From 27a173a945bce1799ace6feff9f21789ab3c0ff0 Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Wed, 29 Apr 2026 14:54:20 +0300 Subject: [PATCH 1/8] feat: Add Azure Bastion and Jumpbox setup for secure access - Implemented a new script `0-connect-jumpbox.sh` to facilitate SSH tunneling to the jumpbox via Azure Bastion. - Created Bicep modules for infrastructure components including: - Azure Monitor Private Link Scope (AMPLS) for telemetry over VNet. - App Service Plan for hosting container apps. - Azure Bastion for secure access to the jumpbox. - Jumpbox VM with necessary configurations and cloud-init for environment setup. - Network setup with multiple subnets and NSGs for zero-trust architecture. - Private DNS zones for service resolution within the VNet. - Private Endpoints for secure connections to PaaS resources. - Web App Container module for deploying containerized applications with VNet integration. - Added a backup of the previous Bicep configuration for the web app. Co-authored-by: Copilot --- README.md | 52 +- _assets/ZERO_TRUST_ARCHITECTURE.md | 191 + _assets/zero-trust-architecture.mmd | 102 + _assets/zero-trust-architecture.png | Bin 0 -> 768266 bytes _assets/zero-trust-architecture.svg | 1 + api-app/app/core/config.py | 20 +- .../analysis_workflow_executor_service.py | 237 +- .../whatif_workflow_executor_service.py | 242 +- api-app/app/utils/ag_ui_event_converters.py | 7 +- api-app/infra/bicep/main.aca.bicep.bak | 165 + api-app/infra/bicep/main.bicep | 133 +- api-app/requirements.txt | 15 +- docs/diagrams/private_architecture.png | Bin 0 -> 1495332 bytes docs/diagrams/private_architecture.py | 171 + infra/0-connect-jumpbox.sh | 82 + infra/1-deploy-azure-infra.sh | 69 +- infra/2-build-and-push-images.sh | 84 +- infra/3-deploy-apps.sh | 113 +- infra/bicep/main.bicep | 313 +- infra/bicep/main.json | 43429 ++++++++++++++++ infra/bicep/modules/ai-foundry.bicep | 69 +- infra/bicep/modules/ampls.bicep | 71 + infra/bicep/modules/app-config-store.bicep | 30 +- infra/bicep/modules/app-insights.bicep | 25 +- infra/bicep/modules/app-service-plan.bicep | 41 + infra/bicep/modules/bastion.bicep | 53 + .../modules/container-apps-environment.bicep | 14 +- infra/bicep/modules/container-registry.bicep | 41 +- infra/bicep/modules/cosmos-db.bicep | 29 +- infra/bicep/modules/jumpbox.bicep | 120 + infra/bicep/modules/log-analytics-ws.bicep | 8 + infra/bicep/modules/network.bicep | 236 + infra/bicep/modules/private-dns.bicep | 68 + infra/bicep/modules/private-endpoint.bicep | 56 + infra/bicep/modules/storage.bicep | 32 +- infra/bicep/modules/web-app-container.bicep | 167 + web-app/infra/bicep/main.aca.bicep.bak | 131 + web-app/infra/bicep/main.bicep | 120 +- 38 files changed, 46073 insertions(+), 664 deletions(-) create mode 100644 _assets/ZERO_TRUST_ARCHITECTURE.md create mode 100644 _assets/zero-trust-architecture.mmd create mode 100644 _assets/zero-trust-architecture.png create mode 100644 _assets/zero-trust-architecture.svg create mode 100644 api-app/infra/bicep/main.aca.bicep.bak create mode 100644 docs/diagrams/private_architecture.png create mode 100644 docs/diagrams/private_architecture.py create mode 100755 infra/0-connect-jumpbox.sh create mode 100644 infra/bicep/main.json create mode 100644 infra/bicep/modules/ampls.bicep create mode 100644 infra/bicep/modules/app-service-plan.bicep create mode 100644 infra/bicep/modules/bastion.bicep create mode 100644 infra/bicep/modules/jumpbox.bicep create mode 100644 infra/bicep/modules/network.bicep create mode 100644 infra/bicep/modules/private-dns.bicep create mode 100644 infra/bicep/modules/private-endpoint.bicep create mode 100644 infra/bicep/modules/web-app-container.bicep create mode 100644 web-app/infra/bicep/main.aca.bicep.bak diff --git a/README.md b/README.md index 7124d2e..d23ec65 100644 --- a/README.md +++ b/README.md @@ -124,7 +124,57 @@ The application uses Server-Sent Events (SSE) for real-time updates: - **Historical Events**: New subscribers receive historical events before live updates - **Background Processing**: Analysis runs in FastAPI background tasks while streaming events -## 📦 Prerequisites +## � One-Click Azure Deployment + +Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, internal Container Apps, Cosmos DB, Storage, Azure AI Foundry, Key Vault, Container Registry, and an optional jumpbox + Azure Bastion) directly from the Azure Portal using the pre-built ARM template at [infra/bicep/main.json](infra/bicep/main.json): +

+ + AI Investment Analysis - Private Zero-Trust Architecture + +

+ +

+ + AI Investment Analysis - Private Architecture + +

+ +> See [`_assets/ZERO_TRUST_ARCHITECTURE.md`](_assets/ZERO_TRUST_ARCHITECTURE.md) for a full breakdown of the topology above. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) + +[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) + +### Before you click + +1. **Create (or pick) a resource group** in your target subscription — the template deploys at resource-group scope. +2. **Generate an SSH public key** if you keep the default `deployJumpbox=true`. Paste the contents of `~/.ssh/id_rsa.pub` (or any OpenSSH public key) into the `jumpboxAdminPublicKey` field. Leave it empty only if you set `deployJumpbox=false`. +3. **Pick locations** that have capacity for Azure AI Foundry models (e.g. `swedencentral`, `eastus2`) for `aiFoundryLocation`. + +### Key parameters + +| Parameter | Default | Description | +|---|---|---| +| `namePrefix` | `invstdemo` | Prefix used for all resource names | +| `environment` | `dev` | Environment tag (`dev`, `staging`, `prod`) | +| `location` | resource group location | Region for most resources | +| `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | +| `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + internal ACA). Set `false` for a public, demo-only topology. | +| `deployJumpbox` | `true` | Deploy a Linux jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | +| `jumpboxAdminPublicKey` | _(empty)_ | **Required when `deployJumpbox=true`** — your SSH public key | +| `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client tunneling) | +| `vnetAddressPrefix` | `10.50.0.0/16` | VNet CIDR when `isPrivate=true` | + +> **Note:** The portal one-click flow provisions the Azure infrastructure only. After the deployment finishes, build and push the container images and roll out the apps with the helper scripts: +> +> ```bash +> ./infra/2-build-and-push-images.sh -g +> ./infra/3-deploy-apps.sh -g +> ``` +> +> See [`infra/1-deploy-azure-infra.sh`](infra/1-deploy-azure-infra.sh) for the equivalent CLI-based deployment with all available flags, and [`_assets/ZERO_TRUST_ARCHITECTURE.md`](_assets/ZERO_TRUST_ARCHITECTURE.md) for the full network topology. + +## �📦 Prerequisites - **Python 3.11+** (3.13 recommended) - **Node.js 18+** and npm diff --git a/_assets/ZERO_TRUST_ARCHITECTURE.md b/_assets/ZERO_TRUST_ARCHITECTURE.md new file mode 100644 index 0000000..4bc4f09 --- /dev/null +++ b/_assets/ZERO_TRUST_ARCHITECTURE.md @@ -0,0 +1,191 @@ +# Zero-Trust Architecture + +End-to-end view of the Agentic AI Investment Analysis sample deployed with `isPrivate=true`. Every PaaS data plane is reached through a Private Endpoint inside a customer-owned VNet; there is no public DNS record for any workload. The only public surface is the Azure Bastion control-plane TLS endpoint used by operators. + +## Logical view + +```mermaid +flowchart LR + classDef pub fill:#ffe0e0,stroke:#cc0000,color:#000 + classDef vnet fill:#e8f0ff,stroke:#1f4e9d,color:#000 + classDef pe fill:#fff4cc,stroke:#b58900,color:#000 + classDef app fill:#d6f5d6,stroke:#2e7d32,color:#000 + classDef data fill:#f0e6ff,stroke:#6a1b9a,color:#000 + classDef obs fill:#e0f7fa,stroke:#006064,color:#000 + classDef id fill:#fde7f3,stroke:#ad1457,color:#000 + + Op([Operator / Developer]):::pub + Internet([Public internet]):::pub + + subgraph RG[Azure Resource Group] + subgraph VNet["VNet 10.50.0.0/16 (hub)"] + direction TB + subgraph S_Bastion[AzureBastionSubnet] + Bastion[Azure Bastion
Standard SKU
*only* public IP]:::pub + end + subgraph S_Jump[snet-jumpbox] + Jump[Linux jumpbox VM
no public IP
UAMI attached]:::vnet + end + subgraph S_Aca["snet-aca-infra (delegated)"] + ACA[Container Apps Environment
workload profiles · internal=true]:::app + APIApp[API container app
ingress: internal :8090]:::app + WebApp[Web container app
ingress: internal :8080]:::app + end + subgraph S_Pe[snet-pe] + PE_Acr((PE · ACR)):::pe + PE_Cos((PE · Cosmos)):::pe + PE_Blob((PE · Blob)):::pe + PE_Ai((PE · AI Foundry)):::pe + PE_Ampls((PE · AMPLS)):::pe + PE_Acs((PE · App Config
optional)):::pe + end + subgraph S_Build[snet-build · reserved] + Build[ACR Tasks / private build agents
future use]:::vnet + end + subgraph S_Mgmt[snet-mgmt · reserved] + Runner[Self-hosted CI/CD runner
future use]:::vnet + end + end + + subgraph PaaS[Private PaaS · publicNetworkAccess = Disabled] + ACR[Azure Container Registry
Premium · admin disabled]:::data + Cosmos[Cosmos DB
disableLocalAuth=true]:::data + Storage[Storage Account
allowSharedKeyAccess=false]:::data + AI[Azure AI Foundry
+ OpenAI gpt-4.1-mini]:::data + AppConfig[App Configuration
optional]:::data + end + + subgraph Obs[Observability via AMPLS] + LA[Log Analytics
ingestion/query private]:::obs + AppI[Application Insights
disableLocalAuth=true]:::obs + AMPLS[Azure Monitor
Private Link Scope]:::obs + end + + subgraph Identity + UAMI[User-Assigned Managed Identity
AcrPull/Push · Storage Blob · Cosmos Data Contributor · RG Contributor]:::id + end + + PDNS[(Private DNS Zones
· documents.azure.com
· blob.core.windows.net
· azurecr.io
· openai / cognitiveservices / services.ai
· azconfig.io
· monitor / oms / ods / agentsvc)]:::vnet + end + + %% Operator path + Op -- HTTPS 443 --> Bastion + Bastion -- SSH via tunnel --> Jump + Jump -- docker push / az deploy --> PE_Acr + Jump -- browser tunnel --> WebApp + + %% App runtime path + WebApp -- HTTP internal --> APIApp + APIApp -- AAD token --> PE_Cos + APIApp -- AAD token --> PE_Blob + APIApp -- AAD token --> PE_Ai + APIApp -- optional --> PE_Acs + + %% Private Endpoints map to PaaS + PE_Acr -. private link .-> ACR + PE_Cos -. private link .-> Cosmos + PE_Blob -. private link .-> Storage + PE_Ai -. private link .-> AI + PE_Acs -. private link .-> AppConfig + PE_Ampls -. private link .-> AMPLS + AMPLS --- LA + AMPLS --- AppI + APIApp -. telemetry over AMPLS .-> PE_Ampls + WebApp -. telemetry over AMPLS .-> PE_Ampls + ACA -. logs .-> PE_Ampls + + %% DNS resolution + Jump -. DNS .-> PDNS + APIApp -. DNS .-> PDNS + WebApp -. DNS .-> PDNS + + %% Identity attachments + UAMI -. federated on .-> APIApp + UAMI -. federated on .-> WebApp + UAMI -. federated on .-> Jump + + %% Public boundary + Internet -- blocked · no DNS --> ACR + Internet -- blocked · no DNS --> Cosmos + Internet -- blocked · no DNS --> Storage + Internet -- blocked · no DNS --> AI + Internet -- blocked · no DNS --> ACA + Internet -- allowed only to --> Bastion +``` + +## Request paths + +### Operator deploy flow +1. Operator opens browser → **Azure Bastion** (HTTPS 443, Azure-hosted TLS). +2. Bastion proxies SSH to the **jumpbox VM** inside `snet-jumpbox`. +3. Jumpbox uses its UAMI to: + - `docker push` to the private **ACR** via PE (`privatelink.azurecr.io`). + - `az deployment group create` for the API / Web container app bicep. +4. Container Apps control plane validates + schedules revisions; image pull happens over the ACR private link. + +### Application runtime flow +1. Operator tunnels browser traffic through Bastion to the **Web app**'s internal FQDN (`*...azurecontainerapps.io`, resolved to the ACA env's static IP via the auto-linked private DNS zone). +2. Web app calls the **API app** over the internal ACA ingress. +3. API app requests an Entra ID token via the mounted UAMI (`AZURE_CLIENT_ID`) and calls: + - **Cosmos DB** → PE `Sql` · zone `privatelink.documents.azure.com` + - **Storage blob** → PE `blob` · zone `privatelink.blob.` + - **Azure OpenAI / AI Foundry** → PE `account` · zones `openai`, `cognitiveservices`, `services.ai` +4. Telemetry emits to App Insights / Log Analytics through the **AMPLS** private endpoint (`privatelink.monitor.azure.com` + `oms` + `ods` + `agentsvc`). + +## Subnet layout + +| Subnet | CIDR | Purpose | +|---|---|---| +| `snet-aca-infra` | /23 | Delegated to `Microsoft.App/environments` — ACA internal VNet integration | +| `snet-pe` | /26 | All Private Endpoints (ACR, Cosmos, Blob, AI Foundry, AMPLS, App Config) | +| `snet-jumpbox` | /27 | Jumpbox NIC (no public IP) | +| `AzureBastionSubnet` | /26 | Required name for Azure Bastion | +| `snet-build` | /27 | Reserved for ACR Tasks / private build agents | +| `snet-mgmt` | /27 | Reserved for self-hosted CI/CD runners | + +## Zero-trust controls checklist + +| Control | Enforced at | +|---|---| +| No public data-plane access | `publicNetworkAccess=Disabled` on Cosmos, Storage, ACR, AI Foundry, Log Analytics, App Insights, App Config | +| No shared-key / local auth | `allowSharedKeyAccess=false` (Storage), `disableLocalAuthentication=true` (Cosmos), `adminUserEnabled=false` (ACR), `disableLocalAuth=true` (LA, AppI, AI Foundry, App Config) | +| Managed-identity-only workload auth | UAMI with scoped AcrPull/Push, Storage Blob Data Contributor, Cosmos Data Contributor, Azure AI User, RG Contributor (jumpbox) | +| Internal app ingress | ACA env `internal=true`, both container apps `ingressExternal=false` | +| Restricted CORS | `ALLOW_ORIGINS` env-driven (no `*` in private mode) | +| Private DNS | All PaaS resolution via customer zones linked to the VNet | +| Telemetry isolation | App Insights + Log Analytics scoped to an AMPLS with `PrivateOnly` ingestion + query | +| NSGs | Per-subnet deny-by-default with explicit Bastion + PE 443 allow rules | +| Single public surface | Azure Bastion Standard — one public IP for operator access only | + +## Dual-mode (`isPrivate` flag) + +The same bicep can also deploy the original public demo topology by passing `isPrivate=false` to [`main.bicep`](../infra/bicep/main.bicep): + +```mermaid +flowchart LR + classDef pub fill:#ffe0e0,stroke:#cc0000,color:#000 + classDef app fill:#d6f5d6,stroke:#2e7d32,color:#000 + classDef data fill:#f0e6ff,stroke:#6a1b9a,color:#000 + + Dev([Developer laptop]):::pub + User([End user]):::pub + + subgraph PublicRG[Public demo mode] + ACR[ACR · admin enabled]:::data + ACAExt[Container Apps Env · external ingress]:::app + API[API app · *.azurecontainerapps.io]:::app + Web[Web app · *.azurecontainerapps.io]:::app + Cosmos[Cosmos · public]:::data + Storage[Storage · public]:::data + AI[AI Foundry · public]:::data + end + + Dev -- docker push --> ACR + User -- HTTPS --> Web + Web -- HTTPS --> API + API --> Cosmos + API --> Storage + API --> AI +``` + +In this mode there is no VNet, no private endpoints, no jumpbox, and no AMPLS — useful for quick demos but not for production. diff --git a/_assets/zero-trust-architecture.mmd b/_assets/zero-trust-architecture.mmd new file mode 100644 index 0000000..d3855b3 --- /dev/null +++ b/_assets/zero-trust-architecture.mmd @@ -0,0 +1,102 @@ +flowchart LR + classDef pub fill:#ffe0e0,stroke:#cc0000,color:#000,stroke-width:2px + classDef vnet fill:#e8f0ff,stroke:#1f4e9d,color:#000,stroke-width:1.5px + classDef pe fill:#fff4cc,stroke:#b58900,color:#000,stroke-width:1.5px + classDef app fill:#d6f5d6,stroke:#2e7d32,color:#000,stroke-width:1.5px + classDef data fill:#f0e6ff,stroke:#6a1b9a,color:#000,stroke-width:1.5px + classDef obs fill:#e0f7fa,stroke:#006064,color:#000,stroke-width:1.5px + classDef id fill:#fde7f3,stroke:#ad1457,color:#000,stroke-width:1.5px + classDef dns fill:#f5f5f5,stroke:#616161,color:#000,stroke-width:1.5px + + Op([Operator / Developer]):::pub + Internet([Public internet]):::pub + + subgraph RG["Azure Resource Group"] + direction LR + subgraph VNet["VNet · 10.50.0.0/16"] + direction TB + subgraph S_Bastion["AzureBastionSubnet /26"] + Bastion["Azure Bastion · Standard
(only public IP)"]:::pub + end + subgraph S_Jump["snet-jumpbox /27"] + Jump["Linux jumpbox VM
no public IP · UAMI"]:::vnet + end + subgraph S_Aca["snet-aca-infra /23 · delegated"] + ACA["Container Apps Environment
workload profiles · internal=true"]:::app + APIApp["API container app
internal :8090"]:::app + WebApp["Web container app
internal :8080"]:::app + end + subgraph S_Pe["snet-pe /26 · Private Endpoints"] + PE_Acr(("PE
ACR")):::pe + PE_Cos(("PE
Cosmos")):::pe + PE_Blob(("PE
Blob")):::pe + PE_Ai(("PE
AI Foundry")):::pe + PE_Ampls(("PE
AMPLS")):::pe + PE_Acs(("PE
App Config")):::pe + end + subgraph S_Build["snet-build · reserved"] + Build["ACR Tasks / build agents"]:::vnet + end + subgraph S_Mgmt["snet-mgmt · reserved"] + Runner["Self-hosted CI/CD runner"]:::vnet + end + end + + subgraph PaaS["Private PaaS · publicNetworkAccess=Disabled"] + ACR["Azure Container Registry
Premium · admin disabled"]:::data + Cosmos["Cosmos DB
disableLocalAuth=true"]:::data + Storage["Storage Account
allowSharedKeyAccess=false"]:::data + AI["Azure AI Foundry
+ OpenAI gpt-4.1-mini"]:::data + AppConfig["App Configuration
optional"]:::data + end + + subgraph Obs["Observability via AMPLS"] + LA["Log Analytics
ingest/query private"]:::obs + AppI["Application Insights
disableLocalAuth=true"]:::obs + AMPLS["Azure Monitor
Private Link Scope"]:::obs + end + + subgraph IdGroup["Identity"] + UAMI["User-Assigned Managed Identity
AcrPull/Push · Storage Blob ·
Cosmos Data Contributor · Azure AI User"]:::id + end + + PDNS[("Private DNS Zones
documents · blob · azurecr
openai · cognitiveservices · services.ai
azconfig · monitor · oms · ods · agentsvc")]:::dns + end + + Op -- "HTTPS 443" --> Bastion + Bastion -- "SSH tunnel" --> Jump + Jump -- "docker push / az deploy" --> PE_Acr + Jump -- "browser tunnel" --> WebApp + + WebApp -- "HTTP internal" --> APIApp + APIApp -- "AAD token" --> PE_Cos + APIApp -- "AAD token" --> PE_Blob + APIApp -- "AAD token" --> PE_Ai + APIApp -- "optional" --> PE_Acs + + PE_Acr -. "private link" .-> ACR + PE_Cos -. "private link" .-> Cosmos + PE_Blob -. "private link" .-> Storage + PE_Ai -. "private link" .-> AI + PE_Acs -. "private link" .-> AppConfig + PE_Ampls -. "private link" .-> AMPLS + AMPLS --- LA + AMPLS --- AppI + APIApp -. "telemetry" .-> PE_Ampls + WebApp -. "telemetry" .-> PE_Ampls + ACA -. "logs" .-> PE_Ampls + + Jump -. "DNS" .-> PDNS + APIApp -. "DNS" .-> PDNS + WebApp -. "DNS" .-> PDNS + + UAMI -. "federated" .-> APIApp + UAMI -. "federated" .-> WebApp + UAMI -. "attached" .-> Jump + + Internet -- "blocked" --> ACR + Internet -- "blocked" --> Cosmos + Internet -- "blocked" --> Storage + Internet -- "blocked" --> AI + Internet -- "blocked" --> ACA + Internet == "allowed" ==> Bastion diff --git a/_assets/zero-trust-architecture.png b/_assets/zero-trust-architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..55a46fde2ceb7964916e8e317963a77d34673a13 GIT binary patch literal 768266 zcmeFacTm(>)HcYB0hAFiqLN1u5dkGgrUg_)1QZ06s3JK^PTe4&s0fUpAQ>eINY1eZ z1SIF2bEe5OG)?d6#yIa+wYBwqwYz`JEeo;x7j8J=InO!w`r?+n^nv{+_mh#49gw+x zMUjl`P$c|XLGdSiA}2?-4uAb&r6?^)mRwIiMMlOuT$F3;NeUoXd+v?i$&hP@_`+3QEJ ze{7*YCM4{CpMb=*gzy<2b>jNNO1wSJTsZd_~g@9UUEKdQ8*sqm&N4?jqHoW;9C-zVBL zK23)*RxX4Wxp{bXy3I>0P-?kd-HZId=2U+rZcS`XWMD(jlPd4xnN^`wN%8*RVp6;KiW6%oa6+^!V}_WN?v`)E0g zdB1!)$KqkwqJ>`y^z{-8Q_Ekjr^~lP=*_ghY)kBr3+A&LD*ZrH`uw1R?+GjI*?7Fw z#zGmVs-}(fQbmDv72Sow;V54-m(ka9ft>2Rs4ZFUqLt~fKo_w!deYjtmc9Nik%IJc zp@OGQ+zb=Ot@WhTeKnwWx|Y?HrV~QNU@1k>m(PIDN?Fa{-YhuAt(9%i)J%=&ZO%0G z@65olEn!Cv`{iRwDH}G2sL@tm4o+1qn)Uh2x6e&J*@eq73p?!OLmJ=bq3b`!XZzAi zl{KV~l{idu=aIyCZEY9iP>4BK_du3uPj>#G8*iL~OIEJE4Q?$dQTw>0{df?&dbWwk z#;BQ?6C;!4-SkIYHQZ>eIQcLP5|fVJ(yiLsprqy23JB|)#SNhUX0NuL?-fFB_T~(5 zY2_^y1#o7F*w%_og!Xf)XMZdYOwdN7BE7=@ zn^T_{%M!vAwtyJ^lb`zO)7Dek{R2ol-FsaDy}hCS@|%iqKQAw@BAZEP>c&{0HupKT zv%aH-6?lBP6WH<5rJaJj8fn7_$@+NhbB&(--H6Bw@Kg;7??W<9}Y zx|t(tzBViHjEdo{i59ISwk2X)#ABgV$sbd+9uO_olW)@#6WFh!rnbFkN4;lHhP=>N zt~P!;dGu?cgUbn?(Fy+f3#hFXCrlA*m*@qL3%0XfN00XK@|qBqd5dkux60kNU5N+CS_V zeYW1We&xZ?*0lD<3$}1Hb~uBay7){M`#`@Iay99ZMT?v&<4r-k!JKTpx_l;r{iEAW zORb_(6zJ{MTpR|SWrvw3M>B(6@zYKu=*tG!HAe>_@Kbe{j*=$bwd{vW5iGo;GXIW8 zSB2ueHkvp1Qr+3}p@a_fvA1su2V&)FMm@MRmo`^LqBdCz>@cXQ7*#0>A)z{Qs=~r! z)C}TV@%3RnnwC{v94epYTH{UC)VkY~ddvzJ=c7Lrj0aOLFLj&r-VI)PLM<+suUViH z7i!tdBKEK@*hVRC`=ZA`Ax?MFXZrkDYs}C{`$KV>$W?*#jEn$oZU<1?nGW;()pl|) zjnQB_6~y?3g33D3{S$ALeALq(&VeorSTg!XP=@P5azqbakvDQ^*lkMkpW!tXm2q!@`Sqet z8hMvaL>G5RbmNldIv1Pd1n?$v-PC?L?I6xs#vKT-)gTux3+_0|{ny6E8ErmNg18g5 zQo^m91237K4->LN!2&*|^qS9~2_&p)Ba+IKNXp^bK>HmnSl9>g&nQ%(tcl{|=!hR3 zT$!>W|10IRH5-cLUQuXzaDXE#92!*jA@_#kd1?;o+ASki=z$LQ{}JR@ngMJ9m;b@@zL(@~TRD%y710 z!Zu(M9oGBM@{D4RD`N46@W!q7oM(6Ln7F_?xsz)bSPY5CpzRvO1Uiz`1w0zjguHm& z6GE1=l^hF~3v835C_r!6!-TW&zJ%jhj;r|t1XTSV+R%GmZMp0H>c!iuDbd+d=h+<) z@wj{&k9; zLi)KQH?7g5e(F*bz6kN5a3?eI);4U8OTpSpj(XV&Rn0ccHZJ1)*>_nM51K-S%)@QF zt2`YANGmhA9Ah@SZ^wd>ZApPs<@IRHm{F zfd(C|!mf7EGERRNat4tfIP3NBurej>v8ObCe{* z5>U=y->aCr?wUvV2q$cS-3K&~{J8Mis~o$bdm~A6T^VeKXPj1r-^+&yw;_brI=N2= z4Fh(?^;}S2n5}YvvHK|}!26=-^S#V+hnhE6 zXX0Mw>eU6e=B|A`74nS6@2$`sxsdiPt*UV+CroN!x`WldtL1Bt;!2_$dOJ*w<#}Rs zDtlqxR8q8Z03T;&5^x+FfoSJhkA2jbu8cSrLeILx1Mi%*Ay0L`l733Rw{L^~YEKzh zVc&(OkxW$K1mG9=rjWpn*$I}mmVZu&S9LXmQf%#h7Cxg^i{URP_{GCS^DGtyjZXps z6XtPRqw_ygcU?Fie3i>HUKuf6>_U&z%4GKXKAY)Q!`|E`iT)(HkN|-`>#>iw(V9h$ zedeg;f|(Swphsh5$-%0)mN-OHWQln5mpjw8rTaAFZaR#{1dfZZG`<6 zA1#cBn8(=)-sGyPF)moIK;j}MP_&N#s6VdC?uv-B6JKBg|Q#<}q%M zP^2sIKDpY{sxa*#WYvGuyCY?Q&wBDBO{okUGTwz?weC=sp3a#SBI8Mwgg{k~zj{^S zM4)%>3(TEPK*?0BO-7BVBx}$~PJ-uNYO3&#!8u<^2&QBK;nB7z3F0mmoF4TrcuF%~ zhpTyZAVfXK?6vb|ztfDdsM%DrGK+_NShq6bu2yl9iq}D5JF~!EtB&O0A&n2Wqn-gq zkfLB^Wtv?sc=U)bSv949dp_dj<~1Ms0;l!)ZaJQ*zx-pQF1+<2VzX(LALVx#wO-IwbszLh%F`#|V`u-z z+hq^R_RcZ*W*NLbDtY#tTJd8Y!|6e{JzoAr9pX*5rFGfjJ13hC=a?nw(yD6WH&;EW z7~Z|Ypb1qFopPhnbe3jDd=&&gKLy7jqYG9=7s3pOD*K^QJGCsMCV2jIjo;l&1H;FQ z(=?@l#jP77DJ`O13#priy!!QsuT@M|H{+u7L-`E#ynW%3eiG~Rn*P#-c-uvZ{!3#p zmtl_6fQ^TT+W@L&=~PO$A;h9bG1!p;51Lr{Fim`t>44ToDdkfZBJA=*9z@i+6=H`u zWS(^clyHwYPMVShA=d99GZiI=%A50QnS34=^Lg5Nv*{@vSRveOKZ{3)wl=neoKA`Y zeDZ3Y0PRzn%{Baud-pZ~Y$+nDv`iU9vSrM0;9WXC-OJIf$u2G3$m!qwEFlja5te%9 zEZ}hqfUi4~D1a!@eRKUtyD^AP!C>%<}9&DC1=it(MtHEzK?^eS_CkhHFV(WZItJtRf6N0r;J zzL2Pmw?*(KO>HfsgG~^E&R8Xg7`V6xPD-BT;9%m_Tha|YAir4#@gy7Dfa46_YP=9+ ztRB{eTD%jxP^R;Y3O~jsJ{+K)d}Hrnw)$L%R3XaGfQZ7+Z+)U3Ig>wwvRv>Iz5ltq zYOr3!<+h4Sc(u@w5gv1{Yzj|?4{|+Jp zT);?$m^G}d!%EZRn3yr8*g{d=>YA)~4fpg{3nA8}+^@%}ao2ja&F&7tpu~+8zZn)D z9*+9BUN{xYp^>!K(yAbEJF8;VNlB3^oW)5Tz@a_Knddi69Ch1DVN~5nIei*E> z9d52H(Iq%yfTJr6^TDe=7)**bL5&Z<6$GMsy1KF1XSb>p%xdfFZ&VCyuWeLKdqYG6 zBm&cPW=l&8rWhA1;Xa@Au~Xcr)m++pvw+47LN+2etrIiqOqD2mhEK>O;c?^Mp=yqX znPyfDnJ=JG{D?0#9na_x7`qQ2#&9No_GFuGyil5h?}LrGoB?4jkK2Ls(s1-Ea%Zz#_z4*K+Qo z3#Q$niz9JNgW`sUhAbY>4$z5ijEYq<5nOVnTjFrwivSfVT$+@nYEQ!DpsP^MgP2~M zj?cLH0)Bz@kFBpieX4Cyz+AK({byGPGQOZK*EB;fNb1>N6f8tAytOz%$8RKPJBt_S zwJ?mjc0g%j6yW}1x&DA{PmaGfdM!%}KzSm{zZj`dfM1*Od+g}AspE^Uv_m@?s;KCt z58U??^kGCQq^sX2f->!`;mRr@7LRM*C$+3^Z)Y@!V;4^o%mQrIvW`_U;-1R*UmKrT zPe7%D$tAvW8o4@SR{@vZMS}gUWE#+giLdf;Ah&In(LRaTeviV}U$5hR?cY)e`~U<4 z5QXsipCU&Y3k*27?V|om9`GA87;jAB@-wITygXYgNf-dpPuD&vB~jVXVTzt@Pxko%cvZAC{y59`0?RxoKNM`5(oGOK-AG)!P$QQ*4)e zGxQsrFi8Vh#&*l&b-{dwg$-8cIP3}u+ZE3a_yWu=ZqQgb{PykJ6yQ1h&v+y1yn3>e zhTW+z>FVq2>gmm5LU*0Ne(##uk|1;h698TT@3-31pfpA;~A6WB5Nd4hh_EjlI!c&llp z`W?O&E1E#(L}a*sHVeTYB;?MAmv{f9JIOr5GBX_k1QR0&y2@}$(j_$B-|0EB?Is8X z5x80RG=0+AkX=y`So=o2e0#^B#s2{Y_Wv;f{r?LV{J&0olY#$#Bqjb^j{lb9--)XK zWa2-W_)jLj$-w_e?!1J*zHGiNQT+t!pF0bA0u7c9&(j%&SK-L+{r@UX`E$?jwI>u$+ z0uHfT!lHDa_IWO@{<3OMCRFtM_d}^=6^xI+pAG6J1Q#KI?|Qm=dh6Lyvk(No#}67b@aRKjHG>WK;-+lcm7_v_J39li=396TwQID!d{6B_dmPFE1`RZ z(2&q`Snj`@mu_9@!{EO6C>4|V)?^f$^UB|J0%p$mRR`HXE@N|Z?z3mV*45!(MSL$Z zY?S(Dup8U@kn1TTmCF-o$h?=xu*nt8rpx;K`>$E3NJ*86t@q-Fy|``a3%8ayT(D&; zQ1~-Bo6#^k+xIpwaKK@LJCI8=dzsUX`MALR0-YJQN}9W;yW4TOF6X@ZnikD&yZ()V zrYavFAHq6en-96kWS94~gq&%m2%{Mi(u20zUhSCZvmdDo)8@Ln(5_Dq{l1iplHZon z>^>}w=K;Fx$2#RO`b+%$b-}A9G`k13#+97}$2!o(+}-m~<~ZCWtzcke1Vub?)z#IE zj+5(od3f}~Qyq8akBN!6wVV_~BcuIpgSjKc7GGIBt*tY;@1;MQ?+x@7vt2Udax%~C zv%{};9AFYZFTAnRlJQ}#_~5B)H-jvlH8i${%e}N64d`yamx|z zK~98PsYpnaOt%?-2>IhX6Ik@mH=nB6ms7mz4U0w3pb%oaMA$$eI5{<;JTQYT92@hX z?1uQ-o3WY!LeGHKUv7iZ{;{YLI@O9VUqC5l)BIEN#zkh@lL&L>Ov0O!`(C_w0c%j! zWIM2qb}`LdqTO9m#TH@Rbd`2&>;QIB7xD)}PHW2&G#d6p8~$hHUdgN6xzlSmfR~^N zwI2>F-l$6)9v*gM#x4b-tp}f+a>38w0=P8SD(IHkZXO?KZ?_#lqW8Hm^YSid_n=hn z-lY-4yY5;dUba@p_FZFX)pWoJRbhCTra{coSbM3HMCQrtvTi@&}?j0tKTMmSblx|G=*D5#dy6gklg#+ zB2!Z@9D32W(Hk1tJ9)qSWpjT1vq{KOQ4cuOae)TAG2bnAE?;gy(}V@_87={RElm6A zZW@npF4PU#3FTyGU!rj1H?B@dFbd#QXABdajJz!}ker<@F8ndRYy0adbMb}GyCU!{ zM7d(VSyd&oZ{K2A3Kom?@W6ig;t?JFrL*%L{G1FFLHqgp!!m)MSJ&0m!_TTI+BGS- zkA`Xw!qs;X^47&`-NxMLEz5iN?oB*Gqwq^hOPecGpzQv^q~_=67aF>irfOi;pKsI_ zK~5e1E<7B~?h91@Hf-RMx zd8Dg5XF2Tp2R_O@KYxy$or(V3dHUR%^suV}WEy#vx)Zghd_^r=L0{4ZsgC*%5uRP z^%(Z{x3~90>+V+39_Z}u&R$MTOWTO*sH&+sae>*XGqr@3)m_?$p2wtfu-=?l3)|?< z4)xJxkVo3ynm`~{Ta_SpHPe%Wd3RAq9)Vwxq7phSARvGsWUQ`0E@N?P*#%b4Qmg*~ z?mWP2vdaqXz4Qerq>^>$n>X)*gO?hlL)@6Z*3c~sIoEpbK~o2;PWd0)Epa+sCyeN&+k1{)h&hDZCj32zlHT!0;>x$1fS>hS}s>=v0S`( zk%fijWO`DPX`mA;o6CZg8asPcdAa);`SaUvm`JtGeciEg>NzIy{h5X{<8^Hzmy}KW z3$xPGr{m+aj0_FExsD5GS~N$O#mR}7Ee!4|rGiYu=i(28IANEe1b_nB~7$h!6)Yy=dM~M=g#mi1HEUfnqNT zH?TfOIaC4y&2Qeg@zQr-PN1K1|K9otCNK^Be0-2vLDqW`O-p3laag|3uCtIOo8v(n zwQU~ds1D%PE_zf|?a3It*eJz&&6n|_Y4>BcPz!6dZZj9Tqi|c_9TRZCk}6PQJmM{& zW!t3-E?=PEeuNTI-%x!lRX~huA~~Ek##BRsgJFCZAKF`=fw`t|gEBhXrOL4(3F;jr@%!B!wd_Pp? zDXkxl+6)rYc(5=i(NyBEAikOxP6uyw)q+B%(s(5{O{==A)Z+FnN(y~e8)JlQ2dh;% zfj+0<7uvWcU)08Ui0t1Ygjf!^C0}R{B2qO3Di!YOhw(#+1IBqm#8-6bYiqnxnLH7w zeXe{bhRXv3;>K)XV1S*`jwqN(E^uc)d+r=$zaCnbxc-qRL33WK5S!wHOn(0!#(7v? zkOfMaDcnTnvE{-1#&D;pX_z?Pm-1NQ(cL9N6QOT|y4bk5=II7dLoS)3hF=8X7Bh&WiWI48z_@IT zO+c!*Z@nMqKjMp+E~lN)b{JFO&K=B8PhU!n0$onE`+^nYx{S#*Y>8Dj%Nqmla{__d z@FheHs)6b@Z22$(sF0Yf@9aB;Son-AFV916X1WA45DOMvwW4G7a13@^sP<22w$op< zAD8FRYS|l^dTO50_EOa*oHz{heiqV zy%ID@{V~zeP`ws!*Y6;m*+;uu0>%jlWG<@%#m3ETK4Asmb2%$T^W@>fEkYT~g5u)a zJp(jUK_tmRcX*Cwmu{VW^t;WBe^2LsEV~&eE-<`Or zr$;nI3qzdFEyRJjicNK-G#n6co+%+W7anx&EtuaNc}lzeS%t`G^g-ExtJXxDsy4oV zy;$|uEsF-R_0iGM*{Fg}5_BBYZtbO4S2~-;N+VM3K)Pe^~)fOkdUsbs>0*e2g(@ePM*v*iN7HyS5;m8($|;ZoF*bHe963@ z{>2qbE30*j*W=>>FJHbyL0!^ZNZzuurDefRB?I=#+#CZnVykr*wJ76@E2y;$%*|kH z`_328ZAWn;IN1YAUAQ@&C=KOc1p|1qfvlay;Q$NyjGF0KpDDMvxHtlV;5Pp}-;Hcq zefsoiK_LtC~@K%M+Vn!Y-|usbT~J7aK1;^o4Dr0;bmml zH^U<%T*cUxN+z_`7PbjQF$v1w1ZJdEVzrY!j1Tmy0reR_-Ynr1O5)iP| zhv`>Q?Vz!xhi}A#DkvLy+d4YHe_Hh$U$0C(yEhvE$7|4>oi|H!id1q zb>6f$*B!QAG+_HM;aEIIU&Fd->Om!R^S;87Emy|L`2q}TBFqk|Zna@FPs51Ym|PpU zxwvL`voy{Vt?GU5+@W$O66#~h8st<52zp#9;)hor}SyGdEY zVN7*;hK>oj5|ru=A1+*ksSh87@k7bJeldQ|oc73(U*;f^QfTk=nU3TS~n9)Y$6c;ZpR)R=?t98``G~Cw@QNEIr z(lYF(;hSaN=@0zWYiC60KUuDQBA~rH?Q#ddZgtbWdqLD3X4w8VH_THd|(Q=9U^pVMnyQ$;HLno`|gnq^|C~BL7Kd<{NJ0 z)FiFeyN=dYdeSSz!ERW~wzahp@fW}`5mE}sW$P*_;#FE7mg zi@^0MtEp9gdEwa*jyIB)-jO#)5s-(TyTn~@tg>7XD}nvA{b4_yQQDi$O*S?MfWD%$ zr2&ENmzUW)d5O_}@Q1m0 zk1K56Unt9!_hs#eXCiYdPpf1+NJl3E#kId&yfElay*Agg-m0W<;1>;{ejOezY&-h| z3Sk*ZBP8`>`jT0%pniSmasy)E*GD%&Kj1436_uTf`(>fi(~KzW5a2qidLg!7J6%m% zY;lEVH{euT(gHhj!(7Yu6eDr9LA(uuBd-8p{9>n9&h8?oI(zOUw%eGJB!!Jm<(>@S zA{d=!(*RmQUl2bZUnH-jB&)9O1b>W;!F9t=Cnu*$&ynoO_u1KNo0}C3B7Xz^VnSjj zJJSlJoV3~@ez)=iRwFmJ6aI8|Dl9V|rlqAt4wSi(KFWpffMu9;l9Y6Q_|VxpwdN5J z1okdespj5Hh|LBURB~1pC&bPq`73%2LTm#8pxEYQ6o^US<~nA_ToCodbw1(!`}p_o z^WMK_7yg)HZen7RoMQe;{?esOnBHMyUhHjf6=p~M@u+E+qLOOIUDXckgQqDMy9bO742(=nramno=Vt)uoVk{h=H;t^)n8m( z1oE$G0|3-DyJ|0JFJ4U1SEA0&mnE%;uZcNU&nMIL^<*I1}9O}78aPIpOP_azPc*clha{7(4UKR!mrI8SY7q* z$!_at<8N={Z*6byXussVDK`fS<3HJtON3Jt%5uW zy|VIVWrez*m#3MBM-jL%!9mwhwZJz4=*}HoJ?9ieqEVaBI&d6SK3oTQrD~^Qlu&8A*ZA|9hjdva()2 zygWQ>_^1^=85tSEjq4H2e=r-)V0>bkx;V)(Stz4!CqX7NqF5uh?2A zI9#@y?`Vj|fYbnp9eM$?tg76G>KyA)QO@ENHZ$yMIpz#qnwpvdiU)q4AT=cLeSpGX zxAKY@zj9Kd*UPnC8R_Zbk9GBDQi_Ykh3B0?6+R^&eRxh$EZV>Xw^!LBzO8i+(3=-Y*gtv0Y9Qjul}rf~uLo z@BxOw6T_UFH*fxQYvOO`dg#t^=(A+R?E&It;UlaiB@V@??`VlbpP~IBt@FEa6*Ik=XeBV%0 z1F`P*i4(T&r;iJmwZc~UeIfw3ckGBzU0of-j-q34lt7n$0!U!>Zh;|D%SX+1zx1X{ zgy&Y*e*qLb8( zVOBNMAK6T70uI{Rn%&w8EiEnl@L|i(&ketQ*25fv1^ot8OrdiNh$5*AjRgSLHS1rU z;0+E5fi0U`Kk-PBs+HADFh5<#r>1J|))s{4g@y1l zIy(BoQYiwqGeL97#HuPOWdOMYQwec4H29^W0tn)hCxdUu3cLw0d(P$M?ahAnD+AA{ zD~r@#suPx%B_xPqcD$hkW%K1=lpC`>Zcdk!xx)p4L&&=F_iNa$vhw_t&)KsJA)j|t zh|Cplgx{3IpwXAQXA(d4ZZ_=!0}t-*mF>pfzmESC7#R4^KQz}Av7&&LI#RUJuTM$a z*0;8`DXXZMb!W1xZE$dK0Q~DqJC$zM7i%+f33gdtpl}1n@u5{ z{)fSdtTZw*g5AZ+=EZr|Q_XF4bx8&E3_Op%4wksX1}(L_ci;K@A6C3Z0X)%7Pzy7& zd59!Vgx!O^+W9s!ACTy}5CL+DTley^(k+dxtYprc%mK=FyedrY9#Njf^Z9|$}$E!}5H<7GcX^ z{>sbCr97!P0r8$Y_tJM=NqON3WL*D(qX0T}d=I!qf^KGJS_2Ia=^QR@Zr>|^A3drJ ze<0;G171B!ni_cRFD#ya$=$q3A;KTglKU7$3gGBeYrOx?!g*m;jx;{4h5P}qV8Es8 z{Q%3ZjDH_`@kvXw*r4g^fa83MYtapKRCf+Y% z3z<#Ww411sbPn=_Sw?N$S;jLnAzDbA#l#dYA75XQh0h-@>Rh8oVZVayE%m9@_YVwg zLA#*g=n)R0tDaRLTHS*$t}sFrq~jxWhK-Hw2Oz(k)6tYR(xy59ThrU>LX3sk!1`DC zFgRg{JgHCeoo%&lECQ~Z!5Wx92J2fiyMYpe6f$xqDF+gTK#XtB7bL>YvbL3}47d$7 z9bZYs7)onPMsP7WfYuEEdvEFl_wXIlawrl*{pbVqNTk(`%#r2>~yhO94-eUTO;@3Q0Y-} z2ENfze>O(@NVH>L*}IFUwCx{gA(1+cjz%Q!;z$XSn`plyxxPZ&z?P%40gS_k4J!XEA`ncrU5VROd~D>I1(HLOGUuYf#gX(=@~uV9 zWtBH^1Mvr;?;9eHvXV&g4+?VVHjI;lE#%u<8$<&N&W)B+?J<7UF2b(=#bLGtZyUo? z(#P0XSz(fKJNC>Q>>2C-Qt-^;i;JhmLtF|Bm261#E71B@dk>sEVtaP7?a<-FZ1SOk z4@x~cw46-aKivbvkH*jW&$KH$1HnTja^d-X*vlFkz0orMJ`gZNL^=&B8w~rsYinOYQsm66#%%k0 zPbxUFM&EX}6QUuKF1u=#5Q<$FIMp&g0?7}g9`%n%s1XlIKf<~T;qhE|HK6dslw!34 z>ikG>8L)c_=LKkqX1B}s@_?4}Vp8hiG<8o#;SVt}HmlRCq_}gE6YR%=7&vzzV8TQl zEPtx${KQ<&05@kJ&F&IqRZZo)caPiB-_L=q`>!Bzb&kTVlF^B4_WW#n33(vo&K}7a z?nFxUi6{N%-lU%(3g#4pyeq?9!<_i;%{oU`XYv)#?Lcwn6hQl6TT zs!qPZU)8p|TNu!zK^OI8FkGNl`|hCae(^4t z6Y!{GHL4^&DN+@PjM9}ahZVk5Rz_G>v;Sm0@{4i?P&jHAth*1BwH!Y`Kk&ia+2#Wv zVB%d8}yL=*g!k`~hX z^1qESM*t!l2-Z*Y^V{_0+rXSn05g^W{C=v`A0==a6eO0IzzjqIw9n1O0u!ttBePHB zNQ6o2#|Jwq=?OWBMp4{s2H5jTdaIj1h0N?cgmasy&Ig`QVY21xvNb|vAD|{dwX}etUc*1uUj8T9pJlksd%ZH1Gc?_bRBSGzIbslvqe5c)L}{9<;1C>GmjdmL{sf6 zUeQiZpXA}$0fCKW5YG%5n47z7L&j@sjJvYDe21qc%H(9l->BR4(54mt*>r>9?q6I;LtBqW>@K1{MjA9bKi z=gaehOm@#0w(>I%o_Yppob%enYNR#Q1{Sw;5$cl0$H$@a=lxHyb0ivwDu2K)q7H2d z$}p!$AhMw}Lj~$E9+tlZ-TsuDYfrSI6|W%N*e}9vtpj!)uBD{q(kQfl3~|MTGi0V9 zIuJ8#KCRn5&mk^u2D#j^nhp}b7C8ZLmu&3p6ttV~_2SAu`%`PE1+2l@OL+pTzy;dg z^x-OGTC~*Fd#2j}aA@HJ(OWStgl%Fug19sG`N2~>JUo!8@4I~ZP*>`Mvg)^h_cZRo z89e~;96rLa7oIRWa8Y1YAh{~#U8Qxw^3mdlt2LyezQ$#c0hV{X`trd4LsIl7(Xg@~ z;%L~b3?(;=UEsv~oiH%H233Bn#Hfi_8KYYRq42TY67ur$`dtm#I;k1gPXmPul)kBu{JIO6%Q6fNQj+;GsFOA)3^cH^QIR{ zkBnsgIUN|kckhmy{tX8K=|Ij5#`fx10PquFPM~SI;8&R`AW2FIZU26-ozMWClu}XQ zlz}>eavmc1PEuFZA~vY`$X|AYpaxthM40d{xRtjsdRFR`G}S)0`$WfF;k}>am=z#) zo;3&Zmh#y7T=40?NT(L)vO767qp1DD8+Ii(X4r-9H7^e*NCDPS0~nyLUI0FRau__0 z1k~3ZIr0~vBm}}`@bi-gm7YbPpn{0FdY4S@=9p<(FEsJz<>dkBBnJi(7I3YCEAS#= z>1b!pHJ|fTZud8q_;>8Y8#ks@v=|sKsLZl%miZ~K*vpWBxP7|`Is<_x>}+p`1MzI< zx(!<5fenE*D1S*@kLO(S*ROwVXyC>+LJa2b=U0mQ6Kj%?m>ap%{VozI|m&R z&2`smK-hoEfEpv0H6h%Zy#~_+QhYDx`_jmQl7-s3I#DrAZtdb&YZjtiX#8?;Vb?+~ z9y{VI=CqcXk)f3TozEbC?OF}#+E54(!@}V72~K@QC8d_;W;ja#&K-bu#^WqIy9~&# zoLpNNs49mlsZmo?gXF6usX>DMW?l%{xfTOR6glh=AOhz7H|6AtTnMN(*b%G;yY3ko z89|UBJUOs+fJqq3|0jd6y=HOf2Ww(2$+sTfg#bzuj!gsAy+QlkrV+nhxFt$zfByNW z2Mt_=CTu&kyTIOMXh2#{j1e0iH$Z3)BL-pS=H~kP9ne#u)SR50tSsetZ1u5|jYUrD zkV-c1%ZF;pI6AP4iMhGC)5Bo=1R($w63WZX{VD;G9FtC(^@8#4?yTkK&jmFV6^)Fl zT?&ZZh6&Q0*V%xFv!Rzj`goQVvcwmLz`o@VC&0BODs{Hkow7Vet7sQDlsX&!0aBo1SUVBsnEX?CkgUS6Mx& zRaQz1D5m|;#~=1VG5%4(^}YdEdX=?^_c`-HQzVOK7(vLB*x6rwl8P|D zYj9CUR<-~#Sff?`Z@Ip+e#E{-{t@)DDb~LUjq85XE=W+xecNqGHPnkTIUZj&xnw6Qlmv zKGWj?MMb7w$5aR#3S)ZFq?y?D_aOP;qL4E-^+wD|L5s-dr=*X+{WyC$Mo|bH6}YNk zZcffN1>34LuEm%p0}>PR5}ag0UpqL#($do2UX5+2{(_0fqn~WJyA=q(#K%wRw zB=Nc%=LJT-dNu+CFFxK7NPs)%-hw~65o6T;DQG^1eo|}t*w-f-jUUVO)RMA60iZ$Z z;fewr`SAF0+V{&6V?$?TEL^(@{!zFr6 zR7vsFun}(Dprzt_V>>76K~q&FKtZGg$S&_<86+RPxUpEtgj>g$o0GlN&Yf#MxAQ1I37Av9NJzo}k#DmwSn@yCATHZf%!4M7JMQdncYu8FX9;&+ zlGz#7k0~N+Rq~|Ll6=mgs`$+W2Qw2VwGrqS;DKl7=6<)#WMsD#jvX8K@kvV7V%-__ zGwILNm!8JIB9sqXal$2 zK@cD^lRsMP2cT^LVQumP2Mm<315`6QBauvco)Ed1_T}?mxL^VHu)9zeKmSj!Y^>wzL+25=4$@&kn;9%hF0i;5~ z%;n!*?a4I2#il*kt5Yrd0LQ2^#Lu0(LGk*Ze{S8r{h;#(L~9V&F4pok9JlRB0Nz7N zN=n3LdIgFkm5aP&{LdUcc1+yDANE?HmPV`IesBjX|MBC;{-?l&w&64)*$rDNr1oxo zw{u5`^EV4H3H%>Sq3Z9@^4ggT7cM~E#JO`u9m$$d=@J^M0ay?6i%j=ET0cVR zZ!6@QQk9XbZK^ea+-S$ugaeRPBRR3(U3woe&N1rN($!5E^-ubKQQ1u zd-vMTw9hRJl`S1XAke^UfRS-t@3WJ9J~%jd$+UYCbK=-B+o94uyu2APvVr?qlC{y> za0)H!nKJ+aAo5+CY|;TrWHSyJmMxfc$>$(;P{5}kU%a(cW0a+qGY&hVAlCzBv4Bm9 z0X>ica8{t9iHU}<`aGO)4dpt(5x#FS0D?IKh?X0~!`R0$7|h(9CJv-Vd^I<}7?NsT z#TbyzB^7L9i-iA>C9`@sgJpBc|+T-Npo)-yqSIW$T2w|oazH(sA6`zQlMg{P-y zVq)UIT#O^s!0>dn!6u5nQ8@JMBLb(?$4u`AJh1wk8QUXUHz4Nd!QX)ODFP~rp zr;&-~8@8MYnxBC)_#q7^VA2VPhugD!0Sia0%Y~58u{Y~R%ye^%S0Vm}XSP}2IgjUF zUM&ioDt{~4LSMo9t$>f1zJ2-X)u$%ru-Ad%$dPCl5cTaja~J=qVh9kRup0@RJOO#1 z^wwLMY=Z1^hjtif;y7%BfJDqiyLk;b*xllftM-ohpygU}-!ZQ+QNG^+tS5^2$b%nV z5q_~h0+d*KLpaR`^MT?`;;8bSHpakH?kf78M$-`Zo4VxPi5o7Ei^8qDj2Yz#1MD0dI%jfXOk1Q}QUFjFqWI&rZ1r z4*OfGjE6KHq?zJj4-Qz|e0fy@d<~y@(10P$PET(}5ci3^d2@v23pg8wLx*@QN58^v zVo)o@m~=$M+Qvo<)DY-3*f8Y1Jkj7wFQiD3W{1%Va)Qmt0T*kyH1kiNK3xk@{_vL< zU|)czTk40yI8S*%7Weh-GRSHZX=VUDP`Sc$b>CUZy<5rJ4Y$6<89Q^1#o8yS^q^f_ zeutC>Z>Z@1FUGz*9?SjzU+0`k6AhFicS8|MB)g-VN?8e!(cmbu$sV0l3OOni86|sV zWsj0wWM^0AZSOsP&kLQ;anART-~IT0AAL@7-`9Oz@Aqpw$LoFKi1la}1n}>`xI%ky zUPgvq92w`2uWzrW@c{+2LwILNsRqB3nUUc{3zd<{0dU16lKAniN=_IV)PNM-qeY~H z-Un~+Y=qyS(em5=thw>a0)#6OB(~WI?ryx_H}D_bCKC(iYNundfIK%#zu?gZye{qx z4Yb6&cad+*dup%_kQKeSWnZ44V`QA1$X-y7tQKtxJ|!-$bv+mI>+p(l5apUYPxui= znzWF!5b*XmQE%7~85Z{CGm-xggvuQbt>sCwoS(I-du@cHI8fxJX=9;axT=_ghFA|E zK(XT0V8fvyq%q|_c?t+w(%U2F&MsG^Yl1GM;RKliBtD>sXwCoCyt+L>20>?YJ@WFBL~l==y28%TTeKDBE@EfI&sig-O&i7|&P zmJe~yi|+JFhssJ0V3zvukzgfHA0PH}Nr{P3W~g9p;DT{KP%y@3O-Gz>RII@E1GrG? zFJgm2EWlwtbz=uWJjgw#?s$uub;*f~|4I7;1!MR&?!(;N-X0kc9x(3ML17`Ve@G-U zjO&`;vNz54H6;7Je95Jmby$;2E#)o3^)yGjVp|KoPKgb=-d12fJ+rna?DLpwo-6oh1X_O|l z;p4-t+9!wt7t2A@ekz#u8uB!fzsY-)L@)&I*s(9+-8%zhCctdBn8I2f#vB+Xvyu^9 zlQwiW-H-{{G}h2UF*P#!3Sz9#WA9!P3C4WQ$^$5;k^8JE!QL<$c|Zt4Pd^Srm6HCt zFi=0YC>6mxmx)4INzljJn{BP)K*{^}zi$Tdp}T%kQEF%o?34*D1A}s(HIP(RCsa02 z7KCCrqlX7JBbtPXtg)KQsHSCtn;Z+^^yFjx9$&FId-!A}a6ZSYTEJ*RLb66H&iyNO zU&4K|ogFH;UyoSXk7~Rb4-pyJ*47rE??gMDnuKs&{8#gEdkG*TAj4cvUG+(kpC(2A z+E{{#;e5iv8TG5_>FLJ~VwA!KFI9ycS?Z(6+IVV&8V!U>(m)Lc*1C($UuqsByq(}e ztKuiopYmKz(JI<9Wzbcbv=#9r#w;u_@Z@IbPIY5XpPuMY!_fWiBq!RmU4Out%cYT# zg5Wtd(y7Pm<1RYgg@OmjjYHvvRcksa6zeWIEftj=*{caZBh{L#i%o+wXnkr{s9a-L zww{wLfJ)=5HH?hj(q8MX3WphgSnl@i@rf1(Zl~u&DFDS@Uc8w4 zi{Y1zr6ncNP=Za5ZCnbEjtBm9WTDDEVcvbQv(yhvRrtTZo4vg~ioEUOh5nYr&g}n! zi{V-e1g}=w>)Er$bPL&#CbOpi$;7GMBuz2idG52ekxWqeEld&LQw?Zz_1d*10WX*Z zOtem(Jjv<8dH66=o~n7)+qXCg=Dfp!Qd`B!Dz!i1Ms-9r^wjOB8K+sfe`98Wm5X&Cm2G9UDw$ohCk6abMa^+iYRa62hd4zQIVg~qd{NMBgadC0fJo}x# zX4%=8m<+?s9Oy8b+UftaZ|f=vWI9xL%K*};SI~p}>ip=DE--y}clUo4(ANNA)2Ln7 z(z;jzorGuh7A%@^=osK@#N?2SidTQ3@(uX7?LN7EdLY6KTb6cEesA1V~#(O7sh*$#mfApD56ab z7si^QIKas`8}#(_rY;0u$ef?It=tNh{I47b_s z{+K1;n)nsGc(r?K2Ohel3!}l850X5jUczz_0Tmc}a4C;n(~%Bo!-FLK|epRUI8RP0*Tu zXlXTOSXJWZDk~E%G?&To?v%E+PMe<@KS=Q6>(@6nHDT>&jCG*~g(~wNEmBl9*A2C1 zyNMAE%>T(Knua3>OpXrIUDR}I5wD+C+jOGO@UXg5M zTht%F{_@MeFzjkf2p}{Vx`Mjc_?TKCMl2e>O*fEQl_K@(0Vt4kM1oiA1UNKR1Zg)IHcNrjU+G&wD*e|tqZ&MMNrlg_E0YTa5HS-;QcF+|n{J%j#HY zN(y-yuqxjRD0m)q=MxOY!FZ#Uy#W=Ku&8blk_MmWfkjAoFbr25mfh8LgY~zcv(uN~ z{+n!GWu+oDqT0_}7ewIXbAF!7fY?glc=cN-P6+(;^Kzfn9LSIXvfnM_yv)h zN%g1;@BPDEM0~=a&h=~8esp)AS>jWfcjKOqZ36}aWF^^9^FP;Z;O`%^beF%C15%fh zg_{p}9CVH=d1`3bT0@l5q1EA7W^t_XYgGym5F>&EeEQE*Oi4`_YRSC(EWqLP@=Y`* zZlWl*1yoEkqm+L?8miS{)m-AvRaNJgON)Fr&?eI-Ogmf`TiunlA_xb^^z>s(OUlxW zJ$M7vmxFm9KU!K_3qt6!f?;uFB|0-S?h_Leg#5}grd_rhT^c5pn;02cj(q0VQ^9#m zsfO8eHRvSJAF?YpWl<+1ri0P~I_SzQGVRf`dOqXj%U)?|#pN4DSN@*nq#p{fmm)Ur zfFiEEz$;gfa@3OznvlkyakZ88pi{=C+puXmvs&)#Dmen94Gd}hxe@@0lr+k$?HRCwSW5!HT6OD4US@5H10J& z*U1~AFLQ$l!WErSc6Rp4O$llvKR;_IpGn;L$&)R?daDKt+P{}iSB0Ngj>h?Jo9(H( zA&Uz^<&2to<@dt_a80-Afn}(%(RTTXNxBlh0mQni1?n^imX^gNKev{9L{wBSO6~IU za-c6r_W-TA!Rw}-UkNV$4^WIrj0y~dmgiU0M7RU-adDLTq#m5c*WS~^;Z#^!+WhwF zU0TwK6JI}nmbNHH!b1vYbHb4#9w69pn{z*WAau2~w6w6F?%44nAYcKau6B%N+I7O{ z3g$wgVZoL$XwIlZ{|X`R^wgAM1fWTqGJg?dxw^VK1mJqHCT$4a0e(XyHx{ElQDQQeJ>5^$c9((p-e)LQpmY z1hgRdVsWx_LZ;rFYN~_h4-y|WIQnk_ob)WtX$j}xQcUW&^ed zOy91EA7o%;EM#~z|58|3bptD4tKPn!;*^~nh~eEGC{3Wy0pcUSlGZqF0vrPA<#C-9X3 zE90t)Tw72cn=9kwFPB}HR8_{yvGu6cdPo*RUSkDqQU&%3707lVBD86WrMnS2@4C8I-vQ`4gUE4{c2eHL5z!O z&P?xD*eXtzl!PJXCNy!Vxv{Cmow2;3MXgReg;?c8D~8L5!4wvZ3x~c<02e@EfC{$I zQPa}W5^@o&g0hzaK{n5E12`+~P)heehyU#P^RVn(R3rc?MhF~=Ut#9yVJAX!2L$md z4)~fH0UF%qg92^Gk4>jqTl@PDJDrjK+*=bJRFOo)hm+TdwAO^e<&uhud2gXu!Oy6H zKOH5bGBRw@ksy$XJ7?o?JJ|Xm!v#KYE_m{(Qsf-wnH>0471|RppPi`Ml%prU* zEb&C)C9190%5V|u$;fbzHMy3?qqu=xAUG43Pm4{F)`kwbuxqLYrc&l!b z;PK5BZHh5);csQDIopXDXtcpAK+!Ha%h)YRyS0h>C}VuF-7LiU)AHz3WkAv0N6 znc(}1iXiVT&eBE0-;iNt3Wfx9msS|jU86?#D#3a%MHEX?Rd*i-Vi1~e zs6B1Jx#0w?E?7m7BLi)xAPz6AQoC^@43|u!8v6P*hBgIw59EMzVM%dF!k9UTVD+@L zM!~6;yujTkHq(SjwV%%KxV|bNOoa;c)9c9?*l?jCBXEtlZtTP?m{PqnjjX&X5@=TENs0h)$Ov7&sJFy|llJgMu4m zpC9?1nvR|xot-f#JK)DV+AFkQznKo6(HfTGx5o&nwv*ZSb8=1!{PjHzBtl8^T`0Y4 zWWQj)OM6)Z1fQD&UAM2&P8?W{3!qI105meEb3UNAYrle+kEA5-Ow3aN{W6}gWy_Y? zxjDd}#}OwW=y+iHs}tJj^Al%*5$ryC&58C0Dow~Y!pEQCtM4Yb!J`0aUi3fpcbK<= zEVj;G&cO~T$Lu=TUi8IZ%FE@ORr``)HX6H!SrfxWY-s8ya+rq3$7_OT2*|gybax$z z8|qUiz`Cb_V)6(JtKC00#u4=tz6BOZNy#*CAR;_5QxK9<#9qI9_YPl`L44o-{mAmM zGO{M9LA29o1_y6QFEd#sZMKY*7Altmh>+apV^PjMCJ4*dHY<>_fB$~!l)jnX$&o)*`@B`o9 zMMw9_;mpJ<6kb8Nfp`i%%FI5@78ad_g(Ea^i{fZG5u$RzxSSfefN^f=%2uvh*4tuu zd^|>5MMJ}X7lfS3f^SN+k$Nz5QQ|R6rv*EEUYS{W64aHtwY3_)7{qx>qqd@gheW!D zlnuZe6L^@w974DbD4*M=rCO`4&;yYTkmFuS*D%dAS?cd_MXm+CRJ~>vHSM9bicBp< z!)B}A`B++66#*16khajec8v#o1z3&^tQwZz@2&OPjY0s#XG6>T_pH!uADCn3J9Zc& z>IBUr)W*SSiy3wLT(na&=l5TFiup!TJKV^Mawz!MA2G_fnd$Q_*FVn%NOkXDg_TRn{z zcZ535yho`ilhMf_83m_Q-=_V*Trh+}?88&n{KDLzBwCV)h>PPQj!@-3bSi2U6{|yW zBz~4a*H-G%&s6Cq?dsauq8JHck7o;-%p|D?W^C2~9UysmyZ|)6D$x@+dRHR~v2xv5 z;$-!zJ7Felo#8Mu;QjB6>6Yo%YgrvON5H_E$B85r!G)g zD|=1hEilHtXl#Hu1bhG|2ipI=PSl$=RVTS`6>kIzi$xsI>5G;Pa|sy)vLXJK3hjy4 zNozL7)mH8Xi`tZ+#k6Vy`V2mW%F871LO2fM;}m%8>dISau6IFI zl_0V=u)>tr<{KUf4V1=acmcHJ^ifYuclrxiZ~@q+F2|}-c}Ve#6h zMS8^Y7Tc9ish_BibpcsYU!m zPzjxXs#cUMTy#=#^Ja*4QO+Fx31>XQE_i@NDS-NEsx0v54j}$?tA||Y9xW6GP`jYU z#kWHIMqC3IRHHc#%B|!*TwB@;iTF-vQgwNEvVO!=I5wv)j6BA_+@o!ASg@0m`+{%?`uJr&uDz@8QQc!&XDR2#6dkS7%#WN_sk4ATBX6O^A_yc?6rrnp8SJ z2my&I37-zq2^~8cC0QAnnlgXN^dx4p3A3{PE;$cKmsEKlHxS|;q@)7}WPEtf#=PXy z^P1lelHmb<$=k~d$U7_HOWPuozpl^e4l!HbGJqewu&mqzi$?CH0LgPk2p zCf0y3Xdp0?CBMgmMH`xgwnO*~P-U6;QEVi*p=bWm2EiMxk{~&*3M~2)(1PNU5=0%` zk;z8WvZBQ9Q=&yDld5zX5XbS7GhD=#PCx*fpO=SQE3-19Z@hxi3N@%OPQ3=~2AD!m zwWG6>V1p4|Pm{@E)x@AA^|HiuTMzuUW=-)B1|CBZIK%RyqHg!6p;QPYF!qZ@>KpYjtjO z^E`~d^;j*qdoZ)5nzT#JmFZzqOzV$2(V}&RGU`^aiva{3?@Eq2WAWKT4kPXi8Apjz z=*Ho*7}ih@<{n?#77Ay9t-E%q-FzTm+5u@AA%?+204a}*4A5Cmgnb8}ZWY#RvVH^o z?%hp*Qs+(~vHA1feDdN&9dY*+4Gc;tl)9f8b(0{l--BSb5H+!1l~!N@RKLoFU&N!v zICFmOUa6g8_8Glo9bMfB-;GNI#Rv~)$KU*fN^*X4Gt`jXICZt6MS6S=V`jbEiJ90c zS+=SDn7E(}&z85Q{UJ>tMeA5y-4;4GsHgod{nR9r_5%R*%_z5U&j}=EZYMS(3SX`K zsE}wgZjh3rY+_SwTh)DJiVF(|Cniw#hs|rDN&o-_%2lJOLCxWu*I_(omwC5a;IYu& zeff-rx)%Tx__}EwU_AF8Jjlj$Yi!uGvPf_?kSA55=o(c9X$EVS8rM@4TR36)P~C@8 zxs1$AC}4o~vIp74U)Mr051$`<11H{3x%TN>)#0GH#6)4ViMR;!5nvZ04)Ym}Dib%0 zAH1q~5Sef__dc<(CR8CA*acfM?7tk9b~ID_&ZV)@(u${~3x$R*6MNl7KY5v7G;N3S zK&E1GR!6BE3)Z{2%b;bxtUPGz%!FoFZ=*UzmDo7TuN%cUZ+a_(g%!SFkfd8g0R_z~ zOe2VGDBY7BxW$9YF-ruw0W;}q;tBUO3Vc{qa0e7m$svfqhJqdz0*T1eNi>I0AO{BK zG&RkYn_3W%3aI2}Shm)#U8`;qg@O^Ie{h^=QBgQl1NRS3IiR)zvsz--0`4EUb5m1O zbX1hCswTv6o}Sg%S5oia_4fA8&f22?JCt(JDaCfm1p81#80HKVQL52O(Mmm`f}0{U zGKBf~k}@(Hb8}AxUnnX9GN$v#AJdbQRfi6-m0gIeb{{Un&d1*g;>*<4RmVq-vrWlo zpc6;!|AJ3XZK7XvO(XsK`gDGrp_wIYZI%!n?Y0bk{5m~WYY5>!nzf_%o0PP__EGUF zA`Ku{zFC|*x_m!RZUxJ;@2&=o7BR}?dcj&QbnrX{o=#%9MEL%+bUS0reh>PleKgn7{HJN}IEOq{TZ*`>i%EV7a zHGiqGah~m4=u$iPphoibHMJI8A_2k(JwEf{k`{yO_;z|E!8y`g7TlQ=iJ!%5^h*NpY-JqbX$CHBXp9W zL6L!%4Hti3_&0ZqfImwOqvX%hX%fzaL8{KO0OHv8C8f;YKTS0cSI5hHSdDf6eE+0W z^s9im)-BqH{`b?mq+jiK>=0P-qXIVLQM80i~P10BT&BuuMDc+<|AWYlhki zBrhhA{hyz(jum?IWf#iQFKokF(K(nD}sQhJIGxWN@cskF=@%lEFoUlb7erx$S>=%wFu%9d_*UB zhR}cASGUm6PT(eVeV%rQ&pB(NMS zDR3vgA>6_c5wE=P!4tr3+aTcq@QN02Xl!iL#*L#RBb8!1ckk9WG!%pW>&urf0MZ2E zPw8(Y2o~tuJ>L=Izfe;E8U-NH1RBfM7FA+Tf4|1fWOy;qXZALxjzB+v+NQTEyb@3v zsFd(*MT`}Ls03Bxb8l}bsIWxK@ZZU|rU>tLSVT9x+lFg?KS?Ij_y8ju;zDOhxCES)&>d6WcK5PTnEM&BGYVnMEBdO<5P z2tA}psMt`~xfG(Rgm2}5w9hjipEUd>NIM34dhleMb_-Tn#)AF=%$5XC!2@uN&bBDw zksTT6GBp-3j58t#IMLAXFuMxT)InSeP>rZG!{pv4=Aw>8!I@WEn~c#3x@@o?!YeN5 z$0Z_?sgY?7*M2Xw2Y_aVp5ftPK*K%^E(hL=ZiC?DP)b1>8u#rT%Uw)nMS+gRfskm3 z+7Gm9Ct@TSdPQ7iJBtb+1PC_>fTx$%3&&0$4AfKBf z$#!Wd?pPdVjj>g&Gn-L4p#K9PI*M;HvUY8|cW7u2n6wHEcTH8~x8Nos-(cZem{fTz zXsDP4fw+%A8Vm;J0^IJV6T@K;X~#xiKGl#M08m}?zRBOQl8Va6J8Rw=i|PUzee3aF zD~3?0Rot2Qxk#kfU+34d*b*KEv?+8r>7oL%apOwDT%^78BU0`zVM`;(kK*D{ac6+* z(v6O(!I}n;HqekysQiZg+?cW_yQ_^l;|m09YzRq;(g>7N*MZCghL2PnDuFpNwIu#4gmv&Vb=VP~zrW`^khd z>p;x{xil#r3UG+s?!LcbtrD$7Om+Y~^6(5433xB*%iBG`heC)XA6+thlz?Z^!%|a+ zDMoq?wbnx306Y4aofsZG#l7DaYOk#a&eM9JXT^LGJne`$yu0ViuCVeONXu`AAK)oN zPl=9*en#t2A%YQ{_2;q%(=lrQ8A^SRy_&-l-2U!)K?s)=%;Zve`>lzdv)_`;Mm#*> z*)3Z!>^x@O=Eqst-boqR-oFl7LTGMmVZqk)PpclYO}?2X`cRb3#~tQvH8nNqtT5vQ zIJ`ns3cer41-=w>$U0gz0q;iys|h>DS2TLtdvL0GBPg{cmkwDAltn&|Hi$cb7_i&5 zKottr=9}Y?bfa|%ty#5d73oJ$j}S0b%pE@$SsiiI0KK&GYV?Dc(xVHRWA>0L0&r-B z9SU3Rd^q8vs&%0|Xh0>;mmZ50#@-a#{Jnt1p%>DXBaGMr(C2ZIkjOxmDN(Wz6bb!* z{zMI^6wm%+K0+2i6#GFOh+&2+$csnL@2^aD1-Vz1Bd`)9fbx8R{9XlyqquD_a-poC zpfh9)D+evdHV;@$-kWI#Q+Dm%efQ5l$@>tU_U-$4<;V?Q9|Q(45I4}E>Ylk`WMl-9 zm9y=5oep~w!I45=>)qlq^R_M-X{t-#^>~i+C|J+)Pu&zaM>{JS7WEuN}HVu&j5K zB9W~d=A|xO}vzkC{aXiW<-eld1Ghw+?V}yfSV~*u8iFxH%xAjn(sH*Cs1u_ADGE@$#Dk^;~+1ZC_E?>Nui1>$A7W*nfuUQIBBzUACk_G{{ z)*Yd6Ac(x zV^AQdfS3#+J;3moS}a%RLM#@1rF3+k7y@!wJ*^7dKS6j|k3I(kbTfd6-Zz zjJnX>_eZe10FZ#{jXeJiC|k8_0Zb)L`T3IDTPOuNlXXlyTF&)1n=`DC)zJg%ZJgPS zQ+43tA@SHw4*H7vIfIcI5Bn-PAz`Zrk0{ZGRe{+WQLF$7BMjqc z6%E564TCp3{IQsv`}dML4-t==lvFW1P1P;ih>`q1U&8sWrz$|?>3jBXr9;OC>@70x z59~%hdQi(dD(%?!2TLYX%+es&z?OtCAZ(xi(VG1vuyuLS$&wKR zQ3_S5etwV1qnn^-p|1i#1~9REJ*HDYW~ww3!Us@C_f^R3j!YN@*qd}_FL0u7aA2UZ zQOKta9GaQOPGsD;ru7xVMnsVf%A?~QE#x zx!B*|A2I{}PSFKL0aNY%q??tXLb}tn{44lSjiY zC&!=+iW5cgDga5&-S@O~bl*EWEkI*qHM$gr$p<~k?0d2s0)!^s`??XXvN*|r7Z5R! zLbMhriS#}=t;4l&wr8C@>hEuWwT#8in@!*@gFMyiNyKN?@jvk`QR=`aXA;S*>qlh<} z;Ielx$E3hEi?&gPjQZ_d?8Q}Ll~&ey82cs9S@l&=AzwMPwg<b=TBf!8=31Wm8cL@U85NtZ>M_1QZV3(Iglu`CfhgC%= z_9*db+X`X}gKET_hd$U`QH~=#A2~AE6PsOggEu*i=L*EbdzWT;oEuF8Qrq3 zF}O4s^Sp#J#qX`xEr+Urkjy~*hWK=ZaU-E{!>~!*YgfY#X0bI03-cHTw{cA_b~w~3 zLUik3NxK+c5#8Z&OAdq(jtU+JJu|lwBk^ zaE(CR`O<^NjkGerqGi8bI4M)*rWB(#Rm>6VTnNnvoK^3x<*oNr^o53W&N9$}QQ=;) z_RX6D*FI9yO`$o$#%3cCN+xFgsxS{#oUhh2>Kpdj{ZVvuA8KZZkBAwYk%lU|y4`cr zjG%A{l>!+}YPwDtGo2MY`{%+f%*-yfc;J4wM07m%mm$MlOjwhMEVAwnIx+5ZosOZQ zzRt6A77IWMC3Cp>P@Rm*bM;PI3Y`FHo_3RnGF#~iT zAv8o<#_|e_v((+C2D2%tkwfxv1Zv4&gMF1=J_wlzFKpIkv4F1G)xC1sYrO>cd z55Z~Vp8^M?Ljc&v;%GrAtxXuD0#KK^a zXeGUVN#d`6zUIw|NejkNgM&tV(}%^x7VgrB!hOHZ17ahrqtBNJ(gVuuc0^4S&H!5= zMbs^9MmNZQG3?6KtAz4tI|HCnj0}4D=+16Y+Y~4+*vFM_>m~*|V~F$wyMAzg*m210 zOf@x68RO$n^u;)5pqz%P24kl5TcF0f_GfGDkU}k z20YZUv4$951Ev8g+FO-Fb|fC?n7(|G+b%uJj{_|UsVO8i{EQp%)s7t~cm~jdkdUHN zLW)3>d>e+0Mah@E@o72=wj)Anbs9b&-xv3p{k99%3HZWP=*1?!b`#d2YTYsGIik!v zd@1mFtXk@|t5@ZVRUi?^Q>XVpUfC`*3SCcMbEXh0>s6ricnrrxMu`!gh`8+LR+xan zx9&?AR+aAXcf<_{ObMMgE+`T_9P+inkf@svx1GV$FNxHu8f^4k{;%0|=qp*)JY3AgV`vk&uK^IBGx@D#dE(yPB)0 zsCeGWWjvFRn79oSh<&lWlJpyt%(ag&LPboJvSRa-xsXf6)-rWgg-_4K;3q(vAeQqq zp~ZX&;=Wr-;sf-1ub7pBXE6H*U0!&+X)ze>DyR;?&ALfef(L?E`fO${${oOXEu)*Z z*>JVm$0@%#apFXjdV0<1%(Yt`A!Cm)j}I2aGiRJ1JUAV93b`42FCTnHP*9L@0vdTd zB0xrQ(}V>dg=L7&7<5~ZyztqpjJy9%X(7gG&>?u8FUt5K9e@#~uW(BMP4PryCj57J z_1k~^xR4*Jhh7Bb(D_)1)={ZlH8j+eigY{_UE{fKiIu)hk4n6we^pK{iHFAogJMui z^33%}H2RfzFVv^;CECrLH87a(=wF<-wX{7P3+ie$V;?;{i%hKmo#a5fAZE&-e7TMJ zD7r~`o27ktDc~fDVo@fv1ck4(w7G=^_l|{Q!NtItBVZZkRtF=8@g238Y+PC@(+6%1 zLJ1h`N8bMy16alwVoGElcoNtZBN`L)uN=X)g)+i(Ud9!+*X-MUs(_K;T%D=V!U#>2 zme}Wb;5%$EnN{uH`t1<}l^_lN)_RKHt{RUY92^Pe9;?WKyiA9UXi__%bj4U$AwdpA zUO>J;hETsJcSnzgmVEwP-7^N4hlRO$X7$8e3@r2eG4;Q#(0g`{sj-Ell@-hV&#tZ% zY2W$lOF{jc=(+Q1e$P`5oH#K(uTg{l-<-3z5A_b(iUTV^oMKiiK(Mb(?>^Plr5>h> z=kaRt@?CsUFy~Gm13bCtk=v~rSPmGQnGp|Eng%>4b}2#c=5MP*>M{__9n`plfsR&I zP34F7>r8mI;p+SQ?IVLAlg2Ap^Lw+{8i1JDE(yqhhBH^W<|tq&flT-RsBv_LkuW4! z{ovsY1AV)Ig||c%o^zd0S1mkpbJH(>eQ&9#TzcgAx7Iz}+{E}6bk|)d`u@Comq0>* zBte!-6u9IN89&|rHLGSh5>=Jy&Psm{lW+B6#b6gyQ*=a)P>6%ht%kKgn67M|@Xlbj zB;9tRO~urb=fJNhuP~FxmGS5Y+vru33^$W@(v|lt(Nia15CoSyrb*G=#6-cB?_`;R zsDqg|RTyvB=q7wkO+`kOcx{YHn_Z72syYn}@0CzYZG8Z=J<3bMoZV z&BV1P!$OrK2AmRgIw0?V6*RfT-~?CSbUiQ!cy;vul5@AUt?g3y6FVuXw4Wu>-QZLv zs=>DyU?qpjk&|<(?4Q#_si?m7TUn=3#+EqC!1HH@sc7knF!jiK^kDYkO~h6F{W5Y- zRCUt`xZ2M}{MEN|c;g(M&!8KZmnUxOKVLZ_6}sxk^g1hk)>$Sr5(zjqHg@H`LVl}H zRF$^3f8SnG_Y+xIg-dc?Kk2b}%-{dsyHQA1mY)tyBL7lbHb@N)x9al1k-xw0j8A@NBPqP`FjbNPeT!8%-@18+CUoTtpjoBN8*81;hWo z8~&GLfs;~C@o$TF^WcVG>`z)*Ao}$7-omf^^W``Lza1ZEpZL}9=BE6MkCaA;_;Cg% zCJqv`1;|J9S{h#{1t>tNWvoe!gOOeaiqh#?R!UZ|jBMs$0T&XDtoT{-4r_>)Wx z*(I9O0Ohb;3_LD!HmiiG=MyRriYdd zuf_fS&qwp^sxee$=ms#09?m21Qjw_Ffi4=~zI_~e)NQk9eu&Y}_OmIWp*ko=5x?{> z%Kh-A^xOI3hy zO>~v#Vyt2!kD#D6pc2>%Pys_|fyjX8V{T-0gdUQVSk)w{&`M&IJ-{zC5V$Zt&VvUJ zPGV+_MPGezZ4W3R%vgXNMgo$RhAb}>JE$R{UY-QV2rPk+PoM}zl~7fV>EHxvmxRXr zvSFrqCpWWYyN^t$-hX3wE(wtq6*s<1z8`8mb9l>8%5|5( zDg#9{+rE9z{rMmYS|)(HOCS=3^bGngfZ_ZYKBJ$Oo*o(!5_2g|oQyk&Zubvif@njT z9PGRi7y^{BhzJ*E@Fqvs%z~#UTmgbCM5#)8{gW)gPat?4W84^V1^6v#7}g*#a&K_Y zNKar#1Kf^#w1ayX!(vc54gnVfv=f}+g_{>%>Iuvrn%z$?1x5hA>VFBmQ+&`KPR#Bw z$skOTaduYfnJ!>?@agB>AR2k91cX;vDJfkHMpzjJb8>&+NC^cB>Z!k=;X_%VLS8|=6C8U|6U0oCX-X)1DA3Grx}}3>a7sKz>;Pzy40?f*0vruKkBwxV zDT;zoL`0p8?vKHP^BvaU-c7=!>U+zXJbuI!(yh=~ zIsk+eX=5{&b6p~`x~-EzE$gNJa-H%j|2MI~*$RpoD!-Mo8D3Lp@IGqgg71y-P{9O6&SyoK?BmIaJF3HyvbA_v!ZvhL_9ZYygep ztMA{xk5SV2gwsva7T&0CNz9b?~-qG=cE<-F5zL?OOOwZBVfjxc37H$;0Wm~mU>zHW^=#f#QPmG+wjWk2c_iV-o+qDAoCvfO#%pZ(95of*I z%>s9sm_~AutnDOs=n~%~a27qLoD3nb;o>Tttd0F=@~~7xjw2Mg(ZsW?aG9H(#aI{+ zO%hs2>d?E{VY~@+S>!e#JrR-y4uudB523W3_>h z7)6eT7Z(&JI$z8p-weTH)3{lnZT!#n`A;I?J650~E)K`4{qxUXR#q(S2p6`Pue1bg z7d6l)->mEar3o6{0oNzdhS0ZR-8y;72}LxA#{GXln}O(IXfuao-~#^jD_~ZP-e4o4 z9Yyv@Q_RFxRE6jOs499t{yu$#zKERMTpVU$LL?G49h{j?fV0>w7j|O84+dHAFm8kf z6MZE(yDBuuFbW#ZyrD`|t%Y~YcL}Dp41<=h_>i9r8;K~Zm$=cN&xqzvcXwHQeDS4Q zdU`_eMgis|a3Inan6Q0(RAV(n%tsgT)}UYRB*Rlx9etUfh}6AUY~(idES$m3Xzkrf zguuc@>*C(Np@#s7zwa|zfy69id_+V7h+@pr0M_}l zIWEG%dbElk_q3r#*7vwHCj=)%pa7RjCxB-SngY^XF4Cr*ymGa5*rNCgL|%46Cj`AE zfe4>DBNvJ_4rzWX4tW9|iTSUW;ij(VKc3*QFpmITp zWn^3gHWkL#t}SLF8jkSrziVI(q6R(_TdSk3y~Dw9$3LG=An^_`-4a8X)Ya7RT;T6z zB|+!{ZYZ_5mH_iMjS_MeU@=dhR^pMRqErHt)7jbSJ;ViNp<%|*eIiIF12;^Lo){W> z0qLSt*S-7q0X8+kS6fzwp(EOm(49GZmd*ntPg!lPG8v)`IN4jjeUk%F111J}kI=t& z3t|bN7=n-I{b()4g$0zVE9&V2z)f( z-Fji%=I4xHgW>}EuKJo9r9QZ)!?$T3;)h>=&I8p63iNG4T8&3DKcJBcdi@&dOX zyar;v;=DWwGO(I$Xa}^5w*d~j{yX9`BPAU<3 z2G>4@+k<~}Px$}GuRb@Gv=YZp5akw@gWLDyYuE%ps1czFtjfXyR43$l%Ag$vx}u=- zL4$yMgMq9q5y>dXfvO;;G$!s@B*&pYYpSkJlJaEFdrVm2LPD&qtUQH}a&k(m*Pwa% zdLA-sBo@Q!by9%*q%h*P(1UwwhX05Kw<0 zY}(wsd-twJ<{Y;bav?~DejPmH?Cx$zAR>!o_0I*Lb86{u)$q}s(1D@;ut_}!Rm8xL z!_Z-)N%PczdwvNu0`~?bV=^%W$g~pW2Eew|)VZ><4VV#p{KiSCO$Vhv`}Ch5%uHyjPrLg=H!wOrUUfrFiXL)Ou>&1vP=c(X+01kL z?u3Gd#ynuzZ5~kdg=l1|1~WieiJ4z0*A(rnrcB0@TVm)uFesoZ?7M-gReNzY6aORh z=c9(>8VB;Mvovdk%?`#XMqb|h2F9HT9CnoV=-qxA1khc(dNJ)u+9g)4sHlVki7o0< z`MV4IZNR#K6n?^=Y0alhCOZA$utRshcT*~-M>@H2oXN%L?zTSlpiyfo%Ok{nIcIB| z0h9xo{9h;sRiN4zT|U4%js+(#R=rnA@bZ~wYie$ekqzjCN#gugmAJUmdr8M@qbT#1 zzs-_J$6d}mJ+MiNW)g1U@qQ7>SXma4G~|mWiG4ydj|3;eLsg%znUx8sS-aMq&Lhty zlwZGo@Q(0l6`L&X@!p4aBcElJWBo5jdX0yyj?LgHFDYqt;Xc67AZGmI6Z9ry%{F_} z%x&sZrYNE3jvGGa;Y>(Q)~l=FKiE}wT;B(WbVYpr>>Cs!yWs9TJ3Hd7Yi)EEVkM+e za4lj!1~pL>u(V8BS>^-d#;d-~zvZ>~m5MnG>cMOKs9)5&nl#-1_gu-nw>~g9J z4jm2HHZx!)BZFxKVl+(S_SVy@N0P?nQf%u2HDuHp<0?30{iZK-qKMXSgeB+W0~W5A z`~x!%sh=0*$NdKiefTa*v?aHUH;$r360o+LZqAHTQMrHZ0lxTlkD$}Cp7wJuUpA_z zZw8HM`oT$MYHGE%VK0VsGFIA+kAr|8zonb^=(sip>(8DengU{=FUIAXfvx!WR(Zyt z8r@N=83gtM#loki4OHI@dcO{J_STh0Gah*=OV4(|zqdT7HM@o4 z;F;MOukc-jP9<|1-q~gV_Ic}N{G{YvL~O48`fC7>NaFPZdpZn6h<)Onl$;F1%nlH{ z>S@oCEDU?o%(G!O1U}&a+DQA>{6Mxs^+^eq03WQRv5`n`Utf$U%hs!1#ljM6V|k4# zMT}UpfLf!Ri7oig*I>?#q!`F1&&Xzf>riSUI>r94XdvjhX3qxCKr43&yF95SKDgz> zy)n$^!3>r=VhgVB4+SbRrnYt%)V%!jZUD_@`}ud;+d1m-BnR)9nb~OfruL%X38sg8 z?ZM{#m^r2#_3h)s1YH=0H7Xrj@?5;PZh7o-=Gu=URQgQ53ojyc^e(@W@$=CIP~FO) zaib-+g-kbep2yL)MZ1CtAdX@dg&m z(10Ire0X?pe7v_l>8_u;#P#dzwRQbDWnlW3ZF{$U|AAj7&8TN?G+Bapx70+EBzeZ(w zg;=PC-*X@M^4`Qa!khob&D-xu-F+$KEnmtev?^yWrj_m0Est)f-0xl!5scF>h5{V& z7p8PFDD!m*;orXxEG%#oPLDM}avLfuYE{X&{oI)oqBp*1UAM!SNb<)HkG-eXZd!jq z2xirQ<9(4(`-}yr%|F@S17*2(Mj?&ZE!6R)MMX2SBLh#KDpdV}LzywU#>>Na=*z31 zykG3kdCzBH`MBk4SB2RZxCc-gCO9jDKldmb|+V|n>wEDpO=GcH+A z^xrp#y7*HIAbh)*YCGr5+{6t}lWiV5`5Mn{nvCX&NjJAqT|IlTOD2=I)%xpOQRUc< z2yOr~!8a3m*w`%cU00J#BEOq=mg!(>kpkJ@Axj?**=;6!?wwA1u_n1K*xMgQK)3xi zSwR*TD)7Ak@Ye2b@?^t?&;FC2f4v&(y_3#yg9q|KiloJnpy-D0Lvi0 z5r3(_^maO(&f@9_ftJLag3u6EE$toWC-iE^Ump2hJ=FRjQLmGmgg60Lu7Q-4kD#vW zr%lYeMoWcqH7#FdI^&QFF|lq8IVwtSo<0m-6`>fLc6fef@7m41he$hiFci4Hup0WI zUCD$-+N-VY+5B9(JBt`pE**F7^qo4D{^$($62dlPNohd#82tGZMSuQsw2XXSG)H8 z2M++%l$sUfo;s#od<5T*R1qfccSzwr=+#@@RYpMKI{o#6bnWNNlPQO6Cc3L$BbM-I zmYm}jiKV}s+<&Y|GpU=O?q*AtmD|pK{=O-hma|9oY7G=dsDPda9PTRhTYG*3_LlUo z_Gtf=T`*r*zhS(856I8ad3Fm_p^S&~M&j{jd{S3yUMGlB`QyB@i1r-{N$IeMn-Y6 zQzR`rqAtFjCP^-c8t80@EDNQ(`$EwD^!kOK*veP0S|#@Jm>5=uY?6)@vl`aRv=#}i zK{nqZGTr*-jRGDM#Hn#ta|Q9%aPl14+`=Jo>CzyAdcF+#jg)8c@4x#&yzcelg?e&~ zvYZ@S>nnha<~`%1*cA@bH%tCv&2&9`+}s*L3Qd0oMcv=>L#TX^;KPUD^B?lwpWCwK zab#3S3HRDZh0=?A%T*&F%fc|qnOF^y40n$WcUtb;@+APo$t$A_DU@iOYNm(81>-u_;PtS|_38Aw!Hp9I?IKprucH4-1ju2=p+ zd4C;BC@!@^Gt)?1+Rg{`K0N-f4^%?jb3Qs*-zDp*g;hb-!HiFzZt=a9A#c1NiRjDE zoVMNb2Ndp6#`nMHy9r6W`9pd_DSB2)Ag*`d4Wqdo9aPXS9vM73bN&-urPD&uQ-??i z6v@?lKHAOvAh)@TZ4RGuTeV8Mx+@PO(JEbFIfiRoOtV~66i_iAiB`(RbFw5`SzcuDIOiR2pa^${ z*g|K5DqrV?n96VkN7b;fuRXC7itnSpeLD)UHg{^o+to8vCO9k)8%)D)YFkTcIcN#3xz|1b&Djo8KM8NA=jd!OlJnw!$W*qZ?ezCzD=*9zX=6{QRBmDjw? zPToN!(+#Mu(?^SKs-jd*dB$SO$b0r0EE{Cb??@s3pS>eL4FE>z)+C69NXQ>xqz>TkNybQLN7dO-kq7tB|C z;4D0$#$;$HtEe)Z$1ME(t%cz&lVPy{xA8vTvVeuhH|G-$>(-1u7qX}rZfA+y_IlbC zCt=Jz=K6(dVGY4L(=jmA620*f!M(h;9cQistb<|*Lws;La4AMR0&+b-f@i`T=d8ds z2`utcQ=k>}j>q+CJ{1(`pd^O8C&$6c@&*>*;p1*=sRqvsj+!ZiXJ9_1Fa1lg1=*ak z&(W%fYUO|b{rbhj2g52G3?GDpK(q()?`&*zprTwFz?nAoUB7p@fjh~nw@ zlKt$uO-wa6tHK^TL&cJNLNms^2ZIy%F1|;#4Bc4|-Cj}WhXN#$s3;#3?;zKVUby;Y z4%lNB3~ZZV=CBy(Bx{v;iJ|UuKBLvf%(p*w^n^BUFe|G%Sqn#lpzBh2e+FDFmwLUY zNsW5;Q?dCIZw`n=ytgAE1lsh~`|Ha24?TrW*r`@|J0i;c$4Us8g58PjS_T)6``@9F) zh%>t++6eQG!90*IurhP7^x#1$C)@@T1Gt&=#K&4=E=r8*8y&ukujDb}m{OJPV9{#+?$%VuH3{D* z-tq6a6gHE16QSMF1cb2ATW1QJBZEhl-LGz^m17?_VmOrZZ)-&Ptj!!?JRuEFb+*j4 zEa-EUSIPdWWIB^>py|X%;+=21@srvsvGCmA>r8_1&XQ7Cpc} zCi<)4uu+uezBrV6Ikm?k{&wH-B#>OO=s_crJUxRUTA<|1K9=#`N5Y!j;z7^pkK;fv zxWw=1^;f82v_P1#A)tN{0?>i3CooVZzeh+&nVH`}u1@2Uih1`o+FgxS2&8^o;c!X0 zvanN4dJnej2~>l3j*d=DOl)PP<@o>D`U;FzAw&27?Zjl16EeJfzhBZXE9&=li_ag zQS>W;WMDZp(#nriaWiR>QrjxMesN}`Zg6^#^eHouJlKSGQ2p8XhClg%LPwQSSu4zR z%z19As_L7~aOU(_XTDr0`R+HJ*AE>el&3u%`hpq}oLEG3#857{xkZ({h*w)WNb+WG z2;wuF3%#3*bOv)FHj=LHXclKdL(kjC8#gBTw}DAyjLh0@MBo)}ERZo7^YzM{*PVFj z=)46ceB}$O%U-jS@*QnBmi%&^*f6?qnk|W&MuQ^Y$lP?3XfU4{d|D3hx_v}`DP^>N zeWqT%fYN4Dm32#EFI|^3j~|!V!nz#qWmm}Ly|an&a6-QWBzAH8{VmX}&C-Uj`1 z&z9pX(-RXzC>lMU3Wq>#FY^1eN&M2CP2`-w8Z$Gqv&dmRJhP@pb{aw-LMS-QRq;-< zjIU{PvwHo-H=mO8%vweKRVmYnPVvDTw{gUXBfDtLG`^yIMhsMCa@`AIClP`f6D_jh z9E&l{OnRu!`&M0LVq|^Uc@eoU#xDN4WV!B%wc#lL2!KBwOaH z*Jy9p4o!7F>XsL7(B`anE@WV<0q`)ecSoh%W*wewOm;Gyre@|R*tb%#>_=m;7X;k1 zs5dGV{!KSfC;;T-I}{_KOm-3y44`j7upRwdRR{yxq(jyiPFzQNr-1v+z(Cj-CNsM* z8-rWG*LNF$DZ$?X?O)x#RLCt1Y6qqiyH}NifNz1KEEqahgFk4!x^xCs=ujAia6Mpi zS?H(XeuKmh)l24NLgNL4OH9h|OP)Vp0#x{65)vQyRIY%eIZ0WWKlB-jtRT9_*Z`0T z_%`b52_Q5uryqlVL1j%13*;+-z=P?SWno7TP{|O{1upm<=5GWQ6ky^>3_!pX+q~Jv z*0uxw0MJ|k${cJGEHU1zWq+XQF~7HEVbT&px++tOVt^uk85`pwf&TdgEI$ken&O)d zkbcm_Pv|-W%?yZ!_x<}Aw@*?i!x$2RzUn1GNU_1Qk$%Sy-DXU-!B-;a{ji)wJEkL< z>0$u?jVALs(Dd;hC?zgp0t(a+F~Y>{xZJt6OHVcBIZ;5?hC+*+%ID>?bGIZOJl#vW zQd$E+sMGhi%VR`v;9%I|P(14i?lje&gln>Nb;>C1bP8Ra`fJQMR9=ZV@lB)ghV{#V z@7tn4jpsLsmd}?jdpGZNjE>f8OJh?L1G){8Yl!6rB{=Duh264b_7-wvub*`9FXwT8Lu(%MyKZXuQ$I$otOvxR2r=)mc z2yV!1xqtv~(l9wbF_B~0JCtemk)v^-Te*(sxf)2_zM2WTyMgCQY)sr4c!Hr8kwPwz zkts0!dV6MnxHv1J0mj_JYRFM{TxFPQgogk0I_Mp#;&M2+Y&vF;YM#vn!S?G zauRJ8Dc4E0=P$bB)K_vpUu%eyb9J4*OB)pTQN?92vfrfP)6n!Fio;go=;AT#8W|Y4 z5zW8WZ2=;B<8y>oF7&h@ocSw4u;^_skoa(s=WlO@E)oRLW^oA54mC*YCy9V@uaxu$ z_zNW(&Oqgx=T8R=KEn{udj~gRG>LINiNHz&q&i?NP#27m6B+WVI8W5{T;aV4LIcqb zCP?fhqQ{@$Oo1RY84xH;LjQOKLKh(tw;KqYp_>rX&OzF2w0#2FQHpB{aWG+mY6juu z5sY~`b@MJJ5RH5tbkw6qBBrI#Rp>)jPAr5&N}P1YmiT`Sif zK0Ha<&-Qi${Z_H9V)gd^aU8}h#vGdG;(hm;naA%>mx{08trueAO~3m*HdxcK;e+v6 zxvjt5`?CKX<5sb&b4w|UHNu-oJf`<%hhaUc4}S3S=r$M6e&#p6gIZ5!w z(~W#{R3fFefjW!9w1YgwE)92yqstEGIb<@n9aeh+NOu}&=f?@DKt9ta7`JSki`|I; z1=ZjqhmZKZaEf5C_h48C)0BXc7UbXu;HG>B)_oOr5$_tY2Q$Ax>@jf_;EY6;rrO8H z2T3RNEBGCfklTKH;j_NOq3LrY^(eFm3*EaX;wi3HpYzO z({PZ*6nddIa1)2xRE!q?c)>91fQ%pX@42>3nl>dhhwkJvvdrb`MCD!SXQ5&wKw&)% zY&RfVlOtK81>Q0U3@LDP%ODH#&S5?t&-1zAiQ8YKUO72=AKzZ|BA-0SVxOZ=ssO$Ge zEpr`k2Z_K$m?L(O`{9lefF@2Pdb^|(z*K?I|0gZ9ATe4dsC%2&-vZ$QQpg)O+75g; z^FB-E={G#^ra^18D`5};@rm>VV+h~@IPoV=3E*r1h!o$?$yxnWiNL;j(C-687K!Ql z2S9}{>f77f19e2n>jv^F?vo4p-`H)vn0)du{56sO$) z4kb1XOL#M{T5C=_(i3zYg2l~w$NnUsqS@T(eBe_x7|4U^w6p?RNQ0_XPBMD75L*iZ z$n4Uk2#?!$?m+bKV67T%hCnDmRKRbrUL7%r+tmAkW#BiKueWiM#jPjQ)v@*wiVu;H z3pqwAkTABssLPs6`*>>9PlxsMZpc)mk0IVUGTx$v6nituFFBQg3|-S$$;VoELlACC;e zHy^L{J7T1l^4xu>%RnS)>j9~rmEb<*{3ccYtVugpu9i%*OvmZ{Rxkgc;<@S{5)yB- znTjP538XBTLW14W0#`-Ac6K9hVQdnRjmA27(IG2bVD($6yH|oMS8UqWT`~O-hPI03pTl_FV?Ln!pS@ zZ()OM8T14y%gPKp7MEG~@i76WyanQ-^pHtbJ0%b*mjx2%HZNFqB{*i_O_AWFf1o2I zl0eL6c!Urstf`4mUyUwT={dO@Fcg~CDz;L%u8)F!*^vOY@R4FN`_ei)s zTP#hna78Dg%=PxW>TMv24;SqVjwy9r(bkQ{=f(-HrTZi*$@8mqhq%Wt)F|+ura6nYEn`k-$R6D^!jj6vOFk-G&ue z-gn&53o5gsP=t6y$nN;*AnsIe0U(({-l-=v@I%Um0y; zbCQI5Uz3+maH$IaWD8<3=a|evWkBtFzhhLzbgVt_(Ia|j0|3tl@XQmLs6{5xfek_* zHo*BkCd?K6O`iUp5OWz_h@C=8G>!fVmT{l*+U32sibwjYtLp3HH6e#QCn4p>u9)wr zFDg3bbmv7|o3;w1C!RjF2Jh;%NsheDL(t1j{W-P?3u#m4Ewim5Cu|@QO~Bm3QKBqdC)R^%#qOvsd{j0HLQbs?NC??D z+9$AVnePxnobWpT!UF+|R2%&_1S_J~12H=r_W|BDn^C~wA*!TG^Ss zcw@&D;~-j$@KGE6er5zNGBIjSEi4Z_fJGNOFkICsD^A@bw*UC?kCp}aAk=NA0F`yF z0g1KTpjTAr?}e~e9s~qi7QlbNy3oDCroi?gaKVHT&8!X`BTT|{#U4K%ogW6~uE%1^ z@Us2fRA2RidCOG1N8Ut9rKb9CRQCHZuzar#B0Bcg&6_L|(TYFs1b%gU-ivNAD1;7h z6NaZR7(M_VzzQtqYBRSikXWCQ%ZtCnX^woGuQuK-Twg0&2zM`LJ-TZSM+r3984=lz zxbTNy07mg`}XbeStA~P%{kI57A8yM*v3>M?*uOjZK&z27ta{ z$Nt(#oD^|?!=8L^zOpXRj4a15i=mf*!xDf^S5zy6Eja-+!ldl|;uz9wGyF3&Zh&fI zRdm2Y*!ZoNVhD_wduww`izB}A{EHOy80PJyoQ2qqAz8vf3N;g8Mm8XABOEx(ufqKA zqDYq4Zoy2z-f;h^eR$W-Lnm$-=6Bj`Ydf z1uCpUFFxAisL1UY?&^wY8W!(?5`)80!WLmOi_XpKph`mhWBVgqDe5lC$OW|Un{mqa zvI;3fq~k^W$Z^&Or??EFz8_@~aXu;kwgfdw?B7taJ|~L3&B4w-P~g7!S+3~)`vXEk z&Ja=>vH)zMV2l&(^_L3@9>~0L%shTvgHwx&O1uQQ&F`C>(p2LQLTNR^9&G_eD=;WP z;7QNy6Se)v-HMEPy&XW{GvZT|K1q=@+Gu_TPl&ysN}hUoA&i=mv#tmhHf9ELp?yG z0wH%L?akjb*N(l0JsI)wC-+d+F&aRFnaFS<-q3jGUl&CsWKmV!41zS|NTX73V4%kv zBoi=FkF7~i@#8E2vL>yJg3%84g}5hoQAXgbHv1T(HWKe}Mot_)&Q3Z=t(y z6+8FXFaxU(@^2jL6|{L(1apzh08x6s3}rcLQV1Vxrw2pA#=>D&s1nQc1{k#E0M`rT ziUEQf_IX3=ptS%STl5=tR(mRRJ|ibL(btc(;UpHo_{)e}tO`$K!w*B9^g0R^pz*;%GX;V_a%m4_xmtpSa{Vk{tLP!B-N;pBok6{I}) zuD5+&Ou+TTX8z4l0GfUjn&6=KJlXxE3z5sV-l zT}b9VBsDcPF?ZpHm!_=>wSTlE)LbjoUnNwh&Ycz7MJbwm22ujn4DalOa{VpT8;Ft} z1b2vAvGX-lVhnJi0j%qgSwSJ)8F(h&RltV*E(}UHw1jX?%j8NgiT%9O1C5FK!8|*@jOt1Z|6ACaz2;ig95Gb} z9-dIld^>Uj@eneY&{(sIfZi7W-o3>LBh}R-e`gZ;BRG>qHk{i)MpDwPF{A5v z^Xmy4uH^N_#Y;be_j@3COEb+`Kc*YK)?GOneC2(KE9=hOD3hlAJGqGgWGR~Q7($z9 z{d(gczK{Q`lp=;|>`=TcODZbjpzKMP;*S*E_)P#E^c)3#6Jf#P2t~gK;z~k7LRG$f zM{l&O&mWzVq$`DeYHRC)t~$7|NNB%%u&iDXkifV-VIr55y+UkiMy;8N;88bHueJAl z{rY6<=ZkCyLYsaxOzdwG*HnI#rPx5bYuG+falNXt0;gYHh0M6Ul&Xze+s&Gkj5kaS9*GR zd35ZT&JA-A|4Y|~vy(LJnE+@039g0Bwts&cW;{3+bY9;$wXgf1W1z?v!q5srFf-OI zbQOk)-SF98zvFdvoiZ1xyuAOP!#<1=7y7l_kjE1|5RYHa5-6F56h|;2i+K9a&ie80 zSU|Z@f#B3q`#G zzN0w)sfoq;@5u}PoqXlk>mZp!n(C`*n*2u0-jBlu6?zTQzeGDC4o*y2%SsWMA6{9j z@B8G*pMW*t&|6Ish`;~&BHlMtDCnP$H~tcIcE)os5vr|ChBDZHo;p=gCmyMJM^&EX z0ofmy-gWO%yv-V_jo}{+!8l9#aVGtIb1JHb(3Oq%*nc4MJx)wXS!FC*LN9$FtVG9bY27;dur;yNfyYV_= z>nKbONChN}C||&uD=Vik$?3d~u-W#W1}paUab|BMEnp@5dNbVE+M%#U9DGp6!nPa# zO!Sh_kR;e|U3=$V4+d`8@f@G->ST#*9f_2l^nC7BBlN28z<~51J9}A6@Ji0VFVb!8 zDIAD6jt~$MZT1$`y{S_+KY_bG6` z@Q=#@e2Gt|Si<%Pa!2cb`_1szHKp(bxgN?lJTmrOC@_K3fXU@Q3(v5YNGcekuyE)% zY}wNIOGB1QNDc2uzy-i%AL!}9@~%fVfhf_d;TsydgfSqDAxptjro9XDB-)evYJ*Yv zC15^+>=-=`7~t6tMg|%;C7J2#t6sFZrmrt9CI)e2F34}f^Z*Gzf&>l>-^7tlkt$n+ z86ug$*y&i146-l6Zvy)VG!4jkBWKT)6h_Go>70Qq+Y#{fwgOa0oxz+zU4e{6Xk8j+|S$`ogQ@8-rU&) zQ$@hU4nTJf*OPACP|@7%fN=sC?BEeF!%bAb7lrR?qL1y)WBOS^7AkoNg$MZfW-z|% z=;#0;3t7zc_&9rlGPUQfTg9A$g8k@YqNAU<>MBL$O>EU|Fx?y)g4eUguUnw#isk=~ zGYkk}Kg=^A)wyLSU)57vX<6Cb$1WA2vaGH=Vy=j(hRR7v&iwpdN5hlbD8${&@OOpw(JEvGYdy1_~`Loomj!uf%T5`MmPwvvS!f$8EQ-n zfk(OSD?}80L{Ni|gQbncfrKWRI!JVt)hKz7k}%p-vLOlxtgI{{ckuf_P$V?D@RN`F z-6HPV87>UN5B(sF7ZFnf#)B_D{@;Va-nnY9fapL19FE@9(7OF-kRt#nnxJKY@##y_ z4PtVINi{DL8KH3Q3sO=_gChC5qG+bCEcT0HjnxlYqxQa|8i(2t`M(%&e%lFa7_hBv zFa?1A7#XRgu`HNVgfZ| z)L6V$`~lG+k%{tKo3KjWz5HN{>*)z>9SdMVv77#L`mp$-VWS+mupX^!u*V! zdMXjL;MJaDAZpd^G3JpCY(xbJR@i6xL z&YieeDd=}8VBzlP$zGHiGkPiAD0tr?OtCyP| z9hn^<412!4=Yf_BS}4_8&`yXgMrec&2yA}U)F3iAoA?ZE5frb62peI#wsxwR30viG z@$yciC526^KJf-BF7(L9)ri`~xIo&bpWzYwf#~O9NwX^X5IJw7LV_&W{W27;oU8z< znG>yCqbMWY zKFCaBiqSbcc>4G?6O-<~zJL7giTvX*z6q_5W5*PJO|QnE5KTft{u+KZNBU7WC9X#q zfwCHd5)!yO$$fPXl0kXokjTR0Lx=_t&$`EoV51khNiUV$z za~gUMs<)uG0oVsz$|@#}QOhGZoGJ@MiQb`)<`0Ky>?eOD4+#I%r*?G3ejSXB{*mz! zsXF|yp5Pfk3|HyDmr97;ijA7m^bZZit;e3=%ZgK88kjteD2C~ zD(bPUw-XE6tY~=6ucz8!ox90G<^Y2e%u82A?Eyi@#0HaD6?JKU4ql|`^cv7Whdd(M zgW_V*b@_1KHvW6#oNBC6q?^yWFpl->AfbfUA4CEIA1|ZMf6K>@s~pnGOz?QJ&){0$ zj2+5bv~rA{LCsyX1H&yG;ThR~1G@h7KiH9k^g5-`1gKX+)gwrz&$J^SE&&SEzvE%% z+l}eI_&5i?9O}I1d!=dD!NW1y!02Or3oEfwD`oXVv8e9S5sFF?VGtpb;QAO2uTOr zmXM+mml$!J$i!hA82t3|j_!}>DKRZ<7J@Fr z_D8^tJTa$*6R~LK0-iRVBAr6s4q8VH^P=t%C5c<~Zlu3YJRUsYTM6AmT+z>0*j8+M z`bQY?_#fp)CK$#HRS+OREgkc9#gLP^;2}8Mrd2(IvXA1@t3mLRvR}nvYs|J>fa0v%%HQ;*uX=$l*xpqGwDU(9S<@YeyZ^Q%prw@)t zVgy|^_Jc@zabgig^e>&mt_kRI`)nNB%p!Dg>Gl9F4CjC?ZXanYGxN~buOvc%g2Sj0 znl=ESb>`RrK5m7iEZ__;Ap_S8^iCl5v#&2i16*Hxj3M2;ql&XeReb;6ynDz ze+&9hD+p?Inolr~V8$>6Em8>B0;zMa4CxiojK-ElDG3{t70k(ugR&1j7vQmq8H3+r zdRr!1SjPSTbUitAz`uEq{-P+Qio0)M&$zYHn!=xlQFJtK0`+s6X3{pv3H%FIB`|HF{8~zQiz;or*{cX^wA_ObhsiN##tyYEe#PByt49g05(JpDXI{9+5*gOQ*(2y z9%2uatzGl}_D4e%(E!??TY~si-XB09qzYO1zP`Mta?wsO#XvR<)1ib$5UYTY@Er?)3+Uykyoqz>&x$fS%gC#2MVzm5M zvxBQ~=J!;USf#!l0B&O?1~1H^Y&nFkZVe^qDSER|o(Xj5koG?gX?8RWgaVP(F#*HL zRu)}1h;Cdn>P#9T6vYz|3l91*GqP_%U!Hx-RtAP-o!tMlUI$ScVq0dSk&AQ!Pv1YH z@`c#Ft>{XYBk9GG4-E>6{obW<6kYWvL}Gry7n(v&y%pO~7NAvVaCw9kSln{VU*usQ zi7Y1t1Q;zX`W?qEorb0;=6|ZouW)EX=Az7s=&i%K8{AJhidRTTD=N2s*n`+oW@glK zgH8cK@$M1}fJ}ueOJn5zAX-{l>=Gd$g`f_to2=ekhGG(R;|PvqG=UlDfo;GV7vx6* z`VD7N@5qQtllsi~_(k;g2}4U@;)WYJ^L6#m^`be&9r5|ZpKSv_`YuFMsmPEguJCI8 zueGyb2^wlRb?1{)Qd6Nyd|6}@TDs6V!E0k~&I%SM)asPN%2B2UUopp#w}@FB)JDza z>Uw*6K7an)X2TC__6GOya3F1ROeAZGwq^OD6(_;G4Awzup2nr*m|_wUrx?{pcU3 zpB?|RO-VWV+SRrr8lQB3bdXPT|8uQ`|I3e_-OpX&Mjpbggdna57QX%q}-*~t9&gH}{mgDq-9xNpEF9OPj; zhy&Z%&En@2BAVh<{gfj>bqA_aM5WmOL$A|5m?*9DkP<+O1@dSA?Sz~}rvW9?ZlWh; z80!{ZZY}rY=bn~sLjZ2F*Dt+Vxrg6JH7W9un8VgLh|Ke%`XxU)@Nhb#?x$-D0=sU3f=BfNmsZWD*o# z-2FfAcu7cj8u?+vkG9b22QcJj_9ns0;FmX5==qcOI=}g~s3_fre?BZN@zyXT%)m<2 z&CmJ&y|oSw&mR}(M(Qe=9*)JP%eNFCJ}V~nVD|&=P?71F@Ko1cPx+Ol<;NP_n_LX) z29-f!xKqG6eggqQTniTL(3~!ReBjsVDiRDD^d9d?D&dyl4-1=ie!p&Z%ZU=aMw5v| zn!Mhre$acz65icpIN(lQwAtcyn=jV|zmD+lRG)T9RCa&UzTMssH}E+p`e}Q*?#*>_ z|8l)lbnhxFbx`G6tv2oyeuEmaq0Sq#M+>v1;u6VAw(|_10sVkm+^=y5swa1&qfM->^HzJbjE9daDi$s-DqCOeNvx7ti3r|{`Luca!P?+k zH z=7F?pQBQ>hd%7PTD!%~9QHE?X*;XxptWd3vDM{a;k#2y$f5uX&EbfZkem;naZx$u5 zIC`%%xlzLV$++AS*XA?ZFUTp|~$TT*^OR&Mu7Gr7doSU1h6 zde->H(Q<2EUfvbA&Qu30v8y)*7ApIyFUU(T{MAtLjMXPq`<3O#o3953&=_qzqUX4` z*EYG&O!T@Y&z0}rbylVmM+tg$5T|jIkpGQ0&P^RUf`K(byS0;-J*%~(0yu1%Bmz0r zuVc+IDJdz{93=DF74$~h94-hwWpUFZ@3;^TE*S5pMCm;GI=`y;vKG}7vtkAwN^-mv)XT+F;v?G3HA^(KqS8(y5R3Fi6eJlN0LD36N@*0a6K zWB8<2V-2;~(cjtMc%8pO^ea|J&_8dOVR?1pQ#AVz7y&@HAT2Ln2xfrC>)gPmob5t~ za2|m%0w74lYUT94I9Oj=HHYii$+^mAt7vjsf=zS{Y4UBHKf{~zalBgmW^kP<>gpPl z4qP$#a+&T{U=GjaMWz7RnNh}Ub3JYAbPwx+k7?(8!bqtYmcj2sP`zfp_NCWO{`H%8 zi%dc>ae0~aI4pp#H!Wp|XyV<-cO-q9x)X5jyw^A3f$2|Z;)#uRW{nRU%{n^X+j_up zhLxSv$+grs`=iW+?MXogVb6*ply=+1syG_Y% zp!9|I)VV;RGe5Ba--QHgLr-W#E(p=;j(M|C!tdO7_ok&BvsayoXJ*vyPbh!+$>pfy zQfWB(xNSvx&gPx|jf2K_>p4GXQNN}G*iKv(3(VM<<3|bo&%GV@i`S^*B7L33`41%7 z$t5z^S}OS{(Dj62fu)^&0{sTfrkiYcen6jUa&sy1I8VD+FXTF^M$Q5BqHfkadNC*6 zBYmW0t`zc|H5U`yx*Mn#ZcVR~N&bUq0^>NM8PH zDT=pKe&JdWVv%P@e%n|>NiDDXu!PHmKEp~JmTQ4t&Qv0uNS^wdP^a0j<@fdt=aRKL zU5!u7e0at%AtCdc(eqk6Sj?BhmD zwJqj>@x{?ALB?{k_dHPRcDy|&CX{#G?&P9TyJo|w4;XQuuMVc0IMS6w973wlmq8Z+ z?vlTz0EXo)EskA9TSx>D3JqVVje!==84N}b$G+Qy-(6eK{o35LmV(8uEi~d(QGX_Zj%Fia-SfxX*ng614eZZ4{}l z3j**$FiL8}I7y?Uy%Jvb88SO067RoZcn2)N+jHT5e$Q8foVf1f4qxVrna`A`Mp;Of zeLWZG=hZ3OIriA~)nBlg?qVg!G?Le3826{GeAVCd#Cz58cTexo)>*aR%;|)?KGl2faMf z$=MRiyls^qUtdIrc)Hr4I?$?bnq?}-LtFB~23C=&$o12gpFd|AwI~W*efj|Rq7#;$ zL?qxpUtRYU;sZJdKHkd9ZwGt@7Z2kps6)zC(S1;Z>l;8Cq6^>Bhz5?sX!gVL@xKK^ zZ#CL{xz{~7XnbN7snr#Jf~E%*m4CldMe|kqLt05sJ<^9hE6UCoPk+tY)W;PfXz-y@ zr(ULzzca6?@6p1{`_lLKB!PEING?!W*|kWKw^5z`aQO9;n3yk1dPu;#y258zKW}rg zZ?EYr2o@~dGaF!eW1uBE*&{(S4+X0U<-1MXitdO(m_r0})vjF-7X?33!~_(PQrQJZ zr}}4^Iys(Y_vT)3@g~?IcW`$iJ#roQ^TCcgW-3bg7IbvE=D>|lC zxZFfEowc$EBUA7UYlUag_3BMe+G3yc4%P^tQy}ar=Mvi_NXJ~CBDIYxarg~GMV<1> z!q}83X1#OK94c`y*I$U1cTi8d944P{eMp#77J`Ks*&zLLE$nVm7fcuQzwx!(u0zQL zCkR7-4R=;wZXF_U!ye0(g0iKBN$n-G1wLficQ*dq`fi(QHJlqbT$^;#c&zLb?zp_Km z_0+>h78F7o8sgs^Afa$og&K`v-i0dAJFe?gb7=o*FLyHrF!`IuMtbBjSiYe%U z-pgugnXry;%)py7{>5wDpmu9>yn6n^$I`y}hR!1e`4QJR8*Z9YzE2}pkF)A?r^ z4AUbdQ8S{Cm!O;c4>;%Ntz&!Ot2_ueT)N5ZH)xZ7PSrOzHg;4YUVg|@V8{Z`JLFaf z+l~5bu_f*^?ZZg?`Eztws(l;conR+(l08PMAZsm&kb@;Xe)?4D*-iJ=`zJJb0+6*F zqwY`&(jQ*qM(31s$TTjB4*DK{?q^1r1DXiRCJ+e_fM8v**!=dCdUb4rg!FtG#IDk05&&34Yd+~Pt=AEO1 zs>ONdlGogNb9XaLN|6L<*dAe|r`&fI{&L^)Xc9iV`->Ox9o^>Za%M)dE`3i&P9WjF zCD)ZRzsc>4Tun_Nm#%iU{g;;BO4k;05diVZb>urdh9_^7DV!4@yG354XWGq4DnR?H zNB{2yfMFOf0IIhrdFp3?!>?}6fNV6yslH{>jVZKCo`?>&Wjmk)5GA@oc%^4#K!el~ zj8V*727&Iii9D_7kFNK&Z8oqj^)0^|mX5+%tEo^n1bPyq^BtQPeTusdk`6NbsA#3- zrFYgRR)$hoy?2V9oLZvqE@AylS-_1e7S6qo^IA^4OKR9UeAyrvX_7~bnmyJZB2%D& z@9cS>6w@Vx%&RjpyoMb)vSHEyMqp8D30ak(#8F(Br9p1;Flzt|!1{^sdy>hGTmg-P z^-e*_HBV0dRTDRc0jy@GiRfNaKaV596Vqfn)6VZrXDGpeIo23%i+ShH42Bqx?QVUE ztkH4R&b>C46lylqr0Od=+RUnuI}`dI6FT|etO)sBK5RSWlO${`qF!ksEreeUiV?x532YbG5yo-*>%CLKA|9alDVN7erE2o+b3>qxNi zR926>H*)o)&=jHa761KPwF{SLVg>>QRya>- zXh!ek<4Dl$Ci~l232TwYpo@T$H(nxaq(s3QcWAa>yhyJiUXqqXkGrKdam_;0qeIB^M8 zV^&dD%-BGu*M@fNWL#QWk{V}WSJ%+;vcIVrWg-3eLmy0DT3TCIF-c{e>Q?=zIG0@l zPr+_|DMVkHiF`%C1}bNz3Lje=XUqqmDQ(&Em!2H$g5~qxtJ>Dq!;X7Nmg7a?e-{@A z1gH zqe`YMR#S(;H+PUaQod=VSoR_+XxR;EXKH5)hF`?j?D)b$=t;b%^oLgZA5LxxVQ@K2 z?r`jPFdTYk#w!~~{YNsd`3&|gh{5Hd5(<{SO;sjOVCWrp_ruq(0m{nb$B%)*I>K~Pa2UYRi}^Y74RPCq zgtXJ+8Q;SXvSXFLL8V{_;nTw^li5uTK@4m>4$F5U1Z*&^5vBB9SSO-n$C)bAoElIr zpsMAd-ZYt%6yQs=c9vl=Dlq-czjohf-bBFx)u~wLCc?oYOn2M6_^yyO)Z(jGc;yOO z&r+RtY@ewRs`ZHqzI>#*Lek@*Al;N|6_~rCMC+S#}|P zWo4{S@4XKu&!RHX1Y|>eB*M-rX7uM}cy80vZE#Q}3~UmxZQz^cyol=pyU3B5JY z4v@oWK^jxYVe+LzK71FOR=^m>L^?Qtj!^~M0z;(g&EI7X)&bBzrVT619p>hyJC z193z*&z`U{If&Ei#DN0`+HE4^O*C$u8S6gxoUUbjsy;eO7m_U+sr$og(d@EM&zTu) zjj{?1Z%n=~Y(H*jT7~Qv2YJ0~lx``D@a|o^Gm=J^b-#T`xdsQqFf(Qqw%ek1FYE~z z$8jtX7(PV)fIIwiK}Aae0%yu8bADco8?l_h3bdEua3N{?*oC z(~ZPoE3TlZ@*DkcDlczMbwpm+yk4@bCvwx^hQA-)PQNg@Y;j}s&pp5GKefSC^#1#n zG=p%fFz)VNCA1S6toHHEoIiV3>Fk@tcki?=T*w0S8?Pkf(__TSEGY;F<`>YJ_;|pk zoF+PGq$1JS#+Vc@jI24f72xZ^0|!9n>#zg-(LXoWD(FPb=;%=v7X7@uw*0(`*SWcj zPB*&t=H+KpJcwmnRhV9EQW#$+6$BGd2o_Eh*{gH|*>%xUsdfJEYZ^D6_*r|69*hy}ahXOJCMGunW$`?q20$dG4eZjqv+8 zJPidGb-{m;s}VE+bIdc<2u#(dnEMBWnn@C$=*iQEH@J^aT)TWZRcS?9x>CV*@xG^L z&e#S{PEP;EaCAA0CTj7?8XFr+N-&C(d-0L6vii$$WG=X4@ScZP61)J|m-2ghuGSS} zG`jKRtaDegjh~x4 z4M}T8hAIa+Y8^sr_qoW;F;#UNoP~gS!VC3WMXi*XyhDuNEMrAlMMPI$*dYlCK_(^% z0|OcZ11J23pWlF=pUut=w@C-*i051lRl|Ta%g2u!jHB^j2N@ZBp=bltLcEZSeC=x& zLEZxgIC*)6QF92k0_Uu4CcRP=?Q-HBz5dF2+jSROjt^gL^eAG5Bm{)^{d>*dx^ zosPAeHb&jGI6a)wlw2w%{$8h$WuZy$BQ@*gD=#pKg~IwKzz;Y3^5 z1xW>c_(1vVFD6j(qpasIUt#c;Z~koP>@2jnXw9ivUpFXZBaj#w+1n|vAt=xyc1K zy4I8=8o=55(AO6vt>y#`@7;nk`UX3zs(L=B_~ZFvQ9)21s^C>s2{c~Z+$V5JsaW#< z4s{lej(sn#E%OU@32SWGlF7%%>|IjPsCMPbi{ppB8SyZ8pYu*k1Tpl)_IXn?USk@X zu(KT$mTQ(QOtc&wN`E7t=1U;q&l-v}STLG*DFq>|7h0 znkt)`>Pk!BwhOO>Z=#|)z`(mVf@cFA9br%0a_HXyP(kTk$w6>uFKD-Ue>1&>jpuRo zTHja=kQ!zsUV4zTLcqgUTrY`)1?%9jmC5dHt5*Csu37WTSFc?|{(mwFj%A%53m%Isa&KA*|7An5h2*#s@~<_mP}e_IPAdWcDsDuW78 zq=IINF1h*QkhJ9MLjaFFShHrE`<4+F#vWEil?(AU%7OWS)18*RXZ_yp4fAuO-(?i^VjPBU6@>$+|xN)5xIbYIf>JaM|z6S`H*d{n5Rz&Wd zzp^wYzqU(MZoZdYKw$5&4|*dkx`S?;kr>!em!nV=Y2?Y<0c(cVo>MbsKF0+{ne)-EudOnAe>Z!(W2!u*lTi+yBCc7n2IZ&-$ z0?Q5p89R6H9_zY9{9wC|9Ssp@Hrv^$XVg7=^*l+BGBe@wA-qzG0G~Z68{QreAkb-P zY;fpVSnw?Kf$g$;BkF&rqXQ;C<<}J-kxJ=L*3@WUd7)QPx)~U)P?M(1w0Cz!w%eI! z$Uh1Uv>VYh{n$_K_GWUXF-(-KI>Lzdoj;O~u~xgqu3}#{x!YLon43pB&8m4b3o|hG zm;-@oDlYUn9=c@^zB@P|;JRjqGT$(~U2=?)$IgV%_Vo6GFuh&fn9Ba7 z`B*CCMR-O9H&PYVefj#{1b-5;KQ`BveSc;q6V3pT086P3Zm_uVN?DMZrE}t(yV(9C zJ++VLwF2w?{JamVC(QLmQ^z+s&d)LC*}tvWM*3t|_UfyYdIe*<(~_h)L)dl3MYm61 zfC(ln_hM{+@mBC-q@g?7oICqj%e=a*=_@3H&O@;s^+d9eN` zvG27O@WC1YtP8#_aiP>yZsY@SysZjaX)RoNx4gtg+Se^4+#bT8yf9f=i<}4orDsR1 z?bk+CFS}0oP#lH%U;UQ3Al6gcUD~m8CC=kd+GdzbJbL)bgmRF6@Kdz8MdV?9&(Zv& zi> zUB@roP*SqQJrJ-pZA{gF>qaG-@#4z{leXvj-P<|C>zj|BA8=XXFy;wnvw8ETHRZ2- z4AANtm7@x=z7zz*-adcRBmMAgYWsz;u2;!JW1| zx9@6a!4>x{p*dD;FRoQ{oO8E@g7u?MI;F~e^(il$vdolA8p0gTH_sj2C+yPLAMP+{ zeNMvXl+Cw+oWTsk${i+g#eL`qKf@C#Ug;PT^>^wdB~! zUX(1GAGgvM77EV1UYD&t=Ac*0uAXu^9K+20u$61q$^t_pZ{lNV6wP(L!lOL<#rlT@ z?R(hk(zZEEXf-9Bvg`AbpPzJb-_n|G@%D?0Q?g#ZW^rd{ofc$N6ysf&X4-Q?bl+b( zR`uO97yT=RZi#vIt%6 zoEeE4n~uFAk%gL^g!`D(rB^;>Ijnw!ZqtU3pFijE_A1k7yG~ckY#!cs_T0Xe@0IVX zM}i!ubEXDO93}tih`Rmyb#=V@ozN{8JnqL|gkDWigzl~Nt<9~SPHF5T#8Ge#N-=;c z6S?32zTCEs^ptmwhVop$Z8OgkbXP<$>|5m-u-(u{{ zE&rQ(-$Ml}dJ;n}=#eK2Gh6#Q)spqHokt4Rl|1OQ3zuD*sXJ6ct<{*MxZdKUVwQQk z(neQ!&#=+5#?fu&%^zhN%U>9*(!jk@WRWAUUBTWjTj}E-mW1TpAQPRWWTKl9vYre={-UE>U zUq}^meY5tkY?|NbS~%90^1VqsV5?JawS4Ad`78>F1Ho}}y^vSWK_%vf5{vu7be%0&TCH#q}Dycf8 z;QPSaQ__KlSBgE#&UHrVgz(GmnmB7LT^yIs}+$DBg$(0wADW!@K018-M zes*BMo;Y(99@f_j($KBP!S=1}Q5^|t5s9-MJKLX&y9f$~oZaQEG!~RIeK2ofIrR>O zp?i!H5|Au9|N3$-hs#~sY+u{{rfe%EWu-S~&o&;>NKk3FHE&KxUx;f;5_bH$|D5ei zAZs2g!?r`DG3S{(?pawLFWU-)W0akGd$-I?{=Ww>}k)_MVc}0ybl^ zx${{Kq)%6htRBe8MNzVReQ9j-LY|ogCULf8WHlOQnqMp=_dh7Le~$-V^1fKY=Qmd2 zPtPQ3w~w^2&bxGutLw@Z*jQDz@E%uu#I}X?#0Wcrgq#C)aJuuHuGCUEYsWzI_KB3^ zT8)d_w{P9*JXL1GMXQ%)UN{)+#1#se&ar%K=~%3^g-mm;oUT%Sk!8%wrGh%M%;G=2 zb8@XZOj61{v+jUaX;^-GSQr+aFvG4RB=bU{9F1YVnxrH;myok7i&iQt1r--`gU5p# z>xR$T&$U5rzo|j;Y30(_p;%h6m?%7VCv1Tg} zu zJpP&Mol%U70i4$`q+XQgAFcw&i*yxzj#h9T7uD`$&KS=7$eqwJp+R*%@PTTLqZCD z!-KD8J)YVw$5Uz3fg3W@+D_&p11g`87epOjcl5Cx6tK728P2Y@?`aWHis+B;nx-%@ z;n|^#x{E(?6)*KaL_Eo|2)J&u=j|{UjeiG+s$Avt_50qPVK~|~MJ>F+#PB*ECsdyJtaZladr3&vmmjSa4i`|d zj)mf^H$sjBVagvk#I>uN+jd0&T~Dc9V7T?mAi52V;lZ|h!)fnC7~Hg=&+Esir}H5J zb!^^|L~VUvffY&=VYxH)P>+7Ukw*H$@1kS%wi26`0~MZ3Y_rOB?EqNi10Syt8>scG zjYqK}$hQx-h3v|lodXY6m-|QM<;jR4>5U2JrD0lHyuy&FS-di_Fwpb*j7XhNG&%Dy z!Ix|N)z)Lxof}HpUmuM5FWw3eJ*QnSMWBl;^30=)tZK_GmQfN$Ga_{Zg-5T;YA!M=G@2lY3eH z&}0xE(cSp(qYvJSlDg$K%fjxrlH7Q~&Z`{u@@UBqFX)IK9~mhV_e`t{CB~ulluv?g z?8@q|x`u{7Y{_t{T-7Bd=iZ&EcG|rG`XOH-Axo4qcHQnAAY)tVT&SUCTApM=z!B3d zK8{bi{o_Y{aCnaISY+N);_SQ}68}o}(TvmVpdpQEk4#Jg29U}*e^Cyb5ODw^kyh>GvE1Za?bATph(-I6fVChB2^2Nyu*+dww zi_^Ed=_>(>G(CJO@ho}6Kv)hNw%miT44f*tqEZ05w&HilE1)Qr>$K;8e53#f53k8HtIZjI=&!JQYoEu~ z>Gs|Rd=0AY#(f%NzEIVdaWe5U7|i7<1SLhe9_SHg=NGC`pA=czOb2JIiMRtIt#GwiNgGEB>cL$b!tou|Ra6bIaF1zE(VfSHsL_D%Z%^8@US%BaY>DX2zuimI z>3X7!8C`9r9aXA6CoJZSX{R!H@6NGM1L1k<3g+D^J z+3@Zx%K&9MZ9@en)_21JBv zRfLe(#}$8MjR#zHvrf`#Yior~A3USj_Lu5)1I)*q6`!vup%(6|+pSGa zEQE%C%P||wDGGf-RgH6tAzYEsf9Kp3i& z*8pwh)<=(|bT5E@K*ih1p+^5>yR{d0%*Ps_{*W;084Iv?u5OJ-4`2{d4d>({cBpyw z1I+bLs2wvQqG~>EPNSW`z<2bi0EXo8DynXN9f%IZ`wWQziMK^;|kE#gJ<>mGNmK5K&5Jl^IQ8EH`^B=~&( zQpS^vaLG7g|4|Jv9|iGD-%QYuIxJzUk0qei4uq=|2)Y05p?d&O5xoNSbBOmdD9y%C;&OB2yjDh?T6=p_?z>;F zBfX4s!e(yHCbU1v#BDJfg^MSj7J1rUT6Vd6b2L+qdM9~cpq5IA5H(=20O%hS3cgT9 zfR}lWvjZx&>AdjQ$ntWp1#p|=G5d;2;TJu$ADOWWTHQZK;HuLbtNq@Ox~Xubc2XRY zx!yNClLj3gAno??16ptouN&7KxtYSX-m_S;y_Rb;Is~7}+U%J^*ofoyhc0oATx)Ny zZI^XIdl5WB^<3+wYg3Oztq2d1&_S_E5#^u>&q!R!vzd}!NyqJ^%(BH$bi#SoY zBfq?-f&1~1ygV4GM$$@_jpr}7$b^`Ir>&QJ`_}rZfAhO{k&ZiNotfpEJ^j(nH^@k0KPPn@TkL+*n?*BU@0iZ) zEkN}hC)rR2vcI6P+k^ZiOsi35o_o2U?j7&R-Y9#weuv?BM(N`91pVO4luj!Xr-&B^ zw%$<^KUY_0A1yh~-xF1gWoE`ZS7Mxhpo-))$Xpb)@90V6cijnp$MNMd@x_Z5r_ti5 zg|U$BitBu?subJT1(MzL4nnomB(94Lze0um2H@_x0e;1{dlak&4mtZa%`{V|4z2eA zNl1NX_gAq92=q9Rp?36wnUi4 z(k_q;%0&)F1~}{YfL9&{WE4;Ubar;`X@4&TD%1y~r6A34@+HZD3JXpCzsD`<{;R3B zwb2Ioh+XwG)q_IEJNa)qJybKUuRG}BB=k?!Q5v+VJMOPPp^SL2I{W^c$<~~bsHm?| zKT>J+CNpLJo8k9ol1ls2_H47Fj0{dmXZO24x1O4+`?WFw@)a9LD24)aG5hTW3S;9m z*mAfIeVeo)5F$CQEk!j5^|A-vVdW{jDq}1 z+|IVOg;nX^JrJUyp$z!uJPdVyJ0ia$WOj@1hYyq&E@YaS>E#W*FSQ~fA*XT?ItVW9 ztI3xQQ#w9c8v?3*QoC5z@XHc-%z>o# zP|8rG90H=CFi10u)!2szg#vfh?`S?>AHGUX6&Y?hJY4uaBXTrA`UK^Y>(G*JI$YA9 zT4wP;%qHMAohA@3BgxoAdyI^)zB;HRrLLeCb_T(zhNu<8=mFP29G~}ES$1#V#*F^E z^o5&BS^?C)&z{{U{Yii8mSOw%S#NKC206$3i)TwpOUZO4aqLh33EW9Z=TX}7tE^Q4 zug&8+MO4F1x&4~c(WA!dDt-maS=6{I7YhqC`Wqz5NB)j|D59Ye@#@0)tIb5(a^_=+ zn!bXV;fM9lT1yM<=T?@CRy;;qy1KfC8`SVkC<8%%11Mt{`k#O{dG3i<+^?_i>#LOR z{q-HjmU$o}K7OYq#JkaLl0!6aG{g^zXSf(?KfBS>0)lt%3f>i2c+LQ(SOx~&6p*7x}=k;n0jN+3=KW(OkY9gDpJ&>q+LIql0)`RZ9!kg~zHT_zWz1XqG4O zhk8epNP{o+sO!S-wYqCp;54V9A;QA(G0;oR7!Tc-=Htk>duz0XW(imz|JR2fAhKm; zVewRm{OdTNCl%;*cMdUhjGpJ0od_Oc|F2gVc1=bR2nZE-NB47wk5@;Ebb7Ns?V66$ zBVft6YdJn%m8iNR2_R7?^ffr`EG7Kc%bG(dPoxQUe_Md}GOI9qHCDJZaC311C0dnr z5of}ib8P|}hTVI-2Ydm55=OG86@fK+usH^iLV|LVzF?&1P_Y|cb91ZpTWeXl$Agtt z4Nw;Nyag|Cu|M64O6<`PK^x3Ti=E=|;lLxiR;J%F}K|;3~02 z-RNk(%MpE~pa|u)XG*Its%m!NE(g?Nm_MCJ%xVrmT&N6MB9Y)}x^OUZ4?wH@Zjl#t z%_;y;uBxS2a%%Jcbi5>nk-ikpo7Nwn5|C?k%P%Jnm{O$$UPVR4q!#xk#<8gD3#|MH zWLE#0avXF6E?)FSLP9FhvJl9q-1H#Ahb454W_Ph0eAR91NG{_<{oI@_kBh~A;hOGr zefhHJNnf98cZp4$#k2>H$unh`skrRiLKL_CBdApL5N-<4D;&uNEm!QG;Q3hu#szc- z(>8p%Nw_|PU3-~cUgtrU8aS^1RW6j&76P)U8!156RRQ0hyHx zP=%WTcYzzYe?)Ws89p~m5k9H)MKamNv2vB_77`M(V5aG=^yiwy-k(2flvr;;Wc!JQ z7Drg;FY^IZ1JnMYOnpxP8?zCtX1|e<5lA6oGp&C;F*!r|G$$0_phOK?TS9te;Gk$_ zwM9r3PUeCg2f;{H37|A-zW9#);P5>B1V|5wG>AW)|F1X9nV7KpsJ${X6GL#0a0NXZ zVt$S0^u3h0f6MToN4_x|y6ql7s^}}JocZGJ|C^Sj#>P7ekF%c$J+#QpZnCiE!D6lO zC_VuORmDdAHkgV7H#27R+-Qk;r;WbY6}3Qk7P{(j4Q z{&BDh6+tEB-??HjiDkmv`LtIH%Y^fTMU=pk^MQfAdV!J>blcch;1B|$RAm)5gInVOyHzZr48`t$J&JP0mSeP%+aM~; zWDpHk~x9x^gdAP&0e~NJ@kO~cam4Bd*huDHD$=@leaCZ2A zQ}pK}-oqs(Ry*8v0a=Vj&rIO`86N)BZP1qqK|T-c#EA(7HW|=ZHa7VGbckiiNlW)F3gc_p0{5!nOB@I$s=O%1iP`^CgZ1(GL+=180h*A5E;5+P_wK9+d@{`5umeE>b# z?%o}Qgp?5WI}T*$Zv*-Hzc2+~_nMkYT>Y+i za^GpwVM3or^X(mE7VJ2T^bog4Md^Vo_&>bGKhr-2y#cU8e>}kb&*_gT0wXXnTG}+o zsr?*Z?yY5%l|fM{kSY8HPR!{@`M>X9rQCttADi9FJJ`$tsD=M}?pd_7wH;4-l0pVf zr0H;E3vwG-Cwtpi0uZ?I?VD|fQ{yJg_}(KUiX z55LJka=#P+Zih!l{mDw@su>3O4lCYQ7;0*2fZqHXL^|i^v0}|21UIVz2#6JW-y7D5 zcDW-jgni@VmFoF1>iJQe{FRvgnb9%_tLb`RnNLo3rYK8Iqk%6CG-TxDuR6%oEoYs< zKNISG(@qKi{JCr|WLwSu0)8g=U#Otq_qH485t5flVwt@D$Uj>KViwyc1Kpj~odAr!dY2}w!j!v&fW z;Flb9nlMagPby)wA2uw#+;w2!g7xMB{IE}C$Em%+u>L-J0loP%4aO1dF1`)`EV3W`WxhG?Wp~ zDv>(~c|4ptIi~%G59=V-fX}&p6?^Bf!m<0Gu-?53*gm|0HcyC#ZsI(axc?Lc`Ix7n z8`gQdlL2V>@Lo>9+XHgG^|&|!aRMTP0ShErZZ4;vKY4=k9PHFjjmLbP%kv&eRIBr;xI|w3}K#Q9bH}U zz)9{caj-86VOv(;za)$?hIRl5B5|CYh z%G}wMvXB`CMw)?NCni@ltwUf?=x8A3J?jmsm2z@=cw(erDX&)DryBPe zK;M;>la0MQpc@A^z#tRaT()VxhW(6s@E?e&xw&A}JtDuH=9_f01sSWONzN`d2f<-a zP99=FHmp7jgc*SxP*?O^8+rn`?r7?QwO3txJ7^85O8{W-{rkxVF(h5;6axd#;I?s? zX{`9@`0me?D};Rg>IIJJP&YdM9W-1>15$x{6IJcaHDVY7&>dw{`_jRHlL~}n^fB%5 zYm>%yzH0;?>FFzQ`#*m^SWg37REX7_I-pf%ZBj`xX^T;<9jMAJKvnMONOG$zIQ09y zC>$Gi1wZ?;n-R&>)M0_y!ED(9a4<4$gB!A4Y7Q;L@v_EUlYy3S5Eag2S-Vl=`5xoL z8Y@Fd;KA3?Q)D~433VRMrF`#))}X1cxQWf3zC!Lq{9{55O+rEf)8)$?Wj4#O5|_jIUHiIo<%uQ!S?-5=uS22rVb2P-RDNXSs#vrf zIVk%3RnE7au%7%Z}s6Dk{n(dLju-?*0AvqN3XUeaelE$5MV# zV+E@*7IKPTUBMp@no!fb9g?rB@{Wz^!9qxaFdO%I<*P8S^b;E;Cbs>>jwn)p;33Vj z?Ca^jHqk6pl^}Vg+v4a*R+kV!LIN-^D0Z3Yc%1D|jG;M+*nM4E0pA{AJ0q!BNTlevjPvVa3 zXgL~(%^@WG0@JVE4^ey|+x}IsJ8rIOX-Si%;Ma48o@Iz|nD%4A9dfCM3GBQ;m{!bo zWgk?IyMF4pgR-&LBhU-(h_1X$N}AF6hLw$GpByDBT5^Q}ytg>P@^WnKgwy;_9Ize@ zK5j?#8=0D}*9h){sF@-!v0FoYZ;4^P8Dv`R{LxWS7PHbl`No`TS(0$gZXTgRTrkHu zkZcr~Mp&;5w03uECX_9~nth^-8mWj}f{YPr(tG~U$z*-vObkqt8BjPt25n-(RW~Dr zs1P7QkZHf%osx)&dAr$2(|i-X5=Qn=dA-}w0jgNXoo9|3DvrNcSRVZPXjOs!C9@|` zs*Hodo$RMwmUWbYq~o@Tkj(0N1#FCUAr_MMGiQ9Y@xH|B-nj;n{kfn^`ST}M;Sj_E zK|wwJ)x!!3s=p&`EnvOix4msmoC5aVT)KLCbRheQIig2FC*A5`E+nL_XhhFjcAV5kCryEV_@JRe#3FdhO^ z=yQ`*P#DkAGX_f>YHJT@tYvbSi{K-=u|HCY1luxr6uj9qcFhNV+U>6F;hzL7x`1M1 zEwGbbJru=U5>|nD;Qf2F`+M}m*R7%Rzzeor6E1VwBTiWC&(S;1*2OzGI95CH%reou z_NQdc81{vFAZz750|J;3&a34_J@VU)@>D|12;g%8Bae5fhqE0uY_Ugk^_RS7-kb3s zUYVlyGs%FmlXf<}OZs+;pPz{hOY>g;@aM3AY7GouYUI=+IW_gkm=g*Nq((uWZ>G`z z%sGO$78Xi?P5pWBbFAjsA3}uz=xc*8{_B5WwB5#zP$*8~`mMLw!f%?K%_jVtit*bF3?K+Q zldY@0v6sb&fba^vn4~>aXbwsg!%j7C@`pHeCBbP4^ZQ2)9BU>$$vSX0^O+7gL!b=z zC-Bsv@36YPot=(uw(6bxaKY;STm%KQoe&$2l?{HQYk_nPM4E#`LcopCz`$U>sAzv@ znV;;4LQ6_w7IcyjWf2x zi`eC}T;-`VV+&oggPn1BXmZ=FZY;5Yf`a^V6?xGax=x>Hvg-|L$OAnnM6t2526{r5 z40jSzy($}vT*hS|=(X=5xL)@#Lj87Hd0swxti&wCtL&uOv)K;a7P+C zxmdU6u%;3vQ)!i?cSKmDO_6pZmgv%Gxt=ocKdWCRlU&=DEqA1H+;(2bqy+T=pl&tW z1DCk|y*9Kj?b<8{ZiG!tIQb1#=(s#c6<| zmG6fxWGwf2d>8Q7y#wW|yRT;$iOkLQ+Mqnhv9Qxzr0W;OyWB_WAEqoOQfBV=L;$^6 zQ)=3DpH^}|Fzco80hEp9sqc~?=knqLlwY=mvklv&tEL5S3<9@f%K*uOIO9Ro(cV0i z@6ZhleUp_Hk1y9p(`_Q&YhQ}_u&kc;P5ZeTWQzNEL<~atw8C`QBlaPh)Y@Wj*}ZgqSW!`v_s)HOC1()lGYopcs%0jISW zMP9Apyhrf+ILY$Yx^Wa@C%p<{kz|yVu#4^Wl0@|^iY-Caa#yJy78e1bXud1v9kkk( zpBz#qh7{Sb6hkQ*QtrLE#gXD}=t71pb$iq<7gQy53=H<>BCbFIKnRp-Cx1ngv!e&C zH$Wr}Oy%jp^_C9|?wT8D6o~yH_Jrmw^y5l-?Ay9^%>x<(9UASS8~QqA(6Ho$8q|_5ICkMOe=4L-3{4x%f0`_-TyEFa zn>{a;lo&g)UV_@NpSO?jLBphEM}cBgTWjO~WZEL`4LArIYxnK-1tHcU@owmx}PYEhVgU`d|K|w4e^4GRP=i9Hn3m^?Dt_}CF1XQ>yMx0Jet?Y zbR&STZWkE)X<1iGB=)49SVspApyqw(Sdb;U`_p)S;FkO6{3>y$J+H>tVyg;`yn#w- z6+O#Y4zWdX@k@h)#vyEvKUW^H3`AvUAj7zwYN~5sQ9gWqbZAq`XZ|EAbpqvDIKjW_ z8uVy7tv^Q`FJU6Y@@UsH%U8Q{$`w=bQ*SjqOZ0GkHKkj!^2DP{zbwpJ{O<40LBqo% z6opy^Z$eBCog(vo$=#!pyHH8S@u?NB2!LK6Z!fRQ#Q4aE3<3g0AfgObhnXsAeQ+;; z6^05xxqqI72O#-;w1+Yl?1pR>_u`yNhI*YqH(Z3|+BeLMjg3p7!$%S%rSS3bpH>__ zPQl$>=mgm;b7v^uc z1R9MdV-1C~{$h6kFiLb5eq#+r_}YPw?%J1b4!DKMcMDtFwckHR$3rGKRq z!vGo~*fjX;7n-5+5-EgP=t}sQFguDWr4X`h#-nLvKKzU${T;xsEX^bED&E%0)mMua zomPk`m&dKg9D!wcA5PJp0+OPzBd%4F=%Usdoz!Gx$*tGSX`_$tWg{+^A-x8N| zWo(gny=0erF>?$uZ7bKJn0`Oxv9Cf!*dTN-m>nN}YWzks&$L=Gbm_YMvDxl+vDogl z_3vKa_ovsFIS4x1+Sn#O9RAL&-^gbP0bW|OJtmW?{s2O@qJ=kl&WjjC6snVrm#z-j zk?xDy$3>Pqq22)!w^?t$emyP<$;bAL81l$Q(($nILRRHo-8Ph%5#PeUy&CELX*`bP zP;g|?j-uEi=QHnCbx;wD=2knHoY#Krup8IUz_?n$UVhZ7m1A-^Li2|avxurJv{?;z zP6|Icae^ui3VDKE!q){IKW94w&s_SZEewhe1kuoV>_f_uN;Sh27!e@^8y$9UNpUgO zoE$tsj2QkzsW|t32nYzYen0RH2}uGl?&~f0Dr{n4@tQ=;2cX-T^UUy-WE1CHWn6S{ui#)V~)!v z$Hf1vX9W<-c!8fQ8f4=c2=$*SJ zwA-zwMIqp9uaGZJN*dWt%gihfLBl3sfSLs_-+66Q?v@1wsT3lQ=baDgmbA%Tc%~_x zz(}<74G;Gm2am`MI2;cT@ji@ySh|a?l9w&FAKETK+qX}n!9sqDLH>MC8hI?u1J-=J@|D11kGJnWYNY9R1!&r z>{QmXZXgVl^Bb7*(0{|z)@`@&lZBjvdZ@Iav&muN z6Rm8tpvz`_SM&{G%bp&TJ_|;*D?=Lt%j*~ zAWok?9XOi3aW)}7z6|UoK_zE-xDW*h+M9nom;(_2>0q%g+u>YD79k4&9H?;Apk%DS zzrVMacN_*eC@Tx)KI9?^0Tn58psONh)_PbuB(LS=7eyiYuJ6ct58Y4LX+|5cJP`NY1t@o8|K1weHb{%7LN_B6;t(=;F;~}j``RP+Hug8f=UShi3>il!C5|ZxDft5_ zva=Igd=QY@#UNLk_4F77i4FVnBe*J!w-WKFHphyxy*D;szi78dXjhHzlE;9i60nWm z0EITF8i?f?c}L(m=4;z;^l)Y*j2rj+otfGT#1~QzWV7zOKYTsi9EA9GnUd0Ss>sV4 zC3bJ|2wHrU@O_|*;EF%-G<_)9e90coM8X!aKXkr?MwPkjt&yILIV(sAqDQ%*_ig>! zp4mv8IeNyd+r6VpFCPmv`g?}efH*&f;t{x(Ud&e(HU*Ih z9-UtwK+Od!+76oTMh$->g+JQ@r-+4ptseTj!FG4td8^KoUHzEir4svU(ys%Nx?OfkyVKt9v@d*mGEPNo>GQ+(XEpcQu#=q#`bonbiT`L zHNPHEXKCPusvm4AG}GGvnd_=Qbaen-1%|Ma?Igdy>i%9P#&jb~qd$Yxf6>bIscnrD z!OnI5CjKkLWQhbGwr!PXB(Q|t7Zq<$?iq#VorNhWOcm-r_j%X*&`D!F#9~Y zDsdK9=#}_GMU!MNHex65@_K4ra+#~Vsw-3%Re!Q5u`;s0cRSDcNXaMfqYLKRc$v@8OvBjO#Zo%{w{6ozxRniHG-5> zk2WqRqVW93U%3Y61!ksn;SSpi504MeojXT|)S$vaJ^)d#y)6wPz2@e@+lfnc{;8fDNq+mB?gRWvt{ECNpQoqCxZJlIzQ~92O63WNiMi&4Fm(Si zYdZ7|ijXLlr$Xf9W#4r^Fv`AoHOMFBhQ7py@>l1eVkI#n+Ou^q-5|BMrZ;rBv(oS9 zB^$x3>v&98_DNY)>A+D6_kcu0&-w87SX>r!vhf=dB`vL}T4xZC=*LZ7fKx6xe?3|d zhxY-%F6rq|@ADlb+@xh>W&IBRFW{sBbknRXj?|-njlrMa#hf$x9kaI3xz?2~D|h_* zWtEkU4M`hF|Ck;hx~PN^;uz6gx}>5#oAwy%q(;D(d_9zBDyYW*I!3{Lt9gUvq6+L4jA3#2$Y2{8`u- z0bH_H8bXORWA7>pLiQxJgdHA8fJ)g3lg#+PYw!AtBKvI)t%C>8AdEaM^odD=F=q+`9RQ!aTazz?qo|C%d|NqSZ~k zbG~h@m6#>?%vJdRH#Q?TTvJc9z`SH@zM~STDM?B5d4}BsU;ZM`{~8{}&z?llLPCBS zZ>`wm=Nai^I;&T=@8B7YN97s8)loYl7Y77Jvocl9cKD> ztQNVlET-#R6WO0N-Vn5!xkH?glqkQu`C8wxsQ9DD2QSQP{nzW(HeuiHVy-k~eHV%d ziJ;t_svEg5{XX;TBZ_*L(4>z+q{M6yB36YRiRrDfi8K?SV&hm)&~~ty5Pt>tbanTH zl*H>!I52ZiUw^d57*rx-n}T-K#Gu5G8_doS>se@S`mBJ5gTv2jpF>;z+ER7; z4G}}jyU}`_*Tcd&-Nne+9!bl#wl}{zq#@kCULAP7{rVA$vO;J`NTJT)ley=<(VQ}$ z8jeoVu*1WmIDuCM@+|2-|sH13;l`4h}T$@bU3*a|i2hv_<%V zRSt)!u8E0&YlU4E|PtA+F=F@jYt!Nlp9=JBe8#une$DkacyB2AFmsN zwyDNX6{g-?`IP7z9!k6|^ z&V?DK?&K5-Ijp;FJ3td1|H@#)(+ioQ+`~`QhMzqiE6E&-HB|m3F7CHFtkLCdJ}$v| zW=lUfw#kg$CA8u_n|eN(9AAC`eQd)X>cYndex16Z?5?7&={((v`Nl72MpEgzJKpX9 zjr#Dgi-F^DNK`oifv?vajP~%V+~-w+DgSpg14yr4C7|evsF{3} zyI=Lrir-u`^-vLKJ#MkPp|d7#{$T6f{rlB0h-bmHMA7Pnpj9}<_Rh5@E2sI1h!8+r z6Sf*aZDPpDKOIc}{;iFS#55RnzCQNwolAdKtka>j!Ap|#=;zNIeCLg3)1RKTGr;V( zqnUf&)f-1k8+Kp!;>FH*xYd))Mvoi`W-W_jA19u^1Ext#oJ#laPrj|{HM~g1*|r_J z`S2o3S^&Shu%s{h?zx9hNt3|4O@?;zdQ>bQS#Hq5ZSxJ$`mtosqWlKBHd9W6o`^Ul zIrU4F@GN>1Zz(*SM8g|}rF8J#kYc==6M1UFzz*td0H#AhPD)A1f0Z@A7c|d~kB@=u zBVg3SSdirO%3se5dSiZ`$Eym7R(ZC~sb1tU0<1||(9|2uRK zQwGF=8#6d~S2!whyA*2PEKE$j!RE7I@mr3hGJF|>S{jm?QncKZqN0il)SLVq8ae>6 z8gVChJO&1RI*5*HXh|uk^xWQ~F@8PsQkVAm{&p@!DXJ?|qr)T5e6QgSnqEuz-Mz1u z_f+MzPKGnxx>#6QWxbp{hc4@$nsthLV>)lLq-< z@|T_9YX4AF=uliNtSO?j5%ma(Jb{QyZ&vV}q+}3sF}$_Kpk;M^J?NNfzBEq{%UtNW zYG|m$Z`QipW0;+pslxk$opt5)vw@UTXQ)-z3X)s!UeZK&@bmFyvbp*xo&indn(=X0 zpiuB8mHaFkyI+}hClS!P(gBC8#(y?{kyd91;vjbvOvkhbr7{AikPx2-l62<;xl|P3IEl_&l8wf z;%B(mKQI!@oO%>GhlGKWYi+H}SfhoSmBSU~+~^GKOHbf=oEF2`-8gW@2B6A4s;5q! z0#h|=SR#%7w1aagmHzW{(fxTlkN z)}(l}{QbFqE`=QE-$gulr;Q8p*>aJBy#oXG;O@i4wcktde`EL0uSR*`697OxR9+OC zchb~Q*Y8?Z)ZX?>dXC$PGa;3joP5W)Z=tq!raLJsH!@*L;0B>*jemuE^t*Q_tznf8 z_5`U@FI3uxN)F!RZVlyGyc9Ygn4u88VYeo%^H*1{M>@v@4`+W6W))%7mrgN!-zW@F z6DH-v#+DZI(GnFXBd-el*K6VEK^$k=5={0)bs-_iV5E2pV0pXF)&PbqYn%M#-tMes zXg1Pa8tBY?cyUX!RKBRl8ua{L3&~ToNACe|jhml;+ER~31pkYlLb67GjE*>npqR|e zoE-NVzkc0Q4lt-dRFpV4OOuk2Y#!PK1_$d$i?V~T*Q-88CMIxTz5}kCGfmwRuXVd) zRak^Jj5iL@fEAE*x}92swF0#RuxN9IN(-z|So?Ca*P(U_f9lgWUSzQ~S(6nJEnx9P zPAgF+FYM!n1LunA&Q!s z$3VLPvozRdfsE_G9GU_S*bZSLut6TU?vI3zFZz3v%Nk;f!eoX4_n~ zJ2JKoL@c1UQoVGyHA>iNE6IDSYX(F-yC(H zojvlk-i8Y3kHBW8)FM1p#U&aIqD$?zKI(H|Lk)~_sFP7r|1EX?YbE#K^P33+@EDAA z=}x3ik~ihMvp=-K#I`^G6t2 zW*5OnC=uxIpAAGy_`BP|s{@n9CMLobQ}$|VAg6Zd)6h#qN3I$T9c} z_>nw%&9{YwH1z4g)pe{4SJq~{>fNzHYpAGE&v^hb5ktV$2kqGwn+RmE?rNKkFOmWg#w?KsCw|!NqIJ<#Nbl9h@eJJvb(3=E-j}B*APo z3_7g%(~?_RDarq#jp|hy-@+NVeffNBTpYCPG}(R~`p_|t)z1QCmztXTf0rmD+{Gi` z?=F+G-{>zi5Aj)zNl#x`8|!Uq`jHcNs!HK?SNxAcv*YPyr&oRHov=hTU^p+5x6i*7 zkmyPBYw1nv=QG`GYHJg*n5yNd{7kHEXkvohWps28J6mByie7{P=G-Y8!Y*HGhmn(j z%h8vj`)e2hehHnRv;;td-1@Tpos+#88X;kRV0g-7$V@z1;gSRv77{%<373cuj*{w67B}>yRJ!c1>&&-n3fY>3oLmS65z>f=O8brX zgUSy8fd+Hywvl|#h8UfiGRPrL4(2UTW97G1ktg4wkw_*C>G6q-P4OvfMIFsk#9Z`n zSs5Ds0cYOTQ78T0R71G!VL7^8zXY+Z$<)@tgCCbo7ve+yuorn;T#kW_lM8BC|M}cw zcG~^k^;>auv@{@anTVz$IWBH6LqntU^N$~6=z}p8vdcI~{Q7#2%*;rI=n6i^ywZY# zbHf(RRiHJa^5iqH@eYr)?YHO;Cu?4MpRV+$Ew4>G@=3_d9E+1G1ZtjUiS=Mhi!$7~ zj90bF?8Cf3M>``mwV5@yz^t9%!vh^)BYyevrJ~{lq;7#T(?aklp{|>?t?@vx45fN(7cWg9E1iaVOm6WnUObTd27(Rph?_RDB?ZC+*k!Lx}Woo)A zT`UNg`C509EOu4KBqlzPm~S5itcjNR67`6TxOk8kA=M_)g(fBCPbOV6AaBaW9T0i^ z(M$5nN>a>C1&LDINLFTM(6zk5`ODXQ6fG)oyWO|g}APPL9^_dgoL2r(At`& zHzNW;&&U|+1=jX`sX=taV8}T&n7eKsO|(VyQ;`v{6+l~ac&x0Zf;Whmu@jBX!={b& zqR|QxP~0%VOQHJk0IRVE(w9)J|B>v4`Tbuj!fi-rs`dx8Mg;~0EVZbgzW*Z&1+EO>i|KO^BRC7(kl&h9H6N2;pr?mx&9eAK=Z|_{x%j~!Fg0qK zFTiltVe@uvb+srfD;gB9Tg&!yK+>98$QC566*nFy-pjQ1_C|$OC&--gqY)z(gUh*{ z;M=!v*LjjT7GOcUz_oG1s!pum@9O8oX6gsBFYo<^YfSuU3R6O{f)b^ zrz=5H7jc~{o?m&Q&}yC&@kCjfm~?-2$mW~Z_wOrVZ=r269asp zgMAC7u-fv#aIAmQ)0gyRM!UWn-#UZW9IwO$n^`{dkB$8B;17;$yg!14}SIUE)3W&xaa%wb-cmrc!t@j2!0xUJr@g`Rn~CO z-wFY>@s&YcX%Qlv7!yawp)X%DzR(a|6B*Lf()zM0Fk3V2vMRc_*v+sZZw;oz{&U;F zAC3s;bAZ@oD1RB4IY96Q#!CcQtWRldY^+>_bEbA>wKIqt1P9GZJ}md=(t7aVH1{KL z+e^8rsFI&r!P5A&*@Z=5pGJQj!U51&1Z!pK;>lbCG@VQV6xWN3tkrW~lMtt*^xlfC z_g&_HqZsmhdR3&z6+_*6n;RGg_}(t;+Pgb{Qnr|+y&YFzLTP*R`q4yR#tal$xOihH z;*1K|t**v;!2j>v^i^7YXdaf4a<^q!OOZIgkAg28DO#+q8#KJ@F?x3kT>2ykv7r2?`t ziSp?DOpilrs1o>NOXOK4p^B|ex=b>Y_w(<9IqOzNMucmrTg@aR3yT`-!Ct7SOKK$s zbjYPoUZYP@@L;m zzP^{zP6&Kt;wtDEs+O0%4`Zd>knG zTqaW3T+l6?(Dn7%mvX?4zIXE;o|qw=qYTWe0}R?TZGuyBA(vAhqM3q63yCm%80ipt@Fe8n{V;)?M~JJs;Hx*G${w! z1BAf3M(d%wE-%>Cthc8dt|Gw1*W2DkTVJ1yn3RmnTVEpS4%B)U)_Zz;y%!q&bs;60 zZKG#kkdgrC86XqV^2%3vW}`k{zxy&Z(siZ%sWh$MnT>+zI4Csq|a2P_H{l~Bmshg>OoYOaF9l$B>*Np+1o0uvi;ii z;e#+-za;n{K~mC>8kbuHI4ixqJ5B|wopGgaR%W)N=aMf`Ucb`W7V!>Ngaohwz@XzK zg8z&+lwZ(hFBLU3uB%U!oY9^8>Ho_*ign2bg{6MAw(=!`f72p&KTUmqV>q$KCh zLSw#6Fl(vv-I(o{P=RR$kn0R+ZjM{|)opIyXzrnbovwNF@<=77%(%aEx$l_j+P>HG ziItJD>gtlNtRrQ}s-P%AEjqH(l@QsT=<=WPXiH>)lZrV8oamORl)YN(AM-2##oifnvL;bGy&-7*#uXwWa*hWKa^cN4b~Xm#RGr>k9o|{! zgeEm(SV1I{;^Nx2i&M9uZ1UtMpXm+wTLlQC4#ZpzO&Y$el9pC~gHs2Hy@rE1L0Q^T zS|!%S8vJR%W03nU&@(iYZppFDeKa3EZ6bwTLT*F&U{vv}W_}C!cmwiE-Bg0spoHuQ zoM>rj>Hj@flOKSpH&ld5tSv6L?eE`sk@x0e8b}B=%&d(Cd7+Qb3=%#;fd9e<>T_?F zHn`)~iF?>zR?^WS?q>77TRZu-LZp1)u_Pq=5aEHgPBWf7`F_xz*;}j)Eup@M#A?`c)CZd1Y8ne z5^(bH1cuIA7EkeObZK(aJPet5>+@XSpdWfczIfTLtn=Ray}P67vs4kSsxB>!9vKO1L!FL>ZISigE+wxIH~QY;1B6CNr52wzq>d)$Du+1<;0Lo1il7ou#CrQf}RZ8MYD; zKIddlK<1KHXwH_+3bqThv`(OVWMpImD2<+;RmJF8B=xANM*MAtPaW5;UAI~3Gp*hC zmW$vI(f4$?(m-?IfK{O`U2h9e6e&SKN(7`trCUOg zMky&#=|;LiK|#8tOS(h4QA)Z?y1Tpo*?8`E&i&8b5042u-k4akW{s%nW-Jy(|MEJ6 zZfit87U=!E&ri3Km9ZKoj&bj=j#L%xGwZ$MeA^dkn%LCdK34K}+Si`qKH{oc|(?;qPw@ zVJqaK4Qs>NZN#)RxFF~TTro=OWFDJMj}~-N|3f@U+ z-S)hE$JLC z$eKAW2nX3h@&`j7A+7pf=5VfkOjg>DlsP4NJK12+^gdv^_RplG?AjvL^7DJr$;c20 zi&cZ{xH$WXpA3aAK{rF18R(C*E>^{OJdys@qxQb!aZ}TMf{$k=%MnT`Zivy8=!jm?+%7w=7*KCF8i*@sb&*%d+w-_ zi|5*zV#&KPp_7U_H+TAs49P2_wi^>u&C@+q7^D`YoGrs$-wBa>_{96;o(UqyrF||v zC8Y<@ffX_q5SZ^f+*w*#S%H?F|AA!lGHH1M$vyG&=d_?D9GpNPJ2y<}78(rZd&FNr z*eAx4tt}6qPSz=J&7P#ilC@jj(S^@8Huz(04n)IaK&?0<15(6amUt;&tV>I&lC*?0 zdcSM#@n#uvaka)Ue{h#1;qE9^J?d&V>~74Jpl(finF6_n`gx5= z-CR2eG?;>+q7NVZJ|hh##p9MtIu!t9SpMnybAaNapzy*3;A+cYCjvNuUuVFO;MxT> ze{F20OWBn!kOI(Cz7M)DHJ?7cQkeH-c_ar zWzFU<^Qs0dGkMzk-@a`akLl^?Dh>_qtnxiM4w9e?9;>j4av!Cx%~mXT54*#u<@Mr{ zdT020M~6OsTb2ExEE#5~5_3Ue-qJ*$0(4Gu89Q}1%^cVqwCwk%b~6_ge3_q}5%VSG zo?lx?RqJ10_OFpTyDBLvZqSvl8*{&FLA zAdQm4!2~Ksk_6Gx(pHwLopk)QW0>En*z|&cAju`h&t1m*n;z+dko3gFwuy0?5BbF^ z52O^>C^-}*1YO*B4K_qXB-`4WR5-Vaeyy8mNwim<2nY%kW}gHe%=4PRT06azZ($DH zA8{cFAI%i9unm!=aGk~JjFy%QHJ~pA41~OLr(0E%;34&$)XG;nCSd0uGDXNgz$dRlzXtxd|idLvmUAXa*PsrM{;Xe@tnOl)s&TjSdCD(aP$ z-NEfy3n4wz%_-Equy`vYl`}if_TWoyhu81Ob{Q=>s+FtPaNbp_Y)npANg+wbv&m+7M@~shcO4ZzWML$TI*^FPv zC{V{mGOC5n(b%T7c!Mz9gE0xay)UBo)3?bXw|GJ$EpoH^qpPcHMh3n4I$a}FreK~6 zG#oVp&*Q%z&YK&1H=(V|OlN+{G%7JOb7Fo#bo9=bMLzN2PtEW_`-4i|Is_eON%GxR91a#22c)vjU#S+{1Q< zUWr5?guT+GJx&HBkJK&vO>>K<`d$)*Os$g`E58+`*Nt6TBSIc%X=-72y1&P9ch|LP z=hKTT=)wF# zwOpI#7^f9;qGf)eAA75kq%7Z4=F1!vLpP4FwTg^YIjnX!T#hb%wqqEZ?oL&<(lT9W z8QU~9^Hg;@%psK-VKe<%J25&XTKW#k>A(aC#V$*ws2HuQ$1OA1Tz@NW5u+MW=-Hp8 zHdki1JxwDt4XpaoBr2>ZPIJH1)x7*%#k?A;<`05k{BSx;)P-R;$A@m9df$e+{AdZC zg5vK1%uYBL$=-xCoJxs*UnsnFsBS%mp+H>ECCn#&eu55a0wyg8jlTa2UX8s2c-xp$ z3@Zyu;rGX1Pcr}~_=1Fi*o=->#^0z8Ubuj`XR*{LPj>(MwQE{j?r>)aAi+vVNty3X zZUJNvcjAc+kHfak&yMUF!@{#Q`iAvECzH`MzGq%BIY-mFGn^I%%PYx@O2a9QPNykT zGdw=--ybs>tCi7)a~C?1$^>imey7A@VJ#Xk9q(wJV^lC0eXKe9(adUxKBjcm!JI{%7Pq=hgH(%;&tXYUQ>&BFS5Z z!_&|B+HaPeX#_c*E0z{n$psw_EKo;=@tqnFGzUgSRlrQ{+13aM1fu@vQvCC_&D2bo zP)Xk5bhO`CQS*S=zblKJ8|xFE*jtdgeTC^LvA4CfZa{^y%5sHwh(BTH>|&Jw;37gc zHU~lpSy@yRF4?GpgBRPP2?qNuip8>hBwCL+EZu$VC4?$Qj;vNz?kcJ4s!wt1n1m@? z%>T}Gta&D6zS+UAMKz(S((x5>myqRsfQ};A^d4qr_vd7o_v)+k=ca30s_clAXDN@R z?r5XHN7v@GdCc8l%d~P?jmPPAbQz=DGYN5GJ9bZAOUqNvQ$I|`+)W4j<7}5hrsVx) zE;2eg<-<0p^I!g43FIT}PKf!qSXsuV@)Yymob4Kl57lrqD|oCW)lJd#rwR%|7^rpl zKr)Q0%E#lHSy0V{SHz=0f-#teaO`1=f)bYteYY)?&7m7nME!|2zuq#YEuLF70w*Jc zb6Pb3X)P`5F&$%@J3Fl)HB)Z==zjzgar*tNFEbAN>pY7#x6px2N)vwdrtho?`|PZ> z88bpQ5RjvlF(+0ou4GAK%0jlUwYL$7Ke_;Um~Jw=*dJoa_+rvCGF~x!(ZkV%SmLRT zJquPs(ATiWp7AeUVcZr?IxpUS;2S{d3uN0DG-$@uMpqy-$>dLkR3e&!li> z!526Z_rzRfvhKN`6qGA|gNW_mXnPP}D%#*xWza#4`az_k9wFhSif5QuXPWo1c1)I< zgSH&#b|r9`a@IOtyi>j<*9%0mFTu{(=G)s4Zvsnd?3u9GmY;fjTtW#A9Lf{~u;_Bg zxVeWH&en)8_`}3?3Spn?#GE|?1EE0A@s)mc9~Uq8zl9%xW-+(3Ad~d@S;^2Ui-FGg zOmD+4cLiD5>K33+FjG-Yw1i2>`C-99hNjftd2>D9M0+YKoVTnZVFH!J7z^NF^Yhce zB?f&Ny@Z5m0I8=3OBXybF!(uAMjjpQ&}8;<@N3X|P5M|4R<~DM^{-z!jxNEwyPtO! z#WFfOx&lnu_TENAI(sip3`TbQ?C?%6i3zDwN%;o`s^i&}{L zKa{f(zz#0qlL2a`FDdTWds$^+;ii-^k=Oj+1`dLzHIlCRxECJhro}W!tL9qTBgq0eXMnFmUr5x{R9=e;tC#LTxnOMyC-g&UQc^9ss)Gvz6Z=KRVpaKX zPf#YleS5Ele%xgJOQ~GX_7|)&A33bDY!Tp%(7%d|fn9po0o&~F>AAyZbO-1RiSF)O z-@dsG{+D1X{NValseRbwr0eMD%!9Cp4`XGLkHg*@Js2qyHXOPp6-B6Yg#d;aC4b`= z_F4YbJan)^Zn1+hQkJbwAq!$u+xy42A>76#AW)pDXP7bh1&;ip#q2th{z&CX*Nv~c z0vB#DWPVe3k@+U&xZaq9b_>j85NcP-N`&ZlA-!x^{dI zhTWbVY|TOIF37iOaEUQ!8LoU%p!>s7`9FIqTa}Sfo|7}>aQI3|dC0zL+d-)(u znT?5u2Ui#IWaqsJTBXgFMR$_m^mOqgP-jQ+u6YhL%W(?|R#aEN`6m5qV!Z5SzQd7! zWaRKARQdSQo3GfGLvr2rmVuOdV%VZ{myp{OS4ts-WBU=!LQ_ee5c6tLn0oSw{H**r zfj3;S$oh2uy@70yX%y%8?=0Ks>%!S8MGy;ocbp0!=w^)MT;Of#PSwsfUFql=ofvN; z7TV^d&nU@cIFDq*XuRlyQ%ck(%ZgFF#f7$Fy1GJFo$9HmD5J!L4h|0dC*BHaywj3b z{%e)0b}q^mL17ug&E+EBdqB%UUI_>|ptb>&!4Yu@RYtVWT-ArCMn12dIwWPEgnQ9uhLL-)zvXlf*tA1v+p0lU9(i?yke@(W$3yp{(zbsbiwf zcbE+YdDUH7Tr{D;&1;)NU^WjZxgvD$H|QAYTUocS!o9iVWJtb}A-sOeSMksF};dwlyw0_9bwHxLEHrYSZ2COkojO}hQa@gh@>ez$x%8MxxlE#ocz zHR4YPf$*nxxTh|90Zg)|JnLg%Xl%uJ;@zX9($dzf04}oou$zt2D@CkMa41$s2Jcu8 zBBLEm=6s?v4Z{R}Jg$2xtX4LDw$eVgy)9~w2JuIF(F$1{P`4xG=@~UOosuPMRBcsv z_|701>Ga98(qN9T9+ItxfcW zxc4!tVw>!W127Gb>OrRT*;b%vb8$70oavUopXg~!s1=&+T-g{bf3qoccXDA76SULuKX_VG|WNm9+djoJwEBUkI_tkuO8u4rm1mfRe&IHHgTkK6!$7_{59kEcokK>Qvx zj{m2xa^s!~MlL+HHx*wgo)qp|fnR?){9bpDrj%xbnu1PQoQ}8?uyhcnO=3`~?e3+F zd)l33Zx`ggNJwyl@X^b6rqw3d>E!L=;%6t}xpS}9AO#u9Kb1Opi-YdTS9p?`*h+C% zJ+QuCAbO90-JPRWc8_Cc*@9uZ1T;`;Pl05LeKy~b+wDE~ZBq3#ZT)BWtP+xL zDDWZX*IauHkol18-+FJNf0JEehgU}(0O$WI8KopQ4zrF8J3&zBq&1@WZ4H&I9`teO zTFk#GvfWuNvx>2{-hRg=MgaVVkIL(gq4~04u4I* z7Ys8|MDxU-$`x#TF7{@YX}PUIzJ)zCmgsn#5}&M4^xEOdr+24`g@t)sW=oPVqwRR; z6`(TO(h4GqiuNCp3U>kFU|r(^cmjGmL~ZHKg0tr*`q)kl>D_8*bQM35f{RDk-#oTN zm(GOpC{$R#6DK6C@9f+{yNp8}r_J^clYsnVkEk1ls!m62mWzu;Nn5G;LLtNpS_PrnK34@h2+=9Xh&kz*+c z@JUNePftzvY&T(#1TT9p_&xibc$9id!=E#zl$@QtuYuwZnCB$Jk!W0Otn}eynB!<$ zf1`O=7;x8tgyrZvd|iToW~ST%?<$@77Zoxt4p-mF9%_9s1%!}U#}8(E|BZmf?n2l2 z16tYusP4&S$}B^d8vQrv`_$BsPe8#@Sg5YDLx~JiLwgR%cf6L2;^h013^O6gv8#LP zt2r~UK2DB&p-S1CZA=DJe_NxkT)845l3GVHxxrlJpt7++dY57h?k2OI2C|$ss+`i+ zotIaYkgVO48lRAw`g-|eR}8h_eOz9rwxWE4k9#=a^^mxbRx4rau~p)BG!MF3xpnjA zjEwE>G8r%9>ort_^vUmnJPzCKmy(iM0WT%aW&pNjygyG`D3de3voug@VIe0Ql=$jg zDGyPAa!T5T=%u}T_vi3%O5%L+RhwXw;KZ$fIbCt zeKA|bqqz-g-78{%B6iUU467V%30s26DV{usdt=FU=|}GK%^{Ira6-l^PxkE|(2lmO zcgEw7j*8VTExGG7<5e*zA14f^9ZI#gw^x}=;9&u5G&>ZZ$R|}F#U%woCmYQn{zAZf zrI$FDw?OP)1)k{!JjX5e&Yqru-h#Z3KdV|BeMxVIa@%Nv>r6zsjJQuqM<)YPQXVHw z@~zizScIv$L0L7^-W~(EXFyPB0{k&WQ)6ZtG70!%&d>i-xv3LG<#S%dAt8BydkwOC za7Gl+52>T42kL?lYW`UkWGe_{?S><^q3#ziu6pc+t6#o6tZ6&=h3z{!TJh5Oo0ZAQ zS2P!35@DDJ|A*L|m#p-7F{Bk5jfE*G#qWHd30DnOo}gg?heEB;;CoscaH+}jw6m$> zM#`i_&(d~4@-8g22S4V;%frJ}vky;lOeVDMcJ;^}EoIk1}P}SzTDbxaP=tY>Gck`dt0mBSWPaOe5*1l^8- zu~TZQsbF&?e1rJ6^07M9#=p{8MMW;xiJig}-Ixse{=ULNzO!j)^`p+sN{NXMe8b&-KKJMz~^Cb1~J*%D*#(5FL>jOynq#Ll8@rWX%M-=IV z$S@6tEC;&HBx!nelBLwN7jK{KtCtoQA_wyZ24332Sj)*_>+D=hC=d4V_@1Umyg{ls zn4OJQ?r`*|o5#2{JPZU4$4%J#`ewV6ec$-Jt~!m~j#A_}=}H`$@T%EuKnsv(JAhnkqq{?Scn`K4+uIqJJ$^0(1!Altl2|X4|r@<+aFJxu+cls}Ylt|{X7XmSJ zPV1CgRWp;j0<|y;i(XgPn8fO}7^l~>Gha^>!p~PpTI@fobY7&(S!)cW21@-M9^3r+ zTjS^7g8b#y)ck-4!9(I9p)8dWVWHB}-}3TFlUooxz?Z$_cA=rL=orWS`^9QiG$6KG zWxlWr9~-EFuPSV<&Q7}p1b&8I>CfgXw%NjB;x(H+taQ-cTj4r7wh>AkC55U!g9^J5 zR59`JyeoMQH>Ud6T#)U}yxGYOGV=0w?x3zPELk~_LDSoP<| z6T8)5NdVQ0iAnvgsKklNu%kgV2`+An>;?hBg4i9}6Pw3!QQ}x{fJ#3)>LS{XtW5$q z!@9+B-eHjHIN^c0QJhYF~FSWjNRYz}_R~ zwSOMQy5d`P%89gP$VUooO4fxGDlpHGEx|@=bD9hb`TQW;Ujq>G*y42udk0RE}*HN z_L*Ek+rgGH6z@fq);H7%ncieQkd%>G0q?NA{kUmPh}B@A{W=`dy=4vgz+b%E0z z9PADBduROM^E2vP3_;I^{9;#`$%H(VB*MebPK!jIRF6Of*I<}kL9ReDQR^}y1r3_? zxyrN(5~`&bIXR8%Q5lbxW1&H3Bt9YGVLRX1@n$pQ zKIJ>&Kza7geg?)E<>@3ORY_?dxT$`?i_Dkp!k8&qu z%W?vk6@vI37&(siVkqyTqAvLmuY@9FqmFE~exMPCM})i>r^dYo zC&Xs$wfhsY`&)g*Dp@In68CW(%g7j3^iQJ0!>6sDKyP&|eh|=o)e_L8K$3YLz$izNEq&%Rz?i(Q;;i4PCn5>MmD}W(`*&ZZ3E=l zUf_k>*)d9p9m$Hyo*%aTL2H}V%vaQjx9E~2Lmvv+&;CS`m6>JtE<9=NO#3SL?wx6_ zlZAZzZGwe!JmRT^iPajf)oS)+-NgAbth*r98dyL%i43@R&;;h$Fa_kLe?^tIAr0Qj(5gfl=VLPlE%Px15Qe|QpPro!sT6cUv4Cch zd6*J@ayU5EV3(oDWY!u^(DJRqt{wA*qvM6G7jgJ;*4`>2b*34SjysDycTLR=GPAOj zx(X?2XlZRvBip@zUCGUJ1ikd32g&mXW|h9aYBp@=A%in%@5+$x)Ks9jgg2c@R*6kb zl7xg1DM;%J2&w@YF}=qbff%dnE2P2dJ*I+Y6k8~?q^9znDu>-6R_5S>tNe$~E=z9S zaWRDod@IoYAW(vH8L@8#@)O3+9`ZaI6ejvC`5)2UB#-#KRdI z=mQevgdD4_>8p&>iNyw(M(7wQ%GsA1ssIUkt(^B$j$f*Nd3f2=9ai1in(su{GFcn# zzGi&)F5?+XbV`@hJqn5lcOb5ajqwW#g8p*jBvPvz=AOQ;^a80Me6-7P)P4~W)bEXe z{D6#F=u*r5+|$msAsEJfu{KI9R=I!;#2=4(M@Of=bnPcXHJ?kYty{#OKQA>QpYK;g zy-m0%_eT5tbL{`H-}if`*_$AS?`9eWl`3Lv?7mbPx($)1Pe0KqSYEvxU>tJ+@diTI zot|Dfq;2n4?S1v^nJp5cNyyCnVHunT;7%T^p;FFYHH5S~oPdP~0(^Pip_yXMI3~y(R{v`e7HDU1=Wo7%dJ~;_8Tz} zcDcJZr0?T@hAbrX$M}!7Tcbikii%$d9`+hdhJs$?Q^UTDM@TZc!poO$>cheULiUe2 zJl&yZQgkpaTxxDB9w_)paLN7$o1nv_+NV>Z(!bBKx(- z7>8Qwb&1^`O`*&A>OT3340rW5K~DR^C6t_~NvGuzt5>)RLn!Nc&lS_QC$pT*WpS5@ z4ctAhx!-->^Gbc0GMC68JGUN>juuZ^_VSfmxVLcWUSaxcCSFB<8GP3Q%WuthW5@s# zZSp7CXjL;^|8f|I_G%PmJ$AP^K2*4Ni5#e!oU&e^xfH{lMPjc9*=BLM+DX=(P} zo-C`i2T+mOX%FYI`x!6Xc}KDfdaQ&R!dlv&YX0~k945ZNNG&SLdYav5XkZH(?HT3e zai>2EQLy{gHmuJ|dGb?ITz~5f*EA<4@K*6t$vgwrx1=OUq%Dt>c@es4YHeO6-%*>> ziYCF{bjEyaI{jqAZC?)9&nY(;7+5+tMk~s!ZLXk6T{~Z*4tD5AkK!WoWJO`5rG=}m z+b#*z}AA{A}IymqS)mQJ`_-rMdb8U-9o15Rw|A5%eRM7R|Jc~(6Duwolg(Z;-%@CBbq1lf|vk8|f zP{iv0td`EF&o`Fn4oyK<wSXW4K|>AA8Apj%xj-3P z8tC-H#3mtu*^PoX@q3J8vl`EfE@KQItwjv{;N|Wr0 zsi!IMygfSVDmlz90@sH_V!1Uds8`cwrT(kC|mhZDcpx&{kH~z|j$?CD;~c zic>J%`3t7$*=e4K$F+%Z7gWZS8=bsF=S#J&zPXE0YC7YSVW4j07|PoE_Ltvi97PDD z8w_nE{z`=CxEK~j@LWu+!Wv81%I~aNOTSo6S z`jSgMH$#~PyXmz1$B#cj{d(bVC?hj4JbbhILyYI40kl!yXU^{qkDq!tAp}^J0e*|$-L$;gO;!EbY&!|j6J-rk=JVPPCo^{r#Y z8)R;Qz<9(aZdJ^AgI*vuApf&(*G#aS?{xnNpbriX8-=Xl!Q83KCDt7Sj?CNT$pz>jqojHcO~`F$84;$q#j~gn8nP1;{=THpU}82rqJY+bdVQYNW>aUP8N99@ z1MP_;HJmgx)jil;F&v^@9nAAsCHrGQ#T`3L zDV(+HCrrd8Bo-w3BV>{#0qTwW+XXPEo}OfaK>f_LhTUG_zA59*J_Aa8@E5RhBqUox z!th^GF{7MzyO%jioNOQGyi%HK7mrg8569sziEv`d9@W(v754J)Ycnynu06^6gtG^>?E_L~O4ASx5WZaQ)1+5jry- zo}PvV2J%@d3(L#mR(OQdb926TI7~rE1Egh>xWw{k?~jj`&aj${(;BWAwVH5ZH1JW? zYyWgbckQtZBs||1WU-r^k}?W2F1uZ?b{JYu7M6;jmX-D>IxrAIl%&keHjSnp7B;>! z!Pld1g@(7}R9rYmxp~x>0Z$@JTv^{1uc9W90zc@9ZS+nOTz)Dpr`Nak(H4R z%AUi0`joPycHi#nYx}ZbX@N@Thn)U=8AE#!e z<3naF85}>b6kKJ4tE=i-ZO3z!{tDT}PymVH?B$pAp;=8pASPdcdapW@#kS7K=?Ot$ zA=iSBOxgZEH0(Q#m08K1owmOBmES71Vr*)lo?m}^v(&|1;?1}LYnkuYUh`6y4uit} z9rX!DRn+Y<;24c4A}ZBoU+4%$VbQn2%NeM! zFAl1I^=bgqXgQ)TdsX*$E++ZwS8Ra{~r$glWu(#UDCRN;@vi5 z2x$lj3sw)@JVcdm-8wvasH2zGo2MWun%1|-D}d(mqXU-WIY9)lz)x;D8x*p7ch`x@ z$Yh?1{fR^Pg7{9^W8>pD_QsYfE$;@>;M}p#hihjJO`=3#R@%c^_%nctQ7gjF-&P&# zU~2mI>~#CAPC<2h`!|+AS9c!rRJow+0Dgr!@)s*2++fctZNB#EU z30bkp#79uluXh@~^e5~1>%hQo9d~)G*ST4CPWCryh}fbUgHk&W*EXhL$gsgZN`2!u z7>Eu5^M!W-L9#+t9)}OZfVeKo{hDfo|IbrYUWLe;xnzIenumu+q>*$(tq5vbc(-nW zzQ@Y3;$Jmc*^{%_6Mw-ES{^l2r`sw;tO?!74woC zBl}o%K8SEdn5YSyRIp7hpxp}<$0X?Sg^oMqA^7iy&OI};OJ-&+&&0QPF|OTkz$LVe zdzQybK%fg>8&@tPbg)%RL$L*3$|#%jKaR+Z^79k5y0*b?xhx>pOAWa(qWWeVqleid z|8>}dC)e|XreBQro7`W&q@x62JPS*2XQ%%v8FMk90U#6%Z$rZBUqsnic|}DK{CH%W zU!Y?_8WRJWtzA`BAk~jR5DKZq)M*roNZjgxh>Sj1>(zivsf_!NrGDe7DH&Gd*Fwmr zbH@9S7^jyK|J3RlLMNeoa&F1KW`KXY7L>i30H?!f||H1Of$m!c93 zNnB4I1`IMcH+{h{=;<|?YadWSa81gdQz#XabsjD1V12gC9bj+#1Y6bd-0I!CBvNiT zOlw}3M=l_gIMS-KVf2JKs;&`0gI=DV5xfqZ|2bZN?-k)fOISJq!5|9C^0OAryn?pq zkSm-7$0?p1O>TYae1GSII2i<>sT2pP$rP#9wMzeDpw>V$Oua z%D}(?b+1wv<|63eh4322jdcEdLHysnD=sWNL7GW@emgrNwxZ5Sr5lLY)P)5aOaX|& zOI>=twD#R~h3Z&0@pMEa`+E+S9iG4LqBAQpG|`!voSK5cCkv9D!_c4!>VSCkugGY= zjA{J++0OqoZa1?~k{TPEf`tQ8K#Z97D&^Lq-W$5zcWQCrH95@ZV};PZcuPQsc`}#S z3NuUZZ%9wFxb`=!6;W?SL-{X~$L=oJJ>_kBMsz`L)ctRs@uQzVqmvRen6oBG+yX&C z0fYe1I)BvG=EMDFd^Mhxm`GI_ia<#C)CCwdUU78AWK{;abhzf;Y!+#PRgUtaqSwq( zKg_N#j+8|yWOYPc9OnuS2oyvHgw9mZM&L|^d!CgrF~xH|&nq>V5RjAW1vm1Ki2Hnv z!1g^q+OyNwNny=`BPd+s=cf(_IL_t62dlLa&&~Bv#!5iCTR+qVIPTD<7Z=O&^ZTsQ z7pUhl!vuQ)E06l_u9t!jH(z|9pUPXx)|>AH7i(S%*Z?RXp>U-=~EG@?5O!S5v+!%hx&;b^fLC~tHMRfEW56wOtnVT;wg_e zywg4RQvh)6v$Vq(@-i09|5=+;E0 zLm#p7oh>KC$Majk02Sw1Dt;@3b00kjVfXX|t>U&e_4kL=z1vwGiTEEbrdFeA;PuB=z>vg% z3OByE&aXJX2AbOb}^?8Be$b2jQy#Tp(I6 zBli&s4A=sWDHx7WmJ_EkTOP>$D_Q@?M(TJiFLOg2cHu%15u57Emt8;J&aY3LEuP|I zZ&v@dZ7S-yaS_qc+|uF<#oJbfSgz+Qq2dG<7Pm+kJy*%p3|D@uMMfDe0H?I$Bc#6^ zTtgtE50g#aJ33Abmk=e1D*}yTYH?Ao6#Byu%nax21O^wG0$+l~Wrlz>K)*i=YIi=3 z8eRXxJV?e=b|rbkc-0C*wy4%VP(;Fq9ASj({mCH@4vqu7l}DQ3m5pX+QC$6si-nLj zxUNf7syzvL0o~nPU2EO3P8{qlm&dA}$p?d;Y1YOR{*}waSs58|To5WhkwK!=GGBas z*+3VX@>ZfyYV(1Uazwpu*6%+F&V0z_+ei6aU zWM(Fa;(~=AB4p*qnLDV2^ffe<0?&WBfY?-w{hDQ#1m?fM%K@tSCp+ksF|#v!1JKE@LL6=fZK@t{CQD|&l~yCs;#P9 zGHTkQssOixSJ7M>Wdfb#$cJxT%Z^^%x=`1cBiQQ7X(5H6Ef3a6{HD}lXGZlngl$FpFL88 zgt7U@+xy5vT}gd-n6b0ubOVETahiF!pUrxIod95h*^Te>@PQCyBuGPw4TTwU*U<3r zE_f3#uMXskF>XI}{vTHi3)7@w)Y0hud)=udKI`?5m@t#CDvbq>I8>ihrKRsBficg2 z#I)oW7~-ErILlkPKg;m&D3Z$2ou(6B3T|`vc{dJ)6l=y$VbC5!MJ~}!x2tvV>BkZ$r zai^0c%+RiJ=4-V^PET*s$jG-vmOQvS$#MRc2yY@Sz{i@2`NhS@Vd8Mn+(5Y&%Gey7 zoc}A-`<}Ojdut|H%IYxqDWL3nUMgjHyl0Awb`p?AI&Ib=%=cDagx%%&Wy@EhWIK;CalEQWX1o=P^(e z6tup4xjI44I+G78hsDlXV2dlf>OHmci=?qv?*lJ}R3ZFVgRC zgt0%7+$Eoo=Oy#9%a5Gg1zq*-tvb(QndFPy+!%Mb=ci`1)~1dq&R1-iUAuH=oIQx&?ML2(MYOxQCID(nk=V0%c z*KomEOBN&!UIwIo>rA!4-^YR=d`GQvx+5x164F7WrS~}V3kZO7HM!Ue*&JBjYl@0t z%8FrdKkaM)<{e*Iu+crKJD~q^uNy60NnrZO=o}O1q2v{BOqT!OozF|*LrtiVlY{|j?<%5F}Kt;dj5k1uOaQSc{VpRv0Vkh+^^#x*`0Xitj zVXhNk8xlS>6Za^gr;6j>AvOF!xL;~2FZsQ52Mn=PzK4e>e9fN&Px?EH9M`UyBHfnG z3^TJVK0~P*A9KgT68%Rub$3W)=7rKrAdQEa1qOK>q_% zSc^Y}@V}4z`74KoT_AUDmiPu|dcc4|01deXkUiA6Wl6$thRif=%L+k{WAiJ+tzlqQ*o6Z6V}Pq5nd=|2`Z#0v;ZlfZ1(qFqBs# zou|d&ls=g`w^1FA`2!b?*81-hB!VBFp%azxtZU>{I{7CPBbe_kTkgwP< zWBMn1nEvSEa^>QOz(AaTCr7XvjbWkl1p^q4oSfkdCDq`~pn&x8#~Y-%9&hMP52^cb zNuN<=KV8^Y65azbi(cF5iT1&<{kbE;1UK!j2HF--r1X^@pIciqhP(=97ym0&h0mvB znv_Hw5YRJXL|U?&bsC1HBKlax3sSX zSDXx6EbYE$Z#18~h;Sw)MqV{9WYhw)mFF?K@?r3ny1KfmiVE__|NqBMYDUIz#SjD! zf!S(RiCpORV{o77=+d!qWB|A1VpUGBvs@?QE>Md>+M;yQZY4)2r-v?<@)9 zF@(cd-?i1#qvb&-S2tlOFLZ;-3&K$vd6Jlbnm|DTI=_JDCs}MvKBWo-#-h%@V`0P- z2l(jr_E|6pl!qfs*a~mI5*8mvpm-P;f)NPKjdHIz%09X}f(1=YYH+mR_FlZW3;OEi z-@ls1NzKuufpvrG1L=kHRjipnI?1RwT?d%;3Y=n4$`z*y zJV#3YYa#hk1_oRilzo;*>^`rOy<1=CPKFu^@QrTVa1es3O$v@@Vx2})Z9~z(MZU}o zdPhyoTO<5>O^uE5T(BoSA_4;MpcXO5|zUC}XqtjLe{)BWLYD ze!x;w(ni8%`tGbU zri299eNa#p7OLF>SQD9V?L1;*vp(7-9-+}|(9*{eur3D=*^_TDxcikZVrSGA4z(*p z;b+HYx^KpRAOZDK^X^f{)x}TNdy96nc0#pzz@~xf(#&)yq%q)70hOepI)qstef`=S)?sho`a|(PEiFx4 zf=fJ-9nybAb6ZKt*H5Zf_V;8@TxMixvK@R^8P_V z&u%TUvtPf}?}m*Z0;f$K#pRK9TP;50Bngj);}#Xzq=SAn)uDp!d#+GryNoJaTThjc zprNCmZZ%&`_$aOlS(o?(H=l@YRrqP0mgbC}PKx=mj*fb_XE@#V?n)W-eiRo2gi3qK zWjBhG04Wf;|HXb^+I+S}PQcxzro+PnMqU1bVpbSPMXwZq>425{cqNdM^2|bbY@((T zcB;PKR=xgu(lb*tbOC|8?2*&M!xwofEPK8Nebwx}Vgf81#ri+ZTN3vrQ zi?i-I=jM)nLjN&1SP~wtXRe(pqM(p`#c~}q6QQ`oX7EZ4c`2(E`~uZWOT0mHRO8jF z1YfC+-vt1B^66~e|Iqe4&tXoeth=_j85AjH(ZG6bTM~4{^EIh)9Yxi%Ye~p$H0+5_4M{ z{boj;;B@r^pL(#bvb8(fS6P9|1-d9rQ8D(>d?WeByln^b zwC6yi61{;V@}5+?m@6jjy`8Ci$CC>a!t2wGbOOJ=;G9OVF)sII#+v|=Z@e+d_ep_^ zcCnz!Ddo?BAwkAkx*x7MiYIwN$=x^Psg<8oZqCDvtsybMsS!HYuU`E^E@*p`po@!~ zd}nzu9g@-Q?Q&+l9x|)FM-Y0JcJnt|tQIGm4DC%fUZGPc((Qi69#H+IYxD-kkjqbalJh)U<1OLQ1ZY-@QMt{X%MWta)lng41%*K$Au5 zXDy)=O6rfZ$o8RPcD*5^NWqZRk*9mScE|GzF78FfqcCzKRM~vtcYH%m=dS7I=Ff^f zW4HRc+UczWdR5i**A>K6CA2hWThk%nub&QIrF1Qqnln^8E3xb}tiN6u?Z`97fRA>O z@wL0n#<8J_ik*XlndgJ}J5kIQ=B}uboaPU?n9L>?Sq9gbvQ&5NHnw%;G!sjn;_oTu z6@U`{Z(rxqUlpj=Z!-_?9%@#l2;ZDiS07qhx=F}tziqAENkOqXTL)OuGZiWhqefx9$1D~#?%582X(}z{+}&l>)V!!RHs00s7=xPT;d)ly z7TTio4I+%sZo=3C%gZR+%eosI>U9PB6A%OLY?YM>80M1zwu&P_C7Ivd+gsvvMj%K1tT$RBQU_-6z28|Jnbvr%t2+p~7e`y| ziLQPvEqBsNK~&OmV=^Y_>#dVxqZc@;D$Dc?txp*REG@IVC9(m_Ew`?Z`=OG-YhV>El>3;y|!m6c48G>eaWjfyHyH8y1Kz3dq0}#p1i_C zTlc)h)HT``HfKu{PK{9D9Thm;*G*TAd71!)1SD|c=al(l>vpT^jX62^>Wcd z>=0c(yX8YqT5KSBpKRtF6$xG?A8qhi&~XDxpCIab}9Si(BbFLKPU5l-Xtx| zRGxBJPFeru_SWhuIm{C&QmfCGd!fi{H=D?me5N>mVS{fj&v+?#i@eCIh1Y3eC{Huc zr0QWrt2>qf&q--pL_p}nv*bo-{lvUc(ye~-foYVLVmT#bPKw0W^Gj+*%K8>>O?z7s zieUDYsAD^)>I$@pK_d6kU#GmIh3XB_oaWN(t4kJ}U~O)c?MX8hWvZI#^kYnn`q5pm zJ1ZJoGqT>}by%`xgufhQOAvjMNofzq4EXB*`js>p{koWKbHUQ!i36vvEdd_3z0TY& zywQ{xSD3c*DdfQdgFhmlw1$4be}~rj?5U}1soo`K)Epc)s9o8)hM;(uRo@*4Y?nfd zC2U1SDsqi_uMOzo18u;&ccW#lI09V;&L9jw@+CPrV3ihb_@>{#ihjdkdcme~a8O=V zwXXAhXqA%=P_c4zN#w@&e{F(8u^0<6soErGObINYp);aNZ%Cr1<<91sZwb8 z;ps$8NY4hS!^Y9pLZ7)YL`9fgRZc|{HQJyU4FGR6Tf2n$2Dt0CaF!34lgr!!P%B<+ zn_K18+L)y2A+TCzpIEY^;H!Gbuu^eOQ3R3waM=%PQ1}A1)t+iA|HzgpQ<=lPqLAilE#lQT_3keD_uK2hyogFPi*{DPK={cSafuO*<7P1{+X!cslD3l;f~pj z>%YO)NDzXMM>2}d|6}W`aBb?+P` zk3Unsoz>OBWdHe{vHiKU4+MeQ#0p)*>bU^3Y8TL5wvKbf|yrW4*~*Na!OSyQ}Q2p<1VRLS^TD9o9$vk zqZNB!8yJk|JI&3C!tytL0H?ge#Jd%g)Ulu=3Z;+IW7X(VLb$XSMK9CSIWcrqU*TiNwJIeDNjoU$h&9&U_qUETM>I^%pRGc=dz^gzVc1Co~ zkdvSCz7X<0YzMoJiEEoQGP2aDT9WIqM+L{oh~)0ZR=W$S-dD12jf+$K`K==@XETiO zv`T${>TL#6@fo&*)-Oiw1!zVWUP~r6rpTGQI~Z+Omm}hu*FlGckKpfm6K_Qd4pJyM zRR;JovoQ_kJ9WLx2mOyq#aYl``W)9fPO9HfSK+A8!v_1e!@QoQOCg4{t1Ep$6m+x( z9)-cww9dLnyAyR+vP)3eXiIkdy^ONl{Lr50Y zjHxeBUKKu1vMDypWi_`Zt^LPt)dTMFt9Zum;1WO@=r6eboKC5Yl%C#LP0fER+5*GE zt`%BCo95TAOBtE5z7Jcg&cn%D^C#DB6+>8DiFGf-*+y=90zXnyV?^dGls1Rc6ci{S z4vuB95GXfPA3wfxsHV@}6B;;Zc=u`znNpA22bd8d6NeCRp3wgs9bg?vWlcb>dPogZ zrXtTJ-NnIdDB<2?wz8_%wT~x?vdwY0u{nn8m)Q_m!KSB)8BA(CZ<+Qkfo+T$fO)5k zTH{u4BS+Mgl&mMj@2Z6`X06bBf)=V=+=^t+#q+192L~6rcMDA+RPIZpPL9tUc_11L{&I0mkqJ&|6pZFJ7cX$NtyU2do0iN zU?NGuBE(&@On7|s6dZYECzbt$N^({8w|QhbS3LDPy+?yfaOiWMJKS$CbXs4-4mSDn50jA=G5`%Qlck)iH$bzZf z%{kJ^>uGFG-Nm1!H7Xopu-oJ5w(cWN-J63+somq19k9KpJd3+qk{3k`*>(53qV?Fo zVv}ww=fek8oz=Rb&8vmhow$Xov*!YHEZ(&1#Y^Ytu4P+)R{z=)(-5e*XRxyOPRllo zB`I>d(l_w7XIe&PxkB8x&YoMIkod>vB(xO7QC^VNG-2#nu!1{VZQjpsy--lC;Hcw% zsi&#)i?upl6+KWQZt#NN$Hh)R!b2EG1atNxUPyd*5jq8lFjH@9N}CClagHs&VkTEGiZ^*x1-e!<&_xnyTmQ48s$D1P60; zr3wLW^2J@zYSWCZz>A!gqchi1lblbT&*WnSte}VgZEG(L|L2ndQ;=!ku}-9>`#y%_ zRijByPF6TeI?8_Br%2rd` zW@Pry&Cb4$CVwB%1ULb1Ka=?cmHy4$>P+?rRlqLDo%i=fE}ShfH!+#{#R*5~D6ko> zea0&gC#hXgt~1+dBRfl1yWDVCd88=b2$&{3dmiH6j?POK#cE1>=CvvF3dFxrHaHj9 zhm(^x+q(pzu@LTJwzVzz@X81gmHF73St{|dynUuto{7J4h!ez)3788g2pM{T(t7+P ztfigOP;6$?W-nl^ceYoaT+3m{`WGW2BP2p}8><5mk8^Uyl76w8N zSydBadg0P{ zca!y2=_BmQcC`2tg~0QBcZ6AjsVt43%braayHarN_hNC>n0UVY1< zU;ke^uwKY&%*yV1k*Yx-WEUgDm`SVm3vmc~de-5#7UuZlChOMK{HD$?+q3C z=|yFbwq|+q-B&I{<6Ixf0UCgkxN(PsIPiw2-P~95utOe;^?FL-lH%xS7P{|)Wk#nm z56;p-OCymT+PuTw2;d0U<5Q3;GchtYHgg714?Q(8k?zrjwWSY9gp*U8DW_NV4^-Ag z>eht%^o<8}x02lr;!8^2enR1w4qv8W=VDsmq5EDpy~&!;)D*{zg}szzeSU#JT1Q87 zYx%QAKp2 zS`_`Vj;zQV6Jryl%Hz>nM-6Nm_VKZv@@ z8X+2Rt-T5LBMyqeeGng%I7`X>qo}^`-ohnP@m)=O(HieEXU}&vuMVZ7j~=OZRS1j5 zT}-qz=58~%q{bxh=}~Ie8?QrU1Jq5W|5} z@4p~pgn-0WqIy`=`;^|09C&++%F4T~u2lWnU6kK}n#_IV@@s09&R4SmjUvsm(v zrGTLA=7#nq-&T_Uv)U^;Il|9R87LkAP;heXK{crAFCgBSrP(%C;y4M)(Zdx^ZyQ>; zIXg|a5H`3lFFF1kRw7vxW1?-axf5z={rky|GxnX@$qN4lQMctd*|8ynN5u(Y1(ZGVao=?h7Ls-VNh z$1VF%ZrsR-ZzY|>^WEXFHcCROa)wK@n_CpCg^7#JNyye&v@@ZMkd7{(`C@}(vKYop zeSG!)JvJ}taA|4#5xEofp$l$4KZb>MF;ettQA+ z{{S^#-8=h?j`n6d&4OZlh$Xt7bERO+e`ic)R6U zjgm6~A`?EeF{P!;Jl~xna1|ClP8sZiIq}xsA{-wZ+d?K&7l1vMF!|;=w^*FS3)BNt z%(huXx5(*UI-nK5ceeEHnDbFgMTFS_G~jM`3L z5{F?DLhQA_2B;2^iucvWPW~;km*o>N+(=w4nWT?Hfc{(*2Nf*S4s^2M^`=3v7k9{loY7 zg5=cQ+WW+G`b8Dem)(WqZt*cd@~~q%xO3M)Ow8`y<0nu0IHv#n#{Gt)PD<*$pI>Y^ zn@q|loiZ|q$@zTmxamhV7B8>RiuLxZscJlcQLN&lFcnuq5P@MmARfl-HDfBc=x)xl zqV2|X+iAoy79E8M2vD`H7M|_a?a;va5xKipDy%Zwc18blQ@){?VvELS8y>n(C27Xr zE@P8i9Q>`_j3Z89I9^D&&Fk0NYqHNl~7n@GjME~AQWRoxMWAq3TD+v;JuB1WKVuReetAR4N>+tm+cF>LpL z{Fw4L_;#kVQyCI;gr}pkE)yGD`s{-V25>wTa4RD#q`tBpd9gD+gcL^63YKcT#x2ir z0j!IP0c1}=U?4%_;4J#w!6#|~n}paaf_6`ps2CLY-5*`@z`c0!DeB`cZKc6nVrpMt zLsIqE)rB4*VBq-sKl)8@;D(R_c$o;=A~n1Z2hdy~P37I^-?P**9iVH{Nlg?ftELv( zH|DM~r0&{osZ|`de+7>6Yr^guFOKBb-j~2WZ2uY`TMJ8Wmv@DT?t4e~mY&dp`RCO5 zw6vV`hi82O$65UN`Q6hD%8@D+BkzDBTzgxHlo#!S7!U}V8DwIxBNRtx$oQ|LUaMK^ z*BU-GMmdaUwbRA5U-_uczT0d60_qa>k#j1KRpsOrkRrIgLVxnL{Cs09fSh;lZu<*U@HWSQqa!K3 z^aG%0{F^g39m#9n3I~5zSN_R?L{=;R;K3Eva+D9CHcC{`+pR>iXMox>Ags*()h@+- z``ZUnL7y@Rl9B|Dj}xFx;fle?%9fRkbr_|mQ&RC>XJKU(a<;4eV$gMlWF|bTD=J>mNu(U?o(4~t@NoCbMK3-H&IHhi`0TSdtcu$2m^}qwCO8d0 z@BXTL_b?>v-08xx+&us>z1Anq)6LOn7hpq8T`YYPhtiHYxF!s)y70G>~9Fx&Ql7U6do+4CgE zK(7m|&(t5kGyR$e^cocC_AgCvi1F{vB}%D`R>>btQ;+~JLs$2Y)-?hhV?$_OjizqG zbely8-*KV(7DW#=8;`*JUP!}smX-0W11c#bSxw}Pj<8!sNt(~a=L1O$JTUPqf7WUL zM&hw2=m8@IiaA#>Q(ONFNz(2j@>0<*_H(Lkjh^Y+KCQO;5X`FQ^B#o41vf))i0f1qUhsLgM+Z{F}XKaWb?A z`EPijZ2B{Cc#z&wIjojakqJF*?2wMuk@kKFE#-&l4522e3V}Hx=_{|G$PC~obd`CW zdFloYj45C2L<;S~gn-tKi(m!=9D#r0_^cG+Q8g1ct@$7F2$r@+&GxQI!RQc4kP{7! z`|K?4AotOEYG`4HVFb;(A~f=aK}2^wP%*mu zd7j=YrWOiwKah_A8V>aGf3&kli@9_0d~w}t2d?>ky#cPPBf$-L4K~xwF>}U&a@o-3=C<3i^v;qQ8rfAp~{2qm623W7Z|z#lIl4+=oCirvPN_0>p;;JE0PLCK-RJc z&<6Id_FtcTbFc>>2S0yzg@oO|CIEHb5bvEA!|rX4An5f0iid8Wm$&GCv;Q9*kKts2 zzVo9;_%=3jK%RnyeH+2v4q8uCCwM@-)MM2TXnX4E1;K^sM+*1urKQd$1Ms%J zYRO|U{O;wca_D4vuXx-zGaKllOx40?X4YWAUY40#Xnz8H```rPR^0Z_H?YTm5?S9K zbfH$eoB+K_49ufll?#nHhrg$@@UuAXNx1{<#wL3VQ1y z+oIY!r{TWkvFo+j9S>IuFOP`X8=tuySB@~(DxT?^u4cZ&c&plNXdq*!>^scstC(M) zkh30Jb`n?95fS4G9N0M8xzYgCw0@wGH!aYF#mIyw#fJN znKKKEi|Cc%|H8{=4fpeV|M?V^6pVSoY&LYpJujZ~ZRa!PxO(BIep)yuC+>3Nz|c^% zNO`ttpZmy@{=&?NHx0rlMn7NQ<0A7GNRz$jRrQOVyPdIC*{?5MdW#!-cf%9v{v2Hq z7#Te?kPy^)_ zBg42OOO77#cMz~&n2*@D$A$t};Q0>tDFhdG)e{u@atwtWSRhGC3x^91XJ0LZ;Ya7U z&~sw1F6kfAat}@@y6E{h&IEqZ!QoWeBUV`jg&pv+1j6veqwkt5*$_^{St1bEVeq}H z58Ve2T2iwLF$?$1$9JqRQb^S9cwS`VgWFYTJf>S-aj0)$@kb@c&axJlN#_G+E`Ylp zL9=HDqU6n~en8KlJq5BNZ?6j&ja6~6CSX}y{g<$-xjH-ao?DbJbdt(~E)VAWhqtbLx_Uy)qDMRgqRLbb5iB8xUpl~Ti! ziaXG3zi7rB>)w6VtcudF8y0|#kiqYhq~JHS!9COfv#jhWt^F9-Lj@Kd{6&@D_^LP2Hg;kGg2H(D7~5dmpZ5 z`CvO`5D$|ck~}?ZP)#acBmSzq(6Ub=$h@xiT(y13f`c(v%?dMnQGbQg_5x)3sl?RR zjV(|&+U*J`9|Yiv6534fFt970)v}30yXrcSlQV#b8--jj7393OUvf)wIBd`x77d$*VO!qjuy7J4~5ZG zDXhbaSq02yy^I$Y62f++qF`uQN^0*KGw}J$Mk|bKz4u_SMO9sW5oS;u+YL?o_D?;o z?alU2{)BR$gdGE`9R{MF1MdgM%ZrMfv*SuYmJRq7khC~eu-sNbs;J0Ah4<}M6V3_c z;SClc(5?iI)qI;WSyZ+ZoRcoODc-jkAS<}k)Y1}2E9MGJ+;ivBA!Rx~E(VX;!Mvmd zV9E-W{{a=T9f4=A!w8PEaN=%LVehGW`N*xllmMs;NLG%!{D%N>LQ%?W8|B+tX;-_= zhU*O430?hko8g?^4&{qV1Kc0AxYY!ivy`jHD!Od$xL%x+$oic^QIk5io$LMhv`wvYiTx`V+_k)@FIT&=zh0JZ)A-!jwn3=lVPGHLRxL6?HlUBR;;Dq;~=^q{~V56a- z08`cl&e<*PU5lFJNC1BfzTmB?EiEl&WoN5rBc;$6*M%TYPmp*6w4H>61Q=>qeR%&5 zY%go^%TwwmrfAcz6Jvh0>p{Nj5qBs4q}x7Phv9+$e0hMLMAgfS-i6!FWv{(gi}0&~n6rJR2m&UkbRXL@UO8NKXODfa-4fmDb?X;{Tru5IIBXxN!f+ zWz)rg5be3P&YKqa_-&DQV=r#pGLrn>r(1{~_L&tEBP8Gsl&lH{V=@re$McIY&&VVy+c-f8W|Q7wGz9jqKHt8H#4 zH#2iJ3T0qo5NV*PiHuA)31i0U-Z5NxNj81`MN^n0zCrD3(9kYv0?pc2qJ3vk*WHpf zx158r(b?;=2N)+?1H*brscSHtIVg09)h_w8yW8D86xhaw|K_xzp`ot-S+t!stFQo= zp79DYanaWf))zU;#~craghgJXwQa3$({0$B20>>AMmo{$-eqK=sTKv(orRSRFG3L{ z_m$xGnWMW~JwKDrTCsB0eEk}~W)vJ3hr@!U_xq4m){FrG{)Kg;u@6y46l`w~tzTxV z6?(4Lht@jqS$N`~Q7{=hrl*SXu<2*J`9kMG<38pna2`F-jO93W0J&IX#b0s8VhYFGv721PE=Ex-Po>1nAhQOFd4@+4Qr_R`^3*GS8 zm|0#Xr=dx5@O$1rh@_&Vtp9#9xA=^Cp`5~~k|af|YK z6_qXmxuU${;=E#Z&asxd-txD%@=>)hmV=R9v?MiXPY`Zm1cnH+~bFuT7B0!60ts{mF(IbOQT19u_7`v zKlTj3LT#ZByU?FE&DCCDV->%AD$S&2kVg;0z1$L%Vn5eg>6G~damn@9_p0R~$?u~- z=Oc96GpR3zQsIl;BjLUl01!xAT-@OOElY4Jhvi2Ngp0p}A*y5-$2S{j$7n>HcYf8~ z&E{R0X;pP`F-4>8 z2$N?f5wPkDT+};ObnyFFSy(A@haTrUn5%UqbS8}x%-x6FF*DP2zD+f|k&}xHy*${H z1g$s~mBPP`gWZ#dX?F8LZu72`^uhahs%K+k+YmO}3x(%3)@*IQlv~};>;+T9VkJ{k zyswkrVbk0{6?cZnwLZvQfSda{?s)R$%LdGW`J!dDc{Z}AK+6A2wiX{a%=iWniCHAQ zPuI;)ai6S5JVzPsc$n0yW!&jPb^oHzxwBunwUO_(zcO6FF*Ph8-n0y5(zDnn9<-b1(y!b!YcN|pCV_KsK(qfW9 z#dt`o7>un~HIN%Iy?7oCFLQItb8`KI*il(hSU4J4Y%yGB z-z6Pz$lsf*Z2YsVwTQlfRO6uQ})BrOjE zx3&K44ve#If8Z&e6%txJJ}Tc{9b;u+z%C6iLvR4Y^CiD4TIyN-5Mq8!Pybq6oSB`S zhwsbFsOQR3%OC@zqqKI4CiF>WYkRx#$fs%cvz`#B#x?ZydpMsuN*oo z58gujx2ILJzG0(N?vOgj=r=KEY-()mxQrARSasRkP$M-NDl!pRCB$>A(bUwmTk22L zZy-m!4|9Nl$9F2JY~G&Q0Ri&ERY&7H%LJh&Am0@m%huNB09-rx-jk_?)cB}{j8xCH zNZ(!23d@2$jIRz0Dpb$c*S(?c7K%F< zb_0x_QB=X?Yj;h}a7|4GvM?hhIU%g84l9Md{$WTbG^ zc=*+~wGFoAd<-$O7*lv8Ul|hV%*VQHfgFVKlFm>)xS9C2u+&#ZTT5&ij@n|%VMb?~ z>N;L5%jH848BmK0eR+x?1OC0kQvWk!p*(R@tmKcTy>$3j8k(AEF^N~{$t`{=kzMh-@npFyZi|Tzxr8i?CLAJRR!O*C9V zip=L8dr2ojV^>MYOEgB%p6S-DWH7o$!N}WxzEq7@Rum8*gqGy+F7fSKnA*;2**qo>HIYb=i$ebMww-USt<{tS0PC-3QEuAztHmg{DWn>N zmt^;rAW!bLS0me>FAouQLwB}P@txNTsw9tzi_6W`5ogy?c6j(m-tB7vRZ~-QL1X5# zTO-i)J(z*fZOh>f{UsT0^vqkuv6#yRE`6tFq6M9&6p%>GrC1C$XT#7tT1=08@f3;l zHyhuxjmOu z1UY&c`LMXZ0A)ZgQ!X9o(1)O>Va*yn+}Tt-`SYFbrUUts*pL0WDsPq-`$FqhDCg&! zqbL)4KGf}heGP$GRx#k@Ayr=G7x_}N~IU13t13CP4y1Q)i1i!>wh z`Vwa`y!wxebM{-*-h%u!%o7DIb-6TnZyS`6(on%Z?}TMYOiT>v3~ZDrc;W;7{oE#< zlK*_-vR_9=7!irjW5x+4Ul zAl0nMn~2mv8sD>BVa_q3{uJ#o0`vOh+pteP?#Ys%>T9|3+ANHk`p1i{FA2 z>#tLN2J#C65*io)pmNXr&$SDJ1vMih>ySTv_@IR%V1(JRBG>bn!3 zu{$6pe3FBi*`w$t-ryHbAEVy4&pQ6Vpa!-Qr<5DSIqM>~ImUMa67-~aO~wa^FaBX6R(#UVvXJ)+7l`{8;yC~;d`8{wnFLG=8--J3udI>AR%pC3l= z)p&uQmkdRCJu7kt@|+Cm0Ne^qPEQuHY-%Yzgq)oGSU%FuX-9y)x=ipk$zbIoRIGHf z?V1`$=f2Fosur#Qts<5>p?6m)ify~<{l6Jqnw+dWJY3*2>o)y*50ZLBS0a7QYll^0 zqSDI=J%Z(>_}mtqg+}aJ1O(HdDsQ>cUo!D)VEi+)Iw<)p@)-9gxM0J~2N!7cd*0XK zPx4eBa_$_FK%_XIbDCDH3Vpx}!;HSP?#jD4F;sloXNeu`9B2ghc}OFKZ0q$7u)Ysm z&3=T_%B##=pyX+8>d9WyX&^pwvTBcoi!-CX9*Y{vY43RE?R|@1Z@K#?y%3*;YJF5+ zRtN`Y)xz3+v zbo5BqxpeInVReMPhQ#;Ap%3)_?bFs(WBPqYd{a3sV z91b6p9UUDN6xt^3UX6i)_jPJ&H#fJQzn3C-Y1fBGsHJWSA0k6;Z+EwCup1htfV?r& zBH3XW>(EUENIkQ4!IJYp?wE~i40>SjN#HIsaZc1kaEW1fv?#HZoT`kwF(OW1(B-}O zw!|wVCoyKV^`n4cXE}m%zEHg{dv_Zb&d)-no_%<{+5Tj8^k8gbbbO`#^4sEUJ#5_@ z+8>7&qa8nUDX(4?zOj@2;R8uSRiXJ&8SccoZ8(C3KaoJbXor_3*_n&lc} z##-eSWMOcN>CUc+xOjbl<2=;wUa4;D69il{7+mL~<=jWIE9W7Ge1OWp$I-}pg5I+~=oS^ezFa#nkdsA-0gk9~SIWZ(3pg*kZLHc?UO9|? z^bHYlbCY0;))QPksIk4qYtFm!I=z}*_e1mtRV(X-lH$;BTB}v73lr8`Pdn<>n1>vy z)LT(IcA56fm~5(x9Vsf|Ot)`SsUOqOQiVi+;CAc$er3qva?{giCVPXPXtQPNwm1PG zt@um6SSZQsfote-|9a}ZBF1eiHd{+_%IoE8Bzg(FKl7eVuYO|)#2s%U76p09QrtdG z3R&@NHLp=PGjiOPJ8Ep|;o1G}>oxYH^y+otGQBYoqqb{QRQ`>LrDH#0_Y-{jg#?M5 zw$&Kai_{Hul-L|(=Ll~F} z+h?+ee0;Ji-GZBFtGTKy?tT6IGuJd%dna98&xy-E*!f`R9ZmZkJsbVo3OhOK?2L4} zjDILl;l$vgd1C~_w_;u{K$@0(`PwyDHU8r@Jh`%R znFb^OSK=pRzo0yjO?%}E`p8)}-|*O=7_x%LkHAZ3>mgZaQcv&F0F+p%+UU)-L*tr~ zS0)g2&4#~B|9pKPAHRC59L;`)!2dz+@u}O2I916r7ic-04~6Vc{rTaXn>R5R2ag-( z>%HU-p81e@eZ6aCZngUoFApwF{(@+DzM|$87hg_>Wo{Nf}S(LOPzNUs4RzpFCsN+=H^I5xv^`*lr)lur1w-HGVipIZ|ZXh7e zKRJ&nFE%?~I)ZLt)kf^W-hohgDIY@1_R=_WcPq!?*=z+#(nZ2HXYzmH6I< z#Fvyb50!eyJ3n8?^>7E*=EcucE~Mh_5)m97Fp zLgk-Y#O|ili`-V#nropzotkn ztJJ2ntD^WUSRxOW2dAqqM<1j@dc8ItS`NmUP2bNUYI_fSE0f3j~HD|B5kD6-hX?T*!0 zz|>-MEqV4(f$@kmJ2L?{rcvlgR$3;ODYzOY{ySDiyy9eKOR(Fv%(tXWA`&kpz|E5e zpa_YKEG{l4wq<@P;N4 zj&|p+CZF6->pTjmSU+(x?V1!SjgICRbO6e^C@1xCa_<89~Q}k=!M%8s~fCd`yoXSgE@Y!{v@!CEV%z* z>(~2`_a8zbh$~WyC@)1v7NX`im@ZAOQ2*49lTk*&Ea5E&=>itA$P{cHtjh%(TN}xnP^@&0h}vzLis&wFwvcSjx^XbG z^4Kr6)c(@f*QLTK7)sasj8;P01(@sX@t2Ct{C3FKv=!ydR%WtVzMxl!mCh9H?9?fw zp)7JPNC!pTb!aB2Yx^BIb!TvLEzNCA8{NxMe4!4BJ|9n_CAzbd=5x2DKSp`b&CUBl z4CkW1U{Mi*)2&me`tU9;frB?|Ux!jsmq_dG>?4EgWYozQin271W~Q)qP6GQjcdS;8 zR>#l{mSKm9F5hzPGM;3nT)-eJcjk$yaYCRT+fmc`MUE?;1+Xw#iOimBkX_Q?gUy*I zAqAV<$Gi9cUi={t?ZVSPD+>Xf!&7C6V?AD6)tX18-dn$Z-7G_uBk=88HK7Mew{NRu zWt-}jlk1WD$MIX=myG1YvitwOjl-1{p^%nZjujPrVX8Y{n3c_dIegfTIeH^H#45mO zvfY`S8{p1hjAfhtT(ugWJJ&rq@IHr<%s#h&W@bGXhhpR3&yDo*s!URWAZz!+Q*C=8 z*+=JVQ%~X3E+|#VF$>Lggos}%xm7;9y;w2yLO0Z#U-I);(Ss9^fk=INmT#zcyp^A~ zUh6F9rN99Ytjgw-#R%UN!;wyi!DX$6!MUT ztGi8oW237B-ttl8rSC%{G&@<36{?Osj37M>y)UjkOpp1V_V^_IAiZ{NVP2I7~QQBPTdf)NFtqs_-iVdAl@?W?wEwBOseDne2m(J{-3NiCno z)yo|MU`}2=8})?TA0)4O_Ih)3FN7WOyDuHo(R!i9yfQ7Swim1U9p~D|+^BMTZr0c7 zD9Wkk^jYrW7%rqHk3KmACMhJkPIZceDNPQ3ErHXD@Nb6egpfFCkb;DlX& zM0u$l@8-T@mLWM)*HC{)2FHUM zOyNp5aX%JBC~t3aig{d#YXM1FgV=<&9c9*bFji_IsrKl(kDrwbsl@t zE4?5Z^D#HHs%F*&JUpgXu}AwuLV~`HeO+RE7QH_{RO85lKhCAqjk#kxT&kma?RPgt z+Cir=DvFBi3T1&&xDRA-$ey%`nd#&od-`=7(9$3+wcA;Gw=(jOTFmsw}!?WLb+i_mtd(_%Kw$aDqtO?!4Ko))Y$?ThFl;k08kaY z2I1awjm8|drKulB?Q~SRxfGkTZZPleu0x_G7b_|u8F=Kh7NwYKWN7Hu2)knJI_HB@ z>!~4qsZV1qwIUU6l2cH4v47l5Rvvl;ym@>*_iec@Y1x}%I6TsUk`3(l5`NN$)h_6r zf^@1U$83lRWB{j(Wc0|eqhlIi%H!`m;1GrVtX==wp_qduKey=y}mA4z0OlWV{*Nr@URDSjPVMlwxC%_lPvBB0@Lu4ehkI&-mKXP%fzAn!~|ND}ZYO3ti=F*Fp4#(zco+ z7#_O1vzYt*(f|Nm(b3WGHfLpa<|{Yi&=*39p*H*u2QM(6Dk>`hcq0J*cR0J=%3xvU zzks*UsHoaP({m&uwke0uode`e{p(Yp-o4_=L~iFhZHBHFbBUTSy;yzH^C=(~4ed6P zDh_65)1J;c0_@8CNKRp@R1Yskbg(5{>P53roH`Gm<!v$V%78S=Ztcc?PsvtLazm2T)bQ8!irEZGy8cMFt zhITE$y|31-P-XO}9Lx<;v?oN{cBNK|K*?rN+dKxuKCPQ;P~FR5SGA`4hT9E&8smeL zkOda>h{zCE;8^{o3ozz>9AQb+Vwj^a62+&~iCLc%pY{;|xG2|M_xUpuMnrz9y!qVI zMfi+)AxBH;v?#FbtaJ+Tso3ZpYEE!s6&Z=$*+|nWuYV<=M}AsE5a(jhft#La9ec7p(3Hh>-5dh;ty#uEy{RuueKa^Jq7eXge76VmS zHSObBns%n1)@eeF+5G&IYK83BY$PKHk38KUBeE2B8BLYy$s*3u>xnf47x+a+;nW6)dfB<^yK9HtPJ8id0n& zrTLTd5172nu#ZG>+!f4)F+ym+2jOfwe^1B2E-h<#BnHZ$=DDm2nTcP|*%2^4x~~In zAV*_v*i1|x^c}9qr_!`rh&d<1VS}#@K*opXp*~kBDX(bradTcGm5`8_#{QgSxWkkE z=cMRI!L`s}1oU+_Hp_@)P1#s^cvyJ~q2}E`MNmv5YWU2Al9tMrV^{8*&TE;#g&pzL zn(}Iay~=HZ<1D4jC*SH6t0IJ+?)o5_4v49XmK)a%6^of%^9H)I0Y2$wzY%XWbHH(z zTeaDR8NE!2o8X?FzB645?9#;@0wQOF7vHApS+&l@R<3EsRe7mHd;hwaedLDh31lf? zr!bE|Y9IrzA5^!vkEss&4)x`hQ@Hd$QZaPPvBQ^o(NIs+d~)CGyj`Dl+?X~Oc70my zsJhh#XTj@yfq6v3fE)3e-*dS+*O=#euRo5!6 znwi>Covf#~|44}E@m8b4es6-1z1R{rAO8|%wC6sLUX_-S)EMgT&QXzR(AwDC#DV9O zw9S`NDIOsL8GZdp1ljvvlPW5fLW1QV)v`0R!OypXoOEUG7qVyga3@+-VB|V!TmqF;M(<*k~q0IVV7j~Woh~a*x6y*Vm_v&p~A>{9d^_* zRDZ7L05*NQzCob0?8@Ff+#;xRKX1%a`_;@(s{UnX{IM;wo5;hYy>rS1nn5_3Bl4 z7{c-Ijr2jI#8Pk9FFidyTu;ZqOs&%Sb&5Qp1A7TZ%up?JfA4_8Wu&VwSF&j}6##4r zDzvw^w^ydK6bS1%@9&bAYLqOc-sR-nU*#T&fCtyI{1@>ic~lAwOoP4dO!dz4EL8Wd zrNkEvzzA8oULl%^PL4EanYdfK@2Uw3p;x%MxtIRiarO}!rwk0`jg3&DUp9EITvwms zU}sl>>C-NlQ(?|TIct-_hyNP#6%{3c z&$8?511(MrAqLU;IUyH1CBMTU-rDy>D04w~QBGRg`!@lKrl%)UUH|!WaK%piX9GJK zx>{HN7l#Ae$os#IVezc=pgHyaC#n#!aTR(lSFaiy8~6XWZmS58Yqqw2OijV_ygdEu zdECd3(V?N)x%lM{)P?3l_uaC88)yE0H)C$#JkiiVPt-{jEE9my5b@tWUTjp<>yt7& zjr!9aBO@VF-@w4G7SwF}o0Lz(MS1X$dro48$1B>$&mpPo>gwwFY=g@u1HV>s^4?Ng zqkk?e8UkP>ATCj+$I-;ll$P}S1LNbIvnDJ5?w8=;XSLoKXH5``#KV*Pt^tqW7CeGT zZj(d@KbbXt{h8*mT|gpEu-( z9%%%0Zc0k{X=!N-UkhhIeFIkJV0DrH4@`XRqm`|#&q*mKbyCVfS9seV+NHp_S~P{Z z14w`1q5cSER+s$rg#!4jm&7F`V9{m$<9U9atZi-0`;+`o@_SvKt{%hgN%Prb^rT9^ z2W?LvfaMO}r)h!#c}dS#|Lf~^^8O%KuB`)(eeYq%L09=h)%g=d-gUyOn3F4ii}bg% z$;t_U;sN9h=<*g6Ky0Un-kn)@ni6!*|6XH3PtvudRKV|nq~zPd`+hbKMWDUpv^6u) z6he^+Y&jGvG4({>9Ph^eEVC1)K&sfr*_-z}@@<|~$#mW3+9?@yqeMy__@q<`Kb{koq&djbCV z>0;+RyJVIc{%Wku-geAU|6MG&{J>TexqOJH1JgebQ)Je1d{Z25h zUsor}`2|6K2&hU@(j={0Ivj#?^dJBQLa$=LyvsT1iKs4+9lj3K2R7TDMvf;xrY2FS}PD3}bFM>g(rs@ zWyw#<6o=qc3q=WVkN@>ig*7!k_GPGvaB>3uNJ`}SH$_a?z5e|*+u=rQ+T1T zrJ)sS1sa+vLJt^0U+^viLn^qV{2e7vle_e5GRNC%w9G!=VOfwku&s?P=a$a1Hj236 zD*H^gR3kz3^7@!jd$b^C<9qPpL*G$RjQJ4S+RCnMOi;`fr}o@cdovY@bxzQ0(v$J} zJeBIC6g&|SRpgjA_LSPP)Md70sl)I8P2Az1SiJOx;21Z2E;!UzXZXZ=3FHIH7Rq@bL8@8j;Mu*4u}b z)7AbIh4=3>fZV#;nS_&%4lz2ODnNSjk8nBRhVRtj=*AO>bT zyi;y&YZJAbdkj3IzlX}l0&s7MmvLtI%X7y)O1e@5H8s`xTF8Zp%vA^7ax7?86=MV} zei5`Hg|ov$X<=k^v~4-cn`o)jep9fJlSQv=&5Op|Uv*V-Dpw3^WMmX>oW5=9P8R%9 zLVC`?zo5ID-W^~5aBS|F-L90JS~KzH*AO@)?n@#N&tYkQ@b`C{KaWY0!RnRT1m@)_ zQF@+)Q#=LOj~8K}IV42INpTI55e?vqz#jPL#hW3kWz#X+^I|VL58@mhof&T3HXHqX z8x*$sHN?hjc~*zmB|pWwzZSWlx?Px}`w28AnmZ_@KB438XPn;E-}b|fQYO6>!=W%k z#5&p|!pathZfv{VVe+Q15Hb#wo0|I2=3^{~b}Y@>9W9n4^VdO^m7cr(na?7n#4s*A za+`f|2L~c!0&{b98EToL8_Z{D_#m7jE?v1YySSKhg45gEH@3Asd{AOxq@MZ->+CET zE)VV_zt7Y;2w{E?rbWJ4;*O6%?45{;SM_gH)_c=dOO12}cMS$vj40Ge^YRL*L=2;= zdcj3Q%w^`2&lc6LvKI=Q&L$$_wqNkD*|8<38Y$d^q#WuWv|k?0H^s)@LYg0hZ6i9X z^wnJm8e|3%b&t+iK(BVR%6!oN8vl#$skHLCWyToQ7rP{5ZUXa1L5~iQFB`%t-Kc?< z*clV5o&ra+^@H{5wL2mJ(lUO$w2K=>SGk`1*sig~iIZ*94Fgm_2wnJE$?)nZ$_|%cdc16n-d`dUu5@!dTENoozK0T#q-46m$@bFZ>b9-|wHPP! z^lL$TGkZ%CZxab%J6kPGDTOfI4v6HY1Ti>UwrCRK|3}tUfJK>hZCqEy6$Jxn z5DZjGLAsO>l@jR|5fN#Sh5;2pL;*!aTBUP9N@|9X5~NFNKssmW85m~%Gq}6D-~V14 zmx^yZ&x!lo=RD^O=8qA-cj|xFU)yF8v2V{%E}r^Jz3o9x7SSb7#|w_s*AJxH1-1@NR+XU}5Frotkx(htT&L=-v>eI4oKt}gfxqQ)Alp5du891msf!q_rM@tMSGU1mZ_}~S?n;MNH^P1 ztE**krI4W8?6XJ3LUrkIp7TbkVKL7;-<5k`LovRmxt;{Re7J#wA~EuMCKFI8$nwp} z#xbRJ?10C5bK|V=0};FaJNSl+pdDY0CDeH6KD$k|*X$E87PB_9nwZl?n@`!P#>i^p z=1cNZi|zHH|M~@wudC)tBq_SjTSmBZEQV!PooL>{@ITorci;pH;2Y2#3a2C_P!>&l zOEHBm)@?AlJkN8j7Xn1G)sB8vP>L*Lq2O?B4KU-mJ^S`yP(Ee<-=kbID4fZiEl%e8 zWHHu1?6Yskz8}^GgBVLL=+c@Pt=jFSI9`U7-7;&(J~cE{%1oTOm z*25W=Js@-_t{h;u8~B8%{iGP<#{Mba?PkvS!~`F46u3=Q{&)HI8?J|EI(-`$oDl^X zCdLYn)f1-MODwAVcRwm);Cr_>N1vz??Juq~Apl8Q;N8<4?oYl^IU z!G6SP$$L~wNCtsj5tl7ro{ia~3$TLFV_owmn|`i`n9_7$uylsj0@uNVoD(GPszyFg zPmnspHRLIU#P9)g$*mGE;z69_I^sFevHLFsJjr%>4cZiRrDH=ojrMEs%WQa?9ws;r z>jH_cqtkuBH+`@)YI$2UfyeaGBD=}Vj9WyYsHR;r$;P0nKy^+RX}U7-b|^4nIXM~C}9IWCaVEX#qnG-GAv3@!R6l&2!PZEP20-QBVTzmh3Ipt!?_d1YOJ#c->QCvvhij*Wq3 zrQ?0PlDajvcgu4-+wBfgQNZAWu0pBohMW&Mpr=PfVz08YY9Y`~>&w#;MXqRmV@7%= zc6uh#g09d#-~7u_xvt$#$wR&G&BArBqO}V%2u0uKifr}KqoL4gNat$-#agSdi!SXJ zb!)8&Jd|a)Vz{N&`s`ZSy74`48Mpp7OI#hkZOVKJc063Jt{eSNAceExg9>*d4h@W9 zR@O2T-Y}wXlX@F_!&6i|n>w3PjRW~_G&)>Ev)?Gm(T+LPx;ATm|NiGYgpXW>m3N++ zl$_#*Z)`k0T^T>@ zvuMavk?=i1b!By#>4H0csLbsxZ*=6_Xiw5$lrT@^K@P&zpp=)sa}mY^qCED>1M6{s zcY3n*9XH4GCX^Wrdh?>BEIdcMW!&9tq{(}0ltSA51MuBzqEH28Wh2!H_E;^x{5=Kv zeC|_Hs*jw0TTmeREoLiHpNq0@6y;R;c?JnG&HYzyoV#!#7pgmnSZm53|8tc(yE?{* z_^iJO#T)HorRa{q^Vcgu>qHv^}&zH*3FsPM_(<4 zr|iY|r6i{;4pn4dtHM@w7TIjdTWx$Z#9NcE2%IY}zx1O}REc&7)V4QYmQBV8V zKBKQ_>)9vfo40au)*&V_MI#c`;tT-JF#wv+w?w{~ek<-g%$F|)Tj_2c!aD3aTL9_T zH@95vLi!J%=K$@MH-c7-3g@k=us>>peaYKy6Viy^=RaQNvw!I&3W{_te7KZ31uCw$ zoqCj%edE!$m%bJ)NCscS%^dye@h~41Yf35h2zVL2&av9Tk*WJ`0_OORsM~;2= zT7Bo(<6;Bgc^km)1>3a9V&t6`ifcjK}f>tsDH7NRgV8) zg;($3AhAiGBj{OXO#POo<#D3kgUs3PxL9KjBb@S!P|dx2Ecd?ckJ7A9wFh0%;J~2HX@(%b|pd)PMaY2=x=4DKGyUot;l`Wh*6mNZs9N;Y;vYCUsv>1%CiI zSlj{cJ+!$ix{c1Fg}@ajE=ULON)h|gtpOJ71E>%T~jhzLosEMZj1gDdc4~qy?AUg6xRMgL691 z8^X*IpWkikJ-+0)5&fKBBKFTdVtP;Lr(WN4!sTDS;E$+EvUuMjY!epAn|2=u2aPP= zdpqo5zVsji)93yX4umu`^xgYLba`ijfMo=h`(xtR&`{jNC=Qkwy^7N0r%ye;Q>Hj^ zaUCryX6*We0@ugzAg2c8i|v>D@n;I zCcz=cfP7N|{t>m&!gx4J)@}XMY1x*jvNSi$6EHH8UWc1hh)V$o(s92M|J*{7{e% z4YSmnWMHfu-QoQXpANRos9RCFX8}#Y&c(~yJTPFma4h*SJ9|8g;oO`CEbh(58=2j{eX|vP1+cRc>8~3VJ_8+JGm?1DlB9A) z`GmW>za=_$9=9l{eQqIpZnq^vaYy#emJFSW4SLDRg`lHn)OlRh;N_MNKCO=p40P7& zl5dIP_1&{a*7(fS#Kcp7qlJNus86kwGub0Sb&i3RPXG{V4?|hEgMyZHx--cekp$U;mA+EbCs2QY2}8NeZFR2*;I+qJp!PXCy6EoB zyV(8|nVK|sQ_bF4;9-WzLVpj|N9^Qu!=8zoWtd2^(cQwVEMMW(^78FBPzhp_C!n9s zaQtrD1OB=A^2<{>t>;sl`AkdSA1me|>E+8Q>^V+wx8ZDo`*egk#Aq z>E4$@oyrz7^!3EVB!aGK-F467NPt?G)0=m8vw!XG{_qE!z5oKhrNyBBc4MO`A77^M z{Sm|UozhmRcHkdrj~qS>E!cPXj<60fciippGpfA!DuaI=w89f z;!Ynf0gv)5l*fDhc5`7`b+DL(IFELvJt~?~rn@Z&_0`HzMR(iFV?;G?Y#uT3ony1O zuoAvO%OP)*LNk z;ec7JN>v}9oCLE(Ggz#tz{|^*ozY8o7|!SFiqak?tVJd~UdIAGy&s*SdP4=yKjVMQ zaVVZ5cy_eyYBdq#h>eVl3=emnsV*_w?Ukcfly;)di=*XcNW)xbe$7mHJ(NSij*H|N zy8P%H4Md&HvVgM-KWhR0w4Rd)PgT*a^YL=o^juHn4&?}fW=^3Gnh>m>ibaK*Ql@{YGJl9Ekqhdt9Le?ck(B0~GtF&bCJ>d1Grs`|!yoptk z<{0;q`SsePO^`lNI6uOPpkKLvg(9`;f)pB)K3XSJSV+j($?2BlwIGyQSKukG+h&@G$-tQZabCbPQ$DtDAvWlw;3!c)=(fj07`?|XGUTbvG{Dv2I{z2x= z=T6=jNpm=`<88H>W&iaOp+FriY+Kpc+1Y|vH*hpn#ghki<-N?%8=i!3Bt+Moxt9#atwA|aCr1xhh|!#d=wqnu zzE`sQXxQx@JUCAY@r}^y#pX(fo*GG!je1j+H;>e*5>H5PFA_`gBX%DNj(w$4?AD+>h8XB4)5VE2AOl{>M{>=G2`C4 z_E!HukKs$+}FYu=yTeMS)?Pr;)liv#k!&ePHr)sRs=Qp^jS!&Hov`2WORl(031c z#>hClRmXQyKJmyNp$iwz65DVIE`J>d4rFu1{TdeaUF7QOCA^(a8(@{!kG;SM!D9dU2jY^)9EbRs1rx{=zch@pEAyAoU_ z5H9y-y$i=)xOTM@TEv8AKR;y2Hn+7denhpatgW_)cjL_6lm16eJiWZze|$qp>?YS! zs_QbMC8708?$?$}5?Y1)>N_tX%T2u!T78z9L`g_l@#V>VcAL|dXq>N!S5;58p(kSL z8Gk;>|u1`INE`Di)I z3AR{?6{Wislj_{|MEn7P_$}0iFP=>NhS8QSoC(-Kyzfn@-Osx5ReZ{HwbP4TYOv1MyL_S-)gLTPj$uM$>r6%K|g4N=X^ z^;;v2i)_C06%QV9X-J=$p4Nk3?UThY%$6cwq4N-fvJ*aJng(ORF+L>1dU zToZ;&vJ@S3aHB>Q?BoDJ2Crx7E%kD~&?{YS(g<8#A03GIC8o1+l#r@JQO*}gwp-T= z3l|>PJ+QII2o;{v(bFRKbLtE58OFd7dg;Pb>z>?A(7WNjv+ZnF{xY{}ykJDDb203We?PcH1V8|-wb5%r(0hb8tA(z%5P76Q~goaXab(o zUsUMfWY+#A$P#TL56u}g&1--Ly>VkK@#;&7m#xqcVLL_y)dlGHS~H`h-JsPVCmXxt z9eA68fsHr1r_^u^S(u8=*-X`!Yh!g2^z`a%=jBmu-iz^*3tp%#a@^Ki#qcc$!pO|@ z{jD{meZ1txQ40(EXQj#HY-6wb#UWK))9sDajpgEsg>VK_sVyXFHhg=?1-eofp(pqf z@LzRhmU@cgr$cSNMO%_rfk(uU7K#q=zY~AvQqzX?-EM#V+JnJ(bu>+$ii$Dbbx}on zz0Z`_cyppLe2S)e%*1nMIMQSj>4x^QB@eHQnMUsNod2GmT39Ij>Y4(Z(^s7wBM`-s zhcg|NJN&!?a*4zs0^#VElZBavqnXCietw|9)wEis(FNgf$l!TxlPNaw90%qIPvz&hVQ)gl|k2?eGsAD5)6khu;W4X?zx53&fIar^$MM95Mn77umsenOTb`;gW(0S7t#VQifeA#CcA&-O}UPRGCZa0aJZqXBeM1dj+qExJm-pMXNzd=9HVH@-?vcUI_y$= z&M@yz?Ptfa$(A@4mtWJQqj=Z_)LI{z^6J0@pYE=%WlsjFjlsG=j+~apM)pBS0iKX& z!dESUgu|bzB*;k5hH0+j$3g}4a!*JO=t7_CzprP_Z_e#GsWf@%lFdtrq~dUX+5}&O zIf8_L{kpnp0hU7W%_9z040N-B`g&+~m3T;8m_@|qzO5}Nwtg2S^Yrt&Te`gb8nyUDNySW>b-1Z3zAoaWayJf{tcLkZ`7@c;bCz>K*4m6+9=L@sHhzmhuUL7sd1XphS z#KcSKsaWDs|B1;Eex4YK&lHbS)8OOc%lE?1$MHo zu7Cx<#`+^NKnccbQ$;ma(uUY~rl`s<;!!<4J$D8FE3;H5zKqrGqjeP#MYF;#F1b4z z54{~jOf#U}R~PKbca`c%S3>_;1yjMOSQ#JBF8b8Tb|sF3oJNkd^uI~Ou5?X+ zK_C}TG@Tr;4l!^y`t94Ep|XLK=l@wxCBZ158()wczg8v>Ynnnb>t1QKj~22#>$7o!is}LlBmRm# zC<?TWd;WbX)sEG2`fqM#gYVG+tsSXqNlAIzi*l}dd?1py z5z*Zi=DHh7>(V*> zOH28nDXr2lAz8qOw`1o<;#IVs%E`At-l0P-JW|`%b^(w@B(MIF-*0si&S!mgcY={{ zU7Qu#T5n*BXFK?zYQ5poUPPNAOzu8)L_;_BF$}Mys|La_@eoMh&&zN4ry;fPN_(Z5 za;&S{R(v@g%m-rh>D?rXXq=%eEX=#s(${AKGnAH*AwecW#rn#BZgMBD8dP4uA9`04 z`yXLMQA_q47_?Le7iBrX09{-MuK|tZIWOU?t*yOCgsK1i1|=yI;#VH8{(%iewhqG` zQ(V(jV>@5~HG5D^Q;?PjR{e$f$iDi%&yMEQX4D6X;CqpGCc{*sc>y4Otn6f02I+6win^>LhC%e+&f`woi0uvkXCJ&oT;I4 z`1dtcYOO?~P~tl}1L`L%44&lm>vN{tv#CvAQ?9a63>qsKv^vn5zo3T;Me=9Dp+`2% z{}q5!`M;^L7^=GZ`Y+QOFK%jV+|Ne~hm2m_f$xD)&rpb_p}X20t}X+^EQ2W2rWpuDWFE%*TK45TSAgrc8cm!z-;qLyw}OB7T!{ zvEP^Cm0s2~C=Ki@ELV1Uc~ZKSp@jv}IbrLjhsX6Uaf-x!4U(YhxF#3{JXlce9T59Q zDAR`c^*Eowv46Mdvai9m%~*)8$;;9|t_dIu+!W#}nS$zrDVEYORps2X(h0_i3C*(7 z(nIW0c+`e5gUbPm)dXXerWzxn3a*gH`hKiU$%F2UVE)pxzq=4WQo#qi`hZe44PC0X z1kXeDnH1>drq;z*f0iePSq?gNHWgUOkJ*3@-Ns+UJxRQk-Zc?v%I>0=0IXvLuKGX% zq1p1|ziKuusw^Pm)$v6GZaBlE^Nz*kkJNKunDs4R+TZVE2BVgo{8V56Bxw^#w)*j9 zf25I<-OsfE?W>WHkT5VXfH}<+34h}9DcNDF}a7|F`F%=sm zfG!`4bzV-iqinC1PS>t5et>hybaGs;o=GIB>p<@zBO@ano#X$mDHT<$k(7y%DTdXh z))CHv@q<2#2vfFi2Su1Q-WBw}08>%{&OjNnJe2X6{MW*^aRZ!s%O}7g@$f8Y&M+>Z zNr__iKv{O+OzvGlagXJ3nCJ+I%t>8#`yr&SK+b-x6qTP$Q0;RtiC^Nmmt0fO2jYz|PO_ zfCg-==XW4TYmBG>;F;efbUIuwOU(Z!WeplG_GEdi=O7c9Q$(T>5K?2=F-f(#|r=SqU&P}m4v&4y_c8gcFAt4 z3pVAO53IZPZ-eg3wN?s1F;`X=?`&AOVTsd3mVQ1|SpTlInslKINWCSkF8cb-<;+hR~Fm5-jlx4r;Xv#`)K^>HCL31Htz5n|H}17b>?WnHJ+s?wnC7UN`#1kZ7o zY9>&XHX&RY=tp9XSc!I~4!B#s|FICld3qYuW-F5^OhR81?e=r}Yh{>?)qS%^taR+S z$^QN`yU_?;Jy`SoAXbYV+vS3ce?t8&473kY;G!%8!D|np$EW^=IhQPn&qHin| zS+P)rg^*8M=j~H)mqiN3fST@d!TwUD{3gZQHC%`A6$#mg|3N|Lc=+R?%vgIzM$BSF zy47QjLs-KsDY60jCTcH2aY=7}QAe%VVJ27#(u<)e@1MCF_Aj*LaY-*C+nuiY&4}#?ax#t7m{+qapvB7d}(h%)R zXEslwbJETd7VLEuqu~Yare%Skc{bj40^bYXe-Ml))PF(w_U{2iY>0cgJ1lk@Pe|g& zkK+-#{ca1Mr*~9-4De82u9^IfvT^5u_Xd;BZ%}ad_s6T|>9r46AfbC{h{UNuU-EN% z?=ehhxxR_X5xKN&6;%+HSQ-tx)s~q@jgTnLvxpy01{}zXhT-tHno12qq z^3~7j)upyqgO!G3Mfi?WjIHuNNaSQEgj7Eb*!U?Oq=~VCfdsT=`Ol5kXox$?e?-Kl zPs;o%;g#shO8wN7dRn#%rRexV9|bo*gZseXgCs&F77Q7b*H(}==YE%#PEm^+RS;Ru zT)=I0%KDJsoSQ0Nm!_vb4W(&RRC^O1aYXS)sl1Jdm>5r5BOi}PY|g;f{m&j-o`UEs z@DZk4S73TA9-4yJvm3H#9HJP*Pk+Az%-2ifQM&^PO8|Lb_Wy%duL3rsEXmH^JnYRG zvbFWvQA5GtM;uJqKq&MwU40Q!%Wsp>YJ3 zwB+1J3c!Te@KyV*bSm-dKjnYZaDY)`Cl;Y0Hr%J^P1xjabUlZ!)c@OGm7VIRGdUr9=+B$9o+N05AP;BE3xDoVo%gwzo8+KG5beZebyGvHLezUL+DX=hfay~vQ zVEnoEH+*CBA#YO37wS0jA)VOVW`s5f<`=E~yz%&?v^cJkm_3G;ATs3y<?RW zB_t&eLhGx)FGdjx9_kfUGInGI3CYebTVI%aMu}eTW{VM}$s5VHIQ`)!e5NSx z;c^dPU4DzqE|Z_t2ggJg0kw7Zb*k*vJe04s*KfBKSS54%_xGp#j9nu^YI&kmQV5ku zFi3@kF6|!`f4>R(93S8O?Cb+Oga?jesK3-2pa?X)mRwXi@Yk6TCZW=l6vwtQ$_qtM zjN6$g6__F>EGjBG8`fJ0XRhcTQ=H`ASIu=P6IQu2q&>_~U>;XuIHp2eL!#XtAGp_i z7WSX<3nez_6t4lR+g$ zhgt60nYn!zDJJedY;+oh+qm}g4$$t-cd_I@vEw!`y8t`!k*U`f3IbsL{PSuKs)~wM z)E{6~=_srE;vRe!Y%?^pTXL6zHHE;W&|$P143)xfP=1^DIL`wsD`|(3k=rr_KrX}# z7vN!8<42;2#HBrZj#5O^?@Bmji%v$|(58s(QYl!&ww@lCOj!M!wR}(BQOmlzY*>@M z3m=|7-BUcYZpmF?(_e6l!c^UE6RQfPiMWw`BuJr)9%&7+Ij8@g1IPdKK1j=v-W_^j zEG_Nq_s@>bUC@j7a>@nV$)m6@FgGu0Wj_MwsVQKTOiWCEQ{*=CKZ<-?W>pvMDHW9^ zJ7WRwA|bI}TwufThGL{T!AJ$c>(j|y8#qer9~el0_9OKh;3I!t7mO?*X-%*Cz{ZBD zfZNrTeY3xpWKsK^Tiw%w>+k{2uC7amZcymx8Q5oqbglFL7p!{#+=SS}$q`Qf|1o#F zPs1)X!-0v$(v}u^A!=e2{8oI zADrBec=|Nlu42u%HA-kZNjHQo#!%}LkWhezSj9E=UH%hbEXZ!@4;O%d9ZNp{d<_+i zJ-E~mHrs`Tt>xvqL)Bwv)M9ZhZYJIJ!Ktb|!aMFK@F;uSviQJPzLTJd9W^PYu|RW0;<0ahUq%RFcm-% zGpq&JT4-wji@RZr2WT~q@jU_0rB+l7hi-X$Ek}x7=GK)sjPso>4LOkNr|y8I>)?b| z)|GxjxRYZ^x6&!Dd1^lbKwYc!M(o&5)gru>-y==nT!<@{3V>EQ0kYhRz84 zIh&)k+w13e&fida!T9QiFpUH3_~izOB=-XU@uK#QxcCe{5)FX`uv%4*_xv&wHTs^2 zu|KJp(h3T4^YSd{*dNx?uYl?rf(iC1mw~h0|L6i8=)#NezjdKr*Vq`8Ty{s4{@y%4 zv$Pz$ra&1uIFda8UdFHHP9BU$;(M}^g+gw5o;q@IM~vuT`Srnth}sVu{ak*EO(ziv zK#Biy42%J!B@S{v3NeRY8UwGtb2Er%h6?8*K=Kkl2@V6_JDbV2^C>m4VB3?ys+W~X zN~`05G_tj|g)^`({-x0v10FnJ*3I$WH0Rh#EHBT~C%QE8a-;G^95BJN~92-K<+3i&gX@m=Qj{Y9Q#7%V7SEZtfR zlv#e|21BDVrlhChx8fCks6N3>gNQmep3di1lbZVyDZPAct%eqfTI&goU%lbCddcyQ zN7sINJ)n5oa$PQSEVa0y99v>%j-H8KZpDC5r)$+zDu9t<1*?7!bcC`Qr9Z@aa*PMM zp?68u?G;%6#mtM=(0x(wK|QbS*3U**X6e9PALg@MkMKhdz7 zQ2OB9DlPgia=)#2J(-yu;l5Tcl=T=7CV}d@!WAu9((vQQK~IR&Ws9B;^L>LGsEyKa z6G9?~&w^$`spHL$RM#XyVgPsf$$Ts-npri`(`Uj|l=%QQB=JLVEA|z3@)Pv?rjrBS z8ki^`DlXmm^6b~Anw@_2%x9y_)RVl0k-&$N+5(4{3Xwjp0KvE`oB(ft#ihM*jLM38 z2X*ErTWnDcq0`eRq_KpRPRVBiub!=CP3(IQT+Yaa-Lir}6VY%szq@!6=!OT@)`o_L z4E#onzbqlmw-~o8r&{@VdG$WyJ{~pg1XQy&Yq>X*+VA19V0s7$S&9#~ZCgKJmZ$Da ziHNVW_A-f3>7l(0=A+UKoO&1>3xg9}JCsF-;g0wN`ufd$C|S?tV12Mt(53y^?2J#z zJZg)5tJxBg3`LeB!Bp2Yfv=`e#(cXUl0kjrE^yj!u72utUwC)11fu5f>pN(5cLS{4 z>l?`wmM2FnMA*8gIab{H$Csero>X6q-VRULo)?8278_9sX}mR9*o$~r6Yz~2l~q=@ z1rIhXeQ1Y3^lz8nquQ&AAo)Y{?=Ap8ZQIB)yT-9la=jH=>eVx#mB9_&qKr?l)T86o|ul(zuD{&gS#S@SAW!Rwz0goS3BYxmoeMyyF>EV{mVvYLO_Z?#O z-Wou9W43ZwviPYww1B}gH&+IpLDa|d`{XxO$fxW?5;TVJsONl!fWICljaFiVxZ|Nb z>HWW8u`Lt;Gy>~oN*dXRVQ=iD1;&oFfwukf>@YXVW_4Oa6hmB8<`;L%Ers<2sthQ; zeLq^**tW108>0&YZt?4EDe9pR#q@SvTD7KZod)HJ6r+^}i3P}K!Gc18O-qyz_is8- zGXJRo#WL!J*;+m*YIL-_a~Go%SnQM(Td-oY8?xj)V1{HR9M+`J?z+0I39_=klS#M5`igApH_*P8UG&^;Q*pG2Jv0>dSvq5O}#RI>wk32(J z_|my52u;IH^i45?eSOOm>vt1&$1P9Kk@`bkUNQzNWk0;fl)P!#iaP`DgtBt!5Kg@p zg@?%jr|0A2vqMBe!gCf{3!KwT`2{Lz_C*?tOo37SVL1Hh((6=RZRrYo(|Qi_lA)TX z1!M~FV`RsPh?Tv`2mBsJMvA(E;n?l?*cAOvMjGYiwpC;c2^w(9HQ^8^1E1vr=fnqg zLVXAUlYZd|M8Vz0WDRLZz%zKS#F)lPZj_^pq|D@oD;aiOxclW!?Y0cg+IGlgE*oCg(Bgs*DJO&20oKW_>F!GD7TE)C!3Pjt^r{g z%^KN2ce=Q_**5+&%7B7X&Z@0j4v2LQF43!r|H>bLLD%}YHTu*IO~a`s6`(kgb}G~Tx1KoVongkkbFnr!dq zOvQKyfcE5MBrV%)EBRz*x)lwlN`i@Nzy_1JU}~1lEWE^a*FT~lcRnI|C%st#u<+jE zU6%oV$eV|aY7v?l_?!*Ys+10CC%IWE{B@}TDD9u#(+fRxEV{IHKw9r z0)6H5CrST+XfxOz0C6a5l=Eb9v`htWR2DWA5We5=<|v23iS6WD>6FxmvEvIktN_25 zL!xDVX={TQ)(aV2AKWU56wL5TAQMFsl|nti{)o*)96j^GccTo6n#~|Q>DW^lb{O&$ zymgSLS?`r@YEp)j$L54iL_}U7hsn@)kFyzk(m({gV8UM{!pMbxiy2-}B)^(SKp9Y~ zohaAp6T*tX3)~E_b0?4Uu*)I_uOqY4&X!EPjoEklFTW2-mc4&RJ~1*CV1m82H>1U! zQvcO>B}BvA3IzEL)r36tNo|6mSC$%AIewYykRK9!m*?9Oj6) zF8!$e6I{9MA)<+A`eZTM7((7|0XG&| zgwd6%FE3f%T&t8^~@T>}s>9i&_q% zW+6@a#^Xo!k?%~k=&E^6K#~SQZLU4~V<){gTjG!fMMXnEoo_lVrOLRBwIbFxc602h zya_2W;E(5Gw&nr=Kdkp=d#d3;A+-z#`a(A#D7=6($6G&mFgrbcEfZpYuPv-Ed5Zw; zseXNxwl8VQ6pcmIf6Sq_Oz`RP+3=ZCwKo{7p972SvYCepp8qGXRe2L+~JLkk(3a1TfHveHS#FK zXG>ylGPU1_jDms-JUp3sc@xd{Yt;uDt&!W)0S9BY66bQE=mQ8O7SZ)7X@IaaL`D)M z_@5m<3CYgmAOt{|ersxq*~y>65>l?pu!k6*P-C~D*G~@!JQo?`mL;s64At70_?jB; zIof1OYWW(We$e|EmAsy-tE)zP5<M>x7hVh;~gza`0C>y4SUD?3?{lrP&C83|B zjt=v-HZmv2#lyufe1FDZdIjz!^~hAIr?TK6u(y0%Qk5A;O_`>y9>VqJ8GBXnCh z@E{6BdRb|vYPf-7WFipmAl{^B5)bNLEFWZfu(c5n?`~D#`S?-T-+`SHC_)8sxoKr; z>#^|8r-6sugi!n{3oZte)rTfmdSSebP5F1QYr6W-yYO&n92h!VD2_nKj%)yOSwn51 z1~?S!--+j!SNNDZuQY8VECFSQgUN|?adj2BbSbI3(*9et@c-}+G#A0J%HkdgtT)Y% zHdnyR#_dHnwAL-bWB~>Wk-&!i{9q)Jig6iW3dkdH1Q0HvKq}-xD(rSDKNxjjyIOvd zx}^t+M}ocprTL5U40sLabY)>?pfylPP+^m1cqm2``xs@k4%zp;s6BpWT*rC-;*1@Q z-tN|wWM(nk6qrr3>bwEte?;xFSf0gz>0xTB3?1c-QVF2zupDt4seHtp;OzwQ>u+|a zxyV)$W^QanAiV_z>}|UE%m8(7x?5;>YwDU1Mx&$acJcpl``t7X9*8yR@E9pFF~zNX zOdTj9bFvE?5bN3yTI7Bx!eF6};jSRqx_qtk(4EcD$OtlXX01{y%}{FhFAM9ZseMau zV%Q6-S1|npatImPb28gAWau~D=~IG-DjqnA>Cj)$@d*3JZLzcb@lsBATbK?JAtaWg z2B%J%lX%dRWhGFdB}C^2J!1slKH{j+KOeCJiGHL3dW1og%deIBgMJxr!F8-`TYH|Y zf7l_*ji+>^6*# zf?W!;0x>C~lx4ta35v;WFe`Ii0QRxhRQ9GR2)-XFLWOj1plB*FhbrJ*V|Z(f%yu^9 zui>KM36;9#gRP+Toj3P|_s}pU{zy=WqpEZ`9!xJy7{?~&xElv4NO5z6L+n4T%>S|! zum$58$`gMQc?pj&v)!5U)G&W~hb-Dm%FbSd40=PW0Q{O!u)lv662~l*#4+4e(@2WY zq1?KS3&cQH?wr?;APj}#4n?d6z~V680cD^NBPIC@^Z6_4V-vu@Lw38^=DP)fFt+bK zKcE!uBTH*@)_Z?U0xNV+5NF=EL#O{N4eWy>K4;Y9jdUgl5_eHC3f8?4pL)(i5}Ez$ zb_0IFUKX>5p7W#7DtEq%|2I&goRy3N#7%Y2}N|$ z6^}5%0x77?ZeJN}`4_5#L^*2Mge)V%D%B7xFvgcD@Zd5K15he8R!`d{`!OK{S|tfk zD&l~o+qrJvcb|+})8J+W?t&cWCev1*rvMIpwtLR*^JqUsmOsxh;k$e7r7I$Pdqe<+ z){bdzmCdCAyKG?Sw$Rru;t&dV5_}HgtaCo%2Bi*&wFqj)AR*BtfR_3Nuc-0cSkWQx zl}K#)$|Hc9894}73@U`h-rL#~X5{kXdy4Hmnhf6_@@Al_Q3WFkq2;AZv6Gbo$9X&l z28J&{L71-_o3Qge59-n6$On5D55rPly$DO4k)D1XHXJ1S*M{$W-ZeL`4U{KPi@ZEB zp4)4>SBIRs=yi=qZSv$>1_piga|{Bg@vQvKhl3nctMEHorWkKeWX1AV57W(#`pvRw z#?I8psqwo=Q+o?X%h*I^4FAzr44~4Yd*;Cuuq}R$DymS#K$`Qb@6MV!^e~nVHq5{zO9#4BlQ= zMA(+aFU=fiOS7GKX8;SAs&!r%*pf?3c1 zt^$UFo#W;PR+&Awpr%Dy^st=!OmZ|NJej5~0S48WF#DXN+tdI(3Lo3@+>3}bMR)+1 zp}@tIiUn&Yxu%WsG4};txrGk!!XKsB!Hd1E}MOXbz6oZ>lCnIB_ z_;jkK`YFSZ7nZH0Byk_=fS(zqNUSwIH+8d`2N~-&mreG%{V@dC{kP%a+dqQSued|? z%Z2&mTEe|HG>FCA>}*cSWOSOm9JN_*jxq3BzN<=L%OOG!>w)ZxFKGos&1vMbR;}r? zz%8>hoM-Ml)r!Vt<=4@w3^_o9pp~ul3g%#XXxfNZs<|X;Ps^ziD>e!*>qa7ULV5cT z6az>u;vK0+O-U2+pmaTSa%N^#Zs@IK+42DjX92#M(?2sOT68*L$Kcg`-NKN2icv25 z%!m(IF!(PecKJ2GjuaJ<^`#_x(^0vf1WojrINqh1gGq0V)oWBdn;n2TCrb zWe>p$PzuJk1ZVTiH83?y${RfM|q+7EzIF#b&piXbhT_@VZMm6E`p z5k>1eF4g8!HYKmVM+V*)3T0-y8UYZvcWbYZaWb^h1+%pbnl3KiAg>3taLAH-W@e*F z@uBd;n?R-*w<0+_??X+gIrWF6B+5ZjDaYa6v|4LMgJX3p7(vG$`kel3lKlvf1%JBX z?ZwPcsnh;Y5wZY^xu4S;od28f@XnQU%`t9OPZ?Uu$s~Gs-|EF7FDOMcb^RXO#4m}i z@WGx8&GJ|*c{xywh2Ys^B_^^ZR^M@42Z|VBY@g&*b5wkIxUu%yLnvUivND5mz-a5^ zq*1pMY*KxMktaMbKJ_VNOaX*K_hwi4HfJYKUyVCk>v5sdMXo@9!i{+a1fnh`&cj~} zVHVDq62(!3ZgFw(4-3C@D6IT_Lq~s-yAWTZc)ZWcNAv*cYYA#T3IvCSl1Q z#3k}{Q>_5%UFk~8J|HMMDrxt4l;K8|b=UDygDaPd;xagbbBcRnY{9cg6DN5~;e*WZaCUUW+5DZMexWhs_Vdn*q-d87) z8R=H|CN!~LD`T`!lnj=2vsQrANTELE+@Y3}LM=;UkvWKz(#g33Hw~pF=V2$kv z%iJO59z!n5VDu#2P|GzO!whnI<@ndVI}qAynEWcVoQIoxsv-4)`PJ_b>2d7GkJ4g6 zrE)SeJUyG<+Dc=IL)dsSp_Kz)hTa;a*JYJSAV#9S3wkYAyEFy-=}2p)SOR2jiJp>j@HA1Y-}R+UFYNXLFdD`#-H&%I z{&C_YoF1T+y6H0A_5l#P3@WLpD6h~(7l9b2N@a6hEa{Y^7AOz9L`mMZg#Fy;=!@o8 zyXZOna}nE{fW|ylCU=7R*pQ5jRIeVNsW@FiQE`RY#^QPzmb3uDv9#saHSm6HZkX*h z*qe<2QKKS+&%*YG04?XB&xSnKdrBKXw}0C(Y6Eh7bMa3`Wbjp#lqf*K?Qw4OaG~|a zLNWQoah_7*@`?c3yJbqoty7j*L+f?blfn2BkN<@kvLzNZ7X29`=I6`w$)X{QlOM?(GcD0@P3#rOl^GpxLPchTCSldyMA+R?i>%#Ng~dqBJ1i4MwkH4 zd}LYh#0me_R%4Vm%p2L#){b}@c#yHp8h3kOem=C=ejmy=f$?yaal!r0iKa3u4)o{G zNvD;I=;V$a8%J-ue#*(2Y>I48Rrhi($!m(VPpv_1+4UzXwH`fks|P9TzBbG8*I&!K zc5xPz+K*PJKTHf7TVJ>=2gi_}Jm7GhQlpET?nNr8n%fQ2yr&NWgHPu?Ly@1Iiwo*h zRaDnRZS=B|k}6&KKQ1r-#mlEUG+6gc96=&B)Dzdc?|148ls_};w|6B830GD*x# zGeLx~zCHyH4}IWGM9%NtZ46GT7wMs(9W&f3_euS8gR0Q0+C+tdfcDx2rH`! zHH0&?13!P@vQN2h!ZmKl=-j{aQJp$U!Ug&!r!?deR=B^#h+dbIdrT+jGD|I53}N9R z?$^ih&=v5N&W3UMwAx93I=Jafr!M#DhDUeqiFv#G z$~6Qt*prkWad3_g*mFZAZ4lj$AA&~Og?zSerY1%1egDMdA9haj>ii%9`cAsxiG#Ep zx84=Lr}vX|%SoD(@%YsFl7++~%6|UrSt*Z>V41hfB3YQXd`;5@nR96i1ED~cai2

1rYw6M=7h~4pM+Q-BVs?YNFmszl6ag9e=+)J% znm~b)(hwNsE6e$%C1)T@f2`K1^Ua$Vxw*amVO39Tt(kPRw7f?uJ>;H6M=!&EX0mA- z77FogcOkXil zIF2sezN_OweU>EW-R5^ylapus!zwFpj+$j;*hX1Fzdd@Md+pf@F*80y{7ie|RKa?v z&W1)!;6`W1Erxi*NPf1d78g$cSXp1lK$;%->#y#vHz3`-r%x}^S7C>|ROXIoYxVaC zz9`Z=<mp4+QaVpbHgCeh zmi0pgFV3{xXVR|u`jz+mb0y#FKbIv<^das^Pe9Ye5xHpjN2UN{f*AxRo1Tb>4VICurH?@8?Iy zF2E@*9Za{pg;f^5)b+(w(%v3)CrzVp?b`U#4_XeCLX)sksB4<53e4a&^)*i9BcV1k z^jE|FDM0gkJJFLJ=u33Wc>n(XuoOd)bNcWLrc7>CCuX6mSu)q$urj2HNNH|$I~am$ zK9&mnmFb^MQ6dWi)?ezmgT+y4X=2jS1C^IkU#)C1@bCyddd~~(-JC7QQjGX_wxmFC zdSqYr!3WrQoquWpLhDcZ>*?v`#!>G-aDYcZ06IxQH{_k4PUH6QC^4@W(KC!WD);f@ z9i5!P5^uu#{CungN3DtwS}Y~iQc=O-Df#qiZJk0`Fdw@+^z`%zTVdq1mQPprYI?kj z+s=Dy#wJmadQ@Dzgo)|Sp#EF9Cn^&%& z)H&v&>!|;H{E~&XeWuVF9q~4Y)NzfIQ@~0`=-!J=E8q!#UYAv$2P?Z`WvncFv%l+X zNV``;57_ozdx1$jkFK|i3$*O$L$ks(gn~1B_xAsA!;LwabF1hbVcyJm6~4(}@SU_N zj6BD%6O&M7)2dy0(gPzqud1qM+Zwj#%f+w<)_`Kp^(+XfiBJeCD!<9A%F07E=9&%; z;}C^^9_)MnKKGoaju9HAd;PjbY@kprz^0t}p)%#}UC=)H`SZUDTNSQcA$24hS1bC= z&SoT(u&YjWrg}?!NYWbcoS2|*+fN@+)U0!!k6uesR9M*J%q<-q*U4s8iG`_+OXr_k zTAf=Imxql%LrW)BkhH%Zs9-=^pQBV=|1HS8%m?o15Su}2 zDz_cMsB>j$Kg?JSFD(2Vsk?|l>joZLs72pmgpU!UISAA1;)BG+L_}WE!JOj{uqu(R z3t9z*!X_2Z<1d)q*W`yBJ6r}#$M9FIYsQwEo1<&@jEb>_R6q+N_nq`v+h2X(UFN!* zoM3Dr#K7Y#&f>AxlMgmXXl9<8!J<8X&L9k zOF=XYi~peJ1bdZf)f`BB&TBn3}FDDPR6qk!H#avWqN0eeU*7_iayi7$&)?nCbH6ty zUEt04iZYM8<7H<|Ac+ZAf#6RQ5A`9PtbY;l-q8Oj78c}hmt5(~MW?m?Cj9MN=z#r4 z+@XU$rzdL$ihJJ=O-V`ROipy`Sab97DRSS^6e1gb^*7;pqvjy?O6BGWy0+u4F9Yj? zeepOZ&LmxdOoISe5yI9!a0TKCAt5P`A4_qLPky5sHA9*xuDI{_r{l@|YVTqHe`I|H zSe4thHi`kFgeXW02uOFw5|Azd0cn(Or5n*DAyOjUEiEmrbazODAl=>k1NS-ioO}QE z?8mKp%Ua+1zB$JnCYJzx=-xtMn(#{{#+uTe_v?esu&(E@hpt{@PdP5;Fmnq zEH!rC-h4>NRj_{Fj_0zR%hmKDM9?Zi0sYAzNLPB3W3j(c|4FvjRfLI3Uw^;<$B&os zTTkyHoXTB+Yft~acj9?rku3~L*gx7Sv$5TQ-5a_59h0QEG4?$Y*|0pggGTP=vEG+9 z20Lqe+s5n3=DPNHp`j+wo!y_lgoO0=n=7Dg?N&9I7~I#C&P ze$M~>`}ett%I}>qK?2U($sX)E=svhV|1?1gaPR*8o7X>p4>_a>+!2oj7#>cmzkZ$i zQ0BND0gW2_@c4Rll|Yi_qtkIRPrLjn;s)5> z6opF2VC&jA3nQb)#8L{~8pS4|E#FGa@l8xK`%R4($PYFU=vWIbPFj1L-?P%wI~Eq$ z>KDW64pw<)y?Uf?N(aM+)@Sa&ly$jlYU={PpV}%B-$qi+E$M zDX+a982FT{8Psbkgm7&9NJ4=cFIdSyPA-gwjv2`C`0*p;Cqm9(@qevp6qE*Xc+t?D z%mx)fn({2NA9U|+qBqN26Ck7H5#QqV%E3H{7&|UKY*Jw<<9YA z*sC{vCSCV)jIvHlLdM3+nd*w#TClU<>jK6-IE_RPl!=fxwpv~)(XIMrU+>*GNKIRH ztD|_6PEuMG_Yv~((@xwO0b3+a@J+! zI^A}thZ+r?{z+aa;06l{<{lo-@k!LU;+Gk=hhUMtSlol~XlQD>zpP@{&kViM;H7Z~ zj=Wo?wkRenwcy}sk6^B@s`@4OzWq-{c{w=L+@XSfb=zl%mS$n%>?9BM#%WIOgz~4E zi~A9-XMfsvLaDW>uQ6Ump~RO0t_}~`ch-DyTu0=Q?qXt%P?o|;45zc@7~Oe<`k(oE zLjwbIldqXyi*rq7U%phdv8jNWQr_Ot#l^Y8f3^9fwb7L#tj>gom>4Ihk^4=^HXH|JVc zii~*a>Dv5RV|x&;peN+C(E%2L5Yt$}%If#Gm+KZ(-z-K{g%Ae=nYkrcm3B*AU2&e* zZ^SD;3pURhIEN{UOAw?;g#;#c|Fwvz@$TDm(zW$Be(3*Jbbm!w_-**R=2_@}R}go7 z<~0uz8&q$lxR;XaiCrvhhYd*RHx{FnGqC186BPTTum%?wnNADYiSwAI3m;vq)fE5 ztqySe{`J~qR!H!!tO&HRCuww`uy5~}gXQ3d5Mo#@DJ}Jm*EwmDg{-m04vP7sqYrN9 z5}cf28s3+9#E-W+a*@NepbU?~-rhFkxb=@vBhlmaJY3nEH*cKm);)d?&@yXGEX)mf{(MJkLGw4|{Ch#k`y0BIZbuBIMPD_=#Y;o`PtAu< z8;Erk6$?!J$sG@H17aahb6dK7+YXI9Z$fPtf`se z7XgaMe_lNlTGcN3t_NKt{Df`o?FDiEF9OL9zJ!O{*xfs@@M#W8prKCB)e+1O*}01H zmYIZcQ$|vsjQC9PdKYdh%JP&?_1U{kCx~gJo@)tihl;>$<3f<$ep-2ES8Hj z#9s3dL*)P+nhRq723nM2EBIPISQkyNu7ao6@XdcFLR8R~ad(e_z$V?+XeFM|Eth0xU7Wh_t@H zrW-4F^ByUpaT{{7wbi$^ofVgX_nap4_O5{ERC3!lFpvhyuSkxUO34)tYm#Wrdvt_@ z8-L&K85To?$Q6!<0REVnwOL`h2_-bof*tJt|IBY9DkW=S^q$2z%QfAgooI&sr6`-% zSvdxvkj*uGk{~pMxDe3Q(aA#(y=!PVs0c1|ir;KGO3llBjgwNb%i3=IwK1i(UW zwl$OniT$6I@%OL&{pBq+czqk+y`un+PU%OBg>8ba*zy9WEu*bwW20?}Plx+IQRVfi zVd-vSp`ykik)wQv1O!WRu{_1->{;H$#b3fynm0GOSJVG)SQN&4w@wqoeEs|YAD#Tk z%)QVd+F`#rjz7qArxPh3_o9ZWwxr}JQ(4D)s;2ClUb*5w zA6(4yc=Np~1yr6O0M^uuX(Vx%DqajvX3+-s4#&n)Qj0=%{qlgXE^C3p$pUp|!SEhm_iXT*II(?=9-X{?O7()2&q z@%ML6aAEldeRAV|^ZS{Iq)g6w%G@7AbaK=iIp7RP%Y*Za-br8zpEOpmmB5zk?GDdFj7e8*Z{Pl!8lr zJFIC$6a}Scm4L|6H%K9GKX0kOd4EZtk(qgTPD-VIbaZ?wq22*c?vdb`y|Z)X=g(Z1 zY4sBlfZCp^dXvKK>?ApVdNWs8QBl#%EGv^X#(fRU-~brbo)Zpp{paKV{?6nK?&l|> zgTZ96JXnYd;ORZst=d=}SIUO-bK3uvULr2eR%yCxjOd9_+vw=&Xvv9`l&Oo$+T}f1 zTprzB-eVk7zr28V?>rZu#zEc_G=5r&ia*+t zVNoZBIUjSJE+kw)1FAt-UEku`J?&S2HI0u8lor7cV*4j0F_F*J`#h(l6r6E_BQ1L+ zXl0mreK=n|wmc&{J1sL44`<6^;PK5;+rOLSZTPk8e=n%Y0SHvfvG7J>sBT=LZ7LO2 zMebPNoQ9|TDqu^&DMqx2nLi3 zzk)Y6MI=Q;K1!aRojeus&CI+a<9xY_PtVT)?@V~EGP3&OpKD{p$P2xdD+~tBs3-z| z^lLW(POz}FRPXpF`uyh$5RQjXMwo29_4XcxRm)gi5rnnjk@az82E0G1+TcR0?mTYbf{IcI`*s;g?#S(ECc=s z00)HNP2JX(V!&SU$r2duCU98}H2PNpKl7q3n-Bn>yCOPOCf~{cnS|HjU3dV+PB0e; zik?-x!w*R0V_I7K_3@}i5LNxJSK^h%Ch9z`^4ZyD1%SGX-#nwAULo3@5nawwv4zr? z@CCeup5E7p;rG2MH#znAYr4hEuTNF^Wq$pdC&}nF_2?%hNm}k^EFx?RsO^J&cdjQ!JJjOdY zU%xv2X^TS!zpOtlh-`}H++o(;C*ifx^B2-4MTw>n6`cS)JVejV&aFAno5ApT3aKDN zeVtBG+;ww@)x-8?nrA%8i4UhL9q|DZfNliAU%uqnf-s*Hqrj@5UB(n?Cuz(5EYOu*hWs59-jx2!FMD6`ZQo4Jbc zdcyMNcVTL3ahgnqLV}QL#|Nvid63J;*e;aP)6#w%-#c|4aGbKFKmu@EmUJuo#pVBm z1q>mvfq9ePeRQmurf2xTWbL{&qlS{wC=y*p>|Jw$k48>x-&f@ zuF%udcK~$&$RjP&Zt;uP|8QIdPxsZU< z0e4kun)+B&f{?rPU(!+&{lC6^@jY-Pi?$%~w& znehCeY1iY&kI^okJOh{&UeVD*>2gFWDub9LyK{3-nOkqen?Cc0-IL%s8TaK&UUHv9 zU+RoSM*rq54F9bCoVVi8gUw|@{+Y?*N^voRoE#@$F~aXHfFVF5hnjq{=Iom>v|)G8 zArqKJ`q(;GT?14C{s`m8yG5W^!rq?y?lC7b6BC>Z^}k+NA8vY#jz;fJLLz&9{?l%B z_(0KO72+|Jx}fmHVV3$C$1e=PD?A@LxjjZkIWSV8k(s(WX))5#t&f#SbjOFwvOwJ2 zHMJIL`TjF+CrbR(Kj?0Wzae03>c_EWr1`8P}oNT zu|y;!`DufB0AhRR(p}MuNJ_%IJn-*fU?>y%`O8ov9}qd}@pCFxyQud%mNS=6s{>8a z;MWO246MKe0p~Yo$L|3$efu`J$k-bEdTsnwf5zHy3jS)|t4Slmc56Wf`!ouo) z_fABl1x_rms{?v?_pVY^6)9YGS`uFGxQWSEs6x3pcI^eZQt~$_A%LYwV3`HW657Lv zBhL#G5l2$8gom1AR-_ap!Kn+_!IsN-x5s$-{OFc<}91rg8LhH18GQ_!Ui49PN*D>bV|HA9b z1Esm3T5T(}q-S7|{neE=Gf{E>8^Aai_~V?MV+C>T5y`2k1~YYXI5=9=zgJF74%U?w z;$uTYLZl=md7b+p@S5}_f`j{{?@Cfq!`PVTwn0XMM|8aa9X0g~;M#Lrcag?5)>F{3 zX}(W-U^rjDE1_0yRw2I1X?yOvWjc+K*VNvM$8i2h@6zO<2 zHvk?5kx| zm0i()It*&8COlj!1d6U)9IqVDcgjR|LXN-)M?qp@%fwm3$$=jSv@Z47oW3sN3t0GP zDyt3(s2WNwcOa%1WZ^82U-_z#u`@mZmu4h#Ehpla;fTJY#J2*^$MrC@w^dq*-R z+=2!YvDnEO!yfY;Z=gvm5}T5;T6HR6q|xxZzl>mhO@YUm7n3$0B&eLP9##+AYl=N^zLSzzld9-T+ z1{c)4GMrDQi4K?{U?(tNqx9~7#axqKsAnDk7I*h9o7H$E0egCTdppKdrD6L%>dpO+ z*Rox<=a!(Uf!MnbA3jh~EvjB7iS|zWtAk#s3vj&V<>n^k=euvu;gzzR0i|-kImi|8 z%;buE+UqyGdzWkAs|1qp^FVCd{!@vEN6p5@))5IZjrIt4ON)xzq!uUha;xzDkiqa@ zXk=e=u(LlxLX3kxwO$ToF}$`_eo{Uivgad3+`ufXjS0e;yt-O3GGeb?@CrQjG^TH~ zgGfOL15tcSnS>>Ac=~54L=5XGOt%XmR*H9(CcWwH5snxKTiJ18VIzQ^$HyNum^L^b zZl>YVFtssUt{#Vr10d%RmPI!Xvjx!4rOu}%rO?4B+Ux=y)shm8yf z3wN8APk*76f3=RXOPsY)dvP|HZ8FMdv8ksCAOl#S{J&hkT5JOFF)S!3=w&bY8*#M@d@$rYKx`i!Y%Ddaz~Qcoa~Fv z7tPN}F@rZn#23E(%xFAcOyQ6#bjmWIr1<{xXUN86oJLW{Xn8_9mpXNVw@ zSy{kmh@^01z#&U;TZ^7r85X#HofiWm)C<*enW1NI3q3X051kxFb{U%R?^aV~3iHi%U^KAzNQU6ew>( z!VBWYYG>S?=_?WcLq0VVpQ$#U%UD;06!| z%%m>-#`5O%BI7BeXlz$K+;9&M1%#WVijopcfPMY?8>j=4#2f)W9nL$dcEyhf-I0Pz zg(DewDBueQ&vyq+f#-oA1SI@}k1gaMH!zE#l(b))h-q{tSKj+ILttMTDZXL^1Q$9K z;DuC=9s%>3HN0-g1|SxA13_l1Pyb()t&j(W>fKK;d;D}g&(e&$Nnttn_V$)p9sL@c#e!}X0Qxu{ z)Iw{~{(_X3IyzUz$~p2NfrC`>PrGqJTua1{0$<0ik;CI#bqg;Q^wI2t(+()}6v^3u|_j)*sZ+Q^KIykRdD|LC5q zIcW(&MbLLcU1K?-s6Kr#BYG=$ zy{KTR&~`!EMQ9fkW_2Q)gi{qi^;YhbVGu2p1|Ct zi1YR&7VQLsVDtD$5IE6gSn5(zUhM&CF($nfYJZbMXkl6k>&s>P*!#{+Q_wv&i>KcS zOi4N0UCIV+mO|Y2UFTlQ$*P7{QxtLopxugJ`~guH(4`6q;g9q=p}-z^vpaO)G=I7thlXC&o*a@kVu1>?hzi>b*V`w7v1 z>FpI%7xW10#s;^piKhY~{f5)`~vYEl`1^HN>PfKa4gYRz=r{~D)>iW=L zG7^*Dx1Kp2BJP_PbHJP!QrCm?eit=i;dne^Ql8f{K4eBig>Cjim*D~8>UcSB!@@#S zBNYbz;Y97l?f`9mydWdMk*(LD!e`dnR8&?@m&1o0cyzQNxU2Wx!3KN=nq^G-r1wck z6u8p?SOEsEHxUkz<30bZyvCpJ@f8yGsgXGvoN9AycZ$FD^z}VgQ)}a0Q&E4(o2^>o|=bb)xO@Tzx3$=D=d)IFXjxSSBeI{;)=_fH}M9+pN ztJP!i*-}XPt0EcGdn*V~5=%sYPP1TTWkq7ch?>&7XqcGP$X{dJ{VOQ{wdFZP;gAR6 z6cSrh6jgI8~UO*|oVzEE5DQi!Hk1gQow zykPkduSkNs^Rp|D$ej;Teggc6r|bsNzp6YsQ)u$@;i)@?YP^UHBZY z#~RGfS316-a8HX4f~84MM+Y&AmuJ_AKf)*p#DN^UobK!flj#%`-*Irpp#nbHFTq52 z<^??m$ZbMAzJUbl?BpP)Xo_~tGA%t_z`$3~@;1@^`=V$gu$6Ny)kaUuA;5sZWY^su zNXp{YtPda1<7SLG4Rf36fV-HgxUXkqq-Q;)t)bD@O!F87k=@<)j)+y~ucJ_k-(DPSmwt#X;CVhjS=|iUFkI4+ zf|QxL)_TvQKi#$qRwJVh_w!0{sk@4F`_Czknxz?y2*S2m>La-< zX&j?I+`4wvdZTt}@9HBeDt~_&JmzyjTG{}vrM13B23p#)#a?;{uQCxR{#7_sQi@)om-Ct?_e!ZQ>QyD zCU$=E^PPqRE=nGNj-if@hxGIdGxa^bXjT{JVcD-KjEqL`SA1Zl@+bP_4EPqEPGW^ z5oXf|ajr2!d18j3<6`-0;Y|RO`jk; zFRpv+etGk<*nonL&ZsNaGcG_InkmvOq8~s;zIHGbw0Ts{#MExoMT`I~J%F_r-KmA5 zvt*vJW-tzNQx*mvMqLn0R663d3QJ3ywcX1Ac@^Z?#>NZ9<{8VgxKFzs$vD229rC}0 zu+`}R=uLq3{FNU}0F;6_#twXX&4YW*37+vlrLmOmWQk|Ui__6bcPB_B{RqN__*P&( zETv&>p|4NnHVj3vYJNODIXUagx@Ux$qgbl39vMwdBpw&;rc*V7CQFA<^gxZj{_9Ou zVj|0a_^TtTQ%o_uU?j;l2~MuK{bk=2NN8l6j zA|>S~=`{r>;o{F98@0@aW@%bl-po3y8YPt*AkHEabn#e_hso3%Tf5`+Zh`C#Zu{mV zo}d8}rC)(YEy6^!wQfg&;Tk|qodUk((t(SIC)Q8Ol|z<$mO?gFXWk15J${5CG8n#s z_4r}+>v%}@Y2;6#D~Z~gx69G?gmvv&hTv@oO5QEimv~+;6c99&%FaEP5DKt4e2my= zT-HJ&L8uqU=D4=%UVu4M(PZ@J!bnf)>=U>L-yJsyHQq?09nHsVm6snC7s|s~jE)`_ z@B*JHR$BLviK!me$dU{tu%pN>gCj_aqr-5boM%H~Qt^SQ3a99o~edVWCF z9!N5#XK5*q(fWU+;Q?77K{bh?oF@~cjODU5-|XPG`zl}@H$=dd2v6RH&!*bkoZpeF zw3s7J<+b~XhX2uH!#|#!j2&HFNg3s!nEGh(BAS#O=`j7q!2zTuOaZZce>efvuXH5q zjoFw|!#f1wmTw2LOG|WCw>tj$^DO7|NaeD#QyyUZi}R<4b%WB41N_TTS!mi;R)!sv z_@B`0nS6}_S_MPPbn8=;`cCzbLJ(;N@yQ^t+yvhQ@K_MtZL)CXGl3FPc8zL0^+M$S+09G@W?VPNM*R=?`j$ z#MjSGBwJ%b;%v8{7_e#pP4`x?Si(*}U7W9KzKHD8-u;P+8Q|nBsJEV$3liI1>^e}9 zmXcQ6)4#3p>vci2wMYgr4K&kyOHLMXq6K7a==lUlXF%)kz_&BysjE>kI@P};>mjJ>r?j+RhN4yFAC?j)y*Z*b7 z0qEs`YX<@Jff3;<7&V+@?(Te$9n|;9Piy3eOHcDFDYnY91zpk;TW^g0C+$tMThP(I z;lZ!R|Ki8Z&D&M~t)zof2qo7$BxI}JM;IAAFmMmB7wQ_b!61J;M&|>jSk-tiz909(#US5tO;!sGnoCRluo+I-rFxIM6M;qO^R4$tu^S|#EFh%_6PRq+PGcx)yOZA9)NSjNY21K&!>ojQOZ{DQ){>Fk+QzjgL2Iv=wklPZ#Vz3s0 zZ78mvdwZoCZWl1f{MPXp``N*Ef$1(2?w~RnlDYt`t6A1h4b)N@i3+X0`O0*RyW31tasIGy50v1I=vXu zdj$sv!#tne#oqV1|Cp;Tmp@2p1NPVG^KZm`{!FJe4O)vzgVqBeBS2qh23@wY&WfsH zV$5Is+5zjD<3=*LkyOg8CSdw=rQOT5yI$}HJqEC$0ctVb(sAN(1SJ5hO(?4pC&bca z3E;HNhb0`zg`=AY92OwJn3&a#4=@56yYe*ib;3^$5)iKY)CmdgGfzJ{t5%078pc%a z?pm;#U(F78f}X1*^zN=o+Bp|H|ZWl@on_ZG~0 z(k+3Ib+}JSL7^Lj+_=W|Sy^<Py=A94J$S_rV$cmL2?SYgvu1%;K1{S*g>GpDjgG&&*Whz`oS4N#XaRw z8Lui!`?!UOU}+xAK0)juTqc8et=cr!P(spkI5Q2y%Ex~l?F{$h<%7oW#*GSe^w#1h zzO9=@Ln2^38?@hrH#Hwx1ywtswXOg{H>F3Ly#@xuY`$X)pk*8pARiufEkD0>zctI~ zWv!lLFy^*ZWDX46-Xd#!9x^xpg(jdEZaV=xez?OBhQJ#f`eDN?*m$b90LwCKe@@Ct zzKg~s%!g4kJb`+nmB{{jl^bZ}oWZl}f+Wg5HlE+HZG}|v;7CUM&uD$!fkJZmtk!2EEZNGvC zRG5>?0P~^KsQ7s3`Z3VGvBW*a1No-kkd6%xjtbEq zRzQSh_%(+fQKl4j1v_ZvgahuVu0B#~Nm}f>10|d1k)cpOy;3Z`jokA1jF^V38o#($ z8spzu<`vX3c%PbQp$LlvEpyltz(xZC0yY!a{;QNp^oUe`XkaLo&k3|ZPjE1}Wu2M> zwV|Lfu6V%$r56_Ixa0Y$7|iw+ku)%vQ$UFE@nNbLo4gz>hqrlx(Kz!I5Hv_#SOr@jydcL$GgXx>nWy8;umFIVC1qJe;)xo#$yUeCbZT)Iyyi4i;5t>4xiVTJ#|02Qr z7|;x`F3W^}XRTkK^3+(!iR9wR*V(eLq}PoEK3PCV1cK_$f?@|nv`%+C9{90AQKC~j zudY7mw2!lM`>sew$8CuK8)!XYBqAa$F75yx2M&+9mOqH|7up-L9i4IjBY`)hPk9EY z=B{z7c}!5igkx6PwK~H2vOD1XR#i${TSZYZK9k&Z9z@<>v$Jp9l<X5N{7 zEgziR_<{{hgI{XkgK%iKH8jqoaugjmoF$B<#5_1XrzFP)Lixeeh0e2QUlSkJI`4dj z^97ho1H(VJ$%GV~UI-3}h@}CI;xGQ`FkELXIs7U@q~&1BQ_yN$4;0wZ(v1zm=23)m zMd{zZ`O5p+NoJGm`20*x{@txHetHxdFBC9sqaQ?E&OmGptG`9Edwd+(92)m5iU4>SnqSC8#s!k;lnX<3Pqil0C0m+IZ#E<^^`)e&-69_D61R^)N+3~gX3 z!45hH4nK18#!kz@e_%TJI899_=e26vgCkS<2Y~igqwzvQAhluG`*!hTqC9bb!e~pymH#7vGM4ZjZ zQ$iBJQ3%!rLg(#AvEofZx(ro|b8~hsw&$l)CXXIY69ia{+WCqzX?>TYy!8Hsup3+T zv|K`~EdZp8^^FxTVFw(Z*qRvhCd+Yv-SeZkQP-)uL3>Zk`u?IN0p7ggs`JEK<{w8xz3*aRjg~r{cgfBg4V-XkJmx_gC9EoOLj=EL${r!HE z)bHPs*mVn@soWFes=ZhKUa-}K5FyNEVhZ?PnUEObkMC|Wx7gb@l`)(M`W z{9A-T;9*Nq(`0N@2%59MVH%0yR;L6dbM zAT}p8QZUOC07^XiyTAZsgp}KQrs2&0&MYlewy>bS1J7gt7XLyARGA&DISSI9s~!4_}#m73VMVr zdKH_P#3Urlg_W07Kns|{Oy>^YC=l{`j4K;B3VNR7{k4qN ziejX#jf}RJ-umH2^tG%EhiMu?zQ$2E^R%Z0R-%~0lCI~34CN&)C(fi@AxfF8x^~x@ zTp_AZWX{y)^;b84T(oPu9WpLOo)>LJ@(A~~jF2SJ1z!QV4%b4kY!i;uUJwVIZZ*?} z2pRw{`_DVWjWU^oPCpct96JrYYRVgvVZ%syh3;fjEp5+xBW#F^)0+WMa;iOw0_?4~ zrO{uAqwr<@6~e8(J9nivdQ;jC4Ah3nOdkPMBEGtsu39O>zQHcbhB*JOY;ejgn@nq~Rmk#BZ$Ru}M2(=&-Yx+-etcAGkbm~-bW&y}oB)xw z>Wi&p82BEbsXg7A1>v|O4u$Znv-9<+C^wgv`aneI*E*cd1|hsLNu)O*Y<+V*hzG75 z>=cnCPA$PBbqR97_U)z@?Hq8_xiK)Q7k&_TbANAQFjlHhQMu9@I&5mt9-cy>aBHWa zrE1CjY)^rsF4hkcZvn#A_UzRUBGxd`M%tQ<>}HAtb81LrRI0Z0%-FR3NTyT?I$9DFr`oC~1+d zcI~BlVPU;7s5fLYP$LhLw`S=R+CWOX3+2&9%6FJUGCn&K8Fa-HaGH?^u$+8raaEL(`ZF^GzWybY`TGZZ z!(nGsA|e!~27AjB95zRV`7H~F8?|IfA<+JSQ2qPs_bnbOd)2-psvWFYXHIMV8QY<8 z&dkwVmQ(>?7=0(sWx?}=vcrd#QRE?Vb<|#DuG&{Bhy^+-lw~9FXV(0D;B@+0K!_-YC#c_KMhJqJXz@ty zYx5JWt)@Z&J+t*yRc+nO0A<5$H!x#`t=X(UVPb}jWi9(GfnS<~&33+4XNU`D1pJFus^zSYy3z0u!%-t@jcME-0+VSnBt=Q+6n5|t2`KRw-a>yORtiy3b;8jL9crqWEu1GO<)(-sVLr_1(ARS0CL7%#Ku-S>h`G52b&)DaQt7N z@+D(BOTy|(AV%gzH1m~xbq4+)?6s)o9pSB0I~-WMnhwM zeS#(m%SEIGv@L)}oPw1S6qYtN$Ft4Mi?rKdbR;BljAS#scII6P7P8|%*qNB z>a!oS?&AJ+t)cY($B^{lTOB+)$9$rek(l@zj$fS`HyUg-X&D)J_xEOI7gu|12nd(^ zUS+^>*N`*uDkM&ud;Zsr^AtZ^pFZnrDkpK^8tthq>562vf;_R9DbImIMWs$oJ?zW9 z>~sBF*2@d6q4>p2R_)Lmi$|)Qr3Re@|gA~w3A5lJWJFKkO(4udK3Cm_sP41?3QBZrH5o+Z|^!l zUD-$kPQP1Z`fI3Ijn7$87s=ulap|gdvmjMoWX9R`&7%wHs#m$_T^35(av3XSoT{nb zzKK8oEQ)j_5R4ztq{y^$Ih2NZ(Q62aE~=Jynx5_{yHjuGe*DD~8a%i>uLBzKUMIKWO!Yib@RFi@)OS#!LGi3uzGWJQ=y2^8PO` zeK`dsC5DDemt{S?dKwm&p26xy2G?F-f)o@Q3FXC%y)ZYo)u;lzCK~ij_9F`3vDTjveI9@@M z4p1Ic`-?*{CUMzK-Nc~p5se0YqgI;D5W~Xn-=0jD_@Jn9`)P1`S{hTK3G^T#e94qD znXjwh!uL=x#UC4}JKf{#3@dqW*$|Y)gq8^^J!{Nv`y&- ze6lk|^4e#b56g3imJTp&gyQIh?R2ynoeO>s`V@JEE?&`aqzZe_m)Ii4jJ(OW9AP z2iUQ67~MkKOggzyqzHtGSkbL0FYV@llh5Z|9lJtc+A8?|nP4wLogEJ^UFm1B#mJY^ zV#_fRGxnq7Qcjkhw3E{380_O77w1>(WYvv$PNBEKbJdTLf=_jIBbdT@Ejl|snPQxE zsuVW%^=X+UyyTKz=mK&@{4*koUAsT@HaQ$YlXjgfsN_Kpdbts`Z!ueCHEYgYE{AU7 z#upTL4XlqAXI2js)aMWwrLa`eD-WjXOJE5KTDGPXT2C=qS#_e3i;Jst8}=1_jMf-b zxIH?mVOP*WYGq}`VE=9G*QSYob@g7egDF`!`MS<0nmgSFIKUuLSz-%9i5 z=IzDNr1wN50y<_9MqI>#(UJX$fq`6WEdv8D%sP2^M|#8Y7-Q4kZS7m7K&SA>wW^1jET7|$g3_qiJ~&Ivif95>wo=n zI^MMgs6*Ytf`PGLqAb6ZD`I3EI+B)_4uw+7El$;Lyt|HA`142X>G3FwDscbbV;JLJ2x zMxy%BibC13Is%9ZBvI2HabV7Z627ug?JEZxY619H-fYLH{yxQgM}JWUnOuin*FNy{ zfcY5@g+)gbYWsSN56)V3l>3$k#za1ljtgB|%eE4T=E|)Qm(k+WWHlGp)s?VOX3G$s z*TceGm)W_!{m26jDz`3qlj2qWxOG$4v0nfp7dlp89Z4?o~d^Q zHM=C~`R;a`mS&VKj;&ZxNiH7^`w6OTt6ttJ3BSwYvYAZ0f8=JQYdoo-+fpZs?JTRw zvx85c7+T|is9+YOz$r44l?yPD2nsZgq)wXwoQ(3BnrI*c7xC5s-hkpLJkyw{ePxH9sC+uv;lXR{CeN@cQ2S**2L^@@aAzJ2cbrT; z)F=zDQ7{T*_G4Gjbg}IcxYIiRoMpw!qwMpld0*|+U@O!)W_ETYxVKrxUSu?qe28X6k5j%eW;4V$_Wxh(m1$EitJ;%dx=-S)Q1w}<}`wZmt^p2g;Bp7%mY~0p&LdzUi z;5w^3;;3ECxZPwq_vCGDwihwxCqH9eqrMl8Bl0v^Iz5Ee>116SZ)d9Lv#t-K;PFZ` z3*|Ld5*(35$0yVx1PDkV#h~ciK`h&uh*iix+6Y}~%~T#XDSeTx+Vxp*vihW@JD&tM z$sk>oGji)Na!}+VV&ms~i@sG(s8UaR;>*?IFm zS(dpP*?jm0#K#`y-1KyDFR$~C9?2_LF0yH1ZVe$Rsr|9t;p&Kf)P?V3TAcHpZo`WD zb|v26`1?x-IX~aKLQ7;pA)%RJ-3uX?;_GK^;%bEu`vx+9DzW#mPMn`{R~akR!j3$* zHeMOhHy?6i=8by6kbdDmmiz&C;z}S%<Td=-BDg-xdnwN z3?sPUH#7N4Mm!#Yd2s+@6=?oF5E*&EYHCVQWSpPmy77gUGK*GNU2e}v9dpi1a&40= z$Bt3P&-BZszpmkV!yuL&O3z#OleIFqi(_Th#%TwJ?cv%LcC-Qlv0;-*Gwq%3Z5gCMyqal%ifiNqaL>#~>;hPprGVV2GpQE_;jp zdwE$h!S%9x0`2|#kN9IMjXFnRj4;822hiPIZF>Typ1rJp2a^>w@tJj?ks>Pj+~HP= z?B~|`PESxreT*`n?^ptH%ZZ*N4i0w&v#u1Hdby2rr32&bJMGIyJC`6j2g8RCjc3R1 z{pCdqzZ;da6OR2bOqHRD|@&)7Q?LvQsFWyL6@C*_w>fjPWz!8)?L#HU*E_m zb~S8~u7s(&)DO5KBBJv5Li*dYqI^1?EuK&D7Vr?ojL3A)yvaNWCs)B6JbUtIICx^bF{$jPlpJ1Y7Zf z?zN|d{GHq0)5`dSg`IF@8^Ih=OrhnuC zrK_Z@3`Nzig4x5F`h}=4(VM1(h;y0w)(x1A8ON`%I^h~E#3rwN)7@=cMC6$DNC03Q zC`uAIOc$YE5W-syXY>KA`t|zwJeE)=^DHJdp2Oni42JBZYL_E$m9TN{O}xFLjn9CV z`={-F^w!Y=nZPfu*V9&*68>v1mU|~ESGIR_4;Bl&*PdiqOt{#!hf{il}C{_n(k(fV)*0#&`$i4XSgK!V`~PF=Dxj*`y6!arQ4m286c9u} zDJ7&sl#*1srMpWSNd*y*Zjh3eF6nNNmhSHEe_i8!{~3%op4`i+z4zKH=9)9K8CdNI z2nf<;O}H%=?$MOs60kw-QI3+@_v1&<`t97BWe8JqNjqfebC_vr5?~B<+M1cvXt->~ z5_NFkE}tjUy*!bxm%#6b@nuue-3y6>Xn-D%clJfl)ehAt`0vustrv$Zm5%Y|?L{%7Rmp7Qb~0J=?1s&{ic?ucLt5ff+TB-D*lWG0Rv z0Rp!EoM~v2s__Wad;SAVbC-EpR+i{oM>J1hPYkCp+?2S41W%=ts#Koe$NDLFn4c}H zjeaI^Zh1|`yXiyD3zv8JKio9mm>|&3f_gJFaU|8Q8jTdYd?e%IdO!BcYGoluvsnse z=g7#(74&CaG#!TRk||k``}=s)e7T=1we&L-!VShNpiwF0{3P$Wes}`^Zsb!9#@JX6 z=n#!CWdZbmY9^?-v9Y<(2KG!5zUbm}O0|Nu??d{xVQ!UWifN@W*ebN-l>BqI0mECST$Lp0)*a3Y$ z5y5w-1F9%&HhcFNzp<~{^?oD%m2U>hWB_}nru{75NWQUc0ARC`yUc5#NMH|au!L;I zfJ6a0DW5elFgWLOHIYF*?XAz;_V@~MZO0Ojv* zFP%=bWwJaVRSy@Gnp>}w3qjKBGua*OEcB!_Ud61S8n6HAN=*5bD|S3plA_Sg&)a)x zFz10{`R}$qfL%E}B(F#g9>44=E17)qB|N+*$p?>6W4O2X$^AITK=MK^E@R6ny&m3V zQS^YQXxztOa$VTiE#{~lv2c2`BbpmNq1kRsJbwj^^mv2$deQ-KDe=~CNZgBq3Ud!&tr38!X&*n%DVXh^s#ca`=?GAkW^b-!fR=b~x@-ze-HZ$+ zqRybyi;q>GJ^O)~rRkY&5NI^)gmq20=O=wZJ|m1$*sJMt)rU?^2b*r-)tH-aft%FU zmN<~+>Df^C@dbt0y;rgrembwPiO8e_r)t3W8V0}3&xju1#sykI#KLbyg@nkfs2J<% zHAs10&=px(p{AmuLPr-awOZymm#rjWU}7>i{r>rrLoX%v3C_C4u2?~SF(4t?91a{_ zz7z?i)qqN9*kyCxrqy9gb&c4PGUk+zjH9Ji#SVvJA|gtrrqbcL<@U0rrOyInU-x6` z4;Qj#zAn`3sa7r%yTu!(X~^4D?KXe$QW*gETDBhP>J3$%v2DPbAS=7WQS9|2_n1t% z95TQ9iBi*F`6R=9Mqz!W%NW7FaDH|i(c=Q;`*M?Uy=Gk50dhbuG@n3;1CO!VWbx;B zcXwHlso0>ga`w@R(}|PANa)VhXlM&|pkimId(x%4rB4ekiPmIIms)K_VB1)z*|Kcj z`IGkmBLqpYH}ntk`OtL~9CBspxKlg1wA)ufi~sZW zk)rjTvGVi1rCFP~HmhG_35_T*)@#4|yvPrfi%ku77UE1Q2@e;#ed_84<~#VJ*zrhM zXDb|208QcwqXiy9iio^|l2WeO^qKG7ePJF`qPW6VCU|2_VWSk#1Yt@(5JbRkT?KRDVcv0~lxn$r!=-S&R41?Vw@C)_ zuS60o84x@Vl3T2yeUS|38UsB&bdGC=$($ic5+o(d%gf~#|J6ZfbQ?a+#>Bkf_d5$X z(^FSpSX*O*)iO6fi9tBxe6$$(I^l@K2e@(KVxl+>*C7R~cUS>HN&Vy*^Ahfpjnm^* z=wT-f5X^nZRgret>;3!pKc(tWLUYU3+ns==4(b{KeUFgic z-QFcJ-rSrOlY6Y$IIGXbA_o{hrzgZb05lvN>}qcA_?cT;@JhDhIQBJvX(`(mG=E~U zRw&nhg%fM*=y1M#pM4)x8&bVKD z9H`NJRCE^@zc4Z~^7~$6r2o18vtDv3Q?G~L@lXr%h>er86`aj#*RFI~n=WdJX8lr& zd9j6`^}^<30O?VPwccNw#iqdM?mtr%6*DmKp{rbZYB9GUe$oUfi^}t}gt9WKcGSnT zwBUpf7p{f^U!ksn0dz}p+K1eqPFWZ&!{)qp2M`RcA)>JiI!e3G`+W-vJZ55n1BS!S zGFo$ODDL@avN&cyl+#l0+ho`L84s%}mn;zyRfRaimB9Z zoSK%Det)7adO6(O3_2Z#&gZl{yY)Vy(9+C<%Ib9TEqTtF=m(3_N!_@!$pd%LUM{!a zH+J`j_FR5}@w*)FBme;FUh@U0%VW443lkIFZ{|9mt5{fYzNn>t#)V`hbGdaBm3E}E z5++*o(o$@M(^bTV{Ny$$7JWCGs2aWZIplgEReG7t!0db_paAE7DR~2r3+U=>e8Nu< z@Lg)Orlv>3^o!uM->q;=k6^OUWXENNz5FgwC-^x+-Yfavzf&?7O=#eEdwB3IE)GGI zd~{Tr&qs}$l3daAb1DLIV`7kC2#t;gE)X3W-EcQQ=lHz?Vec#cy^tO@|HFc(ehFS0*EDc71(!&&U%{*?u}lIWPAC z&61xlf+67B$Y6gy3K3CIP!TOH#yt!HN@`dxwN*T_xn1En0fIYA(h)H+pL=DF$#d4%G8Uqt(quam@~Dlxk&Hz;6xJz#UND>U|+!O@v!ws2s(b9_GyL96Y{7S7%1qn ztH7EK4oK3n?W7L+H&n#9nH? zb?RnJeUSzn{sv{W=pIS=KMQ&(PUSx8rAlZ~kKV(|5g~iLy|1bi$pn59@$SwdA^6uTcn)}Eg77j|El@$&RjZ3^uxmqB}Q4ds8 zq;%OXx0N?3u5dqf{ptH4$OP$_6S=_&JWw+9XZm!x*?kGh<&Tg`% z9-20Gm(Tqp%sZlnJUy?vOSRC!UW9P*q~+u+19F1q=8#n$_{EGkG=a3W9W(`OLyozk zg2>QIlEGyC8N9OBul??-x)M{t)VH+aW+SUUUQhe>&Ed)2uBN8Ah#xEr3>tZuGpWt* zQ&R)rN7DzcL(|pxZBr7G$3H5gj%p`O4UK3FqLL%n@?k5WQDEsAP|8Z~op+1{wR2zx z{xm6FDJJ5!#+;KmcdfE{jS02uQdp*CZ zs;b72M}K#Y5RVIJsx_dbI5<0~1N%!jLyCCB&W%$^QBkX|xC`ee7Oo*H3BWiE3iWi%rw5mXj+g zj20D}fUXqrb|6EZLAyPIq%{b9Ltvv@ZX9D`Vj2Zo2188pQdt?qH73+*J+-x=$6ZSw zkQ3zK9wY@JASJr>lX%Dx44qu}7YU~Rm-;Mh)|TUit8x%<0vq>m&hNY6 zx#V$~TS8`YbJOkW4fUjDn9jU{kSqG1bCYJaF;N2TZ*}#Xol$6c-=9owiqzKH;^IwSB2Mq3f?42;?5(MBUoD0c{626*Wn}@$-fbuV zOHjg3A>WkLT~kvN$^^NDJ|ghXpM8B57V{*xPI%-OmX?5l|I6xcvUV=IG(!}G1RjuQ z-kh45Nj%7cu1KJ6k*N5?b%=-~LFO4Z8^_j08wuGgV+v1>mfL_h>iEd+JK-PlVR$89 zwY2BH6C$T&c|yT4*s>vvmol(Kot%tJM(wJ8zZw`TQ<7@Tpf5b2RKsY{FS4oJ2pZs_ zp+KZbRblY=N&LS=L{u0IG>6bcD=QNY{eDNtk6c87Wo4z$Kpo-;Bb~OEmh{*U@av`e zac5${RSF5&wp!mW=!$ncULMd}AJfW#T@!gQN(gRTN~)XRHZn8>UjC^vkVKS`m9??4 zk#!jO{SCNjREVQsoPJ(dgtRr}+HT<%LJpT^*zB*_Lwwg;{S^&)7;vmIRzG23?JrS~ z!XF<}J;H*%)!HUOZdUp5TR?!ab00{vh}!=>FwfryHnq0aPFe=K@Is?ueO=w}KiU6W zx=LqlXAxw4$c;zskRiSzlurgRfSvUB;o>+pmO0;sFFRcF=FM0`BSpVBlA?KQ|HPJ* zq^_ZXl=bk&a89plKtKhAgOGkhx(dkS_e0M@b3ya`c63w}&bSre>OfZQM|t_}anLkH z9#!+yV7V)F``gUGB?Qro6)4iJ#{K>b{zKs3)ir5FISvd;Q}Y9bPNXon{@gbEbC4s6 zhe+uCeUDW+{gf9dMfUqspqmQ*JM!Rp;SST83w#bR#cz{bRW&t%6&@(eyx0FumWgeU zW~sE)lY2Wc)7Ey6SFk5}4|FRE3k%<})BZjOau)#l?Xr$-P*c2L4HGfQCptPQFHafL z?x&MH@|G(LBsd`rb#?y@@=F-x*$2pND?@4n$n{~m8-dRFRM}r+dcYwX^Wy-R^TC+} zQ=`s~`|nCuQ@(xEgiH(Qu}XT`0`0^y35=|ZosNkKA1aUvYO(t(==L=5$;tvS0L2gm zUIQFAu)J0g2z}A}H-SV31qG$vhVb_7+3D#7(5FAh`a5g5s90GK!CiIt2it9A_|DVQ z&QJhpbYs11NjyDgGb}T|lBy@EB2Rb)6`egSRQ8F(yYXKglsF+6_YPJe%~}5A2^R}& z7ryZ?boLf|l2kzfQ1DfYqIjo_p#T{bJPKqI2D13tqgXxvnda)}V48{F^8g8NTw2<~ zxoSs82aq{j!@!U+twdf6j@aOV>~R`J+>lt+Vv})wUcq!3(V@@C$uqhp%gFtTc=dP}?tHf>sQLKhOtr17~rkysa%CZ;b(lKzm)Cgn$4QaxP-^iKU1c zfplwlP|(uE+jg*c$fN5!jA9UGY^RNtm9#@80NBXg-~GQu@6y@mj)qS4_$AB(ZT6eL z{|5f^@QKzd!p28%?^b4J8#{&%Z~mDKmttc@P|Ym!$=!humrB_+Hdd7#HoOlX?vMeq z92_nf z*qipl29nUh&oJI`xDm`YY-Z{YPMNAZI<}evLk$I_*h@=)t*vEYVLc@wIsIp*2ymqf zFCo4GukYm?xs~7M6x!K(Dje9%mLVxFqcC5HV!s@0Myw3LIVC` z7ia*bDXEjP3GZb<3P`p5l?MB_Uz^(oit_Td+uGOvE%sVhSnTvb+1)y;ATR%@c>MSN z+W499|6kZ_3K@4nL~Mhs*Zeso2;jwKDl!9Et1#i*Xvub6vM35L?k$mk32?DvH2RfI zC1aSBy^0LPA3ZV|!br1*#6V_7o5=`|>mTOP6BOh#ZyY*+_E-Hr5UQ=NtYoC5r2M!3 z2x4K9pKdm)9I;VSR`rK8S|hFJ@1sQ%RJkh8xr#6tl9MaSoS-{);l8M-uiXb2rnrir zP}v{0fn$juZ=Cj2S4Z6Z5_RIaTCCqbKEAxS$`&$-+_(`g4cE||;xy%iHn4r_Av?Ic zwe{w|1?KzH1HI_#^)S2hv!19ZheD12o?OP$(+WRv5K5u--twSImF4vTPPX)#pZ}Sk z&eDQh@I*>{e8+V7V+~hT7-tydr%%oP8)sB_=5SPxn*4mmdWwVk`g$~vn!VLws^Z^P z1a69du|0AJ5;8#g-_|7f&tHQp1R>kTFo-zz9|e){4=m)Nr^vb9$~#I92{1hoteSI#m&Q$BD`|>KvR2; z!{JWnzinH>bPxlUJ#ZprWo6~$K4{dRPY)8Rl#MMZ6WEP4j%P`Z#hoSzb)pri*=RsMe4s3bx{shJ8) zT1@#0+nZ)R-QA_uG%cg$tiw4D)=KxUMA9C@9K9!I&E=SNZ%V9d~aaO znh?{_Kw>OG?g8h2i+yr_!1_-aeh34(;UEv5MPO0vH{yTrzzuk@!E&~;f3+jS%_F>k zV7&AAv7rDW161Cj2GN%p>8F|C=9Wu-keY6Ba`Fpi0g^KYlTyKs*KB3TvM>Q`^BjJi z#anjRUUh@~Cs0~m-oFXWIg-`U{Cs?=&@@+4^61}`L}=mNy$d#auq2OyZy>R|ywF#aH_(_zcm=_TgVuN|EgdkkfB2Z18sqxP)MPhr zZa^c0r0hHyMWq^DRw+8FuJdF~JFxFU%Ga=Qi7w1PV?($&fB=b$TJ}r z6_9@5YY7Sez`$v+%o9!t2?@gm291*wZ~xAyZ%D?9&gkQ^z(5*Nq(tTK!-dU$k6I1t zLty8ZpV{l_LA`v=oN1O25606Ks146fwuAPE!BPe@R(B2zypWWfZV4_E+|cmIDNxBa zdHU=jqPJt(=OS`*;yHcZaf{OT;NTtahrB#q6j4Age)REyZs>^r&8y4MOh1zB+nOew z_y31axeT{?I$SJ*G2b{ZmK_hI4XQ7p^h2h+i9O#=M=QC=VF?fE|AUfSFt%k&jV^yfL3OGPX2uhuU|{6 zv0v7`SyP(;IF?_9MkIa4CMH&=c8tQ$9n-Ru9dT(#s^%%!*@yE8{}_+&BEjHMY1Yqg z+j0Qw#kKZCmR0@l(EaF$^2m=FW^ z4N`2`UtQnF{XMbACb`)ju$HL-;b zo;y$X@2t-9{_yH*CMrpDv&kUplH}rouGQL#EmQ;kZGwBq(4YbA>FuZqNL2w669@y6 znvi-@$RkKfEqZ4{`L8DhANW>7wofdo_!j=*hu;~JK{A|>t5=VTjE1L9 zi*#L8K}zhdS@ZMG7$*pWI2~Jb{(4kz@xh+5{%|~&p~PWhWqp*}16jPAyht};=+WAF<=)|&~!<|wRgr=9geXg4# zwmRl4EGs))SNDYVkOq1EP+Aqp9Dp=t-ru0)`*qkZ?_Iulf#hZN?USzw3BI2`t*orz z{C9Elj~_mSb2}3{W+v6EvHzp7c4^R9{JEGe>ztk0o;kb%eh&Z`UWs>pu~CAXzVV^F zT-to=ZehZ=2jGg1j~_!ySv@E0uQTi-iVO^@=C`4@5n6C=4=qCB^yK6OXXwG-CpHIi z*U7eUDq!J?iBzomfA85hK3)af;$@EGLL&hqL+YcQMe2b#_%j?M;0*=B(u2V=2=l>! zd;1E;*zN7KcXZeToa*H9ZPS5{Y9@74ER0B5wLxp@=31UbJy7e~CJ;NVCT z!j6n)cLuT$jsHa@4b#IWp#UbI$HvQbILuIW3MWrN?$&Y^s|uPTA|s7s1w}$u#PUgUk_m2q!x zuiefDv@azKlKl&)-rj&Yh6brhaxyYXmTKUFZviC&@L>a@|IQ{#k4WbA@d`p=)#b&- z?}Xsv{yumT%;D}~CskGTW1}M>ncOY2kvG2qx9h^RJ@2)*vbdjP^KU`n+zsN`U0aov zkihx32$0{qhxEPWA^ph5=K)e3HFh{Y^+AA!l4UE@FMY9zAt~k za-7A3NZ!TuLw#cI7B>x))kt4!?WV3n0u=yaZx|lqDJzfW(g#S$eU5$m`@CG@fA1

jo8)0vj?OXkdXZ11U*sNGv0pawc%Vj#N53L&4_S^54)e?!Eny)J=lYrq=Xblgf5A zSdy#^OjbstY+-*AW{8Qrjg3iKvV-bIz?P|kYh=5HDj*OkE-$8{^8Wn=Pll@y8N47% z>+O=rb|PS6lFkW(^#Hf>_%ZF_v^f*{HSd?C0f6WIo1%32`e-v0|3Cz8hKz!O9Sn0u zBZYVjss}G1iamBwf4@Qy%muE^S45q_*zocHS!NapTZ!2Vo!Y|U#O0gvbkH1++yQpf zN{7s(gn+UPG&iKjde**v;Qrwy)4-8I6C+a}*h2Rj`hS)JH_nxq(GoaE)N|wl(44?j zK-LBFT$2A;sT(6lyW3FNzkcKC(ciokg2%DDr{}QlA#@L_(8?yrGoY~Yfu~u;1^)f* z+rdjI@ekJlOu0+&>Xga!F-%`@-63Ew6!@&c;{!3fH?f6P+Yj?O_S&n2j`I?@7x+o0)^M%6|9zvHAAgC=Zk2UdK{cB%i ze|(%o05Lc4brdVj3OZI=)0{wA4OpHWk9PXI4#a6{c6P2aF!T^m;lBbphSGPNw@Apy zG(jKzp7HO3A0kdA9yt&WT;uiid}^bkmCmYUw`?Ix^3Qy@cs^pZ>@KqjFSoN&|1V48 z!oR#ad>w>*RGp*c(*^d%Ln9UMSH{7;6I>he*@D38g;q&Ryd@SC8K4egnqB(4rW|}3TbiaG^PadZU|M9`| z7trA3;NXDMuMCnIrKNV@yW;f!-A#FFcXkI+dlQsX;WCp(fqJC9V&5v==83iis3xfx2m*RQ>p{y*t>Vf03f~0z=PXs z8x3#4;VTp`_Er^77hA(Q?Sl&n>H%Fbiv__L&!w8lZ_V_;wwk8-<{rrm@U6Q0Ls@EN z#gLGYkkwO4Ny%YV;lKkO4@jz@5tqF2AvUj+G_0Nv5^`yonS6>d93LOJ|8Qu=^Qn(z zLE3CM807>v0DeV@Q{i~r-`p&u#t9KoNlA&Gt}f;OMlw~v@3Wy7^82wqiHW^{4!+4- zXskT7Huj@1PxZ$;18DSZi}!RcC$x{l7_sEvlBD)v0+S+2uXZ zjf2j9urU4oG8M1u8@bQ7J4Fi~Karz?uY5ssl1y;|?&fe87rMV|x9dY{E+K-)YT-T` zq#?Z*vl0_$hVpb&R8+hd|L*;97k(9+jjxTS{7$wZ^l4~lG+IMy1IcOB+5Jle1>f;m+X-G|LuTGa{=VCqdJY+r-59m#3$D+TpA&GRz` z0GdC<^$8Dwu&!r?YtF13YPCHnbbg zclWPwEbHQiWCt+n0)M7OBPL=J9Af-0-SrEr~TRE+j~Y00JWOU&F@Y)M!Dih z63Pc3F2c&E9yH(#}q=ZNw?$xC5j`@!#^r!gepclH8xbHj9hYb$7lii_*4!8a1AO^*VY z6L6u%e%LDBzxl&%*SmI-g_UU&{E^Yp+YG0{RI=-1nF^X3A+JXfN^_hu@pE~CS_@sSFp;e+cH4v(~lsH5j z@1TK+@yYk~o)q!*(Xw+OjN{}~hOPuIM>_+3eVM!&gMlpQF2v#mU3E2meM$`uq15Z~1ov>*|W)Chks^EIZtO@n@L1=#;WRxLsrE znTfjkV^J(A2Ww);Yo~7<9u_3gczPZIoU_t=cFpC2^aJvI-AN8;#7GjZMJ1tAC1*f$ zf;OpdygaoKKaA}7u4?M_HMprGjn{6~dA$^b_ldXbW`OTd* zHLm_|@ZJ7|&Q~Bo%&2?ueHGIBj`D#{qn({O3k%XCf@6ZAz-;7;ezF$WgAaxh6qFk*3&5BYxCVG-drr22UHCC4Z0-NCFxMu*M$*=`b0M8yi_T9V0cNR>HjUDz@d@001MsP?pVsK|=v2mseQbqW9jm|p@ ztR!UY?0!xgo6{&3B@yoafZT=^1&?TLmIJfPSgKbe{(FXo!2V?IF*u+vU)BMM3h(`Q zAP6(Jpu0NR{lh>u_SYGYDU$kCP(lK+8UX6mYPrXhfJUu=2!&WN2wYoW#CrD*2U)p4 ztCXCX$5SaWhcnJYuB@=|$7jM(ZWgE(9fD@^^wfcnkjXm^NdbXnXg9Fs2!DJX=xbDp zO&Pejo>EZ_jEy1VVX$WaC4ZRG+|&epm@V7$LcnzowNOruh-{@2CI$wZ))2mD&p70* z6B%@}R4Y}a%ihj+U;{rCGR$Qb?>z5&b_xRmut@5LN|qiq zLf#v|3DB^J#p`+f@MlK{Ej#;htg{%TicWWB!wL$5y}Z1riKANkC;>>Emq+|m{a`3> ze&J%$%1~bCuV1AG1BiGDpm<0Te)a0Wp?bDe7F3zHK}qJL5FovIQO(TsKr!d~+<8#k zr2W|zjMwMP0>a_<4r!m-b{frcz!$}x3t2Pz)qQ^7==)EGvBkwD13f(m%t(;36mxU4 zIJfc8Jdo&4)$yvfx{<-bL=|?&;0SdMt@N*7-(;7=t9BtHqkrxO9Boi#i4UvD&CA2a z#s>A8|2g2b0bssjRdu20isGS#%>B4DfXZg5Mq`J@*$>FjyuYNAB6fp_-TFSV`=-^w z=@p;H0+i07w!#J#fHwHtX7va-J3R|Oy!=YY{@KfeP(8!~x@mYnl$9-mz_aeJp8yq5 z8-rrgWyi_o;liWKm7#Qj0-wTYhRpZZY5~rB8Qdu*gAA$TFApQZ{|pNO=#Ak>vGdUm zaK)YF(#^XS8Xl@{Ku;E9H67bgGaz;Yzl^~i!tHQJeBAewgXKikkXCE*{>q{NYKhfy zHJFwKMZg)ukGntCgQK6v_zE|(i{*;7+dl*J*D}||We@l`0c#@y2}(->Y;2pIh5Ab< z9iASi)W_xif@I*13%mQn)}Izj5BLC85WJhw=z++yd!+(?3&>N=PtW;3e$3WsldE=^ z0TPjW+)jt5&6iz+khEzL?w`2N2KQ?*r@gK($~)qLF93R1InWh(Ce$MeXu=BULm}r} zpKA}Z-R@`T0YI}$MOS}6826l<$>!V#piV$RO6pmm&E*k-8!EIB_}{8}@$OwvWo3~P zt~4NSwA=SUVXcbC8ACvnwiTR8T^7hIf*4pP_{pe?19Tfx^}sGQ@G-Di0ft!$<#}sHx zGYbGDJ*(qU2E=FWk>?ob$HIl;*)_BJzlMkH-xVXPe{N__V`D1ZCr`XSXEFf88F&?; zK|wDC#_hSQLDcXZ!lE8KPjtMFM!M%MS|c-)nF_@oMuUL#uqrYdNG@tm4g|MDGr^#8{As3!sP{8lI1X{U}*Xe`V2O1rq zD5sL6jvGAzY%7dq+0yCB@82u4-0LW}7YAV@aK9?wR(k?WAU!P&-X!yU=lG{j4vCqW zOcryxYzdh(>*XKLYRATYj*P%oheW_b4^3yx!>(Vt&=Q1(s=K~67A3Z~p?1=nD!jN1 zYpA2c8fFWWWg$^I)|s8T(s~%y)ujeGR5-W8IZebi?wy74+@x&?Z*11N$lNpJ^J>S( z6(uEW;oGUH$WR92?x^V11-C6WwsU;hW9UL;G$iT-MJv#AKLXKg=x1YO+Ku+}Q-tg- zbV77S`%u!-g5LZr7zyY}eY@LDudXo-pFj^SCr8?`3y|xB7eeZO2Y->B-TCdeU7L0K z+S&x@aTPsZfmTiYOa6dn1CowyT?OU0ag}9d2G-VN9nlnFFWJ)oc*$t_RFn~FgFJ!c z&%(o5K_(#*ATH*!GVJWFP@Hwh@X_hK4E>SGu>ot%XlU6st84)=F~ErLJ>AG07Ir5& zNvmsx3z~268F;VX*hMyBZX>*IEc4mif*nq+)=p6&qPv{{`n~{aL2vPQ?%v4U{ z;;8tz9EDm2%=mNP%48okLsPTC-7@`G`U3(SV8rCZ@i|)4?!_GMlZxMC|MvB3u4!`` zfseh(@QHx=8&?7L_4jT9O%LxN4(_9)GenFEfWq49&LV?D#eI7ESC6YrRtCEj6h^?| z`<*azdNNvHRTZbxxrRrp1SPnUh3*7k8LU^|3}=`}B>_g$zMh_hz>*Sa$8$&vu(GlO zT9AW?4x&eWj>Pnq`zNFN^UbtY!n zwNCqWrn`*!tzj1shxqokP?@W>6j5F8zF!^Xqh7 zUEcd()X#UU+&R6XqWa5~^cf<^W>(E#LUZae?Vhy237NnnB+Sgt9tTwA|4akV$=NZW zx>T|hm=rzrV6w#F0=`05v;=yWQbf?m-7jCc;_kj<@~c9j&n z$o4M&p&;N8C#sC;`M<@-BOC9~(XoHAlg!lnBu-4MLn|cRSn{D12&DU4g-`7GKlbb(4q5y&M~I)sm;NlQ9A zo4{p(5{jI>0_tP83D{QLgyl*t6|z;Lb&c;Bq1_XTn5VGZf4$wZg5c_oKYLPOz63!3O_8 z!0CKq3u^OtbZ0&{r&bJ$td?&9rt#NUW~8`alONdMGVACtCWDnEVH@2$!XY9_Y6nM! zt7DE1!1IW79WIczetx;Fq35a!0D_E6nx&0Lno1O~GnnIHW5d~UCMGJ(o7WQhJ_4(j zSSanCrm!pV)1F0!vwH$^Rt1*U#>4q)tJx-Rkn4Tig#;ZhJ3r5c%-v9_NPRU;HF1uf ziGdiG!}=)0_UJ0H)J?KjmZ-LAqG-YaULC7jQB_cG}-dO6(n&-x@>-Zc}qPhogV0+P{2`FUpqd?2fs^R zL4m+1G-?Hs0U(xXy93Rf4@CXb#~=;6=#!_@IbMeM;84ce8pClDKn?cC5!1DLQ53q7hBSjE^7`8yd1z&l&s;@PX3bd>|Mp}95&34(=gx7C;qR;)At;8O?x0ab>R-UN3Hj;N(bfZ#1 zaR@4@ffQ{`?X7xCE5CY6E^xjcN#l#GJRhOM^#LX0EO%A8{rOkCO`DQlFZe&9FZ_H_ z;doj>y0RYajB#upL_Oqa`C{D97X$yPScMwQ2?ygD)et-$6=Z?6u0Cl_HFuVjjjhxO zn4TB^;&b9A?>x)c2SQN7n_Yj(lmvH0MWKJ$kyp@iXF4%a>es^5)csv4_sUAVz>b%w zhf_XjmJcFQ>Ts+hIghEDQ3kGJu06*CNk};jGH8)BHs;zEH(#&;IAXp{j$BlDcoHzRlyuZ859Poh!YLU0tn&LlQZ`kLywY5b@I- zQc^alDkG2D=kgQt^XWF{+w)H~r|W$N71X?L93C<4FZRgJOfw)7leItHd1|nwNs)W) zHlnW4+0=5xd`?8|<>hIg)JW!77B*uu%aL1HoBk`%tK?AW6mohb&(F_AV*jK3#l3sa z*jWsn&bd5R(9p}U3G9x6+YLNB&CW8LW=M`ae5e(*lShIqU0h50aiU{p_A#(0ORLoy zLh0aa(CN8SF)tQiREfymTN6ttw?FrMxxc7uQ$|R{X;wp4A{Kq+^5r0$Ae|xB46Ct` zF+xLs@7!OTwN4$v0|hn$P7fYE8Z8jsH)iAXyiSy(b-HGeQrmP^hH3n)a_fMZPM#P8 zpQC17>iZ_k_T0dyn=r~9YFD{?&AN3N!FRcE;r%mU0|P!V1`Du|MqRk@1$X4PdgGf~ zTj}$L?!&*nY0)U@=2^^tJURLLNHU~7O3&DcQ-z=Z%ju&xZ>BWe#Lh_`J{03kLA>q$ zN?7pf3o4J;#aIyLhQ z*N*KFZzpS3(a;#@YDddtfoy-nFIwl}qvj^HH&Q!pwUTzbY0lxRz@1H(JpnxGLgdWJ z&^U?q@hU^o6HeQ$TL=&hC@7E~!eKX^xSr~~t8dR$ag;Jdqo8S^!9c=sQVqQFmoAdV za63=0SC)+_Ig506Z)S|XeelrZY5b4)4c@73od)V!e}6^s*a~&dx+p|wcz8lqR$cN( zHxx$$tH{f{0nS1k`oNvZS1&%7^tNMcdg|!*?os32)bNC+X0=56x6Y#Q-r{AZ7Ia5R zcLB*+*GRFryssPZOG4wy0fYIXk{@b8ZYG6#kJjwhsyr^l{p`46$NhMxqf7O554X%M z)<#PLqNT-iBbtus+}+*Lw<;U!`D0m@Lc%vaLZW7DH7i>iqIa$DAGD0d-oD-DMZq~L z6gJX#E+BE!Jo>hRdT}PzMieGOBqw65Vb%J}@{h*$?dAmg)~JCZv!2xsxT>t#)54yo zjTlGhQc@?E4~)VSr_>wpF7oo$ShY%0;?UB*(t21{U=R5sh#t;Yuy_fTk|0;6_rqhSpt!84y8SL6lmmIoQ5Y z>3Fv}HLE3}yti2r6dryFp{7RU?R^pP#3C7;b!Uq2=Hbgq$Fh{-;%~()R%0B(SXd;v zBf()|g7Y2pH+(}6IWKwereXEQ+{QPKU%XZFMsx2@`ym?7K zqK$K`A_hM^_AZ;v%=a8mH_vs>;_{3P%ia%WZZ|yXF+s1Ccy9y+Vcox%So1yo`KF2L zW2)3&V$oK+zmksqj8h!X60_25O*_qUrR2qotp(*KmYL0lSmhN6lr2jwiz4Wii!07O zGYVJLIU-T^V-~0>&KoxyDs64I*9v4ebGV&lb{6{6ohzU7C-{a72n!4EmzadEXRz4x z*DQpk6s;@!+24LZOCCRvQhEC6O53?(8Kz;${st}r7_Ns3eX!!0TRWc13k4@`l$$Lt zZ4c_KV~>Y~1TX2@+#PiO5Z;WVy)~9CAD$v+?{9>KwdDPfHj24@=NZYF!p!WzW=^nl zFx#)u-J>05e3R-Q`&-+U#Hh~(k6)B|}evj;29c_<(@Y@tJYkIQn0IQv%5H#L6E z2d5T~m(L)y;I`eHXfKnMO8fTNdjEB;@6N8%u}V>LvL{EYQ1i!M5o`(kpP&y&X@b!r zb9=6!L-DId4F4Dg#X~Fmou{$7LWPyi=hjCnADP!x96QgGzb0z4=oWWVYM7a!nb&iX zQ(UadoA+yCN|B&kmNfz5Lw()vFRuDFbsSzpw1yT-@O{e|wLdsmI~6Fp@OCuK$XO%} zX%SB~Hi9v&lo$y_UnF2Hk24BbS~4OQmZw{+|Jp+LGb(!eTxBH;Ph8V|z0P-99}uOpbGTO0{gyv?uw2rsDJX zKzDcDS1owAKFUhgc7Ht>$l|<=knF)SY~irOu|GX}fVji;gWDjvxRmT+y-wSc>8UAm z8))4ZgA_4-v*W-`hP(hjqWX(2!F?=yrbKC?3p29)eyzv-UhUlnu}K)m%G z(|kxnBX$cnnjIPd{D>O^qP!vb&1}p;ZuW(2CR>mBjfMag_I8M2UL`ra7l~Gd$}vY! zkM&g^b@APv&n9Lye?~Ur@7)rc@+u)jT29WiKQusiJ}Opr6j8aqKIXr`WfX0U_rj#v zN}EH#`&CPi4r{NX&OT9j(~j2Z1ve3ql!aZ1t1gNGlQ*s$?5_3r?M@b?hc$Iel#`J>vUSGqqE)I{M7Ri1qBVoz9Oy6B{!9; zSIg!0sg-mk(@kWv?zOkH9G{i@o2Q>{%Cn#+kJk9+6eXv^X@sOTQ zQAF?hWX=TyWTR?o*5Hz9=~Py$X)07c55Rx^y&W;=zMPVU5 zp_x@wMArbrox#}Af%qBW_ymfPXU3}aBQH7%^1qK(E{BDEyMqV{3Gp|c$8#7jv3ZcE z*)+S2$J@cL;>3G#)tY#)h2v$*rK*L1>EK`~um(q%%MlTK%Vo)p;_LR&tkxsPUBNy! zSFT*SaG#ku(l+E%{>u5K6Bc~}1O#9spI6jrURdGqD_j)JKgyj&o#6SQI<;^L6Q3;@$ zn6`;B?0LflltC4C*sVV<_Dd!QA}VXX)?BD9o1L3|vb>AAL-f>AWZ^JUekiggYE;ovJ@z41D0>;3AAxwm5=~X7shm_Z7=q%!~T0uyTyq|%7QoccK6q9yk8+9 zHb1M?F^iRVlA|h)%ly4JbDq8q7|2GrOm+pl@bV)sQ92QieRn)3eYS7X@>t*Px|iQG zdR#mcQ!{@BS}zp@VtCPlrBf&P{B&4Id_Qa`GR%1IV!K7#-f8!u&8=(R zaIw(fkX&vLN@{A<%6lhsR!Tp;_5pZ2YQIOsq+L^0T`<0?`yB((yV zcUbDcJB(V%4y{>FPdin(d)kq?+!@31ZhtNqRXX2CY#%ED;F!)2XM~P6xDH$^tK;Gy z@Z&3&-#g)0GE=Wn)Vf_Tnea)ZohJOoVbqr3Sr{s!yOXHISYu{TKF^6=h-&BQqo-A! z%hQc@X)Uj4RYFyht&%u*f?vZtU!YA~Wut zcU*LIeu?WEr=<^=nK2PiNs+rGys$H+@KmEs5-?jqK~ATI(7lX{jSZ#j>(_rg(eG_) zXgC1C^F{(}e5nXRz(5DoE(aM&7ax`6bO7slzTP41U3N<38+3Ms(O2g)wIb6;f-5Bc7| z#~KNbNPw~t-xi~kEm$ZZp6Le8@0C2#T_fLNl5lA^qp<{@`aef@pG5YV)l65 z6(tT0?piFwXF?7_90JqzNt!fNt48gH0Y?IT1w>V2W6JozeI^>MUegEVT&LR=vsabb z1n80*>-cT$N&@A$pvuBT^=#D9l!5$Nnlbkf^9_VbMWdi)Y(>ob-5`93f-#B5Z(O_a zj^I@HOucNw|2Tt{tY}3^_;!4jN=0gZ1|tQtuy7t$EFPdiF$jl+3sG*o{ZSy7?_m9M zM(frc);3cqdD|h6o9AJJl<+3$f9BFs6&33z4ltF!vXiX7wVf2y#v-s zct+uM6ef?k&Qt!j%WJ$Uwx)XDKsp8m0TH~UMl6?Y*y63^-u@kUh-cTUl&_!F=#A73NC&apl61GpQubupu&S9dtLgM72m?c2qBdwJKcoy9V!wyRIahC!PoCB=T? z9MVffcTP+b%yq+RIkaAu^uKP~`e`6i-n!i6!W*wbXZ znn>z(Z)+>teJwkXhC4f>Kqyx`!niE)Czg;M-QO2vXhWx-gWuC>McDb=I(4jI?ulTx z)5@~O*XOC(L88~qw-j%|I$qH3mRKDA-F)-bkT}SnNJ){}&pSJdfDb2G%2gE{X(Tl? z`yPi_^WGI+fb4P{!e$!%xn%z+JX2QE&&ZtLVK|@PlM2e?)!Ew!-&n=d6MMYA<%o~h zVu#LD{gQ#6XRCVyv9wHd=l+qmE*tuBcmx`PKC?sh`>5fcH8dmxW!q<{HSZ7VCQTtq z8QU$3+pZ564%WM17B!S?bzgTX)$n(IZBAXcS1h9#+613XpSgk-o_)hT>DRBs>lO3! z7tv=V)0?~|4UuSx99+xVpq+6U6^eM=+8e%Wk)u-JUM|J7FX`0W!GjTW_a{W*db3Kz z8^7S&#_n1W;|krPb{!%6+j{hqgMukk&}b!k?fMzWk>ha<2bcOxqZx258v#}p>{a_c zx5AF5x89}e>{DA=MMXitFN<8MCvn?!(-2p61wF+(I#0x}oq^S)60=*6R#aiy**?I8+@4@$DhalQN}p zllhq$M}kx5vvj2FYTo7L8rR+2hiz{2V=vPEt6fPFVq>!t6JKd+ZlCNM+a1>H*82M^ z{Ee^*N=ifh{rR`Qu(A*m-EZ+31dcA}Dmfe5fT!mnOqCXu#?wE12tI$V7iY(ncAH4g z0StgN`}jxZx4NSnj(-Gza1vQqxRWN60n-++vB9kIz0HJ%vhojyT}2TQ6tEx$IjOxp zYyR4z>o@nnM}atI+je6-%H-(ySVcLq?KexIWw6gT{e|u82$;wMvpe7j!90vLNb%Ox zq#dlOU?5fp&!xoH5pRYcy9|1Zi(6u0HM^bBGSbrOxKVuW^$Q44@1>J zJdq>9p#f2o&$XGArS_TAMP$^|K(-jNazPV=m|)RoWg7A5{U;~~ti+gW+%FSl^+&i6 zR{~u#xCe;tDyI6Qg?htMylsb1Y_YSssHaLgG)a1NXCf^kobZw*k68MG4?=|$W&6D2KahzL! zkF955%;tNrJX`HuCM4V_nop2rlT|vRGKNXS^5xlh!SVAvB%^W%E+qV}AOt@ke;SHr z@OX1M>H=N*G7RaA*%^@Cqxu%g*AJ+$%=%0h_BJ`*4V*N}B$H{>IyBnHav6U*G;c6U zH@4Vn2MX=$knzBcKl6V&I@)g6Vns_zP~iJhji6N$3MHKekR24ov&6-+v~_Av&KM>t zF>P3k>GQw+@HJ(x=bqWz?frv0RC*AD2hDA6x*K!k4J&s-Ru6yd_vT1pM_9MtLwx%p zD?_|ZQyaX{rSiM03ls4=q?a|VW0%*Co`X5fNok^Ds4DSiXK4)CJ)-@mCs>U0lvZv> z`?7^Sp0^YrPArktHNGJ597XbfdELGA_SPvll)#I+riKqi59>cbWTM-L@bKT|R;Q0$ z$gW_?QTj)2$PWySGVc>%UU!F3SzbQHm7VBhCxrl#N45R-&C?KP=c*JcO2@(21F5b- zS6L8QM`zO0Ym$0McW3U&emGQC*=*~64d~b0qoXOBlaH^nvAuL&Snf+S`C_v|B^6$M zxP!{Xbn!Els=Pz9R$6ybU!x*D*dN@X3c0WlNlBWZs&(yoAgL;#Sg|~IzxP*ZOicWu zkU6V@?d^Z4v~k$}FL>stu-YB(L@}xXk43-z(|uXBFaDn?KJQbjNynIQp(8qv<1%wE z!usfV!yu3S)xb}am7&xyAW=L=1z3QkiB-ku)SJf$>(#`{HwC-BxJ-~3B7!1fiY#*O z(QUD@dI%kgwY8Xy)|d}nB%h<-^p(x1J{@FrOO2E+D`KHb?GsM#uL~l=#tuQeZ|MjV zI+Q9b=CxkiqevS-Ja){snCM%@JzulXGz%#9%l`Sm_Bd;`&`#NTxXnjf&;M&?+%L!FATJ*|_<7@QK4=kGW zbuT}^MM)6hB_AWu;tO5k!=krIIK6Ft8Kg~lKjFawCxdpA50l!{n12_v^rzbR@>NJ> z*U;iout%jbQAhjHj8$(v=v5fAkS&b_6@+gh$Y->f+~#f%$w zTS^(jV#fYZcPHN3Qq!)x-swvi3F40Nq>GO%E4aZiXjA~B%(^#)4!RE@F+}ysC^Hki z2`%_E>U;Xz z%F=KbF*7^Gpt+`NWb|jQ_!%!RoC_U=h`^ux^HDgHhMA6zzL8OZeL){IC^R*%W?4+Q zUpgWq09>6YHbk@H$HzxT&_9YfCGiDDSZJRP0*3l(+%9W8>ihK-hZAq1p|K2YXK>sv zOuaf@0_Qg7lsS@9LpErWYzZAP7|x1#lmGK^<}F-AC(1FK^_Q}|#r+s1q`KXpJZQi5 zjZWk{q8Pt7S<70a@|~WHBW+*eLoDTFi3qgJX!4n-XXa_Kws>V{6Q90Jc;@t6r&W=8 zN;K(I^y7%0?_dykS5m69jVX6hk=r63(9*us*SU=-mLcOJ_!gacleHo*KmS{P{+k(3 zF+`B0#LS$rPh`W~u4~@aKTFHtOdRGKdTBU31m9AMu zr#-w>6Bi?is!4 zxtpZE1|YVG=gg^7RaX9M!JF9+9*+3%KOG`jYq<2@(x}=qUcOOi$}*YsDvT1M(WPJQ zvK`UEfLS|+RcHihJ%f35Qz53X8vI1+iwQ|nGMLd zAg%#MRoDnn;K-1d4ox8-!UXftn+Oh$DInln9K8|{0MwfzCnpYa#Hfb~^7nn40Wo9Z zICO%Zf{qUA>F<(adBpT+i3rtnKFBlI&yJTEV~XKWe3k~l@Chr?ZN%Xw|J0A|_n;;x zB_*Yza=bp)<>!y@d~p_5521_&myeQ?hk5}$YS-@cpvZLW{%W+_d34*wUROdb422YI z7;Q^JUkbQa563)E4qeVTH=t}^z%186+`Vt#(Qj>`J2yK%z6phXbD-9(TW?Zs5Ijw{ zlR#G#%V2E{#3wp6TURY()+&Uz!qOhupCerIm(>1#e-UMmoV z2Ol+11G2G=XVVdK!@^2z4x9yYhK^$AAODo>cF}j!vsN&*UIHn{xs$4}FtT^@^j7p$ zd#Xc8SyV>sxOZlN&*dbuaaAamXK@i3G0HtrvENN%uJd9hBPoGbA5ZkWA@Y7s${D1W z*%&16ud<~fo6xYvVXi&`tGI|<<)PSIRn;y|%kj;H^WhGjgS@f1lNqT|Au9=l{rgSD z!68Y6XyTK}&p9f!E`LJ8iWZrwoX>majRWl+9E=qd0JgFI*`CsH1F?lxm6ZE4GM41t zxhGZhF6SR}Js#uPL0;y2HImWX{`I7qsN5)s!9IPfkm@Ky2yzgyQb*gBi(F5Oh65|A zPeM4$hVpc{@)~r$bo?$+7 z&G3M#xCauze~8sc7s^W2PM&Iit-V}w7Bx! zRt^wyoGOr8G+A3~4b?Mxf{Vad8wn4MYaHExvwmcnDuuYdG`y^aIos0dWJihgTwHwA zY~h*kLtMntpvDmVwK8hgB&{n^mKNrw?u zryw|E0NkIbN)RJ1H5t)0Hm)BR#1;$2EYU%fR1(I;03wh9egHh zsxj#5f)KvGerg00av(9+H3TW|$v&D}PZILYo3(l$+S=YS2+qzGTX#e&SX$P8j0X3H zJ9loHj1+zj3=Hgu1VbwrP*3_M%j1-g|k*~@$_&-M2AM({Cj&h&# z=Q8tOstM}(e7!_zL1#ZQ zzMGmnF{|W_k{M}JdNMbq+SUJS-p~EAe-B5+u!+NIZ$@i10Qd4u3f97(jC1NB!^C>j zLTz5F855DLA@do+fn7%wD9S^Gf+3l1J#<}8kQ18`%4)Us&mp_2c{!fWoML&7V*9^@ zS%%Eh@7l%yxdWS8PTr&d+2ViMTfp-9>DO{Aj?ob*^-`0YD2-SD)6W3Ie-TU*OmuYq zUmQCs+?IO{q2eW0{MFW0>2li3WyK!;^=n1tX?f*kskoi;Fp05olX@|^;GVADcT39} zjVgPOs10W71&Wvv6L$7{kZ&>2(UI`G@^MA%zk4%XvfL+y^rkh$aC=)UfzPGf^}J_) zHBh+?SgAF(>(4M&mmf$GWbFW67)VpdUJjvSc2LfZRT9OlT-CDzX*g^JQ5Nz z9P7IXJjTM${w@)*v98BE6Tks4j9*=L_*3^`;OeFN{D70wBzK@VQF{uc6ae_Lw5M$S zE$$D!@`H7Qf`UyGQ>EZ!;4Sv_yjuKUB_1`H#}D|h<8G=F+Tih@`ZVBt<*FN+oATBm zX9*M2)3#u49o}@$7=#32dRm)8-snjjsr97!^qZF$+?}BV`J-j4Wrw1GD{hW1CVorr zkDc7v-d0g%-6;bM-?gocjnLeYjo}u8r6#4#2Gj!I^pm-A4Y&UimzVStNVMJ@$ud(o zwKFfrBSl4+iB#Prz%bZQk{fa+-A{>>uC>}7jkKUfbgRVoHH1I}F>sMVa&Ocn!uWDY zL4ENEtIW?N?c7_&pClCp0qCpa{-CkELhSHr#chPV{J@ae@Xxcz2lUjb=_w&m+l#j* ze+s?~@&^sg@mLe&hkCdQ`^EiVWuCsIsz0^crV_Pmc=z(Lm%IDb87^6Ab}g-d^98N; zGv|QoSLkg!%~z^9m1;90vDJv9iyV_Qa4Mf@cW4j%z-x0V+Sal#zo6?ZW-z5dPEP)M zXS=?#m5l$Lkqwf&<0gvd=*`wTc7Ps{(H7hQ(FU>BmoHN{hUk(-0ttB?aaKv0n3zyM z1^)y!u+gTbipdkF{oeg8&XjERE_2m;_ht*;HtQM~pxwSLCiaBFKrvVSiPM4P;F(iW zQWA{1($dm0(9+(;{r<(*mvwdn3gZ04dN1_vealldEx;r_WDd5Nw~3fq|a! zd|$6|V+OpG9mUh@0vJdH}#Lv>^0NAPE%9_jiCt8duXudvl_-`eu^xdrwG z@oRH`=yKFr`8~!3Ah|-Y!L|hNWdH*nJbZ|Ou#-+HvD>^@OXm)gd=L*6uyC)M;X7Z}9QwQS#_6zm@q4Z=wzBfZ|(aT6q zQHQ}c=z=TErIJ94fH`A^A#bPsWVvx~k9o~#dJ+GP7Jn8Rxxpf{c2#_4W_p`w8?~!F zAdMVfkAkaJrC94pl6B(y)ihOC${sN=DLPfH?Jwt$*)O0XvXv|Anm6sovm$*XI;G;C zq9ZJKEn8@p8uz?ZBfbWOfJ9u6)S;=s*{7hQtO#?8O;ZZe4#MrX4WXvZ`40{(dI_H_B3n6pfkR`qs`%HZlgu}ZJuVO(6!5#fpwTX z0PI~PKlT75FeEf|jM_yDvNZ7Vy}a;OyM6sX8RXrQRbYmIW2>5?A~1}04>r)Qa><0} ziL$9O3AE(fV>r3xR%yV5$W-v#Cto#rEFd8<-}_x~wuzu{0}?@7>tdEC$0gY%-@euT zsb^}R({DK3{AA+D>9|+NX1oxx9vf>eAn*}_A}K!~kM=KF#1ETQIxZ?ECKw)!A1PuK z#l?P7eN>6W1gaX1jr@_HkB0X|p1WWE`gGmP%S8p#(1^aWJV)h6zQu0L zrKqOn0sIH0$VIq<`>|KhKDYV!kGcVysE-0P3#7Mi_h{GeO-u~2(5$9s(i8Jl1FFdorM%*}Zia2{S*Q?#6a{fdGJqrp^FF}!zDpSPtJpTB1x0->2JCnaKo95ki27wt_cD?pfZ04MzrVCvYR7Y1fc291zWIf~ zOQwkB!Fwe7YQbmb#1&4b+^wI6+wZbK??{ZLItBA~M@E_^{}74aNJyIq_p>n@NeDj@+%dzLlI z*f8yTd+V)-Kw^3p$B!xuGO~n_5Ny_pKp040885eG2>tOR5_(KvMme!*g>V=D4jrfW zq!Z0+F+YANFLst(Z-hqd@3u!5oW&LNj~+>g|GwgPe?sP>y%>T9bcjIWty^0l@<2#{ z&gWpc8pp%ui#HOoR8uP;X(F%l`WixBL5XB9jE{slTfs7Q&FX?@Z|N( zOjS|!xKukHxHzBgXBiZ$DJ76t@%K@LU3U)(dYn-;X&e@=obS?ifoJ%xPgTjXCw7SG z=;E9RaqHqTN_A~%Tz0i-wjHUi$&wnFf!`(L%$)g#-2%r-rFayfvuaybKxs?^%4zwv z+T)?Rf!8Nfmaltjq>XSKGIyRh-i#(3ZLd6;`EG@H!(~WlyrFmnbnzpz9wlPXb8(Gy zcL#ZV?AV71?wJ`K7Z(?d-xTlze|rUPPh4I3XwsGm3B^l(-MRY5e(@jW<%=Cf02qn8 zx@x<+1_uRw^Ygob*_FrN0p32}HdI_rtX;N~Y)3f^4L_6c#KJKD*}kzEgdSivW$!-* zpv=>g_~eAGENLb!B}G|~Zb2EyMp04zE$!{Ncz9ofgQ)e{ zd&z^0;E0zH6f_Bh>W2?&Qy=VZZ*y@<+Psg9jyXMV4t&kUwOql!kavC_ zmzo-FXV+J=TAZq!7J3#94e8L6>Fi=YyQqdH1w9>I6L)Ax=&Sdxf0=x#1%-rpxw*PJ zEU_Mi{*T{!am8JDL=obbJlPBtL42$I`36_vrDTi!TVFJ!8pK_P^Dm7!Lb6EV!jQlnlv-AK}RzY7QB4g)V_(sP35xIFo$$C%!#%kGR8>b z(5UTs@ukK`iTH7`LtJ@(Xd@)HklhgZ@$8jR^*0dEZH*$(dd=Sxt);+7N9Xs&Ju@UPw1zCPi&wDW$qAJv0cm-FoC6$j#n)hc26C$JM{Mn(==5^;6CfD788 zf~HDW@`_9gC3!2;+6$jqQB0`*ARr88gE}|qhEu0K+1RFQue0U(NY`B>)BUD43!j)6 zc%nV8-jgJJd*Ehh$R#$@{D%(oV{uSFd3%e9i&t%6i(ckWR@>-zuy8yzId0E2t!H)* zzQ#?>P7f`_!5$|}bC*t0rPs35nC27Ju4{8I5bssWOSGntZ0N6J?@krRTMsP1U}-?jQCx+QoTiWO z7b9k8+jBh1w0Yr6A8CKF(suF*QkNOc#uVohS_Ufh&4@BaVRiMH>B)Om_@lkP%Q3du z2k&?Bu<%|5DYdtpg+zx_P}4Upj0^87ZEbJosn#BKp0@xZ)+$~9q8@XTXTN#=4s<-$ zP1b1cM|D`no@{MT02j`!*CAv%wG!QRj}d@0S1K|GJD|C($#gXu7F+g^64;;-Ct@ zeyuJjSe}^vtkc5E>Jj~KIyxJDIm}N2!4VNq_)b$*1WwO_9frc2n{rqzEFoXM>`Ph& zhlh7}%jVjtDkrZP+CdK#6*UeAcV3y9I*dL$H@82Wb;*rNze9$yV8k1Q})p1>BX6th)rqM;jCAK;B-6PvCb8NpY*H zs*OkPG^e_K`w2QaSQLJC6xnNj^>pPgrsEGUnm2}q{WAj?g#BYJ@80_=`Ep_r-3$8~ zi9o=`i(qU}^E1!hFSqVYcndG@n@1Dn$FS#YqGU=*pZvas=sW>wv^i}nN657FdGws0 z#4!ncKS9=X2>og^-!$taGh>W9ySO+tyKua8>?G%#fp{(<%qJ?8ytoR`(BHT{9t=j`pE@9^M!~I^z!()tMX|%Apf@-96*Df8kCjFfKrz@?qG5 zk^@fXx|s~fXJ9Aph4k6QcPz9km>F(4Qsjh*JEH+(<1 zD&qMGKZ#W`*O6)|dQ)KaTJ=RW|17w=@p~JlR?qUNZtN%!iHau9634t1QKcTbD`5IL zCMN5);l{;H9CGr`(4zsk`F+cNH;OJZmTK^sKUP(hURL+GAR`}Ne3(RZmz7=A#F1w6 z18F>%gEPU^lL`p_YDzs-w{ zr==+gw}{^$rHGWCfnL2#Pk1{}2eCBbfyI6Q?9u|upzE}M<)-)1(GilnrsUQ1?MV8SGd`-|&d*Pb8kcSCJp zBHiBF;ktE%fuL=96hLV9w5{{!ru^2xx5^cxHEI(jI208_Okrvh*(xGgRtq)1}7pa@6V&nQHZkd(L_$fR~+dXaKzCe`@UY^D{w2as!Xc z?k;5XMg+hj2QzOyJ*m&gI?Oa_pBsVAg?7wk?H=5@@v~Y@i!Uuy zm#zAAC6w2Oa{i*lhU_i(k$9Q|7!A15PkyT`%L~kR zDF6%qxBx;SLv-|X91ea$aHgGRAw+lg+AqSNua$$Q=D4E>Fv1k>-~Pl$U2QJFn^ql& zbk!h1;dR#4T~#6R(48(n-_k21tw7{kWwrGpvx-I6tXGbAP^%!h=ll3neWXC7d{6cH z@_FF2zN2HpbA#>cTL|fn9VhFD2{q(hM_f~KQt8Br3lL*^0D21!HvCmS$KS|LFiZ2G z4w#Mmvm(o65_mY>kLXhiT*v#SvWQ=Ri4|6N78VlTitf=@ePZ$06>YEQt$4Ua~JFRak2-L)dOi*aM3jdfISg4KbOH*L)G`@F(D^c{L;}k&HGnTw%37 zl-)i<)=0$`Tbhb-l|4Rlc8)j;zg0hgp<^JRALJMjE^BXsCPqz#WAB7st#7R6~; z*nMNQAl<-MPh_0C;^;44#m0s1KRLcmb3Hgb*CjPsJ$onReK|}iY?>M9f zTwLdS%iS?egQz-6+cFGNNC6Vy;0@-H~KSW{cP&-t0m)^9egt?2pchoz_aRq>3L$t<0m z%|(ps-66m%OP|G z>3C&S{K0L+-X1!2v>JEb$li)eQx&pw`?Z@MUf1e?%o1U-hQ0G%`uTGNLNqyBc@rhh zjF%xNHB{{hGjo~nsIZR}WY1QMomN&nkM(}fQO90fB5I8=eqXo%mI+%)vG9yA1D~J2 zHu649@qf!X`J{S>^*E;IeyFN96cjX3s=;?l@GW{Y4FZHG10Hx2M|9o?#=~l0S_BV* zlTlp?HG3pqKBrP%#w84j9*#_YA`Nx1?r67fc0)C&Gdo{92?fG!?_q~xs~?)3%`PuG z|9Xkeam^jbQ{Nvg5(I3py%!4PLNg696iY!I@6MN^JBh8$?3IT;#4T5_Zb<8jyMvI& zT5%mp_V+(xA$*(kAnz7}M#c$%?r-VBB>E{zF#f^&32RZG+vaOXX}XcpXO&&IhxcrG zW=7lV-th6&%zB?^P{<>cYX?-s)a2FUlSZX10f#rgHzTIggqM<=D)#Z@b>C|skR>N& zFF3SBs2jzoq!wnLVWX-~oYIl-IBYrRyPd^E%rQJf)R9KtZ7dJzN_Udo@&4qH1bfjXC~X_uVRq z`1XwmxR{l8JVjdRSClf~_zr>@yRB^Z3%kP-aBm}Em#kG{j*x_N7|K-+&hH}gCcJfIAr|tXXHWqeME+*T-?*5zZE|u(V zlHw++-UDpKEltN(X=43@F-H+{k_4NTk--{G$>@VQnj!HA8KA|A|6M-8T3p< zK5?RCnokEkz%kR|=6yQzlYPje=^o8zSz+@jzXuUMZ@m1Z%UH@C;(~){SZCW7 zY#xPkcE0;@eskG+9SPBu93Q*SyPtd|Y4GTH76tKsVnv75VZ3d45%P?LKDo{D8Vm%5 ze5TK>lG`~C`iWtN01kC^sk7vpm|graU@`)w0T4iZeOG0Wo77ic$p(@29iICGh#@H{ zjzCDDsbOgcS0Ia~@<1;StLku?on67=)epq;GJ}L~MMI)%#GfN#^cJ@svjmjfLAn)lWuDcNjdwR|x*KPst$k6Dlv_dW~-le{C zirccz_w4w!h7{|G>#w;>6uV$uGZ-*R-k^Cb2+odK12Q|Z&z}dCiztg8C0&-NGJ^h2 zdWMmw_c%>~+a6$2k!DXvImr*&e)2Yph5sUZ$Upq_r&u3v#d3{(tgfMUn`*WQ#{``8 zNj(}-ra!tFli5OTb~tA)RsFcj8)MZI8lpA=Op3SYdniTWPrAw099qhpI5c*;U7J2G zvs>ZJ;bu_uYx15-vlme-MQTcx*%e>eyzH$Xs{PWL=_kF+`;Z^c;xeRYw@@EH;dC5_ zs$VTuqi@CSU$&g!1RpB7u=g;%+xZ&V1GMG+m z@oN!>5+Z4`qvdj>RN)Sv1r;OP!wq5Jw;&;6`S45M=dM@t1jDp!r^MnwPCgJd5(j?3 z<3A+h*3*7=2cgJl^#jMX_BNU>(H+9k9B(sV6Hf53+Y^rp3iL;cRLc;T7Dh$I?Xz9j zsGqHJCWMk^FXoOdjmnnr91z!BHCTuS8TPrHme0!jisw>B`WTekB2^{V`ywU;#-M+k z68YnY(A#EY#Nmd}WaYiq3K36n-uJ`4RBPAV_hW3!vsGgwV&0l_WV~WK>|Re!%#f0h zc0AkK7}j>&deaQv^e5cz1QDcSe$1exgs7gFeoc4 zgU`XwuCC^aS^$pn^CQJ^7iMQoYbO)+d)7zN9)xNzEs=YOJVsj^E=~yLZuTR-e8P8X ztf+7CL_=*h|*c*B3b+ zHx0CL;Pv?OQ9bne@+Bk7XlG}zMgm9+RlL__NO%t+wS!i2ND`_ssygB>enk4=Ot!UZ zZLgtAPTWN0fuBR<5&VdXLsYgk%|azc{fGL=XEIp>4QtE0@IrR!=+tdW%TX=W9wL+0PaR#`AlC4upo%AafEhup$PU3XywxuDCI7Z0*zD+_8}O$|UfC zq-gOAHBhNp>iv!u_61Gqzq{uINI4n*X8_cLj1lC#Y}gQap?O4+y)>^?!Y) zkuD4!Nvem`h&n0>HSJ*7Et5IC6t-aVzmsdjbMNi+OZvdTn_2#rZqTLu>1YGWy;O11dq0y5t9Q{JrtS%8e z`M8$b3<$|6qr+y4f$wSN`MSrdgS_`T7!ztlb zUox}pMzf+oqi%`FUax_ca_|JeKj2WPRQwY5)U)h?FN>>SgGeWet^3_SZVB8wT^`n1 z-&vHe5<%xU@0YC@` z97l}gGHxC}y?I^4;_LXS@pW!KhcYO>y6WtsipW=}1ATpsf6j!Z7*a2?#iVvbw(0xb zD#0cve?dpLz0eQqSwlf#!jgAI8JH`_NA^IeMLxo17fd>Z^zexVS*DT!mjh!5Q#Lb- zRF;sMT-vK1mu#VoB!IUyiYp2okbsu@`jw)b+`x3k?m=n+EzXz1kj&Cl=^QrX6;lDQ zN)xG66I^9}ip0TDmieWkB3geJrS}F9Ibg;Ub?1wXh`bQql|5c!%I zANRr_8O=lodE7fh?BLI4G*YOSGkW*LoSs&+!luo(+-7 zSiR<%nu3i`o+hUR_P;gXkEdCCASL1S&S+&~lH>)W*UQtjr5~RH134bNNr+T#V=jUNhITLjT-1gTEP*Fnwyq-7Apo57dm=2?QK*h8As5)KtwYcibQn`BzCHT0IOTmf> z=2jDg33SRym=>fa3R?YRsIGFFnipKW3PPUrLn`s*tgFWQ4h{sLv9q&)1gj+z23RoQWi&Ec zZ+PWZRZr%vqVw}b4UR`|I}m0;amc$4L1dYVrptK-m|`IR04xDqY`kTLyl$o^w{2WR zPubtj>LEmLlXNx?6zDfn(M;JN_m2Jg73eLJUwzv9B`Im#_e+f*N!zR3{DrLC+}1YZ zjs3Ijc&b5(hJD9?@ZVyfC2}INlx3o{4 zzP2h%V;6V5IIP|n%bThKc=s9tqX>Up+AP53-u2z0FN^Wr>u=8@=9S#`-hqTg z^KN2^%t*he_J;8{QTuJ{9((Baccs2rV{h5 z7ba}1%u%vbT#MJK0COFJzyDA7yQfGa2F+-x zsl8%i)MRAxN{Ie<_ePbCj9^}2;Nm>%#*L$^C;y+@3fOq|Cp6QwHR>x%-Iw!_K0qVN z%sXLW<+qp2SbR0}%|eHb1MsC@rtrPS0L_>hO2T8wlfp3264TY^jc z2AiFf(!PU2nY__tpD$|n@5=u{P3iT!kAmn@_I>a;) z6BT{`>YH=CfjOi1@1Cj>rEF3nxq`IuJsh05Zw&wa(t8}s6KXWi#^vAxs(G&FBL98o zJn&dh`0{_(37q_&9TydvwY3Cj(e8&fPM`-P{AETQ0`Qx>UADkuoDJZD6R2+E*-{Et1_8z%>MC1cd|-Riv#6eg;ieu8%HNmUT!N>^p z^1XXP?Pb{2Oqi^kob~%iLL8jq6$Kq9JJf$4($8=o(mp&w|C4&#tLK_Xx()2KsUS2El(95BrSJd^4!3${8Umzt*3*ye}YN=6V*%ZvC!y(D)jh zU?pF(%041=xB7S=C?Fums~~@7@>$x30YnG*tXuf0=BOPwok~B!{09vGii`gqtu+3( zG!j$mAqEsc3;<0hfOHj2zk@N|lP3jQ{AcXM|G5F({CW*O7jK&}jQ+L6{{8B?94gv! zmg4&E-m@w8atp|JMEqI6&Dz+b^eP-#>kdIHejOyugO347wZ!||Gu$o-*&Mb%H0zwOUptpub0MU*d!$A2oNRz ze}U4QK%EBZ^}@0Q1`3M)NtgdM@Veckr30Qju`xax!;3OPMe}{DGfB#s?>L-a8ma%r zjPLijvpmt$t25a=eL89Y?UgWdSA~=i5XB)O*$-b*6(MJm=CyvOF_c@2E-oe2(`tAE z!jm8!{P>N#+3Eg&NbLRAkv}nQ7@iX5pkF(K`~S18Z44-CgJ%D358OK=Q^1%Z3u4yv zW1#(3W~cSPIO2Ih2g6c`Z`tEq&&G?;lTK05wpU5uk}eGaWvTaGH8#q8T1)@%duLVE zvy6-=#-6-@?^?ARAd_8UJ34%yi10w8c9P^$_22#K)9P#(z&g;y>8nVfd2edwokq`FC&lB+o6MTeNSO(}fD& za2!MrKPh-4rqh2k;*1&Y|k@lNt5#=?s^anoHK^iNrZhj+o8)_=ApE!{vJcA*( z^2K)dU>1V_tg&)XGW&ZtKNLy|0V#f|m{LE7jKoB0Zy%7!9j-dg&%Sbz>{s2`kbb1t z9yDmCsF>Q?n$bJzZ-dX|31$Ewyu71qOB<UaoFhw-c)@BHs$j<5b_|XjLRiFbct|y51$*T$AduG+A z^XF}Z9JZvq6`K_{C}51JR$|1ExAyn*pQFl7qm=kOf6zTNw76~0;*X7s3+>*~Zy(NF zQ8E8r!UHtWQj?RF-8v*|xBZXB1p=Yv0j3qx(>||~9q+x`oaD0%s4-D_uKmZD3k5tQ z(s>IDEtRr|;j<`muJIEQ75#>p=>7T5 z*fCjK76wcFwVp*hK;B#%M1SB0D(;}lJNOFhfO&a&xrhV)KK!doYq=7sJ=oyQNu?f3 zoBMaMAc9B9ZuV^N{7??G;9??_XcxPWkIgBJj56D}o`RvldT`{CpAX!Hl#;}f5(2D; zG-=|-g0?P_He^^9oUzDguC_Kdk(?H;Mk^8{FuHJc^nSR;pDv7zjSXI9x`Y%oG>gl9 zY2aSO;{TuZ@xU0yG|al|;vJIy83MpBRch9{LLw3uAAfP?U<4W~z#g^B0Y55WY3UUF zXtMhx06H}vMCD)GT=8rgeer{XUzM4QG&DBOFD|xC-+{DJXS$AwMmqbnrE>8*M8hoO zp>2@l{AvJpT<)qZot-*^**&15*EVP`MkRceHuJ9VL8>d<;EwSit-d9-WsgcE5WS zcE6WsFJwgsB+9B*Rx^@sw=!F$ow3-7o0&-u94{Jnr5r8e5FG}6eyzM$vzVy6sQaWX zB;?+AT*tOfo7(m`%e^^rLsRfBk~Ov%kw#4W!_E8n@tT^NTGUH$d3*4`1^-;*u$k;4 z#Jlp}1_eh@Wh<<9=5@CKs059L{ zq@=m|fuOJ@cupnWA3m6Y8`<|CiG_tB85!D^mLyD|wnDkGHnIvjR0)m`0@EriW@G=< zyG1?LzSx-XwST5CLUl{asLA}oJ8&b5J2@k9BvtQJ+e5@{sHW)SwNoi|Z0rR45(|nX zG#bGeHp5n1?wz~1_i7Bs2(P=;N69TZADg+6jPcv{%1WVki1cKrMyvLU=2sNscX61i z2?`~PNcQ*i=ux}H^XYeeFr6ydbk@D($`BHBh;9%%HaxSI^0(u|e#p!mp)z>P!>>l< zl;O!|v68pdlKKY zD|z|$J4epteA1-<{s}QX3(HRg^weXIL5)W(i#_{Iv?xfRgGAl2M@&juT376`amflF z#qYLIfqS)vec}6?{QFzl%i~)oBOvROCQU-VSo#4zZR!>g(eB)wd}+~(;bP7g(%6F1Iko z%KOFaHeRxj4Ms5c%@c4ioN;4KRFi3-ISIg*tgHOyLDrAALw9BRy|cGB_n!0r_9f-D zpSwNDi`kmIZ5`;CdH;#3?xUZYXBo9>gkA-o?##E%&3y$QUmnK)Di1_snyk*cQK zNx~9CIj7JqpXVha<=(@WBjyBY7_BL3&=oZ_Gz8j@t(DdJ8rAL&YLrn0wG?5g*?Lcr zfp^!WI6WR?^e?lk&`{DaUcSm>{cbSTKMm)wQNh~bzg&RgQg;8(4pfck^DrOd4yJQm ze2|;IYYsrZN8NsScscb2m-Xq>{*-7EQU6r0h3|E0&~S!sRYYFgl+znE?N@)Ic4-F9 zRS33r&DRzd`f_(03P4X)yH?X5t zz+1%>l&Z5CVxDfVOw~>e=ETItt=@Yj+g$?F=?ZGG;o+q&rvZoNAiyOo1WrLvXaCtP z!NI|Sy9=g+Un7QSE+=bKQmj`8DJLiE%S?HGweM|CMNO>KL`Ev(B|{+Srx!?Ef(^*5 zsVi=$Mnq(lm`_DH8)jV=M#FdMJ9?(77PCH432td_!}%%%1S-94XenX}VMW_d!N+A8e2n^@EL}ywCgv)@6(k-0M3-x6iU-7q-$4W4~Yr|tf% zY{^7f`|aORr+xru0qr0vp>m|;`wAsOG>q>ty%kG8FvTT-qK)BINjZ4VNH&Y zOAdYOapB^fnUx{IK3-wvB5kHv*HtuoZ#Do}+>4rDqcViA8w`DL@isJG6?*BdRc^~i zzfhVR5Fa73izV0u`lPHVOe)7BhK9FU56F0=l#~K}0^*u3YF}nPwk`2dysgimHLZ)(Y47NwXpxS4w8Ec=ZF&B%I>-Nf?2);!r)H%q9SgTQ z$cW}>&nl^0W<141{nR#e*3~p>wp2%!t6us3qIdbm&(ISLbi#6{{Z%%f`aiMN?^)Ic z_lIdPa~MpVYgef=G9<9PefOI@Q z=)RJs<_0+bp=?TWPPl9UEIoEHR<=*2dg?PxfduU?O!^&GnQ5WPCN|`Z|-DpUPyZ&RWhPh^=tr9KA3N zj*R4dQ-_H1f+k2WkeO`=$p5=U!BS>zygX=~!N_;V(&AMx>X?eVB?+wViFr14C_c01qFqYvYrsre0=!4_xqzif6DrL zdqI$rkIwr2`-W;K3l1}(&5}`${~JN=bXgEuWFtHSq4%N01I@x zIGWw`#gj6e0wEgP+>+j2&FCnCg1E-TzW#oln~+T6Gog_3Rpdn}wQc!y*NYrJ*`$!w_&GG*0 zW7gv*GFXIIBwQ9-TRqkI(q1e!S`vz#p;c`8Q}0vjHrtQy(OeINry`$IXMP?YmRHCE zp*ZSVZ5IYTE(*qGG^dUHKoq>Y&dpoRE6dIp>FnPcwT9=!*IExax3)u=&NO|9gO{gT z7U`3;DYQ0O8x~cCMJOcn!65LnxR8x5| z%USg1^}H`8De0)6xzWAfJ>buatv>&$Qx4}tCp|XTs%d+%n8o|v)V~i3N0sL(c^Wf`M3Pk zlvSfeU1Z=tTwLN{%sFF|K`t@z$^MGU{>nUMBX7BSBT(BRsdR%XgxAS7@|i=Vmsd2- zVIJ=@-cy)#hK`1^O4QMD$?C+Ih@jv(Wk8njmrsr49C=v5YV}QDzL?jj-wC{f7IjV{rrnSybDkdd3=XZQ3JeKRaZ z_HGVh-rfYCfCO%0e6ko?9~qnmq9vjWP8}Vw&+n!ZNnq8z-FUh2|8eyeP*ru`7pMse z0s;yG0!j#y($Xpy5NYWa>6Y#==n|0bM!Jy(Y3c3|q`Mp5Lj3-}_ud^09fP>{oU`{{ zG1pvca{oAO!o>DiD8W1T7PoQuQ(xQ36WV!;>V6CnRF--w4Twqkf>1-R!|!5sC+YFp zlz?uv)3#%6!mK%*1O#G0wwMpehmn<;-Fa~b&Wiq+`Tkj!F&Y8J67Te4!5`8ljEY~s zG-X+>_LoM@r(iHs_}fNbB{}dJU%;`($8WZMH~*Ba=H-L#Y+q7D5Ne>Wd*mOfZK#`n zzR~gHU>Z3^~2f@xr@zNtI%u`E4HBF0yj><^19W>|L2cJEl0p=Keu}wK!mbT)wY)5vA za)mv2SAFGlf91~qZD9~9Ly+}eyU^*KpPRF@v-?H&FZyxufw2?ZR7;ZYrUZ(y|AmcL z4wwVi92OVxWKd5a2GVJdU{L>=G&I!Yj&aVd*&J8mf8pqNmmgzdVjdnIQp;wJRG&{x z)n2cx9A#wV@NRf7WD*tB69SE zkt>#i+1LP0826{=`HPzq$Ib=5FCAF{bEh^hCS)J*29c#yoN+V&2V9nJqWSj+fjfA7 z25q!vJ64iNl zQkj7HpV9zCFbF$IR9lIAzPH{}< z2bv^9HqEKg^szaj2&R;iDx*QS#p**`ocl=b%Ial3aOXBBn)uEQe>0@gBm%yGXv=B8FGtc-`` zQy4dIHsGV4z;$2uS1u^ZqaZmq?R7ipI=(RGV&|0_Gmme&M#O$lR8-_J=;#z7pBSEj zSrpM>wn_%aa7n@;wzkaMTe>({R-$jGVIL>rMFl$axo||5!>&PZ{ zE+wOjy=`swL7OM84%y#$wB@shcKcyzqPQF+cKA%Zcs5_YuZ=>a=~BfP-U4xv&mOVE z^vJfImzF8cSaE6sv19E$1Pnrl{C+Q~d&UQy9* z7(=4x!c;9E1B10^eIOtBPndmCs=T%`TrCpyJf>*|Q&K>n@mFw0s%T_PL_|n%Fep2g z=yuD_-LY)PCQ=A z?O)#&j?IF-3BZNH=zswzNP|GziDEV5Z;(MlPtD!1)YBW@U6$OQGg=t4T>)ivA|8=< zoJIIxcvc|dbmA*x-Zq{ZsXv0%61h6$^VB?@E|Od0s(W2Pg-;bhtp%%6@dwBLPi)q5 z7%6U4b7F}8x^kv+d%|9Ek}$F|ni>p+c?3$`=;2^_id4D(C`C_c zp7_a~m98RBd786#3q0J&&t~`zC{HIvgXzU%e5!z@|#a)UMAl%`}-}gu8i(ur&-b;lBQ5dZ_4t%9ODm z`v|Ot-1VDI64bYDT!TUv5bK9sFXF=P?mVC^s{ju3_oeWRb--j|%&0GI;(zF-#Q5^y zPbwCBX=NIR(=vH7s(=cIqaAi8)@NN534wuZCc&X{cP01N#v$_d)E&;BWoNf-Q-YDi zhlj54)#ezhQf_s)-N}oLLDV+JNkAO?Os9j3oSdIW&3rij%G_PR0gT5hqN6kqE4}mcH8t-P1T`_;>(q&epwd^O(UgZt>csuw(bv@^{STzf3uax1KMv&QwC4Ss zC@|Ezd-?)ta!bs+`uj8NnuDBiI?psBO#EeK&LJ-d^dRD{I*;*CrrTd_Nr|ELNJ~PH zCHDqucSZhY3wxRHh=+To0a+tBBm_KfWw`ZqM`3bYdf^;a6RK&|s$cJrM5M~CjH)se zb@v1G4f9j8vNTNQUmzf6i!FG$yLes4}#Fjbhn2uD})O#Eb6_;?YJ$+CUWUl_@iEV_AA zhSaYeL&l|z#9&QoFxK1L{70%cZKOxkn1@k!u%i-(HdabrdZCHzplc@mTI?~3FD2(4R&@d(}_s1Zi71J8-xQ- z>|%9l8l|4q=A3{kq;Yz^DKzrAlw2pQOo_lVOOmcbqXq9Ll`2NWVQ~Yq0mdMdmi}7P z)QX2h?EZZ%ll3Qm?Sn*lSOk6ydx4NZo=d#OBRehCgFgiLRAy=u%iDe= z75>>4y9*qif zPfKV1Ip-kAAKxD>t#ZX!(I( z%})I%1YWcsSO0lx$LehBP6_8(i=ylvHM<}g36cLkL%(Bqj%p0M^Cu6dm}j4#zOyHA zuQN5Za)hkCd*+z2S^5bmvwKjk^6S4;{}_@optBN}nsGkrbH2MYQQfppsH&y4#{R>o z=fK6kRC#@K#TJDrx9G6bnj>()8Gi|1J7rFf{;gEZlg*-o^^vAuKi%-^&wC@VV2KI7 zz!HO9eMF*wd$72$5EkwjN6mJ*OfOb9n}`WO_g%n$t;vd{ND)E;7*_(FJSZni*$D|h z;TT~{_NIvbw_j{GKc_P$E$*S!06|7K}ReAN$?+y{6KBpK0|N zWG6Sz8WIK1ZPq6~`}p{z2SF?Xo>j#5F)8VcmaHre=Hf!d_C%MW?&;BWP&e%B5PJ?+ zm1)06Gu|b!KU3X!AYELH1C4l$Bg$SdFoK&~!GI|(J-sI*R2*uU`|C|j_4O0g=VVk% zzk{hu!mNFLcSS|++(EMh?L!}*oz)c@PfGSuW?o)F8Yi-01T41a8!vBuk>MCvcsiU@ zsS3Hb$~5;-GHBD{WkR#*)L@0-3zk|uP;N-S z>GVEN{^iTs!II$W^G9I&GlayGt%ryDazAo1$yb=I#gC`X;tbXg`FN~xd)S7Dt841E ziMY8=+5`tbEqOR09wrBSoh3x^@$emHVnC5KxdF67x$DrSfzd%s+>lZ+u<4LAhM@EPb z44`_uA@d5XxA>#GA4-*By2`NYEewqPy}gj}v&*e= zJpk#`>hrTmm~J(?_-{`U?w!~QNOT!NnkFl264OY6S0N1iiDY3=c@74t;I;Ac{RK%H zCSI$Rg>-&97MRN&$w2yUsqehd$HT`*G4H)hwUguc__z(1s)fZ)IFpIuwPM}wX;kQf z1Tk>fUP8E`c9a{(T;c3F*JahzA>Mk|ZlL~j^r=f*dsyDjpFeF5w-y;kCL0?;73db8 z5#4JA-F7KX-Dlvn#4HVn8sk ztR<$U#bsxwWOqo(&Fkr=eb3mouqbS656_EmbK}?!(Y#tP_gRhE2`f)NGpU}1xi6aA zUODJV_S>;iRtT$|SJH%(tg<-)+v+JKc8=zmtRIr5yyrH7a^~n%<0tA)&}TxK_@nJz z_ZB;^cvyUDhVyFUtWdAhSN_aS4I{1AJAfGE@Nud^w$&y_-*nE!waQP0NzQx!+4_+` z>hptrA`<*(nWM3-C6-6ok@(`YRC9Z3O?w3qXPjU%oPTdk0vJQ5yk`$*ZUGY;2Ia;i z^Ni zs4Wiy$z1Q9LNq10**}^_s^y{Ve*oHvHnrXbk?qt@LO_>-_KG0V zOG^ejvx0r=1}iHo3JMD22rongX=%;9z1yS%|B}EyoT@5aA>>#Zy0sQJv`CM%ii&B{ zkbf1{lcol5bqX=%i3(dH%p#M?LQw*7G_)drUS-OA*$M^4OFrS@!-aZ5(NR%6a~~)u zn&SD8*GH{iFq)s8+>Dp_VZB}j+e=0T>JGT{Ic268F0ZBY4F)|sqLu9J+0;2h%hKiL zam?oNMisyl-APVLDl%SuTz+a~MC(UX30cNlsUYpmuzRP6^HoqEvsRB=otkCFSCVfc6Rho-GWC!Kn8p+w8a&2{T4h}AzuPNq6E^Z;I z$9*d&Ma_q(38A^cGkCFs`Pm$z`iZ%S%7kKe-|+ zbw2-UqR7J1;2W0NzlOR_(u9ZOi!w0Ic%SnTwJu^o8YZMpVrN-EIply*x9gO@M!DM0TM=PYE%M((Y@75us#OL zEx$iZOr)w+S9N!vvwqYY?BL|)CZ(knWlYS;;nnZ+04&ydx+PBlBEQk%LjeIhLyET) z{UrlYJC*lg(O(!z&hS3mxDWC!Y|MQHc?_W{Pzz=v0q&!fbq;+wWh^ZZ&+OXx4;L57 zqO7uYm7Sf!-JL@CfS#UjzP^^+T===sl9q5OZ{8>?DS3mSc6fOI63#CaFE51jD(W2m zVBgRyK8VwnhCTY1Lk)+Z;Uw*AcwuqA(PZ%q*z0~Ax#Q}z1d>pXd(Y2@Lp&R1%`)2W z1|+?P&Z^Uu&1GKEW62)5tRV40UTykirZlM$?>>E7C)F-`Hj}-cEw3#&x7d;+-qKL7 zpVXmUnMn3G>6A6y%)`xzQl}bliY>~m3Thp@$wWqORkTCd#E%C|wsS*aTYwyXJ`xXkD#%eFqdLvt8Xhe?@%S?QRRvzki9`?X?~W%Ah0Q#&*- zpWEWL5lQtjcAdenJq|cN)W2sKWv^k&0wM||3ILHkWO)C@=aon-4>u3bS>Jal#u4H; z0b5&OpJ3>ZAK_}uG@9MQ#kHQU{rvg#=u~w56zO8)P0jEN7&rg2>nYtH@s~%v(qpkP z6)uypm#M~EuE4|wC!86VUaWthSbtf(E|849iU?2{Ttn`PvX3tKK!^3lc z+rHGFF$gUK>D9OH+`fJP)(x0=&cj3a^QZAdxivlaY4Z2)ElEPy;ghlCpwq(7PeDc| z3mCnU5+}smJ%2=fwUoz#2-seEqzU@32?)3aa)aFb%nWv!#iBAxhEmB-VlEqyr{&S@ zdO=bKJ)N|(G*!bFULfr0i2mZFl9j3a__U}tS?jNZQO2^%pa1P2`*omP=K^aMR8 zE^g{z6B_{!rU|G!mv0xBkkFH*6e{40U+E~Ct%`<%QB8gxLOg92py?~++wk(bZLF# z0g#F?h3t;{96-{wwW~--G&D4fjGX!#+}uc>x}9m?zJaUpzIcD7R7prEdQ}-}n1S{6sMc#M z3;hQ4p~rgX76Y`ue;c5nyydh~uC*eGrKhGI9JFpTsrFs%Z*_;P3I}sDPAJIDP-nBH zBPRNt;mX`^hLBYRPkTSDxc@nQZA!rALY9-^Jc;Nc9zBXTN?SWkc#NUh*Vx$5vn|(T z*P<~Jr}UFgCp$jO8hqGBMuge|G&reTqHpB}pD`bZ&+1r-$pYVLPCFz5KZ1t*SPv>Z zPsM{kz!fAXc((3>xM}by74>m&S()4Syy4ON!Ryt^z?%|kxlPw$4EaFA&*}N^;+B>> zcXrSWQ20fx_mjRM2n@>gV~Ic!+IB?Bk_8Rm2kYQ9?}lk0Q2lx%Oxu<

{^)+>OHLd+=PU_(PNB@>chdC`bHvOU+#etlOGl({K&lT6yClKl&2{M z3`oVJxw#prZq3Hd{~}O5+f5Sl{&a4m5u1V1B_1o4A0IY6HShU}Yi-*?zmX?)`d2VV3V(5Y6BqSuB&7%K4$;XHxRHoac$zcOkar#Oa$7L_WF@r;@IUHbaj*)b*N_wV1=Cn^Q=&FVcOGP z5k8%4@CzQKGK@E!1pSF{QC#))m!S3n{yyw3kiJDePJ&i2peIlk$W|_mfL1(lW6V^s zXw^zPsA}BA4F2}*nIKHolI3T5r?W`E>b6|DxBDy-Prlh z0E81P;~UEj^!5+-_J?ZdtG)3}1^c~)iF)4f`vdHsNvXj7v(|>eX*RR%ZwTwm{f};G zTtqo9Pw~$>8)r5ju0-o|O!J!3ws$uX00EVsa^rf)?Hkuf@{5XsyU#W^Hz9)uy8?Fm z@}6FJiHM>BHLLr(lyEWjcY7ei^(63v#Q6!JK{}l=O^rM;-1Z$QqRSaPPK>O3riLps zbM29~c6MWx_Br;}yd-62vs6;!IwmHA5cPo_%FT^bS7-bDIS1&%hsWZ%xz9>UN`yu3 zjs3tRdAiZs-j0S|C5C`%Ht=+CnZl!@PF9A^N%VVDEFr0t8gH84KHgi+N=U$Z=)ld+ z-cVcnQNdxZjXj0Aqr1DiDYY_zWFNdiZS5d2x0ec3g?o~{@2BtNj#k=Z_%{(S>%IW1 z3aO5(E59#py#2nhfB@3Rk2;>Z3thDw92{-7j*Yt)*3`dgdAvL{JG%oCt5|M(x_c-X z51${j(lceyjh3vtgoi7*qp$LlK%oyWULq`v@`u^1{$RFB*v$;NbI=Hkd>Uq9Zca;0 zU2eBK5=0>mb+^v>Z4jb9!7IHCty~IEHtJUF_hSwYm|^X6BsBlju^8<6JskF4MZm+? zF9+UhS(yV1iyrF@r^wHrfs-B~!sigPv0-mBNBVbp;%YF4U~*_udb+;0_LIa@5Mc61 zQz+2>-}03qp)LKgLa`JdEzZ*Eh^qCm-&?8D>z#ux01&N;W;f4u#$WjkdNsYB)^7Hz83F% z#=!6-Aw%wS7#f`P@kBvu*hM5Dh||Jl(=$H4+MOt`U7M@U7bXuLNJvaf8wI_$x3|P_ z_zfbO!*XXow&vm5@@SruBUF)!FC-CFB-|3%;&z>_PDAlI)q*g4-3m~q3d_H3g=)0I#hTsUTVH)r{y4KpQ_a= zU`Vlbzs!`hr@h^Dy8h)Qv^m-yS)!_-pf}UV&glDIL&Iu&P9@y!;0{p9&(2Umc9d1q zgZMu>dh0!&_h>G6;EW9yt!tp10F~`S&V$Pj>N5kHA-BC)UNpZ77#?ywh^GDVm?Apo zffOepQ54MQjz0I{d0;385m#GhCq=@?>&Vag9TD}vKafQqB_wKir15*RW!*8J^m~*5 z)(zAPo-rvXD6~af6zW2A?si*GT27gjA|V~Med_AU9Rvx0(Kk*=W~X+ym>zIi-GSq@ zFj9mXWcxlLPJaZfbI5pafPP&g;Li_zrdL{$*XD`M$vYonvXY2oOi7%p1A5t=asnAd-m^S$`b#JMz(q)L)1oc?@4 zg9G$Zi?uNYf#ZJ(>1)_$4WOBVilVx|4!URQKdm?{iTs-k1~L~LyhE|DZ$bnX=x462 ztu1mGRqu^!@}^r^8DBb@jfrVy)8UjjuE2pd|KaC{UXYo#P^5Xn3V{g8ua*{d zRT#PY>>TY@n53lwKR-EBbFW3xiN0>!G zcZG2|-Q5iEx_$c-6q)V@fG;mCZCD&$1 z;}>s#{~QKqLP8@*JmEE$921iby<3=`4Q*czVqfm&B}GUkT#O3)CM16UoF`=xAsFl&7I_kP?trRFs9m>2Wm|hZSCuk|7TRBO@v9 zp+FhoUSlIq_9ioVDB<^F9OKeMfBQ77id9P(JXY9mcEC{qSu4?-!pfOjV;Nh zn`~`$T}4z8H8hw|brlv)D7=!DlzjU1b!$t@3|Nv5GsL&ZNMQs7L?Zpl+jFAUD?=|4 zY{ts|etu6906Jvn;9xae*aEZp^(z6J@z|pTXw4>gu<+(+=H?BNMPTioogzaAb8jz` z)A4G_ed-VnPR@*s49tMa%JJz2RD(8R?mX`- zWvV;?7Cd3J^XP++ZxxGEP4fmz%gc8?0rB^|IL&|v)8KeFkm1O^c_SVk<0OI^mqZ+= z$(E8YNrQunQx&4z22t7_eCFInLzvIPJC}6%e5O$E<5X#vwTOm2`|zh(m5Zo~Fvzp3 zD-0F)6=bDfmUu2|#*NLdW1FOe0DM{cI z?gECX8!|$|_Ae2T#EF#R^TCxN$id>k*m*e0rKN|8iY5`qm3F}mvs7C)>9D$riuhh$ z4+CB!5Ui}S4pk{3A#R{BvwbTba$~H3&wQ0`Xet0qLmTl+M5;J4iVK39S}fO?f+m4r>6W0?OLI&GH<7W zu|!Q>-69CHFocEq-f}>Cnv$5w;n$bT$ReN5;}io9{{Blr!VuF|mLdN)9P2F)+| zLk};P>;)B_@+~wpUv*CJ98o(v0r??O5;H3+929;qiGY!N0`{2jLta`z;X=77IT=Ru z&n}I)umivPjg%ChN_1*EblqkGJ-oh+DcI(Y$vSJGDNq5!KBlIof&dj0D-%;eUS2>Z z+;FH5G%x8H8HpkS0=f}@rlwvXAhl`>FX-X67HUxj15{LU=gyAj!a&xj428+qt<%5{ z577moHBrbjBO#$}<~t>|dAJZEAt+n2@7jXP|?%V)8X8|cW-uXP6sUg zJZ_bf3eDm!E-vmldCTRE){FuT6`lA@7*eF<2wOwg|_}{o09Op2=vJA-g-z#s8x6fRYC+wfV;c9&)&aM;=!xS z_A%5u6^<mJ{Hq*T+gh)j?5S{vHt#jG=$1Juz5P@LHPcslC+O>7}JDXfT6WnPC4$XF00G+Yw@}OB{K5+l$I2X%Igv;n@lI#w+^#}BZ0(x)ZKXop4xdtGy54$! zkE-L2RDD^gR3yWZLUwNM#J^MJ=*Y=k^{8GW2ssKhmQIU}$DK|NJYh~U6t-!&%;#3V z+zx{7yw0k7pa;@6l~e6U1_L)kLjj0k-1TK;9YBC4fz^`qyO%FtYR_fBt*#Ci>=$S_ zc6G(`h1CX<3xm2`T1rZKRu(xsCp_OaD-&y$ie=9PD`Kac}#}{1*{HSi(~s zqozC4$cJDy7|?~RX&dk{r(+|rA|dDV+vw<4ZSp;XYeu{$&n^-sm{ta%x%|K z+RvO$p5JtJCiZWb*&Hd_h8oZh$Wb7i3$!JUMIS9*eUvberS#?r6aXN)@$~#uQ**wv zK)~Zb38ks0qOm+IkKUz7P>xkO&OSb|kl&YlK}Vk<|; zPqvc}i#nY>g8nf8@@N|w{kjZ4{9|LS3$)kZp&J;8{TF^vOqT=yHtKnv82FBH=)r?m zoa~{Sb2Ew|Hi|1yNs5b$p@;!x`+)&jDQs((%TIkl%cAvb1H_A$7IgEXUlWqzcoXx8 zz;yk$s;cS`NTsJQ#l8G|aNw*|GYCHh3I?{9P~Qb1h1bJF?e4^s^@Gc(m{y1DHl3k!?%;5tBIJHjxZ8I62vYZJ+nH`LXY zr_J{CY$-MWNbKl30gAy9OgdID5nWX^CL|;U_D&KJ@G`c$;!lT%hZ`CiV3?PPMxFj+ zR%7M;y%;(=v~)UX8pveG1Cp#^Ug6@3iexkC%M8zeho7p7_jgmf zm>?v&R&BRg<&`2UQ{%Z`dxwX2htU4>r95pzLoSz53!AUwu~=j{9+cj8{#ER1*lyf( zssYI)1PS=!poTerB5sHXwxKh*Veap{Lp}>6DDjvIn|cpbU;O@akJ-sW*abuKFXiRi z+9RzsG;S(qgUrpYJI4BOMQM3(u$FOldSzvnW?p>!@6dWEm_dH;bdFCKYG7ovyH^1Z z3iOtJmwCg2f!fqR;M|jt)jl{dH+T>N{vBR@q*bxt_g!5Nkp}@=$HolsC}k8AV}&mu z`#ee5*^vV(vYTr|rb@XO*-tkkWi!J*dS4K-hsC0P1cvPOOgiU|k&KKg#;nLZsMML>66M|T?4OnTG7DsY^->9SbXF zb`HmIXoEBT7=BuXc=IMAG0~Tc6bgm0T((6&fXxb_loJgq!)m|hjlX??V_Nb22wX~3^kb?vR5x3*Hh+5sb3KSLX^>K)wm_bEuU{zk%m=Pp4BgQ_l%9Mnl@{{Ke~7)?@21l;qJfU0X@XfpAY;77Z%%+0pUItv)c+2EEtqQy=au6F)1FfEL3))kV3B9$4t$l0LiLSyB$G4&D}hat_NVf`=70N<}z zZbi$;!lKEEX>|ix(0I}bbcu#XN0&E#2SeCwsB>fTp@xQ|^Lgz|Bib!=KM1>~ryG<8 zv&ZM>=d)7f^o-iA%q~7{!+%V9HlGn^ZIhgYn>&Cc=EXHj(GMRGhMDjB)5Fu&f&$>) z8@x+cjFyhZt!cYRA!C10_V%sn(6B-?Z+2GJ;pR-Jw>Q7OzM12du?kyY9`kScT+-Do zQ2{I=gf1N?C#U=&fHWfh_CEaIzR@{G${4ACzuBMhd$fdDRK#JRIBO8z;%&t(FRx$@ zj^v&ZH2v^5B;jNI?Xy%z2h97MdNC14TMOOZA3qLmZL6^vKV&zMwI4$VDmuI@{YtEZ zR!7h0*VgK-NYqlN-*@}qQU9!4-?X6;`RjvTcb}aKD|og_gMbN-rKROJb6r|mG;u(0li&lFKRj@EO;K-y0i)`ciI7ko)Oo)7MD0?do$U;8ARw&KxNz zMYeEU2Glj7)Kpa3P8}{wJj0MD(^F9aUZ&g`LpaoNf%hdf4h(!c9QPeVIRR=P%-kVj zNC+)04R9d&Ym{E7T(BQMUYt=SC8h7{Fv!yhig8!3BfWOixx93j&PO=jV3tAgw8n_6-)NybEkB^hwfc{9Z+5#7^^m_(@6vMmw}wgZ(`AkeuSfw zKYxa;R$RW@#8W0Fovt|0f0L}L${OmJUH%rS6qlF?=y{&~KFMDY?SKOu6J(Kic#AE( zg)uR#u{n?La)m0@XULgEbJ<$LOovkb%LiZfdJdxw$%a5`iozS+3C74m@pyY<d5P4)ycKpW}eN?M0sbPXP@5Yn04#)cqmzz!oa}5EIPUE zKCUw)eeuBhTw5DOL)-NuQYqK#y(Yc?vVnq>biCZ!eS5xyR{8nw+14(nQ|%w+_6?0s zK18El*;k|w`Hu^5alKQ#_i%7ZOKs=o=74kk(=vpLl8483r0_oE2J;*j^!oeOyXht+ z#@R4)EouekE>d!FrH@%z?=D?OMb*F#;+QQK{CneRK3%mK&mY~r1tqPlq$IM<;Op0} zdEC1BFO-pZ35l6%WtlJ^U-0rHt&H50#bgI6;X4K@ro|Br|Zh5%@U7P{lBBMy9Q($cA>vLJAk?Hz$lK^;(gISTS zmUjW8qgp#Xe!$Ib#LjNqp#~)63iElP(pBTyPo}Tb?MhcKBRHz3;NFmbg63yi+pqUp zJh3K5Mk+YTpZ~36b;>Wf{nPEvR;aKw)RXmPWjt5^wCi#ewN&iJ#`2#(nkvd1drSRi zW2K|W7%|m${ni^(+1O9+K&!(aj!Wx!1v8+^DT_&m6-deEgh~2}`I>>***NGh661ve zq~qyw{spKv!QsU4I5M%YBsw^K)_DIGdG#VXg0*o^Dn-B2FKJ@~mBpZgd{Jkin8 zg1YwEyb4Sv0G&a=dB_`i9gprkc(8M@$qO^dfYI{J!oh{{9(K^zu&`GMO5UJMRNOU@ zn3dXMD9xJMz}x?-oo>j6L7g-DkT41$?h&2EKiq?w`CD}RzX6;J)fK{%xQd3RCg60y zTqt3OSx~{oxpxno;@^jH<#}jy^zve9iPfqii@tRGlkLO9o9-BDTs9jO2?-|&{MaBP z4{C+?30f^_u6Vwc_!|2x-We*wC5G%Pzw>75Ju{ro*t6GTdqGHkI~1?3!dE4k$G1H~RdBm|OXxVg5>*>O>`~{XX4F?e%J?hmMYncuekY z#H#^`h{JmA;Pn31_I4=kF*TQRjWLL2&HnjwS5kLj6rV++=X!9>K$hS{l`qWx!5Ms+ z?on8H$I?=U1fT22sLNHAkz%7ZOA@$ueKHmnQZ_bmaq-BEE5Cku!DnM)GH6vMQp-7j zRIj1ohv6SylpJI&1*4|fQh(R`1Qi<0CLpl*_Dve^{s9ZHr=S~Pn)+WTbaIb^;&^$` zx&XT&J@DY*Pm#esugzVM4k}Zxt0=P+{ULTkLM$_j){j`tda3C z9o)Z~v1S0pn6CKG%K)kb25wD#RC98w%A|49Ll3U``gq)6pzmPDA4eJa`_8p%s)U?Y zho{F-PpI%nlc7e=zG&{1=H%h==jPrYue6sC6?M(HGdJgU?WMHB`t0`nG!gg6Q_86? z0)L;t0mDi5wO^4h9z6q*rl6pWLvd*I{rK@Csi5Dt6(Dr|eO0G;$?Q9xogDsYS%$bo zPWqc##ZZx4&fY~S(ES>v9Qc+s((HY1LSRG;cefbQ6lXG%(bah`t z!6KxigV4cY4F>RpL-13aqq3|pEg0CJ!3}NqX)xU^s~_qp4Xgrw592d3_z)}x11sa@ zI>WpeS6aFT1|CB8IQTUE69iz;A1o5X^=0`HTw}kSjg54B#L`3AeN5QMwXUevzwGE? z-U7|CN)5d(%g;DdVnouktA(cnpcND)9w#$yuLSsv7@bNg&Q zpIuN=0&u}6Pa(p82G0?07e?XPu1}l-bp%XWrb0o=^gdAhfU&3BLpDg9EtL^srOv*v{H`yp<6lobWfp!=)w0+%TvKeA8-~wFw_$Vj=^^fd9A%fF!c|vkcNRPudO4 zzg@75qoOM6>%}=Z4jSV|0^|Y%uj*;$K6>tGcSHR|j8`xv{JfJgcGQ;BaaU;fHy2FJR08CfQEWEOGG`GLtS>Plw%JJi1Ff*xO5*0407N+pRxJ{zZ9t>I6U%pqUA~ z5(pLY)$7O|uI_@Sgh}~jmdo8<_sij2x3#xxkfyD{p_@{ktm^1Z#h7RPTw3}V^Y)Ey ztwJX|ySb%)`{|jWR$a%x*PCW{v2;{Vo}}dFer=i&a+rl%0)P`-$N$#vjd&~)c$D^N zPPgSpft#Be(?3jw2Xc73vQ>f#bV>>hhdq`NSMCc3Jz)i9_y@dBAbE<5j23Y^CwgP> z0&u^Q{sUl!0^hW>b9S^6K6fjih&)cPTxNYjPJTMC0fe0z)`4slXQ(1T6)3+Gb)%e- zsesLRXKkWVba}u}S?4=5a8;mr@uPa(TwbKn2s6~GYAfyCm6bWnV0hz|D^z!32K8<;uxL5DKA=6qvi^N7c*F z%S9osip{d7ROP^dzkl_F0&*k>sR=oY#e{^^|1`TQ6+i4~ZJp-;tAFK1FgZ1KYs9YO z!A5+&ibj*)KyNQpVuy3prPO~rTL6!%myp|zY?Q}t=fDFqQ9SCoCnIm#6m;WMR^Wgp zrr+|T`=Qm&&1a`NxU?hRzHWH>W~x@s&$hC4bkGg~3SA_d_3(N7Mb>jp%F6n?C)pmN zhp|QpS=qkcUb=Fg7V9-G2If8utuOE^@JfE%3ggRF|C-`&kRWM>Iv#FmfkyV{>pY?V zvOK@<85w4TzpWjQz8%fSMqam; zIX+!((8+uFM?6eSksg^@wq9N+h@CAhU6?!k?H>Dc2R(D#yBl5}`h61VYLh-5`32@` z)i}9kq{6~d1M)P?JKUJ?x$^Q4uqE~NkvKVJm6Yo0lh85ApQIr88!#oKIXI4viaZwT z-2H`wUXe_1`YTgnm}$?wF)#6s?`Kc%9Agy@aXDW{;U ztnr>aBqy)|(rjd;mr| zD$7WP1UhR$KpNK{@+C~1Jzo0WCVx+2-X|C4_9a-}>86)EjBvD*Q?%~}xVmB<=k2eK z?&IN|n`;i0LqlPiWa1IxTTsyPQm~5$JRw^yQW6*&?6ALf9hj2+X-b0#2ZWSV``Fl5 zkH8?;fB<68G>F2A43_UoYHAvqnNeZ(=a|SQx?y2fI?=+Y!2869M_MT8PNAXu>#g5H zLx~?gd_p8(@vsW}3B(U|?$1dWfzA-Rg-M9q&G~1UloUm3nh?sex>{Od2*}9;0$i_N z&4C%mhK5UC#MIq#Qm=ldE-cs-8|+PcsXmc>0N();vc5jmbf@A@G9eaLNMz)B^s@wO zj|Ji5Wws9v4rU@EpANiX5^HDrVwID-$4`e-^uynSehd8FJ#X1qSl%@~etw_=_+xnZ zWBb0($X87!Zh;*;-d%2XTH*LGm09iVQCzHTmM8V zh&Use^Ry>H>avLm>(;OInjAiNZLLDazeh$|hH~Sx*?l4+V`F1FTH4Y0b3NRi_8FpXWVw*TxvGBZIBhYOMeU0Xa!G+u`!S zD#jfLVT4YHp*Fc{fliM4O_i%xQxznAGcq`-X*umIXfXki$_qe3vjH!wz>PtmH_+D6 zYQT`O4%Hc2Ow09&#&Jg~n16Gud3y92@n?xcckG7~!eV7;)_mTfzAjU_)cZcl(ZR!a z!LRV}60+@LhtGR@7>C^4-1N=N7%>5_rlzIkQ#=xORWse3hZt5xr4nd!C#U=0A=pw- zU}*+7c-k@?1+F|QN?A&3J4=bJ+GcZW>gD>-&`@DvVY2WzP!l!PYe^GmmHfDDv0fv} ztx5~@6Cf_Vd9#u(-JlxP%c?4})xqKHal&t z*$bpnL;l)^)iK+i!NFLMV&l^Ses4EKq0?zCT$~3n-X5r-NN;R&zCl1QxZ&W1qs&z& zqMnOl)MC$AA1P{$4qg(CE_-z%x;DS>(BP$lV0Nl#t@pfs(R;8hmwkX0P_nPTXIbWO z*pZuyF-;m1W6$^MXMG*arFqK3qhOKA8PJt}I2%|!Jz;_>6(Oxl?w35~v4)@#a7 zh{W$T4zktsn$urwPltMs7zB{!x&hSmsOGDv@H;%@#^q&9*l!D_=7g4>?X9ihY+J5G zc-D6%6%{9b*A2U4lrJypsg>qSoydDuMXZh4=9|tuCW+v%Tu76w^jz4QwFiInIN_<3 z8%XoHd-xGmTAZB_!iIGe>P;!0?mQYR&C2|?)5*)$)c6D|AZH!M2z=}5WfK14=`H-8 zbYK7n25pl-xK(0oY*0U017YDr*{;Wd_tyU8pjb?W7y{(5HJll|{Cq+Or?uNx&bA2| zO(u^1{5iL|?tD78GB&K&;DwhNWzrtuh+uw?5VxuUom9u21ugK@=!6jk(7EOP1b8`l zB=Si87g5%IWz9c=py9$@si=$$zLj*((L`Zkyqpg&>oP)?xetk>GO$NcQCrliqdMo= z42LBCKgpAXp&`^2oS`G4-ty}t0BE^-K~U3YBVb9dw%etN!a&|Yy@R%k{!rd@sSk}l zXQry^YHNrn=57jnz6)rD2R^x%GME-mrZ0UT|45Zm#Go(DsnRYb^N5`5Ws21o=jAr8-9 zr;XzvFCd=J-eP5ejA*WtR|Wo57D%n{RqCs6U|GI_Y4ff|5AgBfZ@sPoCn=BpIx_k# zbabcFqjm`G@!5<;5O2?U!Lz?qRrT8~H|S2V4SM2RS?M3eZSM!%!)=|LPE6W&h*{Dx zIQv#$c8#w_)0>@p1DWAY%th2Hs)cuL2asuFt^*)pG@+k zU7l(Zcp~y(YP!dhWdM7!C@oV`NhxUcH4H>XJlGTQOp~Q;$J)eaen!8^xVthu(cLZJ zAeb=o$Sxd4i!$4MU>ivF^KA=firCe`CIk}@7;tEoJjh{bG31BHF+4reHbjW7wh9|+ z?UMVX%!QUz1_f~wd{;Scy*&w+wK!2ph?)0ZngqZutmP>Re1+V14xXWUFaa$yln_u? zNfMtTmK?+bNiNASR-=c*bn>K}BoVAeLmR&<>n9&erJ@tEW~LqlU{>l3d1u5u>I{*Q zl|4D%FZk(!`HNPu4OBC!O*0W{qL9O~J01xrDrzqepc^I$`da~AXIkA2ZFv|9VFS!L z^#wSUy|UR+EwEy2E)fxLJfA^4_{KqRbYy^f6KQQI@20^%g`Ff4`U*f5QkxJyH2;kh z6w3FUtE>)sfDtm9)BztG?|M~EKf5-8Ej`w(vx0jyh^L#${ecjh}UgvpUHIX-L$;fWi z>h9;#ee;RmY`ZHmWM*uJNJVR*uQ|5s-2yujjzb?%TWj+2<`xbs%_2Ro`aQLJ z5@m4AfrAJ63|pa%vKalHK&{3LP93u3eXP=NQO@U{m z^6ZEGx91gxrp{3L*ZZUwZOcjl$UiLNiRW9~#y- zu{j#e`9)sj{CT4lYh@-=GykE{6;X9gm@lKVW-^tvlY#*l2Cw;G_ZRV3-}y~UrcgZ{ z6qZm|UoCL`+SS_e>0B>f@RJo1R(|-fudKwY&urUKrjR_b2?|DrnbC}OL9^T2s_6y2 zc^^JdcvBm!vTv7>h<#4H)r7dIDbMwDXh!GkqR5^4Q@AE#OI}`f$|N9cuke#ZFxkR2 zi)YnH-hIa@2M*+&G$UCgM=a@&khvOls42&My3rC(dWTLqUKSG`%^rU$A>z~v&tFj} z(;VnaGh9B{d=Yi6OLKhn4?EkY!akH)5MP}Tg})ol171EppV35sKfq`K0KZo!>VWVH z_QGnf{VLg3rrLpic%_X04}-=!A#=Tyu&|TOCWLQ}ttl3k6PBX(ox0QgzdRXp)v_#Q zv4w#R;p6$?z6k|FOvILvCl-Bf6Xia}F!n|i(7JzLT7q3^^xr%M&7S)C@!5MGv)-p$ zs1N&JmGESs#};H`Y8sW5j9_J-MB(tSt@P(lrquji+JsXgsavU5rzA;JW8>Gu>=oD7 z0$^4W9~H$q9Ft-`^q2a%ZZ(7Y1Lv_Dpnh_&T)CdyhV5ODR&YQ`N2i}C61WO~iHG&9 zU4G&5@qD^(+CZ?EN(v7Mkiqm4dHL@WAGWS=sJ3N_h>%FE?!;;(1fTxofB5>fYrrJl zZ&d8NM;>$J^ALYT2o`_?ju+!|F);}t2D!v?2#`S@*hxm`^?-x;bENaW^2+gEx*cH= zx*Y16mDLkZ&~KnQeW*IqkKhnGGt`Sl;jbN}yl?1IY8owSKxhRiBZC}3Potuaj^*|1 zDi<$)0VHD34eOLxWY#z??i^_U$ex3i@WDOxMIgOcKUQWEuv;n1FcXnDt}oa(3KOAo0}Uy@r$|_*fBI~ zA^xaijXRyG-=(Hn`tBfExV(YtIGj4k#MIxNZx$D~ZKR>LPk{8AloY5J&aWh|S+@N7 zQ!V4)Iy}@9v6)yb@T08x$4t3POIw?4@808Cr-Q1E8zSGuobIgHyqWTyz;Wc0!izqg zv&|s?$9_q?tJ*IGbZ@J%R{pUzsek{H2}eWV$!)*>4`AfPZ<9Z;%nl4RBBIe)k`CXB zxruFVy*2N7z@0lCe@hu|+%SPh!2HD1eK(|~FJZQUYe`YjpYHry68jJOn2)t? zlab+Ra`A*w#mxG`SAHtjrDl&qwNEFzjo=s)!n99LE{!@Xkl#$gmCC@tJ<+~MUVZzH z9p&(C`uo@U#S3BU?&5FDuV3$lGy@}~WdntV`pSbbSfutUhL3!|&zxmBR`>0rLaa*b zmoLU}*`YshKt=+(!;`%cTjf=dDBG?q6#DTbWsnmAAbHl#?5FmtOTS$AkvyjVOUh7< z-0W&;9KX5VJeU_!mNFZ+Dw14&-;O@Xqm);F*lHj-d;ECPdG|it(#;#0M{!xA;Iq(^ z?DtCZpm{v)$XsP*wIF9udofb7)$1fs!fPLPCMemhE>{y>9dQCTf5B?6vz})C1IQW6 z5EvA2{|_!SXIl4zc=P_f<P ztvD1H6{Vx4=RF%cWZ{4`@JT?h^Ru-1aSaZN+coQEK?wz7P$<7Ww(Fga4U6bsH4u!^aw6t`9 zJr5s--eN(unfl}V_e(aw$aV4vJ|OcY`IAA7kdi{SXAgA{*MoxZz|~Qn5YlHSkL5;2 z>Xp8~rba@HUnkhBswxedn|cHabCGBO-h-S8joMT1c36#Gs7+5GTc+J4adk(aQ&x5j z4MJ&Y>8>1Vk&$=R1F(=%Rqd60K)j=PGh?9c`*($~H~R*=x}L0$h=&PK0GIAe@J02E zH{0a1;WTdj;RSDo zn|MynvysTZ1jjgDJxi^u6q<|Gs%*&DU<<(0mYN(hFqCngnVA{G00afIlwx5arh*38 zdzZaOX))Bpu%q?j%t2^02x5)DdTFPuuc$>V93*9?yc(Xz$;Gu?^M&-^KT~K`iC^78 z1Fl*p*r1n?&;lgWqP_Sm2aFX2uK)P<@|^%s$3}-u0{*Z~F2rTer&YdlwRN z$uzO%cRDXhh9Xo}_M^XBvBmBfh%gN|#mb}^85a2PoUh~T8rUKq2KNeIzqRTou*$$I zGSJbDbfefK^hKfP00#2pd zy+8$+3u$*%Q%_TCpvSdigGomPU9EN{n1b&q;}?oPkC+4)_eg8@0e>+9Ewii$v}KXm(T=0RkK|IGg<3z4_` z`RgmMv51h?)wHsk-98^aU<@0pXzqY|R_a~!+&>=?A>Y~^h^Ba5*ayfF{*LG11iBNg zRB8TLFV6y0#RX+xwk|G*#Knc#+0B^#{S&bKQ;-75@>rV>x1qk21SsvLm6c|ui3f%M z<~{$2uH7H^y|i^6?xP6#r3D4Yfigv-$p=aSaYfS5(th}S8a7`20wwFvE88u+<$M<= zEj|3{Q^UKGo5VFqkSFVT&2fTl>vOThv1Jz*Y}b+!z)4pv?+_Ngcrpg{{oR!T!H0a< zCtrT4Yo(6^aJ*bEEFZZIOc&>M2KmiXCMMSuBH~;;WNxQFzLaZc|CpYHu=Xm+Y#J@l z{z_HRhwooSkL01|MN(yg2N^7oY17EZ#N zVNQ4uNv}pb$L>CON4>EM!_50DWMCM@Z&vh}emgEb_|fGncHqmz>9IVfp(z44M^>sF zP$?3KjjyI?Km9~C-G-r^7$T_Uv%`TAqr_Bh*0B>Cy^1GUSq-(d&@>{* z^8+gIaCKEyjM*;gv9$aO*qE%6lFr0kio^by=%G8T-_r`UU-&+N1&ZKDMM;@R#404W z66BlWH0&4FY^4EffSuk_lBj)GqT$=eZCNd-+pOlJ@U&(}{1e^*f5AE3%K?;DQ5%(< zUR$aw_!vmNPw?|YQuuBJ9hi^Tbaak1Q=R&7PIC!^Hg4D2ovG@jC4%}Sl9D4`cXVfm zg>iPJ>u>Bp!peCp&nMWwuI}z!TwGY5Xm;i2=R=0#-R(z^w-FF%Le<(Qumk;ON-7if z6N87EPokm5rl%LFuczqv&!1V6!?4XV#z?)l(*Gb-jiz{tIoIyqHJW;$jE_9PZi(Xp zDL@9`CSsNpDbN(ta*%<6g;Js``{`Q`ptc%76BHEAaB^x~ycp;r8`z##HK6(0!{G4Y z=KhVZD@b-&#gu-FgG)(u^@kC3f8+~Y*Jsp;tQ=}EOd2NkFA&?vRRL^gR9mIEH~A}y zoWz6=oE{fQO|Ctz%*)H$Y{u@6+f4{#V_{)ti>R>JgS1UdMI~_KT~$!k8UL<%zZ#du zR9?+_JM~c;SZ>JDY;dTVnl7x61XB;Tw?NC#UTIi~#$S8;6|zG$zQkDiu@1!}gQ(px zN(n}x^h8;DbtX){^LYRMQd_DAgju%~y<7)7v&C5$Zf&XN+)i*9zBf?y0m4wd>8%Hz zKfkCz=Ha&X?jS+z1q<`nJPYTtV@ym%6%`I6`&l4#86J9w8JVk9OcyU2D=2WOq?o={ z+pGa1Egw4`^deE}W@{n015yurVi=q_8W7Vtyq-yEX^j?nyaG;pH=lF`;BC0{)GktY zpwIsuodnVRlB?^3wLInCPh!=x)(hR6?N@nZ0PhfcTnGGux~9zrjPU6)fkNqKx@^Sb zQb<@h>Ds=-xG>&4ria!q5A`7v(~ccv_=mVt#BR~-+b4Q2?=*$y zLqxTH0jX<3fy72r*PZ;TD$`#tpXAnWLrF<|fjPkdM+>O5FoEQFI%`mMT1v_-`Me!( zH-8>1Wc`G`zCqFd>=)7Ii#crP&s&yx^?}>jmb%)K9CZeTV|N64VKH~OmMeT!N17R3 zUaO@)nZBg1ekM+Q3qf)JrTa_aGMzm=H*|D%q78iyE_YP5LV@qRn|!8gg@rrP-+c}2xf+z%;<)h)6JaV@RWRJZcT?PBsK0AJ*0T=nPmVA;RfMf?Un*2O27AT&GN z_@UeJ|Jz2J7v7cdsKsl3LKB=3R2MSO)}np6l;H_+gg>zejX&abH)o`qC#R-<;xU+g zd(2EoSeMV}HL2(}F&>NcwIuityn10fIr%9rCMGg8bQ0OtUEvRz7P;n%mL@}k#3TI^ z;pnyD;S7no&!Z~Whq>PEXUlpy90h=6ZQ*N%pWmMUeGyCo_@?jSwpfk?Kl1zc69NKN zHS+5R83KKM(VqJn>2hT=k)2dcUmV+|$cOniu;g(hg#j+jfdk-|UVpq<2oM}5L`ju&=Cd;>vtH0~ta7k|d#6%hC=qx0$nH>>%cJAcK!m6semW(I9g{Sx7aKl@`?=vxR-A?y5 zrozn`YCZVFrmk)%E}qR8sP)$0{~*m=eo^?JCLvtx%9{^t@#sVv>9UnJ%}^_t$rggXRc|RKvsH+R`{%vgRw0<$~S6wq)?l(NTz4KOH~G%v|0jT2NM| zhTgr4PW9d8r4+FnH@;}(zTq+Wwy(A+)?J^Njk6-9MCo{7wBxDHiuJ)br;U3>^)4#v zIb0!c-&S0ntF-IsL25|0*W92%{*;s6#&5`bbbE20Ff;DTVSxuJTR!n*^ziU-yma|T z2n9jxp^(kYgSpWZ^uppwDsLHe&Y-P!=K-d48qN%gpu5)BS3dNk4t9zlbruz|q6_zI z;c=-(Kz49&Ufc2?a30(#=xB$YT1zLTrk+?8XpR%!Md7*OS+m3L+O?CyHqxw2j6th0 zHaMybS`x={a@PLTgB!+s|C0TIk8~RG@@i_&##)`w#oF~^sN6?xqAu(fe-Sq535qXY zCcvR!I2&wMc$#RsVrHf~J$h#{-DFiwox}uZ)^X|U*Y$rouPG_@lO8lW!qs1G*hZ7& zc97t39hz5BW@Z?9en8Xu4ZVQ*a~JQ^z75gJPnrBKm;`5Lx-F2LCqfbq-y(v87ls?v z4*Q?oysci~ic-YfxVz){nKOp^`jh4KE6CO9coMzLk+|U%X-VWs-r6u!-EBFEqK6cM zNpo|r21f#+Z(_8iO~QP-pE=HHh5O4{+ukb^AaqJuwk#}!0)mkFJh(Qij^Y%(cZvOn z7L*bNwNs6RPkkF#P+Bv+m=YOz;d0^i8d_!yd8qL9|Mjv`?&{UGlmi?6H!vw~TYv$! z_L+Y~3byODQ@zR^9ahh9kd7QkH5Tm|&rv@i-Q1v9-`u>GLUiyr&;lx&xw*blaT*Gji#eh~-81l}CKdqzK-F3{%up3)J1VNGWTaOLROZMSI~Am)n7O%s{?gP%`T`u}ZuTBd6Tc2$F23w+ zPRe&6T7D5{U!OjJb2V}l=`QaxYtGAsdz!^XSXuKM8{vU%)|M*j&zsUGKu+*F19YwU zO)Sb`z{K`8*3!{x0l&5c+hjiOsrtb7oKfVNkjVq#!*HSjjaF)TPNt<22#e)#!~6Qz zc&9j`H+)*|*6W=w7U^Y=0#GA2%KO8YR5*y(}zj5pJopzslGH#+0g>yeTs=37lLm7j5N zmtvEX<3o#2xg8y5&BJKDz@v+pliv`}02hIQq5gPI{2thFZ_C;qKy1;#-hO)SZnkwo zw0~P9A~7a1tKOL+n*EHEkuD!yn?zOj{of^R?J)H$?~qJXU*FE6=@G~5HM5j*ufPQe z;tLXrIE>a2|1ZSf0*DP4xkPp1+emHe}bk@kkIZJ1<6+( z0Mmrcbf()gG>;sidrSu{kHb?Popeer+&M)~m?F&0DILhj^VHtAE5v^8IWz+t)ziB8 zAu5eMzetMZ`+=!7XPD{k<|rAMHhlC5ngz9KB!G1%HWcFFgZ+)s6m)#4R2{F~maK7z z8Vf5Si)*yFclGM0`1st{uPZ{YITcJ~n+=ru^KAt){Gg94Q8sS!w}gdh7|qj*7kgHh z*PgAxj{3#gs-Uav7MR5^Lf6)rV;dh5@<>Og=EoCpR3cr~oci4`AUVAj${_NWWJflx z8J%YtnGtS%#a!HY;%OBDdk^@2{c>Vr@7IbL`-i{enpupGN6QQ%W8*Oq3iuU)wB%qJfo`;n%ve8x!S9t=0sCVW3@X=wx% z%Sk^XfV_AfZko;{EljMUsx?1G%KhrP)_owj4vkiRuUu8$eT`=P$XirJ0kn{W7^VHS<9tVRVO^ z;fMf-1CK#d6XkfQSC^8;#9wisw@G;e?}JU&Ww&L$7%4s_kz!D&N*(pB34o{50yl1Q z>M^^mQ&5A0gZ(qLIWE9ZOEJq!5Q$Nw1hkVjPCI|ZuY2^jf0g6};1Ut9VE_(eW@cmp zN#qrT81FOwH*<3qUy_kvaCk0iw>`f#_7lE&B2tWwszD3G)S5Oi8mG?Ys#hE0I;sgJ zI!%HcQE%Yj>UynPU?Y9!L!PhKSoR#r)h`ZydYZYO2s`$fC5r`M@mO^hBYs}m0vjtW zk_Kg{HgTE-5?FBiZj$!*_3a=bfjU;@CWcXYaRE@cbYFl<=JSPn^WzH2aqU5ZR^}db zWuu*ggA2GT&qfkJXoY^JBTJ&Tr7Od?scxD+&@)JKb9v;klYCTJ=%F^lebF%+UMYD;Gh{Np3L zuKDm^35>m({k^a_ZAHVeGGQM(-ZeizwHR@SD~pmk95&?pOw)Xwe$~}+1+O67C)bKO?!0bc;;~uf>_3rm4&{}>>m`S+=*;piWu+zPU3fHcOn zq%`VMGsngX6Vt}X-V>^*fFuffr>>t%Q{1|38}wL5j!Y_?BPc2jR4snjF$ZD^g3|tI z#*wC2vMgm~<>;sL?{izSP5VUJZl~yDQbj}ccy0MedSYVT!W0Mc=+e?lmSnTJYpwZv z1_Z1u_1k{~(dr())%Eu6cO0!~ie_Yz@7L(*%+^I$`=&xYqAfsf-^9fCS<716wh3Ft zgRtb`arx1sOW3Nw4sfK*j!+~enc;R~9r4>mAMy@uShgxKWzhh3kQQ-;CAZTrCAa@sgU5K#`l6FzJC4qX<=xz zMHOZI2Uap_`_cG^jb&fdvp^Mms2ne1y)MFf_N+PT(+F9^{S&?OtBMjc{T}zKK3fnE zMczlZDe&1q?u;i$U0s88s%C`j?V>T@D(|`a%&Y;t;+$NNo+gg;xi@#)c9r{lxpY4h zoi`kpxm>_Y){!2b-tDP-oKAP*Zqp?#ye~h021;vp8V`xpV*v9`Wua|-@ zpylTakGnr7nVF#u2fj?yc2r%szp&jF8_Xx<#McSauE)M8IDO;vjJSl;v)cqO}Q&1Xb1jC?vx6ZzgO?N)Zvt zupwEQHOLQ>nwQvNClr{FwY-1o)pn9x%^h|iTO=f}6uyLYtqmP*BTdK5)Z(jK^Q*JX zinVbN)O@#|QbLG=ElBU5IKVRSBTy9-eYKPS^$58BdqE;oFoU$EZ8?QP9fhV^EMr zNZ!QEkbg|3+>buwD%tMk(n{9wTt$iReTMXoYA%lC)z$e~ixF~^CHL<$-sTI$02sMX z-(T|__+j!Z9*T#rlJis_IoD!PImfB+d@!V-tuw6jTSZdi;pQf2yM#7p$93Ot@Y9XY zwWOr-)J--HdgXSVY>rZQKo0PutQMs?s=Av;B` zC3twC@{iu~{;+)WGOABlhdUTPeQN*2B2a`(z;g6@kVqBj!8hRHu0@?iq&iUJuqB`^ z#ULa+{HMiRPB(XVVIfPkj6WFDJAWtX3K8c^S4Mxg_Nzfhd(-Q~X+8n*HFATL+s zfoa)jf#CC_HVu)NCE))+&prwD$?mmQEXswG;o%lU;-IP4M4p&&ToUmJ^NJ1)^}-H^ zN=IpOE0|o;zxzC;c~n$%L3``LS|3h0`jAf#6_S7CIJx92^}!^A`FwbLr-6y zsLh<3@7Cl}(%CuOo^eK2R-<3-hjp6O#6$2;7gHXADHURfK-!WdiC~$)#vwAc9EB=@ zg2Iz2WO2IKl{i$(&em-1h(*6TiPEYKl<#%{pR?a4Pyhuow$f+AM*Q zeI$p{Y$u$MgK`j>8K#iC*{zW7Qr__AedEu^$Qpuw0s5aGc@?An)Zx}MY^1`moi3!3nGw2k8$Vs zf<3&v7RX@5B#>>oSsmT4oD{yaPEt-yhH%vR<4Mm*b5E9Kz=Jb1e1`v&ZrvJhNm}JR zzCR)+rXgIW7f;Li}TLDmUbOD@3453xY z2;>O|%{zabLz)ya1rLTqG6e-EW=WxzwqVsX7>$7L9INU%H&{E)w+~VF@nB2RJ;5v+ zXyC&>sWQMFAzV&__Q;X`p&>9gKNBBhLP=R!4D<{I1@|B`ViYN;^5>&jP2SSo3>Gka z)pQW&MO4mlaUJ1~^dC&}>C6^-4PJu=poMtvGQ&Aq2jok~ng<1AFe zVNwhlx%?*%{dP$S@X$v0Rk$CVaN`Tm1eB!Nr|*6+%WZhX?zx`|*_8julTk5R?1F-9 zXU{6G0Ms}{)H5!56qZy}JYJf)FL8W-`110r@A(GJ4C(0=2(p}lf^hX!M>gA3;o7`FOy1r0Fua z9;5v@itLVcHt*eQ-f~4>-{z!3LV0t7=B+rQxpo4&3B_#>Dad7&S_+3eg{F|bI;{EL1k zxOe?s7P7HZzuMamHV-5-0UcUTh7Dh%4NEL(M@7}%J%zRYTV%QC-bK*OwtbxyI z!4dG=Hy*ng;$B>MF6A>`>DRZovS_dgN>vA*yk1&#GrayemV>BeH#7JG z<7HX~HqYqctx&b@g>O9c)sPxo)6YjWL~Qf5v|J+sEC0;LKU1{rf{wi3!@;n;HPOuzbMN-Cohqi|jVT5Ivu5_@{rf*wN|fqK9z08= zWFEIO%@0%EQSm#Y%8SnXCztU~ThNSmPDvtsVWF%H)dw54y?OESiqNwX#tV<<;9+u0 z(Qcee?MAAj<43dlCX zZG8w)GS6Nm+r~2{2C(J&s^Lw3cZ_JTu#khmEzOvpJ(Ps7;LV|~GBnr#BJ9|wbM9$I z>NBx%{R9GnIP&q`yLN&5w!S>!A)#exn4nb}+7wHFxmlKYtFM)omv?1MJBNiuWoI8~ zzC+w6-A}>AkdYzl%yvIr`4?=c4Q2^)S4U>>*Vy&r+ErBFH$As!>)WGRE>wbJ|&39e_eu{oNQ($=SeW&%rZJz#3dzV<*b72kb`~} z`}beFPMzqXVXcdsr%35ULf2!M_CGFw)ks6>(8%5VKF;&!n;K_1A3lr{f2HL6si6lz znc`NwEjhgkT)5n*m}wrhrQV+TfQp_968S@i2C3gUI}4 zf+1gi=1O21o<21_8dEd43;ud4uHG@tLptR3`UxSt?t@@@y)sYZ5=wF=%nq`8X0*x_$z>(dGpARg9ie1H-`wBnww?llRZ0I(yb zChPzEH<7{B+gnGpv6}uV44}M}Y{PcVpxi^M&thF!~9e0r3DmvMX?( zoEf|f`6UspKee4RUK0(0@s6j%uqSURaosmE(IE)&hmcYS(hh?5H)QBI{nR4x2SWE1 zuvv-+f)*CE;+(wPUc4|tUHMQ}?HH4`_GRd&6Dc+uUX5^_4JLY517KxgDgDeudE|(i zqN0|uG3UERv;Y=;)?mS9*(PH4nSf7~UV- z4%-RhIC0p>`f-2vDt=DOr8DJqvK-F_9FS#*udL?BMhg>@xuX>%eS{Tw&6?wK;US0~ z7(U#WzkXU&Im^Cl9RV6`9S}}*s~y8-R7;DB-;Aj)T@4T43BlC;4k{E?zFuCJB#`_8 zkixqwSuc>(N;5OtrkZr;WdIWyP~@1{Bb!z*{fi<3~(cIyuLBQ{d{2fNw z)>AqtLBK!!k*&P`UHm*jY&ZBr%X4Rp+kfk{CVxbUMa0k_ALZkl=n=QGw%(uR>+OAC zSJ}8ed`AfTo&-5!doDO;aru?k10r)-?AF|x?OrN`lzxG$Q4P_$mn1?Aj@wE?O_*_f z^W@b3%eK@;Scw5bel2B!nMouFRYN@t;WvsDqr1?7{)~WL-p}_f|T7cP|-5S#}(Q;(hz`&i>X~u>nfj= z6xY-{S}rA@PnuexxrS{_sHK~B8Fl4wNpOQjlbA?tP{8K*1h;y2WMFAQsI;o8CB61( z?-k=(bvPWMH+Pxj;zsbVk5b@+162Ob)m1n`U$YJ90-xzGij>ZS;5PJ(3MqjIr`QhD za(HLjhwK+RetZ;^O|-SIC#QmDhiPj9ZR2%ejo@OSWr`dZ)@lRGq^zuVe&@BHxaOl! zurN=)9^~c{E=^l8kh_P%Gt+v?$W_7AYJBA>m;jGdB_+#okb72(qD6j8ygw0alx8pM z9fb+Q*L4T_aagVM-v@QV)m39@3-*6zK{k*8S_n>_a%udq<`WXqhmsDZ?|zvY&;%}+ zK%75pAfw!(FgW*6mW3l1;Vowd(pq#qW(oXbO!H#S@OOU??tR!AT)Czp_ za-RvX5otv`Ux3~rZwL9+dHc1UOmu>&jGnp@6839DWkm9o!|(~b@54F`m@^Q?6`RNR z1x%*N zd3#*7TX)rdw8P@IV#_+oB-dH)t5#N=)H|`^AKZ%_QyFQEHAvj)W(;V7md<$HAlvcJPy0X5A9?99vf8ex%f|8|>+qJ~ z#V2bkXDqsVdQ@g(GBaTvr{w$=cjIo>oS3}otux=c4FPlBy}RDHr}g(IjLfl~><)CM z{5JT8lIi!Q*j74zPR@DFVqX3Ww|DaiT)4fsP!STRyvOrsaCCG_)Q8@0x45c4w?OeL z%LCrZSlfX3f$s?|ERQT*{r&4x47Q*%`(-Ye{bUb(=`u6;Z}}O(5Ww+ileSjq>Z%Xv z+}E!lHC%4Uhje2@YKayFJS2{r8 z^Ecnn!C`%Pem~83T+cXgZ}H#Bk8^*JpgzdA_OA^qoR~X$l(Nc1=j{1I*-yOD@gCaA&j;i z-&=E@sCS1wjEIN`h}yG^9_4*-2LX~im84TieObU^Cxp&DO|j?HGfy|yEj_O+u%mOg zm>O%__v=;Au~5I89Pdae=Bf5+T8?FgQ1v^~J-!eIAD!#h_guejI9!t*eo;#+6uRr^ zGdp6K8Hg(G(t+ueMD)y= zBpBgczC87G8OGi)9$w;6m66GKvl@N*%q1fuSZRlNd;5ikYNd2UdcwQ*##qN3^c8h= zH(OhWo!`#PR3JyArzgw5*&wN-BWq%U6h?*2Y7s6x1AqSlEQpLep%h#3NM4PDk7w54 z{{4i6gt#Bictn*VZ>hDzXoMWYR?nH3>^Bvw|M#a*^v<1$<+<4i!ChjS*0XLf_z}=@ zA@QL7`6~!!Lo$+*z1{g1r%t(Xvo1aaGf?s7`O%vD3>_BvA5^`=WR z76mU+cX@73HI3t)mshYLIl-l~z!g$86T>!@#lxzJSw;v;lmoSTUPA5MRwQ+0^E?ofYq*IR#8$|FC%ycAhmlQc8^XZuWt??D{v z@NlEAiVAsERsA55!k=QjFgbxfg4H~aIat_w$569_*1mZESD>5aZK`&2a`{+i=k1qV ze0}v86sLiy!?!?JSNGlPorIe6AlvM=^!;i@sh=gPFDiV0&mPmCFP`Cs@7yWCv-jt{ zv*za9c6xUq5Zm`*sWa=!nM<)F@0L!iUoR zrOHT#9q!_*-|#f_I|z*Fgfl^6tJG1| z#764wreyF`{*?sdHTvfCFZdlC;kWb}$nFN;`m$$5T1Mvbc@FMcMS68oWvLOk< z5|YKRDy{QB#yvA$_HoVI`^xj@ImEuoJ2T5vVe6Xt`iPm``@D6v`|6N{4)+y#Nao}` zg|`A={3x1(2UY(w5k{7<&&x-7vQO%zv-5=xfFcmt_^7^n|NhG6MkeT4pkYVGa_rbe z7z<&(!11q_uUu&bf%e)pSFKH_Fap6XEv-w#ek}A{9wv0y+RnGO_%dGjP9tcrMQmF_ zGPj70xdPPX3sdFqKZw>7F9-nf35+zG8?~@s%kb47sxQVMv)|RmPkcD4%p>qE9flW| z8Oe5CxNJqNX$VU5L9-6*(QEX zT6%xuoGk{xBUi7gO4rzc?obvDmAtFr)Hn~0!bN3=eQa???bgADs?iP(jpxtTnHLfq zn#5F9g)dk;y}#-2x-YvcTZ*_L8jf>uy%M;0_E453J^QH#S?RxToWbu~GvT7d6uf0n1?iflWxqMe;ub7MEXgkR$=>P3ix&@0bUbYu{I4wT)2yQ> zsKhusJARRH}E98*6E+w8aa_qP#n>i);1C8W%Fe!j%>6f+4WyMIbXV28+7O?&G;_6@)F?V zkK-2zu^n(zK!J&XwBe%o4QZ@IU~0VBHB(TOg&Ou|B|jYKGGbouBImOZj;W9uX#x+ zZYJoQCfOMUBoV?-E!A@Eay}i3s~`}B`>PpqANLfDwK-W%h{#&eI4H4+=E^@_`CG~k zbk%M(^9HAhJ;+aD)3LzSVtP4>wF+BR~HbN-TJK zg$fc^jo1fFhK>L71yNbj>Mf(r{reU7&UWU?eQRLYw{K#I|3%@q_RXyGD7AFvHnDQA zw{PzuuYUgp<2MfNed*-n^nW4ov4!DsF{5~v`NL7k(p}2)Ad2(-gKXdy8C`?8tZaXL z?#k~+RhbskpQKm5?hc0EeD>2>x4ync8D-@U<3zsD(FfQsgI&4)iKd4$H@Jq}yIEOn zn&Za43Kmx1J6|XxJrhmyPuPBqmyN9p`z2fre~Un<`S~S}Lc+7Smjz;$tSon}_Ryn^H7c{Gb6uLPQ-*1@uIV8vXXTi`Lk^WcnHy2(fr3+4uxvu)M8VbuBT z8770Pt9wAuOLfU^eYJT9DQgW;AVQ!knCev>e6#VEA@?6XoS7SYb=_n4?vqVTtY~R- zzt}A6Xk=fH6Kb}Gg@$6N^}EsT;yzQ2oM%I$?Z5p`ZC;O<`wU!Klaniog7{9HfYu^O zJu8#AQ~iPwLsnPU-CjTAGwW}CPfbpIuy5ukKK#hG`hMFLm7b#e`}bQrh|4fzkrGn zB;ktE(rf!S<02tArS1Fubu8+`PwHT=)sf|CH8!01WSR+aL9D(ZC)-vmZ#X^OQz1MC zb1T9H$;He*A_&8UVzhzQ*qX^w{N>7d=LI+4tW3KALi+`%p`pX7q-hKO@L2sO#r zuC3J*yE;zVy$=hcI_6w>J*FY<%a=lOkIl{Z zU*61Fk?$hal9VWr_C5dO9NU4oan18L0OrW}WM^N#7i_Ge(jR)wUR$TXhMpw&j=n{eL;03%?epX6wtZ!t zsfMwGZ-@)mHP(2E zDL{H0d-os5(8~qoRF$(Ich-9tm13YPX+?Y# zdWz%YV>raXm=@beR~%U3w-3h@TNv8o0Dc07!bBIFLh&PBHeTKY+ow-6|GSA&FL4vk zp$z!^`Skm(xmFXMFu#QY&Yfw~l$(%z_YrTzJ6&|P-UnyOU2<$GN!mtec!j)OzQzWV zRIYtkbMuf1#rpd&J(0^9wVn*`Pg*{syw2=sPPIum0tO2b->ODjPR^_~`JMR&yhor) zN<1$MZe^bm<)uA)+?Hlc(3AX+#9rfog~tQ{3@5V;utZTsEv@5D`QY&rZyLg<9IRTW z{`uAF)vN!oemYR~b*!z8*!=W6dEh{y_^UOTmO;#_Eg`WNd)Chl8W9h=*?}KVMgU}8 zOp*5IrB(XWoo>@s1cD0b{)Oi*ESR$9E4^)-lg*o7y;C?C zJ_iI`_WJKgRf+oXV=Hd)oune}pK5%@B6CxV#bssI)q%G#aMj~1GePXvJ8y5;x?e^e zB<1~xNEO1}(|g=kwp#o3pvR$vx4%xZIPYa>H(Q=VhhL=@{=P`+o%8a{kOv9~3=^vt z+)0%jyGl?3c+S;+6}+0Qr~eJTk{tV>f*!9xK`Sn1=2zp;-r%))TAV(1EdTfK+tM*P z8fR$SaV?HpMK^v-h-Aaw{VK_a?Zq<#8-UBPw-cZu5j~m*x3tVJ$c^>3ONTGajg<=t zso6fWgl$>?k`<3J7!YBU`QpDQ;z6Q|YjOyO#~q(&?jVw~rgga@;$^BFV({!rGd_sf z-I-1eKC!X1?jQHl)2EsAKA)M9&g|W|1~Jm&P(ea6H*DxIJ$aUq4Yg$cJ(M6WOq;nN zA^GOz%a5KsX}R(Vy<0v&w7h3)I@78nOmwyr^p4>2UXqb&X@`N4=;iCn^>ogdc(RF2 zO`SvnKu329^F&yjPpfbPxO=|w+-vp&FL>oV`rg|+g%4CT74y5Sg2EbaL0;ZYDN=8Zc>wYf-NeK>D z?AI2-f&Ut>mXWJfs>G4zh^HHJLru+ex?gh`Gl%BZje`S^~B>N3}N!p)m5v><;fm#+*Ray zF8}3vV$lln@-bh(=G@D7-WkBcG2UC@Yk(1F^Aj4dm1zowjd6`pU8si78GqA>&S~sv z{?9kDa2k}w^1%C8o1E*!hPswAGurZQ^Vv3pg=xciMBv!57ylh}4R9}2EwVoizY(B8 zkXY3HZ%3nqdwybbM+*yQ+q~I_`Axg>{}%x#>t|-TJsGVSLh#Tb-k7xbiT08btNQRoSQp?7?$(7?;G+PVN^tS`m0@NFRL1-jZkB^i zZ+pgJYU&CY4Q&RM;FH&7WCl#xrDbM^$eHN$^~F6k} zn;_OyR8)XmbD3(h03oOZ{P=MRr^C(wCKeXMGOt@g3=`e?xnz5j51Vt~{0zfr*7N6Y zmU|nn_j(?9Iu~>EM*d|XJzl`OFvUfYR58*#pYo7d)N+)NNhF^m1{U)bBf~Fo| zlQYmjcg#6+h3r%KgYD&1Ei{AH^&oMDVnF<>hEfx(?Hf0#{ z1rm~1OP;u)jS+H;H#QppSdjx&0TCi1S)L3Xz{lFe6mY97h8r63%$Dcld3fU{MCJ&D z$~RdcV6ErUoc?{`{?C5^FZCZr)ncc}!jv9QAi=0ZsQn#LNjzJdlP%mq6Xdp zJka~?L44>np)gagEPF7uc)*+_>ZPM&d+Fz59|GIwZs-E88)|A;Jx}?Ycc4n7^NnQ4GpWJ=_ z>h<%tZux%umiXokG=pW9qbI)QZ){8~iWBVYT?x#$<>aD!zAc-Y5*d~1iUpWF|1l-y z+P2EAgqngBV`E0j?>0ar_OaOjyin56ka}EJsC~gH|H2bf4E{M5OS`2cLT(6l*nsO{ z|9$+JR$m!yS((guK5h}A=C$(+;oKq)AbaQ9(U<^7)r$TeExU%dI4*0>mqt0F* zP3r3|)YkG#dKP77UODf3&eAeU%6rnyZIC#khWKLo5Tp?q8w&&K*E{KQzkdfZ5!Bwk z)!yFt=~MTeemjr>eosr=wRZ-DOq96%?jI$1QVsYVDVZ?mm1fRm+@Yowmha@W=LcX{ zivLn1-I!kzEOJSFBJOs=G=kNChg~MC>`Z6Uz;VQwqS{(m2DlYo-z@2fKtV`XzUMUP zA$OA87(`hQ9C-Ha`?ozW(=UiCd7qUZAt8$oaV*x^Cz7i#$j16|-@fU_E)9#{XMg31 zy@Y~c_vSMbGjC|TMSdi5qUc}OuO6=|zdjJJeF6lt13o{Z)1$%GEog6_oa~u}G8?H! z-*^XmxU72N!1V58eSPg{iD2m4%jfQSHG|uihXL%ystZQI@DWag|LuI#YddzRCns?g z_ip4@Ij@R)VNacv!Cy-+!TtXIO%IRR(a{P`%^TgD_m@o83nmyooDmiN%6?u2N1ab~ zejV?iG^oGQRCn_xn!Z1`^B+7&RkdqU+?3;PMfS6d(}Mn$58l-oS3hD63u`I%)D03k ziJrjP8+y~YxDhc`?f-EBxFfbZ*p!oI7q0rr0PoT>Rb*Q$d+Qatv3xYuj0%4|Is8C# z9}tS)317D%Jt6q**|u#gICvJiyA?zdXUdD0HH?hVjpYQ@^O)7NSkhy3PVCpe78bH# z#$UFL1(P#Onm=wv6%}eSGPk(6fDpJ4d{n2}jHQY^4#O%G zW2I&Omll+>`EAYp*U*rTkr|yosP@lNiD=wZR*q8UtQ@LmNlBJCPbwxHwU;*Jyw)xY zwUvK;%?=JLY;x8+b~sc1>^&g*l%_2sX}IKF5u04yk^O{WHd{@xsd^uz#ty8KPpmae zh_e1nH{` zxA)4`5_(`i%q8XQ7&my-`NWA5=>F-Y`TxBKy$vpDr`A`u`OPtd3iA9sT)wckVr^t?fwjP)h1UfS`8FB->z( zc`3hu-)NiUu2ND`sk^B$h)|S2yQh=n0#2n{RnN^Dgom?s&~C2fZjwiBGzB_l($X_@ z4<=z&*`B@pXm0cz++Fwz77$%kUXe4ipR#rw76G_sJ9EOVlH=XSk6$?Hk{_?HEuX(| z0iwL=e|^HvZvm16U31-hj9YgzY*tjU5|?*Wmt39q(KwxyG`;KCX(gsTE5wjM2)@{u zmd9zbFxfsmuscXD+Y8Igx4LWBFT3zakr3-L6mOq31y7R)=k1G!Et5*YyjqyCE8n>Rzch!$(&AZfr& zZvsG>gvbSgm|1f|@8GvaTSu7{KpH~UkLCPAE|#Y~R5(hU_P(p@94=4qwxAWm6Z9|_ zrv-=56_6L?@bM1}EYxx{co;>RhM}s(1;y%2G^vd8in9iV042j>)5wDn2YrL zk?fs2Par0WiFy6wM+}Y?PxAMHfiToinl+WEN9C?|BY(N`4nIFFYtr4cNs|mU`*ls^ zXZ7`!RaHMk#2bU3#PZj$@GmBzvWs1Jen|5VBV&E~l@(f=adG5;WmCSN{Z_tfq-lqC`RYH|x*351mFwp#ZMnyZGI;|*+!kVHZKaD5j9Rr>&MLT}rU1qinSG;e3UvGDOmo98M$q7rRlfib)jQVP^+Aa_-^7le>3Anm;hT z=$N#3XK$ZWlMg3tvW~NNZ_lr*obj~Fa{+6UJ}#NrIYG|U0#zSRHv^=M5^mS)jua&q!0srAT6E9bYre{b)Jret~tg%ac>59^;v z2tFd6tT%YWVtDKN^$Q4s`0I7_65H{lFI^hP02u{N!$;D9%7^|}mbc4|cONvoe}nFz zB)yccpGtsWv7!>q!?OgN$i1{oVbRO?|7qR5xW(!1UQyAzH{SI;-)6qam_&C4lh3OH z$Fg9ogd0`+=Gj0M8s778+x%{~y7gQ_ko^^E)Cx3cpO(;O?Ptb91qRQOZ(a$em|R)>dLcT+!G2e^h-1RF&)2?ot#%DMdj*q@)Fu z4gsYF=}wXE4y6?YBn1SdOS+_y6hVnacXxMp+==f0zxOg2dz`a3i}=T}Y;eIY z-AF8=VYs{M+c#Do9*9CJgIP!&sqnM*se`2a5B#0PSkb9DIaL61LVl$AM3n1DmU4Jb zd1<9dhgNA`y@pd4&OZ%uA}yG$(~^A?^m%=4PXR_th8^pN+mtC_mywkUkCD$6h8GWS z3xHuT2YWwm6)z{}?tGg&IvGr~h&UL{%9r^BfYOy562eHu!vU4)BQ?nfpE?la_~5tXW|0d<`1o(Tdk6_QO;KZprfLKFfY%X_nAg^ z5H8+64HXq1*O5Pv1YoeAZfMBBV86VYtqjCWzLX$9w* zOs~9-D{y?UK{aXwvu=&wqG(aM+c1G?D24X!EE)`NV}STSKX=c_G<#%3eRpj{_{9sUPIs7o zbi`Mad4cd04((Wz)4c($UJk!I_y=3(XZT=$4RQ0ZvA`4_bS?O}xY-vspE=zr41O9*5Jp?YT{u z6~LBgZN;dtH&tFjK1XYAZN1zB@bIFdbj@-Mjg4oQhE(OYM?P*1>B3hF!OeLa1BV7%{oz*vVw#`XU<4GKL| zfxH?Ol|Ol!y#-zs6?02Hm|-_P+%RZqV>&y_c%44`-TbxCh)tkFf=_Myyu%!z0?Ojn z5ppPRSngx|*S32Y!D^11aCb3jqyHcVJ?@n2ae7+

hlrdVE z&opktr|G42{zZV)(m*=`1YJ1HFH!LfEfD<$5Y*(qF1p45bwQ~mHY9(S16u`LHDP=Q z^u)2TkvJ|~5qn=>(xfCu(SXGwy=IaRj+BqS!TZyGczAKd@2^=I#H7jn?$AnF04A)z zAWSuLAL<1@x6{z!&Yb?Mwf^{)%7pCTdWB;%`Ev-92oG(;2k+szOJCNQ*?w7!U`BKX zsCQu;G|=3f7IX`8eJHuPgK)Y_vTfUVCu#yyupsg9S|F&3lCZ$PIy!oO zGWl3ZM|+Y>z&E(#@#R1GmGiuAwbwZPu5depyU-92Eee{qJP<>W=&2pi9v7EkQVirZ zxEoNfojMkQU|QDeGt5HZm!YS*ac0bbR@U*7Qp#obDArb33&eDkKiCaZZ=^0eAbzVV#0u zw)~k5WlRZRc|3DD`~VI6)Pcj|CXyfOunB>yaWGVqe;tFDXxI@Ht_Jy%R9UZOvOKWV;|g(W`)fP0a#^Q$%@H2QEHVQmtK6U0?;;o) z(_5wgy8L;d+N=)h!*DWBQ}dF?)91WN8k*%tJPIYkP~`{3h#@ z&h^fzNG#&ji&NX_Qu7xI@5543*vP#d2k=3uu`@0U zl_L@m19!4yVRbYz*z|vbh!fM&V!wVReDEMNBm@SxfBf;!6cxjlnUO#{MkjMUE(esp zuan{F7OtY<;?xvfxhpw;?GsK;ui=`FIpiRe4G^*iqmXC3JRDL#q%Nl;>Dng86Dehx zEd?-P0~m}KqCdfG*u|w~wz8GQn=BJ?%l1Wkqf3|tw+n4V@pNm*pzb!IC z5E4s>xlaYcb=%@9n=;C*T&`iK z#ZF<9pHM?^+Z|HUF71R+Bw1KUvE`GoTGw8jE7!Vd;xokyIetccqpJ(=$*-9$p+aNo zf6GvjUuH6rSr;`w(F5lfb;ESi?X+k$K~xl@J9kG%S^osJaXNj$kvrX}{ph$sx4Zbl z@xNgrsn_QT_k(y2OBY~=CKEoPrgrboDe?O3deYB&&XV=714ksjjN*59v9P$}S(gZf zy@K@jf)N1zp(95p1Cg?XbVpXN`Eu_R)Pm`5kzni%!Lf1zO+D$B8CNe2Y-ANh;1*0( zLn9OPehU)PRd5Y~$I9pI;1d;<6cmK2I5|*|A_#w>J573}^9h(F$X*c%ShQX09)r5N zaEKBpbUO>dAgp*@WPnZ9(ArA+#40y&6j`4#Q*MnMTn(L^{0v2GKliPKj&$*1n2E{R zO4mKK3!}!q#|ncaA>!{tl%PpS4uWYOkkN<0HUNWA0h!AT5GsU-1I4toh$WxRMA34> zO{Ln2!+v#Ao7Tky4DBGNj?7CYrX4bw2S?O}goJMSwSj0yBw!Qc=FK0jCoe55Y6=U< z$-L@mQy*XQ%IN^!9#yu3W{CJQvdM54O-3{qvc;n-_!eXwk@>2YNY;OI*L zn2Cu;&)3H)ptpB7R~;Ky02O;3s=>QiPi%mXTYIVlx|}*Fi?AOGl~#t7N;=()X3ekrCvqpKzF6$`_V;1}^7Dz#+sx2vHmH@aR!sm;g(t>nuRQ4J0Tk zUk-r1EfqIRM?oQ3eY&R{3^EK^B85^*%MR@)r>8+O>5xroq@5^;1}^!YnVILyeUPF8a0MZu=2Fa6Pv;4EXxf4-@lS_D(KU#Y*quOZz}@ZmFGQZJzEHa4c?2!MF} zaaB}INeQju%ln{;itO_Z3OYGG%FfBbC}9~n5EA(Va8*DS%H8v(PoFYB=;Gs7!Za1F zrNG7YfQs5Z@129CWv#G(>8sd9*OUFQif@!&m-rTRZbb%1ScI&XWCNIrrIgO#j&t6sn&k!>%KS6^>pUIe@rmQS~$b|l>C3v3WNoQKt2@N<}$lU<$ZtsMkz&efqSniN% zNW(hNT(bjuC^Yz&T+*q-Eze7UOvk}N%gt>H?sx@)M~Y*jTf3`Zyg+y8*Pr7(ksmF4 zatK6l0N+AQz|bdkzu3!wj)zBDQ*)@bH4)1-rXpK;L-{PVw5*KOtIAn9-JJ@$2KYGj zs#u>qFm8XqmmrPy25fOqQQ58NJkoya9js%gh~f&+ffEKcv0NPMr~l@`Kr?F&Q})4J zF@N*sQD~RA1aiJrH8T1b0(bh-(vHaqaQ|Bt(V0NTNstyg)F49`p#c;1{rd%e_j5Q$ zff79OGR$qQKUXui(!#_vdtu&$?Jk)T0jZv5V-*MiF&P;sxNiv^7j(mFM zU+84F@XU5Mt>QSXpEwAct^?x$Y)hmaZ{DV1U^v+%`>|}10mE?M4sVQ8o*tVrMJNBg zV4mMnPQO~~cY1m{QkHp3n;XJt?WjD`MC$q!`^V$Y_8G_?^^FkyPfBlbrBz)5G8d;= z2D%;Kzk*NU_{2nIP+7o#Z}szA4ggZXwd4J9&9X-%9_VSCn!q-=ft9nhzYnyvy>-pY zDhJHPwSL%C`1#4TZQOYPLduWakZPaiAeOyMea`iqSD+g8!*(rD|6XAB9XNcHlh0n7 zkpYANkV9%OumtYwG>3)^;4PTOYdwShL-X)U`C*w_J~&|A@_Pg@%=3GP=q)2zl#Gmg zZ+=YzTiHbSr&^C3KxCO~ORQ{)B_)0CN57Nh9trp+>uBP;&oGQdy366`$Mp2X zw{J_L5pWd-C!+X=bJ}NNm*ge@yAA~5v$gPV5ju{y=ir|qk*2@M9tak z{u*`d1)m;V;o&VBR|rXh8`Vop3`#~gM~0){-1x_>FygeQ+dN@4#PaN*_VR6RHfB=k z+{{EoKhSl*SbWHfme6r_TrxS|#$N3VEP%i7MWSL@M8utDP8UA+zAR0sShdP5w4iwV zf3_tPW7#w?o57?Bczs64ATdBeaZTWLE;1dk#-rbws&5LRxTt#D1^)ASjF$L!Da?lo zGcri*jT_nUKw&etU72q^GVe@W zhb-8eH|^El3HYX@?1fUg_ZHaZ4wsb;^!1&Bg@vb+AY4gpdjEAIyKpQX|alY%NhJbYtC2@<5*i;|5&a;2U7>|s)gD> zTs#XhM6HDLQGwVtH)mflP7Mi?ddxdJI}(s!fJB0f15gbR1kKLXp4?Cy8XAHz1TgNQ zr8F@yiH_#qnSBD&jqq>?7*w<^tEzeiEXXPSDJxFnzaNE#g)m4h3HtjNBifMhywngx zmy~`G7EF_;H}eOD!{YR0A))qQNxr8(_kZfz@JTCiKslZFmM_8njBG4oH*1H|q3V-{ zf9+H}pX&_Bry@DPuu=wYM=tvu^c*#n-`Y=JNxJ7GejLVD1x3k+33@m%pmgB^#r z+LGg^%kh_U+n7UihX4Rua9G`rLZ@c+C`JR1{mvKhD^V3AzmU_?azXtDIWG|mBj5vd z2Al4~2lBgv9HPK`0%cMd)!FdXo2Mq)y1Fe3JG#2K&@C^v|6|@T$gC+pxVbSlbMG#W z0GekK7@bMC*3E34gXJCa{OqH!@COlIbLg(eQ&2GuKV4A|XQU8u5qnkTvYDvd5zl59 zQ|+|Zbqn81owc`@yV$(asO3u@F*mDA>qbjk#{rL>FAnq1`V>|C!`lLO^KBBbJdrQN zroyNL`A?ug27zO4M#kIi*=F%{pnb!EfKI0SCx8H&jKi%NSUx7iojpA}Fmbhy8iuM2 z>ZqP{>5h&Ld<$iHd0PjEhflOUJ~g{Xezmo=ML|K?7^|cn?E#rib10=Bze+!(aMX2n zc4jN*yKP)$C7VS?GTF|z5^&kf`rf9zA`y?kSre3MKc# znqyg)2Ee%lR{$vdD=L%enVD%hqf{Jaq)#?AF3vSgGq!Ne`oV%tv7>csi{z4ohz4sj zm98;k-}R&&;+a;dQ6JOLRJfj?lQs10RE9T0lcbEykR_wlOA^Dy|L{rA#WoL$W7TF&7ZC-YN?%^1B(IC=0AQ zoL>f!Fc-K+^z4p+nRy$dR#lrpWGojhyFq|*ic6viFazXn0Hb4duxmswc(iF1OpF>N>Xz|q}*MIxxdkkY^0kq7F zCM*oI*`asOw1}P9vS7+b#9;yBzY}FUn51f%ye1mF!gc#f#fy4NYQYz#92Gf;vCr$bv(gg2MS^Uwc{e?8Gq}Nu8=3 z!@e!(v!52!7_%ohK{qY#FMS4HM=FgS8Tt8Rm5zo2 zVtRV5h593)hd*+0d-LY0VyQBW3y056nBYf7BJ~UI!1O?HO^?%Y-SQPxShHSxG+Q(w z1L-74ItUa!D)gG!m)FSOF^(TZ>~^JOfVqUX4?hzF13m0R=L3R1Nr*Z<4-=Tdg#_N+ z)yEowBd-cnKEayKw&)iRiHz*)>GAvY$#VBUu$!*8#`ASok>$lj4!cpO^sCA0cRQat zWdwYk8-r>bldzcoE-cYP5Wz@31xF(B}Mc> z(8uZ#b0u@XV;-~4Dtl9px@_}^l9hFLsverfT=lY>jzDHy?8}a{Lc-w+`O=R;Gawa5 zH_BLb5a;iY{6Z_w`2ZLNmj-Wa+wdv~P*_`CU7x5WAt8}Qvvzd6SSy>bv$ux;VmKK< zH!i|!n;oR1qjP$8X1ZQKX9Izx+hAZSzGl17&I^&>v&~_O3JQRVznyQ5az0p}TUY@9 z%DnD>gIAAvBVZo)GNA44ZoUB$n={;tO1UP<_>_M)5%4v()&_3_-ZE3G>dA3{$ABkP^zl^ly+lzBq<-D)= z@8bxtuMUO9BwQ37sWUT1R$k1$6lhv}kFs)zM__Dx15Dv;cg}g89w%^x*)K>L;^PBM z1a<^`Zlgcnsb5dks?K|<-U^^=j@mN+?mdp!+HP7MIft)(Jx-0SjYR%}!Y;5{KrFX)*bNhDD+buk5 z>KK4I{Xg}&ng8Q$0-ps1E1mVxY|v(!G@|nhFgyUVLoegxRDqsH3|N9V3*j#ozz5r@^uz8W2ddrtV!5V(fKFqO zey^x*k;LHY9pKG)-f#teERaaULPCg%PRu_6RTc~Yi0+?u6itG{8J!H;QGCYLRrn5v zFjlPFU81N})>IYM(ZQ(mIeu6tx438oEnY5=RDKzPInOI%1!AGYA{zR#C|>8*_BiBq z>?II>V4$h+!XF3^qgN@S*XJgNhI*!0VR!Vv*};ml#Bg>beF<&y^Gg_=;kepc80aeC zLlMtilItD!Xl=C>E(Mt02FCo;KB#?E+wX1Rb&cl6i43`I+A}XII^i&hu-`nG{$0q- z{43qAq`1nkExO9i_>HXW&#jqWDz{2c&svwW;jS)O0fFi6Ty>Jr(AIzew}L`KUaLgE zP`T8)S_6alDi0U6~o@Mp2~yg`rdDni0vs~!xj1G%2=Dh_w& z=&s(Ux&gbp*Ie_)t4|hx`$uk!)6&s!s;D2>J31DhZEP`wSWd*(y2aIL=cs<4tlL@O z08I1kj);Wj*~V}Gk2j9uD}zb!@$M}dn_k+wb%m!d8ksyC1Pr&{6Q}U!z`@?$$_IIU zeSK<1O((#IPa1?!h>1;Eieynx?=LRP8D0z*rh3&sefs1p@0$;s9t5hYL0eSh4Bi9u_@@K(( z7Siva=3#TJgnI;X?^l=;A$c<(;1v+|Km2mculjpuJTJll>B9PWJCrI|uBO{lg4?G@ zL;-<&4(m{ZY@x&i{#U~To9FgzDC7WRrv`0Jq7-l&&Q2r#f4>7Mt5OO41z%s2b$T>3 z70nW0D705QJ2KMHw6wO$%F8P$g$4WwXPw8g;7`ok*S!gr$11ir-c(dT&{WMo z>g6RZHQwq|O2%k~{r7lR7)2h9XJQh~D?9fogEad|CkNDf8NLivRb`epAPyiY_iRFw z5fq6F9UDN$0=!9CR@SU%zSc)4JCimagoka>L&nBY(7>y!R|ieJuW*@#IATz-mda6t zHRl}9z%?{n_3m~gQd07aj)5T)5MU}QcEff{#YPxH)&NX*tdpIcjpmLwMGM05r{=@H ztE*Meb()*+nbbOm_n-Q>)n;kR!2lTY50jIpfp;$;HdedS$(pNHk_|IkIMq^ke9;u> zcyk-t+hcLIkJ++q4burL{vE2PUTS&FcSnB+5{vaGk>+M)AFSUNc>L-WHy4jGFOSpY z&t{28xsO%~$oKN;b*6#reJxqHrzMXr`Y+>X=lFtl%ei@N4je6vD3W`c= z{@Og^8s3z}?KmD$CXL0_>1`VF>BWz?6jFlHs66WqUAvMKZ5OVk@IIOy{Ou3lu3kE> zkewxkaNzI=o!e}%$cKAzWnHRo{@z`@cD0ga_@WPdhItxCV1E)Q5y=?O9!O{DT(2W* z+1uawwdioeop2+2r+V0n37*5T}INRgqau;?w0^Ah_Nppu*_nlQUgo1)8Ia$Zejjsfm0K+Ws2S6u->(J`rB0+a->+Lgs{#uxT z3izg{F9Z^CWUc+tDJZoV6Gz+H+&ny(a5v3Eg?-J?mn5Hk@#gQ_$7%{aIOxe2Y<`44 z3_VMMvX5E!4DV?$VO` z>TFIKDdFfBFX-eJGxeBm~F zdi3aVna;WfoBkYRI`LqWNOiOn#;{PIcTwDnPq62`h3Se%$UQ#n)H_*+9nbG*>wxM3 zUKv_7HIVB<&@v4BUL<#kPho z*2f!kie93bce_WLTxZdpk>IdEJfBXN)(i{~SIK!JpFYnVh4?=FJJtXF3nh#7bzEwj zs8->X0mt=T;|7l_x6-Aluhb&TEM%{6Avo>MpCJZ=?nucY8`oI=i=GjEuPcx?=Z-k&du_>RtfB%goGg-s58xlA!my@w~YweS&XNSy6Fs`uDAxKsGkEiE@lf=+oNz zDZq zY}8d`*uht(24?60PeBibK!6k&z%-LSTJnDjqUP2OEDae&eU~>C5Y|0;Fu?(k=|kQM zS*?eaE)@U121me`B<2HTLG`k3qv9j^^iT$t2M-#4H>3p+2o^f1UmWTdX0L>+m#u&F(wm>n$j(4`?0BJX zH8;cRn$^>rmyG&VIl1DvA$A<37R6e*!scLR=W^PzHqxlB`pN&I7TY7LU~4B^IW_g$ zwOXfvjfoo`>uG5sPEH>-`e^7LM}CbS?rSp2^|{gfs~Q`Fm5ue0bXyGb@9uFvS~mOU zG)a>6u@z&B@t)CBNuh==fBa03iR?|Q(7{JZ<==W0$^wa+YkbNq?&0B~dT@nN?Ex}V zQ0d&XG5|k`#8AJ_=;hy~#le@|HS=E40@9Qm|lPWI&lekCh%h;+S}V*k9U9AuPD`X!GKJ?)QpyqF(NEXz1EF)qqfi+ zGTmOXJZE6YH6JOppIj3D^mkd{98UqFNY2Z9BB4Y>r*n3G@@IK@85r-hv{M{t|5gJm z2~faMyO^8bVCyPG|GPridb1;k`m&uB6$#cfnT{~Rc6v6M&E8C z5L%)_pPx^@myF4H?Oiscf_Ll6Img1FB0qr@K{<++`Ui|RYB@adVr*P-!larX8;2OHRkZ}g;y zRclA;CB9$!!>szKD2QMDE{7T~4fC`pe>A>yaOf2gMtVpfOISmq zCiGP*{YobyD>PKCx+zk|yp@CJ7KroCP)`r>^XGdMu(lVZ;^g9j z_X!#+&xYF_aXcK3>!YByXR9`Yh81+*SF{&9lcc1i0^0#qzJc|?*WVw-gF(HNm1qzb z7nj1bx3?FNZKXKI%c}!NV9}Y3i3u$0I+w>_-lD0&J~xl|fUoKW)OV8qv**dYI8;!otkjZZ%!122xlE z8kYN#cGJmSMuI2%u5bcHeo;_YC(=xaQ!g-&`IK zaDr}c>vx|9hQ>t>tY-eEq6&2(T-p;|dSfDv+H7n*w$k{>WpFjRirLoYDhWR-LX;>5 zZ*4H6_xMX%skg|lbZI@8*MnkSVDwo(rQ{uJ`1!NzkHOUO-edNYoP>nN;gZ$v zZVG%x#81B;wlBHYUC-=Gvn;nn$s$?TS&lfcd;|qN`#n*&uCE=dsC@4C<$9I2Y{;DI zvT>uX!#9BczzruBEl$gkJT)~}JqaQ&kaISi4;Ulqn-WV)A)V)o*TcEl*&q^rss1FL z&v0FUzF~H_zqfbu4@I*Gb4FH{i3-Ms9`n2vCv4;d`kJb$Sfycv6pT2fY)-?LfXILR1T67$DLN4x;Rfg%B%)L?m{dW2C+1FI*L z{#6|3N6T9!RC|u~#tD^50BL;uXtmP+?rDKXN1L&rzJ6=B9E53yegFRbGmfN+ii((6 zhTC&onEBnglQp8mKj};ZJQX@Rf%MC`zwRZu?(Wc8>^Mf@bcvT@tbI)2Cj!eQDSu&m zt`a!PuS3^?$f{a6yYcN?vFDAkEfmcEJ&H`48W*qvMIeg|ZZaGJ{_tG&$YMwIMSM2> zmPJ~5kut}7i^_F+c+B@-@4l`tXXP7Q$Ej2D-WqkN@w%)OPK(M#$&*l{PN# zR+Bs`cbiLvR7%YYRje?Au+Pu`SQ6STQ}libe@8;c)<3^uuF(6rIZV}z{S!Xn;$lPk zx6dkSxYoqtHfn11C|5k>T+>1}zRbPj#=JS*lBdem5vtNHM)1-i{1U6mgddDBT9C`3L3Gt)>cF!1Y2XE*8lto zae}uIZ&BQY;8ZGu*jKn{)XOZc{M=dS0HcqWLSgxbptGmu=O;nH&{isePqGwZ$v@XY zw*YCLV5QEaQU1KN%K0G31YJc-OA4=}xf$F&9=ulPNA-MaIbH==|K{c<{2)_P(|h;A zi;Ih4HlW7K97ecw%QHIfG9< zrMo;fJv|Y+JNqLh@Li=~fKPe}CMM~y&^w<3s=$RAsZ9g$9t~X!%l(^nPRNRIw@+74 z(tcD{s;KT=7>Ek}T}u;Mz(-C`9~dmCS0~<_vErmxKHu3l-wh&0GB8vY+rR(c6?aU) z$sMHk{&&L`1~pLIaA%t3u3j zHWC)yM~>MPWL1r4R$Fz7^cQz;Iqwf*l1Qa=*=%nsIPc%xthzfp`_@+e%N;y_M}h3P z3Y+T)15R$YW^$o7)?3z=mZ7>|!1pPy)(K*euvSLOrd-I#$fAz1?03>$4Y_TS`nT1b z9Bw_ev_x1%u?IR4L$!oRtjt`h_s1vVE&k>ulrqvBgpg6xY&%e}KD%zleW&@v&8Ul@ zL1V7BQw*xu#UIR~2r({|w6 znX!gZJ%0S^{QB1K*|$4p0Na4?@6dvh5#(bDL-sig{$a3>ftoVq1zy8Iv}R7zajt@q z!bGjR`?xEF_5I|4P+$1?4F=mu1^WRhB7qQ>al_;E)P;f~_w~u-crluP3?gAM7Y*sBruI&xQc|vhYMH$<=bKkt zjJm8=`@5}a!in`eccwACpLr%F=8V43)P!bFMp02tX+80BGYw8leV3$X${#G>O02!` zB<6{L`CReZ^xp-u$a5LnMn;x&v=gUR{cFC>2e<^4Z|ak$>Q9P|jsNeWdS|!%4ct@> zoR!~S-jutZpMoKb{N_!D757bIsHaLZeA)DTpC^#6bqn*;(M_%3fBdgvD`Cam#Lben z4R35H*0HBnA8Gn}AF)~KT=qs|&B*nMnb3v7F;j?vbqj`f@s}@|Nn}G`!(&XlQrXJJ zYjGdEir#y-F~Z?A_}ySZK9j}oeNcN*XXm2VHJF1D+4@OHQK3}Nllw~^;^2!iM#mva z*j74!*y>HruVNsehMs*R;!vt#>w4Xum90@t_4>8z3^tC`ZCh>$+~H3B$r6zqw{LIJ z(n9@3PTp4b;hP$T_)Bp*mis?m89*230`PjkFrnmL{(>ui@nXQRkonn39kBFo1JfBZ zNJU;ACQr}xyBmmR)joQ8WxS~Opx?_OWx{>AE?dcZY$id}9~Bb=SD`43wU2X(i+4jQ zB?v9tPxj5l#Ly7s5K@tqB`zkm$lAYb3-=h}a=H&5lk9|~*AQ9RZ|Y?jO~kacM6_y- zzH3-*ija|oyzuP5hhOxyHTm>3xvJ^|I8jg)c|3Eu;NzoNr+xx1T!n3x`OZ6brjTHqdo3_E1+_2@=14tP;H;1Kj+)cY2eIj zYEX@g%xEgy{&zZ{k@c1*lSh!&lK$(rT<+k?U-{YjJtWxvOodUiA}%(TO#5d?Z|@}J z5W_Kf=T0DN#`AwmC#m0q@<)* z#QNz|gm%GDs=mI$1Q+5vE6dLIUYkC%pjPd}-b#*=v(2L&J?)(Q3BO;ymyP+)R&-p# z{by#GXIfe-&z_0lSwLDAqEl8g&TFM~b%MXX?uAlX)P&sQ_@@-4G``+axH;-ppzr_31;9l?BuGqv4Uek2I>)G% zyu9F5H*n;6Bxj_j*K0LgpxX$%Be06f5QZKd$`atJf^hWYvcoY*+u!o&bx(#Y%HD1qPbED zC}fNzB8utFjoDJpyY;X2+P!5=HA&r9?YvZEh>+P|*Q8h4fC=$HvhWD@!&ZG}pI7l! z;9I6OKYt`F3~Pq8js-FJT@U?rG(F9uN2m2ZuvX^o-NR1cPbhL?8>$)a3)frFh>JUL zem7R`?!La<7Zb^(tSn2LpMmCfv>j|d!niguQBrUhhspDpPdhzdLv`7wO+{>t&O22mDM<*Ev79rOb4u>lZp;fl`eeSPVYD>c>jB z))~Qo3(h}LuSQgh_AQ6?EX-P`toRy!=k9IZXVGbJiGS#dc#`v)Uy~sh8v3jor25{T z_2(>x0BuB=kHgo_OU6GIOvlH=cYa;#wmbbB-_1=fG!&7T^-X9VfTM9Z=0Z?VeSLj% z9Bp^7F|K(u=j9pl@)8hp&*I~qm)g<#x1oAmHmlBwX%pBCyeUk|ZF=2^a)gcG_Y0I- zhy*b1NgEm-#(Kah^YSGv1Q9{y#>RFJ;f+OnY;FQ25)B<)Gz`E?OC6wSyTpRrPSGwQ zAhp+>YPcm>o=HEoX;@FqjU*+_9Uujhg#$i8%g_E)Io$2Wo zKfgc6#}hB>ptH$7KaWAqNfEH5DVJHi-gr&|WFC!j1Y%`ul)I^{aN!OV{jVW`!KE=M z%f=?RDi8@y+m5T87UpB_ZPD+{H3|QBPq;ng<8$PE0FT588qmL2rXcf^PCV`Y1BZGz_smeT=*7@y-~auA3qR8Y+CW{MYU5D0g>pR zh8zgKeh1iBmndhubxC574Z3c{h@$22Q5)li?9({}!66pP+fYA#iAx$VLIwVC-2 zX>m!mvVxGLp3Hl%Fff#WLK{lIOCmi{)vV7PP7v_s>{>Mm1`}Qkuk)PvI0L{99joJG zjlVt&PaEm776xw+Q3T9{A-l(N z$6^42c9`{BIA};=8MCt9MfB&W)*ti&EsC-x*bb9?idRzd9(>lUJvxLC$GDJ?n2;Ce z?VtSo42zH%Ty_;-Dk^Lg71=g|SP65JlbLyW4clY)fDYiGv0lad$rWkS3Q1wYF5TPgnMp{%l;+;ukGvmzsn}K$RymSrl!Bf z)l|J;0~vXHef{KQ_vu8{Pf`AVI&+ zX5uj!wq!>O^!%o#@_g0*?)=5bo>xDm>zZlpyT}n4`VhfNDNtC*z~|xHR1-)PxVsyq zRdt^LSJ0dU;QP{W`jfrIE-QQj?l=xRLmln!D;@lz*hC_di4qdEH4f&DQ}vb7v59F* zCdR6m4-Okok9t|(KqW3aqyGBUtJUMJnVv`{Y>*VMS{RtQyj@YUep-+upZ3jAA2^#K z0a3+Yde?f=sUK_HkNhIE7LU}+qM;2eDfBD1H3S$0R$4PTv)ys*C)~1JjhEa5ve!R9 z`RZ|c73GTd@!=K}c2%q{Uhkyjqw1cljSc~PGCBxg@)qWdIkm(311{~KuP;so)pkNO zj~zB@T-sy3!`y*22jPw_M>|ArRNbwEoaV(k=1(9n zJRw^wF@CKtd!RLng$G2?$ya464>dM}+ZZJzknK%PkgNwCGKil8{bzzVyNp<&N}jVh zJ0rPIotEWVUwHk1?%6YDDk^3w1NilA7%rrj9ckeI07ZP^{LFFqaLc@e%BTJZ2zEY6 zM8;CT`l@Y;JXnos65A&Em@_)M!7{l(a(}VdiflpzdXskBe6QYsOF;cvt;^A3cdDfp zsQ{X5I^UxLhj__5+T_QIkSUNlupf4pBevjaa_UK;N@`cvr*1VVVd7l_^H0az*Uz<; zPSZ>+HhJCF{vCvH8kSVT9Ceuk(~9Ab?AS4#WFH?1Q~80O-rVo&eBlwwTqJ zmR6GOoU<82w2>ev=!0eww=;*?VC5S@e+RN?&LI)W!msfI=AeLM_H7b^Q(> zavA*Fq>wFg@=Ej7rB&D7@uS&@FjNZ#(gg=oqtM#!Fll6^Mlijusd|C^N&s5leBFon zfYXCVl*DJj)seFNPlnai)iIiNu-qDhh#%wmH|v32IV5w@($U?Fe=@5NX0*DxJ*&mg zrEHroK~`$MRy7?RosF$6<)cU3c8i_e<&TfCx|Zbr{HcJ?-UvuBb;-k((AQUd_im0O zC-1sczi8Z<=Z6{}1B=|mR&Bl7cY-NhcjV;atK4`E`{)o~Ys`keJk?b@2(C^l+}_^W zSwQ)z=X~Pb!5GI|`MrElOu9oxI$siNU>+|gcZGS@eRVLS&hw*DaVOy2@w_|^vtlOg zFa#+hc{aF7e*;DV;rG5M@S`&sZP0Z(3O{&M{A;@9N{f0?*;fO7wr7DfCMOkcuZmV# z5l<%nmAkO~*rcSeYE4Bh&rg$r!NEre8DJbh1^dOPk(Ppjm#4Ds!-kH9#o~rLKQFI3 z_)M8bc>le_agIN-COC&cto`P^B;oV^srp>3!#)N|iXJ0mjkghNw0G9?i6a;hWn^z2 zINkXiU04`h$h?6EG6Y@MGwB5SKP`7JPl}@nq3){8j%@4aKRO(zpvZGDG2IE zWr`H<5&cCwToli=gL|iEq>}_CYF%e18VEvXg$(05tT5D{~{jc3#PLJnvaPDkNa{j++cdTwGVl(ogUvH^ZHz#v6)jaajZm$b~ajNA*7_x zU+j4Af9{>m0~#)_>hiBJ^rfi%{r7PSwCNNfK|F$iS^K+DxF$Y2dYE4MYFu1nnGq99 zQ9AFfJ~`b%b_^!Ke|#IJ*;M;Yoj*Y$Kyz@t1I8# z!_$O3VCG2RbYitHyle*Gl-0q-H8n8}+}q6obhW=M|LfO5Ksd4;*FSUNqg+j%nYr>@ zTHU$*+sh~}t{d&KWYW!@OYV#sO_kbU&rwFgd(-)%CaYq2bg=w&@WT`z%#?VB{EWdu z%Y?M(;a^KV2|gdk(6QWb2{K9PN3y|=z_{m8!*6x#bx9Uut6D_MA71BmUe}wKqbK*Z zVPW=mKt?KJe(rq#?o38@`{~oxUjpWsfiQ@!4J4vwqL;|ETA8XhOiE%QCI%r+$Lq>{ zxKb#n)BWGq!A2d&!*lVWf6TaF?RuiBqM~MyRuj~oQ5QIBl{XZblbF#oGx!womBm;N zDw~qT#KwHBmoLR0gU1pK!}X*D#9QEBrY9vSDk=haQ+4+Fwt$$GPV%p!KX#@YbU4SE zhu4I4e`5dZ7-4tzF7=#))d(iWGct1W(eV<}%j@Fo?Vms*J_vH(&zqKjM2fzCn^%%C z#HBzBthB@>AM+eH6k^GcuJA+=qo zuSeRYfqdcBsjP3jbPWM8p^grDcz7SUgTO}ji5t`A){K7DWU+CR$o}y39YUooa@?ikp~Y2A zO_g9bCkHBkRdE5Cr$=Jq5;C%A&}@5C3(z7nFtPX*&s&AOnOs`Buk##%uTpRNOJhhu9by^C`&BdEbSa z0k-Bs&3PZ;y|=;v75f9KunO@O4Ags<*m69zRL*EkoZ4o8y$|Av{pz5gdTCR0%hl&F zV;m|=%rH7zAM0%eNG0~*z#YuW)b&q+X9!hKcTu5~<_~7~WrdgMpS*3^x4gJASqcf5 zy{?@aoNe7`eszZov2b?Au`z=0vUI0U?+_jo{IG`0RL=$eTbPtY8y~$^x$Ikq}@ZTahqEX7_%=vdNA!|<{GLlRu4 ztvD%#DG{U;)D(|T6FQ#S{urJ9rNecdtGg;rPF)>IXK=;iOYxVlNovY+n1p!2A5_X5=3xgF61g*KnCI7n@1ZtD#QQQ!uhUS_sD|m=m*fokM zZfS8m{%E&MGqc^R1rte{9QWKZXlXKh{V8-y_%F;hY;cbIx{Qh~#xQbojOJG$k~7X&!lb)%+T-rKWwXkE;87^oL1H3(541<3qmK_;7s=L#fjgQ95yP zNhWnIS?lqM*Fum+&2dmwdohwh1N;`i^?iMNU4^@#*~{7BH2D%;xE*){dt68e@iVqB zTNLAdA}RF^1mjA7NV7YG+PC!FGoW@t$D@RDn3J*POSbk69i!HTQ?}KN|kn8bDTGSqbza z45_H;QnOLFuiX2TF}v#}cdl75kn=->RcT8%XwZ?4Pq?zVam`EEw;fwR#Ga#b&|@tp7f%! zq<_gWz9=*-Mo(K09XWK~#VbB+zgndIP@CkCUESUx*;{~MY(;8~+vcq`nj1;Iolhi3 z%06FGQY^Q{ZA6bD_L%14QP5P7kctn6+ZL+bZf&@-viZgNH@*O826oYHE$$4CeR6up zL@q%Ex_jdW(DJCsI$2ml|K)7V9otv?-!{v8B zx){dCD-4x?yv_M`;RXUM`3OQ{|KcJZ%ZZl`@_pT`=EB`vPU9pAj<>ey;tIBbZpHcLcl)PFw zL~0Z@#vz1AyI*c@Zn{w8z*_9C-%f99r=L5BisP{Xcc#pWBh%M65%Hqp@ghqKq~$By zhQIw5Ouo>*WdusYTvMc`-RN(P;Z(gWO$IfMxpI-XqVQ+dzY4#!0zE88B_v1>_d1f3 z(cT2bj#e-mOCIdqEw#{WTponH)pOKY>#={A?LHmFC1goeO^%ihvO()*yr{|s2xyR0 zS==wn_ODp605O@0jg6aT38*{IsZuqM4@_0dtl#9Q_gsW)JQ*Ae;Sid-mT1OL<|sm3 z+(|7h**YJx$VNcxo(}fzz~~lOMnD}9?hCXWZf@3VxP~aQIUl@#rVmuL23i^Z$PHFImqE#iu>0c49vnA~^ewX`#TPC7>O!KHAg6#-7^EPId+z z#J8m*pFjIoIz|`T(fxNV;@$_`5B|NglU!!=aH_@qa{Nc+0nj}8sE|F$^%rHB z_XY~SuqO8<8utT!r1RlE4Z~Mv6@C<_#i9}F=82%XqwD+~U`u!NY zI|Gvrk>@Z*Z|u8`0P!)3rwJlz@b!l&C1txrtl5L*!{0N~D)4YrS@d!3_h54I0-uWG zbVCSOe)si(4aYM2^L^4`6U}4Dv2{LoUVIg8ZJCZ8R8j~}I>a1~=WD#r%}If4 zI-=Lahy()}$voq^xRyWxL4==SSZP&{8Oco__PIs5wB z2=IS=_>kA-)BjO#9=zw+LvyQ&(@6Sy51awRLMb4Fct7Rcruh=h7KrmvSC<*|Um!2O zIY&D!Y3#0O=+-5usdpPV%j(zr@umRI)Anign4q_*r5LS?r)y)-~s0)r+e6{w>d z-~1^u)dF&>lt5jbj4P`|LwrK3Qq|L%=k=GcA&b!t7A#mE_hUc-s(*ZRRw!{i z2#gIE!cYNIsMEQ)Qt_0|^@$8M)sdK373ZkeEanz#V->?!Ic$RByOm6A!K47cJmWDn z8e-0oD=h^$zdMMqwZz=L+N*cK-q76SkgZV-a?5JqMu6J9;P$Ml>MrhFW@_qvD!Es$ zr{69QG&YBe*ap5-s}ZE8c`Q?oUgKH9wrLR-ESoQ6vP+S;&B!`8{Ib%Na&VB@@&2~) zq-CjU_H(;iFD^`BVii)}^gVk=`3axu{cipnzF)fkR{E`n+SSH7sV{Liv~Qr@e@eL_ zJ4t2AZJNh@!sp~-#)J6W<;+vdIB^jX7R@|xl>2YM`%(GLRGm9a**x*g4bGS=a3ft_ z8ySg$=x2DqHFIc(8xB!#Y30G=z*Byi2FS(+1Jn;Lpu7ApqmdcZNM*`W)om~A>$hKc zKCv>KoTDLzTHFaW=9@1M$Td~5F{4K;&OS)jsT;-)%)oIzs_N$8ixTHh^W$e#Fvua?Tkk zlPhs9{}7}4Lb|hqT2?sYIU&cWuvAXOp9dskX;s&NQ;!uHKujbw3 z$7m^gK8abf)rZX9p9aDWm}S`dLKcP zA(jMcgPfSM8-zsEbPq@WBs5=(CUX#UxF1n4T@dgsU~hg;3M-DOfVoW3noy5bTxsQW zyi8vH_1JDD3CX?KJJD(JS(*dA9S#-D=Kepih3Kbs=je{CG|lAAzPY~nz4Un~O1U=M zBX~|CrLWXw9=#;J2I_`Lr6?s% zMcD-*gstTGjhyaixPJbKUL#Etdd*b1|9I6q&eh_#O^Z#e45L0y_>sYpiRKCBoIm?A zQwhf-8Lc9Ub4L7J2wGb-Z5KyG#udk1yedPsPuDJ6_ph0W^ZR%d)s+}dtzI5+-Iy1s zOU0p6%es2V(qZ5`en57lySL@p&Rcb=7@?7toqR@|H4BQ(te|Bkd&;s=hO$8-nDk|8 z{RIZVuMY|hMQ!T--kf7W@Q)`Q06iNapS=m! z=i3u}A4*Chs;cCdY+0Wz!K^*8i2lmIEV}J|g9#*1VQu;L-kt>w&HLu#`DK%h6K)B` zJ>x!)SBEr?DEhQc7YGCvT>usjGVspCoK; zC>pZ?$1F0XcwImXM&FHfA562b4Q!Y*56KNg9m+n$jEwYVh`e5ot3FZYvZ55}AjBmW zyr3O&srr}&Q0%pZZWYuT)I_qXYTfyHClS2W$wJ}r-HqR1VJF9>D?CTDBllJTGqV+- zC%n##S-eU=BZ-J0aT-o02q4#p2-)YWV=?w$zm^|j1`bYc9L$UE!9&QiWP`b!!Qq-&p_)(90Z@qDn_ z@6lxp2nu_E##?RWvUEFhiu-qMG#<)iWXitHDx~&N-pt=3_n!PI7h<6cE;;wAH;3jz z?}n=eD6H@PQQ2IEqt||qZE0dgb4f>RW%KW>J99>UF_^jk;{sUqhvbQ-L;r8x->H^r ztAzW5oY>v`vIeSZtkN7++&&&uLV`R>r*>Xt%szI`I<exXXw6tgg& zi1Jz6AYq9rDDVm2!MI#3MhGYgEO}oL=f7ZhfUbjCSc)G`ANaF*eLZ|)!l``>8%w0M zp`)wgJ{~JDL7)&q*2ju-G&7hIzLk{Ngua?602049a0!Zq`AYX~NCPv!e{X7RJ|AAo zVc%wo?$frO|DpTG3pmV4KSwvj!uM}>1=_y76y$MTA$J-a=*r{2mNl6itVyR@{t ztQyivxoO`XEi2tY6#a`SIUPv1C>MCP)MvF*{chdDci!3Sm57VhZ2u+SuH-zsN;oD} zE8HyHuFj#NB*DID8q$tMiVRd(=R-^~|CJTr?I`7#jk*XPhrM5{D2)sZlPHtbxvk`0 zivIfj3-q(1d2L;kEs2m8HJ<*=R3!(|gP$vx#gvk<>liQ(t|g@>ie%XuwNo1s8qQI) zi9Qx}nLC0?06yVzG3hqf5*8v$ATHN0Q*AMQ0V&D0(@lGV)D)Cc5B682vLlZk)A-%x zlo64m-m_gl{DDG#xJ(>W@f|i%H=wyim#cKuCqdm${I%hD35E9Ns9+<7Tby*%VSD>T z7TI&`9j{&S^cMRJMa(*0cCczAS6>Y{@ShB+rQ(MpmkQ>MCtSzIJ9>VstycjzgSEn3M_*@dZuYcta}A$Wk||~_ zuTDTkij$6grR$3r)H@38s&di_N)={rmr~B(G3QfSy7Ik)Rl~K%F2W$k7f!#AxK$n- zz=}26?pcl6(N0ZC**JU{7Cp>_!53d?ye|Xc??Q`_s{cJTB2y|wgyHu`PSuO91ORDX{Ij4cEhmXLv_2&O8+VGdb7%MQ?)AQWu<{c z6@QOmyi~u*7mP2jz zx0+8E2B-Sc_%!r0wa! zak;{p!#jISEUX>UF;Yahrrjlv+nn(lvhB0YRl$Yfa~Il0u^VOt{^}!TPR7(3+kX-X zlD>?8=*1TPo!i;XKI!_=`eqEHYtyHP1Vvc`VR6x?PZtv-la=J;ZW-bk7#O`{na}i5 z9p#qIB*~1$U<=I?l{#^>-0|zJ$dHKQY;^YL^c9R|bJW6TSdB>62F{lW)sWZc&qz(s zRWbP%)$8*Fdq)#nBblnY%(`QZRqaj^WxdX8T&5FDbJA^4XWctE?D)-&Z?Aua?YwS* z0nLDk{PP+cSi&nOz&JXqTQrp3y#vv1sgr{YX4Lf)7g+FvdcMqI$+e7vfgv$D8CY1E z!NE4s|2N*cRajE|uHOA}@*#?9DgijG8^I&S`yfNN0?v>sXQKD$ht?0R&6|GeM)F(EY&09f)V?+1VIw>v*Id60xEzl&Q&B>K-sP(Q$M{fT?ELHTeg2 z{8Z_S(~@+C-=kM_Uvz4WdeYb?DJ$VyaWNXT3Xk)mo7BR>*LQg5Ks4FMDsw?S!S6)h zk!v?@UO-S6R?*x>$vG+Hl7A**$f|rDaen#1b+)nv?XTY&N#0?Un(@0e6GrvgIgAHeM_M19N2T_!Y+kuo`l?8>Xqpx@((=0U4{%q+ ziu9d~PO_OeFgO5^!O6=ep3|8|Y7RS4aCU>9C3iU^9e)zA*#lAWYx}oVC#yaRCNev! z0%7Q>Y<+;WhJd|*t>EsH;WGLSB|{~rVEgEckdo*|3qpKqH9U&7&SyI?6Yd~e3ukyZ zRPJTFwV^#y<$PK4E7vGMp|?s)?Fr~rRr6&mx-t74l0)N|$+m%`bEdOSCTf;2@7m-X<0myguzo&v`}sa%DF5 zlYprv8KGSSmy*qB*={!QrTI84W^o7yt`gUwLVo;MC+92&5-Pl}Fjd@Qv-KgLLEd!m zpA4^$v)OlD==T9_BMjQ_9)^C-a1rWqr{Vb$U&QquoJh0ZY@T{IgIC4UE+ z4lnDqQ?`;pftceq^RM{&I7Hwpm~Z=oC;zks`pj^1rIWo?ZRE~Vy^CK8xM4wHqSX@y zKd9_+bYy9xkDTr{ip+1B$GnBB>e80g7TSFZvg9xBxWwE(Oo;eNL`$^OROq!}1R>$H zS=Q=I?!*ET;`HQ!|9pG6?Xxvq$<6mIswqKUGKu9h-+P>mwK~5aI z1?5x9Ks(N7o`cI(P8^SVcWfBwX))Y>50qW9J1!M_EgoV=$^K%KRiOU4kh-*bjrOfu zH)F>fht@Jl?bR+aM3b{eOFa26KF>P_fBkB;7!n6kka0Y-D{5kgY)*T^Ajwt8e7fe~ zf(zd9Ah&#l@9%ih*_1P_w=esc8}NI#FXM#`4Qv>EFVas^ZL_pBHSb7zf&a zySJ~5Irgqo1_r*gv?-RNciDTA;D}<$x)N_&>#)C>^&TyBHF&i@C%D+o5lH(7WVvEu zi7<7310aR9;erRg@Dl7MudX=nw8c_}Js?#qnD3e?3MU9%1ITMmD)wNvk8U%7p|NkC zmjE#)WsV2 z(eACVGQv)`jNTK!wE^jC*EO}?AP6fd*R>lr4z$O(szRa;gD9-1Bogkm0d=o3nt1J_ z&q3JttLTmg92}jf)j%_w*AL9Le`vy=cbEVk^ES8Jd?oWTVZn+Z=JStr*ow1fU_fBl zUJ`JupI`GA&XxMg4u_C(`Z%^EruU?L8hDadmk z`DRatKj~IIojp#jsO&`Ft7`?l^z^UObvl;C`hH&`7sMmpg@>?cgzm=Z{xtRE(#*=j z`IZFa!EBsD644L#RJL*VO%EJ!=dlnzlSPMk(n0&A5IND-Y2TPi=Z&y6yus|6R|b=x z9}_*+2?%W)7xH^~!KH#5wRdxdzUGbv48Z%wh!2Og`T3N8n z*gu;C!zQaABH$Ha@grVO$%6=fjJ4XaEj4k=!F0b*{Fgnx#W4Y7%iX0j{nmd9ie#@Q zuhBzWs^eRis8y=?)I5G@=2XjzpR@Z9#zsmuFcDDIhcNhWoIU`YbC7@?F85*p?Og-I z!9BIQi~5?HILO-ApCW1L{{TM?1vqACZo;0pw*>@VlU7H4`0zwcZABvbPIqdt%_mG} zP7!Q^+hbJ{+#&h7opbh|uf3#u86Gy9!qi*x#$ddv=Ob{Mu<}x1e#agk4{4s3MMXo% zlRtIOF9@G#==YV$$w}fc`q3ZOhI*2cSkYO@*^)c0#{coOS|x*nLbxhShy8jpo>^M< zfH%mZ`Q>Z3Zia+JiG~M(n$cU0Je|sD6%d35yCgMHQ9ij)hFr=A5Ay8yH+!*fCncpe z3yZ<1$J?u~kWq1Nv8=5(bnP36szPwn7$`@{3SxNHcJ_7rReAM7GP|>1Yi06}F#*Hv z>FrAZ&lhPfbipQWDlB{G=)*U%gZ+DkH6d$eMla{}zff@lj(^4dh1w%iiB_s`2K|}Y zupf%BX!m;W$^Vhb_&1@}uPp{AbKzR6*LqK!@JO@M(?#~SMU-V^_~hh-g$;mcSYZ|A z+=u`tq$do-&WV!euee%X6@@BY|g`z6mJn$kpnG&jSbtT86V_N59SYd|}laz!_0XZk93-HEwEe?RAjLY!> zi^E~H$5;iHua}poxHy;@_rZq}h3sIrZ*dSDYWRhO{E3)hIK=qm3ApDeLkO2mm4t<_ zr2*+@G&D<~bVSO--`{7sy=}d+EJ*Wc9hGBNRW=5-$yizCOU7D*+%Od6{JOfyxw&t3buS?}_qfvFTUUVBbrUWQ@cQkymT%r9D)py2 zN9!-p(+5{OUB7zu76u;~7gt@M{I|I3{}O4(Tmj=>p@`(v`rQ?kgH2GT^V~8#K3JZr zmx$vs%wN2AAm5ajs2v-_mYh6I7A`1zxFzLlIy_WP53HMyWnNd((wz1mENWCV%mFc^ zsj+F(EWXnK_IWDsLJ4uIcwC&4l9S4;S84ZNz+w~!P)NQz3`f8Uf?rCCUy5FLw*k}8 z+-w>(%vMk5y0hVG0|`GXyBvpql&Pw?7@m65Z1blJ|rbgf4H$d7SQyAGo-j=zv-d zjjs#Kfv4?K-wJ#MhZ@nprrt;e-gJ5GtfThBV9(n6qiWwTD;I~MGiAKTW%Q#!d~{C9 zx7Bytv+^`#PeevJuXA-$qIoam1%`5&a$K}_$DhB>1Bd?7q@W*^US7E#6cPkrXiIym zl$hw0P~#ca<{EP_^Z>;hy4w3zGi=Gw#lUHt2&E_`||sbGUOO+rx+ML{iZ# zp*qt>#>T+w{B#a$uP>~*(vgupefErolQX*I?1}C!mwv&gdbNYpEcHVw#~!G5^)GW6CD{GYW4n>S zxH=+XtekSh!XL*o(KY$@x_aY%^5L!Z#-OFN^e^A z<&Ix8XJe`3BYM>m`yHczxbdo8`f10`%5sr+@5KK%Z~|=yEbGKV$~%?s;)`tQdd6>N zF)}m17NXKT*xpoJX7_W!`2(`!SBY+#8jE!~t0GY$AwPYIBUaBJj}c9(q`h=pWk9C+ zT@V{2Ba`m`JF~w<0J~$stkAGP2n5Vrr)9=+A0w+~!a}{`UFq8?y(+w@e@QOSWAOO2 z56jteH@Oa75cgZ%!#baDb%17}eG8Fu*l748f4A*Wag@p|x*^|Yr8D&I*hB@#T<+!_RYHhK; z#G=&n>lYgZMPl0LUdoLB0+frA>AG*&0k|FD-ym;oY2YJz{#ICcJ5BoO?k-`ut@Hi? zrZa^IJ$>NuAyvy)H84gj{vxO?9y?T7@Y-y9-j@EH3^uPH7#T@;&4L86wzlTtvIQai z#{T}foa#OtVwTrJLY^&Pg?XPaQ=__Xe4O=uO*`}{0c7r=X))>%`Wj3~2lG~dAJ^O4 zdqMnspWf$g*N(t#KT|7vEb1 zC;pX(enyWME+8)W_X9e}w#WFtcd7oCEKc~W#V|kQSX+ovzphlSxVP*jdVRU_g4gFq zasl_Aa|qubCv|^Hd_5gw=cMgkyUtie@VS&@hU35!bIXWc}Rxd8o0G0 zEYVj1_m!e>pYxB^sCj%Jeby&}Z!)sbQa;h_Lzs){&gQWSs=m@M?19vb>Vj&fm)B!QL1yubk|kJE3G;E)iI$;L%+ zad+L$&^L3iG$SHj!s76n<*=f(29E|h#?Vg!j>xo)kZiYl zS578K^$MR!US#+!1;N}Cq0->V1Pwv1jozjmt_ZGmBki76vRZWe< zt_Z|DZe73rl!ZmTz~FsFMa6UNe>b4@i&o3WE@G9>K*^-dW>`*d9 zsY(emNe|Vb6F1)AR9Ifl92-;|8IbHYtKTH~VvcXFTKdAMTOx+_I2R4{z`~QHrGVch{2pxD(;-6_xrlX% z4{dixZOVh?8oC1g9}*XK6whWx@!gw1-x8Fc3(C>p(fUg!vfxWl@#7vST;$M~Q+f+DKg5*HZ0~hcb0P!^csw(vyb?$eLpq$gv z+6q&OBaY&&iQ4+48~2OrULd1#Q)&s*1x z*d*m{r5;sBf0lhzGl3uyDk{!P@=ADk?=PM2PHbQ9=y;Xm>XwqCx0H1<+e*Bth=Gih zTCtw(iiU*Bsj9`I{oP$DC*?^>OHYUEvia3!bz~omsNmNZ6T?Q{?JnD!m}I)Ua|btq zs_!m5vaQWcCT3d$X0D_XSnlJ3-mfp+%MxzPL9bb^n>m#;Mj-5A%9?3 z6}||zQEuP7nU;}ZXk;`rJlwsYm1ReB{_DPDFJm9WEgkL6rO~K1l~Q>t@;3Foq|-5k z9I~93MJM^p^Wq)-lCperFWSr=j=U4XCFD)IpW~J^jpkO7P;qz%wIG(#&2PBl*%L48 z`8VyauQ!W_8qSohmzbA-G;`Z`?_2il<||zIV!}CO}r#C zyg6w-L)>e^@i(+)Rzv0DGR!WGPVVX?>l4~Mi7K|e7v0KZHIK6ps1OoYX;~B;-Tf$4 z8cyVz$5`RA2^KQq>68AlFnEi{_J}!vfyPq%TKF|ytF;yw`IXLGLwn9ARNMB`>}Yvo z1i#Vb=Hr=R_G)0h?S36z;_l>})Vvtk-O*$5XZ04`x010bz+%TLoNA-d4GoO;=x0e# zl$_=4j^?{zK@+EUs^8b1Ke8cOXXjQP=d$Jo;VT>gEQ__CH@g&zOxVZC@;FrlFlMMH$EzI6Z>4 z2-HtEbuF$Uzw4>i|J3OzSh3w58`#|Bk$x1?)YPu?TtY(P?OSSl28r7baIRh*TsG3w zBxCfbop|*KnEK)K^ZmKG=G|R9;8kJ87PHiEj=1ILCw~5n`P@cq5LB!k!d zqbTE_7Z|Qyoe7J|lBLQgV9-)F`rrAFOQ*m;!rbvC?qxNjbv$6I?`J(d+K=+O(iASv zi`@U>idlH+!Q;o9iGtK^U+EIQKb}`Se=II4b#;PCZ&#EDz~!il1f({8=`eyL%ey@r z1qJ=5x$=#sj-bl$WS!Bl`rY-7Nr8)la#7@aXY%1E$CtyxZaZPQ5HMiC6_-hWN&a)K zH)CEboQC%K>;G{9F2L^wAFZpaqR>uAP*<;V(uH&eJ>Z^Y@&xQ;K~Vyw7rB1~QUe>; z^cq!pR&%zHomP+hNqGm0OojHtogcv$UV!c1x!d$H=6ZTVL@2bg`s%ZP^L+wYY}qg7 zUmKup(_f1XRmeGL-L)L&R|91k%;Paz{jG7;W<2AMp#d7Fm%vY!&|q{v2wGr|WCzd}kTYwHSo4;H zU27CZcVmzhM{zcvo8~qwXuE)vFll;;K2AUQYx>{O| z`TD(=F4ar~=;GoG8&tMmgm+OzNy+2WCy-2{Rj-&{tEP&IxZ`SG1j26K-rid_DM?Oyns;vBCZUoz zIIMZ^j=V7+Z|>>2h=4gxl!X8sLNo*_Y}*x_uUz&-goKw6D8H6R2G1nLIG2BY^0wv} z9d!->bEJ2BJ3T!G@L1j4PLH?zSqVW+{)g>~!zSWYe)yc7y%e&X)g1i~#Z0-3zPlU+ z8uIc*SQF>JJ@Xa57|l0Yuja^NZ8>&g9+8tL#V1P7k%<_J$Tkm+UYW-!gW@#hk6^M) zb@9dUlBANVK$q^>xracwOnp^<$OoU;c*+yb7ypXMMy2GSAi*mk!AlEUGVNRDw{Mv> z!+iM3z59jVp3U#LW)U-=9}&!BuZAMyg98U**1pQZi=m=)^z_Hu=@G-Sa&oN`h)5VZ zVuyNB>*?6{jNR@YMtj)pkq|DkCQ@I@U*Ug+>iY4CVO{O|^@-SzqRD;xCfx31bypQ% zhrmCP{jMJ5k`n8U$t<|}VCUV_D|gwg(D*bo zIJmD;5sdD~Nhf5%^tgRg5ouzqHTWmQ!y(Fk}fxP?#F3>T-g_7L+kHaaC%fw4_ zE32)u;^rjo;}+d&KgwyjnX>&+SS$NAug6I zQyTfv&kq+iq2U37?9)iKD=88a8!MdqlUf$+K%Rw!M(Rw17%>)B`kBlR6^9xQe4NV2 zFkM+CTKwxW7D7P*GIf7|V%u770RPCe6)zv3m99TB9nwtUIp%Jl74`Qg-R`4Aun7+d z`MovwG~$0Nt44Y9QtKJPN$&3OdLAa&y0Ln49IcRZ!tGj>;4)?VM^aoIhsQo|t0mGa zJ3H$($yrc&<|#Iv0FEQQ<469nYgjcaVg{L;^Z55HPP#5^)7^4|&9pbHo@# z5BgWdqHrAS?b(r#aD|>8iz)&fLUbfFG_JX+$sR9vuoroyrY0*dkA{Tg^wzN>HG26X z2;?@9FZr&erw6+z#6kPvWgXyM!@VFY46lFqXDASugf{2{~zQ)dfK-NRuFP zgXSg@e3H`153yQDnuKIUz0zT<%6V?I9Hqmakm3P)O?)5P+u9Oks9!%06-}0Tbki(a zG#Ltts^hHTo5o9ID?^5BBMVtczi(R8{)?|?VP@X{+MRdLo~+OIq}N^|5srTTcvM$k ze`}}MxPNu1@CQV$Z{PmDM<0d24SV>5CPh$%P}>WodNbb9GTGH<F6?}D`b(?(JXv?*~EmgAT$Q`-?WN9kQ*qJVq~g3l zJhPPg1N<5t3|UD@;*h(+#O4ETQfXT(HbBbegY2fJoLr8(Wx8|!MCLG$r7s5m^>mR2 zag>`^1QZmCbEyOc1kl_HL4y1DxuDm!HaI)d8`sQMU3h7~Js9`w{l$7L6z#u3jgkA&MMFRW=U};13kosnPJRdj7-Mf4sv!+ok*#s8Nxl~eLagY&{ zGKdS%YWtdp*3{I%*9Ms;Wn@%G|E-UmhPxNkP%j{}0FQS6#wpuf#O?cITSG%aJN>07 zB1sVuLOY)y7N##ryh9aKRYi*mDc!xjs#b4FBz_4Jw6)C+2mqEk*7VFzch9||SV=K4 zbT>#(pzUr}_C`QJ*Tsbl0ZFAyrTmolsJNdX6`lOW3k(nV1q1}=yX* zn}5Mt`t94Yh=@B7t>1k9;{8k*OoqL^y9s>+xzM_wzkUoNYBuv7_F!^bRKR4mv40+K zUZIOL3lrNhVIazt!+cB@cg`bXmcGv&ACCf^aM4t6KN3!hNq#(}p`|4>R)9 zGqm*sIoZz=OWmAri3ZsrA=^+4f#XP6Y+qd+6W0-$w_J@*Q_*tEzv~yz%OCCho3Ky- zjwD=**N+R~Nb>VTC-F40g!(*?U7X!DbtO|Wd?6(5xwjV(&fs5G9(VJ`ja$~VbU9^F z!QrSviwD7mz3IWd$A@?G9fEjZ-n=`QPoNe!cCpuzR|i!&>ougcH0VG-e8P9lkEF7Vx^ziNK){}YBIUz}%sfb$A#$$*jDPV-lh*_V^O$Q&fLxfF9izDkCJqjx%50Wcy#FYdTJFFY zfYYu>PFfnQyW9Lo%CBH!_h%~A7f*t4@b=D5G=Bc)&kesmZQZ6_hfzWf6$>)ola3FD zR=J7_IT#w1MB*Io?l}Seic26$#>!jmoU}4OKQL_oW6XQ^+A6qXIqf3A@>@pcds!Ld z!kHnWFR}lvn>xd87 zIEK1YB*;YEHa0f&^ip`a1+O6MTstrJH!+1*;wl`~ErxGi2~FA!)O`I|Kv?)Q=W;U{ zuo|GNyN#dWoHjq*2%VkHwCxovtZoC1<|IsP>_A%nw{KGdrMu%8_T}MSH#D>d*@pA~ zp8etcWe zU`B>FltcE7$8I4CvC-I8oasG7{s!=Qxc5fvU~G4wo!I>cw3kXSy^?%QwxK`HP2~yPTUg`?k<2v&RYS2C zPuS%u7KUdP)1OZtN4k4^4aU`lI^HvdmzBxTw4~EAFl-&MQ~n>Kiiv;p>LCPu>opJ# z)=y4JnVp$|p<$uqtMijE->AO!!39cfK88qtS=h}IHDBh}cWSHI6(Sd9;J$L@fRlEew zoJvZWkU(cf`i#6r1BU!KS+DC8C0`$h6R{?+5hJk{?u^ag%hie_nD8M@`F z_@9*G*;_@I33*&mao*8U`Z%}Dc16qhP{G#L*2cycv}p?pZX&|MPafTby0Irg02@$l zK&XMHc=Oh+PoMTlsjq{i)-(Ox5b9tsNdr8tjIrp=k zgeV&z!{dYFhl1P3S8p6Ce~DGA*Kb$H<~W!Cf%+xq3cP82&PRKJt$Is~i!8gp8ybY6 zgZ^OXEOZ!7ZEM3u>u)#--PeqLF8I- zF5aIsAAFz~pIPPSZ^_6$g9*Rc$U9XTnL197&GGM_O>AxCZaKEaNCZ<}WnP@_IGA9C zwnR=uVMuF};PI>?6`wN^U#tce-QM{BMxVmTsr7P|Qq zif^qwfzbHc|M%|#NJ}XxHYQ^S#&0d7o;V+TevhtlQXI^}qNk8ECL+}?FKfJi<^8`< z8$W)JaxdOPR8kTH;pVQa`+DcrE#MpHWc$T2o(mQq$KR$^1hwSx91RT{o5IY@Wk3!_ zO5O&WEM_Jo;2>0z7s34NS8eTRN5_wZgrkiqD)1DYR)yL-?25Z!A~g+-zOF9t4gj!- zj*f;>y?enL;AQ~F7-xTfaUcN+4YHsP?JvbkR~Q2HE88Rrvqd0H3)(QOqDwcMz}UM6gD;|93Y zHZD+8lS;+m&N#__4tN<4xt!0l&6vCK;*-NK8!Qc<@~P&;Q5W1&8So1Ws>}NuKMV#- z-s7DA+r#-+wW0m$dj0BnCHwEz>&RCjDr1AbjgC-++unMurn-E4dl>8SPX<=1ay~~n zWL{@@rm67qI4)*|g+twRC-P%>Ep6`eTjZM4%rBiB&7b|GDuV-?SHE(bj!b#lX;0?6 z%J2Pq10a$dy!R%^QBjI~12e5hH?R0oil;(c>$*td{TCYN6L_K!9UopovNDyI@fRqe zE(WSNF>{me@I!h@0KHC5-Y+gTk^gKT=e>qxW=XiX(_+IRtiEDzA4wrbX}3I}4iQ+) z#N_3R7lA(F8OuH(9!!XEx!!Zf`rn2qWz9w2o>vfd;QWb+Wt`V_0|NsE{{`Z-EN^ee z@TjP;sHoewc7lrIBvTnw*+>x(oT>!|L~}C~t+jTm5a@Jtlruk&A|>T`+grm5ii#yB zgIBtq*>94w7M}oK%H?vT1Cq^(itpfsovr8(Z3(|nJ@hFbKdIqim$y02?`;G_Y4gyO zimIN~TnnwHUSG<{XtBUh9Slxy|I}$>jLZuQt3%eSPcQW={q=hp|5`zTiX!>Fb+p*} z)By`~U_U%!w7%gV?vbT%)nt}L~GkOl=oL3#uXbBpVy zp*Du>>P_%8OZwimfB%l{;o7tJ3~F%@^oLqpT0d72L^(5WXO@G;W!fL-lcPw{*XI(rKMAI)SA;PPXZXnM-N zqdV7(Os`xK*VnIKUnj1Jg}MVS@T=FaFCt`Q-^&l7r9_A0Qi|^5>q{va(@|APX5Z*c zpgcD$Z6?}_XO#i-&MQ}VVmWN0hJ)kcE+f`u17UR0wrjgze4WJ(IBoI>d0j>}XK0jY zZ`&!8#UG5}Y|*t5;7CmurfXSqIQM6-%(cbNRod$6>WYbZ|8&3nRto3_poz+1vxu{H zyw4qw$xcT07!mkP`C#56%B;D~SqN{HWSRYYmM#j-ZEii6S_G?$F>ln79g8EZ$Y6dw z*UntyvfDSBxzx6ZcE_}D_fG{CpCBc>HX!y(6`P|WaG~ap6`GiW+4Qj`ucM3#@?>^L z%#or$&hh&HPRzCM?mj+Xio0}?L_kGaRh5V|4#dl9-~7$FwP&+xV*KXK8#6PbH*fAg z=t|*D4heW;F%0Xc0FF3rPTy)=MR)5=tTZ-agJUliE*TbV+~~UnCoz8fOQQB%N5}D% zE0$SI)xN$9E5q%|hL-^%u8_jODax|250bhUaE~v^!lzDlHp;n*O`_1^WY}9&o zZq2Ikyn7{Z-A-G;G`6DRD26>hRXj2%IvO%QISozXw{JD&*m=-^fK@jaw`ZQBy}dmx zhI@Qc((gA<-cbQ+g@sjmP)Xr&b?YumOFr38D9-_%@2b_du(f4z{|P|t%n5pOe0-JZ za2PORDk_|y7=i`@VRJcpw6*|6RAoh-D<_qPiHploGA3FLz(2!c-#QH*3i;h(x8zq> z2T8Wl4<9Zl0h?MB)PA`PI%<4;aKIARLsgGhX!8K{A=&QwMMcTXwUJ!LnGaPVd*(1h z^TM-_U#)Csu`4V5TVfiq?2ETc*~c*FU9nu55+s_FB%KpmFL$B)%*4edWW^cB>v$0% zTp&%<5U`y$__IQl?naK@F?JpQYzOGyweBf`!9;Vj>{&?s`0*l%SaiPAzRU~H4t`P5 zO*1nMp; zIRL0ps?1Q1hnSeOz!+RgRP?Mauax`mM^-1ZY!`4FO+m$RmU0L3frSS@yr8g9h3XNU zrB)dkWh2&i>xW6?=trJqKP|Vmg28~`uQdPfcBKt%y;-0m;l{D&gZjOIY)XKn1ao1@ z@86PUW;rkUW^{C1B*`(EJtHF00K%?Axq6e)(n63*${e{+_|)~YBtdsy-}kKm_*I_= z&4UfZ%*+z;eRA^cncd!_%x}s;g*(@}uH8t0W|f$50g!Wr(-ZFGB%?Lk)n=#n7z6z6 zaXe-By-yxeZaWVUI|RhJFAF(q~R?j^VE(Uo$P^|YUeq$r!sCMIIN zwlGjw&fW8g75d^)yKkT5sJg~-bxonaXSm$ordDQk+3Dc*-?@BHV)ozc>g=Ubh|fx7 z)!P23!kYcbQ(fe?^1b)J1uGRkalmd z+jCR=)7Q!v_*eKk<~i(pK1KFPGLJZd)CVgZkG1 zQC;#@=-uCoD*5;kiWU8nIZ|T$V|x0&AIJTw2h9Y=V$MUHyOh3}Ej~e$T3xup0dVk~ozjBZY$;y_QBH7s_D|=+`nVr2yDiyLvc8U

$7X%_XYZMV zu39d6Od|QSw{NHM@vD{DijB0Kk2cBE3-5DCXQihz<9|~uZEDP4agRDOeZv7cPL-<$ zeq4aIX1tC`vJ8f|z0(erU$h}Lc-a&tW^cgM|Wsweqa88 z*6ZBSv43#O@vM3tfQIhZ$`Zh39QBHSX%DS#P|tuqC(KNOZ?O20E~F>^1id{*sm_e& znJ=ZTUY^>TGgnMxK@&)MbcepRg2lAg@s<`6pD12pFdqoi;$v*jq$xJ2yz6`kr6Smi1OmREhH;)6+ZO~n76o| zJ~RJ?fxXD~WYZK-jTZoF0YNXQ2+@@~X$gJP6|lSjeiw8;s6bska%gfY7)&+S0oWKc z2cTbHe;JAgG600z@fXnS%6@}>%^f6eByCalc<|bnfo9@xnd|Yod+&53A4LtE98(jW zD=iVm;PhdgoC$u*BR_w}0(PkjW`T1=dZZT}wje`s!>Kz*)Q@Y8ncSMXNh0H;`xP!e8(q7gGg zjl}!k<>yd014{3q5XwXpP~vGJA=_WRnAq5Gj68?GXBbTU^foCToNYyiMmy>|(9kGA z0IfB)>LnGOI>0vP4sVjoN@F~;m<+N^QliE7H`CSCg+c)J?K^(eNS*MRMf1- z>NAs9V;~7NKK`c3=j92+CSno>mmT`B^H2F$g)~#zWrSuFf8Y@3(+hD6_30HG<FtR2*w#lE#1oEq6%tu)Q|TKM7g--=Fa5noEsi{5V9+m*i(=4eY@XLVvPZ%~mEgK~uvo_n-=qO?WMr7@ z>~P5%aDs@>k&%mE?j`{t(te?ftUT$wH;2Y%0O}F|C9t(Nfq~3f?)&%e44CjENqOvE z(sdenWE#^#Lm9r_joLv>?6*$B%xY}Nh)jC^cmqZ*BpBajRjXrJ!cp~Sd%KvEy~yhj zg~o)vMgX6+m#z9aS*mTva+%q2}1R#ISDCNRJ8%>=D`+F20ZZg zLJi5C`P1E@FHPG}?Nf``WxX!q<~g>nc+X_Sr@7PJFG_Ak0#$q^^~QOGU2fo7bic; ze#oyB6h}`d#y~F?jGr9Z=+oqHXfW}|ywAVC$1f#Sc#QiBEI;=;Er#m&GRqk=0fG3? zP!))w7b$?71FF6v`5=IUkAEM9#JxuO3s{mkK_MX*$Qd+b9q4RM%>UJ^{dm18y64v~ zfr#!)XaZFmo4S%tPL{dqU*nu?PLHqi@f84*cVUTJa-s9$PPj3uSJJVwPmS010-NZC z`sC^=$VVmAd9n0#Uglq9^6(h01{s9@oRxW0b`%}w#rx1#h!U)=Bl_l zZc(;|nVhs)%5Tj@U#|72vZ%prxtaMsJ8d*H1LWl^XBe1{hsXA8HixIqw}Tsh9DYIl za@i`V&ggDFHiyL=fu11ogGknTxdHFRW_lLFArDMQUx@#3hxF7bphH2R%0j! zHB_P`jg4!m(rVDncgX>7MER$7?{cr8w>dbJe-`3NLBD{u7<2$*6%@H$TO$Vu2|qSz z)KBE0-?9Ykg0;MSq^yB_@Fn9H4PUci+Q*_=3jXnEvc#rSvxC1|O`~UL@AFIhS1GA} zQkPl%9eH$)jnIb%p(uGj6;bs4t6Zwe`iuu%>%#57O1fAdJvpK0BgzsE(N<+B+ z4-0@MaCdpdbY;afeG2BxWW2;YCf|<6YpZ~W@^A36^B;s`4)9wW{O%8CR~|rQUmic- z&Pri%8h=xzK#VgxgkuU^b%dx!2aBviIH(2efBzP?7DY|v3K!y4nL(AHlju+~b{P-X za><|nbTm(^8ux!2+!{KQqj?iQ^0b_RL*}wnG&*Vq90foOMe;hDv?galCo)MUE(eqr znwuFq`uY;VC7O+~+=*MQnrs9WQLBH}C4peXF5t!A6y_~OGvv7er{leDe}*Qt)cYA>a46`o264AP(rH`^#glM;eZ>wbLS2ci40*`$GhPP zQ*-9BR*S z$n6>ml{MSa>k$BfCIg97G!38>bbt^G{F$oqZaQySgUveZmvil7@!)+7FM$)V!XWG(S?rdWqXv)b5KLY1Y-%Xc|xHc*hw#LBif%h*H!;7 zP8BXEs?N?a^w?eHHmnj76Ztxny~I-K!y_?pxxpbJBLBOGZE$8!)~i{~o&K$~*U5Om z4T#5!YutmwW*#`U&EZ?#LR1K`|F4yn!)42C4eV>{G`QOREC?H_Rm8IpUzEe&9ApAI zn@7`aX?Nwr@?+qB>=#*bHAk@GsE*>wgou$S-E+XPC3M&@a zcX83mDamg!{`=h&0l#0=aZj7}0qWsaIofV)k?=tYU!wlh`49yAs)T(x0NL9o$%guM zkn%C#pWe+-s(|Uu#8mg(k?7J;zqo?J$^M3K?`^+pKxUSfUV)ZY(~M<#!TDQy9z)*% zXb@@@@3GGlKD2n|=a7Mj-@^f5?Vq<#7DJk6jEs$S(D_l{kBo$4sjAA6PCo|_s<7*n z+En3*n$Is7`rn;W^27u<8H{F~Pq)G9lt3X@)c9&HI9ewRpc~3Z(^A0_*-a`L9(ji!O z^Y?KuFeqmj4gqENuUN_0*nMyH-YnO{8(NOw^c52w@)-6|&lN+%2(XShY}4lgLBWNI ziAvL<+fL{=&p*Fx)z3POmWTovy!HWpNcYj5UiM{(aWj?&jltoW#sUwPdK#sb!yQ*u zAO7#k$jQiZV$@g{pWYicI6GAUv=K=1iCnZNkf?*f8jgJroPXqoe+laAueF*c1K+{p z?)*N-V*yaq$yr%QlonXY+cAP5*dEs0t6FG~q{^I|3aJ3A+eVdF%-G0t4=F}yx!A}u5ssQkHH^sov+fY{WU#pySQj_ z@vH?_JW&g-$X&zI@_VB2eO&K)ZJyNgKKR(;&Qj?E368W>y@&ec0IC7PZzwD3<{6rg z(WIv7XKV2Hx3p|?d%*^WC$d-XJ5Mdjtf=t6sKUg@XTLeE8y5D{k7O=0<9mj)leu|G zOG~tI|IZBPw=?UTi_D>6|6LtP{ufoqQZt%}AN^o|w2pn{ikcDT#%*esGMgpJk@LQB z{Cm_I^oEsZXc&6ly#s4;Fa-D)_7-EmeftIL5A0 zskKqHVl&>LppV!xsQU=VfCSLwetDk)?Cwno^XxmLx3qrDYJ;10pBlb;_WT-up{Yd) zwznG~wDPack#)rq{-ExSA3f467y!s@;ivP|xV+&f;*o)@%mc~oS*gk#=KkNm<*!4;6d((YjC^c9 z>R@cVMSNJ%2u~Rph#aO|z{8Qpn?hBA@asXNv>qbu6IQGD%j#x_5lVX(T37!IgMwgeu(Lz9J1gZR+tDiXKCfgCn%$|X0PPc9SU~;g zbDSa@9tIeuqh3CQKsx=G>=gAu3IE}PYex)x0wZ?v_Vu*5N=|e2KNESz20m9YX#h`x za&sYm}~+-Pwa<}p3AbA9MM# zZ|7?qirE0bO#qG>ILLQ+2YrpMV_<+zXHlY{xc8UCG1t>F%ZZ=24ueoPQJ@tN&mCVt zG9J-nJ_!cA|8g6rOsI!rc}X&&%WmG<31Phr7orBf?U|i5EU-Y?jrG6`63}-Qvw9Z~ zA1MRqwb>Sxqve4m(AELMa6+N|P>Fft)LnoRs~EDrWN~zSBPht5;(UlA{h@WBopYZT zJpzCbAogbkW-Z`f7KAf7{wSnY69;kUrii$B<9FR5ZS6c)RO}HrLCx7=N8R(dPfN@2 z8m3*q2>mzh`U>(9$9rRGAXvlBD`#XR0?Zw$cKC!g{jg;qazE71foSFI>;*DG4jbBP zBUe!$AAYJKz~Nc-b6hs>)8G3s)>oYVBu($p9XN|2p#}+MPXRW54-P5tkb0p+N zU&hTr8cxgY1*XiGt=8{X#V`V2oH^e3n6VB0d_P6{6n047;g(^*z5-odb%>`4vaf)F z9~vrb%#8XHQsUPn8{%_%x}20uAz*Uj05{(aC#?XP&0O0Q)Z@_Be{IP6mAE(8O1}a$ zL22(NKQz4%h<4+m1+VSnePI@j-^(LMZ=m57LJ_Y~v&tCO1ZPnQzfBP;j0T5-ycTLQ ziF)1on3-Ak;{z`#>8FUUiSz*zkSpeFzg|#ZX;` zp8ozcc4E}~d+q{uDNV+_vv;O%p3$<52Z96SjqF@-aQCRaDIs6&tkYWld)gFj4OVJ` zpIV}M9a}$K$s90Y*OgW?Pfn|`JGACMPqZPHq*gjAm%2EA^SNO)%5yY449?bFcu6+K z!BB$_4Bl9XI6cDnk0$%gP&6;e;#9ZSMLz)TmN2Z~!6KOtwVJR+LFcOY`;(=yvCxZ( zR~9u4-JaSyn6X{Q^A=M45C?YQ*%u#>`SuMdBL^SQwWdwm1@=qUc}V+uc(kSgpr#<& z8B2B$Y~yt~PK2ZyZd+oIel9vV-FbR0czXUX(4(;<7@2vU_NzWzvf6*=S6S(3Z(sPp za8QwuTpgD%%*5PW?9J!3@r41?gUyv(jRx2R&;Ko#!}d`ZB%If>fS)gpf`B09DLV%TU`hYqNQZ_L6ZNVviJ(B;zIYDs6Y1}q=qmc4 z4u@GV?GcdPO4TX|A*VEKl(pSit@2(yPsq_^70gB)V4h&iZEJRRw8q-gqquO3I=mU! zTDU}Mb8BZqXZf~s7LT)CNq@ve8k!IGtFXz12^HQG!u7_PX{ugZt=e5_C{pF_uYNm* z2zg){cAr3(_Wpgth!=7ZYzo~V2UDtJwj08_VP8|}z`GSa$1`UoZB-^U=Sc1ltSA%C zYzqEsB>4ExtY*dj#ZM>s&djbvr|TnhMreY`wa4-0YbSj#elLp;ogL_>2I02yFQEPK zD!irCQz(b3?Z$4N*`b}3s;;I;geSKX%gM@)zkB*GQ_9@~msAj5@FD1)N3|Sls5CUr zf@!J2wNt=4}e0qtJlgnU_xE4jatgk;=<;y8TTW>wzs#5;C0;g%2YqL z13>2Js9K51v!KYx#yP9`uUoBfzd-(xgxJA;u}4di#(nkN=mCww*2Q?SKE}{G4S9*_ zb32j9bU>(@*=al*+B%cVQH5N?ZJu%n-U1^@Vzy{#KlKWLL|o09ztihJ z6B9UZ_EG#Su}(LC{raUT1svInVMruNg>BrO$BEc}z0M&745^^>)A}u6go-YS^ZLc* zSAow7a1uxICdQ{5-2o;7Y?vN zm~YT4xK0UNH=rvhV*58#Sj}PmOQzcX0PU%-<@-x)Fe^LhPGbRaroK%5*O};-p~YVh zEbDE9+)Gy+I>N=~*0o$1M`wQSXAt-Za0t544o zGBbPglLW=YdP3*~mnNy~I5_+coTO!ClcU}^{%>VSD-dnDU~+fC+351Dg4RRt{w(VM z(H7|;ik^TBDy7gpoWFnn%JQl*@3ls8A`$}XwL33Hn2T-&`nG+$lx8C@6y>#{eCgf& z0DHykG3VS@iZwx7A6uYPXQ@6jUF-=pDenB`eP#aK<_ZMJlB(<#*q|p}SeTXlhUo7A zdkS}(==SOgE`iNSSBkM(d0`5-gbn<|cZ;cn;o*MJD6rN)KlJwR3xE3fy&M;|<#>3~ z57~HbxY`~qA8T~9djJZ*d5szz)(7imEU!~S>*u1Ohh~?nBkBbw{X>Q+SRH8VZEZ1^ zv@KviWI(bFmK0z_M%x};CiJiW??wR(X#GC{0|Nv0N4ren?LgfXgWeqs`rJQKEnvw@ zk(0Mc(o9V^V*E?2&L6|EA}SUt$jXAO5x5F=k(2w2VgR2eo*i;^xX4>qul`(Kt{mih z5lpiKkW<+q(M#}%wd+2)gSffBPx*7(0RKBYpsEtvCJ}!4yI~A9@5ZH{==^)hA`B1BNTsbf_bZL%gxFF4{#B61uZPQ|F z&L4*Dv5$3Hx904eV7w2nNg5G*fuf@9QI#*I;=*gHPJMk%rdd7QI> zg0u9h0~lhO0YYrJ>S)aqleUv=I{41b--AW0Qj#}mqz*~g*Ux|II-bM}htZm|LO9FX z;`m)w22~)_wWd9Mg4OW1EoZ?Sj|lefLYq9<*RM>VFe@EfDR9x9_`eqgQ)dv;g}l=c zwrJgrb0pL{`!`7u_iH=&`1nR^I2IOrfXg*9hc6)+JbsoaCJFogw$?wm49!DW$RXj% zlChPF_i?*H${O{G|D^QtB~YutJ+_RVzRATU6REqgctfVW&EEb1#l7Pevw8UNp`E>r zpI?<9deixv&i~Vc585)Skb8RsfDoA>c6c)i>kTg_zs{s8e^M2NOfNB+cIc_U&h$d{ zthL&rZ6GY9aM$-g;piKK;={pV_sd=5rsn2_f7?!0XLEBC#H>nno3&VSbKq(YoUq`j z`T0s11As6-UaZ_*Q6Y{m=jJCW!i|fZ9rY`bbP)W@eoVZ>puGG+;QyiOE1;s>!nLtM zL=XflKtfO?1f;u5Iwb`Jq(QnxQIrnJk?xl6Rzgxb1qA8N0S5TrLC^i~oyB4u9nZ`+ z^X>iaH=Y=6n%RU2K0VRQxoz~b0(Gse?tFZ_3usL4Q*P_2of0!F_?j25Z{g6;QzT((9{%QkbjJ9BSHdqRY(H#tp4R2*Ck|6Zk+aIBsU$NgPn!pytnmd z8Tx0y7=XdaWOG}aWn1VZC1rjmqAW4z8td8pg+3X`0yAjNaa)YiV*9zAJGVSmR+h@G zunVd*Agjp3!}DS7{=n?&1S>l`KkX9N|B3CF(O*mg)V@hcq0!Ng(5H=eFnV*HHId#_ zyY6Pyw-~$R@;yF0*!CYqfQ{u+a5RfJQ1|64m6Uy|st8nO*v$qt`p;@XbQ$&K3uq1< zcSK7QP$O5yD~9U@BG*JFzyJ8rIQ|8EQ$!tuO$*D)=3WO}xX_Iro&5KhGJbQOKbTmH zL9MhtsA(E@Jo=g1htO=p(>FC$m)?#H568Xp)T}+CspKj2i~6y^yDF8taX-lvrLS+9 z`0ws4eF+WiT^&1icS{49?b@&7{R{;iUtj*F-0Qrq4pPtDB0?3_;u+^=`gr+HNO!U5 z|GNNKnnCf?N>)ft*xX(M_ubn-|HK>&l(dfx&-xgsTi}`rB|ex$lsr9c@{yC4en7AB zG%po4xxh*8^CCy&hI76SVGqfys{*S>K|z_q%-?NfFX80mpFTg!>niKyWXI#-=3Zok zvnZ=<0F5b#b;81oeIzL{@Q3ivQ70#Q|Csq_7nZRNL3!(K({yXzlz8qU42jWyjpWhP z%!boz>)?w`uItfo!3J!zT_7=ZDPDk%W&~rr&;U}B%FwO_ z9X8<=z8H7+iU-8hy=b6@CaAEFDtwgZN=mV7@~mLE1~u%QahC{ClX_!Qxd3l4F%kRr z9bNF{Hn%s9fv#v&l9b5;^@{Oi#AW*_2B&^@fx3D?&Wt$z}Q zU1PaQGL7YoA=Fpe4iFj7tD2h9l9NZGPf=A>qJX=IE9mU$Z}N=3lz&$O0_=Dcc$g`W zca%w;EoA{hY$Ed*Zbx@|nG@L9kSSe#Z)IizyExbwS^8hNx;_~1s7zhBdXX9x7-2f!#*Hx;Nl|NV6+X9hU!^TG2-S>H& z#{@n;DZguk?Ej8DT-Ppn+-C&C7oW#~`|R!8M4Y`cGUdw`HS!hqxwoT#QU z{D0d@^~M_q=64azB~M}g5LB*3U}2$3-w9vjR%W?+wL!}!kg;5xIQn8!9ipQPj!~-H z2VbCS|AG#;e{Us{@RP{zPQ-C_%_-=W|Mb628ANi_(v|lJuIwSa^1VO>35lB%f>|If zkZIg43pe%qZ~T9W<=OT1t30c`fKd&(@1^rzJE_114hc~JdGNpe1A)AQLx!xHHeOzC z$EE(tJ@no?NXg5qG#d&X)g)KVg9E@}Rin^)dd{%jq1uTYITHl3dQKF#&R!gadFhgn z=V{NIH?~50Ht~G1G_vWt^|;>1l_QUd%CKX=?M?%1R7) zw-EisSO2|?fp=G4zq>d6x+wQM&1E^on zk>c!=A|;hoRmDUnZn2u4^d#EG@ppgWb~JyLu^z?r3m95<;$g&VYqIc70y{JjLKN5! zXlQD(JlWv+->2;o6{JM>^w230C~u*2G)nImH~z-+4A_KXVuz3)moPayIdwGobekF& zL1>VJ9Da3d3}kaYuidv}W}heJtt{2$FU!>o@+Ymi4@KP?w1MFvUk1^gMo!GhRW6#z zpad94{HGmPuZ{PV^9|I*z@ zK>Ey0jgEfSyx6A+gnI%4jC#gtP^R45lUbA{*9C7DBD}A94Q~S=8vFYD>y}%GrloPA z^{B6$ndUiC(%4EzM;NT6 zaBIXuqnzF^^#&1;8K5_;H=vff&^E15%N1;{L+|WIMvK0-Td8xN9TnLD|u_5o@pPal_iIZOuS5 ze0MJwjMoF!I0p2Lhl=%t0S%f6dF$CLqJJT&;ZFz9GXV#U$LLs?wR83yo)9Q4Q&Rk{ zgi`fx81Ahn$+pHVkQJF4yoQZMhI4nTC181dW(H2l3f26$%=pPArF0616%L0@eN=)V zDW%xX8ISp_`o-vZ#I*SwF1*6F0Q_Yk<7Z&V<>lex_w?)w+IYa`X^WM!SVDCogZX`rV*BTO z1zWV~KLe@F#*nOXJ~i@ZpSZDvK^^upKORw4)wed`bp`iwET6j#%85))j(EJ{tTf+{ zM&A3edw)6reMOg&f0SN~l zxI^CjcUIOrVqL}h!epgr`AgaaS30a@XR5pFswF%FxhraQ`8x0mGH+Do{sH>2+~ ztp#eoj;uf-2UpY#FKR;*eYGgsqZb4S!MB8G|% ze~oux>}Mx~Qt;nKF4{(P_Bx`I+WV!EQA|{nJZvaH7{$UN`(Wu)HkG}0L@2lkub6UR$0xl(_I%|-|6E%*AMd8=#r8@Qw_Y@ zS{eqdX9vlfc(6;&WMV3Viip=ON()k(tgPNb!x>;SKkS2V9C-ezLc%KGxr!`szJ+1T29V?$v@I4lTk6F7u%z;W zVzZ_uH@GzoYN4OL??^4D^J6BuBaXMS*%&5AC3?ah0cdlpErX-I_us$kS1O^d-6PTD z;3}1nY~yg_aDqY?>VoCI7JK;Apuue?egPw)0W?Zrrq`rz0t#OVm(vOTq~Sj#Fc*7M zZNYlX%-W~||CZD5f$SkwRhcheMm0Wk~Cbk{ETwYGkx?j4AN&jR{DYO1OZE5nJP zalp!Vnkuaz7sms1ki~&);{dtq82kkg>RtCqX{h{wL+jiFX$1(a+iaI&&Btbe^q%NZT5-N{-EuQDP8ETaIIn^$@&I( zevcDZtBHyTatTNCfnOEEkqJ|8VvkBMBHsh6I`X<}a1@>c!-7s@ZsAs8GY(?3#Qe|n zFL6LW`l;P#S`jMQJWo_Ps^6q2FLon=}GPr`N>^An3O3G-+B7e-`H}ZKg|)>ioif= z@y)>UDUqLOEVq4F&Gk!{4iKgJ_Jezz+ZF&{UC%Hg?0d(HvH~fAMq6HYMm`^qBZ5XnYTj2 zRS2N!t0x9+^x5eqW9aKRZ%mnpiCriEHvYxH!h+LmFat^{AS3@I*@&E5TZ8E*P*~e% zTK3Z+bVVax`vZzW8B2@ZMQwv0nAH7}Xf{4jwwl&mbu&E+(c&P?A(wulZj2 zgte+|@esbY^B>zE)(M)+q1P7CKPp3J1uF_ARLlZ&Ii+jHFqJ+PfJ&#QXij|4edu2E81-D zu{Kg9Mnvp+UPWEq&TJp9&1F%Ua@=UmgKG|DZu>cNB_sS67Wwr2J9kGbf6SV})R7o_E?BqBA|sBp&GPe|tO9%gZud zHdjk)6qF_Pp4_qnAnF_4R){?PF+S+jKA4hG2a}ZVnFm;>HTkpwvYGMmWA-OKC8ebs zJ9h9J#Bsf#+MT#PO#;3fXALlPG$$i}S^s7YaB+ctRm%&*Z~x7GH#)VrE66yimj(5O zaPtG(iE?etRdx%s#s=51IqYW@cP>Rxn=LkaW^`Sii%_0f*t`JTEE$$DrY0H?Pr35` zavT=#4eKRLztj@TKMo_AMD&QJ-j|&*hmjI=F3|`Jlb;zWDc)I6b~Z_S6Fi!#_ANie zVS|G2SVgUxV?JB%=$ST;nA{x+!mZA@y+|3Bs*D9}?tP2IrOjslC=r?3qk6Wi%I=1| zfS`SOL&HA{!>wg#&Y4l8qvf-E$xi-Kpia-F@-Y3~1$bK0J*1J{ z_4Iz}+qZ7>mJW>+Rg3GE+yPoiMq42%;K10_27pm5ggygmmTYfr$2%Pe_$XdS48puu!* zz`aCD^3zDRTDndR7tGdqn71@uzH}3)=d`fsgz5^`PqF2MmLwLL1hn&3K}69%s7?$s zGvqtQIgF(w2-G_}EB(q1+w-?GGo$;5e(M*+#K6D`2YhP)PibLcVPftd-uWjIp$P~H z2VR$*95BvCpIp~TRygk^Q;G|LWE47L$`f}+*FOBM=#+MUW^dx|TAVD&XjMma?MDr> zK<2Nf8^+!7I=;2wG0JP+b8EzX5_6JHgU=^x4V%~bxsq@gUT>M>DZi0Fr=4B*uXnXG z;-@1$Nd+qm3dUBf8CH+nGvR=(+Pv@6nH-Tq={@f0)SW4fE!5g}-xG`!EgN&k9Ifz# zAj)t#HtP#XIF{)!_QuEiVb-|sH*fbF&!H}(a~1pT4>)&Z`lIBSi^6rj$D4AjOVSN78N%x@TYc>f}l z0e5_kOa#`fE5@slhB@W$dZF?oLDhD}JwCSWBMRa6Q}!SyW3raeLxvOi@N zm4!eUf%7LmR?EW^(kM08d+|a5@{%`Xf^-a$GKBK)-TFZa4yImzR=uH8X=hSpIuKW6YyeeI{M)yUZ_e=oD?KtKr0LI{|E6WN0hw4w zOW%*O2N_37ZF$M5xY(Gv*j`UrH4WzOsHhw_Ufodp%`iV#L*?BOQ~4%qE!jgXirHi@ zG1(Q9oH)4)MncD&HWB9bWZyHjX|fccVqs?YX~}G1&yI&IV`MvB`Sjg4SLLScvLL&B z5BDpv=u@j&!qu|N%9^4zeo43By{$vdQ@$O2zRvxMI~I9t?8GyF z87y+kJl-x*@3s9grsE*z{z^}ZkXPMatKN9~dAzCboo{AAsq>r6>7!}R^HNcb32{Ou z#XfwYz{~gUd#h`*u8$oZ3#~;E1-MoFAg_>a;qnx_&v;oKf2#FCq!;r56l?ky4HfDp zIn}yKUI@8|7-Sd0;*c6w2&-&@bi>BM`pJ4k%M7{!-S=;!!Co8a%Lu8+U#EZ^*mr4w zg@m&Z><-+EinbYa{9&FpSu_t$Tv*Vm`he33_prAxRRw^+cJ?I;vR5%SI^oo)218p# z#Zc(0ycc~3j_9~8Ah#$Y-U6_%I;RjzQ`3%l1UF|1C>UfjuK+4pEl*2ET3SvR8(X!jyw(kPtj^X zAKpYuHfD<`0)W)>^u!%zIk-VKQalJKE>Qr^1|A<6iPWv#-I5g%p(0PQHIB@`t);Ad^RDaeNRcr>N1jm^ z3BEhr+uH+~d?igdBEWH;uc!(h1qDBiF9WO|b_O*ypUVMrWG7omS=rITSMXPEk4z2= zi~ln}Z(H#NxXKmf;v&WmqR0EBn0T%CMmHa`p+1 zjI1oE0uT13w}FMb8{g!QEXi!u>-}jU-vBov3oMz-tm0{1V|iWqxVhVhhn-sS=JPqP zV)WB~N}*$65x?I`h^b>_SOY{{Ld@4ig|BsMXzzP}RllQ57@wa0c;E?>V5}`k8Z-_| zE&Mh%qCi@BaH8-TjHE%;aH4E|_U$Et|7KK^&oniS50dP|nq|j|Ep`KI5Lo2mfn>mT zK>jv;{pfUXs>G~Mp|noWT{?nVTAk{dj63z1)llJp`1~i|K=mq<=PLsbN4lN~at%CT zewuhkX!`ErV40O)#)r^CW^$^{pYBVBy774`)ag=qVez~N{m-eWc|X?KfUg8%=tWk# zBksEGjl}4;{$}j?T&1RRpxr8y#^&sL9o5exDMyMggf!aKe0qvBeurK;_)sh}bXlr+ zU=){G2oGGT?dW7;V?O97ul-P*k)QAcoNZyNYys%&zGDV0xGHzxVxvHw{J(gK4WmP| zp*6pN-RzNYPZ0kDIF0?<_=oSk84V_Y)X>@7+#fA2NaVhR2c1g6cRZJIwjP4_lq>t< z$uSMkIJuy|vheeX5N4#=%G_XF_x#4eJ-&E)&0Z*9ea_}$oBS^Qx}yZd#HZ6wyac|! z{<8!aaK~&aDmQIbj6>T_G2>U*OJL1!o!d2 zPLChpe*&e%6vF31iPr5A79eC>NQq0vH(FD56vdRRtgM{D)DmYuQMx7LeW034KW{#GW3`&A~lta?!SwCs!tKRi4nlR+lJ_t_FeMj)h7c7oIv zER5s#&{5(7M$t_1$x4sSk!cjrH)jiZnaUU7pf?t61A@ox>}n z8f8D!v{!ArXMc43NVrpoJ*eOxAoE_dvDp9Atv5AU+g=?4^z34C;Jq=qn&MK^t`|?% zC+g_A(*lIKvuwDi>MPzo9!Mj~r1XATXfA~5jC|FB1!-P-etYuy zRCbX^Dig>cVmEx zS#tnv>vCG!2l&m!MW^u&CWej+J<~HS7cj};DebCC5O;u38LOcvmjyt6aQarZQLFRN z3An@hqpOS04VfW9rBQCZ35t`?WMnYOVM4Gye=52PhCPwp?Css%K|ys9QOMSYhUq3@ zVq#)Yi4mc~ha%Z#%Fo1>4jfh1*+; z&QwZQGIWJ!b8~WF5(c_&sqfuBr^|(%p19s77tz$LveK2~e zK6z`NmR6>}s-xj_7EuJ7vYPU8B;){K8w1*inwm#p%ScfXt(2@II=VX`!JsWF`sYV@ zHlzRnzLhz7dB83a0f;Z?I8u6RRo-N^p2AoRWVia2bO#P=_f7rt^~8ikSE0quzc-&- zOn;Ne_~lFDo0yr}>U1~;2JV!UykNizzO;Z;Cm^^0e+0YPJE!W`X62#ah2ea6Y?Y!T zdf)=BR<74nvptC{eQ7x9|G;s|@hS$(tnH=O$oB7&&vw-yR!8lS9WNs0s&p45sPF-u zJ|Y7oLT^0n2}Yi7Gsx8-K@ZvwetzhCa)X35f7%NGu>VkGE1uQY z(BLs%{>eMI$tS2IiV2pP`I*}e?2ZyMH3Xv0wWFx4OwGaJdI?`#4%qj2o;;6_h>*oR zSk6D_-`>g~Jk9t~45IW7Yp6Bd8q10C!JGpcYU;fOg;P@A@!g%1BJ-{^ndQ_f&!58u z20Xm33afnXJn&h8oAdtLH}TEQq0wTKV^)@r-yif#eIViHQoz1kSz*7swPXN7zuX=5 z^)Cjp{`6D4c0bySW;WD#y;bz}>&7R77C>cqY(9h;HZg-1mABo}EQ&P~rm0}70*a#b zMs-K$SROnu+?wUj6ar0I1T<^p5Nx6jk+6*ACj~XfA||S;JdL(M>sYD84Vwtn{j&gP zU?eM?mz5tBZF6+%Lhu^rw?P8^5xo@nrya+8$^w4k+&P+zl8cYPk7BMnJ{=|pn2RHQ zGhhIIm(3g>{j^uIco6E9Kb(PC>>o!#z2PL5X|oz{vY!-CXE-)MpV28_7>F#V>{*aC0My{2U?m?YCk< zIsBb69m7GHHU)n8O=3ThB>aMM5h_~Xb%qn|eiC^=)&&iP%-meiI)q7Q|DX{-LUwoT z{QY+TW(jk}XEHb{%AXfG41$TXvS?vi3tu86pr3ab=efYpp}ntY8xWRaL3@MfIq8{j zIEHe(g`ZPQW8OuC-@ZS7<9T5>07WwW0Q9S=(+=a0W zO3UYEk!`5inzbvAu~A&E;~_Iw9M&gGT~FDvY-f8mvFCGBMmuvgf7QBD{y9*>u@C6( z*iM}K8m6qQ7h=7+RY7*0!r0-r&Um_`nE{9`u)GdFKBhBtOU3)+N)(b2wrO_jvrbz6o-p`*`0Qvxa zS5)K!9tASW&``yc>=y#pko_QhaG(u$2BuDr+8ffGH$V0@sd(gMQd(;`bDS;SVw@PK4D;p!(;Y9ae#>FB64a9Pv~Qb zy^^@N_=se6O-)8j6O7SEho449MDDCjNUN#IIn0Vn;^t;%9!#1Xfp)hS9?0u=&UH@8 zJtm55y$+Stu_I{+)Q+X4s(RB1z&1nG_H2L%rgc)d3V;K_EGR1*8XOFf1*))F7M=Y4 z)-1&YBzk7j*43q|q-55g@sqeaP~XHv67vxQ5rAfiZr*%l3ZC2nwy$40|gXvcBn;^ z-0j&!lH9y zg&G4xQbbT01F0cu<=3w~@G_q5^^7XdK+llpe$PuoL&B_!YZjZD0iKbGkU2p(TNKUlCjKNjSBqW3r3;fy{_)R< zqsjyUb@}^r51o|YHys_m-}nAP+WsNWyM`1Y$WBC3ui_^WMe2~xl6Unt#RnD60gjZd z>XFK8BMS?VUewe=)y_&%JfiegRt^2FZv(A604KBN{K%34iybbt@w998- z9zlz*s-nw>qH@x8m$ZUeV4Rsj#YRU(o6{w7!?mdCy9~znvW+ADBA2`!8 zBeSx8z)tL!&XU=G;1w@_wCAw2lx5uAJh*tCpKUAyN>Q0jK@)dR8M5BZ6gjzk)7eu;?=lTci2Zzr za!$wiH}J@*4o1SD&%4xAe6GnAuo7BzKZZ)*3%fM?b>#RX%JOSmV&_+8rBuEhIN?rI zIBviD=3RlEuBxnjjpXTv)Hd3Ot++hyc6F11+YL5Lrep{Go72fh%B%);weMgMp=@Y| z+8u_m2eeQPuQGF(188-u`IwK2ecf=Mk7O`^%ffOZ6z?@)7v4)7m)!l95t@ntC5VW{<-2T_ zuXZ;Sgu=uIX=#xSphEG66k4Lr-;9d#b?X?=kR>X7Nm<#hx*!2S$-r1_6vh|Oe@3Gy z-=H+Uz6b+|qSbny-4!nl5EVCmh5R${1<1gI%R^FNAp&--2*mAM3qLHuhL6%42pP9- zEr3$*IqH(dDn^Uci5&??5f;rE@G;S1#cw6tdEzdv~Jy)-W(HSTIb;o_zcK-Wihe9%+B8*xO9@x)5v7%Uj)^()-K>1Y_E4{=w8!; z@B-!}m^QY{Tdc<7gaVesUmsEYrq~Vbo@a@^mZcHe_EI^TiiO1%x-H(pvaw&lP4@`Z zAv9gZE-=#^ad@~sA3`JyM-a#r)p{KJx*VVmwu8EoK_~M&a$%R;+qz<1wbqcC5MV^G zS+K~Zq@FE43CTcC7R|VGI78K{LB$44N5nfB};_Paiqh9dCvt*ngo^kgwB zto6#0e$UGRq1BW$tZiYuqVr%|?LlZER}Bie@beeUH@&>(0k{TWy|ev=EYw%nOr)%W z#zR7vgfle2bzXd zpf$n-vmIz=nf=Q7^I5Wp-CWzAoVnVoBr(xT0q|d@Z-VymOn7JG35*qd;&@MkV2F)G zv7#tSAGH)2*Y!1=D^N@RQdzC3#B?~mI@hV;G2a1Sn>;U4`(7*Mbsr^VWvZK3Qvo6+ zcUZ51{z8%8L8WnTnVpr2D$6Jx3ieu{K6ZA&OsAN`fez>`)Qsz_XVfoakaa$c&V@*< zoSc)h#Pu3*GLOr9`}>3Wu%A!p#q9LC}ZVH%4M%g|10!B?2FCsm6f|3mo zRy=i#2}HJi{r#x48kd~~kDUcQviK8kyby_Em)%hU8rebR6i_Gj6`>#?2onpqUX6&NV=2ocmpB9&##PIOA!gm-j zR_#19kE^V_6JeT>ZRTe828yNuoe2BC3!);Lu z$Yc)otD|{fdrCb=Jt0`@7kztdq+$TH_c92B&WIfXT}-z-Bxll!o<1*(wYWDb>ix~t zxi;UqPkxBQ<6%cqgC}2LGHu@yLQ~66YUi*_ATVpq)^_y+>T; zlcRq$Gab_Ize{b4d1B-{HKIwjPVOD7)XkFh{fa4WnkiAECeW8DI;(}OE z{7!NlveayOngoHn*|~ITtnS0mPLu~U#QWYH!zC4@v9lvZ@hccGt?$|q4a|+ri1a%t z+p6!vFvVZG^Llt3C)*Ke$@Op|)ww9*oQK|r%VNE^0l{_GeQmF*J!2!jU4leI$|Z!b z_2^{xvAb*eZUjk0^lrR{6nb%mEN!s-nxbi*w$4bOX0sfRT1vc%0vqj>)zyF4yr=DL z&SxU;IU^7%nG~b!RwdLGwv{24^Cyk z$3Vsn&V?#$hA*qDgd1C1Keo(BaRYya&vOCd8O^g>p!WzaquAKkFjGNw^PAne_5s`- z&KhVSEEw^jxh1>WG(v_CPrLv}V;NR2pL`b6PLxfTqs^O)_nwk;VlO(F{A$VP>!AG$}0-7pV0|38d zW@SC-e*y!ltWD^{G1i{r^Ud1s9~^|z=2!&ZAS(oc0HZV7RZmc!lAxmS{yMVGwY$4J zR%}8-=1I?k%CX~Z8_d;Iqa=jPG(j~t2Dqy_<#_YI6`TGX@(;r-&*yq9!9BN3t4W4` zX!AFW@~WzFEbi0({HHXnKk!}}nwl1NEJdqj?k7LB=v@)BQ*>#@w)r&NTCXlHu2u=8 zB+u@>9q*={GO$r@&2R1Pq^zDym)@uDO>Rj19_?H4hF9a96L} z{mLF6uZ{$02drAaN`YbqhAHmJ?aS!YAoD!GNsyP9S7<1{>R+_8kc6}I``p~{=-X9B z>F$7#f@ovvAPcB3P!ui#ikFllK!=eg&()va_lAD;4%o58-!?KF@W#WxVY9h9wr^-f z5yHWPqGQDhYcubenh=f+BIQ*zgz_*gF{7XcQskKgg4k7~0od;fe+_bWe}N zzE6x-;tPd_#e*2HAKve!(E}y>cK|AFf-G81tz}^Wfo4oUuk{O8xp3vmGK`BQhbsOO zYB*b7GB0l;0U%pcYI^c>iO&~sD!in1iJ~(>L@AGGX=4V!_m3Tkx=_jo%F5q+lR}Cs zgY-=sBl5x{txvo5wD0=D-{wLNe@(Pm+}PmBEw`e>-A?+fklDw85RG|i`s2?ApFJj2 zRJG6DrTxUnRQDwdo<4_E+I>e~DmvyXJ^dZY_}<;vYdbiIr>3UnFW)Zl!D4Wk*3}Od zM^nfE=Hv}N=|LC&CWv2ha|gO&{cx`F?VA{}u8fwv94($^<)(qQtc1Rer2cP~ENFMg zqNz|wlikG`Nmi&nULU+JmY~W5CtWG2O1no=4#RKG9cMOYshC~Gp2QP^?nETLrfhgK z&TZzX!|}1sTx=CYnNcVI$OtD?9`Lfyo~?Y4Z;!ghbOWV!bAGYC~@F!LnJJ1zAu!bDvmyIDch1tbE%3CTM+BV!?3 zZ3gZt)K_d4qp!EY?n@HpeH@-Ax-h&06kSn~E%Y=bF#(9**VBVK@m7x2gnBIF3Z};c zTU)-89Wr|deVaB|=o#S{5Wg~gzd_?4JlK_H#!Bto4xc{X3o_qLqhmu%6eJUnQ;|=f z03H$YB&gV-p^rK~Rcd>lPnxgBh%3|z!w?90m&htmGC zP?yNcat_bq@6Z7s?JF@G1CA=dl>x`1Ln*!oh|C)6XE?*O;@#*^QBi=P~Y(4SW5R+u+_)<1EE%(HPHd0@c5L@|4%4tVe+@7ZJZ7so{K^aHUV|HA)CKcg{r(H) z=no%0sH|yEZ8||^0?)h|1&A?B-O>7WZV=_h@Q?il^yJIeZl&brqFYfGuWc5=J6^5?PM(tm1w}~F0P?3Ibx|(% zYRprUMsXUDT{YLz;vxSw$??(QFn!D(&y0*CX9?4a2YL#*En5e(RinU}mdR zp}4Dqg2)H;@rf&uFm#?3)YZYnU@NHWeuzY4Q@5{365O)Zy`X!XS}H1kTniNdL_+0V zURmkZrvt!e;G2Ou*@tVlEnmC{j*O(KVtu&aAE`D8t5dShrpTx>leww!JvI#1cYn6| z;M{fCw-nOT(|h)euB38`<^zt5gi~-#j0-gMVG7-9$>r1o^NhLnJwW%LY>E#U`d+~$ zZJpoFEQOR3yxH)CfV;6iUa`Df6@bTV+W!&a7bFGk5xEJzw3&yzFnhovXm00=K(xKA zta9WAP>D*tiG{`S$THkZ{*STRO2E$r({I=`y|I6)I5?h~^`@MF;={!FD4JLDN>y>E zaKT>cXSVV8gUrTi8qxf?Pw&Y*YunTm`{qoR28Nz~?Po6Rof*wGu{C3$gPYr$$=)bL zIz+c9sSi2(BroD6JGw0P*oof}Mc@34>%dg|^4pq2MRj9l(}{_RY3BiYxnMYh{j?0Q zgVCx10NKRge7(>U4WU&j{kkyPJrachc`*2SfrwLGF;$M9urxh=E-W7C)JysV++rGU zY}B8uy#NDq<&Y>ZuLg)e6BAXEEg)fKFNc=p_jgY@ukmx&Nn)>64 zau<>~9_OyuSuOha>JGGVH(&+M=g1zUZxig;(Xt&hvz zw9Is%x4GGO z65p#Q{+JjEH#zRfW~<`J#a70Jg=Gip^Y{UslgVP#7j!?^Ew#$7^_@#7lnihV-k5u> zj|^Y&FK4tGV0BO)Vpde>Q-B|pAq9mYmE%)`xGW<*K?glSOFa)+J;A`@`(Mm1N(~PzWDc(YQ5)vO#A0?=Mba%^1N-}{; z65|=6>nnKl5f~YX`O+hEwJIo?nSXU#$=(J5^Qm@dJH9_G(dUj|boXW+&G@c9uZ=l7nTH{J7|oZ{Nr?vR$lluZ`IvRZ>dxqfMR zxjn|fjqkMaeUa|3Y}hD?=$Snm!!l*OLKFr91rM6DEwBOd}=-% z4EH=N6g+zaKYeP8tYL)KJTN~US4SUkaz?kzM90K1&(Le0RHf>io&a!d84<@o>@Voy2wafzz=VX;^ zqS{&mJ`Yq>Z0vT436L;zHOm6kzmQK75A^jRIBlE3(Hx&3?4z%g+l||W{0&dd26y=R zt>OGAXS1ljPFCx*J=f%0yRThjL^_Z?24d;gF7dyieX!X%@U2XZpfR6l_TW!fq8dbNVMGQZ0JWSgK%e`Jb?fbP#l56~QsL0NiVdp@$>0;Zgw zHwl@T5BE$s?{%@CO8r%P2Ek|F0NV;JZ0v2tHFbG;>*+>OBP)TC<{-%UuZ>TbMIr7& zIhvnDjN-W06~*KZQrAScko99#d}B5k32ufSZg+QITCMmIymx-yfhnib{_RJ5M`^Uz zdqhN@yaLVdtc>Mot~RxcN;C0k&HR!9o-upm9Q-uL$H^q?WUD=F#l(Xr&9dj!t-1Yw0c*^NJQ za}||bv<^T`L1OjxJpgd9N$wUmhKP$bj1Wu`!n2NixRq^h<)-9EuK}w&hK8H? z&EX6{AgcWQY!A>M(Zjo_=v_s{X82>r$AS&reSH((Q^79MN26@-_okCMNQ+!*MIrZ8 zrV3LWhoY@IS2dKg`D3hR>mBkuZB+U@RyAYB$~w9`olaK-X19gOlHc)(U0J-vIqVup zIJl$7eII@O@KCmYi1Z4Dro^93Cm0=Wy`u=hyo9EwyrE^_;n|v~y7j%*?*SXz&w2qh z7&dyDoyVw`n_AO>KuF@^;#LZEABM6lbYGSSa}5FRc%u`*9$G_IT z!1(OnG!0N&B+}_X5R^VXe#G26!^vPAtxdSXz^oD~&P#a}FT75779Za%zYi;ty+FP3 zUcv+d$nv0$h#lx|l)if?P~*b7Jmff0x%M>H{1JU!J8V{DZQz~ma<9~sfLEeaj^$D@RIxCvXJ z8nS{&ZY1D-p^sHajAkNZs7HMM49QYPQlrvTjGo^5y?Z%-uP_^zEEII->{f;e&%Sc> zKSuEc2C@+mQ4i%!7;t~o_a_-+XWE?EoI%#PzPTzHiaP9CW5~Cnk0hGQGDDP?B9l$( znhuTf%;yg+RlE3py^|f-IDDU-bmMfZqcfMDl5CxUR&h4{*;)1pFaP-x`XcG*>Fel_ zHxxh#%QX@Gu5S$OmpFp%3`l!n8yR`LwzbVsXp%)Q3xR{S4iqT0>0h`|6G(#iyHVkP zm`XPtD^-y1+3x6&GryvM0Ud(ofaR5OXJ%+rtkPj@kfgjnfO}tEl&vJDcuP*Sy}-+A z+bdl}R{Nup!lXAe3|CEYw@9tWhqLqqb&Q60`PbJr+d|x4{8d(mw@{|1HNS#^r1cUA z24h}%`Glmc1EFw2)cC~2$Y0v;%BzuHr2_1wg;xhhr-{R?(B4IXFJ8&3p9$hYY|s%l zH%6x)5;8JBax<(nFClM;irgz@f!8iEU#u`2$^@%BsDHdy>8?&Kk2y}&-v%WQGOm8u z$Qbg}Bfq1>Tg0UmbqGQdMOQT}h|CtE3Q44xp4xRRIqJmY+01;;CA|G9v8=Q#d%!t2 z)7`f8O!Wy~UO>g`E!jgxF987&*nWe9gB>5=zrPgO4lo5n?mO@g(2uW1w)BAxC3?Z_Y(uzJR& zg*TT!m^LsHbOr-!W(aeFj~{2l7x!;VwX<3Ap?-hYyu{$NyTngUK7CaS4+G;z8|uI# zl5rB^!P(_wU?4O~cR(4&Mpl+#Oz@^bqxU&Z&WgKi_g;Xy$Y&rsZ>UV^;s)U`cC;%F zvF$Dupf}Nvp*4eyjK%)t^3jSmyX$JKON+m_tGGO+T8=*dd)b6>y(|3kIvv+NHa9oX zq3an{B!J-GS&5-lvWukkocukB;LVQ_i<+cesb~Q1DlJzc`IpdJ8`} zg|J|3C5dWQ)^Z_9*7!*IE>m&FF7o$IN061}`pQ(VQR3G$+%ecV39nstW=}Tzd?0^# z%h?VD9I4xMR^UWyMcJ5~L_;Ox-TEPg-p;c8%UajU zokexKU(9{xkGf&=L0v;VBQG&AHS+;K3p@LMUpgHHaCQ`w9_Qz}=+-%Brl!*4tA66Q z^!>g#WU1w{$*eA?HaXH(V(+(SSV8=Fh!fTlGZ?TXRNH}fr=6X?fx(|Eq7*m&O0Z`X z;u9!+Z0+cfP{2-0^9>8-v^pBTbu|FAwEk zDIgKi6AN6)%iSqEHH`9E)SBk9$OY@Se zM!cG;qBJR!DcCHvt8A7>JD#<5w{4U0xZoGVpDe1_TE&)F9g1^Jp3dxl+UiSDG|3kv zF*mz2GWhhW>;L2GEuf-YyZ2!X4I;0!a0hLaXmR3?~Xs{^(=?mpKgbCmdkE^`=+-q6r-{P-E$xxkk4 zK_>90OU<#wE>s%Ikgo1+X4$~UqxFCT%Kc4#ZwB8@O-&8vJeEJ5eek~dr6nK$?jBN) zPsN7Okdr8_K_$ zkCF*~nHT3>Loi{$X-Fgw06t zPHfGv%HPx59D|R5+xqD1`=%va1mF>Gb$JbqJgKnRN8cha9~i3^2wtRQh&WH{jQ(l1 z#d@mCJE-x|>tITp-E zHzB#Ooi}&3x5ntM1^DEl@^zZ5oXg8`ia2rR*kYM0^XNa27iE6_jLk{Xo^0owd@7KV z6UK`+&3 zH30H&*_4O?qjsv8z`#NqV_Nr3CNc4VE!OdqZ|7i7_i*8rJDK%A$k!JnZ2sZ+<>$mU z6Jb)_aAi@Y>S&5GCiuppmo`wom}fuM@h(BIa4GrQHxLi*`(16i^!b>0_IzPCgW|)7 zRmF{uBc_147TVdG77%(?2P?-K5mUlAg(2N)!8K9#SrH#XN6`Zqt~mLLv}{VOcrK_1 z0JSMiz}mix5rDMsn`geC4O+@`n~%D@kdp&Xw&Sh7mQ`8U2OY4PTKZ=u@d}sYMpr)9 z`VSS(|BiM%0`Q2=50x zEO*>3mEfLhqb%ip-J|LDNO|j!bI!lgfs}&s#_M>?7b!^BxVCb%8Rhic&-Fton#NZ{ zsh^}|cHx(BMk_*Nj?+|pcJx2X8Qcepp;PQ~;J7yR{?B_dKklWz%(1j`f-nsisVHZH zmEmH?nTe^}=H`_4{Q}Z5IX9PhGhFugJUv5ObkLgBNdpX!w$(xw!NnzV z_M%IprO3tMPS1v-QkU{b*-SLb*2+Gkdg6_w`+d?oY_V}dHhgP4+%%I*YhhVxVu8if0IY1f1^NeOqtk?E%=LRmWzBtiQqT)iDQa>Kv_RU;~jOd3U4^Qm+Zqoa+nf)(u z5LWz^*PY+1;FkdDR;a8XN2%R3+L*orKI>%4e_PO=m32x`@|@U&h{W;c+Q1u{u4xU2 z1GCQQgg1w50XDq&sd>+o!PPf^e%<5YKs&N=x>>H803wK1ax?lLbIY~g;7;*FRnp%o7PdC(fBvrDtFd> zUp12!&u1IF&?_htJLA03LRgZM;GPjF>XN-0xNph@qIDJc!j7|^@-GK7Rp|EHUtD%_ zu-}jTgyXoxQzLQqz zTlQunRQ1Ds#J#p_rzHk`egKKzuo$^~o92dow?~oo1HAIhFu6lnihGU0>^CfiOC=HM zeJrDsMU?@@N=5;fM%y-e>%q43S`Hmde`7*$L3?%qd1#}kNAq(wIFc3@2(r53r0bgd zzoqxH8T!#iT%Rp2bQVq?=e5|#zTjbhEO>Z=uCCvOlQurQ{(G@ET2ifWOWE+(Be3p_ z^!dFH!5=(I9;Xw1WoY>6pG_DX9g?F7 z_n+VEdfo9`MneMxh;bm{x##M7(vw#G=#Lz3*ThjHP1*U9#D9Jme4r)HvqDg*&3m z4r>h-$s=h+erJLnUf2*u&fAe<9T4j)enN|WNUK8C^%nu^ww@IS-LnlC-Bejj0^ zwVUbcm8!D2)AF*OsujXaCCSeXsh-Kc8q6B`nU?JjTN2`YI_Qrx7 z;&ixD*yxW~nsU>yeWSN%I5N(+U?e)i=jgdPTOlkow2M{*iQtUpTgc`3cGSyJ)#V>L z?QiXB6u8a=; z8wtkd_IGfJO@W+!mgIE7d$*R=R9eZEfmYb?Gw>+WU3M?k5#y-KD~nesPV{%Ywy9iqvns&s^}qKsj#dVw)G_- zG(b#iR@*`3t{FWNPI+V`yRQ%b@q^!Gw6(T7fsn9-uS{kwM!;~=^3gk5LWt&CBM+q* zvU+%xLe{T9n2;I|vLE!^XYq-@e;D;mF9d`N|3;zA8ayhu*;RTV0{?6?y9dD;BPLRp z_f*S!o|2dd17=_UFL?2;pW=S4xC=Xz)7Z~I(1*ruzGLfXKMGovOvu8z956#E_Z#0JuT#o9Cxx^i|)&i7lm`%iRAffKB$yAR4OFZDrze~#9xp`kg@j7u3s$|XP zkDR_tpG9wNZF#+_n=a9?w+KHuy!b5n9(b*NnWI~%BZ95vK7UUMg1F!LI1xjrujdk; zpB4mo38aoeUFlcysmMg!VG)})e|L^nk>{?ZYKF!m1ibY?**2d|=85ZPd}`Eg&tL+r zh%?ivc1`d~sojbp?Ll1oTM@gR`TgdUh{?F01$?&S^9naEMGM&&K!`Q^#wzO?doFqe~)`m4gl)n;k+ zLM{6~#t(=J5}euC&4p#+f(>Pfs605SE^EOpcRbc+4UX!NHA z@j|xw_X<|`A;ts2KcJKw#Q**h8mZ>2`8Q|xb0{yyn=rH-ZjCo|yw`jnr;`4z{l2*{ zA<8Q_($`rB$6o;vyf{Wj_J+Rpn|^jJPc>bZ3&_JfpE8C3rB%@D z7Gq9}rngb>aag*X8*z>3;Q@5_471a{$ z;|Yw0+a|KKB6hr%IvP1hLK~OG<<9Z1DH}yA17%(dSDJ=gTQtIqGV(xJ*nG7Ljp!-re@SC9J@{p?P~mx=0kJOrbLO3( zfjp#vfXq$m8uYaW$@}}Mv@G|KTh~1qfax*VdIc1Lb*AEbyF-> z$W;u1EW}5Ei`OhUag4Hk_o<_yBi!@j`*zXQ7!iBv=sQNNbp4Slxk>Ph1s(tVyk1%7 zAE7v@!~!%D8Q`R(_ke!Cm>>tDP+bdeU!Rkqa!EOrIwr_O<0tB(XR^;?Y8m4S}>8 zpnK#uMu2t1EbcGo-z@3eKCuRS)kiqMV%M(QCBLxVy z1y3)=^0~fRZqTt9EukWzmO^A`I=bu)jT6ox=#PhgfBE9~@`|(6^P`7|ly+);bwBCBpPv)*qD;*p*@)(Ep|D-* z@mW~5Tj@B4djn&CYC16{&AY0yhf9;2Q)h#dJHf?N$0t>m_adHT}rLne1L?RpOrHHP7eQ7b&XbkCYUit9h!^{&iGqb-X zo7DHLTBUhbQ&qrIOm=IY(cmF7l(C9tbyXctfb@t)CCzUJr6Y$N5^Prib6N>m`!phQ~sp(F18QL zQH$1zI3O*ogTBobT>UvH3)@z5Zf)IF|GwKONn71eTg|{$?-Gf0cNX+*m4$jAUTdak zSlzE<=gj+RAo*SYZiMCG)-8v*II-l~BK`LJG>a&kj*DZjA*!N5)+#p(a#={fr6%JS5E?pEqH1Gg%wK_D8Tr`v zs#o}ert7`~-qkPOzU(nvG*_G)ifXz^$s=HRM%aY{f#_XMcRwCv^vkLibzZLP3fV+1 z4{ohlb%4h{*d=Ys{}UeeIFMm~=ow5*W{NLU~_lQih}bajfm)M61v>UY6wt=^P~`GBy(_Ix)g( zpTU2E@5J5!?IV#0bnC-BacKv$b)MVh^QJ`qtva?q$sL5Z% z!z+MwV~_s>3WaVj$3GNVCQwi?YNQ)X{CNgwN+h@GwjZUB zclqmEST~u3PZrXnm^>TmGUBqGoC~Lv=_xEmcA70Im!pCr*5+$cB|gY)DsvCEVK&b_ zzG;T;6&w4EJl$4V5@TK(0q2RD_yFOPY7-Yq5u2}ZaaqtL?XILZiL+m!SzkDEUzYM2 zLc{(brpzJGQvxq)9KwryD<2K}^Mxxz*{kD7%$8c~ck4oCPUPz4jCDLH_nL=B5MQCF z&?<*^8(iEc$8zRKStO|vVW*#r z2LuUoZJI7yHEz$64Q7X*f#n9pz@DSil}X5LyWL|nCSC3F?ZQ7iJeI&98nD``6S@kW zs}YNlN35QZ^E`;UNGyrlzjs`F)#&83&G(Q1ZE(e{r5X^ZBXxD(Q}^&BAqlmmjqN-F zGBVnui!^0V$@(mhrdLo2bUUX!tE%wEy`{8O-{kyP%6^-%7awH#R@`-0E43bN%lcvf6;rhSo>1n< zu&WmwxLB5n0W!Ryaw?DfTdxNOAz&WodG-3W*WVOU1!QjjDeX0wSdJnH1Io)oFs9`# zwbeowNDZF=aS)W;{~DP1WeCT|txI?9wMK4?!aonr}2_3z;wxGKbM`65T7sS-2 zT@Uu=YhKZ$y(=kGnrbwwPjgW2u@w@?D0en{HCtcQ&L*ASZFk|!9eHW~ath_=%iaAI zu~6hJLu+ArpFG%nmYAHx+*F?}3M2`exLTLZD8dOJKTg;&7tr}-jYNMoL@1|(J{cL> z_G+-NVJlj>Xf|9L8gYM2`cN@OovNj3bG+V=d5@Nsj>GkjPF-s_A5vXyMe$3N6q>G` z3J|JMNnU@t>bjEtZw74qs;JD!H?0ZVN4zGssKh@FJJNI;-xpkyIiZf^9$lkI!or&91auq)x-T+DGqD|jlm zIJL{H0tSCtMx9m_W(b6el+^fC*8Gbeu)4I7(hGt*AEuc1|J2fd7}b3tBw@37-eUp; zPtkliZHwdb;n55lXao3)tiQ^a>=(LRnnUkG zySK3*uGkE)_Q1-|{{o&|C^6cpS5J&<8JuE|HGF%%^a&BXcA&SFcLCERfJM8(c!W(j z_yW~fbjZO`)ACSvVs0_`MpO5q=PSOj5BT5>*=-_1+7eV3C-Db(Z6QVNWl2CuJkd}5{ff!3De36G15i#hi4 zyn=hBqU3xxW3Yi_;mQ`1VPuq)IgQiC^2A8IhT-Mp6wBL!E8Y6>82l$6P&9yc5!1c# z41{2YHX8FhlClzjBg8D5jWA;*d$}X09MO~2e{C>hVc|8#nN!tz*Sc-!DABbV%~FWk z$)D)13~LBM+j>|aBq-qX z#cDt4w7$&+%}~TmYHBvoztAMs5g!v1E*_p;AptC+a(}1Y zR-%I)ikAEmwe=2F8dxM0a-Y{?=7iz!2B-P^)j9OJL;Mxn$*qZ>a%#|!4=+zC zQn4D90vdtoCqoSsauM8xkSMjah_@8EUa~KBm@(7V)`p1_$eNb-m0alXSdqJqkUq!vxSYxd-6@kLcf2_5@I0pY#G5 zq(hV6;&Q8zY}%jM?JHf-zl=8{=h$MJ8XI9UM$mcvBBupy?w#+?V}y*4L>@36lq)m3 z?(xxcF^8+|N6Ag`4x*mxfY$HixBHPgmE=e}P7^ zPt$0vIM4IvSMn$mHD8&SFl!%~YHD`<`9wYlJ8aOvM}KViILdR`grJAh#z;{1lWMi; z_xody)Wdg=&Wki$h5faJ+O!e=DYbgilnR|=e|rH!X`X12(|!1+@6>FeRql2<&p!f= zaq^1YlB`%>p`B=QvWxkfs^}SMIkS!is?VW9OJoNhBzA7oRN%V+pTen1t!psG*>SQ%c`dPK6V<-Xx-CG z^2RJ0FQt`=nvA$*+5ZUwTtT?-I^Y@;`iEC2ZLfYD?u#LpkPr{1O;Os845Dk%+rbig zV-Qvlg08Ey=M=oQLq1g7BQYY@kfA0wU1`_~Nt2Ix{M_X7ebjz-m>dSpAC$=zo-sg6 zl2ZBimrGG6qxa_eWlEIaD&FerX7!rB^nl1mDzx2D zw)}Lh4IUHD)!he0-T78LLT?;M2={Flw7@Gj_{>50YBsnqxANNfRio)h$sL=plDyF1 znb*uQVa7`LQQr-1mQBdKDD0vNGpdz^yHWe=tpSi5I_W@Q=b1RmK;3R|HNaR~sxJEUoIv)emyU%fQc53epaCW&J_&7{|){Hv#;{`<*C za@iOOyx{j4zQ-j~?*IZ-5)U$v94cJAwZn&O&6SbHWnEGtCWPKts$s|E0SQN1{GmaC zVS=kmods;0EZtS6s2}?BFJC}JQrk9KZmL5=Hte2w6kkzM1?=TQi@=sK(0ob7fpMx{ z+E7x7BbLfHGX{6D6TMktfPT17c874iSjY%_7PW5^ibuWNOi^E3A9*V(Q=^2NgSp^y z0w;XOBAyed2=!+!N+MjSyjAjqB~o!l$S{d_I6hyPj%*kUIUcEKR+@xHgW`JqT&jH zzPh`>kbsT|>!64?WYl+Q{7YjAEXo)AO2UpP;B58v?BkJh=~hraFfjZ535Uu~cxJBW zjqQnZEisJ8CD%C~AAL|$nrp5^^7J9AaSmA{i@f*yQfw^4PF?@!>Wr^`FsDw#!NUitQW%j6_9xB&?k?-EHKp@@3lN>Z-s=U-(o!Ji3_D0*kW+gwAyoH z(*FP~?f5}g*$)$zR$>@rto#%23<5RW9a5weMD4Qe}>>^ z^zGBBn)ho<8sD`vP}>?^foNs~LNSf&K93}0h&OYFin2&pe9hz*f!BI(I)7u>FvmSo z2tt?9KN`d4B`KJ#TJ<(SZ%yK(ph}jSnUJusOdu`cDt$*D00dhjZ^C_t=Q_3w5M9zk01TI$62lTN@en*)n`5ihIgJHA1UNq2CcTs zUep}-^k4%j-N?%lUOZ*Kv;F}QsLPNKNHy96IkMmVFVxjR4!6l4 zNQ?hw-r7)>#bn;r)*CG?U!-MxZ{|X;{pXyVcjd0@V`>*b5$ju8T8?hDrn7TEa`L6W zJ<#wcjD^oL$TBsG*x1(|7FkHH?(*71F916bIHwM58R@#rug#NmL>gVNm^|-k(B?%qAVpRx7KjX3ff%Z}CHW2<~+kbRU}zAt`j# zOMUZ9{q^J3tPwGMZQKPGMA&UaQO}nJ*ra}NXy1VkPJ~-@)duUu{cHb&2|%#!26tib z|Ms=`zl|Yw11O)ixH07{?aP&KPY5)%DA}}z6f+_V&N9?oV1~iA8J|?dLt{oI;d)C= zcP)Hq&&+OqI)XP4GI@RT!snILnCw}xz(5ew59nUj-) zNv2W<{>9(u^K9nMySmP;qU=Ne%bG$YH)pq3$J}AiqZ#hWK>x00_Delzu~JD#=EPvf zpKlIu@pMDJ^@MJm=^v?p#$C^S^QxBD_V#yG-Z1zLxSgA`kaR%Zjt*j()1&pMv0+6_ zMm{cjb}wfYI3J%NOa*S>ELD$R^z=KqMs^^fkS-4WFEmh*C~Rmb1_zmMIc6~ayA9J< zdUmBM|0)-T=WaRX)`I-H(feKe!=1;al>F8UJ!wnuTdAp|!&*A`TKlJQe`-2`lkBoK z5sL6sq_KoPL&LL>kNz_>H$ml*V$_CpOW_Lut%XzY+F~<_e~?&jE%lLWhq>ds>r?eG zCdJL|@*SgoCpI&;>JHPvx~C^Iq7}i)j36K|)bUNEqQdniA^7vAnmUPM-Rj{>c*FlS z{m2hOUnw~``Ec=iyqzgqVP0_7`qW{$J9U}Ex)DGTMy*1yc=A=#Pep1zQqX>1jMe9- zaG`f`d_c_2&Yl$#y0+ZgN)&sHf9BY+ZoUM^h3Q_!dfP-$`SaZsF;(cod_pH8qU|Ps z?>eD^fx$iJ63jyypL_Q7DMl zUB6V+L(BQ!EA^KA+6V84^f&7u2KQ&jt_%;q^|!b6cRNP@9Uco&?#-}f^X@v3xzxUs z4kHr_CkLiWA20i8|8i(X0`7yk-ZuSo+&lpK0RrmJ*_4UHAO!?mEM}&rRf*4h?%tik zJTKj8Bij0MK5+#8_UF8qq~hS{4<<%P zeT2N|Cr_Ri=KXye$VB5YYs~?=K2}zzo9T|QC2t;Ke)z*rA;F2!1a#v%18IYZ3ZO$K zc(Nft3PgPOk9Qw%n+jx~?Qr zswczGCDZL!kx@LYyXy+2yI22NYGn=~sw_25|F>`B0e&saJGu%zzVJ)19NXK+N;HkI z*l)X-0wsh;o*U1{5|TJ z8)AgvqY>|pa&nNt+f-7jO^`Sah-KASjo&u%3YUfZ3ZQdx-v4Yc|M_jlz`fPH$ zY?UA;sdnW=%FjaKA>Zz_^gPfry+fbo7 z065&X^UEJU-UJItpYZ-yOQNS3P43T5FEsO*Zq3)smZ~LQ1&BTTm6Z!x&C0##MV7Dr z7bA!b!X_a4kd$QTg)K_s?dSK;9OKbdeEdET!s+jjKV45^W|lT?rvfUYR8Oc;%fFv# zPC*Y9Aa1i8{`YJ{rqDq55_gl7RP}R7hzE4fq6$Aj^Xp@eHb1|U-*76DfY3sKh-gE( z;EOmOYzs<=2GYFl5H2jO54LTLMWCE-C@9v*yw(-@zq?C2yE~vvg#psDrB_-5Rzt(T zvzA9!VK|V2r{&2VDHsDNv$ssj(s_4!>nc`!bfJZCXe{d;8VwDpa_^&9^0T!7)H?mO z5&_MXt1e(k<66NR=-2DvdwjmSkKW(xhcHK;)yp!IFd#za2CG~MJia^AwW!2tWg2U% z!Z2$0U6GxhL9zX;FJGj0^xQr~$Z+DTs;GZGez3^;|GVSQ^7PDwAL2qnhzOy`pZ#~> z1@`d|sb|l~McpvMk&mHZkLhE@T=Ge9|Ijl{cxw;(SD3T&xlnm?Y(V$hnQ+QyGkXc@ zYr*0Q3c8bJO9%st{`Z(Wn}7JU{T*k-ltk>x2JcA4VNc2!*M8Ph+R@UW^zUtE(cybL z0{{QJ61z=*HhDceI}7~Pf17IF#_3M{@jZ8LH^iI)3+pAA0vK{YwMNbHzE%u_g!b>H z5>sS<+|j|iuyDQbL-y~Qnm4;ENwKjjxWs!|YIz!rA-OUCd+SPl_cVZb`c3hVWFB8w zQoMRO9NT%3G?}pVolGtA!dt{A_q{!x_VX8qzrD_hKo&mQXS3r@8ja`}&g3VgtthYi z*TrDTn_#9~=$U}wVSi)htQK{b{Qn{mYv4o>uxIUnXDjY=NwioQw4@fg&++g)!iGun z)J0%ofUa{bEz0&7RBA#(?SD2oeztWfORJ3T_U%;X-9AKcoKAtrZbW^zX3pep5M36? zcAD;Qxc=SuhZEdM!#}o}A0_?SYPyPDP{Ozfr|6Q`y`{+z_vt71<>p20XB+goKjSa| zvg!U6M~?Ogf5CnG`)~`w>QQ!V2{|m=-%IQnW*cKR1so)4X)a#gFg&mXKnR)}d8U`x zq-ye`I9nd_>Afkba<}7HPs}t_04`R%WOGwfEWZt4d~K7pmDdS}T>p7Z$w%~Dz$#qo zxT&zal98nNT0Qa-%IihPFGmjvUv<#LsI8aU-cl|W?Q8GuYwPZ-GkPnp0P(;R#3kYt zGn{=MK@D9G9$(L=2Ct3G4Lh?dqCy&eUENhek_pT%4keeUJ%c&A|7QH&W<3O7cJ-gp zo!TpIFz^eFq9!Jy2WifjJBp9aFW{bQr(T^@MAwH|Tcsg4rk#Mr8e@!8ORa4-KNFlD zkCcUj2;cv?ByZEcpQDi10-0%VkMdyKA2QI2b9J?lkT8M-2kHW)0;398DgpVo={Bb{ zXgE^;SDu^fyZBRw`vdys%%6_$eI7-sHPny(i{`MJmOMm~u8tdDzw+rXd`*Ad%kykf z=B&3yz5=wO1?@Hpa|js?xC0tAmGT(f47jo0o=;0pFR&c5oolN-KCt@_b;P>a|1;vr z!-o?wf^q}+e>fohaCOxJc6+aTOn2|*rKWnK5m=%c2OckH;~y=Lt9p^XC?-^Jdc^); ze~y^r+0v(_G5FW}V8Us{zh$rSxu?&bp~`lz+6dXc;)N*jtW6&CEX6LH^x3lW@Dw|4 z-a$PasGk818JJti2N$QPRO{%tZ$@{1FRkYC9YhVUt-JzsV@ib>yQ(j&b{?3TKkzrK}I`E@^JZ$uRoGZ*3rVwp{Ax zFHp0-7>^4ILZt;2y?e*{-$st-8XctyV;y0@q&=RB9UbzjN=k-1>(KGs+t)X_zGgKb zPYV;GMu)|cQzM51oO70L{G-LXEWlyTbKNy6_L*I#cWM4@Ug4979P=AzAwA}P-f}#G z?REW~nEcOim=H8FG4ZB6i}V#$# znCwHC4?DZW_PI@Gt(FIXzglN#pvPFyM-l3ZPEJQahxGI3az0m1a&l>C=zWiBT|pAD z{lLUucW5dUxMB3M3tc8>Ip%sWv)3x65y_KTE%BXW{LTL7oykP@#(Lhr>n7n9u=m$|Xkl`cCX&N26*F@D zuR(~HUhKE;?T`nF)CX7GHhOwt;6WKi-~qpAY;ElZvgr1e2Qm;C;LgR2=P9Mg0<|!-4(CLk z@oP7U`;rwJhO68U4K?yshZX43D6&}1(N~3@1k;!C&Hp7sdmz!#TZTky163nv8d8fQ zml0yWeO(WcB;==EI_@k*d3iBF7!$_3f8ck+r*`A+qi-FJX%aw-(9-H&m!;a_k-^Ej8wiW)@R-d3WUV zkKf0VzZ!-HiZ{r~t}AG2Mjyrh)5G;QIuygcMnnXsuo(#hvxaoUQsEy0?mANm6}ONmtoEeitE=E4@O{=pOTc6^xB)d@VJ;$ zzy`sm20iqYoVE1$7Ex=l9**E(Ni9PFC`#7sXVO;W$~!QxVtaDct4J*op&jz#LEkGG)B`;A}2(m4Bo12?b1O$`^rMFY*m7t*ov;~gN|*;V<>Y1A@Y;aV?Rceq}!23xAR zrNtpTF8O*yRMa2}B_J@Qp{_nXI}1I?DM^M9;dgC)_@+eclb1R34SCJe0=shZPxPN( z8YcfBB)x>#qPMOKVy?2iy}ho-Y;0_2Y;37%z-$o|sMy*f-Ru|*rM`gy1U0n`_RRUW zWUmgk#4C?-oqoT~w6JLV_oay9l~Trm2ck>7KqiWZi5!?DOWV6#A|fJ6-^W=@$>QVV zi-?TE*`yRiI_wNy)^QhZ9Uaw1fT&JXXsGr#QOP9E2M-E!a(-x`s@mG>1_qw0b+ECZ zpUcXwv_>(Qq+D28>3kA5nm0FJzS7z*OH7Dsn(_nhQyFIwQkiEXH>mfYDE3FfhMNp= zsveoIgeA5pRDK2Q7Hev1QqO|l5ZVV1)DVk346F6+3=9jInFX${!c6oeSUnUA3#20LyjZmK!oJ9)oEexIu7)z zwy3$b7=M5N-L<_r@!#jqlL@WY3@mh4wl_Aam00)gt;>zr6~TglZctrKjdue8=24>V z?>s$k`BDlF4eYtArinOh4Pc~ybShvnbZTjdoPuI{b=5sCkA#>wQ@sFKx=;fH2Gb1_ z$;m~P1i&DfZQMQz{J0R=_oYpJ?{xxp4$L>s;|JU1060GJqlk@;z79IFgjU}`479yH z1vtKvlMB_<_;XeFFv~0(M|XtWPPNp<_4^f9q#(&sw@JYnDq@m&a$Lq`u3jk{ zGc+UQ=i}4;8IO~R{w7w>HF)DZBNpH;*#s>z2ZtVL*s!*ma2h>(%smvWtg;IWpGx14 z`B4grC%PRwWoBj`?s`CBVM-gj5;}1_8@}H80F{owpdb(<8V$JnM5uwZ%x)?7Wz`=j zN>{*^ZRrjk#=wq@*N+47>i+GNm9si&p92&=3b7AGl_1v9~%?b#@`?_s=mh zva*7L$KrJ3X-aRYOe7c3GxPydO_P>5_8^U(o>3A~0=5Hb)UBv+5|SCFEQq>uYhx-) zcDmUMl&~D;6YC69DbHcO{Qb`}&t^Zaw0~VN^Z|$9M=%DZ4e>GD#flF++O6cYM++QH z2VIDXUjFx3FaqA9hD2sQeP&?+a@I;X5}x` z#V;sm41{%HW2i-32FfGtl7N)wV1NH)y}q%bA=Mc@wYVtYxRHpB>jsorK=iEL9xIGM z)HKvg?=(4xp73eB-i1-cZ{W!w`vwsoPjBx?QTK;20<1BD9;1#eT4hKkG|(C!%tt!I zjIU+oac0*bxqxkUSeUA$WYc1=DX7^Qw?!v)I^@6Vd}RMoCH=XEni?J%S4U$b&_+>q zc0PbvZa4srhiIU8{NH@Xw+c_qGGb~fx1E*`8EXKx`k(Ff$tnNIPqk+M}wmZuu_hrsg zPk(`xbU(7VHv5KU?m~SEz0W6Gxi4tBbYTiJUBQ~Su10qnf$XdQt9&)bhNY` zCis(n-6R`Ym^{^JgEdvvalK1ZRmD>8@2<|PQ@o~{G_qSwFb1zf zUmYv#{A+KL33R{mj8B0ANqPi$ncCu9d3vj>A0sZ|k?pP5D}jsq6aZO|+UY2j`7 zcI^46KqfCMXQV za{>Z&W2f#qKvl3g`-Iw+hK9^{)|XeCle_$wI~+z?!Qpr{4CEx(p+yLD^7260X5N0x zm70<=C@Lyt2`aw*60dg|fGq}8y>tno*`_G3>`;|6iYsj_@tNyL>-2Pfc=$&+BMAvp zzzeOU*wr3a3Cjij-cxP$Lnsui&HxGpoOknuK%fyA$a?R7=smiuj^pLuAC%ls({m*E zXp`LbXV~OKtkst2laoVD=Kh#V4qDe2j^(+_Esa&CM@8j%{(O?eDQoLy%i*6Xl5M+1B9RbbC)viK(F!Ib*^SCvK1dxIlCL z+BgZ>kR$@RB4j%wneTa(ybo1XC5wP)?`ueimQ(KQ?$LpPi-e@S7V)1x?Z?oS+A-NI zbji>Fb?bi3jbrh9EG+u_8?7|odrN_n{TTwN6%USg@6vP?Tb1Kez7O62wM=)+U`P2iSg`9VXjWP>-Kt`VoqA%+dxO&KGI9_!mfK#K%wVv6To>nF# z75P*>3Xe zlsGs5wZB${%gk`eCLDq0yG`u(5|29*>H`A<+v5CR4HpMk%z;)E6FH^eXL?GnuU~f{ zt^}~T{^R8vKYyN-FxXDj;SuH(6}f+nS-nY4&O{?3A_9AwRX9tvU1#v=)2AIoM;x4- zq9+bNa;0_rsr-R9X>kW6=Q7RA;8O`5IV?O*N=#%V2OtT;QG4Hs`T4zmhFk>IEA*$K z0!ov9K3F=Kp5`K47!^jSt_eDAeewK4G5CaGj{&Fi zm8KoGsG(wdXoljNlw7;~eLyw3iH?FBJH81A%T3D0RisLP##>5a+GDu!`kM8gMes=@p>6&`+0Qc|3hgyjI1BV+pmn0ywtgQ{9V#F4m@pS|L z&~xk4C-KI{*G)LlGXVfrmD#6&zZd>pfhC`im}2}>El(=l4oq!^C#bU34h|}yA@hVQ zUQ+EvIC`W^bOVgFA@Yvqo-moiE3k6b2UJW2^OXYZP zi&_oqS=_Rl)JnOim}B;(snLFVD5woRt}27Z%ofz3bHg2dd205up~By%lx^ zP83`#POO50sIoS3MA7w^pRx-Jl}qVQ=l^`NOOazE$8e+wmR|L57DOOBY*x7hg2+#%QFeNh%Y=# zkT`J)vKSd!kP$iFnvoNAE!i?a6~=AJa@out?urJaq(qI@piqx3yTEuSMI>{YD90%z z90bRHp%yhb+N(U)K3>jK-TKoKbC@$~u)mSDbw7&dIF%O^e;+PHLCEa1uBjEXeYRPn zey#m!Akn_1=CskL(f(_@k28r*DW!tXZqa9#0EUZ1Ysxkae?T(F3r1h8(#;>l)=;Ri z6H(>el{@Mg&L)d2)YQHl`}=b$By1914IeMlHr)f^HT#ouLiZ-8EaBzr*VlQk;QH7~ zX)lFdgF+>{?aiZ?FTuTQX=!a=af2cTD=RD1F&1Y4P7$jGhTqP^7wKj{e=?6buaUBx+}?4PE;7g0qu|WswAuY+s}9yu^j#fNG=n$C_o~R-pr3cE>mb6OPckwkc5!% zThAtJJoiKMq}<0yWMOWO&0L#1^InXAo%-u;hOiZu3x-4$AiP}e2*N=Nl(xWyr|o{+ zdwQ}9IZ*Uqp1Tvo#UUk0Gw4Sn!3?VyddjvN0KuqfXoRuclgDH583+faU#C*pzqtrq zzg&gegn_P`-%#h9s15b-@O2%kVgI0@a`;+F4ht&_3v*teoNd{kpR7%-_OKTaSW$hR zyEtg`XsYgHq|9Sph3Q=U=gS1An=@gekoc;cuxCY)5D}$eiVN|7z*kIkzT$Gi7A5Tb zCs)M68YtU+@#+;5VVY{YbHmpa(A9hMCR<7HFCC10E9gbr*w~1J%(d~!5w`uxo9Tvt zwwTA_u%FOP)4*d4QghkORb8!cU{jPvUKsq^CDf$x}2ZYGi3FYME3_U<9o18of z=kkSHnQ#&yCBKB{aQp!uh2qDKWL*LG<%iAU%vw_5)uXby0===Jf?$`}byGOIofd5<^=I8n+ z>{P6DD~D0u;87NS{+Xh&=bjA^&r`d*G-$O4Mnwtg*R^z~$oV`4?%xX+$j3xO0M7Be zcmMuk>r(ILSc#1)$Z}#@|GMtU^N#)6-x>O#p7ETw=M~qTXGP_S3A9 z6wTTA;&99iQ0kp8z4%y1rVtcEh6~m_$s;y47HlRo-u*qV*r-zOpQ>5L02DPjMt{QX z2Y&D5_m9qr71(SVdFK+6gv~E6uZ^9aq^P9-c6YjV_G}&K5#r(urt46usc_zX0x6i% zf$FPQPYC&~CjH?fte}c?92pnDKYIpY31I-l^~(JHykjmTq@)ZqaO===2|5SG zo>wUa21YCTVxEA}i4octZE|vjd|1U>j_uc4v}a;Uiu+pClQ1?NFi@<_%)dbC+=KeW z9>}?g4!ABXLTLxUwux5W`Ya9J$5|u0mG5?=K&N6H`?(Q3*D+FvIe;4;08hc0$IhLGSR zScQuhFVb(qvvA$+?;Nf$^CYI_bL1^H?SBv2SvqFdayq*8(^f7h60i&S zkL1ZM@2~95^KV8*s(3%v1|C6?$ioApbwX)LNSEkzI>vrE+><1BWqth|+;a6Y{LT@# z?Um zJ#R<2y0vvN+HQ#1B@@71MN8L)C(T!GqfQy&5L-w(P=p{w`Q8Q&?rzilh4RL;3|6j5!>GCrx=)&qBw}mv7nG3%K;-hlO;tN9pJs zuuS+F*`r52N;WQ+^^^h71DX;H*`~l_TU)cIPq)j^iC>4dm4lf3J$z-^E4J1f&C$>z zOw&QXzEMhv>!yhY%i>KpDR@JO|6+yKZquDb;K!4}hiRCt3mUHt$l~PUl5=z^cCfgO zbYhhe`YY11r_kTOe=q)w!Ehsg?siGUM>6lmmPCm2b{Z9cSgwbrmZ-Ef*O zoJ~Vv--Pz@w;7v7LSn!!0|$y2#4N1O^7eF;D;b^JTL)DaLUnB`Kzp zN>xp5_~K2@Jb43yBtJht=xD&mSPLB$r{`~3O>Elf5uG+spP6iCUu`{+T-WzqTsWsa zYcEaA6pN0-e^aKHN;i=io@{a2A#t+V9C~T0#(h7}X~>0mWw$Yw^;zjMKTn9xJA9f# zC^G}waz9O&R~-@gJLpTO+^&+-@j|4!y``$IF5!dJp#eppk}L3N@KT-__p}gfI58?j z+{{cfL$v@nW?*gAWMq=n6Wl2vpepG99oREoAc{cx99eJ>z5pSSKj`G!dCS`y!#?jk z)9LZDb|0>JaLLa6VqV(>L3N^7l+C22TQ3Ws0e3gPr_nMrdTM$F!2S&&mfXjF|0biM z$>Q$(M|yu)TFQ-y$sAA5g3(x`;QR+O_@@@CLqrq`mA^_w+W_?h_yN78o9cD?V!KOc zGXMGW6GjK^mr=*+fBd+~!=ntH3sb!mSxEqf!@ZwdyFfJCN3s%Fmt4r&PvTP-Adum_ z*qkIO(XgKAz{3-jVf=OYJ~tQoLY7!;^c8x#ZemESI}Ai7=unn^&@0ddHloiP6?YSo zU?*F(I^xB=7F3fxN!SSpOHjn|!tm{fXX4rnAmXt84(hT%euAv7>BPp?@@x4$i0$$7Uqh@Qp?zc(5B1kM@u4S573;5@w_ z+o)BO2qxanu~?x9O1Iu)?;U7-b3G~qCKAYRybIkta*0LUcf&Mla4XGpmSLPXhqmFV zuQp_bfFF0lWTOqx{UKm>FAg|e_nR#)KOIERAM;)86qBSLql-0lDmq*^U6|P zkN%651e>)X=f%VX@^Iof_fVbo-Nc#^_2IeZd@|p&fM%?XRhlu|FSfP{|D_ZfAtii` zo7)`QFkg$m=gLOc-cuW|61**R%-Y7zs(XHE8L))qs-rD*uoVh4`xxms+qj6P2uiA1 zTg^(N2)dXXt|k2#jn9B-+2)zga#xqK1z`S1!=0e9nx1|cxTOTAjtbYMa~CN# zJ9hJHYD8mqZL$k^n6eJD;2vtw(z0H0EuH*yzv8YL6eP4if;`G4b};07yQ`_dhR)m6 z;tPS3F**$w^YJBr28f??bN95j%ONsOcb1xZes=aR9g2b$&rnwqhHu7##g^xPb=1vh z96TJgf;k?`v9-~F&6(i}U$4_NLrw#QubZQeCsRY#Gd!Koz$gNIq3ec&m7z$dE)yB+ zZYCnhfe{VI%?2dMf&zwIHr!Jn>8$V8USrSPoC!1g&^XKOsu=s7>Uyt!%%+c5=}ueI zIMIHV@+PV7#<*RDo{kQ-CudLXJNtZhQpbe%RY}$Z6hvJaJPi&!iFF0g;e_v=QY%I~MLcvYS3AX2((gr1^PMwE~j_NFBr3 zahVN3>G=bTKd6;_;SwCHIu2vizIgTWb%QLaF&Mutz4L>b($*-1{ ziLUzi!NE_iDuw&%)m?sm=_GjbmKBd!W*(D43z?n;r`1r#!!tXd9#~C-%@|lWxTA+> zpv$V@>=vIbcIgRft8)BVa~-|1)w)V)irZLKhOM)4VpA;_5r!N#+pOnI7L3Bxz12Tj ziuNn^KD(XToXf51e2+rmr7SF#2Z~sP9=)0A?n*^+tK-ftzh^!D0UCgKRRbx*hTFp7 zZm{4|E*(hRlc!IinK&04o5e__84|kXF&p5aYtK;Q(e*5M;n|$;SDF7v*vOIJFU-uC z0bCzFx9jHlI#=4u>l}rSeu8>|)k;NcOpvTagQ_jP=SHVvalR22*SnlsaZ_C@=8YCe zOeI-XXiOgb>D18ChK;6JCFc3^#MLBXns%X!{N41|t{QlGIp4C`_z}CmW8ONIVzKA4 zdQ(@jLYXn(3g^oD-C0+>>H2&4FJNBi{{V7fme zZ9nRI$A$=L>RS=>{p$27bfPC* zRj|)MHXis%9@vu2-j#8+28X~zac+{!xY$$Roo>RkUMn!vz{U?1ho(rpJMA#NHHqi3 znVEw?3)%Aex_Ys-sy)u9mETEZ{@cM$YwPKlnT3I>wLOhe{Qd(@GE7uh?vK=vYwMOT zH!~F~`X zaWF}~bvVtcHjHj%^@mOI?^K%-k?NL~ul@8HixfAvM&~8&q883u*uU0A(l2b!{#dE%2g@)Y^?%kWB*cBE|>&ihKP{HPJdd)3r zm>i%{6=U4hi_S*JYCW^~j2bEM@~Q)p9@O#T>?{*pkNxqsczxmO+FJS>$w6=tC+v?O z=h4!V78fTPr(IuIzKhJyL->Ff&_YK~DS^AG5jyRAoj!Ro=i4oLrtsG=x1@)aK5qL} zdx1A}?Oxxe8IpWAU>y7A%?}kTW$(HU=`~D2!MULQ0FUyG77SgE_0Ix3P1jVDq|DJj z*5ggZB}0np>dxD(;&kotYCQDx@$Gid{B^7+F-qjxvS?0JniWrL43Tb`p4K9 zdrjd_d7CDv!-`q1cs8+s7|mS0TIegvdb6nu>XSC}AbJ4^5292`2Qv8{>^(%-CpC!B zweP9rnUH;8mV5Cc2MPeT0^}?B{V$=$Apq*Qq9Y7^9y|LcmuaL=o!>>M*41L61D_~Q zZi(t{>LOUCwbc&CJ)4s=V82qSFB3LY@G|u}CIWlJMJux)7|oTq4ZX2~gM!v)bDHG^?D==Ai+T%% z$u4f$w>nWX-u<2MI6ElFJ6=pC0!ORnm4X$-hDc5Of#Z1E?OWkBLkla8cy zZs|2Wb6z(}cXuCLn_l#(13G8OaTf8>fsDOzw1Q2eZ+pjSXUm~GYcc-vwQC6;eF8|G z1~hs<0y8y?dw&7@@#+-1vMR1X*_f=pu{a{wVz8lQFLS3U0;7t(XFVo?^ImNzNJ;Vb zQup`cvBxPqE}5W+YN)Asimhv9?<`^2Q~H|o`?;;F4{>~Q%%x)dWZ1$k@AfGA zSHYM%7^$EV%&?A7w~({ILI*)6|D2~oU1`}owwFnRU>t?b6lnsl4#aI!QZU7KB-7m) z5E*^;&1|q(1KfN0uM!Fj0=wVFM!pBrahMM&jMqUSM`GfjrDcwC`F9v4wg1QWB@D8i z>9mmh0L60yO0wY7bXy^g8#v z8QukC=ns&yz}9r9-L82{w|QECy*aXECJpaY^h3btq+yRq^Y$>H(WODkteF{GNMN#> z$RG=fn>eJW_Z7m#g)zQ`#kQkEtpYLWPID`YJPogEDl0Pkxb|wt<%gV$o9fj#i3~11 zTU?6`7v;Zuot|D?_}!TWbXN2o`FOKIKT0CXRWMn=| zRF$W+Mj`3?Ps%JLcLWvZb0Liyb%S0vyS%Wluw5vz2jV~(ghXlux5n^zMhV>2mG`p+ z`z$+~G_l~j&CPxCX;eG{u_N8l8ouHr$BCvyat7yH+CPpbNomM1RC!ihy3EUY&)z_( zdtP6z2>ZFpU|dgAvz%jk$fcA6KJ^QS!>GSugHF{uzJ{^Y)=B2zd}BMNVDk!%WQnhm zJ0cMqBs2#>W{6&I)A19`pUv)JwJ^=rB-mY9jEmvGL9F*=H})kx+@JVqe_{(5Sws#S|TkR#ui!AH()D>^DLp^auZ9~yMb#p(p_YBRZl$>0o*EPnZGgsE%t%U6`E)JtvN(|#F zywppr=XX>ZA)O=s<=OIG+uuAi`!etD5L4|YC)Fql5AEP;@#t-NOUpH&+^-W*= z{O1@KqrjD#l6Hmk*-3{izEL_ZAFp_Z-u9M^(-E(kpPQO)!IfmwEIm&dejvfv+;HQ3 zGsq?rC0KIBw-me2lYy)Wd83u9hu=B>wW!DeLIf{gHm-}jf{#uHmU*Mv+iGG$Z=BaF zA|fR>_vO!V4ij(hdLWlLIXJ!=b{q@fJD5h&J5+&L_4%F5O-kj280qShlG!D%*^CGqCXrD>0oCm=enQJmLhG>8B@A$GqN zD#cCS-u_|!d|%&qj^&N+8^Ogk`HrnZFzh(wNn_aSh6Kel1_p*2y7q)8d}X&FD!>vf z75yf3e4?~;Ahh1?kVb#L@z->_B#D~$)X*~^&1t>4xjBR!iybT{&4EZA$MVuEMF!Q3 zsG&Pnla1%jbv};ZH0=|Nc>DH$_wV(3KQ40|YDjR}4BTEX6REDM5{W3?SrAUVs)~F_ z1lRnT!NuETz=g|X5~b~6h6V>6+P<(~rZz4r9zsJmcQfiMPo*C{ zQhob2?*`xUavPF^2+zV&9eoDI1gj+{_d-V}0aRINV_#eUP==x7kLljk*%^#O`I-i! zv{tFb9TDLg{~4#rBRgv|$tE`u#?iMkRMJ=Pka_t^^`sViZ_ZwvuQcWXo7B^@WB~N- zvMRbMT}H>V8l5=9AD$IDi5#1bVRE_1Ro8ZP%(u^>Syz=XC>JXRA3^*_OW6Dps7Ly^(D zhQYzX>S|%gAx6TLNH!Vj`4nVDi*x5Rd^OX^I&`F1N&Q9@q)|akwC@caesSSkhcpR#d-{7K35WesyrU3Q`Fr*e?Bq)v$#0ExTxsZp047q*L*1i{8NhFRK=0K zDu5-Y&X_7XT27j;GsaA5ZGZLfDAK&Z$mmq&tu*_UyJ%JS)G4Ecw1>R(sLW3QY$$Du0h2cb@X*RsQI+1blltNp>Xj<)wKp10)&3-H{^`Wn)y7h$ zm#j_}OGj5?v7ga=i@xER-gR;4fB|F7SnpD4dejS@KW$6=*9GHLVMbY8F_Iqu$?kUO zwbKwCaF+#i$-%*4X=hhq{GFYbS3MEQ=t#a0FSZH2zaz}*3v-IBY_dF`Dk(_?Txo@j ze8|oR&Ib-6U4y5pqeBs@xJ!KDpVZqxx*<>U)qD4TL9hnDKT04V#H!GfcGAtwr9o%y zemv=r<92muPY!4FFK#`uX}XiL);vG!Y9H9q9JT(vRE37OE=K5>Ej7nCV^L8h36n1+ zQMvIiGk7+qyZEl%wshKEkAiRscrH(!zFk{2*E;jS#(p}QWbQ)yBXjP=+xFIrZvc9y z$!2G=qbYR%AcjH*!b=1bH!EdcdQZ?$4i&wx*Ss9aNW? z_1gL-L`QR5H7%@IdhR|u6t_!9M+ei1`E(nEH8j8l9?`C(ad}<|YJcG-4zgu6Am*H$ z{P^#dITA(xeh9J9Wq=n$g+X+5TwF@-$82^cqA+3Xc-5kwhK3yLe}z?*LO@IBx$I2r zY*;L-k9>ZvJvyhFRpKQat&(XQRsyWQVdt;K%z1ul61(tY>n= z^Fd!xGGcFfts_;s_;qReumj+A))AuO9TigQCNGQZfq|oQl1>U%~{I z7y?;}1;>f!U|?S@1aS=d^2+=ERdy-ZMe|_Jlbv5aa^>uXnWT|ZJ|$C;wN62w%IV&I znx=cskXD8;V4KakH*YpA7OQEaYx3`~h$Lw4;Jq#=I!MI%#W?6q&2)8iNkJ+gx6_6t z1bkl~DLL@hQsG7&T3uT^M^+}X>+Is9f@Bd^{?aJB1a%HL6wi>nj!wE4Zp)B`O(Fk| zev8kcBm1ipQCdvgP`?573o?Hrn<&hQs!)~fiR>48l zyBL&0!|VEdvQ?XB0^(T1#+WolN=gbnwcgHUgWfEoBZtRd7#n9mhBrwGq`hjC5C>3k z|7vPdAdozY{=h_hgk+LvLSYF+M{8?pQp1tb*>THRB|TZ$>@?%~mCFelB@^al>wfw9 zx~w}()J0wH`8fRh9<(2pf9XjvEW$+{eyWP4sH-?2V? zv2JBXJuukWx9{A2I)C$Scj8Mc-&47gtVRxZ zslM8tkGrXq-uu9`kNwG$6j;U5FK8^%S1?}*3^pq(YbR2k6L%Ph@aGVBhOnRA`CaI} z1fx|IAU*>ec~~p|j$wO(GyuEw|LU*rz77besfus;cbbLVQ@V@Y3Qv7n=k}k$8swGw z^6TVbUmn&f10ewXQOM6=Y2vd%p)44XtV$s$AQ-;M+AQ{dE}rnCHb4w$uWoFV=Z;K{ zkJ~_+E);c#BEu@<)B(3Qx<0Av(cJm7HtkChlB`y(#1qgreo2`>D>(@6@L z?j%wC$Z=j?zsQYkiRv47e=De0Gvrrw3MSd27392c4E*|3+&J2e27zCFSr>Q( z*_Bs7Ne|{3E_#s#sHk-W0;(Wkf=w}j43(BQu}Tmig5K$W7X+FGn>+ayasW7Jem8_p z@j1P}&KQol{!CIwN5>mH?5!^%T2QufB7gMn%98Itur-N@iE&sNbAZr8GMz2kAvEnK=lq_BS5TjYTh8o2QD|;%d><2vSAC*I1Dd`)(321# zL@tuwfy76N#uwSnM-ItA;v*DNokPZEj$5wk83CB~_iNbyu5Z0&Gd}ZyB2t{%m(qN$ ze{(B}TVA-jyIb|YZXHG;0H{q&Gd33mpb`zG$QZXu_4R!IDa#JF%aNaL!y@CqUEOi+ z?VUQhCHXb5 zWdL*fFzo7xh`&z}$#@q~%1YPMl3w??Ji+$Ur9bUKDh}9sSnS~k6&WDrham@R3XyKOCNuKMMA5HhK2F)*pGK- zt5z<5Z*F#g>k2_&WO-Gdn=u@^e^y%qWd3!saJ!TSwj(Gg+rq*d376UANqS;S?ou#q zz3k`t>9J*0d)wa7Tc1vvl|1NJwB{X*r2-GJ%pp~b83c3lpMO_H&VLK+lTt?C?dO8Z zKqeDDI~kfIpN^7S@(l>+i89VtB_x-)y)L%D%?uG}Va`iEfNWEd_JGJED0%+uSsfFT zCOY8xzKRSl`blPR$kVsZMWouEuL=u~K3hJm81#bCRBiEmeCPWk3a72Ca^aw06l^m1 ztj!pMwr#LK%cGv~f8pnJk#h@qGaT)^E{lZwZ>j(Ot#3Z?n5mUa(`DTk;s{FWUzlz7 zce|EHhj;$?77_FrvXUj4Z~6Jer;MO*-M;r3k0bXi$S)8%=d8@4`z%f?Jy~9E&YGA^ z_^8H%xqM5$`tiJ=phpC!VP|eDu{_UFw@YmF^w3m+72L;}xu&y)2rv-?oZsBpnI{$f z0BX@3tumCN0t00f6cXf+^7N24f2w+NMzsAd4$DD93(1>{Loa{+e77z39Vh{4wYIig z>qM|$$oeX)zQB2b4F!mz1Xh`O{L0ct<=h}TOWWZ|%m=m<>e{Os_jvEHF8c)qJz0vw z>M0Q$LA&6}%9|R+Ox)afsB<9L2SFFuqa~1SXf!hPtFcjB_*pe#4M%{~@b&T)$7VI# zt{eGz**g>|8)T-gHglV^s;uY&6$b_nSqbuGZADgTkZUjGDFweNsA$}|&c_q}?x)CB zEq8_LGr`8q;U_-)&g0e2WGTbbipK-a!%~=`(6)s{;HI}v14yA;BollwFf4qIZwpIG z4zAtbr8R3PFOdg9-=+gaHqb8cgWHPc_0KBTBhH4 zD7U)q+Vy>$H>-I_$hoxWI+RYL2#pF)cJkH!ntFDFN(oR@p+7r2k@Wn@mPC*S!80LI zQ6Tp3TB6mQ9Ey-I8w$LLgQY=2@7c3wpOS#f9{uUlGeQrBE-i>^hA<6#c*a7hqsM<% zhBpDcs+OiEeg_W3{3?vhk+KCR|^a`)1K|K#l4WX zqRJ;f6gmYN_s%O%SO6O&zgEf`f^h@4(YvGv!Dz|@@$yFkrqj)3rKNsnv-?P{QoAc|{)dm5u!|;?&{a zx@2Hm=3Dtc@+8(N>-&vSgF*)2(K6;)70sn%NzH6zLDwzgb)dd`jK1dl?ggnHpC zsP14reAt;#rYNJaq|APy)QMs@Pt_E-`lp{kmSsd6!%X+5lPJdT{{TKo#E+RxR?&Vo zLtivtAq}ZWCp;ujNEHt}337a3Us9LN@ie9#+H_}KY`cEa=XSoAr>2>8DRwZ`@eh*hu~*6FT0PkMpP6grb?h>k<}*LoBytuzOBvnB-$-X>7omBa{>Mf z*e(ndKN3<5vm4&q@MT9sA9TfkMg|47OAjHWQDR3U3xC#i;bKJIJSUpxRW%BYaS9O9k-_+ z5>$4w<_+9uhF=Dp5J7fC>dFZ>@tFQxFB%w5mR7QXflt(z=io4PRUmdNEIj74$fvKX zoAO_41X74Zb!SA)^;04zYQ({nZ*s>uC|6pH%=>=DLUlLhsSi;Xabk|z6H1bFdph>n zcNZc!7gzo5em#RbpqQa@hl-nfa?T`E?NnT;kFT%mwxI|RENM!T2isTnZ~OlIS$hX% zLv&}!$>Zg2z`>26Mg6AuT((OB`1>^B)DE6kYM>tQxKU>a=)e~z*Y{SJb_Hq;9NG2) z2QFHSdpD`@mh`+#>Jx7Pi&tIpM;$PJk~dXJq8HneD5q=EnNvThvlTQL7mY0{evclVXUxmbX=pAsdZDYGzX*B42^h`|oO=2H8 z#!JZPHPb-elED`?68pPAH$2SC@b~)WMT4S$8GL@Pyn~CHjjlesmKe5&kzR9NhS`fZ zf2^)}(wE3evKhvuZ8u{Xg`sr}>cTewnJT$q5bcAeuyO=%2mAnm&i?@}&GcP2%vb%p zkeRNJAmA__6I8vd?6PWxn#a3Tdm_qA0lNhsfRG1|U@Y{Qsi>fYq)C|G*O@Sh?;>(| zBFrJjwy5@CcOu{2NG$b%$5HI>D9!sc8#YfYK706!*Y(~7*RqrNXfhKE%VaH0_}d+Hr|1ey|Ij+H&|>o=I6qL;HAuikZMiEWSykmXUh z?sFfrQR$O?|Kc*8C^~~Nk1BuQM~%q5jN3Mpq5)-F1_5=bU;y-Y>#??WEyN}mBK-2)b5Kg(A-7XVZt2{dGeU2Sfn$qCtBZnPTZzKq44j=gjgpep@93AuB1s$nRBmAj zaF4{qwh*3xrWF$KW2r<`VzKW>xnlZu9e;SR8glOsV630H7qsqhQ89_$o%yo@_A1F0 ze~oE75VHFF^QX86f3hpg%Lv}(ur;ZGRKoa(BXK6^T?|v?1=nA^(4+3e zdrr8N-_EtZ!PX$)I?^AR7ozpVqAiqsb@S$x^t_$9!6+MNBcgejlInh}94Pm+=)-Og zA3!df2a)V(Ey-=J3Ex@xao`PuWrPNjfJ%`U8j=7!o4h=P-kH^HEC|{94MMs<6;H#= zDJue6kO@d21)ifz__;v`dxiBf+_E`Ga8uyX!#ebnP1g>+x%n{ce_QwVr9pjUp4ru z&c}K?j#cztn`g}E<|j<+Xh+Sp*sZ@?fVpishDytax+4=TEy`KyQ7g@Rdm|^4p6o|n zQE9tuSN7A=y4gx*GegE=2k~t}lqC4X7Q>#mZ*6F{8Un?73JjyJmJlsLBf!KQa#S9_ zFJ+eRdouxx7hmU)3W(vKZZx}ZzuaI5PAMH;W%WR3RCU`ED6Isd0IAr5Z;J_b=9w!cjw^d* z_>V?KQ~Ss7JykGf=P8+8ubPcXzu8RosM_{o^j1@5i+jwOQ|)z9N1QvSJ1A=cTqoA1 ziE@Ncc?|lkn$VXZjWOn9YS#)LNjbt)AFP%wywND1tI&+|5_SaKn_tW!VPPfeHn(q6 z51=0nmk){sv@98f)Xrh8taoup%sk%= zDMXYrW1dCY>593OiJu@lm+<7NYfk^Sa86oNouoq7)7H&jrl?ob6D_vyYs`>ail8obe&`UrZ7{Nclgsi|C7mhN0Q z{pdt+JxDt2Uw~SU4wNDsSI*oGcB*C9EZvw++JQzUUz17}8dBu7@Oz6acP}-M2HZjJ z0rJG%y?CEv&)jvV&dhG9u@JQ&6IJlEwXI@-Yi?LVUrCdvyi?PnY@~1Kjj@x6%qveE zzlDbAPrEB!3^~D=J2UEc6OT^%-emM;Wqf+7rTacLzLYG%`^lBeuTlZx7b(+EuG=0P zsbywKgE7k0Z%jXCWw6o3ciO1FgE7W5>%UnoOyS=SU;X%2= zK7XSyr>t~DTx{H*DwNwyXR%_d=j~MdmlsZX{tH8FnMs+FJJ0>uo{^tT?=s~4%#Dvb zbCU8=p;4N;lxL%%-F<2ssgg#+tn6^ba~j#9I?ADu4ZiHIC0`e{rhdFU>nI`T)avCo zJ=E^H>ZV1-=lBbHcVO%mDFb+aD6ye1d9QvOMYBQ25t;_%{uoeSSaQe9DCU3r_G{YO zD1UhCc>nWT-v}iBCN$39b$a+PsJ~WT?kxPnr#g1%;zbu7#=qa`7A5NUc(~L-+Qr2M z%3S8oqcWc9NNm=9TwoH?%2OVrR3D0QHB`%E+nsS-uX+2Sj!q%`ILfX2^&tTq z38G*1a_>W`kyaL!e@#u)9;|1?c+FAc#fvv{rvi%Xmm@o-p{aY?e=_!}qb_Kg23 z5^?=+>IY(?NqN4riN0Q|Qao;pAMf3kw>^xC1t_WN&w%r0{8~@g&%4Nef_q?KS=svh z*0YRm=vW6`4jpV@jZ1V<88iOe69OB(I>Q%}omQJS=WJ^mLR~-nXI;%^I+C0e6voP3 zv~G{GSvR5T$^9;(FR2@y_O)fYa4R-5%Jo$j7k_5k3~Zg@qbk)@80bF0l$Niv zI>9HO^xogcCu9)J^)Dm%2|SQJH{O1GcJoXo)#+oj!ctOFPoMfEaKds1-gT)$QcW(< zDQ}!&*FQ#^VvAOnLYQ8b22Q*O{wZ3(b!)vxE9Ae$EfAeLb%~$XbaNq|y^K@MmI&HR zpE*NGr*3=Hjb|lIt4v-?3tuu^c8%wMZmlY%_R*w&rjzvR2>T-WM)x@CN_@{OBti7p zSGF2(o}#t1vbt^qLO8NvHgMzYqv~qwSBv(x1tKS4%_Gxn-0O4L^)@j^zNN|&1Vw|0 z-796$_m^MoZTm+JyMvy=iAqR#y6n8~>3*OKstFpAj2m~G?0hE?6&1sT6LujIcA?_S zjfRY4yAlk+35c6GpegBp=Rt8<|L{=sz1vpnGXi!q=SJa;z!I#y?nd4N&#s`TC{2b^ zuHE8ojHR|seOYx`h_e5!umU}H0THTe7% z=Y1SvUud*B#+4PZgZ%uu4W;9a+)jCQl8xc!r-(X8sJgWP{vAB_qIwg8wADjpwK~Yl zV}X_d8GMSRKsi5B4Bd+l;BRia+*_2(T!Jua>)MqhXc5_Sv~PdDFnl#=zBNt&X7r?Qd4HsG- z0Q9)?Q5i-JA(T*>M-Lk({Ve-W@QhJyhjeQoBEY|xZ-W?o2n>9cc1VC$81h9E5T+Qp z182!QhRSkPR2XRArq(z-XrOl8?qG-Rc1$JzFfT9D9ji((PxH2(gq;+kqx-SFF^^sv zVS@FHrKRSuYn3}p{eoJ0#zr$lt%iac(DDYN-hfjtx9Gc#`}eDFZ$(IaD28{wqJot} z6mKDVeyD8q-5J*>;%%o>>Z`vxy>daS!RZCq}wFM{fH zdBW)s-r;$jG415ZY^P21ZKKYsh*(v6HpTEcY|PceYaZ)ic=&f;byU7CQyB(17~$f= zeILHz({5iW9p7dR0Z?vkWr8`}9oE7ZzW{O_{;PwhlBLG4z8AAd6yA6pITjeTu!S3q zPE4eb=DVwbe2*YY4WN3-;3McqC)~eR9)s#k)UblAtivuYJT$axf!cL{t4GWJHzwx2 zQH*$aPHryi9X-GBDA-oQqY0?ExLFCp-#vin;rEN2?@u;!Q#NFxu1cC_SYdPgK`aan z%XBdC_w!x=Kpaj^Rh5w$v3@|M&V9-M;9^ROz5f((XEGl`ber!d$Hr2ON|WLvlhiN? zBED!Ii$9NxV226M$aR-(>i{30fs#$414W=-7Fl98_@0O|2evfu&WK z)W$#p|1GnD=h1APWuvn_6+2V$!MxO6rx~Tux*X%;r~kd}{H+6T^UqIX!d^lbxf4#a z8L@o05qo(3HQZdT%hp!+eJi~Kw6G3hU9lB&2K~ruU_ku|!Ieq;?!HsLHBr%+`D&QT zyvcPoL*)NUL&>|-(@8zE8}mDl4rKXdjZU5^6>Z63LGiS-G_}H4l9oB(G(-~YyHWrs z(I~*~BErI)SC+&dKRy8h?T#ShSf(2{0EPx$cs0@F0c~EG|$3mcM8RtR9=qW z-&L%yZ%CGPCrBRd2*60sb0UVN-=$Azb6&bgum=y#E6Ub#TQ^GVx?dE1PPK?(GkQ0s zvtF@3d*Az?g#UWMap(B4)EW-mHjfrsa8lR|H+e+G4KB=GfrAMx^!233|#&L#ToX{eIX+~ zU9Xv)^xpZK&k|EDHV3&CkQcil?hyL1>^aXWS(sLfcvm-BS@W?b1U>faZJ+AoSbe;l z+}S~%{aS(j-Ta;jhX*rKK&{n4=L3e>`M+EDYXv^&(}VT=W+j4Bzy$*2w_Q*N&HK>y zgj?7*SNyVZ&rN8wLVxe0mN0z5(&_TdH#BmJiYMCaRbmNF-PjnxLyMomJ# z3oB0owrS!Gy;zGu{w3tP5T0L_pn{Uq(x5f=#{+f!qpJU{$F#08%7B*We7a9SK+G-e zLgZhe@ZUif1%A2l=mf!g{QjKu(MJgef?zLwTe0k49@SD(?oTY;>yX|w%#Va<=u-!t zzwdcWM&9w+X|u&?0|X0&y428OhU0NU?Y0Kd>$7P#p;zh+ov(5rf(Hsgpfg22iQ)L} zIgyjZ#4X?@bs}C819Sk^2A^mldXV5FW+^JxUtEg1zq*eZ+E(c=Ad?$HXi4PB@w;?) z39_GUON0nAK?^xVA8(H)vX|du1bb)K99zNspm;CgNjyQ#<0ug6gJ=virWge+^R~@E zhhQ0!=7wFJ*Jn%@qVGl#JrWXnVC%PH-AQfO!)7^FcSuh2%)#qWXZ^46)qxe_wSRi> zzRe-00L?6@6HSMm(*&YrYju)cV7a<8kTe6iy{L*Gu$RH9sglIFi>HqrL)vdU`+#|+ z9t88MQF4hhYpy08vFXj<*|dBL1FR*2g>gU+4Y@-?T80I9l6UvDR+V zjSSDRzf83|5_?XhzOm8jK{NuO-$5Y`RMryY!@%IjTkV{Jr6SXwOnP120zW@~L@f{= z!S`+P#}$>7Xn0_zGh8G=$_Ui1CkP%<)Y5;ON zLCKOS8GDn`J$TUIp9^hfT*gE7KYTdHZtW5a-|GbHW!;tg`(;aap*!Ml*Bn{5%@6->5kbr1vLT>46cn2q8a~JZsB(J;Z6Bdj zvlp^4v9xwGb69a`@DF@<=zqT2imo2F9NvtmiAL68apOc`kf0UVZ7 z>@wlvE(c~6dN*b$rTN`}ciK0xyKYsmC^`52V5jCv$9HEC1qTnR+(!f%dC+=GBjrF~ z7MKeVejFFr7;XiTiH(6Gab(Zj>O(55CVwBN`9ym0A{zqwD`OG#otT>1tjEI6ZjPY- z|Kt9tK}$DW1zv5T=3#ha{>xhJlEL2|$^BmM&4yRl|H&W?P>#ejG3CZRLEGDe^RHBf zyb1t1e}OW|vv1Esr6?abZIBS;2X`MdAm*G1*`sGS!;bZwId1?@jSahaMx)(JuX2_%J5qwE`jHsy0%!}ZKUVhSxS?ZIVx^W(=K=!-n?U8^@R zwZ?pC7qhg)rRi0iD6nTZ9m-N<+_P^kUVhL#3)Cj|o3=1$2a=lVO;kecrMstx;KG!@ndYw~8Jkptf&c*! zwW+BM0z0-#1FA$#HG>P9g1^Y-EZ4nt0o-bW+&GKH@^2;^eVX&(u^bh(u*~@oabJd@ z{*c$;!YoFQQBs7)@NR`3==#*uIR^Q1_@D)~JcA6uOt|MyDa($=c76_M;NXa@J`)8&h@$PXy>WQuZ2QBZ_JPO1~_WY`r~=NX`4 zP3yT~Gmz(C4*|t_lWP(Dm+~*k$!ic$ITFkS?1h`&vmBl1M#aqms{_xC^ck{&P>9<; zZSBvEJ4t)`*byoO#;B%9^JAe|O6&d0cUd=TPLjWaxl#E)H4&(dJQ*#Zy@5XFvAY7g z0q(DeO}-1XqlHE;h^~+d4O2>2!@L|Qq)kV{;0D^Tb*&fuYe1>{iN@FKSQe>sAcA)F zEorXao-^ETv&*IEvRgn=Nm0&tAUYX&+;|>6%A*%eFds%ImzQhWf~U81GW8M-WzTYN zwiSrrKnjpj_b%TBAWZ;?f|ZE%kdi%@iygoLcu!ADYiw)`CPQ>8?c2Hr4&YsiEua(2 zHAWWA8%A#i7cTH@)SLDb7c?PJQ{;(Tzr=0!*rDh@v#hl|tJUhVHO>gus*oObKTX*j zCIh^hY)K{faBlI477R~Ktqq_tM=%;e(JO|!l7M6fR_di$KhVg|26^0BjTM;o`0^E| zI)2T|`yx(RZh-Iw@VNC~;7HJV_7M$WVR|}+0MexE>Za&<4pl}M7nLt!^=Sw;jMS?a zkaZHltgx^czuJpBBtXDsui5D6c5%yhkth_;7#H*^gVx~1wvzv!%PeQRCJZ3S4L-J5 zos9q|P?4X%e6j3GWd($&L+}{SA?L*8L-$w2MMOM2J){1*2d{z$7j8wYsLk0xrLrbw zA^N-%gw6<0o)MVhjO1iq%Q3%$s{|R6>=n45_+X7gBV17SsID>pk!O?O;iC@u0E#J! zI)VnGXgLFV7jhx+tnNjA*t3l5AP28#jb}P3r9a`?i4d_z9=8(c(mGsMx0InqLZDa6 z>6n>UetqtcVkANz8dj8*Eqd{j5hNwI9LONS^I!-kA$u)yV1)7QtxNs{lT?>uF}iS) zJO=4RzVOg@{2l3!=U$sqJ$9e&E$fP#5&b)hZmIY-Xzytaq%Y!n5M&O>6>u=IO(dF! zhJm4tRZ`}OaoM0n02J!AFMQ7Z3?(WW8rQT#6)>qT+*kS-T#CTBgoN~$waIaDaT8Zy zIGmL9A_Y}{8;{2D@@7TW?t0d+>1)cr+RttH<1OuvRkDA>wkS903-`Wl4wW?mjzg56 zlA^9w_MZ;zs%^W)n41JW@d^+I9z+4WduL!UVIoe11Oq`)yq3!9Niq6Fb$qeH6}P*U zkyZFR5^3YtcK^L|svje!u3pQk#!rYJJHOG)^7T4_oLLw|5aoe*Yxxv` zSQpgcOJD?DeZFws9|=eJb#RkmpM4xwuc(yb&R{8qlhT`@l}un$(`&-tM-DA6)M4Z` z86+35L5vsS#LM5Xp9bbjQ5U~dCFy>A^MIvL2bse&`Fx0tT_o^T5FYdbl}8ZkSG9fl z{Z^Klm`dM2qw&M`qe&XY7gR?O8U}erq+v#nrm`|jVtI(1MJ3}W0au5$DaQ9ScsbB_ z?;xS@MXn;>&Yb(fS0I5%_=*#>nOf#JwGlEhGH4yIPvBe5ArR?45wTb^ez(;r))oDO zNaWxxC{*iI`_Eq)YV8o6A^4iHzY={P#-HT3okLv1VQmZ#h&ZpouQI6B3no~mDNwBV z5`fIv&n^u=m5_kah)_fek^X|IqtKIXyekdEwHfzQ?&@2akY|h5E>IS@yHG+C7N%ss z^Y6VQ;qZBo5#+J!Oo;4U)r#WU2CwV)Z*BM-XJl{0#aW=sX%KShP`5@rVSdsK!OH(t z<1t;TbZ@=<=YI{jLs$HF8>;s@px|3L0;I|=%h+=*2}TMJ4O0_4roqD+RfFb_&@Blf<{Sv& zd-(J|*&=9n)Dz){3d*J#xxl_WdGgeXB-Lnu%6zxe-@VxeBJeHIXP}6Gb;I}XK3B5a z%v}f#>o%V4K5`&MoZ5Ta)LxsjC2sa_hR-fr2QZAfls!v`R`Vr6OI@BGLlV z9f}G_iIjja2oi#H$1osD3P^WI_t4Go?|0Dq{qJ)hpX>F?ymMloz1Lo6t?TR4%E5&A zbPm8J*Of^%sONq(H0gunxT}fDLv?j_LR>s^YU7IBjdx)ANv#9$DRirS=osJ~b4ft2 z`i|}N45dT!51$AQgTBs#?0=75B6lwHzBAA~(XV&gUy9!zFV;Ha(t@-Oh#bGtk>0PO zu71m6fQ1k@Vn!)X^w@nsO<&1y9~cU z{T&?-uQy%=7r0r>>cg4{`9At4WMkmMqO95rzkivY-%$kg6|mJ_Sy3WyTm}HotK^5wOZC~iNEUj-|#RrFa7c6x7gUpfA#66 zL}25_82dz9XZ<|U!GU7i-n5Pn6KFIeq25C3!~=Jgm9M-;0uoX%7WKhOAsVoT%-F`p znTMooYnm7VD(*EGKq3rkDrqSxYtsNo5T46tpnK!zeY`i;6)7-q=?(Ydlk+ih*B7BMr8s9UP zQeQJU(vDP}$Rl$3w+Yw!ps)+1&F$@W`^VsqtyTVS9UqFU_rZUS^9!OPlWkvv&wMB3 z`#`jK_YOqYo*|X{;baE%r!_#ApQ&=1)x38z?bs=@$C>XhSNMQ(x<@erDT#@8z4?Tg z9#2q=n;5>9P~UZzp%gw_{70CaW|0Db`?%taQqfpZ} zeBk=++b$amx&Acvn1%0^6%{VzTtq|%SnsHXMiUXfXPo%Vd=Y~&fB}Tc@b}>|vv(q& zq46=SBDDij`_IIX6@rS-YUOD91!1?V&l8{<&x#V7ow~Z`utK4qy!5{n{~MM{ac=JL z@6U?+5f{3V!SGRGQ8U1S!S82FMsV^TCr?Q^d4&*YCE|llBSjS}$li?=O}Jevi8BU4 zreO_>-A8u+7RW}_XVGnF?V9%$Y9Qt4dyBddM*xC9XdO6wCaKld+I0}}cLEd>Ym7{m zOVd%LaigMQkkd_A=0gFW`0c0g+h`yU5&FG^#UPS%3%&1Uu>vVtGnSHwY>x1liDMzKb{`DS3t0%y|eGceElr$gi0(Y{caitS66Ey*&Ik^KJcqMugC*}or$aHqj0BncVL{DccGzKVk1X_8ty3UT z9f*S&>B{6JY~{l15LZQ%l+CQl*%=uh91n_$V!jG2(91(`bLG!uGe?6U&~(m&eEki} z0iUz?ys>!OpLL;VN8CR;;+Y!QSOb_65Z5N0IPafV`E7HXZKY~w0E~I~H9-9U5lsBj zCG1^UJ=nWq%F0N&;dJlbJ>Wse$OI5hB#+>5`>TA#uGX@G_>DHbY8A(%`^T@;)tiO0 zPpr)K_B&_ne@7w@A|A)3)A)_r%x&?=O+>Lj& z&rFuWDxN$cKm_#;yQ^rw^FeGSai1Z{gun#jBl$o4A#EE+m)<$^co@pIbS;kM>j!=x z6xw`d;a0YatQ>_1jfAv3_h73TJ!bVB%2?-^Os zlFkh8A4mA-t%-t1j);SnF`>rs=tZVtbld~|_xS06JAG*?gg|-#q}VyIyK{peULR%4 zB#g~WPiMPwr9(>Du4H5^d=ENo;_QMDrU=gq#c;N_Wv(R|>Ujx&i_Z5|PbOEE>Se*E z0`RAy0!_9~KuHOw#cy>a?K(?E1-E(3^PuqswhC9{p=h}50rxdP*55puEmtk+dH!@^ zVZZ>*0>AUx@Bl`KH(KU@pSa+EjP9ZZH`PT!Cl$hWH6H(U%&$rYx{BC5C|X{Y z6FOr=^8hU$zpS2?4}^3r%m zdIbTxbj9WGcP!@tufD!?tsm3v8id_Sgs&a5V%08XyMEnrW8v>+x(cBo6T0A|9y&HQ zHh^jquz^wlQ!L%_%gou#)F3}n3)hFOtk+Nei=ut8?IwxRH0zra3`@&tgi@B1TciEc zoebBdTA}VM9&|mKx~g~YHWRaFBB^9-J1mKp;>ya0JaEo3ChVr7qK+0Ahi&ZS6i?@V8+oIqNB2o?)GY~iN0A66L| zeJbB({l5>A4*?^BlKz2>u)j!~hs9PU9p&C?26O4k!je@~c+9_Uv5^7*+koQGxtHc7 zCaNH%;CqALvCdGCK-*#G^vpI4r}|Y0Igb(474)~b%7AVR#~tx`VSL2uj6L^yNcX3~ zuZn*5?|#6|+P9?cxy8jkO&))zfykj2aP!d6Zo64t!gjpB46BSqV=Zy^WO+tg2Ol&x zDhU9diWek1l*-C)fM}b5?9#`os`k5lbjKko4uL^?D0G1H@*400;}H215>}UFLcmyJ zCV;lLz&L)rWf=lB;qgCxp+#1C1TI<<+9>zW(e`WGfg~2xZr~SJxBpp^!0I)Uhb;Tv zaU`(8KoKaW^w+M{+y^vg!JW`;pik@;{<7J$=hA`94jENvv;VcfpHi;nv`}#Z)<`x$ ze4wzJ1PPl^QesMShx{KKC1Cb>=JENfWSlULZ=QaY=j5+K_pQB_#b7~4IWfA*jV#18@ZIk;nxPAI)Nfs}BZ z_gx$S?^T^wQ7G_g`->5Kh%|pyd}JL6_s3ZIdx3p+6G#4UGDd&T*pdoz>Q1$s2JrRE zHE}x>KqepOh8#F;Pj~@7Q|Zu?-exFGn$d)@`P3%UzrHSUa&B ze|F0Wb-|qtm3|KX$y;&M1g_nvKCg1-)Ze}EQ-{`dpmE&@gy4Gv%Yrm8=#;o`>fx$VI zY|W?1=A0H^8aHX8{~#dkT2eM=QinYK>*TN5<2pTI?#8_h4EA!z>~4}MILVyAz3&@# zZzY;<^EiO1hSr3P^M9{1;l>#jGIW{e}KajB)V?r6M!M)%X*MQCF%@t1=_6`_mhfl z?)T^D*^5LmN>7E{MyBUqF_%0SAKbiV?kc9)8_?fV)z`|FFZryRP1mfwSLornvxzVa zFK%&LZt%F$~c^t$as@0i6a zT>Vc+ z!-whU;vnl9HAVR_`$QJpFVzyAz`5HJbGuJm3bq9JJk$pUPJ7jLv-!sOmZ6Xu6H$KyP2^i=yE9c)mCzi|)rRA6=*BxM>+%fHJVKV41Oh;?5xQ&xH{J26+2_hc zGdiUsL;lC4JJ>(lExfa{d~T)_=K!ZA9EgSSr9-LAlK3$9#T<+DAM_-$(;OT?3o%!h?ECZ$vVxOrxWY}Hyeof9z%IwtAkSy^8vh(W z=M`O(bszYronli}w$!35vna86V;C>2DOh~@&Tj4KN_AfG{ceAeA%*r0655_fU~JtK9j}DFYvF3<|lO?sr~yMJPaJiBaRUhOM#OikRr>YQ`oR>cJ=PF8k}q6 zHaZUcdKqNc^UI?hF_muPrme1fDbmkeOvc>{IVH z77=lVX1d!(Wi!+_D#i_wW^m97?@s9vGW8d#5PU8xkSEjvLG1Y7)Y*e)bW{@!L=_-o zanFQwYhHdm*~VB!BdD4_+A~KIDEyCR_gk~lE2-aFwq^L|jEQM9tc*Sx*Z%f+;x!CU zm5aIm8I%B1*50oB#m&jB9|NSuxn|F*`^mH(dtIu;o3#b<*iY@fmY`8FWfv?Nqmoql zl}n)&6n*q?GB7b#XF5ggj{M$&)(8%ZMW_^jz!7TJ{Z}q-KZ*q?08B$zwUG>B?_0-N zgr?_Z5dBbA7HM|CIkM!?6t1I9b`PmmMr4ov9pb`2Z>S8$CN!XQgT`O^`d5}lzJ-bq z-|c}E>pM2Ow2B;i)<3>+Ek;Y$&Ra<)3r)vVu={N-(kE<-T@lOL?3%#s4Yj;1n9=0Q zZiRb6SD97apzMs|u?Qoaqrn0fw zHi%YeFO1;8txGf=BJ~6AYhVgB&fn`_(1xd{>`31Hpa^lh<1^UNNRs+dNg0-Ldi(pU~^w*(Dwx z%WJ(-gARJox{c-fnw}3{HC4bN1DGiYL3=$)+KaK6gM|>NuZRUpAuX;mDE=sm7T9eL zkDZ({(ln^3PYH3#b*5>20N&01Q(k~TG=Ra_&DlZzN}ckRNoXa|i*0^SFFI9%j*Q2s z?$toNd&21x!Tn>mXhT4c~t|`f7cBt4O@79U!xyFC;I16lN;E6!nHXhZKmB2v(53XY7-wwbC{Rz@(f zGUZ77@#S?KJH}1H`?6k>@l`stUik;Xv}2AHk-yC^SbH@-P7L(6Z&!)Nk0#`3;Nu%> z_bwh_eKu4+0J$Nc+Wd!&Xj4+>Aa5uvIt;{l_$0#1#NjR=#7%H2AsoF9nkr$NGZ{IN zwm-(Kpgt&rO72R$$W05{~&+%#^uX^G4^HtVTY?Q z$Q$Ap17)A*r#LPf5c(4yhEU6ieCeFw2Tm2V;w9oi7l_d5C?CPEB&~zWZlwWjZ9Oyj zy=0TpYCVuOdY%`yPE%FKKtQimI$Lu+9 z!MtL2N>abyN_^QHnv1E_COO&B^Dh13WA3j%tnS&75A6ZdS}Bxn=%D?V;+`^>&GA2# zt;M!dkki43G$HB0!~Ig}U#0F*O+ijBE?HpF5wtef3oK}LV9EwoyKIh8#AhjriG8d_ z|Ep&TrIyDVvb$5lSk&O_A2({G?)~g85aMp>dj?fj|52Be)#6;lW&RZL>#GrW9JZdi zij}4&E=|@+nrrs6mK;BR9OicRa4ZF=FG)j5_YdhQ*MlhNu^$EZXY~PaE%3X}+%xwb z9HLfMvtZjZ5}p#iG1xS{ti{j~=ZQuE5Ut2$*a*4o;iXDKg>w5x<)!dHuq9hvZa zl_%(h>2v?CQK23^d*cM$7CMbCiZin*;8Sf_v~7xP$_Upwyiw$NOji2i!gD*jR=PgY zA$quPQc21KRG|HSrZ9r7K2&a>>CEWt?Bpra=cJaBk}~6t@1YYyUWOb+3AH{m#WT32rZIB6&+3rXe&`Ls79+AtyTG{uE!HDr4Z}O(ip7GE z11X4_{avofCS_$Y@sgxq;x+VDkqUGz+E}}%EVsi+v2LtNhUUG-li!`T)=U@_&=Ez- zUKPuNGwT#VzRtpYIo4tK83W0W$yu&W-{CTP0y?Ik(;(-XkfgKs$BPwifUGSq?`v>8 z@;NBnChvsN7DHXVY7wJwatEY4+G`-WmE-^UMW%JLpGwLy}W->|V0Zdp&iFP&}k6z)SuoYgg->T>+?lp%23gdv5EliDom zrS(B|*)u_zdV|qD_>>+W4|UVAxN<)q_x~F>>obZd-21i!TLCzrw=866_Yvk?H6RW@ctGks_mI%9!Aa z*!J|SR+8>T@wKnW8vd%SHEWLhTpRcg_x;#W6STYP6u7zUUQ<`6!cQ#MOF?;2Ywy0* zuR(PVUlLJlruCXCzZ}=t;Pin#m2+U=hQs~T-cg?86`2e9@PU%bUU`mO#5VU?ZBJ?G z4%E#ADI}sqNf;TjK0<@O zA0U)&cQKYSl5;AwNm%DIOkK}|N2O~cfxWn*Brk2;XM*s?$4f`tl1o;ccFj)iq-z!_ zjQPN{n55;KMM1m3+sX_^*VkYATdvsO+47){HSOdUbk5hwf9~qwfC!$c&(xuHBtL0h zMKx@fP8&>qv->nH+v-&AEOV)WnAmD>XYun)=l8b8Lv3IR#d*hN<4X^thl%0ha2_~( z1qxVUd+x#ymt(xKAlg4RGGd*25E>q!bc;wcjeUkcdQnN|zGI8S1Xfk+aLr{MBiV7C z{C%P|=EUE3N)}+p3bglWu2<2ZVNE7S55KaH85EQhgJry8CLlJ)%jMbet8~{D-OaZ- zrk`|CTTqB$ITBge30frvFJHc0S($-NkrD(p1hzAFB(zT9NlB>$VV?chO6Z&cb9w;( zEMjh-KZQC=S#>TSKKzkh9{qhkkughK zTeo4K#UxoB^%A=h7_**n_0b?bVPQ6fNj0p6TsQ*=!vufS;Ip}yUH-l2ItSNu6W6(A z>#t%5AC1qKl(=t>MS+kG;Tj#Y>P}4qkWHV~vzxUIp;W81Cd%tIhW(^FKRe%-m zJZf;APK_rm^Kxf*j`9p1_wM78ctmk|T_a}X{SgDcnYKa>L%T)=WCwP<^YiO1b!@5$ zIs`VY1YsYKx_ii4r=vr|S_c=t-ku(XA=sQx&Vm~nBcpM8x(sZ=-=dYOX_2Nq*VNOX zZ6^=va-4Hnf5*(@A!yM9ofUv!0DGxS3=fzDw)W~YH9X9>y`4`dAREu6$S>pnOou%a z)_+{HM2xyK*Q^J~+x1+%ecQY}CCwy>D8=^;vFenKK`{O4eFYpQGGw)vVld*@n3z)9 z)P#kF_e0gaBo60^=p;USa~M^!pa;Qk3GYjI87`S8vAW-1R{$-mugn#V%--esmVl4M z8l39OYwK<)90l_HGN;F$o5J{NoG5egWQYqcQ!`WK$r5N)W;v; zaHC|O3-B-ZP1c2&JU2Io|Kla~A(-*=0j6s_%$uX^?C->e>-v;eI^r)E}^6&Vjj4cq4_vg!D!{25XKR`b;^kluqv=#c*adu}!^kKl}du$zM zyY9-!tijs?3Op89PHG#eodH*=m~88w+$1L_hl~44jtF6)$Dk<&3y?4eGjqwTM#umX z+v)wlJTKF3F5}OiW_p2t7bfLGBY7;q0-*+OOr~j-Xw9*RNK?3)EA}PO#x>_p@1;vr zMpZwmtVoj=NnJ!)ErnApWl!Bc`LX=>XZ!XHSzq}!TWI~|W@o!BRD6bg2rrf}V$Ye} z3TP_WvuJA%G$ zeJLWGBx3erYb61`lJqCuuEs{h*a0+3Y{)l0%e2m{BK}8?%Ss|59^S9LmYv{_M8tnq z>#Q!^&|xnt7pW}4HQHEPLrf?a8EF!3!u|gI=0wxK#ievBO$Cw#j`8tgD(#IM{QQz| zyq&gwT5nyXR?AINcDhGanP18*o{Phx9cM=7BeZS3Gd2iBD>G|(Iw0ZNyYR!c?(&$-pb8fP7H zGB4}E`}$MSMuUa0G5nshH7FNhWokLz`9654G+)z(Bsi%+_C1(j6 z!p%)+tS8%XIY!5=Tf-PR6A2HO#$Z`AuB>Fc*p}aId+t5F2=&#Cp@U?LCub){2S7D8 zPo+|(wc(c;XeP!tnSnC4+z8xUUg^rpfq2w*3+~l|3~rVl4pH9%5vb$Hb^}ujT3T8Q z*l{<{-&la+TkdB|!VC$WkZ}*ku~Q$5&HH8kci73*`?AX{E+q3nRD?qZ+0h;lj8!X1 zy^W}I(Q$TRJ-_-|D!N=kybsfTWLHRrB)}l*w*F`&7ahpl$W^>NRNWL^a@(xu1{e(y z6e45aLCRFzSY18AO}hhPlHhxvf^2z_IdHV^O7BnBukQ#qRTUHa79JjTLhtY~FD*>u za|;W-@Bi(7CS;QN*MIKpyo%r$Y(ml|61je@zI7k(!fpEk>l1SPQmj-X`a7@2WjVcGxIZZh+Yn!SE|!=uN%;8srcn>RLf2hAA;7ZrBKv`{UX zyPSDBZElnujc*ex#YcznvPeGV(A|CK^XCL?32AZ~c=U4c@`53yJYO^{HuzjQTUaVu zN#q-$TfS~^2@s{Lt7|d})nxK@aJ&cq_5ME1x;#@b9lLuMPw&@^aqcziEo+$(eB?k+ zSUE77wiu^8G`Cq>nQQfUg9fBuv0KG9L)K(plW;>rlwa(^K7iW1Xk}cJ&T&EOd8@|` zkF2cJzt$@#v;==pFkgi(yy{qm1w-cCHUBCW!NsTFL;I20&xbQEkZup9zmu#841H${ zi}eam=l$GV`C*bBXmC1VgureSOhy|T=EfP*RHXKI+|Bc)+!lC+IdZFGT8IC|ajx&V z#_{ahr?kpk;<4Bm`+J9Y>I*5Ut=&?+59d3B25*8O=d_|$*KWr4WBLmMwg% zgYT{;OvUn8pVNu-{BPy` z$Z7(SHGMy_s%_Df`Ab}--Cvd5+#vFW(bNF{@4ad|N$HOu-|HQ#G?DyCv0@DPu?KhiJ#{(`6$X;++ zTy0vP7uI&^h5=v4X<98;mzQZNoph7xSkoRjz2$R%p@JP$?%JM!KG#e~gK29bSVnoI zWI_Z3vyuxORmORxB{TqAH~!f>7?*BsZ_mTQQKI}3{Ws-^MTN0yK*h*0)&q-hXl~B@ z`zb26*YEDjy~qA@M+mv9*w~c9>rbPGN2kAkcae&6GOse}C$6c) zXve>G18><&Ru)a|gBYyQ0CU|&HjalvXMAj`Cqc13N*EGFczgabX)oXVPbUXvS9p;~ zlu`oqlDMzRv7^*Z>+^`E2y8G9D1B|I{i`}V*SU{?@mB5B)Y!}&h>{*CunDqi~q>MYndEl zM0?R)jMLOCBu|9(FfrV(ZfMSo%A#^th6UuQg^dB~04^wqye=*bJh~-aTv~!<15^pY zyY22vy30-&yvh+biFkQ2fY}L&k_aojK}(jNua((}lS`zhI6vO3oNPW+V6OG-`=Nik ztX*-W>HsliX;9=tf4a-44^a`H&N@F76FB6Q8lB(*zP5e+nqog{o3-ay?14$`)P`e4 zS%$kS!b{~~cGtq;%77gI5jmgi9BbgXfX;(RI9nPa^(L~F8#>mPj>w33190RJ>P3iB z+75sIR9~X`pMa)_R&%LirQ@PQS-Mn!iu5%_hI2bS&^B8dHy2-xy!_dB&}y!Lr)LPF#*Kb5~JMA-_nbXLCsMcId#xH@AJ^@uA&XZmU^jXX@1A&tnnF zv)^0P)k8Dm$*3>IEBv}`$zj(#%>q^Ex%62iBzT^t=~$mHafaL^nI$4Z4Xn{|eMS29 zVg3Y-NTT+(FN6I=p<)@GzW0rcjK1c$xw%28SH1)=Z!9->H1A9$(fasw)|G)cm(Z0z zkqHS!UvFRJvw1rC`+{n^*vDy+zX3^PwG-9=jIXpTR>*OQ8LZ0zuZVs1YNzk@dyKgB zXi5>9dzPAWrxx!?moeyae?lmjUHjy@Ao9#fD6g>>CgzdcQGa4VPrAO-{Qn)D}kJZO%%6{HMvQ2W~;`9vYd zty_x#;d^^NS-w4LcnxsqWyfCX%9>dSeSbrLbn3zgWrK6VkL(8{xDpo= z(ZxWC)4Odo8YD4zjMz2&5?jzc!VZrP3CRUXkhPi4>ozT-n?bf@rCsZ zZP--rjcGx@qZy5~>gQdg*Ld&SI=11im*f^jbf$~b+O8QVK^~Q;p7pd<$31#$Hs^ya zRz$ksS*`4yJ4Lbriyr$!e;cYvGBPOVV5KM|`AO)Ro0~s>{w>LnbrW+1Qh-oPYwHL; z+h>lwivaj>>b~8cpSj*r|N0n$OT#0=8pn7;j{n~ERwIZ2S{%324Gj#a$i1VZr57Ws z?rj-=UMr@yd@QE9O4~-FKrdLFzv(hh3}TJseAXHa>-4pjNf~cxpV==1ujixr>Q7e z+WosGJ9i8rg+kIdKfgyD9IP38ag@C7LeDzWD>)2hMuU(tTh6GRgh+{4{D@mZBlTZ= zv+w2W*Vj~4ld?0`7m^E%TVH8odZL)h0bm6&w@+VX{&gDLNMKvDu?6r&n}b1MFg?a< zZB`#ted)uf-BrXc_P>JVu3}(7;Y1UqqLDUuB&m6NR_oxqlk5ljBHq8Ri4kPLuXY;4 z;-X*p?N0%FY!J`+?B0>v2rl(@beOq7m-A#V8fD@6dtMdb9_cVbcv4UMno zV{K=umyd>C) z;g7y4pF_)MGdx=Bn}OlhN*ZDP3ZGs0SzWl~c=Bx(@DY-cDPTgne5kXRE@_Vy!JnGs zgXL7dX=m>2jNa3;p!CngfruC&j|f+Z-7dcT&^bDXCr>5bnqW^3Wb4noJxv2*fXObv z2r1I7q*6@u>w+%DP(>hieIU-;`*B|Ofy56nHVK)RWnqk|VGr~07IHC7e>*nr_7DFR&JSgy7i=MwIUcS z&DxJ&5x6~MRz(lkvvF{#i`j&&@ezZm!O&3}XIvcJX%GH2?4F>oX~!w3?Ya0S z5qLx~^!?5IPoD&!C|0CJYIEc%#LUjl77V(nih;0}+w$yCg=cF^%c>IwTt(rPtDBk( z|9n@QX!82@ILmUP(G#@$z$O*<^4L7>&Dbaz!$dp2SeGTM7I85{^HjStJEDfV8Y}S! zh}zVkX|+6_cKqZLt~Dumzr@5WY#bXpiqWPcBZIozVL9Z@n>R^G3`dZ+9y?1-4QWaY z-1p74fa<^Vv#7P=kwP2BZ@QxK|Jz1N@593laI2>jC}H@Mt#FcrGqgCgdP?r*B5#F&xaX27vnuI4oGe z*xDOazSX*Q>qL|A-d`AJ4k|Qc{wF|kzq;DlA*6+~s;P;clT*oG6JD1~8Qglk3rjkg zx5MlQ9P3^m7;kb1m9>Wdopffla2eKhn*``|n;^P()YC#lM5HN3kcEXMr2E^qZ_24E zzV{(%X4g6?WIJsG>T}ITr%rtvjF+^Jp0A3MZTxfxE=1iOgF->DPSHkC5Cfp8JN!)P zC~juOjt*|PpOUiC@9F6YO3+SI3NPSFHOLtU)BE$=80m1*T)LEH+L;ara~`;>50>p3 zHpQGiabkIC$*46^dVRkC9Xc4mL>CIU-NqN4?zZaz`a;m@{8l=6nujNxA?Ca=NEv`Z z%g)wJ8GuCF_3X~#U#us>KsjQvCoeBNTw@bk?ZKF5%2QWci-#7E-}&af@opO09hRvf zRey3WrC;?AI@S1+!RVkuXyb|HvuAyQ!ublY+spxq&~YnDQA~oOj2qy17*UW5hpcYJ z3F9p$ArYpIKt&+){#61xupW^qvgiQd82+C6)pqiUp`o6kVSGnFoaD$8o5*W5I=PK= ze-HMGE>1fegQ#rd)^VUh!d-&K&HA_MVe!mNOOh??Kb={pZgiwg3zXshj>cn6A+-D zV=$MlRl;vSUufJ)soz~2oDDD~5DJC2CT;YuUAs2ASdC`E+rk~-ooYIFYCfBqTw}%g zq28y)#?4swaQtq`mn5CRyqSf3GiOL-92bU8klmujl-L-zCrHgee@gxF$H9s}B0sfC z!nObaciYfi_Pap3GT)!I5zB|9U~+gs3b z_#Rq_*6jH=Cb#t;KTJ`>)6<%Z@r3b)5vTM8`}YxlHPllxGeNf64i1s3A&bZUn9 z7g_WGOfLl)6&2N36R1mFgh2y=+Mlw$Maw)1#q2jT@q+88vU79$uzO&Hb<7T=)%5f@ z^s4m4nc)UAk691sk@&J{@xg}-z+WNj&NZ$te|czkcNej#tZr}Tx^*iHJ_W=X!r6|{ z@!32U1H&-U&h+RgZZoIqK>)0y08}Eq)W^@tIs*3q0AUdVt(dw{4b}8M6J6bb6lIX| zbgz7i_ov?6+@8U0u!$6be}@TYB$V{Oe@}+%;D5BYZ^AwRJ1RJVXVD~Xl%+otsBaZ) z?2)*2Pu-J0D|Y}+9O|2~rs_Sm&>6{r1+X_BWedkH$tg~P9|=)AG;qpKr>Cbwb2lg` zh>&O?8KeccXNF2bHj#V|AQ(6js9?9=dhl`(dBY66{$LqJqW3@YRbI!3>w`C_md9NI zD7cE!Dz@RK_P3sJJ4->a+G|mA^wgwIu0v1mS5Yq#m2@w#LHtQYoNqB`xi(t_|H*#3 zt+}bGsj^a(aRG1^TeJ|ym%F&I5QG#xA|mn~Ug}6lRJ9}wGPS#c-Evu8UY_^LY`5M( zX%ln`;a(`a=-X3ktGh|h=3gGG3ZUUpiEs9<8LC(p+8k{~S?z3CCX_dU>_@jD+RoZ~ zb!|b%0k!_LjU7;R747*zl|W%BF&pwfIyn3!)v`Ko$! zsJF_O%j^uINb|vf(+Rsh{|I9LSpM^F(3PKMKwr$*PpA|jdEbLWbw53U-+*&YeUwEb zSd{}wH7= z))g-qNWs29!~4QRq465(<;#}=0Rg~_MXWoB)$^Z!)`UfC0zisw{@!^8`_xib?gU-Y#%Bp)R785zreS`_OB|7jfDDbqZ&#wXv4vc zXVHJSl60P7lg^maZObRImcL^!iCZ)#XMV5pKlI4vp8!mo3~b{%ae3oU_mWz<%rEBJ zh0{U(I-l}$xszGH4?(oj*{r%$Cn3?%`c?Fo6B^kL&owzo8 z^4h+98U6Al1OP{3s(ablaI{zhJ_X$bz2Y z``D9S+R+fpH`kh+*OrC6?xVx5Q=<3tuA75k*eeElM2p}Njaur|F$JNfM~}X{t_#w` z!g{NmI{xndix*uVZ#DUNr=~9Fo9Xz}bmvrn(h3X8zQ29SlQf1Rh|4tJb>q)jvIt&F z@0Ku=+7IZm9V_L*?c4=#6N&lZOZ)bmVOP+-~ZzW6lR z8(O{$c)SzY1%Zu47|LOt?^^bPKr5j~Ij^~Z+|pH4G@pM%ef>H3wr=D>Go2jHD<5y5 zfJ0<9h|dFYEU^IU)m$)Vq{wwx>_uf;PgI0!Z#@>f8n=<#lC11EUKw>qrhi-9o9Cg1-lpW#MAFl@)s={J*_13(1AA(CQ|T&9`NyPZ*1(2;x)tW6dKM|kP_Kr3o#DrwMcptQHU z8(7QohmP7%1c6){w2)>;N1t#y!A;toiM?Ob-f)nDO6)}r14v?{ptE*cE!W83`w`mh zFG0i=PUszAhJ!lVtV&K zKq8QAntZVOGdU^u6tXdSF}PV`?*6KzWSf?1<2t>zG8?quq#hL&7DB(_XI0gpK}l$+ z@}ewUG!@#l8EA~gGNQLOH-Sk|Q4x;2{P>8Pni{uhM{H>ctnbE{ez>_gec;ge#5m>X zD5%JfGrGesOjN*i0GG|WnmwIS3Q9_)#?F@}bEz3_rH(*Hl8bMK3X9KLimbM&Ugava z`Pa;wI%4zFy$Pw}txl_-LMq_OnzWP@6&W$Hwf?i|wjdN_Mqgb_EG$y{d_8pjaRL0= zQtd}N z$7QEIZW=_sM~8>M_>t2NkB`UswPjeyNknp=R+0$e6C^WkO?==J6hNy1J&PN6LW4?h z^8;TVcz8QF4J0>G-->g8`t*Z0#1*Eides9!d{x<*KgU1<`=`V2;T!!EiCu%n@ zQ0TPEj#~QT)wDX*D*yHVuLkLw`e3(REBvm`cfM;J95dTEp3V#$zrzbUfWY=x`S{#+ zx1vGP!R{Y0l)?`AqC4P1xr8T5N8k*ZXNAa1P)`)mm$;TsD3_RXC9 zJxqJ($A_{_XUHV0_Z+CKpkDFr>h6CKe-pOs7>b=;Hfg()|1r4kfUnHwkj{Av0G-nw z+Uh|1KcKd2pw^+Rnp}6ac8e)a2hiBd`sfD=EM?$j0I|3(QHtr8 z^5Zla%~(0a630o-YQ8k8dtKt~=^2e3MM&+=Ru>oYhMfm+lJQncuJM!B#FsxM!C0`b z*mh+2D)4e<+rH{A27!BPE!O{hbHY z-rr+0(~-CVB>}C|>Q<-T0}GNJm{TdgM;~u)tm*nm;Lcu!;_AAD(~41NykyDnRj4d~ zW7gN|YHCiMEMB}SGkFbvWuT{L zY24ilcDcteG|us#J7>hN!M(8u!Sp;$&@zIXo2fxiJ;h2e;p*@EQl`y!W$CA?+@-+U zK7SsUmzNN)cV}SpZ;&9eeV>%%Wd%ugXQ^Y(u;P^~pX-Rn3c6#!b6tP|Y9*bgObiSK zv-Yz0?=LJZF;UA(OG6?{PG(_|p@CyFhUtXfvaV+Y2bx8m%^~Oe_iVaTZA8#P*2dk@ zt18sS@ELJNwqobWgLVW??xcj5&f1VQt91c6kjt+{AhTw=ozCm+JSakxK~upSIwQB; zc8DR3r4`&VPxz@rd&_#<6B>uWBfx9Cc(D;cdknA+L&Iw99xTH`+B9(WF%e^2@b&X! zvF&(r6ILYn%Bwgc6=DzE;|7L!=i4{pQKPwV)7`SKkm`}ue|f{x`T6;WG=d51T0x-B z`TFhKclSZf$UMijIw1Ptb#3_fP%@4jnlwZX2){hPIy0F3xC`Sf>!TOy>*3+ivK9(A zf#t=h!MeP(n4OhXOKfSG_?-k~FXE#sQyluj7n1W&5)*S#OUucXmpW$PS6U50<)zJt z6ZO=<{3^=v4mqTtM>dO4N5q9`V_)_4ndjn&PcET3CN6-ci!T)bp~?wPt0n;9F_JDG zONo*d-fe^fWwz_Xt~xURX9@E!K(+wgxH``hKt@Ut0HVG~Lykd1zHVjAjqR<;$-`s- z;UY z8QK^ol(Dh#Oy{0}JN_UU2y&Fpqzly@Bqk=7m6avyE?y1Ss}2C4SzxzZzkWT`X&nZq zF`D0}W@&5?H|P%6%i(#lhd(40#-i-B2ry&*td1`hi}s%FSuOc+lbPAMJKMs3Zc7U} zqL!AHLi8_Png=@4D9CHMHPqA;w&E_v3i(U4#)-%4*AHl94SPa_CPync{b;VpP_J#m zq-##HOx`(qZl``=UKX2duV4#E@&;ASVRZsIuTp-{)A_CNWo1 z$EJgqgSNJ|yu5ruBPGQ~o|#5KI0B(gCl(f_g2}JGPDZD5*;>!a*6L~cBIgo2=|cxy zr2n^y%nuzS=_;`wjNmX-P1nq`8e@`_tOgrJ{pnf;^b1Q%#xe)^>f3O4#PT~xI{=xA zY0G9~;WIHM%cBPm9Ov?QLV_eOMQ}f>aZMQ5{o}=e7IcQI)MNejgH&V?MiZ{b=H;z| z5@n}J{bJuV%nR~AaBx_EfBgVTLbz)C(~#$R7w^*_FUY1K%ENnzKZCjpSZrvg>5A;Z zgK&|i-8%A)^>FN6!H3bxPCv#b6c8|`U8ALfG_;|rYC1l!ObzQ+4SNw9u~x2-wgc{k zD_stO)~3eR;9l7IQ`#W91csk5FeXIME7*hHrbT;269_W^>Leggy5B?*fG#0aUv-%a zM*4_~9~trf~303H|>UAG5-ix~`v zcm1~i!IV%PcP*FHX(6&(90im?0#F<>INsrLyJ)i@s_zUe4Jx)zTn4``=Xoj>kB;W{ zm+UdIuz-!3T(Md2ns(X6#WuxrP*4#1sUFlGByQzcI86^7dnja{=?w_n5-mv z5RmsigY)+OBN8!bQ@l7*?N28>4}N6ePBuSp{*!-+0(2cbqxtPYei;-=pmD*c#c09b zJY{o^UI1jsy$cI@X=rGus3zj{Vec`@Z!@5v1Y|GU_zrw&08H2w9G0^HW$G%nZEfI* zvj{=gEo~?+XF7%dD@lvxw*O7&dyFBPk(^R zCp5am`(Gxbz|1{Gjp$(m?Okc4wuX`R>khp=++{T2p)F2kF}Y>jpL^Qzu-}q2(}; zv)ynuvx4JR6YFLO+>qwUG{9lM0DuD3!$6#PWsG1i!CsVz>kz;o$gmQcSEUL%UN_I5 z0t8d}DiZTp*H=4D=jP0+{fbJ4C85iJ62<~+yCV@HCK4W7Z^$=ta+c>hff;Op+jFDA zpN_hnH+rmMqiL+rK%2+JHE^=wz_Wh z=X*OAU%a>6q_ezmV^gOxGF>WM1Q&7t zf-J%;zU6A}u`=x>Cr_4X zma2%Y(Fs^G@|NC>{k)_X77`rXt5@E}d_^90JJw=i!cfL&FwsXM-shdnX_nK}m^e-}JVUfI{)_c=qRK?M+AJ0$m5=sYzx zl9(L($^!gnAXXv?%vh8~2i$XkX!sX?4Tgro2335s!!}Sc&r(vV?039A{P=N=4DwR8 z?JyAFXvxq~4erAL$__x`?f;H%A~FaEFJG=6Iy3{Ve&}L}M0D|Oho*WC;@mIFGtG#N zdU5qKarCgdF851ZuPkgn#FM_ck*-a9@#5_4oS7%}W`mP{PmQj5|@%=p%bYaO`C2GKTvw8G=uJhTK*A%;&9!x4q{p+o={BiLk?E!iZ0f7UUe7rdx z;Z*Nj6%sNA{yA8DuddnsoyxPwR6f<$2SS1k+;4DqcTXtK078-SB_O-RR>3`!#T6U4 z*3Gyb24(Zd>3L`h_WxJE5+UB|b_1odaP27e;`8X;^tW_1_ZdxJ4yq1*V=va;nS0x* z?b7w@*EgflzRmYzsrm0}u9BYKoA+XMr{zy=H&N#_{hgx`RpMlO1DCA;1MmK4)e-g7 z!eViR-}1TUaHK82*ywIIhqjxw z+cTxUfkW==(*yZN6$$l!aPGNEVj;p5G~75xjnO~HynbyDE^~9M=;vf^X222~fpMePF z1=z^-nMfu`cw#%O7L1rsUwy)ttTOf{hR2u-n68^N3EdGYACwde%jmO8{h5K~94pB% z#BSDc+VfD6sV&XDB^BCS3kat;QRXs&;afj7xrTmeDBv7lY|)lkmRja&u}GCsVALTZ zrtLIhouH6)A0}c)+;nT@`QB#V1cN_T_QEHuQNvVD1*)agc!-8wR(Y+bx3_F@sf|ZF zhPv&ytXNNh@lsX2V(5Z63Z)l1E#&OnE559~Ikio?y*icrNbuG!-dsz)pXr6d$}O_2 zTw9I;JA6|HNwR`4gY*;;)D&P_?`pbb^*J7{sS;-1$3n&>0QS zu?P3DM_(>8PIt|zg0C)%=2Ectqf74Sq9XHOH3v{j4fZsxtx{i42^3rW)X0!V-&~7P z%Xq}^{ya^Adc9*?N3!}_Uq$vX+tERXzWj>L<+Yc40zeeL|4B&y$24vL>n^qjoJOmm z0*lDQN4#s6GaBm~8yU;oI+$DS%(ZWh1Z{`2xh!|#De8vSqP@hvi02&5(Q*AE+q8xn z9-HFZZkIH`Zru;AI)G~VD!SaAA=HxmIcq~c)xGEQ%De`CRipJ1wUEnww7;oPK7z>p ztamGuHh`{0d&c%0mNWJwK#$L$1qnCK?7&m?*Jn`%xZa0O{{VwfcnJCh*QZvuc6N3k zcTqqZZ2)rv+2Jd~NIDY)RC7@B*nu|NyLao0i#Kc2JUuH99bBQm^Y5ZHQS956X_jc$ z9?H^5mKmRWN#%~M)p1m zsU($^Eqlw}qlE0e_uhLP9OHjKM|%7HpHH9H=dI&B>;B%~dtCQ*tx8p(`U^4R<)Kt- z?^8lTDEoufa?KnE8>@H~})DQ+hj-i%*Qh(3!NH60vv)S)x|AC^}O!Siy;NTeaexc_;ZG-|5bbJVmMq z)tS$BZ$4U^%7n85`IHVq{hprQMxaR!X%=W23G620CY0{&=KOlPNDhVmeFTL_b37$Z zoYkL>uAQCV@`IaLIMngu`mJ%F_nVH+P!ok&DQyh^SGGKVPAqOV)1e+@%x)L-cXN+h zQ&lxq`Y0``m*sYu92z#hKg%0$(JeRZF)m{4rW!6spqD0FzvaEnG;I0RS9gt{Mt^Eq ze5CSJ{!V{AWgr6?&9f&YssPMQP*pAP8@K8qFIgeG=R0oSuWnpk*^_PTFv9%piIMWr zK7)d$L6WdfJ~kYioH@B9Tnf5p9*Wh#)|Hl-DTU{uOc@y9yBoK&8r9f4D|;qhchUl% z>nOd8hsQ{~j6WdWmjG>(7*c)&lox?+fU?Lvm7YCwa_Ho5*m8WNmf{oDJjn7QuUg`|ySzR{Z^c;dzAghQx z83$#$qy9&?_cAV7&+@3YdZfzM*RNmx5~7xF01)<_io@64dtRizH4agsn>$@8?!>{! zSJ6{5ml!?c6AzBoEKzOg8AkY5TdK;n=)?21K6F*C}IvUIo! zig{*YLO-)4`E8ZvF2Tx<`vC=-M?*6+_7MKCv9W1rXzWkk0UGt?@Gt*Fht4b=n^k!j@60RDn}E3= z<>WYUfenFRPp81_D5P(IXu1bj`TdR6WvTXT__=*(I5Jm6hXvvKLNWx%CR$o`hLNp} z4QTtH!|oDW&~G9UILL!>!mSqdSrzXO3+?`{DFVz9#IWx^yoW;gbNsr!4Yy(HNOv^x zX9&^p3BwBOHqFPK5>+$xNo0R$&l@wR7HxcAe$?VqIZ#zwOV4jVq&Yc@E|yN|$C=jbI|c~cT!lRz#1hnr0u>u1P6xz#jGw4iDY3L&_m?&+e+vj;V1qIIY#$jScs4 zQQJFoPYzR?6!XaiD5q`t53Bekclv}n6@CAH^D^uDP-VYzhOztG4^;iBuzOj5PjZc= zrq(qvVYn=iGSD>NPM{2VAe_;q$h zy%a3NtMKsuDW9}87HO?Z>RG~L|06Mj?3_kCdg<#*`-ihVHMvPg$jB-kc}WQ=FulH? z;_jhB$vK9~&z?+AH@p7}%43NQ8k9WaU0{7oyq;M(IpSh9xo3E943@`IZ>KI)hh$`B z$urv#1j}nqhra4--&qs@82PXZcfiAkO_le56;yqy7CS2I3LOk^96&GR?dxl#tsQR_ z%sVkVYYHuR$e|A7o;J|E+qVqP(SoNBrjgpPAXsuQ*c9lH{jxU!JLr5S5DPu1?knnV zjlTjIzJ%R&Ad-R+6*(02$Mz5B>8jW&qB9Ra+zt*3QFhqwe790vj*A{po36kYAw2gP z*5rWIo)Wua;n6UF+(s>-LwE|S2O463^|LY;D0%3d-tAuLgTJP`v-Q50E3Pt{cqaBS zd4dDaXn*K+g5=rmyy!1dc{R0_l{;&d*5FC1$&=+Vdt`fdJW;I1I_nJu<36#X)3vq6 z_0MD4NCm2UYK)o+6;}DFE}tD-Fo!Iw3~!Ix9!*7R8NlVVjrV5d0^WJk;@V3#A}bEr zj}0?mzRWx(Pg~iz=SOdnDzBnpG-c?cn(Ry`ZFxWWK>5%X_9X`iVLY8rhu*jxu6~B+ zgvym{FlM;vfIm+420i0dls~$%({Fdc26zoQdCjF zU{Yn}+Fad^YJAv4Kb(p8B+)f@U3@rinbWh3)3&^Pf{bNX+R9CAb<6b=5sQ-i{lxG3 zEvd)=EdNfu!1f*rUWXv1@ggqs-N+`G?QYLOXi&*L8IeV$3T#>$BKKYUoG@7u^}4!Y z7x;4hXC`#C$JXcj%Gc0;U!@K4^Dui!T?Z-0Z@(NYe7|9s(#@6AykpJgzpk#9V{k<^ zcppTg>dnWVUH~N#JQ^L3s@}(oP{5!ol2u2->D1Y>Ojl6{P=F%$Kzf$ z1i0CLggi%5K~}c=o6C=?q44lhxx{{BKl75U_a6kI%RMFPfmXc~jq1r$?1E_)-NnL()Q6mC3 zdRKJnx6L0s`2Lq53-H)tPZfovJ1ES(976KYS4d7emAzT*&Y1HaCpT<^gfNAgV|DAv zJ&Lb%4E31-C=#J4g5dEA_EI^hih73(CcMIBQOPoJ>3Sh9E~k}K8dS8m>rcikyR()` ztmO_*tTb_>ngEB-M?IAc5$_UnS{qi^08XHu0{BP1zA=CFTu(>W!VW;fKu{{*X%e8N zsGYU&nT3NEFwWv5eHW^;KVy?7M+1lrwR3FpB2_d z+3Bu~m3&K&uK9Z&)in&;%Qe)-MV3AhlR)o@T*~)Bd{y$32zJ}}yTfKTg|SWJ8rosG z%391X>BYy(@b~)%%Q>M#lAk|+Q@ffe{T_VDpb@M9=H#KHCC<(`Arh6Zsp0(8fDyH;_Tkpa zXsg=Xc2F@hi-7g3GaeO{X})vk;N&>{2`h_Afu(N)tDA{=$*PQ(B(l~MA_W@Agsxgr zQuL+d%w7zyiir5>PPnjFPBx?E9;cwJyuQ{kBPLd(~VsaW$EkUh*?%Xt8XY z{cny63^oJJ2&68KC!NSxmYyTdaF8%Poe{RV)5jWbb5j!&b6e=KIasf}NB9yu`u=q( ziOz$Q68;T9I!55AuCDndWW-Hk)-HA0;j@OIUdQJQU|gpMc6m!XJLMU*PYetUsHtc) z;4^`*xL?1&5N*jbXOyFcr8>t^e|uCQT-~lH^e7UW($X<9k^+mp2ru_u=W}nUO4O{G zhuP{(zdeJi`j3+!V_VH<;7iGfOT3f0bhL}9KPG~mcczq;=6>umFZ?6Cm^#+dmeqv; z$KCCKCr^gb@5xI0{DM7+l6Sp^;1!v2k==?(NdT4oiwKdCeG1b3>p0D_aqaqbXiE9} z`xkIQL8CMhh#Ranmyd2+avr=BXVK-UTLz&-{MXuX^C~-je_W!+Zx>KdFeL1-VqFcr z1V-30pEps#kUCoStf@93(XijiUdhhR{md0SESJ2qwdN1PIDhrjhMJm;o;m;R1cZ9n z^c~hLqN1*j#fGeH_PXib0DdjFCMM4*a{x)e zarU1v8RF3+JI%Js>8Iu>-F=>>>_4Yy#dstsFVUQ&kK6&PQcjry@wK3 zgO?QC+ElY#hdOVP`NX+>f29omY7NoMe3quVb-f-C(Exl_LUxS}Yp%Xk|2*>nOS9Vo zB@d2$YtdKZV`pQ#el0r01Mr!D4!tYvhrT&h6itjIa;uoGPBxs>n#eR>pHA-^5Kvc` zc>CbNg2g6ry1DcCEuGr8%gYGQgb!szb8~c}POXiw)zQLA6%)r{)7w-|8^&EU@U4qF z$Tc<3tes}uP%Hf9g*8tUG!!G+z&L|_&Ivf!2!t@#m)}dxjnF7@ayU+r~P532Cuwn^WUTOo%8IxRJ1si*|I_(L&?YMd~)x8+H_TWa#R4(a_7u z1_QeK=6a7fG3|$U9v)coMI4ig*VIzT*dk&cflVt38p)+Ft8<-Kyxi z>jR3_r!QEkMUJ!h1O=5CcF=T@7yu~Hviv>Q*1EVq@}NBD%kH(cmlf-eP4&ic?{T4mj^{`_wX;R5OV8cm_~Zs4JkR`LSC6?dtXT0QwAe_G~H)E zdwHm=Vekj9nswh;Uf$7I$uMs))6Es%i3Wx06hVe;hfOs6JqQK0RaS~(2`3AwQF%D* zFc7UEC)f2NTg=IK-&R52aT==jX+4znr~LgDWaZ?pUn|eE(bLh9cyxlg7=cG%k8tVx zLLJ2;{ZPzhNShxhm^XY&iM|#RNETZ`kWe8GJ82ZTJ@!H$;*+H z6Q|pL6Fez1$Wn9KbWK*Vt|7QtCpvDmgmW?H1ZKQ>L7P-2UG>oJ**GkAi z)DL*vy}d`)vEh}hl+?uw7gCxwxY=e+TS1F(gWoYf&t|ekQgWvy>`m^**@NqJ&Sq@C z88`8j%WaYArqP|uDd8^e(8MjFrFvf(gM@lKQF>gHJy~KR`hsJ6cVE3a1o&M+A)&Xk zL>v}8Mi2|uhk&Y8c$OVzPSVg|7HG||`a3w8B(Ts=>)ZTT7{2C2>s?iZV2-HhZ{8Gq zVj)2QxskwPsgX!zqW^*?IY*{phb)-}*!}*|SaHoNKLr!#?@BcOeBff|ViJ*Mx(A)K%>HkDyLob#+_nq_4%c? zkAcgd&%a^pv14>c?(J#B!t0#}=9r-3Tk4YBsi z+xSAJ;ebx7R5y^`+WAJVtFezNMico}8rs*K;g-)7>g*!+gzcINY@F zlfArKrKO+RkzB8`Cj}@}UfB?cQ07(v#GcoVedV(#?U5rJHCTBail4CFj|o2kJs3v~ zjz4l~Xc4#&n+Wgg86nj5zi($+&QSSF*1o)LpyqJ=;H}^|#j0A_FQlDxbl?!qE3i%q z)=XvgR=cY7Y@LNyf&XbL9igYbz-Xw6P{bE)vO~sgv68CV+I^5gr{8P6ZJ+&Oq(TEy z1z^BUvE5no0u&YKgMP(Q%x5xzv3NpR=yWf_zU2mDFX9_YR&eH2kYAn8eO_@r%wb}* zu+2d1!CT9v#@gCoA0I2`;=i>+oIQz-rNG@Br`g2gJSwJIJrl(Ak9y__D}uSxIG?Xw z$@)0`Kn+bpERXl5qKf%&Z?gGBoNj27^^6}a?|sh(evDIlQU^p7V99M8i)E=s*QF>Me5QkxVfu%!fV+Hw**2b;5>NN&O-^Zd(wa%cpaPlh8znva9nM?Qc;rpZ z$HSw?jxTwKgg1YpDZ2Qv`@@HO>Gv9W6qB>P_?0=VW`7e&DWIXtYX`p+BPRgoRmE~9lMOPL$}uF+Yr z{_c6t07$|6QjXD*RWD~d-lD-YP6%yeE}&3*D*jsrhqXlyu>xZ(8CjUGT9Z~^f%Qdh zvvA;&r+nQ$ZY= zn3$jn@x}O40UP4d{CZ2S-mA^DcRm|K6FP*A)KTWRN_GiD&}z>2mN~tf|tB>2*R=} zfJTP2t9IOO&k9t{K}04G2};8)d0+lqMVFLlXLYOERzW2IzLmI+>~Fo%SzvkXQGv8jY$K~VgUH30_FS3MO%#(Wa~ROYn};EpBb?19L;(;m->nF=fYGy{*a(Xo4I^`*L5dgGYx`df|~*&l`zt=F2oi?dp~kj`2?e*D26n`8dQr%t+U zF**94#N;-c!_s`Q>yc!J>suJZ=4Nb_V*e^l-ESJXe?uo#Z(A-^&6)Tp624I4EZ)(! zj$SY7kR)d0t&^K*7^CWD&-wj@#`W08Ms)7_m}1!_xKP~-w=_#3ThUU8Tb;`Zg5u8S zEBMs}uiO*jau?fG!q#W}`7QLQ_n&0}@+@OJW^#=Clm`@08jCY+iT?W+`nFC!0f{t0 zYc#xud1iK4bbv{HJD9=iZ(J9y@8BSVFVSYX-BP?j#qE#UXbmMa|Cln(zIZpf=KRnI z18^RSijP%&KxYszCMG5?Ev-pX-n?eCsNt}4Sj+m5p2WR3t6Pv3Pft%nix(1hVkYIx z!u0g%sn}SouC8DZ1f7kyg`WU47}7YG*ROXmiD_wRAhJm7{ZIr(^qpfHr!?Lv+^suBZ1`{bvHYg;a+SAp19*kazBO1#m|9(s%mP)=YMZ8 z@BY@T+8g$;wC;VWmWZK7lC#27uw+IclOejy#l^+JvGxTQU}eB6W{(?B$3cD>Vb9Kn5$OB^KhY1{g6@rk~M*;yccU1x4S~8A-yZnp&z%@QXCT0wr+Q+ImdduKe4w|sgZB-Fy!X553_zTx5#@g zc+NqE>|R|+!Hvt8EvkL?RfxiqS3pZQ^Dr6NHnO?lVm&l_RooMq;_YR8h5qk$YvWK+ zM~TU!OMXvh+9oR%@qKQ!^t_ zxV2jBHOoP=`=cp@Im~tpSEXwnH~0)GX>+7#ERzZ=)MDy%cD5)Btf@f(q2S&#Zx;x(*IJOo?MBPBa^2K{DUg-X2(|1Cu=c>~I5K zPdQb9xuYm5Y6JEfcAnrc6JnuB3uOg~*`6Gg$B%s&O#a%0p!so6{V=CGkC2qF0U4+O z{e?=ovCX3~$?%82I8f2C-x4T}LspE+iykIz%N!ep!oC z-eyW$u@u_KWy4z}z?R4$*1jKCGlwgoPnoHq>)MNi})|sF_7rolzaS!Xnfsd_i2N<>|jdxWB<8xRa?fL{)VM7Lyb z*S?@HrAc*o&*1Rk!>}7;Hwhz9D39OUsC;hBJOBH$j82ASYuqmBu1*%8l0@5#xn zeWb+TpPr^Gh}Q3%FIxcS8-E~+uMJpvs;BoI8?^qpog4456&`4Me}T3A3W>gObZbK} z#`;rvn=85rPG#L$0;x(FZrFdpnv}Er4+Y|L9Zoi?m?0sg1j*V{^**9@8TlhKCLBOk zujEPuA*+W6O5D*_%0^S~@gu#=TbF6>hzzhWa%O2e5#zWLX%3dwxDs8L(8|d_DnN5z zxZLf_7jrwu*Rw>wWtEgTP`h84)w%~v%Y3n+qVpbvv4cJy_Ku+B2|0-6OnY7tj0lxp zNm9dPls)0KTP3MKrNX#bT+E+x(Rx}|!kqw5q5sbsfFE>_>uav=z#peQUuAna+m||W zw$H@dxb5YX#N`4a^CPx|s>)F*SsIILCs$Vpm)nkD^j~jp<2rKO-F@}>Thp6QH}2gR zQiw012xo#Bt2B8ErUD_)i7<_?-rndg-4$(j!5DNuCL(IImv^BSD-4gbjSn@M*c5i5YGJu++Si(mWQ?3j|PLRHBd0{9home(-!m%RRinapJR~5 zf#cPgB{ku~SpuAT{pcQ8k2Lq}j5@z(gooee=NGX$IST7e0P~`bDM!`Y&krk+jk7_B zI6WA$2j+vDL3MC?2z!1_wZz)5P7Yx`-{y%E@0kmdyuHg3<%`CKU*h5|UPsdJKgXvl z3^mg7R>h)TAJgvz>MRbbLkd6Hn`cJ4-JJwC4#>mhK^H`g5`JO#w*p9!8h~J4>1ij} zEMPLOj{*X(!84(D)2|X!sTd3X#sE+i8Ky#Q`w|LlKe7_`*3W8M8NXA}W@OavC14D( z;;$=Sy~O0?e{SOnJVRY*#o!q)dU$!E(P&+y5Sb|sK;4@q65Cl`XQCdLt9S9K)%t}tlg^BZ-*AzHCr-R*|L0LT%cKD2`4KjSCJ>&b=r`+A^C;lF+R zfz<==O^hM`?naR1j1w4M4lC9Po6jUiHaCC4ZsIup5V8$27OAr!;`WFsyaD!pXlP-( zSyilT=AeZ}e(v00?ROaUD6m>0_Y9jJnJ>1l9jzLX75KZEz%>Rz>VZc%pQkPMW|kfgnRV_H5`cD>RI1#lllxIOVei!V&ge4kAbve7EeR)1gC$fB*rCEkMdeUC{S(z%hf%q(6G=H1HFt71@dD>6vCAC6|LE zP^T$^J42_B1ssuFBIgHkj}g)9r5`StpXKxCJ?ktt<#xl zj%LwkciO+D3V8ACa7);}A-tmZ@84I~)W8s7FVf4rbQd-i=qE!xK41ueWGP#)M`t}fdL+AtOU`Y7gd_9`8*OjT~LaJaBhRpe7um7 zoSg4@MbUn7To-#A60yM9j_tV#hQLS`@TvdytpvgrowQLd!@vC%SYn=cUF;09nvz%T za}C>HD5VXHLhaCLz%fUEp!m5LKhG^j#{2sh%jh|a6V9=;wA3`S2GW_uhe9MK78V+i zPNN?0i|n&BuJROfwTm$2s30%DwlJX9rxYt0lq|0zB$Sk2`H!X5#Yu)4&$Ki7seNmP ziiAW+^#y@lNvP@s1Ck!`rilvvf4ym-GsU)Z%#(A`uPC;e)rYZ-O+8*9Iaz^RX4cA` ztxP^qJhml)KQTX_mWiorAk2&IpL6AEZ7lBE+PcL`ER{K_kF9kGBqSx-fpP4wmY5;Y z=dWVmhTI9Mjh}*Hfz~w_Dg6F#tqfo25rT2lpCY90mrU)5=btIYR18=T*tGqZAmiW! z`q#;)+nQIzJ-Ju*Q%Ea^y^cg-)#Kf}$6{>13GQZe6`&^rIaFdKikRr=)Ugk;ksYak zdPdv;C3$F_ubl?$2s}cWh{!AMr)Ne+7gwjOJt=w9-8>GKCj2zk%x?yMI0 zHM6>dgZQ?0F${-saa$=ZwlbBDHGOlr+c)yx`JDYs2OPNwFEoo;xsij%hT6SKw$^Wg zS7H|lD%lzeFPu38O7z70+Z#Qyf&dc^14Yo8J9^~Euk!MM$F$f2^#dt&^;?$H86e?c zsk2cV@UyY;Q+T+brS6o)OBlHH{BTMEeW3Y?oE~-4LT|wZALXrf$RBC^Uzhj_sxEel zif^%Tv*0ykQLQ~WSFV}He)B0iITkaNd6ZKHkTHp#RyrHqhVIc(lX77kS`Sj?x4wD( zcTapp!N3}Cyy@1IqX3cA+&h|U+;)z#Hocp%tTr^5gYlqN8Q=v-hq`4qBGZiV?V zb7{yUfJSkAf-GzGA5(LVnQn;<>Uxo-Yy_q8xTGWqhl6HM#4T-37y@bATC0o<2xjlU z80KeSbF9KoToLJB#GG%q0=v#j?5RY9ZjJatToz~F{-QpJYhj1@dhXQ=|2-|fdVqd7 zPK0#vgvdi-6u6UZ#sj#}vrjhXUi|(7#tnrt0;=AXghV{7{5FniIdW$Q^%IbFIQEQn z33n2*gqpct+ozQucj_N2C%Xl4>5h((#PR;t;<@7bKwPf%&cE>u_wnOtxOl6dz|%qb z8k#Nucf7`XM4ZijeeVb!9v^1b0^14}WNZ9QfTJ7+Bs4-)hmGbp5h zR3rs7P9wc-Z8>S~Yib7PyPQ3%xln>~kd`j|AMcub6@{uRLie|(MLw}Q7C1PQit2{a z?@1QEi^RlqSagOS9^!$Nq@<)kXdU;&x(qI8X};kn`nEWOWdDWBaP? zgaFoRmHK1lH_wBjF9qV=uAb+~%qc0!*pv8nBcHS$yvM=u`^>p>p91vzi!k5S!vOA} zZd@On1Cyv>j#l~Dih6h#xXti4>ZucW0$^$O3q@1&1tz9tcY%o4K&0Xs*Tw%DA~;es z*MzAlDW9b&!nI~;q*F6cuNO|9%q;%Cu(c80IIX{NG%XTIxXFB zn(}g8km763G0D00T;w;>eZmQZ%8N7k`-o%Ew!{|0?jHMb4Qer^9?-o^QO^37nOPg~ z%;Q=~LV|MN-L5WOS0cQ7U;gK18;7@v)JRB~z$OQ+cYG&r%GYoB_O?Nl8yU2~%KG92 zUO-NBV94?D@vtf2;4Jw0YJ*rqUvMxRq`Jx3QBgLQ_z;H*Y>w{G(b-x4yT|p8{5sz9 z`ARI@(ziAd7+FNTQWe47BH$8E2k6KJwt3G33;{bE;?d*`EPk+Dx^#(|xn7GkF9*r3 z9gz^>zC)o5%B0w72S0(Z*&wpgYtMW7-_T%w$-ktqvjl~fxBH=-Sp2GSMkzTPXyYbI zU-`qH_~#XE1L{=j%8eU0I61Q+*`jf6(i=srV6c4Eu5SnJ)iE`!gn6eOLs7`gTG;F}T4Q?+axblPdwR*2(*jiEuHM9S*uu3ps_Uj%2#i%xB7 zIgw|qkQd@eW@?L7Og6Ou;!%!I<;hDLt{lP0 zCBs+$WQBs}Oz?LL=L!_jOILd%ttmmSo zcFZ(@jJN*r76ua=HRsA zb|2IjZ_qFsfBd7+*6S!f{=RcoCIXv&ge)CwbsJb8c6WDyd;uFdn|g0=Ury$%4yXdJ zpbx;R1VZU^Y7dT~WFXZ)IFd^tDfDO2P*GHb5GT1G(tY5o5YTT{H~|f!-#(Bv8NA05>VI%&mUlrEdP@N-i4%-))j`lzRnV@@o!BAA@y&COiKvwGIaMO zm6exU<8$`6OXZ8mbpvM=@D@V(6?#Wd8NgZqI&VCX2C~KAfZhUhT$_Q6b#>H3Noba+ z_8~)Y2M3qf!={F>FHQWJ<6*m0$}Q zM9dlIbYfCcAggx$`kZ~+o!uT2rQ+gkLs*yxME+)^j}Uj$3LX&v~(#tTXSTce=BkT~Ys^umvg=Ad1{~9@(x4E?jUALpeRO-P{zp zZf>^hN(7rAy#$DTCdH@an4~JS{l$gA!UJIL4oQZN__H69eo2fq6ebSAq5VTC1tR+o ztk)G@Ly-s9MjISR3BZ*|br^XQ4OQMTCMA6!1l2jIWop_8@i&MIfOUO6pJR{qSJ1el zD0k)H-rzj1p}QI@;b_&D4{?SpFf*0Fa-pHQn|`l50>Hwe)FEW&&o5Rpupw=#3FH@z zA+!k(jkrPJeg#Mauw@(s6y>Y{R2T2w9&6FtCJ&K4*Vmhef;zN?7{ogVhhX~RVk6Md z%?+R)TOCt|0r&oF#pQ`Qdq!-14L&x=kL@7F>}P&67WrZXM-Jl5oLF$rnMnW#0v3wz z(UNJ3%aM^+gzmYhY+X7y1K%%}5=IEga2E9@8px_7^nyXNZEyDu!Nm=6tG9Mwd0qm$ z%Yg8?2|%qbCZpdFdA;cTZa(}g?XQb4Wq{jRV`kof{CO2*J&P}Z>@qeA;D>F-+Z$xI zZ(FBm_U0za2D4hv7x43ILWO`n^kB0Kw>(bp@!h*ADJ3O(=qn61IXLcUYVvGs*=-S` z_?Lc-e)@E&i)30@*o}fUVuFAU$$c3i*i^}d1_R(NHh$)xko;6>oH}K^E zHzBB1pkCp@n7c!*I4je|pTI^vHJUaTUs;W#&0jhv} z765ZOqTqSKdB=VMRSIGj>2 z|B8gc$wG$}t8XvgM^{yq4{)J)dqjui&vEIAaQRV>YZ_K=b`VH7frm+F=zb3ve}F0# zZ7+Z5?7XqROpZXDm3tM~@?l8o6*gYI8Sog!eT-)z!AHs+k>TN;#yPxf+t6Hw^s$w4 zb-th>!T#@CQ439hyzEBMPwBDbvZVnD3pf{%UqU3elb%>rN@_*4^I0LoV zE|UJ)(W+T!3|cJo4?)c5iw)l%Am#G2!cPng41h6Wn&JVFU;U|^+7Jsr>@C970PZw< zk`B6kUD-w^9#lwp^XJf`xnpMmQrNuq*^j|AVQxTXRJj$C(KQ!rq&gjeA7yrC|APXyAs+g*O9Lg<2 zL`)ptv=M)MEYR@H2MBb^T@Icf{FMCUuaN7osoX`ve1XGYQq3A#WkYV9CiO@`3AQ6H z{bq4&h=H@oo{sA*&vNZrbQ8rkR7;siJ$^hjeGa}!P%N$M5!gaVKrr`8Lr$-mXTA*W z1tE&V6{l5#v8Dy*hB7i*eJ$meVT|9~B4pdx z8m1?*9+?2-Ma7pJ>s>}ixAi}vyiJ69QT_=Us0q{a{<;RWQcCOE+ji_SR&V_Q2{oIF za-_R?bFhvp3~b9M1Q))`<_Nq81qfbzecMU}&CFPl4rOT&-}3J}fT@%8pi0wkNdb6R zj_^O}FivJ1EcD~V#*=M{9$?Z}X)CmK!;}iF5@(4_1_5>pJ%XP#dO7RnP-TdyDL9zCUw3dvjPF63{-dtV~^(r3rQ%Tu}@!F6g?!Y%V*x}`m)K}ouzXk+MAwh<-pR}SPpGiLk zpK!N*GOEo0+nOecg^4e#=BTuU!~a+}mDYT(HJ3^KC$*uo*%(#pjm4@wb27^rzx7(S zmi;z3l{*DIzVh<&O$>%Be^3E9!=$A_y=ATfI^oXax*5JF5br}CGTX!D2oYaq_YIQR z)wv#VIm-X;rZi)=-!Uqtf*-KXT{J1(xl0|;ICp)6S3{r=DZ>|0s!dT@*N+Lurdzs4K277u|DzoRkKce(n%maDymiz~f`)PQh{)c4DqSD>a$$Y-je zrDan?ndY?f5hgicb~tzJ<9|1TlUrHGrE$lodoGAi$YR>fE&}S0Z1%nw*?$Y?MMgkYLdA?<;#ZSOoSOP{oa{ z_z*w?6JUICo3!Kc;HoWSiV0it8Z>j4>BpvZ>oZ9mDh?r?)K&D*MY122#^uT zz53@K*-MbZtc0F6q(MbyV{e)wQ@=vlX@9p9MIa|OxJZ2l>8t(?Ck`{nZ^KClbZG$w z^5x60+{L9)Z*db+g!jJ8uh@E4?B-j|XJ2W<8Kcu>M~XU>2U{Zxi7OswQq zYgU!4)L-8ZmSTCG_-0H{Do<}-Wm3G^($FAjg;a0`r;ujNE2yKdtr^+;041$sG-hUI zz56GnaG)v?q zFC_(Bd?%sTbdqfM4$^HyPStn<>DhPz5>~|IAA@Eu`F7794I@`gX(02F*cLOq15Aum zT=PSH1%!zShy(j`*aTDE;W6&bjlwopRim3W`fNtt!Xt!jPZhdDKtaA)T|Mn~a*qno z2w2mvb(q0`ZQeT*vslirMuW%aoaziZ^03$K{HcMOlE;RAl`3Gl$pJ(si zcZGnH%KN$(W-69YOTp#_R2wEESJE>Y7!_}Vz?#zjT^V5S3T_EH5n>V&I@m_5LCKCE zhi-k((WB*_5>N|-dTzz9`z@ZXCewzP>j*UG!xP{Y~ej!7N0sn|Mt?c%Qr6b zR?{{&`$W0<`7v8OghK7!-EHghepijWgP9jPT=Kq{&znyWzf4JNHV?z(z#dk-)=nd> zi@0O*3wYZ&XsLKvp|>EMz#G?OkQFNtvaAX29EYo>hT)tLRHttz7w+w*?QJ#~svkcH z&*9(oCi5-w!OVq()N1Vx8|hm=u=lnT}>0b&5M5zH+yeb+3J_%?j$ zSt+3@VU{uzG6hOtkg1#ufXlkNHBF=tVNHH}F`tBCd}HGVANtJH6kY?zKN01Fp92F6 z**(UlW47t1fx&RWlWQF_UqGpoAw11^`X@k0fc~RD?Rj-#YW=4wEop4ohnyO@JBTMg z)rm)Y1_Jo4a#y>$G=!v4%1`O?rEO$!d*?p{agpj`9s7K(e+V=dq#e-7t2 zhU2vlp^5Ly<7VG$)zip3e;zn2=`4w+c6KrEV#CyvTCNqYwKJkn0`VirFL|EDb#m^B zlckTP*gn4qi>dDJlP0$+Z{3Cd9Z@5e)|m`9B4wl3x`>GO!7+$eRTT*2ltiSYmo16j zMaNQrA5gcjxNk5$J2)u#=Zi^@FVc%SRqk^`!XK^8cNv9Y@O zl8Hk&g2Y5;&lbKMS^jnpV>5rHcvHs^Bv2-{{_%oW*{x<9<7F0nc-(qm=K3uuQv@&; zL=z0l$;q`>QmK6Mmf^59iv{_lhx?~HfqjbQhXiPjh#?R0N?U|5++}VHGT%wbXH%G6 zmn=WCy~zOGR+Wx_tqm{P5!1eJZD2xaFtd;;P7%_2x3JP6t3GgTe0QhPIPY5KbJ6Hl zq*Ulk`}&YTsS!vK(D~P##&dBYhY3w*sJH7a^Y5(o09HFDTj7EyH)oJ|r2bTZ)PIi< zCw%?|XAg)a8TW1Vj8<7&%wN2;|6Zn^BJagb=<}yfpL~7C!f818oq_T}QXS6!-IDVgW|q{ab%E3{FdIcM%t^sH`#@YRx`Vg-bmI}2 zkhcd(aXy{eK{EBPm-n4gJmQqDLxbq%`HLNTS<3sT99>w5m9NZ~wuN3b0J!Q`5ZbbX z!}D=RiV?&JdmAIJt#^BMW;?%~aNAyK;Cev$%SAp(ac9gwNaREAZr%iyPfZ>gDfpSP zQOD!rh`)an4fP%NpgNEuR7eDG8^mRjt(<(qZDo!NK6SdXjBu|ea%aE>QYi@zyVXlx zPX9E`1ciX3RlR7-GDPBYN)q8;4=n$gs$R8-<_Z zf--^g89_IP#(mBux6<)xmc60$AT1h*mGnP)GW4l6*cr|s&34@BTyN!MQlZ;a{jjuz z-qzMWW*J9Tu}fxVONvj(?axbdIRZzIY;+{pDh0%chbu_2IwUauyjx4@jP(a#(1J)R)G884K<|$RrfR z93%P^%0wn}rr>Fw_)fvj*QYv~*30H%QF^5doFqi6uSs@KA%D5YU* zdsOIcr($$Vb&m;kwpLY3)*Lm_pn%yZPBQ1W|5*^8E)xDg1%S9Nmt2__FDziTtCBj^ zo9C_lY?rxB#RmmT9yxIO&N!%jr!RgHoPJPz+cfBbRB|XM`ynOQ@R#uk>6UZdoVRZE z>qkq(8uVoQDhU0v?#RQSPH31ao^Se1cKXu%RqrZjVZC@7jw0Sr$0wvh&88itm+M^~ z%eW`>`p?64Osd7}eH_{JqA$PgrKdz}PmW1g&RO`*+`B=X`OpcjGT#x{Hcckd9R77n zs3dXa01FU``6t*B#9gYoelq&wAPnEHUEoaeYNeZ=`Tg13i+}48I11R~UESUPIAzjK z$o2!2llf7*gi+gi-I5?Cr+t{(F}= z6T91NAiB%_Nc-1&5_9P0{<#-2Fcjk$>3CNnC?wzYluslP($dkfyM?60MZx@zbOkAznYq>wfy_O0y@;~QBXlfPS&Y779-Ak`b~y3emrFn|I813UH3P5sj8dl(iiCV zeY7p&xH4Q_kL0P&+my0E!-|Ked&v(rduP0BTxbV?gSVv5q|9u<$<)j}Q?hq_s~zGQQbA-zX8Ifz^xIRj z^oF+2LbI8h zS>n%g3-}^NiKF+r)xZ)2AxD5pCkTd1p;eZQ?2P?4QM&~#F-6iniK|;L0NfaG|KNt; z=Yv5Hmg2n`mZDa=i&b@Z_DXSC`jaTg|xpJk9)voyaT!}AO`oxpxuZ90s{8E zgy=*)Ns>y=+)p>@SYNQcnZ*YJE<;HoE$Jy!|D4CO*?M43F@5x2yo`-&m28^BrvE|_ z+PC#?3cWzd;w~nPD}WyENh$fGHxD+)OS%QiC`>uoilBZn`L#>WY~gmDgQ(gQ;EJY{i^E=o;hfl>{0IX?y2s~_Vs>e{b*8 zr*QbgBm7Ss#V$|D8zUdJ&qJ{S1G~>MWM939rL9hq+INk_k<`Q^oq#tUilI$$>^uTk4zOVb=a}>PS z{_S3MZGg9?W&{KSbl8~cXY_jyFGO8gv1Pq7{FZu#n)S&)E0nTmtXQ##JQpr8c6Xt(Yv2J=bCqj3M_~w2Xo{m$I7n z&EVrFPP~14Y)ui#j}DHgH0_#{N@|UbnN;^Eg3I*u^s$cvfaD5O&&!f&9C8Ee9B}r^ zov8=U(EC>Psc8Sb#T2nr`yNtN>0!eELAvttO0!P7jKR%qutKu zdkS892e$~9DZ+TEl!a+-6}D%{lUkMdguY4fE&aM9EKD|PR%K--E2l(l|Ki6`8H!15 zOBLK$^n1jW4jRCIf;`wX!Ub+5n>EYpeF^->&Z7wlNp5ar!^1uj3_u`=0pC%0_MgzI z@thv}(z9nYq93CkLJ+sLI%U=(z7xG=k=Vv#K0dsI@nTZF4QvM=rOT1497GJ#ODeHV z=ol10znHbDt)Flcik6;Qvs(}WYmcL(rWQ7sev!=CPYgmz4E13w(upH{P5=1E#zi2P zQB?@#?m03GNnxsbNa6N3mcqsM^*M~X?N}PrDQz}E$P+f-x2K()MIo8YQ#EEMr}Uq) z;K6P!WgSKKywR-9`dyF_n3*?pB&>YCa@{0v>~o}O&~nE4fA$svy{zLvw*!tb7g~2# z)2(^%R{OUbksW7cTtl}$m>q)Z!c8PE#xZaM7k1^`3E>()Cdem7Sd-;zu=xZz00@A; z5ZV?)V4m!uBtloO#ozJ!r)t>P2wkDk39?5aKQn-<2E?oe)3w9w=ZIk+n2}2?4&&SW z2y4V{4pD)|X*~o!KNi~2vA9maZl%RKHa>30038>>WTT$!iC6gQ7RovUePk3AYKVyz zqV}ln-aWK-?4MXe?-yh+UvGIitan+1l_tR&eCTcL_5Q?4ePyyn$xev%u6d6US1)Q$ zalzp-oYR?SMAILSfC&v1}Pv&NFyk$w4{=XbV_%)f~bHfh)4|S&>`InsDN~L4Bg!@#Q)q;|3CIV z`z+5c%$<9`INv$%`<`>^ZhlHm*Xm2|V1>#-fIJk;=TXgkIP4r0)Qqpd$|t4XQJT3z z!~67G!{Bx_tw+C*VWR+eK2Url&_VbN+*8!;YsKlM^SSCM{HCC82dUu+I?mfDEC-me zE5ZH!yPrQZCg@Z1e<{H&NV95GIo^O#_;W>1Pj#kgnVIFZGnGsZRg6ZOmRVw345Qpi z0bQ|~5WE^xBe;1N`RjgfSSiSW;_S;z(+ej|xS^iA6gm(=0Gi)JgGW9F2CR64TE<|1 zhE9IL9kkEk5SOy-K~R+xb%l#CZmzgX=fJ2Vxw58)GM`soo>y?A`(GaOKyp@R#TbQx zQn()wM^9eT4lyB-#na!*5|BRpDVj@8Hk8ppe}@$?yiy<1y~inyu-=F%(gmHl(r6B! zbVf3-PEAvTpKPg}+$S(OHYOj+$-u+o+>-?gf>Z)zl~9tnyAlfC05+X1q?mIE!m;1h z@+0JEQ=K`}i>}K}*U{ygAfjuZxg(E69e*yaBcPIjSb&y)jTTl%L3j65h<2DsrgCAv z`NM}bV>Q|1*5FO}0%W>ij!bQN9AZD-ip9JR2;jYV>Rp{JzZMLklT%?n0@bvO0e}IG z6wUhbs_}8JW<-{1!?kPQ;U&^k^HU{7|9mq{y3$vxQK&1X`VZ=xG-M%gyE^Ld@}#D6 ziR>;#{QK`ndppH5-Pr!_OYjj-id*ot@8SH`M{)w73!p{}{BM)t{=(JDN;GHaYAu)p z+XYSEbx5e$nAbp%7X<~;fmLLHeqUi;@C%&+g|N_2Ry(o`e%q<09p20yGbkg`o1|2Q zmX2yOIoFRgD*}}Pa{j!B^QWi+&bpIykaL=kc-8G<+S)J3uJZ8o8jr)d*^hI*`{(xX zMyo9_)aU5?FP}Yo-HvQ=dvEg`^wIumKOe9@cN_dB%)YbH{%*B^gT-h(-k6uX1xxZ0 zJT1_X;+-L7W>6_YZPwDy@EGMPz}CdnhY`iw)ErZ3);k zWeF+jA1?e37B=&_52Qc2eugd|lk_R7=DQQ&v%o)Yt8HTC0lm|LODnwTGEc{jCorjwK;{g&ec4ba58d)Duul zuQa>jd6hwSQis(#@nMs7RW72rDWdR8V&c7-D}(2#sP=wdJ7==qw?R2Q{R+Uu{y0gb z-|f$%Ey&nAo(3aH2+(rfxHaM%%cOKf^4V0G@wl+SdFq*>?Xfpn6QpCUZogsX?n~an z8Ct*I$ieXtR4*1?Y=w}i@xK|A^=dE}C|b`K*}p?)M|NVaJ981@vUKRNOd*Hj&)2W} zTtt*AQPkFEMi9pz{LNkWI}x!u&#Tbq;#N?(g>R8XH}zStB{QE?oCC7lxBc$*rB-Pr z|Eh>!maYQD-EYK}`g#|2Jlx`0@x;o3#WJ+*)Wu zm2nSobBCWC>%_rQ3;FBFZ{S8g2C?e;Un1ZWTKvO z#$nia4T8ZGheK?#XwX?mn^_v-NK*PIJ~45uN#r&HYU`u7M@9{@^>@~gBuME`f@unj zU+{aRd=FUyDbTqNJU8%N+1e1_l@+q2G!Wk;qOPHVLhQ$ndwgureX37Qr!@5AmvoiY zGuP7PxxdA?&bjQQ+nonpmCeT=3Mq^=+k<~g=cYO6tY@^K77apkOpe2 zwW9I!b_Vc*NVEc@GIMYn3AiJ2M9}N4G#If{e7QyAkV*jjB1)B>zKZbgEtmhC&rHC% zY*=F4G-l2#QgWLN2`Tt!rp{aBkD$fK> zf|`z7h9$J`tMY%(k2u(nBo6lPPOiG!+SJ2pZU7nqt%3k_@FZ-3A)dB`rhqqZpdnFB zx=w7DA+&6D<~;0cWWxRgI+z=Y#y)h1Te|PoFwDXU_wBp*WWCe98GQPI;C(hbg6L_b zln$VLA<+amCsEoNo2rcP{ga((eV-y1^v+}g*Rm?3k4CGava_r^W+wK-5h(QcReqr% zJb!n&8hk}DXNLi9{ww8}=xE1@dK^fVeqlJ}O2}f6LyYaI;|#pjpk(v&JB1IGo?Fxe z2Jo1559c6(0$t4gG=7im@jyt-Let>Q=I?KjRh?`!hx)d@zS0mZWkPlv5E-PjgO)?( zk-sRgp}Y8yMHmoZ+9lJzytJ3#@0xOkLQ}P_*!%Mf0brSyygqz`qdVWs6d>%(~)+@TovO)joSGl-K( z&>sMfTJ??V*ME*%0~T8#lhAeoe+VO9#vR>EWhm8j>&ATsyF*$n(bd=v`g)XrEc$IQ z|Lc#D9`45Xy|>XJ@x9n|jePU9sU#rHk`UO8;5owEST-AR9e){gkPiJMxsM`<;V=;i ziTkiO(?D^)ji%}&M>;@>VBB`5cc6A$j{AT7vaHVZz2)*3&)~RsZQ%A0`IN7Nv4GtI zSbj;xbJZDJ{A<)BYdJd_zm|anP#e=mrA8@YNw4r6|C0}&ycYJ_> zd=xJKCU4@h4GJ_m9;E2tNW)Q~=(CasLmhY)0~J!BM^+gH+s`>dH`k9zNtW?w)VtTs zngt5j03s6ZIz3KaJ;bOFk;29ughwE~d}k;J1`=Ewa2j8~Bn*Ilcyk~#bI|-0?jj6h zy*@1r=-lU^&lhzTJ&`B)b$QZP8leyc`0p22aq*MG8*iPXIM;h;_~}6nQvi3kO zx3*RW#)^)v0(=rH{pZi009h#NiOI*m{?Zj>jlTBv1qlQ)|9K* zE%YO4+;Vjriz4<5nlEO}9TxYW!6J8dQ{8Jl^mWZ&9^F(44mJSp6}0ARGe?i?j$0SH zEdn6#J&9)~m(IgCv9}m;$?jX?*(l1stt)nL{ST=(rxaw8}s_ zbVW-|G~#lZ=P}L{zZHNXogm&QP&#+KXpP=m|a4{LzAu1|>T)YT)TjJrd9(R}(h*2Lvk+0HK zNCtx_)Iu3k+g zrHDtPkqRS0Z7v%oDJ3PY-(UHI+*631y-7<*S}L92+i`7*gYKTXdeP_&cc}i*;Q=5r z8hvvCIqxaYA%t9mw?y0-F-S2_WR!F$2WOt{2Q-0CFWpdQkB7h7q80bq00tRAfPq0L zC@QILUIKjdM&qw%LH_MYFTs{EO5^)5P9pf@$7E&ZT=n_Ee;DL;*EjkO$i<+5wtnu= zc)dY(rJ}x0nL{Dm-gR@})!moJJL?zuE>Kd=&DPCVz>P$oeLF5vE^Tsr_xE<=fE!oZi0^xHa#mh;^1wey)|&Znzee6g&`Z*mKs#2M z+0D%jMY@%1*3$}2X@74?(SbD0LV6C4GNlAl%~TP$om4V0^xM_vY{(~nU82v{=ksUb z9O%s{l!#gC$u?Y^ZhJ)zX$HnY(Aaw&`bBZ;L)%5n{!R*6)`@fbc573aFCj%ZnAq&_@J*8w>XiamT`iZ_=1@2bSoNOpPQT9S07T; z8RX+H`9Ee=|B={{4Bi(kGMh?vQ%ojkROyX)eh+eQ~)%`;sY8Bne$R<|RW z{iD?Q&kwxFZx8lg0u*+NgamroU*Z^%fU<3MxX&^d=#|hI3{*jNnRmEFO2wm`_33xO#HHkQ{P2D)^uH#;4u(=>4gy`a+J7r^qQkzfNxt{D}}3ox-;^^+o|!6)$erNcZ_kd_len~mWfG81M9}2 zM5K0!;~O%lL0iVb!6Ei2eV+jtuJS%`{z@d{T7awTH3l;QxxSy(5HeCTwBk7ro7{BH z+$$<)hqf`f%t>uo^YD)ze15+fVe0;wjhd+WU;BO?xj4`ly&z1WJb ztE{QRpP&^L6>7UXU7Bsq@N`tX?v|F0Z(uxc($PI#8oGPo!iCu`4@1t-);4+bft^uV zUjKrUI}8kl%Oi02j~_eR;)T?em9w5yP#tV~#1+|@s&$Frf#`)FV2g!Ja-Cr{$$<+$ z08w$8YKmCQk`(M}&x40rTBs1U=Ggl=ZM6V5Hse?8udxO4P#WxrL4z|Wz)sLX-GTM* zr!@v0pC#4kf!MfVZxiccg;q_`Dsg=HM+jLqM&S%qN{~Azw!6E^4l5~LtC)yx?x;IVs8J8+ z!pL=qVBff1T%6Cxwod14y!`HS8iK9mh=_>sI<+tHWlBnBxxH{oLt5DGu4~4Ye6(yh zDE@NzT(_1k5bmZIr&qVhi|8M8j#llh!U4wJxCNpP&@8B_ zsTt~zvuSMf5Ym=h^z{!HZ|luN=D7JbH+$axTR+MeEuqazh%)4_ zZ&tRsshy{x5jN{45qs@Vg@N3@4N0s;_fjd@$V9m1NfMIW5WAW77U2OkEiEkt1wEcj|;;x3X+?xymRS&Lh(}EFB z-tL4QzPGbps4M4-Hrd}j1_CLu*G{Vw_ar6j##e@hqPb1Ab#kU2xHN!p{rKs!%}R<8 zP^rz3A1Cm85?u2~3jjx%P$uBrGK9JlZ+MIwic-2J z;n!W__dOr1CygKpyKrgg}y#L-M#0}qkS7tE1R3eBg@dJxkqOX>wz>6 zA1Kxt9;}o@rBAm{hxrCvzVm!81H%c@kNHomiy)RgL8qEA81eCo$pBKq)zhsh-b`BHqGZLs?9F_wJGgIm{sv{>GSCf@lkJbg)yLwkZ8QsunJDA+!BV~-yzAU(S6}P3#LPD~HV(q9lj#D)!HqQJ zHi}xH;xZa?+Z;G|=@OIIqq5xraKejQ1+QEw-`DL-H59O$addhiLk~{HS)_AAa&mIH zs7Iluc0RizOMnoM`QFYVj1#L?k=gc&2jTJKcS^^yo5)YlwYHILOqY#}1bP#zoupGv z?#?w0>5+F^@9N zQu?+4;`q*pfv->F$gbW%udhu9^h%zjPD#$v+*L&@_UMdFP6}uV*ig1&O$s62eqW;5pP(~=VUsr9Jven{`hQ@t9`&DFHZBR` zc7(mftXd?;i0L4E*lpQX2O7eYeKX1JxSUk@WAKZFj31|$70Jet8g&~2l zxtRIRw1MxZCBf4_D6~oF2}o4768G7^#`NF<4ULINmh*bN)oA2J9y9P;OKaW7mWG2w zcE7T)&gX=eA!lc^EyCCYtEcf$`Xfgt3Y5&XwJTDL$hirOzXO!x5X;YZTWtvFO5bbw zZ-CrX@e-4ekO0RD^k#uHo~|+*c_I$?UFvmX0kiJru&$TKNeZ?;$|YP7Gwa)E+g_dY zCIg#I>%P^JXD)Jr4hoi~Bqz`5pE$9+0f|bP{E*=R^|`eRkHQl$*euF%VULAlZs{t)eX>uru1)p3$N<=en z4i&aIA^`=BoF+mEf%LN;DxaN`l<=Dpu^e23g#39d#%J&6E0Vq_w~h7XQN#9r!KF5N z7l#EwC^6@;UIim0nmy#|bBBNz%Kno3LQe_?$kx9L#lZrRAU{Q!86RLhR{P!+ zTnXf+*|KSa0xx54$Byc@!B-zV`Tcv@P?pZk%}LU_%>}+3tquU#bltcw_C6BIxZ}(> z6CYj^7Z+z22E}CJX!QYCs0;v#50jL&v!X2riYzUQ=T+&v6qDwffGr8*F`t2qH#soG1>Me32k{Sav>#Tz&Fnn>P5}H6Q9d7AdWsIDUem#`UiE#fJ`m82}BNC z2&|P~sE7v|jj~s_nUGod#EO9fthhTnt2H7-En2a%Q{YfA7(ERF9=KASQd$xX>pw%! zh|giythcca<+XZQb?lgtyT##_G)!I>Idp&AsK%|&3h3AB;buXPQC?mScGhigJq$wB zlXQ@%Z74hb{j^AXidvIzMnjW`r3Z(3Zycm7j8zg7fU$B}pW$=aAO@USU;n~MZ$ziR zqHL0D(iqVL6~aO;t1+IZ@aRc#GsS5@qVvJQ#!3BB=k=L^;t;Z{-0NEMH-`otpJ$a_9 zYwr+}6qZdVeq1(k7xH;0W#iv|{`}dK;2kIu8iKY14)r2(3LQx5k+0Yj$lu@kPv)UwL=rKI{tY|lN6Tn7?#ldu!P5X^} z6u(xs{XA!>a7yajq9ai78&4ta=U};(CB(uOS#4pb01C@EdE&$yKR>REr{q|I0s|x1 z5K+MM;{JYDIGZC{tsdhxm~I=&y$!G&cAf;LCBuRL_pXE=qBe9;zPk2ce}(^6vj`(& zIjcF`Bi+6eQk~MuY&S9tx)*iNoEe6H)MlYlB3#bPA6Be`#ON?1J7vDvd=`CUNy?er zxIHhjGiROxK=DN46$d|mtGgb^xP@_MZYioW;CIK_&EA_1M96)7*kTUecJN;!D7j4t z)tqkty;bf3#gsq+$P0p4tH-|N55eDF$1@VYpH|dna^1?6f7)pwJdcuHcilCINM_J)bFo`AEHO0a2Z{Qz+)_- z+9}F*o95_9ZcA8ZtQz)U+o7cVLhpLv-aq%f`8YXcT0bM7m`Bc-aEZ8{uTNign5ZzG zC#{8(2C<*F@fdeBDCNq;eIURanAa`Uj+)={q5a<%Lg7+%^VooZtMv2}D@tJVvkRH8 zUR8dpX=j)Ty);x{p+Kh2iIb;Jbr-Ggfut3Bb!5`^5^5%!-AR! z6KDieHp?&z!0@ZTy#=K#G9dnuJ)Tyb#Qq*V`5KUjc+}U|LaaQ7) z9L9ZM1_ki+pR4%?RFv>bL4m6RPXZt@AjHKnGw723>mhZ}ItNYKs+Vhl>MpX2-Lr%F zhg2VPY}qwXf6YmDW?;3|)rG-x2BS$qWxwc-D}NzG!CJJYQ`v^makLxL&Nm<&GABML z5WXJfmJD)ONrbNIc_1Tm9shTH zsiZwc?R=1~g()61ghC~!h3^!X^xH01%$PV-9~-jk*cG`%(0m06mUt)#A>ElD#fE@F zF)&Q~0D9jowy$|-3bY8;1EUGDn?atNH?QBk`DGA^p#EG9Apm_rme4Z|tQuWN-H{`Y zuneK#(m;yl=3uF0Z~g(!9ssk1&FQxBS5*5gWp1-9+K{vct=0CoMt`&?*NZbXtBS@u}S?YQLEc4n^0~ z1a@j4mFVrjf?fWAhk(`=ICgEaG0eCxFU@&jxr3oZPr7^&PlrD zl!Nq-$a?J@t(KRK*fP6&_ru2+c-iK5n8Ej+uuoyw+c;5j3|`P+1FFnx*TB~e1wsZ6 zJ-1!Q!a$0qD`#xW=W|pk%Am0bK(K?~mr+Ub_wTIlSU5TTpix1T4-I8VMC!6?GCyZH zD=`JzEI6y?`6M93MUSmitTz`#=HlE!WZtW)hJpH_c+q{L zO`byP9K!215I`vUHy33?q0JrH;4K>g-keLNy7u;H#C3rWg+4Q9T{{{q%tV~h^ap+qKx&OF+8|fPeJmX3K z4rsN%0a-f!G6p=ncPw_l$ZWvCn)}BmBGnkjpvuy_I)nOxF1#fD&sc2H`j4E*7TGTl zV9!_@50R9j{yX!n-Rzb0rZ~ z>Vk2E01GTjP++@x?-bOmV`l<)^E%Si+ml`nvHGD9f25l&L5eUGbB7g$2sextpwM%! zkPE3mI;i;By-l&j}U=1|6c7EOe00iyYICk|!0Tc=^Yl z*D6OlLnqT>2g4*K&AWDX>&YrqfL~EkBz)uts^TD^6i1qpwSRDD|0yxlpuIYJ`A+ob zqr4+krTG&-+f&jQBX- zDZj+nR9)GzK3s;~#JLaTt6?pf7eTUE!ntNgO^_H3Q0<{hjs&_&ygePQ2zotjA_~72ckU1>n{;e-pka~>+9<(mzHd- ztem!%o7gSg@ex#Fc5~Ys9a)&=|LJk|Y#`|Vxb*(v6%rEC!Y5!aF@svM`BJD1 z9HB~PpNP8X%W+yzhL`_7K@(c`wAzvLqs7s1I#eW=j`XRY$nV|C=pLaM?x=Y0N* zgE}-1wSz)KJ2G^tc?T5|yW6VbdtrEGWm%H`vk{tV#y7GJyec9kP}YQOg5}X_CMG5TFKdz6#iL_q^^M(OpK+)_tYj(wzi}a`4R^!I_4YjGHC5H=x{Lgx#2Hv6TM5b~D5A@h*IHS5 z10M6*HE|XYridO>LBB0Tp>kKkpxa}Fpwrz-SUQC+n~|^m{FEdQ1w91&QDb91r7j-N zcek9h2+uGv83UsA6o;ge5TL(%(njCT%gci^mU#hM9uu8D-GwJqLROafZd(qjU+`TV zkapgf3(d}c`3kRuM?MD^^Ho#Rl=k*DUkY(s>U&TmfQy|SkVWKI_`6C2@QJ_W>({TF z5v)n!47HGRx+OLsFo>3!z1V@hW^hoVGV;?Wl~3$Z)8icq)Q5p|#?%KvMJ+9xwkWZ= zZmaIL>=(JYFqg>f9dBHk;U`dtsnO$9v0uv0%j4nZ20%Dn71W8IZyD+6_=JU9TC?7+ za9Ub6C95>3%o$r)bf!KQvP0U)|GA=xZX3unZ$BF7NZ~zqHjqK?a!emy@};c>_OA$1 z5aptT)1=VF#V(GH1rz6x4a!VMSLkdfEiQg^T>s^9yB5`}f9?i9-^Q#0Li}T}lz~}= zbGo}l`u8j*;|)l&9_M4|jRbovGZ<3SAeuvtRMGoul@yCxJL!s+P{z$;e;=nmGk@ZL zHx<1*J$=c_YSYecGd0yrN9RDhw3mvCYML2&5l=O0*y(IA40QJ(TN}AANH=g0DySpQ zoPt-e!!yjbLFSAH`&k;AAQUQY7)cxZeR-Y)e#yHn;UGDsm{xf1V9nSdN_emcpJy_} zT@LF)y46!hMn(p?uNYAUJ%SR8fBP2en^x$;+gUwX-CA30QhU(rM)RGmp0UF#JuC3`XJ zpcpxFRNQ&pBx6tGXxJwd%5A2eLo0zXMZ>}3$Bzqpp-9|uZUWP-!Nf&KmbX-uLf2oOZyS4h`1p&qNNiHm(x3)v50Xu2 zB&ON#M(0&p>c0YN->{36l*-9^vAPP-VBWWycw#$x2sE@s3qG_0M$?3 zoOrF;O`@cYeQB*h-D07rQPFwP{Z^{`z^gin43FjZzzeIGC;=^^GZde+ds0{G`1}1& zS+=V8kfX33w--lGmnkR>X4Td^Ads3Qal(Fn?%-fZ z2%9qc1U)^ykaLcmm6ftKeMsMF>RxfYZvW3fGIl}HIw8S+)Aq#l*(;tqX#-z1i85`P z473QDN_|6`e7ufZ_GAt}G?{kTs;{e4GKC%O8Jh`}XP<%k74q#NngO+v6B-!V&CM=V za7Yzi+~M!s+Q-Sa_t~_>uH!bN_?_2IuOE(UqTk~-5BRJ`zI}bFzW1{i{^P`n!qxGR zMU&NdPy2iKu|n4Ul0?hZQFZaI8?u=qL+Zlj-MhO9s-#?&P|J2(#0K z@bQIY-iFtKJ+V-umu1)#2|{!MK0c-lu)>hH50v&RnEgEDAl;qpvkbAF>yCB9O(dU} zyk9B6*JCV<#2~+~=vZHW*{$&q?p%|aFrKu8-0+1y2QeKTjLRmEdhxYr?(qBrCf2~f zb9+rFldkx<^mD=8agt0P`?*r;8Q7d6@X&KjOIu={SnLp~HRBO@s&~J4>PP0IAn^f} z!*LQyBNl){6UpRICsQ?hQXk*e_hZ{ zF8V~cD=0*zoTQtcD{!Ru0}8bVL$!h#$g&Zy_zN?dK#D^NZD*NYXtcQI6F^dOe#pi# zR+NCaNHOljyx*RNVrp7Rm~VN!0#}noj9b=-qTst_~XYH;~?_VqIH%>QLtfG zzb!&BqTbwvse$zDj%$VT3T9|Rq+)^+AT(_+^VW1Y6*9BbF*lS~* z`moiy{P4VV+%&F|e1g2S=k`7WIa??$%d|RR?-7yJdhhr#Ov4$m^I>`du5&|GtfpbS z>w)w==|0D$^|{SV-T6kJB~?}R+V^C5NX3~3#mjZ)I%vE&-Z$A8#b@8{)pMIdHCg$= zwo>Y2j11B8w2w~uW6VufA#+^1td840^q?jmS8P*EaNTR^L{Y5<%=H$};|kjh<)Uyk zgi34RTY9i2>;)W@=~m2t4X>$r^Vf@g#fCR+lAqGl*Q#3^UhbT(!z{r^#UL>#(PpXo`$ahC^O=DuVAz;hrx-%*O;>UR|3h_T5aH=Z^Ydws_8okdTq zxo+#;ed!4)Np0n+8+8#84vSbC3R)MQA=|!A>Xo{U1uUH`L7wSA=1*|hM8%PzmuCx+ zynjDQae85)5pk{+iseuxCLMtk8U~h@DZ1Z3e#}Xbzdb*fT6Y;3{6Ckc^<;C*?fG8r z+qYQ^PIC+epS$3;`O}KlIJL2*BI!ZgM99k{ycUmxM25ODHiz6x2`NhSYF4&e&H8Ai z^UqVhP|>MNWYsAVKInWV@y^9#1OPG%oN6B+>!Y%j<>i5E{EGc5CnRJ!NVnCU@rkakVyl1!*72)!HI3No%_`Rd z>xMvfL)VCp5srHj&)cdZ#a{QU?lUy3?B&`!WLWHdkuI{I>By6gyIOp~xdz;1SV30H znI7g^;UYsJC{(EvE($*zAF6JGo7eeq--d`F(N~6ENuLmEYKz5ySOBc_z?TPcE}I*w z&%TdVA9dc`9~%BHX)<@nTk|{%H90j(oqfnH&Y!ov#<6@i-y$vdIlE{bkGTc|E5F?o zo7cr|heWb(i*q%JQ^of?33ZA&M~m4JP*<>_F8kwwqU&ut`wGO53?r%YCY$fIt&dtb zCkEby`(C9(>rPd}`w%-!ZM zwZRQ&rQ!|qAaW&PoJ1JhM42aLci9WR4Bnj=aPaB*eoa&9Hn+fZl(UrYmP@AC>n#^6 z4OF^9wIC(Dcw>~j|WJp4ua4kgd%1cX%E3!kj(q<7_w8&cRaF)4%ZGBBJtqT$ zl-RUyE}xfWg3g1TKYkR*hR3THP(;f@F>BLK_K>QodYJ~$CLB=H^kurN`mP7urU}@4 z{y9gWUoFZ*V+O~w!nkYM791@)9W{WE4%QPsEwvq?th_2$ik zsK}$?*V&oZ zI`XvkDBZpNA43}A*oT?lec2yVdY%`X<6Cm&a-NK2ZEf_SA)yT6xCO@#6GX5BL3QI| zuR&gd00!PvVM&4D|$6G82-F(U6Vtk&p7vHie(bCY`C; z&zI67A~gL6Z?Lm3c4rb;TFOK0=RZi)T=u=1^!g13^8Rw!;StpYdo5#rHg@(5g*{%Z z+Zl3q4Wdlz8Xa)=&}Eh#%%6^7WToUjZhVlImM11!W8b>q$RwJaWT3LAKcJevElV`q zQIeajNk={1@ys)4iLWHToi6zO#HLAi=S|!Gq9XsC*Z#h2qpUK12iVzQ?P4-9Hk*f; z;xQpNz25WHqGgYCnQJn6LABKWQcI0Dua3k1pM{|xoN5iR=N~`Q?kV{>`Xc0r#USYgu`%H~tpdGt z+gn0Hvg*6J`tw8k-#ad<=sxa{BKi;-{CLVyUEQSO2zPBm!w2%m?EN|S25I&eK8y;3 z%>>ir|F(>!L4|ZmKv|XpN_3q-!kfsrxVW-1cYI{l+1VK%AAjZy`@kbmWJG@%8CmG- zRaFxP)cR4u^W?mSB5BR!P=Z%ts(nnwC z7yY-7x-V~z(7SR<5w*kzZ*Dn=FexV`BrvclD$=N{e{#%gD9I{(S^7-V)l5(MUI+6H z+@|whd`IimB}LJFdyj3o2;sBmDCWnmuozz-KmS%8oP>M}pNaADagkzJu_N2UE{%=p z`W~#u`0BLK_qPTFk}XFzV=YiF8lN@3pcBk{%7lmAOQ4xr_`7$ca{4s@WJ>t}z_kf% zK44sNaVou@eFFn11QdvtI7(=5+$n>Kiu)88Xg~793Dz@93bTnBUT^$svPCnmUeyJ6 zw_zPLi_AR%u9fu22FC#d)2}5l(XvR{?B&`%PY6hi?hc zl&$S%J?ken_016jx$=Njd^b;a)q7qbx_<1ud6 ztW1HyvgqFRA&Z6c@4Js5n-E0wa#sg`Wh))~cgM+HUuZD+P0IC1h)AQmN zpz>>YJb74k%GR4i9HRKLTbjQv{rI5n<<-AE8TAoPf3B9x%`uRtkc)Ux5#w(&gxO2n zqJZ%<)OklCcA3A#@(Cselkw8cIOIP?Xt@Wwa=K1^<=?ks-@cSpG z&$@obO>c`Hgk~qu-(X1oY*?ixVusCqK*V9IyjY1zT^Ji^`1zA@U%P*ig#xrEC9cam zS2KDG4SjRAjQS_RxnyxSw{P3*kIF6ZoFA8C@3J2~6gPEMiO-=JZ}H1;6#*9}Vj>O)E^aK%5=-_fSt*Ra@bft8iV@<3^LWCKH6_OVQ>)M9$ZPMTP?Gh=qx zVa){9YlqvQ%-Jk&^b|d?*i#R=8lX9mHPWnZr$n6=kXUO6m@vs@#JIOnFc&0Tg}TzU2hMmMoc2RBB6*(;}m!OfP|A{SS#AX2<(83z>H2 zOgC4w_4Z21UOH^E-uU!UHguw#@fiEr1Bi$!z#%dFp6O^;?&SNt+r9#g_VSh9`^kV&8;gK+L(vqxfdzVXL`uH|KnCV$)P9L zXc(X~+h?j!k+u6&?CAGN*^d~#2c{Vtts@P0uLTQU10b5Qv_w#LkLS4O44Zbzou}Wt zxJ^499nUWpzxx+@1wc}V@UtpEz~M|;sHLvm7~lAC?OJah%D}Me9&vuLlTBByY51#C zJ@j7uyzdAJN;bsAzf1UsZOmr0spqS1csw#})Z};VKEN%CwCEn9mOS4b`}?Mptp9xP zIt4&76c&Si7x`9FpgIoJy3H$UjCCO-bu}{V`fA*^TtphH@lGUpkUo12@IWbEk3 z(KiP>H1R4M+e4z^Aq8=#$9;LSP|ztEpH%oo@%e)v#h+E zS-eT}s*#z{6gIdKDSqdbrLOBA<(o1^4U&X+Eop^K>iFMQE2^%0fz5dwul@CH6ou(7cn z0wnGSPnU69__ z#+;a-C`-TkI5v(D8h}lZ6WT{Aj>i8BR`5J>&Jcrmd&Dy;CB+obW&pjAmm`2GhpA|3 zUTi52<5 z8q;6o?(wtoA|N?-Q0fYBQ9wrt1Q|l=qyYLO6YB?E!PD=r!kQr9*EWokls9ep zHv0Xv4@=UUcV!G-iI3aVgI`$}eqWm&9q1pMsXIj0i=KdrGSP-jEA4%&?Mc3nL-5qX zB7QKBAeu#qp{X5_P%O~`xLHdaDg)3i>iv5KGxTp33WAIwJNrpFWjVR@l`yd3O`kbp z?9C}uDAgaUT)GvVjYfNi9f1S)&!xbrtxcklYx1S)RZY!l%RxU-%ZF0BAb%k$e0)_yUe0M1pN?DSN$#*ek21HdN)0 z>F9XgnR?A`rkj+yS3&FWDl7^Nqg;KvFW3ryeEL*Lo>2=|uC0I_b8~|%68?X(KpsPZ z=%~A>6AYk*v2haK>ww0G=NROSgwJbVa(3PkoAUND>j2iO+;nQLM^IdRcsi*S+tXi) zOLbm{h9y+^8T|7?&3B}wDYPUR{d00ae|t>dz##PV#gNPn*bWrzul#5RbYy|GhXr^G zhR*sPTS&^Cp#%j+C^Y^dFi;nsU|ZAiSV8fojl*KX?0MK~ZTov|sj11QE-CI#QqnVs zK)pohNg6;4Go^Ys<5=Nu`KIG3YKsN-^Y+;W>vi3=O^eoYau&FahW7LLbNgglmmLI{ zKpDdJN>(l^f({EnuW->qbXk%I34J2&yY;$t3j@;0kJ}`IUv+k>;x^f5n`6BHL#ZlA z$%eHLWIlV?gM_^d^4eeX@{%>WWU294;L${gd+}P6Ex^|o$~v&-DN-&G|5*^uZ~gpS zR>q7o^>sXi$~5wMm^X5=v-5It7;O$2aDv(&Jv}jVvY@;KVs&hOK$H3ne#ndvA`*&k z7HSfmftCRyBe5mW&N@py*976=J+mMPu(z_hndgT|{4*W!v*c}S+ighc1Fnh5&IdR^ zLHFG+TEzw?4S1yO;54w*Uh7KO0;d_vdM1ib)q6bq68~guPHA@0S@72NH~eUE5=K>&;5m`}YD}89t$*DvD@B8JU0M z;!ywH*UsRrv1;%*uQ8^zQ-Av&2lS;0wyaPcZ|X#!y2cYJl>HoE`T6r76=q08@+N~G zR1lv1`X*iqw!fh^!|p(_M+(^W2ah%T_rkc%mFEggyG9b^v)j*;{cjFDIUj!=O3Bh( zSoFA01ZsDs^&3ZOQDYu~|NhH9Jv-Z#q}2pxXZq-QR*q?RF|iWKmsRYM5J1Yxx?T7B z`ZZD4XlrKgiR+5U0||*Ll@w*xX>V|t4Ge-=!c{tD(!c4B#8S_r*4EafoQLDuC7qfg zfe$yP2RoB-8ZmE`poAXR#Z|dS zX@%9ObSEfPaT~FDtj=rSC|#24W_6;Lo-FD(!nS2f4~R#`X~fjtrwj`!9B4?NUD-o3N@w%gH*&z|8#& z6&QARPz&(a*>G63*i1If2o;Dw4il7eTboGK2B;Pued>+4eu>?KZNiAN2vq|8kXc&1 z0YwWTub@-oI!6LFjSwvE_SF!8?V$fh@_Cl?C-J%a)2FC=M-!sxQ!Q3<1)KuTqt zK&Ga$r|0qdUm~#8zkY2!*nsC2E%fsGV$kpk+SVp1UOpFeC8(p_70AH>B z3<4J`*l%Lr~zk#T!3T@)MZdw~Svcwj8}tbbYHgcw->! zAB??vXP%wUdW!wp%pm3q1vIhQ-1ey|Q5)69BC+REIrVY7d1|4}taA=cg3m)zR?^QS`0b7dXT|9?9Ig4$%2lq&EU zq@7iu_HPvS1~^F#UPs#JW^(IbA(^W?t0gNZb?Zi5!- ztJcaMl}ZLkzMcTG2#*tE8@AQ??--2T2@OhKEe94|a}6hdg9M{L`6@hL+?(v$t9Ly) zc3N-JgK5&li`iH;at3nD2QD3)V+x?*N$g5=3zwVkvzL;U9>{f=-S#y^>-Y}8lyu@U zx~b(Typ+1wve()h=RUgc_G-+*bi5-y$RS?{=kT}Y5^?E;s}9!FV*|3x@9R;3DYGc4 z%U>2LgsiX|Zh9a;fkGLc){=NnV{&GO8BwknA~5~Of5gOE*)ge^UvJHJq?86`f!PL6 zgOT<~J+Eo!z4c><)B~afxFpXkQcehbDKMe zH2#ZV1ee`62*ppX^$9!d*CVt>WT673u;9GM?&bwz3!ecQIl20%egUhUpIIut`;Us8 z6b_zxubA~`Nf5Psd1wvSd}k=fMHa`T_dcm&*6!oJB^C%Z2#;etve*rGDF#qH6xhGr9^D^ ze2-|>W}WMJgI{{36r99_nLF1x0~*mE%mkTYP;ua5A0-U z7GFPL1N@wW?a4@!$UeQB#`EloVQ~pW=?V6RO&l5db~;fZy}v>%l> zPSRbz{I(}7LpGdV^4;!Jb940Jav20uu$%Njg7%4(3Zlno_hE-cB095F^Ldl@n_1Bd zR3u+2L9cNVwPW4N3o3~y{%s8^Qw`(j*{&l3EpA-X)W-kE)mMN;wSHftUIjtI0s(=G ziUs)%%V4l0O>fV6Z=ch?{wAl=>F-ORvz`=I{*-tRmRjr*m*X#EXN8H(-S3N}_hi^DFD1)Xf$E8Zl+=CP9Ydzrcq_9lkc0QEn_9Cddigl|4%# z7cvpnoh5bA60(=u=*7d-F@V51}7_RIQ?kVPs(J zgVPhM8JH6nHJ6gy@3#`=eq+)788vPPGuTRZU8Cfn($qKh-C4%RLpwFYqqJ*LRlwG=ds*AbWGBAoFY>o2q@^c9zA;&La)oo0Hj;F%L=Z4qztU-)G-m z#5}REDEUts8%g^#=_?(d*%Eg5`FW5ezQn-5%EeV;Ie(R^>9}8Q@4EKEQ1;V3pR21R zdrP$l+$bW2<61{NC0W8Xkna$j-^xdp&2M>o_|0?6211 zFqIU+3mu)EO^V@1^VB$_g{v+m=Ba~mnqFArVyihO*0JR(@{;ksO~`4&N{V|s6Tma8 zGu51({zs7qOSq8zw+iY#RBY=V*a=NTgK?LE?LpOnD&T5Rn6YF+$xZ_5v^G*Mva7Kh zw!XF|jMJ-_jJ!?%qp6G}k%LT$Fi|)0_;Pqym|8;Q$dAGA=(}-MkxrFsq*e#p-3&Zz zMLqo@0WO>$rc46Bk4*oH%)Ra`ixT;D&{9XLJ#_#|6XOD<}=pvUa ze_ML@bBOF?W17txg8gmTjS|7eXi6X$R~rHRTI4)CmW%b&V<; z`;f&>ppdfCgi?78guwg+fU_wI?r}3vHlI_0nh~aVH8nM9 zXlQbMNTB8P27Q4J%!G=%L+I)^@;1zYK zh|0nO0|U$UmG5ky8H;s&_s-V`PeGwG_P&8CAm=aP2;{oMC^=c0&{uys=t4+|jmdZb zcUv?t!P=th%c%Da2Q#B$k2ygy1}vC2WMe;9-@U_-2IlqkqxF5sqNNs#b}ysuGw;MQ z6eVtq^NM}|HXeF^m1XuPQ<-Kw*7K46Y~12dz7U)6>ovx9{XV9UgzK)d29^ow=^AtW zP<^s(<^ll@iM}@>InK%gF*Vt^p3csv2$k^{DPu6|t`i?$A&`y$O9wK>(*eJ9fbU>Z z`M(Ke2V|2{RdoXcsv>3eFkH}Law#(9#1?gMnK0c99R;0$(?SjOJ~AnoRR?14-;Tt& z1Ldx;utu7O9H|Y0gMyi6eOIsCRhCcH)7>+k{BhDZ9@ui;n}CVCH!5W8zL!jPMQ}oB zqqA680ntaKNmZus%J?f*p?>%Q(B(mIkAC>ta}8E8%1D(7Ibd<0h%d7yDX=<8?Y!F- zp%#38?;yWTDP}{Q0ikSI)OP9zrmGhVzMk00BHc+nf&g`?GR}FH^8@y<)6&d}re_4Yv-87gfR_m}k4dk4yg zZn6pUa4<*f`6p?S7A}tr@2VVa3Km+ddVAMxn|My-@#g!00EKu`4N8tIv4=V)31lso@0HS^tR5)R34S?ppgL})hzVY}Zp&(rP zEE9G5uW#%u1*+hofYEBzqo1n7Jlz+dPQ=H%<(VDn>*`AmQ(W(Y{w#3L=KIZMw%JP8 zrK^72myXyh%n8S?cGqF9V;$3SR&-kK5ws@VFJ3I>S={cmZCj4G z5T5v!M5cB|LVDn%C`N<)!;g=0ZZSx}0)m=ZhP7Gx=KD_}Q|Iku>0L52KXN(j+#1hh zrasAIJl9#0*zH~u?}&K@drv!C0r-TCA{S8XOR%$GmlZSX`A_V^oL#b{24KSHK>xa? zrbb&!>kxW^uF@|&PS|eCV0uouVcMyxYLJw$C{a8=Az`P`Tye0-Qc-gD&+~^@8BSi_ zXEH5~K!KRlnr>1v9M~b&)Vypsd9>p>WCG@|SyL1mm8EEwHoExf$;qnfs>fLDAmkJv?X%&S?W9IZ|KoGI z)0evUo^y-lHX6_fQCC+7mQpvTNW@BQ!Wp5aP3rEW?8gy0nZx|PwJ`Grcf#-u`X8CT zXyDN#ZJ+WgSRakGhE5y_)=_V(!4=ZToEzz8J3U8cA27h3yvM3&t$TC6CJ`c8J6*g+ zsa4^<<{b`7X%6Ka)Ob77cyL~#S~N1an$C~FI+ueUUv>Ea;~D1WEO|YRjg7;@P=6!j zS{ArLw_QQQI?bIT9o*SeGX0-CSrsMF*2e$O*%tYuq=X7Ax0!i(?$iz&#m8$8lu)kD z#vAMNQpqTk7HzXXaje-=Q^e-Iz}CQBdhM`%KPvn3(8Ya7n>9-2fJ+G6vAPx-;s`ogClg} z*J&-Ip`!4B@T;lpYJAJjmzAo4qc`%joCE-E=*?Uw-Z@-U$l3JrC07K}tt81a+I)s~ zkjT_pUHxcf#q5|90-X#Bjn9@AIsYZ5cceedwsRv%l|Sgsb#e-HAp@+i<0ac|-uEO_ zg{Yd33aowPf;|~`e4*2=T%;2QO;`88iDeB&my8?v7odRX)$E?&2*iSf)327K?fhFs zTW;f0XzR}J+owj|IUUkI(OfkWp8 zYhO#e#pGs>gUv}8zXf}iFiL=|bNhH}cQ<>^4k|ruq#VbL(@!&gF7wLwEyWZ{<%Yjg zZ45M_UI0~Fh87SZKqe2lgA0d6GZB$*^-&1Oegf8PGp#WjC(nM``I7xsP)O+1DfzwI zUjPqzPdp#>AE<4nx;OhyKmfUsk(nC)k(?+=mgRTFQn1$tODxrfzeffn7lVql&)y=n zBLw%)?(R1^ld)N0lT&KgjA&sIE|pY>mS`D&?j6CmcGpv`?CN8!k*n_b zhAD;`f(7u-t`MmH2dsF}d|(UvSyPpN|Qze%b(~J05_kCr+?XQ!JgLd8o*emw_QwtNuaJ zhZDE6D=sgUU`9>o?*W5zkbfJnx;;R-AoGwCmpUg}!aH?Y4GCQ5VG!juA46b0s5zv* z%nS+XZw%q(4kegWR_ck;@8+51KaMxj`P^{-eayIZo&MPPSrDayc|i*55WPAUIuR$3 zx&9_a5kSv}g zX0y?&#fk*;vW}sU{4?hxa(7^0{};C*GbiVI9^_`5E2EXbCWPL#@*_91y7u+U^c%>H zl1T%5Mn(UuWJP1pP>ez0q^cAih}96$Ppk#cJw(KVeqYYtW@cxJ>4vgF5%GRFF#$oE zMp*z%>~)zRnGBALds=xy(uK_bG4m|H#4NY*oaMo*nbxyzY-)TcA+DVW{8}kbv+X|1 zVX8eTNdf!BsZASMXlZ^zvWNKJ)r>gMsUe>%DJg;Z0Dj9k9R`{@ros{-WGZbEERO6q zbZp$or5hXk_Mg3iHZBm%JgB;=cpQFBBPu;RzrPKH;Qw8IbmKLotZO^4>DV<$K$a}B z>+F$9wPbQb>0R|UOG54&H*U;y6)NU8m8vVO^a(-}(&ju;3dlhz0P{bU?}^=6tt>6i zi$W6{W}N)}Hn@a@#CBo$E&8q-IS)^#{KD*v(p{Rv_TTTfZSjEfNyL5&l9@4-GGKC` zw*_kOk)c_6d1DX%vB^LBv37aBJd$UXGPC`<=^_Qu7Vy8Uf!UPkjMYg?`sM7 zWn{nipxTSFy=m*C0CPLuMt=`cv?i~7;L>_Y~on#k`Lf$oKj6F9vfvoF=vNwN!5 zQ&(LIz^a@u7ccS{*vbNRH}2av3Y9{w`tsfNZd!he2P}nz64Iy?@rNVl0Ruf4_lg=F z_3{sd&p}APuxRLRr~|HlDJ?1YrKx4V6=PE^n3{N{81uk#@Gy&) zi9%M82GY@t8oLUEFx}*$hvA6=&#$`L10!Hb)t@;o0HlGZ>b4U<3mZd7PyF+bK1(0! z(&h1z(i)3}9pGOPFAmeRyal>2{k_e(>bm-Kgz>ZOHN^$DlG@t4@}NEXwDa$79G;;K z^anTYUWaEn-He~FGa5C2_-vTjkVb|C!fuKNP9js9a&D5pKX}vPMGjuVn#{Nphj3x2;X|P}={`U1$l1LtwGr zi{E-F2~-XnKWuEAf_`<;;aqLx7)J+mrrEU&3=A|iW1v$fN}#CN4R8>#+fir5et6;< z4mV*SELVS?qB&2mb0;<5PW$z1%jKa5{&pk&oF>n;sY8hP_^J$I6N?~6hDXAtE~xe& zEMI*uc_a{JBTsIUZuU^G|ssb(m$c1*8T*9*ngI*ek zZkvu;Jf4Mdg-Z}jIWbB*#rM=@Wawy)zuYScm`Q}_< zP_ROqC-nw3B<&T5B3E><}Ymkv`SgSX!x?c;JS9&;g{#U{k@VUPWG9Sa=d)&q2so zNqQ(@k8R|2-^a2|)2*&Dy-ecc=5~ZU0ET{9Y)mHW7GZdFAG_WPrJ?AD@87?a9rV#r zQsP!#%)u~fT=4qzJ6>bqopG-StNE@61g86TJKrSnW949O7v!rxkwrht-ougX7&aRZ z!EHMHs&LRf%Qwm=tLQH-jEPY@aHXV_cG`JSNH#W~UXzG1JfgKZa;I)(RO1vaOuf0f z`eY3Z48UA4w|>$_#M$})$7Hngp9c=FI-UM3yjj`i$~h}7zb2c{!&KGn!YN3;|swWwrdl|bp;WXNV)i<$Bw2Qs(Pj7 z=f{8iXzET*d{vs36Lr8(f3G=wk&4&pF2M^;O$IfA7ZuQ`E4b^1T`Oiv1U1^uP`>2Y zk3Y7D>3mSNkgT>^!y3;@ z;3~8=yCDDDISt`&!Q%#g1|?-;opVHDVq$5jqm4}gP*rX}+uhrPAqp75$IQfxwsAda z4mTWjFgJTSCbFvq58U?~=5=FmPqL!@?1=M`u-6Srpmki>nQVQEcA&GbkGbriTO&T# zXz(7v%~uceQ&k*6+ie|I0&EvZFU`z-0n!&gW)Ey7`z-^-8_o91#AutFu_MkAK6}hh z8(<&>GzKQ}4Be_dX}*dOGN`G?dq$7sK|c1RFiSU(jdgLM&E@A)bzMz4N&ol2onKq% z1?F)hlYzMPM<%1B*<;rYjAQcq5MJf_ttIw!tmVQ>0%VdJa1dK(7AaR zIYNJ5RQ}*Eum|5$z}l!@dj#2FE$o_(_;@lDFgMD{3Gg&m&^n;BAW*Fgp(_|f;;+)X zgoL!`=#J~7rS&x1!P`A^t7oba<4P74b%%Qq+!28P*I4aXTT9734H5;hRuQovB-VCk zu{!b_wA>{KV33lI*69wvoQ#P?pQw!8NgV@u<|^zir=ejZSMEqt7>byRD=sT5yy)LQ z9~53aWH4KAK;?;+*5Ly(PKqa_i7yhF3GlU##)=%XKQxXz%r4=zI7dg1Nd%@5(1X&T zrk--Q$itVKzHvAVc73^9SficEr>iiToOL1g9TuxXMR*{x*p~~`pCXIdx->NuI0gU< zc0L?9c$LsiCoD**M&mV0&JwqqYAf{hz7F3hlJs3 z7cTKgP>|xlKf~?x;j~+BU+SPGu{jm zU4-=Dl+jykJ*`>OLgUTSOim)OeD|M(_}frm8z)nFLy zPc{bAd=zX~262x1dNx3~q6(tB8SO;|G+M3EiU=37yYDyJ#y#KO4*RU`U}{lp^(I(( zsVjACWrfJq^?tDOUrZ*vFg{xjStJwr`AyQ^3A31i9!Ea7O~R9vV^ji(BY^<{SIviD z%A4uYF`5f_EqQ?&wCpa|n3~zC3v;MCTfl6%KUC9aycR974hH~eBc+%96&|=s2HjB3x_|8xS zwzXiuYeZhzu=+D}g@bPBb?5`YTQY46rTvqbJ@Fc-gbjz)HTz?Z*qKf}-dGvs^zm(< z50g)3hpks!EHHcJZ{ldM#hwKS=0mC58iRjbWeW{R%AYj?&*GFbbVa~an{Q!$UIi4- zecDE3HGeeIHSEd15TciJ{j+i%}+n7mm~%mSMn!CSW? zx89bQA6cK0++JVzL8oB)Q@DB0i+;Y?JMBvGpxbG)FLwa1{I=me$nNCN8fuBqSs*P78vaRP+(&6Bj5c3kz=51?A-A$XpxXGLvIrk5$uA6Np#Bs7F9%*^DXkApZA zhCe!^pxDcE*cH^!AeCfQQdZt-m+l8um~&(!sfpZwMY$Fax%lW4Bnwa0Zb{A9aUprtZ;?%D$adMSg?t=39- z#B!=K-ksv`% zM@OGe69hyYC%m_ejHE2R;^H;b3(d@BzC@6n!~VIO@cRA=D3fPoT;t+On0gEjvPX}W zu&Wg%b*r|N`7-jly!Z6ZTZZ9VO3J5-iVy<*0|@EwSz1~?eVV(`W~>p~p^fON2$~$O zfx*GShKB2`tddhD5fQ@x)qHYyPfbb5feCC{by$OLq{~1rmMOM^sm_ZVH25vf;P=6< zT2Kdt`p{bqnAjr&h1zF|{{d1yXJlMB^o!7sP=x?~a3<Sm8RW>gH6P^L&-N^}jm@1qaOtz-qBB7rA+)a%6Uvsca-(p4pYm)YKG`k9IRQIA_4_Ar72a_oR;e zn!t0WEF#@;Z|VjdF|)22F|X$z5S{A-!ncfu5faQ$Hk`_o<+8S zyt=w+_c~x{d3jyKIIjN6%KOt%a648;IJ>Oz@Uq}610DIGNiz zGz%h{o1T#0pm)Y}U?bQuhK12of2NF#`kT)=^ANPYX4_jK*|SDNP~6DW)ZRQzxTpB! ziS3R_&qA*|Ea{|VW88TnI4fcArk6Q+Ss~C@jtdPIuX1E^5*%Be1VLq?z^al5IyOjN zg!lXcP^)3#DlLD_&&T*Nja&Hqb%x*xeQ=imktJgP*EjP1Z~=%79j7Jw^XXvdW1)4N z+HvCT(7k)A(6jtm{w^L|hD%CR!KHa^y;;Dxzoxma&TO)d^eMCJ!Ap1+BS*x_NpGAY zbd4@4!Pfb+NJ&YVP5Fy697>4Qrm0aKtX8g!w%2&rJBUHU`Kvle3Vxq&QZ7|<;3`{3x`}6e& zH6cL=WK-kj;ragp;T1uw=xt{&fB(racFRR74kv76G1>+HE`&ZMrOzGnz>1Y&783KK zZHbqrprhOF(|qxw4B1DXKzjzuRgy)}Fu>EHJ}&b8#>n?T+Ris;D(7XLa>>x7UF zI^&Co+`NY(gno$Ld3lm^VXA0{apxn0^Q=2@@!BWp1qDO71OJwuOHEEl5VYs9+L$@8 zcI+&V+Epb?z^J^Uq9iu9qoTs0 zGYN&k*w6E@!^fk2070ViIV>w<;|L`2QBRZyFBBgi*yngFUocz!9?*8{&qt|k_oS*+ z@fr-jq<-*R=WBB1BD*r|D|VQO0Y_P7X~fiV(+&j%m8tM>Ev zkGN&JG*T`n=Jf!y0FNKv6~bZ9g0i`}S(b4Nzjl*BoALv=FC$iPU*3(v##)r5rN!ErvnXcSB-2tYxQ)XB?o?}=KtMDi-`#dkmrZoGBp|01aE_#{cTMs z@E~**eR^*%FDq*Y;RQYbqx1vyB8%K-oc(NSZ=q!$XEfNyt^YcC8Hr1`kIBFedXJ1a z#eVy?hr!ebLH^WVhC)Gp0OL|G@boGEaV9sC#lc*Cljo7_C{uX< z8#2hvr$3K{*^pP{SU+(sIEX+wu)!7yxwTDAnORvG*~vKbS>HY!B@{ol;2l4nFBSR$*jn%;oVu=EF?(>4;Vh|yVkBh4fRb=)T{SX^_g%J7^f;oUV)kB=#UfNF^ zs@>RFkP3S{N2A~NLvMR&lAL_%zxg_wi<<@k!3v1a`Efcd_7TJL?jvH|4QgS6XfYY)(W&$t~1&L>Yyr3G6xnpWVMr%AOvj;ll$tH3qo>Ao-wK<5?R4 zkHC$DrtQ~zH-5eOD4WP>rM!D}bxtw_-LjAci|5a!)7+a4Dj%LS{XZ%5GBcN2V@eYf zKW>=|S-@H24%K^oSoGb_YGB-2x@bGxboIWz*eDdu39OL0SKm^d5$Vw`D0H@lO zzfQHRys;RloZPQP&h5 z{TAi?=Z3(mjvDMYh)ypm?dAo39%JL>6`{Wq=ItHkZOX^QRB9C_O)$EgKGPDFD?1w} zQveah&Sqt_0{-TA91;>9NtOevtI2E%q`+Ot0Kh^rOdA5jVW*XaUM0TcWuHGASX)0E z=Ese?Npqe4Yt|f(=FvkLWGxue^+YCDRJ?2o{TMFn7~N$?nK9qJ&cRvV-k#kYG3+!e zyER$Q2bmKeA1=MA8|@hB<>e+jJG;2JG&>vJT>_uwwkDEjT=`Yvf_U##38Z#VBta1Z zaEr41Q-vqbtU9l?JWkhi)}$eTYaaNOC=yFT)J zntphP^(PF6Vc$PcCh_?yC}>w@ zUIE`hdHq(Z^sirktWTe1SAF=|OIlL0^h#Jx#tlUzH(6R98?)J6d#y42{a{}M#sn6m z53RANjzL-U1}w1MNa+GZmZzulUsRqjyb6oeqvNudMa#lluwC-A8Z2MnJ`1y^B ziYAc*o96fGP|XVOZ+M8&>ZXUuc)(P>F3@~oZGHGa)Y^Kotrk4X_AvG$dpZdb5u$Oj zJ39s44PXmW-`o5CFm;VQ4U6YkjLbD2;~}V(UKtv)YQql&vqnS?*v3XjgeH4r`<`8P>Hn$57I-zzIpbk919wKy;KlfHia8b)yw zhaTnfOAx@Qo$7LISeSRD1BZT`9TXrhVxJCMoDwq0KaZE)y9 z)18~()vS(%JC&>R1oz7!p@kM%CLnFb0|`%ZC&x5I$$c#L%-OTQ@-ep6)kH7BwmVG| zUvC~m%9{QEBtpvf?ir-3(=6|i2X5rx5L(MMcF~@75 zWDK~3qZ_i={zcNj+L{_MCs4~Aot_3RN?IfQ{b^P zbf}l|J00w*2n#RmNg>DP2;1jP8ob-@0Je<-f`x)YT_~hoU`$(6qt6G)-wi=XRwTpt z*#!l^4b?)Z)z`0wcFWv|JSa*4>< zLhlzNL733@}F_4TPk zwL_%>`u|zmMPK|aH}^J6Fzh>UzdWgV*CC4oBg|LC_uB&iaR#WJFvLMKL5m!V-7lSPj_3s-8bIm)d#tyu zo5G5(x#)DWjR<#xf!=IuOy$9T4Y!|!3WzP%c%jT!$GDH-Z}ntNvh+E^-*Y~KByh9< z1jFHX;yf7nAWjXx-wk+W;KyC7>7{E{2|h}p+e0d$K0b-%{{fl80rgRS_UxK}mN0F; zQK_A!g_RX};KhAZRbH*45D|uFTU8Y|?8s}}6q*P(YxeLfI-iJy_r2mO+S>9K{JLQ3 z_B{_mzNo%*t7o{o`)<<&w1gP0e(Mwn@blZkEF-pqT;9NY|KF7=V7>IR#?z21OCDT8 zkg`Li|0>lp$!uuNsN3l-y(hM>_MpzOT^}Q%QT}ybolhXi8oVjUphWpVjU3S?;snpI1 zN>#wG;GMsh{{C+CE;7F(p}#nSdqT`*qT#Quiv~u2P?NUG+4BMD;2Q1*wOKJI|fYbMR3nHmx?v=j8aw0oT3^cFv#}O z$$1Ph;d^NU(+*Heq^1}E4_xTYR&IhabmKZFXEA61JY{(%5^Z7z(KJRe2ay8!-xUVa z`a~pKygXe!JQtuS0r74T(@U~)L_^t7ng?-;2$)_n8z{KLsV!^>J8$_gdM{A`Vsion ztI>~qudX4w>VTjC=y9HcLZ1`DPz$GP#o|xz2muR%j)kmJdy!(};hT+VC;#`ZKpOB1 z0CG?KdzYNHg)Bg~`wGp2UUwTLz_(OX-<|mJ@n>(gh684C`mpTBBRv66HEL~Z%SfhN zI!^W^{n+?;F0vtKKsF`L-#;$2))?KpQqPW=qX9g;zL_0*sNMJehOKkJq9YAlO0HbF zom~$Zg?u&<5BPV@=IGJ^9#DcisE-lb?lwLYy{5VcVNV|B?%{NUtA)TL>@v)|OS-vh$yJgjXH4SFb|L%JN-Z3#%19KR&w1IpqPM3OCwpkdV-* zbY~2og8eFLtGD6KJKEOOK?Djp#GGW9eqm0*SP2L^e?r`hoPmKERMSw61+5P|te3Y$ zl}OyBS*&yFlb9# zedMzi-9c`tY`HW5Ze>53o4o**#ItdJru21tuJh)#pVCtfkkmk0dx)PPe*?LkmsCr> z$|@)f0ea7x3TC~R!Es4h87l>0ST4S)zM&-RRjobvJ+=2bBHwGqClP%NuRx5JmKFdR zV&+>|lmdQJ9amnAlUFAol@Bdui9Y209nORyg(AG{~{+B94r*#fI&l*E_ zExc$KH^Y!W=}eAPbzeoJbY#k#VS=CoM%Vz;yXMi`{}U29BYUXP)Ga&1&}k-xle0rYxRNb z^=0?sWZ~=Ljl2Pu0DVJ4CRB21V+e)FW`_x%@6wVKl)l@6|2co$KYgMQ)hQn7j&@ax zmol_k7EX!V^z~^2!pWQT^qT32GF^iP_PxWzO;`>H7ADIjrKPT9z*qtOAr5x%8H6LO zJ(Gg6gD^OzqgCOx+l zso|3KIPl;`{(WNT8asQpSPlxB2~I0B^oA)8lYO0IV=v)fM79nJQB(NYBI+B@N`1jN zn%B%&UQuy)R~FP2obI5lj`EPN(VeqM6!Y3@7Qwkx2ZDj+aXM6q>UjO%=P2MQt4Lu{ z?g4q$v7;s2XoLIrC-u`E0eaqA%r{?L4AFH!(h@w6v&iFlrlKOi&kr5Qy0X}($qI+% zjp5W$6YKWjpxFyE=UYk#!`K;;7X+b9$?@PHPxj5It0zT5Nsmgk6|0wbislGg`Q_Oy$GxuR)c1p2aEb#%QWt z4KoW%dpoA}Ijiz-`DjJ}|K!JT2v=kn)VdrKdoxGPg1#AzSpr+lsgK zido#nSxxtILAvYy{i>7nqM}DF%!~c}8iq~$D&!67GX+xN4C;A_2ox|Wkr)M(Rtscr_yWt}Jx_MJEiK`%m zEzI5XjA+X6UcKS@L``ieaeQxz=*@G)q=|s^Yn0mEJtzS?EAhAl>xLn8Z&O(P-uAK; zYWDYCL|$5o5)y2{m?`pKntlFH`S~F+n(Kqbr24ON0d+apOm`g`GJ?}T#``!DU@wsU zzNbL6fy)>5Q9KS5pb|A1Z{mGP+0`nwFyWr=8}+T>D#*%@f4SMsGGx1$T2upW-c1@M zk>wb@mX9m#q8}PkB(!5L>qiWmk66#%*2CjrRy0r3($eU%Ce*2iHbR&HetiUPAv=i9 zapM!uS>&yMUy*XKgx|ao2dc~9K-15kIy);vRJ$Du5Tu`FlY?&wyE2!G_95Sji}u?d zhzX%>?Cpu5hOmU1r9ncT`RV=p_aQA4*Giz)K0^BOnAkyIiM~n}e^pbSu1s>*U5v;O z+VF$7_mjrk76uJX!`2ZV!q8}=oS|#URGayE=dOnbu6qcFoxi{9y6a`ROgT{0*fl6X zLc5!sP+;?X*@-heLV0-*ZckwP0eY%FH-vXWBL~+V*-4KML&U$qd_{3*k*Vds`Wt9G{-V6Z=KJmcp|UtsLFouTRn36|Ff%ow%`;y1%7`E-wkORdMP!-Ew%P`mzM3Q%qz+?l_(h?2E&M z(W8{g_?fR30X*CsQ)*|iv{ffytd0)epAHa06VeR|UYlu~YIM)dOi^~61qx1As(&9M z1pB{B5@}I27p zH~w;4bE~OLL@8sVKA1g!ad2}ry4iCH8>3RgCi(#)K{NVb>|L`+8fA~;a}ZhaZW`>m zzCYAHc$dG>rm8KOubYsNXxIj&U?3W5Vb(D+YIbyiuRw#@w9y_@YKz<5o|Dus+k5pU z)gv|3g?HWf#O8uh@v%I;{a_~{`{n+E@w(jP2-aOu{@%9o%x@!se!+q|6+iuQ>KvK*a`$X=I@2&}iJqY!^HSWU6`{WaX zl=Sx=s~R+}?xmJF+|u{7a5xxqg)P*!TD!u@%_(At-QDH=)~WuY20dslj4>Ji#I5<> z)352L!@JhZn~QrEsihsuZY0;0_9o}q8+XPkcXNl=VgnucKY)}2or ziGPRh`T)oqbu5Z$U;@!CP-p`5cYpt3Cjmu9NK5~B6^Pxuc@i8;0FvJ$X?qS>J&OXC z-^QfbX}@Sz0BS8fy!`@4dvd(@RpsU7z&$!l`=AWfZT|+?NngY95wvPiD1+rR2&%B{ zjQGZ_Q&=u{RCQJ7X+Ff)9qEry5HC$(qv2=8EY$mJTo1XSmqIo+GkaFL(IyJE`j%e3 zf+Ix;*>+b>cOce&wB^9di+a^1^b`w9ox#QC<;se7wPZjOgzu0Bm-WEwetnK-A9$$c z?)2x!m$A9nlr)0|s<}k`wszA}Ta?_QJ(#>c4&N&2Sh7b=Ef|Uzh8_%@n~n3Nr}-v? zkzE`m6~-w|&TrQ)6fT$S1<2nLq^2p{3$)}u#zEIKa6IB+95)^NvX?e$Wj|W062ESr zAb+N3ox6rfHxV8{+bUWFm%xXD^Fv`vYqr4LO{y(BcyEJZiDx=1@ORPBty^MPU`{{z;+$>|SLNEHw%CMjIn> zuO>Cit;k4DKE8Y$X`<2T)3(49XJuncwC3R6^oft3cSJll{#>^yU>muT(bK0|I1FR4 z6$}ziQV(^$r>}G>$e8GNrMMayu@2i#-2oPmw;PjIFV_&z>wPk}l#o=Eut$5)ad%ZVmTEq9%lP?$ zju$IvyYUa-NokibA0Bs=^-Xa|Pw9WKG?y8?Frs%cF*OU{-m(V@Nc^RP{BpH>8-*D^ z34nIT-uM;%KPbZ=JCWSpZbjEaK~CwNBIRur>U(NQz@*Yzgges+2zJYx&)5tdi3o|T zaGAz+a?SOqTaOZJVcDD$-B@Z}?_Tca$=1K>Vq-TjaZ(O2AAOb5X2!J&Tl#xt;iaGe zLq$WKtvPILc1rvGH>keb-r+~S3f?l=aLKZ8NL$jHc<((PCK%1wsC`xf_|oJQ9s*P(w6 zgj84x&M%(hi+mrkwYQgBIYxVfHqEH598L@4sbR2YrKCKbZ*)0qAji?&Vr9}TLZb9~ zZAZL@&g{rFmk*ymCY35<^5|uY)AO)zv2Y4@W0{~|w?8*0iCU)M%}~^!|IsrV<3i>p zbx~4MvHsCa^2&Kp_<{?3JH-~&ja8lHLkAH<#v86>*58v$i${Ju(Tsc7v60hPDeW0{ z&41X13_9U4Zk}YKSH4~4of*BZp81#`xA-f0+dkwBXA1Bzov1H+A$gw=(=eVvRp$ z!tOVOhNw4~u^A{rf}@079mAO1V)_vcKkNKRE-uoqMeG`)(bvKOGe&Lbf`@gEB+c3YLWi)jC6iHVz zKDl)0tpe?4Pw2f77bV5UZd8&6?(P&oS$ZS&{$Y%~a2O+phF~$AFdU1QO>`kM7{lj! zEpmPDH3Sn0!(_!F$LzZ}TJHYxFt2_4vf^=VslhEVe)i2`y&hiUC(DaT$w_*i)^s~+ zNj4tT!pi(H8(YNkFlDb`s3ZpjLF0ygWQc6z8rl+Fp|!`dQj)E7Ke}6nr{_Oj}>G|7Psn##H_A_y%63 zr%yKr=GjRv@IF>9F?`+q22C$`0ClG#NM)BLov;=)Tiw|ZE zkEvOf2X?y^HBwuv>;9ZW@TwyNIzMF5hARH*OG|ToS(-JG@6~fHX7}{F%|!NQp3YVV zBYD4I!{PnqJ}!bn6-J0mjE`#~e912>GcjIzd^FDe=L7u)Y_no>Hu5;h$;pQu&^w(J z-x^hRmNl%6Bp*thS{xpqX%Z>2Txk1I^pPyuvH#1lvIDDb6{Tm&oz$9e2n;eaC+)Vi zHj}`YD;XT&kX%DgXDWOMKu0F_*@)lb#C2nUQ0|L7EqgtCqZZ(F# z5{8lRd-tnUR8*kVKgavP$jAvOU6YTitKy6X3be61H2@;yBB}$wo9;F+1_fPCXu2OT zz^izi4*-2Mkkj~!Yjmeg4=5;0JbdIsVqkbMyuEW2D^FdfBJ{c^A(Q%!t*995Jt<90 zeZvOp7mpLPvH|cRJBz)Tzj$C1UFK9~HJ8%eh0R)mjM53yEi-@&)AMyblY%Oz;0p6rNls!I1V^%$KO&>j(c1wXOZu}TVAsV+e^37@i|(y8(HuCb z^Gb_d$c&{?`;CFi`AiH#p|G8tcGf~rcJCTPxV?79cSat?L~Cje?OPZ%?y`&QIV`L& z#%j_);Zto~M#IdWet|D59V;<5W@I!N%&qxg-xqpH=Lz#Mb$_D=TX00X0YGm2zBNX} zcu*P0-kUfHbi6gwqp@m)~eHw+N_%cZOv^-W?q+YFCSP-A`th^7Zs`3)_pwJW&7O`LXz4?z;C| zDC}n7>(D;?nUH1*-dz99#Mj)fghRhXKBvE@^y-JVTn%*&noP8>Gvls_z^nu>MYkBg zwXY|m(9I!W^ALs^6AO^R~bHx-2M=$g5s)0gO|pWsozA4FHw9 zeceWrlT(u?;ml;wZ^D}HJlC@eCX0r{0437SHwImD{Jq-;G?#)XTFS`jgyCo>xDmXmaF?Of)f^ajR z^^%2z1X0*wHr>(#P$lg@5cCfdV}LF}!-pLDAFSt``-Qq<;-NMqd)d0iAUEu^Ik20s z(eN2czbzV}Ti4-WTYWeUw7s-8lYIJ84aeow4hu`50VjUogks?^UljeoSo8Qxp9SZ1 z)4^JCI%K9UWKbduALL}IMWo4MmWF_*n7U)@PgYS=kJ$%v3L#7z4zu1M(bi*(T1XWb zT{?#8+nCF7TsCH4V1U2czqR1QCU0YN(4HzLD70i?F_BM%-W#nqj-ci3?QfrN=v{$0 zm9BQ#@9tEk?fRr*+`AXjp1WE#0V?g=IQoPMPy$nE!mF_%84ToE(j`7OizP=^Cm0~|tUPz{% zz}U-ygDCJ@s4SiavTfaU)yU1wRLkD5pS?9#v76oM4Um>`zuKa&^%NmJq-2Vy z(zVvneRz69!P`qJ>qDtR*?N`1l+Dtm`7XtzST;l6?Tvy*)@c5M;oGy%8`-Q-T6P`cfarN?_I9Nx_1%p`_A*6=bU}^*?Y8v|C-?HyBX$QZ}Zk~O5HgxT&89w zJOEg0DbOp&SA?LpU$s@cl^z@Ntnfn+dm=t2oLj|*Z2AG{B@`%Or6n-G!zU?p+M=&) zdh**VpR{)Oq7)y)nJorO1>e6Qn?ceY?9zhlxN}xJ`OsyFY^-GLAt>_WqRCg@#D$j;DDi1?Y z0O0I(ca1)Wq-)@cor{wW)Ro1@SiT(VXHP~}9Uv9X7VY7`Gh3_W5KF&)Y~l3a^!4l4 zqgK6-oMIgBxHmQmLvHWvmh2#q{?Ww1N?H2H-CC)l?4lY-aMxzf=zDLtwSn^%`k2(H zhUEB)pxM{#AZuBY28d#G0tSW6;Aa~4A#$&NzraG@9#hnfQjd%*iu3v6x85Y|FyK|t zjP1*wmTL$-@8iCW(tdrs;eSE-LW+-g-?7+cTT|ZDOFb`$g;mZi+7?8Ys4f{9>mMyv zhFDzDFzHW;JRi({iLTbrLdbsKl_c!^uh**hSARF-CR%V!^>2g?TVb?IHdCQ$kS0 zpP?{*cJ^;1(w3C;qe`Nj+Hli*UOh~LQU3P`t`RREQzc;#UOSa7O zi7%6LQ}LUKa$Vw6&bsT#RRv~)KLc6yy*78_?{C%mA+@(B)8caOdEQ&x#%av6{W(2K zrVfWeQp04}_5G^DEr-2!rZ+H$8aG&dJow{n!IEcsVj_6YqwsiqfA)TeSfcsh61L|{ zjE}J6r^Mx}FgQssy0_fioUd0Y*6Z>Qk*j!Jy-jcsmfL-UwT&}#ftiTNdSz?t5`nqR z|8)%N6+$yTiu5}I1W9c0xQrzl6%`e7^s&wSHaSd+9Hn=roOEI-w6riC=vA0jo@tk6 z5OiDo+0@amdLlC;V`yd-%AtPrTHL6^ZNXKi~M@#2>RbcEy&PZDh;CMQp(({R-> z*LiJiQUegMwZ2vP=`wOFCm&D9>Z<_yV={S3Bn3$MsNw^ch2`k55 zMn7`Bwo>LdpSBhQ_s*Yg1FugrATRq2dl3f9TAAhLva%O!J2>?Y6l`pcy#6Nex&FPx z7k*=M)|k{e7 zfC~L`nSqXyflg&VWto~|p*!K@QR4lNza~`Tyqr}Z=7Pl>s&rTKH@Aw<+`#ESFYw>n z?F@tH0G;~w_TatqYXZPA(?{wqE-u<(c5SP%gmJifI>iN6LX-EURM2b2m6x#GKuXEd zhx5$o)Bikx;dMx!;`J4RIgmQ&n-6Q+(@F{**EY8p5C)Fr{55+Drmkg< zvs4cEtZ@3sFM@R5M+S23K?|`10)rtFA#*2n#NT>MVuJfWeHL6}&g786feg!h;6>umS1=G(@K~;_do7wrEs;!pigfUP`j7pIJ?6hDPS6mq?rY_s+egYfM5{~5wVI5!M8V&I z=>k3dmjo@KoWRfuEh%sf@<(HYw{xGCM!b86;&kJ;6`LKe-L}P1Q&G`UtiD+y3@ZJ5 zi7Pno=BN3Wlnh!5%RH{Bd5%LKW0tTDl9SC5I^fqtbLTsUzL<*jZ&qCB!>%!s$qQRs zTTBZaP4<;Q)wJ^IRi<%xL4Brr4o$2mzCL+?R z1$SieSARvBtpvV%cZQ6tDF2r%uueSxW@3t6#Cm{aQ#~>9@^X*twOhA(M=IhIp2xm< zv&~BaR`()Izvf8l{@kMzA|l}aV7FW06RiWqJodHXKF2g%rdUr2l;c5%-PRzDy08&uXc1G_>&Ic5c1#Lp1rSDa2KcvKl@Yl(cfTQ&wTDrPk z>~G;iu84xN)_@TZ#8&QmAA5l{rCzyn5Vrt!K;WLp0U))z*z)CcAj^M4b7kjtRI~o^ znD#lA1K=;5k%gy9S1DdD$jdv}!gz~`-3PCgVTCvJ<4&HxvP`H8WB%GHiMqsnxs=22 zXpMwu?BPn0?$zyE+J#^9@?O~4+4-6X-n-}T9}+@N2J=FbM!>)XlY@@vfqM=;h6cYD z@!3J|&*5|g?cy=tU)egK4 z1SORXy1n91!wM%nM_OAaiWnff3yO!guV!U!ee&c<9^Mp~Wfp?CC?*DuZM~YD@Fo)K z-_Pw|>mfNed+(WeLssA)DA3FPk%~EXrl}TT3t0WVm~B`X@))hqhkUfEg2=oI!XGkP z+85pR_?T9#0`xXk-klSr0YO1+plig#E2*dmv)t`K*fvZ6rX)$J=dOALn{k0@_U!B@ zkcEl3Z5}4t@<#?5dPcxz=hLUlL&K51&Y`OG2yd}lw-(dl>OqeAmh=*ql<}^?bn>Hz z%_x^nXQ9c{?M~So%~ajaXUDEjcx|1B7y9z4oCf9ukEnAg{HJrXEv8oKC6P&+ab7dmJ=&iYFh>?FP=wojGF^4R&(YD`Twi$uio9 zfmjrNXyVGn&H2g*0o%P|OM!!WvZIvQY0Mh(LlMs%t8!;D z26`*8Ng))M2kg=tZ1bYXeTf@a$8!7!F*?Xb`#)~iOu@?PORnv=OiP6kGR2`P+s^p* zdHg<=4~a{a3l|gbM#9!_aH+A>Y~`f=#grPZTel3O5AMO5ZOqm|^Fpp+9{}7ptlt)T zX|CAocnRGxy5?12Ipm}mveA3;bAP^ZWvN4T%)J*YBzg@40)wr$bKgpaZL446(o2>M zECaiA#uBDK?ugcYJ=GSN8JU@t#XiXfQ_V4iw@0V0_@Y87slx@Y{mfWRPWE>jdeY2& z_&fwU@Bjj3OA=yY6SK&VA3yrJnBDyN=dhsyhVRa5ucd5J|y2D$kdiCr5 z+9boo@?r;BMbXeH1H*}6MnttsuE#_@pRl9ZZKln6wf&Wr;o(S&p49v9Y~Yv?dGj~# z|KFR8zjozH6_avRMH1YfBYxOgA2(*+0h3QgU#xGjj`7ERx>XNnH8V?)i zknN)@73L-;>iuAXUg_J%eq7!$_{z}lxXQ5#r6bVt>n8u=p#Av#6kz^>7-1(H%y_|L zwTRCS)W<_^&vLm(3oWBjacKX+NcGKyep!jsLvD6{PIWXT@WVY~@>nLOn~$l~ zXb&>f9A3ESM{vcZtN#-9+JhM}#Qui)%-FM}i2uGN!qR0iQE7|!14DjtQ>4S(7SJ6Pak`AVS7Z}KM=Z?(rZBx^k ziH4Adx;p4?nsYM{9W)fobhwkz*^Lc8-wY!Y=C9V>+8FA&HX&t$DOd3_+ON`8nQ5no zv2QmOQ}*f-g)gF_$e{;}2;52o#SCYxMsski{V_h|Cmkwlexx|b|7n@`)WB3=xQgFM z2)#XmiHXdj51ui#{m^B(O3wy+mYVI0)M4P)#vxK~im-lpok8u)UdkjrDY65TPyTZB zg6by)&M`)T1e1Q*q}ys@gND8n$J3IR{%{-(fBR-9+mfiHlnZXsYcm2mWsZ-lJl*j4 z>lmo+p}hIO(l{Yh_^YD@ND_ zs)KGs3rJG3vNmBb}lLpE}*4yp+K zVA}kdl@klWR}}SGt|EpF6a6n zV?>yluCoML_hh92gR6FUb4GFByqA1JB3Zg2rwEaGjp--H?eNl`digT^Oo91~`etAE zR~O4Zo5sOhNu!DO?2l3*8j6CG-l{aWINt8`R(R5Q!A2(~br3FBX5w~U99bBsgmW46 z1^14LtCw%zZv7}Qtd_2<-jl8nQ&wo!Rlgxpap!l$g|o}?2H|b|dlB*@X^E%0_#%c$ z1kBL5;D!1#)D9sr?8%`QEmMU5<@|dbbmax%s3z=Q$s4zB-Fiso4I1i94}2J3E*82C z@TZh7V-l{L%6kkvtNAYkoHkvCq+sBn|O_0Oj$0rY4t%b4V zrf9z}W_=mDfz-BCVPamx=jr-&C4h2hW?=B;0KulIqho^nhC!cH%lI%iborY~nn?tk zVD&cQ&mo9-4hXW$%u;M>?e5NaC@l0V1Lj66r##rRvjQs7gwykTn$+*JJ@3O!Ss>4X zYdVB~7(0idC^Q;fZ+}Ak@keCrHKvSi{+@=zc$?6cI4-1l=CS8r<(~Mn6u|P!DJxf$ z05iGNBjkjbqAl0v3l9wUW0$yJfxfo&3ERuYZbxFe?*1}6N&b{G3hdIcqR3RMYlCSH zA-DC<3%0G#gk`GZX+>O{zX-C2UpHM<-W4!z3+8lCm8Hz9zCpK&RDPhTo(Jm5B5>NpI z4(FM(XPajwSXfvf6E}+fic)%Y?LO0*F?w`wZ_iv+ugqI*7bj#*%Yr!Cb4uhsefEs^ zz)0e>WOxmb*b8p$R9hg`AF2&A-??G78MzrW-%A~KQktASZ5VC#ajNASONlpje|5qX zPFw0QD4Rget1m~lR3V0~c}Tm64ctKY)nw0fQU2Fg=4coTC{{W`yq-J5NXppG?ypfF(M7TWn}(d|HDo zF%j(y_2u|;R@SQK;cpQE{_g{*!WzFeI#73{X{&sFlHejQzrXjVHVmY6e{!XF^zA} zsvi19S_(f?ci+05|Im-(BMZ42`u3lnOA=(c(c$5fzYKEmSC8{vOuPap)APvf?S|sq zU>;1DEma?t`4a!umt{)K#6#U2+da0ux48hxrK6+V$jBCH)Yiyx?av(8 zUl}iGZaF%{dLKIdI69OqjA1tnzH;bM|2}0d{oJ{V{R21E(Te*2>ndsD>be8@@#I(H z>iGE17L;hYOUKH922^jwMomURMuaC_$$K8hd6hapFYl3@9B7Pl=$1L|nMQEvs1r(6 z-KS4^qs|k-ROaK#-BV7O4wfM9o{CiUo3|e>zdiN#@2L(Hg7jov{ZB7fuQP$atUnhG zI_!L3+hpI|#2px_wJ_@&DM^`WDSrS}xC~D>lBp@_z19j?6>w*%Y23GNsY;QaSE-fLRsY2gpr;H?e%KdR zJ*e0;zkYS2pwKF`AA&T#=WCX3Wvc(8P~md-COczQPE~9b_vtg0A8&3RmTg`N%e*om ztw77dR4KgOX!&8g)`5uyT#`lx^tbcT=zix=a{GPf_>UjiL?al4c!z*{`}$Nt{>MM? zo0qpI$HymrDNA8kk1o>e5=2zsJNbEe8%HhzqHz0ZiC89K)Qf1Rk&ppCNO>I5-PhM< z<`d_CPf!quQuG9Np>JlwaWE=HXKr z_4jvN?i5T4BMPDwDzt0}mhaX&$aDEqNZdXTj{01^pCx6(mcotIpeT5ej&2~&ut!e+ z+MPR&ZJ$M>1sI#V{}X_?3EMUF)vH%9_VMi5Gbt9R825H}Z$c9WoHq}oaXF%v5LYBb zDnu-ct;|$2LSM}Nz*f(r5?fQlH|I~aNZdG3lE93{1j$nOvxnt68aL>pxU{RidZ6pa zUA8n^QyY=#1@i&Vn_dU=vD@I#>^++h&`!Ekw?(2wIQhnp$+4E;*@=f#;X-Ip6}J~_ zM2$lsHKXz=T)5bmsj5QkRle2R(?dCSePd^}zy@1|EnWXw?DOB}fUluKii!wI%IlVv zveqPS6M&{AB#=X0a`0+^MzpLW4yho(&E1;#pHD{2lZ2r$2B4Iqqy6Rg?e;HTP*B*~ zF6SHf6!no4CF4rQlN!hvV}8X~RUN%QqvB1E*i{(BLKWPto&x@%$}xIPML*_5rIV79 z9zIz9Jl$rgRq>|GP4Vvj{#-$IT&zK4Z0zX5ewZ!e7on~FyjrPKxJtvwfkM~2q~L@- zr5ZEO$D^A2jZNtX{bZ~=2(!N^s}w%ab_ArBqr*eBJqo0H$}z%a^K8|y_Y8hSZUjz6U0|*ZALdP zQc$D5bdRAOX7b=PcE-~h_np$OdSCUT*0ekMl$O(d!n$FkAgtyl@NkxR{kprzT+trV zL?FQf!TNL4DWcMbAyQ;6u8NhLO<6)6mTP}TOflt&H*otkQrMyda`TFP{QW^2f1$=lnv&&w^KeVCnG#y_?mC-VvkBgq5M(Dk z39%{iaY}RDd2dh>WBP^1%lj}AC1*bj>;fz(1^`6(i@#wsnoC=DOCu4xYf~vO z)%L$Dlm}Zfj!k|fZ=L39xVhB5o9o{($cvN|)4Iv8B#Hf|nJ$G>mIC~tzXK(8`@RU_v;;gKXHVWR)QGn${w z(b18&ux@X2A0&`75`IH%jjsqm3rED`iwq2hV>LeS72umT0I!mRW=1H(6%l{et=rvA zk0N4!9qhJ&IQBf$y}Q4|!M~4V^vTaJ#Q%3>_xEocuQdg4iQ!`FucbH7UTQ^K4y@Mt zby(Q^p2HOkh%G)z)JX;MYfL9joPaZx<}>6DCGMN^b#)TDy6!Je0Nx9cGlIi%X3+|k zE1=QMD8|fP0GR)G8P&H%d;iYWA6b)7Pz+UKD($E8e+E)_ja=Z+?yYoc!S(c@wFztC|g#Em{p0?26|7^x$4_1rozWXWSUBIeKBQrHe65ph1oI8I;#H(HOYG+4tey^#T zMM;^e>JqSZDTcneNAA0RJV~^|N~kQ0prDk1(&#Iw8^C=-PbD;TY}?HH0PHul zg?q$)e=Edotgl?dnVFf(@BF^mcZMFER|mNN*e8GwDoB8O7w<>l%uU`#9F_3in2aSr zrvJM_1Awvo@?|+Er{FL1O_-~Nux~X|B2}F2x|yK?C37){pJIQ8ldPmsL#(`ZtKHGB z()rCVDvsOl{L@ekmHTjuyu6D!-B?o-3x50A5~bRDm!(b>i7TSPr_Z0E3L`}w_jh(P z{<0a28LF1E9?Cnyq}jUyHn_q`*i%uDQ_h|{*E*X8Wjc^Ldd5f~D6=s$_hSzq2n8M< zK7>KbC49^{^4b4x8PYhqk&^KkNS)_14vDMZycqyQ5?lu(U%m3)%DT+Jzyp;ttI8$Q z4*MOWw@QX~Qcd>vO-Ou6H*X$^G+=$$J{q> z4IblF1Vsd4#+aHAByT&Ac{BZ5T$Fdw?oTcbu>+6-xP7!WJGhEMyJv4O4;guT=!^_1B&M$(-dMRhsAY~)HbX&E^eiP@dr&q6_QhmbHvr;1Yg%20pyyA-t z{oI<&NE_Cf#l2Ye9c*w=n-<0@l?QITQHjvKcu5Q+%&;*5eg+W&BeTSUf^}%P#r&sm zf~_pZ4dpWA9}(;*dBwcIz{5{>y|S}8_KR&-ghAITI+{95 zvx`-j8U!gv>fZTes5>>aORhe87ZReMXYy`uYMNnTzSknOVl3B?g!8G8sa}c9VVOL? zm6lUWOKpW6g((YaS{`#R{6({wRz{9qb)n_5Iz_rlX3cl++RzQ?&vovUrC6d+Fw=TA5Ji6kvePoTU5LugQ!Id0Qr^sfO zZCGekYG?Bytpx7!4^?@59Kc6Av+di&92ZQD*#^#tAXl^0gWSpH`6`fu~#FCum^FG^Ru&WM$Qa-JZs3tTya?C?(+4DfS zQ+XeC3r>xJ>ow|Nbs+#J;ADo8ln5?k)Gin&pXv>Y)`%cIzjR#m4l3e94EaHkv|vhp zu?o8Bkk@uNtMucsmxBkI4ICza#3GPDq{@d+72Y^s)&Q@h4=&NTT0-P($48cs?lG60 z*{U|ofLgBh`oYhFXmqZMMF2H>LQ+z}^Yx5`r2U(59%H$pP~1JOw6esg+cbwkz*38g zLEA-goAr(bD&Ne;MTlhD0DY#DUe}t0DE_{)v-4vgeJK`@y$J9JiBA)PdkvYzaN+cu zGbf9{-{^nWOY)1fd+swA7)n?lZUySkEF0>m{rzz5vOUwMJ?sDxJFJHrX z31=(6&3L@Ja#vr>V@s9hSPZFlC=?`F*V?;?jzh5{t*o0X*xfFTLh%$YNC2Zu0BeKe zy+gu>;QR3Q?Wy0bOB=|G+rE@mxGWbdD6m?IAppXX zt%0$^OJM^ya@X=*LSFIFl?60T(o87yS7jw7eN4!wvhna>i+Kfj*(2eV0KRGxzrO=y z)1qp+8M#`8GIuFh4Hr7&-S{X7(I%fy zUutuKZwIASy)ZkwF}FIcHG1Coi~2!Ty3(P^?mG29VPJTEm}jwyru37Pl8hB`kQ=JY z)tM1Hao-!_NgIj_xx94pgZ`bqNiEkN?$s+Nh{T1!r!KSwP5?RHop=5P1w4e;?deDW znw{~Zj+gd#-_k?>-jP>v@Q;N(DG?j%O-u}i7?1Gvr%63rCwyI6BAtrp3}-uSK;^_7 z&ShuAs{%tMPDR{in$=PMg|=8NiS{Ee?w>g}Odk-)6Hb^||8OV!-M!2_Ci{u$KEH8t zZtchigO%k>${ER<9w%*wi=~F_a=oJ4=Y5P9>BEETU>`&AkRE~=8fFi&2w*0QX7};f zeuyjY#I);+urtZi6+J22mq<3)W$RB-gYY|eL9BZb z9cu&b2yru}(6t8$PkRIoi9K5c+tsUADJek)3L4l$Ds+ukW;l;1H@VqB_5~2QeR9UX zegAgbb;oV3pD9N|(?TPvYWQs?O6vHIck3i1X=ltC<l&P5-fQe-E*Q9^q@mKxRq!tTP7D2sMvq7-fJ@xxe93bIICdI2x@=6M<=*B7 zR!mH7(Zxy%*0{>K${sL7Sr_1oM`8i;(!@uS2<~o$dWqPZECEGKK^O z>Xff`%x^Y-Ms;&(6ouz^#QKZ8ckMWQ6ya?>8zV8qB0Jdu)KaUqMt9f7gS&#M!hm91&}CM_!VoO3^xu-V$B zdw$`9gMzyxJMR1Lu+mfVW)-m}dv(7p?gmpPe{M_c6d-V>2SN=Q52B!7 zVcHSEl<$S(q%iMGF73vmlJboczK6!|;j3l3uxT5184a*3%gOP!*d7jyGgV!hNv*G- zzE>Y#%ui5R0Z_C5|JLQ#uU)$@(d|0vSp3uVP^hc3Q@s4HawE9tJ$-txKBF{z{&mRU z{ANo;%}@5@R()Qb-K2vc((`93?B<8sA^^LVoRsPPf^Ez!h~0YVb`2wi2%FG4@)qN$$EeGq;0*af%o2(j<> zrkt_Db@zQpOtx1l*HFN%F{w)fKI22(oU%q^=zzc>J`T2=8 zoH_jKkgu?r+>qHdrqtf%c(so-vM+0E`mPKN$h&PFD=PBJo9i!*=EO++ybeaQl)Ez=;nm>_ zGWgCfi&>gjT%x}K4ZHZelvM$)R5n^aEVieU`csbA`=R)29Jw$~LB7p6e3MBZ$>+Qi zYWx2EXo1@toaZ&t4!%b<5yF7fdNusx7jDzSrm5S`0Ccsb#Y= z(V?@vDRv*|t^n_bZvho30}0mN-se5c9-J{=e$G--lAi$u-pO)C1&hucl&q}L;M|>P z(=7vZGy@tTH)ixjJYf`ZIdZH^TG_arz?rF86|naV+;to`*eTp%7IRBqy-HZ)C|9M|RO1X$gsf=_znxIbk#*0O(+ z%Y~Q}wZRrVlmH;l*uda}^OT>_`qsK`-ix4+YTE}7UK`T*F>liGf7KG`(JHQi2l>qf z_*u~737R4dBQ8hHk|(_m*)Fn?&-LISseCx9eYV-2Q=z@AEFJN19N0_FR|YfR3*d*R zr)D^qic{2}RiivG;$erJc_peLl7mCK;_}`<{Ar(~J6uLXd$eCt6nClJgJLt$yRB@h zrEF2;+sw`!Wo}|pG@qHsVoObPNON8fi---@b7S%aYo>A^y9U0$O6AqTsSgcctupLp zx4hcJ0=LJoxES4Ud%(2j7DwUZeVOO^ngA}n<%-lB+tDKYd>bA4^((`eNY;h1-Xufn zskHNg>X_nM0MmNY6fqlA9&V=&HU~;ioE-UWx%}T<|MFa5h+^m7mKO{Ty?gg)Uaag3 z(8tDi*JTV1lPcVTiegSN`T<7?Qpk7yPUd|jU98n6skylb`^Bpif}TeD`}{ExK1V02 zNREdwP>?}guZOk`-d$o(p|hUfcKCqyODR~i{#f5;hD}fK_e9|76m#ifgf^aNVcz;; z1?RnI(YP6Zf7#NrTh76T(hAC3CHwX=s1(xvOPoeWlT8yRYRjahBq8mZ@a}CTqof$h z_rm@%UT+pGKN3T3u2Xj``TB~u)8}oE1!qKLWLhnT)B15MG(Vf}KzJVZ!2m+5;ukR? zPdWE$ue8xKb}hk9WD5d3Jba`fuJ@r0W2ysucfHrOVx!X2^PQsY-%`mt`UM{sS@e|6L+?q(2e&Yg8^K(kgBMCk z6LT2i)GI%5Ti=^604m8AQ0`2<1)N4!y5@Z>(Kb&j?4$MwJLE{SdcJq5`mrWe$40qq z!V4^MCVw`@VdtfOJd!2?i#dhL(cg92O%$-LIc&VPeVwU0UR~G82RBYBU4Cvc+tZPW zNm{WqurV>BrJqZ0{F!Mk{Q-RYiZn%-l2Q_L(B|5v`uSqpE-8t@Kx)fDp3M)a}v_hE>{K@zUS38gAh}k(y`<2sZ%f?1+KjB8e?lopl2A$)YJ;N z6WUc0`ZWdf!PhKL{XKGq%**V#(!H3?(a~2x1cDQvmLL}S-%H#VlAD{%%ode3T>Sic z($Xw`wzes`xu!-&fa4`)W*SvPDOYMphm;M0TxKJI>u1jG*~sPkpLi~ZfYKtT1Kf2Qouu!jwYWjkp} zOMX@@7g-JTR4W&BA-d8D?ELbw63>WCHv%kbMEeEGu zl}Rn5CI3O#_)WRB^NYe(yBU&x!HewXaUJ<@BD#mu?!m4&`03D>*+&(Y8l=N!iUKUp zvoD$}S(Hpx&Z$L(<3A@~x-Hkqs{(-ZcXf4Nni?}VWMQ?| zP8WKyRLK2g`@MPlP~h>1DB-b|O| zK`MD$!I9HnWs3sB1`tk6kO=FxA5(^YK^MY0J)T1^TlD?ujvvv!wjbzP%c5=TPC`hpPyHwt^wkqPg>nFA&^K)b(RlXvVR=**W88k*o-i-BbtqB#(c4Z5=2(!JFaFHurD?9}D``WfJ*o^CPxXha*0 zD|4Btx=vEdD7ir^_N;j%>SJ|OXOV82$nh~zT&_ocp&r z^uM7p3dYakAuCNo;ylB26{Nh(~Zm$07uS-Cge*A(> zL?ls$VqH~W`msVK=J|sMKkyhau>9%i>Y5uWD2KGWUU|Zh?>H@G9jX0Us-{LaO@%(M zps3ojerBj3ZJTkFT`x=G)v;K#Sd#Iwa(|O?Lwzm$RL!+lP{!h|@TAn-$nq@tmSAgb z=lAae&Xv0iB$}iZxK@^1`W}4(JTUTyI&Wf1yqP1Hr19PH(5S#0Xi*k?O)U(n&T)B|=Bt*hxVv@`qS7Bm87 zP{rvY^Q@WqQJ+2mca({Vr9Bo{^lIlLxfVYBGHl~-(`LhZHTS#&NFwb$qam}Kre?77NdDJ6tHK?*_okwWXv1htb(oWClkeje~Sne6BGrnajX%mPc@>cuYp zab#aLeJmrh6S^ekvQ3FC-<}_>9DtIW$17}b@E(l4I8A(!(k-=j>WHmOQ;d7`;sA}i zv^CdbyEd6VSFLJb(CtG)zO{r!n|6%C-DN2RC~Cj@>r@PVa~0Z}E5>*^F*7qWKW{(F zB1pA-zqeJcjUFGvQ~8*=Rp;J9SwqC6bg#aW?CQ?`!7k~&VPSTxS5zoM|A@*~URt`L zez@2y?09hq$%zNLl?mhD-5!`X<=&M_3R9lB^pV&GXcv4l;=rTOy%2gQOaNTE6y%1_5QpaivOz zMtbVGSTSUz)DUEX+w@}b?-gTZcb{dT=jP_fmavG8vgL~Of(ZU<*@0YMXG>U7nT0IG zZ~kWW*(;h)E{R{Gw8wM^?5@(PWv02uuqejKec?+f32atX>rKsY$Q?f!K0*GYRx*XW=}VUKj`D}kb`UWUc&`J`Df3*`uW)koyC>F zoD9rC{q@&UYSN!fw8hBK6(Px5IbRUoX6=wZddXFN6DAj{E4^^wqX(R>dj@rl;7l#o zAd67!&|&&DGZPmcJ}O^$?%amF{PDVO(niOr6;6zc?Pvala`(23l1;Otme*0$w?7RP zDK2~_)0M2tf1?(dYF$JyyYL*zpU7h(Ds1oX=LgaUC0Jy0urr};uo=4L#l-d};&MpF z$w6n4mC37oqqnb5?TT=3w$}_$z3dSlY&SL(%rlk8Lzu#21)`NxdK}vRYU0FL-FbiDcf>A{8j*Jd6jL*Br(h8Z!UMuIDu<-eGpZcVBj>D*5OQk z9JQkj=57$Hn`6)Bdo;K-y=UOJXiwZ_>aKh^<2Vhc;NIr<1W|06GhO%gEbBHPUx5R; zy_sSCT;1RHZ9iXVBfY5bB11DQk?9xR80z5J`0KZ$RfNQdOo&&*+X~_oYf}Cu>ABNL zs)VEXV!MPNaQFehCa^fjZN9Msf6>43Rgz!$+!TFFK%+H+acU}ML1R?!fkXgxfy|7T zxbtw)!t54aS|LW;@>zUbtUH_&D=RFKk&=9je~4(md=Il208DZ|&_Zf2IVQu*F#Ze5#boJNG$D{_S6DhcF&-L**Wc+=fz4@RY-Phf$Jv|Qs zsky*;CgAfJ#R!LW6dz zTaS~OIaP9d3w{?Q-wT(Hhw@hmMKSsHAF?IG%v=k7=@dGFbPOm#C{7)J#8DKAwAYO-@0dOZU*Q(d78RA<04w<>PD7+3^k&+3nF9L0=Xb!K@0D=d?ZwMpmn%hcM6_&eeIgIwFL`6j*{m{rw zgeg?0QrgSRc2qUBBH5Oeo9c)8Wt+wHptWb-(`>!`ib23uw;GS9iTlS^_pw?^x2X-j zd;O}Qg)3zmfR}DaKfb`O>ol$pVt`f+Coa}P*@9VQ>%88xk zNE!nCEtcO#IgOuzw!G*Zl4^CvmrtvEjD^Wq)j29!^G9Nd+L;zOpHMj|BV=6soSeI| z3m;O#?>A!qN!R1qO^-&4N+y3vau~K`ut#KA^`oCRHD3z)T$yRr8$a$#>|0w+w?5Eh z2(@!6eU?VjR(>gIM99xRQY>;OK2dh}eTA->3Z|Hh1889SxN4-|(V?)}|IMlLVE6^d z4#R_A&r&slV)@U`&TkiP24Ds?2eNfo^s7AQxe2R+8d&Z&fd{r?)@_m6`q%!Z4C~i;Uwa=qZL0#Mk>H~M^8@=#ihTw zxyi@FQ-ns_jvkOctW}L&2Taq@!otAH%5}bX4z$SqWnzS!a`ee_RMIYVoNBjM%XIGU zX;Dd*sk!eXBw(q|t{B_8{2Wdy=!F8|v=#zzp5tDMtgOoxIySe;CMJjy)BOuWMu-LddskIL_XV4iC!(-WhU}VGsn%=9kdN~7%UYq zX?QC536=!EwKi)*1PWHyR0rr&4>`aj@!H0QT-O-dX<=)9h6_xxw-*LjZrw7Q?WAbx z7_D$~06hz9Ofk*9Z`Jmbtx*otTzUt{_UiCgVPRoHYIb&wUj!XgCiROf+BEdZ!174a zcgZJC|K(l~uh|oQ^OZobojVUTV2%#@zOLtdZxkhq!qLIHV*1w3yT+*&jp_Cn7AA21 zU{n3NQu2Z_RZ;PtyW=TQZ!K9xF6hsAYHIGZMzv6L46jU~7_`wjw$Gl$;|Zj}#yQ6# zn2vUSLg1?W^H1ozQZTm)3J8F~yBxxq{uR-mt4xdtJ|54kI{EQ<_j&8zQ@y?nIub^E zC6Ah0rm@3#krKijF#I(Ay=SeRT+&_i2-!n?9x~r&UzkNUxsNt2UVyu|b*)Pra z&h6WO^IsIUxBLDn0fH?xNMp=CT#|k|uU_f4A4$AKpO2YnfQj=M&rLQd%>6%>ohu8t zC{tYb1!;-d^^VLyLLWCxet#910<6uEoVqsF)}oHHp@2Vu|5TDp7!#PS!PNK@>PZMe z)|h^#U(1aDP*Ej|9l>ff7OsNv&iT1Hn1}rw9nFq)j1ekTgF#qUOr=LhwvKHTS67)+ zi+c8`Crzqp$I^AFb98qNG$Yt-*&w0{KK~(+Qr^*)UHj>75(p2(Adt`kIowVe$kA=- z#JJeq>M63MHr~VZXJek3n-67bbST7(0Bs|}#bt4DRW;D(_3Jc+7*3|GEn}%5TCI5T zDhA<8a&bpR-B@bcy>BljxTJ%>IPGmrox3TK0evvIVAid+Hm)_Uy4Y>KW}zP+6g({p zWg(FaDR^qc{S6&{cJ|Eg-@nVXf?qLwW@S#9Mok}R{fRy8mk^%c2+hrOjU?wsvYAw- zF?a^Nb;}O%j`d*P)C{9ZxY7^@3~bHrC_&OWQneVH=sJ(4#8o|DzK0QZHtRBh4-f`2 zVT^6HyqPVMJ=e$q;gMm{GfXb((?&|Iuo>@fHCp-qxVjForn0SzI(7xIAtErwQKTyf zC@mHc1t}uEsz`6rYZ5z6K?FoPO0S`XUM%z~9YP7clK`Oyl7GiH^PcnHZ@y0)Npf@U zIlHXA_S*U~fL;h{#l|M)LTJ66jaGl6HfG2ba2`o*kDmsyVfv=rF8cMqVV9$k9u`ZZ zz<8iRZ{12m>q{@Dh)d#I_bXZS`*`Hgl*P$MhKxi)SqpUIwdk!=YBrGDS7}Lrn027u zHcSfST-4#4@0?Y`PS5By|7dV%n=^Mf*~9{EP zY)mZj&3i4*PrltBq)c<@f|rd~<9Nj~6%9n)nwO)}L@{3#Z+7|l`)`bgcA_@(a&z2U zn0&$uTsnvYevs`X4*zP)qSg#Xd8un#Go3Nq%P73B{!j0nLO!(@Ek2RoPe`i!Uo#2% z7?P-+Vyx|+E7aamY5|RQA18vzl74^wi3m!5wk!D}Puv1!bUd1{pP701j2~&Ts0Fp! zOB(dZSov6k+#<3Bs!^$9p##L?569l_k3Fb@M7wBjf*$QA^{BBG+o+*iUw4Nj+& z4K_8+!|;$x!or=6rRyUPA;!uzZLu&BcQm6BXaXk!^-EUYo>n&u>(4dCPNYIHZE=*4 zUr>ME9@H zSoSb+ghxf8w$^=Y28uswxsfL_%-f|kHd&RzmY%D2Xr_Hs@5@&V*$t>2E;r3>=xg0+ z5k7Dx2n39Cl6K~68yHAXjJTkrv^w6xdb%EKqof4?5eo>^(kFFzyHSI=R$Np$8LFUP zkNGm9uRFo4!28*ZXb{)@`0*p))9UY!tFUJb6e_VEn(3?P*!^;|JT};5UNTEA<*-DK zv9eh$Vdkl48R{fzF+-nUcbwIzK7J|Xz38r&Bbc9T$s9|{Te7(o>|Ge|3FG$I_k_?4 zck|k(%$Kk54O*I*{p%Vy3;}a$iA6}y3#MtMktB*#4T?W}i z%s#E&^I5C;dR-k6R3ny5IylH-fERX}y-Le@*jo^TN|CzeUhB<7h>n*Ea=)f%PAo8L zN=zB$;$8cqwzhkHb6&T?x?`wfKp_QbV+8Rvl8T>6NeUsvr1xp>C`VIh{pdL?O5>vj zh<`o`9Im(RfawdfU3U37c@}4mbX2T4D89TI%)iT!H99nu3-R&fM>$banCLKySAn-_ zgP6Hu$SOYLXC9;8)%UvIetjXuY1Y}qSX+A}kX1Ob504+j1P3T@L+c2szi4@- zdoPbLL=q5RKop{&90j8U^m3leM_vP0zq!(uFjAxL^?Llw)%U3b%cQZoPY^YDdBxl} zn3$LVL59srAAlSe>+dNkWeOcT_FzlBy03u5BfNhszJ~tf6C?O=IB*Dsj|0HO`hU`O4+_M{f)!4{qJkehie6$W4Hx$E) zJg?mft83(AbX=XgW}Mi;fsz-i041>Wbcq;Dx$Dr^{Y=zA*x<1`aW6Sl^kIrJr?_MC zV-M&qg87yDy{tPrJ9_S8{n=M6SPv$ak_TbOwMUzuK5qYXv>BA)#{4FMTRq$1+-7rc zZG`;Nz!R;KBIj0EL?{VXpGi1sf$sp?^0%#)isJX~t@()=ZLhK2xdZeAv6{0ddN4wh zYR5a}0l=SyrISlZWeLA|>b?q^rNcz3wiRVbo{KL+UMD=T zmIEcUrUdh2gE6AR+q~17Sku9$X|s<(WZ^L-A$f1UkyFNOj_E*`f~EkWzIc2@PdRr@ zez_?AU|nYOicDqe=hYFx$3Ct)y&8WXtC*Ir(W6^bnVBgt&Mo$l{0|qPZuNd|Psi~08^G)*ZsCtQ@MIR(?FtVNx|X>?Hq- zij4`>_+=P}D`_ZmI{-}#(cJW_^*w>1F4ib9vr0HGEDV>)f>hCf9}AW_@UqdKcc)tA zWY8PNqv0ZbGGh_8gSM>*Etw07;Zf1(9~~WIU!R|l$9+Cp+uCX~TD=?p8Ra>H)mr3a z_VMjNTNIU{y=pMqlw$*6K5lNvHBlX9?@o(sPAA12ICzjZ zyXC|)IUr`VeQht1zx63BEQCwuaN22+bc*iKaCORJpcG@|%De1B% zv3_K5--ygesaNizJ-qpohH(PT!mT`+dgmNr;H3 zvx0JpWb&Us>+5qOlcacHMv>}d0J}uyA*INDFqSa=ZqWOs811BH8pb67Llc0}g{|eA z%@X;yZy%0~D&g)#A#%)G5D!aN&hQGru>Bze(w%1Fi{%w()9qAi@Dm=oX zqE)!pO%Y&Goo0?>4w}`zkB*WkI2u^&&Jx;FV{SoAR*o~LPE_3U7-mY#ZXjeeo z?R{vdt(jS@8z$ID@!nhcSNT~N(J!1;-UkR7Sz78N!rWJUD}37%6nH^MGvW6Au&_&y zWHh?;neCj>Lz<{yLvxs5WOU2ut{_dB9vpS<+YNsHvm}ZOCip(yjo!U`H%vYUc_#HB z$kOC4DAArS`Wg#QY?)3SeEIV9hGAWy`&3Whwj2{Tin**`Y9;DVj<8$@Ytu=u?%?0( zQww7yE~LSi0t4kJIo3}Rp=n=8Xb7}6NBnxhsohmn1lX~}dwHhwfrC?fVw1d+q2Eb< z1GHN(fP&t9I?JFI!&dK5m|||%iud9y=R9@lDQzbVwzRP^$Zq7U>9Y;!%X(yV^X5o@ z5&0y)&O;Lu9c`{Ye7LB^GR;r~IJfbr&dSQdyFnFAP|gkhl%01)@UoGqW_xpH;_BNp zOLom}aflgau9~rM@+j`q*Q2g7%szYeLHQ`g%#4jK&FjMGl-cBzS&~$H>CvF=~KG9?RuXMma(&|&d;=Hz6LT|0Nm{3R|Pz7xr? zo+K3iN&`kBd;Zxw+`IDJA8~h;D?lHud$yb89Kkgms`YDo+5qg)~%+_<>f=;cQ;R- zq!CO7d1v#z`%5&F!&v5f&-5`Cc&&L zJq3=C8;@AI`wAY|3-Xej2{0WD+8@m%4WM7QJW@`c2O-R{q5Cf?AgyC8VO>dQ>{kwEmF*Y)zC&G;c0U< z6@s1vK6Iwr|a1Mjg2i_`q^9LFSNeW-3b+DIJk?8 z``zFxhFCOy>XsRUIp^((DCkgBfetPemG{BH%dK+l1y&nrbCr>ik-^`fhY4$tu{F8M z$SQOv1sN$ul4vT6ZG%CI;B490*jDB#jfsi}xs=hpgXJH~gXn1il7Zbl z4Q|}9!bB}Wf$c429`h85+A$EK#;0KRThm}G9>e#b7MR3z>~?2e9(hU9&!emTAFeVj`v9frffU9Zc1fq?NH1dNlDlS%RMY7en7F)`l2hSI!Y0CoUj;67a>Snj%Z z-v#u%3d|owq}J`Df8GCF&wM2uCL+BrvTrs1x~_!k>CK>)TRU#N++$&K=#X#4j0&rj&$EUsDgTr!Rf418o_(gpYj0b|%+j*?*Rt)M+K8UJ({`}&P^ zLYdgP(Qu(tV#KDqL4!_?jvacSsLOa5H4_(*`0+kO{ZKlLlHNWC%2G$k_3c|CVwBht z4Fijt$!ZCF2M-^%9+Xs*IVrFeeSxl_^!3>5LH6q+5GV;CU|T`z7f`JEV5mF(Zcu6+ z<3C^L*Pkk=DCwvpM@LdS;+^JtsGXXIMb7g&&d&Z|!&6f3`c#3xo$AT{@zVeF)u&&- zKHnu@cKp<-OSXez0s<@Yjg#Z!E>k~01MUa%HNs+I1vs4g1lK)R(@O70u#dw-L@YW! ziLd-WVr9T5vHU~-$y5M|;OBf6~ddCm3p#m@8Y89E}C9m)5b`)u0)-Hl&_6e%Y+ zS0qT-6rEUBU0-iOo;bWlV!sqid$wa+L@>rZRXe32@!rOD*5uCKHN)MhNq#9TGhHc~ zx7DA96gx{9t%?cDJXv12Ok9y#`2ZH)_2|!U|FH$?JnGOXvU@c=JiNH11YEp2{mBot z0!l<_S7u2}G;r&92N^z?>vN>vjN5gP_Vm|0-NmiO6A~4r4+Ho}Sfa-npxd}>x>M53Lf~Zh>CXE*kppaZObIKXXWJBJ2>!ToMJABv9Vclan;zT z?^fAgT}H{lJm_XIm`lX|AtY?erzL6nZR8qv3d?fHuUn@_a_69V3MQ2+-@BLIuQ$|8VTLM;tKOk)n0(+z)%c^rJ;ZZqOgL z>B|`F`(&V5r`YpRMDy7cbM7@mDc2`hZyA|4C)9`huEMKBymlgE-4_=YlC}0CnHSgA zDquViNOSW@KrXNVmbe$6V>}ANyvVl9$jJW6NsTv?~3QC#NsA zFjybB+q$|sD82*~cMl8aKyx4hQ>%Skyz@Ypw zIr*xQ(Yaf}o!+p-y{@#ZgT3X2D!&Y5m)6MK9=9$s& zkmT9$7?~&Qe%N%KGRdtDyImnS&JmuS{0xU=CRRJ&qDeWTAXBs2uq8q}EiuD8&vN@- z+R1r;4rHEF&Fyj3XNFHn94(e|gkq!iK%>2gxF41sS*zs3o{9RQ477*yX>tLaXV$ka zadAx&x-zdaqnFzf)MEC$+gv&QGk);_eloJ+DX~S-QaQ$_^y%fIM8%BiZ%v!auHVYa zO+(78;e^EaV%T=1ve4@sApeto{do*jh$<>DYHDho@z6-YL7a>c+p|Y>f$TAc@%O9U zAe-Z$@A8J~Z%ZSYnVh`-=CIWA(M<>nUcY`_U2Q_&5U(J)-|#CBU#cq!56h4c^{FMJ z_B2tqBxX-{AwGOMPU|d)@$+6H_$uml`*|*ne7&D59c5`_B7lI2V1qfo<&hiKspnzUbVsl8|k8CKVI30nVyX;vCM_y1i?K{%SATijZV32nR0x zblJ(^m@o1&V?6ZRW3vtZGC*S zWv~RZU0IOC7g@4Zw%9&5e@133DMX<>45?6b#l5m8RPL>MHK{^kJ3_FWHsME-z>#N#Wdgbd~7WE_f5w?s*T&}*M7_uQ&9Z=s`dcTeY;QP849g3NE zb$6FmdTt2iFQ}Hp#26Y+LLkQRc(63a+A7@ug~RM#1r;W+o=q(+3S(v`=o{ys>v~mH z^#v$kCu4V3l$J^Y@DU=P5IV(>H&9=^(rQYAtSkaeurz-JR1uFAjKlY-7!3jKV$b0; z!FS}<<<@jUi3s1%ifkdYQ%51O1^3S1Cvv58dH9xroqc+Hxgri92inngAarQ?=+o=n)ou}NhD`d8|XR8 zccgVapcXW}guXw*C2FMRnkigQ8cs;etj)lO`2o?G52#yeRpwV?W* zYPH0gRi^>zAt{-)ucsq&Y0$KOy~pR)32$o6n-LBasa!<%!LsEeo5kw1V={k<@ShhY z=9y$Cc@?M*Bu#aEP7}IQ68t4>uG{08>VPIhtsmU8t<(JLf#WsF^PU4X3(G%iVAEfC z8HCas8|Ut?fu3Olj2P$PvH1FI2Uz!K7BlbGxYD(9b1I)a!xHlLb1oCx^o1QR2&_g_ zk!7D$kC|Jn#BGaAOyVkTSIe;U^SWkwkmT!6{}f?i;bLJ)@|{0?$STXa4u2alh+n#a+aaYQ*i-eIvmR@RJd-i^sc zkXIoMpyj$cV_c!x$u>P!we%MP(q}bfwmf%5o|!dk*}LbJnSbY%Lww(wn{Tl8*Oq36 zH8wQp;!HMNpjDKOC9Z5;eslalJdA0gR!xDIkpOT8p*nm44YE7n(&)w^7$J0_m{9v1 ziPcUZ$uLNjxGpX&43m=L^;%sJ|C|%}Q_Tll3=*l#eEHJP6^!%T)v<|*C$_e6l%MWf z0lo*2k}0aRZfbLNqKS_J&Qijs_I2=>P=0s1wgPK>yg~AH#{|Bt{9AQ!GD2@P4CzW1oY+C*4DaEQxRghO3`nj-V#QjN%#HLP$k>zR(F$C=vmaMq*t;8jS7^N)h*+u%792T;CE`8j zDyg~Qr|HUj*2mX(bo#%1`7$MCdh|Fn96&jdZle&YTdtQ{HaX7iVWbx}gu)!Dk>%u@ zPQj6p00d#71gUC}7_WEtPT^Cs$w&Y8LJu)6K|xxdEplPmF=gQ_NaDfh^wq(#8eS2R z-yRgt4VY8sy}sc#EuFVSi!ZR0d(OEK|1?9>kTrNJ#AUR41@;tTggBvHz541^ZhdTd znw*aU1kOzFh(zLfgz4yGdB+}wJH8M0*w~y8K)p|!))ckbxFu6vCcXHs`vSlsAAx@b zF~6Dv{i_8A1kj~GU$3Qh&Lk%%(?djgi{A7ikk6CbTanigI>E1f^>Ke%3**#ESFjI~ zT8t1Y2zEAwPpnAac3NJ)4F4j6#*e9E(gi>x=SBab?bDSR5FnxOiWe9DMJ*uYA3Ajj z#1I3yxiy2sULVvf+gi#CHH>zqI4{OkXk_4X(A$|Pijo=QHI(>S!2WlCiIHRt3U`;4 z@kB|9+UOlQ)4yN`Uk#xl19Rj#CV?aP-z)XzlQHcO`Od7*CB$2#0gvx>bx_aKUi-Ww zxSk-W#hR{Npz49HN=>LbczSn8_V(j{+y{P%-#jXgm3uH1mH<#pFTSh~fgWJDac5GO#!A%J4lBVjc z#0~~`7#ENYID+rIdRpgUHqrR6OxM-vNLW1*eT>FE7-U-kh2eQmqrB5fqo@~;U^(aUdup|4)W@Ci? zcs&liT@6;A9aeHQpvL#kicA5Djo51joLga=3>N;5r z8V$(1kpu?g=N{W5#Ms=)<}4g;ZE;l!bs^``F66NwRca%vN`nDO1&5-Wu!wQND%z)GT zl{j{QO4}ZVP{Dl*2W`4HS#jamwOtGXVS12^efQ9$cptaT@#ZFs7=R0yU~v!>UK@h z_AuhSk8XPoY|YJCFrMkbp(rZ0wgvU_7a4&-z%99z7ouhk#f)LL`@mh zAV6(Q2X~+qWyWCqi8_pdWZ_e^-AYyHCO6^0gXk?AV{;Ko?#B7@qRqNSCh4$^=c{iW zqKY}okPpZ?{y`3qP+ZUVVZoAjHbF3=z_{;?`=ChVY=^o$<#?Zq^)>sshi17aA@11~?O_MO zmTJ3dG-un&r15OA6H%QC-T6a?FTu&sAJ~yV=yimWNwAUIT@V?o*jiF}{P;^~sOE_$ zdt*22i=#xA-?id}gR0BPKUY!5l2|a;9Xw~H1znV3+u^)o0!Ue62L1|fY33_}VAVVM zhy+TJ;mPAJ3m&uMmyHM*(`mtm(W9d*TUqN(t=LfJ^N<>02P7gby3wh2?KOq6Y7!Z` zw0TY(fEJ+je$%76CW*R6z@$qZJ2J$6WTBur=)Wru^%mXp=k;N38=2hxL$h_2#FU$L z=^&#`GUX>j{g45HJQe-P1$nB(d7Eck!5C!ajS8?P0*;vv3MwBX3D2fJ-7&T@Ht&qn zt!P1R;_>*~9!=fCEEALC*7#xr;UITzS?&elOIMCF&wu%56Xn6)V`uSwtUKTgGMSt2 zjL_4L;5Cy^5hswXy4G6tVhid#Awri_PQr_+y(}Z8S2|zGSKFVKKe}nSyD}Q6imeR}6wkEt z4*je4V;y0_chB8k@c0c+cO8+DgVy+p3XbSkC8jNlC;3maojyGyedSpW*u;`2-|DN# znDS5d_ySs;dxYaan?38NMMHbQfkm!!|4IYNcG3685*XEC(K(uMTB8Q9KPkPnHm&F z&P)wGF?#SI3|T56zTx@d_3MPCw&FJ{rPz<2myHZm?QfzAyd)2UaM+eEYp~JbXBak1 zOG^(A3ZU1%)-Eu~!_g7u*`?2wGN`!#qa7f4s>NpG336!V9FuO@m?`r$4(3(x)J*sf zuGB~&v+f++YN<{J<6-j)2$1Nj_ck+s)JyKQLD&lkeaXsNxY0lyC`nRVgD%dO6prm? z1{6MbvZpP<($CkoKKr*m0EQ@EUtidy4o(?yqlJr$lfptac{c3e0T}9AfIQWifJTW0 z>{VamZft5SlVp=jE>`{l;vkP+-o~+?!BJL1zJb)7WQ}yN(_u?aTSG;sn6_DLd4$(X zl=VCev^05ldebuekDUz9X5PS&4hN=V`qSqzZIz^slm{W<%nV!a#Of)ejb6i~+R?Y8kRyH1@xt#pQxFT~N0rN#B{ zjm0oCXE%lK1}GlI^;>j*{cdaP{^!r7ivvn9m`~6>)9?{uBRH%-kq5RQt5`g^rK+kb zBrMD;!p(58uHrLR=uWxo=Z@VUPoAv*6UJs$CNxHfg=9W6_9_f>dcfM#m9Ac$(}MiO z;c;n8XReA~#Fsz~`DD2+F1rxeQ%HQj8G?)4TwG$@(_bnoLLr3db3t6ndY*8;DTn?m zQ=Cwz6B(bL4g(}SJX|Mx9uj55QD)}*y>2_c67-txXzp>_aKn=Ue5(JN5$z{*6|?B+ zQ+D6{}O~Kre{dav3BeU~HW@cKe@?h)OEF?5k_H2qVF56mJJWeIi37tGU{=PGA#0i^`$@zKf z$B&P)vTD=siw0H;A5cL}e;Xn$WpvJH+*s?0-SccqeHNg~FmF8SJTPA-r_2%X*5_p4 zg&Xf0US-WFoK8200b1voX)I$eSV4Ae4yCJe{^RupE9!3 zg4C5&ru)O9D?Q;q_q2b};OjqJfdAYdk(jBP!lO52`tTu0HYz{od{!S46?E(vON8g5 zXHUw4F>h$W+{W9sZ?<#En*5FYGL=nL>e?HNbFAR3Wh!fH%^+z+2;+ zd})qEKU(&yueXbLeSTze27sGWV9C1B;eO^5v%Y!e2{wkPUYYLBJu^2Kl5-s}ja5mg&f}93;uD;Sgj^Z#D#KmtUmy#XIKy&Nk!@_!tIW?SYCbJ~xVFGpfMc$H!-8Sq z2(T_XvQq76p1*h%j0ra8Q=Qj^Gbi;5cyf0||Eae2+qy*G1M7C-LUnYsfVe+oC5sbH zFF}mm>F;%^yiVB9@RLnhS(*9nojb`3U|MmFjcGw$`b$GuapPSD)RWjTFC^Uh}!e<}wjmoj- z`e)Xx)#oC&-Hod6k6F)+Yb zr)9kY8+~WzeAowDm;3bFTDFZF7o-ez1 zLn_X|5Y0!gD~Qk^0?dlaSlADC-n1pUsi`TW0}AfHUo;(9eJXWOoY8$sr4ZgMG&Bt? zBK*qr-i!1%5fl{s`$@u^z>WbrXGl1l0ard=4Xd6aviH9q=5e_1P(jmm3QQIz0v^$q zZ=E~~^a{`vXou3ayaVi>!Oe|7R-WTNjg;^l)|baCE`LP9yQv9U{Zdcg^p zP$y!hBKGehOJZ_zAyg7NENS64};=P}-Yz)(RiFHHmbL3pt`FA*3SX<=>s|Gp)>T_g^d0J~STa1s5^%sVP1w{mfhK3rdJk-to2wXE1*UAw% z29pAR$wm1vGq-FK%Lk>EAMRE|qtTnVLro-QN2|s*!;gNoHOG)yIeBd^&g-UHxh62Z zS8U~90a8Mt0~ckassVTpKaGFh^7?-G(4m{RcKvhf0YLm286Q_yQ#;PdNt)IDw)b3T z%7dE0L1_fy3!p(EQS1xx3U?Jys5adQ=dA=O)}dK3;4F8`m8Mserh>|Hnq1j-@#@=< z1ob=Df5w(?gUj2DKhbP#YO1{HSPx{Py5gvWFvqN1Qaf(4pEb90hHD&q3reNs88<&P z$52{2lxr$Pm1O8Yn=E=Vhb?SgJ+P&M##w03O8ma-dzxUx*@>fj*5y3EdKcU-CM$EB%OP(itR^%@OG5-Sd=}ty7Jv=IeN9i zYqdi1kyR3l`(K8VwB$b6#NF1tJ>;s%ZYw>_BA)~UdCTsChOGp@yfli;n8oeQx>|3Z zRH6i=D>EgwN}EsW&&|tMd<+C2)%%PzI*%vkXy8F^mL$xEn-^L?ZOU_Mz!1Y;TUXcV z@_SYiEC2ywf~ttcSW2$<-$uIiOLjBjmywQx6ZovBudh4#{y9(tw`1IY=+M2pck5u! zm6kr^()U!oIcpFVoReK(z~S+vA-bfFb^7uolTH6d+xy`k2B*?Ve>gpA`e68Y)yvwj zY_UY!p;W3==1KSSvKC3gISC0$U~^FfssIppc%UH>P{E&u3F5eU^4y~LCFbe={Ly@Z zXur2Y(_3YUGC`}E^}1u#rRqM}d1aT~wnk1gWSSaa;`Nnq>=h9rlN-^fBqi4h-=h?2 zQUYfSmGA7e6yIhqG=$~b3qNe3)B69NN^mHV1qBg6QENv0<4|O?{`u;uA2LN4sCFpsU3lf|?@z+xa02Hz#E;vUYUZN1 zi@`tz^Pj)4-P}~~c}QG^UC*~9k?uf~Z-N^-!o0Y&1T?$$(a0f4Hf(G-n3-=p=S=k( zWqy=K+tQc87g)um5P5GYDK%qfyI;xPj`Zm(w_)8%xwAA z*N!^RIa=LwR&u^&8>68tHGuW7#TBoU&h8Chr=r?p>Rrb<(~L%pWMzsBjfKc26Zm(t z%C}`Jt7Akii|$`0liEHz%>F!SJn2Abp1&J&kC_>&Q6v*|27QTKJ5u;d@}neAM2E%z zHL<&N`oVy>bXt-71?rry2(RvIpi$+IhQFI->B!5!Z=)x( z={Vo}*MhBxj_I*c7Oa-Dq-0}To6ui>CVM1h9xgj=mdUYSBL7jJ$*o;Krh^jANIE6v z+jX^1Sti}(TZd|Lk$u^=1>W)T2|PYNwNq!$_0JSp|~IrIj!Qx0YuIe@R@m|0U^oBm})CAGmN|0(Y_2o!Wd!}7VQDJ}o; z1PB-)_+vbHFm0~m8COTOwQlgY5~D%%)W|CbpIwIRXd$7S9!o#M+BF3>KPym_>Kp2W z6RDZ>sF#IYbRCC_xh~39eaj%}iR{-_@Gfh9sXyvxB zuyBHoee)VQI8E2tx-Z8vLiJk8@paj1nY}LSeKqO2Yjf)@rC5djiEaN^?3%>Qrci^l zN9u8NjbQ#O43_6Br#UT5L;>J4-xi~hvFVmtes?@ozc&^cW@_c8LW{(tpnm+e^E~H9 zJ-9R3zvk=Dk9(a*08kjdC`Ura9$#MW$lhZC*z&$&)9(r`H7>;d?5wQhj=5)Ct-Y15#y>x+_vL6#jEy<6_Q<6? zjkvlxZ}LqsNbmwil0t^!-@x8Ag{!C4303?ns^O{wlMhXi!z*?ZCKJ50b$+1<$M)DG z^KmD!T3uKFH0wF|vPJ(Yt$|cw08o+q_wYTh4^5Hvo-|H#V)Q=;zdt;Sy!y3US?2NR zXz}5hG{1=QG_sTmFpb15?y?7vOJ=d@? zrX6={(zi^w{IF;64ZX*nl#kZH8ICz%9_~oho6KjA*y9B~E$icJgd7`F_Wcs8O(W2y z=TPeHXx2%boz5MM7QZX=Mp7)R^MSITcRP)G)naH^y};i=UT5b0Nvl?;Gs?JYXJiJ=(E^vuK-aoVZ#!;0RWLSsZ`y=bX(Wd zntt!D0tl1ehx-C+&3uyebLk}bG53wCK(utZjgvkLYH>bTyB*Gl*x>_i<_k{~{=olS zu;t{vxbpm%0j8mFh}9g@)bs=KB$W!`b5qfWLV)Vuc6 z+F+)+bvv|(jZ?C{y#YaZ2J=UiK87}=QeYe8?VQVQe$Fh*}y za>p5-Ig7wDdTCZU|OTT$NI)PqsQoYVdZ*^22JSk(9c^n0T<6dX{gXo zzhdEG)L{u@7*2SY>P60Szg&-(F^n$@IdOQEs}RPntGV6 z)5T8xz?L}99JyXp;dEB`^5u<3#I=oT1Lc!f&`Vp@5~hZetGj2B^?O*s35Mje*vhUvS%3M0x;4Bw4<)r$ktO?AB z)LMs@G7*!;Sm*ihX^G$aW$1NVLSZ%*qAuw(%twZ-O-xe%1KKPkA6kxrz4HQe0=&HB zKzm~J45)}h3%lpiSRFlJwAa6 z`+b2x5x7Z8qB;q7?{>W?-&j7#TofLN9_krh;#7SDNbBcA(w-h4Cc5|<`Kv2d6Wj6@ zmV1Tqvjlds#nyI23e!3XfLXPTqtfb9Z^ zcSCl*{n+@p*Xt<8!-qSxf5C^zrvTJAPF`9P_gI}9jf~Yu18NHQ!Yz?uwZ8i@0)}O( zt2sc8to>vLvS#^li8k^8o~p4z-{6ck!RR4@Mdk@*P+yw=MTPF_HYkxaNNbzpG;cyo z3f;7b4>5*+B77!WxXJT6)C_Fm|H?)(WAmETJmj)B<(Gy+9sxF9zqm*8ePViMxnG)z zkf^jx?Wg;q22NI}na+c&26>)7LKrFX?P~!8*|si_y>&WST;1!A7je8Fjxe~#o0h1w z!RiD0#bL&r(N8lARk9SxC-GzhVzfL)vPnXlr@L4H@xg9e=Nd^?Cfeq-4z+4+wzVit z=xW4~wX2h67bpK%-=w#TMcbY^l76UJUlJ=txKeocn(`oKELO-{;jMCsXNqc0)pouu z@`v$qD(kI-l9n z>k;`&p~Y46hcO1ZsrP5!hg8r$I!QDP;Lv7wgcB^3N(KyBp&d`Id_`xHDz$b7kA2d2 zHCB(aw78^@`z0jI4F+K!J|-T5mQ+5wyD3Lu63tE4K9RBm4K4X5bp$Ut)$WwS@zK}8 za%OB=ZyZ=Y$X3>U%dRXf%ZL&x{IprHmX(N8yrxVXz?XpZ{;K9u0)zWz97@Q6D;ABqd9imUc#~ zaM)DEY_m(-<-IjNX;PJ7=mw)61)x7nfwiY2>m)N|q~OD^l?l#4S{%|=av@5GLmWM3 z_aQGY%T;9=>TR->!x-5&{4o|BE>j(tig0YlW0bUuGl6**@5yCK%txMGV66~GIh-t} z*y3d4?XIh=H~(0aLqK+4v>fqz9QkxOfVREZeF7mgR`lFF&}UeJiIY%FdlzcpF;%^p zS+yGt8KZzlLP$b_5R9;SSL`^RRu}EGD&1NR;kH;a@U}$BM+qD`%6EJ_ZH;% zViXz-TQy%;>W3->`Xo7XZliirYm|;L!3>@=M{iQ3|5-Tzkb`)IgqnZEMgJ##m-d{Q zPI?K2`2VEu*Q)?4jn(?`=CJHv0s=%k#zit2dI#z01s%9hqi9$Me@ilK;xP&XFk4k7 z^pj_1Wdittkms{B@c|$2fY7y6StNCpaH76JeYQ(d>4Usa6bNv;mRBYu3%7zw+h|%C z$bPe4erh(-n!L*2=Uw|zzpqWe(7nT(5^x5OS$+?rI(n;rH0jHT+7Q0z;TPJ&84N4D zqThQMPJZ2uIaSGAQcFo$#3uESbc}@VgJg}=O@Yk%q3;Arhkk{f)U5MI zZ`UptL5$wJ{{92bH$0QaXimq~4k(Jm$Pl208$B;(8{#P@IqUHeA1EY{QaIB$fJ2a; zeQ#{MM-e+5LhQ-Dh)Vk3!U6Oyb31wk&{FL}HZdEZQCJO1s+dBI4G89Uh_Y20fe-;~ z+FyXr{j^S?OFAyxa{8HoN&=7rk>k|jk3HGUZ%3yXR8X;^SlM@@4cxtSa?Oib3bM(*qi85~voqcuh_NkpbCsVZ)WUI6@ ztXpTSSGpKWJS6gNNm!-jE1jvjKRej@Vu<1B_j<%D?k_tL9)Iks+aAr<6F}^Avp>4B zjb5yAYj%hxO;RFNEl`VfKI~(rlN`&|`_8@!hF-0G4Fo;(ofvUfOc`ah=LW66^vKN` zMiQYfG^wI^GF;tK14(H+Nb$@9xr%JIoJrPamv?V$-`Z!{Rn9hRO0?@MbE#t7TqU+& zGJL%WWX1=R7q?$%ipD|XG}P&-g@i4RPxdn-u1F2dAog&D!rcvo(Ev>jOcFU z5N#Ql3(?982hRe*Fg7pGvBsa>PUk>)rX^+pnf=ldy*R3nxrz6Cz$J(>>g|}uQiqCT z{7c4457K6NL;O;2?n6?$){H{+U8^*^%GV6`4VO8QqJ)RP^u!ILH@0J{2iaFQTDH~# zDoU)XmS9VT<@!C|UFx2n3S^MgG)^ktt4mIsX~>e{;vURp1(x6#kKU^6gXM0$VmJ4- zP${qb17F6tQo~?q_zGJWlG@*%?Xo7xu)x59UdqNuF4l5VS0~Bks|i6ZXO2-+HTCSx zY5i-w4q;_NH}@$Jv_!{o=GnIi$QZQe_kuyv5n>8i1bWm=3pmcc>Z3_7R;2`4T3DRq z*DnPf*&{a%G@SQ6YCFeN6@9S~B%nCAH%)^$+%COR!98h>wirR{Z{ut$dHe$;x7Vi} zq-nLn%6vM-u3e?Q^e1>W>D^Wp34@}+>o+}2qeVquEg-uMDLoF#ogfI@)g`^!|A0Ul zSANXIBsnjfbfzt;rMdCI*;0cmo#CAaS-NMHyOD$L?GkC4ot>R!x$d27 z*lqK4cK4O;%(+3F?!M2;*um@us$-vGyJ=HDfRVx7iSOWAmDmHuj z(gu5ToEjoOxSf3^7~^t(?taj*Oe(gAR0iE;TXSz_qhppH?;G~eM5m!joL72d-jI8Y z1f8bavN5#scV$p((DF_Y|A!0k%XWAsfB2Ak9gYxvb!2mL0z;~|9e7H9*P`r}ZKSjo*XPpnprqJrYj^fU&(>1gwe#eO;KmZ; z5o-^oBBB>EZSq4Xda;4#Ig_n96zWUmqz)RjF%I7y97jdEj@CJ|O5*KHsIQ)=n=#EzME8|X?RScxxQACvMkJjTCMB$Gl^b!-NNy(c{+yuSczA`J&4O~ z^TP|oz$7en5e6K)G@A`Kt8=Jv{si)h(T|F?ced=S6Ib#A&+Sc0DzKg7|Jz**U6)r# z)5*U#Jy_;&#SSzTg-x3|#cb5B(8oHjjO|B%rPYC<&&))Vo5W^?{}K}umB>WeZnqEDF->Y6wQk$$l%d#f~$c zvxhN7Yl(eEERJT~)Fna19uIq1RuXNtvNS#N$oFXHUbLl&&wd)|iM?vupr$BD^AQ3h zDM-S`qqz;M>}B{Z&1g@%?<|6DG+oc(bgiEpEbl6YstpY=&jdNr#;W2I5)aRaE%37F zd2TCXGdxj5*-=4A?R&^Xy8#a+x48|0D45HGiYTy>MlF9j;c${V{|4!GBpSU~l+l-8 zomo2f1-mtdRF-(_X4%=79pOo~rJj<=U79awQ*EbPE>S^kRO|Y|oBLpEF7BFRrR2PB zQ7(g5B=;H3amVOhMGZzr{7kE{Gj2DD60`A~Gfp3L-kiD&f1T$RNB3ZkWQX4Mp}8n8 zCz`^y%t$Izb2+{ zKPc;AzzAP4yM(iN`HP^}kq;lJwmNAaGor(m&8jicqb$cL`gYZy+9#EwFMBThlrls* zryY!m=}L5p*hScJx>c6t9lO-#di5Z^{zJbQ|i!#Z;o*v%tHU=L^|Yd zf?lx^iQ&o#g-`*hwSEU|1$Fa&+{{X@--Uahex_^Z>e`lxfQ8wz>QPx~Q(%dH`kkr0 zeXqscQDCUPz>HH;FGolLzlIQ=ZdlP@C_x69>`E)9$jZTY%G?lc{ zV$Cu|a#~PHlI@g46iIf5N~shrN_Hhtwk$=qi7aK$o_z^f$3B>0e$V$zb$svt;P-yq zkNbYydC%+pTCUf%KCkOa?ES)urX}{RK5^+%f4TJ27#)Vifzqb_`ge@Cg;JK^n4R^O zLe^LF74E;zsH&_?2Zuyk+q&dSHSwRmGWy-B@_X!RqU+ygI{6yuqBc~PowP+=3Y)># zsOz78f04iW2Skzd$=Jx4nEvXH+V9`#!fVsdwBJhBj_avUD{X4N+WS5R()nTama%7E z-Dn_MZ%u({ENpgOzg;p$b84rPdS*sXP>)bmeCPKpdy}y@B89#}^&bw`l;|t=jStvW zebUs_OoYsX+O96-Et{^JYE_Y^Quy?{Nr#kq^+g~AEYru%r{UBtY#F%381LWOYIteb}c)3r=klw`OT=h zFC5?nz(&H)yK$a{uZ)%_)21G5s`xN2e*G8X%)+EWY^yyOOr z!Ps>8g{LY$KYIK)&32&t-5=GS-L zn>9{FRx<)GRwZcJhGYr{mZdw4C}!*$m;GS(jrOl##m;G*jYoV>>p_&_YE0C2*(hl9 z{n*?|ny>8FHsov zmeS+ves0v|wZ_JtP&TeuhcW88Z{8G{Gw<950th6`cjtZvSD8C{&Y`?t)SEYNf~}FP zZ#&SSbNu+<5gA;eOPBNcPIqh2QC;+ak$8ge?(?v(;;xj1Hsl!)QGVi4RJw3Mi<^{i zy%}m+XVL3byEcgXBlFj7N^@||Ob8HbQ+&+fkrC8RK%?Xp5#bm%$@Hsp`O63to?7Yj z;moJbyrv(l%Bq``>0PCYj6}AaW{>Uc4%r;6koMlJYMpsV<3uN`R}KP+CxTvBpSI;!EA|iEuxE@!|!0hfs^u zwy$<6dxw(Ds&E`WwL_rM&C=3Fz14KNK_u*l$XZiIw<76QWQq+-!Fpum3!la`ypP!< zEnRTkuzRp|&N`y!b|jg-mV$x>q-_MvvCn|kqyU{xrhhKi{XX|)^Ja#9wWnL=`{o*; zTXb*1);PHipTnXW!TcSowGF2OdgG|O3)qez;xiXTM6^imOs3-3oESsug)fg*D0_6O zECXnYm+uR4;z`*5b*RD5K5QR5}T{b*f8gjL0r_h3hU1-?7 z$F?)rDHtuA(6LocJnlJVpe2rCV}9^pRc*YebeS{zq`0_l$Ca1AdAeOQ6}L;RVYJ&? znHv=z?`=d5_FA#!OgEP?+^dC{c`m%D;$#(RDFl}@2xyswy0`>MJa-L8>Ra(~fo)qJasKffpuh&q+yw2&1#dS}iY zMAf4DB-vdF*akM~jaQ*a2QpSFtE-VHP;H{VZ(mmP%s8s)zK6E3i&Bq;+Rz)Rl-`)C z#Pd&b>s(+ou8|%n067IZ54X@-AF^{#%cO)2_idT?Jv&FOCmPmJ>J-QH$3HTuCQ zFOXM95QrAN%BYMv&g+OZzIt^Ypf>cv20TJrTiT=~kT^y){jL(B{QCkct_IkU^IcWER=vA-2OrN zzhzt!OD|lA5lc1gYbtGU!kXi#iu9X&2D+)E#lq7+hIy5AzP(6pI$e=y;@gyw)^GP2 zlM8a4v9s-e!!K!O>YheGm+Fo_ z<-0VG9|v*e-Q(8`kwy0VG=nZKCg#-)h~iFL=FqeOWipuFRDV=gS3qv0Xt$=Y!}na? zY#z$xZxcfi?z{sZy6&h2NX6-Wm{KLDrrY!;c?s1Axs03Sdy^#dXWuZ@1(c5z6pbP>v1W*?49<)4xN=v%eevZ**g z_~GLUInfAu@b2cRYLWY?zg+P-`Q_o37WF4lrH@}tPe(_~X3UGEd?k#1#9=vk23)3h zv7G59C)%Zkl=xt4lt~Q$`Wv_+u%chj#Hvl3UoRki?;KaWZQdRl87UzW?x3y?s=*sp zFI(pKsRC5beJ1Pr+_AvN4<76=En7R6NNHq0ZW>R(a>Kk1^_Pn%_@}&hQGRVsB0%Px z9bHfCDDdvfkhr;ZYcJXC^8*q<$c6wq%8&ow>a6Q33$>%26XTO3ef869)hISS9vNxI zy-#g=Yc4eb0nh|#55fMSMff0cY_F^Wq{dgIE9HcfbM z87HEaDZ988o)|`=M`; z@(y>4Tv6hub^MrA_rv*g#`jcj&w5(GDkb|LcO2i*%*@TneKATE4qrMo1;;6g%ydusHK6jyVo54<5<8%i%a|s(O}oq zcsto6g(tVUQVKjt?z*%LlzDEvpYdz_kD`WP8MvN-fj<^dly7}kd5pjzuN^Tq5-V=; zuH1I&DC-zX3K>u-(`~t)?eToPL5l^X8)UnKYlrlC8tQ9%1z$1NP}bVMJ>Q>JaX!7e zw)fZMorjAPvd*_PH%tAC{g2x0G=IPLS&hWa%n#KY8*53?Qy6 zvh|aP2QPv&Xo#{RqTg*36T40qq#8(A4<(3XI12JP5g=?sW^2v-iM|@K8M9=ud;{3P z^-;+oj>9Gzf_t1xb$g|wS<}rkf=UwwlYIH}3|uROr7wNEIz0H8FfE+MzkG>HPlxik zGi0*w$+FnnF6YM5%-1+FL#z*V#Zl~R@~kov8KW7d%*mM3@25V;y@jwQwyw1Bptt;} z-%?Sb>SCF5EJ{a*YB0t5%W$}AxR76kv=gixfd@6>Xy#KoS7e2;#&qvDSrKbj0c?>5$*Z;CH%KjwSgSesdzz3rjcW}smk?yV9xr0s2DNv8b#nHkQ zOGZ)4XjWuWQW9!FtXQ!^-@f(c(5c0@|A}60S1cWyIo6a$mu(RYSJK{fbNqn=#C?Y`;}&qOoVj{ZtlBBe^*pCkMN4vRZ?xeN2l# ztuMNw^tO=vWOkyjp3S$;?EyyOhW=6_?t{H#)&MQJ;T^qp+RDO#8$Ml!7#kbw9e{4~{i~{Q3@Qn!kLNFOmM;p_KXLrnN~M&+=n<()P0sZ$c8v}! z1#;$;Q@m=CB>BapNSFQzZS7>bs=?O4%+dSCxFHm$_TZ;=S%klZ#u&dY3=p2%H%);(E>{+1(?1Y-OgncGD&p zIlS55B0`2bM#QGDK`WH(hi{sQt#-{i)A;DdShbvGew~YIGHtLi&Nb24^C^$w%;keB zlc5wED>Q}LXssIED1Ei1#k2H7%kA^3M;u)0Zg?v&&00sr^&Pr>@`IZhvJ^(fe>-)O z5dPV2e|-Czvtq@QCGZ>iBU#ApR_KK}&XHh7zJ?T8v6ysliDp;UG`0*S^E@kT_kK$4 zz2>CMt;6r(h9$T0Eg@fu}r45TUS+8VjOnYGWno$T7#vQrds{>fVbmdsD$ zl#w$PPh(EaFn#!xxw}GaEMPs(8xxQ*Z|X}EW;!YJG2c8D^AchXJCQT`+Tz@KV^hAD zKf0R$+u$be)6Dq30P=^8?w7k&3}<>RSw22K%ata2ZW^vWx#RmAVVAC|>~7q=4^|N_ zGhE5PU=X331IVstBGgr3FRt8IUGN0hhSPHPmo5GzWcK0>LxdYId}_2?Q(Ie`PzH|O zn70^8{FZIo?&TZoy`f7zGo3Sk0D|7R&bTl6+{+gg-+xTP&bDv!b=S!%;qfGf68D@DM*bnk#LgAM|F&eXQpmPD z&VT>GoBhEgaD~#dJ=0Y%c!l#E=f{~xl*Hdq4RJZ!{^~vn*0ejbkIqsUCI{O~*j{cI zkM(}XI7{pc+=bkvqOAc`dJ<35FLbNhtLT)JZQ|nV{i7kCd9xpo9KPldJoiu75z1`F z&KAx+x7T|i`4C*^F0n|biP!mO=eOs3c`C%wib`Eb?mLFAG2UC$Pi6Je9DdN?0Ji6D z^&&TwZ=QbkX`zsm=?_Jdl_xS-U8R!LiLZA|oNZ}_8kvJfxSzj#!Tj_Jx>N6a#=u<# z!8p|HhdVaV(XlVaV~y+gK`Hrvz|HNlbh>Ww8i2Q0+q0-ms9|@hemq_G^yEy5k(i7T z%~E2xNE3cSJKB7%JmH=!kUgd zWjK(&J1@Uvw8u*CK1nb|;=+BJ9jO6P=WiI(0)d3bpmSj*N5`vmB>GW*FshEGC^g)urjJwO!}L z<$~MVA&wVnL!U#EE+8%X+)JmqDke7HUb*>n+0WDbm|ulzE#5LObfBfL`~2q3=}hCo z_xo;KS@#)2(o_aa{@N(?9O$%2sYl*dbXR0wUmr>Vc2`7fo!Ga`u4WEBZ^`)*F@M=K z(-1p|D&yP&Y484W$?@SXDyxbe3Sh8o?NA18T<&t?EgO&IgX-r`_O%36MVjX!ei+p4&6}-0xAq2sYTF~omNj(6$-&3oLf>~y$~wf~Fl5fuc#Liz zn9iS$N9T@_c9%>QgOlpqt+=9S7+g;(F6s&5mrH5w6rd{_YHE(8u>$!kE%)~Q3*FmE zOa>nIv(HO4C_8P9j8w98H#XV+^BepsVFgc{VbYKL>FIDO6#HvE4G8%9Lgf(KqF9_` zZR9ow!1+a_6DLouv1_mz3z525`RrOZKr48N{&u?07S6BOOq-(&%iWZzN9o@k*;8?@vLUQ$Etxo zPyOFJ6n2uErhJQar3j(eUzenxdUmqZGQ|S%F_QbTTZ?*~k3`hweo|!lwJ*Ho+&jEA z%|`aUsfE=+6`j6bcV02YuImA!O{b3^8}AR94t*axUM^0N-7a})`qmha!qDe_*N};+ zipOy6ISlIl^fGWs2*J8UOk#S<_`m}#%|t+YhCRh+lsM9?U>VbGPB(I&&CGhTZ!T=# zbqUl&a>sSaH(p)FJ1&26V6@chTUQL4Kb~4|(JfH8psQ#qj^<)rTxVxwd0&2{GRsK4 zfl;${HyEJa$XJvSpYw=l&DGC6)ka6F5tr*G^^Xu?%<+k|J3I|F2m+PwyzpAVdxptZ z8XNhB`E7B{0DV0onTGMXVzM+(VQ0HidMd4T{*nui)w}Z>h6BiXUbJUd?XotncU)Ak z+Gf1VV0+*irGE~qrO`U&jA$j|;z63bXix7XkF9=GA3bvH6Pdilb|#ewonD47v%#rC z2)_!dp5?nG#kY+TayoODcGoJ-%PsnOZJytEeg=~d+?x)>e|emP*CvZ zO_bfDHGu;A2tIlP2BV@9%-!?_6j+|cpFcm_X>>sE)gM;U$yX^LD(=?ni6v^6o=jye z%nOo|vc23jO;?=idpv&?a;kWheuMg{~TZK<`MYg@PEX+`W0auZD4dhC!xz3*BQe{e+#9;awM9#J^I>9+sMU zvy=Eqy+x!AA}*ukIcLc6-x|$db$dAaF^en2h`( zCgU)1$4M+@#5-BAsHj5Gx{KNeAZ4le-rD!+cHK2CQ~3jwA0M}>xwIKNQJq_#&yid~-w9ixCd4ltr($fG8Bh6i zD;9=;>?`ZO!~I{OfKUxs5maUmofd8I&T8b<_@#QAzRRPE3K^qea_Xrau}-Wj41ulM zaPHaC>bA=|G`nt*8@%-E2ALj*wSD-|N-qKFEo`?C$BD6|?KE`ejcQpu6Wk~wib(WU z?byEZ@Way)=!q~I>@?s9Fl`%RM0=xY!DT- z>t}{|Ot~QM;AL>5V~(Bl&z*NW5P!Kffv{-0=y%qdca`YlCO1#y-Q*a>No*fZ4;0a5 zN|Djg_X?BX2@QYw@(7&GV*eFjFySwt9_QSPfvN|Pjbup zt7!NoB4XT{eKSneJC>CMpDIcDR?)Ma>(@m6+5@h#4d`sM1MV`9C70HJ_Lq#>21n5O z^QGJg6FYiq#P#2{JcI|_&HJr!;hUA)UrZR9aP=q?TLa{7h7;W&i-r6{a9h*_g?*kq133*Z7I;d8ADok(Zm*Xf zU%=%|Xr^J%Ox1(sWeqA0+*`F&>6xr`C+gF*NiO?EwQhOC)w)sA77dT!|JqkQ-d}~l zoWk_z<8`0gJ_Xv=sol@O*PX9ykQ)ELkNJB;6kU)Bm<&BI<;Y{qrIQ{ad-C7e_;Xq_}NEN^Kt3=14ZbD1y9P* z>fgDEdyV|0;}TRnJM)EVB(Ea^SWuTFn_yD9iIDQ^LR;oL6Q(;VzvL&kXd`;4rzaS9 z?Z1gU#Y7nN(nCk?wONL*g#ETAkZ&LIp7u(xCxW`C=$I+9k~u}Eg`kOFoq1fY`P$z< zzkjwpuNa|&zGkW=$J6ruVn^scSvFDa$C1fwg6bO+8F{-V2^5J1z`qz{dGWkuzMv1}WUNkNX9m5=lfC|Ey${3prJHWo?EO857t(eE z*WpTPXt>9naM!c2qN3ie`_URUO%jW^@#x8u6-uYx{<|-I-V$L&dH2EpS;SWaj!<74 z-n-4$3A-ihhV^=GoagO(*M%=1g-7TKRM7nEh5=HSP_dT?^89=hGZAa~@Nd>5_-5CC zKK;(Dzuq#AU*exE_<$$&6N>U7c$rYy9H?GF6R%Y}&yM$ft53G{Za?yC2(ERSr%%6g zvb!WP7u`P|u}vn<<{iN1ozl_KL2{mzAo`WwMhq1(gPh+n1}?6LesXsEVD!QEUV0A7 z52{;ty}#srcP;dzwY#9dX7$u3)8NT$a-lcMEJ1`|EGjN@^{nIHe_^0uE(qtHaiI@) z!h(f|7c6*T`Zw0TAFf39=Sl8!7p}~)>O3eKG>SS-)m2rwvu3a~^7S_bO9Nxpj0-j( zlNo~q)D_FW?|(pe^F(m9{)P2p1vfifM^=Fj*?);b|9bxN6p znqxRXC2qnY_}>sB8#h8u=F$J6eDdHy<@Mk_HfDk*zpp#*HCgK|O58W*sSKUS0QozP z?UC9Zqs3N9jzP*U*@td2&I>6BD+?$(PoO_oyUc$#o4d$Q^J|Q51pLaLYoicg^WR7U z_2+Ya`e9Jc-hjn#-oLkn5`@0I2Ohk$9}F_J1pLv_mx_}%6z}yr!Nti>#2RQIn$`+Bd8v13&^lv8UlL? zW#FRlG)$~yo<`phsw?ZYW<=hs16XWU5_p$4J9OVMd9ApV6co7#-hTQeXa9F%|9KHX z#paznaU#dA4@)R4D1Zvg+Z_Mj6druA=DXT+^(vyXtM>p`f|e8K%GP=l`QVCv#1bm7 zgoK2Ii4sBCE9bb+09`*M^jibpJ7@E@ZTvgdZoM8_P!L{KCAVNf!g|7hx*d$$V~RLH z8n!ICnIh-48*-fBCjYyHmv77_!H!>SZd}3VD=H$g@)rRqU;$-_7Tx4UfyOpD+wY$r zCY~>T6C3MAJN0}1ZLx4UxbL`liuF%IL1Lnlu+{!V4g-k*1M!E?4@JS?rzOj zNAAr2dQ@yI5ot0#WQR~T6ujljlmTegYVx~FJYd+gX!dOVJi(*LgJO;l97;;*n7 zmz(`&aYH@*jP?H44Xvyk63>5`ob=vqnM;eMbbNuloJg{_wAC_-`?WP{+E!LN+^rMs43!6x<|i*07=!?O zu#(Lf!$6|!g%P3Sb(wRiFtZ`A)Pm)8vb=ff;%zIkbwezEgOa%1P+z(((WE9R>EvRe z6HxrYHt#B8G~47ReKdjYiObB7Y`iONGY`s1iR!98wmhCZh@1kCXu9dq^xDxYT;3U1^ zN+ej3OJC%%ur_Z zN7h$%ag6(I1iWA{-UkKDPo7*!k4JbOPNM*Mhbs-DKZA)V3*xGx5)O^y#=MUG50ICn z`0w76?1%!fWP}rC1iyXzhR!Uf63!iT&fmCU!@V^Mj!5_gh{KC^?$;@B^~8azNK1zy z6n|?;-3M!J_)D)}-{kN9Yv%;7g-?M@7#l7Wuc@reaUtrYa~= zusHCiPHwI-pc+sr*lfD&Hfa45HZu`nT?7@e4)_qz*TE2UnxgT${&CCOjPbfYh}XxD zR;OQ0w(g2WTpsfN))Mdw)2k3zXOPz%i+1YJKpEdrg~CfnE^{z@;jDFhY}JWx>z6dI zhH59gue#yGLb#f=*!*_!&siXHc=Y7SYTi#8a{Wo#1`gq*H9Wu7rH^M|XHke-5w>Xp z{3iUR1g)N)!tsgtf@M8J-7H7Q>AiEQJB{*CnBAzrXY=Bnh@^8KH)Tnqy!0?{i~4uH zJC~lr5In1W@JU|wR<;vcX^5?yvw{iDp$Z+Dy3o&ybn7=&UH-?G)&wn#QhxBpy3ci) z8L2PM4t=}^2@cwo*aMa~h~f!x&?b;suy`l4Qd495wrveb7c`X@{jO-)(o*cF3B*!6 z=W;^BBJ#0kt2c< zn?#A*Fs6yeI-Y?As)kW`#@oB^syT83UXgnEsp8P`!GhV$$V3s7`va{EJvEoyKx zP9A;mdk4Z0JX&Ii0W z_pZp?xj(mI?gGl*444iQdRa8^5kQ-qJN-;noBo%KAbg>xQU`tx^;N6(odomb-pAIu zM#0y5K$j+H!H)2+`DGLL$t`X5Y&< zP5dzi@YFITTq^U>Nuzu(eF&evZ;1l4W-pXdJzsKE8n!%yl`H86%~qX9iKSU=dmE;gG~0 z9ES|5f&4`(LjSDRb+;DrKMD?>`4Q$VHER`4NBoZ0rr9Nrj*c%qcd04eW~gn&@2z;r zp2Ne3U*Xf39O;tQ+Yj|$wkvQqU_W+E4iT-#e=mlclumED_2|*fumdXeiA>(?kJofK z!5AT&s37!0^g4X%<0D~Oz;6~BE!vn6(jw3vV zOwUm@FlYjcM@&dSqN6XdwCU}cPjDX!Nc`5$S}OVgJo53`CaBOL7SD{u)hKa?sR|3L=^Z*GS_XIKy#n>(06$hC;nBQ|C`x4FNo3mkQ#mQD;m=+*EwrtHAx_P za|wpO8Hdq;oXHq4d{`)p{n49i7lkFr)~x z^{I@LtwVs6Dulc&8}RoEhWzaakSDr<`1<(lfAHklGy8AGzJzQ=Erq2-e3bJzU*B#x zQ_Y-wViGj=4UyN+N+zYTt0Xo_ClHv`jRdJCLMJj^fL*Q7AU7)i=ZWZ{Wz7#+ObWEh zGg)_-*a(mY1jz~=aM-=efUL^Vp-^USEfzQ#eQN1GXtBfYf1ww8NT&Tz8+Y5U32-Ss zl)6+m{Qa?}BIDZ`P_pN?BYjj$?C^$K`u&2g5Cp>^%9P5jcDoZy-`e7cC!4i_%xl$%5a_>HvRke zekdL^GqYv23zyP+eZPStZnDN;9*e$s?pg|Z{R^5_Tbv=4@=yWyb_cG^=;)}f#Rm~$ z*Ex@y#=WlKfcKQ?SDs?41&n`m7VG+oyGDhs6)gbpm9wMhgTWLz{Pg0t1d)WCt#RqY z9lnNMeeu_RjlmVNir&OHhX_85jnGZXpdJCGRWdua&Kd%T0*s=L&bd2a!-zLA8)+0i zV#7GkN70Xnpc0rZB2wW@;b(V@=``Qi=*1P~_pCS?>UgDvcU1QPGnl3QdaHR&F@Q72V}U9PHg z+YlIMHT~Y|#?#3IO|`!~_hlPSoD>U?wVu(YI-WdqXk?RhO-y~t*<3kay?y2DTpz(rRfJK`{H+rrMWE_&(she(LM1$`8nG@=$wzvqM)9fU);> z{etHK0cTR+;|D`LbE+!QOMaJR+Ybm}sY_mcfDE?j{XBD1UT_zb2?M(6z6>3f4i5=J zUWolUoETHwi7sSl?DE5kIe!DGXag^4n{n78;|-UwOSSyn4^u@Y=h4OMTWICXp8DtlRD8w*KDRM|<<8+fN(e9%tr&zJsZ>x{=sFhF91#)W(k_rc)eES`;;;y z>8Do+jBm@88B%>UpIZKVEp2mzTrjvthr&q1dA$&~q(|o(<`zCMhub{>Y!{ zw#<09$^F5Ts`gqkTH&l+!awnc>S1`c>HYP|Fm#NVXfD>;K$Bl;dB-S{p;xe z1VbKjHa-%2MR2L_Ut!Co(VLuLnaes1fBy%R`SWQjUhjPm(zx(avOaLmYYy(E%mA{i zu3q{-z5_EL>PUa>okv27@%0KqnJVhOi;NVPH@IbSZAGs07Y1izc zt!I@hJTvG4F}~vwo7faX%FFkp*@~#>TSbeA`bt{pt+ZkDpsKPPJTv1rc-|{82lY{a z;NF`v?Rnc_a_l0^a~U7Y!8u;B(b3V|R50u^++p;vcZPyN%b**$|8|OT9pfic3ci0y zJm4k2RgU4qy&Ie0!8U2NCc}>nE#f0x=$8Y

0nF;XcHHAkddAkU?O#d_o8DiF+NgH?MKKnCd+R*P$FEiJO7dnSWWE04Kd_0R z$wJ|=OliG^tHFJky|Ki9d48S~CtPb@qV zt(3MP5a_L;FxEwxcAV)mNtU>{N}Sc^6OeW;=k~s1gpV;t2*(l$orvhs*>!hJb`AuMIRE&hxQL`{c=) zHqSVP$?qXb+};Y~VTvwo=7)Sks6Zz4ycSgz!pZU4nW+kKRT3d&qKFdkb$ho^21)2ev=p1F2w#U!*T3U z*bbaW8&x*n-KgTP8P_`-w0Kxhn`YFT&vi{qZ%- zsWdpkxxi^;xHIll{MlmvcZ*j`nBr2NKTm_TNon(kt=7-Rc2S^;NsQ{FXGJR!cQVpqZy8ztj zDAe}hgo}V`2pJk7HaGMY5O4I#*VYCuHscA#QF2#JciZ-5;5(~qDyd0VI#M4!Iz9); zeYa0wkzNnsS%Fcns&BOl5i^*OEx1Z3qsc=ZEkC?o)hiv!6!XXm47^v*;rqkD090^fd!!+!mVqn7E4a!Ax(62*$^A08ux(G}1%#fLiDsf?n7qSq6v#m3|KeU!TtMAKztH`jS-k~D{Tr}LGt?W zu@gcXR;&y(6Y$BKynt~$4hm{S3ugGb@E@t31DJ)|>YhA-IC58DqES8^1Owi#&ZS@m z=$mX)`!;cpO^gm!n{A@Und z8ZUpcvFWM&ixlWGt|J~enqutCcWGTf&&edE|S z;!wjzzJPMLj!Gi>^Zvz)MimvO1qVGhex)w}oRZ{aa#J#(jaUzT3VHHaTgvClfw=uABhJ zv2wE-_33)6j5+fQ&gLUsICUV^oXTj_RpthP?HNtp^~6_OF#RHW%*Nk%xLy@;!hA2J zE)lff%8l4uUG-c&K^LkkhcTX$(p>^6}a*k76y-S)Ek7mJ#|~OC)Mapc%4pJQ@2oAFY|FtdGrJh2ykl*Ot9H z7rJM#xN#c!@{bVxwDFt+E)2TxL|1b0=YLQWUXI>y&CjoqG1~p~X|>EVXJwNcQH4_gNM;<^3?kf-Vr7J+NKiQe*o5yL+TuWcG9uh~>{&C@ ztSJSvjKS;_qi;ln>uAs@t(o=0Q|zt~tzP^1i6lnL;cn!SOI%2RgMzq-CHYeJ;o%G( zgOf+!lHAL1-tO)>%Ct*O%yvn{S?0z!yR1?ATvW7Y)L#Ql<+w@Fr{7J*xdyF~+kLqu z6zdaAhqCrA{)QZl*(y4Ko+ArLm{~leeHty+E2!^lyN|MPvYn+>-@m278Gr`~Lh&_W zC1G}4w+*4$0hjma(cea{e=l3sQ?2$!SNgSzXS=$5JXFOnAD;uzmyaC0@XWt1<=|tV zS8AG3)pnyo-!5MJ$h6ZAmx(ojGD7}x$b!!$^r}lh=LG}Zl5#gLWz5m-6>q6g?<9O*+|Id37&*)Hdv<2lT+fs z3lS(NCo}4=3@{%$Dvh^#2)pxw=RbL9)$ly-)k}$cLNCK5Gbh@t<360PjbOMFn-aR< zbEzSvV6*5(5s?FI-6aCnsgWp1+a0a9(}5M*&sIkFR=tO!%BzIv%S_c=P{bk}yR!0YzqD?PM+EYF};Z41*@ucOT&mBFuW1 zSLs4`gd;$hXzefuL~GCJf1<5#v#*kbe;JChg*CL8VBjE<&aN)DUd6Sy3Lt>@7b=|M zEkDVPIvaO1d&BTrPFM=pz0ryanHd!|36hkM zV^s2HTe>pRz>jkc%&_r&L8xn4-*OrBpv(>OUO+-orZs~6g#NvEY<#?aE05r&!h)VP zY)QZ*B*AOAaG-Y_&?mUe-YO|4GzldHn3(>a{F0oNR}u3f+p9&W3n_EM*z^cqL^=}8 zH0uk6x&+rUY#bB}y2&>KZ|jxs9#FUwA!bSL=CPABUL`B5p=BEP?q^iu1GRpD7|3SJ z1%gWAZ}=L{P)oo)`icg5C_S%S8JC|k9ltm zpF1zUB4=D+4wv9R+|Th2^m%W6s8xx)*^fjHzdGWueSF$p*<*>?!GnL1m{T>ZG~f<- zv!RWIxQtISnR7|*@FQ;By!n1F^e93g*}B;^3{BfL>ucdea3<&#SZ|SrYBUi-Qm>$U z#oup6OODRsLbyX6I$I$9Zt(`&pY01_F@3=dZXz|IN#R2IR%nw(h@180{V`_>-WOCH z!3V9{4Nx9;0SN-e!*#MS$7n)_SkT9KSa}JGE~z3LD(|rED2m8_=-Jx<03g!YnQ)u_ zB-ST@S-!Zr&{BT%2#gJj%*nhxHi|P@p~#ikW|+CoeTUUV1y4$D<|x7t%%MvMyqJgj><3%+O-?R6U-az5`QkcVi^-?etW*JV8h{o$DkP5_GudBE86_X)r`orotf;q z$%|kjY}-_5dk48&KXm1xj!265lr^zXH<{yldI`>xJz&K<*w$T2rvPr{7Nq2ZjS{X9 zV)-D1Fccs$WYm3DE?u;$jP*rSm{uM>lC@j;R-i+bmUd;7Hm$7i%9R9RhjUk9NZsT; z+nb5SA#2OXH>K(7Q%owYtoj-R@(9tr^K!G|IW4R`EKyFlqL~4B% zU~$i7tl9l9*CnJR^O^yCMOebL<+)`!P8BZWyayx`L3zNFs(*Z?4m5nI$lASm^JWyF zo33Ba3{${7xvKK7&qWk^D{x3l*%wJK3ib=X&77l&%+UyPkRpQK-4$U=WK(Si^v0%o z`FK_h-ne(KiDOrvI4C0W&aN*q(Y8Nz<@Q~xCC!jXFpgxusyA9`4kPD1rcY+@DnSTC zL4kVu?CDe6A1LUtBpv1(cvC*WZ%czyz`eW`w?rFK4IXb)1HMAh&=x;Ij0*6+Z!p8x zr-L(f1NKo-UJlpQ5`~aJz3LRJZ(UAo7h2AfV`0I5J6hj;OAMLTW`!aadGuZMshwwX z@A9E>B0V>=zl-_DT({Eg$a@a=H2_dd9|carEC?>KHWvLHx>|f2;R7RVsb+&_ur*i3 z5CkD=M?%V=SI=9#+PSHgD$T4f;Z*`j!c{TjQOc$U`=`FiU|q|55qEc6A0-4kza85p z>b}Euh8d|$Y%u$g*@8=zW~Q|dx<31#+k&9oM~6p5z_cQvDG5PJKOe8V>FMDl_e>Y3 z{cNsJ1J~z9s2}Zpp#^am2>aEKe3moJ@Cz62Lr^VapI!Ry!8z+5ptH;I;|b@!JeoCu zi8f^X_7Pr=R7^Z{!4AAw247H4P7aE1{6B+2#=Tf9@cx|f*lmK8IqyF3@u`I0l3=cE z4)${b7Y7=0Nq;uCV9N(Dz-;;Yxuk@Mtzor7#EgDEhA*)spmxr|qe=Yy=v?-@M5Grk z6kWFH=Da$nf_y0z9i7IoSo}leYPQuIxkPBs%kc1G7#a{K9LnSMe)M?jqsNC|5bptq z7jXT0F%*hDW0jBDj5l(%^9^BMKk!NFWM=@|%fWt;Yw+fmLfzF$*Z{!Se6Y8lv9$z> z1rlKPL~=hD>H>^Z56>_A9F9t2&JRJfh)xGc&pxnBF4*cLof(Y)uCllM&7wKvwY%=G zmh3^EUBd@!_JlZJZ&~>EY;N5zt5&1*BhT&QXm0?|8lBcGJZsBXud!vY0!oVdI0Ej; znU?wc(O0eu8Yi?T_Sta8bYq>c7$K|Bp{tpE8wIl+~6ExFmi z?@85qHvf8)L(Bm|7hBtL*iCHR^XFX2371>%LWi9imt^nOBJ9>}0(%2%1s7=cZcTP{ zY)1wdtVC8+Zzu_3D1ESNh%dxCh`mxePWWIxWA@im1%38em2Q-_yTJY2m8Hnu zz7q=bD0}r}rbjE3xig8*@SG>K0LW!4D4XTwt2sAj3`c53+P*yoV#X&xZZ4i1MC z6FEN2&_mFL+Hw)`GONz58mm&+e97V zq*1c?fL!3s`L5SPz7E>=^3rPw0UXm8C{4!II1yB<~%P74a} z-C1*RwH#A9-JA;KphLRILGpcFD9kF)t9y|YLMc}F3UTd{yQJFv3MMS?Py zp&>%+^qe*7dZ`?k)h6Z7am?!i}w9UL8GaRGCN8&3em~1{V|5!TO6BR02kj zMu;MjGB|rshu)Z6m{s^Ae4BV#>lvnMS0dAX58#LuD_73uvaN6&iJcw=X0DWT4pJC+ zU=h252B5mLzn_lppE!2xYh1`RAdfz}5_ek;rv+5(GesB2S%)Cl)bPPmKq}gG_=`U0 z9@gO=+Fu2VOiVB3a#u;vtm}Pwm1X+FfFPGcm4tImD;RV2Cg#eUEnu1c|6J}QxEEf$ zP(bX7pMANWnBXdeLHeUIl>;=1S%VH9Ogz7xn*_Q>NU;kam$3oz2~uw0TcYSJc{r05 ztuvY77*vVUPn`A3WBuwuz)1l#|37p{-MXzI-c0LS9D&ZBP$DkP8z{BdCP27O&ssmT z@gBbe=}$Jd5O>FdsJD286%qUehHCca=btY=UG^f^N;I%+7n=ZkK4MP|p+mtA8xi@B z4OqQ+`BFmM@{6CzdCrYh!^eku0l}g*d>A3pTV_!;61eRK+7c3mD>O>k*C^B<0;#P| z2c{4-2l%~biR8V{B)3xc-EfQuEEi!ou?gpL!r5u2NW@D*VE(!_!}kK5<%`l)XsO-m6;=I{bxf)@zDLyUSN2rtZ<@ZS4U z<|ipY09#*ir4tK>Ia_E9p03=S0^@1tSQX}>*mb_G#&YS&vhhs1Y zt&apa3;s3~)?&-)pR-U_^V^k%pq9Us+I`~Ug`VDto@;IxlxL0n#1n0U*MQKb{(=T@ zh34s`*|s~;Ty~uMN1aV3Rrk?UO)?PPZKxG!naCc6Gk9noh{=FE>m&Ge%R*52iNz2J z7cN|QEXv`)vtF|(4HlKUkr(kMPwgU!q{p6XXL$$cNrJ-@n)AjpXS`%TR7n@?K#Ud`YK;n92U=* z#X<2db}d*z<6@nJB!_$u1CBhD$?OmpH%PZfg7~aUS;-wBl>y9N9*P%nh7QKiZ_eSM zp@WNOPMn=}ha|IMauQ*xaW=yYb%fk`^9TwPs{2d;CK8LZrdeA&6|l>=WOGCyR&K`G z;>XzH+(6fvNyNhgfxw?Nc2xu70SgyMg;=YzIE1ksgmL#vL4g^fWjS}2%_jOz^ay|W z;HXJ0_&5~tuv{$gtQpL|4sllp1f+?U=>Nq5Pap)`q4}zaUuH+tv9NjUznsto?N?a? z+*XO4YUaeytUWoQ3qjMIXaYFJVz#^q-2)NuCK#wV7_IQycp{`cdwh+@8;g&qU8;;T zjN?pwH>Q4QHIhTXnsMy21ajmpWJpOmjbFDe6*`snK131}DRY+@A{Kgxs09WsE8kmq zmR`75QUWJmP*A{{iX(AutuQd0Q~(jwzB4Zs@eSl-v!UX%;4I4!I6^F>__2l}TU2wV zzjp=lJ!W#2wa;JNQyJuKZo#hD+-UVk>ZJ*28Pk z#-?~PK~Ve@vQ-i_WLn(~Q37%HcJjl~?8>O;E8WwZ^!}2rN+V$swu6~hse*o~BS9!4 zQX)r4_F3G+Y!y%sUP5WH)R`BYZ>+;NPV?{hcW-I10$`c?$Ro1(4Z+--4tVk;U^TnW z=6pOE<>)`C^%#p{adz#tlzmR<`BA?^3^t?iiDWK9j z!@Lzy@bK?hUtmrRe(DG6@-Wut2ejgSVz!~T2qyR(IJ@x3$R9)b!n25OEd}6`^+=eh zG3f1OV8hoD@<5rNpC8`UDrD56{EW z6Sv#&UN%t}$}kn22D5bG%UfXs)Dahn)B^@@o^yLC5etE5j==w6b&=M@4=0ii9WtXe z1ueJ9jei=b*A)5n8e75VihRGuW%MRYYJ`5ns$&A!5X>iElPmpaJe`a zXOREI$?A{fnZF2natkvq3A_oKF^tU^&nEmb1TB5cCk`SGNIo*-TPbpR=&Dds2aJQEN>>rmo)srvmDo-YpXK_3uIKCgzoV#XFQfY?S z)$B=-l$$Fwfy(7X0Zc^fT;Mcwo@n)$b;AYMtEi*_;v?+)t5-9f z($sHo_HR#aIF3{>_93u;`tjK4Kw7VO#;8|8!6CK-EX5e}+y-n8u;`=kUJs=9#zIta zJ|~0km+v$R7Tn$W1)fr&$pR3Z^!cL4BVAp>_wW6+%z*d{;)R0urFlpf>ykE)*EArW zc+8RTr*cV_-QypLOYMmTJVJ4-(nT%c)qx=B_#azwr6twD0)!oZJV(kKYtVxn4aI}l z0PMi)q@;6gIliLm&hT?>SIrzoyig->Vi=(ZuLF6b-MfKfa6njFwH*x*peMvrJ7I)+ zm9Hm08hH%9KI?bh|ipr-Tc)?76D<08kpkn`y;`0o1d(cad)}h*@girc!3t%J6;5_Z=@(bCb@UAD{f9F)-7WOynga=!T7wBe@?7qpXnA zF)&c1FhhutibncDIHWDp`m4_ud&${TU?{_F)SSgCDm5JZMrQkj%#z@S1Kz0EFY$6o z;M@Rd*V@p18HdFcXadbL;tC4edk9asBJ@l*UZs>ye{-x{9C;o_n9dXd68$3Ly9gzM z6%-VD#E3O2+W!9wAmSAY?Xja^3`IXmi(Q;%n8wfx7q6}qkWZl%OB>qOUC2Pt`0gG8 zZ&wP}Q;QL5ejvZci8$7;VXEX&gklv&%aEmiweCU$oS3MNg*v>qj?D)z=c?3`ZnB>S z4qHf0k(O?aTjEq5ts@7_%%@vHM8oG#O$k>z(kddTOO;k3ZVGekJ?hjEsbm_|j;Az> zhLmo&{|0KrMK^Em22ps%Ff6Fk)wSOdsv7w4NgN2Xd-pn7%=frPRy~y{#pkPU`^D{# zX(Lgjt?xNsw2b6_=2J;(>#bhIvzI9ms+0Pj?wtHJ0*TI(cLBx<4D5qE1`|B@|Fw5L z-cY7{+}Z9;cP;96%T|VUx3Yt+n~E#KLAgzS6cr`Zs#J^72x%}RZQZ(TORFMwDwHYH zgbbQNl43KB!W7N4)ifA0x-ou@G57P*uRmbVJ?GxjbDa0gdA;X-pZ9s6AK&li`}usI zX=V!+NNaT&;sQ^(NP+h}(92okF3TWB!!HyIG8vR8g=s=*LTizJ-_4Sk)}lkpzqh#) zMDYyYKloS!fxx|H#|1q^iUqz7fK2T#z!V7r2c}knJcgzSApr4)G<~yWKu$2I0nI|u zwG%;fC{;ii#pdI=XW`UZ;~vhc*e+@?T-mDbf_c=+Zgg?v2N`1}OLFX}cMJ$VA}1QT zxr2Bw^%f1YA zjNR&`Qh-FWa0EsQJ_wEsd*4KE#w=K~k6{!8*^5;?3EWUxcxiX+dSULZTcp%f`+pu^ zYsinfuv)(|MuF5Dg5p4X09b>=F9O^~jj$v?)7$k-H}Xr&AY-j?j9_a2>I;amW`_|sg(c!RARZXl#Yx%7YU>sAY-2hRig9I+5R&NWw~#Usa(6ao z>6EEC{P2$E6eCbGR>VX$ker5Z^AP7YJFJrHfd_QOpJN?!9bv*B9E&gQ_U_#V#U`?o zq-$O>x}6HhQzl-$x7#g)4v?lZ+ zY;)WTnAqUmEJbHUkE&hku&t(h&KzF)MuKtYT!xmTKP-4I+J~os7Nu_RJMKDd&Yb(& z7=D{%YNBZ{0+tu1yX@RqZytd>@_&nYaB8k3l>J3r?JBiDx+B}6PR%zbj4^s6^sbOIrWZs*`H<>;hf2hhYyoR3*m@wkLda}1(Vso0Z)vPUzjkKyb^24z3G>F1$z;}NU;0mw06e_@lR;;kbr ziY_{H_LKUdV28X_-j>kAp$+V*v;@}H9E9VD9mi}3qB_)lM7;B2NJ6x zQDRSq4NU%u)N@ZCf6*mG#;uWfB#CK73iVT_bUHoF)YOZtZ@^D@_3IgF6XQ(N%1%jj z&wX2lleP7A+D^pK*~X(;K4)#&SJ{1!8&y9oIF6U=&F~(NdGqoz2)WU!uNMUwE4nwI zy|;sJCs-;N8?H%C_s(@F+g{h9H#?pUb)(`*`_!pzvyRs@nL|g8h*|u&K5;_R&zkx9 znN3nG!7!Yw*OJ4ZR)!;uwXY_3vd%h5^b<2D)qh+T(($d-#s{k?u|wzYXG;`4JvTWm z4@(9>1^89g-&(#>^~lgB!Z^N{(^rsb5gqK97ks0)5Ml&AlgXrcFU*M3sFIVD+p%?2 zk(2uN%ycZ~i;Lv^9(kBehoriaHXwlw?n@z&NZGd4RR{iU$g<&&%Qa`9a9;}pTOO#5cqM}rz@S4C_ zq*Zhx7uLeK=je;6dfH-E6UeNV+4sd_5w4dB@)l<`rMhhY$@5MFI|r<|ii(kw?q`eI zqbhttLb?Y{^xrn6N8WG0k?QIgJ#u@8vJUYprwN}xr)EFv>Q&x8QJ_sWMB+TD21m)( zJfwv1Y}a}x5JjUfP*=~1unVP-v*_Fl7c>Em@9-IJd#l^~Xy@dE4FCFe7`=V2&L5@| zp`j1OS?Bk^;O^?TwXi+e6v*geS_*wT z_ns%b%nv0=_aqS%_^5m~?SlxFIQ>=9rwcx{!-o#?sXt7%#iw@o)D9m;#sAGb>1=aQ zCrQ1zV(X$T^Yeutzu>cgN=H&Qw*D>a^GHZDe?8^&?2)mYKkBu) zd4K%>nn!nc>@7$X&?+3H+3zg2$(v_nkM4LMjG8#bUGV!aoBxHC`G4XO!-mDD&aD0Z T$F{{pQ?FU&g literal 0 HcmV?d00001 diff --git a/_assets/zero-trust-architecture.svg b/_assets/zero-trust-architecture.svg new file mode 100644 index 0000000..06451b6 --- /dev/null +++ b/_assets/zero-trust-architecture.svg @@ -0,0 +1 @@ +

Azure Resource Group

Identity

Observability via AMPLS

Private PaaS · publicNetworkAccess=Disabled

VNet · 10.50.0.0/16

snet-pe /26 · Private Endpoints

snet-aca-infra /23 · delegated

snet-jumpbox /27

AzureBastionSubnet /26

HTTPS 443

SSH tunnel

docker push / az deploy

browser tunnel

HTTP internal

AAD token

AAD token

AAD token

optional

private link

private link

private link

private link

private link

private link

telemetry

telemetry

logs

DNS

DNS

DNS

federated

federated

attached

blocked

blocked

blocked

blocked

blocked

allowed

snet-mgmt · reserved

Self-hosted CI/CD runner

snet-build · reserved

ACR Tasks / build agents

Operator / Developer

Public internet

Azure Bastion · Standard
(only public IP)

Linux jumpbox VM
no public IP · UAMI

Container Apps Environment
workload profiles · internal=true

API container app
internal :8090

Web container app
internal :8080

PE
ACR

PE
Cosmos

PE
Blob

PE
AI Foundry

PE
AMPLS

PE
App Config

Azure Container Registry
Premium · admin disabled

Cosmos DB
disableLocalAuth=true

Storage Account
allowSharedKeyAccess=false

Azure AI Foundry
+ OpenAI gpt-4.1-mini

App Configuration
optional

Log Analytics
ingest/query private

Application Insights
disableLocalAuth=true

Azure Monitor
Private Link Scope

User-Assigned Managed Identity
AcrPull/Push · Storage Blob ·
Cosmos Data Contributor · Azure AI User

Private DNS Zones
documents · blob · azurecr
openai · cognitiveservices · services.ai
azconfig · monitor · oms · ods · agentsvc

\ No newline at end of file diff --git a/api-app/app/core/config.py b/api-app/app/core/config.py index 0d98de3..4cf391d 100644 --- a/api-app/app/core/config.py +++ b/api-app/app/core/config.py @@ -1,7 +1,8 @@ -from typing import Optional +from typing import Optional, Annotated from dotenv import load_dotenv, find_dotenv from functools import lru_cache -from pydantic_settings import BaseSettings, SettingsConfigDict +from pydantic import field_validator +from pydantic_settings import BaseSettings, SettingsConfigDict, NoDecode class Settings(BaseSettings): @@ -22,9 +23,18 @@ class Settings(BaseSettings): # CORS Settings ALLOW_CREDENTIALS: bool = True - ALLOW_ORIGINS: list[str] = ["*"] - ALLOW_METHODS: list[str] = ["*"] - ALLOW_HEADERS: list[str] = ["*"] + ALLOW_ORIGINS: Annotated[list[str], NoDecode] = ["*"] + ALLOW_METHODS: Annotated[list[str], NoDecode] = ["*"] + ALLOW_HEADERS: Annotated[list[str], NoDecode] = ["*"] + + @field_validator("ALLOW_ORIGINS", "ALLOW_METHODS", "ALLOW_HEADERS", mode="before") + @classmethod + def _split_csv(cls, value): + # Accept a comma-separated string from env vars (simpler for deploy-time + # injection) in addition to the default JSON list form. + if isinstance(value, str) and not value.strip().startswith("["): + return [item.strip() for item in value.split(",") if item.strip()] + return value # Azure Cosmos DB Settings COSMOS_DB_ENDPOINT: str = "" diff --git a/api-app/app/services/analysis_workflow_executor_service.py b/api-app/app/services/analysis_workflow_executor_service.py index 63bc708..0b326b1 100644 --- a/api-app/app/services/analysis_workflow_executor_service.py +++ b/api-app/app/services/analysis_workflow_executor_service.py @@ -2,65 +2,72 @@ Analysis Workflow Execution Service Manages the execution of AI agents in the analysis workflow """ + +import logging import traceback from typing import TYPE_CHECKING -import logging -from agent_framework import (ExecutorInvokedEvent, - ExecutorCompletedEvent, - ExecutorFailedEvent, - WorkflowEvent, - WorkflowStartedEvent, - WorkflowRunState, - WorkflowFailedEvent, - WorkflowOutputEvent, - WorkflowStatusEvent) +from agent_framework import ( + ExecutorCompletedEvent, + ExecutorFailedEvent, + ExecutorInvokedEvent, + WorkflowEvent, + WorkflowFailedEvent, + WorkflowOutputEvent, + WorkflowRunState, + WorkflowStartedEvent, + WorkflowStatusEvent, +) -from app.utils.sse_stream_event_queue import SSEStreamEventQueue from app.dependencies import get_chat_client -from app.workflow import AnalysisRunInput, InvestmentAnalysisWorkflow -from app.services import AnalysisService, OpportunityService from app.models import StreamEventMessage +from app.services import AnalysisService, OpportunityService +from app.utils.sse_stream_event_queue import SSEStreamEventQueue +from app.workflow import AnalysisRunInput, InvestmentAnalysisWorkflow if TYPE_CHECKING: from app.services import AnalysisWorkflowEventsService logger = logging.getLogger("app.services.analysis_workflow_executor") + class AnalysisWorkflowExecutorService: """Executes the analysis workflow with AI agents""" SAMPLE_COMPANY_NAME = "TechCorp Inc." - SAMPLE_INVESTMENT_HYPOTHESIS = ( - "TechCorp Inc. shows strong revenue growth and market expansion potential in the AI software sector" - ) + SAMPLE_INVESTMENT_HYPOTHESIS = "TechCorp Inc. shows strong revenue growth and market expansion potential in the AI software sector" SAMPLE_INVESTMENT_STAGE = "Series B" SAMPLE_INDUSTRY = "AI Software" - - + def __init__( self, - analysis_service: AnalysisService, + analysis_service: AnalysisService, opportunity_service: OpportunityService, - workflow_events_service: "AnalysisWorkflowEventsService" + workflow_events_service: "AnalysisWorkflowEventsService", ): self.analysis_service = analysis_service self.opportunity_service = opportunity_service self.workflow_events_service = workflow_events_service - - async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: WorkflowEvent, analysis_id: str, opportunity_id: str): + + async def _handle_event( + self, + sse_event_queue: SSEStreamEventQueue, + event: WorkflowEvent, + analysis_id: str, + opportunity_id: str, + ): """Handle a workflow event and send to event queue""" - + if event is None: return logger.debug(f"Handling workflow event: {event}") - + event_type = None executor = None data = {} message = None - + if isinstance(event, WorkflowStartedEvent): event_type = "workflow_started" message = "Workflow execution started" @@ -68,23 +75,30 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf event_type = "workflow_failed" message = "Workflow execution failed" executor = event.details.executor_id - data = {"error": event.details.message, - "error_type": event.details.error_type, - "traceback": event.details.traceback, - "extra": event.details.extra - } + data = { + "error": event.details.message, + "error_type": event.details.error_type, + "traceback": event.details.traceback, + "extra": event.details.extra, + } # fail the analysis in the database - await self.analysis_service.fail_analysis(analysis_id=analysis_id, opportunity_id=opportunity_id, error_details=data) + await self.analysis_service.fail_analysis( + analysis_id=analysis_id, + opportunity_id=opportunity_id, + error_details=data, + ) elif isinstance(event, WorkflowStatusEvent): event_type = "workflow_status" data = {"state": event.state.value} - + # update analysis status if completed if event.state == WorkflowRunState.IDLE: # IDLE indicates completed - await self.analysis_service.complete_analysis(analysis_id=analysis_id, opportunity_id=opportunity_id) - + await self.analysis_service.complete_analysis( + analysis_id=analysis_id, opportunity_id=opportunity_id + ) + elif isinstance(event, ExecutorInvokedEvent): event_type = "executor_invoked" executor = event.executor_id @@ -103,40 +117,38 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf "error": event.details.message, "error_type": event.details.error_type, "traceback": event.details.traceback, - "extra": event.details.extra + "extra": event.details.extra, } else: event_type = "unknown_event" - + # Add event to the queue (for SSE streaming) and cache it event_message = StreamEventMessage( - type=event_type, - executor=executor, - data=data, - message=message - ) - + type=event_type, executor=executor, data=data, message=message + ) + await sse_event_queue.add_event(event_msg=event_message) - + # Cache the event for later persistence to database - self.workflow_events_service.cache_event(analysis_id=analysis_id, - event_message=event_message) - + self.workflow_events_service.cache_event( + analysis_id=analysis_id, event_message=event_message + ) + # save the output if isinstance(event, WorkflowOutputEvent): await self.analysis_service.save_agent_result( - analysis_id=analysis_id, - opportunity_id=opportunity_id, - executor_id=executor, - result=data or {} - ) - + analysis_id=analysis_id, + opportunity_id=opportunity_id, + executor_id=executor, + result=data or {}, + ) + async def execute_workflow( self, sse_event_queue: SSEStreamEventQueue, analysis_id: str, opportunity_id: str, - owner_id: str + owner_id: str, ): """ Execute the complete analysis workflow @@ -144,89 +156,122 @@ async def execute_workflow( """ try: logger.info(f"Starting workflow execution for analysis {analysis_id}") - + # get the opportunity details - analysis = await self.analysis_service.get_analysis_by_id(analysis_id=analysis_id, opportunity_id=opportunity_id) + analysis = await self.analysis_service.get_analysis_by_id( + analysis_id=analysis_id, opportunity_id=opportunity_id + ) if not analysis: - raise Exception(f"Analysis {analysis_id} not found for opportunity {opportunity_id}") - - opportunity = await self.opportunity_service.get_opportunity_by_id(opportunity_id=opportunity_id, owner_id=owner_id) + raise Exception( + f"Analysis {analysis_id} not found for opportunity {opportunity_id}" + ) + + opportunity = await self.opportunity_service.get_opportunity_by_id( + opportunity_id=opportunity_id, owner_id=owner_id + ) if not opportunity: - raise Exception(f"Opportunity {opportunity_id} not found for owner {owner_id}") + raise Exception( + f"Opportunity {opportunity_id} not found for owner {owner_id}" + ) # Create the analysis run input analysis_input = AnalysisRunInput( - hypothesis=analysis.investment_hypothesis or AnalysisWorkflowExecutorService.SAMPLE_INVESTMENT_HYPOTHESIS, + hypothesis=analysis.investment_hypothesis + or AnalysisWorkflowExecutorService.SAMPLE_INVESTMENT_HYPOTHESIS, opportunity_id=opportunity.id, analysis_id=analysis.id, owner_id=owner_id, - company_name=opportunity.settings.get("company_name", AnalysisWorkflowExecutorService.SAMPLE_COMPANY_NAME), - stage=opportunity.settings.get("stage", AnalysisWorkflowExecutorService.SAMPLE_INVESTMENT_STAGE), - industry=opportunity.settings.get("industry", AnalysisWorkflowExecutorService.SAMPLE_INDUSTRY) + company_name=opportunity.settings.get( + "company_name", AnalysisWorkflowExecutorService.SAMPLE_COMPANY_NAME + ), + stage=opportunity.settings.get( + "stage", AnalysisWorkflowExecutorService.SAMPLE_INVESTMENT_STAGE + ), + industry=opportunity.settings.get( + "industry", AnalysisWorkflowExecutorService.SAMPLE_INDUSTRY + ), ) chat_client = await get_chat_client() workflow = InvestmentAnalysisWorkflow(chat_client=chat_client) await workflow.initialize_workflow() - + async for event in workflow.run_workflow_stream(analysis_input): # Handle each event - await self._handle_event(sse_event_queue=sse_event_queue, - event=event, - analysis_id=analysis_id, - opportunity_id=opportunity_id) - + await self._handle_event( + sse_event_queue=sse_event_queue, + event=event, + analysis_id=analysis_id, + opportunity_id=opportunity_id, + ) + logger.info(f"Workflow execution completed for analysis {analysis_id}") - + # Persist all cached events to the database try: - persisted_events = await self.workflow_events_service.persist_cached_events( - analysis_id=analysis_id, - opportunity_id=opportunity_id, - owner_id=owner_id + persisted_events = ( + await self.workflow_events_service.persist_cached_events( + analysis_id=analysis_id, + opportunity_id=opportunity_id, + owner_id=owner_id, + ) + ) + logger.info( + f"Persisted {len(persisted_events)} events to database for analysis {analysis_id}" ) - logger.info(f"Persisted {len(persisted_events)} events to database for analysis {analysis_id}") except Exception as persist_error: - logger.error(f"Failed to persist events to database: {str(persist_error)}") + logger.error( + f"Failed to persist events to database: {str(persist_error)}" + ) logger.exception(persist_error) - + except Exception as e: - logger.error(f"Workflow execution failed for analysis {analysis_id}: {str(e)}") + logger.error( + f"Workflow execution failed for analysis {analysis_id}: {str(e)}" + ) logger.exception(e) - + # Update analysis as failed try: await self.analysis_service.fail_analysis( analysis_id=analysis_id, opportunity_id=opportunity_id, - error_details={"error": str(e), - "error_type": e.__class__.__name__, - "traceback": traceback.format_exc() - } + error_details={ + "error": str(e), + "error_type": e.__class__.__name__, + "traceback": traceback.format_exc(), + }, ) except Exception as update_error: logger.error(f"Failed to update analysis status: {str(update_error)}") - + # Emit workflow failed event await sse_event_queue.add_event( StreamEventMessage( type="workflow_failed", - data={"error": str(e), + data={ + "error": str(e), "error_type": e.__class__.__name__, - "traceback": str(e.__traceback__) - }, - message=f"Analysis workflow failed: {str(e)}" + "traceback": str(e.__traceback__), + }, + message=f"Analysis workflow failed: {str(e)}", ) ) - + # Still try to persist events even if workflow failed try: - persisted_events = await self.workflow_events_service.persist_cached_events( - analysis_id=analysis_id, - opportunity_id=opportunity_id, - owner_id=owner_id + persisted_events = ( + await self.workflow_events_service.persist_cached_events( + analysis_id=analysis_id, + opportunity_id=opportunity_id, + owner_id=owner_id, + ) + ) + logger.info( + f"Persisted {len(persisted_events)} events to database after failure for analysis {analysis_id}" ) - logger.info(f"Persisted {len(persisted_events)} events to database after failure for analysis {analysis_id}") except Exception as persist_error: - logger.error(f"Failed to persist events after workflow failure: {str(persist_error)}") - logger.exception(persist_error) \ No newline at end of file + logger.error( + f"Failed to persist events after workflow failure: {str(persist_error)}" + ) + logger.exception(persist_error) diff --git a/api-app/app/services/whatif_workflow_executor_service.py b/api-app/app/services/whatif_workflow_executor_service.py index 997402c..866095c 100644 --- a/api-app/app/services/whatif_workflow_executor_service.py +++ b/api-app/app/services/whatif_workflow_executor_service.py @@ -2,59 +2,71 @@ Analysis Workflow Execution Service Manages the execution of AI agents in the analysis workflow """ -from typing import TYPE_CHECKING, Collection, List + import logging +from typing import TYPE_CHECKING, Collection, List -from agent_framework import (ExecutorInvokedEvent, - ExecutorCompletedEvent, - ExecutorFailedEvent, - WorkflowEvent, - WorkflowStartedEvent, - WorkflowRunState, - WorkflowFailedEvent, - WorkflowOutputEvent, - WorkflowStatusEvent, - ChatMessage) +from agent_framework import ( + ChatMessage, + ExecutorCompletedEvent, + ExecutorFailedEvent, + ExecutorInvokedEvent, + WorkflowEvent, + WorkflowFailedEvent, + WorkflowOutputEvent, + WorkflowRunState, + WorkflowStartedEvent, + WorkflowStatusEvent, +) -from app.utils.sse_stream_event_queue import SSEStreamEventQueue -from app.dependencies import get_chat_client from app.database.repositories import WhatIfMessageRepository +from app.dependencies import get_chat_client +from app.models import StreamEventMessage, WhatIfConversation, WhatIfMessage from app.services import AnalysisService -from app.what_if_chat import WhatIfChatWorkflow, ConversationContext, WhatIfChatWorkflowInputData -from app.models import StreamEventMessage, WhatIfMessage, WhatIfConversation +from app.utils.sse_stream_event_queue import SSEStreamEventQueue +from app.what_if_chat import ( + ConversationContext, + WhatIfChatWorkflow, + WhatIfChatWorkflowInputData, +) logger = logging.getLogger("app.workflow.what_if_workflow_executor") + class WhatIfWorkflowExecutorService: """Executes the analysis workflow with AI agents""" SAMPLE_COMPANY_NAME = "TechCorp Inc." - SAMPLE_INVESTMENT_HYPOTHESIS = ( - "TechCorp Inc. shows strong revenue growth and market expansion potential in the AI software sector" - ) + SAMPLE_INVESTMENT_HYPOTHESIS = "TechCorp Inc. shows strong revenue growth and market expansion potential in the AI software sector" SAMPLE_INVESTMENT_STAGE = "Series B" SAMPLE_INDUSTRY = "AI Software" - + def __init__( self, analysis_service: AnalysisService, - what_if_message_repository: WhatIfMessageRepository = None + what_if_message_repository: WhatIfMessageRepository = None, ): self.analysis_service = analysis_service self.what_if_message_repository = what_if_message_repository - + async def initialize(self): """Initialize the workflow executor service""" self.chat_client = await get_chat_client() self.workflow = WhatIfChatWorkflow(chat_client=self.chat_client) await self.workflow.initialize_workflow() - - async def _try_get_conversation_context(self, conversation_id: str, analysis_id: str, owner_id: str) -> ConversationContext: + + async def _try_get_conversation_context( + self, conversation_id: str, analysis_id: str, owner_id: str + ) -> ConversationContext: """Retrieve conversation context (e.g., message history)""" - conversation: WhatIfConversation = await self.what_if_message_repository.get_conversation_by_id(conversation_id, analysis_id) - + conversation: WhatIfConversation = ( + await self.what_if_message_repository.get_conversation_by_id( + conversation_id, analysis_id + ) + ) + conversation_context: ConversationContext = None - + if not conversation: # create a new conversation and store in the database new_conversation = WhatIfConversation( @@ -62,24 +74,28 @@ async def _try_get_conversation_context(self, conversation_id: str, analysis_id: conversation_id=conversation_id, analysis_id=analysis_id, title=f"What If Conversation for Analysis {analysis_id}", - messages=[] + messages=[], ) await self.what_if_message_repository.create_conversation(new_conversation) - + conversation_context = ConversationContext( - conversation_id=conversation_id, - message_history=[] + conversation_id=conversation_id, message_history=[] ) elif conversation.messages and len(conversation.messages) > 0: - history_messages = sorted(conversation.messages, key=lambda msg: msg.sequence_number) + history_messages = sorted( + conversation.messages, key=lambda msg: msg.sequence_number + ) conversation_context = ConversationContext( conversation_id=conversation_id, - message_history=[ChatMessage(role=msg.role, text=msg.text, author_name=msg.author) for msg in history_messages] + message_history=[ + ChatMessage(role=msg.role, text=msg.text, author_name=msg.author) + for msg in history_messages + ], ) - + return conversation_context - + async def try_persist_conversation_message( self, conversation_id: str, @@ -88,7 +104,7 @@ async def try_persist_conversation_message( author: str, text: str, content: dict[str, any], - sequence_number: int + sequence_number: int, ): try: await self.what_if_message_repository.add_message_to_conversation( @@ -99,26 +115,35 @@ async def try_persist_conversation_message( author=author, text=text, content=content, - sequence_number=sequence_number - ) + sequence_number=sequence_number, + ), ) except Exception as e: - logger.error(f"Failed to persist conversation message for conversation {conversation_id}: {str(e)}") + logger.error( + f"Failed to persist conversation message for conversation {conversation_id}: {str(e)}" + ) logger.exception(e) - - async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: WorkflowEvent, conversation_id: str, analysis_id: str, sequence_number: int = 0): + + async def _handle_event( + self, + sse_event_queue: SSEStreamEventQueue, + event: WorkflowEvent, + conversation_id: str, + analysis_id: str, + sequence_number: int = 0, + ): """Handle a workflow event and send to the sse event queue""" - + if event is None: return logger.debug(f"Handling workflow event: {event}") - + message_type = None executor = None data = {} message = None - + if isinstance(event, WorkflowStartedEvent): message_type = "workflow_started" message = "What If Workflow execution started" @@ -126,18 +151,19 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf message_type = "error" message = "What If Workflow execution failed" executor = event.details.executor_id - data = {"error": event.details.message, - "error_type": event.details.error_type, - "traceback": event.details.traceback, - "extra": event.details.extra - } + data = { + "error": event.details.message, + "error_type": event.details.error_type, + "traceback": event.details.traceback, + "extra": event.details.extra, + } # fail the analysis in the database # await self.analysis_service.fail_analysis(error_details=data) elif isinstance(event, WorkflowStatusEvent): message_type = "workflow_status" data = {"state": event.state.value} - + # update analysis status if completed if event.state == WorkflowRunState.IDLE: # IDLE indicates completed @@ -147,16 +173,16 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf message = "What If Workflow execution failed" elif event.state == WorkflowRunState.IN_PROGRESS: message = "What If Workflow is running" - + elif isinstance(event, ExecutorInvokedEvent): message_type = "executor_invoked" executor = event.executor_id - + elif isinstance(event, ExecutorCompletedEvent): message_type = "executor_completed" executor = event.executor_id data = event.data or {} - + elif isinstance(event, WorkflowOutputEvent): message_type = "workflow_output" executor = event.source_executor_id @@ -165,7 +191,7 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf else: message_type = "markdown" data = event.data or {} - + elif isinstance(event, ExecutorFailedEvent): message_type = "executor_failed" executor = event.executor_id @@ -173,21 +199,18 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf "error": event.details.message, "error_type": event.details.error_type, "traceback": event.details.traceback, - "extra": event.details.extra + "extra": event.details.extra, } else: message_type = "unknown_event" - + # Add event to the queue (for SSE streaming) and cache it await sse_event_queue.add_event( StreamEventMessage( - type=message_type, - executor=executor, - data=data, - message=message + type=message_type, executor=executor, data=data, message=message ) ) - + # save the message if isinstance(event, WorkflowOutputEvent): await self.try_persist_conversation_message( @@ -197,9 +220,9 @@ async def _handle_event(self, sse_event_queue: SSEStreamEventQueue, event: Workf author=executor or "Assistant", text=isinstance(data, str) and data or str(data), content=data.to_dict() if hasattr(data, "to_dict") else data, - sequence_number=sequence_number + sequence_number=sequence_number, ) - + async def execute_workflow( self, input_message: str, @@ -207,29 +230,39 @@ async def execute_workflow( sse_event_queue: SSEStreamEventQueue, analysis_id: str, opportunity_id: str, - owner_id: str + owner_id: str, ): """ Execute the complete what-if workflow This runs in the background and emits events to the event queue """ try: - logger.info(f"Starting workflow execution for conversation {conversation_id}") - + logger.info( + f"Starting workflow execution for conversation {conversation_id}" + ) + # get the opportunity details - analysis = await self.analysis_service.get_analysis_by_id(analysis_id=analysis_id, - opportunity_id=opportunity_id) + analysis = await self.analysis_service.get_analysis_by_id( + analysis_id=analysis_id, opportunity_id=opportunity_id + ) if not analysis: - raise Exception(f"Analysis {analysis_id} not found for opportunity {opportunity_id}") - + raise Exception( + f"Analysis {analysis_id} not found for opportunity {opportunity_id}" + ) # get the conversation history for context - conversation_context = await self._try_get_conversation_context(conversation_id=conversation_id, - analysis_id=analysis_id, - owner_id=owner_id) - - next_seq_num = conversation_context.message_history is not None and len(conversation_context.message_history) + 1 or 1 - + conversation_context = await self._try_get_conversation_context( + conversation_id=conversation_id, + analysis_id=analysis_id, + owner_id=owner_id, + ) + + next_seq_num = ( + conversation_context.message_history is not None + and len(conversation_context.message_history) + 1 + or 1 + ) + # persist the the input message await self.try_persist_conversation_message( conversation_id=conversation_id, @@ -238,53 +271,58 @@ async def execute_workflow( author="User", text=input_message, content=None, - sequence_number=next_seq_num + sequence_number=next_seq_num, ) - + # Create the input message for the workflow input = WhatIfChatWorkflowInputData( analysis=analysis, conversation_context=conversation_context, - input_messages=ChatMessage(role="user", text=input_message, author_name="User") + input_messages=ChatMessage( + role="user", text=input_message, author_name="User" + ), ) - # Run the workflow and handle events + # Run the workflow and handle events async for workflow_event in self.workflow.run_workflow_stream(input=input): next_seq_num += 1 # Handle each event - await self._handle_event(sse_event_queue=sse_event_queue, - event=workflow_event, - conversation_id=conversation_id, - analysis_id=analysis_id, - sequence_number=next_seq_num) - - - logger.info(f"Workflow execution completed for conversation {conversation_id}") - + await self._handle_event( + sse_event_queue=sse_event_queue, + event=workflow_event, + conversation_id=conversation_id, + analysis_id=analysis_id, + sequence_number=next_seq_num, + ) + + logger.info( + f"Workflow execution completed for conversation {conversation_id}" + ) + except Exception as e: - logger.error(f"Workflow execution failed for analysis {analysis_id}: {str(e)}") + logger.error( + f"Workflow execution failed for analysis {analysis_id}: {str(e)}" + ) logger.exception(e) - + # Emit workflow failed event await sse_event_queue.add_event( StreamEventMessage( type="error", - data={"error": str(e), + data={ + "error": str(e), "error_type": e.__class__.__name__, - "traceback": str(e.__traceback__) - }, - message=f"What-if chat workflow failed: {str(e)}" + "traceback": str(e.__traceback__), + }, + message=f"What-if chat workflow failed: {str(e)}", ) ) - + async def list_conversations( - self, - analysis_id: str, - page: int = 1, - page_size: int = 10 + self, analysis_id: str, page: int = 1, page_size: int = 10 ) -> List[WhatIfConversation]: """List all conversation IDs with pagination""" - conversations = await self.what_if_message_repository.list_conversations(analysis_id=analysis_id, page=page, limit=page_size) + conversations = await self.what_if_message_repository.list_conversations( + analysis_id=analysis_id, page=page, limit=page_size + ) return conversations - - \ No newline at end of file diff --git a/api-app/app/utils/ag_ui_event_converters.py b/api-app/app/utils/ag_ui_event_converters.py index f49d6a4..a86dd6e 100644 --- a/api-app/app/utils/ag_ui_event_converters.py +++ b/api-app/app/utils/ag_ui_event_converters.py @@ -1,4 +1,3 @@ - from abc import ABC, abstractmethod from typing import Any @@ -7,17 +6,15 @@ class WorkflowEventAdapter(ABC): """Abstract base class for workflow event adapters""" - + @abstractmethod def handle_event(self, event) -> Any: """Handle incoming event and convert to desired format""" pass - class WorkflowEventToStreamEventMessageAdapter(WorkflowEventAdapter): """Adapter for workflow events to StreamEventMessage format""" - + def __init__(self): pass - \ No newline at end of file diff --git a/api-app/infra/bicep/main.aca.bicep.bak b/api-app/infra/bicep/main.aca.bicep.bak new file mode 100644 index 0000000..1fe3b22 --- /dev/null +++ b/api-app/infra/bicep/main.aca.bicep.bak @@ -0,0 +1,165 @@ +@description('Name prefix for resources') +@minLength(4) +param namePrefix string = 'aiinvest' + +@description('Environment name (dev, staging, prod)') +param environment string = 'dev' + +@description('Container Apps Environment resource name where the container apps will be deployed') +param containerAppsEnvironmentName string + +@description('Container Registry Server') +param containerRegistryServer string + +@description('Container image for the backend app') +param containerImage string + +// API env vars related parameters +@description('Cosmos DB account endpoint') +param cosmosAccountEndpoint string + +@description('Cosmos DB database name') +param cosmosDbName string + +@description('Storage Account name') +param storageAccountName string + + +// API App related parameters + +@description('CORS allowed origins') +param allowOrigins string[] = ['*'] + +@description('When true, deploys the container app with internal ingress only (no public endpoint).') +param isPrivate bool = true + +@description('CPU cores for the container') +param cpuCores int = 1 + +@description('Memory in GB for the container') +param memoryInGB string = '2Gi' + +@description('User Assigned Identity Resource Name used as identity for the api app') +param userAssignedIdentityName string + +@description('Additional environment variables') +param additionalEnvironmentVariables array = [] + +@description('Tags for resources') +param tags object = {} + +var appName = '${namePrefix}-api-${environment}' + +// Prepare environment variables +var environmentVariables = concat([ + { + name: 'COSMOS_DB_ENDPOINT' + value: cosmosAccountEndpoint + } + { + name: 'COSMOS_DB_DATABASE_NAME' + value: cosmosDbName + } + { + name :'AZURE_STORAGE_ACCOUNT_NAME' + value: storageAccountName + } + { + name :'AZURE_OPENAI_ENDPOINT' + value: '' + } + { + name :'AZURE_OPENAI_DEPLOYMENT_NAME' + value: '' + } + { + name: 'AZURE_CLIENT_ID' + value: userAssignedIdentity.properties.clientId + } + { + name: 'ALLOW_ORIGINS' + value: join(allowOrigins, ',') + } +], additionalEnvironmentVariables) + + +// Fetch existing User Assigned Identity +resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = { + scope: resourceGroup() + name: userAssignedIdentityName +} + +// Fetch existing Container Apps Environment +resource containerAppsEnvironmentResource 'Microsoft.App/managedEnvironments@2023-05-01' existing = { + name: containerAppsEnvironmentName + scope: resourceGroup() +} + +// Use Azure Verified Module for Container App +module apiApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0' = { + name: 'apiAppDeployment' + params: { + name: appName + location: containerAppsEnvironmentResource.location + tags: tags + environmentResourceId: containerAppsEnvironmentResource.id + corsPolicy: { + allowCredentials: true + allowedOrigins: allowOrigins + allowedMethods: ['*'] + allowedHeaders: ['*'] + } + ingressAllowInsecure: false + containers: [ + { + name: appName + image: containerImage + resources: { + cpu: cpuCores + memory: memoryInGB + } + env: environmentVariables + probes: [ + { + type: 'Liveness' + httpGet: { + path: '/health' + port: 8090 + } + initialDelaySeconds: 5 + periodSeconds: 60 + } + ] + } + ] + ingressExternal: !isPrivate + ingressTargetPort: 8090 + managedIdentities: { + userAssignedResourceIds: [ userAssignedIdentity.id ] + } + registries: [ + { + server: containerRegistryServer + identity: userAssignedIdentity.id + } + ] + scaleSettings: { + minReplicas: 1 + maxReplicas: 1 + rules: [ + { + name: 'http-scaler' + http: { + metadata: { + concurrentRequests: '10' + } + } + } + ] + } + } +} + +output containerAppName string = apiApp.outputs.name +output containerAppUrl string = apiApp.outputs.fqdn +output containerAppId string = apiApp.outputs.resourceId diff --git a/api-app/infra/bicep/main.bicep b/api-app/infra/bicep/main.bicep index 8b370db..abb95c3 100644 --- a/api-app/infra/bicep/main.bicep +++ b/api-app/infra/bicep/main.bicep @@ -5,16 +5,15 @@ param namePrefix string = 'aiinvest' @description('Environment name (dev, staging, prod)') param environment string = 'dev' -@description('Container Apps Environment resource name where the container apps will be deployed') -param containerAppsEnvironmentName string +@description('App Service Plan resource ID') +param appServicePlanId string -@description('Container Registry Server') +@description('Container Registry login server, e.g. myacr.azurecr.io') param containerRegistryServer string @description('Container image for the backend app') param containerImage string -// API env vars related parameters @description('Cosmos DB account endpoint') param cosmosAccountEndpoint string @@ -24,21 +23,24 @@ param cosmosDbName string @description('Storage Account name') param storageAccountName string - -// API App related parameters - @description('CORS allowed origins') param allowOrigins string[] = ['*'] -@description('CPU cores for the container') -param cpuCores int = 1 - -@description('Memory in GB for the container') -param memoryInGB string = '2Gi' +@description('When true, deploys the web app with public access disabled and a private endpoint.') +param isPrivate bool = true -@description('User Assigned Identity Resource Name used as identity for the api app') +@description('User Assigned Identity name (existing in same RG).') param userAssignedIdentityName string +@description('Subnet ID for regional VNet integration (snet-appsvc).') +param vnetIntegrationSubnetId string + +@description('Subnet ID for the private endpoint (snet-pe).') +param privateEndpointSubnetId string + +@description('Private DNS zone ID for privatelink.azurewebsites.net') +param appServicePrivateDnsZoneId string + @description('Additional environment variables') param additionalEnvironmentVariables array = [] @@ -47,7 +49,11 @@ param tags object = {} var appName = '${namePrefix}-api-${environment}' -// Prepare environment variables +resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = { + scope: resourceGroup() + name: userAssignedIdentityName +} + var environmentVariables = concat([ { name: 'COSMOS_DB_ENDPOINT' @@ -58,101 +64,44 @@ var environmentVariables = concat([ value: cosmosDbName } { - name :'AZURE_STORAGE_ACCOUNT_NAME' + name: 'AZURE_STORAGE_ACCOUNT_NAME' value: storageAccountName } { - name :'AZURE_OPENAI_ENDPOINT' + name: 'AZURE_OPENAI_ENDPOINT' value: '' } { - name :'AZURE_OPENAI_DEPLOYMENT_NAME' + name: 'AZURE_OPENAI_DEPLOYMENT_NAME' value: '' } { - name: 'AZURE_CLIENT_ID' - value: userAssignedIdentity.properties.clientId + name: 'ALLOW_ORIGINS' + value: join(allowOrigins, ',') } ], additionalEnvironmentVariables) - -// Fetch existing User Assigned Identity -resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = { - scope: resourceGroup() - name: userAssignedIdentityName -} - -// Fetch existing Container Apps Environment -resource containerAppsEnvironmentResource 'Microsoft.App/managedEnvironments@2023-05-01' existing = { - name: containerAppsEnvironmentName - scope: resourceGroup() -} - -// Use Azure Verified Module for Container App -module apiApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0' = { +module apiApp '../../../infra/bicep/modules/web-app-container.bicep' = { name: 'apiAppDeployment' params: { name: appName - location: containerAppsEnvironmentResource.location + location: resourceGroup().location tags: tags - environmentResourceId: containerAppsEnvironmentResource.id - corsPolicy: { - allowCredentials: true - allowedOrigins: allowOrigins - allowedMethods: ['*'] - allowedHeaders: ['*'] - } - ingressAllowInsecure: false - containers: [ - { - name: appName - image: containerImage - resources: { - cpu: cpuCores - memory: memoryInGB - } - env: environmentVariables - probes: [ - { - type: 'Liveness' - httpGet: { - path: '/health' - port: 8090 - } - initialDelaySeconds: 5 - periodSeconds: 60 - } - ] - } - ] - ingressExternal: true - ingressTargetPort: 8090 - managedIdentities: { - userAssignedResourceIds: [ userAssignedIdentity.id ] - } - registries: [ - { - server: containerRegistryServer - identity: userAssignedIdentity.id - } - ] - scaleSettings: { - minReplicas: 1 - maxReplicas: 1 - rules: [ - { - name: 'http-scaler' - http: { - metadata: { - concurrentRequests: '10' - } - } - } - ] - } + appServicePlanId: appServicePlanId + containerImage: containerImage + containerRegistryServer: containerRegistryServer + userAssignedIdentityResourceId: userAssignedIdentity.id + userAssignedIdentityClientId: userAssignedIdentity.properties.clientId + targetPort: 8090 + healthCheckPath: '/health' + isPrivate: isPrivate + vnetIntegrationSubnetId: vnetIntegrationSubnetId + privateEndpointSubnetId: privateEndpointSubnetId + appServicePrivateDnsZoneId: appServicePrivateDnsZoneId + appSettings: environmentVariables } } output containerAppName string = apiApp.outputs.name -output containerAppUrl string = apiApp.outputs.fqdn -output containerAppId string = apiApp.outputs.resourceId +output containerAppUrl string = apiApp.outputs.defaultHostName +output containerAppId string = apiApp.outputs.id diff --git a/api-app/requirements.txt b/api-app/requirements.txt index 7191582..d4d83b5 100644 --- a/api-app/requirements.txt +++ b/api-app/requirements.txt @@ -9,7 +9,20 @@ azure-storage-blob==12.26.0 azure-cosmos==4.9.0 # Microsoft Agent Framework -agent-framework +# Pinned to b260106: last beta with the pre-1.0 API surface used by this +# sample (AgentRunResponse, ExecutorInvokedEvent, AgentRunEvent, +# GroupChatBuilder, ChatMessage, AgentThread, handler). b260114+ and +# 1.0.0+ refactored these into WorkflowEvent factories + AgentResponse. +# All subpackages pinned to matching versions because the meta package +# has loose deps and would otherwise pull core 1.1.0 and break imports. +agent-framework==1.0.0b260106 +agent-framework-core==1.0.0b260106 +agent-framework-azure-ai==1.0.0b260106 +agent-framework-a2a==1.0.0b260106 +agent-framework-copilotstudio==1.0.0b260106 +agent-framework-devui==1.0.0b260106 +agent-framework-mem0==1.0.0b260106 +agent-framework-redis==1.0.0b260106 # Authentication & Security # python-jose[cryptography]==3.3.0 diff --git a/docs/diagrams/private_architecture.png b/docs/diagrams/private_architecture.png new file mode 100644 index 0000000000000000000000000000000000000000..ab940d0457eafb462c079abc3739c97f28fdfd8d GIT binary patch literal 1495332 zcmeFZcUY6>8#YW^t#v^i2r}znF9&y_kE4?IC!ebIo7XJPq`Mf2Kaqkyy}Y+!)# zZ2H?({#2vEOPBT(xfMd6vz{0nJ1lag*dBedthmaxweF@wD^#o4!m>EaxwU=o-uB`4 zM3p@!Um7@x|M-eMyD;74VdRs$SK>~eJv;u9pO^Nc*8FX-FNs?)niT>s_!gUm<%Nq3L_>*y1n9|Zn&@Hd4Ywf=SRlFy!me;vF# z^Na8g|2o=n`}%gylaQ{pX6X{O3&n zT$2C7(?3^)<-dUcuO;~}GyQW({>%0MToIQ4K*_(BBo={sSfdT9N-i z$-kE5{|zWvu$cd=HvP0Z9)i)Ee%g+dM%DY`d(IRsa_p*OOa)` z=<=peN2S=j6`uI*ps5a_X*zoM91?+pXdWNV+$&$dO zw{%zUNE6<8o7x<43YlH6Usgl+uHLGdh)lHqiv=K-`o7%vWpOXHzkw2lpV4RPPoO() zUpVjUAE*@l%i1)8v7IbWde!IMT0?3dt7L!3$EskUgC7bxP>*Sg=C+^8?pWO#xZdW4 zpwh3fh4UUCApbPdaJ*}K8VjY~6h~X0_i_L72`}!{oe27CC;i0r)W|wU#-`PE6CdA< zdQS#sz4CQp^s@CE7+dqgu)(%EnF?YTp6k2}zZ!FVI#4F_$L{?6ElaCAs{-D5Vs)$c zgMA!9@~FyNA)zd&@LQ?ip8efh{TtYiwKG{4@aKTuUrfQ>v=nobiCl^(x;W}#)QR>_ zr!qUqkA9N_@2>M)^~`c3sWA_{^`D6jrj&f@^evGy(yYs(Q z3-FUz|MKoE^YV^~y%B9~ZL+0JclxIC@`@hs?$BnvjaU}WXZG`{uD@)aF1pzJp>AnD zE5;q)w`4dKo5xVJ$ts~l!6SMFqO4YGV z3S3-V7S^O3_NE9FDK!B)IuT4{2ghq6^e$?>I(>E7Vq3ZWi(lQ1(fNB*KHR>bZ=&ji zL^uvFt#QKNZ3S|%Ukdt&tVoVM#KXydQvUU)<`D@fX+lL;es|LZ&F#BdZNGbeuQxH) z^O1yQ)op9!%a^Bed!C(44#me=v5|SLq)^C-2JPuTCW>tfyK8;Mha}qKPoKVSdnYt) zec>glp3Mh8a{0kn#YB=sWw#_@tk^PjPEL`PRN}J2^OqYazUg_$_t$dsHop?+RiCYc znkQ4lMO-%Ujy;mGI)d?~c0ZhL4>_maj-UY4QnZZQ6dNK$ zVIqW3oR^;;5f>LXk3~tdDr|n1pIT}5eG>~TCcv#ZEH5wbQ6+m~nImzGX$5d9@fdw$ z;TW8@9uW$sUw3hF(cMU9tE{YCom!hMt9o@o)_vsHhG1&U?#@P({l3GID%A1v)=Up~ z_s6)MUA8ixp@KZCYRRDW`6D|tB1bs<^H1I@m-o%y4k3E;S@!FbVu_J(Rgc(dTWiB( z?1_nGp*u9Q>fP=DLUHvg%W6;kH@&L*1_nnPf+&v>ii>$Br0|&2iGdP{-nq{6PxM+> z+gW2cY^;)?TZBSffF8!SX}8<#jh{=AWs@pxec{+X{(#>PZR6QA&?UUnnJ04Ok;iG~ zbeo;UQFU*0OR%LCex+HJQ*L{uZhkO-K$4hsvt5{js_o(7u}z^2fg3z6DkhdyP^TEQ zAs#W2(=h$y0b5Kn8~yi*w#3E{@_{WY%(r@`Z;}K}UnuWX47s$> zCt}Eqwva|!3k$B<0p#v9fg@Qeb{~J}*$nIYv%n2gig1-~=*`Xj{LxWT_2*(#7e6>s z<-Gf60{l7$i@J3A&MTLkq&CRL!Ur&3?a9|e1*$x;W4A}?6V%3MDju%u^L^X<RM7fhKyg3MSOqVhwf^XP=I^W(R*RyF6;<%~Vy(`(>fe&;i(a$8~WzYxC zXI4>Hy>tcRBbX_`-VoUqm(#0Ze-JNtnrVvOOD`^;pUSrL9!qXIZe8a$x&W`5d8xr4 zrODX3H0+?kv-+}zk%7Y07tcx+KRTam`xH95k5xsQuO4AA?6CC=?QbNDkEro@&ugA+ zeS!9VbMeE|V$UpH~|4!X5HKjwBizN3W* zn_!PsR?X>vW2;Gx-fauW_B`L7n4WYc(jdj)5b4y`GsCr=ZRb*0Zir>At8oY^#qCUd zhcrsJG(%-N#E@@5%7#~sR(xw+YH!P{$|)yNKFS!dnSLLh@3TL*Q6a<}e+ z@G3fp+dD%Jg~KU}0iWN6Pnq_rauaYN<*nW!Q}#kFdF8z^v3!VeT?T9S)^rylG9q3` zj^2X>(Sy@}D#E*CK5FX4Pi)R)f7qPDL|+E1RvB5VD*G_4dM%J2n(((vocfFMe;aI~ z3iBLh+fcujrW_LBhqI5}oWkpQY+Q{$$RQCE+1WXdE45V(H@^usFM2U0cQsAYnz1{% zJvKJ>><${cIx^@Y5&E_XWQY@z7CgO@Hb-%a)Kn%&aP#H$@UCWOm`j*bVCrHc>JyFqf2?ErC!h-VrYZA`F7Cgn|X!Cvz}WW(W|S+RL5?ohlPa| z;fYv)JK`yei;EMhP)IlKji(zuya3rN8f7V@^MOluY?;`dYCrbTyv(^H?%BEBB>A;R zXHK7<8bX`2)wq>Lt2J&TPqf#Dv__gW-ck?QakGsUlj6nXPIEtHkVht{8j`(kCG59U zJxJ4;-D0JUT=tSp7i?^?G?^-EI2^7_-6pS&lY84Azj;$LSw{c~LUm*=)2n;Mu6b&B zKkW8SdM08L&CC%ah_`oTJ={Px>$dT|s!Hh)#C758tFnrr(C(PRk`l`2tHIInO@sjy zth}qree@`WLV>9M))YvdE5Zkm8R3>CjmxxWN?ta@9woL6N9EO-_|;+nFpem}8jjOc z&f5BFsb=yMS9=EeWIe`?GcOeU99&Wa4j8d2hvnQ?&)89_B!=*3SxrchszAQkr1D!0 zETYC@FsbIUN}Zkf77jI-tJMbfd|#ncuk4Pyt54v#o10r|g9d?nY$I)~!o@Ikne1+` z<*O;lzDW9U&AVyX1ItwnsX3F|oyLx-@^BlFKcQAF&HSetvfk(2T|;Ws*WfENY-*1I zTQ%-YRayPq99zNpqOhG$!x_osXNZd(h108n(Is;_ToXsC7m zy!|wY^Old}m-5QW&I_uoly7cbWplC)oj(=c0zj{m^#)=I3kxtZMp0L71rPuD$FILU z`E)txaQF46HdpnFgiVaDxoDM9BliY3-#>8rH{NS0ry(LgB-mtMy>j>XZIv5U&Gi%p?SrP+u<(Ig&=*h=C5+Y-Hxp6fP7N5L!OheK8t4h^%&T-@R{3S+T#$ zqbLolC7(P=n<^}oai7W4?s)j|wu6Jq=7+u%WoU|Fc!E@NN>c8rGkoaIp+fTD1iR|i z_Q8hrF@k@*koEG1zCDNeWUq8|bd1%yRWG01e9^pbO~7SpCUbqaJyYHYeT>@Yspc7= z8uGlf7@1MCyN{Kx|E&feRJ5-nvC0GYav$HxqB9!D*2dctZ@ua&bRf^=u0D)PmLJsf z_pdr3VeQIUZYI7sTI?2c0b!2bcF5S!ksj}o&rG?DgD89mr5sIQ@aLO8)Ry$7`;U*fdZw1=SNo^WeAFjdV!z!bS zObQ))o)_*?$B`<*R7LCruGTl*r}BNB6m1Mum{3jX?uhTGV@zIVE=Y5PzhreF!9-)kLM29n`d`}pyp2HNn5m0F?H>WsxQF?f-*R<|1z-1JxZ!oqTC zQvJuTt=5^Yu;^4BHqG{H8e&zN)7pp_!UVP=6I2;WAva(D*3tQ~|52ZPMQC%FawQ|^ zJxnopSbm|WTW&+fLoT=^@WTBrUS+=<+_Ih*9uMW2K+2-Ix!aO<8+G(lsUaC`Y})-K zggAQTX%fwvkz6E-7`1#(UMfXxruoi$y< z_RiAQ7hSk4Upqg&3U{aB`2_@cuqc1;0$f+%v`Pyaef-SCgq!t3mY&)GznIBb@c_z6kJ3amLDDE2 zGM&BTH6q(F=Kk{N#<|RWetETyFhQ?`hm$p*Z6^v1iW@GED7m9hq7lo3XtbItv$tsM-|cH?z572cz&*l! zVHpWXmuX3-zDf3tBSQs&iK50u&)nzAIrGM3+zNbhB6D&3H7&|q6LWPl?Km;@4pEJ%@*U?K z%gp>BT}fP@7_5hRw;x?U#QRFgs|f;iMa%MvojG&W7Jl)a^s=NWUkvO1{rb_1Lr~*r zF8|W#v#nkuc{4LJJPwnS0)wwF!xKfU$2>7bMdFY&2=t zYe@>K zmmEsQ-6A=}auqAx3bkfCYpYaz*7K4iE$7ysWy~!6WfWb$GY9E1UqV0l|9~8wG0XP% z!`IX6&oAl?U88uod zV13c)aoOcgy$eW}fkPOkRm=rRyMB86xy>1W)%wevFpFX=)&iA=R*!-rBnk6VIZY?qB9Du_iXmd~!sM2^xdXcwdhh>^+2G|OFZqt4 zyfU#t*gC%+wEX4Emt9YA7Xlj4h2E2{h}f+U@*~8Rs;cbpO-0DG4$;F)iIsts_Gn2J z`c#)c;aZ|dmbX_!&JzYhJZ7!cZRP{nM^ME&D>G0RTzu}1QNEQqJh(OgazjwT%~RKv zV8mfH%PQx!gnUK#++(}cto{3g=30~2S8J$i$_T`447Ahuz!WKNe3OPEsMo^1WZlQI zPnP4KRmDDf^y$N7^Psq_$@#unhf0e|U#cg3dz8bXDx}sfb@MQHr2|HGsMHd@uyq|= zReLzAK0bz5QeZ<<*9gpEim>H0yQ0fGv;u?LH;_P3is-OGO3W%PKx7iNElJbHFR*o9S6?XX zRV}M^OcXQjH$0R1sd0y1=}1&;uA*;{OhM)bQPKStC@}l};1?8CQo;zzI!%P2A`T9h z#G;>O?GGyh`(vxM=3Dz9oYiIFjYF8n{Ra;yJLqX+q)9Q)EQmzw7)J8bS_ zIRL^eZIPk9={vp&jE2DSN%?dozjG?t;+kO1U1k@D6j-;DM64|;-G&T^7BapeNU@d{ z=awh!XElX%Go)2`%p0w0wJB?&CBbrs5lekM4mnzh{R3IoU8i#)zz?6eU~bvjaWO`P z3arZ=W7Y(txfUqNHlJRcYCeSFl@GY#)SF@4_e$M2A$Uzy@%>P5xDcr@DlTiNg9<;t~K_+mB;>j=Od{1E8Unl&Q|0 zX7t8by_TkC-=}tsF?cA5FVdb%mXVR7(?+;P|LC+p8^K+9^L=d3n@~_fzj?13CE@-1 zT`H@|DZ%T+u_}F>jdxJUN5ip3`*1tVteB}tX!CWMXpgCNrxlH58>H3C7dw*Pe@Hc< zv|q0XOH=Kve?7ROk>JTPWZ9$`9bxm8hyVh#- zP0G1l?bd6_)gp+`8K}gBglv8!r_cduOR2TaOsWzLXJ{LI0^8At|A5|b``dDl>z?q^ z`}+~gt{d&6d2X4FN*#9+%oX=e(7a3Cq;SYHbMNSfBh81{o@+69ErM5{BO#cK-VZmm zv?A?_d~&p0N9$|t+)0h_F_1-Fn#%D29#c?dv36StnaD2JO0G5<&cCqxWo;K0+Dc##ryqZ;fMWbXB!Ig1H1l!0$15-RoC#AFjB4F1-OkO;QBcW12KY!&D*@={ zu|~i>z6IUaz6ISKG1jOG5JH>HZr*%S=fCL8dGMfEK@8FJ91%t<8qM8TdY~Zhf`bp_ zi6QU+5R7!DoqE&dqOl?NwgV$ef#hhqQm{!>vZTyo<6;B#?pyYU?GeT1Zi>V3pO!B~ zYcd3GEg(|8?>_+b#Nyj`R~0&4Q+eJiK^GIIJQtC8n;`S9q|#5LK%>1CEd4o!B@pK-&~_#59Q zqYYuUjMuMUF}IyYA!Z@3M-Ku&{FIi76qS}9Tz<9@rzM}_*LD&8)X#R8xB# zH&TW$j42)f5M>DE)T>M(X`??p$2)Y_K@~%09@&Y@%bPXx@us=)gR~s9^fVkY&4h!l z7AaTBt4jEhw5DnQN$UY$!J^tNf`PwRTz0A_c(+j{bpO*SWOX z6a}Xe@E$_|am#r0U+cEFXUAlhMV_D(KZu38a`V?U<^lYiTlVPDFQ^Fqv-tsKw{pwY z#aMlUX{vK=*xqodm08MQatQ*Y+l_5{X{hB!_zA{Fs!PMgg$2ozBp($NY=F*>cm;ek zbp#Y#ZlB@Qu>`NtDu_l5pUhGzAlToSxih-On4!TgLqtR*cYo26%fMn#qLgXR;fp>E zlDtZbmB}_AeCckbp7|gQl%zh{uh$SR-<9eX$wWuzeS54RG?z%MA}Fq33WXi+He`HB zC?_Oj7^)N^J2H}86cqEZCDt;#sa_P)1YGuf;ZT7Zx=24cM&a1d@rue`LxNH0R&(RL z*8hy7$vexX$U0S)HJUQ)Rw}P770e}*=e6k>ki*=BfDiI7bpR~Xo}1Fju<3#?WYCl} zGSApzO8?&Qn*mS15ftkxWj=jb+r-Hql#pGsj3rii^%XtuOcq1_(Q>VMv*P5%1I9n* za19kG7?s|5dOG)fRyH5U-o1PC^-AU86yly#GcDJGU9(yPUeB6S8e72q577^>vYL=G zR1Vn(Z)}Sd4!LrQ@t({F74`F;)mM)X&V{SOmd0`b#<8aPmX8P?_~nX{%F<_Bq~|_R+iiZ#6)Vj| zlI%UlcR~VEOG}Xx^}8-E$chD!YkKFpX~A75JSN_#gF`+Z952R?sVWreEcClVv6TQW zK7;`K!;V!WnhH$vopMz=$b;o2*nZg&xZEIl&f; zd{wXmayDQ8!OyJJW553Tf<{?9DR?t3yW6sA?CecZXSYn`aQ^mMIK0m|WCv^PvmIRS zg;O0c8_mlL>3(NE#2bQV-7mwie)iP+o$-M8Nxjl9&Yji!wDddY{sy(OASKLcsSEeW zpPu|`Twv6<{(_{=G)8k@JXf1Zkwr1U-I0>Es!fKJgBx)es~(%9>Eq*o0&C1zNuPW< zp+KI)->|wf<9r`rQ@JJNRTTH}BS-8wwKX9!yolb3hPtg7rS#Nw_6?HSlj+`}0+S(t z&DV!fB!wY8N5@=Q_wnq*+;R&$v1K;l0!7a&+ z0pcQSZ|eZ{yj(_rYJCS9ZK!91_~Hyh{Wyf_b{k}jOlqnXJbms~S&iyw#92xV!R6T{ z&A3qO3Ntp9JBXMI<$JV1MbE?(oNe0<*5u^C6Vl+Ci~;`lb8AX9%Jo|ap_(>YnR9&X zJf9K32I}Tgk;W>t;u(>Jny^@|;>U-`xA)oEsZ(|__U!s^ZfCTwR=Ul6B>QZB&>t{s zJ;0vEg|^v=7t&K4N>*E&QG`B~VIy3#8{>d~*|GSP6h|&G{3OX{^;Rt-H-3pBSz!T} zaw$TheQfKH841ZyF}WC3jm9e5zlRcDten30b><*V7QW#=FtYXd5VoID5<>9;M4kPx zyUN<92V0Bnw#U8C)k1DOn%2BiVpMizuXQj~yO>6nN*w_-kf?ybtihH0V9%Zla?YcX zu?w6o$d7DdbysMkeyMMmd`E|f2yKnvwKh(w+YBg6{yLIOTi^1$n7 zYEoN$RmNff0|^TVv_)$Cmt$kkwWPJBN~yWeeEd91wuo8ufLpB;*3k40way{-U%oX? zuKxLJApM)xv4Y@+;@{PX@zS|>k&p&Qnerhh&Q(CTfC^E|z$_VM4#wlr#nx4N> zkE(GNWULOurKj`p&D`5|Do`p#Pg^Mm#UF6fD>fK6c}(}r^vXRRM)2l6I+URTBa|q4q9t}b z4KiyoTrqWtt~SQavmNngMa0EF&ces0m#M#YAcl|IV%&Hso!nlFncbF4!-4a=bikjW zLSkp#n0P10>^!;dha?tcTV=9x^U==;l4_67tYV@ARQ%nI(4$X}ufzNJC#(h9o8&gy z1dHT%}};?b+liLl}ZsNCP{q!RRK`E`Soy1jj_`m@JknM>Zwx^4!J2l47Eg|42)yb-mdGKAt>l z6xEq=@24>0bdVp+Rr$-xeh?XH-oH2wI4eE3$R=W?+i)>@gxWS*Y?u`UZP@6Kk_--o z6S)+~_1DxB`!>>*4%>r(WfFfqnrFGo=Dh%Dy=+}HEiuIRWWw?$0C&2kVsd$$V`l+7 z)JKAJtiZJ|S+P!a2qQ9W;KK(4f4Zb;RS`f%2`*3m_>60y z-!3y-Q}q@C?1&+qd#qsRu!n%AW_zq#a~mWQSEDaxQapU`!9GyatNLCKkLA$^>5GT2 zH^rm7Aue+zhd%GITwhv*?9a~3YD?OZN_fvD(!TvG)lA;4C*n4AX)C!ZS2-U)0ypYCqQEu-nEJCdTrATYY zx2laBZf)moTf!!HN$kL%t8Pslv^LHPD=DzqX<}4ghqhkRpbuIsOEy;Fw)$0|>*njN zP;H;>fB3=oI|ceo&)Wdx6FGhQ{eo(Fd9k98^t*G8AR)tt-4BP(Uq;d&mOYyXEvzxO zijY~+)RAhO-e3lTA>)oN^}<=vtIWhB0oe_VeY7QpN2LI8?|Gn5@u%NV+{L{dXBN@C zBp+mNS|5`k1g*GAk0C7qt%MIpVnq$Frz`p21irHdvOqI3IU9KhQCW^Ub z++KJEVuUN`lZBPNeS67z;MGG&;AKmCnl)1ExRfWCwythZ~50<9qwTzrctM;x!T1mtm#z706kKzmPK9DLbeAHQL@ zTY(FtWzf?L&=Jx#(eKddbq8?Vm_H#77Ge~rxd5zh3sI|hBS~g8c z`=7daQP0=M2-MPbFClIc7j7i14-C41&Lr5_!eAI`C&=Eq>mcH}kdIT@o&X0cSbcba zJ*0!QJINMIyeQR}4a%|6;)}OF*w<|=CT;O`J(BvfMyV>c$iE#>V=&O~ehc55iPp#r zElJKq414ke8b63Jt*0}Mu5dRO9@ch3=f?>&L+q7cB-v=|b@Czd*~^Xxnn_0y!7%80 z@IaAEk&C#1jB)u~Ph~K}z`&rwz4bt|8AzNK(q40)lta?hh_H-CWJ$n@hB8lu_s=Ql z=nC8o7+ z9C%9*hM5xwez~)>G7kUg=VyF(c08xf4m6j=Rd~=@i>-E$XGJ843CxB9=m9Nu!zPBB zV-F8?%*<#*;|&d@J=$~tGVb-hVICK{xhj;d3Rgtertmsfn2EcZHDy2oZ$8;-((|2~ z(FCE|s(qa!qb|1bEjKlhVkBx)|IEd`tIC7fFmX{nbzVO{H02go)03x9OKTNg>7}hg zWwkSm0Bu$V;ldCHxCs_En_bG2sPWZ5J*^3}RY;YfiG>D$acOvAEI;0}p*Hivg$q_| zO=8sRwoTU^nXE{Tuh76|QLQh9Hc|~izt5g-r+oh0?)UlgMoQ+@J0fB*eOP&>u1hSZrTTA+=L2`d9(X}%|zga(w; zNJ|xIJpWXznqAP_*QT+{fEw!0QKLo>@>f=lhC!+P@-OVpXo!HmL37QYt-sK|(x?;M zZEizF`2Z=8C2)usw5$iG#HAFNP6QbK*=0(to+s?bxd0ywgYMizE@w%tw80%z5<#0L z-zeW8tSnwAp3;UPafQZ$p2I6TA6NEZh4esUZ-xr~O<+nb2=2$(joT(^fHCTl`QfqL zaAo~Ua^QPdE$GB^yJ>||*=%ucr8;};Z@+t`?&=M9lY#XyY=Vdso*g<(<_*3F<7xc# zw7Sl;n(p%g)H31{h?4n4CD`Kn!ob*T?|8xObNX`BCPRR!AegGAm&IH%?w?~^=nZX$ zxl`KSl$TQm$x_ZBsVg*cGjoO0bQ4qdu$B;zcWzr!>=LV>h^|G z<3ffJVDbOr?}iu|^mWV|H64s1nR^Vqg$c!X1TRK9^>GuD3b)9if5~=OSnl3$-fmL< zyD(*8cv*+kGs%3eSi*#a?M||&v6ftgXK`!Ojw7cn6TT>hisF-@9x3cD=vxn=cd=h3gHvpR{TLzf7AleqkdLJ?~-!pwo)Ud8XPN<^qe_DVI zBCfQOFnySyZ2*X8zM#*$JPztnCx#^Cu-U7)5VsM>?mEii1pa!Z7sh0$(Ae0>C;{lQ zbL=%WEgF4tz;)hMWLSFE^}Sa9?YBz~S)KDhfAc4UCF9Zdk!Qz`INssMV~dZV&mUBV z+nVb!kh;Yw7CUIJ=8@iuPOkW6>qTr<_^Yfe==_S^POW1!_G&lBa{-Y%0>FBKIa4Tq zka!CC(G9^R(E75H*@sOZk2QAll1^pV7+RGfjwdz9s%=xan51`a%*kS;Z9rc|4}dfj zpdLzXi)N;ggT2b>xCM4IAo(x^nW7SpLmZxNkBjr8zTId1>e_z5b(%5hD_^u^x~5() z`PtqbnC4{!tf5Z*AQZ6B0DZ|kwk$S*%X!B!bq$lM+_HJ4CTMFyfk;q#69}mF$dVda z;Hcy8zH?NbZyfbfiQ`A$s8OJiNGfMTW^iY|#pwUnB?lcOgtzA3H0b3h{ukX!ZLQsY;4*SzOKBY1@ z+>tR_ug-9vnDT1^Vko08&C)d`brh|I;wOC1U^?tD5LBp#)7IPSk~nrR=xs{=o!a!D zfkxgM-t9O#3pMOD@?yb%Bh=}*l#LasNyX%dfOcJW)BOTloN5p`9kibnK*J$P!q(2v zv&?L;46Y<$Ro{|-{@@xZ?)}O#ZK}N2nI4l4=v3wBiCI8=MR)+4Fag2qpyQmpSR7 z1F&IWVq((R{*EyoG9B$d-8b6>Vsc4`A@1tWYOgR}wF-J3Qh*-)6n`f3CIjOs^EmvE zKb*%$0(&BYv!AfwZmDeag7dNFNkCKE)hh$(rH+!wey*g}AHrWw|xC7{cPg9-*6L z86YP)9|V{Jhq4(`=>k&*!ECv?4%K(6UlgnHY?^hH@f|Ps_JQQgkRq<3LOd!nb|TmmRLj=V7jctb^mHLozF0}L+^_^}1^-Pwx*NOa>sM>M zcAL1r_e(x4K~0CZE|mev8}L&XWl%-!nw9kn*iWjVZG)r1CZ)E~Hvc({f7@pe#CvF0pL1hudkyV&92C+Td_gyH2pJn75%8;nU%GU+ z4n};Xd8|>N;%aQI+I0WJtup6vj8}f(KrU;wh;c!}1e_clBCsU8%OEWqlz6=A zN=D}$X|BA}!vk6w_)qeHc?!BUaubkS8nJA=x8zPX&%S>jxj69y%w@OeBw(9<2xn7l z0-f!k$pz$}klwezw6p|dINrs9zMeL4$^-%*(g&zttD~5*@r- zclFJ{>aS4Um_3E=6h(FZMtV%0-_kQTpERI%Ds)5Yrd(JJW;Wg6MJPKM3$CxMc<(_AUIN% znS3R^8=$n0C!05!^*pM|V@)LnIb8Yvg5GgfW>#!K9G__zHs0Ri0x;SF16v;K`{Nq8 z*2UXCZ?wX~3;h=Q3rs2_Q>0yI%6+MF046Y*3#RB1G$!6y6i15K0v9ngh;r;64@%#% zp27hvd>nMZHUJa^zzw>%?vfZCX#l7VK!-mDozJ{$`|-ydXiA6)(l}ht8tPGB>sk9i z?c1g1R(tYI{|mqmHq{-UdexmN?PfC|(2}q|XA4Z3FN6K>>f_H}9=5Ta@ap~c*jrp0 zpjM6v>B&aJ7RDoHG`~H`!cuec8{!9?N|OdnzQiQ|PU#7h1{+(?->TO?Uv~Gs$Op`^ zZ{K0X*s{vQa5PUCkcES_zIY~Dkg=P(#>`X|kOwphvpdSx^R;)teDU4)5#Iz)a6s^9 zHtrIzRP3Cb!k}2n1$XK0rT5jDz$-bJ zDk;FTK*dEgBifH9ro|P2ekqfmS)1)Dv`7?vV)(>T_kr)v zvTX8xzfu1<-E{RE!N@<(v9SE#Zd&(Awb1u3+7$=6JgM01X;zVQ-)YdkC`@+zilV@C zkF$PvufJuUklKOR>TUL%^9Pf$`N3#OPnW3sVn6{3Qq@F87-kEDPg8ZP%7p+CF!%cB zOO=hgifp~VG~Sww6JX*$-vnzIQ3kvz;pdQ;CSpU+6!xo{ndJcgcenpUPe?CgaIV<$ zuzkB;+8s;F<2na9q(JG(K}eUgp>7zBck-(_85qPZkW=E~rY1+QS;lsoES~93pS{jpx1&(LFA?%I$tk zSmq2c2L5*w2fr?z@Q3fM>$5tLZ`0<>du2Rmhs=vjy!6^V4s_wKP5J_6AYDH2f`+;C zjYo^CD1x>pUTmPP)4uS%ejg_t-0eE9g$ zqf-w@Sy+OlzFyIbJKvk^U5>NJ?0HI=S8yU8$(1Fs;Xl{?r6q#tsdmWa~YD*1Y zUwrrdAK#hmjA5~b3>3{<&E2**R6Jc(#lk|0!u|f_l1NnqhvT=-&2n7zANBzC+`#zh}c!&JFr3mWJfVhfwz=0E-f z;;Q*jiMb)@OhXwnWD!uf1F3cj)KV#rUZ-^kegtv^#B{2>FwJh%wiO@ zJ^VU2L2hL#bdDZ9>L-0lABbFxL4Uq8L8SOXjy5w7i*m5%802Wx-c}9(jm#k+8D}!m z%y&Bxr9Ru4WV{muWop^0V@VOD*Uy=3^G?`d#gr#`pdBuH;er9EX^qQAMy$|pLG;x| zO8_|X@Zm#1&A+KD058qA8qM)l23pb>!L!2W&+7wI6*a$L^)%70NymX{8ICd9XZQ9Wxq6L8%=Rf*IT|+~xE<^$R zC^R#Brrjo@gC0y=BcoouZcP5_Xe?Gy-~1KZLXEBTb;(B+&x~r>lO_#E^(L*$YRPz%%JW#T{+4^ zG2p{d6eloS18ZyW;tcltbhWP1RxP_?7}^jELXO*gM`NLqcG$sYhMMjql=L%ZMOH~RW@FFm-i2r3JZACgwaC4rp{Cfg#i zMt$)M_3xBRfu$Kz2pA1sOts;S8;|VLA&l)TjqvCvXU&NrY}KB)l3`xOS>fQ7UAiA| zS*6weA3d;D)@&-YXWF#7aXddfF9=H5{D`l>59S-vrU+iruw5ypMcSo<6F|aG(g%uc zE5$0Mre+nddd>WN7ungY>xWFOVwdBx!4%Z`0*9?@U%!Bso|>CsHP~=w$#m)gzkbKc z3Qrl(alskWw;|6r%2|0;-Q~l<=mnIS8w|rYSi46*gh5iJfsSIQE+C>OqcVM39qci) zX%2-kl!CF1?c$w1m($H#Q1%=Vv zdLTSYk(+jEhDAjIwOWA&j{7h*ztFPk6Q;DuactNy`2GwQdew*IL}?3tr~(>_{pe$j zXduuKUZ`0O#;c>PeJhu_&s~zRl!gVR-S>l7H&E*cu!ksI*S7(g?c0F-f<;qL&(t-= zW9sobLr-;eoh;=F>f$huc)))zOEodquPlNo1yLctk5UYs`UATv=Y=ik>s2lUbX_h! zGf0amDI`DLReHU=KX`Y?^eP{JJ`k8IjL*G)c#!7X&Bdg=LNgQ$OO+Y*%_NRNnr5!RJ&iUNi&~JpGZzg_O4q)cLZ@ zY^lSONiK9C4?GXKG5Dr7(11s8X+KAxFZRhe!@ObD#%?C$df3EC zY9kna@^;bd=q^xW^n-r}4}vJ`OY!zb)w&+xW9$`fi;E3t-X<~SRU6i?nN2u^hr#{Z z*T*bPvfgWYx#4M2Ohg75t>1faeSYOgt)O1r_$vWz%F2_M{>S_R-rsu=F1_+pBV92Y zp5uXm&EEslZ-9E`==s>tlc`pE`D&O8&@(LYeQ2@*xv+7Y#toYEn{eHwW6KHm0igb;$olFtz;dd^durdHb6YOpA>85a!x^c+_6$Ls?X=3=f8+ zo;N&mJ+?z;f9Gr{!@ia;;Pz_+14FV*l~7~zM#$P0N6ZmIw0bv)!45w6vmh zls_Tk9-Cs?$PJnoE)cZ2cuLd|?@H@D-ePs5y`O^o@KM2+$)i^|k!+9{d}|nl+hcen zMaETFx&9B!HeV{uZ>JJ13}nTxvA_?OHt0a@;6Lp)TvE<$+t^=&02K0uT!qZzz_q}& zxw=z<2;v=daBHG&hR*N~8(Tk!#yq-UM6%nmdJ)Xv`#K*M7Do?SudV$vnT>zTjj`PP zWg8ge1brpTiU1{z3AAT2dn8Ua0nCvh-Pqc|t`pILbLL1)trn0P|EzjpB)>(^F)luy zvfWi$^SjA%a^mxxBU$avAi)H>G62Etw^0=6lbGtYsvkpJnA!WNP?Mwz(P= z=7Ol|(aCHk{W(J!A9jNwP|m69Q-QsUPMB5Lqf0`ld(op{^wlPC z8UpYr_ApDkn9j0!w5S=roPC$nNe`2VTYZrYbos_6|U$PrZ}oJ7Ho3u$htjbQ@sQ;=tsC zYjsm40WAi)lZD6ypL`b=(AY4Jd2?DlGS8&D&?x^_s}%;Bo$Jb!;jgk1J#T_R7dv+% zjRLauN9f~G@?2^g?c`Z!fXZIrZ9+#qTZiCuM?9%0rR#F7oAL_aL%ch^3C0gEZf!wX@g+yGmOH2BJI(pwrD2S)+`=|kA|jeq_;pC73!^B9EpXwJ1~ zo#sQiJr4l+Yn6kSM){Kqyg= z-VBfg2qbsM(HZBvzrWx<*JmwnrwZ&l1nRPeo)e1Au|>~_pxADH zJIPu+QpB=SRpl5917ka<0i66nMgIvQ4LK+|?VGi-Vw|h8o7o4Mk1oyLG_ANS6%l0w zMD5pKbM{5t{N?Z+@cpI4eL|N!Op7Vyd zldN5;ok@s1A~2JrT?ySnED{GXKgB4$#vNZr^Pfm6+&j$r`i(|q%Al5c`dRUxMqfZ;H zycw5&8w>@e-L}O^i|GuGLN-^DrAwdn!=EYhN~S%)}=_p zlc{5ChbMn_7+2MP24ya&g8Rzg+J4gDyHN6{faa}OkkcXgnabzIeT^Y3W7Cr|EBQdH zY%VaZ2^ZZ?=AHo_vE&Ys)p`8QYqSD2?cT2kbxj#0uX4!y%jA*FPzGxvJp(9|h6-H| z1|+PD;`SIJJKo3wWsf>`*;$)d2gJy^#sZ+s7{8f8=z`>flQk0{!yZIH?0@`m_rw}t z5&`4ge>u4a$m`1aI}Ef#J^K6!G=S9MLa#e-G92asyUwFaOiWBm)N)L*PO16Tj@DMK z`TG0}LxB5}dZ>IO)mpmB#iJW@OBwRixeIjYhJCB2od5jYlr+`Y9dh^}=*NJ3K#bM0 zW1!zF=19XvV{LGtSM>uyIww4SK3YVk^# zl5sTzhA?k$4hxF-YczHYbG_^s38veou@1w63#cd8x>M24fIXLniC7~$E+6W#cEQPQ zo*XW-@OX8NQR2hAgaZ`CZ1U!pjW6B4D(lV2*7P-YHI0*E3}p{E7aoAJHyDB{dc%BU z5!lx17#C?%!u-vHm-oij1osMLAR!9_h$A~vq|M2t`TrG6`=2?{eV^zfjcZ$So$K&V zCiZdBJ~26sb_SVG2i&rM2hQll~`s2qnmXOjXX>tAMuWD?Bpdc-$DZa`S@AS~Qdhh55O1VVK z2ed%qsDuuICNLKkMm})BlPDt=d5lNSl`mBq7StpIQ|s^*rT6$3JrRVB6EVEUF?`V5 zdy>uj)%c_@P6lu1*3otSF){Ffo58DHAZhB;{wxoKlIQT8vdKyX|1%aXGYb^x6I6@8 zD@t7zFlu>$(grxf?xwm)o0UZ9s}s`{naMjspYjTm$&;I}u0s7fc4i38IhwzBVA8i1j!%8n)cS_mV7mK6|PGVU_AN zG1(l{ZoS$faTvOJt6r_>Q&hUtz4b2_ZJBsvbFTNW_t#MeU)rM2SvkCa^4#dxq_bxy zxn#;_IsbSm8DDt6J0WU$<_fyKuci&A?@|Pc^vWTj?yL<3z zmBX;}>iee=`oqtTDxH4Dlcu0BH{IenX~Hid0i&BY_%7{^z){yd(S`YKEMlljtIZqH z0aGvGs>Q~oMT%t&r=vmlNUVP9`ROT@ba_*x}&Yu(H`Qso&-1YqEd$4tD}Q%`w>J0Rd^ z?3&$DrHRy3_sB9U1EwOW14lRnSP;*{PBhVJ;_EL|oGqupZybH?Ei=4hqw?&8$(co%`DBh|{*jSOFni;};7;Nev<_%(&FN{U&D! zzujK?q2o5)KtGllm>d@rICMv|G8CJH9!ErTOUNw*EF_8;-FTs?rDeMgCzQ4ehrN=t z^NLSOGT}N!owX3!?-s53XXenWUIRHwR9GI;U-Anz{Lpd1o8Zp?{>3|{w!Zx=CFCa1 z@GOd7Jtq1L6Zano#p%tu#c;khYnqQq)AqU+ajTWZ2)|+8A?0?|ciWP+zmo6+_Urpv zIXLmdX^)zI@wqh%cKv$ktf*!Dj@BnB*eEm=wEshgP*+bGOqN=`c`q#>AV6F`@=?XF z$a|~cWq&s4b;HNWs;8&N>aDbO8WJ>v4WQ*F>GzDi@ti(ZN*M7Yz-mFSmI6;mIp{~$ zjFgBS*3^Rh6W8mS{2X6GF7>b z)QQ_S(?bTfdGNI{Kp7d1*{Zg=??0GR0w56ioy}F`-W=n(b#s1)rSgz9r=Dm{LZ5q?mU#LArJ4In(;SlIVxeaCF z;Bb9tLqQC#-m!lwegpKDtTQk5|McP=qk)uZwJgaTF*HJXpiRb01peMD4HjM7Y^m?H z3i3J!E8hX<+)8ncH@)6sd6OQxiVJP?*eVC)+}P|OhL6vGVq2OgL@b$OWh6;_)r>n`AB&ZbOG_Poj;Yu;;R zs_l49`xh=g6GKDOxqZ30or&$eA--1W(a*!`_7YQ_c`~d0RvKQduQn1_hYE=Vr$L*= zYNrbD9#>3fSPE)>lI`d+0cE_gzP_$M+|k)ttSBunFRycTp{$cB=^aaCxHa&t)wtIzCDjSk7?70n=XUWxB-+`LCAzne|^b64bl^yXWYCg zMKF1|akX3rYJM+9?!aqFGSC2^ zoWsPzBOx`l(l`~C+psV1elIr5`TY)=PqF~L;THGuB`bBcN_SviZdh31;AAmwU+#j0 zJvvYKw;Sx_dDfdxk*K7_q6$hrKPFO#HFMKG7eNSd2p*Ug+r{Ii)Rmj_I=1Ae1zlP0 zXrB91oZMX-%L^Z3HCkIjhhz*Ofm&~F&OSph=}MImn-QOA@GHdzx@7;@M5$5iPv`l! zAH;F>ABqkB#ia445eA{=LjsbSqTZ+U&%O++MK>Q8YuWX>ou(i#8~pWp)ETyq_wA)) z#GFkyZPq=pPjiPrlfg7@cmt&+2eb!RHpC+^~i_VCb8@+p)X@2V(Q6t!%LeZw2f;Vr5mwcAYsW8bb z;@anwYWIl-e2}}&qT*|}F=?qXLXlCi9H}bcW2le|sKqWBG{<&}iHepDnoA{L2H;Eu z@D~el-og5|Yr5*Z;^*C)_gIY3oFWizM$_aL*p8}dn}tVA@s)h7xgKKjaV2&f!N)tn z;qLg>Az2gvt5?(&B`*Q!g6(wd>(srd#p2^1HoF5y37#f)TSF!%I5g_HJ zj5K~TLO=AN&*D%83yY2f6a3{a2u&);wEBMbIGpM zzZ~LgUhH2!^owS(arw8EmvzzyD}RjJvV87V9?)oi?NQYUN-!JRqoUWB%bUfecR*iR z7hG8ch#id!S>yv8@7vp>-#iXQSM{Rq6iPdF#E*d9lHixN6_=x4ZjRr4`m}-qff}Fm zSe_HIqN=G5;^ohBkzwsA$UWK#;S+@bz~Ii2T%TO+cKXzf_{~ybM_AT zw2c5`+?g<&?i49xh6Q1`%!<=mZq3DWPg@4JqlG_kU}fsf%h0?M2dOwQ=h~u~r1h$z zLt2HU61vJF3jqKw&;1lBm_hR&2!sVu!XJn7##bj^&|UU{V@I0;y$6U9qFZW~o}&~$ zxvhCDju5tHMQpuwj*IL&lmwdZ)_t1N%F0QZBWIpbnMx@RVFQ{gYGkyhSX7n)Eg~WL z4b9@oJ`=4Uhy1K>2`DRjG4ypw|Y z7C=PNfnUT5AR%+Dxmrs;lRlHJi0Z1>Cd{lUpz;nEkGvVdiE}D#$L_W)j8v$k4;KO3 zqZ9_Ba$~Ngp+eiurLkJD#&KvoBAQF$e7k3y&Bkmu5jdx@!=Zc%l4s8zI|-4xCUn+j z{K=sT(17!mxQp??PQN<$OP{6+M840;DOPQlwJ^sK3j4|!XHJQTwOM0kI^IzOS1mp? z;|=OBt-mu2*ILIa=t19?`=PyH{xRzz(TkVD!=7unbS8=wljO7#gH4y}Nej>O={z2& zIE9fjz@{oecbq(Tg!0=~8<|V=3FgL$UK3phfB(a26}T8vLvgy{^07}IL?UFxhfAzZ z^)`RC8L+LYs+#`N8+?8SuNV=oKYWZ&>WcgJ3dz@_?wC2!nH?dwIxSwL^5rOr z9l(4SNAgJCztvo7Z4p(W%#8O(%nu`7E?MhcZL{x86cKmdeG(w7@lYQz*_{1GJtk~x zp0+koY?5%d#vdIM<1X}w(%`eo&9scN9x(qd?dHRi{VkcW4tz&K@#2bt$U=(rvxeZZ zuPxtE>xa+I|44VseEOlItAsS3mGwRz2?9bMx7(Vec#j?t;_NfgNyasfKScePkRcIC_8KFM>{tbu^Q zz`&;6#bV-AXZbnB)v*3h^?V&3gR-$^i`ox8J<*lttTX7qU;I$gs@PnGuXg8Ak3RYB z#mXvdTo$Pjm){0pnQ4$Qf(9qXfVUAecQkFfud%r}S~WbUWq8gx&4900Q?-q`cATph zwWZ&&4gL@tPlZ_I(_D%xAP(h_X8j(h$Ij*n*hqnSsaew9l(0Ns7MYvi$+XNEKaeFp z(ZvRp0#7EVWCcaYlp`6XABsy=dpLlR8lnNVoK-!Nmj@2t`g{?o&I^;A?M7JJ1-HF< zT)eycabK>`nvV9#7OyX_`h^e?->qkLNprR?Vp2TBX1%XxadjdFN}Ms7s*zs}n>ctZ za^m38t$9!esH%7GGuZ_jTjr$gywO;D9t16)|5ZlXKL+|;JMuEwj4F1LvN9oWw=!d5 z9br~Qh*9(-l;Wk_Q5!uMM6~yE=M3e17f)C#Ek*b$xu;Wjg+Cba%z~#wT97kx37`~e!1K=ed|XRu_cBPD z|HEypy3j8QG(=WYRmF)~6{S-&mSkMR0ypL`P1_r`n+1CPWmb)vq%y09whDDVb__4f zP*wGIn&ef{rZ2H0AWj(|*>{JaG_Ps+e%}9lJ*Ab|k8JilY->q{9!BL2xNN5=C@AQ@ zOY&tnu>M=z+Mj*Nh39{tDRjtqex$`OB+8{}v!l4eb$eYdT_&CK!29xgA1m=gcFg%w z#ocoC=}rd(`$S{zF*E#ZJtrh`bgfszytAVtoRx_$t-6N)ybcH~eeO;lydZ_9Rd?&D zpJTZbw2)vD*TX07YMP5+IjN*TBlg0LxW+2&v?5^}rEGKZXBPrgr~i&Fz-jXA`}B_3 ztInro4qab>W7;_(e*m$@mJ#1;iM5xEu3^B-gsZo+GXi0~7biPgz;7`m6*aO=XqGBm znLE7p1C(_<`s9e@=QC9eq?1?cx?Wt|W&nY|PD znu#Y~a{2VjTWu5Y7MYg4?jyyDv_-_80t9O7%Ene5@z)+x+uL9EY(G8x1;9eTRIE)x z)j=Cz{@EuD11iE@dvHrMDOLM}%* zM8i!WP(=Wx72&054{%oUKC9@4(A4byY_*%zM~_Ua{M-`ELCVtZDp?tgRIUdf1K#!2 zEP;?%sRTv}1U0IGiq*nDpA7=Z8-aa#8)T-O;Iphdc2x1}+Y1*QIf2(zTmf#NOEzHs zdII_xGY=P_KVRM&;vUhz(c+^wQ?%qWOEcDVqfRW4ml`?O~37=ZN}jzz5su>B&2tiylqe_Gwho z5uiX5641bPnd*htEBBzjTIfL_lYMUIu{Ca~@kpn^e0A`E9Xr6an0kj&j<0O-?MzHx zbTjc|fDJ%7n)fR2#mDjUXU~ce5YV2hFO!pZl|2{^w825io2s`F;u4bq8>L}krj349 zw?Wj*OT%R|RzA$ba&zSZq&bK>js+0LR}^m)@wlMzVL=ee(#zp7q$M0~#HHxkBd|Op z9t2oXqyumky~~Z+IdK;s+*j8I;db3_2cHo%nhz3U#_hk^&j39vYFrCRbS0tma_?_Q z$*WcXa-x<)P0;ek&z~;^pyJj_cWv9|NeKp42-K@OBfK52z~q!DlR?kxPJ$(3ebl_d z%Px2&m6PH97?gRw+n!tTL5u-qQQtB0Vn11TySKI_#}df8bjRPq?yT?i+c1>`E~Ut@?q^TQZE%u#~RCih>Ik+FkyG_IjN1v9v< zw+2k6Qml8cw9rZ;Y=-nO3_Fuj^ED?d%-yO{4HL~1Hyj>ef+;UUomogi=j)_$%!TZI z6X6b|j2qt41GegXMM7e_I!?C;J6=*!BD>wzJLK#R?DEJVND1ZWm6aw0UJH5jq0s#hT0!UROLZ8r(^ zlF}YJFl7fjyLP^{7J0Qu-s6u$`TkT<=QS>-^IVzzaDGEhc|o2NCJa2Q*kNgpNp8YU zkN>n73r%VgAt8A2;zdTctUU0{oG{8j9fii^x7EbhdlLuPD*ddOn3&yOIm;e@4{b4! zp|H`BW>uigCFxs?3_d;8C6>WHEqI>g&GRr>pa~h^DrtD>$w#C8@y8g>{;;k94|Nd3 z6WI33oOBhOe70#O+~SsPbV&moM7#eeXktQDucny=&>NOpD_T=KsqWDg9xdzu!eh9o z0VI;lRD`vX3CFmjDzKrf=~SU>0VyD#8u_oqbEk}H}7RLz+ohWvRfW}H6xH*4+fGH=mQYZ)^aCT>*)7#uk|xSz4~70SwEu!e&MXA$%5Az7e-WS>ntG*lvlxMxwX&>H_P{haczjRBoI2lGDTOH;Vu)b{nWCl0YzN*)<5-I#vC+Ul|_kmU)2 ziq%uBA`WXOLcYH9?9x+5dy6%_s?NA|ZmI=1=D>w`GwiYo@Xr&z^Jk3E76ARdh=TGr z{U3PW>D)C)uwEBHQ_)d~J9D-afd0uke)tsd$pfydbjDUNwHRG*Ehjk1MbYUHYedQW znm2)0I?n3NgL`07kgA&6erZCa@7k~kBZgoQ56*Mxo{K`h=Ki&R?Vm2TmdnTQi)Kj@ zjbceU&vIxhM+*h>WMk(rK1oLhT1TCfaA*gy#d$?{U@pP2MU-0&(g{L>A$fS5{LY)! zDR5e{ja{VXG9Tux%ZVw_cLNrI!vVsQ;&hWrd+h;Ys~Rs?dGpI%T7i!3L~A$pIYQ~o z`P(UM^x$P;kXboEYCShdsOQI4#&DfMtgP+r#kRnTC!p6iHf#~il%iU1LqTw)q=Eke z@PAf@Tb`2^mzoMlh?8m6(gE~6#<2xQJ#BqUFO-+7)XUq&U5<+$sEKO3- z68AQ~WEn5_wYVnyFtkks)vN?GMA4A>z_+FU7ioQMm)H0sks_rG$Z#DIhij)%nTrNJ z_wP_5#@t)P&1>BO4P~#^x+lE!nTe0v0seVI-p6$f(mVxprlz@tktKIr{;t1+`PfW) zAl?Z(d<41~rlKBMu+hK?-*~^Z>(D#iUjwS!K}b?ow+tn=_wHE_1OY~8d@~iyb^z?v zqQcm6BW2QahNZ=NC9OAj(EthYSQxOAAJfN6Cg4U34KQ^JJJ#wUAtC88Jk?Z^D9_)G|&HYE$XXJ-;4f^6Cb6>$gA$d5x@xt=U9i_b-T^@heUE*-6|AlKa z(_GWM?q!U){e3xHgyu!D>d*Htm*Yc#kV}voZmAHkrYN2XM+L2UywA}vLLZZRaH|=S zFBjFU3>*I(8dXGAd<%e|B1PH@=f(Q^de4z#zo|(5>(||UsyHR)PdEukh|Oa>%8Y4L zRF+zd`+lZj*;)b1!Mx2z9M$W)+UJVh_hZt4Gf?^Lgxww7)YE)KcxQ{Z#?ezjcR4;;5}zjN;mv3?Y^$@^7fv_DbvlyeW`BZ zZ{YO!4Ujx#1Ja=}eD2Kx-*&ns^E3bn$1wN>dVfRR8xHl;mrfT<%iei269T>P6wYm++Ckk-KzvOq28AA)n4#j z1)*=iG9Nr1d?} z^b16d+ZdXN;Xcly_%&$@Wa$`Ed%Yb1@(%pE>ndC_*Mzc&lzcbf$1!-k+h%+~m1B98 zZ2}he<+8ROn|yt(;HSVDXfa}{HBEsbu(CFrpZkl9YOG&_1pdEs0gAa|P6mDY%d?jU z9wr|GcUf-6Wgz8rwd()JrsqV4&+b|e|M1dttl)#)o`n4@Aa3-b!z#c(qQ+8t01;8) zNSp#AT0*+4-<$>&;JiHYK4GhXp9;Ijqz*z}u3VNy!g%0@%}!*pUQ>{7$wkp;yvA%$9qRG5^$!Ze3Hemj=Q8EVrekl>?pp1cL57p|lW?KgK zvD&ILiUCjZ+8CL$*n82H*(w0JB|Gn^|PFog$q}X#R%`xYN7J`J+SnHFkiM zO{PnWga@&yfnGspB_zB(mzbZzI~4MtGzn@--)_? zl8V5$@FdsIfj)wOm%W$+B*QCL8uc=Ra$y$zTpx zYA3mY$53go#Go(y#ab?e_^wEihQ8AfjE5AlQe%+!4XNLsICB9CMl4PhI?#@nH`CMr z+g)Ld*<6^ASK2F_p6(jdi4skhmw6ES{o~+E^=ZnHA53kg&Y#a!FF`8LDZP@HNh~)# zc}m7T5+qUGR8v!{b{jm8uK~p>U}6%CG9d`GOirWKzt{28{s(sX_sxg)bF?lW|9{{3 z@!cJh|MS!8Kft&jp95d}mVf_oe?PsO!t+mF$-nPjtK$C=X8!x;K1aWQ$g`i`?T-G( z5dHgZ=IB4-{O_ClB<27AoBjX7%Kn|4a?RTWk`V^z9h;@$$`Ny8j_2XwKDGaBEYRP7_V+tT>RwZV&N}$^=H~Wpap9BV| zB6G)d1m}Sjyjtj^n*LI){Q05Rr-5fOFu@_Ib&|bh2Go<@$)1Xp5{LH>m^K94xr$E2 zuKNA=8dj?AIyydUc%hxmWmYSBf402ekp3u!*gj+f2er$(Npe=ylp9n#=*kI72n(+R zU$Lpl_+>%@56D!A8vo&F{e9KGp@f7a^{kRhnp(AOXwnkUe3urQq)Rul;fSnxLgNR2 zj@S0z1YM~RDA8Flb1sRwt_X1aO^WR7?QT+|d9qaUd-VERRH{3AISg}cI_>5L!8$LF6D}eiU2&8z#V{IbaA*Re} z`Hz%K-;@C>t3_>M`%v;4rs*l4G1poju*r)!8GN-{QeMx0mp0L61Fc;V@NU->8622< zI`{pmmCe@{s44{H=`SBk;r@2Lb^#Zg@f@cLC+`I^$U+%YNBpvv?RK3i>Gz#a`+m)8 z)l_Nsu%~=oQP^T*H@?n~AERGW*LV~gd^Kzx`f|QWjd@Mrk)*bGiao=52@5MJS)Rw1 zTl=h;F*sYNe@x8ZS9JWSX{KlYbAKb7PqtgGi@{CLE>IRyb1z&bCW-B+XfR#XTJ>tP1T7ZBgpnFcQ zeA@~UU2sE0gUN_?Ejk6xwmCm4v2&FBg4<6<23*K7HW9vcuM0}wE4XzIxZt+bN3uTi zw3n%=akD+A-TuCk7K4Vm`gy{%!r50<_5OW(v^#W#C%wT>!`tES2mA4Vtc8XCpH+F< z5$lzeVPO{>ap%>*v0kcL$w7eZ&@G_+NA;)VV&F5+UL6@v5E}lJGSy^RU zzW-PlnMXdaUgF0Mef#-Y1?38DG0+F*Qz|K!9I3d{rCBn>za0lD=;C{n;>ICRrQkTw-cW>TbAkh zEl~Ay0$G>QjNJ?mNh9nZY&o+YKPGEVa17+O2kcJ;jg*bESo zHZyJNdaE~P!~$otGD0j;^=8(s>>Fb=ldkhW&s~;FSzzG+8cI?#4 zjAtn?O&|eEtBrF#nzk7DPMhq;hC^;)HeE;*!k#YYt7Goc0sGh212gx$4Tkb{ODtg`20xIHdWg7wt-A{=MHJ9$g)wY*d)I&HKxR> z@%(BdwI={h?y6g;k&o+f3jd!wN=QyVsYoS9vDo)ShJ{h=d!zJP59R}*l}%o72Md*{ zhx!(HC|610c72CPoar`+D>EZ0l;P4NQ z_m?@~;rVS@Pd5yP=^LAIdJyB`FrHtuH9jt4JwMmawXJzHD1qeN)c;!1%=V8UL77(( z>P`;?JM6T4kSo#SPp}b<@qv8QKM197E=Q#=H_-Nmrm@2&<)YCtgaAdgDBeL?=3l^p z$aSeb5&Wr7)AnXFRWgWApg6*Ia{MYXgJ8JxvkiD?rIExtVe@&MB@4t89HJ1e$7Jq5 z09C)>eq=HIZ#l29pV%=)-2<2|o6r0ofu$SYo~aehOvHDJ4a=@AVCX{E4snfsRZ&NS zS6*Y3oJ-k%H^?9nn0BB~qu8~Q(8HCLrY+9CY<^3zt2LREe}jMzcPd@Ci&o%-LKmE* zU*%HJ%=TQC&&I5#?c-x77>SJu==0hq`1nN4#$T069Rk5)xJhXwP#)%dRYAU<@op3N zhgP}94T0X5EE*)G-Nxe+H`XGNE}Dxg4N^nCjJe)M!X}1+_I|_B;|}tSXbTWCSSX#@ zX(c5Vuw>egGxz}`x`=IO4*C%{eLIQ;EPV8`nSmG>({Vq6(Z9v1<&qT<#j?f&nhV}tItdWNT5sbINR@5RHPTL0IW*O(>}@V6pKhUb zdzf%RY03H1xpQ;_r{yPcx)Co!qjVb3pigd8J})$9VB}SHOq6Xj-6x?wW_R!1tF4}~ zF?df`SGWrtrcz>Ap|IMtH~dQ0-Lk}@R@%z~8Lpzn%i#c}Ec(E-m+hI*f2G8 zsVZw(;logJ5mt`m%M+XYwWls%=Ba}%ZMF*qq$EacDgP4_Wy{Q;S-rMOEYeyl1C8f_F$}(?yaNTmdnXXvO zX|=OAuV>1}s+ZrQTo{1u2v`MMFvFP<(H_Bp20jZow?nyFM^C)5*gSRlvJz}S2-zS5 zfs|LUdfyFJUV zq`ZT2E24Si+y7Dty{X~pnafD4bwGq%>A6bT{m@ZH%brU!ldyd+KkZkL-<_&e94P{6 zD(DDO3FS-iikj(6G)_iQA=Go}^6*urgjst)U;((=A=L#C3m1&Jm=OtG`OyCuvYkKYm`_S z{5hE4e2OvwQ{SCWL0~4St4Thq(UT6sAQ8+foysyIvT&6{#Pp7xJ8&DDK%;hIF=7v_ zbO%iafMed12zJJ+ylJbyIq*Y4Yf(wP&uFL+Vg}SH8y2}8NemB@BQ$Rlbelx2e9OSdZsdDB1%X?SmH3q;*Xu08mR_6t2>^% zbOT0@wbHV0I0ZgXz_Nt%hy++1E34ZWQrlamF^{f50_82@817R5kP%=1%70c&8Kv(= zTAT{lAmO-*o2%@B}0R2Bbb zyaMX4paQf9OHo29k7KvT_EXxM{Rw(va|AQWxF>WxaI940u~*IL8&8$pMLZvdu!@qI zNqg3C42VtCk(OZNj;}eo=18xbyYuT>wqONZCe+>5s?v#wd_<%*#M>wr{2c!##Ahsdo`@G)B>zjo#bl$G}(FWxf{cK06ic4&8epj zh{7u&n-v(~+J!9bo(SA}b&-^h*fM!c1`)($3=(8y5XmDlvBPL?-`n@?Lxu==q{~!I zYRD-&i(2E9K{=G~vU0$!qe>4PtDPqD^h@gkjK=*onB^y?fs&~E%n9-#J3n?u>1AWu zM&~m4=BxtrB9#{B8OkHUmM`d23)f>?uGUa3hI0upsLjlOdPPPmHOme!pGy&F||V?U*=;_s6gl^WAOa4 zjw4@lD7RGGI>nTdB)=T~SuYI~YLC%j{%$MgKqUoz2O2;EwdWui)$1`K2Yif_$pF%f zDazd{x1we5VB6aX$~bMK0t1(WZ1tjqyOSmF1qas!=&_NP6TDUol&RaYyC1U8@?SZ7 zMS`DyIy*D1>q8_U_e|@(ZjOUuqvGGXztr}`l*5c{#$%C8UqQ#U&1G{l{D*Ht)VRtt_;n6+&+o@a(ndVlQdcm{0 zvNtMW3-m?;T6CA}KW%`xT0dY4e7QC2_0j2)XgtAL$ueG(D-!hwt zCCqJEdF$V)YnN<-Ys-sKq+4ieO;5_x{~$E33noN+6f9l-obE|PyObMpb@qIG zz9Ck3K}UhK`2nOb0R_@FW@{aDs+@Y$b)wRa+LX&D`W$B+D0EDDs=(apams4d&WnWf zJ-xO3G!9@YiS&_r%2wJEJ!ZOh3IFa`WcNsy{fXJznrGx*XBW)p>?iarx8yfQ+G%1bU)l(S z`%L?dRlRw0M+{*Cu`aY9F+mJU7(fCSTv!DC|yG>P}J8J~e#uablu~RY@n+ zva~EomabC|4VZtbXX~Ru;U!-#;X|e7$K-RhzB+v52r{Ib&_JC1Yi7&-XL0-c`)e~_ z*Y_y?qA>_!qv_l2M}GsFb5ENd{Yvd!<=r*HU^&Fh?-r3-X3bmYqB(u^S~KtFa_iLK zfWucE(BHe$s}jS}=$91HzyTHESJc*Jfqr1ixDRFx4Y*7n{Y3}sG-A-ZxO0lmJXJqa zBM+v&3TPZ6dhU?s5J#t%wy8_G{nKBTHaxs)5!P1CU-71jm$#(t?CnREsvNot?mQfz zjhGs&Jb4WN0-8z&%|1<%qNkR#_gChgJ!^iU$?S=9U|<5&!z3thQx>^4GeEe}|8IDc)XGZsQa z|JvQmUw_>{v*LEF0+bXPr~2_+94D|4dW`h+UcMeK(w1-Dm^2IwgpRp%pEY;v+Ik*D zPnSV{NqYJWMBF^(x^uz&z2?X?{Kh+V#GT&G^2xmuXlf1(!?TV`fs*v%9f)lK z=xJc(ixfB1kYlgZH;slHe*DDf_Uv`U(j7P z?`W`Z2#X_0JP}NvU79X#!A;yPSb090`(&%mi^9n@+-8_c`+Q%K^5yd0*AvN8(`Tojot9+5}!5F8!R0U>&mTkD47&rZ#}J2T2OF{$P`5>xw5J<`7thh z4ApyQgG4k!r83EJ!>Lx3MSRE}X+ExZKK&!#V&hXSQpZRwH+-Qg-mk~H@^aI|6eO!+GJ&b(O)97Mx{%J$-NdPG?tFUy2dDaE{$XuG!(1rD|ng-PG zM7RzbgWQOV3e!9fmqIYUn6|qPQe{AWTby@R8E$XrK@aEas z)v{we@-Ewz0?&fp#%y!3x{lXj+(Xy-Z8bY@ zT17D1f#cOsXW_rMW!3aLBmUK$LdA3^hfTl14Hu678=yJRCBJCviJ-;6_5}0w&KoLw zZ(CpjJ@Tc25ghH1;yJ#%MKkGL!oELfvmXlyzGhxDD=`NDv5&f5yl~+X?AJT3e=uOM zeV=w8s6Bh$Zd2Hz)FUCCs;$K-b_Huu9XS-eV!_jM=n%7!{v&ZiyZ%Rf9c-DBf$uHC z@pbPE*T5Y#(EBmz5X{M%_u+ewbstQl1t7Y&BSCZR+uY?Wgw#)Uh^k)$&w=)Q$lz{` z^>y+vjD=;e%gG>u$9wZuqVZnEjbfVV8E`IYc;ps=I?%`TaK=Lk5=NW6GQS@dB?j#s zWWJ45aX3IVM8j@H$|#Q={Od0PvN0y_ua zNSFn$!6nyde1XdIL(X4RM?RWZcMS|!cfZzl!~6Dah@l{54@+)X5Pwk$Jg{vCS-TCQ zMqy%*{*A19#G_vm1oST`O65jcon&r;y#Y~69+1kWp$f3VW3{fs8@kK}y`5!!5#><{ zsn7*_@SS8zU5&@epXE%y4ar~uzo0E;LJ0lx<=mhGLO)2Pe4r;;c&KpNWXhMmGfPcN z)UT*A<4~`>qK!Ow{d#VXOW&Kykm~^*e72ph59p9drWUkN@{M{{CCp3}oW(u%bu%vwU8s9m<1y-5 z(0tiBvcYd@c9VB?m3L-w#Z`pgVrk)}*wS-{43o{8Qs6H{)wqwAj7&5dnwri(=m8c7 zt4I&b9NLHIXu>QkEPw-{r7ezqq{781KWRh(8uOKtrJ7K)y`6nWxx1BFsa)w`~-^549bG#WS&d^N3eyRPh)eA*Vl(nwrC3{ z(erXqqWZwL!kW764aRA(aM!UONbw@HX?4wr%Zskk4j~*rZd>$J@|cLHw#hh?`rH*I zB^~t`-j~3=7(@cBiMf#u0gX{^Yrjvu*ktA{EhfkcTc^|M+HpjjfT4(X7MQcn%B)fSyFFa>mg>%N4P>sL?q=uRSqfN+L9IEjx@Lt+*El* zV)LCKqBu}hiz+MT;bApGvSGXg+AzXFV;rq=f*b2c5yd;aYY`LKz#AEw$tufpNtG@! zS)QDDmeOvc=jixq&)aT-Ng35pG`Ch>(sdguvi3z|Z+(!ZVLIb=9;DWtrhan4DK@9M z(YD&(Kk`QFd*7vW|D+%mO?ij12N#6&ghMQ{CUKSy4IGXBwOP{cm$9wyyU*wYyO(DU z8dg1}GOW*M?Ns5_w@OeEF)>{P{E8JngnQ;ePu2nDi$Z7K-Ps_L^&%2Qc%pw~qx`%N zLzli`JNx$Cu5pjP@{~_wfVAhKf9C;z{&3ywPRNccTKyS*wjfF_{#B-0l!}0cpqDoZ ze}vyh_Uh>8T>!-HRV>S}7Z!}b5E>;fB($yrbp5_?E3n^ocCOk@U@Sv zg9gHM)3Wsbv7@Az^Qino26@Tox!Erll~y0V22G-{l}0WqrE;sp5j}n>@`{Etp|Gmi z?=HLqlr+{jEzdMlFP#2L;1ym{x;3!k&)mPsGAT3ElCqcl>nTY?giCoX?wEkU;@%;T zVco>#%?zxKNC%>#ppiHTN2Eo}`wKb@Lj zSTHD{6fAB(>(8=LH?Rr*J#4+7=^4JV9rdAgLM29t6se%7xI*Ha?ZyfYDod7n68Kxc zSTyP+Q+|fEe{4n?^t-xvb;)Y8s*t1qiayv@`DQgRfd|KlxSiB(U&V+iHkaNX0L6Is zVsn&3=-N;lzpH8V&PRMC@Y0%?!^)sf{TeUl*K*Cc7+bworzf^J#hX+F4ho*V8Tfsr z!$ez58ck`&uENv@qo^Vovh4C~XZ)(QBZlm@*uUh3Ewi$4F`?&@T#Qp^DX72~yL4^9KUX0#m`_^f_XX>t+TUC*8wpB`5VdJE~4j@6hH50@qc zU(m3~&WevqwLRg0H20-v$H-e|mjOs&Vj8pg;YH(6=Dio><;mPyL2bRpW9c2^)?k(n zHk^=n(QnONWe@jM*=c6o&bhw<+0@j8binD@-Oov#^`H0o%l*Uytz^o9A6xX(*R<5{ zyLIBreLh@=vdODOSXoQW?WNy_SPXIQ6G(Rw;n~iBHK+53J(iE%6IL}@S%*oBx69|W-Pgm=xlZRJe3wB9M_*3pfQ&l%A$g9!)lM~`8@^cY3b3545d{(h$=OU9C#TtgY z3S}wXgC@92r`q_b3frsuR7_I|S8lzFx^bJtSa{G}ChuM=0vpk*aPRl{*c{+afpdOm znG$qw$n?N(2RRx&j2PNO$2}Tc!_Spa1bXCh$demRF@ffgW)(}-;jY;e;_}R-q4-u! z?W>nGG_^EDOky%JG8plu;`Rqv-h;B`G*`Fhc*A8&IDMbu-fjdq^D}q`cKE-49;{Xv z|DDeD(7SV;kaz*;N|kQVtb1Jv*4Z=+YO@`S?Ck8FN!G%h69|cC%y47o$B(qQZ9y>o zb-I<*_eSs{GHDPR6|gO(xV!ZL7l=X5=9BlZ0Aksm=BPxQ@q)Ath8Uc~st%yib zib#z}553obN|oM{&?6w7&_ifRzWu1Dz2kf{|IC_Mvwp4>c?cooxy#zRy)01S zu+H-D^zHYdu-Zz!4Q&LIK0W^Bxydws zi2(P84-jMKv7=+k>!5>%$^~llCAR05v*CHWry*_@VX}Vz9POfLATVh-EE#6UrHty# zd?K^%P$)zHYC%e}?U%bm_k%cOpR zu-7)5Oh@DHxXrhp?!ua9-6TvocV1NJ@MlgwBOuUvpASOGHJ1&I6vDeNx3Sbg4Qh!; zgx7{+oT$8YaI=|^|HAyThD)beDY>Q0aZS^cC!g#4*#7JPFa3A9;m{9e_7w8;yZ3nd z{*3Cc2NXKC4U~S)gM%EizmEIG%LiFdGGi34D`{F2dv{oOTvm#b*KpPgPViqAhHy2$ z$$yu~t{u?QEBi6)vwEunt*Hv|j$we)Qn^#%*ItK*ha)}h&WT?pZ&Dk}4K)WxU_`Ij z5;0YupC8z>C#7E0TC+?!=0V2j)W-cJ@RC;EGlsxR+`M?vbK7%a@WZ~1mvVTl#`04m z>CM_cy&)V+2#gzrMyHSOUOKEyzo{+F`0OvQ%%&rQw%Q4+T9)e_| zL~vN@(XG)e~wLxB_2w>``r`8Ev04f3XpUMNDP_6 zb=Xp=Z?AZFer*khyK>k$ZB~?hM+#TU!}Uj+6(E! zS>L1$@QiA~Y`J;LI`KhT+}OBwQDo`QcK17vA3lR&l}o)$nFE)po?P1Z*ZckB;@zcm z++Q`G{_*^umlt(@CZYWErwmr?{~s8W6ic919d8p25BA>MVZD!^%N9Ll^V|I$=7<0K zoPS^3m-%sav1M_Vt^q`{?DTPj1~1_&&_oA9 zaI1qox_rm_Qu-355B8s_o-~9{N+uEP^Y4&YNj=!>uBYkP=UW~<+JV}aS@wJ|D>oX*KtN8PQ)q~;-n12f}21@YC>OnK#>?Avg7V3brmb@FRV=&k`41);w72(isxd4ZdY|90afJ-xs}nRP-Z3T(#@nlis(HIiMyxq6H5`D z2g^>^I`Hv{T#1SowQ2_xx#4P02KS2bOm4xojdGt>iEayZuA8P14@G5iC@bTW$kWS9 zK}(K(G0@jNj?!qHBd!lM91LD8FzznspJ5LtPtNp63tfOYCr8SVr8)eiZnJtrBn5NT z`FO6f^Q1IC(iK(vnuSHlhE({VeX3c^M~rIw_)lmkhOlPc@65#qda0`sRr~mJSsS2f z`!Xj;ZkvzddMixrOICV{y)uBLDbcr2i)=RQd|FidhBv>;EN?QSJzm(pS3^CeA>u)9 z&@?$bwiBRsXz5tP!OFvI7wvT~H)@&A9;7351q@kw)tAUTQqVx!UKJS(AVaM`%*_;j z`;Ap*=8xw?3g$@EZ!bgFFlwcx`$-D%PWJ@#7XOiTL9G9dOGghrgQnMdf%XcH=r-W` zN>*YC2|~9H@+^A%z03Z(dWZQ=Ff!oI00j1wSwd1y5+X7}LUIBZHWG%1SHdmPO49_( z<;LUJcd<%@H*L5DLU1NP=tq0M&5{ilu(!Gg(=3Bt%YlF(x!Mi}R|E$qtB@GD)UwTb zYA`Rn)UYF7pL$6$G&E(w#K?YKTHJan;Wx?XXnh3(i8rrflae`0j5bUtlG5fa<7g}U zu3E(zjEkv68L$!UWwwFbo%T@Eqbs3k@XS(PNJ|E#{1i;o&DTGjD9sw|cf#x;T@#4B z5Ta|}0jsVGb@Sb&RDN8lx;z^`6JMS+ex&xm*Kt%s*@%eUR9)gMoOww=k9nu5Bzvc9 zmR|^m4glG*PFZ6fD+(oJV*u?Bqg&45$_#qd5w6|@T96|KhSFkD^(`Q^%riS&HjAVO zdgsTDG>9nMb6sPeWa0y|XC$~q{#jb(;p*i{c`k@#Onf3CFq$oPPk~7JtX`ZFvf>A| z>6(KqQhf#>dzB-Ux=|{4^EyMR zfX$XQVNly>S|e*|+%sdYa;=xv15HT2^2XyXyiZhLYCQ}yPQPq@9#>Z`t;Qi~aGTx_ zGcRJ>-muJnkC>a-;eG+3+kn^pq`I`c+?4=WzH@AEaDwlf*HgWuo7C}^M?PQjAZs{% z*(S5R9GjMI^m#3hSHazB?mW(rlj_r(KYf4dNs&XBMcIx8r-!u&{)GsPx(YiLWs z_l5a?VnH-N|7k(i-a}4j(lQm94)qbrTptQE;5I(6GM~`twp@AxBI;&gr<%Fz9GOv` zn{N$0hjgURf6e6iO{Jl!>Ap@|ZFH+lJMGqzryagQ)=La$Q||goTH{JE5D|{#0O$~_vR;bbPieMh;>n9>@W`pKCHl(n)%v)8X4>t;PdMV2jU)IXjD3ABxj@o#EK`r3{y1 zmr~_ADqS{MQ9Cy~G_;BiXkl^`!n8mDlG+Ah!wuDxrsywgk#hLZfr$?lw>Y{FrxCsN(!+SY z2)>8qQ*ETZlkw89qXu2={g3|VtDlT#*y}f$K$%4A9tT*_BhmBC?m`k;$wZF*KdseV z;__tcXPr7QR_+eWA>i zRb))*N}=`m{pfh-!YgU@#svPXV+Sp1Vn&wuWlNs3XY&a=ckVb)cKT|LyK(-5we!*o zGuPngaF(T)YpYFKJsw!Q0h+|<{GF3riZ}1a@2T3%P#bg3z0%k*S5>kKljHnmw&s*sj9v2QTivEEwXep#nvDk_q4PAiW|>Q^<^^=Uw^m}#p) zOV_zGw}41a95-}T8f3zsc?mK-i`8sKr6GmDd$-E22GPbjNr63+UA<^!dfT3v1AA1B zf_8JMCDE8_Bj&DD`HX$xRbwLQG5}8i3 zC2ctg{I2Eou2WUTz@9Bqn9pUz1bcMf5n!2|wBl^<(6Bw&b9JjNS9+|rKDU^dSaPMF zT_8yBE$37;{_v`Zn;jv=A9@X|bRZu%OS#)OAVZR*6q`UvZa!;AYF1+-gGt(5a9Y0n zouuPtLzjt`mQU)~=A{~T^ZKs4M!mH3Tz0<2rdWZiK!WDD-;Cx!DrI+w2hpf#KlJ6 z^BRA``s|F=$abu>TPS>D<1E|WY+4uj%k2Pm5nafXJIwB+Rm#!1+Dvk89bi3_`KnE| zhD1yTEk{z0Q8VoZ1W#JKS+|E-GRp(8fE!VfP3GQT*M}06dQV16F>*sT3}TTu2m!02 z5%~|P*;$clKjz`u8YBHAQ^q^2V9YYpP3G^p`Rhs*_dNuEc)mOT4wgonR*`ESsFGur zS$~Qw1Zc&PYo80;Ee}?VrX=_3=3?B5jCK2G{AIaCCsGw$)H~PH=$mpG$NJt*vEehE zx?5jF>#Jv|jnqb-H__6m&`PaXy;~Z{C1sXk;IeR%b**6<@|Y?esjm`$8@Y<)uvY}j z-WMSkQ@t5wfN|_|MJ7phJ{N-_$CGRmzH-(+C~)?fIi!gLDf8zT)1pgiIh>i>cWU*#ibR~o$n&eW($5pE@LAXdA7ji7iPmbjhDeV&S;IAAv9hzZD_g~Ux zLB)WA&DD_=WDr-Z}^9s-coVfVj~_$FCm`3$AH@*@wJu7iX5 zC7+-=I;3ykoy=F*zd?T0)^>9vN_LJ{t}PIN|Mp#_8C|Zg4pCRJX04Hy7@}*dDzJy5 zxSc>gR13BG9aG=@Qwv}@v6Xo`m)D&)T|wP|VEgc>#Z}3JUZV3YACn;a!YPP*!2X{z z9MZw2E=i8lYf>|&>(4_DI^RZ*2x$9<%LjoLN#Q1FrP@qX0?q|csYTFO?s|cD=0uNm zTlS+Ve4051odJA>B{z3spj0@~-aKq{msagsn!kvO{pimFg0UYN{EJGjofi{^SJ>oK z0eIr(#vU=%5xodlN!P`MND3tKHIj9iE`#_zC?Oi2Z*WUuKAxZ@H9YV3X!$z>#G=Gi!C5XDj=*> z&)mG^5e*sA-6jMYRBh47~x~!WkQs_-kU`5hCZX~&lWS?SnD3dsIH5ew-Q6VU{G(o=gCV}FxCp#o0 z#u^jTB&9RM8g7J>uZnfM3WJP5M6L>YCK5wF3Vq9pcknqn8kA-B1B9 zhz$i~V&cG_ujoR2Jj`613Y5xC0)Ml>POmP;Ii+(@XdiK&YHWDa*Od0snTA28x@hJ( zSDn_|rqPuRx6~g{e?9@-Rh;s`bH3apykM78P(&EC3ow&?9uXjGO6yq1DK|9Kx zj9Y~o&-d-0DF`{OJdwOcl*EMu1&v@0xR27_rQ*fY6>>(ZqC|yo9qOICwkRS1ZSiT* zE)zu127(I1Ss843xl+Mq`KEE*`1q*At*W&CjqtB^YfGWdcrUSC#XXa2LA$VeYujqP z4=W%<+Hv^+er@l}F^pH`+Ji!wsD;<5hQRq6vWXeaa&nr^^6?6(3raa#5LzrC3zPu4 z+#4p!lHzQG1?=bmt=HDepVCZbK3=2Iwz!!tN4d?=j`|Ih^~u<5ylL)TR|y4>o!!L= zt=BYWL;$%uPIT)uhVuz_h3wmpD`~uvm}w9UAwtxrkP8>29qR_n z@MU9e#ss)M5n2F2vz2HBDHy?YXPNTxOqnO6(%xY?W~LW@mK{j3`koVi7_x6<1XMha z9v#%}1hBn7*&|_L#E|eNMX4rm+D*YZF)0bbq;dmgJAMh>x4)U_-cY@;K9Bv4sjjbO zM?`Q!SH4E)W>eFyjq&ZfpDefSuj1`8=VOdJv$j^lnD%v4>etWQr*@?sL!_e1AbA8n z=$eQX`_wY)ix&$_Pj0t-<=Uf~N#l9KyB;Goz7rv8)CY>3I0B;1DS$jf5_cWoCZ0wO z7fm;apCIXlhQ3mrVo$>vV{klU25c@Hx7}SjB5X=Vl$Bhnj_g79ocb2U-H#t%FE_0G zW2-u;X;0x|BzfVv&-@7mHFZa|raKG(a?Tp1X?y_9An>6nIoO)bIgMG0Jsn#j18qU0sjd4M+nx8dPp6 zrOqBLb#G(n>@W55IyhJ}brs>SpCf9p|H8wgfM8B$H9ZDnSD6X*}5X z$C;*dmd>wZUQ=0lVoXO;UbU(Jaao4x7n{XJdHQ$5|R^py=9!f`cAH|@I@7PHku{lb;0?qpv%Y;rp&Xy zT6NV6ucSP|p5WeC6?DIbvxMlz>d1kw8qB6Sz;~;Ya(Oc!tjUbOEHP?vI-;*GoBe1o zQuqq8yb4+tO|J_tWQb|pQoUVzsQ=7mlBCnkjlh@#?YUvG9uqQEjxTY>k?Q&vZ;*N& z+40kiqQba+`srU z-WqDP=sxQwG%>X_J|)6C{l8yTUE*h(G#am|2-qn@8We<{(B0P2jmwtH7Gf;(6b{MI z6yW9MGVZ8mL%1GoSXBNPBFsx7hR_q!pv=+UZMU;Cvv!f`zC)nOMbxg3H$6(+k5E+n z#Ta{@3Nr}>*gtbbX|Yj$+pT^rW$o;c#+gQ-=Fj8gF3FMc)!aLFh&~?|e*o0@Act7( zo>+Uygc(rbA~^)ZR);;0%?jQU3AJ&_E%FFHk9{ECbH}Iz+N$bG(;1T2RRl&`!$29O z&L^IbqmDXUHpX()JlWOtFjwr@^fU?s{#-MTGg_@@u7nqee8d^-{|mVOebK`Br*UGH z`gPVfD5$eNUj8ctP7a7!NHx|K6@pks_-P}k zr;sqF`M54?EvNrWp=R5`_s<&LB_XggcDl-Dm7!O}w>rjg=rmA|uPo z*y#v*d~l!)7uUHhX(2Ur?Be@VN>O3GWhXK=+{1kO>8d#dN_F*HtD^yO$fi6RH?{`4 zc~H&Cgx#YO#@n04m7Su?KG(;eWB zVzAW)POY&XuS|;B!4HeUzo)NXU|sWgD8(#9 zsJqM3yG(kaFP&eI^bG;G7UT7U`R z`n{d0u?@$#j}B^}aJ?mM!G5JCR zyDZW0y2^FjL^ztzm{oa{i`W~Spy{37W_#UBu!#)1oekxf>s0>a01lCxCdAmgZ|(mn zjnfdnn`URRAC?}E)agD$#2$X$KZpmi@;0*?G=AyqdNBfr)$hC|f_@6Zz8N&C*L}7@ z=oZU(D-NYK_H&r}BXJP=2VHNw<-(_JKIh^-}02$5CXamM* zJ)Qf7E|1hzn5DGFEIorMOyb1yYeOx;0w=N&qAs@dqDL{ZJl5nYF&B%yLtP00*q&Ux^jZBOeLejVC*vg#`f zCP_JU?B({s2lgCE>0>0u3sk-}O|jLjRCeAyl?C!t9^T`fcUmbj^VvYBhp!tbH#UF9 zEmd);!(Q$x^kh7F`s5T^iA|~X1F#fwTq!QTVIVY$k(=v0-I>HXRY@|WKAGyc^q8!Wad2=$fSgSY7 zW69)DywMg{{h#McK!Byv($yaXXiW>EO?B?~v^6aiDEk>rXmVb@k-xn#L|5R&q3CHkHynn&vk^TxyV{O@YrI`3GX+-@SZpg;VtO7yi z0(k+)YeMXR%pSje>p?j2B{DopKuDI+v9YnPXh=%2(rJu~83xJ0Wl|{Op$uWi_2eC> zj{L41V9&bTJIxvZ``vU?P*M=|$Q&8h=HBSK+gEtcX)O{W)#-@WS@l+YYiMb3rNS=t zo~#aa20m^8NgzesH^k1YqJovM%iTUG)17Jv3Ig@4O6j;RL*=|%XWhsF3&`;sMGi6e zJ-08f>tb{XI;|JzxuyDDxXA_Wl@eVQnWggU?)QCoiT2v)j}7A9VXjF(Q5?KG^&=K& zhy(HI`b1|>=^DQ8;GQEB_x)iXXOaj;=$43NFR|TcoibKpBvE5CS-9zjGwth0Ic|Hv*GT0J&CIL^%Eeo3H0REtmdisY_?JHas_ym-5<5;TCNo+sOY z{II&Sb#kaK_U3?FEv3mg2N7AB)T(r0Dbf=T=R)$}5Z+|-3w7byfzJ>#Cw1G!-5FvP z8}bA~w6sC4L)pH@-B9O$x5QGc>1K+Y@8eQw&@5A1D@T8ADwi)=Ulcp6m>pj!0 zhDZnG6cl#+nv(V9)m6ymy-rRxkHCMfzoz}^qd3TP>-*~DGmhz{sg1NLPL&Qr%J@K; zbI^IA^T73A`{R#~JFE^2FRF(7A!6^hF;b(mlW}h{jvYMEpHixK=^!xL>D5nN5S6`f z`in^Ud<|e1!!yu;m{w+Aw13>n*mWi$C-TbWdI++@(+zH^zJr+5QGD&yFTeZ(cb#EH zNG<*F9u$d+H+;20HUrIwyAmwbMSio@N|Y9#*7t1X9of`eiTFRtqd%;fQjNS*>&?`q zD|<^9J2G(tOkWi3zmvK54O3>nBe}o#n z$kLpZFJ1dI*!Re{c+Y(;yP{(4N@r3o)v>p?*R{w=PrGgaKR8fjrDvU(QQ&A>{pjK2 zUw_q2I&*yH#=hUbMlWqt_0;NB*ET+XEu8J4Z~vWzrfeSqKLaDCK}orS2azqbP;eh zW2L3n5^t8+Am5aNDFQ{qyLZ16thanU_;0nn?bcKc9v*yF z5E+HPZ0+cn&^f99t%U4+A-=nq&kBQipM>FQ&^`;b`QA?qB&#g537;t?PrRO9VOac8 zr{f0{dRUb0lc8rq#)ReEA@^F`>wn`|0e`fiLGisFA@~d*U*P*spUzBa9ND&Qo5aK+ z;)KzS)m#&+00S{$ic_JFbwY9YNQP&-Vygc152gMq^Zxa|o zf~T*S<*Ew1Z>h0O6SV7m{30#--#~G|_0rN?g)VlXS-1AeF^m7czC0%|&-#w#-{Stk zOC6IA>3jk~VU2IDoR7GNIecoL;O&d8M?~|DmM7XzKIcHV&v~EWVP!#!+jB>Rvz-%e zrrs*cl#Q0Hp5R~o%X|HYc8+5YL|I{?tY9R9UNbTWetJruL&}kS z(1XLdf9&Gu5L;iKJ!EgBe@LW&{8}+-IPBR@lg6=T!I=+R?FWusY*|$h|HntY$Z2I^ z;Y01@#!N-c%rRwbJ0{y8zWLr#_fDz|) zXp!q68B^85@F4jN;a_FEvQcmvejhzTN(}kBcW=x~shVQDqBfP6k6{( zDi?oUXZ%*Sg(>W|?rbM(_#$r6l>)^D>K$J)xQEeW{_$xUE^=D-7xEoyi6R_`)zH1k z4kLKe1*&Q?eCVsszC$%$p4b|HZo$o=zSeOXxpVvegC7R}EPn9)jeb`-5%T$#xUJ#6 z%&Z_^Uw+e*&}!@XWlPKPA0KQ`^qonkKq=stZ8Voq4_IOu3_ht$jNye*sZ z=b@bMpQnE7DDNBj8lT-zm@-vejoowkqnhr`=#fn1$Mpp?s#|r6oR27nfL^({C;>N` zef%Nz-xbwA$Yd6l@@Vn9iyS)!e{Hz_I1_SPCDuqWtB0Po*>P0kiB}a+2UYQuNqeIJ zY}zI}Z3g%MGNYcicq050cOFL8xUcUJBa?rHXX$t`FY-B7MBn%*BlL8-ujGQC~0_iqPEA=cow5i;Az>}1cA#a}~>v7FRW$vT5A zGdlk^E-Pw|1qC@yI1CgJK6|5j==tnn#6-@1zZFeO1v`Ini~E-^!!mI(Z6Cgt+=wkL{VcVKqQ>Dr;PHpplsOk2)X3gm7<#F?*@xaDTY*Vu(szS86M?!5eK3WD&l9k==WA zv@WA%uzkX!;g~ech!C1OmvsA8BY&B&z%QXr6x!D(9|Oy(6i~$u$WIDz)}Pu|d6&N;>0ZPSdPU7@2&XvD3>gt?vAREio_k z^yf-g@`lHvY*CRLL6rmhu z^gGvIt$>ha&Ct!5acf1llW_d%E*p^#@32~#`Uk~m%VG;Nc|v*|Wp2&A#T&7VBeU+D z{w9GeZ0L>tQNhJ8PjsX6>`bnt-^w{3uVqx}TI6O%%sD-0t3*mlFG#~+oKQ2F=_S~y zsmS6<=AxSSS6+@Vi&4vQ3neSlM94NGrf)b{>ypmOK@wJW?RR2qTwri3W%=WC&X)v3 zy;x17k_Va|i;K*4uRcC;vc&dA&Y*Iz$+2!pIB1!w9&2qEz>#G=kW_l8uIOu~H}SCC zc4j{TuLZv&vb3i$fuJq*f6f&Vs&@UvJ`UD*`Bs{)n_r&O+49Vqt?l}gdX;igoYc?i zmJ8GD>I@dzgUV(3D^@pSXdF}TcecKerB1F~I~9_X>ZHCoMez1btF+gAPTtM%3WaQc z#2l59aqZcTsC2zN$?Z%m!PA8dlF=6bbSe)$Z+H$QrDS+X|0fO=9(+Xn9f7mQ9G_mY zkfY*}336U3H`-c{-P)*;uR=)d%xdjzuGfl*!$$N{F@DcE`4J+$LM%Aovwl$*#&yZi zZ-dJve{ywoBxfl;e4=Ni0N~cQaXj29TeRdzT8x7MgV2urxwl&#YJzeQ1OLZMqu3IMcomQ3@ ztxg(w&KY^Ye!R)n8BT|8yx+@+WqF%lSbpJo48x4Xf7vQQls0y4r*+lJG#3~tjtb~q zlT{N=-_TRj%S#AIXQBa{?dY@W7yS2 zahfx{D$uDpws^cGG^kZozLDVW*6PVz=u+|i{rOneu^w?!{sKqoT+_IbZ+s9-=S<1C zdCTl8SfF!{v?#T9eDOYiMDRqQ8%k!{OpGsq-`jg)*r@@s6PBrKgjWJ^4-U@r3!Y*{s_2I}(hd z21X`KYOAyF$eGmmh3(y&<1m>f=(*lh?&kapL%vyeo0po}f?LXTDQ>hKYu?K4{GYa* ze{-%gav0vUV-Yv5Uao$(1^YhxO#6`g=49)Blc7&1b;!^Nuv&!RalAHwEk=z?Xsq7X zceT5YP$NRvJZI=3DAe>WF79Y1cGi1%rE>7Vi_3MC#=g$gh11pWm{~&2UbjKJ$k#5U zCdY(oqdym|Q(dJR>fCj;wYfr0%MMHxm(5mq7i|p%m0A?7DaiM&guRo;dS`P`%$kSU z!;V1vK8$&5?82mqcY2Tg?%hyqHilBm=e>Eoi(uO#PFWpMsnMowG)xR)`}pU23{{jO zA~mJx<-aXt*m|Cf$0wq~k6f_0&F=k4aG{Eec6PQzOo##1-0P@T;ij~UQ#iZFvqgO5 zYcUyLDZ)Xt8y|oz^{^<^i|TgS&Q48OSokWg*6&*KO|@6@bglnb1c?2!ZNvwe1dOp< zCjl1H#5_41yRN&r*1A7$s>)|~K;`BrMQ2E%k4-q+dvirh_JvT3_{r)1v@HIhJ{RYy z!=Fiw50ZXeKu|LY^nLvJv43w9<6WEZ^dGXpOf=94L3H&Ws&0Z4VYFm zWl?!N`oW^q`9SjvVo>ncsJ)hd3&V=%3us=|m+XG|GVI!v)XWw;c?OQO|AOfANf^I| zZ!qg}mf?Vu2eppV{e1A}yINEsZI82V%NCxMP-R!!(AD)u#Cd7n`jI*Ms&ll{)T$`u zymQND@$@XCF>Ny(xveuiJbpt}%+Ojez@OQ3qT|T(-XeCjy~N%w z`U0(bwfZ#w%hTv+);#B58^o8II)@)GwOZL_dDE6=-%9ccT^yguYxU1-bu-6zYw#RY zPj2@0rfv-0%3TdhNl*8KpwOYh-p-C4+6s$LR*#GXUvCM@&Fwfuv1yqdB&MpPUwRL^ zI$tF%cd7)wuv6OGo#v-rQC1M8USRQc@kbLSm$rOM9IT~`;Ojwtqbd3bVO*(Hzu%h ze2{VE#p$HGT@`d}T0EHBu~xcDzsv$!(6iUSySHu6vuDrj+UB{?0VsqPrBLA%OU-&z_YX_G^z$ZM_hsDTN@~{LWrZ z4`GYj^y06ZvCRwnKjF47)%M;kQlHmapYR$z(JDMOT+ z!zOyt#+3=Wg)=x8u$fQp zf_;w11$^DIg=j#O`%*bC%-WaLb%L<;dp~0R&4iNx(a3 zHyh9SDWmn_gE}T@JZZxXtwwN?vZAz;Tqr7BJ<}sli##}-`wtT7G@RY)koC^yiIj~p zr-5~U)Zx8?!|%5Cbydx#>r}W|oUk)FMdrP zDFY`4BN{dJ`R@5ce1@#h@i(B3)0?MaiIi1%Rln)2gcR>Z%dsVayX?-BHxE5$KmXpqy$}g=FCTlo*YMz8waSvUaYq%2 zne5jK^T$KZTdBvoidN96Y$M0Hs9%(;>YPMYQy{9SMLT%(d$vANDlkvFfrP&0iOZw` zJ|x12ostyUt6#LWEzXIy|J=9W;>Uk07@*aXvdSC<`i{FJush9(w#|HQQF1&+>S)@V z8>dEUTm=dwDMgiQCYy`eVx~{0XHqgVWin~A%)@v+I(}viFcm9(Bab*Ed?8h$XmEvs z#1)0&W3T18f>aD?&(hn1$8JQ49_QbfPtN-!s=I{c+7v#1c4RkoedR@tNs#}-X$~&9 z{w!Vuu+n8RahsHZJ+ze8`Qwxcv=i8vt2DZrQQ>9pF?5}HPw?Gc`DwhZZ(7C5KuRXY zrgJs0xN_|)g1;*~-OalIdm7`@C8T16OsAIpk#^o8gLeAB{9z5GHK0oL<7Y30tmHZE zCit`LiPWHK=S-T{RhN!HQJjrmmM5u9XNy&aC8@+V&4ccdUo+^!Y;CJz*jd=Cok{hi zNJnc%of}%dc4D91y5(tT^lo8fTPMSUO*Au{7`BI^|BrKIr%7l$hv~5tqG~T?c(8k)AEt76{ zH3J;HvXr%l$MAlxK;EqK3xjJdow=8+j~%lqBhBedW8+FoPa)7b@3A$|#U}m5?RHIq zCh^z9n{KB8+89ojr8+he=bgY)Us!6&YmRj%(4RR#G+jLZ$v(G5cC{@bCUfJ%lOR(Z zf9V+7>4a5*&8!NzH3&Wm2x zoqfk73UA$LPt;nYtywg~#F8w&P3+-JD&EJ(W%c#U+*))Vk!9~*u(Ni(mLqvBM9=X zl{Cj*PrSLX*tm0eOpmq?UB0=~uBBw|g{|j?Pcfz9IWRp|;S|Y` z%1q%&WVA?P@Mnwe+>>id6b7Y zZ5UxH@=is!JJ23~i{)L7ubycEGNt-(<$UTySE_ogu4B}caYJY4d8>gk=a-!-vM1va z8-xVkY2jS7`ABhc=>Dj{BI~|G#En6f5wJ0>N5srmUfR)Id;a*NxhG~L3T3V&e*9{X z%vr4ro*+~fRjn2#r(2+6tyw^fgPCQ~ZMA!CT*c;oT$@)Yp}j=I9K@dzQKddzOF3hy#Jl*saHHCX%XLMapQg+4S$fJ@&RR2?8@ z=CgipupAmQELkrEWO=7Hql#Agi*OaN)LMm>eXwhsy@RpEN!A5oL?u4gsn6!Qnbb#& zvs}mJ11%(F=AwUFXk+?#Q^>p}P&2K;r2f@MsP*1oET~fuA!J^+Z5(}Y@7}!e@*@EO z0a8s8JOEewGO4UZ)-S_&8>0f*SXqr5-|(qvYVO~8=&WBQb%coUBlz;;f#MFycU;^% z!Yei-TqZ~9)xjtE7=`hGd=bZvJX9nd{nS;Yx%oG~B-+&DWi^KD?EoUfZB7w3G2;F1RKOMzYcP zbBC$mSjzG9zbL{!C|Uc!Nay8ENXVdw8dGL%Gs&brDWKUoOcPCYAh1wGnD0gmGn=Sz z;DyEcw_N*Vqk^Bko+J5b4)EmgBknfu1O`B;k>8k08rMa`id3LUXrp zcOQ-{#0`2t9r;0kxR@CG6)B-WXq~OGi@i-2pKd_VxSrf;2SUHPgJ{~VvK0=9Qg^Y6 z|E^_w*jLzoY^Tx|#n#ry7{LluQKsO7uYZuB=DiX2)S&&OypyGJvU1EY#AM|L8>GyZ znwo_?I`xmuneob(z@FXfjE1Q88($g{qM~HoyGL8k4<=s^FJ$li z55p^4Kfgi$BMLUCdv{J;^y(p_AyoYPU$*=SHsa=Jf$|mi(-*mq^&Y&vZ}00s2Q9uZ z#RADWpgitAn=Zfe>1n6QMS9c4WH4P>*wXSz7y2E!yfG?(!jB@BV|0hMs&K zlLU9R^De3$WM1vsD~Ds*o^yy|dJwd*wsiO|*^B0CZu<01dEE8zT=BW`-&hK^?L1Vs zILaGo;4bgEzHGCj)q@@4pCOCv^l^+UWhMntR#!ZCl@$)~IJ@-lnG`sXuNH;6WY zS>Du_%`4p{;!;iK>IMdRCeHa~6fvWi$||9~dly!}Cg)m(oL2daiE(d{%Cjm1tHLu< zteq80(lzhSj%)Vf+Pl|0#_{Sd4#^YoZy>U<6nbRVY&nhivGp~J&x0P!BFXVtmU^U} z1TR=IE_d+#{<^UH@>*ns;3Sjp55@Ofl z8eS__>F9Z3^^1v`W{(@gCkSHmtg0e^vvR9?#5jZ2)T^{HN!z%5ncaT5+iZi_E;VR( z4_W5%qST&op$c>uuXauOnt-{##A1Eb$cL?Y8z=?SE1C#cvFqfr322lhC%VuXWg_V>DFV4LP zejy3JJqZoTfGCX8G%CQ9E1`a!!nN3{LQ?6Y#m zP~aH%%dUZp`pZ`5>H>m?w6ZMq>%?FKQR-%@hR2+{SgpE>3d)hnQPqG+v+6yt>oDz+Uf!MI#D&esN!*=HlUGd?gcd7GuG51 z$;+<0_OFH*iAu>7$h860Sh}0dske2-XBTu$Qik99xXm1CA(WAd2MQ`kX63TJ+a&Z# zTtJXxbJ^;9dp!epl$;z)+wxl(YqKU#JFj&89=BhWkF^&jKX9J2t$?yH0i7yR5}a-> zH`Ox$xir09xP;jHy?cQW_3sA8+GJ3|99^QfaSEZKQkzp8Ngas>sNJl>*)>aB8F$rV z3Pd(B8LggrqtoN@C*7B%yP~CCmHK!N6J%f^Z)Ls^tSNi&+n47KkH>gxZ4v-Q#A4lM+o`<(pmX1z z8}dgUkTuM4S?EBh&l?ev(g+DGf@BR4W+^o}x_h|P)HGs?B0x1OlvTWZDb>8!=q&_c{EYc&qsWO06e2ivaan7-k)va8s zSt$eg+_cT{7a6nRU}t8d*A{wsEB7VGNXleZ(xTKfLf23t&CeW!MMbZgq@`6_QcDZB zg)h&vW1CTiE<+^?b+QATpYP_TuC!H!40l`?cmYP3nY70Y0jNN5sq5)OP zKqRWSANngDQ|nH$Dn4QSrxxIRsp&vj5&J`YvPxEZ?|Q*>U;aww1&Vc85IX41Of#jeW#$E{SF5CS zr8BA7cQ;!u@sItd2U+0JGv*lU?d6oNtH~+nvukjab34-n*AvFw{);$UT94$?T94p6 z?@E8Wfl}vyy~lm#7T5dO04jJ;%8XEw$_GxoSGQ9;aM(GpBR6=0m}ToQ)n!?<(j5h{ zwlR`Zc<|Nt8x8R?ynG*#I?HU_lS?>Xi(MVw1U|rj5SvFdv7Na2hC17?VI+VwKe)~H zZyCTB>$?}}UO7$%W?w$bF)R7K6p(Zd$Gc7p)kS6mv3Ooivxg@2dKZkewZk>1E9HEl z%V{z{{aUnJgTlg`H<2v_{dS+DBRON1`c=KP+SZ#=x7r^TZr*jhQBgOhFOtkAT4<^N zzu0^4s3^}Ze3ZmQ6BP(5q971O1d$@ryA6=udy60-UCPjgW{e_T=^docARy8iU{pE? z2+S~aqz)aaL!aNCGP=yD0t!>Zw zIUAKf-5gp6!~njseYKKyAI<|@xvEM)PIWg=K4WqWZE9M)7YjLM69qcX3>Uv77k+_` zb+13>Jn_UShlQ%lWhZGyiLI8`zks_}jsV{;%M}wo*K7SCj8*Ur*>TChF!n$aUol?t zDVch~h-M50=MKHOJd~>fHk9Jjw*PW!OUm+Qz2$AwW!ROvKzFCdp4v>=Y_`#L&ViUfNggBQS5m_Ib~# z>FJA|>zm@g6bek-VfA(jS*Ky)m#p){GfZmf`CMHXP86~;I;n2kU(S=?S8Lb)-UXtM zslTZZDqcFvv(nQ_30}?Inh06{lMJSu$s8fwA_E4Gkx$>2P@=oHJ|-@ z4Z~e4{npR7j=+?*o%53vT4*)=bhyLPkc}oJN=Z!!UdN$I5eiUw{{9s@Xptzy1EWae zq_#5F-K$j*ItXKrkqB_OLU@SfeP-{hgq`4%@Jrn33hSd*zde|lC6>h6?MOQfbcrF;RCHr~?5=e3&K<_cDv)N@6^|2b1~TkP zg*9Ei29|>>7J6IL$cK7d^AbGyZTriF*9J_d$C69;o?31Uuk$rp#+m+t&yOP)Ic_cY z3Zx*t4U5c73K#5+REdF$llvlM%kDa6;5hN5(^)-+Hmzur$>X^d27>gI|C&$s`+L1-8HyP_> zyFOxx5pX2|!F)U0xpNOqba&CKz``ykYb&pGyFe&cm3E-0;m=Ybn&N zdlOMlyK=fCQ8>u5T`$YF2rGS2w@C5XfZNjG)xioUqj@nXF^>F+Gw8V}dB0?Gt({ld z2m_B*Y8jKU;$+#{rdUKz&ydZ4{jKH2>B+-ARuxHC01YCT&3@Ww>*xrY+$9YyNV8pH z#1)xc{7!MDZf`&!GR0)AHdP9#YFHrK{&objCQY)`iScKh_I>vMJR9FlN3Pb{?xJYM z@(PZ=0u$EBX6*T9R)6Ix($=zXiz8uUe#Am;uH_C!UqncH9zuiJ~{7vugeiL zoRo$Y!dp$6_iy>UXJEL(C35YBu|_N~;c-gr8sJNYlbQ1D&t=c*Z^j{h0X3ck~)~1pb1!I8&C>#AH`p!+2%ji%#y1M!<9B94xn? z2g?}b?qDQev22o|nlgwv*dH*MKC#!**%{ue%5;jnM?9ugc3wbQ*~nuab;sSS6SJbK zkk9OSz{hM!@r%EJHk zk(OkdD(CyIC*?L*U=LU=2W5P=sf!;d_+@Nu0Itb-6QwXI*PY>2(qdNqx?u-qLCfwv z*^++4rB!N2xU#lJ^BkWa_1;7Vv(xAKupCmGg;HQ+Go~{@8>O zz+i|+OBKX0AjV6-@iol3omjP%xY8`kU`B6L;i!aT;4?iHXX=eec5eDK+gIS~CSGZQ zd!4}KI`c7PpoG|SLkY%&V<*k03xnTo%6XymFc_3P@N8!#}?$ovDrk>+E5=_V@uH`l?$i|l`#SwcOL zD31UDDYpseH;p%_U*~ZJTFWJVTy>L|_O*$}|F&($?VmZh<9gWW`!&1k~E^}_d!%CGEqjj5-sZA69g5B zhC)iodvROLG>Z8ua43ge+MOn&wT{YW%27|&wrWkjIz~Q~Bm z^6-W3P^q(4GIBY)yHa6t8|cu>S&OWl$7E>Z z$K<`zUZFQw(9c&&UvEug=GNuHy!i|IiY@jY!edD20+#)^{hiT3=<>>`Lvf4NslFEr zw?`YNmr;5vEUWfE`^w(kSa!Wv)s;`F=CtWrU4{W1SwC``xDPyC9i5_`$c&h|G7one zOh*b0rF<-sS>J8$AYZt{L22+~4fn%PpR`QCex7SBU zQjvZ!SGmKr(Ba`^O@emAK>?R7p^!dB0uf4U-KBujdu zda=7)W#EZboxRQ~shFcnUB{btY01M-cW+{3L-xm{(a$9$I*S<~2k?njMU@14Wr)+?h@q=(D-TpS!6jt846&hI^nxP@Lg>b+N>OFO9A zSWh!!J;u`S61OnpCn;0VSC&sHjtEdzcP8_FrRh3v`6c~3{)uIBcsTP=9MUPODQp6Q zWQCJV?iyf8W4z3Cb#;gR_IR9|5^@*aM`Rg%ISQfj^%T*uay-zvY3@!t-qqB!zVbjs zM85Y*m{M{VxY8u2I$pm=o1_fGGFwaW5{u?7XOan-89~Z7Dm2|{con!6e3mCM7cYUB z|K%8K%^tG&vZ(Wl7axp9kQ5cs8AZ%ObD*T>a@0Uq*b=> z&}aX^DSP)Mv$rP76;^9_GF34$j&R+uTv?iFMeQ(smI9CL;V@B^F_flfSlg8)rfnuqxLcP?fiR0!}@`x+u3=vO$VfLW1maHtr$;Je2{S7uA#MmUt&;xptU z99J`0P3ipihMw?${^Jno)&UcNE0@6o{VEm@As;zCO1av9vb}C#QS5*;maeKoDPa3j^j<4 zfRN|85}%mNQ5sQRhYpBr29|`lCcrdWr+V2MBRh0nCPhUF6Dl=KafK%NxZ06wL^$M2 z*?5UkCkAk^1)m_!<=K9?#_|K_^wdm)lM|M`kVTpsf|h$pP6Kac|J;0yB;G<7QX%?K zdTZl6`uM-yV@;Cu%76x64juwYwF{4K)>9r^_evg{VvW3-)PYY`7jVBLdoM~2i&970 z>2gv>8Tj&AVv3Q5P`km6^N^!!ZN zm4K4%mdnsCwy`mWQuqE2+EQ6sP4SrlV_6$6dBerU^;#7h*uOtt0c%N{?~g&k`|SDi zbDp=06n8@QB-|IDi@DA;0Rn3=QoUIWaTh#~gNL8e{oEG&rRQ-dlW{_lw689=Nx9@2 zqi`s%iFl*m=6vj4GRVxD+G4JOrVwB3f}hXRxh9e*Y zak&3u@#iSnmvC~#-R-eM?-BtF79|e1n~#5x4ca9YRdaWW5nmr)afYv*w<`D)aEFH# z$1*M3&$1U{7nYHe#gwR`5VJflI=SH=ILU2Pcf+b<_qr_sO>a`|HV8vib#BR$rMITe z@75H}Bl9kUp}T7}ROM>T4VM=?!xxg>9@`wgB$46w#9ISvS_?i*WokNx?fU%48#7F|*OT@0>5R%ePDWfl zQ}d?O>$gLXgE#!MYYpf^K&;qA`$p zYMS{MFRx?T+f^|IHc?I8r3#aLn~d}b|7%8$s;X|wIDT=DdHoqF3p1v)v#HT3Da;V) z_{df;(9uEfso;O5Lz-ozD{4GKH&NX1ye@Pk`c-w^)6wb1Mo4)*lU{*geO#?zcU}&l zb@IUyihvOzor7o5bz<2`buuFS;qJ8XPK z<8kgI0;;Tu=dkNrNVCB*syePKs>#vkXqm;|M2Z8I^P8G>(c)KcLUm)n$VnyGYyIq9 z@TC?zYxJuhX7$Vm*63{(D1MW#EW#pUiOI{0+G2CQ3}D;U4i9rk(F8BD{R{P$$)a0}l*KtuAzWK?di62^z!&&bosxBAz+Tk5(0=d*;J z@Y)&j)a0&qyK^F=U+R5(+S6}w+>PrzmfNHzy`v1icPYy5$b-m6j$ zGObdFA@4L&Z!MBgIp3ya(Hgn`{5g1pJA;WQx@0&y#TPd27Tl`!-pi5+K>voHF9Yq% zolBQ86kt>4c3p%`4;Bacb@>R@JJUP^0TDo()CU|cLr^N>A%-=ptuBU-y*#D>G!a6o zMpW)e^dhA^tY2v$<{JZk{_9EpY1(dte^p@l=l@at`Zq1iU;q2RAN}77{BH&Rw*voL zf&Z<*|5o7tUn}rm(I%zNce~v}tqDh)lidW}5rgj6^P(HV(cvH*NHs$!is9=m%v#EsX+kkS> z2>(hBkWBtUF!4ZSla5fCaeR$rK~VGA4vI2Nl}><|*wcRvr~meWO{x7r&8ceiE+k=0 zY;vKY3})U?TmbK*-pc&lJA#_KdK|}pbRm)5y3?u%PO5yG; z?c3gidVoWmB1g+QJ3B)Hcxi1tZn=BC6dE(ca<@jvhMbjupYyxR$}vEnYXAEhm4%%r zB%rW1bF!dfOzFoF04$^cH9Bu1?h&fQTl;IGpkwKf>slOd2xfWTRXK_O8im#}FfjNN z{cjSX32EoUTnBF8luYd$0kv6+L_{nUk>9hBYT*h@edh3Ymy%t(g5hREJw_9f(Ncih zoqKefJd*0sQ6>}87!sG$L@RaulI@gsL?DYd_o(+?ZM=ZB<6?g?8$eO#kFgG4EUcM` zq);3vqQk&jp;Y8@qvt$|Xz~7otcJ01a=a5DJfh2$exQZ5mWK`AwvA$2-swGn;{PO+ z^N{edrlpE8&51!~3HOG^xRVjEAG2+xXyzDub2>wzF!M?uq|L?v_!{25ONrV4#64#m zYsMM){oiNcwvqL9Ob2@;C5$PsS(1kY|E7f^HHu=cVWz|A(nJYW&P+#AqkpoOBEU7D z@^mm(K?l5$U$gkl7M~Lt@6fMs_cbrH>KL9y;$Aw>B;?)&_)u|}mMY<2-TWzA?O(6O z$G~u`CJi0_0x*SI(onI5{KquxuM|48sP<6qB&#$xUEaE^MN@bP2zf2eoUvEM2Zw}c zS$|BG;^>rF8KQ7@IG^^|jx99Vxd=~8MKEe;n8(4}u2PN6956`UaR zIN~&sPidp#{$wtcl4B!Cqe+qa6_)LNP(V7zzlf9xrm#o3sp6tbuPFjBQlJ?tlq~aZ zdWW3l2@hoTlQi{37!Q+(66WM*)b4u;Y?pR7#4oe>ZUi-mwZ|4cw^B*UD)3#Yy~=Oh zIgG2+ElAX;a9?U5?#HPxi8SVfrTM18CC0}aRr|=AcQvW}XtT$_YkUT~ySZXM^Kqlg z7&PrWJ4%zCn8OSHNQ(nzS8mj74Wb0`_-7{LFXhr~U>3fDv+G1iFpiqA4)QFjtj%Vt2v+7mvfPCFjjA_q#b)0vh(~ zX=PYkrBmbF`%FB@Vlab1bCOZWwgFJi#$Gitd#dl&Dh2kG??|jFzJKuS_=1d#zfBGK zu=K9Or}Xcje+8%rI4<}rn=kKl7hV3~)#etK-JSu^jq_4j{bYhQOUN=JP{L|wehBw-&DD&81$(xTpjM$wWUCBe&o2R@`)@{_R~w140A8JTrEmq53M{CYubJ)6R7%(jdS2-?RbTAB zRE?|j-kf(H$YyA$ryV)XwtQ%k>@|aW850weX!hnejZl^YP22rlJEzOvS9VHHPI<02 z`ZtV`w|=YnvOhLa+`JsZn?kE*ZAJ%_;_IXNqYS3PRHOLUW zXcM3RW>lU=CUhXV;I6-NPIC5-?NNF{1ILN8at+pxB`ZdE_dI9c)1j^>&k0yH0{yO< zj5yfTYyNbRBd5t4%!r^v-(|mz$t12tfl%+|Y))QY)vzSMu>j{*3ky6c&7aD=X>MEd zFOP9j^p$@?5fBrbP{5m%p%kYI&>R51`)jdGlS$V8B4Dx83@bcWBOB_#AyqE+oG_<& zljWM7Zh&JeKmYEOJ41nkiOK7%&XZvRT4i{q-~YwNHW`ph8mUripp%;K2X2PzfXFmi%vEb03Spls@k$pN`+~qjaC0iE z>x!*R)v7!{JUU#Z#|jHPnZdhna1`W8pi2_`_RL3xqpoFOi(On@E?v3=GB1z|FvCf7 zklb%E%e=GqB;!t?d-p3}j0@>Fl}^}yVIiD>dd)Q~6lOfk)zx((P^Rt%ed-3^CKE1V zyq+(F^>8*9H3%1H0Zz2L#-JApxVI;Ff}{Yq4F_dc1B34*Q=mMdFa@m60CL2iV(Q8J zNK&{#p zg{duyL5bca2?>lcF|IkVL^>F}e@>GMqeyU+s<^bn$eVV)P}LN10F#$8d|^4@Dccsx zwp#_2VfPM3R@>qUlktA?vT4#%nUvM4M&wuSSQB(S$yDkIe}mfqFckZkxT#@2oGD*% zH@<_&>@{_tLalRhZhPGORO59*^E*YQ^|&j26;5M?xEHB~CK7u00(z31RD<#Pge$gB zj-|XfXASUN`uigj6b%i2)ZgEb+aQt^Y!hcMVzA6X%e>aK_Q7^{CwN}3P70N@CC}O% zI>*{Xsk|O6Jzs3QnOKUD@HitI%_DR5(j`?EanAGUg6=+CH&MW!nzE9u%nx3?Kho~! zDaLJFdYRv`w-6E3b#tMw0P2Q~VmzDf1DAD-WgC0fVg8taIedUWUfFM9qYd!`UO%(W z*%OB{%Kg3iSU?*)MREAmtL;93uR+csGb$ccb+YSL{KQEw)M^cce6xP?aC{FVErZI! z5(T+7lYv@GyA}aa%)L-o7Z>xX19BYHB<*enLDc0e3A@1=uM-zDC!YOuV`}EIR(Nn` zWdkB=Z1309?I9V9o-C4u(fx79qPUn8ot(Nu%Xh2IO{`?mOXctMaZ7%|3X5Q#T?#~bHFt;m z3M^+G2~cB0k(Nd0(VsorlwVY5nsd+<=Eu&9-N$HHh@^>K%CK^D4BC9n=fleGHJ_F_ z;o*OdPS$L@&=!|RmqN4r3rI)9n_0>7=De8X?-YSh3!My?5SNSaW7k1$;+>txpAsAT z30E%n(VUljV{9EKKfd)q6xZi~p$*|`rSOi7LXKx5q<8Ofo7QCE5EN3jL5j`d{qM5Q zy()yo?lP)$bW7pi5Os)#qkuSgagIpj8=BtT&u-m$GFYKb_oAgr6AjMJ9*OzDqxjs@ns8_^a1DY^g2c zH*-mgnb-XwaKMceISvjQu=<@z^Q-39Sa|dadn7thNaZMJM?Aj-1GJHS7W3#t)`6kM`Yq>i^ zcD<#`jIt4ley1{1k^Ha=k_=s^UIxn5KigZ`dYzFm;bJCpDFgqwl`0#Ei-z(KA6hzE z6>x+iBi7uM)f9?hq-dQ6%k7x0$;9&-xsE9f)nLzMA?V1^%B68$l^qLmc>0vzVmEO0 z!-=AX6MS`v$8&<8$AhHKZLY^AV)tkOI(^@N_iK`Y>K&m!;Jaoy;6iO{R(n;PS6bwI z`W(jUq?T(Ix`GVzb&tsb<)$^688Mgi)8SQa?oe{odKZP{({^YMXI>4I2?q(Z^hkbP zu5!XzrPwJB+ls^89M6MIqWex)0_Yk01-u}mtnq9$-F(|FEfb%5PQ+oD)1hO?sV+)) zZ{I^#7j^@`8zm3{s!b*I7%hwX#OORepQCBW!=8_{2?c-d_G#ywz$J!yZ#^wVfLOrg z44fbE_)YP}lM_`Md~yYYW#-V!3iNpUdZ1n(gYmrAi|%zc8G(12kx(pDlX3B$M~u} z7Bq7fz!wQ0rIF-aJ-NRcF4MS6opvbWzARCRwq2UsUdak%{59+5PZxiouD#L|^8EYn zxd^}isu*=Cn4V7d_3T2KRt;BPx?YW^j`lAxqe*Vp8-6kLzJ01k;d?RS!ISpbB?b12 z-|hHW#kZF9mGpUUNlOTDd|Z?l*_wMbTq9XvT5CGyi}_gSc-e zR(^9Bz7jy?&n)BjR(o?0pO%naw(zlRb72V6FryH8=E8+6Ffg1q)++hSeHyt`;;&b0 zFSMiY>mHgnA#_P_-E-Pf)$GPq$J!(qHZ`_xMEkp>U zrc@W6jH_Ci�B1eQrlKg(qE7U=+50h+^VY=wXWpCCu;)xn1GVi+lhr@LM^|W~0>V zI0dnfiz1fm)`i(vWc*5V)cji?eoxQDP&CfQqV3z|eZ0C56&a<4m}=1&uot#aiQ|2B z-1e;gJmYs%m8Zm_lfN;k=g(#1ozZB%Q(}#M1-BL*zc4$SS8TD|o2hl>jQ9$XaFf-4 zzixk@5x$t3%1RK(ouBdZRi31w$#y#b#szOUJw2V&v`bnsn%@N3%Js%Mo4LU^_mxnD zxW<;3^=E$h?8MmK-cHEr7z&$F09slvkj6n-3`^fbg(^Kd;;r;*^2i?P8ih`knwp)} zpEcIhbV=weS}{;_syWPw4r>O$2QBy~Mdyi06{-E+b<3g|6%>2v1=4;olzjGYL<7J^* zsOR^c5+TRo0~Z$;E*CyCRwrK=K9;!uNffa%Y5;~;vp46v>h;c{jrTPoFtsyjv9GeK zI;OghHSWMXm`V7H&O#rLQte@^kz+KBShumCBeg5l)^Qt~mwvSVx!;w;|lX?zKc=S}jkiO4yb zq!YJqi$7eATSqLsOVX*8Ltwo0^cY5vD>56KdTD5dn--Xz$4B;T#y`*sKKe}t(>4FS zT32=AF0OueVx3l}L^tfVD-~5`qP{&t#ZSO)Qw8MXI%~1lgfA*Y;_6(jt17E?on^mT zG$Zs>V= z?I&V5)`6;$QVzV*MENMmpVOu0e zxcP*OimK3EQ2ifnI6b%$wB&-NPat%@A38mi++ADW+}c}`Dk*7um47b!hQM3p1@Eod zjJ^UxZTBjFCIPED^azH8N`HrjmSY1Q5zMY;^x6QRwza)NQ@Rm<>-E`CcyfSadP!%@ zQBq7y_T|gwr9=)0>|k`MFzRjFp3&MCx~QgR|8^3`i1-&PIB(U*(Qw626 z(J$ngX??fmBmqD+28kK>jjqN<+4{gSlvAB)*3mlY82$0F2)&Ec`Dh(iLd#3iEEHhp z{T>WXKl>4S{vVcusNl>)YQc# zL*=Gy<>ZzTK123Rq$+!R_xoGY(x%nR)mCWJT06YZZ5F5T80!iyblzI%`SmwFJw0LD zsmN#ZfTQPq2oC=Hg%T{q7FIb@ds|Oy$VpCj|2#jEkE|k<4cJ4draRemI6X=^G?l-K ziRpk2=@TEeF!nNBlMclif405*t^NO*D=H-=lhxn&)$p)n@3zR;{v#DZb;Wy%J##og zw$6_qUw^O-_L$cWo;ZCfOq7FzbR!kf=GK=0Lv=sDx?a22dF(h1O%HU%FkC*MJeU&z zhd&flgCkL?{mlnlcmrg2C3dNo6_D;LddkYlV4k#Z>1<0VsH)-t+6ZMBeDdT8y7Cgd z8M^FCiC0d)d2zH23%q$;;2j+X`26=*x_#`yw(F}&7#}r8{-VXM_XL{>6aZsK6#V3& zBa}c!yKxzSp`cHDk+-;*e2SpYeYO|-wlfauol?!sCm=ZDv+?zU8CEe1Fj&{8v7rG7 z9>W2H0ea(+Y3Hk5l-qeLs`JgWq_}c#il3P#g45+Nmp)(c{ywLegoK{C4rkkku9<`h zCEoMgQl~sy6%sS1H`JiM#dHwJ(4413sF(Ts<4~C_}Nai3R&Ta8-G@V+a zs9`PAgKx9uvXs!Km#lpA`PC0<#MXgEg%b?CedSA-Gjwz)u$iqRBPs+l)~r_AFiPQ1 z*gk0#&<}?p%Z8=Fa@@w8+8M8o2$|L7iHTF8o>MJI!P&kf6|vS+DZvzJv`72L`PI`ADm~OG z5(#}Q;0Alsd>fzhoDGpaco04!usKHdD{`tcv1;($bt5$VoOx|(7uLG(n`f^wnA>P8 z!$zV}nI^Ie$x6dCO}seBM01Ab(y6&5-1eqK-NhrP?~up#o;VCTsI)YpYmhuZ@lE=LJ^- zCb5`J7BHX2j$&fg8!gc`02K1w;DDVGa@IE+pD*(8P<{oaYO+r1tNi0Gi1nGAt#sWJ zX4tO^3y(%er6#;GC>iZ5G(oC(S$9s^j@3O$6rKASrdbC+J9++Bh2zw7dF)EDhhA33 zHCI$FXw7;oLI~j|3`>Iwk;DeN#RUx

  • jgQEDssqGE`}kZ*n9Xpui!Mp*r7V_%gdZ8+-gbbxzIa&*@5a zSHSHfzI~ccdF|}%P80As#p7(txVM(rhfwv^)K8Lm&8c%F+nH8X!)j)S0mID9T)N%9 zqo^WP&~=u#Z`oweZNEW5LGy?iD`Jij4cj*ggBh|M%dbgI+^xyToDB6G&t0EdoXCRO zIlG}P6VOBAs$7Xv%gZ?nMYKIrflVl#{2AHhxc~c3bzIu8Hti{<*h`y>gfCUw}bclP=cg_nxWSDxZQb1rLU zGg7T0?!EX2Y#&?P>sPTng@pR3=6r*aD>?go4E|t3_YJP1P&unQcES%ysYfES=-8Hf zUc5iJw)oc`DltW3`k#q0goK6l{;noXfFdhiSDl{vs9Y}S0n@Vc`|sa(B#4-ajNpv$ z=&F2IqACmz*Su{Wd3g>nF~cg`l;yfT8cdl?fxb;J20$WU!7-PoSq9+kb1DI#VnNk{Wsi7!rd z)g-sAb8kS>uu@Crv+x@#PjR<%UmCR&DMxlmYaPjkjdyUkcc0B2EC7)Sy;TQcfl%hR z!h%OJ{crqAAjS)=1j1~7v^L~;Cw)94=h8r}89#sV+Payse&Db$Ay}0}0AK}arufBZwX+&ntwAa+nudZ?U$E$2?T56I)cO=SJ zZiHD|TG_z19>n?wn|j_)^d{|=ywWl>Oq>f1Av~~5_20TdCW)D;k0K%7c~n(kh8;Mg zmVA9IDx2_cEr21IH@$=1P5RSJxgul9nNN=Si_BDzr}uiNPcbp@u{!aE)%eFlJKop0 z=-x!^Z!gOo4@&sebgg3h3Wu_8Rg7{2vOx{m5Nns&gOB9>c3aF*MIzI+0+Fy0_o0HO zE-;2r3;Won4o-#lVz+{APge0Iwut#94{3Gi?t2+hB&87YdO?%ScEC%l--uPO2jP{+ z$)0F=jy8OwEVxb%Rk=C5-l%5(xJ+nr7gj%`Gv&@1#-3Y+g@uEqHc8IUE(_7tshVI$ zepRsT&5=c|SlBc+HN`9#eA!&>K@fxlY{S*=^#q;PIR4X@IJd*Pl@X73%fk@fCrm6! z_(kDug(f;h{%GmwDBEWM@I~k!LVR^`8Q#5tGo+>7JB7Tw0OeuOdPP>DL-xYHeNp8BLOV6BP|_)f&8jqS9c^%j%2Z{K=k z){7T3j3Vw?zZW@K4YG-f!j$Q7TxBsEz8cYfYT0yPz`oo?=0vTxyHF#82pY0kZs0DJv%E}Hl6!5Dmfv(?;UvedfkyIy_rp@>2x02eqw zs&<{Bm*%kAHC>wz+ZrzJ?!5Rz*tJ0lx!SefLMn-(a-a{M&FLKgus6C z#~zxJMm#*S7j@{sa8FMzWxpiRYLS*xViH{p*BQ8P)Gj8+P~bITn@?wiqM8!y1ZYJ7X1M2%piCUf0-2p{ISZXY4FPMhn99n^f`i~tz1ox- znf2)fjSB*S&runI$joNyKaa{&ep3U|Pf#5y$>RBW)SPJ7muC~azP=ulmc|!H7W$#u z7^;#B&hq@OVu82Q)(e>-*tN$pH|gv4rHxfcN-dz}D>@Ca&LRBe6GR;fjKp@hlN*yG zb&PtM53B?mbx-C2NrPoXy~+c$s@h|T8#Pe~$eG!09>@Jgxr|xzOb!G=NloBVwJT`$OJ4Re z-#OOaOfXWD6w6dbVk#?V%LvwJuP=zm%W7TT-pf@SZnNs~urb4GESgo%QAY!`#(6pG zi7I=_4Iy<(Y6M4XsWUH>;u_RncBV?@e~}5F{q(+m_ki?>S@hAp+(@m(wd0)z+3iCz z3XfI3Kh9jF(>~mg`c9&JckI<{>MXaAit)XhNRp zY*{Sy*1~LTpYEa;TQTiWvC|{#&-n698~k+gxfIRhm|#eZ zcH#)z+)Q~jPIh*k$WkQ9baSy=Hjw5ixXa#_h5q6cXD40);(Mwu9`fJJHji5a4&AGU zO>Ah~+lh>mKI8*6OWSlDIkrx&KJx^8^NR90OIz>gl$ZiQbTPy2 z5Y%rj5QZM6y4~7j#N#t|HV5BMcg3}ryme6)qdxFaS^dZTy&GvK;W8C}bqfwNnC*dS z2>8&kJWn?FR>reO!SXN5t!JG`PDw$GY<4JjDacvrp3gtjvK(fEJT&+Xk|52qvnv4- zB6$dS*=LL{aI?=u>uIPw?T?KC3D07)M zEHJLp1#>{i+grhpc#QEf#I+B{pwG1Jac|5+H!{B+GX-MO^`*fQwG{F4-j%?^{X!PT z9u0)#{462H4zla5#kk83BU?!}MbfpHxCKMFk12ILfNTHt;vDTOkcdf6wq=BlLPb~0 z^||L|-VJ*~Tl*uyLHyVYCduVXh795?05XXqq?9fAiyK#rULs@kev1mY-E4k~YQ|uQ0 zt>yZSC1yB#pH}Db!z!x-nl*x^(QTD~dfKuLjAi0lzrbLr7Y21d9E^)$h3zZk%0b`= zW1!;0^r@M7!`aHl?&5v~oasA`Ob;0`pYn)tW_|HZfhYNiKwba_dDRXTnKc!{2z*F9 zKWPqtJ8i(38w=Yz+xlu~&(5ZilYJG4x>>=VXF-i*6}_Yu-g`XwyvZSCbI+P+LUb*IK;fe{i#n`DRgLqsk(<-CPJu*9p~oq~oeeqohU1#W1*PY74qXd4wSf8LDGVHb>|pLHsrIWnYHZTTTA(; zk|zobh2wIqrGQnt7YU%nRlN$Cr2F_n6D9CVXrrQVeyfs!jfFOZ_$jZC=j?{cVv_|t zx!*oY@f=lE)n~;Wo!z*dmtcFK>hyelR~t`(*Eo|92X@DcmHQKfw2AzaD5XLn5u$Rp zYgLuy;6f2~2Jai4F9(H-e;RfcHu=#^FwyZ%Z%^#d=$@yJZp(BW5uYC@$?q#1;iTl; zJwq!#zqOs0d~ov>p*#I?1nO}lCMl`f?dP&~$U?Gr3sV!l4Z*@wd`3S%=_;R$Ss)Ed zUzbc#PZ#!eEQHT4_4RDQ_URAG&W`q%K=GVmji=vBqD1uC-cl^jkjiSd^a(fzQb@OM z52ZMz$cfXDr4vMalMfJO(~!pRrfyPT;?o=%mle`@_j^j!R!m2fon=ipsHh0v<`4AV zKzTnZJ^gbeAvZT0>P~s8=W<5bXRffb(~EfkmU7i`mS|*yjEQ?>>U6E#t)?!p5n)Fa8HfNXZqAR4lv*1U3UF}^;!6AAkO2L_rKM`K zMFC(RSyt430}(HDhKwhB80kZLi6y=xlgYi!GY?ZwzMWb?44PP)AjlB zjiCekjB(*#F-YBxW5U~#x9kcKd_(2_QCmhke0BC}Nq$nkjpIt{0pMwbSRM(tFY5X> zj<*tUsLA`m?d#l7`b}|td>hFSRX25Ayts6t!)A2f+l!&+9jY`nZKs;$+~$i_r^y@# z%g(DE0IwQTCo8IcgXmDF-&&SRhkjqZ{jc?`^NdKHjfF{YQM-IxvM z)lpaft!-f>-^hy(ngr}e+-be~4Nr;w0DxiqL}Hn3o_qwa3&Q#8*4XFwM;5ns#{=ov zQz^0HmwK%-05mPFEf;{Mmj+@u1iRZ8En>cH;^N_vUs{X44Sf^bF5l3+A4pbrcMpdn zjrud4{!{J&NpUfBb&cJ~`mr8*S0G|oUDNdED zo~^P@i+=K?%JMyG>WsrkwH8RW0k8Y+yF>4}r`CW>h89DYxcE-2K8P8LH_d`yvIXkQ zmZDdoI z96N>r>@ql1(lHeJAy9lIud}b5Tn-F{VGn6E_a5K*9pWL|?OKnRc}6amBJ_2?{f8=P zhZN5E@>OA8(|UQyJc>_oGtmNjGvD$uGskYBhh6(t$M@~-olj^Vu8bZuDGf!QVez{= zJ}w^$G!7>$Vxd^~bWh&>BU%^IUSt(d=G=>fi8g3pgzuqi{_>^kGj%A6-v!qv?8^r* zZw_p3B>({`z?bGpA!*K0v<|tLmAXu>HlEXReeuhb8i|}RK!xmtIAtA-cEYLVyovqHRr?rt;o6<9xQ(@Zr>jeDiTum+^Ux*#RVz9_U+Jmz2}r4006l}0ph+L} zxl3!eZx1fKdwfUk!nt$5%3z<-BMiVet$&*be5_k&m|s)lLqSP=m1_N<-HbP>mNryW zipPXW*uGmuWRusWW44>EbYm|K(&K_p&*W26Hw71B&bt)puC;%J_(f;#Uow^s?DDXhmJ+OxvS{0^x?KI$XEexb#`A@RaK?ruF=1wWkpDvJ`82pI)#*- z>&*=u^&=gjKXazPgPk3cNWDHOV7@pbsu2sbJLk28reFR{VHyp+a}tHA)d9O_BjzM| zGwhjob$_4@PQKPrbJ@4d^A>8}cNZnUv7r?a&7~J<>a}A~yS7%64ciz(k&SNbXiSHd zmc4yVII|3j5ue{)@wmdLrdDx(^em2By{ju8otrC-ZfLj**KqBcgpsM~CjMQs5eq^x z*kmkQDKD119iy5Ws;g{Y1Jw}eO^0E;I~YfWv^%nrCm1R*7@LFLY4({gCJ9Y|wz&C= zxE0rHbQ%OsP`$$kd`s~4j()b8Vuqek`%pkI%_8h{ER&GOs85O%vhSSH?!lV5*$<9m zg=LNyhjdfVRRnWC8PmNDVmXD27nwJPOVsjAYpb)xv6o0_MG%@&4C-bY*(YBozb|Q- z_+x4+LdYBU2+&(~Rn@qyHjso=NFRQIo=4`{Tdbm4Pma}3%^B!{WDwtR;GGX55W~tx z#WrC{3)6Pe)1awxI$US3-Jds7lt{4(#Z*`4C1Q4l{{=_tKs%)yzPWX=5Pbl=33>Yy zCBv2Z`AZ-T0fmV6Oj&q%`0WL?spaIk;c;+$=8XiyBB$Dl1U4CTZO9nQ$l-B7sj@ zo5tE6>~`doISiJ+UUc~@atXM0{F|bN|Bteozpm^ZedD(!Gy!%4Fkmbilth@-si`xv zax4{gsoMFvDpI@sS#4ajfBkx;dG|N99se(sG8g}Phewt!-&V$GhfTL1S_G#g^By2F zgNGLkwQ~ytuY|H@Yh?Z((%u8CskCbwMICiS#Ie&ErFW$lDT;LIy^BZ704mM{fMm% zDH;naD7U&izdFZcYU=3aV> zMRdg092YR0dK$sp=ds4uY^xntG<)dk|(n`(g)qzRgUXcv~bKXwhkI+jgV!>Ut zRQ|hYH#|@NknPu0e^K48H^sGx`Xa>Y(QF9Q{#-Zijly7CejgrHHHKwuL|-y&X7#QAOG8YOp_A+@0^^W zETbq-5PKx~-j&+eYn`H{qZG#};9s<+u6g8GgUo3EVxg63dBtmJHwNgIN3XQ40KOg< zRRo|*06rX6KNk0P1vL+av>s&vg`D{B3OQXRSyA2hamKZ!!-ew`utoKXH$h*v*Tv{r zL6`)9sn*)@E;6%wXGx~;#*eSw6zA8-D=Br87WxPUIi3h57T@il6z8myI=tr|N?} zWiS7eGoyrEdJPy)7M3q!ArZ4$U-@D_x+(%R`j*};l4-?7t$zg;r7RL8q3Qm6Zf@G~ z-~g*-WlL_s!js?g&MMrH%O_&4hhW)n(b8Idy)2o`Vs(dw%cxp!tP-yQLYCdhVk{mW zLdHNEo-WU!Z}{E@ z6hQC`dg}p=S-^4fEbYUewE&}MB1XbV$?P(Uj32w695n%h-Dny6_A4WoLA4&Wp#2cI zzmVm{h!tpK1^e^~f6|JUGtNd47?D1e}WGRpny69+Mo9~l)uq&rQ8cFbl|dM+k0 zzPRnGs=%fpigb93FB`t|al1EKv3?nyBYu=Sfl}-j!~3U!kOTFGWFYx4z@C)4K^@~)CNS^PU@ z_s-zw=tE6_OSbc0jk(wZ_+3!bmzO>OJ5zABv%qe^7Z{2*65@Q)<(Bn@# zl8V5~{u|!jD>s2%mDam8TriP_F@@>^$GqiZm*oJ_iT*xv>0OZA@^REIynB0Vi_5h* zEU^-Y!c6J_a=*<(At6;Wvl$`=0Z8(M_Ku$Rp5pWg?4MMc%M)VY4MY+FkudOM{-VJ1 zuf{D#AnK27IL)P*3U-?Qbhj&M4-Ke92`%6#-Mn!l2ZVX7_xU0cZ42<)Jr1EJ$iTn2 z0I2|vU}8BL{bi*yf$v?42Rqwn1qN49@p!9!%PT1~IF10l5(D_i6(C69_p{Hc#TSd? zx1U5C59CM|g|CgRgz&^sxBxIKSXDj-*pkM|weD-$;KW?3t*u4+)n+7KiH!$n`Fi~l z`O#LPNH!K=Hvr{GWvfC=)o(t`yfY7|xeS`wAS0*l8$2^317+Q(3*gc>i_qk0?pk1^Dh+9OM3D7ewP8JsC@|@XH-4rx5G-BP+KjMdZFebM)e9w>sGzJB+sG@+2 zUHT`LMnq(%%k$3wKhKU>A2^@_Tg@1y0(1Q2IY90?Un|Q2y#?G;^A_>v{DLsVUzC{^ zej;UN3zCbaL#^$66mx8-bUZ2i3TKxFD$qb;@kk|9sr}8; zAmM}ucNp^d)hlHXk$k`22>l46Zy^sE04*p4P{ab24c$bC#(xEb5$y@I`*3gio1t`R zYV*U6=BZ^+w_QguZ?AdkpJc0$hgHH0M+L3o!ZHa7OVm<;XGF|&hy~bsDwk2gMC}gl z=Z9z*k<-1>FQ64oPsQS~`^EHZac;fh7I70nr0tCAfH%s&d29waOywGyDv;yXGQ==? zRP=v%2BUtviF~^Zn&nTetgOWOZ3_0sN2EbK7F+i+-?HaO4`{{a;b#E5TCb)5*aGr2 zidyNC5zNX|9K4&klm1KRWS%@xgaM*d#ZSp8+ru|kU`#~t+Cfy_Qpepcy(>VkdBL*)+_Yj(G26aChsl>gXAd9OqQqo0SmJ*MT zon2iA-)>~OYBowZyF2%{Cd^d%A}x3qsHrBVJ})+GTELL7!p@nqT_eSHow znz{8q%H}(7m(r4HXM-@y|6Sck!2mX^4h+zvtMFiS-e6Fleyg4(Jyy@L)2wKERxoBYRPeNmguW@URYSN0RRsclMto9 zoWg{B-vhEjbSO{6ruzESFMUw(o{zEtW}mVN1=cZ0xWVav(WKGLduQ zfolm!S|NOm<_j*I0sLlH#?6n{e7uK;zVA-mr+QRrGoV;LO^M|DM?4bY5pfADWm5kGtE*N;7qw`mak;}<>fEFd+XYZL}+GTPy~((k)C9O z|MqPTTZMmCigB4a*fj-aAfILuAbZmLACB_7xAuPa1{hQ5$W&t#9CV8VhO*B0gj>kE zR5|rY|5a^}0RgZu73FBTWNgcLnxUg0U}FG*4eUn&yJ<-1+GPFIc2yvN`#_YpC`s3_ zY-K2KEG(9A;Nq34u242=N3>f2I$HECvvu&{Pf_t7pXytD)yk!=&>vp~;?3$@*8EME zX#HA9zKL>bC)5-r-VMDCGOv0=cvLh^{8Nzn19wch`vCi}Z2>9}kGPkT4oH7h2V?Fl zgL1B8k*{PQg5wUjZAB?wi_IFqey-jZ{?}}cPg8vbm`U!+^zLRNuWCBFhsQ-`N&KN# z-o)kXI~*WSC&_CoHrhoN1|$T_o~IAx7AT@J(5}5oYJ4yd9GhKjh*9(M9u}Adu)Q_5 z;to(ON7^7t8%DYNzHemt^{xT zEPO4CCDl^}_!+U4z*ehv{|6x>yR@KyM$>ox+XKz-fU9-p$gym!Q7K*xWk+cz9v zvy(UrB6!qcI^4Ny>V}}luHfvSG$lr4dTKG-Zei7u?X0w_^~S8@b}M~UnL**76eWY* z$%Ct4xf*)$A7id-I+V%?p0`rQo|Ib$Li>MNk)8m8|Z!?&Z3}^jHUyS zmF)K=j2eJi_zU&Rz2C5zR5@g_H7vw6I6GAz+TY?Nzg_!aOeWRP2DmjV;GI_=Iu(Q5 zTYZ3KzOwB0#jYp81#IE7hljokcebiNos@e_ZM=;2XlQM;%Jas<>}y(R=K__lG~XNx zkUo1iTl&l6xEN)5?h;1o^~vwq*RC5}e_ZzVMfAJGD>aF~TpxJQ((-lW+1#XkO>R}6 zHCANzssaOTSFRpkoRI|nPT7)Iw~POhkc?*wkGLsxC0e)n$fTNZ`(U+qYPhH=D1yvW zvX*g9prRaeVy>tZT;bYg@c<)wQui*efJS_Il7xii4n|&x=$8NEO0vz%BM1H8Co8)q z2v@6cUoQ7(o0+AP>(KUt?voz{9S&K&eY@a|S5+N@$nz1^@i77Hmi95DwrWa%vr|0+|=Pz%>AMXc)4D1_~Xxh(;jw6dj4c-ddl{Ro7 znON*wb5v6^c%V3kFj_HL5DMvUlJwOWtHQ@HqWG&;s!j+~=q;D3Cz!^K{jtqGw9ta- z)`zV9+4yxBW-iJ?A6x6#c-+%?ER|Sg7gFT4gXyvP{MrjH=~!83QVc>*wDp0E$_Wn@ zK>LO`MjOEEdgD)1OB1n#LOhOalQx`Q~dCV@ckKHigDS<{AOtdi3shfn;D zBLIJIH82anqQZV*)P|HE5*!_LU$0*ZvY(UI4zioObfbkpX~}1gz3I2DK9wGGaFwPa z?8v`yGHk1X{d#H8uoh-e5w_SRuGx6F;Aqz>F;b#HZ#Tk-oNM6JyRW*G;u6xmt4mt@MROI)ncB0kf7h_Ocbl_F*lCmt}&wb?>(B_AHq!b zcL|yDAm{4w)Q1RbwMW8Ln_e7F<4B}rr)z>!ol#9z4j0|^nBH6887Mr^T=t}hX#HTN$&ng z6=-IS9c;tadYq(rpCd^!I^D+N&wT{zEaRNmt1+x_S)yATM;U4|tM+qM`7(R^&c1zV z&~O+Hl1J9V8c}Y9rvAi^g?`YFB@MLB;8b8|=j=T>9zH_v?2iqqO;H$oq_tWOgI>;$ z8-Ff1-u&={QNgfky*EYtfZzT5$7Q&OPGe3>;QCfb2r25>=kevAJUk5rv|=7|t>@2s zd2hE)Y1`Tc6IUANy)AcA1SxJ*=ISbhA(m1O-bnaOuz=VzlLBZS62I0EO0COQoMRqe zY(_z4C?X3wU17HKtxl9~u!Lg1ewYJHVqt~;IRV>f-{XlSo zGXoc0FgHN0Oe`BgAcouSj~=CTi&?#z^n_@;t~bY<3`_bSm-lTbLG{h@Yqr}v7Mz4L z<_LJ`Gs%YSO>0k$`0q(}Tv4@0q&rC;F8ng7C6uzz(SL6B9H@9-!l^XlbduOI;jsJCr--NV`>ge}`kkix+gDGV z^0~IZVO9oSozs2*iO?-fxo|)M{D)}MU<|d#q?2d_QpG2+5pTY>=0{h~sbqhYG?t2` zGvlZN_z7tUDPh%A(&{qVS{Jy*4ONN4dY|3Z&lmCHi;%duZQ9xX=DC+Pb_*XL6_$q? z`!zO_o|ir+gi#s^{hE9=aK9+FU@5bzqN3tVkE*g#-@7|0Id@EbMMQVoIUHAp4dYi) z7+vfzcf<3(NN<{8053Inh83|&E{e8!hBf>MlEht<^nILdgI%0(sA7iNWn}k!%m7UR z8|_=b-cQs;Oz;gvSJTP*Zw#3v>OEipNjbf3%937!+FE z)#%@7iZ9ypc}gGk-Y?qGEuyP*YcU0Bdb}xAIR|7c;;Nus@MO^W%Zs>im+t=2%S#;M z4C3p4w4okTN43W|j+61FjlqhW^*ik+UprY=Yb4BvL#wx9V>4qD<1+*ITb9Q^=N(H& z!1VKT(j`EG?ezSd(++J>e=4l(`PffuH@8&CReFj3r3X#-wTz4qd3n-(HHMDHML=$o zk4Wq2#M%2U^mn*|zo5t+d7<}`aiQ@+1IT{PR!f?WZLF()j4>+bXAW=`4$EUL56eHe z6d~eVfp4wi@jKsLaq+BQN_6K^CQF2s(@dgLypiQ)HE#k+$PE-lU+tosNmI$u1c_$8 zY6O@W!S=u^F|?D+V(G>ONu>D^&#C=>yJg9Opl z0uh6a%~jIfUyVc$zV89SUy=;{yUe2~nS#?%f3@m@r}y~nSRNhXtmcaB9US_CZx!1# z2V-JVqKXV1k3)-U9TFa<%q1yi%}Zjkm}LCuIM~?Bg6L?42bZufh;ml=b{5kPNtSYA zWnN{a%K7tqm0qdE${bTB1CE8D=%(R_qOD@^ZSExc^6oNDO4$=UYGsw0-)r-Ua>_$> zk8%IZv!Bxh?Z-1fpDul#Bf_l&OOM>8;liiP(DB|N%#^Vbo{10cG|e3wL-<^;4RIZ8nLxh`I1zQtp`xU2|4M`~9`Ab6Cf zpuzu%lAW^qD9Y{}|6uXk=-9Pc7=zfo5_PCD`>!wX$6-n;Z56Jt63N)W+P4os_0rNa0_7rRHypP#8o`fpoR{^)WN zE})m#d<%!e4+;fVLvfWGsV8NR)78ESE;&LlWfnrq*j0xCzg<5iNuL!;BJr9)xZ=H> zj>m9=18FhV%`7bz+7Edw-}VgWm+_F zY(Oaj{yFU*ix>i#W;(Te|M?-jIZqqE;v?zFDJn=N-BDyx5W<6&8n9A{#muR@xPbPRq;p&4=8=uHthS^R%d0tXKF__YkrX zbZ$>E^1~2*&=|^RcReB;dIEGZ=ufNx48ErWAmUnx$&46l%4TGv__cj*N+|=pDQXW^nH1^Wj?GQ$J9h2 zJdbQ>cm({9!TGiuphArh`)_2n11((MxU6_Wzp3d52SgkKOw%r9+6%bO_#U5ScQ5F4 zvL#WBU;e%U_7>E1_f=8NV&2C+G}?P;NN8jcY=gi;9o08}p+KVG*1CHpG6<`ZYWDVi zt`4h!Z;W=6bG4%gWap5BfRpDp+}7FNd!?iJk8_ahb3}**+YiOg-VS!XFteJ=Xc-eb z&+4!5>p&?U5DvU5GsU7qD_XE1f2?G3_N_eJs zy{V`#!ob6KCj^E7rBbt}NU}~24xzvtmP|eR-nG9Pteg3WZ^lUvh`OBpjZDc{Gm6TT zi_V~f_$u(~Lc^5@28n_V>=)9D(xktypTb8Tzk|(2gjaev*`$nz02lol|vaLXh48b@g3-`7x zAsxeOmH4I<+m)4=sDx{Lc=y_c`(y%w{42)?bil|e@f%*zFw)9ZHTEGqn3#G|AK2j3 zvs3|!vRa#F+pI*?iu*C4l)4i$m#h>7$^br&&%n$L8Dowy^)3% z1yF)w_?FIhO*3=Dnq|JvN3V~8a(lZORkY+maoqI}*S*TSKRQsK?D23s7i`)e!vg-| z74!~z%yr6ds=p`2n}`oY4PFCbQt7DyS`Xhx@tg+POiGf4RiMLU$|}K=->RF^`^RS= z5cvHmao|z&{e;<%l_t2BTYyW(oTGJnPr$O%TA>wR{L0P)7~<&Qsx|O``iir&Ee#7_g5pb>_&UV~kB8a}3 zajvQG-OJf-3OebDeDgATgQ^~vy{fG*f_3-*{kOsPD$J9n=xhMMfbsy?;kr94?}@Po zzU>k7DQ$Q6IL78Hs_Z~10B1ey?mHb|U;y_oYrXM=K`#oIBm) z_CLEo3I@t7jI=bKG^Nf%2ns7BPW$V%tJ}+Ss?AAv$bJdRYJ38socTRn_^qWLbsGis zadV8nZGy&tM#db`ATn(r(4s0U6jw${jz;DrHQkg8$>|C}DbxB);H>X0i+~9NtC%C` zILZv{JJ|Me1T;_FXJ@pi++x)o6dUXi6!L4SShjZz#<<%Z9nf2EEdqA@in0B8h1dP7 zuevt8i@P&m6z!mDLLyrmP z)ul{R@uuPnF1{rYAZb1zD-e3BN857ytvyhkrIcE!(NTRW$p($o{lOvc%@6oh(8c(J z2um~diC>!=#_w^&@y}YgR||huR#poQJ)dO-aXNwNa`60hIB3*~08vAYkUKoEv9)l+ z#1}Qj`l}W+4(pa7CluQ!W&NNgJK3&{n9Y2>e!dwJWL9}N{veKUXh~`D(V+Z zg~KyKxJ6AHefJ-PQHtBDp^kAK9+16FRRAkZ2})KvhpyKwsZ2mmbf3SLJAi%Lipt&M z5tgG&*jdUgsCdHH^KrP9vdxSlu)kkJTT3skyc?b=Cg~Ak^0TR!@XlwQW_xZp{)uU( zNwJ*j!(%@#lR8%BLr|Yk(__l5)_-RJw8pbgvTr@EoFz#3z#o{y{f`GD_8 zaw(-;s^@rx1ukg6SvonC3*Z2-W3@p2D+UlNnRIU);OlqWvxr}AYo*um_n(XewBMwW z>jwh>PyXj675cwPx4go_2pKEYaDuLjAAjvJ4>zv2dzrdqVQH}(xPSrm zcv8c<>yP&pK|-Cuty>m(d7=estS`i@{t*8hVd40?EkQ6<(!9!=FfF&`lDMfKBDZeO zLuL^h;4?5FMe>Ed&UVtD^1p8**V*UizzoQjo+~$vVKjyw3BVuttvsU(%$?ga5)!If z{(P~KtLeVoE>g+gKP3*jh_i)g&Ih_=^kh6Yqbpownk8G|98P zy6bPI265SPcAX2u;AD;O?0S}9d_GrfkNh6XU2fGg*yF$Xp0h(kd&q2UvRsuChhyjB z&{24){?zHIDgd+wgy;_84aX=R9Ds%Lii))JdvY=|9>>PsZ2g6yx!h^S_h=95p97NH zmY)rog;8l|Kgg78n{guZbhyW?3{N{b?9#Ngwd)7TfH4Wl$OvV)Q|IR=z|g(CJC5WT zcgZ0h%;O_%xTpnet$|117a7Od;HpLl-1jZ;J}7P-^l+R})2ml9^>1c6k~nz->S;cV z>)kt|T=r2_JQRS($LBjf{3+nKarq<-$llyiq|98aZeBqJBYF|0BvGWqz2`Z;H7CxK zDXYEwp%t1Y^?Pm@wWNlkVlW7v@>)26o8tB+(YED@`HttlFe*P|HUHJOdg z4KBb!B#QvZ%{?~0x5PClDfvU&?_i29JdjmEL)kvr)^_!|t(H#su=I&@s(twy5wi)R z_u}kSp{2xDRq~51^ zy?&RPosCP!#-Rt%%o6+vv>h)Ry8-F-j<*f!4K7g(}%?)9{)9UcQxFEH^cYd`}D zYrP_In(KaHmR43aEul6Fc$@WczG#E;9B{0GvCa=Y{?6zQfT2Fxsb7`;d3?d9=btBd zZ-1Se!pt^@*v*K;Vq#;FwRp6#qvtD(R*VaK@fWKYg6N^`<2m1#Z6%1TA5+0aw3X2E`2tZDb&)M49_Wj(5 z1%L}BE>49a&H|aYQsRyu%?aIhjg7kn!Zp^t#Yf=8fMw1@qjd@;QiFp@wRJRTZiL@d zWxU=87*nn#D;oVBGUuHbckn|jn?|PYdn`la{NFspq)3i5kz=bB4k{i&8uQwR^!!%HLq16t3c zmQO#*e}CG(%OWIqve5yOxC%Q!FN4t~(TLW}g$~KADajL#*w{ES^B`e;PffmA#G5;yBU?A+Y2j^>@+Cq_Uip?9$PndVLRWlIw055AT$!A0H5@*uVguEL<&B|;&ZnN?ie z9$^SdIy1cYi2U!O7K zsNBy1RF_k~dFltJcIPnHf7Fit;|)&egRRu#4ng;tzy<wB)|NJV9`&StJ zuXm}4{&N{WedsCUJU@0s8q`$AsTt*@2aAElaXTv7K1O-?Z@>ETISnXw;hQmx77L4z zP6XSfp~523w8a*0%D}tvV+;z;Xrnv|vAgN$zdquRuPS8!7-CMOyl{a#H1Xa{Q7`sWW z>NHUCLAxz<*{e!Czq!$>SdH(!r=)c5vbGOmn4#MEm`y2WLvaanrQ%?yfABXxNw*#S zOGEY$`@Tgt2zca$9q)w=@an0pXHZnpS@72O)E>&Yce)i-z%?h&DLPtgmC|P^sdOo+ zS5mc)KL>E1Y;#>YPbvb`!`6(G=QjbSwgu;W*G@eVvLK^mj1$_Zy^ZH-ZV_X0=?`BK z8gfeU^{TNoh3fU{wgGKHZzES4((?~z-+@^!wmd+sQM_zSo(nX1JQR$nda|_Nj3(h|C z&b14!=$MpeBoPA({ovLrxw594!HVHZ6XRcI=QKRVV<@SFECLbX7-`1qI>I+$V{^*6 z4)=e1FNRm3++TgPvb>RX;w_sJqm_loZcBu-J1XWW%0+0a@8$ku?ifCte#$iZ+A2G( zuJkvyju6eXiQ;Ez#yI^^^p8Bqjl3~F#x|UD+uBC^oU%G2P2BZwGi~46`x2InKB_rV zJPaCO3mQmp@`N$oijU~eQ03OWPoc*8n;I*H7Au9Cth>r%w>Pic_2aSv8kNsL4P7O~ zITBBQc+%iM!p-}A<7&n5Chf|a9YNDCZXK=Ry6StZV8WcyKOfM^2R7Yxw1w9pZ4?S2 z@N8$&;K9j7@X$OR{7edL3f0|#9+NR<6pG3{YKjKveqP?#sMx}oitV?MQ`_g<3`_Cf zH?fnVwT*3LagDyeY5rlu?LEIjMTMT;3X#j#^TuxR&bija^iw*_DJ#cXzy}KU#-wFSAGmjfKCyGTHOFi_JbH)G=#-$M`1Q2t z5oYqOUbGh&q(OCAEY33-d3@RC? zf39c3r)5!q=3@g{*{1;-K8ZXtXznVO8LCgnZ;7zHj-pzHW5HCcp9C13EyP~k|E0|r z6sB%7$@kQssvh&}3P@VCNE-M&c+HfjH5?kj%dHsdM(JYj1B;vYlu_Q@xYE zJETkhp*uF5GGAoLIB9V8e?E`sE&ZbdSK!daeBC@`!?2*0?7d4EE?Q$YB=3wUi7Yq? zF#`+WwXDnP#X_hWv3SUTFJbl5q2~az*ti5QBOp4GsEiyUZu>dc+?y%E8YC`2Y}5@Q z<(s4-H;U>VTXkxT9Kd3*GH}R|=kQ&k{rlc|hWN*fOXz2_nL^49sHg_9E^x&KOzNcqi$_Qe5l4wh=+s50qY^3r?{mU6erpy*bEENe&c|ao<6{xHl zXVHckM>yRVer-&&JO8?Vzjj(({0<_oW|vig#iu# zIMomkSfNSdQ4Xit?@2#7ts7_CyE!6@vt$xPMA|#MwPoFlcwL-j(Oe`H*THBrHr3hL z>2D>2Ab459TZrSy55Fvn7wlp@rZ{~OXJML4#7biSy*_<9JzU|ogsAs$>eV4260-LV z1cU}V5@8uNcQ_Su*S}I)+0KUYMGrEOBzclGMUpY3Q>8zX8k6*u6m*V>Rl?F4th-)i<*y+#U zaj*TA3Jb6889YUy;G0zmq(8aNpSyM*%k{2FL-++7ji80>Y|yG`Qk)TYkP)}EL&V); zOe9P5UB^6Wq)lKyU$SDC6Dva#n`7|ZrU#uK#9VEu$B%(-s^J2mqm8N}ZbXPYT=|LXylwH}*K~j0mC9LkXk)?s+d|y9L(oIEKn)F=P0uS? z2$2}rqMB^Bw0;e@#e#55!km_SxF#+^<#jCh%mB07Wt^xdWCF5e0&--ij~aqIZBYcdogS2hoqa7v=QDjW{vWT4wqh_n#q=5(U}l_f*tPwnaiigTLu0Wg_Di zOAO%mHU$!GxAaMaI$s!}Fv9&yit!z42HDaH`YIML#A2crv~*NjbyXUaM!^&;iNwS% z!CK9~-G}vpx)dZNC|QK;fSR#G_Z%{ZRYaGz$~qxEZ3ZL*Cq{glUikmTKIrQT$5I%Qo9>PyNiCi3z!N8U$A$6 z-#dL+C}gv3^0G=z!rV}{dHL$Kjmld*b)4z&cUcSUoLs6JK_mfBm>9kmfwyp&9%k~E zxy0&f6^ws*zHsX%8y6qPC0YyNP>W4VZ&t@WMN`C!++wLVCSf6Ftm(Eb zxaqU|Pu+fD9(sFaC`jyVw5_y;+t>8WyGT*H+#)`HHoKieki#QhHMF{Gj!zfAhf=bw z99nM(9GFpqH>srzsHJykly+!Db!bHyw!hS4ccNx@(rCZXgxdl`B(B99#Xk(0+TnsB%DEd}_dX;pR8ECd8UsHP zc{ig4U6Ob8ofe7(k$3cHi1tbwzZ|;hb2%s5a+T}$GkLkIfsAf%*%#(Tv~_UmURiQk znGf4}oY^=q$k3-b4^7-viMm1@l^96HKx?KzFhjCiTdS&JZ`^mi|Ki&n+^+&<)T1#& z?`@FHF$Q1acFr@lMVbjO2yn*MWGP1Q51ZS>U^HGSwYwet~0cvziEAvETc}1?kYnBg1x_TxNn_oio}t}hPy+)#M}%^h{^c!Jg1*8 zNwLHA8}7v_Ke&~Os{epm2%EsWENL?vNNsw=VW9g3GL)<=x;DL(6FI?KA@=*)I+?cO z1J1A=MNJJ(W#tF_E#_>k7HnfStX*c;vVS4@^!sV8eE+HQWm2G+v&Ih}FWkJz#?mOI zU$Y0yy=&wo0mjWEmw@y0Xhuz5nSjbGmH;wK)gi*;59gI608zrpcC+HeOcIvghL472gS4>%?hTKb&cGHuVcSHmz zw*XC}Z)G>{U)g&qJ$A1Dz@FURI-2|~4JkZl(dw;xNAHfijZba5q!PQUz9@q>JlVlU z79L}!r|71)NpT?+G%s7eDCq|(o&5K@Pts8~h#gGZE}#)1nu~4iT^Jc%)A+C5V5^D7 zj};!yYAoD|XU}O}0*Zq)1`9@AQyFgRqfX%m=XP7@$hs#XiuBIpje+Aac+9E{y z;4w_HAN7Ui^Ln7FUjK|*E2e{sd;xuhOFm?I_Nh{|24|KiWBlEX4`2@TPMZhY*GVsE z`TUHevdtgTGR+6t7g%h`Rh|iDTcomRaT1b1yVe$hXbGg&IV4zH%_#d2reOgLFjs(j zfo*al+XlJlq=zrww3%Q}UCC?WRaP3l|2;@$huNH?jo^Lx7fyR4Om@WZfwtakf0E09 zz|uI`!Y$ED>Ocs6V#{Q@S4dFc5fs}tOT1Z0CQ~qX;(zeO${^16O`HiS<-TFG^jv-R zZ3~4Z3po4B8yUZlNICxF`TNxjGu=2$!x9_|3hx3p%}FCaUm^pz$K?32%%+1Kd02mW zncIvuCfv#Dk4LtMdY_e7f430Yn$xuksH%6=OD19xzD^@1so#f5I5497sv!(jeQq7c zhMnlQMHY%t-MvW6@nFHOE(&MPr|G&lYC|R7&5;vgKLBnhy!Vz1_e{+@v$;1?n} z@bDU&Cpw3j&`VHz!pU||srD>L`c#10I$JxSvqE^elog}ud>MgBaQ(D$djPCbaMn5V z=UT510EZ^oG!6K}*Vf5M0=|0Inbb_sy?gw5*+>-HKs0lNRi0{M_ta~L8|MZllg|hY z$<6O31V6bxMrps@FtMjpSKlO?N*z2`9MQV60ofG^e4!9`Z7e#gJAkQ!4#7X@L;FE* z^8la~(zXu4)~#}DRJ#v~7n73H+uKY;XrwvGz-N$UMq1eDeoBw!3Ortq4u5+^Ku+{* zY;R*E)4O{x$>+HecGk%~{V$4LAH`*j+Qez>Jq6Fzb^6fvhID}AC~_G%9a-NG&w6QU z$e{uG1@?UXe8>y^I5_o+mdAXFZ3Lah%f00&2Y}UqZP8MO@Dn>n`&nV^O`Zfz%#>9- ze~?bk?T>>A?{7*zLC(qIpD||cUXn)p7oSa@QK)|t&6scA&1=_M`#6>}e|P_L$P>;z zxY*-d_zHt)i4daw16@~AV)jeTI%nbQ)zQSyczHdlqDI-fb!m{f(e=J{Zqzj5?gx3> zaCxq4(gJ2Sx@z7m&Ap?Paf{iBn>)$BgSsMYr+Z#HDcV46;%1y!1;iQBMa@}Ml{A1) zlB5UBe0P&q;Pmi2tb|565XHqOHb$BZDLcSliywF(t;IS>_fd#y^k`GJwaqxlp zNQ?2R-J21$ER%G(Hms7Jetof(+XY59qw>{BD)I0gGVPU*|U~E9ja;DXFj|W`mvK^n8RmQm2vvJ1ta^U(X=S_Si||3#US%nT^~? zZ+cpV*t2E41n#>lF4R?tP6BlPP~kguq5`4~H2n%!@+0yZ7T<#}?9+||Z*8osHxmFz z3!D}e>Wl97x+;&-dCOho(6_+wNEkka>e)K*qWsJg1smym!@K-Zf-)I1Qg0qOS!*2r z#xxdHeOIx*==ru=0aPb~I?#+DYPtQZ5-hZvpDBNvYBGGO&f-$ zFFfK<)cbz!N?r+b*VDdvK8@Jewa7QW6KPYS0q+s;l5K~O^eguLErQZ+*Q966_W}YQ zl`;Z5ECP!VKNGYA#116ByFF6Yi!)1D7A+0r*u_)FZ5m;rA2(dL2?OwveM7_I@~>_{ zW8rcDes)!-5!BOHP||&*kU-kOuBB(d9U)}#ww9>zo$64ikD?_kY4+4(sI_yA#syz7Jq*s(h9fncn>yWByj$(fkND?gizi$ z@P0Q_tZyBjeiOr~Y3mSbJ&~uQy>>Mh&7R9v-mj&OQ@6b!MqJGM4>Qap{G}nj{VTVn z<)mp}DZYVvgrt`+?%j(U-a|~Bk*+=0Kkka_bVc@Bv=52ByA6~a**^ygY=p}pS^%tr z%{%+V=;|R3VP${Fl>xc6DCxejHG2u#@p|ct9{AqQ^Gi0{ZzIB<{UIyEbL78jNGm@X z6Wk|!#tN=Y_7^>S_9HPv%=x|O<2TPAM_;)1anMQ+c1^s=zfdA^`M^_`Ov5Tqy%SyJ z19{R4hHKm!)=eE}CUY(py>v6V)H~ECkWC-cpTsTr6ioH>PaB~tv}6j@zHyVbQGykePng3Z1537@%PR_vMSqLA{X&?(8^Sgq z(w}^W#Od&~v#w%m&a9%YKFSKTFDrwX?u8TQdn6=H?2Xl0noFE&YfdPENf|I&ZEF$h2GOW2u$yZw}szs%Fw`;(2Wz4Imc&Lr^=9g)K0Y#9P4?H_DwM5lB4 zE1hfgdoGMh1e;u`7JDUm$^jQlV-q8%$Ygkn#3`7l)&J)r<1ke!w~e6D0E@V1Xy~?n zOEmLGUAVinfU8WtlxB_q4-r7I z7B`mqZul=QK>EZPT*Q_B_S;H@QBmu^9wEu~_fszr7dK}si*JB4>l!d}gx{Us&VkL7 z_KB#qH*Tco&sBOg7Hb2%jbRYTUSV~jAAoZOejNm1NVE%7eB#&y2IaP=8gmDBBCxmY z@H}O$bgy4*(@-0`$XW?&?5-6NjF-lmqAvWZzC!y2G16upa+!CZ(yinjyFQF8pYMCF z7)_g+2Z@GmY)ZOfAg8{LTxuL+2k-%tA1UZ8?a5kwg$?Wp<@jjZzp@MhAz z)1Gb9mo-AmTNYp=3=LzS5}}ayrEX1AZrjuTz~s!WeqIsGAl!#xVDF2JrGWnqkx#x`2sh!3Zx?ACc) z;pjHPh~_WBQ*PAXrU*m}rFu*X&K9nsN4+vV+8R>Q1EvP!u41)!k8J&Blg%im6pz=sbzk>wkV=8aD9Bb2*ug_zWRzs9#lS~S zZ}$yf??Vqs)Nej6hp#m8cKuxS4rEf0<^L5q=fQw(xgSagsa+C#4GT3%SD0`^7Y`)o zzPPF$oE$Nh**6vZ$}P#p?Z`^(nJfL;$1+j>QqhA-^dh5v;H|Z>GRBTbGW{~qd_9dN z`3V<5=)9lNdb4m$TqEMxd#7KM)fy+SE#K%@rV?)yomsPlU}Fkf>jw|DoXUn|XBGGQ z+ArIf9``=|y^L>vTlOmDRzlz;B$n>sGhFvQ8*g|_d+S+}PYR)@A_4a~0jQ4#Bvm;y zaLJsmm%Om)?;Onofw27*hB8qhv-w-Gp?{d_pKzHw^78qn_Cx3@Kik|ZyER2(oJhXw ztSS^5x=tEB0a+>O(&BGm=*KWJw*^|aAZ~(it(B$5ZmIAYg>%hJgm~mlsARQStvjA6 zupoTPdmIC@g^H!Jib(s?81u!9+R8$^pJj#rK&&&ead`V?9e|WrSp-p&ofl6+!p{GW8 zK9VK{%@mSPzy@D2G!gGzNv9u)pqaUNEKM_G`!9qe)f6K zASOG!_}RqdoRhwI9fWdp7DFsfN{_ZzF6rB_bx>JQ8&#U3+Y{Opv$FX^=aV#t4Pk9D zja7DG9r4j6FvZoQRld>e$BHg|wDrexw}vqHjwTzaFs0D~HP51jh_-Ui+l6qPsZR3o zK+?bh8YwM=L-s$wd28-Nt+MvQ2U39_g1I2hK|)d)erll0*WE?osR_fKgR~R%Zqgh| zm%VXA#Vdy)skGaJ#Bp0%dp=?5F&=DlxpPsRXtqux@3=q3NH_qFkwM=@$01bNpkzwS zh3G?JSYweRXIob5j}~OLa(kx2XdZtr;`uLau@_@2cSjD@`kA9(p6U`)>(v@2YR>w< zv0b5Q(|XU6pilRfw=Idud|)ePR-yi}Vw?Zwtine1@wKexJvIDc2mDJVZWW4_%jv#~ z)EEt<2Ae5>7VqDRV+rZ^xRcf4wz_w~=q?fMnrXA&{kr110<^LRcNj?^YX`OV5%<#m z4xy8NQIVTEP(7*oqLNc`d^~S|RuPN|T%R=Azke(;aaf6$G#U<0tty{oN^_Co(FzxqmIT>Y}@_FO+bt(<1Sv-VBkH%93YnD5CM|F z?-Tpw4AH#*>rzug>YyBFBQ5dD3b5CTG8f5d`(|$BTzm+iu7DsuAwOMBp<>(!&IJoy zeou3<_X7N)6l~BYQQ{~q9phh}(SaY2pj&`N9BLJn|exJ1BS z{dAr0dnTi$C6M1q{K-`F4r_wLyeD|5b~?;weggxK<;atnq-CSbtc5?W}s(sjZo-CukZqzEiL4Dev-jNKQ zJ)3g)0(L!PcH@?T910mmN%)cAcN{*^+EBV)+EBG@)octOFunpY!BAQzS7ys)Vd34O zciD_$^0gx?l~lwqi4aR9gt52HvJC2Zrbw*zFU3 zG|KyVXsflfQkTKLXT)kk0LzWA0PD0HSzEdmZt3CgMIsZ4WeKvG+-oO}mw|Bl$A1$O z_yP@$qDGzoe&bWd4wtO#Vj=Y(ypGrVPVP`VCI<%Miqof&Y z{hxXXD;e^gUZKsD4N=R4T2MU32eQHr&M4gkIzRPZ0%4LYzds-GW*9`08gK!I2Yn4T zbvDkj`2mbe2T}tHu~S1ox+|!EJ;)uU*nr~t%DWJkL>H2BT4lVEn{w~swTNNam|4E0 zjBL%$F%7b`@R=mM6(R>FjzPYXOcMP9-!%|N*c^5L4^CH-fPQpoVCM|7Bs zL?0IgVn{1X9pz0LPLBjrAXO)JP!P_Ay1e|EZ&ke_bG zg1xPCM;9z0sFE6V(01^rXuM2n>;k8p>8@i>PaUzfW_T<6w!hNhI)?S&);U z-mL&1yl+Uq#7Be^(B~#MwmRV>v5riC>bNUDeWs=l-1vV@@k7|mxNb`+g3dVLA zZZU9#jB6V4T(EQ?e2|A2t%Hwf@H9VvR*9X4rq1}R5*6|M*Vd=}6G#MLjgf33JvpB( zi$02u_dQ}A0`6H~e0x)jxVD-u@3qqqr4_&sEDwCErOqUUrxAd8;m1dORpxDhFb=#| zn6=C(7h_CE?ctj_%7piRPY{Vv(ni@MSBy89$_-1D8p(gfJOWz-JwN@2y(wugjd|z2xce-8kgq zR0=a0baC%Dq$crnY_6Du$>Qbg=Ek>Ga{?BVGV!zc4~g6c-g~=la@@mWd8n-q6Xi(1 zh>auq<&Bv+A1g5wl3P78EVy~Z+yrOWRx@%uH1i>OAbR>Se0j9*@G%@8Zg9!`cFKz5 z9$BPu4dpUx>1^hm+$|mpYD+}f-Mc+e*idvqe<|3Q#mwA{ZoBWq9vnh3_9aW?vvK`+ z=uC}JMYi~=DB{VR+v6T`elI`|5iFya6WJL_>!hXz3%25O!J0HQpMUE&b@&x?aO|dh zUQ<48834@UB+Y-=uN$@AN9_*&abL4JHpdUB4BJ}pJ4`URYrbuE$&Lt z*yhaK)%=w=xOVGAUX?s#>1HdqcPy7f&%5*r@U9zOX9;!@?kUFir56mj^fvfkyUXan zG)pT}QYk}oYCNQj`LfMBkX}pghDX}q`L@(&!;L(ubR!gaR!e2WJW`wmrbs~MHT7F4 zo)UK*81^OY=#AI=S@G1jZ`GC^9p_*HQ2FHS)||?I6m`ALTsEz&s}umI$$BFLf&Ymn zOTe&ZEO^FIxbE01zkh|utVf5xpGax)bOKv{7T{c1UC!2uybs{SjUnbwcL5kU_X4)x zuFsLApb>UkXSuYhNxdhQe~un1O3&K{&TCMd&CsdP0Q2C0lUEy*50WjTQv-alvdO$j zcOc1nw>^06K|1Z9zw$cr`;f(ZQg8Tp_u9oIT($S&6H6OlHjdG^=eKJ7KCrA}HTdPe zMhA2-cmg1QXcTML0#Kx0on}k^tbfj4PTf))Co1@0-p3H=^OrvZ(&j+j-v)jC&G)*E z_a0Vz_ctjdd&UYNK5dVb9hO>NI2Y&-{9fRN`VI=QwlB<}FKjK={7vc*HFmGRBs|Yz z0WQBzZJhk-Ia#oLG&wNn(YD;FhEjwxsq8E@_qC%BcE{j8c3sEc@F6PR$o7;N1GI7? zsuTzYKSF}zKc$tfHg1_`w#Ns12zq{*x3i`fWE8SjxbOXaHm&>(j13BhuO|ld2i_~s z$P$QS=Q};kX6RoUSb=~C!n+tzs{CDdz_4o|3B%d)tGGRq&PB9;*VdTKu` z*ONaJut3OKVWQ_GZrc+A7W9M%5bGDrbBU&1&}dhD;I+&v{JDS9ToF0``zL)5^oQCK zZ~!iu$B`ULP<{?s5#1NIce(QszP93KY@DV?Vey%7inO7r_7|X;Q|CQ z0}i_2Y)IxcohZ|~C1{oyXG{(&n{!jfV?KfR*dnZUN*x6XO(BKLUnjyJqVW=QCZqk# zX63xE2AGY6jIx0$IZ81Ud6z<<^uogk^inuEQee0dF1vtL5q3%KwoZ5x`5FEmjLXrR z4(|lJWJL!b*0z2tm`cEh7Svc<5Sm^VDN~Zf84}jt0mac4MCnB^_gjs9Y!D%H9snuW zkB>UG2pWVRxvG-|kPsm%N|`d#{FPLE(lPr5CsDWmBZO^CqO=tRrREj#k9QYyu+)Sf zXj6hr8klrbi(pb*-P**G_QnluFe6BSHnA=rjB_nldcE<^pickc$*#!W{%j++4&=1j z+??ISv3yX6p}(ToC#1ETbC}o3_hbo`u$>z3FM_Mr(Vjr|C>SdU4tlLU(QB_1K2fTquV+=6rn|Hu_v+x&iU4CG0$V$*U-v#gO>ETyhZ#HfgOX+bG z5mz?V>HfGu%?b2{5We+%N50_T0Kfi;f{p;4#XeK9hmpoZW%Qh zJHgXshmFYS^q8)3aXxg%5=Ge}rJ4L3+~(+SMLuH5hYZD|79A|F3Z?UvIZ(%K&cile>n;*jn-JP__? zo8ixiMf~w5RRIz9&lRXhRL#sOJ-pUwe=o1CdHB@WXWqsd7y0{1P)3DJHm)sT>u{gY z@3@=4S8f^%^y^!Hi7@waZ@JvrFeD6?q2(^k%7~UFG87*;f&*z{{Q?8nLa9P=#@N$8knnKXS11WW4 z2{ZBYJyb-*hrGlmeOGCw$TKJTRA~CY*1|8j>RPHhCe4 zHsD>D4$I)1vEqUWMI}uiBt;>CblScRwY%tCEJ%MHeR<;<1b1w9S5Pi|YCtA$w%cxG zp`(10wpZ{rVSLQJ@nAmboR|R%H}*S&$S%u?1SCG!4D`bTom7zr)Zcph18JQw}@fJUYxijtyU@MC2E9H_0pt0)cW$aM+`!JP^xUWua$v zvUs|YvM+X47GRiYR(Kx@H10fS)|+s`F`l4u^HhWW`r;SHM@C7;%!X}qO&;i^Un$dj zH7s8?=XVr8;yK>>ZINTSr+K)p$C}dmofH?I^|axMNj912h`lffCv5Ad?awhLGy4Y$ z06QtB!1%8D((3%I9%AziS+m%w%ooi&^}~5q;kq3! z!=5NGzuZEkm*t@~Bu~z2tl@Qhm%2Q_aB*jI^sS^?`S7ZD(raK zHobw$00a(%zjq4u5ywB$8X@_%wwh(^m}3Uch+~ zZCL;CyMm1vMI_S3F<1oKl6nKo0+ujzZ#+gATLnJ6AF{Lg1<3tca(XJ!q&|(hQAv$T z#QK}=YIKD4t+22%--mYn6{lzvb#}1^|8*Ytd+YJaR!~XF+r`~fA9?SMSM58m7=wRu zLuUqE)aAp-dul(GY6?$MiB;SsP8$vutJSP>OEEXv%I4m|u5BlPnD1y$go9TLgtKPj zQerx~A1RI;;>8u(W-C3$*PgY$JSxDQ#9Y0ehcN)E}H?7 z+y7rQ0vO>5gGR2i2PPi?1BSM305!{|)v2xl08#NQqgTA{{8`BAr}!@hlt7i&v(c&W z8SFY%YfX|d;7=&Sxc^Mpy%&0g#=lo8< z0@_g@_{uEYt>W;^w=);fz75<4ka=RcEq^ZW0&q-sAPFM>NGv7J$6GMD3 z%M6BHFF-%YvAjM0sOCm)7qsoP?O!y397WHwe(lDXySu$vRqpk{sHp#O?=RQCDm0t8 zJ86UZZ1DZ-UvjWOPWi+gpl{d4or!VTB}IhzVf);SS-opwojhU~6ifhgbyA`!-}?nN zX-36(!|ADq_YHH9JX^QllphVB_E1q(T1fzw^Q>H(QSd(}W zI_I6qS2q2<;oWl!x+w%7bQke`4_sXqr#qjKVMdmXoZ&k#5A~3UeXc*@8cu=l;ikur zR>^c#>6ppGyi&1HcipoIgGPmJ1SOzM(Gqn7Q7WaYV)df(yTNgY!1|ji9xB+bFUE+G zyhe?$QXz=G!mob&1bZjUPb0u{ynmp_H7&iVxUXSfDl>#Ur=|~(-!xY~0L2(#?uKH3 z{@YuX@td7>&aBv|3*ui(YW3nGwd@Vsts zhAu`xvS(s-QKqbfm~hf#ZQRZ^uMCXe17UOiFh}VDI|*2H;H5KPx{XNMlc`Cf@$zvd z!AD7FXj*oz=KyQgf9=~>k(jMmQkV|C1R-)8Ayf8mzRKI9t0zRK4u&yBrPX=q8OoFr zBgI0^SXDMVpEv@>e-eGsUsr;_*|;5R4215;=nQTN$Ye^MwzHYjcpy-`Ik~^L4BxJL zh)p!W{`jg|brHMt+OUe>xY+BT0zz_LJX5t^Nz_1TN14H*MiPE`gR6Gi7J?g`?^4R@ z_FHaPKH&8nR$rKiu|9aCa^3SSpMtEXMztK{H93%RRAy9w+@NM=kva@5WbER#C9tBM zSzSngr^RXaNEzDpF!_r#JE;WEMkWSpB4=*`_OtJh!0jCfjFc*7&BARRGjSUKX#unn z0Z%VoN-B#de$h5gqDz1PMpSg+L}1J@+&z&lnn8w_ub_rgZiK;PI12zHo&jj97Q(Av z@%sZUAGI6^de_rzRq63PE&a@^{ebJyJOOo)D;BCKE&q6gdYjdhh3A=6TnEehFReTP z0X2mu(beS~OEZ(wk}{Wt?#bEBMkfSEzqahV080pj)hWw8?(2uw-24lb_+FLA7J9&F z>bq#Cak)d7P38XAZxga8q*QqK!2Ki>)*Cl{;VC?lal?-o?Wx!F@k#+F@DqFrU`{*6G*-C0rKZd$bxa-?KKK*fnoqoh|xd&Cgk zD5wi}(8Ar^o6;c89>>WAJY%Sy%`V~Ls*1U>eR|e?@28a~_j62--LyeAMT?Ex)lwnC zOKBFv;pvu?mQC0Yi+O-m*)|mBcRzS7Aj)@#-gs4cipkB;!f7&5wfTh9?z_`kJ+W_~ zPVw|(ifVL7@=a=}b@z?HlZnu9;m%YUjPFNMqrq@0ed|xq&6QglPmK2Yk%K+8wLJ<$ zO^$Ofb~_!)2-47u#r+nPrn*<2p6JZ}uWRdXou%{$0i$($&cZMGYZa4cc^51%$v}oe zmhqi1#Ub{E1pNfWtAIK3#2fNyW+e*xVdHMq!&SC`BBL5o_O?80pQF=&@2;hW%^vBG zu>Iod(qnlerumNrTfwtEH4EhZCSuj6{iYtupMr5sNv~5G97?=wJQx*d1ili;N`CymzfPVD8_8pAzW_Tchtxqb}i4wn`}>; zM*ERt)kmecwpRWw>5x7OtuaLNugdW%ot%|oSoN;k2rlqfVm$cpX>sEjym*wZW^K&d zpwQ7ske(5&HdT3$Ll8cx!@MLg4{A<_H1CDH3mUwRJ>4O+f0+Hs#YwUs)a+c;bP3!$ zy(tHBOtw^GQ-`#IC-PV=ykkzzYg2k=%yCUt%a3|AQNk%edBk5kI^i<40{G2?;7(-S z%pJW*=2fh{0dBUA+1eXVjAsOD-<*I-;l-~GGxh$x0KO_=VmQ;)v{F_EQIg%@^>6X) z-Sh9+4J9(+8)2EUKGqA?p=KeB92{HJ95Cyu1BR%;3DCiCWJi2C4SZ7_0uAQ{cOEE% zeQ;yL%+_!p`XP7{a%3;$cd0`4?il1*ep0<1$(F zt*J<1z&>Qyw(oagq=KK zrN|Or)vhy6*xG?e0!3iYYc7EbqrH>E*;228xdd|Josae<>EPQ@Yo?f8LE-B#Pf%m_5*J#W_52iXP5>Pf&n zsG&6HC2y3862o5LOt~l8kI_)n8&;UdB;lzlh?)JvdF2U#KH}bBBK=d#*IIA6svvF7 zCqGpC!ko2BFvNVBbUK9?9n+vWZ7+&IfF#KAsUI=ZItVQ z21o|wqbpdWt3o{I$dr|oZU(UQSnThvCGWNNOgVUAcr;-B9Wsx$^Lex*?mV7`~vUmE@!@ZJ*(<1rr90LB0H8p!koyZsMd6~S4E zEj|oC=bO_Nl@gx{oEDzZ+hj@D>l>i5DfGHj|Qhxb-d{4Pj zjGp3U?_Nbbt;?}-Kc~os-ya`L* z;e4PtN-`c9m4LK18I6J@XEuupiq_6@eZJ0@!qGc@2$$0vcUnF+vTzhVFZfsBJzx?| zJseag0wRDUscEo6;z`Z7Y7S5Kgl&OwSB<)I7Uw3bub=yK98c2(ru`fUs@14X(WI3p zAO8iYAOQ0nfQH6J#y~#ztk*JFje=csI{B#nGyb<2dfFG}hXlx*r!iJ68nE2)9`Ay4 zt9IIKf?TaOrb>m|Qx0c>%hY+EiUPfOY0GR}lpdleb55_A9y6CJaGWM3WvVCox_#%& zsKk%Tg?l;V=TD>jopro2uRWIE3Dt-VK<~o}{2Q<6c~1lsDil=uIr|EPc}5QI6$Q4f z{f)gWc6QX~u@6W(RvoNE;prKVm-LYsI7AjUaTFRS%;*h11dItiNI07&Yy1^}>FtcP zMMFa>9qXm4T74#dI}%cjC+0daF;97QSS;Dp%4J{K;fk4}Ur*C_>p(;&JnE zf^p(EyZ@n z-Z^r>DVhfdzuA>)+ZJ^>-<8il6+`Q~9|G$0iMZ;#TMT@APf?0jn6wfyhQUHW6;`Kn z8r=2(erU^ArUfEZ<4t9onBD@sP(VE^N`fdejD{X>r57}zQ2N?kIzj!s5r5yp$1RU7YDMN zm|x@J14EG*Nu?kQ+nJeBr6$jQ0@Xi(_QbI_lieL)7eM1#imzua#h)3)3!pQ3ak0E} z#WA)zWzL~MhC#(&l%^8S82b^JBUDYfkjdE=q$EGYGn_&W1)Z764$aiH= zJEh5b@N=Q+VD7f9YSU?K#`%nMm4P7G0B)Fd$G)qzo8N+im z6a9?G$DUj53C&p7lu7QNV1#16sMFC#d`+ zvn~>NN8)jtJ&DVl_h!%C;8jvuT6RqN!BAg+0U=WCoZw#@Qzm;pa89M8AN6?0qAfYH ziecoz>v3#g&_n)#?#6ieOwdWL2jCZ=k;Y`A0}o!P*>u&iZ#|*(vPPPVCJ_7118c++ z>|ej8&Z;(LVJBnzIF-XpYPAIbwqX41c5%#|V?KVWg~o~r&WyoSb&h`J0V0>hLEUc@ zb7#Jtet>C4dZM@VN*B%~WjI7FUvg+BgXvEw)~2XX+Nk$$KY9gxW`aWS!NE-_lWqll zz)qIWVr=+&^fmXls_se1`t_9yzd*8vOYd&1Wj9CceZ$EtWN5Z$ z>~Q$9jZ_>rLV6}%`7V#&E8Zj?2~8lZFY=vOccR*hh&>Tb1xLgMD8zU!B(st0+0Nz zDcv=3?QJCdWm)DvAIVRFVZTm#&#(C+aVF{B*ZdD>foKBr>j&hI|JM|2p_$F7xyYbQ z#RzamUxs0owB*n78%-eHI3UGHi>t$USQ4nEn#a2Zq77Se0E`X(DK!dwq&x2B?5qq& zM!8sWpc7|jHwxgflfqYLJoT5QMX&zY$j8;%S?w>`KQ5BOzMNq;7FzCmZw$QHsHUVU z2+>Wy5V$EUqJUl7jYmY{yOXpJ;x*XP3w$*qgZ~!7fB8UIv@TR8xeG93q*J7X)@GXT zZ;a1*-cCNp&KWRT<>}*So^ksoH0=}Ad$o7AVJ6MTn`Kg00tE6LF}r;hguvY(&eywh zDjR<7cRJZT%S`-|TBID@C|E_Pe?(^Nnl`Q2b+Pm}2IO1io9zp_6fbX>bU?}^h;{O& zBU#Df&EI|$2d%PDKf@a8n#i}^FFEo`a@gST;EF$Lmjdj~bJ%Fk%y|eUxD$*d@GmbO z^LPOKUB`*k{{lDF#9LK>LgT2ndEe7-e|qyXg8FZYx076q0l9EF#fK2EO$}Ci2b43^ z!sZi@R)t4eqc)90t8{#m?;UNfAaePL~A4Ya63!3k^0&v_|8|(?h_50wbOll&8Ebot>n$k_DM$%Er9AVCCB?zIy0Jf#3Q#4tZ27ebJQmxTf4HQHPfcW2UVV~J5=)~%#Sg-3zE)Sp{2Z|5C z53b*RQ#(A=2}8ZRZ2vW@!Epu<*1|4=5=3f6U`)*j)_Jdyrja2#H}s7-?t(AI(_Tma za1uI0QFCU(nwiosK)Ai9nTmC`xs}q6=9yA)uRKLHjo6bkcXn}EmXkbgzD~j^z-{NNAcV%Sv14YTm>-5fIGClLkD+v+$z+sw9wop#KamG_&&H)O{SyO=wK z&PQ6C6b1RFD%aP>Bt8i!!e}qu&Vaf0pN0BeT{|7TMalsyf@gN3|dSU2Ou?(8(|1i<0FXZ z`IT3zUL$e`#7flML83_af?>R33A_H%MRS)@Z2+{sjPp$7EtF@{LheHcw@0hh=Dy77 zUrVpKHzBOYXdFEg2&b2pviCEGeS@&y1;5dT+lTQE%j7X(lVegI@>eZk-d&zd$V%ZY zG)HJ^W-b-;v$l71J_3U;2p%)t4}Uy-l+)xh5$6T?S)-koDG(~{Fje-1Bf+2fG~;x; zdBKPYiqp9Bqiv;+GOJFmul-HnmIs;lfvR!3+OMLZtUEoLR#fIZ_s7M|y7lirOH?#8 z7T&v`3)S?2$v5@Vn*`O`9u$aW2YZcbmYM==p&am@w!Fi^u?&sm&Wl{l=V$*Yl%5_i zJ}30I0%jjR=c5yEs2m+3s2RC>as1GTb=hKK`pWe7l%BUs0ntdJAPafg^piE zLCsjrd=BiV2Z`1(Ip{S{_;Pa5bq*7028FRWyt?vvVp8Zuf z`2_oUtar8tRQWC zXDipc5yZsvjWx4-xKzt`gZXuSHz061oqgS)yI}AOfup;22io4%d$B$^M%iU>8l1_mgn%_ zdwr}|{ao@6VQ}zXHh0-MDw5;;Z9|nJUwoE)IxP|qI}-8o=W|1)!`ag zIf_qJlDMG}mG>@VJVx9)mnLYtAasyTx*{$OjuOB@%;`*tR4A6ng4co^2f|3y4UdS! z$KK_BGQyj2Kf51T8vvNw5|^MdF!A#FsEn6Wzaj9efdUl)3NAJHYw%^dKkPqVGqp?+ zMSsmxL?F+ml#6+4MPwp)5%MK*3uc9~3?%PyA98O}*yLSB+}<*`YIDThrlgr|HdpJv zzD&AdJ}HgUVP#*;zP(~_8~rp-HiN0=)y9>?3eB$_Z+yOOsE7*6NQ&AH<=xdSSq_9@;^@VN#d#*fx z$tDPZ;p}v0e%lN{T?Zd1Q1xJDOedzr3mDQ;6)D1^dH-WTWqIYTpYyGbiq>+E;DK)KM0S}2K~jaiL`5HX4!g8m=jyA47uP;d z!kXR7yN4-Tdy{+WadD)cp&sa@@dcxQf#2DR zh6{pA_pNo{vkgXZ!f#DYigC75ULV`hA$&8L0URprv)q8XAO@9`s=bOSIZ!S3fwtCX z^oHgxt&(DVgt~cZFD+>JX9$1x=Mu?9t`X@df(p&coN`N76E>t-c6v^Jy(2N6c5Alu5*vCAtr}=`YGr+~;W0 zD|ik)xA)jbhPpj0%_Eg9aeDgPI+L>&W^CIj-vL;nmy6E-s*_oN8=I$10eQMU+-b^+ zm;-Ph6+_ebE3*DcMJ@5!jXAhw(=A+x=W+{x^{PVpeqz0M_FbE~pW-0~oMLyGn#qA? zykeLEv4R=McDf=S0rLG64-~YCU-pWGs*Zg)sl~z67>~xwE`Ae8DuqnUBW{i1|~zoLr@gV)`B=6^lkI(jsexpPtN1 z7ms4jE8mvh_+l>-W2aS~0Dh-X-jreK<73W;9Pc&k7`h?)Xe?OVgsgOb zxF?{)Q|#Ja!B2WOn8`ZV1uFLzk_jOXtdRl?taF+CDo#j7UuUDjY02^qV(nzHvz`7m z+U4)J5uf6nHxTi8TV{SKHmC@Fk-vHDRXDnMz_9S+Et6Uifh5e^jpvx`d`S#b6lNb% zVA3TiS-GbTXrWswT&kH1nU#(w(=$*ePw`Q!+!9FVOmo2X z*suK`+yU%z`c}|U(Zqh6O2ARdDUhe-AUZ`wCC7}qI<^pSa#(YBr=R+?Z5J)46_-*&VH z1ho3WN-WXQhwAAW&tfWFvkBdQ|2i zn<1NCr#b}u9oNh_@9qWd6$#3=QD;h(cXzfI#6NwWR5E#s8b-TAC146M(l$%q`Fp{} zAWp7{36YOY<`z{e0bd>a{cWnzHVUNhDE^+Rn+FxZUi7oS;psC|Q}1WI)vnR2*Iw)Y zYUt>@^l4N6Cyz^AVW}i`NGl%}SSP=ETG-y`p=(UvWet4iBW-HN@Zj?ND8@u`(TrwH zEJnAYM_`ZVG|+qXU$cob4}ksWj@cn#bsnDmlacxgez{V~9#Y>+DGKcYT=+H3hvy>Y zF;(x1UFrsu#tG%A9_%=`0oJWul=9Yd;dNCSE<2(0zC^db{;#*UXxtE6H(+D5cJ*h1! zhDgr8Mu&R&+`Zum>b~+n0wK7|+g4!irNF;nTg;WhKiE%+h-s3FDoq{ zjF5JwH{Ec=vF&Sg@qEB0?03JNYo!Xd4m|29*P(uw+Roj?V)g%^z1bzxRm*$6&{p8} zW^YFM!M&N8>JK+OCwx^$m*Lie2}`07e%`g;|8ccJ)0msbHQ;co5D4$5@O z5PlzAZrg%G(E!Sv;OyJ(JdY%F7shB}>(8a$CK7E4ar)BRQ~n%nOja+RB~Jgz8&N7t z`V!=ds?~mY0mg=%jl(rWZMOS-US)YRWI~x{@ubd8(nFomzk;=wR?-ja8{crG= ztAgk9z<)f=pi8jwzC_D3cj=$e)3KJ9?$6phu4M#|S|XZ49Stu_K%?h{i;U`HL2T(> zz#sX&hDx%Ld5GPprE8gB87wgkQM%mNHW(#YArRN=JKQ{}3#*zR$bbz?ahrLiDT*>H zMIJJ3Uo4dSVMO^<{I-h$pT3MCHF*%bDAI_RN6d|is9Tmevo{&Dw7h#33p1YYWwmh{ zM|u-7ZXC(84CkJwPv7Fh4uaH7w*mbehi`(+XcYI?_m@=}5I z%sDAg-ST9FbME*V_Bg0cK4Bs(AO)Oc~x}0_*)s z0Q+(>J!Au#H&gvCe|NxMUp|UAC=Og^*$)@HMU1VHk&-7?K7NmBUzAQ&Y5emK_gbpX zV%2&7(pE!6EwB@3N2X*#ChW*d$0qEX&<8G%fSertOq>WrapQEtAv%MX9+C9PXCczE zik9D=kY;(Mm{-GgX!tpo=M{iZd0;+{G@s{HTBhiGwB#y=NRl0|m~A-gizA+0JNGwx ziHVWmIU+611J^?xYie))ZHxH!{j^f6V4fYw!7+QEzy1s(yDS zoA?Ds*qiP>FdQwlI+yoPNorV4?Ps!^(dhy?thjfPaO5A5SPVD1=f%GPExYN ze;$+s_&rUpTu-JPmZ0OfJ?EJ66Z5WYiWQsiP?w=|$*Fmtd0fXd>%szIAsPBIA9XUT zi|5sovO*pASBBHelby*`=3Xyg85z%EZ_6OrC*g+F54(QFq`E~Ur=NUZP21)O%TZ0* zupB5Uk-Ct)>u@_SdWz`^odYIL^>+A+KWSDj{5red#X+iyw1DlEpAhG{RSMgD`cm%y z+;BK$=93h|(x*~ZE3xpYX9D=C(?g?`0vdv|<=LO4N$xKrl!kk_e{jy3$4*SkmW`kp z9Ps%Hn674L=cAW|4R&LxcDi=fmF=~K9a3gb)d5}bWb1@-4wix(a!!7fKsr;mQJ-8I z@eNPV!o|QV+};^`d=e<@qSx>)7ibYakW;Y_e4RS6*N4Mtup;;+s{Z&y^^|_GZFviS^`=#z8bTtvQxq^W z4b45cOI*Y=K!tLqPnYi5`HxzWwF(+ajhodd^e5o3o$4RTP!{b364>Uj5IuMn(>7d` zCTBeI=q?tKIeNhERzET678$)d{s(bq;bzz#HhC@ds?+LA_vWZrM0|r2uL_?acl9iw zSjWUyhH%slJp8+?#*E5c(o_%K#;TSg1DY`(8F+B>)s5@y%R~g*r>xRxl^cfFi_#_|j9fJU} zU~sXzgxvS+Q|?>G8cQtS=w_vP;{Ut(|APM46-C#o;JScHC4QWrvabdAfo17e#{1qA z+q2*2teK;>09OuZk}R38ulk4e<{E}Ei~1# zoB@p=3H6UJV?t#9C{ap$mONZ@>y%(B-`;mURk)9}00NQ0m#ULG6NrBdjd1WZ0S&si z#RK5=Tf7-lUZu?hx6VY#N`A-^?wVoYPR?uy2O!b<{qVYf?M!p!&bB7nb_Z&JgjJXL z+|s)ggG@)c-{okU^=9C7d9NDmtsfjbxi!U373EzPy)-wyGj_G9WQ-7^3Q9+*gI#V1(-HQg(ZdgY8=4T=mn>;}fah?-Ylty+CD zEtR3unws?;VM3yUV*5uD*vjq@Sp*gU*M=SZy0jrHtO0|0~!B+A0*q7%k=M7@nHN*nAuZ_2RTQXH`mD5Z-jaqeRG zBMaHl4xd>(uGGulDFA3s^_R;0KiI#u#$+#@2&xkhc>LJ~=&koEU?GmC!$U~_Vy`)9 z4r%519a10w>?UgBc$L%H%SODbX3tweu`5y+_%;d&29;Diu!V~AtB;+}4CVzL7e_)) z3!Ajz<+UTqEo+M6avodp=DRju9}eJVb-bvF7+z^fJvF zK`IaXqbi+GV-(rg@D&<$`J1?GR4xF$8ovu=h7|^|JgBp;`jr}7?7TMe*e9DcZ}bw! zX>~{Fi7`*0#Cw;dt|`bSwK=U4uOS*lYATLN^iZuA)*0pB{sG~@RJQq~$@eIepL|X| zxhG{HOK7S*tFh^9dj?Pojrz{7UIaa!wN*bqE+s167+8lI6nqU+j-Ywz~7w^fDz) zVkoIiUfpKXg2!>xxqgK&fc_pEQO4RiM2yXM6MI6chTn`-z%p6KIR@ld;P%n*h1X1( z^=v2Cis&MbfB2p5kR{AI(CJPpe$(P+&I zHPRYKrIRf?bKlAq*fk1|EA21|y4AS_b9l|t>^0bBf)yp~%D)N@m}Al;psaUrBFIoo zwvcefA;q%u0Rt|t6bSt?K zm&3yGd53vK8X&ZG@q2GQmN>K&T{m9ML3(DkkH@4XxoIMh1sLb5MY3GeQP&cpVbZJg z&i&8yx^P9;mB!V6m94}3z_jYB>BdzyLj5ie$U5$p2~}7~J-u%g3aG$E^#jEI!+fD% zFJciBDosLaaeeC_I~Bs;-%B`EL~n`~X?Oa9FDa@vt-wt7D2fPqg_R5lAx1gLh9?EI4`KKj-P!qyW(Tw~@W|a3PK%gT)~)_FAkWds7{q z>!?oGK-g7E0InH>$I4Xpwy2J=OKcu&zSdP=(p5hGRG*TNTD7(wsIbj11(DMWEi)+N za5`TfAdXM_?Z=ceU-hy!c?*YpQBB+Yv;_1y1Z2$k>Wn7&`a@TK+d4+td|~#_gU(iI z6Xilzc)ab-vukxNcdZq(*UM=;htHW4F_qzzYG>Z$z+GMcJyW`04?KqHFXW7%0IOA# z3}B!LU0`t(5}lBla5XiS(H0tKs=rENm&Y9@a(mb2OU;VQULCVZ#eVo;F#ODF)Ruc) zCi^h6Cx3L3<9&AQ#|*`p*&wW{yy5)_n)ZwATS+Wk?lMv*p+Au>ad9**_8lJSzCd+4 zgKhDSz5nU~HG15R-AGhoXM7(VD-@)t zs%E>EA$)-)K=NelmYd(?&6k!%)#7>K*=9w0s~0oOo>!eNUYEj50vGez_q?>W11DZ4 zAikP%@Oz*B^YZqwYPO(4hq_wFIV?-W))B96E~QQ5T3Mzxs;+aEw!fO+L@#XX=)9I{ zUELP%s@g@Tn$pnCK=^L?z+gfKu@-Ml$#KnKq-mq93|p&T#xmi~Sz%e~$1AF> zlHR~?4oo${|RR())s|^v_5i9n;h(RgapXYyS5m z;;-4m0Xfc@9lPEI-^v#BkNu}0CgZoqR__OB46i;n+03*N-WRMG{TBUL)mD|)`C}c? z#knS~v}nT1rrtZd)l~NY@XG%KoBf)@{YiEX(@C6Gw-`NkTfl>#4x5VP{?!Lbs>L$7 zIsNeitsJ1u&-^8of*)n!KM}(>;69bNwV;Et$Hz~39!hmO)A^;DC6x-?2BxHM!5?Q5 zqT0p*sGHa8T+6H8=16k7Uwx->RlhpiCNpS)_q#_&Se-p`9E63nyw$_= zwvI?o>hH-;=kYizr89H#N?9oa&NLm3&?}WxWtRu^8%3dCMs+~T_AOYHSo3LMdAz(t#P+)`o$)DlNvr;-CDt(t7P0? zX9vQdblE>>3K9c>tIwKjF~4W=`vu)9l-ab+x!4Fk(K5Uru2s45o=lx1OC9{NO8oa9 zEOzwE(Xp77f*|^Uc8k^b&YoM)>uC)nSIZrg%OeI@J&h~fG1ATPENYCUzFX+zQQlO< zt=j^YtM`rEAk{Ty`zIJ|yM1AaIMEPySRYxjIV>)f_;6uV35L z|C8-^G3(cf6tQtERe+J=0$Ob?Qzqt^5p7E9E;9s}i=5`Qg9s}K(iJTa9!sPL+z%>S zdehW$%3+Wjvf4}nO<&>_Qt2=3-My3tsJ((Z^fCY7RkGIJ^;g!fOV=WV_7l2uN}fYz zfl$!?LH_@3)>~cAonHwI878e4n(p^_>zyq$?=)+qpszpP*X#c+(!1)S@x^RNAZU9x zX0lK1+)ZtvG+M_iLGEPOA$F5^?@@Vv?M!xqJ;yEY8)awQ5BkFN3)^mZu=f=;mfg@; za;lDnXPB@6y~i><47tQ#1OLl$gmbu$P(c$BuW8-7xl)(uoi0RZ>DuF`4>F7I`{Z6G zaQRQ`Op!O@Ny{3X%dP(F_zPd7sqTzUHD92W1Mt#+kGI~LaC_kj&B6YV0iH|H`1hd! zd9F*vyAd|`!^`kd71RmQpoLQM&ese)%x1oszK>-TAwwuk+vf;JOs)1fg!B0G=#du3 zlzCJ#EK;N}g>{r{Y?a1&Nn>onvR&ouXeTTuxT`oFK!!=K#tcliTlFAHlsjXmB^pb& zg8JhlGcQ2Q3T>VBzcz<};AeQyF3{8)CsXNxmlW0YMwK9)4^`N~`)@u){F_uLKz77q zE%#*A%JZzrbUK=^l=>4|hp8H&DzdT%tJ8F3yIrnSVrsdrwf0y_U16(yW1oTo7x>>v zw=rrA`f?Bh5l;#}QJyCRIT!a=aLJpuUD6hl~FxU$VXz)Q9 zr8VTzIIkq=Z9spRP|vk0E-P9VD#pHLFaJV*7T!tDCp?J2%INwsLbx4^6r~noI$$hC z!Q=swPW?~VKhEDq=ZEfcm%`4ZO5IGkJ;jQ=kKSK|qp7>)h zyi|Q~=)2Ky`rpSz%wxU0u4jByz}dk7(uG`CK0cegHAy=p?DL|X`_AcxM4HZ*U1g+Y&0lJ?8i^j zNu6T}z`;d>#t*h~Z1n0fBFH(HR&M5JY0V@8EiSokWss;jTjgbJ;+;hgIF!Dws$xnW zsl+&cPZ`Kh6!}+DTWlxN$dvi(!dO&;FtsU( zf`9O!vsYe5A>;yG3jUCXvxW|68*6Y=YsIT@-qa-VJ~popd+r_Yr4&K@Yk2gL1V*)I zUv_;-4L>BSo7r+u!$Xh+KH&TVmj9Lkg7|3tzFhDbM$F^bRZH7D1%Q8y>u1WP9=fIp z$cmLM0Oo@k?^@a;e?OHtuoplhMx%0$PTjsH`zf`t74WlB}iCoio zk43l=9nUMJYA3NpoYk^Y+KR_S#CxvvGBKL@_Hu1rj@#ZWvd&8dFRA%U`tK||rDv)5 zAKh&I!AF+gqfig;_UROg7gOo&?zJ+$Lhw3N%xm3nywY9!rrfrcW{d__+HR`$9^)G^ zM;p84m|fSkOY@8o+bgcGL;8fY^DWG)bGj`C!S0s{3g{8b7jE94;{}S>bso?iZ1`T+ z$$^NF$-$umpUBR--}#PuM?jG=MlDw!byxBaoU(385ASiMbH)DXNlGfQbhAMCDN&~x z#eeWUK@dIw$=Kgh>FZB_r~nZ~Fk>FhFat5`9f`AA?qzMtH>%VO{f{Yf{1uwDeHojG z$gM!rt9j20zEtGt%PP(5N+-7}POYA9O{!Q?Tj;pQF=}Nrt ze&|dppD4JOsp=M>#3lZS6xb1z@(WyKvV4En52{`uA zpB2=dJSy@Gx1DwCs_(9)?l}gez!;+bB4e&4qrvF(fyK63=E-(OrxoqFP(_}fMpI+A zP9EI69CR|0I+0;T(XGy^87FPj$yvDS(&JH8JdQ9A6nk}oG>N~0KDh)xU<>E5B+;}G znc#SWLp@4w;JbN0rrIV_zgNFB>2ljZ0!FO$msaJ^pPPp8ex13ZK=Snbt8?fqwsr>pK8`(z1(kfqzLUa`Zc| zy^++{AC~9;(fmzfxcVtLkIB3pM1+BGKotYZN6Ji@oWI^9oP8N?6c}2Rt!SU6Y~l?b zVAe*W_V3Gzht`C&N4`GSdoM`vV>V^?M&*O9-qgK2kL5xXZa5^vXs!f;Fei7?y)@dW zGaQ|-NkT{1+&8a8G=!{5L^l+d)eI6&DW2&_6|1u-F6db=Ei#uCULsJ6EX}k$+UYU& z_P`f0Ffx|7nTX4olJSW)aw7I(xKr%guaeWEN!F=ruh(SzBO2^_rb1w-jAg~Z`+PK1 z*=Qir{F-h`0QP&m7ccc<{fxpt@;aBU% z^W3J1*X~`ljI|zgd_=jix)_ZNse;tUcPIQ(ibkGhQ9mO<5 zbN&ZuSK=Id!g~2c_dQeqROOc}QQ`BrxFAuAvD26Qq@zyJ+zo{RnL0S&e+7rh6>fNB z-fqgXtH!19n;Hy+p6DslY?|Ga7r&!lPW+(4=nH+XCa;3W|e1KAQ7_W2HU$6BBeokwNX%hM|5ytFn9p+9}B`ZBj-@jCU|M?C(y5LzfF8$f& zneAlax3>xSpJ}ZwWxUFRgclp({ilOp&~=ecivoLTi07t1WmGgjtcY^*vPr)1-~S%< z9G_vr?0RO48=v^RT^&{O9_9T2cU@&}5*OpR{;G8+uq)h&KEE3j7#@=17zJUl2w{OX zAXA~CPL)&L>M7LtkcsHaIs^>gX&+2X;yMA7!9+011QG&hl%xQJkL8B zlN;}?NR|u2gs!t?g&NQszVl_5PUyb*07=Gq|9i6sQLy$V23toTqa$U%)t#Z^r9;}WEJFI-XkPCBn@m=Yfm7ce!<_C_!SEn~*6&5mLg~cR( zun;8G{TVmhtC;_hrRToQu0SW2g2N9NwfzgR3A~lCLNvn4y@9sDi*+ZXGJ0l86sof+ z=qGK2)W(tlDP)ciTDaHax7aZ}JX$^A4wjztY0QQpk!o%KWpaSsUS_+jvS9ix@r+hu1PvE|Ow zefEGrSQ?n?l~TTAOy?fm@}Bs$bJScR7m1V{YY`$!UUwu(8d!O)AcYL({!P5q9t?QDJkuuOC_GU>^m|Pd`t<1GdAe%MIpxV=v6$I&xd4qa$&k zVXIm(UhLbtCo%fcRe{^?L$Eg?XrYyyPW<6;MyH}c8wVjl0m*;cDPEj`q;;|L18;BV zIi8xWc^I$fj@$4YfUh~#EEQ#71J0XR<55Ue1G)nHD0*(h4P|`2PYylto^3l7Fnww zvvEinoH_=rx9RBHz?I3HmDPL0gyZ^imYj6<6(;lj8%$7vt-J?&9ll(1u<81Y_iDxc zCIiHEQ86=$lgEcy45pS(fZkMZPYn#cB@^{)bGkV7)g05ZeVc^X6LovKXJlGAR_hBc z%~M!cs?}Mmo~bq59<*M!M7?KvffL@r$wyu1E^7CV8T@wRedx3uJyOMUYfSjB zXAgF*W4lJ(*FrWE^Ix4MG$4Zfdba`<*hL4GunDKNL$-)>;JlnqoXU^xw3ke{ZI|kH z9OKj5j<%Lc%l7n7wiDMaCPoG7`m2y0b=cD&0sY>c_MPAbUC+u4UMap2IlYJS`tf3 z&u25ieLogEkz^ir=kE~v%iyxoIGEwg3QRy-|{a_iY4CD$9 zK73o-71_*M6}6yaiMkEr z-abluCyTfPH+g4uFMJRUGrGZfunc-9SMerruUPxI0e3GVhxeIwHx*JW<4E>^Z@g>G z>o~r)X4g8y+R@N)a9hl4Lut~>8+bR1&C4U}tg5Xo%yrimR}x&$?qzi4%Lk3ux@(8f zfpH~#ltH>(p6hF;Wic(y(ypTGGcvFniBhcBT=>?Hj-;om7dYa^`>Rn-Ge-i});z@` zB)0-K7oL7k3?W5|!9SdAZ!S)y>UQ;RSCY`-PhG|Oj@P}iFvI5F>&N*^v-ta6)xlR% z(SUc(F|z(W^%CK=+pZkSX&e4g$jRS4H_pQeF1R~De)~Z21kl}iI-Su(459<-?LPeJ zuygq&JoifK;`C196g$-fkPg5{d-Ts1t}sVHrP{jc(p2P3ce?42xfa-r;nbEkAUgQg zJ9om#V}?An@>oG`--f8@(X|indRCsyZ3j)Cwi*ltLFSD(f*U{GM>h}~=!0)TFiIdH z+aR6yVRKiapYUluL}txxjd|L)~mbH-WuDq z!p}uQ^W)Qi24tI`54Z15cgX~R>9WPo4zpBQj(&}YxQJ>9G&f80)$!&xrMuIJBGUG+ z`|-@o4KE)Fyfr~7s4eOdmX zpKrb^PVEwUQ<^)xVn>TQ0)3U4UJ_O2wTGfltWip9*V;4}6sP`Tq=!+lsR^F>w31(;6G^o$sH^;(NHK|%Ls>v~ z@cjVOeQ;~8^+?UDIPBHZOc(@|lFQwbKD=(9c%S48OvLsqYJd4dw6=F`rnqPV3P}Io zGK@C`@+od^05$&G**OzI{Wljo#8V(J_RmDOrkr^uHRz?STmF78r7T6L!{M7O;u;(g z{CJ4fih)p^--qdzr2|Gxs>OFZ`?O5B)VVT}Zm=Ux8yl9GJ76bVq1wx8yXguLMOOs+ zEz}qlX$CP7^d0PR^ZO$7ESwaXD%1-$rmJ;;7gu9C7EEMBD`YT0I*g8RRzL@uAwwb(339j9jt{Y@;rfPzg8XXAdW5ckHGp%NF zr=Rv7R)1)BlWUGO?&8^>QwT#|W{h0+ST#+}5!l|;0bCbOhfe$f&JfUXX#hU!U$T;+ zqntBlx^2>l$UM8nEoG+J`^if(I>pJQGI^bjZqOSWn^%C^t*19t0vl>K4X6c4=O$-IQC6Tii7=xH z<&kcw$0Ab)TtGSRD%y|9*Fa&DZGbEV#6$Rw+3eL&t%6_(q4h&?$dox@(>o~5!U}2h zEcjMF`^SN@`t>2&IP}0uNs&2Mo?e>{{`y6%2%FtJj*1Xuv%QhM&{MlJuYT?%Xt0% zR*x^6JhTXOi1KSP#07*2d?kB?- zQ~^EbOPoBAK6zAyV537AiR;LEiHbZTRvlR_o8H^hs}FspX{$tPsd^`g)MtO$pAiQR zUf692Z$GhIeJ5vbhN{*Zraa*S$PA?b_YdoF^NBw2V~E%7 zo9&zB(FfCcxQFiUP@f2Rcd71)x*%Uc_WN=#^8dJHAIy8G8V zsb#k~xh}_VV4Sp3RFD$OE!Cw4^>+{{ns#{r5f)f?I!!uJCXo6+G0xK#=BQD>^A&wl zq1A_#9(d+`pzQ&9bwz%?g@%}v@L@x~cqBHtA|i&RzjGf5F!?nO4P}vav6CB~iNQKS4XoA|f^NVkD65}Y1~MBwhi-fiP3AW@v~%sVS3LW8Q(wJIHU{xwgX zH9&^j{gMoH&st_!#=)Ex9@+FsMwtmtT}?{J0|6qEq)nuRPns+Rc`%OMTHW^dTu6fh z@1aRsgfJMkYn()#>lT=!xHvZ1eR;;-!`*U17JAY0*Q=(4RVW~c!vI9^orUNsjg%Xd zDV=8NT9ywDWFzzLJOB8LgSi|hieDG)O4Bc+-PXfe2RWU2^qSB0S4Qevm^r1u-4X%g z?iFMr83+XJg^RONTS9yuM-LUVAyN<9Z*LqoBWFf4@mIqhk=8Lz-iPKD14&zMc<&^( z-K-MQ!$RQ`EpEyYVxZ?}CTj#tlLHG&Q?Qis-!zVDz0 zceTOw#8Dza+`hY4#XV(MDIWNdRwOirPk#!(18Sos&s*^2$CRtzt2e^uf%~MbT_gGT!mujiCz-a$5nd<4>aR&aLpn$74CO?Rc4E5R8y8j$>2cNAK(pr}s z2`|j-MvB#x=SX^gDK*Zhf(ab)>#ww)s+~>^NCpiaZzmk#Oym+L^;g?;s-BH!EwwN* z?xfzoZya@*K=AdS@i7m-9j_)zLTbv0MkWkh+62V591^#_@en-7X~ZB}uJkO25B2g&T-I8Nw~s z6P6;F3NpjFzmsF&e9TNaGp)jW-Hzp4bKG(;i=H?E0)rQ>xPRSw>4ht&m23XSq->=Ju%$eJ zFD`rxm7GM>B!?iX@?P^){+fF%^25(_^qQA_s)9ky#5pp(nH19Ey5?xP^k2~p&w_)9z@!1Oho-EDH{3Daz zT^xcqe|iziJWB`HelziCipbq9VF6E7kLX)#`JLSp;V$q~FMhc|EYwG7?4 zO;BHeiKgJJ^2rNLERi%8k{@`0OsN{!E2b1Q%Z^kQaHyp&t|DJh-;kj7JY!&f@Bye(PMXJD2K3% zy&$UkXS&r#IPaqyhD-b}A-M0IDZgle2!;3%nF5C9S3F_&Q9>FTlpt%J3>__Qm)l%2 z*QPi!8cuq0cu6WULtLth|GGHza#+eUZ68MZOEQP{_L|}4c9cFwcuR*0Q7h(}l(c~v zIlh{m#ta5iR^8uSb`?J=1-!a-^Ni!$i`u(8AHsm*vNUzpnh|C*2t-zu<1ZYNVe{1KZUU*R%}r^juqMMx z2*%PJElycR8m}5h`7|T(Y}|(-M0K{ZBOYM7EWV|9q+bp&9M)Oi6{*GdHa$%}(l9k~ zGV?jOLGVK8U~u%`wE|4SxM+RQ^Z#XOZk5hQ_x3p6t~r=7xyLb!{2nlZZ7e;}oI4_q zcNOl;e;Q6IJ8%R1UY$bGNKdxGU^2%Zpe?%Bh3wHtstbc2$Jv5C2ug%3w4&ayf za^f@o4wLF)K~e`p6J*Lny&^G#2kz4GJ&4uQ@P`UH{pl*E%O1Oc z%Mo%X0Wg0q%!oR5oB6qoMZ6Hm*5zIDGrjypPO^-h$##X0i9nIQ@t@J9|1C}M5z7Pf zB_%2F@p|(v$@#G%R_wEc+ekyWd}mXk3yH(A5}m1$!SZQ77wxQGa$o{%28wFM#{&d~eeYuinujX=V7?}gtxt(d z<^9$||4t4{3 zED@x`OqVk2&-@ByGy6sKC9|Uyhwc+v)~LT|gaY3qv^IATC(8VA=7%;oUcD*YqkLDz z+H5;p59M2MepOskvMhk8GvhKqSxm$N4(30?Tt#h$`JXcrE2118Lk>4UKnO&n^NR`G zam@ToLUN&QQWdMr>;YI*0ugCqrL4@B*8?*Iuk9i;VvlU2Om|zup7G_LR0H8>xCV6Wo0H^v9UDuP)4yaK1$a?Pf?h=#8WWV=sh;oF zbZn(Ay;LTEpQ)Xda=nCT`!M-pUf7J@Nq@;ZAazNsvjRlHbgf885&j&;FN=H6E6YS| z+A1r7y5W+rU+}QTtg+4=0wMF^JKokBd3K!>mG)?Y$kzO`GJ`Bm+qP;W&FQhFXQ|Gl z)i0ooOv_Q2U!yk=Y++^*+3^!FH+2C|nMra$hsC)G&5n(C1fOdSPA0_n$1=9?^?!-H zV34Bze1w;r@bTb9fDM~nT7fA6s6&o5JEwHn>b7Xj3z{}Cu9{o#emdKnJk{3{+>hg^ z-V&|2@ecT$txj_gYpH-0^~mveZA^O-xNm>_7z*dmgqY_jD}O}wY<2=wo}Gu^Aoh1u zo=4!e3>9v?=L%(7nbC)}_+~1KzrK-HaP`%(p3}088NwE7PRsbWN6i$J7>;?|qDF7>dfzgmB# zb!$nTzj4<(_i~qRk^Yne06vnl+`qv#Fy*&bObxx+ufuXwbAdwPB!D1w??M#;qoAwi zI2PG+G@|0Ycb4e1oXhFF*#hq0Nq%Y^MM&@>n=(1G~{%FmZ##32sfZ-9_r=n_ErbpU3Zh})#V z@N%nl_sH>Kt4EZu6N&Wzv+u3u)`ah)N08Q9*YVnNH#?>fl}4e{m7TP+4&SH3e0my9 zo7(`&aJ!TA$MP2dKG|CSikzr|nxCSgA|zYazCj&|%=vF>F5 zT-{XPO^RI4JN1G}#nd0x3v?|@%_f>Gb(-1AVEZV6o}J~s4uw;c&M>k{)d21*-02JG zC9_qa1ez3f*Y>h2-mdAAqQM=dp8;DjDWP=aF8gI6{*Kyr`pMQ`cC9P~4X(F64NMIN zuF2#Hv>@h=a=ZkMMgB+n(C*h~0H<-D z?M~)u&E&WJe*6T)Hx}YLYffSm+c}qDbw^#5=i}u!-oJp+in3J!7l!#YYy~=x*9`ys zAi^$MX{lTmhKr+GUyPSA}yoL%7Km;%1qpl3$P!JvEk-9r!q! zYM%O}=WT|Mu}FCk#~T`0;9g#fwfG}7?n_WTyD)uC(h^d)OR|u2#f5por|yrTC}iAK z=Jfn6y&A#vgCU5DOpca2He1E?Pz0FD+vMJ}tK<}djF~3=_zFqGqeOjhHV==28qE|y z?4N41E&h8&z^mP(yZ?x{9Tz|q?12HXx!=V1K$uvM9QXjZkEEBOBJWC9*Lk?-gFTu@ zFD`?=a!x<7&W`AY4P(xbO*NePVT2!VCc{dt_66c?lqXoejKbiY`+ zK90bpa_((UjPgyM<>o%j3o(?!NTX4ZgDl>J-fIl~Xl~*s{qPn@iWYyHv@u*a=C6oW z&|3I#DI*xleUmvNEx0)>88^{EKV!_}scN#Bgi>yv%EZKz?b~R()*kyVb{zaH^X7XP zWbxFb#Cyfc44WNJ(YI&UGw-h5DAVEA!;30$AIB9|xb+My_LvN052W$PCL9=XMkV4i z#tR=&5`2wcTJgMHrR;hHyH4gM4wPXpMu8M%D;yW ze`Zy93S|yg5om-s4kjd^gz@YV_KT+XlyZ8%_E?R5cQWL?eTVPzi$N{pS`|%v;|i(V zh_Dg&7rq>v9nZ%S=aaEL5Ox1&cI(@WLHYy32QjOgX(Mi__D$ zX@dGyRo4^Rrrl4B_KXoAdU_H%npvd#nY@_eWb(y=#L$0)wEd+w`n4 zBpx)T$04&~Bg;SpcK%~00)?kv5NYcLcBxwQ?wc#`PDo&hIMYrVXr^;6yoA8+_}?bf zb{g*InwMbn`-aAt4C7>MyJp&)%JPCcbxK^o^ zN8%QCC}9YPP@;rI6T1TEc&bYTc7g4+Ukh?QrxNUmO0?2u?m6`nwGpafM0zEsGO86{UtpEqzk{NV9?80qkGTc_~(N|_ls z#mg^uDW%ee*VtLRY#knZj89dYZ)Nov@n(}-Q)viHI(YV(IkuSGF&B$gWh6I~j+%c0 z85{wVYg0}h8=8)|A31)Y7V1torN2V(^?u3QW|wi)2wsk9?8yfg9G#AE403z%({tDP z*Tf$gFWHg*dok$iuH%Wpa|ZD76gYz)aecAXbA5h^Xx$WF|BbNo@4VHoi9Q<80v(V? z?;_q3INyUZd`gji$()_ue(@9&PB4lPc$;7fy1kR8jww8;XNN|h5lU}N1{={))8n6f z5~Qh&LgNaR8McR~uJjKtYA3CI{pmg8latym0dw9)A7;yw4A^s7kO{`nSo{@M_7ZKP z5xtflq}_jut796nJrj;n7ja*^`5~_ICnPfy(EnpX9V<`6IYR|_9TwJ;>{zMST(??C zXglgWW?#~R3*(G8K?G~u|6U2X;@(C?(uF9j8l;=;F@(*3V@yyiAJyJy|1G2hYr1ko z+U_e&2*lp$ZuQ>Q5$G0g5EFg+z~M)Dk+J9V+5ztCG}Z~RyyY!78{|4bekB#U7BqFX zOGakHwRT=w1~Jm8vRh2WlI1|4E#5O`Qgrpw=Xs*O`7UYA>|hHEN1bsUipg6H{lo61 zcTFt5hc9^r{LwV zTM8lZTPZ*r>~e)F6^9df#;)^kkIwN(y7?u~)XkVxnkUfG0kr&k*Sp7qKp` zoMS>ZSaoLiMKdsR>*wala4Mt2+6zwWb1#B=-B#PkzwJ=LLg~or$wcDGvefV9uLLNN zWiIRC-sFjzx<=l7sfJ!BPvVi6$LY5epuc&!RC(g_JsmLTd83xz(Q)aQ{9uO7H2Z7W ziV`y6)7_xgysw-@@)(Wb(lOtCo6}P_-Dm7)R5Iw3JC^&<_DSX=hLo<+{G7#n!MvaN z`bTtjMm5dOk}cnr)1HJ9F71vy&FD^f)tvP#i$5`TDouLPj7-s@T81YM4Y`Kb5>Kz3 z6Yk~e-QiTW4b?&9CCb5^du_C-ZxgWjk^WRLLqL2&QqZ?X=wS)Mp;00aqkuX&ib$NpPF9DRg12D~N3}O^COjk z+9E2#1dwVxlmitX;n1f#szntARY2bSr{ZY(EAp7{UKs`%yeZJs=7K)^rL1A85i%7E zpV$~Nr<%hx^3=ik0Uf67yPP8~tV>?9%pIEWryqIS==p*N=WCmt%f5%3EGSAs!@XA( zak%YOuM?81(-4CCY5BUZ1vkTE=W93bmTJ?>5XC?DTzYX5mSMVkJ zzYo{N>s#HgJ44}kPWA=5+P%S7+Pb)gP6IJJ_o%YO8l=a_=W%%p zc~;>mCp+|do%q~`slBid=0%z!@+^bt(_Q~ zFh4Qz$-ZkJ^D>v1#&Qk^yX`Rjh2EH;{!PCnB78a~=eW6pl^I{IE#z1bg>*O%I|=DZ zz#U4SN&$UNZ62PN{afV*tnqbJr>Grs3t%H%Ymert&z4w)JkO;r)Q~%;mpya-iJhnh zShLGcG&^1Ky$pmwJl+1Kxra1{l{Sb9IuqUXWsN8IsY0NvGk2a*9w1O`<~D}ZRxFO} zY0W8H4neX#{!I}s1}?tR?AiRt0d_-6!?O-=Z3)?#ac7&Dnb$q@s6+f7FRj|bgyHrO zZ&n|^Kd!PaK2yv(jF+H5^T`W=1u}16V>%WrO1x@z^M2bQXM!LGkV3bk)xFaE63>U~;{hhynzF*-XCu>E$F4=aL(+82 zI5UUpG`=8~{`juRO3~8Z+K@MyUFr*Ea)wnHRmyc+=@1j;bX@fO-oOI3C7%zGX~@{+ zytQK*)uV4QUeEX!kZimQn`WR{DcicxddTy3jE-1Y$s(Sh-umBOtM%5-yC3$qdtB=x zp0+5?PN%}yJbqV8+qH>qY#0V6TqYQM7J{r!Ohh8t*UxOCcOzop7I4OINjMkwVpSy* z&LyKJS7r!J%LgcPvF|TFzH}om1PabzxHPL}jH1pdW)0zth~ci1Hvg;ujn_BU>;23W zQITnxvrR=u3Cr0|HMx`;pQoG|mMScek&z*^8k08Q5wwasXpU9r$`4xo_71g8vcL5! zyk^-;li;n01-4@C&ddPvvzegK+}kN>;LI<>%vM0K2GF$ z)ghjwHn!U?`dg0!$MYT85gO!6!rzCszrZg4lCg2zT09Mp46S@pxOpX;ic7v z!x{4}TS1|!Epw^z(iB8cbp3PHf9gA>onn@;5#5`(SSj^#y z<SLaH%T6$sdgAi?p%4(1j{&Jaz1s7A zB(NaC(elE=FxN>0Pm5ywt6%?E-vcHnbH#xsXa1SdQ`@>{?L_Ouy#+ z&*c1cs~Uh*XQ8Df%`24|E~N;60tMv@c*a9=&G*EdIf{7cR7d1*t^zJZ?OCnwXWZN=+x6Cg*V_~4;|Izgxa7`@T`*_r=yf(P^swmw;uS)M&frKi( zgVH-R; zVw!h8e06!Or*8EOrNSwQ*8|%flei&4S7li1M+1&jNk7K@x#cBs&!-}BVHdg=$|)rT zAeF|)iE}HlipgTBJsbL8L1OIX#h%VADJ`AjWq>LJJBCJ4Us^mpc5$;F8-&NqrkT)h z7Nwl^jHZ7Jv1er~R^T#VJwLiulXzd>RL}?#x(`DvmC7sHNJp7b-^*&PF`<4sSUpv% zXa3h#SkNpY3=Kf*Da@tRSn_?eHmhZYeUL-B(9!e+K?JVls=+gjLuew$53 zJ)T+Z;meoFk3p)cS<1PyLAfPIP=P^S`1PW-vmm2&4h`W3x^+Wxmoc(jhY226<1y3w zT-nat0#97@+h_>+nb5g#~xl?n& zry^(!0t|$L?9TF`!V~OzZChqzs|1RXs?O2C zgh1v)M7K{i74_1=l83foj+LXW0|9kGyZTuOclo7i>f(;s{yK;+Nk_llb8kumhC7XVn3hgiz66Eo*- z?bV_%r1>k$X5O;C$OYrNvbLPA!7Vl1xx^P6b^_uRMgAS-h+7X(fo%~q!q&w^>W5Gh zEO9GJ+;r{mPKMT!dqP=y`_v%A<0jJRpcM{x=N+)S8@$w^hpf0}e_<2{Y~p0=Rmm9F zmSWFS4sO#IVI7j+JHE(>5%+|GqTIVp9@$fo`81#RZXa6LlVuwSVT*xE=a_jX^HTMP zuqnKZlh(2TK;#)=lTtk)I#Jpa-27>kt}n;XdSFZOVxv9nXizt0CrTgl#j2To zOfv&YcQ zr==x3-<@PMV^3vQ->WXI)*Y3l?rZx`I(0jDKM+i|9apFHB-^@Itdn)^9lhW<>rhN} zoy%xb=S9aYZ?HHXx(@=`xJ=0Of^oEBjRVB}05ZAkM~HjPJ9KbvblWizx)c5|KjBZq zly>NFzw5h!5n3iR5FJOnaD;(+QEKd(reSM9xD=xCU^$J(J%{mh8OPPhTxTyplTSnJ z+Qy9w#g~@u8Emb?A}zmL?36JB8TBsZE$F~t3Xy|3)G@sY(Y?LAA`P)iPE>}LwHDq^ zOiS)VlL=*VF#{in0xbej$Wf57_?9GplA4gAZ7>7D!KS)FaHD_9>)Qg2eLu=VWq4-@ z@r)v6>+^Lo3WVL%1kfAgz5Hm}8Ke_&(~(~6*>$BPosO0c+P2rH>NpX)c+w^}$c1Kv zRB9jl2{M6yV0U9AzE0A2%ZA=-eM02f)X+)u1IxeN{;^5ss>EqXrR6R*@_by4h;K!d zkRe7Essgip7@n|{Nqnn<687Q`V^Z*AENfJuYk8L~lHFZ7xjDoO=52TKhYQ$-S=7#smV zk=>j^)KHxYA9-bV(sDM!WcFk73n=OdCIbpBbZLL5$Ct!k=L<6S@Cqw0PX-69Zc&2Q z<-If;qQspGV&r53{UbB=VRo550}JKLQhqyo-XH3pZL@rlhpU_I+o-f{7HcAhVMzUM z%a~QM!qve-P8V3LX!3>XLg&x&CyZ|FoDn|+4(QFJ07#=uH$FD0x;RlTd~Ky$svy%2 zxN>wSpr+Im?D5(DW{)#071)5Ef^a8m>4){{7-lh*;s{tm`(=H5pOv5jLUI4Ka@E^x zxk8jG37;bbGhk(p6ERV$**I4(ra1Zq>}I^34q?`t9^!u*By{E(7eJWQm@ z#BXiuw8zq`WN0}T3T!zMGD>?otW%IZIc7<@eaT^jKNVmq))U`E>x|Q<_0||J>M?;{3y}tnbSP_X*aKOFiDX{1 zE%3L^y8F4lVl#~tO^AugUNA6EG^LbhFHD-SxK8qchH99n4oIWn7Umb_)^Jyh3l z;ZM1QQF=qLb#hS3G#p)>jz6eg;#jkeWKhWjgT_+C==tWwA^mD1@)!CoKUq*J z<>j)W2qu5au}6LF;tYt6wh3obK+g81bI+B*9a21dATC6vHuPuT&JsIgx;x?{d;9gTNmkh>p@RkRQM*xsF~TEL4SMyQKwg zoQ>=3u%yk0O1I8Y15NH)m58cp0W+QMT%-aSqlSj2M(xGpo{d@feq-(Fd`qlSkg}#u z6+jW~>&;hobgW{@W5w4?KHlFGJrIq-ckR`q@NA_Aa6)v!Wt}@*^3U^6Th$mGld8R-V*6sN&FpWVoY{6a;vEnsT(-OnxkhJv-uUd6v9KD?k9?5 z%lF9jEO*as_9~vpbPO#}8Gg1ZP$Y1k0Zr6LcvN-}M%fbheI%|L=dGk?iBdT&Isk4u zoi)6)0ba=k-LbguJqzgo^o;pX>82{+c||NY-U`PN!9v_6mkyk%^OYGaO1Sg;KSw7& z$2&nIyDXv^K=yPZy3?;3ECK}bsrx>Ciw!XSdzVT|8by$1%^_Bcn62j|Vg~S=2+NEf2(ezS~fz1KzO8LRk zd5L%zB=`GOrHlidVxwyDgTY|AxdLoa{cO;}o;yrT@it6s&|K4%wa=@bQ5>1sip_T6 z*KNZFJ#BbjbJe)26hBK7?8rr>0=32qBrN4rW7}MI@;qui6cxJh(X^5yzNE{e`{D{dHOZ*nSu0X zH;$QuTdrKVWV|XEMW^3tp_I5nY6v3=)~v}0^OVk|9&@MZ>5^#2Q~3*!F~J!MScl;Z zHcra0v&P;&qzM}OXE%Q)|A?Wg*@^eWN)=mx#i!)KkhIyafg^NGnJ=%L=;TRgez8J4 z)$fXW*S*uHSdwWX$7#7$%S2L&U2XG?_f(2`WxHhIoR2D+X@^@u%m=W(g3yk$Xj zWUu_P9BMc5aTb43okA<;4`+$cimr|p>SC*5qI;oBkWZ8owV3sU%gRupz2D?RmJO-i zni614KFHYgPNFyjq_&6m!XOHDH7a}sW#ZF8p7vQ&aSIn#W-06z<>n;v)L|Ne>l+dv zPxz(7tc@gTlZsvNd5Sg1X)Q70z|LO6vuhT7AmrBRLMfEc9GxxK*3zCSw9#=oCNeWx zJDRmMY$+40@NRFEzBOgTcU53;+`_oUd(ndL6+eSlwE@3ni?umzxTs@6@;3K501Ixn zmS`m3(41F10oe}zJ*o`+47#)ueH}}x!>e%`Wu7kO1b4n`YLUH>(SyL+42rQwnRW}f z{CzipJCU0$$|rFmu|FlOb#e=HPP(S+6}|p!nGIc;&;F!EvQ)9+Iaq(9x}S*1v+Cp~ znZcSQaY*BcvOu)p@K{|=Pm5%On+qJq4*9Tfj8unD4k8~Q!n5wp5)@v(l1O(Frr@%i zVfMEwOa+)yX#C`>wxJhzZ52yOg#-imH$wbeoqBMg+bdezi|lBwlFUM!KF53KTVZqy zldC?%7u)**W&(ra@6{7wOrRARQABE%R%~^}iP;DLjn3r%1T7O*fm+!z z#|n0Cv6kiNB4_$`k<78>QFaZJi%YKL47Q`$Zou;F{^4MEzmS+SYP@h3F~9xlGUP+@ z=;y;IdgTK!G}yn>ut#h!>(7b?_EWHF{N9gk>`tcQ@%vAt9^Ea{>Ta+rC zrY*$m>+7HCju^MNKOXj0ceK7b!(-LDUUF%eR;)|GGG>QmU+~S*GIn$h%=X^YV1}aT`U5YxNa)4@$Keh&~>X$VA;$t`%Cdc8a?YBC`Q&m1w zK`I5pQfDTAyza0)&#K=U#8q0~H%eIl`DxA=J}BZ^S~qP;l2l{Lu`k~tD5+}kF1N(G zNr%Lu(E+^RNoPR55%C)hi5v?Jag4++xB7UJ$GFpH{XE{;ixm9YcoAhTCgSOB|I%;$ zDJxz_F==k{2bOzEUW;#Xw$EA%tY3s;8IK4ARGgVk&@@CF%Jov zmDre|%Y!_=DLng9`{say?7c8Q(^xmQiMLZsp3Uy(0izQA{C*x0A48!Q#W~cUKmUAHb#8WL2AQrp2w5j zt&ogi7PpgSP%UwA!@6sgx&Qh89#^AD4_?)Eq5Q9P`_{t%5yGzc?G!H$H*CXFh`qQT ztJnMx2W!3Bq4u&=tq$GdVjMvzC^)4lDx+g!9@p<-IXosbt%Fm#^~Z;H zhrO4BgO)d)!qoxy5aNi9OTD;IoE(j-%?DXYVjwh zx5Q;F6ip&D`&T-2X$G{4a|Pmy0=b2%U+&PW%x*fxMLKUY$%MN&&hHt}@BX+RE`^M~ zB?E?oHzAEO%sx&lLtnm+a zean3`G}`)f*?lI)wzoJmHTkGRDJ9TiMLh%);+Tp~mdS^qj*=*X_@*omONVO@ey-{L zWr#y(9_%jEZeEfkvVSrm{)A%?Dw^1J^NVBf-KHU~bs8$>4|m|VxlOJUiW{m>0;@N*R*On`P$5VmPRIh<6lB4aB-N_}m)ZTsEBgX&sKkD|riMp> z3aQA0wDt9q10yvwHOs226UH6hby@IxaWd%reK5@O*Z;5nG8UVY@p!OseGVwV);*FA z)-HPaz1=gie9m{uA7jr?ZR+DAVQp<)CfhwT1J)nx=c6Sz4+kuJ+@X@NqceNb>>|X0 z1$&D|xAg(sL-K?o9lTl0DDqf*5+@2-* z0`*o`fpaGZVJ1v#W^8;bKR;hvS2s~YP*BjUB^#5`1=#Bu$e2MIZM5Y-=OJmwT&@z1 z?qVf9`@t{~vK}KBE)jnVOnIU)+zZdmc%0(7#7COQI1~+TI5af0ps)};jt?c&N)kMY zIR>Hg4cxs%{hd(4lw_|g8PhySFwA!pxEM=OvqtgwE@$j4Vn)BR)Gua%yZ1cuG5ydC zOBRh9-H!50&S$7i%{oPPRe}z(sf_3gkifnWTQ@dS*jAY#3L^Yty_oodx-NDKiplmAv>;=sM;LJZ> z$NHdw2Y&o`Cn01E1(S7DepqtCI1gaj>h(VSSCZs@BO8(ivTIcWB8;+8PrRqs?jQ;vzspLxYrv zRf9qE(FtD8qRFe_&2bn5E}jlY;6V8_{G8UhEA-bbi(9bd-qO5?`T?nYl--qKcH5F#VerR~ub>ZVXlOXD&7cR? z3FJ&n6I$J?cS4!gJnOWtTUuJO1$?|7@Nul7^EAY$xToIo$CtXC8XDiuJhabmgngck zpvaO+Y?9JH(npAYxRLc{4wVv^OO+kYp;=_&MBy>`A70ZxFds36lk#F} z*!fbt@^PEN1av<{U$2gNSEkrs@-rLT+B!OIMz`NdR1e$1*enq`Y+2tbE_E@2`7f%C z19jAEX>1!{R`)U1A6(U6!knL$8LC5Ae_?*IF?qGmezXl^UzZGeAZE{i;3`&Uz_aV? z#~s^yph`fY!1M5*1>#cNH`|zr#qC-(`1$@X_RWbL1PhXpBj17zH&tTEY4ui}A(apM z`ugoX#B-y0&oc?6iX|%!64onPR%yY==_*wcV{T0?#l+I~?nsP}AKAaQ&tD=dOqw{h z>*ln$*mY!bft!g)Hrmc1wf7`)vUq=ZKUv9pTu#JudG&?)=|%%h7!;@;5~BdN;{HSl z(c})!cl^V42%X>*Ua*ddYLwdPq>|y0pqY`ZxeXd%Mjjp+z#n`Derqw_3p9obR;a7{ zSiktb$%grZ6se7Sj>~gZoDAa8Bx;Dx*IbU--x!^WSMufFF!XiqQaxo9Zh_FjJB#Ai zJj;x_`9pf~&Su5%&aCK1O2h|f9o3CpD|d*I;bKfsc$&uk)sz1YASve$?8J6+|MI%M zK`OzE7&O|BWs$0AJXi)5@_{udjJ^}MziEgCuC+Llj}5fjl$YVY6^IvJuiFD5!&77A z)<}%golLwd5|ey7+Oy680L;NC$xA<@ixr>*=&EHcKrIEOXR8*T1H7dNb6Z&aot&%= zSk7@@JipdQQ;g-<-|NJ!Cks1qvviIi)2I$?|A(uqTLIo%se8}rx7Qk4Ie2!j^LX!V zfI<5DbI>nY76J~;4}MYvql%-{j;XGuVtdG4h*Jm4ha^^w7MOHzkv>DR2%QpN%;uMD5Z2P_-;#+(}~2A%)Mf2 zgC7W%l2jSEI|?;Yh?6)+d>4!3^fX{+Wd34fb5(qJw{1(rAbw*T^kgr|=;#n*C=kbi zL>$&@>+4fM?Nu!RnynCXG>{*uRzGXLD>yDhM*n@531Y-?WMhoRQ+$_tJa7c0<33gf zbOcIZMM!1++7hGxZhCZN8LlIJqOZtV$9IUL*pp9g=ensu@lU?S!K za5ak!P%#{uW+j=xWQ|b)lSQ{`ZVNj@?5hj zGN?;HAP|p~E<(nNn0!eLmjny(M|SS$hac?GI%QzG43Ldpou`0iksgWt06YU02Uvp8 zL^}X~QC4aW*$0Sq=l?+#aLKE{*7f!EnLW?U*DN+WG!;~#(zysTfQJ?Ka64oo(3z~P zEMP2>M4YxN>KQ;@iF7}{3e0v|>Lhp^vH$U~%(Ef-E*wxYb5m0$688W`6^IrD=V{3o zWI1!ABLTpIi-HZnEZ8f;qX6n^$(Ro8d(6>uFGlRHBMh8#jm)6fswY8n(>y3i;m3#%KEYEx=qTAYlE$=mSyvC$8_+G_*_kPFQ

    R-`c%&y6iINZnGS{kQTTo5@ERCG2mM4u0g{yY1Qs7-Bms~lCL2&={~OY*rB&fQ8D zMAog0lV`UgaJEZXz}?e{7V0zRcg4ENBbM+ZTUjhbWRjS$9`U{c0ml&5##(5IZ{SBq z6-UD+H=D#lz1afwhz8l-Cr{fB7omOXXZ`36oosev)nw^$CXuHJ%G!Qx7s>CuI`wB8 z$>QUI^}#!_+MW7Ar{&E|MIgi{l>QGB(@TLVVivDprLfbGgQZX}+A3Dh+c=9SP#~wi zo64GgpClpzr1<=+r7kk_OO|pS%=&rX4;J1Pi9}@?n?f<=YzZ{)lLFC!^PJO5X5*SSh1$L$~VCtOfe(9C*J{e%#q|zCAka*7|rk zaPaz-Wz-6cS31$%h@gpYM8KH~6=<$I&##xfe~S^*)qKKM0Ynp`;ZFT2feOm?zMFj8 z@9YCii4NRB*_xoam0HcwJs-o^IFeuef~MjgXu3*ff^@#&j@~U>(_?oJgW~$i&Q5Y`&;O18q!j-r&EtJsBZncY&kG5WyNyUYgtu21 zz{l8nKGUN&=)fU02-ygad-*obPqGF5(%9VOi=bRirn%b2af=nw??sCUuUs}a%cm+t zFoTXlsm0>>7AUmad*PG=PLEcoV93ge`sY1lM?Z@!8X}XcuW5}>?UwuO8(HP$@pxox zwwLPyz$^&`U0vO4)^o3K@s>A&yXFfoKe3}%+U=RZyxH!CZPTt2ROwG%$QPr&;(bOI zoZX-Sfrk`1tmUySUuTB!X>UI)w>}$HS;{&q{T-+H0Cg%vmY@)?Y!j}%?3Zzv>Ok6!bGvtaQ-?d*h_j7y3*yb%9E-}BUbsx zJW*n>zbwaC8S3;(u1`_LHfD`n^Ft7?HjVB`?9x0m#xY}mxj|i=T24%B|Y^(>97s5=S#DVrOfVe5SEy?P;*Khq$_FJ0VIcgIfSR^|Eil?C19+C z(mavlsqy>VA?8){I%-SD4UH^SD=oODkHX~qFD^vWf4u-E6ko9hhI5d-W>)!{&@6cx zfsc|~3iO)KdA6u9gV zq*fACB<)Z^*&r4{HMKu;fvdi(UV}X)Xy?aTVAK#;USdnfVgA_sL8wd*gZ1PcP@vd$ zV1s@uPX6Q%*(mxVg0gkdOr+A0sMRQb-`vLHT&6f9qm)O~zM`e&!1Ui^4HVUt5-vA# z@AX2FJ~Nn!c$os189!d^p;xHoYvm4Zt>mK7+gSKct2C-3h}P2_ zxC?UoM8r(7F7f?MmhY@}U_w1qfY0<*g5KSIbP>?zesU4){#Hy4wGj=_c4Y#Mg_fW8 zx>9j37XtMOl2Kd;_VvO%fPoooT9RJ;TsknAZ4@k@iKRxU>`tbVE3ccSis)MxL^>z` z5#(KUKUf_MF?bRXYuR$#N_@GX`7kJ0we4gM!9$q;dA|A-^>==Lc&UD~yZ7aJZ-*fl zSj7Iz8Es9x>p3a5(x-NRuKP_60?oMs%_HGcU1q*S?YDr+9M7Og2;0RCHieB1(8X0n z>)W$ocw0;O4`-V?#uC`=hfE;r=_&K&OSjqjZih`I&f4Uv-kY>8pK+dB^dzk8W6w*v zT@?3Hx@;ZWbVm%o<=ds@)b8nL+!#cvlS7E#$4k=xtJ0tTtI{=QwAz4-Zz8ThrLZZr zgXEVuX%nBZj(;k_koiD9cIzNTc z=i7c6$uku2PCuj8e)Ad2yKVN^^_Yt@cJO2wU{L&5?>GuKp!>@nt+p7F~ zrLq_8diM&~@^HC~LPN~kavb_uRG%fz>GM~St_YI8lAz^3$$soSWW|^7`WBu)smrTl zWUxB;aXgmbDF4&m4y*L0E=3yuMoa`n*pSi9a)0@MXiFKJKjC`^z3c|!HZ_&855Ez8 zAB=TA3Ad7_(R?_6z%2m4_QuF5n&mlDDJQt5Cy7cf4498_G%%QhexuoKcb`#PfpJo9 zFnib`+Z~w`J|bZCNzrMN#?BLCijC{Q$j(+T)z3INbLW8tZCiku|ga8IIGoYbm ze&IU`!M1&3V4=j`J$03x;^Acpkn~|G8limHw^xrsaw^(@{1G zmLFJTKcup7n5~LtAv1*XfWATESMhm9rd_+M*&vxQVbL-!I}3(udCH*)nH&GPWsY8P zb*bmRhGJQd!MbOFHiDuyOY$H1ruIBa)t_-<=y`9mF|KiqncDPB$*GI!C9 zIqyN1gL!9x0SGkLLufIwfr-SCzN2qcNHT69)21;O4<{%Hmj@%&$3Inu|db zk}(!w1-aT*ti%6%?jA1)6s4mx3S0Dxy664kI1f`$dwWMEHLk+V9TpfbO&do#u={d+ z_HzNh!IYGSQx7OSr$ziRl>Z4P%$R%I@o@otga6HC6F}15paS_kOow^_%@{au2 z2rAV!5!lZP%hiM9xC1*KvDo=a0}UO~1f$0$xK?mL>H3qHsmePD%SR%YSoj7-u7HU? zAujyT+_6=w_nh^z4-=I&as>(Y%c~}8gi{Y`13K&H`)7}6%&>p5*HS>!Fj!m$HpC#VT`-rGI`W4== zFTZ^dw_62ylWH%(Ex874)>kw<81BdT<%{R1|ID|6kKu>(b0e!5?nZO@<>8_Up|SN9 z7SSPFHvWe3he;HKvFaAgoAspAaZRzEhh$r<9-P7GNzP63PsO=nt(gSK1t18q7!GMl z1P9;x#2E9pvnT<_vHbsF+7|lN_Eva+XrxWpUTXrF9o}xc?TJX;Au3Y2 zNXgu{a3gxR$XQn6=NR-Zqum%C;$UOCoY&3M>F8DZK0j;V4#OL2D->U=aI+pXmExf1 zWlDIh=$eNo>?h>7;PSreH5f@p(9+P%hU$v7pm&-c){Mup`Rx3<6=`E`wcEAep8nyQ z(99JSab^p*y9$8>voE=x7zV}5FF*u{IikynEdV1(hN6`Q%^+YpR;>&BQEXkMS}WpY zzQ9SMFO7WCRj0~IrEhNlZPHgN?A1njIkO#%_RW`O4y18syhBu)dRiuvd7nPMB}rJ{ z-PgxEb+mm!AM=@^SN7)NidFMA)uaY58k5x zY<({7GhuPfA}Q80xhXayaQp8c&@bgFlCw$u^Q{i6Pp}|09OuvCOT4g#SkIl~CeME^ z9;q-k$A(mg8~icf8yQ@7*xIERau*TwoO}q#I~splC4+Ex-EL_L3ML9uUDt96`2Xmq zySIR3*W*VHJ@eYszQ5cU#|a=Thd-VOe)a{3I}^&)+8iUAv&HDO5i{&Nsh+mY4@J0K zOLw_>_^{=vPA-*nmQZ;WF7ImIu7vV5_kISLZ~xR%W3JdsI?U=qG|63L4)N-*z1w(~ zj9q&cb!7|lR6nNk@UlrR^s%O(I-8S2BuqRTP9;9|IJ%eOq55mohY!`b=SBeUwL5-= z7-+^AE#b&u0+QOn?YQTBXu?|s&f^wnidT`DLPzdRUKkHV0q?}fAeF(|gUAgT1Iv{? za!Uu2ZK1ZOO46HEM+7?Vvn0DGzI!I@+X}tszDHi$81C-XNg^WG-y%B54jh~h<=^XP z*J1bx6UQO2>-BQs2mA$Ggg*srCA&%n19XjNUrYh4{5lwf=m^@DFojSw(9o8-!Z67C z@oPkY*&mKAGqu86cR^{f^<-6;gAfCKDt0;H&gPE#jLFJR29(F$#(uana|^>Kl>Q`` zf_{9ILp!9J!Kf2aZ^%AwYZLJhZ1bZ8HX}(n^bw5W?x53T3&hd*I04%_4D_9uyU_jNCYD`sqU4}EeMG)QzGhx+V zv9o9i`kf7QbYu6I9Oz&d@#d~sT9ul$P$>!MAgMI+)lBd;YcmHlk_E-}V&JF9bx1Go zemNxXkFCbIwyD%)*)IdsgOp2E)~cJdmk=&1x-fltL2-GCPVFy?v@%=lMUbaIEy#Mo zPHfk!?@`};=$#^yMrWhbUc6-)A-?QT<0Q~qj0)t)@O&qnR#Tk|2&OsH#wxi(gPy?R zmZ!_-`}BpQvz4|wEmYcGJT_LJ+AOX@8CaF0hMsbkvG1r4Zwx$8Lrr*=xNkhy9M^Q) zZ0qIbT;wZ?2y zuY>Jl4lR5eZN016 z8evZPCI0QEV@Wsq1N^x#eaZtWs$1d>>H)15Fcw=1soQM)7vUzXVZls@`om{75mt;; zt@mc7V=<)PH%hmXhZ(HA^~lqh+xvaMYPq>B^+yu#TF^9d{quGO`PZ1Yg!AuMN@+{e z@*TMWG~e+;89nd~_d2s#3R8M^r_jEo%^1rPuYy{|OJ16py+_~9%t6b(&jn>^Zxi1y z;u&z|H{}z5!~0Dl#liwJ9W35dx}Twas;PxNu2pt$woVaNTsxgr*kUy?2e~-_Z)W;U z8%(a2u*5vF`ba*2&i^JvQSgOjt)5dBHH}o8o1RKCu#{)Li>`}?u#08;Jy zhO7J1a8EKw_J2I={kGZ4A-oo9dqdIX^Y&*JS%l-cweaX9FV5JyAE-mX$D{@raxLlrjA|KsD$IaI?|Euc%V)?Zj95p;J?5~05Sh6#86 ztz3JaYk@u#xH!i{b|E2_(Sm$j+6T3XrL?4t66jeh5K zGNI@pk#m8Q=S?RaPv4Lg)NQRDdJ8<_^8x_h_LHDK>lsW=ltk}t*T>n(8ajhV$pKFf zkVJs^1n#Dy`J}NK3iZSbugae%C%0vVM=aLX%$oMhC{>^h-+%27FR9Q1;T(_8`ZSY` zU9z7}#6mJLruDFGZM?qWtE@%})= zEzEL)Y!b<*1VHdPj7Azv@gB%p62!5f@YDUNWD2|P4|w+mg7rJG)g+SV~sgm zqaqr$Q3ex8VeFr_AD+#iV=1mx_N`GcWAJSWhTE-}~q2Ve%%-O2*S2O8V9%Zg3tVUz+vk8cN#B;1dw^p(nc+ zW#S=Tr#$g&+TW|ItAPfUXt#FWqOL$6cu7rEAnh_JzPXa(J1~%i)sx=g{g577|`)N-ZClnc)It@%YgAj{q!oWO~hdj)BOb%hv%L+ueK2Win9=0 zyT_+`|Bko&#!f#U^Zt)PAi(ZRikzfiD{?ry}WB8aa%_WK97#o&=GG000p-1MbgH-D!d=eg;+wAO7JnG4>FshuS12mKBA^g!*? z=PWitnDp0}vdcp(L8F5^UaZ-L?TWzVmV3b;m563akYATPRSP@K~Ho+9WR|U@ArSU0xe?Isjqu^z;Op zxhzkGH&mz6eKjbLV2LWd_7(;P8Mqz4xIN?!dmT_POD=T_Fx-1I*+Xn9zHnnblUk9G z8{xU)x@5XVBkcu$xdo@9wcLHFNACx55+7L>Hre&zx1-vt{mkomwj1kt)cG(h(5$Fz zfBZd7@alZ3v_F9zXhRmwe@}*U4?qnR@A5y>G5sW3kv|>Yz)xJuz zsz$A{#RF6~Wa?wqqXm46-^W?MC>b>;B zX*Y5Jd+*&Hcd@iM{Aq}hL{2+D@%hMBByuQ1eyrND(45X5-;r{}nq?AOr?+{kX0{*f zsjhq%1a)QR&`R>PqM4v5W#QyuA#cST16l5~h!cQOR6)0GskqO-bAz3CCXNdYI6XNI zHl7^K%2EA~oh(04PgkB}P1o<@vMpE3=u5ZMc;e~lePirt&V4X}-YWgs@+9Lw z@)i(~+!X#XN%qi+h(@P-gjLLZR?Zn<>@n>_(5WG2dr(wI@WO4B`jEZTguR>a0)U({ zildkx(#1=Nx9-7yCmZolaUn{>jPxIqsR}Q0{)AcHt!x0Yv?t)M!kI?W3yU{#r+bP+ zn=-id|HxJXd0mk4YIyjAX=wGY+E*NkU4CD$Rg|xIb)*V^^F1j$4b?oik3-B}Gf>0L z5%}yZaEaDbW&r6V5ODYEWT&>j=uZ{00+L!Z9!r9!6dzA)p*|0ltsT!oX9cS#{BET% zDHqRuE*L&VM_|~p9*YG9N~6RL8Xf+noVdv!=$#9$u#j#6)mccn2Ys}W@(4QoC~nf3 z`ee2*fyS@ThH&pYC=NC|L)&RP76ZOXy6g1(#<5V9r$T0S?} zA@(IsarcXUB)u;;L2@q@L!SQ^>tAuUxa_i?SiXex^)2_Vq+(5Y#A=0#Bet}>V|?mP zIeV5*WsZ#U1Lw5ITs!9*NpPJB=|}n(`$=4E_tSZ?5 zlG#E2Sl!8{OHM>uCXQzcnMpSo@C!? zhG{e-WohhRN-^l(-R#B=tl}w(B79U7=*~+Ul);#!0M|WE;lyrJ2h9l1kSpD#;RCKz z5i+)?QKFNs!{j97-TzCL$)@GzhGqm{CW|^HGOHEXE)6naW8)+N8v3{0O05;-@)^*! zHNl4P1E$wg%S0NeCzh_GNM403QQ~Rg>W@&e1=_Ot<|B+UpvU0w8O+*(r?bSj<9cv_ z5(nbIp=@4IO$^%J`%H+rjY0g~u{Hu=h(tRREN8EdWR8r(8}0CO-RFcW9`_(J?64IH z>_i}P*DMI|Gkp2)9?ef((ycFm9r9K#_iqwZ$4XtiI&ZvliBe#Lm5G$31{Qj|M@6I~ z^x3-S$)!%C_Twu44lUwR15EyL16lHzMK;qI*8}?=F6?CtU;6@D=*{$MEmpYu)*3Fs z0HEYj7CthQZ-+weH=z4$ML$}J<~gv6;Mdfm%^xjlYJz@=S3Dq>@NW{&H#}s+4#*(N zknG}DU#dkfP;?Wvap#^KE>155tBC=9a(YaVjt_R)!9zb$a7;UA5PgNmXN9-ZUvHis z_y;fMA9(!F>-JO#(ri~|DeSUKO3IAa?dy?U9RIry7aHzu!-JooNFNDAMKW*X!nMUun65Tmy`O#df~H1nE!>San}qz!QPy zK%!l4gx489)b)uCAgpT;I{#upfj{y7f#q6!YYS9uvma}4nBtI185IRc79%(Y@_S#zomVGMOJd5e($;jjj@X-ndEdP{B_dTiB*d$IUW3e zule==_nPvq%Zjk8S)k7F6vYJA^!zs?Z1+S+C{dXEesqhOqhpwf&p9_R8N2RivU!&z zpc`>>-%WcMxJ@4gldIX?&Hbp~-WU*Ev9>96^SXbxDHHIz_I`0}`vNdE(0X@cM<2&M ztg_M4Tw+a#$!ulbtn%HX7QGCM6~}vi@4|`ri#khL>}K@{Bru!*fX}?XuCWEnoU9x( zax@gCr+gn4`22oXA+V2V*5>C%?YfL%KgbNvqaSUzm@r*hS=ulm zhyYHDyDaLVO}@qeEx0IYprBXeNq<4+2qCkT9a%T)#`SZm__8)n%kC3oqjUWD$xA#^ zj@GCUA&}#VaMAOQU{wawz5VXL`X+!#)&Jec^`DndT)hroTUX5#_WvJMR{<8)wuJ{! zP!Lcl0RfevyN6bh7!c4wT0%jPZs`(%i*ySNU=Y&XDc#^8jdXW+yglH3_uli(Hw3#qR{iis^ftC=}JQ0^Gam_+b0aX)&dVbp3uv1 zeoTTYwWfT1BZ(+BjZw&NnvU5W;#}qtcHTpZ?m6*QBzz|y$yk7@hp`2}Y1Q+`jgo{D z!#VG9etbwf-*f2Wv@e0f`!M86E8dH5$A_T{*_tJFHCPx4j|Xh{YJNK%%l}%o+glrw z4hU^7Hk+T>3?H?cH%l^#-FFCs!clm}MrLpNlvxfp3%a?uMe5dQ)(v+1GPbGZY@U8m z`}&M^R@BEJW|pav$1hW1!dclNoAf)RfXx-$kA7|ZE}@7zUS%?IS;|c#927Rc;ZbkP z7V*1Z6KZ_Vt`ps&t16rv{4wC;j`4VAl`WC~Yr_+fMK!xy=c@<5U6xwJQxlS(+>^(` z)4(0AO!rIF_}#&`I>ycb2Xuw;jvsJSpg+L0Js$nt3jlrvucVj13R-FoD`-!eq6wci zhmYlF2ZD`-m7Bt$Mx>0yc$H^?_LirCn%5>*euslU!ozIo23=O?7H3z3ExN64!?)#` zYWop0Ybh=9@}Ya26&7PdI=SPJR7hx=-??WO{!?+SkorL)81G43S##_l}&g;np1O5p$6XQlUl( zTj?Q}WTW2~^C>C1OZT^r4~D@5_UvlhqzTUlM#w_x@m>6E;HZpZqjv0a=W?)Ryn?y= zsmT_#G+?-#vHe)3XQ;0=Ej)Fw#zH(*A>nI52G4pPw3AkpsglkwldZO-d2-YEQ_;`Q z8Xs_&J?D)*g=ItIK89Y!&la=uZ86c%RU}EsxY|VPKzA_ZVz;23&$`jy-~Cf_FmWGN z279U1q(f8V+f8-IsE)j58L5F7t0;>Xj*e9Og$(JML&RKiz|Mpvix$A;E2-Uhzm<9Y zyaQ4}5RCOq29w5p{a_&y)7nnVZPQw9u%^`&}cb*|S;3>mg4T zIGzYe=JqN8F1jb&8NzWXG)dWyv;Q$FcU|d{e65%pjDItNrZ0|Wg?utWe60EB7Yc|L8K`8Is{1B9WJTceEHkw}< zIlFpwX>y*NDWwp3KwVc`nK$hb>|;Rwf|`-eHyo6SaP#qDJskrp+xDZ2iFornXJ^igR_ z336NiLY7AC#>U1|OME5{Tdk>gC@H673=`k{E-ylJM=gt4h>?NUlkh~Pe*!16_J`1~ zE$TJQrUxtCy15jvPd}pSoPzJL_!_Gb`_^3F zYUW!O)QAT3`c3tYh4+M*o>Ae6UpT8p*R43xs-{^Emp1n|i-^_@DhmTfj$<9$+YD6f zQ*4PT)ph}am_gKo&9wXOI36YzWnPgc0y83^Kq%S-|ItP{W~qbU$3a`d<1nGBwZMVG zt!5gHN76R2(|?%E9w~LCRTMiUh6tCe^L~ahsWRn4J&Ru_33xV}%v>~n z?W#z$=otUm$x86s>iX5shrbM&fjxH&pw$WNx2WiaN}Ay1=G|OW(7m;xMzzOkOOOUKu41f{BNuce?2l5(!m9^*%&Bu1mj4SIlno zM$0}Xo6K?3(blDSq=jO6_3$5+46}vbg(*#YB~s~*oN+-=&<*ExwGL^E^)5&5 zi?etWO@}K(*WKnTAS;8_;RB})%hm}pVf1wm<%kworAhm+f|Y3%2e6vCTMX1?m@w;W zB_eA*Dekh>%{|sv$B3nHNN9v7Ra}{+xZ6HqEBY+ZM)+&QO|>!Ysn|8{I8uHaJ5@i+ zTQrtcgWU`7_c20&I)3G>UJmPa61;myr%OP3-N1btXDI(In*bYo@AzIF7ZZp(QsiPb z6dsTBWR&Dgx`6RP7iYOYU$}=$xfz$ztWwRcb+68D=;C|qrF>8vuR?<7L(Yp_I?z~) zelxXZ!u4~ENaIKbd(qack{TaG-lu)FuqzL3JmkG)EIb^hE%I`jYBjlj{jaz3 zgPwEjaSdAuK-d`0JRZ-+$Z;*bxeY^T))gPz4`MsGmZMo6n<0$L%eO=+2iTC*-xZ>j z@PZWD+0KdtqHXK?e{9R=2=y)XaDj}FTcsVM)~hrnN3%E`J7(P#ej%--!|yLxt#^kr zhRXEF0BeQ`PCkKg{4=6aPc#;h>mj0J(Jva+Fvm5BDkLkdhe4LMVd!G^4M%>^^Z+2=J*ugGbs zXs{n-HJ=k1+0hhiSIl`!-tKDf7KwNJ>r2A;M7Cu60;|?f9V1|5$=5wc+_$K1B#24I zIxSZLO^j?g_rG-N7gFQvV5qi#@4nk7p&yYWpPBH2xCN@U{rX36j1Od~+MP$e=eH zotw35P7}oleb@Ua>?C|#COV9$)X*-7^D^f%!e0diiT>DovF!dgZwtv@uVRxND=79# zUZo4ecDbqkC3-Sj2jf99?Rk*(yAKaf`)Cfh|4It*@fJ}kjZ26;k3B;O8_|j}0UkIc z!l1Uh>?s-cR%74LT1m3S@Zw(qAV(va`Y@1#W}=%~Otfl^R=|GicwJjI@40=uOjtHd zJ!(^N{7_7qfNFN*%eTri{F2^L6cXqp6dvnK%KozDtE4~7dgfYl5EW=xre)PAWCW?l z;(HCO$`o|wcetcBk>;e!$W4`J0jT zzAyZE;$&pEX+J=WuGvQ5R+`!2Xh!q$os>JWu}(ZYwy<7$5xJ{(9#ib_3964TDm_j2 zB3wJD*u^9Hl*Tt?PV`SImHn(bDefP`TT~VlM9im(ml+Br5M!R~#W^1;u4@^96l|_+ zx>>>UWZ^m_h)S?&;Czk-<}{<$g-!yDs)tJ*r+2oxR)uYlPr|e{Fn8!T{MkYY`6Z+1 zIO8}<5?UwDWG8BFFpTP4=PkF0fW%{%a~PPiN~U}IBu*oYWR=Vp%w~1Q^FC-s2?&TK zMEt0=Y+4sX%<71rWw=ZZa@c$w8|krmiMwliUoU?D*~)pzMKTKL-bw$DtFL<99shkJ z6)OGDHiyFthapZk?`HmAA+YFn9GcCB$6$0*=+6v5Z_dj(eoVjo- zbKi_H7G%*v1n#pl0%rOhLp{AAT(qJ{ux&+wVW zh9E*$o#HSpB_QE3)W>hTOA3@eTAe3tcA}N;dN|&48%4rGQJb^Br%%rIyDc|*U|e;o z3TL-<#12jFX6^`_eZWU>uo@O_(+04fjR#yN?9fH!xW;Jtf9YMp5aC|HhL7UPT-rAx z0ZMlDXEQbKwsh+i*|hVmPa`xK3AWjmFH! z88)|971+u5BP%}9qwi9TkofBnkCS*jPwij`!lX?)d$aGKev~H|WNQvK413G7nkv94 zcONMT2_Lv#iTg30LX|D-j~n@q@Qj!}=QH(C}K?e@n|jpxT}bi@=c zw0~WmpPUccc0nV>wOZhJ@EI51WGHuIN1(o9&}q3Dd1OO?r0R&Hk~YBB0;vf=r2N#c zJ`;Fx0lCg$X3Ei0;hS!iTwzQOrT@%U`_pOSDHU$?2FmUVW>0L&XkLC~(eKV3JL0$O zynBt*(U}I?{?;$@o&lldjyI8&~EDn|n3~EYaKiJI1%@5D8<8z=YOJQ2Qnsm^>s|0yNpgt%VLuZa(}pLPdALg+ouPZ^vKvxLd!{$x0) zcAMQklhX5weI6m9HlA*g_SKw<__?{c%4QTvl8P|pGiKr&j7;LQ5SH5u?2=AI4w<+W z#-5?qKvEFTfXTppCmlPee^TZae@bZN;**={w{RaS;4FH8Lw@$Ff+3FHL8dG8R@I>w@uU1=^`$rZDZ5QO-)^HZ>C>}Emj6|G}$Cl-qERF z+bk-(8nM(E$uk94rBp=Q8x)SHC;xZOUG?2CSk<9B729FY;i^Z!HQEpV7~wCR{Xcur zDNM`#IkTZ=!HApz$1T6qQnzJ0$KYfZnJOp#&o5Xbt&vaOLmyIFYTeI=dMDtDs1x4( zUVlJ`i&I4rdChs*@&Vpm*4kakQlUUwx(yRQyA(T96vqVh6$`13)2N)hWrp z7g6SDgx5|Q@mBvfBbHBkXgq_7h}-uz37jT!s`kIaSCi6Uw?osCTmM2JHAJbDKi2A2 zdHryb#$s@BY$843{YE7&msQ$?#(2;#_WveyWII`@zK3PvBh8CHg&?29jb2WHnb~4`U!nawr7V@VS|K_SPhy$yb6Fo+ zDCtX*P-oZK?AFFy+f@fCY3;KQ&BmUtcBN(4;`~FCuSa0wAD+S>tFNX?afo2ge8YDi zx^fHc$adYj#>z;Sxx|?FCDnUGr7(o|fH3$ctF$Z@P~RpW(-l1FGXK zs^Q2lS?K!iC;oRm(XT3Z8Pdp({vUn9xc;4rmw)a)TOdB)V!=sM7}K&@MbTFugu1EN z9;kL+%*bL}@#k+|vn){s7UOQx!-V8mpp&A ze*e{&_@D=gT^@^Tx@0sJbf!`sN8ub_Nj>?LZ>u9s=)BM!DZL*UuFO#Vw%0<35ox=( z*t)xkGhwpU4Efyu+Wj{cyAR)w|S2WI|ACtRCRq+Iq0Rb$GYmoqK57#zvY?&d2A6a!WA0N zkv2;uu6)Laf{ucr-^ijdH9v-ayDp;S#iM?&$_g`f^2Fsh%XINx3Y3 z>_R3GkUn(U*Vov^z8jXRsLG(wU3NdoCRzuEBu*WFYDzNgIGfy_3ER6?lwy)bqWVZ? zoASw}BHBd#$Db5#YBWjLID~MBIXOA~&Kdt%zh0%s<+pmtFt6{+qB&-8=Quez^<0@@ zqMp9Pr>OpZ030RxfTwV=K8a%3ct&!Tb{mHM%kb5c>$+D;EkrhK**1Kv^(Fo)#Fn9O z2pZ!>h1V6>-T98q97+~|M-ukXkZCr{L})O-)X#dj1^$_uw(kZtOl3N*JFsA0#ygX= z+b6usRe(xCs6u3O0cnYvd5mObk-X<)qxUpgb7a#U@BW*l?fEpaW22X(Abz1|J+^0% z#s2am`aOxIe{)jE;`p2Aq66ao^^@j(*4gQG-ULt;s|J9ocG(T!vC;dC=x>7D{Z+ls zE<|6wDO*bsjcjO9P+dQHBDf`&MV`adr0&l1b4F^!}moBldZ_O_VYx?(%S(XSl5J ziPhPbKBf~1I?IXM4Sp2&F{d%8v$6O3Fa;tXl#tTmQ4Dh8K6LizOm3MXPRP8ffCaz7 zYQkdGox)DapBjM&uh-H2Ogfq2oN=A-w!?jS;*Io{u_YfaohYhy(n3~Aj zc}f!Ve$T}De`HjqcTavuPN6#d@q_7yej@jWe<}M^xCJ^HDSsni2O0RsRp&MG;bF3# z;h*q4wKnIwK#oou9;H<0rfzZvIM%vdH!V0oixtgBl-S#-^gr{LiesLJS z*uJSW>kg)50Fa#v8mRGko%ZPhY>LGj9vNBG9BNMZjdg>7Am6@QTP1s`+nE(!4n@#^ zeFXAVIaCW)Uo9bv=kwCi+O9Xm(@)yxbw5}rV>&Ncn%v?i(W@^P!(hblN6E55j&a_P8u5-pk+`-R4?K&Y-Zf1PU9SrINMLvR{q= zaQ`da=vnxBi~T+HgfQcq=KRrdw0>mso|`q_vpD}I+Pj$)=-=+Lte1gyzy^UgF>|W6 z`OQlYogRNGHL*A!!*ZFAJCC>k7-PYz|CmTsrQUH6z=D$GIIj2H)pf+RV3ZW=Augl$ z>*!~xvjfo&Bmz0XIMw{5uuv zz+RzpGFIhm$M9IKXU1exCd?oaKW^Y>L2lf-+p!z-G)eYI`C;;fFJOOsp6&(|0qjYs zuiFi&m#8l+E}8?Fh!%pWC;Xu%7b?Csh(ZK`f4B2qyK^bt9sgVbuin1eFE_GT>gHZ2 zl|5=E#Av(1$eWA2f=quxE&5z<6&A@TIi+M)bXBT4iW+8=WmZ|tNk z&hA|Tsj5Q%PT_gG!6M7~j)3oB{d%ISWMg7Qp4a(7!W-h=rm?#Z;0Rha4OF|UNE->I}j zHN@FWN%MSzcLXpu#`wmJnH$&|z24P-##E^U{tpml60W*Q3EHol_6|Kk7B4Vw#{l$`<4zc7^|E{5B2XVuBTK8FBs*5wZh zi;H_otR=_vE_fR%HNt{_D&^0&X;#RG;kDlnv%SvtbfW3;j67Xw7O{G0ooSUm5(CTb zz?{xhZUZ0xq{;B5KpFiR2fMs;toj(Yj{aZ%tP|$qO~+ttl!l`dN~nC|a@4$qQ?!7Ij|K z=}QDKkF9zn)=Q5}ZPQMj(e>nvNV4Z2e$W^R{=Gsu!vYw(;&r z@a#@)T`UA`|H994ru9ly;1+T4L6kAATLA`knE#!GCpqd4Oj?Z{FJfRTC}S*`DjaST z?r)a&u?Z^DUveUh#)bhKkX*fH1)#HYSzQnTGTL?`hkKq3>7MnsmI`v~i9q%VQ%StW zWX4vjY?Q>}J!9Q@b88B!} z2sk@O&6i-4qvQr&cZSmnN9zDcJTLkYgzHq5T?qNIj>?U7STWyz@R#_0?|B;fnQf!?+Tx&O<3^ z&VO?5iwm~($ON()@I00=#FDb&cH`YOnJV*xpmv<58p>NwyUoR8BxB3Q@zy9)r{#O+ z-|Rh!c+IF}R30EeSJ-T{&=dMJ;?cXcK{&tMd!n$2)GG@z6Tdq{2?eB87((fFquxb)$LQ{x z=$69Np~k;q@XVseVxH?Uofi#Z-(f=#m)O2nFH%q|IpGb_*E>NQk0e*_0!}!W1>y#=ei;DdqGt* zdsa=y2bjyVn zO00xWGmqGb;qk#SgD*q|^Q3DedV?}&^!cdUzN)S>-3E&3i_0(1 zUVvSyO)OGW=DCPkdH>xD0Q~La%{SHkwQs4Y0l=YI(JbhYS@)LjwjPq5G@gj(<4uNv zr&TSFkS{-tnLE|M%1(z)rvmW1&E4Of!^$2Zfv*)C-r3X~#;Y`v$Fo@S4Vh&*PPQ!9oJbcZ!F~ z+ayS}Nkd{i``}66Ze-kc$fX!m5~n}QBtn1R4P$LBesVUnNCyp)gNd_FAY5~rs zu6pGl!oIXV?g`T?MzWR9U`9<|8GmkP$C1t(4D#7>xSsN^ot1X- zcyZ-;w$V*SLYv(F&++-k_DGr81c->vMJ{Vi#Pok$vfxA+5y{wTD@KB-m=%_)p-mf^ zTXnE-ws9+Zz0SaQ+LvH!hL-TQ-b{tgF|I)Mnfwl`cI@R6f;aFQC9kLm#WwDNm4=3F zhSJSBN`USaJgHKN*JdZKq?6dzFIe)q}(Ate6S(A2_ zc04!Sw>JHbU7LUP>e<#}5O&@%^2Btoh0G^;os2)~H4 zpkrZuKrinYOnYI(NrFut|0F?Btsm9pHX+X9HNl~64V|~+q9P94omKN)Jl&~S;i#v0 z<>h75+4gy>iPeoiy^cY0mrCvWS0l@j(fUH0GkW?uxwFj7cCuFVy4NtUad3tNa)Zwz zT>&(v{#iRifrAXU5zTt^YmY_@p^u>n&|F48fT<`LhRlkNUJZ~O4F8cPJ0U~GPcpH@ z%Z+GtSg?%rB~&4YX@AiOY+$X{hZ(&-eX+J+3Ryhd{05^f+&OVg4RUw;Yw^Sq^{d(& zQJ0_nAZOKN%4b$Sb6Ey%_-Z2uRvZ|mlz5;14Rfdc&G5NObTbWF!gr?>JN{{8L6IyK zhzm8=9AtR?%J-wBcY7_*;(j(MM#@WvPB~C3FPH_a+9}tk7Mn{pccw=Mb9YIn(bsW$ z6vuDz8n6oi(FDXI29LTObRG#WH1l5(UlW^o&=&^Bt!N-8+$g zje*v*9TSIVFiui|AYjw$l%z?@nCSjD^4TOZV5MS?Yezt%4X34fu;k`_!&ACB9g*{^ z!e#Pd*ySU*rW!8+lbxe^nNLh!?Rkf%d@%jAwK1+JvheYRhPL$6*e$9*%-Q(-8*C}B zYq(b9JpSBmo>Dq>;CDe$`1wh7as+C~*$YIMf=Aapi!{wY+b>#|JCR-D`UZLb?0Z_ziE)Y;yfX|%3QCH(pqN=9wpfnJNq5{>^L>NdjtTMviXnmACPUcAF9_Ll=LJb!AhX~p2RjEJ4`LCP*F4Grr5oyw5d&yodZX;=zEmbx9L5(@v4o?*NW98~%`Y|X+&3_RVX)~S|4*D)>w|HV6*p@RtMfEWQ~hirK5`uWanu``7W zy#nV)*MXZcWa=8cqXCi<+Bo#-BqV7li`G-PJ=C6GGMhuH{5E69mdP*|H@Wb~a4zUy zTnZ<#E^f?Wym_5N*HAl0i)LLT_D2Uu`;*pHgB4+AW#;JHDmxJl14XMR!@GD6zfmX> zGR4^2`LEjQ$G@%)p37@EGGAolfH+>9|0E_XwO@FY-L?qdZ4)XIVD!9@Ip`2=Ka3nH zw*f#1nir!rV-t&S7H?=EUS3`+l!MXeCCE3j9(-31Vp9A<5IUI2>VxMoxKvhOAh+ke z!>0~MkdzN&9V>12MBUvJXcRs|Fv6fcD5Ul266sm9u+U))Uni@1^_B$=-VkT+f zkLcj2_JO+-QLksxp<7k56T*ED>E=ZHwi{b@Dr=9o2eek+&0Czmp1<}`Q#y3Kv?!dC zjP$L7;VY{pkebbkGNyKVacMyl*{s~r9hZw`d1z;1Z)@1@r;q!1~k<`;elcQtt9KJ z^G|O8ln20J4Nwpqp~CU9R`s22Oj+rjvZ# z_@gcT;rIeCiNZ%N1)PxA$dkshW%?=E@bjk@HlD7jd;UDZ;v{N9_Tvb_SKFZ1B6`5y zX8lM-NbY(glyl$+u8#WQupEEG-ko>-IdIh?+_p!=5H_>b3qzj!RGGu_ujyrs;z(jaj*kugzTxzQ+`H0Ew!Dj&lSv_0qV}U4y6x}|26tCq zR^-a43dY!g^-|Ww*OjMKH`q=R)5uik(958)3}Bmw@5(IbE}FTEE*gr?#LR!N`y_R! z)PZ=7Rm6D3`od1RPH9=V`#Fys6Vzry;X1(99)b>>!os3?Q6DhR?B9y__*F7jz{All zjB2DJ`0T72jeHBc>3AS5N)XH0-6yD9CMSGrUIN3FZMskZO!R7>q5MrW!HuI^JS^3e*!j87R2!xP*4v#)u zKyP*Zb<%P)cosP1$H*{{_biX?+%Ev-MWZ8MQdtv=JX&inU%Yq$1Ke(l+c*bpdpwX2 zkecmcx|8jJLoa8*HfdiQjPPvQ6;xB*D-IF83_(`)%VRQmFS?w0(bIsCquzF<-N4QX?ws zWoL{M!{WkP>jgZ`H#k~deu;rxFr@0y`^|3buob<^z=ZE|v^I-2lGryNletYwMjy)1 zyR9rO{5UV4WjA1=&jQtfQRLRy}2$7nCN1`p;OBna>_KS9Z>m&xU8D<)(hO| zgG!|@-|ln=GRR*IOX-&v5f7F5h^%ol{{4%eXc_YvBi+l2uihou7SmX9BaWS@Eo3kQ z2FNfC3b*TD#9GkPH(nI!+b@*lSp1{1K9BxFUR06Bxn=I&|B{G7o`hlg=&rAG>3P{L zh(`N$ofB`dF?%g(^h!e#p1NbFllFE>iNd+%>B7cMX~LCuM`pAz*eM0fpx22GgBaee zJZSm^!VPap5zZjuugapkWmUwB91j<7t3-53g>~WIv-)C*5D^D~F=4w7&LxF<{8&*s zR9L0Na(@@E)LDy#MMDWCr}ZJ0j+xE=8B31$vleIKOO5G#q;2<)_9P)i>}-+X4pfM< zqB4fsFYO5qaa8x8qY>F0aIqf&t>!$fQCjgo#%&TYppU;cC~vnp6+mLuWYg=JG;cKRbhUrr}ot1gd0xunr|-ps$>(zHztR*=y2+C=<2*=zeDaV+JyZn$?* z#H43Ga6fHlQSVi1Lo0zTSFDCc*(sYvYC_-jS7*NuKr1wFqS;_!D4-FtGMd*5Dg!P0 zS;%s4i*o0N7qd&wZCJviH&Q(deKF*6Le32_p-GFg4rhBjLAPnS9)7vGU@AX^8fb9t zFR`-I91da1c{2OO;+a{sUtZno*QnTi*d>jzdjIaaM!nestI%chihJC=2^hIX@R*zv zlx$S-v1%z89*{%_pI`3`24CIo18p)tQNwk>?8M#n1f`^YgVIS<4`}0;O&4BYz6x}2qFsou;&$A_8aXP>Vq8?TJqNcx0Wse#ij@p+&RThhQ z6Gqb#l1|VxV;wKgV+U#n9$>C>7-%^=hk|C&t)L8z1v6QhIY$vAS)&=>!bW$wzwD%h z$8Zk(E`cwE-T@Jqp}%Rgjd7WBW;p1pfpJnPIt`?}JKG`)yu`bpT1H^$g)`oDFwfPn z{ykOfZz&%fL7OcYL(ts^SL$gHW0=nrCgvW`NU)LTut^W=%(};Nbsb1Tn_y)kMPdrs zi5g_7?%uqXzhn8&d`Buu4b52a0vX~NzJb!JpXfYcjwdnIs*L55lumo^N}PXgc1S8? zmpTw|xBoPL-n9u5^LNey;0}S?773T9lw-0jEa)z7y#f0kcqpYRSS{2(ielFUs6lyy zab(+$wFc`P%r7ZM7DMIAK^hS76*o0+h9%FH**(Xpp(MosE91VIqt<4g;`>dDvk3{@ zG=n`&cK#n(&EZDu4x8tXA7?(h>-?dAI?*Gu>+O6urd#&ql+I4=ii8c%ELQkEs~Rj-ORBI@I`=a zYLBWHjWQ-fezfD~Rz?)S{=zd-re*J6`8fMwAlqm*@Kio?l^LaSBWce=`$dZsXbyke z-l}-3m%V9tJmJDkpjEAo?mz2JHhq?KTb|u(@j(p9@Cosg4#eN(flX~JUxtyfG3LaO zpY8&1)aa;*){@!OSayrv%I+ia8%;CBn z`%1DJdpNW@s)#o(`Jp1F*?km|E_gDI3YIj__nL-kuBOGmZd)y#HVAn@@oh^;O7n93 zKyRf@@6_!#?s5*2n0$}#b~xYoqiq=fRDr1T?y-1Zb#1bD)#pf|)Tr#DjQwnFPxJDO zSgJ=>WRITT`uX_|mHf@;JmJEvu-2#M^m@0$g~LbT9Wa~lJ0+h&0=|=5>eM~>_Wd3+ z;|tXS`(BnRRf|5YcESDNI?U_Ns{1)n1Ivy_j@7A0JBtD*5>`w5$9Ex3L&dHVj=iZg z3hTwR@UR%3w!^v{)=tNEL*kd%kf+4Q`)dlx)%STc0$4C1PYp~I7F)a5PSnGa_ScHA zBT`CxwRiHr5_!yj&Wk|4fRp~}<1S$@bA~zUmPTNS(?~hpE^0p2X8YzPD=uEr#Wg#oUh~dy@DoklN=9>b;`x zv_~q6Yi~mmy0)yXpDVHD7-zmwPLA3`Y&B3NX=L#qE&psb>x{JJFm0nV8Quy~(%7y$ z#1FR=NsEX`m?X{5oBggAk7%{5_apyw7<6}~lDThdWqKnT6OhE&NB#``6C8JNN<8b5v~<>QOTjs=-G zRLirLq@a+(DO|5uKf6JIPxA6gt&$Nt-8|o~t)>(W?O)H@PY|e$Qqd$0vmMp4mu>H3 zb{#iAMpd3)U3HxHF5~g(kNtiKnr{7q165pVE{dCw*oGe{HVaU2$+|<><)yD_hzY7C0 zamTvxLRTO_;H7gxRgTSllsud-7K z9PV~YHyAM>Pc>4JpU`rHe%=tAjj; z3>)I0p(!Bp2~GIPfv|u+cn;TB8wdpE<1)&0DT3PVoq_R@$n%3fX#~}8g|?AyWK2!9 z>8qvG7JL#&ZJvO|&#;bF4J4v9`AoN~A zBIL(QRPiBk!rI;5u{UwEmyT{6LiEun-Yr;$MEJ-$~HQu1FylW-#_{)t# zohW0i`GfPT5QyTd@i9?&7(z>Hc-WBiB^DT)w{ffs>yk{En3(l;*U6qLHKn4{xxeA; zw8b)a!WD>!VN*Cz6rTh>QN8)CoPI5caOM=9M# z4itqi<|;%l>F}7>P10zusd{H3w$r()r*k~PGC$MJp&lYMaEd1NsU|~WB{%-=EJ~D?IW!LKbc%L0cy#bg3OSet_{OHZN2|W?6Dbe4UU7mCMQ$8T?~hDcbmr!d~}r z{atfsB`N0ZX;Oa3goCgMXNYw&fXtSW%9cRAn>CUbF2{y=ps&fce&QQgHaUg`5A(5R zN-TAG?zULC_r4u{&L>8ve%n-w)p96&{I{!m(bCM{qZ`ayjx@r}U|GWFyt7|+nfiR1 z7I)jp)7IO54Aq2s29+dh2nYjFdOYaRDrF?oI%6S+<%-*pl=Najp4yFh{_%AV*v>do z)~%`h0f7vB0uftf_8eS53xEM~e5%oXWY8TG4jsyWBlm87Obhq}k>^Z()`md5QCMN-TT<_3bL$qopD^hNl_?c9krBTcb%c{d|zmuw(>Nr`f7e?9Z3BxPb3Z_Fw++ zozR4iqO0SX-DZ>obZ`R@>Dt%TqwrLVNI?_@gFpH8yTECs(tNcX=-)(IUmF{6eA#G^ zU5}rE$S`p^<4^%HX0qXi?TIWwr;B2Gq~J6e7z6_8uJyQmIZUmR!`ppb_LD)M9dqF@ zXw0}utH4+ZD~HBf?{&0j9jr4d6hX8OgQ^eMD@sX8;j&|TFsQPW%=C2Z>+8YzG*hQ7W71$M;cIFN*f?&7;$hwepUgsap~!;r9w`vPan zMAl1nDQGcD;p5}aosA`?sAQ1DV?t`Dd3kx~8i*8R!tRQ>zz9W4s|W9a%N1Fh5WLfl z^o&{WvaC=4C5zvEMi`AAd-CUI(tfH&jQz@EG}#kOcm9r44)19!C|Vj5heN1ve8Qok z+mzc`gsk0LT}S9~skaMgTo{(uN<~Y?Hg@j{iafI=fIxzKU1hrm9nIE<(Ni09>hfgq zS#yp-(yKSdpv7T31R+SfE63df!VL0_$aOHD$J9ULA>-D?KMlCMxW1zS-E)<19c{AD zYqwZUGtk-3#;2-^clskKzTwac>Y-T8>doYx^)Yoz5(q@RCWSTG)Dw}Xq2E89olw+4tNAzPCDtc zWzA_9!abwIlKnIJ!ADZ#XD|0+0tI1eAW)nnMY(K#OkVu7X)6Gzzw6Fp*xl(!Rw*XW z6B`c2!XcbFK0oO*9k0xr;D$il%WSMPdKoGM$a*S^)-y-N_~4J2tKgd3O9O2_Jio_V{+c^RBZ3` z_u*=eshpXuFq3L^E|0s_V%@K@IU2|(sH~lx;O=NNaXbd3He9X1K%Tnt{0Fpkcx()5 zIkg44KF891n|7`L?ggN&hlk0!x}wREK>MVi!i2=hrpPqPMMZ>s(P(JsQF2}Iu%G1dDk+B*hy^GqO()Z?j82ndPvX9ncZVKwAKa_33j_bKt&WDBN22+|$&>LGOp; z<+w_|7<8APbTweyFFPyFt(3A)hpM4)iL!|9ldZ3n$5(mKSuX^lo4%}GV6ZYeaFL*+ zzvPjY{C~;U=DoAbjVjTp;u^1B*99Q$mk4*4`LLIz=|z8N@B(`WpgSXQ_Gns;eEDa3 zes~#~8!-vtfh(m1P-zMnZhP$~XW6Kbva2V|74M-H6{fKC5jeDq0~WPM5HJ&_Xm*EE z(by=neSW;^*Pkhp*Gh{3SP~sPz0bHmtD@v$iau$)Gyjd0C;XjQop{2Dv$snY4-zCR z{fB6e2aZqq#p^U(%VO2{OUz&q&=|pQ$efpDyg4s_A}q-vwGBUyztQN=7qdwkf)vG3 z)TCTVm6;BH1h5$3ZapD_pn>@nFgVHv;-cvC4++?60>+bxMIt zLUb!vMhb-CsGh-y6a$*fs}Rok|9k2bq%Rm`mu5T!=N&#hJgO_RyJW0}_4hXA#UN_$ zEXHG@X?@1(_RXt@oAwqR8$Hi{CL;T{|{CYUin z0f7Vw{Ox*cBdo`RXv;QosM{neq?^N4y39Iu&yPMJc`LpEv3mH;uSDyFgewZOfJ6YE zZ&xpII9XDo4B|oUucDKNS%Bv$go$j_N|4{V!&r*0XX$HbeQ{9yHY&gw7@;SObM?jl zMSO>2-&8!zUp()==02D=l}?im)f|l|Z!-!O1 zh`=&fguwsMhpxzpY5Qd5-gGcP!TS3mEULPJV$~LKfjqu)=c}Cc5}r=1qkj}JP$16a zEWu=kWa;iIaGM58Av%>w2?7cD5+#Ly7l_=jf0V$<-c$_fFJ5$Cm@puSA-?Q8lTMYj z`dlFeD1#k}HHL-rZ5z|S@_-9e?ga(evMtGmfl7g4q}Y`0VyXaPTipLwDPwUp@sI)c z*Oze_S>hs9?bf%|Va!B!kxxMsvyUSZ^0tRB^7#w4=>HL8(r%S6!EC2{#r_> zXrADJRvxRFyc;n(qpEGNL%|tR($bjVTeYWzGvJ2ct7MnH?x{jH1)524&?hgi3x>#v zSKY@60t{)Drt_gMk`?H7zh`A5DKym9df@>FR2 zWr=u=%Wlez8+~C=vMlpJ*Q+6HL(66FRQ$ zj06HS1^9Qt-ONR5;r-n`616%da1)C{k%oL&1dCWbFdcBvQ~ck0k~T`jN5ffihLDp> zfIgD>cXLV>IuWw*fIbgD06CJxgX=A3s+B#!#}5SM&w3SymxRPsvdt$F5?*@qM?O9v zgF_!440`|fTN`4I%Lyk8h+;*^M^nuLSo(F15(G9eJ%Mx$k$O zvuXO^1is&(BraOUWu5c`9tAbXON%aVjLn&ZE(5g#=KqEJVY_)?y(Mw1lopO)rgOL6 ze1FoPF-QFJDg=N*u|JVyS{p~1YBo+``oKx`a<%VUfXb!6t&btK`imIc8tfuLPEEo7 zx20SElf5v~9L?>Wv`#mLpPhtVJ=~4HOdbsps;bd_h6&*|-8GCET@H_a3WE8Om2h=c z5L&#bT|-4SCcOS{xCDO}FCN#Y32TZ((K%5Vs58W!r{7nui-4PoAmOc*+5cnfJ)ok< zx@h4xM{rQdNu`mTBxgqjY@%ezC`it!fhOt*qaYHn~`V1vNNq~UvbIbbt zF3SsgnuKtbx5A@bLgIByU7+Oku~k+HElUz+G7YWHcu$$hcYh=AT9__MJh#4AGH5hvagfC3$ziYew8SuLUwxM;+G3x41Il1A7 zTdxAvN6Gip9)j7JAQN&cpYRe5fRU)8mZa6TEl#lubXisqOVZOT}0F}HYJ)M*51mMJREs9e~ zP6st8Y6?-8hjpy~vBe&_oXEoiF5A{7@73M4l-#OGc4$3eu+CyLWgx-|O*;~-2FqCR zsDmD!9+WAJn`CRGKw={bY104lIOn3zWJXRhuPNs6HI#p%@BEKtrGemXRhu-OU%?0Sfvm`ED-+Sme{tqor-i4DOxJ|=L0voL0PNCqYTKQahtcmB37 z9Yc~HFXma3OJ_zlOC?+Ck+y6=zd_;nzf-CL!tS+{C@@3sHJoVdBsO=;cA;g;)Ctnb zwNI2YdQF=VOzCQXGeVMc#S0%WFosEoSko`3yg5p+)=L}!DP11~Xm+$_fZCG&%|j~3v59d zqC-NOX!u)>MMTB)Vzn$Eux+%@Dd;wAA#(MveB7bxy6?lEjE8aDb;J z4b}9$y%Dkqbg|`uN>1NZ&KP}SdXZ=y+g*2?z3C{&j(AB{kxM>TEHpGx zoJZKGAn}@ICENBRJ%1<%feoPlAC63BYRgHizRlS?jK?FSo5GHcz)brs_e1$1n!P1L zmMYc+60pz8BKsr30}l93B$d0XYMoS1>*{Lf&vIP@D7D@i5w=}yHz&^q9?&BFj~Pji z$BT5($!O^R17>^G9LD2)5JH8>MTG|<37eSFVj=K)LedjT7uFM_>JBk=6nJK>m!JQ| zruMBZA^^|alvPubHLSE7(vr`9j}Fnb=io-wAqa!jZW{i9918Mc?e#h?Ypmp9nIuBR zfOBePtXzmZM}T1d!8&l@c?><>gTNX)?)0M(as4v>dCthy%ym&WH;?P)e2H*Z}*70Pd70OOCUm2VQ*5h*$EEJb61*^}X5xk0wW36vsF(EVGoE?NiXvQHg4@g86VYVe8OClVi4u z;LWR{p&my!Y(ZXs3h5P~P-0KcCUn*NIJx@caZ(NYF5Y?1eXIsb`d5{+7>|!yht}WG zFDkBY05m-8HeUj;TKl~K)lqYuj?#Ua2~51$-#amVAlV_%HKWCAU7Sr#aeLPsm$UR^ z3-#T-rd>Fo5JCLfI-X|Kvg=-iH&3HVX8e>!^-m_Y*W_ekgC9A1vRt|(!=*GjEU63J z-r6O1PQTiMr3KAi@!8)z#twQGvv} zCn8S=geo0)4!G&)XT~{gub0|GreyKwYT?S}>@(|Qm^)MZ4(Q)Qn#Z7t$yoJtGC&g) zG$}$?14O7A+jX{yNI@oi7C3g?zwNPj03-|^t3y7$&Kt;drZ&vn))HGH<1$ltd~lIL z7Q}~Ri3v6ak_n@LS^AiEJFgE{O?z?yOViav(}ZJvgBN_akI^4tFK=>9lnxbOEq83^ z3r^cKM(<&Xg31bTgdWS@LTknPHm}|x5lksHHI>EL*?D05$Fj#nz*zf~t%M{|(3X^G zUAW_H?NM(;>#0dxTc+*xt)MNMhvD40b8h2D{_EXQM8=JQlv1W=U`i9DD`LE~8#<1S z7uZxY*`SONrk|s&kdd1^3naw-J7bK{9sjS55y)>{9IC7Y(j9jH zuM<*ecblpuwapwn?51S1a)JaFO?R}rPrK)B>ptw-9ZNRdLheEa=waAnOP!6MZatB- z<&FQ|49s#yjwT$9h&mdNKdbS^;|eBfoFO<3%mSJ4(Bt)srI9~MGdK~lU(HsZLZB*} zTJ!&$JiKC1=2CdcGIjgYKE@Uxz_$%-euhex+shCVqHe*R70*y0JX}i#hqS#W)}}c` z*M%8mxotEO+)bw0XJyf#elqMl#8JM15;Qe-ErU|k8c(64Nd;Mu7Y3pfVg=4Rglu8w zLGUG1GHjnZTI$sC1Em2!LA7yaj(G~&XH>cU1(QD1`M@Juz#J#)?Qsc;2_$Tq+UkDD zYLA5s0(s6QYu=*hdk>5P_kS7M z084g-fL-B#gH|5x)E1)$Ra|Zbo$d-*J=!g!8IFVD*~>6_h2u%l%5~J3tMTHRKUYlR z4(2Bi_F|gWIUGv+TUZ^J-;TJ^=sJeSP34!<5>zt6A$kp=K}?K}!*;7dyaU(=WFRht z=f24A`I3c+C#D%nS_P>CYjVpJj0b}RJ1F)W1;F5VWs9SpCrsxVsI!Xaee3X(wjjLgyl{#O& zKoqmlXKfU6JYKx9UZ=Sa2dAzXOfY%Kf)F_Ncw*l9lsC}7!l8WjJlOG{Q3@SD_m(T& zuR+F>k5OK+r-??Qo1*^iJnq#*_tgJ;s-iE|4_rnII*3zwU2K0z9;B-;RBmg?bS+EJ>Y#ZclO6bMGVm8r|l@mh<2Kz+uCv=>h#RNVT zx#dw)pYh3fhFC8DjP>5YK=vwr`GVtyXkLPj)oqwO2{5j5unHaX z<=acjgYK%{Ttvv_f}DgFPIw0ILR zNjvtUQpwUYsm4xE<{WV&#!o;*?_O}6!D5HY9mC)uRw#I-%QAbJ+5DH_KnQ~@inY5~ zVDjgvQKeJKnDugxrR37vp!fwj8mAFy-`S^6DQY`9BP|UxbSSs3Ptx_;YNYW3WVu^) za6=Q*8&RQB_X5T(Ra`8wb0!r&P~=ug!YHH&toQ-DF%iL50RN9VVwUqAff~3FDbFEV zYTaBa;q6?r9g^4r=sX9=*({5zb#)%=f;H&)8!K3AgL#E9j)ee4Xe7~UC&aE+=s92E zi^Zx`?=Q7CVLmg{={m$SQ4)nbmqGx!tjK+k!hLwhcgkVPJmCsVCOsqduI+9q z7bWWOtz-?)rS0ptpF<>`yZq0reEqtVf6YX2r}7RZESko>l(v}~xP+iei-ynSSv8xE z<};H*D5aOcnB3RV~fTejwNs<6+i%5LdJ7>g5*O{pq9P`MADE>=rC|v^;9_cerNI(az!csITq;)7XjaV7Pv2I)LCy z_WEyjOlOYb-<1DWr7k!a2d))peEMCuq8-!tp8oFH+Wh`e7pHTw@4)m#LY*1qGX~*) zjcM@aI#2xGs9;Upl8yjGUsrqG`!@sQ50>?H44Zp-#14OUc(z9Dr@P$;n^DetA;Nqv zIut&Km%K5}G**>Pz*C>*y1ouDQ!s8~GG{fwZFb7-K^FZi%5r$|NK~Kr>wudFURY+J>10=j;7?`XplYw6AQX< zjoi3DTML24#+Dj)B#2)iSMaKT3}9M)o{0I3-C{A;rajhsCc-ELb2u~BTtj>5{WU@a z!T&_itcADLL-Rstf1VwxvK6vD{O)Jv2|~FjH%%ASfG!f)@45@4;R1kS&7m;4uAR&v zD@djM+Q?8EJXo}Hl}O9u+xs}LQMT^>E-lDB>zUUF4NnAXqq&#c^lwd#crOIrK|qq2cEaLVkN6N5!gSkAw7D^gppjG&Z2lAXj^&N7Fdz5r^TFa{Y)3BoJZ@EUp>+XW|KMFKWyK6IB zq21g%#8DHvGJ!>3%dZT?o$6%Z=80)d>oSS4}r@2$k2A5ch8Sq3G9y9VwZ z-E9_7H-eOzr6nB>hjQ)NhUlZfXRu>>o&$NV2)f7M%@g(hg-3N;4HwVAI^ip~^dwhZ@VPY-Wv;gxL*x1R5szA&w#d#WYZI#Tnyz88KbFkx%JnA+i=9i zOMdH0$6IN=y20mb`5f&Gy!|eQ5K5ZxQ|Z;%{5jY!f1?CXNIhcH0DPnHBlYD*8xwGZ zCW_I(d#r#x-W-@^?|Vl@jE40s+ZTg%J-X!9YYaS%A~_QTZSp`-OkP4SprV_{(FASW z)2J|j8-u#FRz36%skyLi7pxKJOI}sNrTQpMz{u=8@SFWB1Y#=ax#kGmR8C-6`dn!{ z5!8WUQnV5I8`ITZ&#u94+Zuj}Y?UayJLWz63~g*<$!OrVQV_?TH9>gOveGK4oN920!Gzb^Z{L|Z4ejC(p(kfNZ%LzclX`^e3cWw`!gNb|eS+Z5RDyvT6T>fyz z_!GVcMnfCoS%Hl_nt(LXoDJw!LP?e~3J#+{O{`xnY9aS|4F5HV*F5R!7nu}3{^;f? zy3rb?_W`MQ6q7AxuiSPYa3-a+@^ax;rRR}wVW-(=bfc@Fst&8|a>eIi;DzMQaD+h4 zPy%+L1fp_HqctOyO`voL?G;z|(;XA%R4i%p(0uHfFC&;N4InGMmil#(I8ct2d&~lg zEqtb2Uds$%Ci8oSA238X>`^A}?1rX%T;kBGajMG?0Eh)1{|S}%s*!n+yCkF?gxzu* z^5=YtYj)gNNUUO)bDt&$?Uqft$IJ0XGr?Mp&=MFv_>&1z2$`VV8@w_XW+-w{Z7YV( z@-7lYbU)*qnn!Xr2SoCd0}TVZgb+FlsyAr*`}(HBmv1>XRE~ZKE{TLUd)}~W*^Wnr zsNUtKTgDu;FOJsa0O@8(rCs1;KR5{d25LdEIQ#*D(b5D>rE|4m@RhASK!^hP883TY z@auQn_UEWq16{PGMt^z%nn&iMtpTO+Nk6qz8=Jpv%YsTbyt&^K%%0EW3TE^x13kVS z^n(L;RY|{wIZvxk8)V2;HSM9JsUI&=b=yCt=d>N~c@(r~`6R2elIj6D ztYmr6#;%vonx1fg<`WR#@<+p94_}^AFNM_H@ba7pU?fz(fk3DS%jES{^tgja6dkB9 zhVK&OY6BH3F5vXJiY(=DfO5~iL%Xo0vxMDLYWeJI^0dOqe3I`yN?M`)kzLp7aU+#? zD|Z$}mvd?zOWpAJ6C(vVoFIxh_Ew>#WC33ktq9&Tpt>{L{cUixIHTX z2cL*UT8ieUeHVTJ@4_BSi`rPhR9P>s(PM19ytd*#ULXS~D~&=qQczuM8_+@@mDr2Mpk{ulWdjH;vRl>~$*`rMwX504JplbjP`4+j$mBxK z7&#ZHfiJ9d^kYG%M9gl9jVtrmQTNP7e4buZ&W${-KUKKX#ymqBj(OK%9~BHl$~=}p zE4QHc{;}yw&E#*^YxofF^d*x8tB!4}l62(dq~|axlE2I~*_mCH*E^UiQPZXjtb zm$s7V{znSGim|;QZjBCsMW(zyuMNXKIk`xB*6NZDLK>D7o`ZafXzr&-QVqhLtiFT@^R1Y{rmT5 zxVpL~PzRlMpVzPpTmLk=R8CUxo}2^>%iJU8q+kuZoE&{QAWpgN8U?l9@VnbE*grBD z(NC>(89gP9<5CL3SBS;&d%BDbKd&=^dhY%2-=CO|#+?P_>L1BOu{#uskh(FfDjc+8 zW#I^g?^Q`Gji|m5>e`*&AjaS3=Uoxnqjq|U+4>c zT_Ebpl`Am`p`3_$Gh0ndxvYsNlbZ4#ue%*hm>I=YNkV(%o50Aw$7BsU?-VOpOmU5N z>V#Me(4JJ04dwrvlYg`{4p(WPF6bo~wSj38s(ARYVj@Et?njVrFmh4Qt|wqII!D{i!Vw}3wGkN__>ZB2Nn1Ese+TgYa^L> z_P4Sxym`qbt0Jut3?BBE4Smg#lR_eRtwZL}Kz5(^=u2n=GpK5+=jLu}?73l}-OBXu zSpwn#X3|#hYbnXzsIl3$vsS zy0>R2Z%LFz!DIFW(6F(95*$X?m(1jJdaZ3n@ObLV))pKV9ce5 zu2K!(EgJkK(uTj?M5t`HJz`8vrG^&$enDW{b;kSmWzkgBRDDYhV2)w1ZyZRQ3Ju-j zhlGXf?fA2hKFN;7rEeRLE5KO6EU4T*X*1z|&mKAcO3oKXF9u6PTg`yQebZ{m4eX}q zrvm*%voVr=t*F&Et;cTC=o-B5ZRk>KpKyzFAb3qpWYHpe)q};Q{Z^mszaJ+!7Dhh9 z-sWC=ZY_W{@G2pT-#Y{S2~C9IP3Cw#R>ak(gVm_K0dDX=)O1%HrevG1jAp+&-oBsX z<`6sa1eD|SG*Omji}JrVKy4Ey#Pi=MtpqCJ&688XE46AjZ<(tf7L8|=?sJAr@PV(o z_p|3giX8o5o&<9B>~Sl(kn>E#+(}^lZtIzO+h{pDg2*`dTR%@pJ{W@iC&A z+uvu8*d92oI<|p}V?f7$%p8uJL#J#LM{R2?3dWgvth&C=%U^Vs_!CUle-EgnMv@?sz>oDf5mjnPS3U6K7C3MQaKg{0;2l2*1 zU1GP0F35sE!0+4}sta(avf)Bno==Nj{KwF@`xB0y^)dL-E^_3Jm*=lK&%v>&P&h|> zaQCf5ta3_x=^7ZoJJF4z@}xD*WQERU4*!jgYJ9sLHdmx;+% z+OOb&DkFj;Cq6UVhCA*@_L1-1y(%w+ikee66ck|g!bBNlx_EfdDKRmgR1_54gxR~; z#8=6A(0<7{|9q*z?g*8$fO9MnXcEHYi{1+t6My{CZ7(eu{JP=UUp+u2fFtnp?9ZQ_ zW$C4309cGTct`1|aFtb1X7gG50diFZrq|Nidi8Zm@AJwdFTLFEUyDt^R|AAL-hObn z(-m6*(qJ@hNR)y~rs+GK5%>{|n_nwOBO($!+xSo-k#$>*khP`d>d@@*F6OJl6VEU* z-UoZsSI=MfKcVQCZ(R*1jD|u=d4=VfLpgwzH1y(m8MEQpbqaa#p~l#U5BCRq6x>}* zL*OhnG3wqJ0nH1|Bz|F#fAWc0Qf{sXJh~tVYn?fQGZqRJ9vSgW;vob`ZD>S0YsA#J zD=v3Lx)5Afm-B?CCi7i!ptAC76ki<=pKvFjrd&@`Wi9jjfRLyLs>6-S9PBG0BA@*5 zB^p4J2zkA#$(pNpwkt>vopL!=%6nfen9Nv_7fL4b_f6SjZ&6_iz5MIoCdDNeJDRoG z$r^+wiP9k^)R_Ly_w%oeAzTp=>FxHYg%Sa`_Pu0=&3DH;UI=ubg|ew?>A*w6RKQ+5 zI^{3PKTHZ)BqUs4C?3~-*x$cI#B`Qhqu}OZlD%gXj*t!#4!x}Xm$m!uBMP)rE=hh& zy>YvNf`Fm1=+C;Ta8X9Y!2RFf% z16#Zv71hdM@etu#2W2(dI^A#_JyFMYTV8`KK&mwgOJtp=g{e2B;vGeC z3h)Rw8{RbZpqO3gTj&r=YKhlTkO31m`Rwl(HTQ@kgEiFDS|+zoqNr!@*sa3BL`jeq z>=ba^u{upbhT)9qX)Q1FpQ5R#25(g&)Sj!|L9CaFXXfS#oH86RFvH*f4NU5ZH0#7T zZTlsEF$?Pj@R{1@%?^W%h#=0qS;ccO!+F*$`p$@ue)As-QE)w^`)3>Bkbqrq(pN$xhLL?Hs_r(Ut5`aV%*}SWj*LA2 z9X7B%zYY}oAA9|*whXC*Pt$%G%Tut$q~%zSsc7m15OOzR_Qr+&4Dx!)E0ed4{QOw3 z^(o{Au8^Qp{?0R4@*M7h=Iu+xNKPw#hU(a}uVQmXg_BM=#*-A3@$zW+tnegw$oo`; zGq|`1ab{M%y~K%c6k31qMW3gTygI|)`Kz!aVr2OP+!JaIoTj(A#_I|52z z$ZjkOh|yy~C?w_iu_JVPoBo~_b60AJh0^axhv>#L#`e7w0+}$H)k-5vQAb1$efvX^ z37)vnw-G$qFGNJ-HMzTtv=j>uI z4^0^#yFofNWl~S^d&~8aQDyxL2+U6oiYtFG>>LPjVO~?e5;it!C=l<1KzuOie=U4o z4@&sl5u3z&&I9$%gE-2nP7_7S5)*md}^?}$LldV5j**lhWHKQbnalaPyZk< zMU3(X`U)MRSI)`%m;9hj98(Zqk7Tg6a|_|Q1(ul1*T-qH<$ksHC>uideg52>r6a$1 zaAi0+mt!P5D@eO3aPygEDrZ`D${6{J{$iP5tgc(nkdpbeH$d5jq8zQon6x%pJq7ZX z5mJbcLqt0G-=_mhr(_I#gnRT<5!6z=4+_C;X3Hbc9W%Igy#r`D)6a5i7u@obl$V3> zS+%}H-?H!6dJzp*DAd`)b^Oj0;_oI<@jfY`MePD^SCXQR6kRTlmS31bqm*zD8RD*$z#uhSaF=$B38dZcgFKq*#2rnqOzKN_W$3O4V?Oo z?JfEOo`z&T6<4JEYd^K-P^am*f>S+Tu?(*RuV-3yORv?Uk{-1bsWo|sLyi6OdcYklUoaUTQ! z+m?2^fB0)-wm|HGAh#w2JeYi9mPo+!s3CirjbF=hSSx{x(A$Y*RTq zZ&AsgH!Lz1r3Ej&w8=Yrrv3$(qc1;fPJ$zNSBEcuQKp_?1kt~-T1ZD6Ou-l5IbXKZZZtcmVk#swV-%JGeiJ^Q~$@vcym=&_7U>QPFeM!nnqI16)zkT=HH_D72HC{ z3C(r1JTN#aHtX;rowp8YF)vMu=*n1CH3B9K!Phi>^_Zg>SQ0>VH*%o(g=PifX1^0% zuTa;}$Vj>i*j)dd+KV~%`V60p7iM-3m+y`?fm5?Gv#<~cweEydL-bF6)?&HKQ!u-? zMO4FliZ%;!JmepEVGP9ez+(Q~Jr58E68bR1&&j9W%Nur$EZOOH_3R!N1QpG?8Q#yq zxxCEi7Ppphqv)ea_b7sr{!7v31ns7B9-~vxMNjctyuvXiGfRSCZfY7DrOihdJqYeo zkj^%hqSH(FgNwy4>h-s7oHy{7YWn`gc$r4aTA;q!r@3QgCu?yDx3w*K3`uwbE;Gw1 z$f-LxfM){bCn=ANj1bI-d_E3=M@vMUi072p|o8np1FnEQx}y^$$!{3J4TG z`ugs9FbZ(^fipz3eN6sYCWJsYP4=Y~$QGBB1B2`@;(;sm7i5D@@(Shov)x2W0`q|5 zAXH?t^_29(lE0gA4gw$ORy}2UM+BDY@MouAfw)6uwco8Ed9cU&ZHKe!lE#H2XQL@1 z+7r1dN9^NF&tCR_Z~e+bvNOfEMnA`M%B>Hl7849OowU{qL@1o)PR8fBF+5ll#-5i9 z&dsImSF9yBvIO~miW+m1fS>^nd{BGxn-8J#$RYFeO8&46ny;cXF~x?yaqr%t;fWo2 zSe;BY<$+HR?-&Zv`lyCZ75O(3jog}i3AD1ERjJrmHpb=(S%S38^UdGj9v^ASXUaAfqsWVU+GV2+deHNYRwC42=vQezxXZd&I;dirM(y!LD^6k{sDa- zvF=tqxZcic?Tsux>xF^*Hp8Ou$nYN!V+1c#IYB7P4T)!;24>pA;af#J3k@h7WI9B% ztMC?VCb3E6IC9}{yqY49fvAZO!sibwxsruVLzg>7#0hwi2gMAY8!ReUIrqlqO*1U+ zJtSgu$EJ87PW(?jeZTX3LLV&}9^3cXU*co(D`90w$;0Bxc%wSPw#MIfF0{I|PHs^u zIvKxtOc#OI8Sr>1TVTQ!%~e?smgd~$bn`AAZTq9QEgbAuJacl&mG!x1#LvK@vtPb6 z3J?8w7coD-s3Ip90ND+O*?Q|aj<+dk*?9~~9sGfGeE|3=_s1s<-&yZD#LQ8E*or>? z-`eCq&tZ+@*WnEa0LH+v)ynK_S4?rGnkwp!lkZMOq<0o1-yD3x)0qpO? z?}8re4$RnZQ80&d7yd;$ou_FBIk4ahlvZnH!jI3U{Ly*HDATL2>DUfv47pIfX2#8 zzw|}AheYDUlfP+c#odv3{iUB;Y#~i-2!|(6zBnCuyqcMM``{cmlPKotjJ|tB9D)TB z*gnb{&!8paL}W69l&|i{J_>A4S68yaE7HN|8h1632D1z1lyll& ztv>#`b@O`Kxz&|Lz$HOOsHOP#-+w#XKDwb(e0|RVUq+A;00@O)zP8f-qwuv^<@=sM7Wz`Is1C)I%_`-8Op+% z!j`U&hW0I8`%;V}>^dP5>uP<^!#cc$=&tBt+-r&vlvEnAOB{szuBJKBdEV7UTBTn8 zhhE3gbl!%YIfI@Y+SMje0+H%ps*{;EpF7ECn{Yh;^s#}lU|`88269eozoOCTPS=$L zaY80j?Y^e!G##!r$a!_KNA#?E2Zk{Q`ZsUNgf_ z2IyW%?v(c}7uD4Sm<3#7R8-^MBO94H1!TLFL;Y0G?MBI`Gw|8ix$%hy_c(yTp7&h# zkyx{f&m4O5Hg$tHeePYyH1juU6rhRGV%?s9QqojtJ^Gi!nwCNtzS$o# z0mY7(s>gBR+SU8!%@#HK(k@!NmFosb=vqPB2Rcr5x;z|_!6GY<0JkLgYsXOi1`shm zZXM^2y3_}Zn;6SNEmD$+5A`p?>TP&QDShB_iIRL?S=oxdWSoaUpH^*LO3}gXs`dYM zD4syYI8yOFy;?MjP@uVt=}m$6^$LLZz3Hf@`AR4~4+yBzPaLKL|Kxe-k15Xx-?|wd z`7!l-xbb_yDVSbu#b#|5(t9bPi;M^6_Sa~UwClUJUVDx?29?t2&8`5+TqW=23Z9OC zyBes@CD&UNXMXzfP_$$T@ELV$tORMq?U-QT4mU;{#pp$O9N^t&sXJuR36%@hq+A`! zfxIntkhco5ci$fpf8Hqnd3ZEB8w`Pnh&Z#lSW0h+c7AD@ID&=1>uYO2TqMT$iu&-7 z(SAi-9hJ;sfAyyqz_&Qf`e9*mh*#1bunFkta_wf9{0vFVi^M;zaM`traDQ>pH#i3t zf|c{WwzwyLeu4g(x^?o+__bs&`GAJcvt>ezj7)4SjOsm~%R8^a?B1U}vxl#HVC-G% z{j zfH(n#kHY0GZOsw5N#)Yk)T2>-qRlPyPk9D(c`_1tJ0D&$!i>0t9d^eID~DbZoXU5a z)K=~;24BURO(JT<$Fky{>#KqbZsri@kP_#wQ+Yjo&RW*4kxkc>hn+0I%B6DA#sBlm z&$mfwv!Z`KZ(#i1I`Qvi$Q-SGGHGAA^;YRv#_Zroh7K24b*P$f&Cto%*qHggfHb%n za1fKHXtVR--o1MYO;;=1`^lCDs{TgvdG8HCLc{KSl*a~*dTw6N!;TLEM@FS&de1Un zGis$7L3;$;)E;=61MXj`tWQb_zs;DMLbDy+F%!nDd^Qj2ZuPGH& zObDLN$+W>AZOJ0)a2=BSPje*-`TDGw!FTa=7p`mZ3(`M39{-ePI>U;TZqHcheHn^1 z5#0jJ=dX(msfAN(u8i;2;}P%qFG`1iwD#hKZ;8#o{lt#+n0f7p@W|+3QWuFlLB5iK z@?pqadnXs%f5AXMDFWmA7_C-a?t401!`r5tge!i8m!c zK&z7GoZDYlNokwslG%W+B3<4V2qkCl)pYipjlhlm`r`qE8-Vq1x9ffz|As>7~>Mi)-DK; zjlc*EIf1(jz`@<1rEpR~1c|cpX{9=%ix{Dj+-eO;IU#hgS6;4Lw(iKAx&Whg4#iH6 znHhrP$X&9&z7ZZ5$BwWtm-ytje-R`(dFiR4mZG^OoEoS+?NyCVN`mVRq&ADSXX?#C zSfPMY+8>^r8pM%Q{WR4#30$tsd@7LD0O5d7{;SX;Ps37fK$^dIDRFhmOfNou zu%cX^*4jF~DA6u=#VniJ?g2ac>eXwE7mk-SHT$B8_^yr~jB$&e0yUU-`O9%#r}N(U zP`c{z5H({S*QafXknUgitefG?p4qH~SxpxTM++Ft{x_!0$&kSWZKr)VwSr51x zzPfx7+#QpVRP(n&kV4CkHg4K$wQ!PKE4|%2@p&98*+4>QC~5kSdQDJrNF2P8#r}9e zdt-8Vzu0oKF^kK*BRAf{!s@c8I2Yz2J?4;A&u&7hX{3pM<-ow2;~Lp{ukphh3*BtF zBJ;YKu{`9cZYt(@>B`b@&DPf@4zd6;4z0`(eW#3ep#z!$s}d4VdX&p@r>eK7ZY6SA z4W(mgX0SoV-c6c#SQN=2`53jc*llzJ|2MkGZ0&*PuS}(2v#}$dF+0nPR`}2ZFi8pWFk|~k|dyI+BTWuv*Cwac*YPr9k-wydo??Jn`QexS9Sj!Kw z!?Epp3`R4rdL4b%_pz;zeXF2N_>!Skvy#`AB{rI8{@(uFAuQoaGxva4= zM0%c(+`)F=ELVs`_J}C*OL+zlpP(?KdTOD`f}Eh&;|%kjkORjnJNtg95g$8dcFxY} zg7IS}wpKPiR6Be9yKh;>bvLIv5||QkSzl%;AOU!C)LuSyw?NeU%9|R4s)mE=Cs05V zS_{xzD00xLgtG{IOKXzQ$qsb&QUd6j(Q1)z1|A;cj_<=UB4Pz1=8Qg)Qz>3BeDEy6=v~t}x$Y~uV z6@s={$0~Kue8`D!$?Y3^9u-TXg65O^&NA`0E}vH`v47JdVAH8JQ)MuQUrB7S5O=w| z;mCHJcCfq`d~V({SA8y9IO%nwtLZnM9pRhDJLBi}dy;R^u7Sr7 zjpTCXcsWM6EDa~=*x*B_IfS-5@{6Z@Y>vCEW!NLpDa$rd2|9a%)ra3UDz^8z7SOG^ zLYr#|HpL}0LW^#+v`a~A7%yq22bxp^RLIJTM+Y=CG`#^GlIbWfyqueOLj80}Y4Ln~ z>6n@`xI}Pkr>cYOJjo8rTW`<$YMX~;DQRgfA3xjyH?KoA3H}8>+`uR` zSmu>n0fG|ag3;F24v&m95h3$I!0(S{kkZ#Y)xlM#hHtWi>UC`JKlY2hVhKXMDS1|Lu@nlqqGGEQlHj?|Vm(^M!`@UilWRbylE7zMcMtnf&_GLAn2Ls? z*LV7Ub@eJy1nU^K&0LG%)DFhlqK7?=H2=vn|6BT`v9h?X2}+ z8RF>S!#;KX7*X5cxu?*g`Pj4nb=j=XQHiDf8Z0v_KP@Cg!mj@T(OQZhPSSpj zM0$@2n|I*zjW@FTGNl5@=dtRx2y}};=>%2=xxBQH_`@dmttoOwge_)mU-?>iCTr_f+gQSN>pXyt zp39Q9&z1wLI&u34?pv*i_@|bdn4I{b(uDP$H7?A-Qhd@HIcD8i&wa|9Mqq|F@%Xiu z(*nm}p(Bt&7`nYle8o~al12a+PYcVUE0-gfKyh(ydgb_8s^c`>gS^7R$76eWdFBSz z#qc>_)Jp$*$I=b zL<<*lcPR#$WkPn_k8Z=QdcO`krZ&(>gihJ7@C1vOMaHh}@k2t|$g{rOrq+y^6_}O? zl~+=XC(GbtG(R{0%%D`xbA%K4R|JXpmy1RZA)$k1%(%lg3OavWARzQXs9T?_*j~F@ zUJVRR^7f~=nJ6Ve$b&WXV2RhujQ&Xhj8*lZ!68v#a>L}MyurhPJIh@AY4H2rE0QVT z?LjmoB>Ronu^w<~WRXUZE2FejrY18q`C^ExWW-);jkf=kh>8q4e=6Vm*YVhOMf~dd zvq_$#o7F?aEV$5=+34pZ+dZP2HI5yk4J(GxSy{Z{&C7N)Tc+XR=+8=ej@D+VjkF+{ zxShdPt}g{1w#+N>JHyE5ZfH2@P?-xJ8@;tpch1*G-*YW7eLW{I^Hpm{=Lp7o^}{+G z0YvG3U5IxQq^ofPwz}RwH|ncvCiDdj`QVT?04k)n_b1c^acT%mYH6Z$%;KWsObF$r z`)sHB8t~E&bAi``s4Iq{z~(M?-bOiNjiwxk+!+z{><;sn$bW+*0e*7y(@KCtyX+ZM z>T)ys2ujL6Ea?Rvc>=ixbfE4tIt7hYfE z5}6(@D|2mV5`8?Rr{_;jY%`>iRuDuDzaSS?voj{C?4-7-yt7xnP{SOHbwSVFD9$Sp z;M;Z=n|CP>7C|-_^f>pWOJud?RcO;!?y3OMMYmptGJARhe^k@C?Tj1yl=3?~dAZ}` zhc8)@qPoi)Edd?=vVM)Xz=mAFI3!!S9FWk5ybtaU{J592)E>P3n2tVZi)g0eOmfE8 zFAr6|!gC4=T0m0;IBH${`}%KEiH6uKLLeZd^OLR^yX< zEce!8@C`XSB1LKesY%-GwTk2ezedcDTDFpsk^=OYjkT|D0900i1?{%6rTKXB_2-)$ zS}ub;GfZHm&&_zwhKC%iwdVCED`gY@jnMR-j&@ww#${F>%uWfQi%fCton>FYJh||; zp(!pgG$Ln;t)0qk+~`MqDDubll4Om-NG`*%M5%Vp{^6G3>@|av9V`Q;Gdt^c*zughCReQTNWBk)i@^ zON$Cdgtdb~!pY zmuZ*UlG+6u#69_5C@>3>Q} ztyy~dqV%#8hus54J@D$zPDLTE23yVtk0${<0q2NzN0=luw56@(inU-bE@;=)h>?wH zrp!@ArRR}R=|Sg?>mSsSefsp7gY4>OT;%k*`Q>GvllnWiKBK8I>s>~LE6o{T_YwLQ z3~&BYhniEs!7csZ*1f*oB@N3w9h*D@5|@4K85ji{vRXMWy`%(zP7}^{pPj$=N`wLG zih@xbPh(@VIATl8z`dFvL-v6#^V{^^hu?sNR8*fty*KafP79e8HaDMpAzCxE)DM_+ z5fBb8)?;bYjTg6WY$mRHQBnH`d{R;E4(4(E`4lr2x;xR~m2`}p)KoJlRYHSua?w6k zT^m2micnFsNr>b$$bFTb*Lis1+AE|`a9Lu-&TZym8ngaX`n~aggC+TdZc`y$oD+T{ zdE7sL{;V{&mt0&kp)F`wL`p{fr8-C93_?93Lc7Q{^iR?>Ye!F|F@TFVL{DDjAWQ?y zFwj`|4ZZ%2^C@XIJN71kciOqxp!~h6SzWtQ`|jaaNZ)El(^?Yj#P5HRkR-WXn?|5P z?kTY%v@05BnpwCj@nAPYNv{Hz!++{0H7>7*Jg;0^vV4mSKe^(q>a5=IVhR!3lQsun z1&#GuM12$x6!2@zXJEe@h`b-?I-C4dR<>X77?sG0nYUK0t2bbs* zlCGIB#(=IVaOWHQb0MW60o#b7$*yI+%3`Ovmr_kMUUxw|^n`ICk@t6JJ43rC9roqA z=^n#G3;pw#1id#tWqK-=7~c%KK4IY2yFvF#_tq_sbmMwo*U>z63s~->)tKJ zaUu49qt*1hO)3b*&Ra^xzxe=J)r@TwXr0+IZ=JT*w(q9|K1}qlZOvtMkC*71XjKK7 zI_BoKcJ;mGcyQaxIV^*_qGhYEs)&h!ZOC#3o+)VwSTvq1C5dM3hZmTtJ2u@RJgs4a+B(1KM7H;i0^71X%bfp_dZr#h$`FIh{1t!2 zeXM+DZkqnE)a!UQF+#wz%+-BnJIB8b+fE1C(#$9Z+~qIa@85aSPegHT@4{XI4UMLz zIyDx6S7RavSA=E9Abx%C(0#hSl=N~mWPO3-KEwZL1$rytY^rn=q3`Q{DQLCp=j|Kx z1P-{`hnuMfxvb$M7Q*ekU_aUMb#-;ch@-&GSCeaIL;Xvjq8Z&{vAy_VY$a-Jrl-W& z*79HyOQ{0MuW$}DOl+s*uai4n9+UDkU?2lH-=|hfK z0Xk&j9A*6lQR@Djh#}9#9WX(i(V#4ucX|n*|U1i%`$y`Zj1bJ|DL9c=l_O; zs5)3=!ZWrW2DrPsLu3***?b^b{XC=m9Xe$mOT>zL5dxANbQnG$@CN9w6bxEd0B9sH z{6waJw8*p)thul`yba!jH1ICun*afSDpgu$)HD)ejwX9Qu<`I~VY ze95jFW+;O_n;g{A1z^#=$p9VTVk?geL}}2kr=D_&?X>aCV7Au-=4Z_$Q;qh=RKLH< zr>XpRU}0@GBI?L(*ppLu$!UQ2=xA})49CVL=G|NV_|2RBt{q#-7lV_nZEYIJQn`^4 z&g!lGtfqKLAt4GXOer@4y?!l#ukaIh5k9JkPI&o~)~;36Qs69Gd&I-x@-p?!0LyZig&JC}RO zMsm)anWx-OnR^ZwmzI>kFMD#Ev)*~M{(HaT#k7)!Nj-j}{An6c`8)$3(!kP^Wrs%h zt$g$k7X^!bMvQ)e7}o#G|7T_peQuJHzbm%!R*67c93BdaV#*}kF}Qz1=-+0tDhmiyfsT+=F|Y=yQ?9ZxbD zRC8}^0g!gyR@`9~r*k-*+cfL>!|rf#n=vofc(v`F_@COFvw7jt)N6v?2i;1WfrB%fGk-b6gq|@9YHw##lGCfBwPKAFw@z9RxN#<#v@}O-7f;p% z=*-8U$ag(rtlYNaewTig^cl%!D{IT4imv#rO6DW>qSmy8A0nXGC%Q1z700jG#*$-Y z5AfsRd@VmA;c`-58Q!lj(>&dJZhLvO!L_V?7?T$o3f5hUg|j;cSa(!9*1%I4fHoO~ ztg4>g!P?IH9sx=x=B3rkzd3!Hv`~N_>K};8bLrL-yhUj{QvOu9!alMrn$MvI?s;f}`2h-BvEPSq*jD>Y|YyX7zg{Hlf~I z2V&=gWL#ziSA}i-oN3qx&-UyW8~72y;f#kn2QP%(ZH8jaF@}4RlIM31a&vQgb2SZy z1KhCzNjo3I^i#Qe#C-g~I&ac&4UZ1l%c2;(=P!fAXE6x zno}ls1O*Xb9}d|2rlM*RK|w)ror=m-X!zV_Rp9iZMKsP%6Le|aO-qHE1&#Wv<}uyF z?hlI2s~_+vfKyHWN68^- zhdf$$x>R+DO3$OtS{$7jxCBAb7@vf050FZ-T1^5yl9X1hp@{(Gr7UQ{GK=3%t1-c| zK+;0_>NUEo1Vj8IWtI5dCF};u+@2zB1wmBV6c% z&N9l8)n!bBuKVH7EGR7j9>iByyB&_Y!=iQ7WvbFnLs8K^+o;tHowT(Bs&HFGdwf0} z#v>6d??x5QYxnj3*4pW&*3JFHKoMqEAsKu%F|brPR4;rNBqZR5jamGLfFY^eYlu## zelaA?OsmQx$F6FfP73MMhZ=a6A)S~=@3qJkCX0$na3j6UkY;}D&i>9DDFr}KNx0!d zRnvIB4#qz$441_~6F4vZ!dur0wACR2Z2gm=W>@a3lY}~Q9(sOdk|G=s6tT`2U)@uF zPyA|;k#;^?tRpte$NZo@7+j4Qhk##r@`glg_qX1vFXTpN|2C6v1T5MwS4q`<&7EM$ z{c|fg7?hVF_~^-@U!kTEEQu<2-PG_DHGuF(gtlWF;7x9n&?)w4yTVwh#V$0JUq&3; zKl;4;_N}TIAm{4Xni5`7@p>_Ph0*=_^LYuzYNg8u_+(!9FV8?OzPY`aGEfOjaOdq};p8Q9aN0bqul(+241#Ms)n*}VnSkyQm%#tn~y-!Oga zQeW2DA9VYb)o6V6^4#ygof^0UP3MGK0lrT4QWpm*9khcpZk~>T%-$S+P~d*{O9ZD3{?8 zbE~7j_n;NMU;E_tXDCgDo;ogb$4@%qTpL=&2ZqcCJ3hp5bVPY825!BjwK8If=9uK1 z?2js~WsmOYcN>wFefI2}t2STslRwVAZ46LreLr=7=dNt&qI9Vj*Fg87#JJ-vX2*yv zx{&drxwg%NZV$6=-J2az=G}WqZ*qm5q(?>sbG55wcsn!!^mlIA;pY|1focipy{Z~T zm$vxCv?rg{q758pZtln5Nba3{vp+O8mR5K0TY*mfY<{w~)V(WcH2RyJ`vYcX&6}}V zNt=QA!%$!6V>YHt`opQM4&@7vpfxZdf zA25ITpj)==j?Wr@sd1D_KaMnbxT>x(&UV=xh(8S0nLyto#>Pe+!Nn$l)hlUpp?nzO z`^6MAnLwAn;Pg(S(92Yl2d@BmfdBMbqPg(Trigw~%EKk(&_#$+HRd!OpRJMvGL5}M z#dev2!?0Sfd-DbgXyab#hz%=8o|2{ZJ3FsKI&-97(x>bCzC+e7d+J4k1f=SK3i{zGT3k%OG^lA##UE*&JpX1%oaANbZUH>KZqJy>EvqU8>CU?VfD70XJ%*E z___RAR;}CR8XC9{Yd9T>LC|~~hIsx|?NnLw{hZX&XJ>a9)p%&tt)267qv{TJo~8y# zrmdrKlMlgm=O-Ji`pW5DmF(DUJVXDqmUP%SF=6~LgHGO@Y(4xvL(`)Ed;bOx|Nc*3 zK!3}+qV_-5EfdV1Z@!={w*PzFIz8?+dVBht;LU!w`Y(g@&En}b~( zj-Mh_2G*x8LfiJZ2(x2c17EU2t!*5hc^~`8#p7$91rP82JJe1)p_8G)w4@IV+BeUd)WMX@b}jFLbnY(U}TYkJs03mq&zv9Sr4v|9Mxm za^|M!=GQ5&jrHSxKT*;*wsC&y;01ic#u<49IS`#$N3n5Xj0#m8PkA6;4@BlHQOnb@@4ieHkAP;k*__wwe}S_NTX`PyA~(9|G-v1UX-3{C1aqO~ zv9YnCrlHJS_wdba$>(vVCXZ(R1-t8Q@l%;8J(=%uwm?mxo3^$cM44 zmeG{E%r4S5m}QF*v;h3F4pMXD*E zHPUZcx*&rT%8(NQrx*9tGo>;O2nM^P?v{?&*377CE+maHgj1DmeXr-Tz!7pIqauxk zF2Nq2rd%G)EUch5^(b>)AQnY1GYtU-B2c%!B}MLL0zW$EgN1>+QU+cR(GCFn zzcW?Cr)7RSg`AGzy*ueRsLgXVV=#4`$- zIvT8%9ZU$J@$czc>}C+TFFdz@=H2L43$5vl`FxZjCSVc)3x7`G<^4)K>i!F<>Fu>S zVK5Z4{Y#gnlkJH(8X3Lai?;iRnNT zlrX|!-~`R|ieWcIe_>)R=tj5-xAL723X{qAn0*Cz9_Q-(v_Js3PV=e?tRXc%ZZ_uMO8 zkATQ-)rhNF)MSwRsa-M+!~<1oeJi<-caJwXKp z1*`q!QkE(P?C}y-`SydTMb-gr*jjE&09e-NKM8Y3Tiyk=Kdq=J+Al`mi5;=wv#r^B z4E;C25_6`mp^+t+l_sa8K^ZmZQuqFp40s$>M!NHl>o9oyQPRq;kZ{=3elWNgI=6p{ zMvc!@e~P+JC^|f_fn3Jkq{nKy*j9&^q;V8{!K8>tD9CfZ1PyPZ8O-?&!`1O>-6+$W z`KSELI#?d`s~6Qu#x{U#HT+h8cNU{6{=GtzDR5JMGr{dM4nko2;HB1P3|aS#CT}c> z@;+&6g)xC4bYA(-rgSFHyf1nqp-LeO=GNz)s`BBCAHzWJD{x@FvwVdZ(zX$hXux0w z?Tl-A>FLi=gP;nXIn`zM2FxbdW3|v8kI!#RWkRJN7-O8y2SKy>@VHu^^UMJ#eSM$L z_Nw)UY!A3*gZz{uqwK5Hj@p|yW@h36`!KBWw@Ds)=pVtw&ckG&>4W>7+ffDAO{_d(HQYO zv!Tfu)zy-$2VV4Tdvow$e?Ke2%Far|_Y^af27om_3!mvwj^b(s%)7uQ-KbrF9uF>~ zl=Xd)bytTI5B?P##yd*%z z0h7@vn3K(}>HEbm8IDWa9(Dr;30!h4MeNaVZ4~GW=xTvJfG+>^X0r5v9~)s9>^;OH zW0=L=>)hb%yeB_zT#|GhLlS9YgJe+Sr9zs1-jXGdzlSA+5$T3ovBK_4JOEFCucikD zmG0JLR5u#|ynAvq0=H^)eqf8JOMMe^Z;g98 zYG`S}YOvY5u$$BM_cxFs2dWirsPwtK93)tEt!q>JvM2BUdH^i^!;Q};X+qcyrH#~6 zGG9`PA)IoxwKAD<@p2%E3DKaI<$I9CB;&m42+T~Qk4Z%N%O=w9b~k-(S2J{b2IUbqtJjoxrZ5XzT)gqU*Ai}ZUfFS&=tGxD(hTU@{hxWh1dNz@QI!3DMIKS zNO!3#G8+&$U%xkG%rZjP;j(4R~a%Sz{O0ydh){F0pPquBiLMh%hUcKs@;GLN8=SxS$I?*BFT_eQsL38G53m45fLD$c zpnl#3r||R^gCxU6n)=dK-@^-{UUb*Ny&Tf^78@Q!Q!?4EA zGIm+-3bBm7$*1(+8`Qm%y>HF(#w9V}4;+-oZxlkKaa+ro zB9RI(z0NzUSXJ>k(HG<)Io$u(W>UP$5Qtoe6>zX_HY0&6$}>`(%}nn`qsr1FtaF}9X2Q= z+H#pnvt!al21Vgr>uRxcA)o_{hF#mB$Y%uXyU{d{ewM=0BxxShtZ+%Glp8WvZ&BCQ z7Tetmqu`R6siY=c58W?ns`mkq+k-CuJ4^=AaLdQHRF6HrLnOn_S++(pj7RGAsU-{N z{!FfJP{V5MlXbzUVlY2j+3Q6Oe8Hp1k+?&=2?-Kac78tN?CXKSoZ5x&yc>(fpRyT4g$qwxwE2E_7wK;LTRb9 z>kPrJF9VBXSG0;-03D@Q6`I>l0ov#OAI8PgGlKe@9NK6Fb++N`?DD?>^BK(JoMN0V z|6z~p&oK-&j?X#CfP{tvS=2+JTZG&QUPB}Ph(a^FY%MT2 zWJ!1!4P@;%Qvd*_r_*a{A=3bZZH9E&4aAE%njZWndQ3c|;Sp?qqzMig8C&;S9;=X4 zJYG3PbaRb4K?VPLnv+=yJy|z1{P0v0sj_tp3M*ZD3e|`2P*h)i1YW2(Tun{wE0&{+WA+)a>2>N2HClN^hIbLPbP2uJ#79h_V5N6}1HeI> zjoI0okO63X_TR(9QTeLC_%!KVx&$ooC`IO0%07WAL>rZ^XmG8UD2qH%Evz1Av__FO z6Cy}EYI|^nm#n2moRONJ+RVxT-=ogxMZiwszqfdavHsbL8c+;E(RNOjYa?*p?0O%i zweGzEiBUPjP(98aZ3Zv~SSML5zz<-z9PlWmij0i;p(*63&kXV4>HvNm{}}{-@P!sr zG30?2hHUy{O0BwBJw-r8ukW5K?aiByPR3CPx(Hdt#liLu>_FQ3x+CP`jl?#nU(NHb z>N6vPB#lW;`aO`=y|XT^l#1d-K1DAb{MH1R$zfXG{!^fzPTxO8KSH7tCni2kf@T%7 z);UJozJ`fxxTUf|(2AFox{v>D@EvLfVDth1whRi`)&DykQD@+YsPyga&rtCC&|V+3 zs<(4?e}dDGjOM3}=|FP*H_u~%{~4Ok(a-|t1D4_huY#L4-p06l`K#<~$6?zRJ42raQYb_FV#tuM)Id;GyP`w?7JwMwdf= z4YnEEF*PV(X-JJfYNGF9rG9^t9lU>z)5v+;TIi0|l(oH*ZwVgKWEl0s|1AF=a^UnQ z=YaoE$k8T5otI?^J`j}I@WxFAP4+>7_%gsX3;0OWSa6at_%y-Ifmx_ zTPn&;hDWg5d%(@N%_K2oj}DLC=X?b00_Wf;U9Ng{1%TJM$Dil?oXL_Qm-I=EDl)1g z0%auxJTC0Qjeo8Fn*#$ykiSTH3@}w==gs(_MG1^e?{f>%`Q+6xwa>cP88S|Ka#y?7 z*Y+TN;mz60mOeH=pmCt>$Ea-&r)`a+>%otb$UxKo-CzIO_@}-_!VQ#^&aRHICr-Q560PcZ?mGw_gHMHA z4TaFNfSHt+kqNTW7?eh(e#{03A=v|k>lE~z_7~EPET=dCGfC}p0eT(G5!2F+{N)~Rg zV}x=^M!tErbbXqPpwu*C(_cAWAw45_;(o)k`}_OV%6wwsEVn4Fj~h;tM=-c`QQxhJ zZn{Y87N($JJtp)1P4=@eX@!xI5x_C<3GVv4FxC6#zv3tGIRCv5|7Z4-nH$WYhl&yC zFA&~fY?K775GXM(_4js#Z6_G*d8KcY5U5Wf`d=f@^6)nA--A)#2Z55Sra_u|v>pri zk*KMk_Gyp@gu1ZKxF?oRP}ko-9|Rp^AZqw^b(;T&&NniIAmoE6Mm~52#T6H>m8FBQ zBD-*M0n@>m_iZq%=mI$b)#wwR^fAShSC$Epq9hF{EFrjT7RjZZX>DJvUj2?KQx%Ar zdPYXpxP+axEk8LnAU|+c_+NDki1ZLerB4`1N0|yh4_hNLk8a5|g~M}hH)X7j>o5i4 z%*ZOg*-Q!{n7Yedjv22s$2^-X2LAtHM?{>N5TMi1rg?DTn_0XsV|4+#3&J8NS4_`; zQZ&0$&4f_>7(;3ieEL7wLyU;0jgq_lLO5J-nGboauMV;}bcMi*H2R=oV{;Z4SrPq% zgXxqj;!w5=d~73&Kq&h@Z2-GOD>Xq@^CTRBp3~^_pEoJ?UmXm8zx{>f4HJlql7Sf& zJBokNoWHQ#gVV~CWi9P|0c6$4V6@8e&C>RQMC|tPin_qpa7%EX+ao|bKza~iyS)5D z7fMNS`0W-XA-C?x%PZWl1>ZZl<^ul}ke8=`fKXBfTm%VPhm~g^W5jklD2QQFa0EZ+ z=E9q3nv+nD_TScBy{+TFT(vZ|QENJlq+ML)1)PGv zu5QMEjZxEY@8^Jowh;Xh0X;E8#r}Q;_?X zynE#&)HG9dR8G;ei-zYEp!K7^L}{^88;&g}{M+o*=<~Pm{>d}_!5azx5_t~`zvLqm zK=ju(RZcj&n)|Qy-_&<=s{ly>8B|MatLyZd@~_84;3kz2i1+CWey1;P5pPsxU|&Q4CPFZ&@?-)T^1(LskEJ$XFh({>+Z zfDkInE22R!(oWX9Gqb<6f42sW#%W0{fuLoHPoeDOj*!EhO#IcP-&lNbu~IK|;o9l3 zvrSOC(8JV3RT()SeTnw6e6sY$c*q$qEXjwQX^_4zC@9EU^dK4z9NFUhM4N+ zCn*4{R`)3~nfCMG_^4TaQ+z~TUFy{tY7h_2@m%=lv9s5*7JmI~lu|a9ezi!7<1pep zr9v#gSrb&q#mTAM)!1-&0lNY=8n0wW7UwpL0VcYk{y}zGmE}U6p+WXYPz*>s13Oo= zFn@=B6fOU{owcB5T1GJ8*4^_UX(X1cxN!3(EgikOxn?x*`AZZOH#qPP3kj;y9# ze{H$Is!%w6>EPKO8#S9~hqcf-@Oe1g(ehVJe)|+iK!PCg)pL-5f`CWD0=_c2clGj? zEUHu`p=JlCz9F!e4SkE73qYBSnG96=$B$R&g@=v6kgwu*=l`O_0wF^4^ID80AAf#d zq72PnLcBlbIf&Qa4IxvjT@}Y`oWvYb(EuydR2ySZ$Os(6V2a_wH>W{1WrbBt^{xY zg%(T+2wQZ#N31~>jtTJwDLP7O4IFY$9RQ^JFmp{GCjdmw2n#{#;{WP8$eirp4|I0? z)*VHiS~cW9IM`6b^s-+kEu>WP#mkR)?m3S)fD0NGfNnPW(U{L1@emYG9%j8%sOVa6J{X) z-uUAsR6>ESaF~I}lN_XfUINgYR&zgmIw|QKqJI(PayW1)gRCLNN;co2iK;iLWbb&a zbsDxQk;x^cS%1XA%F3ZhTqLrtZLWHNY|t5|dVFOUgLS$P3?Xb7EX(A-;ruoN-iYTLc%di89v*(l4By89#mf!AF>O(UE=T-%Cv(k9QGS1IN`*; zg31>89ic(}Gdlq@nc?vdnud-Mx+Thp==R!CJ4V%?aoC=%Z z`PX}2eexcAZ@$ndiWy<;jA-K6=L>#Hp4Z5G8b}V2{`~(M^>ibG_WlrYBOmAuMT}3DuX6m0J zZyteRT4u93@$;-O7qNOF;UsfOK8 zBge=7mIn5jDykxJF$w+Oci#p`wSJ2HXh%N0yzyeYPhZdOJrfhws}P=OT+$+vj71$a z>t7)PkAD=D62$~XL$ybuO||0^ZeXXsR*`DG;Rwrxo9!H(n!d^(LByQD1g#gSEWbU0 zKK|O~+EFAgufZXP!SCPJI>uXPoLEFf^+Dp?NhrZdAkj$x9BXd@lUD1In6CoiEY!eTjEVFH483lB8{w%}KkpUI1M zv#{~eGr1N4T9+U?P^fkm{vk^G3+|dw4O%~?ld(!zc~Q64c9t<;ey867qGe~y#VUi-t42JQ?5JPEVO0QTr7M*_z+oX1==@b4NUh+ zfvbd3f9~)14;`jg<+&Q!wW6e~oI-xl^zn6f?7a2Zsw(`}P+=hGLEh(M<7T$i*f!OU zYH4ZV?Zsyu9r=cYhJxTqyCjBGQ#*vk6(k&poMB~+jN=nN0pxIQ&Q|gp$52g~m-a6teYDdGR73H%blctmIVg+MuPPrhW_#|4?8hCXqIaZOLhNqdN;XFA+>G^Rk%9 z+xtzns1%rklgdEs8Qx_!kV&+j8WVOKf->RL5Z|HxSjBv7D}!<|8uV{~;`I4l#Y+g= z%WgNItUw!QmVjz>UG)nT5AT)XDRI20^*%@qwSSY=wA79r&ezWa3B_k& zvNX@SEvq<7yh-hw&qtGo|8JooMp=VBb9>f|KEGfHob`IJouAJRnqqXUu?4DN?f|R6 z7a5qe+$ns{Y2(qrzadY4L9!EN=eJf>Bb9YLUfnR7b=lzWp*k?E@T%Or=m%qSk#KYc zIxnrP19Ifi_s(uVpat@D&boCt%f+EbK|9J6C{?ll?*~i(xt~4Jr<(O5zV?Vk6x?=y z`Q;^IXjhxBC_@-4D_gnc=6!W_^|s}thP5P9ZJ{d{7aI%pX_r=$BS8HFT&PpO5I(n= zm6J-~&Wd_*hNK4jeT0mx>`)LDTe(*kt!KSK(>qxB_s2gd_f!&4=@nmCfQR&dHxb|C zVj(-VH8Fr>I%qt$V87=nJ_wmNAh*DUCWQa}80h(2}9NwVsH|?L~ zM|#w(;JbYm#8jJRrYvmSs;I%fkqiqSA;SJed3meV(7AH=R%a_a5k3NBoZjE#W|r4H zZl;YKo+iA(`@E_1TyU=OtHl+j{xr7zQKcLi8R?WzC$KO$oxVtUOG#GZ^c&E~0WN{F z|EShqlV6_F=i<`(K3)N59GR)!{$Fp6D3B95{a?5r(N5wuhwL-ocH4&55K?=x3b**pc89jF{KJ?S8Xp6t&nciW^Y9m~4> zh)8n!2^`?;GX$ap&T43=kqF%_k5KLCpHq33rxn{+hT~R+P=f z8`j0bOB-i@)4@2_mzI@HRl1*fBUEP|2I}o0X!5%}WL$gC2ffrpsw?=n8b8e6li_d{ zUS4%b+$2piY;MV2g3Vceyn4KuIu-LbV|j)B4Mnw0rlUF}Jk7xP&E-IlRiloe>(dgR;=*=wN^E z|HNb1L6;cFCaZgS)l5Ey#U%eG26gE`&c|q0J8Ekk&zFOAkU_afN@j|=nf7TjoB`j5 zN6qlcMt=Nw2O;EJho}dQpus?_re|rare=yll8ev58uiv8;39>6uZ=eZtR6+zUb%rV zPHO@%{R1i1$w*I^MmBSlFoNR0Z8&n-L zE<%?y08pe}^ZH4shshm3Z-@W;kCr510&u3eVNP zzSC!Ucpe&o^OnHn|MeHLYCL0UZwDxFynSj*oj$g=cU+=A^~C8xms=}#S>g`JG5Ehy z!-}R9iHRLL*WvEtHiu=XUR9B6E-)Iip$*!MtSnj7BDAr*=e-2D^OMKL2v%0saJamj zoP~vl$MDXAoAiTGHL!st%SEyjVt z>9-5e2qzNOR>Yu@PShp-K|y6>`H=@XQ@^-qwRhSVXiE64-$3pX$44$LgxlP2dW731 zypWePMx~E&arF!PiyRa61Pb!+I5wNW@*5d@psK37#eXjqvSdI@SMutpJ3 zmtD+|1!jc<0a|@>g&mYW{?QtJDn=B^oEbP08gh|^SG0+opITe|g$o7DRU;yD#eKA* zOc5v<*^cR*eb5i`#Hmf*nWdTcutI-~oQi)^>QVDjT70CB1F<2nT(e&gJni=V*FyKq zxLD%iz_F|`rk3u@48K6(Gv${JAjQ-pFDz6`j+|o5E633JnJ;2v2PEWxVHxt+vN(t_ z0CGLq`{_j>1spM+AR?H^dGf+}zrw7E1W?T+HA!7Rr)XGkpPyNChH3^FklTCTZBXLY zq&KtMU&2AD;K}28x(kG~%e(|kSnR<@muW7G94{TDyPcnT^E4hbPkn^b7vy2rzWp_M z7m^$rpkgdsTvDLhMErBk|B^wT8YZwr$&shc8EsA4E&bBq3mTt6kQ@GiRIB*)Y`H1T zby}!+1M3d`1p=M>M@Dl?KE4Fhfigi+>;+Kiw2f^dUTo5y{rXVj^RHm0jT-iA1LIwd zUy;6|tfM`MuS538ajJjpj9V?*4G`(5@K6sFj@FYu1>Gd5)VqiQn#09Kp_fp8^!6hU z5eCo{EeFDM)Zlo3>iYU4AiOAfKX*-^L|rAQs|O66|Cggl82b9PYE&152jKTRqK3XL zxX=~?FQLBZ3RL!u9s-M-nVDJ?ch zE%FEnSpj{Zu9!@Dx{O;-NWH=d5Komuv*f#VS7x%?{t41Dpno0S7Sueb<}L@?hQMse zwdYxvllt?nYn4A2JoC=n58N4M^iNsAe8?x?0CMmf`==qE6==pdCdgG&C}rutm!IP& zW9XAFf06*ncy{I{=ZUT^tyST4>aD8bEVLn3J4r||Uq+Ka$VaP*fIxL{Ay!;Gb^TEQ z$R2V6pW*nc$;W@-Q)DCy2ZuU}M@S@pB~$?j7Yd>CBC|a=%4&J0C~_>qn0#uD0NbyW zu)&a#AtvA~Ao9)0$zf&V;)aG;G&mPpG)4g>LpqsT7Z=M9-`TDo8#A9ZGJbhpiUW7_ zB(3F{GNRwmp0hV(NbJ{$bueydK!A{va+Z>@@B8-{Ab47!Zb;(w-RPM}dF?Ao%);kn zy++6^{6>`=EuR`~htUSV?Fy8!!G!xIHnp zwzdl@Vxv}Xw@Z%It{bbc9ooTo?^srX9_0lBzG^Cg;kYEsM;i2-W#P8pWA@933-AK> zkaLTz;s*^CHlC#NF|mz4MT>!1S#u;l`Dn0pXaGq98)7*M`)Q8$*ye~L;&nUTqogJ7 zEL>DXM4mm~Q_;tJr!cXG&~2aOmONOlhMbCbXSsK8Gk6+@b;s-D0MFCKp$x*e9)q-lv?;?Jz&C*MT)IIBi~VCCc0P zU(jX1&VMU@rW)b3l5^ZYqlwS{(-^ZL0*tn*iduTjM~Zh%FNs7Vo49xn)cdLRnW84Z z)Lm%0OO`+JYII~|#=(J)tGhefEy{)G-nBCAUG&jVt`e{m{8Ih8R1m&}gn{#9A3x@f z6n-P|pry5CXnfpl)OOB!CO$OuGw5PfthF^ZHhwYME#>EjziHUIyStmPR9oYf1B$3Z z%N0h&`l6z^_8u;Qthv9MjlH(|q<9WcFV*6?1P{|w-?woaf{m@~VJkze;_EqOD_KQ5 zoyUrk4!a4o=A&zC;l88@#+-%*1$Vr2(Z_(;$3jA0Eyvg|UtR|{aG7DN4;a{qHB*F& zr`&k9P3^nB$;Sug;$l-hqcN_&nm+qOhsTOQ+G@@9v@0_*B>jAs6iFkBe(62FE64Mt z9fei%Kn)ZFsE0xc@z?+=>`iw&Kp0bd6^9UDOri&K_Xe90OHe ze1jGXCxsR;^hPhg7rUXi83od%;i;$3Qd&>d@XE-`^Mbhbf$43ctjB$f$J9gMmsZcB2C3RBpF*0!>9ayI5 zyvi)8M;$6sy0zy|`wHGlAfJ;7ijM+14A9!H1u3}vK1DcRC>`NoS2a1yZ3p^|6vc_t zg5s?W^=R{pTjA*h!`W)X?t2(NX{j&%q-iYZ8|iPp^7c`tGc~2}*2j#e*`m(bsW-`$o91;?; zxS70v7Ppfuj+sE#qgq->H@!Ir48z(EduAIh-}>P`y1h7*by;b&1Q~y{P?qdD@>Gh; zwXQ@td3QIE_;o6*e(}(3O3-mV;Ql?*+8gZQFQD=Yhl0>_u5Ierc98A^wcAdKX2~pyHCMMpXwv|Unl*l)5UI$+ zdNtH)CpmQCc}HxkUfd@XD)rC5p8=mrtIQ=1?Y;%SdHWyBKKymJD&TCE__VyNY$TWP zn8Ou=T&KRf>YO?*Ez4k9zk+GyR!kPO$tf?Fla1yS&T4HneuVRE#TvT)@%-+MTQ_>o z+VA_X)NIDnGTh`#d~;^r$M3SxG9Q&GsO{OlNg3&uJ^!ABY_M*1Lmq7=*Jq0}Gy2Xy z6(tT%&AAwMlx|Hi9zNOMS*@QqtWO9CD7*YkP%{(55V4=!g=GAGj5;M_4LYE}X477b z4>7ouo$$ki2|S+PH8qc5>Sqgtm3xYj!BTyHVr#9wgY7Xfr6af-KuF-b_iXeq3JP;u zRKq*V;_2_-p97Ar*a6g!)VT}`2FqPQmf7Ev72q9C(6w-VX_^~gi-$WZ1GpNJ=s@es zuf|bF2N8(@!QE;O>lay|#*LYJ_@7 z-+}O$SK0|qZ4(MH>vgoDLqiMhmyfsW7`U;ZCvWhF%MX{94;>vn*cu|8;(ia~gWCCh z<5~T0t55xgx1Kg4OI^1o!rr&w_;AlpO~7SRqPV5y1#uwxVC};g z7v?|)Ib(Pvf4n==V?9zjV}3xwxg+=g+}Tr^RFW>>;NafSJDJjDB*vpx1$ds{Uia^A zUv6*@d-39hLam>bRj%FsM4$^6hsV;p`)V@oHX3#;yCwJe?BLw%mX630>x-_`yv#5k z0ryl*0AM$=bnGJ3D+{AY&&sm&>{0=_`m4j^hft#w__RvNtyW+1-5GMh2&AFN)r1Ru z>Xn5mW(sj|%bshO7PD8m^;~Mo%hgOxJ(=VUpSZrV_(twu0F7%MmM1-u;V~3mS>iv? zBg?D;p0{bQ_Mox2&y3^yqS{feqsxk-dsRn2MOXcXT35y@HNh59^B=y4m-rLiTNQnM ziVQYK^CBZ6yvM_u-_(0sbl zTK67FajbKX9e^kEmX!s%n5TxMcI>PD<0YKChwjW?%ernU$Eql|jrpp8_t~qDwE%@P zuKc>i1&;F0XBRS_$jYWXVTms#v89<_k9&OjHTxfTgx$77rG9d(-Wls(y?l-7=eN+n zPgCoMdNf$qt%RMrRgS%HkGA`q*}L?W&AP=TH1&=|Bd^ocw%!sbHr(G?9tuxs5=xxx zO_8v&vf9W#Tnp5+_%bqw_R=#l@=r0_-hAYY^efa?)lECSzf;Q?)^%fU+)XHPwA3_W zGDiGx@2Tml4?6;8YvCy*Tq0)uMy058{G^s&=lkvsPUm_4Rr6ZLV^c&8srC2x7)Wy- zVyDkdp-txOczJm(t!LfjZ-{H$`EuY3g%0zfBseo0GruBAO-U>JufJa3hjzc$hj759 zH#y@!XN383Mh|3|a@q7!?cB8Yx6J(X>6N+~55GbwP4t7uLZj2q!A(GQM@*v(iq>GT znxxT1t062npx4+qmFmWmV_bLc11?p7&wA!SMBHEHICY6gmCPwVQl<$Zx9 zZP~hqf`$N5;$)XYgJk(HBE#nJKOJ`zhWkf<=SoMF~#5n0p|O{x*1 znx4z6s2DbPuE_K&@2XGK)$r39Ui!l@`2ubaX`rs2Bka4$cDNhV;nNSOpfn0}US{ii z^fj*p2&1kuP!~FP3*tSNWTtlZLcjYNC8tC^vip-nBw!c)+S*uJtjXRA+c9}E<-+GQRKzvh*qL{d_wNHm zs~^d?|DY_V@)piwJ@k}*MBT#auA<}m`U*j*T}DPufjr5L3(d?%WXn&n-G43Qp|MHr z@!2AA(i#%EvCztZW}?wcA1Ryjpg-O-&m&@v>z9?|`TbI`0Tcyo?LRWz@!Glc!lf=t z-<8i$P*^oKKBX12dE2mA-!WKekJ%ReNZo1Z5SpUg`ug-fP`84?L7t*kF#E^~ugH{! zwIyevgsA~VvEjWruHm=uBZNg-v4E{}k%&DmNEEIBZ8`O&W3p5?Ze$OZ^IT#Ok-Nq$ z-#=oWJlE&*^HrW^L9h4fp(5`PZve7dP_Slsm<|_aU$>x<#(?1ZT)RlW;y+>FHX!PliJYX0)7!I^KL=eU~2u|$r9_~ z{K48)c49Wpr=uwH)2Dn;a;!fd7anc6CtF)#ujwj}PBk&+b@~1<(XmC3!@x#Q6J>y$ zNgl1}+PszMJ^Wju`*Y4p^zV0b7GIvNy00uQ?QOVHMN)Z9;ft)A zTDa814JR6eqv7w~zGW2?Gbl4lPLT}eQae7%F_@e06#OpExBK} zY$hEYY~^-19SKohUU`KqRZq|A+3`B zOX#O>C|oT#%aX%l3H#2=MXTb~AC)Z;B>|Th3sFC>0(}5FLMvqRJlL7IJb>-}k)2=H znRX5(KKp!5q;4^Lm;ulsL^9Cjd-v=dao+}F*gGbdBw!%yzO1aO8c|`>0Tj}N>gp|@ z#nX^Lxv;b$5G%H{&}O-^-zm;oe3^;Znl+3osy~>oCX(7Dg5?!lpBWi_2K+*51_p(r zqqIXq!>n+g!6hy5bzlgnc}@=hyP>A3R#jVKC**S@glwWwg~yR?TvS@O63<5zWob%}a(IQ@Pf;qT55m zgKk2bIiI3OTsONg(68&>ngSiowxH<`blKV;&RxPGdl-3*rymrV1fRcfsmH$e^Orr6q2VEkQd07T=ZBjQjXo#&t;7}; zMBuI7FlG(p_#G0MfSd3hEUI6jD4Ie#HY6++9M`4LBp=sWS%t`Zrq5=I1DWwUMEfle zu}2xJ$knqoi_F*?Ev~b-_C^@X-S#K9}N=LrbE%w8Ug|#|5t_Ov_SC7RNrnPRoLTm9_ z^csyQte;XlkwNd}&d!3Bd=*_j8OSJl$ymwpZsL08Gpy~K>v+MR%l*;v+RLe~xpmkgE zv2B}lfrn|ZOsIwhmS#k#n3zowwrcIhUJ1yiBcu884~lb3Q558^dVhl^D>t&JKEbN$ z;|@+8`}@Oy62~ND?t8ARDiUI|7<_Ohk|A} z7|MX)1dM)S832UV1GBDDA+#phGt;jKXg^H-R93Wz z`6ZB~588mwYzw--HONYEbfYb&yd<2HKYUmRB_#e2MB?7Yh>t(B6;G1s~*oI2<^LN|8^-lg417nlj}S2rV=n6u_9##Vam?J%k-^mYGh(;Y}i zpT1sXa_w5gs}c```v%I&g^z3NC9E0eoT`B|`-a60Sq+6?4fABVv{McBywQb+dy3`r z2WM&)+ZpFWu*V$H9W$=~8Y+rF32?HclQ;vnSwg}NVkU4 z6SIk{$+;66z6@Kf2^O_+6j{F8$)~L>tbFk}k;uFDf$ZFfOL$!CjFb_4>N%xOQo>5O`6OZ5<3IA`l-pot+l}fA=nsPONcN5#U{S zysK3FQC@DLkZtuS!6O0&xZBIiT>w?EE(;5?E)=ux}%={O#jCA&&|F zlob~t;z-<30O{aei=Ym--NEl1B6A`Vhmq08J-rW7L|IweiMwfj>Hrf-iL&#^O|>fa z0zXQ{K)q5@R9^l(OqAphh!vraYB*#BmJq8H77{Yhscml2Kg|*p62iSyIVOwV4n}9) zGY(Gj+E8}qPU-Dcl1~zn2P$pQTDZGqLWU#x8hPE~ekCuLN=+Hdt1>H*fQ9JMpbxS^ zV39yjhq>9~@8=%{0V0)dvL!Uv!Q=^y$>YCtI(Ml<88ozQ1pM zbE?JtK^h#KBF-H^p=HwYVR_BxDDE2bkM*M~^bahL_>HY}-r5N??e`>rHGE=Eee-6{ zq(q=JYLTAU-f306zym(^FJxoc`zmjG{ycJQIy-~zE%?lXd#`R%M!~*8d*+L6Yq`Bi zVcUC!KZJ8$tH{$dbf45~4KMJVbQ^uP&M7K#HoP(1e|G;c16UzzjUtf(Ym%&uO~OhY zVTYFA?$6o^GolRcc+Oj0SC>#I`02?NP`Wwk1prh0_og4V$j{k4YdD_IH2_!;03H{V z4NHuxDK0TADUX$i$}%xEGoXumA9lrgzNp0>j__iwaHBnH+MdSxflVn=$J@m#`T!ov_V@<+_AzRCd3hZYzVadwe>^GH6^G2+cLV~- z;4>k{Vc5`VqBlFtAygR=q9w%k;DNOJ!M2@zve*Fb`xNAo0MGVU6FmSRh6{A_E^yU+ zPxA#7C0=_o$Dlpj1*_p(qbH8pjy`|>{KgGkef^9c@lBfzDyo|q+;g4W(;G8;cM<#B ztLm;HbBUF{>m77xi@q}qyub&>+aJ7p%w1Vy4PtmUG5tb&zq$Pt9rNxl6HoH4HoZ~P z8v2~@I8bM*2#bve)=Z_xCz&z%xGgJrXT%4Mb`6N@qWu0{WXmhE^MA|oL}aJ$}{sN_7_$BiCetlQ2bOAk)wLwYG)h?aM)-a zujRA;?}H~h@ulLhYQ`;5U(c91&~Nwn0Y1c{DcIX`kj?y5vxZfB_y1_p98=8 z$Mo!M3!LMeC@?^qH}=E)L_|kOI8n{ra!R$vX$A2Dvf0&<>gTUfF z$_nciv*Lu^8$j1Sd5OCs(q~(E@CV!Oms&N|)OI;^b@h>5u8<8{2@piNtTW*U)7w-p znrv={(OMx8ZE<{EW!lP;rtgLe_J2HdYYtMJaq!@~sN(=QP!r25ruR1`QIregZ&@(0Cu}*r*PNAhitWlexZ_e*aclN_aXVtqo-QvdNawS&zY4uoG@0pNnEAvg z-OOjbzp%~WSbSBLp!XGa6=G^h+57k7p145XiH7as#WXNjCG-Cr|dY$5anR zEJehd%u_M)KTp!M9+(u9l+@e6S+9UT_PJN_9wSlHMJ6&O$LsPBo^!ztMi;*JdDHph zNefj*Mrx{@PA`!^l&Trjntzo~M@!e9z^G_2zum@X{13$HPFT6~BQ4&iPVv}ygYXGH zmk1HK@8nSj>Af}=_4`Og#3e27eNk$e02nRBjAZYiTq9rNaS!UOw}ix^k%3^eC#EFx zB=Jo>!@4_}J5Y^X71o)OJ-8`8{Cn%cvg7`zT*CZV0PN4(jD7PJ9rO(I9#<^)7jPf! z-XP<%Pm9^FnQ)OaO3z*vH-G~LN4qgVe>2QY%5hG}^)7a2p+!vbo z64Hm>Ud~|d^+N(EA}fteR*}0HUQL^I5+iox217?oh`7*waWWY ze0g-BT5C08c^Sv9ph_x|{cjc@xEOQ=8R_fl?%6=typJzFFh+SJD>0s7D9U#s82r4(88b=W~F)4yr9G)jv5 z`j1otkuvqnqo`Y4S*&s%)=SdQl#>ULv>{ibul`wxP@vAX`jgQRJQ~_KvfFx!=wwID zN&g`>>xqOlebYO;;Yr{)8g$JxA*5nqsWaI6`HXU{ELMd5iPm&)%jZj(-@aWSx$w=Q zTPfpF#@A{QQLOd%&$1Y^?E3x9&A%iwLxQF`fv!o}F?Ss%bRIHyp)r-4YwBW2 zeBUWq9cx5Koa@yW>nog{%9m@4+sVhKDM-$r*H7ZQa?7QtYiQ$*pY+6)1+zA)MLFkv z=EnW&PTT7pAnSZ}e|h{nGo`sFytBU0v%j}9Yz3~3-9S;l|Hs!BW${B1I!oD~ zITxzGF#$+^p>Zu!Nwd?Ujo&CqQx7bmpR{?t1u-)vv~-qm6WsChhUpoZF4r zLmBc2nV}&hXL(e*u_&jm9+6Y9)LnCOl>F;4RP*zE74|2ChP5>}Xe_$8L9j?ju5=|Z z_UhIRyX({+LxrHBZXHQrAjqEd`*LwJvx+TMqsqJ^Zyt(b(e4lKZ$5>45$!A95v-!K z*ZnP@D#iFLFv|4Ky=)BO>Hq#{G0cQ3EZn?UjqUYc?bIi%pEk;9CSFy|YTciD=C}mn zC0HnQ>;@udt~ZHIT!~4^6CDmLUBc=#?3d3EQ0y01*Y=So<|%2Ji>2;NK%=qzSi9l~ z6*+z5rx8tX}!YRk#a_G|e$j~G<)f67&xtxPfgD0*oka^?z~Xt3J0QThI0 zD&<rOX{+(TpHvj2KE8A~hPpr;dKWk61^wV6VVSM}pN9Ob6fTZ#b`gHe7tOhHb z!l0y&q}|(E{Y9#4+A4Z~Kh4cAKlciP8#`dL1T-95)eQ^{yKhD@^wkDC%3<@qS8ov3 z-_me&>)YBjtN8cdf8k(x>wTo%_VUFjkq36~6*E<0dQufX>*wpQhGcJdkO*{aE)%Qp zCY1mDY2Ne2G$~{Db*WotN274hWRx!d1@h^Etj~R!nVc1ONbRe4hLv6j-8+-t8+yXt zpoEz0d~fm@aQAb4nU%mrj?LYHh~weyt)Ruq17FIuYLBzUg}*EiD{G-0Z|kML_2Xih z6+fl;4gf9NgM(Uh_;M{iv9OZXS77Sj#LiIRk=@pF8xtokCMKH%wA3Jct>6ZW(HweV zq)<~b_+eOq4xM(hF2QlLtqUm2XU9BzqzxTERH&_ZLbr?nX1kJscTg5qOj4}7V($bR zv*rGP-yr(JmGdc&898g=9*3Waz&7(2P4YX`X z(JsNl?qVsZf(TE$M1C){f6b1Ovk>{$qp(Ea_U%z=`uv@Q%iX}XUD9`VCm77W{tyr# zAa0iLQ37MO;v#DMvGjqv`BO3gTkXGPy1eU}H0-)EN|wsT!O{5D)OIg3=Hq7mT%)%F zhtY7fiMqYpzG>T1p5efbk$xl^bEFp~aMM6tRMgaK=f#V`zPzuyE5SuerdGrCR4!MO zi)C8tshnoA8UOi5)}k$R$?CRC1moEDx((vCOuAOgxFZ^YI1Mu?le9TlBx2{_D3~oO zIF%x>Tpn``oe}u1#c^xfe!|NlCb6>3iI$<+_FX}2OhxT7k%yUPKkdH6&-i^ky;p

    uHeCk713n6>1?e&%)0(13wDySJ9j(KfNf^<*{G#wRH$Wou`=_`24b zcXnMAu1-=O12wmbkO$k?k&1)_VPzic_fXut{UWp3a;U|+mPAyp;Ma5Sbn2n^BeY8G zC|8$$q^ku$z*XmZLgMTPa-De}PR6b@ulf**6DaPuI|m^SJp9F(o{)Hta`lOI!(oPK zC4EEv;s#7?bw_e>Q{(sa#mwXkmhSV!=gZ$3RvtNaLa+VHM;w&Y?aQE`qx)Ir$^@C= zLLP)G4TION#gr@tbCS*RSU-hcGK@oPBD!!>ex_f6Je5JSLcH)`>LN6GC4-ED)s9aV ztz8m@!wEN|oJX_9wAeQ!Z>O`@=`E@2K>tBDr#c4TLGZektGbZ|&!44aWmRd9A;r&6 zuaD-{M@=^cD(%Tj@$J26VIV~E{($<|m*Vxop?vtL963{g}kaqj(RY42}SMA^vums1g|U>8yda`sTI0 z{Pp!T@s0H#U#~ySjVO6HkeXTXEx$wN-n|c$TSNY2EKg@>r|(c$e41%#K3|@jyTwOB zMH%N26c>goI6o7aARalh&sSG>OVw%gZ*tTZs%tS%-bjga@Ek`~J#D~vE=EnCK5bt= zb_PhSKAWjRmJ8>GwhTU?su*q%h>Q#^(>jSGeQr^fYSD*ypGgQFuO0n)eI9lj78SMeq`vOn zyxGkFey6~|;+9zJdXuHzZoRId@M|Yjjl<760vL7DvGbxDQeQe?TpTZ<6_t)4NVhAv)ilP z8^r=}+n!AS!2@^1MM?Wj8~BBVX<_|WGjDNvWJKo~IttfQ-Y$q5yc{#b*1swv;Ngob)Hwl#yKnil zwJ>ws*7arVbxxqq*u{A5Y%GpwC#|hLIToKgb*nws#icP;SxQgObJXs6ay?@Hw@$aN z50uoaZ+MaC=}jE(v5G#Ypvh=+ix#Nd`}dzFve?a1+(>NFW7uv;Xd&mTpv10@EbR#@ zX{^ar_lJ^A%=>;AD%A=Ce(oVy4Cu-3k_KD4Vp?gBd*unn4VsE?@01AcE{NDNrjuhn#)K+nWa31iByw#Q&kvQoe)EQ<8=QQ(4_v(KUQcV5Ot<+`^o7i!wz=uCr7BPJoWU%ka4#5-;eqD^@lC5ee)w=VK)t-1`if%wdI>J*PdN1 z{Fbddh*48Vmmkf}8M!%W)i+aO;F5BJYSVwzc5iI3X#b%?pFDY;O8Kx^PIh*-&}AMi z=s@#oulL7gOac8)Dx|M#G~7a5D&V+#zXiF{uPKqIy6>5$BowXM!CrZb2J zUOy`kjrg;%lGS^+xLw?cuJkW4D~XCGQA@o~0isAfR>YS*O+g7%vUP#?1i-WaKfk1Z z|Gghy?=FgcqaS+VGVxM|$b))YzFwuw%t}OSE5)PutEE-9X3d3+TArs8=3i!gZl%9a zvA0bJr(8L?zDWrM!dN&(QJkEnVts2>tY*I>kV!tLU8iHq%dxT*QeKhS*V;ThH(H>Q zPR8E5xi?e9QmS5Axg%Na@DDJh8zTp%9%K}7tYEv*IHl!OmMM-6IIq`5)wVLy<_#Mr zXhK3tntJ!x38;4lNtzZL8geVhM(UP+i@U#JefP;boU21cPyg>!4lTEjK?VF{yOY^G zLK&h2eMw2FOp?+M%p(vKf$>i)G9dC00+(;Cu=!>2vd!KiXUS6AStN9}S@;q2(ta~$ zhfupMw6JPg;y8rTBB}+3##YTQ2&OkJTm03{XA4)C>#1hGxE)*IHXh8oEJnp7EkZ

    R(oA`bSHz+*y%HKOYnAfN0fdpO~gdXd=#%-@sr51;;lji-nB z8pd=WwRkqJ@kC@((2#3*s_QnJvO|m~q z*gh(PUL|95S1R~5Ul?+vt867(FAgtew@&!(E4b_p5x-h9Ffa&=aH@&bfye>4-Rl0< z@Rxeb9|uF^ZUjGUyk*k;_I$wHqX#*P5jt6@-Yc<-ww%xZYzJ-;{)hju4BgZKm+GPcX{2hN~ zeEizJw6veTZ@RR%=u!$-{37>u{9oy4pFHWw?b3n0z2dl=UGd)Fxe-r?px#XT6F6^U zeap32{5(q5EPMIbU!DyO_6wSfg|@?H&&a2ie)%Y5jzMgIuGanva zK%!%j`kG7n3JQVS%OnEQT3XP-d?@w=)pl6j+Xh{W-t|koPeWn~z=w=%)Q`;%uaMGT zyLK1q#rHNb?g=R<)LCTZd>CddZoWWDn)yDrwS7*3zHBk7@Nvw&d-qf$s;Q=%3M=;1 zM<5l0G9OL>OQz=N*`768B97(mUAM-jhK|m7lhkno&9Jv`%}x=rPc1fcg^+1mm`wN2 z4|WSSkp4Ckp}Y@(I9%5K4$G2i;Id8(X#)3w9S7&cd1b@ft8zd~C<5ry>PiuBZ$gcF z4f9#fe5)pE-=#^1_3ynT0^1b{k`WnMSxnEK8L_ev`^Pmo|F{mRV7{S%-1_Fj@~t6h zEddMd`1lBLgIg(zE^RaiFC>?m7&AZ6pN+U;2&<`gvghR-bJ zc%D>YYThgdRu&~#kEX6M_~Lqm+jcXHjy@GJC*G4Ukt@=I!NDPaFI60mi%#l?c<1nm zJ{^6CpzFQfyzNX=ey$IIlyVKCe5ah<>&XAU+X&{ZZ{nY6SAmm~uEe(P!ThL(SxbF5 z+Z!x5c| zg83o@IJ_d%oSX3FUrjQB^J&PE)>|&R`|`xR!`OjapVO0=CuIDN|E_-@Sdd|4V33BU zwCLodtSoh|p^0YJ=^3g6TghkEr6Nv1^{7+~I~;rC4_5>ss%KRFkxV{qdGleATEEuI zs0UuRA?N}tq7%g|G96XxGjj*eYuvc z+HP-*UT7iLEUVb>Bp#dI*UElmx#wLtlR%y!2MrtRD~_F5ci^Muy753@^D7CzvP<3D zf$jZg!Sj>B`(I@;Gcr2gkTj|C8n1unQpwvqDm3yPA?_>Gc)+IsasM`moMz8tc1YjQ z@Vnr65cq~mD@2V$se^B_cK{DG7GyI3xm0B zNFtewDK~VP{c!CLY88F*$jXkOlXtU9ghLnSx8-oEW_bGBCZ@G1Y+X)?QC$@`%}E}@|R-(=0o z{gST{pkcug20lr`fGsB&%c4+<&LJ^8TY%wr+N?@B^=ln%#@Vj&`{1GVMyY-+oV; z50TrcGiMCV455vEM#U6&`EDb5tyM~2^?4K|^Y&yU4mEhoFtEfk&G z8v@9dP;ffUU7#?zT;@EX0|DOq&=aUH4)4h;+Z&%PC6%Ofey2g9s4%a6ZA?f5FNB5Q za5eIKmIN0ereNX01MS}JTRZ{5nlzYDCZ`g^j~^579KA(*i=neZo#zGyGSg)%_xHpl zzd68(=U}cwFw_|)IY*fR)$R$euzhAU07eGdUN8WxlyfvJd*yp&GC%p8WO`iOqZ8{( za>*kZ-{R0W5?5u!#GXKG-x3| z>*WbT8B@{EdM)i;TXT-@;z~+Xz$T_7Wl2A%eQ@gJNkuU+s(AE?ybsb!OZe4O^mFie1P-jo{3G; zIZjmcd~!-!dr41|g0jX`1|fN1jLZb}@)23oOdXtqu73Ao#9%u+;mqjaMTGr=pU1mh z*PwR6lYIS6YP0xMRFtJzGBZ>cx*I68<}K;p1s{y*nC)a7dD|dn>;Zom}?ep2PYgCpe5MrGNg3Wt;w9JJ%&JqRvxf6RdBLA}&sVnn?rP;qLB^ zfoj*kGBV*Mzikr?$m^jOS$+}}T*Bu9oD4!2tH~PMy=>4!q4t0DKi?V*SGt8E3;p|p zW>gQ(^q~ZoSe)jbZme&6hkdi`tRX|$zlpvYmJr3I8Cx$ERIAldGn-3tQF1~bHM4kr zd;*ODoSBlG%*=(q`48V`0=^3w2kh4E+w65yqpjI}??KnvoSJ@M4sy%yZL$l<-Z#d-uv5N|TD> zb436A&P%*hzb^thD&xV6&iaZO;a794J9jXu14-wDq=4 z2r>`@3CUpNNA{vV)WPW4;ODCy|2ls?l-|TyxtpbhoQA{Da^sm68Ol}Q{(a&16i{C2 zy63Xl;=(w#m0g;<%q5e5dyIU0#>Iq2fH5(*13oj{=#{eiNQM&3w6!pTY2DC@J-<%Rv7I*m%!zOPsCl-aN3DWf*d$(oUFrp z=*WpI20XVg;-aP|q@=;2i0z7gCUf%K;)2lot-(U(z8YNEh+0+q&!@Wk|K6~cd|zFI zMxitj_vc0e4PjFs*w4H;l0)!F9BBfBS~ZqS6gM}?94msmm`(WCsGKJ!k9Dm=VPv0} znI%r;JlY)Lg^1;>*8>&PEzdD7=gnbzVi00@+ATVuVk_>M8JCTH`E+kCbmV)Ey+t)J zSf3`b#@l1pdf4vVz$mqe_6Bsnmb-#{v}#OtXG5-%-wBPm5pPX#$M!Qmd%G+flC!+L z1JQ7uEj2m2;pR%`eMmIe9Ne@M3Sgm;#9Gp@YMv;#!p?Qhb+mcXG9^3aIPccnjH!-Fu_i3G{WnbCc%Jz;)9M071> zJeOO%{|8Z@*!Oj!Hs}ZBNCH!G%~YJKd>PBHx$g7R z!UtinVRvFW|Vdf#~ zN^nrGCTzDTTnAp@ww=i;c7u1JYyznm z8ylG2qJ?t9z#eunYy}VhT?>!$MU_&R}$v$Ly*mKwE+aQxbR`zhg15^ z8_%AqYt`(gpH1CG?r;BtQ@hlj4+OzdmIC{$@h#K|N7}D#50%AY(d;gN@3eodo;rRM6_Syb zH{lIg3j6Ou{+@<~q2pji_9j{4(H-$@r_eC=MKy;8%{_JP@vj zjNoRRaJeplO-9xP2)N_h^~XyKbDORpneLVWac)DbhlmRp3Q&AuAkt66fVO-s-qC$&C{4&*q3X#}589<>6x;uhr86*+c1j|$q z!mang!C_>Z5GOB>ef-*)yrWozj<~sDdmp}TdPjq5UWWf<4e9vQl^&O+=D zzZ$M0EgG$($*qX}2A6f_@{JHF4ug6^y6s8Xq4vF8Vsj!mkiE+A$Evw?&s3f?=-ULx>d*JRCFjEG2K0M~}h z6!ecABSX0Dt;vW-BP9-fQAMX zn5gpi&+r}qRU+_5m+t>IGGyV1ROQu9mFbsfRY+qm=;zLTJ$>S{7Bd$TE4o@=X48$v zx#}$fcgThT^9d(A1z-Md33n){lML6fz5pO&TpRW#J|4H!Bh~N6TBRRLyP{`vIdkPz zTL{;X$)IM={O9{BhFOS|n>Q8f9!HgMi}*k6JJ|3G4Zn@)%xs&>Jfi8uh#1Cpr$=as z_q-i@n_g?=EvF&(ETTt0u%~gd5Y?^#$JjKG0gjc|XJo|*>d^h0!n!|;tI-&dR*qV^T2k1Z1Tu`8!=wPpp9t275I9B45!{*Q03{{pAo1 zpMePV11<5*BC5=>tOmSamApt!IzL)4)Py@sYqwr@iq(xoOeD(H_m6R+?$nlKlWwF< zixx(WyscVkG8sEwFty@3IipxfJZ6)Kd%o?8v69|b2vyrzG@x?(t&DFNTj#k+<7Z{Abtnzhejk8YvLVmp3(=zlAWX7&7eNALiR;wDF5w@i_Yto82ed zjR{6hLl$PlIf6;i)*c>;w=Tug*2rsJFY89*Mi0J|crVr{M$!n{Ml~Z`h-Ugjt%k?O;!1kXcdnx#3}mU0+&Rx0}Xigv|m`&zu3p8 zxO_Pa2@i7OmU-w|QEML`$|l72MVHdh-APDkJe8{reEkJt^6QwCv=mt(Z5+5p76=^F z?EPQc5KWHpI)vZuI0rnDaz$c$Be1@>h9MsI<%BlY06+z8 zWaQM7*P_zf-<%Dad$f2CT)UtzF%>yI1`d#NhMI<~3^6ipqYf)1>ZjV@BN$atjcHHX<+NE1Uu~v((A00a1#B>0#Aw!& zTu(i)xgR0i=wUR9j++vuD9tU<9Z8uq=U{&yeg{G$M=YP%G zwafjFf5lF92quprAQ)p_5~n)Kl_vargrI&ae19X~|lWGDgLYb_Bz)eTjzkd5xzDh}Awy|lbPq0CsYZ>O> zG})zw?D^wYKv*vfRVb+TWpobujPGU>^(Lu6Qte>Qq+vIItyfUfhuMuA1cXWm*jI6n>{pd*S4P2+sMtzS~XHU1e$q zR;6A0(XERQgzt-Dp~-7^B!}q7j~~Uz@7zD;aYjk)9@gb35{*^q$;*Z?LIE5!ZMKvE z0?Yx;;r%=ODVjW+;8DO8J%99M00QNkE&FoR@aUB9wnpv=VZ3pxn!Wh<-_aQ2It*3~ z%K`dfd=>d+QZG->AT&E0TT($nLQB0nK#0z_tn7fAC8r@#;7scM$_8#|RZ{axa(CGKT5Mc@yWrm9_d{sP)D$9f{ld9( zw=vwNU!vbU6gv#qBs)588e2*$Y9O+WLX9Qm^wF7^WDhW-EQKCuvP;8p{2QrRZF7Lj zsH%fMR+AM@wyFrC5`-vLm8^mBDW^^DAfZO?roTb_e!;jbS zhHMu!23`k`Ag4caAo6@@UIH>Z%DemxR`LszB(ZEUnne`?%pG{M+RS0SO5^U~@em7P zXf*bGDGt=Qj^3o^9xPYaP{aeK){|KTNnf(mz1JkT3o7sLaC{4;I4Q`fMfkt=@EgIp zA8W^Y`t@>=wDbR5%L7;YzPq2;=2#=G1rjLOM-AuL^X1GXp=qo1J6=9K{#hRnUr=2H ze;wBy-#i0V4<|e8T2#ex*Hu^fJD6{h(F7{U3(9sC2mSgPy(Fg=H&{3c-UmOOng6BD4rD$+H=AhU56d zPu`Z1d6%OSCh(7pVrv@&SkVsTJkR~ccZ4xmYZtTo1Re|cWdIBP!T?YCJCv9fuY4SL zui6M3w?_3{=9!*1e$Bod43w_?C|cYeoroF`8G3tBwSYkttBn~|8ZZ|P@0WD_m+eWS z`#oBt+46GfdwOmURimqnisP#m2#%uNIs?dQq;;!<+`oGk))YLw6=XEvb7LUqsq&7! zPNj=DOHQ^nZGmv*`;MJ8Uc1Ppx2^BD!oS@mo7!!iMkRY5#ie)x$JKIYfg^BJ4I8(< zAN`dL#l-12`(84F^6f$Ei1KV-MCvKRn}{~~y-|}4<}i8$%`)n=xJ|QKO~KexdkX(! zzr2-bxhv`)=`#LAnON=4X;kH{vFV4+FNLa)BN2-lk5qwbU*)qvsQUj}cd1Pk*P$Ig z%r5f_3B|>{Ihu*qYd>Z1`4l-E7rbB4ZTq((cPSj*FrPF3&?bl+C%sn#(=`iKl$D|N zNNl~2fhp7{fH5Ronpx`k@)+2^%0dw-f$h_45dzQekf7p%99^8XD93YwQ2LA-8qHQD z64_;GR~Imnz4JFS&T*hzyM=z?8oyVKr-nU?wXfwa zxl}MRpCuwBN0PyqSWk)l%(Jey!p3#Do$L{?`vkv_JhEpAei<1uI{F{fQ$8PEKcZ27 z1I~}eQu&OoW8>ye@ooR`K7F_wL>y_V*E4VK@3nMjr$ez1WI}$l&>22&Wt}s%C{7+5 z;2)OwX{#27EjagiV~2RcpT~LCjKKzREMTMSiE!GT= zO2M+Ag$`^VY1-~ujxPrZPRfN8TCi^5y@Q3{qULy50SWBk+~k6gobL3S#4?M zQpVMS2c(g$>Flf{G?+B2_sTj;#g)*}A%p*9bMSQ2!{*rQj>jQbeE-q7P;ZE*PwY*m zf$jcHLZn$TJbv6X_`BTjmhN%KLTHf16hgBF3R!xfJJVCKehwqM=9tM}l;4jZ-fZK< zy6(szl*vQN39YGhBXJ5kjFFR*`K<3-af7Jq-d2Na-Lc63Z))#s0bwB9)my6A7)Gqg zs<^Rv(*5X@!@kg>gcp!I=*Xj&@}cTF=G4EjbC(Ip5Z!*lcBx}bpyR#mZly7!f726I zT$KyKlA*jO5yQ8k2SV}WYhjUk{6@2=8f$21QC_|r(aY~N-8SpEp&YTqpZbU`G))&? z-d7Vg(c8LV+)aLdNUa3u&u|#$^QRxTdR?s$egi6p^<{`iNVUtGQc0&52hmPX~M_64COxf1MTSQ2jWe z?CUZ1l07Md$*3rvwK~+)Uj~kE|9J!>YPS2&%o$vApc;G?3wUal>W6zroHpDkG1$Im zebXkYhIepGkhn~)Svj;$LMJbqdO@k+!)YsN;HDj+F#eMme6<_jF=PNh`p+`D^mYxx@&A`V?y77J^f}5*^nRez!}$BI`kI&Bm85-hj}MSFWz89Kp?6)slr12 zO@-P~p31mx#GF8@H~bjEval&AevxdZczO3F26eSuIVOpJM^|KgS)feMGiNyb9wLoQ zxllP4U(yf?*^k5sBSW+3`6{&2(=!l58tEbiw_BwdF0xX92?%csriT_;6mn>?2=g6w za)Y%x&dP^8CN5rJBpOAKXe?PB)O@GWn zissTc-ea!K*x)dn=Y?pJ6;Llc*a=6aM0A5rVXE#EPn_Lx<@zIgX}n`lv6qa9?o#A- zYck5!D}sV(E>c|`kaKl{i>=&ySbum}l%Z2dZ<@+A%qe%F6cb$*a3f58{m|F7*vzBX zFfDL|Qd4+%#7>2A(SFbr%F!xUlnvMLvaslbmxKr1mOyTkq`x2>sFd#4HOqoy^_gD% z);#Y(Qu`a2ju1yWXK53&VAx8&gnt9`+fYt9C!9Nes5O$fxyXy-Wk*R_Nsrf;T6a{)HI)xO!WoNsL z>_O@j31hd<&|+tAn6ZrWlXtUsP)xCoc3hrzwokhceFyxqpW%N#l~&~+GIZi4U>-qx z&)T>){=t|>4EvjzChBP~7!vX3eCllrIp^oErf}JrJnR|4QN&bFrF;)pyQP*_V|fM@ zVrExt=V|x!Y0dxRBfN-3(RMw(fO=fw+}oc@$}?^guE9T+y3y0jdN?6$aB!*ueaa2Y z$H&rygc5jn@cu?ya9D_laQzwJunwOF;oo+nuJQEE(*c9D(nnqOvhT?_LGe7#dd;G8 zammt_$2jL@(J>Y34UiTaxBZHm;Duu$0v(z!WY*Iot(TEbYk09l-i;>yvw~Dj`PL>j{%(~&=-XKvpWseK{2Aoctt8MqU+`#XiYo66Z?<+{((u@ijx2t2w zH7ykDwVOOV%urq6G7eetRBXj~tPXFe^lYnT)@{E?fLIG2CWAjPKuy{0CUc=&^k1l8 z5-&{DPK#cx)^dH+pfX)$pB@K7d!s}fo0_`b%t6)HtCys~Dj_B^BoeBp>7uo`kE6;` z!oyFW4yYqUq$q@9-ukxJS?1Yzr#+o&FA$iX%yuYt+%4U=xdlT^V7)o}mBf*|;XET$HpF<1QN=;GHT2YHK9&vxo zM^s&&yI;8t^#S(;EAP2w;cW->3H;*(Y@WEu)<-{sWsggEj0QtDE~C`E<~P++SOG>3acEuN8Hq**%wE9Kg~I^s0l z&GEM%dL*wqQ8i^3zpGX8`h|vAu&}KPnqzT~{g&)dsAT$^H>C!+im`Ezt2!f}JID40 z30EhhzG!g`_!Ed}YZK#Qs^-WPqtnDIUIHe}fGyy09rzQ-OueyCZ?vwhoHL-x!^tj- zuKQa4bSWD8MXnYP1tDGrp5W5nMh|;+#O*b*N`wWexjbovL92;5B zyE<;~GiNVL9!L3`=jIZx%=GsM3`O0se*~Vg-80t1|1#v?T}{5o(ByC8ri8VeYgdlo z=`q162OJQI{5CL0f-cws0(*J4R_j$YL>ya&IO^%pHJ|n-)e}|!g*AtMC&H% zfraH8>T7Efr;fiw7V5{`u(7Z4uw58nduRxnV8z}?-!{z&>3!#+n+UIQAzIInj6kfO zh%+faUMA6p3S$i@+%+zxU&SwE;~=N@(3a}_LEpz|+I&fA03_H87iSTnpy1@y=o3WY z!Du^mYbUMe$#}^!edZhm%AJbFC{}gGBEOe0l=bfl5D<}tA)lR|<5!Tr+nZ9&azN`@Xog`YYQ^p`Mbs~7M zA})e*ZGt1JcWC!}*9e4S=#A%1??A;$+5#|kqE@#vg}i#VZ(t^bfHOF?<1Qq-P|f<-8n&@B$$x%hjKg zc-5JpmDEaVaA5B0nshWyGEu0fu5XUoXe9`qtWqQO!nkbo>y?`uRVNzXQYi3}!?~kQ zk%b^K5R?NdIYf78p5jq#q`KD z-naKP6K&;Yo>#2HKH?ypsg-_V_h(~Y#-$XV?xf!<;cRZ6bADy!0)d!uA=K2|c{2nf zj`No=QMr~_4{ZW|q+WmX*L7qK$Y76Z;~#!&Xzbm^%0lIMFn#|&*)$&^BGG|VzJ-@} ztM#DC%@Wm}Ou4<~e~QWJf9BUIE1a5e=`+ zWgJ@S8C-yZs)#s7IW>SQP^z9ZHyBytoF!b^bV_#_X~DZL+CLnXPyi`d5B2K11lO5i z0FT$b39fHXPq&I;p+~1hVITt9;OR@Seuy}f^O+?=-ltyOJCw;AJoNO;suvOG{&+Fj zX@0K8F{h#n7N7OwbX}-KaO6_-U+JxZ3Hk6?3 zAAx_Jv)fQxxvg{g1G-`pv>QW=J`gn8N{C4mbd(O~AQ`sC5JKd#I$fTkB zs!PU0solBf`n*L_9lG6?S5TKf&#yHiJ$I?oPQqeAm=e`OJ+dy4(Kk*~n-GgE6v~h7 zH*&rFA??SDqw#lP0h(`VI<2P(A3cZZ+~I8N>pbm@qy7ZBS9Tm#G}Lckau^;GdgD}` ziS@;ihY%E~bm+?8^v%~@%JrqclqFt&)b9zfFuaSKTrWLOI@jYqhJ4TSH!fhg|6u>A zvZ#mvBGW!TAEPT=vXrm^6V@}@oQI$srPJGcE9_}ueXxBGg}yu!fHZJU2Gi@d`T9;0 z<0fiSN{NxqtE6Nz^X%bg1QQw>e-l_JSMfin_FCg9MjC0dIIttb%e6OKX)ZzWX@1M< zqa@QM_&^(~+=CY^L%g7J5E;a%FyY5K4C!haP00)Jw0V`!^h3g@~&c=?g9aYT@ zjjbImnUzAS#>2+kr(DkjOs-K+d7k{G1i+a7M?m6u1vH|&1t@z(uWCUMhwjUetG1u2 zffl3;W9b_vk%#J!?mOHx$DSU}-}0HwbH)5lc!D_boHP0fQNVsHz0=Qm*tw`!S z^}xzF;6XWxrT*BCLpSrKgL3PgpN>WvSOdKE4pAsA7G4i#{7c}`SoERN=Q2K)&;^cX zCRxNKCNiTn*#^aQvv}ATBU@GSb4xDR0jR$_4+bFM5G?VkjSHS@of#8=Rsn4Y@h2#| zF<{K406A4UuIk&u$fqE1N0X#uGoKSJ$f{tMea)~Faughb%~ zu1Id?R{If&x4yKOvhp?t>aBJ~b7w_SvVPNnN8`T)o(|xpG|?hD&eaDYEXzAR^N>x%|!ap>JQ{+=%ii@x(x>|u`=v^l}UT0Q8MT&9ANk9 zmTe~p#DL|d}~$ zhhor@6d$N}{s{?QCDWMRoGLhSaqXz6%XPQc73HO>*l$@wt4cgYr8prf`)6!P&PoB` zUJe602L&!*8kjUMUMpEJX`dqudzL$Z2F^v$+M^nnvgDcxAJXeEX7}n$4epZYIQb!C zCx7Ge2_qFXvk}8uFltQyWHPCynyAoW$Y#m=-i;XP96Mq$Jo7_(eCO?WCkxJZyRP2b zLs%_jho3Z_F83^s0C#iwOGWuK8`HT;)!n6ZM%f-_SCj+R_kIj+2(*)N|)W59h;4OJW( zV^KaZMk%RuR;!Ov@#e^AH18vB^dp}hJj{!J%1r8btmxl9i@R>JOi5~!m&E;57@9iU z+x>(^M1V5L$j)YVuMVI-Ql&O!SrQNy77Njt009Akxw^FQ>*gHC`SX*E&0UW-UaM?a z>lWFFSJ*i!9u+sc6QNQRHw=~lg4u;XpzKm%SH}4$)d-=x`Dfv8ua=LLCaS(vbbPm8 z%GoSu=T?vRA)*qhh22SOn3_RivbIv9{0*b{`JLtnDhb-0m4knRs#-h zjo?XigKmJ{-tPeiiZTQIe);kx*_A5+7Y^P=goUL-gMeE!w}a{d-2BZ71aI<`4~hLx zhaG5xZuO&2B!A_s0rGNqzOetXgn}dllvYFpJve{4_G~OHAG#pI6U3x^Cbp2B1(+ql4p^l9~4TQe9RCxG8F1^QdxUg$Pn0MzgIvbZnsw8;e4qH-Qkg^tR~(9 zQ}FfDLA=y&`6!IjhzWOTk*Rg!J%jYA)|jL5(2p#?MKQDOe+@z1>E3v^?K zjm4CXpn_q#p_=m1K(whSl*G9r7cSM`nd@E*&C2sq$VFJFYlL0 zZooN1$Z4YRtoD2(*J_@!!#(pEGpiqDkT--c7Bo4(jpO%_>2*dj3 zr{+0Rijt~K@1X>_a|aCRl$oS>Oor12y;B3jknUv70ZgC!LI?-RB|MpD=FBK8_%jfJxZN$+%9+ICXX z;RuCw1zO~aG%=BuT(2oC14~j}Q1r6pSLYf*<#!&?><}(%P?>SmCii}2>P>SUuwg5R zjiujCjX=Ok$JRz0{A0wB2B|l7s32xl5=@?shV^&s_4O#QKwW*^kk9HRc2!%8L&srP z?-@jj2Fv0_(h_-bLzV)azf#aGNZ=XWhl?uRj&Snw5|AaVEur7jkpWxt5A=KEzcH|y z$YLWgcD_V8O-!2ENt2srA)nO9C9Gq0lgea~gUaC7?|G^41O4T78AplBfeF(t66XHS6dwiWT>;Yg*^XE=cbo<|Jb1D*P(9@Eaay{(1e(NWcR zT8TgBYqoP}C(>yB<}?mlX(x;0>VN4W-nacP%PcqmScdkAW1u@|W=Brr{%n3997BGW z{P;NX0J|no@;FgeN**_)D-!S=Bxl8m&1rW*TI3rIdt@O&7nlItBiL2a&)lRBYkeX$ zIa+Y^+#gWtmWHZEX$%FL`$3`ynWpEBF9CNSGZS+@JC&ufIz=d%8s#yAL!vqzf#<0$ zSwRhKtf&5)xs?@WppVyxB{KtZb{ZLcMQmDey9Y=QCGIY-Uwi~Wl(2UUTjhu4d8Q$6 zx16bY#01PNpZYe`Jzj9EL;7SRoA>m*%gfa79T#|MjEp-S{rTJ%6{N{M-}+v{S7)^; zm+#wkJ@&fsIN@Y!P($&?!}55q=yh3z#QjW`MCBvP$(RQD#sbyu{x45U=cXVge=~xX zlD-&A@G{6VK}uh*&RT2x;WvCCxq0ZXtIrq3W)Pd5Gf!!tydMRi58By3g*tdXDg3zE z>)K>~hMVe{IwGLJdFG;U2w#X|UJ+fv;ZRGcT#EN!z@f`2E^>z04% z=P~p}JA)6_!LsC!1u1DokCGwc>?fy|880TcQO$raD&#z^16(&337NSn=mD`AKl_E0 zeWD(r;#z=dE4x+6Vy`Y^TK*(~p1zMvObN`7;pcle>|q(1Wg}9Mc`sa}u>W6(&`7#$ z-_kqMf!EqzPsznFW%YLQNDi|6cas1H;@++Yrb~y%Kpy{N^Y~QW`h>4Wq(!xg7gp!@ z-ei$V-kV~&*jo8(ob2R&0j2``#u~YRTy>U*KE&jyk+WVbn5Z0)srGe%7+@Gt$w8f_ z`XE@>p!6$w>~gF3aqZf88E>Zdw%%%`VM0-_JEuhKj2ZvE68uG_4pRKweeo%zvA_g_j75%YMQ^uFvx?T z>w<7MXf>cYME$p=TOfZAn@X%@etvB$B?~w6q{PCrCbbG30DYZO{8SbhYg>2xdElr< zB|D2V2!I;7UyQFpAjlW(Gw3>9-FNMr&;}99{A&=4jP>xUuMK8T6KcWtK@$33R&7Q{ zHTiWMOzp?~5aY#m8n~43C4R5^Vky`Pz2%>k>PTLxfabQOFmVmEU?`&(I5Oi|d*1D) zjM8&0w8isCQNh#-HPrCHB=TDq)rALLs-h(VpUGjBbpDrjB+$XC5h$wvY z@7mn^w#Z0N75qaBnUV%*owNIg1;~P-0rU(&al?9e3r1=t$)y#w@p%~y#&dI)hV?!%>vc0{ zN7i<-8UlpE_q7pwMWdr*>?$Fus`y2ImO6_h3l=X$?I^~iM33EX=R{eZ9!fB20S&r> zSYDJb_R!a`#;nEOzenw(lVwbA3Qk{yQFkFhBjy(Ohpss>kak-Ijm-?NV2@ZlJSsZo zHq;u)NpYa<|D6g!U@FJ~crkEjqcHYZBi^-iY{yd0@mA08lz#qoaiyr8tpA;XM{1{* z&yqc7!D*9U1&PW+!w)y-o9FAMtAe(IbtOt9Mn2?ZXEvIYK2nR+X{=D=V~Bgs_T@+a z`zCMPp_J=t9?QXGb9}h4wcq{`&c?;%XU0Otz_$tlsrpnvTEJ18Y_Kw@2}pzaVuzbk z_wYUY>lo6}=Y`6{97o|u!ks?3<_Fk1+!3Y%s^q;FO{JO>ZVOy2h{Wpk;Q{k@zP*v! zRF=k%0nPrKD8v%!@F#X#9I^WfC}#;|;t-)T>p0f?(VQw;J(fb8D>b}bgA7f(5yase z5yqS4pPh%c{@ut#{LIDN;#l#9#S?&0T8^#K7Rn z&AX=`ADu~;I zCTs~ArP>JDV@#qjhp(0oHGg~{Ymx#W<(e~bZe`DIUZlRFCIo-3pwQR|mPkZ3R-tD&@y|&+ z*zKR05k230Ik#$77|)vEYpiD4LRi4aNrMsCKiY-z8Kt_XD_l(jn)vl~Bv_O9oV``X zTvz9uJ80ETOiTpd-9030*?{=;-!^ix>#4K|Kc_$EaFsuKd|q2?oXMYBtzok@w+(ly z>$Uz><8<>H+1p!G1NaHdI7~gJ^j2xHslt zQQp7c9&3P~;aJ-fLHMB&7TrQ57W$OvyScwU9j(TUO6b*qFAF2!JqV+tqX(ocFi$WC zM;$Wjbwn(;=BS84T6EEj9Coab;Qu266z*RuU|VC@J*4UPW|HXKx4&2-j2@^mkbCHF zdkOg8JO#+$<^Q(T!keJJt5beac1OQ@_g{$Bptz?x-_65sRY4S91OULI|I42L%ot%j zAr;zP%p2zO6oazW9z5Pn#g{8A_~u1EsksM~0qg6aHV4Fl%~nw8Sf(}|`Gb;s5QI2( z(3?FaPb^(O+T{e%xMW!rz)T)}jRcd;gYYEhLGhzLeLO9Kl#DJig?IFkHo9Pq1%&!! zGl9G~jmnks@_yO90`&d#OZt?j(4n^8U(RR*w!Xoz`z#6Lv z(4D8SM-?Et-k-CyeAnI~wH|QLsn5@4(bdy43=5c^A$GjPVz5VjP`0KhZzX{6(FPnu z*)nVA7#LRF6!h}&pb&w;3>r*vTUMvcC6IQOgUueWiga&rc$_(@D~q+4Iv*%m)a0ht zhY04sRGhpp%*^wfRUTMt3wAOJd`ORaUZ-eSZ50E!sbq8`t8&G;N%vk7?UIdlBS=Jg zQ=PO0%$9O6*vC?g5S6oUZV2AH4mf!^*3X_j0w8Flj+PA6z%*j&?x#vg@8#&G-RywD zqn92SycAS+s|buEzYo&0%L=~61B>mkieg(E_b;E^L}G{cwi@3#hBM0p2cvM?*3CH# z{wUIYdiFuw0n1)F?a@2nh140aWrFO2wOKC51L((8!sSQgLi1h#$w2gqI0uXKXwB`e z!oqC^#O|!p*zhoGT>$~EBoyK6;Ah-!7y)xXQ*s~u6d~iG8X>Ck;B;4R*;bGr-lj@~yN9n6~CkoPlxw<`AXG5KfA&US$+T9>Z*Ss%cW zMXSlvT*2y5sntu<>O&gWdRd@IWZ2}>2%vXUtLBe@{3{%9;X~XfUf9YA+Ol4QgIGL* zbP9`rvaQL2k544-=T5pLg8%5KgREA!t&DEbYdgabx9sP87jg%iqX1X(aIgJH%bC7gf?&tw=-4=03-G{vhmL8UBkeMm zDN9)2kYFW~Y{7>QA3{ zU?!BXdgCJ(CU=QO7v@w-9_f^6N(1wjt>EAat6}bmI`cP^8|Z2qGnd8S_UL@RgDYNB zSh*}@>drCQgRqHZ+nHuc1LmrSaZ?@BuhCU#yV-|mxL|7pQz#I+bn;WOX9i~Q#=TQO z5<{+fvhoj(96tss{vse3&&?QO8!&N=%ytGs9pr3haPoyxNabNw{ZPPBGWjrC`>~%w z?NnYKZVq)lV4b9^ina3iUpiMNtAa^ zbs7Qlb)%}fprL3rxMce)3c8X@+JiC35^ABOVtT$uXgh z8`eIlHEnjwo!qOc){rLCB97Kh$?GVZM}@OU=YY@y=)kIEvv1V|>@P6H-e6y;LHN&)JlKJ^ z8}XCs*AUGI**x=z2cYEA-WrICoDSGmW!T!2j1iUbHHjkVRiuQuLC;bN1zW%S# zX;Bk=-T8?V>)#+&Kbarf-3i=J|N|2rP|K?!@c7$LZ@13o+ZvUIQ@e(0GRW z6-*L6?U;6Qf=M<9dbE~1JUQ@mU~9_dQ9CqwXyXFs zcHupi0q4|bS^*?41kh$|VJ{gN8TL@=)ej91Gr^Z{Y`o){Pv|6BMp?hui{mO^WTz=vqisGxMP$4*WdqMtdA~N0UIG_=`^|d zxE`uI7VE=oY~G$fKMijSzpuKvG*;`T|E8Q+ZdvGcEPJ;`qV?<7yoQE5z64ye>F~B*RV{`0 zN@tU_CA+GY@mJ=*owu>wSD?h1x`dI%UjYXkxYTzI9Y#&+Y8+#Sv`IX:XK^3p)d zvAQS9FIp&oI3!ZU%_nCer@~{T7U&p?P?EBK*#_#HwaF(rY>gay1~RS-4xF2C4X2gg zyGxM8FVKf@?rp7}<_C($sq6jTa{Et;kq1+va;;HKD^aB40XXeZ?XVz@ABOBIsTC&bpY0b^iG0Qo-IaM14DJhx4!H_;E zY1BAP&xnJu0Usbq#N8E0lDIy@SzRnXGloHRi)j`vFWE=&wDr zU3z@DQe5q^fWx6ZSps5H^^4=stVceHPp zjo#QEJs9CLr*JGFKWV7{95Ol_Pje}}Q>5NZJ#NyXqznn&z{jn8@IXVD3-Kd zvqCV11EEh&M1_L*!J^^eLC%%R#UbtJ_y6MDR^9j;zFP@q&9gk)JqP`e)8GGZPm1su zt|79*VNR8NHW1fzBPOPf@ca}!xaoD!YddAD*H%68=|4XTl)&F~b-LqD&{j#?L-)2a zBfP1Lfu>{_vv6JOb&&|!J^dIKxm7P1%txIAnw+;!a*2?8w!oX>F@L#T2I{R;3x(Z3 zU6L~55IbzQy+jbdcW-r~8k_s`k&10TdSUh%ohn%;y9!><;y3%yWNQYImsK%@^J{#p zzP9l_Dqx%IuNXPr?f8Y2UJvI{m$A0_vPE7*IPJGzvIBvP!BO9c4Tbl_o3H7e8xT63|Sb z`IQKWIaoFBDvQ>e0yt3~w1J9kN9&`mTXD(tbt_In@Qud4!4^pT8Jh z_I9AIa?&LS8*E9y_UV*>UP)6pP&L+vdA%f$3US=2I=1*xezv|}^TfjGGiQe2gz@6N z_MWYaxA)ptoEMwk9IcA>F1arUAmBM6{0*P1!`n&3=z@ZRM&f*LLb3eekymhdcOH8UhlIxIPQ*6ejVi%9g5-M|aityE!my9Z)QRJ>Ff z<HZk`Kun1y*CM<^63{rVNNk=NE|FYIW&b2D&7&!H#v zNxJ-eA8YEH;&ik}T8az-d0gnBlEv2n(hB2pJz?c?inwQ+ixQ{u;TmJur9#m{;GD3ve3Y5VqJ86PDr=I*|^}sHOJ7CfyixFz5D`4b*QUpBz^9#fYWD+ zP}U@y7>D6ZTPQ_}z~)O^&q+YR17SCH#1+5uPcF*VEV4?H`7BiW+vql;@FKnA*3y># z+pi8{E9=# z=h9fEZ}rjPjhAEhnxQ77|i2Z-804J;n+|8HVz;McmrlmG0i%UFGNF z8i1u96gsDxe#}81Y+;?3-{m4UmYR18vKb@epLK7MAD%TUFOmNI`HXiLINT**_b?_a z*0T4)nKrmnFJ8DXBish&?(;XS13S#pQpu(A|Jdn$8=G>k5IW!Zyu(4OEn_2+Ef5FI!yd^NrBY{wE`{Btpc9L7 z!qyf(PIe}7DTSa9`4aH+!8v-KPYxRuDLvGNc;)c6%+?z~jCEjj1> zeNp$--N@d(Ndiz)pBDxWWop&|IJJ_d9x9^>d%}A7*LA%c_d@$6u^qd`!u0%uZ?o7+ zS!8x9i|3X+-+2*JE=7X5XHx+uZDu67}*b9-DLJ z;+Mykr^HHC4tpO;#(IcKBYIRqz>y+})PeT0eU zd3z*}9une|M@j&OdJ=Zx4aa|M3m=ZaS($~@|nEjAKN;_x>;ddthR*6G^5~sTV;Sh_bG(J|H}<-uIW? zOUk^#;{C&aP2NSJp0GNc+UP6l_gyo^g^{$Qd5v$yzO9}lk0U8Q;L+X z2%2^UE$Jb6K+TwTg%qEd9_`_hsfqgtp|ME}oa(IPvv0KOjh{?!I8;(lC_k>+ctEld zdB@C{{~=$ok_Q(U>=kQ|n}5Qt&geiv&LN*5${;PITxO6D7sIFbRMjV0q7rkMD7qtq4RX$KaD?bSSMUFV=jaKL!?%tCh4DAj*o5Ca3 zR(*f4y685Vo*-InjWb0w)#DDMj-Fu;{oCsk8~w4|e7ugB+R><1*tNL%>1jjLayA-f zsfyu4#q$^7#3mz!eDOvOS+4KU4~gg_IS2oppx3WFxnBb1Qm~}L?yK5)BzIU0&czuQ zjRh>2sM+s_Gnb~ziroG++z?{S?DtHD)U|?-m&xN@W_2%SlXeJ5%f1e> z-TC(SufPN`yZ}_epPDN_h-74BjBYOd^aD^%&!|aLpRTalK4q6zA}mGSUjmf2p<_#S z0ms;LQRx6~u9b38gOTrbDX}oN%D$*;PRmmRiELW;IXsv*nsbpDg{S`bkw#B2I5B3V zV2gkvzD&LEaU$&JmX;1!`vGU4dSS2Xyl>z12<`2ydw4nq-vyj=iHdJf&>nq$>4;I& z$6Abk9=v9n zra+vOzHKiT{bg$3pG;aG1ONVFlBZl)egzt26KscnLGk~e1v zo*eBvE$oQ0T6&)0*dzyFbwuEjH_o6Lf#nxfJVF%hmT-5fhK2tH3Mgke{us76)Ckht z6$4NA!ah?e#QJKB>c&ja^$5r}9!WJG4TeY&if~*FDO8X20uD-9;L{zRh%a`IwP5nf z`&O`nQe|SnUPZ+gx94v-svO%{z>R3y-F;TFcC?dNf%%vY47I^#M{+K&169$_1Ta0{ ze{GqF>_L2wzl3NiD-$YNo29eo61#6avcgjNp(s5L&|=5B;rj2T9vEIMK~`-gda@hS-|i6LG1tfydGo zU0%vfqTQd{YgOo4t8F$)klP=S{{8=N%z~|hbo@`VwYv}XbhyeDyI~6M{c665~NOHJ%k*6>Gz1r964$($r z<&QozQWrcj>MDm1L9Z%IzP3B8AGkHY0U16xd0f)8zg}z9-jjk_ zmpp#Lw~uD!O>l_O1g_-cL*Q#_I(E1wYFk3t$ zJyTF|s6m~D@97u&&c4k7$JOt`fA(K%b{j$u6Y;HWU#nJ(6`X};d@n>dIsjRomB!=h z(w0Rn?*b=hJ|US?j|YBGmTPgfTjKKjm#wKn=!*;1*7vici(5Py@dR@ zB)c(kyLMcCZDpQ~`_p(6=id~*Td263at?L1W8B!99vCXET(#9GarALWKSOI9yG=_* zIes`XLPyW=RvapSyhL7K&7mQqCLb_m%I9pZvBq@;JWj&_#Uw(-%E86@MScgdq!%w< zkkh%IWI>Zi9T==6xxugaQKc&GfFKKChrVYZF>xI8vRRJqkd1WS?N673gR!PNcWxlx zTisu-$+gyqA6dDYQau-2KP-qA^YxjH`QcHq_SJ~aP=m$(Hx$`~B{!p+6?(9tAizBe^H_h>U7 zyHS5|@koV5a?pNkQB+0C$-jx5qalvYsi+Y5QBW@6?1fs`MS=%K#9gFInp8fPjWn(X zOYPOhOvU3Fj*_Dnyhexgu2MS2(dV;zedOw_I6Kt7dXMp-tv$XM8p18P(?1-?G zghHH^`ymzOFkav~Ifj>-C#Jrg0G0^{VNK$=;}G!Gi%c0a^nBg*Cq&y*#Qj& zz$7O>(Gc4#AJR%lS3LVBbNCie{AG*=CRT{W#YMe^@6`d#ld!6BToXXb4EKjIa)(?U zlS*E7E22xM=UK)3a-CZ{b>-l!{+sWh*mqkIxS`sp*R6m0=9_=Mof}G>@{LP3-LA!FL%2%xqP%(lZutvcj{Bf;r)Zg_uS;&UTboQV(!m zCir5i>&z!|Q~b)H*wg&Y*FlkwBDHMN$-zNMD($E7$%Z2;y4D7$?ykA=SbL|FmsWau zlLlQjkZ^mOcS%WkOPI{0>7V#NG0r+PlxC;Gi?!6Y^S$N?6lAe4b-&=Q*gaJ12o{l= zCQyiLT_8uez)8n>{24mOF}~`t;-XciY>kAxPoESh5zZ{W$4Xrz3Hho;G5Wp4(4vGw zvzd_Sm`nYbhuZx|HMu56MyS?zp^qyKD_ytWbdG&&DI`H@WwM&(x1#%Y>*{>g#w)uD z`y9mVH^07{xQy!B*qXP)=RF*4GJlg>^3f)VC1Bb15KmmOu-l2-?-R$8=QtZzz!zn3 zT-)Vi?BRlA(3>Fdo)w&RvSKScND_6QJ&JemtncQ~u0FU$hGl@^OlM(Wchlkic9Jx1 z^RhIl##@zT$wVQ)-ZZMoZ0ZFS5o6@+yL~tl7O;^Xt0oAG5(k{6sb_`r{vR6#f} zX0ajz~OEZu2s=x`=fCLh#jP#6G(oQQKJ_#dpKw4Xn7NZNYv-4By+ z61>Fx%N@m-gw)A-@8^>@w?h8`2$xi?iPKy$-{1=#VX&`X;*((0+3J(f-v^di!~}9_ zu0Z%Ng-~E?|I2%{zSDQzHVtx;zWz%#LwO>f2u(#i{)@rOGoZBvE(!XlrGkvoRu$AC zRb=38@5<@ugj73n3Vky9w&Lr{%*PhR)$H_c=ciCbfByVg)aQULDCi!ym|S{NkUs$^cMuI%wsOk+KZt0LjDQsk1gFXrJND$a}B;Z~@T6 z-eJN?J;dfK0n2WFUX2{^mSh9qRJ^QHa@}lud%F&QO5gV2duahOf8aU5*TU=Z)9k$T zLr;N5TuBLG-Cpmn+}bXFgN%~$vRS7cxP|uZ=e&C}xU;usn@fg61!D@2 zc~OLRf@%9=w2iegNd6zYaZ=T|?^C*Ih3vU0W&OGDHGTWAF)Msryu(K)PRWcVT;^rC zv5fQph{nn?Pf5RapWMPQsdbd!WAn1LUFU2EHxCa%ngm5QYivAy>X^!~8204#-Q}7P zEm0etWG#kpL8-I-_IK~L+ubq5`Zbf&LcG$&Kgv=k-+t&heN$Hi)I16SJM*tynURil zyW2$_rHtp7e2)o`AAg#2yrirmur=yh^W>2hhoW-Sv=pw!C4-tb%~>cRoLL`~g5q@`n6(R^CUmS0no71eQw zsIEe4fR$Fex7XRz=lpb)Y9TdqfQ!qY;L&bB$Pll_G2yw=Q@4B%Q<#&}W{*W@TyJha z!yK8%Y6AC&OD4UViNJ{J^9~F5$>N4#z-1EjKq{Y&f4%@60`D~Ag?MQ1GlO*ozP9dm z;k}EU9@Y!9K91Ho)y4|>(wM_9+47nircF(T)xCwyNTeyOq-)c+d-mN0j}9dU&j&1N zxygIwGhvit$&gDwy8nYug(J40QW`e@Xn8*KI4t1twxsJt6u-YdD%t+ybdGq_C^?e8}c;r@A}y;7hH#nIB8jd!9 zDi-@YlIIneK8^>TlsW~-QC)p<=lDfBrmOFct3vA9M<<3mr8PNKI+<9Ip^qQ`!W1Fy z=B@x* znXqy9On|;STIS>u%v51_CAQjFc|Dvh?k%7`ZrAjGmjk{7AVa4YiQOL#(c; zRzb##9M1c>S)qd;r@oMb{h}(Te51TJeZ$U?66!}@PXJpmWaSRv}d9LaJXB3W5RxEqaYZf28VB>D5d;@WPce}Xm zXM>yU*r~HDgRj-E(18q#D~i*L*kA%uZ&6>u8mdh_iOz;*2so{ZfU1T?+6$!Dz@Dve z!gmLFWa|C1@sv^4F8Vd?%6O%hGP2`7vk3rs(1p$i+StkKaWby2!jq({IWww4daSft z(8Z&r=DDwFujGK}1xo+X#Yc^*FME)dtZ+URAaIZQs&auwW2jm*fK|}#=zztWmHbT7 zoOgYC7;8=VlbSU3jdjD$o8T;3EFQ3$_g}P)&ZT6iktipWp{aqU7$nTb09>ey77&aPK zWY*Ld8cDB5HhCNxmr6i8)@!NZ_kaL2$&!J8sqJnG*+Q{mNGCg6>;13O#cB0;+~x-5 zV?ZDcY~noe6@}wgfK7AQQx1#!Hf2{gVz$(Mo4VrXUy9_PTI2^72_isrS49h)TvcOzvSm^$$ucS!3Bi^&H@7e z1Rl+XH3;briBCxQwhTRDe|3tH5|SbP!~cKxYol(dRI7Ke02_@?Vy{lRBlxLWhAMj3 zivkUU8&YUKXZAmmku0a=j?J-bfDWIC0-t}}X=$Y7tanvOg6#KC6uxiZx(KLlgR5}w z!OSBj%VcY$W(6wn-97=d+-)5yR=P;Vv8W}@sd+zLeO+$Qzo0%-!N^RrC`u`%`x^mH z>2xrl%PsBq9p$wh;ne>bMSmr}Ujr|N`QP#N|qE9T!Gz|P+KY8+` zUObJJUuH|c*!bu<+fuYruKiLa#><9cG=^6)ZX{=q;5u_v@kVi(p<0ZegvAALtlr^WZpRT zT3B=#nh|*3M-8wruHU#38V+#6h=P(rj5Wf46@>%Qe4}8lZg*dPaZl64Y>F!c|I)r> ztG;i|v#=^hnZ31@Xt!odhQn661o!`^8T`}Ky@P)gV7MDTxv3?DsJhxfUS z<&=m3pXge7Fy|sVVdgRy`WKa<+V7nn|7t{7$P)Byw~CUDB^jA1U*`RX<}_yGG!)Z4 zL;uZTe(-6U0TsKs8~Dt4b9=eN`!w6zK)ZbRSx>SsrX2Srh9@+5*!K3d7S&54-*JfB zFE7Lh`Gi{aq~u-+cpBpGG3E>m)@0h{_7-2BBu&{ynflP|+%;?8_3Ob!88XE{Pc==+Cn`l@vN%k4;5Abw`J@iygkj*opWuftijL2OUYax@({S47aVx5_YpmUuEWqHBNBbP` z?jdggbWUT)x;m*j$MK?W{7@AwIrg8K^@M9HbhtZEMT3Ji;B-0Nxy$V3t%ETG;G4uC z-7fj}V-xsPd(BmW#)By6oP)dFX6Tu@*^(GGc!N(2vUW<@Kx)_DZmSJgH1C>^mKJM< zw<(vvfz2~60-MKU_wiowHNfj2|!^dvlhhzXE@zq{%nH>y4Q6_*E4t+~*LFbtQ&ssfCvTyD6Kl zNoA&+hpdbE^4_J$A_=imgjI0%EV{>lzrNT_se$~_-NXOS%0R!3ziQB}&hQuR)`Frh zgt@x1;x=q8Kb9@*!QbfQ59fX_j!Tc{L)H4i77Rut%K{d1$eUssW^dlgKdN?yDq3vL zYH1>%DJvqjF%yJHlN8W4Nb3Wl&qSBjQ>kkP!Wz-#16(S>?rh#fo(LVALk!HrW?dZn zOt-mi<0Kuu!zNcMn+jM$&Cmm!gL4bmv1841LzN>wZjkMJL9tUp6w*F7{n-Q1`5F9F~lT zj$7JE3P>l`5j__c^D;j3nvUI2=I|P;?cZ_$N4NNGi9WPpZ*_p~K7~yd_?-9C|Hx-P zrmDstcbG~G%UaTdrQSTbv!{D4a3{Z1dfUpsmW`|1ZXgIX{TpQw7%WOa=~lqs0LFG% z*_H^o$9n<zNs{Ys&?le5zn+^am6j{E&r8n-kSqX<4!=wA+`r z0_MAH-R#G+bmp8)c~lJd_ZWxK!`wv%57`4e9ry>!ys#S%*1hrh(zsga?UokP89C!h zW7_d8={`YR)1kA;$Js&p1^7a7Kz@3YDfodpd~kN6kVj%&eV?y@eD0>?uzi{=iRA#xk_Umi)}(!~WM)S;+o+(tA{z$KfQ$v3|^faJAZS zRSqZ7M1oiE+->^bZNAWp7nrmE*XFB!ocW8GM;gZ-d|)fjkD`j^j&N7M2_l7m2C_*5 zQM~uHyzyrRz&S%(FUY{JiGGoBtnbO`liRE5@kZ>g%ux2BmUr*!=6bRF7om|^LAkfI z>N zCq8}Je4+<3ikFvP()`XSc&&Q6b*8G;!0mPRc3>*FqAV*7DUY~L!BM>uxa7W2yb~6F z+&yt@ZKp!LT~mRJ?UwPeW6xbB7A-d1Iz z%T<)_)T!pxoDw_-K+#w>c+K>Q6i;FTZ*T22{(CDJX5Lr$@}z)F@LB2G5zVt&a|__y zwwQA_uy%`X9o&4`f^3{p4r59fTo*-}ma4&u_J(kBfXKJJ%w0lA#wLn-rCRkSjID2_ zISVAH1w)w%cE6@8-y=u)tN$bOofyokxeE2QuI&NqofuivD9U})$wz9k``lEbh{V_5 zS<2*9DQ?x7_OOR7v3G#bz)kUhOe>8(0dkhI$o3}lAIE&wZ$ay6j{n{3`gYm16Tn+PZThe^~mhl|)`hx8p>T76~({1HeC4(J2%^_3rLrOYx2L?tk6+-xsN=I32%;Lftz7nnT@@jy9}D4A zyoa6fWGzl}F9Jgbq)_bVHfd!XqdKyNd199`b-Nndbk0l`7Ys_(@{DVhOWkKJel+QN zEcnKtCko-%K6Md@*31k|MMy_^k?Vjp` zl#Cx~SIIq(KywQkYIFltuC3do51mtQ9GkAb-lb$}2~Q_x-ZVDK+;{&6^apA6Z*4i$ zPdF7D9yO6#=&{I&dM`VpDZQ}E;*-|c7J%rk2##gtwdAZhy zm{^g<^VQfX86Wj4&e+5u^bjMkeFc{fyWF38?_^%|_p9)#^8Ciaaip!{p2sx^$(4ZN zCMl$_ahX4g&pGqYpVYHDQBYQq$|wXJyN`*gzHN)jxhZk;`yx1ilokbip|jIfI)swE z{rQP}UVxutbph4|{*=k%;WC2ETGqJ^z=E!>kl2}Fz}T;h0x9VBJd@GN5}-5Hv8-D+ z|N08tfAW%?jLO^_kcz85Q2i^vE~j&m43k3od7j?8NPa;cIQDk(meX}b#PKH8L&z?n zlc)vV-(31%VYhbu#&r?f&k~N`b*_R2PI59$qOkAl0T4cQ>-$_h-_|j#qnm6`Gf0tUHF4KTtrJ zOL_l=3Qexkmed{O=1Fo<(la@#iL^69(NHZw!*pw6D87^sNO8#9zcE?wX4qB02^i20 z5vM>rS0$4s99R@6shfsT_L{@YGmWH#^n)U?BA^ zxr~6o&r{+Icolezo1O0whqg9(kNPeE@hR3XQMjeqg2Er>US2$i~GV5cOw# z1E2RU$rvhhI85nLgE#5@UhP#)E#~;s0pZ?hyC%gqga0S^K`@#N(>=(Q%fEvkV`Rj) z<|3Yjg@p#AgW>>T!ha6ew_M0Cw1mD1QdYv zc1JIE=x#BJ2q}w`3iEGjsc-)!yFZ@kDg|WY$zgd`Dc3hlp71$jdoo}WJvDe9JcGld z9iz&{?sAc*ss)j+Ic-VL;Y9qGVbh?P-r676)w{l}uAcY(x^Y@#P#Y>!pj>YfiN~}b z6{%m@6tPt;D7vjThwRhpCEn82W%&R|3SYUjD+T#6KZeN9tbhN%()W|rlb1Tij`~k4 zO+-C&KNr&j;9^n9w2ybYg1_%R!0X7rkj9_*At7CzicIo~Zhj1ilv;F*jFeU-maXZsXyQTZK;Mx2ahF&ZEnG;aMdM$dOE^1 z^ZZ4oB6<0ZiuI-$4EJcA64)JZqy@)D5~BLBSJKij5m|eb%iQ}U`dgmO#CH2BeEpbH z?1WVmK<;u`i^>0XF8h8_Z`QO`5&Sg=Khd)MIr)FajH~o^>dv}r(sLEyntL|R$ax-^ z830So-jwt9zkvqW1$ufih^-pQ$V^^6!j#o>QYd!?MD&m#BQEgK!*w;#QZdYOL``HA zRQ51_L24sQTgDOWNfCO*KQ9a0xMZ;S9N6+oZQU|Be*B>K0z%+E$*aq;j`V@kkO^gE z3915lnV%n@%*-6FLp3fJ`?5THWStC0>OZ7d*?fA)0Z?!;DavAUM`I+DDoC2|*tp<3 z4gl>Kl{n7J#m}Ytu*FJ6OSSVR%@w(Bkm&`k(~Us z)vbj}ky+)rUzeR3!hZq2;OPNhQWO^EtsbuY=GHNK-o}IT!0Mesg~eY5)Gb-*YA)~Y zXCR_w&X_^Qynduj`t6&j4B|sYdXj{@e%$5l>g&?h)s10WN><|BbUp>?FA@E|YPd77 z5Sdj|^GrQiWZ=hLxX~8jobW;)&I@;gam{n>d#U;2 z4s1vjAN+hwN9Q!KZX!*01(62eQW4MbzY=;bLPS+9_a1{AQEK~onHkh*X{aXCa%HEu z2Lm6b3>Cz^;rZZ=uUFycFox)^^B{Mvxzhh8jnhD*%}zov6BKs zAMhpolLPc`w^Q)Pr^Dr@ya3e);x_}^vn-QNbh`d1lD-5|-toI!Xu2gK@hD$AG4*ep zyF^S(6lG=fYiF3xh&Z>{mYo!p9m>q9Qza7`gK1ZVB`%-5{%e3znqxi#m=Xvw`Fc6x z@W$lN?Sp8P4xaS{@-APr+AfhfXn}h!U>pAB5dcxJ|8H+I14U}<8{h`v87mHcQo(sc zdHpfeSH-XaELZY%*a{|}!HFb)+RCTe&+Y8&DACtP_0F_rO2w`NprYN61PS=(8<}S` zf}VdHX#kz_!KFPk{OFxtGa;v}X;-IGbT}oIoY5)Z%DjBjvvLsTQOXg*KoSew82Y~m z_yas6AQ4coYG>nqIr(JZKvndR{g)O%G-~@O03f12t4RLuvuE{|hdLq?os41Ca_!_H zOydlC^?Io$C`9zSWoS;H^zFw}=alb#hRnLN9NrpwvgCIx``h9rXnjUe1!{}@$QEVo z3b`$vZG3K8`b}#Fy$br(kN&@7FItHqx!9Vt zGb9*c8-a17^&O4N;$+&QluQsmeJdguF97-^QCAfd)Q$eSI}nnhC9Rvzzu^F@=|nW@ z|FQKJU{R*u`}nAft|GXKw17b)rF0vBLwA=TT}t<004vP^(%s$NA|TyENl7z=bThx_ z9o*f|_kaE0>vDmGnR(ymInRmv+~*woQfQryG#S7S3#@neZp-vSadzUtpML%W3`@G% zrB!q$U11y-P@~C}|7<%8FYR{#+)hEjEpry&2C0v|4iBeLk+$px_v6>eTvwO0av71+ z0+df{={rakVX$@Ld-rlnhq9pZimco{UaV|4iu^QF5oy=o_;6W*T^!IP!lt~GAwq(_7@L%T)cy4%K(inZJK|7@aso+?~tKru(Abx%>TyDjiT4C z(bH0kAWKVfn}8(wZ_D@JRvzM|hG)q7%Ksf6^cVCB*yN+{X2YeXV05!gge1Bc^?S*l zrIhp!;@`Y^;R0yKSepgm*Fn2J^`1p&oFO z&OU$sHCGuZ5zijH zAFnk6O_Rw=7yKr(^KwfnJop#Mfn5NWo#fyc*j)nZV8X+;1m%8a=w|>G ze;DTt9_QNgogWg|FKIh=T5uicbEs11I8|jYNNi>dX^3jY7d7H zQ_hl|5r{@zg8V4eajqEExCU^_>Vs&N3VBvbZy>RyY#7$`ik-Wf~C0-pXtq5 zK-Hh7TZ+8a6?+s5*oMj~DzA{yG0|ZWj%v4lI96D2X$JASIa@Sf)~$EjgwJJk3M$Z5 ztLV~&NwDLGiIg7mC((TN$DUmfP!0Ro01O3nlz{b0!B0+|R%1mzf;#3WCVlxo(g5n->4h=wn~fc$M z$8%I3Iqjh*4p+1QkV|>Ic%_ape!kOSqIys8Z1z?I=W&VAlF9yBl`pA~7H1hJ0AKpk zf8d#!St-~nhi^0-u$--qG^o0Wi8b_GETpKMT(FT;Lh`Nhjo>!)aGY=5hU6k znU%|t+xQ!b=d)M9bnNtEx@}Rj-ME@G?MrF*>miS8#@a}ST_#3%@)3NzhBo0M?d_>E z_wOo71mSXyx0$cg(q8iR2DQI+dnj@-4BBxjMR{a;)bxj?Zrux6;k{3&JZ)z9crAlt zBQE{$*rZEEVp*hI$FIM-?-Aw~U`7VT-Y2D|${+VM2bq2S2B+B1$;<0MJDAKPX!E0n zv(_ErYL_1B)6mk|Ys`%nr5rDz3rNqr{D{zeeyrlzgt($dDe^S7u*u5DWPH+{Tz z47$5CoJX%Y#5{lg!hWZ_!lWb2R6<%(QADpT=o#1_kK^3U!1byGVe`_>!-5+7=75Bi zuywx*H}&b0sS5k~Uk{uGDC@R63U){5WF5$sI-$`uFg>;?A^YO}jT1Sp80n)U@$jeS z-uedKF;J1+Vbnlq8%R3NxoPb(>cBs9t>_Xjh=)FaHbB%uI0APCcyQ6=lXe-UJv0rE7m|vh^A8&7G&?b^a zQs)e3W2$$^#TwGnHGpWI#TV2KJMY<)JJG;ZWqtdP_j2qxgmsa3Z?j7YyKY3p-M9(b z^hxE$yYKU+{D~Yv504L9J65$8=(y`bu6(VlGX_i7bhzj1S*Yb8$>dEitxUSwVYjXU-fj;?XaDyEfUKc>SCT0Q&0NlW`x zZ{DVY2%7bcoe~eFtF@zwY-0PTD!8Vh@$=wiO`rZ@UBK>A-A>I6M#X&c%U-9=xOBCl zSTQ3kI5_jurbsf_YQsrqFTa*XFOid`l7ar^-07%@IUa z4RbO9aB^GJx{ObAMw^P=X=T4dl@_QU6Gm&5*egseKK&fx^YSk|?+4jHJUE>r5ibiPQQFFA>u{S;joXlO8 zc>n%=abzrXh_z$hsh8)XPzk90-1ZSVs~6B)f=KZFzw$Ce)%wkAxiQO#aD;ckY>ScJ zbHe+*ZQ1HEIrPt!bAP^_z{~{jk7Cc2tR2ylA5dkXDIW<oIk8Pm|E1K5`V6r{AD*7 z)SfqHwC%U+OUnwJXHuS>&-waNPMJ~yNiF!{aH2l4wScvuc2YF*?y{8S=)*<5;D@<{PMBWr4(M91sleeDBt)6y3ceUzlTdw+nQK zM(SO1Ox02I!|h`O$C>pxbS;^who6d=+1cTsr;%XK?R$5U=jZRH=qk7sH}5N^rHKI` zaiy+ZziXQUi-X4$Uf z(;2_Fozt=d@Q_}?e9&Z+8r!D4^#s(jFLdV6iB;75Z;Orhv(E=zPR!F^(*URC7OUgAUBq!XjaY{ zL(%!GHAy4IefXOig_@?tE)x@z-2!2!3ujRCEZcaQy*)*F9HTi?;$14?V$~fQ|FwzG zD|6!C4tUZlza6ygj}pkP*1K*fZMAtp{l3a;Yv7twlhkktY3ae(svQpF9yjSYF70Q} zo*8Sm{Ug|S{~}3LAIw;pJP;069oW})-OUQ`?1s|Ko)5mQ+ejimT)rYD1FVhbhEx@Y zBIdl`sOp~8x~8p?>Qvb)lt|845!*`&!Ae;oKhcz@C4_g#j2!Mk&%g99%L+yfH~9HH zz(GDBB_;&sVz3lw37E2o+~Q(IV+w*hWZ7vEEQ8}vxBZ%HY;i-&CjE^wZGLpoRlM67+{qlQAPLE*UB-9$NT#1z*r*iDlxnHr)C1 z!}n(JEQ1T2=cfL@!O8tBgG*`2WkahtDP&JO51E{=B^Uj)>dAsr{i@n7dYm<#rFO9;PHJn&CUTj;kn_P;3e7#Y3 zV!zl$N=QTmhPRd8xg&P*s2^iH7oLnaVekBxD*;g|!$UqP={+urA6oR{C6W(jPw!ou z<_kf5Gs!TN1*RTswdal@CqMX#y)eOSkJV@-j5-vbbTjZ9I zJE?=Xr|FoS>|@@Z*15aB=_cE7c9swx9Bg92e>i(-a1k6<7z{xS4t8wRAPrmx4hjp| zxuM|M`w!!j%MwjZXXP@M_Tho|MpF*B^1qCr*DLIy-}0F!Dl2|5l0a%XRNz~(aPZ#t zj;>xE%q{?c2wo6X*7B%RC;_D0c&Pr{O?a_dDtplbWGaEZOqo+<5-|_4sHi2k1@Mg- zEu~y4<_jau8IC0q;xYA`6uPi$DgeZoj?&`RF}jc!r;4PI?QIkm+D^8f{dk*sO;lwX#3 z_U!#xc~4R8#}58V*^Exvtc^KV0{|1u{OGE*0M1Lz@gsszJ$m5QkVOe-00n2NKG%&M z`ZgmV{|{H#^MN3j5^~}O7F+)Z*L2T z9Lm{Q)Gj`*l9J3nDiupJjKoq=8=V0+6k1epy>PMkyPqZ7Au{q0lG;`yBhqycZ2@c~ zr}G^i-rn)%wfdwwSD`JMK9Bl|oR+!a>L6Tt(Lb)4ymm<~>IT&y8#SBU$C?%O1&G@H zijtnaO+;OO06B{E%v^P{&s0hSBvTq@2gNWgy64X|%Pm$pdKT6GEm6CvrCz>#r5o^KfshDnDFP=Ddo@Q^%0cda-%lxmX4uCeki7yn`nj?)Xp%nd ze)vGUcwRx{zwft$T{(0+dZa-x*uya>uydVlwU#fB=T3XU{)+&fZUpCBtU=sABPPwG#WgEu*%tFjHL-26~>#Y1DPxAUS~akddz{Yr1Q&L?}Lc zc2)uEjvM8;pD?$sVN?B{&piJPC~mG4JrJwOL|N(I(ff7d7VZdl!ybj;;q*ZVdM|qn zm0L0Gp=jN3W|UDRFW-OMWFS0L@9w%=Gkq?G+$}(yzrY+X3GV{;$+YQ%s8DYOUjfRb z;2w8vC%facZGwgXbH`+*4sv&6QLCVlCRiirvbdId0SHb?nj>L3veQT4wpaY@L-EwLc58*~{uzgC~czj5dri|+%7tUBl2 zk}gNwtfXx}x19LaK!PuQQ{Xi7gV5F+bKMIF;6?kVt+DYk*PvB$GW(w|izGTb!eYbT zK+Xx@By3! zO0N9AmaS3oKEJ=OluKS%F?L zjt2<#cl9>70yx(m=Rf?83knb~K($}o4U9jP@Uv-56K2_0R-4ABF3(d_$!>(SH=H#H z*bZ;#Gac2JS3_}vShTCPSTXy`Y3b>EC%@14A8L6WQG$cZo1;~2-#9>cU+703l1Rf; zpdzJJOP!V0lBZ2&p<=mb8XEfger2po3dP-_hTbGfVMFiy+O3^vM7xcb_)YW(wm=

    WGUXu7bIj1I zG;nS$$1=l$(G$4^n3=~L%yR;X=a~e}Ytxq=v+>`#+6WM-Qu`Ab_`tBLPX2DG zQYeA_CP2E)OiY5QwQIKTfDT2F-t9xI;b%;Z9fAsO78V@>S{XLp{u$Ky(%-y(#5=aw z^hzn103f8iE7sQ8JN7->)9!P5)8yJUoT!TuPUv0_$^JcOcEOb7*+DWBhK|lk zQ_DjjswsJN=~qY@RT%`Bq;|H7-ufQhCVOur2XUB3&Cp1ec(Q?zdytf5OtERh2av3! zAX^O%_r=^x?T~{B`=vYAW@rlfd1mM3sJ??|NyvmV7%Cyh0Bxxel;cKQIs9?+enzKh zDMKQ5Rl!Rd`}F_EDMeBegILt;9*9$CB!{J0)|mw#!J{Mp$`6};Ahhm=;9CS0U$?h`s46A8N2?x=REfP4_R|sl7XftJIk8@{s4si zd<^Mac{2X2Nk9bp3A#L!{zHHGNC*hbpu4+CK^}t>wXWqO#Hm2?yK*|E=Q&!3UIiLugM1a!# zv`__9S)T6~kQ4O5jU$);gBKbAyg;&^Y*zCb4m%t;PT3Q4Rp0-0N&95#gmQ>`qguPH zj1%zI`XE#d_GM5ySfOJ!?@KB~~fa zrW5;dWOb`#p^Csa&?|gf6)VOMI1UofJwVq@8kLgY2`JbvR?@B4Vm08mjlq3Cx6Evx zeWYffeJuA>@!?gwv-$Zqf=9cuVbRe>wJJI~=>U;4YunGG@TCK76IabE5Zcp~OYbjr zV~yZ1#9VPJBMXZP(k?q!tEGkJ_d>jO1nuZA0bb$FpS(jCcL3ePzhP+N$FOBRuRk;v z-nuHOfmEU%{U~rY%D5`1R|axTa5R{&#J^q}eO$L)BW&8XZ>dpXRn{RBo?V-)B~$Z) zy{L$c*CutbM>A9Mi&pmSM`HL+LePhJVoKB=M*~cCO1P_?rd^9Ay~ zU~H9!0o_AAldj6j+9}1`H{y8ILEg3>3yXUu*z$n#qu`nQp%5wJ;?gaN#uDtnPo9|e zzi|O?Oq(*ClLtg)Gj4gE1)I0q(lJ-Us(|0xY=}A3n*v#Wq*nf%ud3(fR?(OTc zNg$p*s-|^{&f#3}fv)*KTfDDDU(^(O?u14~B^@5}z!gLnOyhVwu<^>w^MM~jnPq@0 zcG`TcEAWGkO?B+Hi)N>lw*oc_sniRjWbI4m))_3{v(Bkc?^xr3p8ELqG!ps>u0FV! zR%Sm-uETQjP2i#Ou%dU+0sCO96S}Iv;W}-haI@85l6%dNoN5lKEfM4W;ECY#8`{0^e0F}pb4~&0qX`u@c2Cc;DcC2_% zDk7%N`)?DvR`y%~c&dSM5)_Im5DuIq&Q-}tmySsSZZqgAu>x?U@e0RY-tID^b^cZX z?wWo|5ahiK z4FRJu^~Dk3hbJ6ui_+x$yAiAnxg#g%$7#e$x~dZy*lu$(&x1pR#I9e@lf@Huua*!M zZIkW>Dw*XToWWGX<_Po)rp(WrWsiPhn?DxPhnG>3=c(}aRiP=bMYl9#mvD0W(|~kC zaEBy}>CC+fA|mKB%aaj`@QBq_leU$@oPE1AY6gKP64x2Buu2%#H~lYzB9XvP6r|e1 zspE3(zpu~Y6X>yxYxU`svbO)t!QMVo;npING6~}OI#-81Q%rY^E$~gWYK?k&R`%-g z0`OdBy>vmha%jyf<+{3~3`>Pa>lJnC82})8^?TuWdS;z>X^XnGT9@9xH)?yvy@nsr zkB^7XPV)jtRo?lCZW&@kB|Mg%g9bcrqui6nv{DAPAVlHJAX9QH?3#c1i>~QGl7_?C z5{HLaU~xuIm{&#*bb4M;{-?bd9+j7QB1>9wkS-bRrm$GQ9|n6!4ZmdVSW-iq=qAgR z0YVC^^zpEoq>+=w1qu~WXXgp6&M%#2>qn2Gop*>x*7wjV2UR9mcTVfifx&^WU^WG$ zlD2lr*W|gyt6=kq!x9tqfJgq6|EkN(TONN0(B_AM^rtvA$@)O3X!;vy@y*h8zgU(Y z4|tUHy&TFp=QXk?t9HCx9ZF>5hjppV4 z8SbS$`!YTqrOfp7r}cs8r&sJ*2<{MY+OOKBV9rl8=WVL0$5Og4#E)5bEa%Ls<_zuo z`7`Hn@A*6_Z`_$?-$v+2$i(`_2v!~&i5C~To{UpjOfwXWnCnAD^M~ZdHJ2qGJXpLd zcf*e)J+ksPGWB?zj1x5yg#=rtM;~SP&iljj%QWy46s59c=S=+pHs$zsWai{ow~p>ZxtilWbAI=#o%bgVNsW!DiY>(9t}F+wrBsHqriR9D zgfK>aqTD_4!v_P3de~n?x3fMin`TR>C({_v*~b*rSxyM`wc?@e4*Q;khsQn9k?sB7 zmyH%qVal&89MUdmfyP**j8*ii!dxRnmSgLpTE@v9&i4LQA*7 zX29HDOKD__(a@|asaF9;pM7qkoVvkNY;FW5JZp0B_5+w$Y$di|&~NYr!YPn;#mkYj z(g~ItfUV$}be~#4ZH_p7r8xixBnq+mfObQp zqnRBYHvs=4vnmVj?Cb*od@FWey14EM>jo@vu)i@mm^Bkf%?mnUj1|Lms~2{FJ?7>k z{AgN`pP#Pn{Z!B>KPTsD>qK;n@H+v#?A+YGmBDZdor0_^u6^L0@OOjZ7fGOBpkjmj z!U&(up`1@LH}Z|SnbMD}gRn9*gBR8GkbxNdxXm0f2>HU~sDgDl(2?2q2JYURu}9{T z$9bp~#_IT|R?uVw*aepQH=jSe7(ciCQEF-sbOQ3-;PhAZ>(-xc3*|Yt(@65)H9ekg zsLc+glif89+}O3F;N%!WPh(uPboi`OnRkC4IMkgI<{* z7@f$B@^p<`?mO>U{FX}(2K*ZOrq7RwQxbwBGZ_@q&3}G_gO2}wKG$w7e{cE-u`v_} zNzdlRW!qQYu2w5^?;bp$7c|I)d{Ckw@frsUZk+@^`|7V>o2lWqZ{McaZ|~$!_NjMn z0Jtm-5fRUUr%%G; z!t*+^2alJ(zXmf#R&_C_KKpA^hT}ys&Mc3Mi|6el8;d8b_fTc8jG%T*4DA$fly*8 z`$}A^s{rNM?pQ`ZGB+HavK!|^HT>yws6RW-FqrN&cMx8WarWYhkThc!u|2(~=w zUcqq|$Q#+r9pgQoN(pjgtb7E7zIk_Ou$PgSR}?v9VUDsDMmXrA8rxs{jg51 zrpX!|ZLWH>{r319Rga-ej~0N=*pFkltOU@bwYAOJ^sL;+oe{bYJ!qYZ)vE#I+*8X9 zyPdk3N%b4COXzNUYB)Q4k<0$rQrMR-v{@%;tbliM@zJO=q-fyQqfo<4m}Pcs7ORnJ zbUp8u-}UR)!-qRm>A|viN3SrolCHa>w=aBA7#r^9`R}NmC#S1Y4vuVNqA0MBj=j1( zzV7%Vi`~?q`iH}EpU-&po_h-BD8^b|Pj5zjiHwpUMYF*zrXPW+bL`D|6;J?r-`Aa@ zBmB=TD<<9Yrtl4d7MILHf?N!PVx3H%v5K#E z+ab16er2-EOVwPp9brof`prwSY8&keJ0bjHd-5^vKWek`Dize!B8jx^ws;H7%QWn# zuS^36)f1YJq0`{Dbz~czQ!&zyczG+Rf62Ojc-he&Tixf`5GiaO*gsWoP$B;}z`Yu$ zM=iT;_|}ZtD({b4;KLQvM#qFPU|||(IJxLVLyBgRsgE`Z+o!&{TS21qHtF9Mf}SNE ze_Pgkt}OH>ubf5PxkFHvs?8oF%U6g<=$Da{90b%n*I3Z^$cy5}pK*_coIM`6XBHNU z0Iy68gJcPuM28FU^wYzA@$rU?h02DUqHTZ$*$%w7!6pPq8U2(o;dvmpI}{fgsm82b zeHt4yt93M3rB#1wlQL;xz9HwCT?e_%`^ha4^c);(wI~XHE=lemhw3Q}4to>h71q`X zODo;>yKp}u=8b(m$XA3R*cln*Q$oez$kkQ!p8WZRSlEI5UFlq%)C+TO``EW3uG5f- zWu&vgLmpXbi9P|TDNydqUT!^A+Hca<7Sy*(TH;o0_4d`@8&wAld)?PI!>IwEdnf_3 zon3#}!n)@YIHe`7y|VFJ1fD=5pomn~Qpi5`zPhkLHTZ373~Tz>-UKA%Mh}K(XJsn^ zSVCKKT6u5fhIE{ut_oA{t9_c7y!E>E!oof)F-Rw~NyZ^lBU9;zzi=*(#w(1)#NG(_ z^S867=lN>|i+ljDu!M|!8VJU-GC+m#gg^db#U1gbobVdJQ{NP1SnB?nF^2kapp`JQ zRT_J652-Ye|0|$vE~MKCy$d#=bNpvmSqno&GfPZ2ZBU!R+L8?~f0y&BQq9+wb&vh; z5|6mgW}nZnE^P~cVbNykY#T}FHX7Vt*W|aDu4SmOTq`CNI{VtW7R#$q?v~b%=}f?k z&WR{U-5Ouh=F&1OsyWHcReUNYgcU94RSPEBmQpArWsfjGFt_M;nn5(OJV%;J8k zuivYjHAHO<(3werQGSlg*RGbkE9q72ZD4kekE?}fg%RgAESN_R9>@=-OOJpg9}T>! ziX51BNovTKR+g8y^4BiXH&j)OjVM5zv8<2QD}#hJ@TrbhN_v;Yh0mP}_SaYVRs&>p zu-@p5HS!Jtz+#g_=_H5xoWz`u#5qmBI$?>-B)P!R6EaTvDMr2A7*7#h0kHrNkrf4F z7M3_+&tG5xc($Q)OuRms8lV+aaaTjyt9GK#Ur|4$`%pw1UkUXbA(!~CI zYSW!`ErYJ@1t#}uBUdIBog~ty#^h(Z^@p{8_|c?4VsMkpQ_nyq!i zdJ1*{KjCK?V}NGy`t^egdf$xX(Y1Y(L2`tu{M3W8%1I;a=y1I!|F*waRuQv+5Z7{$ z6%s%b+Vw?`2^70nD{g^6qEdYcsDF`j|d~awCvh*CKfXN50tGE@NSp?!c zLvHEv;`8>#DLCyMcpKCNwq<9QSVSX@Ff++nXyXDz1ml zt@xeuMJ$;gZHJ4wo&@G;oXKeB1K)yQi|OnEFR!}p;ZNYE9oy%){>Z37FI%`&2SQKU zs2gyPw1C~z6q)MXDn=n>vp+ottRdU(s3rEWHv=dW`ZHDEZG2MEP%&d8rqs#iU(idn zBL4#dH9@S8BYq=iebWDrQ&|ujsAywMQ!v}sIuKXQk+(c8O;p%v_cZ{eB$2@XE?xER zwd3VtVwx~X;8V^wK@q<3T_>yfQAE`%BaS~`yk&=a(3m~z9X3daQ+S^56I6z z{%k~8=L8HhZ!R|Cw(K%So!jFi1=<})}g%duMKSjv=duimdl2b@!RU?hCp zA+{A@mTw*DP{``;E{>j{wc-oF+W0?&%lN#oE@KiYb2~CTD_*2?KYq$>PyhE&=mxMI zyNi5C7e`9SIcU7Ov)J=xVQwEVNkM5P7Gd>#KWI@w3T!0+OQ1C(xvBBPig1AfNeyzt zhBA@*HV>g?I=|ny27QIDQ%y0q%*RCS=rqqeS2JRSFgSHPJ({2u9q6++=ty<`1)>K* zF=MNdVNO#0Gar2S%!8?kTmYbwpST~Fa5Fr4QryYQ3V?}t#4IqAnh9_A0kk#TbnBK0 zsMr9y0W~#QQ|8*s0$Te(r5^-z(kLInyP-uIdC^=3=|aG}rd~N{a8=Kc2{$|ZHLLM% zY(Xp}of{K7iYck-Bz^GFb3+_4DW#fIGlhyjn?ljKUo+a?fGMWC+=p zf&55iXPGc!hgoB%XTr?H0&3)l5!iAEkeRq5uu-GA@3OOVv3wK|@~VP{##vdWfUx?K zwO6Fq#dYoM9ZRn&@a4Z~RVx)><~ETUxW;e=C$&l?W839UN^-#kc;u*qW4_gOXGn{CzUQ)eSvxS;mRY!5866#MxBOi^n#&NI zItFv2*2+=6+*fi{aIS%F0^rX{)+B<6zpt2_@d`UjrGv^q!al=Zr!MRJ#&Zf?E+X(_1zKoTmfKi93;a}sdxk1^N`vR%PtQqg*SSME5dg;+Ov zCiwly!`8#=1oqu!IlH|hy68P2ZEf+q5rq+;6jG;jn;}tU>m%ywmhayp*mkKKuW}8d zl_tq(6tPMG%93PtZ6B=Zi{|Hs?7WhWAg3lFOO(Zi`5OWWu`KCE>wumv6}h*6-@sp2 zU7R<)Fe5W`|CN%=V4nQc@bgsStQwjzVdur`a|Fa0m#vY8!D7P*dwv!cAsylKcH26} z%BO(%8t-yU=j#`=X>$^}dsFaeD99cZ9%iSdIbxTo6Xx9m!qL#=7@&&5ThNy&QrfFB%wp3W_W( zfM)R&uEYe)9nWnHB2&wB<1$y;jaf@C9o7IoDPYuqx-D^K4Ta>?RBA&bh?)6CEP#v# zpk}>P`T5xj=lud839I$)-46Fh*r%+Z@UWmQ<at~z?FvS+`e>$v~T!>#>7StPly-d>X3|Pl-21J`1;AN_9cA;INt*>Db?&}YI`)> zJES+BpFjpMOZE3$5wV@P;s1ZEpZFd7q2F-b6+nSfDLCJpUf6RXq@>K(6vpu4T-{qg zfD+sYKqFIfDSnmG_9mL5g%$KH6~qj5B2)X@Q%YCIbEIVK94Ldt&8H7*KvoMPwhB5R zEgXEPSH{C5ennk_>Afo9k99GgJGp3-5XsXt|MKI+`?HhbzP|hL=n^M(VXR-wwl-QU zsuLvMoZ@ZT{`FqT9ISqq(ea<+yk&VYtqB5kT=TWNa$gg_T$J`Os}+7Xwry=`Gxs=s z*qyK$!#g)8PA}x~vY^%5%WK6>Ejk-X43ZSZ`lVJHkxo74psfLTR0d8?=?LBPEZg`c zt-XcOlQ}J&Ol(J!4kf_r8K&FWTfin+8%3ZtoTFVgDFjs#7Z;7(otFOwg>(84PtMcU z!3o1cA!s9)M(4|6-lPvkILA=57jR5ii1Bkg?)pY8SfY{F@jX8A#fd{Z;0)GRD>U7{ zpc6onMlu;A@(&jPrYFZ!A+Gxy7OG5q^UaH7{VPOghuImPd=^U)L`bEAAE4`(HJ}Z& z>leL3I&6$FMRXcMmd?|5P);|)0LoVzrqS(fR96hyr5E|su{?IroLGtmjn*gqcW)WA z1}cIa^VfJFO@}C1pC<*DAy_$-pc&8_ zpx=99z%WF4)Tk632?9X?Z^uB1=b0Zb!GZtLA_?lh9>dKtbCfsuF)D`YS?%qoKHXMN z$7f%^hHjy$>48KyNe*ad(n6E|{h{9&*5!lVm*nn$9*y`4d((}=@~K2kHAD1k4$t>W z3QKZuZS&V9V_D62?>2VtLa%_?8BfKI6>Df95K~pg39&2@P%RnYZztJIzhQ3kPaT_k)W3JhD5pD4ge(bjRd);9o|8;8?3Hop)kBpFz z8qS#O09Y6zt`jmGWb4jZA-_v;^xpnWN}0Eo3p!+hK2KMuD4+0xc&xFCoQO0Hs#%&J zvXkyrPmHW|DtUB-SCi*{DXmFfjqyHkNFcoD1u|tUE7?7x3(Nb3Ez|u=e(z%ddBE3!59}aeV*&S#*iX z=Yc21U4cJU*Y*J$eKzSe_I^F1bPz6~lr^V>bvB!rcGEd`5pWYQ65s#UT=iU01dhD$ zBH4l+h`8a%%XviIQh{u|*e*e^kIlc9O$?0#!iSDqj=`jh3wlZYK4z?D=dd#W>)Kqe zKZl@?mlJN3tR%XiwB9~L~O4Is8P6h^^o4l{LW_a+&oi8GV zb2G5(@HLCTykWoE?_cIc%MCSSn7flhjGQrYPqx3sdKrMSY8} zI;g6*y%DCM5F4QerT&ZZ>HboxXb^YR5q`sm1x55on)iCiba z6PSFkF1#K=y&x+YG7(}uBcT$Bt%%}TSzSGmc}nATnMNBl$^qII zAXksA<4bpUC^+m3)NO9mfGJY`&nQZSh4vy6h6Ej_*q6^P!L~x`+`MUJ;KO5sloX>= z^ax`S2GhXKO-RyUufWN|+BVR6BO8We{ng z)?|(r?9cZu_gvMizWezVk>83^<00YaSIPl(vXA4w7>%sK@tYxS0@hC|jfSbTU_bGB zQgF7z25Q?7M*vRmCBtk(^5gP0QSD?SEz(z6@Rbo6mHs(Av zt}Ae64sBjoM9jpd!G7Df&ji=vSx(*Y|AruXNmP{Y@dzp2|797tuZG=4Hi z~+(Q&Xz#?;Kl-56iPUAi(klHu z#ZkL95qJxT9Dbo~2eSEK=#6%=>{3-mI$^#J=FeA65}Jwt>^&@oF(E(53&d!2m=1$Uz0Hx1r0yv+qS zY^_~|Ii|-8%9VhGwepJZbD9YxXlQJ{|9x)uDkIQI`<(YiGhR_Azok!IUAHz7KT`2( zemz*^-G$yfVHp&Cf5#K|&;8wRT~D73;L%)y`KKC=EWwcvXa6?i8X=eYXnQ0O$ETsn z1eYiu3#)k(HTx3!q&x8973eE;-4VC)e#Dn=jR#iV-QCIh1oQ6Q zCSO8_Cny2Wr(P+8X-XE}YtsM2PRsWtHM~mlOZ%)8J63UvJp7;2(jB=R{Aes&ge}** zoMrHx=R5PIcLiVTMsQ7A9#@R9VIR}~K^oHyWyKQJNkPHvu@YIP8xf}9?5qH;Cak#? z^saMmCrdMyk+&azBD{EL=SMD&Ind+ifgavoAl%? z*Vh>fa)%nu+8poRylSAMs}YPCGf+}d%_**~)?KPO37psqC~&uzQ@;djHr9~wPB$`M z9!gT77_)zFEaPA{z#)Vo$6M^tP2FWsRBkYiC??jfAB76;U_D@GvG)xGxkMw?c?Ews zejhETDU$T|B^>pw-ihqhOXaq@{&)TUMYjFI*gs9@jgw*4)kxgVHuHM^Kv`+M&tA2F z6VhRNquuclIi=S_?bcp>v>|%TMPdBCcB=j|O$1Ym9`f+|)sHU6D;c2MKMnA6ME!`s z5E)>&{52X7vp8of3lTK%Cb?Hha?8o)PoF-qTd%f%M2H98w3vK*H-oB-@lFU3Hgxta z!sx(H6=~A3xnG&`xhNoyOXPBKG!&IV*ZrdTRDK%xWK&@@Uo~FFrPhp9VBv2Vr~g*o zjiZWMwOaVDn*qzN2OA?}fihU-EY_L|Cdu6mj}E*|ETn7w9@r2jLkj`_hhQ(p#>SAT z8yi+&Ye;1N@VAO<)ya^y#RVD3I!YM9&edB34wsa&?SNw%D_-clS`kCR3(F;T)*4PL73*qI}S!yssX^&G~ zYK^%>SU^7jhBHgI0Xr`u?CcKg{6w5S58MqzNoGwSaK;-D4b?R@%3ziiXrw<_%(QdG+;gZI7#QGiALqz>%ph;N<$H<37S$C64I7=KB7(8~6gryZ4~w4t z;)TZMclD(H=YHqoH4}$WhHTf_gp?@`#M(rk{`jqi*&F~BiI9+aSaYI-Fz}_4ihNp( zbtMYBrn@g3WrJK?T&UrIZu>U+kcp9T;Qf_r9OkIU-EsUQcK7s#G)m0E>yHA&rP^RH ze+APhEnBRQZ}55eKc9_;4(qf1ag!DjH-n|S^xZ%8S+L^hE!kh328?_NH3iRGaFmU2 zLbU)Qh(kzY30}nw1CMMs?S8QGMbk>&$S8dU%Z-L!N+SO6*}N3>#Yi<<5RO!uUgeIx zN`lCiiB(MG2>q?`y`d35@A{v>6?pE*t2?J*weRvR&d!HV955nfesUNQMO}X}CcCR}~OO}vdOh{=QEw?bO2SxkT zD?PI#(LhFReF1^g$(O9Qe^4HO6e^F<+ zKJYV((v!0#be#?*&vX)^qOuUDHkgs$5f{n5|9Pk?FE}2v$Bi)0+r{Wl+g*Y;aQT}2TE#1f=QQ;KvOU_g5BDAEO_*MJ=r1Px7k?^@C~7l~n+sxuSWTHB^_)@ylpZvVRI z4|d((n>!)S&DzZvcS;C~PR;C8*Gzt5-6Z!Y(MKluY1#xLqJTRbA&-dA(T+Jtivyb7 zHc-627R9O}r+XviWHUpGt%IkQ$mG+vMm?5LzbIJ-1`GCIzXV{Zi(JK+tJ%r<;4GN? zNt9pBHa~S@Yv;){m!mFrJ}m){v3~Ttr2A|MeHEkzW)|NVRp*xUU-+zIC+Xjj>>&K|yfdtdU`7Y{#$#dhc=Y2%b09Tn2_5MO2HR`KApZ`fTmDzft=9ME{0 zm&Y_&udMn4(kHk2x+l&*c2paFn0jL>+!j1~snUhgsBY&B6B(J|fwfs>L*IIb=D14^ zpNL*HHMmSDkq5(XY9;!xaIC43L-~aTYzW%xgZq3F3zD79{PXKa3v`{9AqWfE~<&}d% zYdvxEeCoXKRDYR)3l|MPTn*z=2}g*YmMXAlRD-h!K1Kf8Vsa+7)p26TKhbRT)=dzv zB+?g;x#8eUSVt$QZYT2qn@Hcu<`+}`Gx13imRC~8$-1yjMw!8yv^wml(=v=huCA>mXblw{+lg48*5By~#~zOt+?Upi=79w`~GTqxE{Pb?;S9jSt zIe+NaUvn=hS3+N~RPBhXeny{L2A16aGhP)Z!P1uQrCD8BC(m1fgT6Rx<%|#E_e$wQ z1J3q3G|wq1x+m{e>+TzUZZ8pTGbywWrC zb%WR|*g;eUb)xLVZCBPE=Ys*!bk4T5nKqL}F3wWN!OD5d5+uN8FBv73STr7Dm-bSZ z0Z%nAPlQ%Pf9C8JV-J3P8AWt=|7_PNd*eZ_Q&RWEs%GfXf5VmECf3kY_Z1@h^531d zYN4Ydb>DSdJ6YKU<7NE?*WmZSt%)=>we@yq8=%v=TKOg2rr-Bpg>S#*;!JmMQh25G&X-d-zOa0D@-$MzP4+RE;~4)49cqnam?QKP{jbB2|)`7Rsg@=c74 zyH{%C+`C@$or8AGhaFZrwn(>X+El-N@sVb)UJ9}uI&4c-4Fw(aLj4Jss_`Q{XTg6x ze*8E@FK=IzIS$+Xy0Bl5bbnkEI!y*6#?3ZGq*sjH+WmV;m%x%f7gb5$F5j45Wv#gp zHu(g*vX4n|EbLfd!+Y)VskT~~fD{@H>geIj>A!hwzuU%YX9g~()`O4~I=Z?h8-9+H zQy$s7v>i{Ac(`!;-5I2vgF^&v;oQ zgQ^o$7jlL&UX`0_akH>}7e04n!w+nZZT8~mi)eK;8eQVEYB!0;&q2R-EvWyWxdnIh z*PR)6T12cj3nLF-GpwBWeIoG-)}LhW6V-xx$-tNkW^Tq;f0?V)wm6Am5&H%=q^7-5 zmEB<%Em(ea=C|9vyb57G+(Qe0qi}OGB#M8c+UNtq4W1##{ZI@(Qte&2+{`!WCMk%e zm8hZ9IPHrq)e4blaQ^w&GKA<@kAl?ir8rO`QZ=-OfVO-=xCf`q@8?ML=p~i>K6(}G zbuqyq96Y(y-`BCQFcTCW>J=Dzk9=g2%z4?4jwLJOhJ zjDCd>>MtfP`^`B)KDL)O21_~qgt=94_rhZ&*_I#*D6b`EiDAixU&{hH$d3!KQ!)M= z<64QnR~19V63S)xE^DdDQohTRjHvSp+k|nsiXZmWEj2SOaHyxZk_ETp*A{UBA4|cu zG&MCr%1zNAdrVA3`ux1N4{q4gb}IPf2^lJr+P1MyPfv%pscOjSt$AyK%33)9t$LmO zRFCWENb2ih>J>w{Sr`?}5~aP1rtp)q7|Irtp^l+sn(H47fDW|kwN8Ob(xTpMgqBFx z&Kj;u{|`$wzqNcxtE8$a)BH-x`Gr4P+udS9b_bt)`=W$&kI)5SYYE@*=SDJZwJ`+i z+UrK-EPZ!Ic9s?G=YN+7br6X9Z1~C1_D@YSl~Yqv$Nsnbp63d+N-?yYkbErLk@Vo^ zu5W6mF?v{(M`~qd<=rysav%1j`lHV5u1xoo?3wBXu9%o^ulaXY?J@2jx5cn)>PEeMUrBj+ZeI0u z%gN)028JmhTXaOFsrgi=_aElcMsAbR{cKIMf9)>ajF22&`dnIM=>7i8&ZGSw2ePc1 zQ4t)-F>!DpeM1udn!c?^(7F+&>I$Zv_GShFOL9qejFfd5B0IG!6;-;A?uOqo_6XFn zWx8<4h9k6*i9Is|Q08|lfhSC*FB}@9oZH4)HTaO3pN8j`2=8U<71pO6Q z?=#kvxsp$imdwMyO)F++C$H>E#NPAntcr-xn;ykdUtLfBCUjxf!@}0lBHPgz33OVU zZeqy%tXV((z^`Ncy$O+yRyZxQIm2CGw=LR7v`}hFZJ9f+#zPIlD;>VoHrMGEzMKyR zU02|+9mKmWpG`+%htjEVJMsGJ>OU#a}Y4+^uE^65KpY8^^U*u!v(EEKeJ$j-+W)bq?s~KX2yO* z)O{}|XybhCno7cz^L8w6>c?=N=ooR&fQDIsmD3;lYzmV1BrhLE{R&%T&#BG(8=fcl;;YmG zjEg<;X+dV&V6FS02Tkm4rtV|ypRXYpO5EN$L2l@)m3)Z%Tz7w{gvZK%TeNRl3PDyWKAz6!mP2yB0q;TmXG&<+eVO+W7>)s&GV&o4shq>$$or ze=Q63Uw?wPe3Ldbe;+kw!STA^V`5q(eqoxW%nu$=!dQ%7e|Qu3mcAw(FU8rcOwSy$ zX(1$ZP}l)GxxV9IGyHc{J#Vlqwlj<|L2LJ&5`rMwXf1I~8GRqgY?&#=xD$vnY`=|& z$c~Gq_cx0}Q8#n-A{*}eTGban zk@UB9cK+&TWMDAAvFne8Arq!}K|XG%73S!!5I_LZk*k*<-0v~JzVv~eIvl4OsHv%W zw`_a#*$Kf)N^h)FCzmYw$S_qeAUjZ&npC@-9>`M)kc^=Z%G9lTGh&plRavB}40|>) zQ_EdcswC4Tb_Xi>_q?TLxwbq|LL1h|*pc?p{L<&@S5nBm0!U5O${TBlpq&$oAqiWc zufrRZP9iK%>PQ`%AH94T9E8zh(}%LSzMn_BRPm_)dE0v#a3PE{lk0tTr{MxiLIE+~G}wY!b&^9?QrG6N7_SJ|vE_ z!zlwtTX6r{9Il|x%x~7errI*7TGs5VJ;+yd-bf5kCs9|;W|%m(U&uZnY>IdQheSfy@v8PVTO^39<&@m~(>XuU2KZwi7>7PWu`1P#KJhLJy+)VU<%PPw*cMsIT1^9x8D86fzGzH-g+4_ z7XvptHd;4Rdtm#7mBhgvr;OoAp^xRuyi}W^>3?$pfQDRY&h^Nu%50?5AcZaCt2Y}R z^@PrU)-&Q~n5<3+IAA^bwQr@Oe<#AbD){?U zF)+0}+S7iRjK=H975sd%`1~ z-&neFn6<|_W7s_96LC?K#XLz&nj|HE?(MW+!-_4h0Pm|df?vDu-QM!@^0`TVqrH9! zt_Q&XG%|3q?d%UZw1AQMd$`uGU$cKpyd<%bB*4&-_LpZg@C8(loKJ1DI$2O8HgWv%jnuB26d#bCIF1U{`M5K=xJf z#CRAC#(klUAd&K;qJMXcL6H21^!vtW5GU&)5t1yA zM8BPeh4@J3AQEUPnf#3y1jJ|A8n#=zHn{2Ad)y#e3}K z&D#yEJ*S|JZ(nZ znDbdx6P(_MLuqr6>oy}|<53?=A+jbf>(%CvZv-lcoToi8_&(SF4=0w`bFNj{Gi$BH z?4ZLR!1Qw(@JHc})a`k8Uem-i3c({aeAf3;`wjXB&uHXdJ)lsd%`D$4R4>t?gLY5ykxZ`THu-m*g|m z5}}zutjEGY`al0%?<#y_-s?2Pav56YkOSm==BwR-YZ4}c*J0i3^bM@@gR6KxexBY0 z)FuK6tOt0v1E#%zo;W)W0^pmMkBbmJU{CSH$Jcy#dY;6sTY#w@(V#4O1r+;Onp1oF5QZ`#EJ`&vDJ3O2(SG%6+zd)VOz^~R>FGfMx z3rRvbC}{OlnA$4)xF@#jZK`4_@gK{Uy>8X6`39v*xUGisPX@$C0O9I_z@w+LGX=~6 zziG+z<4F~*qN0_hP(OXoA&=aV&5wt3OY`~31GNJKZ-W`>kHo<8@q8}b*fB7`IAmOw zEU;e#WCu|@;5u^SK<0yMJA~ZJf)cN1(E1dC?5Xl-A>fI$1Kn$OWrdl$!i1-&x`toM zDcP}>xZV6E#!f*0@hvqqJ%4{tx?*9>sjVG(a1MdSi^*WrxkaY8+v6lsqr{y~ev<{; zU|G60d~}r@Yh+=HRc}&1N0!5pBV{*cHdiMDwsLB>6RGJOa!a2$`_vMo4dx0eFIgEW zE4K(;_ytoa?E62{=xAluq-QF-m%Iy!Of_%`G2@C1s zJM|BHGb@K-4Rpwx3G(xtwoB8v(>mKDOe}h(#135m(3@;h{?b+nZ{Hpv(D+z*)n$eK zhQ15W3IdJOM}snu4#jekrtdyK+or!Qcu)Fg`JDc8vyTZ$9`hrqFvT=?a3^5*u9lS_ zIgPEl`q#E~alc!iiDz`kqup8>I_cmm2@lq8V{qL)bG@c6SgO}b6?xUEPZ4iXi84i?T%!`Vsh#0@dBk4o zmYy02h4NYrf_(~<_(l1fpZ?Fy9Xlu91&B;3_(hDLA9Vq`gVYUjxf~Z|u#B+d|JAL{S12IA1~~Uj}4$ z`B#k^$gFJa+e9sPjvXgAwI@hB`F1Q@Dyg0}DOVO1Ve33`nxcvA75LK9Wi7kfS2Moh zU3s_F&H-g_w6a=B_Nl=qkY?75oODbbLx5F+(8?=}I=-WeLq}sqK)uI;L;!`_(6~kEiJ^5sh zzIh#>_w3dd`(C9?#=MENqV;XPdY$N1-BAcl!e~5=q?FX^SPSOU{i?|ZRzV}E^HpXR z?0mf8E&1TRK;=TeO8eZS_8}Z*n=?D>y*f}IV10!LVbeo7`z=Y=wLH`QWjk!IPxZ*V z4J>MWu98&G(K9nOHC=Y~OcG9ZbKWv^^<^kZ+ZF%yr2el(cjgc0K3XacydHjNYH?FS z$4FL9E*vreO5}iqzu1}fK|U3+x(j1{<@!vlnELItty-A43f>y_mx{_PRmf{Sg_m^|J=kpCoVkJ1fc z+fKwbKETiZsyrks$&-eCF|ySDc1DYx%Q2X*{70)^9h$HND4xKbg%rvzf%&Wm1fUMT2}_g)vX1 z&w`=MQYyzRpP9ctbCBh3tzV4M)NiuUeEv&|68Of3TZWRumO=;Lyt7l=OttuBfmnQj zT;6{m3Utt1p8a#jK@iie(r0E*Ul0E*`}lP@+wtyEs=MV)Zc038OGPqq<+#kTMi~?5 zF^RPkb7t#9)~nCjQEO;>e_~Lkzy>)iRL-NRZ{Ii$yCFy>IZ>32L!-mP(@4Xp@)1wc z@bc!ir2p8{5O%qD9?@4u$vHD-Cw23Q z!heh}tcwRX8{KIsP7go1Cskms+FoPkyhmR&!SZ~Og1}*l!c}teWwOx6<&_epo9HCw z)9#Lb9?(3#=u$OC8g9;JY7}vA$os&4m|=_)P-pLoisqJ9QOE>q$REg8T$ydpb;}|@ zl_h?!iK)232QW2= zf`O?KQb^CaNlOU`I_Wo9|Iw;A`-4q1f(HOh-(P(6O9(zdy1C#O+{fq1cl$^Sy}kT` zId|uBArZz|;sSiKA*4+#ah5NXk1fQeuf;uMoG}JBr|~&gkcVx5wqv`hXfKBl`(Lz6 z?1dCZ`lT2coG*J8-Dv6^;ZpA@rO`1*yFS7VwL#Kd#eKiv9mG|?)X(-2^u@DLgAx68a=a21O!tc%T z6Na{xYR(<0f3)}PF~*$b(x~Ipvo*Rrt^Wh{y=IZA} zuJS*6S}n9&C_6jV2r{1#ws&-2{bIt*uW)j4<)+y{pY?My`9(^_kKofsp_Pix`hp;* zR@azT(uAst)>4c+loduIO3TY^h#ZMp#O#a@Y&6p2Wqb6jy6Mtwq^7S{U-CMZ)XO)J5%-uB@qP29k7 zc0A1CuW0i89ovsb(`!(v0rkl@B)uh<97|x+2|@O`d?U~WAJ{#6huBPf=S-Ahg*4FJ zUF_;tj=dUOf(7tqJx<=(HPG+QI@>G>x!cWYc!ZciUBXDruAec)5m z4l-2t<~MXu;Br|DV86&ZPTfDf%Iot{=@t?*(mgvlg-hm5W6xr)oK-=)t$)#Am+PP> z`(7RU3FnBjVT{ybV|o9)Vd63*gh`CLVJb^@~jjO2GNqY>@ zL4;4=W|kDdNhtq_7+18n&s|#>y?^d7Ztg zPa|sr5)pJDl%mfcqQg+iHy8~0) z#fNmM7%nobkhzziu}bOO6B?s2Yb>Ua$Q!5#LpZvC_Pzm(mW zfOu;87U!{$=?A{$qas)DUg@T-bDY509c+I*5Gt8w>7;v+i#+2L3upwCM_h?rQ-KM3a&=`eV zY{Gk#W_W(lstj77(k|+57l{Cke`a<`w=X*n*)m7uIXaUccUxISG|p-(TGT$Wx4M`f;@0NNDHWf& zLf_CrrwtJKy!3=!&8R7Ee-QXW}xIR)73TsyeqM?eAz2U zs-_`J&z4nWnDXZbNq&@Ymn?R zJ|G#~$dg@}bENhHP`v!4C8ww3?(UWl6_&bBZZrBr0@VoTtsQHI0*9*pFzQ;LnQN;& zX=4i~n>Vm)Un+6zxI9@dbgOGmU$3~xbg`M&boByt`AeU6(cRB`NE?9|nUoxMsT874 zIwzT|M_tmyzSgi5lIyy;lpGpxeZjizCZ1#a+rHI~!>DiODM6b%6SHs0^?|8G?DiPmy}q>X(8hVw0ZU%s3%Z$B?@(iD;d(*pcdiG+?HC!~NUPSkWJrz4+WuAyqH=t#;W zOkWY@?=eRo$j$H1e!z`D<_xV>wk0^|QI?Os5)SOAO0T{9^U(-lc!WCQd)I#ivO|NI z<8EmxT3Z{pFD&^$s{`?zT)s7_Witv{JnG_Rv@pu&_O&;JgE;v<$Kf&)U=-U1DZOh& z2WT$yk(#wBR>06VYuXZIHt7TV9tO6$qa5aP=%H|}lb~{TKW6Tp+e}qJY!mmY2XOEJK znnrJ2lR_KE{7fV`Oap0d=kat#D{Ot@7du_|{!8n0&EI*$9NJZaHjrIZ8Nck-(#I5u zfV8}S{kGJPF*@lTOJzka&qiuDXdGXS^l2xzxG4|T+b(wiEzxx?BBl^4QKAEtlk$Mv zJjre-OMTr~;y><+M#Q#ekVf3`FA}JS1*^SGJ3B6Vx&6pfM7(^Oqjv2DD7yq?%WSS49P|c~ z$PoAfG=d#~b~$nrQ@w`(L#m#~D5J$B5_0ng&AhJ}nSD>2${62Cwt9&C&j_+Gdq<-< zh1~P;X5apo)Sg^+)h#amqt;Fx%R@R9AKm3kv{cMg+_XDP_Y8$9p@bc&iSEfcM#~B% z0$-+GZ56*?&y**(l+^n=_$yC`@E8FbuwHMoH2u2IEVC(0v8>K~yO>q*gUr#F)6oZ6 z1uD%nMwf|YKm@stl$i@$AaN2^DAamm4sR11(U$(&d6GP(cchWB_2i!Rs5O z`9aT)K5<7MQ#gfB`0)eB1!3;X{<670_b5qu5+ZQ~><{6`ACq!C7bTrGt3r$O&X|eC zE~H3oj^jAC9as9G%0@KJ!lYTLHT@lEB302-<6&Z_F_ebPWn2WIW68b4iuG2 zk%P^QM7KnwfR#M&LpjKr7!-ZtqQSY`QbJ_>+L{MYS}pP^<2Xu?pRr z`}&t7-qHyz1prA4W65)naw<94A^gKHYHW4G4YIe+lL#DuV+X|8q&nQSB?EYtOX7v`0L#k(nE$H{>I$1Y!r?*LbzE?u-_Z_4;Q zBOY8{+PfYuO}*;jbD#dA0goG@qstetbdGcI!wMXG!A|j}n33$(Tgu9!F?*&;0TTrP zT>-CGU~qo3s`=S-Ex7ww%Fn=e4gqV0p*Hmm_!9TQwdpczG3i_*$LgiWjrtn;S*!SC zd)f1Hwe<9&;@WBnhsqrUgZl9|IJ~e4UbFZPZ+T0duXD1AX8Y#mEXs~!ZUz6D?zMHh zef6yz^?++$;D53blPCzERQr^wjA9s}g&K z>wo@nSMki9UH|;=-ls7J4>mT8`8fZ}V$t03iz=O*DqR;<28UKI*v6F9sGJgi9iOH$ zxch!%i07`oPYgbV?7nsVI;)|=_0Eeis6~!Tij04r{rHuQA4|ZGhvJBB5(Mw5Gmj#p z@zbmU8$H)B^1%CqQI`(Xkjbn$IoTRl*mQMuBWdT0V8G}BLv?MIQmUZ;s=b5vl!1h# zWXhD8&#LG`0N!;nm4lol<}|=kY>z;e=bL3RMMN|hIxYGrmlqgGO}p-TI44YcE5AW{5(W|oB2enh;7P#e7ly8`)gX4)6;UvlP!@kG@P|gTQ#bMWzgXm_iInzkrCif z@7~81+38$wr;=F*ySv6k$`(AT98Jnqlg+tv=B=rZTzbSsY}WD&cJ=Dl<{|8)j_seh zX_>ARwR-$CSUGk~meA>PORHH6s5eZ2Db$3N3K1q5{a*VNST%DLU**qF#%S;elu62oC_>kJ1ysh5TPJ;EymP;K@_!dAhAzTZsp@N-gVJfJ2HrRy7qeurX~YR86vXCG^Ze2L*6o7meLWbkPoz8@U?=+-NRj}T(#?*3nN62?rLD|7RyPqKSo36q;QnT z5m%#t`Ny6V26|Neo!lvheL&q~+j-4At7ZiH9*9HG z-^pSN{>$0ibb|HX&BLc7sr#L#AVy*l96E8_^IpHhg$o~Vy|-^q$XWmZ^TNuOQ36WL z4l0~*`6b=j!~TQ$MT2BH+4FB-_*bn)w-gAwHZZCr#GMfJT>0*7;g_^UE3GUZ~8%fW@e_|%WCQ+Oeh+tu28=*tzG*=1w1m!R1>$y z1)K3CuKW3*azC!d$gNhX&wZ@(u>Y2ti?6f>QKhw&JRpueuEQ9fkWfHNN8;kLu9Kwx z91rL;it;l(C=V;QcDWRz7{O&?hkN9Ln#9z~=D7#_OyxKXzw8}!NcE&peDyBMo_eKk zk{W$Er6p-?QSL!&G=n)P${d(P(gvxa=H7ogu`E^liI=oH2KWNFQyLtxQ?*)IyOYdv zy9A@KgwJinG{j>ebOy1wRmWn)-#$)WUPY}$}VHMq+Q*x9?follxMqp!FOikU(Rc zMX&aSf#rGE28(uC>SI}IbR(G1OXm5VXiJ}&9=+EKK?lM|Mow(A=|x1Gq{?}0Jrxc} zsy4RQ&G*BvTXf6`nu+D%*R}(;-l}SAAF5QlVG%}|)(SoR4hzid+;*t6bRKaPbF#|b zM*@gO{(P9{`{aMD6V+#mEN7?ZzhMH1as!2~nT2M=3g&IR6U8WCW%MxTz5HaG`*xir zTYjjmRE`dEDM3?FF_SWxDc93h4q`i3;#Fxzuaa8p`?{iUzs~cRW`0sWUcs1J**^UraPr&_oR3f|B*zTu<*v0Z$m$ z;W>$&v)kP3zs&c)#h-a^dt&k&3F%k=`Vc&znkX#r?hAg0BKc4q!KdV2nPUjU2a5&QP?oq~PI6~h@jW3Oo+y~`iO-+Tqd@UP9lU>dF8LII| zi&rsLbFNrD#8Kh0OtluhnIcL`%4^aPlg=8*WO~;C-m^IL{!X1?OH{0IJ3N*RJ3`qdg=L{__@1<)fswd0L;y{ z=5ZxSS?Xx*v<<_GyU!>Sd}clNgJmZ-x98>jlMhRiUv%!>7~zYwH&Fq|!vE(mABXIT3o0|Ie!X10XzXwYwJ73BVg+g=r4oe)gu zJSZ<;dFR?&M{eFzx@G4ZLu^TdzNu5SOHl#IDx|d&5;Du*p2WzaViMNJ1rORUba!iS z*HgC(m<5fwkuh;mnN9)Y7`KV@!pZAoS2U!LeqQO9_-ybYfiHL}h44_m)i!+X{QYlHP)G}9B z*Vmn4UI!qtb8Q0;d$*RT3PWJwYtW?G8Yg_-E)nP0@6*2;85MrhpBYb`K8bHe_UEU1tXc0ZV14QzJ|w*YYqk5ktOx zCJLh+dw@Pl-26JO;R?D?)^n^!%X)i;R!5|Qm(vc+dsMwT!CyIHyhyX;shB=b3W2oJ zp@uS4gC62J(%wq2KKHodX9=~dDya3s!#0zzjyE?oozyMU%FInE%bbKH^eV#X_qeLw zybko(=Ur3#hzXuJt8gxpH(+^^vT_?|*m^5Z1Wk%ICrXOiRT0tHO!@#a{O$W+^!Flm z!~0~zhlUP&=)E?PGq-YT{PD{^|8fobJB8LF^7RWKn;6;ov0kxfu%#Uw5!fa!RS2N^ zkj-Ddd}tmKf|S1KCHMJ4i$+jCXDKd~YF9iFcDp6f=b4O!6W*w*XJqk3Ocm7RrBY!Co2!pHH;8)QcUB=oAqem63@4PJ>D@7< z#tY=Kja*yX-GCt%P)<0vwSn=WzronR1B#&ptFI}B>T&=5zpSlq8a4K2xOkj3#%e>AnW_B2QE(P~(cod6}5dK0ZIO*Q>p_`wZ5 z5H7$k@G_IXU6!>pJ|+g_<@&>RtyPssb3%+=Zd5kg60r3w%X?>WcE(nXT$&1DlgTJ3 zSj^fM;P)}mDZB2p&~I^{Am{bqYQNpgaV7t~#C$9{#-}DKyiDPo&yNlgYb?a99fz?b z(yox!inMRmS$9z?n0w@sEk0Q>2fJE;4f~vISgL>0Oi*it(t9{HQp?W2y6F%lV3g7B zPu3zwB~k`0LkWvB9UP`U1_53(mi-GJsO3=EoW>DSmZqSAr_jOIDjI`YnW`0Iwe{Q5 zH6{A#kSH9`M;PLcTcXaZZ8VY?YBH<0Rcd# zJ-Cbs38zaT-z`LH@x$G>Uv5F4^1Oxyg`U1XNbAbZ%;dVTM=ANi6+5Z(GUJtfZ2J`z z6}3CwA~v@DYao&Eh9o5#Koor9dNAa!rc6bF9m)4yS$Bp?*`uZHIT4mm90`JgdfY6p zV)#sI@87Br5Yrd_wkJEA2huf#=1T>+O#4<`s!egnIg0i3I|lW5Y=b5Z^}-T7HdvSS z!_Wmj^O&a^}&xqw;Q_aG+luex7+SnPpA7p(@Erbp9mvL1}HI$)L@g)%xl0Z-VZDwJMAhNkQ zo%?(Q#~}T9efY8eezc)xwK^I~?A?ESJ3?31L_~Hih&8Nf7+w(3PJUYN zR~h3pC~HpXOaZlfwXES$p|S&0Z9U;lVX12d>iStPnOt8lFhOF7j*jJh5SNOG3^#V| zz4@|Fv?eaHHofOS;rB^vYZ6g23OFHuc z-eSRiu1wbP*^tp;`M+7_{!D&hXz~ZLGcS&BNOZ?C{5Wcv-V#A>W4#g@pY^6|rm~rq zhiehoG9%JpAQt-)IVQ--e*?PSc7l;Y&?MCbYu8gi(C@aYheKyqSLvPly^vJ-E8>AvF0etd!NYnb?p|poHW19BN3=OIO$4?)8wR|bqIif!Ic=27* zU48QsDLfs-%_H=c$bf2FP^nIj$1o}4UcZxwun!?q8K5J>|UI zZI(?>J9gdI+o#%a``giBYUbR&VQhAR!p3DhH&1jqg$7&IJ@{#IY-ea6elUC!8$D>p$+GgBNTKGn` zenPwq17PSNtJw5(N2=j_^GBdY+yD0ViI+E_d{D&OB_TsKI;FQv45_K7SN_lF&o>1f z(U(ifV~N`vZ`#U}-m9zmk+sli`R%eNR`oqRA{~vest`XsDJb;r%E&6>K$3@htyd=H zDA&7(mMvQZjFRq^8kVNGZCLi1>XePW!tvX{N zfK|vVj?~GWm|5tdZaD@ekXHi~7Dye3Wix_HPFkQpep;r$@A5h~&Q> z8Y5$$G1VSx{WU%-ue(VrGd0A-r%UCAZ2OAsh7aL6>E>~7nr+WtxWX7+p;NizikeW;_Y^Hit(3$L-92QJj0 zjvRJV&}u)gHoigmGd-HAb4RNdgbHFyx<&Yn4D-rKQGCY^+2bfK4j;C4>5j#x_?8~C zq;SjP*msCRz{o*S+|DETNOEzp7O2GbL1(mZ2rpuz1p5vM)*!MmUo(;mHDEi`&Pu|n z^Rd_rIUC7k4Un9tOE`*l_$#51Eg@^a`Bo6*+*iDh-^^fU}z1_RzMw-lW<4yT>* z+WOe%pnK(J6bpYt|5_*=OD8{n{zqtpK&Zo`PNI=NYuD;gXBENBs!YXzwH^#e>v11_ z$>=5R)QLb%JmFyLbbT>txb(B4k)tn)vc(5QnLtKoT#)%Wy(wzBd~X z-c6d@3js^LWIJ^Buw{qczOZn}q9A2Cjh9#L)F8Ot#QpoVU8laf%jPCW%eY!~dq8B2 z`jN^JhCog4BJ_0vKmK{~6r}3+boZVb1Yf&3GWui`ey_RPEu@;RM*l^fY6Cv&K*iNY zBN2SYqdiZ#4$W&UG%>*$*XwHMkOw*W#J%%$BI$#)rt^Yhg4XUCv3EIT ze$RG#jdeU)BKwz|9jF)~n^ct4=J1gYO zxAmjy78a>#kM>;KY&qPpuod97VF_A3Srxv7TKg}Ja_^ljx;+3dHpP|6*g4LiIg1SU z)ec+h81yIEV+z0AW)0)5gU#0pdk!>esKq zxe0QS_MclE=K5v^&8WG5aOgpz^T0;0W4yFGFYjjc;|lU3&d&&P%k=Tluw(o;2x@j~ zdC^fQY0!TOAobz8hY2<3?I4;<6=~U?!VB*`k!P{{i5l zs|BL=D>$r=VT)4ap_#2hW4;8j5#LbCrksJOUb zM!G9grK?L#Hd_!yaW%xQnKVZWU6X%CT%{1`z21phj1I3yw}K4wPwz<^+sJM` zZoML_n*EN(aX*7;hDK<>;9OL$IBhLI)Ud)OGuheARIz?5(#Z{vX^3sd=vW(77hDt3L+X=2F>PK%XCiX56FX)o#B8eYUg>=N*WK;jd(ek{B7ee-Jw(+Ndj z$ko(vgg1*=VsDma?Fs3RC0tWp z^$ED=_f13bQhSL*V=OGJG*ds1xert+KkjN-tf}8PKe96o>23JICb{XQLU|B2gxjb* zB=qBvu_i(3+#J+FbebS#85N@&ZY@0pNcbQIn zEmST2eD3xPJ5-AEx?TREy}3Lf~X8DYGe z-*FjFE#qBv>V9*Oj5V_!av6Z5viZL%S8D^q!@mxqXnyz)Lz4<#R{Fy;Fx3jyC_V>E7G0zy6N{NUWEX-AhI*2f}`kmLN)L}BCQj8?49lhNqQJGb?(l59SYi#E#os0-Fn~Ms12K-0BepgC@Hwg zY;Tr5@RHqnue7Q+fQ}$&@P8A7?wCFoE^vm#yIY#MErMo37m+a$VOG#QllBsd;pF79 z{k(h>sd=+=WP6g{b@2rgbc+ryE}DnukcOOtg~4()CqNM&fBccODJCNF1y7_^b|g~1 zHwJIyw{M%iy@eRj_@nx~sHhH9XUex$$ebRgeo3v|F7RFXw(oRT=f3=|5YwdT8++fsiTL_~Uq6q98PSuYT3jyf4Y(YsCjgT)w5XMf^~7I~tPa*L^`81umlbS7k%KQ^xX)5{+N zDK&pGHM9fTkAqBmbedYgmIa&(^wVz2im}JMjG8K4awVdPLxF%N_j4d?7#IqwW7iRL|mey zqYZU*Gq9Vz;yvST&EW9;{XcHVa6a@>IHr23lOv@pEDW=~pj~Kee=+8YuwEkd>o~c) zQ7$7R!wRlYDlu^Uf4fCdhP4@Lu^F}-8y1U|$B(!5=}{(HVC;ORA8odV>@t7a92=3E zy@#pCa4@?v6+bcmliOZ1W2bYP`E3>>IR{!S1TUex$0yV0(mfk=4him2Vj-QX^lR{% z+AT}hM`5U21sQ3>iWF@@Y?%tW#G2qQQ|%qrlno!e+c@cRa{OWygg~i^Ko8s5QCp>X z`S?JrFP&74mjNhLNZ23|Di8qiQ07ugsGbr9{S?snpozI5J5i(|_FONP^LGtWz1h~7!(Zg~3Ey@mb& z@Rx;d#{}gBPFJED97=`f4T}$j6C%PSza;Fu;f81Z<8zZLG2BQy*}jxwYgW4U^xsmd z){t^&XlJL*^LN2l5Lz6rbT_Q>$Olam1QOpC-_;f`rJ{NP6vwwIBrLW7AnKglT#GjV zt)Ho7#!0rbB!1Vh*pWqMG5U{cdGoitw{63RW;%X+&t`fViSE?OiwSQsQKFlHtM~OU zGUpp>*xe_Ll&c+KBEn66Lbr?q=2?9I0@q0tvw(3Hq~ta^mh;KbYQQmKqH4;@K_EPn zQ&v{?F0Ze*7f`u`cX^Qa_P5|=$GDWZt&2#_9*TnZusaB>+cU^$#gO^ao*F-rrKpG)eyi~$%>UKU|$hsgA+7}4@4U(b##kW;2 zOHNKs&QLZ9ees?n*?AX<1*1#jjjLP4cIY(w$!++ub=xO58E}}<)jsfY0Zx5*V_y5+n*8e+exvuL9Gv~bL zeRn+j+0XtxC(I+?cyV|DEKn3>X5nh3q`dsG9Qh81I-{;>;gH0Wm-9?|O@usqziNSM zXy4MmxUkRz<#XL?MgStT+IstEbHd&4!yTb)(|$(W_6!lyf0im8ca-%q)jKF3y&<6Y zrx{w8Gv%6ZMn#-{pr~8g4n9NT_edfHaWm+@YWr<2awq({X)z2pPduvziBnq=zmZ(w z5T<;!jT?gBYDH+GNi$JYlqG}qjLYdeUoM5#Y)3u*R2_XzG6t2`>o9!BH?(vS`|$j? zm(`DV2g2hOO-zqwg4`su_>3zGVBJ;BI~Y}bbY~C3S|ivb3iaFGQQFyUW~}rW9qm6g z?(}YOzzg{dBQH3oS|XFZDBP4_Y62koOv;66X?O3=!>?Zua?(HSPwk#=>uz!w%j_vy zdlYc=sb5b0rE*@@|1@zyR}Ioeoy#B9T6y-*h%x^;X;!w)S)t{>6xLjK31|s%BcmWz z|E}^u&0H76B4Fv2#3UqoqgYL_T8T95?3?BN^8ik$s;XW9WfKDa$L#SmirKhw%a;TD8ia zg`;(TkozCwTszGmy(w&PQ>VWhQ*}4}L`!$qID5S;hUQPUJpPFRtq6_-TByi5GPG_Q z9*OY(u;Bu_GJu7l*f9|#Up#w_<&jA58*W?Ltr1M)QT;HkLYnfjxAyO*EyPFB|C)zh zZTz@|u7`(IF~J>~*%z(-p%qeA082hJT^F&Bv_7U|V#B2g5U zc0c_oWtzLxM_-K?uZxn`D^S_h`1kqu z@7hpmINEd<)M0wXQy}R!6+k%4?1mXE7FR7Xl~z<#eB4&5_30$f&P=jOndOi7fjPOk z0Rp#wf89q>!M{CJuV|a*YXl5Kld-Rxv%Kn&<4J9#jGKKH+y?gg_&g|@`O$eF+@ral zUIApxN4onRAJlGO&pU)SZZPL~t|wC#t1wX5&WnEY=FO`Zb_NCslm6V^s?AXlYPx%2 zyKHb!<#p{3j$?^Q_+UT6zd<5AekF^pOZfQvaR?jPPSeD~@I#l^+vp zMJCsmSE2IrfUE2w*qc)6glBI6yr%;s7%N`5_S5&i@mRI1kKpZd+=re7ycy6ltDK|g zPUqJ?EeivtPh!u((be)lJAt;T`9Xaz{%FGM<@DkP3%}Juncu@h5%tjv+4KzMRxcJG4SU+Bi=nd6WkSQS}cmnBExR{%XxJJnh7kSzfa>kEjq;z7|^PW zvYnVY2b@PV8Qi}XFOdKJFl@LXE#SD5piCtI8Uxrd!ZmJH3-->RZJxw%NMmaYU{I%Z@V!bR*RD8u=03zmJZwEb;$Z!W9EJkpJc z5B+QNHT0f6n@OYcr9uLg1wgo?Q4Cs^=B28jc!Nsnk#nng`2t(v`g$iYqpS?tFY6-m z^76vlr_BrFpN{ySjFOcyBget{c9Ws*$*f^{1C{@eMG0oc zR!ZPZU~dS7f_raE-63)4%T`W?F}t+bQvyU zQW#|#(JGeQV>z-hK%3zCURqoB!m)T-4DstsA3TRG?53vd?%AB%=l*sf=*00moHG(Ly zi{j_-f4on?1B|`ezfkh)KyPj|dg;u;Hdxf(?U&;tE2!v@pde76bS(#1WBLdWc<`=y zlC9nz>&Zk@s+>2o^7EygHx`2W=gBvgA%p^t?lhC=1;|y;P_w@)gbhV?0MgiK1oe%& z)}*!4JYe;$yUn1|AAW0sV0JCeNfsOHB0d`ar-lD2`dwT$%|`V~L^r1LDbct{I`vI= zNb#FW(_tnt_NU=FAX%qXFOfqL1_-WgRG&I}x5QsvrC-QgJtH>$7+U=UZt&0|VO*8d zE~Yfk5i4CWV%M(@qh;(@WF&;p4T~ZQm%P;L4vieyj4BVdh?T#0@n~cVJl>7JujzqMCw3=||AHt_ zG$!L@DzI&jw@^!XNDNdaLPb%xQ5y>*7Unm>aEf!NLpa3doaT+ZNC!!0cJN zBH;!6$`kFm>J@~z(pWE7pPNF7Hm}qRplqDqm~TncKe}tg$C*ce93MiKa7vGOoc3sg z{EVr{;5QOe$ol)xME5l^!15zyFau7kvD^knuHMc3h+S)cCHUr5$cxrnnA;5@Yk~?z zy$kGRs6+O2ciRk%gMhc)Oh=+%9UPnobxFmme#_qM?GeZ0?S-%Xp*kTVbRKCyjBC7v zJx3f2JZ@N{qw_n^^l$@mjf&N(wXSpf(5?hlP5EN$*0s}TOaly(75I3slENub@j#5h`>h({^1n8v<%Db3m|Y&A>Nuk^m|@X@_(`M6DHlq zQKp%$4$WECPZM4(Cl*s{fwxBe@zxhxjq@{1g);N2oZESq!?fVpFP9Ai3Z2$^7iJ(> zlc?n-CEYd~E|UiA2So{k?N(M+Zc$(psHUc-=XJFlm%Rny%n|yC9y}FYU;PcL)879HHdo!YJ+bwR<^G>@bWg>Fsv>pd+g zllVDqOWjOS2$xDHH;*;MbpGhOL2kIXyX4PI?o?c#h+)OYA1RtGRR?uSYw4*iBmTj{Iiw>C)0;ONG#i zN~*j-ZnSZaI3Q!AQj`6OBs=%zi;4_9&<`lPKqFRQ{X5`&0GZI$92M!TX-yX)$ZFd) zT4Q;{ub$^?fTfzU{J>NGR9pw*IhL>#cqWJ*HS!$3HSFxWVMeP|!KuF$_}5Plkn2mx zI4z~vIFG1U4Ku#(OvS9B$@6bU2hfMR@n1b6s|OZ}o)Jkk_H`L4t30gBO+vEirBF5+ z=fAaxN8GehA!(bN8R90wJyX26c=lOyoR)n`#Mib$qp8oC#u~o$o#U9B~y_q-SxF?rBrI*q@j8ak4d9F=3BJ7T(=mpw}9= z^<-HdJj8yGhgB1debKFmJ(-$6@%@u0fR|NM<0d91;EB^e*i6?m64qA+j3(f-I-n~v z#i_~7?Vg`p!MU^Ib-TRi?rami^^O3o#bTc~8x*7H#qyQbtE1D4w$c1ui5@}>+biV1Ig6p%8Lxm+VFUnP#V6eJ(5#(#-x z@y#zxbD@St%Mj#ci57)Uw` z;e9EYzgFqwb}~Yq;nJ3K=i%gsb72?eZnF4HYKqnj%qlWgk>|sb2_(x3)ict8QM=;5j`IR&DpEd?fsC# z>6Y9Tu6cT7JnC=c1r%`D>+Xq{JJ$?S?Nh+XJT|5tQ$h+DfZ)c;xPyhtoGu0ZcSFEC2&L(_c^IrCx zWT1VI{Y(dEI!Sre${7JG8p-kyc47rI_f1WkKv>c20>kY!`T<}bHQz$qWJAfy$XPe% z=r_EraOQRQ9XP6OX!U$guRXdc1mcN23#R~TV#BLvc$}RR?;;=hVggg#vp@0yelDfi zw9KR5D;(TE92H`~cz%f*8c|Gm7WAySg@ye>ZgXd{2o@j-FXravwp*L&EX(%qY@onJ zXVoV2#Ta)-+fB>&{s?1#G>N?S>hmSLH5}WF4TMpr!{K=y>LHmwbdd)vvguD0J`Hn1iSm3vdx3 z#v8$_E3~$@4whPIsO{L1Icx82U+&%zmk?Ixpb!M)9E-#)cF-Ydw_t_ab zn|Z|?B;3Ah;3I0i^Ek`Y#>hZD9iPRa`N}^uI`)9(U@tAdKgS>8k$H6@m2{j|BoAxt ztjj#>IoiWa|HNF0*xo9isrF#X^^J|Wnfxoq9#{z4ogV*q4;516i!Q^kprFJ$-)ko0 z_5Mx^`3*(-tx;tmG^}6-K^ARlUT5OGNXiXO(cS2nLD{jK+|h)`KY}`CAgt&aKc7`F zlDU$0L*C&z;q&Pwta1wW%Kx9Rlt`jFgFh1sh1{$ri-Wm9zCul{e?m3C8)${xcfEs~ z*0rZ5y(U+&6-77#r%KZgr|8&7&xq;1#!fl0%4ahl&e*Iu+{eOjl9Eu99V;{ltkiH@ zdN{g<^O$RTZB7X-ZcrgIx=HuKQV+;3zb{`s6qNz!gPVcLo1X)6&O|$*CtDc;|g6k-RlhUIY|JP!TZ!Xv#2^9F@{xw{n(7Jip?iVSUbWfmRy&*!NAA^J-EeW&xX%#E(FpaotTSvb>wIt^oc2^j(#bp6aqE`WpUgs2yGEeX%YH{HQ9t7L5X1;|F) zIr%32jISRja!`E{wJvE!7mo09?%(o%!+TrvUQ#*%dsg+(9rt^t(A6e-&q1nmqjKkE z0A?hW|6`udO4Z7`Q?A?1qnlIwZ##DrO|I8`2SfqjMSho}3OH_ozoX&@VmXzLA0XGK zLW%^Chc^q+fCYFOFUb7xQ4ru%`KiLC-5OJA<5%BNSs})cV6PY77;K;l(`v5DH`vt*2s#?bLyJc z4?BvHe6GQw@qmcqjj8|M>JQYV|K?&BDFPrBrTks;K&Wv8`bAZD9y(Q-fG9@JVXIV{ zTU7@X@&`YMpN~I2bIO(PS{$=O9AHIhTu$s5h{O1*UHri0%6?uq zi!u4|Y~z72=Tg(=st*4Xr(Q%{wSN2<_rzrZL+V$r!VuKwXkNX$$YtbZiTW6gbBjfB zxI#}g%vm}=n=!{;Q3X@&{*Un0tP;w0u>-eUI>opF$BoD_-U?==LheoMH-d6Uu8@aJ z=GYf8k5TCBXo%mOdrDqW{agp8DMK%U;(EJ%vVN+_I_Kc2^t#6?KaWlzfvHrd& zdzAW_j!meYB2o0Hq~xR)2AoTEKP(McfYW>W<;q!7B3y@2J``E@uUSE}s(*FVtW_9XgiowF(_D{iB4c|TmqF~` z))v%TkN5THhItx{?Xk%j_Ih`HNv5c9R)lF+%r$lmXD6;J_+$u<;H89PpSr_XI+W8m zaD@s9H1@&wR)vj35Xv7k&0`h17)wpnv;ytR)END5@Ti1qIAuZyw{UA5k19Yn^*bok zWyo8GzTkF7i&f%fnaw!=K%$D$d(cTy9w$FNosK<`5Ff#{bkaYT%k$TfapDgwjE0)s z@dbs%x6i^$uJz46b>v_F^e)DJWvtUZ#K}{bn=|SdQbHtHM29geb6Y!r^EB*V`^z56&?6x`{rKY8tbR>Kt-@tqQn9FJ6eN%ID2r3FX>@Eyo(j5+R+Z5A3 zzdT7qboJidy9xqcc(OV=T}J-vNVC_k&kRP_h_FRV)Qb4^e0&iJrH8f;tDvCf$A>ox#ZNsMUuPY8PDLBFk5IotPL747^b8EpB_#@8_~bI! za}3&{+1d0$A|lc1x1GL)eWnfV>7)C0_DV>T3m$FOI{Ncif>NnEV|3jD>UbSIczw|< zzt=?Ym2~3`v-{by4+#4{t$5U@tOyvcQRvyVo)A0r&#?{`!ZoIOwkw2YK&8Um6a00b z#kUl3#_EoR0?Vt8latrhMk|&?QPpdcd9z*O*D@2nN4V`w5EQ%aDj>Ti!`+29haKF} z(`;;Pb5eQxj{w%_gRv`e6#o#<|NQyW?h{Np`*`Y`8+Qbci?L%b8e&IHmoii_QQv=f zm|bE%K#43j{6q!+JU>K6O^9nW>7(bg>R)q@-N6~X4xCrc?zDLyy4qE0u2nDbB*yYCI(c?qx^gAi8%T0Lzj$Ng13Np`_*6GT6Y1iB{?j|pJW!Oqr%B`{ zEuOk|P=)6#o!0wpB7@%iA1}i^IaYJ-4hVXRWtM(2Oc&&S@_PV4g2BX-xD>M?o5|H} z;7{;ML~|)OHlAu>Ja6C)1~4>)ES$2}v8t(gD0O%7L!tclj&%5c{Z|5c2KAr%Q$kWa zyX5XHyHvSaV*X*$-qn7&m^@&!LQ%7e;^3F+>sm9-_nPYRnW1!HM*X>JJX;-`p|L!v zwaY;4)O4B(=d-xPWn17emKRDF4nr;d%hxw7j60L)V9F5}*=l#1M0_Uu*p_d8r8$Nq z*1@gegkdzhS;r57v;LEu(9|$+ziYab2NoN92nwk|)1K!8rksS7biHcHO_j7S&&+`v zy7Hpg%sbNjNp0IWr{{l&Pz3jim7Q$Ex3g<)SewbXcZKee`vWb+p(G~ovvwxeMY#l~ zp2eDLx7F{NO6!i%lOwb)yPNS>C{pz05}jo+SQf-d%XF6oWCE{pyDw*cwy| z^+VkbcNP67jk*mCch;1}o`^nm6#9T0K;B)DO7T^7T3#9S?ZDGi{rb7YV!HKr6nva&hkABKv#*%e2*@+wDF_V?2H6kHRkyDuh5MKkG! zUA_`5CoRp0RLOTyPS<_}T}&ShrD7s-T3Y(983^y}MKMvwI__k~m;58u)E1ZI9bCX_ z_)BZs)s5)dHKXkn0=vpGB~+316r5`X@63_#5yG+qRH~jIBu-f zMoJ_KPscdNb#*hVm~BRC^6J6h$okmwjdD_z_3f@!&E7kKE{YWn7&&OV2cl*|!;M2} zw3`<`MVIE`ihKRau;cX150M+ewLc6y+vjt7c^nuzt6iO`ka?ABl~eIHxiT{4)nfyu zZ0bedb#$G<&MCOwyqVtItAF@r$0=M3+#`j^NIoeH!~z3NzfD(|nFQar2m( zb@)|H8+Ei>sms1S&-OU=u}uxTuPWwoxs61_BDOOiz=tjWG9u_6AwK#Rp`4O-V-jz4 z!i0%oNM54!r>7J^-t=HLUt73UP+^LTLsD$B{Yc$z$+1AGCHE){ZZTl3z`hIY^)5vl z$;gS3NT=Tn>9Ok~ol%v19(^+8axz(g@^flY*L>i|>2?%~59&=hamzWM?On(@x}A5$(PIXqEyaNaMf)r^_yH-`B&H6s5ocjBF^ry{J9VOJ@8@d$3Pb5|+KE%B zA#yt2Thf|knVcchv4@p8mSvOMbDm!K*D-J2;K(b=7juuUT`#m9pSI{)XCKaJSFE`ac4zNu}6f4E`X3er$edvI*Zx9!K(i2|el|w zNd-ScO3$td*-@XlCnOTP;|6H9N1UwfRzld}DjsI&gG2>e9&<%Z;b@sn^r72G@ya{L z*Vz5YfBM$nCHq1gJZQW5ZAVMgi*8OL7iZ>r_0GFFlBh-ED6)~A+-2;~BM`2Ut;W6C z*Sq~Di|5%Ql-dzkfah2)w0M4Mb}GldIe_yWZQY?V-JcYgdNG>*|_@s?c>i zQeLb)%Uj8qH^kUofC(G2oi`K5{(;tO)$FlqGjwNL6LwI2h~#`Uvq2m%*YjN_W`ZQ+ zSBoZ`@1WHN7df))Qk}_tPY|+a#|hv0uYo zAiiSxJoyHX^~C!u^bkSN$sIb2*mgr`ZjDwt=OL;a^sHEEBERBUko*r`7mKtLo%pGB z97K~7!VeL*W%Z1_6{=PV%v82txWJy4LH=Os?d^+D8yGO#;}p=#XDN2b;V?93!Y;_g zTmShtCShuJ&2R7AlX5-d_{XGG`n8IJb^rYHetQH{GRsXGX_TCjT(*FhBu~p34)t0u z{{_qa&O2WI_D)W3baZvO$-8H*X_#%^<-07%o)9|c?M=dMUzuNNHgr|peWcfEEojMT zwrf*fL!+;EMPA9W#Zam>ax`_iY~%*sllBK;fj4*tCo!%%pX$#0U%X=xt4PY8W6^8S zIv6;y$$lmxB{kiosV7Fk^|q^+{hEIe`zoIj_p|63n8IY4&(2rUss_8d zq%-Oy>=*wb#`rWfDa=zi{}d^o&ZXkovD%Un5b#vURZ4@v3W<7ip|Pt)xscUnicC)` z?zUGl#&Z4T%ah5_V&0cJNJ+y)g9ML*>iPFe1{#IJG2HP}R;e-fr!=bbnT%pKaP#FA z=iB;ds9Er?ctPSX>tZ%ByPDiXTC7b#B^DT6L#=@pN!EL_|oXU=Xm&sv-8tqq6) zBW#uWhaWMwMMl6PSFWW})9%cB{rho-#{rcVEqVZO;-l*$b$trk*?W`mzhGB)*fdq) z2}d7$enf|+KQWWqY-T1ZrK`XiGvxkp!pE|2hVtXoH{=OEFz>wadE$rXUq7y2B_Wwp z^^Xo=;jeL-VlO{B#xn#1gQ9f+Wpkn)a!M=@Qd_i`49f?Zfk-n>V@+L~J&Y5tj zpt(=v)LR`jwz>~y)|PhHJpP%qEN9vMDa5tuQ}>EmC}Mf~0_$LfqVneoci-(F0tKXbHp4H! zv_bFnGVzr4x9Ijp=marYtlUn2Sf3%CJmm6_k@r#QXo;Za_FT?jiJfm>j%p5rD%)(w zCr_xG3)g^Ot6KYML(53pGqO24rsEg98KfoPS)P?$)MH4{Li}xVI@WZw(uRbmn(4rQwksZItC|+GC`j=5N+ItC#&}R z_^6QJIaxoy3}bX1n{k*;^&KStyL@RSCBl4;EAD=iCmI`_wth6QSjlV{1)f`Dx3ja` zp~Ru0^?_%^kcN}wObFnU-&=C#qbCj`O!ZR=Od_*aW;oq`5+OMO#Ysh>+SPg-m- z&LqL%5HUb?R2DblsQq0$zM14Fwk(QrS-(Y|b0ImyBhWFRFK|K%#v~Ll$0jKBGg!##Ps|diehi zz7~3|PEwPR@l-yPsD5P@=N_^P&fIm3JX!(E>gi?e9W1i)q--2to*7=fZ@9UQJ#xtv zHeHb;74}(4NyAD9jZ$u%+RwYZuTW(X{Bk|l#%O29n@mnF;c?kxBUP9?lw@4auluel zMFn^F!mV>8L4;JLo=fjeAkqy!?@fJ78A0Pm9lzy>!2dRd-V>i8!zIoi^9j@)>~h;L zg}FcJvV+UOULK?D5ALWdD@(kfg$AU-56*$uAdB6w<6<&qbGOJu(LBAKhLN$W*f+1o zAWtQwF23qvwX-1ayEcHnYBW$lz(oc`dVz3;^3O`V)?1do>!+BbPrc;@ zxPe!5db%#$ZL7L7z}vg``zHaenUQ=*tNamZkRqB5l`GRJ(#t;hW~;GUxylG^Mx*~( z8PBr>#F(NYTRlATzDE{D&1wGWRSXGvD}9dGbnAo|VsN@>h=rpq=S4o_2eTk|?~uvy z!w(n*yZ{@zPndVDU8OJM5r`n&iM2=8LNKGOLh*(i2O-;s+t`PHAT<$BejIEfEETSY zcDZyuIyhJ39g5&d?iw>JI`5Hhs-T z!1Za&x+T%koPBbS&^SLQ06R_!OxbMThDY_+c{BWA-($l}YuEQw`H4*i1AtNDvpjO(mm+pIGd0mz8`@*L9@2t9Y~?Q~w2>g4b=V zJ!FuvN2^khyM6N0>A=?C6Jii;emyqbVi zDlV<-^()QydGc6Ic#UnaYAE~PJI~rJe3ORUS+3}+rn5lB&|=mZ>epu&R5ub!%tq*u zBpeT9uTbkbYz<@Ar#F^!w&m-kWIuZ=tDq9oQOKHLyX|kfj&+5#Myurh<5f}YdK^QE z5M$tZ`5SQRDndfP%gBVN<2z4i-UWF|R!$zt>-pv%O#65*?VL_n;woU5G8uJ73%#S; z3143Ix{gt&BlvUVd{xzt$SRP@-%FMqE>LDLzVJHK{qxxN6_0-uXD#rb`Z(CAVD)*&;C-$+-=D)2=de8)-?_IvT})yDE{oM|PY^R0ir(SpFC9CO$7YNQ zZAG&r51+rKS3p~rT6C9~sTSML?s93U!Fq8T7fr=?J5{#3|M1<}tQnJ$*L%I^7JtL- z7dIB_V>Rk}=1<0|(ktIP_`$|YAxCBO_LJ$Ic2|x3{QQx)c&W!PtQ|}hff~5HMHSA7 zs_WXO+W%wIf|i5t0`Mr5no3QHB;ecfXsh}D82VaXi#30JYQBhXHdZZ9+Mg#2uO7JV zShRERdH1}_QkBDmZFxvcR8rZuGV|V(g0y-4CPm4~a1=Z8{gg`Yrq<8CV$T@l|A3oy zXVn4cDiY8~MpdQrBI)-y2Wg^1wf|Rx^X;Bc>z7j|0!!rrE5}$0G2=S`n9pf55^}=9?XlU%`}SgXQWFDhC@Ns;IfRgb8@pTwSMMco9N~Y+h5gbsC$@)y8-D7*YjY$EF@5F>&#wmDM|to{2b2r`+M})}Qg>+sVX+glbEcTy_xL ztPPFr=iSwl>Pr$*G=_=@Pk~v&{jG_y3ktqM<^BAWw2?-oG|uKx(q z)se1jPCS>%w6m}!C&XlST@HmR)2Dh7+PrtlH z)Qht=dLUC3s+jbzrYDI&kX55xc608+no?|VXv&$|vtP&G7igZMUOqdwzC^%>qQoP9 zmu)rP5UD0TR-!*?9U4kVd-s;I%{BUo=h&V6@x9xm*lU4XRA1_5UOJx6Nz&ZDQ(Eym z2EAw{OkLr>5qHJyWJrg>_M8Cj>FC8baWg+cjx%eH-Igd`iHgk$x^EYIO2|J%Me#^8 zF)`_fzb=ev81MXo9EjqesSv3rm#)zpSE7G5f0N2=nL8+p>|u1~ci zNy&b`R}Q&4-c$5qxk)lmKBQaUm_GgEe&waM5X+6&-{k=~;^wu6Y9Km8=vi7{2w zb5M_&i4$}0Fl?yUzD0lZa~!*ZA|ggBU(&t@*J~xSnGWh$!w$WPV#Oity=eN5QpoWk zR6;%UvFD;feq2U}#X&R)l^j!`+FD~u%P^R^`sS{Yv2YAd{pAb4$v$g1tL>+MSBO5Q z`$<|guPjU4+>H4Zt$LvYFZ3we`4hjy#HLL@3GJQ@p~MV_rf1EO1k=H924%HPGY^`x zKe~gER7W)=atd6wtBa7Eyx^xO7E)WJ@`hSy)+gVH%l#Vy5Bck>QDKC_`J<;nbj1HD z*1}^8a+@{zIUrFh=bk>MP?#kk!JG~p`4bwojN4bR+O5FoOWk`ZcBE{PaNZDa<#^p! z9XxMfEr6tylb@`waQe)gl~K8+U_pJ_m#^ls(|K4qprnx;wY z*H_)?%fG>ygi_0mKiRV&NpRPi=M1g;(>m7myNah`;%F)0vyUzmi=9}>@M4;coAbs5 zsB(Xv@Bzy}xw0E|DkKS;@^J9LsxO;+S^qm;Z1^NAmn1yPibk5`;$%p(KBo9)>giH- z<#RVCpM9At9G5ND5`@;Dm;&W?LE9_GUtqa$`!6;LH!{aGxJ`9{?{qQ<{kh+;=*r)$ zsxZ8Hwr4G-5!-K;T|Cc@H9d&8f_854o%YTT$=6PM1VEj`uRHCLm3eE^laA@aZdL=! zN}L8~!g=iYxUa^u8t;RIB(x=Nc*$EaRupvW+6~MQsM?fQ2y97Prt&)|;};|e9p3Yt;h}cnauAI1?nR`hucRPSpZ^!mwy?wS zTCGzAtR4La9{fz3%8B0OumbC!y0np>+Z7JNRD;E<^CrpaQhp#i2Q@X))$3SQoXh0S?(wpU8HcEAi%*{ryZZVW!5KY(UG2YxUK;N*s82Og z5zhWOEIB|g@k0#JLFDiMh+%(oOkP&K_vdoKl?I6{V9-DoS?!HxJ>C-t!4#&<8_M(& z>=rHemmLmH-#jV50~_w=$gnoy(T`|-eq}XSX&0T9Wnv3T?BsOxT?sF)1B(EGxc#cV z-$j=Qctbi=h#mAAad=mfdXwbFy^@u8ye(siDk9lFIyf|1fpcry`Rno|O3rdtlF@hZ zC{k9_o*B=)6C5yep}6q9XTa3H?h6(12{B}2CJE0i)$5T0PjZi}l}GjK{}N-GK0R5d zY+0e+^(O8g^Lyv`PiL*Ml3>2v`@OJ;Z`lf<&?>Ry`u+*3NFU>*Ub;nV;|m7lQgYkT zjSlHyZJVKer2 zKQ8fc@;4r>Dz`7Cc$xIZQ%_SAS>n#sdGbV@*S&;(&+xpS5wLzGG2h$zpgr)JO<5q3 zS&h}>;NC4Gk15UPnFD%9FRvs0Kl`WSk6bp~J^){O?8~O*`dH80gOeQNE4y;M8&H7Z zvzScT?(gy~iK7(qRP$~L;JCXOtwe4X#vh2z_vHprs=H0f?{tM%>&Q^Kb~oSWO+Vb5 z9z&(P4p&Rd8?jdPUDt0}+N5xO%5CESR0`L_O%~Vs7LBpHmRz~&E~!9(q(a`WUO9`` zN@8sODE{;ECH-I9E-1?M+FQ}F(Xxmc^|0WBu_Q}hyWE5&S=U;IL;Z853rACfz)?T^ z-&Gbfsz#f-c}uOnsgF{^vxFf75+}sK-el{mpE%m*h>I_T{mByjqf6($c*{W7``pJD zo+L~z5j4fXX3NOVmP1XTSEFPE9A4FGlXKhmC`n4SzpJ&H`aEM&rJ;LZTveRY7tK_| z+ACkrHcvX&{*~=TcPB9}B!Q9Y!WCRY?ybBB31+VQuFKn}P?V)ZX4X`QHhYCj?|!2c zYec`1DlkY&x-wDj#K4FET<2mW?LI`u&j}nvkE0BZNTIG6W#+X&_kC4Vk<$ncgk*9G z=V^MPh8r(Q{);Ha?N^M2yG?Rw6u7I$kOm2xjIJ@`l(anQ!n zB+)vYq9bT{e5ZcZSMNug1@_hMaGne~e#HpEY$lpkKEJm6%YblO&H?*iXB?3Vhp6G$ z@VX4X&%V_}7LoY!^X<@Z#e012dG!I;UF+wGx$R?K;ypsj^mY6&aM|4_Up>F3zEH!_ z4MeOX?koA^VhTH0m+hCIaEPvv^(N3CRQY`^m|M?jQn%+v+1mD7;YCK6V*?5VqNAcr z=Z~fTBIZ{>M^&GAr5JC}=Cgr4=SP~%91FPzJ!^LkpO>~y7$4vI?e3TX=CywI!&^v| zLUT`ewYQ=%Epg)8!~UA@%pWF4KSV#M;UB9z@MX?{^DaOXIMn?}3VzpS+trS%$RZGH zuXlDll5})JS#H*W!L2RZuJuEtj?fVtACrW!!v9hl+hD_mU%DaXMh8Q%Zt{I*{e4Wc8VA%x8sYZHEJACNI~o?vwl0@46f z&!8NZ7Sh9#nr`sbJkT#bLP0@p=6j+i$-mFv;!sjYtGCfG?YgpdXD*lo?QPHdjAqpo zBt5QJwWo!Y?v8K(pgwCx{<70(S?xzJ;9dx?TtO$+zM)}a${bo>e-#%~A^JR)$FXv5 zez$IRWp___2(x(D0Fh9~<~MSD^7{|dux;xFgQiVn|2|1>kofn*zX_=kf`K@JQr$tr zIz&tNWgWGPQ8@LHSZ|L&tVJChGTX(L-LFa5 z9CZ~zt)<>~mk8G=7d>;PVXd3mJp)vf#899Pz`VW99Qua~P(EF~3pVcm&BXH0ciTs6 z8um63p(raxa<6F~sHeZc2j*b;q=_afFIN&}+gi*%GdOQ<*n9u~#@RA)449p~7T>+Q zRD-tU82-7uySN{AsbIO5+C4W>Szst<_5VUp!`HMh;EK{j?$ou%_mtb2P$3;g?E*oU zB2U1JV78d=KoaaXbSi(HiH?a$0@3dIXa^VZ%uJ(^EO8Xj1lKw|$D|#VVK^xxuLj@q z1usal`7lfsyVY(wSkBePzLymGjjF|A8f4;0R|9ztJVlCZrty&&_q$RX$rQY4W~!y4 zDBi=@_h*~v@{D_@B6p@PUH-Ojsd9lej8Js%oc=fhjXlR%is(N+Ai^XxJhi!Mg@8AmV>$L{>jLosbK;YH-H85QDg;am- zL;F|?UGCPC@Omt1>;A({IE(N7wOhD)8!BFhDlvKOARApQ4 z9A;eJVLGkiQ2p&`EE&M@q4^Pi)i8Qwv7;j>*>2*yn;srT>LuO!W{mg074!)b<5L8^ zutkwFqat1`o8_iQDGVU@0{=yaY}jILr?b=+WMCYutOwX5{l`ELViRlNKZv33z9I>& zF!RJ;7#YdZgi{F&wDm3BK*Q!K2^H%Gb?b69vjAmT+2o@_4p*L{qhp2b7>`5Kw8`$C zj<)uTjfKWwN~q0t>5LT3GOtgOx-*6K=cp&Iw$;3^?Jsid#v$jm?N9<@vId$LHsa2x zLro6ee18eIBq)^ucdf{194FSMZQE(9vjNZ|DW}-p`uT^-j*iN!_PqH1+ePrrPCxTS zhAwOcrC`z8eG7{@01f+q;*s0VSY0y0#ogVxCnlpOAG*v13UXKi-p=HGw=9r=P;eC& zmon_ln&h(7ijQ;J=?6v*C#JkfOx&)0MBMfWI(B)SRJ|JORZbMwb7g6s`s9lpwz09? zU%RJrZlJU2`HX5ZFt&cckVrnH*4B!*&)OZNcKW%>Zoj~>ztJ1+x9sEV3ll~Y2@B9FEM4xfkhCU#4uHOT;S+BfWspzqHTxNn)EZ;~h1XNiFn{gVp&$+=Hn)p-jGeY


    z7HOhbpbXR+$*qX*B@3#@atCn_fy9UGQnlC@01~y++F2=EE`1@#$Qxyc)sm;w2bp#2 z>8bAC%}h#CLlx<47f7B833JNY_1#&;ADAU87w?^4CS_W42Q2EfoeBFvmCGtv23BV7P zy0_vZQ)wrF|t()8YOvva5S z7*0M@lQbyRXqcUutL~GHuW6LE2G$JG7Kf?cZXbhKO_7~P7ohJd^z1Aw(8EpM6v>t> zKL#39Bp4dm^y2FUJ<+@EwFEo~&|Qs`5w7Q#h#gs;{yR))# zd+x`%m9$!c$U^Ga;eoua;XV(z!2n8;VS4&q9q%UO^=bBwGdUS8j3R zk@8k{lkiz_9c?7$WiIZnVAx1e(cSw?k13b8qXTc3_*e$`IZyCCvCl5mMVqRfpY0JJbh*zr%`)oiaLPVm<}vO2&*mRCmSKa}NY0ZaynY zR{s;L+D`pS+=p)5rbtdrfb}|IAg{D}xT-7wo{w2MKh{c<{#{Y9|lwAs8^`0zwn4*RE*vy zotrNirm4neTYk%>aLvz1He=wihef= z_POOw`Pe@|CsVgKvdQRHcNk00POKfw2B$fDO^V0pmF=@<7kV~txX6vyOBu?8it2D? ztrxx+D$adTk!yN*H6(77D zk*oCnm$e@LjWnQ@vzd+RKfH16THcb|rZ%3aB-;(=MfUc4WcUsoabrs`L)RzHby06* zYdacv1SL>g!m?#1qZl=wEBh|@Stt#ekKvK_HO_;eBW$o(_aDGKotVV14T6yxyf6?% z2@#tG{dQQs8pNzXj#JOAU|6c!4A_{O7KgqO-L*C58Y7~vTS#wjq|;oc0W2>S61XK! zo3W)8#hBbER_6e?gUPGflt*0qeTu!OlIh*gO;^+K(pff^$Lq>>RmWI92g}HIufbu) z*gr=-Yuk;gF$j#?TRtRi#_B}=N)%B&y%a;EKG5&9v&wE_Z}YViCUL0b5a4(=wT|3E zk~~P*{+4fMGXInc2@Dn4Xx&YPeX|eKi-&#F=6jFPn-8GcLvgS*jWvwR-+b@y3H$pq z)G%jeWk2AR!uJwTRIe&)#Qo5^cWSnZ+6C)XL|Tz2#F!YPp=^9~t>Mwo zWR~x53_(?u3aMH;omJ9jk{u`|+EcaZ)}YijR@m@Q?95lQ()*nq*@@}u{a=HURbJ_4 z!;rXiSfOm6vm1xr2xHla*Tu>v10I@%*Id8#o$SU6o95Z_u9W9+?;!4>65<~lL z%T0CvymEQ{b##=c$mn+aP%MsuU3jl?uUYAswhIn#>-e(a%zN#6YavJF@CHU&AO(%> zqy9?BK zudje=di~>`fnG&SLRv2aq>*k=M3{7UNw;*DC|*EnG)m`4K^Pr^fOIqIk{ls0K>B^g z^xpq_-gDmHIrq8)V|(J;^)WIiMx9w0wS}Qt;&etfJaPsRV8O_r|K3<)?=(g@b=WedbAbcv1NKdGT?r8IGAItCnlN)=Xe8xyXnnvx zA?sVQcCh^Ea5Uw-Kic5G%G|HyF>{Z{JmoMww|@C2t9dH7yRaY6tN%z(4Yg?4dR!espot3(8X5itWnm0I& zk%H52pw=5MVG~yVD-n$uL)$Hvqo(_?6#H)cPc7&bexj>4*VHvN5hY$eB#S1e$Bv-~ zB6>OnwUad-nX!8^A4HVJ1C5=(n|=Km`Mf5tx>|akn2@mSFL`VYfV}XD6>u{@`jn(N z&`qNb4?TpBXD&TAi0C#QYz`NhGBQ-i$@uJD$SdNzvO>xt!Zuz}E~IBYS>0kT-=2{D z5itnmrqp)XnCMU6%$6k&-CN^#?3Fr6aoII1j%<0k@~O9KN!Q>qD4YMHNPpzyH;mO_ zt9czfZP>Z0V=NV5mU8Se_z$1}R*V+cco=Q`J?p&pbt{jJBCeOKp_qZNXWb=#z78nR zRJ5g4Ub!RsdEL&wsMXF`%via%V*`Hr<+1r!quehom8D)SY>`ol_U*Et2Q8MR{}ii2 zZf~`IButI=Z88Jh0;u5;-m8yV`2LivEO&if1Mzmy5ck804+^Uibj`2MZe5;tr~w_Y zw#+0%#4db`KMiRFb*5GES@p~>tGS_T$0{wn^F^#ie4q^tE5{~U9@W`0-TVvdD*tc& z=_J!J6b#Dd83QL692&Zg;g^e(2IBMmf{|o6Mnl+!l*?Qp#~XwILS4MY(GT+F1zj+? z8}(>%0sHi?Zfogy_}X4!9@_E^#iB>;;n8s@io{Zo8|UIS({k-xi|yGfpE^A5P84o4 zx0{~g5VIIZvb6Hex61YnS#&!(IaI=-Hlq_1sa#eg6y9SA-+iyRJcM+ber7;t_9dsM z$F?=T`T8uBQgBLR3fL4y4I7rihu`+gKI<7=MTcU8vg50@<%}#0JXIVsU8I6`@%>XL{SSApW9=V5 zJ!9T~dk2=gmZKMIE-c|{J)O(_Bl^Rf@12|9fDIFdhPYtx@%54DHJDa|#b?mqQ|{AD z$5Q#zD`Of!b%*vvyf%^)1mo^#t0XO@Uy!A)aGF}2RD-e5L;&Te=i>p(A@j-1r3~-( zrcThuEsp1rYeCd2$u+Ud%WYo-2nYxOz+3{T0;YqJ zaX_Ux&ALar5*(w2-GeEpua4}-P9+L{);E)>dAds@P;WyE**%HZ{&Vy`q{{Myl*=TwY zAjK7Pnz|Q_nZkP}CZ9*ZMYeuFXZTMJ?=bLtJYPmq6sP96Bj|ekY2~U{?~pC0sPqzy zeiP2%7s^DAjBlkTy}6$h{1%^$`(iYh5{j6qdosE%E82{~*4UmThVxpSm)Oo~fL5;I z!G>Q6cPZ9d2A{@vsRbEwX$Y^kFYP34-zOm0oh-_rx#`(^RBv{j)f!4Is-wYOhJ_lWPm>kg)MZ1$7 z>g|zoAvr332Mx(EiVuGrpn(>m>X%$C>KyuWwZ0nNKfMVEPYWx#Stj3f{GkZE4(GRM< z0hry$DmR+w`nz)5W;y^!@i$D#L?Wwy^T&h8DIU8i{@}2%ND#^#8zZwBtySbS?E&_6 zu8RIN;mgP*VF@7b*26x7Mn3O-|06A-*x1;j$3|@yKW84k=)Io{N`1|L{k-EKkmPX| zu%Aiwmjb9z7B@W4%}*UGQyC5A_D>cy-vEw8-`VkU4wm$NP6w%_;SP=!Xlmax-|E%X z7U9y+DIfh?ltQUz?#GHWw=HKHWrUBH=SxRDmL@VPkVwfkbYX7_K8ELs(|chEleUu1t&5n=#h@O_*B`DIb}RS-xTWs`IAO1IsL1xRL0 zzLScwntUC&UfWd3e=|wo0(b2Fl=zs}g=bOGUFPSvr#(%W`s0)4si>zb6{VzJyyqEW zO1q|@1y0hAw1!Q&wv&JUa)YxO;(vR4`^sPYkZZLhZfv)0pWZEnz%(5EFF%zdX1)E5 zLeKWEsB2wf03VfoeyiTo8iq8{jAgcp(^A@0-93FMFHOY;Uyqe$@fKbB^-&*@pGWN+ zr{%yR-@ciUDCmkyD0D$tND@_5%elDgY`YmL1%0p}iDtdYgW0=Qs!B=)MMXVBLi|rz!AE{klp))zmW2{hlGOaFN4bvZ%*GLYc)r3v9}R5-lx_&!K&qxQ}BIauTL*d307XZoJD zHK1Y($GKc>M|FkUR2quYzFat&H51K{g8mKb=;;_CIo)Og*CpS1XlHExD0*a9c41Fl zy}?<>f1t$bdNdaLJ>N=s$M*XthFwmtweS7?7qgn*wH8`+3iqBRDm>ysT+G@?E*h#V z@S0*-+69v`%Bti(@Ss9P+GemV^4K|r%USw$5sW@ZqrJ&$CnM`)$n`yZFFFS{y_%Ju z-cv!NhgDvjB^u1!dq*cX>9Cs8GN`45SLjlVB}i-eU+pL2cJt=xUy0|sZY*gWlrM=_}jDD9}IuvV*Y zLBTwYZ4Jv~P&eAnCHpq;sespVYG!|F>=BjQ&+N_={*%1Jqa&q3{gYK*Tg}qJ$;qr= zl~03eN?v`@P?Q8Si?v1)u1%fpxpq+hB?Z6H+($3EE4ttkzVR7fvgxoDb#_>kV#GL& zGUfn?&{3jFW=lk%nQmc#+GnG;Y?&45Jy>dc@ax;RPXYo0w*0;8i5=_3J~}J?TSk(A z=H!z2K$@xCqfjWh?K)+RE&rF0Uq!Nc~@?oEz1LhE>U+`_wR@(dRr^qsD-a);rFJOlHv<)<#y8|!DThuSaR~7MzRWe)q&7bASrzE~g z09S`8a;;b0bUT{&SQ1R`6Z7>Q+vYRbg3})Ey4DGDdmEhTt$S^dxR&=Iy!6lZ$j_wd z^fpAOS-V)RVN@dYY9FE{(L$lL-M8- zR0s^DZ18F3-XSI=&R(=J=PPV}ck2;VxHNoqwL$=X#tnL0KD|_N^?G z&?$Y&QNh&KUfXV1g=i6pp4(|G8g#FtjKW1D6K(6}{haZk6!pO*7K54i!!}e*Vh1Q{FE;L?++3L$(n+R3!{taxDp}dH)t1SzI;(=( z`Tn-#%Kn!O^U@YKnkyG-gPuJ-bB=2fnO9}e&7)OSMXb>K{$jhwy3^3G6TZ5+sr-m5 zmo|hXKlKy4jr&K;IQ6g8#U2)E*|W)tQ?-Cgu6j>7R5#HLXFtxCmqdL9xKF-igrg@L z4w3~sG&K0=xkbi@+y)Q8wV#|!d+&rL&#Ps79OV~Nv&57#OP?J!Z|2n3yG#b67eT*i z6qF%BX7$|}2anxJ><5xZlOZW7ORlF%p8FeB3qtb3yHP{GO4?Ese7=;UKZ^R+gHL_? zG{D0URdkK>d4>^hfySp-U*7CY2O-?nv*-8S>3`|etAVj!q24|z0We@T3|1HGjQGd7 zqDMhB!8<*7Me(#JIW$;t1M#y6JLd%KYf?j>dVT)-{=XBSUyo+*PKYfue~C#)==_;A zMAyP4>wVfQnzOM{WK~~Zi+uhT??AxasX;(sOiBN&aQ|elF6#Gq(l+> zxnBgR6^ANJki3@wcb)4d)ya=(AFsiJv#p^9E7VSJR<`eY(q{EaZ35lxzgCS>ei>T| z5Rwg5)bH~0CY{}*KKe)G=jlFx5%Uc{oeS}GnVeVNs;2@01>dvv23gr+jgl8Bhd<10 z6Yc-*j8)BPjbp1oBT`O(RJ${G4(NMr^#V-hg|L(*Q*dYG`aT$~JK8QTVL%%ceQ-S) zzDNtRH0NW1b#!(Q1{38|05ndd4Z72J_bqw-DR@P$f0lQXTHq0O3M`mTv@?ZX)UL90 zwyZsC)YCP$tzX#zlb2WDP8#98;^yw8@A~Btb#R;zjIw2{?+x&E>}$G!>uQAF)GmH`g`QN*Fp?+5nGaWF7{4JT_q*s1;@8f8!$K1#COIzY zR3e&f-lWthEh&_pGh3NZy~yzH_g(wJ9^VkZbaHaINqzEZwZeKhkl+KC@99%+p5*>y z5?=)V(g&rTBAqI&Tf&%6H2nHZF9e*o-+=6qlD_XwMtCRtdu`U5m%ElkByqVpIofax zz3;K6@Xs0X>a){#TotuC08(Wr=w6%Ca-$E}EH=x)#wMzoyFKC95YfA&Zf_B^?XUw4 zC4N<)+wi1#%^e2EoNRhaf{Vxph1=n^2akz}dtkz6tK3$**}Qd{f`A?1nDvGu@+1N0 zr-CjMIe8|-rLxjXy}T<2ORlSpr*(*hsqNSbi?*<%!Jn(L)Z@tYKIFQcRGn>2vaj5& zx-CNh^>R|}K0XE-Vfp}oYG-G|#+FkG9QJtKD|_ zvr}&Unlt~ayROrx+O%`_uz?DY{Y(;Yf6Am@7~8u!*x&rl`Pa9HZ?9ba;Zjrna)B{P z#&M-X#nzWey+{oZ&GYAh%KBhzL!nL)I-I6Jw?+>Pr_Q#>u16w@P6KzQ@{i%s`U<&U z{C&KCHq@!3M{N26LqDi$R!Paq5(u~%_~zYz0iW92bImPt+HgjHuRjqf1mp`;gOU*O zprq*Gle)8$Gg)#TThK*C#G%8QBw(-87EV35F)29gZsJ6)Q(d4XIQ8mCbUy0j7`AW4 zOEkUoOms=vgb|rPeo)7r1gLEL>Lbv@W5BcR=3QD)(l8jHIjU8e`yxhlxIzP$+{dZQ zb0Lvg&6S(6PE%^Vq9d=8-|_il*yV}7SJrDy+5ZWO1sdv;%4DzYtE=nl{hXp_^1?ei zXSK6lRql9)KP5$Y3`g5lJbrYCuMD-{Ls-OhX1$|!cWPQFeXV(TBKnKwq_@{g32DPb zaSfed=96ufd@$;~v$(K;-qHWX1PX?pO&@KDO2d;6SL886^1kV8$1QQ?R=rWVI zST+-72Z_#wx)rm5J68gpu;|w-<;aDe+(4o1?714C-V03ngPY!m_do`I0N~u0xo#$t z_v|O19eE$lyz|))3?~gtlRuldAuVkMRrm^rr$*yT2JMR zY4fEkMhPN57W0nwra0BR$a$qGTl~Ix-DgHyL*F;CQxW|}zrCu8)>bH(n4nN)*2^2% zKDb9rgtI86?pB!nmM#&G^Fl5m?2XQqav?!m>&8Fv^G52pg6u|P6&Bs>V()ovt;$bx zf#IHYdMw)YT6S*B_LPF|TCq0M^KXo(+-4qv+Ug-p^)5L#u*@@KC&2)x(^YBT!qQT- zv@IA5y|dCUNsZdCKP%R%GcBa@JuU=Lrn4-lgY0+IiYKv!Q68sjYZND2OQ$-%KSz5f zOCLRAYY?LbbcKm2_R$qN>tZf_#FCUhecE_c8Cb8nhdI8#_9zRj7^hH9Sdm=qE_ zj#Z`OR;2Y05`leV_sdOPl1MhKT0oemQK;yGy2ahBr&yWey;LKr zBGD3>;>baFbP%Dg9XCjp!z*nqz8 z`UhYD1_0un4Y=x*JzM7CS*@zUCrK1SY|*{y>;a&6hwZbJ;h05U;oPxAOZxfg7!9sG z@pm_Kvld=g3l!(3z6vAm(oZcMcYQ=pzn|z%6Zwyxu=~@=I$=fz)_#y`vvZRv11bXy z2`^=lcI@onvYRU0Pka9Nog`6LHP9qwDdMZ9m!eObm8Dhd7Q|y$6xTKnL+=Zb%d{K` z5P5id3^^g6kZ5bEsHhaYC5i#5(a28c&FizA-bWwuj)D5^`*LDwD^d)CeyXfm=|r9C zx#?|U@ro4uShVt?(S13(tBgYT00@9VOp%)Rm zfm(F&W#d~pJ3jJVc4#Al4YY}DKLo7%?jAq->(=}^zL&ly=E8NTAH!`hPa9ys*KKz& zxt4i7xUB&80Z=!<03Cbzv#^V%iRR2jX0GdzP$D8CtApT$oAe#l^JihXHJc)*Vc2_) zaG1%8GuDp1zU_dS+3S{TyD+fwZt&>a-`HP*=e@ErnM^2o&ELQnu(f$4;NrSRakeJ% zh5G!rGcG_J$U5(isi^x-8jV*Bqo+?#EMNeH?rOQUg=#A?^RG)6Y^Lo~keiiuP3{3- zW(f4dQB16?iolo3u>~fT8ZQYlCD}C>5#NE6vB}O&$Gohg@~X*ce7WG(mvCq?>O)Dx z__>h@R_Vu?dk$a;UPe4-yncNB@VToMkF#>>n-wcQks`77HrVO;W*{pZ4YfK%MEFox zTAE>-<>90^Xebg%t* z^BP19JCqy_ZJ1udIvnhzz*zu;R|Q-*KCl41fevBdd#mO)SpV`#yAjvW6-P%}G0Fvt}n zLq`j{kTN~X1w2rWmnHFfURx3X?>?s^3LpR%_kK}1|9k`FT;A`t1_-Ii=(#nz7R(oa zxw0zF9`8lfg$k_6k9|x*t=H-ghtTAU?mzn;OBh8LUV=m*z#w(YwVeYB8L(bDCVF~F z08xV2s&+;Pln%Z zzfu)Vuf2xV*oIdE>00I?FHF|7>?!flHt|1q`ZNL&i=jRlq{c zdONvf!PhBSsTZrLsg0<71*D<;=uUV}s~%e%AGitz(2a+70zbt*uz$e~zOjca{#w|n zB$U^(1V=}CwK7er=|yP3pEpblc~0;93+nLzT#kG-R@BzLoM$as;iWIq>#O5FX;oJ(}}NK3JpzBL`3`afwMd3>DY6|M_(}+0aL@;15VvObdnF zB^@@33Z?nfwpZ*RjRT&>E`VrW?$QnBkXa;Rq1~HN z6I8}Tf>UfdYsx6H2CjF(EvP7E@rTIX0RsoXpOWuIDt^EE{$g3L5 z7o|$`SQnZ=0v-$SiFkh4livIdZxVknQmk2ck6wTH=g)t7k_C&w_7P>7-&ZsM*WZN) zxmm95Dy3cqlXSnAnuLIy6v*Evgz0;*71k; zE;*j>SY1K_4?sK@MQML5bRW)0Ay_BSC0ivB#7Zb|u>Xw)=Ll;vF}L_l$P;B)LT37S zf08ah&!ri6trJXuanybEilB&vmmo>NcK#tU&xK;8LQk-K_A1FuNMuU}^6H%>QdJ6W zt!+8s*^d={U{7Y14!BQ&h&|U5;RUc3>^9u{&nW@vGQmGVVNZ%@{{(_Yo7Wu>K0B>L z7@+JZu~-~*Op#d5bQ8vMrorLz<|Yc1(PA)z@@U{KMKX6f2;B7}&2zCbv7D&zz6HXeWCMG^ZHtrYdR=9-uqU@_W^r`8K^tdiEqOdI1z691LD0EtF!;lEbQTb_>@|27{jEBpZZw1P4+PjRJCR>P*8)dbfo&R; zfrD@`OIe))JDnQPd+)r{@9%_E-Ya+ftTfL__{fkfh?XT`WEqrth*UIN;ND=Gl9xxD zC|IGAl%xxsy1`M$CDl4>#9#>!6|!IF?Lo>G9ofka#0$jlGw`irVq&tInw|m(GRt;2 zEtuh!==KCsiC;d>=zLuD834ztYn7X?3%vu&#|oR-5!CO6a41Rm>uXN+>wY9in!UDo zWh3d;%eA8L|2Y9}@d0FYH(~`4aeHaO2R87B6fsgzT9{rq3QO#Ky$cR26+Y++Ol(E1 zM7~;Ky3n;oVa3noN`Y2oU1f%w67L4FU)H!j-|?>|Z8wn`&UykHXz{O1zsBmtu1_C9tv@F{8gGyax zgs{Zx^fE17{l&C}{T#H{V>se$#!IakEVP2@StRboHrXrpzd=-5l3MpGc7>6eu6q}oA1l(8Oj}&XKJAoG0p8~}(6dpo4QxF+? z@siBMqb7lA5=A>`kw#Or#kd1`;Ns#hRn_}_>HJTKE_*wK%%>-OE6rkRR@7Y%U!D_t zcB%i(-E5Y)heT%X<>^q#kj2Z<=$(%Bxy2{E+aQsV5AbaJm%qz4fKEYRcvHyWL0q$4 ztllP{O<$#j5qPp$4&LhoVhX#JsJ1(}<{uF7%+KZmMu(Gx-DCP!o6qh7+i+n4s)XAx zz0J5%4nB#t$vE;Rg-Ch~lO+JMJ7@JG4q4@FZVzjqVGTT_;$yY0W(YX&XDTO&TdqjtJw!#W!9RpEJv$e!jW(EY$^NNdkhPc$@^Om4#pHUb6=;b+fL0#6Y+Nsh{M%Jp@dA15H5CRyP-!egV$m}zCCCE4B){;cGtpXo21qrel2M$4$j zdY9i{dD);>|2-!xEf>D1VKLyAZPHn0P22S*%=r!1ZE40CXRDoKp@plD6g|2JvZPgY zby)&XxC?4j)TzSp4&;FmX`qVk-3VwoK`S>QCm>d-$X}HgY5$e{A7kS_Enmd7;J2Izrl8mUU{bL@)Tx z`Gq4lE&vk|bEiwtj zo1dY;>-`;%fMj1Nn!p_?B%9l7hcC8~cy_${#M1-a&Aa@nC4{i|8=qtvpeRoM*pDC~W3G6Q%fES-D66*IlaQ z$N!3k><{H&U?DHBB=9T;(!-dNu-=Tp9!Hd^cLjbTK<0s*ZV8Oh2 zFB(-o*)SxQVJuOfPBYS!uZ~?A;--*CJN`JB$m_b5E5w^>kl5iKp~u>sRmFe7CSE^v zz*>K7#7deBrXesWT(H#Rg3gNd(Oq6@RsX%BivP&FHJ^nb6RgM(tVqdgP006vj~8dZ z7-#|Lcs0lCz+GIA6CCnDbe~g_TsF6hL5qa{-3XU#8>>gjLt9J_g(v$EaaxCj!E}R2 zA8|NpVE{;bo5DvbuvmFL-Z(~C^|w!oN8*+&W!;k(mktK2HzF$$oRc(%#h)j~CMWW< zlkX%TlSYsB~z$)5G^oj1N$5afLXTg9gz7XJ8(kHGYEJip6o4yyTD)A@2CgE0>+tWJQ#lw5aY zqB+t{0)A{^rUh8T#oql=1ncZGU^dW3d*sW41}h%WxYLkVw0Fs%z}@v znm`>r-cr&pGhum&fE%XqT|PCe%o$_jG? zF8VmI+YA<^w2(kQmhX6l>(%z<_snW&q3ph?Ss?XycXoE4IS0j(m~~3HD?PU-RWj_$ z=XP}5-56c~R-_uTHwhf6w$en|@Q`473b)hh_k|121Z~mm3ZxupE>QV=$Hpk#okO|BULS}B>cB8 z>V>`Qfv^J4I!u34M=^U^L$yfa?Ux{uY62w7+qr8ed0Fz)!UIJoafd+r`rUv7_wV%> zXjH?xf7S1Pdmy~6|9T*tPi0{boE@+co0-%~evi_exTs?sjdQdj4+ZL6*7r}vB|-R+ zqWco0(b_O^{(7_yh4zJwXUrA|lLrOB7&`0^a!Eo{Dt1w@6u~5ALm#$p+FSVeC~WHU z%A-5BRc`<6nCCF=OXZ?*(+wp4fmdc?=%1X+&>sx9&O#@Z(vb|Aizv3-*1+J7(D;BS5^LCnjU7k9Q+SCaTCMVkL93b zkz4fmIJz(n9vFD3s>%|Ho!m|-x|Mf+-jp(fGNHn@Alm8IMaauieoMl+j3zTq+rxRS zBO)E9jI_zg5^6WO-?3d)R{0>8lIX2RbNbWn_U-m{jsdk#0V@xeovjRg6r6YP%L^UC zfY@`W8Q5VRM*<6p;OkuhKsa%%dk6%5fz-f9H$#Zuyd_dCyEW8Po1*jlP%EDPM=lvi zs5G35kkgr;&=rV{d~o`VrM=y(Za8w1DYcPK(kbfq769XvmAQzW`9OA=GsPk_#;j5p z2+E4)GV9&Id4Xa6%sP^*PU(&sH1^8K=-6#&bHp)~_(Ii%VU};G4CxTnj|*|*sX`WX z95)!o(Idw~Kr9nlN=x`VoNQoX9$AzwdXo0K#5e9aKogci&a--PyMf6FpzN*mDNvZ|XL? z955wjs=@vYdMx2JcA3$&5j`TM(79mSCI(HTi4*szuTsycdB=TQHrx4xDlQGr{erNP zYQa?i;js0wpe$y^zymBAoVmTB!YvktflHvTm-=V6%?VOi>v)*^?qG7r$>Bm36);7= zl@2N%;6dUU13ML*C!d1xlhC5rC=e{gngo7m#nj(g&Y(3HtD-}JT6tKK@A?f>#qW;O z&<_T!5#x_4Jj-flm$#xopV+w(W6IfGa*;L;6s{O>$aJdN@udaCiDSPrX_aC`j4Kkk zOAfDP6<2+$=}}Pq>=tW6MwY~=Lw59*$DdjNQi`*WEMB&8c_9v%U!`}2E8W5vw=dme zb0UYw79tf?YI^pU;V=2fU>x5|2IgG2=OFnRw)8ucU1KyopG*x+0f z9Uo03g>cCr+LQ$6?TBT!gQ`?e2}lbIGJbmX7B!AsJ~;2T60$a@e#DD^V?HntGaJ8G zL9pD=k`fF=T962^(Sr{x}b&-`=0sCXCQvfBHZVtyDcUUR@>qLF!zhSF<L{xg@7_-qI{+2YEpnJ63N(}~=865Ht zIG3@FT_)NYZ2$mn3^Dp zB$HMk8bp~9Ma2=&QKZwJ!H3_nQj5am_XgNAhN4Yj@W1V)3oku>H)wzi`rxwqOfKca zy`bNM9)Mt35&Z|EvbS4?RdN;x%w&bi(SIn{wfB(O~9 z6WcgxlPaG=rq02=4*opGj@S=#P$|HxGdyJv*it29W6WhWi?)xcss=DsHqsm{(&F~Y zY&y#*aEZ=0B#C6{Oa{|0Lk3^$#s&{nT1-m-dl@{9yMIi02zv%I8$mWOrSDvgGT?a; zuLhEapYU-($p^{+=f!5?liYxLNi);Y&2s~gbk&kSFeIILCeV63)?!qkpTEGYXKz_- zJoRu;C)rpk@g8P1jkd*ODOhQk&}@e@$m)LJ!{TvZ<%@Wi)jwsDb|iXL6J1pJwf@lV z0U4@+s-Zx?9Fyk=&3j`aTlNStLzSnYn=OWvhYyu)!mUHn1+gn0ysB=8{TDp(ik6QQ zUI)yzm)r~Rnqa_{#y!X=)c*W}pPwI|xzkPJl=XS=+^7;7u_Dn`9=WK~hQyj~KEne! zzCuol^u;$AV`Y5PWEA^y!magED~6+iM-qWlqUe%YaKGSfEu94vr|Q=5-B2g8f9No5 zl7g6Sb=H-bkV|A?A1r)tLK>6oYjm}=D#YMi9QPGHl`F7%4`g=!%bl1;F8~!z25`NF ziFw=PH1^!TI?1z`< zd$Z>`xzLlsg;?VjFMA(uYBQGE`}l7M=vCbaNRga?ODk!H$%m`OE%U0ySZUh307G#+ zWBd$J^ibHnR9vuk{}G{d2a;Zo7{b1rhh|cq&-O0Fr851j?00|1NBu}mV2WZQ`^(po z%mkWm=6tb^VsGmi^Rf}d33IVUt&(&#yaRW5CbE;V+Ud7X#XK@B&csU6rs{_Rb-R=e zcL$0V_3HX2@?-s_R{4wt1dMNh6pl2}!G$`j1s$75z3PU2OckBCCt>k7QrZfE?7(VH z8lX9~;TcXg0(-;0G}n~7y=g!gQj)D4WAPv{0v2)?!dGN!C1ELZuF?Hg{=@X<3`W_Q zgN4IEU^P3l<(gBa>&wOO-_f&cFR^z4GSN#eRVw-w4BT~Q)Ba^TWx(2fKC0fyej`Ad z90I$p&k{Q7YoYLN?8@*2wc_6vSuadBVjnUrJLadeOMf6HT%HA!=x=!Z;CWw0G-I&H z3B?m)?e5&o_j%%vWM)>-EYe@8ZHq9G?$0a?+_+OWA&}ZSb%#JAisRrGDTFW2z_v(D z_|vof1~B08Ajtz4vlR<&TRC4G_+Nx=dDatdCkc?AuI?ilES>WkjAWOF$}n;7Ip!Fj zzsrv_E!!g@j6yJNV}r`s#Tk8kV9HXcHHQtgn_eEL5=OqfPoe&0%~ZP7W@TGJhOGjF z1_6&T@jDXmkvE-ku^?CEf)HveUdP8T%Ww$ma5#2w)Vb%{h_$_{%Yg_1wij6#?e0XC zEkO&*C^9Lwi4E(K#S7TeW-=FRUkKM$WfiaTVSRTALSMHj9WF?DF3gIWZ9p&W`P0S6 zo%ID|Uzyen?soB%{P=E>s&|W?3@5d_E(c~7?tV}nEM60Q(D`Ee?HUN{n8sp*>ZinA zF0nS~r}`Q-J-g=eRt>Cg(=9-}85-W%m;Tz1N?R@cDsgu|2&{KRy;9c+O!I5Y%1dXi zbJvWVQc^DHxY*#8jL|C^p@uDsX*c+c^dXGY1G#|v;e3Ky*f+0#{oHu_*l;$5)%U;& z|18@?As958vKaLgCzfYEw!{!=vHK=N5xxcrW@NnrSU)%63sMq4`bNM!V|-oHHRUCb z=CR?4d|eWcVd7whSS}DTXpX406<2jE#b`JOQROiXq&G2F-ROvlpz^7Z=5FElu(Cl= z<+BcV41fr-ZI&ZG8lN6B&>{kYGg%~BhhU*tzC3rpAdt_OByn;KoDMinO{}>$1k62~ zxyA3KiFz9&xav&y4C}(_k7S#IuN2yi2flzTYS#@Uw}<0(z=Z75Z(qW=_uelb?9_S8 zJ}qXw)ncMG@)chW-pLMv*=3pR(so)}1-xoR`F!K_yrPa$oZ+2WVAhO>vT6yHu3CDz zN!7Ne4o7AgA;Tyf#IkOd-&#d*CXEdWr23mbg>`02;e0H}f2ZnBOms;2Gi>A3dhMp* z$19&#a6m-)H6Hw_>T2Oe>zcFF<;6xnANe<6mw+ zcp6n+ycc{th&KFf-Zjd6_O_~fpRayO#pm^G%WVRyMT~ilR!fLT@Lt55$Y=|U3#JFy z1PF{g&fNoc0T&gD=SKVH<1%*9+(LYOm4;NY9fwQXl{$z9Gk+&eXcYm1YrI(1(Glb3 zj96U217Sd89q(gXO=O`|(@<6Y9bwlZNi$DLKn`KC;fk3!fy@5CvKfKo0-14;I7El? zgEM|>5tbCOVsAf(%OW?*D64Qua(99;P3ir)VN?Jb?{5f%W8BJwBrrspoV~^={OfK< ziw~vst(7J*mDx85BfB*O2oQe*VU68Z+7>OfXjw(ljcd*9KU_f6!(;cEY!FX3n*s=e zO)>EK)Po?zo-Ua}r`R*`$I5hn0^Og9|07r_Z1u%28ME(zU}al(=}Ru*%m;(Ov1*gg z0DKs_^0VX~fSf;f62!7UaeK&YNw$rH_(rkTm8M|Y!m@(#`}@W0GlS!nFEB+hCV7cb z67F{?W}Ry=k=^)CXYiLXi-R&f9W0yWr&noo{7vj_dTwBLew^PnT{jp zva>=?481+|Lz3+_6kYk~248F!KVYay__^QenN!ZOIfG2ml zOi?df9qu&u!{TjVAU1t07Fg}U_qG(j%NP`{JV+cWS`_i#m#Xn`F44cFsJyZ!#{qSp zWQ{RC*sb|MVyWw%ynTtPiqAC2BK5&ce=OdC2P%(anB|em&oi^lp4amoH@O;oUE78I zzuvrkxshlhUxRsr)&i<3O^X<|?9FZCboovt`aSHEQPX3+#r8WcT>;d`b0=R6->tt3 zT8twJ_nZp!7cY#HwFM*Sq7iH9+Kz-nDxM3efym+BB>b z(w8rGGyHXt1ti`QwMMk>x$CAdSY~Z>+=nnKr^_zc2UG%D=vED#!|RjYSO&x0%Q?qg3s^vW!fJO8S1(I)@03 zcH^R}sZ~jQr@TExsTCI~w{ajQ3Ed(C2pU>=m+J zb!Wr8)E*}tSz3IH76^xc$Ile!aAIF(JAV?*$`9|{zO=HTqgrg;`;79MY>zfC z@{dQgaMCdgbYMj3p8S}qH4S#=e^|$Q5vGb7 zOlm2;Ym_b1+}H2VLtuO_jRIF$3;6)V`}sa0ki?PGdd%3bJ+IJ`{Bz=FXAx#O9dG%H+7pGvp|LJKiNTz=>xles`&-@CO*jE;HV4_um#hu~!j3c@S z4@us($SBv;3>@wy+t%?6AR@z{3$T=oiTFXCtxGJbZ7R7!{blyDi!C=#rU=a2#ux+?)M#&v@=?Mbi5x6(g`+Stjj?g~$C2Z-6pGFvh0D^8v` zoSmkaWG$}NC8P`KYa#drgeTI{_6Un{K8GLOf8h;qeQf1C^}_0rLzKGr%P!kZCdzdh z{INJq&Bl>(l%m=Cbq9iY@Tsa-nxe;po4Bi+Z+;#5;KxhS2aNuiEe_(YB+`c~b$CfB z%(-iBX|cdfu^t>sE-I`4T%ldOxuT}d$Qsp@Jbh0}>Gro>tGt@dM3%`uofU7{AJYTY z2bW?j<$qjJCACS$+;FT(p6*lHt=}HDx0sboTtBEk{7gTTG*!IOC09=WJUZC9ou{zx z%vL+e@IINf^lD8;UB_3OI?hPc?kIe(vkL)I;Kx#f}YS6(@A}UHb@uNq< zY}&eF8_2Oq8}Q(DL;uP=c%i!~%&^KkFYRGxN{iWs4zfpolEGfbhngD9VKS9-*2~gI zZx4i@-2S#@#mH@1rj*q8ayQww=Tu*dd0KH8>p*OKNhReB3+;p8{BgoZvv@y8SbR()InK{b%<7Yja*ljbpS9PcwRDJwvYpBdGA+dvhgu;H#hh~0n9AmGtvdfUp>yE$ivlx#;ff;3p=1Kz;vSxwke&=wHdRc|*V0mZ?QFwbUaUko_R;%4$GI!DLrjwC;hPR)csz*I`hrZ)m}OhhW?bS#$0GK@i0m^xeJrMA4F z83I%OIS6yvqWV_W`A^#G^(fcc6_PQJpUiX;tahlkIeVTKJ6WtYpp0j`NwktN_R_;w zJ$x7SmruZS)%JzXJg(TUXSBx;#gznX(bHb;AM_?;m0bmjzF%3>!1O%RYarDh3LQ-+ z?jYb6N+y8()p&6mj9v*JUJC-?J~DU+&$d7kgB>a zSYu@4wcqsY4eWe7jQ?XKMeglqjkLNxQfRuO-4L~Q#rhwd0pcgSv6i5G*x7Ix30-Mw zVHy*yR*yB2_;?-S*WJl3!swqSb6GnCeO0S~536j?Ha9-D#xgpHd}O+Twgf&5M`oC@ z&e_)J9m?@oWls*efQ?L1c5N^D{WzcOBYe@}t`60zC*mI#j)EVyZ{=$hOeng0$c4vF z4^`}+qR7kzv)?40{ABtWY1}n%Yj5Ae)lADyRBIrs4X-GGn&MoP00D&5@-#DI$k=qPEB90NupHBdyPb95*$Vsta| zcLsR<{`QZbkDxp8#`8Syd(JTpTFhFwTBHm5@HkX&%A#g_H5^RuX;)^sG47SZv)?vQ z4`q(qi20|6q~_e-)2+HYfWgjBcghI;H9&3e$6UW&tmEK}EXhm^ZJAvef59129hgf8 z>GRC~kT#69jbgq^(-^~mcuUrQAILk_&ZA+7&ww=YFSl82iIw4b5o@wc;>P?)I!|N4Hx z`(EW6#!26l0EOxfN5Xr(YDSkzrFwp9!ljZ8*EAPTkqo1kqAq4*1+wK-yzeGRek+=C z!lprD!tZI&YtoXvs!@R$>qED*vu`TYHbnY>@{zka8j5kFiwvjuL#Jb&&%-07BP zgm#kg%K768ivn?Bp%d33iAsg%q+=GVm>m8FaTXg2n)mEhuO>j4rYQYjAz1oVmOV@B z#}`(vYTi)sNoog;2ePm}|B_-B7fbex#fACDDq^>qk|buvU)*e0BP1~L9>BZmnzBTw z&Yt8W>LeN!%cB=^r(1Uotvm@Ivsyc^ecu}c8K&e_nk-TmX_Bh$RnFh|b*|m^)lTLE z3*6jv6c76$}>26E4;P`m?J?-E- zXJX<@ZB2?y3SJ%a7|klz$#Cu_6tg~ZQ&JOC$#(`)!$vZfs@vqqu9=*q@Z$`@V!9~y zwl?AzxwSNGUm1ED#rpdXgn1gNgyPCDh>G&gW^tdB(tm0=(R;dWC(b_JSBfC2Oi%=8 z8X-AU-e^0!{j87C*^h5*_3m~MV(Gfm{r>IDw2ap1z;MpXDqR99U$w1c$s1sQXWPHA z!u2#RMkQB>Ao4`4opZ~y%F{;)`s@Y9#n6+N9s*q*Sv~Li@~#^dno352WJwo_+QX0l_!eS5CNrnA%Xf;;1p{cUs3zuDY`1@!jCcZ z3-_$#-$eUwIH#{yA*;xUe}2C8yK(FCg+I<}xM@2ZP4YRr?bma5vrbSbcjx1Z{I$Ek zuGqQw{=ciC)N)}61pn7C`h+T zvp)DIe=;#w(T0=9hX7|96O}+FJoBPPyOxW~5ShdkdcX$o&dSRiM2%LqbjMnwrlg*y zdJ}#*bKKf89{r*9oZIxEm)9DeL7&+2)g;>gi)XY*0u~(+!>fFCO`EBi2*^f+Kj!&0 z7RZ*`BbDIn;6?qoe-C^8o@>?4A9r&>Vn#lXgg0NHX&H{oc|?C&$p-0ni7Ms@0l^Wh zVLe=Y4DXpeax;RWat{M(OZ~RJ+?$%gatd~HgIuQRWth^U1iW)}D84tIRB(e&^#hVK z{VDs^Lcz}WJ;H8ov-IK>`1fxbp5-oICi!8W?d7Ly^Kuzh@%3V%$x^rZv@ULOcBc#C z*3u_oOy8;K9?K0BDau+Z^m$q&DUFVFrS$rXcSjUyD}?_e;**5$-F=4d@N(kX)-IiL z_C1+c^Jxe7?+Z^>-aSg0_oFJG+K{5E&b;eRaHMF=6B&(F;BB+x^^lP z_ad>GWA4cbweP|Ul&Ggr+XErz<7pew!t_x#*ZDtK?Vchdd<>j@xT9~Z4Zj2%Xe2B-G48o54?PsU{rjF&WDR0x+C)lQzACOY2- zS+d6+m-S{`_;bW*2;U?A*!K2hA82QD-^a5~X=EP)x$f%kIi3mF?n0%$8J~TOV|1Vs zKJR&CR z7ER^}84xW!-EF)NRy2+=&87b!TG1=nJ#_JMPCpDlwB|||3fLOkk!8xDLaKIA1^sWC zXFk8Y+tS*42+>+F;YphbmXQ zTZOBTla}bt*psA<4rfEM_F~x$%doFkc&^T>!;vL1FJ}+qWx421lw+kOh?iBN1{~5N z?bzN;XA3tun8l!4A2w-+^v1{4_kJ}kqT4y2m(M)G>O4fKa~hpN0o&wN1OWqV)Bna2 z1(8p=GBcChROj>W4uL5>owq;6X*n$=Ht`bsS*dtLfUyD2qjwwB8 zUOmO5&7hyiLzF&aa$J;vK={5S`!x@2T?1=<(_qQjqVT^iEGg%$ z_7mj%byZ7C@UCcD1G=7$ae$FbiT*aD>lx_Vto$=92``#}jdqj;?zCRIIa#ddLI@a& zH?^J z5g}r&k?)F>stR~Az*=n>D^9Vl#&Gmp?P=ZB$f-G5Z zH+4(z1^IFj58F=QZ%HJ>BjgByAVynTUv=i=OCQ*^M&4F_XSXd%6&G-lL&+&cLI`DPp+0*Jkq{?zwtD9uK-ox}PL-cHT`$ zR*lotk~yk-RC)-jT}tSVe$&9up|btAUUe4CNEz_lUaJRST30MX1vN!7VzmDiYm7uG zzy}5+I(yw*W}58-whIH>g(S`v!Sf=qV%tw#AKC$Ou-*Koks5XY_6B@}F8_9$Kf2xl zE&!erU8UBf=dO9Q)wB2yeW$15(QgU{?xlF)2fKKnG4b($vbvMw-MDeGikmC z(fr}Jg7+Um7JPJLjdXEK{=5FdKRgwJ%xPnhkHosf?sg~JEzUnSYm79x{tUJpgcb`T zWBy?-_DVRWB|{^zLvdL$f}U!{n~f-f@VB^bsnRzv8itSlsmw6f#2J-m65!mcce4Rl zGtgrb^*id&CQ3Qo8ZNqSN6Vb2tD1DA&Onk(ZtUjCfL|Ss#)7BqTG(|;^AhV?kLID% zcIOTUC*NZ z3mg;zb_%w)TY2YaU|g3={~6q3e>bs(OSocH&adB&pLvl0j;e@?91Sdi{y#tq|Mqzw zNQON({`(t)Y<+Q8b94JxW{zsT_W6oUGGLG?Qe2(kp_Zb6xqsfh+3uX5>y~)M+3waZ zAj}0yvf|>X?GbYAmuzcaBB|PHD4QWldnj_C7xvmm3}TJi8y4+~|5o z4sBw6xr=W%h-o-i7gnR>gp{8Yo<(|iQbQ#pcZ7x$T{7dbyxI1<6Q5_iUB(h1xROgx zk2@+MIYhu5t;Sbr_?lL~R6k|{Eciy|fYRW;w!Tj( ze7KU%*5V~Xu9CuEn9c9`X;FozYh?lHnn1drSzmfiR&wSO$Vt=d!}`Pq0Gh(tB&pgq z3ETAQ_QkYi21Vr?Z)rEuF%P^f59bz- z;miN?82i-(^@6MYkSSiw&|#K^^vF()=^B#<~9d!Y7@t zq`uex>hxe(fud86#AU;fTcD;w;fK{Cv7LJ%WANkOd9Q>-P@rWo0zxe3TvPor5-|L7 z0mHMT??+qae(g6};RvAYv>J~soa;M0TMY6u9X4K+rKx}!sy%{K!E-KZpM=0eZR&fz zod<5=r)S970}hc3ef+@o=gDY)V}w8ZmlGeKUias&4Yz?O)3AHsG&03J)v~z$+?zi7 zx~+oW;;!2Hjr5*x|9$q(FqhD6=9_=tznHlo#wqUddf34@+MnM6p^tub&VX?AW$($i=p24z6h!+H z4FFrGGIh8Q;R;PtNe)&HXm=@u?>9lOQH-({i5OQlNlM3_9vwhcc)np;0!sGDMJA=Mv^|K@;}d(4JJt~C7x zngD*(1?s9$g-Zmypsf@EJi=6Wpd-2mxA4}w>FnMOpk)-Oc8OnZD&H`ExJr05J!MXj zZt=aq8vW4H(pn(-?J(v;L@-F7nhp}fhMcoQ#s=Ey+Jfqq?0B`n4KX-Z-?C8{*dx z^c9T2H1oM@+n*rRD0d2o%Jo+SYPqJ*NbTz6ik9Cs>;$M)Y?EjlGxc@@NM;KnNLz4F${?MW}LYl3vVAea=4^FAa`Vd^Iwa{&7x$l9WsoB)g_C6il82I#4HR%-% z_V(2-0ECcMZlRt6f$gD-+kU1BF8a~D)1~7I<$`55;O`YMcZ|OazP*N40ats5+pwC% z+hvq~H`zq3A7jvC_bqD8zAQa!Ho!AP?@Ld|z7W#Lt#rdV%_Kml@-(D{`_ELi z&1-9uiPe~f*uuy49#V?QxSDV-g9a!&HU5}$kK~! zK2=A3J`lto`roQklofa6Kssqh;qoyGUKRYwiS^5;$iZ%TxnO@|q;lkjp$7g8IEK(~ zGJcBAT0A#(nARnn+Kl!L%RFOU_7b+vRBO{)iN?y)>lswKqBO}X$V4-4$tU-Ne|P+w znTd@!Tm@EJZhNph;^V|w2re_WnxX4pX>nI!Z^G9HvA8#8(Ct7r7QtIPtJTNY1QOGf z?3Y1BZ3ou%BE@V;(7itMV<$8G0$z-AULWw{%)WB(?%n^zz(N|$B|RXM{Doul}-HX>b%du zqsf#xIhhht_>@~9**RM-dh7X^7NXmsME!XJuTV#Fwi}9}sj{JH}v)$3($)T73s*2pRqq$b_CK4Ia^{3m6=(ukKz(8(LGTHiWPi>F8eWx|-& z{|iy*tkf>Mc!DiouKjNkOT11C-o2w58ggR!!Id~$p7+* zQC)W5K%dJHnW{wlCp!=I*z=}cekmG1l%URQ(IhC#{rD`i^gCiMb`vn>)u#r+lW*YZ z4`!U|aQOYa%Zdwi#SwHKA*bdNd#JG z71d>+F_3rU?e9Q!w*cU1fnF3LrYcyRw$KDuJD5^7Wp@DdVw3 zJMn8E5942E1g-h5AYN?(@(GQ zQBXf?HYc!hpRi7=|3ODfCbT94_Eii&>I2tD%RZJn6L0dZd(c(>%o>qTj55`wgzpY#qO<*F5f}Di@9JfC_F6-%%r{DjHfh^)`>H_RgUkct4e4Ujr zWccqz6s#d1gCk`bVCjsW=+$8UZ86In0Ch&&5P_sy+I~) zM5X$5AarhTDueraqBNSvdc+}rcHz`-TaA0su-!gV+54AxkM)V?k-+-y_2J56=Uc$J zD)MfDk2S9$a{jHNlS}keTGL{d7WNQ?1^*SA)7oDaa(fgou~T3}05Krz#=ZsBDm&#} z$%(hg%_y8985Kd~vVy@B>q?_G11wzX+nsZDIYpj@d{%Co)vQhbHoW`GC3`CJjf+*% z{D+cKCUv2a+g(4juqtY{?&Vdgo!I(o>xEvcF+BGsNI$D!W0B~edTJT|;%jafHY`5z z06AFb^VQRk*rw^3pT*0=tG^t^+FkqjjuM$BvA#qUGf%Icr0!EW#L=uEv2tc|%9I=P z5zKgc7yT+v$*~7uu5TaweaoU)KK-XihyMwwZ$i{IO{~t=hzjKkZssCUsHd+G=u7fv zPg8iH9{f8Ja4{83{~+@b#9Cw zjXag6oOTA4m~?S=K$9kZXvu&k{gw->4Z}C2 zdRy_R%KZQ4_3}`{6#Z|e*1Y}JkNB8GnW2vQ+BDe8!&1tZsDA;`3HHDI^wN(m7H;(l zG4<^fNy%+-aq);io920u5GM0ZM}-#+ehev`arYC{&YB(iTHqszOAR1pafZ+kMa3@NB_|y_ za6jwMeIbA{6Ax}eYMlDL9LZ{Ir|}Wb7W^Ms32YId;4Qkpry|7`%B21`V-)l7Cl7=I zi9i;mFXr|INKY}NM=}BZ*>VOD{%N#Wdsqj(mzRt6os3*+PPoIaOjlibt|HBv@aE*b z1Z?KQ_SxyjC}vv!TTO2lDQc$Ft`V*U4zEg zA9cSMipV+yJBy4wGgF&1&UVS!F|z@#-c5pJOb3z>PJ93Z;6WoxY0tesAPDeYoGgDc zKGAFQC<9&mADub7BO!IHhxqJmtN`J^j9SA4V+|8?oy%ly*hK1oa%Ler)+?_3Tp4tS zJxI#lxK}2Yc5aVG`v+6hWksor*@Pz~d@h>j6Q?J=b*0M$GUS>xHT6}bcwkoNYTH{| zdyA{V6ncDMXDV(JVZ()(exS5a!> zuwi@rYm|g^rIoZrEK#N2#nDTdTr!$|QUMa7hR%tap!W@FMK*S!%rndJ9uZX5-eh3& zgY+9MnACC0R#a%y{5@iriT;`2cjd^bY9?2STznky$_l83;RWQpt^1IZ>1YYu`o~kx1<*Pz)$I2iiCyZocydtz>1}guahHJND4fNGncZ_Q!BO zTef1%&fq}Ty5xH51x{0wk0EQc=b|4e&gg`0I9DeR5BsKubo2I`s(masQ^GGh`{rl6 zv96G*?zdGX}P`v6>c_WUBtSblMS*Wm`< zEwRYFP1}V_$j0$^q8CFpIAinvkyg3cKy{Kw>&D)~V?Z9MV&G`>nEOXri-=oj$qwxM z)~K1zF18mTVS@38X93wOP%~zIaO={;orYX z9UKzAB~kY%vic4_G73jk$he$o8AGA~j&94^f7$sj-k``MYIrgIcEAPVuvM?7j&8@- zui>m2j8^XEUfuZ+h`a5wySI&=ogmq49WX4g616H?;PU0wIz7cRS0nTdKc7~-G6IawBZtqqy%*5O1p$8n;w9hvwTs zZ8-ZXh>KU}eu@Yb>q#G@>{KgGwo=h@COO>ly-vXnJMxQIM|h4%Ii$U_2V8?6lLL5COAUN8w_>X6SQLJ~q?3*o z$WX~f?r)S)jWMu8WCU~!le)o`o``=fuEY8xL0{EgSfO|^mM!I#$@i_@0I4tqb&9?D zy@&CMdOcy!l%&MVv!Mf`)W(MRUe`TsPn&w*=pbK8d`B~L4JvX;B#M^SmRV5EnjbC{ zCpY^_M6FZ6T+W8)QAGO}J=tp9$ob;pDEFxRJQ=M$N zV&%En@MgbPAq<`?cGe5~vB+iyv={8}h1JqEuv{&5$CKv*QZ@a5QNO5YzU-4D6!AI+ zgIEQPfh3(-p*!p5sz>U*%=dFpY`hejX>ZGp8M+u(ojF|L+9+6d;yNVHh2;{EcIc?t zzA)Dm3Q)_++CcY)We2;%pwqqM3Nd=;efRq>q^4!1fW`v?$9;&kQ&^mUNqp_RA{u2nzJt%h$ zd;idc@}u6r__6*ElU=7-+CuLfQ^%N|R)*VjBT|_S^<9m8G|sCV`V6AZHxKu&@PW6! zpW0ywK98%bfa?8E_CVRnX4?`Vx2b^?~B1#%lW7GdG9Z z)(jsjnd)3A7eAv!kF|+bZS6n_V$CVs#q4^pdE|q@l9$Z;6Rv=aU@=m$Xd| zQx;>oE1TKcWZf%^7$3-@A8pXl4O8;D$ez8Q3W6$oRCmX|D`+!L){nQS$XRVomq^g|k+8?@ zpYtjDu~3=PU9Oab<`Xt{(ip!vFnu?6hPDQN6#qF(uO3WALi$-veV@u~&}L1R{{2O& z83m}<%`SPOtCcbWoW#m=l%RvD#}q9o@Gjz*HY5=khzi(XyH*X*Lnlz!oT0#5tM|t- z_|6t?@6FJ!aJ8`Z)+0FTE+UuwLYTZ*4mbO9m*CYIg~Pcz-&sAMMzk2J}Rteu-zZc5FTLjmr7t}Z<9*&Bpz-Jk%h z&jy|)p_;$1Q#W9w#9f`z-{}JVOx(>~?vTJ9G}MQ4H0bQLUcSjE-pW5?PVL(4N z8Q%lZnEmSP<1aAvxV1C8GVn}6XOr?IvVM}Os)=9zM;v#HBkJE7dEZ!ENs2n9S7GC~ zGUUA3kphfjp0NJ7lw>+CWw;5wjXTsS~64xRTOD4L8qfOJ#$5!r0^?-IfTutV!<1b^5Fd7JSuJ zQG=Pwq3=UB*%@Zvo3Mr#d4-3#pm{nlpNF7nMyCpzuTy9xeqKM-5=BoISg_wB1xqv@ z5ARGAWSKpcCo0ytJY&xg-k_?KSNYWo0L~`cJt{NiE*d`q3{O`7JCGyO1ad9vsr>z$ zdrzQ{AJ@tJq zs>;0J0cA=S8(C04v{cb){Kf;C;-^2WJ)~~a{vZ%|ubzDH;H--Z=+u#x6iEV<5IVTK zOIezfI-L7zI6dxB_vl7}tN5r|o$k9SVGXw+OLq!<)yEei$p7i*b~R>0|CO9C#OyfUDi}k_K1PRE1eULzNinF2iU-m)j#RXXhlPGeNya z!CeOP>ppCVOjFZ09%{l^jGpcEq@w2ioB6EtZC~JSKid=kIQ-@3!LA!?(BY~BncP|8 z!1@K}wY1tsQy}vK>0UvB4ZN~&^Uvs3pRz(8y zYqiuX@{Uz9DsS%XIW|A$w4Dugb+gKpL^}_C?3ucJ-RgkTALXj-z{SO(nk1ukQ+i2i z*&))R>0R-*d@bDVhIgc6Egm4`-h?abJt-`J-UWyyCKM^Hn_TupW0kOr3veElg0hXH zpawsq`Rh%gn=`7uaFm9ndkkkcsP5-9@+b0sUOP#5ED_}8gN_mdDMxwKM0qZ+0gjHW z^d~6suNU1x!;Ny!x3HMzL{?OSlN!?fqbczW9CbN(kGj0G1}C8jOy+3|#HdXgav$>L z*IA9!DpISFi4AuYbxjo`X`^gdjbov8In8W7I*5zpx?Dz$Sq`Kqc_|`#xMd5YPHc81jl^lIM zl^07ah8Z;gwYkCqn==0eu3a>kXU+xHz9v%`7z~rvV$Yw{wDemuh;Sc%uAI z;P*alln`bQ_k#ZT(W*~6Pc8`+HY#P@8KftDKgBS zP$XG`uhBX#>D+9P4ci+gRVkb|S*;Ck5I(YN&HPoT8ORciI-{TgNL(Oe(8Ol6%Qu{>kd` zCcZP|QZ3Jv31pg_e7LD4_wulQP+AY($wlq&uitA8RgQ113yL}migcrGEflbzpe71d zKSYKG{2)uSk>u4j5^v=7h`+~BB~7n2C-brA-s&vLj7hIK(Z`V`v5mKGfu&TTqO0MH zr8r-FRph~5OWW#CLK!vJGAD9blQ&{zD>r#pF2Id|uDaddqdoj?mK+K5M2{6&c}M$7 zJ|upfrOS=4nI_J^CCjnv@-u{u+&i*oeUh}q!$ZJkGtV%4EJyUdp$4N=FYM@zkBW>u zt9Y_hE=R9*RH}f@cm8L?jq5h)T4nc2H{;4m!hJXP3A>|<2F(H5lU)U`8+b|v7ACr) z({?-1O{5)cTtoL5OlYNFHcgG=t6Af+0F?oFqM7lOo+VyJ3NtgRQ03-MNGg#q(=vYxC0ERYe2wihQ|~bt)OFav8i+bH#Pp zMRTv6thlpFR`v;HyUSp#z9ZG)7%DFM?H|eTvT#Y+_1(3F{N0xNP2;wbM?`$1|3TS_ zB#}aGnw8c>A3f)DVCyfF@Ad|trPl#$J7LUL^U6}?b5Ddu4GHO|(}E@bJQ{Yo8t+tJ zms|zb(4B;rq{TTY??4688>x7apL=e4Xss=@YS|dPkeI=zG94>AQp7f0*9Zc8%Nx)@OW-kiCEYWDq`Y zTJ2_$T*GXwmDZ_50b4jE-amxAe(diQ80|bjO^l^Ai6Xbh$XN|+ZW)P~LaDl?9XhCeDsp*EPGi#JZ^+RS(_N7bXp zr`}KlleQK+W-qv<_KDz=X>NSH*FL-=oAZg54SxnoGUxdC1}a%NpJjq}m#dKk zBv!^SOBiCH5+|c*ddSN=H^s=Hal=vr_E{e?d0ad zU_weoKw(vNLTBkg-)2GHKqGykVVkta=Cl2}fG8&qTT!bGAyUGmHiBgAdFuc?+_@US zWYD@3HC50v@TsliNfpYgerI*pZ+W+3bMgD-ic*t2gZ{kPQ|(@y5sv3?=<-n{#u_x& zb!n5sE5w@h*hFks+CxlH6JO?F>66-2%C)BI9K#~Gp^fW;&9S7@S(|>?gZuD-2WRw^$Qz{j@kDG<|aQOGX!|HzUK5NPGs5H%@W=9=Ha^vil9D)etv$;vlKU|s5WN$${W*+Q+1na z!(>UrUiGWf6RQ41e0WnDHP>Szv#yPcqsvp4gSovXkJ&Nn^lMs$oxlyxoOesdYl$Z+ z@=X#71w2SYimlDuCLX7R>vysU5+Zj$m~946PA9w{y4RWb2tRKJLDW^LEY7zwF-Rkh zNB-i!k?&NjdeJa6Pwtcfqsa+LsUt7?6*FgJkqeUchA3kX6H#oUJBGaIvFn?o?(Kmm zSxO4jP?qTMz}^Gt2~9sB3HIqBga*U~n5+X%qoS{s@Qqv1LY@FpoXLu}Z@ z*sf!UuPYCmRAK{L7gaPuckrE66mF~BtVmjAo}uCWaBZ2@r}ybA%+GmD91nE--OjN> zr98%0i?rYrEW=`^vY^bDO-pS3pF`R4aGTD;svrJ6!N*lB;X#Xe|sB zCG1O5o}8RKOyt%{2j5;QPtr_LDW0rK4mZv;XlPrE{cbmWFUHHCewGE67M!aJ+g}?; z@6Lu|C-=Bk%W##~5b?X^S`}e+crAki;K2A9w70v76cxRO3Iv`N0?U_GglCXv^Mej1-U6c_V`VZ=dlu>QleLAGFC^brW;DUr6X2A z06%~D;FoIN=g)o;8{cc8sN&+{O3&Q~p93L3VyVvo1Se>hcpj$#Tj^yQj5t_{_F7qe zIUapIa~QQrDos=*FyVZJ4mP?ldwszn6i4+vZR-V#;s@LFE7qbZL$ z2zCtpvA$FL4MX<^6syJ}g`ejTaT&m#)v@thS7Vym0@GsK;&7?t!G5hc zNOCp))p8kOak0A1(w?)cyJ4HWrk)P>c<3h)BP(!mfZZlSRSX*r)&`>W5O9TzFlw$o z0Jh59p564_X+V1H*SJ55#cSA&xKlo9DqBQX4U^Vp6R(oHS^5-@1K@5<0Bi3BGrsJS z)tNQN&lY`(oCJDG(W{3lXFC-g66rA(C>O>&ugr$6^sFRX^ZIF9PE|O-g@%t|otcqN zz4Eu)=I9$18RNdcynKq@Q(cv<0fq^qa%v)lg=Ub0cWcCJe0IqI{T8n^>nc}HrLPIE z@5-{q{&Y%HnMi3tavB_fCy*9DBr?T)2Qk$oTUX(s+ohUFVZpoa7~Dcxp{+QlTTN74 zM+SZBxJ9*kvfa2)yxOhfr!}r3_JUK1_z^vtrj}#$5`6jc6cqJ8u+(=%<{((IoJ6WS z875=L83Cis)-E*5_1z+z-L_SYRmIR`{WNL*Mg}w?zxgL~geXXm4-`e*s3p zq|`EH=qnL%A-CDg)Pl!mFcI+x6Q-xD*Am!fwz5)YMZy=?apx2Zr;2buvj}RgHnWI> zbBlDX!?#o~*z@*`v4_EWG;xV zExn|r9f@QX-Rz$d_1e%QJ0Yf#;7Hf9P8rY5+n4gvPK}qP1y75n)l2hY4Q63`^KvA^KmPZm)pHPjn7B8i+aZ_^veIcP%{+Nft7+sy2An`alQZ z?3fCFdJC=Lk<&HW!#mvx;ngAmF5m%9AV$}e7JfMl(o0qgv^g2NhKAtMkrx?*E5mq< z@Y!%JM92j)b!ZpoBseB`Y@-)uX$*Yu)Ju@HIKX61rjcG#_^Ny^y`HV@WL~f8<75AK zwM(1M`M2wKTVBn)Si)CQ|L*62sFgP9PvJ9l5$++)@m3DS5rqOlq(T+!YvDD)qf-PQlY&${(#A*XNoRc1qcx16K1zLZ6yJyTzwf zji4iqtKEu|pvE{b(j3?}xr&(~G-HeSRo%=(?Xqg?s@xvqvRLFEwj7_ zn-ZU)=S&_oSpkvRE}~qU4t{NTC3Hs!!)77OOVXhh9p5)hBrRa>~b!^ZHgA>#rW=S zysq?Ifb;TYdnPqA7=ztWS6}s5Zg$>Z3qyPJSA8g^=KKjmefGRZX5*_n^($e>l>WjT z6^~1hQOnJ}L4b52kkRO4Y>Qns@l!*^RsOIS8daK4mj&l$&K;W2%LSa5;l})M7;`jE zD9mkiCkezyds*MZIP>~7;183Jc_a8$v8J1=u%`Bg?V0cX8V)ZM+;>vL0+HLwxR#T>qlLL;|w8B6F_gF z!A0+iBrmA^FDRQ+D}0r`%EtG5y#w6ChF6w-IQn%VUa5E~T}k0zADtr?!u;*IwB)+!vh6vd+ZhDP!R@`` z-S~`60^ewn~HOF!LZ3mi-X4KD|y1HrXtWJTg$v z-s$i5jGjOCnHyFb9Sx+Hwa5{;_iVW76c9IJ5oLOf?!G*2bF>Yk-qtF>4qG2>_BLZn z96bRWnQ90kMS&E(0_S2tq)OTWX92lm>JV5g_mK4T^#r zYty5~krTy9-oBcgV=ejz{fz;SacCSHpZgb{(OfvrVcO~Vu$AOOpSnuAS`IUG#Cs>c zxkZ0l>1;$=M+7CLsxrdm?B>eA!oHvbh+PJ3RnKF*ww7|EHubfaTEo5YW2l2vkt96;0iL;`ViEZc z4Qh03C!b*G>F8i6ZXO;J7nkB6f_Y_N>_8C!D?#WR`6*HDD|q?Tx`skpIBK`gHdYzs znh_RFz`D2&AidQLow(F{T#zWlYL4Iv#5tdKG{x-K^XeRl@si##YSHCA+cZ_?uO`! zIe<4=hMokn;+ls?>L!IV7dov1Ul*4J&Yq*zin9scZ3TQ7Ps!%!?s&5W?ovBK)>jkt zTe-|KoP1nG=R>MG4GIC*?vJhmO5KODh+^sr+p_Q>$suw?Umem<=@%Z7R|g>-d`hFQ za*+RgZl}u0azRBXj2ZZ!ndj5-^M5&-Wog@TS748n#3y0yV;yq*f`T8IMfaB3M16lg z1J2af=zp5Be069}&ky>eRSgsF)MhT=OWL0&VJ^&ncXA6&uhxQ=X~1R%eRmN&*+q^U z+iK}FQH4FWHZ@oK<+W+FR{Pfp*+m2Nt}UiHfbE}Np}7z;MLGpAL6LL|+yn>}qmH=oVUXMWJWb6FAeazWaIN3_511{oqsZ5wZ{Q}N-{p3p%`%9B5TUhqaL z`(3h5g`wk?O>YAsx5ZGr=yv@^uyLLN6kW9cJeesa3WO$d5*z0wfrw7J@SZ_PW_6K)aU0bmtPG6mpKbuMwN_2x{nmX zn#tuQ*$c+r)`HNLe$pywqD$b=3h8c?KTZ+^4{8eO0r^YSkcSe?TbQvwBB11gDIz7( z5k|`26P{Nt$m?nN0`rmu_rB!vVF@d{jy*z2GH8(IYX>P;2Z6>Cjl2!g^KwL$BY8}p zhJTTl(_{fb7a&rg*p|sOBtIelSSS=I?q;Eqc;wy}1#If@<4fmj=1Xms9{F|7%~_K- z5a`MLs+bACK)>DH9}hM{H!{fEw>Az7hjFB7@unF#RH$Lm+Kn?459J~pIX0Ef zO#tbcTnpGZFWi~AjU*!gRcfEtKg))-XjF^HxUYOX$>LK8D+}jqi_I+=(mQmJ zNynv{{kZ|rXy)jc@|X)!TbTeTSU;4N1sS`gh33N_3*LB`sP7Ce@Wx;vk6W-{XLdx` z?h>*UCQ3`>GRwmjINa*Lm=bKcVLPiZFL#YSc(Zq<8P_3EY{tAJ7ekv#(m!SIRjdWq zHPGP@17F#0^xqO8@s8(1Hd&w})kUdS0_-&R#w@ZhHi?HS z2d6*m${X#i&(YiNC!I{|q%j1mb{L5txw zrN>XEgMw)hKp#T$)eakJmUzz3-;hUTXBRtpTB3glu9fp$h~pe2N9`v91BF)F8>2{V zl(DO;kX;qB;Bfg~%D#l6`pe4t9Q+ViEnWg?&xq8PI23EP$O!eVTB*W1Y?=#H`yOoE zxITYypF(j6emmIG^}>3Z!QOuLpkrCMzATa?t}+@iDk<{5;WJLdSLUzFklpLSpK;!6 z#QtpF976YU;lp~6y6v@JBmxjcgZ$jtt^e)&}mFtcggJy zN&Mcq;z*7hmi{<)K=0tXdU?{6rM1UQkx4=@nk@gQR>iEiRnBH&)mlevf^Q7m{g7|E z-gBBjiH=YZz0;F8DtRXoFr87-)M?8I37iuG?1T8qpj)U(DmJFTQXF#jPJt8qxR-wz zb0VO~m?o=3itGurCi0M;+c}sQREsBSBz-N-^m&|ARM5jKa@g>_duM#y$m53}5Gxd# znnahsAr4)ZmhQ$}YhfWd6z8Pq!Th(g%6z?VN)Jj$j*8w%2w?T+*THy?w`p(@teG;W z8iof~=0@JnF%lJ0wp&J3{9tK{YrQ~Ce1BN!vSyMm1f@E9T$LKHNxh6@{Q_OXD&@D8 zX7EqwhziAeF!Y*|GzFxz2k3*W(4I&HX>Fd0B7?l%fpE9u3Ap!?W$-KP%RH8Z_1cfy zWZ4^Rmv598IsdX)F9FdaPIE0NL^c$o*>fQ{w?uq&C7wL5 z_6mQ0|CPSm0ghuWhNd<)JXl8Q_oF03Ja*z&FF?N?4FlD4o@ayYs%|(RWJwKk-g>w~ z1IW5Nm{YV1n8_M>0h&oIM;nWK(1K3`${?Gn8j2dVz+9>C721802B;;ocgBXGR*-{@ zp=3KkMW|v`{A~CZ_0b~Rvw4i=%khhd0CeKAJswwWpHGg2 z6v2;fBiC`v4b9DppDmuNp~F{b4Aa!qcpsLvGJFho_AMPAb?8Wj{16s#cLvoPAZdVEirO2iG!oWVb(t6rvVQ>9B!m4Wb1@8wcgP#MAff9MuSqYu+M9@m-oU_8 z@e5au&T08n%3hHEkl*p1xxp+ku?;IFsSYmxEqU?t=TBy6#c=D;kltqt@=)8aXPULi zhCxw58CYZ6f!d3}=zh^7C`eL!gY;08x_Xl?d_5e2GssaRw*I2O);n2)BeXDRpuwA}MOl*V>J<7>1e{@0I2f0li=CRKGk?PMC&0zVePC`M(|KqJYgG z*6JWN-v$c3v=_>Da+w)_cb_ zeeM6_u~zAI@wvAxR21l~QB(vJ88SobRT@BWvR4(^Lz%Jy)>^+U0yQidAy`C;7(k|s z1QZq7dyjzZ86boJVfqZ-fqoY#4c=j-`;o%8mbY@M_$|9Aq<-@8I{ zCz=(Gky@#dcr2y^Wlmvx&o)kF#+I;KK23TdIdIuj&*nrl1GxBD6Jw|%R8X89Z=HDujFW*nEWa#CMkAB8Ue<*qB|sy-XsclCHouAAe@)=qmxuZ;k8 zqH8@2OkDiHI%u#}cz&N|u}0}!ueJ9xvSR@MabkwVB!F zmq7pLu2!Bs+rQdV$Kn49hokH9Z&<6~LN15_ke3zsrRQrfmaL0VHZ=B9^C1kqA@6FE zo{i15d4B$uU$U^vK4`DdYAT;lw)d}&AfBozQ=_A+H`VQ;}U8u!0bgooa=!B3* z+A>;;Z!Mr?>Q(E*J)(Z&E~iiPe+AKAnD(%qSn5e7xIzJoUYOK93OvSyGU&2gb|I!I zkjEL*%xhn!8XY036Rqzo#9ZIL?N-%(sexEM|6tZAYT-e(BY5a=VHf&u1sCYXfV-E| zqsshHO1hMAKCO)sXZ}h2eiK6?r&ZL+z+SJe2CYqYBm0%fh_3A}bUR8^44yStmkd-u zL*Xh+1l=Yp$@`4g3W^3lVqlSavt z4ALa@3pf}2zWehE$0+A z&5Hjy-dDlPa|1D@te!Z0v9?BB5!1g2Vo={P2;`;grGm*%8Y|oZ(OZt=I%GSi0*Xhu{9Ga zo>1!Nf)?NWaF;lt92|2%pQSIzjDI-tzG|@|7_ek)Y%D@hV#rp%r&}9sRjgHB5V%KN zIV8$xs0z_rcT7V3j8op$uQ?;V?G);5FRR-jSugD}k(_jAIL^#8hqS9AQWa^5nWbf2 zOUq>xli>L~f{L6`^7p!n()9`D@W1ylvs(qMd!JS`-ptCP9_UwVWZj>q9;)nL1#SH# zD}WJbyb94AhgZqXo6h7BN?3AA!`|R_v^=4K>zs?|<0P+JgTjc=`cY@OL+ZLK(9>5Kbmq41iXR0B=8IxSmVl4E>JBH)}&0hj~7+?TTh zx{VI{uQ#J;*Px$$PytS_CH8ks{OHHgezHc103m7=YaUs0gV z{1rtY-gTV^zJOY)!+^Ve5~qYYgwCY5$iv&Zs4u=von+Z4JlUE^y&~`jU3KR@j$bSZ z;F$A6@m2Y_+^q#GBDr|-o#k44I~XJwew4u7NKZ61+?`u*KxMop{izsF&>eq&nw2Z6 zW8;qgi1`OyGM<80C|l8cc^B8!wsWV*m2609P13P-h77zu6j;ix$__C`8a?PM@FVTA9@G(1bbdRq##pgDk$s$R?bFYrYaxa;&rK5o zCr7>2DW3r?79SoCUIV~*mQ~_0EWW$=_G>)a96C=PS^BN9#mVBqXD~0pk=P2+tJ$$$ zthZ}-!y@Gs?9)aoc1*81PuGI-Xn%<$aUKe6RCy;cu_g<+@Wuq}5T0jBOcXVC3$?o`@{M zR|~^mQq%hZup%v&6l(bwP|yHujtJx*6r6$}w=U~3tlAII0*CwX_U)aya+WRG?)L3d z9snCag>&{_co=?!2(1;l`T18doZlI(SG_6YD?^MOi}l(}t%a3A_z)4A>YEiExu~-o zd^NlT;ZDbnjyPs7#V)NKPzrj@(yvrawl`F=$s-)qkofyMT%O~C2*Y0v_pjEp2{v>J z8Y@cKlK>GBxVu#XaG;j8TbA!hzaIxDTgjVhXXt%o`*6Y;gEC^7fr)M>w zS7_uNGJDwsgjTMix!`bC_4cQs-j64?I2W-OWiiZCZ|54Ml-9DQT{oJM$;W4xGNSv~ zD}a1k*7fA!LOJlmxItr~=^v6DP-_zAet()}dyn7$n!gXX@(vkk#%^wc*L)yNsY%m! zzrKC2G~=4f{((a1)%0-&3q_q(I2{G``M1dM-;QIr=I@PcdA-0;nx3wu?TY@9yx9{z z%6+FS9Ne51n;t1eBzu$BKc>Zn?ftysnc}Ha$ym6k<4p7C-VBsNF2G9vISr(tcfvY709~~XofW-lcjpYzbGgr9b*T
    4$qE7)e(G+=WWsrGBa52ZsZV#RYw)md2{M>iW6Y% z@G8XfVXy;JP<)Wt@gteH#a>TU?vG2R@|YkQO^f3)%v8JNmz4XDO{8h$tGEj}EXD48 zq9!FLWmyEL0AB3uR;g@|^c8J+sR%z$GT_-!xVu661*$t}`6KRdvBeJuE_shi{y)OL zIfB}0VW6%q5>i#1O%ifBGNUwMM}DBlm#f_kQ!Z*8!)7Xw2HLkfC&R8(oDK! zIC!6Ve&=^Q@B7EQ&pyL|vG4u8vc6Wpf^bggl? zU;}`}d-dzH&}HxO^p+O?jiqXhnSu;&*j@kgZ$?7c#l2skdVsF+oe#lRojFtH^J4nW zgqF#KC4cm3;srpH5C+(oH*Y^ZZ)*_4|LBpqFi-j2 z(lzu~FZ_#giafradc+*mAqaz_JlFXrjeGeVVDBfq z_l@$uG?s{&&0u?C;>RS<|8#g<42mDAX=*ue^(qw`c??{#pL{VD@}k?c`ud=kR6142 z`E5dayBWC{lQP0c4L<{g$knA5%FTM1Ef67b?A)y0=R^v5JpFieU0gP&*~_uWo2Gb1 zXQM`{nyE7_IBGTC2%zGWcfg02g^^t@ufUOw89 zqmoNZF)WN(&e59Z z!|D?I9;doC&T~61wV?LG9%Zw@(8>4xm43D5t@)2EVTt_4Pe^DYI9ERASYyKL4*@g5#jnga4r# z5{+o0+C3loBQFScL_RsI$Yu0cCxj>5|A)KU_s5T@Y_N`-5RGUTm=!9XU7q`xG$^T7 zUWe|pIH!0Hl-Z|OxRwloPPU(l$EhP2aDv^*lPBLKW=5x_u>tTV!G`#$(Fc@X{9V)) zdyfj0Tr}t%oxpjWeUI;CT>{l3CI6F96p-*4d|f&%k&ekFZc%09JpY$$Tou4UD!IMC zvmCf~3JvBd3ej>Il_6?sN2Fi9y3h%Z37S@kJKu?rCEw6p{e%QZV1Y69Gb^qM*%hjC z9Gv-F<~t6r-}&e)vt7;OJ|z(PI4%2Cu6mCGB8nfrr!+r6Pp zkI&2oB?0`V^CXZ%h?X|ZZ`*h+bSKxX2|jb^=U)UG8X)2X>vbRY9i?GF2GOOC9ib`o zK(wZp@_!hMhAwPpj*iw2O7YNxY5~@dz;t)PNekhFoEhm(bBVzqArVd>NUp?aCfW=rY6ZLCp$8Hh??(1r>1uE&b zGZ^uH27q>TAk?BolF95jm`yZuP;y_LhC1^fq8afa|7Ir2CK^^2@+sPw{|D)7I5}wunBkUum4;tRd}1Hx(@R z_%3jbqs)9{GYPvv%!faU3xqRUvpVal3#)wKdakW-B|Gu?o%sgtBRGwDsL2)0E2}hP zJ>MdOm+`rAmBD_#oh#8p3z~*`IP};!DIhvnncU;ow2{2hvy9NJSQ*KWiLn}T@@d(t zd3?O7hKA;1-Qmobzi9q>uuWO`4{dBN;tweCSXQ@2V?()vqwpU!bBkkMJuy>X0UZ^w zIYeqitv&QmCDN06^&m4E4uAy=4cL0Mx#I@kh~MtrCp3|e8r6$0nbJy~uji0L*G^F$ zmeR1Oz zgv`kBW-w)nFoDquUfz&e_*sfS@jgT{_P+0On)9ircS^~1c+zy7<{Iv9ZkOU4LR+k*;1_{d zV5nAicrix6bhD1tRjIbL^)f6@5sB528{pgE$MPuuk4~Cr%bG8O>q|{2mv-LMiW-*bu)K=Dpl=A z-OAr|IQnF9i#&)u{rt6h+X!pVKxoKZ-JUsi?aHKT#ZU+SC1UWF(%!6D{Tx4bu3vp; z?*Vi#(ESaiA#_BfVWY&YpU+}rH29PHay?0~VMF#nq(myw+mB>9v4uD+nAsK3Fppwd zoXR9u`qG`zayVF8aqV*p^=qzNwES{K&=E0mH~sB-g!D?vfQ4Y< z)|2QUJ&vF4N<5`BtV?sBr_Ik}ii$Erhw6vMPizDik1Xs&*CY{Y{Fi8fi#@jP9#Fqa zB73r+!XUR5WQ8oCo9P!HU+oa3vo+V9LM#?X6lJk(W z_>2_dd`GT&*W$N}hiHU$j%)wx=BK|=eX}dWV@>YKRll)-#O3!Jg2CHh`}xN^0t_eN zbEd>{qAio$Ob5Bi^1y_+2lT50AsxjN$FRZ~XgzT+IUluCzmdLo`Vd?dPaVkHUV4asvX$-fcl-BnV(h%|MReL%D~hrdLa zHo%*@z^&P#Y(N)kZo>QJK58a7Ze__|Q>(4p!rrDdzm?;?nXc+EK3Y|~gpkg!bR#sH zgS9$|TrR{$>#M5LS+7}7v&DM9v#l6fz`qiBfoAUJZr!T+jHR~xN)snxoLD7kgzZm1ZJg+2sn}m9RjPWr#U?H4EDKfh%87Ecr!-?nOWjsN_6U`pEs+65b-J?~M&Or2 zrDUtUw)T!ua~GQvaxM$U%19uru_BS&j~k91alZ4N(1>e{tpD z!C@MjFQr!yRaGqW86KAX52fBTTTNa~lOL`0KwxS_N)R1Gx z4y6M--lVp6<1ZS7OgbEYA{el6R}t(#cHJ1r z2P7A_Az}krzdS#n3KOR#rIJbc+?LR7XRp_#o?hXRgFHjOgbV2$jjP(8j+?bfkCqC2 z*0?&N<K3!~S>tG=+BiAi>i4QlCd2xW7$SB0l17cGgt1>8%3N@-*ol&zF`)Ny8P%S4#n+9D9^7t&noLy_eDKLRm|9 zz^V85g1;+pqzvzkoArS4IetpQOQg|?Swutk<-NNL-X`Ye=ACvG>oQtMTMaY17epf(8l{Yu;8uqJz5nk% z&^7m^POR?0hw~B_Us>))hHT<8A;+ImwwD$c2VPmO2FdP4b|tuvD^>mL> zhuY;X{9-f5!Sj$`mIry0lQF?$BV?Yv4CPwGbj!`*I|m=3{2}kXQr~F=|BTfq>NUMdr_>kj=QvMQP$eW5`AwYyP013Wl`!UaZJx>r_VRsmx!~#zW9d zOwe!zm&(fChls&V3U3#3d#jsVmUPPA?Q0e-2i)J0U`*oC%t|#)4@pldsrh<)Zc)}= zST=gr2{ccexUKHe5M$#0^3G=Z%E6t~kb}Kotg&P7t_n{^Vd8$vtF7l7J*oYTGKm|t z&I>T}z1`kLvgI$>?eU;jt`pv`T3cU@y3Zz$x(~x;7fvueaM_B5QDuFFCd_rbI|=Yc)xycs&D(b zwiFkywf+8%n)EK>ZK{WSGqPd{7s2G|l0`;gu8T3A3exDtPmer)H3g5BdBZ~u=8ESB zI_tqUYiELasMS%K^MyC*UFbaGgHDf-Mh()Z{Zy_`%9MmBn^MLc?@WM*Mu`0(8n%Ea z2?SHy!7*w*`@sKedzP@-j@{Nr;i2Sy&$(Ubsp#uD(&1Ze(xV);#trb-$0Cj~y}w5N zL|>acYjQQJonyJ!n;dI2O~LU*#nl$2PGCR(QEYGo*f05NubSh#Cd%_{v^eA0ON03XN9X{MPt-{*^Qwgn~yDYo8%DHGv|dE~(vr+ogMW+VH0x47jookXtS{mv=xtsL^{B5as;Dc*;`?)Rt- zVU-@xy1+8O0xkB~-%{WhX2MVg;<2|ICRcoRZR-@yVx7nHiNtN%JYC-OTG#ZGyT6JZ zIlu{clru7gpnFh@)s&g^FEOcsA#J-I$HE3TgU7vA8b<4P<+irB=K-2a*^*&DB}I`E zHuWlV>lq5{dFX$+dnW{H!M}*9TN&<2&q3=!Olm8&6rMd}VPX66wWHvaa4FSgEH+~k zH5~%UxD2#k!%~SCwntMk)^cz5dy)X1g3CBo;|z5D#pRK5#S(+8yH`u^%9TzTl-uJX;I>3g#?dJX|^7Ro}`j0t`##>YPlJsTA2NgP08wY9Y~np194-FDy|b+$~F-UPc446di94{x`46a&XxD+|7fDT6Mk-`@?A z$GUKoyERzE5uH2Bixu`?k6>MFMU1(3;J>y_y%5EKB9W}iKZoy80Eq-1AS%;e7& z>ais@;g5PAOWbkVS}Th0(pvdT=)>e!VY5Mj)a3*&0m}xH!+Zw(?utrS;{JE0$QI6YLQ{d;?J)Qva*Xy$&`qx=wrKPn)aDK z$R0UTF(T?Vu7>iByJ%~wE|R5`mi)sFOA2ER+)C1~)7thBP{<4#W-(uVNnmIjAT=I5 z&S=D#$}VtDX}!ys^Ko`PW1AJ4405KAb3Fzl=;PDv=KsM=?LB6=#JtGIY4^?tb#JoI zL+tEBVp`EoTFa_T$_l0NO)n|!wO8PGL!Q|!4Y$AuwzlCrp-tqyM282)P2tCA&oF0H zSljq#Vn06NoNA_3T6ZD>SY?b9yR;}~C^77u`f4XyvuDX{zwr?DI+boIEWLYM)o@8R zWb3>v%n^O5b$y4t`ZI{sdwuh>*tiKXQ`d6TxX%Q9@5LO)vkMbz7bjJeV*HPtnZc~S zMG|2}Gg>DCq=qFl_jbbk56yuEjsot-1ZZd?mf9r(nSR^y_seX5d2voPW#P^KHerV^ zGS3M^C}y?vsbzE8F}^#;o`_4Z-<~hJ9sS5&tdBKh^|72+i^nM=F`946)joUTlx@G; z>JDD!hR|O<)!QfR9mG?~V@<(UnZlZqe;t1L_pg!SPJLJ9AyjZBY7?BS>4R6+H|6U- zikg|us1%f{(PE|DSnT2|`1P84khVal3MCNK;jQ z^e<0>T(I0~ls?3Ni8LIvTrIs>wAZy^!b$UO-jj?fSjNrnHCpVnhW3H}*K3@-2c5s& zw3ptvmPs5Kx>z+t&g1^iNS%;bXKP(+S zGd*pTKg-$JE<(>3ixod@w-r^@AQifGo_;!3^=t-!s_&w2AR#5n(RxqA1dpD|WoMhd z5u)anKwJ3<3$!I8xcvvncp5s!*-5Nq4T

    )U^cJyq6W^9yQ_M@6?pm$>|HpcgM7B&o{jnVW94k`mBrcUsK1Lx%4^M`1ZVrCQ+$ccUp zQ|~l?f%aKzC@#bOBb(me3B-L`n4WjZgyjo&RW`Jg4*<_L{+o~VKk8mxXs^&1nf>wf zHJwVn)s575Lran-&^P!np3V7Q%|%=?QWu(Mrc?BVCU7c=B=Wt-=Pxof3)zfd zWqNhRQ>o8uF=^YB9X}fl<>5xU<~O9;a(=aAP0}MMptw~*O$uszOaIoF|r52h2ahNZX$YuW#tbvG$Gg=;(v#jy8F}2` zaqbkS&x^w#{Q_%$PRpf_Ch7<-w0}Qv0EW#kIro{xQ)7DsDy1;?$*_|>m2)-wYA8=4hB&`();5)PHok@L@YT%8MK*eF< zx#OUt!WE~=6&E*oKmB}LOk|6PF_OE@V_E{khEK32h-@E+jWS*rCHP1qa-0PVa_3MZ z&h2jEAWbtUmVK9iF({^gEpE0;$v3XOA#X9m0Kr5xxf#8sI2;A^!f^t!&ALV zdlpj9lkw5RlRqbELr*lFQBOOIY<&`|xR=iSA{El)MD!#V1 zZm8Nj84llz?_!EqzHY;^aiQh`bGR8k!FB}5(P{duj@VQW zhh8cN9?h$uy23{s8D&gkH*1K?eZ4EZJx;Ix_nP{mWE+=*y_#p^Q!hp6BGrQWKpA@= z{?rIf3o3)h7ZCw9q}XlY!xi+$Kvmd+o3}jF;cRXmt@U|@bs2vPJ~ukPYdyG$Q>+$K zWF}aE!MNt#N;Zy`WCs`_M)^xuEy!HMXa5W@Ts-Kzrw4}OpiSF>J5ISQ>I)V8qjhi9i@~$F{eM28#6#vtTg@@wi0j}gvvi-{FnFcQJDYB6+&SxMQl6`XT>{(y zu$C$EWLPm7xdn+y3)a?VYXgY2#6YdeM5E>V`}^U3j|js8ESDy-zyEyiID|GSL4Nlq zUo8l?QlC)ArTNU`ya7RABO+X5K||AL{NK!}6w8yDg!dZWndbwLE0<+{h*)EJur@YT zuvs%J+_jmPdY=keY6IVAhwkoPY}n;hIHf22&*!J!l<((S%AUSClDGTN1Q~0gy5Oyf zm;zWG5%!ZgJX=o+#oaKzxGdPN@!rJilWLX86UVArNM2;;Ok`_Yt3KOJl#bh%8$TW; zN+5Vvn8LF`L{yBV9p@6UHAXsvEcPBWy;zqntTad7w}1?~OTf8GkkFFV>o`$B?5g7y z{bhmWUej>@`;n5e&sf%)KpO(hIEU_7)_WKky3F_MYC_ZnZ__X6CYJUauQchG2o2YT zZod$OTE83?+`9PA@!y}Pc^t;np`F`vH;(I`AeTiGX}v|lwt zvFgNlhhf{4e05x`gE5GCgi8mOT@u0BEP6&-rc;P+1e>Eb3LDs9P|W@$1h9%@m5HOq zbBLl&B|g}B1c58-g8(3R^FJvq96o@Z@ak8k?BYRh(=g4N3byJ=&sKl9lki>B968|B z!`cTu_;pU~nKIt2+8BQ@B;_IaFLgz2J1@mDw4E|<75?aRL4+>H`lAZgnlG^zt=-NW zr@@y#ep|wU3DlsxQ6|=|+49)jE5~Q{8h_=N-fzghpOXzQ!8lgsn^b{Uv||nWevTyf z6$dH6zn{0@x>U}uoA1zB&Totq=)&3(mL6~iexFM|!g?uOSQyFO0jg-6m8KQ*4LXIR z@`XZ=IyAVZC6>PBYj#5cO9B1!I==~-HI!*t)&$%;@bS|*6D78V&6FwLkqe%Qmvam0 zeA8IwP_R5c(s$r0xIhf8RxpI3-JU>xv%>##YmNN#xd_uI^)|BEH*WhHo()~e z_w|Ne5tt>(eu}^TSAuV_n-;}*pc30H6xHz<(&oWc^(^g^&>I(NRj%{wV7oP%4^RGE zgFg!8YRP!L)(j`mKYUao#d$>h?Tx4^XNPL%z_o}fqwr~f80L-hd2dfb(p7jcq&&ZQdZ`@~a}P>cVYNxg zC&N#%u*~DuKU$QSHL7PM8qKe7Tczfkz0yu@=`0uEK7S$)m$4pJd~!U%)+;%nqf-d8x?W(` z&digle++g<>-ms|Q{;YvTUmSRSpMej-*iB$7>u5Zw%{K}8sO_McaNf(|NU_qHjVP+ zcrIXc7lItxg`niq-0j!-rqV{mf-fBD=$@sd@Jvm=J&y@%q=LNERYsQ_o6q6(tj2Bx zX@=Loo@(HyC2u|+5Mbe%-IZcvj4U7VEgTS}UU>=13|(l3DFm0T$6uu5*1i)QCSPc9 zws5AJK@m4jcz9G^O};O7@C{dTJ}<#z`m3fiTZad@(R9u64k;q^3a$4FV_gU!`2x;6 zl%TGLAVH7}VKKiER^*gF`N9#J55iG@-u$Ga1kp`Y7k+;1%z-?(_X5xm<;3)fk}2d5 zxhKUuE+ko|lEKW-B@2}SwMLK9{ngrA3BCn>34eO^`^%QJd?0w&hV&xTusp8`T zDxG#R0vu-O?2i@#96xlmwB+-xzF1c+c?rM}+0R`HFP}YI(Z^4SB}ss-u1rRWIYC!> zZchq&8{-}Vi_{dC*Zi~rLex)x?tD0IAl9nGK^ z^UF>*q(ahm9C(3`xuox2(bCs)enU`3!#OVD{6j_%IZ;zLG73wm)1Y;*a6R&^wg;Qm z1PJfO|8!c$qwi&MngYf|f>%SU(G!uIiI&9TOmnZuZJC3G#n-{)f!CbmU0KC(=;&bG zKFO+K&w=kE=FuO1;jY(ii^DCOVg`No%y&rJb<2rdH7At1Xvv~qi8(V0YC}!VFWCqw zIjVkYN#W}!bhoagZTMJOhFi6Z(i>w-mY3^~A$R!FHM+2Ne!}mPpC9XHBw)e3DZbk- zzY_20^BNK5=X$Rp)gb)24HqAr`FD%W3< z2)?dzo1`VlaWBo&qR?=MPH~M91g91+AnhJq)9%;_t}iNi9$oVfH7cxH| z|HB~fs=Y_!9GD~XFa0X#X&M=5*pYo3xDt2|CVeEov^p#Mi5&2ap~&n!z@DZH8e?n= z-&9tXs6HMD0?7|UDhz#uBGV>9V%(+A`!j@Rr)XG4TIUU*PV0>tqv8t&BjxE!nBxae zs{vE6u(IRl+Y5bxh2~Z@he)rRS%@BNfI%ScfU=jnZ6=N2Z1b@tAk6SCv{y9ZtSS{S z`~-u6jq4o;e;)a@<(JZKNlmxg@f}QAPL)*-o~ZyM1hzoiE@6g;Yk&%vyMUaxsyxM zRbDoFXP}#JKq?W;)CYh@FjH4B5&StJab4>C@ZbsX<8dl{>6)m}2gwX=C!gNw&Mz(N z7iMfzW8nZcng?Jr<nAVq63wP;Ap?V>=($Ym&184N3iOMBd|&$$EwNaS&<};(7XS8wJ=dOY!spgQc`YAAN|=c)-r# z+KpwPSHd_sxn~(hOF5Mc7qcV{GxN6fl~)RMz4_!XSS0JqZKf2q{IoXkWaq4iDwmlt zR*ZBf9iD^gpA>$*#0I$h-&K{T}7TeVm6k6=05Tq7XK!&WlB z)c!-@c8oUj5#YQf$WkFXzX+*AH0}&n{w(5Bg`hY!fa3J35gyI8Fmn))*#i|U003I$ zVYFo&ZisbnbC1QtF*UFkUS3NjgB)#o#0Rsh_v35h%en9oQ`AE-?hey9l7&Hv`&9^7D zwyC1^9OFK!1a8U9O8~|hc!fr&YMqNI%fxc0FPkJn0AM>n+9qtrtL9DT#j57PRPAx9 zc{0XGpT}Zf=s{0(-K^&2IFs_Lx61No(KECsO`ZTNHWFbu{dy%ZeSrC>n6^Ldej%** zMoLoM%f@i4LR+$93bpXt8kh4Iu@~DImpg-Q=d!3C*wS3eY^~9-t8`|8(rYA^*BhAG2qQKH zt4l)!%>783!8=%C^LmVv)yY3Gx)NwE^ijjxC!xuE)YDkJKY1v?zepCKLlUC%C3mqL;D%by)SgM8?iv}Rx8dr)&9-%GV3IW6#d8Emw$BUTi_<)kdO9oW%8w2F% zO3P<#w^u}Gov95D*|AZ7eshUM8ey#nV8%(tu%$bI%#xB&0OAvlKdZ!p(?R6*DeuKV zH=UvA&1_5Op&5Jr{+golxUM=~?8HHoe(j=KXgn9CyLuUS0ny7Fmqg^7{xhaqP>j#f zdL#%UQ6D3&hZ@vF4Ff}pS@0LZN{UQe)Q{l5oaqv++RoLN+R-T}v{$h*u+C#w;PI)e zwK7$R6%94@*er7~?J}h2jZ@=GcDI+c=sT%bGOQiX!S5rm;O?gOS z%780#t4$K@+5#9LXq?bjT|QSixEz-hN2Y5YoOq%GGNK1N2zYgIPL)XDjeoZt6MCT4 z04`XuP&DEUAOQG?<_7^+AQ)#-*kE!!tkCZNWX z`5qQ6y(8+wSRT>XEXw7gz*m7SKcSX4`|+8zyF1brT~O^bJXQJY4q%aH9x7VrC^EjX z-PLG1%;>Ah)&`0IcA?2t zUD%SB54b_(VxPsU>mqGCg|_MSMKru-F8~twnmpKS^M4;-Vhl6!rKLoXx2znP#o-dM zhJ#S-{FWAT+Q3{+V#)B z8nkB>#xpP9u?k48?5i$!mB(xFBy{8_bm!U-@*lSXJhd(VA8uZlqyoO>@BAAC|#mG?RLlzZdrS_b3oI{R2LylV=Sl^^K zsN6YTkpDVt;=$W@*p14oQsLNiEx;KuOA_TSq%4xK4V&-kK!(rKY5h)>QFb(VTfL%T z{SrO>BCxHLC}X7wNQ=K-mPVY^Klv2-^uf*){xq!o`qKnwV=OoB5iJB1a-0yC^)}%s z&4;^J|Ev|WFI;|4OdO_YLrV>qNz|!HuT1bu#EOdMw((GUA5<-)eBey|B8w>QaM zck-|B6}BRi5H$eU*7{?8e=zIhndvio%Y6akOO++}%#rYj?t9YeH}vw%!2k50rq>dz za8W~fo74mujF=gWIGZdu-$%vs0K_kib?!=`V-xW`3Z`heJ(>6l`$AZDkOvQ#!^b#|Fxy_{l8ofW3E3pgPGip(9-)zd z{f9F3nvZ%?X|cvbA>&Eag}>XSCPQfGh}2R*NWW7rM<3pG1Z8>|<%mO~<<`4g;6qb; zO#f+@5LZFJGO?d&cTQxbV026dS8Q6AI z_j(-6_ZmNMOj5vu7}8f&E;g~$662x7-u$gXdMBS&2cCA1V&m6h>?gYVc*hY)f8_ne z>}z-9XU*8!PCnCaTygTwEi5s`78#WAMZPtD9hmijy;%rUW!t3iPg(5b3t^M-LU|2M zJrSUuL6CY7Wd5L|G*#H^xtq2gmR4R91zJ;?n*bt%-aF8=+xK|C8G#)gpXt1j+6Y*~ zdlXxJK7An34%3lV=0yNjCg?+3B|AUkjpKi*yxzv9<~tLR*3#wd1?(7`l*qS_EI7bG z?DT)Cu~6H@enHpP5;1ylBAwnm)J?_my_M0;(XY}qW8(C|-;;~BzDEC&*Wv$NrOR=( zRpoqTkM;jR*Y49!N3$VAwdjOe$WTgaD<7yZan+7_`D-wr;X_xkw!8~9ow>4%>&CVN z7JEp*I%z^I+aZY>9U|SQT}B$qlPgoY*P3hH46hb>^~fm}WWvYNhTq?Aegi|~dF@>w z_a7D$v(MBCJN#nGNQVKG)<5OLjfR8j<;&Y2Up6mA80JydnI((YZ05wrU>W(FY3BBt7f zMi1SqBQM`nM#uSvL416eu9HriJOM1NYD+AD4Ep>?kQx|{J>jzUoH+A-NhcS%QZ%zN z!NcDb>tF(o71FGxrFlH^ANFU~s8eiffp2(TC9~e#gTG<6Zij^8VX71*sc#2tb{1P~ zC)tv}9=Pb{U0O^biIXBiYkUtC{ZV=zcsPj$y=LNr7?J?+Lu)?2mcY{-+vzB7T453G zV%nK6J9Em|7M4+Ntd$&Jpl$~oc8WKBTeLccHv-x1&oUxe0fd+h=A-W?8A?p+RA<>D z8rfdBw8DS9DX^4*C33WGBqw@(dGS`c$`Pn|fAnpaG@pFBnq?*B)h()#jNxnZ*)hKO zd$#0c_yN`j>l>v|oSS=2M@&h;_(7isVeE?arRA={B$W?C?leh#Hmr zUEmpO*CF0BRY5avxIq5)jexvnq(TLQA}#5&psD#32b3j8{sVL_%S`^P&+s!S#WZ*r zyW}!V~F?Md+Ij;>fSsn@(-M2#0+pPsMJ#Do&%7h zj~Wsax6sK0JSI%H%q-Q1CdxKt9d^QYAVXv!zWkC_vbQuHiZ2uN88E?ABRPLE1_lh>F85Ps zIp2NE3%zB6qd5R^GmZ-2wFRa) zV{WB#;iF2$YrnGpw-(_}tEt+{%y>B@h&oEP4BqJZ<`lp1q%2v#p;rwA%LTek7M~`sF0Ubo( zhi?TE2!i#BaJ?HdmE^mq1_mqnR+S{*9~}?!^rX0Z)gTEfe97wV<;BhDl?QaqkMJ(4 z$nncWjrZ&IK#o>72<^*YCAxu0R3TuBfx!V~YEi^{{J8#KG;Ejtft#N`2ABS$1)$ph zaX>kj3(4}P1!^vI_p-_W5zLIu-GekoJ}+O$%D`gPdM$`Kr4ur5(}#eQZ&S$Y`aJx4 z9sk}s8g(^>a7R%VD(3`-ca!PX>!t$q(TK%x4L>UWG{O|l&{kL&iY!1t^^aQ{Oz6E4 zw;it;*l7a;sey6*5_g;{Eq1XzRwZ!H<+g@yL0YBioSb7i963E#gI+L=74_L3cpmxs zPL9T3@pce|_0f_$(n_tO0AGQL&HWrymKbFY6f`hX14_J>H4nhu1j#{5Xt-5UND}4d zSMTqgx;4r;QOVa1sKF?0h27`NDB#*-*aLJ+oKN!Qw~paL(nk_-Ej!r zHap1JaAOWHh8bHUI02D9f^{aurn*zREY(2pt<*+~SL>zC!~3N4)4wOd{3-~N`Y>x) z447Pk`Ck!ZyBnEm7yKf6Xc3YKLF+q3u-^k%%@S>9+* zKFgu2syN1D*;qH${-2L@hE(;p?(13!Rb-{Y8}eagxj^vO_C6pclaAy) zDb_7*Jko~mbGAp1?Mvy?L zwItzbt^|g6fFoGoo(WLlj$2xZ>&SI3s1QE4q|L2{YzQ=+k}zO?4m_caUVq9Hx2P+#>x4R{c^DZGknx6HQ^DgmE^Fq4|2v-g+6@@+9u$x==_hd|OX% z5;;}KMQ#%X8;CB{w>2IxWB%uH#~!rJ`hG__83`Yi!LT|(bKd0Ioton`=t>#u@i9P2a!!}*p@8hDOBH*3==mL273)TFmcp~$f)#$1EKy4+OI zS^#K)fm)}Jc@3t5xDsap1MFVMy@#rQzX_p?V5NcDCMg3{Xz~Q)G&%)OwgPL?VW2XQ zsQX7b0_-t6(usLKL5{!LupM~jMr2;1MYZwm#=i$+A2OP<4T)bXb%}K@>ZYoV`;!r8 z7OWFXEIy$B$kR%(LUcg>L3LONa`dW7RSK9hqpMOn^I|(^I&HK&ow?4R0L)|_jMrAg zVFZaPi%D0lMHrMU;vEW#V^gm@vc}9*IHd1U9#^m>)(72pk2_UX=DW@3<=zHtd-1 z2eP|L8$l5E2m6O;?(qDljX3o!A$kRG=r)34y^NmU0UEuPEz`|bp3|BO8~q?1kONi0 zVzc0NL&D~dgWieY2o+Bz-~9uB&bEqvS%3n0qFG+XIC&~6Q<6qrQWP0@ZpYQ-Bq~)5*`4$i8Q--$g5H{ZB zh!{I-m6G?U-8^ZoDQ3nTWh(~WsJm3^C{m9%k?}sIEf3})C?!&4k>3Bz4+I`0@!EHl zIhE{hfHF6)>T6EAO*DefvRLAl^oY!nTj*{h!8 zA(iv$hgCPa*KCZTB7=dkp;Mqi`=2!%9dwuL5QOL>^ml=ty{r63i1Pwh^@vNz_jQ5Y zMkv!msf3XLyBw|P#JQUFkwRDsg#8|poSmn)JM~m`<27HNL%v-_p54aRwJLtK)`hlr zp9%rmoLhcvJzd)~CMVX~E>Tdu^#54yiCKf-;LV23zbL(KKXiFIHoa~y_f^Ze=S2no zP*CRZ@0S|)@6BEQYK-Sp8YP#6P81R0-Qh>s#Qt^AZ_ZpQZzWu}pD9;(^m`;8^Yh-z9I8ED$3EuTMx+By6uYLCHY(`JzZac|IGzZUT7oJ&mM!9w-w}Y z7%vtQmXvwi__wB1F?_unGjI&xUm3z#*jZV@mQiatA2kM4R^~R`mVS5$wa%|e){SVx zGHg``^c+$kY8QYXifVw}DnsF+vo$M{x(%*cINe(*87awuJO4uYBl7m{9q)?a_A3%meHL?Ym)BD*SAdjYZTQAv!?w7S@@K`b*;^{q|~|f zp`(;VzMF%gdyAL3jWK={if`}=Q>I|s>;>h2J=0w<&jGDjS0b^j^ya%fGq3CC$W)CX zC$S+Cy{)l0SSr+5>X`?)QGK@Oz%^lcFazc=aLVnvjN5V3qx|eo$~M2~XYkL|?)HZ} zvj3%O|4{t%tu7BXFkcmO!aD-h-Nd=90uwyyJ*MF0%a_(=Su%!FFOGIk*iEUnK|_8? z_1=%=QjNV=V&Ein(QwAo*n_RN+nRti!^=+EMd8lS9c`59O>`mf@bB2{tvhe8jCqu~ zT$+2S@R(%z0opipR8%LkDcJLB+|@8$Q>nqiu)#uWTvG}B6+Bg9)B0;) zQ>)Q>@WJ!B3Vz)JoK68Q;Cmwwjy>~`)`X&MqJERSAQR}GJp%d_q%hc{SMwvw=QKpG z;&kW6{{Es;L9F#v^rq3H1?SLwTjPA7PJ7=Ut#1B4Bz;VPRp0ZK!q>|Hh(-L#gY*B@ zw3R|nZlf*On(xOpHWXo?4O3Zit8c5kaI)45R3CLZ_!*LCj5#0=$-;5^)}vDA_`enY zTU#D@EP6{lJ3de*1Ot-|Fkidnitc{|!mKAy7SuW^!6*@5>#W!AK3uu%6f|lBE{5my~hjvCJv0{oK0Jq zYXDv2p?`zn7)k0PeF{Bo6~Sf5QD1Dz|Ll2HAeX&xxmSH+t%JU1na0wnO6+c^aDVu>YDa+n#i5Wem-9&_U_+Trh0fOtRRhJm+!= zdQlm^9R5~r^-~qOnQ*3Xq0QIg0C-Y&9!) zgHh;2(ktsU0Rr>Uk5>>3;Sf1s!TZ^Oq%-SfA3z@RhhS|{^Ot13G_syLkzPf&rZ^XL z9)B;xJ(V2HtcocBHc-haO5 zx{h!#;MsfaweEGVd#(M*&rR@CevC*exuO5jH@&OY_RaIPWv4aY)yA8*W?<%fB$u(6 z75~63(KYU>kga;qHM$@9IQwUFS*C{B@~It9xMO0k2noe4}q*j!Gm z&}>2~5&)1?vJoIH;mq;h;?Gr({(3DgmHD%)?@Q|g_>*@e5y!;X*`Po^bK~DK?#H_q zjeeO;yWhjz<*LvTcIsyf9{4L$eTH0oBKx+`-QZsDp)|2P;doKs9@euj=G1j1KUw~L z=zesWTOr)*MczIJkghF4%c(ryVp0uwmEw`4!#dxYv|Ci_jAuYV3-H_vPN7$NXo z@En=zpRzQ#G&1`=pPRkp&2cRQ04=AxOto25k*#F8i_e{5gg?HK8)o7*}2ZoCAvQNJ?bXH_WS6Zo$=_# zH@^^|)PDM>-S3z3*$-$^CiYKTYZ{*SSDYUgQ6H~ZA`_EDDFlvR^VtmuT`Vd?22LEN z)8idjY${rc1O6Loge$orLmzHG?ro1wlvlUGWHE_Oh2D)$-8WkEN2`z@@6d+=eEIVc zaG24Iab*CJm#V>*Fo+zBsXy`iGA$vt4mt7JwvzNjfrxySih1taUZYNU%XyWZ?z20c zPRTJ+QQxpZ_yN-U33zghe^Ks~J%c^>;ELGAgV242K$i&|=-%GF z7%|@TzG;zs-OaRtPu_~n;2a#!-`0I--TBX72gosiMxIB62We5B?|DZWF=B1a{qvJc zsg9HCUauZeM;?*nO-!1MP+?`lZS`YjSe1s!EWpPpdx19htrN@+6Q!zSXKLEsaO=v; z6*{a&x0p$z?Q`6plP&sceeD$lpZd;%!V+KJrGiguZOJ`01)FetW+Iflccs{=$KCc-~_ z@0WIJ=`_!ihm9-66fl~`i#?(JGNd_@wa#U);Sk$q-$P6oG2t;-;eyDV`87^)_HB)i zb@2Uv_lzueY9)`D54?qiwHt87AP50Uy@sGbP*pQ`BH_>*(B5nOyS|2NtTj*DOtRQ< zquO8@NSSMmMoaPVf9{e$gw*%?Ln+92az;Yklb4xE1!p01?uBmM^=QGXdX^=di=C_QRK9rl z5S%^6*X*F#kdc6TtV$$y052eW_s@5I@>sh05S*?2i@iLWm9w;&{CIl?8)o4Hn;Ao|Bka1P zX~>z8L!l2oH@bAy%R(ec5muHYxSBIp6VDq7?_VG&b(NW8)WH5}nc z4tTaZCcG9&aZ$W^Z_?JA^Ou!_p%7CB4%2HmzJ|&ejslRACJzvLte`AJ(E37oFpBmP z);CI1ZANeSV?NC`zHue@{p8C09KnQxLGN*O*^2sM)y$;3F#=3sbSm7WijSXrdIN0X zIdlaJPJj7dQo<66(-TXDWtT&_)v!awm8Zx8!{ZSB<9$W@l%&m3xaiISi}yL@bS_N~ zdZxKf(*b&1!>Uj4uiQ-b87l*XON4W5(Bt6i@@(eqjStq=h#_^p-nasPhW*t})RmC6 zI6l}4u;2%r_U4J723RQbCA%=Dnv>uj5(fG)-)h< zL$#DO;Rd?m9jq!`x~}Bw7D)*=pvh{+K+W>Ct}5^Y)=1Gqy~b%Jcpn>{QMmG*{ka#) zR4S$XH>htvh5&|LjkVitlFE)4%V-qH3mj->MoG}N`X3g?)!g0O=+u!(Oq=GfKYsmO z!XisMq9Y-YfhyN(x3LA}X^)#%vGWsPo6Tp-x~fvDi`#h?>y;9dxM6jCDXX!`Ed zb~sMs;%;>93OM%zY)xh;V)vU=s<(2&7&@6(gNEvThy!K+A$Z|K`fPE!+9 zrCN*^sZ*b84`=E*-l55-)D|3Ax2j8dIiaR1lq+Oy*Sp_<&SdnG;w2noweB@Q*u}`7 zO*9ch7y2_1RX(fPwJ>JY)Wax;B0bfO)J;JpKr$wcHzAOg`lCa#Y!o9B%iXhwx3!*b zC`bbk%OA<3T2MgT0Z1I6vus0Z0l~t?Kg8I&^!p4z;pnM62tLyq_)+Ve{{oC)g5T|d z37c9?YLVdELR6e5y|zCucd*36gbkOW!ucoMM_pxtbTWH-l?sUKcpW;1MOJ4o9?guF z5uQGGNtUDQttcKI&Ww@YNU$o1Po3r{a=!--=<3=;q&2gnYa5BK`AoE_ww_7^YC!hh z5UIR;pPIT2x4OfZGu_F-K{<7>BoQ?{TWAah3_iP|@_^yyEf9#}#(-PSR|^Lvi#t^} zv9N>_V(0|>C?~4S!&w$;1yjBSMw&AKz9_JNkXZm8F+t$DU7g78p*{uBz? zuL6N}E?#3X$FM#>%g}RH=d7z54*~d$nkF;YKU#plxeZ!M$A7rquU*boBd)R@n+g5Z z9(^zU8<7U?7KFl-dDU)P>2(GbR%!$@af+bTJ<;0TZRS(r!N|mF&X|?IA$$qpp*mIB zjBukhtj&^brRvF@rH5}N+I&6->M_|04QH-Ol>&?oDxX?0Z}5A z-n~!;5FtnS14-;4Wr@LCSg)`xwBZ%6#G(N`jv1biKeEO$$`3CK!ZQLY_^Ll3?7a%( z!I7;7zf8Z`MRGvyiSXHtKq+gbBxk<%?ghgT_9p^GPMj>ClTSD+(B+W&dJKPbY!`*VW_PYg<=(wZGq z4E?hZ`l{q-@&4nPV!nGhwJU(kis7>zX1X|iwotntt?RK;*TXn2Ou;<)@gK-{i?!FK zGDfZ0G1)(#FvLh86{)uqv8GRpji zZuvx3St=^k6DTq093Eug*RMCJ?ro^WMthJ}?v7TmfK-(~vTmw8D!9nii#1vi5KxkT z5K!;Rm{;yQ%w!aZc}J0?sQK?AuhgBdax{9nc-g1MJ0O>*`gAiDeV5+ueFlNsP=6D`jQ>`Lj)yW?!mo5?zN z^?aJBw zWEp2Ua}12W)DGCfH!c8vRiU?x`KXDlgDQpHzxD;7jNp&I{d1_mZyVv%dwv~pXz*^t z5JSKhx$xPKOf|bk+$<8|>)UEF2AtA%xVxgqK3kLqdS#1zxIVSs`;zp3@Zb!LdBm(d zw;o>&Jq1;tf_}^~NbKc_T6B3=Xv!Rv3WT7!sl-eAsrb|>+*;2%3<|g-@jrQ|NtCs5&h5u&6^gYJjvLZZh@mv4>FSH!N7F05mKxi%$I#ffa zh@e)Vj5TCHI`$&^U;OBz{#Zdj28L*qsXN*dPpBmJZgn0~%Oo6(2pyj{5l38$WDF>H z_dU)OpJ}MVxneveCOFy}t%c?v9&}aTQ1F;ub0W(G`?UNhT#Z%IB_OLbI#i}jsm+AD zViYJGv=W%tPE+NtyLd)YBr-pelvbtwc3uj37= zuhEF>`~4VAyrEBkdnvoEvoxZ;^=XonxVlij#dxC^8&{8u8%i%qeWK28BulSjAdD~4 z#;u>ag$w8utzWYbOtRQhgwgPr^bV4Am)RPuaa1AMan%^57$y5bHP}2ZG@5Y%=KGs* z26a`u-wkeKRr11CFLs3~bzTx;z1sUTExr<8%(~2HSZ>hlyJiaL@Z5_7<*Acs8@2u3 zNn!u(#V|Bl8ZoZBu_`N;I6N~6TAa~^>i^opT9AE>Ly9QL@>as|DFzy^+gQ7z(u+*F z9bLOT^FTZZ5PxdL0VHuYvH_`X&m==gQqr%2*5UZU)$DQJAy}oI$`s8=IU8abw)0X_ zA{LK4VNecP1RMw974O;6rq}mqIjB|!$n}EXyK-K#7Xc@`4urn={2SH3G zz-hi}W9xHSI6CUt`qji{`ZeG3i`5#X*gYAnSJ{8oPVQ6stzg%o1FWDf((*#Ng2$C? zTf>yi3qNaD;#!vbie?J=d{?O;0~iXkxXx9=M)tJL_-~WdvL6uEM8>R6zvh7+MN`+= z%!JpiY_q*3*}D? z?E=RK?z0Xs-muEAeL{WJd!sFvv5a2+5fC|zbq8|&ox_TbMjNeNRiLMluf1CdGV3f8eP(*$^T&Bj#ExnW-B6FOY~XI2mUtWl|HUcS{oc9Bq<<7~z}} z6&uY_WX&<6CTw62oJ<#!W7H?4eqbc)7aM4Qf0SltwJ`>I(Znccd+UmW%3yo z`g>I%#L=nevjJ99o`+fXp6$ObN0R)#f$YpyaGSC*)L95g-C3#Clt*5X1snPJu3e8x zKUZDey=5>s1U(tX$aoZK%c^HE$lRl{OkzhIW(F9IEPwC$k{q3P1GeW*NansF8P1IY zkHKE&prZaYRzqZ^q+x0)d|_=ak%?_62TcfCCJ}1k+$x(hAwfpzAwWM};`nXHD$QIQ zjAU(p58>x?W(3wr`%dm($^~YwE&o{^jH{$sDP4)gaO`w)lu=}7ZRn(^-isr0!O7*6 z5srVNOE6pf;Cgl)Q2)+Mb7lJA5A%$z)$mKPE+jx zy6GnEg_ajE(W4acuTWdOJ7a8)&g?!P^^+X_F>n6Rc>QG(-xkQLVj!^~y!N@Wg{_*@I4JZuJzk~W$A z?{5!2v~X594US09lsIj!dCb&^tM<+VHWUy#I{NDu>P>y;+j*k?GlO2_)PMgSBmOes zw6I~{pFZ_&OQ}{of?fH|J0K97dTzSTFA zr)f)p0uYmUcgJ`8g?`%kCxfZeA5O*N=TS4YwGwtkhmF_|+~N(-n-^MIt$Ud)U1e_d zcz?f&X=G(X6N$>{|Ev_B)}w-qUrwse+1K>g81gv$M&DbO4)mCyVg#Cxm*(vP!7v69 z&7!r`*V%0TaB~qV_`G*25X+`3DXB5%>lM8;bCrwhekB;o*M;$;SKv7_f@Y8&WQgrCM-GI9cJC3rg~B5qT+wn+Bj}# zlOK=AmSP6ENv6BTgxz>Jw&r#up&V^v_N_mtpZ|hvVgS*Ja$#j&LuwZG57~r@i&S~B z4hiK~$@8M|#RM}Z+!YFvEV@Iqe}NO%Qnu)odh=O}&--#??VC3P7^$g&0tNL2F{D%J z9ns!Fr$$Vyp0B42MoGPXiV+fy_JH8?XS_8fj1@Wil*HEyJ=^2k8l08ddgCQ}J{-oQ zvn&liKRk?DhM(kqTe|ZPc(+WCF&o#lSvxsF)R`W}QV35fv8`!Z1^4Fw+n1bqxu%sD z??5qv*`{?NPTqKG7QQA^8-0fFTx@yEl1c5A=EAYW18yiU)@>=e%k49=zTcv`q(dspUN?~=KOmpOp#eyi<=ekz?ieMUfU?iPL=iY%aM0~u(E!=v07Z9P{Ui;aq*ar zP(S{GCOU#VMo?=Dk#rA((pq9%$fN&0> zDV4zEf9K3hEoqG#CV(`DWwA|*Wj8nb?7msK*r_c*C-z9wKu&D*&$^LODTn`Yv$MrSvCG;xt zKFMvxt&DY4^pXl(Ru!4rRBkDCvHhJ2kOqvsZ!xZtna)czc~1yTDmnq;8{ND8l%{0Z z&%irC7GxwdO-+G~jdU*Ob;pHfm_UNqVU!Q%Yf_m{Ce0pWiXJqpuH)9crbBB$Lc~Lh zrgjr}juFEmd?(GDT#p%BY&YefIp zoFX#b0xa@!qzLMGwJOuwtaFD(7G}w;FM4++BEEPyj5pHy>;=6Kwq6NtR~b#;=s3U1 zcQ;+l6`pvxmpxj>d227q^+HI_73)G?XJ!MpO3|Lr8*Z$yysHS~~K1}a~J3$7_l9vG?AZC0VM4))F=SE6{zPPvV z<1n7?ZCT@AN%prNbaV$bnGCiA$Wi8>k0VussjxAzvckze$oK8F=e``dS?np|X3Xw*|< zl!2kXny&+jwRlj_!BipP90yh%FHiQ8?mvbAReWt3w>s#N1*O>nPzyHDL~5uaHP%94 zKZ6r{wZQ*uxXWV1M#Z_@@)*6$HgO5K>kACU$VG4I( zqg~goppIu|#4;|n*VSE6Gkd2zn40wQcq^B;ZC$3}*?>Lt6iLYT0|PF9KS%>a2ZCkF zr=&=TB59a9rWD3KQsT^2MN1%(iH>{9HX~eQ!xxTN7vPlLH!=U3=3uL@g|q+MMlG&I zxjf!_L{1mNd+}0}m7&X7zS6sH%TYYS0O9;&d0?#l7L5 zl9PKl-Ctz~1XF!`$A?AKV%rPX&*ttv@Wl>bYraE&<5bee_kU`N#?y`qd47um1^dlS z9uhA70*4smZt&PiLl@Yv=Z@dq%2^x*g-ttC1FuPwA0E$>@juFG~%Z(;`Z`|d0Fod#v z^}X!926ls0>DV%1&CI0L2_Fkr9FhFocAdt>*la)%d~1oMDk={cl5IcaZr?2dY>dH1fKmmhO%tVMpA>p>GGWc7NS0yNTo zqRQ5^heN8}>9=w_ddX+^is3V=<(a@|z?%BH4!}h#wtr+B*vG9PqqwL?=1if;p=Z$u z(W5DG@4mf}uk!vEw?lI7Z7-4EiP7#m#@eEqYpTx=>#U9KbN2v8M+ z@Fu^7(F~1?Or5qob3;k6P4gonGNT`lP%UBub|#T|0#11qNYuN_*56n~&e4a4?w&o} za6hSdE@YY6JXtQ}Uv39x#yo2$(q5V+`(6fyj7;HEjpY(P0||NLTDQ|wdL(V%UdL2q z8?1~O$lYa7654PEh{}SOd$;*Pb>FIVs%<@`Y~pR&+a?gd9|cz&hT~@!GsW??4IRgEOp(1B>-B;q`)hf(|-_wl2_nW6{)fF$M>Ipo!&iXg5?=OO* zHo&rgP4UkdEoKKy(No<9+=w8e4qe=A6x4EH5<&BnQeFW|bdK_;YG&MXVY7dSmMG-xRU?RoSgZhc*~AVG8KsVwwU1Im(5 z8>bsFV{;s&GAgM|@v-I!12oF8oYyB3RhfY>hT);n@h-kx+a$wPJF1o^C{k`gYyD2e9w>Slu)o-fo>$1(n6StRdce1qG%hVZaj)5OqK@8Ex z`C4vXkX}m-r?paFULA@r99~uV$R_5ig->A*GAKyuT6*Sf^{tKk@s$<2s-l4xp9t7M zE$G4pok;>y_#Io|dV80J+Sn)Wyc<&oxRrq+!GIy94m$%CC!E%5dz1*UY(NeP z8UR#kvz)WDO!DbX*Jm9-01kWbN9_LOww~M3w4l5l@wtY^Tjw z17~F>+^>_>TnSZ|{0ZTwZXear-9?*fXnU~=RAryw55?V{#TKl8>khN>M`rquanOzs zHQJ&+Fa|`Mx?BPq*`f+m4Sqjt_Gn2ft$SfKvlZCr&_L1%hQ%b<@WkVDpi3j2kD}-?0 z(xSk9KvfdyK1=^-!l6dRn0MzPH>Zwr`kl_Ijq`Khw~|S(V6p!};}trx)zxI-H@r+a zUp}~E?auX|+A!Czk3(&yO@1epr2C)#;)u>B@qUwWMOk1lZWv^`m5YBM@V< z``ICQ1>-A*^rGRKo3;`wO|RXK+BJTV=<^yE%nST92ZN0rt-*Uakw-*C(KA2f_A=86 z!6Q@7q!3#<1Oj~-bBQ2!70i&2G2uD4RqnoPpx(7qC*$jX2OEeFb1CJV!^t}0>?Y34 zbpK5K*-fyK?yHS9JbbRR+74W_^;`+uz7oS> z>3r_yy~XvrhUP4y2!b7))`vINOt*~L$6jtpHg&0cKn;?}D1Q&6z_xc}1w~_BPd9$w zT9}o$B^KFi;Zr-oH0gvLi5JMt!~38u@aCuucY9uGb)K?6$$i}~Ur6fTNoBT!Ps0hW z-X(ZHJ<(ruXi(j|74;&9Or9abY4WO~mHL9EE{`oy*&$MM9VH4`w;xa_bA-m>atT~0eQjiFU#N5D?Yl{oC}+qbUojEPvDiSRP9R^Lx! zi!6i5boVgc2+|2L)M18qMorDW^%Bu2AgG_Bz)|L`x=sf*lta;w;oZjzx)CJ)M%?&$ z`kh(FylfG&CuF>t&tvMktt)@H3Oae|f&1+noG6l6>F{!|Bn^f3+PBV@IN(Q>G0{UL zBxs}_eEdHvg(XMypie%A)6>!YQtv1BW^a)s?2)K8d%Gi32X_!M>fHRN>+ z#Cf8WK@$AP5?MWk8cg<4r1h=udgh*dTgq;zfQ=^#ex5ye9c$8MQY!H|=D^iaMfO+! z!P6|I58sQ@A+zj@9-m?3g4Z@m?eWE(?eL|YYm;jxS(6p6A8cHLfR)MZc{gR>VI8sI z^x*E@=$FS#8o-YJ^}MUGlzB*5gaicr71_PDBh=E-q?_+W=P}chtex}Ko1)s9l75wG zx}u}4$BiH}eS`&(c&66Aw}iXV7W$VV)h$McY*~If^}Uyo8Pf6ep2bI)DT>R75!p2II|%8Cp&y76kN_u8$b@5}hnnp0mVY(gQf z6GZWw)cxkI_N5DlfGq*!)$%g-p7u+ z?k)tR^*Ns)LI)G~f*)ApNZhQx`XphZ74~_SJza@^Ah!VAJ*$!A<}+3GLJKxA7s)J? zqCln~#2SCApcnC72dt;TM=aWZEhhN%o#PmDgX^Xeo{uv@!27O!VlO$;xXx$VPFO_O zg#EuMwF_4yBibLaG1Je6mv({Q8|;bu%g9^{tE%9;yPQ}gq^mx)BuAzB1;tT%hHhv# zkxlBykHu~Wlyn^r2sZU1EhL>-g52bPiHoFVo$3c)vagSO_KpIa(;pxGaI(C}6TdL| zBu|;7M~wuaEM~vl&FB90dR~pMpJ8UFFmny_H(O%Y8^KwqkA=yAwaIf_< z%^G0oFAhi7c~wrH+$Y@nM7oqymXVmaDtLPSH00R}a;powkbqu`Hj8rOQY~-pDyu}J z#5cY0S6L;*?YK$NAG4I`<>()bQ)CR@`#3m6qu9z`qJ?YgF2tL3yS_CNW!$mi{L@vy ziGO{fHAb&Sm=#Q#pEi95Y~mIDQ_KPQ*ONi^fuMu($>CCwq6<#2{5KzS>K=O%>15Q+ zr_EQd>_>&_ys2~b@_Jq^? z`1VoP3pTmHk@DN#A1V0L%MWyK#GLHx)G;nP6qu`e-LHmzXjQeujVx^5f8W$lUltfO ztf8Vbw-kI>wY%%p>RoE`doiLTBgh08IcF_@e57jBi}?KxA95h zu7c1;chNDe_VEF4l2exSoYI%o}fzk`5|tn_3saYX=+PX>j=T#tZ)uWHJ^9XL&v zA-SCXA%YS&>A@iH-cb(c<#cvc>3wshj9W=<_sXG|=z97P6p10mG8Aqqfy>bU^+dbt3s6PikErd=j?3J%In_JZl5cS77mY>}Qp9$j z6fk*um}6(VU9$J|X95P)K*;o$PZ{H~Mig}R^ikir@jhWJDmHe|y*Ybw>#*Eu&im&a z)Xe<$@K!Mh! zTD_#MB6WNbD+luRax8Ojz=*N2QAWtSEBA=g?kYB*g4JgsQ>JfP#&N3_4+Nin$9Xno z;~H;FL{q;JE)&s8iF^M>kan!0q$<4}-%@vV*VW5ZF|azUuwBGE53N$%O>v8cTk-N# zzYV9pXT|kB4}HvFh3LF(S8i5Kp>DdgK{2?uD6gn!d;{E7eoGLC%u6U zFA2J22@5uMJ>k*@t3FoG@PEDfxH-{wluHQbLHa`MAU0;TiTKcJL*@_oEudm~ zi7w4skd)8%M;l?9DL^91&=6em?uB^6-e=b-NvwR9HvGA4hH=aI>>u5^f%OC3&fz>r z&)WQxB>1+Cm?JM49@k+Hn)?8f&*(f4oW~?}X5$bkE+8THoc%E!Hnj^gmm3 z8!pn8*VeW&D|DJWm|I#(?V}1&Fq*2XJl$I$#2WR#xFT?p>>@t9*;W}ZUzS+G2&MN;JZZ<{=LF9m*Fw7t&)o~|EBnb9{A<$FhhgR zF1oZjAw_Wb{T{ELQ4Plp?<`c^1Rqo<$il5WVVC%k4>{-b$=)Zl#Lni^)U4lBTzyk} zcAff-u|rD*ZvfAYNI_g_s1PafkEmALgG)v=!XF|@K1-?gynBzQ&2kNgmGrvVaUS|Q zL!sT{>biG}jyJfjUH^VHaF$(QNS?W~;K|rri*e=qMK_b`)vF+=zg=f77z&-3Gx^o| zDJzRMrk*9OE>ZA#`tX*$oQq}B$l8YTXq_?9DER@rgr+!z-;ivli66LjGKK5cSkkab zf&+{>>Q1%uG48?he=JFGknh{Ka!dT#eZr9|j#EOq{LXKq0w4-loW6Le{8090Ups0n z%`;0bX}q0&zHieuJbxLIujaF7qH80?SBxfqosF-ns_V-`ARJie+h}I}vbPfs7tMLE zK9ch~jDOi^t`Cx?fWkOT+jjY{pIQ4CGA)o`|@aR%V(M3ueqaid46YnMq;kqVhHzuIHdN<)2pqRKO?Q-Q=L=X=`mi2)&BC6sqvgjdKb-wAhZ8>~ zOx&&OFex=E)q0_z@MXA87m|LC>XY6VA^o~IHc8yjpV-k2AL+l;`@ZtSmFB^>TcTf(Y6$!v4X* z8&Bok2>51PMT#2^*z{OE2Ae4S_h<9Avw#CJ{W|Kj-`AayU-~X1PHf7J@Td8_N&^sAYzr8xhl&JP@Ob*^&5NZp<-`^I;P ziPj&@ol(pEro^HqS7#kRRN837q%=kwvA@8WipUZDC!_b}eFD|8a~^FmilXfUv|(7I zmTA%9q|KD>^{;7VAC?-Qfm9QY^NZ5&m!Y+_bo1$lkK~HFJDV z(|{P~eaukUAuFYl0V=XUJ<7wGVgwe>L6;^(JynJm}d|8#SlZ!u$+w{XZe zgIbZxbKF$EoOc+arK=*%Zl*FcZ~6HZ%{4l&l2vRBF1dGKBZ;7TNZvaqqQ(<{!CXBy zUgP`d=-|L7b^rl9fui}LEX{VOb)|{Ns8hW@NQ#9G`0T51Rd0mS*J^6`&>5wi5RLW+tcsz1QF<0@i%$XLuaPom zzb3;pgF>ypFyxZ^Rgx6n)fGLbHlCU(A@Qi`;}KHflj>Y7dN!uHg5pJB>NP(C!}zxd z35`7Xv2Of2^WFY*B78PzilwF&TW)kN{Dj<1&aAMz`=;pWc60QCO;KY2*EivMb&+^| zKLUJFM@lZyldG=;48Pj*J!KH`q26lROY7VPk!l_$TWt2DB_O)$_*iiBV$Zed$eR_6 zZe8B@eA8-7;j{ngg{O*?)RX3m)~WDu4_CEj@J;NGHylQ*+-_m@oo_Hi@;l#KSs_l@ z%w&SIYQGt>UZ|Rx`oz&eL1@+dhAA&Uf3a!Bqx|J;^;6mJgS!i|#A1FIAJ#$6oyGM; zNoC|K;-?Nc;g-gJJiug1zbbHIog8du#T=~k7+<*uaTa=zI(Y4Vj8R^6@KfTWp<4_^ zx)49~%

    i*{l7_TpjD!M5 z@B)`8IG}aqQNMlbhSOcbt?Y)vKt#87U^-UQRZ0j1QZuOlSd*fSbcjN(sn1gwCS`@5 zm`-tlz|pz+zYgVHpZP+ZA?{M1rN;f6NvG#?dXW=!(N4q^SSk&?sUki%a+_-?UfE2K zea%W29hlo_)IKm+f-x08ZvMz#mi*yE%Nkqb+qQwDYNn>6t&8meredi|k+WZ!xa7h_ zuO_w{l4yJ2lEb$txZmbdp2&un`g?qxqoeF`@OROVPg7J($mtrkn;;T?sZ?Fvc+frr zYqWAPJ8GZN>%obk>nN$K+5mS;@uZL!Obdo!j?0YOet%5uY;clpW!m1}p65klH3Q?g z*OuR^mF0Fp80))LOAmhjxv%9%zKgkqy44R~#WBT8W7BWEyuLhA?4Jbgk$)H#R8ZU~ zdher}va$m3R8}i1$YasNb<~F(V&c83iLI8o0}1qw_gsy~@tIunA*)4S;@GSc7I0Pf zdF@BX=(SCGZmfZZjY4MP4LR0=F1gDt=(+hI|wulNC{FaUIVnW zQ9aXT9_Gf3g-Myf;F~jUx+?JwJ+@Ae+1oip$Ds;5kP8IkS+5SA^Y} zuG|wL6XFiSB(Te6rv1gW^f^{P@p+U`$+GHm7Tv2OZ&g*sj(6G5pD-O%IUIiwwL=TKxAQ~PVE+O$G$$uG$iLe@zNLb>WuhsjP==SF+ZH7 z;KK{K5>-w6BEK{pC#vHeYT=80wJGpV{N$q>yoDN5gcxH>?LRWq#F*^A9$P*qM`1pS zgi952qQBY-NUd%LQ?DtK#(WhxL0|gVAlgZAF+IrSw%OYrMK1fy*m&NucifFxzo|iX z;{32RDx<1$%oe1sugZ3J^U#KUNgWegjWe?!Dl03MCjdIw7~We8U0~AO4ZFp*IK(%- z-hV)wZLZA2$Iabd^Lg04dNB=FL{>1(|CcS9d+^t+hZcZWlj7+d!gKT!`pXw5dZ8Q9tpSCz8Fm8{6#&PP1JJio z-E*MG58AbmqM*0S$G7)+CM|;5(0weormGWDk!o?WT3u|^|1BPH)GSM8A*`W zF#Zbv%kNl)G_vU=IePENf6@tE8!pXRCV#jf+Eey9o&ljRgKWOzpBJgb-?AyaFR>T0 zYIP%4rN1PSg&?iG@P`+iu;GPYZ}s4H8JwUqj_JASKI;IQ>Xd$~on&4Fn>b9^b6o@X zib*uo>TeP zgJ!-sJ2iR=L398-cT!~kUt)0uzM@)A6yMKz{)-I zvkMLCtEzieV2!1V(;23;;K%bx`t-eadHm~FP3K&AxLm_@jr)oBoO@A0J~C3r zqdmcL?>NZ;^PkJ6SMz#FPI9u{;GmkvsO3gt%GRx5e9BKH#;ro@X&_t1x&Op{)N*f8 zJ~n>K*TG|uBSvT)pWW$av=%dqKSEDW?Mq#yjo?%c6P}3cW%v5VR?(A^2?F%I$ zx5ggZMt0f)y5irJpD6CM;hY$#{^1S#p<{Ton3|%UDn*-{?3msW!yrOp_)_?9TiPqyh;Pn_mIjoA3YkaC@VXmD`1^S+{M zai_@qie=h@Kc)ZVgt=?aw3drQe~}`p z<5er5kI3dSZI9Thh(axd-fU)MrhnVj1OQW0&(+Jb>`9Cyzl@+b02=1m;@$~0_r7Pu zWArpIskQ7Lzu!yBVDyd=$Ai?0f)e5k0WDd`l=bj~=C*-AONKoCr=}%y+g&302qz}6 zTju7oYqrSK(C&7<&oUcUZCI1;Ou11qbKlS3nQh)s4&C8tqHj(V(CyaN&=NP0r;hlf zB-erA(J)W+wCUQ$<=^P*Kfjo5aS2Yfil~;=p#3LqBsuORjWO3-35#m>T>YskMYj_M zAU_mBtRC^K=(x{9w8qSgO|$Wk-)Z&1u-)h#?V`LqvrnHT<@o1+xK}4|*k}yyj&fuY zzaMH&neG?;wN0%cwqS-Q{Nq(B!ReK~Voifcok+9<>DZnt9$1|DkdF>JGpvUZirX6p z=cj&Rw-)_dVYFe|jn>#f*x20MyskdUfuB<@$uKbJ``}qYQG$ADN%5p!dLRRYpq_YG zO)f4jcFuJp5Uh5ngr=0iy4H`+#OaxBaTK~|vi-m-Yq4A5NZR5BG1zSHwM??u=G#8H zbMty^cqpJE7^6tns;WJH+c(Q!3}bPp&&lSuVEe^Az25)M}K|(&#ykYNm1SNdFd=MZ>rU} zUFJ@7Gl#_h-E&O$|JeEpsH)noTMz_MLO|&dkdp2Ol}189y1Vnxbx@HG>F$#5?rxCo z?(RBp4tL}G`rrG1-`#`f90m@@fPJ24t-0o$Yi(}0o8<&4ZFNS$+D*fm~ z*28Wv{^1qVJ4WNp{7HE$YMJD@BF`n~hwq5r+pK{bGB>AgZ-4&GuY-lS26!Ts2=qck zQE~iQ!JR%-Ufzynl7oXKuZLac?8S5D24-5?SI^}&72176W?#L+QBct#jU-4j+5XKg zBQ?-J(`ZEZ_5B-TU`FutHz3{KpLDveH`jPF+&c-jH1BvEHSb^FUqhW|Drp;(Tq4Fd z_2()hOJ{juu!(Q?z~^_`e8YIS9Q*V4Dx^{Ci9b+@hlGS^L1r&W-o5mf@&DkVIo+N= z#x_O~w!i1}pv^&qet3mPPJXtI`8@H}G{<>Y%=4r8kvP@ z$p3$k2Jo!}A3ai|Jk>5T~wr&>8`d*%n#01+;&*iRP(60b#GT>Jh1_!O~uf}g(6Sux$+;e zI-Vh)80$;7e;{OM8}UOn6zMg}zBL|V*Jv@~cKD)i`gc&-?snno)y!vByY5a-yKFaI z)6y}8nLikIOXDzVKWP=ky^mm%70CX?vEVXLWI0z(S$>~bP@;dvA})Se_Xvn16LHnN z&QqDzZD(AMet=IV8*d9WT2geG{pSyjm%}OQPU|i3xtye>&5!z6AjOUM9wc4|b}>b& zA4Ekdef5|fdS6nJaDLq{u8&~QsIfagwhp@xI`M|qonI}B#>fe6Ykr)kuAru*Iy*Zb zIlT{JI^9dOQIMCHR8YXerY7nSX{ig167(dW=iuZ#I|2)>EZeknY!zu}JY_&5;Qray zLo`H*tK~nvzI$4>*Uz)CI#ANQb$GqBUSP8&`YqCulkhtdy5V4RW-TOeKvM3L#kK0u zQPtzwDsR9UOzi;(DxQ1>0AzWJg_6@*!0qD4qvEqhkqP^**>cC--lFcjxu4jy7bEfO z&`Nxs5?N8yap^Qad^Zk&GITx<{n+ls$&*!z`X(8Tb}dwbU-^ZB{8x@F68RLDj*bli zz5r1qBX7o2Fl8LM5=22J7~1LMg0;48%X@t^f(#{#OxhDOwqo3#Uy!O+;=uB^J1K{+ zwZs`)Pf8MEj0~r>b2(Hl6hM9Pz(QA~GY}J~W=Wg+!4=B;B)xlyF;9k!?S0&v$&keO zhRqQoz5}wc^&VZetD|Y*LVWLOJtLPu+}OoHK)noN*nBm`iCv(g#*NA$LpBvNxmu}F zI**FpE8S{PLz61~??yIc`ftQk217xI+3&q!^kO6QE`U|U2YmO;>Zy?~7BE|W%g9d? z9g7>Iu=r}NyoU4i)F|^ef9h~Dx1-b-Zv`0{hUGz>)^KbLo5|~n_*8KQQl}lVx0IBQ z^%#jmVz#jX(<99%7&$4nPvY@+1@c|5l9=lDmv+A>sfbr`ad4EGUz#fyX%8ipG_SSY z<*>b>qbqMNFOMjiSC^Y9E-K2duEz0BNJwCu4%bn|Jkl2)9JFR zP`#;ss2;A`dcOOdskt+k&G@YU#YkjQ(nO}gWHd-sMQ3Dj{Mf<~iU364-qSc93r?=( zhNB$*zg_?r;Rblk26u+X7;+F=U$0K$b|M$PDM(AZ;JV!ujL%oxV_C%aK4ddJ#L` zhI@`vHJbwL!%1f?AWu_S&`T)g_XMTg3I_^7}fuYn=!17trdUM*c;3gu_*YZA{SKpaRzh^-^ z((L1JOR5q#!9+Ual}cAhdyIBtJ15q5xghvXzCu(fhw-Rri6WuS`vs|YiBAweHh{fk z-dH9~up_H!sEcQehxQojsRqU(=H|=+DE`lN5OR?h`tSFDe-smhF149i6@BmS%42l- zfzgeE?;X&-r-;k~66Uy_^b*w4>8dyntUD{MTw-uzV!n;btUHDwn_k^fSfzS!W-56r z*h!+$DHjEr^V#)BF&?hRZo`sPmRuq~(;!y*+}z)$`?;PmVK_G|iGGT)1sSo*lJjVAm4^$?F{#Qyj*hsVo}Qm4KtxrE=757Mrz2Rn(L^;J<21zxTeRNd(xhcxw(VQ3DxJPxL9t!pY^fT{qc8Jp{rBNuoyC7 zqzb)tG1&cY3Lv$T01-`H+w0J=xasUU92Jp0Gh=MfET}p70v=Dm{FOKf3#K=;J8a)x zKp-5Tu*BSWV>KPfB17XOTwR~a3Ek0yT3}RTxqu4>KXqiSGE#2OX{fD|A=MWs~aJ{ON!# z8DC*6Zgu@HFo>M0Vd8OhT>y|IfH%m?Vf(JRwx+;Wu1*{ z3U~x55o2S$kZm200D~~Wz;FsN2W}_llBbU~$6}cU-e+}nH$Q+F`-IE1=P(!?>=oYg z0%x%2_5`545Um@B@5!kBm%6p;|?t=QZ*8DyOLE4^8*WO`nfss6ju# z_v^2*A|rTFs;-SM9BUZy$u=`GPC-A~BuR46kXVSfsx@AnKXiq=s$ zW+Jmha&IWKrY+Lxf<#=G;o%@rlLn2j*JAPqD(ytDC zPb00DoN8lFhmt^b347^hNSUFM{O^|TT@wB8Ee&v{+PpS+iVw{=<37vHEzz02RLta6 zlyA+>{1J?WZnblj$GZ=idV<`jWfOQg-o4LjPXAh`10LGQ3=6G1tS4ES z$qa4Z+;iieREpK=2eR4c&#JG?8Xi`~$X}hn>c)2dsy`_3 zy-=|J;La#q*5%;s_JiCX6+FT&iE zO194Jq>ACUY;4~PN?OY1dscRPNQ~OakP$xrfsXoy$z}JOyDe@12zk97sNT$cSM*Pb4tTIp2 z<2D+A#ZSF~NSq8#8g9{c#n1d6;J4U>^9Y%odWzHei5D~B5TC#cCZ0;>8j!gBCIi~X z0Kety*P9-YKJg@velx2pD{J$$VLq?v-8f-CG=tvX>6S|qSlSnmf(JuLD#?LuBDnE{ zC_4Hz+(F9&JPV546V+N<=gVd0_c%+FNE>S`s^Y&F{ZKMd#})4~gNWrZ8fh#DwKU$aGc&^u5)9qB0|0Z|0@p`JI_Bf?MBV;uwtXUcACFIr8qT%S! z1)Qeez`0R#;!R#~8juM;$s)$W#;&{V-p`zyD$C6^ge9GB$k-$M(o^4%{{Zh@#8r2?=kFm+qCJAJcbizA-T}96A-b_m`3h&soYzNcgLxBYhVj5W?x9VPax3U-Vz? zC{vw-9TnOcbeGys?lDd~@3bv8SU>p+XE9Y|a2pt1s9BYeJrJun)_seLB+N~;NKmgx zr&1E2z68E^8G}>{pq!ncVEdoDD9{pqv=#uY^;%VZ~QSW7k=CQ9GkIQ zkLSNdG#Zvhs&+E&kQoZ?bVz#rZF-)%_(BA%w!_3pAEEDql+LDw$1P ziw@?wLS1svz%+xg^Y3U1FkZ4d3%T_pe$7!fvFl;d@`_IZmaM(y)paJ>#1tGfBE!{Ysrj(%? zuHY`c$&K$#jAW_=EAVt3GrYq|5@rX@Q)9n%!W zFW&3nyY$Y-H;S^d))Qw1HjRD2n%#8*#7BXAM>+qXAd8B{+vJPX6xptTE|&hGfiU&h zm?*HxJJcR*> zSK&M*s;+?(r#P{zNCWix;vbfVE^NM|s0Nzy(6A{cJ)V_b_BBipLQ3j+(W30>*^CHt zIZjopwnSlSy5WaAZo1=qT-Qt2aDK#`EanS-B(C55NE*X{GRYu;YMC((_q8SBqj%u6 z=0V)bO6KkRyv)AUmb%p%pLQ}pX+>#`1sR`jCe0pREkAf8)LqpR)_c9LU+FI>Uca2y zNpEZn4imih23FdT7XmVxF(j4L@>(DQaJ1}>ldgpFS$6>b7PExG6oJUu3X|$R_eC48 zPm+>lPoe-vZ>w?D7*i9|{MmE9V(t?M)OkGyJ~A`~*XJ^_ug~q@%_>id z7%(r~`Y!6iku*eql>~YqB-VbyP%cinKg)h{m%dL&0wmb7IuEL^p9S1OE@S90TLGmI z4VnU-PsuI*BGYhbCh0mtPLGAVsp}At5Px)FH{8H;i#*HcFQ50&h|s>up?an7D$meI zf~?%3t4fMthfasn#Qo?ye!RR&-L6z3|94g_GiS^wgv5UarvM>Y-tL~zl z&h;c++^!M?o>T;2-ZoR1fT;46H|I1T5&H1M<_~`8;PPqL9WT*->v#06ugDJ{Q=_6d zr!ffleeOtId?Mv|LO#<}&Q}Hb-+wVO$~jIC&s$JcliqJ-#PZxJq>OiEQr^%sd`1PHIArb;r?oG|sy zdrlj8ERjr~0}l6d20)#E7T>nSxQjfbj|WhUVmaL`cDh)?kph6Hk>!Ow7d-ZN03p5r z6{sfZbWQam5j-hF`;7f>BnqD?cl={f|7WxOdChV^;w}~?AR-a6 zdif|YT5Myiw~DKby+Q>&6nX&NQyczd#B!Fax41fim7W4Ng2&(!q4oyE zHdKJw9nBOwoN68xy59CUSrso_u4NgkHXDeM-5-#Uqvm2_8grU0VKRO=UFTiY`BnlA zm|f-yavbqQRw@jYH#WZTfn=<$In@j>(d;OPpo{mAiRgG;a*UI@Fqd26A(4}q(Y3;B%YdJ)k?3^4ihV89Q=NTa;AvfrWo-p4*3-zCJbyv%I8Kff( zIj~)qsj&x^Q{M69wB`t~mX9Fc(FLQxjW_Rta6AV9M;Q$*BRLCgJPZn9TRjN?5T!We zN>XywW~8ZiFPe^qfr)~HGTLsvyN0K@OMi8+V)${9;h{#vCVtl|i%3e6_P8HrAxtEo z2*bw0;`0>jAr|@(ATF)1cqPVZsXDSHLs-U_ly!ADu+k>Xy^|)a{#2)XEbZ%em($H@ zwZ;>TsbURbS2bFoRzSsL_qQ{+w%~f1$FSag*rV~_m3mgr%4wgeD*7`Y0*$-9stn|whvQmQ0Lb{UNeA<`e)B95Z zO>R>>1AB^zM4`}FYY92{V|oO(-iF_QiN#nTr-HVEZH#U2mclfams@=$&w2Dx5pzP! zZ?~>TcS(-;n}uq?QNlAmK}!prXNldI+m%=Ln?llnMn>>DZR7gR_39Qk1CqqO>9e>L z2H3YkmlwOA#%czdIeBJCwhRvbvV9XaKh)WQZZSE+E)#4$i1_08YoD3Bx;sbD8lI7{ z2r>(wIjceo8&4xpUIGzozNntqN!)LLdoYCLcp4WLxL*>G!mq8f{M)=C^huPP zn-?+~5nffJ{-l(-g+=BQI49LAV>CdAleePqMcW_sdW_Cj?70J7k0!N~0CA_e=|d;b zN}Hd9g$F>~q_qjpY1Y`qzMK^7^Q>o20R$Sr8X1f~@5;QBqKk)wOyVI?6DI5q$;x6T zGa|>Pk`C^30gMzwLtgeTg8GJ-<_zv6BxN^%oWx?N`>;p=sDB@+04hRNL%k<;%QB;x zM}l4`dF~QB6}2RC0R5oH3tw<8+35$h;|DDenMKetS+2dTO>B7&JA15xd`o!cP1#J* z(h}n~@(5fgY0AfM1Kmjsn}E9{Cri-VEP=)S(7M1njqGLCui^mgYsvMWg(8+XO}hV+ zgiK$#GyLxy7`XUxyIH{4-h6$i`Lw2_o89VEce#Q_u8xJ z?IS0kKK<>}m_Q}C@VPzmyhh;|ql=y247os$Y<7JE(t%v2BlhG}makubS96Bl?D>@9 zWYQ{pynalDdQu z6YvLDQPEgPs`D^U<4r#uJ3IT6QU+?j`J>v%1~8cK^z?LMa`JR1QVvkBpS+i~W_(No zxvBQ{6Wolkbmp$3Yh8eLlMvYd4hzd8n3RtbX@s%5UL6F8;KpLS)I?nIfa8aL?5fX% zt+#JzGfpz{8Pa!;(@o7shr{`Hd{Wfl7J~-GfDLThDo2LrYi%tzpkJT2X!QcT>Zp0c z)|N3~zJA$oo(Lcxd2y1q10Ef*IqipOji~5Y&=QZyc#Dn@r{&;Qyh*CTyM8%qBDai;Qy(Bwnd)si68PMjLQmD3^fDRiGUg&ye+!uAHhnAX1RLb5`Q2fGAx>}j@q-*Lq&W5sr z=6(ismY zXoxSSSzkE(R^Z)%lcEKlheY!^tupF$zw}2WGWYPN*jU2>_x>peG@P9Lz@<~lk~($z z{3H!@#Ix;n99>K?&`iok&k$4ltfD=Vw|Czrt$0?lA{PhTI=#4=#2Ovq*INR4=6G0K1DMLOmd8Q4;9-pf2UQ@yUHqomdvZ5okzxqdK`D0Kai#Pz`L9u@;$bZfh>(_2&lxJ>6oJ3=AI?g%ftprBwV zVR1vKkkI9{?(!N&Y`JBZ_{Nr@B0!rqy51?OXu`U1(&g%AXUPur{UR-_Z+PLRwLp$x zsGs*thgNyTm!VfRv$d{lj4EoSHq%D}2Xjr-Gn{y+7Xt(9E9t_kJQBM1wPltIjXX1g zwkK~YwzN8R;hpBB2;(r^p7?-@>(>T? ziP`Eq{+!F*B65mMJQjO)4Ne34LEFKz?f?~u@q!l&SfUKJ6Yq}}R0|m4)meIjv zS4IPI)T1%po)?HuqPW;AX5~8)?xoOGI9Fcyu<`DWpS-1Tl^hK&>tUl~`r!iP4k=*} z{-$Gt*_o2CYG#pJ3}j0|YTsF5`GA~}{6)p++#==WbFuGVO$)-|`&iiB?!U0Rowz{1 zaJZh_v}0#%U?Bc7KP%6yjOnCdI}JC6P>Eq0DEa?wT#%4UTjqZKZ#?=pDk;7bm};+3 zL0ielb;f?yO8g>>nS&`b{K^!r8B`on?9N1dEJt@-KfpvhfZq7 z;*LEb?xpJpP_v-e3YjqiUo3sQdc0kCs2@W}1wn>=_NtW6!TV~Cdi^t(QpJ((N zW-YgHuc3&39ewLySJoLDb^<5Lkj3qAGZ3_Sd zeD+Y_oo3K zbyex`@h)IHL{D;94F~v_Mp%uc$;E_7Yw&u44n)L65NmK_Yh`)g_rV2|2*w2&r;0m# z*^n%bu=nkFZ~pO9cvQG722;|LF%@; zpq8};Z^Ml#kP!Gijlg1pmC=DnOib4Hr$1IDHCcGG8wQT-0Q<;1`FpdyDB8DFR4EZq z=!W0*Np?Yt6bJjq!u)8Vt*z5%T(BI#$3l>X;)_$vs^DpdX`u!R@+Z04`PcXt(JpbYW`Cm8SnyKMEfocQ%Tbb^;%W8be-G=u`S zle*PSQ0^E&Kkx>)!_jherysJmA)#k>hT;`RTMuLv}p>ssuc%ppIidnu>5@%BrXd=Y#XZ z(32a4SIP})8lOLi6~-U9u*t{xUs3vXdBapfsy3^(s2TnT+eqvKsC@>~rwoU5F{HQg8~*VhDtitu*>*<{ zEkQ&tg6k}dsW7z0sB59wLq?i+V_t9y27{I@?x@w=pK2!FY2iLYq@kf-1LA#WcXvdz zS&wyv<4%d)orfSgDbL3bdYE-}JR6t0pmyf;lr=;1qkbOqk<=8Az!t&tYu&rE0me<3 zJ9uH!5k5b^fXDuVMoDQBmFRbB;ou<9#h^4|Q`Yf8zU+I#90BC=@Kfr-0?9)?&_mrv zuqe~mV#xuQmuH45kC!Y_^6D9)YKt{P5N=CYX6-YRfJkF!Y{|a9tlV5Sv$HS8!@Q}L zl@~{hRWeM?Cq&jYgx*ha!SD@DpyLmsB5sLR8Z`j7h|p?uZtS~R@lEa)0lvSVjz@iG z#Wel<8WwJG`SZE@vQG0VT{*dIx$5KvdcHa}&WucQzNX`rmU}9{vmjpfDSb{ht1(q$ zX&&UrzKLDWDrz`(S5JB#)!~8pz`hdmPUq)G#rP381DhSJaY>OP_EBo9lGJUa-o(S; zbJ&uG=}B#ULy{sRgE3yDy-hl}|HoU=%l#vJw<7bJ*h9*yLb_l2Rv#$4s${IZlJ`*& zeqveaEw#QHK8_vyS?R-EK_`149P5I+$uT7~ZUP1wEamt{2d>MY|hqjN+tp_ z##s|zvs})itZ`1VbYcigrkLGPR3Ae(39kot)*@GM%lnwPpRIB7nX+!MJU1`4Lnqe5 ztI}ei!XO`;$45n?l1XXL>Qk(5h+_OhhBhDq^Ev<-D*mH5iueoSS3Fuo3=S*S=H?(- zO-pvqa<<(_qf9v`s;l6MQXi%b!&%-}X%kFbK}>_mlIHgMvDdETU*E%(EQeJL%gD=M z!0_c^)p%ucbcuL?imFtn3WFr|~GA;&IIQ(Z%+xPrQXzI<~Ld)a;)_;hBb- zc^d_tonyxe@X=lxaEvnXL{RAv*&NcM?L$aXNyS4FJ(aQHpWqG0;QspeH**OtWQT`QKJ_!kPKV2(~rA;n+!*d%n0SFe(HrCwa zPD^X2TVcd%`#bH3QCzlyn6Fx1P5wg*456>TfA7d%M8wqkYK4Yj-86k23^bDwEL!;$ zcXo+I#)r$MTJm|89~#b%vm{FAW-ld46C#;nDjPE6#c>;R;||7sH1xTwoLD^qey*x4C{&WU3nZPxB`^BgPI>gMHz7=f$ z#=wb{nO;>QNL?~Z+N!qPsdnD}SA^MJ{jV0s+~_vA5$(xTc?_HEtf`JfzIQkCb6Cwh zJP6)(-?48Yoen8#DpFdJVT9U(t%1j(@4;DGh+eMCa&>3*`*tx=J{JxB{kGB3Rd}f{ zNk;^nm+b2MADLF3OeGa1`;o;Oc?}JqVeR_vr=<&__}DKDy1y|!G}u(9OKQ%y2-?(cI8?@f7t!sEfQ z`KpSrp;Ft+ORxpJ!*wyV-=hfj#Hmng31lG8Rk70YWTxLW4Mz}{R7+eH63fKYaC`1q zeqcB^wwo9!sqk^ZtdRSQ!jF7{A#6w<_#u~7I3eTS|x6n>|2E11Gj|L02^NGu{-w9wJ0l8^_OG*7pspm z{)5$Z+r}GE5LZHfh{sJarI78)!`+{j^D7e-uD*{?48xc{n~_4Uk*jeAO_DD%0e!__ z=(?*mdswve{6Hx-@JTq-82F;g?h#kT5@}GFR-_7 zx7d{Bf|QpXir;zAFB?-!kgTONyIQqFx#eSY7^mjLu9$U5cy|;B-#h#N!N1llU7t6h>G8^~BS(U`}V5iX)-EgpXhaS+`7|y1fH^L))W!B!rG^T(? zWa6ig1bvvU{u@VY#%=olcbbu?x$VgIRCBD2ISfVO#GN{?xPEan^i2~kXRFI@o}DnP z(DwJnB?!nqs_y#|^i+$%Z=Sr=1GK>sCg>T&3G~SPkehI}ERPt3!BXD8Y4wIjh-ckw zL?6+rJ`gTGHuN3?x`z2QGLpnV+rWr3+?0-8hm#vp($%la{1c0m0TN6AiA_sakT$cL z)~O_BXUD=(<@jHv8f!psX-ZCDhsmISTQI3WVZ#8>IR4TgAk9XB-ZRpi=9k_2=?^AN zO1KI3+nY{#Ve5}?74P0gzA{3Yhmem|LyVc+2MBI%OesmXRo2e$I_kZA`Xsa!-eQBW ze#_B6e(sM~ed?q3`Tt&7^CAf$_vdq8rEfZ%7PN&h80pr&wV@;ly@B`E(TN&Z^PFt+ z&ej2|c8)L(9&P3SA%r(9&yE^wKqo8kaK-gob51=yB0ak7_<4X0Jnc>DcVvv;Ef3!4 zhXcSq+6z;8qRWgYAtTeV`A*<=jq*U63R?$q7R`T}E3Vey#8IG9w6TykUf)2Exx2cz zPe@}|XB%BlV;}SRz;@*vGM9v{SM?H`c*qsI=QkI1WaY#L8+lfTC99(|$_Jdt@aBL~ zRN0X1+G-Sx)fb57d?kA9`IgOwLgP=saVOVs~ZOX zl)m8=-qZV=sZ0VG@AVb1#&d=&okRN!_4i!IU5=Za;Z&O)B>fPg08vQJ(~}sk!#AXL z`<(WD9&)|y5r2voL^5H)I>mLX1Sp=vU&7vd=l8!0B$5pzmepj$-FzKwHC(1npOusI z)2s&QH~ICBDKkAC-W$ch*MK>RxQ!(@aa6aJ1ZZdsR&|P+Qc#$dt{5SWsS*m&&$qfN zpH~u(n)RNvd^=}OF8HzL%)xiowB3^3;F(RcQkW5oC?;+?Tz2H-!TEZj#aiSV0q5)K zpE`%#q}|h@eWq_H`}@->fsXqOiQtJ#`hQXh`55+&BEdgND+(E@_q* z+3PQ%pfE1+=@a$4cliyU_OW6MUgdUt5Ee#2Ktg>>$x+n-GB8+=^MnyCd0tzE5(##8 zqwV7h>8;TMrargwoGoLiPg1l_+_ba|nZSY0tE(I0K{*9{HcqT#3VoIHlAk`Iph(Us zYdPi*;I!&`-#lZ(F2@1_`RTAW?$gN-y+ywf(zM3W4uBB>7#IkZ5C}P2{|l9}A3n1# zyDiSs0DNYA2E35^&4P-17+m({P$6xh{_d)Mphbe|b48lDTr7&g;EEoW2A$^!3K=ZB z`v1eFU|yId{2K@VeRJT;gimR4gUcjck^+jA=^B-j1BilkQXG0~6R6z9M1_*@`QD7y zSZ~ zZ4NH33b#oqxL`2~HseA4(F|ufpndG*4*G~~N?NW+oepNE^c&iAbr*Qn>u%OQ#k(yz zNK=iYOhbUDvUCq8&%@u0#g=RgsA$e^HG}UGb;>Uz8Q?TQhnJf6ec5eRBlm}rG4yI8 zz>K4K(Db#<3ttWBR-5?FeC{#I^m47908`@$JzupSiHel@yAHpwjq3SkIei6%M2;s( zLMDvI&3Bw|CCv~Up!P_jy#ETP6s;5$Rd36k{E9CLn4pMdY7p9GNyfnNmg@( z1*^N~v&HyMOZK1mxP6s^eJ-Bx%G)aC14_74o-Q6k(znJK(mQ{{wRChUI0_iZ0yj3!);l=32lNF^ z2LbV>`vU*|y5$ADYPF?g1H2S4MJPSJ4Bi`)LM%KYA#i#7xE(WzD0QT#NvPQmZGSq& zR{G6L-SKWT%emUGX5+^8%g~liQ}$}!>iqm~V`Erw1bg!sS-%i_+gW#yV0nuAfy)5|tK9m2f*Wm5jYT^ubj~QEF3>Qh5 zpA6x&qKe8VOH0i}kVw|G*_8_o9bN9sYF6z`K!@75hQ7ruVBmx)D{$(p@BuC)JUnH} z_;->+ivgJw=3wt9s($@;Qy;BtM;{jVr>R2kMKh6Wrscl($ocej)(*O0Q4GZeOUawd zc^KlTp+wRa&D)6~(*TJlBQ69b5sgliM)8V z`=bYL&#}Q9?llW`{T2iJT;7tAxhv;)vn~tgZ05ig%*cfE4+t=GJj$OW1)a2d0W|{4 zC`&LNN1&i5WX-;ArpbaD7?b8r;fG;&tyOcrp_3}0NAt>?gZ$fv@4ls=Z6}~PIFZZB z5E87W$FGjLi$2Lw^$M4d#<7mZiPx^KUjt3+E~?KIh_vwl1#(fzUS4s~*+nZ|#8sXU zV%ROtEJ#NZgpyCt#J!(za*LpcqJQfUf)o~p@EWbLrsP#7yst@T1c6mo;md4J(YW=1 zu)#KcbLjFdn`q&rnA^cK^1(8^QHu-;^Tfsj+5!^;`Pcg|^0^geCAcXhGU>(a*D~?q zF?)g=4UuxY^hYn>{Y_EpJ2eu2#qNLbQI@#t1<;qk|D_{kOpNpO)cLvS(|dC-M!4lf z^Yy01=*F7dz>GcP=F3#!MmK1hb@4yra)w3rxjb;l*)4DUWrr^Bpur>pz8f2_-o5Lm zwd0+waK{DQNH&fhzz`z~<&r0@rtGYq-O_MRV75!J#b#i5&64YOk?vi?azpY!i-Ty8 z-SYjEv&)GyMybo_9bBPm^Fbvdjh5T&rY5ieMVbY?blV1-KducD^gN$Sa@TzjgxeZ! z^0!&O2fuww^|a>JLy+Wtu|%!>X6BTL-^E+2!HHSF^B3nd5r-QppR+ZxZilZU03>#e zfVqo|Dm>ZQjDg9NuW(+E&&p~WDTvhp&?6=oQyU0z^6|{4XdFcN;|!8e_PiGVgGr-%$F}RA7rqHV78h?J*vS- z<=7c`7GWm#vg8Pg`u?n`+`5W?VQhWae@03-%-Dk9pk@~ypn?Rb`o_DheY_Ac>xO;n ztD|{RBIn`SGJe~K5p}IcJVGnkPCuFTz0P^x!h61F1q^|pz&nZx+3&F1p zyLn>R3pC~t|0&0ArLkLf%V+`HJ#8F7lyz>-uY<4kCNt(K9dAjphYFF z#e3qwK;kwhef=j79!F}y-B&i`x6@$l%{p9d)Lr+rFmM`psVp%?=pkWXe?FF)#4~HC zN~mS)2gn$-T~t$vhdX?ZceD)*Xn>4{&6a^w5)Dw15ai|MJ4M8?adCToen0^FicuAF zrQ39OZid`|mhk(1p_20Z%xKHSX5t4st{ZU?k>4#kBnXgeld0g{!4#f~p{i!*o@79~ zpqWW=UVXX%YdWsx*$!<0w;naQe?R2e9$71%w|P-La$!*_&~gW*pw~E+msnnOURpW= z*)?u!djt$=R3pwKKrYv(j$zA^li0&mvQ??jGnK}>whUeO%W{k|Rr*C$fbvhW9vT|5 zyxXV%*Z88@2;BT)5X%h5XES*mS@@*Xay9}Rh?`ms1T}Z6rae0>29i=zNC2i-Mq42+ zGZ{HrSuZR+Q0|CanJI%VUt7OGqVXiaiq@-0j^UM?0vOlYZNKa49j*;{JrWZT9IFEIoW4QazJQPw6KR#6UXr`Sow`B$yS7(SFDyNZ+6O!Gt>A_>8G z-r?2U3I>HVAM+fkGJmLA@S3r7Z(y(>|8Smcg`DSvBbfcdxndzSurcMGRZ z^-9Rep@J)}y$@<*j+br_c>6YUb=?=cxXkU4H;_0K2MT!KZ8+Z30_K^~{II;dJhZFL zjSWOnfIw5%D#-*`0gVfMI`jx_?GUzOtS5LkZ>Qt8~N7$(HaU{B;t42@iBNuN2k`JN3qXkX}AU)Nyzr2 zb#+QVDYH{jRMeS|6y*-5)L<(?PYuBg`_z+n&a zAT7~G8xa`!6;9!D@)fzavIe|HGgc|c5q&I zo#HO*Qel=?P$)d2)0@Pq(whVbi9ZibARIF>^$<60cMzF%4PVy7rV4C44=x)B$`!z2 zYIBmYvLeis12XwoGZgtz`y>0ROHOWoWmhLl z$*_Un=o-LKhc@9hntqsX3p=$t?d+lctf+|g-bl$P4E=MtYSDt* z{Iy)|B9MFBF7N;phU$HGR_-({{Rw*D-Wh>K4YW(WrOtI|QpMb5OT>}JpGhexI<;iD_E#di!4{`HB#pPD>8`=XXxrK-4waQ9s|VYG@G>JVmT98Rpl63v*bkKIFSOvZ^_6uNZkr zhz)AD8)-Tr4}3G>Wg&s_q`SZ8{4F(vQUc*Dha$0fB!Hcznk4p-v z|5aEBcv2;}@=9#dIyc)_Z50k|71r!m&mpqhOQy^}qoO3#)d}LA2-TbjCHo|w7l*$= zus!|l@NR*GAkp*HWWCuL1jRX6LDG{AO>{Df%gxpu3SfD%cFW%uWv`VLpX}PLOXS@m zRZ^ecbHf2-3on$TRBChu{kL%{uPKTM4MCJ=O-k+dVvJg z;Q$?!SJ$V>(J$-dfoPnW@|TDRPm%pk#NN~i%$NKz;(X9u^1|3Ya^>o;7a&zmVa$Zf zDHJg9blnuqJ6AsYeCE~!7=f}UFKdn$0_G2?SXo)K!1JNRWQYF#&%{s(o!WT~3=GPQ z3@bgEdn6?!Og)8L<*t@+XN6!S9$R?%isG0;tDi0`=H!6N%2t>97=kpa8<;DYPHLpa zCc&WT3t)w29l_Q!jHM1;Q&)oyV4}eUIX~^V^<$cyVP!QnH(y&>?VwkyM-A)2CaM5p zU5W<;zxnRa#_?umP2T|jcMG^+K6Go_uP`<4|FHEHP*rwY*PsG|gwhRy64KpaP*NgF zcXu5+Rk}M5aFi4&>F$>9?vn0~^KIVx?|tw8jDa8y;XLQrd#|}HBkFQ}mCay)@^pKeU|YS|o?fK>iaA7l8FiiMcE1JRL1~y&6dA))a z4i9Wxw~{GVVMPBuAO6%EdGX|8qQ;s6$Z?vsPLMl*Roj6#>^g==`+`6z6#6Nh)W zu&KQEcCA_I>i%a?z8@ev&AE1)=4Mv#I-j#v%p7>21qW5v02*im@kjWh{vx$}mHe@2 zwGJItR>;`JHEqxh;Plu^3pcEn*8EOy9z4qxE;BPTr?cg?jl(Um?kCss z*ooa`&QWBa0&SkJ>M5*FIV%K!fb952(@+el^!8NoO*2rKDt`PZI|y%%`v1Xeou$(O zApyLyc+%E}?1bk_1L#rdJ+%!D$#sS&mD3N`_=ymKsIJ>enQTrJA-umo@0Pw*1$XJz z1+ZW$(t><}%im3EeS|Wt7qFbCVH1xMLKKdrsv~acwHpma#$;%RNxyH8@2KX2y1=)qOJEe{G!<8*XuD$s`dDHCVctd>Z=x1a!YK z(&jm=m6~2(5}Z}I2$C6^7SNc_H*`^)p6Hi7>sz6iZ;17z@31nvIk#crfZy>GpGx-b z>E)hct18PF8a{VB+cWO``jTl(11M&m?o4tRA70JhWQi^GgC$e7+YbGnTZnb)@zYr< z`(8|zTw?PGy`tKzimL& zuyyTAS}%{ay{9}Rb*Esl-H+Ma+`8Cc@tj<0&oEW&UsV>VVR<%z(YR=T*aDmDh?6fz zz5)&>=Q}M8>jx5^^SGZW~m*#G@yWJnV2$1zgk9~wu&VX!D1ydCR@GEVu~jfa85lQ z+#6Uqf>aiNHkA0qMuZ{L`Iho|`;UdV{-T65sZb&@cue=io-0(eQR34+(r_&!qnyx&QopOc)NoU}6>uYJN_yXX=FH)zlLu zb4jEG%IH#-uf<+&Y|! ztSjaZLOO2a1`a+m!OTodT325@+Ne2A%2o5BMFa}HWxuTgj17S#m^_$1VjZ>F%bX-o z(ROjAbFhRHf(*juw9_{FMve3BHBN}t?EMCh$AxD-=Ua!fOx)aYd!AS7Aw*m+G8*oX z;8@DUj?{Aw%xsQ~y{X*7C3!FB3^8ZyPqRkLli8^TbG`&V$Au~vY~4!kxPH_TW3@&5 z`4Oi9x-G8?hJXEfE38p}&8dt>E)2s8?|{6AU)hq%ORwNr-+73_m~NvH~n znq=;zczC0kWq#;He!Y&{S8)I|DEBOWUYQU2@f^04?(1+v`K+gonRggSx%0HU$F0v_ zoWZxX=G4ylQLxBOo}}VFA?gw%&`A(_oKprA6w z@uCz3wox@_+xi=a;h>R4*?H5t|L{_M@26u64H_Dnx(}^t4?d`B+CzwYYJJ5o4 z@OJ9%CaZ=J2}KihYg%4@ zCnjW$_G0pbM$6z2@q3@)ngY5i^JeT(WCUI3d3WL!c3v+0;7MG+*uO!Y6?;^;Jk#HQ z`!i2`1}urYRjbS#ehNAK!p(y{623>sV}xEvL6B4gZ$zB2;)#rmY^pEY8uRa|x@1t^ zp9y9`nkM0~#GITP80ft9MtObNN95#sKL(+XXD@@^h4MnPtnQ6XNOXM}eW1E)WX?g9o6#2F=UJS94c7gQ%~+t@YPMR9Eu@zlDIH zFdBY#?1sIOnVxBNV3y6km<&;=SS+zA02aCj(G<5|N1-_cUX`4L$jCbEi3v_k$#OeK zAPo?NFGFSbl-&=!D*FG6F z;j|mysVK6z2#R=@MVsmxq{>k(Lb)I_eD}Ne>IjCMZXC2%Ljhdjx>Kz)f7f$b`-u7c z`j~uApkl6X>SSx0V&V>+2y)x4rOvRP^$UI4*Lo#&6;RKf`{#i*1j0 zuV23=p%yS2yMQ=fz*rCfc!}K}CV=vZD_0oP?>tn%_#UWMH0P9+^VDnnDB!;fBI-lX zNxc2hpVQJ3K!u_`Z!U)mwY`AznzXP6x-KS9eqrvTE!S+dW!uH~2M4oP*MZ04z2sPi zhO2jHA%TD`Z%QR}3Nth?FpvhEg2QnyU0sPm37#N>Rvn?(p~o3PYPdKfECm$IIVKia zupszxx9@*ysxDAEKq^l&rn0$QkShv*7y8| z{GP6dxExjqeUMLQy+OMy6@4*<`0MVk@RAgkJNCxnMS(70v)j0Ooo^Q13PO=31B+Ry zsN-^~q|l{8pEl>M-+2e!T^SV$|LQ50#Hujbsg7t&%!#J0;J2EYV0&r_(D=UD8t+9> zhm(`-i86*tAsYUqLTxw~P@u#EO)vuZW^jAEI9NtscH}FXigW@8sU`f@8~K~e_74ur zym`+K$T(eY1WWS*Chy}^>b$!Lh;*m$@9XBidJ-#>${U&R`}ab5^0vip?atV+T}a*JpD`Jvm#TG+WW)W?DZTBq z=M;XW{V9ThK)2_3rppaIAa~L~RqVe`xqz%knN~P_v%44p!SnSL>cIif?fM;qL4+xr zNl6j)(1M24-@m^*j?2qSF9)$`_64)R877>-3vd^PS=nKfV8t`1XJv6ugoTD0t{rcj z*VacMWMYu;0L`|jm7JVY%p|qp)Q;fs7D_-^pwitN`)!vtKK2a(Rgba9WB~8Je%pD2J-=q+lnZQ*g)Z2sqwbIB}gUb|6`oOSQMS1trfF zp|Cw2I4~{8wru!Si!D_B!x{Nze=FSl0A*p*YkM&>n9)M3 zEXLQmL00_Gfb@nL$vd)Gf#=B+*wCgLK|hQF`|E?B043$NnhTk-yA*lZyxC3go$!VxQhinVJTVk9=`C;x7$1FRYFt z(7ILL=h}9xx#)e3b#zXRvP;C5;hE4~Xxy7ZPPq}z3HbY5`qZuY zR=G~>L6tkM<-rxN?Mgp5s6Z;{URfiJ{Unl{5)>Eb6I&-k0~4b5BVF?&!a9wj#U&6r zM#isM)j>>9Zg%_Dhujvt_%1<`mR3XQWJgwo!>J3GCQvT78jSIwDq7;`61MYR1Y53enR` zlaiOE<`@>wniUsUBc>^7X3V%ELci1fO9$yGX`yk+3YX(5D~>(B9Uu?y56^9CQ8H#K zlhwL>CdNVc965JVvi~OI@R*&L@tOFEVd;%{tuW8UM~0lU%Kfvn$C=4K^yuB^*e+cq z0ilxFC|>BZOvHl1L1r^~zX}aDn(o-o^Qnh3Ta0()XQ?kepHvS;O#9anLaJW07yqcD z^8YRD8*0f{tq{(z?C#`UoPe~4tlqQ*d+%6Ii#!rktr50Q>B6B!hQm!iVK=tRLWLi_ zo2nPGzp>r%&jfx!zOw4&r2?1>#nQ}ojU1)3wgA!V?Z{QWkGv!?^G5dY;V+UKjf0B( z8$^&QuOo1-HdikDn~m zfi$K{!-QS{VJ53Alj*?EqEYn9h7u zX7@u~o+P$9>65dVBj+C$^F`6H z+w1tI^8WRf<%5CWRvACP2fX$V_X*)44xKrzgPRx08Gig2T;C((=D%fPxeYi4H-}H} z<=u9GLu|3`@LEKDFiR4aC}?CL=u7O~dNhw_r4G==nZpz)sP3{$3v7P<>M;<7-_mmN zFmaWM%{z>1^oH-=3X7*(Mc_P%ds*9ZhDxFZZdxeCY|*=dqp(Xh@03Ow9mTYeq^; z#DHvUz%lyC$;n;77D$e%{zXUc;Opb!l{#qhjGpbYObtd&uQ(7)`<(CIsL>6jK8%j^ z>>AWyrHm!a4YUkX!~DqY;~@e>FfS_NJytPlODb@YGo#~i#Y#tg6r==RP6jG|H)n3! zI#YOe^8_Px2$cJ>$mlw(QI8XQ_d^N?XifQTpQt8;jGfZL#6Z^y_<28zDw94+Fz{(i z28e_#N+}rKF~04SI0-_OzE4frR6?o?{tVf`MuG!K3;wH=Ikx!-d&Jb$DJilzVGC*) zWH4}mLDcjff+CIVinW&)_k@@GdHcZ;Vjt18=cl0@JWBJu1`|>ztkeK!vuOW!aYE4} z&4!QnIs7pg!%1agr~8AU8jOTVogekpk&R~H!)}3LVN1R6dNSoEuuT-X}mPXrmKs2~0Mh?j-y+!4|Ofc8;qv z{4}(fe$kUKw)i}Q%)0huKBCYx(NVo~e20Zm5#`TCe#zoUl9JB^G(Xxo=!DbVAZo5Ja zVnv1FL+5^-MuQN_q2!)VF~Pr~g5Kwyq&@8c`b}@|iE5U_*BLtGvE=E!R^UP!wQ|?R zl;4bg+!heR+qVU6jTlkMqd_wNTOfbzc|ATDIplMqp!n}-gJ z%yYWizO_hvxiQVjIo=z``gE7x`Skyl_JLsa{rfp1Ya2-29FM=Vl67@)xNUY$9$}%w zYsk71o!BrAJP>#*ErkNrZ^=ooQpPc(wI@gPLc!zpyd8$^H*?6B=*$V~>FZ6+80+g( z&(|!=39A%83z4uh;@g{{2dIMovB%HfB}c1vu?Jn{mQSY%dZ6Pu9&g0O57TS*&^92v zDS{Wr94UE9!u@(htftKmw63o>G#uLE)ya-7ezJKNK^h!~raa`d!q;1Irm9RuEFgW4 zfqEb00c1l?gS9SC7g6*(LTCgS7z}!VrJSwWCWs6hq2l4U+gG_Mut)JiL>^binbvbf zdo7^PXR>lpr86IBif4|poLp`ShzH;$k7cumo8o#&)X9_;6?p|5z77uruh z-$y~BARr((SR*McBU}as0}IM$itm>!it@RPf_)Qy_t%F{ms^_qulY_FXbO0T_Y;XA z>eJ3s2OrabbBdJTF6N{8*a2*u;4r@7HYFZ@M9d(p)q8s%1ysaDpcykNnvmW3F*w@$ z9F)C$t!JFcv@4y-qiMouX=&9LrH0HCLy)nl7?0({jNZyo9ie1KJ~p-D`Si2o-Y1sF zUyBD@ex&1BFc&PEe7t``PI0@x+I4J(OgWbHO0L-%IaBkE>$YT1y9qk7KGvh>>^j`y z*yd%?DXf8u z=OB5SHt;1qTdRt!uKGXBNp-mA(tmrM4+T$H5?NYN3^Y*K+S-ncjUiu^?@YXm7T|ni zGUS8W)B&6;A?;y?qe)x{=kCJg?!~d7|2~2bI6Xh(<}L@u1tG+3%JuFpHOmNg#U%oq zR{M>g0Tr(Ma|i2zbJ_P0tQSKM31x6G>QZk>C|Z9*aMmwW^TCD!cT5duU6-&$ErWO{@Uc3kbo&bIi_A|0FSY3u%<@SsLVUsKZL6(j$e0X}Z zoatrPC3YlVeVS@dF7NyOJ6#kuj;Vc3&W|5vPkcDRYe;q94&Tw52MFrxDF+9Kk&zK> z3X1V>fD>)AEHEwdxg`#sUpIH^?VnG#=IiB|Kg}5L`}HvwNMBxE3VUf1q9Ze_+C1^P z*qZ<10mvJGZ+@CdPF7UYuFO-Z!ZrrPNG};^Rn(UV$ApLh>W_wm%azf(;RYXJy4haSIg{44u#)+MoDI{~4iEeSe*HDZ)bk^K=OifN`S7xr zPRFSwIt3fHxlb&J;YFrL;$UPX;Dpdggum?UJfI>96&Ht#xSf&BDY=|^UFWB-))`6{ zmpFA|s`^B-MkCXum%cNRmiEdkRu@OfypLx2`SkOlU}k2>J>TLMv zpABP!Zf_?S@QUTTS04oHNn z-+G+&%RL?au|R-Oq8ky-j!7eD^NY`jLluO>g%11?k&*yRlidHId=M@{k+~+#^H4lp zLCbl=(CTJG7FDR;dlc-kcRh(*49uc{{SR!Dj$_|C9!_Y`c{wwqnho>QC7r3roj)ys z6}z{g5fh(krvs}5fxQcyVN9wBRLq8>1QVcx5cI0vl0yJZk{8|gu?`P&3(Ev=5B%gS zZ;g45vPEXZtmLkElFs(#3rAIeK{PdopVNNcA(`tE`&o3xkr98{H(qNkYpZZ;=ob6V_yZXC;h~hB z0*7(HS_TBTGwFAPT3;N|!t&<5UVEx{p%5rSH_R8JInbS?=a+ttva8;rz z@DHb`x;dSG$jyTj+@?~wuZhp>Uh#3(ys##)xOnJ3G998!GO$zuvWo93Rq$JsPx`d7 z8*vDkVAc}BS5DKRrW-*jJ6;nLlSbvW4(+w{yK9ZaVY;U(b$~gVfIsNnrX}n+Z(NFZa z&LU1QZLDO6Qt_-3+P(KHwm5^)=gx~lGW<;Pmd{EGjM$<&Wr>=9)|L=0CCI|^mR(C> zEwYTrizYFbIzCuu9}n7B{n85RzXWEtf4mfNsB*+ z>5@-e611DR>U_g8kG{b8D1Y5Hv=R2R7R$Oe@m&K&+x@6<#3ljGQ$EtnjIwt+2 zwSHruI>}Rq+s@4Jl^By9dnO|xX?R?$&RmVdO^MX&9GQS+Gm7SsNn~tdm$fwX5r~5BO{~Ue#AG6`Eoo2=xkrp}$KBCU=pSob?>xm=< zm9{b`e)@}dVy1}{h5cZJc6u?ps014x7yBv{(45sy+QypD>D_bViGCcW#5LPj>pdOE?x!C3D#o0vV3k`#TX+u(3vwYlQk z${a#ono8frx$|*$!)h87xv578?ToP%@+Fst0&+HZgcYs1%56mL!;lC+; z;P@QmI0n4%Yir0Eg(p_y7o?+$gGPqwWFGx?`kn;ax7lXG*Wn%fb?^@Ojf{V|*OdUl z!Oot>$cAeQ8|Z*1_t>TfrDN0XYz-a5Nn~uwYX#jW!&wyaz{$LOW~Nr~_BOm@qHz&{B@~Eqd8(>hjyI;mzrFScL$eU#wQT`(XM2Kp zB_l1pj^#8j?NS9>TGG=Sq(hRUwQ|z!PM*I$Ehu!@R@S({DX2W8O-T~i>t*qjyFRUG zxGFoP9!mMrLgBJ(f7*xt2%t#qm(Zkz>~ zvZLNbq?OF6#D?Df0#W_uGo0X;4v>U1CuQugHdYzdXFPZ{s-Ib595P0SiW2N~^ZkU$ zZpdyg;*0Z_9PY{11hiq^9z_?nn8|&kv}9}{TW6y?L$`Z>smGPAlh89;44+G5Bh^(G z6Y4%gN~ma)*Q84t2w(`-O`{y`Q*q*t4`FJ}ydxO@xFV_J{`Z6~^z$t>T-jd)oi0hx zvw8HhRebTbPihTL3jlUmC_0KIQ&dkdfM4U$P*L_!bO*FgnRfxwcY`Q075i+N`glZw#fa zremfLBMtay!e-+;iJ$kKmxCa*^56M5JJR+g~9>mSY~)gL;7ESZ>!~Hm>m? z?b1rR+I%|hyto?gCiZCvX+5R;*i;eAY^U=zx)s39(uYG5vk&{du2T-}M2^<#`mmVm z&~rzphAkcV+(747xJcwi2h6##s;jGuRKVqJwmGmnWMkTM&XN_leWzv-8NW`+(r>#E zh&nPe(kgH?kNj00R-eqdyka%mASv;~-0Z-)Hs<2S*EyENc=*6`W4 zWVV0STD&mXf13hrh`o5hfW_NkR>p2L!j`8|m(|;mEtfj8d%lkNR-4PV`Mi&3@;)=g zR3k*1;d{~AP=bX*>TysC)zvOVAVCA-+9AZBmT}TFT{<(p+zIgc3m!m$Q zqSk&ZS(h&RZMwG?824E3RSQ^Mdy%^aM9cA#S9Fh>^~x92egOhIf`*1#!|ft3k-);z z7;X5{I;b*Rd$AteyIu;LKWr*Cv|a89A#AGX6QZ@U06zQqr%q?EUBl~yqLr0al*-Yu zvBQq5-Ea~PbngTG4o90-i7Ws${B)YHuPk!gyS-1F;{3{g>((8vy`&{@w_p0_>W;Uj zE2J-FVus}uc!7_FJxg#~v)KF%Ihd*|^6@i*^qh8US2pSGH}9b`{Ms|-las6aY|IyP zSgh#j{sK|yAL($LwY5HXYyn_-5vW8!D&N8d24AhL^V!s#q0r#12(UtXXGe-UBU!r4 zvgD1}jauGlvdTC>0*0z72Ol7R>X@KV(Nv-^2+j5bp@kj0THkKcit zq0fb@3xdfXm))~}YoI!H3n)ckzyuQ18b1QX(@|>qAkF6omdJEOeoYyHI8z!N4u=_z zTe76{7YLc)UAF-OPJ35REiLkf>ayhvFpS9jBL{XMHk$wUJoKL~-S}wlHAg}l0>A5K z*8YCx_iTL8j^7rsA!XEGU3>mDC-N+9)`t_Z7;mHtZ z<0d!v%IoyFqC2^1?YjK+9{f6U^m-%)*9wT_tS;ILm)h6sgkY--O6*oWCgPYBa=h4! z!?IA7vjb!Rlr66j`!%sx*JO@ff$?wAL_(W{-0sCihIu`E#;1JicI`RYK*KMBUXr*J zg*}%f0s~^F>JoX8lvfp3U;Epdcu5OV;@9hmD^emO`+B0~fNzXrZcRkpd$zszu4oD zM`U$Be<&xsdQ8468Fq)TUA08j3jexZ1upnc0>!6OtO=1PRTC>UzUrn7RG&w9~{{jLfAY=*v2KxIH?(^doLQ*Z#7Gg8yBYp zhT3A#WK^uf5ml5CuImbi=9tZh$ttpqhPq9Xsf1KGay_ON520fV@Ho|0$CE{-IfYr2 zbiIvw4o!~v9Ac;W#_`Z*$in5BIz+PAK#y%ZLB^H2{snR9Vj)(soi>-Wlk!py26o7^ z-B{fO8H4Algj+oe8Ml1sz0%LS(tb++bKa%=JGNp%I^+@>Nv!LTwi^^6+O}*rpdPU4 z^|4)^BBgNXksKNtnsV=1wI8aGrvUvc$%RzFsy`$sdcEc*_TQVi)#x%Xa%=&k&PQySw^wtufm5!QYbUlmVJ`! zFN94e>yO>yN%v=*vI}^}16i*^hO6M8Q3A_tan_S3ji1?TZ)|K_Z?|t`sJd3?agjYvh8M0{#rl(4ksvWKEtoi`1G`^6B!>r{AqJ= z#i()ZS#t%Hpfk=pTp`4K#l0PcHJ2|6D%Ywj&4GY45+HSTE&8nJ-az^>gt>0-n_BM( zmTh9gLS1E%YIcfaBS<+Ssr@*BC;?b*&9R^U+OoFU8C7tIY#_hcFLhybev}(m>E8|U1LSraOBwA z$@`j-m8g?(Gf?6^NE%iwFd+F%P0sLjK<5G>_2JOZ1iYD}kKB+KE;%h-GMleiHKaj7 zeOtxx{rmh|kMAKi8Hri%Fk}}InoKNb*0m7)x+q7Je&k`TXvgUtvL@Sj`J(V+p=CR8Lt#8l0*wrL2=Kqp<-&z;o;#&?b*2Z z7PyHQ7^BL%P=D_smJ)mIvnN~@iliLYYLVc)l-7g}UsfajG6-h;Hr*mTXVqnIs^}Mi zZF$)_jFUG$X^xEVSkVtR1W1eRGJbGouW0IPF5@vqEteAqVYMpu#jNmu9 z&u>y}m%VDwJhS9eri^}1<%`q>Ceo&~TJP2dFGWSk?HHf`)SYqZC?w)Hu&IFng=#A` z{OobX&E`1Be^P#IIr3fHkU6oMG=2gOTT!(ar_(@1*%6v@5jvTo<+VF$d<0^v^<=^S zD?WTq=s@w2LCAJU*vEfGx>kRP4fkA9K%yhd)GH#C7dm->0O`A=Y4O9@TMS!~e6Ou7 zpVL5EIDS{gmiEX$!!~uQ*JY1PN%3u2Y}~PX|JyDqB|213;0-1gO`{bzVM6rV;!&C6 zwjLC>`xf+t*=)E^9UIY72twXWYL33~pcB_*{bCyu_?eIXS)wf3(FGdLm3K^@IGSnJ zJ%GQwOJECZw|O3ElJKrFOs6zXr!th%I64s598)SzgVB!+`utHYA2`!=hHCZ@N0F#; zm3a;or0^a&DHUh`2$W>BEqqWjNy*aIzLF**N3o<+NexPfm+^nE1BplfW-dwBvgDz} z1b(G@t1s#ucKOH(KuelY>rY*anNoTy_stb4vH~c#Av@?m(3_cPJy^y{+bS?5M8*$B zYGM63ZIO|c#cFr{& zLo=z>ZPO&Mc`XkPTkGUBJ|)Tr+FyC7xRR1m{Pv!5#ccBhfu;;A;da!eL^Y&eIM@ll zwqpoO#Da*S@cTj`)(uNT^+_D}xQwtP6^rl@C*1j%O({>UtuLhpn79N$qf=A+7GB=x zv%R!u2HAWP$ zguRlE2UFsAH4TgmA(Mv6$Myn4!D8tOzq;=Zmzc|Lkgku6l;4!}uY+-zNJtmB{Euu_ z1nBGqil(M)Z-q!h;ucw){o(c#l&(EcESl{FD}V3>%j zSGQbgq$DdNX|?U+cAf=gQsaIGZZ45>b&72tx)FM(E?6Sa0=K^-ReBKp*lo7!p9`k0 zJ*bR?{vZ~S)pPTMh2zbaiKZWnM=`f4o{?md80f1wS?rvIGPWH~~#U*};@H6^I6Z8^YDu&5dVjjO6A5Giz zC)dxo77J59;fnxs=EjwOg{26vkst#J0@eH?Z${FfNer2QlLFCqu;St*pS=Qe*Q#8q z(1|!7whYLcQBi4T7Ud*X;O}CMb$3Hp-COs;D_Gh8>2byFxHAzpylQkz=$l7wDSYcp zmZ`RJp+Ni+Nq2imss3xrSy!K4{n~+3BCS;~5LMyJjjkvS&PwJ) zg3w6Qh_LE$|J$dtRxefAhZKolKjFUIQmN-@{1Ih#I?6dncm(yM780 z={OJcN!W*>oj9M-_}#$~QiC}+3WNwKv?Cz$vgY*L`Qbb@4a_<1mi(#EkMimuFmJ9d z4DlufooIV^F$_G4j0*ZAW1r@k3B_C! zvyTHK{sYbem?Dc!lgoPf1Gg5O%nk;E+shS|8;45XM5P2QhgqUPTD*4fb^W05xlSA5rMjE$!NckyOh24C{^ zi0QNaxc4!}*#jUXpk+KZ_A}=F_dwVgR;vLjSLS$}ijq%2HfXh_`ldRy*Wz7-5vWJO z3HmLI-X}XNP{-cu%X_Lgb_#jHTs5Cq)Lbfm#q5- zQk}AFKabH~PCp!iRD*=ZL^I=L2JbF0Rgjq}IR9-<+o|vthW0ld^XI#9eD98*z?2~O z^x{LSxsiVyFF;urW>O_9~uOk(kg%JI{nwsBTbjTwOAD4jq ztooyts?=nj>AN?>On@oDO!FKXKzaZMb7=*oa3BjzXpXi<3B|^YA)(T+zFUK+Gi(;A zV;}%(>Q=QYL!}pWK3vibK9~IPVZ{>a)LI zf*tNK?d!k3{_9iSCtzS3L~#=!06(Wi02m>c=XHy;17ueDjlKzZg0E4_x%N{!8uNTWIf*7D_F@4&5YrB5ZI0l z@r5Epclq>M=)G0IUk|Y#5)mMRPD)C8{B>SE*+}^x*_gEZRxQNk)R$ngULU3H`E$k_ z8zNd6k%H`Lev1*5boZmdUd9Qfl>I4dD>PCC#J6~Oc(qq^&94g}EnMS`kq|Z4kpH~n zr?_Z~EQO8BCyNK?`*CqYfc#xd0`tQTk4P(L?+_QH3(OuP2w)ef>U>984{mIISF)#^ z-PHMNeh{0Yi6LMUXME5YZ6$%;eBklpbE^zo4Ew-{rVz!9i!L##INNC^&lO(C{7slp zZi3759(v0gzuuk)%E%)8MxUg*{@Q9m&A%C2d!YxKoFCs=WZqp8S(lfWH@Z?<6yz|hhK4UHc{dX% zEv%j0-Az08AOU=*@|%iUsE$McKXUGu0ehq#7sS26;_$ttduc_`$5i6lGBW>C4^6hO z<$OKGb%+*5I9*D#Vnk9COyaN3sPDa_KrhKm`;2v_RBRys>GIuDb2LJpk$1B_NqS0R zvXcyA*oWMEO@G7<@W+F9|5iX3vO63a>|XYgjf{-xu_r$CeFa**QmwXr+V*`X%{q}@ zFNW_fgvx&Q89f>GQ&D{1-RfRnAnSh^SAWO2Y^7GSWJqE!9^p*L_0hJD;Mn79{fL^q6BdZ>!M_tJ{x+Jh#QM) zInP@${RopUr%&#u72WMg^SUws+9vQ(5-3-bK~geV5(jj*rL?kYq`6IUj0x1VUH@LesGwHbPR1Mzt(Zm=JrB? zo~LhC_BAV81xZ~My-n)_fLgo+q=|gRQ`mpr+s&OB+e!TL$>qMYM@-yB;2Wx)J{}pG z;*yfP`%0EWJ0x3KF>uoF0C_J5A^>aTit(V-p?>dt4*ed>WW57>t!@P&h+nv()TmEF-W-f_mGmjLn8{sui3bJfuOjJs7wMo3o8Pg@DGnW3 zzbw*CzaVzDgwV@=d)RT-|CDwzX~3g%koJz5r!Y{p#oOEY(Wp2q19_%!pnYXH$s}Ww z3E5n@E21LwxM)lNDWZ-&|Hr4AdaUz{0ePLx<7~JG&g#jx*FVbitjShSbPwO3$nX65 zY^nUC{rr&K4Lz?7J>R-#I@fAZErxkZuyYLAR%w8MiKZ!63@K)FP;8*0(l!LB0j)Y; zIcqRsL~(b|S~34MMw8EO_EX$NMK7V=MZ(OJmwjZaqK?IQB~p8z4o|pz)186ryEr?_ zsY3Z@#g9N6&bXhKM$xEF)hWxDh8z%4W^V}IKe2(za@gA8Z)fE{BV6Z`t@+$*jguug z;xGQUq2rMzAr%!LY!7^DAK26Ubqgre#K8)9-_u$FLU^)xc9ruT-5xxPvZ(m@;OW)Y zRl6leya)sN&8#r7H~cKLZNFC17%hyv8Ebq$J|8{bOp?-ghQaAaWx-sSUd$%>jCgtb z2@>!7Jiz19Akjl9}ij+Tux{KA2FQj2PJBWaxT3FC!3*R+2Es;{TbiYobT| z-q}C0Bnj+)AAFrpvdj6J@%r~x63bRm^98IGMgLiNvvmI*l%*l8V7G%a8-!ykV??X? zNB-2x-zceu7!p1K_;Oi;2$c8RM&4&(zU;7iULV)~m}MKVI@9BM9&6#{`+l%0NT&!lTJ9d~x3Qi5f9&Z=7hrVW@)POZ#_j zA$j%hC`Ba^!_{`;zTTB@!D9W^dB+8s8}LRy0b^GDudp6vGN=;rLliI5(6d&Ug1j*N z*Dq23&rg+t@%*Xd-6hDa;-k}E@c;&4cB~{oGA&UyBGCZk@}UN~iAig$xk95Kcq9Ve zq@$uL1R*Y(gluN9T3ek&Ta>Ui88%1iwOO&H_wbp@19&n_^gacia#3|gk_T7sgY>|l z(=Xs>M26XC9d{WdGeiRtVH^KHZl&XYZzaTEc>iEn`D}nxZsknV>s#^Do}fAhnJw7d z^OL`tufk}W-US>Uq6vbS6OL6_7?ZUYc0W>4QPHMGqcR0)WnF--(+M=O)#T_uiQLuY zPV9VJtkW;My7JQH1DEflnu5F~B*cU8$& z?K_tE#wLpdtfK1eKMM-w+aGCdR=Q4JLp& zL=ui5wJ^?;=nNLT1%_`AC2(+7%R~gbd^mdByY530r)VD;C&|9l`fG1e4VnJ$x%5T% zi@H%YAH;xL#Mww7_jJ^u%X4l9cfqOT(q3w(Mb$wTV-*jNlbbUF29wvaV)nCLnQI&( zMSl;b^%{PS3OPm(LYtL1J_zb07%R}0=Ok_eGZujUG}Y=(o|-X^=KK2m2Jc_t^S_cH zOcbNwDkwkx6F$MjPaF~}9CR$cVgfHzs(D1EWH}-+@BPMXKdeI(H9PQkM{@W-PcFz$Arx{@#f9FCn*l^BDs>RuywxJaetU!=vH5*QM!< zO|Lxv_F_BK+Hg3IiD^1JRWKShYvYmY5-xJW32=YQNpe9O%JG|(O-%EObse)%MoFW| z$R0u3zqJ4k>6O-z{sME%S$xS8*819-8XY|lmbGGQSle>~%?WnTHm>nv0Nse9F`cTy*bdZR zI&;?-jIMAGV&WxhyD}9&5BEZ`s^b|v-H8AWs0#|Jp0|IQHqdy?GWqr+u%{`)s~jiZ*$mh3xJW zJ;nqi0Vo^6`C)i#_qO}`4OOJ$I*H#)M$#v#S;?4SW$0M@K873ilVPB7Gm1EMav`&v z?-k?cMNOrWz?W4yJw!?UJ)d1NXcHAe>i#a5-8KKc|2B{Wwe~*KBEk?DzevE&dFC6= zYb^cT5n?X7m(7$uekA+ps9GgrB}@6(1TvQmvob?XMfjeRzw==)Fwc-pX2#X-DMZ`| zvcWN}s;S{MAXI9k=SCL~+RiHnhl-22VYK1n-Sta)K#NhPYPonNJ>}sEO-jO?kk#}M zVyS1Z7@aXrb-Vp~Kj!+@&hr8~55#vtj_W=xx`J9P@j$k_b$!5h|BTJ9)y4{bVX0XTOWjYgPMJT1r@HOd!GQiizhc_0lHsl(ZIOOPoS9aO9X>9d z(~yiE9zS*ey2q+wvXiAVdq8ynJISDEb9@qHDcxoXHrdl`GDHaz6hBIfO5@(NcSxi? zHbE~kF-GDpY07(wNlMS1_f~=b1;AASa=Yv;6r0DG1F(mffpF;14t_gs23r*!G)F8k zW9mO*d*{o+2Hw8|{hw=u^mE!EUAV{v?zeXV>Rzsj@)g7S;(UrKo;N1D>MM)m);rXM zQa!U|Wqj22W7mMWD<}Gj8!E0^XCzC)z;8V_eKd`(rdDOf<#vWQTp>T*B)g+pWX2^@ zv$Ou;qq38$EHCNWMZ8v4QBh!xryB~5;$HQ)%>!E4QlXbyfJy051+=bYK}e}UtHs*$ z;*ngc?fdTYWb2-_$PQQlRKWUH00kWm7os{>K3a6mof(8LP(JRj`iDr0nz89AFlK_v$A;8^`xBHWD0qC`AP2&d^o zu?bbx{$gO*>1H;eI4a3l4kwoKv9Iw3AR5SDjINEx6RP4p3jT4}^vC*lB6-YiYHG^+ z2n`|N4HeijK$QwCjV-y(MBpA_NBtKx-Y6KGyWChL_${sZv;^#KZ@A-yOH#_7pZIH( zFuM^(PK3$zYuD=`5hOcV7J)rQ!rXPzTTVueW3S_J6-gwcgJuNH!?EHUiZ|zld-U1-G)vm z*YnQ;afI`Ls2>*DTV8BkFynH2rVMJsJHwv+<42IXmxDl|;2EQ@6%T?p=yf{38*yJ< zW;j=~SJ%N}bxY(ocq?nP$EY%3X3>`y*5ZZjLEfOof*<@OSPa#-IY#-zAEII}pa~Pa znmM{Y_m6k1_V4@M2YCp5q`Ez@1RFIQs+JdstvbF5ifovg?$lfFP1eM}qZ=s(YA-1* zEv;#>nuV+qe{#>t=YkuOhU|%z3$>6tQW4R4DJQ#XCGAnyX7d@|z!>KUH{Wz?B zLSeG8X1W_d<0=^5*PH@=hn8Vzk%Td$D5^U-x)=2?1i6}gw6yVC-sl=(cbxPZePQqh z8EsE>$Y3znr#+}6xj@UH`GD@j<;Qxl<@y?_8wqOW?kDT>Zmh=$~$90rH#@=n$kPA5dj4S1f?szcS4W8 z4myf}bVCWF2n;14HG~pSq>~^uKp=pSL`n!Gv=9=`j)F4tf7kiXcXDw_RPwOPTKBqF z*=sM5pZC=Ke*e5i1qKuZwAHA$FZL<*^2dnz3+*X2Rtdi;WBjbtI|pBqhUdA#yX6l2 zGJPQY{dP?CE7A1*L&bCEh#(vP2yrQ-(qpXqvVcHDq2pmB+_E*^?do|AZN>}N@ZlGP ziOI|Rpueb?fDT~bGC~Us!xBSyyA8hq6I;Bkp6;GbV`0 zs4*wjKR_l+d7E@Er33uQAm7w#nOfcv(6o7?~ zU5cguDJZjpg#a-%P#O`dxdCy^h%g^n`y{G=w`z@*Oz}$hxmtjmz*B2`J%!LcMxff` zyysl!P?>r-|0rmC9Gz+DqY4sSPx)4Z>J;`r`f1F@Fuk#6o^g1>yG8lw>Qx|(H_!Or z-26T3X`Sk!mHo`5APpNyDVbZGV^=lBRmLqzRB!LjKYx+NZ-!4a$*2l(Rtuc@jRFB- z+g=i)7Wp|G9zs$TWRvY`muC2+Y*4A;%x4yn;&-J@fo6kW{)x{iz5Qqk>w$j#suflx zKy0!(Moe4VkP{-){B7v|IR)h;<9)>Qezu2%>Ak`UZK>wiB9_8o?ZGlEFf((i9yWr_=?AVgsv&g3~ zsW784p9ejlcxZ@&2rIOslE+o=2XzGc`N@MGusx-kj(umqLaC4H_?>H=rIVVXS>vI+ zblQj+!<(TaZ6{m1@pGAhI;Eh)BA8f#`&0=ozDI5>U6o3XfmV#SXxAnxljq9?*MLn`fI@2w>xsgw>O$ggWcC#yVP#kE_wD7 zsdgD#1Bwaufjxx$L=LCBb75I4kyo_1`P;GWpPuTl-+>M`SmQ1&eE>RhbM7&jN=bah zHOaLjmRu1*j3g5i)5<Hvt_BDPByD^nBc&+rf`x%5N|I@fXUuGTu z4@lhq;{4a^^M7LQla}5EgV_Gt)PqMdAya?594f0Tg@cG!SQYY_)x)c=e>%|7Zcqwx z6tHPlDU6`Z=ahP|Z1?f){xc#M{~bE<{o^OjDHd?8m}Xzwgml||P8u|f{?c70JW$<& zbtA*v=}O}p6R*Yu`Ty2EbX<4DgBod{jUagNeDLecy?=u3i5FsxGo@pTt!rY&Q+5Z5 z-AHfXlmu08?xjk<$st8GWS5sKIHm`kj`J3gxnobv@1Gk*#-hX5%Pk5@OOtgAUqjyCfvq_FJX_wSUJTFZRiIRX(Qx z?r}||$Jclf5XevOp`bpNBjBJWeaUp0RA2L(CleH|w_>qu^Ojz#N_YG*WCkqm;+H&s zfjah8)BRKYhmh{t8^t=X@a7X$R{PN_u}a`Bm(kFb@{`4Yg8c+7VDz}T;^3OnRA@y- zg~oDcnZ`o>Ca;;-Vo&x4$*kV}1m2<+Brs|nYD!8tG_oaf)#}_@V4|(P$ggtrm{u1wrX@ULwqW)~1X#BwLQe`@bCb-HcB-x)j{ZM^GM9`Enmx;W+B;8xJEV*_T`s3nvu+9O)ARZwoO}C%~_=b=W7AS4}v^x=8#|yG> zpk$Tzfw3XH&1!WcjwBmtU#Ga4VLG9m?cjh2fyuj>=7xNpr>}wYE^FhG7cH`M0!Eqo zkn~1zGY_CVzaq&vtY5;P<1b;u@+@o zf;+o$n{%W+SSIjc(V^2ku+{dCH&D?tfBpUToF_9Yso>XPPA9U~S39FxLuQtjjE!3+ z8n)|TGdQt&{zF?yq0?5NBkr}zmp(Z|x}`5&4zvU@jD;UJ4 z)z_tqM8Ov4573M~?qGhtHG=_p+?s-ujK8a%DZ)=aD@b$xS%;_gZ34)d0V8$&EQm|W zXS`n$ad#BHw;e0Ja^-s{n}cQGRcEcjpCk7lTjEUr2%XFX=P`U@0dc#|6EF}eVsUUD z)|*nsi6E5WhpY*U2XhsJvsARo;<=kifht}-AD&9@(!;#_4X{GHnW?r5VGrU*9ql@C zKZ0xBEIZr#-99yAH=5^I6?1_G+RH~cWiTCfTMV^y^so4yo>Ei0-+zzv=)C^C-wjt9 zLK!x|Xp#%%8KcEsV9y`s=bPGjA`5zF@u@YTU2wql%KJJ}h-w~oIH+x$eO4c2G6pRlO4{|SW6x4=bC_9RN2?aJ-vzgAq?&*okQh zmKP+{JM4F-4K>8wpZp_Y2spVv{(c|)>1<$o{7^%4shV#*Lgenjcxjlucp50^dDX}F zd)E1l<%_0CCS}dWjqvA7Lf)y zHpg@1C!Ny*1SwcbT1V$$9_b&ZoaMqVsLevvk~8a3Df?4Go>tJ8=M+`#{%l&YMfz{t z7)lT`nBuU5A#3z~QBXISQ=Rh|wCk>X9xEV!5}&gB-k~X?nN1Y;b1=>8{Mu*-=A5b@ zKmc%|0N}j$2V8P1?iQC9MstZGYcMEKyJADIsV;A1gNPz(bza+FB{z5P?uS(r5M(Ts zlUJ`pf9zMg;DUqKrTf3<#XDi)0=#VFv5yV$JX+&@FnNn+^oB}r3MS<`#ar2z&Zi zoO9wcnjVPD3ED`A3d(}oqc0VAuNo%)`c2yl>Kxwzj;8pj{hfE5)bdQrE+vM<-8t~S`wWPg2+eUXG@EX2I#IEc zljvFX#d=47{bUaTVa)TesXs(6Tx-4f%2J;%-a9GlqfvV$o?_+9P5gWjIm%id^r-Q0 zNr5j73UcH3TziGTgzE8D{OQQ<#DY^ICE(7)p=2I`0mXXl1N)jvUW-&p;X#kuiI&E( zt}sF-H55G-=lBLj)py}nizg->-ng`J@vMl%G47$^ez=pSuZZD@;)`x+tLZZ#&$+?t|S~nd_o0Q#*d(y3GL;WeXe&tS(QT%~J@M`K|By`TMpfYncoy^Z|xSmhJ zBRTyRJ8W1Ki-a)I^w~#3?SAm(&fD~PzQ4-7#?Z!nid^1BX)svZ6~D8~A;J|Q!iN(u zihB~GA}{URSD9;aHrrgnsn7`9Fn$4x&FtG1^!9Ox8vVUatfPAZ9y(!ToZOd~n=VJo9E;~IimArfBt}g3im?xk13vD!uz^_&s)+5Ll zDMImRIjweYGMvqcyaO@tbYLuL{(({r^c zdBJ1*J++ipoS+P740AZ-oKoYYhOQ@?n5-Zcvng097+baW$&xYH0#DRJPYmyeS_|gO zLaoMc#dl&b#6}^;XCHcUikYd0p+Z^HFY&Pb3x3VV1?|stXI0DR#tp{=ee9xFP$19jK;aOR62y3g?g^fUC|2b zYGc6yJ$+Pd;BbtE)@W%{7uCgOkr#MKeuLjN*J~9FeBBJ2CkfubBtL-(Tx*bk`M&8a$0DTm4&CaNh;% zH73&O70d12`Akcl2S)Lhe#^I8K%XH~Q{Pz+B-zH3W&Xg(%*;%X{#gf6lZzzy_vTZu zSnS5U5PG^Qc=aH|xx$>0hD1vjua^jEdd^>SnW_T4rs0w@^&3@-F)=az5J>S!3rkB& zoZaVwz~|A#A!V&4+th@KT6&<6a-~z4Mv6zBz14E4Ys>yK8A#@uVkSU?g7;7one0cG z7V13MRV71>poW@Z>LyO$z#;!4x6QUT?HI#wS^`b7evMlS_A*FJHZTmryyj-}h|n1diEewt0nvda#TP{dg&9X(BJ1Sv>U<y@ zL;SIH5k?1c<2L69c=A@%ZD_>?q}WQRpHG zsWHwL6Bm!=lT6urW)~OF7;xNACSVlA(@uC@e`D=s4+6h91$^a7u2G(Sxk9>YcD#|x znY|NxxHNvGG+nBMAjxr!btv{P*-~I3gDAGgsE5yN+^mT2lttKYj9YrLX>9jt=dQyL zkFEiDOi=T1Iw{4}7snnNp%KGTh`@8keo-zJzCF7WD+7^aS~puGg1lmBJPP+16>y>3 zazw>;&yP2^q(-GtV`4G3OO}Pqgx+!U4=g%#Gc_#}+K>t?%Ie*$$$QJ*V!0n;l?>SMSAfH$EsF=o zmAf*J(S|NuE@(b>>=-SU%FYewuV-aIGtD*@cm$C39Wr$y6bhw4X1s3MPN+lPtBPHv z7%`(*j5Vwy^%pcpunyKIX|tm0EzNk+niw@*>Yj6lAtP}eGFCPZdc>(~efgC8B`?8U z5Q56oXD!xnu%PC3z%U6BSo4;^y3wB+5=va>%RFoESuqJe;*lO5P}UI6$=Umy*Lv?} zxcf$BY`BIjYko6Pd6TM*X=rG8yi|It<*kNVst}t^?J8!G_+p~N=RmvA-rioG;2Y?i z;$rGWT>6#NtP%{rCvO@Ds#jXc_EqVn>)2v?D zOZOat^BYqy`!O`jZQo&kfB!cM8i}si>3Z4euE9%H5k=If#)~P)n6L+@et=( zWp`EYw(07IsN;PnY`uy`OEk?)Ds!qU^n-roY(C%B2VcH(aW$wqdwT~gwBhzAq_+~n z!JxfB@5(nTlXRrKZ_6wpz`$+5}+H~7Muo7r+;uQ~xnWyH!l z*kqjEt_A2Q%4m7AJL6#B{Bd;|g_#>rT5d4gFB6GWpf*W5 z_H(2L{qZb4N1M@WXD77Ys^bTq8a#JCPJ~P$WawChOkb{5&c${>Kkuh68b-(oZQ>01 z`3m~^f-zmSTF|xT&7?~ceKvb5;#wB6$JidhEn}PYVeBXyVBN@85Y0kG)tOg+%uCD2 z5U6V#al+z-5=VZ{OYA^Fy5M$pW2>5*5@uQ}wEZJvm53JYVga?Vp#GH=3SP)tfNOlD z^zGXhPoK8+%|u_nZjeoIE@Xs=>aMSc7$Z!Kq+=cJ-y{NBQ+_mxV<*V*mtMW7yd?Lr zH?D;`2uC#$YbX6W@`Td6%;XaV4IX37+<0WA$k=dsRF=;fe6@N{&5Z{=j%DSg@u56e zB1x9oVa0SR^ZxZxIXWM4vlWXN4W0>pgbH!DIBQYeW1R@+aE6BFU%qjNL&FtzE%_8E zbB;_S@Pz#~wp5-wO5IouA18sEuAKYtWE*MSrg*rrm|AI3+U$-Y+H)L{k~t4;;L7F@ zhq-ut+BB4jWY)1#3yRHG(PJUKW14?kQ@h4$DIP80*m4_C;)vVeVo92B#IiEs#n?vw zW?W@ug=~;oQ09X;`HMO_I%wAKW2yB)bc>ki8dksoyPq%XjueR($|lp^gOV;sCvr^m zSO}gH++nkM!MBn@*-@xa$h0c{9 zU-sMNl|H|P3I*cvuh24+|7 zdWSC@n-K08^0U=Sc)}}(ET=W>o$WI{Gxhov!4m2tVK}JzB2GGE+V${(pT2DMcba&p zdgFYos^?q^l!)^s5@Rvr;|=+Xm!BLWLN~f>Y!pqUj`>a(k!e;*q4FDR zZhmX6zLow6fph*KpE~OGzz70?2-5%7LAYfip&OtF1R>Ncnl&uDX#`(S6feHJT2RmC zV-(bf&z4Xuyf*J}EWj7mSId{V_`H@;%vR%A;Fe|%3k$=ohC?HWywFqqdc>* z8An*KKrL6|aREX~X+n&5Laj9fI$R;mxTTpr)y38Tov1fbGTC`c%PU2x_0UcB#!?px z7xr0L=&mCBZ+%$|Qfo6CNcyX+_^5Vmr%OGC%9WMC`Ph{+>m<_3VYkkIxdzF0_KmbpUeQ@#)|Rx z50n1OB`{ECjP{y0x1d0h*DC0uOzrr8EjKY^={lBS-T4(cJp6Ym>L#^z{lV2R&-GetABU(L z&ub^Hj;JQVB8lbZ2#t|5(*Q*JcrfIKjZ4X<$-P6Q_-u^*=EnVb&2uS{0gvw$wIP^0iS$6KK?y=Sw7G>IOO1dW64WTqXE!@(2;23~RIe;&%Z?@qK{0MP#noSUtrCUU z52<4>DhwX;+MF*h3dRAmywR4)V)#sQP;~PBHG?S+W!7ju1!2LY3jv|J{qVO{^4>9; zbj#j%8x%YNZpIpnEjlTAEQ%4C$&?N5*0)I()`{WgtDiK^#M0|2qQRY6G999^VfK%o zJf=m;vP0Pvzf6pk4O$&B@Th*Av=R#q8zrCDef;DJeI18@vO|`aS4fJ*8;i9oxix!6nBd>A1ZH+}h*f_!qniWkw5@KJAnBQbZ?zbe1%0~DAec99~EA!Khuc4yEwHalb zqS~AC+8Jy%n_nwTrG62=DS0>{K{uY`z-R=pOZb5BBHYIb$CR zaVjcw*Uu|f*YA*IjB7Ie7Ft1e8lmxr&9XqRUTKe>BX5dd&^?Jqnlg8XudiTbNbqTt zluYJY1?JKD!QQy2$Lq8|tnl=M>XlCA^^%m*1db@G+}KdsqAcV5%URkRml+RJHl0n; z^Y=fZP^em#0M)Xr2n;>6o?L^g%jB?sG|xzF5$cJPqmnx!+MjsT>!3e3Wp zwwzzUm=efr-(=K7E6yHp-DIlULaM#)(2#Q2*%jr=vabC@DQYS>fYWnnk*MX3i{F*$-wt!HGGxshW=YMeBp zqM{01t(X2w7UF$hQC^;?POY9DTw#ziQqTm#ldw&$2N;K7aF0#yO15cn?!e1d_@X(9 zL>efZrcf}>d5PU|6To9mqE%n^*<~w#M#M$(STF8wYcM{FF`$#;H{NQbB_DidKPjbj z#Fco@{)|I*Qm1T%T>YS4h=D0C{eXOw{*W^AWp>gNzsIpNRM!p%VGCbM3sQhTa*wRvY zMa3x9186gk8-=eJdKEp1w+Ec-^=KJWYrhClu095wQ@u>1VxqxY)dZ7G$x| z{y^8c4XY=rXKBOCVE3_QVhwPnX(cJeOf(l)T32W1b@URkhW;vcL!Z5lP$oh)$7AWF zdN!UDs3AvfMv#3bbek@ny8LJlYAPW7Q4#MO(CMX(5FBMZf0%-bs6{^ zPKEbhy@1D5a!ihsr9wLQK4xilnK1Y`kNE!Fo7dFv+|%(nWz+r@6%P7lq0gG0Ks<+| zA}!@=MR9Y3$sHZ6JWq-Nq^6_y%NEwvy6yk6nOxq7YSw*XJH~1mvh;%b#WapR_60#E z(4Ti~ER(N@Nvfsk*u(+S$~QtBnn*1uYR}bT!R+uLoD|%bol;b=g7{)~Krj>aiMG5y zSYx)Ck2VVe2L=DV04DB*0kMYp2r_jTB@bn#K;wAAr?P@)@m}p1p$*&Q2KOkFRJ%ePf&Cd6?RE464Hk&tI@uJ)BW-rVNC=a{=t-Gx@0^>eos@#*&T=g+O1%oa$ts$ziq#(R2K7gA$Yl`&5ZbMXuztK%vL^y^u8+MiLf z*v<92u?}AJLenHVr%Rh!8-|0R6}m#PWyVs1&{t#P^Hp~JE73Tc&Hv2*!sV@2xD_0m zjRu|%V8h@V%1v!*#BFdt!c`p|Ia9$KE^iV`Tve?yzC_5<1u0GU;l6|mzzo;}%~oG6 zni_v^WR7@JZGFl@4PTnwOVmrl*c$2tdV);PD%O#GuTZ`cp>8;+`J$izZ%m=;r7V15 zD@qS96)fL`A^`t=8$7aJoY@vM`PrrtP2)qK%COSpgV3A<_ONu za2_#K>Y(48p9IY9k)I>^{;#o)mBi zd`dbghReV`Fi%fy@ni zK;mAC1QQM#(pgW9JzcVspw)h7Hy9M&>YGbS4xt0|*^SE9e%1Jg3DdGys`q?FhZi7!62*b# z1k0dmi+c&vGjp9q8S16LcJ+?7Kjt{}rtRP>x8~?z;_&b=DAD01z2-I?^=k${2230_ zq15!%&7hlOEys9y>9WYtKzAmpDGBdjQk(_HY=;^-iSwIGKj>Qz- z?Zx5JfB?A$EA;D$X7{`}cZDm6Yn0-FvVAKq8)hP^N%08o$_Vuf@^P`+rI+E+G&eYq z&~dfWJ`|~+q?A>8|2!D&RI|p#sU38ZN80mF2vVUrg}Z z={3ZbSHb0!&GDT8D6UUFslyu9uPB}nJgN4Rz@oQmZdw|>acIhGEU>p^6N*Qo&jAln zA#e{DIeE{1o@~>C+;8!-yOPLPby=Fijg2QH4(5V%Ov@cb0P1`LvRvuXKS#bnW@(Z= zsBOJiA-zzG^ENM2+cH9(e4XzxBHVywIj|Z?ik~2WFO}W@C;X!xi8b#I8DIgT@ZKyN+?2-g$j zB`0)u2P%~T>L8ur5&Xg1tDR*P?C#(;^CWg^eB*v{vRRCnGtv3afeVn(eAcMMDkQr& z>&Dj*XId(k=+@Y=dWJz8lYX<(%3x2btE&w_JNpA$TT%tUfzF|3poJlNnbD;_O5tia z;pXBakzi~LOLx!t9~mph^*Ku{M>4DAxzZ0=QJNBw{@H!Fq^QTq@-;!=2K&|?z2Rq( zOM%CFK_ft?5^0a7PcHMx%V&@MJU#1fXyX(LW`goAQTF53zsu0ead`EjoR@og+Sw3d zabB*3Gj5f`K{~&Doxp=Kqmnz6Xm{{6fYiq5E4X|hrA5wH4#RC^DCQ(jBhp(*p>bHO)XB>riaMxZ=4u{4&y;e;!MnFXKbvVv;SXS8XEtY#DTJ^@|TW&USi@Paw%5oRGSPOYDG5?td^Iv z)T=Nzs4&6;N3C+D^5D$zuTL1CI=mfA=KMq22=Eqw4Fq3eX~rPS;TRmu_<{lZD!ue8 zj100Zv7fI=JbJW;g8^S&4SC`_7eXnHn3Ob^F`Qyv2M4m;>;`U&@OQ?ff>8hS=P~w$ z8X-~&d3B9CkzW_#L0KB)_pS8+j~iD=g~2da%3vX28SCPnI?8wGcZjFkNF9+o_f|98 zNCIqxU6Sv{_egEu z*ELW9r$V+;aGWP3*k<>)FR`buUsp2rQZOn|F7+B?mk<0s?M%Ivr;r%eW)Z@1J6?8eR~RK+%BHvvJER|QWv z9~Zj%-02@-%w%IkqP+RpY($;M_oZ0fxfJ8+$^g?iI#CzbMl$)1X(cZoQt(EIL}Q5* zc{QVU5X#;cxU~=ub`Ak6(E&)IdWCF7h-O9e6(CN45f$C-#pBbujU=*!8+9%xe8KNC zGGDi%VS38S;_F+^pIBFUd3l(#LG~AHv41_(N$a8gMCRp=JaE9>FwX=?1olpL`onh* zk0`x$+WMT}%YO{vBnYd(;94&hi~kVqpIrvk6+oV`F)`1Rb>umI(3G>Y(N1}4xGcIu zBOb^P{GUl<7fh;$1=BdsM9%yq5Jz1g6_;MUy|}H{-lhLo#OH5&TpdC-{lW6(DW3!} z#CJaUL%BN62O+Z^R9t_ovFAo+qgjP;T{Ca<9J(iH`A-{}H&{Yy(r?zSykV@Nmn z#}m9kh{?r(asvSf#=y1k`={x2y4%3g^0K3SRif*%vuzK+77q^(PAcu|D-9IKZM_BG z3{Wr_EbE@`7C61^q_ww$y^Lx);69ej$-Sb|OG@-AS602gjlex{=Ll5tK-jYs;%Wmd zglqKExf8_>o}QkVR04tUJX!CAzzMCBsU{M+b)z~~TiBvpkx;JkhYHoebo3vB08>)AfofP!@Eqwe^cA_q?rWRj9 zbJhd+R2?TP5$%W zZh#BoJUHt0Ke_>5MWFEa?OZqbd&6Dl|JM}D7i>~9(zCF@e*=0ho}D`JpsWGxX7}4S zfUSR*XK(}%7>er^me^}~iT{?Sg@v7ZsnRGVE#u(pdNv^eSnR_?^46f+`ber`U0vM? z=_ENdIgU!`Wv8zM3W@IhI)(90qLtUzx8TnQH#{93#SUZg`o2V2fVn8Etqpt60Kqii z%E#^#P3kxyAmQNcZ3}|(Uq1zE#&<4)SSctM%*zYU>!0O-oM{1Z{8b}|It4oV`-|8S zyA!YKohUHv=^sLU1DA&BQ#;@ZSls_F-0jWVi>xgR*WkGG^R|x)%gtc~?Tp1Q#dR1* z`B3(+@c>DG;hHXB| zwL?D}RKLgiIZnc&x#p8Y0_J5o1!eNWS;8kIV+FZyxKbC+U*B3pm5f?Ho~`$we61h+ zdiiemod1p49e=oU4X``Su3{PnoYR4RF}nwNctFi&u8~Bp`H344v(@kFtzoibBZ1wG z1ECUwFQJm!^Kl_raoJ7Tif)x26vJ$zHfIj02ceRGI0ankQvZ0u`~RWZ#|3e#x0?_L z%Dezr0<4@HIiEZ~KYwuc#P&)A?3Bl}p8qwEFsZRsVY) z$EC!#Qye7z_dJg4AGY^Fg6p^B(O0h%4!lkv)BgvPdnvrNkly#T?tYUfE)A*wA53n% zbEk812MMa5uNw-ru9>}$pIHt8gr?l_hLeuY)s8G6(K!mf3JQ5O1#aKSEEm>vr#u{1 zD}DPyHk>iPv;Ob@Lgl!~Kkrz_3-R{AH2@brqh<*q^CybQ3!UyHa_pOmt2h4VVB^;O z$uc`0;vECV@lvzm>O8@?D<}&V+B^$O(=OeClFy$f$^kl2dEe*zRQ_Rpy<-NI!_Pse zc_5G1IXb!AC!W*u#oGiy1*pD_jLK#$N3@R@!b9c}igN18^^P|-lL;m|I!4kdMs5mVdlTY%uF0U5;t$T8+?tIoYlnt3+#UZo z0kgZOTk+I!rBAH1w$v9`!29PLAK}YFbwq2L&#HPkiSEHyis_O_u~R~0n-kHl0$WcS zKeZF|oL&Oo^ZNC9%xI`9DzrAPX8uH1=Nz!e7Qh2G6>PhM@>fuB(GeA(XkGnr>j~+o zFxq$jQweqXiIW_`nFL=9`LepjXu=X>1Y@( zSJ7-gFX%M|*Ibs8kw)B=uL^eyjJ_>rD&w#k<9ar$@gGL8f%MxBqps8nfGe+#DgSLI zhJLO#9FHL|@Qs{YI+((cqG?-EiEl_~wQ}LM-}3;Yw}V`ypVo0s)OiF>A*d@i4BX^i&E+^ivDzmUz1|gTg##h6~w7cHfsfaw8S_rv@^6tfw z7L#OVWI5zxWRZ**ETRnF=slhH=(W$SA0mJG?cB}3u5l||j2n0y_k+i;LM0BxqO)&B zn^M9)-_aj%txyl8N;zHAs(n1QAeLDG?bNGurvyRP4mbspmUsUswXciH41>TYGZ_;% zII{KtXY1$2+7q72@TGz$y1Q@)~{(hK(lfe!9g)3vfcy2kuT;6_% zzlRkb)W0z;aEkCzrE}}UU>2s+8BotyJ2M#-dFip?A?rh;H%#SJwc@)cUI~wE z#fP}Kc71oiJS70VS&R&K`SC(Zt12=t zoyuDZBw}Apo}f@_2?e{5RR{_QXr{>3zfFXpBEj#@wf3@H?EH8EYG4TBJpl|S`=B$C z!o%CF?g6eDb9rkS##7zO)a$U%wlb9pix;AF2kORw8;ZBcfm2D6G zlcppH&VjDcVKWS(hEk|RKZZ5ecT(a=Jlt2}Fo;-_^WN2NuDn_btj^zU8HzELl;p+9 z$y;DL-4*Fk9e2&|g6+U!V@$3-k=MK(ESjnSw;LVRDc|;Hxy(8c3g3pL=Bz;PnK6i9 zJro)C9a}*)V#p^a+ zhB>)na+<2}>Aa^V&5w=G{J6G_eYM>`e#<@KIwR^}WEoGguoEwRD8;PI!Y!<$#bX{v z|M1@NB*rvEy(4(cl#W^J-!Bt@?G$vWbv7S)-X_Dt8Mx&-QV{_w^-uwv)=JO&}csQ}( zmRltaEU#dAero^dF!H&0xK-9rJ8k8n*2&j16rL0Hh$C6FK zUWSXNmcJOStCNIJ&r;ex3_1g)g2D6c^W{>F^8ByxZ8`N^-ibeKXH*_k;tQ1h0$tRF zLLDVCH6iDj(UL6*XwTe%R&HJ-J&B>un6J57w3y7_JP@Iosa~JVz_4&jYo_tbb>;3+9gZgM5e22r%*CR|Gf~tVG2aw=|7dWIl=f<;qSj2 z0|ci`AJ1689iv4KE%#YFX-Md<@FAo;DK?KN&bj7Uuo+T+ok8gG)d=EKhC(W0BctZ3 zT)?F(KY8xufD;Vi$eDZ-5vY2Pvx4>VB8LiG-UGH^YRO(SVN&>nfS}s@=xwpB>i+4Q z*m~UZs-(@en?_75qQZjNMl+a!{)4WH36{jWpv7*$a&fP99n6L?90qhhY+=46{p4qZ zyx(5`pd59z4Azt#1%qXDjlB1@MxV=Ej>dp_&(Cz)J4p2=Opg627T{m?X?w~I1%5T# z%k3PMo1#Q7v(d;b)3J>J-EBr#@v0h5AT~_k@`*|Hdg#P zhKiNxSv=RLDlh&bTGb8Qs=~q|C&v|EDHmW_^d$?-GX6JE$P$|_UYWw|A$MYZ$Y1fy ztD(kA@CTK5t;Sk8Mvy~I3UaEe;s=hRTlJgnH(xb$1XA>Lv3n#iRcSu!)JoJ(^`|WFJ2`368Qg#(|Y** z(P8uN%}*j6BbFYvjmQtD#k^kKS8Kh$!W^)x;t%o1Xg!^vWM;J}D5n@He%LOHgW@6i z@okIUi5=O(!`}#wwa|`n+{G6VxxqLFd!sy_iZ2Hw(OY4!!WQ5qBbvUJ8q)`hETyKb za`*MPR~ktjq4h^%+=cpzT}>t10Ptz6*2BU1525P%_)wh?fCH5fm#Q{*PY)*mX+VBR zyeaY)R(e^BGv~_yo=?1bxTR!mi*e5n@d!*bZ)>=>%I@vVV1tcY05Z8N)25>((+Z0l z{*R#=;j3CdT8$JAD3l!cAYtUjo80IlGhIo37-8(j|oVmVe<|%o<0$i*YuXkejU_@+| zwD+>aQEpIsRBWnTW?ZxWr&0U{8x@tOn8tX=Jd1)}zw*?gmoyOgUB$pVqvHB?rveaB zUz@TOYrZO{d7GnW!i|>~qq(=n(}211UB_-)>|YLBAy#OF1fJ@$8BtxTo%cQOmGQaD z5IyOCw$AF4u5zBysbE~*JO89-x^7xf)6v$5y5PTIP>r(WM^`1aX~}wm`AgX~Qm;Q? z3PAGNAwY9mvw&DveS#HXW3JzL?zE*@z!2Sm;C}JgR(LMllW$Jbg0z5wIb(?~$6mXsWhyue*Cc;=4@*_^Zrc~aFJ^Rt&*0ta z+3lS|9{(=P7VDT?UYew#iSg*L_EO=zuLO_jI!%7e$H~Ay>31#9UqGCBHF||4J{F;- zjZ1IK#9FB>b;@GA-VpRo>I$lA2Ca!s{HbVxD73Wf0EY29Z!1dVot>Mz23$X2pVHxl zQ%h4pAu$0$L)h(ccxV0k&2>TR%D2fzILHWvhn(+F-~R*-sVz%H-bimX)C?07uU0>u z;qNAKEMEO_2u)inOl%VXj1EXNNoLEIY8n9d0CQ^dk-}Gsr`MaqIYcv2XfN8EMq+0VLs-{9A)l8^b zH=cm?B?Qb|VZQ^HDiYT=QfQ96kx~N2XKO z-U&i|<^+y3%AHqAozClc_ol7gxjnmQhd3+qev_czxGk6rgi{K=jhtLs9`5})7?`eF za_3F-CcJw@wJ#yQ=%8+U)1~?2Gi`<%3NWLRmo1LCGL%jIOfYlV5nf-FFcubaK2iiq zz9B3j5#V#s!_xyQoUBk^l|IC1Qb@&^g@=K&hYKGsd~sdxw!w^(4!}Qa?^q;~*f%4O zd<#l3QPHfhnaHHD8C15E`@B$yBh*ZlswtnyGoqPVqZ49$_Q&A`^3Rc%<^{FjLTIRl zK+`3(_dV&^&?kSMQA`cK7a$%Bx4JIb1{qaNpZ6^Z=l1JxRY<#QS^W~YNu8b2QzHzN zJ9W-_@j7)8emy4E(Kl>r8xPIDNjIV@W81bO|2CCWg}TUQMns5aM%)wa2ljNmx;?l{ za`8>*)tD&pMd_nIN7gzNQj<0fz)&>ZYAOogkdMx!rhdvsJC0<0Mual~whZomP`DDZ zlH;<`{rWl1o0*kfU3XA_3nyKj$=~^5ka(wO3k(taw+Exsa%0=3R_(Ql5vP!PWecZ_ zWu=^69b9|^ zN$jOwMn^i9!IJuy!4T>f%K}{{pE*@mtI6L!(E;>atXap8WFiVq#_w=!7ZBf^v3tRrSo*&AeD*-BBkKTvo`hFY8ux;|e0NyvwUAPoAKTW62Z#O2-Yj(sr1(ByDNfxVH!U}iqN7h z-H%vpin=?bs%%K$9iyqMx~GA%2C5Z_{K$RooB z947(@Xzgm}&3)CsCwhu*dHdfsr>wR#b>JxWOGHgAeL7DMgdu!^jnHhVj&{yuB{d&oeLo`X70@A8=^~;LU;a5(9z&^a~Ny!XZyWSj9V{{~M;_Rq;Pue{4h_TEu z8jRPp)Yy&Rl@O_4!^kei=6355pv<-&55tF$ehLGVnOkbigre(-_Xp?++ohG2m ztzWlFUh#agQAyBuzm=0YYC0nL3A1_KACP4v60=CZp#}T+NvqCmUlV^E>3(iprpkF=Y1780>oP7sWQ&|)(Gmc`R=pYuPh=BB>^sXWxy@PZ?0qMPkW&;!{ z(mRL{S_nw50Tt=Jh8BwS1PBlU(*KP!pw9p6H`c6Kfnj*}-Fxmnd+&4JeWH>FllO!C zXMj0DE^cq>C0TbcLjXPBg@d&Xm#C4COtQ0+?_<#5`6P4hrilL;^$2hbm`uw6*Zd_T(W5sT1yhJsnnd^5BvGe zhI^%eGh)CB-_Fft@grlM6L$CI8WpVu^3SV=IT8p6YB~b#%F1F}WbxuWQrnZ-vzzDt z-ECv9fD_aS$IcNV;j#s?*vA3C7GHqDvdxczQ2};p0hxR#4@M;gM)laoa64_cQRBh- z;=E2#txh%C6K~FbF41c{`La&0P3ihHx$@loau~0yrL(oD^SL%*NgaZ%<~#uHzgBR7 z(gYn~-cGAdES5!p!T*OYe+ud3rGCe0leu=0Xz!FQ*9qzQ3K*ULUd-98xZZW}+sD}1fNjO9f!31#|>)H|r?dk^(nc{011c5Bf8%5Z} zTfx*Sl@D#|Ggo&|0v;R_yK_Ak&$eLeTy70?z`|GvED%^oJz1AQx|+ac_Gp4Ms57T~Ou&Zr~sP(+lvwazq`9k9p#=#81A6aDsc(VQ~r9#A`ilDY_T{Ryg8sPg<9i#dDxCM=K zmP}wgr1Sl69+!LHw{-Pk047gTDvW^Gv(W?W0lDC~89?AWzYY<+`y+}7&hP$r{hsOn zGMwi$doJ5$l)f{EMPohto@Oe$Ox(Tz{eQMSiS~q#fyv`#uAsiBubJrK zoWeY=v;j21z@@sDxGv*9dH5YHGL&0XWHCsuG1{p{*XDaqt`tVS_228&nJ;#AsPGt4 zhKC#bSrMlRL!hV&#o3SWkkXIHWg;a?3`^ zHvmdMPrffa1pKfyi&!T>$Czmo+MoEjCkh}W$gD~Mh5xtI@PFxp5_$L>JHnHs1bb_E zc6kr$w_$2N=sxFPt-gHA&R*2`zNhq*g5#sgmW zVrwcQ_947}hohNJ=Bp3EXf_F)@VLkT5NkHN;j*(7^gM9k&Yu{}*h z9r`nnpD!U3g{w>A{qU8s&Ii4ARv{pxg}TSA=WD#&#*Pa_hff2UT$6S&g2W{jSH426 zT&dYyx7~M+zzMA8l;QDRh7VQJ2U;f%%W}qU_4lQijb;O-Y_e!-Zaz=otFhee7Cw)0 zfG1Xq@ahtH;&;Ihax^sgN6%^!5!oBq-T61JKVAE32ahk{vYDCi-M$B=M+10nDg8*T zPGDoq$kN3%6Jj}tdF>Pd_8syVuyy-SK(_H+TiZ4m6Muj?PZ!>?51~!0j?zB6ZC`7< zUL_kPQ0{iS{A1L=%o%)wAl7ojxG$Z(Dj^*APjP`TS#JDuCCg%mT7GR;CuP29qvuRxMF~uA_7EH|SgltK1i3+kE`<}RrrJFhYKJ1tJQg2y{ z4iFh{C!VaEjn0tu^{(cY&lm4^ACE>q_;`xOJ`HYKZGZDu*dF42>uG9IY`d1Rm2$Op ztJV|bkBv;msxM0B6!oj4 zz?tfqbyyE=ZDie=1!&L)SZwhxQIrsm2D5^k**;n+qVWemch{-XGX1uB?!5WwF0R=( zXql02Wk7(0!;-GH5@WBnp%|J#lD8z?a+#~fQp**pHrtEG0(~JjeV!7kR~#)V_|zW$(w-}~?QuGSWg@iV4;?Z7@!k*&pqMuNIwm}GHOEYi*Cb%45_obTaSL&@2e zt@1{viKq5}QQD4fVQMixSgT#d>ir=F--fa^^~sW+!vTy~lQwiAQA-)b*GVDsrugJZlW_}?5?Nr+aF z$5rKL*O~zgccoOv8Sm@y1Mno^6u@r+=LSqy848S$H~O93g`wW_$;=vDl71F6MhOG(r@p3+Of4Rw+_JuZns||a59i0 ze0LD;Pd-*Bncf8#>AT}DTZ;>wqQ6pmJb$O!fgZ*=sXovRn#+;_jl>R>;$!`uh!)D3lQ zj&BlG@NDXTv&S7amO_D|`6jm-l;U*D@A0?$2gAE7&3D|lRSS!>BY@9@JQ>mK$4mbO*VwOcTub;9L z@V`edP6OQwX`$G*z*h4{f`_GOZu4k^veI6|viEmu+;;o9HrtVlM}vP>_cIX~Fe{7_ zZ#NJ7i|uIgvx^c7dyB9x0^%!faSFFZo74_y18XkxXJa)MMsST9+YgeG+o65JyhD+_ z^pYGPQyW!OM3Vd2(x-a371}?i?6qM< zNi2bIsfgDlZHFMr+LwUz@F^#q^_md-#|p}3HYD%R<}ICb8+7k9^TE#A&~TU)l*K@t zx#igXqk45$lvJ8pHe8jSOb*!!_xP|iykMtBDyYcbngEnjh8;{*gP512XsHY?cb>q$ zOk73je2WrH3*Ql7Z!J{)+E2wci5WYpw>)FmzWTL4?S6Y45LY?t2vpy z#-j>rcQqEhtgG5iuwD#8?)uHgIM);>fuOx9CvmW(-pOS<_r9kJ?HOXu4m|Ld0&!g> zdVeu*$aUr_gTCX4dnzbc{O>YNz6Narv%KIiDqt2pDN{N&iU5FipcuZ%$-)PRI!0E& zJKnzcB^e(^8azBS;93z&HHU5HTDV!mhMWC4?0oqBFZOAzs6Y>GD}5IBg^Y_A?mRWB_`YbfWaxq7)w47& zs7-N()y2l@99}Oc-S4O|+iSWl{$0@dgBKgrbe?}GNe9$HTD>xfH8>bUvh+O7Jw=H_ z>ZPMnjK*6FB(;=!fv7&^{9)AfsK<=xnVTcSkwC~V1l3&cZ}CtASbf{TV+Psa~ELw@k!twlz4UwUW>~Nc57;CXC;vdKk-ZFggl)Yw6{ zk-yb;9AF6m)3#6oQ9ueMmi^nw`;>G=>ed_bJqcb9Wth3v6;3;O3_b&>WP` zAXEG9h?fHmmr`~=>IVQyR=!gaFQ+!-IJ)?=`U^+Jj%Na+U?C3o*KH&=+f4;F(UzrY z5xrn#tCdM-2y5|q#p&!aOXX_9GExv1$bD$EmX=Vv6ngf#MRpCSg}wg(Nfh`Er5#cg8-j_g!Dk!hL#ZT-6p>?dA;R+AJR7J+ov=fIliF z%Ht-rXULybm61nokGbpi_ndrpD`z=u=}OGzW<7cz`A&`()+~Zb_gesSw&i6p@uiaO z+jvR&UdZhH!twx;w{9&fUU#=1v%Y6AsKz$;SsolU_mYA@a#BKj)8;@b5H7DxlugZ@ z101*02r-u6PWKA|30dVTi*<`}YJ?!cRH zw`5fMNY^lJSa>Na7T3ORKNmWMRi+;&M=F5Iw?6ZZhJC3z+a*FX5%B-=Ax7|?b_G~9 zXtc=%Jq?~uAUr;X`5Q+8NmO&mPXFH#eWGu-Uzv9|GHA&%e%LbBXrymWi{<#?(S7!6 zbl!4MX>BmopIhJQr}EN8dD36z@;QJML@*8)7`N^<#uk^>y{pY{#T(7X5T+to;{<3% zFfWd70+nX3*RR!qDm(`h-Cm6xaES>5gy_tLUzXw%=@F%>kgqN^m+HroAHD-e7 z>04d9c+Ov{%bVbatZm#gGC;|JR+RdfeeH6WfUv0Zt#P$714* z;dV0$&ap*R`qph?M^}257=O&y4WI>@g19eeWj))Z?bXHSNmqqp@+16u>&7?H7?AO| zAq8tn=#Kq7yE+F1a*}&tk!3C=e0)rD5EHcQSm5?YII=R2OB7 z{b_Ig>T~C-!-o~qhpjN}Yqj|<(fiH^A@6%~XWtk4Adug0!ujkgk{^IV*43qzr=v9p z2yck_Xyb8|kClv7{EIrzu04Q7m*_2r+;((5%bKBDv6ioWQN3cEeKoeESN^O-`O)nV z$u2im&mPsS?9cn__>NdwT1yg>(#Kr8n==&O`E3n@XcT14hznKk!W+G;d$RjJ9Q10A z&QV5ObSXOiI|q8lDCZC@6Y37Ft4@dWral~NpYz?l$6SZ1G5rKl5~@ZX$^NdIXJU9{x_Tc%E0NxwSZPeK;8QjZ^$G2);bFb1geBT+*ODMngTw1fJmV% zm0>qdsf+5Wtw|V2*3&nyHLKyqg3hLg_B#4=Ki8za73p>KokzMzk71`*W?&KM*a1|u z<=fyvnnhWJm_T)SZD%OhKQ*2Jff}wcPdc*;58jIF8QxQyWY$(X*y1Jd9wRCr&im!5yo>?i(FW!5)=F zh@R;`zvlYyx;s4ZzxN|?qjnqDRiTog5UoFFw}ixbfhhp2$lTmVFeEdmR}I60&*%jN z+J1>xgU#)xWta6X#5D%OJHGYEjt+9@>gmg6U7`o{Kl|aojg4+(RDlUdHMW`dM=HJx zwQJs8iL!lKZqY|ui)a$>fI0i`I7Z%Uvdk#eBer)Z1mZKLs&=Z$f<7>H83?uml};z`?m77&HBl1zw9LuZM^JKW z$Y0C|)oi!yu$JLe_-^re${xzAY29Zl*f5LlsQ;Si)3wAO(D>=FYuqQWTx)!v?l6g= zWqn*>TscYnf#RQMO#ELVSWP6_Z|lpaz3oNKd$KGSaF&#G7s*?u-qve-KK%hu=`OVGf0Uy^2M;I)3&^-SzI$>Gk;&39Xm?alfzL)bsI)Fv%Dv z#ut>tosO6BxS=*CZsemnl4l{$HqeW@7L#yAtnVZ1t=q=)q1*6p$-}ov6Uhu;N2JBQ z<_md{lHQYZnfimZsl7xU6kTSwzw|O$PY0PvTOgSM5$IF(HI3q;OHF&*WcDiO2%7(y zXrayX$3`^x$(<|0%bAT?4U5ECmsz>KWb&A?oV*uBtE-*6a=u>QVbaF@)%xEmgO!i{ zU_usy^oW&(sB?Ur^JK#vuch1!y*n**b6wmQo3J*>%pC#z&b_+BvymTMXBlI;7{z`$ z`2t+&-o4`tL>P(5B@5?~hW+w5c3zXZ3BDQcdEh z;+@Kr>9#4L_bJmhb#sSZm z)8jr<*MSVhWZ~QR>)7jr%N>6S?fm*E4$-H(=PddPyeK_pPAHaii1uKn8`H28C~%*i*ZuX?KHPxGYnF=1qq-+9IMK4xy7ybvY@ zW<$?-BC|;n-krJQ=DC0H&RY3F*g(yhc#+cUy2_%dKP4n#Jg-_M#z>C`2A(P{333~9 z>CEOUb-|-MmP4$THeMO@MfA_Dq4y0toJJH4y$oV{A1B=o?%r*fygx$0cf&0I19gj@ z7CyL)pG)1sUTO&4BwWnTkC6%Kip%PcyH%9f`Ej6e(qlhnu)hlbrAiOHp-Ur-TWm_s zIN@DReC3;`BvV5zd{Dnk%I5LXTI1e83R&$`r05v{Hug&*FFqtY`Oy_YQ zx0cDeO@pZO6J8pVLF**pMplyk+EfgKP|j$_y(>%?HbC7~RVtQI8_aS$M5UDWt3;v&3k|oRnQv zHej_hmOHrOr88=+O0P*23`tT^s1x_U@ z(1tS1aZ^c#_|UBD8x6Og7Pegrdhnb1%Q@M6+WEL05 zd_N}>u5WK+9c6Mw#Lp$cz_IgVf5UTL(nJ83LGI?{?(A3oD(LFn*>Mvu&(yQF8tosx zrsok+Z_Xk~FR!EA-XAZW;}j9=cwV{F;LqMnjH-}|3PFaZ1kF`M}%ee^;>$eD$V`dk9+I; zkLAXXi#)nM=OFmw(?9?E1P+}4k{OAMaB+4lTmSop8E^2%fqY9$&zBB7#L@>o0;w^9 zoujq|P^YzGw{PbeKR8h4Po45akd%^9+Isw}qM=aCKj#u2|5c%jzn%g>^ytccQ5z7q z8TLt<*?B@)U*gg-cF4lUhX&tY9vo<%#swDeI7F>(a}JcaW0(P;?^L@ zHfGNmQo4#X2S=cXzV3l#{I1Oya`7iNn(`(2!dwbqOPrGmJRU#c!?Vx72ZG5=Njz0F zRr+DPsEjmgPf_C38MPvgoXWOzWceT_Cz^8o`#thEe}uY#vz7L@ z1-Si~{{F?DFP!+DI(~jD-1jf)mxccJ-1mjU?E5s>*-L9{l@KPUDHG!^WO-5;CPc?( zun>n$5$@>t>r+}|ke2b?Lw-?|3c~8*sT|G0Yr!YAFj);g_W+^j`HQ!?!F8*AeJy&mb zWi0^eCT(3lXP+O**ukZ!4awu>aD84MjkLEkbA=g=YGzTIoK;Ckx*+?{xoXFMjQXZW z&~LX9jN;QwqU27rY&N0NGwS&;$m7qlJc5Gy>!ZyCNt5;7<(0&Ngnp7t(5TKBW;F(} z)j&wVt+WD}OI8{C-ZerS7K7xtlH($?<4)`U7Y0Zue?|lt0(AhmkDPp=VWk$H3^Pi& z)$$6d!ZJ-qvR(z$DAQ!2{{2JI2Ee#E;4=U4?!R>YJ~aleOa*6HQ*_XdKTS;lrJ5kDUuYfAXw8 z&hiRX>ZSDN=^`_#fN^eHZ7?x+;<{`sm%6P%6eI-91wT-;dBq8qXX;xq2bkI%W*u!S zL)*kEgjAgliQEM@4Ti{c*Nz#Ei>}{92B?0`rgBHK-oheBq1h^I0ya}6j`{;UgTf3*RO@bReTFf z1>bE+S%z~?l$48NGd@2j6MXtK_3NoEL`0$2<fnL`noat=z(Q?Akaf#V+@hO&1yh9$9!o$82eG z?QI6LV1mtjBxdFrY?7nUJ?hw?v(A)@jH}H zdgF^@v)6AZ`)um?EigZ3PByOVUKCeq9BUve=h(>m05X*a{G4*Wbx=0<@`I8h^@y~{ z^}i{XKl-PeU0(tygh7vNjEz{qVb+mN^W-@x^p-MqAGofjrkU#0dK`FzeFvJoQlpc1;Z=OWO!V&dk=Xmabt|D_X?oW6k|c6Bb?ut?gkhu%w!raaj*6 zzJA>Jc`gWHc!7Wa4ghJrk8ik44Ut^UOcN{<$j*ezYM;h)$bncb8noLt(}Hre^#+dt z{PnCM3cOq}p)ThN11O*k%SE9#1L(zAxz%Dr+xjo+B$?g_kQ8daI@R6$!XSjBc|aE= z7+H&0wp@&+kybIYYEBuwL*4GLlY8R1y!6S+);71C>w<6Z{7xlgnNl2%jdj4+Psd!H z@2^bn0}#0HrJvraS9Om}?KX#kXo4ty3(tR>WbrHYy(ow8t2>t8EzcF(%ktQt|m{J>JlHc_$uoynDil<4>0AJFoDT3y}Q*E8(P z)Dal8G%MAoNl6Q2mW$}%<7=QSfH7NGg5-FE0Mj(I`zP6!*$UKk%|cpptxnNo6ZXHS zFqiPs7>01)$6sWAVvE15!Y8#G3HUSWq7v| zl~#!hc;|3VMkA*j;NqDU%q$~!yCn1j>JFe#Arb+753 zaT@9PxN(l;>wLN9_z1K~BBwh57ziHw^aIWZK*eN!qgHBDKCKZeoB90DXtyY>+`J+g z@VM*q(!bb#S#+@M2EXfhHI{Kp z@;!zX85C(wd9=$mTo^RN{4_z^4zVZ%klq`&K%Q{4b@IFyFWI@ku;b zb&Ow0(S6U#_2TJyUx_w#Xtjc*58%TBWo>ld8u>}2G;UA3N;#Hgnm77qwWN=YKbN;% zPG*BGNvh@`F+3!gFAo2mnR2AETEVDJG9v*YQRlY2(vOXa zMyEucx z>Y8=DKM}oNWZ2r(sp%W4aI#Xj=tA}{+Yh{L?)2}8@CvYb2zXMi+%_;VsA>IJs#*-J zwxyUv9gralTXeCDp^Mv8v9t`#fAC+qQ83Y)pjU46P$!+R56(FHjgUwc%VsQmbG!;D z6GK)q!jq?=p>c^pHOHV@fAmjlFE7N1nqC?WlrkdYbf8q_aQuJc^wIBA6a3m~h`?U2 z_DTx&TWOVw&b&)7s)LfcE<-Xi?jcn=dR}cjl>S@u<%yYJERsezctykmJm7dt7{XX$ zFQu~(n}`LD)czS=w#=dPb{BVtNyVP~Kf5#F)o%ndlwOT2F|!z>gCfp@v3u*6C1M4BId$lOuJO8)P_OU192r+hDjI{lT9l&E@zjd zm)tXp<{!~g<6pP~{qVw|^0vC!N9N;I2z?-ts)D;*lcoh5v}y`9WaBP~LSjg%RTSm> zo5N35t?j`0ZAbd=B1<_GW@jl|yShZL*fNmN9(2%^%)AVHF$Z3;MV9P~&ND%ue)$=3 zlIRNA?;%a%92XGU7OWFhe^a41E1DC%xg(XkxVBxIVN<>ru_TZP6j!s!-$pOQ!Q?J? z&_Ez&(7}Py9GD=F)Z1!}tpis@)Evlp2v@z+^}R4pw$qsMIbiP`pd z_syJSgrcP0A1mBX7qW75^(GEF!%D4nhM!sMxs^Yi4I0p^G%XEH6_A!Z=<$(PP#U&C zxncy-Q-QR7Lxt%Z$yjgkF>r4pA|m{L2RB^ZxBlv=+vv6ai-o4K0u%!4e>;ehDAW;f z_=Wx}C<$>Duty`%+W1%W_bn}l?Q~8?VcaD? zmzF;gtTh7c#P!GVxV~ZdTzev#ZPpHRI&Yc&Cw5Q1o^~r=#B6!1XlV_+l&}D|u=AOm zw)=6|fx18DSAHDuBASbH70QvH0B-rf3n=nYE`5Zepz21{3 z>S}Nk{L84F7SU0lNHmQ6p6&tx^;FO8MXk4Yz6|t!AXuQBQ)e|t)UP_}%gS*ttQ3B8^VDFTVYQJT zWX`?{AA{NL_g-(2B>vOL!9$}BZggCCR{yRhl+b&iN<>^B%8ieQvd zw~8{9Oc0kRudS0x)h^8*y#{&R+e%eVdyuU;k-&dX_)Pee= zw0=H4`c?a7*Jd4r$V_wqLwEQc22S&kN}UOJ^TEyB+h2=x;^ef}PHeiY-a%VnjKPfH zVdU;;(X8Ni>|E-nEE$`C)!RFmNhZGOSXsswz$|9j*?iIPRuA+-OV90L#VfB)oY6!t zEcM3FKu3zw0dqOp{?AOh2ZrH|jdSlS*$b-j2vI|MX$CW5J-7IVIhC|sOH;FT*-pdT z+u-4D5r=}3Qiqj2R@JSHJ%fl2I71rx%sS=)!Ta9xi@5Fn{u=$2L4k&^GVBsu%C~Oy z5PNr2?VOU9mI>Ia1;<;#pabCa*mhsZNL9{SXk*hZ$N>X!iJqhbBu}>}?Od4G#B+InPoQ1_t5Cl5OAa-e3l0V_ zo>5i1%5cRVfzQuWjPJ+p6n7@TLqo}=rKMSKv&r{_D{uRx9;$Xvq|+?Hugkq~8h5+brc?pDk2hmh$7r#k4*ftZ@DEyIKSM5gE-7vSfl; z`sH}DFguunvkFA2VNL0R;|A1x?j5DE)}LPpZmc!2pKvayEn9f@XVji=U5ek78DeYv z@8vPw+|Euexd@Xht*uUr3bBUS3S1J#YCYk^r2!X5e5-Km6PnJ>3Xi-e+-vi{eQWU< z6yI2Vd>4z1<*HWIF>sXYPO$gc4b08XCJR2?%aWaa{SnjU=c^2+uzL_bI*W%;Qc~vJ zdMvXDGp>}TU=BT(djSnn)SZgol0VT74+*O%m%5I!Q;Q|<#!9|9zl%qJL01un>*kJ@ zIx4qGg0+vcX`YpvUR~f%hfqC$_WY%`1Z{R~wF*n;R6Vk(l3{9Uww%ArbwR?IL=$Wn zQl)CZgLogk@7?JbE%n8@$=&#g?$_HD`}!AdN$V9ud>*aL>Rhq{D41WduAa;T7h>UK z5fxQ%N4btZ!|UnkX&M>zSkxlG>sD-+BQgZs^;4$-uOQfn>OSEkTStG(Y?gBUkoisy0%6Eq`#tF3`*+^dt+HxqI^Pn5tqDK-NBPCY3dYsD z61HO%o}ZB5B58z(dV9I9fSK+vBqD-hH_vl7c?&=Jk{p(v&dXz=tNk9^kywu2!Q_)c z?46tpe9+z>pTzra78}D#2Wa>vP^k2fYl7C(jU77iqxAsdo6hOv<%(#bP=ng%! z!X($OL7|z{QB+eyD$&teRyKQLdD$=+Yyvr^I&o#Aa>dSau{bj~_vTY2>qLEWu~lpM z!$P*FhB`Xs+66{gqAPm=wYcSK*BK|0ike-zLeqeoOvxSexoARA#w5 zUv4Jcq8ZQ8rXGvzEn2@MyewcS-U9uS@pSl%ng|-y0Of&qZ1xzgtzDX1j4VHl-27}u zC1U*~i0evXeh=#_=BdfsBvOkxE%GW#gBz?AGvyror%tkIWy5xHlIOO_G=oCkXy3K_ z6;SAf=9en({vjVxVl|)#*DKX_t2T^e4nqc0WMRHigdwxl7|gCr?aMUI;}%oAu*e;J z;%0SOdb$R=#P@e-G};xzi6pPdM@WV3Pc2H|oXu0&0_!hakz6e{#`20SzRk_e#rOC5 z^_187xOeY`(m;25!e~ie3F0kgTlq(7(_K>WI&eMM?#k|(@9t2IXCin@sx@Sr&QHz8 zVCg*s+qHM{@GMnVyiZWlg$p9fC6SaA6f~z_f;b18`vD;(`wU_h7W#E+cWn6uvE$fM zYb%V)7HVrTUQ#@_`GLhlYwFi5^hx)4yP{?Dgaxuu1VU(pvc_q~;_UR6EGqlt9M6}G@JV@fujsBS_$j{olY%l;H z6?O?jX!(R^UDvGwBrGDLl#Nvv)^xC1qOPIga^Pu!{-(h7j-40LwL_74xoy$KswKi~ zq{`Lnk?+`0kBH^qn~02-$R^@s9GK>13O8Q2B^E>Pwe8l<)_ySEkd;cm?6g8whrMBo zRHS8ANAH3f!>*5#IBghXi(NV9yQRjH?R~vM)6z}}FXcx{T3V%m6xF}StyJva>`3t` z>h0~-)YXC;AFR9UmD@>8eqWzu-!Z_r*ZGODh_y^PEU>%#>K1niNoQK3>&Yd08S4D* z!8zgkn{2>9H71wbd)Php_06{i*|l2;dlnH9^>fCD?$?ttB|}1# zAe-FW3s?Y3;8pU>B2%xvy`S#Ox@^6(Vanex_?Lf8Fpa2ux%YOJ1Rm%J{FifwBnhJX z{kl8Y!)>GMc^2UJlD#^qQQOh>mO7U4j4faQ9Amavrf=W9xm;c1)1(}7O;k^C%)xc?d-jJ5RdWg4iwC=sLSR%E$#cKb3u zduy%lE5Qb?>XgLhefr+p#-*9bE;aFej{MXT4liwQIl7tr+|kOah<1CK`ywSJt6YMZ z=Lg#Dj+Y7U14>rT2e0WquH3oA;my0?>}Hl}-5MqLe9dz{h4SM2 z{-1Ph+#Uhe6tU5}_r4N~IwVc@S{eIPQQ=XPkeK-L9_-S-wd3_Y7HWR7P2aPZt5NyH zwBMgMhS9Oh$*U*~_#Mvpc2uKp0{(I)50;%xvWI&<4(gxO9KVUkXLnmvf_pvFd7lU> zAqwGlDdA~>EQnJ0T~M((`Isc+K~PM{vm}O?|5VvTH&z+zc`iLur7r{8KTnk?! zr7lyfSJgI8AQUE?M;wW%voBu02H&Ip#UI$bL_-6``d|~Q7CzuMdKGZ^sa`Ym!UDB} z56CFB_+>hDljK3@T$1C+yMpTP%Uk`Z{p~GLWs6rU`*S)cOaxQq9w>IB+$S=<>elu@ zjR7*ErJ1uy~tekHj7&q?}yGwC1cp!i@aTn2<8^M2f`W%-K^ZAsG_*Y;5N*11XLF~2OlT){_ zh?Uq`harZVL+7oSD^B~pTd;#&IJbmP;- z-mnwS%gZMwUV=LK<==Str}t(}qOJ#VE})mCz$Q<_)(bo-F%l>creber{fiXEebIp6?h)opSNANngp*Unmhy6|hbse@SMZdDU@nBD!?|HGL+} z-kJ_b{wH_yBPhuCke-qqw^^cCiR3un?*28oNQh!8CZ_om~(6+#LBb}Jv z^#1d+=hg#V5Fyvf{|aGNNx5?IHBOq>Tv10+(M9!R9{}eQr^Xdiwa2h~cOYI~rJij9 zaN}~hYXUZdBc+&u?xB8*eD%whZeGZc-aSKezH zsa@q;L8E({+H^J$WnFZ9`Swq#SMek>>0uH;zc_b~fn_~IbuA#xxicA-m3mc$Z4)=1EpkYA>R8V4@7DUAS4YV`Zj%vm;WdZ$C?KLRU(&t4X*oeg|;v*>}BWSVSj z?ON)8{!~GeLo*ISeAa_+68JIq<R}|a^QnoAE%!wufzAS;ir(Ms<#|N}J$deck}vf2>uwE|L*rD}YJI&I zjQ}|Zbc~UP?kErl(qK{-b6APTbcC#^+xMU7?n~xO;b=UX)f8u{Z~Ur$<-Z7+gm zSTfq*Bl-`8P`8B$$E%aJdh68`tHoqo%QR;fziC=G|LFVnUX0a9 zHBjaXrIl%hDF|QPjXToAN}yoTz1-&<9eaf`lk0hX+vO9{8RF!t$U(uAe@4r*!v=VP zFDJ&t^cC-Q+;aDfLCegn6pgty(BGc{Jf4uNyz&hVk-K>c3Q9c#I(~BVDZH{sBlqfr zM0es)+uV^Ob3xpeoVoQxbzH6t>1p7d_VGx!ddU><@V$_VsppnD06RSOSVb zFdKK73!+dy;TuWq<)fT3J~^4geURPq$UmKc5=MT9k`6PA%QR2iQ{TFX>?R9tqKS#X z!$p7mS`&Qq!1RU8HM; zUiRIF$!@eTGd*8>!%RD2|E$;I@5sOTF&PvkkERlzS7tWO(Hl$h^D{j)(9$aI!fOqD zZj!x3Nme0n!*pUwSRvLo?{Et?ak4SMWFg{hS6>pZa^KgM>Dl1d??zFBD$gRWexGm8 z3x5CD6^}n*RFIijHsM*%6BQnwpPP&RG!`Ogl-?5Ah%NS$3knOHz$S3(l`L>>d+!tf zK`LXd02}x7%bDvG7k?_j&CUFDtiPY{5ou}{lDUG#fS+v6cb)8fR6nY(xXXH@sf3jJ z3!p>)X(r%#0;*=Z(yT>Sdn4J|G)H|W$)|kO5}ROQ?0OsC!5V^>EeN(82`P;@WG{04 zqd#-9VN@V1JNJ+F0hy3y4O6jS_II<>mot4Y{*2Pj zH%Koka+;l=C-vwYPvdQ2mD@#xPD~tbC3$*Q-kru@6UYVnw9v88XV7k}MB2_>zk4h@ z`~>m15cTdkRXtk1+LbDH*LfO2;tp3AH@q!SeT>oPDNHWE5`eZ zH-a08L6WnoK|#U&?eWYTx)!=IB##%SM1fCzYsOg;hqf-*B2{fAC6gQ}OxFbT8R(I_ zIL>N)mo?}ibcrJtI1;K;ue}Xj8=ygNLe8j!@T@QgihCTEl)G=@>>dn6?~+-H44tY1 zuCCC-_I>W-bOMaAD-VHqu=H=KvenB6{fLxboWqOq#6OGC#qh&wpjfF?Au*TDos!Bl zDTOw7Lf!(c!Uqd{9f<&0zdwlI%Vs)1Q+x-iVQ~?Y$$S z#GZ0-bL(&c^5M$VQigOF_0lhe03hZShj%5+()o;8bng1oO$yES>jIY(?DjgJnYH)) zMg=IMhcVK4W!tEXuhmXY@L%zuolNs+R1TR@u`XEyq%Q zoEz5$0|AIW^ z1dfp*)C?$xtx|{2*MfpV&+3ObtYm$EHA$xez)dz)gpSKlViMu>kz^BS_sK_vSifHz zTt3xGgD%GCRK|L~jV)LHk=~*Fw1fBWyCSGWAtfKGv^?LaP1#;F=^0tpl2d|-c=^x| zyeS$5eH$)@JOYNGVYnzf<*y~A#dG;oe>RY^1_lK!y)6CzDKP69VduBZo!^R{&t;Tr zd9wx@E?9wlRAX3=xx2{EUTHMeTa4$YPi)`ZSyUaUD^NVXNH*VaEm}yl+CJARP!pp}=sf}yCivyc) zv0ph~J z+lAO1@oeqrSmaGjOs3?^&w(Rj?JM;oTn4maPx{x49iqHS9s4fv3kVR;jeE|YK;Sxw zPZ(_}7*{=r3`_htaj*&XKtBN{kO0p(h@^RA52$jSQJzv_`6)b3np8*YT0?p9SFsW&BPa- zha*V4zCeZ8llR^eoLt|X0?5u{-KM@^TXYV1`Ml6mE^7WSrK!rI%Z!Nq&fVvQ6Ii5s z-7ZDL*T!bdqE=WFgPi;WMOAAB%(K$^ zcMl7N2q&fKMP2}8u)LvNo#-|avPeD}29fVF*XmKLVG88s-O zSa3WBYRun%Q*7W;4=X0FXFR_WkOusV2kzsJ&UH-|T@un|h+6h-MIWEX-9oom)xyNq z&jFixWvfacQOUS=yKVztZBOS?aH4Xh3Z|+0?lK>;Z@MRfJeK&2`%Pu)EZ}3`wU*e= zV0@Ys83|=h`3`q-dhya$;&J&XKAp}--y&I9^yxU?%W2|TZ=B!axYr5^WTM8XKwja0 z5cVEWO{QHJDC#JRB4Yytfl)dLDAKzkVvt@1fgngPp|=pg0?derG*LPNLI_1VBoqY^ z=`|p|*AOBl0RkcSiSy0(jsEwp%UaHwaYEkqJm>7Q_de%s-+RX2nd*gJ+a+^6^-qBB z?-lwD^v|A1l3z@beX2xlJlVy_R#jQPLfK9{)(QC1B^IWG+m1-Vy+RhSYoQc!Nc@|4 zRubFvhz{6)4>lJp`t0ko>bQST^X?5>Thj{O9KRqi*deFNshC!(Cm zMZj6Ns(M_n^rF7`Gs+*{5$+$7!>un-l=rKZ^-dcszSQn-wz&b^2#nVso%}fU>}=i^ zm2*^H7isgx^1s_ghB=B$*|=MIJG*{w93DU4cFEns&^uc@O;R;vzp0prhmG?#Em7sa ze$Kv4*`QL&b*iKKFJ>;~eO1DpJh?&4%?&9o9`{KGnSRM@Z23ixhXLOTlAo(rq{>_j zqqs$=PVG9bNZy04)NXdIZpzKf&Uypvfdi^Z!9B5>KbF2FQ-iB?M1X#kwlfRc!WNIc zi_=NVeD=&g>XKw)(&BBoy?Q1fI3Q`PiNtR8iRUk0u6QXZE9-1e zQW+^*xsx2%Zs#fkcydOftIN}|FZ%>|9;;>DubQThC&A~jVTeJkbjyOp15!31X0C$W zuqC_ZeP?L})sWqwOyvin+cvz=ec<>|FnT*p-ltPCQP`(gCAaZO(74Z#E1G%$duA)f z`R9>3fLM-8Hu1=;!pio^zsngSZCmb)tz`jHGS-)%t2S-g3j=kKq{|-d|;q-Ca z#YaqDKl;mh8Y-o#1`8~?Awoi5vDqGKO=D;1tYCP~Vq;?raU*hkYc1Y{_Q&3Kg>}%NCQ~bfjCoq-c$^ZhcKXHXESbC=O}gH}YWD z$@msnl-+Tw0@1NmHkWBf`QR{}yTsDk`Vy3IHGwB5JKJe&$D?ViHwGU`Bpp=vKw-&QpS`nvLX7RSYF$<6;{oY%Ct?yuZ1z~= zE!+8dMlW^sN}bnNW9GMouPYgs*=upF`G&fam4oyDWzwd*biU+_uU5Bqe3OK&DQM!V zL=H7jf9J)3*ShiDGO$>W$hdb(?N+vhfw_lSIabs!+OGkp)uaplhMy8bT9d!FLOz(? z!HL4@ExDX*{?Wqwa}DXi(za1_hE?2;?%-I zAkXiDa<}w1RdQ1HZ<)S4VVEy-ANhRil|Vmai4c$+Au;0U>H+`eu{4&FV5oa z29`dgZMa`w8kZ;&*Fa&dN;v)Md;d7P7wBLe-|%j~R_=p-d016)6a`&mW{KYJ(dK`-y}Zxx8N6xRHp$DYzMU-1wY*6p z^))QiW-cw=g~Vc=u=~3wD_l(Tn?@csjdFeizMv_WpDEBAZB5v`hnb2*73+A*2XR?- z7b@}{%iEmFWIMcWu$`ZpEjkesjJ9@fK{)e|7ey9f@HA}-{+ImBZ5TJ7Q@dou)-VHV=obXl5@wT*Tz zt;Tws6+I^SE-}$EMNXH?Map@%p23KNQLl7(ZpGU0k(iDajw>(n*l%quQP(mCg@gqA z;a&}c0kbU*V@nUk*-mwdp7`L*oHx*ux8FE;ROsTVV@FBLg#rcw|Eq85>;Y$VaHq@- zqXRDBG-ZB%&&aaAVR%1H5x$fO9Us-32bYmz{PV*&{ZNAS{1m>3{%n?n^P}ogp%p`Y z3o(4}^XiVgv&zI#+#qKLu&>ol@=b56_=Vl35iLXt~8DA|e83@aQVrl(S zB@nX@JVq5h5fxUD{Ju(p{zg3HxpQ%4R9}c;ZwEuyhe}Cq(qHV?S%K+_WuaP@Z zQBf<{CX-_vCk$veJ4I)~ajr+k!e2W!2vM7AamD=>KZ9XgTdRp4q{c-mnWt6be;fSc z#s1Mr9luG*du4Xx8Sfgc@nXfg!v~&{QfBAb&Sv-YSRJLOZ^b5j1!vh)vF`NWu6S^n z-ZD>bdU{=#!<NlaV-{=K|6b$v=>o$|3UggsNYcaS^Pp=h$ zEvcriE{6eQ$U<-Y+^#~G5qE-#v2R=&irjiJPIhwynfEjbZ1#I5u04aPa0x^k50TK$ zp3+P7FTbvf{7|hK)@*B5<|zEHgMbTi2>;1?Ntba>ob?pjMP*%&5OsR|q^e1Rc*55msSZM5{RmjGk zT<(oM<~m&RAkqAq-jO{ud5q>%`Nld)-`u5q#yV@1))SCqutMAnuA*rl;4u$UlP&M z-(ty~iBV4csv^c-DG?_ZFWQA+N7Ut1dlTvEQMGVq{Bf41b%d2=HIxBEIx zc!h5Wt51rWBA-7^C%@_6B7twp3sk%6jeR=%?nu_3Iz+@t+;=NmcG_aCh66Hj;xDKi<;FlSNC zyh_fO_k8n7k@3!=a%c1A7V{VgnhyvTWgpB(}3kehka>ktpjD`Vs1b8BmvQy*1` zc=keJu?EfQhY#^1Ws+<4vn=SDzKeKETJuo`z=ao*6yY!Hp>M80o=4&)MQCS>|MhIO zYO1RR96Q_@FS4T4+J^)bZ4!Bq8P$fcko}x+Ce94UMV(jCRf%!JN9A%k>sy!%+eQ+L zk3gk~t+!C{G`!HNVc@NxbZ!#(Gd=w-M$0j8u`4-bEIQJkz z?Pk4VPo8`#_|K8(UxHaOZn#O^gjc6G@8MI4kadQH*Ct=>$^^j)`Pwcn?VqrbblbXi zk@1*)B7?V6=aB>_aIp{yMw z2o>qA19%z7NH}va%TSUmI3=0uKP5K0(6ZZ_kE+)&c(X#C(f9EK#Qb8I?)Y?|$o<&- zay%wp!8Z1tW+rVThzIVFQ~uBu)S*9ZG`uJ!B}Lo)!?L@vJbu#BYR@A6vySXTi;IhI zJ$cFtVUASO($bRiUwQ?2l%!6I_u3+QW2622XfYJE?Gj~K7g$l~K-*7&;FEj8r}H*+ z6M};3ux08@yF30|e!c^xnH9f>WuCk0XC zwN2V=Rbb>2*JVkUwydvx%;HdX4zw)|C+9v*P)6uhWtPPJ?E{rj?Mjt^h$(HmlpSE5 zhn8W*4MpSd(p3cDGq{2`kZJIRWnVm?TSM0hi`G6YbW<&%hzb?ingD=JPS3`~oRK5c z{)L`jz|GQWW5O6L7cwnni7w{uFgigxT(H7>Tq;=z5)u0m=u}pwJYf zhw-yVB9Rb){MlqaG_38-b3BjcnsfhxDyCRC54x0Bsh{F{$DiiEQ$4hgiwMbWY_x{& zEhHBkZET&y<3WkmnWm^dT4|e?@!@Xl-12hfn>Y1r=@Q0OW1gwtZT2rQAs!Hg~y1(UcV78sC8;_^PNhHy+Or75c zwZM#34lQK}|C2Jnx)TpO+TMI(^3sn%ALFe%pFP-QrWh@*xuOe&l#jC@B4_;PutS6UTJ4)QUhXIO|L3Q-1VCb$|*`wQd3e6?srtR$$DKhk|8}o z(S(y0QXkRN70wfe47g|MS4tzhu-w}d?;;5GrY73y?@GACzZTmwMbxMtNnjR%X89?- z&1JDn&e~oGE(F;S1e)0SH%#OoNXD!*#^dXtR{wYbfLN;*8RFnU zc>-gRE$4rsqpK3yz~i{NP#CycGAVshhg{Rqp@^ouq+h+Ms(yj_0l>QX2ORq#Z0q zq)c6<5=<@)&{KEs0F)&hu=0qwhMk>DKI9-7(vU{d<%Q77ZjhZf7@n8IVMV8n4z@l$ z2@mIftT8OBUXTAaKCX4<;pG(;TL3c*L0YR}-PKkD$D(tHdT*n2TLgk2@5m!*4Hn+U zM~{Y?RbItr64EfR{(wa-Lo2I{j-z2@9CWg$()A)~y~0^KZ5PcDdH(FB>||Jt_BnpO zd~52Vx*Ll}3N7mMHNlbZi^@H1&7mnm13|G5#$=z7-8`}<(_2vMB*rt~Sb{^wU_}?u9 zmxv^5>v!|hYog0vS?af)^k+SjDm>>)#_ti2jMSPYOTpZ*0g2sr2fex##*55om8t9-&FRyZWki;zN1HOo zdwMd$!;jTaSqHrMG*bhM6cv^QxS(8&oD#Y~l_}dcG8vNVI00^5_KCmDDyz`RIY6JD?Wax3uvdyPlSqT)lHdq?m5--AS)}iQ6|Mh z<&FkCkm>ij5xZh_`|p{>Oy9SjYjNIMIag$bNunja68yAdc8?je@wJynM^}Qmb?bT)09-CcLhddsO;9c(sx*S4-PH)}zm}pjSo+>?)pbt^! zkR~Vy6D{RBC%W3faxgM6$@OuTmXdF>E|Dw0*WQK?;gq+_o!d_cJu4yOfw4fdR_}k`;cs?@4^ZNST;U zYVQc0V-N07tx8xdW0}#7qb*zE1RfpoLfGyr&-w-lnUb z=3{7&0f|;7`Iic7D*Nz0#TzGiBmQkd)^4Q9l9g@3Rb$kk%Sir<@!=#nSqS$G{qw5b z!(ILFRdUG3B2;*}U}A4?J-q+`x{LR-{rx~WoH)2rx(wA*oab{RxcpUAk1+x&^Gs9t zauUj}(#h>vtG7@N*ftq)J5CeQfy=Nm+X^!d^7z=;dFc-gGZClz8mN?+&yHM&7OYBxF?3WP2Fk1km|!CUptId_mU6xcu#wY)oq>KOLvt@c5=pz7{PY0 z1Gl{Q9$s4Tnt(1BLc(NscVV^&g)Hh_ty&P^=hp$a76^vRJu8H^^K(}N6sE!R{~zc`rqz68jE8z!bx zQ-f|DYPq+@X;}*SEgM`W-I6$YXHWP&tUQ~W>#U!TS6l=J6S%dM+4Jgm-WM0MO0v`| z9CZx*t7CJuI|lOMX_HjKFJpq2X>a%$)i(K zfIS|TwZn282>_pX6hD>mmRj?n=4PUaxp@d>hLmhL*^_}E^IWc4KcvR5)J$XjbU$;C-Ut0_U9I;O}{3O)GM3cG$| z8o9L?#g+BBx5JW4N_u4L4A4DKYkT|u zMs}!FRmdWeRpogEJ`AT+poS!I&Q4CT82I8rY>cpIx*L;jY&L*Y->5DUYzZkr9%Yi; z;VsTh;SzB8!4oy~0aR0W%J9niVAmnK4EdkNZ~^EpxXi+lxd+1-70tV94ocROO zX;GOU!}WBm-^jv^q+2EzEm5Y_Yv%NF79BTJ*%h4$6kn;pA{_ zt_+F5t>bSsABrcROpfB^d135uSGVi{Rg5<03L)35I7J8T-U_ZaZ3rPzx8`OWUc;E6 zSi>O)(gQC;Gh8?Am^fy7NZ+^I9bnp{?>OYeeWpHMCaz*tRcGn_mP~VTmI36q$^aN$h3~cUhh$w; zRthe>2*U#kAI<$sa!L^g3?6UP#iGkcY$^a=$+2GrO_}EtSJJt<`@erWB7xsO0SHu2 z&m20lCWmWZ`}+vSH@JTIG8h_DSqYS#;|A4@s;YB@ z$x+k9AEgi2V=Bo}Y_gik(y)rEZ6K;`T^tg6xGI3}7z5JhbLOE0{G`|gDNR6CnQi(p8kGtd*TQPSpFvR+E%+m!E38inRHcYwgf!0>$F+qb0;3mfgZ z!U|UhChBoTqg$WPg}lN#C4j47UJhp`7+R@t5xIJF0IfAr#{WPnxwD>6Q1B+j#^w?! z>Nt~^1IvZP6&61Q0SI~x{g#bQxmvY*rHhuyEsp+z2(^>b6ob5tHqJ+}N!>lEZ=9E1 za0?)1u-M9l<<%E;SWzBX5v>l_WH5$wu2vGP;1)cfg%Izrf6ywXL_A=-Vi+Rt#V6Vu zBfvZza9`-q#ZiuqWNcQ0D{((GlunU&AGZhqPKH;_?gFm-(K5sQ+}!XUFz1$w`xMr3 za4FwiTXWO6w@{y}lTPVV%8xlR1Fh8*T|Ct!A>rs?DUwy`x@>T1@}` zyv)6q2{fq)r|5Ym?+{7-vWuF!8g1fmD4=iVXJ$MbeTK}v!mMrfmhpZQ27_sJptSa4 zjeh=ofKl2!2NZ{G4iZuiLRxtZupuhS2-0w(S*`zD)zE&uLx&E~u7iw#%D6YTGNN#r zCV(A~6P1^07NLEgj?m*NoSbVLq>a_@W#~PS_*G1-K5*&3|k|kgpt^Kwb=9Q9GRIX{S0uK4lP}Li2fE07JmW38iAX+(z{X~WhN?6(K6maXFFe-R z1%5f1wSAi-30Jr^SFmL*f>=QB_9VEDm#QTsB*bR7iz%5Ld-|#M!lBg3&Z@~wkqess`2QeZ*Lz2$^X%mr=?6xcf(N9-8#3teYDo%K1z?su4m7iHXHeBk~7|q2-OYR8uVUbFIpT4Rv+1 z>-Ie7akE)HAFO~nRzW7DlgY;t;^Xr`0~c0Ol7WH2@c!Ko`+<8EPIb-JdTws@9Y@uk z|9RZN@X_taOf8N8=4}S|z=YQv`sCN#(4MosRmF{0xKqvbhAM;SHHHg}cZplrfOB8u zFqfvh$<+a;uF!7pe}7W$05Jl+`p!$z?wb`NuJqPIBM|dkyF2>UR?TT*UMnPPJ}?$m zezeDjmGRioqep4$l{=iNf?jC;ZKu%HtHxj-s{)9oRrn*r4#r5UZ~>LFPxB8@?etsK|`{_$H~EEpwEcC+-H$ftHCOk-10ptM#azDB_s9@ z1SBUA>PRX%Pu^XT{F_bANL32-(@y+$?(bXharqZAKlHTCHC74n;0&OVRY>^M4d%GU zVeJe8nr|Y$r^6&ZK+9uuwT%gu&$8&o-}X8vxMk?40sn?tGpJxoyMLaERsJjH<>+ef zSMAT$?90paNJ=l&uUWYAANoSlxvx4VDMiK%=uFy0=T+2Yq;wrS^3J#dGbFYw;+CrF z1!lH)OLyY}|0S-_D7(i$D*$xb=h!ag$-AW>w?N;T`>>PI&_I3(5&~3G-M}wyKrntc zGi#j+fWT?rQk9&>cUMf4u99{mgizjjr5bNBzV|#&89sk5f&6)*nD@P3o`k#5)9je_ zBa)A-Ug!_G4sKL9g2FUk#{X_Q1(r$9v3CF@4S*SbzDT;1XMeNZ|5KG0MTIJ_!3 zT|x22Y=H3JHZ~1pMHH8b(j=09eo_wqdLW@g2f=7!(#5upw%+|_Veb#68q6poXDL@K z$zu4268R^Wz|*pmM|&Kr(P*Ko61N{_UKXJjy1?9O?QzO*AKMW=WrSxCB1;w>ud9IG%FDW!UeOD(a=)+Q9+GSv}&sXzp%`Q=(6_TdQM25G<0&& zcMO0ZNobtM;bsf&(JGpMe)xax#H0(=Ztv_gTGY|(`E%#7*{j%mpex4$k}E8Ua*xMo zI=a-f2B_G05Y`*8XwJcH8VPviKTz0w#^sA`-x3NpzeMZJ0H+5laC%%&VVPQ4$p7mtMI@y|zXHR{|Ew&FxV5zlUn<(ZUFq811L%K8P)K+$ zin;Yx3|V?K?*4Pipu~_FI2-VBuG|dB>s-H}Su`V*3ufWlTSJq!e|TCNxnXVN38`5_ z3+Ekxs-&gOCSt-uW0o`I%*(x!Q&MW@8e|HLn89`* z0g7){Z^nlnU2s2TF+3@DnC(Z%e6&XFdF4lc0-6hC>BSEL?aZcy#y~-K`268vmndyd zrry``iLylC2_scvCeg|V!uE*(2Fo4#HJ-^&U;h8fhPEx7TIu3?N37q`7EIYQIQx+V z;A1v2Gb`FE9Q`3WFD+bUj$EJ+oLx2V^`{lM%mc|BiELGx!1%$4(fC|>SaObsO-p4U z6x7ryW99%~D;+V)sskNDKC`Y>0MuGO%*-T{8a6L|$%T64fN!g#klV!^RjA*5Q+=q# zT*k&EOZeUp(?oIPdre2^G{1-3N-&`*y4&Qe_$NP$LrYm%tJd5C|2IT$^uKT0iw9`g~1c~<{MM3u|vdm2&ArXZlLqrASeEXtlc#pSh- z2W~^GH?c$bkpvsZmy--90nLWTe|i7KH{Hn0xCkUzV11|rvTka}a^Btus;Hb^fHHY6 z#K8L269t9i(I8{lr*BUt<9mR6Qak^%Y}Z=}OB#1pc2H1&ph*ReyBkKN5aq;d6X+i1 z?Abf5ot=flNoACh-+)u`7n4q?Tjzfe##ewa8vMh6=)?=blzNp*4;8fjl_lXgCQyS$ z%hc%8*`w0wg|JvGGB4W@>@RiD64~yvHTwt6c_i`nJR94)?;mu3EM|15YC-~f@o_{v zOsXodlg!9YTsqg#kAYDwL`6G8!bOCIhlF9Z$lXZ<&~Fq3*2=Mw28oHV!CERp1mfxC z)!)%B>f@=F+P?Gow%QxbHtA#|-TQfd6L9GEq*qm0J9rGK9S4*Pp4Zvtheo@Hb7TaB zL}QApqCv5%IA1q%Zo>v(WpjNYRP(!xjE~Gs&&+^+BJ<3qGAuIkUfHXjeqO1{;)AW3 z8(^A2O(2dyE!|G;3?pw%LRSVK6ggMESB$nrs6K7eXb030wq+8kRIlV}1}nK=-Y^p? z#AMXkGW0+ZzV#|P+AkR=Gq_yaV5Va?P~0wUzlHoP-HIoeJ(3 zl4`2pcV>XPU}*h|Z%xT-5k_)`riH+bA_B1}j(Xtd(3X80Sf`d&#Sf`iT3SB;>!rS? zw_)<(1fEt0386nePIBfwVmO%~|Dy^{?V{%j>AR{RcvZr1G4+P&9SX;=QC`!|y^mb`#eydqsBeuHZdaxc^zX^kG` z3kW+Pk=bKk?n`_26Ng%hS-3tP18c{#C6x*IDDK40%~%iQrq^aYe|{v8K+&miv_X^R z=QLtLp%O2lbaR`saT-Lh%IcxIhW#iZq0=Ly(G=3lI#9 zv#=32Xl7XtEv_ds0d1}KF<18qrjtguW?09m?ef5;fF++){&FswdK2!o5sZHMAESa) zHxL>p(>wc1ZG|iRU@rm3%)=1?Y(>oZ!uDN&oYhK9^lOjqUf(BAPdYY*m-}La@f9XZ zCQRd_MHPiU<32Zto%>;J-PGkpWcNas^K}(uMYQezJP0EP=A84urf_2RoTS&n3uXcr zBp)STu)EnXWC9h@)pkn*NvFvllp<>l%3xS(_IId0d>|cCue$fds~g)M zau5fETh$P-BG9{)&^+|}FB4Vn9vYyjbE(!BKb%Ei5vi=og$9+JLoL^e*6dt?hw38` zbqkd35Hw}*L5evLNtW*J?j8l>e`0w+=E;XBRIZ zvKVpF%VCS@eW8a+_{VXJfatljg3K>+l;W3`)(HtZ-~~dJ6nh!4*aEd52dgcl?k_e3 z?xhzCUCYo(#w`^96NxtkJYg}hx`zaLK(1|Uc0T{}nrw$_r%jFZJewkMVDt2+iWWIw zjkx!EpSia0A1{FDP;5@S4;A6J0=y)?ti^?e{YRLT-gC$&DYK~0&(GtYG947g$Ik~Y z;!UullZ0nO{(J{C{iBQpq6MZp~fBFEDS2`aGM2AM#GUe zuZv*JLB&;6;$!eOVX+FQPPzHTWbD9aDh?b+&dk*{6{KYjvKx9D4Ga^p1H~|CCwiAJ zqJFGafg``bMQYm+K(B;^L}x;M%51QIwFn$=f^BwXsoq6^R)9DneF?4lv{L@Q;e+#u z@hPuca`N*v0(R|83kMA*aCy=bWDKR`JMhj|m)ML{=zxzZ>P~6Oq;7vKF?-;rYn2gx zitQ1sn=;ehPgVd0MNzX|*>V~tWc;ea@_kv^0CHzj0|5J~^u~O32VX`z8(m-8O0lf; zs;BEAD9gpD_wS7xY6-o}O>x0Rz^M-gE4?|*Riupfk?GI)m73~^Bg7>XYPcr~M&4*}8n+~~e}L1~{S2jv^NS0yJa zQv+zNfJ~$1T1N(x`wn^L<`yY_*TLhoKcu6>MEjDWqOOVU@kTW^MbAf(o4FR=nfWLb zSi!tvFjxRQu+6FDTgxPM=UnF=fofPE($It^u;e;4y_bOW6(qy@K-P8jpk6?tw&p{q zr~$0=D%T}nA0H!c!}u9`ram!3{XLLeM2hNWl5mf9uTQ5jMv#HY=KtLeCprrgf znT&}#xHA}U7fhKt!m!leQV#-vHWWdLI@p|7z<0JfGMAs{xR4{bn4SymKpQDdOo*h3 zKo*`HuG?C1)|f;a0sZ6AHP!(!zB}hy_?I8U3BC0x=87Ai<4C(UccKPv=qUBNq=V-6 zx{WW%w9hX*;pXbu-r6#BX$Ve|P=ff4N!@dEb89J_z1_A=7-|Efg77CG5YP+(Ba%xu zJVDohN%>{hIFOa@#%fMa0~tCGs_afZ!IeHJmjIvg9zsmW#wC<^SDSS@Lb{!C(6 zM8tB;@X^udKQ>WrIIQEfBktU^jU;GzitS{f17%1RPECbpz#gu|y1rvMfRz{^Y zOihOacVRG^Mgq|{vaL{}tlp#LuhY&G{+k>T>C@)s=HA;DWfHb40iIqy*yjl-A{j@O z;XY&y#sx9`Qb~0M{+soX0;ESI==<6N+0At#4LK(mcYdHTx#UpBjSUisk2WzP_EKJH}PcO!Xg~(6*>cqA`74)}o@KWPo7xTwI_K{f6LPwi|ZY zX+ay&W|jN7Q%T#(`&C8tWX}Nqa;3Zt!<`*}9F$P|-ZHq32U4#XL|iS42F(}~mvzA# zmKSIV(#;@r;ji;R9*PvJ_g#W-{1pL)4xfj^2lBXY8ng_qj_5x+YXL6bZ}KnOb62U;o*891*^Qgf^#zfE0o7^Z7hJ+UQO#x zgY*I8+eo!XSyO$q5;;^9vvn2@U%1dp6MsPM?1EYWV+*|h_?eoZlHa9)p`ySo(SftP;8_)~mL(MD} zR=@<+W_4|84P!6+n*iWU1e6;xhR1Hq=L?HfM2uc?9xRlW`E6_f%W15qSMu)N6`l4P zdB4@zX6urwr%w;lraVd~`*n|(ooA6&0kY!xQRO?JsL!3>?`pJiIoOQB|EA1-NvB$H zAd}M94s%+MwM|m+sJ#=-nR!650aMYC_Gt&MkvIUOBR*!o-umvdznhtvd6N+seNHLL z8Eg+Nl#86k&&@^Rry=UZ4O|YAB?T1#?M&ps4h}jJSBRunMFom*j)jQu-vk55YMot4 z3WAW{-k7%5R%avE|I>X45<4p*aBulFDmDR_aRB}7J*E4P83&Ik^_iB1u$@uX&E3vI z(e-#}^Xj%@u}0vMfQdr(Y~FchAr_V&Me@i>zOd*Jn#f*$jW=ibzJWoUl#51xxRzre zv2&Q=)bSqM)_xys2i2a?btEf)?I1eDPCPDb^_Ak~6Fe&4q)%k<2s|-6gnN>gXEcT$ zR@*DD7-?2&aH}L6j*g(MoYippy_L5rZs{F9bNH;(nZqX@y9UOLD_C+SU_e<`lW;8sw|=|z^MVzGvI`72J_B%_c3y+o)lvhT}F{6@-%yc`dN zFAlO?CK}tmY}oZOx?<;~Nli=q{i`D%){jI}>US%Oou;3((=dT`q?$4nTU-GrSZDA1vI?JQp%BvzWVOau3klgRq|`gXIN*==;R;z0-}!hlbw zZ<{MfH%mRbFS99v*gmN+9jsY6c!xqvXjncd4yqZI)tUFKDVMazs6#cqy^FUKvtv%2 z2;6~FvjpS#knc*t>$h?D%(g)vKR&_8h>UA5UaH3sR{Cq7dN7{4Jr2k#Fy_ku4#)g} z21Zycn0m9?zk7%-bhBx|F%Gk;qpfYY^ZgnJYHvTdTR)I=IKHnBUC#yHvZrQOW(w5v zaT7B+_d^SrYX-Opeb%+d)0(UI77-3+bPMhFI0c;+aCo4y6 zZfPL~q?xj44FNAmsrqEvc)COP+U$1g<;$OvZrHzGun>R1(ye7;rE3+v2~aynhkSt! ziKFL$LSNxW;Lk5Y;w8Es`e}?W@-vPQjm&2PDCL!vLiP_9Kk7#`-FT6ok6zfEO-M-B zH*iW!KLbnzS}Ct+Wb;(P-vU#tkKyiA|yd~$*OauNb=zs$o05{! z&csPe;u2=R?;a5c-PZ((R&lWp)sT^}jZizP9<333>2yT!J}rZzs6tOO_wG;UrtcSG zzM#=I3`|U3Fs~YOG*uWnnAx-|7awx}TubzjqA*Dct`^)nJzX6 z27&F7ma|-CIT6aiJC_k2t!MqsSy)iT2;5^g-2UQ-Pn&$uxAB)RUi570P;VYO zbSO4^*&uhNMtNWRp4)vsRE1vbRvW4qOo?z1mG3vi#)1iS7&_|FQgn-`rQ??U|bx8s1K%0L$4K?nWca^#D3O zN5^g-q8h{lY0q(n`g3*dy^ z*fc0nKXDZ7sXFSxk3UC`9bM@X8-F+7UX1sqqBm#911V8eaE&{o?nB zOdx+P5;w^>7)a2QO88(bKfOSLvH##m(_Zpdx2_}LErC6<`ZUA(|9<`ez8+1pYho6Y zwR_A__aMI8Tq1(~{bKb+KI~E`&;bE`b}TfL=h}DwjJ_xLZupFfwEJ|YR^e8JS)4XL zuQQxDO=5Mf8XkYB0i!slrUgu^Q7DBWLU8Ao8X8wUWiDCD0i%AX7j){wL-KNTa2{5y zpl=3Mq_1mb6+Qdl!2=)a5vCPocBzzJ4{BL(-N?wun5(j~vf|b_q57$p_VJS^`>6`w zMWXAU1_THRixGU+YRdW*52uAQF>N0ofn1W+-!7;%XgFx@-insC9O@1sJLJj&e5x?Q z!NIX2<9Nn%BD0Be)W*iTd}{?I-+6;D6Db+c_u0*v;=iaJO{%z;h;EAeaU7#a=94UG*HO(Y^P1SZCuQ5rVo5wxhWpN(K_E_1)baxPttO$%BP zybo5U!N|zS2UCb{+pNE;bh)yn27NNn(V3u>jg(g$Pd7~WYd?>A9%3#4lqeEsFi=@DaTWCeNOg3M7$z7Qq^%oDlR^NU^^Y6;!| zGWbT1y8f}2P0NU@ zZ$kWiLw(Pn7|ie^V@;R8UwUP6ExEHT#qTfiMT;vC&UCln8Pg&dR>40fvur)uX; z1mRo}RCy*6P6m)CocMl`YOOz`hd!xBjNzMhchM3zvPMhlN)RnAfx8t$;K{uNKu24C z!eL*bwEDCDN{NUZ8aKs-^!mNK^?Bqyg%Pm^a*|~*v7&#lum8${0d_F(m;ljG$HW>f zD-8_PU;jKKBwXyiose?&DmLy@?Xm0|#qxYV`p(_QTI9Evz_kA50VwD%8m;=;h7*amc0Riy6Q+lt+4b zdN=hhJ4KUH5{OtwkDljZLG@*LN9)5aQ2mS(AWKkenCbnXNaCEfUtAIk| zAa6el`HN@={R5^+jLb7l8QP4B+Y!O2d9CgnEo6p}y*-_Tu8Fe0nBM z@>P}A8=*wfD6G$UGaK*Ctg|#qmQ?adkCoG+ho|NJwYusO)b;^Pa6%OJsW+ zZA2P=Z_YqAwM%<(4xlt@f34*Z7&HF%7vm}&7%SSM?j@F#|JSVk*1>z%kvi&5V#vvR zZCfoYlRX`RvlRkfFT;=Sz=32XBOl0MD0HxZ z=$?gWViNpYF+T_jb)4`On+sE1J-Id&6;*ziPH&ArJ|aVk6)$!;tH^Dlk3=wTUTT7a zs!{ZQvXm{({oqU#gahA8T|vPD$8?VUw&TYTcIpJ9ae!J52C)Rf^lsH7n1PR$YdX%X zVOn)OXp@mmQm8eHnv-a`?LdE&-iIMV;has&`@nK`wt~P#D8XsCR4j0-*kZdLjK20R z|8Q6RWaRlWWes71c`wSw+}Cvb=G%!mZ@G%#Ci+0q+lIW^?B9*SQhflcE9u_EVmbN= zA=Fy1xD5@>-z_XKE0Vyp|F_q{1oA~3>g|nOr-crrkc_7xSPg3uEk)yd3M1F`Vp6}j z>sBL5(G0%_}L3^&Laa506T`pEir3|anE)}P6EBzgAwmd5x>@tNC=!{)1F>nz_U|wSJ0YY2bMqcEbh@`eQ22rR%kw0(6d*f(HIMW#UH){_tnyK& zou+pG2xGF5kpX{hKN56)I)_+37RBsb>3l1jGYWM$8oG%Eh?Q~h4)FJ(YTvyZdaUu+ ziS_4^QF`9q@j=>~&SM~TsCIU9!8IRvRbob2y5El5hW4G9o}Q+~l8J*M`L%k`qZG`g zEZ*m(2m33hyk-5hem9gWRv(Lne&I z&e4Z7JUmJ`M}>rhv8jEfrJ{R`$DUf-{6CDn1yq!4_dYxZqNrGi2m&f4pma!sO7}3N zgc8Eg-6b4BX@->U4(SeylrCwMj-iL4`R)fj?>Tb5-&+4?t@p(1fqCZM``-K7*Dh^@ zc0u{xa*a`Hnrv*h&H)Nc;BXvbrnz+G%7#Jw9gjW|KL7ljtaXDxDX}?BwWq^nF?~%t z9fc54o`(-}dcXhz^Oxq_v0yCK3K&bdmo}54l@eacQFE}Rc7X0)}GZZ7@C;$3@jhz)gB#~A^X40L;v0i zHkQ~NxsL0M#A;RQ37(k*u?w;*skPYk0C%}|oPUR=k5i>&qVN(>bWjF=1=Am8$Gf%n zsn6H(5*1&>(n!VgD}0+7RVH?id%L@{P$+nx^)*|NE8~2?Y@r(;$m(ogjz2q_osiHu zimghI>uUPzao|MK8Qd%Lo%cFcbHzhwK-%&1XM~E%(z4q|uATMQn->X)2<-P+Ka*B% zRtfM9%zr0Elk%N=aJe62Gg)YaSsx#hGiqH+7(`w7bzPs!-&}oq<-vo;Vr|lGj=O=` z2&j=e?JGQMDX`S28AU&81sbB#xU60whf7J9Yr#POqu%b39Gr_RHz!u|{mD(cZpiM} z4%nQ6Fz+^O;@g9HP zzy|&d``uWFQR(z^58iC?7vllw<(32D@l|hu2vFkG+P6by_vP&mHH%jN*xlKVI+df* z^5#)n?pVjUMA4f>1P`3NrO~8d;8y1cIWVw)vy!Z6@FA#L+SS4Aetaqr21YaV%rCJq zaMQtCP4~6)XVJN4&XfEm&0`DrA1%PI`SGR?`kzKXps#<|y51SB#uu3xIdEaUzIj}U zD0U;S+QSm3T^GQwJs{@6Cx#bv5VG+O1$O2kGsQ3K%j6*gsI#MxD9Kx-J zV$<0rKo6A+)S#P!pFGlZ4C&Ty>wN9$jZo;Z`CwpUlI!8&SvkTHIiPGV7G$bXpq{N% zGqt=o;n@b|l&)X@iBMBxh;ExH=qMRrP}--xS2|vPqzNWB_Gm=(%=enb?}xbVO~v!Z zrN0(>ZD?w^tl$rWZQhE%3kbJ=p8DJC%*5>2q|DuZzB0q1FBZ#(-9B`DRgV5+>QzFI za!oXIuEN?$X+DJ#sz+spX{jahm}w<~p^s7_Gy%%1w7w$7rIVoR=egA;w(KxdU%4iu z?65?Je0CYa(RVZ+-T}F+#{(L?PNky5VA}=H6~3ITg$0Jjy7i&Op#s){WV8Kpi`a(u zQgL-frbWZt{=q5PgpW4QpDk1)!E6?F*bwU%4Q_6S$U1CN(NNLy=j|nsk%!2Z4O1d# z^EAlN-{;z2e|}zA#Df_`+hXGxqXovnCdTCCr*%8%5Hg)5+bUPg_KhsFIoEsp-{yOG zhmP#^P13)9dh{r_QoEU5&GLZ7Wv^o9{0MenRKPl%qmjTLJ7CBe@~e;DZXJ#5%-UE&J`3y2 zLa=vT4>DjOO3h`n%a)Wobj4zniiTz(UBIEqh0z6c%F%Oib?J<6ZQ+}Y6}FMau_3$d z+aj62>U;}8$E~c$aC{#a7_}Qs!>v6~+}U793I!9YTL!=Ch`B#0?n`iL;>j)I>r42GsFZU?$v%<~0e+Q3s=fzPghq5^ z&(ZigTfFBHO^mc}*Rp0byeKtCb@5IZ1tb|;HE9PSJQiaK4udCHIQ!IdlI zc@&}-N6`ZSx`8GmxDawq;@;o20762R+_6KYF5YBr3wE(vMrLLaEBd}xliE7g(@Ad} zu>vbqWp!AfUlE}OANO|(hta!CMn(8!+`T%F${uRv)#YgBf*@QRE)RS;*x7@bqqss3 zs2ot;w~JmmN@&RfeE=5X?+QzG7b}gzw|1Q=C@28?IUSb_dOl>*iv|K;8X09T@3stV zPI{AfFR2#w4s~Zizt$~JW084zEX>aFp*w%TUKtzar39>Bt(6*PdCPxLq`uGdRzRY5IHx-_W2dN0oK6OgU~K zM3yi4N>O3oNbgd?Xh(FfrWKMm$0kV9e$R%_XI_7jaePw&qOd(V2Gl;AN)4iqaU1*Pu^UvBH{fM z{^W^=&7u#9&9F&piG@zMr4_ca>|plbO0n~f&1gRxxDM;n1GMby!X5lax2DPYf4a(A zKY_!OlyX$ksC@J1w#M9=f6}wrelq}9R(1}+YHS5ASoAcBs@NT~tIPChX>lDm4-?e7 zt*-Ia1gguZzgpxn;2NfM=g8yZCYROJ;_U3Sk5^u0mLVzsY9=MJH>1l(_AS;@7`jEB zB@H6kTT5eLZmu+0X7i*%&2bCLMDq`8L#JhalkbHZXf)~aVfmaG6taHVCSp{=-OMS; z)mU*^4W^{Me;={xhIDhvnc za^Ku7FMC)gFR;CQWWOmL&8IAr-ZScoNxj8x;f#IB>E^t}#aFa|6UYzfuD00NJTS4# z`gzB&S#?^deDVnT=XGBt*PT|relyVa;Mn^BSlXYshNd&P9txqBWtHDOpJ7%$eL;%W^ z8g*Qr0NQHIVNrU=g^`zg>fZ3A0GSxgjF00e%KW|NL!A&Tc38EbKm;2vOUFHNE z6+3HP_NG@>@(XknMn1;tE9fbf1Q6T_>zYg6-X;RG=$ef=;xXJ_mB4C)(SA_1oOD~8 zkB<*RUCKH?FT(3wHWW0CcV>i!>VEx-|83UY)5WDiogpkde6gwPKDaA%91Ln;f2B*M zw}GK?cRDUUEhVK2h}~l3=NQbvwt{o$F@?M0#9W4#fwuozHpmqz2Z z5$U=*DXNH2AIWwB^@HK#=AN|}OukKpOV{+p&DO?vFk5%7IJYpXC7G0rEN?dM(6jca z>59#qxocn}W^JvjhJK~j#csS0%zL-Q#@fvt933i)1`t;64Gj-tUiQDTa{`pz`Ua*i zAhu$;)`V-A?{w&OQECIs#cb>GffZ$ocd0!VQq&=b*hT?_gTouwqjdd|gLHgCRpF?*k?%mV8 z;JJFH$JMnKY$BRJ!*8bbOjH=KhTYlhF<18Yoxuzf_`7!$d(~#Zb5YC2J$}G`c?P4$ zL=+lyHT|!@4!uWkaByk)YK}SpNqO${n#(`J1OLSI*2B{a30!lf(^ngxfIIiZEyagw z1Y~9Tk9HaiHeSXG?B!la zRm|S3=Ug7x_j3S=Q?PoMV6<>w}W%qm8)TX}tZRa7+&=9IdM zcpVYrtv4@g*noLp&Jzma-5K)9HwDhueK`KPGl>OVS$tJkF%&#R)Np+p!Ke&K9av0U z&pbkAng779)wZO>u6$1?nWDs6KJEIXPPGc@YDIskZ4LG#n7sVQEuk+M;JtY-nv+2n@ATiI!U*7@fAM?Q-DT9sBRT78135*+kIxP&j+8ENuWe7k>_1G+%S!wH83+9Sgvsb zJXiuCw?P||lL)(w9#h`y+Wv#wqn$kd@1a!l_G0~2N6yi1xE)r1Soe6QF>vfAG~=Qv z`mfgaUn{e7^e*;v)DAGyaf#@_aSuz#X5+!0Tp=Z+_hIgwii(^D z*tpZ;-A(ez1QC&Qz@e9-qd8lrt?3?8ibZI!v<^?h&dg7<2D<*M-wB9q)2GXzcf>ah z2$FesB^N zM(@y2R00yUR5~;w+>> z+NML@zQ^g&qk6l50WccAJd#K{nnn0lM{EyrDL7e_Z>Tw4)c^_1$YT~E;BR-;m1Rw< z54r8!!M40uyZ|!AmJE59sL$Z$73p7I{@L)c{M;_QtnHOTdjRS37Q1gg_5SY^O!|q^ zV_1xy(Cg2eU+Ee9gcYdgVlk?Pp~@{(NbDgml%1L0c!k{ZYi1$#hkS-tH5q6ak?89m zvr2%2s(_!`P|`&b8WCF0b=P7_4D=Odr+JiGmoxO8x0r7NYWK-odD{qxr)P z=~h!YAmCfs;GT|s*oqzC9iqM=`2+l$x#I}?ABDi~w?I-wI-X4inJGS0uIF7ky&Tdy z4Hs7QSE^YrZAhhDjG~_bD%Lcddb-}B@dcB?_Nw`1a za3&0jsqC z6i-z`vSd0rw*>&a{C;Z&+Wd@8?`Td*l!vD$Cd_GN4T8S)B*2)KNdkG)Uw!uH$U|7n z88Eu0#QvpMnyf?*&mw1L%F_1z&T5Y*d?i_kjqY^h;mG^-wY4=cBfwX-?qsp7GoxcQaVB_o(`2+Z!yYm{b4SKs&&R{0Dpq{1=zs?A-a>4ot2on zRLXLd%X?clR63TwNy$nwo7^Czj)0OENx%c%*EPDRkgY?Is4(yFK= zpZQbUcZla$ZC1U0eEy8_&vzBZj=DsECMtx2LULA=;h?cCaBUA5IFt&QnOWYq$4)DN z)FEa=)a|~JPBH*aAR!4IWGgp~pSW}vwr(Q<0OD{ByWFx?pd!b|Yq`9CS^=FP;6jPugb z+!YHU&EzCXcq@j4~F4Vm#KFQ`PRd`tC zP-SWBavvlIhIBBF^D9Q|3{`WB!g=wv`j3e&#(@TO`D)$z%|jk{8<7`v(Fdvt-~1HE@w0Chm7XTp3Q zrP49x2aTHA1^&?%?s%f_6Lv|6S^iq(Z2w}((Tm!#gS*c!_frGq%Iz3R8*#xc-d?}t zFD<@q`yS>_2435`%Ma;-kHEWpLCN^oxrD|Uz`-{y_UO3xLQ_28YNP) zoxx-%oZkC$;*ic|$N9Dr;s{g@l`qRpGKqw9uuC}U7ZKpZBR(&i2bz80$oe>x;pyN_ z>2QvYii-NdAD!H@TqpVwU%cI5k1lzkSxFrr**AoVwk}SQLWL^JWl(%2Y>Ven0Op}} zYI1T~;uOr~k73iBeo$%azn;gk&qVPDM(OibgH?8J#OIu`5sXEsk{JuWUxm3;pLv@M5@P{pO_6BduTF=5_?u9g`lz%4z_uZN_ z1EItK%BkN7L3E{J5O}x!D76f+g?42jL4(C(O`)7dN@t~ zD3}tA{9X_X7QS7SPH)vN^@4>*K}2zEnE(Eqxf2u3VdkgAK+=9L#onZOFjacka@zbcLU}x)&n&O6 zJX9BQ!mFKEk3ZxYb&)s)h~}o6&i;GnI;=kE#Hau=2VBVMIb(C_i&hxVtJXHr_wt@^pB|Wd z;hG4M!!;%H990@5MRo?*!>4N1Oiw4_sA>&rFodHU4A3h0ngse70I?yC3W2ije?Ol8 z`L)m03=2hQz8d{wXexKl<+@tsf`d0|PP+8Q+sht0f3CSH!Bk1M=cM3#_O50ST;qCT z!ORS0XtlLL$;rP>eJAS)O9LbOm*R|iwQ)NatNgMw!i0L?;_|+6vFfqx*n^UR`igI5 zfv+VL71;rI)3sa^|L-3B1mzQk5@t;cT_u%T1n$Pg5?hz>gx34cFh-n41v>4<6wFBuGr71|H7z~S*`HF(;tcVph_2}FF?VekYc?BjEYgd15Gs#UMwmY#i663rhLG`Ap!<${#$Ww z-933G>7byf7+BvlDWYspRJXX=rTu>>&QnD}L3a@v8l<%)JpOkV>V55U9y!{33`({C z{*+n3%=|6tUw^M5WagE!d#IJ=x${P?ieD1bFEY4f3*o8Jy^Y`Z%L$UNLxSvU37LP7 z5vj*{d*ZeV#sio`Pem&fZDko&@<`d%`za_81IiK$Da+cYOP8-)T!S3nhM4ke2@vo? zb}Q$9*?fQh;N~yNng28K?uh}i2YlV1dpFcl2zQL!vG!o!|Y5*0xV3g(z z*)c-AMHtaa6>-V3T)mJd*05->Z{&wu_JO?zTv)+-NhW>Y*^hW;kwSnxSxUrnUs~i1 zZlvB8b4#N+ugW{7-v*$*>f|9@A}Sh8!P)3$*ZZWBJN!Y_JCINkwT_1urlpd!iM&x_ zaCm1Ysts~-=80UukN~%u(R3cTRiN--{B9tq^#Yr%h4CXKNo~`INEsB%tTU1d6x&ES zREJ3o7ao%(Ak@dx0Lk(C6*OpFm_!mzvGvn0WtP z-V4ornX~q0LHXjyYeG>(q&dY+f>ho+M%zpRJJEj2cd0yIKl^>06UHaYvzZJ4KnX*I zCbV%?v;fpr_4%HWPDp>wZ~}DM01Ub>`WJNBU<5?pT@v8(1;YIeB3PAQg;8GDy}{z~ z8GIM@p@cxmMVo|5ahqJ*!8k+2+(i|f2r*pXi6K4Vs9@*9293KRN5yTC)1Nn<^I6oFN*w16)$V64P37I< zcWP{I0l-W{!9x8kH!dAJC>n?Aa6q)=6ZlR^-S`qDZ2Q-()2JS*l0nj4Y$6@HSVd9W zq^E$RO3fI5@J_ocsCTZIG8eNfpF%0D+{x$;|D-1U?n0NaMWTf7B}9h6ip8(n?_P9r z5K_G=^Zk>S3IIH)^mOkEX;;!Wt|)$F4213yBwxRN%?Glapw@JX3{)8_!a+yuJ7JVA z$NQT%NTeaaq5rOD8gAwNG_{`too(Ffjbpz?#YH@InXV@Pmh7cJ_YH#A)Q|m_WKF*V$$}vg z|CVeh7+hX^ELp)7$Zx$cL8z)$w9wNzl4gWPUd;zk8OohB8f>;W0J6KcWGJR38`B2+pj}%cv>1j&i{f{zj_Az zbGbz(fVzh0-G_b8NdOQ9v%fUa0@lxbS!NA(Q!F5V>dt==1W2F=ry<=xZ0dFf0%06n zk}gP9q{@7ZzdDsoY}4_3+2*xyvx?KZvxW$VRr5d2qjJ!;F7Unwz%)jG&V0Z2(&zFP z&tl1M(cL;Z;t8f10rgL$oHc20R_rfTA0)+B1&eoHjh;gvP9=Z<0x|X090J9Hbr^yS zgo=7nLjyHdCHlBb0kjZ)qQmO179TB5}H zHSmA_dV%_#lMb|=>!UFT@?*8NG?{>i5vQ?|(93sV^+;0^X#dx^U8MiOs{PV?X=lu3 z7}KWB%?t#foT19<)|O*I1tl~!T?3W8np_}kZ^z;AR!Hqv(!1GjXe3?}WrAN(tsWu? zFKWwtTGFZ2Tf+DpfQoxA!8C{PD2EvH4j0)XlXcNijw zhn9xqhcZZ0{R>M6YsliPJ-}7eiPmsnZ(C=-&Cc>gOCiZ~+UTbZF}M!#YR}aaH8fZ! zHY#IKUCTdmoi_fi1)zwS9H|OqA)-ugX7CJ5aSaF4iKbU(8H)ya6G~ziL6J(-^QaC3 ze9yKA5uYTn7+i+d6=&87ed=r7|l;7#t5vqb7NW&T*##JJn&Xg{!fYZeJm&TmKz zJ0}b{oK!=@U1tkbTyVSHFRJ`9IWB5_DJU;nvxuH|qtkGWY-w-9sFHbu*apAzq0NnV zDe~K(Oa|bkvP+KkvF;s<^lmsqpLK07k*rp9gtp#gkIL$OX&hb@-^>oW>4^CZi<6QV za?B$uE7j23_KmmOt{Icx6VU(Qmv`zCEep{U8yN6R7ot&mD0|}?k>eHg77wK6=O__Dl`Ri24?&+^{6TAdaK^UMZ}&vnU6Q1x$UWMmbHCdimt%$}Qj z0I{62q!F#DEi?GQ^dermWDhOjn?>|eRrOH$mT1`I_Eo-e4n6(t6bs4MMbJP0ctwRI zXQ;?%#l3@MnLLx3f|{0ldt^@@$Ga!5`zKx)=gsCH3*!d{a5$JJVF^3NDehXx8G>kD1y>O;cilF|fcrRI_#aB)e`M5g zQ0TK@y@ObNvjZ|uI{-51oSJT$2I;!CP?RGur2o4iaqJtlhQsWK+NZchxe zF*}F3#c3q+^7T0DDOeLxxL#(teVUK2zF~8Z@AU2DAJ07`VkOexoOws4asQ}={A*VvB#W*|UZxYJw|0~QoeXvRoEk6fG?Csw_B|Mk z?8@ms?2X{LK`_K0)EMabbuEupfh9ZYH*ekAM{H;gmO4Mh9^KMTk@>$Ymb2xK}zk_KrHKqS3JusTV*k(Y{T}MwX)p+_LaPf;Ic} zoF#AS>t|{>T=%BEwrxOdAPjb6@;1dVyF}F>R_#2@z46VTOlZ(cQ0i{I_EY#WKK?>W z82!THV$afG(Lo%J?q$htp9aTAnvX@Rw#fPub!hV5ke~C$T0c^lpXj%$0<)>%4li^#6ZS^}68w*>O5dx!4J7TC?6lAH}TWH6G%g6B-?otXyW& z-ID5y>C&(28|$MNH{^2@Kib}4Fi|g3mj*&5`X$sQ%cBIiH++86e{piH3OCHqC`%Ec zG66}oFqFC5pd}0~-k>{M@N$6Fk~gGe4`7-&N*zDmjwT!4y7Z9-_BiTENp79(q1Bi6 zaWoy6DMJ=FVme~KegC25H z@eYVBC$uBF)6eL-m$)$7(S_AAgufK39S1CYlOrc?Sn>MMz52t$k0e5=d2wXNs!N6n z4n|iD;Ilr5mlB3Hm?*z1rl(PmpA*!lY6{#q-vU!Uw8`Lz# zA&;mj5<(@?!pu>YIn8^OLqy3b4byx-2NsY6eFiN`50+%wsRw!@(R!Ok=V|ol!>GZl z+pnL0@F!eN^B;-1Q&VXYqQrpg6y?EY)MP88dL0i@hkF8ci#z^C#kSMeaZaC#2gBQ$ zY|fs3U3D&Oh^MNzr-yzvZAD5Jctdl}fxrvHagQh{S_jwzspD+fqipr6dKQDg5G0s8 z?ksWgGq1)F-~n&^X%b-d#R|+-2sdmGdFGC8Hvf)g-OqOxR0>G+_YzrA*_eKy07@D* zZy+lgi895f%hjydf9)wD{01j0BSTJ4xMHSPDcc>GPAT$+CL*f?X}yiEm#wJN;Z&_H zGnb&vUha+ayNmJV=w|A;v#@%NYkxB$km$f8B^jP_(;s7~!X&D-#FO*1QKpGiq{ii7 zcc-o{T~BskaXObI^p@`~-%Xf1E!tHmbvcf#BEV^KH=824lA9%~Cs&_xlo*kfovUq@wn_Z$(lcR3`6l|h^;-o6| zCslAc+6+_Y8W?wa^Vnq>0dOI5gL}o|H&uiWvFLc1mx4kqq2rf~ zcBsh8rc;y)T7gUm^*gFert5G@f}m*IqQXQ1e2L(MUy4>vK>^-k+R>Hq6zuNC$@8BG zeAo&ZSN4Y)J-7A(<|Ybmury?(=W88}*VSa75CD>%057vJNj>c5v>iU34YtX~>@r=f z0axmcN9o5>$jn2y@&hq6iCDdQ*2f-&LK6?F+9#FYrOEgdlkiCh@7PzG0uLOzNIP$@ zdfN{NHX(je4E1);tgJ8#rP69+D*0CghI8}c_-~81J<5eF>vK-tV#b5-C45H4 z9ltvr4@_?WX!9cJnA*%LPp~~Yt`B; z-y|R5Pk(_J4F((e#NJ)L*u2$51NwaA&z|78%W+!^i<1g8FV6PQg)r9jb3V#tK~*wp zbsg=OVT+eCg&n7N{C$Mq(ZgUt@1Fb!GBnHrYtJ5upACb(@QJ+XYhe2@Cn+WfRZ7#S z+wtS4qT-t<9@eaw7xlj{!drd6?!5Gr$sIl%n0wBX6EhjyFEn-d&bJMeA~Eafn_c=& z);lfke$0lZNX5k+4wKOjYKuyb!t_*KWpQ9I?CNL&3jKWnT_FYTM4=QV0Rrt8Nr!ix zSe%Pkx(a)Amt4awHIf7`qmn5rDdxiyAx!~@7cFlf0(gMfj@MzZ#~TNBm*VQ5#-T7~ z@-eslYJyU(S}GXQfxYvhC0aov(``GNe6h3O#;)`D%TzehpC)9ez$pH(vpb7Z(->~^ z)woU{VAczG-kXKd^{hFi4#0H zI3Ok>>crL^xzy2|>UnbaYUgfWYw!0Da`B)^w-$*E3kGOO_-HfRuH=8hyYK)A&&2d1 z-C(Js6AjShhmv1e^)m{SVt_^EJr(wb3&>1)_T1;nsNyi|>OHrhK#z~^N{WP;NleOI ziSDNfFB~I06tf8JfI@fM(f}J!Z@NDXjUb`#S8WN(>!_5TbXlXWBw?^cp`at%eLnfF zKpLmkaGGLkT=!ONmCa5|!m)(=-d{8sT3<5EeO`hf^wtJ$Q|-s<7f*=>qRW@?kuS`} zXw+nAU#LboNXliZRd8{+j^V?kXp1(iHmy|?cW>m0DC7-!H6FxSi-xDT>t)`(-f6Yr zt9a)!bl(69ogd1lN!3VBnQUft%?Bol=Y&ZDZS90T*jg-K4VapON|6;fK=k$XfmwR1 z4!46cL-g+YOdZteQRF4eP-=Y_c zceN1&W($=f89TaLcQj3!tI?HV65UTnL-TV34&L!SaH%GpYN;mABgpS&AmH4RVbjxD zIS-UgOiC>8gR49t^yR)#U)x*5))7^obam3j+9>%`se<+0elZ`yL#G!zi1q13cp<8? zUK&6@+JOy#kzlI+e?n^}oNBNtV_|6t!A9H%3b*#-&PW;I>^L}Xl$fYhSQnJ8j3n0{ z3OU53pAijQ{4#IlIA5V(Qe6;trU-aw`C!~jbf7OFJ3n8mtx@(m;)ejG+MLis| z9%_vy)7tn`_uZ0h#jsE$hu*?BL<+y|?{7zF$Rj=iYa zrEcxxYu;#V35;&byJya|6tJd;;VI@!35C^f2_t6a5n56@v`{$LFl%i>NhBxyGC)a* z&=Bd6X!%)43k$th)181>*HgosHk)mP>LG94}?8VJz{7Zn5ii0Wk2&e2EtepMqja;lBDC&u~T_=%sYyQYPu9iMt>VYI(wH!zM1gS60piR=TVhyGmX> zTQ5Htkla=9*VyPky!%3rVs7^JI}{Zo+aKPX_97^L3p^*VpnlAj{@{$bAPXJI z_NRr0LXank38lPMYT4mzb48=LeIwm;;@so?nMaH9zzolTKS7wLWW32abVgP z7M3f_H5F{y48N_dxvspTqBdDd zG0bXN?JZDjEDqd`LvX^UQuV>o*vP?w~tVu5+wS&P9zlb3_ddku7Aj25q z`=@Pz!T2HYzA=k1TKT9mWHlFgr?GFfDdX^<=1A^fpUV;bMmkCrF$dY?phWEgBA{&L zXC&b=op7Y)vo~DAK4(AE1qfTaG9|`!g;t89h-HS{DphX0C4FxskgOI?B?)J{)7ia# zT9I(dz(F{XkYF~GjWKCNZi0Cf06>_#v94dRj^9tDY}~jGkiW-CKsQlj{vainWWc~d zrv@0hY}Q*tl;XLwjPp;P1Kvdg@GeTU&pN?x8fhH$kRXlKSXiF#tDorfHv+6iB!lIX zm$^9);WqLJlh2ceXp+9y7b9$_#r3(q2<1C*j~AaW1^I?^3iaRlmN+;K%t;;l>ayvbs22ebL}n-!8nwN`;% zq9S@c0Z<@5?(8H25ir6V3;Te8ffY6-pACDG7}O#miBOey1;#}+@kLO=b@wGjV&4ol z!mgk1xqQ^Q7_kW7pFf;2Gm5k~{l?1MRl-vinJFn+)p@4WBgvE;swLk9Cxm~?>zbir z&&pNrkIOxN_LTLv00J}~EPfd^VW%TxsWd?V3kqmHi0R2>W6YQ7nKHGvKu#SB`#?uo?;vN0y_8VT& zQmoBOFrE#3SSfnW z_dwKozgM;9@YAcdc!kMhup&G{hVaR*O1JwYl+W8Du7Q!f@!KI?A^&kB&75OY|xwK)@Tt zS0(ik)`)lf8iHHE%{J@8sl(uTkl5X6-2b$SOl{Ts>#e(A8C?^txpQ?I1CSp*aH4qZ z^2Uo`ymyc3%s(UU+4Y+T9a_I4?yy--I>I&##Ail|_~2bcAXE~*UiO6|Y(t}!-X?G| zKR&dy{(U4%;E>t)`SXG%x1m@L>3Q;1z5!eXtpce41BmA*0|olW57FavoDofULH9Jd{Umo z4lJn>U0A<83mBrZm02?)ivZtkkyuEA7Y7Kh29VGoJmx34-FD4-Fu;32!H<41`!HkO*V z-fcJn(SW3G16EN8k^YgnnyT;g4pshs$#b9f_=(hi}OsyzMp3zt{U5s)G zih11koDve?+%A%Gw8Z{d)j3jOVbcR15_(kk(|>>78sWw4v49cdVUhmMV`aE zxV|}KG+eB^cG_gTLiwq(=#*m|{vE!&aMoGOrx}b|m&yusm)&vK?+T@^tyyRo8})oG z<@hbBiD1CYImCH+drw#9jaz|B)_+20VNCwL9r4KyHhn`*tC3rGxTza0*jb1Ns(APZ zntNt9hb~3~;{VukyL(%9B)~-@P?=7+VGtju%Ktp<=1qWTp{HI0#8d?Z%s?^f(!m`< zcMHwff=dGveZtJkIvE}5&jR7{eJ&q^8XtrJQI&c`!V=fvuOB*XgPZropGuKav`ax6F#YesmwF>uxUD4S`0)!)~9>`w8U3dMRi^U z$vDl29YmMMuOk)^U@d{g0pKMIRHPKc{{F&|4FHVa5!KPrvD6rVGAn}r5#JUu;kT~+ zN<%cCwN%v=vXI3}iL`ERrvi=76c&m~%9$S$j^P6=gl^ScDD~NWi$EZ5|0ZONo||CV569!Ox&g@I&T5OV|c zg(d<|DvLV_lsjW|+b(oH7;9WusCYPRG4(wFpNuQ3zi75tZ$qT77qQ281N>~kMV0WD z772us5*Tk8&TB45%gC74g7;f7rEnUE21|2+!g2*1i_QGTNwG~3hNq~q`m!ZI(0ck= zXJKw3T;I>jD}TYwrTi%d<6AsGSmN_l``B*TYcG={7Ubw+Yb{)OU9ljNkuCwwWWN$Z z&EQMBs}J;nSQXWr0-=a{yOUuY%#PsF*}e}3uQ_ zg@rSiAbyeIu+=aBXL1PoEZzISMoUq%^Yb(4_(3=BKc8l<_4)JX-Kh}S&Hasz?Be2H zaMW=hy1TC*Y`2jwY|gU|6&<;QSB1}q+OF)WjhDuC^{4sM#q$kAP!m>L$(4~3Hh{0Z zg}pL%p3Vld`GD_r0$eceQ(}&wN`N9qPMt7i*xtdx z%<;pmGN8o6Wo83fM;I-7kig@+SbyV{xZ21EF{|1Bh0Y(zyED&x{g^8)Q?*w14_*2O z7~wq)n3lF*URzM){MplXmygLuzypMPMhtjL47~Y#FSQ%lmY?14QBeXyqKQV6Uz_w@zG{5d~r4H?P`bGU=7`GV=3f_rMN-(Yb9cI%@XItGzb;VYIFFABnoel; zgY}5I(8WrKqXjPnmJAryrJq{uS}KGeY>NtXuHAUVZN4oKCX*f}MOET7KEUlVlT*rO z(hdFth`fR6<^bP=Ps)`)@&^A zsSRz1_UF5ZK#(*Oe52bdj&hlKm2lRJ8z5&7oIk`3Y?#CvE-r;nmUHHH^e1$i@oyub z#6uxU8?xizF;{NbAP8&(-|YanVA%2r(B*zXwahe@L9;po^avvt`*U48P6Y|AuWLIZ zhY9&=$~CpngXyn7-UE`KnWVAV+Q%_bDO0+9*;jXm59q*MUzPCGmUXzIVkmN>G7Q+| z(HiC6{z29s3Edzco0Xf@Sv^E|^XAN+4L#?jOB#K^D_Jjm1HYt5y~9jB8H}dEf(iie zn6eTE(uYYj13v)i7WoO?l6tGB>bRI&_ILzuA`iGPOoUlY<_#LPO-v$1p~>?#`zP_} zUHEt$ckXNy2U2NG>X+P7K}cP>fY+y}Ji?XH+x4jNKt?XJLRd8FIRsLpw3JgndC-s} zD!-3Wi31M937@Q|LXvd1NI6c~VLpeZ7P^jtTTCpL{`ATL;|ive%^_XMI8a`A^07oJ zJfxV8=X>cvQ{c;~=ANme?_#NNz;alcImRB;t1CCiv=*gz%=SG-Hn&wD$(;I6^Z~m8 zDAD?Zvu92{(kgwnG1Jzy%%`>ZDOD1c(!NYqbI@L;R^go4pQDy37b)-wgpaEaAPzpD zk`YQHsR2$c&}9ST-faU8ee-C4aizD|H7u$>AI@~uehJEI!*t1qDcL7%>0gTM$61n4 zB>#0g414}sYH;v1c23Uh?CizETe9~&Jv{^WiIi(xQ_-Ow{Zsp7X~9z!AX>%^m7*b= zFX)aKX0z2zKh0GUQuv6(9yGCzNxFjYPU`9Y{2!CK0B)GayNI{Bo6R_{{XDvMs78w- zIoVPJjI%ftN>}U1Ku#8^F}cM-)DSGq&wP6;0q&$6IK=JL+usK$tZv|J+p@Ej9&+#C z@-o_vxDtK0(QqkP`A}=ZmoMOiaZqe$h~1opWD+!LoXWn0L4IG{aB9)H1}15s%f@&4 zDCqqiJ&F60y(9BBcxBh@)hTo+*8Q+zfzz9It@A5!DSE&tX#U49Hoh{|h&6PDrzST> z*-Tw&vm{m4(Xl{p>!#22_sv(NU8Z~ZVD%Vcgx+CvXbx>AwB<(rrxtss|Fni2?_cF-Qz|6H0<;08za+F*S?z@!e#}5sG1<<#KhkDm+ zBa|4m()zNM9yHx^00yverb;Na*d#kS8~Y9?jG@$S6ieK(Q9L`r3?+u$w$_ytmD^nt zW{+QK;w6BWj{_PS8o*zVo!yx~!AX#?2%KWb4OvH-xnY>zVFbPf6RQs%#&bZc>y4zz zu3-nie?UNU0Vyf3B_db91KB#`52nU#9iLS3)eGJ$LvG_^o9^bMoE^cJ8c}8{M|sEfEzhwTpE&em{uREyd-mxV(%k#g zrZ(OGTJV#^>7z8mR$k(72pQ}_;O9)Yak*;ns)5~JMg3RIeS^@LYLWb z2qy(g60k0q+T|h!FNk}L{=tU7}(g{dMT7U>h3B9}>y#M!k z??2vqXD}R!8qV2g?X~8bYp%7q+c~-W=JfZ{JWDCzp>WMbkS!3P5pR1nQjo1gfnLSP^w}c$t@ILZJh~cc& zV!j@x z8||re;`OmQun+Da-Q3+uNfqs=0<%1RuVs9FJ)r5uy4{or{5ZR*ol<*SeYUpcbnvw0 zs%mWc+wS&4fokEVj)sBCpsDryV{e2ASEm&l*<$A16V~?=5ZVpTMPpXW$qN)Te+y(c zQHsqtCvrFrQlR_kOaA_UuB$4ppczl--Q{&}kTFLpz~q7hR;NVpB`XGUpDdsN&3D;U z)%N)=2WEXtw@AGNBKSlAmMTtHNLa;CV*YWamFxa+mH2uxtrY&Lpy+%gE%~G0RsMp^ zTFBTV`(XPgE_!PnYBg|NNp?zBivQS>)6=K=xoRn^zNdnC=>Irb;x~99CA*)& zbXffXZB%#AzFgwF958rpoF1sguk`}^@X3!1TwNF4pXvnr`@^NH#I>VG$~k5A=1Wsk zoC-Uu@=u^@mGHh^NA;hF1;3g2XiUqQ{XTYbzI^qDw-oZr^8Fy;0t;AG5MXGi>4dsct+ml6pK+;wIt$Y7l zsud5StFCUd2ylpV;g^!>!e*s52uEJzQ7)i-K&mn*Je~y#ImjCmM-{dI+?B*T;;~y$ zMwPQW{jz7i-+UXGq{JEc7&u6ldxkKI8Ck8V_plWQpXQpki{~_cg#vl z@nTQsq~UuH!z8Twr0?X7*KIyqAYQUt3xS8qXC4tn?{Is6a0bg>pJ~kCZjR*QXXpj4 z9HcR63!#JRe&jhuK`j=P3}(f#2nbl|$`XoO9PmRL@g8Y|`rZutIYAHI#&D?k+% zYK+N_u`YG4N!*Hof-mwG&bd;n^m~rcEZA5iEoXbGi3)_Ek?~46QOC##eUxBOyvuOA zAxh4A)FFKiVBAloUxoVrWId`N>&gBt>&c5JOg~LPUgOXC z^xPq^6P#gg5ugGp;i0p$oYKxTo+DDf1DwkfS~G~ zXtb?sA~iSI(t_F9r*`Q6P`J7?_2Oe1^_epen~wJ_Ob{r5+<@1(qCHk$AJl=6ByOGs zMCCvE#A|I|-?Ue+2$LV^;Bzq#ud{wu<&gd2{?1!Nqt0eUAk-ZYU#=|xW2Nl&hivFx zOY9vZtC3YyBm}TF@zR**)eg_Hh?-e@)p^vbe;qaJJiQZd-BNr!p!3}jkHdwlpR}&M z6;0)^dhtO4Fk%=h5AaJ~^5kmg5~jXT-x7);N|5O;^q0CPK zrCA^QL=r*fj{zI>^s6ApI7kZqa|N9~inxpEpWjA;fi%sI_&EBV79$rFz}?iZ8ltnF zN~Cvs`Xe{T4i#U>HXQja3c;AD>8A)SvcihXqAE0(C43mGh2>}>O?xvx=y(k3fruzj z!l^<`+5xpG`sE_mjPWk>+7)m!_i;DLQpxr6tN#vaGHTC0eJpew=r_0QA_KQaC4hGY zL=qSqS}|0!9Mq9gcMS?iq5gvL?HYsum=vssCD($zxxmA`z49gt4K>Ow_zd4sGWLHR z`=vKR0xHv{1(U%tDp?xpU(j~t$#zlhqNG)v?|LcfOMjMBF%=M^IFAXLs?c zA1}{q6emZ9#@kNNOoq51g|R0?Tr_%x3~?zYm~OVXN~T;}WfWoa zs71@wS@Zf$rY1cs((F$&|Od7G%|)DTZMu3 z*n2U&E^K~|734A?%^twxqyDU^+m{w9!>So238T`kjUR2+`ip=@&>zA#roRN^F4Jn9 zWEr7DO1|<4FJ1(jNf?g_^c$m+n3%}BuEzA(FPEMg8r{{Vj7mHHFjmm;lPBEyT6%*C zpu!yMu>BieT6b*yuE)CwVCFgr+lN_MoqemX@eD0@>plA45q zE%)yYqd~?&bm~oU9?`8dD=ZU0#+#>cFRRo+7bwAkcicLq;2s`;tH+fh*9Jxn*S;!Y zjB9nC-LEHPgAc8rvU$^OyI^?Ut~2{O%R)8k;He>ETl?PpW30`zk9>rK$K+~W#`mUoSU(E=Onve(E1!ksTVB%DTN0%e>i(5#5>{@0Mey4&iG<%3)#l6JTJB#8JBcloG*tuJVw zm2F-SnWEW-i%Jjcuh;BXZT9v04ibWoZaZP)O~+Zbk~)7yg(@t{OX$`n-%3_;#TQ$) z8B{hu)@t-7qpJ9-#5ryoR4fq*?Bv6V)9|w#*5kJj9(M;Wo2c%)Y%KAJg`Vi#+~dFD zHh?hfdd_h2_{qyI-zMm%hT356k|suaqvE5R@1^d#`*cXGi>`?+yDv?B?NyOpR~a8R zS;D$`IeDhI#W}tC$aCuKWBLb*f25lvB6XG$i@u(a$DxhK6zL3WQ{8*cwP}5(y)nrt zc=w>L1d{ZXNQ$B~N$%t_DYg!bm?C2heLJtV7*3##G@m-X#q#^=P?#A@Fq)aF&BoXl zIBW_4Sm2Ow-R=p&6O1-qm`2{Me6mt(+}Zo-!2{{TGBf+8h()oj^^2h(Cs3dSpM&Zk zWhEn@tEuoTY+>Y7twT|MA1`Fht7u+&eAlP407~;c?Ng3xYR{x8+nTk>dxIXGoV? za<9m+j_2m|NE|L_XM7rp+R>;@EpBOYtx1&b>svr`v2@lL+T$ zSRW#JtJ<`g`A8NRC->S4=DM6Ku?zId6kGU2t&su1hHlVQId`m+0e#alC(*FQbNXp& zo#R@hH-e+db-L0lfMxR&+@#glZ}wh<GC8fBzSL1=23D~pq-&SI{6WX}rL&e;Fl*>E6neX~&(>F4*K6sm~hSU{k zTGJ_E*-yyKtdvOA#y)DRc_lOD*oen?K#h`FAWf*tbTCa<7W&0j$;GKEEblbT^)V!d zcfn!U5YlCQQw%I={r>DzEH%B6>0qiQB0NLibvmF$3pTIzESmL}e1OxXz|iBjD1yvX z>i)qhO@ui_K=}DN)}Z8@zbhn^6}a^(uxq|IcR%8|`HQ<}Wodt0?K9h-Rv4Wo8USXWX;J?On3GU zs)W(o6oQJ8(oe{WUbJO5>Zw4Mj9pQ;V~f&jbVZktx5~s?CRt{wNcWHCjeIC8uZ9vs zv=sX>RAy-@YvBnK%hr1`Qrhysa#*+Fe-!M1* z{lW=xjta7CqWku?YPlSjN_C2tD}?4VZyeL+ElSH^$W%gW)|d1#hvgM;3oid+;EMrhnHLoT?I*VB)Y{NC$Ls=2|c{^u$@(4GF$OJH8!XyZcE5W~Rph1tc|xdMaMJX5D?X5OdR(J1XJzX+ON_Zviyzibz4_s&gH zuSJ4VNnaXt{lVwDu0w={?T2wr0Zqq(q|tQ+dXgq4V!lh&YIR$q2p5j?JZr2%Azd>A2X_IA90Gl zgj2&1!+7J^;$mK}3N9;p%AN<7H&l6sUSS}{8^)|YpMkM##4o9q7N5hJY-cAGcRts!1@pBqv<6RR!PT|M*%>4c?>v%3^-)Ma{Dl-X@7{?YK z9!X3!P3n$Om%vha(zcr0k{f()fAy4XpHZsBy&YhcXYlY8#1u~<4W}A&t~Wl9_hGd1 zDXxN64cXJv7{Uz2mtLjWvA{Fq7kCqxqk!P`=U16|gv|KShD{Fc~Q;e+c+la|z6cX4Vp7 zjAM&yy~QHsro+F#Hx9WgLU4Zo{-YyX1d%JMV6Mke*Cm48!&NxbuMuhK9i2X;abGfA zljVm)&r~v#&ZTqBS@%3(!2K1aWn)$t7sp5PWQ`{6BPgvCLr_HoU|AnMA&Fe`WaDBr z=<>+P%2;f*E+>a&*po7$7Pv_&Fzg_F2ynXpy@DVM&d;%BOtI#gGonap&fSfw?l|9G2F-+5f$I9;!HjjLq$MLlhy zJo`ndfi<1{dr79;3!gt{bd0Du2y1H%y2`yGv#_XVt8BobLy!M+Ky7`3d)fV#H3?n@ z2E119B-n!#=U+cu#}iU}u^&@>)|!Wv*t9@}hcH%`_dSZqXQ4g-MDZmrpuV8Umql>I zndl8LxcTgVc|MkGs+FTN+T+yr)`u|zScc3ioDdp){YGz^gdMK{jVw)6ki9H~Ix#u+ z_Mn(_j3!DyYHG~4Es6s<>BFcxLjvI(RLfq86Y(%sO(EOSU2;$9o&kZ+Snoz+KQ_gG z!I9uEo6nCR@JfTfIk-&57XQ5*`bLl6f-22ull@|0sE20>kwbc~me064e=1iEt%U^h zHi(-p%>8(W1~HGHS0E7KEtZSm{}W#ly^BrkgyIIqQ){!oKUAa76?@Sba=j(yY=ee^ zzrOU?aQgmexcwhga$Y?{z)EnCru91JIeeY*yPocq*x6!hQ5dsgonUJBw3cROSo_ZG z{V>mxK2GMs&lV>@^p0w~1mCH-o)X}qNCSs3e(T57RPB}`c@GAq&*octg~b>Tki zqM!Y*AeotD)!x?D@}Q>)yt;{)cR9#cSN-k}<2H!RMN^Cw0^HD~a!F+B0kLgp^XH49 z&AA599Y@Fl&!peR+}UgSv7huv?QmelRn?jrbq|5kdvVhsr;m+Cb||LIg&k6=(+A`MS-Cz*ba&cOPQX?A z6??Gf-X(;1%#OSjE)}*L=-?eH{h&^Q3)E#EGYi#g%uoj&??59B81{cI@}_1DFmx1D ze+CQ^4Rdk|H{F^Y5b|+1cB$Eq5KMdndX`&yZ6HDt83bA>%+gYOKoj_YdPV@CRI|b= z@5FQ`XP!wib{^YWZse{2h@u6Q{D)6c7l+AXzqBOw_!>OX6SCYT$PuzCgt?KeX1jPSwPS7z6ALh`4oZHwo$9PCHPu;oe=t0)O4Dq-KV#>~ z+tn<1>#z5AhB%L42bd^2IJ75N39c0DL3n4vJ>=uUjTw5I9rEP93F*(^6U^EGJbffd zj3VCmF1Co)9Q0oykvwb(8>WlQbDDQ-w^?Z4KJ*6Ww6*uY_KrhRLW1^oY$QmV>o4JZ zm2Izkbpj}0ZRpuq_Fu0jPHFnK7^Em~d|bavU$DS& z5V^4PA_vKwEA`0M^wMrd4FpT<|9-0XB5?rxrQ3V$=!&w4Jk|Ni0Q#gT3_#-Bw{wRidH zw=}@j5i7~=E2uO0U(w|sZ-&3&tx&mp70z+Kd*$NtLeC6(l}%N(6P#A#Yv8;2qbG*y zs@|Q;>*CztGusg zo(;Jk%%fcsuIcY@gy!k(S~21pRb)WnXqreu$-ML50B~*UjoFr$>>g(8y>qVvI2uZ& z>|#C>7JN23GgQ7|NVF?c^2I*jac8_By0HZBSdjAvb%y`1r`avM&-M4#83|LomqAGN z)g3OQox|Kzh*Qh~qVo>3@~o(C0T#aFL4wj=4T3 z8gnc-neRZ(N6s4!843K1rQ% z@I756q@Ns)IDcO~^HV%m!^B@;?nx;posyW>_sR~Fa%@N?BaI`me@xP-6j|D`Y^zT= z+A?Nz|MmhB3<(yO$>mnRp5=Q%{J_9G=6i1WFZ+&L)t{?RDy#S)D}B(t318Zy1SJmn zh(*ri_IdpHzKoHNFMMu78_;5F;$&LPPb2RhqxvNe3-(N}FQDgS`jNOPp4v%87DZ#Q z;QZH|M&Jj;4?8V?&TCz8_SXV7c77WKcszQKG#n)jS zhq;G}JXumBnxlW`TEqE*HQBzZ=M7Gz%lo(}IaGr-Q>7^lP-qYXUc-1G zo16msUH?~hp(%4aFG(Z3I6FU@k~+3P*xyWW2y6BVCN(XnghvsthRwA0Y^gK~y zxWi+MEaO6fShK!0d#W*0CXt;|m?_ah(V|U5!9-uCO{2w=)VrBms=?U?U#_Wciz-T(X(KmCAV zRB;-<=c$CO=FO#+T|}@Ati|$*i%AvbwUaCia?-)CjnC16KNc5A0;5UqSH! zE&oCM;&)@l>!kUWrl}pEq-A&Rw42;`Zz}C4Z?q%UH*}dK&d{G%l?^@G-TV#f;=e@^ zAl9pX%EJd$qSqQx38l$Jqm_Z6ErAWx2KCJRVK|e~>sk~)jRMUI4tgU4(_U>X8C`tBEoHf9{<_D|}{5xEZ<@q=Kuds@j5auQIch)0Pbl?x3!t^JQ{3Txzy zk}YF7zN??)C8wtcYd4cgiV80nGi3~5Vk*_NSCtz>O>2cR8#2#SR=m^0Ifm(pAEVG` z`t<$nDX;bU^qOJ(g@QHlbNy*m%kEX!Hs3MuB9#sHVI#jk&en&?ZgEN_oWpJH);uY# zW%nEA){^_{z2pvzk&*Wd3=Cl6ZoWyC=Qhh33KTap_58$LFruS_#b*tZnUt6u!(lf! zROmcboz0Q@)Y#XPHdMe1#9GqF-jvlWm6rY%BfI@Ng0lm=cI=d{%|2_5vtz+&V&F)b z0j-x%9v}1D7P(tejX9Nt2f0m^BsBVikGoKMqN72CQO&VUkCuMr<<7ZD72R zU!BuLoYZM)3Zc7PVgxZXGFop~uFF%_3-S1|1&wR7rdO7$+3p`^yjqJToRi9&eHwF= zLO+RA!l9X3s?}7o)_0j+qvAP6t*_)TX2|T1#?%abKt`;x`SFEh_3JB+Guy(9oF3NI z2=R;ofR+HrVA065o!&?c$sL5W0ld*%1)gfCxu zdwMeJ_J`}@NKpk#@xwmoe`OJnD`r(aVkEtMSns(Ar2Y3lQ ztmt-ITYMuX1g)v6sxrQ{aD8#8!sJyXGt6Fqw+RlPty!y-5=6;%N@2#voR5&$#F=Io zGhk^v7Ca4?)%opin8Z%`z_`?+m*P19P7Yo8zHv%&d^|ryQG;O-x^?_4^m|aYYN>@} z|6rO*w=Qs)Dmb<(MqZ^#?JS*QlW?|Gv8zf*414~lQz?p;iTX+Paf-qlhDl72@)`wS zPbW<)*_3hDLbXv|HL|vylML0TumIowedR+xPP}q~$F;?&Z>v#I^q0ja#m~$Hk31(M zOd_;m&qCAbS~GY;gUwk!K&y@q3~qK1*L?{y_ab_fm3L-t*Wu&GOu-R(y(kQZbmZ5i zf;n2?lB1?P3(dA#Ho5Tt-H>Uazd&*$l#Q+Y>)b{o$#fs&uV+v7tjkE{-z4(QvSXQ*%NcJH8``}D)Lo?30|PT#qVOI|I;-$K*E5x zX)bB7)4Y~%%Qk6s!SCv``$q&4i})!(AXz27E9ZqWGO-Rw*9c)wL@xIN1;Qgi>$3oE za91EaB%^wlLkRH6jf`3M8L(-gT3v#WF6Lffl0IPO{UE7(H)Nx z62Ph2QtTfub${zhtJ_*O?IJ}n0SqI~O-Icg*G8uHvBpgOYn_sr8#v)#=6SQ&T0!K3 zC`(0RUy%`4`{On@)V=$Tm$jOOgudybU0htcpDmS7c2mqGNLxnui zZ*s}@a2Csa(5P7&F`b=(0d*F7C%rSl#kCa}7(lPL%)#nI!Pz6?RF$O;1O}3a%jD4c z+e^-_(L~*{dw@A}H2w{rnYV{F+JpWmHfWggmC`cdz%NJHcgbhN_=K2>tY7Bo!*vrX zsH)wq_?aNIm2nE^1oPT_Os0Ov>Yf^anoB@{jI{4|0vKtSiwIZ^dT?FoFR;7!;(2t0 z-Z#&G-pWuLHSKf6@|1e!Vbns$7~L z^dLUli{lb3uiPtSYT0!kk>xko-8lH>!gld-L60ZO#;VXTsO8o4bk;%)A0Q1W|Y(sFNqRd;w{`{mIS%JG?L z2s4<;}qCOR@ypfN1iGxi6&SeoK z;rgO`US$%m$!U>>s_{I?#eZGq?e_Ne(H2Ro#(KT(XNIaA>VFw408|Zk01{(xI|FEE ziu@D3?yLt=ubZZ%*kvGpQ(cJvFV$r(i!4WA+igfo4-G*DFsXw9<~ahGo;z8#U0P;V zDpZwB>-u^xgz+yq6&n3738_K`K*{Z$kA*LK)!L}6M~UYQRuZVGcIdNY(_9ISE=u_p`Nb_jehl=dJJBhbU%DL+E z^BBko3vM<=I81-ZV*|)ED`2O9-(kFg)_y#bmMj*C0SoGQ_F@<%OI>N+X3pKDR-G~l zX!P-%^sz60T^%1uv+*_C=jR%3D z$VeO1VkqjRc_Cf_tn90&$+U5QrHXJt@N@hZa)M4LPgtqr=&tE zV|nRY*76TqZ8L3^_?E5ny7AY!%oBIeuf$1yfgdV~nW3k6VO3vEYy|5nxJ5EStZNE# zUN*oOTUYJzouu&dwz?S8)&@@91`c$;Z+rk6dBo52R}bT z_WhUCwYpb?;#-M_0ba(hn#jD#v@Y^Tqy9lzt}5jE{^FFRSl@X5tiEE1=3*=3#M&9d zoPfeA6KTIR6LP)b3}t*K8UKxf z41%-^@|NPjS*VUp-R-aKQZE9Ycs0o(=@t}A;D#w~zduD$s2g{iezZ~&_)1=7CnqN< zj!*k^f1D~gT=Cy&W8DiD8xnz5-u06JEZ89_^$k3%Z+M)+9__01Vmuoq*I|6B8Ftke2a&>S2sq+?yey zIbXR|OTDAHBXTPo?zJKZNk~8?mud6=kQdlGT z;EIY0(YRK6Fi)?m!^uCO2`DBSg$9HGXL(ejM;n0@p7r1-l}V)s6obL+5bF*cKzp+n zk2#DpUa3+*ii;crlYM>2i||O1aiqe;2)91B_1X(QzY6n?&dIR>6Ekb_YkWQDTTVoh z8^c&YH=Vg^OB@Rg@S7V?wLo#yT4}@0TMKeI`cpizqw=q-^Nw92REGHTr?n94SK`~y zXBFh{@ON@6#q$Oi3qGijUXu;c!N%#K64aiG|Gif2+WD8sRMw9AdR?pZZlEq z-{Lc6iJH0>ofXlc7TjQwdhsJ|)RTvu(wq67j;vkZ{~vT*5agpP7@XU=Fd*v=SZwVa zohT#BY!>ZF6>U(a+S$P|NOq5A#V5T51uH2q57KR>ndb4M5|g+=KNG>*(ROWj7Nys; zLnK75iF(NweKk*c-!DghBE_v#HRo&G?umTOc#Ax#3xM2EK6XEI@fa~?%4EjfdlMr~4}`rO9)dp54~ zXHiwYA39%8lwmv0fiAf5fyS@|_};V~>_=$v;Cs{kQPz^|GQC&lq_Qh3#g33-z7itq zL1T9X;4$2s)Gj?1Y}I>@O5gxYtGJ>4`r;yHXaJuE3~5en$0M<)guOQxl3Igm{FKH1 z23;)1uT&)3vh{;yy}Qn|>8xEx`}~iuSX^g$1Zll4bEd8L&>eUq^e`1~6lAFut%p zH~n{;k_R>g+A#qaGs_UoSSN`YYiA+vw~5+a+hjh^psjnqmqpt9`8|jh z5|+ZgPGB!xPNyne?tTRVMu8}ZJ-QdwdyH{e${()O1l&yTjj^NWjzA5jJW`|%&_JxG zusHb?=W42UgLF2vK89nMi_^@Y>(Nfh;}4f0iBj3Ydyp9=_u|nEI(KP3?;ck7(a@f3 zBc%lPM_FTimKF~&5L%=t&ZHeOOczO$CtL!Jw`esd_`SJ~EM?Ck;Dl~7{*fneA#bN5 zy5Jt8VKcW`Q5?@V9}5L^B~u1guV}$!d{&w%=;*h0dU-4`WoeusQ>pS2hdI zqSI^D!bzo4949Cy4(zep|3i7}GhOxlArSuNjjgk@8r3=GG>OwpL%x?@>2SugK~-1S zL5$jd{|8!C)<4B`ucHidR3P&Q2Y2auHXaqo1jTa5d^yWv@?HeEiwSWsEg+6-exxrt zA|jVu`Oa9>EtO~y%F^%BQnyku8yw2u@MXkbKHZvie%1;|Xa`#ykV5H=pYj;o20WY& zM3iQ+=;k9gKhyp-={93% zn-J&Keap)3S!zb_CSIMDOqX0X&=Qs-CZJ)#JyHr|)6aQtR?%)umAPgUY^u6nmhF zI@S&B?9|3PXZ;D{<56sYOWl2c>SyQAa97p#4&~_MAJcG7Og}~c)ctT!YYK;Z&TX{- z*WN>4fyfPhs3m>4X=c~CBqK@sJO!o)9#t2As#e+(zv>t^IkUr^uIFZJ$vM*#f>j$d zoSJ)PLqGx!nXjKc1(APVY^%O=xzk;z#679gWI%rsqRN}nV`*nR|EXNbQ$E@^cQ3EC zRZY#BgJZb;wq7FsM-OGY4Zp3;uou4jXWpIrvY-L!mlnYCS-HyHhpwFp`s8A){br6> z@bQoyN~28V`&D{{9ye)x!YmZjYiHf9S+1(0t~2*pB{TJDGU?tkZx#B+1Qu}f1+nr7 zRMR(^OoBiEy7awv%A8@s2{7Rp@asSofuC5P>09w9BSoPzq)AFEEjIW5=`9IPwNLUQ zl2vK92b$PMx#)*0tX_SxXm$BH4|=K3N$!?xoL%Zm{#&Kj+1seB=V7&;g9xw$1Ma(~ZjBQ8LzmFSnC4G~~(8ied5S^DIoWp+hG?A>KwZb}}!%q@=Tb=-K4 zZ9mkVY7vR!K8rNZ)#Ld%dL#RdGcdVFml2Ky`5l%1s7McJ2=sLi6{xw_-|1t%OMj-H zc-tt9n?^iI@sdu73AB=cLRZ~VnhK+=alf6d-yCgs8B~97J6@Tj0|+_qDgX|ZSnfD# zGVf;InE1QQ0o5*~3WiQ|U;aZW`Y|EKXZaJ%xdUWTMx^gP!TE35xT47H{m*%Z=rA$= zgVj~{ECk{zL>RLDp4tKG;1Cw@bN>?jXJRfL^_cfkN+*G|D{_vQP_U;vpZ(?t(CUT& z5kqBV)K{X&z^sR}4;1-8P7N{~!)6fD*LxmlduVoc`X4(vL}((`6^uJITRLp{d=2y- z2j;kIA4cW~=IWM6%t!JvI4>-W@O!xK**E;9G|6pO)1UvYoGE9mzV8%!D^! z)nqeo&07@+0MPfQ)#;Q})1Jlb=hQfDJPDvhM-PxF81tbuIJa1UpvLk3vEN03o3i(q zyC;?aI+~9*ZtDKrmk-*guZ}=8NK9Cei6>iJwtpjR&nKSy5CJmN`qTs^{`u*_FgIf` zuDHKH2TbNo)wbXjq>-gv9L;=&*%$Mij19rkC`W&3;#gPb-&fha8lbUz)n7l}diy;c z$lrG)pjaYuy434cj)4^r^=&T3UGB?lE;U73F8YR`{_)8upPew6N=D%Iip^~Xw z6Zx}HWuKrRf|g?J0}25~b^6$Xau{!lm;jjSsRb3eKqJ=2I)G3mQ5*aKYNH@u5Usf5 z07G8P{3-*OOX2G8JVPbS%&frV#fwU}nNXkt|Av7A!Jop$xz(1h6hZLZ>>P3;Tc4Yx zp5?Jx6IQ$^-f#wV%$^u7+Xd!g@;AHb#5y{r-KIbyc>R!VBi+&K2DEl;9eBgWLb$0VK$BKKmaietB=3Zn~2r$`Y`H5c}k8DKE& zCIye%OZnR2V>zJF9O^hD4MFLA4~qvPS_SjLDTldY#H-r(G&maW>_?QNUh-&03--${ri1yXo@n&E< z`Tbel3Q~?=R}dUigoJ_zy_BgZ<$~cU39FW3h`2%k6b}bfPSN8_mQFx zujwfdqmoqt5zE^)T!0lKQ07TApFys1U)t7jGHJqs0X?H!zKnm@{v;I)v{+E zQpA@Sm)nV~nu9GU zAKwfg32(21dGF%UXy;sYd!cQrY-%g;hw&Bil9)6Dsz+zHiiu>amuYDKfZ7m`q+MeJ z5i&a(gI+U8xvXwy%a@sbAy^l@elyS(s+F$scIu}Em}^rnUF`$V&);T2bA60%03qoM z#)#a44jP*(sJ+KyTCSwV9HY=+X)lVTn)U%!6*w$5Xe(iDXP@a6X}NAMJQ^u?#C-U?caAT8GFIqO6`SA>B&ki$O+P_#mdKvMkGx0N0s2s?sZ*@>!)X0*W4sewI9B-yBtcXN`u2M%#X1z+9F}9U8tdJBPkbdaTyfC zoy9O0%NXDeK=@iS6nPz(1ilgH1S}*@iS7m1BY~8Azo|v@V|R9ZB)5LbR(iq}6CLGo zQ*%Fp(Up>txvxB3^mrIo#BYGrG<0uQppIPyAf{g4%iU7x(kuB#!(OLcX?pwOYk3!b zEUb%O5vFdqvtGX>L)s)Qe0#0USSic{t&|kaP6*g=`M1t1wcS+`6#v!6O#2G39Si-I zGS<0-A#-b$ne>1=bx#&*TGvpAdt_J__IrxT1g1N5pP*gBhe!PhG|A*Be9>p> zTh&lesh*Lq$ldDG6#6kqR;)(_^OF=z_y=y92_ep$ai)d`hWD8JJ3g8KnFLATiZJSL zRrrupA+*@)033qNr~cW&{46e8D8G}}GqFu!}6sWm=lriCQle@WNXt+K}Bfz0h3 z{X&=pTJ8J&8sJm1cNFi_diA#norOGn4pfZ&(^^ox*qOEnbW3(d#JG}OkvZDYSFEcy z?X9)09l2?es9mJ519p&80Y(t0nF^(T$GbF50GT+BV`t+Zk6x}w*Fv%ldwOgSHBr8ARkyQ1rizr01LgvhSd9_BhiXJW&K9e)xTv0>sd>*;e`SlP3DznuK4au;JBUuq4 zudE9RhcB-quV3hENFjxuRDsBy@Nwr!A9RF9aKNTwOH9=74n~LK&??9b^ZP@+x@0D- z*E|(0&z=Bi$?qh<_!2-{0zk+|ocP}!#?gG`=?BKEPF>%=0eJtl8Te;q>zY7oeLZX> zsthgbFPVZuzupEEO;9IY!E1hg?KEIKFQ)F1w;kYLm9i70HV!Qz0#3uiX<&P%_8bf3 zKL5x6MbtLdLl!?vR#9EK0zd-#K_iLGP^K7hkxAraWVK`2&%K-j8s5Jsz))Zsd4146eX_`3$1tPkzTSj`bA9fZ?y(v|+PqYi*gGGUUN}rxt z!C8QxBY8u-rE)f&I-2OWu=x~dBhu4=!7N7(@kn-R12=u+<1U^F24-2MYyA9Q-7HK= z)|4e+9pIku`TllSUY@VY(cJV#H$^yv+}t0)OCk0yPW?Ik^2c=PTc#fURT|j)_x)}F zE?JA@daUFyxar05cIFB6+-zAD??*ji46&CzMiQ1Il{#U7oX=;xofDSV?26XO09e$G zxkma!*4AO?Sc-oOjAaXPnBs1ERq*Z&g_$((lgEy~{LFLmTY2j@N?}~v2+DWYvtU?# zzpF-fGqp>7pLL{kC%dv$doZ}bq`cLd=k#lXYmZK4dbi5RK9+wZ|5(LlX#W};r}4Y_ zEH&=cT?6I9mbf4LF_Z86BJ_&_qf}dpc$_#1Ix6DD-Vrnu_wzsLnk-G*1&0ThXL<;^ zJl0Ad-uW;N+G`d_mCq;C!{Py)n4Zo8gEq@_{w(?mVWd%2QTfbrf}-&FO2>cs(fe9_ z$@qRJqtfzwImnjN?O!`M_kLbm{bXr!CJde;;rqQ|xjhg4PLDfL2YlW5-t7AHt~kXt z)3xx(v1XqDp9dTr#(xRWbcsH{*0sCLj8E+4AWa~ER7v{07hC>ic?6-2d^m3Q{+8Wvf4kuaADvgG-X={Esc+d-RZRLK16Cs| z-J2FGy#~|}F2FG}btu|DtsQ%hnx9#NrC^2n4r2Yc^rAeNF-slxgeQ?pOvLUa1P>)| zpuFvINOkCA#wLh?cz)O3yv1U&rmX~|CX}y#tgmrslso5DT;aD9fsAd@t5AjEQ`A0B zoSsBo6v%SrzptMH!4FK6%N)CX0$*T_ zD>4%2ukiBpJ^HHPQt2#YWG{5Mmx}>|XEMFhef=d25_@)=)SKR&nqyx3py%Pe`krmR zRL`_$L3NmGt-d%)Ef>a}0J(QB%d+Ua7xRQNIAq&ra;2uydYEBR`iTaBUnH2jQ}`5WY7^c=y*`IsR_tB z9;)BiR*J)CU|1+9K7e-lwlzuEZ5ZAj0$G6Li8PcS1NWfz6cnFt+2zK13ffcg@@|!u zPf@UBR(ahotuTNP&#aE%9`l)YP0Ur6TUk(oWFb*Se%ntb*b*GV5xpAhH&PVT{3iS? zagbFavn+xc59n$7lh0;n38aw%#6Uc6GU?}uP449OFJ$lHaYtGRC2Y)+j3FLMJuxKV z3OFNA23DW5;Y{rh92P~1>%r0Q)S7c{6Ylbs@Grc$eVDZtcfwV{Krnpc&0`{mkbbo) z^cBH3wK01AbB+}0(FLCs#|JKIc#rHQQ^^t5Zbkxu3D`0pFOD?bFSE!<)O=oi7rdSa z+qDItP;tc67eD;ndagvj&N_AKl+c|!Pxc+aAw#ssgKPPv|FBe{qNrDBU0z?9oXi@^ zK`xe!GI%kkSvh_yG_4Cf5Up@FT8p!Dsv&uX=bJKl@#Is)TXRJza(=%DjyNlJ5?@lR zj|K>9sKy~z*jc||ob_H_SOQ<0qL}C2%Z`+)wB6<5?8P$Yi%oH0ws>E4mu+!>&og&= z$-p0>3(h4o(1CmLm?cN8!`*#{68}O)?;ZjjVJr z7N^FJ1oLnY3%ar|4vKoGw$Qa5%I<*qL$6TBj!MkOPSg2XMQ!&92W2Iz$0 zl*tS3n)~c%!jC|6rj(TWr{!4=ZMUugSUhs}`8ACXgF0w>YfVt;zYm(b0L1yvHFsWe zu$Zld)*nB#w$SpVi~6tD988&gk#K?PFb=KpBUJnxg@=T44-S)D`k0h=u4c6|f<^i| zH0gb19_#)zE1VE93}42kxG|sO1)i0^^K#~32)c~j!N|C!lvN|!}J8W|fo(+Ah&cNUdO&LbpDzyU5;9iC%^M8s8v(Bt|>&NRT ziVkUXAiq^0wnS`2Wgz$R#9?kI&u2^5lsx=G{)|8bai+av>r?cGU6sO%%b~ z(AYTk^;QLNnfGJ2-pTyuVZlE*r`bv}Wz}PfyBtH2GT&jcsST8JBKmv@y%!^w@m`3X zcqPfv=&WmJNuVojXP5O*Woqi800$_0iQJVI5){Nuic7?7E&c86PhUi;b zAyV+5Ra2)dDT?l;ydJ}_&#sp0D~?&A(yok$;Ep}2!K&3RH<2l{iOzra1gFWa2jt(k z!$QfnJjZNxv%zPBs&j74cPXA+MXT6OI+)k%B#PAe%d|hfJNpuR!sClChxLQgE1 zffi=&Eap)Gojwr}+Bqz2bfGi*hDpPjaQ0avAE)XJ?GI<{x1F=d7RSR;yNt%$BS)Qo z-Td8KlfUJt;2qemKWZIliu3 z&Bgu=qq5gZz+`_KykX-%OZuo{;-c1$W_f6aV1p9dME!k-)0S9nBj2lns?4pI@@_A1 zBj%dvE0Yl)rk{7g+ENo(wa)KYlO9D^I+QCzo3zx~kpo}QNrtv<4}}8TXd$H&3y!5o zcy>N+Bll(!AXCh@|7g&_5>ef@oM#(AYyeCYyZF*?Mg;aXI10zt-`Gyq67Ve)g&x3W ze0Gp7^TfzS7<)_h-2* zUHaZimwcnm@Hm}Twnu=N%|2<7SN~Fwee(a1bsbPmXHPd)RuSD*5djfbdY3LBprRnX z6X`0wD+D54SHVV+k|145=m|A+f{IEBgc2ZhR0t4CkX{4d3vTi6_d9#`xO)^|nRn;T zoq6*ZoZ^panS;aNUUU{7n`kDU+~M}*kYZVR<`#5~|7%|qGn!4^{f-p&3nh}Mjee~O zoK3+c5CQkQwk*lle+0@W?C?*CAuxRT8*=72C5()N&EBBPgw+Sj-9ek~@BRbTc1tS_ z9Wg9o(~ZisDyyIs??XYqI{-5*3Jdw1L*8)qeZ1YlKfM!^Y2#uZY^Ct5rU&6O-e+P< z77=<8bvohdwX=?>?R}x2`WaPs*pISUV&7KdsZc-JPatrEp=BI ziLTs={_9eAqFTiC?$$y(?CXact>7B=J5O+oyxVgq&m?#^7f&^o_oV7Ny?u?e@q$g_ zt9#>ZwfJ2^PV=+coIb0Y9y=+d*;iiOrOw1GQNo3LG}JL=P=}5w4ZlV2Q20DiT$PUK zCYpE8e&zsi*cY!cv73UhGxZ6n1epJ%` zoWMJB3o1^XOx=sfyf=+a<-(S8I_bYLJbxmtisUv&o_?Tjc9u<~{6L%3fP~qfb5=mO z9%H3Vbp0pa1+eWIKUss+*kjN0nHvmF)(SKnqgpDg$SQBAd{$M% z1k=DN+N=p)&yCpmY8n6hgbo1c#27pE2=A3q&0>Y$R5CV@h0YBbN=Kf*i0WPrFg8aw z&8sw)cO!J1FT_QCvIKvr{Ef4rd88RnOIa!?Muk}aa^aC9UBNKgMj<*=!$xKT2$+zC zDGIfh7`&2++v&5ilVDW`@8b5p601v3RbCS^7VLQgN{Jp-qE3}>E=6dtsv)Bao=#_JA5eDQg*$}l z)16w6!P(FUpcoBQ2mk8V%I)%nhPl-9WcDtq3&ril2Ag8RO9zI1X3A$!zZtTKQPlp| z+<)h4EQ!_4!j>C#3>cUk;Tzb0nk%>WIBfZz_A`R9)aW8tGUvNgC_IoO5i^5YGOmNA z@J3%)}^6@yWh&)YF*PrhiIHA5qA-?s-cfn+_r-!%VP% za!ecny1Z(nUCJcZwIO-LydfmE7vae^)1oRb3)T_#$td!3wQP>8@@aT1!6x(bbwl?^ zzEi4Owfq{T;X?904BYttAKFWDUX$l`~*Du2#SP|!IvnUnTFTtGdg#4Vy z2e$kqwxljv$2rY1hP_flF1M0vpAZsQK33xR!~O3(W#wx%+Jkmk>wL%E=y$5G{qBe} zA&Ldl*xd#yulaKZUF{csmI_1&bys{>9;VElRd}jSh_SkMs)gyptqC0Hs_}kh<^6Jc z$q~)mr)Y~7eP}|)73&)xd}51El_2NksJD2M3tl=Mjl~Je{^spejLtBWu9G$S_M?v{^~qM#|PS^LOUSBH`u|yM7(+`0v@mgUC;TMY)K|Sp&geX}Ub@@oL(!#Z&2jIeI2XPpkT~E^vq!rh-*q26UmJj|v zgaGSr&L(QV+>ua{($|-5zR4I>`1Md)7JEvBMFGWH$Ew#u$3lOY$yRGz)4Kq({HAyL zN~T4L7?odB^sWO!^SA&R_KAa>)wQUSoJx-&S!shWoGjnC2Z+mrYnb{Ygv(Y0 zc+T!yCO4&rCAjdtF_++Jx%J;5_!mD!hzfVCmG25u-P#U=M0A#@Raa!trq^&e?aXlS zs3^~==E@8Jggidj8vnU)q_j{frHMxj?nxr8qty`G^#G{m3i`F~cJ3l|U?+>po4nPZk)B<3@-0su8O%<-ToD&YH!=qc@ zok5?Uf4{2?l;+sNNTG0oqTXR)2bW%tuF$qYZgtFHZ(3k|xZEG0gu=FqRdKVaVUtQ6 zHL2?6Qa}1ZPi@p!clY~PaQ6n|*bfeUUGT0;r4Txq%W`w`vl0`Fq(&byJx@l0bI1AN zV;y6*&A3xgI@%JMph2Ep5;i_D8j(tbKG`cGy<0~eNYSDx8Z}bD4j@;MT(|49D1kh4F&Q@W1 zpgK}to6{dEB=)6yF*T-aX}TqhKT%ldt{ot(w$+mP(gT5oCCw?78AGQBf^vvGp;oDH zi0r49*b1>^)!Vm_Wg_7|4&IaZ2>9o;oY_-%cQI0#uk2Jon^#%J0iXgx4I zJltw`vlv9Q@ZIl{9JGcSiBL~K@Z}M1>Q$K;QTJ3&6pFamc<6+baSfJV6w~ZJt`j*@TP^wG)&yW;&tt?@aqLYlz7N!Z zpM8G1@PDq!!Ct3WY;0BzfV9tZVqRy@X7AdL;Sf-ato3x^ak!;9574iQI1v2ZPC8K= zJ6vuRKw+lehm8cK1fIEkRFD(DbL4ikgt{6$66WHGLmiUsplDd4FKzl|XnI3Ev|7RF zJY6*vLTdm=x?$DZE#TQ4gcg`HMhEI6CYme9ZnPS7H4DYD8HvhWXw><{;n*+nng3E( z`pgWL(U{}1dFKr@k8-;I@&FBbORn0>xZ=E(VORO%zdY6XqUkr8zS)N9e>vo7o-*|U z%r^O#{vOA>;$~`;FnjgH-%)hmXk(M%NA4l5jBIf>-Abr_sII)(tUOKNsF)eCR3KkI zmw6cS_LOOK%8<-k4ZIz^ZAjr=q@l7tTsbx!z9zU%L z+Z>IyH8tSY0>`{K-85^58jq7jf{gF@blvkk7$8APa-! zyipw*RW`M`dB;y5C%*WXp1~AlRx`W#VIvLPC=TDm@C;G>kk@VKDBYc zW-WWWP0`BFDR97(?DEMB^5$++=;nl=ZR$;tvIFtYTVlAIi$zxKV+O>#(Ytn&Ifsuz z@i95{)&(5zZv`p5CQ-u_0rP#w_ft*{%%tO*L~}t&b5eqpN~!io-B)yibF#=y|y zzXN!E7w0rAoi#=eE_UbDEY>+{-u1}*YbTc)qzak5wdVZ@!_bu+hDaE z{SaQb9^nRJx86AJ|+!{xUk_|8!4$Zy_$K4;siNcGFxm z5?r?Oq%1|so-}F3hKVP*Z1{Qj>E}Kb(KPrIp{Mj|MxJ!LB-T@6y7@Q-`98bsk~k`4 z_34L>n5rYXfAJ+1R7<)@TMVHM?CV@#b*1PY4Fdx5G&(nd9(WnGAvjgnZVw{66SbYU z?p!-jAnN2|ZRJE4Om8DwpD}^PwS%jl1doNAc|+ZaF)!|OGC#}Ts2`Yr-^4F|bJ8 zhAZ#HkANnfe`Z$!J?pGMW3MCBB+_GwNRnC2ePfl-F1e(wIC^RAm(pLiv!x%< z1dWW7Hb8iLL_oGrF1L9EXpe4A$bxPj-0HZ=88XzGq#Lx#Xo-{Hp!bCO{SZFdAOZ#S zrB%#K54HIG3OQP{1j+I=!TsT81L_csx*QgvP3l=yc`&rWRgN&y^+8i_uUJbDc-JpB z2le-MT{*95SFoitEU|8h7MeHyQ}F`+r9$Uo7u}YnmbZwKo5Q)RbZR@N2IWQ4sjXpk zu(x_}vF}y$Ek?ntq$axOynQ@C?DgRC=^GZ;!OV)z{d!dWmT08LQl{f`bOjH);zF8I zrmd`%jjhg=C|{u|DN5$2(!Ry{Ep*@)uZYp<&V{2+jlG+mI@W`I*$gBk78h$C?S0)w zinItq_q54K>&_SP)zfa)X=$pIF;#ym5&3xDxpF4R?j)*mEPz)NDU8?G^$B<9*v9q7 zo;ML!yhwMLZl>`b8}dqqB#;}R`^$c3$u1Y=#3Jb-L@&*TM-f*HHQ!p&P>{L}dU_B} zhN{km3XL+|U>5>2JaX~@nCO4s)v_PkWy8BCkO-;CBf3(ao$r{?W?$JlAm;2-o_Fb( z_j2+YY+}|Ia90(OITWTJyDvh5StqMe^>4#$a$|J_FR8|0k$-jE@Dc5Qlh32^YVIoF z*2Y?Vwnn``jz60F^ju;Ii@Juq09rsXy}bT{Y!d0yz+LQiRi#bfQO$^C6B*Oq(2@F% zgsuj__5|)`+r4O9N~mU`3-*PP(3J@zZ6M7ay(p~Pav5m?cYqD*0d{BD+l%|lAcCWx zew!2@LRuxu1jfH!h7VaijP)d_?)Z>+lfX1~8-9{78Hdu0`t`R=T7Vv1GOrEH6?C_8nR zYDvM&QzarAaAEZjqe4}GpB7o^kStX0hAcU;+%_ydzicy4m}eF&$e&EiaL27LYep^Z zdR>H;68`zB&nLnO#)*D`>3Lj+(&6pWJ&O%Z6L43}hEHKW1=GFYT)0v3LaCk?6G6wV zJ93vk^B=p8Ju`Up$<(R=ef}K32!vTlfC;5IX*JRtAKkI@bTwC?R%(Mca5`}Zp26;d zvVPcNx07Y%r8EZWD4L#l!UEeEN;)@a0O!puv&mOT?ud5=%ir#TBa5ipwf8%#cxYYL z7(jx=65C+bI$0&cEkDVeZ_rPR_n2K63jZqj^`uw}|8s>DZh^ZFMlBeU-hz(XtiJ__ z2?Qx1_`()EP3uJXnLh)(sMl6|l1o%KI@5qRcM$4LN$EWAHY1j!&`>N7yn-pnU#dEb zR4>+%i&+5ZRO&xO{cO2!8v<&t=61b#A$|mOKsvUc!*`6?ZOHSLUrQZb?7ERzldq{8 zyp_1;E$Y^z&CtjJck{jU(-=rUjXX0JUHM2Ci~^1zGhMqn@5g2AdQUn_*Ok%{N2L1k zUzax7P|6l&dP0|+52wvaBYWdYG~|57XNJPMbo8Hu40gwXPSQT5RtmejQyMfy?30A+ zV~q(SVBQ4x?p^?`hNITb1+d@(UnILt*nTb`+|_xe<ZWXoe-mJXNFdw63k9dy z6F0F{V%b`M?U&e_dz3Br=t_@srCGE+6riYG*#9=>IZjO6$_YRX0TB0< zh&biE>D~32H=~UY3vkGr(-o7GFn-E-YkC&TKtis+pXbb@@)hRTw<;9*#_}?|FJj#Y zj&Ac)yOxuA3{sziA>}K`g^%S>rvQu&ZLDScA}99eumvaU3+-PV4Nx zt_jjNE4w&3%uU(nv-;I$DcsD_X?#!z3AzE96J`=OS-aUZ` z=EJJ!>il<%WAq}c-x+_&PH4%;>&wI&5?vg##5us-|J3(B=jMF3#a3ogcb|Zo5Cyf7 zj;3iWsId!IU;}YlSj4Y6_&l#AKWbckFUY}TC)2iK)g8XkucqMMf~-a6n@&uWyBxA? z*Y##&77LeU!>yy?o!19RoT9x(T0FMgXd$wZmOjBt`$KacUyTXnhQ4LLK9i3d2^9i| z-P?>abF?;c+~zT@5R%N=*`8w)rgrGvtqFYz&xy4x%#7*kNf5CpojNS9WKPnY6qNTY z&Z2}0*_<|gY`}Zhr9dIS#>AWQSXz;d+QR={1t6Nd(OI?)OrZ}kd`|;*{Y8+tT34l{ z-D<6e)dw2!qxQ5RQlSETxKP$wk=rKB%6H*V;N-Ji!=YjbM3Xz}mg5>G89Yx`XVtfx zE^3Xt$OSqApQ^s3l*TYWh;}oVZQKKcYw?-r9z|20bDG{_9RYYE`6e{&Mc$bS=l5aa zs?cf7NJ0V>%KK+yNm&+O{(c^fXl_m9Ngs`k?nhnC(JdQoz&r%Sa$L%TwA_pMWgT)=C!j;#d22}gy9v#zLC6yRO6cAu9U`I3F>8_-@YxZDBuiO6R2BjwDF^m zp=7@lw(!uMxwS3t#co!`lF5DE%&+!ht<)GEfjF2{Z*ot@%vSf}b-Ee%)Ls32_GaH7 zT*^`jIat_~#m#aaQ)C%RR;)3LcS2CJ9HG~u!Efh);2*&-^zK+ExTF}PrPDSh4khQ~ za$Yfds7pvl9JRxwT-}ZRAcQZmqfB#_+wdUNV~q%C(yFntkwA@ch*4@ubBV+Ycb?fY z;a82{Vm@>@R#T_Huh&`uqT2nJknD3Rp$IfsihoKyJKdFnwWA-^m?Ew{7g=>=`|4a4 z-zej^z0)N0%Npqkkc5B)cNM#uq|ra}=G4A*VWgeY{3%^Q1fl5xzv6*Mhz}*gbS{pz zt}$acUYBl|-F_>YkfL0;z^UuJMyT;7CBvI0AW9&DKQtIEam3ukPr}brv;L)%+7_YJ zxuh4#{xk{$cq`BwnV(ALNnJU_9!|&6`+c$j1})9`V)e$u@#0lGe+^vIcJb%zbfrC= z9%0_NW-d~gg|tSni#7$M-)Js(CC3~P%zQR}o0V+vq=i?bB^y62=4!~>Db%Q;m$2;c z@Np;V6Y_Xca?iX@yW_=g{vXPPK{yWbrkNhDRN`k(tBuozg>*X39I9$H7)M(Cu_6k; zu80R_e)D0ulIG)+_hXtS79XgAgbH_R`%L2KdIBLyp^zqq%l!1|=0-|koOPfjpH6b` zSmbQyyQ`xPx`1Qcb5Pe%DDRD10#dErsR%2aUe7{&b%ND}rFhAJAot&=hb%O`+Z{WZ zY)74)0_C#9Z1g9Vjvz5-1bF6>j`qH7snTYnRI6#%r(akmZ@ltsI8+rxQ(jLMAxGQU zovhR7b3&a|)R1TGM~Y}}%LOBE%65DVFf7z1IPJ#2B(!5sznP*w1-wNpt_#!Y9vEm? zU%ont@R|KV?%l(p0!VR#i>D9kD>VRgsg(PL-#>2Q6ryW?+-?zK$G~q;ssI$<(e@#N zekXqCJ9SIqv!kD%sxs}9S9Rc)NcAqxQiC`8#{qfbrv4*Q>$+&lkz*pxC3>dnR+|XhscZ1O)R31`kJjgJZVGTN zj^x36+Nzh>;!F6aHm*3kS@YS?$Vta*ZHL7$?{D~Te&o!$Pm)i;ByW4c7QeN#Zj#-yC!h8 zUB^FxI}C42L(-z?k!77@iXK>g801&$lv`WakLuqO!M@_BVl-%sglQBqY{AM_*e^4^4K;>y2hlxCJDFC``9yo!?y@%2ScS zlCpBX?CUL2HwAuoFM4-2oMc8P;uTrWKyS^bJd0}cFz?b+LW6p$GM6&7#4XGjaJ2>k zldu6qjf@Ql**6E63WW4?g9*BBH{G^k&DkzvzgGnDsPIFv+gz>7GkWz`pxF7Y_4TL! zuZ}|p93*7LQ#WA6y{Fi>yxlPQhPxHCX*%*O7{762`7@p|dOe8_G})Og_S6xer*o4d<9 zb|5O}64EW<231~KA9|^s=M}y2uc^0tQ2X}?-=RyNbBy6+EG?g142;m?S2c9HZ4Hzb z>=h`{RVZX8@ZU2Y!Rv}{!zCM=phdpuw3_l(l~wSV_Mv^LN+$rHj4KnNO>%H;5=5R1 z=(PyMz--l{SOm0NvCG@VPPE7qn5lJ`r4owg-Wyh9E@z{dV;a`ZWS^~GN3(;)8^P~CZKUC><}dQIblG-istY8PN-`7C)Fa>$bAKf`_OVs*az&OWyqUhxhnPlJjY z!KMO?z1yL&YFjZ8=%{-d6-?eU3Khrmlv9m9WXS`&d@p0U3z;x*Z;}PnTj6?zbyiw~W-Q`w$Dh{<1OqL_-*HNn+m-$KFHaei@Kq=hK ze7ZfGUR$Tuy9UaH<2FljZ=KjYtDYvFSAL}~@WC}83&5O;MP$EpNT(aa4{)TSXHZ_C zS6+Hnu9^8~i@L)Z{Q522u4sym%i3+z$O0iyHISXzP<$E0^qx{@%#L1JT>xvF%KJ;f zfN;1c1{%ImEg0TknE`&oofq6EkIao=4cU7OiSuim-6$cbEqC444uiZGwRZK&!+HRG zztdIn??;f_jparJUc|Im&euZ;P7j?ej~l@c-1L?jxFw;QVBttvS&*aW;rLuv$OamH zCO7i$@OV7|bxMQs^2S7SLusHa3H+9kqg~xXm%$AOl=@JX8N=0qIXT=UQJ}i~2_EA% z$JHYFY|;lo!v_eAEwB84mfOe!qZ=(XnkV?%lQ%^A=ml0*R;IVwub|X8eQ)R58bliv z$}T64;@(=*mg>RF3*vNn=}Qa-!Ou*Lpy$#G-DZ0xM*b=h;9JC6D0esahXw`CmVlg* zA$m>?ci1H5f709Q0h)6c@-_?e{ko0}WAkzvWmhS^AjQ%=HGcwZHo56+#)aQ{%p8S| z?R8UK_xeRPde_AteEaR`r;jJhduDc--by~bo3r4RjkTv`(N`aN1YZIhL=Tn)%{k90 zub1eg$_c51$DnF?gQQTFYeT3SYOPAS-6#6x(|{yUHfI+Dq? z@%w(-gKA8<2ds)ZO))=g+`>yPl6@D~v8ZARwghAetu9OFGkS?^+=Vf0ao|C%D0+(& zTL!l*1X9i3u!UY82_Nv*#WgaJ!I}n~`Nf|Y$?X-W8G*1uzR3cc{zPnBRT3&X)9DeQ z=_2bIp>Ps%hqZZf$!}2%hmo8lxa__Xb9(SVKV=?}WouHiVfISjh$7pRgU4?GUbLwZp`xiBAGfkQQ z0q03Pxe77BYgi7HVhR{c;<{6HEk$Hs-cP=;R~exkVcGk>w3J>I$fT8d=<<{WqnmZ3 z{j?wDx-mVGju|lGzv)AZEjcnQ@tTyuzPa4AX@wTDLzKzw2g;4faUg;y>*aqHJl2N- zh!SwV)(^P4f4`2jJ$}-^Nyo_>Zp2=5tozs*b%UCo?!WWrcd9h9y9Smz4s22lM-BG! z=b-UB$e)9Ro|u%995Y=@{{A3>$J^oLz<_nf2vZ$MNTH}OkSb9#Nw?+RNb3y1lRR{^ zW~NYwEOTp|{U0BjEM0IYqv>VmGu0`HXUp6Qyy*C1GK~(``5NbILvZjyhTF(j`3mZa;)pLB@tAon|eKh}_6rcdlemJW{dNu9s zqigfNTHp$1wA6#0f{5LPVGwmdkfl*yjr~>&>$4fCgL|2CFYwSxw)Ku#{l*-lGuCXc zE&vpNqf)f4C;Bh>!BkRZVwXUzX+M(L^hK9+wjdLSyme?JisCJCwANo49sq9a#6LH=YUk1UvNKcgHEVl#`jC?hLf{-x0`^G*#U0lU*LP-o1|UECdg{j)A=R?TK@Py@VPc z$Fa~AI#u}0$IGM6r<>e6-hK0*%+*9JSdnN~ynzyVDhLwn zxn*N|WdT?qTT^yyQ3l5OLtD$)jCZ$QVG2p2M&4gsZ=S*;w>xe~)bli#2m{f?4;ENR z<(TQz`x6zbLhmnr8|a20Fm@*zp1n~@0vgI~fnQVuJ(R`#$^&pW{4E!#($BBcy^`DG zBHN_?-RBbI-6WAXjLP1fR{v48?q>{2*8fX8?G>7Ry7%XvEWGP5Pe`4`Fm8|56T1B6 z0pSXn-S>e_{P&CI&j%~T4xWYC=YhU7^VZ(^?!)o=wx`b3%S(!i-}poFV*2y2>wPg- zyN1=}DJ!mP3`xE5^Ow`50-}|`3#oY{!@QGMiffwGiSy9K)ymdvIJ$YYbL5)})sY4tZcuwKS`ciyZw2%7>(3;8HFjXO8b2b6AROPim?P zQBA-vZ$LE+1ma4nOQY+nf>hiGC6eB!I14JRK_1Bvoq5_+gM*fl7)*7J`{5sesHt%2*lzq4Rs$&UtbxIfj6Azd@qWf_ZLuKT+A<= z_(;;3m`Ge5-<-jyHx#t6pf-_rb+_CGWeYsTutmBbR043Kjh& zh>R;k-aQXP{S^!s4Bn#KNbJ5Ft*${n0rG3g{t}ZcY)&F$520$P*g3Aijc&4w=VW>3 zG8}4PRj$SWsVoyFkV-Dq+=d;7yyI!6KOndF(FeZt?109pLr75CQan93*Ot9Ao#9JC zK$o602FEh8h}zzLARf6p)#&@RPjlmYGTio|W6_ir#L=IFY|y&~M_HI98;qPc_M@Vg zoJ7aGq!OCrtIUqqOT`m3YEEW)m+eZ@O?*T(haxf9pWuIjp zbzTQu77Oqq#V6N6WZOpK*71pfd^lN|_oPlzfTVTc_pj$@71>>mQb*?wJo14GBDw}m z+p2e{Lq$OswnW)mC(=^vIAoo9oTSX<9t8cVi}T@C8@-$;E7s~zT%07SZE@7zCA?Nj zI)=|$IVLsv4I$rQvdg)SCRcI}y17-8*Du{0R~N@b4rR(O^)ZI#@u*lruKGK7Cz>YZ zqi|C*05F0D4ru%{ZlS*W^S7dHoqh7YfW;T}u}rpe_QMk0#3*N9-)9cfZ6*=gZ4>@tI^(2l zF(gvS>reR~!8=DBI&JrM|SG>(gz$CCB)9)Ug&Vp^vEnjzm58+ZFQc zP_5<*zmC6IT z{bi5aH(Z5R3t}qvLFV#htTo+mDfSJ1Cn4`@^hH1dAcqw`OSjd2Roaz^(Ftd4^|8z2@0OXYAsvSNmiSX{71d+GvV)qRg4(BM`UzY%>Bl ze*&o3lnBotpL_B@j-L&tx2aIqvdID+mD?XOHdQ^Xlc&?KP6oN zFwY{iC$ObUPG!jXi@{J-61t&IuE>qM!i}{#0Y`wv28z;$ukT@h*Ihh3q5dEPJLAstA%eaLmiVVva}6q5mbEae+c8hVtKoGX<@bH56=k4TPh>kbgHh){&kLuj=2T=INC+#3{qMHWv6(eygsjKZWg|T6EGDbh zmE6~@HQ~}`$F83zYZjk?CbQQE3FU)1);zf6V&aX$Kks^Z$HHFhhO0`IcQ1?uT7HfJuual%D~|e9WoD*51EdFhng#41tAWfX zr;S9RmbzzeJO;C|m_BT>Hp!SuGg4apsz4kbPUenJOvJ-+yH5hf%y*M0OOuRr^EMRa zQS8z94E45OtM1w8M!1wb@Lns4V8=#xC!&)QOk3erNljuSNraEH_ngDYtWN2dSL}rf zlj8B6vV?KUDWWfJ)?#9&&CY)tAS5(wm7Ik?y!3b_zw|3SH4y@t%j8+l1Y|=U+^$|)h#ZQ?!`<;G&hP3I zQtMy)p;P!$t|Y`+1@Um=mLkHAonWS)Oq7vEsK31DTF;n3c5I_{O6!ZIrCe!q{N@!k zt9T6|b!!J6Qg~cx9&sg8Q$4>&BLiV^J7==7P@8OCFNcs76V58uO65awlRX7!$%uf( zm&HRRPW)r})dnK$eFq^qB(`{kdOg@-i)anit$pj9Z|43f)V=*abZh6%RVSbHcPGEx z>u{BklvOYU{!^%_w=HprT#r+zDXg)l?8i6Dj<(QFTuGu2Uo}Jj{-2Pt)XotCfQx|u z-?dN+@p8c)PXT;j+cM?UtsQnq+KG#ua~Y-%pq6An13YbCHM_YP+yhp;Kvpt1=ufoW`O6_b zdV+{!{QJHuFCGN}V*JG%9E;% z&nL1#Hv#pmEW-HT?y2N)S?3q!X=(+AHyVR?3OQ(pOH{k)7M3jg4;JaA{79dikx2 zaNGIN_s4wTnFbQz65w1G5U&iR-!4BhLz_6i3U6%}KApTju0R8ogu!6aB_Wm1=|KPE zyZyd8Zb5&zdT%2e9X7PvdKZ@f9!-pI)cV=Wfd8Ts1rGEC@ezR7n4)GPViTuVTh?Q@3<=;lJ+HeXv*R(YgJ(e`!9t z7#@ahrn0Z`s3)}9pWmfc80L$du{iWjLs|kjy7|q3bzd?tkQCJeQLd z>>Uhd6|Pzr|EbDvnsFuF@Jn>>a1Y|~`^Ud-*4NNr*|#tscfoM`j4y0&Z;^)Y8}^13 z>P8z0B3j!BfOovpFcCy}&h^wR%B~G31AZY|w;RF|NuIA?yqXe7-Pk_^d8-&3ZG=aK z6;8Ksn1?QrNSL;8c4&4*X|-#6rz>`GBIFZb$o)xgQZ!4k0b^H$BN-XPYah5PWs3^i zV@52>8_}^E{o-ATk@M&9IDBXcre4U>nA8J#o9yl5WA6y~dDyG#rTrRiX(^vJ%xZ6h z!n13#8|%#>>zpE^^jAZEe3kr6YZ2V)321vlTdFCW(f$G5T%#5aPMU2H4WGUAzOEu` zpi>`q65@8pJ2)8kJzkegpGn7}z)eaB$a)lCJ>Rp=$@XhP<$L#{l_M71tX^?ljxfX(UMKzL~w`E`JT8krT=An`umfBSoEj7b+ zPCQQK(fwvzEN5o$UHHZLBs3XY>Xj>voLtxq+Qy zK2Spe#G?D8M*`XwH_{T&#{cb;eU?dkw}r^cM9pp=h`l^}5{&6+v0A{{Gysm(fX;qM z5HJ>nv6;`r{(fBW3zhu-mTv)yuNYU#j)gYV^mcYeef^pSUWmz>It>>5=TYymsaQHQ z6y0xL?%Fas0@qy~DpDYK4a!n=Q&XCroKQ~q&q)?okPQSBIS};iZuAMWAG~jE;_Z{U zEvg2(|7Vt(X~an5|LVnx!Mc@(d*I19axC2<({r3@sv+~X6X9m1r5_4)8;%K5<*m_K@t3ZZ@AT)q_*vvhe=Ea zhWjgg`TcuO*arqftHVGyoZWB&1~c1NrN|eN3J$g_3gMTJ{M1|HE4?)0B9j0BvHjb1 z5%h%h`iF#F6OmU=6T`INfjm-IQnF5lfoYcDPX5H~Mwv4se)Elu3&|E=E&_f9DY$~W z2=W(uU(pAqHCoVBC(l(Fo#%cJHj~B4tPT5LQVyPo+i0#=M5ty&l}=_YP1%gLN<-&c z(45tB$;rt#0Y!glBoen2lK;6hFF#=(ce`aNTh!JsZO6e{6NA*G0PHL*l}t9?n`#|L z|K*Mtf(E612fIhN>NpTXfh!M{%AELZ0+VxNceX*t-2oL{U0n>0I=wyB6iIZIi6e`< zphJ?JY7rZ~ttD4R{L^}z?N&dy+KaZLIvr0Zmws!NbujRcJ79)wj)~tOM;cJ4f6V%W zg|kOpxoad;G_Lf)*d|!R!2a{69wC~c+&^K!NHL(DVS6^I1Wt&*dtWlgV8z7Nv-9oj zd^%Z(@&3t_cFn@t1O<A?y&5&2UPlT7ETSa9S^)9MvQ*Vkm1KDsz~1>sU+qk9!@ z8wm3BOLZjcS}7sjRO-a@y%s>^Vm}6K(O6IbwHm=tqM@FL@C3>T`HS?JTu~r+g(y#; zKCT$(E`>EULg1<0=BBAzynMWIb~kd7VCp!8WLpI??Y=KIXf3_UB;Rg&$Oy=p?{994 zhv&*lDy-OdvTn0(Lf0lswBzhtU6*xtZ6N~*h0uSdS#Uoiu%1&d;msakKz1CS95}G? z4e+@GTOPU&YHHE8_VzNnTdDOi!JDJI(Tpti^f(=nTVvK-{xyXj)dtuO-r5AitZU%O z1VITqgC89jSZ7z^b=F~mWY2P@mGM(?k@omIYYIEw0A^-Qm0!18V`VDb&lB>T`|YG4 zUpOdJQ%wv?4+8}e8l3|3iC&WglvN>1@;;#!0vA`E{f- zHV8iEc5lMyJ%}8?D+}>dtxj74bRJD~Gp_)y6QmH@lt*^;=&rNuCH}x8X25>^6!Q8d z`eJD2YKzdgNOCncpE$bFC{_#o;Z$+>!=76cX~4f~K(T?MP1YJ3>Z+Uar4F>KK+%hK z>BVU1VxyJIql`rmCAfM8Fp1XW!BDTU(8pn`uuQWD%uJAn4%O8)o{f(Oi6l~@r!Toa z^m6b{z!?@6qVq-`vv3@hikYpRZUI(TN5{c^_QU_|hDoJ!Rl;M;`=n&$nB4dmfMnCx zW@ZNOptMn3`~6$-_Lrtp^vLqVx9i6_l%hwsS3?5U2?`QYm-Xll^eoDti>Tjh?6O%} zU6W8e5)n&mc|i%03R?3@XfrVoL>Xvo$_w?24<(w*o|p^;abtCU!Xl^nc-sBp9?$aQ zYgzqZfdmDx1p9mLe}>x&p-rL{H9qdj*-VHUIpz(|{Pu(qvds#D^}`Gd zo^w=}C1QrIU64C&Ds$~deoxD{Z}&tkDqq`|n!=73@Iz;-FG4MRef|9WU+V1pa`Mi< z{k7jRg)N6q%x=ePwWf&59|A8z3DZ>yyEwPj$kZzd){1KZX6g~Cm*WeSzTaORS${wD z{qc;UXjR7v$b9d7qgPA+m5!Jlf(C}o93k5-Hr{$&QC*_6@0MCs?E4grP`^CWK@wtN zCuKC8Z-cge&qNeal2;mySM!$~8AZ&H(1d12#`u&%)QBUl?k%E1tt_-U-*j{|d0_{$ z>}^B`+2AM*RP^B5XaY;{*1Zw4%h+#+Ljg5s3s)tiDyOPuEMy1o`yR2fx-#*^-@R#- zW6)sHK^ro%??3gPZ6lhem0~!)Pc=E6Q zuBFn$F(x_Bb+vdUSxZ<~3FwAEw=claIt7Zp1$+q|u9~RMC)QWj(@pgc9KCFR@9Q|M zy45S3%m;+j+xsn?!IA*gy2ut}CN>u97)mEYhXr=2s=JgI%~#f&Y<#z$>1LV~(t{`= zHE;@nqL@d}=q;FT0fZc2f3i2tl697$vIk#!vK5B%610f z>+SQPfsQPdc1OmeKNc{$bT6cKX@BbvWBXE{@lJxB(>n3Qu%DNVTeYxV@WjC{9E+g; z+mG)m``NvKR_5)&S{2F3>?L|QJG#Bu4?O!Fb!pC>1Xs4&Di(~` z;(W;6sGB5Ak0y{HngDY3kU*RUn46nPsDS_&VAnjjv2j}mke*WbXt-&8kR=_&;ielgnup6L~He4G(LNPC1Ch_5UK&vd2+4;BWQ>rFW=%J`>l^ z(*{N-+fI3mj|Ram6DJ90k`F?5n+LEiizt6;3t$>q27z0P!||n)i%l83u`16ZZHrCl zVGqceaaXyoc~|WmAlcCweJmW^?`j_uq~zu0bu;_jO9K#P(5N$>lh4*1V6buB-TjdD z1OKtHfp?t8`L$b9w2AwF*_GQI~YcA z?vj(W^Lqs8EDJ0w_;K2aVtC870Pz{w0!@^GfIQUswm-=MulRb84)+Cgb zt%1G*M&)l_YA;+dR4zuc4Aur%{gSXziZw%bJ7Zhh+E6C>%*h9YRI4lq^tC3}*N7<; z_Qewjg!C9l<-z}=Z^r`}fi6fwOldZw@IFzVo`{H{ole~>i=Zv@HmjhoqePHC!0dmt zYbDT(1~>;n|^LMfgaN zCTKDBl0es(9W@n1N28q8)PPY3trF=X_)8r>wTa0|NoD2W=H(BlJFc!$@KN|B&fSk{ zujuIR@H4uvhKm4<;5`af=q6|718V>h-yJ}sb$^)x>o}FjUH(QZKe-mn|#&V1bn2{|Vp zz&*O&t30{A!FY&;uCbJ*0_^vmXw_#_)FBwqlK!*=7v{m*<@Pv-Tv0AKI6Q3G@B4``yYp_PYPH&> z#BOGyVA|Rkb_OE!njQk|eUD_sHyNI&$4H){qot#{WpXk-5ohsWgAg#^@f84K^3PJV zT#<5v$`cR^fj?Y^C@$_icH)HH@aBT+AdW|j!=Iu&)*MwgkPoB@|*gYLjrXRH21cvk(hletFpxw_W6s)*JvE}rvW zK-De`u=~!S4dbsU#)Hg7X=TxRiefNuXJ`|AYpWJp_-FssD@D;T7%a0s*jTkuRTAfZ zg+5mL81peB2nB#zkJi5%b7q1`j@)RAn6OIl`NO2S{IeN zz3kw-K!z@M9@r|i2f>QsUXmQ217h?sJNA-=5~ldXWITHzXS-&j6~WvChse#9th&E* zePWWuz}%ws!?$~ED}D)WyTnZVbWlA^N zMSvf!25c}ZyL}S0!NiY$v?U}b68a?_0N$s9dsN^b)r<|66Z}0hD@k%*_7t}Z0&$uY z3Pl}A+toESl2;^RqoSh1(5!8t;p`p1_H!-!(t~gP}nnEZG{^ zXgb9qE5OHVo*kcDrn~@nx~EUjQ}&%F=G)g3r2n>7H1Nmo-#!UNV%rHX*^PUKC% z52!PRZN2Ekr8$-}eDpjN^O{oGx z=s{h@LRo`=)Ts0t={;ZrsgW9~p+~w9AS9Ih^8}FW`{%kW>$RLb&p9*q+;h*IbApG2 zThv(f;UrkmyQ@Vu-4SBzlL?HY`#2X{EU-;fTrxgh}*+7OMk z^6)rKW<<`cKXGH@dQ6AGMR8k}aQb8m!dGJDOf7zXgPp3FY64PcJrN?BI}@^pD{dRd zOj?{mA;r1!4!Y2}yL6s_JZdGgZkrdBFgQ=Fn`A&Zo_!5*2-M{LAk<%>ljSkox})-W zb~d8k_4_qJ`+9(>}n(MOH|CM?e6h6W-J>br9;+7RIB9c`rqL9 zK9wVW7|EBX6t2LNwj9*{@g+YJ!7)DM-jcZ|^^twFI#K+HsJYKEga%*RzR`VJrDnB- z)xkmYA%N93T97iqJm`X)rM&h`f!e8!`6I(1OAUMCg!m}9jn{B9rmoYC0#Xa>`vbz? z|9g>*<+Yo5Aa(}O>Y$zo)dKzopqOf7=otn7K`X*s)qAh;G20f00_b1a7@_K4Bk-ES z2paoXk6~_TYlu`)aLWzCtzA_V=jsF^B6-vpSNIi|? z?DCiLvD}qjKbjSBSDCIzI95=Y>?^v}M{^pg-|Nqz9>%u#E&5Yh7}B_4?Yhe5S*fRx zUSdt|<6C)WD}CzBKZ3W~cg&zeN4RBLQB-MzGfIAld}s{Ab;aZ zCq?s8ngvTd)`45@q@<#D9P&S|?s_+mo;pX(zO-(fRv=_7uYDD2n+H=|4mD5HT> zrCiHG;uDob>w&mkv_mVV(I(!T5!J)|e8h{|mIjqg);RqwY+6QR&^$ruC1epNWn_&I zqM47+X@1t@^NkaEDX8+mQw~Qd&VO4^hs`p+J296mn_OU%=zIryBBa64;7-)zkw`9G zGBYhDSa&(sJPbzzxVsW^LoW_ZaS zzYpA;>%p^uS3Q0tifcWgB27;Of$LVU;T&hg9l##H+u+ByTQ(STaEuo`p-~I$_@4%l zn;y_h;1Jn8s}n5;Il4>%pyPQxCoLDkONKi3Bz0ZU#Ky+NHysJ}lMdW1 zfXXsk&%VJjo>*>qePhsi5`=jDx5Dn-zKXp{6)3D>$m;1Df9k}&r@$g~K$u!)*i%P* zW||(lPhbThw?S}(;L3b22QCdAU98XLo$Q9^c!Apow+p z^!GaL)OYRnuN)?^KkYD}WJ~xSMN(orRT-44lec`R;$kC`?G$)tZTf>JhP|}0D%&HC zl_lan4LAG+(G-Q%G)51%qI)A{h9)4#3wU}BihW2@n_Pc-xQwh4I|O=oyWI#Ph}#1@ zQ&lck;U(ckK@ews`ncHX12cFrSO}GDBi!O31F_pP2HN&KDL)zDn@n*`4OT(79dh@Q zF)-2%3)tcjRX)Tm3*hCM=GTPYnFS3ZPOKP&o+WjV7)*Q?vVG}<`<-w6O|gj^k7YQG zIp!RD#%L2l%8S@+{Z%td>z}l`3rxSNOy-TZ`!r+4*42VJHJ0ijh-%Wr5lI58DgQfZ z&TJrZ9_SV#q|50ee*18=f2wq|qIT~OL(r4+0%Rc`q3ryZ^|QydXUO-e%7GeJ4GMUz8o z3|XXv+csYC-Qjydby$BXj?WKS>R^fulKI0+swWAO%qm2oa%9+n=hepMV-=TssPwM; z=ERs3t^HjaElM*F*+A?RLJgFad`hc8E$v^Ggn)40e8uFueL!gP`ufay__1(kGL(BZ z2@yt_eKJzff>1&v%d^-P9E;e$dRdKCVINtB_P|ni6xJp$3hwzn3c>1GxqDr)$od;Z z9$*_K^;)*g8{0FelP)au$q&2Ro%{*A8Bbd_8%t{@ z!hD5CNc#8r)t26x z-{fjW$5GUQ2~N36Nf0%v6woULhI3!GG5?uiQe|@`RSfU!<}hh_7#QeEgr#Gth0xP- zR5%65LFg!J&KwSWpR-uDd53mn2p%sGN>+uVkcexFfPg0z+WHSFo(HI-(Av&U z3g2dviZHIjmz(00bS-}6$mH8dFYcrL#33CAk)h%lQb`Ux1_FT}5nx#u0-?oR6 zmV$$BGLg-!1#7n@M(wkN?ZU{o=`e0(gJ#h*v1@@hZ*|V}LJHg_sF!Ad1i(&$qdI|F zAu!y~>6S*CV39HUMvB&7brza8S)cqIHkoUmWv25~OJ~4uw~wbAC_v?+YT3efs>^q* z?|vsFq5zA6wU5J`M@6C846*ktgN#k=?+X9->LUUovie9@cZNa6cSd$b@}KYA5Ozv6 z&C{uyartuyyQRO1f2LR8E?E0vGVPu{$VKXJ8SX>S`imav0__`Es?X|z>|8ruDV7q? z)O_W*@jC1%mTn?q3%-kTW!(EAiHWQ538j`QPx>;~8h2UQoV_mo@-R>M&A|t$kFQ95 z5WS-J*SF|9d7&QN@k-tCszplOPGz=b-Shrk$}KiAlgW;*rH+66aqsXG*|rz|*?&R3 zP4LOfKmOaWy`=GW)CB$gaEif&eFF-S6e^xLqaaQ8T0KPNwm1|@E(dGdtpQh&i%0vP z%P#S@xkw@jqZZxWt?B2<^@C**NqKpBo3r?kbIaJ@U$u19#SSm@PL0jXNFafUTO%ay zl$0#_j4V!ZWN5^Gg5>-O?Np&;PpZ(ffaAWA&-({k>u^1Dz;>IOX@zNL4%!&0Z&q1I zzfL|HX);eYaU0p6mXV=}o$M`>MU$7$M)Vdb`p~AuHbP3k?^`^*O0q*TJ;&E+#z6x5 zK{&V@j%vq0m*~A?s0b^IWWudzoL5 zmxTbiMe3Qc4}0f0WlbYP`DNu$Ex6%M0p=-kRMBC)W0#2o-}+pff5JW&uL|KECLF|A z@1S-um?u2L#{c(7Q{U@w8CIB}0(z?M-A8rmr#%LVMMXv5SL8?b6*+IJOE2Gih-302 z!^i0@nk4JN=Dk=!&@hcw8{A4p3Lo5Zw3jGeZ}JFu+r&N935A^Jae7eRZ< zR4>xfxlI0Vy3O?v!WtVETsdf&GCmd+eeJfZxw#L93dR4**P@F*;% z_DG^Vnp9}9dIsgQu8R>79X%(Ri<#cu?u_N-&2+*-ax0cg28F971@X2+IyM0c%uY@H z_V$wg*9S*xL^0oPdpM8{0A+VN@87>)Zn+^XO2O73MBY^co0yU!EPBW|N+CkLKHHT4 zyJ=iyGmTLm`xvZX_o9O)6vV*F1FJvO)=-9Z;S7lR`8$+nJEpbF&CTEHb4Zp4JKNPY z$~H81+G=S+0TBx~f=H1o+|R|Y&T4aJuV=Xyl3NOqWJ54-`wPLbsfotL3OsD~xc$|4 zw0ul%E;R>*J#w)D*@;0Vjkehcz{AS@b_! z${IKF*mcmQRtTYNcUJoNxJKn2o2J#Ck0o%1S6f@qF%XEBqELH7Ya3;o8jlNO%6+H8 z4b2+Gio_b!@tNOU?Jm2kkuK9l19XgS)$a;%1ojnIC&#*WwLuSI09p!heA5+r12k*5 zb%dy4C;KWC)Mp5?G%?H>cCY*Vuc@^o^Ih)h>NG%r{H$xwuqE{)@93yyjet2}afQ>~ zwSJ{LFX`h~WbY$h20V6KVB?1QwlY%Qz<*D!5qTe%1ifz=V_IU9LHmPIsLO;*EjEy0O|LD!!+lM)t*pgfwk(i(~iLkS9Ak zS@}pt=p}4EU?8FleCw+Y=8fT{n8oA~W1~S!7W7(Z52iPjZ}+<1*mZAW{V~q;Y=y&r z9$pDXVZm7LfnLn9h|f(wxo&Xo7ski!5QAGB>DzIrA$K{#c81`$=_j{~w-)p8t^!RI zcFM}|A}#a5%#!-FK#&4?!>g@;_MApJ4MHH(?x^Na9pkH>4HZ zXRblbVbGX)oXA{?0)a1Jo1WUqg`if~R(H3S&ytXGb+^WVi8k<~krfWPv2C3_E?r`K ztD%cB&*8zcK*!p-Q=!ngzW1q9V|JXv+=o4tk)&i;J(pxf{j`jW7=HVe>vXyov|zP@`I907Y?e>Vgr zX`mP=te>fA3GMC>x4SOzw8ne>Z84gNENNTJmb z>Aus0^}0qzQG&Oe?NJyE29UQZP|EegBNOEztclbRHYoKV7z=o;lX3nTQQXyVWlYWb zxI5MKw>FwwF8{Uth_112WK(ts;yH2KBrSsM9qNp56^Bu-<867rWdFdiy8|(y(b41{ zTGjc^d@pqdgE6-hrft3YFqr<%n#=Z%pI`Iib%*lh*uOQpq$F6A5US9lkjvyp$v3g` z3nySlfaKpn*?3|s*psb_pMeO%cSpslil<^{f<){SV2ID5w|krUo2k8Ap{FdVEF6LLt%n` zetupnwJEt41B1|Uma%EAeZlNMK7>5NViOY3K)kwQZjO^9nS{eFqQc?(oy&Xt)z$4s z8!MHFc(0tz0oG*x^$x6vxbY58bgx`_hT!8wc3ikrf+~wMj}SnyL_p4*MA*dICAoi% z!2-?aGP1HGqr9WT!=c*8&3#;^N_$)=&qkQpc3x9c)5gU0I)ZL? zc6M0chVE7agGpXFcc{;Os zvz@!}j&*2?M1$yrx!4B9wD8;tyJwBgJ6d8B{ebTaaojfq;sebRRln=NT)HW{d1S{( zi?SGs&*Efl9J)8`f3SL|#MaXsvrlzY!`|_5x6-CfLkjj2uCPO_#IjGtran0sGEI)a z&r74DJ-$Od8gjFL3!*Ss1iiZth&3(pD?ABa_h{~mTS4sdBK3zP!CT~BU=vmSt-17q zo{HOM!2Kd-Br1hXO_!mwgk$%sUu9%Ue5-{@CI>ln^-aSCZ#g;=%juj{pc}tza5U~i zY@>EurA7RZ6vDzET=J}Hiq|_S6gI?EA#ZSC2Pgs@y90Hb;&Hs2y#QMA*qBkX7?&X+ zL3iBI6vD_JZ;pMM-Yt_R&WuHK_cQ#m7T{%U+Ah%ok(n1R8}wdTAriDEeX z13nhV(nU7H2E^mL2`+lN^q#)XYsl=nuRInYChwZiRT=#hyO^epl)?CHgyX;EoRXCp zjb9dM09+e`-PQ}INjr*j?lkZ*X7X3FmAMirw^E{i*k}|m6Dg4 zY1t*dPE)5|!dHE}uCJ#z97~Li>ohcd*41@oJsq5FvGy9?A==VSGTaDZRsCBnK>@ir z2|PObSHLz{63*?V5g#AL^Wp~8+HML`OZ$B3f1)?kr7s4KVEi>6imYz!dxiOz)( z9vO)49nIH}DofSp%f<>KdHDFKvDPMaYin!laDiqFwHNHJj$yb7{M_YRcK7YHrh6j_ zn^o4`LLwV(jKQJ~ClQ8ON)SioqG$Sgyl53(^RvS6KbbomX02P*;jMCBK+&yCKg+Xe zWkm|zv~sicVNPE6bt8BVxg!|N$}7F*(lE8JKdQry2&3<>vn95|AdF7fz?<)$&*Hg~ zr`p@vhUXx^X5>?KkWlR9*gEQqUVE2`aX-JwlkW#^p;upW&UE7sNgYjMtmw1TG)YjG zct(t5s;~tY*rfX0!JP21i5ZCvk-*~rw&Gw_cey)QNL~Swp9j3cm!wI_nqnM7aJ~-M zM3vg~6hlgg5IQN(4V}a4R^#B<#)iP~{e@|eo!*O3_OPn~1Me300x%O&3$AA#wT+6nEM9v2*L? z?&k=Zzcuwm2h`Nhq`oe!P|>QJ$MhGoJHK#9o(3WFp*1I-ssaKGvjm1pMr5%G( zuLK?=LmidSP**qJw9k)Q>OqwPi?V0IEC9py+ojn^Z?kPu$HL3mHfqO5ZkZWB?e#H6{YspDu9K_2$D7QmiWkgE_S1|IU4jShq}<>hsdq_RE% z=$q;G;y7butOE$l{)fZj|3DXNnCEOF2C0i{=)3D<6O#(Wio}bL@SY|Ze19A^Mv1=Z zTOXj)?Zl!-+uCadaM%f3VjWy6vF;C^;18hKyxriFf${8Lco{FGZ={jlc_ zxPtFwq96)5g@Iz>Nm?J%qSU8!6B^IlVRNP3n(izf@l)8dBdRtX`i8?RZbTHKxWN8{ zt{(61*X0C9pUs61+$z|B4HYJfCm?+xh${oZ=jcEC92@I5+GZl-cJX3c&?PMLqoWd6 zpBGG+iJV@KQT^;dRA!e6yamBR6PV7b9WE=wwI#ER&V#Z}07V&P3iZ=|hY?YUu(r0D zYb(od@g7gZUUAdP z`xn~`WV7IC%I6xi^};*6PtDG58i_QGJ`4qR9 zY#gaxZ?k_pXiN2! zj*xXUzy0RuA*J7C%~gaO8$m^YEx>lC5$H$iOI=FQMpM;GSmYn)YR>bH^8^*HXFO8wJkwHv+2E;6Nf?+PH!+VtRO#s zoRMcuOQz4*$c8Zn3~VXD(CU_k5V=BDI>fJYp zg#Lbgx$#FXC~P6(VH_NSu>4UjwGX0{r^;CsM5?`6!_?E62H<3yG~(f2wwW`uG}Xl> zR^-V*MTM0~OI}7Q875vIt<$m*;rQ0AMnFH??nVCXk?YvYR`udo%*e@xl2ChhIKNNP zenfArIy;v$6jHz7mR-vVevqHKbx)zK-rL9gBED`l54W*D!1~fPLnZ~!zwHV#hyG2O zr(|RVQH#^vkwWT`BPm4u@#6Jr7x(xUxV$kBc6UB_c^t_W1McTI+WQ0eyJ!URDhEn&V5WL2ChL6cd}_b)$s(*SOI9o&Wl4l zF|4J&Z|~1A>Byqrf`W9_W&JB6){N~G%4;G<90^p*Lmvw!a&Oj}cIMe?Z@_ca<*m-7 zfK|J6UUTIlpsn1`$5lgXZB@`$=(CogiZ37q|K-Gw91lxdmA%xm34@$zX=x~|LthJ) zUPOLIDsq(AoItgIPhjIF4d)9A(^|9Adf}=Df!p3Z-iuL-fZi*oxnWevbeB;Y9e!(YS0cowkV|_{7`zR8%FOG!P32QO+nxZ_e!xpM4$O*O%I>|7~C%l0QilL%s`Y8-Zs6q2ur^KUJis zkH6l_5pX>fHa;0P#XghPQjyu@97MnRRtOjy6;8>UY}taJOnZnnc5-^UVS2iWMO(Oo z0LFdSKu1989W0uiZ5nw&eY%d#^?o|CW%=cJq~20ezzVe-96yz%*~Ug>*qX&hk3)kc zCZ4v>=gDojdC$1I?B9(>BCD+(m za(H<=^2wKNw-ALs;64ddcZ6yM2k(N|3wz;bsnQc>-sna5 zDbWq3jyv^VZ;jB9!rki=#$)R@K5ybhPfAPAhQee|z8u&zD?QjisGt5|U#I3H)mByu zze2_aDLbMzNS~SOXmb!nBF=yEpYg@~i^yBO52ZC|u zP2JoqonH88u2)?X5{@9rNwsDS=jONnw)O3N|A3VU)`nDc=i+UViYwpl?xKqLk@^V4 zNul;!1&7#zY)Py*s;bS66YL}vNIab>SCA+#F5HOp7B5rTq^q~rp^+4Yh3XRM{5FFx zEIGx0?7!^25bjRzTSY^SRUuSq&LY{|`$98n-%Uz(TxY(EH2Boc<4;fMr@&s`4%$c;Y@8!G5K`~?bwSg z4zv4`t{+%KR}SR#RsSdJVPYvFD$*J@ooP&M<&(bUs-;K|yI{ME8`)c2xtt^+@Ojz5 zz+m)KLP*1xgzAy7l=z5STpGlj8ZG61;zAfsF_O8q%uHG-))N^aGUxDaJ;Ou0mkuc@ zDZ%MLaw9dBtKF56c`9yA%l|9UqGX-STvb1bH*PG#nwl(X1BL!Dww0!>j z0u>gb>FC&dj^_B~4P2qz9_88aAqd#s{ZjId*()lzsqVrgKYJgKsjl#c4l=>LMM=+9%rGUP|1@k~m_Cpo+6sJ+sHq@FhPS-M9mw zH_UwPBPJ}a%wu#|SNRzpGc=>p=I1}3fPpiE24?1Z+=%5vj+Qkc^&cZmqRkme=9&vX zglw-^X;G)+m{fauZ78lD(6?`~u(XsBi&@)FM_0~atR}y>2&B_ieV-FkpylD|0r5|( zG>LjJi}}JLq;rB_K|In#{)lX!r`yF)xw#`gyO$^AzToLpBJ)&{M6pb$Qt2N)G{WkH zuBmQVLa6f5JX>O8xM8Dwzly4X68*0OCtgIl+mmd%3rXa~!mwnG+E_W+;df8PQTpw# zFpn8$R|)-}(~pI_HqUc{cBzcy$AU;Z%h=bRI0+NiD=sK`NS~nC_yzQ*tUN~RVs;v}d&iH8l>HQuF=4An9PabhN z-Wu)qLEo9tQACJJQlCB+Dy$FQG~b#s+EP#WN5X%szGQsd{-pbO%1I}a_ub0Vvo!*Z z0?cNC@|mx{?U=3=HnagG5MT@~FE3LKF|#T3M)Fbtn*T8h&if-rZ!hYNW`4u0xt@0L zbg!gM!1)KVOcIHjQ90*KZA%v>OT|A2GF|3M_N$*8k?4I^zib}iL5{Wjj7Ve+~I6%KvJg5S=O{$+?1bZ zR;(xA@DJzz)LliA{aI)7Kxl$EnP`t3n}TsJwE_m0L&wdPfZNG=P(p zleuK&%2JP8$_SYmXik)>(eNeFF!RjOv#yePscd(3 ztuPJ?=ik8Ig&}2w+l_Z8#>eZ#$n=!^r8Q(f>V(l^L{8STBcY#erQn`v`_8rH7Zr|{ z2&lv?;LBqLjf$Kc33EG`+5|e9`QphFG!t{p*<4bksIhXyk)|;4_g=SosTwO%Q=C!d zTDU`BImBKc;`BnV4@KSMsIGqWW#=;w)Xb@aqAYqcaa@RHQf;?y~85B@6*!L*FEv^K|F&5QLK?M%yBwYa|r zI^!B-3A07?Uh*=22Nx6XJH%_Q4wZfEaGS0+(QxgnHcf%Ywa=?{F3Xvz>%XkBdeQ7! zkvPh=d&L-hi#hl^?`8T+r}8oNTFncFzLFCpJP}N50=DJEFMp<8oqaz;DWp^DLRH*H zJLy9zYt$faxm@2YJYIs#2y`Cp@FK(3wtOek=?b(_cJW{xx@RUl(!8#ya&`0!5tdiJ za#evTv};$evrpxY=}KAVki9t^;HQc-0|;a0cF=2>N)q6L0*n&ACzQOK1CCw;4=DAa zDVj0y%z1^%n9@>N1s`wk+{tMLYA_xn28M#1m?E$`fT>42mngNj3ryjj?pT&_wzqF2 zuZ7|x1O!|@{7S!%U%931K5FE=e8{OYSIB&I+lG*W^r0UJYDqq(314Fo&22E z92fr6{KYajhsINOG}+m^A*OF4*(o>1s`YdQS~vLkV&88*vUZb?F8%r!w|A5mQ?f)& zFL9??6`6*2n~rsxcDr6Z_p|b|=Px`jlYONx7@C1XX`5|amaONcv%JVZ|H)GO*r`(u z#Rhs;QzZyXdVoF;o;-b8U`urJTW#kmWkgSiF7R2WJ;rgqNI`{F^QhQ7_m7rR_ww>m z(%w}3 z4^m`9K*{*W__?98G?{9KpeHU)<zyGWH&C2r0B-W`Yi6;zyE-m{Gt+OFwIt51gCZAWOg;D)4_YxoS5MjnJw)1aB5(HLCPa$80DQA>WVb?Pd=e) zkmjzHqB~PgEtPWa&aN=?9$C;CL1Blj^TxU+oZ8$;WGj>9@d=6W_y~hBTe`aAl1Y_` zhfnHJO}-Sy!Z-?>o9A}Qy^E-(F*uXCIrp)m|2_`=Y{`-ry`FsFFiNda>ojuzY(ZqZ zUHdLsEdxEhy+d6zGA3ivLA7L&e1>iya}$^!Y{PykvXXZyDSdIe_ee_Xtzn1em2%ga zskV}*_kO$|M9=Om>%rD)$jNnf<=GY)WM0jN)f%t5>p3zqqF-MDgdt;3A4b*9me|&( zq%VQHR^a*oRtd26>WNZH-wtc)qVg1D;Jqr(kl!+mXXgIisV;h;)S)vs->j^zX#4a9 z+`Ye_@3$KbMb2b{S1TCGG^LYXBcP_C@%+w;w2^_)mp21kwImYh#Y|^enGVtA4>X2I zA;vidsRkd)2#J%&d1L_>aw?@8SejkE{IXZr7bA3QqNDMm_|uQCjn`&EPF7xo!j(?K z#o%CSgoOFEG|HJP$n5$q-22gecB%OnPK8B#E&p?OlUGljS3v6yuVdw7Q%)c+>*oT1 zHdIp8I=MORtUptgChrb(#Sn~ZLj>~@Kmp4zI&na=cuA*%F~^Aw*}t&zZM6vTC}Od! zQ(4hdRwh_aA3uJ)Iaqe(yjMvHHYB`6qudiKI97os zx4=Eqf~ajfcD4WgI5KvT55~1t=b8viBO@~+T;Y^+wJpt!E0|C2qLRrBWQh5||}pHzaqTwHP-P8+Am%+AhMpZVkUBvtTu&!Jaf{3sm{ zEsqjcTu2#C7@mY%_OVm?8%duiicyw`D@E<|cr^SH(PHB>} zdS3I5?6U#Cu<#J%;IPYj1wNm!hpcNbdIi-2J(hReZJcu# z_nE7j(SI2p*UhtORBz;Jz-6E!&8|$Z!a**&;nU2>CR6dxdvq(MM>7nvFO&VZ)%E20 z_woQR*fx~WzTOJj!>`sRfSLS9ut25q{Vn1#c5%aKVVv6wktR zuQt?-gE9>!4&uf%vWw>gcodulQ6v>lCcl`8B>o-6v9r9EJCsLhF=(Q~;q)#Z#moko z>({T>eLC|8O6}4k3Ae2J5gp$Zf6KmOxw8kQpMUHnx-EUXZpr7gM`g%MNJvQS%&V8j zPACor`80iqBU9(+Pszn;S@spXv>l}V=coVF)!XP^x&BJ9cHoo9g17I=EKyfaFU)o1 z=ACz?yLd?%si~LD%*;l*d_)Qc-0nuduWwaPc(|wiwNQP&d-rZRQ*p6tr6vbeL({eK zhjOoqm`{G^n|9*=yCkoEsA0Nzsd?ny;H{2&@e@ZtSL5hZ7G#zaq!D!?eo=bbBZcWw z!=V09%7LhNv*1e6dK_#kH1&}Qd7|TQM!<%J za6#DZ1HNckK1GT+e6X6_aWY9zKk7ouZNb5+)}tXN~{@0YVuL|EiW2LOCew z|N0`+=%wXx)gO=>JN5s;IX4UqMn~q9`u5P3Bu<>rE8;AJJ@vV%=k7nW?Q#2NaqmjJ zAS$OZI@}xNfL?A=hGC_NT)AUkb@5>pbJdW8)wIaGY%?3^Me$F=+Y$m6ZnB zM#8ABVy}!j&R=A1o;CL>e)a8plTO=-ecw+iMsVz9&!q5yV{%v|ki2~I?p;VEF)@kX z0L-Brj*FZs=zi}$RQR1?EVA$K8;TK)h%3j z@Zj2-?XTg2yRtrz4j&nMWYe(J`GV}-ZOWrEFc{X+>)9&iJwUgWah`TS)javT=gP}r zt?r^#ryyuG+^>fx{KCn(FqEIxmFtz@G5IC?h-!;<&eeSfYz*^?M@v`cGTPGJV@?t) z7~}Q@o&&yee7mi!_?pkt$XVUf<%V!A$jOd<08+~{gbrbx?@f~l62>C@m%#KPFGWSg z;emlG*~>Fu2%6eTv#C-u?HPFEU!M0I7fF8{zf8l3=G!i29!wf_aS>B%)IRaMx>Br8 zw)EcJhmOe*>l)H^?qU`6NdRA=7j%j^OOG9vybPU{;jLqBAu1js!osRY0{1-2imfDm zFXngM{ZWV&S~h-rZv5rv?P`H}VVW90a-8k`zXLY1)iBYhT9jRjU}?{CO)xHXJC*V^ zRK?>G7Md+~!9~dD&n=7_%C`cYNSx1qAFbq*?2?uG=CY{43DT4O^>8!&xrMf5O@)G6 z-3E?bg}M_Rjw54ZeFEzIidMx}UOva+Qrhhe(hc#16q7QWMv;+WD|KwSpKqIURn;$K z=bDhI>f$R2)hQ>mu?W9nmQ86ToE`i0><&0k{UI}HwHt!)Uq`CXDE{#$gbnXO+@9mV zzq(Tbc&DSLmaC(KEf_2s;gP>n>=f@iaf__7i}$CAG0du}#0teoNQl2>ZE3Z1CcfLc zC{Q#VwRdE67@->0whBQ?_XBs6l+a}JBRGm)OUrKik-Gh^5&P_k)23Y&K9P%)omsD6 z|AEq}(K5Y5>7^NrdD-0y=9T^0?VQX_4T&oSph(rRf1MD+Gqi1X)>S?(_ga>9e9Zq< zR<=3LK;+sUN_3 zOuc(R4R*mPuMSft3Rsr+A6hp$Won6|%wTu(w}?t8;YntGsMZu_Cci=Bu%qf>nB6 zx@eeVqgty7Is2p1Qoj;nec|CF@i(5ly&uRs6kfTS{`%d!u#SDh6#I|Pl|0l}=T-H_ z&4z?cGLM^Uw?D_HjJMQhpKzPHyKUCVr+WPMjVlcy{N3SL>qDlx=ifag#@*>96Pf!m8n5W~sh(M$T$I%0lf8EL?p-=~`U7{$Sn$_sb?sx_Yf^G{LtCK-|m z9?bLj@i90?8bbExWdUCiiI^-kdU<*Ioq-2R$S*0lXW{NG1;X(R63Scw0`ZG4S1Z;= z%SxANH(S_LC=euVZ8R z_%+VFG|Ef1f6s8oCW1QpHJNwq)gG0#Ki|InU1r=%D+$_3y~m>{djFWe1j`1#b*mP8 zp-$0zGB5g{+h=KHpA<7+x(s+-sSeStaQ}e=<7Lj3Ezc!XWR*p+Rz-mmk5l5?y(k5W zQ+>5XJ;~vs{<>OPg(pvje1!ug5Ng?0?!|fG;%OZ_yYxbbzQmFG$WJ4#wKX+{2cABU zL{BO&jN|C`{)MrPv|sJwAMP5TXnAb8&^m9VrWBhD$7^cB)qCPRr>{0Qr%3!48YkC3 zGPw5t&1l}OOhMX)P28u7t-S>cyc&|25*{t@<-bl9tr?Ci%Q$dnikp@p_!SwO zZ_|8ld$s4+e+H^?`XU)`-dwJa5bv7I$@YRI}gdPBw}CerPCQ>;~99F(F+$YfHZ(klXt=3@$C*g?_6<(PCM_eNE~a+AfK)9UO>F& zPHkenJ2Y&K$2g~qjn)<&w0EVtE>ut84Za<3$Z;6EVd}PE&G`DB7BnZgXU`tflVd0S zmS(xEBZN^k%J;RE7bLa^@`+YLcmeWB=<}h8DbYV9cuzEv@*O&Fl$eM^hNJ|CvWSR_ zpI+S2&Y4aK%y^kcSN^kcm_kYU*;4g*y2}xi&J~wu{!ucj3g}tC%@FhQbOKWM-1>~z zQ0EQ&a1XJGZIf1Et&rEeZbtumy#f8THnf0DtM0{axHY{SaCki;bs$6FSDgv_Dg z1x9AX4RGdilCSM=`}DMdmo?Yp39l&To)^r7hs`B1*~ZgSR-a~V8IJT^oskoAC34p) zydNZ5jvPB5Xs(y!lVwz)gMd-I@8FfymDW9oE&#Kno;ABT+x+O)Bj7+rNk00*Dj22? zwXcE^>!KYRU$K9mXZfTJb8R)r3@2?HaWd3~o9Z*;b4fEHCVsITq?ViSKBx!L2S0K? ze}3m{kepVMe0<6u2zJ1doSGd(RToTk`;!1#Mg45t>uYN}q_vf@g>jyG$B)-Ad-`&8 zxhiOD!lhnwj&lnOVkDzDd31ZAfZr<^`jed!y@m+8(61FbWRb|8hK+;Kkkowg%sRLF zlRk!9R%+Sr@94KSdAAxq4cPrk(!lEJ=)CT9 z-<&NwIoA>%9rj0Lz0lK-Hz312yURt=A9tWJD*N^8KgEnCRqtO6l2XtK9=#)9;PPJH z(*JtVw7xQ2^W;n#*B5;r9-j94-JcbVx~Gg8b*3n(FS8-xT7^xx)J!)z04AW$Z${iy z;`1(9jgD?-{xaPAfzPkbKYkMApqCT46az(~da}w{&}R@~?LDJl-23eVkRL<#)QtY(@AjNYu?0Kv9zk1lP3y3t$`uDWbUJ333< zb4(`GiN~#4>A=$q!3ohfy9=|hiL1+t5#D~((ctPcX9WLJ@}8F;ib|*nA_1wlY@khb zXFPiJNqTy@Y}_-xj{CHORT|}SC^-dkDt)>Mx;w`&2HG-QgoK3;l3phyxKoF_+o#^u zt;+A^=1xU0gVwkFa&d~Bvbsz=E-S1mb}crgc(ie3$SpJI7JW{rIzBb^Xs(x!;nek> z)a3F|3uSP>UHm66_w}82r2CbbU?aqtns9vScxOdS=j`Sho!x!~**@_76Y$H=oc|>W zq;>0EHF?>vva_A$c$2kazw+@M)s~Qed~>{t(A$;c9(Juzi9C5#rlU(HWBB%&ATON% zYKE`P_g}Aq^#ZhW+%!gmJbX!M}#&wftP1fKrpU3bMRWPa`~f^yqnGw=qB;Hu3Lm zvpRB5BG;OFiD6-3Sx^eCdO>!nsTlFbtIFK^1E>hR8VU}A;i8q=9{QdUr+m~o= z$S1nTq|86zm#0tK@M!HP_cj&a)C-w5-$^nu?`NlO(Duky9}lrY%`JN)}h+%5XK{UOu$R=7`3ad~52_sjgMkk|sB~IM))BYQ>W$b4`|;B6`YAlomcD zT=c^B9?B+>eYHvCGbNz!Zl}}Lw6%4;y`ytahDO*Ey9zRbT`1x*8E4bvmAO(^OYe-o z^!M{V_y84Cw31yyXInjtoL)8dNi3h=iyf~4Z5RwI8Qqeq^Y z2j>I^21eHuq<%Y?(gM23g}?YjGio7CNe-SUfPlB3i%T8LSe%j&5Fo4JDxJw@mJX1d zmEO`gn31$=qQih;W_vy?^=P^w)6=MVw2_xsO!+pTmy`@?*Ne*iA3wx>tLQ1S)lU24 zRVxaGGSG4gK|DlZC|(ydk;hN$ZUhzKz8RgU@ALBsro{@%K<0(aXsC*>_T$Gjb^bqY z+qN)6F*g9K6!GgTU9fkr{UB9pHOOu1^-)lcc==eK4^4ck+h;NlwDh#|fm-1Nw0mj@ z?bq>#)b4`jf6lFrTvu8oih4};B;k^Y$QHNS+RX_*>vj46#|JQ0IYcDU@;Dbtu;czM z-G)+NF!RIt#t_|vGjUpe%Z>Z|7_&R73qF0iSUQ((-{XygV{W4Vo z(vI5xk#aarnL*3bMkr!~pMr-&Yon}bhGTaj4~a29Wu8-IEBW>BACo>l<+5w7UVx~0 zxxkS`P_wO(QCMrJtwnXc@t-QK?)FQsG~hsVcz)KPz#qb_vB z;BP^kt}cMHj;|O@)T%r&?W4F9x!W6xic(VrYY!dDCiv~pqiaCE54lJ6%KJTi3M2UK zP*@TuXNG`+AdZ>?5;kIJ;@9QY$lyUuV+39~J$@Y0@gXN+m`d>xl#|gXYcCshcFM8w z8td6p3Y#9m`qM7*O~8LGW3h2oH-6(dt2sL6<+NY8f?l2BO${~_&95Pnw6zr%G6AMd z#G*hcyE9XoaG`Km=}59YD742=(JGjb)6RXV)N6%04jP%!)gMG8 zQ{#WzyJ!6DitYeBxX1~CodS;q5pWQ3*mkmgd%Lb$UCzl`FRD$w z4b|Y%)l?{Dr9b~@`tJRac}!7XnxUDu8EpNix9RmdgeKF{bX&Z#aGW9De;Xi3%0iVNx^C=F-N0?g%bZ9cHMbMa?~rlg6Uz9Q{`dW# zujN|30zt!iGB_jzHnW(z)y3}EyGMk2^P%AJW2t>cKJlMFOKQfRLFp1!G_d*h6s=YA zFmGF)p|i|W`)ts*?+7ZH?)Yu@&5j`RJ4?6Ib7(761v{X{>GO)yh1L*`W3jQBZ@2jv zE(OI1lMyAuY`kj<-IImTU~E2!2ue#;N~NAH)^?<6Un8Z=uC?VE#@e!TzRiM~CDEPK zoA}c%p7=#&8^2&dT4m^E+Lx*8rJg-ESHDqrjtmbUTfOuU5nO_KrF9l2;(BSKn^tj5 z;D1Dy-xsTHTgFDm-2emOu)}*y5lQeM2{w&`=?ltY#swWOa)xB40%z(gQf}SRRid}K zG0653$K~i(jc(Z4J<-wC&370Zl%5t)w0bdJzPwgL@NcOU3uOx=-#=a!7j4k`Vln_FVE&CpZ zv5#dKDrMgpV;_=j?E7y1XG*_&ukZi!dPT-K^ZA_foM(AI@8>z?;jvNK(L5RE6V21i z$a7~98K4TQl;27x4>UG?0AB?t@U~6As_4q>3ZWxaJz}M-ss2Oi_}q9p5wl(h0u;b6 z&uSCj*({!MTO(xe&^d1w=Q+*xLP~e>w5~fy;&ormmC3e_-7P!$3g%n4ltJghaDag~ ziq|I&?umdiMNsFNZo`&-0B;Lq1GcB@=o_2c3!&zsn~R1}&NC6U8UjYO_*cjKq4ikt*J@& z!i5in-h!~&ceHsMVw(UUUspp#G4G9|X{^*tO*MSi?JM#t#J21M0nOqn2&3a|FfGPi zBgr*uwXqA+$^Jx^Y?Q0#W0ZdNk-~VzZ(YfTCVg|GFJ|vl%g0v`@Wib=u!rQg&`~X) z3~HWCg(+04R;*8&e|xJ08@%7hv5_lJ!f7k$-BTiwT8WOqU~o`Bo}H24A`gJ37YPEM zU%zipg>hjstcl#RZ*tVKIiu~P#dfFczJKS-v)`|_n_Su4+$1C_h#>vxw=#D3jx|f zH|BrNx1As)Bz=CME8_X?(LVdr#+DXrw^{X_dn^qB113Lu`AwkiEH(gcIK{wg{6{giv^aufyPC#>vPeAo z`|N#?QlSQUhPh#kY(M~cg!7{J#Y>mQ*=<;x={_wkp7QORBXpN%1BKKaLbwY2L#+x& z)cOKGqdVLPYu&CGOv9(Pk$}1Umm>Nx6Bn04wRK-k&9vE>bEly@>yx-CqF#Ksy|mYE zfv(qVZ}N{Hx4wU?W#KQ0ejZa>KTwzPb@F>%ojI;`PRMyN>HKZR`mQDwxs+H|G^F^) z53PDSJ&dHpyn902;Eg$asXBn@W$x$egSwW&fg0?6R+(TLDHeWyc>oS$R~b=0Ak>_Y zqp=5xsPngPC_Xeurk3Pa4*MjB%{HNTiC45zi!Ix+dxcI<%6}lPkcgCk)HV8uiiq&K z*FWG33eM`;u^KLhXliQ0(+X;~BQ!P0$sSln=__VxQg}r$o*?(ngwCklW=0Ij@7jGk z;jz6qdFo^12N%@=ek(ZRciwaAD`nDQmyUoO;qA4TpZKl%86bgy0ZK-odK>(a8khF% zsIIK-hertbqU=5!GNJ45!lJXLp~2W{H>%*EMR8V-tWGJtEZYG9E3k86K_c+}D>@huzn!S4{R1-M55^m2pmicLaGYB|G z|9Vz|!_Qiz!G30qB8)LzNcpM!F|y1S>f`?P6COF?TudxVG`O6*f)_w&{{1+)0LlDh z>L~)$-qiS0RpNROcZhLJ-0zYlP-lS-{cloIHBj{KBe*>;@$H$w6*2B~dQ8 zs6X|7yarK*Kmv?gqw|K`*8jauzK7OH#x(0_`Y+4{44}B;?Cd<1V&K!gTzM5xhVHb) z@aPXX?i&2F%>$)D*zh#-;;jwkdMeh z@)6xX9^99F1FXPw#Jh^nn;g&B08%8&_+nU#ke$z;h*6RJkPyo(m7b{oMP_S|=O&Ta zz{M9OshpS~+Fj%(FxKCQHD8+vgiiSWNuej5KiJ{F-V44&7*n2#VobjemjgXx!1bU7 zm#*Tk%p_xuv+f4`m7lidPoMsQ*dNSE9$F2K*|wwUabGO}dx+#>fy+B4Pd4K`b$e+k z`_&*uvy~ppn2Kiwaq=1eY{pEFL!`WP-xGc`W8t&^w-|24<^x(1C)c8|uCs{_vzvw) z6V3W*7iBeQA_vW`A z%DtG;^^c3xeg2R>?)-W*lY*t)-fbhhtnAyr z#&G|iF^(|=FO9}s{>2mJ>kDCTiCYgo&-5*p7A#3pBemoc)7_6BmY0@3Fpf`5m`_$6 zYis}q!T+C1<)b0x+W)ySi}SrfR6-yL!AnOYx|Vj5HvK6_$2+`5TR?;3flZRd?YpP?Y6nKohfOd;xYh$ymwFi#kL7j{|L+d6NmO46Hs;# zWte=R4rdfei%y=Q*B4*Ae*Y;5L*T`3b!xz{gsG5j*uS(zmSZf2l|3yv&5%ik{%Q25 z)px1?($B_+tRVC`<=gj+SFTds;SsO-eaA+s#r+Pmh>v9}_8o7Uj8MylAHXEfFRre3 zJ4A(i5arc?het;sH>%@4h1W>^dzQZ_04@2?l_WEJgk>YX2_<&2vbDu%4z6(Mt;dA&L@p52EoIkZ}YXNai10Nmk2C z>pgs7PuN(OH3F3NJYR|JPngh(g#Sw+HXjlr#5a<1NBA5lM1)UhsT@vE=t+SbH3Sa0 zTB{AE;xi9!c~Skr&*Lf%2~5PB1jVHA->?knE(rXwQBk=u_mx{xXkOh6W%^q$`d_L{!ASuQwSsbW4q7G;`WATHDukcm5Ha&wUdARnrLeTX&V=;gMm8 z6!s;>@Ts)`)5Di7d||_z9*hY!{azJI&A?D z;+F#cTwVi1!M@f%B(zV6K)fRF?A_O<@gmmzBPpul|D&rZh(!+|aOJ|V%NM%qza2c7 zcFxtHT76zcwQR|m(%JW28}WABt&9vSt{(|6 z*4UovYO`Ov5;c<`Y?ZehodNigD$|&Q4{mHb3`%&89{Esv|N93E5-cRo#U&tRmqAQI z()7gqQt4V6jKMbsrG|t{qte7>!>_`y+Z+=okHP*1L}djr;-j|e)xtidgV9xAW%T{p zYX?7*Dem+gV|ZsHBM&EeNB2=*zaEv_+2#R?omKGO!}a>wGbsO9S_(kco@0kUIZNOO z!lvMREa0-8t1hzR_Ci=p(-wHb)GT(tYcp69=f%L`<@Oy8ZuY;IpxUV2@zoShp zGj3`0Fm~zAR?mB$d~gSE~aGyc@^0YTiM2vEb))> zEHb!B~3Ni-3-@(1*g`+NYY^YoFb9~h8=+uvt`Y`K)*&H!2^Q_q8QHtit> zFg{K+shQma{A2$U0v4GR6}pOq{x9DihjkvzWG3t3&0}?n@?CpJB?E}sBb&zI-=E(j zMeNK=lxLOO_I*%ZZJcXU0@7e(^Z_$N2Ih`V7bGE)`+_{f7+ds9WI!Ha&&`of@cOfm zA1NuyDeE*5o{ zbe`*HP3+9;5P(6)pcd63ov+8ULD<@zCq)J9j*0q@WC^Wm83Y_o|NY3b zwS}%p3&{hQbj0|72KKoXY=dCvBkcunC9!9)D%nD)9|T+^oB~_>_1CXFxhqRc9W!~A zY3=Rri{2j?{s#_+{B^4fbblGV3#0Wvuuf#HKNpx}D5CNr9|v4)rA2C^x>+#1MQ#Y;e!uk1_zBz^?~A z`0|p%?b(}q@~uLobP4HF)C<3p%t;tV#wNIJLy8O!-glqk@a7%*Yl@c9OWT`~h3Np= zAcF9*n)Utx^4?5bXF!8mpug0l`zVE{k_<)NqJ2SFA@S^4V09d+LZ3!0}Sv8|l) z%P$9?oC*D}ne!faL(UIp9KSNon*Ddzf!$5I#W~fhmg>LG22J60YB;09bMUNWidPSB z(fMDZn-yYo!Ugvy7Rk)arR|r7dnOct9F(kjZWJR>HbdW3y|;RD_46v`y^;oJ08wzY z*JoV+U`r&~{<*KuL~xvOhZ59{rY;d8{pjfFBb}F&PeI?`X0lgJJ0(N)@H5-rDYwo9 z>V6w8*K>P#{6ap}BN^ z+s4bH#NV^u`>uMjoGd-9`8amPZ0a)%oSPF2(yV}ro(Z;Bsw{Zk%*$`?9O;3pC<8P> zd2}h+;nA$d?@)`(+v~m{`d}GD&oVQ7seBILj!~rB{mcGA^SR;scM{iH67{T zJ*o(Pj+m*QgdwAC;(DWlcCqt!E&rZBtMb4GdPDa=1Loe?Pk0rHV>u2|&->$nfq|<# z3izqV+cuESD%}BWrkNeNI@sEZF8#%(w;)>irsaY5{Es1US9{Ba&xk)m-S;PB`tyI% z_ui-8Chy1B?i~feCDHbF7z8=s)R9Qx70!s%#yqXse}$NvnH*^Z?_{OCDYGf?k;ksK z`nmkU5GA0o?=Ls;;AgUz1brW2=Y|&^i1%{ zCfNWTOD*0Gq-aIMDse7iro?n95Op32ChGSUaOf@-|lkw0!jWLga)zRm%TB?W*v_`&`u?9?r>$3^`7zt43r9n!&APnnt#%bz2AEc>QE z2OfM1nfj%J@ef{jrt&J`3y|n&l1PK=W%^9-Ctp`x{6n}ZquFR88_IKrv+gPo>R(qG z>;GpNfUMpAz0ls-k1|R)96ajy;jMmm_R!A0{D1wQlFR2g{Lxj|-SOF<>=2oTr}i&N zee8ixgSW&-#x+b<5KuhD1~a)tN+qpZR8g!jRjwbeC)q$Krpm}1)-ZwEj|Hd1K9PF< z9Ga~rx3#k+h`yov`WQJS3lEzLyt^23sk|H=DOi=1^Z>jE)Q>1DK1&)L8e&UrrYLmS zag1&;78DlFmMk(3;RJE6&TAeM+bc9Q88N8J@yVI7DO+z@+o|>ofRh1%Q|ou-4`Mc| zB_BR~_1tibG}r_0>cOGxev9F<&EtZ?f-H=T8uIe;{LveaW_t@{jqN_f#mC#vq2yTi zw#dAj$PaA;K_X%DXgHkvV)v~~)UoU%WJ$K;34+K7*?mPVSl~7#EsIkq>_A66g)OOxL!W`~w=ckLB{W!ih zJFE*|-J-H9b{}VjbXIiXRY7|LHY6tyX0vAFBF}xZWPZ!OTpw~uwwpIQ3dPqJU#dGh ze*`p}bR`DsQcY=!8#4uU30P3;Ad8v*Im_bLOz?iZAyuQ1amUYNB>?$??*fM zr=*5XO?5cem>ge-84i4R7U%Wk94J)cU=vvoUm$X5JF#vrUikiNOQ|1cUvXJ7;jG1?=dh(&}OdoEQ^hdZtU5A6m;%?Q}qZ>vEr2KibkQ z09RyZTWr2zHP?^PuHIj-Ncgz?7VU8J?S#y7$GhtwM-A%XuHXMm@OIR3ue>cLBH7_D zE8gz;v5Pk6c@}>jD)(<~TIdv<58ZVp!{5#WVR7Fh}hWJA(CN zlC*%e|^*z5X4(*!|zx~nO0~RG{{j^yLv)LI7>bvvETAH@j8@|g@G;mXm%0*%Mp%9mwn;AV<@vB87r$? zDn2T*5j=8LL*kbvJoqwlE1o{do;?V7BA>D8x^=nBnQFT5@Rz(#giEdLUrK_vg@85Z z&2I~adCDDwD1-Fk1aZ~>d|hpni$3_FYI~Z}a>!xb+t`+1BU$&Y4>R2Kg{yim_e;(E z9X^q)G7t^Qxo=+Z5L&SlR`+YP<>k~9->rNA|M}xb%BwvqJ{|Fh56MfEA{xfd$~ItG zJHwe1NS`8Sj!~pdNl|5HeB9ZWl&>J3INt6G+@CE^qG7<3kjjki#k3!Am5}KUsSH?8 zj*DaN*{Ian91F}|H6@_7SP#6|?-Ddw?Uc1PTZ?fRr_A-<+N*%&Sz?#v!^ z1B?rvcxiF7u*m_LCr>`nxlc84*MtQQRGP&mcy6b2i!(IGZ^X~pd%YuK5Y3~@jUIzLV{txCm2!Tk6xQ% z2m>wC`U^dSmEji;c9UTAQ|j*0iWt6JE=VKSo%Xl|Dnfk+d;_v|;zZ0&%|gH3=WFMS zTx--Sa0Js1e@b)03fCQB=DPNUxjE$dxl~^FDNA&+wmN81p*6I#UzccFQ!5t%Wu2Yc z3l%T9@w{rfmPWP6SgvNRPrntaQ+e+VJJ7mLgJP#hah_`(P+zx=8`lX(p}YI}*^HHfPn@&GLo zrd_k!P6<2Cb~d+7M&6(FJEy%m?3Q?ki>s}D0f^+ubA;*0Dp5f0a02()(9m#A_d|Sq zDwV#w?7e$ZmicIS^wZntrto#02?7h+@j?*>rISaztQ3!a-FCW@n#viNFB*6Bqu#jg_0%r>U6O|a%Iyb}anpe=w| z>t|E*k4z1{(NSMfdxuSUptE$UjR{Rmu;I_${yI3Ao$;x9C6|#!KtNr5ceUsVUa&El z4-it|a>NC4wVkdD3|3vDWBZ1^iN?l8(_RbiX+UF^tde|z-3E4#&h0rFL+Jn_r&p6_^I3 zFZ>J$6LOx)r|u4|d>awx02CmHX5nDxeBYSg8T`)9f~>tPUJuq+*e5BDkG#sMV`Sk^6Hd}&#)U&1)^+am2j1PQaxj${IH+~1@)&H>i(2@|7_li#zVxk>!|OezX^(JwV$I@)&5 z?YU+uVNQV@oM+X9d$ryK_nlQ#J=}yAA0oLq6nNs^LTO_`$qkUuQ zC&bnC>z-fDH2fz>TTCXn$mj|?aj#nA%T<8eq(0>W95xv_*{)HBdyQ>v)tNDNE6eu0 zobvYy3P9~GI#Vz(NI_cBN>4A^u(L~H>RZ4iDn4N2IQmTH;H&fG^jhcR-JHv^bz^({ zW&{O6@mq}X6wSR|$84Vt_~q*tl8Ntb7)%9;x~gVybF->81zchdkBL;<|4ac4QTFX% z8ts04uMG@vy;>5%gL1YkN0=9zb*V|bLp+?FQzjhnBnh>kztN6-PD4EdkXBkDe=+yLDfhW_DQq)({kfziM7u zhh{_QVNPL|msN*^J&TjY#l)0WCcL~FR(7_wr@jP?<*Zi#IvD_HN`DNCactoWGd3k*egWTe#;jqA?mi{cEA-}q05j7psKu(4Tctgq)? zZHXmfz^(ACp1aJB`?j>a2*@{=BsQxV>-fSw~>Phl(V!7S3m!pH4ZMm09tH{XIslpo4W>SPA#KBR; zBdlYyvpEKPZosdqHutj6u_cQ0nr(UyYgImv{}HC#N~6ozU{vNcIqX9iPLHp|h_IpN z8yEMb60h~YI&uVU+5TC%PFPUTYr0w;2 zj_KJ~iyLCQ(roH^9Un*}j>pbrx#oS3E-h534-fbFJ6o2|%Yy2QG+OaosQG?LF{t9; zQdh@4Z?g#lJqqO$#Vn_HJUX81;tF2`*sag^NdQ`%t&>w!g}=WDLM@^^Kfjw={)N$0 z3vpk8hTl?I*|w08rC9!Le~A?mLiw~knx~xFE^lpP@sTbb738=u#5O&Pa~LP^5qi>B zPP74Got^AbFsA80vhPWKH_19{EIuxd*LC$2QV%14^Ck#$DzjorO+RVzH4SGVHH-8p zuI_$9&G27eH%m^wiT-4BEEuyR58}Z{K`GnDdo2lk3T$e7$V=0;f2AUzL)`@u;U~{m zN+PxRiqHZab7k|1i<#*|#bykmE321j?_WbkC$@By&{jAQezKI8m1QcWo}|8?AL_a` z%Q-zuw-%;gY}OKUE-+Y>6#{xbK%1`0@$Dy6sMb{Y>Eb+DW=i}Atm!lLJ$2K{%A95K zpp#jWu+)%egPj|85w3oYOF|loB49aPtH$cO);91o>~oopmO1Og`I)3zDtlOBf!4wu1jnB{LBIf6pGYQ6<@1F6;0@ugI z&kg2`Yu|L6hc_6pip5JtutIs4zASCK%{`IW>}rm-a~M0P+eEyjlhztPV7^dw4BlGB z+_Q^$7$4+YeuOO7;!vc|c@#lzX5Gj+er1A1lvz#;yL&_TH>h0p^uDmLd9U|y%tpB~(GNla+>48^APJe(o7 zG~H>9=cbCm7D%{>Zq{F(>n(4(iw8na8xYX(MWQ2Sse{~>ZS->yM~`I?O8r~E!wl3O zRR0-U%$z z!_fK&aK;QI$fwo>@Tk>z5gTQoj1el#Kj9O@`36NdMH;~QK42qNzu79ewmz&hr=>ns z#R^4aCMA9D+;{KM8R{N8dE%tbAd%iGDDeboN=-Es21?_1DpzYls|nK0N<;ki-as=j zQBpcJp+-jjmiu@&w>t(7SFsnGe3xw9{WjT8Q0CI*Ye`k5tDT|ZyU(YEU3v9DkZ$Yf z$hol})WL~BiEXXwjDUuhK!87E{lsVfuoix)`-wNK~3X@meJdpQa?(CT{8xgZuWaNr!pbZQAii_I@U3-{bQLhGRE)=ucTU)t<~C^m62ViPcat@bL1O6FtA&-47A=t0&&75n(d3 zEXb33`BKq$p2k(%OX4q*Nr>6+aifCzAcx7}06uZbu0m=%O$F2?stdNi5Eg@Ycj+RJxXGpZD^&2#mQZUodtv-Sf6=4dWs3x{36+|^@JHNWxV@eU)%UJW zY?&aAgef48zRfiol=dM%t0?{Q{du~;o>{I*f(8sRzWuJvWV&{yB1_2!q@sDEyNYVm&m2AU)_>6Jv6o2eZbzSlmK$$FfHhtup za7TimAiXCt%#ME$)Kywhb8o5v_o-vSiybSx;AwH)kU!R8*BL#iqswRTb%@Z93@hX= zTHU3{Gsjo?MA~?9XlF4ed^GA!?SDSEu2G8I+|(eiOb~HF4DR%RmR=}xfpFngPpiA;eM zr}Fo2T%w`Ld;fmq;uC!|HDBe=i3!Bupa?`+N2gM`E2If{uDS{2WM#XDP(h%`L^h~| zRJbkeGJhuubObv)6<`zU;%p2&Gb!`>6)yfl#a34L-|kvF@^ZE!+VFWl7vm@*BI1#P zD-$%^R3f0+KgTC`1zJG3-rHGN%T_EZ;R#tF0jWA<+X`S zs_QHQ>go{SQ79Wdexv6)ui5gEPaE`IRIfR?hRyffvz@6ZF}sA>9pr^(*{)}HWeWS5 zPZy5&1CwYlC;_~^`~g2{_^!JL-}I}~=$)$5kuwn`RceW+da{uAr!C3JtOxjEl$7C}wmHy0%@ zlzj17T{R5V>K`>Qfc56TdJ;mX-N6*W_8G5VAl2sUKi5|g`pe*6T3YHk!s=O7a(c75 zwY5WC-@|%prYAi$!D|%KBnJA^s1b%{o(#F+8H6rg0xqf89Dr0hbK3Bwvt8$Jyyb6J zDYYsyNW6N1?o*aZhUq$$ewHUj8k?uDzBYs9D6PFMM?Kw_6{@wKNs^l7E9S+9{`cZm zs&;Bk7e_qdjQWZFXkt}?>$4w*zve(`J0L9bZz^r%klsv*FN_YGv(0(?ekm_#LZp}> zKgVen62>e)ty-YStX~~S{wDaksIqJnySno7Jz2b0Ms;3^rB)UU3i1I4O&edt6WnbJ zMMMw;oNrLm?z{Jqjygrvn=*L!oiII*7cu=Me14beZt!`EIc#JifXuNLb3)FXDLk(o z7$lpyxJOmf)}~-%Gx-|7J|}z!FaOJser-6Mwz)iV-4vwY%=RdHep^z413QOqVheF8 z1w_d#3_RMx>vY8i(2$7eXfvz{C-;ESyrkED7LQ4*M!%Jnm8*MWO{7FQadCaUharrP zcXe){T0a0{Qd1!D==C|Ap6A}VJ(EGvn7whGxuH^hfSgk^TrhwREGCy;2PD*_*hKy6JoH{q%) zi|ux8B1pl+7R5w8j4CE(?cv%=yqJg9rQ32nDNM3CxwQA46^&QQ6M?X+5AhfmW6LIR zdfBbC!r`UiXDAj0{NAKf?U0Bnbq$S$!`TBcFSOCLZMQ44m4!y6&91CxmS|OAdMqh!GlxO-KlJg73j^-#hS)ib z$2+mj#iF1DhP^lU%DO8)IYqlI{6MHVbp7;azP1fuS+faHuI_wZyNYsubaWK-C~?;S z&GAZH*UOZ!2$yipn&~c+)%tLgVxYwQ_P@S9DlyR4x2bn0v?$Esouq-m=!q7a;X|MZR~iBM^9DK^rnFnzo8g<4p!cR{>Rv9l~qyVfF0$}^?6TwH|g zCf;4V7=|)i;eWB`bt?y&&SI# zOS@b6Y^S{WD`;@Yt^Qn1Chghsp%nqKn%Y1HHR{VURKmNtUL@3KRfr{ z_B@yWadMh|a!Oh_BLF1Q=c`S0vNqxy>)Wlp*gFjs#8c@?SGy+lo0UM@(DF5Cwz0>@ z0RXVKbF#dzNA-UEVS%!0@B}7kX{?qk{m1B|aT^;Or6_sYwQu24t78KCW)0TWgb)67 zfTWsX5C`VaNqpCIij6KwwWny0D?hjJ_;He%{yfgg&if6)#mCoj+m4wz<68fhhfMyT z<0|M(O{M6CEL?_CzN64?vzf{ZE%o)?KfZgJ5sLCM@t-ejFE?4U7Ave|*3+Th+#8=$ zvP3z$AqTF?$2aB^D6&*My_G@2@=3@I*j8J7suixcAeGnP>wOa3*0Q&JiO;OF{$(3j zG`4XK!U^2R1gk-(tCaYxOi0*5RD~2&wgNbRdDTlHAer8X!GSgHECZN^VV$F^^YUJd zz=8^g#$EkO^kq^BdbMrpK;??>t;VL)YCZDSP*x6v>YKr3PAQ(@8s*93*do7HW2+EH zV#Va%J`5Hh%GJ~za7F$_%G{@aGe$;WRJ1gCefZs!L7f4*eqD?~tlXqs_+tLu>?($P zrz2{LI}zhwoxt-C%thbt;_lOmpezmmL@#ou6aGb3DMHM(!IV z1An2Qz-D|nDmE(P)iEi;)}%fTz^L{UPjj&!f9w>qMwKbhh`PQ>a9=h6$z0lP`zliI zi}>X%W`A4wMMxN<0IqXGg7^~kg>FsxSGe@`i%*A|NAk@tOz$f10>}c$M7&=W=r0SH zlgplE?BBio5Rru&oT1f;dGmCJIc5VT@!KnH2`6rgh($!v#&; zUoW`=5`o{kx3+Z$7w7?=SM?FOGk-k;DAg!x`PG%YYS1uXh)J*FuiIhMuNMl|&`dkI z7&SR-i5+KG*MKoS*Ezo6>t1Fx_U3+Nz}Z5FPQt)XmK;iW?Xx)e;ysJIm41@YGl-p5u;_7us>|BooLFZ-__! z3OMtIeTuDyp442Uryr{lxOp?HS@6=uU>w7Yq(*Rgy0wDG%Gy&8u@#SCT49-%7(Nb% z#FE9*?;wS(AKjMoHmEPP-*qlT!^x#5m+vG&bt5O2dYI3G+o|SckK1Zm8U;SFhh0r! z8^Ha#U6!S5>U*vZ=RB^Qu0f5reWkIkO5I@=Ny%!fN^u(A)6j2@)}PP;c{PAwX-nXj zitQ4`0pgu=G{LwfCJ(p~5_tNcNJ4Uh0t|QSyUW0f=|!53l!8k+yxNj;<}i#(L3l5?c*i-l@)RP<0=)0eW%l`xR2gQ@BN^ z+>a8|(jF2JjQx==D@&Ug8=FljzSZ5X4$u^i7y*G*Uw_~0{lboOs>a5~0e18KMN%L& z0S><P`^_MB{aX<7+keolGNVvDI2WmV(Ho#=40 zFp&I?%`Z#b`2Ne@*|}7yu~l4QM0!YDOH0?g>-yKWfj+?kdn}=EnrX98V7@{3;sy1_ z31V-NQ#CjDJGZj!4?Ra@;Nc0LkAkVOxQ`tSt4mT{YmbM?SDk|$W9$Sf0dHz_hz1kKv4+DdnOz+sWmquDwmA}feeFflHsMz+%336E9 zvPrV#K#!j}XvL#$G26kNs4wz9OKr|BQ3|1&mGZ^MnolP*RH401oU6FF#TfMYjscC6 zt1P2xgWaS<#l_^hfX6>rDN=*MxDIO=bCkS~fQme5Xqs<3PNpMvh@v-i-1(%I9(_~s zkp3rfvJshxxNG198nCRhU-6|SfH{Obo$8-umg>q+soam+c;BgD94@}d?KJsT__9`= z^V@ZRQ_R$zs0NNub9474l|(GSO8xe$1n@Z|1zDvh;2>~gf@H^b=)IovnRt3u4ZH7n z`BeeceuDhOH1NFv3M*H$P$^4`9!i>VTkk2nGI{<;lbb&6xGU?7)zad#f7+hcFS5!E+u%6;6D!UEDl{tB`^bCQ{fJ?g(5|^z4~; zTG5w>ZK50K+IKDwhO7yBVjljmaRe%|z$!NvJ&&Gn1^vRhlO7sk{D&SAZnGbiK!HSL@&a<2 z-gKgw>ji%-1%n0fs($wc08|lsJjPHJ#H-`mfe~KjTgzBKH&W1H(VKK}CO=&z;~nw# zUpH;b$(8LBX);{Hzgre z7654Z6kd2OG)7+`-QE=W!ppjI-oszj$j1dxkF)?Bu|3$^aI#1+Bq%5dP>b^C<2T=@ za|v)Mv{fypRBg?>=?)YJy!Lrb%8SZIajCm*pRU=%W<$H`M{9B>&Mj`JmvY9ROBP?L z+J9nJ7ivxd$u8c=0UW<+pHT6Rd5jx};nUk;fZEO?C@7c(?0Ub~qW8`G>0n|NvR&wA zV2(Dfv(#-tZ*IWr^WyGAON{O=)%eBU1F5SLTi#evX)G{=r-d;qG+6M{ybfl}dbsCG zXcv?5%F{KO7QRf26gze@%X(oLL8Yk<3d=$7^&U{|d)7RR5y08!Dq5W14&iW8KHD2S zZ*I$ZP3i)~cREr`psC?!+IQI~0!jdnSafCmQUBqZgsxn!nMK#u5wg$ez|HKa30vq& zYf#YKwp{^y|0ZkD$HlXQPmY@9&fNz~OQ*G}Y=h;~Xe3M#&=mlqkZZNfEKFv%#;2T3 z7RP(;goV&6;DD~XeECME1UaR7?K`ewCw%!{M1xVMio(;9*-#i3kp+67Tz?chyoHxS zT)LR{_U&C+{ICbP{fPHH=i+IU9OrzHZGc6Aqg1Zj%7mrs?vh!g<3odFTU&WHPR@sB zOmEiC0@orr*&%0Jw$NihzGe`vs$r_;Y4A!uEwTI6G5?(TfOlury{qvjkPqSR?y!b7 zoK&517b7G?-Z;E$qw24X5PIY|TaSi^JXH$s(y9a=ZP3zwalXxCj zBn_t%r4y~J;3vQ|q?rh7o&WBCwhG&>j*RiAa~`phi(QXNZ?oW^>AJ2@VlBY>5Yg29 zIeAC+c1(vWts}zSbG|ufkB%42^s^ND!LFtq_INYp|5E?89(@+?zjgrde z0%Xg>*xJ$xiA#RKxYHSaPD$VSL1Kpqk{!vZT%GKRn4caWL6B5v9Z;cG3pkY}OD)qr zd~7kX(x;lrd}Un}T_s`eQl^esJxZHtxU-Hn@0M9O&y>#O*_A|MYzlmU=V zVy?K3Ra-Y1abNE-rXZ!M#B9HHhMb~Q2Mp3!G2k2Pph1{QeeVZ18|AX?r?xq=M@(NUWmRIvK#zkx2a@2M{S=S!zXZ(ESSbAD#7`O zV3Qcf&3llVg);3bF%-1=VOnQrr^Dj2;^cME0}J7aLEB!|&KXjgk(U?z^fMgpV;gAR z^(kV$+S}b=>oi5SpiGzg+D?FA2C$D1Dvgs_ftmA~ zx|f(kc#fZss8d@w2643_7*Y$uDwW$P3ISQLtBt~wtuzEA&y;`ky8(CvFcx}1V`bQs z_{+Omdc(Z9rzps9B zem>QP;bfM9(I!(%L{ws4@PO06r@Q2_tDld1Y_<}A&djJJFC`=-xQ=g4cIV2)D%W)b z&nB^wm_Xf~r#|oA+S*Dj?)dK0Q`h=-FAp52>wa_wpe&2P?b-RD**&{RkDU#g^QO4q zQ@Cs{5w5TX)ntcWAHY3<4)^DoV>{c2%Uomw#wszGwRM`jh-+_DsR1Gk$ec4@b{5!{ zT<5eKPLzKV$2^6o~UByS~;)tPK{03fqUmf>8RcGr7v?fqs|x7U175q9SRfRAwP*?D4a4{s_0^L&ha7~xhI%IVM? z&T?t3m8b`O=I!M>xhDk*@`q#gtNhMmWGTF~ElP=a27dnG#l935o*8d&W@tn(30MB- z>Xm!2X6L1}u3-#6#&!g-5OGyA!ON?Nn-Cc}NN41l`9bB#>2v4X>%Vx|Z_pmQa$Rky zCgD4Bs955}319x4W*ec$s4hzV7LYt5&(bqW15PWlwtI286XO($O*tW+CAC4*6wkwb z>(PoyTW1ZWyeg(%I(r6St1xV#?}VqA%El0nJQSf?Ky7D^7u()$;<5+dZEb8=mISM+ z#9RplEZbJYI)I_5_6)WDBFI5DqG&y2F7>Q`vw+2*Dxvq2T+CF4bya7Pf@tzcQj&6= z3m_qxPqxOaP1lkB`UPD~b-B7iOSE7OVdf{GADTJAQt}YaXh$Wroa&08T zN>_M#JSw5%t1o^EJrkqfxvQjvJm6;G0XLDY<*Du#b)W{cH-Fj4-(j7GecajyMq7SR-8Iq9} zyA6R|zrv(0AV99Zx)9;X4kh21|G+5uxEs32l(q!)FzNan&{c<>kADJB%l$C4Ha)U+ zKKB&BBenYrE_3V}ROx^e{CKV2nbT~d$AMxSCO$Y&>tzGVaEl;&z38ICD zVb0Ubm5sQOuU6^d_$q48Lj~2q1~@NCujc;fHE44~^1J#`Fx}2L5aP>7KUIEW>__nP zXJhB>e(7B%0)jCa8F@9}OEoq(Dubh6ULQLKB^_6UXd32p7=nA?JQu$ClTcQOGEg7I z799&$&0(0E-H`to#VK9x~MuX zyL5je~H^%u(tq< zdVSu9*FFYt3`EJJ5&{BBN?V9D2up`3jf8ZA1uB9{N`v$QyOJxdA|fEo(%p@)z*4*X zXHn1bc)q{)eXa{HFZk3`^UU0H&&((0we_{L7tbm~XS?*zvI|SeJY}!>QloZFlL420 z)b8*`o>+2H(nLo#zp=4tZ9{{`@KQzc6OrlGQu`@ zdcYzD9&%kR*?t8TXWmFKibclLdM*KYA0t7rT9H+Z?&_QxF~mb~B?ihwKJaX$9@3m* zx9Vo(l0h9koDkpGXg7CBOE6PA`E;&UpFWNpvjovDZ_=Ic5O)S>Vq>*_K~ zCSF?~mP=%V@y!c*6{BlwgFtGUL(!Z}2k2cey`sBYhoMWl(+E8Tg%w4lwsLPK zIiH(gUI28By!P&nWPity=Qk>60tyAe86cRtjmq!<5q@cCPyJ*`HtxVxH|2Fls4h}m z2{;k0ud~ls0TE#(w-UVQT(cmEo;Dmu*isk0OS}BfAObOaC)gu9QE}qW!-8Iokl~b7 z=RY!Z;=VD%>AppC{7Bk`ihUF41T4qJM$DtbQtIO7K&Bk9%_REonn{90oQvY~e=Qo+ zhKZt2h-#JJO9WM1E{Kd>Y_;iZA0PM!Bx-Zd%=5`pfw2qaGLhTI*pYz@(k5t}WPXo$Olwn-=D+upRQ za+UvfW8Hxzyzu<9^iK;J?KWA_9}%LqPEKv&iPAbFfTns2R7zu~l=_Z0s2%@*6;bI^;_yXZFXUT5Zb>u$umlEZ+U z|I&&Nd=Gn(-41(!KMeGLWljfTZm)B@a=?jJ>C2?D3u#7HU%{1k8IF$lwGHt#viZc@9}W$rs4| zBaRwzi|s$a$KCt-m&4ktBc4)beqWio6tJBm1yQM=DW)uH153M@7&5{X=tPRn{dl_% z!|#?PYIN?5P&lflPBIZ9yti5Aa4q^sy`rK;%bTZ(wLibR<5h4XqzL(^y$`K}DT>#Q zXJ!{Z)ARxN&tJ&@Lm&GMxt-ft`hZ0ywLV(SNk8l%gb@DPboc)@HNAT_y?uh1Sxi}l z$!<2ZSknd}E&i|mCgWdjQ=a_KU2c1|^x2F*ZToi7^scUj+GQ?-TiMS2gDRn}bXD^a zGAz`8oC2tejz1oh3jKLl>O)_94XXI;Dk@_Rl~K&`pyQH8lavaL6IYtgvBOfz zmnRcWG>c9ece!ref?QBXf?gW^;UU=`IvtrB+i!od>1>31p2q^sy4PBJ896fZXY-+y z{&y^Mm!7;!$+)AnaUd00;r^ncp_7sMJSHf~N=MLQBP>7yRH46{Par6U|FXwyNBpVe zzLnHt$ngO_1%EOgP7iJn)2OB4ddcjG-L#ZievUM1x0XQvOktKJsoTKlF<=k(d zQ7^pl+~h@~xv$|_K0Y}}g;&PCC+2I(S{&5B9Cz!gVvRI`YZq%tzY<4`> z{bqW4HG}pU1cK}G?_Ie|?g}GWNasaJ5Cc`b6vGOvwRuuo5|Rx(Q5Q7yc>F7erkj8C zhaST6WkbRZ2F%-ATl3B619Zv_g8}NKPEKCNJ)|OiXdjIaPDi5zJ?B~G6we1hYNgs) zC-*MO)WiylU5I#re^2zKV*mXw@Fn#bUzZKRsG)cDjdLn^b^wpmLna^fi@WYZhL6dO zJ^>gb0(U;2^IXH-mbs~|ZNLOV6EWca@5LG43z_CP`TvqfuE>sRjI5G_Yy!^;N=n9f z4w^v*^~aBV*T}!yZkI$Ogz;8N+wWK*&&4l|;WVq5Vz)n*0~7Ezms2MN3{MkzkVidxjmJP`n6d#tB;>)pe$ZwFzq0lJn;VJEg^M^)9 zY0k2-X;Atl;@pqXgr7ZgCKuTTF{q5pMF@p_V#;zl*YFl&tKSb81fR!fpJ zB%Pi%FDJGgTHCieIg1^i*g#5hhE`NWQ}DaL6W?R z+YMAx#2P0e=Di2DLZYJP%?+G;k+cGf9xc&BLpSSQUyz$_w^38Hj)m0XXO-F6t3_Nt zDFbuaWo=_a$Sq*=!Ie_{3O$#>LX1;*&OP-IS%vW5wEp>Fc54q2$!2=H^6xr(x!6fVPsqckgM6qNjo+W}{M7$3r*MmqJp7(Bo+Na0>)WeB!?k5Fg6JN6QR+ZW;#$ zP71&G`{fWYlUGp4A|vR6R$a{#(O9(wP24{)*eQXM?6HPR(pM5D9-W1x8&lj6m z$Ig`un@Bkcv~xgpwC;Qh9Ia9}lpz8NzEF;@p-dQjGgETY||_F6?jO&drf%H-rae%h229l z?quO6P9T`0veNmMO-;uqN(mCJMUJ3gwP8Nw2WVlPN=X9aXF@|>?<%o_*az>vRPEe# zHu2?l=~j$^h5yPPM0}Q}=fAV61X5;i>^VECF(!E7XLb&-33$Ypm+%U{Y_mKdN^<+6 zd+VuX2tDG}oMPtQkU^@&^s5?7d#cUqx1-c8d|fS0A~D+U%*-E7OB%dwY?T-tF?{xH zYRnv?w~@iKvW~CG+#w(h{b{@m~){3fFFa17HkInbiN0 z=?K`P<;qCcfNGU;f7eFTXN|1&Y~plHovM6;nL;GL$`)~+ zo`}ynDY71-=Pk zl0;*Y%u(tSCmK6uEpB>vM1z*W&b4k43pM2^^lVAODGMLp+^&njt7NR~g=92qYyZwp zM9*-$;;0w~&td05&QA2B`FuX%o6v1je7PIDl`<>pH1#^qt7y=7f9yh8I(yOjRIPw< z&2=S%dot$5?W0hT4rJK1D#j>QnP+o{li8T!-rO4oUt=?GLrLa2ykDWNUA2@OK8qkW zD5O(xx5cJ>_NJX(kZHYhKSrf<&eMJA`CP(ah0;5Q8{yCsrCX^cF63D|z6eo}BwQKK~*~NS5BZGsQb?)zQ|9BU2?FPBCO=efI zPR4XHrP)|8Ezd^1fo~2r@7kmCnV;0*o2gryf>ew z&kwRwO}z21U(VY{#R#5`o2qGT4|tAS!jyv*Iz{Vgdr7l3A~o&}+twmfr6-Cn8#oLK z7va&8li25aLCjDll`PF|w(Nb+9j`sr8<(;)AD1F2xe~v*xpIwD{znBg{B2B9V+Ols%FfW>CEmw^GxZ9K;2dqp2xDO zz1Cqpoz3#g%V8YW<{6}4T<%Du67)P1`QiK_;h1{X@zsqDOMFUJ>@9Y4CEM0LG|{sH z1UU24^76cg62;fzw%hw|Y;M_2^5 zgm=RZjI;7{{mBLRH^c(U#RN^#mw4+gJ)JAR7$A)@7wIXjI*SzO+HBfB2k0zKW9T5` z>5xFfsDs>WcwAD*NFT+DpI=l(v@XT&g6AjsnvcaVjfVR>jxz|=TI8cjGIjgCuslB1 zkfL;H!e4%xFE>YFwyR5<_;yMfGyP82TDACXS_j^3;wjri7PgNsU@OP^p_dl+gMHv& zh2K=Gs$z5X8DDm0{-h6h!73^sSss`XR<;fQi%VIw7I7iWunJWT z!W+5ur|CDub*vn%)2(6yqI<+tiw(-vz$C%ALdrwp3k6FRA24gm_W}qpea73{TbMr3 z({W_xpt8lB{U3<;3BTo~Vqg^%Q!KWWQ`3y$3GZf!!fnt9{$q--_9;oCTY9L*&6lU* zkTzH*hq6iw;fd(0O`5k9Z}|uxs(LvnVA>&b^%xCZVo!;O3XP z@>Kn>-NeZwL&P3f`B7a76kqpWyj6d{YYHqEF*;%4wG@FS@kF|;WNC+r%Sr)Ht&Pem zZ>y*g&^5I@J($3rwP15H71o5?EwuE#PUKW0}5;Q4ej*bYik0vF6nB2Q^YD*^Wr!y*GIbn?@^m(1{D z73X1VcL&`Re?~Z{9Fzo@tU4?l>E)@=#*v~altrD3aagRowRQ%&Ti3}?_(TSpG;mpK zA6N!_SgIppMxp}^wWCh%`q(O>@cCOAr*;I0=_r`j!UptqO08&`(WXo(dpiDcY~1@& zH|7;2KFnhx&Hiw^Y|A(w%A<70$6aGIA`&MWQzRdQT9@}?sgCYgPqM!oOY&;b&sKwoO^wTwaO(hu_nM8X% zZjFZ@L{(IJ6=tKOOIR@x!Iq5k!I5_@Hik%GTzeOEt@ku1#E46rYU3|+cXmz8KX&|> zpw{$#S?76chs?Aun;&HMFWd|Gx*HKs{N0{8O2;@4WArL<__p6F*_sWM0L8YSTQ7}4 zM~MCWSPFEtx;e(V=k8PnI(=EYy>ExCA4&&{79lPL z=NnZEkEw>Dgkg`>~>>g{Z>0B7sWWe6tg}v7w600a^(}e9!1l>HRw=Cpmj4747 zvd>&yb}HVvYo|QXxVY9~(zu;Nf?J)Py)-mBC}}}MKjmfPpDe5^ymh^A?**ecGLF$6 zpK|O~h{B@YylHN2$G&iWsjSl*x6;Zu9;WTRvbyVmf16DQGq!tnSqw~_fT#i#i~82L zU_g@&VMt)qfl934xv;PyaV@>D;S>Vl_w2VL^>xQv;;s<8sMnxPbv>*z3C4TJsp%PL zWB^W-^6E|%(~8Yqvd-L9(T9zs^F5W?{j$5GMRlIv=*vso?N@acuaH5NIpcMuUg`&J z7WW_!(k1!RZBbnpn#4=SGS}z!VI&|^s?V+m&Xhvo0VgN-!`=ecfQ!CPmU;lKqv6Bp zKuK$#w#>E87SasX9r)vr8i-q#)TK6I)3}7zR-@3cxwfTA zJ_rg*)+6I5=%(BTiG&s z_Cn|8%X7Y9R-w}M^z{>zB-gHJ=-x|D-^y*EsjHfqHHZ87Be zBA@=^?$nk&{mpbDr|S{Ca&G z$(datzK4YM_wT<~Q@=ub8*W(PdsdLO=!4@h`a~jO%pW|6hy2=$bw>ZB> zi{HBC-7x(={!&XvSDbfKih@p_yK~{kGavbF-)D2Zqk}@?Ibgz^J+Z6OS`Y9Q71 z6LK3w6daeA0osTdBW|d+6!~*YG#vff&sXH9DC+pGOlzUkbTjb*efJUo7$qI*F4vtnOK-&&CFjh%NjctIDcpJNOz(;v=Ul zVmwzS4^SRx4l?csYJVzrH8Vfov1mG0#%&@&(rn`8Q8iGN2_ylHI37*2Nax|@qei)% z+9g~1FCQa`Fjc>&6#jszW^F^727mnVN2?Z%{+m5` ziI-qsL#4rx$Tovldc|u+{4n$Jy@iLaQikg|DqgJ=a2nNULv;-*OO?tYSHyS77CW`q z%-M1BzgJ4wA-HFwd&D&NY-@kY>$jI2sVJ3=-o{6H1{!H6PCp|v?l?8x6 zYN@@c?{$5vWoty1HEhMQ?(RJobI;q!y8NJ6n?spSihymd9kvRq6Ij6uteX z428u*$wQfHGuce7ojv3Z&<;Brn-Zm8MV`sm*RP(v@L$feDJQZjL@Yjn#l_4H){TaN zeU#fZM~!|jPc_KOXVvZW<@}+B$iruR(`_uCrS@`q_4i|CA;C_9b)n-MX4q2MT$CVK z+~-U6`q7(xM=3`EM zEw1CCv)nBq)k?59+*bMx8YUQvZucZp%s^7JjokI$Ojq$Y6}OFZ=hi+|dyqHvw+P0j z3$(nO{Cjrqp8ATHJ`xMcj?bCc?(=HX4jJ!0ComLG=dq^B&u7&(CHiA0t64+^97nn9 zw1bniEOYYA+_S@o>Zpc-;}&!4Vx>g;0+X!j=GJ+y7K3o>b~?+PrOvS{#2}4?k{S_Y zx1L>5z(X2PB^zaQoqJuD!DN6!^H|GDY=+q73%mBxCw_RiFJdfHi)inMb2)om-y;?b zMg=mVxy3y7kd0k0mykim#(c4=U{qbpxPu6=J|?MS9p;2hr^+OI45!Fe#d^8l*4Yf) z=JBmJLq|Lby%x!-HbQ$wmgZv8*hpepVZ@!H4Ifb>>9VTY zjXY-d?`{DP^Y;r^9o7Vd*oBv!!3_iZ$xO)C@Qc+6jHg@V(ii=Mu*t8N*wM3dC8 zxpS|2jlaAc^)^`aaBYh!JBP|CUb2S>b8{#M+P##mmPcgC5YCE zO{o40=uG+akbeXIfZ2X3Dkvw|li6r>D96fZ0X(7Jjh zez>+#yjWAqKbveSF!7Ew)y&diDaOvO0+4z>Jo zB24slV%X1#wPvi8OA;Pw_>igSMZ5Pg(XU6$N}P7C)~O*d~jPT)=OB7 ztU)fy^eNC(CO3qb`LEIF+oJVd*IXUv`*Ns|CoaA%Hz~V-guI=+xUup= zR9_YK59{b+^K*9sEccDz%;One#5-X-?|K{n@deGD2)s2^TG~tIfWmL`7$MGGX0fFo zWR|(F9xOOMks2*)jBG{awWZVg$x(*8_xBv1aUXC_I>mlU>_+bcqQH4p`K!ZcT6s9G zy}C?MK6uhcORrSV;G7n_%v7JaY!$ux^B0^`Ju6$nw>u_N@%FntP&p;?QEf!1sx!xs zSeAYd{DxUb&^6$64-M5oDaG}H`M%&N<3~|(9(ZJ_F#s=_-FR|)*o`B_)FF3kO~=4S z1Mt-Y2mO&qJ*daW_{@KDk~*;UPrz&RigQ9@f>ZTNheAR+<{*lD32)+Ty*Hk2tx{-8k;= zOb$G`WP0TAVKhLr8%576ppb&fl`GLlj%d^TdHlqQ_)nkoW#wmZL-|myiL6!!H5Vh> zC0@riiMR3v5efXQY zpVsjWknqhK-JeLf&l#DRmaMu;*(Ej*jb)$_RQMU;C{fA_@v2v4@NbR@z%93MY899BEEs>~MZYvH{ z(7EG|xy9rEe!=%&FmMZs=?AH)V|4@qEtr1f?DnY#y@*<^JHIUc=1F5% zcts8uuOAie_08d&S{_|FO|9NuJ1J=NcRKOB{l8fggSSaE@ys%7)UFagI4X#k(B9Fu zv5yD1y7ZH*D*aqTY)Qw{{E6rY%5`4)5i2lX05C5aoyaY zgHI|$j@y#A@}AITlyi}%Uj5~h8=kXWdWp^2snOOIRewL8>EG123EOPLh1m8r@^IO9 z_y^1<5Bo+l%h(n7Y8QO7$F<|u-*Ld>>Fa8yqER`b#?FPKf+8A!Hq|%NQmeNC*i}1W zl>cLV{OJDU-B*%#i3acfk3CZ7`0;IUXk1j*X3t%u2676^&>hm|{Ss3P;`zM_M>z_{ zKfEXAytkR!6x+kmNg}Lj6dfZAIh2ybm78Z6HE9>Cv&$pNM zP4y&*W2d5X8_ZT9`)Gn6DHD`(K@scx&SUiSX#)e?vNO~e(yqWJ$n}{xzYS{JX5=IDGfD?tjYSa=mx*uMNW>BDE1q!5 zSzi+U+)gffGjO(mwOH4cdfCqDq5W1I8~#L!#B692J~9 zHFYSsB;U87)6*@RR$ryOd)MmFmy&5vt^(Fr+DXjUW-F{NCIelRS-loBs_!&{$GrkI zUm>4)PVt)-7l@F!|16qgM~`#L)MR{Fz6W|neBp!QM`klPp~GY?9ue2ArkVZ`ReusT z7g_dq>e;>P*%wEq{=82tLTRfSxFNkay44KGB^M}v+e+`*z{dCZXq1(Bebmudf=s65 z569JD;>eSTJ#-b7>0CV+b|}$)@7cm0-)QT^mNs(fkvu<8pp%o9)WKJ^jY_1X0^%WX zkx(9YuCXRm(!usIjGQeb^n~a9(`+4{Z5x)DFUV`kNmPG}t6L|6YG=cAe0zKoApT>- zR&JR)TsLN!e4`l+*=3Y&m96Qa_S7c&URSl-$SXL6g z!CPcFCrh|%9!5#}sKm}+NK^=f#Nnf4I8W!h)F3~*QR@Wnh;8voiFwh{@~y(Q!J7fS zEU8hu;clNXsM~|=oZ~eJA7lXsGdS0*a>AjKlBa;5;R!&Fl@%4yQ1R-NUjL|F^`LFu z6f6Ly=KQFj$jD67STA|!zI(aplEB5W@7r>IXsK<_Gd=5MY&uS6T;Y&7E_BPNUHaQJ zO|ln}%&F06&vSXPD}NM^dx@&yfD0L$;|wkvzN)FM>3$2FR{QgR#MQB4@`)w&_lb4M z^sSJ^mqDj5FPkFp!D?2{>CJON6*w;&UZ5CF+_f&Xdc(mIDkTj1{M)1q;-4lY^F7Ee_c#~vKlSpWR1 z=lHwtydHf#n7Vyiw_?M%bP@oq0yLb{T**vXS2vTJ$^GePU6Gp~^k~Z@0}8k9Z?!}U zNMcbduwmp0#KC&?EGzWFaMe^xL)lIBwlb=TwOeyyy|zRbOkrJVIAlTwZ?v#>*^p>M z+^9aNwj!e=gS4V6L3`tvWKjPiA$=7$#B9j?LqaO+Y>;vnH`rL=!972jo99KmJ~}cc z(`DZl5@Hl1b~_DS?o|SYYE;j5lEc!aBEh>|L;D5gZais^FpYf!KHRpn{0?X}Lu2=6@rd)vy`c$AE*2LWOe z0%gA4=RI!#Y?a~)e28^Ixnz@)WL8Uyk|b)RPe$Jz)=3)3mlkwZmesdNsmGNyU%xKq zIfsV|T(t3?ZbP@1k9k0ewwtQnKyw;v*if@n-%3g)tv>-?fcS*|zM49o^Eg#4c zJ6fJNirH!eCtAtpLlxxp4U`8xCeJ0NQqpHN@Wl2FiBM{gNTf(xoUz*+Q;WDK;L0JP zp^)A5h`fE2Jx@8nTa2zF7`uz~6#5u6THk<23ylds*DmhdpJItVX-bPpPsf!WWok}Q z=<`1AZfs&Q8ROj7K2%vNfL~6Z>f*|&<|`P-v&;(Pp^KQs#RIC|dU|As*&BtZf{AXZ z>=w?(q<-a!$3u6I{|}}Ma(M@$k@i2jlB)b_nL)wVA5=l|L`)n4u@BX}i&pnln`App z?M_a6iKu+EH_g8ss@%c_^kIi88iBIWPo{o=7ju1h*H)@qap^8jDB%u-kRFqN2q9Qc zz5hu|Sr^1qga-->)@9h>$Ci%I2Sn%+4Z9b%`wD`B0^JStM23(t6eEOPdnZouG%?d(#Eh+6W!qW^OQdaVao0|@J zh4zUMRmGb~WI&nzV!&9#mYQ$&_`cB}^pVej4857e;oEmY$d*;U6xj7BN3JqOH6ct{ zPR`=-`P{pcSODc0@~ZR&Wsh#z`T;m&bi$X{$#@Fmz2+xq)i)Kvx6xY&Y4_8T#P8pz z4fC|@!jt)LWZI#)+mf=ABAP@ZOlp^VC7OERP)t!s9d|JUYpf1W+3K@&oA*9<9Qv8& z)ZmmWu<1`2H*k>xdKn9uY7vS5Q0};4CG@&Y-rF^0d@YDMsxGC!-z%|ReEuAy@STjJ z?l$qvSV6TVRU0;c5bf%|vOz0k{T#3! zktFoXm)vglV{+i8f5{Ap>2~N>X=&fFH2hro*i@wDXZFA1t)|FDTdN=s!j!v9&90(} zH}>MQA085RE6f^HfjdD+^pg4F$VOLE+sd(KmQNX&98^)|MpEkh`Fz!zZk*q|z16|J zNrr4X?gTH@&rr1r<-b^8QBdh`J=Wk+aozz2$82MzKhLvDks-KENvP-i2fjWb0V&8| zSC}H-NfWQ8d(-V3KEDOOy!Jo}p!n2O25Ou_i@uxshYy#7a-ZZr`pE@Iy8LjjSy!tm zzxAd9Dl;vJxh_UjNkh*y;`Hf{EHXb?AhV+8&80;SOO>%J9ktifA@yRU*xG^#ZV$M3 ze%@5*{yk?w`Q_x~tg^IrFC1EIinWa*_PSKyQhcJo9RZpl zCp&w#0=n3>MZHj$TdCO8flANzL#IA|Zj~4SM5a`r;K%|KXM$11%8pp^IQjmun-#r_ zTdYrj^O3)`uvx3Uw9FghHC0W^JK{p->?9>!6JMElNP$-R4;MwjmodK`pT9D0AU~^; z$i4K4ZI=4*$pn18uqtFWXO%&L{B`cnT6yFEdAnNpB?Vcv6R+zJIA(!QE1|FSC?Kt! znO&gLs{PyIdT)BWVkp1x*25X@Vp+>))YM02r-Qx^SmS-BITQ^zgu`M#$h-)|Pn)rxs`3NwKDMrI_Eyol>xfVWCnRTigg zZ`Z|r$y~#vAiYVp@&IBiZZG`yV0=PX<5 zWRdo1PQEH#X*Ggiw>t*BIWNGiS%|d66iww&?pFq`>$fSn3EUzgdH4lWTDNtnKA&lw zwQb4&!L&fwuY+RoFTTf8QP{&xA$d@Uw6w;?P3L;nB1N4^m)oglA(|)H2Ayv@+@B~; zD-62j?ENQp-xtI8e^=#oT^^8W;7&)O1mY#rJj-!G&!xU74leFRM|Qa8;>T-_`;{AB zA^;EQh@JwIc8PYYp#(U_hfIxm-q(DLQm%YmJ}B?*pee2AX#S$;Kpg{I3}^91XUK`enH_I0 zAzMX}<~FMo3x58kHm@ibb73LeIDDV9nCplh06@kkP+e2AV?t9UK{yXs3kB7sv^$} zcU>=@{KKVFU_RFs+M;guz>7NG{QwU6o=!TEn!|Bbnm<8C0Rqx^CHI ze?G+thfFw3)l^i{3H@7GbE=H|$-i(bE@f~HfWGRA^=0M3Pz51Fz-%CUpB^2gJ$3aQ zAau_4js~DP&zWs*&_GB>aQY49M~hcMryo+&(Snv1^+XA5OS7&Q zlEgRJcck5y!$U$)Nv-s}N4+n-e7?2Aa1MzSpwK@fB#NnY%pwi4k%=q%L~>ratlKttp;vy%af~V)cc4*|IW|StB9L0p*Ll5c5I5L<`Q6 zba+Y!Y8_}95MnE5WNd6%-E1T8X&UD`b!uKmyGRF^lfbmr!1j1#P0c!4X_jjlcx2xI zx~`@*wwuqnHf(8Y&)F>A*?YZ?8k3+@2`(esTix`gZ|#tsUG{+Ve*dO{e7SADTCPsH zDM5~r0h6gc0<_W33OZ4GfD-*quUM783+nCLuNhyg$acoW-Auu#`l5j&o{NL-Io;Fw zXFP!j&%!Q{RgRH^h5Y{TX^GP}s`Vb`m*#1YI#S|hz z%|k^{<|t)hm`4Ltr*!X?nZgt&K)!F^b}Mk%`n)t9ZebA~t})S~RMtqXp=&X<1#}Fc zQj+NqUbP*`uLGKjCO>CHIR=2DmQ^=pB?l@Qxnk8chN$YaQARG-{00n)_93FIoU`Tn zQUusN&FHV^z>J>gG>vPVObvL+3=Ad6(J~C|k$YX)cp*qbRA>3(e-cKnU{>1o8`>AD zC>p`obnlAuEK@$ps>|)YSmF<$@Nq%4*O==k`XYoLcXPY@H14B0B_~-lMBHQ#F7F=_*v#ivm-Pb2m9YG7br_>F# zx>HirwX}petpA#^`1q(c^mRu@W&31XRz`tUKbk?5SIiT1KZVjGL-HS_qOeJvKwmBs zxHS;FRn?nsnZ(P>D^6qr6Lvh#yWq-|t0PXu`6hMR3hrwZ7|ZVIS%tl4LG=-sdv?Li zrrr;@rNPWl0CBqE#g+nh~XbtpfVg+I#W3>p1mO#=9w`b7uPof4tBGHzaROVR-`G$=BrZ3JvErG%iBOA z!_uVl^JfR~)VRdd_02g=19G(ZpNB`kVSa+^XQo0fD9CW9gntXk^hj3`TV*-c2du(HIZS9FC_-2?OJ(M8|} z0;cx54d}WzK@_Kyxz86WWN2)Sqyx$}U73!Vf}hATrK?x2s_7wn-_Y(rm}S);rvBkC z0EtB&a&=wJ2h8bds7sXL!++(H6%mK#bkl9n)W@l*vOne16K)Z{!l=DfzD!OZu7Nf4 z>N1J8gYQ~6VLts&?`}hlGax1hr&6NODn{)$WGv2$v2&n`V@cDA5VtiV;6&aCJ?}2) z6G6*}{g%`euA3%0|1Moh0E!n_tS^~TA3n?tAu8QVFj7E%SA)VjTwTS&z(8ovZ4g5< zs`OHc2=Sj&+j1fC#JamAeZ%8ha2f^)G_hM5nQd)VEYV(Fe-QgCyqCHX)81X{_rz+0 z`Ki#L2gq12&(#BjX zc_7kuee@*@E6_NaWK5NhefL9Se^gb zr>9w7y*b;JJrcqY&dK9?gM~dcNR|b;aFua09=Sa$$p~$kr;;R)xo$eO%dKZb=`BNEj{Ou-Q^4Rc{er@Ct|*=9hLe z)NYZeNaNox0u^*}GJSJ=tJ6DZ3(rKvtmT(4uF&hYilO~W~wZ&2I6GQ@$iylM~w6St0B& zF+dl#W8t$~saJiBXgGeH$HdW!3!-YiG*$TZwJzu6L#3HKFB+%wht1lPKHeboI>y^t^X+h3(ydoAb@MjuM2*xO?F z01wTk3YLeCu`G6|BfFEnm}2X_16DMwe3eG>-R!t0CnbZ}OUU>4oWG(p9u_Q-z|;Ug z-n9)e5fSwp{aa<-L6c7U22v^`kSbc(X{JqXjy07P|LR50dIKxs?!G->R)25LTbm{= zy;at}F82HpO#YRvP}Ecbez0@$P=-kV#r)Uf-00D-7Bx(PVd;?(7^edxqMXx zpH0=ruD=G=4&hU*r^2k->(uA%!r_-vBwS`H)(c*=?C{DuLqR{sDU*$ikQF5dJ6k(3 zLW2W-VZ(G$RXT-_uTL?ZtnVQZ)||hNgXhr=zP`@Tx)0aK!W08U0B}JdoC|YqIK9Z{ z?WS#L)#P+9k}7k%EiC!&ZCGvw@$MntldTHA%ULw+)H2WBe3{Eu7cqWC#TZk)L8UO7 zP+GkBK31 zWlyt9^4`Ysah87Nu`#)4Z#z3s@-!!LOm^_5$}#q!nW>Pq_k-#5F;ina^bz&N^W8DK zimQ10xNTaBcOu?li7PauN{ScVR&s+o5UUGc;avaTP825cRpA#u`fD*|8sEd)tvsJ+ zaNHj2xx>9qY?6)+tW_pXqo0PZ$BLE*VM;x?8!%a>uX%}Wnvrjo?=-Ynpd3*8UB<6^ zhwlh`!K{r|QI4@uDw?>J1gkHw%D#rBe>FzYv=vgWygSHF_Udl8TO%f^FRTK_!xcHV ze|M{!;q{5y`%kmQ%CJ${2YHg+#wIfzS?!$&cipn|bgBfTUX9>*lUSu7k7UY*zi^3Q z_+++vpZA1|!~$v9b)ZAOD~rjXjJyyKJ&Xs)fZ}%B?jQCuzBYBS@9I30AuZxoYnysl z3qyZsf%iQ|gpZY)?(8*=7NgtmVoOWqB06=ye8^w36b(M-L`Y%RmQhJUQt?S>)@t@D zHMN?zSID;xN2JZkW!$KlhJq~6dR%{fS?A;(o#DddmNW7@5zo7-naV;in}hSCBtORb z2I7#ZG{ZjFAUA{g9czkYUnLrGWGM5$9z~>jFI1s7QKlrFA9WW?EbqI#Z+zKfgE?(q|TVHA$W+RPI<=QTM{Nv~j z#5YB?BpKIbr!4;MtFDi+4Er+X#&>x~?#G#S?r!0Wt`}u^u?}vZ%n?2+8xsv)9E4fPm&~2s6E~i{ zIdSjwc83uNr#CBUf8#=zg6Lx;!q!Gxv^2|K2YhgIa%8;@JwEYDy*S2Tb;h8+bFIa7 zX(8@}8FPXr4`hMCttym^i?siF#nMdM>erxu1R=tU|DXLn^G9wA0cJCd`fp)| z_?Gy~-jIF`eSLE_h#4=pJ;FZ*#3x4amk+&y<%=yXUSW|L3s-t^@n;4b1VZ!|`Rnw& zGvba+kbQHZFNcQ%ly;n^6r9;CLOAEko&=4-SGl4nz**dEKne?}JzSh%&*yD<0 zgz@{?oJ4-<)CuVnH1*j!o*3Hy^NL))_5&efVM;Gx5!+(5bo8pzkMg__+56*p&M*HN zFsJ80^Wo1Y%X=cOyz< z*z~c~BuoCYDCc(n(&e+#DW<{9_ME9L{B_%RKFq<@q47Y>IET zhnvYrHMv;}{dzMTU%||!A54x5atFfv*1Y?6Wfcld2%M|;`xvKi1)oCAN-i=#=T}S-xN^>I^q)QSei>x$ z-%`X@=;k)d1yQ0E<@oBLV?-tDgyS*zNEP>g_RWBsbSfs4@heXqS@3K(TONy`lJjPx zbVSAawyYV8$P$~ouj82JQ|TQqA`pE?e(NI0Ue46-Cp6stj)tq%xJ-Ova~aF}K}(7)F2g^6!l{Cq;weP4&ylY?BH~>OUr|k-yj+ zFEC_;K$IZ=5yKrSl=6%Ep%iX_Sld*P6vV|G5oq zc_!PX_SOY-PqB7p=7S9GvHE414%0`#GL^{X7y7t;(t>(lYLYACRu^C_;}{fr9X9#< zUh=;`nrQvZQvS~5!ckT7v9jHIEW@IBGYYfMrOUoLh>S=%sd5%(?&&X`iH36>_D|UO zKVu)>Dx*GiI%+v!k8B02mRZdq16AM)zOVmP7MMD%ceJ@!Pquzn|KMeWAb-b*(V`ok z!JZY&Y<|WlQHBEuADv%s8via4bKvy@D;=5!wHl-eLi0S~I>R3F*S@FwUn`K%R%R-#HK%Q&QB>GBqzS|4GMg>CydssU8x@9oy3&;O6E?|^D5i@HV~ zVH}zY(gj5b(tB?;G_O zzRz#1`R`&8R`N(*?mc(!efBxY8=qXmy|{HA0zZi+u&*d$GIv!@ok*nYT^h@2ke+*V zerywA*f}ztJ;^vA)F&%X-GZsIY=S;_!(9rP&zN84GwYLHdjc2ZNKcOPTFm)&Ely2O z>){DrE;Eg5Jk7D}L{Z{ZQ-1bERZnU|YwudND&~kL2&?=?toDlKn!UGu9U?GS~1_$sKkN2Nv*@qL- z3p=+F@>hXEdKF4><@}JJ!(ALWwW>B?OTEOQ1h7Geq{bwuZ_wb=^G9FeeqiqNkPK3% z5O<%LM4qU;py&s>BlA0-{(P;UhazOs=S>3Qa?`({*m!jg+nS0 zQyVt9r(28a#fKyd9{W787F-G?a2`6p1b+Y8HbAxY|1QG}!=QS@*v7)6A&p{x(q#?& zs@U|pFRY}Jiv!?v@qZgo$)2go{d`$q>4BI1IbPO1h1;Nni1MtH1^R9c3d;sME+dOlHbf=q1BM45NZFzsk z(eYguGBOw1U)I71&}!W3Jw;tPQ0QW@#6P6F@rV^1??yX*Fwm`i2=>6@{e!=EN*^M- z43d^Ek*z(l`yb+6Gb$SZnBgQZGs+pS3J9#9qndSlg;SWuT6v7Ucp#%7P9bob{w?uhzB%rF?c7m8b+N ziU0{Fiv&iq#V0t#Q=pgDB)4k09-Kh(PUQ(e233q;9)Egth3r|5!!PVt9}hrV<+-F+ z{h9d9AU~*=mdkdOF%A>gURR`BZrFZO)ZVEbWEUEr&(vm()PsRCyzkH)0P4MwI=;t!b;ZNN?#ATDpfZl z`(Rt~>2%W`{^Sv23l@=TI@Qs?B+`=2 z!RF|#vO>O_dfa3${|d9V zQoimNJe8gYg;}99d9*Eh=y-(i$4O zUhpIj6GgdtFpg;ra)$ESLjrQsI2zaLozetcX-I-;F4~PEG1ZRUAJxUT844_TTu5(elMPszzKV6OjuA89R2?n^h21 zS*-#5(kQMW!Qmjxm!GJNvf|HV*}#Wdx3CGUMkj;2q5(>yA_2zq-@~UI*tc*l=aV6U zy`=NR(T``#@B|UteIL-_Yfnm=*?pVs#q@2$;W-*3pTJZAF&K^I}Oc4fcQ`NrqfJ2A;EsUI+>Oj)Xx2| zojBoV0D@_Qix_x@R4iC3NxhJEQi#Atr{2k~S|{AX`GXJ%u{wXy?p#N#2sg z;T6N7)O9V<24LOAl|uiMLTC{iE!hS=;TL-2u>C2Qf|tFrX?vnYsDZqB?`vF;0=^fC zInJd!&v251&wPnvjmI3>cON&ZQIgFR)|O9U8-rF{PS>`d3%SwgPCn=DF=^}sR)J=X zU9(EDvYXexE-f2_L3Iahy^cz?T%IKQ2Orf?`ukfcX1>^drsNZ(Lj(31;O!2*@KWBo zLWtP)9$CCCcVN+2b|)$#jSHX&f5$KU?Is3F<2M)X%!jh^uBJ$C`B1^BRybKz;w|9Y ztDG(QN1Y>VIE{Y6v^5PlG~TOo$-5m;qQ45y@xIh~z|UCJ^Iw}edYl3*Sq^_Br}CL* zV?qe&>=f=&P;BeJ1sgU@7MDdWTqCQNmw>n-Lak2MlPxiNjD}^ytl3a#AwX7!6yDkb z&?WOdLQg}4YgDHc^Pqtg`HB7xu9(?xeJ+4}s3zSM_$G9A*|(~D;JW~6LZd*K*R@^z zEruB@6{LwTNUV4K{m7ff8D4-_Z8p@&DAgI{=qb=H=dJXed1;bhweDuHoN_Ooe*|M< zZu3E?%zY=ggs(JR%-K60Ktv7C#fHr1tG+c{j%f?jJab@OdWa9Bx`|_HokMBPkWH$xejbULu2g zC5|~Hbki?Os^rx<)Ee^ue*kJ=C^#NMUKnjJKxYddGell0lshu<&W-}r4P=>0rQS`` zx&a1t*8PYf-Z7|wAuT^+&GN8j1w|8bGBMymQ#_LGB|+`Qgno{ zxTd@!R%2xuzsM^?1OpfkcMqITlVoferv%@WwOnANp%b6O5$R7N&06K zW(&cnT!hVA&QQ=YO0Bp-SHQChQY}%Vn>Fa1ut?9l3NT4_U`2Jd9#`Q<^)WNv$}!X7 z14`?bpy%}*W%+fgNSj<wY#Rx2ela5D8mMvoBc-@F#{=C{b7GdU1tl@>U>u2kjeil5z5C_&s`Ah za~A~2KPGdb=Ts{!RIuorlSJInOCI1D##J(*aZa|q`$lc_cL{2?PqWP5jSUG6@I~pn zc_!{AUPsB1_|X8wiw3siQkgew&K~g)V0C$EfXE(dt?jBhLI$CyF-|8v2>C&EsWeVj zZ~|h`%qL0=P@!XniK=o#$XH*^G?4MeNKJX)0x=*F)eTCPUKM~20(Tj6NQ@OE#N3D9 zAIgG8QmukctdLy1x;7(5sXk*_IH3Vo?m9UYP@PJ4oh_)&)~;4%9pPYm_9*@cRMh3H ziW;G>F=MPTN~{@t2U*YOfeCq*~YDfdFg4yIHw&)eEW!^2zFGG(Q z3~}*$$7_10MnSL%3@c(lHn|9(nYm2`Z`m+C^TcHpbvHxc7;t=Ixfp~Sa8&RVg$iR( zykCB29nOH=1(GVjN(v$K`PH~`KpOH;_;7TNB_4DM_x?MVpP*?jG>D+1F4$=|ZO`J7 zeRA3O^pwgd5Mn?<=25JcxA>Id`*OM)D)B9P^9SGiQqxTdu9~lO6C~87$PFyaM%A|F zP}||))47sVg;KXFl|iy5)|DiTpFgc+w@Vo(02`r1r7C;uS^SU0G+sv+1zCNEXyFh+N-%1c9 z60Hp>OfNF=&vwE8+z1Bjj?|=kb)8z8@z=>dp?>j2-F%k(fHV%@fB4#kMoMgIOmao- zT*}Cs3`rQT8yuXDEgr7}1z5ai)G`ED^?RLKzhk0*?<-8u@&42rZb&@`b<{_S^=dKoI)|buo&gp3UMw}~Nnl`<&UEzsp#|b&q&UBKj{vP_Kusrq za(=y^)myr#mUNS%vf8mMXwi!&BRU6>h^{lJ_v6ut?FfiP6*QqWMlNdA+rqfo(00)A z#+dTcrB~=e1usi^+I3g_D>NbhwMHQu(#h7hO3femkR-eyyK6D8WAU)_WURKUCNGiX z9S^ud!RGZ=nFI2D8s-bjwaDZ=!wlyN;#7}FoOd3Zn?dTtg;qk!0Q4R?{ zWOYmfd17-&n+>YxE%dseO`y64ByB-!r;3hMk^0>amXf4&rTuXuDsUT5BmB4i$A{iX09Pk{ zQh{rvXh3oq$TnH(ups3zW*gtW1wgCUz%R^e!Azx>ArRH_zTJh)P8ww5DlJ7O``0%(4t7PQj z{QXBeJzMxVm{}LLdPFEpDy~zKt;>Y$p2z3;_%eSJA=@CCVXBb(Goojx^}XSmtD%5e zmb8@hkk!dB#T>pLuOua_#A8YfW4ojAc#a7~92)|oUxkFp8>)Na=vCq)wE1bLtKLr%D~2dhvbF${O?U(l+N>>dp8V+TRS-bO!8;|PvI=9}M)~e9$jGEqco9JkE^ldL zsG*|`WAw%@=h8)1&yu%7)->6;ptC?iWf%~k*K8YZ*d}b1VrJg2^qBWzj0+KyX;6WK2ouwA5lYH=f3(D^I%vWmN z+1BwR+$twAPoS#MeHWQMLhqk9-LssR*eJrZfN!Jle{XJEzj^cWOwX^mvad_;CDZu< zEYIKm!!x{7LIG_aFtgm2iWMmvndU&&aaxINR0F`C2oO(@pAU#bv683Vt}StXg4@J4 zJ{8KpF)kmko!>RLBx0%PFAL-``nWHZHRlKn1jba?h_>L;cN=Mr3?$}5Zi$y^VYL=e zsIsqjfK@xd{0e%GilC;&QRxLHfapislM~DwItw5w?PeVdLq}u2_#eeWg%w%I- zD$!0v+bWi78BE%ErU*cXQ%zZxu*KUX3SsC1E+>51z&p*XP^Q+T(*L1Vzc;OgGAa=K zwcnJ_ptfeouDHLxc4K@5Qf984h&IgAuZM=fK{-h)=_cc98B-l44<{8)JM^>deRIYq z!OjJVrFwQpEB4dI4EdavxoyO`FNv1Zlh~v27Oi*EM-msF9sOT4P->7=LVx}{LMzfh z%Ol0L4Lsh)+=_2|U# zQsByfb@mXLzvtV$;3Gi|aKin`1;A!Gn4@IumjEmIdC8Rx%mb)_J^?<%UO%t(4$RIU z?q49@Wumu$36>9;V8vov3<3S@n$qlo;Dj)2aPZ~_WyyD_)`hY;#uP~aUlIah)(0;o z=O1IR=;NgU)`K=ocL8mY@Z;JNiRGo&>a8&m$KRT6{#t(A*w3J-Y|Bah+mACVhNe-i{(QeNZW&#q-8Gr(Py@{3~$6xC=W^91o4!7PFhxN~;cS}Q_3xw>v zP=)z9DKwHM4uIy123NeBu8qG)S8_=8+k?gK$>gpcDjIWqUvPEKY`qLF>d znNxtE5iyJ=Ib5gyM8tuIGn3c(SS5g*-V{{gIian7>cLQ7$l|r^(CZnzTERecZ%q_ zC5s!NaDp{lM-KxPi2-(QwvmViy;U&k2UJ>6H-fKHUf?f%@S?H9u|iZ%*QHx8YMyh*Po( zU~6E*?Q;fPZ=CN*;zG@kD?f)rnhgrF*s8gDP}OVJ@kJwe{VRI;-6EKA{t{4;L~@Sl zNgRwpl>w(Oq+B*Bhn(OtRW6F(y$c8E;W%*;tuV!G=Vlz|wRPI|9m!@P01?Vd`J@Y7nu zqV1JRX+HgNxl<=!-GTamA_(?fQF@m2XZU?29nY}m@^j&VKt|H2wcc3ZnZ8sVa?owg z)m^2Sm#E)}G=v8Q`wG)m@|o9@O)&g#6|$P2Ewe@$aP3N~OWr0Nm|IGs@Zp3y^WV$Ux zaAA)7m+SE}f#*fCneKyK>5LA3VWniQgMP-wx4mbF(`sW*F)}xR5<~t9h;iiTU@A2+ zXlG$j!Pi3&O>n5I$-A2Xt?TH^g`PWVN~HCZ)ODYCJd>Xye@1go?ZMd5o?V4U|nilsO$3EIzF;*;~dKHugi>k(f4@HCM5y+Ugwn zuBc8JDzj3HUpOrKIKm69-PtKVnU`?ezs1|{vcrZB@FmSht^Sdi#!ADNATiRIy0qeN zsn}3Mv?xMr!@qvPv}&FR2-B8Te@QK~mxAq|V%Yp0`1o51!m9ygom`Wp7{7rm&k7!= zbBBc4;^xR5rxzy0QOEwp$lOwl(b&Q><2caoWP1X?&bS=_bLaJ*^ERSt=b#_f%7_C! zo>D*m+l;-LSm})Yy@O?)xnW7@!m*>&dF|E*lHt_(4UCnm?(p(?g?R?+K-% zY8eW+UXF(9cpmL-(!$t%A-6%(*Xq*z+5r_apZ&mBbUh}MrS($u>wU1S^jwoGdy9v7 z$zpj-MRfO&@Cdu~NFvBQkN)1Yj~hfEa8ia~g{ z)X(ZpJ9~=O-sYo2UQ67bm*%*78x};@nusg>TY9HkJ6jKLUmLo{r#iUw zTa)51y-L2X=cVcI{_MATS(QD&j6H8XS)@FhR_=8d=@8cmmOd{5x5OzatvCQ3#CA`H zYRZ*5Mzn>OqJ%BZr9wX|bQ(5tZci+foYawO_Sia9;|Q3qm~}OV*Pi$r=WYcFXj?q! zs-w*^U^rO8U;$Ip8fWn-4*{h9i#j@H+Ko=ctsTXKWs2Qwfj>r=$-W2zLS9KqNe#ZB ziLkDD;$|7qzg~&~6yR~QpK_d6W!1OsZn+wx#RxjY!KA%3sRDii7uOn%9KDQR=PEQuRJPJ_E87s~U+=+w2iDe#L-K8OS-wbLkZTX4b9jAvxXdAENHA z$gvEG<;SJ5W{l9Q$AeCSku?V~X7z);ZK!Uoo0*+k;UMvJCQTBk^FB^R%vd6oZ&k}& zP$TUwBAOAiztgI23pejhJTi>;f}w8Zb`4!bWvkb947~u$DbJx0TqoHb8hSwaxYXzd z&^M8u+i6zN3Dk7b^E<}0n(3evX-tUqz0leNe+ zBtNef^SUCqA%F-IDy9`HK%D2v%axtry(_K;Vr%7JJU zn4%N?S;4VlWC3vGfO9~c>o?+Yt5uk{C!pLwt*XWR+I&SfIByi=f=^0Dw0CR&M6Gf# z7Ejl{D63h8F%%P?1cbs+2zox(L|*f5oSD2z5&A2rbw~)s8t1=r^xb7razrs_B%j!& zxw@P_u9g&-s-Tp*{E&{fmQWw?+A9)B&236Qi%&X<#e)WH;fgBABNOm$qBpR;;e~*a zZ6g4ldPFf`YPirTIRO+dgv*A+0GF-{VykUXSTEtQ=w+}3)COSYHb;2@#kuhFT2)~% zPdLt-CaG%P04O=>o>vT;&U$;0mof1iKEY?F;$`dkb$t#KO%vi=;q7n5>s2Dz;@_$9 za`F3cZ*DXf7-{Y3TzRoyI?`1N}%9C|CS;ZRUoId|<~pu%-cmOXYC z-z&al8)I2+dR10~nzwh(D&t3-N=~kX?WM+#CfpQoxSRC|Pt744ERkhHxb?)gq}(Kl zBXJO_OVLrPSXb_IXzn5p$9F?mF-)0O#`_M>+kT4*Wv@=7d3#{{6C{qSipvsZtr^e zF-WsDst(O|?b@|?9C4pcXMOiNupl;>TMw~`u+Ze9cl%q5oc1Gm`leq8m!$8>Ey0|m zTJ5!a08i@jlCCJ5>IFn#s_0vHYE{^k=S3fu!;h!jbX;mGt~mH!lBz zWr*|Zkj+;Q)6>-BiDpfFAGv_@k$?VDmS-WkADk2v&i^V9cRR(HXF)uIVPh|73X5F` zbF2BnzS($I-JDr(VUK2iE+`W}`cyfc-jNJU#Y6o%u@cJRyY{{EN6M8Cs9ABXtCLo4 zb|bg^Y#!5yZX;BYPZF5ftk*iWvwiEA*UKh<@1LO`rYde4?R(pwvVZ+$iCMj_{c=Dk z4@dsiw|U15rKK(R@wekVuis~t1l?L9rQplxeGi`Uw_ye2hQ5Db(B9)Xh0Sa_$+v~i zD}_%u@}vQQYmxQxJdXa)Sfh;fkV%tot7F9*kJp#uu)yU09R4~5BPR8*ims^SsC0{> zCoYG2Nady4bb%~C;t#4!InkEfRQlLv$%`^=ZzF5idO-Wlmq_WR`CBb0YAGkBSCftp zay=XU9Rw2%n`jxOWixbU9?7vv@Vjeg+;P z#SwdCla92!G#UNfq>~!U55XOe^wRt9m>_%{mbqg--sT!8yvWRSh0~Qzn7hhP_sspAyJ8OImh>^Vu2J))3ObkeIgd_Ju5*k={FT4-q(U9yoTUg4QHtecOz7I85$ z!WGu~Ev9D&sa#}26g0}vwtc6(gN!f?Fth9BA;AOx3mAXTaEIcC(JU9)km2j@!$YCs z$LHVyjD?;ng{Uc-1I*C%5Km}ga#2z?yAJGTOG(h5IUEX2BkZa8uVdwN>ZK}O-YGim z`}Q1)J*si^DeA56IorM8e9qpnxSsylaSp;C^KC$fKbIfpPNoY25xQ4d{VJ|?JV<1T zPP!`iwMR4czS@NS*DD)ME0v`ThWWQc_MKv;_gf@`15jZ3wXDd1Ev`#4Owr5V-lk9a zSi46vv&)N3Eh}?8N@g3F98v6vV8gMx{UB^0tK>(%%ZA|zXAxbJ`_{D~o;4_vA{^`X^rA@PD*W3GI^2NqJ znEiP+lS>!06Yo!hzh13(x~J=Mcznt~vJdGMCa$4?w#!P+a|9B*L9>ZX1zm23@k2z4 zUI~Lt(_x|V73H^wn^O~|&L({|j+1*`be+74!UCLQEwE+X^L-_KqS4IK%d0U<8QVd1 zk}mdjThil7>sy6u)9dKkp}o4j`kT$ZJ<kNX@@%LDbdm-7ULo#kR!4kXVse@M!#ELDP2OL-h;ze|PG01kiO&MZ+6*XPV0aG;dl}p}djlZh#e)6TejL1sZREC&6=?}1-w2kzYs*aI>SJlCENvTz5cKg1V3j448_N4&o6@mR zsa*2a3tt*aVil<*y(k^+IbvjXE^MWpIS%UuCUJ2x=H=NOrN7-kPt0_ZA_zK@!nny{ zw|cCi_%*7VX-Lp*y^!CyMF+v2sac-=MdRAFnq=Ph=ZOA)#!=f=^R4$@{+=F;kbfT# zdjUii|A+=~oxTn%1Z&1mJ*PfUZHp5P)9-SZNM3M`6WVMDH7@mNg)c1m7q!H@{29l- zJi*28dDEiNf-}8Y`TG<-weo^SE@m2O+2VOKc(+0J4|Uq!u@LFBs5fsqre>M`IJ_W6Pg)0FhKpG}5`b=5K_xO_1ImgQ=5$CkTA&4?HFMKm-;SJ-Ee*)2Rzi~LL5 z_MS?M8d4NZ8tVuMaC5SmTdyg&Om`C}$anB+QA2h{XX>*jihk2l5sClcPwSTX;;QE> zfYXx)z|WiFaH5f4dn_JeS&}X$1G3}kUe8%U#G8&u%?sTB#^t}aW70r$w$8Phn??LX zHXU9DxC;O?A3NlB@Iy2O7+8P%fYgw=0zgpsk)57`M|Be;hs?d(%q>8!LFil;yVvX~ z`wqN0*mrR;tT&*rwL*g~gyjae++LdW$y?uHr(=pV3lX{I@o~N=w#_49$ibOKA*m-#NB+&Dc+UG=124qh@a@1< zLp{(1PbH!yc+<BMVP{Pd_ZBWDdY+{>uf{3G?o3zZLe8BS3`S9 z!8SKBVJ&KX)~h9*)9o7C`b_q;o1)=4V?Y*2_D~Ee}-cf_`l{c_J;O0hoz9<`kcm3@&JBiw_LPx zFdlc=M3YvJ7c?SP6Uhs2rH{)}UGGRR;5bq_qR=bxK0};VHoEpXE!tm&ttmi^;Y-;eRz>`}qfz|3L)L_CM%_+GZ3Eh}* zZ4Z`N7oY#D+IMq&e$5Fn9f)enZ0wtvq|TgDeR+Sz;p!unnAXePTx|iL?*qi8b9CM+sp=!9zhZRAt2ql>>1Qr`v-B7Nm9b=yRd(!(np|tbJr=c zQL(PsQxj33Z>kr=bK#p=csNbg!T2Z2pf$Bv>w~|bT8TG3qHiy;XwxSI9ej}0%~%ZF zfWjQh?zd!4HBM{r&*UUW895)!g_0D!3+~P$-lcKPzT6dK}(Tfj7 zGqX}3v%u;ZlhXjkkvu&t1VJ>uz8@NhoYUwaPzJxr=~d z@y!9qjSS0qie#y33&(4t%ad8IRNrofx6|0|uiT+H7{nN#i|~^@Ua`yMZ|Z3Fy0g?3 z7oMoK`9n)OG$9&;xUa6$_Z0I6xBa&?;%hm+7&?;{DQJNM=r5crMw}S_FSf0VQ(NYp zKC72sUt;rqNF#rtMBW{3C0HL+(dyRtWY(>>a`ba}{IlL$84|y9QU9qn|6HwQp7Rw- z)H*yf?okTU8V+V=gHLMG-L7G-@+R*8*d-L-6l{xSw*E-l?fwKaDk_RPbfHeh1ogs;Lfuq{aLH&@=q)fAIL*@3^KB$ek;0EQwRrp}GF0a??sf z=dGRqB!`6=UR4ueR$Tde4wDXy3fQc)J=y#H4@p5wg95J~X^A?e%Jq84yaR8E=P1Co zm^?;iU!%Y)gsaYk*oPVnpDQj})LB@em*$!Gk54F4)B~zx$CemgoU?i%+e|f`nDc{9 zYhA&N5(O4g#Pq8uD&_KYb80{h8SLj*vFNAyTone0CwlDqJ>VwnPt}tbXpi`LPSQ1I z+>2q_n<`Z*?c00QuB;@#g|gP_s;&u#rXND`+qPe-MnEj%P9-g@iCdB}E~_aC`T9CGihLCe=Xqnn=r`vj&L zTYKSh`-3munU@q;DBZiai+V4Nzgk3AygVb+h=uGvMjDE+=!k{B(Y0ZH*el;lej9b) zJ>r9COFZfa+r!zc4uyw-k7Mt^T)bHOMD4mN1uN_9${s%K+8jQG&%V*cqrdcBh-cD0 z`})L&m&kSf@d`&Bce716qqQ9F@HR-?&c%kUvJ4xI$Y*^Tu;_#^e9}rweYP3OOS8BO zdGO;6oqIE-Uwh+;w<#6mML2C+*XEuYFjt`el0=SNq4)a-56`6`dzA3q1~1 zrV2+$d!UDbim_L*qxS^?;uEM2ymK+`U#vT~T37Oz;Cg;&Jv)&A-ZU9Yug4O6Mhv=b~~mijB7jvhZ$h0kfsOU1HUt5!V@ z&^Xz6DqSGX_B1k95*ho{&DyPwxjfz_q^UaP+6gh|1MX3?m$iCd0DSpzJSQ*D00K8B zd)1R#bYw=Bym$FqsmtExca!l~t+XGOO;=tmc9r&S9A`yZQ=RqD@eu-s_PuLo;`gYmPO43g0I}Np^ssTiQ=KY91}LL-nLyu)BYCp z=q)G=&N+Y7o^m=hThsO%9Mt|UY_cmS{s)tMsnvH`G3yqMw$ZQFxF~Lw=Nj?fpEklJ zSRSurj6R+!KJ^Gq(^a06V8Z#cd)``SF>7}hA#Bc=MeB(Rg_jDEc*C`VHpf|%%!+?2 z7=9?^vR_{@zGT8Zqk+NGS`;RLn~Fp3f}3$1ne*4%blnA*t$A@c(=y2?e`xVEl`C6R z0tTAsA9w#1r2pvBHysVIdiT7u{nDSZ0hZjkL=0NT2WQwfoaT@LAKLa!wUqhRJo~Ax zUJSs@8uMU>+@lL2+lK}j=yHq+TIH%X4<8*`_RvAdS z@mnXw4_~1Oq3WMDQkicCQIad(p==@CS?gFW_mbM>Ky+L{4?mTNq(_!9evJIrLh3*NB)^GP?eu_`v`Sm_ z#prG8W|4)!-k?y+llC*V5i}a{1b7Y`U!(W4;Xv!le%S!_+}>DR+I}Dw3fQ9IVpmQ- z>15133@6#l7XjW#{_~=iV#VOU9*)UOE7Wx^C-PM!(TXI7oH6Wg^#iiXn?aMp@9?WX zdkPqBe+{L)U*-neZRRG9QPoUkYNeS;wM=L=G`eQLZSkjV(LTp*PgpFs>$5wh-4|$5 z+@0{%<;$d_;=z4%va{)*Dpw;o!TV*C)qRBdHdttTv_eDQNFR{gOJjbdsE>r%bupE7 zlT6WbD>vyBeI_bB+P~dwdEqH^Hgn?Gu>B-q%!VgxL3Ufq8E?b!lLR|5 zM9fRPaOM6&?!I6{-ei1Jf|z_=XYuPWUdb?(M+@x#W!LeGV~k-D3X66TSj5k0?wBN4 zXC4b+M~c4Gl=Sd~EJa1~071Sc&R~>Z>F47C=P)yxUkiwVIRikMQH>W%-ri5nRA`+K zhuO>({V7<=lVwe#a}xp3-d1;6zCws&sEK^a_;Ij9jV_c}=$T(0`qt9V=GBp1f?uq7 zg{PJ-A7ty~$K@Yd? z4B%S6`!TW6A*D-g_e(?{;#4Ppz%f}*o^F2&Q**$K&*DL~(~nj(q~wgHg9i}<&s}_z znc3{42^>&Yn|gu^*l%<6D^ugKQDkp=q$y;t!%~Vrp{i%a& zJ$j8abAL}U>aQswS~Y@A1bN!<#6HJ)a{k+YfrV#*`=8=iH+NM1qpRfAu@5euhmJ3d zEj;stI6~H8<5^dKZpYNz7&b9L!}8l_Qtqt2(D!3G5oON#xvWw6fZt? zC17!T6R>t2_)>aUs`fM9X-O8o!b*>#dp~uUQF{_fndnmpU zzE6ybEkF`Hr`~cci!~Sd7XimX;^=16~B?;)@@B+usp(bJy$Tx;>BlsNJ0? z)<^I#Wt&v!LyXbD!FUX3>W2f+U+)Scx~wVYV`lxPX7TJ=n~C8G3L>kba4}ylvsI>t zT_yC_X@Y;p+G4*J%+gp+t-nca&M~t-MDhVaWSadS!dV^=&a!34=`CNz`=~ditw?j4W2^V?Vp)_iibtE%vUjDUuZrOZNr93`vq2T4Rj^vqqiSqUI zdKoeF1$xPhWA27lz1-}rON9cJsT56I1EYQs-z9u}Ap45V-c+x%+EwG0c&mbnl2`%n zLZXFC{*77Uzqo!fYJ+;J`V~&SH*|A%wRN3i>h)GfU0*0=Ub6dRLCg_0rftKU2^N>vd;hj~ zPA+hNJph;lMNTULQTu)0GV5DoQCkyBwvVt?#|O(m63qRT_;euZ)=sl}pX*8c zRq8v`DsMThwWLqQS#(%vgs9_I|AGgUQD@N3se#1oVD7w!lBN8$i*0V^UQN_Wx4e7Y zj#|k3vVL3=7qic*rhoB0|2FkdYHd4IHVmqTnX3uYVT;=$(en7O7)4wA@5Nf!KfnjF zh>Ik9)#&axatSO~e;xajsl295r@>$*zdj8I_D=VI$r>b`IL}dBa%3|76F|D0k9bAy z-v!-@^!KC0vGp}(s0o)nxAY7KAfK^NBQAz79SlYoFNu4wO}Yj=95#7yvDt{Z%$)__ zWb8gZv(MC?>Hh9(82fKX(~@+f*qIp+^~T-Xw6pJxx?`%_-s-gN1OLqu+>wd)NAfR% z0FR{en8AVk_C~?Tex0W?6BUP|Az+w@CLXwPE%|qKFQg(cI&5^mU8p!Ojy}%iFyMR2 zNBck%(JEHx6FA2feAVkAShC2>G*w0@QER(J!&Ceq{=05i&6on_8_@C$D2g?MvRITz zLQsS$)9<9S4XJ}qBdhfuXt4Z`E@i2VZ!z=g*^QFdRm4K?#Yd3G1CAb$1hik1 zEecU;YkhYJk8`nhz=Ac<~FR=VLkdbT(aUEgDaA7KF5#5y@e38LO*tyRoAHM?^g zwSFW=UoY`CO8$85#3OjCkBdWz?bF*JH=q+msEeDei1A@;*8{mqX=Ty@gNc0l9lLBJ zHU_{{j{Og=-eAMhUerjAO7>g%mgD0g32daF<0ixBs!JBNCUdK9f~1uSu?ioN9Y5U( zZ$B@k76^xI2fY0cwr*};FZdq%{X~7|;#{0@Zn|AraH@(Y%ia&?w-)4{^KMVJ3DoH_ zSgXWLv%0RDe#@=RV~9-3sYvR#i&une7D2FOk)|L}4_>?bRYefKncS^V-$9G_<8Mz~ zF9Wrw8H%Lt$5A@S^u^OLiFNk<3m)cG9HMfaUnAyMVnB<~XSw>hF@Gh=;rJ8BEBBH{ zSi!*E*!Dz=Riswpubzfb3 z4|>voE)?B)9!y;G(J|)l1hbD~R5c zg6_W#haYzyB`5@Zzq3r}@qVf_`^43>$Sq8Oo=t2E?fYW*;>v8#aH5w$&s3lzP+Hdc zuVlApEA{?8#}Yrs|Mjc;tpFDnK2n@~0L1t4J}f>!epCtu%cr`!+6D*0N&+jh6K-jT>Kv1RoWS9+7-kicyqx+OF)B zhC-ZU_TJ$&8XNZKLMI|)`?t;JpKW(DKYtmTDx(~Dc0o6zU8^5)*sD=^)7`G(K_Q{c zVh`}pC}f|iUGq(Uu~n9!0aD|p6X@y%v&|n}KtXMC&vHzxUz81oG#KYy4TI0?H*kDu zFn<1`Ou{32wKhvHLi-6X{5Eh=E7J}*z+Lw8C8*S(SU-izPa^`rq_FnKF5cOaGH!>B z`F6-9wLe!9UniI+zGF#J_CvMp2?L*u@(relBag3C%3uS4kS!*Thq^7gEu}In<)bI~ z4<2e|;K8mGS8Mh-GndIJR5EiK=x|bGm_|-@`$#=h@B|tE$;F2IBqM>q;pVzgG4^3A zwR)DHmV3XQL&M{&APT>}{(2$409&VmwG;d%NrM@ks{P_>^?3|u3BLeqo6~Xw*a#N) z-%$8k@1#9h`o{kt;iPThqDBn{u)&UJ=EwnOc3`t5w++sAX*mUpNtMu1mgxoB2Snh} zvulM%cD~4pB*Q141}UE#wEWu(U}jSmoH4XwT3;EEmNqq;@zX=3zK~z?l)V^_?qAIty_ ziIXdb^Vn8z%;mJ;jyi-lAK|5b*X%L{UN#NiwVRP+qQYkYmbz9AW_n{C1gy^2Qv4IB6Msqth zEPP8!r_EPN=c-AAchOglMhm=&Emy`jZ9somWqt7Lubx+J-^MS;T7Q>WLB{>?ux?ZR zq>j4`e;m?_PzNs0Q61I1zRD7LcdVl+_*U-TA8YP5xgpPd8RTW!j0RkJjIS5XlJ;5; z@El-|`k6UGJgqqoObFt9VJL}vJynrpEb?34hY#hUFB7cgl;Z*yB>~&+^wa-GeH;Qb z_CNBlV;#6wp+&v!!p5{YzHo>SWruK&+~I0xD)mU7f6bNI=$53zE_}XpE9?EYhsh<5 z`S^#*%#4m$i{1r)vmueVi{!; zz;8F%*gV~Wq;)aB<+f1B0*Gln-k?*XYi(VomaEHpMeqhMBu_tYXIAFxn}AR1=sp{N z?-zh5@vIX?-FL{{tI#dH7S&p*7!Gi{#SIggx)oBRf~lROc+mV-Y;pdt38 z%@V3VRa&gU%I@^kBBBz#`yP+*G0~Gk>GX<1osXonHTWjih9GB7OsBO695@C`^&fD#*iEw|UK$olR#^A&>jBi`gu zR%d6EhrALJ&B#Lg;VT~5RDWI_Fr&kc>;?eyzKJKc*S-F2z5PWI>E8Z7^300sJ5BkgXXXy8#y)3$ zSZACryRrR1!#2r*oR!IX%Qfm#4G)GV?v)4q(-pC{8RnK(h5` zx0_=1Am}&!t=)3H7UQ>W`g%mqx=Y<}Cj55gx91t{6IvNHsmI?$gRed*mc9!ie~N-t zJkFgss4X$hGRnL9*X)Aq@jtm%gtdjTXA+0P-o;d{G%rw#mXa!H(mx%Og~=ADwWm&xMLS&12g z#ZDzT*kGaycwlQ;4!S_aVLNE^566VuvZK-F7y5}aAZ+|GFT;`&&)W%1(bmeFQXeih?(!*_f03bUz>{m%=>cZyLB2Q47dKT%asK%k*?jz>l*U)CZzRg<`L&HnV|UtGb*D8PlUp^_ znLU>^$y&D`O?T|U9zHnisfIN6*s60i6v&dTklVa761}=nn!?yO2xRm*y`5u^c&%Cp z^)BI;{=@S$Mj-h&=(=EW=Oc+)w-rYx*ORTszvZ%VWmJ7IV9ww=xb+`YY)^bM}~ zzidfvC)&ec3a#g-7oV6dhO^5=n&`!&fpVk97$ul3^hy2xFXC{r-#CsZ?(vz*pmz)j zI=UVfi}-Vxbf0o=`Ufu!1637L5fi2l{aDfH>&w%Q)BqZ7(*Lotr=$k8VF=S zfDB4Z4le`}>=MnmOQXAt0-as?BglaivZ}Fe(fZMxTW$au21>Zau|It%Nkus76^&r( zvHhTsh0WCujjGKcttasvTb>gzlk}7KYib2gXruU z`+a?oG*(%tl|drU0v}%DV@(P=NJ^~_$7D3|4DuLbr1 zfOtPkv|N+)+#_v?Je$WzuTpsvU4y>HHOHsS7`Rmg)?hRouRp@*>T<0&)_t}D`Z(5erOT46YQXI<*31!uJ?rLsq zX7;->ccnQ4qo)%)BTxD%ZG=?@jCaxSNi{bHp-I*z)u5$L8; zNhp;TCIyo->M&3;03~eHJp`cASfvui`OYf_2(#~TwP)M$q6iK4n@yqJ-R2h)+<@G( zx^A`|9^5O)F*ff+X^W9UYg0EQ>|lTvStMFR6`ed?X9L}{ z(ShU&s=uYrN2~T ze!1m#bxp{^XkletBF~SO<${4kE$H7o@wnk2Ekl4S^)-&Ibi$@$DgTdD6ei^;U4Rri&neV0yuL!h#h+5juuT)cpm`2s0IA@ zwA7YNt2#?PemA|44)q$!eTmKHA8&NNKJaKGJ|kd|6ede8$xN-L;{oiDv+U8$=pZqM z5yBC0sA-vWnM#%#gF~}SnK_bUs3A!P2^Rk&IWAWPKKE_c59;E0D=qv_>MX#2Me3r~CQ|hX*y*QV# zf#cr^kj8)B32oaW$1Aw<$fX7oJt9LSo8QyH7*mty^UiM<6E%?dG<&+b?oo_Jv3Fcnw zH^llKEhM{1QU}8a1VZ*Uer`?8_I7VJez>^$w1yg0Ro=RfLihTgG05)mvk8{h&_Ek2 z+Bz8vi2$a7ol~N|Bf4c<+{3Cs{V(L-28=)CVWdlsfb+;83@?L~89se6 z*K_hF`@k4OANzYMA4mm6uq=0czYk@g4UP?2zXS_o`lOy0;ct>@D2wORpBt%6UZ)D@ z6=|VYh=);Xd#6?Ql^=ZX@F?FV3ZoU%m$-2n>>tn5cj-%~_@2gA_es26d{p?_2KflB zu4NZyovKw%6I+fJ0O^@pU+u-?ce0S6lHdZ>^M@B@5@`o*mqe0(G-$$k;@_7X5*fBr z(5DIa4q02Qcy#@1v1;$;lH~$J)h9)a8V8v)2!&3J9} zF!N~)eewl@uvKig!xl7c4`a9+Wv0_0ep=bj(OxUvr71|>bu`!&9h!A@6JOtpKDqO) zEn!9YbsUfAbWel~aUql0sXn8bwf{plPL^$_ZX3fZ@Zue+# zgmNQZX4=;2{H@>jEZ`m(uKca2PJ<2u5F=x^0`ZtJSN10$#C_tD`D{93N?WR&t(d1u zZxL%!o;U^19WWbIvv`yX8(XR}7&1BZeRO~7Wa5B-8w}zeJ^>}*ZrD|mmA=4=tXs3; zolhvS*HSZmNEJzi6G|N_K#KatJdpOJN#tV?EjmhMcYhUuI`r6H7L7Jx;jz;9=PxJf zIbjBV$d;BbWF}p_*veBsfsQGqBFV9DeEey){G-2-eJpm^7orh#TK8)A58rOs{=ybv zm$tx@tbOLZJnwo%2*v{(T`^WhWBt~Qn65(A*FaoL8TV}H{MX#^-&A?&`!3<@7mgNJ zI$Kx7Q2}#OOxxX!Zt?W?mff?5}6!&FBm+MyjV^s^vFSaU@l#?8mt0@S%2vPCS z-AO{x64HVOVhfd)dAWf(dXnt&QDRXx$#=>oR{K_x*(G`W42LTpMi+{l;}V8%uj@8>{Ys6p&oM%|sP*?|stWv= zWz7A-PFJe^aBp62gIQF262S1rpZ*7WDuc?>>3#f8CAW+5CCkp=UZ>Nq?ZSs_u?3n7 zGq#pPW?bjJ+;>q0x0?;2Th%pn9QWr~_RFt8TC%oKc{#~Q)yXJNyig8*$pN2ym5?;4 zZ+}Dr^DuCUozVcN+Sv{*7%@6IkLYUXx;U{^G|_6s-aRe0Q0MmLL!eujEMHGs8(%%yi*RR-B)O>0Xfi9WT!a)(H(7OJ;NTCho@dPPZR1hm#(ko~#voU$Y{A7@Q=8N#?e9 zh-F!!neV$Bmfr(wvuSwsVyy_~%yHZxqbhLw+ye@?(_n2w zcl!h-Ygo(*6jE>J4LcJCZ2ACCns5X}8Q)Ms7EPvul;>MOpNbdqyl^1H)MV@A#N5Lo zU=xvAWf|tC=Q&sFnx)1l*U&9~L!wo4YWbr=weVxtdhJ81i$saIN$^|AS7eIO0%IQi#EOcy=DKj;nx{HQ#Byl9ljgE4w5trN@ zPaIXkWw>AzDV-6$-#fqaHv;)Xg=!-0-z&D470i@2IDl`)w-s-WckUa38gU!o+3ed8 z-1P-~>*>}5uaOng2fza#%mRs8VBPzCe(4fa-iTR(ik9em55iQtC`|U)fa>2@&>bDD(R<(I?1F)=XFEFylJ(ep#kavy18m1z znAmHM+M!c5Oh<>zkfK@^JXw=Z07_-~_y@~I9u9k!)5UMV23Q3FFM9L(KD-Z_iwBPt z?wVMRdK%8Dgifkh09z6821Ju-D*$^kVlm%u2D~ygip`i=Bnn^t?>Zs1ke7Z;(xGAi zxG0&Z^djRTunj(`*EN@{vi1!o^6YEeULx+U$Ly2RJHDA~>c3ETzIz`FY07x{)$MMP zFL#8ie#Tk6>(M*o3A4-EDy0P?%e;AB3`{afn9RD7(r$|TjAiuP?1LOUJA0C)chv5>qz5#RxLrotx!>+`D zuYP_R(la|$K;DT>qa0HZ|CK!9jGlk_WL}L6ivjhI;R`5TCN3&{D1SYfF6e_KVc0V9 zVdo9WherYYR&%l;M?_4dn*007{I2L%<$Kn=R>qT4!r@SzHdN>SldMX>t5K!;Cri_4 zQBxpb5li|f2epwX$l6zM1M?&s8@kg}1Cj$OzIZA*a&V35<%?E1W{c76E7%flMe_qd zhRvS9P37h7Y7c)EFVkwZyDyi26^D2^td<8~Xu7O0M)`DVE0CS_QiYyt_H&s_qVyIa zdne4RW~yrv20+R-LHVA0;~t87Zkh9I#u7zKoUb2)=$=p@$me6AuUD0Pqz*r z#R+ItZg5#XxlAGeTY#3IJA)E9vSkfrsYOH$?w}~KdvMFc=3w*dLL8A9Y$iffhDyCRux;~}Mde4xyYXj=bP_9r+T6D|cFrwK8F+2Ym zzQK@f(0H1$5=**)EKBO+@jMDdFMe=QqynZPs|UqaVZ_Yc0rk2YrY2G-GKag>(p2po z|1h$ah4W88e%HOhHk-lc3HE1qM*Kh!bHCIU{og>tV2)47Hs{VM``_$F@fqD;TW5>$ z1N5ra3DHvWikqiGD}z9m8~*r(ttMb|5^%QjQ%H$l7?zdxjx`5lp;0ZPvQxY`8DW~z zMhg}bhWAsMvs!DW8)EsfLgLKUxP5frI0D%KG*N3w(Pgxkgcy9r1BIG#@nIoSHoJAy z^2#m%D+!QfU&AMjmw|
    5yVfV}{+;i9VhTL!O3LvSlqQ>$0p~NT02cv*>MgZd7%F(io zI`P_Wz^8zYI{j?i{j*nz$(rU8=^O)Z2S+89gw;3*c|nndJ+a1v@k=_;edFm`D(ly> zo?{MZCbj1}J@Z8b1QV`=s8peT(a5x+ zEzu#mLOZOf^{yVYRc(i9zC1E3T0@AV$p2TLCS=7^zPp}HLs-s80mg)Ti2Lj!P#>t?xMxhG)t))gGOu%D z0QnliJY-Qp+l%%19e0Pa{%7aUiSN&nJQ8`f6w9N1*0E zNiZlLiimwZ}1`qZ5GBR|(_X?DIMwCUieDoymrbhQ&p0V9A4{78q zgp?BhR$tsb)=qj-KNnC!%BP>9%H8#F71E`je?PDwl0Rug_HL`n|6|~<`->H!)`oe% zJ+EeLm6LA6ERacF)|sDJ(KI$V9r7p;(?`fS@i_L~R6EL6ImZljc{a74?CqW^?Z$&` zW6CzCh=03B#3xPctZX|Y1K#kXZfe1L$Ht}BH?L!JnSPdiyqc&}`>6=M0uKI*)^?18 z0~~gzpp;I{ZfniK1T+9~`AmgCxsm|#V+stYG(tLW)LE-wwERZhj4KJiU!!AV>R@8w zwi8J4%*l6llV=z5#@Vm501;^UkXP)f*mBs^Pk#Z&YykQ<_MZ;?8mQb^I#nQKH`xwt zvvj=f37H}^oxF6bDS(xS?$*4l)8CF?Gc>3nx!~)pw9byFcv*Ah5$Vqrg)SBp?&v{s+&EvBifiXYLi#jf8*U@ZtNf1g+QKj zcT8#EE0HbZoN-bLhY|x`--e5gj{+WaSx$p;&+-r(suO0+N=IWr1+b$mJDsA1=I2=< zX|yNN7Jgg!LT=OwLIhNC0S7+8TM%Z>Oef@K7xwuT=u7a!QnxOn-K5ujuQVNS) zQEJz)CpIdhkr?~+8L{5zvqjoU^zw65uxVuOq!f&O-wF-x9l3(i#o}tJEZd_ClChc8 zkPx!QH-nBq})pOBOsMZ$3jxq3^8{pcXL zJ|_p0STj_d+aomqxtKlGD*1&dKTF40z9X* z=2kjB1X+?0H4>g*Ts+BF(GWd2Z3t$1A;uOnZnJ6_nwp|bzQHfR7D*LnS0UKY;j!w% z?E4=6o}yu;QYBZcN;$I}TOEwb6chViX2dkcp{8zQX^9Su0UD_gPykgCt3LxhPC$F7 zZA||Z^xfwz77CVn7KyrtQ)c5u>kDYjBN0O%uMgT!O*GYiuy75h>VRMIfHbdM7o}&8 z@-g4!^?C*a=ILjYCqHZWJBGRQ?@Djje!vm-o*qQPI;wuhq7kuYQ~8|Z^$#6B=Z((u zv0~weh4K)S+Qk3n4>2TG5~?)Z;cdgCd``82I5WKpW%Hx*eT*!FuTlH3_5zKmTY@=D zgOsVJ?jouUw9-m^l5Sog1Nc6D|2sVNsuBrPj*ofaj0|^T^_~A&2w`o49D4RWzhJ#L%j;qn7 zSJF&7#(*2e3{>I|q;b4^kM%loN16r}q7cGf-x|+~mOZkm{JSm<0j{ej*3KFD!Ck0v zO)_g*W?TklWMnksyN`PB-e$fjjYfU+49GUVeqx_S6;vx zI1#!lD?4ituYkVpFFpQP!)jIeuNPn@e^=vz%@S=qCLUYo=V!{T{q?WSoka-a!4H!W za)giOA`a0o7sGcKqMIj_{10k%sY`CoQstoM?cz~U_T@MEX1_yu7ksIEZrwd;fy!d| zA14TtWMQVN;z6Zy;#$i&;E<;L2PRBBZvqyxc&O*?Cf}JN`>s4MxCOyYj74_%s!SgF;jw~2!+A~L7KE`~v`91fiT$UqE+QhDk!iDoANuy{url(5xG>1gaTPWN z%f$q;_jt@$Gq;Fm`YQNIN66&CHPo9uuTN_6ZmzD5waW==aHYXF(_WecW!F=7jr-m2 z!g2JO*+u*Ue^J2Hs)gM8tB?iI3?Eq9YK-oitRLvMQvoD@(giu}0*m(A`06=O0JZTa zxyNMaB4K2wYVgTlH81x&WI0yvxh;ZbPn&^F)ohU1N&xkjBMB*K&%Qq`t<$bfShkze z!S|XEd(+D`#xKxp}xIJ0G*UqW@RXl4b-pn6T~O3fLfpqA}9O>^))hQPH+M)PW{ zjU{{&gX@H`>)3skKU3qbWKXa>dZkFyNA7IR!6ZwcJkHMuvr53@*TQgRm$A;i=8f!* zBe_+!7+YEFYsuM}EgU3n{pP+z)SQD;?Ik4nmS(M%0QU2c!dI0=RKta72KT;=P>lFi`fhmr;Gg;R3>B+kze`oG-PNkhQe}M zFyAWE1x;}@W9tr&17j|Qj4$mh;P}I958qD-bvA*;CVLQ4bKsGbsN3CY6KvZ`BO${? zN&@^P1}wmWrG`m~i;HuS;P_$ziJVJQV-xy(Wrn!yvCUy9C&S9KqM2)2nSYmfratl5 z>lkTfu^13R@q`ydNa4lf$M5`PBPim!7Orl~;Q(T&<7O$XgoHg^LXQ&89mv@IFaW*^ zK=;@S$35{6R`Ihq86Z>L45c;a*jqjLzDuX%=@qzp5}*He@b_LO3-V`|@PeP_K5=Hx zi9!lxbP+2K*ix7nuZZEP4$d2eT?W1LIZ8FzA(oZOAw_M|_HVNZiG(a%-A1h|>PW|a zNeM4jzFIVMkOq*QL1RUSe|=|17rpmX_Knx_Kzq>)DWMg zmg}80^Cmh{Nzu+nI~_Jf)2k(0=<;E!0~Hk=w~POeV^`YO!RY8*n^>&tUFK!%niNeO zmCQRoau~(>b0((N*e^9M`IN;~<6w{T&%rjX7ti!GSv&1kJX|WOo8P}#lAWuJ8MtXz zp%Qn0NIm5E(~*g&HFDHHoGUTzwkpo?=g(|Ff^R?G-f|Hl@{PXKp6g z>CGRsMnUuHLc9-&Zy5fnqO+-(+`$VJwW)}s02KWtJ*bHiBC;Gs-|QnhKR}cNy5T2H(H!;caOG^ zQW|htAGI>%cJGm@0G!)9d^F4pm%R6QfW(w)qbxO^MsjFQC2jAD^&u|S0G7-?Wd1}E)(j* zcl)t5QwzTOxgbewg_|G8-yZ!$-^hQN*Ba*Xs?a&wWM}-+X;56><%@zKlznS-vf;L# zYD=iZogWRlH-r`;(=>#l>9O~X-gdQpBcI#wDG!mw9jBug zEjES3jHLH-K()ZSy!zjwh3IK1(u5E7^y8f$J*|J26Hz)YaT^IO<)z-x0-NbJ8VM!q z?`}c-3?WP-4x&^cMGpNJ)K(<^2jrciT!FbC8Z|Yl%El%uuWt9;d%!XV{H*&w$9&pt ziEU8B1IYvR(R|$Grixai^IDOPP(F(8CayUHT=tpob*6qgUHS;1yyl6;Y@YCyZ7LaO z0}(h|IdIA8h_@*~DO)yMdDcd-(;&)?LV*TGk%Zpy^K0xgnKXnMmkecO<<{DpV(n6@ zu5gc`MMFW#AZ`qjyeHw8Z{BGxr035^Y)s8Tnfyx!^kvUj+`Th)d6dq~>JF%eaHP}k z)b@^{wgtNy{HlA`L|``U%}B~2Nu?sj0gfN! z@Ki)n4$3oR?Od~hxh(B69_S3hvgr>+W=#S%z002h!73j!tV*OCua8~(Z)&hC-vhr2 zO1;@9dvLyiS>NY*yXN_hA!TCa(|rL!{D{-(%;dEV$ZVEX0+}b0d>IHY>#>T4a2NVb|00Q`ljB_ zU)7%0-6?U41ObMW&uEpIXKmB(g7jsw35v(pfgrp4ivW;FfdFCm9*;28+cUK$EG^Eusz&2aL(8;I+aR-lR7~v zTz!9SdjTN}Od7FBN2WfS_iZUo`!9=;x+Y^uPNCeR>WmON!WxmIJgg42Z}x#V{@wS)2nJ3+2Vfs zg=50Z4-#ScBLV;kW?Q^nE-N-McUvrX32ShVudm>OVxWyZ0E$PuOdSRvnS&Q>(0*)T z>uvoSSkE#j&zC>` z-Rvf^jy47Ld}j{0IDNzNPSBco$ZXj0uNq{2pwRV~f{h(d*T4eEc7-Oz*vk6l^Jon$ zG6=J6WyB(pggCzZR-1jKD`FJmVo^MWo0;*jZJSb2;D<&-9JQvuelxvRGQAo8!xvap zsl5M!Ta6F^+76p?Zn~!dNfPn8`eWw|l{t{Ym_mOKs>S$g8)Z$P5mYj!t%e)35)((GH7!*6oktVMCs@99~!4}eR z!vF50;SjyYM@;hD%7(EEAsyUnJ}v1&o6cicKfRb&g-zeL5{Sf0V_R)^p|#e!-rAZBwk5L!>(}&s3m>=|ix$w>FOJ`?;Q{ji z;9USYP*G64z1JU9gA$-X(M$Awg)EYC4ped5u%va%(!FIWOLzsU0H1GNBc+NPnbX$D zcAVdtDBD6AI@$USw^z+{M|=y_lg#Az8|H*UB~P2UW>9;z82k^m=U2>%p4 ztCkzHtD|^5#M!VRxHDLv|KwCOh3ki8-ZuCOwWxH3@O+gm4o4qDYOm3W%!&mK0ii_s z>D!ZNr>gJos6o2+KJMLe81a0WauO0|MQ{)&dqLTV1K12^>=Wo zIXNHd`?~?&E^0eI#wtv}fxHXQDwJ2H1d%VX;z$ z17BL?B{eK`&%KJ>%j|sp@Jlu$VbJ*SK>xb<1y z=x8I*xS%Iy^-*Er2H+^~d}8uUgts_>qY9E}MkB|S1cV%_B+Ve^oijfP$G0Y8StN&D zL#YS1C`L|;Mf$bJO-pE)8!j2zZ%VskC|9Kilyow;_|k=iM920r-#i^AgKUPA7j>S3 zt+HKzfoqLTQa1>pE|hYDS65?QZMGIK6*j|I%{d$$m9zPiORKN*b%v{7AG;SjSZr6qZ`(IX;kvsR4iFHO5>*bIub9wo6 zF%7opW2aM{uss2e-_02W5O?-qpg~KYedpSvFjC%*0l7B2`+f1woHIumQB4d6PikkW zm=xv&RGUQl)xBkk#3nPBHDLupA^^dG&W?(-(RGTOJxadhY1R~J@ThK06%`6yeEgUa(=!^wy<1VhuUsd3 zmq_zJ#vS;=bykh_-EW1VZH{;r&GDU;f42(hJny|YJ0}2okFV~*R@0F+#@(=RYXK1S ztrLtrZRV2x^%q!2JNg+0ZgD7?sHJij%V-jQ^_>^3sfv5kz&mZz^+~}FXr(GI?!m_( znm)5?Vy%a+H<`OVY(fvlI=gE=2NlrAm%6HTa|+mloFldH^to^ygcV(Md4C0&DK!6$()rkpFIUjWe@w}UXmkP{hn z7!KXXD<6(VQ)Bv`{SUDQprX9BS^zBdAW6UZS>|T%059n6Wf$aZc;FWIlPom3UmYI+#0Q4cvIMUMUK>sMj$WGV{jeX-f`N(COU9=lUgC@F)3;F z+9m+miXa6Py9Og6mHWCb1GxImg8rZmt`X?-M5iup_Y}mx>Cwy6ylJTTw?CqpA$@xE zvPQeOpV>zkY zTV7FX-#gCr4X&--SW2e4CfI-HMH~g&&!(^(UiymlG7l5XSFq5J=?X~hH`#g52@17k z2Qs3L5zG?+vX}#)RdGqe&MeHZ{}Tl7)v3Q81MPSQ z;#FWujO`N{IV@Nc3FdZQ|I-kogA}M0!dQU`2*}YB{5a9$Eb9yahujU z7ImD{`Yv#)CZVaiaeu#DrmVF$R{%X1z;(YdOmbK zIS*`{+10FS_8JVjpBBtl1#E0wEx~=ly-VSwjn<^e#yYgckOJ}UIIi2oGl#nd;*z^)c``YOFMXTz>=kv;bE zT#b##0&GClswK(>&bi-Lz*0q}geo$?cl|A4c`1xL!YK+VgfCV#iX?LeP;Y^L2vtbc zU;lR_$4GbGOe+I>fHUO&=j5BlL!#D<6S=?*^9BMo8BXc-*a`p=Mzlr zoJrtT{RQsIB%D{Xah%{adAw&|q`N>G zA;uE1yIOjV_)oboh)=k^yMH6qILvNBja*Dch(x2f_~($JliN;bjb(I7jxVzL{Yvcx zOx)wMS$2od?6^G9V^3W$hzUR;Mv6KPC{Aw;RIyX&bb>$M}}W|JcDKufb#WW zOlNxD9|VAQW0CrYsKp`+B#&p{Z?xt&MEZ6XP5<3EEY@hiNs$c+QVkEYDww3U zk|72JvS^j)L<%xZW|$2L+WxXZSP{8(S5gj{a{dxbPL`EaK)%S@+qW$a$TX4YJjI5E zJPBW@N|@2=cJBjMDw`j6RZ%unE9>PCe;)`$2A%yrTktlEGNL)ES@9PoNCU9k`t zAONU0k73zZG!^(ms8l&+$Ot{)-Y=;#a29aZGsH3|L(xskXaEc>Hepr{gtqBQ^=Z41 zwW{SW9PhY9xFica&@exDA`^TuBOJ31Sac%lbL!E{{*CE*N!s9aHYRX2jH=~yire{J zIHGD#0%6!a(P|a^VF39dc?sTAFzVA8c{7u|JcH^-a)vWY<;5l)9dRTminq`y3WfNL z(u045<}>mI1{jFTr|a4l|BUm0pA58l1nlhWUCW(3#zp~A@~_7g_E4$5%l6|F=Ga8# zNvsC-9|IvMo=0mj;3VzdS0;9pkoNuVG=YonSpkDIpj#dZzXrJ~duKA_Xta8w2q|Ln zC7=ay;EYzkdl#UrrA=ZuyE;Us!Zmd2r>Tki&(?pRX>% zl22)?%p<1gTAo`}vsd%a;hwA1eV#ki*~&KaYZK;(*p=%ZtCOS9bn%;1vk2u$m)eb# zz1SkeZkwVuTA)UE*}(1X(Q&dZXKX3)mq}LmFsGv*vU~FDFRgFaye~#~*!-q?}OQZ@6{6<;|+p_x5{RDercDWTL@XMI;b` zPJBsc<~bgLrUs`?@}UcA`0gUm_50zzKwR4Uu(bCUUDiE@NdS^90~-}7BUAv?#Q8&+ zNEv#vq8}CYq{<%68)0Siw3u2FnbyJ-T zodNk!?ThQ!Mg$Y7V{ZGLgRu#0rzh;JuWrGXGr~@{+Ut=tfA^y?l5j^Ds&piKp)-5f zN`h#IOlR+}Ra_umfBbJ~{u{K8dMl^%_03brLDMeNzl-%$U=08Ec=)0CAnD!lid=oA zVg`YQo5;yb@!K+z!-*4yv@!s9T9T2y-kzG&;tHf?tj$6QQsN$)9brZ|>J;oXtZFO|1Mu-jQ z5-sRb6Zw6Y>dl&#MzA`%xWk^&=R3cx9loJM9QGN^oy*$0qRh3lIu^*?r67v_Bn>TI*RQuy3pOJdX~zfhQ$3xgl^1Un`!0m5>_OVq>X>pzTW* zkI*HpoAb?H5m(dh0g)Yhpf!!H_R@!4dXNVo+t|+Klv4q7wbJwad97=aY}JIW*A8_Q zyxC5ul^x~idiFrEja{fdWA81n6ofBO!v`WCWl;Irw|ktfqFgVgDC~CfrPD3K`g#vH zUaj$-bYN+D99Xxt`|WmCq2x^#L$XDOr>rf%{n)e7*%OH$ zRWvU3fCGPU`<31b5cSjyfUDb2#Ura1B`dHLHc@Hq-HS(JVzz#L$T=$lIcb-p3vZn# zI|^(+(B6i5bOd)sNYM_C0X?%E{#3?k+3kid3IEp%fJUO5=HZh&(pAbQ7v*7E5qIDF zxVRujMl799&&j~9A`bW(WRHvIB&SxQ^peCn)%zg*2^de?%(BWAibfrd zwL@B)hHWq)ENESlmik=f&_et-AVF(c&uUpe%`dCr&DkPz)Bsv^-KXr~y$jwYp4G9` z)TN=mzJq;{kG0n)wDEjA9(`j)B#0M$Z3~EvWiWY1{A@tK_*KXTAtpvYS{jZ>i9UT9 z<4IWSQDHcg+eF8B=0w!!+y2|S3j4UQOuehvA|c|oU8!# z?PyI@V=SMf+BpvUhAo8luZ@jnu>bl!@Q`+O#lRn?6_8Z{0>-NA4;eJ~rTuX8zqlrRNvpKMF?V&;05}Pj-vQ}ivN^Vp@9tW>Alagq#r?(~ zO~jDG>C~b0Tp~hMTCW#)@yV0+pJMMm=qs%tKtttj{ooSSj&Y3|b0MP)K5DT>sX?KV zh9_l4@cmAk9wU$!{Hl+;v+)YJ85C-JsgzK$76f6aKwWBd&m%#~FiEAwFt})2&?O~# zF8P<~+*J)RTDi7%EEwkl%jlLR)481IS)vj-b3>o97IZjgupuDhzE&u>e5=j;V+#fs z3eoiu#rj(Gy7+~7|5K)w*cDSwy?k6-54L4DwsahG(As9LJMFGu?Lz%X{71*iAG9{5 zY(pomckSY~$H)k-0NMn8g)e-_O1C6Jk`_}j9s7psNAI>j63x4YCF@@p=JdbDFOZ zT!(G7xyNYES8v&OIj^MpIeRUBBZxMkzGLuoN$O4R;n^x#+SP1N$G-T~Qe8)eaY~O2 z*pbeJk%gAOHh!CR6YZ1`u-7eH{K*9mbp0F{*_miPswu|+JUam7$8UD5zY@G%y}PI= z1CHVW#z*am1 z>WjVm5_&QdggAh0l0j;5^_y#$Qn?d_iP30+^Z?I*v3#*!+PBvClKJDJSYX!y1%BRVyl znm@}7-O@o|HptBajTOH9K;ep_AagQ=pRGCw=%IA=C(oKCF)3elwV*0r19a=2>p8!8 zTqQ7f-3z^5C%eV-s+c=R#ew8D zJ9+J`Ujd!PPwO3WMQTVapcw7=;^NP`WkcERjlVRrBxM#|Liw)(@drY3^hThv}2D^oZ7St{wEc`70FoP5;zT$#;<*V}VZ9d1t_@xC#33 zmQ1Wj1FMmwplRRpqX)qV6Ag1xz%pYlOTIPCR6BEUuHL@Jhv7q4p5MJ+NOlOW z?s-SsHukv`sJ#ATjj#S+)Y;+S`fn(<{LuP*yjkF&+t%%{(IiaJEy_*T_^-pRI0HzY zx3`sihcsIa(iX=8i%qfCq2$Oxy#`k?r<_u&p-_@}LziFyux6SyHGkTE@?cKR%HX`h z#P{W-bzs+uqlsVZjMgX(T0V?=C)~>I7?THd4Ulj&IBa@#XZ1=Z562qtZaS{w-Ftr~ z^n8rH4!%c2c_5Mp%Lec{K2TGJzB=}9uOBvm8Fyo(cY2%Q^?NqPHX#WcNU~(aMw|US zfi1W7C$*$R@)hp4AE_E!$DfdI;rq?FddfM_?Hy_h>>dt(Z^x`RI|`n_I9drfC29LA zt4f@8rGDHN+kJU(LUN%`f9i7||poBg*qxo0xxmV>=t# z@jkn%N9r*&?TH&{_4OyJcM}8vxp^p_62E5%7TEB2a^YtHlu?R5h;Va2Ye&uagslrAW8c9S6uHkK6+sw8) zqUG!JEb=^SV6-LikL+e6J|ZzA*3VloJrUv4eJKOj29W?(hL%O92Rh>(rJ3@9ZmNVueTe@)rX3tbNaiM3M>nlq5IG`GCJfo1v_&+PzuC z*)X#$9?tixdzgo+`9f1|;)bHwirMbMbBjJ-6yuF5A!+PS9GvaL6?-ldrybERNb3F# zmp?i;f+=?LyV7>Yu_^-aP9!3@2rWl%ChfbAePPwTb3~e;sW94yU)dN(ncfJ3%k=h= z%leUf{V?t{IHiV&fKhzl+Y04M!^LuQSLcWu&4jk-R>un3`8=l8# zYWCf<{iPo~yJ+2}oV!~jRL$A(cE@CzIk%K_!RRCDKA6E-5&*?gtkAy&QWjSVWs^E) zb^!_5)|nV`R!)Xr-ZPKye4crwHxD2K%N&CI7U%)>0~CB6sG$ZRVQf>RlIu!V%FXi3 zy)vHBizLd7KqK1OxtTt;C=m8hCo=#~5cWgyS_{X$3{jMBbynRX)SgpVQP`bp=Sn5s z>J-=ywH~G^g5n0fEGSM~P?%jWBs|mI+?@mb6-2x)xdZazh>1O&7 zHxY@$x3rcxZlDoTX{F-UzC^gZl__Izmfs-57+Z4kInv<M0yD*AXPw0LI;uF zdkX}xB3%Lj=}Lzbq=eoS=|ZRpy+}<$CjsgI!MS&Szgc%Lot2g2nw9hJ{kG?M_TF#n zHCs3vlouvhQCL7onxhuyyP&?GvOS+)p7jETNcf@pp2}{P%sg){D+f6BHCz=f=`1kc z(o=JcoD0C;$z|&?U&s&DqX5yS!J!+ZnxQqCRWs9D6S;I*_l}lJZ%Y-=Ef3p`uit&8 za*A!V!Iift^Xu7pHMhX)CZ?G2*s~IJQu`U$KM*HE<>^{HI%s!FKR%W>2bk|F-2W<& zI-X1eZNAgG3{I<|EFj`Py5?9Ij^@nEKY~3R;KfhioI&2Nfc=;+GFpxJu<}7cK`-t{ zPY;~nV7{PIUC4)ai|kZflPF@_A;`#Vuq-f6P9ak!ZHxUcI}#=X>*)f;o2<6%Ihc=h zqhsn@ROauW6K@oHRhQ&nBTR0Q(~F-wgEyaqBM1LvWSEiuFeP?|a){r) zU+R(}1Z$W)40loIeOu)6jg3{PQaagT#9WF&mQ=aFXY(=zQ?qrNg@#sQPI=!wxA|Sw zE4f#|JkdBl=tpvDHbS=*FLSRsxRF9{@U*!pE z0<%q>*1+{c7uZ<4->dU=mwxr^znBvPr+Ccv_p`OheL-|6r&b+`>lr16IahKmbmiGF z(Wd`+xWas^RO^0HK=L$2;it>XFO$#fE5M^y&4DxGTXs%QG?>go>!Pq1?|h8kV6!=I zpAP!4z^eRKB3^5ns16+Hv(Z?^A-(@Gc4{WN!UB*&pEi+hi=5eFZuFh{q#YAX4NN}T z$rB|_j}&Wg4*1pvqllwb!zQ_VLw~-4Y^c4etv%26lS?>$wUA)Hl#ufKGBKVd13l5s{6ti2tT>U?o@+bz(b0Z3oRWUq?gY=Ho%eT#zH8<6_}Tr;bq(;0*u6>l zr8SrSh2>nWewQGgDT4^ljMMQnkwV!ro&9kf!GZkklYt|-^v?HJ$}t`;w(-N1{s4D& zdc#U1!`%-YC4SMEiSoXZHM7yVQ0EN)+7~Tx7uWJRH>3;1cn{77KLbeYcT0EvM}{;{ zy7zsGDRijipTN}ynqg9C@l9&a`zpt~Td}ar{_s5B}n|%RM|R@#uN{YvV@WxC(#ay;sMnv(Pz6(tI|`Gr|NV z0!S?Oy6-o-jVut`WhSMhzH(Wfuz%AG%r1unb!d%T-b!}P$n-8}b9~lMZWy0uQV_G) zX;P*ObmIX?(RX|t-^XkKJW|j?V|ALna=`h`TCa7dAAXAGPr0L@-jcP>^3Ir1Sw@ty zNaJ?MpAyrdfdYf`@r>{X+Y8%o0q0lxUzh~XG*42SrbmuPSk;d=<7UzS0WM`8vYom; zIXCq5t(=UcCV+9zl!{mB+4ph`jCXe$X@B2omXa$^cmoX`GU8yz{kWZ37QOmsOYq|~-bJYHWz3cjhQ(5W>ws{wC z(~hA>^=Y%`J!FWy&KaAhfSQ7hdecn9$M5TfcB$ht(Ay^d*MeX9({buB2g~c63q^`cIy@X{q?7l0OUvA02d^vdQ+anH^ zj`tfYtE^vq)%&{OZYQ5?{KfT!>j^C^O)207-%3xkL)pyv<F@@NNn%oiJnF|c#%&7bF=6PJ(KWyBIEXa%A|EBDi@a&tsKaj$ci6%VU|HV(t(&qD#L(6VLF0*HSLR!;i`bXz}m2= z`i;|7@tD#YY{HDHoE`6nRvr#F8RC1^&Cvoe9Jkc<>sr?U%;JBk?R;(CMz3{NnbX`i zPo3)xYxVtg^3HMTweitCYWksAdqs2!!U#0TJn|jSpQ0${$`g#t=qp{Vihu znqJ?djd8c))0nEMJXK%dBWG|<{TR;*%{Wh^?!?vjT>RV~)65i;?@sKWme&`n*yoO0 zU2u?h)pui0fWjAfcZNwzZSV4#(%b1t-`AHzTO=eI-uGk#9A}q4MB6mu-3%@HnC@jW zm!;UnMMeB{)$N#0#D^4WO=UufoAEf#IMNstShG2P<3ehBDI2p`cHr9hmki6IVg{qe zJ@%O6*gf_9Okkb#{I@`X;rU_3&>PKh0E!f&^Un^0|29F2TWL*At&j@ah=qULE!K2e z^6mOxUn2SyuERM7eZD8Lf{nB<`h;A~;mc)cA}=ri`^ivmxD@O?RB5qRVinirjj9Dk zg{r$8dRWrl2{MvuLHe_loCl@Ne_F^?vX;c9cTUTP=iTzGeIWdu%aU0qeWe5lzy4Ri zmQBX!KRC-kr1fQU8sk4bHG%{KVJ$Pu!|&ff%c^nDg(~haqd5o1<%~w^!B_1=!&O;7 z2!3fzysKc(MEl*$-emdRkbKkE*4R#S@j!;i&c7z7nE!ISQ2QE{z}Nri%&yr8q_1s-nsG)WsL#O+1hywq-=}wp^sNvPNhr= z-Dl?ZgFe6!@_@jNgR7GulE?F`eHQ3hCC9fanWcRxLv`1mO3D84;9I?K9BKa+cE&Z! z)#`+24SP1mefwTo+5EU+=O>w2`1>u+@8ZJ6Z^GZiNZkYOu+1h)UEGLDJE7CEK~)T$ zR4;G4eSC&MKUq&J=?@@$b-&SxBM9Dc!;a*F8b5vy2Vw>HK@MxHY3uQ8x9FEWT}iuNen(9D zc)kHyZ)wha;}MFM2bM1RVFuBpkg9X6)0ll>{i3R8E>9z4XRW))|L#Q*wbD4?>JyK# zIl!kA1z1~Msx6g$ugQ{NV|}){}KbNcmom5FR$UJ%c?<4F~ zD!gv}70yK?yZ7_dt;=k)KigY<{DFf{Zf?I7nyR{dG`=ZJ0|+)_1qKfUpbdbQiKdzpRclTw)>@~0+gX`fcO6y~|S z$m108Z$MO+lZ)&9f}Ut;Tx^%K0W{=OhN3@I9TC;_!Zn!<(7l8NHBp{&Ik{;ixRBBd zM+#{;^YCC!S4u7!JS7E_l%t{X+t)+)29IABWvqh6n^^u}dK{zrP!)bJs*2x+eS9c# zl*|DF?xq_%NS|Dm*|YX(CWUVHJ+qY24+A=gXu+i;tWv}qM(i&lZp>la=269FFCF|%j%xCX9Jw>E?Kw#2dZB|rA)hfq>{XThNS+$(P4pSwMc^Ql+<3(rYsGOMD1Y-8>wkX zcTjdD@}o@-$x=i^R^JPJb~RSCBr0?uIc;w#u#$XO?t4Vpp`EHeAiW)A)kiVlIkIT& zV{9Cig0;_6?pkl<=zs;3jrQFXRs*+lZwV{KXv~?st+Ua=_=$dGv3k>>bk@Z0)>sW-$ZsbRoD1N-QXpqcFP;;cnbu|~Q8;vXF zfs-maT5d#+y;0NhAx$&;NyRV<{t`0ypwYo+ZvAH@2LeIyXvA4=89qwoTM$n9lZK6b;^Ucr-v9W+QYi7q={isH-N&lgDaH{};tzxuZ=3)O zLB!&M4Lf~Z?41I2GIsj(&w$uyXfCJDFlo#y_(x}<7S!PNav8wsgt`salp#9L(GUUe zgQb?-TN^Lxy(|FpJbkpvPH5zCB0N8U`WsKCnf7WiieoFa5m;&0`d~d~TyNF%(+nBm zLjCUO#jke2F+N=rG&F4b#n~yvSx07>V zbU+FM`UBo23Mt7AFm_D0sg5R3G*Ac1AltPe!v~M|Fl?%>lVydEAsJQAC`+o!u$A+d zOq_B!5$v$idHe2lu;{@N3|(SM_;H3c8RiJ?g=oxVeTl7!rU{ve3c2>XiK4STn>Fv- zTX-iNf8TiH$4-6F0_`F1=|>WapJ-_AUr~xm$!IO9f7yNmK`KsA^9H*#k6@Z%QGA91 zrjw|}&-H+^8%%EkR{Ep_ zI=$CLh-VbVmo(54usqq$FPc!3j*WN%DX()riYN6It*XqmIaI|j>MpQZAHafoPw8l6 zi>pP~>u!5@tzVZsh~Y(4kc{@9nO;~$*$1Et1MNi8xe71PNEn^v16IR7V@gE|xX`By z-9-|GS%hQ(j~)vCPz8*Jq1Wbrjgb`+ML|>ZS$LqX{_3OH%Az80#5LGwlfKD%Uv&f& zg-hq`AJVRxVLBDZ4XLPb+&#pK9*_sE@4D!LqxKL-4t#IZ&64>S1+<V*cvPi`~<<35vK?i&3-V1p-L~Sm@@KH#AkYR!PB(ieXY?l0X zrlWfAx)wCplrUjTz&mI_;0sJq3m^1P(L^(xRQtyQzy}GqP58oSCjmeIr}&j$4?+Um zB75!dguL$S);x2VYUt`#!b-dY43?$?!b|&>gQHL`&IAhQy^H}ne4--N` zNlnpGVJ-BXVb@d-VhBrT2(hW@6_fT%qMIss6{V7z*YEpU%j(s0VS%pTf~)E!I)v3r z(%aJS%mqkcUX}_*w++Wf;OVkAOj+VI8L}G#YUS1RJNsg8YE8z-pe530w}L5Az(z!_ z^fDdieHnvx->6#~F|9ah8XDU0f4c^;_rmhr>HnB#>OE`c4s^~*`vp0l3A)=(^&TH9 zEDTm6TV!Z%?0a*5m5JBv58r#Fl`h^B0Y(;v+pr zN2sL>m=hhpyX$H6{bw@AIqF7IrmV1VZiJ=b>3iaSr)b<#dEhGs%9BOA$uYZh;EPd% z!a=BoxaxhQzC_Qsawr zY!_?bDd8W?$q-c2PeiB7T6o!iU8H;-w3^7jqUPdiLAnx#rmU1x>Z*$}n9WDiO9dMu zz~!Xs^~1NAx|&?{ppA@b6q!k)kNX4wYT2P2^AGRTbYC<@(Rz^CZV+U2_PYA0qdmba(C& zasNYa+>DZ~Qe?OxGVodah3p=LjPF`T5f(D12+jMkxLUzx+Vy8RyRCVqE@D|lTz07E z>nL($B7b#=qf$w?>EK)}u*40nJU#iF^%`Smr7*eYZABWykUN9Jk7)l+TT}HWTv1js zAYsXD)T%=k3$d%&8?A5ItlF2D(u~gLD>f=p+}+z=MZmu+D``7WB^pQ%XI#TQjAK*1*Ar!tW2|{)ANpM ziAa;PWtk+8zaIHOL5Vjs zyOY<%P=E(gU2=`Q5K$ad%|xEh1sB+WV~oQx(tpMdT>MM4JgGa}#|Th+-c*y09tRew z{;OnK+5p4;7g>1MhiC)1bGjV+A0-7J`y337Zu9KUMYUkx7jHzxpX15%kHn@O@Qiw| zeDm4T4hX(Y94XoqGhT2w!r)CNgIu`jq&98|Z)AM$WZmN2aF7`~U5YO(VJGg^I418k zhm)w>byan<5=xSjy%d$;L)b~0sn37?tHdNPwRr{j2RTRoCv^JVk!a!LtlS;j(MBgY zc(4}eVrZdI@&C89cyldxa^MiEz2Y<7+;H77Pd z_{lc=n_X6X{s;fsg}+)$Zq$L-$RbeMA}_)6fQ&HUyw@D{P6tV2H4uHk)Ne?* z%;WtgR_7`Y)k)uSm<6~ijYC-=(8`JH%Ydxr_@f;53`YTnfrB!335Tdpbs%~LQaG3B zb_t~LmQK!qWW9Li0IQ}$nso7aD>tY$`;{7T6KkoiTmkw#}nUUA)=4z*qVtll;KtZ~} z-9*yvG*$FKPR@J)Dhlb#%aG%0_l|sfO8=cO*CvwabUi32F^MkI(=dI$Dck^g(-bH!Od!UiKA4_W> zwnU4H9CPxcAybZJ7=CgUxxMc@Ia6#))dt(y4 zY<(PCe?sRJl>3_xLsMyJm_+_ngp_ngb(bYF;urpu_}g_ulxJA7@>({}n=133{{)bV zJawJ{=rg$YUcGhR0I67v0g~@L_0mBi@UWDnb4zGq zu0|=bWpg(zPjgY7kyo#+Qp%_uh|HfES;Km9lyzL!y?mjxNeEnOYyX>f$YYt?; zFZZ&YnHg7ma!bpW4OR>|_mOm-X&CP*;HVog0zu`wn~m<7z_Dr04n?CNzcS;G#QOD| zt?o2}Q?Rhkp$Vi(>*8%;<_-xZ8_t`bRG(vmN>Rh&iCAbBilPT2OvNGI24*E`U!w!M z-B7vl-@~7ql?J0=S>giF>be09*zt(z_KnnJl$W$IP>Ra$8?6u<#2MGlC>q@*P|-07 z^p(*;w~2nr|92{01>=V{*x~LqIMq&U|gwZ*TJz zy>b|&2vN4y2}V!y3q;51(G>EkA)pa&dhDu)8u*xLXhKf|Ma^%6&9FZUsCq9rdcI;k z3w*zIN0lY)>;m6p*Pk?vrc9Rc7i2W(Bh93o%S;n%_mld+yLqbhPPxsLyJdV1P-@}OtduHvTc zchT3?K$FobzeGwD)vEYWhf`qZqGv-E*&>s@t}WxwTmogqF7;+??qYfiUQ&iHU>?-> zn(vq7b~)f=ig+^zOnQfNTedLobfn4#CW@*&_n;|08Fm#(=Dsoo!aHR|XS@%nAwZ_x zr}?$ip0~V;^mFy?pCtB$@%pdr58tT!TWea)&Y3XV2G3V&i{ks15*Q{;3G+ISwFgwm zKGZayq^1}vHjuFD^OH1gl(jt8-z-KGjY`cR7`Vs_}51B3n_O6VdvpsMz=;m#uDDpUIgK6hWVo!w{xvVzVv zfrI=XM2Fczn{6?z`*3+n>fFb|ynTZ&rttTM<~n%0(uDjgY|HQAWT55A*3zme!4u36 z3NcZIEIcGQ=$aajmA*G`@>*S7qTP|=5yTZpyl}huJI|L z>=aC6Nt*VP9( zHy$_ijZGdPEzYA^MyuK$H0m^WWk`{d zAdY3GtmP%k{yot$b0lbj66DkB&(rRwG;NjtRroZ0ItyH`x?w#VJy+;bTZ3U;#W)7! z+)D8}y3lw27M4r9;1YU)H`D|KA})_IouFajK79RuOc?9qVwGDb)8GSUY|UVrvI8u; z#+UBDGE)un)aI<;E+#h;A2H`;^m6+8oG>PP3 zsLE++n8j?qpj^89{d+#pBp1d3rQ^Z*KY87uPqTHW;lYAq+I zM<|`l$H-RnEMG`zMl!2NmPqU_A3UQTMk?lZw2lN=W2+}KjIXy^`%oK9{XzVOhFr`^ zKE-)3mEFpkN@Gf%|9p!jskXe%T*_@=Y@5TKCq*_x>P!B>xzVDu==k9jD|mU9>*-s@39)CkL#e>d}HM3y-8Je(k-%*vx^0)hqClEZX#Fz)dKps zPy&J4+1uyY3}Dp8iQ26?7I>G$Aj9;1ANXh_R6+=~>TP zbV0?{B_(Jz5Ybrib~qZM=6yhwt`M26fl{5cdEd&v0V=@PK!Dv&te`f%0UuboD{MMi zH^U-%>4od>Wia*Sbw@77*(!PQb6(Q|N}rl=o;qzR)`^`bKqk=@)m>988&}X7&{&{6 zC3;eL(BS+y=<<}%CM6p=`9ZTxr=+@S`1@wrO|>p-W>qn7Aq}pz{!T z2SlabQ=bb~O&?|9v#_S*zV&QO8+`d2V&rO$*E4&(}hyGxBNfOCh`t;?7f9pP7rjIM`IGYq(V@)akW-X(_;Ak_Y5;9n!a zVOz-pi)T%gwX|lb9aWiT65yVs=}37TadhVdO=EAYN;RD{w3LK=zAe@y0@th#GwV>4 zBFg+6Yw^wg6xsV#Cwr5tb(LYCU?T(jY=zZ{){9COsJW>I7wvim2bSdN{$Z^LYDXSD z4)?G+vhye8@Dul+@+J>R>O0mgkKoD`RH6?Gdq;1Y-7Un#25D+2RG+JG^02lga zgjnVXd@K_auY3V~^$ZuDWx4xRzg}$7f`-N|pNZ>DI+D&`KO==>kV*~Dv;z7M{=(*i zh-np|l&la*zYxD}Vy#8%c!!Zf-ItJ1eeRv7*B?_B7CX+p7Q~^ZMurAO=Q81N% zam-E05WrMvrtUf57o`Uurr`O8El-PxK(wlh&9=z2FegyC(LG)%xsnPYnP{a4N*OXU zizC&&2>Q`;+*HMQmSpd2o23qxc9Bzx%Z)l(d3mMFD?S%aVe5y}z0=-5^)=vQHzIwD zbJ}(X?M;fNbGJ*u6oWyvSjc=ic5S}I0g=5|mselWl4ewA zS%vj;|K9J(yXCtCp{j-mGgM+zwMTao&eepA zz9e`2vXqON#4;&SoURL_6mCra$wsk2JlqOx^<&+8$k~`PEYR|g&mO!ljd}ERl+DUI3p3g<(Gyic zxUO7IuFIYDbagHaSSoiMW+H~Uo8!`Mh5!J1b(_!c**4Bx7{mIhNAhnVzBdEy7{)s6A3(?-r7}x9+AfNs0aV-AkZi^T4_&P7Hr0vFl;=#ZaLYU--}3`6Af8iM*C02ODBO_S-t%q z6yeO72n#kXBJlNDmS0AgD8H5^URV#8O(pxw_3?gPjCK7e4v$35y7;^faax7eSf)AC zcKJM)FIebGbPg1yE${Lio!_Z0m)7xnkhL$Yu<;heJQ+K@@RuDMk5N^1j`6CqT|iYK z_e%Y>8fC!qyosQKWs?Y7t)I}{*MhCYqagsLyYnxurA=Bt)m{)+)OGDYc~Lpp5inF9 zu=Bd`8(lbR5Fpg_V)opPp)*Qj9w0oHT2fE#4SyT>3p;jO?6~q>GM-;M6N%)h6RJUR znojnl>7ZeyesULWWnfF+-kX8+2Rdz)^e!Hg3?X|+gDhk*GNpaOGBs~Z5qCOPQ*xaH zXBFQrv3>7=%|f>+y8E*9`Ei3mNLwDgl7nd+q?wOi$H6PXi8s|sBd;$0xpxJ^*Ld*U zjU2-2SsvAb9cN#=_7Odkf;ynvQdRN@m9f4zA1|4PNb%%R-aFjWur9^q(2A9Lc&j6# zR8&)!Sd`QnVkjMui)ut=Z}YxRUKx<+qcsK^x3b=IK&AN4__dmP%+k$M*vB6J{q5xt zA*K2m0J@}nEwF(3*gO$#j+C#E6F)K<{aL6OCTnt=xOV|*WFT0;M&<2!eQ11pkXqV& z>A=Zd*AvNe>_T%V^%Gk*pmSsSW~nT_M0q}fWNtH%GuNJqp?YzS>7;YVRwSY$cf$0sqk+q&`kK2p0X=^p|?&3mYP2Dr`vQb4X<=IIR zr2V)F<$`zG3mIENK`;AUuLwV z{xK5pfz5v*TzGlz&EW8tOMlyMDujt^2a{EdD$>VA=IcdJCWB$d;$r;a#^Q4;)B9-4 z3Ws7@qq}6Zu`x^g&yFaoZ7DB`p%a=xOl`M&tPp^U^dh!5+I>AEy<8-+aJWd4Zl1Ci zR023)3nmR{79^@~3XF%b)#;AzEwAvVDdPNMZ>83q0YzoYw=9m&8BD*^Zjm;#P_fJo z3*^f5a^|8&yi)DDfwo6En6iwj?JzO-kJZ(=;x+^J8A?VIwxmW?PkEozBrc@!>DU_c ze=h3`Y7yUPJ$YL9(|*{)iO+)ld5cTq295|th=6`YnN$TDZA?FibPuR403po!qqPcb z8z!c7pu=joGzxVfJ8#Ua^EqG`k3ZsnH z*+(_UXdrQu7f))j0Uxt4ImM~RO*WHDH|R-uVKD{`_HryO^eEfTe;DByna+eGif4T2 zaqQ2MlDy78w7}YZTm=;;F~P1^8EI@Wn2W$=8I+ROpHq=nExD`G5l^`METf0_eMB5Z z(uGUPlVl%|T=vSItBHA=Mh;+jZnJARuuXdVIqYC0c}6=psY{8MPm4C>%>W&oFgfa+ zXuXsuuj{wO;0Jnc58}m1o#(dXPCC#bNlJBBwUWmn{&l$$<)&Y;$w>gdc%}3&8f#)W*3%<0>)Wkl<2tFu>A%g!#y9EiWg~%1UA2>8 zTpU=-J?``X#+N+*Lm7-|tu6-l8dVkYh0#}zm3VzX#XD4&1C+}!nRi_1x?lDE>kn<%uMh}F^2Dud-^Vuzj4CgVDK>hVM46W{>KxaF$RXkCWR z9yX@5FUdk*FzvDkc<4ytI$)WWNhRQi{xhc9F4R8deXB{FpU-3f$lzmz1TaEQ*+yy$ z(UEd)>&NXxW=i0<=Lu!nQSk->0Yx>5t4(TZD80hgk;2C;ogSTi79}PaM;CN9w3Z~8WvP+1xX+62Ib zGptoy^)GcleHAvWQoux(9%UdkP^3A76!A`@x{@5KW6sv97P?293>!{w#fT@HP0W43 z?^0GW($7(6vxAp{f=ax`3>S2%hhsnETqHxar=Z^iu@w6 zitcn>pp9b22bNyF8{Ef$0mq2VbFaG|WgM%{H?OiF6Teosq#h)_x@;YZ${tc{EqF9j zqx52Qk(&q2uT45Ic4XDy=?~-a4odnAr17gf?Te50Amw{jT?F!Y`emNs^o1^=vbW1> zF5PkB9DKDO;>;=5mlvC!WGW7JsgN&>8bO0~2cw|U(0B~{Fy^`5!okqM-q23%-iL_; zdEDX!Mujx?iGXZCU)1_Sco9e#zl}41Me6GUot=Z+P61CEUlijVEVi;9(E^pLLNilV z>MHSv0pw_<{hTRVr#;`=T()aaQ1+(U3)|})dD5Mnbf3r$e3V&cnL=aGu6c^l$}DMex;`jqe#Fv#EnJ=DQh+Y0FWY-q9L5MTz;I_eN#)S1Xh4Z*V2` z#7cAU@0mPO$Y9gH&%mZ4({6;UWN_Tm1Xl!Ob5j}&9KXf&5%RIFIB!Q#xma$so@opb z<_rz++zE5n;*^_1ez2~;Oe4Wj`-t{8n*gif?1B=mB5{F$Atlk_F1g$Xo(}mUJX9wS zTjUmZiN@Nt|J4HQqs)%bMdbaQygxzQfB=ae=T6z#%rd$+7|#vSPoQ%i$n5T_riIC7 zeQF#8S_rk!E}+$@nvRq;xK~gTx|zz{zSu9EwL3t}1mOK&6=Ce%=IHsoD^H=4`HpSF z4VAG%ebBqHt}LG8Gv7oSMjALpxWEv2aqc=FKuuU~3to#tpkdWRD|lSp(17@8P5pvN z`OY_%_DXol_Vw?x@m25R=-9?;2X8^#Me!qns+|oJPwlJlXJre3Hez{u(9elJHhDEu z{EwU!;HJm{0UvY)oQ>;XVlFcGZ43c-hi1xe#+Cc`b>ns?l{Lv;P!QF9=@&mCadxwm zleoK&;wIJ{?c!KcBtA{Y{&;rgG$2Qsk&HfUn$u-D4?5@!Ra%{x=u;AfPO&CSF93?Q z^o>U!8)tlSnr!YYke5^-FKTACsCy6KY^{6?HM=tlnnWy7TVwuI)%-LL=tTZf6%|0Y zL?^)O9y_13q&|PDzw*hph<2ebJ5R@uUm0S!`t$n>QkY(p)Qe1tv}^M>h(b3abk)EFrTrR02j7Qru zcS`T>mP)3v9gFfLWZMG&Pn%>QAr7qvKs8zE&+fqLn0h8dUD|~HNLt_qP80%9?uRx& z^onTx^ng?@n{G*I-n87Ely!#`bzKLy`8|Mhl*L$bYs6SlMzu6ZKkQasxP-TS;kS_i zBocgH!RCus!sw7tC$N?i?|@~_H!%)0>Y8Xd7SB^oM^Ux1UhXaeAV^7_R-R>N z>Fo+Mp|^WxWacx(BkHB6A-x$h_;AOfO5qHv4>oqNZg zqoSkK;gG~cO4cgO@$)Hwmww;jhq)JRO%26q5Cs@p!Ds8vT;@BC$tvYCG?f*~em?)q zRj1{ZJG(L?03?p+(n*<=7HM^{^_rQPpyasQ}9 z$)|c(ynE_;zkvR)65>qq!uG9Gm+B-k_cu=iXielo8{1P*+bzf(qHw+;K)GVlOy9Z= z!|n1o&WW(+!kLwJgF9zJi(J_)o+9P4?WqQd=8Bp#IaqJ?;I}CN+L&m@L&)EJ=zl^^ ztGtkO?zEdC>!5d6k=fs%gd2?vjzBiwgB>iJ@7tcX$mh*~1s&(AsizN=0JrI8EZzO_ z#@!#2wVhb*ZS8NIg7qU<%Cy?uWCVh6>ah+KfFR^?psCoIM@*_SI}ZU~D--I3Xeh=A zbXtQmE6E9D1{_lw(|PK;t^$-ud3TH}D&i9Z9*TbgVtvv9`*fI!n5r*BV<0C<3ZM4V0j@+%=AsPq^@RrE#`}^ zcs(to*Dpzf)l81BET||aLJ6Viy&1Ld2fcdZTF2OF+`h9NFthv~uY0`8CD6VubveyZ zj^S{X^rjy1aU6m!)GZw>gB)r2DY%(rA?Mwm@W zweg5!DJW|668rxp5%L z^A!hB8iktirq9^fa3kfXNE@^7U0fhoqbP2mkT$5d)can|(gl@DqV+C(@7xkssk(jN zGqU&T6saIARg+%6?!G9B)ff!0&*49^VKV`EU(w`suj==`1@if|tG{YTm~OdJ3O?V4 z6BabxNm7+du=U~g-2&g3S=1E8J4oX7rtKy(gKeb&9bz`~h!Z##Dl6O{ertFIVfu;3 zJAKKdwkU0yTlq`aQ{c~p!C&I59Ci}zw;T*mX)*YSQmsa=#TB3fjfKG}8YbACL zp1s z$K!KEkEfRd-+-0u0NqTn8r1-<7j>;FTKk?GpbR?MiXglBuFQNDQrc8lkOWoq|~EUC|nB)_}GKtr=wf&B(tFvh{3*)QOht!{>Tm0nn>bpBM<@{j{E z!H!QNd2`Ch$=g!6w+pQpCUwBw?$a6zh~T_#+Y@LBi!bCp+c4+DSS)AfkD+9s4qd9XU7`~crE72+ z)0-ot6}zZx_nzAj)ESHWEB4@dq&2Uxt+yO0G&uT zcaX)LT3d&(vjFu%u*^aal+fzV&Lnt>=2{-TZV4$}z1&D{9%GR+j`i^_#nfgNJ$vx< zxN-c^$>#PKU)VJ;o-|Ugji1NDJ32*qViC(xT&kvza>jqCE*~Tt_m5g5pf0)#deLSF5{_#_r^hlHv{kD5rVl-{>;?H@~{Xi~U+mMXSu^6yg`uM(PbA zdK$@=by_k70&fTCv`A99*am0L#CsZ8c{R1=qJb#z+3wYbDRuFlPH@3gxDya5TBVV^vHJ0Nx=TE6d46c3@ zV_fGc4G4Yv1~uUJe*``erdVdzw8nD}+dQ>T)YNhKLct*DBsMnEU&ehZ={NLms*eo# z%s6C(%udL!)+V$#sggZM3tg29LSpLz*a~)hjHbDedQJtfC)?|4uB+n-;k?-T9Gqih z@Av$?BJ*z2SEk{!G>z*m8L$8U?*#l$4A521*3^^SO*b9?*7g7A@zf9>ua2lc<*#Vl zY$0*t%sUPZyf_Qz1EZo_EL|5LEDXru)mF!%DJyB!Vo25M81CVDx_(%Q2D+rhODylJ zobORtN-R%n+fO*1R7YwDzpoH)(fto@@F;Yq2MX|%gvsHj&H``^C;feu<&fS}Epa2C za=JGMkXud-${%jiCp)C^X2hDwvM!QwR@-|UK$2PfxACX{mn`)7_e+TJvd_DTiv=(>;lfm&LY9IZ0uIzP9A*5_p+{tWwumoy}xpM=A2aPrTX6 zIeu({6R9t|2rdM7j~YuwE_rEIU68Dj)SnM2%5i3h_+gZ}p`+31TI5K!k;K+XzvTuQ z$rMP34E(G&HYtFi`dWQj5mr2{Dga_YIfJtmg@ahG3IaNrm;Z7EL{e`=vU$oN&>2!Yu>Iob|2BBY%#C85+QgS|L~4DM&8m!kGMfjbJF4(r%$f6J zO(NBMrFj1GzN3TEl8HL@f@`Zo7RoBB4vKITH*-q(ZPD^>= zXF7hqy1@GwfKo1uj(iX(C^6F2)3A!uWGfVSJ+LQ3FRLRJNcp(Vof6Hnd`-n6EpPK~ zPVu^cmK7x+(Njv4;&)Jcg64C^zqkN{Bxd!~@p#NXf;HghH?B{sc#KlhLK9UAS9ux- zY?X8tnN3qEq74khF}IIB?38?tNHCWj_2{55)72bpkA;_U$u0k(gLJi$cE7>Z&Jq`X z%NyV6wYtCXhesB=5>z6x6%ixSciax61U0O|mY`yA*` zixh`(QVJ)Sn&_(U?J1xgpDl}koNZ6GxnHnA=lC{=1<=PajLLk!#C95>e|Z&7H$OD{ z5|^=Ul{yi}#+G6LhB%CT7{za)3k%7j&Dd;^O97n>=?=0E#4hUq8x4>tSkNXu>~~q` zMh4nZlsP+zn~V=w&U3!vd;lO2SAO#aU=r8_`kR?0TeP3kb)kbqe!-(tSHiMXCihz# zda+f=^Dmz^9PtL{eqC$(82UHc=f?fIrDL*b-J2Ob(!?AssqN06e>U& zc#ba9)}W*fCm(hSb|#xf(T}Dx>FoI<5BvQE%S(-glda||m4d$L+Q>YWVCdjnr)Pjk ze&P~tB)|U#0WzI2K^;hQ+C)vTyXeYgZt5SgEI6OAn>ky~>=j&?0khy3KOLzL1EpiI ziIvZA%j`*iDdc33)IgGjZ}2@PKnf}JFQqBuq~JioSNppzCjI-QrC%EvLKMDHW!@yA zxC#2@q4Yph$djNA1$j1)LwpQH!hWcOL6+P+I zmtf#yqrHATklFWhMzjVBNGU+|2^3#gSRHD_XJ80FlEL9etVGux?E&V*i4|!7%Rz)S)jiK!Wu-Kw@7%;`u-DRBQM5#nZ)>xl zMu-sv`wDjZDq@XeWN^!{*f+Bo{6IF8gJ+Hlo2cw9aYCqSbVg zBTpjVvIiWUx;*sleHK|8g*D>JjNhcynlI4P^77`vSJ*o4hHfL1jbo&*@{gK0pzY{k zk@nvTldp1ewXa9+*XDhkx-HDW?|DH|@sq66wfxRnu}wZFR5vs9VyvAWA)U ze92|&E7~~1*je>%JKWi@#L5uzoLO^;yY1qw6x%D`U;2wTJ`3@e{P3lg>6uw~=Lz_u zE2q9lv~z3z04G=*mtfV)$4K*i0dY~$<{7;tS6&oO`Yvjpb9# z8CKXrXr#E~C!2NGZ^_GBJ^l#z9vBQ;AA%%NoX6N(k}W2=T8gu^(b=^%Vxwajx%%>e z%f65lJn5_^AHZl;3tiv*d3#e+pW`%kvy~M^?|o+i1-GZ5ZOLnSWz!O&>d(0sW0t?3Eo3MgVQp4jxwD>noIHV4<(c&G~c`-#^fd%C4J}P zVSYt2A%3XVCm@-eDmIBtwQOmLSZrF!9bBF$_-|0Ii}HKZOaxNekZjcLK_$)DPrWsB z6o1^>-e{AXWl^wUa6<;JDdJSA*7@GGt;%QJBEFMsuO%zI;H+&>THSi3@wuCb2gOFE z`9YtNyOqLFmq)aOLuAMh9X><$(=IK&oRJe}=1bJxlC9t5;@-!_tm9sc z0jh5oAG(otQ%$)MP;mVPF}jO)wE~y@t4BsN^dQgjH||Fz%;xA%OUzjYHz9J^Be$dl z2Q?y-RF2;{K4M}mxsjD;1^0G->xj$ktVyiDDX{uru-B8?`Wzf#;DuWoAZ~J7F4w$AtZ|Ew3VzVb^0MI$k)6HU3fO8TS%g0B+#|=gJ==AvRoqSm5MGd zBw07q`Jt|s_8Z$YVaI^DXiw9!y3?*vE-NMZd9vWszoSD#9ix%iB?~VG48&)%S@VTj z$eVdb%F^+93UX7!0`d-=_dn11-)=TchYQc3Co){F>YxswOUN7!?M2ZbF{qaR<-jc$0?w=^@6-cfI> z`jhmTbiC^;dJJG<>kv)$-X@kD}4drRYwy&M0onv8&&CY&B@~Lm-@5 zKu8NLP1~N+-|)7t|M6?su>5w<4j%#BE>*ENrE{x9U~;w>g>k&JC)q(D8A(O=WF3W> zA1Ax*;w8I%$6Y4Yw<%yoJqv40v^TDAJ-()@UUiKTx)t7b^Q29^d4ca=xn&QjffsWu zHqi9VDOaS4iKK&arJ_6Gy5$9TLiEqwO_1s)wY}8IM);2;SPBap=bMxgfIc4EQ9h98GmWM$#9_V8*Pl$3k3G z#Dgjm+?P)1D8VWtzx(oWOY1p zOcpQmSg`dKkCW9E@uQxV1TSs9xj%n;1be3wYhsF0ugz`&&yb=Wkld!x$d1lMfdz5- zeUJJCk$tUtGlG4wv=a{LS#fd2emBsA1fO-JBXc9MhMYDK4nF(K%F-NxW2@oWsO(&< z?Kx*_XZ?8j{K?if{VG2{$+m<8LUM)o2>6ai8FMqmjK8N~)D^lnVJT0#{C@g*4MiQ^aX0=44H8@>86}W(bh3fs&1!o+};^H!L38QAx-9gofqum`nsqR@! z4OUk{1YxS0wLD`jYG8pH#J@w3Uei$CbFzi(4*C^t3>>%GC#z+sTw7P zuG#LmN9bFN^S=G3^U{o4>{;tERQYRSp)PqWhaDBWwj_|2+R`O9=S24Z0aok4mr4mB zmF}h%p1op!t3Zgc9xT1%o+F=K#U6QIdo$dGQFV*3lrF0flcY5ujQ%Yt%kSn@)+34` zl%J^!W}J=%xv8qd^dnasfTNn26#O?X$%x4Hk=_EIuQbH~NJF8t&srZn?Yq&@H%^tO z#pvIQN#5?5EB=x!n3o~-Rl${#zii72cqj(dGLJkHPc`<&sTO5E=oIR%Z+=9q2qOP09#e;HZmQgD74 zHRmn$A@YcS?aF}VYQZWwAh5Ha3Dow?!i*yyjpWL zT_k_7y+^V{CNa0|H?G5m7yMoh-iDxnvp4SSO*yNp`i7X>IXmj^Nc$aLvJuEKQqGw# zx1dVRRYHhhSIcFqUWrG*r!~}-hJd$iaMEx%D*mODZ^eAPl7n`LWxJ2u4J$!3UU9#m?IuY6957S&u=Vl68d!2pMNR$#n2_36x&d^84RUq}InX+Fq5?ErVM$twvcfq;Cl2RzqsG$$J zA6lnh)FJK9A7I#h{L`a%Or)#AX8j66CSc-yV(kJ~z$g$fg!3l4>l1724&5ym9EZlm zt%|Fuv7p6qm>)&9BqElXW$bME4XeuOhPf983siHA^|xxZ z3NcSymIiVz;X?czsJHhu$nk}MuFrv+00q2S$4{Lad(2wHV=(;?He6=cLPxVWYvH53UxMHj!_IPFy#3Q2b@h4sWTMjX)Wb0My)~b(puR_2 z%_>l;O&SM!9qt%iYZPE4*01Aibg?Rj1#P-$+;J>>$##}snY53og^_M!|muV=s}dZs+E95!Q5Ejb{}P}qmQ$a?Z_U(xyZ-P zjctAR>^j`Mb-K%bh4P^IU9K!>wpY{*WtMZL3t_SUizxRqYg{Ov%$`m6*+DeL^Q49N_=Y! zIGM}HVyvFC(l+&+YLT2%m>2vWXrxiki5+EZz_?o_Wf;;{q2-lsCgicvG+6eW+GDx( z%f9hrd)(xBs_$~cV)P0t!t{7D*hX73G8(e6gsK0i&!LQQRdaG>)8BbQAqpr92>>8K z1g$=7@%RmOb+-$t%hxhWCBripv+ht4_w?yUXfNS2xs&(U*9T5a2BaVBGAzETs=IWc zF(c)7P+Aqs_?O~vmQS3s$EorCRKs8OBUhC;D*}d0l+L*n0qwUPT$XIF^$+6J7P&_% zLf)jCFkEtqjekAzPqfxI%B`DC(|H)BFX+9KE9Oswsc7N~M*EX{++~Q>V!n+B2q4pF!yf9W_sf z57iS_{x&LOye}xeT5-)CH`aHK+LuI)cePCQD!D@)EJKsAm(`r-Ca3P0z)fgKosj$l z+aPa^G;JNC-kLHCJ71_W_L&3ac$To<2u-?n3QRG&{OjaMIhnq^i_ zR{ixV4K(5?nmT_W#KEH)bJ8t+)7Jg@ZzG4&f*>2jjUX=-jOxt%8FOW z<%`ZBXcQJmD}4_e*7=73$3)t&wj9Sn>QqEj7jtoARF$>6CODp|Vx6EhAns6YG?j~A zII5w3W|AEvn`vL9)JbLBI-x*r!pF-WH4n8Gb1c1JBm*y#i!jSI{5~`K8ub`5-Phx( zWT~kH%aQDzXJ_K~*D3U0Qs^r4a-B>!QfB@Ltp~Ykh~!MBQ-ZmFo8eenrU5>-1f!6( z2tpr4qY&d@`P@wgX(OV1Jn37Qdm5j^mY&*(Mdx=}Y02!awZm#Is-xxU(io|;h^ zJL!XQ9JXIRP$1@B7>D<>D)vUlG4fuWwH9?)eE&1;gt_<1%b(j&_nez)y2CDW75L(^ zyJjkd?&`y-#|FjD4F=MVEsgXA_2Y~O{E~(LfYWFmKN?nZOXrxXW0o}Jsu7YizLgTZ z{=p2lxQNs7%}A)O4tfQLUpU*MPnSw)>sxzam0R1>chf!3pqKl8Ur`WW3NY5ZP%rbu zXQJn89%}*&L?w?P;y$?fvghYWO>|xLa7WH9LWGHNU}?>-n(m4sr9x+;6>pq$V6~n@ z+1R!~#vY85d`0xa&)iCP>AnOfx|sfU=TrfP@Z4meGI;6n+wxUv7Qw?lNXmH#t@$-U zWnNY@BCfB`VWxye*SCxT&W%Jm6sC!g7AB9!F0(V&3>g^d^~C8qRjx>?>rAq1UcTGm z)6od;TUN}>^3MB#T2EQ9@xHzFsLE{7MBTa-m2ZRsAl730&y3D2~tQ~WUL zX6bY-*K!Rz{~tsA1s4q3Ie7v>V!XapD0jr0HS8^)X4zU675<>v!S$T;)^m%)l4#lE zM2TJtr1Pm~rKV=iVEu*gn`*~t%6*0W;YmB@6Y5H%-(OP1j)SCEaEFb$;ujUU_yHX8 za*1Iot}?-P>pm-(`x~(OQQ?UUU)`U4yuE_yL9*~dQ1XfTVV<3O@^!=f=iM0qoN3R! z;G_%BFcnf$`*+_rZ0Jx%dOvqr!a5}^5k`z~PT<9C_`K$X=IoIhI5p!m{ZF zRGE;?%@##zGJ~TS6)-o8IFZmKBa@@Tz_$+muKb6YN(3R-@LdKnGe2$QN5jECCDDj; z=#8&b#7C8~N;?YbUKNMX%0In3IwNP<)~D^@s^q*?nQN~5G|`5*zuQ-5{hC7kYL5?& z`^jvc6ygyU^bcB&csG^@W8V%*I#)J{vL)RRI>vPq#F$}KM2ij;Zjf(s!IZ{nbwRjTc8hCU=o zbTc}ImigH_R<1yN@~sUSxJmWMmZP`pnpuqnL+d zjTx#sItj5N^N!`%n(v<1blDyy)t+-N_9lc;izLV~Gr_L?EygSNzWO(87QyB0*114$ z3qWri?wPTcHk3`foz_({%MikrP#Zt01W%nmx&)$asJ086$gshw%}!1m{(25u1MuUk z4mCXuy4I*D)88q1KavzUH`hm66-&xn5(cCKIrNTHsHeC3b{F=AD{!54u}_dH?2ZY?WKcTj z)zASf-ZG&|IOk?q66M}y2&bA#Ze-7FMz0w&nK7%Fz*}(;i>}M{ml^ZNJ-j|3ayi#T zMU<=;j%al`;%uszonfI}@xsaUT#g&(1uJF5R4gS2oGM z&VA`xcE@E<2&kaN@`q;g^sABZ3PhF(m5h1??*k->s4`o-6#H#Zo#!t!2ph%R6yDg-yw z2Zfkd6^+&?+voRr3i1Oqto`;>7&YfRqn*7&uv+BIe=@78C+keuH=L4<%U)Tz98D1&iaDjv&jaOK&cpHS{w0)LrVvat@!rHzhZDdPbuDxxyVv*Ho}X`?!CmF9zLyL zb<(NGyuV7!%wp?*`uJgq{L-oxQ}m{vu-~7jDDO%L-dq0N5m|-B9@VY%gPH;CyY7Gw zQH@+v4)FINyb97(KWCjeR;9Y6o6v;h`oC>U6Q~x7Q(Y4(g@cc9O*UpFbQvA>e(pY& z@}GU0%7dk7lK9rgAfebRRe=m|?g#AlW!z$0Xb`Befej5SYQU$a@l`9b z#)|K}{32|!TPL*hzJF#cB~&IUcw(s5-#HmoSQ@~hLi%NvouQvSn_y)j#-w_a+S()& z4ocF@2OkVoAoT}t5|@)?gR*mHXJ`YuNT)HMl#ngigO1Z8Nv_`h9?}9G$N>LP>BzMn z^>g&YBW_O%AU-Fwa=5LHzK+(OakFH`qN;Q7!OwKt_eTR}gs=xXU~oWgwyoK4{A{Y& zCgxY#SlBGyLd3!?Uu!0&ewnd3Gq%aRX=BlT*vV+BW^6N1XY+-zQJ@l(-LB$&re!0i zl0=ef#7+PTUjt7Qx0D>i8AWL$4# zy71A88b4`e$s7uIuPdi^g+~#EU|C$P)#ZkBkE4|z&fQeHWJDITC50KW zchBv#BDbdIXlw-fPOT$lqcc<;s>}j>t(d~$?p(J_QVD%sG=zJGt^sKYAlmGWa4o8{ zqV>q+;R9jVM|-7(g!+Zh;M*bVFH0bE9R5C1TpJ(D?dh7dwB5EyUH>5MJ@)kA?#fZE zB*ln$8Dn^?Lzy7PNL7(-A(}8JpSPeAYB-HW1O|J)CtJSMm+PMi*j-;8RpmFwN4!?e z(bd1BV8fU8%>CiyhxjmR3zQZbC{wS*H|&q;vTq#I_V=fzLt2MnbFSlw<*ilaohVc_ zCyM9}dTp)QtUi<3DiE2HETqc0;qka@q{@NhxW#y9>>~;6Ani)!G}(V*7_T}(-@=)+IRfBrjcjjM>7wiG&FlD`|SjNluoLavX;@P8uiX$nBP$AE2!{LJx z_4Pe%DD%Lo9&^xtW&Rc7mCROu>i*GtUU-0_P4KeFT$O+_S?63SL%c?d8KN_0X0wAu zG(gon|LU6t>-5yU{Srl%BHEt6z<~oS9nO~4{Jf2PE#CxRFXG2;t?c~Ol8LYcU$?$l zrT-p2M9jbP6wKZ0@>XC4;9(pSW>C1%fw>InugBf_VvB1`Cs;U1v+;NTgQsCIc25Pc zXN7A-a-@dW4k5gOftV4*z7DHFI#D5Bh1VL~z4+74&To`_1iPDZ%LI?1YlH(9+`h`J z$~@Of4jDfv>p%@3y(bGN%O~o$SXo~{5|?u`OcAT9l4-L7-Q@Xu*smJgB|cZ?Fqmsh z2dEWwLME!dAfE=%y?4H1XI=H=ua*wia*qt!%j7L)=+iX>2W1auc2)uSgHCxT@A9u+ zq<4`E#p>suQBCzA03)xx;O-r027Hx38`K~_m^oX99Msfd0S*;K)aow{c;bvH6=DKR z7FmN{%`ikseiw$lyB8$#6X!c8>jo~XV^_+O!H$m|0vpVmot`hA;@dJB7`KKcTspwX zyCgj(;)C(-nRKf;X(EfglZr!n+m1}V$m(d$z6UKo8X!%gr1pK3KmO&^pfE$A#jdJ6 zGGnu>q^j6kJ!m~>C*?zmseNjL7g)OzkgE#0ez0#9O7p8!0SyjW3BJPG>t#wc0ggMdyfN% z*Zz_h#$c*}EKWCvR?q2Tx9TfQ3T$`R>kpOhZ2p1uM>tO76$}K}0*(nw6Qduk1ET3E z*SXwbZ*E^ZVzrN99dHy@`R_fBsvl&7l`yI^^ow8OhM51k?rudm9%YL=KeoP3lhXPg z60gV-2{-b&!YNB62IE{l#(X1{D`AX{LBL4q?{QTIquI#g>S2kJCzB-d0jlH`TEL$;HU|ugNcOe^oma{PBbV3=K`12l zm!)og>{bt*FZ0n%31%~Oba%`!%({>;>8aSs%sLQIfM(Ng5mZUKfxy?CvLn^OS!E6K zd>;@P5=qoeO;D(RtluVx@e26QM)nlX)`rIw>py0iA(dI@p=XEH{6Zd+H+}b=we=*RRQ4?P;_ULlcD7SPt1F;D++Kf zq+T)tSFG8Zy&k@tJ9PLzy`Wl;VL#%YE&&(JUf}cMj&~f8Sri4o01N+x4@k+hw3Cyb z-C03VMnNf)b|X_u-Dd_+WsiIh+EwgTT4CrIF*OizC|}O8Z3xm!0ryQE-@4^E!@hSt z!yU{sFBCH49W>|kU zSfwGKyoO{Jtuv$7#Z_M~LyJBQG{XHL#8GjA)_qsUgN%V1|Aup)V|B(7+U)~1p1;bq{a8a{G(c6@>on?+-RiM00j zd)W;xAHuNS|H`coT~T0bZqILb+)+zjR@>?50*bhtSIn@gkR7m0`2P&zNe)S?df|mc zOJYYf{{>!r!KyPa!8Qqs2_O4HrVfXmqS)xd*|V{@$53IjyFsU44iFk-*_^yyx@;ae z${Zy4hI#2dC8&DMHr$V1X*t|wuyXhFo#{qMxMVw;@MR^ zC$yu`t7ei&JPRWB3@ehB?O~p-d%E#FuBZAeBQiS1@r}G9fBVXnsmDER-!>y zJEJ9S^Uicu;^#SEkGmY60mvsm5eW^Glh*zgM>UVG?pNt?mIE?o$(&J;oGJ8@j#5I+9Qbo4m%30 z)foHly&>ASN6m^I%?{G$!;_BWd%k@(5U z2&cW+0)x%)8QD<-tP{Io_%a;dEofx)|0A26h$cXu#YM}3^70A>d>8SZf>xQC?z%5i zLLI~B=D?WvR!oOqzT?d7%OsGu{duZRQ5K74N0Ya1#h)M>2L8AsLFJ`?U`*_0107Tf zAT~ntF|1B2wCY^g+!$+(SYmo}XI(i|GIyk>Z2KN~-3V$mk=rYWcK#OzbDsclPI$%? zWK>={VfqA8j+mR{CCGJ~zt?e`K)SxabFJN(yJ1xlZrRh%KZ1CmtjKhW_laIDyCE>t33@itEj(~02iWF zoe_#{KAyabDGK?tKjb;v0OB%n!rO+jNrmEam?m?-_`0Xqb^~ERH}q%QO`@%Fx6&>m zg2C_-De%1w{Mhi@OVTQR*(bmU%R<11V1b=hmf)ro>mN$6d}@wE=Z8S8Fpn?e4j+vX zs};MZ5wfGTFimpz++VvZOhq$%wu@F%3Dth$;{v?oGZ6_6C+2g&3PwK^dk=RRLh)s{ z@!N+Sw8sam-Ac6N(9%+%aJJj{p91ze`Qs-UZ3>PKrCJlt;EGS%12x@Dwb_k2dfGQ9 zVBh`lqt~@sfn*7Xo7bl^ynfe=36_4*4bKu7OziZ@+P)!P+7g~&*lct%=$C;PjD9bB zz4(Ig%0~Sk|NHx;e`$HSi=VcBcN{UbZ@dC#Ll)``#=a03?TRn?8@Hp6S+@fKCGE8F z?^C9Q4Dk8AG;e3_uM=O~J}jkUFXd=GGaU(!4svuaw%c=9{ytXLwA7v`A&b7GL)iW= zpH%ty=X%h+lWXn6_KkaUc4W`NPfaff8DyHk@$Kz~|1SK3$omKQuNfTaOLSTjL*SF^ z&s$dlIwWa`O8uR+`@C{>zQ_HvUUQHjfx$W{hHhVh1iGW+>gviF(A_#Ww%)ew{M(KQ zVMiVIFuK^QoYcmq5S)81B%o4uTJ8GCCVPce?1|AK*RfNm>N~ULcAHP?^GBACsLr#h zTK)jw`)#t#r=Eq3+q8L!me+|bwVb826Y@J`wq4DIy%ZID>xt8IFJqe2p?F|gn8Bek z1=~;4G}9b2yoByXw)j+Q=HZCEou~E3@J+$(pFRk?4=Z9!ztM-mo&<>M`2C{5U0slZ zTUh4Zw6Hj9wKEqDer9r_ySjzJEL$FhG*jP|pNVQ)Q?wRVNCC0maOU;cy3hOwg}?-B zQ3GS$mKr;`A`JaJ)91^rZjy4u_~dD^t9YxV`iI0a;>-U+Qpyq$xP>L#3%iciaPK^y zY|c-d)ZoRX)p2dA3McqfnaD54$qzy~tfa zC1%|nooLcFC7r#oyHWtE8_eFtVa-Z!HRBMOc!|VR#l4YT`-A@hDd-^f>?p_vtfal4 z!+zi!TB_X6KTIPWwHhN^Q8<CQEGyyY^#KqI?6 zV5SItM!0R`t|84lEi3B<`*C?K_HX_XS)*$(&u6aU?Xw*Bq_gAKboSdZ#W;z?`p{D# zE*+-rbOQc6E5fHknIp@`l;;zxa`-(XiqGH*?3zbgFL4 zmd()ETM66pD}fZBT_uv<@ZZLrZ!9&_`GicCfgG^NIVM$&*r^>vkU+^>zv;5w@S5Ni z4gks$_*8-rMb~)SkAXU9$4mRq*7#wk4%=>Av9PoxNO)|{N>`~V-u!I-9empAYrMGN ziJ$Cy|7+nGt{$50S&@Us#5y4e)kJR->`I8*NrrZ&d@;lKT#qWXGJA@bKN>ohHlxy7 z$KMPDuVZZAEQE0NGch~U+%K`GWINI2H7HZ@qFujR+BRF9Q6-2g@j0MXhRCE=(xz8{ z$rUY53)IrIKc0X3X;J54Ldk7joa%4QE$D5c6c<~7bgweXW+Ui@=6T{v zP{I$3nYEA zEw3}@JDVt;GkySi^!uxd`;%v8XEz_CpxmLw3#&V`bwfHFa;?B!fMeO4svUH4t-}%v zvUEe!2612J!BOadH<%c4Px&{b_ft-RoBVc+*AmH0)y^@Kh2w>nRDq8-G$qvsoPkpZ z2a~L8{C1E{`7e9Xy~yZ55Qy$Q!@u!xQF(4(U*GIVjVk;?y{G2dyaIp^VbSO7J@XcI z*4h;}cA|#mKb~KI;fWb<1{w&gd6x6=f^FIvXp)%IWft`L`8m#xq`^x3Pd&Dv8PCfU ztU-Ss-Yd_YpBK=R7^MUj055b)J~&1Xtge9qC5YyU{PGeJl3SE;kSLY}i%W}dR02y0 zD|nvg>fyIAN|dNl(M-_9F8mvedj(nJrFghvUIM;4HH!+JTY}X2ZA#$M;=q1PmEdswiC9pHXbze^i`zp6cHMec-Nla z=BM-A9VraS4GWITL&-BOLsysq9FJ`cef_9R%=pt|Vj7R*;|1zg&tq6%H&Xmz!F>(u zl|c(QAh9;wq@X;LOeRA~4^~9vw?w7>jqxxlPdnr3wX5k1%=wg|D)rD)x?JuVsN>w; za;>0`c0dRR<>TFgynfYG&lAeZ$|PDIor)9=zYC4m_@(q==wGN6#T*DS2Cm2htZyIG zeFAy1xo`wPk^Apzx1wl=1sh+9>f*G(W})Df+w1Qc!!`BLJg0WPEYPg-VQhi((F)}B zVnyY6c+bt3-^)`z=n!4>mEjkV!U|9-)@n~J4B-q5)(`q`c8hQSOdAU&+kLNPrKhJC zBchWmanstmP1qwAQkXP~Oj~Lix}8Itf$RKq$PHa^q7ZVDat%Jyi5avU!US)(NVJ%t ze{o$YgOu9vDp^hWu^@M(-WV^Ujg#G2#R|&*5vdut=|4C$1fnOomp$J*6A=X)Z!xe9 zRxJ}&B}mj@7dj_GMR{lb`k&+zA?4_Dj0AjMVXUn;0?V^_afWFc*G*@eq1&2J&&_6i z=tpWC6w56bjKAA>w~20Br<)cg?;=qKTJu$Hf0kefSJAmA1iWRT)6^77-w<* z2e~e<^$pl908Ez4!yGUjBaq8L^rQ-XbX{2yz3Sm%i=X7aH?aw#&-Ki#yhOr2-Z4kf z*n?eTt*xyt_{p~umj^05Y$s$vXLdDwiEPHLsF`P#Gp=|1&xwkP!tn!DoLX%iYoI)_ z4lv6OxCuXeMoEd{*47r74d6L*d>|sfOTH@4|mB|Pv|6yQY z+ujq=2FikQdbCk$*J~^pg8delsacG(v$LGlH=sK=>3_`Q>alE-90|D8QK--=GFtWX z%?!1BviPY3L#Xmz32giY_UVqI;8;i1{lq5vqwZ6z*s9NPFRD6cb-SND0x=T#!F>iDn%XA@cFz*!O?mPo5S(&FgaZYyK`l@`YgC{n!9W zFnFyh?p^Nk+8R$ig*Ie{IBv6~$9?#$)qw^hua!W#v5jV$H^uK1+{D?r<>Q;HM#)+? zE1`wZ{_k@60IKH6ouo|PNy_svVw&+3Yil7<(GE7%1o8z`C_B(dR2OfYDr8VLJ#z|{ zU(a9=Yn4@qO9_QasWTrwyh$u^>hA4D7V)}=2Y>YiFbj`2jD`m|(zwI5x@kN_1am8L zN)3=wsQdJL(-pmvqN0Zq>Y*$|p-mp6{cTIK7EVHrh?qdY%ENnm%M5I5lNWOUJhXAw z8td*RJbLuVY-sRMAEZ4^Lwy$bXQ%ZS8m%0Wf{)g$xX;Ut$?>9A!N%JBRL~fQG+b47 zP2(G}-1PKQX~7c_M~)oJD$7)cdxv_R_o&rQMcHgIttvNdfQKGJeN}`k$j`T*e#xla zoHl0neK5PNm1BW!d-LXM>c-#F4|sGBsn9~>^OIrac~3_lZN6`{1#NAD1zH8}&77yy za;NT$ilnr+q(@>lKQzvc(U6rV!W= zO8;0oI5-GKQU9o(V;lO2NMt;qEIA$%(ZD|{=}IsPkL~U4B{I`Obt>G)T6@ndFxF?? z`pi)T34m#)HZ#F;3=4tJ$jp?i(HQLRGdHv>b20eNF7iemtptppK_r5d_c)NkeM>`H z=Bayrym(Ap1K+8A52ywfHpN$as=Toq1GT}fvo-{Nn4fENvRU`WePoYG!bgL*%8sPq zA)#f~=aL z(7?bzD)xzjoLm895HJ`nVh;uN|J=Nqa#e4r@T~k;ml-*RYQ-i%{64UY+ z0(I=>CPKe=Zm-KRQH?kNWE{}Ga)%GAVwjyNO=%1UBOe$l8eQNc3nM+xEK~07a{;N6 zIxvu^9kk}SFiK%fPqWt`66Z+{A09bM9i%3KD&>Jqkfxw}yS=lo%v`}-W(k;;>}9B) z1*SzrWcnP^BF6W{&o0b&a_8qmmrBaYlusdGn!f=w^hg49YS+d`M+x6~zTk6(Oi5w% zGOTL7bS{US;`uWv)g}k6{q%C>87w8l&N-F5rwbtJF2t{ zVAHJs9@`f-_j(VpxjlJWrx+cS%U>%0<946o8r`|x7>O2pbUt4Vy2@7-s$46}Od^Z` z$^!UpetyA^yG$DxO}`jl;c`HDUYj5Riq!T@&fy5x&%=e4ALKLcMji~GoV~+8;8%PD zE^35Q^Ua;qyen`BzrZTPL0MkLd#Zxn5af&h;VH91SHXBC5|c&GKmjh!6T`i-OI?Pc zcVGjrTeqUszSU#^;v^FDqn&)wWp3c}(?!nl@h5mBPUsRUG}ZF3sy=gP5N>Dqo^t%i zN-7+Gw&3j4NQ6ElYFGz*U3dGmV3su3_bQ8Y)B2{&E`d{o<{P{rubz~4YKHho7>Na; zt?HmaK%kb;mSVR*uJN!6_*1z6-<*ASAV~bDYq^lfVJXiF3bbuMz1n`bx(c+`^Qr1V z-AWX|PP{f0&gVK`U#4UWuTAdQhFytvNxf$Mb|zU8?l(8zUbi*!JzrFeF6ILK!g{0USt4! z7JfllGc}N61C?Ss&2EOzy-ARJ<0n_C1+}3Y6h0!;l8;8yLrR?u`15MKASp zh=COme9GrqCJNK5iapf{P(NXjH>|BY^2ouOiiF$F9t&@{sdZW<^))^xc(-5dcIH=m zhus*cEN?A3ekNAlx&bz(+hS{cTi?dQqW#SF+O~Z_K#u3XckW)| zi=~9me{0yUK65HV0Rq5W*0gaLOB8@u2`o!_KL3lSjj>C-GwS8 zBEL^K^H9R%j+s3fNC7q2_9t7eC3qqtduK|OQsVihw0m~OU+Q4ZF=@DzqaLra>ge2M zGaFv*=`HN5E9;$7aQD%)u9cw$ejfNmEm4Q|XjeD6y^fzeoPhGt`*r^KU%(fYf4ne^t@bi* zKlz16h57T*w&4E#PQn$?;Or>FbpWyM*s+}{UzGh7+7%Jxao@sVt*&D>R>{Zt-m*nPl1 zMwu(u3yMoAcxRWPgR^fAkHg|!cX5d?Ss2=7EV%L3Xaqglc}&|*Uw3eP+WYRvT8i^9 zy@bib0XrAC9sNHSfXaB61m3xz{J@?j-hO>gAQ?S;9J(dU&@Wwuq>5W5d|s@I&E%`R zuEuC%eyJJKz<6-nr3%x|K&z6oKbz8-?DU2DWFmv%<2%}Ze9fihu((Rnp* z6(^m=U-9<74w7SAz#;s%Z9d0oTfU^NbbkU$+Q07_X*Z8;zZ)Kjm#FZNn=DY}X6{aX z1DS7qE9vj6V*^cSCu=2*<6po~*FWnbpzxUX7XF+fr%$98)-{gF1@El_` zX?u-8mR3{+Rnkm-ujnq5Wh7COT+yy^1db zbnrn2rALoIR9ySC0x{^Ho02M@x%_6NyI}=#1g>z;K`vtW&DMUqa9*T8=p6h);9LqH zcIjx_b3&!W?t`h|JtVMFJDcLl2l12m($Sp@*^p_{XTKTOS+uNUJMAXjyRr%ui>7P$mX8*Ar)Y=${Gl;er!a4(T6bfkt}A4% zx&8H-&yxfGJ(>7zJz*c>yPGfM^Ld%k#oWdwtM#u#sDv-rNZ#b@FIy*gw?-Q<`yP3h zRKxMB4$W1SybT=BEx0eVwwNUXWsbeEh4K)~#cNg>-|i(b=$Dg1#-xNlEdPhV|4>Y~ z$M#!Wf{FtMOU^2O_Ul;4;tOv~G4Utyy#G;ZtgUxf&A@(}Z@=G5+|cDpzkbghk$`71 zBoXTIv+rG?-x}IGMy$6YADkPU3AN6dJ(Vb*|Ha&_9{k^7JpFdNu*vu3qZ@+eyrL3$ zcxL#&BY`WAB#`E2AF{>k`WC4_2%^3SA}{rSXW`nU%s#~8%^>R=yl`tq-hTM#(4B50 zu+L_$;IF?938KDW4SA{gLV0M6Us_nnx7+SbzF+Nw*05kFW%7D+ucM-SQ$;QRt!(#v zc$lO34eWUo=p|D`Ln5#DS%V6ClEIjp#_#kHcKFaX*hI?L-hTT{#ka(Yg8PWpDB{C^ z&rEwme|%zL7?P9&239D)|9MHhHuujTet4fNQesiyjm0K(ypj?iWp8e7{#)dSXRb{) zc`E2Zl{=!b?WDZ@2k{S9trZvg-aJZB{vdR;Wy15cB;(;9;g_wYcZDuc8FPt zhc4H>6Fbi~>3FQ3*IGp+64&Qzw(l@w<`4)(&qUni+~?2FHIXXrFu{S<;){0=JQ8{G~<%77n|Gk8O}@IzBhT-Z@N!T+MiKWOkX|R zcU3&(Q>uH?xtu}I}hpw(F_ zn=!`fkR-EKbvLi8jw-#FqQp);UhQmee_JtzOZTD|=J^@kx^>stko%%mmYJEEIsHyg z%#7W*zjxmEtO9DN0^Pfcw(QOJh!aa%dkp5;HGg*}Mdf3pc*qy(6B=qm<}aJo2)yhZ zaWIWAzGKl~!@E1JI9B)VGnB2juM87uFiQ?Lkq_&6r9&$`9S07Hr6Qw3krcLyG!hwssGobOn^r{nE7A+ zXNPE5u7JWOP&wGK5Ypr`9Gi1-h6Dj9p6DJwQtEoAPkh&MUF-4++2M+rSs`3rOUc@ z(l)F7_3t@rse+{cT)xM;8<`v$mGSp)l%>x4QpXhqZ#9uC+pgrgjOWjBMz{W}%<1e#+FW&CvY3>- zMUPF5DVw#^5C5bQS7PP?89W%TS~fksQh<%=(N z(@Zp(ooT1^TJ$U&RNGxsl9T7wX)U;j7S`p?Xn4l!bS1yvhF^XZhIJ>74!vo7B;q#G zAw+KU#taYSYUx2ESZkth-`q|S(My-naBP19D-jh{w()LSM6Z6HC|+UXX69$|<6hk0 zKX*Ob3q&M2L^)yI?V9|AUv&$6L0u_S;qBb|N z7*BIIw?_jEY?lzO)Bb@#}| z1_cMX^|zkj4;benk2e~`Zc78%zQ;M00_o zu6&1hA@H0WCZ*aS<;dpzyjxm0NmthUW9R}aY!9Jn{?-RL0)b#^FyskuPrglC$A|Fn zS%h7LYImIo`@&MTrY~ztgu)(K*W4~{YO*!))QpY#Rs8H(1z)?TG?^AJs(bU7jnKj` znN#`sF^?ac+1i#3ds~)j35951xV!*S95(lAcZ`rgEYL3kVB~v-BBgbtM~n>V>ed9mgy-St z6_UQ2tsl@-V_IrnK2&0MM%HomtX@;louuWh8S4)O4Ay@p5By&wS>qQ!*@}ZzQ?^?* z%ML!|lP7*u0t!2X&(~q_<9T>_$vyH80c4@`HxqBmjUMUyjE{)?d8fgH6;o4F*O@L} zvtGNF4P}#%*49_#pNcxB{Y#z+$bRnggLUq*b>hnYxACAvnC9_|tX4 zgdfh^KK=|kmZj9ZXh-mzm_If)_GEQ&&{!gL=B-jz#2T-KGM)ON(#}9-^`%$6f6YQ; zK&=|{iz=0vay+`th_oqS4Z@&cdWd(@M@XUaff^YH9b(0J2$a|y;lI~FY4h{R$9%>0 zc^}-$)Myr(n&`}sRX3ABcwtJ)-MfVDx}bf9s>x^VZ|yy`Wx2aJHT|!Yf~+Qjn$9W& zhiSXcXa4PRt#5O4axMo2HN-p`DbPSR<$*ng4a9rN?mi7F7YKZ8d>q&4op{v05zJXh zcLg{(hGbK29^2rYKEc8xG>P%*;mAdKeV>x$mFxMHj!5YW?4U7K04FRK_wd#rv|+`FI4%=l9{7)uRDwD3^m(tf9JM2rTHg&GJk|cdcutvf4Ry==B4PK7Lli9DjRMSfHb%;alT$EVFsHk6=^b|8RlYCy&A&iK0h_K4f`Sh0~wcZ1X zAFp0`79AZ8au}TZBqfTJX*4GG%33J=OD2;pWI46DwF_ENKZ1Zt$!|4}@OShRNvz8< zXIWraO9>*yRaM4dhH<@~xDwPZZb9qPu&fNsMWX>=hzV+FaG%K0DEHu34KABlV_=?G z|M_VuDfCO^<;%+aP&rRqq+?KnrtQCV4s zHm00FOxJ-2ugvB1*#{b#cq8(_j6()VS(4aTdA&rW_p-HmO7%b<#H6t0b7L{=+6c2l$PCs@VdH`@UI`06_3WblV+xGQSNb1;DD4`Qka?P z-J}kaUGHO67kkCW4ke4nXpt~g@9_P-EbnVT}`a;}CbEqd7o z&6uGXnN~{ALk$NX(PpDaS-4Lp*>F&E)k+2g1b{m_6yoxAqgDY%?qlks`%RyRGOPs-dFdP zqOyob7*AprT=rtz2CAH5UtK8lppptN-FtsY4-CJz7yG)GgQ{~`*>FO{1s@Z1Y6*&Clk=<@;+#90)#%2o`G^r&w{|4)k9f%CZO zQF5HPUn%tSQ$P;@+&DDPEy1Y~vd@d1RVYXzMwF+Q33sU{7e2GFpCZE}l^#8OGGrIf zV|?pYigizX3^`yH;&RSw3}#(D%a_}H^X(ly478xkymTpk#;xrEs{J|69rygaqsJH$ zyb1ZuS~Z`M1r=kPuKMm^9YZT(yz&^hhG*uGd^M`jpJv-Ae?6zFtZ?rtY=U(9kgd2&0<&@{3Qd zlowL*O`}%4{St$_=uThw=I#==gaUDKwIlwCiHSu3ZkyX^b@a!Xt;%~$j15(k6`ey- z*2C$sF~g08QT9|q!<9z=g{LBGa?56zpLWXnOkU?YtZ+>a!88roZcuVn`7x+90D!?6 z{g|%3N#;*;juWq2q2BWQCR!6#wdQmNU~zD!V9Nv^SyiaJQJ}x zd#GXL_R`CscZF8czwY{_Bp~ZFePO&%Kcv=kv|<9LL8lJE zB?FcRwt*Ro%^HW6WbZ#luIc!!-ZxNNjxaMe{tE&qfPNh*Nkh|>kzbugZp(2URj}N- zdw;SBNE-8`EOYWEBe^6yyY;zC-6)+Z@8CZCSmv;Rx1B7B#_lf9YJ0hdh0y)8K ztC_cEuG*OOb^{#U#mmNlZ!-Xg)9z4AV};Z&$#KU^XKo>(9rzPJRLRqSZ8W;iu!KY) zi(0FHej~0X@6L=iMLlphZ+!-{t_{+G%`jUW6L}HkhM&OY{}dCmfDGbRAI=Vua~rIg z2m!FqPI^IUbGhfOCNU<7Z3Ymc_2LwFL4#wvz0HguF_a!SQ`U60aoLt3`uFg&)(!+P+ZS^3eaQ3_%2v;{9#f;0nrH&&lCJL~Ljk-3_g(Oa5!@vm;T_4JY# z6Ufm5{e-NDNHyl99jLU8scE3LYOb7?Jt?G8v>Ti-TGqQoxV5fb`hn(or|~sFwu0f* zF+Zqp(eQGMbj+IU_o0(V9hAXMdjM5J$YPf+CKPtwtgJ`NWWO3wao?X=Tt1MC9KaC6 zbwEu6&*P#Dp9Wy*)2CH_DChdXjw(b6$dzGrq$JJ}KrO>5gANEwnJ@%ZXFh&>v2i!F zaK}lVV>=Vi9(w%q&p#(6`(Ma&=_;=))r!w_v87N(oAg~WV)YPmX#_R3p6SshjSR+- zh^b#TzY=Ll&+CbE%Fjbzw#!OkR_@k%johxuU8f^2T%4B&ICrS^?|Uno3?hG+7PMFL zR@X-#4r%7rmuXkPGD@+pP%h{zx}!%K4lnSxwziIS$;*-xJaou>D)h0<_=H694I+|r zX>$Yk(`EQ!#xNdA&dp^`{;Y5NU`H^6x zz`N2?#&31n`0IDYiLAeZj9!3_4bzBVUe=JazHU((9)YBOtvL~ z!#XOQgd$wYj{&ME%nZ_(izl}=YsR66crKb68fNEvV`gMH+4Zr5gDaWRe*)Z5qNW^L zjxx$(oRMb~aY#t#O*eE!^Q`u`OnCZmxt(X(@|Q1$S!!YQ)+_NvCZt|cUijA7r3);$ zWd09#*P1j|zCivUZo8;;6ZXY5r%Swh`lI=#Py=U~wnnvLvE8_nJNObO!g6?cc)&dp zObaWE=2&}gV+*=q64o`wfTW+v1&^5U0h1a zTFCf;YCT`yN>KMD0KYvNMmYgNvmPK;7PV*qgj|LDef5dS++0sU(^$J_rm(tT$bzAr z9v~3@1>taBu>!+xE6+>XvfR&{az+S7+|C>TDcTSMd9+_h-$-A-7Q3uRRO%&eg5)EG$q8VsTAZd)%jv1Dq9X zlS{tDbJQO&oI{wD7N-*2&B{4e!}2YZHO17!6Gz%~AE`?E^WZ_h<6@m3XebTj>C;8c z9CQ-4xadp3cxTOzd5wo;CaiCThKp@Ka6R=qt}+8GHlA4~StL^~_J(Wh@`J)4-)3}D zrONUwzw$z`gjLf!x7(lVJxc8YI!`vE96S7T!@gXEd!ZMtHMHm^p_kL|RAuaZAR?wL zss*B>2;>r#fM~xUeL;p|5TFhBO7p2ckUdmpCC%a8*x~CEjtfZ4Mj7BY&YV7d4H(VE zrQ~-ro*WCvAk=zVV9T>ORq_RCX}~ggo2rio;m7Gp2Jq0(G`HFDYFReT0O!sU=2ovz zE@WRC8L`rI7+IWRu8t!6>is|UB;Z=YqQNkW`qzOiWWp|fam{RTWhGH$Jc4}>Egg=W z-~8%?Ghl*mgw5%k?_L00Me_o4kvvdskwGqd%xrN881qfZ4BWUe)sRg)<%Zi z@N1Q|z^p+D2VH=Q-mbKvrN?HjvoNdNKWu1^w8!920EhzM%qYNMf4rRrrw0i)hO-(Gg|GAO!q#l)ihK7TkL6%~a){K+J# zt4llosJ6MabqN7Q%bwi-s><4fMQc<(x*t$^Vr$poX)<)9(OOU5KmM4jGR$tz13>D? z{Jge~fr+p0v$Srr{rBIVJcmEDPTE5)=!{GB>;YQ_f|Jlz*mz zf6tF^d@UtX5S~{RGo{_DcgOde*5DI#&kGeA=tJ zlRP{7DdzigBTE~8q)1Ts0xMY4zG~h z{rxrSpW|>_EAIPmiV)Y>74W?Gcl~CPr@zl0hPfi7`@LU$$Bw60{})2}yqf>Bf4n}f zk3iX0On3Bu5D^viAoU)mjvdK;|Ni%X<}KaiU-I7g)vp0ytzKZbUjJgaO^)yIdF^R( zs-&uF&{chzLE=3mxB#~nOqI9Ty79zUkA{GY`E_@6I&!JE*d;6I z@;ZZ-AfmeZ#suiZQ{P7`5*q!#%Xac->|0DD5P5n3`N;ZR@2;hcd&v`KcxNO_Pb!Pr z05waqF)y#CE2y%vkxo7%B@T#FD2v&;CQeHS`Z&1ZRL;NxuC#7n=~gP*(fhC6rF-9j zufb~E)D3BBJ1qEp7<^uJcJ>YncsEt>s|3zYd}wB97=m)g5jaum z+ZQSMUy~#NtS*yDI?NJSrKLWE~@nRP~cp6CNdtB4BO@L?#7cr2Mg8j~gjr?gRP?(FW zMs62WA5vkLfhJ|A8kfGz+&R`xT_})728o%0Z(ME89+I%$NS*D(1%QNfM#c1ZjC=#|ZXN29zieN#`pC3I50owlnAW$=C z`GS1~EesO@0FuO|&LoHcL0SCVOT7$+!l<`N36U{!xJ9p+MZ*AYr7$bB%pqdas&n`L zqWU~b!0cCokA+@EF9IZ>6ciGoTwZQ4zO~r+q<@UphAEK??Xay5%B39UO#<<8Qe* zodH&)f!=PY+VYmt>~H*kRhj`bE$7S3qVZgS0;v>SDA0j%OfC=loTGslfJEmf&X*;$ zuvs>_&CXP${!iKndG8Cjvyevr&;5~q-_s3KXV<)zk^1XG)dbzlg%o#KV*TsRW2$M6 zWCH^Oth__m3s8s8FN$Uw74{w|SlpIoO@Ks`v@R$m0Xz(6K$y@5UMHP{-kG0eM1`ft z{j#DoG~oIh$%X2o5Fl3@-njAV5d|7gZeDO2ToWR2VMasB(kqg3`bk{qk|vp zO?AK1R%}{>3r`(>ZB6l8sph^&*++j%%9=~E;Op+|!(1Y7wNTZ60L|9_v-u;@9;8wG zo@VQ7@K4nx?A$GH4L{=7zCPsn>={!xw_8Jc5gtUrC^SZxwZLt4En;y`+2$MBl>#Gv_Vdu}==utN|90`q#TYppoaf8Vau%t0d zs=v~s^nq@x4csZY@hU}CQysA_KzmkYe8v{MJOTF4ufL*Fyq6E@hn%%)x`rqX6yz#a z>zfUo=gT%_~d7hyKu9KbnQL^Gy6^>kb7sgoOIa(ihkEIKsUVnTB#AuGk0~ai|k;L%48{o zJ$S$+Bo+}7kzY_ip5fzj1+-lISD*vLQjBsXO?-_i&mICq4N7L)__5&Wy2 zkb-7q7`Y4_L6C(F0Yy&L1qjEp5zL5%w|U`#84NbUYXN}+{CP+sw6mrFP&R3*A#r!F zTuDl-ci0D9XaGQ6gYVtDccrr`UWOW{d=df_SHP$I=BOeqe5JFq^BYrd2E=%<7Bjro z{h^VA1$qL236Aw=hwlVN6*C&seXzprDeF$30}f>q;B>5WP)n$#koQcoz?7Ah7GUzC z(ezsNYw++*rzDPVY0(#Nk8E@q7v|>X28-&XkoNGtK2@+ao7>a5)dLNHhNPfP92wErxr^(W2#hv>okP;974ZzHdq!nrfB@CLS+W?*WP;h6+ED9T z@zkcXV^7W#y)pS?W4W56z*_hHm=I# zeryvcYblZO95j7wA9AIo$3SJbP?mEV43rT)mp-h1uL+ zxJD0?BQe9nt0RbNyeT|7a1I0qY^zc^l2#`syFjZ(gG|8oPS4CNkivX@?>Di@P|rJ4 z!S7iU!dS=!(^2g6XxWmuxO9sU*m{;`VVJ;EtGyT`6!0R+#hzXmr2X5%Dc zSh4THf_H6g*tbb`W5BC{xNKDds4)-sl$4}mAgI=|qk7XN<^1b1!^yrty5$ekYeLM8 ztnHg7ksR1L9%AC?tOI_3K_skeWhywrYfm$i?2&%g@w@PPNg9}k2=(C^2VP&e{oyx> zFhDf1z^0J_Y={WNrq1&`6R>b#Q;KwY)p>w@#U*$_7YLsSgFS{Imjf#1+C7{_5~V`O z`@U#~dspJ9-lYpCPoC87yJi7QT7+5;m$db+Zgzj4Iv=m@)X9VDQ|4 zd!Oeu&M;HL{i%c-whVF*Bmn$}Fw=k}pl#v0L-kd7qTJhmR5b2&p3z-7aOfw7Et}?%l zN^^Lh=p^OGF=Pv><^QLi+71J}$FINsDkdvy2CoUh?+2^;-RP*zC>T64R$hBI9PYQ` z8YkkmzFN+&a_jj`$AB}K<6zG;8YHI4(cNA$Oa44ClHbMB&rt4mt_D7?u{j+B9gh2r zsi{F3515eaA%cA9PgOba$MooXi_KlXbCeU=>yyW)1bdU1YKUc+x^lpq!}w;&`7ra4 z^pX~0!BAjJUmB-)!T5H4mEKpi5(d!zAka-u{Fx8{QZ+B39@+^zdaxW_`^EqiB4|WG*9wa-nWFh z^EQI>jjJh+FBnrYo9Zxl+S4}mgq|6@HK2|DG?|JJIyz6^!vOaOXOYsDL&HG&jhGtZ zfkwh3JTOY;mMCf5mZ3QEV0v!ZHWJ#(y|#ZedFt^DF1-=jYjnA%}dt|t^=g8GAGOp zmKbhG9e6DHp*{81cw@W6I#z3`_Z;={c@V7l`nKlTl*Lhr5d>fsJ%^G9R-6pwo2Ev- zOKQxON9LxcH3Mo-6Z1A4g9!CEG6q~w*0Q(W_3uK`{5s-=kpAz-dp3ws0RieGEuLhV zadvB)JF(?T>^dJPh+=^i{4G1=#Ub3V-4#^?G)z5u|4E9aJ*d!u1`!n%P!jUW{W;jy z&%scIB8=NM+6(c1O^05Ypo~nu$Hvah_a^^SoXD614GuQxngb*YaYb6>YwL`0p?932 zY^7N>?mv;{LlK(MI~>*R`QfF$RC7%$2R_6e3n|xp(xf{cvXTglPfPoj=%8NErJOCi zUjwjPPsFMib)>pm#$_l!g%UR}O*S>)RHU1-zp_m`W^a^M5dqx=bYM3((Y9L!W5JEU zO%&9w8Wx5?5Wvw<7C?0D>Qp>1R^^7>1)i8X8y!H-OD?zO4+AOojQK_p$ByIxl!+q1 z4|CZQ=kGw{&6SgrGMwD&Jos+8#|wtVYR0!{?pa(Uy!6ee^_s~0`nB1N<-C>LF_-Mn ze#(wLuz{z2v$hj`6?V!`D1xdX=11K9PH`=IYI8BdGUGWTN&LEUy)0J|xBD>&{9Qdg z)F&Z2viR*am+&JkbNv9zj(%kW56}B59J2MtNcTT7hZJsG*0m31`gNCc{G}!i5Ti;g z+GOXA3CpT$!0c7+)?`3Dt@?FR7zi7(nY0CGmPuNUcrQF}rKX0TQ5+N9lS`@78;Nt=L&^Ye(UhiRisYN7we4(fcb0Vv!0iBhhtiS6tos4TV_t3|KP3pHwEG*rM zdePXQ6X9?;h()KkxtAM2B7iOTOz{rYW?WW&a3;@DYdmo37gw;&ljd$~A8D$HeweI<$pNQ|}JCmOi zKgE6it_P)CJw88~@W($s(L)K$V_50RZAy z-!q^uyjM7&G7Z>}hYuxT!TT}AeRXcjU;2k75EObCnmn3FX0xI}m&9OqMZdwB2$@ye z6|#;}a)hq%gLu>V#VKGU-y24sAr(N8^-Jzn<-^cB23t{@@8FN;$dn@kP`Rm86zF9~f_X^;*sq=@$x`4x8 z`0>C@fd%A1Y%L&HfWmLW8B8fDjweB+6PT5Olc^NjjLWmCc1}}pi(zf9+GrC0Esnn5 z7Dq`nDFA2g+RtB>bcW?Y=KlS5Zg%$Z+%O2OIVE7n z7ZnV#G%rPU5v4#Xz!QBE23n@#8du&-aSK4PSgc=1jm->+g#4nPk(iK>3y{XNkHQn# z&E3Bn2L=|pdlYLMHm(-1|m@nZ(bw)({dn;>d8!gWk(tQhG{JZ;hlbVC@GF#c^U`+~yYz-Xeok458MW6GuEiMPQ(%%{I0 zW^&BP1M(oY^kgU-fC{EBv#Pqf#la2!1ImX@XSTW1@NiZzd46qad0BnR3TWvo4AP-*$=5{X+t9RX z{Gbg@{*0G>8SQ&43x$tL`t}e*X&_E+PQA5&&EOoFuNohuozkBI z_E5Cll;Um_<6ou*~~*7!|t01)3Pv|@jM#gr6h8H z#|hQHFGgNGe)X5Dm65GGV!}+XIt>|B251JAJGNCmiMc8Df%lj|*TZWTSI=JLf3Y`D ze(<0%ZGCs!-w7cm4e}|ijOs%k8O`8Ctc~8D-d%~ySL-JH3&HVwb|9dXzqRJ42=-rz zS6h`r{2?Ia?G0P}{Twe)QMb+oSgbq}p^z0Toh2&fo8Wsi;_y$}9ZW`n-&ab+o5kFf z*-@I?(zNt6h2jF8=pMDHLX8muFg}QXl<=vg;Q2#(VB^z^?gwk6@De=0(40P z(h++^7`z*w#ZVBnryF0}Qw-0Wn+x9?|69O6LRMsQX!6PnmiHnnD_EVhqUASJM6ums zK6Xf)k&rM7W(orARpfwSfdxkW!VioRiO(`CK76o596#m)dOkrJJ-A?}jKkp#Uc7h# zNT%97NMBwpyoHHfd19i-+E+g#-S<0!z~Oc73+S;XTi$6B@SxZ>hwMHhBl6~k1Cq%M z&ZmulQ_pmxG_Hz^U(ojQ>S4cUwyoVhx~5`YYNj5_&e-21D7UckNbZ$2)we9dTRYB* z4Z0@?bdo-Z_Ge_y>R!6^N^h6zPjT>iw*;UCoP^{WsL~&d0!Z$8| zb?433->z=%_R^A0jW2dT#Q2t9&Fh>TTU#SiZFmpAl>k4_B&~4KQ41CNQ-4qst?8ZT z));U9_t;;x0qMT!$yuMa^)6S{2=+qEV}aR0{?~27Jc5EB;US=yj*5;xqq6aC<3vDQ zMIV^9j@ZK^6_me(b9s);r>BUFgANaQbQV*S;X#*;ULH|c3IajslwM}=hh-W6?Mnm~ z1;*3=`nG2HvT#k|KL?w0K95$@-+xyw`4QPziahDmcGvVjA9wEX57j_MdP;O%PDuMT zxId4VnVubLJJ9{}43hBwx=t1L{=Q%E6u7fJ61V!gT(aU@m7#o0X|2)b1;t!G_ z&qL}lm!sajI{sT8jQ%wzmjcS;c%s=-JJHT=@AqfA?%MLwfB$!@(e-Oz45t)gx0oK+ zx&gAd!_F!qdM&?%N$KT|^$X?(NnX7qZGK24NfDiRx8q2u2 z{_C^IX#OySi3)#Yi$D<2gl$F5FMLAHPUZ$#QR(CKB0nQVdgkN&{P(_Xu<3<=m}#v? zAF>suo^OqWLTGdFZZWT~zx`MLecF$cmU#H6%6o;0^px-G`un)FuKfUr;{JR#zFvf= z!-%*+z2I9H`2E2;HTc~;+BmA8-jAb2sGh* zTeSUFXPHc$u$7M?n#$pUcNbEjn0;q1Yk~NsZ9vQ|DpCW-3+S(Y&EPS9Rux1Tr2I(YO#nOCMn__hoQoKCk|I--85M3!S4@+r&?t?vGRP z>{T=OuG8RDfyOOA#zhxnBcqD3v7@)=Ow=Ttq$ksDhD( zMuY#t*o~U0se{%qJ75ds=jVUo?+MOm_c(p}>^Z8unb|r)_5c0GmzsBXW5-QUbQB@o zV0(qRTHmzr!bR%=UlPo*f;F zOJB^1nVTme%6n@|3R>E?rRqpw+}%0{`PT_Px36iB-8#xGlsWm`5U``;$F150wg?C- z#mIr)*Ph#91w^x$H&*~yncA~`xWh%#ch~IpYVt`uGN#-M7AazS`?a-lfS)uenMe7S zWGSxX_3NLhV3mM#i=$O7yu9LoQo$q&X>MitYs7`N$1g~Lqng(%Q7-DbJYgw z17zHpn)N<)Gb=MO2q@O~a&citNa;v7myBFVJM{C4#?4^?Gq5CGiT)kxiPuGcpMA@h ziSx!($P-+$pe?kkO-B_&2&fV?g z&(L1n8;FSrl{+_Ry&PY&Kth2o#5xf%@sjvYQ_&QfMIStZ5qT=B@n!Z!Wb-X%m{AOr3O`@Mk$G8IWx1_W* zA>M!wv~pa-_o6S|i++Y^8HC$Bx?&zTz>QwH*jwd)PQo0L+(r>-KYBrB~jKRq}M7$Ue@gM!A>8hsYe4-zp?a|o^QB5{W72Mu zq`uG0)--S7Csmo?l|5+xVJ`AWb;>-U&5E!5S#oj-fgSZXV7kvJDCCVpA?uh3`(WQp zIWK0L<-r%AIeZO6^4O4d=hmXi9>W|A}x*W(KF3)y&K+l_@PPz0%nsbo#t+ z?k=tvPn<1p5^wNqv1pC^%pC+227_@bEh-aQI9z6*Pw{Gc%hQVekg3{8M~VuX5oS#h zP*A40QS z$-1PSJ9pBj;!9;1m0G$`aB{r($&--c;!gJ>@BX5L?Q^X4g@IX9sLvvJGn7l87j>+` zq)%o2Zc|g!ZFlQ+EWav!+7|ILiyXENJRBw9_=nA=1<~;Ub{mLgFB{a9m9eJaZ0Sdt z!FMX;HWm?XV=ZB3+PY&!Hr@^Pb>nI_F6lwZ^H2r9xShbz4LFQic7559>2e#piTInZ zTUjts4KyO@p0SX`mQlQhH2C^nDpx2bnI)x#b(CxCRNHay&MTx1L<=>QCY?#1kK%JM zyBIIn-tfNccf|F=vaw2k2R`wUgrxk&iGQQC6Z`P2wgI<^l5*2#r zZN=@@fxe#c@!#wq6JHx^3-fDyG&(-Cc$Q{9UoX-N9DE^HSTNTu#ln8FrPJwXa2q=R zE2{jXLOU*4?3)PB?OYBR^G_Im`mCL^qv9LA%s?cSh*Pz-85~^c-^q|WlI@7HrVp7w zVN{&Ohx?+(#ARiz`Zm|a5G>H!!kOI4J)&;6DajJ(MP_O2x!l>Yp!FWPkC5mRBobeW zd~e}o=JXgkl8}&4E-D!Dh9`3xY}GGcep?IRetCpVKC?`xFkzl8eOQBDPdSx&L$Cy` zU$(LcN^n!tL<$}6P&=vK$;X}SlI$_G zWL(?!PidhhE}h_qcFkKi-YFJwqn0?4amtpe!M~zwDlF_%z4s2o0s`=65g2ozk8p_g z;fhTosb(3Z*^Lvlvw_%CGOm-^mz1D{hQ0f^aJ?DI^!eBEriM?w)7f9{1;CcX3PDSB zWKcyN(a>nXK9>p_iokin#pfOMje|6z%*$;nG#nys47G$Xydk(IXABNw`}?z-L-v9Go_s6(cwT~mq8abZOz@{iS~allLylvB zPVyst4w+t9@UoR>N0D?H0xBZ<^5cGp9Of#n_t+@?b(0G!Y}6cL42ECL?rUX56FJS< zqZeddAh$`T`Zlzu2f|}k54pX%i>G&^vtrNB%s5#$yXP0^Dqexh+?hTdwEoqVYT)q% zxQ((eRVsaaQwh(jf6*oaDYYm!1)2B!Y*}?5j!S+5kXcfoG^b8f+Zd=W77Y%{2{?j& z{;*hn)q?!^(WgmC#j>RqX-rl){cOe^vI3w4fR!&bm^D(E1c%>BXTvt73Kqe*8#-y^ zZ+R^~&7OLEc4=j4s6AGohSHZ&uz3FbPM!k?2FU!QxdjE9gDiT+xle%r7}k7@C(7O! zyyf_$dRW7ei;GKJPhXC(xY#zjZu#KlOP}#Olw^^g8|R$3F_SXnGRd=NDB}m}6K?))A?*W35@Up!wacO$d|9^lILe%m|tt(Od@uX4aRfN^jkS zre&1oR9(&rTYXean@%vmhH-D0fFnfUc?UY;2OU@!tm=rtx&G9NlMv3fGXaPCSlEZ@ zfVQZDN-}dgZ*t&pSf|=->o_aRuU; zbA|@$%T1x7=xgu?`(wdJP%TYOF|gp!mh;OXT;9dlivX0ZH%tMG9kldat*pEPj&=*# zJwLH7IQYK1u(ZDD-QkpHEgcGiz8j}w6~YtuF5S`lNgK3x4iZ`ZNp7rTqjjl-fq_l1 z&QH2U7#b1P!eET_b^6C>T5$yC@Y^?UiXzz0Pf<`E?kI9sX~jVAG36R42{ehySV~J~ zxTVvG>Y9A^Dt2PrM}IdIAG2{yn<_wf*C{gyD0TM%yh9o@n6ZD*5t?;DEyN`xbOEar zJ`J#^uhBE~?q3d*(ovH9qb;6@1Ah#wW=DgH;pnjRnm--4kz$_^!PxBkM8fMq7s4*$ zWN`(w(RlS>2R;XtE17H?X$jwHd+alq@=XWmYPF6Y@@<@T^j1{wot*vQ{2~SW+lGLh zNK5&=RUl7(xHIT>koPc8**mpOKSG|gt#x-VbySZ!`ScIH)H?+|^$G2nIci~P+$L5H zH&aUhJ5I2lm_W}bk3KPs-?`Dadk!t&B}exp)|vs-rK#)*Eg@4VvHpgJFHh;F-G=s+ zvck(*;XSZmaK+5Pk9=wDK}yf?-076}_3wW(P|7yQYAL9VVC={UU^(c8feG-O1%0?O zaq^xUZGK)|iPD}whl00p9s9aRv$3kg7_-q-I}+Ss@cb6Y7n2l9;fG821aQU!pH=ks zaP5;ukyP1Fyc+4dBsQjnL3@@N*oHANDCOR4w}XHg%N(My;D1-6?frh4-v6! zEpC%{v7CJlfgqkteZA2(>Q}BxN)KrnM=s~5uzH3nN=l6V_5Djpu>YDK`MUqg8TYih zuY9k{zWwx*yLT`8NQYaH*tTOaPGUh&FfDY|VTMYbA{!?rWw^O_y!ky5ur zfuQ#N20Gqzk4Q^;SDkWs6hrpFlBiRj?u^HAa#54lj4d1-5EL@mJ$7nkMYRCRsdww> zm=CsCL*jLJ65k;i8*e|NYvblPIzS#pp^(!u3dMxugo+sxVWUGSiS?jYZGC6ZM&p{t z&>lw_=l2k$8}ES`iSB_9+izxLQ|dWdd-|lJl^enY9Q{;u_iiY{7e=Qq)j*p?0Ky_q zup4b;aX8H^aG8Rkb4GNEw}Ai5*$yG~l9Ap9oz=4Sk&t8M|nKz)SX** z1O*3|)UHkv`g*$n*}iE?ru^rywHsGJxhx0%-3%s_imj|NPUu{+H)Gi7h>@Y@mqg zE6v{mdMsMeH7@|!>P&LyD#f|iVOmhH8z5ymF7o>exk7B(GxZe-q zm`A)YgFhtQtWJ1U)QR~d9jZ$I(5P`V3Q&~0Rt3w{FW}GQ`o(LP>P*uBkLmOc zh}afY)Yf)F7X*7SH$M%`HEHd;aS5>d;1Gx__k3+lJodL2dubTz>!j_ibqhrfe_2}f z@_iC;ru}FaIR2=rq^bvX&G^!#OVy;XwBN+5WSIO%<2Yqa>%=AI*EUAtvu6|2^)WGb znpep>gl3NvmTzCPC%PjC+0x$>#5Qj`;h{kg(v`j5di*Wdu@VEm@Y_n9c5!KNa#`#` zBSX;1Ijzmx`F*`DsQArG-F>Hn$pl8xVdJ;$~ zV**q@iO*6!v8w6K?Sd{i>cg;}k-mwc?bJQ#-sn#?^7VZrA|@hZdE%8`^zU`%FumB- z1qpK_qh}k9FcVA5hvS$+u>Jo{jB)K3ECEB=?T&KSu`kio$ei0|^p2gDIs1M{?MqIP z>RN+hPcJy&E4w%Y92@ib>t{{UI-TNjRO{;1v|g&jZKcRuz)qbKd6P*v_4-BHJ{`rQ zhaTtmOx?SCHz^6+WQ{b~%_?|tB^ni2j)_?Q``sZ%T##Y_c}Q9oMouN5ogNQwR+(ei zXnUL5+qLT>Qr`;3kj$Ho(KYT1K)fI~kTT^sE$rBWjB;$dp5a*k4RB72v71$~UL-t! z;BhBFeo&zZVAzKguoepqhRiJb+^M-reyTyivd8XDy@&Z0<>l$MFZSPPJGyi^z-VCN zR3E2A1T??IE&6A1+#`va$+h4Aw6jaGQXJ7+~K#!f`g4(4V& zJ*Ug9@`anve8`_$O~JyZj`~zYl{wc;-EUY@LMUW!kUYxQd^6w)CVD4cPE6Rx#4Y58 zZ!*b=CI;?Ug8HGOVj;imn4J5OC{E-*8v5mAVNb($Vb*&7)LE6+L;8?!OtW5K3^+<; zwx*}2m-om>$IwK28aVy#!rB_F`UoPq)+*mAzn~?2^XC3u+-cWa;9eSFKR@Fr(HLM} zF83L;<7ewXz29GlU6z@8x}e#;V!|xft2K$;oYap zHwT6?!#kbO%ruH_n3;b|dn|s*1KEowo1M`O>xfmb4p2w80aiM2>V668jaa7U^04r$%b8|W3w9rQstx`@uVAIuLqna6*KR9S+ zfHX3S6{}neXs?;GQgmf<*HWjP1}m+DdmY_Z&$6-g;|cMDs;d4{tBdNM6I2uOoCGri zmlE_G&nRh_xF@Sa)?zmoi-A*M3tq){l z>*jCPviLPe0+%9ZH=*kCTk975I@=%cI1-+DVzvK|XU@;F888tnFK_{9$u@(vWZgtY zgpyBZA8nbO4UAsnPV&dvrfxK%{1K~Y{(cUtk28MVHWN^Xta>kSOf`zJhKW9ZK0N8B z0e9koX#LQ4gvXD;U!%Xc-6P;zeGUL(&N`0-2a2s4!47jk%BZL{?Y%F zL8;yM<9MD^o#RM$icN_7`cr?&bH?l2zn}(GV}YP6ipzaBSbn=DZWEIe6PXY_9Y&Tr zOJqzSX}zj2d)vUL0~9jZwf?K5;bpOF_VzEl=0B%?Xl{J!#z z8YGh;hk4H@iY)7!No0-}pjM;f(%J*@@pP z*S)$;IHlZ6nv!IUVQ7sRvrSHM>+7&|fLVw4yl+rH_>`vQ<(<~h2RpeFL3629%SF|b zko_M%Jn6U99~YCFDyRX{*Di4~-jQ^?H_13UA|fKU)?tE|C2|6>$>!D;&8!G47OdwJtn7w_ucA8P!xBEG+ z&J&v|#c}i-Il4)FNTjk9AjA=)LA`C*8he8vv`#6@!D<7ABLM(hDmyCjx;({qX?H)q ze=sRJ>sG@f^81kNYEMO3e+%#rK8+Amk75Bc_jXwG=&u66R<%V-L^mfFqlX_y4w_tl zsjIYpLF@S$>9A@@YTQvLFO#kTcExSs?cwzKN8p$JxoD1Hwvg3ZaHJpusfD2UPhc;a z`2#sx1cEEae$!MjB~gw`ImHeJZ`~BeD{i%imMpA}N;@*NP#+yj6X=SHiv3t5?>_D> zB;=c*?gxIarU~)nEi8W{KNxy6L$!wzI#WU&%TP}| zDRb%k*J3v?hy^er@@i3ov5wEt~a4 z^aZs$nz0@vHE6A?qzd?>#2{2UeqR`}kY^h>JBK+sI`U~Sh&v3;^oQp>&@nE=s_zJQ za{1_4x-r%)y;QkS&&Q_%0<59A6FWWL3oi?ZzlWL5*scB9UM^R|U1|cETKPe>->mi> zKW_-9YvGB2FU(M>nB?S_`9(FrZ>#NB7El9e_uv~$;;ia;w_wsM#+J32Mf10@-Ge0# z_q#^`7T%)%RV=l%rZ)(Ekdi5Oqid!@$~YHI4IOEcd|&!SNt%zpzm_}2&z)BFqce2; zfFMUiLs0T3=oP?T;|J2*HwH5rxZwbX3JIA`r>vUDOGtJCR-%r_RBR-Ct+7M3L{=#O zvP~||dC1$*V-PRU8C30)Yir^EP(e{q{&n7cwFo842xTvv)_mBhhDTv+J7NwT7^KE{)0DnC%$wfQ?||G5@YDbqCwN z9%bIZg2u`!ww11EU1e!tqHO{ZUdpF{@7FoIH_c`MDjle+S%IAZ+ z`TiF;G8a~MM|+N}m;E9L;Xv(k`*Az%-hRR-M>j^eq{mb&s6K{RNZbkxCv$*ZEIq~t zU{)U>W28R6tBTG^xzAOgX{8l)mDB&JZ6`!A#In) zJh2~rb+)&;k44ugbqbRF>-H{=CkB_^yJepX+N3$i zg9dTq4V+*qV^v{&!#j?z`s8I;DAX@15rag3v+<9$*{8@#!x$a+k>c{E$g=MbO*N!W zqBQvT6SwKh)}V1RE@b3pwz+dc$L_DcE`d>K^VDj~srouhf9uDOZ#Sls@gLjUOf=k{ zG?3n~_$3{0cK<;V>X(wzl;^7v9ILqHT*a6)8PUJ$l9IbH9@5#{tE*^rFojR!Wc@|x zl1U`UxFzK>n|TQi)P&R_&xQBzYfpdFEILo9Q z-k=+WP}C$=cF0aE=%fb5Z}(eyUCC%lbcxQ%$$7r@+7K)%vpHeNV|IvG-DL=(F8v

    ?Yq6{lX0VAb>cX)f+q)?(5~okYOgMChKxN*o<`%22ZetF zPOqWigGaxgc$JS`PyFkC0=q#CucJvp&&8@{ zZe(Hza~rWKDK;fXYow4VmM6?!e^G(f5yF{RWdWrhsi#r>{;qvpVTc=r=_+i9jXTGW z1B$$E5}TA@`z!78q9&3Aoa4EprI#CaF9ovf}E63*NQ#RvfiMo_97{7k90D z#A@ftZ(UCWLu0V1SUi^5P$5=@%1ZGWKUwX8@9&>oFd5CjY~+R2nWN%gMqlM5<|P2D zf^_86F)5i><(E|cGRHW>5%FBi;ueYAEpef^sPgSVmnm4L5Z&9(6ke}2?q^n)^VKrw z+mroTpQvq+oLuy-Uw_EgLL};dRcRGeqCG=I_oR&=79@)cPFwT0Z$moPDzAxKMkNtOel2(gay+3yo$xL`7GgkbWb* zFxFoAa)FG<5|XeBO4x9-Zu;0ZG}L$)ZRx+fR0ibjge`@Gh-|o7ZvKS(^ zeiN?G@BQe?x34)r-+UJfO|cSwQ5|B{x`^$&yAAB`K0?3U%d4!l4eZtWO~68*k|H54 zZc@z{7DgbvA3l00EF|=KUMraf!eyaTiWYC)ya_%W*wYQoc{uJsE_4-+e*=4afS&$J z#Ox;=2gowE&aNDi_`^r`=f3**N&puQ2vlo(o6*IXA~$X*JD)#iQ2*Jg!u=o^P#$a4cN7L;raJP#$ZEwVCHEcB!<3TSjB*!iwAG| zTP2DL3MKB1e^ypkFJSFjcb*m%jV@u5R|f1BW~LGsjMdb#iR*M)SkFYnD0Zd}Gnay_ zow8G8tVsY#-T7_y=g+@@87i}Q-O_WVO76>*;Zt3{Unk@2C$f2>vOdn(gS@)3BBR53 zD?#e5w4~6xQQe8=aCfxq-BY!rWisAB4v?RJCbxe1lI~tyky}5Q1~|b_#PMcuzoU_n z&BH1>U3SY7j(yL~E6ufkfV)iwNXUXefdgJa+8;wlZOu<9C|nvF+s~exc?$e9zjFzP zOOo0Qtyk=x%hp$8TD6V>Z{E@89JRYVZv(~EVnFPto^|*MR z`XA)O**<^3OJ&nek(81!lx=nj{!ZM&8wa<2`M65WU?vP6Y)btTB`%)qHQ2I5rQ|{0 zq_M#qS)McrLHC9cDl$HK9Ylw*t+7}1 zG?@$or#A^wZsRgQYHsv&A>%22YhyW~T{`|z(TH-=I){;-WqO=tU~hKN`!xgf_>;^- zee&0Q*LSKhmu&LUvoDVhh9cish2>%fa|O$V6*QuxT{O>!9}IUI8kLGNxRWY>GM(!2 zfg?m>rx2t;!XhH(k&$IVqp&@zT<{dw)F}5li)z|Thx~lMIxmiYLG70`E@?i}d^PW# zH`#y|RFO!D)b*T&R;+n1lV{u&-=7{%Q{2AI^|otZpX7f%$hcY3Y<`_04Yye#t9%{3 z5B-zA=K6|+F`_dPJE^1MNAt3?2m2>k|L;OR0Nk??$_I2X2HDy%d|+YV@P0NYp#uZy zs-u&Wd_mm~@Y&0ZZo2A1BN&+wZ?6s_Mglqo6ojO`?#|b3NVoelb`$;D&?KJEZJvx| zZ>1i*vwRXwA3o}>< z`v^=6FlMNOa_Wt3XPqiwThfHmtg37^z*j&8)3w`L&2eRBKlJT;zqTCwIyIG@Yo~oa zjCpH7Gf@_zWvL?zd+WQ?koNZE9p_c%LW#A44fCI& z7@C}#Y$KHC&sQxA)G|k$5>_`4%K6S6>#dkeQovMw(@J!L_9MT+Xjl4uY7=?6WG)!H zLK0!(-`zXcRQa~Y9kaF=lu)?kijO^~E;w*%+qPuhe{w@zT)#0=|1vW$DOBEDUj4&c z=v_MgjCsZ<#cH5+Wr5@3!p{LU{YNmx9}d+W9VA5iFcA>ibU?==$M#{(ZC@{UlccNEdtjY_w3sZ z-A~=*pb^Qf=fGXC4x#*WbJWCu$w2Zy1U_*iGs#@4D1 z#3ZS~d-oKj+;3k>oX4Tb?4VWCh=S_nm2T=QX$#~H!#j@NltEQu^+q|J{`z0?zi3ud z*n~7Tb`)5G5sHOt{QzkchgA#XOczYu%xOyYdh0O!m$$M$8XeZn@LJS&9;)lLXWK>V ztC?oLtf(-B?W(%Cs3NscSxK5&unS%P8r`Xrin69ym;{rw0SQg>_$Sr1b>D8KwTNp5 z?ug2t+(v7`r1Q`~REo;7kS{y!(1889U(E18GeF@itVkPeUv~rhj77stdf#wK$GUEF zX^1_ybAO;|nLf0lxSUZaabnl(L2E=)b@?rPFTolBS){Yj+GdV#W&YY7fRyvrv zz&g(JKF@N&Q?jRTq|P}fmj@oWgWc7#cxIo$Rm0Ib=e;MQvcTBT9@e^AwR-0^YYe1r zBJi6XHsA6Z#}A4a7f6>1>ZbgGC@*U~b!RZ<4!7V34(Hy|s5_TlpK-3i)&5>sH8?2H ztQ)Uz@!YxYDSxvw2~y-e21r%khdsR#VYElepO_pzgC)X{GB)=S6w|5&bdK4Th=}Bu zcv0vAP7VujmY9BqC9Tf>57AHNjT^2ttY+=sY{oG3@og%B4}B5FFJs9HXDb= z4Q%FNQD?*2+QjYOKBpDs?~v>LUV1D1lXW`Hc_82$?_l=S&yJLO0<^PZ&bo(6Z_Ar5~chsTNqZF*G6sar=aqZ)&Sfm zZI24wYp&O#S7&%`E6e1`0x6+ACDn)S;71!+ht7ha#$Xk?`uzFxhxhL<+Q$`Tc*E0` z@;mo2R&$}O@==(EaFg4m_g&IR-hM<+wz!0d`5VR#Gc?Aytacm!kSxb<`yA*_|2l9e zE2EZ8IXZOZ%!CXC7nzk7LF7!dZk_#`x=q{dF@x1b>@(l@Vo-em{FU|J!|8SGL(7R{vDk-Owtb>6Af<6`;3wc#yqn4Bt zJ{Gp2=OuLb#MrIC!=srG{Xn^(L!m!Kme9a|@kS(QNBJ{zH^<$-EqXbo+4m zVsWV&p{SinEYmXK4dV@ZdPLmPab@dU!)Xh*#@|JeZ<-`&p}En60Zd}`>ammBaDSgZ znI%lg(g%0TL+Y(}=MI^rG}YH}hEhlM@*^qPz|lIAK|-QZ@M(TKz4xHHU=y>#StfZ{8I0D|J zW+xCm@UkEI4=*@nmbu`r$+ukPL zWr7rwrapZ1Yuiv;{;bnd0wZa8d8xg0Yk_R{#`F+3ch;v*XC{Urf4{c*`eZv^P=mo> z=%hF;R7Hg+f4?dA8w*RUi~RRXF8O4AL+C_b(&e9n>R9jG?U*C0j`GmBS=j52({4qt zUR^Pem*qE_w3+m3&UP8e=;=9cFnX6UwT)kw!z1mQukTA@<=gWK9FFcW-@ctSkQbI^ z(J`bapbpd5FE8;8)a`uE0^%OUlRnpN>59^)8sNQ%o%(ym<@qsBrH8(FZKYZ;x@0mXxA#|Lr*U z{p#%-9$ki>QUd*i|B6zWqOW!_0g|!97)B#PZDVy5A*`sV5*fMwYHsg-fvXBS%hNdE zoP*FqM3mr!s>zpk!PQGb3*30w(x<-O84$vbzBSz>MD_7T9J^YbU`4v=C?0b`&X39fO+K1CkcVsQo`stx~0#U zRPPIzQ&F})0*)@d^}MH}U2kk`kKvmgbSmn4Ym;wy&Gl^G?AGeh(+C7|br_Rac%(ruURnlEM%aLDb-UH$jp z(&^rt9*CJ%E+ivw^zJU6Ha#0C^jNvgWCU~SJyy0RCb2!%A>{Vl71Zf zA1)H|$MN=WvOa5(bzK)VTS?9(wvX!OB)MnQ)Yc?yq4C!ZoTuod{6-!luj*gfsCeP9 zOGp?4qDAx{%^a*arvb$Ql%%z`?Nt_u(gIx8uyyB?J%S+^V3*V%1SbwcC#%r7&@vx5 z`$k5T-lvD1R=QMlWftynJ^^R07w0myF&!or4v?c!jEQ|WLMzF#w@*SKUMU~4 zz=_X3HHELGx!L@_HCtJAU6Dog4Bi}DJd3RId?;4&4OO)<51-O} zflNh=^e1~0bN1#SZ4Rce^5|;Y(L2QgoKE)kT{?(%{M*TVLnwDP|GHF5qs!C3Winqh zS;$RXLeGv{mxynYD@i@noAR)-IFwc%w6?YKYaE_D>^IhE5*vq13k}sSG^;gUz~Q<) z!!o&l-siD@a=wtR<=1x7cjc!2soNr(c*Ej9BLL;%m)^QVxE<_6IJ}nu22Gid^PRbE zjUO&MZP1j%>QG0-`wOm{l#%>Q;ypSkn#3B_ojd)*>L%MvoYt56bu2yVciOSiB^{2{YSqN>!$1ZEL@S7x?ds{i#) zrPa6axL_w|ZCwNj*5RwUC!vfvr7mEqqSi)e@7WqL){DUrLDefX|}SN}=f+H7ERL!Q;ngp*+hkE5m!X1Fs?X+v_gl{ywwj zamYGk&P(#@{q1_oTB+N}%;Kur|2vm|Se z`2`b;>>*UOC9rbTpl_ZG#zEExQzYHq%MiWD=)%Boyxfsh=$A+SlRtIr9N)|rW%jG> zI*zvA4^IGU%Yk0ZFW_QmHLf-}HC0iSl({EWblbM(Z0u2t9V@4D{QSDY7zxHIv#dm( zidmdQu;;eNXKc{A%~5r)V4)aq(W#}f3lz%BvE3@Hve1*-55l&w?yomk7iarvEgwjt z1H-_xEb32^^_KLnmC%-77Wbo+PD{F82m)jza}>6%fq-tGmN>W^*80hnJ~Ghd62Z9y zX4k#$`d1?dYKtxh%-)u!MYr9H!A3*r;mUy(BmN6UEN~NgsieWukoIHn{ZDyMTT$y#ynx|_L)pokFZ{ryo{iMotnmlN^;tbQji+zogCr}Atry!77!HXfrC zgHKgcdw{Q|6XnUg&w*I4v9In}84&wl;oJ5kLAPE35U^-Qsipem3H$sqV{gOXs7b8Q zh&uFdnd}#t0olsdj#eWFUwCYnPoF=32_`ByrwE=pW#CV{?fCJ_y*)GgzdXI2lHqSrQZoU7|`xVmk z*JfO!B7z{bnIGo&Mj)smPmCAT#!TDe6((UW#`EJ8-%jOpy-c+$QKwr)Vyb*Y0s?BJ zT)XZ{E8hn&&DOTei&1GFSXZ}a-(KS@uKx;Bx{wnUhs+2|^tuxDXJ+Q%BZnu)pURa} zo$wzAyVAA=DTndOw*pubz7p8nr2B6*DeK<5##cNWYjSgRiP|gjgD%2TnD+Vti}zZc z=a@=#17V7v+ek5|jO#O(>Iq)B;|)fJF<^Deqb9GURR6G_+d^*0&RkE=#cTtJ8WyI| zK$PKp@aR`iI6bqA+g4G2VIzI#&h)sUt;|5GS**CeJ*6 z3qh^x*&mSd$p*L}m64~ka~0veKmUAxX#d5#JU~hMr!X$`@!W_yV}xjAW|7f1eEDy$ z+3-Ie?%WC6C63zAv%seTY-o2k)nGw>Sq;e3qQJxLH|pF#TjOCK#kD(d#jX{3r&n_! zW$z~t$WRSXN7(l2Osj`0T!p+xEDz2VPw9X3%bR~=(Nxo93U!hBb3NLW!ZX)8i|!SP z{cwoo{^dx`R@MF#Ps#ry3Jg~YD1*DrlHdoc8x{I_MTz)GxguyaXE%tmY9 zU6}R_n72gZoG7LLl0}Hy=lU=BUk+kaUN0?`1{Rb|3DTPq>+%@nzuZMv(*Es6&3f+K zs*iqEcbF)mMrAqsTcI!EH0JkxKMA_-m@_sln%CG~>5eky*>?utGl|1FoCb9_LbXRa zgF|!a;9=D$UK1-6+`KORi}!wk5jO6F(l$%+oad}exzyp;u-l!O|IdNU`gIqEj&u8b zVGj5>d6jUT`o7R4O@NggxH+X9$^Gl+zqtT(j|Qw66bh#Y&1dGHvHODtFb}3~G*oXK zK61z&b?ajBRQV7EnkTGDQJ{lMlnR!JJ$zVGS2wQR*6B62(dyjRgl3UtD$&IRMw88X z`4=~t7#RtlJU1ew9wyVlf3A|wRW?YcMJedo?K|$1xPv+~c7ov7IR<&1!J7Ux66F0*+GW!M z^a?B*9u~!>dinRBFhqOzoBP2s$z(<&)6kK`o*6)-B4$5C3(Q7GDEA?dOq2EX^=yVR zb2C~R#W0WZTzqL_zw|X%3^|G>+(;i}@(01el9+;|Jyr5y@?dBKf~U_2U4tnLQeJa1 zM4w)69uMsZxoKI$fPkbtX50&*vuD92zCP>(IZvu;Vwg3M>i+5o9!tjOy?&SE+0slf zX^v37*xR9qJZ1K5<(1+bCB3KDn;aYWT-asE_|$+Q*0NS=@k6u}d60{fN7sCg7oG`C zmRTdrsUV~8@9sW1JC^?C%LUcT5867hnbj&z29PsH=FUy3(%H6cOSm6&|G#3PdL%<} zS1V!g;^F?ur)}Y0-ZHFbeAhO?hZKMM%twQZmPLEOAFM56bhgAJyIQ`$D;Kmf)m|@; z+kn047M;wg$e3x!dnJS*<>%*@qMbs)WXC4I)ZtUbqFKPgCFhVK#{_XvQ6un&)zr}F z?y-w&85%n0W(362=VHE>oQ#=YB~y~+^-Da|pW+#B)rzM_NRqOVKp@Xfv|_Ow`E?bG za7=nb9~Rsjy1Nt6Lxl)3&3CV)Z>wZ*<=eLsIv%kxaKM2LrZ!d0U*nCY=F?Thqen|y z={;UATWGjnHNkBWCWq;+U=h!`DE@o*!pcHdc`z>JOpp&8tZnoOf6CdN^=6~gGt3z? zkH?zl2cNichwo20LmSXpVJ%+*vurkdzyrO=ABXVO&7!?2XWLi|URW6})`b~w!-lCT zb>^(0m>HP}r>?Y*yR04aw}3VBP6>wQ_J4kJipcY52-Hm8Am@0uzrKO^o^8 zu2)h#XR70H^r+U>Hcly|M+u$|+iZnS#>(`i1}q8dFw)0oX4;#UUyteNF7Vw3to~x<_A`&jfv2t_kwG?Fu*(!9<8?m=xubfC&*u@rlyZ z(p>p)kVE9$$@-ac+xE^XkNQgxp*Ybf>{^`4_N2!b?@QW{d`ZU-WW>ZAf>AykpsBDf z34+}1F;QVu^noy#4fvT93`}v zvow4QrnZb*S%%J00QQz_X zjm;Yy_)bCnQqvgdR11}oI#!{R5 zj5i<#!0Rsl;`aZV1p#7W8KG96k%YrKKi-fDeMsX<3$e2VAzps9ifqB<6Y{2ekBUBz zBh>L0R?duTQOSc+Ps75bsnugmvT_TX(7$CceyLh)l1&Jjc2@I;F6y2=OOp${e`uT* z73t4O4ZM?JJ^mpYy@26pbtJBasfBZ9N^~k{ExRPHGT9LwT|8wqr$HKU!)GGbo>gM-FFECx9E$j5|?l%ESNM9Yzi;O=8505vy(j^gr zgytWjwKqF8$2weAZB^9L5Ou@3H0b+1-e%A9zZn51x6CJ>@S%efO;^5uQ_+Q`tnBK! zC6O>b=?yAnsMB!1r!=u6)h#_&?983J4L4rCv}sxC6_Bdu@VBoCKj0%w`-N(cE z@-B=$I~RIf-ZGG9%h1g0j{!Z+Rxg+a(RbY26n8d`7%mRd!_Dyx`mu~_Y1cPsld%&!?=QK zHaF#D!>}hQ4k(H9y*gVB4X3`&&d#2VXtdJ1{qjrqH;1#MEiH{bcm*}|AsJC2)`O#$_GHRQ zwBX*TtY;~TI+HxYLuAUr83BzYSw5g>Q9F8X6xP-~dzL~iL#S!b-Mihbr`M3EP$xzB zY&I=++VMeAJQ|Zs0VhH;>cpzwN+g@-0RPdMiHH#sw2@J*hg@$8OzMurk#DyuxKv{t6~9e~thX=Hkr5huxDBPkm2q(lBpK z&*+@!%?!rnCINdN#r&i)2qQy~LE0(vTh)E${utv0`azN;pMY)1qJrn=v%Wr(7@V1Z z*gl7j%AtiMkL(%v5;}MCB3B?1tBi0qy!2k$NM1t>nEr@_z>)Q*q1?l-Du;$f9<9td zI0B4qKCK`-a6RlPRti4--OT>YoguMrF*$lE{%uq_N?$Y=ab9zIzCt}$zBhEKu$-8s zA*g#N)?2FaD08)xv7CyHO{!6W@E4U8&Lb~$rT}Yc&bUz=IEv1qPekBKzZ7kN(;dIY zbgHsZIZ4=tZ}o10XTX9I3q|dG^m6 zCKkR=F8#FwMt4mk175CY=iD5@@3-B)04SvitwZBhFlMy?hHlHRghh;IgQ32G1(PvW$cZ%ge8(%e3U8TO z-d}w@^2EPtC*P&IT~-aV$8!g7AkGMVH2IKr@#!(iD-w1c`k;a+a|!F`5W)3xCe&vM659hZ;t8HwR72Xr2-+O$Y z=!}IfYPq6mUPr5>sc!qWFQ+$)zGo_buSl6a``Eb!#3L|4OtU-EyMIhza($?glXN>#v(N}gGxw>A-Z#F%uE51D1YiVIV(Unt5m>!!QhZLLFF{M)y30QV4R8-0CAEncwd1NZd++ zo42E(-KnLsvv+kgX!F;RN!rIT$t8dAj9t$C+KF;h0qgDWOnYGo1ftGl+{rM=G|6Z`vuzyBRBS%+ue zL*8GMmE^-eb;rO)=V3ri0Fmd&_jiL!-@W^TNBLHU@GotwVI`ZJ0iX}wxo7umZVY9J zN_&ckdG;^V3hdVe+|5V@h2d52mmBm1=8c+5Rd0McwZbL!QrxJOGm*z7vtca`c4xSbkJ4XVgRzb9G zLfX<(%|eT6OW2T6e2MMZ&~30x4WxS|Hcofc{<1Ai@#H@?S_~(r!X*va#k`_IW2>t* zj~<4)djCidxM@?JICBKw_fal-<+fB^m=c*I*PP@(^7}rXBmGCl`g2V>N3z|$jGs@9 z1c3R?`w+2im`u!HI!bN4j5?RX#&P0LaqJZHv!TC*wM9`aO^p~ds%%p{z^4J3Er@br zVY+nJ-EXdNbq@aSQM19{n#1KSckFtAaAeS`%8Ttf`%{DNNaCG~2UdDQI)Sy78V!g8 zo;*#^0EbrgiB%^G6gyw+%f<`iv~5Bfd$MS!u0tJ?d#BV4J?|SmIYB98=ULOzr45-^ znCL337YvOsJF0neU#E2mZEWynf;)v8Xmn!uD4*l=+Qf17_PU)P4Xt{-RDb90BE6~f zM{V0?uR9#~{KWrVd3VkC?c;P&K(&wP>*{`gqsx?4G8h06pRt3Jaql{eSOM@?3(;9w zy6?~YQ3$zFz_sozOG@INsH`m#7w{`yR5+7oqmeO0<|LmVdvLJyX8oVOJ}-g{&ma)$ zkmBpKXgtaOs*Ks7^(!w_;<|V586=O;_L8ykN6$n-p`kLwpsM}OnZ?HIS2D6%LW6bV zn)Rx%usPS5r9~-yPKczR9kpT$}-a+|$1^W$W;v-zD^i zy_zxjE%et0`uEFnIJJOt@=CX*KDD7 z)--hW6BvD6g~eC2BS(%=N0gLEU&v0Rp%a9o2Qh!hdK&JH-n>Hb2&2j_&$V!#J$nhZ z%bP$;>U}`Fc<3wNRteDSC~PsvZfnb5R5r$^tkUL+1w{fbR6JLpz9>WKN*_3}wvO&u zJSae-`7W0V%IDX=F!Nx-E>4P#GnvW9*7btovM@Q+7gjxr@%kA8ZQ9U`uT zt)~v$k*?jM1=H8T^eW}80c(`DoOciOsyy3(N=8 zhm%H~t24o-oaB@bEOCkVsO?=&jENclRwo?Y={d8yc5oGO`Vq0Zm%6#!c9`oZiZ7i+ ztd0}Vk-LZ(=_+9+m&y814UQhzQq`hl6!X%*Ul{YbPBLKcO{Wi`7Q3`iW zAD5r^+1lu3+MAf=oj>2xU+m5MkhUAmnJh{R< zf^ME^mv?tviI`Qz1n-Rin}rr*mkw}QeGcaNS5DT~lLia@?|X3PDb7>U-?ORNuaiY! z++4wfH6Qf+urML#doLgBX312^5mERl?) zD&F4qzLdz=!jcjTwaSXD5)DeVcMgztM}>gCE+2NvPPfP*<*)aba<K_uaGLxxAZRQP1q{EK0U!FSFUboIpEd62(YM1cb z+No#jJGO^+laTn?bhcDOU*Cs%(3&iK@uCnggy=$i(c*+UdHx{>&|?!F>iYU5q2Pj{ zAIWC4af78rn)IMoPL4cZqr(-OSYL6Ls%xbuE_CUOHJby(x0NQY1xW`>jloUt&=KaB zQNYR({W*5GNgnWOkkAy_3iL{VJOg=c=N`#ii&)gPv% z-GmQOEgz}|^Mnm?uNkDHcwD#jaIF#`5fUA8Ib-3XU*@HxAC^Z%uu{fUrF790vg_aw zB;ZbcGv`E8nqyf>@z`8<^K*Qn!tBl2+2ei_$OZfQzs${LPZO@w#+~vC3k!>D;ZV_4 z-paW8;_Ov$27A@{@l%fqhoXZfW1LJr1#s@+xEOoXm}Remc->0XuHR>J7AMRZ8;3Ni zZ05JWw7ZQTVBItuh+Dn7sjNz+ZvZt^c6rOATSYD7lL}yXAi>i|FO0OGyx381Wi?Uq zHTNhiB&wjNbDlb{d0y1`0S(r<2`sTR2qn(=8{%ioEm0fu#N(jLQNk>>>{(yqzVfKV zT0JipiG6kxwoLbgu0no$kUA(nG%YPH_i%9Z0@O7nIq;m1UqFDI9{jwok`Q%>tGfN9 zhLOdMN`z>45;*>B{j!a_@}K>m#z#BDuIXQ`$#cq&eO9cace1%s{(GPMf{1LB@`cPM z-9BDiVJvv6C-ByFuY_O?r^PIYJghi$*Nab4vEk&&wz))Gum}`5{l^~{s(U3$ZnvC= z;ayULh&yYUg$;KiLEpWTZ6_&vfMCD!YQoUeG;4Ka<1)lfo0XQfHo{;jZnn=r_dLm% zxtR~SLFiKGat;YUWZTv}WDY}vGT(qj(A&E%vK z97!<}?$&fQ|{mj97%{(URZSNti5AS{< z^;XB}F*ZZ6D;pQ5XMwk2j0+Uiav8`s(QU_h6g^^>H6HMHrvg1cv5pEU66RYy4w#3B z)hs|P=nx*&bKXM23EB;N!m7Zdv$0vwp*tg3a$++#0f7n!_(7QadF@)2urDi(1I;ie zG>e4a`uWbrK?n2wUMx%!&8tV3+(wzvEs`8ab!97z61?2DZNbX_#5&%jpFFkVJEsoj zV{`UD-h8)T%<-$~I?EAf)v3xt%R=b8}31r^#5$BS)I1?dU z+BG=c`82#gB~GkhoPvmH;&p4ShDVQm!REv%Ww7%E@Kdx#sN*5n{p zH;*VW@p-^eyM$t_XsvSL8+I0pMVa_tiEFr(%Kc!j&NuOiFZY{NpZlIgTriiJT`8va z=d7Rp*lDoP1(1(l)sMYTxw0@)tGzoqX?8fbIQNE;(MxDxo?6%TM>zCcWY8G)vyW`a6NX~0=vJuK1?!f;izF5hTeX(ChuaEGl;xpjwc zZ|=ibq6IYz4UOyfJuH0t`C0G0r$0~C25B=Co@WJ^K83&3YIx* zL;U@^n`wIc-M@Y&W-sR2=h?sa7`k>97^9NiX`Zo%C`Jo);mT{@9l6;+g>4*gDay*a z%z=#eQB`j~Er{q$M>>b;$SEudI^6UL%Ap4G$iHaqH!{jzdePk+e_-lL&-3;-gKvG2 zJ?UZ=a!#9T=MsG0%jn1i7Qj8OJnNVnWU8D)1#8=bX8rg+Nf{H>QWJyZDlDYotDboc?G%8BI2;s4d3C;lD96z2)*+8<_h`W zS8R~U>b80|Q7#CB2^5l~TNpE~iIp=y0cvTY}FwV{mEq}51=Xwa{P)A0le!Wzt zG9qjB;VjX0OS_iQB!9ITD6Qm;g`gg&cKC2t1FLMOY^v7Am$|2$i>eN^u5q8oS#+$D zZt`q#PlLWD+g(r)Q^PT9kXrlDUuq#d$PqFKgDs1_F8vjYnPE%eJh^@pYI&GDAEKunyvw~a0390?>Bq0=hS4jMhcN1VIn zjgQYczB`6b*hZanaoHx`diNer&Jezxef#a4=5(xaS{MijMRm$Wrfk4az3|W87DCd# z;($k4ZdIAtqO2R|iSs?glK}Djc)bg&Tieu9-1?-&n!M`=T!fDocSw1DenbD((5dZw zqA=+KlpN%eI#>WL9y|%I_R7^S$E0rfQ)2i0_Ip<~u(-h$j4*&L$ubnL-FyW5rnh#r z1LYptu|{8$DJ=K#llCpDqJ6nJg08`yJDs0b@@1Z_#NYc-E`t;w=SW}i&_=U>x4ipN zo{-WwkxI14$;>vuAmK|h>bcU^V*%}BWQFk7s^}nJzv~>ryjO6p+8oVU4INS3J9(lG zIW%9~9m8&9(0QF&Fu_&jhe}woAoUJo(EVF({cr-R@A~HnSoxn5u;Awj`2B8hHv)m! zLRYc&lMt|9lD+3|Cwq}vI60+El}1KjT#r}Og_caCi9C^YZB-ka{5nFsgF$CcNv<8t z+|eN8nXEO}Q|7!o&+EVhVKe}HTq4`?+n0|=aD;|pbhIH)YtQ2c`W>GkQ(XHJ{q)Iz zW1jNX3Jkr;zFzcOVfWJBJ)}ErEiLC_!Lr3cA(-Pgj~SddDsuadPZ}}o#8cS&2ToE+ zJXVe(LZ8j;&iKDw?HianU9>6IPBh7#T+LBT7T+=-@vRbq{tcx|(*I`Zl4JpWo){hRs}u=d3@Mh%)X%WaN&+$7Qb( zEc{=>^E<>O@7ho)`gy73=zx!|9go?kIP&(*3E~+_Hbfttf%9F-EwpPqVS@ zl35ve&F~IprB;xhRG$eKvyc~&5E&8@6ma&QSteKQYi()w7?3ANry|pA+AK}r)4t56 z=sP&Xrvxlr1flpMAg?G?7^l>YOtpOkS`5$A2wlhMiorx+w_%mmz8Dw~A>r{OJz*m& z@a~`o&(?Sd668@<<6e!<^3QIw`WlbaVdm>jHa5KMd@!#GxkpR;Ld4p z(y&H-{Y5odKACGOk1jjH`H(qZSgzCsMy?-Wq|mDk`p|;T@&lfj3&K`kwi%dPf`Q&T zO)GZ1{0?O;^>lSqy;+YM(y_$;aAOnKY7+o(d%e#GuiV0-SB;i z4Ag7+Z>ugT86&-ecmDgk5HlmSiLjL=T2liVFFO>L4cF02(e1Xq**ZaFuz!XwrP1}t zo?iuO{i*twF1^)bbTTo8Zr17!l$cp61Mtm~j)SD*9|lpYMAV|HpkoaTDS@M@-dEl9h?dPiI{CIu%ykgohe0=P zIfS7>gz-DyPf!1!H!>~#Vngg}!K=_$Y@BX#@cDSfJNQ4GJj5~I8!-%q{Gd=y)?8nV zL!ABGi^xH^EyKeBITP+nOMP%m#WlJuwHz!VIVchijS2< z`R`q=nyaN&E;d~^E19_nTT(;cPc2&vH@@rt5%v~fQEzMe@L+*b(hX8lQcAaUBS?uf zD&0M#3eq3~(hbrj-6bI14MTT#4*VCoeb3(eoa_7Mx)?@hfSL7M>&g4M@0$p>!50Bg zJ*p`UIDib*plh!!WVm7X${aJXy5&bJfs1XS&d8PO4i{*3s`>#^*p6m>MbHNV63Z`0 zNlE1wkRPD*dE>=zyzuDZ&e+(ntmmYbnkZRg291%(!4oaVEfoMDG0VPaW8^eiXcY`P znK0wvznEfx9#^WpDN+wCo(FF?ojSc++tf`Ht`$>#6S;0}xgtO&(9s=#<1zkhy9W5D zdt|4tWy;@~TO0h!On*INm64NQr3?pA<2pTP10BgX&Q59G~3D`Q>VM~DBn z4H`nbKv2tETOk@olQ{ReB26Z;=f);$T&)*_0o<%_Wf3#ioBQg^)9%Gg^_RkD7bh&k zJ|JCsZBeNhfICeNAS#jd^lh)v zY^;zR3J0iin>XQWE&!4x$EQ~VbH2bqCBS^O;sg!@|7nBpwEJZD`tY+K$^2k|0aUF$ zw}Ap901olQ8-P^$Xu`Dj#{3M%?{6$-+|*N<>noH&hBEj;rL1;&o8bfz(nt8@_~Xmn zn;4@(&tzfdbwom`#234%)4l!UJ!@N0pMpz%Zs`eJ8mR}Mo1k6mQprv6*B%ghotc}} z_jBbu2Sh8O??n!0Ugb=a{O-(J6%P$5Z%w~`Bn2QzK=YySrsF+C1MS4c!NHOG(wboR zMPvXgi4kXqQF&^a@k?5vdm~692fHznD*-`>60qnv+l(Wg2=Jk2KiukRrfPY$jE&a_ zUCq3z?01&SxX@Hzy-MHQG}{^v%lR^(bobu9Ohc;|)qd#jKr;)tYkDA^2Y{2G%gY_Z zR>nX(=k)^SBIxgcsW5O5OQjZM{AIAq85My*r>f`=h_jOu8#k~Nl@}fG=OV|8o5RbD zppEU;)HL*rZKxZA1jdoC#ZcY-%|eT3EgY-0f|s}<0%kgC7xU*p{Q5pYO~$N)x{8r} z%KthdE;gxS{lS^K+n*kzc`IlRkLI%hl&HNU?N+Nn$W+1NB9+v@`~?}s`!C4T#YXQP zHYHg*IC~OOrNZQGC(7%J$HSfbj!y+ZHuHQmUyIFb?4hF%xztTn8d_dlPc;EHWOA|_ zHsM6ubaE2L4HO-EXw4XtYFeHj!=h(a+;-!u0ItJK5oJs6_g=S(Xci;+Fk+;zZ*y$46q%Tnojov}T;dNVvb$@~pl(-dZQE$+)3iW~3jkbF ziE-GQg8GS_Z4PXJV8+`^fT5i$(Gf8$E;?x72k-pXEidGsjtv6PW+G^pj}}LAjsDzd0M3d({mNd+7|g>Fjfz4uq`Jo>Femowbd~)hX2cOg57A}#mYZL z+~4nA{8xjU4eg&P9|X{M-;p4=NwKH#f4wG&e{GJ87C^;->;Sb?zlXV;i!%EwY(3uF zm=e3e05a5H-bibESe&Y~9U{Hhsngp=L(QW-Pr4(ms7Up~rt}YPyS(S)NaM-xzhdO} zUpTCb*@dMX1bzxCsYzQbl~-DG%f7$YGa1bFadW$be|M_}5FKR=)rr}t1h;dO#R>rA z1Akd+?{%r6LK)D#*92fFsiJ|wLC{Op;8O!g(az;;1%PP)aNV2jc%vG!UcGKmJ_#;g zdSIX(==)c{=>fF`YN}SErA&;rQm3A;t;XQ_$jF?bp&{IY!3e_>T{&(SP}e(Du&p#n z_-3*ee-p#E6p(B0_C;C`W=BEWu9WVldBA@9_^e04pEE>(57 zpJR7C9wz4ouxla!h<7hUPysT%50_tNY?(5#TOb z1(z69JMaOXpKW8aYJPLe@p|5ap55L@v2Oc37VtEM#kg{8#7Nk{$4$56rwh1G+M<_R zt*6=5GLJp(dxHtjZ!3|tDd;c{i5q(V-+)HPAQE1AP8gd6ncHcC%yE9*j&0^wSmg1( z+wW~L0m@0gAN_TY|LI;xUw!IKBvs2h^S?j{#0cQ?mdplE0S z%l4NcIe_&)tL}S>@ZO#^;3*iiBpO+RwV-FI6~Mj;L`ScEbHv8k8vc?&Iy&P4*IQQu zDp>$;T(vb4YkyI5H-_(ROuwqSx^9d?{g*HL5#iW7E=)`|zGumZctldJXezH1lW*S9 z(Yi{N@v)|sYx~ldG{w}`bs&AjO?!o+<@k&EAJ6$HB zFJ@SfJFp-ti?wHZLTAM2cO~=RWTgE4u8F&ZTMz36khl*c~ z@_jMw)t1@byxQxo6zo|xwjegH9(Z%1b1VJJ7fhhlPIEp=)ERUP;BphYlRVSh9?6|I z7tz2!&-*03*7Yx>q2sRAzfELFW20iLt=Y)Czf8PUL`EXC1_n^qoj)Z<{c$Y0hIS;S z`cu&bUl{JAOPvFz+ryuf=xnFKjIXao=3Vf3sLr{R^@TqG$VhD{+czf1o(mt5Td^O9 zM@CG}a+tGnYjPXM*1!D0d~5#r8|M3*+2e?sGPxtFXaO4=+pGkfT%+M^viLf~r4CEk zCF=#6OrQFCMJ53GB`KeoXKU|B2A0%r^m0=9m14i{jEI;7+3B4!Bz4FK#MYCLZHt;zuCW5_Vq=QG!z0f|!=(7&Y&ECa(309PKe9uJh4L_k}* z$_;kQ?XVpWx-`rQ7>D=12~bnFoWJdU?}pD04Sc6<8^5OYh0W+i+Rek8uTLoah0OK2 zugs+zo|&IJpVwcz<~YJG)B*W*#8v6Mo0vGMY0O45IxLI|L|aDt;l|&}$lOmy^hkOz zOJw7r`B|68uPrl^9?j6YI6E7UlyVxKnOYjJ6*HThS3bMRPmV!M>9fd$3OHIHQKH?S<}E}#Vcs8nXD21wZ`?vdnl z7DO4BpyEHw4`8ZPe!UaGy1u`EAiJ)Ms63oI~PA@jr(tA5c9cMgT&;aO|S|(w*D~IWZg%>E308O>Kc-px@JdG!Q z5P<4|+C(8pc4Pp@?k)S?T6CiuD9H^6Y`KeC%pTu=FzJA`+-OJwOd5ff<;HICmJikP zePp6XmZ0VH1>lP7>)>`LDJ|!-A063~JSv)+o7r`RD*CSh`g9%eyDFQT=TXrC7-|-; zW2R+2OKNW`;O>Pr-QK%*@1Akjn6)@J*i|=E7T>s*dv!8Fv$zdFJFVjY?p{u+ST+Ar z6?m{YvyC`ud1<9r&e2p^K-KsG>el3HQNC|6&>^_N*%)8`@T1uP`YPeWRm^J#KNSt^ zmZJ@gVdl1_&+Id(vOq*6lK_=1VDcE0X$m2d+84XSB1mL^3ZzV9~?Rw@gwdc?0P&i-SGJKZL7<>IRqF2Dh zKXlcgo=L0Pcz`Zrt@HXSkqQ_y+4}1;Son)Y-HbSgPoWL(1OYhNpV%&!!%W?B2*has z*exOqJ!Xs0adOXczdDnUi?T`y=CugF=jFq|R#Je=R5QAEN_ut0b9L$mC==Mlr#m8M z);4 z`)`ar+A^hwo0aoDpuJf^A1v}Wd_QMt^*oFtE&cD_gW{i9LrB<7;aBR==0B!1D9_6CxZdT#@mvNT`6e7Qo5O2BPW0&`noe5oaSh}$B% zBf~M2Zi^R0z^M(`Z2Kzq+Q5ujSTixu959vsvA+<)U=K$H%%pS4DYf1cg?jP*%iwW) zSVm0i&O~jeGTPQ?@0ueL>Q)Yb31+VaTqdqE#s;lq&QZqj)umgLLfwI?Q1-L?L%=yL zjrJ>~zeU8vPERxA#H6j<-{cv@1=dN!=2+9(P|MmwV_`HHgbhREWjZoD<{}zUor%uB zG6pM}f7Q!b2r${EoPygYG=F0a8|LPB>aT`Y0JEy#)mUbBcJ{ps7xgEtw&KuFS>1vx zNj=sG2+xmtVv8o@`j$ap(r=jPKA_82$?dXkwxKTZ6rC(*Sh=hdHtVvEiNh{D+Et~^ z0E0FgyC_H!#;W z3~Rb2^(9e<=7{VeY>``oFe5VZY$xD^hl-#-nGgM}2h1|WyT!UVYz(Lx7Np0x9BVoo zzP9nu*cc5CCV>+Y&kVRse*QZ3pSXIe`@cZYk6{Tge-!-O)vo$dN{?#kZ2#f*>f*l| zbZh`4$8XLD`Y8Y(s70f|BL^nJZsycL7J0a%An-J(h!|9~xv0j5z82F|_c*?N`)+9b z9iaTd$4>(>YU=ilc1&M#GohwPB$L)g!f5feIlJy2VYvP$MscfaZZng*2Mm1 zsj_WPLe7qv?T&&ed_wOiUyysW(VFuF*dXe^Y)~+e(y|LOD=ig2%gP{Ca&l5HUItL_ zBBin&whn+;)CP?ao7Bk=wg6myK;f76E+o-@DD&m6%MD3k?+(Ft6kb|&FjgQ^$ zEDIH$Kd+;>hpKcF5OLdn1;@U`-Za-;{VdP@bdL8|D@b3shOSZaWV>zE%a6vmdp(g# z3e?^;j+=_Vo%KfZ4I9s=2>4KGNJ&Y7=qRG5wibZrkdf`$shGNe$NH<(Lv

    + Private Zero-Trust Architecture +

    + +| Plane | Components | Public exposure | +|---|---|---| +| Operator | Azure Bastion (Standard) → Linux jumpbox (no public IP) | Bastion TLS 443 only | +| Workload | App Service Plan (Linux P0v3) hosting `api` + `web` Web Apps for Containers, ingress disabled publicly | None | +| Data | Cosmos DB (NoSQL), Storage Account (Blob), Azure AI Foundry / OpenAI, Azure Container Registry (Premium) | `publicNetworkAccess=Disabled` | +| Identity | One User-Assigned Managed Identity (UAMI) federated to apps + jumpbox | n/a | +| Observability | Log Analytics + Application Insights joined to an Azure Monitor Private Link Scope (AMPLS) | None | +| DNS | Customer-owned Private DNS zones linked to the VNet | n/a | + +--- + +## 2. Parameters reference + +All parameters are defined in [`infra/bicep/main.bicep`](../infra/bicep/main.bicep). + +### Naming & environment +| Parameter | Default | Description | +|---|---|---| +| `namePrefix` | `invstdemo` | Lowercase prefix for every generated resource name. Keep ≤ 8 chars to stay within Storage / ACR limits. | +| `environment` | `dev` | Free-form environment tag (`dev` / `staging` / `prod`). `prod` enables Cosmos DB zone redundancy. | +| `location` | resource group location | Region for VNet, ACA-replacement App Service Plan, Cosmos, Storage, ACR, Bastion, AMPLS. | +| `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment. Use a region with model capacity (e.g. `swedencentral`, `eastus2`). | + +### Networking & zero-trust +| Parameter | Default | Description | +|---|---|---| +| `isPrivate` | `true` | Master switch. `true` = full private deployment (everything in this doc). `false` = legacy public demo, no VNet, no PEs. | +| `vnetAddressPrefix` | `10.50.0.0/16` | CIDR for the VNet. Must accommodate every subnet listed in §4. | +| `deployJumpbox` | `true` | When `true` (and `isPrivate=true`), provisions the Linux jumpbox + Bastion. | +| `jumpboxAdminUsername` | `azureuser` | Local admin user on the jumpbox. | +| `jumpboxAdminPublicKey` | _(empty, secure)_ | **Required when `deployJumpbox=true`**. Paste the contents of an OpenSSH public key (e.g. `~/.ssh/id_rsa.pub`). | +| `bastionSku` | `Standard` | `Standard` is required for native-client SSH tunneling used by [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh). | + +### Application +| Parameter | Default | Description | +|---|---|---| +| `cosmosDbName` | `ai-investment-analysis-sample` | Logical Cosmos DB name. The template seeds the six containers used by the app (see §6). | +| `docsContainerName` | `opportunity-documents` | Blob container used by document upload + processing services. | + +--- + +## 3. What gets deployed + +Each module in [`infra/bicep/modules/`](../infra/bicep/modules/) is conditional on `isPrivate` for its private-endpoint wiring. Modules with `*` are only deployed in private mode. + +| Module | Resource | Public access | Auth model | +|---|---|---|---| +| `network.bicep` * | VNet + 6 subnets + NSGs | n/a | n/a | +| `private-dns.bicep` * | 12 Private DNS zones, all VNet-linked | n/a | n/a | +| `user-assigned-identity.bicep` | One UAMI | n/a | Federated to apps + jumpbox | +| `log-analytics-ws.bicep` | Log Analytics workspace | `disableLocalAuth=true` | Entra ID + AMPLS | +| `app-insights.bicep` | Application Insights (workspace-based) | `disableLocalAuth=true` | Entra ID + AMPLS | +| `ampls.bicep` * | Azure Monitor Private Link Scope | `PrivateOnly` ingestion + query | n/a | +| `storage.bicep` | Storage account + blob container | `allowSharedKeyAccess=false`, `publicNetworkAccess=Disabled` | UAMI → Storage Blob Data Contributor | +| `cosmos-db.bicep` | Cosmos DB account, db, containers | `disableLocalAuthentication=true`, `publicNetworkAccess=Disabled` | UAMI + deployer → Cosmos Data Contributor | +| `container-registry.bicep` | ACR (Premium) | `adminUserEnabled=false`, `publicNetworkAccess=Disabled` | UAMI → AcrPull / AcrPush / AcrDelete | +| `app-service-plan.bicep` | Linux App Service Plan (P0v3) | n/a | n/a | +| `web-app-container.bicep` | (per app) Web App for Containers + VNet integration + private endpoint | Public ingress disabled | UAMI | +| `ai-foundry.bicep` | Azure AI Services + Foundry project + model deployment | `publicNetworkAccess=Disabled` | UAMI → Azure AI User | +| `bastion.bicep` * | Azure Bastion (`Standard`) | TLS 443 only | Operator Entra ID | +| `jumpbox.bicep` * | Linux VM, no public IP, UAMI attached | n/a | SSH key (Bastion-tunneled) | +| `private-endpoint.bicep` * | Used by every PaaS module above | n/a | n/a | + +> The legacy `container-apps-environment.bicep` is retained on disk for reference but is no longer instantiated — the workload now runs on App Service. + +--- + +## 4. Subnet layout + +Defined in [`infra/bicep/modules/network.bicep`](../infra/bicep/modules/network.bicep). Default sizes given for `vnetAddressPrefix=10.50.0.0/16`: + +| Subnet | CIDR | Purpose | Delegation / Service endpoints | +|---|---|---|---| +| `snet-appsvc` | /23 | App Service VNet integration | Delegated `Microsoft.Web/serverFarms`, `Microsoft.CognitiveServices` service endpoint | +| `snet-pe` | /26 | All Private Endpoints (ACR, Cosmos, Blob, AI Foundry, AMPLS, App Service) | None | +| `snet-jumpbox` | /27 | Jumpbox NIC (no public IP) | None | +| `AzureBastionSubnet` | /26 | Required name for Azure Bastion | None | +| `snet-build` | /27 | Reserved — ACR Tasks / private build agents | None | +| `snet-mgmt` | /27 | Reserved — self-hosted CI/CD runners | None | + +**NSG posture (deny-by-default with explicit allows):** +- `nsg-pe`: allow VNet→VNet TCP 443 +- `nsg-jumpbox`: allow VNet TCP 22/3389 (Bastion only) +- `nsg-bastion`: full Bastion ruleset per Microsoft docs (HTTPS in, GatewayManager, Load Balancer, SSH/RDP out, AzureCloud:443 out) +- `nsg-aca` (legacy, kept empty): platform-managed when ACA was used + +--- + +## 5. Private DNS zones + +Defined in [`infra/bicep/modules/private-dns.bicep`](../infra/bicep/modules/private-dns.bicep). Every zone is linked to the workload VNet (`registrationEnabled=false`): + +| Zone | Used by | +|---|---| +| `privatelink.documents.azure.com` | Cosmos DB (SQL API) | +| `privatelink.blob.${storageSuffix}` | Storage account blob endpoint **and** AMPLS blob link | +| `privatelink.azurecr.io` | Azure Container Registry | +| `privatelink.openai.azure.com` | Azure OpenAI deployment | +| `privatelink.cognitiveservices.azure.com` | Cognitive Services account | +| `privatelink.services.ai.azure.com` | AI Foundry project endpoint | +| `privatelink.azconfig.io` | App Configuration (optional) | +| `privatelink.monitor.azure.com` | AMPLS | +| `privatelink.oms.opinsights.azure.com` | Log Analytics ingestion | +| `privatelink.ods.opinsights.azure.com` | Log Analytics agent data | +| `privatelink.agentsvc.azure-automation.net` | Monitor agents | +| `privatelink.azurewebsites.net` | App Service / Web App | + +--- + +## 6. Cosmos DB containers + +Seeded by [`infra/bicep/modules/cosmos-db.bicep`](../infra/bicep/modules/cosmos-db.bicep) using the `cosmosDBContainerNames` array in `main.bicep`: + +| Container | Partition key | +|---|---| +| `opportunities` | `/owner_id` | +| `users` | `/email` | +| `documents` | `/opportunity_id` | +| `analysis` | `/opportunity_id` | +| `workflow_events` | `/analysis_id` | +| `what_if_conversations` | `/analysis_id` | + +Local auth is disabled — the deployer principal **and** the workload UAMI are added as `Cosmos DB Built-in Data Contributor` so the FastAPI app authenticates via `DefaultAzureCredential`. + +--- + +## 7. Identity & RBAC + +A single User-Assigned Managed Identity is the workload identity for both Web Apps and the jumpbox. Role assignments are issued by the individual modules: + +| Scope | Role | Why | +|---|---|---| +| ACR | `AcrPull`, `AcrPush`, `AcrDelete` | Image pull from App Service + push from jumpbox | +| Storage account | `Storage Blob Data Contributor` | Document upload / read by API app | +| Cosmos DB account | `Cosmos DB Built-in Data Contributor` | Plane-of-data CRUD without keys | +| AI Foundry / AI Services | `Azure AI User`, `Cognitive Services OpenAI User` | Calling deployed model | +| Resource group | `Contributor` (jumpbox only, when `deployJumpbox=true`) | Lets `2-build-and-push-images.sh` and `3-deploy-apps.sh` run from the jumpbox | +| Log Analytics | `Log Analytics Contributor` | Telemetry write | + +The deployer (`deployer().objectId` in `main.bicep`) is added as a Cosmos data contributor as well, so you can run the FastAPI server from your laptop against the deployed Cosmos when you punch a temporary firewall hole or run from the jumpbox. + +--- + +## 8. App configuration in private mode + +Application settings injected by [`infra/bicep/modules/web-app-container.bicep`](../infra/bicep/modules/web-app-container.bicep): + +| App setting | Source | +|---|---| +| `AZURE_CLIENT_ID` | UAMI client ID — used by `DefaultAzureCredential` | +| `COSMOS_DB_ENDPOINT` | Cosmos account `documentEndpoint` | +| `COSMOS_DB_DATABASE_NAME` | `cosmosDbName` | +| `AZURE_STORAGE_ACCOUNT_NAME` | Storage account name | +| `AZURE_STORAGE_CONTAINER_NAME` | `docsContainerName` | +| `AZURE_OPENAI_ENDPOINT` | Foundry project endpoint + model path + `api-version=2025-01-01-preview` | +| `AZURE_OPENAI_DEPLOYMENT_NAME` | Model deployment name | +| `APPLICATIONINSIGHTS_CONNECTION_STRING` | App Insights (telemetry routed via AMPLS) | +| `ALLOW_ORIGINS` | Internal Web App FQDN only — never `*` | +| `WEBSITE_VNET_ROUTE_ALL` / `WEBSITE_DNS_SERVER` | Force all egress through VNet integration + private DNS | + +Every setting is environment-driven; the same container image runs in either public or private mode without modification. + +--- + +## 9. Deployment workflow + +### Option A — Azure Portal one-click +Use the **Deploy to Azure** button in the [root README](../README.md#-one-click-azure-deployment). The portal wizard collects the parameters from §2 and then provisions everything in §3. After it completes, jump to §10 to push images and roll out apps. + +### Option B — CLI (recommended for end-to-end automation) + +```bash +# 1. Provision infrastructure (VNet, PEs, AI Foundry, jumpbox, …) +./infra/1-deploy-azure-infra.sh \ + -g \ + -l swedencentral \ + -p invstdemo \ + -e dev \ + --ssh-key-file ~/.ssh/id_rsa.pub + +# 2. Open an SSH tunnel into the jumpbox via Bastion +./infra/0-connect-jumpbox.sh -g + +# On the jumpbox: +git clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git +cd Agentic-AI-Investment-Analysis-Sample + +# 3. Build & push container images to the private ACR (uses UAMI on the jumpbox) +./infra/2-build-and-push-images.sh -g + +# 4. Roll out / update the api + web Web Apps +./infra/3-deploy-apps.sh -g +``` + +Flags accepted by `1-deploy-azure-infra.sh`: + +| Flag | Description | +|---|---| +| `-g, --resource-group` | **Required** target resource group | +| `-l, --location` | Region (default `westus2`) | +| `-a, --ai-foundry-location` | AI Foundry region (default `swedencentral`) | +| `-p, --name-prefix` | Resource name prefix (default `aiinvest`) | +| `-e, --environment` | Environment tag | +| `--public` | Deploy the legacy public topology (`isPrivate=false`) | +| `--no-jumpbox` | Skip jumpbox + Bastion | +| `--ssh-key-file ` | Public key for the jumpbox (default `~/.ssh/id_rsa.pub`) | +| `--bastion-sku ` | Default `Standard` | +| `-d, --debug` | Enable Azure CLI debug logging | + +> **Why scripts 2 + 3 must run from the jumpbox in private mode:** ACR is `publicNetworkAccess=Disabled`, so `docker push` and the Web App rollout APIs are only reachable from inside the VNet. + +--- + +## 10. Operating the deployment + +### Connecting +```bash +./infra/0-connect-jumpbox.sh -g +``` +Internally this runs `az network bastion ssh --auth-type ssh-key`, which requires Bastion **Standard** SKU. + +### Reaching the Web app from your laptop +The Web app has internal-only ingress. To browse it during development, open an additional Bastion tunnel from the jumpbox to the Web app FQDN, or deploy a self-service VPN gateway / Azure Front Door Premium with Private Link in front of it. The sample does **not** ship a VPN gateway — Bastion + jumpbox is the documented path. + +### Rotating the jumpbox key +Re-run `1-deploy-azure-infra.sh --ssh-key-file ` against the same resource group; the VM extension rewrites `authorized_keys`. + +### Tearing down +```bash +az group delete -n --yes --no-wait +``` +The Private DNS zones are inside the resource group, so a single group delete is sufficient. + +--- + +## 11. Switching between public and private modes + +The same template covers both modes through the `isPrivate` flag: + +| Behavior | `isPrivate=true` | `isPrivate=false` | +|---|---|---| +| VNet + subnets + NSGs | ✅ created | ❌ skipped | +| Private DNS zones | ✅ 12 zones, VNet-linked | ❌ skipped | +| Private endpoints on PaaS | ✅ on every data service | ❌ skipped | +| `publicNetworkAccess` on PaaS | `Disabled` | `Enabled` | +| Web App ingress | internal only | external | +| Jumpbox + Bastion | optional via `deployJumpbox` | always skipped | +| AMPLS | ✅ | ❌ (telemetry over public ingestion) | + +Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly to the bicep template, to switch. + +--- + +## 12. Troubleshooting + +| Symptom | Likely cause | Fix | +|---|---|---| +| `403 PublicNetworkAccess is disabled` from your laptop | Trying to reach Cosmos / Storage / ACR from the public internet | Use the jumpbox or temporarily allow your IP via the resource's networking blade | +| `Bastion: target resource id not found` | Bastion SKU is `Basic` | Redeploy with `--bastion-sku Standard` | +| `docker push` fails on the jumpbox with name-resolution error | Private DNS zone link not yet propagated | Wait 1–2 minutes after `1-deploy-azure-infra.sh` finishes; re-run `nslookup .azurecr.io` | +| Web app cold-start fails to pull image | UAMI missing `AcrPull` on ACR | Re-run `1-deploy-azure-infra.sh` (idempotent) — module assigns the role | +| FastAPI returns `401` from Cosmos | Deployer / UAMI not added as Cosmos Data Contributor | Verify with `az cosmosdb sql role assignment list -a -g ` | +| `nslookup .azurewebsites.net` returns a public IP from the jumpbox | Web App private endpoint not yet linked to `privatelink.azurewebsites.net` | Confirm the zone exists and is VNet-linked; re-run rollout | +| AI Foundry call fails with `OperationNotAllowed` | Region mismatch — AI Services data plane not reachable via the configured PE | Set `aiFoundryLocation` to the same region as the rest of the deployment, or open an outbound `Microsoft.CognitiveServices` service endpoint on `snet-appsvc` (already enabled by default) | + +--- + +## 13. Related references + +- [`_assets/ZERO_TRUST_ARCHITECTURE.md`](../_assets/ZERO_TRUST_ARCHITECTURE.md) — diagrams + zero-trust controls checklist +- [`infra/bicep/main.bicep`](../infra/bicep/main.bicep) — root template (resource-group scope) +- [`infra/bicep/modules/`](../infra/bicep/modules/) — per-resource modules +- [`infra/1-deploy-azure-infra.sh`](../infra/1-deploy-azure-infra.sh) — CLI deploy wrapper +- [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh) — Bastion SSH tunnel +- [`infra/2-build-and-push-images.sh`](../infra/2-build-and-push-images.sh) / [`3-deploy-apps.sh`](../infra/3-deploy-apps.sh) — image + app rollout (run on the jumpbox in private mode) From 4ecb8330a98191f4ee4ad47e5450e79c31c280b0 Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Wed, 29 Apr 2026 15:06:13 +0300 Subject: [PATCH 4/8] fix: Improve table formatting and alignment in PRIVATE_DEPLOYMENT.md for clarity --- docs/PRIVATE_DEPLOYMENT.md | 244 ++++++++++++++++++------------------- 1 file changed, 122 insertions(+), 122 deletions(-) diff --git a/docs/PRIVATE_DEPLOYMENT.md b/docs/PRIVATE_DEPLOYMENT.md index f58514a..13aefa2 100644 --- a/docs/PRIVATE_DEPLOYMENT.md +++ b/docs/PRIVATE_DEPLOYMENT.md @@ -16,14 +16,14 @@ This guide documents **everything you need to deploy, operate, and customize the Private Zero-Trust Architecture

    -| Plane | Components | Public exposure | -|---|---|---| -| Operator | Azure Bastion (Standard) → Linux jumpbox (no public IP) | Bastion TLS 443 only | -| Workload | App Service Plan (Linux P0v3) hosting `api` + `web` Web Apps for Containers, ingress disabled publicly | None | -| Data | Cosmos DB (NoSQL), Storage Account (Blob), Azure AI Foundry / OpenAI, Azure Container Registry (Premium) | `publicNetworkAccess=Disabled` | -| Identity | One User-Assigned Managed Identity (UAMI) federated to apps + jumpbox | n/a | -| Observability | Log Analytics + Application Insights joined to an Azure Monitor Private Link Scope (AMPLS) | None | -| DNS | Customer-owned Private DNS zones linked to the VNet | n/a | +| Plane | Components | Public exposure | +| ------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------ | +| Operator | Azure Bastion (Standard) → Linux jumpbox (no public IP) | Bastion TLS 443 only | +| Workload | App Service Plan (Linux P0v3) hosting `api` + `web` Web Apps for Containers, ingress disabled publicly | None | +| Data | Cosmos DB (NoSQL), Storage Account (Blob), Azure AI Foundry / OpenAI, Azure Container Registry (Premium) | `publicNetworkAccess=Disabled` | +| Identity | One User-Assigned Managed Identity (UAMI) federated to apps + jumpbox | n/a | +| Observability | Log Analytics + Application Insights joined to an Azure Monitor Private Link Scope (AMPLS) | None | +| DNS | Customer-owned Private DNS zones linked to the VNet | n/a | --- @@ -32,28 +32,28 @@ This guide documents **everything you need to deploy, operate, and customize the All parameters are defined in [`infra/bicep/main.bicep`](../infra/bicep/main.bicep). ### Naming & environment -| Parameter | Default | Description | -|---|---|---| -| `namePrefix` | `invstdemo` | Lowercase prefix for every generated resource name. Keep ≤ 8 chars to stay within Storage / ACR limits. | -| `environment` | `dev` | Free-form environment tag (`dev` / `staging` / `prod`). `prod` enables Cosmos DB zone redundancy. | -| `location` | resource group location | Region for VNet, ACA-replacement App Service Plan, Cosmos, Storage, ACR, Bastion, AMPLS. | +| Parameter | Default | Description | +| ------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------- | +| `namePrefix` | `invstdemo` | Lowercase prefix for every generated resource name. Keep ≤ 8 chars to stay within Storage / ACR limits. | +| `environment` | `dev` | Free-form environment tag (`dev` / `staging` / `prod`). `prod` enables Cosmos DB zone redundancy. | +| `location` | resource group location | Region for VNet, ACA-replacement App Service Plan, Cosmos, Storage, ACR, Bastion, AMPLS. | | `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment. Use a region with model capacity (e.g. `swedencentral`, `eastus2`). | ### Networking & zero-trust -| Parameter | Default | Description | -|---|---|---| -| `isPrivate` | `true` | Master switch. `true` = full private deployment (everything in this doc). `false` = legacy public demo, no VNet, no PEs. | -| `vnetAddressPrefix` | `10.50.0.0/16` | CIDR for the VNet. Must accommodate every subnet listed in §4. | -| `deployJumpbox` | `true` | When `true` (and `isPrivate=true`), provisions the Linux jumpbox + Bastion. | -| `jumpboxAdminUsername` | `azureuser` | Local admin user on the jumpbox. | -| `jumpboxAdminPublicKey` | _(empty, secure)_ | **Required when `deployJumpbox=true`**. Paste the contents of an OpenSSH public key (e.g. `~/.ssh/id_rsa.pub`). | -| `bastionSku` | `Standard` | `Standard` is required for native-client SSH tunneling used by [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh). | +| Parameter | Default | Description | +| ----------------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | +| `isPrivate` | `true` | Master switch. `true` = full private deployment (everything in this doc). `false` = legacy public demo, no VNet, no PEs. | +| `vnetAddressPrefix` | `10.50.0.0/16` | CIDR for the VNet. Must accommodate every subnet listed in §4. | +| `deployJumpbox` | `true` | When `true` (and `isPrivate=true`), provisions the Linux jumpbox + Bastion. | +| `jumpboxAdminUsername` | `azureuser` | Local admin user on the jumpbox. | +| `jumpboxAdminPublicKey` | _(empty, secure)_ | **Required when `deployJumpbox=true`**. Paste the contents of an OpenSSH public key (e.g. `~/.ssh/id_rsa.pub`). | +| `bastionSku` | `Standard` | `Standard` is required for native-client SSH tunneling used by [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh). | ### Application -| Parameter | Default | Description | -|---|---|---| -| `cosmosDbName` | `ai-investment-analysis-sample` | Logical Cosmos DB name. The template seeds the six containers used by the app (see §6). | -| `docsContainerName` | `opportunity-documents` | Blob container used by document upload + processing services. | +| Parameter | Default | Description | +| ------------------- | ------------------------------- | --------------------------------------------------------------------------------------- | +| `cosmosDbName` | `ai-investment-analysis-sample` | Logical Cosmos DB name. The template seeds the six containers used by the app (see §6). | +| `docsContainerName` | `opportunity-documents` | Blob container used by document upload + processing services. | --- @@ -61,23 +61,23 @@ All parameters are defined in [`infra/bicep/main.bicep`](../infra/bicep/main.bic Each module in [`infra/bicep/modules/`](../infra/bicep/modules/) is conditional on `isPrivate` for its private-endpoint wiring. Modules with `*` are only deployed in private mode. -| Module | Resource | Public access | Auth model | -|---|---|---|---| -| `network.bicep` * | VNet + 6 subnets + NSGs | n/a | n/a | -| `private-dns.bicep` * | 12 Private DNS zones, all VNet-linked | n/a | n/a | -| `user-assigned-identity.bicep` | One UAMI | n/a | Federated to apps + jumpbox | -| `log-analytics-ws.bicep` | Log Analytics workspace | `disableLocalAuth=true` | Entra ID + AMPLS | -| `app-insights.bicep` | Application Insights (workspace-based) | `disableLocalAuth=true` | Entra ID + AMPLS | -| `ampls.bicep` * | Azure Monitor Private Link Scope | `PrivateOnly` ingestion + query | n/a | -| `storage.bicep` | Storage account + blob container | `allowSharedKeyAccess=false`, `publicNetworkAccess=Disabled` | UAMI → Storage Blob Data Contributor | -| `cosmos-db.bicep` | Cosmos DB account, db, containers | `disableLocalAuthentication=true`, `publicNetworkAccess=Disabled` | UAMI + deployer → Cosmos Data Contributor | -| `container-registry.bicep` | ACR (Premium) | `adminUserEnabled=false`, `publicNetworkAccess=Disabled` | UAMI → AcrPull / AcrPush / AcrDelete | -| `app-service-plan.bicep` | Linux App Service Plan (P0v3) | n/a | n/a | -| `web-app-container.bicep` | (per app) Web App for Containers + VNet integration + private endpoint | Public ingress disabled | UAMI | -| `ai-foundry.bicep` | Azure AI Services + Foundry project + model deployment | `publicNetworkAccess=Disabled` | UAMI → Azure AI User | -| `bastion.bicep` * | Azure Bastion (`Standard`) | TLS 443 only | Operator Entra ID | -| `jumpbox.bicep` * | Linux VM, no public IP, UAMI attached | n/a | SSH key (Bastion-tunneled) | -| `private-endpoint.bicep` * | Used by every PaaS module above | n/a | n/a | +| Module | Resource | Public access | Auth model | +| ------------------------------ | ---------------------------------------------------------------------- | ----------------------------------------------------------------- | ----------------------------------------- | +| `network.bicep` * | VNet + 6 subnets + NSGs | n/a | n/a | +| `private-dns.bicep` * | 12 Private DNS zones, all VNet-linked | n/a | n/a | +| `user-assigned-identity.bicep` | One UAMI | n/a | Federated to apps + jumpbox | +| `log-analytics-ws.bicep` | Log Analytics workspace | `disableLocalAuth=true` | Entra ID + AMPLS | +| `app-insights.bicep` | Application Insights (workspace-based) | `disableLocalAuth=true` | Entra ID + AMPLS | +| `ampls.bicep` * | Azure Monitor Private Link Scope | `PrivateOnly` ingestion + query | n/a | +| `storage.bicep` | Storage account + blob container | `allowSharedKeyAccess=false`, `publicNetworkAccess=Disabled` | UAMI → Storage Blob Data Contributor | +| `cosmos-db.bicep` | Cosmos DB account, db, containers | `disableLocalAuthentication=true`, `publicNetworkAccess=Disabled` | UAMI + deployer → Cosmos Data Contributor | +| `container-registry.bicep` | ACR (Premium) | `adminUserEnabled=false`, `publicNetworkAccess=Disabled` | UAMI → AcrPull / AcrPush / AcrDelete | +| `app-service-plan.bicep` | Linux App Service Plan (P0v3) | n/a | n/a | +| `web-app-container.bicep` | (per app) Web App for Containers + VNet integration + private endpoint | Public ingress disabled | UAMI | +| `ai-foundry.bicep` | Azure AI Services + Foundry project + model deployment | `publicNetworkAccess=Disabled` | UAMI → Azure AI User | +| `bastion.bicep` * | Azure Bastion (`Standard`) | TLS 443 only | Operator Entra ID | +| `jumpbox.bicep` * | Linux VM, no public IP, UAMI attached | n/a | SSH key (Bastion-tunneled) | +| `private-endpoint.bicep` * | Used by every PaaS module above | n/a | n/a | > The legacy `container-apps-environment.bicep` is retained on disk for reference but is no longer instantiated — the workload now runs on App Service. @@ -87,14 +87,14 @@ Each module in [`infra/bicep/modules/`](../infra/bicep/modules/) is conditional Defined in [`infra/bicep/modules/network.bicep`](../infra/bicep/modules/network.bicep). Default sizes given for `vnetAddressPrefix=10.50.0.0/16`: -| Subnet | CIDR | Purpose | Delegation / Service endpoints | -|---|---|---|---| -| `snet-appsvc` | /23 | App Service VNet integration | Delegated `Microsoft.Web/serverFarms`, `Microsoft.CognitiveServices` service endpoint | -| `snet-pe` | /26 | All Private Endpoints (ACR, Cosmos, Blob, AI Foundry, AMPLS, App Service) | None | -| `snet-jumpbox` | /27 | Jumpbox NIC (no public IP) | None | -| `AzureBastionSubnet` | /26 | Required name for Azure Bastion | None | -| `snet-build` | /27 | Reserved — ACR Tasks / private build agents | None | -| `snet-mgmt` | /27 | Reserved — self-hosted CI/CD runners | None | +| Subnet | CIDR | Purpose | Delegation / Service endpoints | +| -------------------- | ---- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | +| `snet-appsvc` | /23 | App Service VNet integration | Delegated `Microsoft.Web/serverFarms`, `Microsoft.CognitiveServices` service endpoint | +| `snet-pe` | /26 | All Private Endpoints (ACR, Cosmos, Blob, AI Foundry, AMPLS, App Service) | None | +| `snet-jumpbox` | /27 | Jumpbox NIC (no public IP) | None | +| `AzureBastionSubnet` | /26 | Required name for Azure Bastion | None | +| `snet-build` | /27 | Reserved — ACR Tasks / private build agents | None | +| `snet-mgmt` | /27 | Reserved — self-hosted CI/CD runners | None | **NSG posture (deny-by-default with explicit allows):** - `nsg-pe`: allow VNet→VNet TCP 443 @@ -108,20 +108,20 @@ Defined in [`infra/bicep/modules/network.bicep`](../infra/bicep/modules/network. Defined in [`infra/bicep/modules/private-dns.bicep`](../infra/bicep/modules/private-dns.bicep). Every zone is linked to the workload VNet (`registrationEnabled=false`): -| Zone | Used by | -|---|---| -| `privatelink.documents.azure.com` | Cosmos DB (SQL API) | -| `privatelink.blob.${storageSuffix}` | Storage account blob endpoint **and** AMPLS blob link | -| `privatelink.azurecr.io` | Azure Container Registry | -| `privatelink.openai.azure.com` | Azure OpenAI deployment | -| `privatelink.cognitiveservices.azure.com` | Cognitive Services account | -| `privatelink.services.ai.azure.com` | AI Foundry project endpoint | -| `privatelink.azconfig.io` | App Configuration (optional) | -| `privatelink.monitor.azure.com` | AMPLS | -| `privatelink.oms.opinsights.azure.com` | Log Analytics ingestion | -| `privatelink.ods.opinsights.azure.com` | Log Analytics agent data | -| `privatelink.agentsvc.azure-automation.net` | Monitor agents | -| `privatelink.azurewebsites.net` | App Service / Web App | +| Zone | Used by | +| ------------------------------------------- | ----------------------------------------------------- | +| `privatelink.documents.azure.com` | Cosmos DB (SQL API) | +| `privatelink.blob.${storageSuffix}` | Storage account blob endpoint **and** AMPLS blob link | +| `privatelink.azurecr.io` | Azure Container Registry | +| `privatelink.openai.azure.com` | Azure OpenAI deployment | +| `privatelink.cognitiveservices.azure.com` | Cognitive Services account | +| `privatelink.services.ai.azure.com` | AI Foundry project endpoint | +| `privatelink.azconfig.io` | App Configuration (optional) | +| `privatelink.monitor.azure.com` | AMPLS | +| `privatelink.oms.opinsights.azure.com` | Log Analytics ingestion | +| `privatelink.ods.opinsights.azure.com` | Log Analytics agent data | +| `privatelink.agentsvc.azure-automation.net` | Monitor agents | +| `privatelink.azurewebsites.net` | App Service / Web App | --- @@ -129,14 +129,14 @@ Defined in [`infra/bicep/modules/private-dns.bicep`](../infra/bicep/modules/priv Seeded by [`infra/bicep/modules/cosmos-db.bicep`](../infra/bicep/modules/cosmos-db.bicep) using the `cosmosDBContainerNames` array in `main.bicep`: -| Container | Partition key | -|---|---| -| `opportunities` | `/owner_id` | -| `users` | `/email` | -| `documents` | `/opportunity_id` | -| `analysis` | `/opportunity_id` | -| `workflow_events` | `/analysis_id` | -| `what_if_conversations` | `/analysis_id` | +| Container | Partition key | +| ----------------------- | ----------------- | +| `opportunities` | `/owner_id` | +| `users` | `/email` | +| `documents` | `/opportunity_id` | +| `analysis` | `/opportunity_id` | +| `workflow_events` | `/analysis_id` | +| `what_if_conversations` | `/analysis_id` | Local auth is disabled — the deployer principal **and** the workload UAMI are added as `Cosmos DB Built-in Data Contributor` so the FastAPI app authenticates via `DefaultAzureCredential`. @@ -146,14 +146,14 @@ Local auth is disabled — the deployer principal **and** the workload UAMI are A single User-Assigned Managed Identity is the workload identity for both Web Apps and the jumpbox. Role assignments are issued by the individual modules: -| Scope | Role | Why | -|---|---|---| -| ACR | `AcrPull`, `AcrPush`, `AcrDelete` | Image pull from App Service + push from jumpbox | -| Storage account | `Storage Blob Data Contributor` | Document upload / read by API app | -| Cosmos DB account | `Cosmos DB Built-in Data Contributor` | Plane-of-data CRUD without keys | -| AI Foundry / AI Services | `Azure AI User`, `Cognitive Services OpenAI User` | Calling deployed model | -| Resource group | `Contributor` (jumpbox only, when `deployJumpbox=true`) | Lets `2-build-and-push-images.sh` and `3-deploy-apps.sh` run from the jumpbox | -| Log Analytics | `Log Analytics Contributor` | Telemetry write | +| Scope | Role | Why | +| ------------------------ | ------------------------------------------------------- | ----------------------------------------------------------------------------- | +| ACR | `AcrPull`, `AcrPush`, `AcrDelete` | Image pull from App Service + push from jumpbox | +| Storage account | `Storage Blob Data Contributor` | Document upload / read by API app | +| Cosmos DB account | `Cosmos DB Built-in Data Contributor` | Plane-of-data CRUD without keys | +| AI Foundry / AI Services | `Azure AI User`, `Cognitive Services OpenAI User` | Calling deployed model | +| Resource group | `Contributor` (jumpbox only, when `deployJumpbox=true`) | Lets `2-build-and-push-images.sh` and `3-deploy-apps.sh` run from the jumpbox | +| Log Analytics | `Log Analytics Contributor` | Telemetry write | The deployer (`deployer().objectId` in `main.bicep`) is added as a Cosmos data contributor as well, so you can run the FastAPI server from your laptop against the deployed Cosmos when you punch a temporary firewall hole or run from the jumpbox. @@ -163,18 +163,18 @@ The deployer (`deployer().objectId` in `main.bicep`) is added as a Cosmos data c Application settings injected by [`infra/bicep/modules/web-app-container.bicep`](../infra/bicep/modules/web-app-container.bicep): -| App setting | Source | -|---|---| -| `AZURE_CLIENT_ID` | UAMI client ID — used by `DefaultAzureCredential` | -| `COSMOS_DB_ENDPOINT` | Cosmos account `documentEndpoint` | -| `COSMOS_DB_DATABASE_NAME` | `cosmosDbName` | -| `AZURE_STORAGE_ACCOUNT_NAME` | Storage account name | -| `AZURE_STORAGE_CONTAINER_NAME` | `docsContainerName` | -| `AZURE_OPENAI_ENDPOINT` | Foundry project endpoint + model path + `api-version=2025-01-01-preview` | -| `AZURE_OPENAI_DEPLOYMENT_NAME` | Model deployment name | -| `APPLICATIONINSIGHTS_CONNECTION_STRING` | App Insights (telemetry routed via AMPLS) | -| `ALLOW_ORIGINS` | Internal Web App FQDN only — never `*` | -| `WEBSITE_VNET_ROUTE_ALL` / `WEBSITE_DNS_SERVER` | Force all egress through VNet integration + private DNS | +| App setting | Source | +| ----------------------------------------------- | ------------------------------------------------------------------------ | +| `AZURE_CLIENT_ID` | UAMI client ID — used by `DefaultAzureCredential` | +| `COSMOS_DB_ENDPOINT` | Cosmos account `documentEndpoint` | +| `COSMOS_DB_DATABASE_NAME` | `cosmosDbName` | +| `AZURE_STORAGE_ACCOUNT_NAME` | Storage account name | +| `AZURE_STORAGE_CONTAINER_NAME` | `docsContainerName` | +| `AZURE_OPENAI_ENDPOINT` | Foundry project endpoint + model path + `api-version=2025-01-01-preview` | +| `AZURE_OPENAI_DEPLOYMENT_NAME` | Model deployment name | +| `APPLICATIONINSIGHTS_CONNECTION_STRING` | App Insights (telemetry routed via AMPLS) | +| `ALLOW_ORIGINS` | Internal Web App FQDN only — never `*` | +| `WEBSITE_VNET_ROUTE_ALL` / `WEBSITE_DNS_SERVER` | Force all egress through VNet integration + private DNS | Every setting is environment-driven; the same container image runs in either public or private mode without modification. @@ -212,18 +212,18 @@ cd Agentic-AI-Investment-Analysis-Sample Flags accepted by `1-deploy-azure-infra.sh`: -| Flag | Description | -|---|---| -| `-g, --resource-group` | **Required** target resource group | -| `-l, --location` | Region (default `westus2`) | -| `-a, --ai-foundry-location` | AI Foundry region (default `swedencentral`) | -| `-p, --name-prefix` | Resource name prefix (default `aiinvest`) | -| `-e, --environment` | Environment tag | -| `--public` | Deploy the legacy public topology (`isPrivate=false`) | -| `--no-jumpbox` | Skip jumpbox + Bastion | -| `--ssh-key-file ` | Public key for the jumpbox (default `~/.ssh/id_rsa.pub`) | -| `--bastion-sku ` | Default `Standard` | -| `-d, --debug` | Enable Azure CLI debug logging | +| Flag | Description | +| --------------------------------- | -------------------------------------------------------- | +| `-g, --resource-group` | **Required** target resource group | +| `-l, --location` | Region (default `westus2`) | +| `-a, --ai-foundry-location` | AI Foundry region (default `swedencentral`) | +| `-p, --name-prefix` | Resource name prefix (default `aiinvest`) | +| `-e, --environment` | Environment tag | +| `--public` | Deploy the legacy public topology (`isPrivate=false`) | +| `--no-jumpbox` | Skip jumpbox + Bastion | +| `--ssh-key-file ` | Public key for the jumpbox (default `~/.ssh/id_rsa.pub`) | +| `--bastion-sku ` | Default `Standard` | +| `-d, --debug` | Enable Azure CLI debug logging | > **Why scripts 2 + 3 must run from the jumpbox in private mode:** ACR is `publicNetworkAccess=Disabled`, so `docker push` and the Web App rollout APIs are only reachable from inside the VNet. @@ -255,15 +255,15 @@ The Private DNS zones are inside the resource group, so a single group delete is The same template covers both modes through the `isPrivate` flag: -| Behavior | `isPrivate=true` | `isPrivate=false` | -|---|---|---| -| VNet + subnets + NSGs | ✅ created | ❌ skipped | -| Private DNS zones | ✅ 12 zones, VNet-linked | ❌ skipped | -| Private endpoints on PaaS | ✅ on every data service | ❌ skipped | -| `publicNetworkAccess` on PaaS | `Disabled` | `Enabled` | -| Web App ingress | internal only | external | -| Jumpbox + Bastion | optional via `deployJumpbox` | always skipped | -| AMPLS | ✅ | ❌ (telemetry over public ingestion) | +| Behavior | `isPrivate=true` | `isPrivate=false` | +| ----------------------------- | ---------------------------- | ----------------------------------- | +| VNet + subnets + NSGs | ✅ created | ❌ skipped | +| Private DNS zones | ✅ 12 zones, VNet-linked | ❌ skipped | +| Private endpoints on PaaS | ✅ on every data service | ❌ skipped | +| `publicNetworkAccess` on PaaS | `Disabled` | `Enabled` | +| Web App ingress | internal only | external | +| Jumpbox + Bastion | optional via `deployJumpbox` | always skipped | +| AMPLS | ✅ | ❌ (telemetry over public ingestion) | Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly to the bicep template, to switch. @@ -271,15 +271,15 @@ Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly ## 12. Troubleshooting -| Symptom | Likely cause | Fix | -|---|---|---| -| `403 PublicNetworkAccess is disabled` from your laptop | Trying to reach Cosmos / Storage / ACR from the public internet | Use the jumpbox or temporarily allow your IP via the resource's networking blade | -| `Bastion: target resource id not found` | Bastion SKU is `Basic` | Redeploy with `--bastion-sku Standard` | -| `docker push` fails on the jumpbox with name-resolution error | Private DNS zone link not yet propagated | Wait 1–2 minutes after `1-deploy-azure-infra.sh` finishes; re-run `nslookup .azurecr.io` | -| Web app cold-start fails to pull image | UAMI missing `AcrPull` on ACR | Re-run `1-deploy-azure-infra.sh` (idempotent) — module assigns the role | -| FastAPI returns `401` from Cosmos | Deployer / UAMI not added as Cosmos Data Contributor | Verify with `az cosmosdb sql role assignment list -a -g ` | -| `nslookup .azurewebsites.net` returns a public IP from the jumpbox | Web App private endpoint not yet linked to `privatelink.azurewebsites.net` | Confirm the zone exists and is VNet-linked; re-run rollout | -| AI Foundry call fails with `OperationNotAllowed` | Region mismatch — AI Services data plane not reachable via the configured PE | Set `aiFoundryLocation` to the same region as the rest of the deployment, or open an outbound `Microsoft.CognitiveServices` service endpoint on `snet-appsvc` (already enabled by default) | +| Symptom | Likely cause | Fix | +| --------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `403 PublicNetworkAccess is disabled` from your laptop | Trying to reach Cosmos / Storage / ACR from the public internet | Use the jumpbox or temporarily allow your IP via the resource's networking blade | +| `Bastion: target resource id not found` | Bastion SKU is `Basic` | Redeploy with `--bastion-sku Standard` | +| `docker push` fails on the jumpbox with name-resolution error | Private DNS zone link not yet propagated | Wait 1–2 minutes after `1-deploy-azure-infra.sh` finishes; re-run `nslookup .azurecr.io` | +| Web app cold-start fails to pull image | UAMI missing `AcrPull` on ACR | Re-run `1-deploy-azure-infra.sh` (idempotent) — module assigns the role | +| FastAPI returns `401` from Cosmos | Deployer / UAMI not added as Cosmos Data Contributor | Verify with `az cosmosdb sql role assignment list -a -g ` | +| `nslookup .azurewebsites.net` returns a public IP from the jumpbox | Web App private endpoint not yet linked to `privatelink.azurewebsites.net` | Confirm the zone exists and is VNet-linked; re-run rollout | +| AI Foundry call fails with `OperationNotAllowed` | Region mismatch — AI Services data plane not reachable via the configured PE | Set `aiFoundryLocation` to the same region as the rest of the deployment, or open an outbound `Microsoft.CognitiveServices` service endpoint on `snet-appsvc` (already enabled by default) | --- From b5aba50bbc7c8cbde479a6fddefc463e32dff7e6 Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Thu, 7 May 2026 16:23:02 +0300 Subject: [PATCH 5/8] Switch zero-trust jumpbox from Linux/SSH to Windows/RDP MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - jumpbox.bicep: Windows Server 2022 (Azure Edition), CustomScriptExtension installs Azure CLI, Git, Bicep, Docker EE, and clones the sample repo. - main.bicep: jumpboxAdminPublicKey -> jumpboxAdminPassword (secure). - main.json: regenerated so the one-click 'Deploy to Azure' button now prompts for jumpboxAdminPassword. - 1-deploy-azure-infra.sh: --ssh-key-file deprecated, replaced with --admin-password (interactive prompt + complexity validation). - 0-connect-jumpbox.sh: auto-detects host OS — uses 'az network bastion rdp' on Windows and 'az network bastion tunnel' (localhost:50389 -> VM:3389) on macOS/Linux. - README.md, docs/PRIVATE_DEPLOYMENT.md, _assets/ZERO_TRUST_ARCHITECTURE.md, _assets/zero-trust-architecture.mmd: updated for Windows + RDP. Validated with 'az bicep build' (no errors) and 'az deployment group what-if' (status: Succeeded; VM image confirmed Windows Server 2022, windowsConfiguration present, adminPassword wired through). --- README.md | 12 +-- _assets/ZERO_TRUST_ARCHITECTURE.md | 4 +- _assets/zero-trust-architecture.mmd | 4 +- docs/PRIVATE_DEPLOYMENT.md | 37 ++++----- infra/0-connect-jumpbox.sh | 74 ++++++++++++----- infra/1-deploy-azure-infra.sh | 40 ++++++---- infra/2-build-and-push-images.sh | 6 +- infra/bicep/main.bicep | 8 +- infra/bicep/main.json | 65 ++++++++------- infra/bicep/modules/jumpbox.bicep | 119 ++++++++++++++++++---------- 10 files changed, 230 insertions(+), 139 deletions(-) diff --git a/README.md b/README.md index 6cea80d..9535eac 100644 --- a/README.md +++ b/README.md @@ -126,7 +126,7 @@ The application uses Server-Sent Events (SSE) for real-time updates: ## � One-Click Azure Deployment -Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, internal Container Apps, Cosmos DB, Storage, Azure AI Foundry, Key Vault, Container Registry, and an optional jumpbox + Azure Bastion) directly from the Azure Portal using the pre-built ARM template at [infra/bicep/main.json](infra/bicep/main.json): +Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, internal Container Apps, Cosmos DB, Storage, Azure AI Foundry, Key Vault, Container Registry, and an optional Windows jumpbox + Azure Bastion) directly from the Azure Portal using the pre-built ARM template at [infra/bicep/main.json](infra/bicep/main.json):

    AI Investment Analysis - Private Zero-Trust Architecture @@ -148,7 +148,7 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p ### Before you click 1. **Create (or pick) a resource group** in your target subscription — the template deploys at resource-group scope. -2. **Generate an SSH public key** if you keep the default `deployJumpbox=true`. Paste the contents of `~/.ssh/id_rsa.pub` (or any OpenSSH public key) into the `jumpboxAdminPublicKey` field. Leave it empty only if you set `deployJumpbox=false`. +2. **Choose a Windows admin password** if you keep the default `deployJumpbox=true`. Enter it in the `jumpboxAdminPassword` field. The password must be 12–123 characters and contain at least three of: lowercase, uppercase, digit, special character. Leave it empty only if you set `deployJumpbox=false`. 3. **Pick locations** that have capacity for Azure AI Foundry models (e.g. `swedencentral`, `eastus2`) for `aiFoundryLocation`. ### Key parameters @@ -160,9 +160,9 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p | `location` | resource group location | Region for most resources | | `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | | `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + internal ACA). Set `false` for a public, demo-only topology. | -| `deployJumpbox` | `true` | Deploy a Linux jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | -| `jumpboxAdminPublicKey` | _(empty)_ | **Required when `deployJumpbox=true`** — your SSH public key | -| `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client tunneling) | +| `deployJumpbox` | `true` | Deploy a Windows jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | +| `jumpboxAdminPassword` | _(empty)_ | **Required when `deployJumpbox=true`** — Windows admin password (12–123 chars, complexity rules apply) | +| `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client RDP tunneling) | | `vnetAddressPrefix` | `10.50.0.0/16` | VNet CIDR when `isPrivate=true` | > **Note:** The portal one-click flow provisions the Azure infrastructure only. After the deployment finishes, build and push the container images and roll out the apps with the helper scripts: @@ -181,7 +181,7 @@ The end-to-end reference for the zero-trust topology — every parameter, module - Customize VNet sizing, subnets, or NSG rules - Understand which roles are granted to the workload UAMI and the deployer - Switch between `isPrivate=true` (zero-trust) and `isPrivate=false` (public demo) -- Operate the jumpbox + Azure Bastion access plane +- Operate the jumpbox + Azure Bastion access plane (Windows VM, RDP via Bastion) - Troubleshoot private-endpoint, DNS, or image-pull issues ## �📦 Prerequisites diff --git a/_assets/ZERO_TRUST_ARCHITECTURE.md b/_assets/ZERO_TRUST_ARCHITECTURE.md index 4bc4f09..2f1cfb8 100644 --- a/_assets/ZERO_TRUST_ARCHITECTURE.md +++ b/_assets/ZERO_TRUST_ARCHITECTURE.md @@ -24,7 +24,7 @@ flowchart LR Bastion[Azure Bastion
    Standard SKU
    *only* public IP]:::pub end subgraph S_Jump[snet-jumpbox] - Jump[Linux jumpbox VM
    no public IP
    UAMI attached]:::vnet + Jump[Windows jumpbox VM
    no public IP
    UAMI attached]:::vnet end subgraph S_Aca["snet-aca-infra (delegated)"] ACA[Container Apps Environment
    workload profiles · internal=true]:::app @@ -117,7 +117,7 @@ flowchart LR ### Operator deploy flow 1. Operator opens browser → **Azure Bastion** (HTTPS 443, Azure-hosted TLS). -2. Bastion proxies SSH to the **jumpbox VM** inside `snet-jumpbox`. +2. Bastion proxies RDP to the **Windows jumpbox VM** inside `snet-jumpbox`. 3. Jumpbox uses its UAMI to: - `docker push` to the private **ACR** via PE (`privatelink.azurecr.io`). - `az deployment group create` for the API / Web container app bicep. diff --git a/_assets/zero-trust-architecture.mmd b/_assets/zero-trust-architecture.mmd index d3855b3..9803cf6 100644 --- a/_assets/zero-trust-architecture.mmd +++ b/_assets/zero-trust-architecture.mmd @@ -19,7 +19,7 @@ flowchart LR Bastion["Azure Bastion · Standard
    (only public IP)"]:::pub end subgraph S_Jump["snet-jumpbox /27"] - Jump["Linux jumpbox VM
    no public IP · UAMI"]:::vnet + Jump["Windows jumpbox VM
    no public IP · UAMI"]:::vnet end subgraph S_Aca["snet-aca-infra /23 · delegated"] ACA["Container Apps Environment
    workload profiles · internal=true"]:::app @@ -64,7 +64,7 @@ flowchart LR end Op -- "HTTPS 443" --> Bastion - Bastion -- "SSH tunnel" --> Jump + Bastion -- "RDP tunnel" --> Jump Jump -- "docker push / az deploy" --> PE_Acr Jump -- "browser tunnel" --> WebApp diff --git a/docs/PRIVATE_DEPLOYMENT.md b/docs/PRIVATE_DEPLOYMENT.md index 13aefa2..4d18bb7 100644 --- a/docs/PRIVATE_DEPLOYMENT.md +++ b/docs/PRIVATE_DEPLOYMENT.md @@ -18,7 +18,7 @@ This guide documents **everything you need to deploy, operate, and customize the | Plane | Components | Public exposure | | ------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------ | -| Operator | Azure Bastion (Standard) → Linux jumpbox (no public IP) | Bastion TLS 443 only | +| Operator | Azure Bastion (Standard) → Windows jumpbox (no public IP) | Bastion TLS 443 only | | Workload | App Service Plan (Linux P0v3) hosting `api` + `web` Web Apps for Containers, ingress disabled publicly | None | | Data | Cosmos DB (NoSQL), Storage Account (Blob), Azure AI Foundry / OpenAI, Azure Container Registry (Premium) | `publicNetworkAccess=Disabled` | | Identity | One User-Assigned Managed Identity (UAMI) federated to apps + jumpbox | n/a | @@ -44,10 +44,10 @@ All parameters are defined in [`infra/bicep/main.bicep`](../infra/bicep/main.bic | ----------------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | | `isPrivate` | `true` | Master switch. `true` = full private deployment (everything in this doc). `false` = legacy public demo, no VNet, no PEs. | | `vnetAddressPrefix` | `10.50.0.0/16` | CIDR for the VNet. Must accommodate every subnet listed in §4. | -| `deployJumpbox` | `true` | When `true` (and `isPrivate=true`), provisions the Linux jumpbox + Bastion. | +| `deployJumpbox` | `true` | When `true` (and `isPrivate=true`), provisions the Windows jumpbox + Bastion. | | `jumpboxAdminUsername` | `azureuser` | Local admin user on the jumpbox. | -| `jumpboxAdminPublicKey` | _(empty, secure)_ | **Required when `deployJumpbox=true`**. Paste the contents of an OpenSSH public key (e.g. `~/.ssh/id_rsa.pub`). | -| `bastionSku` | `Standard` | `Standard` is required for native-client SSH tunneling used by [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh). | +| `jumpboxAdminPassword` | _(empty, secure)_ | **Required when `deployJumpbox=true`**. Windows admin password (12–123 chars; 3 of: lowercase/uppercase/digit/special). | +| `bastionSku` | `Standard` | `Standard` is required for native-client RDP tunneling used by [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh). | ### Application | Parameter | Default | Description | @@ -76,7 +76,7 @@ Each module in [`infra/bicep/modules/`](../infra/bicep/modules/) is conditional | `web-app-container.bicep` | (per app) Web App for Containers + VNet integration + private endpoint | Public ingress disabled | UAMI | | `ai-foundry.bicep` | Azure AI Services + Foundry project + model deployment | `publicNetworkAccess=Disabled` | UAMI → Azure AI User | | `bastion.bicep` * | Azure Bastion (`Standard`) | TLS 443 only | Operator Entra ID | -| `jumpbox.bicep` * | Linux VM, no public IP, UAMI attached | n/a | SSH key (Bastion-tunneled) | +| `jumpbox.bicep` * | Windows VM, no public IP, UAMI attached, CustomScriptExtension installs az/git/bicep | n/a | Admin password (Bastion-tunneled RDP) | | `private-endpoint.bicep` * | Used by every PaaS module above | n/a | n/a | > The legacy `container-apps-environment.bicep` is retained on disk for reference but is no longer instantiated — the workload now runs on App Service. @@ -98,7 +98,7 @@ Defined in [`infra/bicep/modules/network.bicep`](../infra/bicep/modules/network. **NSG posture (deny-by-default with explicit allows):** - `nsg-pe`: allow VNet→VNet TCP 443 -- `nsg-jumpbox`: allow VNet TCP 22/3389 (Bastion only) +- `nsg-jumpbox`: allow VNet TCP 3389 (Bastion only) - `nsg-bastion`: full Bastion ruleset per Microsoft docs (HTTPS in, GatewayManager, Load Balancer, SSH/RDP out, AzureCloud:443 out) - `nsg-aca` (legacy, kept empty): platform-managed when ACA was used @@ -194,20 +194,20 @@ Use the **Deploy to Azure** button in the [root README](../README.md#-one-click- -l swedencentral \ -p invstdemo \ -e dev \ - --ssh-key-file ~/.ssh/id_rsa.pub + --admin-password '' -# 2. Open an SSH tunnel into the jumpbox via Bastion +# 2. Open an RDP tunnel into the Windows jumpbox via Bastion ./infra/0-connect-jumpbox.sh -g -# On the jumpbox: -git clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git -cd Agentic-AI-Investment-Analysis-Sample +# On the jumpbox (PowerShell): +# The deployment auto-clones the repo to C:\Users\Public\Desktop. +cd C:\Users\Public\Desktop\Agentic-AI-Investment-Analysis-Sample # 3. Build & push container images to the private ACR (uses UAMI on the jumpbox) -./infra/2-build-and-push-images.sh -g +bash infra/2-build-and-push-images.sh -g # 4. Roll out / update the api + web Web Apps -./infra/3-deploy-apps.sh -g +bash infra/3-deploy-apps.sh -g ``` Flags accepted by `1-deploy-azure-infra.sh`: @@ -221,7 +221,8 @@ Flags accepted by `1-deploy-azure-infra.sh`: | `-e, --environment` | Environment tag | | `--public` | Deploy the legacy public topology (`isPrivate=false`) | | `--no-jumpbox` | Skip jumpbox + Bastion | -| `--ssh-key-file ` | Public key for the jumpbox (default `~/.ssh/id_rsa.pub`) | +| `--ssh-key-file ` | _Deprecated_ — the jumpbox is now Windows. Use `--admin-password`. | +| `--admin-password ` | Windows admin password for the jumpbox (12–123 chars; complexity rules apply). Prompted interactively if omitted. | | `--bastion-sku ` | Default `Standard` | | `-d, --debug` | Enable Azure CLI debug logging | @@ -235,13 +236,13 @@ Flags accepted by `1-deploy-azure-infra.sh`: ```bash ./infra/0-connect-jumpbox.sh -g ``` -Internally this runs `az network bastion ssh --auth-type ssh-key`, which requires Bastion **Standard** SKU. +Internally this runs `az network bastion rdp` (Windows host) or `az network bastion tunnel` to forward localhost:50389 → VM:3389 (macOS/Linux), and requires Bastion **Standard** SKU. ### Reaching the Web app from your laptop The Web app has internal-only ingress. To browse it during development, open an additional Bastion tunnel from the jumpbox to the Web app FQDN, or deploy a self-service VPN gateway / Azure Front Door Premium with Private Link in front of it. The sample does **not** ship a VPN gateway — Bastion + jumpbox is the documented path. -### Rotating the jumpbox key -Re-run `1-deploy-azure-infra.sh --ssh-key-file ` against the same resource group; the VM extension rewrites `authorized_keys`. +### Rotating the jumpbox password +Re-run `1-deploy-azure-infra.sh --admin-password ''` against the same resource group; the VM admin password is updated in place. ### Tearing down ```bash @@ -289,5 +290,5 @@ Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly - [`infra/bicep/main.bicep`](../infra/bicep/main.bicep) — root template (resource-group scope) - [`infra/bicep/modules/`](../infra/bicep/modules/) — per-resource modules - [`infra/1-deploy-azure-infra.sh`](../infra/1-deploy-azure-infra.sh) — CLI deploy wrapper -- [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh) — Bastion SSH tunnel +- [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh) — Bastion RDP tunnel to the Windows jumpbox - [`infra/2-build-and-push-images.sh`](../infra/2-build-and-push-images.sh) / [`3-deploy-apps.sh`](../infra/3-deploy-apps.sh) — image + app rollout (run on the jumpbox in private mode) diff --git a/infra/0-connect-jumpbox.sh b/infra/0-connect-jumpbox.sh index 4bca8dc..c9e08f4 100755 --- a/infra/0-connect-jumpbox.sh +++ b/infra/0-connect-jumpbox.sh @@ -1,10 +1,13 @@ #!/bin/bash -# Connect to the zero-trust jumpbox VM over Azure Bastion using SSH tunneling. +# Connect to the zero-trust Windows jumpbox VM over Azure Bastion using RDP. # # Prerequisites on your laptop: -# - Azure CLI + ssh -# - Logged in with 'az login' to the same subscription -# - Bastion SKU must be 'Standard' (tunneling is not supported on Basic) +# - Azure CLI (logged in with `az login` to the same subscription) +# - Bastion SKU must be 'Standard' (native-client tunneling not supported on Basic) +# - On macOS/Linux: an RDP client (e.g. Microsoft Remote Desktop on macOS, +# `xfreerdp` / `remmina` on Linux). The script opens an `az network bastion +# tunnel` to the VM's RDP port and you connect your client to localhost. +# - On Windows: nothing extra — `az network bastion rdp` launches mstsc directly. # # Usage: ./infra/0-connect-jumpbox.sh -g [options] @@ -18,13 +21,16 @@ NC='\033[0m' RESOURCE_GROUP="" ADMIN_USER="azureuser" -PORT="50022" +PORT="50389" +MODE="auto" # auto | tunnel | rdp usage() { echo "Usage: $0 -g [options]" echo " -g, --resource-group Azure Resource Group name (required)" - echo " -u, --user SSH user on the jumpbox (default: azureuser)" - echo " -p, --local-port Local port for the Bastion tunnel (default: 50022)" + echo " -u, --user RDP user on the jumpbox (default: azureuser)" + echo " -p, --local-port Local port for the Bastion tunnel (default: 50389)" + echo " --tunnel Force tunnel mode (open localhost: -> VM:3389)" + echo " --rdp Force native 'az network bastion rdp' mode (Windows only)" echo " -h, --help Show this help" exit 1 } @@ -34,6 +40,8 @@ while [[ $# -gt 0 ]]; do -g|--resource-group) RESOURCE_GROUP="$2"; shift 2 ;; -u|--user) ADMIN_USER="$2"; shift 2 ;; -p|--local-port) PORT="$2"; shift 2 ;; + --tunnel) MODE="tunnel"; shift ;; + --rdp) MODE="rdp"; shift ;; -h|--help) usage ;; *) echo "Unknown option $1"; usage ;; esac @@ -62,21 +70,45 @@ fi JUMPBOX_ID=$(az vm show -g "$RESOURCE_GROUP" -n "$JUMPBOX_NAME" --query id -o tsv) -echo -e "${BLUE}🔐 Opening SSH session to jumpbox via Bastion...${NC}" +# Auto-pick the right command per host OS. +if [ "$MODE" == "auto" ]; then + case "$(uname -s)" in + MINGW*|MSYS*|CYGWIN*) MODE="rdp" ;; + *) MODE="tunnel" ;; + esac +fi + +echo -e "${BLUE}🔐 Opening RDP session to Windows jumpbox via Bastion...${NC}" echo -e "${BLUE} Jumpbox: $JUMPBOX_NAME${NC}" echo -e "${BLUE} Bastion: $BASTION_NAME${NC}" -echo "" -echo -e "${YELLOW}Once connected, clone the repo and run scripts 2 and 3 from the jumpbox:${NC}" -echo -e "${YELLOW} git clone ${NC}" -echo -e "${YELLOW} cd Agentic-AI-Investment-Analysis-Sample${NC}" -echo -e "${YELLOW} ./infra/2-build-and-push-images.sh -r ${NC}" -echo -e "${YELLOW} ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP${NC}" +echo -e "${BLUE} Mode: $MODE${NC}" echo "" -az network bastion ssh \ - --name "$BASTION_NAME" \ - --resource-group "$RESOURCE_GROUP" \ - --target-resource-id "$JUMPBOX_ID" \ - --auth-type ssh-key \ - --username "$ADMIN_USER" \ - --ssh-key "$HOME/.ssh/id_rsa" +if [ "$MODE" == "rdp" ]; then + echo -e "${YELLOW}Launching native RDP client (Windows mstsc)...${NC}" + az network bastion rdp \ + --name "$BASTION_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --target-resource-id "$JUMPBOX_ID" +else + echo -e "${YELLOW}Opening Bastion tunnel on localhost:$PORT -> $JUMPBOX_NAME:3389${NC}" + echo -e "${YELLOW}Connect your RDP client to: localhost:$PORT${NC}" + echo -e "${YELLOW} User: $ADMIN_USER${NC}" + echo -e "${YELLOW} Password: (the admin password you set during deployment)${NC}" + echo "" + echo -e "${YELLOW}On macOS: open 'Microsoft Remote Desktop' and add a PC at localhost:$PORT${NC}" + echo -e "${YELLOW}On Linux: xfreerdp /v:localhost:$PORT /u:$ADMIN_USER${NC}" + echo "" + echo -e "${YELLOW}Once connected, on the jumpbox open PowerShell and run:${NC}" + echo -e "${YELLOW} cd C:\\Users\\Public\\Desktop\\Agentic-AI-Investment-Analysis-Sample${NC}" + echo -e "${YELLOW} bash infra/2-build-and-push-images.sh -r ${NC}" + echo -e "${YELLOW} bash infra/3-deploy-apps.sh -g $RESOURCE_GROUP${NC}" + echo "" + echo -e "${BLUE}Press Ctrl+C in this terminal to close the tunnel when finished.${NC}" + az network bastion tunnel \ + --name "$BASTION_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --target-resource-id "$JUMPBOX_ID" \ + --resource-port 3389 \ + --port "$PORT" +fi diff --git a/infra/1-deploy-azure-infra.sh b/infra/1-deploy-azure-infra.sh index e29abb9..f8970ba 100755 --- a/infra/1-deploy-azure-infra.sh +++ b/infra/1-deploy-azure-infra.sh @@ -21,7 +21,7 @@ ENVIRONMENT="dev" DEBUG="false" IS_PRIVATE="true" DEPLOY_JUMPBOX="true" -SSH_KEY_FILE="" +ADMIN_PASSWORD="" BASTION_SKU="Standard" # Function to show usage @@ -38,7 +38,7 @@ usage() { echo " -a, --ai-foundry-location AI Foundry location (default: swedencentral)" echo " --public Deploy the legacy public topology (isPrivate=false)" echo " --no-jumpbox Skip jumpbox/Bastion deployment when private" - echo " --ssh-key-file Path to SSH public key for the jumpbox (default: ~/.ssh/id_rsa.pub)" + echo " --admin-password Admin password for the Windows jumpbox VM (12-123 chars; mix of upper/lower/digit/special). If omitted you will be prompted." echo " --bastion-sku Bastion SKU: Basic or Standard (default: Standard)" echo " -d, --debug Enable debug logging" echo " -h, --help Show this help message" @@ -82,7 +82,11 @@ while [[ $# -gt 0 ]]; do shift ;; --ssh-key-file) - SSH_KEY_FILE="$2" + echo -e "${YELLOW}⚠️ --ssh-key-file is deprecated; the jumpbox is now Windows. Use --admin-password instead.${NC}" + shift 2 + ;; + --admin-password) + ADMIN_PASSWORD="$2" shift 2 ;; --bastion-sku) @@ -164,20 +168,28 @@ fi echo -e "${BLUE}🏗️ Deploying Azure infrastructure...${NC}" DEPLOYMENT_NAME="ai-invest-sample-$(date +%s)" -# Resolve SSH public key (required when deploying the jumpbox) -JUMPBOX_PUBKEY="" +# Resolve Windows jumpbox admin password (required when deploying the jumpbox) +JUMPBOX_PASSWORD="" if [ "$IS_PRIVATE" == "true" ] && [ "$DEPLOY_JUMPBOX" == "true" ]; then - if [ -z "$SSH_KEY_FILE" ]; then - SSH_KEY_FILE="$HOME/.ssh/id_rsa.pub" + if [ -z "$ADMIN_PASSWORD" ]; then + echo -e "${YELLOW}🔐 Enter an admin password for the Windows jumpbox VM.${NC}" + echo -e "${YELLOW} Must be 12-123 chars and include 3 of: lowercase, uppercase, digit, special.${NC}" + read -r -s -p "Admin password: " ADMIN_PASSWORD + echo + read -r -s -p "Confirm password: " ADMIN_PASSWORD_CONFIRM + echo + if [ "$ADMIN_PASSWORD" != "$ADMIN_PASSWORD_CONFIRM" ]; then + echo -e "${RED}❌ Passwords do not match.${NC}" + exit 1 + fi fi - if [ ! -f "$SSH_KEY_FILE" ]; then - echo -e "${RED}❌ SSH public key not found at $SSH_KEY_FILE.${NC}" - echo -e "${YELLOW} Generate one with 'ssh-keygen -t rsa -b 4096' or pass --ssh-key-file .${NC}" - echo -e "${YELLOW} Alternatively, re-run with --no-jumpbox or --public to skip.${NC}" + if [ ${#ADMIN_PASSWORD} -lt 12 ]; then + echo -e "${RED}❌ Admin password must be at least 12 characters.${NC}" + echo -e "${YELLOW} Re-run with --admin-password '' or --no-jumpbox / --public to skip.${NC}" exit 1 fi - JUMPBOX_PUBKEY=$(cat "$SSH_KEY_FILE") - echo -e "${GREEN}✅ Using SSH public key: $SSH_KEY_FILE${NC}" + JUMPBOX_PASSWORD="$ADMIN_PASSWORD" + echo -e "${GREEN}✅ Using provided admin password for Windows jumpbox${NC}" fi optional_args=() @@ -197,7 +209,7 @@ az deployment group create \ isPrivate="$IS_PRIVATE" \ deployJumpbox="$DEPLOY_JUMPBOX" \ bastionSku="$BASTION_SKU" \ - jumpboxAdminPublicKey="$JUMPBOX_PUBKEY" \ + jumpboxAdminPassword="$JUMPBOX_PASSWORD" \ --name "$DEPLOYMENT_NAME" \ --output table ${optional_args[@]} diff --git a/infra/2-build-and-push-images.sh b/infra/2-build-and-push-images.sh index 228d942..a5b8662 100755 --- a/infra/2-build-and-push-images.sh +++ b/infra/2-build-and-push-images.sh @@ -19,9 +19,9 @@ BUILD_API="false" BUILD_WEB="false" BUILD_ALL="true" # Default build mode: 'docker' builds locally and pushes (works from the -# zero-trust jumpbox since it resolves the private ACR via VNet). Use --acr -# to submit to ACR Tasks — note that against a private ACR this requires a -# VNet-enabled dedicated agent pool (Premium feature). +# zero-trust Windows jumpbox when Docker EE is installed and the private ACR +# is reachable via VNet). Use --acr to submit to ACR Tasks — note that against +# a private ACR this requires a VNet-enabled dedicated agent pool (Premium feature). BUILD_MODE="docker" # Function to show usage diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep index 927b323..70cec5c 100644 --- a/infra/bicep/main.bicep +++ b/infra/bicep/main.bicep @@ -15,7 +15,7 @@ param location string = resourceGroup().location @description('When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources.') param isPrivate bool = true -@description('When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access.') +@description('When true (and isPrivate=true), also deploys a Windows jumpbox + Azure Bastion for operator access.') param deployJumpbox bool = true @description('VNet address space used when isPrivate=true') @@ -24,9 +24,9 @@ param vnetAddressPrefix string = '10.50.0.0/16' @description('Admin username for the jumpbox VM') param jumpboxAdminUsername string = 'azureuser' -@description('SSH public key for the jumpbox VM (required when deployJumpbox=true)') +@description('Admin password for the Windows jumpbox VM (required when deployJumpbox=true). Must satisfy Azure Windows VM password complexity rules: 12-123 chars; 3 of: lowercase, uppercase, digit, special.') @secure() -param jumpboxAdminPublicKey string = '' +param jumpboxAdminPassword string = '' @description('Azure Bastion SKU. Standard required for native-client tunneling.') @allowed([ 'Basic', 'Standard' ]) @@ -249,7 +249,7 @@ module jumpbox 'modules/jumpbox.bicep' = if (isPrivate && deployJumpbox) { location: location subnetId: network.outputs.jumpboxSubnetId adminUsername: jumpboxAdminUsername - adminPublicKey: jumpboxAdminPublicKey + adminPassword: jumpboxAdminPassword userAssignedIdentityId: userAssignedIdentity.outputs.resourceId tags: tags } diff --git a/infra/bicep/main.json b/infra/bicep/main.json index c97ff3d..a31e5e0 100644 --- a/infra/bicep/main.json +++ b/infra/bicep/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "3235998341901409051" + "templateHash": "4960232274037771954" } }, "parameters": { @@ -42,7 +42,7 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access." + "description": "When true (and isPrivate=true), also deploys a Windows jumpbox + Azure Bastion for operator access." } }, "vnetAddressPrefix": { @@ -59,11 +59,11 @@ "description": "Admin username for the jumpbox VM" } }, - "jumpboxAdminPublicKey": { + "jumpboxAdminPassword": { "type": "securestring", "defaultValue": "", "metadata": { - "description": "SSH public key for the jumpbox VM (required when deployJumpbox=true)" + "description": "Admin password for the Windows jumpbox VM (required when deployJumpbox=true). Must satisfy Azure Windows VM password complexity rules: 12-123 chars; 3 of: lowercase, uppercase, digit, special." } }, "bastionSku": { @@ -43161,8 +43161,8 @@ "adminUsername": { "value": "[parameters('jumpboxAdminUsername')]" }, - "adminPublicKey": { - "value": "[parameters('jumpboxAdminPublicKey')]" + "adminPassword": { + "value": "[parameters('jumpboxAdminPassword')]" }, "userAssignedIdentityId": { "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" @@ -43178,7 +43178,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "5495470989234358791" + "templateHash": "16365167653907153569" } }, "parameters": { @@ -43203,22 +43203,22 @@ }, "vmSize": { "type": "string", - "defaultValue": "Standard_B2s", + "defaultValue": "Standard_D2s_v5", "metadata": { - "description": "VM size. B-series default — cheap, enough for az cli + docker." + "description": "VM size. Default sized for az cli + dev tooling." } }, "adminUsername": { "type": "string", "defaultValue": "azureuser", "metadata": { - "description": "Admin username for SSH (accessed via Bastion)" + "description": "Admin username for RDP (accessed via Bastion)" } }, - "adminPublicKey": { + "adminPassword": { "type": "securestring", "metadata": { - "description": "SSH public key used to log in (via Bastion)" + "description": "Admin password used to log in (via Bastion RDP). Must satisfy Azure Windows VM password complexity rules." } }, "userAssignedIdentityId": { @@ -43236,7 +43236,7 @@ } }, "variables": { - "cloudInit": "#cloud-config\npackage_update: true\npackage_upgrade: false\npackages:\n - ca-certificates\n - curl\n - gnupg\n - lsb-release\n - jq\n - git\nruncmd:\n - curl -sL https://aka.ms/InstallAzureCLIDeb | bash\n - az bicep install || true\n - install -m 0755 -d /etc/apt/keyrings\n - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg\n - chmod a+r /etc/apt/keyrings/docker.gpg\n - echo \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable\" > /etc/apt/sources.list.d/docker.list\n - apt-get update\n - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin\n - usermod -aG docker azureuser\n" + "bootstrapScript": "$ErrorActionPreference = \"Continue\"\n$ProgressPreference = \"SilentlyContinue\"\nStart-Transcript -Path \"C:\\\\Windows\\\\Temp\\\\jumpbox-bootstrap.log\" -Append\n\n# Trust PSGallery + ensure TLS 1.2\n[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n\n# 1) Install Chocolatey (used to install az cli, git, bicep)\nif (-not (Get-Command choco.exe -ErrorAction SilentlyContinue)) {\n Set-ExecutionPolicy Bypass -Scope Process -Force\n iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))\n}\n\n$env:Path = \"$env:Path;C:\\\\ProgramData\\\\chocolatey\\\\bin\"\n\n# 2) Operator tools\nchoco install -y --no-progress azure-cli\nchoco install -y --no-progress git\nchoco install -y --no-progress bicep\nchoco install -y --no-progress microsoft-edge\n\n# 3) Docker EE on Windows Server (best-effort; safe to fail — `az acr build`\n# is the recommended path for image builds from the jumpbox).\ntry {\n Install-WindowsFeature -Name Containers -IncludeManagementTools -ErrorAction SilentlyContinue\n Install-Module -Name DockerMsftProvider -Repository PSGallery -Force -ErrorAction SilentlyContinue\n Install-Package -Name docker -ProviderName DockerMsftProvider -Force -ErrorAction SilentlyContinue\n} catch {\n Write-Host \"Docker install skipped: $_\"\n}\n\n# 4) Clone the sample repo to the operator desktop for convenience\n$repoDir = \"C:\\\\Users\\\\Public\\\\Desktop\\\\Agentic-AI-Investment-Analysis-Sample\"\nif (-not (Test-Path $repoDir)) {\n & \"C:\\\\Program Files\\\\Git\\\\bin\\\\git.exe\" clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git $repoDir 2>&1 | Out-Null\n}\n\nStop-Transcript\n" }, "resources": [ { @@ -43277,9 +43277,9 @@ }, "storageProfile": { "imageReference": { - "publisher": "Canonical", - "offer": "ubuntu-24_04-lts", - "sku": "server", + "publisher": "MicrosoftWindowsServer", + "offer": "WindowsServer", + "sku": "2022-datacenter-azure-edition", "version": "latest" }, "osDisk": { @@ -43292,17 +43292,10 @@ "osProfile": { "computerName": "[parameters('name')]", "adminUsername": "[parameters('adminUsername')]", - "customData": "[base64(variables('cloudInit'))]", - "linuxConfiguration": { - "disablePasswordAuthentication": true, - "ssh": { - "publicKeys": [ - { - "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]", - "keyData": "[parameters('adminPublicKey')]" - } - ] - } + "adminPassword": "[parameters('adminPassword')]", + "windowsConfiguration": { + "enableAutomaticUpdates": true, + "provisionVMAgent": true } }, "networkProfile": { @@ -43316,6 +43309,24 @@ "dependsOn": [ "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" ] + }, + { + "type": "Microsoft.Compute/virtualMachines/extensions", + "apiVersion": "2024-03-01", + "name": "[format('{0}/{1}', parameters('name'), 'bootstrap')]", + "location": "[parameters('location')]", + "properties": { + "publisher": "Microsoft.Compute", + "type": "CustomScriptExtension", + "typeHandlerVersion": "1.10", + "autoUpgradeMinorVersion": true, + "settings": { + "script": "[base64(variables('bootstrapScript'))]" + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]" + ] } ], "outputs": { diff --git a/infra/bicep/modules/jumpbox.bicep b/infra/bicep/modules/jumpbox.bicep index 610dab8..223606c 100644 --- a/infra/bicep/modules/jumpbox.bicep +++ b/infra/bicep/modules/jumpbox.bicep @@ -1,8 +1,12 @@ -// Linux jumpbox VM for operator access over Azure Bastion. +// Windows jumpbox VM for operator access over Azure Bastion (RDP). // - No public IP. // - UAMI attached with AcrPush/AcrPull and Contributor (scoped RG) so scripts // 1-3 can run end-to-end from inside the VNet. -// - cloud-init installs Azure CLI, Docker, Bicep. +// - PowerShell post-deploy script installs: Azure CLI, Git, Bicep, and Docker +// (Docker EE on Windows Server) so the operator can run scripts 2 and 3 +// directly from the jumpbox. Image build and push from the jumpbox uses +// `az acr build` by default (no local Docker required) — Docker is installed +// only as a convenience for ad-hoc work. @description('Location for the VM') param location string = resourceGroup().location @@ -13,15 +17,15 @@ param name string @description('Subnet id for the VM NIC') param subnetId string -@description('VM size. B-series default — cheap, enough for az cli + docker.') -param vmSize string = 'Standard_B2s' +@description('VM size. Default sized for az cli + dev tooling.') +param vmSize string = 'Standard_D2s_v5' -@description('Admin username for SSH (accessed via Bastion)') +@description('Admin username for RDP (accessed via Bastion)') param adminUsername string = 'azureuser' -@description('SSH public key used to log in (via Bastion)') +@description('Admin password used to log in (via Bastion RDP). Must satisfy Azure Windows VM password complexity rules.') @secure() -param adminPublicKey string +param adminPassword string @description('User-assigned managed identity resource id to attach to the VM') param userAssignedIdentityId string @@ -29,27 +33,47 @@ param userAssignedIdentityId string @description('Tags for resources') param tags object = {} -var cloudInit = ''' -#cloud-config -package_update: true -package_upgrade: false -packages: - - ca-certificates - - curl - - gnupg - - lsb-release - - jq - - git -runcmd: - - curl -sL https://aka.ms/InstallAzureCLIDeb | bash - - az bicep install || true - - install -m 0755 -d /etc/apt/keyrings - - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg - - chmod a+r /etc/apt/keyrings/docker.gpg - - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list - - apt-get update - - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin - - usermod -aG docker azureuser +// PowerShell that installs operator tooling on first boot. +// Runs as SYSTEM via the CustomScriptExtension, so it installs machine-wide. +var bootstrapScript = ''' +$ErrorActionPreference = "Continue" +$ProgressPreference = "SilentlyContinue" +Start-Transcript -Path "C:\\Windows\\Temp\\jumpbox-bootstrap.log" -Append + +# Trust PSGallery + ensure TLS 1.2 +[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + +# 1) Install Chocolatey (used to install az cli, git, bicep) +if (-not (Get-Command choco.exe -ErrorAction SilentlyContinue)) { + Set-ExecutionPolicy Bypass -Scope Process -Force + iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) +} + +$env:Path = "$env:Path;C:\\ProgramData\\chocolatey\\bin" + +# 2) Operator tools +choco install -y --no-progress azure-cli +choco install -y --no-progress git +choco install -y --no-progress bicep +choco install -y --no-progress microsoft-edge + +# 3) Docker EE on Windows Server (best-effort; safe to fail — `az acr build` +# is the recommended path for image builds from the jumpbox). +try { + Install-WindowsFeature -Name Containers -IncludeManagementTools -ErrorAction SilentlyContinue + Install-Module -Name DockerMsftProvider -Repository PSGallery -Force -ErrorAction SilentlyContinue + Install-Package -Name docker -ProviderName DockerMsftProvider -Force -ErrorAction SilentlyContinue +} catch { + Write-Host "Docker install skipped: $_" +} + +# 4) Clone the sample repo to the operator desktop for convenience +$repoDir = "C:\\Users\\Public\\Desktop\\Agentic-AI-Investment-Analysis-Sample" +if (-not (Test-Path $repoDir)) { + & "C:\\Program Files\\Git\\bin\\git.exe" clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git $repoDir 2>&1 | Out-Null +} + +Stop-Transcript ''' resource nic 'Microsoft.Network/networkInterfaces@2023-11-01' = { @@ -83,9 +107,9 @@ resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { hardwareProfile: { vmSize: vmSize } storageProfile: { imageReference: { - publisher: 'Canonical' - offer: 'ubuntu-24_04-lts' - sku: 'server' + publisher: 'MicrosoftWindowsServer' + offer: 'WindowsServer' + sku: '2022-datacenter-azure-edition' version: 'latest' } osDisk: { @@ -96,17 +120,10 @@ resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { osProfile: { computerName: name adminUsername: adminUsername - customData: base64(cloudInit) - linuxConfiguration: { - disablePasswordAuthentication: true - ssh: { - publicKeys: [ - { - path: '/home/${adminUsername}/.ssh/authorized_keys' - keyData: adminPublicKey - } - ] - } + adminPassword: adminPassword + windowsConfiguration: { + enableAutomaticUpdates: true + provisionVMAgent: true } } networkProfile: { @@ -115,6 +132,24 @@ resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { } } +// Run the operator-tooling bootstrap script on first boot. +resource bootstrap 'Microsoft.Compute/virtualMachines/extensions@2024-03-01' = { + parent: vm + name: 'bootstrap' + location: location + properties: { + publisher: 'Microsoft.Compute' + type: 'CustomScriptExtension' + typeHandlerVersion: '1.10' + autoUpgradeMinorVersion: true + settings: { + // CustomScriptExtension (Windows) decodes `script` (base64 UTF-8), + // saves it to disk and runs it with PowerShell. + script: base64(bootstrapScript) + } + } +} + output vmId string = vm.id output vmName string = vm.name output nicPrivateIp string = nic.properties.ipConfigurations[0].properties.privateIPAddress From d0b9d21b76cb8a41c56b171be315e0e1708573ef Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Thu, 7 May 2026 16:28:47 +0300 Subject: [PATCH 6/8] Add Linux jumpbox variant + dual one-click deploy buttons - infra/bicep/modules/jumpbox-linux.bicep: restored original Linux jumpbox. - infra/bicep/main-linux.bicep + main-linux.json: parallel template that uses the Linux jumpbox (jumpboxAdminPublicKey). - README.md: two 'Deploy to Azure' buttons (Windows / Linux), pointing at the saadmsft fork so the regenerated templates are reachable. - README parameter table updated to cover both credentials. --- README.md | 25 +- infra/bicep/main-linux.bicep | 296 + infra/bicep/main-linux.json | 43429 ++++++++++++++++++++++ infra/bicep/modules/jumpbox-linux.bicep | 120 + 4 files changed, 43864 insertions(+), 6 deletions(-) create mode 100644 infra/bicep/main-linux.bicep create mode 100644 infra/bicep/main-linux.json create mode 100644 infra/bicep/modules/jumpbox-linux.bicep diff --git a/README.md b/README.md index 9535eac..8394d7c 100644 --- a/README.md +++ b/README.md @@ -126,7 +126,10 @@ The application uses Server-Sent Events (SSE) for real-time updates: ## � One-Click Azure Deployment -Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, internal Container Apps, Cosmos DB, Storage, Azure AI Foundry, Key Vault, Container Registry, and an optional Windows jumpbox + Azure Bastion) directly from the Azure Portal using the pre-built ARM template at [infra/bicep/main.json](infra/bicep/main.json): +Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, internal Container Apps, Cosmos DB, Storage, Azure AI Foundry, Key Vault, Container Registry, and an optional jumpbox + Azure Bastion) directly from the Azure Portal. Two pre-built ARM templates are provided so you can pick the operator OS that matches your laptop: + +- **Windows jumpbox (RDP via Bastion)** — recommended for Windows operators. Template: [infra/bicep/main.json](infra/bicep/main.json). +- **Linux jumpbox (SSH via Bastion)** — recommended for macOS/Linux operators. Template: [infra/bicep/main-linux.json](infra/bicep/main-linux.json).

    AI Investment Analysis - Private Zero-Trust Architecture @@ -141,14 +144,23 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p > See [`_assets/ZERO_TRUST_ARCHITECTURE.md`](_assets/ZERO_TRUST_ARCHITECTURE.md) for a full breakdown of the topology above. -[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) +#### Deploy with a Windows jumpbox (RDP) + +[![Deploy to Azure (Windows jumpbox)](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) +[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) + +#### Deploy with a Linux jumpbox (SSH) -[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2FAzure-Samples%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) +[![Deploy to Azure (Linux jumpbox)](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain-linux.json) +[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain-linux.json) ### Before you click 1. **Create (or pick) a resource group** in your target subscription — the template deploys at resource-group scope. -2. **Choose a Windows admin password** if you keep the default `deployJumpbox=true`. Enter it in the `jumpboxAdminPassword` field. The password must be 12–123 characters and contain at least three of: lowercase, uppercase, digit, special character. Leave it empty only if you set `deployJumpbox=false`. +2. **Choose your jumpbox credential** if you keep the default `deployJumpbox=true`: + - **Windows template** — supply a `jumpboxAdminPassword` (12–123 chars; at least three of lowercase, uppercase, digit, special character). + - **Linux template** — paste the contents of `~/.ssh/id_rsa.pub` (or any OpenSSH public key) into `jumpboxAdminPublicKey`. + Leave the credential empty only if you set `deployJumpbox=false`. 3. **Pick locations** that have capacity for Azure AI Foundry models (e.g. `swedencentral`, `eastus2`) for `aiFoundryLocation`. ### Key parameters @@ -160,8 +172,9 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p | `location` | resource group location | Region for most resources | | `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | | `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + internal ACA). Set `false` for a public, demo-only topology. | -| `deployJumpbox` | `true` | Deploy a Windows jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | -| `jumpboxAdminPassword` | _(empty)_ | **Required when `deployJumpbox=true`** — Windows admin password (12–123 chars, complexity rules apply) | +| `deployJumpbox` | `true` | Deploy a jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | +| `jumpboxAdminPassword` | _(empty)_ | **Windows template only** — required when `deployJumpbox=true`. 12–123 chars, complexity rules apply. | +| `jumpboxAdminPublicKey` | _(empty)_ | **Linux template only** — required when `deployJumpbox=true`. OpenSSH public key. | | `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client RDP tunneling) | | `vnetAddressPrefix` | `10.50.0.0/16` | VNet CIDR when `isPrivate=true` | diff --git a/infra/bicep/main-linux.bicep b/infra/bicep/main-linux.bicep new file mode 100644 index 0000000..a2296bf --- /dev/null +++ b/infra/bicep/main-linux.bicep @@ -0,0 +1,296 @@ +targetScope = 'resourceGroup' // Resource group scope + +@description('Name prefix for all resources') +param namePrefix string = 'invstdemo' + +@description('Environment name (dev, staging, prod)') +param environment string = 'dev' + +@description('Location for all resources') +param location string = resourceGroup().location + +// ################################################ +// Zero-trust / networking parameters + +@description('When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources.') +param isPrivate bool = true + +@description('When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access.') +param deployJumpbox bool = true + +@description('VNet address space used when isPrivate=true') +param vnetAddressPrefix string = '10.50.0.0/16' + +@description('Admin username for the jumpbox VM') +param jumpboxAdminUsername string = 'azureuser' + +@description('SSH public key for the jumpbox VM (required when deployJumpbox=true)') +@secure() +param jumpboxAdminPublicKey string = '' + +@description('Azure Bastion SKU. Standard required for native-client tunneling.') +@allowed([ 'Basic', 'Standard' ]) +param bastionSku string = 'Standard' + +// ################################################ +// Application specific parameters + +@description('Cosmos DB database name') +param cosmosDbName string = 'ai-investment-analysis-sample' + +param cosmosDBContainerNames array = [ + {name: 'opportunities', partitionKey: '/owner_id'} + {name: 'users', partitionKey: '/email'} + {name: 'documents', partitionKey: '/opportunity_id'} + {name: 'analysis', partitionKey: '/opportunity_id'} + {name: 'workflow_events', partitionKey: '/analysis_id'} + {name: 'what_if_conversations', partitionKey: '/analysis_id'} +] + +@description('Name of the blob storage container for documents') +param docsContainerName string = 'opportunity-documents' + +@description('Location for AI Foundry resources') +param aiFoundryLocation string = resourceGroup().location + + +var resourceGroupId = resourceGroup().id +var tags = { + Environment: environment + Project: 'ai-investment-analysis-sample' +} + +var shortHash = substring(uniqueString(resourceGroup().id, deployment().name), 0, 8) + +// ################################################ +// Networking (VNet + Private DNS) — deployed first when isPrivate=true + +module network 'modules/network.bicep' = if (isPrivate) { + name: 'networkDeployment.${shortHash}' + params: { + vnetName: toLower('${namePrefix}-vnet-${uniqueString(resourceGroupId)}') + vnetAddressPrefix: vnetAddressPrefix + location: location + tags: tags + } +} + +module privateDns 'modules/private-dns.bicep' = if (isPrivate) { + name: 'privateDnsDeployment.${shortHash}' + params: { + vnetId: network.outputs.vnetId + tags: tags + } +} + +// ################################################ +// Identity + +module userAssignedIdentity 'modules/user-assigned-identity.bicep' = { + name: 'userAssignedIdentityDeployment.${shortHash}' + params: { + userAssignedIdentityName: toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') + location: location + tags: tags + } +} + +// ################################################ +// Log Analytics + Application Insights + +module logAnalytics 'modules/log-analytics-ws.bicep' = { + name: 'logAnalyticsDeployment.${shortHash}' + params: { + logAnalyticsWorkspaceName: toLower('${namePrefix}-law-${uniqueString(resourceGroupId)}') + roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] + location: location + tags: tags + isPrivate: isPrivate + } +} + +module appInsights 'modules/app-insights.bicep' = { + name: 'appInsightsDeployment.${shortHash}' + params: { + appInsightsName: toLower('${namePrefix}-appi-${uniqueString(resourceGroupId)}') + location: location + logAnalyticsResourceId: logAnalytics.outputs.resourceId + tags: tags + isPrivate: isPrivate + } +} + +// Azure Monitor Private Link Scope — binds LA + AppI so telemetry flows over VNet. +module ampls 'modules/ampls.bicep' = if (isPrivate) { + name: 'amplsDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-ampls-${uniqueString(resourceGroupId)}') + logAnalyticsResourceId: logAnalytics.outputs.resourceId + appInsightsResourceId: appInsights.outputs.resourceId + privateEndpointSubnetId: network.outputs.peSubnetId + privateEndpointLocation: location + privateDnsZoneIds: [ + privateDns.outputs.monitorZoneId + privateDns.outputs.omsZoneId + privateDns.outputs.odsZoneId + privateDns.outputs.agentsvcZoneId + privateDns.outputs.blobFixedZoneId + ] + tags: tags + } +} + +// ################################################ +// Storage + +module storage 'modules/storage.bicep' = { + name: 'storageAccountDeployment.${shortHash}' + params: { + storageAccountName: length('${namePrefix}sta${uniqueString(resourceGroupId)}') > 24 ? substring(toLower('${namePrefix}sta${uniqueString(resourceGroupId)}'), 0, 24) : toLower('${namePrefix}sta${uniqueString(resourceGroupId)}') + location: location + docsContainerName: docsContainerName + roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] + tags: tags + isPrivate: isPrivate + privateEndpointSubnetId: isPrivate ? network.outputs.peSubnetId : '' + blobPrivateDnsZoneId: isPrivate ? privateDns.outputs.blobZoneStorageSuffixId : '' + } +} + +// ################################################ +// Cosmos DB + +module cosmosDb 'modules/cosmos-db.bicep' = { + name: 'cosmosDbDeployment.${shortHash}' + params: { + location: location + cosmosAccountName: toLower('${namePrefix}-cosmosdb-${uniqueString(resourceGroup().id)}') + cosmosDbName: cosmosDbName + cosmosDBContainerNames: cosmosDBContainerNames + cosmosDBDataContributorPrincipalIds: [userAssignedIdentity.outputs.principalId, deployer().objectId] + zoneRedundant: environment == 'prod' ? true : false + tags: tags + isPrivate: isPrivate + privateEndpointSubnetId: isPrivate ? network.outputs.peSubnetId : '' + cosmosSqlPrivateDnsZoneId: isPrivate ? privateDns.outputs.cosmosSqlZoneId : '' + } +} + +// ################################################ +// Container Registry + +module containerRegistry 'modules/container-registry.bicep' = { + name: 'containerRegistryDeployment.${shortHash}' + params: { + containerRegistryName: toLower('${namePrefix}acr${uniqueString(resourceGroupId)}') + location: location + roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] + tags: tags + isPrivate: isPrivate + privateEndpointSubnetId: isPrivate ? network.outputs.peSubnetId : '' + acrPrivateDnsZoneId: isPrivate ? privateDns.outputs.acrZoneId : '' + } +} + +// ################################################ +// Compute host: App Service Plan (Linux) — replaces ACA env. +// Web Apps for Containers are deployed by api-app/web-app templates and +// are bound to this plan. Private endpoint + VNet integration are wired +// per-app inside web-app-container.bicep. + +module appServicePlan 'modules/app-service-plan.bicep' = { + name: 'appServicePlanDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-asp-${uniqueString(resourceGroupId)}') + location: location + tags: tags + } +} + +// NOTE: ACA env module has been retired in favor of App Service. +// modules/container-apps-environment.bicep is kept on disk for reference +// but is no longer instantiated. + +// ################################################ +// AI Foundry + +module aiFoundry 'modules/ai-foundry.bicep' = { + name: 'aiFoundryDeployment.${shortHash}' + params: { + aiFoundryBaseName: substring(toLower(uniqueString('ai-${namePrefix}-${environment}-${resourceGroup().id}')), 0, 12) + roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] + location: aiFoundryLocation + tags: tags + isPrivate: isPrivate + openAiPrivateDnsZoneId: isPrivate ? privateDns.outputs.openAiZoneId : '' + cognitiveServicesPrivateDnsZoneId: isPrivate ? privateDns.outputs.cognitiveServicesZoneId : '' + aiServicesPrivateDnsZoneId: isPrivate ? privateDns.outputs.aiServicesZoneId : '' + } +} + +// ################################################ +// Operator access plane — Bastion + Jumpbox + +module bastion 'modules/bastion.bicep' = if (isPrivate && deployJumpbox) { + name: 'bastionDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-bastion-${uniqueString(resourceGroupId)}') + location: location + subnetId: network.outputs.bastionSubnetId + sku: bastionSku + tags: tags + } +} + +module jumpbox 'modules/jumpbox-linux.bicep' = if (isPrivate && deployJumpbox) { + name: 'jumpboxDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-jump-${uniqueString(resourceGroupId)}') + location: location + subnetId: network.outputs.jumpboxSubnetId + adminUsername: jumpboxAdminUsername + adminPublicKey: jumpboxAdminPublicKey + userAssignedIdentityId: userAssignedIdentity.outputs.resourceId + tags: tags + } +} + +var uaiName = toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') + +// Grant the jumpbox identity the roles needed to run scripts end-to-end. +// UAMI already has AcrPull/AcrPush/AcrDelete + Storage + Cosmos data roles; +// add Contributor scoped to the resource group so it can deploy container apps. +resource jumpboxRgContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (isPrivate && deployJumpbox) { + name: guid(resourceGroup().id, uaiName, 'b24988ac-6180-42a0-ab88-20f7382dd24c') + scope: resourceGroup() + properties: { + principalId: userAssignedIdentity.outputs.principalId + principalType: 'ServicePrincipal' + roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c') // Contributor + } +} + +// ################################################ +// Outputs + +output userAssignedIdentityName string = userAssignedIdentity.outputs.name +output userAssignedIdentityPrincipalId string = userAssignedIdentity.outputs.principalId +output userAssignedIdentityResourceId string = userAssignedIdentity.outputs.resourceId +output userAssignedIdentityClientId string = userAssignedIdentity.outputs.clientId +output containerRegistryName string = containerRegistry.outputs.name +output containerRegistryLoginServer string = containerRegistry.outputs.loginServer +output appServicePlanId string = appServicePlan.outputs.id +output appServicePlanName string = appServicePlan.outputs.name +output appSvcSubnetId string = isPrivate ? network.outputs.appSvcSubnetId : '' +output peSubnetId string = isPrivate ? network.outputs.peSubnetId : '' +output appServicePrivateDnsZoneId string = isPrivate ? privateDns.outputs.appServiceZoneId : '' +output storageAccountName string = storage.outputs.name +output cosmosAccountName string = cosmosDb.outputs.cosmosAccountName +output cosmosEndpoint string = cosmosDb.outputs.cosmosEndpoint +output cosmosDBName string = cosmosDb.outputs.cosmosDBName +output aiProjectName string = aiFoundry.outputs.aiProjectName +output aiServicesName string = aiFoundry.outputs.aiServicesName +output isPrivate bool = isPrivate +output vnetId string = isPrivate ? network.outputs.vnetId : '' +output jumpboxName string = (isPrivate && deployJumpbox) ? jumpbox.outputs.vmName : '' +output bastionName string = (isPrivate && deployJumpbox) ? bastion.outputs.bastionName : '' diff --git a/infra/bicep/main-linux.json b/infra/bicep/main-linux.json new file mode 100644 index 0000000..c97ff3d --- /dev/null +++ b/infra/bicep/main-linux.json @@ -0,0 +1,43429 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "3235998341901409051" + } + }, + "parameters": { + "namePrefix": { + "type": "string", + "defaultValue": "invstdemo", + "metadata": { + "description": "Name prefix for all resources" + } + }, + "environment": { + "type": "string", + "defaultValue": "dev", + "metadata": { + "description": "Environment name (dev, staging, prod)" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources." + } + }, + "deployJumpbox": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access." + } + }, + "vnetAddressPrefix": { + "type": "string", + "defaultValue": "10.50.0.0/16", + "metadata": { + "description": "VNet address space used when isPrivate=true" + } + }, + "jumpboxAdminUsername": { + "type": "string", + "defaultValue": "azureuser", + "metadata": { + "description": "Admin username for the jumpbox VM" + } + }, + "jumpboxAdminPublicKey": { + "type": "securestring", + "defaultValue": "", + "metadata": { + "description": "SSH public key for the jumpbox VM (required when deployJumpbox=true)" + } + }, + "bastionSku": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Basic", + "Standard" + ], + "metadata": { + "description": "Azure Bastion SKU. Standard required for native-client tunneling." + } + }, + "cosmosDbName": { + "type": "string", + "defaultValue": "ai-investment-analysis-sample", + "metadata": { + "description": "Cosmos DB database name" + } + }, + "cosmosDBContainerNames": { + "type": "array", + "defaultValue": [ + { + "name": "opportunities", + "partitionKey": "/owner_id" + }, + { + "name": "users", + "partitionKey": "/email" + }, + { + "name": "documents", + "partitionKey": "/opportunity_id" + }, + { + "name": "analysis", + "partitionKey": "/opportunity_id" + }, + { + "name": "workflow_events", + "partitionKey": "/analysis_id" + }, + { + "name": "what_if_conversations", + "partitionKey": "/analysis_id" + } + ] + }, + "docsContainerName": { + "type": "string", + "defaultValue": "opportunity-documents", + "metadata": { + "description": "Name of the blob storage container for documents" + } + }, + "aiFoundryLocation": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for AI Foundry resources" + } + } + }, + "variables": { + "resourceGroupId": "[resourceGroup().id]", + "tags": { + "Environment": "[parameters('environment')]", + "Project": "ai-investment-analysis-sample" + }, + "shortHash": "[substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)]", + "uaiName": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "resources": { + "jumpboxRgContributor": { + "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[guid(resourceGroup().id, variables('uaiName'), 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "properties": { + "principalId": "[reference('userAssignedIdentity').outputs.principalId.value]", + "principalType": "ServicePrincipal", + "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]" + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "network": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('networkDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "vnetName": { + "value": "[toLower(format('{0}-vnet-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "vnetAddressPrefix": { + "value": "[parameters('vnetAddressPrefix')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "11703013425078531364" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "vnetName": { + "type": "string", + "metadata": { + "description": "Virtual network name" + } + }, + "vnetAddressPrefix": { + "type": "string", + "defaultValue": "10.50.0.0/16", + "metadata": { + "description": "Address space for the virtual network" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": [ + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-pe', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [ + { + "name": "AllowHttpsInboundFromVnet", + "properties": { + "priority": 100, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRange": "443" + } + } + ] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-jumpbox', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [ + { + "name": "AllowBastionInbound", + "properties": { + "priority": 100, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "22", + "3389" + ] + } + } + ] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-bastion', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [ + { + "name": "AllowHttpsInbound", + "properties": { + "priority": 120, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "Internet", + "sourcePortRange": "*", + "destinationAddressPrefix": "*", + "destinationPortRange": "443" + } + }, + { + "name": "AllowGatewayManagerInbound", + "properties": { + "priority": 130, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "GatewayManager", + "sourcePortRange": "*", + "destinationAddressPrefix": "*", + "destinationPortRange": "443" + } + }, + { + "name": "AllowAzureLoadBalancerInbound", + "properties": { + "priority": 140, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "AzureLoadBalancer", + "sourcePortRange": "*", + "destinationAddressPrefix": "*", + "destinationPortRange": "443" + } + }, + { + "name": "AllowBastionHostCommunication", + "properties": { + "priority": 150, + "direction": "Inbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "8080", + "5701" + ] + } + }, + { + "name": "AllowSshRdpOutbound", + "properties": { + "priority": 100, + "direction": "Outbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "22", + "3389" + ] + } + }, + { + "name": "AllowAzureCloudOutbound", + "properties": { + "priority": 110, + "direction": "Outbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationAddressPrefix": "AzureCloud", + "destinationPortRange": "443" + } + }, + { + "name": "AllowBastionCommunication", + "properties": { + "priority": 120, + "direction": "Outbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "8080", + "5701" + ] + } + }, + { + "name": "AllowGetSessionInformation", + "properties": { + "priority": 130, + "direction": "Outbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationAddressPrefix": "Internet", + "destinationPortRange": "80" + } + } + ] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-aca', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-build', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-mgmt', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-appsvc', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/virtualNetworks", + "apiVersion": "2023-11-01", + "name": "[parameters('vnetName')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "addressSpace": { + "addressPrefixes": [ + "[parameters('vnetAddressPrefix')]" + ] + }, + "subnets": [ + { + "name": "snet-aca-infra", + "properties": { + "addressPrefix": "10.50.0.0/23", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]" + }, + "delegations": [ + { + "name": "aca-delegation", + "properties": { + "serviceName": "Microsoft.App/environments" + } + } + ], + "privateEndpointNetworkPolicies": "Disabled" + } + }, + { + "name": "snet-pe", + "properties": { + "addressPrefix": "10.50.2.0/26", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" + }, + "privateEndpointNetworkPolicies": "Disabled" + } + }, + { + "name": "snet-jumpbox", + "properties": { + "addressPrefix": "10.50.2.64/27", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]" + } + } + }, + { + "name": "AzureBastionSubnet", + "properties": { + "addressPrefix": "10.50.2.128/26", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]" + } + } + }, + { + "name": "snet-build", + "properties": { + "addressPrefix": "10.50.2.192/27", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]" + }, + "privateEndpointNetworkPolicies": "Disabled" + } + }, + { + "name": "snet-mgmt", + "properties": { + "addressPrefix": "10.50.2.224/27", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]" + } + } + }, + { + "name": "snet-appsvc", + "properties": { + "addressPrefix": "10.50.4.0/26", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]" + }, + "delegations": [ + { + "name": "appsvc-delegation", + "properties": { + "serviceName": "Microsoft.Web/serverFarms" + } + } + ], + "serviceEndpoints": [ + { + "service": "Microsoft.CognitiveServices" + } + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" + ] + } + ], + "outputs": { + "vnetId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + }, + "vnetName": { + "type": "string", + "value": "[parameters('vnetName')]" + }, + "acaInfraSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-aca-infra', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "peSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-pe', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "jumpboxSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-jumpbox', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "bastionSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/AzureBastionSubnet', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "buildSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-build', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "mgmtSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-mgmt', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "appSvcSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-appsvc', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + } + } + } + } + }, + "privateDns": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('privateDnsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "vnetId": { + "value": "[reference('network').outputs.vnetId.value]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "1570618753248278487" + } + }, + "parameters": { + "vnetId": { + "type": "string", + "metadata": { + "description": "Name of the VNet to link zones to" + } + }, + "location": { + "type": "string", + "defaultValue": "global", + "metadata": { + "description": "Location (zones are global; required for vnet-links)." + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "variables": { + "zoneNames": [ + "privatelink.documents.azure.com", + "[format('privatelink.blob.{0}', environment().suffixes.storage)]", + "privatelink.azurecr.io", + "privatelink.openai.azure.com", + "privatelink.cognitiveservices.azure.com", + "privatelink.services.ai.azure.com", + "privatelink.azconfig.io", + "privatelink.monitor.azure.com", + "privatelink.oms.opinsights.azure.com", + "privatelink.ods.opinsights.azure.com", + "privatelink.agentsvc.azure-automation.net", + "privatelink.azurewebsites.net" + ] + }, + "resources": [ + { + "copy": { + "name": "zones", + "count": "[length(variables('zoneNames'))]" + }, + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2024-06-01", + "name": "[variables('zoneNames')[copyIndex()]]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]" + }, + { + "copy": { + "name": "links", + "count": "[length(variables('zoneNames'))]" + }, + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/link-{1}', variables('zoneNames')[copyIndex()], uniqueString(parameters('vnetId')))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "virtualNetwork": { + "id": "[parameters('vnetId')]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[copyIndex()])]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[copyIndex()])]" + ] + } + ], + "outputs": { + "cosmosSqlZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[0])]" + }, + "blobZoneStorageSuffixId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[1])]" + }, + "acrZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[2])]" + }, + "openAiZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[3])]" + }, + "cognitiveServicesZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[4])]" + }, + "aiServicesZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[5])]" + }, + "appConfigZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[6])]" + }, + "monitorZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[7])]" + }, + "omsZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[8])]" + }, + "odsZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[9])]" + }, + "agentsvcZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[10])]" + }, + "appServiceZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[11])]" + }, + "blobFixedZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[1])]" + } + } + } + }, + "dependsOn": [ + "network" + ] + }, + "userAssignedIdentity": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('userAssignedIdentityDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "userAssignedIdentityName": { + "value": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "18363861408042767464" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources. Default is the resource group location" + } + }, + "userAssignedIdentityName": { + "type": "string", + "metadata": { + "description": "Required: User Assigned Identity name" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + } + }, + "resources": { + "userAssignedIdentity": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('userAssignedIdentity-{0}', uniqueString('userAssignedIdentity', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('userAssignedIdentityName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "16707109626832623586" + }, + "name": "User Assigned Identities", + "description": "This module deploys a User Assigned Identity." + }, + "definitions": { + "federatedIdentityCredentialType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the federated identity credential." + } + }, + "audiences": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of audiences that can appear in the issued token." + } + }, + "issuer": { + "type": "string", + "metadata": { + "description": "Required. The URL of the issuer to be trusted." + } + }, + "subject": { + "type": "string", + "metadata": { + "description": "Required. The identifier of the external identity." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the federated identity credential." + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the User Assigned Identity." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "federatedIdentityCredentials": { + "type": "array", + "items": { + "$ref": "#/definitions/federatedIdentityCredentialType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]", + "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "userAssignedIdentity": { + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]" + }, + "userAssignedIdentity_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "userAssignedIdentity_roleAssignments": { + "copy": { + "name": "userAssignedIdentity_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "userAssignedIdentity_federatedIdentityCredentials": { + "copy": { + "name": "userAssignedIdentity_federatedIdentityCredentials", + "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-UserMSI-FederatedIdentityCred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]" + }, + "userAssignedIdentityName": { + "value": "[parameters('name')]" + }, + "audiences": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]" + }, + "issuer": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]" + }, + "subject": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13656021764446440473" + }, + "name": "User Assigned Identity Federated Identity Credential", + "description": "This module deploys a User Assigned Identity Federated Identity Credential." + }, + "parameters": { + "userAssignedIdentityName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret." + } + }, + "audiences": { + "type": "array", + "metadata": { + "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token." + } + }, + "issuer": { + "type": "string", + "metadata": { + "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged." + } + }, + "subject": { + "type": "string", + "metadata": { + "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD." + } + } + }, + "resources": [ + { + "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials", + "apiVersion": "2024-11-30", + "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]", + "properties": { + "audiences": "[parameters('audiences')]", + "issuer": "[parameters('issuer')]", + "subject": "[parameters('subject')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the federated identity credential." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the federated identity credential." + }, + "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the federated identity credential was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "userAssignedIdentity" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the user assigned identity." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the user assigned identity." + }, + "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]" + }, + "principalId": { + "type": "string", + "metadata": { + "description": "The principal ID (object ID) of the user assigned identity." + }, + "value": "[reference('userAssignedIdentity').principalId]" + }, + "clientId": { + "type": "string", + "metadata": { + "description": "The client ID (application ID) of the user assigned identity." + }, + "value": "[reference('userAssignedIdentity').clientId]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the user assigned identity was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('userAssignedIdentity', '2024-11-30', 'full').location]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.name.value]" + }, + "resourceId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" + }, + "principalId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.principalId.value]" + }, + "clientId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.clientId.value]" + } + } + } + } + }, + "logAnalytics": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('logAnalyticsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[toLower(format('{0}-law-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "5234070563222356141" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Log Analytics workspace name" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "User Assigned Identity that be given access to the Log Analytics Workspace" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public ingestion/query + local auth (access via AMPLS)." + } + } + }, + "resources": { + "logAnalytics": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('logAnalytics-{0}', uniqueString('logAnalytics', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('logAnalyticsWorkspaceName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "skuName": { + "value": "PerGB2018" + }, + "dataRetention": { + "value": 30 + }, + "publicNetworkAccessForIngestion": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "publicNetworkAccessForQuery": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "features": { + "value": { + "disableLocalAuth": "[parameters('isPrivate')]" + } + }, + "roleAssignments": { + "copy": [ + { + "name": "value", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": "[createObject('principalId', parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('value')], 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Log Analytics Contributor')]" + } + ] + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "1749032521457140145" + }, + "name": "Log Analytics Workspaces", + "description": "This module deploys a Log Analytics Workspace." + }, + "definitions": { + "diagnosticSettingType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "useThisWorkspace": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + } + }, + "gallerySolutionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive." + } + }, + "plan": { + "$ref": "#/definitions/solutionPlanType", + "metadata": { + "description": "Required. Plan for solution object supported by the OperationsManagement resource provider." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the gallery solutions to be created in the log analytics workspace." + } + }, + "storageInsightsConfigType": { + "type": "object", + "properties": { + "storageAccountResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the storage account to be linked." + } + }, + "containers": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The names of the blob containers that the workspace should read." + } + }, + "tables": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of tables to be read by the workspace." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the storage insights configuration." + } + }, + "linkedServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the linked service." + } + }, + "resourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access." + } + }, + "writeAccessResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the linked service." + } + }, + "linkedStorageAccountType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the link." + } + }, + "storageAccountIds": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "metadata": { + "description": "Required. Linked storage accounts resources Ids." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the linked storage account." + } + }, + "savedSearchType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the saved search." + } + }, + "etag": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag." + } + }, + "category": { + "type": "string", + "metadata": { + "description": "Required. The category of the saved search. This helps the user to find a saved search faster." + } + }, + "displayName": { + "type": "string", + "metadata": { + "description": "Required. Display name for the search." + } + }, + "functionAlias": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The function alias if query serves as a function." + } + }, + "functionParameters": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions." + } + }, + "query": { + "type": "string", + "metadata": { + "description": "Required. The query expression for the saved search." + } + }, + "tags": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The tags attached to the saved search." + } + }, + "version": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The version number of the query language. The current version is 2 and is the default." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the saved search." + } + }, + "dataExportType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the data export." + } + }, + "destination": { + "$ref": "#/definitions/destinationType", + "nullable": true, + "metadata": { + "description": "Optional. The destination of the data export." + } + }, + "enable": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the data export." + } + }, + "tableNames": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of table names to export." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the data export." + } + }, + "dataSourceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the data source." + } + }, + "kind": { + "type": "string", + "metadata": { + "description": "Required. The kind of data source." + } + }, + "linkedResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource id of the resource that will be linked to the workspace." + } + }, + "eventLogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the event log to configure when kind is WindowsEvent." + } + }, + "eventTypes": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The event types to configure when kind is WindowsEvent." + } + }, + "objectName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "instanceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "intervalSeconds": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "performanceCounters": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject." + } + }, + "counterName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter." + } + }, + "state": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection." + } + }, + "syslogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. System log to configure when kind is LinuxSyslog." + } + }, + "syslogSeverities": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Severities to configure when kind is LinuxSyslog." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the data source." + } + }, + "tableType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the table." + } + }, + "plan": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The plan for the table." + } + }, + "restoredLogs": { + "$ref": "#/definitions/restoredLogsType", + "nullable": true, + "metadata": { + "description": "Optional. The restored logs for the table." + } + }, + "schema": { + "$ref": "#/definitions/schemaType", + "nullable": true, + "metadata": { + "description": "Optional. The schema for the table." + } + }, + "searchResults": { + "$ref": "#/definitions/searchResultsType", + "nullable": true, + "metadata": { + "description": "Optional. The search results for the table." + } + }, + "retentionInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The retention in days for the table." + } + }, + "totalRetentionInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The total retention in days for the table." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The role assignments for the table." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the custom table." + } + }, + "workspaceFeaturesType": { + "type": "object", + "properties": { + "disableLocalAuth": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Disable Non-EntraID based Auth. Default is true." + } + }, + "enableDataExport": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag that indicate if data should be exported." + } + }, + "enableLogAccessUsingOnlyResourcePermissions": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable log access using only resource permissions. Default is false." + } + }, + "immediatePurgeDataOn30Days": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag that describes if we want to remove the data after 30 days." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Features of the workspace." + } + }, + "workspaceReplicationType": { + "type": "object", + "properties": { + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The location to which the workspace is replicated. Required if replication is enabled." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Replication properties of the workspace." + } + }, + "_1.columnType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The column name." + } + }, + "type": { + "type": "string", + "allowedValues": [ + "boolean", + "dateTime", + "dynamic", + "guid", + "int", + "long", + "real", + "string" + ], + "metadata": { + "description": "Required. The column type." + } + }, + "dataTypeHint": { + "type": "string", + "allowedValues": [ + "armPath", + "guid", + "ip", + "uri" + ], + "nullable": true, + "metadata": { + "description": "Optional. The column data type logical hint." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The column description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Column display name." + } + } + }, + "metadata": { + "description": "The parameters of the table column.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "destinationType": { + "type": "object", + "properties": { + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The destination resource ID." + } + }, + "metaData": { + "type": "object", + "properties": { + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The destination metadata." + } + } + }, + "metadata": { + "description": "The data export destination properties.", + "__bicep_imported_from!": { + "sourceTemplate": "data-export/main.bicep" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "restoredLogsType": { + "type": "object", + "properties": { + "sourceTable": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table to restore data from." + } + }, + "startRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the restore from (UTC)." + } + }, + "endRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the restore by (UTC)." + } + } + }, + "metadata": { + "description": "The parameters of the restore operation that initiated the table.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "schemaType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The table name." + } + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.columnType" + }, + "metadata": { + "description": "Required. A list of table custom columns." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table display name." + } + } + }, + "metadata": { + "description": "The table schema.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "searchResultsType": { + "type": "object", + "properties": { + "query": { + "type": "string", + "metadata": { + "description": "Required. The search job query." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The search description." + } + }, + "limit": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Limit the search job to return up to specified number of rows." + } + }, + "startSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the search from (UTC)." + } + }, + "endSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the search by (UTC)." + } + } + }, + "metadata": { + "description": "The parameters of the search job that initiated the table.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "solutionPlanType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used." + } + }, + "product": { + "type": "string", + "metadata": { + "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive." + } + }, + "publisher": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Log Analytics workspace." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "skuName": { + "type": "string", + "defaultValue": "PerGB2018", + "allowedValues": [ + "CapacityReservation", + "Free", + "LACluster", + "PerGB2018", + "PerNode", + "Premium", + "Standalone", + "Standard" + ], + "metadata": { + "description": "Optional. The name of the SKU." + } + }, + "skuCapacityReservationLevel": { + "type": "int", + "defaultValue": 100, + "minValue": 100, + "maxValue": 5000, + "metadata": { + "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000." + } + }, + "storageInsightsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/storageInsightsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of storage accounts to be read by the workspace." + } + }, + "linkedServices": { + "type": "array", + "items": { + "$ref": "#/definitions/linkedServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of services to be linked." + } + }, + "linkedStorageAccounts": { + "type": "array", + "items": { + "$ref": "#/definitions/linkedStorageAccountType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty." + } + }, + "savedSearches": { + "type": "array", + "items": { + "$ref": "#/definitions/savedSearchType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Kusto Query Language searches to save." + } + }, + "dataExports": { + "type": "array", + "items": { + "$ref": "#/definitions/dataExportType" + }, + "nullable": true, + "metadata": { + "description": "Optional. LAW data export instances to be deployed." + } + }, + "dataSources": { + "type": "array", + "items": { + "$ref": "#/definitions/dataSourceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. LAW data sources to configure." + } + }, + "tables": { + "type": "array", + "items": { + "$ref": "#/definitions/tableType" + }, + "nullable": true, + "metadata": { + "description": "Optional. LAW custom tables to be deployed." + } + }, + "gallerySolutions": { + "type": "array", + "items": { + "$ref": "#/definitions/gallerySolutionType" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of gallerySolutions to be created in the log analytics workspace." + } + }, + "onboardWorkspaceToSentinel": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions." + } + }, + "dataRetention": { + "type": "int", + "defaultValue": 365, + "minValue": 0, + "maxValue": 730, + "metadata": { + "description": "Optional. Number of days data will be retained for." + } + }, + "dailyQuotaGb": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "metadata": { + "description": "Optional. The workspace daily quota for ingestion." + } + }, + "publicNetworkAccessForIngestion": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Log Analytics ingestion." + } + }, + "publicNetworkAccessForQuery": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Log Analytics query." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both." + } + }, + "features": { + "$ref": "#/definitions/workspaceFeaturesType", + "nullable": true, + "metadata": { + "description": "Optional. The workspace features." + } + }, + "replication": { + "$ref": "#/definitions/workspaceReplicationType", + "nullable": true, + "metadata": { + "description": "Optional. The workspace replication properties." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "forceCmkForQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether customer managed storage is mandatory for query management." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces@2025-02-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]", + "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]", + "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]", + "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]", + "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "logAnalyticsWorkspace": { + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "features": { + "searchVersion": 1, + "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]", + "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]", + "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]", + "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]" + }, + "sku": { + "name": "[parameters('skuName')]", + "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]" + }, + "retentionInDays": "[parameters('dataRetention')]", + "workspaceCapping": { + "dailyQuotaGb": "[parameters('dailyQuotaGb')]" + }, + "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]", + "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]", + "forceCmkForQuery": "[parameters('forceCmkForQuery')]", + "replication": "[parameters('replication')]" + }, + "identity": "[variables('identity')]" + }, + "logAnalyticsWorkspace_diagnosticSettings": { + "copy": { + "name": "logAnalyticsWorkspace_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_sentinelOnboarding": { + "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]", + "type": "Microsoft.SecurityInsights/onboardingStates", + "apiVersion": "2024-03-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "default", + "properties": {}, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_roleAssignments": { + "copy": { + "name": "logAnalyticsWorkspace_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_storageInsightConfigs": { + "copy": { + "name": "logAnalyticsWorkspace_storageInsightConfigs", + "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "containers": { + "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]" + }, + "tables": { + "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]" + }, + "storageAccountResourceId": { + "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "1306323182548882150" + }, + "name": "Log Analytics Workspace Storage Insight Configs", + "description": "This module deploys a Log Analytics Workspace Storage Insight Config." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]", + "metadata": { + "description": "Optional. The name of the storage insights config." + } + }, + "storageAccountResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Azure Resource Manager ID of the storage account resource." + } + }, + "containers": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The names of the blob containers that the workspace should read." + } + }, + "tables": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The names of the Azure tables that the workspace should read." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + } + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[last(split(parameters('storageAccountResourceId'), '/'))]" + }, + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "storageinsightconfig": { + "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "containers": "[parameters('containers')]", + "tables": "[parameters('tables')]", + "storageAccount": { + "id": "[parameters('storageAccountResourceId')]", + "key": "[listKeys('storageAccount', '2024-01-01').keys[0].value]" + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed storage insights configuration." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the storage insight configuration is deployed." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the storage insights configuration." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_linkedServices": { + "copy": { + "name": "logAnalyticsWorkspace_linkedServices", + "count": "[length(coalesce(parameters('linkedServices'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]" + }, + "resourceId": { + "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]" + }, + "writeAccessResourceId": { + "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "5230241501765697269" + }, + "name": "Log Analytics Workspace Linked Services", + "description": "This module deploys a Log Analytics Workspace Linked Service." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the link." + } + }, + "resourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access." + } + }, + "writeAccessResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/linkedServices@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "linkedService": { + "type": "Microsoft.OperationalInsights/workspaces/linkedServices", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resourceId": "[parameters('resourceId')]", + "writeAccessResourceId": "[parameters('writeAccessResourceId')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed linked service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed linked service." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the linked service is deployed." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_linkedStorageAccounts": { + "copy": { + "name": "logAnalyticsWorkspace_linkedStorageAccounts", + "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]" + }, + "storageAccountIds": { + "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "10372135754202496594" + }, + "name": "Log Analytics Workspace Linked Storage Accounts", + "description": "This module deploys a Log Analytics Workspace Linked Storage Account." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "allowedValues": [ + "Query", + "Alerts", + "CustomLogs", + "AzureWatson" + ], + "metadata": { + "description": "Required. Name of the link." + } + }, + "storageAccountIds": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "metadata": { + "description": "Required. Linked storage accounts resources Ids." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "linkedStorageAccount": { + "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "properties": { + "storageAccountIds": "[parameters('storageAccountIds')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed linked storage account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed linked storage account." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the linked storage account is deployed." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_savedSearches": { + "copy": { + "name": "logAnalyticsWorkspace_savedSearches", + "count": "[length(coalesce(parameters('savedSearches'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(deployment().name))]" + }, + "etag": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]" + }, + "displayName": { + "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]" + }, + "category": { + "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]" + }, + "query": { + "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]" + }, + "functionAlias": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]" + }, + "functionParameters": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]" + }, + "tags": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]" + }, + "version": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "9015459905306126128" + }, + "name": "Log Analytics Workspace Saved Searches", + "description": "This module deploys a Log Analytics Workspace Saved Search." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the saved search." + } + }, + "displayName": { + "type": "string", + "metadata": { + "description": "Required. Display name for the search." + } + }, + "category": { + "type": "string", + "metadata": { + "description": "Required. Query category." + } + }, + "query": { + "type": "string", + "metadata": { + "description": "Required. Kusto Query to be stored." + } + }, + "tags": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01#properties/properties/properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + }, + "functionAlias": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The function alias if query serves as a function." + } + }, + "functionParameters": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions." + } + }, + "version": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The version number of the query language." + } + }, + "etag": { + "type": "string", + "defaultValue": "*", + "metadata": { + "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "savedSearch": { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "properties": { + "etag": "[parameters('etag')]", + "tags": "[coalesce(parameters('tags'), createArray())]", + "displayName": "[parameters('displayName')]", + "category": "[parameters('category')]", + "query": "[parameters('query')]", + "functionAlias": "[parameters('functionAlias')]", + "functionParameters": "[parameters('functionParameters')]", + "version": "[parameters('version')]" + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed saved search." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the saved search is deployed." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed saved search." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace", + "logAnalyticsWorkspace_linkedStorageAccounts" + ] + }, + "logAnalyticsWorkspace_dataExports": { + "copy": { + "name": "logAnalyticsWorkspace_dataExports", + "count": "[length(coalesce(parameters('dataExports'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "workspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]" + }, + "destination": { + "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]" + }, + "enable": { + "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]" + }, + "tableNames": { + "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "8586520532175356447" + }, + "name": "Log Analytics Workspace Data Exports", + "description": "This module deploys a Log Analytics Workspace Data Export." + }, + "definitions": { + "destinationType": { + "type": "object", + "properties": { + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The destination resource ID." + } + }, + "metaData": { + "type": "object", + "properties": { + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The destination metadata." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The data export destination properties." + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 4, + "maxLength": 63, + "metadata": { + "description": "Required. The data export rule name." + } + }, + "workspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment." + } + }, + "destination": { + "$ref": "#/definitions/destinationType", + "nullable": true, + "metadata": { + "description": "Optional. Destination properties." + } + }, + "enable": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Active when enabled." + } + }, + "tableNames": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "metadata": { + "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('workspaceName')]" + }, + "dataExport": { + "type": "Microsoft.OperationalInsights/workspaces/dataExports", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]", + "properties": { + "destination": "[parameters('destination')]", + "enable": "[parameters('enable')]", + "tableNames": "[parameters('tableNames')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the data export." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the data export." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the data export was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_dataSources": { + "copy": { + "name": "logAnalyticsWorkspace_dataSources", + "count": "[length(coalesce(parameters('dataSources'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]" + }, + "kind": { + "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]" + }, + "linkedResourceId": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]" + }, + "eventLogName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]" + }, + "eventTypes": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]" + }, + "objectName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]" + }, + "instanceName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]" + }, + "intervalSeconds": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]" + }, + "counterName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]" + }, + "state": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]" + }, + "syslogName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]" + }, + "syslogSeverities": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]" + }, + "performanceCounters": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]" + }, + "tags": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "8336916453932906250" + }, + "name": "Log Analytics Workspace Datasources", + "description": "This module deploys a Log Analytics Workspace Data Source." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the data source." + } + }, + "kind": { + "type": "string", + "defaultValue": "AzureActivityLog", + "allowedValues": [ + "AzureActivityLog", + "WindowsEvent", + "WindowsPerformanceCounter", + "IISLogs", + "LinuxSyslog", + "LinuxSyslogCollection", + "LinuxPerformanceObject", + "LinuxPerformanceCollection" + ], + "metadata": { + "description": "Optional. The kind of the data source." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + }, + "linkedResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the resource to be linked." + } + }, + "eventLogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Windows event log name to configure when kind is WindowsEvent." + } + }, + "eventTypes": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Windows event types to configure when kind is WindowsEvent." + } + }, + "objectName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "instanceName": { + "type": "string", + "defaultValue": "*", + "metadata": { + "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "intervalSeconds": { + "type": "int", + "defaultValue": 60, + "metadata": { + "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "performanceCounters": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject." + } + }, + "counterName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter." + } + }, + "state": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection." + } + }, + "syslogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. System log to configure when kind is LinuxSyslog." + } + }, + "syslogSeverities": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Severities to configure when kind is LinuxSyslog." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "dataSource": { + "type": "Microsoft.OperationalInsights/workspaces/dataSources", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "kind": "[parameters('kind')]", + "tags": "[parameters('tags')]", + "properties": { + "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]", + "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]", + "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]", + "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]", + "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]", + "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]", + "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]", + "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]", + "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]", + "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]", + "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]" + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed data source." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the data source is deployed." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed data source." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_tables": { + "copy": { + "name": "logAnalyticsWorkspace_tables", + "count": "[length(coalesce(parameters('tables'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "workspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]" + }, + "plan": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]" + }, + "schema": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]" + }, + "retentionInDays": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]" + }, + "totalRetentionInDays": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]" + }, + "restoredLogs": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]" + }, + "searchResults": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "315390662258960765" + }, + "name": "Log Analytics Workspace Tables", + "description": "This module deploys a Log Analytics Workspace Table." + }, + "definitions": { + "restoredLogsType": { + "type": "object", + "properties": { + "sourceTable": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table to restore data from." + } + }, + "startRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the restore from (UTC)." + } + }, + "endRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the restore by (UTC)." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The parameters of the restore operation that initiated the table." + } + }, + "schemaType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The table name." + } + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/definitions/columnType" + }, + "metadata": { + "description": "Required. A list of table custom columns." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table display name." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The table schema." + } + }, + "columnType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The column name." + } + }, + "type": { + "type": "string", + "allowedValues": [ + "boolean", + "dateTime", + "dynamic", + "guid", + "int", + "long", + "real", + "string" + ], + "metadata": { + "description": "Required. The column type." + } + }, + "dataTypeHint": { + "type": "string", + "allowedValues": [ + "armPath", + "guid", + "ip", + "uri" + ], + "nullable": true, + "metadata": { + "description": "Optional. The column data type logical hint." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The column description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Column display name." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The parameters of the table column." + } + }, + "searchResultsType": { + "type": "object", + "properties": { + "query": { + "type": "string", + "metadata": { + "description": "Required. The search job query." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The search description." + } + }, + "limit": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Limit the search job to return up to specified number of rows." + } + }, + "startSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the search from (UTC)." + } + }, + "endSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the search by (UTC)." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The parameters of the search job that initiated the table." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the table." + } + }, + "workspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment." + } + }, + "plan": { + "type": "string", + "defaultValue": "Analytics", + "allowedValues": [ + "Basic", + "Analytics" + ], + "metadata": { + "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table." + } + }, + "restoredLogs": { + "$ref": "#/definitions/restoredLogsType", + "nullable": true, + "metadata": { + "description": "Optional. Restore parameters." + } + }, + "retentionInDays": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 730, + "metadata": { + "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention." + } + }, + "schema": { + "$ref": "#/definitions/schemaType", + "nullable": true, + "metadata": { + "description": "Optional. Table's schema." + } + }, + "searchResults": { + "$ref": "#/definitions/searchResultsType", + "nullable": true, + "metadata": { + "description": "Optional. Parameters of the search job that initiated this table." + } + }, + "totalRetentionInDays": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 2555, + "metadata": { + "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]", + "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]", + "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]", + "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('workspaceName')]" + }, + "table": { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]", + "properties": { + "plan": "[parameters('plan')]", + "restoredLogs": "[parameters('restoredLogs')]", + "retentionInDays": "[parameters('retentionInDays')]", + "schema": "[parameters('schema')]", + "searchResults": "[parameters('searchResults')]", + "totalRetentionInDays": "[parameters('totalRetentionInDays')]" + } + }, + "table_roleAssignments": { + "copy": { + "name": "table_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "table" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the table." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the table." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the table was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_solutions": { + "copy": { + "name": "logAnalyticsWorkspace_solutions", + "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]" + }, + "condition": "[not(empty(parameters('gallerySolutions')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]" + }, + "location": { + "value": "[parameters('location')]" + }, + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "plan": { + "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.32.4.45862", + "templateHash": "10255889523646649592" + }, + "name": "Operations Management Solutions", + "description": "This module deploys an Operations Management Solution.", + "owner": "Azure/module-maintainers" + }, + "definitions": { + "solutionPlanType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used." + } + }, + "product": { + "type": "string", + "metadata": { + "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive." + } + }, + "publisher": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive." + } + }, + "plan": { + "$ref": "#/definitions/solutionPlanType", + "metadata": { + "description": "Required. Plan for solution object supported by the OperationsManagement resource provider." + } + }, + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "logAnalyticsWorkspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2021-06-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "solution": { + "type": "Microsoft.OperationsManagement/solutions", + "apiVersion": "2015-11-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "properties": { + "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]" + }, + "plan": { + "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]", + "promotionCode": "", + "product": "[parameters('plan').product]", + "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed solution." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed solution." + }, + "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the solution is deployed." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('solution', '2015-11-01-preview', 'full').location]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed log analytics workspace." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed log analytics workspace." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed log analytics workspace." + }, + "value": "[parameters('name')]" + }, + "logAnalyticsWorkspaceId": { + "type": "string", + "metadata": { + "description": "The ID associated with the workspace." + }, + "value": "[reference('logAnalyticsWorkspace').customerId]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('logAnalyticsWorkspace', '2025-02-01', 'full').location]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2025-02-01', 'full'), 'identity'), 'principalId')]" + }, + "primarySharedKey": { + "type": "securestring", + "metadata": { + "description": "The primary shared key of the log analytics workspace." + }, + "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').primarySharedKey]" + }, + "secondarySharedKey": { + "type": "securestring", + "metadata": { + "description": "The secondary shared key of the log analytics workspace." + }, + "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').secondarySharedKey]" + } + } + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "value": "[reference('logAnalytics').outputs.resourceId.value]" + }, + "name": { + "type": "string", + "value": "[reference('logAnalytics').outputs.name.value]" + }, + "logAnalyticsWorkspaceId": { + "type": "string", + "value": "[reference('logAnalytics').outputs.logAnalyticsWorkspaceId.value]" + }, + "primarySharedKey": { + "type": "securestring", + "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').primarySharedKey]" + }, + "secondarySharedKey": { + "type": "securestring", + "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').secondarySharedKey]" + } + } + } + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "appInsights": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('appInsightsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "appInsightsName": { + "value": "[toLower(format('{0}-appi-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "logAnalyticsResourceId": { + "value": "[reference('logAnalytics').outputs.resourceId.value]" + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "17022316607490420998" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "appInsightsName": { + "type": "string", + "metadata": { + "description": "Application Insights name" + } + }, + "logAnalyticsResourceId": { + "type": "string", + "metadata": { + "description": "Log Analytics resource id output from log-analytics-ws.bicep module" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables local auth + public ingestion/query (connect via AMPLS)." + } + } + }, + "resources": { + "applicationInsights": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('applicationInsights-{0}', uniqueString('applicationInsights', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('appInsightsName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "workspaceResourceId": { + "value": "[parameters('logAnalyticsResourceId')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "disableLocalAuth": { + "value": "[parameters('isPrivate')]" + }, + "publicNetworkAccessForIngestion": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "publicNetworkAccessForQuery": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.33.93.31351", + "templateHash": "5735496719243704506" + }, + "name": "Application Insights", + "description": "This component deploys an Application Insights instance." + }, + "definitions": { + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Application Insights." + } + }, + "applicationType": { + "type": "string", + "defaultValue": "web", + "allowedValues": [ + "web", + "other" + ], + "metadata": { + "description": "Optional. Application type." + } + }, + "workspaceResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property." + } + }, + "disableIpMasking": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Disable IP masking. Default value is set to true." + } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Disable Non-AAD based Auth. Default value is set to false." + } + }, + "forceCustomerStorageForProfiler": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Force users to create their own storage account for profiler and debugger." + } + }, + "linkedStorageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Linked storage account resource ID." + } + }, + "publicNetworkAccessForIngestion": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled." + } + }, + "publicNetworkAccessForQuery": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled." + } + }, + "retentionInDays": { + "type": "int", + "defaultValue": 365, + "allowedValues": [ + 30, + 60, + 90, + 120, + 180, + 270, + 365, + 550, + 730 + ], + "metadata": { + "description": "Optional. Retention period in days." + } + }, + "samplingPercentage": { + "type": "int", + "defaultValue": 100, + "minValue": 0, + "maxValue": 100, + "metadata": { + "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry." + } + }, + "flowType": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API." + } + }, + "requestSource": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'." + } + }, + "kind": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]", + "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]", + "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]", + "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]", + "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "appInsights": { + "type": "Microsoft.Insights/components", + "apiVersion": "2020-02-02", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "kind": "[parameters('kind')]", + "properties": { + "Application_Type": "[parameters('applicationType')]", + "DisableIpMasking": "[parameters('disableIpMasking')]", + "DisableLocalAuth": "[parameters('disableLocalAuth')]", + "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]", + "WorkspaceResourceId": "[parameters('workspaceResourceId')]", + "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]", + "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]", + "RetentionInDays": "[parameters('retentionInDays')]", + "SamplingPercentage": "[parameters('samplingPercentage')]", + "Flow_Type": "[parameters('flowType')]", + "Request_Source": "[parameters('requestSource')]" + } + }, + "appInsights_roleAssignments": { + "copy": { + "name": "appInsights_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "appInsights" + ] + }, + "appInsights_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "appInsights" + ] + }, + "appInsights_diagnosticSettings": { + "copy": { + "name": "appInsights_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "appInsights" + ] + }, + "linkedStorageAccount": { + "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "appInsightsName": { + "value": "[parameters('name')]" + }, + "storageAccountResourceId": { + "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.33.93.31351", + "templateHash": "10861379689695100897" + }, + "name": "Application Insights Linked Storage Account", + "description": "This component deploys an Application Insights Linked Storage Account." + }, + "parameters": { + "appInsightsName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment." + } + }, + "storageAccountResourceId": { + "type": "string", + "metadata": { + "description": "Required. Linked storage account resource ID." + } + } + }, + "resources": [ + { + "type": "microsoft.insights/components/linkedStorageAccounts", + "apiVersion": "2020-03-01-preview", + "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]", + "properties": { + "linkedStorageAccount": "[parameters('storageAccountResourceId')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the Linked Storage Account." + }, + "value": "ServiceProfiler" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Linked Storage Account." + }, + "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the agent pool was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "appInsights" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the application insights component." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the application insights component." + }, + "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the application insights component was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "applicationId": { + "type": "string", + "metadata": { + "description": "The application ID of the application insights component." + }, + "value": "[reference('appInsights').AppId]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('appInsights', '2020-02-02', 'full').location]" + }, + "instrumentationKey": { + "type": "string", + "metadata": { + "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component." + }, + "value": "[reference('appInsights').InstrumentationKey]" + }, + "connectionString": { + "type": "string", + "metadata": { + "description": "Application Insights Connection String." + }, + "value": "[reference('appInsights').ConnectionString]" + } + } + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "value": "[reference('applicationInsights').outputs.resourceId.value]" + }, + "applicationId": { + "type": "string", + "value": "[reference('applicationInsights').outputs.applicationId.value]" + }, + "instrumentationKey": { + "type": "string", + "value": "[reference('applicationInsights').outputs.instrumentationKey.value]" + }, + "connectionString": { + "type": "string", + "value": "[reference('applicationInsights').outputs.connectionString.value]" + } + } + } + }, + "dependsOn": [ + "logAnalytics" + ] + }, + "ampls": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('amplsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-ampls-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "logAnalyticsResourceId": { + "value": "[reference('logAnalytics').outputs.resourceId.value]" + }, + "appInsightsResourceId": { + "value": "[reference('appInsights').outputs.resourceId.value]" + }, + "privateEndpointSubnetId": { + "value": "[reference('network').outputs.peSubnetId.value]" + }, + "privateEndpointLocation": { + "value": "[parameters('location')]" + }, + "privateDnsZoneIds": { + "value": [ + "[reference('privateDns').outputs.monitorZoneId.value]", + "[reference('privateDns').outputs.omsZoneId.value]", + "[reference('privateDns').outputs.odsZoneId.value]", + "[reference('privateDns').outputs.agentsvcZoneId.value]", + "[reference('privateDns').outputs.blobFixedZoneId.value]" + ] + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "3981484094208687748" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "global", + "metadata": { + "description": "Location (AMPLS is a global resource; use global)" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "AMPLS resource name" + } + }, + "logAnalyticsResourceId": { + "type": "string", + "metadata": { + "description": "Log Analytics Workspace resource id to scope" + } + }, + "appInsightsResourceId": { + "type": "string", + "metadata": { + "description": "Application Insights component resource id to scope" + } + }, + "privateEndpointSubnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "privateEndpointLocation": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Resource group location for the private endpoint resource" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Private DNS zone resource ids for Azure Monitor PLS (monitor, oms, ods, agentsvc, blob)" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "ampls": { + "type": "microsoft.insights/privateLinkScopes", + "apiVersion": "2021-07-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "accessModeSettings": { + "ingestionAccessMode": "PrivateOnly", + "queryAccessMode": "PrivateOnly" + } + } + }, + "lawScope": { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', parameters('name'), 'law-scope')]", + "properties": { + "linkedResourceId": "[parameters('logAnalyticsResourceId')]" + }, + "dependsOn": [ + "ampls" + ] + }, + "appiScope": { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', parameters('name'), 'appi-scope')]", + "properties": { + "linkedResourceId": "[parameters('appInsightsResourceId')]" + }, + "dependsOn": [ + "ampls" + ] + }, + "ampPe": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('ampls-pe-{0}', uniqueString(resourceId('microsoft.insights/privateLinkScopes', parameters('name'))))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe', parameters('name'))]" + }, + "location": { + "value": "[parameters('privateEndpointLocation')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('microsoft.insights/privateLinkScopes', parameters('name'))]" + }, + "groupIds": { + "value": [ + "azuremonitor" + ] + }, + "privateDnsZoneIds": { + "value": "[parameters('privateDnsZoneIds')]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "ampls", + "appiScope", + "lawScope" + ] + } + }, + "outputs": { + "amplsId": { + "type": "string", + "value": "[resourceId('microsoft.insights/privateLinkScopes', parameters('name'))]" + }, + "amplsName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "appInsights", + "logAnalytics", + "network", + "privateDns" + ] + }, + "storage": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('storageAccountDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": "[if(greater(length(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), 24), createObject('value', substring(toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), 0, 24)), createObject('value', toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))))]", + "location": { + "value": "[parameters('location')]" + }, + "docsContainerName": { + "value": "[parameters('docsContainerName')]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "privateEndpointSubnetId": "[if(parameters('isPrivate'), createObject('value', reference('network').outputs.peSubnetId.value), createObject('value', ''))]", + "blobPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.blobZoneStorageSuffixId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "8066018424758563884" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources" + } + }, + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Required: Storage account name" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Managed Identity that will be given access to the Storage Account" + } + }, + "docsContainerName": { + "type": "string", + "defaultValue": "opportunity-documents", + "metadata": { + "description": "Optional: Name of the blob container for opportunity documents. Default is \"opportunity-documents\"" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public network access and deploys a private endpoint for blob." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource id for the private endpoint (required when isPrivate=true)" + } + }, + "blobPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for blob (required when isPrivate=true)" + } + } + }, + "variables": { + "copy": [ + { + "name": "accountRoleAssignments", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('accountRoleAssignments')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "Contributor" + } + }, + { + "name": "blobRoleAssignments", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('blobRoleAssignments')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "Storage Blob Data Contributor" + } + } + ], + "deployerRoleAssignments": [ + { + "principalId": "[deployer().objectId]", + "principalType": "User", + "roleDefinitionIdOrName": "Storage Blob Data Contributor" + }, + { + "principalId": "[deployer().objectId]", + "principalType": "User", + "roleDefinitionIdOrName": "Storage Queue Data Contributor" + } + ] + }, + "resources": { + "storageAccountRef": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2023-05-01", + "name": "[parameters('storageAccountName')]", + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('storageAccount-{0}', uniqueString('storageAccount', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('storageAccountName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "kind": { + "value": "StorageV2" + }, + "skuName": { + "value": "Standard_LRS" + }, + "accessTier": { + "value": "Hot" + }, + "allowSharedKeyAccess": { + "value": false + }, + "enableHierarchicalNamespace": { + "value": false + }, + "publicNetworkAccess": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "networkAcls": { + "value": { + "defaultAction": "[if(parameters('isPrivate'), 'Deny', 'Allow')]", + "bypass": "AzureServices" + } + }, + "blobServices": { + "value": { + "automaticSnapshotPolicyEnabled": true, + "containerDeleteRetentionPolicyDays": 7, + "containerDeleteRetentionPolicyEnabled": true, + "containers": [ + { + "name": "[parameters('docsContainerName')]", + "publicAccess": "None" + } + ] + } + }, + "roleAssignments": { + "value": "[concat(variables('accountRoleAssignments'), variables('blobRoleAssignments'), variables('deployerRoleAssignments'))]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3530476863855541150" + }, + "name": "Storage Accounts", + "description": "This module deploys a Storage Account." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoints output." + } + }, + "networkAclsType": { + "type": "object", + "properties": { + "resourceAccessRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "metadata": { + "description": "Required. The ID of the tenant in which the resource resides in." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only." + } + }, + "bypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "AzureServices, Logging", + "AzureServices, Logging, Metrics", + "AzureServices, Metrics", + "Logging", + "Logging, Metrics", + "Metrics", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics." + } + }, + "virtualNetworkRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the virtual network rules." + } + }, + "ipRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the IP ACL rules." + } + }, + "defaultAction": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the default action of allow or deny when no other rules match." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network configuration." + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the keys and connection strings generated by the modules." + } + }, + "accessKey1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey1 secret name to create." + } + }, + "connectionString1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString1 secret name to create." + } + }, + "accessKey2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey2 secret name to create." + } + }, + "connectionString2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString2 secret name to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of the exported secrets." + } + }, + "localUserType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a local user." + } + }, + "blobServiceType": { + "type": "object", + "properties": { + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a blob service." + } + }, + "_1.immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/container/main.bicep" + } + } + }, + "_2.secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "_3.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/_1.immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "description": "The type of a storage container.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "description": "The type for a cors rule.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "customerManagedKeyWithAutoRotateType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting." + } + }, + "autoRotationEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingMetricsOnlyType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of diagnostic setting." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_3.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/_2.secretSetOutputType", + "metadata": { + "description": "An exported secret's references." + } + }, + "metadata": { + "description": "A map of the exported secrets", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. Name of the Storage Account. Must be lower-case." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "kind": { + "type": "string", + "defaultValue": "StorageV2", + "allowedValues": [ + "Storage", + "StorageV2", + "BlobStorage", + "FileStorage", + "BlockBlobStorage" + ], + "metadata": { + "description": "Optional. Type of Storage Account to create." + } + }, + "skuName": { + "type": "string", + "defaultValue": "Standard_GRS", + "allowedValues": [ + "Standard_LRS", + "Standard_ZRS", + "Standard_GRS", + "Standard_GZRS", + "Standard_RAGRS", + "Standard_RAGZRS", + "StandardV2_LRS", + "StandardV2_ZRS", + "StandardV2_GRS", + "StandardV2_GZRS", + "Premium_LRS", + "Premium_ZRS", + "PremiumV2_LRS", + "PremiumV2_ZRS" + ], + "metadata": { + "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "Hot", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "Cold" + ], + "metadata": { + "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type." + } + }, + "largeFileSharesState": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)." + } + }, + "azureFilesIdentityBasedAuthentication": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication" + }, + "description": "Optional. Provides the identity based authentication settings for Azure Files." + }, + "nullable": true + }, + "defaultToOAuthAuthentication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not." + } + }, + "allowSharedKeyAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "managementPolicyRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The Storage Account ManagementPolicies Rules." + } + }, + "networkAcls": { + "$ref": "#/definitions/networkAclsType", + "nullable": true, + "metadata": { + "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny." + } + }, + "requireInfrastructureEncryption": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true." + } + }, + "allowCrossTenantReplication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Allow or disallow cross AAD tenant object replication." + } + }, + "customDomainName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source." + } + }, + "customDomainUseSubDomainName": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates." + } + }, + "dnsEndpointType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AzureDnsZone", + "Standard" + ], + "metadata": { + "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier." + } + }, + "blobServices": { + "$ref": "#/definitions/blobServiceType", + "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]", + "metadata": { + "description": "Optional. Blob service and containers to deploy." + } + }, + "fileServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. File service and shares to deploy." + } + }, + "queueServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Queue service and queues to create." + } + }, + "tableServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Table service and tables to create." + } + }, + "allowBlobPublicAccess": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2" + ], + "metadata": { + "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore." + } + }, + "enableHierarchicalNamespace": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true." + } + }, + "enableSftp": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "localUsers": { + "type": "array", + "items": { + "$ref": "#/definitions/localUserType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Local users to deploy for SFTP authentication." + } + }, + "isLocalUserEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables local users feature, if set to true." + } + }, + "enableNfsV3": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingMetricsOnlyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "allowedCopyScope": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AAD", + "PrivateLink" + ], + "metadata": { + "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "supportsHttpsTrafficOnly": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Allows HTTPS traffic only to storage service if sets to true." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyWithAutoRotateType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "sasExpirationPeriod": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The SAS expiration period. DD.HH:MM:SS." + } + }, + "sasExpirationAction": { + "type": "string", + "defaultValue": "Log", + "allowedValues": [ + "Block", + "Log" + ], + "metadata": { + "description": "Optional. The SAS expiration action. Allowed values are Block and Log." + } + }, + "keyType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Account", + "Service" + ], + "metadata": { + "description": "Optional. The keyType to use with Queue & Table services." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "immutableStorageWithVersioning": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning" + }, + "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts." + }, + "nullable": true + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]", + "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]", + "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "storageAccount": { + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "[parameters('kind')]", + "sku": { + "name": "[parameters('skuName')]" + }, + "identity": "[variables('identity')]", + "tags": "[parameters('tags')]", + "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]", + "dependsOn": [ + "cMKKeyVault", + "cMKKeyVault::cMKKey" + ] + }, + "storageAccount_diagnosticSettings": { + "copy": { + "name": "storageAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_roleAssignments": { + "copy": { + "name": "storageAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_privateEndpoints": { + "copy": { + "name": "storageAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_managementPolicies": { + "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "rules": { + "value": "[parameters('managementPolicyRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14529265638306912023" + }, + "name": "Storage Account Management Policies", + "description": "This module deploys a Storage Account Management Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "rules": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules" + }, + "description": "Required. The Storage Account ManagementPolicies Rules." + } + } + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/managementPolicies", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]", + "properties": { + "policy": { + "rules": "[parameters('rules')]" + } + } + } + ], + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed management policy." + }, + "value": "default" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed management policy." + }, + "value": "default" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed management policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount", + "storageAccount_blobServices" + ] + }, + "storageAccount_localUsers": { + "copy": { + "name": "storageAccount_localUsers", + "count": "[length(coalesce(parameters('localUsers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]" + }, + "hasSshKey": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]" + }, + "hasSshPassword": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]" + }, + "permissionScopes": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]" + }, + "hasSharedKey": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]" + }, + "homeDirectory": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]" + }, + "sshAuthorizedKeys": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3261275799710495788" + }, + "name": "Storage Account Local Users", + "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication." + }, + "definitions": { + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "localUsers": { + "type": "Microsoft.Storage/storageAccounts/localUsers", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "hasSharedKey": "[parameters('hasSharedKey')]", + "hasSshKey": "[parameters('hasSshKey')]", + "hasSshPassword": "[parameters('hasSshPassword')]", + "homeDirectory": "[parameters('homeDirectory')]", + "permissionScopes": "[parameters('permissionScopes')]", + "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed local user." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed local user." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed local user." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_blobServices": { + "condition": "[not(empty(parameters('blobServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "containers": { + "value": "[tryGet(parameters('blobServices'), 'containers')]" + }, + "automaticSnapshotPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]" + }, + "changeFeedEnabled": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]" + }, + "changeFeedRetentionInDays": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]" + }, + "containerDeleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]" + }, + "containerDeleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]" + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]" + }, + "corsRules": { + "value": "[tryGet(parameters('blobServices'), 'corsRules')]" + }, + "defaultServiceVersion": { + "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]" + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]" + }, + "deleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]" + }, + "deleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]" + }, + "isVersioningEnabled": { + "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]" + }, + "lastAccessTimeTrackingPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]" + }, + "restorePolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]" + }, + "restorePolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9925173705553594819" + }, + "name": "Storage Account blob Services", + "description": "This module deploys a Storage Account Blob Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a storage container." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "container/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false, + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "blobServices": { + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]", + "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]", + "containerDeleteRetentionPolicy": { + "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]", + "days": "[parameters('containerDeleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]" + }, + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "defaultServiceVersion": "[parameters('defaultServiceVersion')]", + "deleteRetentionPolicy": { + "enabled": "[parameters('deleteRetentionPolicyEnabled')]", + "days": "[parameters('deleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]" + }, + "isVersioningEnabled": "[parameters('isVersioningEnabled')]", + "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]", + "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "blobServices_diagnosticSettings": { + "copy": { + "name": "blobServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "blobServices" + ] + }, + "blobServices_container": { + "copy": { + "name": "blobServices_container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "blobServiceName": { + "value": "[variables('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "defaultEncryptionScope": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]" + }, + "denyEncryptionScopeOverride": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]" + }, + "enableNfsV3AllSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]" + }, + "enableNfsV3RootSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]" + }, + "immutableStorageWithVersioningEnabled": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]" + }, + "publicAccess": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "immutabilityPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "5026123498979497429" + }, + "name": "Storage Account Blob Containers", + "description": "This module deploys a Storage Account Blob Container." + }, + "definitions": { + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an immutability policy." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "blobServiceName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "defaultValue": {} + }, + "publicAccess": { + "type": "string", + "defaultValue": "None", + "allowedValues": [ + "Container", + "Blob", + "None" + ], + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::blobServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "container": { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "properties": { + "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]", + "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]", + "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]", + "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]", + "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]", + "metadata": "[parameters('metadata')]", + "publicAccess": "[parameters('publicAccess')]" + } + }, + "container_roleAssignments": { + "copy": { + "name": "container_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "container" + ] + }, + "container_immutabilityPolicy": { + "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "containerName": { + "value": "[parameters('name')]" + }, + "immutabilityPeriodSinceCreationInDays": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]" + }, + "allowProtectedAppendWrites": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]" + }, + "allowProtectedAppendWritesAll": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10782942397325758470" + }, + "name": "Storage Account Blob Container Immutability Policies", + "description": "This module deploys a Storage Account Blob Container Immutability Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "containerName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment." + } + }, + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "defaultValue": 365, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "variables": { + "name": "default" + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]", + "properties": { + "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]", + "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]", + "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed immutability policy." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed immutability policy." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed immutability policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "container" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed container." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed container." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "blobServices" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed blob service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_fileServices": { + "condition": "[not(empty(parameters('fileServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]" + }, + "protocolSettings": { + "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]" + }, + "shareDeleteRetentionPolicy": { + "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]" + }, + "shares": { + "value": "[tryGet(parameters('fileServices'), 'shares')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "2735186993322606805" + }, + "name": "Storage Account File Share Services", + "description": "This module deploys a Storage Account File Share Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the file service." + } + }, + "protocolSettings": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings" + }, + "description": "Optional. Protocol settings for file service." + }, + "defaultValue": {} + }, + "shareDeleteRetentionPolicy": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy" + }, + "description": "Optional. The service properties for soft delete." + }, + "defaultValue": { + "enabled": true, + "days": 7 + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "shares": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. File shares to create." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileServices": { + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "protocolSettings": "[parameters('protocolSettings')]", + "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]" + } + }, + "fileServices_diagnosticSettings": { + "copy": { + "name": "fileServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "fileServices" + ] + }, + "fileServices_shares": { + "copy": { + "name": "fileServices_shares", + "count": "[length(coalesce(parameters('shares'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "fileServicesName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]" + }, + "accessTier": { + "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]" + }, + "enabledProtocols": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]" + }, + "rootSquash": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]" + }, + "shareQuota": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15881640847294537074" + }, + "name": "Storage Account File Shares", + "description": "This module deploys a Storage Account File Share." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "fileServicesName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the file share to create." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "TransactionOptimized", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "TransactionOptimized" + ], + "metadata": { + "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool." + } + }, + "shareQuota": { + "type": "int", + "defaultValue": 5120, + "metadata": { + "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)." + } + }, + "enabledProtocols": { + "type": "string", + "defaultValue": "SMB", + "allowedValues": [ + "NFS", + "SMB" + ], + "metadata": { + "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share." + } + }, + "rootSquash": { + "type": "string", + "defaultValue": "NoRootSquash", + "allowedValues": [ + "AllSquash", + "NoRootSquash", + "RootSquash" + ], + "metadata": { + "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::fileService": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileShare": { + "type": "Microsoft.Storage/storageAccounts/fileServices/shares", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]", + "properties": { + "accessTier": "[parameters('accessTier')]", + "shareQuota": "[parameters('shareQuota')]", + "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]", + "enabledProtocols": "[parameters('enabledProtocols')]" + } + }, + "fileShare_roleAssignments": { + "copy": { + "name": "fileShare_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "scope": { + "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]" + }, + "name": { + "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]" + }, + "roleDefinitionId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "principalType": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]" + }, + "condition": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]" + }, + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]", + "delegatedManagedIdentityResourceId": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "description": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "scope": { + "type": "string", + "metadata": { + "description": "Required. The scope to deploy the role assignment to." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The role definition Id to assign." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User", + "" + ], + "defaultValue": "", + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"" + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "defaultValue": "2.0", + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[parameters('scope')]", + "name": "[parameters('name')]", + "properties": { + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "principalId": "[parameters('principalId')]", + "description": "[parameters('description')]", + "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]", + "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]", + "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]", + "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]" + } + } + ] + } + }, + "dependsOn": [ + "fileShare" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "fileServices", + "storageAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_queueServices": { + "condition": "[not(empty(parameters('queueServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]" + }, + "queues": { + "value": "[tryGet(parameters('queueServices'), 'queues')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1100093319443502715" + }, + "name": "Storage Account Queue Services", + "description": "This module deploys a Storage Account Queue Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "queues": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Queues to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queueServices": { + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "queueServices_diagnosticSettings": { + "copy": { + "name": "queueServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "queueServices" + ] + }, + "queueServices_queues": { + "copy": { + "name": "queueServices_queues", + "count": "[length(coalesce(parameters('queues'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "name": { + "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17963799770990303971" + }, + "name": "Storage Account Queues", + "description": "This module deploys a Storage Account Queue." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage queue to deploy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair that represents queue metadata." + }, + "defaultValue": {} + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::queueServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queue": { + "type": "Microsoft.Storage/storageAccounts/queueServices/queues", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "properties": { + "metadata": "[parameters('metadata')]" + } + }, + "queue_roleAssignments": { + "copy": { + "name": "queue_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "queue" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed queue." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed queue." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed queue." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_tableServices": { + "condition": "[not(empty(parameters('tableServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]" + }, + "tables": { + "value": "[tryGet(parameters('tableServices'), 'tables')]" + }, + "corsRules": { + "value": "[tryGet(parameters('tableServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "13069389074590786512" + }, + "name": "Storage Account Table Services", + "description": "This module deploys a Storage Account Table Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "tables": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. tables to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "tableServices": { + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "tableServices_diagnosticSettings": { + "copy": { + "name": "tableServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "tableServices" + ] + }, + "tableServices_tables": { + "copy": { + "name": "tableServices_tables", + "count": "[length(parameters('tables'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('tables')[copyIndex()].name]" + }, + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10905926757212375091" + }, + "name": "Storage Account Table", + "description": "This module deploys a Storage Account Table." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::tableServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "table": { + "type": "Microsoft.Storage/storageAccounts/tableServices/tables", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "table_roleAssignments": { + "copy": { + "name": "table_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "table" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed table service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed table service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed table service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9368972709899985618" + } + }, + "definitions": { + "secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the secret to set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetOutputType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]", + "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]" + } + } + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed storage account." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed storage account." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed storage account." + }, + "value": "[resourceGroup().name]" + }, + "primaryBlobEndpoint": { + "type": "string", + "metadata": { + "description": "The primary blob endpoint reference if blob services are deployed." + }, + "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('storageAccount', '2024-01-01', 'full').location]" + }, + "serviceEndpoints": { + "type": "object", + "metadata": { + "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint." + }, + "value": "[reference('storageAccount').primaryEndpoints]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the Storage Account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "primaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The primary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]" + }, + "secondaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The secondary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]" + }, + "primaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]" + }, + "secondaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]" + } + } + } + } + }, + "pe": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('storage-pe-{0}', uniqueString(parameters('storageAccountName')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe-blob', parameters('storageAccountName'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" + }, + "groupIds": { + "value": [ + "blob" + ] + }, + "privateDnsZoneIds": "[if(empty(parameters('blobPrivateDnsZoneId')), createObject('value', createArray()), createObject('value', createArray(parameters('blobPrivateDnsZoneId'))))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "value": "[reference('storageAccount').outputs.name.value]" + }, + "resourceId": { + "type": "string", + "value": "[reference('storageAccount').outputs.resourceId.value]" + }, + "queueUrl": { + "type": "string", + "value": "[format('https://{0}.queue.{1}/', reference('storageAccount').outputs.name.value, environment().suffixes.storage)]" + } + } + } + }, + "dependsOn": [ + "network", + "privateDns", + "userAssignedIdentity" + ] + }, + "cosmosDb": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('cosmosDbDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "location": { + "value": "[parameters('location')]" + }, + "cosmosAccountName": { + "value": "[toLower(format('{0}-cosmosdb-{1}', parameters('namePrefix'), uniqueString(resourceGroup().id)))]" + }, + "cosmosDbName": { + "value": "[parameters('cosmosDbName')]" + }, + "cosmosDBContainerNames": { + "value": "[parameters('cosmosDBContainerNames')]" + }, + "cosmosDBDataContributorPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]", + "[deployer().objectId]" + ] + }, + "zoneRedundant": "[if(equals(parameters('environment'), 'prod'), createObject('value', true()), createObject('value', false()))]", + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "privateEndpointSubnetId": "[if(parameters('isPrivate'), createObject('value', reference('network').outputs.peSubnetId.value), createObject('value', ''))]", + "cosmosSqlPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.cosmosSqlZoneId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "9379637736520502099" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources" + } + }, + "cosmosAccountName": { + "type": "string", + "metadata": { + "description": "Required: Cosmos DB account name" + } + }, + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Required: Cosmos DB database name" + } + }, + "cosmosDBContainerNames": { + "type": "array", + "metadata": { + "description": "Optional: Cosmos DB container names used in the application" + } + }, + "cosmosDBDataContributorPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required: List of principal IDs (managed identity or user) to be assigned Cosmos DB SQL Data Contributor role" + } + }, + "zoneRedundant": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Enable zone redundancy for Cosmos DB account" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public network access and deploys a private endpoint." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource id for the private endpoint (required when isPrivate=true)" + } + }, + "cosmosSqlPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for Cosmos SQL API (required when isPrivate=true)" + } + } + }, + "resources": { + "cosmosAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-05-15", + "name": "[parameters('cosmosAccountName')]", + "dependsOn": [ + "cosmosDb" + ] + }, + "cosmosDb": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('cosmosDb-{0}', uniqueString('cosmosDb', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('cosmosAccountName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "capabilitiesToAdd": { + "value": [ + "EnableServerless" + ] + }, + "databaseAccountOfferType": { + "value": "Standard" + }, + "disableLocalAuthentication": { + "value": true + }, + "backupPolicyContinuousTier": { + "value": "Continuous7Days" + }, + "networkRestrictions": { + "value": { + "publicNetworkAccess": "[if(parameters('isPrivate'), 'Disabled', 'Enabled')]" + } + }, + "zoneRedundant": { + "value": "[parameters('zoneRedundant')]" + }, + "sqlDatabases": { + "value": [ + { + "copy": [ + { + "name": "containers", + "count": "[length(parameters('cosmosDBContainerNames'))]", + "input": { + "name": "[parameters('cosmosDBContainerNames')[copyIndex('containers')].name]", + "paths": [ + "[parameters('cosmosDBContainerNames')[copyIndex('containers')].partitionKey]" + ], + "kind": "Hash" + } + } + ], + "name": "[parameters('cosmosDbName')]" + } + ] + }, + "dataPlaneRoleDefinitions": { + "value": [ + { + "copy": [ + { + "name": "assignments", + "count": "[length(parameters('cosmosDBDataContributorPrincipalIds'))]", + "input": { + "principalId": "[parameters('cosmosDBDataContributorPrincipalIds')[copyIndex('assignments')]]" + } + } + ], + "roleName": "Cosmos DB SQL Data Contributor", + "dataActions": [ + "Microsoft.DocumentDB/databaseAccounts/readMetadata", + "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*", + "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*" + ] + } + ] + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17715929342484596741" + }, + "name": "Azure Cosmos DB account", + "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group ID for the private endpoint group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses for the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoint output." + } + }, + "failoverLocationType": { + "type": "object", + "properties": { + "failoverPriority": { + "type": "int", + "metadata": { + "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists." + } + }, + "isZoneRedundant": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true." + } + }, + "locationName": { + "type": "string", + "metadata": { + "description": "Required. The name of the region." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the failover location." + } + }, + "dataPlaneRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment." + } + }, + "dataPlaneRoleDefinitionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the role-based access control definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope." + } + }, + "assignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of role-based access control assignments to be created for the definition." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition." + } + }, + "sqlDatabaseType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the database ." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "analyticalStorageTtl": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "properties": { + "conflictResolutionPath": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'." + } + }, + "conflictResolutionProcedure": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'." + } + }, + "mode": { + "type": "string", + "allowedValues": [ + "Custom", + "LastWriterWins" + ], + "metadata": { + "description": "Required. Indicates the conflict resolution mode." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "nullable": true, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "indexingPolicy": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "allowedValues": [ + 1, + 2 + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "items": { + "type": "object", + "properties": { + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Set of containers to deploy in the database." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL database." + } + }, + "networkRestrictionType": { + "type": "object", + "properties": { + "ipRules": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`." + } + }, + "networkAclBypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"." + } + }, + "publicNetworkAccess": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"." + } + }, + "virtualNetworkRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of a subnet." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. List of virtual network access control list (ACL) rules configured for the account." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network restriction." + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "description": "The type for the SQL Role Assignments.", + "__bicep_imported_from!": { + "sourceTemplate": "sql-role-definition/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the account." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Defaults to the current resource group scope location. Location for all resources." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags" + }, + "description": "Optional. Tags for the resource." + }, + "nullable": true + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "databaseAccountOfferType": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Standard" + ], + "metadata": { + "description": "Optional. The offer type for the account. Defaults to \"Standard\"." + } + }, + "failoverLocations": { + "type": "array", + "items": { + "$ref": "#/definitions/failoverLocationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed." + } + }, + "zoneRedundant": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts." + } + }, + "defaultConsistencyLevel": { + "type": "string", + "defaultValue": "Session", + "allowedValues": [ + "Eventual", + "ConsistentPrefix", + "Session", + "BoundedStaleness", + "Strong" + ], + "metadata": { + "description": "Optional. The default consistency level of the account. Defaults to \"Session\"." + } + }, + "disableLocalAuthentication": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true." + } + }, + "enableAnalyticalStorage": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false." + } + }, + "automaticFailover": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable automatic failover for regions. Defaults to true." + } + }, + "enableFreeTier": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false." + } + }, + "enableMultipleWriteLocations": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false." + } + }, + "disableKeyBasedMetadataWriteAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true." + } + }, + "maxStalenessPrefix": { + "type": "int", + "defaultValue": 100000, + "minValue": 1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000." + } + }, + "maxIntervalInSeconds": { + "type": "int", + "defaultValue": 300, + "minValue": 5, + "maxValue": 86400, + "metadata": { + "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300." + } + }, + "serverVersion": { + "type": "string", + "defaultValue": "4.2", + "allowedValues": [ + "3.2", + "3.6", + "4.0", + "4.2", + "5.0", + "6.0", + "7.0" + ], + "metadata": { + "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"." + } + }, + "sqlDatabases": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlDatabaseType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL." + } + }, + "mongodbDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU." + } + }, + "gremlinDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin." + } + }, + "tables": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "totalThroughputLimit": { + "type": "int", + "defaultValue": -1, + "metadata": { + "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of control plane Azure role-based access control assignments." + } + }, + "dataPlaneRoleDefinitions": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleDefinitionType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions." + } + }, + "dataPlaneRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings for the service." + } + }, + "capabilitiesToAdd": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "allowedValues": [ + "EnableCassandra", + "EnableTable", + "EnableGremlin", + "EnableMongo", + "DisableRateLimitingResponses", + "EnableServerless", + "EnableNoSQLVectorSearch", + "EnableNoSQLFullTextSearch", + "EnableMaterializedViews", + "DeleteAllItemsByPartitionKey" + ], + "metadata": { + "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account." + } + }, + "backupPolicyType": { + "type": "string", + "defaultValue": "Continuous", + "allowedValues": [ + "Periodic", + "Continuous" + ], + "metadata": { + "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"." + } + }, + "backupPolicyContinuousTier": { + "type": "string", + "defaultValue": "Continuous30Days", + "allowedValues": [ + "Continuous30Days", + "Continuous7Days" + ], + "metadata": { + "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"." + } + }, + "backupIntervalInMinutes": { + "type": "int", + "defaultValue": 240, + "minValue": 60, + "maxValue": 1440, + "metadata": { + "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240." + } + }, + "backupRetentionIntervalInHours": { + "type": "int", + "defaultValue": 8, + "minValue": 2, + "maxValue": 720, + "metadata": { + "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8." + } + }, + "backupStorageRedundancy": { + "type": "string", + "defaultValue": "Local", + "allowedValues": [ + "Geo", + "Local", + "Zone" + ], + "metadata": { + "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible." + } + }, + "networkRestrictions": { + "$ref": "#/definitions/networkRestrictionType", + "defaultValue": { + "ipRules": [], + "virtualNetworkRules": [], + "publicNetworkAccess": "Disabled" + }, + "metadata": { + "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "Tls12", + "allowedValues": [ + "Tls12" + ], + "metadata": { + "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInControlPlaneRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]", + "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]", + "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]", + "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-07-01", + "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "identity": "[variables('identity')]", + "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]", + "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]" + }, + "databaseAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_diagnosticSettings": { + "copy": { + "name": "databaseAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_roleAssignments": { + "copy": { + "name": "databaseAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlDatabases": { + "copy": { + "name": "databaseAccount_sqlDatabases", + "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]" + }, + "containers": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]" + }, + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "7141543733238879531" + }, + "name": "DocumentDB Database Account SQL Databases", + "description": "This module deploys a SQL Database in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the SQL database ." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of containers to deploy in the SQL database." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL database resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "container": { + "copy": { + "name": "container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "sqlDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "analyticalStorageTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + }, + "conflictResolutionPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]" + }, + "defaultTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]" + }, + "indexingPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]" + }, + "kind": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]" + }, + "version": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]" + }, + "paths": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]" + }, + "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]", + "uniqueKeyPolicyKeys": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1789954443166349986" + }, + "name": "DocumentDB Database Account SQL Database Containers", + "description": "This module deploys a SQL Database Container in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "sqlDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "analyticalStorageTtl": { + "type": "int", + "defaultValue": 0, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL Database resource." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + }, + "kind": { + "type": "string", + "defaultValue": "Hash", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "defaultValue": 1, + "allowedValues": [ + 1, + 2 + ], + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + } + }, + "variables": { + "copy": [ + { + "name": "partitionKeyPaths", + "count": "[length(parameters('paths'))]", + "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]" + } + ], + "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]" + }, + "resources": { + "databaseAccount::sqlDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "container": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": "[variables('containerResourceParams')]", + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the container." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the container was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleDefinitions": { + "copy": { + "name": "databaseAccount_sqlRoleDefinitions", + "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]" + }, + "dataActions": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]" + }, + "roleName": { + "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]" + }, + "assignableScopes": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]" + }, + "sqlRoleAssignments": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9570871897890815068" + }, + "name": "DocumentDB Database Account SQL Role Definitions.", + "description": "This module deploys a SQL Role Definision in a CosmosDB Account." + }, + "definitions": { + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the SQL Role Assignments." + } + } + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the Role Definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account." + } + }, + "sqlRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleDefinition": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]", + "properties": { + "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]", + "permissions": [ + { + "dataActions": "[parameters('dataActions')]" + } + ], + "roleName": "[parameters('roleName')]", + "type": "CustomRole" + } + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "roleDefinitionId": { + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "principalId": { + "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlRoleDefinition" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Definition." + }, + "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Definition." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + }, + "roleName": { + "type": "string", + "metadata": { + "description": "The role name of the SQL Role Definition." + }, + "value": "[reference('sqlRoleDefinition').roleName]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "roleDefinitionId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_mongodbDatabases": { + "copy": { + "name": "databaseAccount_mongodbDatabases", + "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "collections": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9160691107424630312" + }, + "name": "DocumentDB Database Account MongoDB Databases", + "description": "This module deploys a MongoDB Database within a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the mongodb database." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "collections": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Collections in the mongodb database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "mongodbDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "mongodbDatabase_collections": { + "copy": { + "name": "mongodbDatabase_collections", + "count": "[length(coalesce(parameters('collections'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "mongodbDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]" + }, + "indexes": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]" + }, + "shardKey": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14050805189442830205" + }, + "name": "DocumentDB Database Account MongoDB Database Collections", + "description": "This module deploys a MongoDB Database Collection." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "mongodbDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the collection." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "indexes": { + "type": "array", + "metadata": { + "description": "Required. Indexes for the collection." + } + }, + "shardKey": { + "type": "object", + "metadata": { + "description": "Required. ShardKey for the collection." + } + } + }, + "resources": [ + { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]", + "properties": { + "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]", + "indexes": "[parameters('indexes')]", + "shardKey": "[parameters('shardKey')]" + } + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database collection." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database collection." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database collection was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "mongodbDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_gremlinDatabases": { + "copy": { + "name": "databaseAccount_gremlinDatabases", + "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "graphs": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "16834580070429190924" + }, + "name": "DocumentDB Database Account Gremlin Databases", + "description": "This module deploys a Gremlin Database within a CosmosDB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Gremlin database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin database resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment." + } + }, + "graphs": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Array of graphs to deploy in the Gremlin database." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "gremlinDatabase_gremlinGraphs": { + "copy": { + "name": "gremlinDatabase_gremlinGraphs", + "count": "[length(parameters('graphs'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('graphs')[copyIndex()].name]" + }, + "gremlinDatabaseName": { + "value": "[parameters('name')]" + }, + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "indexingPolicy": { + "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]" + }, + "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15062578211366932944" + }, + "name": "DocumentDB Database Accounts Gremlin Databases Graphs", + "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the graph." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin graph resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "gremlinDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the graph." + } + }, + "partitionKeyPaths": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. List of paths using which data within the container can be partitioned." + } + } + }, + "resources": { + "databaseAccount::gremlinDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinGraph": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]", + "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]", + "partitionKey": { + "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]" + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the graph." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the graph." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the graph was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "gremlinDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the Gremlin database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Gremlin database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the Gremlin database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_tables": { + "copy": { + "name": "databaseAccount_tables", + "count": "[length(coalesce(parameters('tables'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3429971823201332257" + }, + "name": "Azure Cosmos DB account tables", + "description": "This module deploys a table within an Azure Cosmos DB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags for the table." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "table": { + "type": "Microsoft.DocumentDB/databaseAccounts/tables", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the table." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the table." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the table was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_privateEndpoints": { + "copy": { + "name": "databaseAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the database account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the database account." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the database account was created in." + }, + "value": "[resourceGroup().name]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('databaseAccount', '2024-11-15', 'full').location]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The endpoint of the database account." + }, + "value": "[reference('databaseAccount').documentEndpoint]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the database account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "primaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]" + }, + "primaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]" + }, + "primaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]" + }, + "primaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]" + }, + "secondaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]" + }, + "secondaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]" + }, + "secondaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]" + }, + "secondaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]" + } + } + } + } + }, + "pe": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('cosmos-pe-{0}', uniqueString(parameters('cosmosAccountName')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe', parameters('cosmosAccountName'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosAccountName'))]" + }, + "groupIds": { + "value": [ + "Sql" + ] + }, + "privateDnsZoneIds": "[if(empty(parameters('cosmosSqlPrivateDnsZoneId')), createObject('value', createArray()), createObject('value', createArray(parameters('cosmosSqlPrivateDnsZoneId'))))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "cosmosDb" + ] + } + }, + "outputs": { + "cosmosAccountName": { + "type": "string", + "value": "[reference('cosmosDb').outputs.name.value]" + }, + "cosmosEndpoint": { + "type": "string", + "value": "[reference('cosmosDb').outputs.endpoint.value]" + }, + "cosmosDBName": { + "type": "string", + "value": "[parameters('cosmosDbName')]" + } + } + } + }, + "dependsOn": [ + "network", + "privateDns", + "userAssignedIdentity" + ] + }, + "containerRegistry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('containerRegistryDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "containerRegistryName": { + "value": "[toLower(format('{0}acr{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "privateEndpointSubnetId": "[if(parameters('isPrivate'), createObject('value', reference('network').outputs.peSubnetId.value), createObject('value', ''))]", + "acrPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.acrZoneId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "3096403326932700663" + } + }, + "parameters": { + "containerRegistryName": { + "type": "string", + "metadata": { + "description": "Required: Name of the Container Registry" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources. Default is the resource group location" + } + }, + "sku": { + "type": "string", + "defaultValue": "Basic", + "metadata": { + "description": "Optional: Container Registry SKU. Default is Basic (switches to Premium automatically when isPrivate=true)." + } + }, + "adminUserEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional: Admin user enabled. Default is true (forced off when isPrivate=true)" + } + }, + "publicNetworkAccess": { + "type": "string", + "defaultValue": "Enabled", + "metadata": { + "description": "Public network access setting for the Azure Container Registry" + } + }, + "zoneRedundancy": { + "type": "string", + "defaultValue": "Disabled", + "metadata": { + "description": "Zone redundancy setting for the Azure Container Registry" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, forces Premium SKU + disables admin + public access and deploys a private endpoint." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource id for the private endpoint (required when isPrivate=true)" + } + }, + "acrPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for ACR (required when isPrivate=true)" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Managed Identity that will be given access to the Container Registry" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + } + }, + "variables": { + "copy": [ + { + "name": "roleAssignmentsAcrPull", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPull')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "AcrPull" + } + }, + { + "name": "roleAssignmentsAcrPush", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPush')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "AcrPush" + } + }, + { + "name": "roleAssignmentsAcrDelete", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrDelete')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "AcrDelete" + } + } + ], + "effectiveSku": "[if(parameters('isPrivate'), 'Premium', parameters('sku'))]", + "effectiveAdmin": "[if(parameters('isPrivate'), false(), parameters('adminUserEnabled'))]", + "effectivePublic": "[if(parameters('isPrivate'), 'Disabled', parameters('publicNetworkAccess'))]" + }, + "resources": { + "acrRef": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-11-01-preview", + "name": "[parameters('containerRegistryName')]", + "dependsOn": [ + "containerRegistry" + ] + }, + "containerRegistry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('containerRegistry-{0}', uniqueString('containerRegistry', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('containerRegistryName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "acrSku": { + "value": "[variables('effectiveSku')]" + }, + "acrAdminUserEnabled": { + "value": "[variables('effectiveAdmin')]" + }, + "publicNetworkAccess": { + "value": "[variables('effectivePublic')]" + }, + "zoneRedundancy": { + "value": "[parameters('zoneRedundancy')]" + }, + "roleAssignments": { + "value": "[concat(variables('roleAssignmentsAcrPull'), variables('roleAssignmentsAcrPush'), variables('roleAssignmentsAcrDelete'))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10440624024470892086" + }, + "name": "Azure Container Registries (ACR)", + "description": "This module deploys an Azure Container Registry (ACR)." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "scopeMapsType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the scope map." + } + }, + "actions": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of scoped permissions for registry artifacts." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The user friendly description of the scope map." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a scope map." + } + }, + "cacheRuleType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined." + } + }, + "sourceRepository": { + "type": "string", + "metadata": { + "description": "Required. Source repository pulled from upstream." + } + }, + "targetRepository": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}." + } + }, + "credentialSetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the credential store which is associated with the cache rule." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cache rule." + } + }, + "credentialSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential set." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityOnlySysAssignedType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "authCredentials": { + "type": "array", + "items": { + "$ref": "#/definitions/authCredentialsType" + }, + "metadata": { + "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential." + } + }, + "loginServer": { + "type": "string", + "metadata": { + "description": "Required. The credentials are stored for this upstream or login server." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a credential set." + } + }, + "replicationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the replication." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "regionEndpointEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications." + } + }, + "zoneRedundancy": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. Whether or not zone redundancy is enabled for this container registry." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a replication." + } + }, + "webhookType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "minLength": 5, + "maxLength": 50, + "metadata": { + "description": "Optional. The name of the registry webhook." + } + }, + "serviceUri": { + "type": "string", + "metadata": { + "description": "Required. The service URI for the webhook to post notifications." + } + }, + "status": { + "type": "string", + "allowedValues": [ + "disabled", + "enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. The status of the webhook at the time the operation was called." + } + }, + "action": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The list of actions that trigger the webhook to post notifications." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "customHeaders": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Custom headers that will be added to the webhook notifications." + } + }, + "scope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a webhook." + } + }, + "_1.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "authCredentialsType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential." + } + }, + "usernameSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the username." + } + }, + "passwordSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the password." + } + } + }, + "metadata": { + "description": "The type for auth credentials.", + "__bicep_imported_from!": { + "sourceTemplate": "credential-set/main.bicep" + } + } + }, + "customerManagedKeyWithAutoRotateType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting." + } + }, + "autoRotationEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "managedIdentityOnlySysAssignedType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_1.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 5, + "maxLength": 50, + "metadata": { + "description": "Required. Name of your Azure Container Registry." + } + }, + "acrAdminUserEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable admin user that have push / pull permission to the registry." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "acrSku": { + "type": "string", + "defaultValue": "Premium", + "allowedValues": [ + "Basic", + "Premium", + "Standard" + ], + "metadata": { + "description": "Optional. Tier of your Azure container registry." + } + }, + "exportPolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the export policy is enabled or not." + } + }, + "quarantinePolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "trustPolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "retentionPolicyStatus": { + "type": "string", + "defaultValue": "enabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the retention policy is enabled or not." + } + }, + "retentionPolicyDays": { + "type": "int", + "defaultValue": 15, + "metadata": { + "description": "Optional. The number of days to retain an untagged manifest after which it gets purged." + } + }, + "azureADAuthenticationAsArmPolicyStatus": { + "type": "string", + "defaultValue": "enabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registry is enabled or not. Default is enabled." + } + }, + "softDeletePolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. Soft Delete policy status. Default is disabled." + } + }, + "softDeletePolicyDays": { + "type": "int", + "defaultValue": 7, + "metadata": { + "description": "Optional. The number of days after which a soft-deleted item is permanently deleted." + } + }, + "dataEndpointEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "networkRuleBypassOptions": { + "type": "string", + "defaultValue": "AzureServices", + "allowedValues": [ + "AzureServices", + "None" + ], + "metadata": { + "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry." + } + }, + "networkRuleSetDefaultAction": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Allow", + "Deny" + ], + "metadata": { + "description": "Optional. The default action of allow or deny when no other rules match." + } + }, + "networkRuleSetIpRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "zoneRedundancy": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Whether or not zone redundancy is enabled for this container registry." + } + }, + "replications": { + "type": "array", + "items": { + "$ref": "#/definitions/replicationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All replications to create." + } + }, + "webhooks": { + "type": "array", + "items": { + "$ref": "#/definitions/webhookType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All webhooks to create." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.ContainerRegistry/registries@2025-04-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "anonymousPullEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyWithAutoRotateType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "cacheRules": { + "type": "array", + "items": { + "$ref": "#/definitions/cacheRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of Cache Rules." + } + }, + "credentialSets": { + "type": "array", + "items": { + "$ref": "#/definitions/credentialSetType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of Credential Sets." + } + }, + "scopeMaps": { + "type": "array", + "items": { + "$ref": "#/definitions/scopeMapsType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Scope maps setting." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]", + "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]", + "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]", + "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]", + "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]", + "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]", + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.9.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "registry": { + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "identity": "[variables('identity')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "[parameters('acrSku')]" + }, + "properties": { + "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]", + "adminUserEnabled": "[parameters('acrAdminUserEnabled')]", + "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)))), null())]", + "policies": { + "azureADAuthenticationAsArmPolicy": { + "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]" + }, + "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]", + "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]", + "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]", + "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]", + "softDeletePolicy": { + "retentionDays": "[parameters('softDeletePolicyDays')]", + "status": "[parameters('softDeletePolicyStatus')]" + } + }, + "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]", + "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]", + "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]", + "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]", + "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]" + }, + "dependsOn": [ + "cMKKeyVault::cMKKey", + "cMKUserAssignedIdentity" + ] + }, + "registry_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "registry" + ] + }, + "registry_diagnosticSettings": { + "copy": { + "name": "registry_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "registry" + ] + }, + "registry_roleAssignments": { + "copy": { + "name": "registry_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "registry" + ] + }, + "registry_scopeMaps": { + "copy": { + "name": "registry_scopeMaps", + "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]" + }, + "actions": { + "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]" + }, + "description": { + "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]" + }, + "registryName": { + "value": "[parameters('name')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "6143951528715126111" + }, + "name": "Container Registries scopeMaps", + "description": "This module deploys an Azure Container Registry (ACR) scopeMap." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]", + "metadata": { + "description": "Optional. The name of the scope map." + } + }, + "actions": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of scoped permissions for registry artifacts." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The user friendly description of the scope map." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "scopeMap": { + "type": "Microsoft.ContainerRegistry/registries/scopeMaps", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "properties": { + "actions": "[parameters('actions')]", + "description": "[parameters('description')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the scope map." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the scope map was created in." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the scope map." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_replications": { + "copy": { + "name": "registry_replications", + "count": "[length(coalesce(parameters('replications'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]" + }, + "registryName": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]" + }, + "regionEndpointEnabled": { + "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]" + }, + "zoneRedundancy": { + "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9998680016086915512" + }, + "name": "Azure Container Registry (ACR) Replications", + "description": "This module deploys an Azure Container Registry (ACR) Replication." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the replication." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "regionEndpointEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications." + } + }, + "zoneRedundancy": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Whether or not zone redundancy is enabled for this container registry." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "replication": { + "type": "Microsoft.ContainerRegistry/registries/replications", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]", + "zoneRedundancy": "[parameters('zoneRedundancy')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the replication." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the replication." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the replication was created in." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('replication', '2023-06-01-preview', 'full').location]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_credentialSets": { + "copy": { + "name": "registry_credentialSets", + "count": "[length(coalesce(parameters('credentialSets'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]" + }, + "registryName": { + "value": "[parameters('name')]" + }, + "managedIdentities": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]" + }, + "authCredentials": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]" + }, + "loginServer": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10146775336818580275" + }, + "name": "Container Registries Credential Sets", + "description": "This module deploys an ACR Credential Set." + }, + "definitions": { + "authCredentialsType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential." + } + }, + "usernameSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the username." + } + }, + "passwordSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the password." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for auth credentials." + } + }, + "managedIdentityOnlySysAssignedType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential set." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityOnlySysAssignedType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "authCredentials": { + "type": "array", + "items": { + "$ref": "#/definitions/authCredentialsType" + }, + "metadata": { + "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential." + } + }, + "loginServer": { + "type": "string", + "metadata": { + "description": "Required. The credentials are stored for this upstream or login server." + } + } + }, + "variables": { + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]" + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "credentialSet": { + "type": "Microsoft.ContainerRegistry/registries/credentialSets", + "apiVersion": "2023-11-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "identity": "[variables('identity')]", + "properties": { + "authCredentials": "[parameters('authCredentials')]", + "loginServer": "[parameters('loginServer')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The Name of the Credential Set." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Credential Set." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Credential Set." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('credentialSet', '2023-11-01-preview', 'full'), 'identity'), 'principalId')]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_cacheRules": { + "copy": { + "name": "registry_cacheRules", + "count": "[length(coalesce(parameters('cacheRules'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "registryName": { + "value": "[parameters('name')]" + }, + "sourceRepository": { + "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name')]" + }, + "targetRepository": { + "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]" + }, + "credentialSetResourceId": { + "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "16179895563671172347" + }, + "name": "Container Registries Cache", + "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[replace(replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-'), '*', '')]", + "metadata": { + "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined." + } + }, + "sourceRepository": { + "type": "string", + "metadata": { + "description": "Required. Source repository pulled from upstream." + } + }, + "targetRepository": { + "type": "string", + "defaultValue": "[parameters('sourceRepository')]", + "metadata": { + "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}." + } + }, + "credentialSetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the credential store which is associated with the cache rule." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "cacheRule": { + "type": "Microsoft.ContainerRegistry/registries/cacheRules", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "properties": { + "sourceRepository": "[parameters('sourceRepository')]", + "targetRepository": "[parameters('targetRepository')]", + "credentialSetResourceId": "[parameters('credentialSetResourceId')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The Name of the Cache Rule." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Cache Rule." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Cache Rule." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "registry", + "registry_credentialSets" + ] + }, + "registry_webhooks": { + "copy": { + "name": "registry_webhooks", + "count": "[length(coalesce(parameters('webhooks'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]" + }, + "registryName": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]" + }, + "action": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action')]" + }, + "customHeaders": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]" + }, + "scope": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]" + }, + "status": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]" + }, + "serviceUri": { + "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "6514847976022081392" + }, + "name": "Azure Container Registry (ACR) Webhooks", + "description": "This module deploys an Azure Container Registry (ACR) Webhook." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[format('{0}webhook', parameters('registryName'))]", + "minLength": 5, + "maxLength": 50, + "metadata": { + "description": "Optional. The name of the registry webhook." + } + }, + "serviceUri": { + "type": "string", + "metadata": { + "description": "Required. The service URI for the webhook to post notifications." + } + }, + "status": { + "type": "string", + "defaultValue": "enabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The status of the webhook at the time the operation was called." + } + }, + "action": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [ + "chart_delete", + "chart_push", + "delete", + "push", + "quarantine" + ], + "metadata": { + "description": "Optional. The list of actions that trigger the webhook to post notifications." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "customHeaders": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Custom headers that will be added to the webhook notifications." + } + }, + "scope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "webhook": { + "type": "Microsoft.ContainerRegistry/registries/webhooks", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "actions": "[parameters('action')]", + "customHeaders": "[parameters('customHeaders')]", + "scope": "[parameters('scope')]", + "serviceUri": "[parameters('serviceUri')]", + "status": "[parameters('status')]" + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the webhook." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the webhook." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Azure container registry." + }, + "value": "[resourceGroup().name]" + }, + "actions": { + "type": "array", + "metadata": { + "description": "The actions of the webhook." + }, + "value": "[reference('webhook').actions]" + }, + "status": { + "type": "string", + "metadata": { + "description": "The status of the webhook." + }, + "value": "[reference('webhook').status]" + }, + "provistioningState": { + "type": "string", + "metadata": { + "description": "The provisioning state of the webhook." + }, + "value": "[reference('webhook').provisioningState]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('webhook', '2023-06-01-preview', 'full').location]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_privateEndpoints": { + "copy": { + "name": "registry_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "registry", + "registry_replications" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The Name of the Azure container registry." + }, + "value": "[parameters('name')]" + }, + "loginServer": { + "type": "string", + "metadata": { + "description": "The reference to the Azure container registry." + }, + "value": "[reference('registry').loginServer]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Azure container registry." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Azure container registry." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('registry', '2023-06-01-preview', 'full').location]" + }, + "credentialSetsSystemAssignedMIPrincipalIds": { + "type": "array", + "metadata": { + "description": "The Principal IDs of the ACR Credential Sets system-assigned identities." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]", + "input": "[tryGet(tryGet(reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs, 'systemAssignedMIPrincipalId'), 'value')]" + } + }, + "credentialSetsResourceIds": { + "type": "array", + "metadata": { + "description": "The Resource IDs of the ACR Credential Sets." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]", + "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs.resourceId.value]" + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the Azure container registry." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + } + } + } + } + }, + "pe": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('acr-pe-{0}', uniqueString(parameters('containerRegistryName')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe', parameters('containerRegistryName'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]" + }, + "groupIds": { + "value": [ + "registry" + ] + }, + "privateDnsZoneIds": "[if(empty(parameters('acrPrivateDnsZoneId')), createObject('value', createArray()), createObject('value', createArray(parameters('acrPrivateDnsZoneId'))))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "containerRegistry" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "value": "[reference('containerRegistry').outputs.name.value]" + }, + "loginServer": { + "type": "string", + "value": "[reference('containerRegistry').outputs.loginServer.value]" + }, + "resourceGroupName": { + "type": "string", + "value": "[reference('containerRegistry').outputs.resourceGroupName.value]" + }, + "resourceId": { + "type": "string", + "value": "[reference('containerRegistry').outputs.resourceId.value]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "value": "[tryGet(tryGet(reference('containerRegistry').outputs, 'systemAssignedMIPrincipalId'), 'value')]" + }, + "credentialSetsSystemAssignedMIPrincipalIds": { + "type": "array", + "value": "[reference('containerRegistry').outputs.credentialSetsSystemAssignedMIPrincipalIds.value]" + }, + "credentialSetsResourceIds": { + "type": "array", + "value": "[reference('containerRegistry').outputs.credentialSetsResourceIds.value]" + }, + "privateEndpoints": { + "type": "array", + "value": "[reference('containerRegistry').outputs.privateEndpoints.value]" + } + } + } + }, + "dependsOn": [ + "network", + "privateDns", + "userAssignedIdentity" + ] + }, + "appServicePlan": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('appServicePlanDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-asp-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "17476769051930529155" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the App Service Plan" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags applied to the plan" + } + }, + "skuName": { + "type": "string", + "defaultValue": "P0v3", + "metadata": { + "description": "SKU name for the App Service Plan. P0v3 is the cheapest V3 SKU available in Sweden Central." + } + }, + "skuTier": { + "type": "string", + "defaultValue": "PremiumV3", + "metadata": { + "description": "SKU tier (must match skuName family)." + } + }, + "skuCapacity": { + "type": "int", + "defaultValue": 1, + "metadata": { + "description": "Number of instances" + } + } + }, + "resources": [ + { + "type": "Microsoft.Web/serverfarms", + "apiVersion": "2024-04-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "kind": "linux", + "sku": { + "name": "[parameters('skuName')]", + "tier": "[parameters('skuTier')]", + "capacity": "[parameters('skuCapacity')]" + }, + "properties": { + "reserved": true, + "zoneRedundant": false + } + } + ], + "outputs": { + "id": { + "type": "string", + "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]" + }, + "name": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + } + }, + "aiFoundry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('aiFoundryDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "aiFoundryBaseName": { + "value": "[substring(toLower(uniqueString(format('ai-{0}-{1}-{2}', parameters('namePrefix'), parameters('environment'), resourceGroup().id))), 0, 12)]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "location": { + "value": "[parameters('aiFoundryLocation')]" + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "openAiPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.openAiZoneId.value), createObject('value', ''))]", + "cognitiveServicesPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.cognitiveServicesZoneId.value), createObject('value', ''))]", + "aiServicesPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.aiServicesZoneId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "18356341267398099831" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources. Default is the resource group location" + } + }, + "aiFoundryBaseName": { + "type": "string", + "metadata": { + "description": "Required: Base name used by the AI Foundry AVM pattern (max 12 chars)" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Managed Identity that will be given access to the AI Foundry Resource" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public network access and deploys the AI Foundry private endpoints via AVM." + } + }, + "agentServiceSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Agent service subnet id (optional; reserved for future Foundry agent runtime private networking)" + } + }, + "openAiPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for privatelink.openai.azure.com (required when isPrivate=true)" + } + }, + "cognitiveServicesPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for privatelink.cognitiveservices.azure.com (required when isPrivate=true)" + } + }, + "aiServicesPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for privatelink.services.ai.azure.com (required when isPrivate=true)" + } + } + }, + "variables": { + "networkingConfig": "[if(parameters('isPrivate'), createObject('agentServiceSubnetResourceId', parameters('agentServiceSubnetId'), 'aiServicesPrivateDnsZoneResourceId', parameters('aiServicesPrivateDnsZoneId'), 'cognitiveServicesPrivateDnsZoneResourceId', parameters('cognitiveServicesPrivateDnsZoneId'), 'openAiPrivateDnsZoneResourceId', parameters('openAiPrivateDnsZoneId')), null())]" + }, + "resources": { + "aiFoundry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('aiFoundry-{0}', uniqueString('aiFoundry', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "baseName": { + "value": "[parameters('aiFoundryBaseName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "aiFoundryConfiguration": { + "value": { + "copy": [ + { + "name": "roleAssignments", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignments')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "53ca6127-db72-4b80-b1b0-d745d6d5456d" + } + } + ], + "allowProjectManagement": true, + "createCapabilityHosts": false, + "disableLocalAuth": true, + "location": "[parameters('location')]", + "networking": "[variables('networkingConfig')]", + "project": { + "desc": "AI Foundry project for AI Investment Analysis Sample", + "displayName": "AI-Invest", + "name": "aiinvest-project" + }, + "sku": "S0" + } + }, + "aiModelDeployments": { + "value": [ + { + "model": { + "format": "OpenAI", + "name": "gpt-4.1-mini", + "version": "2025-04-14" + }, + "name": "gpt-4.1-mini", + "sku": { + "capacity": 100, + "name": "GlobalStandard" + } + } + ] + }, + "includeAssociatedResources": { + "value": false + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16692041582792913299" + }, + "name": "ai-foundry", + "description": "Creates an AI Foundry account and project with Standard Agent Services." + }, + "definitions": { + "resourceConfigurationType": { + "type": "object", + "properties": { + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of an existing resource to use instead of creating a new one. If provided, other parameters are ignored." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name to be used when creating the resource. This is ignored if an existingResourceId is provided." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the Private DNS Zone that associates with the resource. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for a resource, including optional name, existing resource ID, and role assignments." + } + }, + "storageAccountConfigurationType": { + "type": "object", + "properties": { + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing Storage Account to use instead of creating a new one. If provided, other parameters are ignored." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name to be used when creating the Storage Account. This is ignored if an existingResourceId is provided." + } + }, + "blobPrivateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the DNS zone \"blob\" for the Azure Storage Account. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for a Storage Account, including optional name, existing resource ID, containers, and role assignments." + } + }, + "foundryConfigurationType": { + "type": "object", + "properties": { + "accountName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the AI Foundry account." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location of the AI Foundry account. Will default to the resource group location if not specified." + } + }, + "sku": { + "type": "string", + "allowedValues": [ + "C2", + "C3", + "C4", + "DC0", + "F0", + "F1", + "S", + "S0", + "S1", + "S10", + "S2", + "S3", + "S4", + "S5", + "S6", + "S7", + "S8", + "S9" + ], + "nullable": true, + "metadata": { + "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region. Defaults to 'S0'." + } + }, + "createCapabilityHosts": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether to create Capability Hosts for the AI Agent Service. If true, the AI Foundry Account and default Project will be created with the capability host for the associated resources. Can only be true if 'includeAssociatedResources' is true. Defaults to false." + } + }, + "disableLocalAuth": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons. Defaults to true." + } + }, + "allowProjectManagement": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether to allow project management in the AI Foundry account. If true, users can create and manage projects within the AI Foundry account. Defaults to true." + } + }, + "networking": { + "$ref": "#/definitions/foundryNetworkConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Values to establish private networking for the AI Foundry account and project." + } + }, + "project": { + "$ref": "#/definitions/foundryProjectConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. AI Foundry default project." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Role assignments to apply to the AI Foundry resource when creating it." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for a AI Foundry, including optional account name and project configuration." + } + }, + "foundryNetworkConfigurationType": { + "type": "object", + "properties": { + "agentServiceSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the subnet for the Azure AI Services account. This is required if 'createAIAgentService' is true." + } + }, + "cognitiveServicesPrivateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account." + } + }, + "openAiPrivateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the Private DNS Zone for the OpenAI account." + } + }, + "aiServicesPrivateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Values to establish private networking for the AI Foundry service." + } + }, + "foundryProjectConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the AI Foundry project." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The friendly/display name of the AI Foundry project." + } + }, + "desc": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the AI Foundry project." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for an AI Foundry project, including optional name, friendly name, and description." + } + }, + "deploymentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of cognitive service account deployment." + } + }, + "model": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account deployment model." + } + }, + "format": { + "type": "string", + "metadata": { + "description": "Required. The format of Cognitive Services account deployment model." + } + }, + "version": { + "type": "string", + "metadata": { + "description": "Required. The version of Cognitive Services account deployment model." + } + } + }, + "metadata": { + "description": "Required. Properties of Cognitive Services account deployment model." + } + }, + "sku": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource model definition representing SKU." + } + }, + "capacity": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The capacity of the resource model definition representing SKU." + } + }, + "tier": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tier of the resource model definition representing SKU." + } + }, + "size": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The size of the resource model definition representing SKU." + } + }, + "family": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The family of the resource model definition representing SKU." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource model definition representing SKU." + } + }, + "raiPolicyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of RAI policy." + } + }, + "versionUpgradeOption": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version upgrade option." + } + } + }, + "metadata": { + "description": "The type for a cognitive services account deployment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "baseName": { + "type": "string", + "minLength": 3, + "maxLength": 12, + "metadata": { + "description": "Required. A friendly application/environment name to serve as the \"base\" when using the default naming for all resources in this deployment." + } + }, + "baseUniqueName": { + "type": "string", + "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('baseName')), 0, 5)]", + "maxLength": 5, + "metadata": { + "description": "Optional. A unique text value for the application/environment. This is used to ensure resource names are unique for global resources. Defaults to a 5-character substring of the unique string generated from the subscription ID, resource group name, and base name." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources. Defaults to the location of the resource group." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "aiModelDeployments": { + "type": "array", + "items": { + "$ref": "#/definitions/deploymentType" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. Specifies the OpenAI deployments to create." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the AI resources." + } + }, + "includeAssociatedResources": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Whether to include associated resources: Key Vault, AI Search, Storage Account, and Cosmos DB. If true, these resources will be created. Optionally, existing resources of these types can be supplied in their respective parameters. Defaults to false." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the subnet to establish Private Endpoint(s). If provided, private endpoints will be created for the AI Foundry account and associated resources when creating those resource. Each resource will also require supplied private DNS zone resource ID(s) to establish those private endpoints." + } + }, + "aiFoundryConfiguration": { + "$ref": "#/definitions/foundryConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the AI Foundry." + } + }, + "keyVaultConfiguration": { + "$ref": "#/definitions/resourceConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the Key Vault." + } + }, + "aiSearchConfiguration": { + "$ref": "#/definitions/resourceConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the AI Search resource." + } + }, + "storageAccountConfiguration": { + "$ref": "#/definitions/storageAccountConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the Storage Account." + } + }, + "cosmosDbConfiguration": { + "$ref": "#/definitions/resourceConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the Cosmos DB Account." + } + } + }, + "variables": { + "resourcesName": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('baseName'), parameters('baseUniqueName')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]", + "projectName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'name'))), parameters('aiFoundryConfiguration').project.name, format('proj-{0}', variables('resourcesName')))]", + "createCapabilityHosts": "[and(coalesce(tryGet(parameters('aiFoundryConfiguration'), 'createCapabilityHosts'), false()), parameters('includeAssociatedResources'))]" + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.ptn.aiml-aifoundry.{0}.{1}', replace('0.5.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "foundryAccount": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.account.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'accountName'))), createObject('value', parameters('aiFoundryConfiguration').accountName), createObject('value', format('ai{0}', variables('resourcesName'))))]", + "location": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'location'))), createObject('value', parameters('aiFoundryConfiguration').location), createObject('value', parameters('location')))]", + "sku": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'sku'))), createObject('value', parameters('aiFoundryConfiguration').sku), createObject('value', 'S0'))]", + "disableLocalAuth": { + "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'disableLocalAuth'), true())]" + }, + "allowProjectManagement": { + "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'allowProjectManagement'), true())]" + }, + "aiModelDeployments": { + "value": "[parameters('aiModelDeployments')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "agentSubnetResourceId": { + "value": "[tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')]" + }, + "privateDnsZoneResourceIds": "[if(and(not(empty(parameters('privateEndpointSubnetResourceId'))), not(empty(tryGet(parameters('aiFoundryConfiguration'), 'networking')))), createObject('value', createArray(parameters('aiFoundryConfiguration').networking.cognitiveServicesPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.openAiPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.aiServicesPrivateDnsZoneResourceId)), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[tryGet(parameters('aiFoundryConfiguration'), 'roleAssignments')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "lock": { + "value": "[parameters('lock')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "11906964530752207086" + } + }, + "definitions": { + "deploymentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of cognitive service account deployment." + } + }, + "model": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account deployment model." + } + }, + "format": { + "type": "string", + "metadata": { + "description": "Required. The format of Cognitive Services account deployment model." + } + }, + "version": { + "type": "string", + "metadata": { + "description": "Required. The version of Cognitive Services account deployment model." + } + } + }, + "metadata": { + "description": "Required. Properties of Cognitive Services account deployment model." + } + }, + "sku": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource model definition representing SKU." + } + }, + "capacity": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The capacity of the resource model definition representing SKU." + } + }, + "tier": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tier of the resource model definition representing SKU." + } + }, + "size": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The size of the resource model definition representing SKU." + } + }, + "family": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The family of the resource model definition representing SKU." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource model definition representing SKU." + } + }, + "raiPolicyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of RAI policy." + } + }, + "versionUpgradeOption": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version upgrade option." + } + } + }, + "metadata": { + "description": "The type for a cognitive services account deployment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the AI Foundry resource." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the AI Foundry resource." + } + }, + "sku": { + "type": "string", + "defaultValue": "S0", + "allowedValues": [ + "C2", + "C3", + "C4", + "F0", + "F1", + "S", + "S0", + "S1", + "S10", + "S2", + "S3", + "S4", + "S5", + "S6", + "S7", + "S8", + "S9", + "DC0" + ], + "metadata": { + "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region." + } + }, + "allowProjectManagement": { + "type": "bool", + "metadata": { + "description": "Required. Whether to allow project management in AI Foundry. This is required to enable the AI Foundry UI and project management features." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceIds' to establish private endpoints." + } + }, + "agentSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for agent connectivity. This is required when using agents with private endpoints." + } + }, + "disableLocalAuth": { + "type": "bool", + "metadata": { + "description": "Required. Allow only Azure AD authentication. Should be enabled for security reasons." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the AI Foundry resource." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of AI Foundry resources." + } + }, + "aiModelDeployments": { + "type": "array", + "items": { + "$ref": "#/definitions/deploymentType" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. Specifies the OpenAI deployments to create." + } + }, + "privateDnsZoneResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of private DNS zone resource IDs to use for the AI Foundry resource. This is required when using private endpoints." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneResourceIdValues", + "count": "[length(coalesce(parameters('privateDnsZoneResourceIds'), createArray()))]", + "input": { + "privateDnsZoneResourceId": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())[copyIndex('privateDnsZoneResourceIdValues')]]" + } + } + ], + "privateNetworkingEnabled": "[and(not(empty(variables('privateDnsZoneResourceIdValues'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "foundryAccount": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.cognitive-services.account.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "sku": { + "value": "[parameters('sku')]" + }, + "kind": { + "value": "AIServices" + }, + "lock": { + "value": "[parameters('lock')]" + }, + "allowProjectManagement": { + "value": "[parameters('allowProjectManagement')]" + }, + "managedIdentities": { + "value": { + "systemAssigned": true + } + }, + "deployments": { + "value": "[parameters('aiModelDeployments')]" + }, + "customSubDomainName": { + "value": "[parameters('name')]" + }, + "disableLocalAuth": { + "value": "[parameters('disableLocalAuth')]" + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "networkAcls": { + "value": { + "defaultAction": "Allow", + "bypass": "AzureServices" + } + }, + "networkInjections": "[if(and(variables('privateNetworkingEnabled'), not(empty(parameters('agentSubnetResourceId')))), createObject('value', createObject('scenario', 'agent', 'subnetResourceId', parameters('agentSubnetResourceId'), 'useMicrosoftManagedNetwork', false())), createObject('value', null()))]", + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', variables('privateDnsZoneResourceIdValues')), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9381727816193702843" + }, + "name": "Cognitive Services", + "description": "This module deploys a Cognitive Service." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoint output." + } + }, + "deploymentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of cognitive service account deployment." + } + }, + "model": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account deployment model." + } + }, + "format": { + "type": "string", + "metadata": { + "description": "Required. The format of Cognitive Services account deployment model." + } + }, + "version": { + "type": "string", + "metadata": { + "description": "Required. The version of Cognitive Services account deployment model." + } + } + }, + "metadata": { + "description": "Required. Properties of Cognitive Services account deployment model." + } + }, + "sku": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource model definition representing SKU." + } + }, + "capacity": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The capacity of the resource model definition representing SKU." + } + }, + "tier": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tier of the resource model definition representing SKU." + } + }, + "size": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The size of the resource model definition representing SKU." + } + }, + "family": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The family of the resource model definition representing SKU." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource model definition representing SKU." + } + }, + "raiPolicyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of RAI policy." + } + }, + "versionUpgradeOption": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version upgrade option." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cognitive services account deployment." + } + }, + "endpointType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Type of the endpoint." + } + }, + "endpoint": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The endpoint URI." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cognitive services account endpoint." + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the keys and connection strings generated by the modules." + } + }, + "accessKey1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name for the accessKey1 secret to create." + } + }, + "accessKey2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name for the accessKey2 secret to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of the secrets exported to the provided Key Vault." + } + }, + "commitmentPlanType": { + "type": "object", + "properties": { + "autoRenew": { + "type": "bool", + "metadata": { + "description": "Required. Whether the plan should auto-renew at the end of the current commitment period." + } + }, + "current": { + "type": "object", + "properties": { + "count": { + "type": "int", + "metadata": { + "description": "Required. The number of committed instances (e.g., number of containers or cores)." + } + }, + "tier": { + "type": "string", + "metadata": { + "description": "Required. The tier of the commitment plan (e.g., T1, T2)." + } + } + }, + "metadata": { + "description": "Required. The current commitment configuration." + } + }, + "hostingModel": { + "type": "string", + "metadata": { + "description": "Required. The hosting model for the commitment plan. (e.g., DisconnectedContainer, ConnectedContainer, ProvisionedWeb, Web)." + } + }, + "planType": { + "type": "string", + "metadata": { + "description": "Required. The plan type indicating which capability the plan applies to (e.g., NTTS, STT, CUSTOMSTT, ADDON)." + } + }, + "commitmentPlanGuid": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of an existing commitment plan to update. Set to null to create a new plan." + } + }, + "next": { + "type": "object", + "properties": { + "count": { + "type": "int", + "metadata": { + "description": "Required. The number of committed instances for the next period." + } + }, + "tier": { + "type": "string", + "metadata": { + "description": "Required. The tier for the next commitment period." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The configuration of the next commitment period, if scheduled." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a disconnected container commitment plan." + } + }, + "networkInjectionType": { + "type": "object", + "properties": { + "scenario": { + "type": "string", + "allowedValues": [ + "agent", + "none" + ], + "metadata": { + "description": "Required. The scenario for the network injection." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the subnet on the Virtual Network on which to inject." + } + }, + "useMicrosoftManagedNetwork": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether to use Microsoft Managed Network. Defaults to false." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." + } + }, + "_1.secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "_2.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "customerManagedKeyType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_2.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_2.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_2.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/_1.secretSetOutputType", + "metadata": { + "description": "An exported secret's references." + } + }, + "metadata": { + "description": "A map of the exported secrets", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "AIServices", + "AnomalyDetector", + "CognitiveServices", + "ComputerVision", + "ContentModerator", + "ContentSafety", + "ConversationalLanguageUnderstanding", + "CustomVision.Prediction", + "CustomVision.Training", + "Face", + "FormRecognizer", + "HealthInsights", + "ImmersiveReader", + "Internal.AllInOne", + "LUIS", + "LUIS.Authoring", + "LanguageAuthoring", + "MetricsAdvisor", + "OpenAI", + "Personalizer", + "QnAMaker.v2", + "SpeechServices", + "TextAnalytics", + "TextTranslation" + ], + "metadata": { + "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region." + } + }, + "sku": { + "type": "string", + "defaultValue": "S0", + "allowedValues": [ + "C2", + "C3", + "C4", + "F0", + "F1", + "S", + "S0", + "S1", + "S10", + "S2", + "S3", + "S4", + "S5", + "S6", + "S7", + "S8", + "S9", + "DC0" + ], + "metadata": { + "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "customSubDomainName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set." + } + }, + "networkAcls": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. A collection of rules governing the accessibility from specific network locations." + } + }, + "networkInjections": { + "$ref": "#/definitions/networkInjectionType", + "nullable": true, + "metadata": { + "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "allowedFqdnList": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. List of allowed FQDN." + } + }, + "apiProperties": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. The API properties for special APIs." + } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "dynamicThrottlingEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The flag to enable dynamic throttling." + } + }, + "migrationToken": { + "type": "securestring", + "nullable": true, + "metadata": { + "description": "Optional. Resource migration token." + } + }, + "restore": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists." + } + }, + "restrictOutboundNetworkAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Restrict outbound network access." + } + }, + "userOwnedStorage": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.CognitiveServices/accounts@2025-04-01-preview#properties/properties/properties/userOwnedStorage" + }, + "description": "Optional. The storage accounts for this resource." + }, + "nullable": true + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "deployments": { + "type": "array", + "items": { + "$ref": "#/definitions/deploymentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of deployments about cognitive service accounts to create." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "allowProjectManagement": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable project management feature for AI Foundry." + } + }, + "commitmentPlans": { + "type": "array", + "items": { + "$ref": "#/definitions/commitmentPlanType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Commitment plans to deploy for the cognitive services account." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]", + "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]", + "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]", + "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]", + "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]", + "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]", + "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]", + "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]", + "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]", + "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]", + "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]", + "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]", + "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]", + "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]", + "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]", + "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]", + "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]", + "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]", + "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]", + "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]", + "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]", + "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]", + "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]", + "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]", + "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]", + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.13.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2025-01-31-preview", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "cognitiveService": { + "type": "Microsoft.CognitiveServices/accounts", + "apiVersion": "2025-06-01", + "name": "[parameters('name')]", + "kind": "[parameters('kind')]", + "identity": "[variables('identity')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "[parameters('sku')]" + }, + "properties": { + "allowProjectManagement": "[parameters('allowProjectManagement')]", + "customSubDomainName": "[parameters('customSubDomainName')]", + "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]", + "networkInjections": "[if(not(empty(parameters('networkInjections'))), createArray(createObject('scenario', tryGet(parameters('networkInjections'), 'scenario'), 'subnetArmId', tryGet(parameters('networkInjections'), 'subnetResourceId'), 'useMicrosoftManagedNetwork', coalesce(tryGet(parameters('networkInjections'), 'useMicrosoftManagedNetwork'), false()))), null())]", + "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]", + "allowedFqdnList": "[parameters('allowedFqdnList')]", + "apiProperties": "[parameters('apiProperties')]", + "disableLocalAuth": "[parameters('disableLocalAuth')]", + "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]", + "migrationToken": "[parameters('migrationToken')]", + "restore": "[parameters('restore')]", + "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]", + "userOwnedStorage": "[if(not(empty(parameters('userOwnedStorage'))), parameters('userOwnedStorage'), null())]", + "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]" + }, + "dependsOn": [ + "cMKKeyVault", + "cMKKeyVault::cMKKey", + "cMKUserAssignedIdentity" + ] + }, + "cognitiveService_deployments": { + "copy": { + "name": "cognitiveService_deployments", + "count": "[length(coalesce(parameters('deployments'), createArray()))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.CognitiveServices/accounts/deployments", + "apiVersion": "2025-06-01", + "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]", + "properties": { + "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]", + "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]", + "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]" + }, + "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]", + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_commitmentPlans": { + "copy": { + "name": "cognitiveService_commitmentPlans", + "count": "[length(coalesce(parameters('commitmentPlans'), createArray()))]" + }, + "type": "Microsoft.CognitiveServices/accounts/commitmentPlans", + "apiVersion": "2025-06-01", + "name": "[format('{0}/{1}', parameters('name'), format('{0}-{1}', coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].hostingModel, coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].planType))]", + "properties": "[coalesce(parameters('commitmentPlans'), createArray())[copyIndex()]]", + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_diagnosticSettings": { + "copy": { + "name": "cognitiveService_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_roleAssignments": { + "copy": { + "name": "cognitiveService_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_privateEndpoints": { + "copy": { + "name": "cognitiveService_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-06-01').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-06-01').key2)), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10828079590669389085" + } + }, + "definitions": { + "secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the secret to set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetOutputType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]", + "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]" + } + } + } + } + } + }, + "dependsOn": [ + "cognitiveService" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the cognitive services account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the cognitive services account." + }, + "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the cognitive services account was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The service endpoint of the cognitive services account." + }, + "value": "[reference('cognitiveService').endpoint]" + }, + "endpoints": { + "$ref": "#/definitions/endpointType", + "metadata": { + "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind." + }, + "value": "[reference('cognitiveService').endpoints]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('cognitiveService', '2025-06-01', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('cognitiveService', '2025-06-01', 'full').location]" + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the congitive services account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the AI Foundry resource." + }, + "value": "[reference('foundryAccount').outputs.name.value]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the AI Foundry resource." + }, + "value": "[reference('foundryAccount').outputs.resourceId.value]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the AI Foundry resource." + }, + "value": "[subscription().subscriptionId]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the AI Foundry resource." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "Location of the AI Foundry resource." + }, + "value": "[parameters('location')]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "metadata": { + "description": "System assigned managed identity principal ID of the AI Foundry resource." + }, + "value": "[reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value]" + } + } + } + } + }, + "keyVault": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.keyVault.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('keyVaultConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(and(not(empty(parameters('keyVaultConfiguration'))), not(empty(tryGet(parameters('keyVaultConfiguration'), 'name')))), parameters('keyVaultConfiguration').name, format('kv{0}', variables('resourcesName'))), 24)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "privateDnsZoneResourceId": { + "value": "[tryGet(parameters('keyVaultConfiguration'), 'privateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('keyVaultConfiguration'), 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "9899473530932390252" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. The name of the Key Vault." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the Key Vault." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing Key Vault to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the Key Vault to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the Key Vault." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingKeyVault": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "keyVault": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.key-vault.vault.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "networkAcls": { + "value": { + "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]" + } + }, + "enableVaultForDeployment": { + "value": true + }, + "enableVaultForDiskEncryption": { + "value": true + }, + "enableVaultForTemplateDeployment": { + "value": true + }, + "enablePurgeProtection": { + "value": false + }, + "enableRbacAuthorization": { + "value": true + }, + "enableSoftDelete": { + "value": true + }, + "softDeleteRetentionInDays": { + "value": 7 + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'vault', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "8811577289487069918" + }, + "name": "Key Vaults", + "description": "This module deploys a Key Vault." + }, + "definitions": { + "networkAclsType": { + "type": "object", + "properties": { + "bypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. The bypass options for traffic for the network ACLs." + } + }, + "defaultAction": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "nullable": true, + "metadata": { + "description": "Optional. The default action for the network ACLs, when no rule matches." + } + }, + "ipRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "value": { + "type": "string", + "metadata": { + "description": "Required. An IPv4 address range in CIDR notation, such as \"124.56.78.91\" (simple IP address) or \"124.56.78.0/24\"." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP rules." + } + }, + "virtualNetworkRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the virtual network subnet." + } + }, + "ignoreMissingVnetServiceEndpoint": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether NRP will ignore the check if parent subnet has serviceEndpoints configured." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of virtual network rules." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for rules governing the accessibility of the key vault from specific network locations." + } + }, + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "credentialOutputType": { + "type": "object", + "properties": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The item's resourceId." + } + }, + "uri": { + "type": "string", + "metadata": { + "description": "The item's uri." + } + }, + "uriWithVersion": { + "type": "string", + "metadata": { + "description": "The item's uri with version." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a credential output." + } + }, + "accessPolicyType": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tenant ID that is used for authenticating requests to the key vault." + } + }, + "objectId": { + "type": "string", + "metadata": { + "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault." + } + }, + "applicationId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Application ID of the client making request on behalf of a principal." + } + }, + "permissions": { + "type": "object", + "properties": { + "keys": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "decrypt", + "delete", + "encrypt", + "get", + "getrotationpolicy", + "import", + "list", + "purge", + "recover", + "release", + "restore", + "rotate", + "setrotationpolicy", + "sign", + "unwrapKey", + "update", + "verify", + "wrapKey" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to keys." + } + }, + "secrets": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "get", + "list", + "purge", + "recover", + "restore", + "set" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to secrets." + } + }, + "certificates": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "delete", + "deleteissuers", + "get", + "getissuers", + "import", + "list", + "listissuers", + "managecontacts", + "manageissuers", + "purge", + "recover", + "restore", + "setissuers", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to certificates." + } + }, + "storage": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "deletesas", + "get", + "getsas", + "list", + "listsas", + "purge", + "recover", + "regeneratekey", + "restore", + "set", + "setsas", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to storage accounts." + } + } + }, + "metadata": { + "description": "Required. Permissions the identity has for keys, secrets and certificates." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an access policy." + } + }, + "secretType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Resource tags." + } + }, + "attributes": { + "type": "object", + "properties": { + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Defines whether the secret is enabled or disabled." + } + }, + "exp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z." + } + }, + "nbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Contains attributes of the secret." + } + }, + "contentType": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The content type of the secret." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a secret output." + } + }, + "keyType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the key." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Resource tags." + } + }, + "attributes": { + "type": "object", + "properties": { + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Defines whether the key is enabled or disabled." + } + }, + "exp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z." + } + }, + "nbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Contains attributes of the key." + } + }, + "curveName": { + "type": "string", + "allowedValues": [ + "P-256", + "P-256K", + "P-384", + "P-521" + ], + "nullable": true, + "metadata": { + "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"." + } + }, + "keyOps": { + "type": "array", + "allowedValues": [ + "decrypt", + "encrypt", + "import", + "release", + "sign", + "unwrapKey", + "verify", + "wrapKey" + ], + "nullable": true, + "metadata": { + "description": "Optional. The allowed operations on this key." + } + }, + "keySize": { + "type": "int", + "allowedValues": [ + 2048, + 3072, + 4096 + ], + "nullable": true, + "metadata": { + "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"." + } + }, + "kty": { + "type": "string", + "allowedValues": [ + "EC", + "EC-HSM", + "RSA", + "RSA-HSM" + ], + "nullable": true, + "metadata": { + "description": "Optional. The type of the key. Default is \"EC\"." + } + }, + "releasePolicy": { + "type": "object", + "properties": { + "contentType": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Content type and version of key release policy." + } + }, + "data": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Blob encoding the policy rules under which the key can be released." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Key release policy." + } + }, + "rotationPolicy": { + "$ref": "#/definitions/rotationPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Key rotation policy." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a key." + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "rotationPolicyType": { + "type": "object", + "properties": { + "attributes": { + "type": "object", + "properties": { + "expiryTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The attributes of key rotation policy." + } + }, + "lifetimeActions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "action": { + "type": "object", + "properties": { + "type": { + "type": "string", + "allowedValues": [ + "notify", + "rotate" + ], + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + }, + "trigger": { + "type": "object", + "properties": { + "timeAfterCreate": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + }, + "timeBeforeExpiry": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The time duration for rotating the key." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The key rotation policy lifetime actions." + } + } + }, + "metadata": { + "description": "The type for a rotation policy.", + "__bicep_imported_from!": { + "sourceTemplate": "key/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. Name of the Key Vault. Must be globally unique." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "accessPolicies": { + "type": "array", + "items": { + "$ref": "#/definitions/accessPolicyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All access policies to create." + } + }, + "secrets": { + "type": "array", + "items": { + "$ref": "#/definitions/secretType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All secrets to create." + } + }, + "keys": { + "type": "array", + "items": { + "$ref": "#/definitions/keyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All keys to create." + } + }, + "enableVaultForDeployment": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies if the vault is enabled for deployment by script or compute." + } + }, + "enableVaultForTemplateDeployment": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies if the vault is enabled for a template deployment." + } + }, + "enableVaultForDiskEncryption": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios." + } + }, + "enableSoftDelete": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Switch to enable/disable Key Vault's soft delete feature." + } + }, + "softDeleteRetentionInDays": { + "type": "int", + "defaultValue": 90, + "metadata": { + "description": "Optional. softDelete data retention days. It accepts >=7 and <=90." + } + }, + "enableRbacAuthorization": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC." + } + }, + "createMode": { + "type": "string", + "defaultValue": "default", + "allowedValues": [ + "default", + "recover" + ], + "metadata": { + "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not." + } + }, + "enablePurgeProtection": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature." + } + }, + "sku": { + "type": "string", + "defaultValue": "premium", + "allowedValues": [ + "premium", + "standard" + ], + "metadata": { + "description": "Optional. Specifies the SKU for the vault." + } + }, + "networkAcls": { + "$ref": "#/definitions/networkAclsType", + "nullable": true, + "metadata": { + "description": "Optional. Rules governing the accessibility of the resource from specific network locations." + } + }, + "publicNetworkAccess": { + "type": "string", + "defaultValue": "", + "allowedValues": [ + "", + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.KeyVault/vaults@2024-11-01#properties/tags" + }, + "description": "Optional. Resource tags." + }, + "nullable": true + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + }, + { + "name": "formattedAccessPolicies", + "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]", + "input": { + "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]", + "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]", + "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]", + "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]" + } + } + ], + "enableReferencedModulesTelemetry": false, + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]", + "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]", + "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]", + "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]", + "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]", + "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]", + "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]", + "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]", + "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]", + "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.13.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "enabledForDeployment": "[parameters('enableVaultForDeployment')]", + "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]", + "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]", + "enableSoftDelete": "[parameters('enableSoftDelete')]", + "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]", + "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]", + "createMode": "[parameters('createMode')]", + "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]", + "tenantId": "[subscription().tenantId]", + "accessPolicies": "[variables('formattedAccessPolicies')]", + "sku": { + "name": "[parameters('sku')]", + "family": "A" + }, + "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]", + "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]" + } + }, + "keyVault_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_diagnosticSettings": { + "copy": { + "name": "keyVault_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_roleAssignments": { + "copy": { + "name": "keyVault_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_accessPolicies": { + "condition": "[not(empty(parameters('accessPolicies')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[parameters('name')]" + }, + "accessPolicies": { + "value": "[parameters('accessPolicies')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "8803020983329720581" + }, + "name": "Key Vault Access Policies", + "description": "This module deploys a Key Vault Access Policy." + }, + "definitions": { + "accessPoliciesType": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tenant ID that is used for authenticating requests to the key vault." + } + }, + "objectId": { + "type": "string", + "metadata": { + "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault." + } + }, + "applicationId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Application ID of the client making request on behalf of a principal." + } + }, + "permissions": { + "type": "object", + "properties": { + "keys": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "decrypt", + "delete", + "encrypt", + "get", + "getrotationpolicy", + "import", + "list", + "purge", + "recover", + "release", + "restore", + "rotate", + "setrotationpolicy", + "sign", + "unwrapKey", + "update", + "verify", + "wrapKey" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to keys." + } + }, + "secrets": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "get", + "list", + "purge", + "recover", + "restore", + "set" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to secrets." + } + }, + "certificates": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "delete", + "deleteissuers", + "get", + "getissuers", + "import", + "list", + "listissuers", + "managecontacts", + "manageissuers", + "purge", + "recover", + "restore", + "setissuers", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to certificates." + } + }, + "storage": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "deletesas", + "get", + "getsas", + "list", + "listsas", + "purge", + "recover", + "regeneratekey", + "restore", + "set", + "setsas", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to storage accounts." + } + } + }, + "metadata": { + "description": "Required. Permissions the identity has for keys, secrets and certificates." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an access policy." + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment." + } + }, + "accessPolicies": { + "type": "array", + "items": { + "$ref": "#/definitions/accessPoliciesType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-accesspolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "policies": { + "type": "Microsoft.KeyVault/vaults/accessPolicies", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]", + "properties": { + "copy": [ + { + "name": "accessPolicies", + "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]", + "input": { + "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'applicationId'), '')]", + "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].objectId]", + "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].permissions]", + "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'tenantId'), tenant().tenantId)]" + } + } + ] + } + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the access policies assignment was created in." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the access policies assignment." + }, + "value": "add" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the access policies assignment." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_secrets": { + "copy": { + "name": "keyVault_secrets", + "count": "[length(coalesce(parameters('secrets'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]" + }, + "value": { + "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]" + }, + "keyVaultName": { + "value": "[parameters('name')]" + }, + "attributesEnabled": { + "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'enabled')]" + }, + "attributesExp": { + "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'exp')]" + }, + "attributesNbf": { + "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'nbf')]" + }, + "contentType": { + "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "8701309639990049090" + }, + "name": "Key Vault Secrets", + "description": "This module deploys a Key Vault Secret." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "minLength": 1, + "maxLength": 127, + "metadata": { + "description": "Required. The name of the secret (letters (upper and lower case), numbers, -)." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.KeyVault/vaults/secrets@2024-11-01#properties/tags" + }, + "description": "Optional. Resource tags." + }, + "nullable": true + }, + "attributesEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Determines whether the object is enabled." + } + }, + "attributesExp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible." + } + }, + "attributesNbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z." + } + }, + "contentType": { + "type": "securestring", + "nullable": true, + "metadata": { + "description": "Optional. The content type of the secret." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]", + "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]", + "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]", + "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]", + "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-secret.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secret": { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "contentType": "[parameters('contentType')]", + "attributes": { + "enabled": "[parameters('attributesEnabled')]", + "exp": "[parameters('attributesExp')]", + "nbf": "[parameters('attributesNbf')]" + }, + "value": "[parameters('value')]" + } + }, + "secret_roleAssignments": { + "copy": { + "name": "secret_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "secret" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the secret." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the secret." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]" + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The uri of the secret." + }, + "value": "[reference('secret').secretUri]" + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The uri with version of the secret." + }, + "value": "[reference('secret').secretUriWithVersion]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the secret was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_keys": { + "copy": { + "name": "keyVault_keys", + "count": "[length(coalesce(parameters('keys'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]" + }, + "keyVaultName": { + "value": "[parameters('name')]" + }, + "attributesEnabled": { + "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'enabled')]" + }, + "attributesExp": { + "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'exp')]" + }, + "attributesNbf": { + "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'nbf')]" + }, + "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]", + "keyOps": { + "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]" + }, + "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]", + "releasePolicy": { + "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]" + }, + "kty": { + "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "rotationPolicy": { + "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1266219369073699726" + }, + "name": "Key Vault Keys", + "description": "This module deploys a Key Vault Key." + }, + "definitions": { + "rotationPolicyType": { + "type": "object", + "properties": { + "attributes": { + "type": "object", + "properties": { + "expiryTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The attributes of key rotation policy." + } + }, + "lifetimeActions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "action": { + "type": "object", + "properties": { + "type": { + "type": "string", + "allowedValues": [ + "notify", + "rotate" + ], + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + }, + "trigger": { + "type": "object", + "properties": { + "timeAfterCreate": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + }, + "timeBeforeExpiry": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The time duration for rotating the key." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The key rotation policy lifetime actions." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a rotation policy." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the key." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.KeyVault/vaults/keys@2024-11-01#properties/tags" + }, + "description": "Optional. Resource tags." + }, + "nullable": true + }, + "attributesEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Determines whether the object is enabled." + } + }, + "attributesExp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible." + } + }, + "attributesNbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z." + } + }, + "curveName": { + "type": "string", + "defaultValue": "P-256", + "allowedValues": [ + "P-256", + "P-256K", + "P-384", + "P-521" + ], + "metadata": { + "description": "Optional. The elliptic curve name." + } + }, + "keyOps": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "allowedValues": [ + "decrypt", + "encrypt", + "import", + "sign", + "unwrapKey", + "verify", + "wrapKey" + ], + "metadata": { + "description": "Optional. Array of JsonWebKeyOperation." + } + }, + "keySize": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA." + } + }, + "kty": { + "type": "string", + "defaultValue": "EC", + "allowedValues": [ + "EC", + "EC-HSM", + "RSA", + "RSA-HSM" + ], + "metadata": { + "description": "Optional. The type of the key." + } + }, + "releasePolicy": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Key release policy." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "rotationPolicy": { + "$ref": "#/definitions/rotationPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Key rotation policy properties object." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]", + "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]", + "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]", + "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]", + "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]", + "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-key.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "key": { + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": "[shallowMerge(createArray(createObject('attributes', createObject('enabled', parameters('attributesEnabled'), 'exp', parameters('attributesExp'), 'nbf', parameters('attributesNbf')), 'curveName', parameters('curveName'), 'keyOps', parameters('keyOps'), 'keySize', parameters('keySize'), 'kty', parameters('kty'), 'release_policy', coalesce(parameters('releasePolicy'), createObject())), if(not(empty(parameters('rotationPolicy'))), createObject('rotationPolicy', parameters('rotationPolicy')), createObject())))]" + }, + "key_roleAssignments": { + "copy": { + "name": "key_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "key" + ] + } + }, + "outputs": { + "keyUri": { + "type": "string", + "metadata": { + "description": "The uri of the key." + }, + "value": "[reference('key').keyUri]" + }, + "keyUriWithVersion": { + "type": "string", + "metadata": { + "description": "The uri with version of the key." + }, + "value": "[reference('key').keyUriWithVersion]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the key." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the key." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the key was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_privateEndpoints": { + "copy": { + "name": "keyVault_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the key vault." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the key vault was created in." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the key vault." + }, + "value": "[parameters('name')]" + }, + "uri": { + "type": "string", + "metadata": { + "description": "The URI of the key vault." + }, + "value": "[reference('keyVault').vaultUri]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('keyVault', '2024-11-01', 'full').location]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the key vault." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "secrets": { + "type": "array", + "items": { + "$ref": "#/definitions/credentialOutputType" + }, + "metadata": { + "description": "The properties of the created secrets." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secrets'), createArray()))))]", + "input": { + "resourceId": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.resourceId.value]", + "uri": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUri.value]", + "uriWithVersion": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUriWithVersion.value]" + } + } + }, + "keys": { + "type": "array", + "items": { + "$ref": "#/definitions/credentialOutputType" + }, + "metadata": { + "description": "The properties of the created keys." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('keys'), createArray()))))]", + "input": { + "resourceId": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.resourceId.value]", + "uri": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUri.value]", + "uriWithVersion": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUriWithVersion.value]" + } + } + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.KeyVault/vaults', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + } + } + } + } + }, + "aiSearch": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.aiSearch.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(not(empty(tryGet(parameters('aiSearchConfiguration'), 'name'))), parameters('aiSearchConfiguration').name, format('srch{0}', variables('resourcesName'))), 60)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "privateDnsZoneResourceId": { + "value": "[tryGet(parameters('aiSearchConfiguration'), 'privateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('aiSearchConfiguration'), 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "2804046174313565921" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 60, + "metadata": { + "description": "Required. The name of the AI Search resource." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the AI Search resource." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing AI Search resource to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the AI Search resource to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the AI Search resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingSearchService": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-05-01", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "aiSearch": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.search.search-service.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "cmkEnforcement": { + "value": "Unspecified" + }, + "managedIdentities": { + "value": { + "systemAssigned": true + } + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "disableLocalAuth": { + "value": "[variables('privateNetworkingEnabled')]" + }, + "authOptions": "[if(variables('privateNetworkingEnabled'), createObject('value', null()), createObject('value', createObject('aadOrApiKey', createObject('aadAuthFailureMode', 'http401WithBearerChallenge'))))]", + "sku": { + "value": "standard" + }, + "partitionCount": { + "value": 1 + }, + "replicaCount": { + "value": 3 + }, + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10902281417196168235" + }, + "name": "Search Services", + "description": "This module deploys a Search Service." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the API Admin keys generated by the modules." + } + }, + "primaryAdminKeyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The primaryAdminKey secret name to create." + } + }, + "secondaryAdminKeyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The secondaryAdminKey secret name to create." + } + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/secretSetType", + "metadata": { + "description": "An exported secret's references." + } + } + }, + "authOptionsType": { + "type": "object", + "properties": { + "aadOrApiKey": { + "type": "object", + "properties": { + "aadAuthFailureMode": { + "type": "string", + "allowedValues": [ + "http401WithBearerChallenge", + "http403" + ], + "nullable": true, + "metadata": { + "description": "Optional. Describes what response the data plane API of a search service would send for requests that failed authentication." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Indicates that either the API key or an access token from a Microsoft Entra ID tenant can be used for authentication." + } + }, + "apiKeyOnly": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Indicates that only the API key can be used for authentication." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "networkRuleSetType": { + "type": "object", + "properties": { + "bypass": { + "type": "string", + "allowedValues": [ + "AzurePortal", + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Network specific rules that determine how the Azure AI Search service may be reached." + } + }, + "ipRules": { + "type": "array", + "items": { + "$ref": "#/definitions/ipRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP restriction rules that defines the inbound network(s) with allowing access to the search service endpoint. At the meantime, all other public IP networks are blocked by the firewall. These restriction rules are applied only when the 'publicNetworkAccess' of the search service is 'enabled'; otherwise, traffic over public interface is not allowed even with any public IP rules, and private endpoint connections would be the exclusive access method." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipRuleType": { + "type": "object", + "properties": { + "value": { + "type": "string", + "metadata": { + "description": "Required. Value corresponding to a single IPv4 address (eg., 123.1.2.3) or an IP range in CIDR format (eg., 123.1.2.3/24) to be allowed." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "_1.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_1.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "secretSetType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "modules/keyVaultExport.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Azure Cognitive Search service to create or update. Search service names must only contain lowercase letters, digits or dashes, cannot use dash as the first two or last one characters, cannot contain consecutive dashes, and must be between 2 and 60 characters in length. Search service names must be globally unique since they are part of the service URI (https://.search.windows.net). You cannot change the service name after the service is created." + } + }, + "authOptions": { + "$ref": "#/definitions/authOptionsType", + "nullable": true, + "metadata": { + "description": "Optional. Defines the options for how the data plane API of a Search service authenticates requests. Must remain an empty object {} if 'disableLocalAuth' is set to true." + } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. When set to true, calls to the search service will not be permitted to utilize API keys for authentication. This cannot be set to true if 'authOptions' are defined." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "cmkEnforcement": { + "type": "string", + "defaultValue": "Unspecified", + "allowedValues": [ + "Disabled", + "Enabled", + "Unspecified" + ], + "metadata": { + "description": "Optional. Describes a policy that determines how resources within the search service are to be encrypted with Customer Managed Keys." + } + }, + "hostingMode": { + "type": "string", + "defaultValue": "default", + "allowedValues": [ + "default", + "highDensity" + ], + "metadata": { + "description": "Optional. Applicable only for the standard3 SKU. You can set this property to enable up to 3 high density partitions that allow up to 1000 indexes, which is much higher than the maximum indexes allowed for any other SKU. For the standard3 SKU, the value is either 'default' or 'highDensity'. For all other SKUs, this value must be 'default'." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings for all Resources in the solution." + } + }, + "networkRuleSet": { + "$ref": "#/definitions/networkRuleSetType", + "nullable": true, + "metadata": { + "description": "Optional. Network specific rules that determine how the Azure Cognitive Search service may be reached." + } + }, + "partitionCount": { + "type": "int", + "defaultValue": 1, + "minValue": 1, + "maxValue": 12, + "metadata": { + "description": "Optional. The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "sharedPrivateLinkResources": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. The sharedPrivateLinkResources to create as part of the search Service." + } + }, + "publicNetworkAccess": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "replicaCount": { + "type": "int", + "defaultValue": 3, + "minValue": 1, + "maxValue": 12, + "metadata": { + "description": "Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "semanticSearch": { + "type": "string", + "nullable": true, + "allowedValues": [ + "disabled", + "free", + "standard" + ], + "metadata": { + "description": "Optional. Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations." + } + }, + "sku": { + "type": "string", + "defaultValue": "standard", + "allowedValues": [ + "basic", + "free", + "standard", + "standard2", + "standard3", + "storage_optimized_l1", + "storage_optimized_l2" + ], + "metadata": { + "description": "Optional. Defines the SKU of an Azure Cognitive Search Service, which determines price tier and capacity limits." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Search/searchServices@2025-02-01-preview#properties/tags" + }, + "description": "Optional. Tags to help categorize the resource in the Azure portal." + }, + "nullable": true + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', '')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Search Index Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]", + "Search Index Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]", + "Search Service Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "searchService": { + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-02-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "sku": { + "name": "[parameters('sku')]" + }, + "tags": "[parameters('tags')]", + "identity": "[variables('identity')]", + "properties": { + "authOptions": "[parameters('authOptions')]", + "disableLocalAuth": "[parameters('disableLocalAuth')]", + "encryptionWithCmk": { + "enforcement": "[parameters('cmkEnforcement')]" + }, + "hostingMode": "[parameters('hostingMode')]", + "networkRuleSet": "[parameters('networkRuleSet')]", + "partitionCount": "[parameters('partitionCount')]", + "replicaCount": "[parameters('replicaCount')]", + "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]", + "semanticSearch": "[parameters('semanticSearch')]" + } + }, + "searchService_diagnosticSettings": { + "copy": { + "name": "searchService_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_roleAssignments": { + "copy": { + "name": "searchService_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Search/searchServices', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_privateEndpoints": { + "copy": { + "name": "searchService_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-searchService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_sharedPrivateLinkResources": { + "copy": { + "name": "searchService_sharedPrivateLinkResources", + "count": "[length(parameters('sharedPrivateLinkResources'))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-searchService-SharedPrvLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]" + }, + "searchServiceName": { + "value": "[parameters('name')]" + }, + "privateLinkResourceId": { + "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].privateLinkResourceId]" + }, + "groupId": { + "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].groupId]" + }, + "requestMessage": { + "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].requestMessage]" + }, + "resourceRegion": { + "value": "[tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'resourceRegion')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "557730297583881254" + }, + "name": "Search Services Private Link Resources", + "description": "This module deploys a Search Service Private Link Resource." + }, + "parameters": { + "searchServiceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent searchServices. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the shared private link resource managed by the Azure Cognitive Search service within the specified resource group." + } + }, + "privateLinkResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the resource the shared private link resource is for." + } + }, + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The group ID from the provider of resource the shared private link resource is for." + } + }, + "requestMessage": { + "type": "string", + "metadata": { + "description": "Required. The request message for requesting approval of the shared private link resource." + } + }, + "resourceRegion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Can be used to specify the Azure Resource Manager location of the resource to which a shared private link is to be created. This is only required for those resources whose DNS configuration are regional (such as Azure Kubernetes Service)." + } + } + }, + "resources": { + "searchService": { + "existing": true, + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-02-01-preview", + "name": "[parameters('searchServiceName')]" + }, + "sharedPrivateLinkResource": { + "type": "Microsoft.Search/searchServices/sharedPrivateLinkResources", + "apiVersion": "2025-02-01-preview", + "name": "[format('{0}/{1}', parameters('searchServiceName'), parameters('name'))]", + "properties": { + "privateLinkResourceId": "[parameters('privateLinkResourceId')]", + "groupId": "[parameters('groupId')]", + "requestMessage": "[parameters('requestMessage')]", + "resourceRegion": "[parameters('resourceRegion')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the shared private link resource." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the shared private link resource." + }, + "value": "[resourceId('Microsoft.Search/searchServices/sharedPrivateLinkResources', parameters('searchServiceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the shared private link resource was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "searchService" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').primaryKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').secondaryKey)), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "7634110751636246703" + } + }, + "definitions": { + "secretSetType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]" + } + } + } + } + } + }, + "dependsOn": [ + "searchService" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the search service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the search service." + }, + "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the search service was created in." + }, + "value": "[resourceGroup().name]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('searchService', '2025-02-01-preview', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('searchService', '2025-02-01-preview', 'full').location]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The endpoint of the search service." + }, + "value": "[reference('searchService').endpoint]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the search service." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "primaryKey": { + "type": "securestring", + "metadata": { + "description": "The primary admin API key of the search service." + }, + "value": "[listAdminKeys('searchService', '2025-02-01-preview').primaryKey]" + }, + "secondaryKey": { + "type": "securestring", + "metadata": { + "description": "The secondaryKey admin API key of the search service." + }, + "value": "[listAdminKeys('searchService', '2025-02-01-preview').secondaryKey]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Search/searchServices', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "System assigned managed identity principal ID of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, '')]" + } + } + } + } + }, + "storageAccount": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.storageAccount.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('storageAccountConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(not(empty(tryGet(parameters('storageAccountConfiguration'), 'name'))), parameters('storageAccountConfiguration').name, format('st{0}', variables('resourcesName'))), 24)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "blobPrivateDnsZoneResourceId": { + "value": "[tryGet(parameters('storageAccountConfiguration'), 'blobPrivateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[concat(if(and(not(empty(parameters('storageAccountConfiguration'))), not(empty(tryGet(parameters('storageAccountConfiguration'), 'roleAssignments')))), parameters('storageAccountConfiguration').roleAssignments, createArray()), createArray(createObject('principalId', reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), if(empty(tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')), createArray(createObject('principalId', reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "10412454114821386555" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. The name of the storage account." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the storage account." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing storage account to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'blobPrivateDnsZoneResourceId' to establish private endpoints." + } + }, + "blobPrivateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the storage account blob service to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the storage account." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('blobPrivateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingStorageAccount": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "storageAccount": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.storage.storage-account.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "accessTier": { + "value": "Hot" + }, + "allowBlobPublicAccess": { + "value": "[not(variables('privateNetworkingEnabled'))]" + }, + "allowSharedKeyAccess": { + "value": false + }, + "allowCrossTenantReplication": { + "value": false + }, + "blobServices": { + "value": { + "deleteRetentionPolicyEnabled": true, + "deleteRetentionPolicyDays": 7, + "containerDeleteRetentionPolicyEnabled": true, + "containerDeleteRetentionPolicyDays": 7 + } + }, + "minimumTlsVersion": { + "value": "TLS1_2" + }, + "networkAcls": { + "value": { + "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]", + "bypass": "AzureServices" + } + }, + "supportsHttpsTrafficOnly": { + "value": true + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('blobPrivateDnsZoneResourceId')))), 'service', 'blob', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3530476863855541150" + }, + "name": "Storage Accounts", + "description": "This module deploys a Storage Account." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoints output." + } + }, + "networkAclsType": { + "type": "object", + "properties": { + "resourceAccessRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "metadata": { + "description": "Required. The ID of the tenant in which the resource resides in." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only." + } + }, + "bypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "AzureServices, Logging", + "AzureServices, Logging, Metrics", + "AzureServices, Metrics", + "Logging", + "Logging, Metrics", + "Metrics", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics." + } + }, + "virtualNetworkRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the virtual network rules." + } + }, + "ipRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the IP ACL rules." + } + }, + "defaultAction": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the default action of allow or deny when no other rules match." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network configuration." + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the keys and connection strings generated by the modules." + } + }, + "accessKey1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey1 secret name to create." + } + }, + "connectionString1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString1 secret name to create." + } + }, + "accessKey2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey2 secret name to create." + } + }, + "connectionString2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString2 secret name to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of the exported secrets." + } + }, + "localUserType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a local user." + } + }, + "blobServiceType": { + "type": "object", + "properties": { + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a blob service." + } + }, + "_1.immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/container/main.bicep" + } + } + }, + "_2.secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "_3.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/_1.immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "description": "The type of a storage container.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "description": "The type for a cors rule.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "customerManagedKeyWithAutoRotateType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting." + } + }, + "autoRotationEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingMetricsOnlyType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of diagnostic setting." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_3.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/_2.secretSetOutputType", + "metadata": { + "description": "An exported secret's references." + } + }, + "metadata": { + "description": "A map of the exported secrets", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. Name of the Storage Account. Must be lower-case." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "kind": { + "type": "string", + "defaultValue": "StorageV2", + "allowedValues": [ + "Storage", + "StorageV2", + "BlobStorage", + "FileStorage", + "BlockBlobStorage" + ], + "metadata": { + "description": "Optional. Type of Storage Account to create." + } + }, + "skuName": { + "type": "string", + "defaultValue": "Standard_GRS", + "allowedValues": [ + "Standard_LRS", + "Standard_ZRS", + "Standard_GRS", + "Standard_GZRS", + "Standard_RAGRS", + "Standard_RAGZRS", + "StandardV2_LRS", + "StandardV2_ZRS", + "StandardV2_GRS", + "StandardV2_GZRS", + "Premium_LRS", + "Premium_ZRS", + "PremiumV2_LRS", + "PremiumV2_ZRS" + ], + "metadata": { + "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "Hot", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "Cold" + ], + "metadata": { + "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type." + } + }, + "largeFileSharesState": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)." + } + }, + "azureFilesIdentityBasedAuthentication": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication" + }, + "description": "Optional. Provides the identity based authentication settings for Azure Files." + }, + "nullable": true + }, + "defaultToOAuthAuthentication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not." + } + }, + "allowSharedKeyAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "managementPolicyRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The Storage Account ManagementPolicies Rules." + } + }, + "networkAcls": { + "$ref": "#/definitions/networkAclsType", + "nullable": true, + "metadata": { + "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny." + } + }, + "requireInfrastructureEncryption": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true." + } + }, + "allowCrossTenantReplication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Allow or disallow cross AAD tenant object replication." + } + }, + "customDomainName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source." + } + }, + "customDomainUseSubDomainName": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates." + } + }, + "dnsEndpointType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AzureDnsZone", + "Standard" + ], + "metadata": { + "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier." + } + }, + "blobServices": { + "$ref": "#/definitions/blobServiceType", + "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]", + "metadata": { + "description": "Optional. Blob service and containers to deploy." + } + }, + "fileServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. File service and shares to deploy." + } + }, + "queueServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Queue service and queues to create." + } + }, + "tableServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Table service and tables to create." + } + }, + "allowBlobPublicAccess": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2" + ], + "metadata": { + "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore." + } + }, + "enableHierarchicalNamespace": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true." + } + }, + "enableSftp": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "localUsers": { + "type": "array", + "items": { + "$ref": "#/definitions/localUserType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Local users to deploy for SFTP authentication." + } + }, + "isLocalUserEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables local users feature, if set to true." + } + }, + "enableNfsV3": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingMetricsOnlyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "allowedCopyScope": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AAD", + "PrivateLink" + ], + "metadata": { + "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "supportsHttpsTrafficOnly": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Allows HTTPS traffic only to storage service if sets to true." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyWithAutoRotateType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "sasExpirationPeriod": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The SAS expiration period. DD.HH:MM:SS." + } + }, + "sasExpirationAction": { + "type": "string", + "defaultValue": "Log", + "allowedValues": [ + "Block", + "Log" + ], + "metadata": { + "description": "Optional. The SAS expiration action. Allowed values are Block and Log." + } + }, + "keyType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Account", + "Service" + ], + "metadata": { + "description": "Optional. The keyType to use with Queue & Table services." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "immutableStorageWithVersioning": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning" + }, + "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts." + }, + "nullable": true + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]", + "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]", + "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "storageAccount": { + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "[parameters('kind')]", + "sku": { + "name": "[parameters('skuName')]" + }, + "identity": "[variables('identity')]", + "tags": "[parameters('tags')]", + "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]", + "dependsOn": [ + "cMKKeyVault", + "cMKKeyVault::cMKKey" + ] + }, + "storageAccount_diagnosticSettings": { + "copy": { + "name": "storageAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_roleAssignments": { + "copy": { + "name": "storageAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_privateEndpoints": { + "copy": { + "name": "storageAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_managementPolicies": { + "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "rules": { + "value": "[parameters('managementPolicyRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14529265638306912023" + }, + "name": "Storage Account Management Policies", + "description": "This module deploys a Storage Account Management Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "rules": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules" + }, + "description": "Required. The Storage Account ManagementPolicies Rules." + } + } + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/managementPolicies", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]", + "properties": { + "policy": { + "rules": "[parameters('rules')]" + } + } + } + ], + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed management policy." + }, + "value": "default" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed management policy." + }, + "value": "default" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed management policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount", + "storageAccount_blobServices" + ] + }, + "storageAccount_localUsers": { + "copy": { + "name": "storageAccount_localUsers", + "count": "[length(coalesce(parameters('localUsers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]" + }, + "hasSshKey": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]" + }, + "hasSshPassword": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]" + }, + "permissionScopes": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]" + }, + "hasSharedKey": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]" + }, + "homeDirectory": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]" + }, + "sshAuthorizedKeys": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3261275799710495788" + }, + "name": "Storage Account Local Users", + "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication." + }, + "definitions": { + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "localUsers": { + "type": "Microsoft.Storage/storageAccounts/localUsers", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "hasSharedKey": "[parameters('hasSharedKey')]", + "hasSshKey": "[parameters('hasSshKey')]", + "hasSshPassword": "[parameters('hasSshPassword')]", + "homeDirectory": "[parameters('homeDirectory')]", + "permissionScopes": "[parameters('permissionScopes')]", + "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed local user." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed local user." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed local user." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_blobServices": { + "condition": "[not(empty(parameters('blobServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "containers": { + "value": "[tryGet(parameters('blobServices'), 'containers')]" + }, + "automaticSnapshotPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]" + }, + "changeFeedEnabled": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]" + }, + "changeFeedRetentionInDays": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]" + }, + "containerDeleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]" + }, + "containerDeleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]" + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]" + }, + "corsRules": { + "value": "[tryGet(parameters('blobServices'), 'corsRules')]" + }, + "defaultServiceVersion": { + "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]" + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]" + }, + "deleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]" + }, + "deleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]" + }, + "isVersioningEnabled": { + "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]" + }, + "lastAccessTimeTrackingPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]" + }, + "restorePolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]" + }, + "restorePolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9925173705553594819" + }, + "name": "Storage Account blob Services", + "description": "This module deploys a Storage Account Blob Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a storage container." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "container/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false, + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "blobServices": { + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]", + "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]", + "containerDeleteRetentionPolicy": { + "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]", + "days": "[parameters('containerDeleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]" + }, + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "defaultServiceVersion": "[parameters('defaultServiceVersion')]", + "deleteRetentionPolicy": { + "enabled": "[parameters('deleteRetentionPolicyEnabled')]", + "days": "[parameters('deleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]" + }, + "isVersioningEnabled": "[parameters('isVersioningEnabled')]", + "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]", + "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "blobServices_diagnosticSettings": { + "copy": { + "name": "blobServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "blobServices" + ] + }, + "blobServices_container": { + "copy": { + "name": "blobServices_container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "blobServiceName": { + "value": "[variables('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "defaultEncryptionScope": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]" + }, + "denyEncryptionScopeOverride": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]" + }, + "enableNfsV3AllSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]" + }, + "enableNfsV3RootSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]" + }, + "immutableStorageWithVersioningEnabled": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]" + }, + "publicAccess": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "immutabilityPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "5026123498979497429" + }, + "name": "Storage Account Blob Containers", + "description": "This module deploys a Storage Account Blob Container." + }, + "definitions": { + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an immutability policy." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "blobServiceName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "defaultValue": {} + }, + "publicAccess": { + "type": "string", + "defaultValue": "None", + "allowedValues": [ + "Container", + "Blob", + "None" + ], + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::blobServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "container": { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "properties": { + "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]", + "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]", + "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]", + "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]", + "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]", + "metadata": "[parameters('metadata')]", + "publicAccess": "[parameters('publicAccess')]" + } + }, + "container_roleAssignments": { + "copy": { + "name": "container_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "container" + ] + }, + "container_immutabilityPolicy": { + "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "containerName": { + "value": "[parameters('name')]" + }, + "immutabilityPeriodSinceCreationInDays": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]" + }, + "allowProtectedAppendWrites": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]" + }, + "allowProtectedAppendWritesAll": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10782942397325758470" + }, + "name": "Storage Account Blob Container Immutability Policies", + "description": "This module deploys a Storage Account Blob Container Immutability Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "containerName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment." + } + }, + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "defaultValue": 365, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "variables": { + "name": "default" + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]", + "properties": { + "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]", + "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]", + "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed immutability policy." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed immutability policy." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed immutability policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "container" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed container." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed container." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "blobServices" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed blob service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_fileServices": { + "condition": "[not(empty(parameters('fileServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]" + }, + "protocolSettings": { + "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]" + }, + "shareDeleteRetentionPolicy": { + "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]" + }, + "shares": { + "value": "[tryGet(parameters('fileServices'), 'shares')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "2735186993322606805" + }, + "name": "Storage Account File Share Services", + "description": "This module deploys a Storage Account File Share Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the file service." + } + }, + "protocolSettings": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings" + }, + "description": "Optional. Protocol settings for file service." + }, + "defaultValue": {} + }, + "shareDeleteRetentionPolicy": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy" + }, + "description": "Optional. The service properties for soft delete." + }, + "defaultValue": { + "enabled": true, + "days": 7 + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "shares": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. File shares to create." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileServices": { + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "protocolSettings": "[parameters('protocolSettings')]", + "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]" + } + }, + "fileServices_diagnosticSettings": { + "copy": { + "name": "fileServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "fileServices" + ] + }, + "fileServices_shares": { + "copy": { + "name": "fileServices_shares", + "count": "[length(coalesce(parameters('shares'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "fileServicesName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]" + }, + "accessTier": { + "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]" + }, + "enabledProtocols": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]" + }, + "rootSquash": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]" + }, + "shareQuota": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15881640847294537074" + }, + "name": "Storage Account File Shares", + "description": "This module deploys a Storage Account File Share." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "fileServicesName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the file share to create." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "TransactionOptimized", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "TransactionOptimized" + ], + "metadata": { + "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool." + } + }, + "shareQuota": { + "type": "int", + "defaultValue": 5120, + "metadata": { + "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)." + } + }, + "enabledProtocols": { + "type": "string", + "defaultValue": "SMB", + "allowedValues": [ + "NFS", + "SMB" + ], + "metadata": { + "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share." + } + }, + "rootSquash": { + "type": "string", + "defaultValue": "NoRootSquash", + "allowedValues": [ + "AllSquash", + "NoRootSquash", + "RootSquash" + ], + "metadata": { + "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::fileService": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileShare": { + "type": "Microsoft.Storage/storageAccounts/fileServices/shares", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]", + "properties": { + "accessTier": "[parameters('accessTier')]", + "shareQuota": "[parameters('shareQuota')]", + "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]", + "enabledProtocols": "[parameters('enabledProtocols')]" + } + }, + "fileShare_roleAssignments": { + "copy": { + "name": "fileShare_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "scope": { + "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]" + }, + "name": { + "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]" + }, + "roleDefinitionId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "principalType": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]" + }, + "condition": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]" + }, + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]", + "delegatedManagedIdentityResourceId": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "description": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "scope": { + "type": "string", + "metadata": { + "description": "Required. The scope to deploy the role assignment to." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The role definition Id to assign." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User", + "" + ], + "defaultValue": "", + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"" + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "defaultValue": "2.0", + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[parameters('scope')]", + "name": "[parameters('name')]", + "properties": { + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "principalId": "[parameters('principalId')]", + "description": "[parameters('description')]", + "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]", + "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]", + "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]", + "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]" + } + } + ] + } + }, + "dependsOn": [ + "fileShare" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "fileServices", + "storageAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_queueServices": { + "condition": "[not(empty(parameters('queueServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]" + }, + "queues": { + "value": "[tryGet(parameters('queueServices'), 'queues')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1100093319443502715" + }, + "name": "Storage Account Queue Services", + "description": "This module deploys a Storage Account Queue Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "queues": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Queues to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queueServices": { + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "queueServices_diagnosticSettings": { + "copy": { + "name": "queueServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "queueServices" + ] + }, + "queueServices_queues": { + "copy": { + "name": "queueServices_queues", + "count": "[length(coalesce(parameters('queues'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "name": { + "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17963799770990303971" + }, + "name": "Storage Account Queues", + "description": "This module deploys a Storage Account Queue." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage queue to deploy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair that represents queue metadata." + }, + "defaultValue": {} + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::queueServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queue": { + "type": "Microsoft.Storage/storageAccounts/queueServices/queues", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "properties": { + "metadata": "[parameters('metadata')]" + } + }, + "queue_roleAssignments": { + "copy": { + "name": "queue_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "queue" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed queue." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed queue." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed queue." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_tableServices": { + "condition": "[not(empty(parameters('tableServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]" + }, + "tables": { + "value": "[tryGet(parameters('tableServices'), 'tables')]" + }, + "corsRules": { + "value": "[tryGet(parameters('tableServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "13069389074590786512" + }, + "name": "Storage Account Table Services", + "description": "This module deploys a Storage Account Table Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "tables": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. tables to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "tableServices": { + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "tableServices_diagnosticSettings": { + "copy": { + "name": "tableServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "tableServices" + ] + }, + "tableServices_tables": { + "copy": { + "name": "tableServices_tables", + "count": "[length(parameters('tables'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('tables')[copyIndex()].name]" + }, + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10905926757212375091" + }, + "name": "Storage Account Table", + "description": "This module deploys a Storage Account Table." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::tableServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "table": { + "type": "Microsoft.Storage/storageAccounts/tableServices/tables", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "table_roleAssignments": { + "copy": { + "name": "table_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "table" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed table service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed table service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed table service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9368972709899985618" + } + }, + "definitions": { + "secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the secret to set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetOutputType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]", + "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]" + } + } + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed storage account." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed storage account." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed storage account." + }, + "value": "[resourceGroup().name]" + }, + "primaryBlobEndpoint": { + "type": "string", + "metadata": { + "description": "The primary blob endpoint reference if blob services are deployed." + }, + "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('storageAccount', '2024-01-01', 'full').location]" + }, + "serviceEndpoints": { + "type": "object", + "metadata": { + "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint." + }, + "value": "[reference('storageAccount').primaryEndpoints]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the Storage Account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "primaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The primary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]" + }, + "secondaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The secondary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]" + }, + "primaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]" + }, + "secondaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Storage/storageAccounts', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + } + } + } + }, + "dependsOn": [ + "aiSearch", + "foundryAccount" + ] + }, + "cosmosDb": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.cosmosDb.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('cosmosDbConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(not(empty(tryGet(parameters('cosmosDbConfiguration'), 'name'))), parameters('cosmosDbConfiguration').name, format('cos{0}', variables('resourcesName'))), 44)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "privateDnsZoneResourceId": { + "value": "[tryGet(parameters('cosmosDbConfiguration'), 'privateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('cosmosDbConfiguration'), 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "12826689517691444097" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 44, + "metadata": { + "description": "Required. The name of the Cosmos DB." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the Cosmos DB." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing Cosmos DB to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the Cosmos DB to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the Cosmos DB." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingCosmosDb": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2025-04-15", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "cosmosDb": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.document-db.database-account.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "automaticFailover": { + "value": true + }, + "disableKeyBasedMetadataWriteAccess": { + "value": true + }, + "disableLocalAuthentication": { + "value": true + }, + "location": { + "value": "[parameters('location')]" + }, + "minimumTlsVersion": { + "value": "Tls12" + }, + "defaultConsistencyLevel": { + "value": "Session" + }, + "networkRestrictions": { + "value": { + "networkAclBypass": "AzureServices", + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), 'Disabled', 'Enabled')]" + } + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'Sql', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17715929342484596741" + }, + "name": "Azure Cosmos DB account", + "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group ID for the private endpoint group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses for the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoint output." + } + }, + "failoverLocationType": { + "type": "object", + "properties": { + "failoverPriority": { + "type": "int", + "metadata": { + "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists." + } + }, + "isZoneRedundant": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true." + } + }, + "locationName": { + "type": "string", + "metadata": { + "description": "Required. The name of the region." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the failover location." + } + }, + "dataPlaneRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment." + } + }, + "dataPlaneRoleDefinitionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the role-based access control definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope." + } + }, + "assignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of role-based access control assignments to be created for the definition." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition." + } + }, + "sqlDatabaseType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the database ." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "analyticalStorageTtl": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "properties": { + "conflictResolutionPath": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'." + } + }, + "conflictResolutionProcedure": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'." + } + }, + "mode": { + "type": "string", + "allowedValues": [ + "Custom", + "LastWriterWins" + ], + "metadata": { + "description": "Required. Indicates the conflict resolution mode." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "nullable": true, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "indexingPolicy": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "allowedValues": [ + 1, + 2 + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "items": { + "type": "object", + "properties": { + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Set of containers to deploy in the database." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL database." + } + }, + "networkRestrictionType": { + "type": "object", + "properties": { + "ipRules": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`." + } + }, + "networkAclBypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"." + } + }, + "publicNetworkAccess": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"." + } + }, + "virtualNetworkRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of a subnet." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. List of virtual network access control list (ACL) rules configured for the account." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network restriction." + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "description": "The type for the SQL Role Assignments.", + "__bicep_imported_from!": { + "sourceTemplate": "sql-role-definition/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the account." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Defaults to the current resource group scope location. Location for all resources." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags" + }, + "description": "Optional. Tags for the resource." + }, + "nullable": true + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "databaseAccountOfferType": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Standard" + ], + "metadata": { + "description": "Optional. The offer type for the account. Defaults to \"Standard\"." + } + }, + "failoverLocations": { + "type": "array", + "items": { + "$ref": "#/definitions/failoverLocationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed." + } + }, + "zoneRedundant": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts." + } + }, + "defaultConsistencyLevel": { + "type": "string", + "defaultValue": "Session", + "allowedValues": [ + "Eventual", + "ConsistentPrefix", + "Session", + "BoundedStaleness", + "Strong" + ], + "metadata": { + "description": "Optional. The default consistency level of the account. Defaults to \"Session\"." + } + }, + "disableLocalAuthentication": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true." + } + }, + "enableAnalyticalStorage": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false." + } + }, + "automaticFailover": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable automatic failover for regions. Defaults to true." + } + }, + "enableFreeTier": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false." + } + }, + "enableMultipleWriteLocations": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false." + } + }, + "disableKeyBasedMetadataWriteAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true." + } + }, + "maxStalenessPrefix": { + "type": "int", + "defaultValue": 100000, + "minValue": 1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000." + } + }, + "maxIntervalInSeconds": { + "type": "int", + "defaultValue": 300, + "minValue": 5, + "maxValue": 86400, + "metadata": { + "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300." + } + }, + "serverVersion": { + "type": "string", + "defaultValue": "4.2", + "allowedValues": [ + "3.2", + "3.6", + "4.0", + "4.2", + "5.0", + "6.0", + "7.0" + ], + "metadata": { + "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"." + } + }, + "sqlDatabases": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlDatabaseType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL." + } + }, + "mongodbDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU." + } + }, + "gremlinDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin." + } + }, + "tables": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "totalThroughputLimit": { + "type": "int", + "defaultValue": -1, + "metadata": { + "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of control plane Azure role-based access control assignments." + } + }, + "dataPlaneRoleDefinitions": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleDefinitionType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions." + } + }, + "dataPlaneRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings for the service." + } + }, + "capabilitiesToAdd": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "allowedValues": [ + "EnableCassandra", + "EnableTable", + "EnableGremlin", + "EnableMongo", + "DisableRateLimitingResponses", + "EnableServerless", + "EnableNoSQLVectorSearch", + "EnableNoSQLFullTextSearch", + "EnableMaterializedViews", + "DeleteAllItemsByPartitionKey" + ], + "metadata": { + "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account." + } + }, + "backupPolicyType": { + "type": "string", + "defaultValue": "Continuous", + "allowedValues": [ + "Periodic", + "Continuous" + ], + "metadata": { + "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"." + } + }, + "backupPolicyContinuousTier": { + "type": "string", + "defaultValue": "Continuous30Days", + "allowedValues": [ + "Continuous30Days", + "Continuous7Days" + ], + "metadata": { + "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"." + } + }, + "backupIntervalInMinutes": { + "type": "int", + "defaultValue": 240, + "minValue": 60, + "maxValue": 1440, + "metadata": { + "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240." + } + }, + "backupRetentionIntervalInHours": { + "type": "int", + "defaultValue": 8, + "minValue": 2, + "maxValue": 720, + "metadata": { + "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8." + } + }, + "backupStorageRedundancy": { + "type": "string", + "defaultValue": "Local", + "allowedValues": [ + "Geo", + "Local", + "Zone" + ], + "metadata": { + "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible." + } + }, + "networkRestrictions": { + "$ref": "#/definitions/networkRestrictionType", + "defaultValue": { + "ipRules": [], + "virtualNetworkRules": [], + "publicNetworkAccess": "Disabled" + }, + "metadata": { + "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "Tls12", + "allowedValues": [ + "Tls12" + ], + "metadata": { + "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInControlPlaneRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]", + "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]", + "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]", + "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-07-01", + "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "identity": "[variables('identity')]", + "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]", + "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]" + }, + "databaseAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_diagnosticSettings": { + "copy": { + "name": "databaseAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_roleAssignments": { + "copy": { + "name": "databaseAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlDatabases": { + "copy": { + "name": "databaseAccount_sqlDatabases", + "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]" + }, + "containers": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]" + }, + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "7141543733238879531" + }, + "name": "DocumentDB Database Account SQL Databases", + "description": "This module deploys a SQL Database in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the SQL database ." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of containers to deploy in the SQL database." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL database resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "container": { + "copy": { + "name": "container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "sqlDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "analyticalStorageTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + }, + "conflictResolutionPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]" + }, + "defaultTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]" + }, + "indexingPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]" + }, + "kind": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]" + }, + "version": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]" + }, + "paths": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]" + }, + "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]", + "uniqueKeyPolicyKeys": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1789954443166349986" + }, + "name": "DocumentDB Database Account SQL Database Containers", + "description": "This module deploys a SQL Database Container in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "sqlDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "analyticalStorageTtl": { + "type": "int", + "defaultValue": 0, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL Database resource." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + }, + "kind": { + "type": "string", + "defaultValue": "Hash", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "defaultValue": 1, + "allowedValues": [ + 1, + 2 + ], + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + } + }, + "variables": { + "copy": [ + { + "name": "partitionKeyPaths", + "count": "[length(parameters('paths'))]", + "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]" + } + ], + "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]" + }, + "resources": { + "databaseAccount::sqlDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "container": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": "[variables('containerResourceParams')]", + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the container." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the container was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleDefinitions": { + "copy": { + "name": "databaseAccount_sqlRoleDefinitions", + "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]" + }, + "dataActions": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]" + }, + "roleName": { + "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]" + }, + "assignableScopes": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]" + }, + "sqlRoleAssignments": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9570871897890815068" + }, + "name": "DocumentDB Database Account SQL Role Definitions.", + "description": "This module deploys a SQL Role Definision in a CosmosDB Account." + }, + "definitions": { + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the SQL Role Assignments." + } + } + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the Role Definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account." + } + }, + "sqlRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleDefinition": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]", + "properties": { + "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]", + "permissions": [ + { + "dataActions": "[parameters('dataActions')]" + } + ], + "roleName": "[parameters('roleName')]", + "type": "CustomRole" + } + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "roleDefinitionId": { + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "principalId": { + "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlRoleDefinition" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Definition." + }, + "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Definition." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + }, + "roleName": { + "type": "string", + "metadata": { + "description": "The role name of the SQL Role Definition." + }, + "value": "[reference('sqlRoleDefinition').roleName]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "roleDefinitionId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_mongodbDatabases": { + "copy": { + "name": "databaseAccount_mongodbDatabases", + "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "collections": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9160691107424630312" + }, + "name": "DocumentDB Database Account MongoDB Databases", + "description": "This module deploys a MongoDB Database within a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the mongodb database." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "collections": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Collections in the mongodb database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "mongodbDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "mongodbDatabase_collections": { + "copy": { + "name": "mongodbDatabase_collections", + "count": "[length(coalesce(parameters('collections'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "mongodbDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]" + }, + "indexes": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]" + }, + "shardKey": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14050805189442830205" + }, + "name": "DocumentDB Database Account MongoDB Database Collections", + "description": "This module deploys a MongoDB Database Collection." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "mongodbDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the collection." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "indexes": { + "type": "array", + "metadata": { + "description": "Required. Indexes for the collection." + } + }, + "shardKey": { + "type": "object", + "metadata": { + "description": "Required. ShardKey for the collection." + } + } + }, + "resources": [ + { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]", + "properties": { + "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]", + "indexes": "[parameters('indexes')]", + "shardKey": "[parameters('shardKey')]" + } + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database collection." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database collection." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database collection was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "mongodbDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_gremlinDatabases": { + "copy": { + "name": "databaseAccount_gremlinDatabases", + "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "graphs": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "16834580070429190924" + }, + "name": "DocumentDB Database Account Gremlin Databases", + "description": "This module deploys a Gremlin Database within a CosmosDB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Gremlin database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin database resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment." + } + }, + "graphs": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Array of graphs to deploy in the Gremlin database." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "gremlinDatabase_gremlinGraphs": { + "copy": { + "name": "gremlinDatabase_gremlinGraphs", + "count": "[length(parameters('graphs'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('graphs')[copyIndex()].name]" + }, + "gremlinDatabaseName": { + "value": "[parameters('name')]" + }, + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "indexingPolicy": { + "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]" + }, + "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15062578211366932944" + }, + "name": "DocumentDB Database Accounts Gremlin Databases Graphs", + "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the graph." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin graph resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "gremlinDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the graph." + } + }, + "partitionKeyPaths": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. List of paths using which data within the container can be partitioned." + } + } + }, + "resources": { + "databaseAccount::gremlinDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinGraph": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]", + "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]", + "partitionKey": { + "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]" + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the graph." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the graph." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the graph was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "gremlinDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the Gremlin database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Gremlin database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the Gremlin database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_tables": { + "copy": { + "name": "databaseAccount_tables", + "count": "[length(coalesce(parameters('tables'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3429971823201332257" + }, + "name": "Azure Cosmos DB account tables", + "description": "This module deploys a table within an Azure Cosmos DB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags for the table." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "table": { + "type": "Microsoft.DocumentDB/databaseAccounts/tables", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the table." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the table." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the table was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_privateEndpoints": { + "copy": { + "name": "databaseAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the database account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the database account." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the database account was created in." + }, + "value": "[resourceGroup().name]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('databaseAccount', '2024-11-15', 'full').location]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The endpoint of the database account." + }, + "value": "[reference('databaseAccount').documentEndpoint]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the database account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "primaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]" + }, + "primaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]" + }, + "primaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]" + }, + "primaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]" + }, + "secondaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]" + }, + "secondaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]" + }, + "secondaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]" + }, + "secondaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.DocumentDB/databaseAccounts', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + } + } + } + } + }, + "foundryProject": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.main.{0}', variables('projectName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[variables('projectName')]" + }, + "desc": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'desc'))), createObject('value', parameters('aiFoundryConfiguration').project.desc), createObject('value', 'This is the default project for AI Foundry.'))]", + "displayName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'displayName'))), createObject('value', parameters('aiFoundryConfiguration').project.displayName), createObject('value', format('{0} Default Project', parameters('baseName'))))]", + "accountName": { + "value": "[reference('foundryAccount').outputs.name.value]" + }, + "location": { + "value": "[reference('foundryAccount').outputs.location.value]" + }, + "createAccountCapabilityHost": { + "value": "[and(variables('createCapabilityHosts'), empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')))]" + }, + "createProjectCapabilityHost": { + "value": "[variables('createCapabilityHosts')]" + }, + "storageAccountConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('storageAccount').outputs.name.value, 'subscriptionId', reference('storageAccount').outputs.subscriptionId.value, 'resourceGroupName', reference('storageAccount').outputs.resourceGroupName.value)), createObject('value', null()))]", + "aiSearchConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('aiSearch').outputs.name.value, 'subscriptionId', reference('aiSearch').outputs.subscriptionId.value, 'resourceGroupName', reference('aiSearch').outputs.resourceGroupName.value)), createObject('value', null()))]", + "cosmosDbConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('cosmosDb').outputs.name.value, 'subscriptionId', reference('cosmosDb').outputs.subscriptionId.value, 'resourceGroupName', reference('cosmosDb').outputs.resourceGroupName.value)), createObject('value', null()))]", + "tags": { + "value": "[parameters('tags')]" + }, + "lock": { + "value": "[parameters('lock')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "8997226659817763257" + }, + "name": "AI Foundry Project", + "description": "Creates an AI Foundry project and any associated Azure service connections." + }, + "definitions": { + "azureConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the project connection. Will default to the resource name if not provided." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The resource name of the Azure resource for the connection." + } + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Required. The subscription ID of the resource." + } + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Required. The resource group name of the resource." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Type representing values to create an Azure connection to an AI Foundry project." + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 2, + "maxLength": 64, + "metadata": { + "description": "Required. The name of the AI Foundry project." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The display name of the AI Foundry project." + } + }, + "desc": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the AI Foundry project." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Specifies the location for all the Azure resources." + } + }, + "accountName": { + "type": "string", + "metadata": { + "description": "Required. Name of the existing parent Foundry Account resource." + } + }, + "createAccountCapabilityHost": { + "type": "bool", + "metadata": { + "description": "Required. Whether to create the capability host for the Foundry account. Requires associated resource connections to be provided." + } + }, + "createProjectCapabilityHost": { + "type": "bool", + "metadata": { + "description": "Required. Whether to create the capability host for the Foundry project. Requires associated resource connections to be provided." + } + }, + "cosmosDbConnection": { + "$ref": "#/definitions/azureConnectionType", + "nullable": true, + "metadata": { + "description": "Optional. Azure Cosmos DB connection for the project." + } + }, + "aiSearchConnection": { + "$ref": "#/definitions/azureConnectionType", + "nullable": true, + "metadata": { + "description": "Optional. Azure Cognitive Search connection for the project." + } + }, + "storageAccountConnection": { + "$ref": "#/definitions/azureConnectionType", + "nullable": true, + "metadata": { + "description": "Optional. Storage Account connection for the project." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Tags to be applied to the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "hasConnection": "[or(or(not(empty(parameters('cosmosDbConnection'))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]", + "createProjectCapabilityHostInternal": "[and(and(and(parameters('createProjectCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]", + "createAccountCapabilityHostInternal": "[and(and(and(parameters('createAccountCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]" + }, + "resources": { + "foundryAccount": { + "existing": true, + "type": "Microsoft.CognitiveServices/accounts", + "apiVersion": "2025-06-01", + "name": "[parameters('accountName')]" + }, + "storageAccount": { + "condition": "[not(empty(parameters('storageAccountConnection')))]", + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]", + "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]", + "name": "[parameters('storageAccountConnection').resourceName]" + }, + "aiSearch": { + "condition": "[not(empty(parameters('aiSearchConnection')))]", + "existing": true, + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-05-01", + "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]", + "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]", + "name": "[parameters('aiSearchConnection').resourceName]" + }, + "cosmosDb": { + "condition": "[not(empty(parameters('cosmosDbConnection')))]", + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2025-04-15", + "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]", + "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]", + "name": "[parameters('cosmosDbConnection').resourceName]" + }, + "project": { + "type": "Microsoft.CognitiveServices/accounts/projects", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}', parameters('accountName'), parameters('name'))]", + "location": "[parameters('location')]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "displayName": "[if(not(empty(parameters('displayName'))), parameters('displayName'), parameters('name'))]", + "description": "[if(not(empty(parameters('desc'))), parameters('desc'), parameters('name'))]" + }, + "tags": "[parameters('tags')]" + }, + "cosmosDbConnectionResource": { + "condition": "[not(empty(parameters('cosmosDbConnection')))]", + "type": "Microsoft.CognitiveServices/accounts/projects/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('cosmosDbConnection').resourceName)]", + "properties": { + "category": "CosmosDB", + "target": "[reference('cosmosDb').documentEndpoint]", + "authType": "AAD", + "metadata": { + "ApiType": "Azure", + "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('cosmosDbConnection').subscriptionId, parameters('cosmosDbConnection').resourceGroupName), 'Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbConnection').resourceName)]", + "location": "[reference('cosmosDb', '2025-04-15', 'full').location]" + } + }, + "dependsOn": [ + "cosmosDb", + "cosmosDbRoleAssignments", + "project", + "waitForProjectScript" + ] + }, + "storageAccountConnectionResource": { + "condition": "[not(empty(parameters('storageAccountConnection')))]", + "type": "Microsoft.CognitiveServices/accounts/projects/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('storageAccountConnection').resourceName)]", + "properties": { + "category": "AzureStorageAccount", + "target": "[reference('storageAccount').primaryEndpoints.blob]", + "authType": "AAD", + "metadata": { + "ApiType": "Azure", + "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('storageAccountConnection').subscriptionId, parameters('storageAccountConnection').resourceGroupName), 'Microsoft.Storage/storageAccounts', parameters('storageAccountConnection').resourceName)]", + "location": "[reference('storageAccount', '2025-01-01', 'full').location]" + } + }, + "dependsOn": [ + "cosmosDbConnectionResource", + "project", + "storageAccount", + "storageAccountRoleAssignments", + "waitForProjectScript" + ] + }, + "aiSearchConnectionResource": { + "condition": "[not(empty(parameters('aiSearchConnection')))]", + "type": "Microsoft.CognitiveServices/accounts/projects/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('aiSearchConnection').resourceName)]", + "properties": { + "category": "CognitiveSearch", + "target": "[format('https://{0}.search.windows.net/', parameters('aiSearchConnection').resourceName)]", + "authType": "AAD", + "metadata": { + "ApiType": "Azure", + "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('aiSearchConnection').subscriptionId, parameters('aiSearchConnection').resourceGroupName), 'Microsoft.Search/searchServices', parameters('aiSearchConnection').resourceName)]", + "location": "[reference('aiSearch', '2025-05-01', 'full').location]" + } + }, + "dependsOn": [ + "aiSearch", + "aiSearchRoleAssignments", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForProjectScript" + ] + }, + "accountCapabilityHost": { + "condition": "[variables('createAccountCapabilityHostInternal')]", + "type": "Microsoft.CognitiveServices/accounts/capabilityHosts", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}', parameters('accountName'), format('chagent{0}', replace(parameters('accountName'), '-', '')))]", + "properties": { + "capabilityHostKind": "Agents", + "tags": "[parameters('tags')]" + }, + "dependsOn": [ + "aiSearchConnectionResource", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForConnectionsScript" + ] + }, + "capabilityHost": { + "condition": "[variables('createProjectCapabilityHostInternal')]", + "type": "Microsoft.CognitiveServices/accounts/projects/capabilityHosts", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), format('chagent{0}', replace(parameters('name'), '-', '')))]", + "properties": { + "capabilityHostKind": "Agents", + "threadStorageConnections": [ + "[format('{0}', parameters('cosmosDbConnection').resourceName)]" + ], + "vectorStoreConnections": [ + "[format('{0}', parameters('aiSearchConnection').resourceName)]" + ], + "storageConnections": [ + "[format('{0}', parameters('storageAccountConnection').resourceName)]" + ], + "tags": "[parameters('tags')]" + }, + "dependsOn": [ + "accountCapabilityHost", + "aiSearchConnectionResource", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForConnectionsScript" + ] + }, + "projectLock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', parameters('accountName'), parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "capabilityHost", + "project" + ] + }, + "waitForProjectScript": { + "condition": "[variables('hasConnection')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.waitDeploymentScript.waitForProject.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('script-wait-proj-{0}', parameters('name'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "seconds": { + "value": 30 + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16818353602719638288" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the deployment script." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. Location for the deployment script." + } + }, + "seconds": { + "type": "int", + "metadata": { + "description": "Required. Sleep/wait time for the deployment script in seconds." + } + } + }, + "resources": [ + { + "type": "Microsoft.Resources/deploymentScripts", + "apiVersion": "2023-08-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "AzurePowerShell", + "properties": { + "azPowerShellVersion": "11.0", + "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]", + "timeout": "P1D", + "cleanupPreference": "Always", + "retentionInterval": "P1D" + } + } + ] + } + }, + "dependsOn": [ + "project" + ] + }, + "cosmosDbRoleAssignments": { + "condition": "[not(empty(parameters('cosmosDbConnection')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.cosmosDb.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]", + "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "cosmosDbName": { + "value": "[parameters('cosmosDbConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "2297586848184477491" + } + }, + "parameters": { + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Cosmos DB account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('cosmosDbName'))]", + "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "principalType": "ServicePrincipal" + } + } + ] + } + }, + "dependsOn": [ + "project", + "waitForProjectScript" + ] + }, + "storageAccountRoleAssignments": { + "condition": "[not(empty(parameters('storageAccountConnection')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.storageAccount.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]", + "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16405095293780360423" + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]", + "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "principalType": "ServicePrincipal" + } + } + ] + } + }, + "dependsOn": [ + "project", + "waitForProjectScript" + ] + }, + "aiSearchRoleAssignments": { + "condition": "[not(empty(parameters('aiSearchConnection')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.aiSearch.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]", + "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "aiSearchName": { + "value": "[parameters('aiSearchConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16025941000331400340" + } + }, + "parameters": { + "aiSearchName": { + "type": "string", + "metadata": { + "description": "Required. The name of the AI Search resource." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]", + "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]", + "principalType": "ServicePrincipal" + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]", + "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]", + "principalType": "ServicePrincipal" + } + } + ] + } + }, + "dependsOn": [ + "project", + "waitForProjectScript" + ] + }, + "waitForConnectionsScript": { + "condition": "[and(variables('hasConnection'), or(variables('createAccountCapabilityHostInternal'), variables('createProjectCapabilityHostInternal')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.waitDeploymentScript.waitForConn.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('script-wait-conns-{0}', parameters('name'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "seconds": { + "value": 60 + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16818353602719638288" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the deployment script." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. Location for the deployment script." + } + }, + "seconds": { + "type": "int", + "metadata": { + "description": "Required. Sleep/wait time for the deployment script in seconds." + } + } + }, + "resources": [ + { + "type": "Microsoft.Resources/deploymentScripts", + "apiVersion": "2023-08-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "AzurePowerShell", + "properties": { + "azPowerShellVersion": "11.0", + "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]", + "timeout": "P1D", + "cleanupPreference": "Always", + "retentionInterval": "P1D" + } + } + ] + } + }, + "dependsOn": [ + "aiSearchConnectionResource", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForProjectScript" + ] + }, + "cosmosDbSqlRoleAssignments": { + "condition": "[and(not(empty(parameters('cosmosDbConnection'))), variables('createProjectCapabilityHostInternal'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.cosmosDbDataPlane.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]", + "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "cosmosDbName": { + "value": "[parameters('cosmosDbConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + }, + "projectWorkspaceId": { + "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "11649050309693252000" + } + }, + "parameters": { + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Cosmos DB account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + }, + "projectWorkspaceId": { + "type": "string", + "metadata": { + "description": "Required. The project workspace ID." + } + } + }, + "variables": { + "cosmosContainerNameSuffixes": [ + "thread-message-store", + "system-thread-message-store", + "agent-entity-store" + ], + "cosmosDefaultSqlRoleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbName'), '00000000-0000-0000-0000-000000000002')]" + }, + "resources": [ + { + "copy": { + "name": "cosmosDataRoleAssigment", + "count": "[length(variables('cosmosContainerNameSuffixes'))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2025-04-15", + "name": "[format('{0}/{1}', parameters('cosmosDbName'), guid(variables('cosmosDefaultSqlRoleDefinitionId'), parameters('cosmosDbName'), variables('cosmosContainerNameSuffixes')[copyIndex()], parameters('projectIdentityPrincipalId')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[variables('cosmosDefaultSqlRoleDefinitionId')]", + "scope": "[format('{0}/dbs/enterprise_memory/colls/{1}-{2}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')), parameters('projectWorkspaceId'), variables('cosmosContainerNameSuffixes')[copyIndex()])]" + } + } + ] + } + }, + "dependsOn": [ + "capabilityHost", + "cosmosDbRoleAssignments", + "project" + ] + }, + "storageAccountContainerRoleAssignments": { + "condition": "[and(not(empty(parameters('storageAccountConnection'))), variables('createProjectCapabilityHostInternal'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.storageAccountDataPlane.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]", + "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + }, + "projectWorkspaceId": { + "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "12109249428053532616" + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + }, + "projectWorkspaceId": { + "type": "string", + "metadata": { + "description": "Required. The project workspace ID." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]", + "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "principalType": "ServicePrincipal", + "conditionVersion": "2.0", + "condition": "[replace(' (\n (\n !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read''})\n AND !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/filter/action''})\n AND !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write''})\n )\n OR\n (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringStartsWithIgnoreCase ''#projectWorkspaceId#''\n AND @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringLikeIgnoreCase ''*-azureml-agent'')\n )\n ', '#projectWorkspaceId#', parameters('projectWorkspaceId'))]" + } + } + ] + } + }, + "dependsOn": [ + "capabilityHost", + "cosmosDbSqlRoleAssignments", + "project", + "storageAccountRoleAssignments" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Resource Group." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Project." + }, + "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('accountName'), parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the Project." + }, + "value": "[parameters('name')]" + }, + "displayName": { + "type": "string", + "metadata": { + "description": "Display name of the Project." + }, + "value": "[reference('project').displayName]" + }, + "desc": { + "type": "string", + "metadata": { + "description": "Description of the Project." + }, + "value": "[reference('project').description]" + } + } + } + }, + "dependsOn": [ + "aiSearch", + "cosmosDb", + "foundryAccount", + "keyVault", + "storageAccount" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Resource Group." + }, + "value": "[resourceGroup().name]" + }, + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Key Vault." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('keyVault').outputs.name.value, '')]" + }, + "aiServicesName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure AI Services account." + }, + "value": "[reference('foundryAccount').outputs.name.value]" + }, + "aiSearchName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure AI Search service." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('aiSearch').outputs.name.value, '')]" + }, + "aiProjectName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure AI Project." + }, + "value": "[reference('foundryProject').outputs.name.value]" + }, + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Storage Account." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('storageAccount').outputs.name.value, '')]" + }, + "cosmosAccountName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Cosmos DB account." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('cosmosDb').outputs.name.value, '')]" + } + } + } + } + } + }, + "outputs": { + "aiProjectName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiProjectName.value]" + }, + "aiServicesName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiServicesName.value]" + } + } + } + }, + "dependsOn": [ + "privateDns", + "userAssignedIdentity" + ] + }, + "bastion": { + "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('bastionDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-bastion-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[reference('network').outputs.bastionSubnetId.value]" + }, + "sku": { + "value": "[parameters('bastionSku')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "9423121226804345673" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the bastion host" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Bastion host name" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "AzureBastionSubnet resource id" + } + }, + "sku": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Basic", + "Standard" + ], + "metadata": { + "description": "SKU: Basic or Standard. Standard required for native-client / SSH tunneling." + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": [ + { + "type": "Microsoft.Network/publicIPAddresses", + "apiVersion": "2023-11-01", + "name": "[format('{0}-pip', parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "Standard" + }, + "properties": { + "publicIPAllocationMethod": "Static", + "publicIPAddressVersion": "IPv4" + } + }, + { + "type": "Microsoft.Network/bastionHosts", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "[parameters('sku')]" + }, + "properties": { + "enableTunneling": "[if(equals(parameters('sku'), 'Standard'), true(), false())]", + "enableShareableLink": false, + "ipConfigurations": [ + { + "name": "ipConfig", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "publicIPAddress": { + "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" + } + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" + ] + } + ], + "outputs": { + "bastionId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]" + }, + "bastionName": { + "type": "string", + "value": "[parameters('name')]" + }, + "publicIpAddress": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name'))), '2023-11-01').ipAddress]" + } + } + } + }, + "dependsOn": [ + "network" + ] + }, + "jumpbox": { + "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('jumpboxDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-jump-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[reference('network').outputs.jumpboxSubnetId.value]" + }, + "adminUsername": { + "value": "[parameters('jumpboxAdminUsername')]" + }, + "adminPublicKey": { + "value": "[parameters('jumpboxAdminPublicKey')]" + }, + "userAssignedIdentityId": { + "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "5495470989234358791" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the VM" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "VM name" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet id for the VM NIC" + } + }, + "vmSize": { + "type": "string", + "defaultValue": "Standard_B2s", + "metadata": { + "description": "VM size. B-series default — cheap, enough for az cli + docker." + } + }, + "adminUsername": { + "type": "string", + "defaultValue": "azureuser", + "metadata": { + "description": "Admin username for SSH (accessed via Bastion)" + } + }, + "adminPublicKey": { + "type": "securestring", + "metadata": { + "description": "SSH public key used to log in (via Bastion)" + } + }, + "userAssignedIdentityId": { + "type": "string", + "metadata": { + "description": "User-assigned managed identity resource id to attach to the VM" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "variables": { + "cloudInit": "#cloud-config\npackage_update: true\npackage_upgrade: false\npackages:\n - ca-certificates\n - curl\n - gnupg\n - lsb-release\n - jq\n - git\nruncmd:\n - curl -sL https://aka.ms/InstallAzureCLIDeb | bash\n - az bicep install || true\n - install -m 0755 -d /etc/apt/keyrings\n - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg\n - chmod a+r /etc/apt/keyrings/docker.gpg\n - echo \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable\" > /etc/apt/sources.list.d/docker.list\n - apt-get update\n - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin\n - usermod -aG docker azureuser\n" + }, + "resources": [ + { + "type": "Microsoft.Network/networkInterfaces", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nic', parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateIPAllocationMethod": "Dynamic" + } + } + ] + } + }, + { + "type": "Microsoft.Compute/virtualMachines", + "apiVersion": "2024-03-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[format('{0}', parameters('userAssignedIdentityId'))]": {} + } + }, + "properties": { + "hardwareProfile": { + "vmSize": "[parameters('vmSize')]" + }, + "storageProfile": { + "imageReference": { + "publisher": "Canonical", + "offer": "ubuntu-24_04-lts", + "sku": "server", + "version": "latest" + }, + "osDisk": { + "createOption": "FromImage", + "managedDisk": { + "storageAccountType": "StandardSSD_LRS" + } + } + }, + "osProfile": { + "computerName": "[parameters('name')]", + "adminUsername": "[parameters('adminUsername')]", + "customData": "[base64(variables('cloudInit'))]", + "linuxConfiguration": { + "disablePasswordAuthentication": true, + "ssh": { + "publicKeys": [ + { + "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]", + "keyData": "[parameters('adminPublicKey')]" + } + ] + } + } + }, + "networkProfile": { + "networkInterfaces": [ + { + "id": "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" + } + ] + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" + ] + } + ], + "outputs": { + "vmId": { + "type": "string", + "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]" + }, + "vmName": { + "type": "string", + "value": "[parameters('name')]" + }, + "nicPrivateIp": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name'))), '2023-11-01').ipConfigurations[0].properties.privateIPAddress]" + } + } + } + }, + "dependsOn": [ + "network", + "userAssignedIdentity" + ] + } + }, + "outputs": { + "userAssignedIdentityName": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.name.value]" + }, + "userAssignedIdentityPrincipalId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.principalId.value]" + }, + "userAssignedIdentityResourceId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" + }, + "userAssignedIdentityClientId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.clientId.value]" + }, + "containerRegistryName": { + "type": "string", + "value": "[reference('containerRegistry').outputs.name.value]" + }, + "containerRegistryLoginServer": { + "type": "string", + "value": "[reference('containerRegistry').outputs.loginServer.value]" + }, + "appServicePlanId": { + "type": "string", + "value": "[reference('appServicePlan').outputs.id.value]" + }, + "appServicePlanName": { + "type": "string", + "value": "[reference('appServicePlan').outputs.name.value]" + }, + "appSvcSubnetId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('network').outputs.appSvcSubnetId.value, '')]" + }, + "peSubnetId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('network').outputs.peSubnetId.value, '')]" + }, + "appServicePrivateDnsZoneId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('privateDns').outputs.appServiceZoneId.value, '')]" + }, + "storageAccountName": { + "type": "string", + "value": "[reference('storage').outputs.name.value]" + }, + "cosmosAccountName": { + "type": "string", + "value": "[reference('cosmosDb').outputs.cosmosAccountName.value]" + }, + "cosmosEndpoint": { + "type": "string", + "value": "[reference('cosmosDb').outputs.cosmosEndpoint.value]" + }, + "cosmosDBName": { + "type": "string", + "value": "[reference('cosmosDb').outputs.cosmosDBName.value]" + }, + "aiProjectName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiProjectName.value]" + }, + "aiServicesName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiServicesName.value]" + }, + "isPrivate": { + "type": "bool", + "value": "[parameters('isPrivate')]" + }, + "vnetId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('network').outputs.vnetId.value, '')]" + }, + "jumpboxName": { + "type": "string", + "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('jumpbox').outputs.vmName.value, '')]" + }, + "bastionName": { + "type": "string", + "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('bastion').outputs.bastionName.value, '')]" + } + } +} \ No newline at end of file diff --git a/infra/bicep/modules/jumpbox-linux.bicep b/infra/bicep/modules/jumpbox-linux.bicep new file mode 100644 index 0000000..610dab8 --- /dev/null +++ b/infra/bicep/modules/jumpbox-linux.bicep @@ -0,0 +1,120 @@ +// Linux jumpbox VM for operator access over Azure Bastion. +// - No public IP. +// - UAMI attached with AcrPush/AcrPull and Contributor (scoped RG) so scripts +// 1-3 can run end-to-end from inside the VNet. +// - cloud-init installs Azure CLI, Docker, Bicep. + +@description('Location for the VM') +param location string = resourceGroup().location + +@description('VM name') +param name string + +@description('Subnet id for the VM NIC') +param subnetId string + +@description('VM size. B-series default — cheap, enough for az cli + docker.') +param vmSize string = 'Standard_B2s' + +@description('Admin username for SSH (accessed via Bastion)') +param adminUsername string = 'azureuser' + +@description('SSH public key used to log in (via Bastion)') +@secure() +param adminPublicKey string + +@description('User-assigned managed identity resource id to attach to the VM') +param userAssignedIdentityId string + +@description('Tags for resources') +param tags object = {} + +var cloudInit = ''' +#cloud-config +package_update: true +package_upgrade: false +packages: + - ca-certificates + - curl + - gnupg + - lsb-release + - jq + - git +runcmd: + - curl -sL https://aka.ms/InstallAzureCLIDeb | bash + - az bicep install || true + - install -m 0755 -d /etc/apt/keyrings + - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg + - chmod a+r /etc/apt/keyrings/docker.gpg + - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list + - apt-get update + - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin + - usermod -aG docker azureuser +''' + +resource nic 'Microsoft.Network/networkInterfaces@2023-11-01' = { + name: '${name}-nic' + location: location + tags: tags + properties: { + ipConfigurations: [ + { + name: 'ipconfig' + properties: { + subnet: { id: subnetId } + privateIPAllocationMethod: 'Dynamic' + } + } + ] + } +} + +resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { + name: name + location: location + tags: tags + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${userAssignedIdentityId}': {} + } + } + properties: { + hardwareProfile: { vmSize: vmSize } + storageProfile: { + imageReference: { + publisher: 'Canonical' + offer: 'ubuntu-24_04-lts' + sku: 'server' + version: 'latest' + } + osDisk: { + createOption: 'FromImage' + managedDisk: { storageAccountType: 'StandardSSD_LRS' } + } + } + osProfile: { + computerName: name + adminUsername: adminUsername + customData: base64(cloudInit) + linuxConfiguration: { + disablePasswordAuthentication: true + ssh: { + publicKeys: [ + { + path: '/home/${adminUsername}/.ssh/authorized_keys' + keyData: adminPublicKey + } + ] + } + } + } + networkProfile: { + networkInterfaces: [ { id: nic.id } ] + } + } +} + +output vmId string = vm.id +output vmName string = vm.name +output nicPrivateIp string = nic.properties.ipConfigurations[0].properties.privateIPAddress From dfd3cc6c0109139a7ede5906476fdaa3fa44905e Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Thu, 7 May 2026 20:02:45 +0300 Subject: [PATCH 7/8] fix(jumpbox): truncate Windows computerName to 15 chars Azure rejects Windows VMs whose osProfile.computerName exceeds 15 chars (NetBIOS limit). The VM resource name (e.g. 'aiinvest-jump-hullgpilxdvtm') is fine, but it must be shortened before being passed as computerName. Use take(replace(name, '-', ''), 15) so the hostname stays unique-ish while satisfying the Windows constraint. Reproduces from the portal one-click deploy as: Code: InvalidParameter Target: osProfile.computerName --- infra/bicep/main.json | 6 +++--- infra/bicep/modules/jumpbox.bicep | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/bicep/main.json b/infra/bicep/main.json index a31e5e0..99de425 100644 --- a/infra/bicep/main.json +++ b/infra/bicep/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "4960232274037771954" + "templateHash": "14153731485685723076" } }, "parameters": { @@ -43178,7 +43178,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "16365167653907153569" + "templateHash": "5149576106587506965" } }, "parameters": { @@ -43290,7 +43290,7 @@ } }, "osProfile": { - "computerName": "[parameters('name')]", + "computerName": "[take(replace(parameters('name'), '-', ''), 15)]", "adminUsername": "[parameters('adminUsername')]", "adminPassword": "[parameters('adminPassword')]", "windowsConfiguration": { diff --git a/infra/bicep/modules/jumpbox.bicep b/infra/bicep/modules/jumpbox.bicep index 223606c..e14b37e 100644 --- a/infra/bicep/modules/jumpbox.bicep +++ b/infra/bicep/modules/jumpbox.bicep @@ -118,7 +118,7 @@ resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { } } osProfile: { - computerName: name + computerName: take(replace(name, '-', ''), 15) adminUsername: adminUsername adminPassword: adminPassword windowsConfiguration: { From cef6bc5035bb7d793c066298574099a55e1f492d Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Thu, 14 May 2026 17:29:30 +0300 Subject: [PATCH 8/8] feat(infra): customer deployment package + custom naming overrides - Add InvestCorp/customer-facing deployment guide (docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md) with SKU inventory, cost estimate, network requirements, operator workstation prereqs, outbound URL whitelist, temporary bootstrap changes, RBAC, runbook, verification, hand-off checklist - Add per-resource *NameOverride params to infra/bicep/main.bicep so customers with their own CAF naming standard can plug in exact names (VNet, UAMI, LAW, AppInsights, AMPLS, Storage, Cosmos, ACR, ASP, AI Foundry) - Add worked sample params file (infra/bicep/main.investcorp.example.bicepparam) - Update zero-trust architecture diagram to reflect deployed state (P0v3, ACR Premium, AI Foundry networkAcls Deny + VNet rule) - Update README with customer doc reference + naming override table - Carry forward earlier session work: bastion/jumpbox removal, P0v3 sizing, compiled main.json artifacts --- README.md | 83 +- _assets/ZERO_TRUST_ARCHITECTURE.md | 157 ++-- _assets/zero-trust-architecture.mmd | 67 +- _assets/zero-trust-architecture.png | Bin 768266 -> 396188 bytes api-app/infra/bicep/main.bicep | 57 +- api-app/infra/bicep/main.json | 441 ++++++++++ docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md | 495 +++++++++++ docs/PRIVATE_DEPLOYMENT.md | 186 ++-- docs/diagrams/private_architecture.py | 113 ++- infra/0-connect-jumpbox.sh | 114 --- infra/1-deploy-azure-infra.sh | 94 +- infra/2-build-and-push-images.sh | 11 +- infra/3-deploy-apps.sh | 10 +- infra/bicep/main-linux.bicep | 81 +- infra/bicep/main-linux.json | 707 +-------------- infra/bicep/main.bicep | 148 ++-- .../bicep/main.investcorp.example.bicepparam | 37 + infra/bicep/main.json | 819 +++--------------- infra/bicep/modules/bastion.bicep | 53 -- infra/bicep/modules/jumpbox-linux.bicep | 120 --- infra/bicep/modules/jumpbox.bicep | 155 ---- infra/bicep/modules/network.bicep | 192 +--- infra/bicep/modules/private-dns.bicep | 34 +- infra/bicep/modules/web-app-container.bicep | 38 +- web-app/infra/bicep/main.bicep | 16 +- web-app/infra/bicep/main.json | 404 +++++++++ web-app/package-lock.json | 22 +- 27 files changed, 2039 insertions(+), 2615 deletions(-) create mode 100644 api-app/infra/bicep/main.json create mode 100644 docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md delete mode 100755 infra/0-connect-jumpbox.sh create mode 100644 infra/bicep/main.investcorp.example.bicepparam delete mode 100644 infra/bicep/modules/bastion.bicep delete mode 100644 infra/bicep/modules/jumpbox-linux.bicep delete mode 100644 infra/bicep/modules/jumpbox.bicep create mode 100644 web-app/infra/bicep/main.json diff --git a/README.md b/README.md index 8394d7c..b440a1d 100644 --- a/README.md +++ b/README.md @@ -124,12 +124,14 @@ The application uses Server-Sent Events (SSE) for real-time updates: - **Historical Events**: New subscribers receive historical events before live updates - **Background Processing**: Analysis runs in FastAPI background tasks while streaming events -## � One-Click Azure Deployment +## 🚀 One-Click Azure Deployment -Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, internal Container Apps, Cosmos DB, Storage, Azure AI Foundry, Key Vault, Container Registry, and an optional jumpbox + Azure Bastion) directly from the Azure Portal. Two pre-built ARM templates are provided so you can pick the operator OS that matches your laptop: +Deploy the full Azure infrastructure (zero-trust topology by default — VNet, private endpoints, App Service, Cosmos DB, Storage, Azure AI Foundry, Container Registry, and AMPLS observability) directly from the Azure Portal. **No Bastion, no jumpbox, no public IPs are provisioned** — operators are expected to reach the workload from their own peered network (ExpressRoute, VPN, or hub VNet). + +Pre-built ARM templates: +- [infra/bicep/main.json](infra/bicep/main.json) — primary template +- [infra/bicep/main-linux.json](infra/bicep/main-linux.json) — Linux variant (functionally identical at the network layer) -- **Windows jumpbox (RDP via Bastion)** — recommended for Windows operators. Template: [infra/bicep/main.json](infra/bicep/main.json). -- **Linux jumpbox (SSH via Bastion)** — recommended for macOS/Linux operators. Template: [infra/bicep/main-linux.json](infra/bicep/main-linux.json).

    7=JYO2OlCF3k2Wph+W($4nX{kE>TsnxD34i$M zYtV*;h?ceC^6r9`e;MC+meC9z#i$h0%KCO<%xYGM%&&r!0CLu0_o?8bl%h7t$lgPN zHmi3SBQnie4>92$!|~kDe*8F`9AWhv)@FEHs?#Q~6) zWuLXW&Vw;y3xF8oAx?C3J|KVedJ|R-)WN~l7HM!~B)~><&Q4tc))*NFUa`B|%Y+oJ zE47~9pbQB5pauu)`~z7kjf_kFLGJm+ePoEJhf4?W0c{;B!cV~j4Aiso=Vt=&bwD!J zH8fOSqAhz63&7DB0J`flKtXo$aO?9w|6qe{1GnRLZ(16I$T8$cZ81lUKYTy`d-0VQ zKOg*}!{kthrU&@3Wns@NQWPn4V!OQ^PM7sEIVt>Bm0rGlX|u48GjC#x6HxY#q>thE z+Y_4WYo7ZXQK*A_oRu&G1HD-PO0~wiV4r1W<$wcn8{Xrn4ElJVW7IXR%?;!EeLIR# zO1`7-+Ig~a0(u4pW)qdn{QOcfG7|}o*jVaA#h&DHCeK_BI1SI+HODV0URl4LsNbe$ zXV~X(uph8P%y>6Z_2)fj-1i~*>21SQ@v1DDjN9I8xE|x(Ly(l@ z1n%3)+`^7BC%;Wzw(DDJyT7>?ErhHW4J=7ZE~a~}H}Q|KWU~k9>#pv-@zcw$wxXKM z#U^;;SbPNRmCmPZ0{@kvM5`y+m84{Tj|-KlaL>0|eKf@W>}+hHO$*xVCT3=?Q%`=Z z4q0=WVS)QiTT@f1^MR&z;!@M6YG{vf7~dQk;qv?NA^7Q65K64A^#)opc=<{rr=}Lb zKxcK0T+r!8bj0EK$Ot%}dA*AX400#9S&B9R0i_zC^=fZUJ_g1Epjr`$t|;7pF)%91 z%K?xsNWa`%ZtDTPD0m-H#{(7?K>#83_ouuPt^h?V32Iql|Inyo0Ig+%(r_%_kRbJJ zFIW#pgSzOe76ktwXmMOvz>pIP<2%hm}dev#2ab7f(%*_WJzt<|A$;UzvNhj7`o&rhkZ z9IS1UbIoOb4i$GfP@MSwu|b>PZTF4Os#!qfK1}4+-H}3T4)&5q-z+Np)du)^xljSI zSqbS!o3*eo@w>WwA2rHP5U7-4L?Lw#U8*G;nMvBcz;86z>ZN9}{hInu@iHFOcj|6r z;UA6FQZvp!p(8{%6eQwqhpGrFg{G%zdrfrIwqzOrvlu{|6Clq7g_?M7LIJCXE9NnzvW%-sbBL@Ei6iePq}vL_`#NPs$C{skxv%FVg{H z^mp#07Ubtc$sJ@)f#Tow)tA43!cbL}M{W%?q6zSAR~LC~(l+3$G}L+SgUkvY9p=AJ zK0RfWlo9a)g6I%vp2A~oCIcRGV*t4@?B%LE3s-(L3g(rZZ|A7K-kg#QM}URZD>IFt zr?O=oXyqVm7p`tLcjD5 zBC1HE+1K(|ToUI4a>8;2A#|gaZgZ~Fyg`)XTCt2XI}5!G;dhr+23VRpXcOn9+glln z*LhrEP2B2i`FXDhyv0NVB5me(eZQRY$_dcmZBYm#pCr8TIa8@jdF_5aVG!<$Xqa1A z2o1T^^H?f7i}wDrTb(gJ`WTu_!dkx{95f1On_H&SLiSVb6<{?QNQXdm2L zSNFEJYuxzXgD#9J*pPv&_Q#l$p_Uf++P48n8{mPmu$&hdN|{ zro$T_Gy!yO&V6;z5dqT#gZ+uIad~+7`R-DS&*FI1BlzH#FAor^l@6KV;qKbn1o(SP z?2e0_L&)8eBl00bXiT8L+ny!R=Vy@CBy@UxZkdRkh}k9N3_voq|mm@I7zRFEJUw9J-2z4%}K_>QTxcG8=PJ z=H#7Mf$+oE=Xek0+MDKx+?}kIgLCfgKGP@CP*qJqBGQ#Q{CvRvR~Sj)+dDWIadfp* z=(aA;^%qcj6ctrGSf_+r3<~IO$R9KSXKMtuh%fM;Lcr;H8H^SO_DyrjCV)VZ&7-Q0~%9{@R*i7QR(#{75zBev8ig^Xp8^;VYf3>94&>8qB$^4C7&8kV`oiM_L9^ zH4nou^jVzoM(Rs;4C~waEVi$aYr0-0=$aY4GNhssrpT!mSqEv@aPfw6%iveWSP?|m zTSs;u!`YkeI8tq}K6Y{CaOT@j?i`6YIqmHo>HPdLK^thZ*4vhtLxis~^6;hNB*fK) zhfPaMMtbp2rS0~;tY5*7XJoPx5?s&KHJjPnDd!yXasMv5841UC7N4XHjgRr^i;UGz z=tKRidQdnq$|Kcy;4KfW8%dLtj|DG1YMxRnzL;8EF#$2yH}$UwUo-|XsTEm0SC}K{ z+Ni-}x_=%2Q)noNvSOF2|~$u2m?D7@Vh`m zKm?JOK_ApO(_9BCRRHzpy*Ikpb^0FfKwDI;=1k^Z3^Zy@9~vx7xS`s@mR46*=4N_g zmnyXzuFYElvcJhnN3^F`9#oNnd3p8!)wj!kO-!7UkAE50W@D^^knpXeVpNnd5{!#n z<|*R9-qn1h_%@xmuga6u?Ce_Yya-7N3C8&vRn;iKhA4zW&r&DH*f7n=IHSaL>1#%Y z6UuHkNh~iXhxzAE4qwC5V;o@J2?$(LE4K0Tb^PYILu_kXov|F=9P|D?S#;Yygq|J^ zV!5ln9+YDDd+KJk9&*&Uyi*nNlG~?Z$6XMN^?H(!Y7kUlP|syH%x2R6Vf*m$ZybfN zTdl=GdLv_ET#jBwn4{C4R)O}5@9{m|Jpx?cOk7TlXWPxlmq$3ZcaLQ^TiTnkhHK=+ z#5SIH#*q&s9^>B3NKM_~vfDo6AGsGuI?ZM77nn2tOQ*J~@`}yUyo!s9SgK+!f#ztr zBNHuc^bqFG{N8;@1`~J{S?E|#pK>^mufQ7~r~!#}YOaN$o>_%W7axM`k?yS04hfc* z819-{q0On1v-wbIRQ(jhOs=obbG%dS7jpQ042QF7?gbs}QS`PLET;8_$j}C1IQ!7hsy7az=j5-mt zPT42`>DpVEUjOEwQy*{?7(o8eK0TiV6Pp~3kq{pn+dZGfwGpt&#YxkB=E_Pd_FN)< zI*QZwCWrC6^z>iDMJuqiKjP(e=~+Y1aXspqN&B@aF+CbZXKyxz52fns>DB|Mjkp>G z+W0-wu&UM3tVH06vz|q;vhp(c`@jG>?wICi?XszD?2w9{<#OFNM6j`!yu^Cf$|B?C zZV}C6eYSCSm!F3_)5P#u^xnXJ+ln+LHsvFScOD5{F-PY)s%J6|%06-}{f)vbxwxa; zw%uuv;1hhR_Lv&~BDa@icFy(8_sXG&=sQRNY?r&MLb%zEveb%7!}7$TMn!&abz`VP z&^mqM`zsZdNJ--MDu*dXeC~(V5;EtE48=H`SBE@YTm;T1y9#P#Zv6_`>g9MC z;YWcl6~V_~+rGgN_OH!)e^Q8VrQ4p>7kj1o@iKRoy>+hAkXsRjlH8TwO2?UtYp3$2 z2DHH85PhTIRy8X0$l$vu+7N4f3XhgRs&iZdNUs(=lQz{NV}7?=BxGcw$XMQr(77Dx z*ij&?8A6x^fshfNnx)tC%r(Av z3csYYkVOw+7p^0WnnuiYo~R5xDiJX;`vZ^9P(!1O4>sv%1A8)N7X=OBnWdFoNXwm$ zFMGKw827aA>9_j#_TEs4qt{w%p&hst#qIhmoVfaw%X=PQY295yx|{2PZk}>=(mh>0 z*CA@%ldq)pVu2kk9X(xLdd51u2NWIP_X4`y1Lx;j6aLqfk?4uHA%vVcNe$YGXFh;J z9vO#z_thHT_~6erd%OOtBb{Gf&3xQ6c}Dd4MPuFeV!A)~(2(PiV=HabO=%{zcwZml z+1U^_e8ln`|I5B(3Zr;AoB-n{dPkbM=Muv-teNQz`V3mmAD{NFMw|c1lip~NDoF`y zMP$H!gs~TU0t2f#4 z(>L?#ax=)eyGuX|1_J{FQiJ@T7}yv6&|c*<8TAIaBXTz^ZCbI*d&Sl`+9rtfjWWy2Q5X#u)siRalOhMjSA3j6}jKa zMBv&I7LYFhk0&AFPQ%DbFDo7n&eUsaqro>m-JdB#dtWt|iUQnxRFV-6Rn63?q5DiALI=*HF&NcJ5AriMmbMB?ZBDzQa4P6| z{8Vt(a#vsfwG`XbGUm~Dq1c&KdSR72KR=IQ&ixGO9i(-C)Q$gmDmjf;{Fl}^*Hz4l zXUGF8fl%8`8w+PP2a%sBNd^)b$M6W7$j zN?qlWQ@mD!j5`pU;EJ8$qJat*1o0giP6&E@8!{47@8zCz=@bl!1QvO2{G592=PsQ+ zYLsd1yC|aVB!cGW!trML$2W5npgQI>u`mOmbdYYKSM1s$uA<}Q)L-#~8o@(k=j8(w zpUtkFR@Ev*Nr7_KD}gcJ#r4y~a9syJBK_<0dRv0=1%k9!3&xWsl^T|om!T@w+m@}9 zEHb-Q3UsP*Dszy`w&Y>E^aGMBr@Q=e0FBYqB+lC+X|2gcGSs@YQ-=*?Y!u^T%$efOPK>0_j#t(2r6 z2nCZPjF*p z`Eh+?NKVy>##p1CvBP2C% z?oBt2U+F{0uPJ^3%73DxN%H#zW%mLqwfL`cTJ+Yu)-Y=vzmC|pu>hCqzTu-1m_)6y z+)q?gj?R)&-(N1j``$r1zF>ZLDAPMg<0jh|HA3fT8U}mXY8lQPy(ZHQN3MJ0okAtv z&Le^bAHL;rve0-io45PQ2oIQH#qqnlepVF7rHq$XJPQ_8T;3_fV+}NO%ROwoAo#A4 zP%=470-N@_?v4X}Mn>qty_?Yi#|ZcZ@>jVr1o@emp$ycX$Jrx?l=$)zkq5p!do2ss z#o!Ha9NH@L1UNgNPeu>k)yF|SU@9wf^iabkCtF+>w0ZC2pdLCa6Mr{%bgi>kWp`~5 zKoqt%51mU(PEESz!!dn57z`laA$-y5nfk2OqEaiqs3kR={~utGsmOV!r@c;T*CZl8 z$o~{e)I&*LB;PprxTCd9dmd*_R6|2Pa_Zs32zx;+dUmuHm5|8Cf@A}Jb`6Bno`5j^ z(VJ-+cVdE13Cy^be>XLYdIhcr_BZ!;=S5$5d^F;=3af-P=YwpIno1=w&)w~mpQ#n@Q(n$Z*!A(Bu|ZQ#e2%;l-)cfNrw}|UImIiKAFE7XnryMs?QL#hSMh5Q zOt`D&*=g}J6a-S-@&)?e4-E~ymtC3_qDfeBJSV#2l}DXl#a#ho#59^0@_(=Z&jn@& zY)fz1$+xaZ$fOt#Rajf|v#%8vcFeIs3z#X~((kp&!h=3{-J`&xO{4sr6yu}7zeV_( ztGG%%b(ZpVRs4=`drwZ@O1`jvf9%i%48`75B{9S>mCJj&Ue*!%{iVLHmL9LA&O-6i z7NreVtperkAnTUq=E#SxWvdejIwadW*wb;9WDm91TgyyLZZ1&_ZsExZxSUfnqIR%X zihJnw_BYw{zCDO!)p_>^;B}wMO7Rf?lb7%OLhA|o%ITJZ{5Bp~?1yA!wGx?>gblnQ zqOTEJ?fjwqmz)9=g629)o9+VZgZ6ggasKB~t`$vv2?CVDu6#a*ZTaUcb!MvUYQml@ zD5svNA*B3?=Fi9(leuC%s?ix8SuF21u%6Xdwd$Vusi~qkVDuryLyB7pHzOz_!hwQ9 zioHPf4;u2zttPE0rQBla?S+^So5zk`_`b7LW$LoduVmBZ5ucjONcB*c+}t1& zegsxc+@@y|wpX2FL8@|;anz#q=rGS{DRD#Lft5v#V|_-#C4Q-0?lGR?tK62QhgHzd zDK21(I&a*Nu2JdlR@h%!IXmu?oRY$Re0E9tL4@ z4VMVw^E;DGl%z)c3N&`hTbIh@a^=>vK3tl)k`fL5x-XY1W~GgP)s;cpm?=WAC!<)g z=e_=l5)0k^`yb~7MOi*CLNN>pF0^Z(Zpq&?fZtD<<(2!lwUBIyv|5==obcNtSGNBk?VmT=BcuI>Kfy&fB6R?w;Y&NIV^j9(kad+rw-kX}U zMo1hVx~*sZ;xHzIjPAw9ctIn2t5!~BCGG?yYO=ieRWdFmE|zbeQma<$w=8beKnk)v-F>1^ z=YMq0ctFm3WHsx!L78*WL+JK(n~l-s<~bjC;#|^)HoZFrTUNB8adE{43-jIw8)p@a zoe3)bH4AN}&Zv9%A|jfbODj3K7Nst2#3k*N(HE84V|c=R-X90{aXm0ypRIIgc#ofS zs`jX)t-YDYcKQK6fCvIs!Ypvre|@-RHT~R9Q4xEgxb}+OxqziEl-)8f*+=wq#ZmVUooJid%J3DyVs zs6NcH-E-46E*FxCK6e$St#&3abT?qx_y?}&`ip{jCf-8hN@vthN9-{C7m$vfX%xr# z?CxHJmghv7ZIwbaZo`#Gc6UpDlaX;(SLm-XsXRKEK4J%iI#-TJ_RzOXne$rY>~w!$ zSM@sd#%ef>m`hyC%`V{gv2hMrKX`ZaOzZpT64WLa5F7n@->4ILh!tl}FOLOQ@2`rF z!qDb2=bc>Y3-UR1DT0Q5Q*2cE`=8aq38tJCItB+HXS@>;ERTu}IW~gmiatoa4T^`r z@zRx`+li;n#Y~#jwdr~$Ab|z7&~nFJZS#%sf{v-lDs1B1GDm(tm12j5{(yT@6bBna z^Gkg)!gAI}(>1#|*MedLAyI{98X!|})hi0^wW#LzMI;BHLn{9$zKG$R-^uWNKDHKq z&A#gdYqt+p?;MszBMTC05(2-*KelFYTS=Sj)v^(Qc|n^&6kT5 zq)Mdc{`HD)2fBYepZMn9-d`y5T+)xX6Y5%G16yKmS$+g;SshjHB#5Yq}Ar>QOGlhdTAolRc@3Gv^Y;fH4lo#>wu7`7H9WWu5@k`)u++U z9l!K1H+Qa9)$Tf%kGPPyc)FC@K&M=z?g9q7Y2{G3$$m!+Z;ciKrM_fpb>b`aRG$f? zC=O#M{^px+5M*{LKYFtEc9%0+LsA1YE`xlp-UnYx*$=+s`Uu9$4Rk@o0TXk9?}xk9!sB;sk;B9_CI8Huql zkh@TP(x120Q!?qzDzZ3GEL&?OA&WY%@$?q@D2$A@|CfR8^gJ+S&vY4ZGD$fJwMwXB z93};YBc%LCAP~02#u#*H$RB3piLXtU6s}FCnuD~VVMaxys)htFyhUg8+-D$4^ zq^^-sY-s4OtoRk)mxfcg{hT?GZ_vm0L$E1&LbKBv0ydT^+4P`rC+ zb0etnE&^U&QMw!1j`*}_HGAa5xd+^Yx%YNUgLAoF42&y7&!T4sQYT&xNRL%>IR2c~ zGw?Osa#+}?K+9>s@r7Dcks|gAg+DH(m7}{w=6q7?YNd+A_IcB(z)@Wx?Z7})0CpF< zwefVBM}6P@#@Yl`aKS0^@-mw0c#BTxPI@I!MJbZlJ7i8LJ6)K`yL4V68VrAm%_Z8u zChpMU29eJRBQJS>I7xZ@7H_rOihDYUlrWq*%0S<|YrM!>DM(X)o|qw=NxAybBp{|> zVPZU6kU{)^L|q3s*8BTbogy+)C_*H%WoApV_x4(mJ+n6zB}qsK*_&)H*;(0p@4ffl z{GYeZ`Tf6_<8qx|zU%ospJ&|9ebc2^JgLeH@iUqJMp5Qufyr&-JliP%?VMW*g0WK~ zvx1I`5F;?@@^}F##ahw<3e_JPo#bge z#!$e|WWI?_&K=V-x9wcsHRDM`Iln4INzA6V?7twFDt*UhN^5ZQX+?fPzGz^SqM{a~ zB`GB_OJi|K$j&ZpqFsJL6|Lp(v(zT$@noclde5Lx#f`DQ$rxH?!2352BR3bMiT6L3 zmD1UIZ6x_f&9VLv`FgP0-|t`MMpacZoV!EWQ0XSW=AGkuApoSYm;cPH!+bk^)eytI z0R&yJthU4XiKs5=&jPz*GN`7Ka@U>MnKl0{#m?FOIbJ>}<~(AF#lCJ3 z`n9)2aRIe=G9z}d1QaqGxhdHKIFmFXR6$Si?>B~FQ_^A5P1o_f>Qgay(N5b#X2H~& z>GMov?Jy!Mv7JZLlGLHE;?=;rw{aMhZtrg1_x^McIHIT%miFuFsV5nE?Ck8QUDbin z7v1#|AN%X;6vg?T=A#A~&khf1ZRuCyn7qg}p6pezO+@W=Wv@kz6LW0V5cAJxR@z09OXYc>Hc}AV_9`naEM7I|nVkBGHHngjL)=tVA zX44ooW=d09Sm3LOjIw>mH5XaL-qBCrS~if%H-+VC2u3agf=Jf5cXB_f_!fI3zVjXF zz1qC@X7Z@=^EEURv(KbaU8xV!2FjARYlfTUS3DBzFv186W%bf1?yu__solK+>(?6v3vyBo`7HVG^{IB16cC)M$jp;ew-krShk5~C|_ad&>#7^Ib_j1oMDD=F21>5?=s+tmO)%edlMT^6ZG7nC7)G3=tQXP>yxWi`J|AE!vscE$mp)YgL6P6)n z0c$*=hlYm7HZ$)B2l-C4SWv&%Cax`qb6}*~A@R&Tgbh>7>(K3r*fB{+lL#_rD#n{T5`RdM|QX{?PVAl((Vx zRqyw<%ZTo`91EYQd&)2DKi!#@!pO_d2Qgnb9{SAA&nwnf0o4?&Xke{DT8E#%j(#jbm@-qnpSSkf|YT$@?!!UA>2D-oP)*xyA^RUbsm0@LA5;otiQu8fVQ zo#8WJ)^?r{9@ivE7uS^bC|C}DJQy)a76l`ovU66r5h$x{;X)={x5DL0?|N28? zX2s11K8=h=YFt%Y>s-cxA`j0Ndd{-V~t)kjQ;34WJsVlZI2!`4t3 zdt`J%bVr0bM1}GE`Sa)eFzyMbg{uG&VQf6|zh_3|TaHvFG0o0CLcif0)n;_}#`}Z> z{ZhN9Enj1xD0$wzHd2-Fhtp1o->v#Bx#8ZZ4%@hi;DRsK0lw`sN>9hUkn$bT)F8(v zvzh6KGc}1EZdS8Iri0R=IiGQKD@J6Prm9YJLqB?T{W+AkIxfiD+rMG|d;S=29qY|) zvx=AKbdNh<_nNIOc70<+P3t1!!s+0N^WA&s#Xzno|3fo(y*XAbrd7kHThwUXh&dWM zZCO7Umuac^Vn+h=o$i&maS2GNB;1Oyqru)kv#^!Fk|jkQ0%N+Fz-s0b^!DxL<;E(( z^TTIU_`p&GEU#W(Ucjk%4e>9YxbRMavDZ-(jdf4-WyBLTHFPz#Q)N^v2Uo&)s6a(H zs$%Dg*Zs2g&9|`zaxH%eH;;BQ;SbU^;TSH$Zz8m6tY^%$nOELsoPU&IRt-0tBOnSj zk?J+{!Hc;&(k9DiDKheOOpBQDy$IzJz~F(k4}$_;3(7p;KduS)kl^5(`1sR6RRH_~ zLj$ArP|3Ul&Mv<}-ZdX^%@#2T5ml%-fiRn3)a$_f&wKW{i zb{nz1VN5RQ8kxiJNT!XUd-+Cc_QSr7(l|;s9H~c>gCpvNri|p|^JD!ovesn5;U_Y)#`W-Ffm+Uc9*V1Ib2EXd zJlx2HKOCzc;J@(mgHdNWJv}|R5mHi84|mkTvO|OVBWOY`piiW% znv%+UweXd3yH=U&UOP=}xy-*l)R#xn8`#08lO#ffg@wO=*XeSR(S4nWI%a;oxpJN2 z-Me?dmI7-B^iTW(0vv$C2lOfq4xH@l3IOBt-&5*kqe)er@T#(${Izb6{wC~4TpTD8 z`v3Ko*ucB;9v}4MUrp7(KGR8>qyatZr>Mg#wwyvh;QajT1dI?wRmicgdBY%kU?8r8 zJ-Ezd-hVrY<+qWD0+*diuJJoUPIx9$?{PPz{t!C8e*gBZ?lT*E`&A&;1riOA3R!IL zUUdPcSXWnk;S{;pnDB5SI7moPl9j-;h>ng9gX|gJQBfpg692YZN*+@2^_dg`_YXLm z!dJk<1-Cf6<6@7F`aqi3qeG6kyq68KQJh)eL*cMDHsv;8)p&(ESRD4YW*Xor;gSoS z&IAg62??nvFCQ+p-dJ2*oSM=zHWqXG)4T(9J5DvVhF?NegM$qM0@?P)ZwRF_`xte~ z=NG&7{+0rnL>etv#F zzO{Nqv!hc_4IDyp$;K!P;ZqM zM;$+H=bB-)1GebO<;%0SB`bo17JMkz7s;R4C4v#Me!KJjof{BD#=#A+W4w7ybZ60b z;R$=%&Vu!(v(eM1mP>z#Mmz7zPnp~R((3Q5hRxPhXQEC)YLV&;+3FWcnSDTCA}cQL zyg6AtRqG4r5DRM%cbe}9qAWEvHDhDr5-nLL130I%RY?h-@TP}NOWhptLwr(*-{PL$ zAR#=iCt9gGcf}cd8ut(g^|s@l@-O`<5q8SUZ<^l-3kySy+XG|G$wrl&6X79AY=<>G z+WJ~1P>fB-pL}x#9ae2ppBaqggIN6PHm;qW9pb@XA6p0$=~ua|M$IS2qt@?t)>IrB z-AM^R5mXS~xLPI3YS0)2udL$J6B4hjQ-hSu5o{P|e#QuDYw+b7fsj*d&aNKv*OcPV~yz?t&Fg9+!E z06<@Kk^ZwR^62*Q3F-(h1`O>(lqxw5=#m4L^Bj2CKtx`PX<&SO98LrW{4hQqQ?K7e zd=LKIxgk4oABY}A4DH1HP)qE(6CnCVsPjcvjGR)-GYk+(r49-1Sg87y4*-mNIKC}& zoI*@!CZ1Yat0h`iIy!Hp-^VHoKXcipvfP>X@F%Jg`|GDri+tuL#y=b7JMFMlftsjR zX~8f5pe6&>h#zp(bBy4pUVWX&UqU(aEX%- zK|Qqn+vAmjj(Ml`d%Id#RzvxFz3FUK7nP~i3H-4OZNTA6`GDwRL2#_X=Rt2>t0}FoN*DfZ2e$O=M&wY`&zV(ZEa@99+Gyb9QzX zA)Nwz6f#%&$O0=5;j$UYLz}Z!90qMuo%N8kgw?_B)7kDCb|l?c9Q~X>V(Yo1dtUUrR+;%h4TBje)UfL7 zW-wt3I5lh{@bFT3G1zbOqK-028grmb0m%E^yLaI`ETT&HBU^wrIXV`>h5P$s#dd@@ z8Q7M9kh>&Pc*~q^gtU>K-qQ(DxMX%W>X0TAc2&0!otzxU_Z^YL=EUX0F6HLrN$Z(u z>1;@a4h93@icWFb&_POH${1LQke>G^5P_akq%{2MZmR?TK>MZFgwN6$+;<-x`7;}# z+|19zLn?Fgh~(rCV9EBT$`O8CoU{BTKbixGG+Z=!uSyY|bIOiA;iCvKRZU@J=*eid z&*!fj_VjPjdn*Ix7R)hyeK=Y0aG+lfsghnG+bC-*wt`tnd}z9Saat_dHs+2}%D z-Q3j7m_b?>;8w7r;CoveWG!H(Iv`P|Ob48MmCAHTr~?-kCNY7qJ;pzm{X{77{nEU# zY$}D|v1ZuwjP+-Y0Q&za#@7Bmo%MhT`$*B+6VFp0M3$qST{Mq_WE5wm@^uJ1UxGxT zq?8mew?eq!|KXdm%`a>cPVMqLdqc)MApWXC*Eip$31SFos+s(JqcpPLCpRX-@K~)z z>nc5-g?#yvty9sTDAwpp-k$lSMvUB}#;5>b%MefzVAikX;9_HuG#aoDWNU|iKizF% zu8J#V)Z8ban1v0i9D*+9s?`9HsIjvH9o`og=Q%fpd(HNMs+%9=Y!F#woED3qMPWu4 zPe4crQaqMh(~V}`}PD4s99%g7N5iXA}md9-ixM?2NsqDpfYo~UKR>ZxYTwIq-%^` zyhtsch|xDU*EDT4+X&Cn^s2O9Y6hK~w$@e*3RvghB7n)cK=|2~x$EmNQL6mI#l$Ay z1asMGV<{~Vk}9%aIyP)Eil0R9WBr?pjpc6uxxK)LM|s4IN>!RXgw}Q!j)~^m(f>b$qOP$ zD@#k1BFm}0K%&3oy!KH)W4b>T76*4Agj4q#PK!~p>08`cO&=3jzQ!^BT! zbaXUqtxg-~4_R`1KHc3wTCFM4D(b|5k$)yRASWUMF@laC+GQ~fGka?!2xaB3;i(K8 zs_N?E7|(JBy!QHR1!4t_+gEu(!+Fnejud7pQ{`eEm%8V!pyRklUQ+!J3jpl3V?8~I z!~Cz7x*uk2s;*@L)Z-qGagEOwIA-{DCPo#x2>dSK<_Fi}#d+jxWHb+UL&tas#x+#1 zFg!E_+RMD0`%f)auVhSy$HofU&0FND^SNv%efiQ2r}I2sddp$1YK|PP0qOO^-ObHB z$Pj>CYqckp7O0njTa3UrYv1!a2F75)LNN)~`EozwH-Or8ht|{xLnSnJj0z$q?>ny?6b@I{i4~b%&j$<;L0) zpJB}kA>n1=##I0Q(Ml3En`+rho(0r$Zg_iV?__eg(LWt56$DiVz)QaW=&;ME`t4N^ zLjzDANebiJ$X6v=U={L@%$5=r)6<$`C6nPDKoVA8Uk~OC-<2zJXURbf8^C0&5ud7G zY#zD45fVCM#`l9Q1K{>s@WhOIFW{dU2wPfPKh;iwA`=_{TL$NARKR@?2Z#P2wAU%C zTQhY9#vR!Ap4_L@r=+OsL+*XLTYy0UbmpnD(d$D64XZxvYeB&+ z3K6Doa7(YN)6RKU;^KbAKSRGI3_&E&tTvvV;O>J-^{Cz^Bpe<>V&be1mpSEZiweYo z0--Qx)L4mKXPUyxY~3marRt5@rk=Co3e}#4R(P#5zu&FwxrSyOLbwL_>B1kFSoF*d2Z27-PP9^A@&P5 zj?vXu*n<`qaSYWw5R3D^wikzrr*B+)xvG9o7_-mW+2(moXdlyB&DfRHd~Ps|h#jug zHH+aBxAX0h>!BG2^%>d=pR<4@&}(PkdnPse2H9YRy9QwhZJue5VcqZ6x`Kmth9h7A18i^df-Ra`Yi|%mSTER#9l9i{VyP!in%|_~cbOa;-=c!ZdXB5fV7k1#W;=7PsU~$$;MM%;6HnNlb5lOw5lNMQX$2ADcIRWMquBnmIMH5vB7-DbuOaWe&9>iVBy< zlpB)M8Vvdz3H=ROl&chwpG5hIS7NeK+;pk%2?Mu ztmjK6ZXNL<5lT|NlJptuFJwBZB_$5s*^tK@(ONd>s^wZ+Z`3NC>uu<+WgdRZIULM9 z9K^$LPEL-@@K)0@t#^xPm@#9&AQVhe^iw?Ac(3OAUD-8X&9z^-!YM-_D??y2qf%A* zqq2iw?|4BNjZvR3X7V)u^WYY342nyaE-8DOf!sYO1w}C4^xB#XQYsm|`o*k-t-JeW zilk@0ufKdzRC*Vlna^5*$ol+AOB!QqYb!bIqrX3m59|$|0KA{$hk3>{P4Bmtr6hY* zo+%c*U*3Datvw7tVesv@2?)YN?|u?}=~7nx;=WIO*CMs_ohpZwju09-kDWFyC`8K6 z9U0r%`>n{0Z-T;I4W4^LYu+XkD5a>dsTwPmB$NUn;Xi{DK9S< zes&TTmO)?f8bmVI*4L@=)aB2x-&fT()Ysn>HtL8u>By#k;FFYU436+RMRKxPMpbGm z5d{_Pl4%sD<#h@kZ4Ibx${a{Z`0=o_+XLaLTx<#<5m9P#asU}W9Vh2hYeZrwXKEOc zog^c3s>8kb6g6#08SBWe2%Uvk7xQEqhvyvp4=^b7^PcPJacn#Z)iI#UaJ-V~F|T@3 zq;u|TuysEF)K8V=M!rky=iRAI!8 zitOFxj(6-65H?fmDXOb~2s44d>mRC~cwc|>>qlYXG0h8^*c`J!wU%hjmhsG`C8d_s z&PbhmX27sa$t^pgzHDW}`30h@{~UhBRax^b{y1wZm7M>&`o%YCA6W8tdM|Fo%gZA& zjury7uI-R(G5O-%TCtYqjA}Dr<-P~x@P@2+@8LwX%)NSYk14!%DmOjT$ViKgjVadJ z$mq96UcqurOJ_Qk)mm&=tY@Z26|?2o`G&E2?X^Aiy*0j&rb64cbq(_D!HR>!Q(SnK zWb3kCs~QRpkDjmS=+keI_)b*)G<Ee&brL@|3w6b%-fDF+DQet1M}N2;Vl(as+42OEF(v8j9~zxh>7RbN=%0oK2yps}n;I((Mpi!1~%xWg%-&?pJIUH;L-HcalM13usR^xs!hywBNpL9EThrx@GI;8sP(Fc56eHjkAp^(GC0 z84NS_YF=~j;R$R=9EMd_rOFm@L;0+%n=hpIzzTAIh+jy!tjs1VN#PUYPSkRr)0{CN zF-rbjn425Nq#PbwZNS=WoqTQK)nMo z?S>t$bZG?y7;Os+YBfNvtqIYzET(_K%;+ z^_Ma|9fAC_RNiE~D9iXrevY>&g}-Ae*P)bESep9Q<1_!*frEhb|Fd9@Y9b!3Pt&%-9h) zzLrM6=eAm%`Pjt7My96~-@I;E*lBG$au?_rJ>6)b4CV$p-rPw|^>6+ngqNSr9hj#* zNYt^jJWvmyOKjQ1#wV#VJ7Kx=$#3eJk;l*J{)>)T4aQ3On|!t{YcsJr7aV+x0i>+G zr;tM9Kokul_%2XK$GLtTNDY{hGvjr)qzh;E>gOagR8_$T*NJ zT8CBIQ{d!b2;}!I@^sdC!t3J|Giz%a@skbt#n#U;B*dM2i>=9p#f63QArH5=k29J9 zdRSLTdsXiF*6ZU7&v#rrVPms9-aYWVI6DBY4^S4oCH&D}Wo<-l$D0wl*5=iL$7_NL znSGFcfS}C$j!RhB^zN>`urx$PIRiul1d>!?%D@;O3p(5ST?r3iCM|;9^m1sbaNgR) zC3>ipLSb|bRO4kN@bSqeO6;7vldfMu->32UP(Qt`*Ac_-bbk6yqhQ?0-af4qYT;1K zf=_c12k^z*-3z5x*|c+TkPsKg!#LE@xll7SDA4FtIO#ovQoRozC|56Mh$hbeYvc_; z5+N1d4mATRpWT%KwMT`MwpYo>oI|dfC`d|ioE*fijt*6MU06XyIt&C_IhCIWtl#J8 zHgiC|^7!)s*nXuX+0BqCNg^_5y7F;!vgBD?Td4hufY*z7Dt53+biB~E-pN3tF6-*muo63Y)pQ)omo3Yy;8oPK7WM(8XMli z)qzI6buqdgdjw-oVZT5_y!}ji1=L)|E2=V;>!W$DYW>7}jvN^pa#+3dYO(XCpNPJ- zb(P%$ldw1xq#+7y7Nq;p$DklkZTAZ#d&r=^N$b!KMYo03RX*3;SDJ#3!8_)%!Nyt$K9;$0;od%G20cQa@=oI5^AFn*SP64eA=mHIu zI%qb0z62SU=P^5sOjG%|pC2hgGeTE)qqX%$p1Rh-t;OFBf~~EstK${FH`>JXRX-MeP6oh^a%pJ#hlM>P=^oy_Du{}Y>u~EhM>Dc*#3fL z+gaw=Vz+lUCSif0_3jPP&Ia~MVmWz z%uK3M$&^x3dCGJkRR(c917kgF#H>mthCunDrR;RcFN#d_jD77&!n31r5}5n)*ly(z zZmip+P%e{H$v3LC?wxbA9k zUV{9iQYTzm-Q~@xM37*YMFshw>_*Muungc2POH&Ew*zLB87z5H_!L@Cd^Ss37eg~~ zxs93m=E}2#M4(*UOX9^UGyrj29$N!wjx3Y=*MAlF!EY+al)QR1BOw9uthcA9l*#!* z=?ruX$`7eiAnF8VCBoZj2xLAXhBIq~Ivs&jGJb@#h2g_caS_`Rzz7s3DcvA6s^_aL z{mtu~GD?w_B2c_uH&%Mf*zzGMPg=uUT$*sAeZJA?Y3mD}lS7N_`>!@L()g!r7Q&A9 zP7*3-ppVi!f7DKnhHWt07)-)x5$8#XjnOKrCcM?rLpPeJH7%#V8AC-VUVJXzi z6*bb73F$(wy101hvJlH$zb*$S-Py*Z!dEDB)Pba$I;3$fj5VU}wOxHQx+2X020FaOG2JX{}1RP*4?QFOb|+j#geRj^=EOv2;UqvO`;AV0Bps)ro4 zcD(L~YnQI5=BYDtpl>vVkY7XZxQX#&nHlI$vHt^$6=ye0&tOzhQ$TkdDj6Wg$N#UR z{tzi?$Pw)q)@C%2H!Mb)tagB@!HwhlAXG9lK-n_pTE@PDxBqzr#}6~o^@x`Ip}vco z6ohIQV&XEqMfw2+%V*o*y=0?#WH4OTkev&X7-(&c-N`Ez2q_NKpIv1GKnS<=js zkpMIE$OW&0b>@Ph@#if*SFvX~jqUWSTUlAS?TlFWkjVG}=*`LFT&<#xmxSn)Q8LXF%(ew;KH^=(c|->HFkLZw`oPnIL&U>bKOJ z{iR|$tO&qVs8&d1^}{QjoxN>fyf8OUN6s%>+K>zLB0eq(F4$TGI=biqiI1a}b zDkV&D);G{-|J+oAdte|GaQR|n$(W4uPazT+)>Wl}y?o%2?R{C- z>x>_0%B)6%s=eJpx#p>~4Q&2lE&GgQHm5t!9Nrhi{gL5@_AyJ-q}khBG%=>hoj?%t zGMdm#?TO4SpaX*`F?GGS!$-RmNA<)oV+i(L()12q}Y~ zBkg>kT5e>#U}#K_g{6W^POV$+tdvaWxlI+_zy_5WdpkRP3}>(k5|WaDfL2)G_!`Qj zA~^%8Nd`>1m2=(6BOvmn^k~*6Xfz3nlZpS1v}&RSC56vm;rbEParoQa5ycbPfFeck zh@sFFE(Ae9>2E9)R8)1<)o=b@WE*Zs6HCM*&L!-`_e)5$xDtHKHqGLq1|#3^hsH$e`Smzdn(cWf-mmknJ zaX~~7iYE*pLmF8vNoi?PUd|u7^#_-fmy#%$Y7TF+@-169zQmmYhJ_6jyjS0(AZq?n2qflLvUy@ z-GbiBY><_JIfnlar~wAZ50<5s#&MkW9( z39uYNobT^)1l#B>*xg+Pl0oZm7gOH?}_$z_Yrq^qd-wZD-b{l-O^vewZV zFEkBs70`P+awc7iZFV5KZ7w_KD7X4 zqK8I0xLqp9U6Ez@&X8?jiI!OOQKLUitv8daCb!f2BzLYgNKd6K2mj64bB_t;k zOGyPs+y$G~&Ea}<+qPmnC@QLBCPIR$W_r3CzCLD#wJ_ej@g*d2_SF;C2$94taCVsQ zpbIwJpEY=LK#qO48{naB-%C~nFYYENTHa%MLEyiq*f1aSFH-$i#`!ux8Hn%kawf{f zMr&oKeLj1fY}^Ba=xKM^jOyy@4v&w!|Iay$^ua+ZZXseNklr-|i5vZ(uV$IJU_XVG0e#f2T-8-2m0gtWuwkq8+!YpM%d|{FP zaZ&Fgstbt+G_=ibkMj3TXG1x4nV9zZ-L5Il)dJKkavl0kZMdH|&EfrNI6EKW3ZAmO z{C(s9T~Ht-PA|@mb$Okv7B)5{040&PKI+Ho$w&7njS-wuo*`^a2D4gagqEhX`GvP> zZ>y4?-sbeVO+*!?$-`yz<;y9JYL*-4JhA5c^|33br{#+PpXxlF#HdQKY7C-)4l$%T zuucEn3x)VQO$r}BzOI%ds`h;uJ8ryb?#s;wI*GhjJAVx$euIhL5PkZFj+S-}FxrCW zyQy7uiYXK6rZ+2eE{21gc3nM^_fPV!hfExe7Mx+AcjOjRw+Y&vU!#~cl{Ct^WQ}f* zb+GoNbl`Py)rCzsA}gK8NTOOPnrA|5xf?BNa9bhdU3=u7p}YG_^6=|uo$jz9-VhNL z)z_E%dwnK%t;Ro{?G3zK84%;)83w~bu*%61-4i~}@C%eXK0CPe@L@6m31suRdL9;9 zWyS&mDm`y$I<$CQ=7%G8yi_dsY>qQ@C%^HZ$X<2WUBh2=S{$q|+_f+(8nh#_Uf#P# zw4j=2BT*or)s?-X3B~U2Z+EY!Vo)eHFzr=@<^*k2o;(t)%KiDX5XS?6Tvw~+VLTV$ zQM|fd0qL12XczeRp_#4L<2|hQ4(30&#!S^Ucktif-gDWB*L1zcE{+zi*v-55R9*Cv zdkzA1T(R@kr|s=1X=;~^ioBf#xdLl8t*qup%>g-%-}j;pZVG#jyZkIqE>zx$ZHm>< zl(5zvF0rhg<{znIkQThE9?|$87T}emDf}~D`n2l}g z(#MP$p<3^7dTIUqmF_hcoS^O9Il=c6-Z! zhkQf04(f6E*HZ#4-`LviK-0R&tgqd)hcMtCx82704B+Rpim#FK6wWu06G_LO8y&2Z z0<65r05sAxN_Wpt5K@RHy#nfQ8VCp|IsED^{Ne4};r5evZFtA{$oi(^27gR+qE^u& z=|KO!G8Pm?Su>C5kYdF+K0&jocL_-PGFlV9KjEFw!!E$pVQgwz(sj>^K|x*H(4t_M zRRh&0GC@y}ZqxpYON2YvoCX$0YfHwJe#Y03p46-jZV|+GfHn69*46cX`{uK|`vZ%} z3SPUQ-~p%QC=kt}aJ!aXc6ODCiECUFtp&(XB}Qq&hGZp??W{FuICC4-e2gw$eK@-p%X;@il1@loifMY8@NYHKzi>OG=(t`AG zzh{JZCi}UoICd=Iyrexzoz5qQ-V`6nq++8A3qq(5%nW%mCkOz ziG1+lJKbAK-{Ch^J+G@-MVEWIk0j6k*fd?<+5gOtjI5nU`z~t4CX(m&X=Df>EJdC_ zkLI=mNZB}4icyOI1?fa&S=GL;PnFd+9cUjJMo2o{Gsy$;O`9E~Rxxs!cwP)XUnpC^ zJ=E7x)zwkus!QYeuC1&H*qg+{%K&H3EGQ5~zqz_KRUs&7zj>EBZ$F+mFt#)@I?>%u z8KzK39vm}im7XiqC^>P7MJP*SC}eVQga*_$+*s{wx7!z+*t>E48=k<=@-YMUQGQa| zqP^lhOt+&}dAP2Mq9WB=-vdB@L&EaztuEWnQfllzpa!X^d}^!ZeE!}_HqAd#$(y5#;cCp_3@UBPx9KMvH_Cu{gE@Hs#R)EA@G832hf zmL&0DnN@8;N}uJtpIZ@dIFHr?jAK{$YrvuL-#gmeb*8 z36u6Plo(*3jKYWNVKSILlwUnJ?%UJQo-vM-)+k+u3LvOv&bWjl0a!LxLGdXAU>+2s@&vOKGq4UcPQPTPliqKP)O{a2b# z6Wj(o)1O2N{W>x2qq*W+Rdv`Ba6xK#v^h+?F}`E?S(_LZ(@jaksc>DZ!{Zfhl+!dx z06b^dd}{=o{bDEN5?EMR|G$y<6`ERWRk|C4;VGqjN%iQ^P1tkm+fBaz1h8N3+85CB;rFFcs(QS~R~!e8N&` z{AKVMx(Eh|^&$>>W>(Dv=BY0-#@hO-l~0KrBI@-S4^6hAKi$n{+j`aAPedH)=E4(x zK;g5U)OcOO`v1SwAvKtL0N%Y&XK|G)L|-sD^J&)N@v1#}YTz z`*XoKiTPUY4_{XsLPEpKZ{DomW~S%n<`)ov;h|ZmUO{i9xBBVSTpvi& z?d=Vm6j@oyIh7JsPjB+#T+lvPZ>;sFZ{N7r)%@}WePE?+nGp5KU0+|qxjJJSv4>+r zmMkV(JhJxKu2GiMWBCT_sI0-8_=u&(bE!MF${tWa!^{C|%!xoEPo zXfl#B@%4dNKi~l(c|w-z!~0gSrKt-9ddk^*S}brq0LucUGtb>e8tDu_T{#f(L2k}Z z%F1~6R_`t@Edelg5l3CnqM`=A6gM`c%FmUKrxJbeB0Oj!w8h>u%HA)U!P2z(N%-)2 zx|xcrsa_=Afr3%@5v$B4fAjTD$3o3;rxJIm(&EX!?S4&fG6886-djk?2QGRZS~wdU z7XYyRbeHY@|EvHxRB`gb-yb?MzD3`7F0sqVEDu&1iR5qrCnY<@)Ka2YlNoY;w1fl) z2h+)k#>pv_jQ=u#PDk@;6bh}`Ml0JkA%4D#i(_0z?%`}{i3EJJUw~U$)`C!p9oMy6 z6F<6NcPt#8xS?|UINF*K#R4wF=C3f90tL~w@k$NZn7`WyTFwVZqM3D0$z-#yVYivE zb0Qy{My9~-S6BBnDX9=LWetrI8yg9jL$b1xh41U@pY0Z8^$T=MtZ~{HqsK}sSNiv~ zg+CNgspY7In)*wN@{dS2KE9RTCSsAzJ$Coa>G8_rYu=At?Y&U*w(N{Kqa%*~g(h7I z@G}3uZUdLYfhe+2mHo`h$cV)uXd(}3WV*6+O9s?rMH8X+k|=3N9MEsT3a}|ejdFsj zIY2<+&4z^ZU|}jlLJlA@kbp-N7vW->tt>B3u3CsW{Z6TG)v_{Tf^jG1L?xQ4Q2Jtk z|DwrX$Mj@;Q&3@oa5g;YI+Aa}c*}&*^e`;={1$QqQN^S^H%# zLVt$?tM5?q@%N7o3DJJ_>SU>>0Vc|R<6hg`hRfA0*}jFEkzwb4bcn=*@iZ6{0fcB2 z80i0Y96CT$9V5-VYTv&b9!8+-+_$^?%eQZX>toMi%xM9}V#Q>VD=!nQV=XS#(%jlA zBP%N>(IhU@CMnTWSWrOi^Mq%ZhkM9jadKw1xA`|r2PnRFy+wW@a(@!#$YEZl(+6s4 zwyHa_UGBiVS-v2c)QpN#!-H-_&kYo7EG#FItMJsf4x9V)KdB>ai0wc6Q ztgb0Lzz(6K!=MTPZ!WHZZATQafS4XzQ6+h=`w@5yMn)J)$%KZWfIyQ0CDb|`9s6PS z2`UT4#pV;0+NAd^7#VGL$qEgQj^2$Fk!qFhdi=2)3YqB;%wDW_!jIh#H$mQ2I#wY1 zf9vUjhT(^=Xkrx0R7jR)6$Gj5S4>SKU_9g|g~9qLE|0wlaHGp6vj*1dqq?#k3kNF) zky%;#8{-o|9WDIKE%5Hn`{ZOpRn`690Z~?CrCF+(fZPGZy-%cCK~jxuC3;X)OJ#Z62$uHX8- zb94#-+_T-D-$-+>ui|w+L08bv5BEU9!0}XT;{;?>7QmB!{n{!P_~rWJ=g-IX_Z$fP z7*^K^WM#94kvl~N1*(r;#c(^%{c{xwvuUVFToVLrGzy}h?&QJr*SBwXbai$AXU3;1 ztr6x>QIC+8hK-R-gwj7Z_f47OTE7|6Cumx~Z)=7I1|Jt%BRr<-(g8`meRK-LJkYCL zA3G`2Vj|}-qY7*&^Abb>1wMbq@j7>z4v{0Yn5a~t4zV1}h57HEsi~JRfen*d>mc|% zGxL(27-U?*DA_^(AVS)4cQFs@W%g~6eeLbC1TSwBWwNrd1&H>1r43=$DR+hjJQBg? zwl5tZ3Kb_4cH%TEGY3;Wz4#`BjBrapA9U6F%0W^MqZZ7JeLu^1U0smtJ*fpDN|}v~ zPAi54Xl*~vi<=|6uR+@v*+_7K;Eg@B{QS@DFY zI20<#e1!es6|WB?%gWz%EOf+PJdSFExl%*GcTiGN?H5y1eK40LDI!m!xYR)pB%i@*Vl)F-Cg2gU%c*g zrG^h5(utTwRp<^CRsueJ6USJZxIhL99M8f7ym>QZ*~3jriUSIr5GaTKsdkN(BFR~k z!UF@N|1&04DRr7{Vcg11)>2(TBPr`5mz6_wQkGALR=38Ni=wD|};qx^t zL-5GJOjVW4yBezM-K6M|^vevcm)~$x_|#6x2Y{k9M5b{}vHWgUEB%&|$zMtlC}ckf zML~f=*#s$(+**@uIzG(vVf{&G0t#qcb9VBWUe%ra-aS5x!54)79B%tsW}n+SJIA3fb$osj zs-JgQ=cnY2?z`p8XO_|lLbJoe!(q4&L--Sk+g`9>P*8_#&AnW)Hv|~VF%)F9OAm30 zd+nOO9O!yVzgGL0n%eS_;ECBiv`Jm?x6=NEjKnN2egUQjPONuZ2wb?!6ii!t=U>wY<0di4=xXy%qecZ#K;d5;W zP2gbu99G_7f8e99Q1DhaEA(ZWG+L!zVp61LqF&$6EPx0{>;IluGSW+=XQ4I zn%3A*F@^R6V^~g3AR?>Mjf;ng=^Wq)w*c-GK<#5Ov~6c&vsJbsOU@D(EB{EDZU=(` zI!-E&ZdaY=8v~mHm(?lKajn#H#8H_SW_$!dS_ml4!x&HKsHr*G3j@^|%m&(H@$$_F zm;vN8jx;|Aejt_(?GGk*0WWZ*Ft&|Bp`#N6oDpvOr$+4O9`cjb-l->hQIv#Ofux#( z`gP`M`vKwvc2be1Gew3io{(bM>9d}> zMMO#!BxEpp9PeJoSj;u)S^$5VS71&6UCGgs9T?xfALlKbI#Oub5=yTIBLa^Nn+pMf zMb=@_^yNA9=)ryv0HsJ*GS0wJhxH#z$gE?#rLSya5(`FzFYF^c1&j=eN0i!#<+M%;aK5L5rv3cvJ~3CnJXc zO0wePKlKO9_vzEAG$uCJu!##{o(<3!PI#}cDJy<)oofarosOT>`9;{1G*`cL@`@AD zUcO98=U6|^t4c_+|1on=Rokr=8Sao}uI=_*AvaF{5<}bv42%!r8+iDaT?9W_hoN^p z7r%osaM9qa$7&brpN3Il*RC;GadI4a`=;N=v$Kkmy%Duq7PV~YJM4?%1WbRNp~)j4 z_C+96ZEc5}LIylMh`>86`<}XU#$NRBc5NPA7N|lg`L-F|63#EM11%#TVG0;BY&S44 zaCVj5+&wkyO}lyFg{AxGc1EV!I2){cFQH#!kR#8|&ZecOD?F!y6L@-7g7mMU#7EFp zbod?}eYW*d*<`U`YX%)U%BQPDS3Bdhssxa7vDyq_`Z6C!OA69FPOeHymUg#5(Ci(> zwP3&EsHl+lC6=A;-Ca*xtG)~s(7j3eGeQXl&#nbQ1L&D^a9FZik26D6hr40M26S~E zT5`+CU<)^PC3?w4u%3ZUK*jA~Z%h;;4{3>5CmcU0^}q)L9x16z;o`tZLv_>QKs?H& z{hPvr7SD0Swu&cG;z!W$JGkwC2Od7uaI{eL>-VwWVc9(9* z?|9KN5&`3U{}HVq@^g1NOaZq=Dbc?=f00-zDHF5G;gYYmw~g`c;pI1*7hHGfvvh8v z9l~UZD4-E10EsMcAye!b5yh-edhV~D3)%zNtk*=wkKHQr5uR#0y z+QP3l1(=wt+GSx&izZMEpS=rJ!~zZb)cZa`U+@(q{1zL=#L$8;ssE3w_khOo|NqCe zgv>}qh^)-Y-Yb#4XDEBixHE4QnT4{q>@8%kB-tT*%id&<8^7mW-_QH}&;LH1^FGI$ z>%Ok*wVvZK!k3q;c-f1f2#SHR+w?IBuNkhBB^Ub(SOoO)aUkdL?QdELaMS8>8&W1JNffGLGW+gQ{hpH*Ft`S3x&;+K;6*@RM9V8!^Q zR=F&N0%4>~qt`=FAhu7tpbb6Spc~BSp2Ob{9#(wU%5d-e(au)z%}w~)6=F=EM&pmk z#{nT{Ft?9Oou3}e{!DBE`banfLBUH(4C9uuG2#i}?{T8YNH1OT0b&w}X8>RO-xYh5 zE?;>|$>;D?T|GlFIRrgVD?E;NAw@CA-2(bvN=lghEM{-ag_H~Jt*s&N-esT%Z+>t_Qh5sCATNEMSn_4wSZq(^%F&D>3Wxk&nK!~ zovvV*f4+S2_mB5py^!{Kdzv3|@oEhd|GR``SAWhuf4o(D)ZxI~9A|Z@w;+tTPL%@> z5b2q}_UAMd=?O#^_Ff=+bno6NEZ5-2A{DC)7~UwcrlQ8*4pmV7)v9>~y`6v86FqDG z;dwn!raSpSQ&kmWkX8=i2A8iGJk?LY5Cd|U1}4VO%QzT4UlHr0eqBFAL@~^l;OW3Q zVLV1|0a&g7?e^O&A`M$Z20X;#U^t$hn)=xJPMDdgsh`o0-87S>zAQVZjqzV?ZGKU` z7rY4_X1yt=Y~mkXF_l00uTHDii(YZ;~C;3!;$g zq2xqFr)%1WDPj|rUgj8K4<7vr4t)A|Z|Q=2s~pVNE(Jm}IvqoQyvJchPzk*H+7(aW zydfy&Od96s=_v+g31uQ1B_;xcMF)ka_7_qFA=Lp6-GBG=3{FKbE%5a8{NIwmINIHM zq2+RT0x(i5D-L-339C~L!NI{uR)T7ymOoXFUdk#ngWHuDTLnW!7BREeFqE=Veh;O9 zazzrKc1LAPU1~PpL8Mq|Eq)We}eU45=luuaa^SyXM%6K*)!onr6|<5E7!{Vw^PWu zQDw$$b2^kH81-h;UkeW#Ffqt@VXE`1s`d#Zk5Na9$^YGv>+GDd1eVd!cA_BVpy1`( zGIA&y5*#bX??x?bp%en5V8+6I^@=yuEx}6NzD!bd?vg@G<|zuP3((ww5oz^LiVNO2 z%H@E~wmC@e%9XbOPeI=kA9?%_AO@6iKa-L9u|C!);s2_rjOfC&2=Xl980C5yecUej z`cVl@>Q3gu8Hy~;^5Jb) zSL+lODwJ{D!BG29T--QZeA;aI5Iqgeef+3A2Fk27F@1<`-9iWMe?MVY;qbb0MY6Gx zU6O_fy^LXh92}k01Gwq!N0)-rskGN9MUzlpz}p9j?-pl)sxK`Z7wJ ztokS^NN}?jQ`q#LLDc8)v%{(~Fi?yY7vQ``R#uK298Eg6u3>l%?yq|RaP=elu=yg^ zL~wSMd*`3Vgm>KRPB5s^6c!eyrlqybGr^8J2TtMqh!wZ>cZjWNSN5XcWgMg!C>BS@ zwEliv^rGmlEB!Uy`q{ysovp;Pkjx%!O+DTn$TpDQSw1rVV-EqpKp4p5NRxwQly zV?yrbLxY3aZ;LTf$S?^uxSh-i{&%%(^X<7dXJ{RVhJwz(|6NV<#fuNGUn_DvD$&!U zKtG-WXpf(v{**oF`EV~9#9p+oUAiE;M?yj(gggd#%D-o0Dt^)AS7tTzAD(3;FD0dC z#_)AUMowrqEqd^v#s9giENqVv;@!>RUP%cF`9Zi+nSE6PNXmlL5{5Uo`Jouy?(Qx+ za6_KF`rpJ9t()7J%+sylrV^%wPam9V<5OM+c(@)+tI7&Vwfi0HmrR6kF#0dYcg1nE z+!JXC`+KH|HW4uKJpbwqnC|K6=l@;p)W|v?&>A6B4RH|>&}$2GEG`Z#NpiVKxRq|B zYqmCdRq0@Fbx2!X{qOSKh0D}i!NCm-Rv?`JZ{c|ZTb;vfcj=067`IIVtmI4q{MIV< zJkzSm;WnoLud^z?=b|@b@h@Pg*u%WAp1q2JM+$T59spvsN{q45O9%Z)5q|o#?WKJ& zgYWM8*i${dw;Q~77vaPSw>bU$xk5*0g_IP`kFH>(i!-vgZqMELyW|=(1u*(8SarT& zVPo?-ZzTMG>QyP8pyBqVq5>Y8&tdM@n=8aiA(ysU=;(~rN0AJQwjU-4&AKNYoHyxe zj+LBA7PB%vEA?WC*;(4zew$$*jeJYBrWVQjk{*zjpV!)_qV`K|+T#8;XBE@&sHqLt z`)5lbxHrJfY;U7PSs2%~>#!-(ue8 z9JWqMVO0IvO}g!PSk)%(SuP!;NJ+#kB|lYCQz&UB6wGEF!ZcxUl~6n&DClEQkcu4c z1Rrcn-hNc53K+@r%UavoE#^Nj0g{xFE!ObFBvmK!{>&-bYJbU8{k{_ zikCyhUGMR?Hw2;1NSt#i+SYr%*~_CkH3~xPtpCuhiJ^KuTbI zy(>dukp6(38FTKfkzKBmWm&AJiY_QR`e|9~>9n*{Je#ZB>m@OHmUlbWGCXW`{)YwF zntH?`iEfmnTtK7HL~w6CxC`UO%Nz5**hy*V{jFYIW#t!bA4OmqW}uHaFjQQeYqgvo zhS(qf&JumvjA(Q}fivZuwX=o&M|6l;ZV7^F{86Jp>qAAv2~!W3)#k8`iDtLeLP%PD zZG-E1QDHAZMN|~YQ!Xx)uaJ8b`7Or32R0@wc=ZB+{X?QbLo|8!-}Z#;f#!kEL$qgINeIqc^@a6 zS9wu$qHy*N8|6(rGUq_o5}qZcqBnB2v#%*Z+<9b#?(hD70oEchxApL63And8N`%iu%~ z?5Y1YLcQ<585x}>Z*$=uNJfw43JdMhaX{9v+Fik<^yJK;85<9t<# zR#q$q!ij_>h}941_a`qAztMexiX-2xZu+du3mpWd?@w} z6L3yiTCwbf;31*DzC2NnI42qo#a{)wY15lfn<@asK`jY+DcWi*Yc1X zIHo<>EBnG3={Dl+odwZuq?>j&R|ZYvj$@K4SHu4L(c* zdCo2GmKi2WE?iKoc5d0NcgwH5yKb~ZZ8fxP$*(a`S*P2uEQvCtqpS#gTU_w|Xzq^$ zsI*{FgS$HNh(8w^vIVxoKC5un&DNOXKTX=i$8b>OsvN(o%l*JO}k%GM=Sjmoy*m3VfLQH!nTS%M52@S*e8k4jn$f`55A zIpAvnoZ#OmrM%C}YucXg!={Fqad9UYy@WT~BfoY;UxM3d^a=Z!s4G)J-=7&U*3s`| zja%S8R7>L17&HAajBtC#OLIG)ul!>7DB?%fkl8keuyn-JWGwzCSD+{m6I^x=DW zKbX`8SZ{BVlJ-kXR3ZM~?jCbbaJnY!PP(yV-ZlF|sQY-uXh~V!#!CK@KiMF*CuzOu zY@>f8`{p?E3D&2DBO-C||2a6@+fy%E2pQzEID8nB|0Cqy6sFDn&LGvnlI$1Hv(=2} zq%iMMkhfnH^?3th|2{Kw0hS>!uqvP>4Dpeuk4DUmn+K>Oc4Z!Tn2?X$c0#H% zZSoxK^p8)z`1;?sKe%Vh8dzBdp%;T{i!vs+iWVVSqE~d|Hra}fRt%sj%5CByU0A6r zd1P<85b9k$q6Q={(D_O(;l92>JVyWVx1o~SRw?(ciI!r#ApH{R28)BNzlzb8?J z!Y806k)S~MPbC3^EHyRZ`+-=!L24nhMNFJP$S=EbZN2XOEG7sk;h$FdE)$!y?0W*4 z_ciA;?YLaXlgva9Co<;)Nf)pL+vyg8(h=|_FgRJ7k8+4Aq681~bO*D{@NF9ql#Y|5h|%s> zC+)MjOR-$!lWx-+ubM(1Va*;@**CWMn=&*+SX!cQ_UJ>*Asr)Q1mQLWQlyfXwTXkV zLm9eqT5&VOPu?Ikzc4T1BnLhliyORGaGeY zB`0lxFHBi~j37?mHyS^+|C`hDZB2_wLt`XMffeaNUp#X70^2ya@ws$G(K8jA`77d| zxC5JKz6{sUzw$BRZ;y_6N8zq0D_mA)F4Mh(jv8R?JkDsB?i*y`kD&i-_7=_CocvIvKU_u zm~e)@ehYzn*7sIfs-*MClX*li^+^?zOWs|0abFw2Of|EhKn&}td>53)vLKt}1ML+J z`Y6L-1x6NSRn?r`Pct(!(Ci1nMvM1XRHDOC;l@cAMqR^#vwf zvKrn}?X}F$e-TCLOobMTs6Cby=3*eg?YGCNF!f^jE+#q1`PJ!9X+2#=L@j6nxHX`&ee}1;*a-#{}!f` z)TVfnkpI>;+4rJm7ox}0CQU<8@%=jj0S&8JbX3r94``e;)33nFkA>*N?&8IZrzqQn z#YNelAYp+o^?}ggXgiXe2i0zHhn)Q8?W02FdpMo~OLb*XY?&-cc%lsgvfX%x^)VHV;X=xTMOp||ONv8PY(=jOKihSAH* z2?}ENK==|QdbiSZB9w6Z(EjrrEnq($+ywtw z%J|)V-h_^Ozi*;O5sf%ia)U#!4gfmeFwhuQb20DB>;kzqXktNa2 z+-JVG0k9&L*M9pwxu;=q^fQvdA$?*yYNG9u#m$dQS9Zl>A$%^MnsAf8p(H+A>+z5tDu z&8dd--Q{rOSs~$MuUWsTudh!h#;eC`U02=vwpm!?3B_k-iJ22Nhl-M`tE&?e*P$qL ze6T6SdZ!v@sf`V*-DVYNF}v@tfdrJ7epjXI&LHHV6BGX0I^6e}nRP)9H%TAikTbs&pmyEr#XZfV(qj~^t5(Nn&^p{(H3q;|bWmA^lle7{#N0G@Wl z*uhEXvuzsF1OP8bG*rSL1kbC;ZZ8wu{x#9t z3sjlAB2W+qs@_BAjWvw|o$KNoQv}EJ(ZxW;)6?4n#ZTWbaG3Twj({xcG#~&An5A~i z0Cqqi_TIcf;Vi~;l`j5qIX*sSV`F<(NJ9T4?B9GAzal_f1WHc+gpUv_5n?`=gwW3| z?M|%uy10Y=LT&RlNKm@E0uc*{=vs^<;3I_n79wgBz(2tT2;D^%dKOYu+T&^uMxRDT zk%!7+uhmtyH``OKxn&*b(7HyDIYqh`-ZC+nu>)!Wn2LGGmU$%NaCKbG-Yt<~Kir>o z4+;v(0co%^z=9YVURO-6=ljOj)}K4uEm(xOGO*=-HWwIqucb!`)Y7>H1VF!5L0S1X zw58kIYoVnHY_G?XNX~~3A8^@_5QoRa#f{{ubBIezx00{CSzD`ZZPnu7kT5bj&CU*u zjpf6~*RZr?qNcVRwvH+-wb9WT^e4c6Pfq^S&%F0rRLd+3Ph8`3bRvG#4A>)8O-+lz z&Y%yL&Z`?H!?=g=5yPvylBrBGwgXT4GdPzu00EK>11fqX57QYgd$pJi2pcZ8j9 zxyroGd*Ynn#kZ%mvzw~fdW5~+q6fhbF3jRGUT2#9~gOfqE~Ke1 zRjx+j(w3HSv9V`fp2hd?-=-3wN1_g)-0*;(KdH^Q){Cn9IU$HbnV2NO8&xKn8Xksf zAE=%)+`AXwq?{7x3T~-YRR#iapuSY8bvGxcpa3K+S&!7Dq&V))PAS5RcXT+jdF#L% zbn$fYY@A9hV%YDj^daw zx0;`nbQ}IpZ0v1rD^p25Id%8bVN1H}uaX+h(=-b1#Bn|h zeD@9yJMh7Sp57iMJRF>^_I8`8NqFTwQ|BK_OADZy>)}yiytLSTZ)R4crkWqttA5q> z?7Tb^JG&$3$Ka9UcP5JzS`BeGHWrPRg)iVFz(H;|>A}cGsv?hsBf#H}svnbsqm)|0 z&w8x9YiukYu$D>&l2>ioZblJgKLvnT!u@jV;S!7Sx+ldiV1WNd7H zetvzV6wap)Eweb6L39%|QpfaO8@%oYKeIXVG>jzD7nh*|?Wmcr;fL!6*T z*wlTd3M#$D^uDO=4$(G=Jk9P*eApf6TEMbkd8$G7?KKuwdAb&;P(`X~RlcM_01g>2 z9I_PARE9^}%l)rILNe3EkAf#A+^cF1QbVHI5@jf2VsFc^Q9elN@V;QM(;2_`lma}C zW!cQ9CaaJqMTv)S6Dn7&xvfs!?Aopj6>X;RcL5i&=2hY?f%58ZQw|SaTf4svuCPh4GqO2T-QyFKZ?R<-FYF3*-_KHaulXwzpE2lY<@HocfbRubP*R z&g93t5okEZK6p_Jn(oxJ3=CP{0<^W&Ed}7znyja|bN%{H|R& zGKZio#lp<2s;*vMYW2ty^;}bvL0nqvV_{0RJ~zr&Qrnj>q=aok%>2pe)bC|J2+ex- zR#m%`8)j#Ib^iL5zYwX-Vp_#zdjVta4ipUC0j>DRZFkAE3-*#1Z2}mFe4A9(rp%1G zH41r?>)3(!Lz8PMdn)=`4(F~#Z`vNu4!38hdK&Q4G4Px(tUqrt)iBLGuV)2;bPXdc zy}nmEPuT3c&p7S)^k1v`YurJ<*s!t+I}s%-%vWnmzlzhYK?TkeLaSgj|DC?=OrKc; zMM+4w^!wpHh=2e5*#(6&iNu>&mnHmg0pN^3;0YGU{Ocyp{6x`OWzni4Mh-3tiHXzss_+OCrRn^>f5oC+Dvb7a9^gRIy zX8u=eJpgXM1Fpznq&5 zGTX!q_!fN&Q)N_q?fg}3MdoH)_F$R1i9cG`^KprzbeV{!Po1b-JRW&t+to%H}6~(^^2y+u9}` zm^|Nq{HXp#eZ0R;ar?*?#M^zt@W==8C#098v}>>e(Nzpnd(GP<(ww>Nc0< z+(ga6tIf$8)u#$O$duihtp?%OuP>hlM*Io9xg5}y<7~ect1MX zC^TkjVQ(H8pK`w6)2fKxyz^lNT*kuzy`!QY4+1Uve!rI)t(tg%W zIGLRUXJB9;CtOEIXWj_Vnh>$*XlswOM|y1?HJ6%&+Kl$6Rx4tAM5lf%PhmWD53LV; zH&Va2+cd2S2S?(lfFc=Bw$-9W8TnStWy#ne8S_Kr5J2874~sAzPr#!i=Vz`71{Ww- zJF`W*&;G!J;eB8lOcCuKNYB2Nxv4#Aq6MB<(DcsU%4Y*(zegi0C@S`DPw z20mAot;%8g+#s&iCHrd&v*Q0WJPNiQBJuo!E^;33R49(XNfwDSQNIF7>wU)0ApM_h zOZB$d5VkvYWTKblP6O35rDrUy9n4EZMSTlh*Lv2&i9$+3D&^F|)Z5(o?XC(V%!O9g znlXl=_HA?pp4A*}IXaM0+-8oB|3gWBc=|O-s6$od(RZ%lx1kWE$;d=nGD1(}8VAZ7 z6Obyz^m5=gld@lliE;SaS2OEx`Pprtw*M#6%wY$o@JLARIDx;{F(q?h=!&@ABsRV$ zsRE!OA0`XFke2tGX0*`eJ->diU0E=uf*G#9(+Tqc1Cbz2JF^pvhqs4Cy>sT(=7bSz zSe(8S{_1IqT`U!y%`iI#bWz{UK9C>l=ZE)f1mz$0AOV1Kfb6c=hZYVDE}kQ{sXWg$bf8ghBjuMwM} zzf`J|O#r9kGHlJgC%zKRz6>ru8R#+n^f^5xC3^uOBP$y#_vGmGC|#EJI&?&t@7ucy z7QXYtz%C4`k4r-8h`)Thlhu8cm0@P1#TCA?uY7V}Cew~m(5))4>F$;H-12uY*F{`j zTVBST^qMS~a)KYRQ3&Ew)yS*z2#`R!0a#j50)PuBdOgB9=mm7PPs(qIXHKd_QtYrjRb_BF>@zqxQ{=8D+4) z$o)SofWVD4d1Dr8W6@-VDgE<<9P)6pg7x7^D0dglW}RkskENu3Bj>7JjKOZm$=(W~ zdPebbvkF}&YWw+9z-g`ByFL+qh@3ktv#C+c$z?hzj3>W&?%GGyBKK|&S=&+<8e%tv z{8;?qtbScqT)%drYE$k7(fM@Jyw@7P>xRnL*Loc@Ga^~(rW&nbNrausgX(>y;irA7 z4XpZtd=EY!Z|3a%iKQI?ISj;2K&+vU0I=RNsC)^vkQY$0^yX*c+Aqv4zu}(+0;I`l zR%^#}^gV@R4*!~2t>XiE2QGqzWo1=qY2bY!1Sk5LJ?}5qYno3313KoVGt{nlcmmN? zLsj*Ir2Qc!GB1gWaDl|qNRzuTj^g&-2f|+!n(p@`>ToWgvEtv1?wvH2cxcS| zmOQeX7Ok+H@&xoHl$dUllS^~KtkMJAU5~{NXq%XJ!dCRTyc`gFuv~L`EAUvV+ub7a zJPCxoj-1E#{}^4(&Kp{acBJSlFJ=z`aliXk+S2##!j2<4VPau1njVNv{r&spqKr43 z4{sUTtk2kWOG$ZgKIkcM6|fo1muv~OGc3)h<^R@~Rbk(fUgmnTu<*?ixWE7H(+VGgSgtLK#|a`hZ7L2s8c-LAu=6U5PX6f zF}m4JrCHyS5KXGBk^tTNJVsVltNC_7@D=3$s0$1Pt0io7Cq}|s2<2@Ga>iqzEeq|k z6gH;Tck_$LK`tBB9hLqcccyH+#cU>DqP|QCCKr4R?aWUg!_OLN4QyV>Xf`AuKg1UQ z^cg-YL&426z~ldbbN&2TM@;fxKYPb~wm4}3$>}i*s zd0R#Q$(Y|CS8#EEU67q>GG2{oV1Fq!E6c>jhLY?!lkDJU()#a}6-FN=SV8!(f;jN~ zIY9dk1k)nX1&_tKjCyJSHVyaJMuZ;l+KXks_H4#OjedDWc+*$o@Uyw~GjO$#D-U`V zKHgu!m49is+P-NsRHR(B=n5*|avV5N>dptsV3whNM@T?mYyznUaU0hRbO)qC;N2Xc zr2Xf}=H`o+MmD2yd&=_ie)HtrJInw4xs{aFIwN8!Z?>fID*dpN~a!ufJ~5~ zIDyPhT#6+SNT@eW7QLJP6YKIf-|y^D)N!lUA)u^FQ3!gR>h0dW9;fqJi$z?T`R0lD zs{7U5^)HT7w}l&IIJn|<;^~kI@@F3vkYp|*zJ!Lo!vTbbhSr~*#|)?TcD_w{91`vz z()zw7_@+A#b?Pb@Kj_6PWU|||XVvA-`|%zJ$NERb=J^$jFe#W$r-1&S1dTD!J=XZG zgJCWTF%K@L?CU%Q=dhJ&re!RgJ}8890c`wmp=-?Y%LZs1^B|Aqs-HluC|lm%J{k0% zvX@z;LJOg*!-)j}QIuR>Zuw1i8r?5p3sK>K$75oeIanR4!Wnv#&zM6VUvcXum8YLU zm`q}EX<5ty*V(Dk1yzttrjw-Plpb9+pp^jT@hZE)ihsa}15wp1LgEN(Kn= zQEAI{ala7l!;|AnuMd)2e$YV|vpAPq$nl4RCv;hjML4z%Zf^JY4juPXH?q zU@f#KyB@GH3DtcRL4x+KCtfmDp3`pb6h2fh1i(#&+fH8;5N+LVI}4Z4+cps75_s(k z{3M~aNle@@JSt<;unrydM~_Of6e#W&yiu}=S~o2n9w+GDm;Jdmxl(#uVe#9}kX}xg z%i>4em)(33ZWm@Irp|ai(?3PC1Qa#DoR`L}JjGVMlKCdn8bt3JmukVWG-C8s&ctN0 zS40zNCLSjOIdfS~Z4x#*0tv#^Y-{TMUx{`q)`huDA8+c_U(2!RIlG|fju*ElxV9dJ zaO{#JClW7ds8t9iC|Rxz$oQJqy!eC?gjkYAHqT3)wY6e6Ez_CfAH!@EI^*g!a`Q0TVdLGkqTtdOgiXuTOpSOCD~f%%?&_7 zKC5<`hYSL0+)$|ix2Tk$pmr$y*p7p%>^sVJF)Ti}T|)n+w(f2bk3(~%9tq)OI~yCW z7vEeMvZ&Uni(N~LjGdTvAgutT#w}vvv0@{CpkII^SyaOrT(~3pd@?`wbbG$k7)1h` zrrO=i%!bRD!cc;>hQjZL;N3+KuN6Tat2EI71$^~aMr6eG4}cE^ygHR|t%A;#PxK_N zWEvC;bu~3VQ=55j$UBN-1vl%|53g28hJS2GXJ-Bbkdz$e8zjTz8eKXyhHg4;<@HIV z15HN7T4tekB!Q2QjwIvaEc+t`kT*AW^`t4{<8B396Q^sU7->*(5VUkDQf_k3$TYFE z%znDRqg!me9Yh!2*H?-_aM5Yj)cjAQHxzXoKAt8F+mn|zO%R{nAEpl!3;UL$)w#nwCBorRqmwKp|mv75P zpY1RAK_TSHlOM}{X0QwZ!69VaO2|{e2F`O(d;Qz4Xh4$RzIjusYq7>@xg;&kCo>Z| zVwvD*1q2;vGXM-2meV=4FE82{j)%dwGmgt>F#k3*1M>5&p?o7IMgXcs0yd)&(4T~~ z6ofxfcg>D^b2|V3O`Q8)_F`gE1QpF(ZI#hugLaXLx(9M0Xip7{MkGpBhISmNnc znmp`9fwEC7e_Ma?{6%SLr4IAklXdPoy1HeS1HZn1kKvyx%Oj_zeXvDIO)Dr!16HnH z=bpZV1fdVXM3fAq-h8oV<>lq!;UuvhK77c{$qA4Ov`s8{DFip;U}GasxE+pnbBO8R zQSrX~+8)_~O${ES$70{M(^NAR5+8XSqV1XX)<%Rtt+9JibrD<-dF=L~JPZT&Hcp4j zAQHl@Y;Jt1-uCtc!e5#1AsM@mezO2wTv{^M`2CFvn;`U+)0ZfjB=x-gLTwH(_>j&Z zlfDw3F)e8BEcVL!@ibF)sanLJ<)fMwfleJ4%lH|J>jO@+KYUJ4&W}cF07khxf6Y_q zD#j7IhRg~GyMg}x+LymC!rtud3GL_*mD9xES+ZEMBF;x?QtSX*i{1p|E(kDwwzVB> zZD|AIxNJMp-@p4W+@!wVUr5jcdN7cWG05xG+l)OFZ#~+nfFEY#2sl$_v4NZ`{5_y$ zsn8y{Lm-(6ja6#jJHj5lO-&4JY=MMO`}@V`I7lQuGxJeU(4$@R8Xi&>OS|%Au)n_| zWa}V8nm!8D68KY~9ppH#y1N|CE#6dVIz2nF6>o*Rgui0b$GwYIgZu#(rKkS@Vw0nr zs+sw;Xu%&hmqY7Gj{w5!BqU5#htrKaaHY*ju%lV%)Lxt~OCY>X91h;Ej)z;4ZC3yQ z3^_3TM*o%Dw@2W=@B(Ok1-&Ri`@wPH9Xv(1$oZeGEl~4kyHDf_mmWXVd|PC@K6(nj z3Ry#=H{SN0vKeA>95pAEoUEN4)4Q?W?(4FUb12a zuxe5ILcmiL@DeWTRd%y4PFb;&pMOb`bIEb%hi_PaKj%sxG_?Kv z{GjqkMn={?%?_BfuU=ZkhJH~|{M5#MnLbb*Ku4_rvD()xO0`t^l%0Lp5$z-^TN>vN zes)o>UxU(tUYG1^CksvohqW56BOkBvj#($OBTZ%7U%|ScQ7KsHnw(lIk~xVSm4f3DSEfRx7WB>%WCN7r^$Qc zHO|m-)`2z(p}3&X)zDkLQc_ZYagb)>sa0ipR20qSUA(hqBlT;~?@Fxuk8HDDgZy2az0dce6?lF*^Aovpp zeV9bxasvXK+IV-#Q^L)br0W1q6|(OfbSnW&Mc?Y&FoOnziHV_j zK#s*d0|P3`(0f(h$Jq%JfEHFd01X_TOl^!+ghrfG zLI)nDq@dubruHnJTLHM3&{)?0(i*(+`0ja7@LNnwE}bj1fRXp{A;~;|79S2C5^SR1 z#6@4!e(+^IIsQ7)japUt7M&K~vt=im7s{=BRXES^qCa^(ieagq?Kc`7B^xVeJsYV> zNQi5v$N#?oQxZc<44ZLofGPYCa5d5VT_@lN-5@dPO-zlujKanA zX;x7K2%*{x#5OSPpltyN3Ucan=glPbs$fv%0zXVO^6uf`n3h@OAt7|e9YF{KwnOMj zB@5FLf$Mn!TDv&e6L=UN9^x?eP+kXyw);x|a#&aoOn9^h%y~iA^U@J;zV!_Q9RgDm z6Xp1wz~=MBAWKe#q%}z_zL(R_5y{t~Prvejv!8;u=e?WJ`#E`TjFNjKQQ$69?dws8PTT7 z19)#WHkz5PnP%DZvlCuw6|tK1uECl}`6UgpQElGLXN6A6Ennw5rpG z=}+AdOT&|~ZrPhXe5Y>CF?=SEGcpts{tySsw7BDjX}E|f(@SY<>I{fh(<>$c_NnFL z$LokaubW?YcWN|#m(a|?fQ!!Mp9AB$5vjf)E%4TVNH#^L#^tRmF{f1{M1I;{7 zElNHgR&nWQvt(+$i*7_8z7X@I+#vQdg15h=fj*l=V4N0WH}nihFG^mLrIB* z{N$;G1Soy477>HO*b`@(FfVTI1vE?g>Dz#S1FmP?JAjE899-xh*T`nqvQ`KdbI%v} zc~0o?px@3jM_TEck7ppZi^B^V#fi$M!_}qzrxTIPuYvfI{q3#6pQAS~nikq0K{W#8 zBB=TiFanU_kU>i3jcIwj?;D2dT#}(;Wg}H$t=@^g#4NbG_%q{0sDd%F8eRCXJbeu< z4=RG)8Fe(`oBD;_lq3?hulyl<`$%Oh}C7eL94q&cdU33Hi}1N+0>5q7Exhg&-PX$BPs#);&J9x3x#i`DWGW} zz|L(9I*fo+MAOB}c2f%c;rYJ~3E#`8l`@Y_4_DV^T(GBSKlOBW~XQ^Ww5^Q?H0H>#oo!b7~dX9yg|_YPF@i!$`&d1!p&uRC8aM7XXoQHKh%g} z4<)^_keRY;3?3$QkL;aCI|h# zQjx-64vHN0_^S^)cRY>-XOK>GtU|?F9)DJZAZyL}P2dNa$@s}o)kxnHw|6V<(_3_H zwRLk5@21UuLp8@*2ePZ*opB9Eo2opXFY9ajLkVuU#Krv9&SJn$(ok2O$w@nvt^6YBrAS}+8jG| z_9+uBP$8x@HksErJ)WEUa{lb>Dm2maqS;-wN=xR z-+)g~1>IxQfueJf{SA)7oSpSchlyg+cYW)Klt%8Rc&G9bF))Q#QXtfsEhlWs29*W! z2YdN*Gzv;J3N)JES61A`_p=WBWR1m4Z7j$>BXM-;tv9XzpA%0Hdk2R^N6*H{IsOAA z*oS3|RU|WU5Mf~K#i)TkVLynRf;<~2W?35&qbmyPCar^u^;~4l+;EzRJ$W|T;}mP_`CVP_ zu&AX%47SO8(w@Bc!*m~>*4GrL9E_#&sMl>^9-6vpf2;~%^>#? zZjpX-DEZKLG0ooIz-NVip^6ps1{6AX;X#g_)|$G5+U4sL!#$Xfnu+Lxt)4Fz*vz#W zu72jNUb&-pgc;s^BWfYw@>?2e16oEx?4ZkZc8ZN922&KpvP`#T?R*2>pfTBi0?FLft1gt!omHH5Yl)-hmH zlP>&_I~OHLu}$22q&=}(t!Z~?!Z1b82_(TSs}EnkJXVu3r`+G?hscv9DlRWi zXh0hPC_+rk#B0O$PV?=2Ajf@>42ZY5mB&5%CMNR(A_yrTntQW=KB%*-Eu{~2k zR(l}(C$YgPD?Pol+|i$7(N-gp;&ipdZg#4kiq}EEo?0X_Cs6E(>Hf&I3R90qC2ral z7Dtg`{xHMTeXy+7igbt-=)*H=1#LG-ymbY{Mg)cQK(P*b)o-->Vb9vTPTc3EPReaQfw6pphV(Z7mX?O)fjp}|)62-CM^S_`8yh`yc@lYFXO`jwLLWL) zs+LKqXtP}>32MKVah)hQt>agZy3wjq9MM_J!PHfVCBOanq4EKY7V`rF%vqYSF>HX@ z+0#BeGIDfsa=zWc4vAptV~4RfbH;o=3#0nv}vz37a4X{d*rBLT|@#) zyZU)a?OMY=vG}7|w#XY9u1JqBvHC)yNYkHp(nQggggd1bn}iqrnfqC@Gm03d*)r>QkXW7F-0U`f|9urTt|cz*TD7%bXT~9XTYF&rp0C_3 zfdJr^whJA7iQ{a}oIhtcB&D7U4{XZY|2(qNm-VjlVA^#hz5+DtBRYQ@-Spz$JQ+Uh z?^?a77{A8Oeo}OLJ&^)YhodPZj6fbqZ;3_*?V(4 z`CUY$pW>0r@ODO@Nycyb9|)Fd24=jeDunBLTJ9*q!GFInJkn2BHK88O*CfkZWu&2t8j2VOc@~K&~o>BoATh#NMne8 zsn#8q6$~a|!$z^hK0%-%76wiTR}h0om;2a~QJXU@7&4Dud{bg(F3qHfPd1<>4VIT% zsbv4``R7j#KqNu^UcQD6gE2CW%<=cPz4>|ZE320-4MBD9J|Aq@k-)&$So5dyjN!5( z9k>tg*GX>Toeies!~`RwMd0R76P31|Jmw`Q(=5su>dVs1h4ln!YiV^R3OIv|i5ifi)L-64-TUC+GDpNq!_HgbSCpJ_;ut))d|e{T*_wzg)#W4LoW>7|)j z!8}aARD>ZgRzZHr&BFt>DiK%rgVTym%LZO$w|apML^`8Nfwz{2()@VRaA($NVu@Vyjt1@WC+T%n1q!rqgAiCnV$ zywudy=va+qW+Hri&*NzXLjk%uktI)w#}FPa_dZlw(SZVipo0TmFbxJ$AkAK+TPx;_ zgHYg3i4>_)tlj;U`h$N=%sKXOhb8sJ^vOW;LPmH>s#5YzKM>tEoT{0+enafN)6*V5 z-dyagOGceNyzNzjkjg6PS^w2q*a=$Wfiu6$INHKVhUP<&{V-J2-eD7S7QB3A_&3pN zl$4eW@{X9T2IBG8Aa9C>h6YCJije0<_ja_6cDl-TbymNEPSK$a@6CWB1=ySm5^7DgLT$xI{zsu~eOdgo0)LXQ-wNX#} z)*M_8J4Idl8NX`Oe!{l?4v_}5tyr)YQ7ir?j$JifU;E_xabUBu8$vy-?{l0f=r>G> z80WX@d#I+HB{qHX{GyW-!)QKJ!29S>rn1t#YT$vwO~wvCB);OO&{Loteut+WBz%{g zikVsH5snfG+IY~nZ}**@)ds`E!sQ%XDlOI&Bgh&buz;G8pW64H9=#?hT-*TLsibIP zG=v{O356!M+sS-?CUHf<3r@r64QMFatmS=v7O~acO%-$Bt0($o=f@x>W_gc}r`&O3 z=igj@gdksvfbW%}cMdeA5H`v#EUW*B=LuE^U{}w2S>y#MYypD_9 zo_+hoRZIeuXH6hqUaAwLt4@d4ShKDB^PG`{&-CDvy{N3Nv`HMQg2HHFIIvln^bNmS zK|p~A8i#RNlpSC>)l}X<#q+Ssqa<1Oo`{xe^WAR!x8snXi^v6kAr7US zd~`H$2bIbM5jwtB>?aIYr{ssQKBAyCO{o5Us^8(y_;uEVk0?O;Lz__%*1p1$z&svA z;I6i;ihtfr_2GMI!Wt5?a~ArQgWz|iypMGy=yGJ-w-=KI+TotwPui)fR`&b&^hUqV z#w0q3c>H&YM*z`33(9i1!lIw01O)6*P;{>jvbvJeNMj>GXy!SAkX zmH7Lm(LgIC#A8S##Uu1+HGUd18_QO^L(=68x#xHqklJ7p(f~Sx*K5QOZrk^SMi+G_m_`*pUSEt!oof4CMHc}F8gd(KGm?#9V115(HAKC_ANS} z!Nj=<oRb|4PE^mtmxuQA9kci>srZlw!Bd#}^>; z8nfQtUp>UQA^hSUhYdGSkOOx_VBG>Foe_vk(4N*;&(|=pu*k{CxGpic3Bv}OY(7`- zE=6yNNXj34X+0b4JdcvwP<~)ZNakYr8+dF-S)SdY%s-RGCl1eF7nqFe#3QKyXjm|p z67n7G-5!q3OUJkGq$Ffyi1<7n4ZlrW@9yXTeZzwT7prEtDc<_~lhNy4u4%s4U|@gt zodX?F(3!6}2Ujf@u}eTqczANFVTqJ5JS754z`P8|_*a6?;Gm;)^>zb$ja?5?td{wo zEWc9tRVE^NH^f>V7@Eq{1*V`KMSUD1Rk+}uF4;p#TQ1g>IqbTnJREKOubQZmuD z96#0kMSpsIqCGhx?ZaQIBiT>SR5~H8&j#>YxhC-)5YN>uGwtC9ArT0Qg3d!@<9E*0 z$M>{8C3?~DJZC*Vjy$3fa-!Cr=#Wg#Xg6HVwpz+9an>N#bq=@9%vPbIy^kI$x^VNl z)S>GQ!$ZeJCqGfEhhxrBLh@r^LvY^;*__+XZZrsUG?lX?2KE!8AD`Fv;sl^DJHa#A ziVei!+_2cXOTSt{$FmF_t*te)%UG#(wbgKYeZqiVz1O0-0^ujDsECe-7eh)ahouHK zyzryb#`}n4L_a&+KQ{3d70xeT{^^RL=dd0Vyec}MKw-A>$8P11{H;#kU0RxDvDpcN z)?;)Eq4aNsco$1Dcdk?N;i`k@6=bIUCD>7|nG~FYEG(=;JYH@A5-OdBIf_>jo?3k1 z0N_>};RTE@vl0yzn%6GriXwZtAWY$6zm)BEUSWkDd}n>I91c_vYz8o>%#&zgqNH5y zi2PHa9hXN%fbh$`dPp6(6UxfUfa6*TiXl+UAlRVIv!cD9-yp7%!gTMx8piQ$Hh8Y~ z5$5!#B!0hg^2#VE3_%j?Xpjl^=y{Fnrc%ZEfVgyT((k61X^Uu5Rj=k69BQ>tQ1p(Gq)A_P}m&W;}Q@sR**^r_wcO7+zpEJPhe zBG3@uW4re{QrO^yi%UaHO#JJ84qIMA&i>kMB&4(#kQB;VT7IR7G3yIfQ+pSa3VAFt zT!fw_z{T;sIEImT@YTLU+%GOGd&&q^6};ARLr~*h8c2P3o12`9i)(J7n-fB2?W35k zrM<6S?sx=ohITV=Zl2jrdjU{OaCNw<2s-~c6fsRraMO3I`atS~0aSzaj^1P*sDRZK z6a--*5eU`6q4}T5r@B5qcj3l^YW`#A8_2=EPXD$}B=f96oQa1AN zsOhMJ)cE#oryRI|Ul-X$`1$$Eaz0~c*W3=C2_uT|I6N?KRz;)*(LQ-{y4x4}P9=rk zdmZwq>rH?Jn_z0WKfMLqP+*KM{NI9sRR3SFi@nYT)hz!0n0@-RG7u*++u_*3D+L+P z{eXd*ho`Yb91jlOCM-a$PrV0dvB{!0?qDU^?ae;^8;CIi~B}wRLpFoQchud@j$8B_%U1 z>ss5sa&kH;6(98`7yF#o5t3mcv~ZlAM<7ePpF_-^-)EK@rvAST5Dh%lbfk?QQ5VAiZL6kp2_J8)|Nqtl4 zjziPoj1jC%xvX2no%QjoRG);XD97#3!l5T{ILoo16QR+G4g8uH`ugo7BT^0Z&Z|vm z*c4Z}S97iFm8_l3)fRpizU6tq;IZ{Gm0AZGp_R}Yn&sif$)WKTj=!}A+5f&ry>^Y0 zg{bHcsH3ire;P#;&8g8e9b|XW1=`r4+OE_fn=xQ*oqwI(Sz4Ov=@}SB0Lsg#Y}nZe zj2Ihy&J7?fl$An5Fk(iuFF3FfGGq(_m@7g}63(M4bd3Cf*~8Asc?9LaRiy^qM{jQu z{>JF*YRB?RW_?+?S7Z42sJ^eMg@x4BF`1ksZa7&PY$L@ZN?iMs*1y&8^QU!*#;-s& zWTdp4@7_s)bZ{0$43GkUc6BLVz4q(R0q-l|KSQM)9ew{QdLgobqFkjS4jl$HqtgSs z`OqZvpwGGKK8UV1!yF4sc3!=#V94cfF75){Gqb8nJL)r%V5pI$<)@UCObHXM@mdZ$ z=BwZ(I1G{yZg!U!=k#j%9esUSSKHO^*YfHrgAV6oHoQ~^NT>{8lPoQX9=piMz_^$k z!pec+`3aw_#$J zgEvS5uX`!TX8rdu$45?OmF!v9F%lV@R8*(VO}n9>uovUj0|{6zCQf1(+HzG4{#bEpG+6=?5+ZZERVyDtFXls%al4i7OXEO7Mqg79@1i4yffQE@L(FPzwK;S z-rU$&IKV``a1!`y*-|h(&b|+tESDn6%8syJpj7tdf8PQ+(5TmuD|2}ky7%l@u2tb z*D}Ndh&)w%7s?D~c59kksN@MF)ECg6Dy%V_UdreD5H8 z2?~%jA_S|MS;_`~O)Fk?ceI}R3qBzB3T>aeCk)QCb?#BnY|6fKa~(OV6UIhPMiEjH z63Sm@4|hzG3JNlV#adW=kp<~@&W=~>J>}UnsPC!r`T22_tV(9_7*uCg6r zc<%}OtMcb}K@hWbzWzS=HjBNgJ6MEa!8gwYO#o1QvcGG&ricM2{p>-@DPsJQtgM`| zu~&czL+tpEh@ zAy@kP~Q3TStd(C;)no{^L785$h?dKGxVs~q@X ziXl`~b?}$k7Bf&%hT<3+80;V|!;K{+*ZV;#6DtjVrM z#rCtp*XNwJn?T?CU8wYbJ6LpiS#xA$a}yKzy-V$6*cn$J1T90mwfm*p+Za8I5AWWc zTb-Cgfy3Ti0qGj}GcXS@fkRKs z(zc26S%^qIX}9LlxrL_C$F!s5;`svj_ZOw_Bh0f~KgW2Lv25r`SUC7FnSu%1LMlX2 z&^+jwIXRy^(PhA&7}Ln5x(~f}$Zyhc)YV5J!a}i20Gs8%2V-$`b%nb%?fMLJf@%R5 zSG{HUj~II2^HaOY8|ZX^=LA_VlrV15rn^3~vx=*uOc#FU{p==Ush$L`)sOgObed=a zpAE5c>fqk#Q)%zl3~Oa%>b)Ob*WDdjMB5iPYL)nnP~&i8i7m8sAd{QtOq%~5UqO14 zClFpgb{f-l-9V(#0l9#-YicT4EW;p)3~nq*(6N}^29I{#>-&XK!pZ3`q*^}5CO65y z)ah_qjd0!xk#(juC&0isnw~BUnR~U$6#C{3?4Pv3k~XZfyruQf>{YAK zG7yih!1~Fz$K%9Nyi}N@d^pDR%EaBr)J<g;{-mv$jLif|~G`Uf1T!@}(}wL#Q` zV_~5gwVQ$Az3M$Qh=5xcsA+dWEdVg+6>iTrZrp&Q*4EbMaJbQ!ebsGY3>Bq#$oxaR z0lr-u!<#f_Xmki%jD3rkMn|`^wjoMM<>loibmbJn6MFS;cNde4lt^3e)4!op=|*{x z8mtN9g`ELk=hIu{GHh5zs|~&0jVnCI(S1i52{mdZRUDJR9l;~}Jiew-1?@*@vDp%;@FIX8<+=80u9c0+Gh0sg(c$4eW!IuYRxf0oqH!x0e}beD;=F z1uk{6uJ$=1t`bJ=n58f!FLZpT$>Q=BuD~rb-{Tjq)|Q%q3AG zgN4u;)rL|$HR4V+wjL9nx@b}&k-PI_)3;xeqLdd&`3OnL@(X)C_UYuVLljy-4-#Py z04|{CO6GgE4V>znUI>Hz)=N$vii&UjkwzXNA^Z-7g-O9-2{dgwX+ScA?aS4(!9E}t z{rA@}?}!{7-2&^5Fe4yzyXnhIEWR<_ve9#C-hZ>3npaZ67h*U3{KB<=QSj1z0XZEt zWU4wUD5HMgjHS)KnlSK#>dZ|(--p`gxAjPSX9_T=0zdt}^SpH9l-bGVBrl3WNO4q= zXX!Q@ogOYgs~Z}6!5|qNwlsV-v*hr>YhFb)9b)Yb$}>blGsHwF|0u=7qop!c%;3G7 zlj;<<4dv*EipE@pNxxVM+NB#I8Bb>}_6AEb#E!475KJ?(#H$3^h;7Nvhk+l=`tT0%d?jo*8Z$lB!z{xs3`$NAYPEXp3qau~Z@>7b$2xKAN=qxNUfmBj;C`TH ze)f#hd1dGWxyZZF(Erw+_bO9@+%y*i)dfQz-G2v7L9Kmn07r3wn>zRXasnvO)znPi zjV}Jf&(3-7?Buo|7Zf7yx*8m;@2URbVt#mmsfR>tkGM9XHOI&ybb#{YX6i}M<-tLb z08@9z&x_SftDSR~O0}jepPZ8lmjyGnJ8P599ua;sJA-8PxAZ=Lj6-(z+*>j+Fldp+ z`}t{G7D~eFt$Yi%vTXaTJ-h)B&DjGLj_dk8?cveM!T*BQEo=5X-^-01n{)+MXxiOI zZ4g1={Vrb?^zn)OyT83{x3-o~!~p3mA?4Y4wS$k?k$}I4>68vyeoo^@v5cNG3gv)JMsQX4+6`_%7B1T7+>6G@eU~WXxU`*VRu2He+1h>UZlj(T)^ABJO-8 zujn2w?sWp+fBWKORY^~e{3<>1^8j&90r#DEUbSE?_Xx4;{(5Dy?ikW~I=#z(vR~nB zoLB*d97J>X_nrAUNy^n?@E*&{%bCFbJ@ZW;c!)I;GU+CBt7Lsr=weG(Z913{ZK2U{ zPU&)$R+&hEsOa}AR}M3pV0J4nh3Ehg8mzEjUta>olP`*tZ;=pM{E&AfG?f^&v)fId z?JP)N-*H~F&~hFgt%c*3(%Rnm{F$4;@8q{{o07P2ukPz06*|6GhM@_B%G)A(jdGRc z)_+1z&H7+>>aG;|S2Aw&Qb(qxon}v2=AVprVyD)f7|dNXW$>pyTelK^W9%f2>7grL>X8xDC; z8LIa@^nttR;^LyA;oBz6Dz!?U8=XN(etjP+*v&RSQJrAYZ_WEfv2bYze zboQCiyLJ3{TeiPn;pn(ZG&r|14$(g5E z!4RG3Y8I%#^is5ujoy@JtTB~wq<4gFlV=UJ&c-TTgXb>Zv25aA<~LAK zlK&b?2AI5h^+ebph@uP$1yPRwU>2?48VZJ!`OYW^0@vAH+Oj!o!r6t%^@;;tC^S|o zb7vh8_4xN$d9{$!G$$L$O1w`Mh2O}0?PtnS0ju~WCoxF5@THp^*-x3$bS9H!i5ZnK zLn5)%p597&M32=c2YU8~dE)BrUv=eVb@MVN=A(;ID3DCM)hm!tJZ?YyJo+-esHiF; zBIJK(rpE%3wZIRlJ|}OltA5$IgcFy+uP9fEAcC&mJF(1W;x703c^oQOJMSO3Tpx2* z!k(5E&25hojpmoE#d>iX45lU74=2zVg(Ph!YsW%erWR>So%9`-m-vIk%&2+C3QOr< zCn?Z&{meHn{`up__i0i{BhzG?qEiq()}WlsVLPc&{IUr^joH^x{(ikjb)#pTvgQ-p zp>ZzQhp}&3KLXBNh0n>cEQ|F{In()x`(5D+UoVRms(a{BzXb`hN|k=T{8M;%uqyjQ zky?82r^`}E(mWi9gS5t6QtokAV&4AR6c1|YmPsGCw!B6XZ}q`tH~j)7@d#5{bMuAY zFpGyw`Qm8K5YGf^Z~ikgl>Rf+JH+OurtARAZwbNPb>q#QgJoeI|Mn^%CmeoKDJ^Hc z5_GmBz{dyPnCIz1j7rGsgTEV7ThJK#lt4(Y!GtfZk&oK&CpZ7Tl{sw<#Y-&VbOpK? z(3oIdw>L+3_-IS0xvysLmg@EHbR0T}u?#a>`&)w+87p>2cZJ{c9C+ipmp-G^nJM*` zG8eOE@1D|?ew3YkX~!7R4$@94x(o=!0@QMXPl!oKpu@on(GT8c=RnC@+y)dVfgiK6 z?LvcP#^;plDgpN+H0uo<8`J1SJE(Wx1!F)3xN0I{h@7wSy!Ipo3?z0JnHV&lHM(r~ zBvwgDcb}bysIGIlZ7Dc8LGOEHU;w04_I7ty`%}PaOt*4w_bJ5p^ERa%Tu~s1{Rj8 zrqXZUhPtFmuFnrL+&Nu<=l*2IF#rEpfI?tC!&bRYozh;h+g*Ug)b*G~Fl>J{4%WS^ zYIg@C^xcYiIf7O)m7jE2d`=Zu0d;QiI6HruS_os_zLkVupe<=(u{?a3n3!0kQQ|e% zmKsjV2i>k(qxRm(N$!RdaCUhsp`z*8s4@8l)enZf5>(Fo`}(Is?y-y$P$_1#ZN8MW zP5K%hLl`P8No7MB@^|fl)YGYy%uICs1{v#O>&0H9w{I=zfRmSoag|I@K?B`_bsRW6 zGFKIqpBN4X{l-khb)K&vND*23`?5E%(tVdqQu2uZz6up3rPccQ2_5C^=LT$u!|)HY>-%Q{d>1g+|cC~EJW7VOmpo+3T0 zr{zoo3dmE+$jDFx!cYV3J9jf8_`#KG@8jd{Yogf`y1$^A z*a__m|wyo@{yA;|F(+g0jlRD7$5bd)KhaFsSS59My5$5XGp73IfwI;GnZsX z=OWgX`%=LCC=sPa8m7Vjby8z{}PHTWX5zT+52Qh^XZj!LsvQgb5b_kmr`E{ zGiCkn=m5@$0QA&UJyC;c5AU%ECMGTs5q++RkY{9MBx8(J-exs$74xj(F3wLk$4XfE z`07PM?(Cd{K3LpST?k3&o6{z`)eg=(^KYFCf0-E#f^11_tfEn4W8-BgLDA2i9*{DC z0rulmPN(+pWbiG8^@UASFjeb2XV2NtfRcNs+F@Y@$gH5|QeLvm5F^!idC@*UAAOfH zcy)CZXcZ<4U8+JtwQjtO{HdU5oG5Va6kN3F7e#aVZ#NWR+(k*L_(N2Y5;u_zR8$Nt zS0)@6g~cNdb`Lk{@7*uv^iX+WXt8uxnC|8anRmetD&=cxEdTur#)<`ky8h!=|D}}( zyydCdDsVpj3vELA)Q!bOac5$`$|5C==wzIPC?`seg~BgNX>B93_F=zuC@a5`_m$FU z556g|puM*fl*!dxYHeU)D=GKBm{nUNLH5=_#TIkrHp|Ld_wc67{wg931pkyVF+;DL zO}T1{c&~SAGWY&DSqBJv;tIo@ zB_%Enn2l2%9UX8Zjqt;qd12cvGm|YV)A`k_fA*YE!SVCg&wGZG38WVk)PqeOVHmr8 z+UC(Vu6*i6R_-j+M*ySQh@?Ch4<{D7g^r0C5gx8tY5g{JMo{=oT-;*5rXxhR%}s&# zIQJfK(mZ-ebv0hug7*6@(1A0TJ@vm&5EmOA9TSI1PbUgcop%_KfOE{o>74kilp~{? ztg1-#IN%+3y!OXhZ3F}{lz^C2c?G$VvQ z6y%hqSwuwmI51Ls;IN9wcq_YK~B@VcOQj7^x=zX*mBtf+@)99(FDCy=F{r0VYXs8V|lMM|MqLj@*q#h6~(5gE> z^8g&d#+0Yp`S9-vS3tzfAMcI^1-0twJ=M}mfDCeZ)r#KYuK%9Xth@lp@pe1Y3KJ%F z#J$kR)6=$H9Z)BGm>>Dy8%{a>oIE%@%;zxQ5zD9zjN$8sR8s6~F{{7rq<-A!?`9gp z(0e6oG(SD;9bjf#>YwV_^hCjAYTf+$v+s7F=kAfNjQ!d=79qD<8#{_D$(i%dm7@(r zT2EOib6IKgcPE6Oiy3s+bJxME5De>2PY*L#@0L@Vm>>(^ipwMSeL(0D03?wtj)-#x!%g&x07ABitz=Ii#W*4FZQ>}gCJ-@A2Vb;Mi#7U*6l*70+3!NoLT=Lx_Y4d;(%XS~P3HQdq- z1~yZXI3JUfjZ92*eEmSx3|#LagE~9=TwV?-DkC%V^q9saps7$$NKgZE3VXprneNFG zw&%}j85m5NAF>k4UU?`kgB8~BOi7gQUf~5JR$QKmPx@crnqK?uu zQmrG5n{!|T+rL~=OG}6O#)yjLrLA}GF6vYBPvY~$4NEk@mKW!9K@V7it$Mw1zK21d zE5N|WC@OEBHD4ctz+#~&^dDYdgtgWRiEyW-rIC1kaF#H-C%Jw{b zdh_O4aj^tcKTyKM-B_eghbmh+;ycf+Eih5rB(!3cTvEWLOH82H|P0i!6`56-as;s0Zd5>wRjF% zURA$8^YRHWsjdzJbTeH0f{FgYWVF&RUffKb*}BYM?*}hg(0YJs)t#5rLpKly;N09K zt8ax_vT1uH-M&$-x4sg|oBo=N>a<+-I&Y!`eQ|)}aERluoaRgEXHKSbNx7AJkQ-b1 z^o@J(Qfp#J6}<^bs~l46gO%Y5=zL!lJbo)W)ec24l7q7r_+hb6ztQb(XfRneSPqDL zdDVcEwa7(lb8Bc^MMcGe^d86z@u!kKe7LZ&0W^mA{5zW#ZiqaxR5x^uk>*s)*0Y83mrT#jma0EVaTU${Blym9_ajAD8%n z3^d5&ipBhEYXjhym*>wlf$sCx?f*x;l%$ zy}Ui4kMY5-FPTTN!N9;kNA=J8y4vuw#OFrkUIE?1*}KEC3G@2S)%&Xi-5k)a|1~t< z5#ob-^W4OIY)hdRb$KP%W~!#RsZ_7NW_+AoJMJ#P1K{l|2L%$ml%n19IL=V4^I!mFGp^p!mzDe&xw#*_5oIMN`?=gzsB{XUW2 z2~k=P*wZ!G&w@!C0lgCa~=SP|y1?2)+10tF!SI`OaGotC!Cn z{QmuW$L3B*MnM4y9v-7FEqev}K)7;zyr011`ni%F-^~j3HY!A=_(US`f09Yz{ngqU zi?hS~TTmrMUiHhn9WUWG+@pTE2*#@kt0n33Q{A<2;%ZJ8YnCK-_Jgp*ME(H98ODF( z<2q-P$;UP1YF1?8kW?JU<{`x=}&DU>82y<~j|7>Bl!J#gGUQ1VOWb|QFitNmVX%^ zKCJE>XoGe|j&c?NH#cW|KcuD#xNZ=Oh_sB4?(FRFx^A3>5pe*wFFA?0J&b6#oh$_W z*RFgIq~i*2-FQ8aF@vrC*PhdweFA!$&4Jrla_3W7@|(cRjsHX}@anG$2zV3}*tofU z`%3LPUM|1lZUGSNrY4Sz&-aFhHDL;#!fL@85h5qTGB`B!fU6WjptwugMt(hyzW2NeYZvvB$kd?r^ zF!a>XU=ynR`t=JgGLTmSp~g?sxM?L)4s*?NebJJc;q`IO_78;2yON320?Y<%#=d?| z`m|J=xUqKVxIbgKaX)Q{9=ROn=1s4s>hHDnkr3nP5Ku|^E|S~4x?=-CAGEC4+@4$1 z&-BqX#=UcqIBrAKnL>gBRc8H)nyl20mXN^t{V&`!ZRG@yz9}%89^S!^H2*e_H z9v^}n8-QwT&CCdJo^=fmXZCi7J$TN`&kuHG`sn0D?D=GT+-c?IdqX*cfYPD~lu6~c z0Rk`^eo89m_8f$~^>I8<&1Mp~IGPG4sRe%Y)6HAqq`K#WO_yHZL8+C9W1|mbDfXN$ zHfsAS%C{<|H17}}l^n=9W1W|NR(UJ>L&5E_0L;dFOjQe7HE8?=Y4N4!%g9DEIGMtG zS_RU>OwG)|t1uZmUSWK6RD>>OSU;nnM^>^Ede|CPsEG04OU+_}w1);*0<9qa4O<*U z`amK1X4galwth=dKEvEVM$y@s&&h|VH?7T9qp>Hamj~oD70xXaIq#*}wrI+Fs z3N#jLw0Cs2ToSOw<_bKc2_}2vTbh;8ep`G-wab^T(lx`B=y6a=s5K9ZZ=$_!aR9;w;VW zKgo#k(Ev*=yJ0d|lmcYJL9rRbM*;8F4T?w!ZSC4#GZSV__iCtizkcB*Va<-Cpb0dM zOLX8^+kB`;>H0wHqR&ofZ}rQ~ZuXd%tJGYNRPI8=1DotG<>g{{+y2=>BG+m|ymFrf zfltZu*0yx(=Ejikem_dUUcQG5=Gd@I(bx4_x99d_#mTo(=>dx2xOhjFr*nUm-pi|D zs6X4toC)TE4hvnM{ZTHBOYZ9q5>TF{;dz2zwm%9Qh^7AdyK`Y$zqYmpl}rRNml8#! z4)_7|W_*(Qs=-iL-{^aJk<9Hp4oaj7v>*cU9C)T>WvgInaK?B6+r}0kF93kW4_)~8 zj~$dIZjMfaPL7g}&g8F5>D7nd+l`sw9fBIKC`Dv!Y$>%nEgcnN4ftwwY47S;=>}+H9+V8`|4Hu>P z`MkQiq!(Ebw~=PX1?hnxk55Xfr=g)yA^r#lloJ;h7Y8p>MJdp+vHLnYvd3FqKAR`X z$;koj6V+1-RxNjTD4~jOkqf79ogMGON?-g-v;)yj1zMd-YfTA>HxUsqvX(VA{_^@t z2N$9eSf5ddSU`;ZZS4YtX$h(mztk>YIwmHl6?=PnRNFd{RKzF>-*6tfpPk!;^GoZX z`ACBTQ16#AyS|dsP)9>jVp7fCzBD>iKg;(-9Jj#J+t20igx#X2XJe!I2f3`}6*>=* z=ifsHM@Mr`=0+ctXejv#nPdjaWtpzu&QZ|<09lL_q*(nDX~bc@&q^PDO1${iYnCOu zGjnv_9Kvy7@37>w)EBy+l+`=YzWN)`l(L?p8F>#UZd-a;f+czcKcUy694Ij=;)eHh zbX32}*qGT{dHwnV13SV}i5uaEj|RKf=1PMC>S=UxFMi)&UnB!iu@YDab;(mb4&tB$ z4<2Zo$BINs{4g9ochLv^A=oqJ_!p0)Odum^xJQ?y8QQ{+uipl*fOoej`n#NXM2sDiNF)Vi?$A&*Pfhn3(My*u$ zBwtBt7Fp7NQmeY`ug22Grp_{USuwvD{%hf1*4CBv3TmiTp7}CQ>=f-!M19F@F0G}@ z!sE^XQKs#voz?6B?K(GT^5I5C@E_z4&K-{FsLp z9%vVQI@^NY&jk<_K*4Byd>jS!_9wvAgtSzWXrV4HEHFY_3d8^cKNK~b z0iRs&U)?46bJ#k(BN4AGR1XL%cfJm?8q@o>}`Er{x{Efx(lGlZz{7 zCF@SV-w)lX(PeZq4fvV`h=?owDosFpuz(xRSrOIB#e#g%E~^wCckUFho9H5S@FXVJ+WX~ zX5hZ6mX=)Bpp(-x)=HD-E4&{7gmeC~w(qEgErt8lKP?T>z2VgeR@Sk^QKmxgwaB?R ze(fzIveZH=wV(VaqYLiR?Do}3^3-?Y1SX1HtI&PU}{_zaJ$4 zLaFX~72R=bh4*6b6r|lsXJlwxBqW9Lnk`mGH*efN^D~De2=lAyYqd>iDAHWc4CkpQ zZvTWx6?i2ZqOPufC!`EKw*Z~4rlK-b=;Z2369^U`1$6gP`!)x&`uvbkoSdC^cXt;u z4)5K&#|_yapi{Qp>PUE8z%uX4LC(%D`2P5;FD=1c3~wHwJdIN@6v1%-Q*1~{TDrTf zw*R)8nwr9i1pzP+d~(|c%8xT#x4@O#IXK`4v=JoW3%G6|;GPB^;eLKllY#Nh$?56t zv6uS=emO4pV_}o)tA2+`uLvY`J4k3<{Hj$YK$qD`u4{@= zKJyDe%9uA)Rhnz_>)PchGnFjDUT?CW*&1iNF0O0>pV9ri*%mU#o{8|TRQNh)20e8* z{mB~Loa&Utcd@kZsHrtHYUpk#Bhpu0$*pW~kOxZ8MdH&c1Shyjn;1PW)DJgmP?%lU<--0q0*rHprd$xy@z=_4i zzyMeDA<&$$l5y%ZEki*@mP_JP)X)GaC{Iv{0dNl_jxK9s&tXM@^S4t91mA&Wr*s9- z`~p*;Nzhia+vMiwJzN@~eDuf<2m0(CFf0aC?|4toI!p>+5Tspc4XQ}}X+j{S`wcMH zfEWNQtt%Af0NjY|G=@x9W!m-ZZ1<2Ox(7~s>458ddbI63L;8v{X|v%pyweyu zhUXAIz~#msX8Irm0|ql7L?Uy`{cuAUBziS9PB`L0C0aonwMBg^G;BS^#Q=zIcnj@9ArC99MPqF$^QY{;Cm>2w>#84lQ^XFAPTz^15xo9|FZy(B6Tr zU=7I{wnY<2ak;pAOqmd=avlZb8($%={>ssdBxS-OGWbPv-=22!=#P!NBFBrA$ z7zt6XS!K)j>QxCF>kwriDBFe+9qN9=5d~0}cw2P3b;&dfzwX%8i-ek~6+ayuAPhO|(N;;9FIeMPq2eJ(<2NVeg$m&4_p1sv3I z0CNp}mZ5S;>2vQGI)hOa1Wp(r0Kwbyc*i6xI2F!q zRn;Nr5J6DIx_!H@uFjIUcX3y}K+D9|w!vk69NO!QdOGcOTl+-ZPUb~=_48N~?mP+& z`Drjo0SW6|bV$Ib>2VR)Hy#pgHsLq&FnTd>mNRRh@=#!b3;WeJXtggOukU* z8=A`LBTzB3@Jlz5Z=aUdo4JfJTQgjFmbAi&=&|dLEdqGsz!n6`7MC?nm!mDzW0w~} z=F7j9uh zm;X8da?A&K7DDl9qVDeQyz?Q*4`3BzVq>o=o#Q{%D}dR4jB^WG^qYVFJW5q8YqCPW z@fw%{R#sM^Hg+u@1|5@mM{Bi;B@oX70X%DK>x4`e4#OXBApZyo41Dn5flLDHGGsC* zTaL(HX#@nZ#be{77mfW(1uyF?#H*g1C5@@aHU3)d*VP^LyIRtpy?0z`0S00soNj(` zCdo^xexV>9vbY+WnI-7##=BADoJy|&;$71@${`*YpFiK@zw~lod2uQa@jVp(JkVC3 z{5EbaEeQTpmJ}RjYx|;r_NSl)f$?Bq zv%58wLBHPUU{T;b=GM8*W&FpFr6!nJ9erv_N|la%lG2z_EQ@x;=c_xvKqWKgENgMm zVo9SW;wWfkbbN$Co1Kr6vQ{yKnA^$rkKiW1H=)ME`B8mrCQW86D@TMN5oiVpwp=Cl zE!YA_r>86r-gn0_b)!uTKXrsi`TTijR~KyPyz~6JzQeO)N0=IctX_UTgTLS-{7|bZ zR3js!mgZ)V{$3a*WHEgYrBqSTCR{>?>l2IX>(JVZNlL17SdaqQZIiBO7{-FeL_|w4 z*4*wfpu1pDoKsTrYEW+(ltba&0Y(>G;<$+AppvStb{~|x+0Ovj3jF%8t$2Hxu+~iO z(9ck>CdXY+%{IBjH3=vr-%LC1Nvd9{ni&~M83K^~ID$Qq&0L`t+drHbvjG>S7^Y77dFUo-Anb=|gb5mBU@7(W6YL9+p&P03Tnd^7OXt$%eMGpJD;heWopHJOqu%(O1)MvY=a+6~N^TB{! z=VBBl1`JyHoc?UN3wOw`@~3Wh-a5{y<4sccCQwmQ0!{Clmpkun25hD#NSU+ty*gc% zsWY%OJvrfqHhLKMkBNzx7KLjxc zddF#^VHqK6z{E2);-@xr5CC(K><&}psMy%Hxot~<)jxl5aB%GRmIgqj8iEkao;%wk z$e@aKb#Ta4jE{-gU$2_!Dq^!5$%oFwJz=QH+6_wpc)_rV48F@i(t{EV{tw2D*YG!p ziHhO~1D0A^O6q-BnAIh1ZXeU7e$iA*3ovAA(e4lfexUE?&$II@EXItTsj1rO0wNo5 z4Pn*C8IjKVHX>-bWvs{nIkq!Kdh^LxBPlG^9?4hz)SrNgOyzaYOh7M%a;$Y@8jI=a z(}INGU^Q=k7J!`#-i0tq^Z$$07*2BODAl*LbOV5urn2fGPn2UpG&%i1x2}K3`QZUe zqFKt;%Zai$FQ$)0z-nH5H{%;^e{nrZJ(7qWx#NTkF{d|_E#U6Nc@ch(Gy zvrNi1FZnwZDH2Nh1#ZQ&~kR z?k3B{rBX35*#XW9T$K_zU;Pb9DicCQMcqG>z*AI<-Ci0{_wf<%?vVUpI9p*QeSR*m zH~n*W(G2wl@!9t%Kb@02Y{$h&`v(oR@bq+3|1$68>PP?#$U?9;Cng_Wf*SDw6p%v| zRz2Eo>3E%T-!6FF$P=yp4teH8RtP7jbE8X_=?jbj2j(vvW;7C@x+BkNZ0_^wU4 zYABDMBDSKEKLp-ro+d)VQ@ndqhxT>GhGKM$mU=~@oQ>70W!^~TjGE0b_iDDM-8&50 zv~131QiILAw~T2T1qvHkO{i{>Be@GeL!+8zF=h8(?7feNDTn#QY%84clg%fe@tbBg z5aoEua*Oty3ChaG%$mFZynt(x+j9U@aI0gkdvA>`EyvH~!>HFm`@Pi=5^8@z!E}WL zyNBmr@4)tjni-}XFiu+l;=kxEcXxMZdl|&I_*2}hcI&EDw)DB*{DBI3KFa||i)yh+ zI(plcso}RVwfELtPjQ4R&Q6G`$nf#hafY3qp@iWy&!X#zsKuB}=Q4T^Z2v)8vi$f_ zuZhG6NXKeg#V@;-21HasV0MU#g|^4(ed1RBcp~K7zUEtbO&vD*-ioRkAew403v#?q zm7&(lR!*cSs@e_M!rn~7X*TY zh57SGiK52Gv`=!54ko7B!);ic6w=U+H)_3M3{zQB(m&2Zlhxna+E8Hzik7P@Hx3RM z*M6kqg4BpZHE1$!$q|w*;dcKr`|-K9jz-*pbUl=htGmnOON`Z<%k62;ps&miiJBB2W) zYGP-6?aYt_F@j)WL@5+?bxFW0dcb^LV{5bslFsuJ1ELF|Cnzs9>S#iePkw%8F83Yx zRi>tH!(5a*GgzG6lS%1CQ(wfZW1nqCb2ia2l1`ONzJ=gRWV5n%aq&;jfF(#X0%v0~ z-@5ao?e(#A391y9=QKF z^Y`T&BKo_+YNQ6FA_AuN+} zUq&UQgyL{JlGCy9kdYg=88B%*d!ddSKfcFe$P;VwLZ}(L&IAU*@as0o6#|J zzkYqqdT}j3$Cv`aeRw#-W5H^v?E$rvrAEbI&OWcesrBN)daBc}Ki~b{7}rdESg;j| z9mN;Odn%Lr#7imZl{77Fq%`4B?ZA5*^EMZDer1{Ub6Fd-kLK1bL6aiY)m%@tSaqpB zD&#O)?~G2KZu*|Llg(t06jf!HmzSoc{g~1Bv;?SL4JUl*E&OJ+Q_0L<(9sOU2@|7? zlnB0q;m4s6yB~44yQyPLt*Ye$T1jWzO);w_K`%_;rL#VFub*8H_k=aml*bvj-U<&vlpb%$ab?3cTSSuu%68R}5Qz{=@jaa@%O)C|xMDSS0?No`ya} z9II0Nh|1T@^bC|+WNqeN3#db&MT<@4rC-xo3OkklYxSAW+=-19-yRY*Yi69w|m z*z3kSwwq{v{4pkC@jSN&j*A7>c;Dl!OiXw$lxlVpT-E|RF$IfzrUlz*<3We#c9n#J zn8|kLv9!Qr1BA3l^^cB&?&HY|&ed-}rnWLcQ+C%jZafxmN6Hr5QpBsRq@ zdFq>uhtr}WXg57R(8zzgA|2MKo)$Q8aRv4ECfH(mZ9Q_IYm0CqBoV%qnY9SyI?Kb2 zB4>W)rLH&ksiT@%o$mh;Am#ILpA-A}uZMo(*YS7%9<5VOZY}wEW-WqrAbt45uJWrQ zhMWH0TZs8%2R=8D{h>tew8`~E_zAtav9OPqQ;!_G;x+#_KXF9Ol$%TqMR~&C4LOHl zH#|c>k)0ALSvH5&=|-}g{LT25mXP3J)Mc}$usu&+{rO%E$}69_0a=R5V1#@k`sfb| z%4tQWnVg(|sC1q{l8$XGw1?$HJZ)A->Ums!Mjle4Af`J&tptR8M%#K@TNh-glRLjy zEs10*35%dO-zPyJ9^A{{M@kd_K5Gy27 zF)U`MN8EysK5$hAbd_B^cY1_a(lezlYG_EuA^`%76Sm``oYG8r-{4?%z-cJTme|?( z>3cGPIz~Q62Mku@4B&JElS0e0a_V4HfW>z5nWLj}a>Q+fo3bdytJRTVn>DXl;h|(6 z>}b%Z<6eX)y>@SjBH5h^mQ8`?1%Xn{v>d;YrFs~uR^(*x2?s*q3ced4XO9TywM}i!| zSVY+#NwKkxu(BjP{A}i;X=d(Qe{uo>!s_c|MpBT4G8%n1M^a!yO31I%PIQEKKbqg` zlh;ze+SDCPgn1RfSScd=WBFRo&+1-Kl#JNo;juw5O&~xBW1!2 zm2Dd*vD_n^p^*`GcJ?mg(h)hh`C-6{5%f7sxz55Dp>mX|W8{cE75;X8amq{G&RV^@ zQBF_){I}e&fa-7scT$4MzZ?~bRr+7foYZdgK!^wq=J=MWlA{9t4CY7mQ@=r0>1zWH zP`m`I@X1o^tVUlA8)$0A)YfJQQ6ls8zQrAd0%778%k%A^fB;#mK8Nbx{QTT{vsFgz z{_^~qX%o+p5G3UH-vPnbTH6B^^#Btcy?=b&_fk76UF{jXVuIpk?4`F7R5k9q|A6_h zyR&nLn6rQWH}s%>PY~_cIKxm=RaF(BTVffIw*Zi4YN$LphC5p7aiP0fdJk0VtqTq? z{?41$(A7N$C80g&#-Hph=e9v5qF?P`af7DhX|U)!(48A{60dUiY6u|78!KsIGih6wz@U|eF^yZHkapwbdeKL4eSLjv zYipjCfY4Aa7+Z=_z%V8+QfcrZ^|x=|fQ}3qI57UtX(8gUpnCimB8&}zU6r10#ToyA zNsAa*({O&1la>}mgK+kZu_8(V0d0FpAt50Jh0aP$xceCjZ=R08I3hnU4`yBF<_t-_ zmS$#(NqAm8)W&(DXs_%Owpkw0H3HD+=cCO5?h03{_f@hL>sA8#`yHbh)Ge~c4_0;; zmg!YC3Aw>*4#EA*_0Y$7uq6wNh1qF%*vHS;-UMxOp9kIJc;g%+kZtDDPtnVZn-jAFdMDy0X3lk z4#kgrU~-}sC+s~mGz30RiyI6thc#fT{OVPIUkbz1uV_F5NB3=SZy!q$d?YR|PQdTR znIH>k6%!NR)yp^G*e!6ek1MRa6=VoWHJYzpIDQ%DVs4cISxsuPulWDK_vWB76l^2O&tqsPQo{ zbmUT}si((e_iw*iwX<{OvzV9M=+I2uL6LO1;a&mkgV{RwBJPO%lfy|%0PY~$S15B3 zFdgVx1)R2j$FLYOs+V=m&eo@=`*bc;RaP=+R1`u(i%f*5V9KK2m=;xKHm~D>$V4G04+eVDzu{( zUf!N-#6!=htE+QX%-8e*D;{j@F#Oy&EF$(h7?ZQJWSuD#K0}@Mx-b}7n45!{7>3fd zy2b5y8~7HJyV^Mt2-x%mAH8i}DD(s#+jB0iN|=HHiv!R!4)C1{2?3M7-&^%pJqE=^ zSm4(H$;JfizY6LvV?TcuPU{C3czg!6CVl3~dnn6XkYcm_=f&bDa(7CK76?#(!_Vx$h1|LgR1k6#m86e!%RFiI!FnZRg}1?h(ks zVatPIHe`hZ3iE`T+TfSZZNP8t2Z(|eW`4&h3}TAiPIh6@&$@2a?(W)9M~v6JxF4yI z{q)HbD8WyKji9RB3;0{y%P$375=eCp4u&6Cc%bb@9?=faMN)6HxYjHJxHgbJB25jm zTlf+|%ZCV?=D_=K8cdNdAy5i>AW0oDU1@8$zZ_-B1N=Q?RIK38P<(V>RfA9v(pSpa z!_`9wj)ldQ$K4u${opOk1#9_`MMR+z^^+%0K(GQJlI!WdF*vpSYpvY)>vM8)VC)Es z;QRN`-X(AjH6uj#Zv;hoNLZL0Oqii{ny8S!w@)mY0YsbKU%sBo-_L>RRtvZ)R4BS) zW1UHh5Z$Kt_dPUygvpooPO`I&^;-Sp61X!`Q*ACz3ku64!3hSmD9W^W^eP^#fC$4_ z1F9fofROuq@b<2l`Vt>cysom~i}3)A?Dceieb37SP8U3|y(2QG^J8G+$&veZ$jU*>QT2k@2Y)1>v=sU#GQwc{Vtt9!q?qZ`|d;=JIfo zT}iaJ{fV8m@f_)!^~M)!YTu)ygTALu)L*TCyjvLa7@;}zyP+=0W8#~fAQ(nUnVTmp z@+&Eo9&Pdsyn=!6+h@>1*>Rg;b73tB+&caI`7<=zcZClR4`G;(Mh-OVTNwC&&}XHm zQ}OX#z@So>IR@gX(NX~FgJ}hPfsOQX5K~DIdQ97omvzY7KW>buTyaLgZJEV z#@S!mqqb29RvNHS;kyeNPN`*1%R`;5thRxf08{BAXwbT^GD=XqaMbEO_@ZRo4pxT& zOE&0<575*BCIfc@V|1rACvnux=6k6SDh*_agQFwZGu{HI3d5Tues^f7M=--$=_5Pf zcLE|n5e_CYU_e`x2`p9@a(QAbe-hw{D!t%A_ocuOx+{!!yJE^En>9+BT9S&{2PZ)E zi{v}1dqQ-P^E;fr!U2Gg;b8f{ru`yH0p?`6+^@6s!^KnO#Va+Q2kZ+ns(fmv@)d?9 z`2-J4b%fA#L@urhMY9#Z1>STOq>iAv_e7ZX@e4`nRtlfko8HaAGWjP0H}U0yg?TkzYAP!`U!DUBnj~}QGdE%X&T;wbMu4uqvf3Bi z`}YN0_CHNboE{(R^YCI9fWI zRUsj}!Mu2D+LbE2ttI$&(+xn$whs=PxZe&!vfk*(NZ3O*0{=$1l48}apFcg|MAVy@ z!Ob=9;#`@Y0W3xQ(^Hp;F;yxm-h%9GA}$+vBsK15Ad?{VMq{8toxH6q0ol*3-DmgN29v&&PlDL zWSNvT|i8J0+*FtE*ksa5kbKRy# znymnkx*RCGr=eF-o5}IO>O5$HMxSFg+oI#k6F3M-OG>&xnE~F(up4b&QC1cjkDZm3 z{K8D3?*r(~&R|recmb#y%#j?S&jR|npN|jpZ(faa!LU6_V2q4+cbh|1`0os|ReMAV z)9d$K8Cp~cmpd17O50y!TmJk(964|2^SYddroi%+>mfU zX9UL}bYI=SZQ-w8U1#?KcTN6MV4buJj#hx&uTA|4LtX%9x%W2X^+4t@MmfpAxd0JqrH_-wGb2 zzkgra+hb~2Q2RGJ*q8S9GPQRz0Fr=nxNB~n4@NjNIIKC}?>jtM-^gEIe_GTJ%H?4D z7H+)zk#JWoFKc6@T?`DgG&S8-RX=Hbm#@cr^5hK`)&-6*x-W>?UeW5y$zdOqM>cpP z7ZR6gFse+eKZb4V-D=I5n zn01Mwk?=aH(&E7ZYGQ26ZbYu|B{Ir!I?yN=&~G5Ez62o1@jgky&$oT3n5*6-{La7f z3oM_(e8ceMWQnq_uJ+e2)@hGG96CluIGB7>c*4LR_xUsI`y+o|Zxni7#bEP$Wqe22 z8LJe`JV0*-ic#N`d2b@7n*Wc&X9;|+A2x-71m5W7L$+*p^9EAqn$gCSi1xzA820wD z_!GGU_dxkG{BeN`Irl#D0 z5ddU2bvQX4nlnW;C=8dlrKNt!e=%H>DNh?57^qfmk>CfI4;<*mzyuqE|0HcA{g9a~+^HEOE}x*Saxb@LppE==W)u3e}=GhdtIC7F@M z&B--h=JZ4{EhhGdBFV2`9~5VC7_@kiT?I1-hnRfJ%S~VUp{YAcWfEn36y-vA_`QIS zzA0+&0}qHf7|$2G)oBx zut-TRVIUMWU%4|qdsiG%^aSt}dD>qS846sHfvk@ruJ-EvrKQ!t_Lg%i>a}Z z-Zjzi@GSy;EdYJ0Z028@i8eV6&wae>ZNwU~^%AlCFh<(Md^)jeYDySv68_<^1H&jD zgoHJ*4?X1NJrjaa5X)4rGeeb?6bF)Xa-hR|9%F~;z72c2CMJf#X=!Qg@LTQt0izOVU%|CW4v7B{ z<;+l)b%&S}G9^;r<94;R{Zy7p&&<@5t93a*m&(@(Xc-t#$V=$Ga$LZDFNgy@XSlej zq6`%^wJw_gn|3N}P82@O%*?_fBD1s-Ky>0W>>niSF#Mw}Dg6P7&h48u^0asXS_KtKu1wpnF7%+_sbLuD zi|RcK-gY7u&MGT=>F!>vjDg>!UikKMdrkyI!9x@1yFG{J&J%#0P4(B6)@8Yw?XXruil?#R4r84nzkc5FiayLks2Oi-XaHk7%lE$bu@P zz<%{Y;#aGNP`IOk45R#MVE>9sNce{SS32%{BoD&U*VVSm;ehIp@#!RIzZA-lTT6|&wE zWC4G$u(8>NC{Q3I73QD86QxxBpmT(3o*jcH9V3)o9Q zj0S)dN|))L=lfBhT^=0o=;g^8S0fw2F9To;V#+~)$i=|00p#7)UU0nNdiHD^;1O`j zv9hsI7#6#QnE#^-knMh9p=VH^!m`N z&?}a?fsCA=CkxoFap}>G7HDQ=S{xl6#n1p4ahdz&{OucYfapY2^Nwn&b$=>0DWBv7 zMD8-E-zkhv%*};QS>K>62PQu5T%6}iQB5B|${lXaHoYY%^*}*zJDeSQLsve$A)i0D z69`Db*q_($-YGfpCN}Cg@_q&B^X{&R(mM=w>(YI;<2J zgjQ5cO+4hUK}J+PzXop-;C$-sEdmI)!^eE7pwQ5n%x~%G`mjqtHYkvkAKeQ`az7*t zYM!WZW+{6!4QJH)<3B-gu%z%QGaDcHqi}~Vvg%zYzN6!jUTdg3n8QP}Hzwu_Lm2=e zU=soUvkPb(^jdZEkw9W4TmkAuc*_mU&^i*JLx_WeG25^piJoH<+ z!p0^hRrYHm^Q~bpr^}Hgd-fJlCTx9idH~I_8AA@Wi3yM`K0}w2a-jQX=eV%&84V2$ zB=zPe6jds+=sqZOe$ma2(x=Zlj0}u>z$o$Y@jVWPRRBCvnC1V}tecUZ?gsz8)SGm) zvol^|jH^6*9}#K0beWmB@mlV9#R@+|p?wKsLSZ?Lg*H+$yAVbB*!~HVcHQZppaZe6 zOJAIcAMYYo&0p-PNWXtC0@1EcP6Q4BbHk2&{-?P!l72Lv-+i$WJDS4h&pf!^fw+5+n~Q>cE5bniN&LN+%oz=Y&@F)jpPJchal$Hz|o{{An-W?|7NGff9<2nY6g z%Dy5(^2cFjW78~Iz8D*;0J2}Gb`nSPTLKc^3Z+J@YqCMr55rysffIfI)xxr}#AaQX z-!H#bQrZ9xcd5Zy;eC(%$bD(4&YgpUAqif?-WkZyOO^Gzfv}@{81fJ|LQzdEyK?g9 z`&yWcnrwRGKr2vGUY@&|3T+7T&(eiOYs7@mQ~X>LO|5DNa}X%OnuXA0OIC0Iu-DiB z3w}8Mm_*c(l9M)7^0Z&XsbpM6hKJz@m+dfbTJ!?>y&#-Tz%abI?!?U_h#YViI076@ z@2UmoxPyF7^{K^?e17wk5TIUlbu&N-9;SfCOaYpnJg{i(H&RV4c>$H6YOHZz z>e(+n`Xs4n!}ysk`nu8#WE;2%aZ2KZQ`*{aUcBs4ue50{)Df9HE=&D>QXn5A4P@qz z7l*h3O_CYH2c7lqTesjKd-H~nd#$}*8k)a|`IJpvG%`wFv|x_;XM$`|TH|^F$hNtK1+%-0DylaKGp7sZ zfSg|DU`31&tk$fp(qA8&Mf1V8P_^7_4zi=Cx5dC1q~37cbR)&v4+szE63(ir;pXD9 z@A~?vTLk(DVyw}qIIyi2v;<2rE|Vc^=J5(l_q*2W%&!|6B-i8_p8#}b`^ z-xE{hE2sI+C89+~=;E$$dFr2{MtTm2YgMsq(eYP3JKi3ZT80sz2BW3*_Q-_NAt`Sd z4)?%-KT?LmxLV5#YEyfe`}Mr{<`6=0D|1i7a5;W6MoDKhZt1&Of(>c$yLsG87!8TkzvxT zN}n*mM)cvTR)pr!ip#fM6_Y_IAdk_)aLqQ=3ctw%nxiO#ha#{;Ej4rNj9Zc}g) z#`i3Ve8=*k4V{41ZKigNCg-lh2A{bZUp)K^m&0uiw(90=jGzui&DyQGO{YKm-LbLU zc{>x`oKj2A$qLTK^SAUr>?GeFR9X6qPvJvHXYw?m^{Hx=wdxqfJ=blo-)+lhVR2z^ zT7uYY(Ob&%AKqRz1AHNxF@cPQdZ_Px397daRiwkT`!2ir>BmMLqJINVOS8dme0b;* z_C`7lgq(%t|AzI&hEH^hM6U;)!#>&u28qSRB;jNIeDe@9etW?jX;}-1OFqIyi~P{Q zm|oviLBZMk^oz@k*OVy)u!k-h=swpzxfd|hfH?y+yP(Q7abIagrQ=4)zif|cD(TUh@wTan(zU) zb)_gpWc$Lx{b6ie?WbDL7UmI*FU|fp^2N1%s7;_sVPY z)EC}euk!mL#@(!YPv@IijgxTr@h0`QRzo;_`YtuK$$h@hd<>~NLL+C@S?^mbCvD<) zDl=U&6fiqAYX1C2rRUrShueM=%i%QeG0SWa!PU}cfgI_Kn)Ym=;ng_xJQV8LOU?tW zri%9$wY9F5#M};VF2>E{_ygS>r}{7A*xgH6Y08%u6JR;g&{I;*k{r!D=E{*>kdl{d z_1!usro*`R1wF=hGE25XHd$;?EnfKwmK|{B#@+>mLTNU->#f7;yj$;?MT-~cjoM4Z zO3{Z4FxS0+tkO8Y`ySxuN+NfxS?gli^ifDO^-vsv(3G^ZOC8bI5)zUyHpXzgVBcBE zYrU|?=WnPmuQdc+l&T0=;=~wQn__s5(pcOl=NAa zZFYBcI6B%I4KT1$y={yV_+f*7fqI-(j!im*O8zA=CUZu$CFou3Q7ZFO9tS=zi{Cp= zEG*$EX?-CdJ_x&>;d^|y;(RR3DI)5FBaDh=hL8S2ntECuFj3$W9c>AK4I(+YcTwZi zRH~2962=2rHaiVq_Z&@!$t9kL%VrucH!fkME4(p1XdE1{;noV=`{kR3NyNYY`w;?h z;d;rdNsAXkCZHjb1X&<@JZYwaDW8C%!gw!W_yL$O3Lf16CL7$v(8{&8^(KK;x`E(s z*X(k!F0{$xX?~wRZBGkfv|1iMv)yVk0U23WCSB;L&F}(ogzGnto0K+sw24gjsJ&TY z>@aKx7kS*)`J70}n`FA%dl;TR$rVLQ;B?=MI|z!iYn-!sIHCgk;6dZSx+k$4<%B(^ zVCHgJDQ}#OT?yEFut!K(mOb!o_~DL5E+xfMsnPFuZDd&$SW%G)f``{64~Ygx^I{CI z_ZCXLK-fF_;x|OlU^Ql6<*^f{R;Pq9!!MmgY%Gu4#5-8>cJ`8 z*4lZCTv6*4A8VW3L0GQT;17Y5TNzLRAd`KV2CDfwEjbLV%>rvvFeo9963YE9|SQZLIJm|)KI; za#0x))q~0h?+X4Vn!oKnuUE zIK}GQ*2T^=&U!g?FXD=belNY#u~=PNGdAh?RY#)A>G-E1Em|z>jv$&$0>N&`-VDPe zcA)6JE2NoGOTM?oF>&=;ehFuzv!f&=c@f&_WSlO9H|GQ`MQU`@wStRR-0AWxX$eO- z=z(;@DSc$%zK`Y|7DrqjPj^lBzIh*iYzU0Esr(?ge6QTfnsYsz5?NA`E-x-W@4BY4 z#l*$s)CUlA*%YZTMSFSGp*DQ!13|M&e-^`9HV%^7!&4C%HM<6 z+u$V;f$iID(&6ozvP?OalXE2=ev~oE>dBrRU8Js_UdkW>2_fiN)if#suZtiqqj&UY z+OCpg&D9VmUJs}MD-mMZY6dbyEDq9-f|>=<2nk$_I z{&8LV!>Dv{^%b@EWw7S%LJJ>Sih8tzvrA1~K_Tshi->t*@3JM&20D^gVabut?M|wD z*(u1*<|_klK7pRtYmToLxgSnMP9DZRhW8mFpe3uf4sjIaA@a zEq4X;!9?lT+qf_7^lu`(kO+xbV1jmfih}8mg0;@~W+TpL1ac<(TU%u^`+*;-)qpO5 zn3xAU37`okArwt#2c;YhY~0!a z?HR8W;h?+G=N?YmV)33VM5o zfZ-%&A2HIgQ2659*fLQAg9&-saWjL6N-Iu{H=7&OAr{{cC56CnaNXAvM>xO{JI;E{ zj=Q_H)q6B1-NlE-Ngy&a5uQ7Ae z(<%7*omYqC|KnCxcXY(QM|RCEU!ORLoco2u_a!V${pxZ?t$JY*zcgyQv+Z}j+JTms zZiU0fOd=lVoZ^QB9usiPRg;%bHUZBRz@MCfQJ7ha zhN$8et3LvEw((AVHV1Qz-9i2Q?VC50XI_(d>!c@oP~xDmk1US4dv+JQn;TkK3{XvG zqDw$FpFICjd{)Yo>EGy$L=3Moz|h>>`A*#4ryvWVk(-+CHTpBLvl_W{Ue}5jH*fB1 z);RgCf-~?tgGIvY4cXa=lZ$)8X!Es}mQ3d0vYpyqCX6?~NDloi*x|TGmb5-MHxv$d z8%pb3;qcZS3*cds@VmWQh;mI|)Av>E3=y=0(K@SMQ z`}DfD(oED{Ai^?NidlqdIm-LSD~ng1!AaA3DIuH$XgzPOqM2s-Y(!u4_fAdOHGFuY z27c~i2M3yeWF?_#A-g8_lj5Pj14$a3!Bv&zvK3#7iB$tjp8K*o=okdAKq-vCeaAdL zUTjE7K|w7WUtu-(3$QUb739eVDF(v)BW0@|&cMHjr$oToBM|VYxbD#bG-P`7l;H*E?rxxZ?ov!t z)L`y7*{V6rlla|^%|1=Y&Oj|`gWWYJM;X=yl7LIeAqhuKjRw2fv3%w=VO;B)Fz)b> z%Z5sr7RCnTUt(fFnn-x>UaE@&kb&UuVqxt0$W}l?f@cU$3I%GV9W5;eK%oUUUYK}b zVPJ@$b%SRvaDv#`3)W&()zv8h%b7no>p(24xzU_IHOX^xa7|FiW)(*`@z#}2Jkn>r z4JPb7#+SLazQ!swV&=)rDfSHdyn93>X&o`%>$D)X#Zw%TyH~{a7x<&q3_ww?Z8Z}$8 zN)3>tNhSEf`PAhWG)@!kgM)(|9q5y};0foydcb>E7(NT|^0+)N&jBpKR|PR6v|D6Q z_y8^i5SQJ2Lf^o^VQ*0ejE)u-e3j5K(b1taH=OEW|0piT+&M)o(-9DldfO?@G=B4x3TrJj@>>Jjc2dTU=)k?sWM=Wt#g^s7r~8~b{fcuIh&V60FFHmN?y z5bjPmOA@}7DLd^oJ0sW&AYXv!&_qZpy$QoybYkM#%J}7dk8(=^5J6;3X97GK3he@n zI{dKyF~9G}qLSlm$FXnRMSoEh3f!~(o1kFnAK{;jKw%gU} zN{<0dPO03ckYTy+1#D&8o4A*?DSAkJqhe&;&)MDuG|ON}u8p^nFp-Ou5(W7E}49>J}E^#l@O?4x|Nbt*s%F86}qRS8k-7amX`c2sla*0moOSmHUS>Dee$X^ zs6W;JM9ATr)R{MreeI93Ht4xCswodIu_e&7ybfUtS)DAmbaCPSN7w7-As`}xO1zXK z0x-LeJkX#m*}(HHCoj>2;nBD6-?7L++m{oqf-D&A*En}heJS}Zj<2#zncAGyj#I{3 z&tWL4b~nlTt8SCAh$Djg?t8D<(zT}UxFVF`_ucGZpd)f{fQb?erx-5-@cY8XzH*eh zaRX`VHzKI`ecdh8qa;4pnniwIEo;*QUKSST&CSq_#EZj?iazJ&2I@p<;wMz0m5V|t)#15<%(_vVRGFfdyI zo5eVGa~M^lk&}^;`SdjhJ&1^i0Hcr4gM$407ie6ZoXb16koxTJw%@s0L4ARFKa7zf z+A$+u+vWVb+vYg`+@z|q`yCPtpkC~+WMT{sI{Ss_fcKDF-Os}3*DK9Sm>g(U!*luS z);x}+%-1`Kq(nO-L;lbd&A)wQ!AJWgO2PCkt|Z<$U=IDtQAW%>1bb81cZT~K#>bfKI&k$3>(ghp<#(xLQ0xkHfL`rxKu^h*wF^jJp;ibXLJ zboyS`x64+a z_JY{#2)OOMMjkg`lWun?#jpm9fjpQjQ0PyFAOXjUtJ5_m{GbezmEqh`uuUC412h}B zsxa)!y8@6K2*JwQ+LpSysdWOgVAeG2yhM_%Xkum-T-pSrFIQI{p7K59I|$3iRROR2 zYUt&97$mEzT3D<7b#?b3K#Z9>AvSs)|Dc2Jg@VY>wa&vF9lgsqh!4|A>uWs<;>s34Iq}t z%Cd`6q`1Epd(jN}Q>p)bV3#9@t?5Zk5&u;a4-*py`A<;pm zICLZy0q#?^*a4z2U{C_o78pNt*NMnrvF{BpsH1Qj!p@Qko#oM=ib1cV0kX@({lz7l z7}cxie`~qptaR>nkFh&lDzzQH|89J;`w>EKM7n$45)2Owf!6CGgcd?D;{NJFjZwed zK@|Mo_sJNM(x`k*L)mGBcPKGQ{@T2F^(w~O+kP)|V9<85wgy9pC;NYK0f3(*#$xDK zzNG<`GBPnSSDqGhPDQUuEN2Pxy{Tw2-7imMHT|!*ziZr}Dhnn$AmE&7Y;5d%kLbHU zXLWPy)$BfDbw2BoMOQ#fb4>YNg;m4V)0{jXjG)RR&%%G2+fZSS!QL7~%@ZD;+)7&- z!e?FyJOZ|MtX-$VaQU&YSu!(i3E1}nxTtA6a|@9$zjv$t(nZ=fNp|8V6CGWhrFQSX zoBjiQK*s(~%OphJ&t!=400h3w?7#a>1)8N)Fb%*ZCN^89MJx}jpLG$GZBu*C$GW+? zuR{m;xIKY8L0mq{ZE0<+o>DX<@`7e#MZlQjz4*!yA<}Yk6*mxSH`%AoIr-~ntcsy! zH5z`8Y?z@Cvnv0{=zP7{7bOI3U)0(81*nc=&$gXj$jUN|o|`%Tl6x8jAOtgzhIo2z zA?)6flOx>=$SXAr5d8!5{8B79RuH`>y=>KVgL|OE9xr74mj#(QO$7UwrIs%SV$n;j^!J&?>cx+em8j^X9N#1N ztt@sqw|W(O?)S(4`Gc;a;)>h?PdvHuRT@ez*-J4RG~YjEd9DaSe}X%d`M&zV5j{Vz zi7n5}Tr#;-)Ak0!k=)m3sqRZRU;+mOPd}8D=x8ZZlE5JPj?P>z;<80+hb{hl*B^Pmh#BYb+VAKaPv|Xwqr38EGJf^3e>u?5q;Snrz?e-nZ=9Jdl58K9cRBlql!(@Lq#J80}ktz0Rd=Izm;MMoEHLp#F)fzB(G>&={_Pk z?%xgIB*tQ|yoFdMe6Roaxm~{0&p#bg6}#)69k!eAs4m09kNxjr@fnfD4%A10Y zbBl}5bbkFPHuOwUIH+CIH#fgX5m^GnF7qG7)96!d?4pArG~$OJeeE!1x=2a@#6ZVy&eHR5MIyK8Ix6VZ|79{Hb`o zj*2VsGSv^=S}#&nURfoP&Vp8jtf|ZSt8b?`eV7&9-~bNOjhe-kmA?xMIVs3Mzv)Eb z-l{E9cI->JspxY%Z_sa8|h>F}G3#I?{;O5a|0(f7_r7&9pTg6!*Y~F>MX_%|L09^|ZS}DUn1o z-1Y&v=%fCwbrkigJBG1U3c;L;e!e4j(<$myRT=V_^4mOBqih8pb5JiNg|y($;9HR6 zGm@LddAK-}{1zB9n?IT{JtfTqb(WMJHv@%k&7w6-IRPO7u%ZeJl-S%PP!i#DcLy`n zhA`Al`#n{$#KY*IqNtNr6njJ%p4CG2FizZnfbk`KtAAq;Xc{{2-~4b$q-JjlR5^KU z*v6_r$sp|NN`G(Vpd1ORLuZsZ49E;cT48zt{ZHsaHq}NGB51wavwdCtnsfo*s9YR= z&+u71T|xqaPgLrh3x98r=h4g7*Vl3$&tu#Jdbl13sef#`N|o` zb7u$ZvLc1O;3-ELF9$Wfhulb`=AF>Er9wG|X%U_cd#|XA)3qY!J?dgr2G5_44rRGn zStH!y&dy2>4*b`jbo%bU&%4iw=l9qbsZ?38cX#(4FnF!$mAm@)YCx?DzGN*g&ol?% zuIvla;(`7V2*9&Skm+#VpXN`%O52C4q_TIk!GrtoVO9!u*yt{LeefNvGjXp%@FAnwYMEXI=I-;Z-E2(fyFJfN@tKgFbPoQYS5nchy!|s9 zPVDcc)mZ%i_OWTfa50TLhBRJ}Cd#iK6TTo}>JHgszSE=MsnJWP!KwoK9d)wZhuMv|ZKOz2{@wg( zUjpVsrJY=M8e1M7znfg)BrfyQG=`bJ!zORK{U_KN!USf%ul2!=B7+_F`U?AAcf}qQ zDbfw@rQ_20adN7zIV-?FGk~CNXK!g`m4QZ9V`1->Ul7{9JT&OhOk$?X@+vf+#M6nf zs!v|S2dJ(buU`p%{#@<`^2N;l)4qJRp>18PP?@l4Tp zvyM9Vv-gQK`B_=~R=?vDX|CbzR7hW=NLRGHjfuH`I5N(tj3~Jq9hV_b%VuX}jx3NO z4`L%zL&Jk_EG?}x*n~Ga&s;u9&UmAW&4dSQ`&|015fbjQ_s z-qvEMTry+ItD$C^m?VE;SDA?^c9#RK|gK*j_%m;UuQ=%B+*sTAEW0E-4{K3ZsuA?(4>BhJ{Ge1A! zs`DXnr35NjLX4c=#LZrA9h1Sw$_{|4dr7#$K%&>xg>~mIarQ^c<&QJ6wJwzq2CORL zPr`!*oW%Tjfag2(PrnBPl1BpL^y|CkMG8T$3_$4ajew(P`L;PT?8LYD`7L0iY_BRW zf7;0;hWQXK3LH~P^0(>j94yG^qGMu~HZNOT3;CQs|Jm38Lynn!(Y_7Zzn}lo=e|xW zSFQHD*~2NUr}~haf{n9g>C^p-#_~NW?Ix1MM_C>0c7m3fK&mxyVrOHk25e~U5y(u$ z<(5`h8UOF+`RMRanTY-T+mb|#G$k)-=8^*mgTg#f4tQN}Sc|+n-ywW#JX+%|u!C`yDENqoI~8BG((h(B zub)T-su)eA;VhdSr)5f#C%>Aq^6*6QtY`hmz<~7HBO##+dlHz2E+hY|htRo$O6X!x zE(ruKE4B*n1vw3S3{T^)>5;Z4Co-l~D7Q}XwJs9pC~oj6ig*`VYRh%!UfJ5J&onYo zrt#6Alk!Vr-C4h9Pa?EroYx)3!&_HW_UP>{nQYzGLvCUj0&3ZYEmDrs&1k#Li}Sy@ zeppN9EQX=qG*7#_WoYp}j|drbKb%az!4A&|qltb0-+Pa+#J05sAnhUhq^c#$kMXYG zzma@>GXOJpiMy_LxUghdje*N1O3@%V=am>Fn+c&2k|O>&IcgN)KXsqSmSFg%1_qkA zo^hPnQqa>UwX^;Jn1o)nkFSmDL#yEf@UcJ|^vq;_dWR&`LG<4ARf6_wT~9arGkUtl zfnVldQYc+qjb@77M!(~RhK@u~8(02bS>cV5M&S|w7XoCkK)C*L0X^dRpqzh_fZXU( zy6H%lFOY2z1j;}dm8Vs(gdC;U*4DoNZrzI)rHl0i>0iD$#SEWl^0u za(GR5U&2rTXEgdm?mS;z|4gywgFuSw{D%H5$z{9$xkoHpkL1OusL=E+1urZN1Gs*`MG32cTKW5wWXidr7(Gg3TSLPH zyk4Yq)Qj!jsIixHZQTqu4rQh@i81ZAj-KGp_Gbw72&#Fr``T+B)e6 zhSBR`-jYM-!83B}!)EIC!kd{05qFWg#j(|cFm+9Goa{?n4<+#z5{3`x{wj$0@39lG znQUJbInG+kXit;Zffz*V6L5h?MMRZ4kbUu~BJO z7ArX7w^KPdj9i@FGOC7NzeDHu^~Tai2=QlUV?{w#dB+>&WRQ%t@`D0_7%D0&ix=>; zxe$+NrMn@Yu3eAt^xS$$`rF2qk5@x+-q`p}_w*bPZi|Jy3u_A+>AKzTc`oQ3d2xN8 zen`As;{NpYWL*jm9eTt(Q^BAk6UqCc=bb%0RVl+$Qy*qMFie>x-n~1hvKRP&uO);K z7YOLVjPxj|XOk0Z|6NL@>k&MB>jO#-izZ$-f`arl_z+C z=onJ5u4o$&hx2@UEi0$fsYs_lo#)mG_KEy#Z3+HlirDY3GR_i9%%q!eJsVmwAyyM5 zj?f-DIu86*kYizqI6hV^Qcd01L?E(!-^02<2pWR=8=Lr8E&9GQ?`0H&69zC21iouj zQbx3|iA_x>fKhkW_0@2D@^>`(4ELGn=okxn6|5p>XLr~Al%og-TY`Cwy3o~eUpBv| z4%>gpjP3mDT>Ed(Bt4&LkcvnvQ;yPKu8uzJ9{bvC5Emr6T5#`eF#}YXOo_zpZ9Wtf zX>&(NyJooaZ~by-@9uW+I3_OV#pmYEN6;`?<s1$Z5NDld<_{sy^(C3(Z8#%ySSC#I967$loC< z?D#VM__0ZD9g#7lXiS*t5B-jtsdl({63Omf>;zWq@~XKTBmd{_&_Gx)KE4ARIk}SI zeYyBCgLm&zifv$_WSXjAi->rihJ$xC)4jQT={`2@gqhFGCYiLtQ@OH2KE zYS?5gM_XYV?j)Zy7^MQwCmL*hGBi2dk5Xk=AJ$GL51+)ZJ+4u8KN_fe{5V5JS&~Q% zQXPONGngbaRekg~O)Ox-0u$k-M)0rwu+v%_VHo_omp`GPtPBJ7g6oS(2Gu^8nFSqhTxuynsu9`6uNNZ+yH0nK=z)2uwID|+g<|_e53>6jCr{-VvkCBoS8h!#n z5|O+IB?=pTV45ZkMrQtG9-03x(>#})dGXsVtvk$kxE(9KUMrYyAQUl zl+e+AOHWRkL+a((!eFs9G{Y2(KYF>&j9R7{O`6@xWMLvNPf*@{pUwaO#9#VMtk|r7C%1A z8LIcm@!c&AiEt)j@i>2*f#xj)nKb>cdHS+Lh%(R1UjLe`?`FH_{_?NZP27TJN|`D3!*tKP_90hx5C2iKD{b^6XIH^Z+}lMzCOC>xV4q+#Tx=xG?T5FL5oTzrp*!(D^mz+e%?;jxtr=Saf-ymaaHhI<-WCm_R$`VXWp6N{OQ8b!S8-shj-62 z)jo-624Hoyw_9v#RQoAoU`SO=O;JZcsP8=N#C@Cp^930{IdKNsf}u=^JZfoh@E!0z zW{B>zmj}B`G;#w2YDrhTCf)WJmb<5GXxybB3oBH8d3~|asdw<4rz;S`eFi^c=SY8S zT$DS@!-4E63_1Bv7#5l*s>(e!s5FVlD|9neYMUGRWPl8 zef^6Z%6IT=b^ra-SZ258@)RXNG-vq#lt09$`PTB4JY{F+cM=jYJsn60I~&I>{(#`% zY_j&Ywt$Zn|28T*TH5i-J#k8GtIEoM7Y3_g(E{+$M|GZ8Uib%S<|;@_C?P#1_C(3W zfuj~pIKpmMo@3{qwM!QKy#qZzzphYJDL*3UkgJxpj|^SyONrLllq!|d()!-ez{e^< z5z$V>^??A9jH$a?{jVAA6F^2bc=akf2t&%-P@SHs0DM^nC(8>)g%}WskD;L?oX@g6 zntuIS&o5tGE1+DiVP>{LN0)r)48~ka({s^LQNwu{=b(09T>J+80)sj3M3!3*rg}LJ zcca&;@DXVf5TDB@j}o=Q+yv2Ht?yC#fGNPm4*}^NdwHgM3r#*+^TrwXwg`GK@szqF zvmISIK4ymeK3QSob6VO)iE$d6gw1lFf%(y`|Gl$$5fBnW)SkN>ba?Vj;4Dfejo4Or)2uzG575ZrNh?CWVyFZGRiHH}(Z;H@T?_*lR> z%FNR6LUMV#m)|ALqHt+xEpb;dE$vb1uQDmLlzt3mi>kx;?BZ0CmJ;JKA)z{xXjrkX zM~QAn)4np)b9+Hx90h-9jc^cN_x{_85Rl7oad?BjUK|x!Kp4#-3Jx%LK%EemObdSf zNno0WisCSMy$=DX{*r$)&F+1Y#{Zz|E1;@O*KoHw2qJ=kph$=a2nZ-CjYudU-6`E5 z-60_Y(j{He-Q5BL(%s$N4fh2-ciro9&CHqcEdIU!?|btJAqpzZdt8k^Q7Wpc3JMuZ zzcMU0?(y<|ZD=r9p`^C8Ra6KW{qoRwlNhj3f6JldT*RElMVstvgB>PalTqM6P6+S)|x*PIXtgKO-PfagIV zTrWK?H*!?$&Ba%0U91vsCqfa93I!g4{ZBiAm7e5g1_pgL^Z%lT_t)HGSU>1$ORiZ* zUkW(1s57WJM!tV8g=6v#*)PUoY_u^{W4P3Ubfg@E>d*I(4|;oJ?@#JyJnHHU84Aii z=6^8+C9)xX)6D(LSAU8Ob3Fv&l<4KEE~k_7KvuK_c3!RuFxHn~o-U?{f`|=-u^0}U z+)>2Zmm3kgz365@EY_!{F8(T&pSR7$!UkIL3pg?jx|Mm9)us?(*L3r{$dikF0h{Z8ibiLG9M`sO6N zoB=AB_Z=ENy?m@g_x$|&t^{n53;SqJNDxC6V_yViRoBv+&({%7T=vI@2TL=`9MA6e zZ6EQhueTrTp)zM%j_a&;XZ#TycSZ^fc5WLRC&dydVBdr#Cr#L&U;iCgEqN=D+>^qR z89ZJ}!u94Ae*(sFa{22MY(3f3(foTg9lhPbDxY4akw5+KM)iDd9?c`xHzjd>Z4n1T zVKg*PV?C-x!F7OINgY;0TyI?vh@hIQngenET3bXUl**?ptRBR}e$Po@1C)RD8IjuQ znLV%rR-R$t|C*>cn%wD_=+{&3ywvMoT$JgfOg0Z%-xT-bPXyNXi^^?7fuL1VTFM|HK^4kKHc`xA>Sxo9i2|X3^N>)s+Fvc*+!XN42IW5mDv-ez zDIluxrK()p z5e;n-Sji7id32=*GUXXS5}zcn1SCXdX}p~;y9MW~ZUJ!$knx2mOEcr*o|-RTptxgx z0Z**s(GUP(O;v3trua89IvOr>L9KW@A_dHKu&5;1bMw(dBht$%p=$}`CkATkGuKh* zVRVA)KP-Ii1_8*teADHag{A4~?JmBRsxylneu&$}fm~RqYR*F( zeo-}RQYt|%S>7vx8!qrN?YZlsrn|Ddn)V+osri+1FAJ~%m!f^NjPV~8MLH%*ubmU8 z$CqoSzwau{AS2dp-E_D-_M6lk9KP3X*yx!2`baS}m;*|y5Bnsc(xHW{0u6@PW^Zab z4^N`aG72-jv~&}%MX096oV5)(K?Q8&9-$rAyZZw8PeDN;OQ|wzw+0sDps#(45D06! z)SLOaxz;P0lCFMw13}8=<|~%qKsn!*aqug&)M0>UGGvc%9F8MZ>xhso8!eg+{1o~Y(ZjIZtl^+Qqxdx?>%7GY8e?- z+a6>y8u9iyHqW(61A`j$^#lnBjKT!>K|5ul%$$YJth*)H2-U4_Z-w!5sVst%($f)Hx3w^`k_2Z-Oty1lCI#+pTGkhQ2RK+|&8JU4)}zX%J0TA9rbp zrra_HOoAlKXIEC%mzPsM1bBLqLtY!nyoM0@zh4u0>OzQGiWLELfwCjLRVeg91!8hI z14Bbu4nK>eDl}S8UWWLehdZ~!y_9+`X6lf{rKy>g!q^(_qEDOzC9CJl5TvmnU{~SQX7?3osy-H*e7JSyQC5 z5nR7>m3Hil{)YunYl4w#^~pL&t2OD5S2Pa}z5%^KHqKkOJit0Bnnq(gh%C<4Z*Y*W zBZf3nu26NUdmu?DYWrv*<{lSVaV1z;HFz>=wS_Yo3{!w?3aD6uOpZ=NjDptl`+Z4C zCdK+g)t_oFK!`7(R|?0hWry|Q4GzMa4wQA85#WrGt_UU#KL960@}cU&!Jybs>8dFs zkJ?JO#NHq}Q79<9rd2_}v8=k9F%g8n>w+I45SVh6$C8QP;^N+NI>kf}e`#NbzJ{(K zk(VS8)H(X_985}CnVCKB-oH=NSyva&hj9UNXHdKg8&eNJ)B|&wvC&a|1A|+HjE3CD zCkG-Qsr=sq;0-W0BUZNb^jz#Q9J;;l8-9a}9WoNqcr^hGGf)V@EKk{P>mea{-Z-AG z5EBu(+=b@McExCtg6dq0)X(2PZu&L`hA`KA2M4g&eHZA+O-!soOzfPOmzJ03xx5^n zmxmgcBlSEjGxOnXw`Zja@M8gM;BhNGKAwMTK}}0bQAQ@7;fa^Vb4*W(8PLY=>sv49 ztW|~GP)0||(cV5nZ|>}slkqhUu>P>#T|6Ru=S(X2$Yg)j zo6q-tD0R%*{CtV=3>7xEyJY&j@tYxc^r**lDF;74)SsWTfXBl^Ye?JfuG!gAa{YY| zv$f%Y2M>CD2&(Bc1%H3LcLtE3?wtjlbg4E|W8=f~lZn z4^LCReJkP6>n|Y*e4j{Ds_^I2qzetAll^ZOg=i@>vc+LIlOYvKO6y8eodttp^G zcMlv-m#%?$jY0@W(XOsysSK;0U#^Kk5W&9Oou2KT-Lf~~`nK#5Yd&zew>YJ&q*Mjr z3Pc)c7&JY&pK<+$$i&Qa#*z&5c`2LHxHywKW@~FCGO{oj5yM}>%ht|81#Szd--Lu{ z>KB!|xKMiY(lTh~4q=gyyd(*%{nWW+#_Ur2>eZ(fbrT%#PHj4pKqyW6=99a$(=6|j zYleA}C6SW^lKH1A`Os*mT6_#mo`9^O-v4?Wj=600v#<{>NmhFi zMO<8s>plFvfyw|G83Oq|At8&aCWMbq9z1Mtys>bYxr`0-GczUOPr<+BdY`T207^G7 zPjdw)AmkV4#h+p9a|aKA1n*I9q3?r3Y;FM^sVitKDc7Nl}rM>s?FBg)$&d?B*6~P)x&q9c)ru??Q{-9OzzJ&O#wHp#Eyn)o)pM zs?Kc%mQy}ngDhEdJPUDmOf}RHmM8n^{AE5yn zhg&lXH*WqXrugFJYB<<`r-h>M!0U--^IGX{_?R03_R`Iy1UpBk z#p5;yhg&lOp;i5$U&-~2^QlOhj9B+zBRxJf2Ll5kZJ^~!znZCOV3s1=jT_}3Bj5ZP z8fx$A@@b&apDm1XpH@Q^B&i=6G1#7+ii@k?d4R6TF6Q`H-kmg!N>g?ahPfS%Ap`a* z8XBSpg~i44V+Z?XPa_PJ4hnsRL(58~MMM}Iu;G=OV;mk?_e!qzG%0T(1vaPH*7W!D zzb+7O=`S|I=rch_XMo?H*)R)dWmO2mx3DO(v?!9c11GeD@yhZCT;IKArL$INOiUj< zxPU$ApFEBHhb}c(wnur3zx|)ESY${m(l9bAR-fM~RmieI$pP8{Rch*Je*rkl2>k6K zooK+>XI+?C#Ej44aQai`<^JBD{qCZFYU!_|t zpJpF^2}O1Fv~z_P^yd0{;@AFYPx`gS%D}PUB!xZ|#)a@)(4f})GVHHlcV;Vd>J3Ax zCH^}<=kzWf508nN*c~I!q=R;8jL#m(QC`bNhbe(Se)MNXgidqQBNRa;bgXQz{;O2! zXa%?*yg-6a85j@%XgozmFrh}nW1j6wXd)GgeCi6C!SPf=$+S?s81HCe#>8Zom~6nQ zr=p^QqW~uIHUnA9*;#0JqJqN1%M3<@UHvHKtHK!8{)%qaLyatiBAchaHJF>Q!VpRJ zCxVfYW_up||3FpRSK0Awu04ta(D#C`??uA@$)@ze+C%0gp=)pNH!ysvKANxmYWUjq z7@v(f5%cw{Jdss%T80fXN2mDZ03rHK@y$K+iK4ZHaGbcfI2EshBN&PU4JtRTPni8k zr@^z-Q;p||sH`j=b|{V2=Z%m(7{IFiJA62xI9g^cOwPzS(bd&ID09>ZBK6wdIXQY? zz9`z;UsTe6eEI?e%439M#^Yc<8#uiKlh+2tvNx%Ub0(&ez94#s+8%Wxza&<9*+uSe zR-UZ0?9G7vtP4hehT;h!;p|Fwb$1R0=;aVN9A^Fe`D=7kL3FWjAf)1WIUX!~7$QC< zU(jmGfNTO_X)%@aWq2J=jdRxLCLGF3fzDl21S?{(dj&;BRc1@q34bQ>%E(i!gI4s> zjuz;7RaPc{Rs2Fu(&~IyY=j-zVQwxMRQ&fA`rDqRQ8DCiWUVC)Bde)NX)mVbp7F(K>HD;F*a$O#VT?5MtDG{ql25hjXO}~hrJe!MZILLKkiXPJGl#(M3ER}( zv6z83P$UI5)7i-cgPX@$?lYHK5aY;-*r)$se58E#{-bx!Pi{^W$RRMAZ;T%9r~M>* zpNpIR4n8|%yT*_9^5A`oArzi#b5IqShGBHL9r}S*YT!bvKi<5TP6&lCq@9TUYMiT>gDd@=HwK6Z6nyROK0Zrv z*xW9(Z6;Ibb0^@iH$EC>(`38(hhgi04@P>~Ye9TA{jV7`!QQg6prAs7`eHfVa&0xE z4@8oKQU7}w{ydD)NX*OkAribJhT{#|s}j2$@-kder)6?x78Xoc%zz3++Jv0ZgoD0{ z3eKa!kHR0{CPNyY{2Ed+s?eub@Fr4USXlZ_pjX5Fq$*?vlhTU3yl~zGS-J3);z0D~ z-+yX<|B3VeGBG}JLE?&gzB66Yb%XxH;=+o<`K+&QD3~Hlm#56HeMl55d?HAEf6tMY zo?291Q4r-d%}T`$jt2a4x7z~-BSk_>;xEIsXOqF%%}5}z8@kMK^?vrl2TIQigPf0haJ|J z79KFgjaq}UR!OO4_k zREvGynwHL~#Mq7h`Ezxt2m4M`Sy*uJ!utA8%w9Y97_dBQowH&6oDDz>@?bex*+t96 z!Kooz-3i_1TyC^m=t`F(+(-OhCZ)&lHdjC!NO@*Ll) zcGSm`Ssr%azOh^PE@nj9-DI-ZjL6GtDT{aGNz`heV6}X0Gcr$KeY)HAE7!&M)SPTX zBTjX1(*Jf5gFX>a{joik`dHEDMIG(ne2N-^OxHyLon2xz}|Yk(=|1 z?eiz`cj;kams^W`xN{lA0!ckf+a!Sly(k(qsU*U>Q4-{>9n?iRuV`u2?!~*`WPWHH z)76n}^m4vo*y5-oE($c^2cjQjx5xAr`&K(LX1nlpP|I)g2M&>wr#TD}Bpu38h5F)m zUHoy2cpO%G;&{I6J&<&dOW$D7$T4THWzTlp8$H_cJZFC_*z^`5RG*m~_&_#cc=f63 zV#`-4no8^Z_zQ1BTMS#YW`FUy09E91S8Gr3-GHe23;mvK$EdR7sbwDOBOd>*+>xS+ z>>v&fqG3vH2h;ON<_sW#H2nHid2t?~S*g3+>wkxGZULLavHdZ9+S1AGAA(;6zh1c9 z;5>2qcgp7TJETMvotxFc*%|D#M6brvm#vq{tkbb=^qa`l8^}UNqSlO$Igx*nBFCc*S z79r8sn-mU@X~0J~przT+ZnEk4;*Rx~YYwh{8Ihr$I@96B3q9I&eG6yc5^&~NM`h^q zpy|%A<>nvc4JuY!LjEqtGxt_6G44K|eI+8Ci%PTmgoJOwtMNWc%aH!!M?TgElZC0lu)Gm-1hU#=F`)9nLaeNW-`_G@fO_8c}-}>f#9o%fV2u> z_IN=-ia9Fl%`2(;&?k@2ceuX9Lefz)NZo%8YNf~3c52N9y#*P_xgL(u6|5G$2yCsB z<8-7j%O77gLxkQ^9@V=WD<<~r5GtHLDrnk(+xa%|In4QS#`lpCv6g?! zBu=$5i@njx6Y8{d!3c&jNETPY=bAU~Wg&qHeEu4^fP207%q$ukGrq3-&R*hYf*2>X z**9C;+O%jMGvjM2SK1s*H>5r-`lrByA^Q35z-VIq$}GJNo9+RoOhB;sY4zgO}vdO7=vL zhNwu6#ah#=SM3Yquk+6rc)RNzzdqpdS-sHhta1Fx%(40=&!XN3_Kkgb?Wu8L+23u9 z#)^D7CL|>l#YJT+r&^U26mdzu-%-i^evEW5XgXO?oSYt;q1wjB0pCEwkVDH)6>O?8 zxx?e+9WCFEKP`H*DiA&yLxm=ac3u$91~=EQQ1_uCX&iY(pG|1@Z^Wz7($SUJ9Tmaw z3UE(t%6X~{qhF;s&di#C$H_=btHTPD3@{I9%#fXl7@`IM=O^HU!7sYFiVAWf7e4b~ zu<2tktA#>JdwsH&_SUUb{#xp)L)oV<287>rE>f*W&#;u^EV3J;y@f^EymuG ze`G`3l^5m6;2=4W6phJZyCrC7qlw)?2t|}xt+a~lf%|IVT2ne7l6oBDPLxVF3?W?dqkgSyzGtVO)AvhzP@vhbho&Nzo z<7nr?a&OszKOJ`9z62ZuuVS$iFINf`zkmPOnhEwLTN&yZ7*jl& zx>lI3khOg^?_`Tgp7M_d#U-nSC^xy~f?N0QfvEliSWP4vwtSI`t`*oIh!7VIFf?5I zh|)as0%IShptHfgn92k8akDK$in=qEH_F)@&BUIj#P;Z5VO^}dxw%ke>5KxzSa*g*7uLn^ zd=IzOP;_t7l<(AT8>tHT@dFEYv|es3)AQuONLL+8e&XvLif~Cx1gCON{Us;}5niKC zQ*}7K7D|1aEOUFxT_AXT8*qnMherz?kx^^G&IERw;g*nTYU-boqvZ?dDUV zodu4=NqS-7Jq}esDQjDK96DXA6cm&R$G*J&e_QBS9mouAY#hm@`uc+~0tvd@Y;Quo zQ=k$@1)vDLnX71rg{66C%sx1*S=^q8ou0n6t4k{IPe(LydV5i-pMUL0{=%>ROoHWD zEV|T@-+RQRzNjUZ0BF*it9p4jBXd|lMifuAp+R%O=JJs|^J7(YxHt zETExSNu2Kh7nYQ$$@^UA#}qIUmkN9iDZR{cBW#`r^3lK5gti>u{My1PC8Wb%tC>qm z-nrUk<$wnrE~^zUnbpC1;OeSo1siHCkFhb?owkV5QP#e;GhCsfuM5_V4aCSd#T>pU z>*ySfSCZ~uT%>-FwZyU*i!5^^89Ni*tG}}*;JZG~L^fq>>7c5mCCL%}@F0|1Vu{7d z`&>@1=O#K@B(0V+2pzNAgK3kOZYY4Fz)L}_{HJSe?2eUPo7Z*3;_bhiw@x}WwGcNq zSp@~uL`e|zpZc8lg7O-)GhjXF=l3)bU>t9=D`@yHi+$`T5h5^7zby7I)2AE_8(Y(e zeEkuiIrGi%ii*mvrZ^3t5pl)q zFek8`3+_sLYh=V|zk8h%g%Hs7c?A-V(cq4-zBzRkww?;SOvaDddq8=%`e5 zb!l{ijzzC6hIYjE1q`SC(c;@3`^L~GQSpZ#Z3nL)97^pCrQrg=8tpI7B~R5u=K@CZ z!-<}rX%UPBx&hBAC^kln4j7a9K)mYTVxCU*Q_X1p0yjTDi8=Ahmw$>3*+fJ|c@zP6 zh5o&Rn%Q*z>z7)`_HAIs8=K@wqF!J8)1COF7rzQfwT+)%1r;qOCTbM=-#&%C7kEJD z+w47C=I7LV6gIq%Tg`N~Mfldi86c(TsRjGZbLRR@O6&HYUG*Of>hBniRnXa$q@{rh zu2CP=-s)1h$(+K+fRZxi{l%$~NFcH8-uS!c?Cgy&YEQDkfq?QvLnHX=Qm4Q!x6HgX z$Qdv|m*^pJzRn>sUVBYV-6D$A${OGLu0>X1yw%N%M4rgU&D!t+prk^0!icK(8`+%ySS(b4OQ%-(z$_Vd)KV*xkqB+ zkmp0w@FAkhY<4=Mhz zFP>Pfhb2G2OWDz$U_}Pj4{T1|c_NkK?ZsW#lcZzw0ZMf(U0qikMnIwv{44lqSI2Dg z3JN02PVF4JEGO_{sQ_S)T%^_E(c~LLfg~IWdaIFf$v(09K;Z|>TrZV|)pIs!lfl~jX#a$0g!9QuJW8KEBXZ|i9t4F@O+}u2S<~XgI>k?qBnHlNR#Xn z&T3uq6~o<4k%9^EaMEYf?B>mY*e789 zhK)j=LIL4J6uKOyH-j&bZd?cAeS(E41Lr#!JA%PUI^2Z7g{dhq4lxOd7T}obdy({r z*?gIhRzAx!o+0-PaOr>iNOm{EJ}2W9(|O~<@p>Y$rzt_x*kPUJrY$bm>s=doPt(%_nO(`2|jo7A!S2 z8?TO z#B*fNAF{T44s#0?1?fw^7|Z3M^QrgMInXa^+D%K~`ognDsk~aOKEn!$j!tNq-_K>Pmg=y*r3BqE}!tE&%=69iD(R#xs=f0k% zUO9kLO-S(b*Q$_x4&Owjc3Q@(qw|SY87!g7Vf4{_xGzTAcK4fN5Hd+!v_>*@eeauHGnpm4ly?kL_ej6|Eyhi?tP_ zzDG`)$ix~QceKgILb5c6#cssiyv-p0)Xb_Ao$SNY__dLX&e;z@!kL~HD--~H-AT|) z0@Nl?5g)kUN?g{~>Z2vKz@605^o7yU*MCjDurEG4P}Y(Pel7Q9hlfw&aDd_m2!Lr% zRIvp+(}YC|HGMFSB`{+?YY9Hn4K*=Qvavo}xDGUrWlv9jQqppg9$uaX0Fdcqe*{|b z*7nAPBZFT5o3$jQvHSykro%qk`^J4y4{rZ=)Uh|_Lz61=$abo7H`&n)?_9JqXwB?v zTosFM69BZJoFm2TXE>ULu>=rNoK)eH}~P>W?H@%{*JF>r{0iuo@u0YNtcuvZuc z_RfI~n1`p$dqoF`j0@12_x5`RJI6RyLGV$$`ob|i|GQ4VU`@`jW4<)4z!4A~o!QJD zvAP-x6`FogxS~sDuHHabUplr9Bk7`7sp0@(wp)aZ_4tMDkbsbD)yR?bN2CkG!GM6! zj^p;x4K{>(lkQuqLwv0CrMOfPnUPLmDgXiqM?cpQOD~f!Km_y>?zKD$u4|fkpC)Bqf3f8+5<$;qXRu1Y*D@#W) zcn(ZVN0qjW_O!}&cKony9bWOj%LV#Ib*hg=jRjvUdd21T)gU!Rl|hZXH`5f_FBQ78 zJK`%yF63ykxUXzVJe^kS)dADIULy`XUKJIOVR^1#3F(2;4abReMG!WhfH?$Rs)kxU zKC8^ps6N7}=;q&qs9i)R&f6Zr=wEgUE&mh7Dq{clsh82zAAqWcqlZPhc4xTv(E2N)+OuuB;2tT_6tcyEG7FwbT4d2(o`L!+gjz|ZN#V0j2-Qxv^kh4&qK zFQ&M)oP)<~`a^~5M2xdZN>xWq6pw{{TYk3i5s35o#aNyEsw?^CEtO@@SMhkr{E#_` zko`;C$G30CR#!9VtW9Pbi+dZbD^6jR{8ObAU<{i_JZ(C6L818XTG}ZDgv91k#idhQ z9hbV-6wA+lUglFi*nSb@=HBA3MaBRPE%Dvndk7Ejk1475(i)*aPuyW8zON&Mu1uCf zPMuv-;{+ZznVIOs_nXhpRB-SYk=HQ2+c!~^XiOR?injov?YclG;9 z+}wt0T_&_;R=gQC!Sib96zV)P_te^}jR>LzT21ViKLiyW`1nTlRzk%?2@tVFL*)ko zeX+nDVz;^W)YT878?k_r%BxA?0q_|>hFEA{ z>zCrvJ`o%=tnE3FxSe;DDt$y2nt#9k(alB+!y9XC?o3wbw6F5C-wKrq$^{%ekFiaE zx?^F^)babzc$a15#Aac?;>}KNG*pKNn*#)@cyN2xkU&V`1n+?8o->Z2AiCS2qK4qn+R#1pa0k?vpVq-d0M$Q3My^r9Z^O zi}3S1ZfCh2F+l=>{9pY`sjjcTdoVGO3Xa!UA-@_)GL+89d5*3jn7^(JY-nk2kK1l= zOi)4-Lq?_`c*3a+!2(!t&^n5G!hdCD3!ac!_?!p&ZQWLN@$q8*?=x)73|fH)WjNtr zwmmB>*L-s=$Un@*c7tcV65GSg`LqDVVL8}&_qUisWVc$9zGYIJthua@j6_y}y5`CP z{p3f!iCb9c=gj)J=ZRCo&%nDKIx#U@mCF@AxW#A|=oj&TlJSl$z)JA`O$^+4zb|gg z@l078C-AvHCrJ{$JaTHU=;`ra$5)GWc6LsVmd3!)08t9BaM;=u%J}5ubTPkron!Rs z!^7Sh&djIFjNgSI++ zbx8oKf7$426XJODE?Gw;B{hN#L;PhtYIeW5w{j7-ejpQn$6$ zGy9^Ptu#C|WjXuXy6s>W!TIFiWMhJk9RLj|Zt+ly6$*HGME-c>?Jx>UQoVt55lP9O zcm{|a*ZzGir7HEu^9$Ibp%ViGMC|Ntmp^_@QAw#bQ{ESN20_#N`wWB6@7RCag~J2!0#;D?{`vG7nla?Hnl^ zV8v~ZmIf9CpdyByU0r)eM^7!sWe0!LGBB*hKHby0Zfnap!@mttnxPu9>{u=O-{TPs zOfRbnyXEbshQyRH;K~An0uW+-5$>}lN9$uvm&qzOR|PcP-s*^DK-p=suyQ>;%vkRn0ZtJZdM}V@X-#9;1o|(V6e5@8eWRzL zt*{hKB>;ws;73_t^LUdA3JTsv>8wL?0JVr{MkAAz9R%md)T%y*#cC`GLHTFGH2B8o z!TVE9b($^%6ts3WRaCET^Syt!SrS+mWtIo=R2Qp5Gmp_ur6~|jHeiL8h8+Qu9>dX; z`AA{JSc%D;g^i7mE-OpK#@bm-n;i_)ma!y>p`VhHijIllTX}M_k}Uu-lKS@e2yJnP z(=EUE5+jGSqM{fyw5F0XKyT6;pz6u#gpm1}g9=fgQSx_;D(5DY+z}%@TZlvOS-_`Bf=od*8-?v>b)t~e0+-1jL}K;;2-(@Nji4y&RH|HgeUqf&5w5rp|pF1 zgHyo%5K%z3w8W%fXgGsxOC?9wH$E;$->yzmSrO!mWB4sFP*LDAjv?7e0rCTm9tATq z11l@sKl$Qw5=@4zI7P_&DP?j${A`FQ48Rvouz2`);NT=HvsjH{ZH_M;lN2 zSY4EI+5P>SBFVMZ*UtgUWO-X!LW0e9-}&nH_3o`$LWd^i4GUkOBkw{nO6dAhvFt7V z;kHIxVq$6T>vV@#goJG)Bbi(Jw{GcF+7w!pJ97W3eCy(zkx3~ZhKv|~N=+^OprAxV z?>qx;APSTLXq$p>E+bC#-RtW3|LW=jN!|{Lna7Wr_-}BuQEkqct;{!nDp)>C|MiRR z#tj#e4s;|Z3*c-&eDGl4koEy7x@@UQ)^H+(0a$9>(F1o>f#=;~b5Kol0(nE@cn zD}L6D8GvwoC5;#e&Stpp0QwNy+?x4Wec{sych8kKA^q%!kS0k-kGRfc=-6xx_3PJ} zdoW>)^Z;igL5e`wjsX36Yb85|@f@^H0ec`?ZnmYm8%X*Arys172;2kvt`gF}$lK`* zZ|nMXxf2Hkq9h@_hPmyOR+xoG=(HNeePRfnO&lneY1FT6Eh^ z-gnC5Ozls0w>E|)dx#vNL>*0V7xuFG4-t#|cg_%t2O`Goj^`vi&0bzeQ1-syM@Mwx z11cDjO4=4^3e4HXly}_!jTkh+XK;dzT^4-a|qhYk+_-;{=k^X*u!|_l*zxW3=(RME`9`Szi z8k4vf0{qx<1oyMV7f>IR@9YiOf_GIM4u}15Sz%!!JM;CYs=2f6QKV^GySuoFUtlj9 zaufS7@#cR8y0*$zR=b0_E`8%BB?JJGbX%H|y&Y z09#y~Q-gufZZD>p1+LIO zL>h@1C;|Y`lt>zZ3+>0w^&92INiiuY?zEbpYza7+gr%T|>il&wzu)sd~)_@gQ78>=^V7xBH^(U>m#?PKQvW zd989;Rb6$K5OEw_>ve40CqTO4{G777mXV5zha@nS?Fb9O{0OUcaeXY=n@v(1w;-G z>l1eQNn2XZF1CY%Ig&FP8V?0R4LfuEL}bcU>i7TuM*!~n{^sYn7p2wJmb|>^f1iLt zdYzj$t(2j#tSm{ZLu$D0I-9sth-vZ_mwmFL6SEZ>{t$$jV3D3`FQ*cUc z3eY4$!Bc==%SFORxrgK3s7h}vzc7@~2pK=EF*B1gqT(VO-Am(#pP$sfGVGru1wb%! zU+b-pdSDU*+MUlwKk)?<$o{Gt7%-Xq4FAxmm;I4|wZ!-G{JHw^`9{mj%DzAXDXof1 z#fv98$Je2t4pOQ-l^bnt@Dh!S8yrXO^sw8k?eCQ^B*N(JMPZ86FBFh3c1W=XPd2^fYI z=jF-ObAbV^8FMBN+jWGvMsC8eo`q!ueiyIKK@_Rn z>p!isw`JIN0-_77O@|XVH?`Y1q)O~h{9#vkm5O!$jkJa_aaS*Dk+VgEDlCmIU^91> zgs`E$BqP%mq6~ch6UL1FSKq?+?1yf^e@f2a`fOi|9vY&yw|_D+6$;DZyPauk_JO2o za0?g2z+1xLtGKLtUb7X_oZ9% z3j|->czU@Ry^2N6x^}iP3RI5g6>~SLVO=K_&6=T+jpVcsQXBKIR?t2T`}XZbSNIvI zhU@6)wzo*77Zm6N@$~s0%X}kTrd3YGSPLedJk)15oPLFF4LN z5}8<>7zTsg>4t1=nTEbTMoX z*;_mPQgM=dbWBQx=o?-A$93 z!M!)r+`Lp&G|lT^XtO=re7IFhd03lPB!!E2_Nl?s|1b_M_AH?JIi@;G+vl)Z_cu(sGKFcW&io z61;qIS5B^_ySu%gXL~1@C~X>)b_8RIi5uvP-GBUuSE~HJb#dLvqHTEComX$laL;fo z{LR4eFOODWP}SC+^Bc3UP(Z`ocAJ>k_;`QK16BJNfgXTh}i$o58%Zj5d63&9Q*4m8O`ZuHx3D1D;a+)U3YeR`p!7kS!y)h z^G0TgQsKH>p?Pt8QI?$aSfAWM9n!NmoSZ!S(aw1XD0c%U2)06#WbX?i_D)JG#?wnX ztk+GWzin=hGA%@6prZTuiEM*GgQR5N`^!`%JwMaqUOdc);^8BdlJSd?caaWObNI}? zUKBsV!i;ou>K@*6a8l;t`s(Au%R=H87B(?F?5Rso6Ds)jEjtsF_RVzW_I2n4%1SQ1iKN6wBE zs5QMtMXH{8mkc@`bM{j0@|yy}9c$x?GPTrXWC>crD;9#2FjlGmsuD+0gWWb(xiH^0 zfw}}jN<@^DZN*EQQ@0;J>@&b!1W-t_kfPoI?lr`7lr_PY_H&K~ZTdJ)Cvx zI^z9Z)GN@{Q?MQ-`JnB{L`;lCPyg_PI`}h#STfo`W<IUG1J&f7sj60gDp+1MyWNjG*4bUGU0yaAOUzg12rblGD2yWlA!M#g5F7&WoS2De zrP13x;P*>nVtV`I1ArL>yoczmk(x@Tr<1zVm=Hg0G>*3R{V_!EZ@IbWlePE?wco$9 zW{t7X(v}h_+bxG*4C zn5#6{xO^!{NLMo(zo2_WH&G{wR)_)@7ODe9Ob||4I_Ia}VPQuVTPZ14<1;-7=0AHY z7=ZyarOqJs*x#=i>A!2XjuQIoml-m$|7~a^%*n`x@bQJNK7Wkc?Xz<8o`=2s$;G_f z6|f|Txu9ZW%l1wXN$stv*;|W(9oWyNsu%{rEBDbK}(6CFbaO|KT1v z;_xL8PeXE&=55_Xu|!5A_V>v>))A*?d{$Q9azw0F2Wtxp;R#@p%>C~P?(d##EWmV_ z*dKT^RL`G_-4DAwlN=YLEsOv+1K3K>RL?alqpfKG$MIf%?G@`|7x~c}dn*!z@-_@~ zot~a8FDbow@YvqG=^iNdO_9DS8w(#)LRK>v@MS&7*a`-Dr)!-o%HD?Gw3qN}^#8v0=^{PGZpu-IM#qY;~7 z0`K1!=e`d8rDQ53RHWK*3l6{ehGC=SnfSrFX5GpQ#Qor~u;lFQwub<=Hnu35`EHjp z85$IH@9rz9-YypxB450bXUmd^%~IHU9q$bUy4<|A>IW+KiHU})sx=QS&DW-u$?L97 zsWqY*8qVj_zd&%3)`8O%{PN3y;S{S4CZz}PC6VNd@dLOu5l&Rvo1ZY?evez}>M~3; zpd#?pARGXcYYMfoG3gP`vN138&IbCf4?$;<1{XJj2Zx!2q_(An``tUqpXrE6S}@x< zo_5P|v)oy5T$`>-&f!Zg#(EfBX#e!xJ2q3(^?U(XS784;0O0g%x> z`}997K)@Ggg3E8@eMn*9Qq32``}__wjc*@6))&V>#8l7DW`Nab)yK2r(!n8Fv%~Mu zR>Jz=7 zl@6-g)jS zc~JTY2td6G+G3GW2B1LRTCDTu2O-2>_+k)sHaS(Fr!cdgZm3pa;7?*d2n0i(7u}uk zrASGUJOgZ=vU8$y9 zB%XFo6Ci`(j#j(Pj+mUEngTLTPNAidI~0)H2B>$uVc(^5!U?xnPX6&)*fWHa`lk~Z zX~2mr0qcbRf!n7))|!Ag?d|D#`GXICHZ(@3WVNrX%6{vKW*f@ae5|MadEiv3BE{w; z1Pd!<@WYNXwc_W`sbOL9g@yOEHuqMZ+1dt!S3Aeb0|MoR6^hNAO2}cly5zdLEd~U| zWo1-EMA`5}`$D(~c6kSf8_q5+{}uKRFoKdmdD-v|!&vnN=nto^O~^pSUZgMUv^m!b zTgF@ea>pBZb2@}E`DZ9%Vq&+k1VgSKQ&MtnaPYgBSog-N$2UGTwLtH-#9Ei+9R^uB zhW7&EK|wi*q-H)dO$Wj;?1l1-2JMsMl`K+OkqK#Oziq-IPF}FEaQ~*=a&>yuA1bdEs2Gn@+;vc_xgKk_qk6ZdNI&{)*-OTLxlc@!}wSgM@6s zNeU1u+k^9z#KiW;b|*#LkWK~%L-5EbHE?j!_yumCl7AHZv)I=v^fT_=yM+G?T96US zB|u>P@ng93w4;(3{uB`}+U&^eqBc=CC*bV#I-u}+ezW@i<(uW?+uU1=h`A8D9|jgt zfcJUs@dqZ^+?tvWTwKf(NlQJ|*%_EqHH3)QAdDg=Ej@>tlr#?w;Ah_LZSs#F>0M{< z?IEh6ID)Il!s5lSi{wP@Q&^}oQ8hXd4u+gqLpV?X;lWWE>tV|7F$yL(yu{7W>Q z_Zoc<_O_OYJpSP0`E*u3Vj}_T8E)TBgs znWtKB9hH<4Q&Vdcw;}z6N643%_ZXa%#KnoaAghtGAtr_2z8xQy6MgT_aZ#ZlD%$qM z$UtLu7PG)U7Va#-b&B+S5QzIY%3EAyG78miGD7Rc|LIb^+y;kb~L)Ux9WBI>f<9DTyj8cRo z2_ebO4#^71%1+42-rOie3)y>R@4Z)&oxSI6@4eUUeolS*{$9`X$FEm^^y!m(T-W=0 zzt8hHj`KKD_EyysGBd%m-tiRKnW4hq>pOP5YrP3yjfEvNQoYo6StmOqGxK?W_KjQ> za-<{#5ol_zmbt^2^@U5wHnQgCv;`DOCT!>_XP!LgjazO9BvdUp2DKD7<8a847ASiyD;VFm^U z^%1vL=e9OxF)_}DhVujQboUa!DxOvA!J(m?Tnz>;h$nGgUj0*3Qo>n)y0CGsHc*(q zOT0lsQsQ#m)>cWrgX$vU`~Cmgf;bNtul_6*9P)Io+9kTB1?yCb5b+aId>lPs4zTt$ zGS^yHS3yyc-=p@r;8PP56N*OkYhr4>-KC!<1AC+-Apos^Tc_nV_oAcKzuZE@&qJLE zmXLF8;vo6E>v^AvX?3`0YiH3E<;rKeKF(QQt_EwzlZc(Y&I5a(0P{*U{5~V&^O%$1 zjXxW-uOHnkG5ctF2F}5go|uF|TgCX=Irnoq7EgY z>q1`okuVJ^!M!Q5A6Z%TzdwsY$P!eYLbJ0<>FF(@564uLm819%Ghm+q7jF@;@?zOv zJ!Ya$c_J!md$4hOw(SK5M)U6Si8PtlL<>4>oIpHFiX2rv=Tl3|p%?)GmhRfx7FAY_ zDd!N}^PHI@0jcXTPK z*;}4(QImRXHX5)w?ShB*6`Fwxdu|GzZuMtgYAPyjGfnm0gb5&Yk$HXv3f<=s9Df=b z9&mCt4shq@=Qnh|V7c>p=U}rMcIe9e)_v2@U%r?d8s6e)ir($+*+z4}1QTZ*d8Jt` zg|LVSN^(>-uve5udS>?qN8aI?lChr{&_wT@Pa%mEiSHU zc(`zN+RIB2Gwp}J8o`D@G9)JA1Tt)}^OCZR2l~hRQq0%g80hJ-vRQf9a{pytUlCl^ z$InR-<^KiN0!hhkpPd-fDS$kvgeES22C*Tj`{*WQoq&r*Hy8py2V-OuPb>m13)z}@ zk}_@J0OOmWyMF<@J#X)pudlCm@jLJ2=zt8^XbRIW- z^X9_u`XuNjJ_%Uc*i;5xhdx1JCH&k3J4i2d-*lTc5y=VFoLhO&E4GSI#{(D9K7;MUqx!Jf{}!O>9>9RJYJz|hdv z_J?;o9UOPN`&??AC$-(ij13L>?afm1^3IuD$it@~fREDL+Imd{5(Wy5`?xb>PETDy z>ImUv-Mxx6cFZ8z7#|+)9Uk84&&tir0n;?$UmkC}DW?@vt#6B`8cv&}~ zDji9$UE^^%x(|TBCc5n>{hy!jJM0|ckt}%YGy5$udF~43661ZzmoMLT#N5qH!NvQ! zw`WIcnT*(|XJrdeke9#S+fq^Nx4N^q49h6U-)NbA8>GHsVvZLt9@@zeBcA+$tiH4J zpSL}P871`tFrLkQs`vyNi*x4?$maXkTUvq(pb2gCQMa0J*KMckza7KK2zh5}(2>Z< zv_UftD+G$k{ayT>UHnQ*nxGmvGH4G z+q<5BV$d{9eZG`#*F*-feF<)MMn)U|39I$|j!k$MSPEid_7gPvF?IyIfs2#VZE8;? z8$IW}l^fJEd#jI>Pj%|%!1bJzghU}tQFy-<<}lRc<>Te346+aUGJvrl`${S|%eVsB zo{>asmQ$U@Rm&TP>g6`hmX6(C;z*8vYMKrTI1@H zx8@9>u-}V<-G5`BYI4EQdg5mptR)~!^FsT1=;0bBchO!O~q#ijw`7(r^C&|1`dtBH!^89U;Syr-`*O(CUX4- zMiaj?D{>9GA(d>b&>+QyC1XpHJvDW8Z^CudaLa2`&IX=y`1qV6O+gHxIWOMR>?!2m8)bU(dwC)WLhNY!W;7B44-j|p6AMYnL_)s*L z6y@gXp{m)Dau+lU-VzMRsZT;<1mRjjZ;}y+DbE}KjT%}81>dMSHsdx~{W=JSZjsMS z&YIkVD}WkM@)pLsxeefvuHhVMLDYI;M#c@&P-6pwu8dI1W5Qsm;DCU;of!=g*tv)5B!EQ5hK1>vno8mL2M13+Ps+}2v0s3YUPgdH{)AJ& zL-9I`PtQLjM60wDH988GMl;RQ?b7A;+_Y!sq19YTQITOQ8oJ|ZWcW^>3i>gW9o8eo z37+3~mofB!EDqT$E8nEnJ8}5n99J9qOi5{RYqmqzMVcmoIMWDc`?xN4~+}vx!)JEPfe(d9e5?{YcQ?mV5fL*pT-feFkvpiIw!e@7j z&u*oAy(V^l!vZurX2*NFSFh$Z`f93`S&>G|nzy1aVT&&<8AC9!f#2*%Ngcc?J1eWh z=H1Qp8V|5CQGd zo74{%#_k0jro@Ke9A(``RO{LBMoR??+OO^9>4rM(I@k`G! ze~dhs+Mc(})JH;raOo1S=XX$+tqj|~8Oo>hgw#(=KxpVRIV~F-ure=1MXNxInj3fk9rCGoOX22p-~2)6Wl84sQJgl)N@Nz*tub4cx!ZuxC_Z+BMwr z*m8<-ejM~A(Gr(Co+2g`RJ65;$PT0ZI*R=yp(I~JX$!vjO}*I$Zr=w?_wU2FKrIxJ zZ#teQa4ISH=f<>N_({6fm9U$gy{)9=Gk6sO20EW8C@Gn>&R)5c@Z$$~ZGK#qzY{GB z@|wQR7qi2g0a-AfZ(Ddf1x_s<9#!b-t3z`k3#g=+t+X6m@rH*~TUx4f206L9Vdo1D z##no)f)l5$ZFEQo?|h(){~GBNML=o7`0TIEn?-&89F94$HdyYbU6C*|n`{mo;4;^W z3bFHO)*Br5ot9#=TPZQ zy|`q&WopVt7f5#N)(1_2b5BIp#x>dWns`)IPrc7?{0fOVTX&uD-@ffo34Ad&jQcE5 zP+2+pjm+eC3<*MzP?51{wT}ft!LqVyk89lk%g@T9PK6VAGHdUuNN=B#&?^vnHnnUq zT;}B&%Fl4|B!cg+Tm%<~i;nKYjUa#juKxZBwZ=Q$=<}bJ+%S>9Z1=Q8M92p`b`uky z+uGiUkw&$)Is??$-(XBd4F*_-ipPk!Rbyjv*f6k)%*HEUiGA!)bpf0_Dd~nOm6(*& zDcZeL$*r0L`QFTJ#O=o5ox;%zCRS^dw%$i3u{5V_89=qs|ClbwKYw( z%+b-XtE;KN$(1LSw*`^ywuASm?@?0&6GYK2Athz!cU$@C`-1};ad8UatV)`_CH;Zy z=JP*ErL?q^o4N{sq;cGP5W;Qt_N}3*>D}%pK0bwjK>dY(!{Yzr04RYXF&--y2xvN) zlj(wS5L$mSMBFq?Sq-AxuuyamB}qZCO%Qt~pF(c8Ik2#hwoANyTm9if@sFvRR($15$#vkqh3*1m8MMazc%UgreK@cVxsz#Sk$si~VnVq%A56*VUB z5O&X2BcVq;J+YSd?!bAU8x!E{Y#oXMSlZUEc=p>< zaqCb74=tS))d9VPG@bx2@41oLbMI3lA|imsy3u=dWV;0J;fD~IUYMHnaeVIs@F#Gc zN7#W?xBTC-{P5+=7PM@%{)d~>q|kIo{au#<)z!tZC`7dkn4keRbB6i?HH33>dS)k9 zO;fp_f|623NlCx`HQ)r_X^x;n8ZQ0C^56mavE%tCd`->Gw;x;h*1p~_wv`ULYe|WYJhajh`XU#Q)*HowyGke5*b-vom4BpneL0ZJLtSIA2~0q;0-d z$+-j~=PgrS==Xgn&Z{sZBxH?@>ObPypS5e@Yij~LG{B1W_a|%2pX5P?uacr7tbk(u z-y0h@$1g&lhiRVOYUSJu2kC#Q+=;VPlNbv@#QqPSv9?(^ zqhn@1#qgykB~_cF)c*SrP-=i~2fjqN$aS1nwG;aul^jHB@r z6t?392K&WV#1l9h84kK~bT20MNRW<1z+l8O=AD)>&LwCJ9zNn}uJ3B^}bP|Uu zZzO+KU0NDULp3#Bz#!0|XKR)n$RJ*GPeM zJD6g_@cd+9SF8L_x2H41ydwvP;@`Cc z%L0gvsM=4T25$>IxJWB0Az^P*c(u2MfrrPriKxRbj0J)0f;)B*{UYvV8p@5TX+KaP z3p8@fC*0?6{BCW%Xs~?#iOT8mpa2i#1H7dZ1EZsrI(6sl_W=_z zKUvCf{e{8;ydo$lGebpm&>vJpnq^z-wG#Gg{Jx()ak6!r?<4=iJcXT;?7{$WzI*qL zy1IH&62poRfK$qhzr37r5(FhJ9c}|v$KIi- zTwL8EqOm|wxQ%9>n`q@UA0P0z zxF$a5pi+qINlesRUNAH?G5N%u1;|mV{PPuGh_keml@+Ei5KHMf-dnAwFklOZE$Z}?#v$-JX(%TL$9N6q9VnSIB_x`* z0|K_n%bk>6Om>%^T=Ec(KbiNaL7GPuG0|1f4@mDlhk9D&d&xXN*Ph=2Jpvf#70bmc zTu&lU4@}k_#|lv?YHDUACyOL-=7sEoLL@aKgNvKn+w* zK@OghUpQU>1Z-tRqI~bdla&8$*fLH|vam|PG`T+JaI{R_%uHY;|2+axO@xcP2y;1d zGHrHN`7Zm}ib}g^@|@ApUt<+=PsQrN^}MuVUoSNIG3=77D9nHd_Emg*9|5OVkRniJ zZ;stx{jui6icJU;os}g9q|1j7?X@1u+SSit{2C8{AkXiX)5v5Q3Zu7g!@|Py^joP# zB%b_KU43a(Z?087?-%} zYFQJLWx$MGHzrgS6r@qr?HS5030Yad)whpqcgEwnVO+e4*i8D%S#>WtJHvDVu7-VA zP0cc(oUE*$1qEHSs-M5PNOM=~_z?foS7{p0T*fC*ERL3}=R`%F$H(u3rF52FB)^GP z7>jk~y+#_Eo|^i|A-D0%4R$4^;Gt$flPSo_vGJWSAU6ybcDJ^d-F6m|a;lf?4>sz( zyc%558qa*lVFItHxA&d7`9AoG0QI7XJdI}9<;0HuzY*bVdAj=DOq#g$C_@a)^o!S3$x z`P1`=TnXEgJv87XO8@^YmSARnKIo&pcE2fAw#O10ze~J$NtVbN(35-oPKD!rw$X)~v!G&Sqs#sNWyIoUQ*QGh+zwvn)y7;ZQVH8tB>L#bfl?SvP4wFlu6`oVH|#L5c%2orObjcw6D z_e)4Fl9Fh8t%MIxc}mjXJ@P zTZ~!B%IZ9OcANS)ps}N)kGS_uotz$0|L*S}{rx*GGn0*mCbn5`Z*}>P9#}s8hE7sI zz*In>ZE1-YfKaHnLs<{OZ*l3Ub4c5IWEAm6al@s^OqB4h~iV zgeQs_#oR6(_dddYiViZ+p`mQVrIwW)Q@sFFB<@ndp!@}WgR+7G7gs+EOU_(m88nByydQ|( z0Ou5UCnqK4#?`ACX=!UK??iC`C6$zF0efs!W#u{O-k?%__Uy>U$;9;(BZB* z^RTS<%cR7`JqA6~=;$Y@U^-|)TL8wmCc?&!3WD_DWs`vc?rInHH^#$lklIVMH6e^e z{Zw3BR9swIOw9k8$(OIv3a~P`xq%&Y*-rjM^v1|YBuUCZe-=JTY5CrLhO~(zlOHcU zP05yK6BmUFBfk>_2Xlgi>#R8SfNlXOh`k;;X&w(eQnR64o%rf%F1~>Owdpix(^4(~ zP7o0E|2jQK+&w69e6)O{#0*VcNr6CU*Vdw(9kUo2jH(?r$Cvs(+|^W9QVI+Y?>N$v zqv%@9+THazQyDA(+TmVdA9{t%N>(`pBfD4$UGICj+h-N_Pf&s+6&Gs(k5WK?9ue)4 zF;QYQo4v6SHd2D=92lVX%v39?h>KhJ^-&vS)c{Pl0ozDHL6PhGX(V^@C!7Mav-(39 zYv|>)!2d@VkbfF+Ct?w3yBmDb#m!dn>FHmpLjr=}*L58>+`wi%G&ecFTAn*_{v*mbo3@Px#1hs;w>S4VAUm!(^3 zXy4{1KJIuDmE}H;Kl#$C<=I}(P+rqBiCFY8hK-Z+Ci|RFY!?rh9r^ms!2r^b|BoN} z!A$nid?jBCC@LlfhFfk5A|dkG&DBB*Dt<|crh~PLA*vVw1cFexR!&}CTq4%p{Vo|9 z*_mGHfKX_K&&A1k#5*H9`*<$WRwZZ6d>wfXaX?%&;r)+*XO9+e?x|1m1~SwE!g*Vu zG5W$yk3g2cd26fV?ykfnRP7p;#? zc4e;Vw7;P7v3)NkLZUOOtweCJvANl6A5k+g@hO^5#p)RV8PQQ#Bm{Y}^az`Kmpm*1 z)d$JpmZ{6ujJ}Ht&GCdfm!@VG90By*FrCl>9TSM3U`Fd5_WO3vbr>%NbSE5cAONNH zS`df`q0t7XC(Qv(R}irzmpr;UJDcpA&2?#fi1KwCAt~|~K}00Q+-#M8O=4FB4mHYU z-^brykniz)iB+@QtvEcg$DKY*P+49LmRjwX31vSxvNg`p8Wm^HhvNi~0XrX1u4}~X z#pc?lSGS=Ex_%jem9H1D%NdxMwu;M3cg`LxAL#iHj;*OwkAyX1VJRd7 z*Bk4Sm0Py*132Lr8ET0g&t9Y+m{>SQl**^|Oif#y3J1>Mbw4O=Gfq`h2EfcZ_YvJ$ zTAcOXohBkDUKfct^0Nwx0_ z1<1q#>D|O|R0|hUK>GI4OVIDDw0?bxETu5cQ0eAAlge#R&!^d{+v=}gabyssrlwjf z_3rleuGD%6K+y`>A5JTSNd_HS5OiD1tI2{sX85$8)IcP1j)vsmgi8`q`OE z^1(L;!ryP;lUv%HY=p%4QPrGLw&Ksp5EE6@qWp&s*L9f{1g+=jP|0vuNJ)!jj0?D( zf~+oH(;Av#ihs>;AY_%(vTYR&_5e03EIj!}4i6Fg&^BVj=mgd^rG^)sdq^3Se zdI`qKA#~V;*&s&&iNZU;+kq-jjTQPH8VWp>ldbI-`nY3eb{0%0ut84)aj*~yhu&MY zfI7Urn) z)2}+KIXaeoB|TGll9Mfd765UATB_m_6x5^-qo5Ih^=HWivW4-|O=kdh;golG=jRjD z`PGR_?3GV&2-De*t@IQ`MIi*@D=aMP83(a zBeS`+M0;OOL&I2|V8i+3aYJw6i1;5;2p8kzEE*azKXBb*J!%v@~LrO<>ge z7nY#U{13U5om+VaL6RVQ$xy+5dH>a?3y5|3G{tOVsz`W$gCaj4c33e#)A!CHdEmOD zx<%&G0d$3UqP`Lqds7xJt|XP5+wL!Mg~t8x0ik(+vn@tI2l(7-neOiE7cNj%%K$#* z1ojgW7m`xuZ}V8?{XZ*Vdv(M<fcPRN@Fu5w48|)ZD=o+KH2@M~ zX0`>CRyYk#b-~hKIeGpeVPPN8{O6u%K%Foc*SOywqn!U^5;jT=Uwphu&R z-3s+azW*pP5p0ek->kOd`+u`vOvV-*Cm?}_~VbJoXQe%aSlbau{XXYXm$lCoUW z)VxS?(%sXVd$!T?!%@Jfr1oODKTCRNr_f;+YXV3^u3IkbEGK6>!MKR@tcknmArXi8cFNj>WXq zH3n2yAe35-005H;=&wj_7Ls0a(oo2EZl>sHaq98CaM+)D$Sfcrw*%VBPx$|^wZp_D zhCn)IkR*K;uy%A*va~E4?168Gd<$r#Z;ZwFK#@9MvO+f*_F?l|y_OkS>b3Leb} z&H7Hs*V7{{RQijs^%(JFCG7dzr@u{vv-a18Tn^bjbDNo&-Jc=8;$B*|`_7C6lQsib zoA*Ct6?eMv7?>Pl=V3TxW8DNF>=nY^7#j#R2fWEO2q)QHM+qe-B|S_vc<~}El49R_ zV{q`goE*JyXktpJn!1Ub1;N?I^_U3m5fK2+X`s8u8=gcpruc!T!CXUJT%ni!1kN2K zdp3|9s}UeJclfu4G=HrO5x;x)r#_~Cd>rOzuo{iv-Ek(DjBAjG&-?f6MaqG};ovTT zk3RE7{ORw@s`y|85FDt$JxLtb6#*-lpC3yZA4Ve$&VXFk8y1#8UVGD;SEi*ou8*_- zAOM3XP=|EIFu_0y*-sq!AfT+mNl{YE~UmE3@lSXapjFdw@-?bF)aJYKP1nDp^s z_Y-qeh*sHFTvZQj(HH)0(bApWFHu#;SkdE*dw<|^eflg(43K6r3CxO192yD2G+y!g`sFv;o_Zjvq4r?T&TjK53;I{ z6>y$idB=2rBtxay&d%wV_`7$BIshk0KQhsJbY*eitV?yC{YmX7o`uCO~*MLXA@^3{d6ZR;G30k`!3B;bgO8_<& z=S^l`wQ@W;`1qaE9Uc~47}65;cG@%rdK07o^CLTTgvS7`J*8ZRT#ck2u@M|F$^G_^ zCCa`_OY01L=NmaDW*Js)?rU&84`w!8F451_j?Sb1JY=U?J-&e<*8P>=9YEu@LN?mb zTsLI3mYIW^ng2|?`o(%%+DA~s^_ihgvakPwJ0IO$o2B9kl(lb0u*@EK*McuY0<_>Pwzh|Vtc5m>Llsy z+w2x`k&ovH5I^Ba*7}Pno0_6waN&>(8cr@w&ab@6mX?n4^5K8?9>RYMB?E%1KYc@j z_8uU92n5!Et!E;Th>{ZW(r|V@x&1Ar*GzHw}zcAsVCObxbu-M4*xg@v8)i3lmnH>UlL zkuDc%(0c~TmD$;+1KM&&hs+1iLBaE)QEn5f)XfJae~vlK2x0t$)&c_qb%KRhv??2q zxQh(C`Ui3paHyeOQ&KAO@-i0jGJBUudr!~7;jvwB6;L^}baXmB$*4oFwAA~oH?LI7 z;E^6VJAJ9_*np;JcUQNDne8?WCB$=2@ zL_}f=UV;Lak)D1U)a`~@KU3VFCFEUxU1F{=XL_Ts(7##lveTo8z-UL7g@%@O?v-)p znfd5r?Ud_F6gDQ(vXe4UTT9xs#Gw4#Hm=bH4gu!C{W&}4v~x0H?c!K!X69?LyD?sU zef_c#*M2&M2ZvW5ik~v^W8vGcxBJY^(NTvYt;VaFL0AEY5IfSrjhT5D1_b(RqLZZU zPtg06CMLvC)y0c~P7jK*-=8x;rwhXCGd-S~np(D|v%~gW0!%|_R`^noFM;CtJJDTw zdTAVRRI{^PrA98mxqUXy5|EIQ0ovp{sk>A40?26?K7!w?H+^O2F&@_taToq~p(S96 z8yS5Z?AcqK=GSd71e)f(oEWgH#l;QZsbeC!m?JohZc@*bpk$Yq0Ixon9?TQ%&%vO= zSUuK99Y+Txbax@-_a_ZEx?ctvy=mdo3aXq9LG0>E&)egsCMMS9fHIB$-{$;qrY+JQKx&vCgFK{uU+c#(0Q4mO1xz)7n2Hy~y8wU_ivR=4 z&b}=z)#6PUyS_}ZuuS1F{p>ynQBTnQ(JsfQ&U8aT40Z5NKmiOxO@FPU7c14TMk=_S zc9q2L|47QvZs70uBcXdSBb{;Es(|cDLx`y}>|-&HkB-axzT#5*6gI&Azq0aez27W` zL;qP5IxeU2DBr~S!Ppg_D9urVm7zS#u`iGl3NqP)y2U_oAdpVWF@v2s&nORdJ0g_u zaH)4~i}aIdO={FR3~IYgD+vBvInh=%YR*~?eWij%4_HDH;W-avje12{W?^D-`4^&> z8awR#bmK2HaYoHqu;HdkbvK|HKIs# zkdop<%r+@?Vp`hb-0oLxpPLCuyRHMA_HsEx+axUNJNN@-9!a$Ib>5}(b9$ynhXaRr zp+W?N;T#PqklLj@A!16Y3I8~{hBBhyb(-Gk7vAfTB%YbMx4%FAB_(D4nh1=cMMg#f zRIPIn#z=`Ey_8^k7hj{&VHpkxfD<8Mb8k<1e0&Y0K{!`5V!wZHUpiS*%K!Sc>U%sa zdteFyEu*!wMr#eWv!iCs&|`ifU?E9H-3g@WkGP zyC4ECB-gtkF`RH-8jF)AVN8@zmCiCtW-=9o)tTvXTW;A{<1K5BaPeO*UrizL> zpKCWqJAshdFxl;+*IkuHD(0AqCmWsXHT`}4m%MA(N^v-yoMrvjf< zVukIi34(#ME?~JLEbObbTAvnp_ReBU+wL`Mn_+$s1&^1ko4ElVSP1@jkqQj|HAe3unFac`DL%$ zaf)`{)+~aN>~}^+50+j5)ipM{feW+59Iqz-j*e^M1T&&*Ff#s6=Tr+CTrT-7o{Jk> zS7k$Anl~_5$|dH4!T-wz8=fMn-YDQ{wBl7FVW<9ZtW& z#@%gLIP?3UExt zo<}CWkhL|QzP>(8UsqL)Iq&8d6cxP|P}<*I+}=l3z`!Wz{Xc(}QI8Fn4505XAZCrV|7t9*{C+2zoPx@Nq>D>sEH)W+e zMCNLEcr=@ISnuVU(v>RUN28-n@&0K#8KCB`vR#f>%CPgJT31k2CBAj5%yL@f41@^v zqvSgP2VuU)uS#_7bF#gjB}DU{dKdey6-m#l8mtGy+>9XJI``{GDsnKHBZA|RLelhQ zJL_sb$&zLj<(y#xW@0=m=cFN*>yJi>4xa&)C=GGH+kFOx0*^XzUj=3PGUVjDnSzaG z1%sufMQeSt)SS>zmG2=Tb62>yxQIkt$IDQ?e*!3bxfdGv^2XO(;3={}!etU}z0NB=oNVFo}Pel%wr-f6twYTCdi<4a5Z3p|e?lP;1^`M&KV- z;e+fh=#;%10)#spMzQ(^xNiv}HxIWTi+u9%0B8rm5rT|}`Xg;F7Z*z44C6(Q?Z#z3 zwW0aAmyAuAA7q-NDt{5cUKLU@u|KgUBl0QyW8X;0#i&hj!gXR12mr^zrv?K9mYfYb zAr&#DqR4ppooxf(_Uy`wTo1Rlwzf$hVr=J0APPmm+mUZ@h_9isO6rrJt<91Byd;IX zvxo#7jx%Wmp7SX$?)Mn9j})0+pw=6G>Q?PS@<45Kqc-|e%DVmTiq87Mk6X=x!z^QUH@pPj5 z=2uri&It@4IMWYSqi<3tf~SDk*OU1_L%ELIZ>XoeK8iUz>z=i=r69r>8dBZRYz~cx z&{S84)VLn#%PSrIQ_pTkrj|fOTAHe?>>kY=9->qBUpqZ8wYZp>kihWy51?R>I2~Ji zo)STX8!R=Jr+X2E#)ffe>DAgV>Ar)zxB!ld#kagboGLa-Lt*y2T zm9*1P*?E3nwvWwavgn~ZL|dQs%JBgJ2)6~p<0d64y4)>f5G&3f&TktM(tm7?&vNQA z?7Y!gAw1wm#q-+uZEYC^y@_0td|f5d+lPa*pwt%q60UXeSPijAwR(l);ndHcWYZ}f z5h_~BPTRxv0yVLZxF)xof{CVt1U3eu)iuWWoy#^D&bMiop2Tja%(X}Dw2g|rCUD>3?MDnD<3A1=27d3PRXyK$?I3#wT6~#vpqv^$% zm6wh5%=CQhQ$~ZZo*xg4_}t##t(&MITpN2+buxKO3;l-Yci5)TmDWNPBWcraC)M`! zCSTiK+@b=4(H+AdzkIQxggs9P-Q-l}Ftkr2E_cWCdH9};scBobDaEVh^O|G)P`iGU zd48Ck$ic?7Nx@_G=b#x$kE*NPJejR9QDGk5sgn|EB0^0vx3z&Hh%|d#yG(CwZIwcG z9;aQqRHJh>QvFq#v(v8Kdh34fv%OocWA-a%owg#Me4^3y%e5%x$Qq}^^CF+p!s`cd z*X6>aISq7HG8W89v4}*nM=$R#2`z}OyO1{iX=Z5ZdB?`q&Ca>{Rxc4~-1?!+xH}!T z!g@0%FacGGK@Qq(!rc403mPA`+%Olu{tfIgsN|#kCT(z$k=rvZ)LH@yrucnKwsoKWJUg$5s);8 zQdzUyC1ZEBs`;?)hQQz0`wXw4rImaq=O+)VHC{&KeoV-9(lir8t3E*?v6oL<#>On0 z?|v95+yW`%y?ZmI-wFI~i=j8_kkpjFe!ck%QC|UEURcJ_(Hy4oE?l7Bs7ePaxYwP^ zrynHOXLzm6WhsiIzqPbYD(FJeGnVUPLTX=UzRFWLgWCk@uU{6EL%m-oe{5<>IVrvg z#S>X%Sbm0+29M)(rD9*N=YtyEuHN1^D#wFCLBW4@-iC&TRyVF6zA@Kpac$mb)D%E> z#0?LeeK?s24n+y?fPgP>{DJbB+6DMVs7q)cffm}8FY+M!1pu~rvbEg?b7FH>d3E1h zdo_>2eW|1b^Q{X2M}8POhp_1B=?Ms#!`vM0d|^Jud)n#`@|jJ6akIl{v$4K13qV7N;H>gP6Gvpk3srcPUV1Q;j1r@6?(p6Hyo}!{X?79sP56?$7 zHa6%~M2-?u<^h?wmnaH0i$6aMb`T?YKl%6^MsQjma>=K4yN7I!m2E%f;E?Lg0~Il| zda>qT%>LXzAo&K=*@7-DZuZfBS4l&ij_tz!d*f6^MwBKu!}XTXGE3SGTeMRXcE>ox zAR4WY6NvDF)P(T%3iVprImE_5w}>A+(!IQnTVKk{FO8SNR5g@X@{LRVGUDp$6aF7y zO#I_NuwLxkIbE2UbW%A?F5ndiU!_{5hT_a?h+HpJOXZ)rMW?qyk!bFy-B zaImy$gj(5**;Mwq%Z#7!yzqYfxN|-~r*7j|H-^ejyNt{Nf`}%!Px024qn0&1a!Ah) zL|K3H(T_!L$q2KGoA&3d(>di!j1;#aUDT`B)ZV_`>JW;}k`G73F_WKhe5s$JqE^T` zQfVC3xVh(pnG6_$rJ7+)#O>Ry3!XMmWcB)$*(^pJZS!|T;jRq_ueu;wf@4uXS5|Iy zb+!akJ?0%Iak+ithV|6bxJxFQr4|rNuIcd^5l8#q%f}_lsK-P_(K)Jt+w$388Q$U8 z*~`_b>hptfUnA&&BF-6fT(VzXVzxCx#QB1P8jOPs@ALDsQBR6>%^Mk!ot~Z}&$M0Y zt&ikhH-2;#QTX()sql>;Z}I4nl6C2ry@}c$kjn+}Geh*1DXKbfZ7o|_nZ&pOG9DlC z@eS0*KeN05$vgUbdcpN{u80@9m{SE-R?8n?&V4>dqfB+D%-cIM7Bxbi$*CtH*Tw9C zc+sy{{_yMpC*pQ4)>ch~SFK;{32g!IK7`ZC!KNGJvBw{=e)tf-lvDY}nFc-_OSGISR?3+w z^(G)aCc>|B@CUr;wA_S@q7`(-S~brQoh0~YmNkkR1#e*>G)W=`oJ?9P z)@x@3@RR!8xk&vjgIa%@V>?_){EH^NoKqf=G)0o@*C94UlaSDKtuMWF6K2tgJVR5&g-YG#QJ=205^E~9 zSzqV1n6LqRX0;+?#i=Gd(ro0$hw@{4H2Q*6sQac~ARMKr~{^ zme6pTCb0_NbnDLFGf*yRwQIZ=Ve51iWksj6z_c0#1CiJb-#mCRZ(QRG0 zQ-}HM&ot9h*T9ZNK%joT_8Jy7KY#vP8E0&7@|OcR2-@w<&7*^9+#m69t1>fTzu`um zfU^oden=#%?yLtkEBSLQglXr0_Z!TgE1mZ@^P4~-Pu~$s9}Ks=)4aVsdz$XKjKl5N z;9v$E5v#4QDAzG04ZqEEqju`b52<8{v2>d0txrdHm&Nfym=A1blj88QMv6_Ad#JhT=_ege zDtQ#DM(j1JjWsbP-te)Wj@2BWW;(LZKNzf8-21wn!#2Szg|6b#=%9 zfyimB?MgGpP-|ytDIfgqZZV#Z(PazI6km7sCR{n3KQW5kqeQI?sSsi1gqR-fQDu@B z&jj+cKg_Nmj0$SjOF+}XcU>-t9mqsO(uw$T;4nd_5jE8ZUUA*1FJNV5u=r<-Cndt8+H zl12d$+MNw4P1|f};8~1#u}w7DVOk zk0N;%lSdxd+}H7k248U+-l^tuTejg@Z0RN&=}HBbc9vDdWb!so?Ck7*w=KKhDKwn<;S{jJuSMiJ-w_K0Q%dq_NnL2T zzmAc<{<}9njtUK8Pgx8OjCZ^7mj|v3N=iM?%}dKpPXF`mn|GId-8h-a>(_DRifIb- z+9UD(;#m3q6o z(=BEKJ{FXijvZ|NnsqrQthQL|{c*8C(S?swabPz*qD3s0l#MlQN%Q^%;f<}W6Ne*& z4?7mN_WDRk!SFdhF9H|w=@Ud;Rhq(A^h2AK!H=@h!>`n;kF*ET$9})+XgCcIV9VY4 z^^xf-iA-PWOGGEpe}|Z1Tcq=CK0D#9LcqBom(As1gD_y75(|;a^&H22V@LAak^+;7 zi2>=rcj*sp>V;g~7$G-#_~huCy_FM}MrHUvJX9=B7!SuExcjR^LsjCj@ZZ<4ChdOv zsE~a5>hjVd(SRCHTAI(<`|F2!rC7%6U-0JTI1L8}o0=q+Le=|V{5H81&FX$*Y9hnJG)O>1L*OfmPtG-7V?V%vNf0MkCB~XexY&v% z9QMd=qpQx%6r4wm+b_%5uaHlb|7QVY8K6QfK8$?XRlr&WB`Z=dtKY^`tVVuRhFOt@f* zMm0i70>Z7JEL0hI(}B5y@3S~srgcbi5s`D55VPNv@T#lR6Ib*p#RnkoYBryl;P*q? z)8cql^d;hRPbfJ4o|#>mRZh!mW8MKNt9`8l08wuhLg}hVdWQ_>(nqSA=S8!!M4q%v z)i3W~*L}7Vxxmc<6jpTCI_)lJY=X;=xow{8 zvj}RRNI3>3w@0u#pJt<6Zwsts5xY@ol^y^E(2(XR-}y61deXeAPqOX3+v#WHu3u%h zn9d`v!jN62LZcW*Z@Q9hmzVaNH(L>$LPo`-Q}rk~L5#Ra5gc`gVsI~07vQ+`qar+* z32g38uCk`*eSB~8sB4g!4!}6$kGF85vNg6%b?$FS=}k6{Iq%?BUJDNj zdu?Kn!z*Up-K$DW-+{c1$@I#K&dbX)e&wfyHWQ~!7xZyCO4QdK5Iwecdt|ROd5w`- z-8mK)$L%)ePy2Z7&!4YQ1M+6PLKG|U(s)eH>0tDMnB2j`v) z0gq4MiaF9d?3b_M3lT-7 zR0IVD6eOgSlm?NIPEk^jPLXa5K%}IlySt@TknWU5TDm*l+2DE3`MrMb|8CuTe`{jR znl)A5K5paqx`in&@!YVua>e3`*Mu&Rk}LD66W?wdzwyAKmz0$JOuPyM8ZGB!QXFBx z?^S4jYim`+BJRu32iZ3&PEKJwb(39~u3Si6{QFGm&3ecKBMvLjV|`?jE=bUJ8eOXfr=!G7h+e4)vVO;#THt^#6Miv zl41Tn#`o&Sdz|SPSCLP^2A7qUekxewzSY*Q^ci~Xg2a;Y-+ZwB+c=$kn*cjDaxDcL zE`!23NQn&kS`wTbJcpbK2xc%MCoUkITf(!;W|qqgm`?-*&|HYKRHJ!){Cu4U(-kKt zE~u8_kEZ&U2M1Tg@*gt(MPy7t?s&K)$5s@I?f91k@CGuuZI(m9BGN3c^RYs35f~ZC zY0&jX(hvjjsn~WvP4sbHpPiq#oo=FU?2hKJ_&a3g5(vo`Kf2|?gD8lCv2JzAx4KT& zquX!Izwo_*#t$hwJ_wt|$HDKV*Es&5-%y_tCYRR8b)JW3;p^9%Mv%m?2%qLh!QWNP ztinOFV9G$H#Pla>d=Crg9sL=t^jeyQ435VZZv)a&)CIzWNeB-eig(={eSKMP-!>K! z1W`L18=Kx&9E>^clXci#ukIoG-tH*n$Oj(q)erFZx@Igb3jyufNrc8ae#P+>(%%`O zIjW}0!>$P;?FakCbYt;I?2F=Jw&-Z9r-G2q{W_AvBO)?i85P71fw}J>b@3i$fL@;& zAPyLbItFyEFWe@tUd?r)h8Lh7P^?kSfI8OH*QN|Hd?$SIafgmc z)h@C6b9Fvk0s{RkFWPErck4+{pv|K16$7I0{_huGCEst*77j>p+N2KI83nBn`oak8LS~S_NzL6@=)O$LZ$!Nb?;DuSY@;3cU(j09=Kj zh@K$Oz&lx1YJhIFmWB>1p&JUiy1K&lW!V`W7fVb>Kmf$FGhWji9mE7p$9&hfOcblE z(D*OuwmX+7v(k2UxT1};v`!1fh&&zEsCF*bZC)C2fbwH=cq;~ieHQd5`A0|FP1fCM z>}GhG|L4btn~?3gQUIOm28fV{qhSvlSE-bUZLNLG`!IH^E2BcJI|)*W{;2ii#79RC z2V(jAZWbxRxDE@$Vb>Y?hI5@;=QPcdl9G@0hF3$myc!!BQU5dOr1M&L)nPn|u*jX? zJ029hV#}c#+qk5oDy^>MB5i5aqqvA=yn#F}G4Y!FSX-1wLV}R*(U(T=d*r10Wv>Ll z$w|(h`)-tQYR1G~_ofeQE%b+QXL)&{SARxN{rWT89m}QM!-$?;jZp4gVp6j2&7O^R zwQ8~8ReM|g6l=-l5g)pvAa|eeXx_b@9KI8oT?%$~o1?*CFvZXN`cNUb}IK48r`z^()e6Yf%M6w2re*L678?yzhU5^H~G!woG$G$mZx}hT%jcPU_TxP zbp`#k;EiSme=RNf2lnjJ7kC|nd39;xQ~rlACh_H#)? z?B)I>7qhXTps7_Or3m}SrbA_Udb54m)^*iKWiRnQ${&kx6&Xz!>J9hQm^c39NSCLD zl9ToWWmNXADYm+quuyxv-2aUji0Kc99Pl~AYWx{T6rOmy4BGb z$#(l*H^hYn1r{$3mO`Q{56t#8M-FjQXz)L$T^HeT#;?@uHuDK*0lQDXKNZaMS$Fj4 zV7rw0M810fm5HY*mbXE=zq15Gfu6`|{Ve#F;&%P|^=PX5lrXHU?PQZ#0M8wZxN>HJ zwA^YX%kU9FmL%TCp%T;0rA}UQa;KW)F(Ove?M=@HtE{4hZ+;|PvUndcVjy(e^4pqc zhu$Z#m;HtW7mH2`^pxU7V!mA(e9I$DmwXw^G^oo-FdQ^DZEAq>QTB;jC|4cH5u3B<$M) z>Jq7@YD4;%Ca_WXKobAFX1^IYG!jfIkD#K9PG=`sGNtNr(EmB$ivssYh zyR*3A!shlhA_DgooBdFqk9nT7*$9@jv^X)hv8AR0L+HtF_e#_d>)zYm0M9@@0$#@K zo_Izvyz{SLzlJn0Ba|^@f2`Elt#||;Qb=fZk{wm~ z0V4hR?p-}|FM<|M$5(#y^6<4?DW5Bx#PL1?A`9%xN4Aj4M z%$MNcmnG36e=>g(DE$w5A@^7f?;~_~C}k>F>;K5a$>JekP-nHQy%{F4-E_Uv{xY+k zt~R%~FVS|}3v_gJ0XzUaxvZQwe)}IKRj1^B8;s_2A$apgVxf3RRaL{RWFV>mQvi?C zauJ{p9~%b&yydZKdCRFUe_j`xjMy%&YOrT}TzVgCICx{-__uAZ(ir3Jn=+9P!uLaf zGeSsTR}?Z-)X@w$EoJu_=^I~C+}z?~{r>FIaKN4G8?~88Nps$2UIA>Qpg?eGkX1-f zt$g2d>A^8=9U%MMJPT!IoQAm*y%{BjeT6pG&ORsk|1Zi5d!eFo46M@t_CpdrUoM#Q zxc|BdiH!{V`ZX~*IhB`zntJ!u;I|AVhO853BM)CSUKLJ0>T%V-^1vdx{QjYNQ;RdY zI{`0CN$#8Uzr)!z#42pguV1~wI~qUkrg|i<*;ajuG>PAB=24iN8H@(dD38gwQhqxc-&cCIsy-a3jV!$jqkcG_>(uk>DYcXtOQ5VXnl zJ7n-a9@vl%S=mkocdRQeI9Qt=Z4uHEu^1nY)GZxdz@p(CX&M|H_{BOU_iBS6%d5CZ zx!ACLc0A2S1pClnvLuEMHNy4z<}>r0P8c!QHu^_v+^#p}vfISZJ$V2`*qE5oHH~ae zMq!ZLZ75`eqWTxSmGN6P8)Jo_A`xfbA7^Oi* zLnB-G6&x0TG;=8CfRFj?&U^bK91$XgaEZ z#{Ft&c+(sLN*@D4f~|y0V!HTbm3Jh7l9c36E5dltc>GS;!9Ma#D5H4A946h|z z$@|R%yeC>8R85Ob7V4nvbNT)1 z^J)Q5`ebA4y@*R(sd*HhdSDY3rIzF2!CC&z{Ue`@361+MdKRO#lDTj8C`k_Y97q2)3s2g<6*iL(TdNwxe;J0!c%x6v!J{!wYsf0oR zhQNz6OzhJ8j?t2hkB!XM$J^b>qyV_FrJHx3jF6OQ|5CcbXYT?Ps`q41d0O$ZvYwli z>`+R%5D*?5v1@!(y}USB8S3Vi)FL|7P6qf+41*dleVYJpGwuK5gI>?D$Y<}opZJJW z!a*AEBSF@nbBTGmD#LNLpxVwp*w`Uk8|t_9qbKUG{6>%JB)_K5G{49wR_P?vF*VH| z%p53?4zuaRI{!hr=r%KxR*4xOus;;bttBli?4X5ES^0S=gGs#)v4WQS?rvgk?hvU9 zcU-1820||xweKrO^VYC1Ev+$MXT?jZ^vxeJ%T0McKFKO#K9^{iW%OsDV5}FC{R)N; zU8G*P$PIa6;g(-sq?LO!vx5|})cHq8dLZVVU}=R04RJLd((v`)^g9&{x-Xpn7|nf4 zVR&T^c@SElM_6Ra1I2?P@AVQVcKtUyl#>^WsS^$#K)y4oZY6RcshX>wH2)0xp6uu1+`^#^9A7J51bQa(QyUA>jnxAIvsrl!kYiBB(zr2Nzuwzt;|KtDMC z%A`5J0VM;HYBa;!+8V(b(-$ zSHDN|=to~$)tifP`X=fAVYhDe^`@sWlEI)HD)!mw0y)5xv9YnTGP8Q69oOzP_S6>Y zyD>ul9@Mvr3iBW2^@M8lFsf8(lsf)M$~~~Q-kvw==&IH6i0ENf=NXaTGLVoke)8mV zQIT7D`L1qgJk;bx0x7pf9SbV;S(w&e3B1eKtO+3YK*&4;sb=@~o%KzR?Z>$NNO;C7 z9UMxBr-Ek(55r?+sQ0&{=2xnPK9nMW05X@`j2URj{q#$4`+b)D*0r|2TsMs&!-Nc% zkU=#B@D2SIaG)EE>@8uBG-nnu(xW5u^2{|w=7Yt@)lDA{a6Kjn?XIn@?M&1C1HMH| zW~?pbc^~=(Y-w@Hz1OphA~f5hbt|9AnmJ(i`xWA^8B{_^&X z>3QYuUd6iN5G}l#s0P>8-_y>6B}Uhjb*9e7{?ead$Fbio~tB zg$IzM!+bV~q;6nKMsxpc64NfXR*$|%NhvjX!^Aif8(V057~OU1Z2OyL`?4IaUfnr5 zydV~_-IeqP;NQU_jn^vZkRuu}^R~3NGbT(ig&7x))pj~x4;GuI)iZcf0wF<#<+QSz zl5Bo+sM*b%Hw#Tip7y&T{An%Wti|6>RsbCH%nEvJKUkjNN51^4)`@}n@go&?OiV#V7Purl%7;AF zKmoz~2ur=vQ{8Pqo9#MxeGRJj3E}z{E`>oek-(1IrTA8L<&K~vz0PO*d-Yn5@ z>SyGl-~b8A2zIljjoD{i$%@qLti0J55!durgN4&D_^#9H1`>M-LR}cW?B%Yi7Ik=d z;j=sRX*ezZ#_%B=sX8Jnxqwh#JcEc|`jCw9-4!?t$M$K|7WN`^*_mo&HUL^&EGeaw z>gG~O4AkdPKaiydjK;o>RM>IcHE&ej` z4oAM3m{^&Y*Xx%skSTUOoXe&)RKr=JvaBfk3L4VtwAIT9lXLFeR_BTD?&;AUD*gZv zFEyu5N9?j#lHBBtF$c5UCvhF9kG^)sL3#PBo(iyQ)pZm)-1*I%2M|?6MiXvbDk*>r z<=Txl&dz4tOXxBKJkGZXNn>7YmO|wn>f89A598x1xP=T2-Ro$99rQIk{}B;?*cs^A z)bt~+E~k3Ay|FQv&E&~XFQ{Uo?1<}Ux`z)JKj1!J8gqHT!BM0S)W2?K-AoXajtvb> zVMs?uXz0~AE1jL#J7s{xrp=TP-%iTwxc@h0Ouu3xK|~s6Ae}y``@Wm!;mq%EAMJQS zv7xI5T>9mgSG9$e)mxh!DEI}2rhM{o zBEiG!%M7cZX>GPtBS%C9TcxJqFKuiP%M{+38<(jWsSK&3g&Z-Dhlro!A1s<_s@9(` z3RUlGN%^sKOz4QrBe+wYg=rpSm>`?(^XVJuty?C>##4)nyT1r6z_wYcff|i2uzY&c zU;5tcOwkvmWVT;>qMcCS z8!eXQ+gXX_1$fEp*VKWewLTpYqGWgP%j2d0 zExU|RQ$Yxrm)9;-!W6@OD<~?8+4=BGeB9q|k*4WnBF6pgp^+<>zcC^F1M#O0w~3yK zX|SuS<<~FSpOL^=1Y;)t70)#~P1gYb>K5I-`LOUu7#L5it$oA7%J^_*W@$I@FPEl0 zyVdhT06Iqr@G;-NlSxvy`lV;ubX5jP{|w=o5Ag{I)ON?m)%h&c*YOfYO)m_IMF;`Z zozMyv8T+h+Hwav4{$YxF2ij&ywja_q9(FUKpf}=9b zl+<&|T3Rr+ZoX~~I!ucf2PVx74V6=TH`<~!=F4tFeMuoBM7}-x&Qn2pWfo%y@bv+Z zAcx8ll(ymr;$>wYL6tF#XGppL4x6ar9msYd!75OWj9@h)vm1opeRROld);*gPM8QT z^8O>x#Gix5Z>N~}TEnSm>-)O`*a;~qQy>)vQq6CRz-twzqi?;4HAhKgzt1u{#>dYB zg&2Uco=ys7D3#z~VV#kw`eNbk9<41orUDAq&fu{`FI>D=OZ{T&?L zw4y(Q)4`H&rGqqxo)O)=34mir$kpqDaGPR@#Y3Hed*a0lk>&nEj(oiQsDoJt)bP4& zf6e!1*(_-pak=ITon5@q?IjNoou)OB0!*A>2U zRf-pZYhnulSNaeY<`Xfo{REM`vg|8}j1cf1VXR!%oP|<XKZ59vN5pG6b!E0P5^LR}@n*}Jr~0ti*8t%MqGx@inl zKDeJOt-VIstvPq-_%b*97WU}14xD8tiip{pp<+~^4_5(DGqFc_2utFL83mX)*U`X6 z&^xezLr#)ZA&`8EDAx969b{(Fd*Cc3>9$lkQDI?WUBF$I^|kt2*O@?!App96lHJK9 zd`E>qQ0s^6{O%vO?1giPf-LRx!{3z-&pA=2yF|`B7S>?c0xY1^R{1kaTLB9c2s*jQF^vA*G=qCB}VjMrrdIiCi|X zx_YW8F2Z=p3y6&0X$^E!AO@OQZT%mZNRgA*1k3Om35-jj}t zz$ER=drjNejYHf=d;h*9*uzZ~dwX4(4%V&L>l?v;{+s{~TSj>ErgC|)JRn#=FD}c* zKxBG(?AGZx_dWIXYuuxN4ICc_gIo0Uyi`||#C&~=QSR1M?=GVMpXFFvFOOCpLrHfb zOR6=T6&3y*Ssx!xi-(Ho?;ahP_4H-A1S<(~hQ#DxT`Kht3v1oxMfio@Y|M;+n2VP? z5o@}hmKGfm5ockjs%d;{8MtXppn;*b?8DiXy;C)XAyL4f(CbQuiS;0c@)3N+91kI3 z{ar!(bkYQ1#5QM=tJ}Ud4-38e&)O^aI`q&<%H{lO|mgCjWmYQVVtk7z=^i zSwI0VDoTRF=3K^5NrHBMfDN(PkoEVvx^z{zT^UMdtOjy?bc<{d7xQD>4QvG7N|1i4 zrl1WeDP!js@UX$bZXpYA-AG;YQHBxX_;{c&gNcU%BQSNWm&R_;ItQ^)Av}FR<1RAd zd(KA*1u=m1-r+)lU-}&vsKC$(#i-1Z1YB+XhJk@N74|je65KnS5NX5= zW)cJKL8pnygb8saIt>tF`HpvAXQ`UrGm(Py4ws}>G~&7|iNhu}8<6pjZk7%wJ`3Cj z)8mVA!Cf&&JNsy|O3S*}lE$ z=GK_5`A<%lvro>zAh6Dr*U~bjQj&eTknOd4jp>($7bfNcaAvw@8iGf;TsHA)s<)dnsMRiGVlMs8Qxt8$HZyD6IFBfh z0T%+ej6yLWWSObVs$waotGiu&B5Y8)4A}IwYwG%8=aHwKD6X*UvHoaBT1;&7Mm{_zb) zJ`G?Wsj1)i+XdGTsr;bxIv$W5R0}hrL<%#_5LuhI|mE>m9rQA{OOAq5~L4AT&d5FgjOu63nGa1Lh#3> z7Aazj4QR1GFadzgY&p#tMtcjK9IG{D+*6ZN8@Jh8Z!IE2w(i>KxM89-EqilPEsu|Zd2m8WN3b~73>ezLmyhIW~U^U&;`4=xocDFfUTg~t%XkCbgOc6Q{wCX|ZA#K&%p*2~pdW zJYjll+MVo~krAlh0A_Cc#It!i83O~JwCF#7Aqlt$sI3IDrTF{*$=BfnNa^j ztvd0rbhxLxz!c1_IM9}W>UQhe+mU(?)V;l&{w-z+0)o`!jFcm;D=LNhi8>b$ytA-x zKRGrQhAoMM+uLZ}#wIRGp7=jZMt=-j8C_VST{p)*21)FFyIpi4<`|q~0LuD8GQ$Bfnhp;Vy z{ZJ`6z7GM4eGTNkQw=3zx3_oAjp5y+F4WP?Fv7mt(_gb ziI)@5=S*3w- z*(puHcr4XyMNik#mwm*_r;(;Zg4nwKOZB^;&&T{_A`o~ypZJ?;X{kb;U36i%^w)(8 z(>q)%{^VhxOwp)4zpt{lhv7#;GvC*{v2wTGPmhzU*?OtW`1Nbs-Bk*;Q1lUb>U?5W zqC`O7#uXuJhUW3Yf{f#)jYG%j@gK}^=rWd{6B44z%QLpc8DBEd)6x!gb*UaGATpoM zZg+25v6b=9U@du_#a*E!qn>TyXr{fpiA_#Tg zr>jneJ*kvL04Ut})e7A_o33bT*w{t(q%{zyL5{vP*C_xmeD(6^D-@UdXmg`I2E^J$ zBY-Mp53+tJqs#Nkn699ZZjV?B@@gl?il(G{Q9xsb5m`cSRBFbVinG6Br`0v zsZz2GG)7N%NH<=fE}3{lSR-T$M&O^+&w`%)XOzrx)ayyDFSEjv!fg)DrRGBy-7#EV z&l)z9eP#xRIMn@eb?tyR;PFv)XWKM+0VM2X>c{w28~iQe<6xF4{#A2n78ac*%-63? zaweCCN;WQ%dZYYP#rw14>;@A2Y`X@n-Qe6D)w5?b-~?st0O$eH>7J|w<%tFuy8_*P zA>y)SKz<|_7iV@jAkx$<87eeLM{S;rNSq8r{Gu#91t~c`Fo+;koX`yNxTVl43o2!> zDXW*yoQSk!cuz_0!%*&}BBK)+PVp3s?*qotVQmO~?&CB!%P$UYB?;K6)4y1TW-{ng zgeA?QVuxQKM7z?HM*dWAq-@XD_8aWk;l@ga5_zGjGG$a|jm^Fv9E&&`7yZ-spH~TjU^?Q*{G7mB_sWqi^%1(z+@EK!-fj#HP#DJ6-9uolrAkT2_51H;L{ zu)bip@mKiOt5jGf;G5xLVe>nRZg4YY65M?N8q!ZSQi}QUVGJKTETS1~N}&c1#Z(=n zPXD_UtGSMN6?W3b?&Kt$3m4o`nd<%CQVW$ZiRTl!&jQ{1a~Pe8zc>SWw6SG!>$YPQ z%EpVuDYG_DH|yaOzBM<;$Hu^LgJDjU+Zib-dXe0>5}im8>ND`vUYvm)8YbPQ4C=lA zjumBWIz2^#JNGt1q3qz|iRxRzCE->>EyK{z-f}Z=rj_Tzhn$05+rNOBAY#+QrFd@l zs^>Nwc1T*I4&3JOFJ4q(W|jwIux&b;qd~Z|f&3>4(SrnCd_CbU1aA-ob!eg?6X$_u+V6glSZ{P15C&Xq*vLdq^O|YuYd)C#zrR%35hAp?Cf$j z09Zn|mFRztgxA8{91GVkh}_e#q?%c9*vY0(VBnt@|px^=9|nC>k@30xUc=NELGLU9e%mNcpXy`V}A{DKG1pb~;Yybzup zz`&>^Zr-ySedG3qDZlVtGNMS6c{zC0N7U&#XJom0@2XR z;Jtowhi(?=)%naD+UO15gaMq$(LAswV8Tc*FD{aL7HmbA+ihe|aX=vj+?5!d`SjbZ z`BtX`sUY2{%$FIEtv6M{La?y5woHJ}b{YqvDisfWfEs;rU>2mW-<#eFrXoJ>(d+%$ znHj_C{lOwq2Rm~dHl*?2cYt}Y0miF=1q6FBoK~`fk-!KnRpouFJ$B6l%u8ZoA{WO% zu(&KI-p!jc3q$jxl^(zw{NPWX&BIziLlyb}zjjpJnf8k;p!p|NA!# z;_$&)G~~wFYqtQ<9>hEX+4OvfdY|VUKO3!EUHT6f;PhJ=8QX!kCU%=LG~#%@x#?}1 zDEpa#asN2Hy7mWUVsx0aMcXH~lc9hy)|OqSuis8`BI2i2q;UitrW%evR`3xD^0)VC z5CxC}c)7EDryHPub?5%7#az;9q@Y=t85RvIa& z`T9pi%}&I}sEol#nUP^SEiI`SE*ltC$>WvBV%G z=|b;74*lC0X}DFvorM35&UoB2KIHp`nG@19TWD*pV6b8bm-~Oyck` z-JT~A5^J#x3}c^Gapv`|q}A2chQ>e-LTtd*>^ z;f)#(8{_;((~&Z17SOl$huYXP6fxGq+WO0Xzs2j*H$I1L!^ZB>3Okq)O@YEFcY%uu zgM6mu^i?JrfLH(tPE!)~9e9}wzw@lLr_iaWxWLmwREK$wB7|Olyg30SlI0)6%o~+w~ z;8t$?#^3L!St&$G_z;Po1^7+%!>a12fOQOiu*6Ju*p7sQqqMVgqVjwHjXOtEUX0Em z|5+1%@G2BxDB1_o8IXVu`zTGmZjm^e7IC@*=x z$aKUptR;2M0{GR7FXQKeGBYDfEvmn0TS3r)h87o)cn&#z_NmukKX=9jybC#^BEiuv z0Oo-N|AayhGc#>(YwSwp&NE@*=L1TK=;>Du<>b3#czw)%cc}FPO(@nA*zet4OrLq% z8yccHt-|K;iHS4VOv1(T%b;_9v~uD8GYsUct~5H1*xwO z69qnS-uLweU(o1HN7vGnl>IjN>(|JyUx#z!9R7<)JQwke^!j|wPU97@YytB3in!l< z2dFF*R4HHvMT4>V70)_e6rVtr2e^I^x5?YLhHu_{0}M(*8?1Mh3Oh}!D0D-s6w@&t ze6}Qe_^?pWgWx^cM+lHm+cv$mT#gRg@Kg{Y9|qIDI6*y)3en(1SH9!N_8`bWkp_L2 z|JL(0tg+l`!=F1VW{f|rZ39i_<>Hu&;fnf6m$!td?b@N89BR*CtD#jL0}iID4Z|5; zCCo*M1N=>YZmKbMqHUVj<#-*)DEDb%)yfHylat|GWPY6nFZ_ym2HneWS-WNm^YS1< z0EEc(G6M@syy=K?(yhG_8!mG4gyyRF^^oA;J3w!`7RpePH(PohB^lHz?(Gpo=A~uT4TArHc#w+7hi0APwU z+k$$7j)p(Z`3vsWOY`I?kLgotQGXi6u&^7y$eDOjRrO09%^7T1lH33)a=G%5J@jO) zKCfhK+0>MwpO@G*-TTy}rGoyWZvgi!7}%~Q^mH7T6Bis3ZuxM3(5V2@0X-Z)e^CwN zqemPty04~2^7KBJLe>hTg!nk{&lfS&u4B`HaF-3Km|_i-fnUhTkSVeuivNTeVA@2< zWZNCjm2MbOa|!oE3FRW`!X)}Kl@D{LQCeB&c~Zb-G88tI8h+I5}UIQ2c4dzb(=s0amGf+uIhgfU)wz@j@ zQ^5}xD#JoUsfgqr1Ou|1oJ<+e^Je_}-<}>zzUp@Y+UPPmXFNGYQGmyQIS|AK{jZMu zoBj|b01hpKmXw@qHs+ig^Z`;;6aX^`4~UEms8`RyFgQA*s+g(6PzI{=BfUq&#LQe& z$U=w>p%>`r_$aXUWUE1k(#v#XB%SWe@H_#GX(V6AZ_2;{y4teBNtP$kRzH9FLJY7a zSWo9FK-~v)G-U0r;Q9fb4`d!-NYUnICV6PYeAzt&DU_3u$+aukWyFM3bYnK>I(BcW zY}Rvnsx(6gtJdJ)#ZbF=2AL>|f|f|V-$gJMVi9cAbA#DxB1x^6V$T_NB_0RSkc%;| z|M>9r0``26lh8E%!-qZ48%c)w58{ix2o)e-5+2ZmddZ?~rZEDL?i?N1c?jM`U(`V$ z4zVJI1ZM2zvwCZ~4&(uHYQ?h9Z?Fuc6+n;qF%$}tooJ;0W@=P#>%}<9Y~KhjfvdH@ zpWe1nvAi@Qfx3WX@8H2fi<%HjyyI+*V9)#Z^7!~2I0m4_Tg>{Wrru1;M@tPqd$EQ< zKM!csh6X$v8&u&K<+D2zQ}l3d$qkZ>RyyE<6hzav_;t|xsA*|2rlKl`@+VyIGAn45 zyb9Vo`lG}0n_uQno9AAc7l1wu3GsnyIuST6Eki>()Lp-RMp~f<+%AIe#0Z=!D8T$P z4!)_W^*r{L)YIcR)uSN+0qS+IBq$p7+C>|~{DZkb#f;*QC!o#4m6^7&guZ*}<5lYy z@5$mp(1@Bk_C5Met=dj;o8i`MYPs)&V&Afh$|6yU!{08d{FHg0N_X|D_H}+tv?sPF zkE>|h&ZD(Ib9LkkRbqS_y)isH!~bro&4O?E_k4YDa4^p8T@|t~72albSh$js1d1Gw zxonu&Q;g;L5g7?;6f+2M)ygX>3fR3cx`K~~=RDhH(NuGezos)S(2AaYl^iqPVW-Vx zNVy}@KNAC^^4@{n+sCqPZQJWos6JVu^mGXlMvaM%uB7e<51wB0fP%K6cA~T*j@c+h zB%g~%x;_&7RR)EGBgn7#_@9SM?DOn>M2|a)gs#Y+e$k&5(&z}78Z$YlnBf1Cz^X^)pz>)`?Fdb{rw;H zXY(ZT(S%*b@udje5qertR8peL6g(XTHvnOM`*t1vqrkbtcMQWp0&4G)!zDSWbiNLwRCy| zetfBTs5{;CvdiAmNIz9cL1u5k8AhgqXpmq(9+Jv_Ho*jOtI(?*4y#VEYMA9=WtGB`5={}C<(;FyV zU%}4KHQMKk@eh5rmsIq0XXI|;A^86$UBrGWHsK<=bxY7h0w$sf3bGYFLW_MTD%om0 zRwZfDCh_c1=EEY9u?Hl_tubfc6m)c$G==tlc1)$nD-74b(Uv3IzPP#ohWdMOidV;=$$Aj-G_?llOFm^ zX#H5|H^;wl9ufL*Cdow|f9d)KKVtSz>$!KhihaDq<6*xVl#Gq#mJaL&2bBSK`7-0J z{ovv1{ekvCvQHfy`g(e(t#+mS)$s*}`JDF@R4Xftd8nCN=!u4Q6{JfQl748VLBj3z z(-n!;|My~qDDXopO7ns|Myi}%mRpAed0-%WoDSQ3UMiRASvCp{V$+30#&Q3;7Scq|Pg5V(|EXPLx7+c+^Siban?J}j(M`v)#D*bRR9 zBI~89!^5BR^9jeW&p<>`j06$=`XlsP`KBb4CQ>YLb!|r{8crBrFWxmCTWCfv!80 zRRh?XYZ6F{wm5J+i19ZAP#Y!lZ=*1#mzO2%4kTf|9^hrN>LTY6jxw9}li|{#BJQw8 z1t@)Bp!P|oqdA(V9Phk;KtOh8=5R%6UIjA@TZtWw6C`eFl}sm9lGTJ!7UB_B2iqI$ zX4j}C1gY_P9B)3=1bYd6H>dXUJyiKQY@`fbqU|HtOcLGQIj1$z_|?A+-!xhXDdOH+ z9Ec!f7*66K54(Ihz2Y5d$PR2*AZQKVUE3|QI=Fmg@0te)D}eePO-r1S(h#V=$et?N#$3k#H4{;o~F@)Z30cL0hr*F2neHAPoOM_@6MlELdF6iDpj|CnT} z^(nTvFB9)$k|~?(>qAio!+1{Mnen2>U`(}sCk0n|v867B{JVEor`CDna=F0*b#^`< zy#*W55wA#VasPfJV=yU4eyPxvOC!9O-amZU!OWs9AJO>vM)|}fpB(XZ1poZMb$x4T zjmUd}Uouu$QlegDhywNu{Kzqy-qyj|kULap8-=RAc zo0_OM2ZAtoz4t9qIHl`1Z~mE|=XZ__2=GP8F?W2tPvHo{2gS8(m zkApg;3Fqi%&(gR@Lv>rRrcRxhnsN~n^!ilR#=*0Iy0YSgj9uxcW}i5=>;9=)Lu{Xi zKAv-Z&wn;98h8^2N3UaaJ{xe*-o9-2x32y5se8MEiExy+rrwrIyy;3Mmw@Yz496wJ07GLuAIlW zxr~7b{hPu}T?q9ID0h0V=Q?ah5@4p95nM*{rFE!tTDD@ zf7=SQT;jQnW&Ovu7HlEtaHYF+KIy@O7I;b84^{>W!ogOH47baZQNzHC{F0Io8)2}Y zEON4%>Ze}X1INT2%RG?He5R!nVvQb3i&5aKyo=Dul%x zrbH04wJSyDddWVTzB@_WC$ME}n>j;vJ2>~GRU4Z;-V0x1<2 zG=9OF$!Y0umcs2>2YY+Bk8l3Ah+3aR*LXfZduw`e_}SUB&DN8?sH1Z!C&Xn>4tVOk z1_dzf@U<4NOhn`NcRYlQ(N9sA@BF{Z7cZ}*uA42ItDFae3>Ud>tkb;=I7Ik zxcT_1AKv{#-ukRj^wq1U)6UVqfir{P*KRL0gO2@u7$tg1=w2fRpT<~6jR&J#Gzg&{ z?Kz@>M~F4}Hxe2@>hoobf&3_qDtuXDHU@)w0Xw_l)4G%jS zzJ}R7-6>`=V0E=?YHM?at^^Lon7xXn8r{s!yH0p``SN8LL=Tu6{falNUi;6Vn%ILK zbP61f$Ch8ZIs@Olnag!Pa%>8O8S7P63pD?`3fG%FWiHJjt!X|3#U{|w$Tvm zfm+WKu-q9(dmk>878`WGZ}Zlsp!hgclyN7pkplA`%VtraJe8duunEb?A?69)_I|ZI zY~I%w&_5I$67s8#Qa0KFO@@N=*2{&IYJ3ytNianK68!*)}#)Q{QVI@$p(?)h86@pMJceQz`zi zt}P+y!)B^VcFmL84-1jJdFGXnk8yVoAWR7IsI+XXudnw*eGx5fMhF!26%IBM5+?av z+7g+`2hvnmuUtBfFY!gS;(JPvx21V#XaVdC;Aeb^dZo#zVhGdp!h84(H9zgDGht5%*tzS&KB-HGIH)R1+ZBalmM>&$%p>S4*%`GbQQjBw>&vff>M6 zg@s_s!GlIdRxAyL_8BxyHD-YPl79241u83Z9x11$qZ=F;P(QUo4Zh*w=|EzujoaPz zqmnu#H_=j1fCek3={*>`{`#+6BZeq~c>W7hpc;`|QbNO!?7ZRwzv%qMYE;18QTv_0 z{Z|r>TlUWZd$RljyV6n&lfl9-XIsgtReR5~{uY+- z(^_JK0^N3!A&C1p*W(g=G5>oZ&I{myuuMwA(F_E@bHBUL5q&^ge&LeJ!3Kte)U8zK zzGEe(HpDmcCSFyQvyqD&&g!Mn=rBxr{ICUPzUp^BQR2$6nz(tpiT2CgA0XOfoC-+oD z8_^H=w|Tqs)6F(88VJ4zv{%}qs8FFfi)LO=W#vx4LDQJa*vuNWbAsz4aEL%CK~qzV zcM8&oC|Ok2?somo9gPa%=$!IjdJW(A%% z{4g}Ty{?Q@YVpyR4L+XFo>^NzJ0ZsTMKa8LyvJUp9BUK57*5SPnbB;U(;M?g#{E*|`!WT( z)9o=1h6c}^IYt^i$y|Koyy|HsrDmY!BujD&nM;n3|2vT{QAa3r7Sx5c2%5B7>?&Ad|Cu*y_WKH3YVbu5x^eHC0b?zo| zbY$e*IqRn5_%kp1-6eM*tGCx+z@kd_ci!YKpe2Qcsj5CH3GxirJQWlda&<8g?G*qF zs+=4K2TFUKFNYFOE)W+R53q1<#H;D*E+6c?R4d=UM=C57HCSpf=XN*9E<>p2`2&y zXngJ$X_FU7Y~RvQJ0w91EINQ~1G_$+9$poe<6l&$+yZeCmra0;aK|nT1I8yHxa9V8 zUJx=9^E`f%XR;sK83{1OrlQ=2G2MRt{CUq`RKY1VH#fDguu!V={QGOX)nCgNk<`$r zD420W>?w$TaT`RE1K7+P18BgR_y)o6w%(YL=e&o`-~BJC|6Z-2XkcJptne3 z@?iYOl^pfTKVMPJjN=*Ja9E6M0a28H2{dk zXE9U9ZV_u>(%O?|RBXmaX~IH7V>SE#QT5ePRc~FiM@2zVKtK>sI+PSCK{}-WZcW86P3_rf{9SbOia=9+V^*9;tasyv%hR18W5 z?-zbqGwJ1xRqnTT#z@g9YLSsm(WzGgb+7E;nzM7m$zIg)_Uz({fb+>OPUjQd*j^YX zj&LC4y)l#?*cZuog95Fhe7MX=@2Sa5lOK0fl=V@3_JM@N7sI1_z(>dX-}|Me!Fv7e zh^M`wx!J{Tm-6G)K@bLoL?~6+VCJ*<;NT+H%PDH=;%aeTU3Yg4I1JVol~q)59>@Oq z)5A9jsTKSXLGbQv!r`&y;7AeMV&|9@uvam=B_t$((XY<6B6_%SEEQRhlvkwvj>oKm zQCN6wYm1HQwHg3Cm>3u`L&P9s)1Im=0z3w^R-ZrHHRwp! zW6jpzzkZGX`J*T#r1TD%I4mF_yrN>RcJR^b{@IqFy_63vg8N`4B18rGz6uNmM?czv126qzcymPs@l@AYB5IOOhXJwdMIOYTcNaH$Sxtct# zz|=h4Bw~Bsn}6)v3(M@4@uHFkaP{zoDJFkWvyrp21GC1G1u4_z#`#&jxH!dllxfzq z(RL?;oT%vXKsNeqce@kjl#`5CCyD_PO+BO&yQA(xpiqZtba=pPzj6C%^@y z>Y_EcV{RLYV~ZCNbab7DC{J?5^}vk7#Bj3r!zi06CGU;kprEt5%X5134A9Y#@>`Ti zxf6%eMva%6h({MfTNLw-(aG;S2wuZ+Qz0Zof|!ukRs-_wb3H`D$7d|oZ@;e`^FQEK z&sAa!-HC+a%5O>&9n9N4-8-apF^YoND{f0;8d!_np4VTVz1u zv$rdcXSZa61=Qp_B@(bkKy>*VaD+cU;>5)6!tz&t+0o$5))iG0{FC@~+_-QT=uVqq zdR4yK$nKf_68u|eXy34LENC=gfP#do>TY}3DWJ=wDB3^V*pc|gYaHbzC0U+6-4Eos zm@!LYW>$g#iC~ETpi620^mbcUo(UA0kQ1h)z6W=9R&sLRZU!4`>qt)fNJyV8_Q!(B zA}Yoox)TcrZt%QsHv@*8fp|Ao1)-~KI z2@9<9*_KQDldqvsQSY?0z>@LVc3R}*WFXix9;`0PQn)t~lz*6rhwp-aNJ!Ki9b>@# z{KK%>+wM59+O&p`Um5U@j?RIEB=|9dUgv0m^Jy=@kuaEcZ*Q3Z{z_N36A*t!n>F5B z9_ITi4Omnc$H$Ayu*bFk`c>g%Uv|`cov*E%#}Nl-C-CuDN@}Voh9Kk<@tVe3S`Mp& zMZhHR>%NQX2#&d_kXGNj_onQF&DDLgu)rLUsj^Kq7}gHItv6)T7Sg6(HTnP>oA8C% z#qZ>|+;!yw-mKtLyFNOQS6%J2Iaw4)cr)zlSD;|p16*!g`Z|p4)2Fpjr^j5J<1qKL zriSQzuW!!r@OpK19ww6c`e?k03ckYi6&PO$ANkXRmoWcFd;5$x(I)`%rK(9r4%S=X zg@J!~Rn@NV114~SBzNhCHuyz@H#V!PUMoh~O;i`+DWUBX>+wAGbg04C*G*v4w6bD0 zIyXTfM&{s9>9vVoo2;=sJupd;Oxc%mhuZE7pe*JNA8zp0TxF5G7)UZ2^m7)MrG+8m z8IKWjG%PF<;vElf@&rYBdd^+dgz+*=QSC75Tn-?{C-NHf&lwqW#lmvmP~iv%&n0I~L6GZqQg@QjSf1KQa$X)K-FIL&f=+#G zxLEglzebJ2;>N~!Rv7phO5xCr3g?Z{&|pzgxq_q~+k@|Hx4U5|f0kZzvM(n}3)T`C z_`?yyYBZ?N3JMZ7LEF*yL zunrD}tCl`m?n(5|%nY`xEGBs2a+Xj~Foc8C2{r_2+1WrLZd=6VamMe>RTT+-Wp#1( z*u+G#@Xz6#C`!EM+Mk|_4fQFQuw=bq%w)TvL`38&)g6kDf3X0JHnI4TKbY03aVBG>iQF<>KMSY^0>*aCL8V4=d}E>(@!M9<_CLRyhvk@6^11_7MC*GcHosMhEDLiD&xK_dt$e zy*jx4JDC`AGOh$)-}bRGpTWUgND9|Bi7v)WTlV*@9S=8zZ!tdCHl3_q+MdO=-8`YB zNWIt}I-oXU77$2wxftn#`)U6=ov+!VUcD3w6XaJ1<1sP0yP``b>+7xHhw^bHdNvpk zum1<|AAlZd&0mR&Cx0588p`LPr=63E-{2E@LrAzW6CVVF?f52k`XE{nY zN|+ZcH~G{pDf5MOd(2K*4>-#%%T1BPS!^1!@9>rrXWT>!e8yE!i#uNRKoo>t!;5cEV4?zDr%LfN`*V)T ziSyOxC2)Li9XH|9uYq~<*R`<M5@OY>l4B>M7Y4;oxV+|TBj#3xnNHG_@(1(R&zB9+dU3YY}tqErzxKx?i@$w4l=={pBqbKC9 zM(4wTKgMHONpA_%EKo8;;(PJJ%FNR88w@Sx!vH)s&jOgGYwKf&3LABe;W0WN*E=Fe zsnTDgp{)~f-3fUZM2y0aPY2u=C|CjsW8qT>@$ks#k2>Rd5*286!E1M8e0hHT91xMp zcD8lcLH+&jfmG;+&U2_dMKBuS_6PG~ZTFTQxDy9F8qwF*X13DLhwbv~*FF4NF9g0j z9C*;183;^IeQz@9wAAQBhY4zfrQl871P?zyF3I3)2|oY2p?`RCa#UUeEDY5d-||ZX zNlAa`dqR1y?*^IXh;eMdnT=G?HvvB)+}PP10>ex4gUq06a~{?JDiIQ)1ZSRg{(CSrIG7t&dnPw1wi% z85oxaG#Ujzh=#O22))hPVq~OxMQ`W03C{Wcp0`(h4+!4#Q(G#OnTzu)JV{U2Wdb{> zrGu(0_@(*G3jAG@PY6T(WbbT-c0dbu1u-!PqMEadB#ip*l-W6+7T|;!WT|c3fdi82!qKZIy9m{c-l25=x z;XNLsy{pURdH(t7B@Pi-B*7`U1BY5T!{H;2;vvAn8K3tOF(yfckwFU@{JqL8m~VNI zn8%0~UYD^?BkHTLyy+_E}6aM`y#RCI` z`q>9T_hEw9`r2r8}yOPgb=U@^c4VLtymwP=N>xr*V#D`u&LvP$`+)2$&%LuUP^Ib0#c5ZtT5f&=SS@;; zDpGk1qp+)%9VSB>wKO*LlzDGIj!RE4$u+{>dTn?E7Q_wYE>x7y85&zLFU<9!m2cGd zE1dR=&#KlGOj`b_yZVHNX2>jnS6ZyJHPpu4Uvf27JRS1GxU=%tY&}g)8Uh~H%e`Cx z>;s_bEBFAK8Q3Udkhw#MwMMM9#iG$*>(-E6C#)yVi?~nX@fYawJ|D^tMwgPMgsy);$2az+BQmJ94%rzm$~Y_RKmCPMYIE zPHAcBH`aArA5CnFqGswUe&`Pd`zuAzMyVZ_Cngd?8Vqd!Mr>XW7ORYyMj~67i<zn7PlXJ!vKk@uEYe zlRG|B=7)^Mx+IRvsAS^|nrH6BDy7D+!wXv}qh`F+22#`Yw(V}hmNs|7Zo#PiKqnDW z82)kD!b*_UBj2pS#FaKG|JdFx20rSJs{Q@)$Y^WkfEht4euZ?wXb#Tfxi&wjLPDjU zK>*UBUiCdaL%AwZ;@Q%$Grn)~jS3IfeQEOz$UguV@9m;Ow9wH?wB-_sa&uom zr37&j$2FUyd713nUUyRne6J!S8{xU?%!l+>TBEuXTUhP_VMTS`mp1$aI%piWr7&-A zVs|mINY_8lLT9x2KAS0F4yV`8xANVW2kUyk!3m{8&%R*J663YDR^YC)>x^cfs~PBd zD_Z>kXjws1x91uFtVD6|>FtFP@P91cK}Sgay?_|JF&7uDnai69e6NwB7BK>cUCN)M zqlIFfG4g7(N9$#?5e%D&PqP8n$;_JB$3Pt2svd+b;$CYg6+<}vL~#6N>WOqbH&Y;C z*jD&}N>*WFQ>lpvgZfS|>m9^ft>2s+9C14ZR8ks#U%n&)g71WGZ9UM=@N-BO+I=-O zl60?)%g@d))u&sg1)u8jbe}{$)5568Csb}IC}!^Kd0XRr%1ueRz0jEsr6}Z4DJk;q z#Ff@XWGM9=t19~X{ila*aPMR&+Pez^@GEhg_S+o{j!?fD+5d)3`RHt>pkN8IcF2>l zknZCgM03W4gmld}dwQBdKUxX{a)2+d$fM!;X39;X6C$1MbZ`^qzdf-EbZ|<8G}X(i z=3+Lm4#-3;zjBn}X!rlJ2MVv*_4A{Vq9E0>IFkv7;+kGSn zP;k(%a|ez60aRmbY;0|Kx@i$N^d7%d+_=NpQT`nGQ&x`Gtg1qF3```5kLmhcSU}^| z$5tET{=gW~*@q5f1&ito7KmJWbp*rVc;$YEm)G*z$h#~jVK~67 zxzVVoDJjh_FY2HrsZsqI+qDhSX(G(}t7Hwpyn3)gffjEen#1XV<&O9>xKwxIH+g69 zZ5XDTBB(gVqT(H-C{S@jF8$qZ`{1Q*9AE|Y^E3Ix`bcqHs3eCKIUhDBnKCm&*dp1U z^}v+(9zg+tnxv%Cj+|?}T7SDR_g;yKIRJYKT)+$)HefI_lvOj{q`^xA*|yu;L=*wn z5kWDBFe2D{rvMB#ars)0dXp&ZJ!PJlx!?CFrB0t6x=qG~QKizafPZ7W+V zc`&-nY<+CVr*jaGtCHwgT3y`)bR_^lf2M>WR-vl4VEs(mc`!E1;7Se^c%Cy{>TR#Ttt0Lgw5*mxgO2)TOKl839;&9pjw2HP48FwS zI{_s#f}jYV8dPmo8^)G@esEYkoz78CrlX6A=UkS=XaugLVooH`{mS53$G)tAPDSAw zhgSWc)d$)u@;SPtayptd~rjP210+H7zN^%{|)xq;G z{tq_1URBr~nF(!95)2GvZ|J7Dk&?YLHp#``zoiaL+ucP|ZU-yNSci3&W7)j}6ZfJb zu2}ouMu!`HrKN8m#STXIzNh+U-I-VYaZSA;4DC)3yD#(v8$hAZbIzOYn8B~eH6p^} zFQEict`O1I(D)b~Z5ZZ1V`#5VM|W?>^w0P>r}KG!RWdY2mRDDS<PV`S0G)Sf1nS{+2xLw zMcjz+aE0T5_U_B1%;WeSrG2ugOotyyq_u^G&yVM!?*7~)i*=_1h%!*D*i}0LBDp`9 z0BP+uE?&|qk2NT(9nKQn#_EY@~dGy0=tFgJ6n z|LG=B=zH!zLM)lB4jQ8e*3~k#o}Y@J?pGybWy$$j-u_D{y|oUfAt9l-ni^%U+Of#| zEKv18ZD(s9#r*ciw;IQ8zz^nrUUiseXW6Wl+=1o^r5VS|7^pHUtzFa7bjRz6p24q% z(Od$2|B%D#X9C}DYdD{Ra8aQJ^4&Bof*tp07y9p6r525Q^!-n3|Ex)x!}&s+3wVFRNUhwy8#Ezj7+`(}WoVncq9OoIq;**28|fOysEH{lI{Hr%fBe#U zF0<|-+z3Ehv0;3?rjmq2Qn3#ZoElZX$$}XJ>Hs(5i1La-l<=|Aes>w5-kcoTQd3P8 zrB+-bkkOtT>q$8~PuwHG*;^UdpAjM|%=hAzjt&ZfL8+<7yHsC@c$Ruo9l>UoYV5RN zgaZIXqoFQvaCzeKGm^*kdY~fj#xu?L{jIM+xrBqu;4(1@{1TW_dcQ*CCgMpnv>CoD zVQS2r5z>Y`01?eXkpL*pKzPBzl3U^E_`w^vb}{tIyn+!l2!p-7#6-Z^r>FO~D*<`>+hm%SC?In`9tcY097j5p9U%#8;;S#KDrf<@ffnz>V z^|v8Dx|5{N`=bN);t-4MaB%-r<3ZBe*OA&N#E)=NJF6;A*2!$ztHJ#6lu2{ zA_e>nP=FhV83UcQqT-nOCbC=FwJQ#o{^wSgn952Og@A~#Fd%W5n!-6W*WLp649q@x zZc=k^pHXQ=MFRH1P3XGobrbGFW=4&B9nqASmKGfnashqdaJm?|hpeou2A3C>A_2xp z&nOZ7=+LsvRc)#4ayZ;@*43rw!fWHVvU1v8Xg)cqoD)FvUS0b#?+j5j)jZ#Pbn*$9 zGmZrOmJ5nSY9=kc+ZB70tHs)4cb4`4i*PF0FW9L%_~ zm}&wmWAC`A|8Y@PAV6U;-3-tw!r;TWaVsI7%58?j!Kx@qc_RG6DHNQuLPA1bktYG0 zq`v_OEpQmEaAX6p27tnE2o5A9!SV|B&sS03)%BOJ_a_^$GeDAFJ<@(211Bg z0#0vV6#jSPkpSWIJTkBsylQCoVBirDz@LBe7BL+z0B`jfsCQ=)Vbx+FeFuQ0JI>3_ z5oV6O6<3Mw*CuQm82H%XzrDS^dx+lMeYw*q1F;W9C8$pT7W!H@h>r08EUnbFh$}~U z(35y?DfAYxEotzRCrb+O|E*&)GTVCl`qHSLDsLU4Zw_P=9Ge>$jI0iA2L$wQD&B$X zc?CA*wZ@xKL2k{hi*qUtIWlO)L*K}t2JBo7?Ggd5!N;&@;ohkuV55g( z({78{?AW3kS}38aJ{U-hpo#|x6<9UrYSicfQQ%{OXHKs|oNCkmo2cahAFBj!eX8yy z9|oE5URc}WJ;c5K#cn*PEz&sGfEYr=ogz($gIE!S9`MFQ@_ytClhNoeUmoE<5AlM! z72=|~`2<3P>drYQToSdMf&#mpSxqAea5JNx?wh(*SGxn6BdBNC2-a61ZxLIiKqSaC zfbIp+jb4F~=C?c;?RU0(u)M(=5)M{ZpRFg{Cc?I6G zvT_MC>mcqOFP6i5dD+lv0)!u0)v^z<5G&L$YgEW9Gg;2M;ZHPl4NLX4K!fv2RRani zbX!YHY@WNfrz^|69eLE& z*S89-H()sDt@^nkdiIO~Zy7Zt;==$K3W^7QAoyiuH~E!8^K#HS9JmSTi+7-5;RW=Z zyu3@Cvw|ye3$HblZeYL_^rFAYR*_qi*!-1{7tC5`R>6V|FQl}N7=if9=1>q4ZWa`7 z{uR%o)#Qt}({&Rux4FMsUS3Xa_^wcC<@}`Lid?!v&c#*bdbuGid}1B@5H~`;hRg2V zHpC=gM3%exr&uk`lz0TIMI#(LU7&AG(AwTI8|smccu{OV%Woin#HUtaaS4$52_^&w z9#fj@tO*?&!s;)F@efb)7d*4$oj6#XafKQKktaxlp!4KSf!325C@ul1_c&Y z1F#qd-pxRvKDY4GU*_#w&;J^j4c6w%v_n_?R{SLJ%@H?>Sq6z&XegD5Hjo}+uV0q% zk7P4-D$>1GtN}`IhX1I*h!lW#mF(+ivX)j1EnlbsPn?$y80yTxmLUYgIqQ}2kx!q# z==_}Gf#KFF6?QTe0?&QGs_oD9>OkOwWmKWy~!-S&*AmEtTYAZ{Ux^g7%| z=vV(Efdu(B$!?AfMeP*8D~)4H=g#&+{5gfZ7W!Orfi7_X+!C%0zH&r>8q-IR6#D!- zS|2{Ryus-n9hIH5hXuv_0-EQWlQqD})BS}ow_IB>HdY~cxb!;;9}*`EC`wcqt|9z! z|FLse*v)4Q<*}RA*?2srEC5|2825)B#)I*P*C!#HP}f>!NzdI zq7&sRv%zNr?>W9aOmE<9n`&uMo6PtVNI5y3ElK!;Ma(g1h`j18RPwJQ{IUP{Rlj?C zQBc9Ljnd=ia77;t_XSxAa8p@94g}(w6-Gu*&gjm;R1z}yK0D=#Ke!lMyS80-$sy#b5y{Ps}qdv-1Uu3T)fMFz`x3VPiwyZU7(<4efEk3y4HsQZlkqXu~#= zKp~FDBrF=EBrDrI`=BQZA4cY6ztQb2eTam(>HVL)j8_s;0PtDe?W6K78=u|2L$AJb zCCPFMt*HSr(7P4J?amm_x{IB(zmM{>ndK_A%R|h12z>JY0zc1Yofaq^Wadzj4E6N| zvobO<>CLzEz`Fy2F!WZ}M;%IO5dW8M?Pd!0cIi&RL@~LR$2&Fk{M=VB4$Ro6K>d>2 z(&+2!`&2GtbAtw)H!FmM&Oo;EIS@cIbv2F-mZw0B{FGf>{A-FwZKekfe%CYe&|)8; zXtA28^hAv+s(mm9+TJZ(NRa+1&fH8NvSh{A)UeEJ9d2rhfI=_hS_AA&W@Z$hbF;heG1a- ztB6egAAgYT;lriJ>=v2TYJw)iV7~+%svw|MO5b?@o&stf2Z>*8ZL=2dMvOBZ515qz zX9MWk#>S*cgrA@EFWEL@#PhaCltfx%;?|aaVu9MIAQ2HyJKJSm7hqwkWx^wNkVJX? z7b8E)9&?uS0qLAI&0i9-o4;xbW~fnEO*k@AlqW1d_;1kr9$*K0~ou!%#P`OcM#l7CwlZ_G3<= z;|GAfOzi!2SbxxI;;=5nA^O|kOkj06ey;)W4h0&J!!wkbZWv%~PVPG&J^S3%UprcA zk_nU(JT(*q{{4SDeQhp~f2@k9z64&vTv_Lj(q})AQb` zzk;oa@kh$EZ44ApbpcDXe_$Z%a1WNhOmx7Pqf>9G_zTkofCM4jvobT=|1KoqKbv)? zOb@>RB9w(rL7C=sEZbjOGq>*w$=Lln9m`TdZ(&vm?a0N_Z&5ro7@CRt@1_hXI5{gp zVAQ|S2E8pH(R+YElK3}BdVp}T%Em@IWAYl!6c}ytR6_ZXf~BN%9~@jB?9Q2$cXcU& zV+CT%1b_%#yA{Z55S4-v@EZvDm!=W$t{fSat@FVR z%>;U|4CJ7V^lIgn2Wy=UQt{8<+l93&C;wT*9jvlt+inOX;sM?hOEvG+MQX!h1CAu7 z_ls{CKzj;j{XMKS)!X}}tN&tuLwyG5dpeddXaoD-8J+P!K%g}F9ddg^S2Rm=LqjYO zT8R&~-;MtGxDQkHfM^X}^3un`-~+5ZlMVsXcy+Mg;_iVtEFvQe$fCe_5_=@8sCatD zE*fF3+MfgXuh#ymX}p5KDDnl+M{e9uk1oub8DR=YPmeGLd&7G~|NAlpuwfT@|6#nG z4}iuibu<9B`o9Im#fuz7%3XQfdLduyX2_9>{}2`ks*#o7$=kVd@REX(x3-pmcC*qF zC81mALVumlr`QJ$>$~?xnDq|BYHFckg(hogxlT4kkQrEGz&&+YdK*qAL0CdqO@v%nuzTf4jfJ&a#JI?tEJD zYx0@S+k`Sb^nEEQL_#qCe=>!H(nyH~0EqiQfO*eIzjdrC_62UdZ-!#9Ul)B6;kR4J_3P6$cuAxqA^b}eK0XY zmL=ACfbiejSM=V79iiV^kP3=JNJ}2mYH&vFT*brb!MUuwd`@Ot66XuIdXN>?n2d#| zr3vo`^kjvxr{cA_=bOSHI`erl294_a9d3xHO30r6z!lTfc?HEPeHPZ-0 zP+vjP6RfippgPjC*}$DYuOdY-D=Gb_J&;C*64KMFCXF*EH}^r7Gol~ZO*+siox;-E zUzq@4qyIfQ>cz!$jpL=>4W9p2l{ct+klbZ`1R!mOWG0yPd$D|EC|Okcm+z!#m=FI8g`1*#y{ z@xRn}VsCXZDMw0`u88FJ>Gr?ds;n@d zZSz3B_SM_p|NO`711SA@8Jk*M0g*e7Lm4Z5+}ZU(;$|JJB~MQs=DcmW)p`8Pu=U)rkO4w$PA)~=uc2qhCvVml@gAMs={SWaxzaK^ zYSD_p<|6>yD;BmhyNhqT%W@nhnWC-UEgiUbI^Np|A@u*}N0LFn#@3?gsxDzaTI>j9FYiSDKNwuo&%4 zeQ6l^(sa^JK!9shHuO)uSCv$JQZ|)a(mzpNLKiG%a_l=Govg0dcDu#}3ao_4E5}9y zg99$$=V$;qF0=KVHQ$FBb?@fzlZA0=5i2{nk9KyqcPl;9zdJ zr)S!Nn#vkz2>icL^wm|ZjaR5zS?zOLE%Cp3Ll1itwiqbgfbhS0cV_*(eBq7yJ%50+ zHzzNZCl6fPRS|#`f&_k5D5yU52mK-$HafrPp9XgeV|vD&ct#Xn7*JxX*)_n^dvAxQ$4%7A;diq0JP#=2~XXwGRi3`kc3T2a17=d)YZT%s}p$(Y^)+7k10= zcX8CC+ccx|8ST=!k#@_`}}s(Gd9mlOmJ zE^T;pV$&fpWDxrQ%rS0KV6vRJ5^Dl^SwiCOQ}pc2 zHt=lbgjE$?Z8Su`4RpC+baIB0?k^}r z0jeZY3*BC3(X^FUF5T$&$J@e-^bHBNe5XI9c zt*j%eyQ{Qx{>Lv#_#aP3Fr;eMe%;$R&t}P?rpZ>!9i{myVC&M=;0;V;3Bz$rf*5TR z|FKiJ8WL`>T6R4Ks>G zOw0Fmg@p&32@`{WVE3m-?h$ux zoJRWG+}&C!KWPyK#g@JO{bx+8+pBWQsxhcZ^7(F@E{{x2r>qVUgn!_MP`3R-LaIU6 z(4BYUFt|Fzo~x!RBXfLqEdJ4JFxsGR5b811_XeIpW`AD+2ES|Z=g%#KgtOxlEuNm^ zXIbEG+z!uY9E)86EccS$VqrQu|gHI#0#<`M(kI-5zfVyeUE1 z@gu=$MvaUbxs0BmIf5UcDlxNZnn7u}&X8pxwPylxmckN>NfWa1&465A5?j z_iOI|3srbdd5ZZOH{9|!t*}BT@7&oLKL|%-zx;hbsZNWN-PY>v?jA^FuXpOAO-GL1 z+Z#gXjJicr-|%i?d|_nNAu7g^R_)=B!{hra&qzt*s;XZ4`tD2@nP_SG1a|AYAPwNe zar%^%Z4RZ}U$rNNpl~85;k%8-JuJI9UJ;kOmX-cHD_ugFqM%2mL1&PPJmvP^R~YQ| z7y)+zFZ0_=+v$Z)X~fp9>cSeQ&PxAN1O`#O*-HO1l)^CQbYu)2PAAMTv72sRzI(RP;?9^bx| zq2m1N>+R*R-EeX^AwZa!o7>ph!bqO3*4FW|O$35gqxvg_h5j}FpxQ;;fP7}?KPs<(?RV>4*)5R)o37lm!iJmH_pjq{BchB+lP17*1NBp9mNkFfRf#xmX6m2Aq?K`|ZJB0mUet*AY%R5DLOeh`GP+Wj(?T9oiM*o*qJL-IQizSi@u`t-@l@2 zSy=~Zajue{HKjoF*=7*kLObU%xREAKudN{=CMQD|yW_JnGjAgz7&O_fS0tutopIz1O&)u zAt7LjB9J)QiQh6sN!Xa1Uw1n_BkxxNf>h8{uC^skbe4S3j zSsvIrU|?VX>wK{@#tIMzgqelKHx?tx@1U?%mhNG{e?Qpw4u0%wbkr(!1qBK!sxe@W z1qH<{ETn-IIbg2}w{EIiSv^`?EPIFmiPkp`>l1KyTw6ze%;UnZuI@Zh$wEp>dT?;V z`yK(w+7P-k1vNE?>7*tydfxO<9=@wl}5w70(6UrKC=h`PUG2W+y{jg8ib zOeNaEC?=A)xICvQ$sSmsM9i&)qVFUm+IQyrJhAUz?IDc7f)9CBefUcveuIRJY@oda z4{wvhb`Zh`L&=KnIpgx=fgh=-CmNQ^)k8iZV`eTuMTOn1FgjXRMrNeSHr~qW1XEpt zQVw>jHXWCvt!oHMsW^aL9^vO=A^>`qlheeNti27iJ((cprWP(#p!#z>FhcbFbKj9Y5ri&dis?Pq$u6O43D1bai&# zblchzfoZLuwV3g9YiqfAc;a8D2R>v}6BP7p(jFLcr6WE*SWk!U@$l$@jQm%>fY%_i zfAfYC=%++HI2qYAG*8?5^an^uiOI+)atOpPG4k?m`1!UUg>4m;tTUM>t+s`-ea7Sk zS^_5Kj8ha|BHE|d`7tkk4-A(RXzFI?>&0?a`7_9se58`XwAoM_ECU5U<(l!A5K^XMFhuYh9Hq>C0 z;NjthP-m>sYl(Vo7PA+RW*(M;V&n8k;(gHwEsmcc+%`D{#Z8Xbyo3Y254=A6ovMU2XMX3&F>>#iHc%Taeemn1q;lJi*w{qDyc$9q(w#9 z?RS`CI)Qma-aB+n=XsPMCI#gcN4=y3xNy1odgd>TA)J7rga`@_HrUxSGFk=$6X%ou zYppeQ+tIJ{iwd7Vee#6cVXrVWbbo6aHo$s9?l0TBF@{D)-)+_}0*O%32-P~K%?>ts z*xtI0z@5v=F?DnpG&fIt{W|AmQ7zc=%zo$9#p|Wn+3gEw@IsY&gqAK9uW=UpC=ty= zkQ5d{cm9Z=kkEq%^G7T(yzh0YLqkIcd!!ANd<5)XuEcGN2N_8%Ao=7(l9M-Zg zZ8uD{sZ~``RaO0xlJd(q#KdHUgoIL4Qoe?TF+G0{ezeiX834Wp`Z;PSw&;)3)4%@R z*VozA1<3Q}}SvT$cJD7_vHxlc%-P6+nJV=iwf}r9>ZrXY?vVS5D#4D+hGyk zas!imFqh+V*_>?lry_rS5B#g4N%$IG;atAy^cVjsWfhn6LPxO8Z1ngrVTJZcNq{r% z<&founpFOy6o&tC0cN(_!Wjj_E8d+oWP(0P3cSf{qSpltk%w#;M|EGu?&L z@9zli+!33Z(Wa$!uvu-MeYbv?@xGV+TYOcqI5k7sAJH5Th%)((mMe8u)E z4ThdAIeo)BN4gV5D_kFw?8*RVQ@Oc|mX`N1OJd#S1|Cy00PkU%Sa-T+Tec4lI#=x} z%OV_7;4MnO+&QsE3#0zYG)+ZKJ$kZShlcjX{q8yet8pY%{*Sl+J05GfUFjvn z#1s|0zI^Gvb`4qg*Ta`KIk4G-w;Hiwc`PR$@0b3ep}`>{Db9^?!&cL z#vbN-J|lkH(UVBejK4loltCemlbM+bW1`Q7zhfB<<$*~($o3?pTm_7ez^WCP1=AZ7 zr{fb7IyySAu8{BH57+SoqFZx0;=>V}mVQ;8zJn-XncQrK5Q&4G9ASQTPYm zlDX+_anWjnbG7+wH5{3qo^=`WKGFCNDk?T*A2_tMq+prFv6*Va568zsu+4B%5i#lh zE-^Z-;2AZEc{BCn#D{pS?1_t1266&26F(~-N}ZlCkA9Z_7-o7K6c^_rhK69~WqHIx z5YzcaMn)fZgc||&2_(GC9B-be7zd`-BMdqfyA5u49q(cM^|;k(xI$|hW(`rP-CNWbDN-QhpDg+ ztgPgTIA8GHea1LFMun5)PEi(+8rp}!5$kf{BrPlZ908Nz-zX?R2MUd7L*>mI=nebt z?XfK^=*m-vWej8{_q_+(FUUQ(t(KmBzu(i<6<*#K8W~sB)94e2jP?jbH8;b=_IIKm z;@G@={=B!TNfa6*kbgo7;}aOTInvkKm~!}yz32&cJHP^v&Y~jDPgQ>}TR{RLENAXZB{^a=i|<*^&eRU1@cg#x%pIQ=N1gQhEF5Q%hn+wNfs}@DP$k``uN0h z9xIxg<9YE1hn}j$HaEPJ`S77Of3p%i1ZG~dWR%7FXqeWDe3l-2dAQ|XAi&G1q`bZR z;*pFDyfD38bN-+9$Is;i1cXFIYt7*}zw_UohLk8rwI5!&vhr|#K1|Zrm<=Aw?w)~r z0j7(#_S}yjejO1~4P-9&Pb}YF6|Yb`diD4Jf=W-m|{;b}+{rfq`3g z=*_y~T=zS9LL~5F3U3Y4kYwQs|3~Z)(SXi{tFnhmP{JXzdl2{Q?K9vw;dj5))wNma zH^mnXUq|Q{8@gVqcSM}-ZJLTDE8so|yT&Uf);wMjgHEI&b$3vqZ+%KV@_{kNOhk5f z-tCu2{qlBp#s&sJ9uqib(K0kl%g8|aZhOWCg7*3ZKIa(b=0*=JZGsMg zys2W$7xxh`#SZ%c{90`@SyNLJpWSCJid(m0O~+sKBzqGg*2e7%(-w?&o|8-uxZk96 z85cq!ak1YapB%6zCZgiBUJ>4{vv8FH*L6TZt&({qBzD}c{VVbV1xcOHlztS6D=2&y zK|g4wTWj!UchYxq#1GCk0sTn{|GUaY=LYJ;jo)Q&|to=@YJl1s0#m8qEuDs$w z*k#>z$#-)$bMueJULx?}7iKjM))O^j@p`yn)Zd*dq-choKm4^ldya%NY6}W(5o_yQ zvv<5GC3ydB6P!T9R-upt$mcF=jAVAoccp6d2bYp+wNADx{R)V;Mq_%LlVPyM)d!%Q zS2Jje`5+s!#xzVLc;)3~1q3__W}%!{0`hWhZtm=?C&cp&WLCP6V@H?)U2C5Ky3l%# zM^`U!WeXpFn239>q~CFU^u~ zwtV#XIT;O^E|cTKllkdT&aA9#q~e)+mX6+{=Pr9$OGm@-A9qmgaR-mATNu8*VP2De zqcK=bvoxA&RK{P<^F~2YGLl7zSL@8Pf5^c1Q|yK?Cx#6%=iCC0pdcqQoag;e*W5$E zWoRLLxjgWY$xk3oPD@KkPdEASVQxlycJ<|_szq4dN2?d-OGEjV

    %4LdU1-6&9O= zxl~Tyq|IQ$C;JO#E<(V9pP>51@%#S0*(2Sq@gCWs^)V?wKYJ(BAJ!1yo9yR&W)RzO zw2(C-F!)U}m#3NkzA_?i=W2rOgn*xaN~=$grav^^pe$-~9CQ(a^XN}za$)cDYuPGJ zH#+4s_%0?sBP$Fjfan_~C(Of%pJ@E)Q#w2*C+zKag8fC=iEJ>bDlajO{_`uB{>>=; z%&aVECv&)7z(GlaPy&qTC21pDcf2MDsger|wP!IcTUaMB45b0G%a)^JsoiWAmvCC2 zo&7n*ev^cfvgt}Zd1_M>xC$pbaYav`ojir#lsXq$b{2C;_TEEx`*4j;=kl4wls>V4UcD%Two z7HW8{LV1g`NdFPqVtf%*<+3du_0xdQ4r0u#%*?bZRcb|LwMkm(+e|g6wb-nt>`o_< zpT28Q_2mh+b*|a6dvJa7F`}{hzO?a&vEODc=#EO$`j(@v$Ejwy&38W`+tiIwmsLd^ zr>ErMt*u=aQGY1&a*3xDEWdO&9uo0jtl!kUBO(>U%NcB`crkx`N4|%edvWpFk9F_E z&-(eFZr$MB>5!k9EW{>CL|zk)4UMo;lAs~lY1;MZG!uFx{dz?w4VOTQ9NcJk%j3IM z1GU!&75H7nn>n~Y^3NESC#qEITqx@U+>sR&gdHyf#Y`Au0x&|JPhOK%HAW4C0dy12hLgT)VO)-r1%Yl<6Krd zpAXALW6p!f%bWBw0aZy8rr_eG6vL<9suK~Y*zN=oTQTDn16x(1!2iy`3^t9 zmeU0MBYvmfF-BwEdS~h8en*c>BIr?Ez9K`akA?l-y|~~qD9xFkH)U<;?6bvV{mvHt zb+b*;kX~z|(p9pt>!g1vIgf@08D6GSGPx&Dp^j0-W0<}FjkdG_(A{hc#Qq>Gvb!;LL_EPE8Nji%~APa059-cfZPJ50IX)x}4&T@l~RgYM+< z+GKryBHE;xR3u#t|Ks~(|K%IdVsJbE)n4NN_siPa(H`k%RlGA`Ui~Er7MZ~PeQ84KHr(~F`&R5(b zp(c4;DAG|~Q&wtZB`o~+3v6se5A2tHneTEYR8(B5gQwlO4jLokkF1X-_lpr4$4nXz zNCaN?MWI2xYCQpxJGr^^-s*@Rac7p6-t$*3yKB**Flb?{xn{AS$nr=_oCeQ&tvI>} z74qbDab;b)%@*oDC1C%osByBym-;QA2eKU{;dXaA(D|lR zOm*crs$>0wAqGJ_mpv(jPPj7ycxmCW<04N8pV{6F(d=(dkKZ6c>2(s9Y?Gy(`zZI( zfA!&Q(huY_`iJP_?Jv%twoNtc9!N-c+8z3@8Wx(CC)9UmUb$b~FVGTUuYO69cE z)Pe#o^wus?T>-8Vy5k79^00_Mwq>Yz!KIn z!h+oxKE&p7@%?8}0{D*b{kwi$3+|Qgq3~?AO$iJ*+E!$kNE41Ga9}3zkcN2ijnhlU zF9?zT7Ot**@Udg|J*jEtxX^g7%S;#&qwlUouNq!xs@Q{%igwJhyV((%IjMg-cEf-D zdQJ2h&f*e%iw9|@zJ1`a+d(4ObF6d$#KE%K3a&IzC7UZykdcx$9SePe#iwWIGQgIe zLzTxHwkC_UnH)-2JH&oem@MH>C^aO;XCky z09--Db3RmLGbASm6*f8qd2dthIZ}y=E`9rc?e1rRbYtU}iDx-DjShX!*LvV_M8yn4NHZ?8*5!aPg|q;w}V2USVCC(~|-7;)z!f`TjN zdsqDzPBknRrnj|~o#io8s!*lvPF!Zk9hR=}EIPe<&D%G$Z^)=dFSkQ~g-nc(@bhW@ z?QOL?-fNg&t>=ZGY3d7+L7$v%_ z5wRNj(fbM(gO9b1>a$F40Y({*Tju+P9BulquV3^e%Vm|pRiO#uLV*H*&6JD+DFV_= z%KocmWU!V;=88V&!r>KQ+S$rg51362YQU&OsTwBH%rBp8@b>VWOHFiniN{tjB{=o3 z?ZV>C5l<~xx5jRE{^}ClHH-&R=%yr~Qu!`D_Y3#ZU$%!4)_F_6(a~zDI8q0V?oiG2 zT$LS62wOO?&dD-6pftcvi<(qC63(!?d*uLXQ{;+0a`MQC5Q`h;Nf)>W2v|k&$e=UA zy9!$??~i3Up2t^~(&CyIl{eiDd2xFj34QFh;D-KWrbcCEbft|8AwzrIZbozX{zq@_ zao-NT;@8D6=m2ia54w#HKQOur3ARYauFa)>ASc&vgmTw??~^@&@7tJ2<(3k0d3i-~ z@v?AJfU4*2uv*YqAOaZA(~~W>w=L!)ik;d2?zH`lxn8Qi(xcqFutdX|y7jbQIUpl5 z)~5gNTzRbO)$J+EgIzbOFai!8E2}GZoZF6phqYgKmu6o0i&R&Vzoj70NKjU28RVTS7NZH%}uW}yk)&9l0M}I06cvvkge|<7DBvoU2)_Ban zm!*xae84__d@S@awX{}3D66#z?r+$~d$M0;>~BCH&8#KMcWAQlMEcAscm>RH2c z>s^h#tF4$V(2R=sUR1v0emuA9vylNJP^`TLl81<_bcU02!Bln9ccsJrpqth-G6uP! z3oj&%6Z9GHz>(=PyYBjUJ9J@U`Qw^kqK@t^bIl@)sFafI;;tY8m+r1^Zw&itJm+P# zh7OS2Wol&A)$JGgCxCnD!w;a(9NM85^4ef6WofDS`}d`}x+k%vB0^+AgxfT!|A+#- zKC#ma0P%7di{czFIq7Z>(y-p0;z32VLhw9A>`TN{l$Sp}czR?E4iDd&!gxSgeK!D7 znbV#a>rMW*jG(?#t@F3!)_o(mAc!D&d{3rl7#adqT3`ap-_b#`FRRWFTczDNdVw(r zMz-;6&dYtY$)w4Oqw{pwR%=5@(7~(QhCD}@B&|ZYqSV9qBt@mQ7i+=sJe&JJYBHRp z5?HjYk8$>JT}WR)fUre^{XvD+uv{>`cn0$7#J;ud4LCCVi z&}#6e=ZY@ogXPU>14y>1^=?&eo7u@BOP*mZ5#JAqSUX1tTR|R!l#vm+VVKGl{;c_h zpJ_7qg5cF0cfF+0%0czX}(61D+jg&5_M6*L@wMRoPDp{%-wU>~1#00B$lZEr;tXzHJB z4vT-{yN9~me@#tQ1Fl1YhJ*nO#I-T{ioy*QMaALED3lk4x7d*F7V$|E&@|?YjcaM#l$t_B_wjK zTtFWH`gD882YW~!s-miyo}b-TVA%^USWjOMfB(7JT$7@Pd@pT+6Z^_k3;S@wPp-nv z@rDyJP?={b_>y~{TCv3)`B@7gweF)9e^(-TLn}baJc}!%s3C+!_KaQ@DUV-FF1yoo zLeN+xD=wGdaKul{PcdBa75dN2OiC+7O+Gh6n`V!2d?i}dHdsCSBLPv_tWK`g7puh# z#l6eV@?#B3B+8$R$4tDa2 z9afaSixsD&W|oY4rgmA+IE@S)Sxfr+V}Tf1&z@e?mc^;4{{s44XQ#VyGtEdL9U2n$ zxE}j4qy)QlSo%{M#?(KI@M6WCO5n$R1Kom%%ZG@qu%MDn=xHeExW9a<#@Ev$0_eOa zCnu61nm;9s2VSfq|65Nu%*?Bxm{;A>C~Asq)hP=(5SMlb&|YRP%{Ar@K-_Y&-{IoI zuF$YSm%{6$9{hZ!_` zNKZ;i$G}h&j$r;%>;>lI$JqAIQAiN}Lmf^7CCH@{naK9`LNB>g?Pt0X)$F6;OgQ#3 z4JL)Vf7JNKsf&-hOOEIsCJ=1yyxZ}4YBK-5A6bjXDq2ZuxqQXFOWIFTPD%dudhyto zn}VEE5@QDIldTYsk89#deOgu@5r@m>1Q}0Tx%S_myVMo2pJOJfChB~g`EZs6kb<(i zvQsBgzxN~E-xyqa#t@xQ1tx{1#8zYrRNJjh_{ttOX&pzazS!RMjJB?~ena1B>De{> zR$e@GWqnPAJD}L1%y8txSdS`p;oFaYKBU-#4s=yD1|0r;q`^Z-NFO*UKOI)o0TdEGHV3-WwEV_K_mUF8wHlk6QkOrjsHCdW;th>vY+ppx zLb3buuL2n1^YOE9bRRjlBPZo|XAmY_UOM!L4qm5jMqc4#TGZmeXisf&L$c)-#u_ax z=*6W)rNOtjgiGvUxf8vA>yneA_%8J8iiLGasbxmdhLvch(qKHMeKJ^)S)pNFl_eHH zTxv1p{%(<#wQLo>7W1{9&5KM-Or=cytedu@lP+$Sf=VrE8IjOJ&o@Ts>tZ4rvm&$M zeu751zRJSrM+l{6WC_-SGlnxroHD+v;czr2YOb-nfcEzs=^-gFhX#W+GfDgCgNa&| z6cip?xYc)bI8snk&t6kEMMbULGn<~@Gn?QPk5N$pW5~%qJVI$@{biYTUbITE+l^Z! z;wB*Y;RZNsi+p>E6^3y>O9@^MR-1b8K39HL_TXl=&GO8X1jLo+E5g!5PaxuA-cp{? zlaldpg>Y!$G<^;D{Sc3-Ggt%S4J^z?FOnMj}z=%E*-Y!mFxB+ z($q|{O=Bb|=>Yz7(o;ZORdr$qw|E#-Vx_UA~ z%w~L$+9?%URYEuqn^78P;ozE58n^%T_s@pNprFf4D4VoPza~T7rSWMjuN#jnbC{CU z^n3RoX+P77at|GA4jVq-l{h5Mwc&vFL()ruco9zOY{~~8F++(ix#7c_sk<5t<4S-E zm>Kpe@oDq`xXxi0Xgph9|zb-=chf z|7!s}-RhttY|t|{WQTRaN6r-z$~f4;bcq3P=+C4|Nw||qwh0|k4V&?4>a&D5`3d!1 zvo2sd%~}a0czEmUP?um^bnwXuxaCR4b{@UEf1tFC)FZe~Qcm9n7ya zSnP8cI;^*Bw19Idsfgp=Kot)QtQyxLc7ZdgG_y3n90N)w7P_jubnUzb)1K=pIHr7(tui^gcQOZ#fQ3iS@f(2>g3Zu4TyFI%@ z14EQ_H1^gG?`YrE5xXWD)w-QlKU7R^fVnTVg9zf4fX1umexR~*JpADgMoQ8*ZX=m_ zm6A48+ZSYHPNJfy-{=mviMajnxhjph`vIiX7tg%1lKOv^{MLAXYMKKE0Y*)D2vH0E zNns(y1GL?CfPe!SyF!lUA<0Po|40a+f3aUO*UsxtyvaV)*P7qi#|2e>J#SiTjYY=C zxczmbU3zB3j#QexigpSNIN}8vWH-^50zNTlnCs*B;Lp!401w@ZL zYR30j+{e(kUplipf7p7(r4_o=w4_@Tbm4RrSojJ7nmevF%`rvrcqg03WGuUFW|l;m7Y>J8p*#IZbi*I0jeTXK|D6tcg_TlFV4 zTyGb+Kdf#k5SNeuQ&vI4(tL=BFh1ZPCl?eh2VZ1NOvwB5IUPu)6EQ4SRn5&$0515L zrj)q+>*5NA)7!`VDE~2fK+o_EOB*}7gN&?vQDJ$d>yh>Ho9&=|9=FYNGVo~h)gtmH z>(WoMz^*aUGfAD6tY{E$hhCQ-GV_I}PH{{c)OVS=_2ZH z8hs4}!6z=bETU21{zVrs5dP%+BzCh-Q_7lU3B7Kl_xP-n+$;#4huo!!n%Tjt4+ajv znl27uSV&9HHkkhj`;AEo-oMA*V7Suq8*CqF;GC)DooaY(G8g37d)Va~enEcnSQ-c3wXO$Wh)%dt zQbG@)`=UNGaB$Pk%ZrSw#&Pb?@T+JE7RGIo!U4AlKm-Pm_+!q;p1(dG&~XRcXHHKU zm-b9ubuKqqQAOX02?{zoO;v@Mr_o=S0rh4>dY(s7R{0_!OOv8ON?Np{v;>_4OE7E+ zEQV@>Gdx^&+=OM{H)nX*2+yD|tOs-nx;nl|@A=ScrpC>(doZ0$AR67^SRC@mJgssb-)bvkRb+~(e~zW#JMc28 zjJXUip2_iN-mv1jR9Ac(ZA+G?my_2_#C7n6uz@hNz&0cc#(%+ejQI7MGDTAqMs6zz zdnVy^NGohp}W)|nseq3FoLY*7?dWDPaL&-A0k*bqv-FV%cJt7CaMQzao0^FP7uO-$Ne7 zOU2}etRex|Bx^Ulx$zII(xc~=lV@_2&G^7IEg0mfMl zb}|9w?*KvfbkN#81#tU7&dA6BF;4(4vq|BfmzRK5$6Eo&KB2L(a(3$rQs39;PB{JJ5F=mV{&8U~!Ue?35K0QLo&~B&~voh{1^(u+zRpT=H$T{)Q)!I zdu4prs$|9xNee}@%w`m`S6)K}wt1e0fPpCG8UI@Kl^r@GSqc8S#Z%Ohk@FEl%!F`P zsw&rO2FQ{AyqYQ_J)8WTzpyshb)$8lWkb+`-ofk6t;4WnGW3x&9+RyMMZDD6kNrrT z@O%(jLZvc(C%h4$|7oFG+NoVBFy&tg4}-(_u2idIwU=^zMTwxIk132o9yO6yTN*jBJ?gTmNvYYT?!#_NB3is!8M0DPp?$w9 zYIe&iHkhJPDe=5HH!J(Mypd{j=zUZWRW$A?{V)^J)^Cy9Kf&Rw0SfvT!^)pJKY@fo zNlhoOB+p}iJn{1a9|MViv?+nXz008vXa28wh?<4e9ykJl^qggyh0Og}PEL`unyHML zP=o{H(U@~w%kZt8K+ZKm(95vFtB+_K*qFL1!8 zfe&Zrm;yoXg9kXw#&_3Mh4l$(IsTm2_w{3WVnA@y*LGqBOrsj{UWp~lZsj0Go z)_A|;28YcCBsmpaU_uxsfkP4+OC$^$>J9${E19#)U)ju9_H~Os)8O=Te~_G-U#pky z?=s?Q{HWZ(w2UnqR^W91Fvf)%#GNIbLxsUIw|LeK>XqZ#!jqiJaw0GhYC>u0@Zhi+ zG3enymr<8VS0Ha2sA0JK-9ZM({*&8yyiY3hqE#Rg^8;>A2tC<5ymvY}TKi}b5#e)= zUzfLL!9#J{Su0u#m1&{Urf*saU#X(iaIs(ILBsN8vRfPh6-n6haLO!7tNp-@B zRQyKpRVE_P@_@THFf~w%nyJI)U`>n zv=kOmje`Ctw08~oyP~`-@Yg+^z>@Y9!Fp#A}_O^IXsd ztL-n)jvqOmc$p;%-WV@Y!{d0A>9oIRCX-@1c&u?`)DWHCjC z^4-?EUdt(9P6hI-@r{|RADd7~2|4TZSucC+l|h>nP)P_$rd>!GQ5k0?cAvtqqa`d7 zcHacOFuOIO%zCF?z8@SOA77)}-pSH^s;>{5sJ-|)oqIA2)Fy<4SFD!70TQKUH>ZRD zX#Go^7~aia-m7ip<>#Ak(&;_$6~uaR11mp6_?>EYBk-6%llwmu!QQNG=;A7fFlLn- zw!hX;GT*RTZaLdv)2g+tP7o)xgSwNQ!`tpY7%jez@cK?XY5r$;%vMas=}mL4VNl|S zXsL{CyRmp4tH;p8Ty^3~m=-JShZLS_Nya&7l8qm2*;#$a*)tcs*>y#^IZujC~HXh=x<=6?b9UY_R&fp;^Ym}(b&o{0dsCGZlv74~|H zMfZ;7|IRX3zNIcu@IB^c3D(ax5dZigLeW}Fd6uWiDpH=HRX^RW30 zeKlEMjtfkmO5pATvI)JW2h&uzgrxE!3+#DR8ZIAxd_rC^QxBu|;wFeVx)j7|~b>)>u%ngME4D&Q{DP|+&4#|;k&%N# za;8I4DT)p5iH15ll&O{f&iI628D(cj{Qhm>*2v=Ds>84inC9RLxlM6uE{Y~wV9g;R z3VWbmJJ{AdSKCQRM`!Hz!oT(MR`=8~e{NvlBk6C|`cHzw!hXGLgpB`pr=5xw_+vmb zF4qIK6~@b_dyi(J*VGi#fNkI)B~)9}OHK2hY2%c;E@lgFPe6o#(;W|TC3hBQ=_dcD z3>zPKy@TQw?Slf~rkctg=Ys{u>4NB}|EHuZucZpi5?@()u5;q|cq)$l*q}eb>E<#JsLRUBS#;YRZFfxu99=av z=c?`S!OU`ixByb}$}YEDBmG-&y!l7Hm2qM28B|eJ(Qi+x14}{xnN#CQ9bf6T{n#Pi zveV*JYZWz4u&tHkCn*Uj@ha!LuO{V z!GxTLd$XL}+}uDVM?f%CQ}MxzR8w7@hMb(mZY!)mkrx?BBR4OtKkCCQm=My_!^F<6 ze|ufkQU(1dH3PT);_`B2WaOvk4DfHAU2OJ#`?f{RZ+Omaz#FrwWy{PSF;IBA9+nZ@ zuKYhKlq_* zmpk0f?>8>VK;yo$<`BbTRw(=zoAchvpbZ5=BW%Mbd+VK-K`Sr9$A^NzjZMgII;L0c zY#-g_YkT>;2L;KQFFmR69qT@l2Z=of^d~!4$55X(!0?`=RR)B4=;S3$Bc(MmO8p&< zFYzuX=H07hlY<7NS*7;$hi0za)Q`Rhz7?BwTK#?W}@3`GymdV4^q&w1qVk18V{o zBo(k60%H73mb0$c>7&;fL;rrEdBNee0NO2Lp?M zCdZ5anf+@St$u)eg64ke+ZP^Gx$j+J?I@<3`?6a7enC>26&6y*`5hgC*BBUJH)C-C zfz^z7kAZugizslpbOg~jbL4Jhnt-Keb*}Czm`DgjW?GeE6llT>2#c>67#LpCYZ{rE zxdKaluw)$RfI&1el%tgQ`rWH%rDdEq>J!iXJ}(n*+5#UVBJk83-0%JtY6~Fz5y7lG z*^XR@ed5XSXmJ14eM2niZsJ)baJlY2c9DK!d*Vfi#-F)7QDHR?P8~57S{!c1Cq1JC z7$UFulIHsyZl!>prYW3y+>;31s<{R<(I`PX^TVs2++0k4^o7`erCnZ31z^lZMLjn) zow?Vpqo77tvXKFcbfAkGG8rNR8Uymv#M+o|-@g5p4gP_Qn5B@Nmq!cf85n@!&W_GO z4%T?dNlA2X-ZT?Rkopd7+U^nYX=o6V%8utKOYgb&Rv-eoAqW(_mo({;u?*%@Bi|6s zfigof?m{F@OueDLA&HNT`PEbYYp;LNV#9lt+(4b(Dk&J%?ds>#r40BA+%wa2ZP$`< zj=b%yP7@{&<+Lob+pM8-`V|Bbasm^MzY)%xa1I>*`>TC3ytH@0f{k-}KA6I$EixE$ zaPV2A9iewRk=sSv(C|N~odgaHoP*`$b}!+$5Evv2Er21mR8&-ekX~I?h0q8jMti_x z3Ktj5pgNuSOk}BB?ZDd8-Cbk7ig%yF*ZJS#8TK5I&2>KuEGx4EJL2-MG7<@#^Ix@m zf81y&W3CyWfjL!Ji4sFbMn+FH1wR@6uMC*Gjn{&gGUZxvT20KIspG#qi|fp_Wch^% zm6h2-uR}YVW+&RgqhmK2`2s$8GT0w1vE~45a#98a4_o++=}| zhxh2A*^?a3@1{f+mGcfQK=!t>fzoFs!fvY8p>yrUztww51~k@=stmcEIF#Iz`MI|SR!>D?_YQJjG|5K+IDe!QA@TeO7p$7nHE|%AkHJ=2y zlM;`PN8;rhnyV}}C_I1uoUMl;L%@R`w9TSJmzI|9)2#K1 zk+t>Xa53PPaCj1*pEL-+R{j6eoGaz41I27aT-?#osyK*PsMu{F8y_w<10NB&=ATap zSuN0i8w3SQv)OIIfrI7B$_mgBgW(juVrihzPb_G&v*i`iF<`-hWg+2HWaysuaJ-?M{|@}ERtj>MS>o( z(6t(ynwnbjW&)!#U@r|35E8NzuzVPrcc0vuWNd9|$y9g;0fVl14!bzvoKzV~AOh~s z1XGI;AFxD5Mv9AzV;kN++XdS@P`9La{H1bpYx{HRnj-5w(YjaFb=aP9c_ zDL?;@e;@_8zDwAX#P{kdiWlO4UqYEFZi zeFr)8FAeRxJi`&`IA&QnG3(x3X3+gdW+e`A!CJqo;5E3KqG!DSl81oN{oeJ3O{bo< zlheggs~ea~2xQ1WBL$S4`6?wrE)e?oYPT{F`VCiDCIX?Dk%5wp)JwAmcB7H^_C6&Y#~Y~iZ8Gg~`~rq!UPBD*;AZJ>CPQ2Mp0DdQ|5|J+4r zpQmp6-PacPsi}A{Fb@b~^YR*qPVJY4QR1a|9ls`~r;|fQ|5tPm9>ty_ld8VVfRIT0 zUpF^@gfAUW+q2{|=4;LxCnr%M;0^(FvBEnK(9y3A50`{M1i3uj#ed04MYrb!1Ztqj z%F4|pcv=`OLC(pEsa?X3N&K@vmQ@*isjGwBo#*aOjg!Nter+mevNtpN1DW$_8sF&X zXmd01JmNeJu zEVSxoFTXHSGive9W4lP9+v09;&(}yk*zo}U#PFN9?67JPN5>r?WG0s)urM~RwVbcQ zBt8Pb9YW(&+0_Z0gI1mGqA%VMlSoiHmSw7?We-8=t(gFv&jMYlg-V# zIP|AugM+HIj?>9PTGY&nN=p9z@<1&GB$7~}Z5Hn#*>fNoKiviYf&C`B=aSWu0ea1K zEz1w;c0`a!nec#H?byi311S8Rtcr?cl8>mE*t2DjG*(vhfb_My>m4we@x~;E8oNy& zTOG3n3L|>>`B{ViN?xDFzTa?eaE56yp0S@*@!GiOh}g`o6G*#VHz4!y%(+%sFbavxS5y!;l>v~$ z@O0;c`9JWApZ5t77bWQuLygAh@Ip4tzgpPw|PF0 zkTKEznJfT(+NbBg4QTsBsnZdlcwxh$&%4)ZKkd6aKFu2x;vVv=sAx(`qC&y}uiEsK ze0)$48v}5ObaaxTFJ?19{=PTrH=;5!9-lS3M(sSKqp4z_2wF*f`t<8npdhK0@SBJTQq9m$ zZ%Ih_aQu-VZkN+227T*U{Nz7>UQ>45%!kDNg1#6VTb&;a);KKt#vwjJH!8dHchq?w zg@n|qs+w)?zG+YmyIS0tT*f1EKYA;vpz!(L4kzipu6PK2BoAfhB}ecmEqz;%5SV+~ zDXXbT^7ie3h5KslmGac1jHaFeEfJBQjqB+opGv9azXU_M;278({S1A-|}ol&ENsV=onhETx_l z@;k*4v6~A;*+@E*xM$8MLu8u3FySi)=+a}S@hxFFIX!srKo2PFbwg`t4~-isGcpwrWG!0Cq+1L2lW0QpoFh_Ne>8azFp%geucX3=`( zawbPhb1p-APs4jkZ>P+h>D`*GT{78ntXBK$lZ?FlwB|OLd6CHL9vb$XB7sW)#ZK_^ zy)nv&=75+nX%lHvQxhbksoD1kj4#;c83l$@uU64TQ9G-HcffC)D(e08f4Bg|tLtlt z=+kIWH zUd^tfLlpE%yR&R_t}bkISfu=)tr5zNAo-6{Tf5meU;wQ3*Z0c63~SrWA$ zWM=qN$|OslYmq9AkBy}>4iira-<@?aS(kDZewq~Y_}~7ZFxq7RZ}^1R9Wk;|J}TP4nm{uWlQlioo7N?I~Pw-cR?!2uxMmSjH3pW+A_YwneF-^H)XsUU54cB!k6oJxtkEpYo7R0?;X zppUC^yvg<{JSZf=nTA!!Q1+_o0SOD9&H!$lH6aub&C&**;a&iB-`!Y=-f+m5h6N#P z9I70u8mH=bp09YH3hhr-AH^3@=>bGPp~}@@>t@8A{BF2JTAEfPkL6k-lMEOCtfaKG z^6TP|7g{86rI3hvKR53_To1eY@#74%{)>+WlGX(KKj;b*gIZ{3(#F6b-Da&PS%#9; zQh2r&7YPDC0A4b3A>AB6FYFQ>0@h)haJl4#^_`ulgoJwCb~*?J z<$yvekCh)d4M87ORly$9%yZOojAdwzryn=Rz{>-3j)QM+{qa~p3@SHOmZYLWbzAud zCP+6mG26|9Ib4wuYo?~%%sW|mv?AonW7}Go@qK>=H-OM5?^mh*E8I;W1doV_Si~ej zv6K04r$p&4X7EcBoNBF73xr>!VH>BFo_qTuUcO@N!o9*EggjE#rRKP7Rxy=xc%2Su zq6H%&LLPbK?i64WQ3My-^jyc-Z3+v@9MDPC750LmUYOR!STCMMGa2Yu%mufsAPbi5 zZ+5STzI4>$a#ht*E}%Vr?a5L4;~8=l(Y%um#bHxlFJ0j8Huiew>8;Uex7##B6Jrw- zV^z7&{NX7N8e?`%x1LZ^QaY}*{Z_htm^ms-8TNuYqBntC9(aZ+D1g0my6dv?=~bYT zSdxs7`2*BCm$Rul7m8371PB~Z&|da|!PGeMQosUkab%^b>2?)P%+jMX@gA*jy2McW z8U3fXA+fPJ{@p$R=BA>`sy==IRQnZ{n84-(m|;A}!UAXn0rymj<^pi%g$gSwO!ZK6 z$FPa-K7ac3^DeCY%&M`z2rUY%dL1@;CHi-=8QlKY)x{8?&;KDVgsX9U9tT z*zbFDHD1AAinF|;HyEG^aQnx~??Jq3kp~lnzUg{H3vzmb&44(0|Mjz7g$8H+q}a({ zmwq<)T#l)$lX=gLe<-xwJtPBQW)oHNq3u$+E(ae662dlGzE@~HUwy%{ivs!%mae~I z@b)lgMgwPEU*>D2M-EE=B$%tVI6j0S%O_*|E)$n93=hpS@APk{kD@gil;mVr?pQ0R zsfn++UmiKlE(0a+_&VScD`r;Cx6Sj3iTP!o-Vb&k%{#Rk;ii21_AN*fc0Y}P#Gn|A z+!|N>2nrY{?p`pY>;xRe5Iy4Kdo9)B{e-+kNl8gfk>ac(50Lh%hNMmD(WFr zFr=AS^*mqaPpH=Ck4(EyrVDib4EN}a?z&jP8LDHOeSS(ZC`4y1gH!EIJ7z82@AzZ$ zogUHWcG=)}dYML8_03-FYtk<7HQ_PPX{Mk(Mswf9@kQ~6J~D%$H`gt!Nx_L}&h+uf z5F#OsBD(D!uh;_*%Xu4Na4o6iw5jB~EKWO-I|VINCwpp2r;#5Rx%A;9f@Le}wZiS> zZP>F$X{E;g>nK^G-FD+&5AnDg=dQKI7@+5o&-+#DKMG3+CQC8f6$ZFRor_<9^G(v2 z&Eb+huo<1LamdcjF25NCBNrWZj|NA~GLRYq0%)*&N6K=9o6}#?&w&a^IL%tc=EePj zbhSO(TaIPLu4M7`^-WE$x45=NMJ+NOp1OJjrg4&TaBPW+_QwvsBpKQJ^6xoG-w~me z5a`vr?k%lQ1kW3$Vk7G=>6(jh8oJ+=>*_Y`tZ5Y;OtQ!6LraaV^qfP^N?=1S@3OP?G&C zO)i+F&X$>y#SLrH1D1O##Km?Mn#!|atBRj3KC7@W`&@6(e8hZ+iJiwC2dZfNIaVv# z!xj-t5ss=y`LpoTW|x`|Z>+5w5F2^%l?X9;%d{`>coR>~LWraAV$t!w+)F%p^wrNt z#ck4iCbk>mW%~+=R?pXNrnN5bCABitV6MwX3^Pca)rYHFwj4jkb1zR{ldmPk6P|6t zP*Jl4yzwgjOS#N{2V}J5L$7otnwr9F*6o=tR)xPF7<0rAIuh5bRStCbQgIYx zkKe2%YSg-|Zgv}1U@s-qyXKFVO&9VBNNYX5tK%Xo4M7{H)8cW?pF4zkV-ARkzp)h2 zUw4h=n9KQH_h>%70TDtrz(tnbFB|A6xXvX@TRV2@pDxxj=8InH{HGjHyT|rgxL&|ZOM}_jK?7$g?^izA zZ2ir^$jB$T;<|M~l+hpmP&F$Dnromm#c)tkQeYrvqlC9Cf@TCjZz7EgG`u;Vjn+GJ z#m#Qt7`ZG?t>#_XM+_L*q&v22)&c{E(`hGC3n4MFPg82D722Z5$XX@|yI>#ytfA7O0h8XY9C?k=q0QN`cV)0*4tZ;p|A% zmEj#Xu)<*m@nO~*{uAbNb4~N;3CUaxUM$q;EsfhU?R>V|v-%Z;D(hKha@vDO9^acD zKr+8VGX}+dF#@cArh2{=@;SOb5r;k(I!F6`3-bHc_r=f@I**7Q?vT7E0Ng$TupIE4 zzr55qC-kgIO5@`u*ueT|q&CfX)7stmfiQIGUg+O~GqklFj-e?R&Am zO`;G5nTmT!^g&@LQJ)1Z)@I8EV*=4KTPu6e&N{I|SXeA$(;tNNMEUtgd(%b6B8{V& z+f;)m6*X@{D|wN1$K1c{q{U9fsMZSOJbn6VnIqdjJtBI!um%&W+F>|n{M%|k&D6y0Zo9T7O2OIMKr{Fz1W|B0h48}d4Ac+{##OJ)GaEI@7It?56 z`uRmLb|ZWV*7_9`fnoSian)e<3HU&S7+yneFEh=^5xyDFF5Rqywja5qwRx=R&CjSP zF@nZmXGqbk;lVm5I`gG>{_*Jv&c#@5eY1Y}An#7zNORA~W*(H~~cW{V3+h@Fp ze?S87F1+`S_3<|yWZlq*TX1O5&!5k~(a4}nD8bW7qAd7&A>7iy=K?&OECVFc|AcskR@~thee-$)M`( zks$p|gB;B|DJh|V4%M&e*@!vMTQ^{fJ8zk6Lm!WZpFd%?)7h1Q21dus**fwE>OjOr zuGq!K#=g3wjkR%|8;LfgOXPJvO|8zJnj)iC?$LSx)xn*ikH9Bor6{5Ing%Q;4!U<` ze)G>b0{ma5^!8o>qryW@l$R0)LSkK}TJuioYWuU|++Q0jdIkQ~OU5xV*>iI#PGx=Z zob{d0^0k7&EW)FMLeotn+5kaPD(Y?^XR@-Abu;8cxp|;IbYEq?OrpR*{MZz}F(JwgLJUMsb-#Z4ycTc_5E{Lb*G8RBjJyPP zUSh>aINe>>M^y!7lMU^dggh|Utz;GG{jez>g#O_JqDP%J09+_qcqIrnSKd*PR87sF zIi6>MP?nE6k(r;(;u)HQ2pjg^5MPEg4;A1_m_FNkblrYOdl&WXRu7d*CtT z6mMcfuLz+TLJix}(i;cM=~~A3@8}GGMZtE3#qBZXKTlsHUbp9(^{yE(r7IsvtDT)n z>3x@*%OAj!HIAU{|J+1y{jj0 zJg2~k8{F1x`ZveA*Uc@Ry4>3qRjgC3gb=B2axHg;#eCuFMXa*svEg-zc6fTVfhHf% zV8))XZOikDpEZizGWy>U?d$K(|7zDx2ToUT30K<0DAAo~)Z{13=YP~e5(j}@@pgMt z-xgxC-y11C4E6cI?o$-&?rWlCC*hjg>{tbuKBtb{)Sgtj$bFC zKP0+)&HWsH*z+w#gQ*nyD9ZQYOK&ojl<4(30A+4UHxY(E31Q}D0i5_hH)dj8D1*UvZ+K?Tv? z`bCd|jJBd^@`&O`;pZ2FgW_><7^Uj@^9qM4aD#nl_?K6gz>|ykv=3%1S0Zi+$+b=U zicu40_Ew@rxdCR)Jo8|lIlyWTVDg!NgE13^5uI~bfkw5f%2=%PwZsxQA!-Z zBUM-hQ1d(`$XVH|3JWu3RK-+5GwE}YysTzYadC(QIT|V|LSw}~d&~{|#?@7sR#g~I zuNwxy&aTe#_AK;gFhg7zmyma>+cSE-{M_745%-f_lI*I94ff1SzL(REp_+kRN*qHJSM$hw#K>z5tdKl^Qy z3cQP8JLk*wrY0=L5}v@gKAlnEpa;;s3Ik!l&wBdoL+|KG2QdcLi?V^KOD3pdS$d3ZxHeAl9+;;{kJk3J*ET7V-;r5roU#6%Vk6?ge{MTmQI1lQIkv)iy7aUw~} z%APs(F1j3(3&_gihD8DmdbZ#xDd{t|H$jp2hvnllwZ z&R&J9usY0Q6_5c9uI$ScgR1`QE7Q3RC+OE#>c7Kn!>~U!S0B$*_DXc#=uUrm5je43 zgs6yYkZ#CghL_3l-t4M>SKR-|AH2`mb^ov+$o;rUlAf~wT$q$q)Y4t>-H-o=uJ;bd z`v2ocZ%Ha4D+w88hax+aU9z)Rc9~`0b|HHdLRR+Pd+)un_lWGhH|ME7-`_dsy3TR= zr`+7{`!%2AF@`T5Nfnr`mjzMKIKQtUHL_8%&NsF_)oW}2l!hvYE9dn7DIP%(Z^Zs- zFWn;Z*5OvWR{f8{C1y=vVq%f`|C8b-1)`ZGCq*fq(2Iji#%U@)1pOaPvb-bThI1jd!jEP`5yPZ z4s!_AJt9xIG`aS6Vn(Qhsb({q$i^&Q=cgy7CNAy#S?G&Oj=8}rSOB3{CmAdM2R-t5 zU#(efRK!r12HqWxnvKgVZ*mSfB_hwbydlR+=vUt}Mxi%3}YIjiM9goYg^m`&Zs#no0*#lw|-^ypdv z@{&4n{p@q4y;NdS)jW7$1ZnF8MUZHhFY|V$yf5(rr(rPZWv=lEUlc`K!Fad)E%Xh~I*#944R8~gZ_kbepfi!?+%-i(BvK_#GEF*( zpRJCs0_K>Rv^@9&gVuiA2*wce!zO@yrWUiCiKvMDN+TyGB({;V>8f?fL7?fme|e&C zHS5<}tSZE@aZ{cv3t1;ukECgXrw%z`m*uCJS=`P=p3VInkY_kj&2w>iKH=IR@Uv6- zJ5sKN8h-z#zVNhn&5meS#4WauBx_>SK@Va?2Ei3QDQS`ljzlXfwjrKh9oQ}DW7(5r zyNb}oa6W#TInfnVZpF~ksCRehl2*~$-VVBqnwun-amSh)__(-JHWY#>iqmWpnuLGg zk7LODDp46{)YUub>F5$=Bg)aUC=U;^2Tb=h~J5t_)GkJ(XSst9oY)?GJy-(J+Oq{OWbk}~? z686F%82|gJ>>(YNoPJrC+7lD^*n(Ktx~#DVo_UcM{O58cNgv7>w^Z^hdu6*+r;e(w z$zG$Tr%pG>N+Rf6_B%RWGO{qS5LXxP`W)H1)jI3px4}4K|8u$KNM~Weq4m8aJC4j( zf=>($RE+@}JYD+vnY$T}%2ZadLC2(Y$~@GT@kt;{PH+D9MKc+~yz0-R=#pWf#)N>^ zFy^9 z-*sD19+`}*Zf^AHQC99eR-f3vi6PGC&~lISm#2}DY_A0aLm&I!xFuGT)i8L%1?8Gr z1k{oI{q2GtG&J(gu!-h4YUe6}-PZ5Ry_`Rtp9|+E)YEnrN0Mm}x)q%*-JR$N3!a@a zxv5)zm?+am^Fu%wgYQ-hxWYa<^ARHIiaZi|rN#)Wq$Fjs*0?L=Ov~#_8fr?B2fP7& znI%6<*89292+%I1FH}QK)p;G+b_C~_hWo5kL;8c8I`0zZQ6=Qb9nKHHz6)-X8N}@b97iqm{)1*M1;+V@jmqNhq{!Z|BW(z zST)-d8qaaftfQ-g=}-oNh|`V()!ST)!oH;}i}TH+rLMkN))_7voti+DdQq%u+ufOH zKl?VKIdOKTRGZjeKY!i6xDBM|GmqVBtEIsvcVei7iAdf<0zn6uF3Mc0jB3@Jy<6hd zmS#Ou@ruk7U{1BggJ#pybAVi%L`T2|83$w9G3vk7W#*Gj3eW>6Q)E`p%GA(cfWq{^ z;VQ5F35Bk?s7k4*gv9&Ng0JBH0A=RWuFtm(uiW{EN0DB5K^-)QKliTjY20DLlxnqU zday746FR@)K1pT21%73@jbvQ=ew@U-vaHB5f#4gwNp}5=ho!qV6dLc|866t${pMbU zUB01*abw&D*R^4ovhp&c^xu_NXIk zdwcnS{Kv}&C_l-wr}z3Uo@uMqW?X!|(aX|{ zkd{|wGw*G=?DW(InDJk!kv@q9N>>985iR)r*9sRuWmX1>id zTuH;zm$+;C_?fYN*a82f6|;<*G|3Fv%=*$g*)lf5G}@GX!i0&Wa{AdI*9X0yUy7Ql zEKZ>2+;=xQdWM&{nssrbVa4lYpPZilE43Q#}9Od218R0h$_>$2IBG z$+59&3JR09wcRaZ)n5nqTYG!mrf?uu`21ggupbFHIl_5@A7ek{^imO{;svaC4QM{NkLseYC?PB_ zj7TZ}M1rVr-n)woN3W({}dYXzRoKSphZrt7Vf%1{{eC(_Dm2h(6TE)joN8Ycz zuXftzhB?oSFsc6*?U~Y2*l#rFyWN!TX!Wru+X#2d>#Do$xvi$WG8&@y&5~VnHyPhX zaewwYj+}Vk0}lWG6$M$PZzM6sECo&yaoO*uh7WSJ#_9!%+{R0-7wTLwnD19A%~iG` zGj=#PK0+A{PJVP#G64y3OaufSKewIH0Skh#1=&-Z`~?zx0z$^bkShq824T<8UfD01 zj0c}Nri6v5*z=+nCdvZ@1vv^#E^+PG&#<7F58oP@Wc*HvvQ)$|zeOp(f^Q*@T5b2h z05`?&C$Pm07fSdmFM**}R{;7|APZnU!vySzPDnZ+q#b)qD3DSJH`}U8wU5$GP*N_D zuw>|9a0uW2_D(NXNz|GQ#YIc9o)+JGM`_{D;UDx|Y|dnZBm;Aea$g&nH!>uK9Q|FL z>%)^eLWwyq;nNZCn<5Yw&Zni;5Iz_UPvx|JysPI6vDew;G5i?#mofYf)NNK^0`s^! zaD^^Ars5i6&2+RuRpmye2KvkQFS&$E!#u;FWM0;+-c&AB?VojGwDLQ1uM3`sXK)R1 zNt4B7&Wy{-a{|#@)$i5LXXg;1#@h#Yi+h{hnjG%Vh@lKPdX3mT?Xdv2vA7q;++rO? z{XKmsF5OEpe(1y&PJ63;K`B_1mB`{&RgZK1bOof(xy?00o?7kP^+`u#BOXtq6(7P4 zHntEwy%oaQOSn=$*4zT&+Bniz5&FevhljyUqQ3?e4z{*TE2Mb(lcf&c_ldyqERb^J zU(4=y=C&sP@JLy9VfY?xGYEfGcZ<>Z^V|KPOwW!Ew5GS?bmTP(GU#9Syx>;#n~;W$J9CPe(ScpoEb`- z4PAEc;rJDkYbm0pOOk81z>M5FY^)5k50%o0p6A3wP%}a|=DYuQL{7WSkn1oyL@?C* z9kZNP)BW(T7wN7Jgon!qgB-b!Q7&(H2Ab>!k)}an=gDQ{EpDB%9k5%>(tKv!)83Un zE&9nV*zHS^$b_a9;UiumbMuX)%GpOv>JW!GB~*sw%U3?ZHsvpYlmiyl z4dR93^B2ti8Y46tC{KX}TI#%T-Xu(nXGXJ*JTt&=F(K_~$44b|hi&io3^VaF zQly-F=?8bL>4IwlOV1Te4{5PDo;Ew6GFdQDqdJDR<_U}vD-OcJAI#DHSe%9Mo?hBQ|2q0 zUBFhp$pc%?@A0Cq`ic$Q`-uVXV^V#R?%gH6-CSmR%)ZrL;W>- ze+??FSF2?gM^}71oo#5g;GMrx1D9Fj!v@Ow2gM}gR}j~luGzD%YyBcZJVw_35w7y_ z#KZ_aV&=(PY4O|Pu)DjbRBn;!nId)=`(egnq-6N<;;r{YOA-_jgI&tRME8k^?k}-S zq9LxfT5}|x?m_<_f z)3Yky_e!KyQrLMbd24IArDX;I!4|f#s;9q(p;j&sA?Ky8EmePvOdb%j*BSfXz9;&w zu>kBD(Wua}GCR!mKWgQEOT%@(xb|UncDP*A435rs!cUP@NXer>X=NE@uv#p3XnACy zAg}PUU5s#!&`aDK!{_=CaZaR6SK)Yzem=(bP0+gGbjCX`jXR}OMjI&;eRWg(VFJ}v zG&Gc-kF%vAj!#Gt5_;oC`5MB2VEI53+v1gLS!roAc4QFz!WDqYZ=9}T_aR)p`;+); z$s+^r(HsAifHsRQF~CZfhkW|2(l975OGPKRdraNBsWLcUdYSw7Z$o}^Da-96ekT89 z85Sj=u-AJ8lQYc=@80og)OWqT;a86%K!StQr=}io`kP!v1|u_5N{&{xb9L(eh49~7 zlbyQ~9|8Raqv72(`!489yY(ly_a{tH2b_I73+cl*e;Pb05fUd^_^*Fhx?_qUz$f%`4G*I} zm#Y@zdSEY0tPvm_+=|tDGD9Eanb2j?^N+%uibb<7kdpNU=22FhMc?=bHH8Vn}0~-8<=ImVj z0#FW5eBjyVUhDr^61U<>NQ6GD&kI4%;-n^OusM?xagKMgD(4yb^ z80zmwxICU)=#pxfmj|DuJ;~7Ez&F8)w~cd3gHuu#)7^p-B5ZP@TnfB0G9n^P)5(hF z4gB%BIfBGQM=(d`$i~{*qWk`x+JyL0Tw1`Ho_bzOK!845K~L}K8?N2#gLm&}!78dy zpn$zjSK*P;boU0xHZlE;##7{gLJS>X+-$G3`+gcX5oM#?h``gQ?(fPj7AX*mhAV?S zXX5)q6`xNvChXZsN|QBgf~w9`FYw4OKYVFj9TP2m8x&-1zJA^6>bg^*LiWs-{q6G& z>+(JF%PiLxI2qE4iZcVp8`V{B(sXAZJPs!)wM30 z?!vL&PZa#?6_bcYXGdEFfelYKxpPEzbxBx>R=^~*%3hpU8ydayvou$)Fr71Wp4v9Q zR+(XJGEHqIU--M;*!w*d;=}TcvV@f%p_#^gE_+;rzMaJE!KL13zM#t(N4-hqBw zs77gWm_8)oTW$UuGe~Y++FEkQi6m{H)|?!~$iMjmcv8ObhF!5pHx`sb4 z&YkEY+pf66_VSfw;h1u2Xh-)r;NakRY?<;ot)P%^jhe6#$U8Y-j_Gx_*ow%J!{YZ2 z!C{9DHP5rZqMvR|IzBVL`#1ZK^{3%I+wmj5QK161eS3deBdF22%o_rP43~6G7`Toa zK~4GavfoKYx<_#Z{+{RT{0KwE4;Y4sB{sj|?(FPOJ+P*5Rc?g8{{AhPlAE@T!NKu6 zpaW!IF~dcc_)2c@)d*78h~cA(G9R&{>JqXD8!`E zqd199OG@W_f33d*A^-J4!qL%X_&$}aoq*All>AAt@&c#o_BiUfGC_Xu%ueFLO&^Xi(zZW}WHm)h>)MRYRJy-&ub@%GAn_)zI` z-wUh>NJ?smwE&V{`0_y3)ji#sMX6B1!~Jl;ce#mBp$HVsW>nu3f3BvwWGQ04?L&>> zRH1NnO{qn9dnkKKD$+CTX=})o@@)Z^|0)u@qSR6vutd|dvf@%x0jxvL%>00crhWrV zFC>}hmfYiKrJa(enJ6d{p^7al`)uf*#A^pbGyanQK3bzRtpKE`0|Ou`z@(XpefO8D zsAzoa3v=^rn1_hca|3&JWS*+|HilF3^Xq4B|9jsPjmlTfXFr5G0>E_!hmbH)+RgBI z;BSP?O3c>weG13647oEI_M{$J2qrBwQj>?rT_$5dr-CVdiGxE?@dJ!)`Uix6kia@e z&NLKCf)}&PCsa%*#kcCRRJ)S9AudS%rOS}?>Oa2w=uT)OE6DDIcX&_T4QkYWa@QA7 zd{aIRZy(b`5qe{s{byPlP#?t};)cJ@%E+LnkHg76io&4ie_!c%va~g;csa>%4^LIi z0s3@ifP!fqXWinG!f0hVGQtmeYbiT;+xXub*iD-STNn)urp()Z*kTWR!=8xy_=q2o zUZwbN0AjhleSAa%?%OO#LVJ*(|H5iz@S-UUxX{4hYwtSWxBm(P2R7S(mZo@$3*nCf zQ#@%M*IwJb9=qSxz2TCSbQ8J^gdl;sIzIgUS#Ivj!NDYxu*+c*U^E-b zntlJCtdw0QRTeb*B>c%AKIGIDGYFd$-Q0^h+5F9VIVr!t{bLX;5(2X1nf*RH1qDz@ zdw)q&e-$%kCr04o>wgyjyfqvt1j@6^xX}C3C>>PdpM6Y!eklIv-nhO9mX-YOU%qTi zR(eBf7)3OOuD> z5$ufbqAX8ilZWQoLU`a+G|@MOuWzAU-Y$z~Z`5Q-O3V!E>KigvnH}wk{miW+_&%~! z3!dRS?actHgCHbiMq9hG?7*_fDks0dw6a~@r|RRetnGGCvv!XR%pd9m>`e6`eX?h?&#Ux&SKqph=|# zjWyhLm3Dh1{7%Nks}q5NsNh1Qpim#p=U8ODW`{%~%{G>_wY6Wq3}|S);23xSU*vDo zOOFD7*RP=fVd!+J&%neu19TO_!)*CEZL8sysjQsHRDEK9u+GXxx;QsSL^|QkmJdfr z9HojDgD*k=m8z&` z!|w9!hLwM!UYanLL%nNjY>Wb0E6Wq*5pi+GtjE^RPz&t0c&=PQh)FoEt?~YV;>5}R z8mNG{pB?Z08Tj3oY>fETBV#tE_V+|YE-l6E?D!xFPFGj2iHmu%b6t<>dYeBYD~p?X zJCI)?E3y`tDrakd?-%E&Zq0mS(SXC?5U#qeT$_OC8`v8(yvTm1n@-9jns{WqmU%>2 z2ry~E;=)~Cpt#AD)edjVk&A*W`6e_msJ<(R$Q$A+*9RPdH0@2X~gmT2Z8xR z%dHM%_197^l-}N{3FqCw;e`ygCQ-)r#zs(VYJ+be$J4$$@goKj4c>}1r^S3EC}K!U zlY0r}6&2m%wFB{p(9Dc4q}-NQ5dwnPaBm`9D$gzy?C8LCvCJwWTB8_D5rbNF?_~z3 z>@%vD-9;Fim?XUpcUn>C$kF-^UXDP|2cJzr%CF#L`oWT9%RVM9Wzm2tJHt0TR8cHG z1SIS;G9r6>S#WRUo2;Zvs@ zKi8R=oSNFJ#8>Rw#cCco4W_+y?&sF|kx0j_PrqVzw#_f`ChOxbtu6B3CkU#k<%JB? zu)n_CK(T`?pv?)0360GCeb)%q7FTpB&C25(hogc!eoY2&K$)BO|84JF7jUM#g!cT> zGyuSDOdbo2w|UO7vUdtJYsWsVOzNm{uW=#zd8r@XPR4 zT_)vfmeu|qEmseJtCP~(0G_$xQbru%*wOY{+MoP+C2*9&6ysixneiH{88xUf2 zwH|fpvP_JtIj5e=DJgvm4?ml0KY)x8A{Wi-^UYaNtr)%u@mGuH=Dh%RHfC?RYy(SU zV(uj*JWP3W1C$T4h$VzYW0GZgx&@O+1*Csz+1L<+H;oheksRo@h4a|-#R&)P?m?{$ zW7*AgTnussb{4~AA0hRU4=Z)<>VB44TmDAgpa@Ag<Qv{o*#E=|)?RCe6UWu0RKa|-a<|`KB{{!CcN)xbqw^vF?PN7rGrqAC6_g*N?M$yI;D#HG>2vD(Q z2cKGX&u7cMM3=0z901jYkMe|Y3r`;WW^N`Y^=+3>v7ZscQw zw1tW#`fJ?&c;j4(*j)EsttGvZNmdCkci1^+{Fnn+yDui^4MtFF)&7ZR{xEpuumV@| z$Hv+dle!-+n0d#`h9YG`AMwv_KsE<{)+nFs_*rsMe*R|i1r{2DoT9c;g_?;8^d}vc zdgnSiUL#U6GOi*Nhj5GrGbn-hj0Q>T*IHUs1O!S=t|1{IG&I$~L_hW>7!&nVd1^K} zPt39IcoChQnQ3ak0a__Ndn+fXsG;X4+1b?>GfREE`W>5_n>qP8kDsuyEsp@NA`N%Q zkZcCS$ViSms&)gPQRm`(4|0L_mX;Zt+x;W>cfLpR+UHLwoS06$D#*E8v-cjmE?sfy z)hqKTtIkWn*`ircNJzfX&<%}DfGS@C^ht!IvfEcjbX2+T#oV}gQ@aqGg0GGU2$#Dy zFU6g)5$pbH3JpNfEU+Yl(uW1W-w`>pH5x|P$psBG|2M=wnK`@^iA2<7q=+HU-9(rt ziuLSemuG+Bd6sI%MT{>Xb}+d#z?PF;0` zONduYqU*#vuWw>v0`Z-P6d6E41*n4r{Ye~lpUx>8fAde;-@OrJLw0L_M>#t!E^SCY zlvdXJItF^i$S%_ZN5DQOS|0CXsxJGTt`6)(+f9@*ed974=$-wYOdYUCGMs&}e`fz^ zVr`1wAuD}?Z9#NhRx^f6t^zLX+YS#cGl~^QlAmdyuy5RgYsKkuKF*j*Z?b z$BXWK`&twp+;8h-To&3n`FrK)-N6JQEY-RM7tSVNga@8MeT#`|%?lwpKXb^r&n3G9 zCW=o?!MN`?_YwBlw~7jfdwzq7;)L4NWI!^RZwK7$GFr4eJUT!FzDuI7p#$I1X2N?x z?>wLp<+U~*!ZUAn_4`}a5PpF`$ZuB&H&;!>7oSf7+GGsLf_cYpl;>(vDs zW(E%DfnHS`vuX)vbOhF*wITfl*9risbmFUKCz>Nm9h^!+*2)t35SwfZV_Cl(3uH$# zOUBehPd1lO5n&Nn=0#RYi@e2L;d&`7LcG0Qy~krdw{X3Jfr`V-fWd{Uq9*%@nZ{sr z>MGXfOm~80yJD@Q9})~hVEO~@8^H#txn4HJSP|dPP2Hk&>Sr~p^`NcA=JY4*K{+oL+?>Sg*Wivwf?qIEr~S@!9b4PbSX+BJOTE_d*plPP z6B54h3UNXvXKxvFc^Mf3BIHngee~1|m5x}!h-69i{ExE^fZzx4bkqxZd8;@5yo!oO zPUyeaJ0ou06c&@p&J8i1ow<*+4=}C&mj?@{rFr{h^fS_kh6Ke!$QS+hKnpKdJhJg8MT4rG4j$rglTK%? zHw5v^=-mb2f`JY2;TVrW>n7N2i@)^pI(IN_|0ybkpiS&U`mrN3lKsCI0aiDNu%n~( zY%;O~1Q@_A4}xqEYc#sTem(6Kj*wMO9z3$fe*i9QyH>1VAS8QL?M5$^B{Zpe%E^Eh-+t0(|v?S z1#&>QTc3J0btuXRpqYGndR4FO9T|^BcCz<|fZGWs+5C39oCxEoDtQf!`-qIp%#*zp z`_%fWxTg zr)Jeoj*N_q`x_UYAL2uvWA%gCU+e*TWM9o8z$4#L5SRV&4fh)}KBAZJ`!l!0V_U*EvuXoWCVli-eZ zY*NzqDLPwkPfwGIyWx?ib-$#g)YJ+v|JA7opdLX%5sml0${C_|eH)9W@Mj~LycdBx zW4?a&mq7dkx2_HH>t|Mfv2SPU1%(AD(_4LSRxX$cKZ1%CRE34ZY{jXAyr`(JVLm>K zJZAqeWn<}8X=BrR98y@Q=EMS4rG0n0C7r&R+YUMTyqHfvb;P@G-a0Oq zeG(Mf4KVVTUKbheV!khN;+{TJB6Jt{B=VB25S{pitbnYH#*591Vr*moCcHLjB%j#3 z|HBjMtRB=9Q&Bno)2ai?J-4p8cIppJ1WLVp+0$(%_wi${o7+_{p&u-Id7+^+ej@R* zsSO(+v}sztKA38G@620uaWW`8Qq7%Ni1+`0QBB`~wDfzjm=G$erxX+v zAem1VGlw9jZo<7?BSFNI3GUYzH_z*)P)X~c$c9J5G?lB92#N;P`Jj+pRAk-YskLTZ zMC+&U{l~HX-m>AkE-3>GW9;FBdOh>#u&~9k;+P+-o<8k43Z8>Z zpn-6DDC21_Mc&`^-=tmJU(3!)D`K-Xm>98Y`14rZgcKp>^h1E8;=l6w6_+nR?8K(C zOsdYA`!x8EFR=WKbf12FvXz)mNIg*@&K$3qDu?#ovr+r#FdN+kjTQQ;;q42g8LNX# z$|K^{9^XDwCKJoZ9qnJlERLiT0{skr@I)^%v`C*&IqlX^EsZY;{1r2dqbVJmDd#`E z?TbRZzCovYqegZ_m0M}Lm5Ay;|EGd~#Rbganmb}H=v$air_^HXW-mkpKrl6rL^mrj z>xh`^;y(2IVCoR$pp{-c+ALGdLPJgtk}mD3`yXNNWHp!K;^KY_3889&J*xLOOi#~u zRHY~`t|Bt>mbMLH7RSf$MNBs9=fg3ns*Gv;zsUgOIRb(ZwFo#5nbh75-l{Gs`2!Wj0?PvH zPp_$I9wxZCtN)Ghnf@Z(&zV4%;Kj-*bw{|NF^}!qw~*~T^C2@)5GXmHa5Z=krAC;o z3WSm3ipUqt464K>FG17v@Nq;*pP_LbwRrW(+fH;q~HDOleamLlmq!& zl6@cM5V%;sS;pxs$M}Fk6Zjw&PUwm9CA0B)Yy|7Gt#|!1)fF2l)m(1)UEDMVc-K+)~ccK_!hj8wysS3sJHT=u>o zL(Yh34$)Zvk`?4uFirP}@CrMJG*$C`f)n~D+GQx~>flgwZ??5(1SdLC@sql}cErzwpLcWggm~H1l&M(F66B;zxdPHP|^hR{QBLl2+V0kv1@gg2-lxHTz z-9+?Jzuvz4o6o+njt;|sTV;%c#c2mG4hst7$_ffh4FSgYL;~ z9$}->4_ZSIw7x4~fm$c2l;QFUChB&ZMF2?Af57e-woRb<^wr0VI-g4bmeT z{zFJ`|1vLil4}g;ji^L@EqI3>o6UI5h~N%^LcY=^6UIOE*DF992mf(ai0fv4BprAX zB@tHQukc3gAr&1J?I90dr}Li$x;6$lMZk~k6>~_)QE3O^U;0cdQWYA~%<*_;plxC_ zQiwY+0=i0{s+7`?XijaAMir;3>z(?v#Z;zZ^Q}?7HFYD4OwFFsG&g# z7uO`$L-T)Zo2U=SmkpX(Sv!(3lV1W3;<|Ku;uu*C{Fk7dst5`>+g^BzLPA%IO)iBy zuNRhqg2euEVtcxp&EhX%@phE5G8L2P^ofzem6B);LK+$jn5vXaVWHO+R=nFDu0q0$ z1x0)ku^&d5f*Jny5}ld3luN$=Z|3JKxs`zh#B_1`D>c!ekgsQzhGb7B{K6PP07j|! zn2L#7;~+CI@b*F`C`M+(&-}la>0iF)#zrWgRVAVVit#D*>9>92*)#TWY$|QSWX}) zamcQrx}al6mz8rA)&B+QbEjPBY*f|%Xc=X9;RndUh9??Y!!=sUJNP(gbo*a!?rYRe zwvV2Smd6=2f2RBij-v{zq-eSEl$Chofg1rM0eix)+-eY|&Y?pZtsUX493?yv9jpr^ zJmu_r%LDX=8(~kFX5O59`zG7$eLnCK`@n`VaKz98_qw|qlGJ%S|0mnC(M0Gm^wUSTxB1$it~3koiEhQ%@6Ng zp|U+<5uoib>2GmaBNyJ@!(1O|&pKpxavI`&c1`gOCH(mmPDYh5{QQGPpAS@2jmLX? zJ{v;n>QqcjGPL;LkH0R`*LG$SkKrH^gsrNA;q{1994wFcxNquN$+mmT6X$0Jt81Bd z`?{uhp&Ls-Z|3G1eh-m9yKpRVK*qS%FV@tYsWHvp`!w^^WHje}-xuR#+HcPTt!A5C zmGedJ^v$mfE&ASiG20|U0M5(^1bqv%Pyp+u-2Xa+Swra0pX=g}4spH)bnlysDK0%y zE$XYSEmJR_H%3QEncrk1hF|&lnS^Vm+`0N-w2<|@dK7(=jFeP@kWjQp?v2||aw*Z~ zT;pVySBy`0k+_1Y)D8(75qKP%ZKlO#3<3^ zzoyx*f$BOsKkwJLw6MF>UTn(y4c=KyLBaZX_qTB}BIO*Khp-m5_hv;&#&DGG;B39G z{miJ-Ty~3iFlgPY+F4h(?Rm%jrLoE^bIcJ10EMO;Gzeo=l7fI;lxeP&-6Jn5?y5nT8q>$cNtg&yl2Q486Y=ilOFBW1E=EJ( z?fQmEZ3B)`Nwqle@*(QnJ|#i<6<;uC7QlB(+MugS>=wXO@p{&KOPEJ?=aAm8ed z_IwV?<4~FIviA0lPe}N%I$Xx*_-q*KN{FXNGd%_d9xMeK${9HjlPpEX&qSc1O;}k9 z)ndb(jLOQ(ceS@O7-mOD?+<3~G%nH5FDJ)n<_N{hYnYqowTI5u^FQYjxO_39Eh;aM z5(ngD(i~6j2w86bN!(k(esdDi%3;PAmyqz-`CO^U^|^d+aki+6%C#{%djGVv?ONA# zHMJzzW-#DMel-Dlk;5i=3$rRGDmv2I-a@K`_7?9aGm$y=B%PconQcyW#HDt(D4BGxbB z+$xFehHs{(r%y&kxGp#Am%oqp-Cb1V^^f+hVXRo`#nn-9TKw~}+>>di^7D}c`&nV5 z?|w07{Blwqs-?q@=f2wk%Dh}$%AjZ~E+`0AvTLBgOlh~fIN*UTW4!RqS2>^Emvlv2 zPp=C;irx4GI)|Zd3ru%XW@fI{%4w~uK|bl#;iq=Hln>&$VFP?BwvqO#2S`&8pYypX z7>CkOqrsla8!K#I=}V@pu2)eC)72wT#yXYvxg!fu`L4*GXVD~Mbci$x{8MF~@D4(+m`~wZ(!?6L)Wu?6R}W95hL3JS#_TbY-jF2R`>gZ6$n!sE?)N z=Vwt#Qe;gX^VRyDRc>y73JQE%T9}PR87j5v=aIIz*jbHg;4^%Si=R!fa3bdAUE5nR zz$9i5SR=3T|MRCHUUW!dyY-pZVn=w*`B`IlcfN@*)fHHMgPc5Lw6yqKW(yh04^{@! zsU-P<^@N0JiR(#o*;&YjWsMV0fjC9^`vD}be0qC8Aw|h;Ut7FdNpLq^ae8fIpNv;b zNVF@G_9WGdmV=|XK}>u7nE<(Wk2vK)l_(CYmZ)9!ufsp5$&RX{Db+O zt8nL>!z?OwC{`0P*EOnD#+gp2ynLAoiy3Wq-Q;3_&BL&?1|8w^cge6HY2FZ%5I0e( zuH~l*U{Td@t4tf|PpOFsHPet%=4`Lh96Cis_a~m`cH+cY<147vmy6e#)YyAO+`eK| zVMk1jfAeCpFi~Ib0n*X$nnLG3DK9OqmlMBL|AARmC^LJ;RL#ox5{o~x@A0|Gbct34 z_cHu0{AHh!!+mwPd?RM0Bj(<T9A2mM0(gr`QLF;jL1GDogr%#nFWq+qBl7)YbEE9c|mL!ukLF-gxQG?$OR> z+&+lG&Frty%`^N*4oB!m;Qdj``7?7H&Kz> zU$ct3d~e+EAS>oW)t=GjDJ(V_ZFtH=aemT$5q;|I6W}A|NfXy!P!Lw4ba2F)>>FNU zGBBm@C!t_A@z|zO+ki*3TY`u9?qCe3!E)?HHud>3h$9GDS|-!r9I0(Hw@c+BH?Yi{ zV=9S@u-7>rGxA1xIyE&ZS*;zO_cd3CW<|4`ZV#w(kf85&w6wIebpf9$>Z#2StCgaN z@0nIhJ>`!UGA9cP`n_6udh8au8uRiZeSI_5Cuok3H6BpL<^{i&z@>54|1)9bU%%vvzYx0RK{`;s~GqvCXHYY!sWOL# zMVVOGJT4M3e8Rj=r)4RXq&!9JPg0pB`KPLz-8`J(+NYmA+9~$HI?9Q<^7A-Qj|W~a zmc7~HNo-?=G#wpjob>XnaOipzRVgi1+_c)-=LM*oy?gA>6;%zIm;I=$3w1i1D40xz z@CnJPS2qUg(XqHn^f+)Z$v7KwLcA8X>K{yeIUCiW#b4*lG4S+J72ml-jY&+#ZDra2 zQ%l%J^D_sInOBNWrOw)q3%;J}_uc#b1^uEgihVIx@MKWykL#Z`O*&eF&G;uzkuuDQ zJZ;BRDH;&_9pUxxG6Ck%jG6Thp_-9 zd}uP^jlEFPF;=sg@Aw)-%{W!K!VFjVk=^#g*AO6>stXsn26v3{d|2-P#!r70ZDMcx zxLg1iE&xP3327!Pi+5yr{0mn*?fsou(bc8CP_V+HD}5*br4%`vk`i;UQT?tjiD*n2 zk%sDf8N>{da9jC$+Hu(o^<`@HB~45|KzCBVW_A#JMwqR^SGMDl^hMuGoy*Gntwx2v zt)P&H6sgYql}r;;lD)Grk8ZS>5R8hCY}8DHg#j2in2Q4&U9P`u$X-Jhw0-HzM`udojEsc#JWS-T* z!C-R`LdZ1!mSZ?pkS|ju90YCih*8rp85#G$|1&r0vmPe#JzLvbA8j;St#8wcPENjn zfH6b0n0oBRtNl|XXAJXH%GVcLo$KSs(F&vv6_vYp8{94k4AhTx`Cxfty<;RIr9#ki6wStNvE5 z&I*KY(sNpF5QFE`GjD1esu)J86n3lc^4j!p(9n2z`Xgf=#(~Mk3p|mh8B=ffP7{yT z3fT%NC#%83L7V!Iua^&F!B|rhrWY;cc9frd`6)l+54H;^&6vrYzXEi^RT?kYFB4QdxIa@QsH<&u`N8zaHe7vR(xEzvZ_{&tp6s@T&FSN zyq%NkMTgV6V_V(yt2g79KyYx1oM^UOGP_WJb#+jtNqTVbQ%aRQ-DdFe0D@K9$!d3u zhp3Q4G>hIlWX$!1&H%C}TwDT0ayi`{8MR?g&IU6^x~*>q<}5Cj02MzsNPy9|nky>( zk@k)O=RFg#7&wedl}{I&3UTC`J%lS53smdNt_iA*UolgI<9l>&MNz?6Wy~faUHXv! zpc6ZWPg2OEc%z+vZ-&SszRJ1W>caHNCy>*X6mk?P$r{abs_*JlN8h80d*O(FyJysd zxVbBm#Bz2tenHAhOkUV(l+%Xt9+y>JRXlnnb0it3>F|*Y#wAN)s{nipTqB>swXmJ?BgQ`2w@L{Vg7K85yL-2vNx$9)S}tMXJ&Jn z&Y7w&V6)PXDV(j1CiCOWUAOpbs>WkG<0->izvrB3JlYWKc}40-B9hf=CNfn>_f7YQ zw`PR%c+Q^+r0*{eX0|@Msi*rU*`QkzG^&LP3Opa+&|$nq3JA z!C+$9F83o|c*U(AQlM2|YrXaZq`BYnTz@X#h~w4Z2yRC|&0k3cl-ZbBFLb51_j*aw zUcVJNnK@?KI!8}c+Z`;fZ8YK&LmoFAq$K3{SE z_0zPG1JHasO@1ExtID!6r7&PWWfw;*wp)XU2?#JQ0*jo^KFP!%8ybb4PS8_RzYzJ7 zo|veCMU)<9v5>{dSs*9#b+VjR+T`%qe|cc#EfLR+>tWhv&XLV>1o^y4yH^n|X>Q$w z#kNheTZV(bf)16qnL<^?v-KG(f1sr~3hmk#26#fhE}?W(F%=Hv(Gle>TXQ?RQDTm+ zCy!Gkgdn?vjJ+cv8;P933V}nGnsPARQMz(%bgt3btu4`NC8^SWj8Uz`eT`iD73Ei2 z9v*|?91UaiBh=DTWU?e$u+rLtI2RXH^|FHOKtMJiq`f$~i`u)oAgP29uQ7EWr>EY7 z8DyiGd)~>*PgP-caF`-!(JsSV#Pj9FrT3~zPqnetz^-?9E(s5U0~=T_AELDReBP1j-E-v9Rb)v-4)4k5Ziq`SA>WUO0NQ|_%d|+W^9r1ZB6dWBL9TL)L zdW}{QYGDR|0DE|`@%tjnB}rJ!A|3L>CkHmXj-wG1k70rZ zVgu`c)6&xi+u(ZbY?lqgJ(!X4+KZ7{y>62ao`KHl;@oF*GeCH4ZL%^RN=Hx1xy>7- z%uCarF)~{5#SoH`LJiG@{uj3x8GYH z$vJHuosm?zmAQ7CTv9i*+S(x+$;b|CZ|AkK1?af%$L)hZ8en!{ZHqbZPI!MjJ#?>i z6~8|T&vq~?`iNEHDLk531f=-)*jQ){&EO;x5wU7mrGLE1zN}iECNF+4U7HUn$Or^4 zAuV~N@N$F;8>~m_I1qmx%1Av}u?BAt2Gva+S&=W#UwTOifte6!flEsI6a8Owy>(QT z+xI&Rkn~ zZKkWIKD9otB4MR-d0L7dB_$xH*rqo1mb3_7{kJ*q_12P7nX$6et}n!vQ@v0de|S$+?M zIx;7)2T5D{3nxHC1RKcC0#vWxm<8Rd^^t-jAVC8GWO1=WEPyB>SCfj5PkSUE$J{(; zC`aAb&qdH~{S7(!XBb)V^sIbBW?+ye;OexpwpQ&*Sf$s-K^DbfMj6XkXMi>0t@WQLq%eYvV%3QdY_g7eZdV0*p-sWAjeYOIJvBQP7z;i2Kn4IY8 zdC#k;*AK~Q1z%5wk~1D7QI}oV-Pxrj_nlb^GAnDs7b4(l@;yBK>Xe=KinhO^^khr+ z*|Wm37fkefiws~#<8Zn^;)}=hr?6069o6Mz7x?NXAos3bZioM@#`EOpcQ@J`*as#3 z`-$gsG}i9b-I?{oV+6nNag+Jx8K4WnS@gli#^Hj;v?(APOix7i55OnfdeLIMB;9e3 zEdEn2A50m4INm0(d<#N@zxb(n!k776Z`thUCyYcEe6HF|uH0kJ_Ir04n<|L=1&4cq3 zUkb^vJGWHH{d4eP73 z4G#sY*MfbOT}w*1q+`o?I5`1IL?|J|jv-ulgtD-+yPk2JPgZsVKZkX%2>c$OtEo9J zv@XC&)7cpyg8j%rZ+HF`*o-_$RLTrnTU{L;v6YaLI^Q9W@`k??9~oKddKUJ!&=^C0 zW3=${(z!31Q>*<0u6R@DTvMP;^yIxPn4ocJ`QT6dU*BX{)xd?4zxt{=U9wb`#3*wvGOlB9kE! z_u<$o5$tEu4mT1P?PzrNd};5a@Ym z-L3JwCYw>6C)E94TP~T$#&D#{)mNJUt`ph=-}-)3@NLc1sqj171-~m>t?RQ!hPGS= z%D>D5;q47iPQdk4L`2vt;C<0kDk>~_nB0L?oFwLNV{3~>v8SroT5`W^=_Z?rd% zTOv>PNB3sV6*Ku)x+B@&Cfrjqy+!D z!_5gv2u@Einakmvxkl1;lTY?nqLaig-l>;!aTmsOTFk8t1ub=Ld4D@Cbvl^jFpKgh z9=keNYp$so+Za`SqZ%m)Q(TOUdFs4qB(jG~T@KgLUbBkNJy#C&EwiVp19?77n<^_8 zfw4{9SEcuNMQ}$(i!kq6tK?1=zyHfsRG|1LG3P~f(FyoYCE(#M7A7XvURBGHk?Ff) zv$HF)vxBY3ej=kEFtJWgPus0r+uTy(F#Y_;&4sFz@V0ft&IxH1Oj zf3)+(uPKp`ieXjLcK)mckUmXzie8bby3OLzfA+(by2% zYER|y!-qX^347scI$x(<&JO)cFJh}LuP$$fGa}z3<|zSVx2`z;sbULvFm=&+2haFA zbs-rX96TXBadA^tro{M_p5ENHw_DuS(gL{{*23sWVP3)6QS=NP1z?}$$j9yKTIq?_ z#HvYeYr}Sp{p|wC%;$34+TRb}rdn%*N$(i#H%9TH?KfOKHP)FUU2I;YS*2U)f&-)4fXZ^7NiiQ$P_a`nfgaovD~DQgQEEh_8{yqYoqJHZ|JDIKl<>zDTZ-8K*aKHM;vC}XD}$}8*c>G@M! zJX&_J-2Y2>r1OTH<3C^n@mwSsezLQPaSt1ZhqJQ7W-%*rwWfNtTauonBqyf|nfBMVXP55pHE)1O7g&}-AT$B{BN7s4IQ`#$S^2NjoSe7kUR?`q{PpV+VqbZUdaW$B7$QEUP&YOn z$Zg!DCb{bdj|p)_z&C8RHn>5jlC#>|0O6SX>HH$3qyB#PAZx3#h+j$+^^J`o0?KV& z?c}wuqCBL%H*V&dj+dm!#%q8>1~5`rhI@+4)H0`>IoR1xcF1|?>7^bw^Ehlj#DF^q zUFxa+{x9C0@kct}+#%6hU*|za)daR<_z$IMZ*TAB<|8!R_P)VEu<|?jjQU_O_iAjg zNZ7{4(tcR-W7kq-^pzTe;hNFi1OlsUm8yM&wQ0@sfm7(dcNyNZt(AWP>oNPRuzFnwzoQJ>iv}fnn zj68-d+riUeEmcUB&ra00cX#uD8-jV0wb22*j!Dv~;xaJp}~? zBo3Y^b|03ZLX{wk;!zqeSEuK(Sw4?q?`tqRIkipB&)2SWDr^3E zG0*VBo~y3xBh41A?#IPuV|MLP>?%S+TFu{uE-&#cCdwAp*V7Xcn6>M-71F@VZo8(x zACTjbdY?H*zR46xBsl&a%8wN(M@B}%B2h?lGMy;fX!QS1$oT>m00u_5+NOeeR3!Uj z;~FUuFtZ@}_}JGQir`oQ*9}j!avdG4V;4sp914Ra%g9Jo00GBV2i1*_HRpX zLIu_hMGyQl{XF6s!LTp}9=kvM){Eyy{xB4YhAF4RFfn^Um9BRUYMT;TV3QELYJO-@=0R9e$hz% z&4r;a5I`X0G^b32nw2@c_eKE{Ko(SF@D9vPc=^=Nwu>TFKVLtdzT@2mwa!kC1=4@W zSh+8rFpr&Sc5<@Z^5oB-<*BKS>Sf*sd0Op{@Lr{5ejP0`%SlOrv14Bduz9h_KYM4M zX>KDB89Dp=>CQ*`_L~)D^s%=+Kh@N%z}*Xbm-8C)T&h&JsL^-{yAu6)`o_S=+y;j| z_6dJ6Y?ftdmxP39f4_BGTZ(g1Q7Nez$u~emf<*@o)lmGNJI$$4W9#ebLDF*J_7V&` z1DnnYEfXM>htVi*q5wH+Xz0l)UD!YI0<=^{#_m#$4Ez~iNlOoOcT;~@<6~8*S+JU4 zxN@CW5Ty_odU7P|wj7L%()qhky?x09yN{BIDX?w9?R4L4^iN@5+Jk5TR|bVSMFjL;o3x>V=W#ngls0*5fVEqX`pV-)!<++N}v_O~SB9hTh zeN0ZSASp@C%Pao4IrzuI-CH+saFiIsVUSj#{?*;4caK0lA+prn{m1w3KS9=(ib`eq zBV1fg&S%tn%YxeV&&Xbb6rm!$E^=RM&4BGr_ z>l2ca9M4PK&2tQge+LhhqJAeSAqFT7Y-h#9QWLdj6!M=V0mJnzx( zcvyu8J$dLOA|Y{iWTZAL%T!-RMnF^Gss%BK=dp7rFqAGYY=6{JXsmQtxQR}(&+TNB z9pQg*{>h+=M7`4o-u|cY??3dL%s*jj9O|P&HBL3lvixFTAw@qfH5?e9{>wicfRJ1H zdENg&YztaJ4`x?ncbBi|v*LYAOCJF4x|U$N9eVA2aaqB^wXENCdGVeXLXj656O)={ zO8-!o`Q~xSJ4UZMt;UUo2h(S+clhmyxpzVTr`~E&>U}sP2eOzg-onA!OGn4JJj;pQ zuImnalcyQce0^f`q$>ryM0R) zdf*s18Xs7gnF;tuMcZ?%tiE7T((`|KpCSU^&Gn3DyzGFBe!bG?m1|J};`al9;yhZH zJ7hGA$Pq7p#SlHgXla>Y4KBgG20m_itdjHaZ0@gkP)e`za{WQOS5fCT+1J+x#VspF zL;ZI@zk6f&nbANqI$Sq`B|gZ+!K(0Ksk09{jA8DKaJ$k8Q0^@Uhli{5Yak=LC5fSE z+fh(aMaRYAlg2+?EUT^gotGyiA<@x}tr*O{h4ki2v?|;Bh=c6bT8`N0vY<>C_jQD`HKp~Kto z{1^$D0MBV4<1JSVU!nw?7x-3a;stRV_rKUm@j}bo&d%=ge6`xz zHr8=>UX0lptD53mLS0=CFg6a3FrXCZ^P(Z5uWNvG-4ddzINGr%h~(O>fqY1%3Gu`uoMyVYx|*!vl8YZwkSQqW0Op(+kd4cJDWM2( zIWz;WG~O_L&9&HW^tWzh{RiVP&&-ep5^+N=J)TI=3_v_Z3W#WW_o=zKU_$zvocy@Q z@3q#>tPk`M`+8YIf8apUTocuLV0+EG^bkEej9nS&3)sL$$W6eiINIdLx@!%;c)Gvi zu)mCh0WM8WJF}ZW5cNq1R9}1Y=8Ze2=O<^;oLjN6X7#35(|_Bb?p<9m3b+3E7$uDR zyL*RnRi!@bG!6P(z1o7{27v!d>ZpD&rELUIKPhPrI+8U6|5w3&`m`AlMF7a%XTU1t zh;Mt=LhD`75mQXW7uO6hC`zxonY{%j^-EC0;^4#vJ=v^Z2Xj#vrVf^4GlFkGC@Xv2lZP_xJ?eki ztcZx$gLqPb3Qhp@e;T9RcXivHr?`e6HwsM>+P}PTzv6dp_(sFR@=kSR^%;%9!S-?w z^mP9yXSdgzk^;{TW2Y2&I}5qt&;7_zmPf%x{z_U^3JV z6g~Ky;gA3Lln9{J6$^VQN2K3JNIc=;F&|>g1^ZkK`48I{1nhsjA(1Rdk))c_5Kbx7 zX}SYFHMrWnau^eD`rp-Jf{3&8risVO}U_Oa-Ozu&pb+Mv#kvs%@-uow#G z2F3g78b&BS+Y6i!uWt;Y!{hjF2RR_C{RR@^uI)nW1Tk*_R#1NaY8B3*69RLhrZS7VFg0n~Z`hy;-s06Jt zva;o}q=DL$?~v2=|GUaxb{lUELnseS272{)Z$lyu912Kis1g@D2ssVq0yntioZwCe zemfm0FTNlp2Ae=|pHAodN5#bni;4m*7Abk>XtrNd)zt;Zm5|krjPbsF(c^J`Zl}#G z_??9MAC9M3{$ZwZ`tQVu4AKu#r?*b}C?r>3KC!V6j07Np!Io_%LHNq_WpVtJ?Y%9y zWggm)hPQThW~5iPwtj=}G<&36kSZf3Rq-Ve2_q;-J{IQ4uK7-6|Ha7Owap0w_)Q?I zYxCZI+5VRSmFh4$f}*)~D*waziv+pm3S1wNJ};T6^P$B=^sT9?E6gJb?KqQxcBLST zZ!u+Q*qg{xYR}9+`X~7N7PhrqP*LKTZx2Y+~mC%Gi))t zI+A%Id%Co6Q7-dUj(WUMUnQQy)#=ZA-bro;w0;`)tygP)eI!QViR3nWTd}gyR=j}s zC|UXaG(eEH9qk0?J@T;Pt_(#U!y|tg4QVLMzREj;@v&H-2ECgFoXS9jdPPm}5W|uy zrplF=Qsy1dU_GqC$y72|r1`s-iO%7n#K@Y)MY<4UTBTB4}iAXw{-P)WffA6M#J5|>xCuGgM2xSPt%2wyyB?%?bkOR zIg#(5Tr3GDy2XsUTaB+_l9rMj+JI)<0rEy4~4y0SjLgjIMT2$^6(`X z1O$vW$Nf(%h>66Uol*0nZa=U6Z;R5{?r3{Qt8o@7cziJ$>Nf8wYA8e-iYN~6(x6O~ zG+<=5_{?-`ZD7#Ea8QmKn`GRoyRkbp@+~VBYZ|B>L$55gBWWzKjALt5DqA%$jDPox z=J``h$BiQv!}kwKvD^jc1qztwt-SpcI!;g4VxxJYe?>^IbMCA)<%)zpjDD|USn%Pz zHX%Sb`WL%(p52{Fj8o@$K7l~*U8}2XY-pFTFa=|UgqJWG0fS0mAQg6qZeuS-kh*X= zF`a$M0~?Ff!S=d=y2ft(v0by1N_cO}bdX+fmK}aHYQwe}5&FHpopQdg%lBl(^q!e= z$Gab~KRTXn_2i=#SWZ;ft{A0|qEk~*4cR+rlHGO3=~P@V+h40)UtJjtiPZknoi0*8 zw{yAi1&RaPwIK%EdmcBSDH9VB(VHaRB*;VibUxwNue^W&{n7v4IT~ zab#q#KL4l%GR;d#IxDCPL175mK}{#u1Wu|n<~w&c3-*?K+QuaHm#m z-U@stzNX25_(|8()19@zbW*LZT2msk#A;Em>U*-^WSy+GdG z#w+tRE}Ys@>G!x->xkl_f_Y4LfBWoFQZ`UI-rFy+T^QU-b8uPONwbd+GgVJa$y``k zXfnmty*sNjD=6+}r@1`Ymu&!>oteK8=pjpsi;Ye7f|XY`HO)xmsR75ZSkuju1jJnE zyA9IJW4#T(U;K;~;@ry&1mtb=<^+?YrWN5@(TBNOKR-VVbup2zqL}jg#mnj@b_;i{ z!?)fExOE=uGei?l*oLY;-O{OV`rh_LUA^q>8`VE~W>}+j=*dC)rdt_8>Q+D3QMUO6_B@cY1(O>~gvxS%!Kp zM}fMeim$h~u&0>bC?rm>MzZ3ICzDHGt)XYPVcwipp;Ot!=N(*-4dij=NVm}ZFCbt7 z68x^>(QB#CIY zg>suiQ#lBnFkNG%HP#U3y@@h)|IY0vi3_~pte=NB)vLuth+}yv8!0y56&7@T7sx!y z-sH{Ng1zljc+h!n{gt~yVMr!NN1Y$nIi|`s%G)k`^5Bf7lZYoNC37I(waxry*@^Q> z+S8Qzt*AV0u?NK@Cj3KA^oPf=GB)UnBR4?RW_@N*r*oA%I>3}H@w{(gZF*QMuq$qO zdH9YirQfCi&l8T1-sUKiF7W&lrG53YBA6X&r_~MYFyw1S5Q`5hN1e(m>`VPVFq>#` z7}oyW@3&dBxum-AN%t}dq+FDK`?gq@py|SItXNAE?qp?-^8rD>N&g@DHamLq#Dl#- zI3o7;k8JQ~^0kM)xz(MWIG*Swgst@GjL~jr%OfC3k~M5m%~yo_xm6(r+8df?dVZU%smT8yHZ-f zBq=ct?xDt0GO06Aq(D$$`Ygx0yL>Zxucya&85$?D4?UQsz`Cax_wV+=INp~px{C*a zq

    Xrq7GvQU6~^e@(^De@!O>>gl&0+>AJVD@_9-YuOq=Ty2WCmtqT;UKXuD-Qc-R@T8R7*UG~NqU)t894 zGhGP?p8~6U*tUQ?G4oQzJ+P-UhZw`v@hYXpZf|h0y}4-W!OHaTOk+7=UzjvnCB~}u z2AC(GEuIjPz2(-Sz_R^5@tExNebv6xtfa8~w^ta#!O))-Mva+XW52I^R=K zzKD0eOIj=VP#%JY`vhbpaDtIsFqA2LmT9NyBoUAl*X6&X z`oaa_Q5t1hnZGqJ_J@~3@Xuxk~3>i&2%ca>leMoO5&&jcT|Fn{iS9sD|Ai@P)H zqy6S~X_fF9E>{>$0}eIrBAs!0@VDL))j5E~IOvBT;^Vd`w&9*v{>+(iM;l$~@7L0x z&OBG?g^?m*st4-)CI{g1Gp94F-c*9StO^Y&423Uk;UTfYA`GKN5mlzAxnm})L-Zex zzxxOiM6sJ{4J39Ci~Knm)=v|VsWz7%Qlv_ZAZ7ka`}IUrB$j}uL42U6FS6ppE~JY$ zyO0kFCv(&Ll#(m>Fvc)`?iZQy^0;3P3-Z%4GVTmyHaGZEg~?LGdQLazu{Bm`pWNP- zovIQY8&UNcQCl07hL+V+?E9BqAqr%7uojY~_j7bPLRMEon^ z9@_$@U1Ze9SETTqdv$vJBhB#$*T}=5!bqlq2ZTdR zi~S%CBC@~NBs)jhcpcBX4PM4$y04Pt@GEz{y%?IWHjOn~!ylsiJybL7;hl4=vBJJw zo#4B(&h&p=0GZZ|RyYUa#+|jbwO*fNN4X%op*EpY=pWnkar)(^bA`~dyl`Sp5fbWl0J)M>XR)t2wJ}C6!j-`n)S+%4FSzq*}Nkbwcc8_<~ zOomOxIftQ~tb7nql&Qs2 zaZ}%xy_Jq)*FuTh!8vyII^egTe>Wy$=5rmS;>`IkD$c{C)j=a;b0H}lR(TQ86d4_z zq{vau6dDg{Xjqip%)F=UmVlXH;l)rK>4e+<%0${qTUuc3$yP)H-UH1NJDW;}Q!<6R zJ^szH&Z-H>)&jN!axBuPCKFt(Ua(*wYu@H~#^FG4x<7vzBGT`!dvzo7qVoJ^7b?#I zu%G9aW;VR;6FmA;U;>LfsanFltBhau6FsYB0mM?pe#O*t_LT1Ux6;C9(-9xj_+;-# zvdte=+WN2Z9N6CF!{f4O=UZ~?w1}&Ayx2cD3>lliD`ko*G0Yh2zf3x%s;9UWhxV@2 zSueY+u=TRIJ42X`K|NdA-R!lpe84G@?d9>w9c!v>hl&?T`ue(uCPTUYX3@B2YR~A9 z(XC095AR_Xx%tud5=^{#E*AcBG$SM1#gAPV9vbPq z`J>tNY7hliX}Y><>OU-?w*koa=O=T+GDr))Z3{d{*5$yN9UoRQLm4e!;oMm?Zyy7|b^iJ|IzHs;iruIhM7qem&y7EMEIUtY<26%p$lv~Ji43>&3R#t2zHu@xBa#iEy4teu93LO=pI6kc(X3iuU!VV?yFoB| z(vShiG>;Pxv}tL4XhzxZx(gIje-!xG=OuOIzMh+qlJGP6yP&YXsZExd>zE#In62$f z6l|586b&h=JVBiW-32#`khrk85T)8YzvScO*=T4)BvYmsuNq#KF$0-efKo$UQe8$S zr(WUw*L=Nh)eX%!CQa@B^{jRHH`ot1)+qB$8mm+TD9uuN(fO?@pHWbl?JrB@`%e22^IO%K+QLfTRfe?f zAGiw$zW4rSXK8W^p?Ie!$On4t6fCt}L-vZf8mMi7jA8kN01Nt4AZZee^o8b(+V3qUL4RK!Y!VP2g0o9_M2{TGBTx?3)_}SS z>4c5V_)u<7ur~_gb#ky`1*u+U=4=#|J#1kES*e^lzX z$7fT^6NGInLXMWp3)}QNs+WnbCvZ)16apbX8c?^4Ya1J3FxqH+xcYEQv(pZjx*n#! zsboo#b2Osx9VV+TekLcsH#UBU{*R{4Q;^TXRP{H6N(=%p`Y&~na(ZcCKd9^^8rG zE8452|2~0&Vxnp3E%W`Dm@Gi_E|LTu5OEQb#w#vfU&#Luzv(4BaJ-``Qb0UENXX8f znJa)vdKzf`!NEaB_8@RzZz+)OV1`QO-3RM6+Mes@@|XcQ+7F0^QzB46f*~TJ|0+oU z=o*)xqRS$F{b2q6i+AMUkac>@{B482cQd!TNH&@S z`lQ)5UQG=YK>u#+>3Q3G{S=|4nm#%N}L|Mn?&**J|&Le`M|SMJsDi6{#|{m{r&b#6=CPYKOu(Kt%L83Fog*OKkUNdS6E3wpIz?+qyJJHMQbokf{)1f!XQ~p zZ>hNp^YLf0jE{#28MO;+6DPp78Q6!Hv_XT&KXh z?%pQ{`AOZeA8qnejfsw?a`S?=rrvqXO+@d1RQB{v*e{?#WMcX*9PSPUnlr)S_F>&r zakcx|CAjWUA1mDf5=t(>;R6|!@JV;+l-Ec880CDrQB5BUf)~7|Z)96MVSOTK3e6`z z0(yem_n4iXoSFF~@Dzw-!p6o z!*74<%Z=9=E9wAAhAzAB#^x~N9m}i6ZYY;aAFFGy1OlTC9of0q%)3|X3H;*XCSb^Vy}gW{wAsPcw32ah@=`8RT(?3V-uN3Y?Hs(-n-UEj zbqZqCpD%3fH!e31%HsvyFoPZ|JiMfJY3pU!^c@$hJex0VQBY8`1^|*7IF8AR5t>7d<#y1YIrdDmh@Y%-abEWC1`AO~K9VuP5Jkhuik)DJ5I7A$53%4! zC^l$UWXEu00nc-)(8P=7ufk|mi46G<@!J%HFH;1ufl z_Nn~6_D+B|yqC?lC!#-cHg%Aw^yfiM0{{zp5h-7TtpwmvipKcDoWOdzF z)$5>a8fl@c=(WK$P#;8I1p@`g+mm`*tMxv<(5nm*xjq~a-@K1)fR%!b_U-(`Wb!Ll z7%LN8WraxJ6{ldm=ocpP{C|2Tz{0a~G#l%D4_o+UFQ_^IPr{!7KOe+zY8`g3(0f=- zwCr};8)gaB-l+OTGB;X>q-7UuJUi0D!F+g`l$Eu-RBR3LNGx#E;93PDhPDg%!rs@c z1ZNdsJ3!O>{KEbf8Q%4`VmH!OJST8ViHLu$qy%gwst~FNwSE|W3I>4-cRfF&1f(A; zXx`oDb=@4UYdQiYw+$XHnMbSx&D|w7>Oircy;6FT*o|t>VXjuVVbK-kR48E|mUv5} zvc&N$>d(F+S;j9F=lbp)bz+7pnj1_oT-$YE~_*`wg7^Bt5W{&iJ z9irg*LhHoq(~I?~>hYqZ;% zeYZ^8>M9V0wZi#SYGxeax54VXxHhiwOP)h(t3c}vE7 zv4OOya9Y9>$7P#dA2#JKqJ9VcrKBW-(&Vhj)j7%Ow#@yBsMXadl}|TO0@wLX{?5PN zS8%CaVv2ub%jSxQud!IMZSXJDd92bro>m^pp+5eoD5s=Ck(e$k-#&Ice0;7xbeR;;3YFvS)sw_^Y>} ze++x7UP(y&@##(c!<6evs)Ns3Eg0uEdGf7A`Sa1`yPTs~$GE-mB>`bZ)+6iAkvwzM zE35O|y(7)tow;J55^VDZ1sHElhG1ga=*$V2VP^mQc|2K}mL#rL{Oa1i^Y#<%laBA- zb@&M87jVQxVl2$x(9l>4{as|ZHL99Y{ZiUJC@SiZYj0vr`Kxxp2zV)M(!k(McD7lT zWn<>jrP|YlS4CO&em3s@>$J&dr6*_WC02(rn`yMRg_~(Q0pQ}i7tp9*;1f=LA!@9HZ>4#> z(|5*cp~+6C)=&AL#Y%$AGF(F4*ZYY*>E|-H5*Az9I(_f@XPik?#g2z&f@SvEqeE`n zZN>415^M3U?C9zMuDCPVP3WOX(@T9qM`3tZ{>;jL{-9v!YWucaQW$+CEv49l+qakO z$%wl^8wGR%Ql$w8l#w0~e~aX{HdPb7wg!55198_Alh8R{{HCof4jr9_0)o(H^W8X{ zJ8#3^QeoKcevirGL&WgACvLu!jpMPse^3^@>p&WX1l?B$#AUrNg60}h5O4~mKZ_u)}YfU%M86f>EDjIB0WkO_) zO!vTNc2#X4K5)@iRR0Q#ArNhQPGeYZ@#+;bf{2S~R6#aDMRNf-;*E(I!e}Gqg=uj& zdd_CjKO`P$dW{TAN+igE@+box6CHIsmGT)|UiXg;+J1Ob|E_#1F>XX?XjuDE#FK2= zpE(TdmQj_Z*)w%b4_5UYraw?y&Md#;XbIdDbUifevEoGhCNhG*`Q)U>716yhMe$(_ zMH@RrJ=STJhUnY9%r@PIC}iO*OVlqM|FgKUeKC|vh5qPg(-!?hV-7KV@()VyCsfu? z-XPM)^OOUI>%Y$ZxU;?8Bx)ATYCH%fsXwhaZ&%Nl|vGayQl2>YnT` z#1{x$ZOA8FaT@i$#KQVaA$j8@_N92f?yL7lo9c}Lg+`ekn$`N%ZWn(C?LMd>|1%f7 zfuQ}7?|k$&akdvs=`h5_+ZMkL3~tJ+s!n|Q8v9PwapW(#^HTdeHp}%;@}@&9QF?W= zO3%$UAEul9brt91@W&S2-6bYcUteEuG;SgpFu^uby@Qy?n^!M&yL`JYT77@47+}!L6K*_R-i?Hie$zvrVcgeoLO-=5CQ!@+X^>$3A`QpztVMMEppgU2E$ymaby)rblsC zK2}v zAhV=|jdc$T_gv1a;A-{~C2))D)S5B^3Bjpty%=bee+?r>}Qh@JtpxlOVwcCFlG$e30sVru1&NlMB+&f-Esj`nL_JK^-eg66XwlsX!zerqVmA|XfH9-;dGNe&fVU41c*L1BuPXSTW zY1d!mA&2-L6co+Xaky7K^q4LFIB+V=4g@u z(Y@AZ|J_HmyQW16`u}GtxInWX}ZqKeg>mlQbMwXH7or+ z;yIJ_L<^QWm8=a#Ede3=I2tcQhiM5~3cN{AP`D4_8v`jz`{=Fn{SorIs>U6Ab3_dn z)sp63%q#~uEFIPUQd6X5obG@6PvaGwfI46f*whqdhZpV3u}Au0f?baNRvg&ckZ_tC z;dU08zO%9#jbi7mt8*PK8a>+88w_U>M7h5@_LceC6!^<+$#9e^u#FY}+};kYO3#k_ z(GkaA8jNkcO0T>>iyy8Ytqds$x7C_HLWsokx4PQ3WN`oZ(LSAxO7QN!ry3K?jj;^x z`57R7w>m$`BU*mu^%1c>7r%AD7!>k@3O6UqOaAZi{>kSbo(w%Sky0F-g`ExuF~c0P zB41?K`UVDXdK{5Xu}8?tm=|T9-O|SCfCs!Vug^KWK4e%gRS&!8VT%bqwd>W+M&Htd zYV-mj4LX+z1I8POqex%Bd(z-}#j3%7bvYMpCx}D#zQ08n0aKJf-xY5UeEOB1l2#1k zH2zzmmZr`bM$+dab9@2g=D9Q)J|1E{!KzI{w%S2?DaG~v5o&~Y>7(o(;gIwRD;<_d zm7I84$Cyyf?@i?NvtL>NInDQvj8{a?Z)|kJ8T=w$-pcB=O3s(k@-wM8Qv-92t5^me ztNHV@BTbkN9a{_nZd|FuPAJENYwv1sTLqsfDSezk6d|Fur%y$q2@l&N->9n65XX{a zx8>ZFbiQP}5MBK)gj=uda=jD`k~q#b!XAb{rc6{XBfzqKCMGYmQk?LVB6*dBH4+E$ z+fl*0?6f*JJNT1TrQ{zr+unFV2u)a6ICBCr^i#C-@7xzvEA`ZALdB?Tthi!MB-P`S zQ@?C_KVoUFrFw7sIr=uoBmb9fIb+)5XYNBeKd;=?zdJ|VC(skjF?f*Ozu%-m$VVg= zfP)u~Kwu^PT^l;@+Ps-Ts~+1V`(V6CYlekW6~9!c2g6#QKDozm+ziawdTtspY4R5T zowAOot0A9BizRC09R5`j;V_|t5#`-hkKZIqtWo69;n`-uk!AFL=q7=GSnzi6UuqSl zm0D-6bo76oeoy*;Rk)tLdinCVTJaQp3OLld;E`+=7%2=NZE=TCjqUMNVdICFf3RsY|1uWe#l7s{CVv^q5Jo*!)Q= ziu9v7t1F=w&65n1nH(76`PP>SeWDE_4fDDSA+I+vQB~;&C!C9&j8?Dhzi_`vQDT*k zV93TB@Rf%=Dz@Cf4S&UocrNj}Y$ewxRg4MYa3o;ejp$3&Y>}7JK6u{?J z)1t-4-0PlS%~^8vL~HlfkgL~=MTSUpgbooE$8c(Rs!W^MQT##tr8Kzjfqf|zi$!^Yj7ZERb6%uvY+h<++=Z}b^V;wx(BJY=I z;eSTUIZtao`b!&nU$5zYOwFou;e^{e>8pT$zZMdL$qucKyC&L+Q@A6xiYa<2USxG& zqwe#Px`uGQR#p8q9BW6xYiYF@ zDgBk#j85Kk%Y5uN!*FhXMt=N9`FH2+Knf|#(1?9Cm%1@gZN0`=ojWBk_GV;Z{<1*F ze){E@{9m;rrl@l5%Bc*|HUsWae}66lWo3<`8dvri%TV?AA@1! z^&$ zzGtNssI=V=W85CcDLZLB*wbip#bdOOUgc=CZH+nqRIwK>yETH*qomXU+w9e=oz9N4 zU9?>h(T4m2_xCN~YX5${N7PMn+IJ3L_pvcuyqa(*53$Te)_y zGNvZJC8It56DieLeJ8G>=;ME`gSNDhk)-PCvB$As+&G{j-?N=vML@u#q%<%xB4xRw zpS#s>^m}A|clR!jI*b6~B4}v|%xIp97_0u>s`tqx7mJX1<-?i4aDDpANsd=v{mIWa zUTn|vXO~k@&}X5GCgh-7lYCK|q*~C(o?u30voOkyhsJja6Y)asXJA1nkhqMA#w@_bb~(Z`FB5OBK} zyLOHX@jYMoR7U(UJ*a>MAfjs7{1`29p<+bR_Zyo1<{h%d$2muLBlr?#T0Ys{F@0NY zmU2`J*%i`slXK&u^b^8!ex`Qqxde^*A0%s?F@l>j+()XrXZgFm9@%SiSlUQ6&E3f*>Ay2GqJDU8 zl=}9pab~YiW-oaKZdD92NlQBoRYr@c$E=UL!{g)QTe{(qT{yub>kc7CVS5LClw{rg zVsSy}rc`dM>{FiHaKEI95EO(;Shb-N^%I_~t5t#!^6hzie7R)-R~^AKc>twyH}f<=Byr1M%lL3HBk-Z?+6(@vsTTB z1;5?Z3|bJoo$Po+KNz^awVQuearJ6_OhrvCIy|0^DeZZd&WRd5ZsyNtn#y7UZ_W!q zv!tQ|`1S+{+6Wvl>IMtPB$G-9}o6-DSizpJhqZe8W_?Csb6XG8$rwSgrisDpzyPhgLvE6jYD z?*Fw$NlV#Pmy`ZQ}XWwn1mI5ChV#KIEn^#Jt)SIpIP ztX4J{F^trQCECavzVMfplY_-In%jhY>lQXnXjEJT%zl5W(4J6u@+6@w_)X;}RRuZf zQ2m2WLNM#Z>)`BOd%NC%uP`nuvK*cpf3v0k?D_w30T4QMC<3-d&#cRC$1=XK_?-lq z5;0fBlAP`^1c@=(!d$H5+=`Iva!oExMWIeY!l}r7g3pcW)5BH8mro>UdU`k^suc9}px?BUcGlYL5FQ&FSPX`xU?wFC3dy`QD=?}@ zPGBPU`gN5-*AA{J?K@RfipP(ir*QnHVte5pn*C#eccqoFivO?jdENri%qA~ZjI^kz;B!oCI1}5No_@&AZc9bgGqeERxgdQzIHc=X~J>Q}LgHN*Y0hJ{ydf+KDx0PMMEXxnBuU7HGEwH*^r$>^*yQ&;9B- zR>(&<1r%vT6&1hK&A{yG-RZzBYWJBJ6;*Dzu(qyj#IJYI3&?{rRk{{?JS0;52#10b zV}s4B~@$i4oyYn$qE_@H7o1ZlR*}5>}9o%>+EtCB#Cnzjr^H*P= z(KiMAZ1>_0Y9@v$!aqkn6XLMB%Pwr1x*iFBSgvk69T*%WdB7X@C^{lC=-0UDNc*5^ zYLisd?GD#JbEBX3TEn2d1Om&r=Yqne_dek>@6 zX1X@n57F<93{KLf&>J)Zjv{6)PgWL4DxLay*`GVsd}2q#bznkx)KAKF>lmw z>;Pe)_QDWU8D$mazU4o0Jp2q|Z|@ZmytB8PIJb=|i&DUoGIOfgFe%pLa+|R{oO5b| z=E0`+g4J^ClTC{b3w%2Kaz;yaoZlHM;oE5bVoLG}v~+FZ;eAZ%W#{uPbCZ>}-U`>k z5SW;ajThDKS15>bJ7iRpQw8c;Q#%IvbUJ$aCop>I_Z$fcGr9v88~f>1%#)W+C%fP$ z`}vFyLk$f@sH+ zCnZwXnc|mA6eOhlurQu24z(g8EBpB2ap|A_ey5M{4~*39AScZov55Tli=zqk^;C9t zi|3s;cK${$SpWiFZnIUJ^`2zhvb!q&0$6B13JsnOonf8gp8{<*dj20Xl#WK%8yW{JG#7i^A>{SFyRUg!6nRvY~<&{xyb;yov;?Fi)xC?l$;`Z zcCP&di_0g6^~Bm9ywc9J4AjyXN#jo)bW3JUVHv%^`qXJ4;I{RIjeNKJ+nAA&@qv=O zykB4-cwHhu*k~7+&uF{B~HYt$jSJQK+PhjJvqFnvs!{6IV)da%kOa(6L#W zVP&9QdFtOJA@20l;{rHQGoYQr^5%n$n29L$Z3hyZKOz*h zn5Y7(-C#GGGr^*RMNZ{Dn`8USsD#)pQBG>ctvig7!qU~oI z#glu1-VFZFqdiu89npnA@fSJ!CM-<&0D0I3UVI@KZDUp!4xWTdSrW~g`^Iij~AJJCM{K5 z+Z;BJm&e=S)sdm>dW)TEP&^yE96skqobid7aMdmHohDb%D}b}y0fGm#j)JLfoR{vBxj$vV8F zEm8S-I=Ku%3|{afflw(bZSm@QH>YZG-Nr9D5L>sk-&5WHUSQDa<~D+*KKkb2Ls2b| zp2*G)1F0BDPujT<*G!mc$wME9d$WUSEfUR>->SYHTz=ldH3Jn`u<<+ZKYHFGa3Mb3G zi{zp~L3nIb0JfTGl2oF#+gs|1h*0T{PX)Bq@aU+&pP#C-a(cSJ;r8%Qy6mPm3Lz`o zq*j?_!MAUE$JW8;rw=A7ur_CAq|$p+l7mbj6pW1r`ugS;7ZZ5##`Cpn%WcM$m6Wox zO;}mA?&H25OO=c)D^mwgS9y8SZ>g!U-{7PFFkF)JuW>^K2R9Hh^Y^#0+}hZ&zKs~G zz#>Nfp{}ahGVG+|dKUNlH#2^qfe}|xRn=N^;1Ik5n?CArYdWRDhuqHA_A7tbX`N@$ z$_l=XO^U$ozt!~a#}5rBE+GYloPygioJ{F*USA0!q^MdN$JRzmBf;A{+vWw5-K&2s zHo}RP;7K5hA8wQh_j<%tg`QPtt|F#1=E?!h@I8^a0(ZRQ!0@@ShJtI|$Ss8BZoM>E z9hIrd3tPnxR#mjGhUdT?Q0dl^#!0b2n)to<=rQJ}X%Zn3yp*!UGPTyqAj>#5^+J-QWI5@_ev4KG7ldwq7buDDgIb#Mg+6_H#I1MG{MDM&Q%o5s2Y+5b!V^%UEkZ62a5W>Qv%G z=983e-(r|X?HbT2c=@oBOsX;(J-;DSD1F5~$=@%aVBIX6I;nK%xZC{c;bK&D^z~<8 zCW9EOj>&+5N;UHWC|Bg>=0ZUlpOB#Ku(dr)4SB@MCWgy=%n@WHPzeUE{j7F5thAK} z>9(|<$~I zsDVU~FVP+*;o~m(`TmBQ@b>*j8QIy2>g_?kPwC0Y*XQTi^?a8h5`69#m)TIm_q2rMZ4P*D8o=(4Xp6A>|3A7Ka4xy@14d`X;e5Uk33Ra{?JXWsUu74bQI zKmG+79^U>P1S)DEY=fEE+1K9X=As6QkT*NdyeRVWYK&lb4&(4UH%*g!-WqntlgsqH zeWE>y8WADnS787F*Q>prn0UjH9O>^4`6E|dbtkVC&P5!Rl%u#zYOKW*1lV3^S?MVg z1b=&oN{g_i0wE9f#$pui+c4GN=cZ%gd4P~IlPXWIS;kud8=GKl6l;{b)+lLAUl}R- zmd1 z7q-EwwJJ)2h`0Ma6_#foCRqjW<2an#mXbdt0~c%cE7m-Ym27U9V(9LJ!`g>7v+!c# zNjF|1kJ!_k51;D4sf7vN5Tv7{y+%UAZv?xeFqUvPi7X3p!BP8m@=S96AFWi1Z3cAjRL{lo~=y9nPgLOd770f*qt(%{J*o1JU#s03Y3 zrZPJp$81zrB=FmgbWSjk(j{&5Gvn(#aqZXw;@R!f+p5g8ysmsJc9=DkynOGm-GxqSMyS-TAvj_vX=v1xmEqs}h(|IEfg%_Z0QJ!a*pzPzcG+`sLQu z5LeE};ncqEU_JitdV;!NL@VuEhSy_$qy2#yemX`<87T?!gCa#GqrHhy>ca#ym%fLo ztmccsanx;IvjzdPj7MAt4irST%LDrR3;n1cHP@=jnDe)OhYQtf+zRCu61^YCYH=4K zWuIXB*wE4TP<|uz1wqkomp8#$d?K=V>y?d%eRYZtFo^CKJ$mV&BJj75x=@SyTv-Eg49}b1oS?5eE|rks&a5N2bHBViPhHm>LKE_ zfk|3o&a+1$q2Ut0B+$^%9y2h8tA06*oj;~s$CBSl@$d1wr9@pROEh74^xo`_0aHTf zxUjste1^x;5>3i^!}+zJMxVm$m{!?*x`$+o9_-v(`IFneu{2JB-fI3K?!KnaAziOI zc!Be~M3lhRi(qCa)YzntlhLkrp8tdu54neg>L;j$T>A-9Uthj_dHU$Sr#vY=eNM(u zm9;freLX4@hh#^2Ur$e-svnRy;K}gXuQh_NDpc{D78BN%-^sJw5F}(|3WKcVv-3fO zmGtx->uVy=Q3g+=ALbtnW}hOqOqS0FQM|ngj#PUS0TLG*dqydl#!YU0nu+EIr+jiaNbBj;Fv5naqou?aH4WCK$Rd$E=cY#+R3mnDk4$ zGVn|zDg9|1mHDlR0#W6$8-HqQWJQDcMf>ZMxbL-RPDW0;R;+BSft>-hRhQ^-iE4Aa zN|m#9x%6W&p8LvFrbGUO70y|iva*W4f!?bTb@cukZcq9ICwH1 zkYYB(-Oh2sUz9K`sL(|rC&DgVQ*~MYSXWA&IkzD9E)SZHM-50U5fYkFrrvhH2U2(% z8nJNj73T%6FdYID2j>BSf%GF9rhF*Q5zx6XV2y_Jf8WQI7HJ9+lFwngyX4f|af~3s z0*6mAimuCoC1iMe*6@Kr`l%a+^h?CnGaW{uxTsV`CnMX**F-Vktco z6ckVbq06e#LjmRtng*{5b^0spNU3GbO}6L%9+w$7^n6JH%6odaIbQ3riTy%F?sK`r zCNlOJ_g&)4e(06lcvtbt!LFDHrlpy7>jMkb-*_cPh-Qd?tS5#hTgTiHC49Is?E|?X zDF~RZO@FKrwS~{tn^GD@5xBWcGK6mOZ<;M zRp4Q{^H&vp!$kO!nTt}Bk?EM32}|vp7i+Y}t5bI|69@_UT2KU-SyTH=;5a%rKGu-9BF7NC0-@s;pS0-Dq#WG+FayB?Cy zp8ce5yn}!um2>Eskh)NQ?S#cFa~s~F`9$wZE;RW_D9QJi$ElMwT67BT?%*>P>G5_V z-kI}xOgwp|py4t5gaw%e&nY?v$3jI_)rQ!?);^%qcm86;^{q{{2@KN?>_)G>UOBrx zAf}|C{HoUEyzN~$aN@g(1q2>hM=^>Vj?a$5nJ#&4B(ccH2=QCE8l_;Fgk|(crGW$D zXzw6w`gKDE6X6ZQWNydBSCagAMn3cmKG%Q#e1F;1L}7j-Kc@Eax~ggb8E#TsB}O zmW5Hn^cRnS;P}M+Rf(zhr%yXmb)M+x8|ZZ273G~^CcD2qjEjb*q^8ys=NZRNkDIoiXN?_3cy1ubbga{oY0s83=2snHl*seN|Ndj~8?K!}_+BLVCd4Yl= z0A6Rh%ux)L*yrHt`XtyZ!Tos7razCg^0sKmXj$z~ zE_2K>`bA9!eyH7XcmzE4h~gBx!rP%2kNLI@blhbwGH;|KUXLUjAzrimnK`PN<>6d= z#A^DhX%=U))}1MRYx6^LOMQ?U&nxOC>NvlrDgEm0Lu0sCg><)Q9Pw-ZpKTMLcrKu| z$H6$hWU$HcX2C0~Ez2K9rvW20*(7wdj3X~4pqcPN@Pl80A5^r%K?TJ{`2sX%mnG-g z0Tpl+1&`VskKY%eaV|n$u)WwOz31hwG4{pkLwD z*qsen6@9&L3!rtQ`!PEz>T$ueHXjR1y5Ak4kN0Zq*R98`91giQHf&ZtSd5mWe*Z2f zB^59v*4=9KB_%}&C%`3S3 zBs3JAJ5J^aBP}fz5%l_?!cHtIQW6yW@G`HEkq^c$s)NfQ?FZ#?$d@lUr-Pghd8cFL z8+LU-cmQm6pgVJ&PJcWPPN_+xs$vbw-wn}2P+wnJ;SZZ=i^!lgKzuZc+j8~mEXK;x z6G?cWWu!vkd-U^rzLmg@l+y?3h-al9ku+fj231nE_%2p!8R9D-3cso%k?>dR^;MG-A32Fi7)+h2rO z=q`yQ2eBG9#WHBA*I#eQS<7`d5WbGU6|ixoEM$E`(%0Jw^NZ4=Qu+?MFUoHnFC}N{ zJ$dfaW<56E?-_A+%pSj4sU1^b{8GF$6xy;CwyQt>c%&LwNUPl%7Cj{DB<3VWXe?Ct z`hL>jvZH+Mfk5oBtYNGXbUfBY{M-}njWm5JX!^3O-b1*t%Qrhc9|9(SydXj%C7#>y z6K-U23VTWbDJf+E3s}ZDnLw#%4VNrxD2hNMDRm9zydVo}wYEkzy`dKD<@NMX5kK(2 zL>WBmmBhq8H)VMbghWK-MZT$qcGx3n=&I^?F@#G6$#1DSyM%Nb?mu~pvsY}DVT49t(^(Nz4MmR zzM_^Bx08p#oSQ>$P0Vn9tUn{x^c<^tlpWH{%4&T`NI4clZ(9IC;QIV2WqMQW2qvf=H-!rDtR$ zbDo3Y@o{;oJ|*;_cXf5AzBcWu%HXb}m$`ZRERMO~7J-?$M!CJY;^)%g*OKHy8f=-n zB3Ah0kt*vyqxi^mDkOX}ntgSD`aTSJ%r0np7bdht|N0%RS(<*1NKR-E@ z`Kq(5V=|<*!OK8Ho0*rl5Rcmus8$E30tGo0k}Ul*)<3WHHr=bw501kzBj8jqpx*I4 z>qizi7FW9d%6YA#sw^ocj=6vZYp`Bv+W8tCE*5G80boVl&1(W;r3fZ|sYR(iW;hf` z{W|kOM;=*T$5{2b`TKw>DXTXu;UcL>icrsdoB!tFR$Pt&+N$PTb{Vgg;PiCHJtSZ} ze1XNmeS_B&|7BOvGIaB_CK5)J^U^*lt2CqGqz_8}GO;l-GFt4?bUfa{LfpfBZEC>L z*ytsYfP(aQwC=&@z9e@qPz1+h|NlTtD>F598)prbeE)efMm^1M~l| z2DcHhpSTuk-mZ8rm4*J90sJcUn4?aj;V+$nie)i%^`NI!o0tg4Q^p6VliSDA1zu&1 zNx#0&YwZ?l&9$}tvg^T2;H|SO)J8(|_4WPAlpk@w}~$rw6?Yo$bf42Ct?`tH#DJ@893G7#r$N3Cze4b9a|- zzw3T_m=MoqC`gC?!b27S$<066b&_=|Mx1R78LX^vWgih=A^wFB=)@UwPS5;qV#P+B#vf3Kzs=gm+;+nPH30@a$zHT7a3U`ftH4J<6S^e zPHc{=mAJfmFu^upZU0v5@{|<3KfW{1IA8-RiqY5KAC8Hssq-^|7Hvb$>)%IIH8tJV zhV;iO{$~62_i(u%MFv6k+IZGqAxE7vziB&x-z_|RUrk6Tx9Q<;?UWv&-PY<3?O=cZ za~}2V(A*U;8IJy{r0;!-dM%48^(+|Cv!|@i-9WzGU%)DS00U zBY(}%eMy=O-K3rjK|ui4vp#%C>rK|UX?qbmT*!HJ$~1rVjv-YEtPdAPH~^|a2PO#& z<9*9&V^viK{-0)&apHXPO0nS(iG_88dVFMdz1{)fk8Dgsdu@!)Gp(QE~!|fJJ0)CsBH&w ztg^E1x=Q|i6H6Yc>4x^3dB8xh$N^Es6QH^9@un4%lvPwnto{&MZ$INAlBa&qsm|?I z7pwnAffbl1L;}t~#x2vaz3}xp&0WNPhUlIG1sQhey*r`8ga~($k5?t}eHu#2&i_un zNJ(kQ3MQAYz|Wkcpx}^NRtp@bbu={tYX>&90l}t^8kh$R4VXD!-Iyh9!|vvwM@Af$ ziO+RWoez{iCEG%63$U^+L7L!XYz3>$^>DL|apYA6V1Of>D_k7AZXtldp(`q#r7o7x zg3mmL>U$|;XYX>kJ^n{|1J>lO0TYl(Muz6gilnGN{zG+%6%>er4)YG+c+rg0P0f73 z(L6^TCntZhz0-`ow%5o7yn>G|_*!~xu&;2d+Y^!1q2JG4j2)(r5)^Y+;7 zG$s&#?1<%XSSTuQ)P*-MS}z-EN|V+r44d0v&Y0Mv#R*Z%*sxtdB3Gnu#xE8*CuX>j zawehv&4Z`bn-jfto~Kq8#(~gRB0@&)`HW_PAGoqm!pOsu00{EbmS8sXNtrt1zpHeF z6ineqM#i0+|cYg&w6a_avJm-tEt;+PnMEATYh3NFYbaG1U7c+Ct+y~eG5!GSyX>Sn@G z%E#w)i{~M%2c)Er^9$G$m4{vqG5f2F(C#axzW`ceSDeZ8&F5ZniysSlu5i_Tbz`*& z+?I*&-ytSS;dPzNCIe4VP{=JdU(;p3?@i;{;faelI$&@auRzmizI(OQ)}sLl!KjJp zRBF`uiG5+=y!X#U(UG;69QDV9FIPX1;VCZFxa@WXyu`;h4heZrfi4wawKH5ecqWtX z1XiyV_6#bge-qM#xWuQ!l_rx10th5jzU?z7gZ7#BHVHNL2d2ZtFmFfw*BN+?j{X;J z!N6&kHQN=J9ZX#N!{gG3sxWkN`AO^fX(nhu@>x^7gLB^1#h;6~yZ5w(t2>ou<{7x1 zkL-949Io?(hbjJ^X@4jfhxIQVhEPzatEr(j?(;qr%wWgF)GIMl2Xi3)H}yZ3mQ2oM z7CCiv%$u9|knZhGIgtI0{aVrVUO=k-tPJ#NdBVf9i|rt<((HJ!rtHroie#s9^ya@s z5bEXC0-X`)Si_3Afr0{_Mu!pMECyW~E|>1K5F|tKd@VNCcU|3ZcK$stDoB1fOdog5 z6;+zy#BXkev%4V8$}w=&U`y)yUyDR+W72~gI&IJzgYW7dtZl!4FF89yM6b1$5V9RK zxqJrf3e)C$7O1Gj$GdUIaVURRJ{u-B_Taz|rzej4v?eV<Wa=mqC1Lvc!e%sD6yYy7H;r)Fzvwj z_r`S2&SHEG-;Wmc1nK&{wakH;BR$sP33no&1|zGRfb^pHwR!XEnR|V`n|?^@^*aIP z#19{>?Qc!*#_^B?)-7Gu!MJl#jzL9BYkIL%Rz!rAit1?dFzD|>ac*vQbL52ShrJ!) z_*ce9kLaOSv@xQb$^Klfw_tef#|~=+lBV1iQ@D~uy9A9OCT;l0kM?LOs_Y0#Dq59I zM;MZGrBtciI6l=CW%wUZ{tX2cKRerM_g|nq8v*k(CVErP>S|%zz5V%i@Zd~8@0^g0 zEn{`a+Z-xrP|1ru<~$X?x?E$S-gF)#BfHsgDl)QN9c(h{FuVdc$$xK-O$6@*W%b$ z!9&iHSIu_As+AHDzB#43h&VP#(ela_w=84sHjfh6C^<)<%@`F6SIDs z^nIA-vBzntG3NREcUVvmc1w`ig-!K;v2cq?+d%%YU=@y}Z?MNx>u=@B$)@cUM_bdQ zfKyLPE4$gHEl9>`v4R=XDdTRNFCC$2)*#2wJ61r>U;l5n{^)WT9~C_v6CL#YE93S> zOXZ=!1iNENPQdf)=m@mS<6{qWKbaP@MR}JOx6zV{EJ@>nWVE#ha-^@JsLa<#XiVFcpzn0Mz(d+=WbY!5a%1`rm@{u?c|Y@NGoe4$AJjIwcP3|+lb zY}^wgCzS!54RR1sr&FyM8Ad(d&4fiOt*l%(?)IVb)C=wf6$S6kHZnWsriHQbPzS}rp&*KX|HMUiwYT^^K8XV=WgqLoV6 zP*Q9_N3WMXQeU-Ha$LF~RNI_vYi+BPP7tsdK))*FGP1IEQ1?D@TcIHWP9J2MSO}PB zq?Sw9SF8IST4X=Y&U^XeKzgAaBR$yHUlO*(Zry2PbicmQ3=@DC(GT8=Zy#uxsHmWM z+gV>u$8jr{hJhh^X01f;f>zl3wu)XLx6@mwMAEy7*F?|8W2m@EmD0^0D3RS6 zkF!UHxy`mG&*w)Mi)-39$Ewx-HXArSN_@&Qv8>FXcKy|3@PKGSQC=mE#ct!zt@v7% zi%oTkMKTpebx0T)Spn#C$jQ2bt=s78ST zadsy;`OoI0jiRDabbL6ZTO{;kvQz= z3>&HJgJk9c7sn!4X(x_%sym%AipJA(s`@+{>=7@kbOth`bp03e`__6))O|fPPuF6J z32qG1$Jbidzm5F4P5=n&12*Q7ncBs+Vw;!`Rh_rh@$tSoG8}4_jpcqT!bQ;1MdRhi zTiks$TRg_O+Ayk_6r-;{7r~^Z$P}0n=7Y_Upl`@yoSQz`gK@{t6FRs&O7Q$~7!!~u zDlUOO#N{-Mc!rZiEl{=ino~tm=ya=KOCBRvJKbGX0o08+9TUsL8oW}d?;n|Isms^B z+{F4hP9D=4&#T+#A8BOXyGTcuDe?%lkeKtyf5#|YUD5SN|8~7=Ad`3>?}JIW?d?b= z>R4_&%@u269UY|>9kh_n)gIlaX3F2Cf0dnUmX&M9ZAI2MF!1ALF}(^T z()CCtIdyemsxYX!0D%Ykp<%6n=JUBhfu5O`cKaPI*`M(-jfOUf?;9$6V`B?;3>1wK zp;;H?DOZml&6pf$o7!b)wQoaEf;k@D2QTJwcHv6(($HbklEBU>Y|&>o^Ra4xzXB}V zL+=AfV7n4g=Lbap$r{xhzztnA2S|E@a}MJ61M8QFFM*j50N z2(+<|P`W6;bK4=Kqck7!I%-}_pAu`vH=t-O#!vu2V-gadu&~0%aipOrmH=mf7fn^F zX4l^hvtjQMek%ZC#~<(Pa-M2Da4G+PXo1RXu1|ssY(@($PD5r-gNb~5misFMYX~xw zEh~kua-SVST)g`>D(jR3cE)^EM_Y<0Q|`-x`SVjI_0qgDm&3;e7|()+zzbY)bvsC@d`e_6aQ` z@73@*%jf+c%k9R` z-Xc-N)KhEvo{xLAmD_%Qntbmx&Lq@hzDYiyqNdZdrbq+Fs;YErd3|>-;u^YmK=3HF2CMGJ$$Zx3kqD zW9SL9?W8@BX{OBXym(7CS>s{0menE)yeVJ`$8+5^rMH$#=Y7^ zJjO!*%96^6FhyV^`6#xj3DguT4k;x@SscH{l+rE)~L3s)16)^Y{{?ebhwW?X~n%T^z&L8;+eS~ zC(ne342Ge{DYe6|5>J%KPF|af#^_yYs=%1Li0gAFCi8=RePcBQ1R%*!@#;`|wPeNk zQ2w)ORYEMYQN;~JM|8nw85};Fix)2~DG+;X%s^FRq+`1A4sP*)(+S4xc$vA$)&zqg zQ~X$&efxi8E-G5@t1iZ(BjVj-&7x)41Mg^I*{dtK1{&j;2U2(!DJb>KQXVM zfw3^C7x`+g{v$jwO2mR#Dfk>+nw%=J(c)g$yG9#682bJAmeUVb>oL*0C@9cfgt?m^ zB{wvv{6F2zRQme;yQR5SP;Aaw{xQ77_96FnS**O4rZOdirpKMSTHb>L5}xeGjmK+k z?aeE0P3m~y*%_T8B3#7!Yk$>0Hz!E(v9$DU!~ftsnl6_Y*}3bl-3{O4Z>_7_3)ati zd5NN*l5$ zF%8p@@b&bo2Y)a1yu5n7PJx$~*GiX)iV7g64B&S0RNv;IybjS(m5zILiwVU0D_Ti2O_35$vTRb}qsk*dIPw4HB@_Q(~5 z1C9I@ChKg~rwf2QaKI5c?HpLG1xzc%CSjIgR+&?Rm}?9V}J}Hrq+0GA%Y%pQP9(CI3W8pMDx2DNJ|HL zdXCSvc7c~DzxCYGP(cbgc?#~mkAa=vw`W@8vQ>;0HFpX0C5|0HA5vl%A8lWl&R_1@WuZr6s8t4&5Q|Uaco5NgV;m7;tjuZ`?2ZAU z2&PcF@LewJn|@#r#jT~JL_tO6Jm1F79k(&{n$x)`>@!-#`QKi{HD1RpDFp>rs2g}k zq@rg?NPC`zr>dDxx{Hy8NJ*or|x9K#UD&TBnr~E0-NAM-P&o><+RaBA-lnq zSpM!E(e?LJ{n-M@q|?*WUY{8?D;}H2aaweNKPov{{9{f)a+(a}R0DfzvgSPuzCj!h za*?F8+v)~_+wfz^@xE&`mEc?jI|k1RVUvMD^j}T)7RhL^%ckC|6&Bbdc4IG3 z&xQmKD*LsJ6Jb`8#KreFe7=7n6a8g4GjDdvQ3 z?Mi#pu-3KyY-&;pin&rewlwf3%rH}TSTU`ty}Yp8U)hI72L=X)AQJp=vGJ`ykrd~r zPCK}sb?`uoN=hcGoJ=IzOe`!`?bmscNf{X#KfV9bi*ld8VRoCt{LD`z<@odz6_0ff zOt0PDYrN3z`|O?{W=Bb-MXFW;45_)XvB)Sz=eh#i)ORCkM!gbQZeE{7gOjyu-36R& zJ{Y=TE_fkf(Z2prBM9O0Mt_TG|*nRPnn7G1J9IFa!E$OnlsHz~XV z@Yy3q$k33GNS&O@d5Q8fGNMKvUzzd+&CC}lrU!j8CMKPO74_8pOix86!uo+Rl6Nv( z!pZTmLfr4=J?PZ?_=w8oCqw66|94;Cm+r+{m%|!-o+~FGxm|RO%TK<(glq=yzT)cY zs_5us9q39&|8QRH(x;CIxm|$Rq7?e85NVw0>-*ATQ>9=1P)1TUUkje&ce%%={aN$i z{}day8W}8KK7&aLS?yq`00XS$AKg#4TUAj^lTtC?pQ>vBs8=99I~nu$(iddquE%ZO zD3Ld>zpt)7pQ^h7S1W9nyj11pLd>_WYm`aBu&(=RB)zC87znuX@=TLePLpL;ZsaKn z+LILwugVzIRqRPw5WnMVYbSRXS-|Ro+{<=jte_*8ii!%%-!;BZRhE_Ez_vwO|4+#M~YE+p{Wio=+lO9aBz%Qp2qRwRRMmTDA-|9=54LJ+tAu2 z!&|VU#0uHoW-2uw2Y>0oE7vvL0HJ7nH)FA>F)fcNUd zIpgJ1cXTfK?M`B7*a8;IMX(c|<{_pEKmL^#4X>H6Uw59UaWe$W9zXvCFwyQI zm#54JfqAl_{=9+yyuRV0K73)YfG!v>Ap5He`zdHJat-rv4YQlR9PI9HZ%XBd=+)DL zlr(HA$+{E!Npa_5g!eh7c#I6{Qyk4KHs;Y?iDkA;#n3urX zhyuNExIf>E1vdaVwDOVCQc_2*?t=Anu+UlEAVwAsCpX8-G1?Y)f#3pWwIt!ynpKW| z4bvU*eEyvrU0{W2n(p3~xYPIo3Z~iZnOSWGRZ4VmDJj!xXFEE+I()eOi5xaonY9L; z^!qHV(QCZ`ezh|#dSucXD*oyKfzbZX+B-4A`Ru7dy;t3Byp!zwlatd^NFSj2={(!q z$!R`@4|&e|nJ}FUA-Am;8jN_rnp&DcA@yx2;LzVRq)|!ZcgOMg$fTp(JXR`(@`B6j zGhAmdA~Tw4R7-j43T@R za>j)2m#P3FkTuW1_*L#pg0_;JTvUR#o~~|mNJzt?y252nu9LYrqrLqAh(Q*XE)vZA zzJ4}nRX(;cel8@`aCUx9`{{TgCO?7C-}RC|5baNr&>ff4DK^6{aOLJOAA8Em`lqqc zc5f-f>oY80fZw0*E%!oRqNk@?l z?`r2;5Hs!bUafj)f-lInquDs?>)qK{b$+}Q*oAuFBRnw%1pNctNEqbgt46m3yF31Ft zV$7=S*AD@u$L+)##Z7DuvTI6FKBA*A+KT6Km>w%fAs4-`s<@TntfFNkn*@aptT6_4 zcPg(O?b@C0{{MnA=#o^E7PFq30={HwIEaDVG9oP0bRd_1gdZN+3SEvJ6g3HcoG zJbn5&H2vuGwAS(A<@uoinjjb;Kr8;@XcqQfn<%LTFXY+7jqzINeSAT1m{<(&CV9l1 z=<(*w^l;&#kf1xcR{$Pch3Es1aOB=)TKlW&CD9(A!?bR=P(72_Q>C%HyD}r=W&4MO z;^L;Za2}7-_0MhHE{Ltk|0II@L|9lnPL7=jxKZlotwGb(^LaY<7dR>0x+UDy)Z~T6 z9S1GECEMF!;_2AskC6}8n5R|iXV zTkcDQm>O3z5)jmQdza6gnsbbT^WwGM^h5SW76gJ2lz`_8bVcdu9X~Mun3ITgPMi7( z+zTK!idr3~C%8lVl9G~=cS0Z+#66OQQD7GV4fz)gN2<-`@h8!^7E~_sSr; z?h~FATf@{F1!V%#_pR&i{rr%zK;c+a^X*_)?|8MeyE}hyONzU1qF8XN9$cnDUq;CF z_dkKBTwuEj+isf7xgkrB=bb|srH3eQeh2AuMBn%Ogd>aQS|I;g4{1Zu3|q=5u!4nFC~6T&?~3$wH?9hTvCD3l*ycUSY5=MQO5!0~=(f z9;23fw;S5pvd&5=;DQhdnUs=LAP|ue?Dt8+@$w?&K)1YtL$J78&U~y!qc&Q2XSH#M zv){sCdpB>tZ$4+OgOvORG5D;0BwzjmVPWL=GaL}!J|X3$QqPw;vizhRCB z<6u>TvI$Oki870Thu&V;Nhdv#_hhz$^ZwVJ0dozlRH{UQBaYUQGlE8ENT_PQ6i2{d$8>EvOohg-hH)y$knivc|2Y&@jYgFi$n- zDZBNYWs+Q(?efl~$K@<+MJPD#kufon`>pd|zYjOtEOf|7NYvP^+Q)GpK<0tO0F?m- z9v;>sSLe>J#pr%s-HR?xP7rQpV`ay!Vd<)Q8rk$}2t+m5{Q>oY7yP_|oROPD5B~x6 zE1eKEm{ua>vb}v;T#r5{@l$ae^n2b383_&#-7#MsNEtc2aT1omuWMO@p(0n z01uBryJqK-x^i@CY3W(6bol43m8BltYL`1oMKj<>a80M+s4ufOhQkcTtWexsfB(#B zKc~cOywYy9!mzsrLILpB-c35=RZgo5o$6kn57ynh1e2nphf62Bz%IFk*kkN;HrNGj z%FB|wh|EhQrTUEXMMl#{TiG@BgrZe-3^o4vXB zU4*W8P;n)YhRe(sWq+)HBKoFa6iqs3?PO#`ux973OT!H9qv=+rL$vg*?3+sY>4(oS%lVzVzyy_?&^#E!nZviVmR}Gj1?Uf1!dQ6 zTev^i5rCon$|o%FPwL3P+fvEba+ zCKmIJ8Iv74jb+z1|4bN%68JQzl{#lfXAW=NP)8;WGYEJ))@J^DOUvu?-UB1ubXPOY z$mIn!hn^p5UY{L|EJS7THS%e?2ZoPgdfYbokQDb6DmIV(?3U%nq^{_tx|fH(0I<2h)Dwdmj}W9ow4beUA{Q)T{-A}N_;d7&X8A#JbsB`dG;HXP~A z2Fk3?C3OGv3dHf?uo`x~UH8#t#zptTG}JJHorH6LogiA{VD?ZzyJ~0ky|z6THrCp( zeNkE2V>UV=`Dwbxzq&ixuZ;zKRXoMBwLkUN)^Y|F`pBACWe;7EJuSnEWE%?Pc;OQ>awk zA+J^MNB*5a*Kpj+!xme?UvQJJL=4?}-}jYT@awyOBWpOsusYewImS4>xu<+5YtLRV)-sf?LCLnN9U-XU@p>gRLdCU7;I4 zae_rswvWk#47c?^ze&D24jj?Hc+ptnyl*g8M#9cQMKyNkL9(sFmdoiu19(CluBm0Z zslGNaE-^S35&V_$2IJ)Z0V==CnooF4Kd0J{snfK;m3F$&S4UHuklv!+d6EA9mPPZ%@iC6zFZiNlFUy1eXzKHO@`${z zs~WY_t>lq!pNvdhYoLF`d`pbsUq^%S;X@XFe)fuYlan5XU9si%U9mlJ+{K+8Ijter zrUYJidUHL)cp3yZZOiF3^OB#RM`m!rcV-?(%RrfrCL?{(-KCg7-)0agbw0Vp?|RlU z>JUB_e)su#4ZpSPWOk$D{D%bA5HZXIv_a}b0p)eYt@S@Cil^pn>TNmA>7Ng#t5GK- z8m1pxXgqPyA0j55(2VJhVzuZBXo7zD*N?XAAN7}s|71k1t^Lq;`u(=(jZkyWWYtQi zc5Bm0uKEec^Zd!t+RsQyj*a%qlRCuFW=VX!Dw% z)0^~gELHR|*DrA?T}8WG8}F_hxGb7KT`grix8hkbQaUQKXt{@s&;O>w_O@qFindF* zwsT+hsua>2<|r>;EP~8T(R7)pbLGjpPl2$G-jf8Q=@=R14%fZ=`mbL=R#4!7H9O&tBM!9JjOb~2T<|d^AV?K9zp!vs!8|yf_Nh)0aqCYDydO~@EAA8%7q_^c zo6pYbd>Bs_+1}Yv261q*Pl(T%w>hV$dKQ%OytjKOmq!(u6qTUtn}?$;lG7o7f7d`f zT4>0zyuPb#2b-YStcY}GHZ-5~uRAXA64b006X2AX4Rz}jV2;+}@n-pGTg;1bRIU|- zi&10`xQQY~b8L_92=Qn)(FT%)ehZGs}8C?H52L_tC6?vM}! zq#L9=q#KnIq!j6t?ha|CL%O@WyWuWCzyG`A{`Vb>;}{3_yPtm6nrp7PPS>qjEZ<0x zAZ}jP6YhSzvGKg3Vw9d<#>~NCbFwzzJ0tF+W_|7LRCO8yJ@w1si0N$qu>~GR_TfXo zs!GBP>$JP=t(SUF3yqKf>;MD@oAO)o^VbW+BAr75dk2>p%Q8As#JWoPBAv9eKITU z>Ti!;oxF1uxXj@%GVQJoto243z#aLJ?p^=TURbNeZTf4M-ZkIqux-Av zvdHn97fkzy9_Tn@j*Q~A#6J8}8$$Z;EH1}+KeuDSf-)%!8y$Im+p_P6eSHl@F@2}^ncJV0V%>rCt~uZG z6Ix2*t@~qx?v2NNuO-cj*(fRdIy;4O66EBR9%CuW$!TlpgoTCV3}`Kt^40Q@CHy<0TE_HM<2nepM$HY_MqV&{H&)&{dDF;d~ zB#7iV9H1%hK;?G=JO_>5bj$lB={7rymRwv(I&G~Ij5v?-K7A_5lBX4x)#zccU>O$KvfSXLlngfFT-b7lO8;R!Ky{jS8&Q+Jz<#|sNxO#cQc=H~YD zz}I?ONkR?%rj`B{;N4`;LO`FL$?DGM?jFCHyGj^LP- zQm{YTe!etSpAL7M1x<2X+{$RVPWK(M2VPLbY-3s8K~uA=xEP=Tf&da!X|1aha*>1gw+lIO2q)$xe6|1uRDJcw^cGlPArXFy zR^8v<*b+i7a31e+_+lQDkVLqnMv|ej+V5KFrD%ew9C_#P z^rSwVam~Y(O_K%(7F~MAONh_p8V*S9kZ)c22f|X7L6t0ry^&Xr+YV4#C)!yh-7o6z z+0^}v0!t*iVs^fRu*akLXSeWc+oTq*=g&<70>=0SD!qJ8x@ug9Ql;;Qz9}>sGDAXA zG%C6Ap$+B2l6&_qG?e+^z|9A@r^mLepBUGT}K)tnaHt0VV1nWTQ>fTyf*e zEA?Wf)(I)w(8t9}DoW`kVj`c<|ChF*p^{G_{C!W|Ozw?OSE1g}=}B{aQh}e?64{QD zoZRuImJmT_E0<411e92;19v%3HtPcoV}^36=o1X1(XyOW$JyCgU%V7( z5=2)I)+#v(ILgX#jo?%H?-x2-g*3dr@U=yizdh?qd;1I|Xu~5S!oF`akP7%mL@dtE zPA)Fe7|IdK$_8(CS!!PdXaJYsT4G0hXuJ7$oW!DPZd|wMG>WdRjU6d9~k#6H`&Bqj9gp@dX- zGn5CV4h?j`lmo#KKUkX(ZJW;)gWo29gO3xk*~mS6P^jNyw%Gl=wRNYt9<*cdm`uSZ z53QfFTO6GClRNd13}Q>uJrWM_A*_3D8TBZOxK9)DG;aG0rb69&w6bku2m{39r@ zfk>IFKj+!8d0Uj@^XFO0%HcYinjl8lyL`U-|8w<6!yoqXIkUElmQ(r`85tZbyS_IT z+Fj{Kn8)Gt=Xm>h{qNt2;&Gs*Ci7B(?$({<#pUIO85!HgA)4(RtDA^!?Tf?p0};C| z#@tMgkO#idlW!S{e(tV#-D=VB6>m|ylEi%c{LpV57@Z!wA)&A4<>pFM>_BWE1WQH5-`{2c*-AF+^y6Kc z_meg}4Ox{@?3Rlbd#k6$#+eZGA1*LJclnKsJRces#$qzcBOp+J17-H~3n*+h=4iUSQp>ef(AKG0?Sybm@S(yI{dWkA1NQ8#T=qX!lvF zy`zekcy1ZWAJ;fz#)tccg!l1Rvdm81R||EyvVli0x>i)3J#EXLFoY)wraK7DD5m@< z^9xK(Zu4S!o~IgiM`8BobNc6{E@5}17Tzc8GVL%*v*;eM=G@sSjcXi{y>=xG&sB(! zGtgIJHbvZrfUK0bn=$ELtTs~5Na`$wjJaI*v}8vd&kR~B9?#54f>~S>UDF;!s33kx z|Lysh^TA89y&?x$vT8a9$24~#!mXLf9`@rV$+M=n+yRTr>4$S90SjE`6c+1X!2LjC zEtaqOrDCBnR0g75QK zt&KKn=jqW+&dmuRgCq_Kh#!AH-R??^h=_p6F)JPhW)^U5jt&l5!{`I?awajMFfU-!6?v6WdAiaB75Uark#m;uG_L%^7D#*%M}=dy*aO z5*>LdlSnR$EBaA^JvOy6x09z jPwaLe)ZPBDHQ2vi8|W#T%@u*-GfJtJGI_abCV zMOV17_MVI;Wq&Kx>mI#BTgLcF{<2dbVaYL;^jekH>CgQ>=^294lkdlKxsUlfiYKLc za@wwt=S`F&biNrE;YS~O3E zhJ}U>4l2Mg78wZWGAe&o4B2|f^t(iQ#pdhgW z`HPmOwzh-wZ+T#`QQ7m0t?mGokfCfw)+h9{=y^RZXR6K2e{wLG;wG^%O9{{(7xs^QUsB)5bF za48BNQwLTD4%`cL32IYyjBnz2j)$iB>_Om|v3gZP#Z?O4gAc)KnwnCe;OJDElk-(B zU7a<-L7wNwpRawUOgzw92#8O74s@!O>Bxyq9*YzTmn~5Z+x|5bdh7ZP{i}2b#-azz z66JKuD+h#}`US+8>`L@{nH9syr!w^HvfJMOxymVo&CRBAs5ep4G|@TFrj}Joaj;5} zsGg3#IFph-hzC2tv-atkXd4YHtE{c?fk1i_lGuR{Sv8sCF?q7H&G)2PdhUc&nJF?y zwqV)Qcltan#6EXv-u*J=5d^GO@X2G>eBB9tWSH=K0P?56YLFa~lu!u|58pa)SkwnH z1_8TW#J9~uFdw3#qFnEO6?_%fF=K{9^y&rHeI5wekv#CirPF-}%LOA4(mn6;td5?r z)6jU~vT$-%g2>AgGEWd~egB@CmNt$hSSSJ9FnW4+mc#daCU^B$_rQR~!qT?2O;w#I zE1}$XXik5DiBuNbx8kMpjLgnQx)_^mONu$R$-eLyh37!L$>jN#F6I50)6~uTd4G7N z4z77_a?3as$T}H`k7f=BPP*mC%65AZpkt1>U>eD8rAux3r)@iy9iwRA1Xc{{$`N!O zKaK4y0-+^eY1<}3PjW52#^x4G-G@pG_bB52cFfH zK?Y0^FQQ~0DaG1~w~j$$^sKB-+S+J90PE7D!-e4dz@P#ETR<~qi3IZ^o8;ovfW~pN0X(#$v$HwVV#C_9NG(umoAN6LKE!je@O^pYO_&=G5TNeXgZ(y#M~)JCmC(qR0zlm8w82 z#QX}_Xp8nOx5pe~3LUos8sobbjD|`M4@)Q&1TN?g|D=XsI`DOvfYfGULP<(W%F}SPr`P@3wP|@}1<0LX zpr`smB>CMlFbd!&&>d)=@2lN;k+=VXP;iU*3E5$BWcQfuCYHqye>h4a+ei$ceN9-EGiVbP@v`9!pG5?)u zH7CxeLdo+FXP>jPOM#XLs>&7Sq~Gs$mRci-;^p%azkU^mC>kM?DHl*pt=CQ~^tyts zTsy33K!Ty%Eu)CPTFA)w_-Xfmi(e%N4 z#aOKzePu9D_7|J)0qyh_(MXA9B!kgyqIlUX zM2?)pV)uebc%dm19wDL0N3M6qqK-&H#I6v47YU#@VGntx^9B#ktmR6{RRf^TauqlpYJ#q)j**cvu&`k+L`0geL$->7oLsvu zU9B{@Cp7nM0BIq66VR9s0*5HKZ@+l?64OxvG9~3+Fi=zf$OPosrmW3Aj06Hrc&`&^ z^he}(s;V`Bx%a1~xxz%>=D4edWVBE;82n9Rs5;RYk-)7n>{(OhPF2J z%vT22z_W1JAUo4K_f$T#CL}pOc4cB2)Eny=DZM8uY6Y?HWGi%@AG(Lz^q^RFwCC)n z4`%-PGv7Yj0yz>YvbYTIxU4zGcnEI+uhHUQGv#m|2ceI7+=&W*b!U7aZ{KP~VLm<$ z^i?QT*m4G2G}JMIDaUrV+P*wu%*+aKxOg1`@qop0vt9GKJUY7U$&7!bqutgu#XmAaj!y-cNBDB0sMsDBWd>%}>3X#ayCoW;;QHk`j}VJqoV`=Y>(MF}LiN+m$i*cK4CPD( zdfp?tzm1ae@)7a&5=y4~(;u?4uJ%33%+w-ZF;~-!oBM0jA<~CIgrwcM<16yT+k0=_ z6c{QByXM>TGf-7sx@5Ch2+|;Q``h*Q*DDle&tIt}C-13AQ~V?E?MG2kSKXrxh(*Pu zf@MeYG(m<%Bk7B9If!E{P@?MScyvm5o*p70T>i3c2hUN5G6nqsPr)Y~&Kv+1E&h3J zwl#YK=lAx~T$_go)b#(0vF4a5VGes#E2uox$v%dp){8ZMP_+Ikaxvuk@NUbdhI05Yh*frPgFW9ENeMMF#5*wWJX#B9F(*KEt9Mfy-k^iNE1 z>|VMHm&@PAbvj+){1~&oIzlQP833gvkW9v$9@0GF3jgu9lc_cRA(ordH$@&xN{rUl zEm}8;JbILNa@4kHiHx9na9MwyU(eZHm0oo1i|4`C=}ChdO1%Ls#buYc=*w)r!m&V( z3LFV$XO34{q4_3b+5p!A(<&D@U@|J`Cr+erfwa_X;)$ z3zjw1(`$Vh7W#++)c1WN4!1yF@DZsp$Dzu z(dIO*g79c|d;9TUt8Wq$$?sAso#!vz=pi`YckpoW0$q5x#8QzDiekv|$LM_8?-s;7P`)S((Ivcf}&LgYl9aSAybEzHt&IK=$o59{F1Bk z_sImnQ(07mO2w*9#qkHv5O16HSe^qqj`+avm{=9q@5xqM=5wp*a@5k*kmzIW;ZBgb zdyc7}KR~QKI+$Al%GJcgJwi^W?M;0~t)_Su%f-7q{C)&|aRPglr-$T^CtvqvM(WWW z0>dBm5rbUOs>cl!tPb6LxTfAlMzGtTLZK!o*l`E-omCQE0bAchlwl< z=((L;iFDQq9Npk0L`34#-x@7k*+=L6lRCop9U;M7j$hj0rNTxdtygT{-PLZMw{WCl~%xpe;0+@~G{d)9=?VKbeRs*@1fS!p& zHN`b+N_^zX25virG7B)ns3}%!C#ox-Awi+AOqG*sM4FQ|8?OExag~c>W2$HM7zq8V zt?TEUit_uOLSW%47U(OK&w`c;0mGZPo}<+Z*yaV$aVeTSUOGSZI=lK4he00!-wcDPj#;lv# zkn;T&5%C6D9`blC3qTq6E@T}jCP?}C$amk+nY-!gFBVPnrv*3?z@x{!?M6Z21Koe{ z+j40zOR>oL^f<@oQD0Uk?8c#sxDmn*8|NT*5M|%Z-QDkDhgd*Ev@-`p5#BNk{j|IG z_X3pi=0}EfyKYR1U`27Icki;GkyTZz95(BwtHUO@h|G!|&Q4Fj^8*g4@j&hjus|m# zRgw*XFON(l9ONL7be4xJJ5nOr(;QMuBT+&2;I_vd97x7-^Y>@{_^}*wsK`h$B2c;@ z>@lL7=i-+7Fv`bYhmM2s*2f*HIv^e980Cix&N*l%hG+$oXN#O2Uus2S7bid>gwN@HC9tscfPiO@a}pSoH0Hs7jEp^ZjZl)9Pa45+-!wb zn=$Kk@Qlzg1LfzxhO9*j??;T<4gSAzaBw`(&n8z^w2X~~jCAsRij_pw)N)ev+@#+i zl27JwYtCCBrK&Ipvh|RkspwM}OzCms#!mYav*sXGI;FXDDjGaoybwaArp`IqUE#E) z=^q^(t*+(`km)XQJUMda3)}#36*M#@B+P__npTFajUgfRF7jxl7_lpu&tZ4XAlEb` zB&55$2v#Mj>vDe%)WJ{$>>UX0yf!wk4o<`A4Z@BO2B@9LL_pRC*vw{qT+QxKU?!W_!%0xkMmfRd8lvE~2u1KC7P$2?9$+T8 zc~CBoo(S-gUPYvW4hb<;w(!xeQR*NS9o;c_89>@jK_`Fyd}YjeHbe2KpyA%>Jq(&G zgFZ~d!h|39FIP9!!%%Ofk_W|3C+c3lF~! z=^Qyq6jP>5-5KD*^Yin2r2!DfS^1$>{XLT*J?~%du)B|dT-%sJJMT;yzoE62mO)!h zT@10J{QsdY6uWO+GIzI^2J+6W*&bb+1&R4zA4kYhhw|pOhl}IV0?%2B@NhwGNE_*l z-FrOW(;T}~?Ug7zQg_AYj-NN#yWRyV#Z1~&?vJ6NDTk2gSJT;xkgyKhhOeT$AR`g$)f74<%b3Z$bZiabh22W1P8;|1l)I4oxHUe2HS;PXJL z1oKJaZOHQbp*_p$U;|;0a>j;sM9k9*Q;o|HVh9t!67zAlUgN-_c@oo^&2BFWUVgqp z%D=-S84g}xgs019Ws2Ixb$pgnidCZuZdRju$bwUp`ctVeTyZKrUCG584Kc`dxjdiI zY$kXJ1kP=}Aj23f-bxn67TZzVTLZPKup+~OS6{CGdv{FN0!&27l3(3asQyE;K%u7? zo~!PexWIn^ivqm2M`TwJ$pn{;RRxL>heLzmV0UpUYL@C*oXMDRp!>>zx!vKmT2ISg zqb+7u*Qql~itN5;jh(1Kd%(kZXBpc_4wp$lgWeg>x8?v)0rFEFLXzofsmIeSC0UU`fv1`hFk~monsNZ(kw!1VZ!4 z#l+BUHC&eS5ACb-@s)3{o2KcfC5fqar^(ijMrCmTA5oIgc)9B_>&3J{#CqPMYVM20 z(A+{-@KAxl#8j8U6c&qUOzL89!C3KDe3}6-nuk&U8w3zGFR0<$PszxB;NGY-=yO`@ z%lg)Job}Y=S$;jn83A#AJus16}nYr&A2pzcthi zC7}9#|7N7SGn%dD)Ewlq6Y({X#md5DAomtgJVS&9G6M7O$p!_5K=~Aw4x2Mayg{Fp z{#6JsLYwiJvOTQ+O-*+)6#9YsSyI*Sa(>4D?Ehu3|9oo?6#oDj)@_UGatGN_sY@q& zI~G@GpYK%-gYmMVk>@=*Yr%q8r@ZX#YHjUPxL<#Pil#jXsA={_8ef9)tNY|gGDh3|562T~=0L9#X)prLUeH4+VR?4mahzB*zY2g^9Q2|9KUHYD`w{A2Zu{4(u)(Tzpbl|CCZ;7bJ-NuMe;M_K;Zt;3!jHp zFMH!ur*%)ywjhN?j51oU>i*AnQ9*T&J^;v2T|iI1ufTv+QZh3tAhiPgePkk99W>{| z?HfeXi#?^Do+(rH=u*W}0$C~n!7syyi}Oe=>6d@8idS^^cPH27xu0DZck&eBMY~vm z2!-bqSP)~k-kL>C>t38~IfCT1xA#AE{iS=2=gp44OKV(k{O*AsXJnWT0Ldcrb0b)K z;=(3Ca`LRDY5Magr?612@-(K%nw*ox1!TSK4EkR<8QkSQR^)pVBF>b#;Fp9WPExY6tog3+{Fv{}K)Qys+b;g;;yVzCn^fwrDt+-s=3>d=q6aFS~^W`GNyBfNMYy7McDE91y&`=mwF0@5~QG2?>seD@FCV zSjUiBR_~k9=PY5@m;FPs+zt((LLd(n70t1-3~n4?H4n1WS*RdXaW8L*;MlnPB^Ddq zY^N(j=wK=;bSWml%?BxYvMf#i({uoGA9|C$$P0`*^=vDGLvexjc{!`OcG?d~#J<=s z+;fjFM)>PjxGPdk-N)cnSFf_9++wm^JdELHxBU7)?UaXW&18&!YhR;2lg;5_Mw>Tc zy!kTmasCZt+sDOaq&%110ud&^?gz)M7Yb3iaT^I-L z)en?N7cd?o($gz-aKUk6f*KNq*`oCLuIRLlsuZm%;%oiI4&DjAA)#ettjx}qt5$8Y zT3!Be77r)N$IB(Cld7-|#d2%`up_UaPgE&q0W#G88HHc15d*OYWl&Q60B(vNbAH6S z+vP28!AlbGI-wJ|IC>8$v4SBd&|-OBMf?{4brq*2!K)bO2Nyh4*^t==9AQ)!TeduW zR?!7!V#GerrMXga4|C^R3qvm($BP$LV`E9N=PAn2Sw&bcam$yVN8DMf@l1pC1>Bom zy7?~^v2MAAVIf}`ue@_Xqigq>pLd1e9K9bp%9r`ka!022d=kJ$8l;>LbZB7I~$pkbIr@R+-9RFCT6vy`Jdq- zv%i#;U++gB*%@$G0)`uI&+X8A2nV9e6^{=zzJ-a2L|X?q3o4!6wro{O9(Y~o1wc0( zY&SP=Q>Yw^Z0(Ci4z`9+D@Ee~5%22d7<`;-yFWZaAKA7AQs+>fE{@+)dKB{6%g@C@ z9_3kt{dYMMA13IHl{lX@sBYO5D-k>jPyXMX;Igpb87j=gz3Jf&=AO#Lf+IHNQVt{cHlR;LNw-E}~ns;+u` zeBvlI`T#%josQ1R@^W(5KXXw3%fS{Ske2ibI8EQ7e@%WBjq_1vv|MbZcgVaxO2n#g z_sYmo#VPrLp61UV0f+TR+eLoSY}pe-kjhG-%*tvi_bY-=a@vg9QnDsbU^EJ!ZKRx1 zl@t46_spUXihC<|s^8!1HgE6vfV^dH%iBl9!Xm#QCr83|X{K4t@zA0}&+2kO5CxF@ zY9%9+>Ee>%z7cXGDM+!{N_=sMaZYq}d7>|T5VAA_uU%5&&iW2yB~rfs-sjw1Wlc{> z^Sid+_->6T=EHxvuddvm1+q2DuE=-Vs4gvFT4_umyw z@|YI`YENCcMmZ!( zwz;hXb)Q(L0rTOSpS0mEquDcQv~wpn(I2v?9Y6T}gPxo*?4h;FmQ$Q#G==r*8LjcQ zYu(s2-TPD*Mr9Z|&1PVlffx=er!5A9VaW7?qnq2)#>NF7g`vMYJH~Ni>*#mCTra&D zG7<1$&j>J}+J&L85Ag9A> z-a1Kn=g$KBQCQYk{-?W>XY;Mu;@~Y3F6$?0yaSrO!Jih^zA^_T)ISTfv(ByFKHq2* zL_}H`$1?IQ8FI4wBJ=jY4DT^Zbb>0c(O8M9u;dbB<%zln896yJ5&N=z;{*ve`R|Ln zP&YF-!RaJ!i17Afgf-6=(KQ- zx^%k@`Usph8@ZV0J|zkYd6K$%iS*ZNG7^T+es6r zqqAbmnP7IO1ss#nxj76TCOoSL#IgC_1@=c1pBvgG=X?)1OU^$gNz!_3+qP$DHB<0q zZ|Tv>?UpjO+HJ4Jiz2<#&OO6FH@2(XMqc9oGeJ?Aolk>u za(=tsif-r!St9kBCLA-g8zS4g$}B|j!a8{+9>!y(QBfPSedYB!B8ptd)a{H)rSA{o zlJ)|=L82S6yU$|hfK>jO=NQGVm09HWKt8#%>O+p@E|XpdG33TSPJ2UZNAd~j0%EJL z@m}s&(hzBW@R)13rx8RU_f%M$UD=VFU1FVzgQ&19_C@7?lvBzIN^IusABbLBn8XyQ zy*_7j>IQ*p;DS`zbTMxe)knf?+taV*DxE~b!WLhK{X1KY76!UtX%yrnHM~Tl`;zHP zKop<W&xPAk$yUE$Q}0M4nGD;|7!PL$iT=Hk+Y4=Mi+yls z29hP64i|JyO}`IgaCgbe$=%~o;rHlcmjc~kWN{gpdu;Jj)yjKFGB|kr(g*^NEeZes$#e_M6%t8Hc;Dy7kxcCM@J;~^= z!TS%7R((5P=I}(xLnJ=rt0T#)K1Ek=Mhn!O1Ht ztBCDBcUMYs^6~yi)IoEiol~dIh-^6OHtHH@ndQu3Z9~j-P8_Mj(Mf6sr?Vm`2FQpP z8qJY(QD~3y@~?8{6Tdv!(V43FtPOdFx_Ww*ZOwY?JUc$SZ1asjH0)vR`){(m{#m1| zTrYYY8y~+tzM-sb*u9?&>BcM`qJ)v(FRWNC_nAW--JYHv zv8%^tKP@^ts}_@5?Co|<9ZpC>@ACY3yI6YNji;lxGl)q+4~LwT(O~w|Erl=z+QdKM z)LK#d#jZTa%=<$WFev4C5wb7Jncg2ub?~ND%JU#ouc#O5t_Cm3m;`N&TxE`3KXBmF zIp3RJUVqx#Evr4w(&zs};CBS88Y@;fDEJY`pza2&2 zspBV6UwI*O%T1`Kw-d|g#j`(*bo1S=X@YneKYv2;$fG!0Te`7~5u&xpG2?ZU8n(e8 z%c(jx)iKEyyy?;Mz|m3c?|}tc^TOF4=ezhK8VoK><)#uvwUyA=zk;WW5r{ zZ(9J){KfNu0WxV^Y;E~`SZ21`1j?LMpTRD;y1j$CD075N#KKadzQfET*p=$IL-diCdexsLTt*sJhSN`HhgO3?Xfu=jw zAgH=4iA8zJ6Xl7B8M#Cy!k)3PsMLKL%hREBzmsBZH#Xl9GWz%Iz;9R`QI$;bQFNlD zr;m&MGzAN)=q;kX;_rbO3r-(4Hj=!ZkZPOxwr*RH?_V>x-RgZY8%0rxc#@QqDX97g z82_&?jLpuDPfxF^iWPQY-`ey7C=DO4q>p`joO|8%7BTKo3jg0xv4Zfbj!qjxrrq3l zyJLU0lbP^!#0r5^<@vXW{C@XjclBkLT@)w*^1A;NX0tfj&4Y3$g% z>Xw@z{qo%b;|f>lWo9ZJuFKc<(xUPg?ANY7ev&zNFv*u*U@7b9h|l~#E$Hg*mV#QS zHB%e7mgf@YGBQ!aJdUnp1A#M`Ga?+3z!wyf2TrXeI{XW!MT>Bs1(Xd)mypp=<&+S# zO>FnQykLB=&a-_c+us$Xr|-?o1VU9XOLQnI!G3;W!ZZI97#BiGU5_kpL&@a=eF1rS zH~1z)EJtRI_%#nzjtDk;ivd~leTRzWq_N^NKeuw@rlt52j~C09=y;<5(w(^^tL;n$|RALNb>MaVG%w3N4{w`HI;G`$3*o5rv;7moW1woW{D^;>}|pqyv6QZ?(1czKySr5n-ReTSI%nvqe6xF5Ecp&i}e#4nW3;Y;e3D@!IR*W>@Y1u($4TXoKmXVS8Ui--rHwTByOu#?W1Ya&ky(B5gwXH#@ zUX$eHU{3kq$)Vt@SMIh4KXI+3aTi#hh2aqCD*bdQ@d?;))g!*qQ)*J7sJCROu9n5B zvw>Z_X8u!Y)%|6fQG~ZoX$l(ds>5#8`;N`g)B+T+jFnd`f*k3S;^Tj=V%oBeW(n-} zGvPe4l3pCCJX+v%3Rc0tBGot(uy(bst7~MUIdmIKsU~g3drnT7 z_nxNkJ=!R|UM_*PcYEEe`TQ8d4H^y$rd~b05e8;{LsP}usnE%@twj)O0 z)*G=lxZDc!0S^q z_0QwkpWlI<$wXdpxV0WjjYHyyU?dFvN#@KAbx{cfjO}!?`C~erSWf zQG7H$n`-$5EGxfF9MXqfHSx_~uO(%Tl{jo{4t(!>eaiUBt?T-Y-P2shxr&UgiV*f+ z)mw)d&2Ux5zLE{2wv4KAeV+1~qvD!KX~@c$EuGiB_si2+n1PrcyO9l!(NhPnqjNWN z1Dku9_sohd*Gw!eQ5Sx{a&tvWtPriRoM|jekUT9ptf$HnLna#5H+JGyk?!%ZQ^71E ztNbs^OOd|DeE)6RJ+Wxc;mWONM6ZCE-cCd{y-=iTB4Qi4z4VpcS%taCVI%DLQ<-pZ zo0rOGo*xdy(@O{DLG0*Go#o*zo3#ep+jo$OW-zrtb9sq@LbdYH9urd<=|}~~q|0?j zoFh6~)n8VjPJemj6aOXhj!Q~Lrq&!ZgK7l|q3YE)Z`n&89U=MQF$;2ZT%0;U{qX?O zuk+bBp|es)avtP09v?gTE5fAAjfCGKIy*jS_|xsM>55}}u+~MZa-WC)&e3+2YSR4x zm3urAs-*XMZra%R;!$fae3Jfje@(?%G(m!VAaImdz|Mx*mGAnkCH+Uer|)#SGzO=c z4JwrF7Kd}d%5}Fv!&b@3PJVYj86<7YX5(~3n(!CCt5`ae1X)?1K>D1Ur(uVaa8O~W zExaJUEOyyXn6$`v(00Cm6eeP*FA8;WjSo4L%1OxO_p8WK)3Sgc9Uq*c?sJA)ZSVgc z8A4l_pYOE}Hq2NlRU9buzWs=GaqH~Pq;*eY4m!~jI<|H2#DXbRs%Nv~G*rAITj#cr zZ0_{7x986fiWs`GbDlA1O}=^V%;i(A-2P1Nf>4DEGN!e?y%O^BukDJ8Ow4V{aLLKR z<$_CxO5wSl~`e!sWINsTj4{=8{P*bZf|^-XZ= z`97c#oE{Mv5dKov+uMoS@VkBRDlUNv+PMhha0#gs!!8PsAdf_Zt_DvhIViYQwju}B z=P!*gle5yYPl-6n`Z?ClYwBtm7*X0V{Q`b9)B+<3yZ0j@rKe5g7@H*bI{6E-{iVT! zg@CzE-TV%Y3RnN3y-eY9v2Q8KskbXkS5{8Rh}`e08xQU@e58#%!)LdVG5i#lJi#j< zRQXE71e@-*_IaPUh+py5mj0wG`=|=Rg=Fz4%OPG~9Cmw!rFq>Z(tkJY(K~JJT#JS8 zBoQ_F}a;rdU|_<0)ugIaD~@;8{41lzyGsfUSDzaekJngjIH>QT8zp5 zLAO|X$$%1@V|9vb^p9wvQN@lw`Q+f?owe!23@i)rG<-WCulEUkX4w6ta5zI3sOsUCXf>G+vshgUkUGmgDT9&$Q2O3-_^ z{^BS9$!6}0g-v($=M4|z;ds9~c%na+ER_oLiGTJea9PNb-tsv+eK&oD(x#=e-|x{l zcH@yFMG=wm^fJS>w#wq-U1C>VUBOHRKI+HFL<}P<*U@i0>b^C*m{2B)J5DVZZar3b!9*tz*fs<41(#h*Q7sX!WJ2YIQzwR8gn;jmP>s$i{)=Y`QoO zyn+;yZ<1qAQ20^4AUg#FrN(8Dhj2V&N{jhVjETlah@70#V4Z(pVEdhG1(p#A$9>W# zj1+CN2`8CR(wJ&B>6GMDDxp%{-+p9S8Y6y*@yYjech}V>FtHB3UJDA`iK z;^TGO%EF=wozvktV3C*4N;SAg?xO3HAZPSuW4ay+ zu%D`lKl%8)sX1grw*yRMRK5!-^$8^UfkKvMtuWAfG&dd%^(2kdZZ|rKR0C zappW&3K8S9$5-rpy*;*uo(Uj2FV8AGE|x4E!{g~>Na;3k5qgDijSIlYEL)X zNk`-S_VM?j;VgqCma>nZy6*c%{aovdZj0Ch$Rhvfm)Ix%FPS6p!xXwC%M<5DS*|)2 z1{+%h?lKl09=oo;@W}4bo(sQk%|E~w!GkPcV&V0Dr9B?`wpVKAY$K6)Y0CI=f-_Byg_P>rZODK*&WLbxsvs?l~P9g z!=E*E)D#?>JORdE>Atc{!pN&G-8&oK{^Z&fd#XRT}Mhp)&ODLJtLz2g*;@ zBXGWmMzS)zKTKlXHU9B7WoAYTY6b-c8||NxPdJ|qS4_?hu1$Xx{u9!WVqS;8!AiA| zr&n5p|JZfg%(TRAf`CY~3thD>_Xw-4awlTSkp(>2I3$Jy~E}=6UjYgduIk}#q zj!V_SQP#%hV0vn55;)oy&wm4TK1dFZeqUG^T!+TLlM+8`q%x5&4Q z-+oR((b?IF6)7hpqXM+i>%vO8a!(f*aeK=2jim!KGgY|NDiYm;z_jZB56qLQlewQt z#^UdP@dqgxUkH&|ZLPggAE9j&b#8DAsv`>pl<|KgM{`{{jy zF8xP-lUS`MRlf7+0anoT3}$b}E=2mZG^b-Ogyqiv!gQ&Z*3mKYpTCs)#yjpgtyCC%D%xQ#*$0UDMHcw`1D+Ukc%WRFyhajJu9oA&Qg#dMZ1&kW(M8Cuhr8{uB{`1_*Em(14O>;B@y8b zz-Wsyn>E*O@}m(97a1Q-)vJw;%C()dx#1aCm6u-wCS7;FxgWuZ`n&&Zt?3Z+As1)$ z2lv45-?6ZRt(LS&$`#+f?T+EbU|0tM0KAK6)A`56>+0MU6mUg2%5%SU#lAPSAeu)pq#y_sYNsgJGj0xIRB96NbvlD8mZjX+S1rKRT!Ru}2{5TNkCPp)oPr`=vhZN0;8FXRrEg6#0RHgN==pBI6qti}7hGDQfEKf@Dt( zk*^|JE@wMN?GFE^yu9*lj^DpAdbg%GY`D3_L2z*M%|GXr0?H^rdGG{K4~gddu_6ob zPbAC2t%~H#%+}UcF;P);RIPP={RfdK;~IZazyBz+J~wADfaf{-l8VZ#{l5(yCqF_B zyT9(s2TkB%R<*y)(wl?g1ncA6royE9)D9fcjc-7L*xkqHMsyo?As9t1p|mQ(X&nK$ zSGZU%7DvpLT*Gl}jH>l@)7Xw0=X{&(XBPYGr~jw1D#bsUfEYj|i-O!bEj9J=;S%!~Y%v)Ni4T5vch9N4A8t}T zM8!V-^y$f)HF7d_*omb-nHp&SS!nh$cN_+qM1uTxdUVW#r^G7p2KuzCyKwh+x_I zY0bIS)t_cFcUVh}F^-lN7A%$$EysTqiKtXQK;XJwAhCi0p`qb{J1U1_(_g=4;o+6Q zV(=>9biymK+c9KD`fHT^KXknZIM@I82CQXNHYq}q>?A8AM93z47qUn89z`S>k-hic zD}*F_?@jjJdq3wxeSgn&{h#M^b#;A5`Mlq+dCq;#ecyUHhue8;oi*u=DL^OG1u5A& zzde&qserdSvvqaJz~HE|4{Fk}P*rmn99HqY!}PnUDYM$bbd;m(I@%?Urx!bz5Scs= zPJ{)g%U38e=MHv_f$;{=&NtnE;G*>x5s*aaV?D4`=#P$z`*KTsn-nTHW@gl3VQX$5 z;=x}RF?dlc(7vaoqeEBaeVMoW0{-a&=>8@Noq7u{E*>6>!>(;!-TBc}Zy$XzU`SnJ zF_ouK?12)A_|yK;(azD)ylXYNgOLLR-xP9QL7jSX@>OP5`R=m*Xo+ci7*qYi(o*4{ zk4Uk#7l>FFgs!ymE&g2-y%{~~6-L|Jg|$PZJQ&beT@l%hI3dBqMv59QJznM|Z&Du> z^#*dy#aiSoUEnYaACsRBHFYJUV<*x?~ZS();y!>iW>IG$P(7&`9I^ma&rK)F;K0y~Xu zrDjktscX_UPmJg5?VOF<$cVlke~w#9w;#dhzJf<5V@5)Nu=&>DZnxFP=Pm9oG!hmLy${QMQdfsS|Y zX7=_*aC7FecimZwiP55&?pp6`7NL={yn5{dIa;iJ{lM`sE#(^qkoA}eds|vwWS*R! z#0FB9G_wEOX5|ET?$l4nf;K~(eo91GSkH+9dx%O@_#rF2nTbhtbBNj6*v!zN($KI9 z`rQHDu^;W_mW&2oe_G??gxbX$o5dStEV1_W!gjwEzwQ-6J3qfu2?E0k-_+cvCg$Ud zN4Ysq-q-N@0kmFMA^Dce= zSQ*@W9!7#L(>>GGRSCFBBA9+bcNG|yYQLr6WZ78(F?N|(Pt47)!zxo&v9WqLzq&G- z<6yHD+&uh*m3uyA9u6`$KZ?5Fx4*5w-x0TJeqJs!mIZWi zd!axf``CQ?C21c2Fw}0|Jq0}?ljTrQD`wJpNg{I#NFZ>TJhR&j`TJZSnp6`c(z3F| zMVmz=+wHez)$Hx9m6d0kf`(yN!DHFmJ_Qy@-LH7>kE18FY8`E*j}YKzEU+g z*#!bBD4wgDEA7z&bgEB<+x``6xRGmXlfVv6so2QCiP-i>cuNZiXB-z6+UV;m>FbA? zj?Y>y=>Tik;O$#h>t%nF(Uvbh=*ny?NPnwuuG*cQXt0d@yTDVy{txfQ4i`DO#^A6` zcaLm{1>%U%Ljlt)==9m<<|2`t><^^NWg3)%j5V`k(=3 z#lt1+aBeU$SzJ3~prQi854evQXlp-y_c{i4x0m>zjI1n>gIoA+#*e>!6Dd~wr(^|u z%{?W^y^4)#lPpou-h3hEe37{^SOCs!Cg$fw1LM)wh!XG-0nw1C$h)9L4P-Ov5=r1S z$BcVTPva32N0IS!0e3npJ)IAsW~tkL`t{ql#N_1J<>f+3q77LQai$o$LW4<3__*t+ccp;=A^svTtZ$P`rwu zl=>%^h3}m@y-`<>`*XIs>I)=49IoZTf^vv}!os{tONBxDy|v|wxY*4kKLF_gf-kdP z87VJuGJJLgNzdXU0YwAPG>7fnfK4x3lAPI@=I<-R3SLD#4!6kO5|wamlo+KiIkZSDltQPW(!msHt$+ zwM4ynlf!Wz)kkn^1bT_DzYH9InX1NTL;XoT@si}uty!^ zv{?m5BelXBAEFXaR4h5uHZc(dwFCCkQ_Q)RFpJ6G)O-zVRiyaGFD9n8pl>%d^<^&a z{OYKK_vgG9*$-V`hyMLy(8cQtzXn`N8r>)IwG|&M& zkH|>X+R>Y^5tjBLDr%qGfc=2@eAIw)sH_}VU@WH7Knvj%Xy2Hy_$kQ9%S$UY!qXVB z3ax)ED>H!I4g+`oD=9g-thm@CI9PCRb+)&c3jigFsBI_{!L2vHpue=V1V!IZ$omtX z;~p40@2pJ@kAJ}Zq%tXi#LIc1!1@x4uql+qF!CD)8Cja!E@(Z@OBg(294Gi495R0Y#+);Mn(2np9}#BN)@09cI8uxJz}<3fY-eYwr0eL@ zOvqRumZtG2v?>^nT0_yKt824t1;RtH*0CBEF#UGh%BrYI#Cp^kEZaX{M_ak9$tLw} zel+mJ+#QRBMUFK>X57mi3#gcji}pP6w1<4@qKDmI%`@KK)d_VEFQN1=&Mn_+sm?G-j`jTv;5-m&Zh@LDl{)3wA@B8jR{KMwM z!43TUSrO)+BuB6#`rEh6tgNiKI11Z=tOz;qZ&Ouu1nM3*eMP9%>L{RTSb?vOyMG|1 zq{Y*_AOIjIhkh#ql7MKeO;EcaV7PxZxwmpSMz!eR7qn0JVD_7>fY%zC z)i~CobA4|`_CSW(^03Hq+<fOsykVKkl5!2^k z`ed+<;r(@=SV7~*p*k1Nco#+G&BY^X>B+tP-&GdnHf$~@hf#`Jqaos>{ko%7eM^r<>s5H;vKCh-@X9qPG=`>l6D8U42edh45U!U9AC4K%Jke`qE_4#u?{2m?6 z8Y2mjZ*Pz6&W_bp4LyT&SOfa-yS~1jA)CE&X<#6+hJV5xpgw`w-UG<^bbPNMt>B%P zA@5xZ40~{r0Bo`^__R8oShyW_HG9*;%zgWYpqw4nk_hei(COc~P#7Lgh=O7W3tOgJ zVzfMBX+a;5LCB)fPA7yCq_4q=^O5iCJ|=7DZk@B*_)~P8CAygrPfSocwsi{+k5=?7 zOKG?r%g!D#GWH=vZ}TG|S6($^1a4ZGTXVd?qt4^!$`fA9bK89`YDGOtIGoK1dHR&a zn^N?tc_D@$Z8vS%lTs9L`IwpEEsM~|-1Wd?5Pa6>mkepCI}HtNKUfp`q-SPspK-t7 z=l8*i&(5aXmufy6rglet^qbrrh^xT=0ODJ_Xu$>Y;o3%euA?F*Z zyY|7IH0he+9-Fr}PBXhWTzHE2G0i`(Q1`dBo;@@$Iuopj4DTK&3`TZqJeBkl+`(R= z-sjss%dc`kT|aOaOn60wM-#-C^y+PCnX1$7;QB1)E49`e7`~eucY1K3T7Pm;NBYfp z+pDe3`W46HFfUftTOTx9&^~%Rfov*0m8zNNwP8amJt~H;^YK$zH8nX6jsDhFGiWk^ zS)%0#8KI_@zDlYgX9-AxUe#5mE-H5^geTeo-L2-Xt^lm-K_YMSM6Rvq=;$;yQUl!t z85!9f3)xK=HLtL+3t}z|47I#T1greaZ)@TVD1_0>`kLzMV~v5jTwGk>aDYa(HuiRR zu~(E1j97#f6`y+6KqVfV^;KGr-z*CBckDN4gA$`orHze^QQJKbbJZ=NU=X{EMErh| z=Lg)INXF>rodAUkPJku=YI3+;>rX~nbKVibb80)ilw$*zmt2O<%4oUsRGk31;Px6S z7<3}J25;_f1g56WgJGe`P+=I>=0Xa$JC=h(d1huN7=LZr{y29Q++7|7Uhe9g&3$HO zqxlXpIJB5_#Iy!J~Wb`v+0;BZJxlxpC6c zot~Jab_Y*DKU)+GntbY~(5$f@xPy@AEc}maD4xITDX9(--R&>oR<)aL+0ns>Pfn(3 zHmE>a&--=WPKj0j`T<}e&qX}_vFf6q8P*a)(AAd{!!W0}xzo<$2kZwE6O+wB-5SVZ z@reOQi6w>~hKP~S$RNgn==}*Z^85PphuE)I4&~TafbpRR`w)^kal0*q;X=%qR z9M&M}aQ8nwIm#O}qNmS-aRc72TE(G_qvHo}QBo-Sa6~1~t3b*s#c;#BEynRl?!naZ zsDu44cWe`r)^KW6q!rl=6G%z#VdCS5#lUgAtNJ`$!}(sm!17+=B)fDJ^=v)z^5*k+A*O|BQ}EWh(->iK!bvS z?$i$!r2=t z9B3;l7^r9sn+HhG8~^|C-2U=nVad+J{RQyBh0X(i=-6pw4_EzNmwcDYHd}#VsXL_v zj$SGbhzNPhg#bYw-bAA{)&wSeA{Sn)6xHG3;S+UfC_roKa=`gMg;1aA;J(Z4_-3(Z z*7-76&SuX*lMLrYYu_K9aOHJx@LT0?>r@^)J<-ipEiJLz3V^<_gntcKA;(n| zp}n3ge6TOgA^Y>?_Jlir}!4mBZi7yf**oqG$TF zR{LQ?ZuFeXb!QfqqU!3-=;#$4kMVGpa%Se9-IXI`#6CxS^vFp7OsP21-l~V{nUOVQ zMTTC`!xjDdT=wSJyZWW2b#}?0`WbnqFkw!cY;5D37`}I(4Hd|Bu_#DLobHX29&R=- zw6zV?-G#YPXJ#pN-qIF*k|N*%GjmlGp@#Dl1s~stBg(|kP)Wn{=g*gb!dVd}44v9XW0E36 zNdwe-)KYgZhL3l6dt2Yu`%6Mb2C%4FZr!<#G=zPQ1pK-3kV#lUK~%)ELrUlD^lb3w z+QC)`H2*g6C>Ma}$URn8tM+KC^X-EeMX8*r`kYD^je-08z}Vul#~ZrOe~H)Of|KF+ z6OqZQ0m=xN8o)h(g~j`ThL0Oc$-;t@n9eI}>(g+Soot!Eg1H^HT4H$Kix`JFK{30W z7}h`H{dO;!)An5(#m*;$fUs$Pd|WA$@!p@Ll$4C)1eVTH3$Q}JsSZs(P|vyeF#jAb z*GQ2#q<``azIJ6;NJX0pNsr+o_u@mPX2@x2r7tXARo3v#%?$;|WSR9F=x@K5a~2P( zZ9G!{(K@x!mmT$AsRs$Y+=gL&qQ*a%Fe@<;LaB-*!7HxCnCF|~9$awb(oOc!(6W11 zA}A>-O>b&zjsXSJB%%ArWXw?nHH^*l!+(#~04`5ZO(^Qo1B^|j_-

    twGwQOR+wN z38am1OuNe0X+PxP9PYJ|owSdB|NbkjLYu!!p`gS1y{BXoJ5a`!LfpQHk6ws@q44wf z2DBO=cY_V?kDHsyIz&8t4PzB385sw5b|N@_28If0>6#VH8 zma?@Nl3v954|7HC+sfpu@WaBvTJLIZ7C-GIj7v_|ss7MPDRG?muiSRnlyuI7_`<4`S7btc0>I(g{#QU5Mn?~19P4gAR#XreEe>A8ABlDVz`j>?i(A6 zE6MLnze@*ce7Y-Ldd&3n=nx}IOIJ_5NhkeTe^EQSCzf1@ehf-tTwJg)98Qk`d>@zh zdYD14g3%uRtP$*kRbVpd7g%wG^ipF|2SU+^Qf zd|R`u-`tufkR0ljxV!&8KE6D`|MqPXB$}OH-;!-0dN-H}#n-J=h6Ao3OF?F+5*fa_$sHhA&VvC_1i=O76u?1XiAErhH+RyAAU<%APo)8;2?Xw z?+FQUtCWn)(&(^V^@oEf&WM+dr4D=Q6TPA$ilQNpH1f4Ofq0&hTuH)Z+wt2A*T^VS zVDDN>Q_~PQBIl?-D=|@{IV(p+%0f9mg)J?iaP`byQJCvnhyrM?zA+w^D@2@BAqpyk zKTTJLMuAEzZTa`W+aG|SDo+uD%Vn_P1F4nmTJKNd5tV>mJ#@#z!&5EW26?=drXX7G zqve7)e$V-Z1^ip!l!=T^xW6cO3<`o*3%0XC52mqET2d0YZc?zOfG%ia;si=bpi!*h z?#~Tvp$pv+Ser8;&6UUIccLUfyZvx616n~#Z`^7j;u#C6evOEBYtjM&WVRQJidg7w z0RZ+aI@%4aFtKoPVX5iAkpu)nT^-EpB;EZ%f4Zni?W${^+qvcrv9dIF#*ZKQhW%|g zejXngk9I6>8GHG;7;7h*>ZSH8UrO58D(BMvR2~(T^zRh>S+5Vat!m}rm_)2SJ%!B> zFMI-3^!^-BR{(6UIk@##7?eeyfr#Zj_nYu%+Sh(h)k}hdp{Ay$5?x;?BS?}!&<(;I z$bR(@azY8v*H;IN50qIzoH-ygl=Wk_6{$s_P> z)8Jz(sr;33gHHWNL%$6jS>pHa`%OWHMyx6w5-Hu*D?>7}vX<+AxS>&)FR>TmGI%40) zFKJ)bH#GFSyI^rvdA2;rbaFzfsI1Jvv5V6)c6=;x6&V?=43_Q7AHWvAP6l~O{|yoV z*Z5vaOPeLcLw0tfGPiJ95Y_ICTT(^E8_RsQg`G9R*mzV;O8ly;-_472g)lH|9>H*s zg6DqmVx*lX=a#YKDVOUolXRO2<_n6 zV5Bc!aRZ|{0n~}D14w7Y#Kd691c7QLI9K_2c?H=%@~k0qHyT(+4?0{kQJtOD5f_DZ z{NT{PRmWv_aDS=)Y-7*mu|ZFYI1wC4bm!3pM`38_v=^?^1Cs0LZ+9WeE1Usz47LkY z){EuK?2U&k-yQ7+eU|tewl`xm1kZEF~Qc} zYNRAbB?E!uUv12UL9IF#Pvz3nY1{$yrwa^}*>~*9P>`e!iG7tuC$Fy+^9#X#7Y`4O ziE)8-jfrUkU|b!i-_F~4gewMoIxGR8*LfTYr-}3Fu>jbpD=37qmSQar&nl7v`8?xcOc4>%TaDieUB;`BZ_ei=Brusz zdtQUMS}vGQ3E`D)KC=kPFP%!UJJ$Ww>C&>Yn|CIyW}1pX*vr!$)Ss1&#!t13>Ce_D z$iXaEL|7RA(S4ex;o;%hBq(g^4jL6FE}cY0RGA9w+16D`%{}x)rKG08t4oD8>M8`OY$jZl@80-bWta^6_b&DmGAl*h6cafeUrdX@wrj#aMD|ng5)};-yN<2 zIYi`Q-t{1+@AJd#`~Zv1>2ZkZl2b264Fr-r+UFD?l1=$Txjq+j1WG;6QSAmN<^8l-!AX=&M2O^UL!9dqup zI+-=_(v8yxh7VUPo8WD9)ap+qwRN2K>>5tDJ}hu^95@*2GfOh=22KVI)t;C+FV>Z#dx z4^h;w)qH{*74>%XCsa!fejn=wqdt!)p1v^<`|l;g&5eur=V~Xm#qCfS}Ccsj3&z{>%(MRQ$@Vm~e~TJ)XdApvQd8@g)`0mead;J%a_D%4c1F zSIPB4<6#;BAuI*8R$Rw85SjoZj!jio!-SU^|a&4-42 zL8t;kS6ngA^Q!rGFr$FTGbs@epa z-_YxlHGhvZlKZ3}o*aqy$~jq&*R$sJ0}jr9&YJeolkq#wVmbjuMWw(XqfI_~JzmMg zr1Qo2WC=hB#D^-f#D+&jMHB)I*WIh_an0cksWQTy~t4Iu+eV>OVeN+1TJ2qao%r zwdjU3q?F)+^j}+-r6SO=K=xPxf^0p>i(yaAy3PNUg=3`5W_#{1(}^=2(n?sq*RP(ANXJ%S%Os)h3JP|-ypaLQwdEIvTdjEo10_C=~ zIXapP)NjC0piXdysEdh$MY!|Qnbq&LpI!w*cu^mYtyUb*;wtc>E}sf0SR#I;9tG@; zf&!<}T@VxG;0TAK9w0`LorIlK%I`yG}nkgI_^pOL-67>zQ-fm_xUV86$ZB#KS^KHi5VnipM!@PJjOI>q43)g+n z-;503AN(eHvz#Vu*Z^9|?dpb^z1V?aogWy74FXp?-oNUGhK6u;eYc5?bO+=b>l$rO zlJTKx$ za(Yy!q0XI+JiE>AUG@6+3mm><31V)u*_TRoVLpL*K7ov$HD9-4FqzMRB3F#K@81EO zK#+Dv`62c9^*y_Fx#m|Wz#l$`?g|##I@ zVq_s80`0fDt3zkxIUajUV^bQB4wU)T$eFp`EzhIz7!3t|3;4rnXDeaC3N843ECgp9 z2(628r}AeHmP;cHc|gtpSYQ=Gr73TJj8(oJ&lkwJa+&l%f<(PB8}Ejayt?&d%U6Ld zd9monQ$RDAVEzpxf}GLss*(z4^9;HQbV@31x)mKO z6Vpc>ZYs#jPZLZ7Am;d8N=e`OISHbN#1`0YTfq`xe>mUPW1@WEzfw6~9F6tlf=}n} z5AVD>ZYL`&oMv_Qo%iy^txNX%_XBoL(Se_SHEANkjaZ|@49tacZ0m5De^_w37*!-I z@FhUGCg4M|k~Dvh_=A_(obDdEE<^Zt>#0rPdLZaXgPpa!;~k?#XV~ViL+2=2`>fsl z4bP6l{y+6KcuutG$bJ`k560-4N>kxghkA8FkDyO24I|@1zHP0Tj*+Zx;3GB@jSZ5? zt=4d;shN%?9y>2$Wqh;R-*b99^Y+rIwESo$8kzj4(XE`&gZuYi$5Jn*>4c1o4h4nQnd#wd zRCIK)hlfFpw$<#H_J*%cL^^aAOV2e~Kv@}@1ys9~j#U%kz_qo#LsVpKwYGUY6WDZ( z$DmV`o!u^7I4~f-xFaDvoo1X{+KzZzb2n!!x~5)yCz_m|e$?g@lV3f#`Vv0{gs zAGI<#&Tik~|6h*naR5=wO(dFY#)^0s@~6~0j%`&O(IMO&Q3 zz>o;R;**u@xhnaHo|eKrHO=r?>U5mq?2L$y-2GhHBfM&4 z^=I#JCn8(TnCM|fYU=OFNt|kP^1piuRr&in6@x_rVcm^xX(_1(?upKaFF}0vT}=0@ zG=?HZMhbU#50qD}uCW9?JwKbCV-OD}#Aj~Ktxie!jw&xY9f|4GeX~n8Zau4XTug8O zIOE-CtXL3*r8zhjPLpD_(&ct03BbtXKL?_eX>P+dIpdWMY6>Y7WWU#<{q%_}_&%+T z5`Cb|NJ}s3=qsJFserpUx2o*8x0e}}jFkJK^vS{<{qYKsu2)^)WgNstcvbjZYRGlg zuklMkF>B7q*{a%SP`N1HEveeIKjF|EEmJ}d>@Bq@c__ZA7y3_mJ^a3cLdq{bJXu1% zP0zh4mpecfrBhNG4Aecl?+zkLfmoB%15sF;{a!q&ljB%>UupZ#$~N|bYHJ0q30zYt z&e2aY{WE09JL3xPeL^x~f4b>aEbnbx&W6Qztic`qcsInSDyOBnd9-BerH;Hue!htE zP)f0J%WR9H)}ykCBIxk&QYbs+IPu zEqNKeGm`Z8%Phu|2fGP8+^>{~y476^Yh#p=T#k(m9qw51-F!Av;VYo>MZ__*v!}KsCntN7ebha(U~x-aDbMUaQ zxY8oZ$!5!D4R=^YaqP#jf6WA)GGnuYhwfD-F}*NxgUjRdUvc-JfrsUY-dg{225v{O zLyP_mFRc{yN^9pYd;Z=EZMO@bG%+;9aJ{MPLw8V=#%7uoS1d5gi+gV-sAF$+kda}y ze0n1FYxq01))9~GG^f$0x&9;mgpISggm9AzWLpfgfJm zn=|DVKaipOIJLI4BbJ0qad|S|SAsx&<}X);P+e2gTt_E6FwiFvH;wNJxoL_+!;c%} z+pR?gX7=6wAu$T7s)-p1l;1-@bt(0GYG$DxP5PKl0$Wc0O-_!WD4 ziJZPHl`31?$aLK&d#m*CtSatN?nTYrCJjc|pXkkQZh22nYtt$m0sl84Vf=dA@eNd4 zCjG8lkxMVYYcH;_@a{is%rzV^IgKCl!%uHGw+4i#hli&t&p1;EP{iGj3=g+AzI=VP zrk_v66Kiw0Sk8uYB>c&nWN6Hda$rLxgUjXEqL8_0De?zE)KW!$;XWxD2?__(G+Qa1 zdOWhAkaj$OaF6>uRb#dg(~11^$jK3L@_U-n8r-^di}Im!ZeE_A>$kS(iiH)Q(Z3p` zNR7Dgz&*Ou4Pw}m-{}Y#4CkAiBee|+0vxSMpu9_fa9vMATF4sf< z^jdbzV8kZ{c|^tk-t^hBwfHKybtTFffpZnyO)G(OE_4bZ6-kGSxogZ8NZ}=_{`Ij`H^+ z*CUy?EOmE(Agp@{$%pu2;@U!6_6_>BwAneFRoa=TKIxl|KNl2K9yy5Qw7Kz5B^JrR z^z;}Fdgr^8ka)E`&!N!PJArp}wYsy-t6soge>{mgVYMhL@V6raNh%32_Ldgai?2Ed z|61?3VH+A7Kk8|mkbQjHYOF9Wl3T(ZxM^|I6Z z1t)T*Tx4y0U&2FQ7{j*S3cRBM$n1tzI9$!m!Sty*pvb7M{vIF_MW#~AM$_ei=bFTS zmr`tLQ(GIDsq=OzG4rRKadT*mT`l8s+Wv$V7PbHag*d`f{32a7lzRh7Mtm<#Oxg-d zr^YC&R+g0OF<(VhVt0ub#bg^dloUcIrChKKr@te7PFK^c z)(L_BLS@CmTZ@<&r|pQozni*q5}K_KXleIaBSP_Mlm9o8vrVm8h9HKUSfHmjGcyBZ z-B+)89vgerOf)nc^Y&`3osLJ{EmM2y6o{4Y+`ASOvXOb$zkUiR1#;R<*5IJj@XJ2Ku0NT}Vtfsr z-=>ATh3+V&E`&BXh!ZZKO)~Q2hZU`YDnr^QjtwNbq#OGc-#rkFd%B&C7u+c zR}a_luQI5)PqWhYj7}nwT`Z_OU2N>Eb}BAG4W3Eua5$#i_5+sr@itkCdN4c?eDMub zXQfg80;@TWwS@#!G7~p&*i#WlwY&3&=VwBB@z>1augf5xii?w>_>5&orfE7Xq3GsY zI!>ZT8cbDX85^UNb&}W4(}Y=S4vsvTlwCf=<;cwZx$3=!z%@2z=5$d4!;K{ASHGZ1 z3_LJPKb!u=w_J5hhYGFi>^=sx#lLqvjN}VRF;y+7$XSYAabR6N*0N}wqkK@evp2s> zak4eG;<95y3@X<eO=QN~{W<@O>z z&aJ1`n;oIwsp3Kz)OplOwWmI?HU;CG5WH4p4Pu92O-;<~vajHh zCFZ8yBWH3NTr4d}J}t9oevh%jv3hE;bV%QPw0p<)U3+73R_m>-P^*be{q!L=mqzAh zYk5ixjTVLmTtdcY&x|3BVU@S`p36BL3f!o*@}D}IE>U4y4r9{#dgd(z(UF0{;;mWY zQ;rQQ${(;IVHNHzpYFJYKm>-x=S%v77q!%44Y@aLcgCXKxfo_#JdAm1dO|d78yz@q zpu04W=61?)>ZvuCopM?>(%uXG>)3qhV$n4dViBCHHT8)JC~YdmB{a0O-k;ylt1z_> zr0z^OrJ#{rx4g#J&?$qmOFBle&#)u&*)ZqQqh}+iWX%LwDSg!Rw6sn~+;1jE@Zssp zoVU8ZDJ9VIBzyXQtP$9NLeaix>1RVJv9BB`p)w7C&sOtt#>gfDcLxW#dBdiSYjmQsvIBj zFtZu&H76>46u36W5H<2$=V(1HAxHJhp?>z{(sPD@fN^X-zF(I)hppIM7N%eNF{aa` z8!8xq9_3)6@s692vxN@bP@y%YOICwLeYTRyAP(Q<59%YO4qB@%waVc`d8XXLqM~y% zGm8rg?U6iRtFN1;?ODyvWRGL|++q0&a^+E_PVIGO>Vat@15a}r<$dcwsb}vlqw|i3 zz{5J@Q|=l5gib+pqKs@w+#dv6AriDybW}8trX^9hY%L|9zj=S=w$7R*jz(sz9MKxd z!}xT1=NlRbFWe#8eK;`Ix3STEV^@_?t#;uVDB!+km=s|h~@ zC1SH5kR?Wy&cH)Y{dg#Y#uWO7Vi~8Jv$tyPHD$dC*_%t1dyaK>;_|O#L4(3n^9$V~ASS)cDsu%r-jR{VSc27fOueYI;9;c`s`lYgDDEY@K5ryiBs{ zZNe{Ku0rFg)L8@@h(To0ca2W3g|kK4u{F~hET+(!)Rl*1u0F*fhkglRr;MM)43*qHxVZ`WVkZ}PdJVx1{` z@{NzBApgle`}Z9ZUSg@hYYe9rvlCP0vXU@dki3>B{{Ham1LS{i;& zEa%Cf%(g1?p`!T#X1={QFBtVx2VjG)E*?xP(lp54+l#h#i+%e|)mV)UP5K+(V{Psa zx_xQc{#sLq!{>pyGX(g=unn5=aA<`Ws4`3`gLp znI1|NB`v2+>YozF&cph45=%3E9-G<8j}{7D3)?g~g4Po9K?GZK=cHj?rr+9iatA^# z@85p`QS$W&poDcN``~F1g4N~DCZW_Qk<#CJN=*U=-K1tQ^noYhVsn!CvFT1scdY;9 zcaXGN8#0_)qfJAfGl1zJqok}ieMS1>UFit-qZ8S0a=wxK-FwmPUNr=?G&DMGF^az) z!AmcU7BHMS*2oJA?Zz}WwpPwKSe>m-@m1@;(y$S9_`l#z!D};7Vd*dqDr)M7?k(YE zujl_rU)GR|x4z%g(UHEYPN$S>zmqQx(OI8~GKXWT0^pE

    el;_ai%fgBP@~*(6#-o^%}F}qV&^+;#mxC?lw0i8d1TQZVwiDTY&QY8 zU~i1)zS>g}!4OGYe#0tz?E8FADS1YSG2s)v-vtDI@>v=$jT5L+z4`ka{4tL(Ool7x z*v1{W+gCm1>{vLgvDTX8#BW^0&RA~P(8KnqCoDKvNxhBnF(6=!jBDUV5SN{;EQi$j z-Li4**GIKU@4r?~>wygo4P#YjYy6&l!W`InqP9eP5ci22+W3+(eZ-27%ckD%g=)ki zuZRc@)6vpZPJj|8u*o2TkiKDbSmh{&%E)NKpVBR4`-RuADPI<2NVZ4$Q46v z?zxY+Ow)!+S~bcnbFhyb&UJpLCJ~ZY9nZBd|M1~M{U7P<3Y5ZueVC<|KMza< zKK>Ekw%nnuFSVcI8|S`~mh>V)OYzvby8auMW=GSz_Tri>pW*D$LS|;JRF8~HcxlR! zh^tEcCS+p9^jtLz4;~=W4PG<7??m&X zhH;x7!!TryeIMA1_Umsz>*0%)Wi&ec2D18_fYYqDP`LYlCDBUF3(k%%cWgZ-Dmhgu z*H3F-p#@DjX&ITEM~sy9s{r)1YjC5XV;))!S~|a#{*))Z#F+4q+j;l(M$@2Q^w@Zw zP4_-^4dgD)&GJ`{(Ctn)8@EfR)_As`*)O_wpr?6x^~o2*{kd7{G&8s*1pjp3y+wWA z>F~HyrLzBF``s0rvxipsMM1{(7=0k|w>*^OnI~-snr*bYVEVQfvsbbE?GSN3L4XRE z^{kl23)GG13A_1ub=U+`DK{PVr^lrBzCr-wJYH&26O4};Gon&vzv^2NkuD0=jyH>+ z;IKQavOVTrFop&CEB*tw+gwM)>AjGiFJm}6F|=^flN zmwrBw^Asm(?$w3#D5`*sZtFQG?E9x}4498r~8Tc-+_PM;kOuMD1n zhae_4Uusud{6R*G*f5Z}y|A8G7nT4FM^utcM@RQA*M`GxAII$uD@2_jyl#g#!82<<|XOXcnYmd{kT#WZ!3{SyR3vM#)xjwf*%9f{As|~3eS4vjKcmo5V zNAI5d^0-rcRm2heQGg47c%jDO+;c}2P%PEffvmI3@ z^iNj^|EQ3(%t@-1lwS<@fXF!SyWNN**Ec=s(Zrm<<9z3bl|NfT0f`G0EmYkZWM0XZ zIn8(ly-nf4T-%O(Oa&FmA=8|uX&|J6s0Ie{D5sH_1}HVuxI{L#HNKLUhcD}c1$bCq znxm3eACRq@|MijN+FEC;!(nPE)2)cxB^#wq0`rXY3=A%lXRks0^9^=&ME^>@ zk!kPPuYB03?pWa+7@uLIN=QqK@cw+lRx(Zzh03c{{rYz_r;S5<^bFt0>S{r@#<*lk zGd5qPW217R-chahq_XK&V_>YS>n9dNozK+VpW59}ywz0uIu{6wpi%AoL)hj+gh@}| zN=GO5AgV#3@ym~>RkE!|Upm-wtToCwXc-t7=;)x4`hh!M2%bf$>f5B8h-rL$0_pN5 zY(Btw3p@HI6awHMQZw{XSLcLK8yg#wCuIjgw}(208&nfEwEE~cIf1Y%E-2`M74S7o zqLn-ogcg;oC4#ekqhHheH)$w~lr^Q9_BJ-PC3fSxKN*3r0`^Bhd_mfvRgsuFbjH&x zqs`WIxj8|P!i6rt#Je8Z-pU9r&l>9EGi`1WGhs%u7t(Q$nmIQ}IWatCr2N}mq^^>7 zw`AS~$dZpObJO5c)9|03K#MgKjOA?o^(&ZCZ%a&0CMV3&qZ>h;;Aij7he%c9lBsGE zXBe4QbT@2ME%G1HlyGUi=?qVYHoMDL$Ri_ve~+F6K|JRZtAPErCLJvfumTiK)E%q&%MY=)`u1E)cT+fqe- zHHSY*L{vs4_YM)M)A4pS)EdGW->R=&w8icY@xv4&2 zYR(vF%w$}0JQuKxEq(J?lNJ;YZ`~R!Eug5nbGrdgquQ_f6O6-|u=77_Nxj?A(I=y$ zY7e5Wy;Og_-W=<%kP&>kdt`d_AnFG5{R_~O4M5MLqIG2FxH#!3PM1+csTCE|&)TvO zN9Hp0g5PFIuL}L}@699e@aBhx23#&ROrtTWb8BWQ{)kpq!uxyt6#UYxRe`%g_+(DV zQCTy^1=cgQY_;+p(9r5&66pb zoVh!MgpDy{2!(LKN^dDtuPyevJbT7i@z3{h`|e$ijkt2nF2cK11+M^ia2wWU!i~^N5 z*)*Nkv5Ng$j(-*gCB>@$BC^irKsG$ujS8~7h17BTT;`|4@o|_La5}ITZ=(Awj|>I? zDvZ@{A6;454qf~4vAhIA@BTio-f-W$pRTJ2K-CM0H{o2giFd17yKZnG^oEs(hu{X= zx~OO~@Zv-=bXjB~j?8aTP`wPB(>imT51gvkw+X`M(IcMD(zYq-l%*o8;;yBFm z5$8-lm=#Bur2S?Dr#);zL3;F?+rP2@_AMY$g*-Z_a3&^0%u?q?Cwv%4WITD?fv+sh z#LO)6?pga>JAYOtU3!_7lUn)i>mDkxe|a$$1JFkPyiWdqeZ9_y+Rr8V>9E_ptD-4G zn$gjH!083&pu@~e*vLA~$461b>+ie&1X5~0qZab{JX>DO^TXR;zBf^n`1?1sMOEDb znXFI=3D(KmhpTEX$N7IpyaNf4SWr%)Kuj3N#f0Go>Fy^bI(~&_oc{i}@b~XEsrTQ$ zodFUfSeGeHfBpMcWAi`WD5-FXIbW1!7q821d&VswDyk+Yrg5MKKTNohm!ZIVy3O3;RO0IAK!fx%vAwm zs4Yk-C_r~R)s?k{O{34jI5~c(puHuHp>=*oHuTP&=20FzAXP4R!fAZF~ zgsI;r-K+EQT8I4qxbw7~$0xYdgZ z*nIV>3lAT^u(0PECpkH8nN>l8FBpw+JH9L^WX50l{sszz%8PY%hwxD=xz{Qod zw=afLdLk|vTQL`;&Pco$KMn&ipG5l=j(3VJ7Z`fXr2G~8wzfCyo@&0(`0Dw$&&)O4 z&JO*X<@H24hoEtFtDF%Y?FOUjG|$CFni~WXg+)b11ItK@5^9p_UDQ1nJS%Z^%WW0T z^4$;5p!5089rom8L0P89{+(G7S$ZfZ+tkn44+5dCrdRWKqx`giUHXtBsjR&Gm4RfL~nvpeg7mpluRSatA${<(Z=CfjnC1wLN|&1Vq)@ zHexoXvXn&JtNYaFd{o}<;NW24gidJcy~+uP*76GHtNNRQkzrwZA1+sfBUw#PZS8j^ z1jhS7o9g+e=*?^J-dnp);#VId+P@Cx8Mh0`;j&ULuw>e!qcDk;L67J;>K*p{n2Hl< zh~2T386QhBv->DcIEMutLLXrOBn-3MH{@vP{4(T|~#{;B5G|4K|R#q8KUTOZ*c zknTGxh_!IKocROv6(0|>J)T!k`U>^ps4ac-^CwNKT5YWBxbGqTZLdi7Y5Y=BT#U7B zxA#auTwFj##>W8p8Y7U`$%mdhIg+dl70DJd{@aMVB;1Z_($b7}{|{AP0hQJIe2rpY zARvkof}(UuH%N;}3y73Rx3o0UNGaVZ-Q6YK-7VcnH{SqyfB)|+*IkO<_dVx1Pt5E+ zv-jqP3nnGy+DWd)v(wXOp`qI4mdxIdyJQ3eirO3I*X=TtbFLzAToOMF7-Y7s!CVgP z4%qu(-<>n01``naEzlC z_}uQU%8}%yA|cRS8fnrg%gPqRr$JSpLxi%jcpU#uqPL^NV|=BKEm%e>4J957gnvKv z_`7tviClhndY!u|#B2vgu4UGk{WkVZ;njNC%-x_yx#3qOWfLrtpghV4ipRf0Dn zVn~gvhf!|%-nyib(dOz3i`&b8AK6&3@`Qpw|bFT3?IR>EJwe}_Sg5o}|c+9;An^du!Kuic=zdi8O3_ByBu zTkfuuY4_d5#MBa>M?yfpc7doTkTMoNg^q&3_e$qGtYzIdtzN^A(Qb?zr8Y;&t^(z! zx_?_=5qM!IJ`o5SRi&9uVu1kM+0U4e z6dVzL+|=9qItz|;?YXy9OH9OW^frgY;>dfmLeRBD0`EHZ_FqB+VW&Yo$k|l@%HjEW zYs)OqVJbw*-D@ftt?i;TFF09;(@a4sk0&*o(dLPA@ZrURW~@y%b?ClXCoGzn9t zpi_XwMAJZ=?{9!SG?cHCh)K&oP!@uRK&Nu~b_L0$ z9Rj5CvG=cEr^b1b&dW3kFEvx)i05)7ihuw4!pBz!_yP^huPElMp?DA;x|fR#tviN> zebhRRZIrWrir}wJi$I6q)ifH=!89~K>c07Wd-G00Vqvf=4cMI;mmLrTqhaVb7#n`o zee0_Ii_7=_f;uD{#Kj-3+`8kjxrz1q$<3R&yze(k?atyoJP;$iJD`RcVe%*^*BIn0 z6|+8$+g~|xuEnXej9@#^c%l!7m!BBznuM&uG@m_1IvA3bOfyHmqUwtFA@LQ6c6|WAFu-# z#l~hi-yZ*tmMOSyqBZjr#&>f$6P@qjxs==al>*(5mbxoPwY4+*`!m4qo0>`iM-CEz z8X68V_X7%eA{=xOi=%>;_l>M<-%l+vMJg&QFQgraN`+}ntt6;F% zycQN#DAb1*vOteVR5PEMpna~yc8rLMN>o(Tpf?E(@#ekgE={NJpmSB@ z>hprIVzo2I273CS&8Z$D0JpEkUhRN;$CD@1t`*#$3e426xkb zbF;OXS^7@c{5Ax}QJAg2lqcohuqV8b-mp(_t@{?mWSI0(R8#YT-Kux=)B59sX+9b; z!COaA3~)|rzrcboI(|3T8uAbm^I)>NhCnFr38yVDbRTY{;&Ix_mzX#g6zoC+B>MgP z`eP+E>bZ6&rd(h4!}4_obaZq?qd27CpndujmS1*SnrDfWvhq~D7dS`sB%E*~9n43O zJ))F{VuAd;m5twZEsi%)00jZL4k{87tv|oj(m&*XC^0cKF?nlZa?y;4hJ7|VXln`7dLo(?+JXotSspD zS@2yCs+sy+%$5?xANS{rl280k&8sIfXJcoJk6wI{tKK@ZI$p)muA|jn%q6Y-U@ZC4 zYgE2Hh-&EeZTXm5Cw+YXx2E&QVj2O|IvkZO+%j<-Ja&v7zEvopcVh z_4qT_nq-fV@-2FKf7F|=X`MW`UjK?ZA(JYcrmu7uLs#1+dyu`q7AL8Ym!fE=z4Psz zMeT=3>7&sXHWiwY2s=1QvE1IMG+(l;*2l{&_twD0rX1`Jl_p9-p)yV%%)7_SEW%K8 zEVc|>TyDTjBc`OZ*qEI9Dd;B>&LoJ$Y&3%!AwuM|y}EoZ2RPJw7!Hk?P;4-<_V98B>}qPntW*`-Y}7BwL)gSwvqcj&?|ietUm{QKYZJ^&rYa3HG!}{V632F%*-*wlTw zzeyw$t7e96>bzWJsV~))yMu)zChDg{%F%A}6n#p`qnn6`WB&eB0Y|A;V;O7AVq-eG z0ei8{Y^gZe%>&l5FRD(vqhykH9aSox9o zRL)~bQ9SjCS@UCbkgu=w(J7W~^E=zA-$!d5f10U0xhsyeC0lNruPWhRo9ORPE76gX zHJz}ON;xnUY&6fzLXBbUpih(;L-|2k8Ifw8Ahk!C-Ml_a8l@toIMXZ|)?Ao=tWv%y z8NYeQxpN22au|sp^_ZF9ORHV|W+v{L@YOR`XRIJj4Eo!qkM?=QB6{@>_M9yliO=6( zeN4Y~LKi5n(lYcz>v*oe{{t_6O(<6-3H>47l9%@u^Ze41mBn0&%E`g^;`a**f?twi z(a`zS+|mN&9w6cYglbX}F}wm&5)!&s?CYg@`Sj4H78w!}m!AG?Q6AwH&1LZX36^OL zGUO_ckA;sQV>vIUQ;n9%{6#_j*0x>gA%M9mDieGHm0n&p5YtxJMQLj$X?%6t@W=#8f;^$(V6t{&%=FO$PWiGC-jyI5hnlW!~ zJnja?tkVz^76q=a?drMEOR>)dC^PgIz@BbwzCM`s2x6@0spHKSBtg)(@x7$P(Q7`{ z`C#=aWf4L2zPm!*Yxw!4P8YtxkGtDTQu`ZI`uMl{-n}4*udscB_V{u2)Mu%84_Hk! zm#3zND{Qc(q*e~$Q^f=p7ct@V1aaVAHk8v=T|`93{e7pjG;#_G3hvju*Bntled-3Y z*HsV`-o#?CGPVOkWMMTyWO0YpSZ?#2cmk|(SmZbu|1CPH0Xt$I-R z;wG}Gz9V6bs<3BqzrIQO2ZE_8xU1;keD*82-ER9#)vz7@Feke@U(lfaLj`MlB<2()wV zL0Hh*+BesjsG9yoO-&r+{bCJVTyF&gbbj2OSw7O;m{f!}7tC&P|I6N*M@JOx4dkV4 zi!E#Ratz;gNXDW=zWe#fm71|X`ze(w4I;^%{r!YaMI|Nt0u7+;XEs@N3aAQLgD!qW zbY;*RhVGfZ7PZ}#5U1}~5D#HfR|IW80Qzs=zAYl604dQsspL9lEhkhkdtU5GT$`}# zY-=-xe{W=D1o9N6R(rV5YKMlBfBxj<<5S!CxVN&hqBEcmrg4KqL!`vSz$*$J`oeR$ zjk%+T!Qz5B0{j)iYXlHG6lA%HU~fr6`sNnW`?`LmP%1AG<@&04Cg#->K(=>s!gKeo3Fs~V@q4S9 zMsVS)v$H+xp=)NA0SA@1IGRs`q%=k(S(Kk2cpr$wb?pnQsj0D$vQw=V(ER>>3rh>Didss$O=cm`BvYH4ftC&15s1O&hd^x&M7 zQdL#mznI-oPS! zV>I8ME8rv2&ncoZIX{24AYPRueo|_h8(>2D_s%}SCcn3Dc>Z&MvI!#YAkYzChIn@g zX>Hd=4Ug5&;oNcpQ=A92pH1>I&QRfIN5`!CIlXHGf{Yn-nL1;g=PGOlGhqLU=1NWp zMC0}|!I1jy`}@s>F@nqIg-#YsOzTaQjh^a4c0d|>Ac6(jDmpp2ejV*YhcO&RJ9xA0 z5s58Tz$*nK-dabOssFnUB>_7z;$n^0}A=#0v- zPrrVns`_iPIyZx<3T^@+~OCaz1o<=W3g4IrZ-U9=Vb@`Wxx zk_hHcbxg%|PNfMA9+&M54OGEm!|5()US6NzRM*xf|8MraSO>TrIHmI^b-85D(4Xc- z66Jr5icq-8{rdg;JTEV2Pfrte*CONj#mQ=6BlZr?Gq$q>H z!6CAGvZ7M?{vz}Ay8H-F|1y_mz=uF7GT`FJky%+uA++VtNU0S9$Et%;ilc)=tbote zxi)N~Z>rcxJ`G!&AIj8PGQrp0xBV{}6HN^<*t}6O9EZQLV`IbRB*dOo>?0tHic9go zNe~p-;Hw6nHaZ)SJb=ZE3JY)X=%Mdx^>IlwE zcG1h)=JGvCX<@azxnbTOjSVzYM zL{1MvzCHQ3o;#Ti4#q%R3MQ3|>q!5Uv|NEMKvp(-{1Ez+Qc%F&xVeo3vJ=xRKW`!k z{~awXkB3x6UzLEQhaC9pS4vnCadDcYRfG)w&LZCz?~v}X5_EnQ0Z0>n1Sa$uBOz!WUq;-$@6-0r^d}#wX(kB(HcAUz!V>!N z+St6~jXv``RX4=oB`E*;7RD&P3TG@__Ad3)f584MKnWZjdaJ=+0?-Xof}Mzt5orGt zO9~DigyK>x`~m)eI8deE@DUQSdy0iXCq7tnKF`EevhRZ#QoBKg1$s|<7{#-hmY_5^ zm{e3w4zKNPZB3Ny$cXsT4}W`Qsq8a=dLc+f0ua z6$S#%cae}b{uBp5k6J$0f*UWyDbdq z`gLcK2;BtXu;H9|MPv(5D-7eb)Yl(h88X&r3pG4B^s21|sWcNjdhMSfAtXL~>CM5R zp(Xlb_1;e?81=&`PJyRFzImayf<=!(Ry{oIFmV^fryw`?g_Dz07LW@4L^O_Q!1^hF z6zj=E_WGJQADb@s=zPb%xb}+yF`1j4jZd%*h0r&OqukMvr$0>=%uPg)Ky<6jWRWJQ zMIr0sDF~s0dUSkD41^?nNQ>j;a_`=4L(G{ZYstaE2%7$oD$&yBLb^gEx(gy>=XM)H zL8s5020^A_*bK_;!Wh9Qhna?khMAce#IaA0ne~SAKmu~h&Fy0vgz0UR>CZ%~yNXA@ zm6eq}VKv)X8B(eD)Ot&}Jk!*3o;^jf6oVqJX7@Z`F>;m=zJPX*Hf@snT4g1kN<50w!a3sl6HQ@JF zs2y*2dhDE)^^%B)h}#W7Qy1iA&Ad#jX?DwPCT8Xk)NY9RA^L~>J`X%>-V#F5l)=VF zbM8i`ThoNXp;c3#A(Wn;o}MUkf9muY3u|F{xuL!uW?jHHW4LW!Uth$Vr=0@>L{53y z@s(ii5ge>3CpWT0WAb^S6)%Fucn)6PGpFz2;o*?F0N5aQ0wUEA5`*2@>9h|!h|D|n zz7x1+Pk0kA3icT~MIbL7u2+Ic5Rly$Y2R2$2~`Djq1;3In5M`s`9SMi3(Ts4%&2tG z8C~SPeCv}M8agA3#|L*H$w>$uD>a{%Il7jdl5+2H=h^AW&GB(`JhpvseyVLwc`juI zuwpIX-^o27bDDxf@a)-F)Ew0&qZCHoshk``Mt6qqU&;n`e#nJ zc!u+Jp8va51f*wl+(MXTm(`iU|EfVh6pFgYG+y-SPz#G2B#6&LmK7=KAd>45K%b5M#PX{jB`=C?k?e_6} z$62qWg4U3sk&%Hp>D~$(TwI=Hr6uIMcR_66{{8zPVYohVwg(dKfC9iCh03j~s|%6} zlnUS6+`x!ycVh#pFNd}o;J8sN`%O>I)^dbcE77HmOp) z&st~>NHv~o#di`5U;`C@#d7%!#qtWvof4=g3JZR0FjkTr8~YoGl97Vd*RNmCP~np{ z_Vx9Fc35jjE@XjHUT0A=*LJaf0&W9flW@dg3(S5=$(|)MVT5SIUl&z_UJpD1ItvYC zY-xdZgM7j1`$eazX+#ZF9Z)H`q<^4S;MMvj@#)iMUn+_>?ilg^nb4|W*9J@3ge9U9 z0p;1u+88T$BG4$@SpeRe&on-(j%PaBHC-Mnl>uFPP_+c@vo^?}B{V<|(xg8PxTzf2 zXPi)B>yS+JhK3)Q)+EH8sjY8hWHca~fc+JY9)~y(vcEkC-Pkg=es<9b32d63_FRrP zl2QWi|4Q9^c-6lC>gDE1fm7ie*&>^ zSi$K`(?x6V#bk&E>eP>dl(fBr>N_mMr*AGRBB?)R|7JC#n`VR(nblQRRBphM9zIk% zjl9B13MFo__~jf&XYNfNQ1lC( zBu!7K+5%-f+b!VFp{^BH+sl^f7{z6adpLtUyv*NPp)doA3xKt!`tK7fV2jtz=;LTk z6vc$d6S|UL#1;K4%1RRJmbG`gOlcldhx~cMY6}{8&!3n6bkc)J3F+2(Az(4b^~xZ} z8#@maLh&cp@xYda-SD^AfAPu&de?wKOiYZ~d^@cm5xye4lKo&?oO=TJaa2mQoD3Wv zvNX1K>9>O3rdrQ=$(?->dHiCV>Y&Dont(xN-02GLSnUHg1`f;V{(y+^5tf}C`3iMg zKw5WRtqhhXmxg&sQngIjD)E^*XetYeLS)8I1c@c6(h3OpUA&|r)2E<5G&?sl69&Kx zMOswUSu~dy$o0>6U^e(D9UZMd`7g_v#3mt$jjIVX!T2PKKC7NKjN7=7^sejNQS!>Tvh^1JoCqE_kXgpI>Szny)LeZBnF z*SR+4pc;~OWmyfX$QQ9HiT5liJ`j{9)<#ZvhlchBYHT;FlZl2m-+R_KJJGRu{doE& zmD$o{eeH`_r&=FZ?=@K_4NS=+90IH_`-9^Focg`9OSaRW#qMA9@9(cUIrFiyd=SFD zah;Eeb;NGkG7@%QZsm${o0BD>Eja*6HR?U5^0gPqSpQ~}_GgrLJcc79%VD?i^Xu`C z5TX})`=)5lJYE?w%s5CyO9 zX8)A!PM^MwoYKK`*$aQWD&skF%P)C%ELS_|0$Hm06lv2V-YUA@pgA{28!o1oJ?z0b zK$n&ocpA$s{%q@e^3!pvNdaEOLkk+Onj1cZu?xY4QWfM+A6}GfO+d>-{u9u_BuHS5~!9Uyv%jkRRDvXHX!H_}2lU6z-}0@%5}fv7#a zn2^>lbHya3Ejd@fZJ{c|kJn_Uo-e_0vnV7tfij%lbZWb4OQJ_2FW>aW_7DoJ>Ggh z20U|kIBotA&nfg4AX|BTsjry#X$jdFcdXPKE4E#3-y!PQe@SsCsBL4sGTmUE3z~PK zD1U`My5?x`G5)tRR5B9fZ*{+W^Za#fG0+I?L^eNASDNY3uIq7JzkXdM@h;kJXWnf> z{5-jde&%8a8&)629E0#+|0*20rEBwTA3{R|jhgq6a`)7#aMEB#k|ATKVldJ*j&s#TQ_Gyn}WiH%{C2OtJ-IEKt-J0s^zu5do ztEljQ+l-YYu&{iPx??q6AE#K(@=hl~3Jhk<0q$GZv-vB@V1JeqND_zr*b zPw@-WUrL}?SzcB^`n>cFx;rmS8XSf%dB%QoW(;002=YQCAGJmlt3odl4udPn%_Ys{ z#(VVIgHFggwqYC=P?lZolZp}CM_p+>w;PP+XQt20WVv5UJMS|;Gw07TGuVX4&o<4F z&T<#`<*&V8?jVX_VZ^bxY`l=P7ZW#LsZ?2&=48>l*ZBR)^RmK&w~uL8Yh#3XP4@Q{ zhqx?Dt#lO&t(@kI)I4O+f7n&g;(sVy)W9#Xp7WlM7Khie*kf$pi%!Rw8~jpz80Jkd z%~U|@d=blN#*;B2)@?qgx~75$l5wzzSF|K)W~yR$4((e=>b7GpGL)oEG-h%Adv(i8_FG6ak2r(3~D`&E}|`-K4K9-8+FP zd}9Z%ot*Gs^sK3LugkZ*`q`D10ZLh#GYy#_>4z>$L*-PtKZ1fDVc_}(`+uBheVc#a}*Liu@KgGE(O!--5P^P!GEj4p+;bT#o;3!q?m2SDde!;T1 zJk9(i&xL;x#sBy330G%V`Mpwn`VWqW{V2y*QP!Cy#l$+h#t2B~(jzlC&}MHNhumXk zzKY-7*XK7MYJZ7y>{s}ge2r3diK?{I3^159hxr)EUKzA#L&IeK zSL}9w-NJ8fZ637yBJ=q*0vfexbu%#f=s!}1IXSq&mp*XobAIK$2kyMqS0;irBosxP zZrvB(Qm0te#d^YNv#_}3YJJ77(f)_pQK9Deq0g4xscpun6*_e4e#MQ{@Kz*^v8(m`hkWhs6e+)7+~UeHn)@4d5P^k$XFE9A1wb(}=enHqI<``ZpY%zkgZFo>IRk8#fC zUF#7seoju>8O+(E!QjIkEa@e3^5y>Lu`*XWT<_rs@*4c&*}qz0%EJoJoP5GT>9QEO zOCV(iEo&-jvS*{&+(O4E!zLxahBH62W&aJE{A@QchC9t)ov2hS4RPdrr zMuwDp$JSBE_}-zZD&#GJ6hZ+&u3cX598yRHqyhlrB-U!`paL6+_Mp$yKb%{60;YS1 zp7Z7zH2ew7&dqzTr6!6-&f{$y zPok}F;#*P3)9XytcA?+&#-=A&6P$!lojpbF>pCgW5It!_U1jZf}x;wf_lo_Jo^8 znbt_?Z64u>mm@lL$6sqod@!lqTl#FK&YVc}-q1%+biz=cZcXWB@}CIkI;Uk3Z=GsZu?%Zl&s)*%O%p? zotB)6*0DdBj7W3ami$uymfKYMNh8Pu_Meo5yLrM{-f)_gUqBSwRYO$a;T2h^N-E>Z zYO`535c73bYA$#e_6kC~)9tXmg!xm^5;G%Ek_CrW3DNJENeW>iK2hU%gB`gvk0RZO z33hV58O&n_?y5`AK3ng>Fim$`=nfh2Q@^1vQiS7*%D-ioYvYM`weB8T1S;ZomG z*Q+tLz`t$;iEDUba<9B9kHf@&)I#{wbq=>*DavPbl+f zy5Kdd%psT1ZuXC9H4_ta$~AtD|IPj2h6dunPO2d84ZiuvWsGFe(H ze9IluG>fg2wE2(#0;D@0&<-GLs_}ujsYy$tT|SD@z|*Mb?~F%47^0NtXzQ55+vFIl zTt`)#zZ!5^sW9Qu*}34$xB2hray8kr`o(C*(KD*7|vpagnR@ayDo4$v~V+fcgfRPL&lpmno_ zNr^En>Grj;L?FO)_4QLm&ue)vuhY8Ag{%mPjL>acF0Ls`O0Ua(QMTi}6-_BBb@a`M z$D>R?Ux^#{RuXFeHL)QeobF`(gwv^NFE%gDbth)p2U8?U zDL24R-@Er5L2aLnHDy~AC%^2!mLRANPP{)BV+Hcl15J5-_76ZYqU%#SF7$H_-Gve+n z#N_R;+1MB`u?!PukN!K1HX=|x>Wp^pB3XhS)ojkusMTkkfpLn7;O?y;Q5Vmp9TH|i z{-`{vWFGz<%j4}+M(^wNx6WHZ5N4sdM1OQJaLD`HH*in^BK0;BlDS!djCk@k)$)1C zj}Ci>lhX`*w{QpzFG<`biG+Y)&1p>)t~n-~VPItUMg)tYz~Ei09HtG-X4=n1R=UTf z2CbxvlD}517_VKe@Z#6*oKQgkC*+Chi+z&BcWVgbaFDs!U8< zn2e?6L{DNh3>1Oib)CV@+4rsgI=W8Vc=2InqPg?_=t8@<>qW5oDf>M+M$qw6fn8N@ z?N6VFH(DRgd53pG#>U6*in&#0n#1@4;Bu89Is)dX_Q zyU9wK%JRJY$s8LIH5Y!L=i^~ylBZsPh*+Z_kA(&|WsoAaA^Cf|g2$Dzs5n16FD=f$ z>)(l0@na%Fho-;JdXJ-|W3rv?j+E=1>CxS#-kLZ)Y3T&`OURiyGd?VgCd9-rj~Ks= zD%#)U%{$x3a1{(mOXnu@#lBA+ zUso{-Ec2I)*c!GEPKKSm*C^o+{K7cn9*b#XZZd25xGmyH{3My`=L@o zM^Q45BhOVg;)NZugpTr?g)p}?bT~ns3a?_dKR$6~W^2>wYxOBeMGbAYWZY6oI2bEtP~V(XT*Fw|MJOl7DZ9s1lnc{6X4Gy6N7!iV8q2VE`=bcS#OVPK;)K zZHq!N5ZcW+HjIP((#jl1uHcKQ{P7X1-FTjs=0J1>J@Ckd1638}Hz4Q-_-1>Xs+Dt& zxRP~1`Z&jAtT|mj!m6=R7)TyDp;Fz_rvg>HEfnG*tVKt?8_!f2(#M+mrtU2;nk+iZ z_7HVo(;97#9ofnb$%=SIjN~ne(KOcQvw{RJ8^kL=BB${cJ$G@&My$>XAT)}Mv$FDDQ_v0pvW5cx{>(;*DUy^a43%~UnB+OqF^rQe3meslYRhkL3I zpd3Bhzrv+grnhW&z1{BNjaW_huS={4%8cZRz&-Ba9(&b&s;e&tfNo!{u0LlCwjwkj z4+F;3^wkZ2ck-#r$;oNJF3h{VUH3f5OsNtH_tBYc^NP4#_?cvTxQ4I-Q=`gbw7y*J z_aVjsA_~F^k@_$_?%1G@#^?nZ;Gv~Fx&XqOYv<=@=I7;PL(qPR1@BGO5V4jX8cb9$ zGBS2`b)~#Z3S$hQEeF>-cDVxb^aI0xdy{teVc!UANvZB|L4A8d*Z7l$!=1pKwON=Q zyuDdpDbTW|2Cc7f$^@szC-d>jKhckhM0~*xbM|=Jm)_Ua#?>T4W9Z|A_jGHGXp>;R z@N#2&LtQc7PDFSagv1IgW|;?uG29oFz^f2$p19>cT8;BEq-pq1m1sR&&aLHkHTq)WQgExFV1B^*}9|SgiYUVU`mLFsF z9VE^ZJ!7(!O7s@&Aug0c6V;W*2aFa#8(t}|w>H3f~H zkcEZg=~L_V@rU%x#D8bBy~7|~Uapp=%=q{-M1K8=@;?f?CK1DPnLLPXOTm@4xGgIz zCcRciYhJv)&H3qjyU(G^iFc+yxdE`Jg7xttn>~KWqgM2usNQXxI#$S3UMo+GiIFV` z^F*-=RxmRAnEhVj=qxT{S|eW!`$veke6tr>bmCpE|EvySV&6b(KX)pB8-`s`z}+T8mk8f*3`MvMz5W-ts*$ zKE5q&ya`(1IkS#t67pH0%HAZ;RQ0Bv^?bgn)!<|o`{?1qGPeH`ILim3#VDM(5Gb)xPe^bC<^_&A}6NPvPp#N3Q~r-JA5JP}roSr{wzF*Dn7Ux1dY z-d+MR@Dn1bw`RaIHHYXZ`DuQa+`aL2^LP`Wu?-+!J3@b)C^ z@;*S_NU+#y9;@o;Sa&bAVy&AYR*;wf9VhTLPGB#!>3;*I`Fn7&xS07)xjGKJMYNFX z+5isAxce)aV(nTpO*w(K1Z^u>`HMn=QnXUfKI)j#O=cVfW)jeWV1prQR4 zA0GCtnL-u+yfFgUx*OC>!+>Q*M{jh+RZ%K@Af@TCdtZ5KA2cw7h5cVlia>ffGmTy+ z>`^aUFzEEV6@QIN)gicTTd2-?Wj#>TpTKtuq*jio+M1-_HD z25_opyksO|oDY*sb<(v3@m|FM6e>!}_U3koSo%UA^rBuKy-&%>o126sxV_ZjrOya_m`CH-Lh4s%w2IVE+qQW>$Sib!I>B zyL%_7V;gg{SZn!)q=t{k>2Y#1$=6HRR?Ol1cVYnnY<#FqFUZaYY!Vp>Df3M5^8HF70=2nePD)9c@q>0>befnIX0ZKP z_{x$o<{xgx_0U{N!)8a4e4M0!%=PpYwrh|^H&9< zT6ptDbs~Nun2oK!X_?cTL6K4*p}v)LEHwonSdNYn$WhAWP6^<5_xJyxTVpMAq?$Z4 zoC4^j>!Z)qlhLpPMW$@k(~e~ZDudbK-PW#DU51hNdgVVpxshyEofUc-n17~5F7~%q z!d6>^_0?REQx-zzCBR=F8iHwDJZ!{YWU&QNFFken`pQrk82N?3f&K9xMT>CV0uS5x zck2|81ipZ^Fb^`SXTMitz2p1~M!z?|YgRT1C`XIK-#=6bdLE&K6&Auz3YKO*x2@mq z*$073T-?iTYV;7l+*jK! zZ3JZ1@uug;_H4U}XRXaqo9yCZrWc!6Z{GLsuK~S;awzCH5DpzYJaVNspj^JA77uC@ z5{TC;MWZC_&Q3bG981V7pZ=Qx&X(8@MR<8`HszOe|5BqZ+cQ`mvFe1hCnty23VC6J zgTZAeAR>a^rn`&)V1M681|#b;$O>M>IyfAgXLoI>Q!2b1S^hQKGo6S`fo=SeQxsNP zO~a0doAq<8a3*~hw2qs=ZUB6a_$!TjJ?%GgWtD(NRJdl|>NvE}?9#!YjKxX+@YaIcB z&%?t`fY-E*BE*%snAsRZ}$^9Ky!Aw0V|MNxiznkQx6}XNMQcn zTH8;>Dv3m>T{)+-x(}_YN$|%!vh(^E)_P_G)-Fw_`x%z3hknXR#L{ zDi(-6@bc9$GY>UmPW7iJj+F)}j+76NmF(0G4rU3Wv+|+*1H7U&U0m4CNvQ96UR)jZk&hDO#* zSpw5=MHh>@j|2ZUlC2=`i6!zU+?;o$;m#bj=!L&zGXjFP zeE^>gz9rBV7D?&xHorUT#@9|-cF8YDx6oluEDw+P+C1&5cbkFf;gvRf^}zFT9?|Na zEUnJ&5XF|LV?dH+Y`$zW>tif&)QJ9OHFFeHAKV+OqNU@1FD#$1%TPV1jc~hr_ins8 zSs1i}qY)6=_~%)_^~}_haCJW;Vg8}@_QaQ)HzC0^<>j?^mkKlVq;zyShAP<*LxKgDk;*>PKtsxnUaBm4zPsj5)_y(RKbfCqs3C@IOqk2QWIYPQ^M+;kiT zgsi6pp)UtecUp@QYYOMl{-ce9V_kL3R-k5l6=t1%n`1K`qKy^pSPdx{)hjPW7p{+e zXBV^hP+U;HHz{pv%Yjzz<0bg^&BEY#TQ|(+vGVnXZHw)FT(o>MJ(>JxuWXB4Au@jD z1vxUOUMLaT^_!J?!`sWq#~^3(Y<>#jK=JME3RwCmc)pJ)YyWfam{bCh3BBpiCy^?L zMP^xBAM#R^ZNf@Xjztb|f0!)v$IlBYMeVMZY@6+!|G_p&fh{sSJ^ut!J~z#k#-_K0 zM?P!EwyRg8qE@Z`@V1sF`EdlfCrNpjW&c?R7^bc1A-Pg%uv=ugwdz=Bfkmz~JlbG| z)pT0&9lQ4&GS2bcDSV|>1E)c@oUB@-ciGu(@R!E(3t?hwwBrr*^ub|SP$niJnj)f? z8##6~USw*z+4{rr5XI+g-+W4}ooQ^$68n#*-AFn0b6V&@Q4Gq6Oz)L?!mN9|;_Np^ z9@^V7rULaHymZkMV(bd+9b9pMj1DdpjrSJqc1O(@mE^%OBcI$Tc71=21BS2-08BKr z_0^Rnbn&;XuKnp@gfFb2i7r{P;eBL{^RF^{d&bp~QewI$B|G-AFVz1!4-hsof3Ni) z&CND=dxiHKC{i2NZ%9@MgwmUi6>c%*nxE=YExVWjNJ5CezA6B94rxcG2ZJO$6+aUX zaF1&Gha(r~29uhCn;bPLgHa!>R2sKbU(o$EzXGt9u-0((8bol}jGM2*CI^Eh#9ITv z+i;W3EEOlxHS2=gN8Nq70IZGVn+pL_VEewv_ZE}ZiYMgliEWs)*7B8E8w0b>q#nfv z6W(n%Vbr2ZO|%CGE4Zppc_H;{d7b>=iC)AOkwI{9?|8Yv^3RaxAa3~*9lfR0CEg4f zkH&1gHNN7Jh-U=Ni&dd-69Gj0Y%2J}S%-|~h2wC(hf&*=IhOY{)dW>eSs+?u*M7>* zF$QplkeT^bMsAkI4jcbOM~=ge_!-GY@6Qz(!=&R zm<>RnI<+r{+xg)*An@S$knx)J{P8h{$;y7Ni_2FWo67`dl9OUZeS}vmg zW=Z3DB(+B!#QD~?1vB+ue9f}ohkxJh>WmIlMRM;TX}WRf;v2RV@aRoFCO|T+!aFm9 z$!V>vcPV9p+SFTcUz7fL?f)aB-T&}S^TRm|j0Z2#G0&)8G^nmTwzd7!haufwGVyq+ zIp7v9u4^TAqZhVui5Yux0-*uT1%V=F3>*fK{%+@~`KWx1Gv6v$y3iS{5zkM3Q|zE+ zXJ7tZ$NI0(6rrjzxFE2=xmayT8!uNVCmq7`oM8c8fPb>ylSB1y4(#-hEGw&z88U_Y z#?uS3deo)psEZfCKO(G8@YRm;6r*WR(#_A5Fx=ijPLWspZD?ERKNHViS3>UsYJzzI8H%KfRjbyu(BH8d$O^B!t`M*y< z_;#tRh3xL>nJUxaNwN-v7%S^YrRBr9-}q;ik)oxhI&nqY40HYcr^E;QTT&{Co=kPM4cc<6wOtPf5mkuMOqqhg_(iDdHqhh zjZrzD>bDY$$0W=*pa%8V5yeU{{^Q5KhXR7zEFsNl1}im@dNeSX;T0)=9yLYip0%TKhV`ET(=W-)HSUPvME}GjR zWcDk#3s9L+5SM}*JacCJ-32>E@xO$gSkr{Q4IeHJWq7p?KMHOgBBLNG|LrwTd;vkc zTL*D%b0M~JtM1n?%Yp)fc2I0N;ONNV?>90uRAOo8mO45x`H`;8U**Pvd;`^B>SV_~ zY=PQ04Lb+Z-LwuAd=*CUew=#7IUjWY3Cv4m9H3b^xQ~j>$gVORc_KG6auM!t#m zYO(_TeQlo3ibBn?ATNcJg(qM3=~FtLjJY?%g9q)y!{XA?lf7Boxw(EYBRsn~k&!-u zfx5+MQ?ok*fB<;N(bTo(^_8{$=LM>b-uc- z?y_#&V`AC>AkRa}dLUSj2!jCdl1JV86}ITKKQ+DHh;cXUlN1gP$<3S7bH-xg-@ak$ zh1ma8J=@=`$x>Zm)8vu88u)khWrjo54M3|gyl%sZ2rVY3b9uxY!NP8O_KzB>DDGwR zcZe3}`YosXoSPK>PT2WCw~5duy(anHz?cMqx{g*9yPZN@*fRF z!&NS!Y`+0ziwT^A_Jp0C^8mr=Ib$x(e;7E4c6;K@X7?5#E~N`oUkl~o{?LWt0X}ns zZLRPgNM$ot@vyeDR9(*j0A7RA2q@Uku*T`>W~pYerb*{r2W$y_5)^jf4oLELA^Ofx z4rjMq_yq_f8ujA#EQHfgRh0mplI_#a#lg)UtwvLBrhs(4lZ5NWGJ@D>rxNF|{ly^Z z1(4CuT4olfgdTw%s!_XDZ*Fiop{!{CAn?wG^%JRSk#R7)H@QoW7B9HkpDb#gA2z>1 zTzX_AtM+%Pev^;oh&n(BO#?2US{`}S`ucm_acVOz<_+~S(}@96rz_^d^NV8QcQfKE zw@t5-9WRFyYZyL_JpSEDfiG98sk{9BH9J%n0BUDB^2KQIb2*$TcnfOMA6`9{qvWx* zl^YCKqH$bbdI*kSJ4FSE4V$+oHQPOH1EA;go?`XY`prTTIl{nOUhz?31#gf)O^9YK z)hi1FNBVo|8uZq{20#U@)M8S**}UZ4QrRsko77?_UkV?FB{Yv(;^0-W;49J`Ai!f>$5a`i9Kz7g-|Xy!A#O!43$x zvGRJYCDKRV$XvaWotrxis=`pH5T|)&s^0Q`zWxH@G6dK|!AAIDd0L|4mRgRDRlXH= zJ2#1DcNR$i#yMDuVm?+>gd$TZt00KV#05u-iG$BSz3_^^*df?X|cN()-M!by|Jp}=~`b=3lRG8@ZpY)X*@4vUWIXRQH1#MD)m)fI-LF}GQi!Y<@ zoYk1?!c1T0;D(Q%%*9JSG3-Vme_bBnl7Iq)gZP=lo&Y`=w9akF*usIT_s8422L&xIe!@!P%X?(54hO7Ac27nyn9@husY zced$hdWL^atmapX+X5^%hSV3Z02bfbExR+tKn4ZCyk;a+U!G^{iZwnToL?E<$ePt* z?{(EG#Z)F}gOMd>_2trO{!9Er*%?gTgcL-3yYq)y8dvNV2YtQUb%dsijftnj`cql>LsNG*=}9^ zX;35)x7{Cp2Ht6-1YOF6u;cpd(xYHk?fuq-qxu$qA@kLUp&iTN8mDSSr&3_^mn9XJ z*3!}{D0Pdc4v0JAHR$_6f`3#Kse?eUYE)G`bXipWw}V!W{0II?m(VpP4h~E%*c*dE z;WYge%K|BIOK7U|z-BZS>;NXrj%e=G!T%U_YX@?*gn=~)DuFJzB$iPEh`n#`X5$5M z+new1jGBK)$W8oa&ckhTL`U=9`|P_zpC2R1EQM#MX!1zKLt@r5mhxR3ue|7Mu6i?l z`6`s{9mmEg-jaWt&N33j4rpil5#Z}KRvZlO9t{mtIsH*1b#-EQ96D_lhm&6xMVID5 zR^_9&da*IR$xAwl?d8s~?*m0Lt=nD!C}<%9Dj{54{CU*!Hzo9E>(`c@X|wKQRoq*v z#(;c`F?m^tl!?`xikWDPDFEN|$#a6MEPJo7+dQn;vXBv%j3oKPhP$_Z@>pkqFV=ljMuLo`Lo2Ms+%i-5KTF8{t}*po7>^-Z|{74 zv`+2OuioDLy5xg{INL>_S_wwh91fJ*3}p&p^2_exuk$0kQU}$GRo^nYisQw5?#) zh3XN(_84JH1GQQ;Mb+!R2H)Ake!hS{1Q2w~FEsgXSeW8J1UOkcrqV$USh+73zI@Xk z9&yy!sjMSeUFV(5!C zx3B<=CaYS#qN-}8PA#jYpVKlaTHOcH9`WE9I*__&{bG3y{!M(C1B!xINbe;%1RPVG z?*M24xkV#cE&0*1ea8z=5lcVI^>JMzwkIBbAD?vcnQNSW9Q2^~)3a(wAR)i(mr`BN z)tuu@u1y;%>r@25kWo7Yf5CB#*lqgUD-KXI3bR{OQ|}?WSA~Yv?B^!~sH>WqGgtS> z$GF|*iy-r^UGk>5hg`eLvBIL?(_tl9E{6AK@3^H}tyi1j4vO>D;S6!Kn?`hae1CSv zBC4`~Yje|0vp{0ofP9|Ub+^n_yvSzbTc+SuI2pLJ^y4Bz?j`7y$2+pb6fX6Rn04N_ z@_8Z=M=|Iy;_zlRH7ASTVb0Lp+|+7OzBuIQ-5<|9;ma3e!~Cs;gjdiQ9}$5MJz=Cb z=30anP(wTF>No8cqg3?iE?tU`7sBInv~}TZJWc(&yLolQ*M9%*?Cs+d@Zm#%zrTLI z5@_WCwZhgyukNy@G-Zdo_l3(5!NIq$`8L=s+yEJxOkgO~bx<^;6HKLRIw-y4q~XzkXV513q;qReCaBh1D5QhkzrXrBA_| z*Q=*M{Hi@&}a%4k7-t;Tp+?x&^*i%gDh+QAHST$Sqv4h>w= z=xL@wNHAoSJ zff{L)Vi!JQa){d_WYyPmM8C?8cs<q4o;ZXyu?4&c$P)zc6gEz7b5H z&&wy$-Cr@_L-!TfZxiSpDq-i{Ym`TBO(ubK7+c^lNiVyhcp-rIZv}PuT1_ldr zuV``Y3}1dGyKy6INk>WPyV7K)3+*dNMg{F7y^S;(tz|8*1l#A{3(t5jX%DT2bFEc- z@t5C{KYZv~lc>vr;4^ypx!)$e_*HvByxVSyY5n~@T#xeN%ZP$X7fCrLWLlK~`-84O z(2|yadL>OEGuZ;u+pY6BqLRF8) zBQ=LhOURtwh{ku=N1C}@|K&oDWx&>fghjkiN)=*b`4AnjGU~#?&22I8B{#=HP_9E8 z25oM>Sy^p@4fz0B=CYJgG57g6^v9{{B5&Clv$_of~4gLUkdMk*%XZ4o~Ss%LMDZ;|85! zZ>AccbiDB6vvXJgD9mM{eh2*tdh3CIJ#$CasrJx*xCy)P1w^O`blwdUF)`4tWOpTP z)94BUv8R_`hT}F1e;(GHzdsEvS`c#p_oC`JI2-QAkIz1|banT^Y>Rtg8P$0oQ}{2*QgB$aBdwiv+4$4)5Uu^#z+_>iU1 z4|?T?^WDDz`tc{@rhhWTJtNgxoT;y&`v)qR&3iIHo&`+GA#ri{t)~WfZ49^O#e#L@KRIrLXs&w zYosh6FFeb@L@mw5i3C7N(sbZF$Xy>tux$qWAw z8$Y*Yr?0gTg4zs4!L0kYFe7sC;lqc4C7du^a3vH-7C-}r4m@FE#05sSCkPbg;mhIS zdwM=*Gaoet0GUAsApT*2($c5RFPIJuarbm7aI>?6+GRN;TguBb0RL04aUN^BUZ)y9 zjd^-On;Gw)PhA}y!{Xv(H8qo9*pOZaYfbM!qC`pcEbvqT+3jG7U2d*Bd;-gQ|8Ph6 z3OUc6YdEnnH|3(adRtlw%;Q&ASAnrZ;?bkU`FXpA9^IvZeBgT)zeawr54=Qyfq}r8 zDHFvb6U+BVd21zr4VWn0ju0up#`E_4hB!^W?4vRsDY^|-<#F1ae_{e{H1Y3 zZ|9U^C{!H$ZX$t0Z(;5Q0+WFEzvzJ=B}GO?9>A?jNT{e>*SSSNN9!Uh-TG8U=6Ibp zxQYGVg9l#VoV~iYA18=dFN)Ss#rBd2pcEV}ZUyjoWu-%audl|J7x`d$k{;pK)!&An zlk@xhT?Wu?W%${_Mu4+nZL{&d?f{Z5iT89EezGw#O38IVO;GxXouda}s0z=Xb@tDK z>e0fY4c=wjt*vrMAxrq(TzzvvAWkU2C}FAltoyO>AJo+Mq0)Tl4h75=AO8^cg&JMT zmRCSVz+KAK8~PQLb2Lh9A8>Q$+}r_AV&LS5 zz5n5Z&-cAO4`@~~FOhoqklH38mzA48y2Bj!vKV+9{} z2#A^)5z8%%c4wp+?WU*6{k;dwLxDGB{mM&~eEqP(V5vr4l{b9ipVQK!LzS1u#Xsle zg-5C_Bbtd4ds?3|B4-)oKCNrB6BfkZLePZln=smxWiKWq)iJVOSGCCNiKp<)WK8=a zzmFT#+B>sh^Ld$ZuTdeWhbV-vqG#5(Ue{MVMQ2KZO&V!bxYYXG^nten>M| zV&Mw~XWs^Z#!_6ppEo+JIljL|*4^FRpLgt0{|tn5_JEoRJ{QAhhjX>qq}#CZV`P8c znDJQ6yMT^oH2Z5!1`-lgVJsS{DPVWpuHd_oP#zUjam$f*I3a`~Q_}jz>h7Ld_2>1` z(pINrh85Ja1+^z_iVNNfI`{@Qto%~QFonEr1qvxa=B?YB>q}B8O6&MRK_ul>wZ&4F z;g@L<`gd0-imS#7rw>Cy`&lPoY+J z1d5=~$H0ooL$ev=o*45Pk4YjiJmGG<- zsH!I>=4NETPa^z#^82^R`KZWZ9H#i z2ts|LUKSDxPnDx$MSp@)#PaB&V(~|9C8a8>_!Z#&%%UB16My*dp`M-;=4Zl4NSL0B z>plyMASY-2@Gu82ZzwEC>te8s@9PA>gt4&T0aZU&bWUz=r=P90QC&`?lEgw#=hOY<>>vf|{mYtASjV2z5mQYsN?Q_H&uSRfUPjy+rfx_oz^2ImVv8H z7qS^p`Z8QwO6zM-Pw(+-*pRt(SDBR7J(N6t1MKwt`Dw}{Rnp|)jUf8B9~mEpFf(nqBrFis1@9-4L)knA?}8!EQ!#L zb-%o$wmqA^guS`2V45N-c}P%eenp{DdAH#1)h`qM2+2^E-^yVh!(|XJdjhhYLxA+z zrr>8A;0RvPCY6=Fx#Cr?mqCypu?=_@K|w+3);wt!J{}$@@E&xh$x#V88+Rr>%D99u z=koHFjT4}~hC>EzvX+*>_8c4(Feu*u3Ep95T?7x zHzlp9xFAz;A%*7I0{6V|6dFh#W)&;A z?Mqe1Ddc$;jipW3K$k>~QcLQy%#@yJiRSLRdrp~CC3m=+dxH-GZy{eu1b%GzSQk@s zM=~|Phw8@kp}MN7YL;SCM8p0*|Jw#V$ZcFFRx5b^d7T?@c)%k@eq|$|-Y_dY(;C(v z%nVF9ywZoxeBC+s=dcD)?DpnTWK>jKyw0ca@Qz8+xkVd;O?;dW=^Fh-6)LEK{K?%I z-sDW$p4teJPiW{Qg2=YBbM5|pssZzo4>-V-_#J*)GX0a2IRlJdynLCSwlk)F=3`sU zaK1hh9v<^8s0b=wBaLiz9?pin;GC41mewSo^h_7FLxlZI;SAvrIgMVvcVsk;iP61B z;)(J+FMlN1%(4#Gy49-Y#r;gHr=)ZNE_tSTXfpj~n03)ZR7^}vk^sCmNDCPn4yOmY zwrOFy=ypkfjiXDxA0YCo&}lpUr{1~`M;`7!>r(46}%)nF(&7dP59y4tR>^!p22nIb2htu_7fLiPVxLo9X zQ{4pyxHdL6H2b^vzjfwsQeh}1AqfC{sQtgbrdh+Y$m21iHr<|=O+fO($y!%}V(s zu|j71#fuj!T?Kdd?La&@FfPtNHnuoA+9pdSwFS6PMPjEXZ4zHkHbO1Z?O>ec{oGh> z9zk7W>Q-BHsXqn(edpa@z_q1W_UiRW1)i8!#d&OLXO}~a&c}-cVcj|&`~V7H5;vh2 zBF9Th`>`uH}O_9}@gRQNts962w%g?I-CvO^=Oz$>OWLG>EPu6cMLnkd3?0COVXbEj@}RI1O&ac3lPu@9wIYWa|Kl1+2f#(p^)D94U_NZ7O?e0F$c z%;J{8_q&DoSopY#lAK)Eu&+pw9-Sg>RAP>NicG}9dc$IDZ0vlrMMu6`bFqs>`*Hl_85{cKTG9yAgCu!>V*Rz=ZbZ`Pzye6^}i{NNcZ zk?FZbZh<$i;sXPpNk~ZO>L%tc*QSj}MQ|MLFHS>bR^SU#L`%I{X-fv37vjLW)qCNS zahV%KFJMiLYiC|qdz_$_QkqU}4UAZ*%i%Zdm5!+CxUew87cbqwOO%?}y<3Syf@Ylqw<<0KSa+I4Mh zv{D_p@tnG-e$P$)CO_2wL1JDk}OgJyzVWzjK5ty)EjrGgtWPh(wFOT1%a4r<{mA z&fvMm;L>2FjI{JnRZ2=!)F3jRwRHiy$PCf#GI1LC6&4tB0j&fRBNWZhQ&ZYSf{L8%M-lL@MLf^bY@Ms!%%&3FP;2uGGOwlq|7k*m{X&sOXghbPmzn`T`23gaBB zFX^Y%@HFbrHpa_QjTKlLZB|$2uiY2*2BrfONVf1gmh|OrVeXz z&k08q|K64JDk?5&{So%*#>&PlFWF*=4%^U+1gl-xHji3oBt_pYSqwEhzPGYNnG7}R z4ptWSneQ^PZ$uJI)TIb}2B3zP@Vb?CEX@=8SAUkrlPz#Ev!GgGTLn-#pTUy9mjMLf zqv{vOSEvT7E0e?f^L($jG3X!cZPct(ZG;_c08=^zul4p+Gs}8-rd_V~*70;WZUAKi z-i==%oHl*o0$#`|`AN^&w$Xcn1;<6^F4~{IABRp71rx%(SP#!N4{@W2ML&`WB5M?V z554S(&2~K=zsI58=fQuIJnz*$#Bf;qJSJAp!2sDQQ}KvsR-m z3Kw-pTUuO}zb|qhE%(;<)(tPD){gx?Q*Y2QGdnBn5=Da^1X=`S;brRge#NM=&fq4$ zIL$co$J_Ci$U4o7fiW>f#>lGM^j8LkEX$m?M4d&4H}9@Qb67rj^VOS^tR@KWNUz~6 z_4lpTQs9v$5&iMOd2OqXusdwq^;zt-S1JTxT?54lb&ZT@-(S33HImdoCKsO?866#V ze{=|KMH0@s-my6T+PFRD^?HAXmTcUC{?CYjbLXreP4KnV3$y20CTt=m?BG5tE|<++U06yDo-8pt9t24?9b9Hy&XJ*^%C=e?$EDNe zW9@hEFh9RIPW49YVrM^!MeUp1^|tGx-@gkY5DVV?rERE>2FHRfQ4<3--B4;SG1nRD zK%vM=540oO8Y^)-#S32_#BwPp4u5=0+=}Jj0fJSH#^34b*d88rU0qMxCB;OSzcMJvgLH8b+#t#UyNOLCRd~)pQOECGv_L>_UY>>o*P$n58C({=N1|N^5WBla@v;=b zITxLu*~^xI^o#3SPQSD?oMK8#hXsX>Ta!fCSR&ux5a=_Cml3vGc$=Sp)D}$*Y9@B> z@uj6!@j@e0@wP);d5DeC&|2BHaCpeyU)k>8za%SbKilD^lUQ2^PHAtFym!M5|gebKcb_xp$>i2QEqcF4DkXMg~XMuJwQ*sobF6 zN~tvc`52vdIEmvR20{aMZZ(ZkB~?{iSlgv5L(yEQcwQS@(#ekaV<*_;*0MmY8mf}> zG$%)+MJ>%!`sq{NSHDB@tiFDhw9J!qAi{DV{4v0zfxHTj&6up}pi2FHP^Q&L=6J4= zrFLb3;)m_7jM*g(ye)xNjbkDT zPV*n>?g`PN7X_;?KpNvxRow;CRh5- z#^soCv#yLJ%S|@Q3>KBRtbI$9Q}pz6F`5`K@gw7wl$L|0U}N3BOabJFr}67GV}4oe zV`%w4dFGkIfZBsMolA+yTJ&G-0T|?k{2h#~JlZ?s zy1(z}>513MqtHGkyqQxv*y=VjTw>t`!oh4tfl)x6o-OF)3JM?P#df~>OsY3hA3u84)ZkX3rkMU>0W`H#@A6-~^`1aF+;ynd4gdD-Ll%uIn+v^ndG|6ZoidmX zRB{H9<%REjrPl-r7+>xz2SXwTYGxs6Ph>zchmBtLVC@?=k)~E9BY&&e_;C52pc89v z7h{bK6vg1x@Wf@pp^B_%uJn>)<6ujB(mhD}-UZzB1y8oImN#L~Z0~5x%E~HOCrM7y z8N_e}eY#;~-jg1)K}SbxY+_RDO#Z^!T0syGZ)CrMR%nYEj?AP1!s_*x!IDx^!1}|e z59KFaO=oi$5;n>~RrNuf>am*)GqUTY`f|)XBN+xxh-1EEQ1h!OM+FxCu&Q;fyIG|s~d&09eRJf$1QV=TDo%-sHT(ga$abLnQ{0YUlrXUuxnBOZ0X={53%9bpt%5}IK6|zk z9IV)?IXXL(CO5savAN2_VI*szHA+HpXne5i(H6}eDSWI|;qvEh+>^f4!91P6c*Xxq zX=xa0b{=}4XJ!-zpHNZNKJrafwG6{0Ie>bSx%toOCz%{jZH3i1^hH-Un69y<{S>R* zbN6INo&m@lYAO5dx%x5Z!ZtYI;q<1x!tZuurP|LL8rM)ixtgt3Y=zK)XU7-Tj13Gd zciO@E?^f#aF}H#M!WsbkBL~$f`D|0w*omB+%s7jKjz7~e%-N6CSiv1px$+1a%d@$- z2=3LXluCzN9_%m1cc%rw&QY+xe!5&N^*mtlt_MA#L7{TGyW=HO0`K2nOQHB39--A2TR(M0Bd5fi_sx8lpWWj1U#F@aSeaKaTWN|mRAKKqG#Ci%hPSXT1X1jY3Wj*MizWlX6k0EiO5+xZQm84c#IM7KuD%I zz*0MV&T43&$nk(@bg;s}r@pHC*#33K&oi#a2OF!~s7jD=24X_{NRYq$Gtw*Eok2A*g~C6>(&VA5!r9|BT{PS&r!aUO)LO zM}zvYzq#>fmCp&z2s1Ew=j{w&Atu=SeylPw9lXQN&d9zVzfuT&oA^e7+m5!V*CL3L#d7F!q^V#X7 z$x{?9WJN!p6UQD_v?ma`|CHI5qev+vHYvy$WD9PQWN;Kb#;12XmRIbi3k=*L-)lZC#qy=`ZgvpQDka(w6`8SH6n+%qh*T3>%W-)%HlWO7>~ zU^(yaviQ2_iy5#``q0t*!a|(Omz_3bFu^&$ErYJdmE1hz7cqmENbON`R_Za4@P> zzde2j)ty$Cwgb4FGD6?8Ss=(P?1Gln`SPOW>%W4be@*IF8}s=~SR%BC$7ftiEi72_ zG}lV=@4F#>wnYcsRrFL%UkYV9g30Lp`flxLcXENPR+GogwY1>fpLxOB#aDqPA}>iO z`M$bZSwtkl-`^e{gi-(?T9QR2mTHLw{PsQHyV0=6cXwY`c{M2*V4p;c;CPas%&8=e z&zDjwiW_hE1rH;W^?lHYBhR z>Z-nlg$0JcOTb;BH$>;|SuFWV;Qxf<8vDX%Uw^-itvPxf3zS?{`*E08q-A9V9hMhB zvyk{^;krKsTJYYzr5}NKe>Vu$Z{mS22sT>&oCY|Tt71QWQfP6Fb0s$2g$aDwmwg|n z?K#4%e_2*WMyJ>`?!WPW!-+ZMl{}R&9N?e|~LhSbVu?C#>)+)Z<-ma^^ zeSD?E8K0=@+RWyf_qWef?@0V_6s>ios*lShPnV+79}~fRXUab_ zGb%I`DSRvd1i{Sq{lF#CkYd9t9V>Kb1ji4Ys+qS80cRWw`R>uOHAPy((@V&k#DIe# z(g0ii^TTr^>FH?jFCi7=I|4|`o?q#+zkgN4^a=VNZCcCr3>NnzLn?#A(sj~%3%$) z(@lZ(BLHKdh)nEH%~dW`uKP0O@q~YA2AX8XC&9D$c@Sw#V>RwCIJ=GA}I` znMenaBVU-9q=uXh1lBe0lbzxI{d)*>J)w8vIn2||be~me%%D(<6J03+cHqx?c#IrQ z1>aRBDr6348{@HG8g35O$aDkP^vO&4UyR44B=YK2S!}Gb{4dnUk53;rO`s9`ySwFO zwk&e7D>eLlHZ$p&&CkQcyxO0nIFwkRtM=1Q3D)EvVSFr+^YC}@g7UQS(pBX~nwys! zG`KCFWM`{``cZYk6R?O*Pf+ z9R8V|;qTw)TUu3psHxRjTxA7EkACCj^n#DH8b!vzp~}7{-4aS0Ri~fNyop(wEkLTU zxHh?4RwfRjn)LKTdJZnmExoH4FU!V85!ZJ{`Fi0$ifOE*TtDr8C205Z-u?4=_l0j^ zaadR(s;^#QOr*U08%s-VuPevAUpr3Lr8MHh8%IiLI7EaRFtc)Ux(t_{r=*nDD0-7T zNO$V^%Ez9J1OlkC)HO<-S8vV0If(7m$2Pi-Is07f>Q@Hx$How8(f>Ytm-%ro4lE6=FEl2Q)(plf)jgN1py#DFO(7d{V|Wxl%|OW9z@D$$gL<}IOs#0|TxLER0xy?ps?4RYCP}245SJsiF3Fg>fRWSLSlVc$A74`FHcKA(K zS1K2djHM>o|6;0qM}AmxC0CToEp=}ZADp7YX{-3XaU4?Wx3NcJYgmQ zvp&n8+_?%_Q_!}%Hq_A#bJ|<1f$VVI8R_&P@=|&&a^I*ON44Mb9rjM-x)o+arQ;{(tv=?z)JJ+g((2nY}O-VqxE0^sc6j9ZG$>FfOiXc;vCNR*6wZ!G$X^ z<+}Bvf1UoXi#`}LlSdaS0rPnC1_v`7fB^wkNcxRfeuoshMZnZ>WhK3UjJQAP##(bQ zhA&d{k>ct7r;lSi!&Os&g#g3^^nhe#kGT$VHP;+$i+a1dm?s~~b?7fICucDzgEyA+ zC|Wjl{a064deZ5p!0K^6833m5-|wVnWO#av$UJ>&(%+ssR{?2BBpLzIwuWEbDZ%ql zd6b!@dJeN5UcHb}zIGbT$@^mBCwJ9PQnxiqINI9U7JHg&=JZrl+Wp9amPaV0oj`%t zZLB7K%*pDdvN%|ou5ugIFxFUQ;)YX8+rxS?e#CczE>cj)008U?#o%?V&9yZjcXbmfC zthCb|YU;g%y;^Vqb5`&1+mi#qMU=2xK^@b%KOav|IoZx?;O+$n#nI6UDyyoRbxzmp9g(pG+|#bb9X%C!3g=P_oS5za%WoGdS3y^AWfz zB;mO!f)n!y^Tx~P*;YUR^wG*_td^E^>}gu!tC=s0;2A6iUnR%KGBTXJyv1T(vv{@M z-p1gOC!qv=%k5d7K$mSBx5c%H@ev0S7Ilu1#zxJ5IsXng>B(kO*4B0v7cT;h2Qn)T z@RfowV{Y^MuAQ(PESlD^wr4Lq6UAmNhqlWzGJMXOogQoH(y-*xaUZY~(FTdN$o|U* zeZBe5Zf{LZWrwjm>O2NQw>d5e=kT}P}t4L5$8$et}dt8{k5-83wc+bd!*J)1~gk(SmxWfDHi*=iA0~Ibmpi> zMn&+1@ErAI2&?8qY1Y<+9Vj+6q>%IcE_B*yS`R*XS-6`392&)O6^<@8 z8&~0OE9RSn7ezUqN+LidO8^;~{8+WJT!xF=!3D9JDCXsfM>hHUp7s&qHVut{fC{<5 zj|%0}>B^IUIM!W3GNmg!J6krEk63GMZB4DnxU=>4#`^m9%9z{oFz+7y*3QoH5qbrm zQh>qj?72Y^Tl3JL?&s_JT34v=3F5<1GOJ-R96To%I)XSrt88vr5L zS@)gJ^QyWoCIvu?d+8DoArgy5L`UON#|gRIq@+BW*p7R2t)OZJK&#-ewuZ3;7ydn5 z`tdM(iXl>*rrhlqnD$0qvPo-#-X1R4kXXi6%>BWXKadC0W%gdqZ0xy4j5_HJdYYke z@29|g=h1B@CMJLlOG`_aOwY8U5seKEz-7M$dZ5IN(Sd>EGc)!JJ$GRRK6-rW7_O@8 zVmM)=e>b^ zeE@f5MSVV9A*(0x^AT;RRAE5@pTjcq`_=7jkUYFwVK?)W6r31v^1{>FS89)4*CraQ zYW7kY|8~#1zc?AdNq9$jc{$7)L_)uMddvYl*qH+kfFlACn)ahPn0{rny3!n3kogqn z^h-N1$wGHG5NU#pKOY|-?Ek8=s*cvy*0weoRn?tPV%ObquYrL9Skg+b|5}tc{+O}s z7^!psb>fcUVNETqk)ffX-d<&UL3;XGFDlmvKDz}brlsL>=puL6UP3BUohB5q;*v40 zl8r(J2fPziI#z?&0JLukw6!f&0CKFd63s+4R%8-fQ*#t@S20uQuk|}P$@FyW?eAZ| zb`9z?iw)B*_wV0#b#)c&Oi?h^dka}g}FiHQkpA0Z(jkW?-3 z1$kb7AD?+ZwvplkYlvG<`ZIu8W#s-hg;XaA+>6wA2q8IP38Squ+_4dwwo_hNS&Lq- z{NMh(irFjg2_|4RuZ!Bw{h}5Ss8URmEx3IM7Mg;bT*~R?#CIRu>&(Wm*0%lz4(`YD zcbS=$>@Q$_U8G^Zb7${I;K#*&0MxPHronmeAS8B92ew1f7kNlKeSv=!6)&zWA=zOG zD)$B*^USD8c!rhOn>e)6vdIJf9D>0Pqbm{))#2iub(8IYq`K=0} zHa?z|AhPO`X1n$D>CNh6*X|BsReOLMoV!zCdV(6 zk&1_ixndJ)j}D-&IMD0RDY=L}{uJ1IejxYS7Qp&=-Zwhff^*0|tdUs1AWIK2WV#`?HV z&{7FHIt=qXlfR{;Oy+mfpv2IxfT)+w=W&40^YRD6oW=4NCod7HQwpU2C%Io{8VJ>He^TAgv%XBG4g6aU`>E()_CMFI(T zP`+_|%Ga)QE%mlqj|mwxWsDHwQ~7IGJ->E+0iV+R^+L#hC8hL4rBDh;l{vf|si8O= zbxQj3>%~{B3YT^EoBVxxiz zUwUNC_;5eMV(5LQsfL>y${zK<5BSw%KA<-o&CAZlD*H$y+A>~`6Fo&VA{z@p?y2A3 z{!2I}&|!{Fd3Rvb+tsRkPry=hq>fZuxV88W+apSS`5kutV&C2WGGjNrFwc92(s?sb z>fyhsk&&I=S6kW@urrKJqn<|6yniE#$Rhm%fryyoJ+mZ&p6o& z3qa0#)7H*ctD~bsuH#2~UNYdlbJNRB&%5FJ)*U!!2_G5%N(=Ze&7S@c<5_=FUC-Bt z3z_2G3>iTIJ+{>-CGR>a@HTy0{BiG0+p)kKd3&TsmMZsR*Yxya|Jid}6y&U0m2^&| z@ew>P)~AFI4_YF(7uurF(aE`zlc8GzIZ;-6H~IK+sVBIsRQ_AcoS3YYdljKQicpke zZnSzy_us@sRjX0w`tMUoc`M=3+|h6(Wd#Hr6bj2oS6Xk(96kz2_|A{W1!p04W8fmjiw79R{{>iu+Td_`C=BX%qAvYQ*V zI6`)%kc(S*W_;~y|IT2CFfKLM(x7r2s1YCxhKtRS4|o}jyWEV}CIdU)Vb4B#R9y0f zLEm}5&}jB}9~6fY4s=0v@q-@>EZggs`8dyZmOY>-6Sn=RB9mN^7 z)oK(b*8QY<)SdQ-Og2n0jeBfqAUD>Ws=d55Y>SdTb*?WRIvHz^YnB#^Ha97gC3*{s z%twnCTP%jOElWl&U*URf?U-ycE6l1BW;aqoB`^R*^0<@~pWyCcgVut=LLKsz*T3D( zofV`$5G3tH+>hQ_BIVPU0El~Ty=N?slS*H@neeLw0=>}>#B{Q<1-UPQ&zDb5j)*?Z zF)Zx5pyL}yL^Ibx43E|5D~Fv1v;GBs9u8E`yrg+Hd# zL!66!K^DEKNG<-Dn;Wje#BCXJSl(+k{QP3zK6+*PIQ?(jg231s>(&m{&R^-j^tT_0 zV_{voE-C&{i3mSlp#18!o^S247Xv?qZ1S+?&Z#)->4_>RbhgID@>?A)Fp0Swc0fCe z-ejYm-P35USWaD0P0_l-Y-Z~3Alx>?tYtdzWgJrMLXkp({Pd3%6*n5zM#w2*EA9QH zpL}Aebs{I>w%S`aq@#1{&+BMzI~-d=Myja+L`cW&AfG_5DtgF2uXee=FpWTOy2Juk zHE($=tADxJ4BB#{%3n5*PBwWEtVv1=1H`FyZ-Xq18Cj#}A^*%r`pFG;hvkTG@3>vo z8dA*qujgvBL|1&rnK3k6@uOsU|9r2Rp1gv;^2X|O4x3*ER31E4r5lkd!D7I1pKC^OSGQfkthEAqn326gwh;NJ9 znsBG{yXiOAzmnA!?Lm;gww47-$9D79Yd-?Ja7s#xQJv)*f!%4oxnR9uZf)&2EcaO?6c!THHGk86Q|np~HU&FPj*{1UWq(W5yZQFxk~fPvT3+~a6r55j zQ=7{p@JI#R4DWZhTiIr1tHu-OU{FuG8)Wv9v`lZ{wJhEcDqHP}DN!ZKI zbzO9-u`z72{;$JXakBcQ6A45wDsvXEUzU}Y)2Xrt0l(aLer;ZgsRvfSzgo9LW6k=q z_tjP|iw__DSuLJER|+8z?Mq^+-5(q*U?Vp-2ZYq|!Q^m`M*e;3t5-$6UFc;^!O+vFAJ=Ao(Te60^>zxNZ0=(YQ%O8{$#hqlsVoja$C#JM2yDO`AIXmE-8=EA&kZjD5>W6DSnie&#= z$lcrM9kz<+I*%W3dpxZ7Oc6}qJB}?cU<%Rszd1(D5^yT3Q2^TjJdy%5P;kO^aj3SU zOJZ8uQf&!oDYrX&XV0CxcIC>Mz{?e<&$zK9aPjo^pTB-{E1o%f#z{%JRlxu9r7qqH zvJKxK?<}6|*0Z8SLK1kF$4$rPP1DW9#GE=l>@MG3{wic=Q)1c8R@T;PH=q_l(!*a4Ymb1~!A7NLIrvcj9&>i;j=3cTy>&CdT%PF^^1 zVo_UsRMoF*wZG5Yt9bn6{eF4i_R-4A%T8`%zIyp;?B-c)(VkLsD( zisH|AC1&$ZhT+V8(8_ z7o8vaMHZS*RvZR3DxWL`-hXoL?(WR`zo{l!A*yokZ|?jI953H*UsVE3dyj#)gx%Vr zx$El2*xjnHuP5%^X%9br{yi$8C?tcEbw1lyH-TL@VPyXuflQ1b=C7`6NlXE*f zJ~KPB_W9GVbEi)iNQ$_>FH=%dKmS=|QsK?hm$YV>WNmqN*+0ChV$Qd3@9wR<{51La zsUK^Kl9F1wy#BtstNlw6HiC6H#DblJL1Fm|&0t`A=5ofxL;o%<^#biGId}ei{l|#i zOQwkA0td=@dvCO~9CHH=G9HyXS@CVnk>n4+7!3{zmX?$Zwd(N!9u4nQRHW>Dc+tvY z;AsQFL9>9N(;3>F8h)bUn~t^m@qqaKJ?Zmv?)|Cw{HzMNjrY(0xW$lE!r%aIG~6tI z=dpH82(YUwFSF*2PHE(k7S7D@btdzyxBuLJUklM3aS6Q%jFPSMfW3#R&1tMFR~GIr z2eypnPW}8M@YdGsRxPcw)AYmP(^`E`+$0q~2_uDF2et1gkG^y#8Pixw@u{OwDoE;l!@ zo%z*?jpqaxZ|KDf1v~2F?;dfv2^-M7;sWZ%2dG4^3^{yim4UHw$$^ID)Acm1{dA{I zpQH2go~^b?NNDu#-ud$IF7;B-D$9TkX7zuU-rG@_SXOrB%F6#|=B|EYu{8+j^@I6) zr+$9W*tM%lTVMa}x3}=iBpuEk1;-B+cja-``W`LZ|B;bU`U5VC$rQ+3FuJms?)Ecs_ph%9YpF zuYclW>XYc_mk1mT$_};N>-K(c`mVyoo19@;*c24Qs}66D-u`G?PNkU0l-lokz#RZx zn?7HWX?0owbnp2iOX}MB*p%I+{N^Ba6(oUOg@#vQ6DCdi^ZESGl`DZgqnnXayh1}= zL$^BaubVY(+NnP1(7^&RP)8RAt|WoS;9%SZpFl2vfvpn2Bm@KK`aq!s1r1R>pnf+L y1ayN|a=}2BA*dGv1rEBP>I4Q>93{`PH~$ JoJS>!zh7$S6-&KbLh*2~7Yh?|<(A literal 768266 zcmeFacTm(>)HcYB0hAFiqLN1u5dkGgrUg_)1QZ06s3JK^PTe4&s0fUpAQ>eINY1eZ z1SIF2bEe5OG)?d6#yIa+wYBwqwYz`JEeo;x7j8J=InO!w`r?+n^nv{+_mh#49gw+x zMUjl`P$c|XLGdSiA}2?-4uAb&r6?^)mRwIiMMlOuT$F3;NeUoXd+v?i$&hP@_`+3QEJ ze{7*YCM4{CpMb=*gzy<2b>jNNO1wSJTsZd_~g@9UUEKdQ8*sqm&N4?jqHoW;9C-zVBL zK23)*RxX4Wxp{bXy3I>0P-?kd-HZId=2U+rZcS`XWMD(jlPd4xnN^`wN%8*RVp6;KiW6%oa6+^!V}_WN?v`)E0g zdB1!)$KqkwqJ>`y^z{-8Q_Ekjr^~lP=*_ghY)kBr3+A&LD*ZrH`uw1R?+GjI*?7Fw z#zGmVs-}(fQbmDv72Sow;V54-m(ka9ft>2Rs4ZFUqLt~fKo_w!deYjtmc9Nik%IJc zp@OGQ+zb=Ot@WhTeKnwWx|Y?HrV~QNU@1k>m(PIDN?Fa{-YhuAt(9%i)J%=&ZO%0G z@65olEn!Cv`{iRwDH}G2sL@tm4o+1qn)Uh2x6e&J*@eq73p?!OLmJ=bq3b`!XZzAi zl{KV~l{idu=aIyCZEY9iP>4BK_du3uPj>#G8*iL~OIEJE4Q?$dQTw>0{df?&dbWwk z#;BQ?6C;!4-SkIYHQZ>eIQcLP5|fVJ(yiLsprqy23JB|)#SNhUX0NuL?-fFB_T~(5 zY2_^y1#o7F*w%_og!Xf)XMZdYOwdN7BE7=@ zn^T_{%M!vAwtyJ^lb`zO)7Dek{R2ol-FsaDy}hCS@|%iqKQAw@BAZEP>c&{0HupKT zv%aH-6?lBP6WH<5rJaJj8fn7_$@+NhbB&(--H6Bw@Kg;7??W<9}Y zx|t(tzBViHjEdo{i59ISwk2X)#ABgV$sbd+9uO_olW)@#6WFh!rnbFkN4;lHhP=>N zt~P!;dGu?cgUbn?(Fy+f3#hFXCrlA*m*@qL3%0XfN00XK@|qBqd5dkux60kNU5N+CS_V zeYW1We&xZ?*0lD<3$}1Hb~uBay7){M`#`@Iay99ZMT?v&<4r-k!JKTpx_l;r{iEAW zORb_(6zJ{MTpR|SWrvw3M>B(6@zYKu=*tG!HAe>_@Kbe{j*=$bwd{vW5iGo;GXIW8 zSB2ueHkvp1Qr+3}p@a_fvA1su2V&)FMm@MRmo`^LqBdCz>@cXQ7*#0>A)z{Qs=~r! z)C}TV@%3RnnwC{v94epYTH{UC)VkY~ddvzJ=c7Lrj0aOLFLj&r-VI)PLM<+suUViH z7i!tdBKEK@*hVRC`=ZA`Ax?MFXZrkDYs}C{`$KV>$W?*#jEn$oZU<1?nGW;()pl|) zjnQB_6~y?3g33D3{S$ALeALq(&VeorSTg!XP=@P5azqbakvDQ^*lkMkpW!tXm2q!@`Sqet z8hMvaL>G5RbmNldIv1Pd1n?$v-PC?L?I6xs#vKT-)gTux3+_0|{ny6E8ErmNg18g5 zQo^m91237K4->LN!2&*|^qS9~2_&p)Ba+IKNXp^bK>HmnSl9>g&nQ%(tcl{|=!hR3 zT$!>W|10IRH5-cLUQuXzaDXE#92!*jA@_#kd1?;o+ASki=z$LQ{}JR@ngMJ9m;b@@zL(@~TRD%y710 z!Zu(M9oGBM@{D4RD`N46@W!q7oM(6Ln7F_?xsz)bSPY5CpzRvO1Uiz`1w0zjguHm& z6GE1=l^hF~3v835C_r!6!-TW&zJ%jhj;r|t1XTSV+R%GmZMp0H>c!iuDbd+d=h+<) z@wj{&k9; zLi)KQH?7g5e(F*bz6kN5a3?eI);4U8OTpSpj(XV&Rn0ccHZJ1)*>_nM51K-S%)@QF zt2`YANGmhA9Ah@SZ^wd>ZApPs<@IRHm{F zfd(C|!mf7EGERRNat4tfIP3NBurej>v8ObCe{* z5>U=y->aCr?wUvV2q$cS-3K&~{J8Mis~o$bdm~A6T^VeKXPj1r-^+&yw;_brI=N2= z4Fh(?^;}S2n5}YvvHK|}!26=-^S#V+hnhE6 zXX0Mw>eU6e=B|A`74nS6@2$`sxsdiPt*UV+CroN!x`WldtL1Bt;!2_$dOJ*w<#}Rs zDtlqxR8q8Z03T;&5^x+FfoSJhkA2jbu8cSrLeILx1Mi%*Ay0L`l733Rw{L^~YEKzh zVc&(OkxW$K1mG9=rjWpn*$I}mmVZu&S9LXmQf%#h7Cxg^i{URP_{GCS^DGtyjZXps z6XtPRqw_ygcU?Fie3i>HUKuf6>_U&z%4GKXKAY)Q!`|E`iT)(HkN|-`>#>iw(V9h$ zedeg;f|(Swphsh5$-%0)mN-OHWQln5mpjw8rTaAFZaR#{1dfZZG`<6 zA1#cBn8(=)-sGyPF)moIK;j}MP_&N#s6VdC?uv-B6JKBg|Q#<}q%M zP^2sIKDpY{sxa*#WYvGuyCY?Q&wBDBO{okUGTwz?weC=sp3a#SBI8Mwgg{k~zj{^S zM4)%>3(TEPK*?0BO-7BVBx}$~PJ-uNYO3&#!8u<^2&QBK;nB7z3F0mmoF4TrcuF%~ zhpTyZAVfXK?6vb|ztfDdsM%DrGK+_NShq6bu2yl9iq}D5JF~!EtB&O0A&n2Wqn-gq zkfLB^Wtv?sc=U)bSv949dp_dj<~1Ms0;l!)ZaJQ*zx-pQF1+<2VzX(LALVx#wO-IwbszLh%F`#|V`u-z z+hq^R_RcZ*W*NLbDtY#tTJd8Y!|6e{JzoAr9pX*5rFGfjJ13hC=a?nw(yD6WH&;EW z7~Z|Ypb1qFopPhnbe3jDd=&&gKLy7jqYG9=7s3pOD*K^QJGCsMCV2jIjo;l&1H;FQ z(=?@l#jP77DJ`O13#priy!!QsuT@M|H{+u7L-`E#ynW%3eiG~Rn*P#-c-uvZ{!3#p zmtl_6fQ^TT+W@L&=~PO$A;h9bG1!p;51Lr{Fim`t>44ToDdkfZBJA=*9z@i+6=H`u zWS(^clyHwYPMVShA=d99GZiI=%A50QnS34=^Lg5Nv*{@vSRveOKZ{3)wl=neoKA`Y zeDZ3Y0PRzn%{Baud-pZ~Y$+nDv`iU9vSrM0;9WXC-OJIf$u2G3$m!qwEFlja5te%9 zEZ}hqfUi4~D1a!@eRKUtyD^AP!C>%<}9&DC1=it(MtHEzK?^eS_CkhHFV(WZItJtRf6N0r;J zzL2Pmw?*(KO>HfsgG~^E&R8Xg7`V6xPD-BT;9%m_Tha|YAir4#@gy7Dfa46_YP=9+ ztRB{eTD%jxP^R;Y3O~jsJ{+K)d}Hrnw)$L%R3XaGfQZ7+Z+)U3Ig>wwvRv>Iz5ltq zYOr3!<+h4Sc(u@w5gv1{Yzj|?4{|+Jp zT);?$m^G}d!%EZRn3yr8*g{d=>YA)~4fpg{3nA8}+^@%}ao2ja&F&7tpu~+8zZn)D z9*+9BUN{xYp^>!K(yAbEJF8;VNlB3^oW)5Tz@a_Knddi69Ch1DVN~5nIei*E> z9d52H(Iq%yfTJr6^TDe=7)**bL5&Z<6$GMsy1KF1XSb>p%xdfFZ&VCyuWeLKdqYG6 zBm&cPW=l&8rWhA1;Xa@Au~Xcr)m++pvw+47LN+2etrIiqOqD2mhEK>O;c?^Mp=yqX znPyfDnJ=JG{D?0#9na_x7`qQ2#&9No_GFuGyil5h?}LrGoB?4jkK2Ls(s1-Ea%Zz#_z4*K+Qo z3#Q$niz9JNgW`sUhAbY>4$z5ijEYq<5nOVnTjFrwivSfVT$+@nYEQ!DpsP^MgP2~M zj?cLH0)Bz@kFBpieX4Cyz+AK({byGPGQOZK*EB;fNb1>N6f8tAytOz%$8RKPJBt_S zwJ?mjc0g%j6yW}1x&DA{PmaGfdM!%}KzSm{zZj`dfM1*Od+g}AspE^Uv_m@?s;KCt z58U??^kGCQq^sX2f->!`;mRr@7LRM*C$+3^Z)Y@!V;4^o%mQrIvW`_U;-1R*UmKrT zPe7%D$tAvW8o4@SR{@vZMS}gUWE#+giLdf;Ah&In(LRaTeviV}U$5hR?cY)e`~U<4 z5QXsipCU&Y3k*27?V|om9`GA87;jAB@-wITygXYgNf-dpPuD&vB~jVXVTzt@Pxko%cvZAC{y59`0?RxoKNM`5(oGOK-AG)!P$QQ*4)e zGxQsrFi8Vh#&*l&b-{dwg$-8cIP3}u+ZE3a_yWu=ZqQgb{PykJ6yQ1h&v+y1yn3>e zhTW+z>FVq2>gmm5LU*0Ne(##uk|1;h698TT@3-31pfpA;~A6WB5Nd4hh_EjlI!c&llp z`W?O&E1E#(L}a*sHVeTYB;?MAmv{f9JIOr5GBX_k1QR0&y2@}$(j_$B-|0EB?Is8X z5x80RG=0+AkX=y`So=o2e0#^B#s2{Y_Wv;f{r?LV{J&0olY#$#Bqjb^j{lb9--)XK zWa2-W_)jLj$-w_e?!1J*zHGiNQT+t!pF0bA0u7c9&(j%&SK-L+{r@UX`E$?jwI>u$+ z0uHfT!lHDa_IWO@{<3OMCRFtM_d}^=6^xI+pAG6J1Q#KI?|Qm=dh6Lyvk(No#}67b@aRKjHG>WK;-+lcm7_v_J39li=396TwQID!d{6B_dmPFE1`RZ z(2&q`Snj`@mu_9@!{EO6C>4|V)?^f$^UB|J0%p$mRR`HXE@N|Z?z3mV*45!(MSL$Z zY?S(Dup8U@kn1TTmCF-o$h?=xu*nt8rpx;K`>$E3NJ*86t@q-Fy|``a3%8ayT(D&; zQ1~-Bo6#^k+xIpwaKK@LJCI8=dzsUX`MALR0-YJQN}9W;yW4TOF6X@ZnikD&yZ()V zrYavFAHq6en-96kWS94~gq&%m2%{Mi(u20zUhSCZvmdDo)8@Ln(5_Dq{l1iplHZon z>^>}w=K;Fx$2#RO`b+%$b-}A9G`k13#+97}$2!o(+}-m~<~ZCWtzcke1Vub?)z#IE zj+5(od3f}~Qyq8akBN!6wVV_~BcuIpgSjKc7GGIBt*tY;@1;MQ?+x@7vt2Udax%~C zv%{};9AFYZFTAnRlJQ}#_~5B)H-jvlH8i${%e}N64d`yamx|z zK~98PsYpnaOt%?-2>IhX6Ik@mH=nB6ms7mz4U0w3pb%oaMA$$eI5{<;JTQYT92@hX z?1uQ-o3WY!LeGHKUv7iZ{;{YLI@O9VUqC5l)BIEN#zkh@lL&L>Ov0O!`(C_w0c%j! zWIM2qb}`LdqTO9m#TH@Rbd`2&>;QIB7xD)}PHW2&G#d6p8~$hHUdgN6xzlSmfR~^N zwI2>F-l$6)9v*gM#x4b-tp}f+a>38w0=P8SD(IHkZXO?KZ?_#lqW8Hm^YSid_n=hn z-lY-4yY5;dUba@p_FZFX)pWoJRbhCTra{coSbM3HMCQrtvTi@&}?j0tKTMmSblx|G=*D5#dy6gklg#+ zB2!Z@9D32W(Hk1tJ9)qSWpjT1vq{KOQ4cuOae)TAG2bnAE?;gy(}V@_87={RElm6A zZW@npF4PU#3FTyGU!rj1H?B@dFbd#QXABdajJz!}ker<@F8ndRYy0adbMb}GyCU!{ zM7d(VSyd&oZ{K2A3Kom?@W6ig;t?JFrL*%L{G1FFLHqgp!!m)MSJ&0m!_TTI+BGS- zkA`Xw!qs;X^47&`-NxMLEz5iN?oB*Gqwq^hOPecGpzQv^q~_=67aF>irfOi;pKsI_ zK~5e1E<7B~?h91@Hf-RMx zd8Dg5XF2Tp2R_O@KYxy$or(V3dHUR%^suV}WEy#vx)Zghd_^r=L0{4ZsgC*%5uRP z^%(Z{x3~90>+V+39_Z}u&R$MTOWTO*sH&+sae>*XGqr@3)m_?$p2wtfu-=?l3)|?< z4)xJxkVo3ynm`~{Ta_SpHPe%Wd3RAq9)Vwxq7phSARvGsWUQ`0E@N?P*#%b4Qmg*~ z?mWP2vdaqXz4Qerq>^>$n>X)*gO?hlL)@6Z*3c~sIoEpbK~o2;PWd0)Epa+sCyeN&+k1{)h&hDZCj32zlHT!0;>x$1fS>hS}s>=v0S`( zk%fijWO`DPX`mA;o6CZg8asPcdAa);`SaUvm`JtGeciEg>NzIy{h5X{<8^Hzmy}KW z3$xPGr{m+aj0_FExsD5GS~N$O#mR}7Ee!4|rGiYu=i(28IANEe1b_nB~7$h!6)Yy=dM~M=g#mi1HEUfnqNT zH?TfOIaC4y&2Qeg@zQr-PN1K1|K9otCNK^Be0-2vLDqW`O-p3laag|3uCtIOo8v(n zwQU~ds1D%PE_zf|?a3It*eJz&&6n|_Y4>BcPz!6dZZj9Tqi|c_9TRZCk}6PQJmM{& zW!t3-E?=PEeuNTI-%x!lRX~huA~~Ek##BRsgJFCZAKF`=fw`t|gEBhXrOL4(3F;jr@%!B!wd_Pp? zDXkxl+6)rYc(5=i(NyBEAikOxP6uyw)q+B%(s(5{O{==A)Z+FnN(y~e8)JlQ2dh;% zfj+0<7uvWcU)08Ui0t1Ygjf!^C0}R{B2qO3Di!YOhw(#+1IBqm#8-6bYiqnxnLH7w zeXe{bhRXv3;>K)XV1S*`jwqN(E^uc)d+r=$zaCnbxc-qRL33WK5S!wHOn(0!#(7v? zkOfMaDcnTnvE{-1#&D;pX_z?Pm-1NQ(cL9N6QOT|y4bk5=II7dLoS)3hF=8X7Bh&WiWI48z_@IT zO+c!*Z@nMqKjMp+E~lN)b{JFO&K=B8PhU!n0$onE`+^nYx{S#*Y>8Dj%Nqmla{__d z@FheHs)6b@Z22$(sF0Yf@9aB;Son-AFV916X1WA45DOMvwW4G7a13@^sP<22w$op< zAD8FRYS|l^dTO50_EOa*oHz{heiqV zy%ID@{V~zeP`ws!*Y6;m*+;uu0>%jlWG<@%#m3ETK4Asmb2%$T^W@>fEkYT~g5u)a zJp(jUK_tmRcX*Cwmu{VW^t;WBe^2LsEV~&eE-<`Or zr$;nI3qzdFEyRJjicNK-G#n6co+%+W7anx&EtuaNc}lzeS%t`G^g-ExtJXxDsy4oV zy;$|uEsF-R_0iGM*{Fg}5_BBYZtbO4S2~-;N+VM3K)Pe^~)fOkdUsbs>0*e2g(@ePM*v*iN7HyS5;m8($|;ZoF*bHe963@ z{>2qbE30*j*W=>>FJHbyL0!^ZNZzuurDefRB?I=#+#CZnVykr*wJ76@E2y;$%*|kH z`_328ZAWn;IN1YAUAQ@&C=KOc1p|1qfvlay;Q$NyjGF0KpDDMvxHtlV;5Pp}-;Hcq zefsoiK_LtC~@K%M+Vn!Y-|usbT~J7aK1;^o4Dr0;bmml zH^U<%T*cUxN+z_`7PbjQF$v1w1ZJdEVzrY!j1Tmy0reR_-Ynr1O5)iP| zhv`>Q?Vz!xhi}A#DkvLy+d4YHe_Hh$U$0C(yEhvE$7|4>oi|H!id1q zb>6f$*B!QAG+_HM;aEIIU&Fd->Om!R^S;87Emy|L`2q}TBFqk|Zna@FPs51Ym|PpU zxwvL`voy{Vt?GU5+@W$O66#~h8st<52zp#9;)hor}SyGdEY zVN7*;hK>oj5|ru=A1+*ksSh87@k7bJeldQ|oc73(U*;f^QfTk=nU3TS~n9)Y$6c;ZpR)R=?t98``G~Cw@QNEIr z(lYF(;hSaN=@0zWYiC60KUuDQBA~rH?Q#ddZgtbWdqLD3X4w8VH_THd|(Q=9U^pVMnyQ$;HLno`|gnq^|C~BL7Kd<{NJ0 z)FiFeyN=dYdeSSz!ERW~wzahp@fW}`5mE}sW$P*_;#FE7mg zi@^0MtEp9gdEwa*jyIB)-jO#)5s-(TyTn~@tg>7XD}nvA{b4_yQQDi$O*S?MfWD%$ zr2&ENmzUW)d5O_}@Q1m0 zk1K56Unt9!_hs#eXCiYdPpf1+NJl3E#kId&yfElay*Agg-m0W<;1>;{ejOezY&-h| z3Sk*ZBP8`>`jT0%pniSmasy)E*GD%&Kj1436_uTf`(>fi(~KzW5a2qidLg!7J6%m% zY;lEVH{euT(gHhj!(7Yu6eDr9LA(uuBd-8p{9>n9&h8?oI(zOUw%eGJB!!Jm<(>@S zA{d=!(*RmQUl2bZUnH-jB&)9O1b>W;!F9t=Cnu*$&ynoO_u1KNo0}C3B7Xz^VnSjj zJJSlJoV3~@ez)=iRwFmJ6aI8|Dl9V|rlqAt4wSi(KFWpffMu9;l9Y6Q_|VxpwdN5J z1okdespj5Hh|LBURB~1pC&bPq`73%2LTm#8pxEYQ6o^US<~nA_ToCodbw1(!`}p_o z^WMK_7yg)HZen7RoMQe;{?esOnBHMyUhHjf6=p~M@u+E+qLOOIUDXckgQqDMy9bO742(=nramno=Vt)uoVk{h=H;t^)n8m( z1oE$G0|3-DyJ|0JFJ4U1SEA0&mnE%;uZcNU&nMIL^<*I1}9O}78aPIpOP_azPc*clha{7(4UKR!mrI8SY7q* z$!_at<8N={Z*6byXussVDK`fS<3HJtON3Jt%5uW zy|VIVWrez*m#3MBM-jL%!9mwhwZJz4=*}HoJ?9ieqEVaBI&d6SK3oTQrD~^Qlu&8A*ZA|9hjdva()2 zygWQ>_^1^=85tSEjq4H2e=r-)V0>bkx;V)(Stz4!CqX7NqF5uh?2A zI9#@y?`Vj|fYbnp9eM$?tg76G>KyA)QO@ENHZ$yMIpz#qnwpvdiU)q4AT=cLeSpGX zxAKY@zj9Kd*UPnC8R_Zbk9GBDQi_Ykh3B0?6+R^&eRxh$EZV>Xw^!LBzO8i+(3=-Y*gtv0Y9Qjul}rf~uLo z@BxOw6T_UFH*fxQYvOO`dg#t^=(A+R?E&It;UlaiB@V@??`VlbpP~IBt@FEa6*Ik=XeBV%0 z1F`P*i4(T&r;iJmwZc~UeIfw3ckGBzU0of-j-q34lt7n$0!U!>Zh;|D%SX+1zx1X{ zgy&Y*e*qLb8( zVOBNMAK6T70uI{Rn%&w8EiEnl@L|i(&ketQ*25fv1^ot8OrdiNh$5*AjRgSLHS1rU z;0+E5fi0U`Kk-PBs+HADFh5<#r>1J|))s{4g@y1l zIy(BoQYiwqGeL97#HuPOWdOMYQwec4H29^W0tn)hCxdUu3cLw0d(P$M?ahAnD+AA{ zD~r@#suPx%B_xPqcD$hkW%K1=lpC`>Zcdk!xx)p4L&&=F_iNa$vhw_t&)KsJA)j|t zh|Cplgx{3IpwXAQXA(d4ZZ_=!0}t-*mF>pfzmESC7#R4^KQz}Av7&&LI#RUJuTM$a z*0;8`DXXZMb!W1xZE$dK0Q~DqJC$zM7i%+f33gdtpl}1n@u5{ z{)fSdtTZw*g5AZ+=EZr|Q_XF4bx8&E3_Op%4wksX1}(L_ci;K@A6C3Z0X)%7Pzy7& zd59!Vgx!O^+W9s!ACTy}5CL+DTley^(k+dxtYprc%mK=FyedrY9#Njf^Z9|$}$E!}5H<7GcX^ z{>sbCr97!P0r8$Y_tJM=NqON3WL*D(qX0T}d=I!qf^KGJS_2Ia=^QR@Zr>|^A3drJ ze<0;G171B!ni_cRFD#ya$=$q3A;KTglKU7$3gGBeYrOx?!g*m;jx;{4h5P}qV8Es8 z{Q%3ZjDH_`@kvXw*r4g^fa83MYtapKRCf+Y% z3z<#Ww411sbPn=_Sw?N$S;jLnAzDbA#l#dYA75XQh0h-@>Rh8oVZVayE%m9@_YVwg zLA#*g=n)R0tDaRLTHS*$t}sFrq~jxWhK-Hw2Oz(k)6tYR(xy59ThrU>LX3sk!1`DC zFgRg{JgHCeoo%&lECQ~Z!5Wx92J2fiyMYpe6f$xqDF+gTK#XtB7bL>YvbL3}47d$7 z9bZYs7)onPMsP7WfYuEEdvEFl_wXIlawrl*{pbVqNTk(`%#r2>~yhO94-eUTO;@3Q0Y-} z2ENfze>O(@NVH>L*}IFUwCx{gA(1+cjz%Q!;z$XSn`plyxxPZ&z?P%40gS_k4J!XEA`ncrU5VROd~D>I1(HLOGUuYf#gX(=@~uV9 zWtBH^1Mvr;?;9eHvXV&g4+?VVHjI;lE#%u<8$<&N&W)B+?J<7UF2b(=#bLGtZyUo? z(#P0XSz(fKJNC>Q>>2C-Qt-^;i;JhmLtF|Bm261#E71B@dk>sEVtaP7?a<-FZ1SOk z4@x~cw46-aKivbvkH*jW&$KH$1HnTja^d-X*vlFkz0orMJ`gZNL^=&B8w~rsYinOYQsm66#%%k0 zPbxUFM&EX}6QUuKF1u=#5Q<$FIMp&g0?7}g9`%n%s1XlIKf<~T;qhE|HK6dslw!34 z>ikG>8L)c_=LKkqX1B}s@_?4}Vp8hiG<8o#;SVt}HmlRCq_}gE6YR%=7&vzzV8TQl zEPtx${KQ<&05@kJ&F&IqRZZo)caPiB-_L=q`>!Bzb&kTVlF^B4_WW#n33(vo&K}7a z?nFxUi6{N%-lU%(3g#4pyeq?9!<_i;%{oU`XYv)#?Lcwn6hQl6TT zs!qPZU)8p|TNu!zK^OI8FkGNl`|hCae(^4t z6Y!{GHL4^&DN+@PjM9}ahZVk5Rz_G>v;Sm0@{4i?P&jHAth*1BwH!Y`Kk&ia+2#Wv zVB%d8}yL=*g!k`~hX z^1qESM*t!l2-Z*Y^V{_0+rXSn05g^W{C=v`A0==a6eO0IzzjqIw9n1O0u!ttBePHB zNQ6o2#|Jwq=?OWBMp4{s2H5jTdaIj1h0N?cgmasy&Ig`QVY21xvNb|vAD|{dwX}etUc*1uUj8T9pJlksd%ZH1Gc?_bRBSGzIbslvqe5c)L}{9<;1C>GmjdmL{sf6 zUeQiZpXA}$0fCKW5YG%5n47z7L&j@sjJvYDe21qc%H(9l->BR4(54mt*>r>9?q6I;LtBqW>@K1{MjA9bKi z=gaehOm@#0w(>I%o_Yppob%enYNR#Q1{Sw;5$cl0$H$@a=lxHyb0ivwDu2K)q7H2d z$}p!$AhMw}Lj~$E9+tlZ-TsuDYfrSI6|W%N*e}9vtpj!)uBD{q(kQfl3~|MTGi0V9 zIuJ8#KCRn5&mk^u2D#j^nhp}b7C8ZLmu&3p6ttV~_2SAu`%`PE1+2l@OL+pTzy;dg z^x-OGTC~*Fd#2j}aA@HJ(OWStgl%Fug19sG`N2~>JUo!8@4I~ZP*>`Mvg)^h_cZRo z89e~;96rLa7oIRWa8Y1YAh{~#U8Qxw^3mdlt2LyezQ$#c0hV{X`trd4LsIl7(Xg@~ z;%L~b3?(;=UEsv~oiH%H233Bn#Hfi_8KYYRq42TY67ur$`dtm#I;k1gPXmPul)kBu{JIO6%Q6fNQj+;GsFOA)3^cH^QIR{ zkBnsgIUN|kckhmy{tX8K=|Ij5#`fx10PquFPM~SI;8&R`AW2FIZU26-ozMWClu}XQ zlz}>eavmc1PEuFZA~vY`$X|AYpaxthM40d{xRtjsdRFR`G}S)0`$WfF;k}>am=z#) zo;3&Zmh#y7T=40?NT(L)vO767qp1DD8+Ii(X4r-9H7^e*NCDPS0~nyLUI0FRau__0 z1k~3ZIr0~vBm}}`@bi-gm7YbPpn{0FdY4S@=9p<(FEsJz<>dkBBnJi(7I3YCEAS#= z>1b!pHJ|fTZud8q_;>8Y8#ks@v=|sKsLZl%miZ~K*vpWBxP7|`Is<_x>}+p`1MzI< zx(!<5fenE*D1S*@kLO(S*ROwVXyC>+LJa2b=U0mQ6Kj%?m>ap%{VozI|m&R z&2`smK-hoEfEpv0H6h%Zy#~_+QhYDx`_jmQl7-s3I#DrAZtdb&YZjtiX#8?;Vb?+~ z9y{VI=CqcXk)f3TozEbC?OF}#+E54(!@}V72~K@QC8d_;W;ja#&K-bu#^WqIy9~&# zoLpNNs49mlsZmo?gXF6usX>DMW?l%{xfTOR6glh=AOhz7H|6AtTnMN(*b%G;yY3ko z89|UBJUOs+fJqq3|0jd6y=HOf2Ww(2$+sTfg#bzuj!gsAy+QlkrV+nhxFt$zfByNW z2Mt_=CTu&kyTIOMXh2#{j1e0iH$Z3)BL-pS=H~kP9ne#u)SR50tSsetZ1u5|jYUrD zkV-c1%ZF;pI6AP4iMhGC)5Bo=1R($w63WZX{VD;G9FtC(^@8#4?yTkK&jmFV6^)Fl zT?&ZZh6&Q0*V%xFv!Rzj`goQVvcwmLz`o@VC&0BODs{Hkow7Vet7sQDlsX&!0aBo1SUVBsnEX?CkgUS6Mx& zRaQz1D5m|;#~=1VG5%4(^}YdEdX=?^_c`-HQzVOK7(vLB*x6rwl8P|D zYj9CUR<-~#Sff?`Z@Ip+e#E{-{t@)DDb~LUjq85XE=W+xecNqGHPnkTIUZj&xnw6Qlmv zKGWj?MMb7w$5aR#3S)ZFq?y?D_aOP;qL4E-^+wD|L5s-dr=*X+{WyC$Mo|bH6}YNk zZcffN1>34LuEm%p0}>PR5}ag0UpqL#($do2UX5+2{(_0fqn~WJyA=q(#K%wRw zB=Nc%=LJT-dNu+CFFxK7NPs)%-hw~65o6T;DQG^1eo|}t*w-f-jUUVO)RMA60iZ$Z z;fewr`SAF0+V{&6V?$?TEL^(@{!zFr6 zR7vsFun}(Dprzt_V>>76K~q&FKtZGg$S&_<86+RPxUpEtgj>g$o0GlN&Yf#MxAQ1I37Av9NJzo}k#DmwSn@yCATHZf%!4M7JMQdncYu8FX9;&+ zlGz#7k0~N+Rq~|Ll6=mgs`$+W2Qw2VwGrqS;DKl7=6<)#WMsD#jvX8K@kvV7V%-__ zGwILNm!8JIB9sqXal$2 zK@cD^lRsMP2cT^LVQumP2Mm<315`6QBauvco)Ed1_T}?mxL^VHu)9zeKmSj!Y^>wzL+25=4$@&kn;9%hF0i;5~ z%;n!*?a4I2#il*kt5Yrd0LQ2^#Lu0(LGk*Ze{S8r{h;#(L~9V&F4pok9JlRB0Nz7N zN=n3LdIgFkm5aP&{LdUcc1+yDANE?HmPV`IesBjX|MBC;{-?l&w&64)*$rDNr1oxo zw{u5`^EV4H3H%>Sq3Z9@^4ggT7cM~E#JO`u9m$$d=@J^M0ay?6i%j=ET0cVR zZ!6@QQk9XbZK^ea+-S$ugaeRPBRR3(U3woe&N1rN($!5E^-ubKQQ1u zd-vMTw9hRJl`S1XAke^UfRS-t@3WJ9J~%jd$+UYCbK=-B+o94uyu2APvVr?qlC{y> za0)H!nKJ+aAo5+CY|;TrWHSyJmMxfc$>$(;P{5}kU%a(cW0a+qGY&hVAlCzBv4Bm9 z0X>ica8{t9iHU}<`aGO)4dpt(5x#FS0D?IKh?X0~!`R0$7|h(9CJv-Vd^I<}7?NsT z#TbyzB^7L9i-iA>C9`@sgJpBc|+T-Npo)-yqSIW$T2w|oazH(sA6`zQlMg{P-y zVq)UIT#O^s!0>dn!6u5nQ8@JMBLb(?$4u`AJh1wk8QUXUHz4Nd!QX)ODFP~rp zr;&-~8@8MYnxBC)_#q7^VA2VPhugD!0Sia0%Y~58u{Y~R%ye^%S0Vm}XSP}2IgjUF zUM&ioDt{~4LSMo9t$>f1zJ2-X)u$%ru-Ad%$dPCl5cTaja~J=qVh9kRup0@RJOO#1 z^wwLMY=Z1^hjtif;y7%BfJDqiyLk;b*xllftM-ohpygU}-!ZQ+QNG^+tS5^2$b%nV z5q_~h0+d*KLpaR`^MT?`;;8bSHpakH?kf78M$-`Zo4VxPi5o7Ei^8qDj2Yz#1MD0dI%jfXOk1Q}QUFjFqWI&rZ1r z4*OfGjE6KHq?zJj4-Qz|e0fy@d<~y@(10P$PET(}5ci3^d2@v23pg8wLx*@QN58^v zVo)o@m~=$M+Qvo<)DY-3*f8Y1Jkj7wFQiD3W{1%Va)Qmt0T*kyH1kiNK3xk@{_vL< zU|)czTk40yI8S*%7Weh-GRSHZX=VUDP`Sc$b>CUZy<5rJ4Y$6<89Q^1#o8yS^q^f_ zeutC>Z>Z@1FUGz*9?SjzU+0`k6AhFicS8|MB)g-VN?8e!(cmbu$sV0l3OOni86|sV zWsj0wWM^0AZSOsP&kLQ;anART-~IT0AAL@7-`9Oz@Aqpw$LoFKi1la}1n}>`xI%ky zUPgvq92w`2uWzrW@c{+2LwILNsRqB3nUUc{3zd<{0dU16lKAniN=_IV)PNM-qeY~H z-Un~+Y=qyS(em5=thw>a0)#6OB(~WI?ryx_H}D_bCKC(iYNundfIK%#zu?gZye{qx z4Yb6&cad+*dup%_kQKeSWnZ44V`QA1$X-y7tQKtxJ|!-$bv+mI>+p(l5apUYPxui= znzWF!5b*XmQE%7~85Z{CGm-xggvuQbt>sCwoS(I-du@cHI8fxJX=9;axT=_ghFA|E zK(XT0V8fvyq%q|_c?t+w(%U2F&MsG^Yl1GM;RKliBtD>sXwCoCyt+L>20>?YJ@WFBL~l==y28%TTeKDBE@EfI&sig-O&i7|&P zmJe~yi|+JFhssJ0V3zvukzgfHA0PH}Nr{P3W~g9p;DT{KP%y@3O-Gz>RII@E1GrG? zFJgm2EWlwtbz=uWJjgw#?s$uub;*f~|4I7;1!MR&?!(;N-X0kc9x(3ML17`Ve@G-U zjO&`;vNz54H6;7Je95Jmby$;2E#)o3^)yGjVp|KoPKgb=-d12fJ+rna?DLpwo-6oh1X_O|l z;p4-t+9!wt7t2A@ekz#u8uB!fzsY-)L@)&I*s(9+-8%zhCctdBn8I2f#vB+Xvyu^9 zlQwiW-H-{{G}h2UF*P#!3Sz9#WA9!P3C4WQ$^$5;k^8JE!QL<$c|Zt4Pd^Srm6HCt zFi=0YC>6mxmx)4INzljJn{BP)K*{^}zi$Tdp}T%kQEF%o?34*D1A}s(HIP(RCsa02 z7KCCrqlX7JBbtPXtg)KQsHSCtn;Z+^^yFjx9$&FId-!A}a6ZSYTEJ*RLb66H&iyNO zU&4K|ogFH;UyoSXk7~Rb4-pyJ*47rE??gMDnuKs&{8#gEdkG*TAj4cvUG+(kpC(2A z+E{{#;e5iv8TG5_>FLJ~VwA!KFI9ycS?Z(6+IVV&8V!U>(m)Lc*1C($UuqsByq(}e ztKuiopYmKz(JI<9Wzbcbv=#9r#w;u_@Z@IbPIY5XpPuMY!_fWiBq!RmU4Out%cYT# zg5Wtd(y7Pm<1RYgg@OmjjYHvvRcksa6zeWIEftj=*{caZBh{L#i%o+wXnkr{s9a-L zww{wLfJ)=5HH?hj(q8MX3WphgSnl@i@rf1(Zl~u&DFDS@Uc8w4 zi{Y1zr6ncNP=Za5ZCnbEjtBm9WTDDEVcvbQv(yhvRrtTZo4vg~ioEUOh5nYr&g}n! zi{V-e1g}=w>)Er$bPL&#CbOpi$;7GMBuz2idG52ekxWqeEld&LQw?Zz_1d*10WX*Z zOtem(Jjv<8dH66=o~n7)+qXCg=Dfp!Qd`B!Dz!i1Ms-9r^wjOB8K+sfe`98Wm5X&Cm2G9UDw$ohCk6abMa^+iYRa62hd4zQIVg~qd{NMBgadC0fJo}x# zX4%=8m<+?s9Oy8b+UftaZ|f=vWI9xL%K*};SI~p}>ip=DE--y}clUo4(ANNA)2Ln7 z(z;jzorGuh7A%@^=osK@#N?2SidTQ3@(uX7?LN7EdLY6KTb6cEesA1V~#(O7sh*$#mfApD56ab z7si^QIKas`8}#(_rY;0u$ef?It=tNh{I47b_s z{+K1;n)nsGc(r?K2Ohel3!}l850X5jUczz_0Tmc}a4C;n(~%Bo!-FLK|epRUI8RP0*Tu zXlXTOSXJWZDk~E%G?&To?v%E+PMe<@KS=Q6>(@6nHDT>&jCG*~g(~wNEmBl9*A2C1 zyNMAE%>T(Knua3>OpXrIUDR}I5wD+C+jOGO@UXg5M zTht%F{_@MeFzjkf2p}{Vx`Mjc_?TKCMl2e>O*fEQl_K@(0Vt4kM1oiA1UNKR1Zg)IHcNrjU+G&wD*e|tqZ&MMNrlg_E0YTa5HS-;QcF+|n{J%j#HY zN(y-yuqxjRD0m)q=MxOY!FZ#Uy#W=Ku&8blk_MmWfkjAoFbr25mfh8LgY~zcv(uN~ z{+n!GWu+oDqT0_}7ewIXbAF!7fY?glc=cN-P6+(;^Kzfn9LSIXvfnM_yv)h zN%g1;@BPDEM0~=a&h=~8esp)AS>jWfcjKOqZ36}aWF^^9^FP;Z;O`%^beF%C15%fh zg_{p}9CVH=d1`3bT0@l5q1EA7W^t_XYgGym5F>&EeEQE*Oi4`_YRSC(EWqLP@=Y`* zZlWl*1yoEkqm+L?8miS{)m-AvRaNJgON)Fr&?eI-Ogmf`TiunlA_xb^^z>s(OUlxW zJ$M7vmxFm9KU!K_3qt6!f?;uFB|0-S?h_Leg#5}grd_rhT^c5pn;02cj(q0VQ^9#m zsfO8eHRvSJAF?YpWl<+1ri0P~I_SzQGVRf`dOqXj%U)?|#pN4DSN@*nq#p{fmm)Ur zfFiEEz$;gfa@3OznvlkyakZ88pi{=C+puXmvs&)#Dmen94Gd}hxe@@0lr+k$?HRCwSW5!HT6OD4US@5H10J& z*U1~AFLQ$l!WErSc6Rp4O$llvKR;_IpGn;L$&)R?daDKt+P{}iSB0Ngj>h?Jo9(H( zA&Uz^<&2to<@dt_a80-Afn}(%(RTTXNxBlh0mQni1?n^imX^gNKev{9L{wBSO6~IU za-c6r_W-TA!Rw}-UkNV$4^WIrj0y~dmgiU0M7RU-adDLTq#m5c*WS~^;Z#^!+WhwF zU0TwK6JI}nmbNHH!b1vYbHb4#9w69pn{z*WAau2~w6w6F?%44nAYcKau6B%N+I7O{ z3g$wgVZoL$XwIlZ{|X`R^wgAM1fWTqGJg?dxw^VK1mJqHCT$4a0e(XyHx{ElQDQQeJ>5^$c9((p-e)LQpmY z1hgRdVsWx_LZ;rFYN~_h4-y|WIQnk_ob)WtX$j}xQcUW&^ed zOy91EA7o%;EM#~z|58|3bptD4tKPn!;*^~nh~eEGC{3Wy0pcUSlGZqF0vrPA<#C-9X3 zE90t)Tw72cn=9kwFPB}HR8_{yvGu6cdPo*RUSkDqQU&%3707lVBD86WrMnS2@4C8I-vQ`4gUE4{c2eHL5z!O z&P?xD*eXtzl!PJXCNy!Vxv{Cmow2;3MXgReg;?c8D~8L5!4wvZ3x~c<02e@EfC{$I zQPa}W5^@o&g0hzaK{n5E12`+~P)heehyU#P^RVn(R3rc?MhF~=Ut#9yVJAX!2L$md z4)~fH0UF%qg92^Gk4>jqTl@PDJDrjK+*=bJRFOo)hm+TdwAO^e<&uhud2gXu!Oy6H zKOH5bGBRw@ksy$XJ7?o?JJ|Xm!v#KYE_m{(Qsf-wnH>0471|RppPi`Ml%prU* zEb&C)C9190%5V|u$;fbzHMy3?qqu=xAUG43Pm4{F)`kwbuxqLYrc&l!b z;PK5BZHh5);csQDIopXDXtcpAK+!Ha%h)YRyS0h>C}VuF-7LiU)AHz3WkAv0N6 znc(}1iXiVT&eBE0-;iNt3Wfx9msS|jU86?#D#3a%MHEX?Rd*i-Vi1~e zs6B1Jx#0w?E?7m7BLi)xAPz6AQoC^@43|u!8v6P*hBgIw59EMzVM%dF!k9UTVD+@L zM!~6;yujTkHq(SjwV%%KxV|bNOoa;c)9c9?*l?jCBXEtlZtTP?m{PqnjjX&X5@=TENs0h)$Ov7&sJFy|llJgMu4m zpC9?1nvR|xot-f#JK)DV+AFkQznKo6(HfTGx5o&nwv*ZSb8=1!{PjHzBtl8^T`0Y4 zWWQj)OM6)Z1fQD&UAM2&P8?W{3!qI105meEb3UNAYrle+kEA5-Ow3aN{W6}gWy_Y? zxjDd}#}OwW=y+iHs}tJj^Al%*5$ryC&58C0Dow~Y!pEQCtM4Yb!J`0aUi3fpcbK<= zEVj;G&cO~T$Lu=TUi8IZ%FE@ORr``)HX6H!SrfxWY-s8ya+rq3$7_OT2*|gybax$z z8|qUiz`Cb_V)6(JtKC00#u4=tz6BOZNy#*CAR;_5QxK9<#9qI9_YPl`L44o-{mAmM zGO{M9LA29o1_y6QFEd#sZMKY*7Altmh>+apV^PjMCJ4*dHY<>_fB$~!l)jnX$&o)*`@B`o9 zMMw9_;mpJ<6kb8Nfp`i%%FI5@78ad_g(Ea^i{fZG5u$RzxSSfefN^f=%2uvh*4tuu zd^|>5MMJ}X7lfS3f^SN+k$Nz5QQ|R6rv*EEUYS{W64aHtwY3_)7{qx>qqd@gheW!D zlnuZe6L^@w974DbD4*M=rCO`4&;yYTkmFuS*D%dAS?cd_MXm+CRJ~>vHSM9bicBp< z!)B}A`B++66#*16khajec8v#o1z3&^tQwZz@2&OPjY0s#XG6>T_pH!uADCn3J9Zc& z>IBUr)W*SSiy3wLT(na&=l5TFiup!TJKV^Mawz!MA2G_fnd$Q_*FVn%NOkXDg_TRn{z zcZ535yho`ilhMf_83m_Q-=_V*Trh+}?88&n{KDLzBwCV)h>PPQj!@-3bSi2U6{|yW zBz~4a*H-G%&s6Cq?dsauq8JHck7o;-%p|D?W^C2~9UysmyZ|)6D$x@+dRHR~v2xv5 z;$-!zJ7Felo#8Mu;QjB6>6Yo%YgrvON5H_E$B85r!G)g zD|=1hEilHtXl#Hu1bhG|2ipI=PSl$=RVTS`6>kIzi$xsI>5G;Pa|sy)vLXJK3hjy4 zNozL7)mH8Xi`tZ+#k6Vy`V2mW%F871LO2fM;}m%8>dISau6IFI zl_0V=u)>tr<{KUf4V1=acmcHJ^ifYuclrxiZ~@q+F2|}-c}Ve#6h zMS8^Y7Tc9ish_BibpcsYU!m zPzjxXs#cUMTy#=#^Ja*4QO+Fx31>XQE_i@NDS-NEsx0v54j}$?tA||Y9xW6GP`jYU z#kWHIMqC3IRHHc#%B|!*TwB@;iTF-vQgwNEvVO!=I5wv)j6BA_+@o!ASg@0m`+{%?`uJr&uDz@8QQc!&XDR2#6dkS7%#WN_sk4ATBX6O^A_yc?6rrnp8SJ z2my&I37-zq2^~8cC0QAnnlgXN^dx4p3A3{PE;$cKmsEKlHxS|;q@)7}WPEtf#=PXy z^P1lelHmb<$=k~d$U7_HOWPuozpl^e4l!HbGJqewu&mqzi$?CH0LgPk2p zCf0y3Xdp0?CBMgmMH`xgwnO*~P-U6;QEVi*p=bWm2EiMxk{~&*3M~2)(1PNU5=0%` zk;z8WvZBQ9Q=&yDld5zX5XbS7GhD=#PCx*fpO=SQE3-19Z@hxi3N@%OPQ3=~2AD!m zwWG6>V1p4|Pm{@E)x@AA^|HiuTMzuUW=-)B1|CBZIK%RyqHg!6p;QPYF!qZ@>KpYjtjO z^E`~d^;j*qdoZ)5nzT#JmFZzqOzV$2(V}&RGU`^aiva{3?@Eq2WAWKT4kPXi8Apjz z=*Ho*7}ih@<{n?#77Ay9t-E%q-FzTm+5u@AA%?+204a}*4A5Cmgnb8}ZWY#RvVH^o z?%hp*Qs+(~vHA1feDdN&9dY*+4Gc;tl)9f8b(0{l--BSb5H+!1l~!N@RKLoFU&N!v zICFmOUa6g8_8Glo9bMfB-;GNI#Rv~)$KU*fN^*X4Gt`jXICZt6MS6S=V`jbEiJ90c zS+=SDn7E(}&z85Q{UJ>tMeA5y-4;4GsHgod{nR9r_5%R*%_z5U&j}=EZYMS(3SX`K zsE}wgZjh3rY+_SwTh)DJiVF(|Cniw#hs|rDN&o-_%2lJOLCxWu*I_(omwC5a;IYu& zeff-rx)%Tx__}EwU_AF8Jjlj$Yi!uGvPf_?kSA55=o(c9X$EVS8rM@4TR36)P~C@8 zxs1$AC}4o~vIp74U)Mr051$`<11H{3x%TN>)#0GH#6)4ViMR;!5nvZ04)Ym}Dib%0 zAH1q~5Sef__dc<(CR8CA*acfM?7tk9b~ID_&ZV)@(u${~3x$R*6MNl7KY5v7G;N3S zK&E1GR!6BE3)Z{2%b;bxtUPGz%!FoFZ=*UzmDo7TuN%cUZ+a_(g%!SFkfd8g0R_z~ zOe2VGDBY7BxW$9YF-ruw0W;}q;tBUO3Vc{qa0e7m$svfqhJqdz0*T1eNi>I0AO{BK zG&RkYn_3W%3aI2}Shm)#U8`;qg@O^Ie{h^=QBgQl1NRS3IiR)zvsz--0`4EUb5m1O zbX1hCswTv6o}Sg%S5oia_4fA8&f22?JCt(JDaCfm1p81#80HKVQL52O(Mmm`f}0{U zGKBf~k}@(Hb8}AxUnnX9GN$v#AJdbQRfi6-m0gIeb{{Un&d1*g;>*<4RmVq-vrWlo zpc6;!|AJ3XZK7XvO(XsK`gDGrp_wIYZI%!n?Y0bk{5m~WYY5>!nzf_%o0PP__EGUF zA`Ku{zFC|*x_m!RZUxJ;@2&=o7BR}?dcj&QbnrX{o=#%9MEL%+bUS0reh>PleKgn7{HJN}IEOq{TZ*`>i%EV7a zHGiqGah~m4=u$iPphoibHMJI8A_2k(JwEf{k`{yO_;z|E!8y`g7TlQ=iJ!%5^h*NpY-JqbX$CHBXp9W zL6L!%4Hti3_&0ZqfImwOqvX%hX%fzaL8{KO0OHv8C8f;YKTS0cSI5hHSdDf6eE+0W z^s9im)-BqH{`b?mq+jiK>=0P-qXIVLQM80i~P10BT&BuuMDc+<|AWYlhki zBrhhA{hyz(jum?IWf#iQFKokF(K(nD}sQhJIGxWN@cskF=@%lEFoUlb7erx$S>=%wFu%9d_*UB zhR}cASGUm6PT(eVeV%rQ&pB(NMS zDR3vgA>6_c5wE=P!4tr3+aTcq@QN02Xl!iL#*L#RBb8!1ckk9WG!%pW>&urf0MZ2E zPw8(Y2o~tuJ>L=Izfe;E8U-NH1RBfM7FA+Tf4|1fWOy;qXZALxjzB+v+NQTEyb@3v zsFd(*MT`}Ls03Bxb8l}bsIWxK@ZZU|rU>tLSVT9x+lFg?KS?Ij_y8ju;zDOhxCES)&>d6WcK5PTnEM&BGYVnMEBdO<5P z2tA}psMt`~xfG(Rgm2}5w9hjipEUd>NIM34dhleMb_-Tn#)AF=%$5XC!2@uN&bBDw zksTT6GBp-3j58t#IMLAXFuMxT)InSeP>rZG!{pv4=Aw>8!I@WEn~c#3x@@o?!YeN5 z$0Z_?sgY?7*M2Xw2Y_aVp5ftPK*K%^E(hL=ZiC?DP)b1>8u#rT%Uw)nMS+gRfskm3 z+7Gm9Ct@TSdPQ7iJBtb+1PC_>fTx$%3&&0$4AfKBf z$#!Wd?pPdVjj>g&Gn-L4p#K9PI*M;HvUY8|cW7u2n6wHEcTH8~x8Nos-(cZem{fTz zXsDP4fw+%A8Vm;J0^IJV6T@K;X~#xiKGl#M08m}?zRBOQl8Va6J8Rw=i|PUzee3aF zD~3?0Rot2Qxk#kfU+34d*b*KEv?+8r>7oL%apOwDT%^78BU0`zVM`;(kK*D{ac6+* z(v6O(!I}n;HqekysQiZg+?cW_yQ_^l;|m09YzRq;(g>7N*MZCghL2PnDuFpNwIu#4gmv&Vb=VP~zrW`^khd z>p;x{xil#r3UG+s?!LcbtrD$7Om+Y~^6(5433xB*%iBG`heC)XA6+thlz?Z^!%|a+ zDMoq?wbnx306Y4aofsZG#l7DaYOk#a&eM9JXT^LGJne`$yu0ViuCVeONXu`AAK)oN zPl=9*en#t2A%YQ{_2;q%(=lrQ8A^SRy_&-l-2U!)K?s)=%;Zve`>lzdv)_`;Mm#*> z*)3Z!>^x@O=Eqst-boqR-oFl7LTGMmVZqk)PpclYO}?2X`cRb3#~tQvH8nNqtT5vQ zIJ`ns3cer41-=w>$U0gz0q;iys|h>DS2TLtdvL0GBPg{cmkwDAltn&|Hi$cb7_i&5 zKottr=9}Y?bfa|%ty#5d73oJ$j}S0b%pE@$SsiiI0KK&GYV?Dc(xVHRWA>0L0&r-B z9SU3Rd^q8vs&%0|Xh0>;mmZ50#@-a#{Jnt1p%>DXBaGMr(C2ZIkjOxmDN(Wz6bb!* z{zMI^6wm%+K0+2i6#GFOh+&2+$csnL@2^aD1-Vz1Bd`)9fbx8R{9XlyqquD_a-poC zpfh9)D+evdHV;@$-kWI#Q+Dm%efQ5l$@>tU_U-$4<;V?Q9|Q(45I4}E>Ylk`WMl-9 zm9y=5oep~w!I45=>)qlq^R_M-X{t-#^>~i+C|J+)Pu&zaM>{JS7WEuN}HVu&j5K zB9W~d=A|xO}vzkC{aXiW<-eld1Ghw+?V}yfSV~*u8iFxH%xAjn(sH*Cs1u_ADGE@$#Dk^;~+1ZC_E?>Nui1>$A7W*nfuUQIBBzUACk_G{{ z)*Yd6Ac(x zV^AQdfS3#+J;3moS}a%RLM#@1rF3+k7y@!wJ*^7dKS6j|k3I(kbTfd6-Zz zjJnX>_eZe10FZ#{jXeJiC|k8_0Zb)L`T3IDTPOuNlXXlyTF&)1n=`DC)zJg%ZJgPS zQ+43tA@SHw4*H7vIfIcI5Bn-PAz`Zrk0{ZGRe{+WQLF$7BMjqc z6%E564TCp3{IQsv`}dML4-t==lvFW1P1P;ih>`q1U&8sWrz$|?>3jBXr9;OC>@70x z59~%hdQi(dD(%?!2TLYX%+es&z?OtCAZ(xi(VG1vuyuLS$&wKR zQ3_S5etwV1qnn^-p|1i#1~9REJ*HDYW~ww3!Us@C_f^R3j!YN@*qd}_FL0u7aA2UZ zQOKta9GaQOPGsD;ru7xVMnsVf%A?~QE#x zx!B*|A2I{}PSFKL0aNY%q??tXLb}tn{44lSjiY zC&!=+iW5cgDga5&-S@O~bl*EWEkI*qHM$gr$p<~k?0d2s0)!^s`??XXvN*|r7Z5R! zLbMhriS#}=t;4l&wr8C@>hEuWwT#8in@!*@gFMyiNyKN?@jvk`QR=`aXA;S*>qlh<} z;Ielx$E3hEi?&gPjQZ_d?8Q}Ll~&ey82cs9S@l&=AzwMPwg<b=TBf!8=31Wm8cL@U85NtZ>M_1QZV3(Iglu`CfhgC%= z_9*db+X`X}gKET_hd$U`QH~=#A2~AE6PsOggEu*i=L*EbdzWT;oEuF8Qrq3 zF}O4s^Sp#J#qX`xEr+Urkjy~*hWK=ZaU-E{!>~!*YgfY#X0bI03-cHTw{cA_b~w~3 zLUik3NxK+c5#8Z&OAdq(jtU+JJu|lwBk^ zaE(CR`O<^NjkGerqGi8bI4M)*rWB(#Rm>6VTnNnvoK^3x<*oNr^o53W&N9$}QQ=;) z_RX6D*FI9yO`$o$#%3cCN+xFgsxS{#oUhh2>Kpdj{ZVvuA8KZZkBAwYk%lU|y4`cr zjG%A{l>!+}YPwDtGo2MY`{%+f%*-yfc;J4wM07m%mm$MlOjwhMEVAwnIx+5ZosOZQ zzRt6A77IWMC3Cp>P@Rm*bM;PI3Y`FHo_3RnGF#~iT zAv8o<#_|e_v((+C2D2%tkwfxv1Zv4&gMF1=J_wlzFKpIkv4F1G)xC1sYrO>cd z55Z~Vp8^M?Ljc&v;%GrAtxXuD0#KK^a zXeGUVN#d`6zUIw|NejkNgM&tV(}%^x7VgrB!hOHZ17ahrqtBNJ(gVuuc0^4S&H!5= zMbs^9MmNZQG3?6KtAz4tI|HCnj0}4D=+16Y+Y~4+*vFM_>m~*|V~F$wyMAzg*m210 zOf@x68RO$n^u;)5pqz%P24kl5TcF0f_GfGDkU}k z20YZUv4$951Ev8g+FO-Fb|fC?n7(|G+b%uJj{_|UsVO8i{EQp%)s7t~cm~jdkdUHN zLW)3>d>e+0Mah@E@o72=wj)Anbs9b&-xv3p{k99%3HZWP=*1?!b`#d2YTYsGIik!v zd@1mFtXk@|t5@ZVRUi?^Q>XVpUfC`*3SCcMbEXh0>s6ricnrrxMu`!gh`8+LR+xan zx9&?AR+aAXcf<_{ObMMgE+`T_9P+inkf@svx1GV$FNxHu8f^4k{;%0|=qp*)JY3AgV`vk&uK^IBGx@D#dE(yPB)0 zsCeGWWjvFRn79oSh<&lWlJpyt%(ag&LPboJvSRa-xsXf6)-rWgg-_4K;3q(vAeQqq zp~ZX&;=Wr-;sf-1ub7pBXE6H*U0!&+X)ze>DyR;?&ALfef(L?E`fO${${oOXEu)*Z z*>JVm$0@%#apFXjdV0<1%(Yt`A!Cm)j}I2aGiRJ1JUAV93b`42FCTnHP*9L@0vdTd zB0xrQ(}V>dg=L7&7<5~ZyztqpjJy9%X(7gG&>?u8FUt5K9e@#~uW(BMP4PryCj57J z_1k~^xR4*Jhh7Bb(D_)1)={ZlH8j+eigY{_UE{fKiIu)hk4n6we^pK{iHFAogJMui z^33%}H2RfzFVv^;CECrLH87a(=wF<-wX{7P3+ie$V;?;{i%hKmo#a5fAZE&-e7TMJ zD7r~`o27ktDc~fDVo@fv1ck4(w7G=^_l|{Q!NtItBVZZkRtF=8@g238Y+PC@(+6%1 zLJ1h`N8bMy16alwVoGElcoNtZBN`L)uN=X)g)+i(Ud9!+*X-MUs(_K;T%D=V!U#>2 zme}Wb;5%$EnN{uH`t1<}l^_lN)_RKHt{RUY92^Pe9;?WKyiA9UXi__%bj4U$AwdpA zUO>J;hETsJcSnzgmVEwP-7^N4hlRO$X7$8e3@r2eG4;Q#(0g`{sj-Ell@-hV&#tZ% zY2W$lOF{jc=(+Q1e$P`5oH#K(uTg{l-<-3z5A_b(iUTV^oMKiiK(Mb(?>^Plr5>h> z=kaRt@?CsUFy~Gm13bCtk=v~rSPmGQnGp|Eng%>4b}2#c=5MP*>M{__9n`plfsR&I zP34F7>r8mI;p+SQ?IVLAlg2Ap^Lw+{8i1JDE(yqhhBH^W<|tq&flT-RsBv_LkuW4! z{ovsY1AV)Ig||c%o^zd0S1mkpbJH(>eQ&9#TzcgAx7Iz}+{E}6bk|)d`u@Comq0>* zBte!-6u9IN89&|rHLGSh5>=Jy&Psm{lW+B6#b6gyQ*=a)P>6%ht%kKgn67M|@Xlbj zB;9tRO~urb=fJNhuP~FxmGS5Y+vru33^$W@(v|lt(Nia15CoSyrb*G=#6-cB?_`;R zsDqg|RTyvB=q7wkO+`kOcx{YHn_Z72syYn}@0CzYZG8Z=J<3bMoZV z&BV1P!$OrK2AmRgIw0?V6*RfT-~?CSbUiQ!cy;vul5@AUt?g3y6FVuXw4Wu>-QZLv zs=>DyU?qpjk&|<(?4Q#_si?m7TUn=3#+EqC!1HH@sc7knF!jiK^kDYkO~h6F{W5Y- zRCUt`xZ2M}{MEN|c;g(M&!8KZmnUxOKVLZ_6}sxk^g1hk)>$Sr5(zjqHg@H`LVl}H zRF$^3f8SnG_Y+xIg-dc?Kk2b}%-{dsyHQA1mY)tyBL7lbHb@N)x9al1k-xw0j8A@NBPqP`FjbNPeT!8%-@18+CUoTtpjoBN8*81;hWo z8~&GLfs;~C@o$TF^WcVG>`z)*Ao}$7-omf^^W``Lza1ZEpZL}9=BE6MkCaA;_;Cg% zCJqv`1;|J9S{h#{1t>tNWvoe!gOOeaiqh#?R!UZ|jBMs$0T&XDtoT{-4r_>)Wx z*(I9O0Ohb;3_LD!HmiiG=MyRriYdd zuf_fS&qwp^sxee$=ms#09?m21Qjw_Ffi4=~zI_~e)NQk9eu&Y}_OmIWp*ko=5x?{> z%Kh-A^xOI3hy zO>~v#Vyt2!kD#D6pc2>%Pys_|fyjX8V{T-0gdUQVSk)w{&`M&IJ-{zC5V$Zt&VvUJ zPGV+_MPGezZ4W3R%vgXNMgo$RhAb}>JE$R{UY-QV2rPk+PoM}zl~7fV>EHxvmxRXr zvSFrqCpWWYyN^t$-hX3wE(wtq6*s<1z8`8mb9l>8%5|5( zDg#9{+rE9z{rMmYS|)(HOCS=3^bGngfZ_ZYKBJ$Oo*o(!5_2g|oQyk&Zubvif@njT z9PGRi7y^{BhzJ*E@Fqvs%z~#UTmgbCM5#)8{gW)gPat?4W84^V1^6v#7}g*#a&K_Y zNKar#1Kf^#w1ayX!(vc54gnVfv=f}+g_{>%>Iuvrn%z$?1x5hA>VFBmQ+&`KPR#Bw z$skOTaduYfnJ!>?@agB>AR2k91cX;vDJfkHMpzjJb8>&+NC^cB>Z!k=;X_%VLS8|=6C8U|6U0oCX-X)1DA3Grx}}3>a7sKz>;Pzy40?f*0vruKkBwxV zDT;zoL`0p8?vKHP^BvaU-c7=!>U+zXJbuI!(yh=~ zIsk+eX=5{&b6p~`x~-EzE$gNJa-H%j|2MI~*$RpoD!-Mo8D3Lp@IGqgg71y-P{9O6&SyoK?BmIaJF3HyvbA_v!ZvhL_9ZYygep ztMA{xk5SV2gwsva7T&0CNz9b?~-qG=cE<-F5zL?OOOwZBVfjxc37H$;0Wm~mU>zHW^=#f#QPmG+wjWk2c_iV-o+qDAoCvfO#%pZ(95of*I z%>s9sm_~AutnDOs=n~%~a27qLoD3nb;o>Tttd0F=@~~7xjw2Mg(ZsW?aG9H(#aI{+ zO%hs2>d?E{VY~@+S>!e#JrR-y4uudB523W3_>h z7)6eT7Z(&JI$z8p-weTH)3{lnZT!#n`A;I?J650~E)K`4{qxUXR#q(S2p6`Pue1bg z7d6l)->mEar3o6{0oNzdhS0ZR-8y;72}LxA#{GXln}O(IXfuao-~#^jD_~ZP-e4o4 z9Yyv@Q_RFxRE6jOs499t{yu$#zKERMTpVU$LL?G49h{j?fV0>w7j|O84+dHAFm8kf z6MZE(yDBuuFbW#ZyrD`|t%Y~YcL}Dp41<=h_>i9r8;K~Zm$=cN&xqzvcXwHQeDS4Q zdU`_eMgis|a3Inan6Q0(RAV(n%tsgT)}UYRB*Rlx9etUfh}6AUY~(idES$m3Xzkrf zguuc@>*C(Np@#s7zwa|zfy69id_+V7h+@pr0M_}l zIWEG%dbElk_q3r#*7vwHCj=)%pa7RjCxB-SngY^XF4Cr*ymGa5*rNCgL|%46Cj`AE zfe4>DBNvJ_4rzWX4tW9|iTSUW;ij(VKc3*QFpmITp zWn^3gHWkL#t}SLF8jkSrziVI(q6R(_TdSk3y~Dw9$3LG=An^_`-4a8X)Ya7RT;T6z zB|+!{ZYZ_5mH_iMjS_MeU@=dhR^pMRqErHt)7jbSJ;ViNp<%|*eIiIF12;^Lo){W> z0qLSt*S-7q0X8+kS6fzwp(EOm(49GZmd*ntPg!lPG8v)`IN4jjeUk%F111J}kI=t& z3t|bN7=n-I{b()4g$0zVE9&V2z)f( z-Fji%=I4xHgW>}EuKJo9r9QZ)!?$T3;)h>=&I8p63iNG4T8&3DKcJBcdi@&dOX zyar;v;=DWwGO(I$Xa}^5w*d~j{yX9`BPAU<3 z2G>4@+k<~}Px$}GuRb@Gv=YZp5akw@gWLDyYuE%ps1czFtjfXyR43$l%Ag$vx}u=- zL4$yMgMq9q5y>dXfvO;;G$!s@B*&pYYpSkJlJaEFdrVm2LPD&qtUQH}a&k(m*Pwa% zdLA-sBo@Q!by9%*q%h*P(1UwwhX05Kw<0 zY}(wsd-twJ<{Y;bav?~DejPmH?Cx$zAR>!o_0I*Lb86{u)$q}s(1D@;ut_}!Rm8xL z!_Z-)N%PczdwvNu0`~?bV=^%W$g~pW2Eew|)VZ><4VV#p{KiSCO$Vhv`}Ch5%uHyjPrLg=H!wOrUUfrFiXL)Ou>&1vP=c(X+01kL z?u3Gd#ynuzZ5~kdg=l1|1~WieiJ4z0*A(rnrcB0@TVm)uFesoZ?7M-gReNzY6aORh z=c9(>8VB;Mvovdk%?`#XMqb|h2F9HT9CnoV=-qxA1khc(dNJ)u+9g)4sHlVki7o0< z`MV4IZNR#K6n?^=Y0alhCOZA$utRshcT*~-M>@H2oXN%L?zTSlpiyfo%Ok{nIcIB| z0h9xo{9h;sRiN4zT|U4%js+(#R=rnA@bZ~wYie$ekqzjCN#gugmAJUmdr8M@qbT#1 zzs-_J$6d}mJ+MiNW)g1U@qQ7>SXma4G~|mWiG4ydj|3;eLsg%znUx8sS-aMq&Lhty zlwZGo@Q(0l6`L&X@!p4aBcElJWBo5jdX0yyj?LgHFDYqt;Xc67AZGmI6Z9ry%{F_} z%x&sZrYNE3jvGGa;Y>(Q)~l=FKiE}wT;B(WbVYpr>>Cs!yWs9TJ3Hd7Yi)EEVkM+e za4lj!1~pL>u(V8BS>^-d#;d-~zvZ>~m5MnG>cMOKs9)5&nl#-1_gu-nw>~g9J z4jm2HHZx!)BZFxKVl+(S_SVy@N0P?nQf%u2HDuHp<0?30{iZK-qKMXSgeB+W0~W5A z`~x!%sh=0*$NdKiefTa*v?aHUH;$r360o+LZqAHTQMrHZ0lxTlkD$}Cp7wJuUpA_z zZw8HM`oT$MYHGE%VK0VsGFIA+kAr|8zonb^=(sip>(8DengU{=FUIAXfvx!WR(Zyt z8r@N=83gtM#loki4OHI@dcO{J_STh0Gah*=OV4(|zqdT7HM@o4 z;F;MOukc-jP9<|1-q~gV_Ic}N{G{YvL~O48`fC7>NaFPZdpZn6h<)Onl$;F1%nlH{ z>S@oCEDU?o%(G!O1U}&a+DQA>{6Mxs^+^eq03WQRv5`n`Utf$U%hs!1#ljM6V|k4# zMT}UpfLf!Ri7oig*I>?#q!`F1&&Xzf>riSUI>r94XdvjhX3qxCKr43&yF95SKDgz> zy)n$^!3>r=VhgVB4+SbRrnYt%)V%!jZUD_@`}ud;+d1m-BnR)9nb~OfruL%X38sg8 z?ZM{#m^r2#_3h)s1YH=0H7Xrj@?5;PZh7o-=Gu=URQgQ53ojyc^e(@W@$=CIP~FO) zaib-+g-kbep2yL)MZ1CtAdX@dg&m z(10Ire0X?pe7v_l>8_u;#P#dzwRQbDWnlW3ZF{$U|AAj7&8TN?G+Bapx70+EBzeZ(w zg;=PC-*X@M^4`Qa!khob&D-xu-F+$KEnmtev?^yWrj_m0Est)f-0xl!5scF>h5{V& z7p8PFDD!m*;orXxEG%#oPLDM}avLfuYE{X&{oI)oqBp*1UAM!SNb<)HkG-eXZd!jq z2xirQ<9(4(`-}yr%|F@S17*2(Mj?&ZE!6R)MMX2SBLh#KDpdV}LzywU#>>Na=*z31 zykG3kdCzBH`MBk4SB2RZxCc-gCO9jDKldmb|+V|n>wEDpO=GcH+A z^xrp#y7*HIAbh)*YCGr5+{6t}lWiV5`5Mn{nvCX&NjJAqT|IlTOD2=I)%xpOQRUc< z2yOr~!8a3m*w`%cU00J#BEOq=mg!(>kpkJ@Axj?**=;6!?wwA1u_n1K*xMgQK)3xi zSwR*TD)7Ak@Ye2b@?^t?&;FC2f4v&(y_3#yg9q|KiloJnpy-D0Lvi0 z5r3(_^maO(&f@9_ftJLag3u6EE$toWC-iE^Ump2hJ=FRjQLmGmgg60Lu7Q-4kD#vW zr%lYeMoWcqH7#FdI^&QFF|lq8IVwtSo<0m-6`>fLc6fef@7m41he$hiFci4Hup0WI zUCD$-+N-VY+5B9(JBt`pE**F7^qo4D{^$($62dlPNohd#82tGZMSuQsw2XXSG)H8 z2M++%l$sUfo;s#od<5T*R1qfccSzwr=+#@@RYpMKI{o#6bnWNNlPQO6Cc3L$BbM-I zmYm}jiKV}s+<&Y|GpU=O?q*AtmD|pK{=O-hma|9oY7G=dsDPda9PTRhTYG*3_LlUo z_Gtf=T`*r*zhS(856I8ad3Fm_p^S&~M&j{jd{S3yUMGlB`QyB@i1r-{N$IeMn-Y6 zQzR`rqAtFjCP^-c8t80@EDNQ(`$EwD^!kOK*veP0S|#@Jm>5=uY?6)@vl`aRv=#}i zK{nqZGTr*-jRGDM#Hn#ta|Q9%aPl14+`=Jo>CzyAdcF+#jg)8c@4x#&yzcelg?e&~ zvYZ@S>nnha<~`%1*cA@bH%tCv&2&9`+}s*L3Qd0oMcv=>L#TX^;KPUD^B?lwpWCwK zab#3S3HRDZh0=?A%T*&F%fc|qnOF^y40n$WcUtb;@+APo$t$A_DU@iOYNm(81>-u_;PtS|_38Aw!Hp9I?IKprucH4-1ju2=p+ zd4C;BC@!@^Gt)?1+Rg{`K0N-f4^%?jb3Qs*-zDp*g;hb-!HiFzZt=a9A#c1NiRjDE zoVMNb2Ndp6#`nMHy9r6W`9pd_DSB2)Ag*`d4Wqdo9aPXS9vM73bN&-urPD&uQ-??i z6v@?lKHAOvAh)@TZ4RGuTeV8Mx+@PO(JEbFIfiRoOtV~66i_iAiB`(RbFw5`SzcuDIOiR2pa^${ z*g|K5DqrV?n96VkN7b;fuRXC7itnSpeLD)UHg{^o+to8vCO9k)8%)D)YFkTcIcN#3xz|1b&Djo8KM8NA=jd!OlJnw!$W*qZ?ezCzD=*9zX=6{QRBmDjw? zPToN!(+#Mu(?^SKs-jd*dB$SO$b0r0EE{Cb??@s3pS>eL4FE>z)+C69NXQ>xqz>TkNybQLN7dO-kq7tB|C z;4D0$#$;$HtEe)Z$1ME(t%cz&lVPy{xA8vTvVeuhH|G-$>(-1u7qX}rZfA+y_IlbC zCt=Jz=K6(dVGY4L(=jmA620*f!M(h;9cQistb<|*Lws;La4AMR0&+b-f@i`T=d8ds z2`utcQ=k>}j>q+CJ{1(`pd^O8C&$6c@&*>*;p1*=sRqvsj+!ZiXJ9_1Fa1lg1=*ak z&(W%fYUO|b{rbhj2g52G3?GDpK(q()?`&*zprTwFz?nAoUB7p@fjh~nw@ zlKt$uO-wa6tHK^TL&cJNLNms^2ZIy%F1|;#4Bc4|-Cj}WhXN#$s3;#3?;zKVUby;Y z4%lNB3~ZZV=CBy(Bx{v;iJ|UuKBLvf%(p*w^n^BUFe|G%Sqn#lpzBh2e+FDFmwLUY zNsW5;Q?dCIZw`n=ytgAE1lsh~`|Ha24?TrW*r`@|J0i;c$4Us8g58PjS_T)6``@9F) zh%>t++6eQG!90*IurhP7^x#1$C)@@T1Gt&=#K&4=E=r8*8y&ukujDb}m{OJPV9{#+?$%VuH3{D* z-tq6a6gHE16QSMF1cb2ATW1QJBZEhl-LGz^m17?_VmOrZZ)-&Ptj!!?JRuEFb+*j4 zEa-EUSIPdWWIB^>py|X%;+=21@srvsvGCmA>r8_1&XQ7Cpc} zCi<)4uu+uezBrV6Ikm?k{&wH-B#>OO=s_crJUxRUTA<|1K9=#`N5Y!j;z7^pkK;fv zxWw=1^;f82v_P1#A)tN{0?>i3CooVZzeh+&nVH`}u1@2Uih1`o+FgxS2&8^o;c!X0 zvanN4dJnej2~>l3j*d=DOl)PP<@o>D`U;FzAw&27?Zjl16EeJfzhBZXE9&=li_ag zQS>W;WMDZp(#nriaWiR>QrjxMesN}`Zg6^#^eHouJlKSGQ2p8XhClg%LPwQSSu4zR z%z19As_L7~aOU(_XTDr0`R+HJ*AE>el&3u%`hpq}oLEG3#857{xkZ({h*w)WNb+WG z2;wuF3%#3*bOv)FHj=LHXclKdL(kjC8#gBTw}DAyjLh0@MBo)}ERZo7^YzM{*PVFj z=)46ceB}$O%U-jS@*QnBmi%&^*f6?qnk|W&MuQ^Y$lP?3XfU4{d|D3hx_v}`DP^>N zeWqT%fYN4Dm32#EFI|^3j~|!V!nz#qWmm}Ly|an&a6-QWBzAH8{VmX}&C-Uj`1 z&z9pX(-RXzC>lMU3Wq>#FY^1eN&M2CP2`-w8Z$Gqv&dmRJhP@pb{aw-LMS-QRq;-< zjIU{PvwHo-H=mO8%vweKRVmYnPVvDTw{gUXBfDtLG`^yIMhsMCa@`AIClP`f6D_jh z9E&l{OnRu!`&M0LVq|^Uc@eoU#xDN4WV!B%wc#lL2!KBwOaH z*Jy9p4o!7F>XsL7(B`anE@WV<0q`)ecSoh%W*wewOm;Gyre@|R*tb%#>_=m;7X;k1 zs5dGV{!KSfC;;T-I}{_KOm-3y44`j7upRwdRR{yxq(jyiPFzQNr-1v+z(Cj-CNsM* z8-rWG*LNF$DZ$?X?O)x#RLCt1Y6qqiyH}NifNz1KEEqahgFk4!x^xCs=ujAia6Mpi zS?H(XeuKmh)l24NLgNL4OH9h|OP)Vp0#x{65)vQyRIY%eIZ0WWKlB-jtRT9_*Z`0T z_%`b52_Q5uryqlVL1j%13*;+-z=P?SWno7TP{|O{1upm<=5GWQ6ky^>3_!pX+q~Jv z*0uxw0MJ|k${cJGEHU1zWq+XQF~7HEVbT&px++tOVt^uk85`pwf&TdgEI$ken&O)d zkbcm_Pv|-W%?yZ!_x<}Aw@*?i!x$2RzUn1GNU_1Qk$%Sy-DXU-!B-;a{ji)wJEkL< z>0$u?jVALs(Dd;hC?zgp0t(a+F~Y>{xZJt6OHVcBIZ;5?hC+*+%ID>?bGIZOJl#vW zQd$E+sMGhi%VR`v;9%I|P(14i?lje&gln>Nb;>C1bP8Ra`fJQMR9=ZV@lB)ghV{#V z@7tn4jpsLsmd}?jdpGZNjE>f8OJh?L1G){8Yl!6rB{=Duh264b_7-wvub*`9FXwT8Lu(%MyKZXuQ$I$otOvxR2r=)mc z2yV!1xqtv~(l9wbF_B~0JCtemk)v^-Te*(sxf)2_zM2WTyMgCQY)sr4c!Hr8kwPwz zkts0!dV6MnxHv1J0mj_JYRFM{TxFPQgogk0I_Mp#;&M2+Y&vF;YM#vn!S?G zauRJ8Dc4E0=P$bB)K_vpUu%eyb9J4*OB)pTQN?92vfrfP)6n!Fio;go=;AT#8W|Y4 z5zW8WZ2=;B<8y>oF7&h@ocSw4u;^_skoa(s=WlO@E)oRLW^oA54mC*YCy9V@uaxu$ z_zNW(&Oqgx=T8R=KEn{udj~gRG>LINiNHz&q&i?NP#27m6B+WVI8W5{T;aV4LIcqb zCP?fhqQ{@$Oo1RY84xH;LjQOKLKh(tw;KqYp_>rX&OzF2w0#2FQHpB{aWG+mY6juu z5sY~`b@MJJ5RH5tbkw6qBBrI#Rp>)jPAr5&N}P1YmiT`Sif zK0Ha<&-Qi${Z_H9V)gd^aU8}h#vGdG;(hm;naA%>mx{08trueAO~3m*HdxcK;e+v6 zxvjt5`?CKX<5sb&b4w|UHNu-oJf`<%hhaUc4}S3S=r$M6e&#p6gIZ5!w z(~W#{R3fFefjW!9w1YgwE)92yqstEGIb<@n9aeh+NOu}&=f?@DKt9ta7`JSki`|I; z1=ZjqhmZKZaEf5C_h48C)0BXc7UbXu;HG>B)_oOr5$_tY2Q$Ax>@jf_;EY6;rrO8H z2T3RNEBGCfklTKH;j_NOq3LrY^(eFm3*EaX;wi3HpYzO z({PZ*6nddIa1)2xRE!q?c)>91fQ%pX@42>3nl>dhhwkJvvdrb`MCD!SXQ5&wKw&)% zY&RfVlOtK81>Q0U3@LDP%ODH#&S5?t&-1zAiQ8YKUO72=AKzZ|BA-0SVxOZ=ssO$Ge zEpr`k2Z_K$m?L(O`{9lefF@2Pdb^|(z*K?I|0gZ9ATe4dsC%2&-vZ$QQpg)O+75g; z^FB-E={G#^ra^18D`5};@rm>VV+h~@IPoV=3E*r1h!o$?$yxnWiNL;j(C-687K!Ql z2S9}{>f77f19e2n>jv^F?vo4p-`H)vn0)du{56sO$) z4kb1XOL#M{T5C=_(i3zYg2l~w$NnUsqS@T(eBe_x7|4U^w6p?RNQ0_XPBMD75L*iZ z$n4Uk2#?!$?m+bKV67T%hCnDmRKRbrUL7%r+tmAkW#BiKueWiM#jPjQ)v@*wiVu;H z3pqwAkTABssLPs6`*>>9PlxsMZpc)mk0IVUGTx$v6nituFFBQg3|-S$$;VoELlACC;e zHy^L{J7T1l^4xu>%RnS)>j9~rmEb<*{3ccYtVugpu9i%*OvmZ{Rxkgc;<@S{5)yB- znTjP538XBTLW14W0#`-Ac6K9hVQdnRjmA27(IG2bVD($6yH|oMS8UqWT`~O-hPI03pTl_FV?Ln!pS@ zZ()OM8T14y%gPKp7MEG~@i76WyanQ-^pHtbJ0%b*mjx2%HZNFqB{*i_O_AWFf1o2I zl0eL6c!Urstf`4mUyUwT={dO@Fcg~CDz;L%u8)F!*^vOY@R4FN`_ei)s zTP#hna78Dg%=PxW>TMv24;SqVjwy9r(bkQ{=f(-HrTZi*$@8mqhq%Wt)F|+ura6nYEn`k-$R6D^!jj6vOFk-G&ue z-gn&53o5gsP=t6y$nN;*AnsIe0U(({-l-=v@I%Um0y; zbCQI5Uz3+maH$IaWD8<3=a|evWkBtFzhhLzbgVt_(Ia|j0|3tl@XQmLs6{5xfek_* zHo*BkCd?K6O`iUp5OWz_h@C=8G>!fVmT{l*+U32sibwjYtLp3HH6e#QCn4p>u9)wr zFDg3bbmv7|o3;w1C!RjF2Jh;%NsheDL(t1j{W-P?3u#m4Ewim5Cu|@QO~Bm3QKBqdC)R^%#qOvsd{j0HLQbs?NC??D z+9$AVnePxnobWpT!UF+|R2%&_1S_J~12H=r_W|BDn^C~wA*!TG^Ss zcw@&D;~-j$@KGE6er5zNGBIjSEi4Z_fJGNOFkICsD^A@bw*UC?kCp}aAk=NA0F`yF z0g1KTpjTAr?}e~e9s~qi7QlbNy3oDCroi?gaKVHT&8!X`BTT|{#U4K%ogW6~uE%1^ z@Us2fRA2RidCOG1N8Ut9rKb9CRQCHZuzar#B0Bcg&6_L|(TYFs1b%gU-ivNAD1;7h z6NaZR7(M_VzzQtqYBRSikXWCQ%ZtCnX^woGuQuK-Twg0&2zM`LJ-TZSM+r3984=lz zxbTNy07mg`}XbeStA~P%{kI57A8yM*v3>M?*uOjZK&z27ta{ z$Nt(#oD^|?!=8L^zOpXRj4a15i=mf*!xDf^S5zy6Eja-+!ldl|;uz9wGyF3&Zh&fI zRdm2Y*!ZoNVhD_wduww`izB}A{EHOy80PJyoQ2qqAz8vf3N;g8Mm8XABOEx(ufqKA zqDYq4Zoy2z-f;h^eR$W-Lnm$-=6Bj`Ydf z1uCpUFFxAisL1UY?&^wY8W!(?5`)80!WLmOi_XpKph`mhWBVgqDe5lC$OW|Un{mqa zvI;3fq~k^W$Z^&Or??EFz8_@~aXu;kwgfdw?B7taJ|~L3&B4w-P~g7!S+3~)`vXEk z&Ja=>vH)zMV2l&(^_L3@9>~0L%shTvgHwx&O1uQQ&F`C>(p2LQLTNR^9&G_eD=;WP z;7QNy6Se)v-HMEPy&XW{GvZT|K1q=@+Gu_TPl&ysN}hUoA&i=mv#tmhHf9ELp?yG z0wH%L?akjb*N(l0JsI)wC-+d+F&aRFnaFS<-q3jGUl&CsWKmV!41zS|NTX73V4%kv zBoi=FkF7~i@#8E2vL>yJg3%84g}5hoQAXgbHv1T(HWKe}Mot_)&Q3Z=t(y z6+8FXFaxU(@^2jL6|{L(1apzh08x6s3}rcLQV1Vxrw2pA#=>D&s1nQc1{k#E0M`rT ziUEQf_IX3=ptS%STl5=tR(mRRJ|ibL(btc(;UpHo_{)e}tO`$K!w*B9^g0R^pz*;%GX;V_a%m4_xmtpSa{Vk{tLP!B-N;pBok6{I}) zuD5+&Ou+TTX8z4l0GfUjn&6=KJlXxE3z5sV-l zT}b9VBsDcPF?ZpHm!_=>wSTlE)LbjoUnNwh&Ycz7MJbwm22ujn4DalOa{VpT8;Ft} z1b2vAvGX-lVhnJi0j%qgSwSJ)8F(h&RltV*E(}UHw1jX?%j8NgiT%9O1C5FK!8|*@jOt1Z|6ACaz2;ig95Gb} z9-dIld^>Uj@eneY&{(sIfZi7W-o3>LBh}R-e`gZ;BRG>qHk{i)MpDwPF{A5v z^Xmy4uH^N_#Y;be_j@3COEb+`Kc*YK)?GOneC2(KE9=hOD3hlAJGqGgWGR~Q7($z9 z{d(gczK{Q`lp=;|>`=TcODZbjpzKMP;*S*E_)P#E^c)3#6Jf#P2t~gK;z~k7LRG$f zM{l&O&mWzVq$`DeYHRC)t~$7|NNB%%u&iDXkifV-VIr55y+UkiMy;8N;88bHueJAl z{rY6<=ZkCyLYsaxOzdwG*HnI#rPx5bYuG+falNXt0;gYHh0M6Ul&Xze+s&Gkj5kaS9*GR zd35ZT&JA-A|4Y|~vy(LJnE+@039g0Bwts&cW;{3+bY9;$wXgf1W1z?v!q5srFf-OI zbQOk)-SF98zvFdvoiZ1xyuAOP!#<1=7y7l_kjE1|5RYHa5-6F56h|;2i+K9a&ie80 zSU|Z@f#B3q`#G zzN0w)sfoq;@5u}PoqXlk>mZp!n(C`*n*2u0-jBlu6?zTQzeGDC4o*y2%SsWMA6{9j z@B8G*pMW*t&|6Ish`;~&BHlMtDCnP$H~tcIcE)os5vr|ChBDZHo;p=gCmyMJM^&EX z0ofmy-gWO%yv-V_jo}{+!8l9#aVGtIb1JHb(3Oq%*nc4MJx)wXS!FC*LN9$FtVG9bY27;dur;yNfyYV_= z>nKbONChN}C||&uD=Vik$?3d~u-W#W1}paUab|BMEnp@5dNbVE+M%#U9DGp6!nPa# zO!Sh_kR;e|U3=$V4+d`8@f@G->ST#*9f_2l^nC7BBlN28z<~51J9}A6@Ji0VFVb!8 zDIAD6jt~$MZT1$`y{S_+KY_bG6` z@Q=#@e2Gt|Si<%Pa!2cb`_1szHKp(bxgN?lJTmrOC@_K3fXU@Q3(v5YNGcekuyE)% zY}wNIOGB1QNDc2uzy-i%AL!}9@~%fVfhf_d;TsydgfSqDAxptjro9XDB-)evYJ*Yv zC15^+>=-=`7~t6tMg|%;C7J2#t6sFZrmrt9CI)e2F34}f^Z*Gzf&>l>-^7tlkt$n+ z86ug$*y&i146-l6Zvy)VG!4jkBWKT)6h_Go>70Qq+Y#{fwgOa0oxz+zU4e{6Xk8j+|S$`ogQ@8-rU&) zQ$@hU4nTJf*OPACP|@7%fN=sC?BEeF!%bAb7lrR?qL1y)WBOS^7AkoNg$MZfW-z|% z=;#0;3t7zc_&9rlGPUQfTg9A$g8k@YqNAU<>MBL$O>EU|Fx?y)g4eUguUnw#isk=~ zGYkk}Kg=^A)wyLSU)57vX<6Cb$1WA2vaGH=Vy=j(hRR7v&iwpdN5hlbD8${&@OOpw(JEvGYdy1_~`Loomj!uf%T5`MmPwvvS!f$8EQ-n zfk(OSD?}80L{Ni|gQbncfrKWRI!JVt)hKz7k}%p-vLOlxtgI{{ckuf_P$V?D@RN`F z-6HPV87>UN5B(sF7ZFnf#)B_D{@;Va-nnY9fapL19FE@9(7OF-kRt#nnxJKY@##y_ z4PtVINi{DL8KH3Q3sO=_gChC5qG+bCEcT0HjnxlYqxQa|8i(2t`M(%&e%lFa7_hBv zFa?1A7#XRgu`HNVgfZ| z)L6V$`~lG+k%{tKo3KjWz5HN{>*)z>9SdMVv77#L`mp$-VWS+mupX^!u*V! zdMXjL;MJaDAZpd^G3JpCY(xbJR@i6xL z&YieeDd=}8VBzlP$zGHiGkPiAD0tr?OtCyP| z9hn^<412!4=Yf_BS}4_8&`yXgMrec&2yA}U)F3iAoA?ZE5frb62peI#wsxwR30viG z@$yciC526^KJf-BF7(L9)ri`~xIo&bpWzYwf#~O9NwX^X5IJw7LV_&W{W27;oU8z< znG>yCqbMWY zKFCaBiqSbcc>4G?6O-<~zJL7giTvX*z6q_5W5*PJO|QnE5KTft{u+KZNBU7WC9X#q zfwCHd5)!yO$$fPXl0kXokjTR0Lx=_t&$`EoV51khNiUV$z za~gUMs<)uG0oVsz$|@#}QOhGZoGJ@MiQb`)<`0Ky>?eOD4+#I%r*?G3ejSXB{*mz! zsXF|yp5Pfk3|HyDmr97;ijA7m^bZZit;e3=%ZgK88kjteD2C~ zD(bPUw-XE6tY~=6ucz8!ox90G<^Y2e%u82A?Eyi@#0HaD6?JKU4ql|`^cv7Whdd(M zgW_V*b@_1KHvW6#oNBC6q?^yWFpl->AfbfUA4CEIA1|ZMf6K>@s~pnGOz?QJ&){0$ zj2+5bv~rA{LCsyX1H&yG;ThR~1G@h7KiH9k^g5-`1gKX+)gwrz&$J^SE&&SEzvE%% z+l}eI_&5i?9O}I1d!=dD!NW1y!02Or3oEfwD`oXVv8e9S5sFF?VGtpb;QAO2uTOr zmXM+mml$!J$i!hA82t3|j_!}>DKRZ<7J@Fr z_D8^tJTa$*6R~LK0-iRVBAr6s4q8VH^P=t%C5c<~Zlu3YJRUsYTM6AmT+z>0*j8+M z`bQY?_#fp)CK$#HRS+OREgkc9#gLP^;2}8Mrd2(IvXA1@t3mLRvR}nvYs|J>fa0v%%HQ;*uX=$l*xpqGwDU(9S<@YeyZ^Q%prw@)t zVgy|^_Jc@zabgig^e>&mt_kRI`)nNB%p!Dg>Gl9F4CjC?ZXanYGxN~buOvc%g2Sj0 znl=ESb>`RrK5m7iEZ__;Ap_S8^iCl5v#&2i16*Hxj3M2;ql&XeReb;6ynDz ze+&9hD+p?Inolr~V8$>6Em8>B0;zMa4CxiojK-ElDG3{t70k(ugR&1j7vQmq8H3+r zdRr!1SjPSTbUitAz`uEq{-P+Qio0)M&$zYHn!=xlQFJtK0`+s6X3{pv3H%FIB`|HF{8~zQiz;or*{cX^wA_ObhsiN##tyYEe#PByt49g05(JpDXI{9+5*gOQ*(2y z9%2uatzGl}_D4e%(E!??TY~si-XB09qzYO1zP`Mta?wsO#XvR<)1ib$5UYTY@Er?)3+Uykyoqz>&x$fS%gC#2MVzm5M zvxBQ~=J!;USf#!l0B&O?1~1H^Y&nFkZVe^qDSER|o(Xj5koG?gX?8RWgaVP(F#*HL zRu)}1h;Cdn>P#9T6vYz|3l91*GqP_%U!Hx-RtAP-o!tMlUI$ScVq0dSk&AQ!Pv1YH z@`c#Ft>{XYBk9GG4-E>6{obW<6kYWvL}Gry7n(v&y%pO~7NAvVaCw9kSln{VU*usQ zi7Y1t1Q;zX`W?qEorb0;=6|ZouW)EX=Az7s=&i%K8{AJhidRTTD=N2s*n`+oW@glK zgH8cK@$M1}fJ}ueOJn5zAX-{l>=Gd$g`f_to2=ekhGG(R;|PvqG=UlDfo;GV7vx6* z`VD7N@5qQtllsi~_(k;g2}4U@;)WYJ^L6#m^`be&9r5|ZpKSv_`YuFMsmPEguJCI8 zueGyb2^wlRb?1{)Qd6Nyd|6}@TDs6V!E0k~&I%SM)asPN%2B2UUopp#w}@FB)JDza z>Uw*6K7an)X2TC__6GOya3F1ROeAZGwq^OD6(_;G4Awzup2nr*m|_wUrx?{pcU3 zpB?|RO-VWV+SRrr8lQB3bdXPT|8uQ`|I3e_-OpX&Mjpbggdna57QX%q}-*~t9&gH}{mgDq-9xNpEF9OPj; zhy&Z%&En@2BAVh<{gfj>bqA_aM5WmOL$A|5m?*9DkP<+O1@dSA?Sz~}rvW9?ZlWh; z80!{ZZY}rY=bn~sLjZ2F*Dt+Vxrg6JH7W9un8VgLh|Ke%`XxU)@Nhb#?x$-D0=sU3f=BfNmsZWD*o# z-2FfAcu7cj8u?+vkG9b22QcJj_9ns0;FmX5==qcOI=}g~s3_fre?BZN@zyXT%)m<2 z&CmJ&y|oSw&mR}(M(Qe=9*)JP%eNFCJ}V~nVD|&=P?71F@Ko1cPx+Ol<;NP_n_LX) z29-f!xKqG6eggqQTniTL(3~!ReBjsVDiRDD^d9d?D&dyl4-1=ie!p&Z%ZU=aMw5v| zn!Mhre$acz65icpIN(lQwAtcyn=jV|zmD+lRG)T9RCa&UzTMssH}E+p`e}Q*?#*>_ z|8l)lbnhxFbx`G6tv2oyeuEmaq0Sq#M+>v1;u6VAw(|_10sVkm+^=y5swa1&qfM->^HzJbjE9daDi$s-DqCOeNvx7ti3r|{`Luca!P?+k zH z=7F?pQBQ>hd%7PTD!%~9QHE?X*;XxptWd3vDM{a;k#2y$f5uX&EbfZkem;naZx$u5 zIC`%%xlzLV$++AS*XA?ZFUTp|~$TT*^OR&Mu7Gr7doSU1h6 zde->H(Q<2EUfvbA&Qu30v8y)*7ApIyFUU(T{MAtLjMXPq`<3O#o3953&=_qzqUX4` z*EYG&O!T@Y&z0}rbylVmM+tg$5T|jIkpGQ0&P^RUf`K(byS0;-J*%~(0yu1%Bmz0r zuVc+IDJdz{93=DF74$~h94-hwWpUFZ@3;^TE*S5pMCm;GI=`y;vKG}7vtkAwN^-mv)XT+F;v?G3HA^(KqS8(y5R3Fi6eJlN0LD36N@*0a6K zWB8<2V-2;~(cjtMc%8pO^ea|J&_8dOVR?1pQ#AVz7y&@HAT2Ln2xfrC>)gPmob5t~ za2|m%0w74lYUT94I9Oj=HHYii$+^mAt7vjsf=zS{Y4UBHKf{~zalBgmW^kP<>gpPl z4qP$#a+&T{U=GjaMWz7RnNh}Ub3JYAbPwx+k7?(8!bqtYmcj2sP`zfp_NCWO{`H%8 zi%dc>ae0~aI4pp#H!Wp|XyV<-cO-q9x)X5jyw^A3f$2|Z;)#uRW{nRU%{n^X+j_up zhLxSv$+grs`=iW+?MXogVb6*ply=+1syG_Y% zp!9|I)VV;RGe5Ba--QHgLr-W#E(p=;j(M|C!tdO7_ok&BvsayoXJ*vyPbh!+$>pfy zQfWB(xNSvx&gPx|jf2K_>p4GXQNN}G*iKv(3(VM<<3|bo&%GV@i`S^*B7L33`41%7 z$t5z^S}OS{(Dj62fu)^&0{sTfrkiYcen6jUa&sy1I8VD+FXTF^M$Q5BqHfkadNC*6 zBYmW0t`zc|H5U`yx*Mn#ZcVR~N&bUq0^>NM8PH zDT=pKe&JdWVv%P@e%n|>NiDDXu!PHmKEp~JmTQ4t&Qv0uNS^wdP^a0j<@fdt=aRKL zU5!u7e0at%AtCdc(eqk6Sj?BhmD zwJqj>@x{?ALB?{k_dHPRcDy|&CX{#G?&P9TyJo|w4;XQuuMVc0IMS6w973wlmq8Z+ z?vlTz0EXo)EskA9TSx>D3JqVVje!==84N}b$G+Qy-(6eK{o35LmV(8uEi~d(QGX_Zj%Fia-SfxX*ng614eZZ4{}l z3j**$FiL8}I7y?Uy%Jvb88SO067RoZcn2)N+jHT5e$Q8foVf1f4qxVrna`A`Mp;Of zeLWZG=hZ3OIriA~)nBlg?qVg!G?Le3826{GeAVCd#Cz58cTexo)>*aR%;|)?KGl2faMf z$=MRiyls^qUtdIrc)Hr4I?$?bnq?}-LtFB~23C=&$o12gpFd|AwI~W*efj|Rq7#;$ zL?qxpUtRYU;sZJdKHkd9ZwGt@7Z2kps6)zC(S1;Z>l;8Cq6^>Bhz5?sX!gVL@xKK^ zZ#CL{xz{~7XnbN7snr#Jf~E%*m4CldMe|kqLt05sJ<^9hE6UCoPk+tY)W;PfXz-y@ zr(ULzzca6?@6p1{`_lLKB!PEING?!W*|kWKw^5z`aQO9;n3yk1dPu;#y258zKW}rg zZ?EYr2o@~dGaF!eW1uBE*&{(S4+X0U<-1MXitdO(m_r0})vjF-7X?33!~_(PQrQJZ zr}}4^Iys(Y_vT)3@g~?IcW`$iJ#roQ^TCcgW-3bg7IbvE=D>|lC zxZFfEowc$EBUA7UYlUag_3BMe+G3yc4%P^tQy}ar=Mvi_NXJ~CBDIYxarg~GMV<1> z!q}83X1#OK94c`y*I$U1cTi8d944P{eMp#77J`Ks*&zLLE$nVm7fcuQzwx!(u0zQL zCkR7-4R=;wZXF_U!ye0(g0iKBN$n-G1wLficQ*dq`fi(QHJlqbT$^;#c&zLb?zp_Km z_0+>h78F7o8sgs^Afa$og&K`v-i0dAJFe?gb7=o*FLyHrF!`IuMtbBjSiYe%U z-pgugnXry;%)py7{>5wDpmu9>yn6n^$I`y}hR!1e`4QJR8*Z9YzE2}pkF)A?r^ z4AUbdQ8S{Cm!O;c4>;%Ntz&!Ot2_ueT)N5ZH)xZ7PSrOzHg;4YUVg|@V8{Z`JLFaf z+l~5bu_f*^?ZZg?`Eztws(l;conR+(l08PMAZsm&kb@;Xe)?4D*-iJ=`zJJb0+6*F zqwY`&(jQ*qM(31s$TTjB4*DK{?q^1r1DXiRCJ+e_fM8v**!=dCdUb4rg!FtG#IDk05&&34Yd+~Pt=AEO1 zs>ONdlGogNb9XaLN|6L<*dAe|r`&fI{&L^)Xc9iV`->Ox9o^>Za%M)dE`3i&P9WjF zCD)ZRzsc>4Tun_Nm#%iU{g;;BO4k;05diVZb>urdh9_^7DV!4@yG354XWGq4DnR?H zNB{2yfMFOf0IIhrdFp3?!>?}6fNV6yslH{>jVZKCo`?>&Wjmk)5GA@oc%^4#K!el~ zj8V*727&Iii9D_7kFNK&Z8oqj^)0^|mX5+%tEo^n1bPyq^BtQPeTusdk`6NbsA#3- zrFYgRR)$hoy?2V9oLZvqE@AylS-_1e7S6qo^IA^4OKR9UeAyrvX_7~bnmyJZB2%D& z@9cS>6w@Vx%&RjpyoMb)vSHEyMqp8D30ak(#8F(Br9p1;Flzt|!1{^sdy>hGTmg-P z^-e*_HBV0dRTDRc0jy@GiRfNaKaV596Vqfn)6VZrXDGpeIo23%i+ShH42Bqx?QVUE ztkH4R&b>C46lylqr0Od=+RUnuI}`dI6FT|etO)sBK5RSWlO${`qF!ksEreeUiV?x532YbG5yo-*>%CLKA|9alDVN7erE2o+b3>qxNi zR926>H*)o)&=jHa761KPwF{SLVg>>QRya>- zXh!ek<4Dl$Ci~l232TwYpo@T$H(nxaq(s3QcWAa>yhyJiUXqqXkGrKdam_;0qeIB^M8 zV^&dD%-BGu*M@fNWL#QWk{V}WSJ%+;vcIVrWg-3eLmy0DT3TCIF-c{e>Q?=zIG0@l zPr+_|DMVkHiF`%C1}bNz3Lje=XUqqmDQ(&Em!2H$g5~qxtJ>Dq!;X7Nmg7a?e-{@A z1gH zqe`YMR#S(;H+PUaQod=VSoR_+XxR;EXKH5)hF`?j?D)b$=t;b%^oLgZA5LxxVQ@K2 z?r`jPFdTYk#w!~~{YNsd`3&|gh{5Hd5(<{SO;sjOVCWrp_ruq(0m{nb$B%)*I>K~Pa2UYRi}^Y74RPCq zgtXJ+8Q;SXvSXFLL8V{_;nTw^li5uTK@4m>4$F5U1Z*&^5vBB9SSO-n$C)bAoElIr zpsMAd-ZYt%6yQs=c9vl=Dlq-czjohf-bBFx)u~wLCc?oYOn2M6_^yyO)Z(jGc;yOO z&r+RtY@ewRs`ZHqzI>#*Lek@*Al;N|6_~rCMC+S#}|P zWo4{S@4XKu&!RHX1Y|>eB*M-rX7uM}cy80vZE#Q}3~UmxZQz^cyol=pyU3B5JY z4v@oWK^jxYVe+LzK71FOR=^m>L^?Qtj!^~M0z;(g&EI7X)&bBzrVT619p>hyJC z193z*&z`U{If&Ei#DN0`+HE4^O*C$u8S6gxoUUbjsy;eO7m_U+sr$og(d@EM&zTu) zjj{?1Z%n=~Y(H*jT7~Qv2YJ0~lx``D@a|o^Gm=J^b-#T`xdsQqFf(Qqw%ek1FYE~z z$8jtX7(PV)fIIwiK}Aae0%yu8bADco8?l_h3bdEua3N{?*oC z(~ZPoE3TlZ@*DkcDlczMbwpm+yk4@bCvwx^hQA-)PQNg@Y;j}s&pp5GKefSC^#1#n zG=p%fFz)VNCA1S6toHHEoIiV3>Fk@tcki?=T*w0S8?Pkf(__TSEGY;F<`>YJ_;|pk zoF+PGq$1JS#+Vc@jI24f72xZ^0|!9n>#zg-(LXoWD(FPb=;%=v7X7@uw*0(`*SWcj zPB*&t=H+KpJcwmnRhV9EQW#$+6$BGd2o_Eh*{gH|*>%xUsdfJEYZ^D6_*r|69*hy}ahXOJCMGunW$`?q20$dG4eZjqv+8 zJPidGb-{m;s}VE+bIdc<2u#(dnEMBWnn@C$=*iQEH@J^aT)TWZRcS?9x>CV*@xG^L z&e#S{PEP;EaCAA0CTj7?8XFr+N-&C(d-0L6vii$$WG=X4@ScZP61)J|m-2ghuGSS} zG`jKRtaDegjh~x4 z4M}T8hAIa+Y8^sr_qoW;F;#UNoP~gS!VC3WMXi*XyhDuNEMrAlMMPI$*dYlCK_(^% z0|OcZ11J23pWlF=pUut=w@C-*i051lRl|Ta%g2u!jHB^j2N@ZBp=bltLcEZSeC=x& zLEZxgIC*)6QF92k0_Uu4CcRP=?Q-HBz5dF2+jSROjt^gL^eAG5Bm{)^{d>*dx^ zosPAeHb&jGI6a)wlw2w%{$8h$WuZy$BQ@*gD=#pKg~IwKzz;Y3^5 z1xW>c_(1vVFD6j(qpasIUt#c;Z~koP>@2jnXw9ivUpFXZBaj#w+1n|vAt=xyc1K zy4I8=8o=55(AO6vt>y#`@7;nk`UX3zs(L=B_~ZFvQ9)21s^C>s2{c~Z+$V5JsaW#< z4s{lej(sn#E%OU@32SWGlF7%%>|IjPsCMPbi{ppB8SyZ8pYu*k1Tpl)_IXn?USk@X zu(KT$mTQ(QOtc&wN`E7t=1U;q&l-v}STLG*DFq>|7h0 znkt)`>Pk!BwhOO>Z=#|)z`(mVf@cFA9br%0a_HXyP(kTk$w6>uFKD-Ue>1&>jpuRo zTHja=kQ!zsUV4zTLcqgUTrY`)1?%9jmC5dHt5*Csu37WTSFc?|{(mwFj%A%53m%Isa&KA*|7An5h2*#s@~<_mP}e_IPAdWcDsDuW78 zq=IINF1h*QkhJ9MLjaFFShHrE`<4+F#vWEil?(AU%7OWS)18*RXZ_yp4fAuO-(?i^VjPBU6@>$+|xN)5xIbYIf>JaM|z6S`H*d{n5Rz&Wd zzp^wYzqU(MZoZdYKw$5&4|*dkx`S?;kr>!em!nV=Y2?Y<0c(cVo>MbsKF0+{ne)-EudOnAe>Z!(W2!u*lTi+yBCc7n2IZ&-$ z0?Q5p89R6H9_zY9{9wC|9Ssp@Hrv^$XVg7=^*l+BGBe@wA-qzG0G~Z68{QreAkb-P zY;fpVSnw?Kf$g$;BkF&rqXQ;C<<}J-kxJ=L*3@WUd7)QPx)~U)P?M(1w0Cz!w%eI! z$Uh1Uv>VYh{n$_K_GWUXF-(-KI>Lzdoj;O~u~xgqu3}#{x!YLon43pB&8m4b3o|hG zm;-@oDlYUn9=c@^zB@P|;JRjqGT$(~U2=?)$IgV%_Vo6GFuh&fn9Ba7 z`B*CCMR-O9H&PYVefj#{1b-5;KQ`BveSc;q6V3pT086P3Zm_uVN?DMZrE}t(yV(9C zJ++VLwF2w?{JamVC(QLmQ^z+s&d)LC*}tvWM*3t|_UfyYdIe*<(~_h)L)dl3MYm61 zfC(ln_hM{+@mBC-q@g?7oICqj%e=a*=_@3H&O@;s^+d9eN` zvG27O@WC1YtP8#_aiP>yZsY@SysZjaX)RoNx4gtg+Se^4+#bT8yf9f=i<}4orDsR1 z?bk+CFS}0oP#lH%U;UQ3Al6gcUD~m8CC=kd+GdzbJbL)bgmRF6@Kdz8MdV?9&(Zv& zi> zUB@roP*SqQJrJ-pZA{gF>qaG-@#4z{leXvj-P<|C>zj|BA8=XXFy;wnvw8ETHRZ2- z4AANtm7@x=z7zz*-adcRBmMAgYWsz;u2;!JW1| zx9@6a!4>x{p*dD;FRoQ{oO8E@g7u?MI;F~e^(il$vdolA8p0gTH_sj2C+yPLAMP+{ zeNMvXl+Cw+oWTsk${i+g#eL`qKf@C#Ug;PT^>^wdB~! zUX(1GAGgvM77EV1UYD&t=Ac*0uAXu^9K+20u$61q$^t_pZ{lNV6wP(L!lOL<#rlT@ z?R(hk(zZEEXf-9Bvg`AbpPzJb-_n|G@%D?0Q?g#ZW^rd{ofc$N6ysf&X4-Q?bl+b( zR`uO97yT=RZi#vIt%6 zoEeE4n~uFAk%gL^g!`D(rB^;>Ijnw!ZqtU3pFijE_A1k7yG~ckY#!cs_T0Xe@0IVX zM}i!ubEXDO93}tih`Rmyb#=V@ozN{8JnqL|gkDWigzl~Nt<9~SPHF5T#8Ge#N-=;c z6S?32zTCEs^ptmwhVop$Z8OgkbXP<$>|5m-u-(u{{ zE&rQ(-$Ml}dJ;n}=#eK2Gh6#Q)spqHokt4Rl|1OQ3zuD*sXJ6ct<{*MxZdKUVwQQk z(neQ!&#=+5#?fu&%^zhN%U>9*(!jk@WRWAUUBTWjTj}E-mW1TpAQPRWWTKl9vYre={-UE>U zUq}^meY5tkY?|NbS~%90^1VqsV5?JawS4Ad`78>F1Ho}}y^vSWK_%vf5{vu7be%0&TCH#q}Dycf8 z;QPSaQ__KlSBgE#&UHrVgz(GmnmB7LT^yIs}+$DBg$(0wADW!@K018-M zes*BMo;Y(99@f_j($KBP!S=1}Q5^|t5s9-MJKLX&y9f$~oZaQEG!~RIeK2ofIrR>O zp?i!H5|Au9|N3$-hs#~sY+u{{rfe%EWu-S~&o&;>NKk3FHE&KxUx;f;5_bH$|D5ei zAZs2g!?r`DG3S{(?pawLFWU-)W0akGd$-I?{=Ww>}k)_MVc}0ybl^ zx${{Kq)%6htRBe8MNzVReQ9j-LY|ogCULf8WHlOQnqMp=_dh7Le~$-V^1fKY=Qmd2 zPtPQ3w~w^2&bxGutLw@Z*jQDz@E%uu#I}X?#0Wcrgq#C)aJuuHuGCUEYsWzI_KB3^ zT8)d_w{P9*JXL1GMXQ%)UN{)+#1#se&ar%K=~%3^g-mm;oUT%Sk!8%wrGh%M%;G=2 zb8@XZOj61{v+jUaX;^-GSQr+aFvG4RB=bU{9F1YVnxrH;myok7i&iQt1r--`gU5p# z>xR$T&$U5rzo|j;Y30(_p;%h6m?%7VCv1Tg} zu zJpP&Mol%U70i4$`q+XQgAFcw&i*yxzj#h9T7uD`$&KS=7$eqwJp+R*%@PTTLqZCD z!-KD8J)YVw$5Uz3fg3W@+D_&p11g`87epOjcl5Cx6tK728P2Y@?`aWHis+B;nx-%@ z;n|^#x{E(?6)*KaL_Eo|2)J&u=j|{UjeiG+s$Avt_50qPVK~|~MJ>F+#PB*ECsdyJtaZladr3&vmmjSa4i`|d zj)mf^H$sjBVagvk#I>uN+jd0&T~Dc9V7T?mAi52V;lZ|h!)fnC7~Hg=&+Esir}H5J zb!^^|L~VUvffY&=VYxH)P>+7Ukw*H$@1kS%wi26`0~MZ3Y_rOB?EqNi10Syt8>scG zjYqK}$hQx-h3v|lodXY6m-|QM<;jR4>5U2JrD0lHyuy&FS-di_Fwpb*j7XhNG&%Dy z!Ix|N)z)Lxof}HpUmuM5FWw3eJ*QnSMWBl;^30=)tZK_GmQfN$Ga_{Zg-5T;YA!M=G@2lY3eH z&}0xE(cSp(qYvJSlDg$K%fjxrlH7Q~&Z`{u@@UBqFX)IK9~mhV_e`t{CB~ulluv?g z?8@q|x`u{7Y{_t{T-7Bd=iZ&EcG|rG`XOH-Axo4qcHQnAAY)tVT&SUCTApM=z!B3d zK8{bi{o_Y{aCnaISY+N);_SQ}68}o}(TvmVpdpQEk4#Jg29U}*e^Cyb5ODw^kyh>GvE1Za?bATph(-I6fVChB2^2Nyu*+dww zi_^Ed=_>(>G(CJO@ho}6Kv)hNw%miT44f*tqEZ05w&HilE1)Qr>$K;8e53#f53k8HtIZjI=&!JQYoEu~ z>Gs|Rd=0AY#(f%NzEIVdaWe5U7|i7<1SLhe9_SHg=NGC`pA=czOb2JIiMRtIt#GwiNgGEB>cL$b!tou|Ra6bIaF1zE(VfSHsL_D%Z%^8@US%BaY>DX2zuimI z>3X7!8C`9r9aXA6CoJZSX{R!H@6NGM1L1k<3g+D^J z+3@Zx%K&9MZ9@en)_21JBv zRfLe(#}$8MjR#zHvrf`#Yior~A3USj_Lu5)1I)*q6`!vup%(6|+pSGa zEQE%C%P||wDGGf-RgH6tAzYEsf9Kp3i& z*8pwh)<=(|bT5E@K*ih1p+^5>yR{d0%*Ps_{*W;084Iv?u5OJ-4`2{d4d>({cBpyw z1I+bLs2wvQqG~>EPNSW`z<2bi0EXo8DynXN9f%IZ`wWQziMK^;|kE#gJ<>mGNmK5K&5Jl^IQ8EH`^B=~&( zQpS^vaLG7g|4|Jv9|iGD-%QYuIxJzUk0qei4uq=|2)Y05p?d&O5xoNSbBOmdD9y%C;&OB2yjDh?T6=p_?z>;F zBfX4s!e(yHCbU1v#BDJfg^MSj7J1rUT6Vd6b2L+qdM9~cpq5IA5H(=20O%hS3cgT9 zfR}lWvjZx&>AdjQ$ntWp1#p|=G5d;2;TJu$ADOWWTHQZK;HuLbtNq@Ox~Xubc2XRY zx!yNClLj3gAno??16ptouN&7KxtYSX-m_S;y_Rb;Is~7}+U%J^*ofoyhc0oATx)Ny zZI^XIdl5WB^<3+wYg3Oztq2d1&_S_E5#^u>&q!R!vzd}!NyqJ^%(BH$bi#SoY zBfq?-f&1~1ygV4GM$$@_jpr}7$b^`Ir>&QJ`_}rZfAhO{k&ZiNotfpEJ^j(nH^@k0KPPn@TkL+*n?*BU@0iZ) zEkN}hC)rR2vcI6P+k^ZiOsi35o_o2U?j7&R-Y9#weuv?BM(N`91pVO4luj!Xr-&B^ zw%$<^KUY_0A1yh~-xF1gWoE`ZS7Mxhpo-))$Xpb)@90V6cijnp$MNMd@x_Z5r_ti5 zg|U$BitBu?subJT1(MzL4nnomB(94Lze0um2H@_x0e;1{dlak&4mtZa%`{V|4z2eA zNl1NX_gAq92=q9Rp?36wnUi4 z(k_q;%0&)F1~}{YfL9&{WE4;Ubar;`X@4&TD%1y~r6A34@+HZD3JXpCzsD`<{;R3B zwb2Ioh+XwG)q_IEJNa)qJybKUuRG}BB=k?!Q5v+VJMOPPp^SL2I{W^c$<~~bsHm?| zKT>J+CNpLJo8k9ol1ls2_H47Fj0{dmXZO24x1O4+`?WFw@)a9LD24)aG5hTW3S;9m z*mAfIeVeo)5F$CQEk!j5^|A-vVdW{jDq}1 z+|IVOg;nX^JrJUyp$z!uJPdVyJ0ia$WOj@1hYyq&E@YaS>E#W*FSQ~fA*XT?ItVW9 ztI3xQQ#w9c8v?3*QoC5z@XHc-%z>o# zP|8rG90H=CFi10u)!2szg#vfh?`S?>AHGUX6&Y?hJY4uaBXTrA`UK^Y>(G*JI$YA9 zT4wP;%qHMAohA@3BgxoAdyI^)zB;HRrLLeCb_T(zhNu<8=mFP29G~}ES$1#V#*F^E z^o5&BS^?C)&z{{U{Yii8mSOw%S#NKC206$3i)TwpOUZO4aqLh33EW9Z=TX}7tE^Q4 zug&8+MO4F1x&4~c(WA!dDt-maS=6{I7YhqC`Wqz5NB)j|D59Ye@#@0)tIb5(a^_=+ zn!bXV;fM9lT1yM<=T?@CRy;;qy1KfC8`SVkC<8%%11Mt{`k#O{dG3i<+^?_i>#LOR z{q-HjmU$o}K7OYq#JkaLl0!6aG{g^zXSf(?KfBS>0)lt%3f>i2c+LQ(SOx~&6p*7x}=k;n0jN+3=KW(OkY9gDpJ&>q+LIql0)`RZ9!kg~zHT_zWz1XqG4O zhk8epNP{o+sO!S-wYqCp;54V9A;QA(G0;oR7!Tc-=Htk>duz0XW(imz|JR2fAhKm; zVewRm{OdTNCl%;*cMdUhjGpJ0od_Oc|F2gVc1=bR2nZE-NB47wk5@;Ebb7Ns?V66$ zBVft6YdJn%m8iNR2_R7?^ffr`EG7Kc%bG(dPoxQUe_Md}GOI9qHCDJZaC311C0dnr z5of}ib8P|}hTVI-2Ydm55=OG86@fK+usH^iLV|LVzF?&1P_Y|cb91ZpTWeXl$Agtt z4Nw;Nyag|Cu|M64O6<`PK^x3Ti=E=|;lLxiR;J%F}K|;3~02 z-RNk(%MpE~pa|u)XG*Its%m!NE(g?Nm_MCJ%xVrmT&N6MB9Y)}x^OUZ4?wH@Zjl#t z%_;y;uBxS2a%%Jcbi5>nk-ikpo7Nwn5|C?k%P%Jnm{O$$UPVR4q!#xk#<8gD3#|MH zWLE#0avXF6E?)FSLP9FhvJl9q-1H#Ahb454W_Ph0eAR91NG{_<{oI@_kBh~A;hOGr zefhHJNnf98cZp4$#k2>H$unh`skrRiLKL_CBdApL5N-<4D;&uNEm!QG;Q3hu#szc- z(>8p%Nw_|PU3-~cUgtrU8aS^1RW6j&76P)U8!156RRQ0hyHx zP=%WTcYzzYe?)Ws89p~m5k9H)MKamNv2vB_77`M(V5aG=^yiwy-k(2flvr;;Wc!JQ z7Drg;FY^IZ1JnMYOnpxP8?zCtX1|e<5lA6oGp&C;F*!r|G$$0_phOK?TS9te;Gk$_ zwM9r3PUeCg2f;{H37|A-zW9#);P5>B1V|5wG>AW)|F1X9nV7KpsJ${X6GL#0a0NXZ zVt$S0^u3h0f6MToN4_x|y6ql7s^}}JocZGJ|C^Sj#>P7ekF%c$J+#QpZnCiE!D6lO zC_VuORmDdAHkgV7H#27R+-Qk;r;WbY6}3Qk7P{(j4Q z{&BDh6+tEB-??HjiDkmv`LtIH%Y^fTMU=pk^MQfAdV!J>blcch;1B|$RAm)5gInVOyHzZr48`t$J&JP0mSeP%+aM~; zWDpHk~x9x^gdAP&0e~NJ@kO~cam4Bd*huDHD$=@leaCZ2A zQ}pK}-oqs(Ry*8v0a=Vj&rIO`86N)BZP1qqK|T-c#EA(7HW|=ZHa7VGbckiiNlW)F3gc_p0{5!nOB@I$s=O%1iP`^CgZ1(GL+=180h*A5E;5+P_wK9+d@{`5umeE>b# z?%o}Qgp?5WI}T*$Zv*-Hzc2+~_nMkYT>Y+i za^GpwVM3or^X(mE7VJ2T^bog4Md^Vo_&>bGKhr-2y#cU8e>}kb&*_gT0wXXnTG}+o zsr?*Z?yY5%l|fM{kSY8HPR!{@`M>X9rQCttADi9FJJ`$tsD=M}?pd_7wH;4-l0pVf zr0H;E3vwG-Cwtpi0uZ?I?VD|fQ{yJg_}(KUiX z55LJka=#P+Zih!l{mDw@su>3O4lCYQ7;0*2fZqHXL^|i^v0}|21UIVz2#6JW-y7D5 zcDW-jgni@VmFoF1>iJQe{FRvgnb9%_tLb`RnNLo3rYK8Iqk%6CG-TxDuR6%oEoYs< zKNISG(@qKi{JCr|WLwSu0)8g=U#Otq_qH485t5flVwt@D$Uj>KViwyc1Kpj~odAr!dY2}w!j!v&fW z;Flb9nlMagPby)wA2uw#+;w2!g7xMB{IE}C$Em%+u>L-J0loP%4aO1dF1`)`EV3W`WxhG?Wp~ zDv>(~c|4ptIi~%G59=V-fX}&p6?^Bf!m<0Gu-?53*gm|0HcyC#ZsI(axc?Lc`Ix7n z8`gQdlL2V>@Lo>9+XHgG^|&|!aRMTP0ShErZZ4;vKY4=k9PHFjjmLbP%kv&eRIBr;xI|w3}K#Q9bH}U zz)9{caj-86VOv(;za)$?hIRl5B5|CYh z%G}wMvXB`CMw)?NCni@ltwUf?=x8A3J?jmsm2z@=cw(erDX&)DryBPe zK;M;>la0MQpc@A^z#tRaT()VxhW(6s@E?e&xw&A}JtDuH=9_f01sSWONzN`d2f<-a zP99=FHmp7jgc*SxP*?O^8+rn`?r7?QwO3txJ7^85O8{W-{rkxVF(h5;6axd#;I?s? zX{`9@`0me?D};Rg>IIJJP&YdM9W-1>15$x{6IJcaHDVY7&>dw{`_jRHlL~}n^fB%5 zYm>%yzH0;?>FFzQ`#*m^SWg37REX7_I-pf%ZBj`xX^T;<9jMAJKvnMONOG$zIQ09y zC>$Gi1wZ?;n-R&>)M0_y!ED(9a4<4$gB!A4Y7Q;L@v_EUlYy3S5Eag2S-Vl=`5xoL z8Y@Fd;KA3?Q)D~433VRMrF`#))}X1cxQWf3zC!Lq{9{55O+rEf)8)$?Wj4#O5|_jIUHiIo<%uQ!S?-5=uS22rVb2P-RDNXSs#vrf zIVk%3RnE7au%7%Z}s6Dk{n(dLju-?*0AvqN3XUeaelE$5MV# zV+E@*7IKPTUBMp@no!fb9g?rB@{Wz^!9qxaFdO%I<*P8S^b;E;Cbs>>jwn)p;33Vj z?Ca^jHqk6pl^}Vg+v4a*R+kV!LIN-^D0Z3Yc%1D|jG;M+*nM4E0pA{AJ0q!BNTlevjPvVa3 zXgL~(%^@WG0@JVE4^ey|+x}IsJ8rIOX-Si%;Ma48o@Iz|nD%4A9dfCM3GBQ;m{!bo zWgk?IyMF4pgR-&LBhU-(h_1X$N}AF6hLw$GpByDBT5^Q}ytg>P@^WnKgwy;_9Ize@ zK5j?#8=0D}*9h){sF@-!v0FoYZ;4^P8Dv`R{LxWS7PHbl`No`TS(0$gZXTgRTrkHu zkZcr~Mp&;5w03uECX_9~nth^-8mWj}f{YPr(tG~U$z*-vObkqt8BjPt25n-(RW~Dr zs1P7QkZHf%osx)&dAr$2(|i-X5=Qn=dA-}w0jgNXoo9|3DvrNcSRVZPXjOs!C9@|` zs*Hodo$RMwmUWbYq~o@Tkj(0N1#FCUAr_MMGiQ9Y@xH|B-nj;n{kfn^`ST}M;Sj_E zK|wwJ)x!!3s=p&`EnvOix4msmoC5aVT)KLCbRheQIig2FC*A5`E+nL_XhhFjcAV5kCryEV_@JRe#3FdhO^ z=yQ`*P#DkAGX_f>YHJT@tYvbSi{K-=u|HCY1luxr6uj9qcFhNV+U>6F;hzL7x`1M1 zEwGbbJru=U5>|nD;Qf2F`+M}m*R7%Rzzeor6E1VwBTiWC&(S;1*2OzGI95CH%reou z_NQdc81{vFAZz750|J;3&a34_J@VU)@>D|12;g%8Bae5fhqE0uY_Ugk^_RS7-kb3s zUYVlyGs%FmlXf<}OZs+;pPz{hOY>g;@aM3AY7GouYUI=+IW_gkm=g*Nq((uWZ>G`z z%sGO$78Xi?P5pWBbFAjsA3}uz=xc*8{_B5WwB5#zP$*8~`mMLw!f%?K%_jVtit*bF3?K+Q zldY@0v6sb&fba^vn4~>aXbwsg!%j7C@`pHeCBbP4^ZQ2)9BU>$$vSX0^O+7gL!b=z zC-Bsv@36YPot=(uw(6bxaKY;STm%KQoe&$2l?{HQYk_nPM4E#`LcopCz`$U>sAzv@ znV;;4LQ6_w7IcyjWf2x zi`eC}T;-`VV+&oggPn1BXmZ=FZY;5Yf`a^V6?xGax=x>Hvg-|L$OAnnM6t2526{r5 z40jSzy($}vT*hS|=(X=5xL)@#Lj87Hd0swxti&wCtL&uOv)K;a7P+C zxmdU6u%;3vQ)!i?cSKmDO_6pZmgv%Gxt=ocKdWCRlU&=DEqA1H+;(2bqy+T=pl&tW z1DCk|y*9Kj?b<8{ZiG!tIQb1#=(s#c6<| zmG6fxWGwf2d>8Q7y#wW|yRT;$iOkLQ+Mqnhv9Qxzr0W;OyWB_WAEqoOQfBV=L;$^6 zQ)=3DpH^}|Fzco80hEp9sqc~?=knqLlwY=mvklv&tEL5S3<9@f%K*uOIO9Ro(cV0i z@6ZhleUp_Hk1y9p(`_Q&YhQ}_u&kc;P5ZeTWQzNEL<~atw8C`QBlaPh)Y@Wj*}ZgqSW!`v_s)HOC1()lGYopcs%0jISW zMP9Apyhrf+ILY$Yx^Wa@C%p<{kz|yVu#4^Wl0@|^iY-Caa#yJy78e1bXud1v9kkk( zpBz#qh7{Sb6hkQ*QtrLE#gXD}=t71pb$iq<7gQy53=H<>BCbFIKnRp-Cx1ngv!e&C zH$Wr}Oy%jp^_C9|?wT8D6o~yH_Jrmw^y5l-?Ay9^%>x<(9UASS8~QqA(6Ho$8q|_5ICkMOe=4L-3{4x%f0`_-TyEFa zn>{a;lo&g)UV_@NpSO?jLBphEM}cBgTWjO~WZEL`4LArIYxnK-1tHcU@owmx}PYEhVgU`d|K|w4e^4GRP=i9Hn3m^?Dt_}CF1XQ>yMx0Jet?Y zbR&STZWkE)X<1iGB=)49SVspApyqw(Sdb;U`_p)S;FkO6{3>y$J+H>tVyg;`yn#w- z6+O#Y4zWdX@k@h)#vyEvKUW^H3`AvUAj7zwYN~5sQ9gWqbZAq`XZ|EAbpqvDIKjW_ z8uVy7tv^Q`FJU6Y@@UsH%U8Q{$`w=bQ*SjqOZ0GkHKkj!^2DP{zbwpJ{O<40LBqo% z6opy^Z$eBCog(vo$=#!pyHH8S@u?NB2!LK6Z!fRQ#Q4aE3<3g0AfgObhnXsAeQ+;; z6^05xxqqI72O#-;w1+Yl?1pR>_u`yNhI*YqH(Z3|+BeLMjg3p7!$%S%rSS3bpH>__ zPQl$>=mgm;b7v^uc z1R9MdV-1C~{$h6kFiLb5eq#+r_}YPw?%J1b4!DKMcMDtFwckHR$3rGKRq z!vGo~*fjX;7n-5+5-EgP=t}sQFguDWr4X`h#-nLvKKzU${T;xsEX^bED&E%0)mMua zomPk`m&dKg9D!wcA5PJp0+OPzBd%4F=%Usdoz!Gx$*tGSX`_$tWg{+^A-x8N| zWo(gny=0erF>?$uZ7bKJn0`Oxv9Cf!*dTN-m>nN}YWzks&$L=Gbm_YMvDxl+vDogl z_3vKa_ovsFIS4x1+Sn#O9RAL&-^gbP0bW|OJtmW?{s2O@qJ=kl&WjjC6snVrm#z-j zk?xDy$3>Pqq22)!w^?t$emyP<$;bAL81l$Q(($nILRRHo-8Ph%5#PeUy&CELX*`bP zP;g|?j-uEi=QHnCbx;wD=2knHoY#Krup8IUz_?n$UVhZ7m1A-^Li2|avxurJv{?;z zP6|Icae^ui3VDKE!q){IKW94w&s_SZEewhe1kuoV>_f_uN;Sh27!e@^8y$9UNpUgO zoE$tsj2QkzsW|t32nYzYen0RH2}uGl?&~f0Dr{n4@tQ=;2cX-T^UUy-WE1CHWn6S{ui#)V~)!v z$Hf1vX9W<-c!8fQ8f4=c2=$*SJ zwA-zwMIqp9uaGZJN*dWt%gihfLBl3sfSLs_-+66Q?v@1wsT3lQ=baDgmbA%Tc%~_x zz(}<74G;Gm2am`MI2;cT@ji@ySh|a?l9w&FAKETK+qX}n!9sqDLH>MC8hI?u1J-=J@|D11kGJnWYNY9R1!&r z>{QmXZXgVl^Bb7*(0{|z)@`@&lZBjvdZ@Iav&muN z6Rm8tpvz`_SM&{G%bp&TJ_|;*D?=Lt%j*~ zAWok?9XOi3aW)}7z6|UoK_zE-xDW*h+M9nom;(_2>0q%g+u>YD79k4&9H?;Apk%DS zzrVMacN_*eC@Tx)KI9?^0Tn58psONh)_PbuB(LS=7eyiYuJ6ct58Y4LX+|5cJP`NY1t@o8|K1weHb{%7LN_B6;t(=;F;~}j``RP+Hug8f=UShi3>il!C5|ZxDft5_ zva=Igd=QY@#UNLk_4F77i4FVnBe*J!w-WKFHphyxy*D;szi78dXjhHzlE;9i60nWm z0EITF8i?f?c}L(m=4;z;^l)Y*j2rj+otfGT#1~QzWV7zOKYTsi9EA9GnUd0Ss>sV4 zC3bJ|2wHrU@O_|*;EF%-G<_)9e90coM8X!aKXkr?MwPkjt&yILIV(sAqDQ%*_ig>! zp4mv8IeNyd+r6VpFCPmv`g?}efH*&f;t{x(Ud&e(HU*Ih z9-UtwK+Od!+76oTMh$->g+JQ@r-+4ptseTj!FG4td8^KoUHzEir4svU(ys%Nx?OfkyVKt9v@d*mGEPNo>GQ+(XEpcQu#=q#`bonbiT`L zHNPHEXKCPusvm4AG}GGvnd_=Qbaen-1%|Ma?Igdy>i%9P#&jb~qd$Yxf6>bIscnrD z!OnI5CjKkLWQhbGwr!PXB(Q|t7Zq<$?iq#VorNhWOcm-r_j%X*&`D!F#9~Y zDsdK9=#}_GMU!MNHex65@_K4ra+#~Vsw-3%Re!Q5u`;s0cRSDcNXaMfqYLKRc$v@8OvBjO#Zo%{w{6ozxRniHG-5> zk2WqRqVW93U%3Y61!ksn;SSpi504MeojXT|)S$vaJ^)d#y)6wPz2@e@+lfnc{;8fDNq+mB?gRWvt{ECNpQoqCxZJlIzQ~92O63WNiMi&4Fm(Si zYdZ7|ijXLlr$Xf9W#4r^Fv`AoHOMFBhQ7py@>l1eVkI#n+Ou^q-5|BMrZ;rBv(oS9 zB^$x3>v&98_DNY)>A+D6_kcu0&-w87SX>r!vhf=dB`vL}T4xZC=*LZ7fKx6xe?3|d zhxY-%F6rq|@ADlb+@xh>W&IBRFW{sBbknRXj?|-njlrMa#hf$x9kaI3xz?2~D|h_* zWtEkU4M`hF|Ck;hx~PN^;uz6gx}>5#oAwy%q(;D(d_9zBDyYW*I!3{Lt9gUvq6+L4jA3#2$Y2{8`u- z0bH_H8bXORWA7>pLiQxJgdHA8fJ)g3lg#+PYw!AtBKvI)t%C>8AdEaM^odD=F=q+`9RQ!aTazz?qo|C%d|NqSZ~k zbG~h@m6#>?%vJdRH#Q?TTvJc9z`SH@zM~STDM?B5d4}BsU;ZM`{~8{}&z?llLPCBS zZ>`wm=Nai^I;&T=@8B7YN97s8)loYl7Y77Jvocl9cKD> ztQNVlET-#R6WO0N-Vn5!xkH?glqkQu`C8wxsQ9DD2QSQP{nzW(HeuiHVy-k~eHV%d ziJ;t_svEg5{XX;TBZ_*L(4>z+q{M6yB36YRiRrDfi8K?SV&hm)&~~ty5Pt>tbanTH zl*H>!I52ZiUw^d57*rx-n}T-K#Gu5G8_doS>se@S`mBJ5gTv2jpF>;z+ER7; z4G}}jyU}`_*Tcd&-Nne+9!bl#wl}{zq#@kCULAP7{rVA$vO;J`NTJT)ley=<(VQ}$ z8jeoVu*1WmIDuCM@+|2-|sH13;l`4h}T$@bU3*a|i2hv_<%V zRSt)!u8E0&YlU4E|PtA+F=F@jYt!Nlp9=JBe8#une$DkacyB2AFmsN zwyDNX6{g-?`IP7z9!k6|^ z&V?DK?&K5-Ijp;FJ3td1|H@#)(+ioQ+`~`QhMzqiE6E&-HB|m3F7CHFtkLCdJ}$v| zW=lUfw#kg$CA8u_n|eN(9AAC`eQd)X>cYndex16Z?5?7&={((v`Nl72MpEgzJKpX9 zjr#Dgi-F^DNK`oifv?vajP~%V+~-w+DgSpg14yr4C7|evsF{3} zyI=Lrir-u`^-vLKJ#MkPp|d7#{$T6f{rlB0h-bmHMA7Pnpj9}<_Rh5@E2sI1h!8+r z6Sf*aZDPpDKOIc}{;iFS#55RnzCQNwolAdKtka>j!Ap|#=;zNIeCLg3)1RKTGr;V( zqnUf&)f-1k8+Kp!;>FH*xYd))Mvoi`W-W_jA19u^1Ext#oJ#laPrj|{HM~g1*|r_J z`S2o3S^&Shu%s{h?zx9hNt3|4O@?;zdQ>bQS#Hq5ZSxJ$`mtosqWlKBHd9W6o`^Ul zIrU4F@GN>1Zz(*SM8g|}rF8J#kYc==6M1UFzz*td0H#AhPD)A1f0Z@A7c|d~kB@=u zBVg3SSdirO%3se5dSiZ`$Eym7R(ZC~sb1tU0<1||(9|2uRK zQwGF=8#6d~S2!whyA*2PEKE$j!RE7I@mr3hGJF|>S{jm?QncKZqN0il)SLVq8ae>6 z8gVChJO&1RI*5*HXh|uk^xWQ~F@8PsQkVAm{&p@!DXJ?|qr)T5e6QgSnqEuz-Mz1u z_f+MzPKGnxx>#6QWxbp{hc4@$nsthLV>)lLq-< z@|T_9YX4AF=uliNtSO?j5%ma(Jb{QyZ&vV}q+}3sF}$_Kpk;M^J?NNfzBEq{%UtNW zYG|m$Z`QipW0;+pslxk$opt5)vw@UTXQ)-z3X)s!UeZK&@bmFyvbp*xo&indn(=X0 zpiuB8mHaFkyI+}hClS!P(gBC8#(y?{kyd91;vjbvOvkhbr7{AikPx2-l62<;xl|P3IEl_&l8wf z;%B(mKQI!@oO%>GhlGKWYi+H}SfhoSmBSU~+~^GKOHbf=oEF2`-8gW@2B6A4s;5q! z0#h|=SR#%7w1aagmHzW{(fxTlkN z)}(l}{QbFqE`=QE-$gulr;Q8p*>aJBy#oXG;O@i4wcktde`EL0uSR*`697OxR9+OC zchb~Q*Y8?Z)ZX?>dXC$PGa;3joP5W)Z=tq!raLJsH!@*L;0B>*jemuE^t*Q_tznf8 z_5`U@FI3uxN)F!RZVlyGyc9Ygn4u88VYeo%^H*1{M>@v@4`+W6W))%7mrgN!-zW@F z6DH-v#+DZI(GnFXBd-el*K6VEK^$k=5={0)bs-_iV5E2pV0pXF)&PbqYn%M#-tMes zXg1Pa8tBY?cyUX!RKBRl8ua{L3&~ToNACe|jhml;+ER~31pkYlLb67GjE*>npqR|e zoE-NVzkc0Q4lt-dRFpV4OOuk2Y#!PK1_$d$i?V~T*Q-88CMIxTz5}kCGfmwRuXVd) zRak^Jj5iL@fEAE*x}92swF0#RuxN9IN(-z|So?Ca*P(U_f9lgWUSzQ~S(6nJEnx9P zPAgF+FYM!n1LunA&Q!s z$3VLPvozRdfsE_G9GU_S*bZSLut6TU?vI3zFZz3v%Nk;f!eoX4_n~ zJ2JKoL@c1UQoVGyHA>iNE6IDSYX(F-yC(H zojvlk-i8Y3kHBW8)FM1p#U&aIqD$?zKI(H|Lk)~_sFP7r|1EX?YbE#K^P33+@EDAA z=}x3ik~ihMvp=-K#I`^G6t2 zW*5OnC=uxIpAAGy_`BP|s{@n9CMLobQ}$|VAg6Zd)6h#qN3I$T9c} z_>nw%&9{YwH1z4g)pe{4SJq~{>fNzHYpAGE&v^hb5ktV$2kqGwn+RmE?rNKkFOmWg#w?KsCw|!NqIJ<#Nbl9h@eJJvb(3=E-j}B*APo z3_7g%(~?_RDarq#jp|hy-@+NVeffNBTpYCPG}(R~`p_|t)z1QCmztXTf0rmD+{Gi` z?=F+G-{>zi5Aj)zNl#x`8|!Uq`jHcNs!HK?SNxAcv*YPyr&oRHov=hTU^p+5x6i*7 zkmyPBYw1nv=QG`GYHJg*n5yNd{7kHEXkvohWps28J6mByie7{P=G-Y8!Y*HGhmn(j z%h8vj`)e2hehHnRv;;td-1@Tpos+#88X;kRV0g-7$V@z1;gSRv77{%<373cuj*{w67B}>yRJ!c1>&&-n3fY>3oLmS65z>f=O8brX zgUSy8fd+Hywvl|#h8UfiGRPrL4(2UTW97G1ktg4wkw_*C>G6q-P4OvfMIFsk#9Z`n zSs5Ds0cYOTQ78T0R71G!VL7^8zXY+Z$<)@tgCCbo7ve+yuorn;T#kW_lM8BC|M}cw zcG~^k^;>auv@{@anTVz$IWBH6LqntU^N$~6=z}p8vdcI~{Q7#2%*;rI=n6i^ywZY# zbHf(RRiHJa^5iqH@eYr)?YHO;Cu?4MpRV+$Ew4>G@=3_d9E+1G1ZtjUiS=Mhi!$7~ zj90bF?8Cf3M>``mwV5@yz^t9%!vh^)BYyevrJ~{lq;7#T(?aklp{|>?t?@vx45fN(7cWg9E1iaVOm6WnUObTd27(Rph?_RDB?ZC+*k!Lx}Woo)A zT`UNg`C509EOu4KBqlzPm~S5itcjNR67`6TxOk8kA=M_)g(fBCPbOV6AaBaW9T0i^ z(M$5nN>a>C1&LDINLFTM(6zk5`ODXQ6fG)oyWO|g}APPL9^_dgoL2r(At`& zHzNW;&&U|+1=jX`sX=taV8}T&n7eKsO|(VyQ;`v{6+l~ac&x0Zf;Whmu@jBX!={b& zqR|QxP~0%VOQHJk0IRVE(w9)J|B>v4`Tbuj!fi-rs`dx8Mg;~0EVZbgzW*Z&1+EO>i|KO^BRC7(kl&h9H6N2;pr?mx&9eAK=Z|_{x%j~!Fg0qK zFTiltVe@uvb+srfD;gB9Tg&!yK+>98$QC566*nFy-pjQ1_C|$OC&--gqY)z(gUh*{ z;M=!v*LjjT7GOcUz_oG1s!pum@9O8oX6gsBFYo<^YfSuU3R6O{f)b^ zrz=5H7jc~{o?m&Q&}yC&@kCjfm~?-2$mW~Z_wOrVZ=r269asp zgMAC7u-fv#aIAmQ)0gyRM!UWn-#UZW9IwO$n^`{dkB$8B;17;$yg!14}SIUE)3W&xaa%wb-cmrc!t@j2!0xUJr@g`Rn~CO z-wFY>@s&YcX%Qlv7!yawp)X%DzR(a|6B*Lf()zM0Fk3V2vMRc_*v+sZZw;oz{&U;F zAC3s;bAZ@oD1RB4IY96Q#!CcQtWRldY^+>_bEbA>wKIqt1P9GZJ}md=(t7aVH1{KL z+e^8rsFI&r!P5A&*@Z=5pGJQj!U51&1Z!pK;>lbCG@VQV6xWN3tkrW~lMtt*^xlfC z_g&_HqZsmhdR3&z6+_*6n;RGg_}(t;+Pgb{Qnr|+y&YFzLTP*R`q4yR#tal$xOihH z;*1K|t**v;!2j>v^i^7YXdaf4a<^q!OOZIgkAg28DO#+q8#KJ@F?x3kT>2ykv7r2?`t ziSp?DOpilrs1o>NOXOK4p^B|ex=b>Y_w(<9IqOzNMucmrTg@aR3yT`-!Ct7SOKK$s zbjYPoUZYP@@L;m zzP^{zP6&Kt;wtDEs+O0%4`Zd>knG zTqaW3T+l6?(Dn7%mvX?4zIXE;o|qw=qYTWe0}R?TZGuyBA(vAhqM3q63yCm%80ipt@Fe8n{V;)?M~JJs;Hx*G${w! z1BAf3M(d%wE-%>Cthc8dt|Gw1*W2DkTVJ1yn3RmnTVEpS4%B)U)_Zz;y%!q&bs;60 zZKG#kkdgrC86XqV^2%3vW}`k{zxy&Z(siZ%sWh$MnT>+zI4Csq|a2P_H{l~Bmshg>OoYOaF9l$B>*Np+1o0uvi;ii z;e#+-za;n{K~mC>8kbuHI4ixqJ5B|wopGgaR%W)N=aMf`Ucb`W7V!>Ngaohwz@XzK zg8z&+lwZ(hFBLU3uB%U!oY9^8>Ho_*ign2bg{6MAw(=!`f72p&KTUmqV>q$KCh zLSw#6Fl(vv-I(o{P=RR$kn0R+ZjM{|)opIyXzrnbovwNF@<=77%(%aEx$l_j+P>HG ziItJD>gtlNtRrQ}s-P%AEjqH(l@QsT=<=WPXiH>)lZrV8oamORl)YN(AM-2##oifnvL;bGy&-7*#uXwWa*hWKa^cN4b~Xm#RGr>k9o|{! zgeEm(SV1I{;^Nx2i&M9uZ1UtMpXm+wTLlQC4#ZpzO&Y$el9pC~gHs2Hy@rE1L0Q^T zS|!%S8vJR%W03nU&@(iYZppFDeKa3EZ6bwTLT*F&U{vv}W_}C!cmwiE-Bg0spoHuQ zoM>rj>Hj@flOKSpH&ld5tSv6L?eE`sk@x0e8b}B=%&d(Cd7+Qb3=%#;fd9e<>T_?F zHn`)~iF?>zR?^WS?q>77TRZu-LZp1)u_Pq=5aEHgPBWf7`F_xz*;}j)Eup@M#A?`c)CZd1Y8ne z5^(bH1cuIA7EkeObZK(aJPet5>+@XSpdWfczIfTLtn=Ray}P67vs4kSsxB>!9vKO1L!FL>ZISigE+wxIH~QY;1B6CNr52wzq>d)$Du+1<;0Lo1il7ou#CrQf}RZ8MYD; zKIddlK<1KHXwH_+3bqThv`(OVWMpImD2<+;RmJF8B=xANM*MAtPaW5;UAI~3Gp*hC zmW$vI(f4$?(m-?IfK{O`U2h9e6e&SKN(7`trCUOg zMky&#=|;LiK|#8tOS(h4QA)Z?y1Tpo*?8`E&i&8b5042u-k4akW{s%nW-Jy(|MEJ6 zZfit87U=!E&ri3Km9ZKoj&bj=j#L%xGwZ$MeA^dkn%LCdK34K}+Si`qKH{oc|(?;qPw@ zVJqaK4Qs>NZN#)RxFF~TTro=OWFDJMj}~-N|3f@U+ z-S)hE$JLC z$eKAW2nX3h@&`j7A+7pf=5VfkOjg>DlsP4NJK12+^gdv^_RplG?AjvL^7DJr$;c20 zi&cZ{xH$WXpA3aAK{rF18R(C*E>^{OJdys@qxQb!aZ}TMf{$k=%MnT`Zivy8=!jm?+%7w=7*KCF8i*@sb&*%d+w-_ zi|5*zV#&KPp_7U_H+TAs49P2_wi^>u&C@+q7^D`YoGrs$-wBa>_{96;o(UqyrF||v zC8Y<@ffX_q5SZ^f+*w*#S%H?F|AA!lGHH1M$vyG&=d_?D9GpNPJ2y<}78(rZd&FNr z*eAx4tt}6qPSz=J&7P#ilC@jj(S^@8Huz(04n)IaK&?0<15(6amUt;&tV>I&lC*?0 zdcSM#@n#uvaka)Ue{h#1;qE9^J?d&V>~74Jpl(finF6_n`gx5= z-CR2eG?;>+q7NVZJ|hh##p9MtIu!t9SpMnybAaNapzy*3;A+cYCjvNuUuVFO;MxT> ze{F20OWBn!kOI(Cz7M)DHJ?7cQkeH-c_ar zWzFU<^Qs0dGkMzk-@a`akLl^?Dh>_qtnxiM4w9e?9;>j4av!Cx%~mXT54*#u<@Mr{ zdT020M~6OsTb2ExEE#5~5_3Ue-qJ*$0(4Gu89Q}1%^cVqwCwk%b~6_ge3_q}5%VSG zo?lx?RqJ10_OFpTyDBLvZqSvl8*{&FLA zAdQm4!2~Ksk_6Gx(pHwLopk)QW0>En*z|&cAju`h&t1m*n;z+dko3gFwuy0?5BbF^ z52O^>C^-}*1YO*B4K_qXB-`4WR5-Vaeyy8mNwim<2nY%kW}gHe%=4PRT06azZ($DH zA8{cFAI%i9unm!=aGk~JjFy%QHJ~pA41~OLr(0E%;34&$)XG;nCSd0uGDXNgz$dRlzXtxd|idLvmUAXa*PsrM{;Xe@tnOl)s&TjSdCD(aP$ z-NEfy3n4wz%_-Equy`vYl`}if_TWoyhu81Ob{Q=>s+FtPaNbp_Y)npANg+wbv&m+7M@~shcO4ZzWML$TI*^FPv zC{V{mGOC5n(b%T7c!Mz9gE0xay)UBo)3?bXw|GJ$EpoH^qpPcHMh3n4I$a}FreK~6 zG#oVp&*Q%z&YK&1H=(V|OlN+{G%7JOb7Fo#bo9=bMLzN2PtEW_`-4i|Is_eON%GxR91a#22c)vjU#S+{1Q< zUWr5?guT+GJx&HBkJK&vO>>K<`d$)*Os$g`E58+`*Nt6TBSIc%X=-72y1&P9ch|LP z=hKTT=)wF# zwOpI#7^f9;qGf)eAA75kq%7Z4=F1!vLpP4FwTg^YIjnX!T#hb%wqqEZ?oL&<(lT9W z8QU~9^Hg;@%psK-VKe<%J25&XTKW#k>A(aC#V$*ws2HuQ$1OA1Tz@NW5u+MW=-Hp8 zHdki1JxwDt4XpaoBr2>ZPIJH1)x7*%#k?A;<`05k{BSx;)P-R;$A@m9df$e+{AdZC zg5vK1%uYBL$=-xCoJxs*UnsnFsBS%mp+H>ECCn#&eu55a0wyg8jlTa2UX8s2c-xp$ z3@Zyu;rGX1Pcr}~_=1Fi*o=->#^0z8Ubuj`XR*{LPj>(MwQE{j?r>)aAi+vVNty3X zZUJNvcjAc+kHfak&yMUF!@{#Q`iAvECzH`MzGq%BIY-mFGn^I%%PYx@O2a9QPNykT zGdw=--ybs>tCi7)a~C?1$^>imey7A@VJ#Xk9q(wJV^lC0eXKe9(adUxKBjcm!JI{%7Pq=hgH(%;&tXYUQ>&BFS5Z z!_&|B+HaPeX#_c*E0z{n$psw_EKo;=@tqnFGzUgSRlrQ{+13aM1fu@vQvCC_&D2bo zP)Xk5bhO`CQS*S=zblKJ8|xFE*jtdgeTC^LvA4CfZa{^y%5sHwh(BTH>|&Jw;37gc zHU~lpSy@yRF4?GpgBRPP2?qNuip8>hBwCL+EZu$VC4?$Qj;vNz?kcJ4s!wt1n1m@? z%>T}Gta&D6zS+UAMKz(S((x5>myqRsfQ};A^d4qr_vd7o_v)+k=ca30s_clAXDN@R z?r5XHN7v@GdCc8l%d~P?jmPPAbQz=DGYN5GJ9bZAOUqNvQ$I|`+)W4j<7}5hrsVx) zE;2eg<-<0p^I!g43FIT}PKf!qSXsuV@)Yymob4Kl57lrqD|oCW)lJd#rwR%|7^rpl zKr)Q0%E#lHSy0V{SHz=0f-#teaO`1=f)bYteYY)?&7m7nME!|2zuq#YEuLF70w*Jc zb6Pb3X)P`5F&$%@J3Fl)HB)Z==zjzgar*tNFEbAN>pY7#x6px2N)vwdrtho?`|PZ> z88bpQ5RjvlF(+0ou4GAK%0jlUwYL$7Ke_;Um~Jw=*dJoa_+rvCGF~x!(ZkV%SmLRT zJquPs(ATiWp7AeUVcZr?IxpUS;2S{d3uN0DG-$@uMpqy-$>dLkR3e&!li> z!526Z_rzRfvhKN`6qGA|gNW_mXnPP}D%#*xWza#4`az_k9wFhSif5QuXPWo1c1)I< zgSH&#b|r9`a@IOtyi>j<*9%0mFTu{(=G)s4Zvsnd?3u9GmY;fjTtW#A9Lf{~u;_Bg zxVeWH&en)8_`}3?3Spn?#GE|?1EE0A@s)mc9~Uq8zl9%xW-+(3Ad~d@S;^2Ui-FGg zOmD+4cLiD5>K33+FjG-Yw1i2>`C-99hNjftd2>D9M0+YKoVTnZVFH!J7z^NF^Yhce zB?f&Ny@Z5m0I8=3OBXybF!(uAMjjpQ&}8;<@N3X|P5M|4R<~DM^{-z!jxNEwyPtO! z#WFfOx&lnu_TENAI(sip3`TbQ?C?%6i3zDwN%;o`s^i&}{L zKa{f(zz#0qlL2a`FDdTWds$^+;ii-^k=Oj+1`dLzHIlCRxECJhro}W!tL9qTBgq0eXMnFmUr5x{R9=e;tC#LTxnOMyC-g&UQc^9ss)Gvz6Z=KRVpaKX zPf#YleS5Ele%xgJOQ~GX_7|)&A33bDY!Tp%(7%d|fn9po0o&~F>AAyZbO-1RiSF)O z-@dsG{+D1X{NValseRbwr0eMD%!9Cp4`XGLkHg*@Js2qyHXOPp6-B6Yg#d;aC4b`= z_F4YbJan)^Zn1+hQkJbwAq!$u+xy42A>76#AW)pDXP7bh1&;ip#q2th{z&CX*Nv~c z0vB#DWPVe3k@+U&xZaq9b_>j85NcP-N`&ZlA-!x^{dI zhTWbVY|TOIF37iOaEUQ!8LoU%p!>s7`9FIqTa}Sfo|7}>aQI3|dC0zL+d-)(u znT?5u2Ui#IWaqsJTBXgFMR$_m^mOqgP-jQ+u6YhL%W(?|R#aEN`6m5qV!Z5SzQd7! zWaRKARQdSQo3GfGLvr2rmVuOdV%VZ{myp{OS4ts-WBU=!LQ_ee5c6tLn0oSw{H**r zfj3;S$oh2uy@70yX%y%8?=0Ks>%!S8MGy;ocbp0!=w^)MT;Of#PSwsfUFql=ofvN; z7TV^d&nU@cIFDq*XuRlyQ%ck(%ZgFF#f7$Fy1GJFo$9HmD5J!L4h|0dC*BHaywj3b z{%e)0b}q^mL17ug&E+EBdqB%UUI_>|ptb>&!4Yu@RYtVWT-ArCMn12dIwWPEgnQ9uhLL-)zvXlf*tA1v+p0lU9(i?yke@(W$3yp{(zbsbiwf zcbE+YdDUH7Tr{D;&1;)NU^WjZxgvD$H|QAYTUocS!o9iVWJtb}A-sOeSMksF};dwlyw0_9bwHxLEHrYSZ2COkojO}hQa@gh@>ez$x%8MxxlE#ocz zHR4YPf$*nxxTh|90Zg)|JnLg%Xl%uJ;@zX9($dzf04}oou$zt2D@CkMa41$s2Jcu8 zBBLEm=6s?v4Z{R}Jg$2xtX4LDw$eVgy)9~w2JuIF(F$1{P`4xG=@~UOosuPMRBcsv z_|701>Ga98(qN9T9+ItxfcW zxc4!tVw>!W127Gb>OrRT*;b%vb8$70oavUopXg~!s1=&+T-g{bf3qoccXDA76SULuKX_VG|WNm9+djoJwEBUkI_tkuO8u4rm1mfRe&IHHgTkK6!$7_{59kEcokK>Qvx zj{m2xa^s!~MlL+HHx*wgo)qp|fnR?){9bpDrj%xbnu1PQoQ}8?uyhcnO=3`~?e3+F zd)l33Zx`ggNJwyl@X^b6rqw3d>E!L=;%6t}xpS}9AO#u9Kb1Opi-YdTS9p?`*h+C% zJ+QuCAbO90-JPRWc8_Cc*@9uZ1T;`;Pl05LeKy~b+wDE~ZBq3#ZT)BWtP+xL zDDWZX*IauHkol18-+FJNf0JEehgU}(0O$WI8KopQ4zrF8J3&zBq&1@WZ4H&I9`teO zTFk#GvfWuNvx>2{-hRg=MgaVVkIL(gq4~04u4I* z7Ys8|MDxU-$`x#TF7{@YX}PUIzJ)zCmgsn#5}&M4^xEOdr+24`g@t)sW=oPVqwRR; z6`(TO(h4GqiuNCp3U>kFU|r(^cmjGmL~ZHKg0tr*`q)kl>D_8*bQM35f{RDk-#oTN zm(GOpC{$R#6DK6C@9f+{yNp8}r_J^clYsnVkEk1ls!m62mWzu;Nn5G;LLtNpS_PrnK34@h2+=9Xh&kz*+c z@JUNePftzvY&T(#1TT9p_&xibc$9id!=E#zl$@QtuYuwZnCB$Jk!W0Otn}eynB!<$ zf1`O=7;x8tgyrZvd|iToW~ST%?<$@77Zoxt4p-mF9%_9s1%!}U#}8(E|BZmf?n2l2 z16tYusP4&S$}B^d8vQrv`_$BsPe8#@Sg5YDLx~JiLwgR%cf6L2;^h013^O6gv8#LP zt2r~UK2DB&p-S1CZA=DJe_NxkT)845l3GVHxxrlJpt7++dY57h?k2OI2C|$ss+`i+ zotIaYkgVO48lRAw`g-|eR}8h_eOz9rwxWE4k9#=a^^mxbRx4rau~p)BG!MF3xpnjA zjEwE>G8r%9>ort_^vUmnJPzCKmy(iM0WT%aW&pNjygyG`D3de3voug@VIe0Ql=$jg zDGyPAa!T5T=%u}T_vi3%O5%L+RhwXw;KZ$fIbCt zeKA|bqqz-g-78{%B6iUU467V%30s26DV{usdt=FU=|}GK%^{Ira6-l^PxkE|(2lmO zcgEw7j*8VTExGG7<5e*zA14f^9ZI#gw^x}=;9&u5G&>ZZ$R|}F#U%woCmYQn{zAZf zrI$FDw?OP)1)k{!JjX5e&Yqru-h#Z3KdV|BeMxVIa@%Nv>r6zsjJQuqM<)YPQXVHw z@~zizScIv$L0L7^-W~(EXFyPB0{k&WQ)6ZtG70!%&d>i-xv3LG<#S%dAt8BydkwOC za7Gl+52>T42kL?lYW`UkWGe_{?S><^q3#ziu6pc+t6#o6tZ6&=h3z{!TJh5Oo0ZAQ zS2P!35@DDJ|A*L|m#p-7F{Bk5jfE*G#qWHd30DnOo}gg?heEB;;CoscaH+}jw6m$> zM#`i_&(d~4@-8g22S4V;%frJ}vky;lOeVDMcJ;^}EoIk1}P}SzTDbxaP=tY>Gck`dt0mBSWPaOe5*1l^8- zu~TZQsbF&?e1rJ6^07M9#=p{8MMW;xiJig}-Ixse{=ULNzO!j)^`p+sN{NXMe8b&-KKJMz~^Cb1~J*%D*#(5FL>jOynq#Ll8@rWX%M-=IV z$S@6tEC;&HBx!nelBLwN7jK{KtCtoQA_wyZ24332Sj)*_>+D=hC=d4V_@1Umyg{ls zn4OJQ?r`*|o5#2{JPZU4$4%J#`ewV6ec$-Jt~!m~j#A_}=}H`$@T%EuKnsv(JAhnkqq{?Scn`K4+uIqJJ$^0(1!Altl2|X4|r@<+aFJxu+cls}Ylt|{X7XmSJ zPV1CgRWp;j0<|y;i(XgPn8fO}7^l~>Gha^>!p~PpTI@fobY7&(S!)cW21@-M9^3r+ zTjS^7g8b#y)ck-4!9(I9p)8dWVWHB}-}3TFlUooxz?Z$_cA=rL=orWS`^9QiG$6KG zWxlWr9~-EFuPSV<&Q7}p1b&8I>CfgXw%NjB;x(H+taQ-cTj4r7wh>AkC55U!g9^J5 zR59`JyeoMQH>Ud6T#)U}yxGYOGV=0w?x3zPELk~_LDSoP<| z6T8)5NdVQ0iAnvgsKklNu%kgV2`+An>;?hBg4i9}6Pw3!QQ}x{fJ#3)>LS{XtW5$q z!@9+B-eHjHIN^c0QJhYF~FSWjNRYz}_R~ zwSOMQy5d`P%89gP$VUooO4fxGDlpHGEx|@=bD9hb`TQW;Ujq>G*y42udk0RE}*HN z_L*Ek+rgGH6z@fq);H7%ncieQkd%>G0q?NA{kUmPh}B@A{W=`dy=4vgz+b%E0z z9PADBduROM^E2vP3_;I^{9;#`$%H(VB*MebPK!jIRF6Of*I<}kL9ReDQR^}y1r3_? zxyrN(5~`&bIXR8%Q5lbxW1&H3Bt9YGVLRX1@n$pQ zKIJ>&Kza7geg?)E<>@3ORY_?dxT$`?i_Dkp!k8&qu z%W?vk6@vI37&(siVkqyTqAvLmuY@9FqmFE~exMPCM})i>r^dYo zC&Xs$wfhsY`&)g*Dp@In68CW(%g7j3^iQJ0!>6sDKyP&|eh|=o)e_L8K$3YLz$izNEq&%Rz?i(Q;;i4PCn5>MmD}W(`*&ZZ3E=l zUf_k>*)d9p9m$Hyo*%aTL2H}V%vaQjx9E~2Lmvv+&;CS`m6>JtE<9=NO#3SL?wx6_ zlZAZzZGwe!JmRT^iPajf)oS)+-NgAbth*r98dyL%i43@R&;;h$Fa_kLe?^tIAr0Qj(5gfl=VLPlE%Px15Qe|QpPro!sT6cUv4Cch zd6*J@ayU5EV3(oDWY!u^(DJRqt{wA*qvM6G7jgJ;*4`>2b*34SjysDycTLR=GPAOj zx(X?2XlZRvBip@zUCGUJ1ikd32g&mXW|h9aYBp@=A%in%@5+$x)Ks9jgg2c@R*6kb zl7xg1DM;%J2&w@YF}=qbff%dnE2P2dJ*I+Y6k8~?q^9znDu>-6R_5S>tNe$~E=z9S zaWRDod@IoYAW(vH8L@8#@)O3+9`ZaI6ejvC`5)2UB#-#KRdI z=mQevgdD4_>8p&>iNyw(M(7wQ%GsA1ssIUkt(^B$j$f*Nd3f2=9ai1in(su{GFcn# zzGi&)F5?+XbV`@hJqn5lcOb5ajqwW#g8p*jBvPvz=AOQ;^a80Me6-7P)P4~W)bEXe z{D6#F=u*r5+|$msAsEJfu{KI9R=I!;#2=4(M@Of=bnPcXHJ?kYty{#OKQA>QpYK;g zy-m0%_eT5tbL{`H-}if`*_$AS?`9eWl`3Lv?7mbPx($)1Pe0KqSYEvxU>tJ+@diTI zot|Dfq;2n4?S1v^nJp5cNyyCnVHunT;7%T^p;FFYHH5S~oPdP~0(^Pip_yXMI3~y(R{v`e7HDU1=Wo7%dJ~;_8Tz} zcDcJZr0?T@hAbrX$M}!7Tcbikii%$d9`+hdhJs$?Q^UTDM@TZc!poO$>cheULiUe2 zJl&yZQgkpaTxxDB9w_)paLN7$o1nv_+NV>Z(!bBKx(- z7>8Qwb&1^`O`*&A>OT3340rW5K~DR^C6t_~NvGuzt5>)RLn!Nc&lS_QC$pT*WpS5@ z4ctAhx!-->^Gbc0GMC68JGUN>juuZ^_VSfmxVLcWUSaxcCSFB<8GP3Q%WuthW5@s# zZSp7CXjL;^|8f|I_G%PmJ$AP^K2*4Ni5#e!oU&e^xfH{lMPjc9*=BLM+DX=(P} zo-C`i2T+mOX%FYI`x!6Xc}KDfdaQ&R!dlv&YX0~k945ZNNG&SLdYav5XkZH(?HT3e zai>2EQLy{gHmuJ|dGb?ITz~5f*EA<4@K*6t$vgwrx1=OUq%Dt>c@es4YHeO6-%*>> ziYCF{bjEyaI{jqAZC?)9&nY(;7+5+tMk~s!ZLXk6T{~Z*4tD5AkK!WoWJO`5rG=}m z+b#*z}AA{A}IymqS)mQJ`_-rMdb8U-9o15Rw|A5%eRM7R|Jc~(6Duwolg(Z;-%@CBbq1lf|vk8|f zP{iv0td`EF&o`Fn4oyK<wSXW4K|>AA8Apj%xj-3P z8tC-H#3mtu*^PoX@q3J8vl`EfE@KQItwjv{;N|Wr0 zsi!IMygfSVDmlz90@sH_V!1Uds8`cwrT(kC|mhZDcpx&{kH~z|j$?CD;~c zic>J%`3t7$*=e4K$F+%Z7gWZS8=bsF=S#J&zPXE0YC7YSVW4j07|PoE_Ltvi97PDD z8w_nE{z`=CxEK~j@LWu+!Wv81%I~aNOTSo6S z`jSgMH$#~PyXmz1$B#cj{d(bVC?hj4JbbhILyYI40kl!yXU^{qkDq!tAp}^J0e*|$-L$;gO;!EbY&!|j6J-rk=JVPPCo^{r#Y z8)R;Qz<9(aZdJ^AgI*vuApf&(*G#aS?{xnNpbriX8-=Xl!Q83KCDt7Sj?CNT$pz>jqojHcO~`F$84;$q#j~gn8nP1;{=THpU}82rqJY+bdVQYNW>aUP8N99@ z1MP_;HJmgx)jil;F&v^@9nAAsCHrGQ#T`3L zDV(+HCrrd8Bo-w3BV>{#0qTwW+XXPEo}OfaK>f_LhTUG_zA59*J_Aa8@E5RhBqUox z!th^GF{7MzyO%jioNOQGyi%HK7mrg8569sziEv`d9@W(v754J)Ycnynu06^6gtG^>?E_L~O4ASx5WZaQ)1+5jry- zo}PvV2J%@d3(L#mR(OQdb926TI7~rE1Egh>xWw{k?~jj`&aj${(;BWAwVH5ZH1JW? zYyWgbckQtZBs||1WU-r^k}?W2F1uZ?b{JYu7M6;jmX-D>IxrAIl%&keHjSnp7B;>! z!Pld1g@(7}R9rYmxp~x>0Z$@JTv^{1uc9W90zc@9ZS+nOTz)Dpr`Nak(H4R z%AUi0`joPycHi#nYx}ZbX@N@Thn)U=8AE#!e z<3naF85}>b6kKJ4tE=i-ZO3z!{tDT}PymVH?B$pAp;=8pASPdcdapW@#kS7K=?Ot$ zA=iSBOxgZEH0(Q#m08K1owmOBmES71Vr*)lo?m}^v(&|1;?1}LYnkuYUh`6y4uit} z9rX!DRn+Y<;24c4A}ZBoU+4%$VbQn2%NeM! zFAl1I^=bgqXgQ)TdsX*$E++ZwS8Ra{~r$glWu(#UDCRN;@vi5 z2x$lj3sw)@JVcdm-8wvasH2zGo2MWun%1|-D}d(mqXU-WIY9)lz)x;D8x*p7ch`x@ z$Yh?1{fR^Pg7{9^W8>pD_QsYfE$;@>;M}p#hihjJO`=3#R@%c^_%nctQ7gjF-&P&# zU~2mI>~#CAPC<2h`!|+AS9c!rRJow+0Dgr!@)s*2++fctZNB#EU z30bkp#79uluXh@~^e5~1>%hQo9d~)G*ST4CPWCryh}fbUgHk&W*EXhL$gsgZN`2!u z7>Eu5^M!W-L9#+t9)}OZfVeKo{hDfo|IbrYUWLe;xnzIenumu+q>*$(tq5vbc(-nW zzQ@Y3;$Jmc*^{%_6Mw-ES{^l2r`sw;tO?!74woC zBl}o%K8SEdn5YSyRIp7hpxp}<$0X?Sg^oMqA^7iy&OI};OJ-&+&&0QPF|OTkz$LVe zdzQybK%fg>8&@tPbg)%RL$L*3$|#%jKaR+Z^79k5y0*b?xhx>pOAWa(qWWeVqleid z|8>}dC)e|XreBQro7`W&q@x62JPS*2XQ%%v8FMk90U#6%Z$rZBUqsnic|}DK{CH%W zU!Y?_8WRJWtzA`BAk~jR5DKZq)M*roNZjgxh>Sj1>(zivsf_!NrGDe7DH&Gd*Fwmr zbH@9S7^jyK|J3RlLMNeoa&F1KW`KXY7L>i30H?!f||H1Of$m!c93 zNnB4I1`IMcH+{h{=;<|?YadWSa81gdQz#XabsjD1V12gC9bj+#1Y6bd-0I!CBvNiT zOlw}3M=l_gIMS-KVf2JKs;&`0gI=DV5xfqZ|2bZN?-k)fOISJq!5|9C^0OAryn?pq zkSm-7$0?p1O>TYae1GSII2i<>sT2pP$rP#9wMzeDpw>V$Oua z%D}(?b+1wv<|63eh4322jdcEdLHysnD=sWNL7GW@emgrNwxZ5Sr5lLY)P)5aOaX|& zOI>=twD#R~h3Z&0@pMEa`+E+S9iG4LqBAQpG|`!voSK5cCkv9D!_c4!>VSCkugGY= zjA{J++0OqoZa1?~k{TPEf`tQ8K#Z97D&^Lq-W$5zcWQCrH95@ZV};PZcuPQsc`}#S z3NuUZZ%9wFxb`=!6;W?SL-{X~$L=oJJ>_kBMsz`L)ctRs@uQzVqmvRen6oBG+yX&C z0fYe1I)BvG=EMDFd^Mhxm`GI_ia<#C)CCwdUU78AWK{;abhzf;Y!+#PRgUtaqSwq( zKg_N#j+8|yWOYPc9OnuS2oyvHgw9mZM&L|^d!CgrF~xH|&nq>V5RjAW1vm1Ki2Hnv z!1g^q+OyNwNny=`BPd+s=cf(_IL_t62dlLa&&~Bv#!5iCTR+qVIPTD<7Z=O&^ZTsQ z7pUhl!vuQ)E06l_u9t!jH(z|9pUPXx)|>AH7i(S%*Z?RXp>U-=~EG@?5O!S5v+!%hx&;b^fLC~tHMRfEW56wOtnVT;wg_e zywg4RQvh)6v$Vq(@-i09|5=+;E0 zLm#p7oh>KC$Majk02Sw1Dt;@3b00kjVfXX|t>U&e_4kL=z1vwGiTEEbrdFeA;PuB=z>vg% z3OByE&aXJX2AbOb}^?8Be$b2jQy#Tp(I6 zBli&s4A=sWDHx7WmJ_EkTOP>$D_Q@?M(TJiFLOg2cHu%15u57Emt8;J&aY3LEuP|I zZ&v@dZ7S-yaS_qc+|uF<#oJbfSgz+Qq2dG<7Pm+kJy*%p3|D@uMMfDe0H?I$Bc#6^ zTtgtE50g#aJ33Abmk=e1D*}yTYH?Ao6#Byu%nax21O^wG0$+l~Wrlz>K)*i=YIi=3 z8eRXxJV?e=b|rbkc-0C*wy4%VP(;Fq9ASj({mCH@4vqu7l}DQ3m5pX+QC$6si-nLj zxUNf7syzvL0o~nPU2EO3P8{qlm&dA}$p?d;Y1YOR{*}waSs58|To5WhkwK!=GGBas z*+3VX@>ZfyYV(1Uazwpu*6%+F&V0z_+ei6aU zWM(Fa;(~=AB4p*qnLDV2^ffe<0?&WBfY?-w{hDQ#1m?fM%K@tSCp+ksF|#v!1JKE@LL6=fZK@t{CQD|&l~yCs;#P9 zGHTkQssOixSJ7M>Wdfb#$cJxT%Z^^%x=`1cBiQQ7X(5H6Ef3a6{HD}lXGZlngl$FpFL88 zgt7U@+xy5vT}gd-n6b0ubOVETahiF!pUrxIod95h*^Te>@PQCyBuGPw4TTwU*U<3r zE_f3#uMXskF>XI}{vTHi3)7@w)Y0hud)=udKI`?5m@t#CDvbq>I8>ihrKRsBficg2 z#I)oW7~-ErILlkPKg;m&D3Z$2ou(6B3T|`vc{dJ)6l=y$VbC5!MJ~}!x2tvV>BkZ$r zai^0c%+RiJ=4-V^PET*s$jG-vmOQvS$#MRc2yY@Sz{i@2`NhS@Vd8Mn+(5Y&%Gey7 zoc}A-`<}Ojdut|H%IYxqDWL3nUMgjHyl0Awb`p?AI&Ib=%=cDagx%%&Wy@EhWIK;CalEQWX1o=P^(e z6tup4xjI44I+G78hsDlXV2dlf>OHmci=?qv?*lJ}R3ZFVgRC zgt0%7+$Eoo=Oy#9%a5Gg1zq*-tvb(QndFPy+!%Mb=ci`1)~1dq&R1-iUAuH=oIQx&?ML2(MYOxQCID(nk=V0%c z*KomEOBN&!UIwIo>rA!4-^YR=d`GQvx+5x164F7WrS~}V3kZO7HM!Ue*&JBjYl@0t z%8FrdKkaM)<{e*Iu+crKJD~q^uNy60NnrZO=o}O1q2v{BOqT!OozF|*LrtiVlY{|j?<%5F}Kt;dj5k1uOaQSc{VpRv0Vkh+^^#x*`0Xitj zVXhNk8xlS>6Za^gr;6j>AvOF!xL;~2FZsQ52Mn=PzK4e>e9fN&Px?EH9M`UyBHfnG z3^TJVK0~P*A9KgT68%Rub$3W)=7rKrAdQEa1qOK>q_% zSc^Y}@V}4z`74KoT_AUDmiPu|dcc4|01deXkUiA6Wl6$thRif=%L+k{WAiJ+tzlqQ*o6Z6V}Pq5nd=|2`Z#0v;ZlfZ1(qFqBs# zou|d&ls=g`w^1FA`2!b?*81-hB!VBFp%azxtZU>{I{7CPBbe_kTkgwP< zWBMn1nEvSEa^>QOz(AaTCr7XvjbWkl1p^q4oSfkdCDq`~pn&x8#~Y-%9&hMP52^cb zNuN<=KV8^Y65azbi(cF5iT1&<{kbE;1UK!j2HF--r1X^@pIciqhP(=97ym0&h0mvB znv_Hw5YRJXL|U?&bsC1HBKlax3sSX zSDXx6EbYE$Z#18~h;Sw)MqV{9WYhw)mFF?K@?r3ny1KfmiVE__|NqBMYDUIz#SjD! zf!S(RiCpORV{o77=+d!qWB|A1VpUGBvs@?QE>Md>+M;yQZY4)2r-v?<@)9 zF@(cd-?i1#qvb&-S2tlOFLZ;-3&K$vd6Jlbnm|DTI=_JDCs}MvKBWo-#-h%@V`0P- z2l(jr_E|6pl!qfs*a~mI5*8mvpm-P;f)NPKjdHIz%09X}f(1=YYH+mR_FlZW3;OEi z-@ls1NzKuufpvrG1L=kHRjipnI?1RwT?d%;3Y=n4$`z*y zJV#3YYa#hk1_oRilzo;*>^`rOy<1=CPKFu^@QrTVa1es3O$v@@Vx2})Z9~z(MZU}o zdPhyoTO<5>O^uE5T(BoSA_4;MpcXO5|zUC}XqtjLe{)BWLYD ze!x;w(ni8%`tGbU zri299eNa#p7OLF>SQD9V?L1;*vp(7-9-+}|(9*{eur3D=*^_TDxcikZVrSGA4z(*p z;b+HYx^KpRAOZDK^X^f{)x}TNdy96nc0#pzz@~xf(#&)yq%q)70hOepI)qstef`=S)?sho`a|(PEiFx4 zf=fJ-9nybAb6ZKt*H5Zf_V;8@TxMixvK@R^8P_V z&u%TUvtPf}?}m*Z0;f$K#pRK9TP;50Bngj);}#Xzq=SAn)uDp!d#+GryNoJaTThjc zprNCmZZ%&`_$aOlS(o?(H=l@YRrqP0mgbC}PKx=mj*fb_XE@#V?n)W-eiRo2gi3qK zWjBhG04Wf;|HXb^+I+S}PQcxzro+PnMqU1bVpbSPMXwZq>425{cqNdM^2|bbY@((T zcB;PKR=xgu(lb*tbOC|8?2*&M!xwofEPK8Nebwx}Vgf81#ri+ZTN3vrQ zi?i-I=jM)nLjN&1SP~wtXRe(pqM(p`#c~}q6QQ`oX7EZ4c`2(E`~uZWOT0mHRO8jF z1YfC+-vt1B^66~e|Iqe4&tXoeth=_j85AjH(ZG6bTM~4{^EIh)9Yxi%Ye~p$H0+5_4M{ z{boj;;B@r^pL(#bvb8(fS6P9|1-d9rQ8D(>d?WeByln^b zwC6yi61{;V@}5+?m@6jjy`8Ci$CC>a!t2wGbOOJ=;G9OVF)sII#+v|=Z@e+d_ep_^ zcCnz!Ddo?BAwkAkx*x7MiYIwN$=x^Psg<8oZqCDvtsybMsS!HYuU`E^E@*p`po@!~ zd}nzu9g@-Q?Q&+l9x|)FM-Y0JcJnt|tQIGm4DC%fUZGPc((Qi69#H+IYxD-kkjqbalJh)U<1OLQ1ZY-@QMt{X%MWta)lng41%*K$Au5 zXDy)=O6rfZ$o8RPcD*5^NWqZRk*9mScE|GzF78FfqcCzKRM~vtcYH%m=dS7I=Ff^f zW4HRc+UczWdR5i**A>K6CA2hWThk%nub&QIrF1Qqnln^8E3xb}tiN6u?Z`97fRA>O z@wL0n#<8J_ik*XlndgJ}J5kIQ=B}uboaPU?n9L>?Sq9gbvQ&5NHnw%;G!sjn;_oTu z6@U`{Z(rxqUlpj=Z!-_?9%@#l2;ZDiS07qhx=F}tziqAENkOqXTL)OuGZiWhqefx9$1D~#?%582X(}z{+}&l>)V!!RHs00s7=xPT;d)ly z7TTio4I+%sZo=3C%gZR+%eosI>U9PB6A%OLY?YM>80M1zwu&P_C7Ivd+gsvvMj%K1tT$RBQU_-6z28|Jnbvr%t2+p~7e`y| ziLQPvEqBsNK~&OmV=^Y_>#dVxqZc@;D$Dc?txp*REG@IVC9(m_Ew`?Z`=OG-YhV>El>3;y|!m6c48G>eaWjfyHyH8y1Kz3dq0}#p1i_C zTlc)h)HT``HfKu{PK{9D9Thm;*G*TAd71!)1SD|c=al(l>vpT^jX62^>Wcd z>=0c(yX8YqT5KSBpKRtF6$xG?A8qhi&~XDxpCIab}9Si(BbFLKPU5l-Xtx| zRGxBJPFeru_SWhuIm{C&QmfCGd!fi{H=D?me5N>mVS{fj&v+?#i@eCIh1Y3eC{Huc zr0QWrt2>qf&q--pL_p}nv*bo-{lvUc(ye~-foYVLVmT#bPKw0W^Gj+*%K8>>O?z7s zieUDYsAD^)>I$@pK_d6kU#GmIh3XB_oaWN(t4kJ}U~O)c?MX8hWvZI#^kYnn`q5pm zJ1ZJoGqT>}by%`xgufhQOAvjMNofzq4EXB*`js>p{koWKbHUQ!i36vvEdd_3z0TY& zywQ{xSD3c*DdfQdgFhmlw1$4be}~rj?5U}1soo`K)Epc)s9o8)hM;(uRo@*4Y?nfd zC2U1SDsqi_uMOzo18u;&ccW#lI09V;&L9jw@+CPrV3ihb_@>{#ihjdkdcme~a8O=V zwXXAhXqA%=P_c4zN#w@&e{F(8u^0<6soErGObINYp);aNZ%Cr1<<91sZwb8 z;ps$8NY4hS!^Y9pLZ7)YL`9fgRZc|{HQJyU4FGR6Tf2n$2Dt0CaF!34lgr!!P%B<+ zn_K18+L)y2A+TCzpIEY^;H!Gbuu^eOQ3R3waM=%PQ1}A1)t+iA|HzgpQ<=lPqLAilE#lQT_3keD_uK2hyogFPi*{DPK={cSafuO*<7P1{+X!cslD3l;f~pj z>%YO)NDzXMM>2}d|6}W`aBb?+P` zk3Unsoz>OBWdHe{vHiKU4+MeQ#0p)*>bU^3Y8TL5wvKbf|yrW4*~*Na!OSyQ}Q2p<1VRLS^TD9o9$vk zqZNB!8yJk|JI&3C!tytL0H?ge#Jd%g)Ulu=3Z;+IW7X(VLb$XSMK9CSIWcrqU*TiNwJIeDNjoU$h&9&U_qUETM>I^%pRGc=dz^gzVc1Co~ zkdvSCz7X<0YzMoJiEEoQGP2aDT9WIqM+L{oh~)0ZR=W$S-dD12jf+$K`K==@XETiO zv`T${>TL#6@fo&*)-Oiw1!zVWUP~r6rpTGQI~Z+Omm}hu*FlGckKpfm6K_Qd4pJyM zRR;JovoQ_kJ9WLx2mOyq#aYl``W)9fPO9HfSK+A8!v_1e!@QoQOCg4{t1Ep$6m+x( z9)-cww9dLnyAyR+vP)3eXiIkdy^ONl{Lr50Y zjHxeBUKKu1vMDypWi_`Zt^LPt)dTMFt9Zum;1WO@=r6eboKC5Yl%C#LP0fER+5*GE zt`%BCo95TAOBtE5z7Jcg&cn%D^C#DB6+>8DiFGf-*+y=90zXnyV?^dGls1Rc6ci{S z4vuB95GXfPA3wfxsHV@}6B;;Zc=u`znNpA22bd8d6NeCRp3wgs9bg?vWlcb>dPogZ zrXtTJ-NnIdDB<2?wz8_%wT~x?vdwY0u{nn8m)Q_m!KSB)8BA(CZ<+Qkfo+T$fO)5k zTH{u4BS+Mgl&mMj@2Z6`X06bBf)=V=+=^t+#q+192L~6rcMDA+RPIZpPL9tUc_11L{&I0mkqJ&|6pZFJ7cX$NtyU2do0iN zU?NGuBE(&@On7|s6dZYECzbt$N^({8w|QhbS3LDPy+?yfaOiWMJKS$CbXs4-4mSDn50jA=G5`%Qlck)iH$bzZf z%{kJ^>uGFG-Nm1!H7Xopu-oJ5w(cWN-J63+somq19k9KpJd3+qk{3k`*>(53qV?Fo zVv}ww=fek8oz=Rb&8vmhow$Xov*!YHEZ(&1#Y^Ytu4P+)R{z=)(-5e*XRxyOPRllo zB`I>d(l_w7XIe&PxkB8x&YoMIkod>vB(xO7QC^VNG-2#nu!1{VZQjpsy--lC;Hcw% zsi&#)i?upl6+KWQZt#NN$Hh)R!b2EG1atNxUPyd*5jq8lFjH@9N}CClagHs&VkTEGiZ^*x1-e!<&_xnyTmQ48s$D1P60; zr3wLW^2J@zYSWCZz>A!gqchi1lblbT&*WnSte}VgZEG(L|L2ndQ;=!ku}-9>`#y%_ zRijByPF6TeI?8_Br%2rd` zW@Pry&Cb4$CVwB%1ULb1Ka=?cmHy4$>P+?rRlqLDo%i=fE}ShfH!+#{#R*5~D6ko> zea0&gC#hXgt~1+dBRfl1yWDVCd88=b2$&{3dmiH6j?POK#cE1>=CvvF3dFxrHaHj9 zhm(^x+q(pzu@LTJwzVzz@X81gmHF73St{|dynUuto{7J4h!ez)3788g2pM{T(t7+P ztfigOP;6$?W-nl^ceYoaT+3m{`WGW2BP2p}8><5mk8^Uyl76w8N zSydBadg0P{ zca!y2=_BmQcC`2tg~0QBcZ6AjsVt43%braayHarN_hNC>n0UVY1< zU;ke^uwKY&%*yV1k*Yx-WEUgDm`SVm3vmc~de-5#7UuZlChOMK{HD$?+q3C z=|yFbwq|+q-B&I{<6Ixf0UCgkxN(PsIPiw2-P~95utOe;^?FL-lH%xS7P{|)Wk#nm z56;p-OCymT+PuTw2;d0U<5Q3;GchtYHgg714?Q(8k?zrjwWSY9gp*U8DW_NV4^-Ag z>eht%^o<8}x02lr;!8^2enR1w4qv8W=VDsmq5EDpy~&!;)D*{zg}szzeSU#JT1Q87 zYx%QAKp2 zS`_`Vj;zQV6Jryl%Hz>nM-6Nm_VKZv@@ z8X+2Rt-T5LBMyqeeGng%I7`X>qo}^`-ohnP@m)=O(HieEXU}&vuMVZ7j~=OZRS1j5 zT}-qz=58~%q{bxh=}~Ie8?QrU1Jq5W|5} z@4p~pgn-0WqIy`=`;^|09C&++%F4T~u2lWnU6kK}n#_IV@@s09&R4SmjUvsm(v zrGTLA=7#nq-&T_Uv)U^;Il|9R87LkAP;heXK{crAFCgBSrP(%C;y4M)(Zdx^ZyQ>; zIXg|a5H`3lFFF1kRw7vxW1?-axf5z={rky|GxnX@$qN4lQMctd*|8ynN5u(Y1(ZGVao=?h7Ls-VNh z$1VF%ZrsR-ZzY|>^WEXFHcCROa)wK@n_CpCg^7#JNyye&v@@ZMkd7{(`C@}(vKYop zeSG!)JvJ}taA|4#5xEofp$l$4KZb>MF;ettQA+ z{{S^#-8=h?j`n6d&4OZlh$Xt7bERO+e`ic)R6U zjgm6~A`?EeF{P!;Jl~xna1|ClP8sZiIq}xsA{-wZ+d?K&7l1vMF!|;=w^*FS3)BNt z%(huXx5(*UI-nK5ceeEHnDbFgMTFS_G~jM`3L z5{F?DLhQA_2B;2^iucvWPW~;km*o>N+(=w4nWT?Hfc{(*2Nf*S4s^2M^`=3v7k9{loY7 zg5=cQ+WW+G`b8Dem)(WqZt*cd@~~q%xO3M)Ow8`y<0nu0IHv#n#{Gt)PD<*$pI>Y^ zn@q|loiZ|q$@zTmxamhV7B8>RiuLxZscJlcQLN&lFcnuq5P@MmARfl-HDfBc=x)xl zqV2|X+iAoy79E8M2vD`H7M|_a?a;va5xKipDy%Zwc18blQ@){?VvELS8y>n(C27Xr zE@P8i9Q>`_j3Z89I9^D&&Fk0NYqHNl~7n@GjME~AQWRoxMWAq3TD+v;JuB1WKVuReetAR4N>+tm+cF>LpL z{Fw4L_;#kVQyCI;gr}pkE)yGD`s{-V25>wTa4RD#q`tBpd9gD+gcL^63YKcT#x2ir z0j!IP0c1}=U?4%_;4J#w!6#|~n}paaf_6`ps2CLY-5*`@z`c0!DeB`cZKc6nVrpMt zLsIqE)rB4*VBq-sKl)8@;D(R_c$o;=A~n1Z2hdy~P37I^-?P**9iVH{Nlg?ftELv( zH|DM~r0&{osZ|`de+7>6Yr^guFOKBb-j~2WZ2uY`TMJ8Wmv@DT?t4e~mY&dp`RCO5 zw6vV`hi82O$65UN`Q6hD%8@D+BkzDBTzgxHlo#!S7!U}V8DwIxBNRtx$oQ|LUaMK^ z*BU-GMmdaUwbRA5U-_uczT0d60_qa>k#j1KRpsOrkRrIgLVxnL{Cs09fSh;lZu<*U@HWSQqa!K3 z^aG%0{F^g39m#9n3I~5zSN_R?L{=;R;K3Eva+D9CHcC{`+pR>iXMox>Ags*()h@+- z``ZUnL7y@Rl9B|Dj}xFx;fle?%9fRkbr_|mQ&RC>XJKU(a<;4eV$gMlWF|bTD=J>mNu(U?o(4~t@NoCbMK3-H&IHhi`0TSdtcu$2m^}qwCO8d0 z@BXTL_b?>v-08xx+&us>z1Anq)6LOn7hpq8T`YYPhtiHYxF!s)y70G>~9Fx&Ql7U6do+4CgE zK(7m|&(t5kGyR$e^cocC_AgCvi1F{vB}%D`R>>btQ;+~JLs$2Y)-?hhV?$_OjizqG zbely8-*KV(7DW#=8;`*JUP!}smX-0W11c#bSxw}Pj<8!sNt(~a=L1O$JTUPqf7WUL zM&hw2=m8@IiaA#>Q(ONFNz(2j@>0<*_H(Lkjh^Y+KCQO;5X`FQ^B#o41vf))i0f1qUhsLgM+Z{F}XKaWb?A z`EPijZ2B{Cc#z&wIjojakqJF*?2wMuk@kKFE#-&l4522e3V}Hx=_{|G$PC~obd`CW zdFloYj45C2L<;S~gn-tKi(m!=9D#r0_^cG+Q8g1ct@$7F2$r@+&GxQI!RQc4kP{7! z`|K?4AotOEYG`4HVFb;(A~f=aK}2^wP%*mu zd7j=YrWOiwKah_A8V>aGf3&kli@9_0d~w}t2d?>ky#cPPBf$-L4K~xwF>}U&a@o-3=C<3i^v;qQ8rfAp~{2qm623W7Z|z#lIl4+=oCirvPN_0>p;;JE0PLCK-RJc z&<6Id_FtcTbFc>>2S0yzg@oO|CIEHb5bvEA!|rX4An5f0iid8Wm$&GCv;Q9*kKts2 zzVo9;_%=3jK%RnyeH+2v4q8uCCwM@-)MM2TXnX4E1;K^sM+*1urKQd$1Ms%J zYRO|U{O;wca_D4vuXx-zGaKllOx40?X4YWAUY40#Xnz8H```rPR^0Z_H?YTm5?S9K zbfH$eoB+K_49ufll?#nHhrg$@@UuAXNx1{<#wL3VQ1y z+oIY!r{TWkvFo+j9S>IuFOP`X8=tuySB@~(DxT?^u4cZ&c&plNXdq*!>^scstC(M) zkh30Jb`n?95fS4G9N0M8xzYgCw0@wGH!aYF#mIyw#fJN znKKKEi|Cc%|H8{=4fpeV|M?V^6pVSoY&LYpJujZ~ZRa!PxO(BIep)yuC+>3Nz|c^% zNO`ttpZmy@{=&?NHx0rlMn7NQ<0A7GNRz$jRrQOVyPdIC*{?5MdW#!-cf%9v{v2Hq z7#Te?kPy^)_ zBg42OOO77#cMz~&n2*@D$A$t};Q0>tDFhdG)e{u@atwtWSRhGC3x^91XJ0LZ;Ya7U z&~sw1F6kfAat}@@y6E{h&IEqZ!QoWeBUV`jg&pv+1j6veqwkt5*$_^{St1bEVeq}H z58Ve2T2iwLF$?$1$9JqRQb^S9cwS`VgWFYTJf>S-aj0)$@kb@c&axJlN#_G+E`Ylp zL9=HDqU6n~en8KlJq5BNZ?6j&ja6~6CSX}y{g<$-xjH-ao?DbJbdt(~E)VAWhqtbLx_Uy)qDMRgqRLbb5iB8xUpl~Ti! ziaXG3zi7rB>)w6VtcudF8y0|#kiqYhq~JHS!9COfv#jhWt^F9-Lj@Kd{6&@D_^LP2Hg;kGg2H(D7~5dmpZ5 z`CvO`5D$|ck~}?ZP)#acBmSzq(6Ub=$h@xiT(y13f`c(v%?dMnQGbQg_5x)3sl?RR zjV(|&+U*J`9|Yiv6534fFt970)v}30yXrcSlQV#b8--jj7393OUvf)wIBd`x77d$*VO!qjuy7J4~5ZG zDXhbaSq02yy^I$Y62f++qF`uQN^0*KGw}J$Mk|bKz4u_SMO9sW5oS;u+YL?o_D?;o z?alU2{)BR$gdGE`9R{MF1MdgM%ZrMfv*SuYmJRq7khC~eu-sNbs;J0Ah4<}M6V3_c z;SClc(5?iI)qI;WSyZ+ZoRcoODc-jkAS<}k)Y1}2E9MGJ+;ivBA!Rx~E(VX;!Mvmd zV9E-W{{a=T9f4=A!w8PEaN=%LVehGW`N*xllmMs;NLG%!{D%N>LQ%?W8|B+tX;-_= zhU*O430?hko8g?^4&{qV1Kc0AxYY!ivy`jHD!Od$xL%x+$oic^QIk5io$LMhv`wvYiTx`V+_k)@FIT&=zh0JZ)A-!jwn3=lVPGHLRxL6?HlUBR;;Dq;~=^q{~V56a- z08`cl&e<*PU5lFJNC1BfzTmB?EiEl&WoN5rBc;$6*M%TYPmp*6w4H>61Q=>qeR%&5 zY%go^%TwwmrfAcz6Jvh0>p{Nj5qBs4q}x7Phv9+$e0hMLMAgfS-i6!FWv{(gi}0&~n6rJR2m&UkbRXL@UO8NKXODfa-4fmDb?X;{Tru5IIBXxN!f+ zWz)rg5be3P&YKqa_-&DQV=r#pGLrn>r(1{~_L&tEBP8Gsl&lH{V=@re$McIY&&VVy+c-f8W|Q7wGz9jqKHt8H#4 zH#2iJ3T0qo5NV*PiHuA)31i0U-Z5NxNj81`MN^n0zCrD3(9kYv0?pc2qJ3vk*WHpf zx158r(b?;=2N)+?1H*brscSHtIVg09)h_w8yW8D86xhaw|K_xzp`ot-S+t!stFQo= zp79DYanaWf))zU;#~craghgJXwQa3$({0$B20>>AMmo{$-eqK=sTKv(orRSRFG3L{ z_m$xGnWMW~JwKDrTCsB0eEk}~W)vJ3hr@!U_xq4m){FrG{)Kg;u@6y46l`w~tzTxV z6?(4Lht@jqS$N`~Q7{=hrl*SXu<2*J`9kMG<38pna2`F-jO93W0J&IX#b0s8VhYFGv721PE=Ex-Po>1nAhQOFd4@+4Qr_R`^3*GS8 zm|0#Xr=dx5@O$1rh@_&Vtp9#9xA=^Cp`5~~k|af|YK z6_qXmxuU${;=E#Z&asxd-txD%@=>)hmV=R9v?MiXPY`Zm1cnH+~bFuT7B0!60ts{mF(IbOQT19u_7`v zKlTj3LT#ZByU?FE&DCCDV->%AD$S&2kVg;0z1$L%Vn5eg>6G~damn@9_p0R~$?u~- z=Oc96GpR3zQsIl;BjLUl01!xAT-@OOElY4Jhvi2Ngp0p}A*y5-$2S{j$7n>HcYf8~ z&E{R0X;pP`F-4>8 z2$N?f5wPkDT+};ObnyFFSy(A@haTrUn5%UqbS8}x%-x6FF*DP2zD+f|k&}xHy*${H z1g$s~mBPP`gWZ#dX?F8LZu72`^uhahs%K+k+YmO}3x(%3)@*IQlv~};>;+T9VkJ{k zyswkrVbk0{6?cZnwLZvQfSda{?s)R$%LdGW`J!dDc{Z}AK+6A2wiX{a%=iWniCHAQ zPuI;)ai6S5JVzPsc$n0yW!&jPb^oHzxwBunwUO_(zcO6FF*Ph8-n0y5(zDnn9<-b1(y!b!YcN|pCV_KsK(qfW9 z#dt`o7>un~HIN%Iy?7oCFLQItb8`KI*il(hSU4J4Y%yGB z-z6Pz$lsf*Z2YsVwTQlfRO6uQ})BrOjE zx3&K44ve#If8Z&e6%txJJ}Tc{9b;u+z%C6iLvR4Y^CiD4TIyN-5Mq8!Pybq6oSB`S zhwsbFsOQR3%OC@zqqKI4CiF>WYkRx#$fs%cvz`#B#x?ZydpMsuN*oo z58gujx2ILJzG0(N?vOgj=r=KEY-()mxQrARSasRkP$M-NDl!pRCB$>A(bUwmTk22L zZy-m!4|9Nl$9F2JY~G&Q0Ri&ERY&7H%LJh&Am0@m%huNB09-rx-jk_?)cB}{j8xCH zNZ(!23d@2$jIRz0Dpb$c*S(?c7K%F< zb_0x_QB=X?Yj;h}a7|4GvM?hhIU%g84l9Md{$WTbG^ zc=*+~wGFoAd<-$O7*lv8Ul|hV%*VQHfgFVKlFm>)xS9C2u+&#ZTT5&ij@n|%VMb?~ z>N;L5%jH848BmK0eR+x?1OC0kQvWk!p*(R@tmKcTy>$3j8k(AEF^N~{$t`{=kzMh-@npFyZi|Tzxr8i?CLAJRR!O*C9V zip=L8dr2ojV^>MYOEgB%p6S-DWH7o$!N}WxzEq7@Rum8*gqGy+F7fSKnA*;2**qo>HIYb=i$ebMww-USt<{tS0PC-3QEuAztHmg{DWn>N zmt^;rAW!bLS0me>FAouQLwB}P@txNTsw9tzi_6W`5ogy?c6j(m-tB7vRZ~-QL1X5# zTO-i)J(z*fZOh>f{UsT0^vqkuv6#yRE`6tFq6M9&6p%>GrC1C$XT#7tT1=08@f3;l zHyhuxjmOu z1UY&c`LMXZ0A)ZgQ!X9o(1)O>Va*yn+}Tt-`SYFbrUUts*pL0WDsPq-`$FqhDCg&! zqbL)4KGf}heGP$GRx#k@Ayr=G7x_}N~IU13t13CP4y1Q)i1i!>wh z`Vwa`y!wxebM{-*-h%u!%o7DIb-6TnZyS`6(on%Z?}TMYOiT>v3~ZDrc;W;7{oE#< zlK*_-vR_9=7!irjW5x+4Ul zAl0nMn~2mv8sD>BVa_q3{uJ#o0`vOh+pteP?#Ys%>T9|3+ANHk`p1i{FA2 z>#tLN2J#C65*io)pmNXr&$SDJ1vMih>ySTv_@IR%V1(JRBG>bn!3 zu{$6pe3FBi*`w$t-ryHbAEVy4&pQ6Vpa!-Qr<5DSIqM>~ImUMa67-~aO~wa^FaBX6R(#UVvXJ)+7l`{8;yC~;d`8{wnFLG=8--J3udI>AR%pC3l= z)p&uQmkdRCJu7kt@|+Cm0Ne^qPEQuHY-%Yzgq)oGSU%FuX-9y)x=ipk$zbIoRIGHf z?V1`$=f2Fosur#Qts<5>p?6m)ify~<{l6Jqnw+dWJY3*2>o)y*50ZLBS0a7QYll^0 zqSDI=J%Z(>_}mtqg+}aJ1O(HdDsQ>cUo!D)VEi+)Iw<)p@)-9gxM0J~2N!7cd*0XK zPx4eBa_$_FK%_XIbDCDH3Vpx}!;HSP?#jD4F;sloXNeu`9B2ghc}OFKZ0q$7u)Ysm z&3=T_%B##=pyX+8>d9WyX&^pwvTBcoi!-CX9*Y{vY43RE?R|@1Z@K#?y%3*;YJF5+ zRtN`Y)xz3+v zbo5BqxpeInVReMPhQ#;Ap%3)_?bFs(WBPqYd{a3sV z91b6p9UUDN6xt^3UX6i)_jPJ&H#fJQzn3C-Y1fBGsHJWSA0k6;Z+EwCup1htfV?r& zBH3XW>(EUENIkQ4!IJYp?wE~i40>SjN#HIsaZc1kaEW1fv?#HZoT`kwF(OW1(B-}O zw!|wVCoyKV^`n4cXE}m%zEHg{dv_Zb&d)-no_%<{+5Tj8^k8gbbbO`#^4sEUJ#5_@ z+8>7&qa8nUDX(4?zOj@2;R8uSRiXJ&8SccoZ8(C3KaoJbXor_3*_n&lc} z##-eSWMOcN>CUc+xOjbl<2=;wUa4;D69il{7+mL~<=jWIE9W7Ge1OWp$I-}pg5I+~=oS^ezFa#nkdsA-0gk9~SIWZ(3pg*kZLHc?UO9|? z^bHYlbCY0;))QPksIk4qYtFm!I=z}*_e1mtRV(X-lH$;BTB}v73lr8`Pdn<>n1>vy z)LT(IcA56fm~5(x9Vsf|Ot)`SsUOqOQiVi+;CAc$er3qva?{giCVPXPXtQPNwm1PG zt@um6SSZQsfote-|9a}ZBF1eiHd{+_%IoE8Bzg(FKl7eVuYO|)#2s%U76p09QrtdG z3R&@NHLp=PGjiOPJ8Ep|;o1G}>oxYH^y+otGQBYoqqb{QRQ`>LrDH#0_Y-{jg#?M5 zw$&Kai_{Hul-L|(=Ll~F} z+h?+ee0;Ji-GZBFtGTKy?tT6IGuJd%dna98&xy-E*!f`R9ZmZkJsbVo3OhOK?2L4} zjDILl;l$vgd1C~_w_;u{K$@0(`PwyDHU8r@Jh`%R znFb^OSK=pRzo0yjO?%}E`p8)}-|*O=7_x%LkHAZ3>mgZaQcv&F0F+p%+UU)-L*tr~ zS0)g2&4#~B|9pKPAHRC59L;`)!2dz+@u}O2I916r7ic-04~6Vc{rTaXn>R5R2ag-( z>%HU-p81e@eZ6aCZngUoFApwF{(@+DzM|$87hg_>Wo{Nf}S(LOPzNUs4RzpFCsN+=H^I5xv^`*lr)lur1w-HGVipIZ|ZXh7e zKRJ&nFE%?~I)ZLt)kf^W-hohgDIY@1_R=_WcPq!?*=z+#(nZ2HXYzmH6I< z#Fvyb50!eyJ3n8?^>7E*=EcucE~Mh_5)m97Fp zLgk-Y#O|ili`-V#nropzotkn ztJJ2ntD^WUSRxOW2dAqqM<1j@dc8ItS`NmUP2bNUYI_fSE0f3j~HD|B5kD6-hX?T*!0 zz|>-MEqV4(f$@kmJ2L?{rcvlgR$3;ODYzOY{ySDiyy9eKOR(Fv%(tXWA`&kpz|E5e zpa_YKEG{l4wq<@P;N4 zj&|p+CZF6->pTjmSU+(x?V1!SjgICRbO6e^C@1xCa_<89~Q}k=!M%8s~fCd`yoXSgE@Y!{v@!CEV%z* z>(~2`_a8zbh$~WyC@)1v7NX`im@ZAOQ2*49lTk*&Ea5E&=>itA$P{cHtjh%(TN}xnP^@&0h}vzLis&wFwvcSjx^XbG z^4Kr6)c(@f*QLTK7)sasj8;P01(@sX@t2Ct{C3FKv=!ydR%WtVzMxl!mCh9H?9?fw zp)7JPNC!pTb!aB2Yx^BIb!TvLEzNCA8{NxMe4!4BJ|9n_CAzbd=5x2DKSp`b&CUBl z4CkW1U{Mi*)2&me`tU9;frB?|Ux!jsmq_dG>?4EgWYozQin271W~Q)qP6GQjcdS;8 zR>#l{mSKm9F5hzPGM;3nT)-eJcjk$yaYCRT+fmc`MUE?;1+Xw#iOimBkX_Q?gUy*I zAqAV<$Gi9cUi={t?ZVSPD+>Xf!&7C6V?AD6)tX18-dn$Z-7G_uBk=88HK7Mew{NRu zWt-}jlk1WD$MIX=myG1YvitwOjl-1{p^%nZjujPrVX8Y{n3c_dIegfTIeH^H#45mO zvfY`S8{p1hjAfhtT(ugWJJ&rq@IHr<%s#h&W@bGXhhpR3&yDo*s!URWAZz!+Q*C=8 z*+=JVQ%~X3E+|#VF$>Lggos}%xm7;9y;w2yLO0Z#U-I);(Ss9^fk=INmT#zcyp^A~ zUh6F9rN99Ytjgw-#R%UN!;wyi!DX$6!MUT ztGi8oW237B-ttl8rSC%{G&@<36{?Osj37M>y)UjkOpp1V_V^_IAiZ{NVP2I7~QQBPTdf)NFtqs_-iVdAl@?W?wEwBOseDne2m(J{-3NiCno z)yo|MU`}2=8})?TA0)4O_Ih)3FN7WOyDuHo(R!i9yfQ7Swim1U9p~D|+^BMTZr0c7 zD9Wkk^jYrW7%rqHk3KmACMhJkPIZceDNPQ3ErHXD@Nb6egpfFCkb;DlX& zM0u$l@8-T@mLWM)*HC{)2FHUM zOyNp5aX%JBC~t3aig{d#YXM1FgV=<&9c9*bFji_IsrKl(kDrwbsl@t zE4?5Z^D#HHs%F*&JUpgXu}AwuLV~`HeO+RE7QH_{RO85lKhCAqjk#kxT&kma?RPgt z+Cir=DvFBi3T1&&xDRA-$ey%`nd#&od-`=7(9$3+wcA;Gw=(jOTFmsw}!?WLb+i_mtd(_%Kw$aDqtO?!4Ko))Y$?ThFl;k08kaY z2I1awjm8|drKulB?Q~SRxfGkTZZPleu0x_G7b_|u8F=Kh7NwYKWN7Hu2)knJI_HB@ z>!~4qsZV1qwIUU6l2cH4v47l5Rvvl;ym@>*_iec@Y1x}%I6TsUk`3(l5`NN$)h_6r zf^@1U$83lRWB{j(Wc0|eqhlIi%H!`m;1GrVtX==wp_qduKey=y}mA4z0OlWV{*Nr@URDSjPVMlwxC%_lPvBB0@Lu4ehkI&-mKXP%fzAn!~|ND}ZYO3ti=F*Fp4#(zco+ z7#_O1vzYt*(f|Nm(b3WGHfLpa<|{Yi&=*39p*H*u2QM(6Dk>`hcq0J*cR0J=%3xvU zzks*UsHoaP({m&uwke0uode`e{p(Yp-o4_=L~iFhZHBHFbBUTSy;yzH^C=(~4ed6P zDh_65)1J;c0_@8CNKRp@R1Yskbg(5{>P53roH`Gm<!v$V%78S=Ztcc?PsvtLazm2T)bQ8!irEZGy8cMFt zhITE$y|31-P-XO}9Lx<;v?oN{cBNK|K*?rN+dKxuKCPQ;P~FR5SGA`4hT9E&8smeL zkOda>h{zCE;8^{o3ozz>9AQb+Vwj^a62+&~iCLc%pY{;|xG2|M_xUpuMnrz9y!qVI zMfi+)AxBH;v?#FbtaJ+Tso3ZpYEE!s6&Z=$*+|nWuYV<=M}AsE5a(jhft#La9ec7p(3Hh>-5dh;ty#uEy{RuueKa^Jq7eXge76VmS zHSObBns%n1)@eeF+5G&IYK83BY$PKHk38KUBeE2B8BLYy$s*3u>xnf47x+a+;nW6)dfB<^yK9HtPJ8id0n& zrTLTd5172nu#ZG>+!f4)F+ym+2jOfwe^1B2E-h<#BnHZ$=DDm2nTcP|*%2^4x~~In zAV*_v*i1|x^c}9qr_!`rh&d<1VS}#@K*opXp*~kBDX(bradTcGm5`8_#{QgSxWkkE z=cMRI!L`s}1oU+_Hp_@)P1#s^cvyJ~q2}E`MNmv5YWU2Al9tMrV^{8*&TE;#g&pzL zn(}Iay~=HZ<1D4jC*SH6t0IJ+?)o5_4v49XmK)a%6^of%^9H)I0Y2$wzY%XWbHH(z zTeaDR8NE!2o8X?FzB645?9#;@0wQOF7vHApS+&l@R<3EsRe7mHd;hwaedLDh31lf? zr!bE|Y9IrzA5^!vkEss&4)x`hQ@Hd$QZaPPvBQ^o(NIs+d~)CGyj`Dl+?X~Oc70my zsJhh#XTj@yfq6v3fE)3e-*dS+*O=#euRo5!6 znwi>Covf#~|44}E@m8b4es6-1z1R{rAO8|%wC6sLUX_-S)EMgT&QXzR(AwDC#DV9O zw9S`NDIOsL8GZdp1ljvvlPW5fLW1QV)v`0R!OypXoOEUG7qVyga3@+-VB|V!TmqF;M(<*k~q0IVV7j~Woh~a*x6y*Vm_v&p~A>{9d^_* zRDZ7L05*NQzCob0?8@Ff+#;xRKX1%a`_;@(s{UnX{IM;wo5;hYy>rS1nn5_3Bl4 z7{c-Ijr2jI#8Pk9FFidyTu;ZqOs&%Sb&5Qp1A7TZ%up?JfA4_8Wu&VwSF&j}6##4r zDzvw^w^ydK6bS1%@9&bAYLqOc-sR-nU*#T&fCtyI{1@>ic~lAwOoP4dO!dz4EL8Wd zrNkEvzzA8oULl%^PL4EanYdfK@2Uw3p;x%MxtIRiarO}!rwk0`jg3&DUp9EITvwms zU}sl>>C-NlQ(?|TIct-_hyNP#6%{3c z&$8?511(MrAqLU;IUyH1CBMTU-rDy>D04w~QBGRg`!@lKrl%)UUH|!WaK%piX9GJK zx>{HN7l#Ae$os#IVezc=pgHyaC#n#!aTR(lSFaiy8~6XWZmS58Yqqw2OijV_ygdEu zdECd3(V?N)x%lM{)P?3l_uaC88)yE0H)C$#JkiiVPt-{jEE9my5b@tWUTjp<>yt7& zjr!9aBO@VF-@w4G7SwF}o0Lz(MS1X$dro48$1B>$&mpPo>gwwFY=g@u1HV>s^4?Ng zqkk?e8UkP>ATCj+$I-;ll$P}S1LNbIvnDJ5?w8=;XSLoKXH5``#KV*Pt^tqW7CeGT zZj(d@KbbXt{h8*mT|gpEu-( z9%%%0Zc0k{X=!N-UkhhIeFIkJV0DrH4@`XRqm`|#&q*mKbyCVfS9seV+NHp_S~P{Z z14w`1q5cSER+s$rg#!4jm&7F`V9{m$<9U9atZi-0`;+`o@_SvKt{%hgN%Prb^rT9^ z2W?LvfaMO}r)h!#c}dS#|Lf~^^8O%KuB`)(eeYq%L09=h)%g=d-gUyOn3F4ii}bg% z$;t_U;sN9h=<*g6Ky0Un-kn)@ni6!*|6XH3PtvudRKV|nq~zPd`+hbKMWDUpv^6u) z6he^+Y&jGvG4({>9Ph^eEVC1)K&sfr*_-z}@@<|~$#mW3+9?@yqeMy__@q<`Kb{koq&djbCV z>0;+RyJVIc{%Wku-geAU|6MG&{J>TexqOJH1JgebQ)Je1d{Z25h zUsor}`2|6K2&hU@(j={0Ivj#?^dJBQLa$=LyvsT1iKs4+9lj3K2R7TDMvf;xrY2FS}PD3}bFM>g(rs@ zWyw#<6o=qc3q=WVkN@>ig*7!k_GPGvaB>3uNJ`}SH$_a?z5e|*+u=rQ+T1T zrJ)sS1sa+vLJt^0U+^viLn^qV{2e7vle_e5GRNC%w9G!=VOfwku&s?P=a$a1Hj236 zD*H^gR3kz3^7@!jd$b^C<9qPpL*G$RjQJ4S+RCnMOi;`fr}o@cdovY@bxzQ0(v$J} zJeBIC6g&|SRpgjA_LSPP)Md70sl)I8P2Az1SiJOx;21Z2E;!UzXZXZ=3FHIH7Rq@bL8@8j;Mu*4u}b z)7AbIh4=3>fZV#;nS_&%4lz2ODnNSjk8nBRhVRtj=*AO>bT zyi;y&YZJAbdkj3IzlX}l0&s7MmvLtI%X7y)O1e@5H8s`xTF8Zp%vA^7ax7?86=MV} zei5`Hg|ov$X<=k^v~4-cn`o)jep9fJlSQv=&5Op|Uv*V-Dpw3^WMmX>oW5=9P8R%9 zLVC`?zo5ID-W^~5aBS|F-L90JS~KzH*AO@)?n@#N&tYkQ@b`C{KaWY0!RnRT1m@)_ zQF@+)Q#=LOj~8K}IV42INpTI55e?vqz#jPL#hW3kWz#X+^I|VL58@mhof&T3HXHqX z8x*$sHN?hjc~*zmB|pWwzZSWlx?Px}`w28AnmZ_@KB438XPn;E-}b|fQYO6>!=W%k z#5&p|!pathZfv{VVe+Q15Hb#wo0|I2=3^{~b}Y@>9W9n4^VdO^m7cr(na?7n#4s*A za+`f|2L~c!0&{b98EToL8_Z{D_#m7jE?v1YySSKhg45gEH@3Asd{AOxq@MZ->+CET zE)VV_zt7Y;2w{E?rbWJ4;*O6%?45{;SM_gH)_c=dOO12}cMS$vj40Ge^YRL*L=2;= zdcj3Q%w^`2&lc6LvKI=Q&L$$_wqNkD*|8<38Y$d^q#WuWv|k?0H^s)@LYg0hZ6i9X z^wnJm8e|3%b&t+iK(BVR%6!oN8vl#$skHLCWyToQ7rP{5ZUXa1L5~iQFB`%t-Kc?< z*clV5o&ra+^@H{5wL2mJ(lUO$w2K=>SGk`1*sig~iIZ*94Fgm_2wnJE$?)nZ$_|%cdc16n-d`dUu5@!dTENoozK0T#q-46m$@bFZ>b9-|wHPP! z^lL$TGkZ%CZxab%J6kPGDTOfI4v6HY1Ti>UwrCRK|3}tUfJK>hZCqEy6$Jxn z5DZjGLAsO>l@jR|5fN#Sh5;2pL;*!aTBUP9N@|9X5~NFNKssmW85m~%Gq}6D-~V14 zmx^yZ&x!lo=RD^O=8qA-cj|xFU)yF8v2V{%E}r^Jz3o9x7SSb7#|w_s*AJxH1-1@NR+XU}5Frotkx(htT&L=-v>eI4oKt}gfxqQ)Alp5du891msf!q_rM@tMSGU1mZ_}~S?n;MNH^P1 ztE**krI4W8?6XJ3LUrkIp7TbkVKL7;-<5k`LovRmxt;{Re7J#wA~EuMCKFI8$nwp} z#xbRJ?10C5bK|V=0};FaJNSl+pdDY0CDeH6KD$k|*X$E87PB_9nwZl?n@`!P#>i^p z=1cNZi|zHH|M~@wudC)tBq_SjTSmBZEQV!PooL>{@ITorci;pH;2Y2#3a2C_P!>&l zOEHBm)@?AlJkN8j7Xn1G)sB8vP>L*Lq2O?B4KU-mJ^S`yP(Ee<-=kbID4fZiEl%e8 zWHHu1?6Yskz8}^GgBVLL=+c@Pt=jFSI9`U7-7;&(J~cE{%1oTOm z*25W=Js@-_t{h;u8~B8%{iGP<#{Mba?PkvS!~`F46u3=Q{&)HI8?J|EI(-`$oDl^X zCdLYn)f1-MODwAVcRwm);Cr_>N1vz??Juq~Apl8Q;N8<4?oYl^IU z!G6SP$$L~wNCtsj5tl7ro{ia~3$TLFV_owmn|`i`n9_7$uylsj0@uNVoD(GPszyFg zPmnspHRLIU#P9)g$*mGE;z69_I^sFevHLFsJjr%>4cZiRrDH=ojrMEs%WQa?9ws;r z>jH_cqtkuBH+`@)YI$2UfyeaGBD=}Vj9WyYsHR;r$;P0nKy^+RX}U7-b|^4nIXM~C}9IWCaVEX#qnG-GAv3@!R6l&2!PZEP20-QBVTzmh3Ipt!?_d1YOJ#c->QCvvhij*Wq3 zrQ?0PlDajvcgu4-+wBfgQNZAWu0pBohMW&Mpr=PfVz08YY9Y`~>&w#;MXqRmV@7%= zc6uh#g09d#-~7u_xvt$#$wR&G&BArBqO}V%2u0uKifr}KqoL4gNat$-#agSdi!SXJ zb!)8&Jd|a)Vz{N&`s`ZSy74`48Mpp7OI#hkZOVKJc063Jt{eSNAceExg9>*d4h@W9 zR@O2T-Y}wXlX@F_!&6i|n>w3PjRW~_G&)>Ev)?Gm(T+LPx;ATm|NiGYgpXW>m3N++ zl$_#*Z)`k0T^T>@ zvuMavk?=i1b!By#>4H0csLbsxZ*=6_Xiw5$lrT@^K@P&zpp=)sa}mY^qCED>1M6{s zcY3n*9XH4GCX^Wrdh?>BEIdcMW!&9tq{(}0ltSA51MuBzqEH28Wh2!H_E;^x{5=Kv zeC|_Hs*jw0TTmeREoLiHpNq0@6y;R;c?JnG&HYzyoV#!#7pgmnSZm53|8tc(yE?{* z_^iJO#T)HorRa{q^Vcgu>qHv^}&zH*3FsPM_(<4 zr|iY|r6i{;4pn4dtHM@w7TIjdTWx$Z#9NcE2%IY}zx1O}REc&7)V4QYmQBV8V zKBKQ_>)9vfo40au)*&V_MI#c`;tT-JF#wv+w?w{~ek<-g%$F|)Tj_2c!aD3aTL9_T zH@95vLi!J%=K$@MH-c7-3g@k=us>>peaYKy6Viy^=RaQNvw!I&3W{_te7KZ31uCw$ zoqCj%edE!$m%bJ)NCscS%^dye@h~41Yf35h2zVL2&av9Tk*WJ`0_OORsM~;2= zT7Bo(<6;Bgc^km)1>3a9V&t6`ifcjK}f>tsDH7NRgV8) zg;($3AhAiGBj{OXO#POo<#D3kgUs3PxL9KjBb@S!P|dx2Ecd?ckJ7A9wFh0%;J~2HX@(%b|pd)PMaY2=x=4DKGyUot;l`Wh*6mNZs9N;Y;vYCUsv>1%CiI zSlj{cJ+!$ix{c1Fg}@ajE=ULON)h|gtpOJ71E>%T~jhzLosEMZj1gDdc4~qy?AUg6xRMgL691 z8^X*IpWkikJ-+0)5&fKBBKFTdVtP;Lr(WN4!sTDS;E$+EvUuMjY!epAn|2=u2aPP= zdpqo5zVsji)93yX4umu`^xgYLba`ijfMo=h`(xtR&`{jNC=Qkwy^7N0r%ye;Q>Hj^ zaUCryX6*We0@ugzAg2c8i|v>D@n;I zCcz=cfP7N|{t>m&!gx4J)@}XMY1x*jvNSi$6EHH8UWc1hh)V$o(s92M|J*{7{e% z4YSmnWMHfu-QoQXpANRos9RCFX8}#Y&c(~yJTPFma4h*SJ9|8g;oO`CEbh(58=2j{eX|vP1+cRc>8~3VJ_8+JGm?1DlB9A) z`GmW>za=_$9=9l{eQqIpZnq^vaYy#emJFSW4SLDRg`lHn)OlRh;N_MNKCO=p40P7& zl5dIP_1&{a*7(fS#Kcp7qlJNus86kwGub0Sb&i3RPXG{V4?|hEgMyZHx--cekp$U;mA+EbCs2QY2}8NeZFR2*;I+qJp!PXCy6EoB zyV(8|nVK|sQ_bF4;9-WzLVpj|N9^Qu!=8zoWtd2^(cQwVEMMW(^78FBPzhp_C!n9s zaQtrD1OB=A^2<{>t>;sl`AkdSA1me|>E+8Q>^V+wx8ZDo`*egk#Aq z>E4$@oyrz7^!3EVB!aGK-F467NPt?G)0=m8vw!XG{_qE!z5oKhrNyBBc4MO`A77^M z{Sm|UozhmRcHkdrj~qS>E!cPXj<60fciippGpfA!DuaI=w89f z;!Ynf0gv)5l*fDhc5`7`b+DL(IFELvJt~?~rn@Z&_0`HzMR(iFV?;G?Y#uT3ony1O zuoAvO%OP)*LNk z;ec7JN>v}9oCLE(Ggz#tz{|^*ozY8o7|!SFiqak?tVJd~UdIAGy&s*SdP4=yKjVMQ zaVVZ5cy_eyYBdq#h>eVl3=emnsV*_w?Ukcfly;)di=*XcNW)xbe$7mHJ(NSij*H|N zy8P%H4Md&HvVgM-KWhR0w4Rd)PgT*a^YL=o^juHn4&?}fW=^3Gnh>m>ibaK*Ql@{YGJl9Ekqhdt9Le?ck(B0~GtF&bCJ>d1Grs`|!yoptk z<{0;q`SsePO^`lNI6uOPpkKLvg(9`;f)pB)K3XSJSV+j($?2BlwIGyQSKukG+h&@G$-tQZabCbPQ$DtDAvWlw;3!c)=(fj07`?|XGUTbvG{Dv2I{z2x= z=T6=jNpm=`<88H>W&iaOp+FriY+Kpc+1Y|vH*hpn#ghki<-N?%8=i!3Bt+Moxt9#atwA|aCr1xhh|!#d=wqnu zzE`sQXxQx@JUCAY@r}^y#pX(fo*GG!je1j+H;>e*5>H5PFA_`gBX%DNj(w$4?AD+>h8XB4)5VE2AOl{>M{>=G2`C4 z_E!HukKs$+}FYu=yTeMS)?Pr;)liv#k!&ePHr)sRs=Qp^jS!&Hov`2WORl(031c z#>hClRmXQyKJmyNp$iwz65DVIE`J>d4rFu1{TdeaUF7QOCA^(a8(@{!kG;SM!D9dU2jY^)9EbRs1rx{=zch@pEAyAoU_ z5H9y-y$i=)xOTM@TEv8AKR;y2Hn+7denhpatgW_)cjL_6lm16eJiWZze|$qp>?YS! zs_QbMC8708?$?$}5?Y1)>N_tX%T2u!T78z9L`g_l@#V>VcAL|dXq>N!S5;58p(kSL z8Gk;>|u1`INE`Di)I z3AR{?6{Wislj_{|MEn7P_$}0iFP=>NhS8QSoC(-Kyzfn@-Osx5ReZ{HwbP4TYOv1MyL_S-)gLTPj$uM$>r6%K|g4N=X^ z^;;v2i)_C06%QV9X-J=$p4Nk3?UThY%$6cwq4N-fvJ*aJng(ORF+L>1dU zToZ;&vJ@S3aHB>Q?BoDJ2Crx7E%kD~&?{YS(g<8#A03GIC8o1+l#r@JQO*}gwp-T= z3l|>PJ+QII2o;{v(bFRKbLtE58OFd7dg;Pb>z>?A(7WNjv+ZnF{xY{}ykJDDb203We?PcH1V8|-wb5%r(0hb8tA(z%5P76Q~goaXab(o zUsUMfWY+#A$P#TL56u}g&1--Ly>VkK@#;&7m#xqcVLL_y)dlGHS~H`h-JsPVCmXxt z9eA68fsHr1r_^u^S(u8=*-X`!Yh!g2^z`a%=jBmu-iz^*3tp%#a@^Ki#qcc$!pO|@ z{jD{meZ1txQ40(EXQj#HY-6wb#UWK))9sDajpgEsg>VK_sVyXFHhg=?1-eofp(pqf z@LzRhmU@cgr$cSNMO%_rfk(uU7K#q=zY~AvQqzX?-EM#V+JnJ(bu>+$ii$Dbbx}on zz0Z`_cyppLe2S)e%*1nMIMQSj>4x^QB@eHQnMUsNod2GmT39Ij>Y4(Z(^s7wBM`-s zhcg|NJN&!?a*4zs0^#VElZBavqnXCietw|9)wEis(FNgf$l!TxlPNaw90%qIPvz&hVQ)gl|k2?eGsAD5)6khu;W4X?zx53&fIar^$MM95Mn77umsenOTb`;gW(0S7t#VQifeA#CcA&-O}UPRGCZa0aJZqXBeM1dj+qExJm-pMXNzd=9HVH@-?vcUI_y$= z&M@yz?Ptfa$(A@4mtWJQqj=Z_)LI{z^6J0@pYE=%WlsjFjlsG=j+~apM)pBS0iKX& z!dESUgu|bzB*;k5hH0+j$3g}4a!*JO=t7_CzprP_Z_e#GsWf@%lFdtrq~dUX+5}&O zIf8_L{kpnp0hU7W%_9z040N-B`g&+~m3T;8m_@|qzO5}Nwtg2S^Yrt&Te`gb8nyUDNySW>b-1Z3zAoaWayJf{tcLkZ`7@c;bCz>K*4m6+9=L@sHhzmhuUL7sd1XphS z#KcSKsaWDs|B1;Eex4YK&lHbS)8OOc%lE?1$MHo zu7Cx<#`+^NKnccbQ$;ma(uUY~rl`s<;!!<4J$D8FE3;H5zKqrGqjeP#MYF;#F1b4z z54{~jOf#U}R~PKbca`c%S3>_;1yjMOSQ#JBF8b8Tb|sF3oJNkd^uI~Ou5?X+ zK_C}TG@Tr;4l!^y`t94Ep|XLK=l@wxCBZ158()wczg8v>Ynnnb>t1QKj~22#>$7o!is}LlBmRm# zC<?TWd;WbX)sEG2`fqM#gYVG+tsSXqNlAIzi*l}dd?1py z5z*Zi=DHh7>(V*> zOH28nDXr2lAz8qOw`1o<;#IVs%E`At-l0P-JW|`%b^(w@B(MIF-*0si&S!mgcY={{ zU7Qu#T5n*BXFK?zYQ5poUPPNAOzu8)L_;_BF$}Mys|La_@eoMh&&zN4ry;fPN_(Z5 za;&S{R(v@g%m-rh>D?rXXq=%eEX=#s(${AKGnAH*AwecW#rn#BZgMBD8dP4uA9`04 z`yXLMQA_q47_?Le7iBrX09{-MuK|tZIWOU?t*yOCgsK1i1|=yI;#VH8{(%iewhqG` zQ(V(jV>@5~HG5D^Q;?PjR{e$f$iDi%&yMEQX4D6X;CqpGCc{*sc>y4Otn6f02I+6win^>LhC%e+&f`woi0uvkXCJ&oT;I4 z`1dtcYOO?~P~tl}1L`L%44&lm>vN{tv#CvAQ?9a63>qsKv^vn5zo3T;Me=9Dp+`2% z{}q5!`M;^L7^=GZ`Y+QOFK%jV+|Ne~hm2m_f$xD)&rpb_p}X20t}X+^EQ2W2rWpuDWFE%*TK45TSAgrc8cm!z-;qLyw}OB7T!{ zvEP^Cm0s2~C=Ki@ELV1Uc~ZKSp@jv}IbrLjhsX6Uaf-x!4U(YhxF#3{JXlce9T59Q zDAR`c^*Eowv46Mdvai9m%~*)8$;;9|t_dIu+!W#}nS$zrDVEYORps2X(h0_i3C*(7 z(nIW0c+`e5gUbPm)dXXerWzxn3a*gH`hKiU$%F2UVE)pxzq=4WQo#qi`hZe44PC0X z1kXeDnH1>drq;z*f0iePSq?gNHWgUOkJ*3@-Ns+UJxRQk-Zc?v%I>0=0IXvLuKGX% zq1p1|ziKuusw^Pm)$v6GZaBlE^Nz*kkJNKunDs4R+TZVE2BVgo{8V56Bxw^#w)*j9 zf25I<-OsfE?W>WHkT5VXfH}<+34h}9DcNDF}a7|F`F%=sm zfG!`4bzV-iqinC1PS>t5et>hybaGs;o=GIB>p<@zBO@ano#X$mDHT<$k(7y%DTdXh z))CHv@q<2#2vfFi2Su1Q-WBw}08>%{&OjNnJe2X6{MW*^aRZ!s%O}7g@$f8Y&M+>Z zNr__iKv{O+OzvGlagXJ3nCJ+I%t>8#`yr&SK+b-x6qTP$Q0;RtiC^Nmmt0fO2jYz|PO_ zfCg-==XW4TYmBG>;F;efbUIuwOU(Z!WeplG_GEdi=O7c9Q$(T>5K?2=F-f(#|r=SqU&P}m4v&4y_c8gcFAt4 z3pVAO53IZPZ-eg3wN?s1F;`X=?`&AOVTsd3mVQ1|SpTlInslKINWCSkF8cb-<;+hR~Fm5-jlx4r;Xv#`)K^>HCL31Htz5n|H}17b>?WnHJ+s?wnC7UN`#1kZ7o zY9>&XHX&RY=tp9XSc!I~4!B#s|FICld3qYuW-F5^OhR81?e=r}Yh{>?)qS%^taR+S z$^QN`yU_?;Jy`SoAXbYV+vS3ce?t8&473kY;G!%8!D|np$EW^=IhQPn&qHin| zS+P)rg^*8M=j~H)mqiN3fST@d!TwUD{3gZQHC%`A6$#mg|3N|Lc=+R?%vgIzM$BSF zy47QjLs-KsDY60jCTcH2aY=7}QAe%VVJ27#(u<)e@1MCF_Aj*LaY-*C+nuiY&4}#?ax#t7m{+qapvB7d}(h%)R zXEslwbJETd7VLEuqu~Yare%Skc{bj40^bYXe-Ml))PF(w_U{2iY>0cgJ1lk@Pe|g& zkK+-#{ca1Mr*~9-4De82u9^IfvT^5u_Xd;BZ%}ad_s6T|>9r46AfbC{h{UNuU-EN% z?=ehhxxR_X5xKN&6;%+HSQ-tx)s~q@jgTnLvxpy01{}zXhT-tHno12qq z^3~7j)upyqgO!G3Mfi?WjIHuNNaSQEgj7Eb*!U?Oq=~VCfdsT=`Ol5kXox$?e?-Kl zPs;o%;g#shO8wN7dRn#%rRexV9|bo*gZseXgCs&F77Q7b*H(}==YE%#PEm^+RS;Ru zT)=I0%KDJsoSQ0Nm!_vb4W(&RRC^O1aYXS)sl1Jdm>5r5BOi}PY|g;f{m&j-o`UEs z@DZk4S73TA9-4yJvm3H#9HJP*Pk+Az%-2ifQM&^PO8|Lb_Wy%duL3rsEXmH^JnYRG zvbFWvQA5GtM;uJqKq&MwU40Q!%Wsp>YJ3 zwB+1J3c!Te@KyV*bSm-dKjnYZaDY)`Cl;Y0Hr%J^P1xjabUlZ!)c@OGm7VIRGdUr9=+B$9o+N05AP;BE3xDoVo%gwzo8+KG5beZebyGvHLezUL+DX=hfay~vQ zVEnoEH+*CBA#YO37wS0jA)VOVW`s5f<`=E~yz%&?v^cJkm_3G;ATs3y<?RW zB_t&eLhGx)FGdjx9_kfUGInGI3CYebTVI%aMu}eTW{VM}$s5VHIQ`)!e5NSx z;c^dPU4DzqE|Z_t2ggJg0kw7Zb*k*vJe04s*KfBKSS54%_xGp#j9nu^YI&kmQV5ku zFi3@kF6|!`f4>R(93S8O?Cb+Oga?jesK3-2pa?X)mRwXi@Yk6TCZW=l6vwtQ$_qtM zjN6$g6__F>EGjBG8`fJ0XRhcTQ=H`ASIu=P6IQu2q&>_~U>;XuIHp2eL!#XtAGp_i z7WSX<3nez_6t4lR+g$ zhgt60nYn!zDJJedY;+oh+qm}g4$$t-cd_I@vEw!`y8t`!k*U`f3IbsL{PSuKs)~wM z)E{6~=_srE;vRe!Y%?^pTXL6zHHE;W&|$P143)xfP=1^DIL`wsD`|(3k=rr_KrX}# z7vN!8<42;2#HBrZj#5O^?@Bmji%v$|(58s(QYl!&ww@lCOj!M!wR}(BQOmlzY*>@M z3m=|7-BUcYZpmF?(_e6l!c^UE6RQfPiMWw`BuJr)9%&7+Ij8@g1IPdKK1j=v-W_^j zEG_Nq_s@>bUC@j7a>@nV$)m6@FgGu0Wj_MwsVQKTOiWCEQ{*=CKZ<-?W>pvMDHW9^ zJ7WRwA|bI}TwufThGL{T!AJ$c>(j|y8#qer9~el0_9OKh;3I!t7mO?*X-%*Cz{ZBD zfZNrTeY3xpWKsK^Tiw%w>+k{2uC7amZcymx8Q5oqbglFL7p!{#+=SS}$q`Qf|1o#F zPs1)X!-0v$(v}u^A!=e2{8oI zADrBec=|Nlu42u%HA-kZNjHQo#!%}LkWhezSj9E=UH%hbEXZ!@4;O%d9ZNp{d<_+i zJ-E~mHrs`Tt>xvqL)Bwv)M9ZhZYJIJ!Ktb|!aMFK@F;uSviQJPzLTJd9W^PYu|RW0;<0ahUq%RFcm-% zGpq&JT4-wji@RZr2WT~q@jU_0rB+l7hi-X$Ek}x7=GK)sjPso>4LOkNr|y8I>)?b| z)|GxjxRYZ^x6&!Dd1^lbKwYc!M(o&5)gru>-y==nT!<@{3V>EQ0kYhRz84 zIh&)k+w13e&fida!T9QiFpUH3_~izOB=-XU@uK#QxcCe{5)FX`uv%4*_xv&wHTs^2 zu|KJp(h3T4^YSd{*dNx?uYl?rf(iC1mw~h0|L6i8=)#NezjdKr*Vq`8Ty{s4{@y%4 zv$Pz$ra&1uIFda8UdFHHP9BU$;(M}^g+gw5o;q@IM~vuT`Srnth}sVu{ak*EO(ziv zK#Biy42%J!B@S{v3NeRY8UwGtb2Er%h6?8*K=Kkl2@V6_JDbV2^C>m4VB3?ys+W~X zN~`05G_tj|g)^`({-x0v10FnJ*3I$WH0Rh#EHBT~C%QE8a-;G^95BJN~92-K<+3i&gX@m=Qj{Y9Q#7%V7SEZtfR zlv#e|21BDVrlhChx8fCks6N3>gNQmep3di1lbZVyDZPAct%eqfTI&goU%lbCddcyQ zN7sINJ)n5oa$PQSEVa0y99v>%j-H8KZpDC5r)$+zDu9t<1*?7!bcC`Qr9Z@aa*PMM zp?68u?G;%6#mtM=(0x(wK|QbS*3U**X6e9PALg@MkMKhdz7 zQ2OB9DlPgia=)#2J(-yu;l5Tcl=T=7CV}d@!WAu9((vQQK~IR&Ws9B;^L>LGsEyKa z6G9?~&w^$`spHL$RM#XyVgPsf$$Ts-npri`(`Uj|l=%QQB=JLVEA|z3@)Pv?rjrBS z8ki^`DlXmm^6b~Anw@_2%x9y_)RVl0k-&$N+5(4{3Xwjp0KvE`oB(ft#ihM*jLM38 z2X*ErTWnDcq0`eRq_KpRPRVBiub!=CP3(IQT+Yaa-Lir}6VY%szq@!6=!OT@)`o_L z4E#onzbqlmw-~o8r&{@VdG$WyJ{~pg1XQy&Yq>X*+VA19V0s7$S&9#~ZCgKJmZ$Da ziHNVW_A-f3>7l(0=A+UKoO&1>3xg9}JCsF-;g0wN`ufd$C|S?tV12Mt(53y^?2J#z zJZg)5tJxBg3`LeB!Bp2Yfv=`e#(cXUl0kjrE^yj!u72utUwC)11fu5f>pN(5cLS{4 z>l?`wmM2FnMA*8gIab{H$Csero>X6q-VRULo)?8278_9sX}mR9*o$~r6Yz~2l~q=@ z1rIhXeQ1Y3^lz8nquQ&AAo)Y{?=Ap8ZQIB)yT-9la=jH=>eVx#mB9_&qKr?l)T86o|ul(zuD{&gS#S@SAW!Rwz0goS3BYxmoeMyyF>EV{mVvYLO_Z?#O z-Wou9W43ZwviPYww1B}gH&+IpLDa|d`{XxO$fxW?5;TVJsONl!fWICljaFiVxZ|Nb z>HWW8u`Lt;Gy>~oN*dXRVQ=iD1;&oFfwukf>@YXVW_4Oa6hmB8<`;L%Ers<2sthQ; zeLq^**tW108>0&YZt?4EDe9pR#q@SvTD7KZod)HJ6r+^}i3P}K!Gc18O-qyz_is8- zGXJRo#WL!J*;+m*YIL-_a~Go%SnQM(Td-oY8?xj)V1{HR9M+`J?z+0I39_=klS#M5`igApH_*P8UG&^;Q*pG2Jv0>dSvq5O}#RI>wk32(J z_|my52u;IH^i45?eSOOm>vt1&$1P9Kk@`bkUNQzNWk0;fl)P!#iaP`DgtBt!5Kg@p zg@?%jr|0A2vqMBe!gCf{3!KwT`2{Lz_C*?tOo37SVL1Hh((6=RZRrYo(|Qi_lA)TX z1!M~FV`RsPh?Tv`2mBsJMvA(E;n?l?*cAOvMjGYiwpC;c2^w(9HQ^8^1E1vr=fnqg zLVXAUlYZd|M8Vz0WDRLZz%zKS#F)lPZj_^pq|D@oD;aiOxclW!?Y0cg+IGlgE*oCg(Bgs*DJO&20oKW_>F!GD7TE)C!3Pjt^r{g z%^KN2ce=Q_**5+&%7B7X&Z@0j4v2LQF43!r|H>bLLD%}YHTu*IO~a`s6`(kgb}G~Tx1KoVongkkbFnr!dq zOvQKyfcE5MBrV%)EBRz*x)lwlN`i@Nzy_1JU}~1lEWE^a*FT~lcRnI|C%st#u<+jE zU6%oV$eV|aY7v?l_?!*Ys+10CC%IWE{B@}TDD9u#(+fRxEV{IHKw9r z0)6H5CrST+XfxOz0C6a5l=Eb9v`htWR2DWA5We5=<|v23iS6WD>6FxmvEvIktN_25 zL!xDVX={TQ)(aV2AKWU56wL5TAQMFsl|nti{)o*)96j^GccTo6n#~|Q>DW^lb{O&$ zymgSLS?`r@YEp)j$L54iL_}U7hsn@)kFyzk(m({gV8UM{!pMbxiy2-}B)^(SKp9Y~ zohaAp6T*tX3)~E_b0?4Uu*)I_uOqY4&X!EPjoEklFTW2-mc4&RJ~1*CV1m82H>1U! zQvcO>B}BvA3IzEL)r36tNo|6mSC$%AIewYykRK9!m*?9Oj6) zF8!$e6I{9MA)<+A`eZTM7((7|0XG&| zgwd6%FE3f%T&t8^~@T>}s>9i&_q% zW+6@a#^Xo!k?%~k=&E^6K#~SQZLU4~V<){gTjG!fMMXnEoo_lVrOLRBwIbFxc602h zya_2W;E(5Gw&nr=Kdkp=d#d3;A+-z#`a(A#D7=6($6G&mFgrbcEfZpYuPv-Ed5Zw; zseXNxwl8VQ6pcmIf6Sq_Oz`RP+3=ZCwKo{7p972SvYCepp8qGXRe2L+~JLkk(3a1TfHveHS#FK zXG>ylGPU1_jDms-JUp3sc@xd{Yt;uDt&!W)0S9BY66bQE=mQ8O7SZ)7X@IaaL`D)M z_@5m<3CYgmAOt{|ersxq*~y>65>l?pu!k6*P-C~D*G~@!JQo?`mL;s64At70_?jB; zIof1OYWW(We$e|EmAsy-tE)zP5<M>x7hVh;~gza`0C>y4SUD?3?{lrP&C83|B zjt=v-HZmv2#lyufe1FDZdIjz!^~hAIr?TK6u(y0%Qk5A;O_`>y9>VqJ8GBXnCh z@E{6BdRb|vYPf-7WFipmAl{^B5)bNLEFWZfu(c5n?`~D#`S?-T-+`SHC_)8sxoKr; z>#^|8r-6sugi!n{3oZte)rTfmdSSebP5F1QYr6W-yYO&n92h!VD2_nKj%)yOSwn51 z1~?S!--+j!SNNDZuQY8VECFSQgUN|?adj2BbSbI3(*9et@c-}+G#A0J%HkdgtT)Y% zHdnyR#_dHnwAL-bWB~>Wk-&!i{9q)Jig6iW3dkdH1Q0HvKq}-xD(rSDKNxjjyIOvd zx}^t+M}ocprTL5U40sLabY)>?pfylPP+^m1cqm2``xs@k4%zp;s6BpWT*rC-;*1@Q z-tN|wWM(nk6qrr3>bwEte?;xFSf0gz>0xTB3?1c-QVF2zupDt4seHtp;OzwQ>u+|a zxyV)$W^QanAiV_z>}|UE%m8(7x?5;>YwDU1Mx&$acJcpl``t7X9*8yR@E9pFF~zNX zOdTj9bFvE?5bN3yTI7Bx!eF6};jSRqx_qtk(4EcD$OtlXX01{y%}{FhFAM9ZseMau zV%Q6-S1|npatImPb28gAWau~D=~IG-DjqnA>Cj)$@d*3JZLzcb@lsBATbK?JAtaWg z2B%J%lX%dRWhGFdB}C^2J!1slKH{j+KOeCJiGHL3dW1og%deIBgMJxr!F8-`TYH|Y zf7l_*ji+>^6*# zf?W!;0x>C~lx4ta35v;WFe`Ii0QRxhRQ9GR2)-XFLWOj1plB*FhbrJ*V|Z(f%yu^9 zui>KM36;9#gRP+Toj3P|_s}pU{zy=WqpEZ`9!xJy7{?~&xElv4NO5z6L+n4T%>S|! zum$58$`gMQc?pj&v)!5U)G&W~hb-Dm%FbSd40=PW0Q{O!u)lv662~l*#4+4e(@2WY zq1?KS3&cQH?wr?;APj}#4n?d6z~V680cD^NBPIC@^Z6_4V-vu@Lw38^=DP)fFt+bK zKcE!uBTH*@)_Z?U0xNV+5NF=EL#O{N4eWy>K4;Y9jdUgl5_eHC3f8?4pL)(i5}Ez$ zb_0IFUKX>5p7W#7DtEq%|2I&goRy3N#7%Y2}N|$ z6^}5%0x77?ZeJN}`4_5#L^*2Mge)V%D%B7xFvgcD@Zd5K15he8R!`d{`!OK{S|tfk zD&l~o+qrJvcb|+})8J+W?t&cWCev1*rvMIpwtLR*^JqUsmOsxh;k$e7r7I$Pdqe<+ z){bdzmCdCAyKG?Sw$Rru;t&dV5_}HgtaCo%2Bi*&wFqj)AR*BtfR_3Nuc-0cSkWQx zl}K#)$|Hc9894}73@U`h-rL#~X5{kXdy4Hmnhf6_@@Al_Q3WFkq2;AZv6Gbo$9X&l z28J&{L71-_o3Qge59-n6$On5D55rPly$DO4k)D1XHXJ1S*M{$W-ZeL`4U{KPi@ZEB zp4)4>SBIRs=yi=qZSv$>1_piga|{Bg@vQvKhl3nctMEHorWkKeWX1AV57W(#`pvRw z#?I8psqwo=Q+o?X%h*I^4FAzr44~4Yd*;Cuuq}R$DymS#K$`Qb@6MV!^e~nVHq5{zO9#4BlQ= zMA(+aFU=fiOS7GKX8;SAs&!r%*pf?3c1 zt^$UFo#W;PR+&Awpr%Dy^st=!OmZ|NJej5~0S48WF#DXN+tdI(3Lo3@+>3}bMR)+1 zp}@tIiUn&Yxu%WsG4};txrGk!!XKsB!Hd1E}MOXbz6oZ>lCnIB_ z_;jkK`YFSZ7nZH0Byk_=fS(zqNUSwIH+8d`2N~-&mreG%{V@dC{kP%a+dqQSued|? z%Z2&mTEe|HG>FCA>}*cSWOSOm9JN_*jxq3BzN<=L%OOG!>w)ZxFKGos&1vMbR;}r? zz%8>hoM-Ml)r!Vt<=4@w3^_o9pp~ul3g%#XXxfNZs<|X;Ps^ziD>e!*>qa7ULV5cT z6az>u;vK0+O-U2+pmaTSa%N^#Zs@IK+42DjX92#M(?2sOT68*L$Kcg`-NKN2icv25 z%!m(IF!(PecKJ2GjuaJ<^`#_x(^0vf1WojrINqh1gGq0V)oWBdn;n2TCrb zWe>p$PzuJk1ZVTiH83?y${RfM|q+7EzIF#b&piXbhT_@VZMm6E`p z5k>1eF4g8!HYKmVM+V*)3T0-y8UYZvcWbYZaWb^h1+%pbnl3KiAg>3taLAH-W@e*F z@uBd;n?R-*w<0+_??X+gIrWF6B+5ZjDaYa6v|4LMgJX3p7(vG$`kel3lKlvf1%JBX z?ZwPcsnh;Y5wZY^xu4S;od28f@XnQU%`t9OPZ?Uu$s~Gs-|EF7FDOMcb^RXO#4m}i z@WGx8&GJ|*c{xywh2Ys^B_^^ZR^M@42Z|VBY@g&*b5wkIxUu%yLnvUivND5mz-a5^ zq*1pMY*KxMktaMbKJ_VNOaX*K_hwi4HfJYKUyVCk>v5sdMXo@9!i{+a1fnh`&cj~} zVHVDq62(!3ZgFw(4-3C@D6IT_Lq~s-yAWTZc)ZWcNAv*cYYA#T3IvCSl1Q z#3k}{Q>_5%UFk~8J|HMMDrxt4l;K8|b=UDygDaPd;xagbbBcRnY{9cg6DN5~;e*WZaCUUW+5DZMexWhs_Vdn*q-d87) z8R=H|CN!~LD`T`!lnj=2vsQrANTELE+@Y3}LM=;UkvWKz(#g33Hw~pF=V2$kv z%iJO59z!n5VDu#2P|GzO!whnI<@ndVI}qAynEWcVoQIoxsv-4)`PJ_b>2d7GkJ4g6 zrE)SeJUyG<+Dc=IL)dsSp_Kz)hTa;a*JYJSAV#9S3wkYAyEFy-=}2p)SOR2jiJp>j@HA1Y-}R+UFYNXLFdD`#-H&%I z{&C_YoF1T+y6H0A_5l#P3@WLpD6h~(7l9b2N@a6hEa{Y^7AOz9L`mMZg#Fy;=!@o8 zyXZOna}nE{fW|ylCU=7R*pQ5jRIeVNsW@FiQE`RY#^QPzmb3uDv9#saHSm6HZkX*h z*qe<2QKKS+&%*YG04?XB&xSnKdrBKXw}0C(Y6Eh7bMa3`Wbjp#lqf*K?Qw4OaG~|a zLNWQoah_7*@`?c3yJbqoty7j*L+f?blfn2BkN<@kvLzNZ7X29`=I6`w$)X{QlOM?(GcD0@P3#rOl^GpxLPchTCSldyMA+R?i>%#Ng~dqBJ1i4MwkH4 zd}LYh#0me_R%4Vm%p2L#){b}@c#yHp8h3kOem=C=ejmy=f$?yaal!r0iKa3u4)o{G zNvD;I=;V$a8%J-ue#*(2Y>I48Rrhi($!m(VPpv_1+4UzXwH`fks|P9TzBbG8*I&!K zc5xPz+K*PJKTHf7TVJ>=2gi_}Jm7GhQlpET?nNr8n%fQ2yr&NWgHPu?Ly@1Iiwo*h zRaDnRZS=B|k}6&KKQ1r-#mlEUG+6gc96=&B)Dzdc?|148ls_};w|6B830GD*x# zGeLx~zCHyH4}IWGM9%NtZ46GT7wMs(9W&f3_euS8gR0Q0+C+tdfcDx2rH`! zHH0&?13!P@vQN2h!ZmKl=-j{aQJp$U!Ug&!r!?deR=B^#h+dbIdrT+jGD|I53}N9R z?$^ih&=v5N&W3UMwAx93I=Jafr!M#DhDUeqiFv#G z$~6Qt*prkWad3_g*mFZAZ4lj$AA&~Og?zSerY1%1egDMdA9haj>ii%9`cAsxiG#Ep zx84=Lr}vX|%SoD(@%YsFl7++~%6|UrSt*Z>V41hfB3YQXd`;5@nR96i1ED~cai2

    1rYw6M=7h~4pM+Q-BVs?YNFmszl6ag9e=+)J% znm~b)(hwNsE6e$%C1)T@f2`K1^Ua$Vxw*amVO39Tt(kPRw7f?uJ>;H6M=!&EX0mA- z77FogcOkXil zIF2sezN_OweU>EW-R5^ylapus!zwFpj+$j;*hX1Fzdd@Md+pf@F*80y{7ie|RKa?v z&W1)!;6`W1Erxi*NPf1d78g$cSXp1lK$;%->#y#vHz3`-r%x}^S7C>|ROXIoYxVaC zz9`Z=<mp4+QaVpbHgCeh zmi0pgFV3{xXVR|u`jz+mb0y#FKbIv<^das^Pe9Ye5xHpjN2UN{f*AxRo1Tb>4VICurH?@8?Iy zF2E@*9Za{pg;f^5)b+(w(%v3)CrzVp?b`U#4_XeCLX)sksB4<53e4a&^)*i9BcV1k z^jE|FDM0gkJJFLJ=u33Wc>n(XuoOd)bNcWLrc7>CCuX6mSu)q$urj2HNNH|$I~am$ zK9&mnmFb^MQ6dWi)?ezmgT+y4X=2jS1C^IkU#)C1@bCyddd~~(-JC7QQjGX_wxmFC zdSqYr!3WrQoquWpLhDcZ>*?v`#!>G-aDYcZ06IxQH{_k4PUH6QC^4@W(KC!WD);f@ z9i5!P5^uu#{CungN3DtwS}Y~iQc=O-Df#qiZJk0`Fdw@+^z`%zTVdq1mQPprYI?kj z+s=Dy#wJmadQ@Dzgo)|Sp#EF9Cn^&%& z)H&v&>!|;H{E~&XeWuVF9q~4Y)NzfIQ@~0`=-!J=E8q!#UYAv$2P?Z`WvncFv%l+X zNV``;57_ozdx1$jkFK|i3$*O$L$ks(gn~1B_xAsA!;LwabF1hbVcyJm6~4(}@SU_N zj6BD%6O&M7)2dy0(gPzqud1qM+Zwj#%f+w<)_`Kp^(+XfiBJeCD!<9A%F07E=9&%; z;}C^^9_)MnKKGoaju9HAd;PjbY@kprz^0t}p)%#}UC=)H`SZUDTNSQcA$24hS1bC= z&SoT(u&YjWrg}?!NYWbcoS2|*+fN@+)U0!!k6uesR9M*J%q<-q*U4s8iG`_+OXr_k zTAf=Imxql%LrW)BkhH%Zs9-=^pQBV=|1HS8%m?o15Su}2 zDz_cMsB>j$Kg?JSFD(2Vsk?|l>joZLs72pmgpU!UISAA1;)BG+L_}WE!JOj{uqu(R z3t9z*!X_2Z<1d)q*W`yBJ6r}#$M9FIYsQwEo1<&@jEb>_R6q+N_nq`v+h2X(UFN!* zoM3Dr#K7Y#&f>AxlMgmXXl9<8!J<8X&L9k zOF=XYi~peJ1bdZf)f`BB&TBn3}FDDPR6qk!H#avWqN0eeU*7_iayi7$&)?nCbH6ty zUEt04iZYM8<7H<|Ac+ZAf#6RQ5A`9PtbY;l-q8Oj78c}hmt5(~MW?m?Cj9MN=z#r4 z+@XU$rzdL$ihJJ=O-V`ROipy`Sab97DRSS^6e1gb^*7;pqvjy?O6BGWy0+u4F9Yj? zeepOZ&LmxdOoISe5yI9!a0TKCAt5P`A4_qLPky5sHA9*xuDI{_r{l@|YVTqHe`I|H zSe4thHi`kFgeXW02uOFw5|Azd0cn(Or5n*DAyOjUEiEmrbazODAl=>k1NS-ioO}QE z?8mKp%Ua+1zB$JnCYJzx=-xtMn(#{{#+uTe_v?esu&(E@hpt{@PdP5;Fmnq zEH!rC-h4>NRj_{Fj_0zR%hmKDM9?Zi0sYAzNLPB3W3j(c|4FvjRfLI3Uw^;<$B&os zTTkyHoXTB+Yft~acj9?rku3~L*gx7Sv$5TQ-5a_59h0QEG4?$Y*|0pggGTP=vEG+9 z20Lqe+s5n3=DPNHp`j+wo!y_lgoO0=n=7Dg?N&9I7~I#C&P ze$M~>`}ett%I}>qK?2U($sX)E=svhV|1?1gaPR*8o7X>p4>_a>+!2oj7#>cmzkZ$i zQ0BND0gW2_@c4Rll|Yi_qtkIRPrLjn;s)5> z6opF2VC&jA3nQb)#8L{~8pS4|E#FGa@l8xK`%R4($PYFU=vWIbPFj1L-?P%wI~Eq$ z>KDW64pw<)y?Uf?N(aM+)@Sa&ly$jlYU={PpV}%B-$qi+E$M zDX+a982FT{8Psbkgm7&9NJ4=cFIdSyPA-gwjv2`C`0*p;Cqm9(@qevp6qE*Xc+t?D z%mx)fn({2NA9U|+qBqN26Ck7H5#QqV%E3H{7&|UKY*Jw<<9YA z*sC{vCSCV)jIvHlLdM3+nd*w#TClU<>jK6-IE_RPl!=fxwpv~)(XIMrU+>*GNKIRH ztD|_6PEuMG_Yv~((@xwO0b3+a@J+! zI^A}thZ+r?{z+aa;06l{<{lo-@k!LU;+Gk=hhUMtSlol~XlQD>zpP@{&kViM;H7Z~ zj=Wo?wkRenwcy}sk6^B@s`@4OzWq-{c{w=L+@XSfb=zl%mS$n%>?9BM#%WIOgz~4E zi~A9-XMfsvLaDW>uQ6Ump~RO0t_}~`ch-DyTu0=Q?qXt%P?o|;45zc@7~Oe<`k(oE zLjwbIldqXyi*rq7U%phdv8jNWQr_Ot#l^Y8f3^9fwb7L#tj>gom>4Ihk^4=^HXH|JVc zii~*a>Dv5RV|x&;peN+C(E%2L5Yt$}%If#Gm+KZ(-z-K{g%Ae=nYkrcm3B*AU2&e* zZ^SD;3pURhIEN{UOAw?;g#;#c|Fwvz@$TDm(zW$Be(3*Jbbm!w_-**R=2_@}R}go7 z<~0uz8&q$lxR;XaiCrvhhYd*RHx{FnGqC186BPTTum%?wnNADYiSwAI3m;vq)fE5 ztqySe{`J~qR!H!!tO&HRCuww`uy5~}gXQ3d5Mo#@DJ}Jm*EwmDg{-m04vP7sqYrN9 z5}cf28s3+9#E-W+a*@NepbU?~-rhFkxb=@vBhlmaJY3nEH*cKm);)d?&@yXGEX)mf{(MJkLGw4|{Ch#k`y0BIZbuBIMPD_=#Y;o`PtAu< z8;Erk6$?!J$sG@H17aahb6dK7+YXI9Z$fPtf`se z7XgaMe_lNlTGcN3t_NKt{Df`o?FDiEF9OL9zJ!O{*xfs@@M#W8prKCB)e+1O*}01H zmYIZcQ$|vsjQC9PdKYdh%JP&?_1U{kCx~gJo@)tihl;>$<3f<$ep-2ES8Hj z#9s3dL*)P+nhRq723nM2EBIPISQkyNu7ao6@XdcFLR8R~ad(e_z$V?+XeFM|Eth0xU7Wh_t@H zrW-4F^ByUpaT{{7wbi$^ofVgX_nap4_O5{ERC3!lFpvhyuSkxUO34)tYm#Wrdvt_@ z8-L&K85To?$Q6!<0REVnwOL`h2_-bof*tJt|IBY9DkW=S^q$2z%QfAgooI&sr6`-% zSvdxvkj*uGk{~pMxDe3Q(aA#(y=!PVs0c1|ir;KGO3llBjgwNb%i3=IwK1i(UW zwl$OniT$6I@%OL&{pBq+czqk+y`un+PU%OBg>8ba*zy9WEu*bwW20?}Plx+IQRVfi zVd-vSp`ykik)wQv1O!WRu{_1->{;H$#b3fynm0GOSJVG)SQN&4w@wqoeEs|YAD#Tk z%)QVd+F`#rjz7qArxPh3_o9ZWwxr}JQ(4D)s;2ClUb*5w zA6(4yc=Np~1yr6O0M^uuX(Vx%DqajvX3+-s4#&n)Qj0=%{qlgXE^C3p$pUp|!SEhm_iXT*II(?=9-X{?O7()2&q z@%ML6aAEldeRAV|^ZS{Iq)g6w%G@7AbaK=iIp7RP%Y*Za-br8zpEOpmmB5zk?GDdFj7e8*Z{Pl!8lr zJFIC$6a}Scm4L|6H%K9GKX0kOd4EZtk(qgTPD-VIbaZ?wq22*c?vdb`y|Z)X=g(Z1 zY4sBlfZCp^dXvKK>?ApVdNWs8QBl#%EGv^X#(fRU-~brbo)Zpp{paKV{?6nK?&l|> zgTZ96JXnYd;ORZst=d=}SIUO-bK3uvULr2eR%yCxjOd9_+vw=&Xvv9`l&Oo$+T}f1 zTprzB-eVk7zr28V?>rZu#zEc_G=5r&ia*+t zVNoZBIUjSJE+kw)1FAt-UEku`J?&S2HI0u8lor7cV*4j0F_F*J`#h(l6r6E_BQ1L+ zXl0mreK=n|wmc&{J1sL44`<6^;PK5;+rOLSZTPk8e=n%Y0SHvfvG7J>sBT=LZ7LO2 zMebPNoQ9|TDqu^&DMqx2nLi3 zzk)Y6MI=Q;K1!aRojeus&CI+a<9xY_PtVT)?@V~EGP3&OpKD{p$P2xdD+~tBs3-z| z^lLW(POz}FRPXpF`uyh$5RQjXMwo29_4XcxRm)gi5rnnjk@az82E0G1+TcR0?mTYbf{IcI`*s;g?#S(ECc=s z00)HNP2JX(V!&SU$r2duCU98}H2PNpKl7q3n-Bn>yCOPOCf~{cnS|HjU3dV+PB0e; zik?-x!w*R0V_I7K_3@}i5LNxJSK^h%Ch9z`^4ZyD1%SGX-#nwAULo3@5nawwv4zr? z@CCeup5E7p;rG2MH#znAYr4hEuTNF^Wq$pdC&}nF_2?%hNm}k^EFx?RsO^J&cdjQ!JJjOdY zU%xv2X^TS!zpOtlh-`}H++o(;C*ifx^B2-4MTw>n6`cS)JVejV&aFAno5ApT3aKDN zeVtBG+;ww@)x-8?nrA%8i4UhL9q|DZfNliAU%uqnf-s*Hqrj@5UB(n?Cuz(5EYOu*hWs59-jx2!FMD6`ZQo4Jbc zdcyMNcVTL3ahgnqLV}QL#|Nvid63J;*e;aP)6#w%-#c|4aGbKFKmu@EmUJuo#pVBm z1q>mvfq9ePeRQmurf2xTWbL{&qlS{wC=y*p>|Jw$k48>x-&f@ zuF%udcK~$&$RjP&Zt;uP|8QIdPxsZU< z0e4kun)+B&f{?rPU(!+&{lC6^@jY-Pi?$%~w& znehCeY1iY&kI^okJOh{&UeVD*>2gFWDub9LyK{3-nOkqen?Cc0-IL%s8TaK&UUHv9 zU+RoSM*rq54F9bCoVVi8gUw|@{+Y?*N^voRoE#@$F~aXHfFVF5hnjq{=Iom>v|)G8 zArqKJ`q(;GT?14C{s`m8yG5W^!rq?y?lC7b6BC>Z^}k+NA8vY#jz;fJLLz&9{?l%B z_(0KO72+|Jx}fmHVV3$C$1e=PD?A@LxjjZkIWSV8k(s(WX))5#t&f#SbjOFwvOwJ2 zHMJIL`TjF+CrbR(Kj?0Wzae03>c_EWr1`8P}oNT zu|y;!`DufB0AhRR(p}MuNJ_%IJn-*fU?>y%`O8ov9}qd}@pCFxyQud%mNS=6s{>8a z;MWO246MKe0p~Yo$L|3$efu`J$k-bEdTsnwf5zHy3jS)|t4Slmc56Wf`!ouo) z_fABl1x_rms{?v?_pVY^6)9YGS`uFGxQWSEs6x3pcI^eZQt~$_A%LYwV3`HW657Lv zBhL#G5l2$8gom1AR-_ap!Kn+_!IsN-x5s$-{OFc<}91rg8LhH18GQ_!Ui49PN*D>bV|HA9b z1Esm3T5T(}q-S7|{neE=Gf{E>8^Aai_~V?MV+C>T5y`2k1~YYXI5=9=zgJF74%U?w z;$uTYLZl=md7b+p@S5}_f`j{{?@Cfq!`PVTwn0XMM|8aa9X0g~;M#Lrcag?5)>F{3 zX}(W-U^rjDE1_0yRw2I1X?yOvWjc+K*VNvM$8i2h@6zO<2 zHvk?5kx| zm0i()It*&8COlj!1d6U)9IqVDcgjR|LXN-)M?qp@%fwm3$$=jSv@Z47oW3sN3t0GP zDyt3(s2WNwcOa%1WZ^82U-_z#u`@mZmu4h#Ehpla;fTJY#J2*^$MrC@w^dq*-R z+=2!YvDnEO!yfY;Z=gvm5}T5;T6HR6q|xxZzl>mhO@YUm7n3$0B&eLP9##+AYl=N^zLSzzld9-T+ z1{c)4GMrDQi4K?{U?(tNqx9~7#axqKsAnDk7I*h9o7H$E0egCTdppKdrD6L%>dpO+ z*Rox<=a!(Uf!MnbA3jh~EvjB7iS|zWtAk#s3vj&V<>n^k=euvu;gzzR0i|-kImi|8 z%;buE+UqyGdzWkAs|1qp^FVCd{!@vEN6p5@))5IZjrIt4ON)xzq!uUha;xzDkiqa@ zXk=e=u(LlxLX3kxwO$ToF}$`_eo{Uivgad3+`ufXjS0e;yt-O3GGeb?@CrQjG^TH~ zgGfOL15tcSnS>>Ac=~54L=5XGOt%XmR*H9(CcWwH5snxKTiJ18VIzQ^$HyNum^L^b zZl>YVFtssUt{#Vr10d%RmPI!Xvjx!4rOu}%rO?4B+Ux=y)shm8yf z3wN8APk*76f3=RXOPsY)dvP|HZ8FMdv8ksCAOl#S{J&hkT5JOFF)S!3=w&bY8*#M@d@$rYKx`i!Y%Ddaz~Qcoa~Fv z7tPN}F@rZn#23E(%xFAcOyQ6#bjmWIr1<{xXUN86oJLW{Xn8_9mpXNVw@ zSy{kmh@^01z#&U;TZ^7r85X#HofiWm)C<*enW1NI3q3X051kxFb{U%R?^aV~3iHi%U^KAzNQU6ew>( z!VBWYYG>S?=_?WcLq0VVpQ$#U%UD;06!| z%%m>-#`5O%BI7BeXlz$K+;9&M1%#WVijopcfPMY?8>j=4#2f)W9nL$dcEyhf-I0Pz zg(DewDBueQ&vyq+f#-oA1SI@}k1gaMH!zE#l(b))h-q{tSKj+ILttMTDZXL^1Q$9K z;DuC=9s%>3HN0-g1|SxA13_l1Pyb()t&j(W>fKK;d;D}g&(e&$Nnttn_V$)p9sL@c#e!}X0Qxu{ z)Iw{~{(_X3IyzUz$~p2NfrC`>PrGqJTua1{0$<0ik;CI#bqg;Q^wI2t(+()}6v^3u|_j)*sZ+Q^KIykRdD|LC5q zIcW(&MbLLcU1K?-s6Kr#BYG=$ zy{KTR&~`!EMQ9fkW_2Q)gi{qi^;YhbVGu2p1|Ct zi1YR&7VQLsVDtD$5IE6gSn5(zUhM&CF($nfYJZbMXkl6k>&s>P*!#{+Q_wv&i>KcS zOi4N0UCIV+mO|Y2UFTlQ$*P7{QxtLopxugJ`~guH(4`6q;g9q=p}-z^vpaO)G=I7thlXC&o*a@kVu1>?hzi>b*V`w7v1 z>FpI%7xW10#s;^piKhY~{f5)`~vYEl`1^HN>PfKa4gYRz=r{~D)>iW=L zG7^*Dx1Kp2BJP_PbHJP!QrCm?eit=i;dne^Ql8f{K4eBig>Cjim*D~8>UcSB!@@#S zBNYbz;Y97l?f`9mydWdMk*(LD!e`dnR8&?@m&1o0cyzQNxU2Wx!3KN=nq^G-r1wck z6u8p?SOEsEHxUkz<30bZyvCpJ@f8yGsgXGvoN9AycZ$FD^z}VgQ)}a0Q&E4(o2^>o|=bb)xO@Tzx3$=D=d)IFXjxSSBeI{;)=_fH}M9+pN ztJP!i*-}XPt0EcGdn*V~5=%sYPP1TTWkq7ch?>&7XqcGP$X{dJ{VOQ{wdFZP;gAR6 z6cSrh6jgI8~UO*|oVzEE5DQi!Hk1gQow zykPkduSkNs^Rp|D$ej;Teggc6r|bsNzp6YsQ)u$@;i)@?YP^UHBZY z#~RGfS316-a8HX4f~84MM+Y&AmuJ_AKf)*p#DN^UobK!flj#%`-*Irpp#nbHFTq52 z<^??m$ZbMAzJUbl?BpP)Xo_~tGA%t_z`$3~@;1@^`=V$gu$6Ny)kaUuA;5sZWY^su zNXp{YtPda1<7SLG4Rf36fV-HgxUXkqq-Q;)t)bD@O!F87k=@<)j)+y~ucJ_k-(DPSmwt#X;CVhjS=|iUFkI4+ zf|QxL)_TvQKi#$qRwJVh_w!0{sk@4F`_Czknxz?y2*S2m>La-< zX&j?I+`4wvdZTt}@9HBeDt~_&JmzyjTG{}vrM13B23p#)#a?;{uQCxR{#7_sQi@)om-Ct?_e!ZQ>QyD zCU$=E^PPqRE=nGNj-if@hxGIdGxa^bXjT{JVcD-KjEqL`SA1Zl@+bP_4EPqEPGW^ z5oXf|ajr2!d18j3<6`-0;Y|RO`jk; zFRpv+etGk<*nonL&ZsNaGcG_InkmvOq8~s;zIHGbw0Ts{#MExoMT`I~J%F_r-KmA5 zvt*vJW-tzNQx*mvMqLn0R663d3QJ3ywcX1Ac@^Z?#>NZ9<{8VgxKFzs$vD229rC}0 zu+`}R=uLq3{FNU}0F;6_#twXX&4YW*37+vlrLmOmWQk|Ui__6bcPB_B{RqN__*P&( zETv&>p|4NnHVj3vYJNODIXUagx@Ux$qgbl39vMwdBpw&;rc*V7CQFA<^gxZj{_9Ou zVj|0a_^TtTQ%o_uU?j;l2~MuK{bk=2NN8l6j zA|>S~=`{r>;o{F98@0@aW@%bl-po3y8YPt*AkHEabn#e_hso3%Tf5`+Zh`C#Zu{mV zo}d8}rC)(YEy6^!wQfg&;Tk|qodUk((t(SIC)Q8Ol|z<$mO?gFXWk15J${5CG8n#s z_4r}+>v%}@Y2;6#D~Z~gx69G?gmvv&hTv@oO5QEimv~+;6c99&%FaEP5DKt4e2my= zT-HJ&L8uqU=D4=%UVu4M(PZ@J!bnf)>=U>L-yJsyHQq?09nHsVm6snC7s|s~jE)`_ z@B*JHR$BLviK!me$dU{tu%pN>gCj_aqr-5boM%H~Qt^SQ3a99o~edVWCF z9!N5#XK5*q(fWU+;Q?77K{bh?oF@~cjODU5-|XPG`zl}@H$=dd2v6RH&!*bkoZpeF zw3s7J<+b~XhX2uH!#|#!j2&HFNg3s!nEGh(BAS#O=`j7q!2zTuOaZZce>efvuXH5q zjoFw|!#f1wmTw2LOG|WCw>tj$^DO7|NaeD#QyyUZi}R<4b%WB41N_TTS!mi;R)!sv z_@B`0nS6}_S_MPPbn8=;`cCzbLJ(;N@yQ^t+yvhQ@K_MtZL)CXGl3FPc8zL0^+M$S+09G@W?VPNM*R=?`j$ z#MjSGBwJ%b;%v8{7_e#pP4`x?Si(*}U7W9KzKHD8-u;P+8Q|nBsJEV$3liI1>^e}9 zmXcQ6)4#3p>vci2wMYgr4K&kyOHLMXq6K7a==lUlXF%)kz_&BysjE>kI@P};>mjJ>r?j+RhN4yFAC?j)y*Z*b7 z0qEs`YX<@Jff3;<7&V+@?(Te$9n|;9Piy3eOHcDFDYnY91zpk;TW^g0C+$tMThP(I z;lZ!R|Ki8Z&D&M~t)zof2qo7$BxI}JM;IAAFmMmB7wQ_b!61J;M&|>jSk-tiz909(#US5tO;!sGnoCRluo+I-rFxIM6M;qO^R4$tu^S|#EFh%_6PRq+PGcx)yOZA9)NSjNY21K&!>ojQOZ{DQ){>Fk+QzjgL2Iv=wklPZ#Vz3s0 zZ78mvdwZoCZWl1f{MPXp``N*Ef$1(2?w~RnlDYt`t6A1h4b)N@i3+X0`O0*RyW31tasIGy50v1I=vXu zdj$sv!#tne#oqV1|Cp;Tmp@2p1NPVG^KZm`{!FJe4O)vzgVqBeBS2qh23@wY&WfsH zV$5Is+5zjD<3=*LkyOg8CSdw=rQOT5yI$}HJqEC$0ctVb(sAN(1SJ5hO(?4pC&bca z3E;HNhb0`zg`=AY92OwJn3&a#4=@56yYe*ib;3^$5)iKY)CmdgGfzJ{t5%078pc%a z?pm;#U(F78f}X1*^zN=o+Bp|H|ZWl@on_ZG~0 z(k+3Ib+}JSL7^Lj+_=W|Sy^<Py=A94J$S_rV$cmL2?SYgvu1%;K1{S*g>GpDjgG&&*Whz`oS4N#XaRw z8Lui!`?!UOU}+xAK0)juTqc8et=cr!P(spkI5Q2y%Ex~l?F{$h<%7oW#*GSe^w#1h zzO9=@Ln2^38?@hrH#Hwx1ywtswXOg{H>F3Ly#@xuY`$X)pk*8pARiufEkD0>zctI~ zWv!lLFy^*ZWDX46-Xd#!9x^xpg(jdEZaV=xez?OBhQJ#f`eDN?*m$b90LwCKe@@Ct zzKg~s%!g4kJb`+nmB{{jl^bZ}oWZl}f+Wg5HlE+HZG}|v;7CUM&uD$!fkJZmtk!2EEZNGvC zRG5>?0P~^KsQ7s3`Z3VGvBW*a1No-kkd6%xjtbEq zRzQSh_%(+fQKl4j1v_ZvgahuVu0B#~Nm}f>10|d1k)cpOy;3Z`jokA1jF^V38o#($ z8spzu<`vX3c%PbQp$LlvEpyltz(xZC0yY!a{;QNp^oUe`XkaLo&k3|ZPjE1}Wu2M> zwV|Lfu6V%$r56_Ixa0Y$7|iw+ku)%vQ$UFE@nNbLo4gz>hqrlx(Kz!I5Hv_#SOr@jydcL$GgXx>nWy8;umFIVC1qJe;)xo#$yUeCbZT)Iyyi4i;5t>4xiVTJ#|02Qr z7|;x`F3W^}XRTkK^3+(!iR9wR*V(eLq}PoEK3PCV1cK_$f?@|nv`%+C9{90AQKC~j zudY7mw2!lM`>sew$8CuK8)!XYBqAa$F75yx2M&+9mOqH|7up-L9i4IjBY`)hPk9EY z=B{z7c}!5igkx6PwK~H2vOD1XR#i${TSZYZK9k&Z9z@<>v$Jp9l<X5N{7 zEgziR_<{{hgI{XkgK%iKH8jqoaugjmoF$B<#5_1XrzFP)Lixeeh0e2QUlSkJI`4dj z^97ho1H(VJ$%GV~UI-3}h@}CI;xGQ`FkELXIs7U@q~&1BQ_yN$4;0wZ(v1zm=23)m zMd{zZ`O5p+NoJGm`20*x{@txHetHxdFBC9sqaQ?E&OmGptG`9Edwd+(92)m5iU4>SnqSC8#s!k;lnX<3Pqil0C0m+IZ#E<^^`)e&-69_D61R^)N+3~gX3 z!45hH4nK18#!kz@e_%TJI899_=e26vgCkS<2Y~igqwzvQAhluG`*!hTqC9bb!e~pymH#7vGM4ZjZ zQ$iBJQ3%!rLg(#AvEofZx(ro|b8~hsw&$l)CXXIY69ia{+WCqzX?>TYy!8Hsup3+T zv|K`~EdZp8^^FxTVFw(Z*qRvhCd+Yv-SeZkQP-)uL3>Zk`u?IN0p7ggs`JEK<{w8xz3*aRjg~r{cgfBg4V-XkJmx_gC9EoOLj=EL${r!HE z)bHPs*mVn@soWFes=ZhKUa-}K5FyNEVhZ?PnUEObkMC|Wx7gb@l`)(M`W z{9A-T;9*Nq(`0N@2%59MVH%0yR;L6dbM zAT}p8QZUOC07^XiyTAZsgp}KQrs2&0&MYlewy>bS1J7gt7XLyARGA&DISSI9s~!4_}#m73VMVr zdKH_P#3Urlg_W07Kns|{Oy>^YC=l{`j4K;B3VNR7{k4qN ziejX#jf}RJ-umH2^tG%EhiMu?zQ$2E^R%Z0R-%~0lCI~34CN&)C(fi@AxfF8x^~x@ zTp_AZWX{y)^;b84T(oPu9WpLOo)>LJ@(A~~jF2SJ1z!QV4%b4kY!i;uUJwVIZZ*?} z2pRw{`_DVWjWU^oPCpct96JrYYRVgvVZ%syh3;fjEp5+xBW#F^)0+WMa;iOw0_?4~ zrO{uAqwr<@6~e8(J9nivdQ;jC4Ah3nOdkPMBEGtsu39O>zQHcbhB*JOY;ejgn@nq~Rmk#BZ$Ru}M2(=&-Yx+-etcAGkbm~-bW&y}oB)xw z>Wi&p82BEbsXg7A1>v|O4u$Znv-9<+C^wgv`aneI*E*cd1|hsLNu)O*Y<+V*hzG75 z>=cnCPA$PBbqR97_U)z@?Hq8_xiK)Q7k&_TbANAQFjlHhQMu9@I&5mt9-cy>aBHWa zrE1CjY)^rsF4hkcZvn#A_UzRUBGxd`M%tQ<>}HAtb81LrRI0Z0%-FR3NTyT?I$9DFr`oC~1+d zcI~BlVPU;7s5fLYP$LhLw`S=R+CWOX3+2&9%6FJUGCn&K8Fa-HaGH?^u$+8raaEL(`ZF^GzWybY`TGZZ z!(nGsA|e!~27AjB95zRV`7H~F8?|IfA<+JSQ2qPs_bnbOd)2-psvWFYXHIMV8QY<8 z&dkwVmQ(>?7=0(sWx?}=vcrd#QRE?Vb<|#DuG&{Bhy^+-lw~9FXV(0D;B@+0K!_-YC#c_KMhJqJXz@ty zYx5JWt)@Z&J+t*yRc+nO0A<5$H!x#`t=X(UVPb}jWi9(GfnS<~&33+4XNU`D1pJFus^zSYy3z0u!%-t@jcME-0+VSnBt=Q+6n5|t2`KRw-a>yORtiy3b;8jL9crqWEu1GO<)(-sVLr_1(ARS0CL7%#Ku-S>h`G52b&)DaQt7N z@+D(BOTy|(AV%gzH1m~xbq4+)?6s)o9pSB0I~-WMnhwM zeS#(m%SEIGv@L)}oPw1S6qYtN$Ft4Mi?rKdbR;BljAS#scII6P7P8|%*qNB z>a!oS?&AJ+t)cY($B^{lTOB+)$9$rek(l@zj$fS`HyUg-X&D)J_xEOI7gu|12nd(^ zUS+^>*N`*uDkM&ud;Zsr^AtZ^pFZnrDkpK^8tthq>562vf;_R9DbImIMWs$oJ?zW9 z>~sBF*2@d6q4>p2R_)Lmi$|)Qr3Re@|gA~w3A5lJWJFKkO(4udK3Cm_sP41?3QBZrH5o+Z|^!l zUD-$kPQP1Z`fI3Ijn7$87s=ulap|gdvmjMoWX9R`&7%wHs#m$_T^35(av3XSoT{nb zzKK8oEQ)j_5R4ztq{y^$Ih2NZ(Q62aE~=Jynx5_{yHjuGe*DD~8a%i>uLBzKUMIKWO!Yib@RFi@)OS#!LGi3uzGWJQ=y2^8PO` zeK`dsC5DDemt{S?dKwm&p26xy2G?F-f)o@Q3FXC%y)ZYo)u;lzCK~ij_9F`3vDTjveI9@@M z4p1Ic`-?*{CUMzK-Nc~p5se0YqgI;D5W~Xn-=0jD_@Jn9`)P1`S{hTK3G^T#e94qD znXjwh!uL=x#UC4}JKf{#3@dqW*$|Y)gq8^^J!{Nv`y&- ze6lk|^4e#b56g3imJTp&gyQIh?R2ynoeO>s`V@JEE?&`aqzZe_m)Ii4jJ(OW9AP z2iUQ67~MkKOggzyqzHtGSkbL0FYV@llh5Z|9lJtc+A8?|nP4wLogEJ^UFm1B#mJY^ zV#_fRGxnq7Qcjkhw3E{380_O77w1>(WYvv$PNBEKbJdTLf=_jIBbdT@Ejl|snPQxE zsuVW%^=X+UyyTKz=mK&@{4*koUAsT@HaQ$YlXjgfsN_Kpdbts`Z!ueCHEYgYE{AU7 z#upTL4XlqAXI2js)aMWwrLa`eD-WjXOJE5KTDGPXT2C=qS#_e3i;Jst8}=1_jMf-b zxIH?mVOP*WYGq}`VE=9G*QSYob@g7egDF`!`MS<0nmgSFIKUuLSz-%9i5 z=IzDNr1wN50y<_9MqI>#(UJX$fq`6WEdv8D%sP2^M|#8Y7-Q4kZS7m7K&SA>wW^1jET7|$g3_qiJ~&Ivif95>wo=n zI^MMgs6*Ytf`PGLqAb6ZD`I3EI+B)_4uw+7El$;Lyt|HA`142X>G3FwDscbbV;JLJ2x zMxy%BibC13Is%9ZBvI2HabV7Z627ug?JEZxY619H-fYLH{yxQgM}JWUnOuin*FNy{ zfcY5@g+)gbYWsSN56)V3l>3$k#za1ljtgB|%eE4T=E|)Qm(k+WWHlGp)s?VOX3G$s z*TceGm)W_!{m26jDz`3qlj2qWxOG$4v0nfp7dlp89Z4?o~d^Q zHM=C~`R;a`mS&VKj;&ZxNiH7^`w6OTt6ttJ3BSwYvYAZ0f8=JQYdoo-+fpZs?JTRw zvx85c7+T|is9+YOz$r44l?yPD2nsZgq)wXwoQ(3BnrI*c7xC5s-hkpLJkyw{ePxH9sC+uv;lXR{CeN@cQ2S**2L^@@aAzJ2cbrT; z)F=zDQ7{T*_G4Gjbg}IcxYIiRoMpw!qwMpld0*|+U@O!)W_ETYxVKrxUSu?qe28X6k5j%eW;4V$_Wxh(m1$EitJ;%dx=-S)Q1w}<}`wZmt^p2g;Bp7%mY~0p&LdzUi z;5w^3;;3ECxZPwq_vCGDwihwxCqH9eqrMl8Bl0v^Iz5Ee>116SZ)d9Lv#t-K;PFZ` z3*|Ld5*(35$0yVx1PDkV#h~ciK`h&uh*iix+6Y}~%~T#XDSeTx+Vxp*vihW@JD&tM z$sk>oGji)Na!}+VV&ms~i@sG(s8UaR;>*?IFm zS(dpP*?jm0#K#`y-1KyDFR$~C9?2_LF0yH1ZVe$Rsr|9t;p&Kf)P?V3TAcHpZo`WD zb|v26`1?x-IX~aKLQ7;pA)%RJ-3uX?;_GK^;%bEu`vx+9DzW#mPMn`{R~akR!j3$* zHeMOhHy?6i=8by6kbdDmmiz&C;z}S%<Td=-BDg-xdnwN z3?sPUH#7N4Mm!#Yd2s+@6=?oF5E*&EYHCVQWSpPmy77gUGK*GNU2e}v9dpi1a&40= z$Bt3P&-BZszpmkV!yuL&O3z#OleIFqi(_Th#%TwJ?cv%LcC-Qlv0;-*Gwq%3Z5gCMyqal%ifiNqaL>#~>;hPprGVV2GpQE_;jp zdwE$h!S%9x0`2|#kN9IMjXFnRj4;822hiPIZF>Typ1rJp2a^>w@tJj?ks>Pj+~HP= z?B~|`PESxreT*`n?^ptH%ZZ*N4i0w&v#u1Hdby2rr32&bJMGIyJC`6j2g8RCjc3R1 z{pCdqzZ;da6OR2bOqHRD|@&)7Q?LvQsFWyL6@C*_w>fjPWz!8)?L#HU*E_m zb~S8~u7s(&)DO5KBBJv5Li*dYqI^1?EuK&D7Vr?ojL3A)yvaNWCs)B6JbUtIICx^bF{$jPlpJ1Y7Zf z?zN|d{GHq0)5`dSg`IF@8^Ih=OrhnuC zrK_Z@3`Nzig4x5F`h}=4(VM1(h;y0w)(x1A8ON`%I^h~E#3rwN)7@=cMC6$DNC03Q zC`uAIOc$YE5W-syXY>KA`t|zwJeE)=^DHJdp2Oni42JBZYL_E$m9TN{O}xFLjn9CV z`={-F^w!Y=nZPfu*V9&*68>v1mU|~ESGIR_4;Bl&*PdiqOt{#!hf{il}C{_n(k(fV)*0#&`$i4XSgK!V`~PF=Dxj*`y6!arQ4m286c9u} zDJ7&sl#*1srMpWSNd*y*Zjh3eF6nNNmhSHEe_i8!{~3%op4`i+z4zKH=9)9K8CdNI z2nf<;O}H%=?$MOs60kw-QI3+@_v1&<`t97BWe8JqNjqfebC_vr5?~B<+M1cvXt->~ z5_NFkE}tjUy*!bxm%#6b@nuue-3y6>Xn-D%clJfl)ehAt`0vustrv$Zm5%Y|?L{%7Rmp7Qb~0J=?1s&{ic?ucLt5ff+TB-D*lWG0Rv z0Rp!EoM~v2s__Wad;SAVbC-EpR+i{oM>J1hPYkCp+?2S41W%=ts#Koe$NDLFn4c}H zjeaI^Zh1|`yXiyD3zv8JKio9mm>|&3f_gJFaU|8Q8jTdYd?e%IdO!BcYGoluvsnse z=g7#(74&CaG#!TRk||k``}=s)e7T=1we&L-!VShNpiwF0{3P$Wes}`^Zsb!9#@JX6 z=n#!CWdZbmY9^?-v9Y<(2KG!5zUbm}O0|Nu??d{xVQ!UWifN@W*ebN-l>BqI0mECST$Lp0)*a3Y$ z5y5w-1F9%&HhcFNzp<~{^?oD%m2U>hWB_}nru{75NWQUc0ARC`yUc5#NMH|au!L;I zfJ6a0DW5elFgWLOHIYF*?XAz;_V@~MZO0Ojv* zFP%=bWwJaVRSy@Gnp>}w3qjKBGua*OEcB!_Ud61S8n6HAN=*5bD|S3plA_Sg&)a)x zFz10{`R}$qfL%E}B(F#g9>44=E17)qB|N+*$p?>6W4O2X$^AITK=MK^E@R6ny&m3V zQS^YQXxztOa$VTiE#{~lv2c2`BbpmNq1kRsJbwj^^mv2$deQ-KDe=~CNZgBq3Ud!&tr38!X&*n%DVXh^s#ca`=?GAkW^b-!fR=b~x@-ze-HZ$+ zqRybyi;q>GJ^O)~rRkY&5NI^)gmq20=O=wZJ|m1$*sJMt)rU?^2b*r-)tH-aft%FU zmN<~+>Df^C@dbt0y;rgrembwPiO8e_r)t3W8V0}3&xju1#sykI#KLbyg@nkfs2J<% zHAs10&=px(p{AmuLPr-awOZymm#rjWU}7>i{r>rrLoX%v3C_C4u2?~SF(4t?91a{_ zz7z?i)qqN9*kyCxrqy9gb&c4PGUk+zjH9Ji#SVvJA|gtrrqbcL<@U0rrOyInU-x6` z4;Qj#zAn`3sa7r%yTu!(X~^4D?KXe$QW*gETDBhP>J3$%v2DPbAS=7WQS9|2_n1t% z95TQ9iBi*F`6R=9Mqz!W%NW7FaDH|i(c=Q;`*M?Uy=Gk50dhbuG@n3;1CO!VWbx;B zcXwHlso0>ga`w@R(}|PANa)VhXlM&|pkimId(x%4rB4ekiPmIIms)K_VB1)z*|Kcj z`IGkmBLqpYH}ntk`OtL~9CBspxKlg1wA)ufi~sZW zk)rjTvGVi1rCFP~HmhG_35_T*)@#4|yvPrfi%ku77UE1Q2@e;#ed_84<~#VJ*zrhM zXDb|208QcwqXiy9iio^|l2WeO^qKG7ePJF`qPW6VCU|2_VWSk#1Yt@(5JbRkT?KRDVcv0~lxn$r!=-S&R41?Vw@C)_ zuS60o84x@Vl3T2yeUS|38UsB&bdGC=$($ic5+o(d%gf~#|J6ZfbQ?a+#>Bkf_d5$X z(^FSpSX*O*)iO6fi9tBxe6$$(I^l@K2e@(KVxl+>*C7R~cUS>HN&Vy*^Ahfpjnm^* z=wT-f5X^nZRgret>;3!pKc(tWLUYU3+ns==4(b{KeUFgic z-QFcJ-rSrOlY6Y$IIGXbA_o{hrzgZb05lvN>}qcA_?cT;@JhDhIQBJvX(`(mG=E~U zRw&nhg%fM*=y1M#pM4)x8&bVKD z9H`NJRCE^@zc4Z~^7~$6r2o18vtDv3Q?G~L@lXr%h>er86`aj#*RFI~n=WdJX8lr& zd9j6`^}^<30O?VPwccNw#iqdM?mtr%6*DmKp{rbZYB9GUe$oUfi^}t}gt9WKcGSnT zwBUpf7p{f^U!ksn0dz}p+K1eqPFWZ&!{)qp2M`RcA)>JiI!e3G`+W-vJZ55n1BS!S zGFo$ODDL@avN&cyl+#l0+ho`L84s%}mn;zyRfRaimB9Z zoSK%Det)7adO6(O3_2Z#&gZl{yY)Vy(9+C<%Ib9TEqTtF=m(3_N!_@!$pd%LUM{!a zH+J`j_FR5}@w*)FBme;FUh@U0%VW443lkIFZ{|9mt5{fYzNn>t#)V`hbGdaBm3E}E z5++*o(o$@M(^bTV{Ny$$7JWCGs2aWZIplgEReG7t!0db_paAE7DR~2r3+U=>e8Nu< z@Lg)Orlv>3^o!uM->q;=k6^OUWXENNz5FgwC-^x+-Yfavzf&?7O=#eEdwB3IE)GGI zd~{Tr&qs}$l3daAb1DLIV`7kC2#t;gE)X3W-EcQQ=lHz?Vec#cy^tO@|HFc(ehFS0*EDc71(!&&U%{*?u}lIWPAC z&61xlf+67B$Y6gy3K3CIP!TOH#yt!HN@`dxwN*T_xn1En0fIYA(h)H+pL=DF$#d4%G8Uqt(quam@~Dlxk&Hz;6xJz#UND>U|+!O@v!ws2s(b9_GyL96Y{7S7%1qn ztH7EK4oK3n?W7L+H&n#9nH? zb?RnJeUSzn{sv{W=pIS=KMQ&(PUSx8rAlZ~kKV(|5g~iLy|1bi$pn59@$SwdA^6uTcn)}Eg77j|El@$&RjZ3^uxmqB}Q4ds8 zq;%OXx0N?3u5dqf{ptH4$OP$_6S=_&JWw+9XZm!x*?kGh<&Tg`% z9-20Gm(Tqp%sZlnJUy?vOSRC!UW9P*q~+u+19F1q=8#n$_{EGkG=a3W9W(`OLyozk zg2>QIlEGyC8N9OBul??-x)M{t)VH+aW+SUUUQhe>&Ed)2uBN8Ah#xEr3>tZuGpWt* zQ&R)rN7DzcL(|pxZBr7G$3H5gj%p`O4UK3FqLL%n@?k5WQDEsAP|8Z~op+1{wR2zx z{xm6FDJJ5!#+;KmcdfE{jS02uQdp*CZ zs;b72M}K#Y5RVIJsx_dbI5<0~1N%!jLyCCB&W%$^QBkX|xC`ee7Oo*H3BWiE3iWi%rw5mXj+g zj20D}fUXqrb|6EZLAyPIq%{b9Ltvv@ZX9D`Vj2Zo2188pQdt?qH73+*J+-x=$6ZSw zkQ3zK9wY@JASJr>lX%Dx44qu}7YU~Rm-;Mh)|TUit8x%<0vq>m&hNY6 zx#V$~TS8`YbJOkW4fUjDn9jU{kSqG1bCYJaF;N2TZ*}#Xol$6c-=9owiqzKH;^IwSB2Mq3f?42;?5(MBUoD0c{626*Wn}@$-fbuV zOHjg3A>WkLT~kvN$^^NDJ|ghXpM8B57V{*xPI%-OmX?5l|I6xcvUV=IG(!}G1RjuQ z-kh45Nj%7cu1KJ6k*N5?b%=-~LFO4Z8^_j08wuGgV+v1>mfL_h>iEd+JK-PlVR$89 zwY2BH6C$T&c|yT4*s>vvmol(Kot%tJM(wJ8zZw`TQ<7@Tpf5b2RKsY{FS4oJ2pZs_ zp+KZbRblY=N&LS=L{u0IG>6bcD=QNY{eDNtk6c87Wo4z$Kpo-;Bb~OEmh{*U@av`e zac5${RSF5&wp!mW=!$ncULMd}AJfW#T@!gQN(gRTN~)XRHZn8>UjC^vkVKS`m9??4 zk#!jO{SCNjREVQsoPJ(dgtRr}+HT<%LJpT^*zB*_Lwwg;{S^&)7;vmIRzG23?JrS~ z!XF<}J;H*%)!HUOZdUp5TR?!ab00{vh}!=>FwfryHnq0aPFe=K@Is?ueO=w}KiU6W zx=LqlXAxw4$c;zskRiSzlurgRfSvUB;o>+pmO0;sFFRcF=FM0`BSpVBlA?KQ|HPJ* zq^_ZXl=bk&a89plKtKhAgOGkhx(dkS_e0M@b3ya`c63w}&bSre>OfZQM|t_}anLkH z9#!+yV7V)F``gUGB?Qro6)4iJ#{K>b{zKs3)ir5FISvd;Q}Y9bPNXon{@gbEbC4s6 zhe+uCeUDW+{gf9dMfUqspqmQ*JM!Rp;SST83w#bR#cz{bRW&t%6&@(eyx0FumWgeU zW~sE)lY2Wc)7Ey6SFk5}4|FRE3k%<})BZjOau)#l?Xr$-P*c2L4HGfQCptPQFHafL z?x&MH@|G(LBsd`rb#?y@@=F-x*$2pND?@4n$n{~m8-dRFRM}r+dcYwX^Wy-R^TC+} zQ=`s~`|nCuQ@(xEgiH(Qu}XT`0`0^y35=|ZosNkKA1aUvYO(t(==L=5$;tvS0L2gm zUIQFAu)J0g2z}A}H-SV31qG$vhVb_7+3D#7(5FAh`a5g5s90GK!CiIt2it9A_|DVQ z&QJhpbYs11NjyDgGb}T|lBy@EB2Rb)6`egSRQ8F(yYXKglsF+6_YPJe%~}5A2^R}& z7ryZ?boLf|l2kzfQ1DfYqIjo_p#T{bJPKqI2D13tqgXxvnda)}V48{F^8g8NTw2<~ zxoSs82aq{j!@!U+twdf6j@aOV>~R`J+>lt+Vv})wUcq!3(V@@C$uqhp%gFtTc=dP}?tHf>sQLKhOtr17~rkysa%CZ;b(lKzm)Cgn$4QaxP-^iKU1c zfplwlP|(uE+jg*c$fN5!jA9UGY^RNtm9#@80NBXg-~GQu@6y@mj)qS4_$AB(ZT6eL z{|5f^@QKzd!p28%?^b4J8#{&%Z~mDKmttc@P|Ym!$=!humrB_+Hdd7#HoOlX?vMeq z92_nf z*qipl29nUh&oJI`xDm`YY-Z{YPMNAZI<}evLk$I_*h@=)t*vEYVLc@wIsIp*2ymqf zFCo4GukYm?xs~7M6x!K(Dje9%mLVxFqcC5HV!s@0Myw3LIVC` z7ia*bDXEjP3GZb<3P`p5l?MB_Uz^(oit_Td+uGOvE%sVhSnTvb+1)y;ATR%@c>MSN z+W499|6kZ_3K@4nL~Mhs*Zeso2;jwKDl!9Et1#i*Xvub6vM35L?k$mk32?DvH2RfI zC1aSBy^0LPA3ZV|!br1*#6V_7o5=`|>mTOP6BOh#ZyY*+_E-Hr5UQ=NtYoC5r2M!3 z2x4K9pKdm)9I;VSR`rK8S|hFJ@1sQ%RJkh8xr#6tl9MaSoS-{);l8M-uiXb2rnrir zP}v{0fn$juZ=Cj2S4Z6Z5_RIaTCCqbKEAxS$`&$-+_(`g4cE||;xy%iHn4r_Av?Ic zwe{w|1?KzH1HI_#^)S2hv!19ZheD12o?OP$(+WRv5K5u--twSImF4vTPPX)#pZ}Sk z&eDQh@I*>{e8+V7V+~hT7-tydr%%oP8)sB_=5SPxn*4mmdWwVk`g$~vn!VLws^Z^P z1a69du|0AJ5;8#g-_|7f&tHQp1R>kTFo-zz9|e){4=m)Nr^vb9$~#I92{1hoteSI#m&Q$BD`|>KvR2; z!{JWnzinH>bPxlUJ#ZprWo6~$K4{dRPY)8Rl#MMZ6WEP4j%P`Z#hoSzb)pri*=RsMe4s3bx{shJ8) zT1@#0+nZ)R-QA_uG%cg$tiw4D)=KxUMA9C@9K9!I&E=SNZ%V9d~aaO znh?{_Kw>OG?g8h2i+yr_!1_-aeh34(;UEv5MPO0vH{yTrzzuk@!E&~;f3+jS%_F>k zV7&AAv7rDW161Cj2GN%p>8F|C=9Wu-keY6Ba`Fpi0g^KYlTyKs*KB3TvM>Q`^BjJi z#anjRUUh@~Cs0~m-oFXWIg-`U{Cs?=&@@+4^61}`L}=mNy$d#auq2OyZy>R|ywF#aH_(_zcm=_TgVuN|EgdkkfB2Z18sqxP)MPhr zZa^c0r0hHyMWq^DRw+8FuJdF~JFxFU%Ga=Qi7w1PV?($&fB=b$TJ}r z6_9@5YY7Sez`$v+%o9!t2?@gm291*wZ~xAyZ%D?9&gkQ^z(5*Nq(tTK!-dU$k6I1t zLty8ZpV{l_LA`v=oN1O25606Ks146fwuAPE!BPe@R(B2zypWWfZV4_E+|cmIDNxBa zdHU=jqPJt(=OS`*;yHcZaf{OT;NTtahrB#q6j4Age)REyZs>^r&8y4MOh1zB+nOew z_y31axeT{?I$SJ*G2b{ZmK_hI4XQ7p^h2h+i9O#=M=QC=VF?fE|AUfSFt%k&jV^yfL3OGPX2uhuU|{6 zv0v7`SyP(;IF?_9MkIa4CMH&=c8tQ$9n-Ru9dT(#s^%%!*@yE8{}_+&BEjHMY1Yqg z+j0Qw#kKZCmR0@l(EaF$^2m=FW^ z4N`2`UtQnF{XMbACb`)ju$HL-;b zo;y$X@2t-9{_yH*CMrpDv&kUplH}rouGQL#EmQ;kZGwBq(4YbA>FuZqNL2w669@y6 znvi-@$RkKfEqZ4{`L8DhANW>7wofdo_!j=*hu;~JK{A|>t5=VTjE1L9 zi*#L8K}zhdS@ZMG7$*pWI2~Jb{(4kz@xh+5{%|~&p~PWhWqp*}16jPAyht};=+WAF<=)|&~!<|wRgr=9geXg4# zwmRl4EGs))SNDYVkOq1EP+Aqp9Dp=t-ru0)`*qkZ?_Iulf#hZN?USzw3BI2`t*orz z{C9Elj~_mSb2}3{W+v6EvHzp7c4^R9{JEGe>ztk0o;kb%eh&Z`UWs>pu~CAXzVV^F zT-to=ZehZ=2jGg1j~_!ySv@E0uQTi-iVO^@=C`4@5n6C=4=qCB^yK6OXXwG-CpHIi z*U7eUDq!J?iBzomfA85hK3)af;$@EGLL&hqL+YcQMe2b#_%j?M;0*=B(u2V=2=l>! zd;1E;*zN7KcXZeToa*H9ZPS5{Y9@74ER0B5wLxp@=31UbJy7e~CJ;NVCT z!j6n)cLuT$jsHa@4b#IWp#UbI$HvQbILuIW3MWrN?$&Y^s|uPTA|s7s1w}$u#PUgUk_m2q!x zuiefDv@azKlKl&)-rj&Yh6brhaxyYXmTKUFZviC&@L>a@|IQ{#k4WbA@d`p=)#b&- z?}Xsv{yumT%;D}~CskGTW1}M>ncOY2kvG2qx9h^RJ@2)*vbdjP^KU`n+zsN`U0aov zkihx32$0{qhxEPWA^ph5=K)e3HFh{Y^+AA!l4UE@FMY9zAt~k za-7A3NZ!TuLw#cI7B>x))kt4!?WV3n0u=yaZx|lqDJzfW(g#S$eU5$m`@CG@fA1

    jo8)0vj?OXkdXZ11U*sNGv0pawc%Vj#N53L&4_S^54)e?!Eny)J=lYrq=Xblgf5A zSdy#^OjbstY+-*AW{8Qrjg3iKvV-bIz?P|kYh=5HDj*OkE-$8{^8Wn=Pll@y8N47% z>+O=rb|PS6lFkW(^#Hf>_%ZF_v^f*{HSd?C0f6WIo1%32`e-v0|3Cz8hKz!O9Sn0u zBZYVjss}G1iamBwf4@Qy%muE^S45q_*zocHS!NapTZ!2Vo!Y|U#O0gvbkH1++yQpf zN{7s(gn+UPG&iKjde**v;Qrwy)4-8I6C+a}*h2Rj`hS)JH_nxq(GoaE)N|wl(44?j zK-LBFT$2A;sT(6lyW3FNzkcKC(ciokg2%DDr{}QlA#@L_(8?yrGoY~Yfu~u;1^)f* z+rdjI@ekJlOu0+&>Xga!F-%`@-63Ew6!@&c;{!3fH?f6P+Yj?O_S&n2j`I?@7x+o0)^M%6|9zvHAAgC=Zk2UdK{cB%i ze|(%o05Lc4brdVj3OZI=)0{wA4OpHWk9PXI4#a6{c6P2aF!T^m;lBbphSGPNw@Apy zG(jKzp7HO3A0kdA9yt&WT;uiid}^bkmCmYUw`?Ix^3Qy@cs^pZ>@KqjFSoN&|1V48 z!oR#ad>w>*RGp*c(*^d%Ln9UMSH{7;6I>he*@D38g;q&Ryd@SC8K4egnqB(4rW|}3TbiaG^PadZU|M9`| z7trA3;NXDMuMCnIrKNV@yW;f!-A#FFcXkI+dlQsX;WCp(fqJC9V&5v==83iis3xfx2m*RQ>p{y*t>Vf03f~0z=PXs z8x3#4;VTp`_Er^77hA(Q?Sl&n>H%Fbiv__L&!w8lZ_V_;wwk8-<{rrm@U6Q0Ls@EN z#gLGYkkwO4Ny%YV;lKkO4@jz@5tqF2AvUj+G_0Nv5^`yonS6>d93LOJ|8Qu=^Qn(z zLE3CM807>v0DeV@Q{i~r-`p&u#t9KoNlA&Gt}f;OMlw~v@3Wy7^82wqiHW^{4!+4- zXskT7Huj@1PxZ$;18DSZi}!RcC$x{l7_sEvlBD)v0+S+2uXZ zjf2j9urU4oG8M1u8@bQ7J4Fi~Karz?uY5ssl1y;|?&fe87rMV|x9dY{E+K-)YT-T` zq#?Z*vl0_$hVpb&R8+hd|L*;97k(9+jjxTS{7$wZ^l4~lG+IMy1IcOB+5Jle1>f;m+X-G|LuTGa{=VCqdJY+r-59m#3$D+TpA&GRz` z0GdC<^$8Dwu&!r?YtF13YPCHnbbg zclWPwEbHQiWCt+n0)M7OBPL=J9Af-0-SrEr~TRE+j~Y00JWOU&F@Y)M!Dih z63Pc3F2c&E9yH(#}q=ZNw?$xC5j`@!#^r!gepclH8xbHj9hYb$7lii_*4!8a1AO^*VY z6L6u%e%LDBzxl&%*SmI-g_UU&{E^Yp+YG0{RI=-1nF^X3A+JXfN^_hu@pE~CS_@sSFp;e+cH4v(~lsH5j z@1TK+@yYk~o)q!*(Xw+OjN{}~hOPuIM>_+3eVM!&gMlpQF2v#mU3E2meM$`uq15Z~1ov>*|W)Chks^EIZtO@n@L1=#;WRxLsrE znTfjkV^J(A2Ww);Yo~7<9u_3gczPZIoU_t=cFpC2^aJvI-AN8;#7GjZMJ1tAC1*f$ zf;OpdygaoKKaA}7u4?M_HMprGjn{6~dA$^b_ldXbW`OTd* zHLm_|@ZJ7|&Q~Bo%&2?ueHGIBj`D#{qn({O3k%XCf@6ZAz-;7;ezF$WgAaxh6qFk*3&5BYxCVG-drr22UHCC4Z0-NCFxMu*M$*=`b0M8yi_T9V0cNR>HjUDz@d@001MsP?pVsK|=v2mseQbqW9jm|p@ ztR!UY?0!xgo6{&3B@yoafZT=^1&?TLmIJfPSgKbe{(FXo!2V?IF*u+vU)BMM3h(`Q zAP6(Jpu0NR{lh>u_SYGYDU$kCP(lK+8UX6mYPrXhfJUu=2!&WN2wYoW#CrD*2U)p4 ztCXCX$5SaWhcnJYuB@=|$7jM(ZWgE(9fD@^^wfcnkjXm^NdbXnXg9Fs2!DJX=xbDp zO&Pejo>EZ_jEy1VVX$WaC4ZRG+|&epm@V7$LcnzowNOruh-{@2CI$wZ))2mD&p70* z6B%@}R4Y}a%ihj+U;{rCGR$Qb?>z5&b_xRmut@5LN|qiq zLf#v|3DB^J#p`+f@MlK{Ej#;htg{%TicWWB!wL$5y}Z1riKANkC;>>Emq+|m{a`3> ze&J%$%1~bCuV1AG1BiGDpm<0Te)a0Wp?bDe7F3zHK}qJL5FovIQO(TsKr!d~+<8#k zr2W|zjMwMP0>a_<4r!m-b{frcz!$}x3t2Pz)qQ^7==)EGvBkwD13f(m%t(;36mxU4 zIJfc8Jdo&4)$yvfx{<-bL=|?&;0SdMt@N*7-(;7=t9BtHqkrxO9Boi#i4UvD&CA2a z#s>A8|2g2b0bssjRdu20isGS#%>B4DfXZg5Mq`J@*$>FjyuYNAB6fp_-TFSV`=-^w z=@p;H0+i07w!#J#fHwHtX7va-J3R|Oy!=YY{@KfeP(8!~x@mYnl$9-mz_aeJp8yq5 z8-rrgWyi_o;liWKm7#Qj0-wTYhRpZZY5~rB8Qdu*gAA$TFApQZ{|pNO=#Ak>vGdUm zaK)YF(#^XS8Xl@{Ku;E9H67bgGaz;Yzl^~i!tHQJeBAewgXKikkXCE*{>q{NYKhfy zHJFwKMZg)ukGntCgQK6v_zE|(i{*;7+dl*J*D}||We@l`0c#@y2}(->Y;2pIh5Ab< z9iASi)W_xif@I*13%mQn)}Izj5BLC85WJhw=z++yd!+(?3&>N=PtW;3e$3WsldE=^ z0TPjW+)jt5&6iz+khEzL?w`2N2KQ?*r@gK($~)qLF93R1InWh(Ce$MeXu=BULm}r} zpKA}Z-R@`T0YI}$MOS}6826l<$>!V#piV$RO6pmm&E*k-8!EIB_}{8}@$OwvWo3~P zt~4NSwA=SUVXcbC8ACvnwiTR8T^7hIf*4pP_{pe?19Tfx^}sGQ@G-Di0ft!$<#}sHx zGYbGDJ*(qU2E=FWk>?ob$HIl;*)_BJzlMkH-xVXPe{N__V`D1ZCr`XSXEFf88F&?; zK|wDC#_hSQLDcXZ!lE8KPjtMFM!M%MS|c-)nF_@oMuUL#uqrYdNG@tm4g|MDGr^#8{As3!sP{8lI1X{U}*Xe`V2O1rq zD5sL6jvGAzY%7dq+0yCB@82u4-0LW}7YAV@aK9?wR(k?WAU!P&-X!yU=lG{j4vCqW zOcryxYzdh(>*XKLYRATYj*P%oheW_b4^3yx!>(Vt&=Q1(s=K~67A3Z~p?1=nD!jN1 zYpA2c8fFWWWg$^I)|s8T(s~%y)ujeGR5-W8IZebi?wy74+@x&?Z*11N$lNpJ^J>S( z6(uEW;oGUH$WR92?x^V11-C6WwsU;hW9UL;G$iT-MJv#AKLXKg=x1YO+Ku+}Q-tg- zbV77S`%u!-g5LZr7zyY}eY@LDudXo-pFj^SCr8?`3y|xB7eeZO2Y->B-TCdeU7L0K z+S&x@aTPsZfmTiYOa6dn1CowyT?OU0ag}9d2G-VN9nlnFFWJ)oc*$t_RFn~FgFJ!c z&%(o5K_(#*ATH*!GVJWFP@Hwh@X_hK4E>SGu>ot%XlU6st84)=F~ErLJ>AG07Ir5& zNvmsx3z~268F;VX*hMyBZX>*IEc4mif*nq+)=p6&qPv{{`n~{aL2vPQ?%v4U{ z;;8tz9EDm2%=mNP%48okLsPTC-7@`G`U3(SV8rCZ@i|)4?!_GMlZxMC|MvB3u4!`` zfseh(@QHx=8&?7L_4jT9O%LxN4(_9)GenFEfWq49&LV?D#eI7ESC6YrRtCEj6h^?| z`<*azdNNvHRTZbxxrRrp1SPnUh3*7k8LU^|3}=`}B>_g$zMh_hz>*Sa$8$&vu(GlO zT9AW?4x&eWj>Pnq`zNFN^UbtY!n zwNCqWrn`*!tzj1shxqokP?@W>6j5F8zF!^Xqh7 zUEcd()X#UU+&R6XqWa5~^cf<^W>(E#LUZae?Vhy237NnnB+Sgt9tTwA|4akV$=NZW zx>T|hm=rzrV6w#F0=`05v;=yWQbf?m-7jCc;_kj<@~c9j&n z$o4M&p&;N8C#sC;`M<@-BOC9~(XoHAlg!lnBu-4MLn|cRSn{D12&DU4g-`7GKlbb(4q5y&M~I)sm;NlQ9A zo4{p(5{jI>0_tP83D{QLgyl*t6|z;Lb&c;Bq1_XTn5VGZf4$wZg5c_oKYLPOz63!3O_8 z!0CKq3u^OtbZ0&{r&bJ$td?&9rt#NUW~8`alONdMGVACtCWDnEVH@2$!XY9_Y6nM! zt7DE1!1IW79WIczetx;Fq35a!0D_E6nx&0Lno1O~GnnIHW5d~UCMGJ(o7WQhJ_4(j zSSanCrm!pV)1F0!vwH$^Rt1*U#>4q)tJx-Rkn4Tig#;ZhJ3r5c%-v9_NPRU;HF1uf ziGdiG!}=)0_UJ0H)J?KjmZ-LAqG-YaULC7jQB_cG}-dO6(n&-x@>-Zc}qPhogV0+P{2`FUpqd?2fs^R zL4m+1G-?Hs0U(xXy93Rf4@CXb#~=;6=#!_@IbMeM;84ce8pClDKn?cC5!1DLQ53q7hBSjE^7`8yd1z&l&s;@PX3bd>|Mp}95&34(=gx7C;qR;)At;8O?x0ab>R-UN3Hj;N(bfZ#1 zaR@4@ffQ{`?X7xCE5CY6E^xjcN#l#GJRhOM^#LX0EO%A8{rOkCO`DQlFZe&9FZ_H_ z;doj>y0RYajB#upL_Oqa`C{D97X$yPScMwQ2?ygD)et-$6=Z?6u0Cl_HFuVjjjhxO zn4TB^;&b9A?>x)c2SQN7n_Yj(lmvH0MWKJ$kyp@iXF4%a>es^5)csv4_sUAVz>b%w zhf_XjmJcFQ>Ts+hIghEDQ3kGJu06*CNk};jGH8)BHs;zEH(#&;IAXp{j$BlDcoHzRlyuZ859Poh!YLU0tn&LlQZ`kLywY5b@I- zQc^alDkG2D=kgQt^XWF{+w)H~r|W$N71X?L93C<4FZRgJOfw)7leItHd1|nwNs)W) zHlnW4+0=5xd`?8|<>hIg)JW!77B*uu%aL1HoBk`%tK?AW6mohb&(F_AV*jK3#l3sa z*jWsn&bd5R(9p}U3G9x6+YLNB&CW8LW=M`ae5e(*lShIqU0h50aiU{p_A#(0ORLoy zLh0aa(CN8SF)tQiREfymTN6ttw?FrMxxc7uQ$|R{X;wp4A{Kq+^5r0$Ae|xB46Ct` zF+xLs@7!OTwN4$v0|hn$P7fYE8Z8jsH)iAXyiSy(b-HGeQrmP^hH3n)a_fMZPM#P8 zpQC17>iZ_k_T0dyn=r~9YFD{?&AN3N!FRcE;r%mU0|P!V1`Du|MqRk@1$X4PdgGf~ zTj}$L?!&*nY0)U@=2^^tJURLLNHU~7O3&DcQ-z=Z%ju&xZ>BWe#Lh_`J{03kLA>q$ zN?7pf3o4J;#aIyLhQ z*N*KFZzpS3(a;#@YDddtfoy-nFIwl}qvj^HH&Q!pwUTzbY0lxRz@1H(JpnxGLgdWJ z&^U?q@hU^o6HeQ$TL=&hC@7E~!eKX^xSr~~t8dR$ag;Jdqo8S^!9c=sQVqQFmoAdV za63=0SC)+_Ig506Z)S|XeelrZY5b4)4c@73od)V!e}6^s*a~&dx+p|wcz8lqR$cN( zHxx$$tH{f{0nS1k`oNvZS1&%7^tNMcdg|!*?os32)bNC+X0=56x6Y#Q-r{AZ7Ia5R zcLB*+*GRFryssPZOG4wy0fYIXk{@b8ZYG6#kJjwhsyr^l{p`46$NhMxqf7O554X%M z)<#PLqNT-iBbtus+}+*Lw<;U!`D0m@Lc%vaLZW7DH7i>iqIa$DAGD0d-oD-DMZq~L z6gJX#E+BE!Jo>hRdT}PzMieGOBqw65Vb%J}@{h*$?dAmg)~JCZv!2xsxT>t#)54yo zjTlGhQc@?E4~)VSr_>wpF7oo$ShY%0;?UB*(t21{U=R5sh#t;Yuy_fTk|0;6_rqhSpt!84y8SL6lmmIoQ5Y z>3Fv}HLE3}yti2r6dryFp{7RU?R^pP#3C7;b!Uq2=Hbgq$Fh{-;%~()R%0B(SXd;v zBf()|g7Y2pH+(}6IWKwereXEQ+{QPKU%XZFMsx2@`ym?7K zqK$K`A_hM^_AZ;v%=a8mH_vs>;_{3P%ia%WZZ|yXF+s1Ccy9y+Vcox%So1yo`KF2L zW2)3&V$oK+zmksqj8h!X60_25O*_qUrR2qotp(*KmYL0lSmhN6lr2jwiz4Wii!07O zGYVJLIU-T^V-~0>&KoxyDs64I*9v4ebGV&lb{6{6ohzU7C-{a72n!4EmzadEXRz4x z*DQpk6s;@!+24LZOCCRvQhEC6O53?(8Kz;${st}r7_Ns3eX!!0TRWc13k4@`l$$Lt zZ4c_KV~>Y~1TX2@+#PiO5Z;WVy)~9CAD$v+?{9>KwdDPfHj24@=NZYF!p!WzW=^nl zFx#)u-J>05e3R-Q`&-+U#Hh~(k6)B|}evj;29c_<(@Y@tJYkIQn0IQv%5H#L6E z2d5T~m(L)y;I`eHXfKnMO8fTNdjEB;@6N8%u}V>LvL{EYQ1i!M5o`(kpP&y&X@b!r zb9=6!L-DId4F4Dg#X~Fmou{$7LWPyi=hjCnADP!x96QgGzb0z4=oWWVYM7a!nb&iX zQ(UadoA+yCN|B&kmNfz5Lw()vFRuDFbsSzpw1yT-@O{e|wLdsmI~6Fp@OCuK$XO%} zX%SB~Hi9v&lo$y_UnF2Hk24BbS~4OQmZw{+|Jp+LGb(!eTxBH;Ph8V|z0P-99}uOpbGTO0{gyv?uw2rsDJX zKzDcDS1owAKFUhgc7Ht>$l|<=knF)SY~irOu|GX}fVji;gWDjvxRmT+y-wSc>8UAm z8))4ZgA_4-v*W-`hP(hjqWX(2!F?=yrbKC?3p29)eyzv-UhUlnu}K)m%G z(|kxnBX$cnnjIPd{D>O^qP!vb&1}p;ZuW(2CR>mBjfMag_I8M2UL`ra7l~Gd$}vY! zkM&g^b@APv&n9Lye?~Ur@7)rc@+u)jT29WiKQusiJ}Opr6j8aqKIXr`WfX0U_rj#v zN}EH#`&CPi4r{NX&OT9j(~j2Z1ve3ql!aZ1t1gNGlQ*s$?5_3r?M@b?hc$Iel#`J>vUSGqqE)I{M7Ri1qBVoz9Oy6B{!9; zSIg!0sg-mk(@kWv?zOkH9G{i@o2Q>{%Cn#+kJk9+6eXv^X@sOTQ zQAF?hWX=TyWTR?o*5Hz9=~Py$X)07c55Rx^y&W;=zMPVU5 zp_x@wMArbrox#}Af%qBW_ymfPXU3}aBQH7%^1qK(E{BDEyMqV{3Gp|c$8#7jv3ZcE z*)+S2$J@cL;>3G#)tY#)h2v$*rK*L1>EK`~um(q%%MlTK%Vo)p;_LR&tkxsPUBNy! zSFT*SaG#ku(l+E%{>u5K6Bc~}1O#9spI6jrURdGqD_j)JKgyj&o#6SQI<;^L6Q3;@$ zn6`;B?0LflltC4C*sVV<_Dd!QA}VXX)?BD9o1L3|vb>AAL-f>AWZ^JUekiggYE;ovJ@z41D0>;3AAxwm5=~X7shm_Z7=q%!~T0uyTyq|%7QoccK6q9yk8+9 zHb1M?F^iRVlA|h)%ly4JbDq8q7|2GrOm+pl@bV)sQ92QieRn)3eYS7X@>t*Px|iQG zdR#mcQ!{@BS}zp@VtCPlrBf&P{B&4Id_Qa`GR%1IV!K7#-f8!u&8=(R zaIw(fkX&vLN@{A<%6lhsR!Tp;_5pZ2YQIOsq+L^0T`<0?`yB((yV zcUbDcJB(V%4y{>FPdin(d)kq?+!@31ZhtNqRXX2CY#%ED;F!)2XM~P6xDH$^tK;Gy z@Z&3&-#g)0GE=Wn)Vf_Tnea)ZohJOoVbqr3Sr{s!yOXHISYu{TKF^6=h-&BQqo-A! z%hQc@X)Uj4RYFyht&%u*f?vZtU!YA~Wut zcU*LIeu?WEr=<^=nK2PiNs+rGys$H+@KmEs5-?jqK~ATI(7lX{jSZ#j>(_rg(eG_) zXgC1C^F{(}e5nXRz(5DoE(aM&7ax`6bO7slzTP41U3N<38+3Ms(O2g)wIb6;f-5Bc7| z#~KNbNPw~t-xi~kEm$ZZp6Le8@0C2#T_fLNl5lA^qp<{@`aef@pG5YV)l65 z6(tT0?piFwXF?7_90JqzNt!fNt48gH0Y?IT1w>V2W6JozeI^>MUegEVT&LR=vsabb z1n80*>-cT$N&@A$pvuBT^=#D9l!5$Nnlbkf^9_VbMWdi)Y(>ob-5`93f-#B5Z(O_a zj^I@HOucNw|2Tt{tY}3^_;!4jN=0gZ1|tQtuy7t$EFPdiF$jl+3sG*o{ZSy7?_m9M zM(frc);3cqdD|h6o9AJJl<+3$f9BFs6&33z4ltF!vXiX7wVf2y#v-s zct+uM6ef?k&Qt!j%WJ$Uwx)XDKsp8m0TH~UMl6?Y*y63^-u@kUh-cTUl&_!F=#A73NC&apl61GpQubupu&S9dtLgM72m?c2qBdwJKcoy9V!wyRIahC!PoCB=T? z9MVffcTP+b%yq+RIkaAu^uKP~`e`6i-n!i6!W*wbXZ znn>z(Z)+>teJwkXhC4f>Kqyx`!niE)Czg;M-QO2vXhWx-gWuC>McDb=I(4jI?ulTx z)5@~O*XOC(L88~qw-j%|I$qH3mRKDA-F)-bkT}SnNJ){}&pSJdfDb2G%2gE{X(Tl? z`yPi_^WGI+fb4P{!e$!%xn%z+JX2QE&&ZtLVK|@PlM2e?)!Ew!-&n=d6MMYA<%o~h zVu#LD{gQ#6XRCVyv9wHd=l+qmE*tuBcmx`PKC?sh`>5fcH8dmxW!q<{HSZ7VCQTtq z8QU$3+pZ564%WM17B!S?bzgTX)$n(IZBAXcS1h9#+613XpSgk-o_)hT>DRBs>lO3! z7tv=V)0?~|4UuSx99+xVpq+6U6^eM=+8e%Wk)u-JUM|J7FX`0W!GjTW_a{W*db3Kz z8^7S&#_n1W;|krPb{!%6+j{hqgMukk&}b!k?fMzWk>ha<2bcOxqZx258v#}p>{a_c zx5AF5x89}e>{DA=MMXitFN<8MCvn?!(-2p61wF+(I#0x}oq^S)60=*6R#aiy**?I8+@4@$DhalQN}p zllhq$M}kx5vvj2FYTo7L8rR+2hiz{2V=vPEt6fPFVq>!t6JKd+ZlCNM+a1>H*82M^ z{Ee^*N=ifh{rR`Qu(A*m-EZ+31dcA}Dmfe5fT!mnOqCXu#?wE12tI$V7iY(ncAH4g z0StgN`}jxZx4NSnj(-Gza1vQqxRWN60n-++vB9kIz0HJ%vhojyT}2TQ6tEx$IjOxp zYyR4z>o@nnM}atI+je6-%H-(ySVcLq?KexIWw6gT{e|u82$;wMvpe7j!90vLNb%Ox zq#dlOU?5fp&!xoH5pRYcy9|1Zi(6u0HM^bBGSbrOxKVuW^$Q44@1>J zJdq>9p#f2o&$XGArS_TAMP$^|K(-jNazPV=m|)RoWg7A5{U;~~ti+gW+%FSl^+&i6 zR{~u#xCe;tDyI6Qg?htMylsb1Y_YSssHaLgG)a1NXCf^kobZw*k68MG4?=|$W&6D2KahzL! zkF955%;tNrJX`HuCM4V_nop2rlT|vRGKNXS^5xlh!SVAvB%^W%E+qV}AOt@ke;SHr z@OX1M>H=N*G7RaA*%^@Cqxu%g*AJ+$%=%0h_BJ`*4V*N}B$H{>IyBnHav6U*G;c6U zH@4Vn2MX=$knzBcKl6V&I@)g6Vns_zP~iJhji6N$3MHKekR24ov&6-+v~_Av&KM>t zF>P3k>GQw+@HJ(x=bqWz?frv0RC*AD2hDA6x*K!k4J&s-Ru6yd_vT1pM_9MtLwx%p zD?_|ZQyaX{rSiM03ls4=q?a|VW0%*Co`X5fNok^Ds4DSiXK4)CJ)-@mCs>U0lvZv> z`?7^Sp0^YrPArktHNGJ597XbfdELGA_SPvll)#I+riKqi59>cbWTM-L@bKT|R;Q0$ z$gW_?QTj)2$PWySGVc>%UU!F3SzbQHm7VBhCxrl#N45R-&C?KP=c*JcO2@(21F5b- zS6L8QM`zO0Ym$0McW3U&emGQC*=*~64d~b0qoXOBlaH^nvAuL&Snf+S`C_v|B^6$M zxP!{Xbn!Els=Pz9R$6ybU!x*D*dN@X3c0WlNlBWZs&(yoAgL;#Sg|~IzxP*ZOicWu zkU6V@?d^Z4v~k$}FL>stu-YB(L@}xXk43-z(|uXBFaDn?KJQbjNynIQp(8qv<1%wE z!usfV!yu3S)xb}am7&xyAW=L=1z3QkiB-ku)SJf$>(#`{HwC-BxJ-~3B7!1fiY#*O z(QUD@dI%kgwY8Xy)|d}nB%h<-^p(x1J{@FrOO2E+D`KHb?GsM#uL~l=#tuQeZ|MjV zI+Q9b=CxkiqevS-Ja){snCM%@JzulXGz%#9%l`Sm_Bd;`&`#NTxXnjf&;M&?+%L!FATJ*|_<7@QK4=kGW zbuT}^MM)6hB_AWu;tO5k!=krIIK6Ft8Kg~lKjFawCxdpA50l!{n12_v^rzbR@>NJ> z*U;iout%jbQAhjHj8$(v=v5fAkS&b_6@+gh$Y->f+~#f%$w zTS^(jV#fYZcPHN3Qq!)x-swvi3F40Nq>GO%E4aZiXjA~B%(^#)4!RE@F+}ysC^Hki z2`%_E>U;Xz z%F=KbF*7^Gpt+`NWb|jQ_!%!RoC_U=h`^ux^HDgHhMA6zzL8OZeL){IC^R*%W?4+Q zUpgWq09>6YHbk@H$HzxT&_9YfCGiDDSZJRP0*3l(+%9W8>ihK-hZAq1p|K2YXK>sv zOuaf@0_Qg7lsS@9LpErWYzZAP7|x1#lmGK^<}F-AC(1FK^_Q}|#r+s1q`KXpJZQi5 zjZWk{q8Pt7S<70a@|~WHBW+*eLoDTFi3qgJX!4n-XXa_Kws>V{6Q90Jc;@t6r&W=8 zN;K(I^y7%0?_dykS5m69jVX6hk=r63(9*us*SU=-mLcOJ_!gacleHo*KmS{P{+k(3 zF+`B0#LS$rPh`W~u4~@aKTFHtOdRGKdTBU31m9AMu zr#-w>6Bi?is!4 zxtpZE1|YVG=gg^7RaX9M!JF9+9*+3%KOG`jYq<2@(x}=qUcOOi$}*YsDvT1M(WPJQ zvK`UEfLS|+RcHihJ%f35Qz53X8vI1+iwQ|nGMLd zAg%#MRoDnn;K-1d4ox8-!UXftn+Oh$DInln9K8|{0MwfzCnpYa#Hfb~^7nn40Wo9Z zICO%Zf{qUA>F<(adBpT+i3rtnKFBlI&yJTEV~XKWe3k~l@Chr?ZN%Xw|J0A|_n;;x zB_*Yza=bp)<>!y@d~p_5521_&myeQ?hk5}$YS-@cpvZLW{%W+_d34*wUROdb422YI z7;Q^JUkbQa563)E4qeVTH=t}^z%186+`Vt#(Qj>`J2yK%z6phXbD-9(TW?Zs5Ijw{ zlR#G#%V2E{#3wp6TURY()+&Uz!qOhupCerIm(>1#e-UMmoV z2Ol+11G2G=XVVdK!@^2z4x9yYhK^$AAODo>cF}j!vsN&*UIHn{xs$4}FtT^@^j7p$ zd#Xc8SyV>sxOZlN&*dbuaaAamXK@i3G0HtrvENN%uJd9hBPoGbA5ZkWA@Y7s${D1W z*%&16ud<~fo6xYvVXi&`tGI|<<)PSIRn;y|%kj;H^WhGjgS@f1lNqT|Au9=l{rgSD z!68Y6XyTK}&p9f!E`LJ8iWZrwoX>majRWl+9E=qd0JgFI*`CsH1F?lxm6ZE4GM41t zxhGZhF6SR}Js#uPL0;y2HImWX{`I7qsN5)s!9IPfkm@Ky2yzgyQb*gBi(F5Oh65|A zPeM4$hVpc{@)~r$bo?$+7 z&G3M#xCauze~8sc7s^W2PM&Iit-V}w7Bx! zRt^wyoGOr8G+A3~4b?Mxf{Vad8wn4MYaHExvwmcnDuuYdG`y^aIos0dWJihgTwHwA zY~h*kLtMntpvDmVwK8hgB&{n^mKNrw?u zryw|E0NkIbN)RJ1H5t)0Hm)BR#1;$2EYU%fR1(I;03wh9egHh zsxj#5f)KvGerg00av(9+H3TW|$v&D}PZILYo3(l$+S=YS2+qzGTX#e&SX$P8j0X3H zJ9loHj1+zj3=Hgu1VbwrP*3_M%j1-g|k*~@$_&-M2AM({Cj&h&# z=Q8tOstM}(e7!_zL1#ZQ zzMGmnF{|W_k{M}JdNMbq+SUJS-p~EAe-B5+u!+NIZ$@i10Qd4u3f97(jC1NB!^C>j zLTz5F855DLA@do+fn7%wD9S^Gf+3l1J#<}8kQ18`%4)Us&mp_2c{!fWoML&7V*9^@ zS%%Eh@7l%yxdWS8PTr&d+2ViMTfp-9>DO{Aj?ob*^-`0YD2-SD)6W3Ie-TU*OmuYq zUmQCs+?IO{q2eW0{MFW0>2li3WyK!;^=n1tX?f*kskoi;Fp05olX@|^;GVADcT39} zjVgPOs10W71&Wvv6L$7{kZ&>2(UI`G@^MA%zk4%XvfL+y^rkh$aC=)UfzPGf^}J_) zHBh+?SgAF(>(4M&mmf$GWbFW67)VpdUJjvSc2LfZRT9OlT-CDzX*g^JQ5Nz z9P7IXJjTM${w@)*v98BE6Tks4j9*=L_*3^`;OeFN{D70wBzK@VQF{uc6ae_Lw5M$S zE$$D!@`H7Qf`UyGQ>EZ!;4Sv_yjuKUB_1`H#}D|h<8G=F+Tih@`ZVBt<*FN+oATBm zX9*M2)3#u49o}@$7=#32dRm)8-snjjsr97!^qZF$+?}BV`J-j4Wrw1GD{hW1CVorr zkDc7v-d0g%-6;bM-?gocjnLeYjo}u8r6#4#2Gj!I^pm-A4Y&UimzVStNVMJ@$ud(o zwKFfrBSl4+iB#Prz%bZQk{fa+-A{>>uC>}7jkKUfbgRVoHH1I}F>sMVa&Ocn!uWDY zL4ENEtIW?N?c7_&pClCp0qCpa{-CkELhSHr#chPV{J@ae@Xxcz2lUjb=_w&m+l#j* ze+s?~@&^sg@mLe&hkCdQ`^EiVWuCsIsz0^crV_Pmc=z(Lm%IDb87^6Ab}g-d^98N; zGv|QoSLkg!%~z^9m1;90vDJv9iyV_Qa4Mf@cW4j%z-x0V+Sal#zo6?ZW-z5dPEP)M zXS=?#m5l$Lkqwf&<0gvd=*`wTc7Ps{(H7hQ(FU>BmoHN{hUk(-0ttB?aaKv0n3zyM z1^)y!u+gTbipdkF{oeg8&XjERE_2m;_ht*;HtQM~pxwSLCiaBFKrvVSiPM4P;F(iW zQWA{1($dm0(9+(;{r<(*mvwdn3gZ04dN1_vealldEx;r_WDd5Nw~3fq|a! zd|$6|V+OpG9mUh@0vJdH}#Lv>^0NAPE%9_jiCt8duXudvl_-`eu^xdrwG z@oRH`=yKFr`8~!3Ah|-Y!L|hNWdH*nJbZ|Ou#-+HvD>^@OXm)gd=L*6uyC)M;X7Z}9QwQS#_6zm@q4Z=wzBfZ|(aT6q zQHQ}c=z=TErIJ94fH`A^A#bPsWVvx~k9o~#dJ+GP7Jn8Rxxpf{c2#_4W_p`w8?~!F zAdMVfkAkaJrC94pl6B(y)ihOC${sN=DLPfH?Jwt$*)O0XvXv|Anm6sovm$*XI;G;C zq9ZJKEn8@p8uz?ZBfbWOfJ9u6)S;=s*{7hQtO#?8O;ZZe4#MrX4WXvZ`40{(dI_H_B3n6pfkR`qs`%HZlgu}ZJuVO(6!5#fpwTX z0PI~PKlT75FeEf|jM_yDvNZ7Vy}a;OyM6sX8RXrQRbYmIW2>5?A~1}04>r)Qa><0} ziL$9O3AE(fV>r3xR%yV5$W-v#Cto#rEFd8<-}_x~wuzu{0}?@7>tdEC$0gY%-@euT zsb^}R({DK3{AA+D>9|+NX1oxx9vf>eAn*}_A}K!~kM=KF#1ETQIxZ?ECKw)!A1PuK z#l?P7eN>6W1gaX1jr@_HkB0X|p1WWE`gGmP%S8p#(1^aWJV)h6zQu0L zrKqOn0sIH0$VIq<`>|KhKDYV!kGcVysE-0P3#7Mi_h{GeO-u~2(5$9s(i8Jl1FFdorM%*}Zia2{S*Q?#6a{fdGJqrp^FF}!zDpSPtJpTB1x0->2JCnaKo95ki27wt_cD?pfZ04MzrVCvYR7Y1fc291zWIf~ zOQwkB!Fwe7YQbmb#1&4b+^wI6+wZbK??{ZLItBA~M@E_^{}74aNJyIq_p>n@NeDj@+%dzLlI z*f8yTd+V)-Kw^3p$B!xuGO~n_5Ny_pKp040885eG2>tOR5_(KvMme!*g>V=D4jrfW zq!Z0+F+YANFLst(Z-hqd@3u!5oW&LNj~+>g|GwgPe?sP>y%>T9bcjIWty^0l@<2#{ z&gWpc8pp%ui#HOoR8uP;X(F%l`WixBL5XB9jE{slTfs7Q&FX?@Z|N( zOjS|!xKukHxHzBgXBiZ$DJ76t@%K@LU3U)(dYn-;X&e@=obS?ifoJ%xPgTjXCw7SG z=;E9RaqHqTN_A~%Tz0i-wjHUi$&wnFf!`(L%$)g#-2%r-rFayfvuaybKxs?^%4zwv z+T)?Rf!8Nfmaltjq>XSKGIyRh-i#(3ZLd6;`EG@H!(~WlyrFmnbnzpz9wlPXb8(Gy zcL#ZV?AV71?wJ`K7Z(?d-xTlze|rUPPh4I3XwsGm3B^l(-MRY5e(@jW<%=Cf02qn8 zx@x<+1_uRw^Ygob*_FrN0p32}HdI_rtX;N~Y)3f^4L_6c#KJKD*}kzEgdSivW$!-* zpv=>g_~eAGENLb!B}G|~Zb2EyMp04zE$!{Ncz9ofgQ)e{ zd&z^0;E0zH6f_Bh>W2?&Qy=VZZ*y@<+Psg9jyXMV4t&kUwOql!kavC_ zmzo-FXV+J=TAZq!7J3#94e8L6>Fi=YyQqdH1w9>I6L)Ax=&Sdxf0=x#1%-rpxw*PJ zEU_Mi{*T{!am8JDL=obbJlPBtL42$I`36_vrDTi!TVFJ!8pK_P^Dm7!Lb6EV!jQlnlv-AK}RzY7QB4g)V_(sP35xIFo$$C%!#%kGR8>b z(5UTs@ukK`iTH7`LtJ@(Xd@)HklhgZ@$8jR^*0dEZH*$(dd=Sxt);+7N9Xs&Ju@UPw1zCPi&wDW$qAJv0cm-FoC6$j#n)hc26C$JM{Mn(==5^;6CfD788 zf~HDW@`_9gC3!2;+6$jqQB0`*ARr88gE}|qhEu0K+1RFQue0U(NY`B>)BUD43!j)6 zc%nV8-jgJJd*Ehh$R#$@{D%(oV{uSFd3%e9i&t%6i(ckWR@>-zuy8yzId0E2t!H)* zzQ#?>P7f`_!5$|}bC*t0rPs35nC27Ju4{8I5bssWOSGntZ0N6J?@krRTMsP1U}-?jQCx+QoTiWO z7b9k8+jBh1w0Yr6A8CKF(suF*QkNOc#uVohS_Ufh&4@BaVRiMH>B)Om_@lkP%Q3du z2k&?Bu<%|5DYdtpg+zx_P}4Upj0^87ZEbJosn#BKp0@xZ)+$~9q8@XTXTN#=4s<-$ zP1b1cM|D`no@{MT02j`!*CAv%wG!QRj}d@0S1K|GJD|C($#gXu7F+g^64;;-Ct@ zeyuJjSe}^vtkc5E>Jj~KIyxJDIm}N2!4VNq_)b$*1WwO_9frc2n{rqzEFoXM>`Ph& zhlh7}%jVjtDkrZP+CdK#6*UeAcV3y9I*dL$H@82Wb;*rNze9$yV8k1Q})p1>BX6th)rqM;jCAK;B-6PvCb8NpY*H zs*OkPG^e_K`w2QaSQLJC6xnNj^>pPgrsEGUnm2}q{WAj?g#BYJ@80_=`Ep_r-3$8~ zi9o=`i(qU}^E1!hFSqVYcndG@n@1Dn$FS#YqGU=*pZvas=sW>wv^i}nN657FdGws0 z#4!ncKS9=X2>og^-!$taGh>W9ySO+tyKua8>?G%#fp{(<%qJ?8ytoR`(BHT{9t=j`pE@9^M!~I^z!()tMX|%Apf@-96*Df8kCjFfKrz@?qG5 zk^@fXx|s~fXJ9Aph4k6QcPz9km>F(4Qsjh*JEH+(<1 zD&qMGKZ#W`*O6)|dQ)KaTJ=RW|17w=@p~JlR?qUNZtN%!iHau9634t1QKcTbD`5IL zCMN5);l{;H9CGr`(4zsk`F+cNH;OJZmTK^sKUP(hURL+GAR`}Ne3(RZmz7=A#F1w6 z18F>%gEPU^lL`p_YDzs-w{ zr==+gw}{^$rHGWCfnL2#Pk1{}2eCBbfyI6Q?9u|upzE}M<)-)1(GilnrsUQ1?MV8SGd`-|&d*Pb8kcSCJp zBHiBF;ktE%fuL=96hLV9w5{{!ru^2xx5^cxHEI(jI208_Okrvh*(xGgRtq)1}7pa@6V&nQHZkd(L_$fR~+dXaKzCe`@UY^D{w2as!Xc z?k;5XMg+hj2QzOyJ*m&gI?Oa_pBsVAg?7wk?H=5@@v~Y@i!Uuy zm#zAAC6w2Oa{i*lhU_i(k$9Q|7!A15PkyT`%L~kR zDF6%qxBx;SLv-|X91ea$aHgGRAw+lg+AqSNua$$Q=D4E>Fv1k>-~Pl$U2QJFn^ql& zbk!h1;dR#4T~#6R(48(n-_k21tw7{kWwrGpvx-I6tXGbAP^%!h=ll3neWXC7d{6cH z@_FF2zN2HpbA#>cTL|fn9VhFD2{q(hM_f~KQt8Br3lL*^0D21!HvCmS$KS|LFiZ2G z4w#Mmvm(o65_mY>kLXhiT*v#SvWQ=Ri4|6N78VlTitf=@ePZ$06>YEQt$4Ua~JFRak2-L)dOi*aM3jdfISg4KbOH*L)G`@F(D^c{L;}k&HGnTw%37 zl-)i<)=0$`Tbhb-l|4Rlc8)j;zg0hgp<^JRALJMjE^BXsCPqz#WAB7st#7R6~; z*nMNQAl<-MPh_0C;^;44#m0s1KRLcmb3Hgb*CjPsJ$onReK|}iY?>M9f zTwLdS%iS?egQz-6+cFGNNC6Vy;0@-H~KSW{cP&-t0m)^9egt?2pchoz_aRq>3L$t<0m z%|(ps-66m%OP|G z>3C&S{K0L+-X1!2v>JEb$li)eQx&pw`?Z@MUf1e?%o1U-hQ0G%`uTGNLNqyBc@rhh zjF%xNHB{{hGjo~nsIZR}WY1QMomN&nkM(}fQO90fB5I8=eqXo%mI+%)vG9yA1D~J2 zHu649@qf!X`J{S>^*E;IeyFN96cjX3s=;?l@GW{Y4FZHG10Hx2M|9o?#=~l0S_BV* zlTlp?HG3pqKBrP%#w84j9*#_YA`Nx1?r67fc0)C&Gdo{92?fG!?_q~xs~?)3%`PuG z|9Xkeam^jbQ{Nvg5(I3py%!4PLNg696iY!I@6MN^JBh8$?3IT;#4T5_Zb<8jyMvI& zT5%mp_V+(xA$*(kAnz7}M#c$%?r-VBB>E{zF#f^&32RZG+vaOXX}XcpXO&&IhxcrG zW=7lV-th6&%zB?^P{<>cYX?-s)a2FUlSZX10f#rgHzTIggqM<=D)#Z@b>C|skR>N& zFF3SBs2jzoq!wnLVWX-~oYIl-IBYrRyPd^E%rQJf)R9KtZ7dJzN_Udo@&4qH1bfjXC~X_uVRq z`1XwmxR{l8JVjdRSClf~_zr>@yRB^Z3%kP-aBm}Em#kG{j*x_N7|K-+&hH}gCcJfIAr|tXXHWqeME+*T-?*5zZE|u(V zlHw++-UDpKEltN(X=43@F-H+{k_4NTk--{G$>@VQnj!HA8KA|A|6M-8T3p< zK5?RCnokEkz%kR|=6yQzlYPje=^o8zSz+@jzXuUMZ@m1Z%UH@C;(~){SZCW7 zY#xPkcE0;@eskG+9SPBu93Q*SyPtd|Y4GTH76tKsVnv75VZ3d45%P?LKDo{D8Vm%5 ze5TK>lG`~C`iWtN01kC^sk7vpm|graU@`)w0T4iZeOG0Wo77ic$p(@29iICGh#@H{ zjzCDDsbOgcS0Ia~@<1;StLku?on67=)epq;GJ}L~MMI)%#GfN#^cJ@svjmjfLAn)lWuDcNjdwR|x*KPst$k6Dlv_dW~-le{C zirccz_w4w!h7{|G>#w;>6uV$uGZ-*R-k^Cb2+odK12Q|Z&z}dCiztg8C0&-NGJ^h2 zdWMmw_c%>~+a6$2k!DXvImr*&e)2Yph5sUZ$Upq_r&u3v#d3{(tgfMUn`*WQ#{``8 zNj(}-ra!tFli5OTb~tA)RsFcj8)MZI8lpA=Op3SYdniTWPrAw099qhpI5c*;U7J2G zvs>ZJ;bu_uYx15-vlme-MQTcx*%e>eyzH$Xs{PWL=_kF+`;Z^c;xeRYw@@EH;dC5_ zs$VTuqi@CSU$&g!1RpB7u=g;%+xZ&V1GMG+m z@oN!>5+Z4`qvdj>RN)Sv1r;OP!wq5Jw;&;6`S45M=dM@t1jDp!r^MnwPCgJd5(j?3 z<3A+h*3*7=2cgJl^#jMX_BNU>(H+9k9B(sV6Hf53+Y^rp3iL;cRLc;T7Dh$I?Xz9j zsGqHJCWMk^FXoOdjmnnr91z!BHCTuS8TPrHme0!jisw>B`WTekB2^{V`ywU;#-M+k z68YnY(A#EY#Nmd}WaYiq3K36n-uJ`4RBPAV_hW3!vsGgwV&0l_WV~WK>|Re!%#f0h zc0AkK7}j>&deaQv^e5cz1QDcSe$1exgs7gFeoc4 zgU`XwuCC^aS^$pn^CQJ^7iMQoYbO)+d)7zN9)xNzEs=YOJVsj^E=~yLZuTR-e8P8X ztf+7CL_=*h|*c*B3b+ zHx0CL;Pv?OQ9bne@+Bk7XlG}zMgm9+RlL__NO%t+wS!i2ND`_ssygB>enk4=Ot!UZ zZLgtAPTWN0fuBR<5&VdXLsYgk%|azc{fGL=XEIp>4QtE0@IrR!=+tdW%TX=W9wL+0PaR#`AlC4upo%AafEhup$PU3XywxuDCI7Z0*zD+_8}O$|UfC zq-gOAHBhNp>iv!u_61Gqzq{uINI4n*X8_cLj1lC#Y}gQap?O4+y)>^?!Y) zkuD4!Nvem`h&n0>HSJ*7Et5IC6t-aVzmsdjbMNi+OZvdTn_2#rZqTLu>1YGWy;O11dq0y5t9Q{JrtS%8e z`M8$b3<$|6qr+y4f$wSN`MSrdgS_`T7!ztlb zUox}pMzf+oqi%`FUax_ca_|JeKj2WPRQwY5)U)h?FN>>SgGeWet^3_SZVB8wT^`n1 z-&vHe5<%xU@0YC@` z97l}gGHxC}y?I^4;_LXS@pW!KhcYO>y6WtsipW=}1ATpsf6j!Z7*a2?#iVvbw(0xb zD#0cve?dpLz0eQqSwlf#!jgAI8JH`_NA^IeMLxo17fd>Z^zexVS*DT!mjh!5Q#Lb- zRF;sMT-vK1mu#VoB!IUyiYp2okbsu@`jw)b+`x3k?m=n+EzXz1kj&Cl=^QrX6;lDQ zN)xG66I^9}ip0TDmieWkB3geJrS}F9Ibg;Ub?1wXh`bQql|5c!%I zANRr_8O=lodE7fh?BLI4G*YOSGkW*LoSs&+!luo(+-7 zSiR<%nu3i`o+hUR_P;gXkEdCCASL1S&S+&~lH>)W*UQtjr5~RH134bNNr+T#V=jUNhITLjT-1gTEP*Fnwyq-7Apo57dm=2?QK*h8As5)KtwYcibQn`BzCHT0IOTmf> z=2jDg33SRym=>fa3R?YRsIGFFnipKW3PPUrLn`s*tgFWQ4h{sLv9q&)1gj+z23RoQWi&Ec zZ+PWZRZr%vqVw}b4UR`|I}m0;amc$4L1dYVrptK-m|`IR04xDqY`kTLyl$o^w{2WR zPubtj>LEmLlXNx?6zDfn(M;JN_m2Jg73eLJUwzv9B`Im#_e+f*N!zR3{DrLC+}1YZ zjs3Ijc&b5(hJD9?@ZVyfC2}INlx3o{4 zzP2h%V;6V5IIP|n%bThKc=s9tqX>Up+AP53-u2z0FN^Wr>u=8@=9S#`-hqTg z^KN2^%t*he_J;8{QTuJ{9((Baccs2rV{h5 z7ba}1%u%vbT#MJK0COFJzyDA7yQfGa2F+-x zsl8%i)MRAxN{Ie<_ePbCj9^}2;Nm>%#*L$^C;y+@3fOq|Cp6QwHR>x%-Iw!_K0qVN z%sXLW<+qp2SbR0}%|eHb1MsC@rtrPS0L_>hO2T8wlfp3264TY^jc z2AiFf(!PU2nY__tpD$|n@5=u{P3iT!kAmn@_I>a;) z6BT{`>YH=CfjOi1@1Cj>rEF3nxq`IuJsh05Zw&wa(t8}s6KXWi#^vAxs(G&FBL98o zJn&dh`0{_(37q_&9TydvwY3Cj(e8&fPM`-P{AETQ0`Qx>UADkuoDJZD6R2+E*-{Et1_8z%>MC1cd|-Riv#6eg;ieu8%HNmUT!N>^p z^1XXP?Pb{2Oqi^kob~%iLL8jq6$Kq9JJf$4($8=o(mp&w|C4&#tLK_Xx()2KsUS2El(95BrSJd^4!3${8Umzt*3*ye}YN=6V*%ZvC!y(D)jh zU?pF(%041=xB7S=C?Fums~~@7@>$x30YnG*tXuf0=BOPwok~B!{09vGii`gqtu+3( zG!j$mAqEsc3;<0hfOHj2zk@N|lP3jQ{AcXM|G5F({CW*O7jK&}jQ+L6{{8B?94gv! zmg4&E-m@w8atp|JMEqI6&Dz+b^eP-#>kdIHejOyugO347wZ!||Gu$o-*&Mb%H0zwOUptpub0MU*d!$A2oNRz ze}U4QK%EBZ^}@0Q1`3M)NtgdM@Veckr30Qju`xax!;3OPMe}{DGfB#s?>L-a8ma%r zjPLijvpmt$t25a=eL89Y?UgWdSA~=i5XB)O*$-b*6(MJm=CyvOF_c@2E-oe2(`tAE z!jm8!{P>N#+3Eg&NbLRAkv}nQ7@iX5pkF(K`~S18Z44-CgJ%D358OK=Q^1%Z3u4yv zW1#(3W~cSPIO2Ih2g6c`Z`tEq&&G?;lTK05wpU5uk}eGaWvTaGH8#q8T1)@%duLVE zvy6-=#-6-@?^?ARAd_8UJ34%yi10w8c9P^$_22#K)9P#(z&g;y>8nVfd2edwokq`FC&lB+o6MTeNSO(}fD& za2!MrKPh-4rqh2k;*1&Y|k@lNt5#=?s^anoHK^iNrZhj+o8)_=ApE!{vJcA*( z^2K)dU>1V_tg&)XGW&ZtKNLy|0V#f|m{LE7jKoB0Zy%7!9j-dg&%Sbz>{s2`kbb1t z9yDmCsF>Q?n$bJzZ-dX|31$Ewyu71qOB<UaoFhw-c)@BHs$j<5b_|XjLRiFbct|y51$*T$AduG+A z^XF}Z9JZvq6`K_{C}51JR$|1ExAyn*pQFl7qm=kOf6zTNw76~0;*X7s3+>*~Zy(NF zQ8E8r!UHtWQj?RF-8v*|xBZXB1p=Yv0j3qx(>||~9q+x`oaD0%s4-D_uKmZD3k5tQ z(s>IDEtRr|;j<`muJIEQ75#>p=>7T5 z*fCjK76wcFwVp*hK;B#%M1SB0D(;}lJNOFhfO&a&xrhV)KK!doYq=7sJ=oyQNu?f3 zoBMaMAc9B9ZuV^N{7??G;9??_XcxPWkIgBJj56D}o`RvldT`{CpAX!Hl#;}f5(2D; zG-=|-g0?P_He^^9oUzDguC_Kdk(?H;Mk^8{FuHJc^nSR;pDv7zjSXI9x`Y%oG>gl9 zY2aSO;{TuZ@xU0yG|al|;vJIy83MpBRch9{LLw3uAAfP?U<4W~z#g^B0Y55WY3UUF zXtMhx06H}vMCD)GT=8rgeer{XUzM4QG&DBOFD|xC-+{DJXS$AwMmqbnrE>8*M8hoO zp>2@l{AvJpT<)qZot-*^**&15*EVP`MkRceHuJ9VL8>d<;EwSit-d9-WsgcE5WS zcE6WsFJwgsB+9B*Rx^@sw=!F$ow3-7o0&-u94{Jnr5r8e5FG}6eyzM$vzVy6sQaWX zB;?+AT*tOfo7(m`%e^^rLsRfBk~Ov%kw#4W!_E8n@tT^NTGUH$d3*4`1^-;*u$k;4 z#Jlp}1_eh@Wh<<9=5@CKs059L{ zq@=m|fuOJ@cupnWA3m6Y8`<|CiG_tB85!D^mLyD|wnDkGHnIvjR0)m`0@EriW@G=< zyG1?LzSx-XwST5CLUl{asLA}oJ8&b5J2@k9BvtQJ+e5@{sHW)SwNoi|Z0rR45(|nX zG#bGeHp5n1?wz~1_i7Bs2(P=;N69TZADg+6jPcv{%1WVki1cKrMyvLU=2sNscX61i z2?`~PNcQ*i=ux}H^XYeeFr6ydbk@D($`BHBh;9%%HaxSI^0(u|e#p!mp)z>P!>>l< zl;O!|v68pdlKKY zD|z|$J4epteA1-<{s}QX3(HRg^weXIL5)W(i#_{Iv?xfRgGAl2M@&juT376`amflF z#qYLIfqS)vec}6?{QFzl%i~)oBOvROCQU-VSo#4zZR!>g(eB)wd}+~(;bP7g(%6F1Iko z%KOFaHeRxj4Ms5c%@c4ioN;4KRFi3-ISIg*tgHOyLDrAALw9BRy|cGB_n!0r_9f-D zpSwNDi`kmIZ5`;CdH;#3?xUZYXBo9>gkA-o?##E%&3y$QUmnK)Di1_snyk*cQK zNx~9CIj7JqpXVha<=(@WBjyBY7_BL3&=oZ_Gz8j@t(DdJ8rAL&YLrn0wG?5g*?Lcr zfp^!WI6WR?^e?lk&`{DaUcSm>{cbSTKMm)wQNh~bzg&RgQg;8(4pfck^DrOd4yJQm ze2|;IYYsrZN8NsScscb2m-Xq>{*-7EQU6r0h3|E0&~S!sRYYFgl+znE?N@)Ic4-F9 zRS33r&DRzd`f_(03P4X)yH?X5t zz+1%>l&Z5CVxDfVOw~>e=ETItt=@Yj+g$?F=?ZGG;o+q&rvZoNAiyOo1WrLvXaCtP z!NI|Sy9=g+Un7QSE+=bKQmj`8DJLiE%S?HGweM|CMNO>KL`Ev(B|{+Srx!?Ef(^*5 zsVi=$Mnq(lm`_DH8)jV=M#FdMJ9?(77PCH432td_!}%%%1S-94XenX}VMW_d!N+A8e2n^@EL}ywCgv)@6(k-0M3-x6iU-7q-$4W4~Yr|tf% zY{^7f`|aORr+xru0qr0vp>m|;`wAsOG>q>ty%kG8FvTT-qK)BINjZ4VNH&Y zOAdYOapB^fnUx{IK3-wvB5kHv*HtuoZ#Do}+>4rDqcViA8w`DL@isJG6?*BdRc^~i zzfhVR5Fa73izV0u`lPHVOe)7BhK9FU56F0=l#~K}0^*u3YF}nPwk`2dysgimHLZ)(Y47NwXpxS4w8Ec=ZF&B%I>-Nf?2);!r)H%q9SgTQ z$cW}>&nl^0W<141{nR#e*3~p>wp2%!t6us3qIdbm&(ISLbi#6{{Z%%f`aiMN?^)Ic z_lIdPa~MpVYgef=G9<9PefOI@Q z=)RJs<_0+bp=?TWPPl9UEIoEHR<=*2dg?PxfduU?O!^&GnQ5WPCN|`Z|-DpUPyZ&RWhPh^=tr9KA3N zj*R4dQ-_H1f+k2WkeO`=$p5=U!BS>zygX=~!N_;V(&AMx>X?eVB?+wViFr14C_c01qFqYvYrsre0=!4_xqzif6DrL zdqI$rkIwr2`-W;K3l1}(&5}`${~JN=bXgEuWFtHSq4%N01I@x zIGWw`#gj6e0wEgP+>+j2&FCnCg1E-TzW#oln~+T6Gog_3Rpdn}wQc!y*NYrJ*`$!w_&GG*0 zW7gv*GFXIIBwQ9-TRqkI(q1e!S`vz#p;c`8Q}0vjHrtQy(OeINry`$IXMP?YmRHCE zp*ZSVZ5IYTE(*qGG^dUHKoq>Y&dpoRE6dIp>FnPcwT9=!*IExax3)u=&NO|9gO{gT z7U`3;DYQ0O8x~cCMJOcn!65LnxR8x5| z%USg1^}H`8De0)6xzWAfJ>buatv>&$Qx4}tCp|XTs%d+%n8o|v)V~i3N0sL(c^Wf`M3Pk zlvSfeU1Z=tTwLN{%sFF|K`t@z$^MGU{>nUMBX7BSBT(BRsdR%XgxAS7@|i=Vmsd2- zVIJ=@-cy)#hK`1^O4QMD$?C+Ih@jv(Wk8njmrsr49C=v5YV}QDzL?jj-wC{f7IjV{rrnSybDkdd3=XZQ3JeKRaZ z_HGVh-rfYCfCO%0e6ko?9~qnmq9vjWP8}Vw&+n!ZNnq8z-FUh2|8eyeP*ru`7pMse z0s;yG0!j#y($Xpy5NYWa>6Y#==n|0bM!Jy(Y3c3|q`Mp5Lj3-}_ud^09fP>{oU`{{ zG1pvca{oAO!o>DiD8W1T7PoQuQ(xQ36WV!;>V6CnRF--w4Twqkf>1-R!|!5sC+YFp zlz?uv)3#%6!mK%*1O#G0wwMpehmn<;-Fa~b&Wiq+`Tkj!F&Y8J67Te4!5`8ljEY~s zG-X+>_LoM@r(iHs_}fNbB{}dJU%;`($8WZMH~*Ba=H-L#Y+q7D5Ne>Wd*mOfZK#`n zzR~gHU>Z3^~2f@xr@zNtI%u`E4HBF0yj><^19W>|L2cJEl0p=Keu}wK!mbT)wY)5vA za)mv2SAFGlf91~qZD9~9Ly+}eyU^*KpPRF@v-?H&FZyxufw2?ZR7;ZYrUZ(y|AmcL z4wwVi92OVxWKd5a2GVJdU{L>=G&I!Yj&aVd*&J8mf8pqNmmgzdVjdnIQp;wJRG&{x z)n2cx9A#wV@NRf7WD*tB69SE zkt>#i+1LP0826{=`HPzq$Ib=5FCAF{bEh^hCS)J*29c#yoN+V&2V9nJqWSj+fjfA7 z25q!vJ64iNl zQkj7HpV9zCFbF$IR9lIAzPH{}< z2bv^9HqEKg^szaj2&R;iDx*QS#p**`ocl=b%Ial3aOXBBn)uEQe>0@gBm%yGXv=B8FGtc-`` zQy4dIHsGV4z;$2uS1u^ZqaZmq?R7ipI=(RGV&|0_Gmme&M#O$lR8-_J=;#z7pBSEj zSrpM>wn_%aa7n@;wzkaMTe>({R-$jGVIL>rMFl$axo||5!>&PZ{ zE+wOjy=`swL7OM84%y#$wB@shcKcyzqPQF+cKA%Zcs5_YuZ=>a=~BfP-U4xv&mOVE z^vJfImzF8cSaE6sv19E$1Pnrl{C+Q~d&UQy9* z7(=4x!c;9E1B10^eIOtBPndmCs=T%`TrCpyJf>*|Q&K>n@mFw0s%T_PL_|n%Fep2g z=yuD_-LY)PCQ=A z?O)#&j?IF-3BZNH=zswzNP|GziDEV5Z;(MlPtD!1)YBW@U6$OQGg=t4T>)ivA|8=< zoJIIxcvc|dbmA*x-Zq{ZsXv0%61h6$^VB?@E|Od0s(W2Pg-;bhtp%%6@dwBLPi)q5 z7%6U4b7F}8x^kv+d%|9Ek}$F|ni>p+c?3$`=;2^_id4D(C`C_c zp7_a~m98RBd786#3q0J&&t~`zC{HIvgXzU%e5!z@|#a)UMAl%`}-}gu8i(ur&-b;lBQ5dZ_4t%9ODm z`v|Ot-1VDI64bYDT!TUv5bK9sFXF=P?mVC^s{ju3_oeWRb--j|%&0GI;(zF-#Q5^y zPbwCBX=NIR(=vH7s(=cIqaAi8)@NN534wuZCc&X{cP01N#v$_d)E&;BWoNf-Q-YDi zhlj54)#ezhQf_s)-N}oLLDV+JNkAO?Os9j3oSdIW&3rij%G_PR0gT5hqN6kqE4}mcH8t-P1T`_;>(q&epwd^O(UgZt>csuw(bv@^{STzf3uax1KMv&QwC4Ss zC@|Ezd-?)ta!bs+`uj8NnuDBiI?psBO#EeK&LJ-d^dRD{I*;*CrrTd_Nr|ELNJ~PH zCHDqucSZhY3wxRHh=+To0a+tBBm_KfWw`ZqM`3bYdf^;a6RK&|s$cJrM5M~CjH)se zb@v1G4f9j8vNTNQUmzf6i!FG$yLes4}#Fjbhn2uD})O#Eb6_;?YJ$+CUWUl_@iEV_AA zhSaYeL&l|z#9&QoFxK1L{70%cZKOxkn1@k!u%i-(HdabrdZCHzplc@mTI?~3FD2(4R&@d(}_s1Zi71J8-xQ- z>|%9l8l|4q=A3{kq;Yz^DKzrAlw2pQOo_lVOOmcbqXq9Ll`2NWVQ~Yq0mdMdmi}7P z)QX2h?EZZ%ll3Qm?Sn*lSOk6ydx4NZo=d#OBRehCgFgiLRAy=u%iDe= z75>>4y9*qif zPfKV1Ip-kAAKxD>t#ZX!(I( z%})I%1YWcsSO0lx$LehBP6_8(i=ylvHM<}g36cLkL%(Bqj%p0M^Cu6dm}j4#zOyHA zuQN5Za)hkCd*+z2S^5bmvwKjk^6S4;{}_@optBN}nsGkrbH2MYQQfppsH&y4#{R>o z=fK6kRC#@K#TJDrx9G6bnj>()8Gi|1J7rFf{;gEZlg*-o^^vAuKi%-^&wC@VV2KI7 zz!HO9eMF*wd$72$5EkwjN6mJ*OfOb9n}`WO_g%n$t;vd{ND)E;7*_(FJSZni*$D|h z;TT~{_NIvbw_j{GKc_P$E$*S!06|7K}ReAN$?+y{6KBpK0|N zWG6Sz8WIK1ZPq6~`}p{z2SF?Xo>j#5F)8VcmaHre=Hf!d_C%MW?&;BWP&e%B5PJ?+ zm1)06Gu|b!KU3X!AYELH1C4l$Bg$SdFoK&~!GI|(J-sI*R2*uU`|C|j_4O0g=VVk% zzk{hu!mNFLcSS|++(EMh?L!}*oz)c@PfGSuW?o)F8Yi-01T41a8!vBuk>MCvcsiU@ zsS3Hb$~5;-GHBD{WkR#*)L@0-3zk|uP;N-S z>GVEN{^iTs!II$W^G9I&GlayGt%ryDazAo1$yb=I#gC`X;tbXg`FN~xd)S7Dt841E ziMY8=+5`tbEqOR09wrBSoh3x^@$emHVnC5KxdF67x$DrSfzd%s+>lZ+u<4LAhM@EPb z44`_uA@d5XxA>#GA4-*By2`NYEewqPy}gj}v&*e= zJpk#`>hrTmm~J(?_-{`U?w!~QNOT!NnkFl264OY6S0N1iiDY3=c@74t;I;Ac{RK%H zCSI$Rg>-&97MRN&$w2yUsqehd$HT`*G4H)hwUguc__z(1s)fZ)IFpIuwPM}wX;kQf z1Tk>fUP8E`c9a{(T;c3F*JahzA>Mk|ZlL~j^r=f*dsyDjpFeF5w-y;kCL0?;73db8 z5#4JA-F7KX-Dlvn#4HVn8sk ztR<$U#bsxwWOqo(&Fkr=eb3mouqbS656_EmbK}?!(Y#tP_gRhE2`f)NGpU}1xi6aA zUODJV_S>;iRtT$|SJH%(tg<-)+v+JKc8=zmtRIr5yyrH7a^~n%<0tA)&}TxK_@nJz z_ZB;^cvyUDhVyFUtWdAhSN_aS4I{1AJAfGE@Nud^w$&y_-*nE!waQP0NzQx!+4_+` z>hptrA`<*(nWM3-C6-6ok@(`YRC9Z3O?w3qXPjU%oPTdk0vJQ5yk`$*ZUGY;2Ia;i z^Ni zs4Wiy$z1Q9LNq10**}^_s^y{Ve*oHvHnrXbk?qt@LO_>-_KG0V zOG^ejvx0r=1}iHo3JMD22rongX=%;9z1yS%|B}EyoT@5aA>>#Zy0sQJv`CM%ii&B{ zkbf1{lcol5bqX=%i3(dH%p#M?LQw*7G_)drUS-OA*$M^4OFrS@!-aZ5(NR%6a~~)u zn&SD8*GH{iFq)s8+>Dp_VZB}j+e=0T>JGT{Ic268F0ZBY4F)|sqLu9J+0;2h%hKiL zam?oNMisyl-APVLDl%SuTz+a~MC(UX30cNlsUYpmuzRP6^HoqEvsRB=otkCFSCVfc6Rho-GWC!Kn8p+w8a&2{T4h}AzuPNq6E^Z;I z$9*d&Ma_q(38A^cGkCFs`Pm$z`iZ%S%7kKe-|+ zbw2-UqR7J1;2W0NzlOR_(u9ZOi!w0Ic%SnTwJu^o8YZMpVrN-EIply*x9gO@M!DM0TM=PYE%M((Y@75us#OL zEx$iZOr)w+S9N!vvwqYY?BL|)CZ(knWlYS;;nnZ+04&ydx+PBlBEQk%LjeIhLyET) z{UrlYJC*lg(O(!z&hS3mxDWC!Y|MQHc?_W{Pzz=v0q&!fbq;+wWh^ZZ&+OXx4;L57 zqO7uYm7Sf!-JL@CfS#UjzP^^+T===sl9q5OZ{8>?DS3mSc6fOI63#CaFE51jD(W2m zVBgRyK8VwnhCTY1Lk)+Z;Uw*AcwuqA(PZ%q*z0~Ax#Q}z1d>pXd(Y2@Lp&R1%`)2W z1|+?P&Z^Uu&1GKEW62)5tRV40UTykirZlM$?>>E7C)F-`Hj}-cEw3#&x7d;+-qKL7 zpVXmUnMn3G>6A6y%)`xzQl}bliY>~m3Thp@$wWqORkTCd#E%C|wsS*aTYwyXJ`xXkD#%eFqdLvt8Xhe?@%S?QRRvzki9`?X?~W%Ah0Q#&*- zpWEWL5lQtjcAdenJq|cN)W2sKWv^k&0wM||3ILHkWO)C@=aon-4>u3bS>Jal#u4H; z0b5&OpJ3>ZAK_}uG@9MQ#kHQU{rvg#=u~w56zO8)P0jEN7&rg2>nYtH@s~%v(qpkP z6)uypm#M~EuE4|wC!86VUaWthSbtf(E|849iU?2{Ttn`PvX3tKK!^3lc z+rHGFF$gUK>D9OH+`fJP)(x0=&cj3a^QZAdxivlaY4Z2)ElEPy;ghlCpwq(7PeDc| z3mCnU5+}smJ%2=fwUoz#2-seEqzU@32?)3aa)aFb%nWv!#iBAxhEmB-VlEqyr{&S@ zdO=bKJ)N|(G*!bFULfr0i2mZFl9j3a__U}tS?jNZQO2^%pa1P2`*omP=K^aMR8 zE^g{z6B_{!rU|G!mv0xBkkFH*6e{40U+E~Ct%`<%QB8gxLOg92py?~++wk(bZLF# z0g#F?h3t;{96-{wwW~--G&D4fjGX!#+}uc>x}9m?zJaUpzIcD7R7prEdQ}-}n1S{6sMc#M z3;hQ4p~rgX76Y`ue;c5nyydh~uC*eGrKhGI9JFpTsrFs%Z*_;P3I}sDPAJIDP-nBH zBPRNt;mX`^hLBYRPkTSDxc@nQZA!rALY9-^Jc;Nc9zBXTN?SWkc#NUh*Vx$5vn|(T z*P<~Jr}UFgCp$jO8hqGBMuge|G&reTqHpB}pD`bZ&+1r-$pYVLPCFz5KZ1t*SPv>Z zPsM{kz!fAXc((3>xM}by74>m&S()4Syy4ON!Ryt^z?%|kxlPw$4EaFA&*}N^;+B>> zcXrSWQ20fx_mjRM2n@>gV~Ic!+IB?Bk_8Rm2kYQ9?}lk0Q2lx%Oxu<

    {^)+>OHLd+=PU_(PNB@>chdC`bHvOU+#etlOGl({K&lT6yClKl&2{M z3`oVJxw#prZq3Hd{~}O5+f5Sl{&a4m5u1V1B_1o4A0IY6HShU}Yi-*?zmX?)`d2VV3V(5Y6BqSuB&7%K4$;XHxRHoac$zcOkar#Oa$7L_WF@r;@IUHbaj*)b*N_wV1=Cn^Q=&FVcOGP z5k8%4@CzQKGK@E!1pSF{QC#))m!S3n{yyw3kiJDePJ&i2peIlk$W|_mfL1(lW6V^s zXw^zPsA}BA4F2}*nIKHolI3T5r?W`E>b6|DxBDy-Prlh z0E81P;~UEj^!5+-_J?ZdtG)3}1^c~)iF)4f`vdHsNvXj7v(|>eX*RR%ZwTwm{f};G zTtqo9Pw~$>8)r5ju0-o|O!J!3ws$uX00EVsa^rf)?Hkuf@{5XsyU#W^Hz9)uy8?Fm z@}6FJiHM>BHLLr(lyEWjcY7ei^(63v#Q6!JK{}l=O^rM;-1Z$QqRSaPPK>O3riLps zbM29~c6MWx_Br;}yd-62vs6;!IwmHA5cPo_%FT^bS7-bDIS1&%hsWZ%xz9>UN`yu3 zjs3tRdAiZs-j0S|C5C`%Ht=+CnZl!@PF9A^N%VVDEFr0t8gH84KHgi+N=U$Z=)ld+ z-cVcnQNdxZjXj0Aqr1DiDYY_zWFNdiZS5d2x0ec3g?o~{@2BtNj#k=Z_%{(S>%IW1 z3aO5(E59#py#2nhfB@3Rk2;>Z3thDw92{-7j*Yt)*3`dgdAvL{JG%oCt5|M(x_c-X z51${j(lceyjh3vtgoi7*qp$LlK%oyWULq`v@`u^1{$RFB*v$;NbI=Hkd>Uq9Zca;0 zU2eBK5=0>mb+^v>Z4jb9!7IHCty~IEHtJUF_hSwYm|^X6BsBlju^8<6JskF4MZm+? zF9+UhS(yV1iyrF@r^wHrfs-B~!sigPv0-mBNBVbp;%YF4U~*_udb+;0_LIa@5Mc61 zQz+2>-}03qp)LKgLa`JdEzZ*Eh^qCm-&?8D>z#ux01&N;W;f4u#$WjkdNsYB)^7Hz83F% z#=!6-Aw%wS7#f`P@kBvu*hM5Dh||Jl(=$H4+MOt`U7M@U7bXuLNJvaf8wI_$x3|P_ z_zfbO!*XXow&vm5@@SruBUF)!FC-CFB-|3%;&z>_PDAlI)q*g4-3m~q3d_H3g=)0I#hTsUTVH)r{y4KpQ_a= zU`Vlbzs!`hr@h^Dy8h)Qv^m-yS)!_-pf}UV&glDIL&Iu&P9@y!;0{p9&(2Umc9d1q zgZMu>dh0!&_h>G6;EW9yt!tp10F~`S&V$Pj>N5kHA-BC)UNpZ77#?ywh^GDVm?Apo zffOepQ54MQjz0I{d0;385m#GhCq=@?>&Vag9TD}vKafQqB_wKir15*RW!*8J^m~*5 z)(zAPo-rvXD6~af6zW2A?si*GT27gjA|V~Med_AU9Rvx0(Kk*=W~X+ym>zIi-GSq@ zFj9mXWcxlLPJaZfbI5pafPP&g;Li_zrdL{$*XD`M$vYonvXY2oOi7%p1A5t=asnAd-m^S$`b#JMz(q)L)1oc?@4 zg9G$Zi?uNYf#ZJ(>1)_$4WOBVilVx|4!URQKdm?{iTs-k1~L~LyhE|DZ$bnX=x462 ztu1mGRqu^!@}^r^8DBb@jfrVy)8UjjuE2pd|KaC{UXYo#P^5Xn3V{g8ua*{d zRT#PY>>TY@n53lwKR-EBbFW3xiN0>!G zcZG2|-Q5iEx_$c-6q)V@fG;mCZCD&$1 z;}>s#{~QKqLP8@*JmEE$921iby<3=`4Q*czVqfm&B}GUkT#O3)CM16UoF`=xAsFl&7I_kP?trRFs9m>2Wm|hZSCuk|7TRBO@v9 zp+FhoUSlIq_9ioVDB<^F9OKeMfBQ77id9P(JXY9mcEC{qSu4?-!pfOjV;Nh zn`~`$T}4z8H8hw|brlv)D7=!DlzjU1b!$t@3|Nv5GsL&ZNMQs7L?Zpl+jFAUD?=|4 zY{ts|etu6906Jvn;9xae*aEZp^(z6J@z|pTXw4>gu<+(+=H?BNMPTioogzaAb8jz` z)A4G_ed-VnPR@*s49tMa%JJz2RD(8R?mX`- zWvV;?7Cd3J^XP++ZxxGEP4fmz%gc8?0rB^|IL&|v)8KeFkm1O^c_SVk<0OI^mqZ+= z$(E8YNrQunQx&4z22t7_eCFInLzvIPJC}6%e5O$E<5X#vwTOm2`|zh(m5Zo~Fvzp3 zD-0F)6=bDfmUu2|#*NLdW1FOe0DM{cI z?gECX8!|$|_Ae2T#EF#R^TCxN$id>k*m*e0rKN|8iY5`qm3F}mvs7C)>9D$riuhh$ z4+CB!5Ui}S4pk{3A#R{BvwbTba$~H3&wQ0`Xet0qLmTl+M5;J4iVK39S}fO?f+m4r>6W0?OLI&GH<7W zu|!Q>-69CHFocEq-f}>Cnv$5w;n$bT$ReN5;}io9{{Blr!VuF|mLdN)9P2F)+| zLk};P>;)B_@+~wpUv*CJ98o(v0r??O5;H3+929;qiGY!N0`{2jLta`z;X=77IT=Ru z&n}I)umivPjg%ChN_1*EblqkGJ-oh+DcI(Y$vSJGDNq5!KBlIof&dj0D-%;eUS2>Z z+;FH5G%x8H8HpkS0=f}@rlwvXAhl`>FX-X67HUxj15{LU=gyAj!a&xj428+qt<%5{ z577moHBrbjBO#$}<~t>|dAJZEAt+n2@7jXP|?%V)8X8|cW-uXP6sUg zJZ_bf3eDm!E-vmldCTRE){FuT6`lA@7*eF<2wOwg|_}{o09Op2=vJA-g-z#s8x6fRYC+wfV;c9&)&aM;=!xS z_A%5u6^<mJ{Hq*T+gh)j?5S{vHt#jG=$1Juz5P@LHPcslC+O>7}JDXfT6WnPC4$XF00G+Yw@}OB{K5+l$I2X%Igv;n@lI#w+^#}BZ0(x)ZKXop4xdtGy54$! zkE-L2RDD^gR3yWZLUwNM#J^MJ=*Y=k^{8GW2ssKhmQIU}$DK|NJYh~U6t-!&%;#3V z+zx{7yw0k7pa;@6l~e6U1_L)kLjj0k-1TK;9YBC4fz^`qyO%FtYR_fBt*#Ci>=$S_ zc6G(`h1CX<3xm2`T1rZKRu(xsCp_OaD-&y$ie=9PD`Kac}#}{1*{HSi(~s zqozC4$cJDy7|?~RX&dk{r(+|rA|dDV+vw<4ZSp;XYeu{$&n^-sm{ta%x%|K z+RvO$p5JtJCiZWb*&Hd_h8oZh$Wb7i3$!JUMIS9*eUvberS#?r6aXN)@$~#uQ**wv zK)~Zb38ks0qOm+IkKUz7P>xkO&OSb|kl&YlK}Vk<|; zPqvc}i#nY>g8nf8@@N|w{kjZ4{9|LS3$)kZp&J;8{TF^vOqT=yHtKnv82FBH=)r?m zoa~{Sb2Ew|Hi|1yNs5b$p@;!x`+)&jDQs((%TIkl%cAvb1H_A$7IgEXUlWqzcoXx8 zz;yk$s;cS`NTsJQ#l8G|aNw*|GYCHh3I?{9P~Qb1h1bJF?e4^s^@Gc(m{y1DHl3k!?%;5tBIJHjxZ8I62vYZJ+nH`LXY zr_J{CY$-MWNbKl30gAy9OgdID5nWX^CL|;U_D&KJ@G`c$;!lT%hZ`CiV3?PPMxFj+ zR%7M;y%;(=v~)UX8pveG1Cp#^Ug6@3iexkC%M8zeho7p7_jgmf zm>?v&R&BRg<&`2UQ{%Z`dxwX2htU4>r95pzLoSz53!AUwu~=j{9+cj8{#ER1*lyf( zssYI)1PS=!poTerB5sHXwxKh*Veap{Lp}>6DDjvIn|cpbU;O@akJ-sW*abuKFXiRi z+9RzsG;S(qgUrpYJI4BOMQM3(u$FOldSzvnW?p>!@6dWEm_dH;bdFCKYG7ovyH^1Z z3iOtJmwCg2f!fqR;M|jt)jl{dH+T>N{vBR@q*bxt_g!5Nkp}@=$HolsC}k8AV}&mu z`#ee5*^vV(vYTr|rb@XO*-tkkWi!J*dS4K-hsC0P1cvPOOgiU|k&KKg#;nLZsMML>66M|T?4OnTG7DsY^->9SbXF zb`HmIXoEBT7=BuXc=IMAG0~Tc6bgm0T((6&fXxb_loJgq!)m|hjlX??V_Nb22wX~3^kb?vR5x3*Hh+5sb3KSLX^>K)wm_bEuU{zk%m=Pp4BgQ_l%9Mnl@{{Ke~7)?@21l;qJfU0X@XfpAY;77Z%%+0pUItv)c+2EEtqQy=au6F)1FfEL3))kV3B9$4t$l0LiLSyB$G4&D}hat_NVf`=70N<}z zZbi$;!lKEEX>|ix(0I}bbcu#XN0&E#2SeCwsB>fTp@xQ|^Lgz|Bib!=KM1>~ryG<8 zv&ZM>=d)7f^o-iA%q~7{!+%V9HlGn^ZIhgYn>&Cc=EXHj(GMRGhMDjB)5Fu&f&$>) z8@x+cjFyhZt!cYRA!C10_V%sn(6B-?Z+2GJ;pR-Jw>Q7OzM12du?kyY9`kScT+-Do zQ2{I=gf1N?C#U=&fHWfh_CEaIzR@{G${4ACzuBMhd$fdDRK#JRIBO8z;%&t(FRx$@ zj^v&ZH2v^5B;jNI?Xy%z2h97MdNC14TMOOZA3qLmZL6^vKV&zMwI4$VDmuI@{YtEZ zR!7h0*VgK-NYqlN-*@}qQU9!4-?X6;`RjvTcb}aKD|og_gMbN-rKROJb6r|mG;u(0li&lFKRj@EO;K-y0i)`ciI7ko)Oo)7MD0?do$U;8ARw&KxNz zMYeEU2Glj7)Kpa3P8}{wJj0MD(^F9aUZ&g`LpaoNf%hdf4h(!c9QPeVIRR=P%-kVj zNC+)04R9d&Ym{E7T(BQMUYt=SC8h7{Fv!yhig8!3BfWOixx93j&PO=jV3tAgw8n_6-)NybEkB^hwfc{9Z+5#7^^m_(@6vMmw}wgZ(`AkeuSfw zKYxa;R$RW@#8W0Fovt|0f0L}L${OmJUH%rS6qlF?=y{&~KFMDY?SKOu6J(Kic#AE( zg)uR#u{n?La)m0@XULgEbJ<$LOovkb%LiZfdJdxw$%a5`iozS+3C74m@pyY<d5P4)ycKpW}eN?M0sbPXP@5Yn04#)cqmzz!oa}5EIPUE zKCUw)eeuBhTw5DOL)-NuQYqK#y(Yc?vVnq>biCZ!eS5xyR{8nw+14(nQ|%w+_6?0s zK18El*;k|w`Hu^5alKQ#_i%7ZOKs=o=74kk(=vpLl8483r0_oE2J;*j^!oeOyXht+ z#@R4)EouekE>d!FrH@%z?=D?OMb*F#;+QQK{CneRK3%mK&mY~r1tqPlq$IM<;Op0} zdEC1BFO-pZ35l6%WtlJ^U-0rHt&H50#bgI6;X4K@ro|Br|Zh5%@U7P{lBBMy9Q($cA>vLJAk?Hz$lK^;(gISTS zmUjW8qgp#Xe!$Ib#LjNqp#~)63iElP(pBTyPo}Tb?MhcKBRHz3;NFmbg63yi+pqUp zJh3K5Mk+YTpZ~36b;>Wf{nPEvR;aKw)RXmPWjt5^wCi#ewN&iJ#`2#(nkvd1drSRi zW2K|W7%|m${ni^(+1O9+K&!(aj!Wx!1v8+^DT_&m6-deEgh~2}`I>>***NGh661ve zq~qyw{spKv!QsU4I5M%YBsw^K)_DIGdG#VXg0*o^Dn-B2FKJ@~mBpZgd{Jkin8 zg1YwEyb4Sv0G&a=dB_`i9gprkc(8M@$qO^dfYI{J!oh{{9(K^zu&`GMO5UJMRNOU@ zn3dXMD9xJMz}x?-oo>j6L7g-DkT41$?h&2EKiq?w`CD}RzX6;J)fK{%xQd3RCg60y zTqt3OSx~{oxpxno;@^jH<#}jy^zve9iPfqii@tRGlkLO9o9-BDTs9jO2?-|&{MaBP z4{C+?30f^_u6Vwc_!|2x-We*wC5G%Pzw>75Ju{ro*t6GTdqGHkI~1?3!dE4k$G1H~RdBm|OXxVg5>*>O>`~{XX4F?e%J?hmMYncuekY z#H#^`h{JmA;Pn31_I4=kF*TQRjWLL2&HnjwS5kLj6rV++=X!9>K$hS{l`qWx!5Ms+ z?on8H$I?=U1fT22sLNHAkz%7ZOA@$ueKHmnQZ_bmaq-BEE5Cku!DnM)GH6vMQp-7j zRIj1ohv6SylpJI&1*4|fQh(R`1Qi<0CLpl*_Dve^{s9ZHr=S~Pn)+WTbaIb^;&^$` zx&XT&J@DY*Pm#esugzVM4k}Zxt0=P+{ULTkLM$_j){j`tda3C z9o)Z~v1S0pn6CKG%K)kb25wD#RC98w%A|49Ll3U``gq)6pzmPDA4eJa`_8p%s)U?Y zho{F-PpI%nlc7e=zG&{1=H%h==jPrYue6sC6?M(HGdJgU?WMHB`t0`nG!gg6Q_86? z0)L;t0mDi5wO^4h9z6q*rl6pWLvd*I{rK@Csi5Dt6(Dr|eO0G;$?Q9xogDsYS%$bo zPWqc##ZZx4&fY~S(ES>v9Qc+s((HY1LSRG;cefbQ6lXG%(bah`t z!6KxigV4cY4F>RpL-13aqq3|pEg0CJ!3}NqX)xU^s~_qp4Xgrw592d3_z)}x11sa@ zI>WpeS6aFT1|CB8IQTUE69iz;A1o5X^=0`HTw}kSjg54B#L`3AeN5QMwXUevzwGE? z-U7|CN)5d(%g;DdVnouktA(cnpcND)9w#$yuLSsv7@bNg&Q zpIuN=0&u}6Pa(p82G0?07e?XPu1}l-bp%XWrb0o=^gdAhfU&3BLpDg9EtL^srOv*v{H`yp<6lobWfp!=)w0+%TvKeA8-~wFw_$Vj=^^fd9A%fF!c|vkcNRPudO4 zzg@75qoOM6>%}=Z4jSV|0^|Y%uj*;$K6>tGcSHR|j8`xv{JfJgcGQ;BaaU;fHy2FJR08CfQEWEOGG`GLtS>Plw%JJi1Ff*xO5*0407N+pRxJ{zZ9t>I6U%pqUA~ z5(pLY)$7O|uI_@Sgh}~jmdo8<_sij2x3#xxkfyD{p_@{ktm^1Z#h7RPTw3}V^Y)Ey ztwJX|ySb%)`{|jWR$a%x*PCW{v2;{Vo}}dFer=i&a+rl%0)P`-$N$#vjd&~)c$D^N zPPgSpft#Be(?3jw2Xc73vQ>f#bV>>hhdq`NSMCc3Jz)i9_y@dBAbE<5j23Y^CwgP> z0&u^Q{sUl!0^hW>b9S^6K6fjih&)cPTxNYjPJTMC0fe0z)`4slXQ(1T6)3+Gb)%e- zsesLRXKkWVba}u}S?4=5a8;mr@uPa(TwbKn2s6~GYAfyCm6bWnV0hz|D^z!32K8<;uxL5DKA=6qvi^N7c*F z%S9osip{d7ROP^dzkl_F0&*k>sR=oY#e{^^|1`TQ6+i4~ZJp-;tAFK1FgZ1KYs9YO z!A5+&ibj*)KyNQpVuy3prPO~rTL6!%myp|zY?Q}t=fDFqQ9SCoCnIm#6m;WMR^Wgp zrr+|T`=Qm&&1a`NxU?hRzHWH>W~x@s&$hC4bkGg~3SA_d_3(N7Mb>jp%F6n?C)pmN zhp|QpS=qkcUb=Fg7V9-G2If8utuOE^@JfE%3ggRF|C-`&kRWM>Iv#FmfkyV{>pY?V zvOK@<85w4TzpWjQz8%fSMqam; zIX+!((8+uFM?6eSksg^@wq9N+h@CAhU6?!k?H>Dc2R(D#yBl5}`h61VYLh-5`32@` z)i}9kq{6~d1M)P?JKUJ?x$^Q4uqE~NkvKVJm6Yo0lh85ApQIr88!#oKIXI4viaZwT z-2H`wUXe_1`YTgnm}$?wF)#6s?`Kc%9Agy@aXDW{;U ztnr>aBqy)|(rjd;mr| zD$7WP1UhR$KpNK{@+C~1Jzo0WCVx+2-X|C4_9a-}>86)EjBvD*Q?%~}xVmB<=k2eK z?&IN|n`;i0LqlPiWa1IxTTsyPQm~5$JRw^yQW6*&?6ALf9hj2+X-b0#2ZWSV``Fl5 zkH8?;fB<68G>F2A43_UoYHAvqnNeZ(=a|SQx?y2fI?=+Y!2869M_MT8PNAXu>#g5H zLx~?gd_p8(@vsW}3B(U|?$1dWfzA-Rg-M9q&G~1UloUm3nh?sex>{Od2*}9;0$i_N z&4C%mhK5UC#MIq#Qm=ldE-cs-8|+PcsXmc>0N();vc5jmbf@A@G9eaLNMz)B^s@wO zj|Ji5Wws9v4rU@EpANiX5^HDrVwID-$4`e-^uynSehd8FJ#X1qSl%@~etw_=_+xnZ zWBb0($X87!Zh;*;-d%2XTH*LGm09iVQCzHTmM8V zh&Use^Ry>H>avLm>(;OInjAiNZLLDazeh$|hH~Sx*?l4+V`F1FTH4Y0b3NRi_8FpXWVw*TxvGBZIBhYOMeU0Xa!G+u`!S zD#jfLVT4YHp*Fc{fliM4O_i%xQxznAGcq`-X*umIXfXki$_qe3vjH!wz>PtmH_+D6 zYQT`O4%Hc2Ow09&#&Jg~n16Gud3y92@n?xcckG7~!eV7;)_mTfzAjU_)cZcl(ZR!a z!LRV}60+@LhtGR@7>C^4-1N=N7%>5_rlzIkQ#=xORWse3hZt5xr4nd!C#U=0A=pw- zU}*+7c-k@?1+F|QN?A&3J4=bJ+GcZW>gD>-&`@DvVY2WzP!l!PYe^GmmHfDDv0fv} ztx5~@6Cf_Vd9#u(-JlxP%c?4})xqKHal&t z*$bpnL;l)^)iK+i!NFLMV&l^Ses4EKq0?zCT$~3n-X5r-NN;R&zCl1QxZ&W1qs&z& zqMnOl)MC$AA1P{$4qg(CE_-z%x;DS>(BP$lV0Nl#t@pfs(R;8hmwkX0P_nPTXIbWO z*pZuyF-;m1W6$^MXMG*arFqK3qhOKA8PJt}I2%|!Jz;_>6(Oxl?w35~v4)@#a7 zh{W$T4zktsn$urwPltMs7zB{!x&hSmsOGDv@H;%@#^q&9*l!D_=7g4>?X9ihY+J5G zc-D6%6%{9b*A2U4lrJypsg>qSoydDuMXZh4=9|tuCW+v%Tu76w^jz4QwFiInIN_<3 z8%XoHd-xGmTAZB_!iIGe>P;!0?mQYR&C2|?)5*)$)c6D|AZH!M2z=}5WfK14=`H-8 zbYK7n25pl-xK(0oY*0U017YDr*{;Wd_tyU8pjb?W7y{(5HJll|{Cq+Or?uNx&bA2| zO(u^1{5iL|?tD78GB&K&;DwhNWzrtuh+uw?5VxuUom9u21ugK@=!6jk(7EOP1b8`l zB=Si87g5%IWz9c=py9$@si=$$zLj*((L`Zkyqpg&>oP)?xetk>GO$NcQCrliqdMo= z42LBCKgpAXp&`^2oS`G4-ty}t0BE^-K~U3YBVb9dw%etN!a&|Yy@R%k{!rd@sSk}l zXQry^YHNrn=57jnz6)rD2R^x%GME-mrZ0UT|45Zm#Go(DsnRYb^N5`5Ws21o=jAr8-9 zr;XzvFCd=J-eP5ejA*WtR|Wo57D%n{RqCs6U|GI_Y4ff|5AgBfZ@sPoCn=BpIx_k# zbabcFqjm`G@!5<;5O2?U!Lz?qRrT8~H|S2V4SM2RS?M3eZSM!%!)=|LPE6W&h*{Dx zIQv#$c8#w_)0>@p1DWAY%th2Hs)cuL2asuFt^*)pG@+k zU7l(Zcp~y(YP!dhWdM7!C@oV`NhxUcH4H>XJlGTQOp~Q;$J)eaen!8^xVthu(cLZJ zAeb=o$Sxd4i!$4MU>ivF^KA=firCe`CIk}@7;tEoJjh{bG31BHF+4reHbjW7wh9|+ z?UMVX%!QUz1_f~wd{;Scy*&w+wK!2ph?)0ZngqZutmP>Re1+V14xXWUFaa$yln_u? zNfMtTmK?+bNiNASR-=c*bn>K}BoVAeLmR&<>n9&erJ@tEW~LqlU{>l3d1u5u>I{*Q zl|4D%FZk(!`HNPu4OBC!O*0W{qL9O~J01xrDrzqepc^I$`da~AXIkA2ZFv|9VFS!L z^#wSUy|UR+EwEy2E)fxLJfA^4_{KqRbYy^f6KQQI@20^%g`Ff4`U*f5QkxJyH2;kh z6w3FUtE>)sfDtm9)BztG?|M~EKf5-8Ej`w(vx0jyh^L#${ecjh}UgvpUHIX-L$;fWi z>h9;#ee;RmY`ZHmWM*uJNJVR*uQ|5s-2yujjzb?%TWj+2<`xbs%_2Ro`aQLJ z5@m4AfrAJ63|pa%vKalHK&{3LP93u3eXP=NQO@U{m z^6ZEGx91gxrp{3L*ZZUwZOcjl$UiLNiRW9~#y- zu{j#e`9)sj{CT4lYh@-=GykE{6;X9gm@lKVW-^tvlY#*l2Cw;G_ZRV3-}y~UrcgZ{ z6qZm|UoCL`+SS_e>0B>f@RJo1R(|-fudKwY&urUKrjR_b2?|DrnbC}OL9^T2s_6y2 zc^^JdcvBm!vTv7>h<#4H)r7dIDbMwDXh!GkqR5^4Q@AE#OI}`f$|N9cuke#ZFxkR2 zi)YnH-hIa@2M*+&G$UCgM=a@&khvOls42&My3rC(dWTLqUKSG`%^rU$A>z~v&tFj} z(;VnaGh9B{d=Yi6OLKhn4?EkY!akH)5MP}Tg})ol171EppV35sKfq`K0KZo!>VWVH z_QGnf{VLg3rrLpic%_X04}-=!A#=Tyu&|TOCWLQ}ttl3k6PBX(ox0QgzdRXp)v_#Q zv4w#R;p6$?z6k|FOvILvCl-Bf6Xia}F!n|i(7JzLT7q3^^xr%M&7S)C@!5MGv)-p$ zs1N&JmGESs#};H`Y8sW5j9_J-MB(tSt@P(lrquji+JsXgsavU5rzA;JW8>Gu>=oD7 z0$^4W9~H$q9Ft-`^q2a%ZZ(7Y1Lv_Dpnh_&T)CdyhV5ODR&YQ`N2i}C61WO~iHG&9 zU4G&5@qD^(+CZ?EN(v7Mkiqm4dHL@WAGWS=sJ3N_h>%FE?!;;(1fTxofB5>fYrrJl zZ&d8NM;>$J^ALYT2o`_?ju+!|F);}t2D!v?2#`S@*hxm`^?-x;bENaW^2+gEx*cH= zx*Y16mDLkZ&~KnQeW*IqkKhnGGt`Sl;jbN}yl?1IY8owSKxhRiBZC}3Potuaj^*|1 zDi<$)0VHD34eOLxWY#z??i^_U$ex3i@WDOxMIgOcKUQWEuv;n1FcXnDt}oa(3KOAo0}Uy@r$|_*fBI~ zA^xaijXRyG-=(Hn`tBfExV(YtIGj4k#MIxNZx$D~ZKR>LPk{8AloY5J&aWh|S+@N7 zQ!V4)Iy}@9v6)yb@T08x$4t3POIw?4@808Cr-Q1E8zSGuobIgHyqWTyz;Wc0!izqg zv&|s?$9_q?tJ*IGbZ@J%R{pUzsek{H2}eWV$!)*>4`AfPZ<9Z;%nl4RBBIe)k`CXB zxruFVy*2N7z@0lCe@hu|+%SPh!2HD1eK(|~FJZQUYe`YjpYHry68jJOn2)t? zlab+Ra`A*w#mxG`SAHtjrDl&qwNEFzjo=s)!n99LE{!@Xkl#$gmCC@tJ<+~MUVZzH z9p&(C`uo@U#S3BU?&5FDuV3$lGy@}~WdntV`pSbbSfutUhL3!|&zxmBR`>0rLaa*b zmoLU}*`YshKt=+(!;`%cTjf=dDBG?q6#DTbWsnmAAbHl#?5FmtOTS$AkvyjVOUh7< z-0W&;9KX5VJeU_!mNFZ+Dw14&-;O@Xqm);F*lHj-d;ECPdG|it(#;#0M{!xA;Iq(^ z?DtCZpm{v)$XsP*wIF9udofb7)$1fs!fPLPCMemhE>{y>9dQCTf5B?6vz})C1IQW6 z5EvA2{|_!SXIl4zc=P_f<P ztvD1H6{Vx4=RF%cWZ{4`@JT?h^Ru-1aSaZN+coQEK?wz7P$<7Ww(Fga4U6bsH4u!^aw6t`9 zJr5s--eN(unfl}V_e(aw$aV4vJ|OcY`IAA7kdi{SXAgA{*MoxZz|~Qn5YlHSkL5;2 z>Xp8~rba@HUnkhBswxedn|cHabCGBO-h-S8joMT1c36#Gs7+5GTc+J4adk(aQ&x5j z4MJ&Y>8>1Vk&$=R1F(=%Rqd60K)j=PGh?9c`*($~H~R*=x}L0$h=&PK0GIAe@J02E zH{0a1;WTdj;RSDo zn|MynvysTZ1jjgDJxi^u6q<|Gs%*&DU<<(0mYN(hFqCngnVA{G00afIlwx5arh*38 zdzZaOX))Bpu%q?j%t2^02x5)DdTFPuuc$>V93*9?yc(Xz$;Gu?^M&-^KT~K`iC^78 z1Fl*p*r1n?&;lgWqP_Sm2aFX2uK)P<@|^%s$3}-u0{*Z~F2rTer&YdlwRN z$uzO%cRDXhh9Xo}_M^XBvBmBfh%gN|#mb}^85a2PoUh~T8rUKq2KNeIzqRTou*$$I zGSJbDbfefK^hKfP00#2pd zy+8$+3u$*%Q%_TCpvSdigGomPU9EN{n1b&q;}?oPkC+4)_eg8@0e>+9Ewii$v}KXm(T=0RkK|IGg<3z4_` z`RgmMv51h?)wHsk-98^aU<@0pXzqY|R_a~!+&>=?A>Y~^h^Ba5*ayfF{*LG11iBNg zRB8TLFV6y0#RX+xwk|G*#Knc#+0B^#{S&bKQ;-75@>rV>x1qk21SsvLm6c|ui3f%M z<~{$2uH7H^y|i^6?xP6#r3D4Yfigv-$p=aSaYfS5(th}S8a7`20wwFvE88u+<$M<= zEj|3{Q^UKGo5VFqkSFVT&2fTl>vOThv1Jz*Y}b+!z)4pv?+_Ngcrpg{{oR!T!H0a< zCtrT4Yo(6^aJ*bEEFZZIOc&>M2KmiXCMMSuBH~;;WNxQFzLaZc|CpYHu=Xm+Y#J@l z{z_HRhwooSkL01|MN(yg2N^7oY17EZ#N zVNQ4uNv}pb$L>CON4>EM!_50DWMCM@Z&vh}emgEb_|fGncHqmz>9IVfp(z44M^>sF zP$?3KjjyI?Km9~C-G-r^7$T_Uv%`TAqr_Bh*0B>Cy^1GUSq-(d&@>{* z^8+gIaCKEyjM*;gv9$aO*qE%6lFr0kio^by=%G8T-_r`UU-&+N1&ZKDMM;@R#404W z66BlWH0&4FY^4EffSuk_lBj)GqT$=eZCNd-+pOlJ@U&(}{1e^*f5AE3%K?;DQ5%(< zUR$aw_!vmNPw?|YQuuBJ9hi^Tbaak1Q=R&7PIC!^Hg4D2ovG@jC4%}Sl9D4`cXVfm zg>iPJ>u>Bp!peCp&nMWwuI}z!TwGY5Xm;i2=R=0#-R(z^w-FF%Le<(Qumk;ON-7if z6N87EPokm5rl%LFuczqv&!1V6!?4XV#z?)l(*Gb-jiz{tIoIyqHJW;$jE_9PZi(Xp zDL@9`CSsNpDbN(ta*%<6g;Js``{`Q`ptc%76BHEAaB^x~ycp;r8`z##HK6(0!{G4Y z=KhVZD@b-&#gu-FgG)(u^@kC3f8+~Y*Jsp;tQ=}EOd2NkFA&?vRRL^gR9mIEH~A}y zoWz6=oE{fQO|Ctz%*)H$Y{u@6+f4{#V_{)ti>R>JgS1UdMI~_KT~$!k8UL<%zZ#du zR9?+_JM~c;SZ>JDY;dTVnl7x61XB;Tw?NC#UTIi~#$S8;6|zG$zQkDiu@1!}gQ(px zN(n}x^h8;DbtX){^LYRMQd_DAgju%~y<7)7v&C5$Zf&XN+)i*9zBf?y0m4wd>8%Hz zKfkCz=Ha&X?jS+z1q<`nJPYTtV@ym%6%`I6`&l4#86J9w8JVk9OcyU2D=2WOq?o={ z+pGa1Egw4`^deE}W@{n015yurVi=q_8W7Vtyq-yEX^j?nyaG;pH=lF`;BC0{)GktY zpwIsuodnVRlB?^3wLInCPh!=x)(hR6?N@nZ0PhfcTnGGux~9zrjPU6)fkNqKx@^Sb zQb<@h>Ds=-xG>&4ria!q5A`7v(~ccv_=mVt#BR~-+b4Q2?=*$y zLqxTH0jX<3fy72r*PZ;TD$`#tpXAnWLrF<|fjPkdM+>O5FoEQFI%`mMT1v_-`Me!( zH-8>1Wc`G`zCqFd>=)7Ii#crP&s&yx^?}>jmb%)K9CZeTV|N64VKH~OmMeT!N17R3 zUaO@)nZBg1ekM+Q3qf)JrTa_aGMzm=H*|D%q78iyE_YP5LV@qRn|!8gg@rrP-+c}2xf+z%;<)h)6JaV@RWRJZcT?PBsK0AJ*0T=nPmVA;RfMf?Un*2O27AT&GN z_@UeJ|Jz2J7v7cdsKsl3LKB=3R2MSO)}np6l;H_+gg>zejX&abH)o`qC#R-<;xU+g zd(2EoSeMV}HL2(}F&>NcwIuityn10fIr%9rCMGg8bQ0OtUEvRz7P;n%mL@}k#3TI^ z;pnyD;S7no&!Z~Whq>PEXUlpy90h=6ZQ*N%pWmMUeGyCo_@?jSwpfk?Kl1zc69NKN zHS+5R83KKM(VqJn>2hT=k)2dcUmV+|$cOniu;g(hg#j+jfdk-|UVpq<2oM}5L`ju&=Cd;>vtH0~ta7k|d#6%hC=qx0$nH>>%cJAcK!m6semW(I9g{Sx7aKl@`?=vxR-A?y5 zrozn`YCZVFrmk)%E}qR8sP)$0{~*m=eo^?JCLvtx%9{^t@#sVv>9UnJ%}^_t$rggXRc|RKvsH+R`{%vgRw0<$~S6wq)?l(NTz4KOH~G%v|0jT2NM| zhTgr4PW9d8r4+FnH@;}(zTq+Wwy(A+)?J^Njk6-9MCo{7wBxDHiuJ)br;U3>^)4#v zIb0!c-&S0ntF-IsL25|0*W92%{*;s6#&5`bbbE20Ff;DTVSxuJTR!n*^ziU-yma|T z2n9jxp^(kYgSpWZ^uppwDsLHe&Y-P!=K-d48qN%gpu5)BS3dNk4t9zlbruz|q6_zI z;c=-(Kz49&Ufc2?a30(#=xB$YT1zLTrk+?8XpR%!Md7*OS+m3L+O?CyHqxw2j6th0 zHaMybS`x={a@PLTgB!+s|C0TIk8~RG@@i_&##)`w#oF~^sN6?xqAu(fe-Sq535qXY zCcvR!I2&wMc$#RsVrHf~J$h#{-DFiwox}uZ)^X|U*Y$rouPG_@lO8lW!qs1G*hZ7& zc97t39hz5BW@Z?9en8Xu4ZVQ*a~JQ^z75gJPnrBKm;`5Lx-F2LCqfbq-y(v87ls?v z4*Q?oysci~ic-YfxVz){nKOp^`jh4KE6CO9coMzLk+|U%X-VWs-r6u!-EBFEqK6cM zNpo|r21f#+Z(_8iO~QP-pE=HHh5O4{+ukb^AaqJuwk#}!0)mkFJh(Qij^Y%(cZvOn z7L*bNwNs6RPkkF#P+Bv+m=YOz;d0^i8d_!yd8qL9|Mjv`?&{UGlmi?6H!vw~TYv$! z_L+Y~3byODQ@zR^9ahh9kd7QkH5Tm|&rv@i-Q1v9-`u>GLUiyr&;lx&xw*blaT*Gji#eh~-81l}CKdqzK-F3{%up3)J1VNGWTaOLROZMSI~Am)n7O%s{?gP%`T`u}ZuTBd6Tc2$F23w+ zPRe&6T7D5{U!OjJb2V}l=`QaxYtGAsdz!^XSXuKM8{vU%)|M*j&zsUGKu+*F19YwU zO)Sb`z{K`8*3!{x0l&5c+hjiOsrtb7oKfVNkjVq#!*HSjjaF)TPNt<22#e)#!~6Qz zc&9j`H+)*|*6W=w7U^Y=0#GA2%KO8YR5*y(}zj5pJopzslGH#+0g>yeTs=37lLm7j5N zmtvEX<3o#2xg8y5&BJKDz@v+pliv`}02hIQq5gPI{2thFZ_C;qKy1;#-hO)SZnkwo zw0~P9A~7a1tKOL+n*EHEkuD!yn?zOj{of^R?J)H$?~qJXU*FE6=@G~5HM5j*ufPQe z;tLXrIE>a2|1ZSf0*DP4xkPp1+emHe}bk@kkIZJ1<6+( z0Mmrcbf()gG>;sidrSu{kHb?Popeer+&M)~m?F&0DILhj^VHtAE5v^8IWz+t)ziB8 zAu5eMzetMZ`+=!7XPD{k<|rAMHhlC5ngz9KB!G1%HWcFFgZ+)s6m)#4R2{F~maK7z z8Vf5Si)*yFclGM0`1st{uPZ{YITcJ~n+=ru^KAt){Gg94Q8sS!w}gdh7|qj*7kgHh z*PgAxj{3#gs-Uav7MR5^Lf6)rV;dh5@<>Og=EoCpR3cr~oci4`AUVAj${_NWWJflx z8J%YtnGtS%#a!HY;%OBDdk^@2{c>Vr@7IbL`-i{enpupGN6QQ%W8*Oq3iuU)wB%qJfo`;n%ve8x!S9t=0sCVW3@X=wx% z%Sk^XfV_AfZko;{EljMUsx?1G%KhrP)_owj4vkiRuUu8$eT`=P$XirJ0kn{W7^VHS<9tVRVO^ z;fMf-1CK#d6XkfQSC^8;#9wisw@G;e?}JU&Ww&L$7%4s_kz!D&N*(pB34o{50yl1Q z>M^^mQ&5A0gZ(qLIWE9ZOEJq!5Q$Nw1hkVjPCI|ZuY2^jf0g6};1Ut9VE_(eW@cmp zN#qrT81FOwH*<3qUy_kvaCk0iw>`f#_7lE&B2tWwszD3G)S5Oi8mG?Ys#hE0I;sgJ zI!%HcQE%Yj>UynPU?Y9!L!PhKSoR#r)h`ZydYZYO2s`$fC5r`M@mO^hBYs}m0vjtW zk_Kg{HgTE-5?FBiZj$!*_3a=bfjU;@CWcXYaRE@cbYFl<=JSPn^WzH2aqU5ZR^}db zWuu*ggA2GT&qfkJXoY^JBTJ&Tr7Od?scxD+&@)JKb9v;klYCTJ=%F^lebF%+UMYD;Gh{Np3L zuKDm^35>m({k^a_ZAHVeGGQM(-ZeizwHR@SD~pmk95&?pOw)Xwe$~}+1+O67C)bKO?!0bc;;~uf>_3rm4&{}>>m`S+=*;piWu+zPU3fHcOn zq%`VMGsngX6Vt}X-V>^*fFuffr>>t%Q{1|38}wL5j!Y_?BPc2jR4snjF$ZD^g3|tI z#*wC2vMgm~<>;sL?{izSP5VUJZl~yDQbj}ccy0MedSYVT!W0Mc=+e?lmSnTJYpwZv z1_Z1u_1k{~(dr())%Eu6cO0!~ie_Yz@7L(*%+^I$`=&xYqAfsf-^9fCS<716wh3Ft zgRtb`arx1sOW3Nw4sfK*j!+~enc;R~9r4>mAMy@uShgxKWzhh3kQQ-;CAZTrCAa@sgU5K#`l6FzJC4qX<=xz zMHOZI2Uap_`_cG^jb&fdvp^Mms2ne1y)MFf_N+PT(+F9^{S&?OtBMjc{T}zKK3fnE zMczlZDe&1q?u;i$U0s88s%C`j?V>T@D(|`a%&Y;t;+$NNo+gg;xi@#)c9r{lxpY4h zoi`kpxm>_Y){!2b-tDP-oKAP*Zqp?#ye~h021;vp8V`xpV*v9`Wua|-@ zpylTakGnr7nVF#u2fj?yc2r%szp&jF8_Xx<#McSauE)M8IDO;vjJSl;v)cqO}Q&1Xb1jC?vx6ZzgO?N)Zvt zupwEQHOLQ>nwQvNClr{FwY-1o)pn9x%^h|iTO=f}6uyLYtqmP*BTdK5)Z(jK^Q*JX zinVbN)O@#|QbLG=ElBU5IKVRSBTy9-eYKPS^$58BdqE;oFoU$EZ8?QP9fhV^EMr zNZ!QEkbg|3+>buwD%tMk(n{9wTt$iReTMXoYA%lC)z$e~ixF~^CHL<$-sTI$02sMX z-(T|__+j!Z9*T#rlJis_IoD!PImfB+d@!V-tuw6jTSZdi;pQf2yM#7p$93Ot@Y9XY zwWOr-)J--HdgXSVY>rZQKo0PutQMs?s=Av;B` zC3twC@{iu~{;+)WGOABlhdUTPeQN*2B2a`(z;g6@kVqBj!8hRHu0@?iq&iUJuqB`^ z#ULa+{HMiRPB(XVVIfPkj6WFDJAWtX3K8c^S4Mxg_Nzfhd(-Q~X+8n*HFATL+s zfoa)jf#CC_HVu)NCE))+&prwD$?mmQEXswG;o%lU;-IP4M4p&&ToUmJ^NJ1)^}-H^ zN=IpOE0|o;zxzC;c~n$%L3``LS|3h0`jAf#6_S7CIJx92^}!^A`FwbLr-6y zsLh<3@7Cl}(%CuOo^eK2R-<3-hjp6O#6$2;7gHXADHURfK-!WdiC~$)#vwAc9EB=@ zg2Iz2WO2IKl{i$(&em-1h(*6TiPEYKl<#%{pR?a4Pyhuow$f+AM*Q zeI$p{Y$u$MgK`j>8K#iC*{zW7Qr__AedEu^$Qpuw0s5aGc@?An)Zx}MY^1`moi3!3nGw2k8$Vs zf<3&v7RX@5B#>>oSsmT4oD{yaPEt-yhH%vR<4Mm*b5E9Kz=Jb1e1`v&ZrvJhNm}JR zzCR)+rXgIW7f;Li}TLDmUbOD@3453xY z2;>O|%{zabLz)ya1rLTqG6e-EW=WxzwqVsX7>$7L9INU%H&{E)w+~VF@nB2RJ;5v+ zXyC&>sWQMFAzV&__Q;X`p&>9gKNBBhLP=R!4D<{I1@|B`ViYN;^5>&jP2SSo3>Gka z)pQW&MO4mlaUJ1~^dC&}>C6^-4PJu=poMtvGQ&Aq2jok~ng<1AFe zVNwhlx%?*%{dP$S@X$v0Rk$CVaN`Tm1eB!Nr|*6+%WZhX?zx`|*_8julTk5R?1F-9 zXU{6G0Ms}{)H5!56qZy}JYJf)FL8W-`110r@A(GJ4C(0=2(p}lf^hX!M>gA3;o7`FOy1r0Fua z9;5v@itLVcHt*eQ-f~4>-{z!3LV0t7=B+rQxpo4&3B_#>Dad7&S_+3eg{F|bI;{EL1k zxOe?s7P7HZzuMamHV-5-0UcUTh7Dh%4NEL(M@7}%J%zRYTV%QC-bK*OwtbxyI z!4dG=Hy*ng;$B>MF6A>`>DRZovS_dgN>vA*yk1&#GrayemV>BeH#7JG z<7HX~HqYqctx&b@g>O9c)sPxo)6YjWL~Qf5v|J+sEC0;LKU1{rf{wi3!@;n;HPOuzbMN-Cohqi|jVT5Ivu5_@{rf*wN|fqK9z08= zWFEIO%@0%EQSm#Y%8SnXCztU~ThNSmPDvtsVWF%H)dw54y?OESiqNwX#tV<<;9+u0 z(Qcee?MAAj<43dlCX zZG8w)GS6Nm+r~2{2C(J&s^Lw3cZ_JTu#khmEzOvpJ(Ps7;LV|~GBnr#BJ9|wbM9$I z>NBx%{R9GnIP&q`yLN&5w!S>!A)#exn4nb}+7wHFxmlKYtFM)omv?1MJBNiuWoI8~ zzC+w6-A}>AkdYzl%yvIr`4?=c4Q2^)S4U>>*Vy&r+ErBFH$As!>)WGRE>wbJ|&39e_eu{oNQ($=SeW&%rZJz#3dzV<*b72kb`~} z`}beFPMzqXVXcdsr%35ULf2!M_CGFw)ks6>(8%5VKF;&!n;K_1A3lr{f2HL6si6lz znc`NwEjhgkT)5n*m}wrhrQV+TfQp_968S@i2C3gUI}4 zf+1gi=1O21o<21_8dEd43;ud4uHG@tLptR3`UxSt?t@@@y)sYZ5=wF=%nq`8X0*x_$z>(dGpARg9ie1H-`wBnww?llRZ0I(yb zChPzEH<7{B+gnGpv6}uV44}M}Y{PcVpxi^M&thF!~9e0r3DmvMX?( zoEf|f`6UspKee4RUK0(0@s6j%uqSURaosmE(IE)&hmcYS(hh?5H)QBI{nR4x2SWE1 zuvv-+f)*CE;+(wPUc4|tUHMQ}?HH4`_GRd&6Dc+uUX5^_4JLY517KxgDgDeudE|(i zqN0|uG3UERv;Y=;)?mS9*(PH4nSf7~UV- z4%-RhIC0p>`f-2vDt=DOr8DJqvK-F_9FS#*udL?BMhg>@xuX>%eS{Tw&6?wK;US0~ z7(U#WzkXU&Im^Cl9RV6`9S}}*s~y8-R7;DB-;Aj)T@4T43BlC;4k{E?zFuCJB#`_8 zkixqwSuc>(N;5OtrkZr;WdIWyP~@1{Bb!z*{fi<3~(cIyuLBQ{d{2fNw z)>AqtLBK!!k*&P`UHm*jY&ZBr%X4Rp+kfk{CVxbUMa0k_ALZkl=n=QGw%(uR>+OAC zSJ}8ed`AfTo&-5!doDO;aru?k10r)-?AF|x?OrN`lzxG$Q4P_$mn1?Aj@wE?O_*_f z^W@b3%eK@;Scw5bel2B!nMouFRYN@t;WvsDqr1?7{)~WL-p}_f|T7cP|-5S#}(Q;(hz`&i>X~u>nfj= z6xY-{S}rA@PnuexxrS{_sHK~B8Fl4wNpOQjlbA?tP{8K*1h;y2WMFAQsI;o8CB61( z?-k=(bvPWMH+Pxj;zsbVk5b@+162Ob)m1n`U$YJ90-xzGij>ZS;5PJ(3MqjIr`QhD za(HLjhwK+RetZ;^O|-SIC#QmDhiPj9ZR2%ejo@OSWr`dZ)@lRGq^zuVe&@BHxaOl! zurN=)9^~c{E=^l8kh_P%Gt+v?$W_7AYJBA>m;jGdB_+#okb72(qD6j8ygw0alx8pM z9fb+Q*L4T_aagVM-v@QV)m39@3-*6zK{k*8S_n>_a%udq<`WXqhmsDZ?|zvY&;%}+ zK%75pAfw!(FgW*6mW3l1;Vowd(pq#qW(oXbO!H#S@OOU??tR!AT)Czp_ za-RvX5otv`Ux3~rZwL9+dHc1UOmu>&jGnp@6839DWkm9o!|(~b@54F`m@^Q?6`RNR z1x%*N zd3#*7TX)rdw8P@IV#_+oB-dH)t5#N=)H|`^AKZ%_QyFQEHAvj)W(;V7md<$HAlvcJPy0X5A9?99vf8ex%f|8|>+qJ~ z#V2bkXDqsVdQ@g(GBaTvr{w$=cjIo>oS3}otux=c4FPlBy}RDHr}g(IjLfl~><)CM z{5JT8lIi!Q*j74zPR@DFVqX3Ww|DaiT)4fsP!STRyvOrsaCCG_)Q8@0x45c4w?OeL z%LCrZSlfX3f$s?|ERQT*{r&4x47Q*%`(-Ye{bUb(=`u6;Z}}O(5Ww+ileSjq>Z%Xv z+}E!lHC%4Uhje2@YKayFJS2{r8 z^Ecnn!C`%Pem~83T+cXgZ}H#Bk8^*JpgzdA_OA^qoR~X$l(Nc1=j{1I*-yOD@gCaA&j;i z-&=E@sCS1wjEIN`h}yG^9_4*-2LX~im84TieObU^Cxp&DO|j?HGfy|yEj_O+u%mOg zm>O%__v=;Au~5I89Pdae=Bf5+T8?FgQ1v^~J-!eIAD!#h_guejI9!t*eo;#+6uRr^ zGdp6K8Hg(G(t+ueMD)y= zBpBgczC87G8OGi)9$w;6m66GKvl@N*%q1fuSZRlNd;5ikYNd2UdcwQ*##qN3^c8h= zH(OhWo!`#PR3JyArzgw5*&wN-BWq%U6h?*2Y7s6x1AqSlEQpLep%h#3NM4PDk7w54 z{{4i6gt#Bictn*VZ>hDzXoMWYR?nH3>^Bvw|M#a*^v<1$<+<4i!ChjS*0XLf_z}=@ zA@QL7`6~!!Lo$+*z1{g1r%t(Xvo1aaGf?s7`O%vD3>_BvA5^`=WR z76mU+cX@73HI3t)mshYLIl-l~z!g$86T>!@#lxzJSw;v;lmoSTUPA5MRwQ+0^E?ofYq*IR#8$|FC%ycAhmlQc8^XZuWt??D{v z@NlEAiVAsERsA55!k=QjFgbxfg4H~aIat_w$569_*1mZESD>5aZK`&2a`{+i=k1qV ze0}v86sLiy!?!?JSNGlPorIe6AlvM=^!;i@sh=gPFDiV0&mPmCFP`Cs@7yWCv-jt{ zv*za9c6xUq5Zm`*sWa=!nM<)F@0L!iUoR zrOHT#9q!_*-|#f_I|z*Fgfl^6tJG1| z#764wreyF`{*?sdHTvfCFZdlC;kWb}$nFN;`m$$5T1Mvbc@FMcMS68oWvLOk< z5|YKRDy{QB#yvA$_HoVI`^xj@ImEuoJ2T5vVe6Xt`iPm``@D6v`|6N{4)+y#Nao}` zg|`A={3x1(2UY(w5k{7<&&x-7vQO%zv-5=xfFcmt_^7^n|NhG6MkeT4pkYVGa_rbe z7z<&(!11q_uUu&bf%e)pSFKH_Fap6XEv-w#ek}A{9wv0y+RnGO_%dGjP9tcrMQmF_ zGPj70xdPPX3sdFqKZw>7F9-nf35+zG8?~@s%kb47sxQVMv)|RmPkcD4%p>qE9flW| z8Oe5CxNJqNX$VU5L9-6*(QEX zT6%xuoGk{xBUi7gO4rzc?obvDmAtFr)Hn~0!bN3=eQa???bgADs?iP(jpxtTnHLfq zn#5F9g)dk;y}#-2x-YvcTZ*_L8jf>uy%M;0_E453J^QH#S?RxToWbu~GvT7d6uf0n1?iflWxqMe;ub7MEXgkR$=>P3ix&@0bUbYu{I4wT)2yQ> zsKhusJARRH}E98*6E+w8aa_qP#n>i);1C8W%Fe!j%>6f+4WyMIbXV28+7O?&G;_6@)F?V zkK-2zu^n(zK!J&XwBe%o4QZ@IU~0VBHB(TOg&Ou|B|jYKGGbouBImOZj;W9uX#x+ zZYJoQCfOMUBoV?-E!A@Eay}i3s~`}B`>PpqANLfDwK-W%h{#&eI4H4+=E^@_`CG~k zbk%M(^9HAhJ;+aD)3LzSVtP4>wF+BR~HbN-TJK zg$fc^jo1fFhK>L71yNbj>Mf(r{reU7&UWU?eQRLYw{K#I|3%@q_RXyGD7AFvHnDQA zw{PzuuYUgp<2MfNed*-n^nW4ov4!DsF{5~v`NL7k(p}2)Ad2(-gKXdy8C`?8tZaXL z?#k~+RhbskpQKm5?hc0EeD>2>x4ync8D-@U<3zsD(FfQsgI&4)iKd4$H@Jq}yIEOn zn&Za43Kmx1J6|XxJrhmyPuPBqmyN9p`z2fre~Un<`S~S}Lc+7Smjz;$tSon}_Ryn^H7c{Gb6uLPQ-*1@uIV8vXXTi`Lk^WcnHy2(fr3+4uxvu)M8VbuBT z8770Pt9wAuOLfU^eYJT9DQgW;AVQ!knCev>e6#VEA@?6XoS7SYb=_n4?vqVTtY~R- zzt}A6Xk=fH6Kb}Gg@$6N^}EsT;yzQ2oM%I$?Z5p`ZC;O<`wU!Klaniog7{9HfYu^O zJu8#AQ~iPwLsnPU-CjTAGwW}CPfbpIuy5ukKK#hG`hMFLm7b#e`}bQrh|4fzkrGn zB;ktE(rf!S<02tArS1Fubu8+`PwHT=)sf|CH8!01WSR+aL9D(ZC)-vmZ#X^OQz1MC zb1T9H$;He*A_&8UVzhzQ*qX^w{N>7d=LI+4tW3KALi+`%p`pX7q-hKO@L2sO#r zuC3J*yE;zVy$=hcI_6w>J*FY<%a=lOkIl{Z zU*61Fk?$hal9VWr_C5dO9NU4oan18L0OrW}WM^N#7i_Ge(jR)wUR$TXhMpw&j=n{eL;03%?epX6wtZ!t zsfMwGZ-@)mHP(2E zDL{H0d-os5(8~qoRF$(Ich-9tm13YPX+?Y# zdWz%YV>raXm=@beR~%U3w-3h@TNv8o0Dc07!bBIFLh&PBHeTKY+ow-6|GSA&FL4vk zp$z!^`Skm(xmFXMFu#QY&Yfw~l$(%z_YrTzJ6&|P-UnyOU2<$GN!mtec!j)OzQzWV zRIYtkbMuf1#rpd&J(0^9wVn*`Pg*{syw2=sPPIum0tO2b->ODjPR^_~`JMR&yhor) zN<1$MZe^bm<)uA)+?Hlc(3AX+#9rfog~tQ{3@5V;utZTsEv@5D`QY&rZyLg<9IRTW z{`uAF)vN!oemYR~b*!z8*!=W6dEh{y_^UOTmO;#_Eg`WNd)Chl8W9h=*?}KVMgU}8 zOp*5IrB(XWoo>@s1cD0b{)Oi*ESR$9E4^)-lg*o7y;C?C zJ_iI`_WJKgRf+oXV=Hd)oune}pK5%@B6CxV#bssI)q%G#aMj~1GePXvJ8y5;x?e^e zB<1~xNEO1}(|g=kwp#o3pvR$vx4%xZIPYa>H(Q=VhhL=@{=P`+o%8a{kOv9~3=^vt z+)0%jyGl?3c+S;+6}+0Qr~eJTk{tV>f*!9xK`Sn1=2zp;-r%))TAV(1EdTfK+tM*P z8fR$SaV?HpMK^v-h-Aaw{VK_a?Zq<#8-UBPw-cZu5j~m*x3tVJ$c^>3ONTGajg<=t zso6fWgl$>?k`<3J7!YBU`QpDQ;z6Q|YjOyO#~q(&?jVw~rgga@;$^BFV({!rGd_sf z-I-1eKC!X1?jQHl)2EsAKA)M9&g|W|1~Jm&P(ea6H*DxIJ$aUq4Yg$cJ(M6WOq;nN zA^GOz%a5KsX}R(Vy<0v&w7h3)I@78nOmwyr^p4>2UXqb&X@`N4=;iCn^>ogdc(RF2 zO`SvnKu329^F&yjPpfbPxO=|w+-vp&FL>oV`rg|+g%4CT74y5Sg2EbaL0;ZYDN=8Zc>wYf-NeK>D z?AI2-f&Ut>mXWJfs>G4zh^HHJLru+ex?gh`Gl%BZje`S^~B>N3}N!p)m5v><;fm#+*Ray zF8}3vV$lln@-bh(=G@D7-WkBcG2UC@Yk(1F^Aj4dm1zowjd6`pU8si78GqA>&S~sv z{?9kDa2k}w^1%C8o1E*!hPswAGurZQ^Vv3pg=xciMBv!57ylh}4R9}2EwVoizY(B8 zkXY3HZ%3nqdwybbM+*yQ+q~I_`Axg>{}%x#>t|-TJsGVSLh#Tb-k7xbiT08btNQRoSQp?7?$(7?;G+PVN^tS`m0@NFRL1-jZkB^i zZ+pgJYU&CY4Q&RM;FH&7WCl#xrDbM^$eHN$^~F6k} zn;_OyR8)XmbD3(h03oOZ{P=MRr^C(wCKeXMGOt@g3=`e?xnz5j51Vt~{0zfr*7N6Y zmU|nn_j(?9Iu~>EM*d|XJzl`OFvUfYR58*#pYo7d)N+)NNhF^m1{U)bBf~Fo| zlQYmjcg#6+h3r%KgYD&1Ei{AH^&oMDVnF<>hEfx(?Hf0#{ z1rm~1OP;u)jS+H;H#QppSdjx&0TCi1S)L3Xz{lFe6mY97h8r63%$Dcld3fU{MCJ&D z$~RdcV6ErUoc?{`{?C5^FZCZr)ncc}!jv9QAi=0ZsQn#LNjzJdlP%mq6Xdp zJka~?L44>np)gagEPF7uc)*+_>ZPM&d+Fz59|GIwZs-E88)|A;Jx}?Ycc4n7^NnQ4GpWJ=_ z>h<%tZux%umiXokG=pW9qbI)QZ){8~iWBVYT?x#$<>aD!zAc-Y5*d~1iUpWF|1l-y z+P2EAgqngBV`E0j?>0ar_OaOjyin56ka}EJsC~gH|H2bf4E{M5OS`2cLT(6l*nsO{ z|9$+JR$m!yS((guK5h}A=C$(+;oKq)AbaQ9(U<^7)r$TeExU%dI4*0>mqt0F* zP3r3|)YkG#dKP77UODf3&eAeU%6rnyZIC#khWKLo5Tp?q8w&&K*E{KQzkdfZ5!Bwk z)!yFt=~MTeemjr>eosr=wRZ-DOq96%?jI$1QVsYVDVZ?mm1fRm+@Yowmha@W=LcX{ zivLn1-I!kzEOJSFBJOs=G=kNChg~MC>`Z6Uz;VQwqS{(m2DlYo-z@2fKtV`XzUMUP zA$OA87(`hQ9C-Ha`?ozW(=UiCd7qUZAt8$oaV*x^Cz7i#$j16|-@fU_E)9#{XMg31 zy@Y~c_vSMbGjC|TMSdi5qUc}OuO6=|zdjJJeF6lt13o{Z)1$%GEog6_oa~u}G8?H! z-*^XmxU72N!1V58eSPg{iD2m4%jfQSHG|uihXL%ystZQI@DWag|LuI#YddzRCns?g z_ip4@Ij@R)VNacv!Cy-+!TtXIO%IRR(a{P`%^TgD_m@o83nmyooDmiN%6?u2N1ab~ zejV?iG^oGQRCn_xn!Z1`^B+7&RkdqU+?3;PMfS6d(}Mn$58l-oS3hD63u`I%)D03k ziJrjP8+y~YxDhc`?f-EBxFfbZ*p!oI7q0rr0PoT>Rb*Q$d+Qatv3xYuj0%4|Is8C# z9}tS)317D%Jt6q**|u#gICvJiyA?zdXUdD0HH?hVjpYQ@^O)7NSkhy3PVCpe78bH# z#$UFL1(P#Onm=wv6%}eSGPk(6fDpJ4d{n2}jHQY^4#O%G zW2I&Omll+>`EAYp*U*rTkr|yosP@lNiD=wZR*q8UtQ@LmNlBJCPbwxHwU;*Jyw)xY zwUvK;%?=JLY;x8+b~sc1>^&g*l%_2sX}IKF5u04yk^O{WHd{@xsd^uz#ty8KPpmae zh_e1nH{` zxA)4`5_(`i%q8XQ7&my-`NWA5=>F-Y`TxBKy$vpDr`A`u`OPtd3iA9sT)wckVr^t?fwjP)h1UfS`8FB->z( zc`3hu-)NiUu2ND`sk^B$h)|S2yQh=n0#2n{RnN^Dgom?s&~C2fZjwiBGzB_l($X_@ z4<=z&*`B@pXm0cz++Fwz77$%kUXe4ipR#rw76G_sJ9EOVlH=XSk6$?Hk{_?HEuX(| z0iwL=e|^HvZvm16U31-hj9YgzY*tjU5|?*Wmt39q(KwxyG`;KCX(gsTE5wjM2)@{u zmd9zbFxfsmuscXD+Y8Igx4LWBFT3zakr3-L6mOq31y7R)=k1G!Et5*YyjqyCE8n>Rzch!$(&AZfr& zZvsG>gvbSgm|1f|@8GvaTSu7{KpH~UkLCPAE|#Y~R5(hU_P(p@94=4qwxAWm6Z9|_ zrv-=56_6L?@bM1}EYxx{co;>RhM}s(1;y%2G^vd8in9iV042j>)5wDn2YrL zk?fs2Par0WiFy6wM+}Y?PxAMHfiToinl+WEN9C?|BY(N`4nIFFYtr4cNs|mU`*ls^ zXZ7`!RaHMk#2bU3#PZj$@GmBzvWs1Jen|5VBV&E~l@(f=adG5;WmCSN{Z_tfq-lqC`RYH|x*351mFwp#ZMnyZGI;|*+!kVHZKaD5j9Rr>&MLT}rU1qinSG;e3UvGDOmo98M$q7rRlfib)jQVP^+Aa_-^7le>3Anm;hT z=$N#3XK$ZWlMg3tvW~NNZ_lr*obj~Fa{+6UJ}#NrIYG|U0#zSRHv^=M5^mS)jua&q!0srAT6E9bYre{b)Jret~tg%ac>59^;v z2tFd6tT%YWVtDKN^$Q4s`0I7_65H{lFI^hP02u{N!$;D9%7^|}mbc4|cONvoe}nFz zB)yccpGtsWv7!>q!?OgN$i1{oVbRO?|7qR5xW(!1UQyAzH{SI;-)6qam_&C4lh3OH z$Fg9ogd0`+=Gj0M8s778+x%{~y7gQ_ko^^E)Cx3cpO(;O?Ptb91qRQOZ(a$em|R)>dLcT+!G2e^h-1RF&)2?ot#%DMdj*q@)Fu z4gsYF=}wXE4y6?YBn1SdOS+_y6hVnacXxMp+==f0zxOg2dz`a3i}=T}Y;eIY z-AF8=VYs{M+c#Do9*9CJgIP!&sqnM*se`2a5B#0PSkb9DIaL61LVl$AM3n1DmU4Jb zd1<9dhgNA`y@pd4&OZ%uA}yG$(~^A?^m%=4PXR_th8^pN+mtC_mywkUkCD$6h8GWS z3xHuT2YWwm6)z{}?tGg&IvGr~h&UL{%9r^BfYOy562eHu!vU4)BQ?nfpE?la_~5tXW|0d<`1o(Tdk6_QO;KZprfLKFfY%X_nAg^ z5H8+64HXq1*O5Pv1YoeAZfMBBV86VYtqjCWzLX$9w* zOs~9-D{y?UK{aXwvu=&wqG(aM+c1G?D24X!EE)`NV}STSKX=c_G<#%3eRpj{_{9sUPIs7o zbi`Mad4cd04((Wz)4c($UJk!I_y=3(XZT=$4RQ0ZvA`4_bS?O}xY-vspE=zr41O9*5Jp?YT{u z6~LBgZN;dtH&tFjK1XYAZN1zB@bIFdbj@-Mjg4oQhE(OYM?P*1>B3hF!OeLa1BV7%{oz*vVw#`XU<4GKL| zfxH?Ol|Ol!y#-zs6?02Hm|-_P+%RZqV>&y_c%44`-TbxCh)tkFf=_Myyu%!z0?Ojn z5ppPRSngx|*S32Y!D^11aCb3jqyHcVJ?@n2ae7+

    hlrdVE z&opktr|G42{zZV)(m*=`1YJ1HFH!LfEfD<$5Y*(qF1p45bwQ~mHY9(S16u`LHDP=Q z^u)2TkvJ|~5qn=>(xfCu(SXGwy=IaRj+BqS!TZyGczAKd@2^=I#H7jn?$AnF04A)z zAWSuLAL<1@x6{z!&Yb?Mwf^{)%7pCTdWB;%`Ev-92oG(;2k+szOJCNQ*?w7!U`BKX zsCQu;G|=3f7IX`8eJHuPgK)Y_vTfUVCu#yyupsg9S|F&3lCZ$PIy!oO zGWl3ZM|+Y>z&E(#@#R1GmGiuAwbwZPu5depyU-92Eee{qJP<>W=&2pi9v7EkQVirZ zxEoNfojMkQU|QDeGt5HZm!YS*ac0bbR@U*7Qp#obDArb33&eDkKiCaZZ=^0eAbzVV#0u zw)~k5WlRZRc|3DD`~VI6)Pcj|CXyfOunB>yaWGVqe;tFDXxI@Ht_Jy%R9UZOvOKWV;|g(W`)fP0a#^Q$%@H2QEHVQmtK6U0?;;o) z(_5wgy8L;d+N=)h!*DWBQ}dF?)91WN8k*%tJPIYkP~`{3h#@ z&h^fzNG#&ji&NX_Qu7xI@5543*vP#d2k=3uu`@0U zl_L@m19!4yVRbYz*z|vbh!fM&V!wVReDEMNBm@SxfBf;!6cxjlnUO#{MkjMUE(esp zuan{F7OtY<;?xvfxhpw;?GsK;ui=`FIpiRe4G^*iqmXC3JRDL#q%Nl;>Dng86Dehx zEd?-P0~m}KqCdfG*u|w~wz8GQn=BJ?%l1Wkqf3|tw+n4V@pNm*pzb!IC z5E4s>xlaYcb=%@9n=;C*T&`iK z#ZF<9pHM?^+Z|HUF71R+Bw1KUvE`GoTGw8jE7!Vd;xokyIetccqpJ(=$*-9$p+aNo zf6GvjUuH6rSr;`w(F5lfb;ESi?X+k$K~xl@J9kG%S^osJaXNj$kvrX}{ph$sx4Zbl z@xNgrsn_QT_k(y2OBY~=CKEoPrgrboDe?O3deYB&&XV=714ksjjN*59v9P$}S(gZf zy@K@jf)N1zp(95p1Cg?XbVpXN`Eu_R)Pm`5kzni%!Lf1zO+D$B8CNe2Y-ANh;1*0( zLn9OPehU)PRd5Y~$I9pI;1d;<6cmK2I5|*|A_#w>J573}^9h(F$X*c%ShQX09)r5N zaEKBpbUO>dAgp*@WPnZ9(ArA+#40y&6j`4#Q*MnMTn(L^{0v2GKliPKj&$*1n2E{R zO4mKK3!}!q#|ncaA>!{tl%PpS4uWYOkkN<0HUNWA0h!AT5GsU-1I4toh$WxRMA34> zO{Ln2!+v#Ao7Tky4DBGNj?7CYrX4bw2S?O}goJMSwSj0yBw!Qc=FK0jCoe55Y6=U< z$-L@mQy*XQ%IN^!9#yu3W{CJQvdM54O-3{qvc;n-_!eXwk@>2YNY;OI*L zn2Cu;&)3H)ptpB7R~;Ky02O;3s=>QiPi%mXTYIVlx|}*Fi?AOGl~#t7N;=()X3ekrCvqpKzF6$`_V;1}^7Dz#+sx2vHmH@aR!sm;g(t>nuRQ4J0Tk zUk-r1EfqIRM?oQ3eY&R{3^EK^B85^*%MR@)r>8+O>5xroq@5^;1}^!YnVILyeUPF8a0MZu=2Fa6Pv;4EXxf4-@lS_D(KU#Y*quOZz}@ZmFGQZJzEHa4c?2!MF} zaaB}INeQju%ln{;itO_Z3OYGG%FfBbC}9~n5EA(Va8*DS%H8v(PoFYB=;Gs7!Za1F zrNG7YfQs5Z@129CWv#G(>8sd9*OUFQif@!&m-rTRZbb%1ScI&XWCNIrrIgO#j&t6sn&k!>%KS6^>pUIe@rmQS~$b|l>C3v3WNoQKt2@N<}$lU<$ZtsMkz&efqSniN% zNW(hNT(bjuC^Yz&T+*q-Eze7UOvk}N%gt>H?sx@)M~Y*jTf3`Zyg+y8*Pr7(ksmF4 zatK6l0N+AQz|bdkzu3!wj)zBDQ*)@bH4)1-rXpK;L-{PVw5*KOtIAn9-JJ@$2KYGj zs#u>qFm8XqmmrPy25fOqQQ58NJkoya9js%gh~f&+ffEKcv0NPMr~l@`Kr?F&Q})4J zF@N*sQD~RA1aiJrH8T1b0(bh-(vHaqaQ|Bt(V0NTNstyg)F49`p#c;1{rd%e_j5Q$ zff79OGR$qQKUXui(!#_vdtu&$?Jk)T0jZv5V-*MiF&P;sxNiv^7j(mFM zU+84F@XU5Mt>QSXpEwAct^?x$Y)hmaZ{DV1U^v+%`>|}10mE?M4sVQ8o*tVrMJNBg zV4mMnPQO~~cY1m{QkHp3n;XJt?WjD`MC$q!`^V$Y_8G_?^^FkyPfBlbrBz)5G8d;= z2D%;Kzk*NU_{2nIP+7o#Z}szA4ggZXwd4J9&9X-%9_VSCn!q-=ft9nhzYnyvy>-pY zDhJHPwSL%C`1#4TZQOYPLduWakZPaiAeOyMea`iqSD+g8!*(rD|6XAB9XNcHlh0n7 zkpYANkV9%OumtYwG>3)^;4PTOYdwShL-X)U`C*w_J~&|A@_Pg@%=3GP=q)2zl#Gmg zZ+=YzTiHbSr&^C3KxCO~ORQ{)B_)0CN57Nh9trp+>uBP;&oGQdy366`$Mp2X zw{J_L5pWd-C!+X=bJ}NNm*ge@yAA~5v$gPV5ju{y=ir|qk*2@M9tak z{u*`d1)m;V;o&VBR|rXh8`Vop3`#~gM~0){-1x_>FygeQ+dN@4#PaN*_VR6RHfB=k z+{{EoKhSl*SbWHfme6r_TrxS|#$N3VEP%i7MWSL@M8utDP8UA+zAR0sShdP5w4iwV zf3_tPW7#w?o57?Bczs64ATdBeaZTWLE;1dk#-rbws&5LRxTt#D1^)ASjF$L!Da?lo zGcri*jT_nUKw&etU72q^GVe@W zhb-8eH|^El3HYX@?1fUg_ZHaZ4wsb;^!1&Bg@vb+AY4gpdjEAIyKpQX|alY%NhJbYtC2@<5*i;|5&a;2U7>|s)gD> zTs#XhM6HDLQGwVtH)mflP7Mi?ddxdJI}(s!fJB0f15gbR1kKLXp4?Cy8XAHz1TgNQ zr8F@yiH_#qnSBD&jqq>?7*w<^tEzeiEXXPSDJxFnzaNE#g)m4h3HtjNBifMhywngx zmy~`G7EF_;H}eOD!{YR0A))qQNxr8(_kZfz@JTCiKslZFmM_8njBG4oH*1H|q3V-{ zf9+H}pX&_Bry@DPuu=wYM=tvu^c*#n-`Y=JNxJ7GejLVD1x3k+33@m%pmgB^#r z+LGg^%kh_U+n7UihX4Rua9G`rLZ@c+C`JR1{mvKhD^V3AzmU_?azXtDIWG|mBj5vd z2Al4~2lBgv9HPK`0%cMd)!FdXo2Mq)y1Fe3JG#2K&@C^v|6|@T$gC+pxVbSlbMG#W z0GekK7@bMC*3E34gXJCa{OqH!@COlIbLg(eQ&2GuKV4A|XQU8u5qnkTvYDvd5zl59 zQ|+|Zbqn81owc`@yV$(asO3u@F*mDA>qbjk#{rL>FAnq1`V>|C!`lLO^KBBbJdrQN zroyNL`A?ug27zO4M#kIi*=F%{pnb!EfKI0SCx8H&jKi%NSUx7iojpA}Fmbhy8iuM2 z>ZqP{>5h&Ld<$iHd0PjEhflOUJ~g{Xezmo=ML|K?7^|cn?E#rib10=Bze+!(aMX2n zc4jN*yKP)$C7VS?GTF|z5^&kf`rf9zA`y?kSre3MKc# znqyg)2Ee%lR{$vdD=L%enVD%hqf{Jaq)#?AF3vSgGq!Ne`oV%tv7>csi{z4ohz4sj zm98;k-}R&&;+a;dQ6JOLRJfj?lQs10RE9T0lcbEykR_wlOA^Dy|L{rA#WoL$W7TF&7ZC-YN?%^1B(IC=0AQ zoL>f!Fc-K+^z4p+nRy$dR#lrpWGojhyFq|*ic6viFazXn0Hb4duxmswc(iF1OpF>N>Xz|q}*MIxxdkkY^0kq7F zCM*oI*`asOw1}P9vS7+b#9;yBzY}FUn51f%ye1mF!gc#f#fy4NYQYz#92Gf;vCr$bv(gg2MS^Uwc{e?8Gq}Nu8=3 z!@e!(v!52!7_%ohK{qY#FMS4HM=FgS8Tt8Rm5zo2 zVtRV5h593)hd*+0d-LY0VyQBW3y056nBYf7BJ~UI!1O?HO^?%Y-SQPxShHSxG+Q(w z1L-74ItUa!D)gG!m)FSOF^(TZ>~^JOfVqUX4?hzF13m0R=L3R1Nr*Z<4-=Tdg#_N+ z)yEowBd-cnKEayKw&)iRiHz*)>GAvY$#VBUu$!*8#`ASok>$lj4!cpO^sCA0cRQat zWdwYk8-r>bldzcoE-cYP5Wz@31xF(B}Mc> z(8uZ#b0u@XV;-~4Dtl9px@_}^l9hFLsverfT=lY>jzDHy?8}a{Lc-w+`O=R;Gawa5 zH_BLb5a;iY{6Z_w`2ZLNmj-Wa+wdv~P*_`CU7x5WAt8}Qvvzd6SSy>bv$ux;VmKK< zH!i|!n;oR1qjP$8X1ZQKX9Izx+hAZSzGl17&I^&>v&~_O3JQRVznyQ5az0p}TUY@9 z%DnD>gIAAvBVZo)GNA44ZoUB$n={;tO1UP<_>_M)5%4v()&_3_-ZE3G>dA3{$ABkP^zl^ly+lzBq<-D)= z@8bxtuMUO9BwQ37sWUT1R$k1$6lhv}kFs)zM__Dx15Dv;cg}g89w%^x*)K>L;^PBM z1a<^`Zlgcnsb5dks?K|<-U^^=j@mN+?mdp!+HP7MIft)(Jx-0SjYR%}!Y;5{KrFX)*bNhDD+buk5 z>KK4I{Xg}&ng8Q$0-ps1E1mVxY|v(!G@|nhFgyUVLoegxRDqsH3|N9V3*j#ozz5r@^uz8W2ddrtV!5V(fKFqO zey^x*k;LHY9pKG)-f#teERaaULPCg%PRu_6RTc~Yi0+?u6itG{8J!H;QGCYLRrn5v zFjlPFU81N})>IYM(ZQ(mIeu6tx438oEnY5=RDKzPInOI%1!AGYA{zR#C|>8*_BiBq z>?II>V4$h+!XF3^qgN@S*XJgNhI*!0VR!Vv*};ml#Bg>beF<&y^Gg_=;kepc80aeC zLlMtilItD!Xl=C>E(Mt02FCo;KB#?E+wX1Rb&cl6i43`I+A}XII^i&hu-`nG{$0q- z{43qAq`1nkExO9i_>HXW&#jqWDz{2c&svwW;jS)O0fFi6Ty>Jr(AIzew}L`KUaLgE zP`T8)S_6alDi0U6~o@Mp2~yg`rdDni0vs~!xj1G%2=Dh_w& z=&s(Ux&gbp*Ie_)t4|hx`$uk!)6&s!s;D2>J31DhZEP`wSWd*(y2aIL=cs<4tlL@O z08I1kj);Wj*~V}Gk2j9uD}zb!@$M}dn_k+wb%m!d8ksyC1Pr&{6Q}U!z`@?$$_IIU zeSK<1O((#IPa1?!h>1;Eieynx?=LRP8D0z*rh3&sefs1p@0$;s9t5hYL0eSh4Bi9u_@@K(( z7Siva=3#TJgnI;X?^l=;A$c<(;1v+|Km2mculjpuJTJll>B9PWJCrI|uBO{lg4?G@ zL;-<&4(m{ZY@x&i{#U~To9FgzDC7WRrv`0Jq7-l&&Q2r#f4>7Mt5OO41z%s2b$T>3 z70nW0D705QJ2KMHw6wO$%F8P$g$4WwXPw8g;7`ok*S!gr$11ir-c(dT&{WMo z>g6RZHQwq|O2%k~{r7lR7)2h9XJQh~D?9fogEad|CkNDf8NLivRb`epAPyiY_iRFw z5fq6F9UDN$0=!9CR@SU%zSc)4JCimagoka>L&nBY(7>y!R|ieJuW*@#IATz-mda6t zHRl}9z%?{n_3m~gQd07aj)5T)5MU}QcEff{#YPxH)&NX*tdpIcjpmLwMGM05r{=@H ztE*Meb()*+nbbOm_n-Q>)n;kR!2lTY50jIpfp;$;HdedS$(pNHk_|IkIMq^ke9;u> zcyk-t+hcLIkJ++q4burL{vE2PUTS&FcSnB+5{vaGk>+M)AFSUNc>L-WHy4jGFOSpY z&t{28xsO%~$oKN;b*6#reJxqHrzMXr`Y+>X=lFtl%ei@N4je6vD3W`c= z{@Og^8s3z}?KmD$CXL0_>1`VF>BWz?6jFlHs66WqUAvMKZ5OVk@IIOy{Ou3lu3kE> zkewxkaNzI=o!e}%$cKAzWnHRo{@z`@cD0ga_@WPdhItxCV1E)Q5y=?O9!O{DT(2W* z+1uawwdioeop2+2r+V0n37*5T}INRgqau;?w0^Ah_Nppu*_nlQUgo1)8Ia$Zejjsfm0K+Ws2S6u->(J`rB0+a->+Lgs{#uxT z3izg{F9Z^CWUc+tDJZoV6Gz+H+&ny(a5v3Eg?-J?mn5Hk@#gQ_$7%{aIOxe2Y<`44 z3_VMMvX5E!4DV?$VO` z>TFIKDdFfBFX-eJGxeBm~F zdi3aVna;WfoBkYRI`LqWNOiOn#;{PIcTwDnPq62`h3Se%$UQ#n)H_*+9nbG*>wxM3 zUKv_7HIVB<&@v4BUL<#kPho z*2f!kie93bce_WLTxZdpk>IdEJfBXN)(i{~SIK!JpFYnVh4?=FJJtXF3nh#7bzEwj zs8->X0mt=T;|7l_x6-Aluhb&TEM%{6Avo>MpCJZ=?nucY8`oI=i=GjEuPcx?=Z-k&du_>RtfB%goGg-s58xlA!my@w~YweS&XNSy6Fs`uDAxKsGkEiE@lf=+oNz zDZq zY}8d`*uht(24?60PeBibK!6k&z%-LSTJnDjqUP2OEDae&eU~>C5Y|0;Fu?(k=|kQM zS*?eaE)@U121me`B<2HTLG`k3qv9j^^iT$t2M-#4H>3p+2o^f1UmWTdX0L>+m#u&F(wm>n$j(4`?0BJX zH8;cRn$^>rmyG&VIl1DvA$A<37R6e*!scLR=W^PzHqxlB`pN&I7TY7LU~4B^IW_g$ zwOXfvjfoo`>uG5sPEH>-`e^7LM}CbS?rSp2^|{gfs~Q`Fm5ue0bXyGb@9uFvS~mOU zG)a>6u@z&B@t)CBNuh==fBa03iR?|Q(7{JZ<==W0$^wa+YkbNq?&0B~dT@nN?Ex}V zQ0d&XG5|k`#8AJ_=;hy~#le@|HS=E40@9Qm|lPWI&lekCh%h;+S}V*k9U9AuPD`X!GKJ?)QpyqF(NEXz1EF)qqfi+ zGTmOXJZE6YH6JOppIj3D^mkd{98UqFNY2Z9BB4Y>r*n3G@@IK@85r-hv{M{t|5gJm z2~faMyO^8bVCyPG|GPridb1;k`m&uB6$#cfnT{~Rc6v6M&E8C z5L%)_pPx^@myF4H?Oiscf_Ll6Img1FB0qr@K{<++`Ui|RYB@adVr*P-!larX8;2OHRkZ}g;y zRclA;CB9$!!>szKD2QMDE{7T~4fC`pe>A>yaOf2gMtVpfOISmq zCiGP*{YobyD>PKCx+zk|yp@CJ7KroCP)`r>^XGdMu(lVZ;^g9j z_X!#+&xYF_aXcK3>!YByXR9`Yh81+*SF{&9lcc1i0^0#qzJc|?*WVw-gF(HNm1qzb z7nj1bx3?FNZKXKI%c}!NV9}Y3i3u$0I+w>_-lD0&J~xl|fUoKW)OV8qv**dYI8;!otkjZZ%!122xlE z8kYN#cGJmSMuI2%u5bcHeo;_YC(=xaQ!g-&`IK zaDr}c>vx|9hQ>t>tY-eEq6&2(T-p;|dSfDv+H7n*w$k{>WpFjRirLoYDhWR-LX;>5 zZ*4H6_xMX%skg|lbZI@8*MnkSVDwo(rQ{uJ`1!NzkHOUO-edNYoP>nN;gZ$v zZVG%x#81B;wlBHYUC-=Gvn;nn$s$?TS&lfcd;|qN`#n*&uCE=dsC@4C<$9I2Y{;DI zvT>uX!#9BczzruBEl$gkJT)~}JqaQ&kaISi4;Ulqn-WV)A)V)o*TcEl*&q^rss1FL z&v0FUzF~H_zqfbu4@I*Gb4FH{i3-Ms9`n2vCv4;d`kJb$Sfycv6pT2fY)-?LfXILR1T67$DLN4x;Rfg%B%)L?m{dW2C+1FI*L z{#6|3N6T9!RC|u~#tD^50BL;uXtmP+?rDKXN1L&rzJ6=B9E53yegFRbGmfN+ii((6 zhTC&onEBnglQp8mKj};ZJQX@Rf%MC`zwRZu?(Wc8>^Mf@bcvT@tbI)2Cj!eQDSu&m zt`a!PuS3^?$f{a6yYcN?vFDAkEfmcEJ&H`48W*qvMIeg|ZZaGJ{_tG&$YMwIMSM2> zmPJ~5kut}7i^_F+c+B@-@4l`tXXP7Q$Ej2D-WqkN@w%)OPK(M#$&*l{PN# zR+Bs`cbiLvR7%YYRje?Au+Pu`SQ6STQ}libe@8;c)<3^uuF(6rIZV}z{S!Xn;$lPk zx6dkSxYoqtHfn11C|5k>T+>1}zRbPj#=JS*lBdem5vtNHM)1-i{1U6mgddDBT9C`3L3Gt)>cF!1Y2XE*8lto zae}uIZ&BQY;8ZGu*jKn{)XOZc{M=dS0HcqWLSgxbptGmu=O;nH&{isePqGwZ$v@XY zw*YCLV5QEaQU1KN%K0G31YJc-OA4=}xf$F&9=ulPNA-MaIbH==|K{c<{2)_P(|h;A zi;Ih4HlW7K97ecw%QHIfG9< zrMo;fJv|Y+JNqLh@Li=~fKPe}CMM~y&^w<3s=$RAsZ9g$9t~X!%l(^nPRNRIw@+74 z(tcD{s;KT=7>Ek}T}u;Mz(-C`9~dmCS0~<_vErmxKHu3l-wh&0GB8vY+rR(c6?aU) z$sMHk{&&L`1~pLIaA%t3u3j zHWC)yM~>MPWL1r4R$Fz7^cQz;Iqwf*l1Qa=*=%nsIPc%xthzfp`_@+e%N;y_M}h3P z3Y+T)15R$YW^$o7)?3z=mZ7>|!1pPy)(K*euvSLOrd-I#$fAz1?03>$4Y_TS`nT1b z9Bw_ev_x1%u?IR4L$!oRtjt`h_s1vVE&k>ulrqvBgpg6xY&%e}KD%zleW&@v&8Ul@ zL1V7BQw*xu#UIR~2r({|w6 znX!gZJ%0S^{QB1K*|$4p0Na4?@6dvh5#(bDL-sig{$a3>ftoVq1zy8Iv}R7zajt@q z!bGjR`?xEF_5I|4P+$1?4F=mu1^WRhB7qQ>al_;E)P;f~_w~u-crluP3?gAM7Y*sBruI&xQc|vhYMH$<=bKkt zjJm8=`@5}a!in`eccwACpLr%F=8V43)P!bFMp02tX+80BGYw8leV3$X${#G>O02!` zB<6{L`CReZ^xp-u$a5LnMn;x&v=gUR{cFC>2e<^4Z|ak$>Q9P|jsNeWdS|!%4ct@> zoR!~S-jutZpMoKb{N_!D757bIsHaLZeA)DTpC^#6bqn*;(M_%3fBdgvD`Cam#Lben z4R35H*0HBnA8Gn}AF)~KT=qs|&B*nMnb3v7F;j?vbqj`f@s}@|Nn}G`!(&XlQrXJJ zYjGdEir#y-F~Z?A_}ySZK9j}oeNcN*XXm2VHJF1D+4@OHQK3}Nllw~^;^2!iM#mva z*j74!*y>HruVNsehMs*R;!vt#>w4Xum90@t_4>8z3^tC`ZCh>$+~H3B$r6zqw{LIJ z(n9@3PTp4b;hP$T_)Bp*mis?m89*230`PjkFrnmL{(>ui@nXQRkonn39kBFo1JfBZ zNJU;ACQr}xyBmmR)joQ8WxS~Opx?_OWx{>AE?dcZY$id}9~Bb=SD`43wU2X(i+4jQ zB?v9tPxj5l#Ly7s5K@tqB`zkm$lAYb3-=h}a=H&5lk9|~*AQ9RZ|Y?jO~kacM6_y- zzH3-*ija|oyzuP5hhOxyHTm>3xvJ^|I8jg)c|3Eu;NzoNr+xx1T!n3x`OZ6brjTHqdo3_E1+_2@=14tP;H;1Kj+)cY2eIj zYEX@g%xEgy{&zZ{k@c1*lSh!&lK$(rT<+k?U-{YjJtWxvOodUiA}%(TO#5d?Z|@}J z5W_Kf=T0DN#`AwmC#m0q@<)* z#QNz|gm%GDs=mI$1Q+5vE6dLIUYkC%pjPd}-b#*=v(2L&J?)(Q3BO;ymyP+)R&-p# z{by#GXIfe-&z_0lSwLDAqEl8g&TFM~b%MXX?uAlX)P&sQ_@@-4G``+axH;-ppzr_31;9l?BuGqv4Uek2I>)G% zyu9F5H*n;6Bxj_j*K0LgpxX$%Be06f5QZKd$`atJf^hWYvcoY*+u!o&bx(#Y%HD1qPbED zC}fNzB8utFjoDJpyY;X2+P!5=HA&r9?YvZEh>+P|*Q8h4fC=$HvhWD@!&ZG}pI7l! z;9I6OKYt`F3~Pq8js-FJT@U?rG(F9uN2m2ZuvX^o-NR1cPbhL?8>$)a3)frFh>JUL zem7R`?!La<7Zb^(tSn2LpMmCfv>j|d!niguQBrUhhspDpPdhzdLv`7wO+{>t&O22mDM<*Ev79rOb4u>lZp;fl`eeSPVYD>c>jB z))~Qo3(h}LuSQgh_AQ6?EX-P`toRy!=k9IZXVGbJiGS#dc#`v)Uy~sh8v3jor25{T z_2(>x0BuB=kHgo_OU6GIOvlH=cYa;#wmbbB-_1=fG!&7T^-X9VfTM9Z=0Z?VeSLj% z9Bp^7F|K(u=j9pl@)8hp&*I~qm)g<#x1oAmHmlBwX%pBCyeUk|ZF=2^a)gcG_Y0I- zhy*b1NgEm-#(Kah^YSGv1Q9{y#>RFJ;f+OnY;FQ25)B<)Gz`E?OC6wSyTpRrPSGwQ zAhp+>YPcm>o=HEoX;@FqjU*+_9Uujhg#$i8%g_E)Io$2Wo zKfgc6#}hB>ptH$7KaWAqNfEH5DVJHi-gr&|WFC!j1Y%`ul)I^{aN!OV{jVW`!KE=M z%f=?RDi8@y+m5T87UpB_ZPD+{H3|QBPq;ng<8$PE0FT588qmL2rXcf^PCV`Y1BZGz_smeT=*7@y-~auA3qR8Y+CW{MYU5D0g>pR zh8zgKeh1iBmndhubxC574Z3c{h@$22Q5)li?9({}!66pP+fYA#iAx$VLIwVC-2 zX>m!mvVxGLp3Hl%Fff#WLK{lIOCmi{)vV7PP7v_s>{>Mm1`}Qkuk)PvI0L{99joJG zjlVt&PaEm776xw+Q3T9{A-l(N z$6^42c9`{BIA};=8MCt9MfB&W)*ti&EsC-x*bb9?idRzd9(>lUJvxLC$GDJ?n2;Ce z?VtSo42zH%Ty_;-Dk^Lg71=g|SP65JlbLyW4clY)fDYiGv0lad$rWkS3Q1wYF5TPgnMp{%l;+;ukGvmzsn}K$RymSrl!Bf z)l|J;0~vXHef{KQ_vu8{Pf`AVI&+ zX5uj!wq!>O^!%o#@_g0*?)=5bo>xDm>zZlpyT}n4`VhfNDNtC*z~|xHR1-)PxVsyq zRdt^LSJ0dU;QP{W`jfrIE-QQj?l=xRLmln!D;@lz*hC_di4qdEH4f&DQ}vb7v59F* zCdR6m4-Okok9t|(KqW3aqyGBUtJUMJnVv`{Y>*VMS{RtQyj@YUep-+upZ3jAA2^#K z0a3+Yde?f=sUK_HkNhIE7LU}+qM;2eDfBD1H3S$0R$4PTv)ys*C)~1JjhEa5ve!R9 z`RZ|c73GTd@!=K}c2%q{Uhkyjqw1cljSc~PGCBxg@)qWdIkm(311{~KuP;so)pkNO zj~zB@T-sy3!`y*22jPw_M>|ArRNbwEoaV(k=1(9n zJRw^wF@CKtd!RLng$G2?$ya464>dM}+ZZJzknK%PkgNwCGKil8{bzzVyNp<&N}jVh zJ0rPIotEWVUwHk1?%6YDDk^3w1NilA7%rrj9ckeI07ZP^{LFFqaLc@e%BTJZ2zEY6 zM8;CT`l@Y;JXnos65A&Em@_)M!7{l(a(}VdiflpzdXskBe6QYsOF;cvt;^A3cdDfp zsQ{X5I^UxLhj__5+T_QIkSUNlupf4pBevjaa_UK;N@`cvr*1VVVd7l_^H0az*Uz<; zPSZ>+HhJCF{vCvH8kSVT9Ceuk(~9Ab?AS4#WFH?1Q~80O-rVo&eBlwwTqJ zmR6GOoU<82w2>ev=!0eww=;*?VC5S@e+RN?&LI)W!msfI=AeLM_H7b^Q(> zavA*Fq>wFg@=Ej7rB&D7@uS&@FjNZ#(gg=oqtM#!Fll6^Mlijusd|C^N&s5leBFon zfYXCVl*DJj)seFNPlnai)iIiNu-qDhh#%wmH|v32IV5w@($U?Fe=@5NX0*DxJ*&mg zrEHroK~`$MRy7?RosF$6<)cU3c8i_e<&TfCx|Zbr{HcJ?-UvuBb;-k((AQUd_im0O zC-1sczi8Z<=Z6{}1B=|mR&Bl7cY-NhcjV;atK4`E`{)o~Ys`keJk?b@2(C^l+}_^W zSwQ)z=X~Pb!5GI|`MrElOu9oxI$siNU>+|gcZGS@eRVLS&hw*DaVOy2@w_|^vtlOg zFa#+hc{aF7e*;DV;rG5M@S`&sZP0Z(3O{&M{A;@9N{f0?*;fO7wr7DfCMOkcuZmV# z5l<%nmAkO~*rcSeYE4Bh&rg$r!NEre8DJbh1^dOPk(Ppjm#4Ds!-kH9#o~rLKQFI3 z_)M8bc>le_agIN-COC&cto`P^B;oV^srp>3!#)N|iXJ0mjkghNw0G9?i6a;hWn^z2 zINkXiU04`h$h?6EG6Y@MGwB5SKP`7JPl}@nq3){8j%@4aKRO(zpvZGDG2IE zWr`H<5&cCwToli=gL|iEq>}_CYF%e18VEvXg$(05tT5D{~{jc3#PLJnvaPDkNa{j++cdTwGVl(ogUvH^ZHz#v6)jaajZm$b~ajNA*7_x zU+j4Af9{>m0~#)_>hiBJ^rfi%{r7PSwCNNfK|F$iS^K+DxF$Y2dYE4MYFu1nnGq99 zQ9AFfJ~`b%b_^!Ke|#IJ*;M;Yoj*Y$Kyz@t1I8# z!_$O3VCG2RbYitHyle*Gl-0q-H8n8}+}q6obhW=M|LfO5Ksd4;*FSUNqg+j%nYr>@ zTHU$*+sh~}t{d&KWYW!@OYV#sO_kbU&rwFgd(-)%CaYq2bg=w&@WT`z%#?VB{EWdu z%Y?M(;a^KV2|gdk(6QWb2{K9PN3y|=z_{m8!*6x#bx9Uut6D_MA71BmUe}wKqbK*Z zVPW=mKt?KJe(rq#?o38@`{~oxUjpWsfiQ@!4J4vwqL;|ETA8XhOiE%QCI%r+$Lq>{ zxKb#n)BWGq!A2d&!*lVWf6TaF?RuiBqM~MyRuj~oQ5QIBl{XZblbF#oGx!womBm;N zDw~qT#KwHBmoLR0gU1pK!}X*D#9QEBrY9vSDk=haQ+4+Fwt$$GPV%p!KX#@YbU4SE zhu4I4e`5dZ7-4tzF7=#))d(iWGct1W(eV<}%j@Fo?Vms*J_vH(&zqKjM2fzCn^%%C z#HBzBthB@>AM+eH6k^GcuJA+=qo zuSeRYfqdcBsjP3jbPWM8p^grDcz7SUgTO}ji5t`A){K7DWU+CR$o}y39YUooa@?ikp~Y2A zO_g9bCkHBkRdE5Cr$=Jq5;C%A&}@5C3(z7nFtPX*&s&AOnOs`Buk##%uTpRNOJhhu9by^C`&BdEbSa z0k-Bs&3PZ;y|=;v75f9KunO@O4Ags<*m69zRL*EkoZ4o8y$|Av{pz5gdTCR0%hl&F zV;m|=%rH7zAM0%eNG0~*z#YuW)b&q+X9!hKcTu5~<_~7~WrdgMpS*3^x4gJASqcf5 zy{?@aoNe7`eszZov2b?Au`z=0vUI0U?+_jo{IG`0RL=$eTbPtY8y~$^x$Ikq}@ZTahqEX7_%=vdNA!|<{GLlRu4 ztvD%#DG{U;)D(|T6FQ#S{urJ9rNecdtGg;rPF)>IXK=;iOYxVlNovY+n1p!2A5_X5=3xgF61g*KnCI7n@1ZtD#QQQ!uhUS_sD|m=m*fokM zZfS8m{%E&MGqc^R1rte{9QWKZXlXKh{V8-y_%F;hY;cbIx{Qh~#xQbojOJG$k~7X&!lb)%+T-rKWwXkE;87^oL1H3(541<3qmK_;7s=L#fjgQ95yP zNhWnIS?lqM*Fum+&2dmwdohwh1N;`i^?iMNU4^@#*~{7BH2D%;xE*){dt68e@iVqB zTNLAdA}RF^1mjA7NV7YG+PC!FGoW@t$D@RDn3J*POSbk69i!HTQ?}KN|kn8bDTGSqbza z45_H;QnOLFuiX2TF}v#}cdl75kn=->RcT8%XwZ?4Pq?zVam`EEw;fwR#Ga#b&|@tp7f%! zq<_gWz9=*-Mo(K09XWK~#VbB+zgndIP@CkCUESUx*;{~MY(;8~+vcq`nj1;Iolhi3 z%06FGQY^Q{ZA6bD_L%14QP5P7kctn6+ZL+bZf&@-viZgNH@*O826oYHE$$4CeR6up zL@q%Ex_jdW(DJCsI$2ml|K)7V9otv?-!{v8B zx){dCD-4x?yv_M`;RXUM`3OQ{|KcJZ%ZZl`@_pT`=EB`vPU9pAj<>ey;tIBbZpHcLcl)PFw zL~0Z@#vz1AyI*c@Zn{w8z*_9C-%f99r=L5BisP{Xcc#pWBh%M65%Hqp@ghqKq~$By zhQIw5Ouo>*WdusYTvMc`-RN(P;Z(gWO$IfMxpI-XqVQ+dzY4#!0zE88B_v1>_d1f3 z(cT2bj#e-mOCIdqEw#{WTponH)pOKY>#={A?LHmFC1goeO^%ihvO()*yr{|s2xyR0 zS==wn_ODp605O@0jg6aT38*{IsZuqM4@_0dtl#9Q_gsW)JQ*Ae;Sid-mT1OL<|sm3 z+(|7h**YJx$VNcxo(}fzz~~lOMnD}9?hCXWZf@3VxP~aQIUl@#rVmuL23i^Z$PHFImqE#iu>0c49vnA~^ewX`#TPC7>O!KHAg6#-7^EPId+z z#J8m*pFjIoIz|`T(fxNV;@$_`5B|NglU!!=aH_@qa{Nc+0nj}8sE|F$^%rHB z_XY~SuqO8<8utT!r1RlE4Z~Mv6@C<_#i9}F=82%XqwD+~U`u!NY zI|Gvrk>@Z*Z|u8`0P!)3rwJlz@b!l&C1txrtl5L*!{0N~D)4YrS@d!3_h54I0-uWG zbVCSOe)si(4aYM2^L^4`6U}4Dv2{LoUVIg8ZJCZ8R8j~}I>a1~=WD#r%}If4 zI-=Lahy()}$voq^xRyWxL4==SSZP&{8Oco__PIs5wB z2=IS=_>kA-)BjO#9=zw+LvyQ&(@6Sy51awRLMb4Fct7Rcruh=h7KrmvSC<*|Um!2O zIY&D!Y3#0O=+-5usdpPV%j(zr@umRI)Anign4q_*r5LS?r)y)-~s0)r+e6{w>d z-~1^u)dF&>lt5jbj4P`|LwrK3Qq|L%=k=GcA&b!t7A#mE_hUc-s(*ZRRw!{i z2#gIE!cYNIsMEQ)Qt_0|^@$8M)sdK373ZkeEanz#V->?!Ic$RByOm6A!K47cJmWDn z8e-0oD=h^$zdMMqwZz=L+N*cK-q76SkgZV-a?5JqMu6J9;P$Ml>MrhFW@_qvD!Es$ zr{69QG&YBe*ap5-s}ZE8c`Q?oUgKH9wrLR-ESoQ6vP+S;&B!`8{Ib%Na&VB@@&2~) zq-CjU_H(;iFD^`BVii)}^gVk=`3axu{cipnzF)fkR{E`n+SSH7sV{Liv~Qr@e@eL_ zJ4t2AZJNh@!sp~-#)J6W<;+vdIB^jX7R@|xl>2YM`%(GLRGm9a**x*g4bGS=a3ft_ z8ySg$=x2DqHFIc(8xB!#Y30G=z*Byi2FS(+1Jn;Lpu7ApqmdcZNM*`W)om~A>$hKc zKCv>KoTDLzTHFaW=9@1M$Td~5F{4K;&OS)jsT;-)%)oIzs_N$8ixTHh^W$e#Fvua?Tkk zlPhs9{}7}4Lb|hqT2?sYIU&cWuvAXOp9dskX;s&NQ;!uHKujbw3 z$7m^gK8abf)rZX9p9aDWm}S`dLKcP zA(jMcgPfSM8-zsEbPq@WBs5=(CUX#UxF1n4T@dgsU~hg;3M-DOfVoW3noy5bTxsQW zyi8vH_1JDD3CX?KJJD(JS(*dA9S#-D=Kepih3Kbs=je{CG|lAAzPY~nz4Un~O1U=M zBX~|CrLWXw9=#;J2I_`Lr6?s% zMcD-*gstTGjhyaixPJbKUL#Etdd*b1|9I6q&eh_#O^Z#e45L0y_>sYpiRKCBoIm?A zQwhf-8Lc9Ub4L7J2wGb-Z5KyG#udk1yedPsPuDJ6_ph0W^ZR%d)s+}dtzI5+-Iy1s zOU0p6%es2V(qZ5`en57lySL@p&Rcb=7@?7toqR@|H4BQ(te|Bkd&;s=hO$8-nDk|8 z{RIZVuMY|hMQ!T--kf7W@Q)`Q06iNapS=m! z=i3u}A4*Chs;cCdY+0Wz!K^*8i2lmIEV}J|g9#*1VQu;L-kt>w&HLu#`DK%h6K)B` zJ>x!)SBEr?DEhQc7YGCvT>usjGVspCoK; zC>pZ?$1F0XcwImXM&FHfA562b4Q!Y*56KNg9m+n$jEwYVh`e5ot3FZYvZ55}AjBmW zyr3O&srr}&Q0%pZZWYuT)I_qXYTfyHClS2W$wJ}r-HqR1VJF9>D?CTDBllJTGqV+- zC%n##S-eU=BZ-J0aT-o02q4#p2-)YWV=?w$zm^|j1`bYc9L$UE!9&QiWP`b!!Qq-&p_)(90Z@qDn_ z@6lxp2nu_E##?RWvUEFhiu-qMG#<)iWXitHDx~&N-pt=3_n!PI7h<6cE;;wAH;3jz z?}n=eD6H@PQQ2IEqt||qZE0dgb4f>RW%KW>J99>UF_^jk;{sUqhvbQ-L;r8x->H^r ztAzW5oY>v`vIeSZtkN7++&&&uLV`R>r*>Xt%szI`I<exXXw6tgg& zi1Jz6AYq9rDDVm2!MI#3MhGYgEO}oL=f7ZhfUbjCSc)G`ANaF*eLZ|)!l``>8%w0M zp`)wgJ{~JDL7)&q*2ju-G&7hIzLk{Ngua?602049a0!Zq`AYX~NCPv!e{X7RJ|AAo zVc%wo?$frO|DpTG3pmV4KSwvj!uM}>1=_y76y$MTA$J-a=*r{2mNl6itVyR@{t ztQyivxoO`XEi2tY6#a`SIUPv1C>MCP)MvF*{chdDci!3Sm57VhZ2u+SuH-zsN;oD} zE8HyHuFj#NB*DID8q$tMiVRd(=R-^~|CJTr?I`7#jk*XPhrM5{D2)sZlPHtbxvk`0 zivIfj3-q(1d2L;kEs2m8HJ<*=R3!(|gP$vx#gvk<>liQ(t|g@>ie%XuwNo1s8qQI) zi9Qx}nLC0?06yVzG3hqf5*8v$ATHN0Q*AMQ0V&D0(@lGV)D)Cc5B682vLlZk)A-%x zlo64m-m_gl{DDG#xJ(>W@f|i%H=wyim#cKuCqdm${I%hD35E9Ns9+<7Tby*%VSD>T z7TI&`9j{&S^cMRJMa(*0cCczAS6>Y{@ShB+rQ(MpmkQ>MCtSzIJ9>VstycjzgSEn3M_*@dZuYcta}A$Wk||~_ zuTDTkij$6grR$3r)H@38s&di_N)={rmr~B(G3QfSy7Ik)Rl~K%F2W$k7f!#AxK$n- zz=}26?pcl6(N0ZC**JU{7Cp>_!53d?ye|Xc??Q`_s{cJTB2y|wgyHu`PSuO91ORDX{Ij4cEhmXLv_2&O8+VGdb7%MQ?)AQWu<{c z6@QOmyi~u*7mP2jz zx0+8E2B-Sc_%!r0wa! zak;{p!#jISEUX>UF;Yahrrjlv+nn(lvhB0YRl$Yfa~Il0u^VOt{^}!TPR7(3+kX-X zlD>?8=*1TPo!i;XKI!_=`eqEHYtyHP1Vvc`VR6x?PZtv-la=J;ZW-bk7#O`{na}i5 z9p#qIB*~1$U<=I?l{#^>-0|zJ$dHKQY;^YL^c9R|bJW6TSdB>62F{lW)sWZc&qz(s zRWbP%)$8*Fdq)#nBblnY%(`QZRqaj^WxdX8T&5FDbJA^4XWctE?D)-&Z?Aua?YwS* z0nLDk{PP+cSi&nOz&JXqTQrp3y#vv1sgr{YX4Lf)7g+FvdcMqI$+e7vfgv$D8CY1E z!NE4s|2N*cRajE|uHOA}@*#?9DgijG8^I&S`yfNN0?v>sXQKD$ht?0R&6|GeM)F(EY&09f)V?+1VIw>v*Id60xEzl&Q&B>K-sP(Q$M{fT?ELHTeg2 z{8Z_S(~@+C-=kM_Uvz4WdeYb?DJ$VyaWNXT3Xk)mo7BR>*LQg5Ks4FMDsw?S!S6)h zk!v?@UO-S6R?*x>$vG+Hl7A**$f|rDaen#1b+)nv?XTY&N#0?Un(@0e6GrvgIgAHeM_M19N2T_!Y+kuo`l?8>Xqpx@((=0U4{%q+ ziu9d~PO_OeFgO5^!O6=ep3|8|Y7RS4aCU>9C3iU^9e)zA*#lAWYx}oVC#yaRCNev! z0%7Q>Y<+;WhJd|*t>EsH;WGLSB|{~rVEgEckdo*|3qpKqH9U&7&SyI?6Yd~e3ukyZ zRPJTFwV^#y<$PK4E7vGMp|?s)?Fr~rRr6&mx-t74l0)N|$+m%`bEdOSCTf;2@7m-X<0myguzo&v`}sa%DF5 zlYprv8KGSSmy*qB*={!QrTI84W^o7yt`gUwLVo;MC+92&5-Pl}Fjd@Qv-KgLLEd!m zpA4^$v)OlD==T9_BMjQ_9)^C-a1rWqr{Vb$U&QquoJh0ZY@T{IgIC4UE+ z4lnDqQ?`;pftceq^RM{&I7Hwpm~Z=oC;zks`pj^1rIWo?ZRE~Vy^CK8xM4wHqSX@y zKd9_+bYy9xkDTr{ip+1B$GnBB>e80g7TSFZvg9xBxWwE(Oo;eNL`$^OROq!}1R>$H zS=Q=I?!*ET;`HQ!|9pG6?Xxvq$<6mIswqKUGKu9h-+P>mwK~5aI z1?5x9Ks(N7o`cI(P8^SVcWfBwX))Y>50qW9J1!M_EgoV=$^K%KRiOU4kh-*bjrOfu zH)F>fht@Jl?bR+aM3b{eOFa26KF>P_fBkB;7!n6kka0Y-D{5kgY)*T^Ajwt8e7fe~ zf(zd9Ah&#l@9%ih*_1P_w=esc8}NI#FXM#`4Qv>EFVas^ZL_pBHSb7zf&a zySJ~5Irgqo1_r*gv?-RNciDTA;D}<$x)N_&>#)C>^&TyBHF&i@C%D+o5lH(7WVvEu zi7<7310aR9;erRg@Dl7MudX=nw8c_}Js?#qnD3e?3MU9%1ITMmD)wNvk8U%7p|NkC zmjE#)WsV2 z(eACVGQv)`jNTK!wE^jC*EO}?AP6fd*R>lr4z$O(szRa;gD9-1Bogkm0d=o3nt1J_ z&q3JttLTmg92}jf)j%_w*AL9Le`vy=cbEVk^ES8Jd?oWTVZn+Z=JStr*ow1fU_fBl zUJ`JupI`GA&XxMg4u_C(`Z%^EruU?L8hDadmk z`DRatKj~IIojp#jsO&`Ft7`?l^z^UObvl;C`hH&`7sMmpg@>?cgzm=Z{xtRE(#*=j z`IZFa!EBsD644L#RJL*VO%EJ!=dlnzlSPMk(n0&A5IND-Y2TPi=Z&y6yus|6R|b=x z9}_*+2?%W)7xH^~!KH#5wRdxdzUGbv48Z%wh!2Og`T3N8n z*gu;C!zQaABH$Ha@grVO$%6=fjJ4XaEj4k=!F0b*{Fgnx#W4Y7%iX0j{nmd9ie#@Q zuhBzWs^eRis8y=?)I5G@=2XjzpR@Z9#zsmuFcDDIhcNhWoIU`YbC7@?F85*p?Og-I z!9BIQi~5?HILO-ApCW1L{{TM?1vqACZo;0pw*>@VlU7H4`0zwcZABvbPIqdt%_mG} zP7!Q^+hbJ{+#&h7opbh|uf3#u86Gy9!qi*x#$ddv=Ob{Mu<}x1e#agk4{4s3MMXo% zlRtIOF9@G#==YV$$w}fc`q3ZOhI*2cSkYO@*^)c0#{coOS|x*nLbxhShy8jpo>^M< zfH%mZ`Q>Z3Zia+JiG~M(n$cU0Je|sD6%d35yCgMHQ9ij)hFr=A5Ay8yH+!*fCncpe z3yZ<1$J?u~kWq1Nv8=5(bnP36szPwn7$`@{3SxNHcJ_7rReAM7GP|>1Yi06}F#*Hv z>FrAZ&lhPfbipQWDlB{G=)*U%gZ+DkH6d$eMla{}zff@lj(^4dh1w%iiB_s`2K|}Y zupf%BX!m;W$^Vhb_&1@}uPp{AbKzR6*LqK!@JO@M(?#~SMU-V^_~hh-g$;mcSYZ|A z+=u`tq$do-&WV!euee%X6@@BY|g`z6mJn$kpnG&jSbtT86V_N59SYd|}laz!_0XZk93-HEwEe?RAjLY!> zi^E~H$5;iHua}poxHy;@_rZq}h3sIrZ*dSDYWRhO{E3)hIK=qm3ApDeLkO2mm4t<_ zr2*+@G&D<~bVSO--`{7sy=}d+EJ*Wc9hGBNRW=5-$yizCOU7D*+%Od6{JOfyxw&t3buS?}_qfvFTUUVBbrUWQ@cQkymT%r9D)py2 zN9!-p(+5{OUB7zu76u;~7gt@M{I|I3{}O4(Tmj=>p@`(v`rQ?kgH2GT^V~8#K3JZr zmx$vs%wN2AAm5ajs2v-_mYh6I7A`1zxFzLlIy_WP53HMyWnNd((wz1mENWCV%mFc^ zsj+F(EWXnK_IWDsLJ4uIcwC&4l9S4;S84ZNz+w~!P)NQz3`f8Uf?rCCUy5FLw*k}8 z+-w>(%vMk5y0hVG0|`GXyBvpql&Pw?7@m65Z1blJ|rbgf4H$d7SQyAGo-j=zv-d zjjs#Kfv4?K-wJ#MhZ@nprrt;e-gJ5GtfThBV9(n6qiWwTD;I~MGiAKTW%Q#!d~{C9 zx7Bytv+^`#PeevJuXA-$qIoam1%`5&a$K}_$DhB>1Bd?7q@W*^US7E#6cPkrXiIym zl$hw0P~#ca<{EP_^Z>;hy4w3zGi=Gw#lUHt2&E_`||sbGUOO+rx+ML{iZ# zp*qt>#>T+w{B#a$uP>~*(vgupefErolQX*I?1}C!mwv&gdbNYpEcHVw#~!G5^)GW6CD{GYW4n>S zxH=+XtekSh!XL*o(KY$@x_aY%^5L!Z#-OFN^e^A z<&Ix8XJe`3BYM>m`yHczxbdo8`f10`%5sr+@5KK%Z~|=yEbGKV$~%?s;)`tQdd6>N zF)}m17NXKT*xpoJX7_W!`2(`!SBY+#8jE!~t0GY$AwPYIBUaBJj}c9(q`h=pWk9C+ zT@V{2Ba`m`JF~w<0J~$stkAGP2n5Vrr)9=+A0w+~!a}{`UFq8?y(+w@e@QOSWAOO2 z56jteH@Oa75cgZ%!#baDb%17}eG8Fu*l748f4A*Wag@p|x*^|Yr8D&I*hB@#T<+!_RYHhK; z#G=&n>lYgZMPl0LUdoLB0+frA>AG*&0k|FD-ym;oY2YJz{#ICcJ5BoO?k-`ut@Hi? zrZa^IJ$>NuAyvy)H84gj{vxO?9y?T7@Y-y9-j@EH3^uPH7#T@;&4L86wzlTtvIQai z#{T}foa#OtVwTrJLY^&Pg?XPaQ=__Xe4O=uO*`}{0c7r=X))>%`Wj3~2lG~dAJ^O4 zdqMnspWf$g*N(t#KT|7vEb1 zC;pX(enyWME+8)W_X9e}w#WFtcd7oCEKc~W#V|kQSX+ovzphlSxVP*jdVRU_g4gFq zasl_Aa|qubCv|^Hd_5gw=cMgkyUtie@VS&@hU35!bIXWc}Rxd8o0G0 zEYVj1_m!e>pYxB^sCj%Jeby&}Z!)sbQa;h_Lzs){&gQWSs=m@M?19vb>Vj&fm)B!QL1yubk|kJE3G;E)iI$;L%+ zad+L$&^L3iG$SHj!s76n<*=f(29E|h#?Vg!j>xo)kZiYl zS578K^$MR!US#+!1;N}Cq0->V1Pwv1jozjmt_ZGmBki76vRZWe< zt_Z|DZe73rl!ZmTz~FsFMa6UNe>b4@i&o3WE@G9>K*^-dW>`*d9 zsY(emNe|Vb6F1)AR9Ifl92-;|8IbHYtKTH~VvcXFTKdAMTOx+_I2R4{z`~QHrGVch{2pxD(;-6_xrlX% z4{dixZOVh?8oC1g9}*XK6whWx@!gw1-x8Fc3(C>p(fUg!vfxWl@#7vST;$M~Q+f+DKg5*HZ0~hcb0P!^csw(vyb?$eLpq$gv z+6q&OBaY&&iQ4+48~2OrULd1#Q)&s*1x z*d*m{r5;sBf0lhzGl3uyDk{!P@=ADk?=PM2PHbQ9=y;Xm>XwqCx0H1<+e*Bth=Gih zTCtw(iiU*Bsj9`I{oP$DC*?^>OHYUEvia3!bz~omsNmNZ6T?Q{?JnD!m}I)Ua|btq zs_!m5vaQWcCT3d$X0D_XSnlJ3-mfp+%MxzPL9bb^n>m#;Mj-5A%9?3 z6}||zQEuP7nU;}ZXk;`rJlwsYm1ReB{_DPDFJm9WEgkL6rO~K1l~Q>t@;3Foq|-5k z9I~93MJM^p^Wq)-lCperFWSr=j=U4XCFD)IpW~J^jpkO7P;qz%wIG(#&2PBl*%L48 z`8VyauQ!W_8qSohmzbA-G;`Z`?_2il<||zIV!}CO}r#C zyg6w-L)>e^@i(+)Rzv0DGR!WGPVVX?>l4~Mi7K|e7v0KZHIK6ps1OoYX;~B;-Tf$4 z8cyVz$5`RA2^KQq>68AlFnEi{_J}!vfyPq%TKF|ytF;yw`IXLGLwn9ARNMB`>}Yvo z1i#Vb=Hr=R_G)0h?S36z;_l>})Vvtk-O*$5XZ04`x010bz+%TLoNA-d4GoO;=x0e# zl$_=4j^?{zK@+EUs^8b1Ke8cOXXjQP=d$Jo;VT>gEQ__CH@g&zOxVZC@;FrlFlMMH$EzI6Z>4 z2-HtEbuF$Uzw4>i|J3OzSh3w58`#|Bk$x1?)YPu?TtY(P?OSSl28r7baIRh*TsG3w zBxCfbop|*KnEK)K^ZmKG=G|R9;8kJ87PHiEj=1ILCw~5n`P@cq5LB!k!d zqbTE_7Z|Qyoe7J|lBLQgV9-)F`rrAFOQ*m;!rbvC?qxNjbv$6I?`J(d+K=+O(iASv zi`@U>idlH+!Q;o9iGtK^U+EIQKb}`Se=II4b#;PCZ&#EDz~!il1f({8=`eyL%ey@r z1qJ=5x$=#sj-bl$WS!Bl`rY-7Nr8)la#7@aXY%1E$CtyxZaZPQ5HMiC6_-hWN&a)K zH)CEboQC%K>;G{9F2L^wAFZpaqR>uAP*<;V(uH&eJ>Z^Y@&xQ;K~Vyw7rB1~QUe>; z^cq!pR&%zHomP+hNqGm0OojHtogcv$UV!c1x!d$H=6ZTVL@2bg`s%ZP^L+wYY}qg7 zUmKup(_f1XRmeGL-L)L&R|91k%;Paz{jG7;W<2AMp#d7Fm%vY!&|q{v2wGr|WCzd}kTYwHSo4;H zU27CZcVmzhM{zcvo8~qwXuE)vFll;;K2AUQYx>{O| z`TD(=F4ar~=;GoG8&tMmgm+OzNy+2WCy-2{Rj-&{tEP&IxZ`SG1j26K-rid_DM?Oyns;vBCZUoz zIIMZ^j=V7+Z|>>2h=4gxl!X8sLNo*_Y}*x_uUz&-goKw6D8H6R2G1nLIG2BY^0wv} z9d!->bEJ2BJ3T!G@L1j4PLH?zSqVW+{)g>~!zSWYe)yc7y%e&X)g1i~#Z0-3zPlU+ z8uIc*SQF>JJ@Xa57|l0Yuja^NZ8>&g9+8tL#V1P7k%<_J$Tkm+UYW-!gW@#hk6^M) zb@9dUlBANVK$q^>xracwOnp^<$OoU;c*+yb7ypXMMy2GSAi*mk!AlEUGVNRDw{Mv> z!+iM3z59jVp3U#LW)U-=9}&!BuZAMyg98U**1pQZi=m=)^z_Hu=@G-Sa&oN`h)5VZ zVuyNB>*?6{jNR@YMtj)pkq|DkCQ@I@U*Ug+>iY4CVO{O|^@-SzqRD;xCfx31bypQ% zhrmCP{jMJ5k`n8U$t<|}VCUV_D|gwg(D*bo zIJmD;5sdD~Nhf5%^tgRg5ouzqHTWmQ!y(Fk}fxP?#F3>T-g_7L+kHaaC%fw4_ zE32)u;^rjo;}+d&KgwyjnX>&+SS$NAug6I zQyTfv&kq+iq2U37?9)iKD=88a8!MdqlUf$+K%Rw!M(Rw17%>)B`kBlR6^9xQe4NV2 zFkM+CTKwxW7D7P*GIf7|V%u770RPCe6)zv3m99TB9nwtUIp%Jl74`Qg-R`4Aun7+d z`MovwG~$0Nt44Y9QtKJPN$&3OdLAa&y0Ln49IcRZ!tGj>;4)?VM^aoIhsQo|t0mGa zJ3H$($yrc&<|#Iv0FEQQ<469nYgjcaVg{L;^Z55HPP#5^)7^4|&9pbHo@# z5BgWdqHrAS?b(r#aD|>8iz)&fLUbfFG_JX+$sR9vuoroyrY0*dkA{Tg^wzN>HG26X z2;?@9FZr&erw6+z#6kPvWgXyM!@VFY46lFqXDASugf{2{~zQ)dfK-NRuFP zgXSg@e3H`153yQDnuKIUz0zT<%6V?I9Hqmakm3P)O?)5P+u9Oks9!%06-}0Tbki(a zG#Ltts^hHTo5o9ID?^5BBMVtczi(R8{)?|?VP@X{+MRdLo~+OIq}N^|5srTTcvM$k ze`}}MxPNu1@CQV$Z{PmDM<0d24SV>5CPh$%P}>WodNbb9GTGH<F6?}D`b(?(JXv?*~EmgAT$Q`-?WN9kQ*qJVq~g3l zJhPPg1N<5t3|UD@;*h(+#O4ETQfXT(HbBbegY2fJoLr8(Wx8|!MCLG$r7s5m^>mR2 zag>`^1QZmCbEyOc1kl_HL4y1DxuDm!HaI)d8`sQMU3h7~Js9`w{l$7L6z#u3jgkA&MMFRW=U};13kosnPJRdj7-Mf4sv!+ok*#s8Nxl~eLagY&{ zGKdS%YWtdp*3{I%*9Ms;Wn@%G|E-UmhPxNkP%j{}0FQS6#wpuf#O?cITSG%aJN>07 zB1sVuLOY)y7N##ryh9aKRYi*mDc!xjs#b4FBz_4Jw6)C+2mqEk*7VFzch9||SV=K4 zbT>#(pzUr}_C`QJ*Tsbl0ZFAyrTmolsJNdX6`lOW3k(nV1q1}=yX* zn}5Mt`t94Yh=@B7t>1k9;{8k*OoqL^y9s>+xzM_wzkUoNYBuv7_F!^bRKR4mv40+K zUZIOL3lrNhVIazt!+cB@cg`bXmcGv&ACCf^aM4t6KN3!hNq#(}p`|4>R)9 zGqm*sIoZz=OWmAri3ZsrA=^+4f#XP6Y+qd+6W0-$w_J@*Q_*tEzv~yz%OCCho3Ky- zjwD=**N+R~Nb>VTC-F40g!(*?U7X!DbtO|Wd?6(5xwjV(&fs5G9(VJ`ja$~VbU9^F z!QrSviwD7mz3IWd$A@?G9fEjZ-n=`QPoNe!cCpuzR|i!&>ougcH0VG-e8P9lkEF7Vx^ziNK){}YBIUz}%sfb$A#$$*jDPV-lh*_V^O$Q&fLxfF9izDkCJqjx%50Wcy#FYdTJFFY zfYYu>PFfnQyW9Lo%CBH!_h%~A7f*t4@b=D5G=Bc)&kesmZQZ6_hfzWf6$>)ola3FD zR=J7_IT#w1MB*Io?l}Seic26$#>!jmoU}4OKQL_oW6XQ^+A6qXIqf3A@>@pcds!Ld z!kHnWFR}lvn>xd87 zIEK1YB*;YEHa0f&^ip`a1+O6MTstrJH!+1*;wl`~ErxGi2~FA!)O`I|Kv?)Q=W;U{ zuo|GNyN#dWoHjq*2%VkHwCxovtZoC1<|IsP>_A%nw{KGdrMu%8_T}MSH#D>d*@pA~ zp8etcWe zU`B>FltcE7$8I4CvC-I8oasG7{s!=Qxc5fvU~G4wo!I>cw3kXSy^?%QwxK`HP2~yPTUg`?k<2v&RYS2C zPuS%u7KUdP)1OZtN4k4^4aU`lI^HvdmzBxTw4~EAFl-&MQ~n>Kiiv;p>LCPu>opJ# z)=y4JnVp$|p<$uqtMijE->AO!!39cfK88qtS=h}IHDBh}cWSHI6(Sd9;J$L@fRlEew zoJvZWkU(cf`i#6r1BU!KS+DC8C0`$h6R{?+5hJk{?u^ag%hie_nD8M@`F z_@9*G*;_@I33*&mao*8U`Z%}Dc16qhP{G#L*2cycv}p?pZX&|MPafTby0Irg02@$l zK&XMHc=Oh+PoMTlsjq{i)-(Ox5b9tsNdr8tjIrp=k zgeV&z!{dYFhl1P3S8p6Ce~DGA*Kb$H<~W!Cf%+xq3cP82&PRKJt$Is~i!8gp8ybY6 zgZ^OXEOZ!7ZEM3u>u)#--PeqLF8I- zF5aIsAAFz~pIPPSZ^_6$g9*Rc$U9XTnL197&GGM_O>AxCZaKEaNCZ<}WnP@_IGA9C zwnR=uVMuF};PI>?6`wN^U#tce-QM{BMxVmTsr7P|Qq zif^qwfzbHc|M%|#NJ}XxHYQ^S#&0d7o;V+TevhtlQXI^}qNk8ECL+}?FKfJi<^8`< z8$W)JaxdOPR8kTH;pVQa`+DcrE#MpHWc$T2o(mQq$KR$^1hwSx91RT{o5IY@Wk3!_ zO5O&WEM_Jo;2>0z7s34NS8eTRN5_wZgrkiqD)1DYR)yL-?25Z!A~g+-zOF9t4gj!- zj*f;>y?enL;AQ~F7-xTfaUcN+4YHsP?JvbkR~Q2HE88Rrvqd0H3)(QOqDwcMz}UM6gD;|93Y zHZD+8lS;+m&N#__4tN<4xt!0l&6vCK;*-NK8!Qc<@~P&;Q5W1&8So1Ws>}NuKMV#- z-s7DA+r#-+wW0m$dj0BnCHwEz>&RCjDr1AbjgC-++unMurn-E4dl>8SPX<=1ay~~n zWL{@@rm67qI4)*|g+twRC-P%>Ep6`eTjZM4%rBiB&7b|GDuV-?SHE(bj!b#lX;0?6 z%J2Pq10a$dy!R%^QBjI~12e5hH?R0oil;(c>$*td{TCYN6L_K!9UopovNDyI@fRqe zE(WSNF>{me@I!h@0KHC5-Y+gTk^gKT=e>qxW=XiX(_+IRtiEDzA4wrbX}3I}4iQ+) z#N_3R7lA(F8OuH(9!!XEx!!Zf`rn2qWz9w2o>vfd;QWb+Wt`V_0|NsE{{`Z-EN^ee z@TjP;sHoewc7lrIBvTnw*+>x(oT>!|L~}C~t+jTm5a@Jtlruk&A|>T`+grm5ii#yB zgIBtq*>94w7M}oK%H?vT1Cq^(itpfsovr8(Z3(|nJ@hFbKdIqim$y02?`;G_Y4gyO zimIN~TnnwHUSG<{XtBUh9Slxy|I}$>jLZuQt3%eSPcQW={q=hp|5`zTiX!>Fb+p*} z)By`~U_U%!w7%gV?vbT%)nt}L~GkOl=oL3#uXbBpVy zp*Du>>P_%8OZwimfB%l{;o7tJ3~F%@^oLqpT0d72L^(5WXO@G;W!fL-lcPw{*XI(rKMAI)SA;PPXZXnM-N zqdV7(Os`xK*VnIKUnj1Jg}MVS@T=FaFCt`Q-^&l7r9_A0Qi|^5>q{va(@|APX5Z*c zpgcD$Z6?}_XO#i-&MQ}VVmWN0hJ)kcE+f`u17UR0wrjgze4WJ(IBoI>d0j>}XK0jY zZ`&!8#UG5}Y|*t5;7CmurfXSqIQM6-%(cbNRod$6>WYbZ|8&3nRto3_poz+1vxu{H zyw4qw$xcT07!mkP`C#56%B;D~SqN{HWSRYYmM#j-ZEii6S_G?$F>ln79g8EZ$Y6dw z*UntyvfDSBxzx6ZcE_}D_fG{CpCBc>HX!y(6`P|WaG~ap6`GiW+4Qj`ucM3#@?>^L z%#or$&hh&HPRzCM?mj+Xio0}?L_kGaRh5V|4#dl9-~7$FwP&+xV*KXK8#6PbH*fAg z=t|*D4heW;F%0Xc0FF3rPTy)=MR)5=tTZ-agJUliE*TbV+~~UnCoz8fOQQB%N5}D% zE0$SI)xN$9E5q%|hL-^%u8_jODax|250bhUaE~v^!lzDlHp;n*O`_1^WY}9&o zZq2Ikyn7{Z-A-G;G`6DRD26>hRXj2%IvO%QISozXw{JD&*m=-^fK@jaw`ZQBy}dmx zhI@Qc((gA<-cbQ+g@sjmP)Xr&b?YumOFr38D9-_%@2b_du(f4z{|P|t%n5pOe0-JZ za2PORDk_|y7=i`@VRJcpw6*|6RAoh-D<_qPiHploGA3FLz(2!c-#QH*3i;h(x8zq> z2T8Wl4<9Zl0h?MB)PA`PI%<4;aKIARLsgGhX!8K{A=&QwMMcTXwUJ!LnGaPVd*(1h z^TM-_U#)Csu`4V5TVfiq?2ETc*~c*FU9nu55+s_FB%KpmFL$B)%*4edWW^cB>v$0% zTp&%<5U`y$__IQl?naK@F?JpQYzOGyweBf`!9;Vj>{&?s`0*l%SaiPAzRU~H4t`P5 zO*1nMp; zIRL0ps?1Q1hnSeOz!+RgRP?Mauax`mM^-1ZY!`4FO+m$RmU0L3frSS@yr8g9h3XNU zrB)dkWh2&i>xW6?=trJqKP|Vmg28~`uQdPfcBKt%y;-0m;l{D&gZjOIY)XKn1ao1@ z@86PUW;rkUW^{C1B*`(EJtHF00K%?Axq6e)(n63*${e{+_|)~YBtdsy-}kKm_*I_= z&4UfZ%*+z;eRA^cncd!_%x}s;g*(@}uH8t0W|f$50g!Wr(-ZFGB%?Lk)n=#n7z6z6 zaXe-By-yxeZaWVUI|RhJFAF(q~R?j^VE(Uo$P^|YUeq$r!sCMIIN zwlGjw&fW8g75d^)yKkT5sJg~-bxonaXSm$ordDQk+3Dc*-?@BHV)ozc>g=Ubh|fx7 z)!P23!kYcbQ(fe?^1b)J1uGRkalmd z+jCR=)7Q!v_*eKk<~i(pK1KFPGLJZd)CVgZkG1 zQC;#@=-uCoD*5;kiWU8nIZ|T$V|x0&AIJTw2h9Y=V$MUHyOh3}Ej~e$T3xup0dVk~ozjBZY$;y_QBH7s_D|=+`nVr2yDiyLvc8U

    $7X%_XYZMV zu39d6Od|QSw{NHM@vD{DijB0Kk2cBE3-5DCXQihz<9|~uZEDP4agRDOeZv7cPL-<$ zeq4aIX1tC`vJ8f|z0(erU$h}Lc-a&tW^cgM|Wsweqa88 z*6ZBSv43#O@vM3tfQIhZ$`Zh39QBHSX%DS#P|tuqC(KNOZ?O20E~F>^1id{*sm_e& znJ=ZTUY^>TGgnMxK@&)MbcepRg2lAg@s<`6pD12pFdqoi;$v*jq$xJ2yz6`kr6Smi1OmREhH;)6+ZO~n76o| zJ~RJ?fxXD~WYZK-jTZoF0YNXQ2+@@~X$gJP6|lSjeiw8;s6bska%gfY7)&+S0oWKc z2cTbHe;JAgG600z@fXnS%6@}>%^f6eByCalc<|bnfo9@xnd|Yod+&53A4LtE98(jW zD=iVm;PhdgoC$u*BR_w}0(PkjW`T1=dZZT}wje`s!>Kz*)Q@Y8ncSMXNh0H;`xP!e8(q7gGg zjl}!k<>yd014{3q5XwXpP~vGJA=_WRnAq5Gj68?GXBbTU^foCToNYyiMmy>|(9kGA z0IfB)>LnGOI>0vP4sVjoN@F~;m<+N^QliE7H`CSCg+c)J?K^(eNS*MRMf1- z>NAs9V;~7NKK`c3=j92+CSno>mmT`B^H2F$g)~#zWrSuFf8Y@3(+hD6_30HG<FtR2*w#lE#1oEq6%tu)Q|TKM7g--=Fa5noEsi{5V9+m*i(=4eY@XLVvPZ%~mEgK~uvo_n-=qO?WMr7@ z>~P5%aDs@>k&%mE?j`{t(te?ftUT$wH;2Y%0O}F|C9t(Nfq~3f?)&%e44CjENqOvE z(sdenWE#^#Lm9r_joLv>?6*$B%xY}Nh)jC^cmqZ*BpBajRjXrJ!cp~Sd%KvEy~yhj zg~o)vMgX6+m#z9aS*mTva+%q2}1R#ISDCNRJ8%>=D`+F20ZZg zLJi5C`P1E@FHPG}?Nf``WxX!q<~g>nc+X_Sr@7PJFG_Ak0#$q^^~QOGU2fo7bic; ze#oyB6h}`d#y~F?jGr9Z=+oqHXfW}|ywAVC$1f#Sc#QiBEI;=;Er#m&GRqk=0fG3? zP!))w7b$?71FF6v`5=IUkAEM9#JxuO3s{mkK_MX*$Qd+b9q4RM%>UJ^{dm18y64v~ zfr#!)XaZFmo4S%tPL{dqU*nu?PLHqi@f84*cVUTJa-s9$PPj3uSJJVwPmS010-NZC z`sC^=$VVmAd9n0#Uglq9^6(h01{s9@oRxW0b`%}w#rx1#h!U)=Bl_l zZc(;|nVhs)%5Tj@U#|72vZ%prxtaMsJ8d*H1LWl^XBe1{hsXA8HixIqw}Tsh9DYIl za@i`V&ggDFHiyL=fu11ogGknTxdHFRW_lLFArDMQUx@#3hxF7bphH2R%0j! zHB_P`jg4!m(rVDncgX>7MER$7?{cr8w>dbJe-`3NLBD{u7<2$*6%@H$TO$Vu2|qSz z)KBE0-?9Ykg0;MSq^yB_@Fn9H4PUci+Q*_=3jXnEvc#rSvxC1|O`~UL@AFIhS1GA} zQkPl%9eH$)jnIb%p(uGj6;bs4t6Zwe`iuu%>%#57O1fAdJvpK0BgzsE(N<+B+ z4-0@MaCdpdbY;afeG2BxWW2;YCf|<6YpZ~W@^A36^B;s`4)9wW{O%8CR~|rQUmic- z&Pri%8h=xzK#VgxgkuU^b%dx!2aBviIH(2efBzP?7DY|v3K!y4nL(AHlju+~b{P-X za><|nbTm(^8ux!2+!{KQqj?iQ^0b_RL*}wnG&*Vq90foOMe;hDv?galCo)MUE(eqr znwuFq`uY;VC7O+~+=*MQnrs9WQLBH}C4peXF5t!A6y_~OGvv7er{leDe}*Qt)cYA>a46`o264AP(rH`^#glM;eZ>wbLS2ci40*`$GhPP zQ*-9BR*S z$n6>ml{MSa>k$BfCIg97G!38>bbt^G{F$oqZaQySgUveZmvil7@!)+7FM$)V!XWG(S?rdWqXv)b5KLY1Y-%Xc|xHc*hw#LBif%h*H!;7 zP8BXEs?N?a^w?eHHmnj76Ztxny~I-K!y_?pxxpbJBLBOGZE$8!)~i{~o&K$~*U5Om z4T#5!YutmwW*#`U&EZ?#LR1K`|F4yn!)42C4eV>{G`QOREC?H_Rm8IpUzEe&9ApAI zn@7`aX?Nwr@?+qB>=#*bHAk@GsE*>wgou$S-E+XPC3M&@a zcX83mDamg!{`=h&0l#0=aZj7}0qWsaIofV)k?=tYU!wlh`49yAs)T(x0NL9o$%guM zkn%C#pWe+-s(|Uu#8mg(k?7J;zqo?J$^M3K?`^+pKxUSfUV)ZY(~M<#!TDQy9z)*% zXb@@@@3GGlKD2n|=a7Mj-@^f5?Vq<#7DJk6jEs$S(D_l{kBo$4sjAA6PCo|_s<7*n z+En3*n$Is7`rn;W^27u<8H{F~Pq)G9lt3X@)c9&HI9ewRpc~3Z(^A0_*-a`L9(ji!O z^Y?KuFeqmj4gqENuUN_0*nMyH-YnO{8(NOw^c52w@)-6|&lN+%2(XShY}4lgLBWNI ziAvL<+fL{=&p*Fx)z3POmWTovy!HWpNcYj5UiM{(aWj?&jltoW#sUwPdK#sb!yQ*u zAO7#k$jQiZV$@g{pWYicI6GAUv=K=1iCnZNkf?*f8jgJroPXqoe+laAueF*c1K+{p z?)*N-V*yaq$yr%QlonXY+cAP5*dEs0t6FG~q{^I|3aJ3A+eVdF%-G0t4=F}yx!A}u5ssQkHH^sov+fY{WU#pySQj_ z@vH?_JW&g-$X&zI@_VB2eO&K)ZJyNgKKR(;&Qj?E368W>y@&ec0IC7PZzwD3<{6rg z(WIv7XKV2Hx3p|?d%*^WC$d-XJ5Mdjtf=t6sKUg@XTLeE8y5D{k7O=0<9mj)leu|G zOG~tI|IZBPw=?UTi_D>6|6LtP{ufoqQZt%}AN^o|w2pn{ikcDT#%*esGMgpJk@LQB z{Cm_I^oEsZXc&6ly#s4;Fa-D)_7-EmeftIL5A0 zskKqHVl&>LppV!xsQU=VfCSLwetDk)?Cwno^XxmLx3qrDYJ;10pBlb;_WT-up{Yd) zwznG~wDPack#)rq{-ExSA3f467y!s@;ivP|xV+&f;*o)@%mc~oS*gk#=KkNm<*!4;6d((YjC^c9 z>R@cVMSNJ%2u~Rph#aO|z{8Qpn?hBA@asXNv>qbu6IQGD%j#x_5lVX(T37!IgMwgeu(Lz9J1gZR+tDiXKCfgCn%$|X0PPc9SU~;g zbDSa@9tIeuqh3CQKsx=G>=gAu3IE}PYex)x0wZ?v_Vu*5N=|e2KNESz20m9YX#h`x za&sYm}~+-Pwa<}p3AbA9MM# zZ|7?qirE0bO#qG>ILLQ+2YrpMV_<+zXHlY{xc8UCG1t>F%ZZ=24ueoPQJ@tN&mCVt zG9J-nJ_!cA|8g6rOsI!rc}X&&%WmG<31Phr7orBf?U|i5EU-Y?jrG6`63}-Qvw9Z~ zA1MRqwb>Sxqve4m(AELMa6+N|P>Fft)LnoRs~EDrWN~zSBPht5;(UlA{h@WBopYZT zJpzCbAogbkW-Z`f7KAf7{wSnY69;kUrii$B<9FR5ZS6c)RO}HrLCx7=N8R(dPfN@2 z8m3*q2>mzh`U>(9$9rRGAXvlBD`#XR0?Zw$cKC!g{jg;qazE71foSFI>;*DG4jbBP zBUe!$AAYJKz~Nc-b6hs>)8G3s)>oYVBu($p9XN|2p#}+MPXRW54-P5tkb0p+N zU&hTr8cxgY1*XiGt=8{X#V`V2oH^e3n6VB0d_P6{6n047;g(^*z5-odb%>`4vaf)F z9~vrb%#8XHQsUPn8{%_%x}20uAz*Uj05{(aC#?XP&0O0Q)Z@_Be{IP6mAE(8O1}a$ zL22(NKQz4%h<4+m1+VSnePI@j-^(LMZ=m57LJ_Y~v&tCO1ZPnQzfBP;j0T5-ycTLQ ziF)1on3-Ak;{z`#>8FUUiSz*zkSpeFzg|#ZX;` zp8ozcc4E}~d+q{uDNV+_vv;O%p3$<52Z96SjqF@-aQCRaDIs6&tkYWld)gFj4OVJ` zpIV}M9a}$K$s90Y*OgW?Pfn|`JGACMPqZPHq*gjAm%2EA^SNO)%5yY449?bFcu6+K z!BB$_4Bl9XI6cDnk0$%gP&6;e;#9ZSMLz)TmN2Z~!6KOtwVJR+LFcOY`;(=yvCxZ( zR~9u4-JaSyn6X{Q^A=M45C?YQ*%u#>`SuMdBL^SQwWdwm1@=qUc}V+uc(kSgpr#<& z8B2B$Y~yt~PK2ZyZd+oIel9vV-FbR0czXUX(4(;<7@2vU_NzWzvf6*=S6S(3Z(sPp za8QwuTpgD%%*5PW?9J!3@r41?gUyv(jRx2R&;Ko#!}d`ZB%If>fS)gpf`B09DLV%TU`hYqNQZ_L6ZNVviJ(B;zIYDs6Y1}q=qmc4 z4u@GV?GcdPO4TX|A*VEKl(pSit@2(yPsq_^70gB)V4h&iZEJRRw8q-gqquO3I=mU! zTDU}Mb8BZqXZf~s7LT)CNq@ve8k!IGtFXz12^HQG!u7_PX{ugZt=e5_C{pF_uYNm* z2zg){cAr3(_Wpgth!=7ZYzo~V2UDtJwj08_VP8|}z`GSa$1`UoZB-^U=Sc1ltSA%C zYzqEsB>4ExtY*dj#ZM>s&djbvr|TnhMreY`wa4-0YbSj#elLp;ogL_>2I02yFQEPK zD!irCQz(b3?Z$4N*`b}3s;;I;geSKX%gM@)zkB*GQ_9@~msAj5@FD1)N3|Sls5CUr zf@!J2wNt=4}e0qtJlgnU_xE4jatgk;=<;y8TTW>wzs#5;C0;g%2YqL z13>2Js9K51v!KYx#yP9`uUoBfzd-(xgxJA;u}4di#(nkN=mCww*2Q?SKE}{G4S9*_ zb32j9bU>(@*=al*+B%cVQH5N?ZJu%n-U1^@Vzy{#KlKWLL|o09ztihJ z6B9UZ_EG#Su}(LC{raUT1svInVMruNg>BrO$BEc}z0M&745^^>)A}u6go-YS^ZLc* zSAow7a1uxICdQ{5-2o;7Y?vN zm~YT4xK0UNH=rvhV*58#Sj}PmOQzcX0PU%-<@-x)Fe^LhPGbRaroK%5*O};-p~YVh zEbDE9+)Gy+I>N=~*0o$1M`wQSXAt-Za0t544o zGBbPglLW=YdP3*~mnNy~I5_+coTO!ClcU}^{%>VSD-dnDU~+fC+351Dg4RRt{w(VM z(H7|;ik^TBDy7gpoWFnn%JQl*@3ls8A`$}XwL33Hn2T-&`nG+$lx8C@6y>#{eCgf& z0DHykG3VS@iZwx7A6uYPXQ@6jUF-=pDenB`eP#aK<_ZMJlB(<#*q|p}SeTXlhUo7A zdkS}(==SOgE`iNSSBkM(d0`5-gbn<|cZ;cn;o*MJD6rN)KlJwR3xE3fy&M;|<#>3~ z57~HbxY`~qA8T~9djJZ*d5szz)(7imEU!~S>*u1Ohh~?nBkBbw{X>Q+SRH8VZEZ1^ zv@KviWI(bFmK0z_M%x};CiJiW??wR(X#GC{0|Nv0N4ren?LgfXgWeqs`rJQKEnvw@ zk(0Mc(o9V^V*E?2&L6|EA}SUt$jXAO5x5F=k(2w2VgR2eo*i;^xX4>qul`(Kt{mih z5lpiKkW<+q(M#}%wd+2)gSffBPx*7(0RKBYpsEtvCJ}!4yI~A9@5ZH{==^)hA`B1BNTsbf_bZL%gxFF4{#B61uZPQ|F z&L4*Dv5$3Hx904eV7w2nNg5G*fuf@9QI#*I;=*gHPJMk%rdd7QI> zg0u9h0~lhO0YYrJ>S)aqleUv=I{41b--AW0Qj#}mqz*~g*Ux|II-bM}htZm|LO9FX z;`m)w22~)_wWd9Mg4OW1EoZ?Sj|lefLYq9<*RM>VFe@EfDR9x9_`eqgQ)dv;g}l=c zwrJgrb0pL{`!`7u_iH=&`1nR^I2IOrfXg*9hc6)+JbsoaCJFogw$?wm49!DW$RXj% zlChPF_i?*H${O{G|D^QtB~YutJ+_RVzRATU6REqgctfVW&EEb1#l7Pevw8UNp`E>r zpI?<9deixv&i~Vc585)Skb8RsfDoA>c6c)i>kTg_zs{s8e^M2NOfNB+cIc_U&h$d{ zthL&rZ6GY9aM$-g;piKK;={pV_sd=5rsn2_f7?!0XLEBC#H>nno3&VSbKq(YoUq`j z`T0s11As6-UaZ_*Q6Y{m=jJCW!i|fZ9rY`bbP)W@eoVZ>puGG+;QyiOE1;s>!nLtM zL=XflKtfO?1f;u5Iwb`Jq(QnxQIrnJk?xl6Rzgxb1qA8N0S5TrLC^i~oyB4u9nZ`+ z^X>iaH=Y=6n%RU2K0VRQxoz~b0(Gse?tFZ_3usL4Q*P_2of0!F_?j25Z{g6;QzT((9{%QkbjJ9BSHdqRY(H#tp4R2*Ck|6Zk+aIBsU$NgPn!pytnmd z8Tx0y7=XdaWOG}aWn1VZC1rjmqAW4z8td8pg+3X`0yAjNaa)YiV*9zAJGVSmR+h@G zunVd*Agjp3!}DS7{=n?&1S>l`KkX9N|B3CF(O*mg)V@hcq0!Ng(5H=eFnV*HHId#_ zyY6Pyw-~$R@;yF0*!CYqfQ{u+a5RfJQ1|64m6Uy|st8nO*v$qt`p;@XbQ$&K3uq1< zcSK7QP$O5yD~9U@BG*JFzyJ8rIQ|8EQ$!tuO$*D)=3WO}xX_Iro&5KhGJbQOKbTmH zL9MhtsA(E@Jo=g1htO=p(>FC$m)?#H568Xp)T}+CspKj2i~6y^yDF8taX-lvrLS+9 z`0ws4eF+WiT^&1icS{49?b@&7{R{;iUtj*F-0Qrq4pPtDB0?3_;u+^=`gr+HNO!U5 z|GNNKnnCf?N>)ft*xX(M_ubn-|HK>&l(dfx&-xgsTi}`rB|ex$lsr9c@{yC4en7AB zG%po4xxh*8^CCy&hI76SVGqfys{*S>K|z_q%-?NfFX80mpFTg!>niKyWXI#-=3Zok zvnZ=<0F5b#b;81oeIzL{@Q3ivQ70#Q|Csq_7nZRNL3!(K({yXzlz8qU42jWyjpWhP z%!boz>)?w`uItfo!3J!zT_7=ZDPDk%W&~rr&;U}B%FwO_ z9X8<=z8H7+iU-8hy=b6@CaAEFDtwgZN=mV7@~mLE1~u%QahC{ClX_!Qxd3l4F%kRr z9bNF{Hn%s9fv#v&l9b5;^@{Oi#AW*_2B&^@fx3D?&Wt$z}Q zU1PaQGL7YoA=Fpe4iFj7tD2h9l9NZGPf=A>qJX=IE9mU$Z}N=3lz&$O0_=Dcc$g`W zca%w;EoA{hY$Ed*Zbx@|nG@L9kSSe#Z)IizyExbwS^8hNx;_~1s7zhBdXX9x7-2f!#*Hx;Nl|NV6+X9hU!^TG2-S>H& z#{@n;DZguk?Ej8DT-Ppn+-C&C7oW#~`|R!8M4Y`cGUdw`HS!hqxwoT#QU z{D0d@^~M_q=64azB~M}g5LB*3U}2$3-w9vjR%W?+wL!}!kg;5xIQn8!9ipQPj!~-H z2VbCS|AG#;e{Us{@RP{zPQ-C_%_-=W|Mb628ANi_(v|lJuIwSa^1VO>35lB%f>|If zkZIg43pe%qZ~T9W<=OT1t30c`fKd&(@1^rzJE_114hc~JdGNpe1A)AQLx!xHHeOzC z$EE(tJ@no?NXg5qG#d&X)g)KVg9E@}Rin^)dd{%jq1uTYITHl3dQKF#&R!gadFhgn z=V{NIH?~50Ht~G1G_vWt^|;>1l_QUd%CKX=?M?%1R7) zw-EisSO2|?fp=G4zq>d6x+wQM&1E^on zk>c!=A|;hoRmDUnZn2u4^d#EG@ppgWb~JyLu^z?r3m95<;$g&VYqIc70y{JjLKN5! zXlQD(JlWv+->2;o6{JM>^w230C~u*2G)nImH~z-+4A_KXVuz3)moPayIdwGobekF& zL1>VJ9Da3d3}kaYuidv}W}heJtt{2$FU!>o@+Ymi4@KP?w1MFvUk1^gMo!GhRW6#z zpad94{HGmPuZ{PV^9|I*z@ zK>Ey0jgEfSyx6A+gnI%4jC#gtP^R45lUbA{*9C7DBD}A94Q~S=8vFYD>y}%GrloPA z^{B6$ndUiC(%4EzM;NT6 zaBIXuqnzF^^#&1;8K5_;H=vff&^E15%N1;{L+|WIMvK0-Td8xN9TnLD|u_5o@pPal_iIZOuS5 ze0MJwjMoF!I0p2Lhl=%t0S%f6dF$CLqJJT&;ZFz9GXV#U$LLs?wR83yo)9Q4Q&Rk{ zgi`fx81Ahn$+pHVkQJF4yoQZMhI4nTC181dW(H2l3f26$%=pPArF0616%L0@eN=)V zDW%xX8ISp_`o-vZ#I*SwF1*6F0Q_Yk<7Z&V<>lex_w?)w+IYa`X^WM!SVDCogZX`rV*BTO z1zWV~KLe@F#*nOXJ~i@ZpSZDvK^^upKORw4)wed`bp`iwET6j#%85))j(EJ{tTf+{ zM&A3edw)6reMOg&f0SN~l zxI^CjcUIOrVqL}h!epgr`AgaaS30a@XR5pFswF%FxhraQ`8x0mGH+Do{sH>2+~ ztp#eoj;uf-2UpY#FKR;*eYGgsqZb4S!MB8G|% ze~oux>}Mx~Qt;nKF4{(P_Bx`I+WV!EQA|{nJZvaH7{$UN`(Wu)HkG}0L@2lkub6UR$0xl(_I%|-|6E%*AMd8=#r8@Qw_Y@ zS{eqdX9vlfc(6;&WMV3Viip=ON()k(tgPNb!x>;SKkS2V9C-ezLc%KGxr!`szJ+1T29V?$v@I4lTk6F7u%z;W zVzZ_uH@GzoYN4OL??^4D^J6BuBaXMS*%&5AC3?ah0cdlpErX-I_us$kS1O^d-6PTD z;3}1nY~yg_aDqY?>VoCI7JK;Apuue?egPw)0W?Zrrq`rz0t#OVm(vOTq~Sj#Fc*7M zZNYlX%-W~||CZD5f$SkwRhcheMm0Wk~Cbk{ETwYGkx?j4AN&jR{DYO1OZE5nJP zalp!Vnkuaz7sms1ki~&);{dtq82kkg>RtCqX{h{wL+jiFX$1(a+iaI&&Btbe^q%NZT5-N{-EuQDP8ETaIIn^$@&I( zevcDZtBHyTatTNCfnOEEkqJ|8VvkBMBHsh6I`X<}a1@>c!-7s@ZsAs8GY(?3#Qe|n zFL6LW`l;P#S`jMQJWo_Ps^6q2FLon=}GPr`N>^An3O3G-+B7e-`H}ZKg|)>ioif= z@y)>UDUqLOEVq4F&Gk!{4iKgJ_Jezz+ZF&{UC%Hg?0d(HvH~fAMq6HYMm`^qBZ5XnYTj2 zRS2N!t0x9+^x5eqW9aKRZ%mnpiCriEHvYxH!h+LmFat^{AS3@I*@&E5TZ8E*P*~e% zTK3Z+bVVax`vZzW8B2@ZMQwv0nAH7}Xf{4jwwl&mbu&E+(c&P?A(wulZj2 zgte+|@esbY^B>zE)(M)+q1P7CKPp3J1uF_ARLlZ&Ii+jHFqJ+PfJ&#QXij|4edu2E81-D zu{Kg9Mnvp+UPWEq&TJp9&1F%Ua@=UmgKG|DZu>cNB_sS67Wwr2J9kGbf6SV})R7o_E?BqBA|sBp&GPe|tO9%gZud zHdjk)6qF_Pp4_qnAnF_4R){?PF+S+jKA4hG2a}ZVnFm;>HTkpwvYGMmWA-OKC8ebs zJ9h9J#Bsf#+MT#PO#;3fXALlPG$$i}S^s7YaB+ctRm%&*Z~x7GH#)VrE66yimj(5O zaPtG(iE?etRdx%s#s=51IqYW@cP>Rxn=LkaW^`Sii%_0f*t`JTEE$$DrY0H?Pr35` zavT=#4eKRLztj@TKMo_AMD&QJ-j|&*hmjI=F3|`Jlb;zWDc)I6b~Z_S6Fi!#_ANie zVS|G2SVgUxV?JB%=$ST;nA{x+!mZA@y+|3Bs*D9}?tP2IrOjslC=r?3qk6Wi%I=1| zfS`SOL&HA{!>wg#&Y4l8qvf-E$xi-Kpia-F@-Y3~1$bK0J*1J{ z_4Iz}+qZ7>mJW>+Rg3GE+yPoiMq42%;K10_27pm5ggygmmTYfr$2%Pe_$XdS48puu!* zz`aCD^3zDRTDndR7tGdqn71@uzH}3)=d`fsgz5^`PqF2MmLwLL1hn&3K}69%s7?$s zGvqtQIgF(w2-G_}EB(q1+w-?GGo$;5e(M*+#K6D`2YhP)PibLcVPftd-uWjIp$P~H z2VR$*95BvCpIp~TRygk^Q;G|LWE47L$`f}+*FOBM=#+MUW^dx|TAVD&XjMma?MDr> zK<2Nf8^+!7I=;2wG0JP+b8EzX5_6JHgU=^x4V%~bxsq@gUT>M>DZi0Fr=4B*uXnXG z;-@1$Nd+qm3dUBf8CH+nGvR=(+Pv@6nH-Tq={@f0)SW4fE!5g}-xG`!EgN&k9Ifz# zAj)t#HtP#XIF{)!_QuEiVb-|sH*fbF&!H}(a~1pT4>)&Z`lIBSi^6rj$D4AjOVSN78N%x@TYc>f}l z0e5_kOa#`fE5@slhB@W$dZF?oLDhD}JwCSWBMRa6Q}!SyW3raeLxvOi@N zm4!eUf%7LmR?EW^(kM08d+|a5@{%`Xf^-a$GKBK)-TFZa4yImzR=uH8X=hSpIuKW6YyeeI{M)yUZ_e=oD?KtKr0LI{|E6WN0hw4w zOW%*O2N_37ZF$M5xY(Gv*j`UrH4WzOsHhw_Ufodp%`iV#L*?BOQ~4%qE!jgXirHi@ zG1(Q9oH)4)MncD&HWB9bWZyHjX|fccVqs?YX~}G1&yI&IV`MvB`Sjg4SLLScvLL&B z5BDpv=u@j&!qu|N%9^4zeo43By{$vdQ@$O2zRvxMI~I9t?8GyF z87y+kJl-x*@3s9grsE*z{z^}ZkXPMatKN9~dAzCboo{AAsq>r6>7!}R^HNcb32{Ou z#XfwYz{~gUd#h`*u8$oZ3#~;E1-MoFAg_>a;qnx_&v;oKf2#FCq!;r56l?ky4HfDp zIn}yKUI@8|7-Sd0;*c6w2&-&@bi>BM`pJ4k%M7{!-S=;!!Co8a%Lu8+U#EZ^*mr4w zg@m&Z><-+EinbYa{9&FpSu_t$Tv*Vm`he33_prAxRRw^+cJ?I;vR5%SI^oo)218p# z#Zc(0ycc~3j_9~8Ah#$Y-U6_%I;RjzQ`3%l1UF|1C>UfjuK+4pEl*2ET3SvR8(X!jyw(kPtj^X zAKpYuHfD<`0)W)>^u!%zIk-VKQalJKE>Qr^1|A<6iPWv#-I5g%p(0PQHIB@`t);Ad^RDaeNRcr>N1jm^ z3BEhr+uH+~d?igdBEWH;uc!(h1qDBiF9WO|b_O*ypUVMrWG7omS=rITSMXPEk4z2= zi~ln}Z(H#NxXKmf;v&WmqR0EBn0T%CMmHa`p+1 zjI1oE0uT13w}FMb8{g!QEXi!u>-}jU-vBov3oMz-tm0{1V|iWqxVhVhhn-sS=JPqP zV)WB~N}*$65x?I`h^b>_SOY{{Ld@4ig|BsMXzzP}RllQ57@wa0c;E?>V5}`k8Z-_| zE&Mh%qCi@BaH8-TjHE%;aH4E|_U$Et|7KK^&oniS50dP|nq|j|Ep`KI5Lo2mfn>mT zK>jv;{pfUXs>G~Mp|noWT{?nVTAk{dj63z1)llJp`1~i|K=mq<=PLsbN4lN~at%CT zewuhkX!`ErV40O)#)r^CW^$^{pYBVBy774`)ag=qVez~N{m-eWc|X?KfUg8%=tWk# zBksEGjl}4;{$}j?T&1RRpxr8y#^&sL9o5exDMyMggf!aKe0qvBeurK;_)sh}bXlr+ zU=){G2oGGT?dW7;V?O97ul-P*k)QAcoNZyNYys%&zGDV0xGHzxVxvHw{J(gK4WmP| zp*6pN-RzNYPZ0kDIF0?<_=oSk84V_Y)X>@7+#fA2NaVhR2c1g6cRZJIwjP4_lq>t< z$uSMkIJuy|vheeX5N4#=%G_XF_x#4eJ-&E)&0Z*9ea_}$oBS^Qx}yZd#HZ6wyac|! z{<8!aaK~&aDmQIbj6>T_G2>U*OJL1!o!d2 zPLChpe*&e%6vF31iPr5A79eC>NQq0vH(FD56vdRRtgM{D)DmYuQMx7LeW034KW{#GW3`&A~lta?!SwCs!tKRi4nlR+lJ_t_FeMj)h7c7oIv zER5s#&{5(7M$t_1$x4sSk!cjrH)jiZnaUU7pf?t61A@ox>}n z8f8D!v{!ArXMc43NVrpoJ*eOxAoE_dvDp9Atv5AU+g=?4^z34C;Jq=qn&MK^t`|?% zC+g_A(*lIKvuwDi>MPzo9!Mj~r1XATXfA~5jC|FB1!-P-etYuy zRCbX^Dig>cVmEx zS#tnv>vCG!2l&m!MW^u&CWej+J<~HS7cj};DebCC5O;u38LOcvmjyt6aQarZQLFRN z3An@hqpOS04VfW9rBQCZ35t`?WMnYOVM4Gye=52PhCPwp?Css%K|ys9QOMSYhUq3@ zVq#)Yi4mc~ha%Z#%Fo1>4jfh1*+; z&QwZQGIWJ!b8~WF5(c_&sqfuBr^|(%p19s77tz$LveK2~e zK6z`NmR6>}s-xj_7EuJ7vYPU8B;){K8w1*inwm#p%ScfXt(2@II=VX`!JsWF`sYV@ zHlzRnzLhz7dB83a0f;Z?I8u6RRo-N^p2AoRWVia2bO#P=_f7rt^~8ikSE0quzc-&- zOn;Ne_~lFDo0yr}>U1~;2JV!UykNizzO;Z;Cm^^0e+0YPJE!W`X62#ah2ea6Y?Y!T zdf)=BR<74nvptC{eQ7x9|G;s|@hS$(tnH=O$oB7&&vw-yR!8lS9WNs0s&p45sPF-u zJ|Y7oLT^0n2}Yi7Gsx8-K@ZvwetzhCa)X35f7%NGu>VkGE1uQY z(BLs%{>eMI$tS2IiV2pP`I*}e?2ZyMH3Xv0wWFx4OwGaJdI?`#4%qj2o;;6_h>*oR zSk6D_-`>g~Jk9t~45IW7Yp6Bd8q10C!JGpcYU;fOg;P@A@!g%1BJ-{^ndQ_f&!58u z20Xm33afnXJn&h8oAdtLH}TEQq0wTKV^)@r-yif#eIViHQoz1kSz*7swPXN7zuX=5 z^)Cjp{`6D4c0bySW;WD#y;bz}>&7R77C>cqY(9h;HZg-1mABo}EQ&P~rm0}70*a#b zMs-K$SROnu+?wUj6ar0I1T<^p5Nx6jk+6*ACj~XfA||S;JdL(M>sYD84Vwtn{j&gP zU?eM?mz5tBZF6+%Lhu^rw?P8^5xo@nrya+8$^w4k+&P+zl8cYPk7BMnJ{=|pn2RHQ zGhhIIm(3g>{j^uIco6E9Kb(PC>>o!#z2PL5X|oz{vY!-CXE-)MpV28_7>F#V>{*aC0My{2U?m?YCk< zIsBb69m7GHHU)n8O=3ThB>aMM5h_~Xb%qn|eiC^=)&&iP%-meiI)q7Q|DX{-LUwoT z{QY+TW(jk}XEHb{%AXfG41$TXvS?vi3tu86pr3ab=efYpp}ntY8xWRaL3@MfIq8{j zIEHe(g`ZPQW8OuC-@ZS7<9T5>07WwW0Q9S=(+=a0W zO3UYEk!`5inzbvAu~A&E;~_Iw9M&gGT~FDvY-f8mvFCGBMmuvgf7QBD{y9*>u@C6( z*iM}K8m6qQ7h=7+RY7*0!r0-r&Um_`nE{9`u)GdFKBhBtOU3)+N)(b2wrO_jvrbz6o-p`*`0Qvxa zS5)K!9tASW&``yc>=y#pko_QhaG(u$2BuDr+8ffGH$V0@sd(gMQd(;`bDS;SVw@PK4D;p!(;Y9ae#>FB64a9Pv~Qb zy^^@N_=se6O-)8j6O7SEho449MDDCjNUN#IIn0Vn;^t;%9!#1Xfp)hS9?0u=&UH@8 zJtm55y$+Stu_I{+)Q+X4s(RB1z&1nG_H2L%rgc)d3V;K_EGR1*8XOFf1*))F7M=Y4 z)-1&YBzk7j*43q|q-55g@sqeaP~XHv67vxQ5rAfiZr*%l3ZC2nwy$40|gXvcBn;^ z-0j&!lH9y zg&G4xQbbT01F0cu<=3w~@G_q5^^7XdK+llpe$PuoL&B_!YZjZD0iKbGkU2p(TNKUlCjKNjSBqW3r3;fy{_)R< zqsjyUb@}^r51o|YHys_m-}nAP+WsNWyM`1Y$WBC3ui_^WMe2~xl6Unt#RnD60gjZd z>XFK8BMS?VUewe=)y_&%JfiegRt^2FZv(A604KBN{K%34iybbt@w998- z9zlz*s-nw>qH@x8m$ZUeV4Rsj#YRU(o6{w7!?mdCy9~znvW+ADBA2`!8 zBeSx8z)tL!&XU=G;1w@_wCAw2lx5uAJh*tCpKUAyN>Q0jK@)dR8M5BZ6gjzk)7eu;?=lTci2Zzr za!$wiH}J@*4o1SD&%4xAe6GnAuo7BzKZZ)*3%fM?b>#RX%JOSmV&_+8rBuEhIN?rI zIBviD=3RlEuBxnjjpXTv)Hd3Ot++hyc6F11+YL5Lrep{Go72fh%B%);weMgMp=@Y| z+8u_m2eeQPuQGF(188-u`IwK2ecf=Mk7O`^%ffOZ6z?@)7v4)7m)!l95t@ntC5VW{<-2T_ zuXZ;Sgu=uIX=#xSphEG66k4Lr-;9d#b?X?=kR>X7Nm<#hx*!2S$-r1_6vh|Oe@3Gy z-=H+Uz6b+|qSbny-4!nl5EVCmh5R${1<1gI%R^FNAp&--2*mAM3qLHuhL6%42pP9- zEr3$*IqH(dDn^Uci5&??5f;rE@G;S1#cw6tdEzdv~Jy)-W(HSTIb;o_zcK-Wihe9%+B8*xO9@x)5v7%Uj)^()-K>1Y_E4{=w8!; z@B-!}m^QY{Tdc<7gaVesUmsEYrq~Vbo@a@^mZcHe_EI^TiiO1%x-H(pvaw&lP4@`Z zAv9gZE-=#^ad@~sA3`JyM-a#r)p{KJx*VVmwu8EoK_~M&a$%R;+qz<1wbqcC5MV^G zS+K~Zq@FE43CTcC7R|VGI78K{LB$44N5nfB};_Paiqh9dCvt*ngo^kgwB zto6#0e$UGRq1BW$tZiYuqVr%|?LlZER}Bie@beeUH@&>(0k{TWy|ev=EYw%nOr)%W z#zR7vgfle2bzXd zpf$n-vmIz=nf=Q7^I5Wp-CWzAoVnVoBr(xT0q|d@Z-VymOn7JG35*qd;&@MkV2F)G zv7#tSAGH)2*Y!1=D^N@RQdzC3#B?~mI@hV;G2a1Sn>;U4`(7*Mbsr^VWvZK3Qvo6+ zcUZ51{z8%8L8WnTnVpr2D$6Jx3ieu{K6ZA&OsAN`fez>`)Qsz_XVfoakaa$c&V@*< zoSc)h#Pu3*GLOr9`}>3Wu%A!p#q9LC}ZVH%4M%g|10!B?2FCsm6f|3mo zRy=i#2}HJi{r#x48kd~~kDUcQviK8kyby_Em)%hU8rebR6i_Gj6`>#?2onpqUX6&NV=2ocmpB9&##PIOA!gm-j zR_#19kE^V_6JeT>ZRTe828yNuoe2BC3!);Lu z$Yc)otD|{fdrCb=Jt0`@7kztdq+$TH_c92B&WIfXT}-z-Bxll!o<1*(wYWDb>ix~t zxi;UqPkxBQ<6%cqgC}2LGHu@yLQ~66YUi*_ATVpq)^_y+>T; zlcRq$Gab_Ize{b4d1B-{HKIwjPVOD7)XkFh{fa4WnkiAECeW8DI;(}OE z{7!NlveayOngoHn*|~ITtnS0mPLu~U#QWYH!zC4@v9lvZ@hccGt?$|q4a|+ri1a%t z+p6!vFvVZG^Llt3C)*Ke$@Op|)ww9*oQK|r%VNE^0l{_GeQmF*J!2!jU4leI$|Z!b z_2^{xvAb*eZUjk0^lrR{6nb%mEN!s-nxbi*w$4bOX0sfRT1vc%0vqj>)zyF4yr=DL z&SxU;IU^7%nG~b!RwdLGwv{24^Cyk z$3Vsn&V?#$hA*qDgd1C1Keo(BaRYya&vOCd8O^g>p!WzaquAKkFjGNw^PAne_5s`- z&KhVSEEw^jxh1>WG(v_CPrLv}V;NR2pL`b6PLxfTqs^O)_nwk;VlO(F{A$VP>!AG$}0-7pV0|38d zW@SC-e*y!ltWD^{G1i{r^Ud1s9~^|z=2!&ZAS(oc0HZV7RZmc!lAxmS{yMVGwY$4J zR%}8-=1I?k%CX~Z8_d;Iqa=jPG(j~t2Dqy_<#_YI6`TGX@(;r-&*yq9!9BN3t4W4` zX!AFW@~WzFEbi0({HHXnKk!}}nwl1NEJdqj?k7LB=v@)BQ*>#@w)r&NTCXlHu2u=8 zB+u@>9q*={GO$r@&2R1Pq^zDym)@uDO>Rj19_?H4hF9a96L} z{mLF6uZ{$02drAaN`YbqhAHmJ?aS!YAoD!GNsyP9S7<1{>R+_8kc6}I``p~{=-X9B z>F$7#f@ovvAPcB3P!ui#ikFllK!=eg&()va_lAD;4%o58-!?KF@W#WxVY9h9wr^-f z5yHWPqGQDhYcubenh=f+BIQ*zgz_*gF{7XcQskKgg4k7~0od;fe+_bWe}N zzE6x-;tPd_#e*2HAKve!(E}y>cK|AFf-G81tz}^Wfo4oUuk{O8xp3vmGK`BQhbsOO zYB*b7GB0l;0U%pcYI^c>iO&~sD!in1iJ~(>L@AGGX=4V!_m3Tkx=_jo%F5q+lR}Cs zgY-=sBl5x{txvo5wD0=D-{wLNe@(Pm+}PmBEw`e>-A?+fklDw85RG|i`s2?ApFJj2 zRJG6DrTxUnRQDwdo<4_E+I>e~DmvyXJ^dZY_}<;vYdbiIr>3UnFW)Zl!D4Wk*3}Od zM^nfE=Hv}N=|LC&CWv2ha|gO&{cx`F?VA{}u8fwv94($^<)(qQtc1Rer2cP~ENFMg zqNz|wlikG`Nmi&nULU+JmY~W5CtWG2O1no=4#RKG9cMOYshC~Gp2QP^?nETLrfhgK z&TZzX!|}1sTx=CYnNcVI$OtD?9`Lfyo~?Y4Z;!ghbOWV!bAGYC~@F!LnJJ1zAu!bDvmyIDch1tbE%3CTM+BV!?3 zZ3gZt)K_d4qp!EY?n@HpeH@-Ax-h&06kSn~E%Y=bF#(9**VBVK@m7x2gnBIF3Z};c zTU)-89Wr|deVaB|=o#S{5Wg~gzd_?4JlK_H#!Bto4xc{X3o_qLqhmu%6eJUnQ;|=f z03H$YB&gV-p^rK~Rcd>lPnxgBh%3|z!w?90m&htmGC zP?yNcat_bq@6Z7s?JF@G1CA=dl>x`1Ln*!oh|C)6XE?*O;@#*^QBi=P~Y(4SW5R+u+_)<1EE%(HPHd0@c5L@|4%4tVe+@7ZJZ7so{K^aHUV|HA)CKcg{r(H) z=no%0sH|yEZ8||^0?)h|1&A?B-O>7WZV=_h@Q?il^yJIeZl&brqFYfGuWc5=J6^5?PM(tm1w}~F0P?3Ibx|(% zYRprUMsXUDT{YLz;vxSw$??(QFn!D(&y0*CX9?4a2YL#*En5e(RinU}mdR zp}4Dqg2)H;@rf&uFm#?3)YZYnU@NHWeuzY4Q@5{365O)Zy`X!XS}H1kTniNdL_+0V zURmkZrvt!e;G2Ou*@tVlEnmC{j*O(KVtu&aAE`D8t5dShrpTx>leww!JvI#1cYn6| z;M{fCw-nOT(|h)euB38`<^zt5gi~-#j0-gMVG7-9$>r1o^NhLnJwW%LY>E#U`d+~$ zZJpoFEQOR3yxH)CfV;6iUa`Df6@bTV+W!&a7bFGk5xEJzw3&yzFnhovXm00=K(xKA zta9WAP>D*tiG{`S$THkZ{*STRO2E$r({I=`y|I6)I5?h~^`@MF;={!FD4JLDN>y>E zaKT>cXSVV8gUrTi8qxf?Pw&Y*YunTm`{qoR28Nz~?Po6Rof*wGu{C3$gPYr$$=)bL zIz+c9sSi2(BroD6JGw0P*oof}Mc@34>%dg|^4pq2MRj9l(}{_RY3BiYxnMYh{j?0Q zgVCx10NKRge7(>U4WU&j{kkyPJrachc`*2SfrwLGF;$M9urxh=E-W7C)JysV++rGU zY}B8uy#NDq<&Y>ZuLg)e6BAXEEg)fKFNc=p_jgY@ukmx&Nn)>64 zau<>~9_OyuSuOha>JGGVH(&+M=g1zUZxig;(Xt&hvz zw9Is%x4GGO z65p#Q{+JjEH#zRfW~<`J#a70Jg=Gip^Y{UslgVP#7j!?^Ew#$7^_@#7lnihV-k5u> zj|^Y&FK4tGV0BO)Vpde>Q-B|pAq9mYmE%)`xGW<*K?glSOFa)+J;A`@`(Mm1N(~PzWDc(YQ5)vO#A0?=Mba%^1N-}{; z65|=6>nnKl5f~YX`O+hEwJIo?nSXU#$=(J5^Qm@dJH9_G(dUj|boXW+&G@c9uZ=l7nTH{J7|oZ{Nr?vR$lluZ`IvRZ>dxqfMR zxjn|fjqkMaeUa|3Y}hD?=$Snm!!l*OLKFr91rM6DEwBOd}=-% z4EH=N6g+zaKYeP8tYL)KJTN~US4SUkaz?kzM90K1&(Le0RHf>io&a!d84<@o>@Voy2wafzz=VX;^ zqS{&mJ`Yq>Z0vT436L;zHOm6kzmQK75A^jRIBlE3(Hx&3?4z%g+l||W{0&dd26y=R zt>OGAXS1ljPFCx*J=f%0yRThjL^_Z?24d;gF7dyieX!X%@U2XZpfR6l_TW!fq8dbNVMGQZ0JWSgK%e`Jb?fbP#l56~QsL0NiVdp@$>0;Zgw zHwl@T5BE$s?{%@CO8r%P2Ek|F0NV;JZ0v2tHFbG;>*+>OBP)TC<{-%UuZ>TbMIr7& zIhvnDjN-W06~*KZQrAScko99#d}B5k32ufSZg+QITCMmIymx-yfhnib{_RJ5M`^Uz zdqhN@yaLVdtc>Mot~RxcN;C0k&HR!9o-upm9Q-uL$H^q?WUD=F#l(Xr&9dj!t-1Yw0c*^NJQ za}||bv<^T`L1OjxJpgd9N$wUmhKP$bj1Wu`!n2NixRq^h<)-9EuK}w&hK8H? z&EX6{AgcWQY!A>M(Zjo_=v_s{X82>r$AS&reSH((Q^79MN26@-_okCMNQ+!*MIrZ8 zrV3LWhoY@IS2dKg`D3hR>mBkuZB+U@RyAYB$~w9`olaK-X19gOlHc)(U0J-vIqVup zIJl$7eII@O@KCmYi1Z4Dro^93Cm0=Wy`u=hyo9EwyrE^_;n|v~y7j%*?*SXz&w2qh z7&dyDoyVw`n_AO>KuF@^;#LZEABM6lbYGSSa}5FRc%u`*9$G_IT z!1(OnG!0N&B+}_X5R^VXe#G26!^vPAtxdSXz^oD~&P#a}FT75779Za%zYi;ty+FP3 zUcv+d$nv0$h#lx|l)if?P~*b7Jmff0x%M>H{1JU!J8V{DZQz~ma<9~sfLEeaj^$D@RIxCvXJ z8nS{&ZY1D-p^sHajAkNZs7HMM49QYPQlrvTjGo^5y?Z%-uP_^zEEII->{f;e&%Sc> zKSuEc2C@+mQ4i%!7;t~o_a_-+XWE?EoI%#PzPTzHiaP9CW5~Cnk0hGQGDDP?B9l$( znhuTf%;yg+RlE3py^|f-IDDU-bmMfZqcfMDl5CxUR&h4{*;)1pFaP-x`XcG*>Fel_ zHxxh#%QX@Gu5S$OmpFp%3`l!n8yR`LwzbVsXp%)Q3xR{S4iqT0>0h`|6G(#iyHVkP zm`XPtD^-y1+3x6&GryvM0Ud(ofaR5OXJ%+rtkPj@kfgjnfO}tEl&vJDcuP*Sy}-+A z+bdl}R{Nup!lXAe3|CEYw@9tWhqLqqb&Q60`PbJr+d|x4{8d(mw@{|1HNS#^r1cUA z24h}%`Glmc1EFw2)cC~2$Y0v;%BzuHr2_1wg;xhhr-{R?(B4IXFJ8&3p9$hYY|s%l zH%6x)5;8JBax<(nFClM;irgz@f!8iEU#u`2$^@%BsDHdy>8?&Kk2y}&-v%WQGOm8u z$Qbg}Bfq1>Tg0UmbqGQdMOQT}h|CtE3Q44xp4xRRIqJmY+01;;CA|G9v8=Q#d%!t2 z)7`f8O!Wy~UO>g`E!jgxF987&*nWe9gB>5=zrPgO4lo5n?mO@g(2uW1w)BAxC3?Z_Y(uzJR& zg*TT!m^LsHbOr-!W(aeFj~{2l7x!;VwX<3Ap?-hYyu{$NyTngUK7CaS4+G;z8|uI# zl5rB^!P(_wU?4O~cR(4&Mpl+#Oz@^bqxU&Z&WgKi_g;Xy$Y&rsZ>UV^;s)U`cC;%F zvF$Dupf}Nvp*4eyjK%)t^3jSmyX$JKON+m_tGGO+T8=*dd)b6>y(|3kIvv+NHa9oX zq3an{B!J-GS&5-lvWukkocukB;LVQ_i<+cesb~Q1DlJzc`IpdJ8`} zg|J|3C5dWQ)^Z_9*7!*IE>m&FF7o$IN061}`pQ(VQR3G$+%ecV39nstW=}Tzd?0^# z%h?VD9I4xMR^UWyMcJ5~L_;Ox-TEPg-p;c8%UajU zokexKU(9{xkGf&=L0v;VBQG&AHS+;K3p@LMUpgHHaCQ`w9_Qz}=+-%Brl!*4tA66Q z^!>g#WU1w{$*eA?HaXH(V(+(SSV8=Fh!fTlGZ?TXRNH}fr=6X?fx(|Eq7*m&O0Z`X z;u9!+Z0+cfP{2-0^9>8-v^pBTbu|FAwEk zDIgKi6AN6)%iSqEHH`9E)SBk9$OY@Se zM!cG;qBJR!DcCHvt8A7>JD#<5w{4U0xZoGVpDe1_TE&)F9g1^Jp3dxl+UiSDG|3kv zF*mz2GWhhW>;L2GEuf-YyZ2!X4I;0!a0hLaXmR3?~Xs{^(=?mpKgbCmdkE^`=+-q6r-{P-E$xxkk4 zK_>90OU<#wE>s%Ikgo1+X4$~UqxFCT%Kc4#ZwB8@O-&8vJeEJ5eek~dr6nK$?jBN) zPsN7Okdr8_K_$ zkCF*~nHT3>Loi{$X-Fgw06t zPHfGv%HPx59D|R5+xqD1`=%va1mF>Gb$JbqJgKnRN8cha9~i3^2wtRQh&WH{jQ(l1 z#d@mCJE-x|>tITp-E zHzB#Ooi}&3x5ntM1^DEl@^zZ5oXg8`ia2rR*kYM0^XNa27iE6_jLk{Xo^0owd@7KV z6UK`+&3 zH30H&*_4O?qjsv8z`#NqV_Nr3CNc4VE!OdqZ|7i7_i*8rJDK%A$k!JnZ2sZ+<>$mU z6Jb)_aAi@Y>S&5GCiuppmo`wom}fuM@h(BIa4GrQHxLi*`(16i^!b>0_IzPCgW|)7 zRmF{uBc_147TVdG77%(?2P?-K5mUlAg(2N)!8K9#SrH#XN6`Zqt~mLLv}{VOcrK_1 z0JSMiz}mix5rDMsn`geC4O+@`n~%D@kdp&Xw&Sh7mQ`8U2OY4PTKZ=u@d}sYMpr)9 z`VSS(|BiM%0`Q2=50x zEO*>3mEfLhqb%ip-J|LDNO|j!bI!lgfs}&s#_M>?7b!^BxVCb%8Rhic&-Fton#NZ{ zsh^}|cHx(BMk_*Nj?+|pcJx2X8Qcepp;PQ~;J7yR{?B_dKklWz%(1j`f-nsisVHZH zmEmH?nTe^}=H`_4{Q}Z5IX9PhGhFugJUv5ObkLgBNdpX!w$(xw!NnzV z_M%IprO3tMPS1v-QkU{b*-SLb*2+Gkdg6_w`+d?oY_V}dHhgP4+%%I*YhhVxVu8if0IY1f1^NeOqtk?E%=LRmWzBtiQqT)iDQa>Kv_RU;~jOd3U4^Qm+Zqoa+nf)(u z5LWz^*PY+1;FkdDR;a8XN2%R3+L*orKI>%4e_PO=m32x`@|@U&h{W;c+Q1u{u4xU2 z1GCQQgg1w50XDq&sd>+o!PPf^e%<5YKs&N=x>>H803wK1ax?lLbIY~g;7;*FRnp%o7PdC(fBvrDtFd> zUp12!&u1IF&?_htJLA03LRgZM;GPjF>XN-0xNph@qIDJc!j7|^@-GK7Rp|EHUtD%_ zu-}jTgyXoxQzLQqz zTlQunRQ1Ds#J#p_rzHk`egKKzuo$^~o92dow?~oo1HAIhFu6lnihGU0>^CfiOC=HM zeJrDsMU?@@N=5;fM%y-e>%q43S`Hmde`7*$L3?%qd1#}kNAq(wIFc3@2(r53r0bgd zzoqxH8T!#iT%Rp2bQVq?=e5|#zTjbhEO>Z=uCCvOlQurQ{(G@ET2ifWOWE+(Be3p_ z^!dFH!5=(I9;Xw1WoY>6pG_DX9g?F7 z_n+VEdfo9`MneMxh;bm{x##M7(vw#G=#Lz3*ThjHP1*U9#D9Jme4r)HvqDg*&3m z4r>h-$s=h+erJLnUf2*u&fAe<9T4j)enN|WNUK8C^%nu^ww@IS-LnlC-Bejj0^ zwVUbcm8!D2)AF*OsujXaCCSeXsh-Kc8q6B`nU?JjTN2`YI_Qrx7 z;&ixD*yxW~nsU>yeWSN%I5N(+U?e)i=jgdPTOlkow2M{*iQtUpTgc`3cGSyJ)#V>L z?QiXB6u8a=; z8wtkd_IGfJO@W+!mgIE7d$*R=R9eZEfmYb?Gw>+WU3M?k5#y-KD~nesPV{%Ywy9iqvns&s^}qKsj#dVw)G_- zG(b#iR@*`3t{FWNPI+V`yRQ%b@q^!Gw6(T7fsn9-uS{kwM!;~=^3gk5LWt&CBM+q* zvU+%xLe{T9n2;I|vLE!^XYq-@e;D;mF9d`N|3;zA8ayhu*;RTV0{?6?y9dD;BPLRp z_f*S!o|2dd17=_UFL?2;pW=S4xC=Xz)7Z~I(1*ruzGLfXKMGovOvu8z956#E_Z#0JuT#o9Cxx^i|)&i7lm`%iRAffKB$yAR4OFZDrze~#9xp`kg@j7u3s$|XP zkDR_tpG9wNZF#+_n=a9?w+KHuy!b5n9(b*NnWI~%BZ95vK7UUMg1F!LI1xjrujdk; zpB4mo38aoeUFlcysmMg!VG)})e|L^nk>{?ZYKF!m1ibY?**2d|=85ZPd}`Eg&tL+r zh%?ivc1`d~sojbp?Ll1oTM@gR`TgdUh{?F01$?&S^9naEMGM&&K!`Q^#wzO?doFqe~)`m4gl)n;k+ zLM{6~#t(=J5}euC&4p#+f(>Pfs605SE^EOpcRbc+4UX!NHA z@j|xw_X<|`A;ts2KcJKw#Q**h8mZ>2`8Q|xb0{yyn=rH-ZjCo|yw`jnr;`4z{l2*{ zA<8Q_($`rB$6o;vyf{Wj_J+Rpn|^jJPc>bZ3&_JfpE8C3rB%@D z7Gq9}rngb>aag*X8*z>3;Q@5_471a{$ z;|Yw0+a|KKB6hr%IvP1hLK~OG<<9Z1DH}yA17%(dSDJ=gTQtIqGV(xJ*nG7Ljp!-re@SC9J@{p?P~mx=0kJOrbLO3( zfjp#vfXq$m8uYaW$@}}Mv@G|KTh~1qfax*VdIc1Lb*AEbyF-> z$W;u1EW}5Ei`OhUag4Hk_o<_yBi!@j`*zXQ7!iBv=sQNNbp4Slxk>Ph1s(tVyk1%7 zAE7v@!~!%D8Q`R(_ke!Cm>>tDP+bdeU!Rkqa!EOrIwr_O<0tB(XR^;?Y8m4S}>8 zpnK#uMu2t1EbcGo-z@3eKCuRS)kiqMV%M(QCBLxVy z1y3)=^0~fRZqTt9EukWzmO^A`I=bu)jT6ox=#PhgfBE9~@`|(6^P`7|ly+);bwBCBpPv)*qD;*p*@)(Ep|D-* z@mW~5Tj@B4djn&CYC16{&AY0yhf9;2Q)h#dJHf?N$0t>m_adHT}rLne1L?RpOrHHP7eQ7b&XbkCYUit9h!^{&iGqb-X zo7DHLTBUhbQ&qrIOm=IY(cmF7l(C9tbyXctfb@t)CCzUJr6Y$N5^Prib6N>m`!phQ~sp(F18QL zQH$1zI3O*ogTBobT>UvH3)@z5Zf)IF|GwKONn71eTg|{$?-Gf0cNX+*m4$jAUTdak zSlzE<=gj+RAo*SYZiMCG)-8v*II-l~BK`LJG>a&kj*DZjA*!N5)+#p(a#={fr6%JS5E?pEqH1Gg%wK_D8Tr`v zs#o}ert7`~-qkPOzU(nvG*_G)ifXz^$s=HRM%aY{f#_XMcRwCv^vkLibzZLP3fV+1 z4{ohlb%4h{*d=Ys{}UeeIFMm~=ow5*W{NLU~_lQih}bajfm)M61v>UY6wt=^P~`GBy(_Ix)g( zpTU2E@5J5!?IV#0bnC-BacKv$b)MVh^QJ`qtva?q$sL5Z% z!z+MwV~_s>3WaVj$3GNVCQwi?YNQ)X{CNgwN+h@GwjZUB zclqmEST~u3PZrXnm^>TmGUBqGoC~Lv=_xEmcA70Im!pCr*5+$cB|gY)DsvCEVK&b_ zzG;T;6&w4EJl$4V5@TK(0q2RD_yFOPY7-Yq5u2}ZaaqtL?XILZiL+m!SzkDEUzYM2 zLc{(brpzJGQvxq)9KwryD<2K}^Mxxz*{kD7%$8c~ck4oCPUPz4jCDLH_nL=B5MQCF z&?<*^8(iEc$8zRKStO|vVW*#r z2LuUoZJI7yHEz$64Q7X*f#n9pz@DSil}X5LyWL|nCSC3F?ZQ7iJeI&98nD``6S@kW zs}YNlN35QZ^E`;UNGyrlzjs`F)#&83&G(Q1ZE(e{r5X^ZBXxD(Q}^&BAqlmmjqN-F zGBVnui!^0V$@(mhrdLo2bUUX!tE%wEy`{8O-{kyP%6^-%7awH#R@`-0E43bN%lcvf6;rhSo>1n< zu&WmwxLB5n0W!Ryaw?DfTdxNOAz&WodG-3W*WVOU1!QjjDeX0wSdJnH1Io)oFs9`# zwbeowNDZF=aS)W;{~DP1WeCT|txI?9wMK4?!aonr}2_3z;wxGKbM`65T7sS-2 zT@Uu=YhKZ$y(=kGnrbwwPjgW2u@w@?D0en{HCtcQ&L*ASZFk|!9eHW~ath_=%iaAI zu~6hJLu+ArpFG%nmYAHx+*F?}3M2`exLTLZD8dOJKTg;&7tr}-jYNMoL@1|(J{cL> z_G+-NVJlj>Xf|9L8gYM2`cN@OovNj3bG+V=d5@Nsj>GkjPF-s_A5vXyMe$3N6q>G` z3J|JMNnU@t>bjEtZw74qs;JD!H?0ZVN4zGssKh@FJJNI;-xpkyIiZf^9$lkI!or&91auq)x-T+DGqD|jlm zIJL{H0tSCtMx9m_W(b6el+^fC*8Gbeu)4I7(hGt*AEuc1|J2fd7}b3tBw@37-eUp; zPtkliZHwdb;n55lXao3)tiQ^a>=(LRnnUkG zySK3*uGkE)_Q1-|{{o&|C^6cpS5J&<8JuE|HGF%%^a&BXcA&SFcLCERfJM8(c!W(j z_yW~fbjZO`)ACSvVs0_`MpO5q=PSOj5BT5>*=-_1+7eV3C-Db(Z6QVNWl2CuJkd}5{ff!3De36G15i#hi4 zyn=hBqU3xxW3Yi_;mQ`1VPuq)IgQiC^2A8IhT-Mp6wBL!E8Y6>82l$6P&9yc5!1c# z41{2YHX8FhlClzjBg8D5jWA;*d$}X09MO~2e{C>hVc|8#nN!tz*Sc-!DABbV%~FWk z$)D)13~LBM+j>|aBq-qX z#cDt4w7$&+%}~TmYHBvoztAMs5g!v1E*_p;AptC+a(}1Y zR-%I)ikAEmwe=2F8dxM0a-Y{?=7iz!2B-P^)j9OJL;Mxn$*qZ>a%#|!4=+zC zQn4D90vdtoCqoSsauM8xkSMjah_@8EUa~KBm@(7V)`p1_$eNb-m0alXSdqJqkUq!vxSYxd-6@kLcf2_5@I0pY#G5 zq(hV6;&Q8zY}%jM?JHf-zl=8{=h$MJ8XI9UM$mcvBBupy?w#+?V}y*4L>@36lq)m3 z?(xxcF^8+|N6Ag`4x*mxfY$HixBHPgmE=e}P7^ zPt$0vIM4IvSMn$mHD8&SFl!%~YHD`<`9wYlJ8aOvM}KViILdR`grJAh#z;{1lWMi; z_xody)Wdg=&Wki$h5faJ+O!e=DYbgilnR|=e|rH!X`X12(|!1+@6>FeRql2<&p!f= zaq^1YlB`%>p`B=QvWxkfs^}SMIkS!is?VW9OJoNhBzA7oRN%V+pTen1t!psG*>SQ%c`dPK6V<-Xx-CG z^2RJ0FQt`=nvA$*+5ZUwTtT?-I^Y@;`iEC2ZLfYD?u#LpkPr{1O;Os845Dk%+rbig zV-Qvlg08Ey=M=oQLq1g7BQYY@kfA0wU1`_~Nt2Ix{M_X7ebjz-m>dSpAC$=zo-sg6 zl2ZBimrGG6qxa_eWlEIaD&FerX7!rB^nl1mDzx2D zw)}Lh4IUHD)!he0-T78LLT?;M2={Flw7@Gj_{>50YBsnqxANNfRio)h$sL=plDyF1 znb*uQVa7`LQQr-1mQBdKDD0vNGpdz^yHWe=tpSi5I_W@Q=b1RmK;3R|HNaR~sxJEUoIv)emyU%fQc53epaCW&J_&7{|){Hv#;{`<*C za@iOOyx{j4zQ-j~?*IZ-5)U$v94cJAwZn&O&6SbHWnEGtCWPKts$s|E0SQN1{GmaC zVS=kmods;0EZtS6s2}?BFJC}JQrk9KZmL5=Hte2w6kkzM1?=TQi@=sK(0ob7fpMx{ z+E7x7BbLfHGX{6D6TMktfPT17c874iSjY%_7PW5^ibuWNOi^E3A9*V(Q=^2NgSp^y z0w;XOBAyed2=!+!N+MjSyjAjqB~o!l$S{d_I6hyPj%*kUIUcEKR+@xHgW`JqT&jH zzPh`>kbsT|>!64?WYl+Q{7YjAEXo)AO2UpP;B58v?BkJh=~hraFfjZ535Uu~cxJBW zjqQnZEisJ8CD%C~AAL|$nrp5^^7J9AaSmA{i@f*yQfw^4PF?@!>Wr^`FsDw#!NUitQW%j6_9xB&?k?-EHKp@@3lN>Z-s=U-(o!Ji3_D0*kW+gwAyoH z(*FP~?f5}g*$)$zR$>@rto#%23<5RW9a5weMD4Qe}>>^ z^zGBBn)ho<8sD`vP}>?^foNs~LNSf&K93}0h&OYFin2&pe9hz*f!BI(I)7u>FvmSo z2tt?9KN`d4B`KJ#TJ<(SZ%yK(ph}jSnUJusOdu`cDt$*D00dhjZ^C_t=Q_3w5M9zk01TI$62lTN@en*)n`5ihIgJHA1UNq2CcTs zUep}-^k4%j-N?%lUOZ*Kv;F}QsLPNKNHy96IkMmVFVxjR4!6l4 zNQ?hw-r7)>#bn;r)*CG?U!-MxZ{|X;{pXyVcjd0@V`>*b5$ju8T8?hDrn7TEa`L6W zJ<#wcjD^oL$TBsG*x1(|7FkHH?(*71F916bIHwM58R@#rug#NmL>gVNm^|-k(B?%qAVpRx7KjX3ff%Z}CHW2<~+kbRU}zAt`j# zOMUZ9{q^J3tPwGMZQKPGMA&UaQO}nJ*ra}NXy1VkPJ~-@)duUu{cHb&2|%#!26tib z|Ms=`zl|Yw11O)ixH07{?aP&KPY5)%DA}}z6f+_V&N9?oV1~iA8J|?dLt{oI;d)C= zcP)Hq&&+OqI)XP4GI@RT!snILnCw}xz(5ew59nUj-) zNv2W<{>9(u^K9nMySmP;qU=Ne%bG$YH)pq3$J}AiqZ#hWK>x00_Delzu~JD#=EPvf zpKlIu@pMDJ^@MJm=^v?p#$C^S^QxBD_V#yG-Z1zLxSgA`kaR%Zjt*j()1&pMv0+6_ zMm{cjb}wfYI3J%NOa*S>ELD$R^z=KqMs^^fkS-4WFEmh*C~Rmb1_zmMIc6~ayA9J< zdUmBM|0)-T=WaRX)`I-H(feKe!=1;al>F8UJ!wnuTdAp|!&*A`TKlJQe`-2`lkBoK z5sL6sq_KoPL&LL>kNz_>H$ml*V$_CpOW_Lut%XzY+F~<_e~?&jE%lLWhq>ds>r?eG zCdJL|@*SgoCpI&;>JHPvx~C^Iq7}i)j36K|)bUNEqQdniA^7vAnmUPM-Rj{>c*FlS z{m2hOUnw~``Ec=iyqzgqVP0_7`qW{$J9U}Ex)DGTMy*1yc=A=#Pep1zQqX>1jMe9- zaG`f`d_c_2&Yl$#y0+ZgN)&sHf9BY+ZoUM^h3Q_!dfP-$`SaZsF;(cod_pH8qU|Ps z?>eD^fx$iJ63jyypL_Q7DMl zUB6V+L(BQ!EA^KA+6V84^f&7u2KQ&jt_%;q^|!b6cRNP@9Uco&?#-}f^X@v3xzxUs z4kHr_CkLiWA20i8|8i(X0`7yk-ZuSo+&lpK0RrmJ*_4UHAO!?mEM}&rRf*4h?%tik zJTKj8Bij0MK5+#8_UF8qq~hS{4<<%P zeT2N|Cr_Ri=KXye$VB5YYs~?=K2}zzo9T|QC2t;Ke)z*rA;F2!1a#v%18IYZ3ZO$K zc(Nft3PgPOk9Qw%n+jx~?Qr zswczGCDZL!kx@LYyXy+2yI22NYGn=~sw_25|F>`B0e&saJGu%zzVJ)19NXK+N;HkI z*l)X-0wsh;o*U1{5|TJ z8)AgvqY>|pa&nNt+f-7jO^`Sah-KASjo&u%3YUfZ3ZQdx-v4Yc|M_jlz`fPH$ zY?UA;sdnW=%FjaKA>Zz_^gPfry+fbo7 z065&X^UEJU-UJItpYZ-yOQNS3P43T5FEsO*Zq3)smZ~LQ1&BTTm6Z!x&C0##MV7Dr z7bA!b!X_a4kd$QTg)K_s?dSK;9OKbdeEdET!s+jjKV45^W|lT?rvfUYR8Oc;%fFv# zPC*Y9Aa1i8{`YJ{rqDq55_gl7RP}R7hzE4fq6$Aj^Xp@eHb1|U-*76DfY3sKh-gE( z;EOmOYzs<=2GYFl5H2jO54LTLMWCE-C@9v*yw(-@zq?C2yE~vvg#psDrB_-5Rzt(T zvzA9!VK|V2r{&2VDHsDNv$ssj(s_4!>nc`!bfJZCXe{d;8VwDpa_^&9^0T!7)H?mO z5&_MXt1e(k<66NR=-2DvdwjmSkKW(xhcHK;)yp!IFd#za2CG~MJia^AwW!2tWg2U% z!Z2$0U6GxhL9zX;FJGj0^xQr~$Z+DTs;GZGez3^;|GVSQ^7PDwAL2qnhzOy`pZ#~> z1@`d|sb|l~McpvMk&mHZkLhE@T=Ge9|Ijl{cxw;(SD3T&xlnm?Y(V$hnQ+QyGkXc@ zYr*0Q3c8bJO9%st{`Z(Wn}7JU{T*k-ltk>x2JcA4VNc2!*M8Ph+R@UW^zUtE(cybL z0{{QJ61z=*HhDceI}7~Pf17IF#_3M{@jZ8LH^iI)3+pAA0vK{YwMNbHzE%u_g!b>H z5>sS<+|j|iuyDQbL-y~Qnm4;ENwKjjxWs!|YIz!rA-OUCd+SPl_cVZb`c3hVWFB8w zQoMRO9NT%3G?}pVolGtA!dt{A_q{!x_VX8qzrD_hKo&mQXS3r@8ja`}&g3VgtthYi z*TrDTn_#9~=$U}wVSi)htQK{b{Qn{mYv4o>uxIUnXDjY=NwioQw4@fg&++g)!iGun z)J0%ofUa{bEz0&7RBA#(?SD2oeztWfORJ3T_U%;X-9AKcoKAtrZbW^zX3pep5M36? zcAD;Qxc=SuhZEdM!#}o}A0_?SYPyPDP{Ozfr|6Q`y`{+z_vt71<>p20XB+goKjSa| zvg!U6M~?Ogf5CnG`)~`w>QQ!V2{|m=-%IQnW*cKR1so)4X)a#gFg&mXKnR)}d8U`x zq-ye`I9nd_>Afkba<}7HPs}t_04`R%WOGwfEWZt4d~K7pmDdS}T>p7Z$w%~Dz$#qo zxT&zal98nNT0Qa-%IihPFGmjvUv<#LsI8aU-cl|W?Q8GuYwPZ-GkPnp0P(;R#3kYt zGn{=MK@D9G9$(L=2Ct3G4Lh?dqCy&eUENhek_pT%4keeUJ%c&A|7QH&W<3O7cJ-gp zo!TpIFz^eFq9!Jy2WifjJBp9aFW{bQr(T^@MAwH|Tcsg4rk#Mr8e@!8ORa4-KNFlD zkCcUj2;cv?ByZEcpQDi10-0%VkMdyKA2QI2b9J?lkT8M-2kHW)0;398DgpVo={Bb{ zXgE^;SDu^fyZBRw`vdys%%6_$eI7-sHPny(i{`MJmOMm~u8tdDzw+rXd`*Ad%kykf z=B&3yz5=wO1?@Hpa|js?xC0tAmGT(f47jo0o=;0pFR&c5oolN-KCt@_b;P>a|1;vr z!-o?wf^q}+e>fohaCOxJc6+aTOn2|*rKWnK5m=%c2OckH;~y=Lt9p^XC?-^Jdc^); ze~y^r+0v(_G5FW}V8Us{zh$rSxu?&bp~`lz+6dXc;)N*jtW6&CEX6LH^x3lW@Dw|4 z-a$PasGk818JJti2N$QPRO{%tZ$@{1FRkYC9YhVUt-JzsV@ib>yQ(j&b{?3TKkzrK}I`E@^JZ$uRoGZ*3rVwp{Ax zFHp0-7>^4ILZt;2y?e*{-$st-8XctyV;y0@q&=RB9UbzjN=k-1>(KGs+t)X_zGgKb zPYV;GMu)|cQzM51oO70L{G-LXEWlyTbKNy6_L*I#cWM4@Ug4979P=AzAwA}P-f}#G z?REW~nEcOim=H8FG4ZB6i}V#$# znCwHC4?DZW_PI@Gt(FIXzglN#pvPFyM-l3ZPEJQahxGI3az0m1a&l>C=zWiBT|pAD z{lLUucW5dUxMB3M3tc8>Ip%sWv)3x65y_KTE%BXW{LTL7oykP@#(Lhr>n7n9u=m$|Xkl`cCX&N26*F@D zuR(~HUhKE;?T`nF)CX7GHhOwt;6WKi-~qpAY;ElZvgr1e2Qm;C;LgR2=P9Mg0<|!-4(CLk z@oP7U`;rwJhO68U4K?yshZX43D6&}1(N~3@1k;!C&Hp7sdmz!#TZTky163nv8d8fQ zml0yWeO(WcB;==EI_@k*d3iBF7!$_3f8ck+r*`A+qi-FJX%aw-(9-H&m!;a_k-^Ej8wiW)@R-d3WUV zkKf0VzZ!-HiZ{r~t}AG2Mjyrh)5G;QIuygcMnnXsuo(#hvxaoUQsEy0?mANm6}ONmtoEeitE=E4@O{=pOTc6^xB)d@VJ;$ zzy`sm20iqYoVE1$7Ex=l9**E(Ni9PFC`#7sXVO;W$~!QxVtaDct4J*op&jz#LEkGG)B`;A}2(m4Bo12?b1O$`^rMFY*m7t*ov;~gN|*;V<>Y1A@Y;aV?Rceq}!23xAR zrNtpTF8O*yRMa2}B_J@Qp{_nXI}1I?DM^M9;dgC)_@+eclb1R34SCJe0=shZPxPN( z8YcfBB)x>#qPMOKVy?2iy}ho-Y;0_2Y;37%z-$o|sMy*f-Ru|*rM`gy1U0n`_RRUW zWUmgk#4C?-oqoT~w6JLV_oay9l~Trm2ck>7KqiWZi5!?DOWV6#A|fJ6-^W=@$>QVV zi-?TE*`yRiI_wNy)^QhZ9Uaw1fT&JXXsGr#QOP9E2M-E!a(-x`s@mG>1_qw0b+ECZ zpUcXwv_>(Qq+D28>3kA5nm0FJzS7z*OH7Dsn(_nhQyFIwQkiEXH>mfYDE3FfhMNp= zsveoIgeA5pRDK2Q7Hev1QqO|l5ZVV1)DVk346F6+3=9jInFX${!c6oeSUnUA3#20LyjZmK!oJ9)oEexIu7)z zwy3$b7=M5N-L<_r@!#jqlL@WY3@mh4wl_Aam00)gt;>zr6~TglZctrKjdue8=24>V z?>s$k`BDlF4eYtArinOh4Pc~ybShvnbZTjdoPuI{b=5sCkA#>wQ@sFKx=;fH2Gb1_ z$;m~P1i&DfZQMQz{J0R=_oYpJ?{xxp4$L>s;|JU1060GJqlk@;z79IFgjU}`479yH z1vtKvlMB_<_;XeFFv~0(M|XtWPPNp<_4^f9q#(&sw@JYnDq@m&a$Lq`u3jk{ zGc+UQ=i}4;8IO~R{w7w>HF)DZBNpH;*#s>z2ZtVL*s!*ma2h>(%smvWtg;IWpGx14 z`B4grC%PRwWoBj`?s`CBVM-gj5;}1_8@}H80F{owpdb(<8V$JnM5uwZ%x)?7Wz`=j zN>{*^ZRrjk#=wq@*N+47>i+GNm9si&p92&=3b7AGl_1v9~%?b#@`?_s=mh zva*7L$KrJ3X-aRYOe7c3GxPydO_P>5_8^U(o>3A~0=5Hb)UBv+5|SCFEQq>uYhx-) zcDmUMl&~D;6YC69DbHcO{Qb`}&t^Zaw0~VN^Z|$9M=%DZ4e>GD#flF++O6cYM++QH z2VIDXUjFx3FaqA9hD2sQeP&?+a@I;X5}x` z#V;sm41{%HW2i-32FfGtl7N)wV1NH)y}q%bA=Mc@wYVtYxRHpB>jsorK=iEL9xIGM z)HKvg?=(4xp73eB-i1-cZ{W!w`vwsoPjBx?QTK;20<1BD9;1#eT4hKkG|(C!%tt!I zjIU+oac0*bxqxkUSeUA$WYc1=DX7^Qw?!v)I^@6Vd}RMoCH=XEni?J%S4U$b&_+>q zc0PbvZa4srhiIU8{NH@Xw+c_qGGb~fx1E*`8EXKx`k(Ff$tnNIPqk+M}wmZuu_hrsg zPk(`xbU(7VHv5KU?m~SEz0W6Gxi4tBbYTiJUBQ~Su10qnf$XdQt9&)bhNY` zCis(n-6R`Ym^{^JgEdvvalK1ZRmD>8@2<|PQ@o~{G_qSwFb1zf zUmYv#{A+KL33R{mj8B0ANqPi$ncCu9d3vj>A0sZ|k?pP5D}jsq6aZO|+UY2j`7 zcI^46KqfCMXQV za{>Z&W2f#qKvl3g`-Iw+hK9^{)|XeCle_$wI~+z?!Qpr{4CEx(p+yLD^7260X5N0x zm70<=C@Lyt2`aw*60dg|fGq}8y>tno*`_G3>`;|6iYsj_@tNyL>-2Pfc=$&+BMAvp zzzeOU*wr3a3Cjij-cxP$Lnsui&HxGpoOknuK%fyA$a?R7=smiuj^pLuAC%ls({m*E zXp`LbXV~OKtkst2laoVD=Kh#V4qDe2j^(+_Esa&CM@8j%{(O?eDQoLy%i*6Xl5M+1B9RbbC)viK(F!Ib*^SCvK1dxIlCL z+BgZ>kR$@RB4j%wneTa(ybo1XC5wP)?`ueimQ(KQ?$LpPi-e@S7V)1x?Z?oS+A-NI zbji>Fb?bi3jbrh9EG+u_8?7|odrN_n{TTwN6%USg@6vP?Tb1Kez7O62wM=)+U`P2iSg`9VXjWP>-Kt`VoqA%+dxO&KGI9_!mfK#K%wVv6To>nF# z75P*>3Xe zlsGs5wZB${%gk`eCLDq0yG`u(5|29*>H`A<+v5CR4HpMk%z;)E6FH^eXL?GnuU~f{ zt^}~T{^R8vKYyN-FxXDj;SuH(6}f+nS-nY4&O{?3A_9AwRX9tvU1#v=)2AIoM;x4- zq9+bNa;0_rsr-R9X>kW6=Q7RA;8O`5IV?O*N=#%V2OtT;QG4Hs`T4zmhFk>IEA*$K z0!ov9K3F=Kp5`K47!^jSt_eDAeewK4G5CaGj{&Fi zm8KoGsG(wdXoljNlw7;~eLyw3iH?FBJH81A%T3D0RisLP##>5a+GDu!`kM8gMes=@p>6&`+0Qc|3hgyjI1BV+pmn0ywtgQ{9V#F4m@pS|L z&~xk4C-KI{*G)LlGXVfrmD#6&zZd>pfhC`im}2}>El(=l4oq!^C#bU34h|}yA@hVQ zUQ+EvIC`W^bOVgFA@Yvqo-moiE3k6b2UJW2^OXYZP zi&_oqS=_Rl)JnOim}B;(snLFVD5woRt}27Z%ofz3bHg2dd205up~By%lx^ zP83`#POO50sIoS3MA7w^pRx-Jl}qVQ=l^`NOOazE$8e+wmR|L57DOOBY*x7hg2+#%QFeNh%Y=# zkT`J)vKSd!kP$iFnvoNAE!i?a6~=AJa@out?urJaq(qI@piqx3yTEuSMI>{YD90%z z90bRHp%yhb+N(U)K3>jK-TKoKbC@$~u)mSDbw7&dIF%O^e;+PHLCEa1uBjEXeYRPn zey#m!Akn_1=CskL(f(_@k28r*DW!tXZqa9#0EUZ1Ysxkae?T(F3r1h8(#;>l)=;Ri z6H(>el{@Mg&L)d2)YQHl`}=b$By1914IeMlHr)f^HT#ouLiZ-8EaBzr*VlQk;QH7~ zX)lFdgF+>{?aiZ?FTuTQX=!a=af2cTD=RD1F&1Y4P7$jGhTqP^7wKj{e=?6buaUBx+}?4PE;7g0qu|WswAuY+s}9yu^j#fNG=n$C_o~R-pr3cE>mb6OPckwkc5!% zThAtJJoiKMq}<0yWMOWO&0L#1^InXAo%-u;hOiZu3x-4$AiP}e2*N=Nl(xWyr|o{+ zdwQ}9IZ*Uqp1Tvo#UUk0Gw4Sn!3?VyddjvN0KuqfXoRuclgDH583+faU#C*pzqtrq zzg&gegn_P`-%#h9s15b-@O2%kVgI0@a`;+F4ht&_3v*teoNd{kpR7%-_OKTaSW$hR zyEtg`XsYgHq|9Sph3Q=U=gS1An=@gekoc;cuxCY)5D}$eiVN|7z*kIkzT$Gi7A5Tb zCs)M68YtU+@#+;5VVY{YbHmpa(A9hMCR<7HFCC10E9gbr*w~1J%(d~!5w`uxo9Tvt zwwTA_u%FOP)4*d4QghkORb8!cU{jPvUKsq^CDf$x}2ZYGi3FYME3_U<9o18of z=kkSHnQ#&yCBKB{aQp!uh2qDKWL*LG<%iAU%vw_5)uXby0===Jf?$`}byGOIofd5<^=I8n+ z>{P6DD~D0u;87NS{+Xh&=bjA^&r`d*G-$O4Mnwtg*R^z~$oV`4?%xX+$j3xO0M7Be zcmMuk>r(ILSc#1)$Z}#@|GMtU^N#)6-x>O#p7ETw=M~qTXGP_S3A9 z6wTTA;&99iQ0kp8z4%y1rVtcEh6~m_$s;y47HlRo-u*qV*r-zOpQ>5L02DPjMt{QX z2Y&D5_m9qr71(SVdFK+6gv~E6uZ^9aq^P9-c6YjV_G}&K5#r(urt46usc_zX0x6i% zf$FPQPYC&~CjH?fte}c?92pnDKYIpY31I-l^~(JHykjmTq@)ZqaO===2|5SG zo>wUa21YCTVxEA}i4octZE|vjd|1U>j_uc4v}a;Uiu+pClQ1?NFi@<_%)dbC+=KeW z9>}?g4!ABXLTLxUwux5W`Ya9J$5|u0mG5?=K&N6H`?(Q3*D+FvIe;4;08hc0$IhLGSR zScQuhFVb(qvvA$+?;Nf$^CYI_bL1^H?SBv2SvqFdayq*8(^f7h60i&S zkL1ZM@2~95^KV8*s(3%v1|C6?$ioApbwX)LNSEkzI>vrE+><1BWqth|+;a6Y{LT@# z?Um zJ#R<2y0vvN+HQ#1B@@71MN8L)C(T!GqfQy&5L-w(P=p{w`Q8Q&?rzilh4RL;3|6j5!>GCrx=)&qBw}mv7nG3%K;-hlO;tN9pJs zuuS+F*`r52N;WQ+^^^h71DX;H*`~l_TU)cIPq)j^iC>4dm4lf3J$z-^E4J1f&C$>z zOw&QXzEMhv>!yhY%i>KpDR@JO|6+yKZquDb;K!4}hiRCt3mUHt$l~PUl5=z^cCfgO zbYhhe`YY11r_kTOe=q)w!Ehsg?siGUM>6lmmPCm2b{Z9cSgwbrmZ-Ef*O zoJ~Vv--Pz@w;7v7LSn!!0|$y2#4N1O^7eF;D;b^JTL)DaLUnB`Kzp zN>xp5_~K2@Jb43yBtJht=xD&mSPLB$r{`~3O>Elf5uG+spP6iCUu`{+T-WzqTsWsa zYcEaA6pN0-e^aKHN;i=io@{a2A#t+V9C~T0#(h7}X~>0mWw$Yw^;zjMKTn9xJA9f# zC^G}waz9O&R~-@gJLpTO+^&+-@j|4!y``$IF5!dJp#eppk}L3N@KT-__p}gfI58?j z+{{cfL$v@nW?*gAWMq=n6Wl2vpepG99oREoAc{cx99eJ>z5pSSKj`G!dCS`y!#?jk z)9LZDb|0>JaLLa6VqV(>L3N^7l+C22TQ3Ws0e3gPr_nMrdTM$F!2S&&mfXjF|0biM z$>Q$(M|yu)TFQ-y$sAA5g3(x`;QR+O_@@@CLqrq`mA^_w+W_?h_yN78o9cD?V!KOc zGXMGW6GjK^mr=*+fBd+~!=ntH3sb!mSxEqf!@ZwdyFfJCN3s%Fmt4r&PvTP-Adum_ z*qkIO(XgKAz{3-jVf=OYJ~tQoLY7!;^c8x#ZemESI}Ai7=unn^&@0ddHloiP6?YSo zU?*F(I^xB=7F3fxN!SSpOHjn|!tm{fXX4rnAmXt84(hT%euAv7>BPp?@@x4$i0$$7Uqh@Qp?zc(5B1kM@u4S573;5@w_ z+o)BO2qxanu~?x9O1Iu)?;U7-b3G~qCKAYRybIkta*0LUcf&Mla4XGpmSLPXhqmFV zuQp_bfFF0lWTOqx{UKm>FAg|e_nR#)KOIERAM;)86qBSLql-0lDmq*^U6|P zkN%651e>)X=f%VX@^Iof_fVbo-Nc#^_2IeZd@|p&fM%?XRhlu|FSfP{|D_ZfAtii` zo7)`QFkg$m=gLOc-cuW|61**R%-Y7zs(XHE8L))qs-rD*uoVh4`xxms+qj6P2uiA1 zTg^(N2)dXXt|k2#jn9B-+2)zga#xqK1z`S1!=0e9nx1|cxTOTAjtbYMa~CN# zJ9hJHYD8mqZL$k^n6eJD;2vtw(z0H0EuH*yzv8YL6eP4if;`G4b};07yQ`_dhR)m6 z;tPS3F**$w^YJBr28f??bN95j%ONsOcb1xZes=aR9g2b$&rnwqhHu7##g^xPb=1vh z96TJgf;k?`v9-~F&6(i}U$4_NLrw#QubZQeCsRY#Gd!Koz$gNIq3ec&m7z$dE)yB+ zZYCnhfe{VI%?2dMf&zwIHr!Jn>8$V8USrSPoC!1g&^XKOsu=s7>Uyt!%%+c5=}ueI zIMIHV@+PV7#<*RDo{kQ-CudLXJNtZhQpbe%RY}$Z6hvJaJPi&!iFF0g;e_v=QY%I~MLcvYS3AX2((gr1^PMwE~j_NFBr3 zahVN3>G=bTKd6;_;SwCHIu2vizIgTWb%QLaF&Mutz4L>b($*-1{ ziLUzi!NE_iDuw&%)m?sm=_GjbmKBd!W*(D43z?n;r`1r#!!tXd9#~C-%@|lWxTA+> zpv$V@>=vIbcIgRft8)BVa~-|1)w)V)irZLKhOM)4VpA;_5r!N#+pOnI7L3Bxz12Tj ziuNn^KD(XToXf51e2+rmr7SF#2Z~sP9=)0A?n*^+tK-ftzh^!D0UCgKRRbx*hTFp7 zZm{4|E*(hRlc!IinK&04o5e__84|kXF&p5aYtK;Q(e*5M;n|$;SDF7v*vOIJFU-uC z0bCzFx9jHlI#=4u>l}rSeu8>|)k;NcOpvTagQ_jP=SHVvalR22*SnlsaZ_C@=8YCe zOeI-XXiOgb>D18ChK;6JCFc3^#MLBXns%X!{N41|t{QlGIp4C`_z}CmW8ONIVzKA4 zdQ(@jLYXn(3g^oD-C0+>>H2&4FJNBi{{V7fme zZ9nRI$A$=L>RS=>{p$27bfPC* zRj|)MHXis%9@vu2-j#8+28X~zac+{!xY$$Roo>RkUMn!vz{U?1ho(rpJMA#NHHqi3 znVEw?3)%Aex_Ys-sy)u9mETEZ{@cM$YwPKlnT3I>wLOhe{Qd(@GE7uh?vK=vYwMOT zH!~F~`X zaWF}~bvVtcHjHj%^@mOI?^K%-k?NL~ul@8HixfAvM&~8&q883u*uU0A(l2b!{#dE%2g@)Y^?%kWB*cBE|>&ihKP{HPJdd)3r zm>i%{6=U4hi_S*JYCW^~j2bEM@~Q)p9@O#T>?{*pkNxqsczxmO+FJS>$w6=tC+v?O z=h4!V78fTPr(IuIzKhJyL->Ff&_YK~DS^AG5jyRAoj!Ro=i4oLrtsG=x1@)aK5qL} zdx1A}?Oxxe8IpWAU>y7A%?}kTW$(HU=`~D2!MULQ0FUyG77SgE_0Ix3P1jVDq|DJj z*5ggZB}0np>dxD(;&kotYCQDx@$Gid{B^7+F-qjxvS?0JniWrL43Tb`p4K9 zdrjd_d7CDv!-`q1cs8+s7|mS0TIegvdb6nu>XSC}AbJ4^5292`2Qv8{>^(%-CpC!B zweP9rnUH;8mV5Cc2MPeT0^}?B{V$=$Apq*Qq9Y7^9y|LcmuaL=o!>>M*41L61D_~Q zZi(t{>LOUCwbc&CJ)4s=V82qSFB3LY@G|u}CIWlJMJux)7|oTq4ZX2~gM!v)bDHG^?D==Ai+T%% z$u4f$w>nWX-u<2MI6ElFJ6=pC0!ORnm4X$-hDc5Of#Z1E?OWkBLkla8cy zZs|2Wb6z(}cXuCLn_l#(13G8OaTf8>fsDOzw1Q2eZ+pjSXUm~GYcc-vwQC6;eF8|G z1~hs<0y8y?dw&7@@#+-1vMR1X*_f=pu{a{wVz8lQFLS3U0;7t(XFVo?^ImNzNJ;Vb zQup`cvBxPqE}5W+YN)Asimhv9?<`^2Q~H|o`?;;F4{>~Q%%x)dWZ1$k@AfGA zSHYM%7^$EV%&?A7w~({ILI*)6|D2~oU1`}owwFnRU>t?b6lnsl4#aI!QZU7KB-7m) z5E*^;&1|q(1KfN0uM!Fj0=wVFM!pBrahMM&jMqUSM`GfjrDcwC`F9v4wg1QWB@D8i z>9mmh0L60yO0wY7bXy^g8#v z8QukC=ns&yz}9r9-L82{w|QECy*aXECJpaY^h3btq+yRq^Y$>H(WODkteF{GNMN#> z$RG=fn>eJW_Z7m#g)zQ`#kQkEtpYLWPID`YJPogEDl0Pkxb|wt<%gV$o9fj#i3~11 zTU?6`7v;Zuot|D?_}!TWbXN2o`FOKIKT0CXRWMn=| zRF$W+Mj`3?Ps%JLcLWvZb0Liyb%S0vyS%Wluw5vz2jV~(ghXlux5n^zMhV>2mG`p+ z`z$+~G_l~j&CPxCX;eG{u_N8l8ouHr$BCvyat7yH+CPpbNomM1RC!ihy3EUY&)z_( zdtP6z2>ZFpU|dgAvz%jk$fcA6KJ^QS!>GSugHF{uzJ{^Y)=B2zd}BMNVDk!%WQnhm zJ0cMqBs2#>W{6&I)A19`pUv)JwJ^=rB-mY9jEmvGL9F*=H})kx+@JVqe_{(5Sws#S|TkR#ui!AH()D>^DLp^auZ9~yMb#p(p_YBRZl$>0o*EPnZGgsE%t%U6`E)JtvN(|#F zywppr=XX>ZA)O=s<=OIG+uuAi`!etD5L4|YC)Fql5AEP;@#t-NOUpH&+^-W*= z{O1@KqrjD#l6Hmk*-3{izEL_ZAFp_Z-u9M^(-E(kpPQO)!IfmwEIm&dejvfv+;HQ3 zGsq?rC0KIBw-me2lYy)Wd83u9hu=B>wW!DeLIf{gHm-}jf{#uHmU*Mv+iGG$Z=BaF zA|fR>_vO!V4ij(hdLWlLIXJ!=b{q@fJD5h&J5+&L_4%F5O-kj280qShlG!D%*^CGqCXrD>0oCm=enQJmLhG>8B@A$GqN zD#cCS-u_|!d|%&qj^&N+8^Ogk`HrnZFzh(wNn_aSh6Kel1_p*2y7q)8d}X&FD!>vf z75yf3e4?~;Ahh1?kVb#L@z->_B#D~$)X*~^&1t>4xjBR!iybT{&4EZA$MVuEMF!Q3 zsG&Pnla1%jbv};ZH0=|Nc>DH$_wV(3KQ40|YDjR}4BTEX6REDM5{W3?SrAUVs)~F_ z1lRnT!NuETz=g|X5~b~6h6V>6+P<(~rZz4r9zsJmcQfiMPo*C{ zQhob2?*`xUavPF^2+zV&9eoDI1gj+{_d-V}0aRINV_#eUP==x7kLljk*%^#O`I-i! zv{tFb9TDLg{~4#rBRgv|$tE`u#?iMkRMJ=Pka_t^^`sViZ_ZwvuQcWXo7B^@WB~N- zvMRbMT}H>V8l5=9AD$IDi5#1bVRE_1Ro8ZP%(u^>Syz=XC>JXRA3^*_OW6Dps7Ly^(D zhQYzX>S|%gAx6TLNH!Vj`4nVDi*x5Rd^OX^I&`F1N&Q9@q)|akwC@caesSSkhcpR#d-{7K35WesyrU3Q`Fr*e?Bq)v$#0ExTxsZp047q*L*1i{8NhFRK=0K zDu5-Y&X_7XT27j;GsaA5ZGZLfDAK&Z$mmq&tu*_UyJ%JS)G4Ecw1>R(sLW3QY$$Du0h2cb@X*RsQI+1blltNp>Xj<)wKp10)&3-H{^`Wn)y7h$ zm#j_}OGj5?v7ga=i@xER-gR;4fB|F7SnpD4dejS@KW$6=*9GHLVMbY8F_Iqu$?kUO zwbKwCaF+#i$-%*4X=hhq{GFYbS3MEQ=t#a0FSZH2zaz}*3v-IBY_dF`Dk(_?Txo@j ze8|oR&Ib-6U4y5pqeBs@xJ!KDpVZqxx*<>U)qD4TL9hnDKT04V#H!GfcGAtwr9o%y zemv=r<92muPY!4FFK#`uX}XiL);vG!Y9H9q9JT(vRE37OE=K5>Ej7nCV^L8h36n1+ zQMvIiGk7+qyZEl%wshKEkAiRscrH(!zFk{2*E;jS#(p}QWbQ)yBXjP=+xFIrZvc9y z$!2G=qbYR%AcjH*!b=1bH!EdcdQZ?$4i&wx*Ss9aNW? z_1gL-L`QR5H7%@IdhR|u6t_!9M+ei1`E(nEH8j8l9?`C(ad}<|YJcG-4zgu6Am*H$ z{P^#dITA(xeh9J9Wq=n$g+X+5TwF@-$82^cqA+3Xc-5kwhK3yLe}z?*LO@IBx$I2r zY*;L-k9>ZvJvyhFRpKQat&(XQRsyWQVdt;K%z1ul61(tY>n= z^Fd!xGGcFfts_;s_;qReumj+A))AuO9TigQCNGQZfq|oQl1>U%~{I z7y?;}1;>f!U|?S@1aS=d^2+=ERdy-ZMe|_Jlbv5aa^>uXnWT|ZJ|$C;wN62w%IV&I znx=cskXD8;V4KakH*YpA7OQEaYx3`~h$Lw4;Jq#=I!MI%#W?6q&2)8iNkJ+gx6_6t z1bkl~DLL@hQsG7&T3uT^M^+}X>+Is9f@Bd^{?aJB1a%HL6wi>nj!wE4Zp)B`O(Fk| zev8kcBm1ipQCdvgP`?573o?Hrn<&hQs!)~fiR>48l zyBL&0!|VEdvQ?XB0^(T1#+WolN=gbnwcgHUgWfEoBZtRd7#n9mhBrwGq`hjC5C>3k z|7vPdAdozY{=h_hgk+LvLSYF+M{8?pQp1tb*>THRB|TZ$>@?%~mCFelB@^al>wfw9 zx~w}()J0wH`8fRh9<(2pf9XjvEW$+{eyWP4sH-?2V? zv2JBXJuukWx9{A2I)C$Scj8Mc-&47gtVRxZ zslM8tkGrXq-uu9`kNwG$6j;U5FK8^%S1?}*3^pq(YbR2k6L%Ph@aGVBhOnRA`CaI} z1fx|IAU*>ec~~p|j$wO(GyuEw|LU*rz77besfus;cbbLVQ@V@Y3Qv7n=k}k$8swGw z^6TVbUmn&f10ewXQOM6=Y2vd%p)44XtV$s$AQ-;M+AQ{dE}rnCHb4w$uWoFV=Z;K{ zkJ~_+E);c#BEu@<)B(3Qx<0Av(cJm7HtkChlB`y(#1qgreo2`>D>(@6@L z?j%wC$Z=j?zsQYkiRv47e=De0Gvrrw3MSd27392c4E*|3+&J2e27zCFSr>Q( z*_Bs7Ne|{3E_#s#sHk-W0;(Wkf=w}j43(BQu}Tmig5K$W7X+FGn>+ayasW7Jem8_p z@j1P}&KQol{!CIwN5>mH?5!^%T2QufB7gMn%98Itur-N@iE&sNbAZr8GMz2kAvEnK=lq_BS5TjYTh8o2QD|;%d><2vSAC*I1Dd`)(321# zL@tuwfy76N#uwSnM-ItA;v*DNokPZEj$5wk83CB~_iNbyu5Z0&Gd}ZyB2t{%m(qN$ ze{(B}TVA-jyIb|YZXHG;0H{q&Gd33mpb`zG$QZXu_4R!IDa#JF%aNaL!y@CqUEOi+ z?VUQhCHXb5 zWdL*fFzo7xh`&z}$#@q~%1YPMl3w??Ji+$Ur9bUKDh}9sSnS~k6&WDrham@R3XyKOCNuKMMA5HhK2F)*pGK- zt5z<5Z*F#g>k2_&WO-Gdn=u@^e^y%qWd3!saJ!TSwj(Gg+rq*d376UANqS;S?ou#q zz3k`t>9J*0d)wa7Tc1vvl|1NJwB{X*r2-GJ%pp~b83c3lpMO_H&VLK+lTt?C?dO8Z zKqeDDI~kfIpN^7S@(l>+i89VtB_x-)y)L%D%?uG}Va`iEfNWEd_JGJED0%+uSsfFT zCOY8xzKRSl`blPR$kVsZMWouEuL=u~K3hJm81#bCRBiEmeCPWk3a72Ca^aw06l^m1 ztj!pMwr#LK%cGv~f8pnJk#h@qGaT)^E{lZwZ>j(Ot#3Z?n5mUa(`DTk;s{FWUzlz7 zce|EHhj;$?77_FrvXUj4Z~6Jer;MO*-M;r3k0bXi$S)8%=d8@4`z%f?Jy~9E&YGA^ z_^8H%xqM5$`tiJ=phpC!VP|eDu{_UFw@YmF^w3m+72L;}xu&y)2rv-?oZsBpnI{$f z0BX@3tumCN0t00f6cXf+^7N24f2w+NMzsAd4$DD93(1>{Loa{+e77z39Vh{4wYIig z>qM|$$oeX)zQB2b4F!mz1Xh`O{L0ct<=h}TOWWZ|%m=m<>e{Os_jvEHF8c)qJz0vw z>M0Q$LA&6}%9|R+Ox)afsB<9L2SFFuqa~1SXf!hPtFcjB_*pe#4M%{~@b&T)$7VI# zt{eGz**g>|8)T-gHglV^s;uY&6$b_nSqbuGZADgTkZUjGDFweNsA$}|&c_q}?x)CB zEq8_LGr`8q;U_-)&g0e2WGTbbipK-a!%~=`(6)s{;HI}v14yA;BollwFf4qIZwpIG z4zAtbr8R3PFOdg9-=+gaHqb8cgWHPc_0KBTBhH4 zD7U)q+Vy>$H>-I_$hoxWI+RYL2#pF)cJkH!ntFDFN(oR@p+7r2k@Wn@mPC*S!80LI zQ6Tp3TB6mQ9Ey-I8w$LLgQY=2@7c3wpOS#f9{uUlGeQrBE-i>^hA<6#c*a7hqsM<% zhBpDcs+OiEeg_W3{3?vhk+KCR|^a`)1K|K#l4WX zqRJ;f6gmYN_s%O%SO6O&zgEf`f^h@4(YvGv!Dz|@@$yFkrqj)3rKNsnv-?P{QoAc|{)dm5u!|;?&{a zx@2Hm=3Dtc@+8(N>-&vSgF*)2(K6;)70sn%NzH6zLDwzgb)dd`jK1dl?ggnHpC zsP14reAt;#rYNJaq|APy)QMs@Pt_E-`lp{kmSsd6!%X+5lPJdT{{TKo#E+RxR?&Vo zLtivtAq}ZWCp;ujNEHt}337a3Us9LN@ie9#+H_}KY`cEa=XSoAr>2>8DRwZ`@eh*hu~*6FT0PkMpP6grb?h>k<}*LoBytuzOBvnB-$-X>7omBa{>Mf z*e(ndKN3<5vm4&q@MT9sA9TfkMg|47OAjHWQDR3U3xC#i;bKJIJSUpxRW%BYaS9O9k-_+ z5>$4w<_+9uhF=Dp5J7fC>dFZ>@tFQxFB%w5mR7QXflt(z=io4PRUmdNEIj74$fvKX zoAO_41X74Zb!SA)^;04zYQ({nZ*s>uC|6pH%=>=DLUlLhsSi;Xabk|z6H1bFdph>n zcNZc!7gzo5em#RbpqQa@hl-nfa?T`E?NnT;kFT%mwxI|RENM!T2isTnZ~OlIS$hX% zLv&}!$>Zg2z`>26Mg6AuT((OB`1>^B)DE6kYM>tQxKU>a=)e~z*Y{SJb_Hq;9NG2) z2QFHSdpD`@mh`+#>Jx7Pi&tIpM;$PJk~dXJq8HneD5q=EnNvThvlTQL7mY0{evclVXUxmbX=pAsdZDYGzX*B42^h`|oO=2H8 z#!JZPHPb-elED`?68pPAH$2SC@b~)WMT4S$8GL@Pyn~CHjjlesmKe5&kzR9NhS`fZ zf2^)}(wE3evKhvuZ8u{Xg`sr}>cTewnJT$q5bcAeuyO=%2mAnm&i?@}&GcP2%vb%p zkeRNJAmA__6I8vd?6PWxn#a3Tdm_qA0lNhsfRG1|U@Y{Qsi>fYq)C|G*O@Sh?;>(| zBFrJjwy5@CcOu{2NG$b%$5HI>D9!sc8#YfYK706!*Y(~7*RqrNXfhKE%VaH0_}d+Hr|1ey|Ij+H&|>o=I6qL;HAuikZMiEWSykmXUh z?sFfrQR$O?|Kc*8C^~~Nk1BuQM~%q5jN3Mpq5)-F1_5=bU;y-Y>#??WEyN}mBK-2)b5Kg(A-7XVZt2{dGeU2Sfn$qCtBZnPTZzKq44j=gjgpep@93AuB1s$nRBmAj zaF4{qwh*3xrWF$KW2r<`VzKW>xnlZu9e;SR8glOsV630H7qsqhQ89_$o%yo@_A1F0 ze~oE75VHFF^QX86f3hpg%Lv}(ur;ZGRKoa(BXK6^T?|v?1=nA^(4+3e zdrr8N-_EtZ!PX$)I?^AR7ozpVqAiqsb@S$x^t_$9!6+MNBcgejlInh}94Pm+=)-Og zA3!df2a)V(Ey-=J3Ex@xao`PuWrPNjfJ%`U8j=7!o4h=P-kH^HEC|{94MMs<6;H#= zDJue6kO@d21)ifz__;v`dxiBf+_E`Ga8uyX!#ebnP1g>+x%n{ce_QwVr9pjUp4ru z&c}K?j#cztn`g}E<|j<+Xh+Sp*sZ@?fVpishDytax+4=TEy`KyQ7g@Rdm|^4p6o|n zQE9tuSN7A=y4gx*GegE=2k~t}lqC4X7Q>#mZ*6F{8Un?73JjyJmJlsLBf!KQa#S9_ zFJ+eRdouxx7hmU)3W(vKZZx}ZzuaI5PAMH;W%WR3RCU`ED6Isd0IAr5Z;J_b=9w!cjw^d* z_>V?KQ~Ss7JykGf=P8+8ubPcXzu8RosM_{o^j1@5i+jwOQ|)z9N1QvSJ1A=cTqoA1 ziE@Ncc?|lkn$VXZjWOn9YS#)LNjbt)AFP%wywND1tI&+|5_SaKn_tW!VPPfeHn(q6 z51=0nmk){sv@98f)Xrh8taoup%sk%= zDMXYrW1dCY>593OiJu@lm+<7NYfk^Sa86oNouoq7)7H&jrl?ob6D_vyYs`>ail8obe&`UrZ7{Nclgsi|C7mhN0Q z{pdt+JxDt2Uw~SU4wNDsSI*oGcB*C9EZvw++JQzUUz17}8dBu7@Oz6acP}-M2HZjJ z0rJG%y?CEv&)jvV&dhG9u@JQ&6IJlEwXI@-Yi?LVUrCdvyi?PnY@~1Kjj@x6%qveE zzlDbAPrEB!3^~D=J2UEc6OT^%-emM;Wqf+7rTacLzLYG%`^lBeuTlZx7b(+EuG=0P zsbywKgE7k0Z%jXCWw6o3ciO1FgE7W5>%UnoOyS=SU;X%2= zK7XSyr>t~DTx{H*DwNwyXR%_d=j~MdmlsZX{tH8FnMs+FJJ0>uo{^tT?=s~4%#Dvb zbCU8=p;4N;lxL%%-F<2ssgg#+tn6^ba~j#9I?ADu4ZiHIC0`e{rhdFU>nI`T)avCo zJ=E^H>ZV1-=lBbHcVO%mDFb+aD6ye1d9QvOMYBQ25t;_%{uoeSSaQe9DCU3r_G{YO zD1UhCc>nWT-v}iBCN$39b$a+PsJ~WT?kxPnr#g1%;zbu7#=qa`7A5NUc(~L-+Qr2M z%3S8oqcWc9NNm=9TwoH?%2OVrR3D0QHB`%E+nsS-uX+2Sj!q%`ILfX2^&tTq z38G*1a_>W`kyaL!e@#u)9;|1?c+FAc#fvv{rvi%Xmm@o-p{aY?e=_!}qb_Kg23 z5^?=+>IY(?NqN4riN0Q|Qao;pAMf3kw>^xC1t_WN&w%r0{8~@g&%4Nef_q?KS=svh z*0YRm=vW6`4jpV@jZ1V<88iOe69OB(I>Q%}omQJS=WJ^mLR~-nXI;%^I+C0e6voP3 zv~G{GSvR5T$^9;(FR2@y_O)fYa4R-5%Jo$j7k_5k3~Zg@qbk)@80bF0l$Niv zI>9HO^xogcCu9)J^)Dm%2|SQJH{O1GcJoXo)#+oj!ctOFPoMfEaKds1-gT)$QcW(< zDQ}!&*FQ#^VvAOnLYQ8b22Q*O{wZ3(b!)vxE9Ae$EfAeLb%~$XbaNq|y^K@MmI&HR zpE*NGr*3=Hjb|lIt4v-?3tuu^c8%wMZmlY%_R*w&rjzvR2>T-WM)x@CN_@{OBti7p zSGF2(o}#t1vbt^qLO8NvHgMzYqv~qwSBv(x1tKS4%_Gxn-0O4L^)@j^zNN|&1Vw|0 z-796$_m^MoZTm+JyMvy=iAqR#y6n8~>3*OKstFpAj2m~G?0hE?6&1sT6LujIcA?_S zjfRY4yAlk+35c6GpegBp=Rt8<|L{=sz1vpnGXi!q=SJa;z!I#y?nd4N&#s`TC{2b^ zuHE8ojHR|seOYx`h_e5!umU}H0THTe7% z=Y1SvUud*B#+4PZgZ%uu4W;9a+)jCQl8xc!r-(X8sJgWP{vAB_qIwg8wADjpwK~Yl zV}X_d8GMSRKsi5B4Bd+l;BRia+*_2(T!Jua>)MqhXc5_Sv~PdDFnl#=zBNt&X7r?Qd4HsG- z0Q9)?Q5i-JA(T*>M-Lk({Ve-W@QhJyhjeQoBEY|xZ-W?o2n>9cc1VC$81h9E5T+Qp z182!QhRSkPR2XRArq(z-XrOl8?qG-Rc1$JzFfT9D9ji((PxH2(gq;+kqx-SFF^^sv zVS@FHrKRSuYn3}p{eoJ0#zr$lt%iac(DDYN-hfjtx9Gc#`}eDFZ$(IaD28{wqJot} z6mKDVeyD8q-5J*>;%%o>>Z`vxy>daS!RZCq}wFM{fH zdBW)s-r;$jG415ZY^P21ZKKYsh*(v6HpTEcY|PceYaZ)ic=&f;byU7CQyB(17~$f= zeILHz({5iW9p7dR0Z?vkWr8`}9oE7ZzW{O_{;PwhlBLG4z8AAd6yA6pITjeTu!S3q zPE4eb=DVwbe2*YY4WN3-;3McqC)~eR9)s#k)UblAtivuYJT$axf!cL{t4GWJHzwx2 zQH*$aPHryi9X-GBDA-oQqY0?ExLFCp-#vin;rEN2?@u;!Q#NFxu1cC_SYdPgK`aan z%XBdC_w!x=Kpaj^Rh5w$v3@|M&V9-M;9^ROz5f((XEGl`ber!d$Hr2ON|WLvlhiN? zBED!Ii$9NxV226M$aR-(>i{30fs#$414W=-7Fl98_@0O|2evfu&WK z)W$#p|1GnD=h1APWuvn_6+2V$!MxO6rx~Tux*X%;r~kd}{H+6T^UqIX!d^lbxf4#a z8L@o05qo(3HQZdT%hp!+eJi~Kw6G3hU9lB&2K~ruU_ku|!Ieq;?!HsLHBr%+`D&QT zyvcPoL*)NUL&>|-(@8zE8}mDl4rKXdjZU5^6>Z63LGiS-G_}H4l9oB(G(-~YyHWrs z(I~*~BErI)SC+&dKRy8h?T#ShSf(2{0EPx$cs0@F0c~EG|$3mcM8RtR9=qW z-&L%yZ%CGPCrBRd2*60sb0UVN-=$Azb6&bgum=y#E6Ub#TQ^GVx?dE1PPK?(GkQ0s zvtF@3d*Az?g#UWMap(B4)EW-mHjfrsa8lR|H+e+G4KB=GfrAMx^!233|#&L#ToX{eIX+~ zU9Xv)^xpZK&k|EDHV3&CkQcil?hyL1>^aXWS(sLfcvm-BS@W?b1U>faZJ+AoSbe;l z+}S~%{aS(j-Ta;jhX*rKK&{n4=L3e>`M+EDYXv^&(}VT=W+j4Bzy$*2w_Q*N&HK>y zgj?7*SNyVZ&rN8wLVxe0mN0z5(&_TdH#BmJiYMCaRbmNF-PjnxLyMomJ# z3oB0owrS!Gy;zGu{w3tP5T0L_pn{Uq(x5f=#{+f!qpJU{$F#08%7B*We7a9SK+G-e zLgZhe@ZUif1%A2l=mf!g{QjKu(MJgef?zLwTe0k49@SD(?oTY;>yX|w%#Va<=u-!t zzwdcWM&9w+X|u&?0|X0&y428OhU0NU?Y0Kd>$7P#p;zh+ov(5rf(Hsgpfg22iQ)L} zIgyjZ#4X?@bs}C819Sk^2A^mldXV5FW+^JxUtEg1zq*eZ+E(c=Ad?$HXi4PB@w;?) z39_GUON0nAK?^xVA8(H)vX|du1bb)K99zNspm;CgNjyQ#<0ug6gJ=virWge+^R~@E zhhQ0!=7wFJ*Jn%@qVGl#JrWXnVC%PH-AQfO!)7^FcSuh2%)#qWXZ^46)qxe_wSRi> zzRe-00L?6@6HSMm(*&YrYju)cV7a<8kTe6iy{L*Gu$RH9sglIFi>HqrL)vdU`+#|+ z9t88MQF4hhYpy08vFXj<*|dBL1FR*2g>gU+4Y@-?T80I9l6UvDR+V zjSSDRzf83|5_?XhzOm8jK{NuO-$5Y`RMryY!@%IjTkV{Jr6SXwOnP120zW@~L@f{= z!S`+P#}$>7Xn0_zGh8G=$_Ui1CkP%<)Y5;ON zLCKOS8GDn`J$TUIp9^hfT*gE7KYTdHZtW5a-|GbHW!;tg`(;aap*!Ml*Bn{5%@6->5kbr1vLT>46cn2q8a~JZsB(J;Z6Bdj zvlp^4v9xwGb69a`@DF@<=zqT2imo2F9NvtmiAL68apOc`kf0UVZ7 z>@wlvE(c~6dN*b$rTN`}ciK0xyKYsmC^`52V5jCv$9HEC1qTnR+(!f%dC+=GBjrF~ z7MKeVejFFr7;XiTiH(6Gab(Zj>O(55CVwBN`9ym0A{zqwD`OG#otT>1tjEI6ZjPY- z|Kt9tK}$DW1zv5T=3#ha{>xhJlEL2|$^BmM&4yRl|H&W?P>#ejG3CZRLEGDe^RHBf zyb1t1e}OW|vv1Esr6?abZIBS;2X`MdAm*G1*`sGS!;bZwId1?@jSahaMx)(JuX2_%J5qwE`jHsy0%!}ZKUVhSxS?ZIVx^W(=K=!-n?U8^@R zwZ?pC7qhg)rRi0iD6nTZ9m-N<+_P^kUVhL#3)Cj|o3=1$2a=lVO;kecrMstx;KG!@ndYw~8Jkptf&c*! zwW+BM0z0-#1FA$#HG>P9g1^Y-EZ4nt0o-bW+&GKH@^2;^eVX&(u^bh(u*~@oabJd@ z{*c$;!YoFQQBs7)@NR`3==#*uIR^Q1_@D)~JcA6uOt|MyDa($=c76_M;NXa@J`)8&h@$PXy>WQuZ2QBZ_JPO1~_WY`r~=NX`4 zP3yT~Gmz(C4*|t_lWP(Dm+~*k$!ic$ITFkS?1h`&vmBl1M#aqms{_xC^ck{&P>9<; zZSBvEJ4t)`*byoO#;B%9^JAe|O6&d0cUd=TPLjWaxl#E)H4&(dJQ*#Zy@5XFvAY7g z0q(DeO}-1XqlHE;h^~+d4O2>2!@L|Qq)kV{;0D^Tb*&fuYe1>{iN@FKSQe>sAcA)F zEorXao-^ETv&*IEvRgn=Nm0&tAUYX&+;|>6%A*%eFds%ImzQhWf~U81GW8M-WzTYN zwiSrrKnjpj_b%TBAWZ;?f|ZE%kdi%@iygoLcu!ADYiw)`CPQ>8?c2Hr4&YsiEua(2 zHAWWA8%A#i7cTH@)SLDb7c?PJQ{;(Tzr=0!*rDh@v#hl|tJUhVHO>gus*oObKTX*j zCIh^hY)K{faBlI477R~Ktqq_tM=%;e(JO|!l7M6fR_di$KhVg|26^0BjTM;o`0^E| zI)2T|`yx(RZh-Iw@VNC~;7HJV_7M$WVR|}+0MexE>Za&<4pl}M7nLt!^=Sw;jMS?a zkaZHltgx^czuJpBBtXDsui5D6c5%yhkth_;7#H*^gVx~1wvzv!%PeQRCJZ3S4L-J5 zos9q|P?4X%e6j3GWd($&L+}{SA?L*8L-$w2MMOM2J){1*2d{z$7j8wYsLk0xrLrbw zA^N-%gw6<0o)MVhjO1iq%Q3%$s{|R6>=n45_+X7gBV17SsID>pk!O?O;iC@u0E#J! zI)VnGXgLFV7jhx+tnNjA*t3l5AP28#jb}P3r9a`?i4d_z9=8(c(mGsMx0InqLZDa6 z>6n>UetqtcVkANz8dj8*Eqd{j5hNwI9LONS^I!-kA$u)yV1)7QtxNs{lT?>uF}iS) zJO=4RzVOg@{2l3!=U$sqJ$9e&E$fP#5&b)hZmIY-Xzytaq%Y!n5M&O>6>u=IO(dF! zhJm4tRZ`}OaoM0n02J!AFMQ7Z3?(WW8rQT#6)>qT+*kS-T#CTBgoN~$waIaDaT8Zy zIGmL9A_Y}{8;{2D@@7TW?t0d+>1)cr+RttH<1OuvRkDA>wkS903-`Wl4wW?mjzg56 zlA^9w_MZ;zs%^W)n41JW@d^+I9z+4WduL!UVIoe11Oq`)yq3!9Niq6Fb$qeH6}P*U zkyZFR5^3YtcK^L|svje!u3pQk#!rYJJHOG)^7T4_oLLw|5aoe*Yxxv` zSQpgcOJD?DeZFws9|=eJb#RkmpM4xwuc(yb&R{8qlhT`@l}un$(`&-tM-DA6)M4Z` z86+35L5vsS#LM5Xp9bbjQ5U~dCFy>A^MIvL2bse&`Fx0tT_o^T5FYdbl}8ZkSG9fl z{Z^Klm`dM2qw&M`qe&XY7gR?O8U}erq+v#nrm`|jVtI(1MJ3}W0au5$DaQ9ScsbB_ z?;xS@MXn;>&Yb(fS0I5%_=*#>nOf#JwGlEhGH4yIPvBe5ArR?45wTb^ez(;r))oDO zNaWxxC{*iI`_Eq)YV8o6A^4iHzY={P#-HT3okLv1VQmZ#h&ZpouQI6B3no~mDNwBV z5`fIv&n^u=m5_kah)_fek^X|IqtKIXyekdEwHfzQ?&@2akY|h5E>IS@yHG+C7N%ss z^Y6VQ;qZBo5#+J!Oo;4U)r#WU2CwV)Z*BM-XJl{0#aW=sX%KShP`5@rVSdsK!OH(t z<1t;TbZ@=<=YI{jLs$HF8>;s@px|3L0;I|=%h+=*2}TMJ4O0_4roqD+RfFb_&@Blf<{Sv& zd-(J|*&=9n)Dz){3d*J#xxl_WdGgeXB-Lnu%6zxe-@VxeBJeHIXP}6Gb;I}XK3B5a z%v}f#>o%V4K5`&MoZ5Ta)LxsjC2sa_hR-fr2QZAfls!v`R`Vr6OI@BGLlV z9f}G_iIjja2oi#H$1osD3P^WI_t4Go?|0Dq{qJ)hpX>F?ymMloz1Lo6t?TR4%E5&A zbPm8J*Of^%sONq(H0gunxT}fDLv?j_LR>s^YU7IBjdx)ANv#9$DRirS=osJ~b4ft2 z`i|}N45dT!51$AQgTBs#?0=75B6lwHzBAA~(XV&gUy9!zFV;Ha(t@-Oh#bGtk>0PO zu71m6fQ1k@Vn!)X^w@nsO<&1y9~cU z{T&?-uQy%=7r0r>>cg4{`9At4WMkmMqO95rzkivY-%$kg6|mJ_Sy3WyTm}HotK^5wOZC~iNEUj-|#RrFa7c6x7gUpfA#66 zL}25_82dz9XZ<|U!GU7i-n5Pn6KFIeq25C3!~=Jgm9M-;0uoX%7WKhOAsVoT%-F`p znTMooYnm7VD(*EGKq3rkDrqSxYtsNo5T46tpnK!zeY`i;6)7-q=?(Ydlk+ih*B7BMr8s9UP zQeQJU(vDP}$Rl$3w+Yw!ps)+1&F$@W`^VsqtyTVS9UqFU_rZUS^9!OPlWkvv&wMB3 z`#`jK_YOqYo*|X{;baE%r!_#ApQ&=1)x38z?bs=@$C>XhSNMQ(x<@erDT#@8z4?Tg z9#2q=n;5>9P~UZzp%gw_{70CaW|0Db`?%taQqfpZ} zeBk=++b$amx&Acvn1%0^6%{VzTtq|%SnsHXMiUXfXPo%Vd=Y~&fB}Tc@b}>|vv(q& zq46=SBDDij`_IIX6@rS-YUOD91!1?V&l8{<&x#V7ow~Z`utK4qy!5{n{~MM{ac=JL z@6U?+5f{3V!SGRGQ8U1S!S82FMsV^TCr?Q^d4&*YCE|llBSjS}$li?=O}Jevi8BU4 zreO_>-A8u+7RW}_XVGnF?V9%$Y9Qt4dyBddM*xC9XdO6wCaKld+I0}}cLEd>Ym7{m zOVd%LaigMQkkd_A=0gFW`0c0g+h`yU5&FG^#UPS%3%&1Uu>vVtGnSHwY>x1liDMzKb{`DS3t0%y|eGceElr$gi0(Y{caitS66Ey*&Ik^KJcqMugC*}or$aHqj0BncVL{DccGzKVk1X_8ty3UT z9f*S&>B{6JY~{l15LZQ%l+CQl*%=uh91n_$V!jG2(91(`bLG!uGe?6U&~(m&eEki} z0iUz?ys>!OpLL;VN8CR;;+Y!QSOb_65Z5N0IPafV`E7HXZKY~w0E~I~H9-9U5lsBj zCG1^UJ=nWq%F0N&;dJlbJ>Wse$OI5hB#+>5`>TA#uGX@G_>DHbY8A(%`^T@;)tiO0 zPpr)K_B&_ne@7w@A|A)3)A)_r%x&?=O+>Lj& z&rFuWDxN$cKm_#;yQ^rw^FeGSai1Z{gun#jBl$o4A#EE+m)<$^co@pIbS;kM>j!=x z6xw`d;a0YatQ>_1jfAv3_h73TJ!bVB%2?-^Os zlFkh8A4mA-t%-t1j);SnF`>rs=tZVtbld~|_xS06JAG*?gg|-#q}VyIyK{peULR%4 zB#g~WPiMPwr9(>Du4H5^d=ENo;_QMDrU=gq#c;N_Wv(R|>Ujx&i_Z5|PbOEE>Se*E z0`RAy0!_9~KuHOw#cy>a?K(?E1-E(3^PuqswhC9{p=h}50rxdP*55puEmtk+dH!@^ zVZZ>*0>AUx@Bl`KH(KU@pSa+EjP9ZZH`PT!Cl$hWH6H(U%&$rYx{BC5C|X{Y z6FOr=^8hU$zpS2?4}^3r%m zdIbTxbj9WGcP!@tufD!?tsm3v8id_Sgs&a5V%08XyMEnrW8v>+x(cBo6T0A|9y&HQ zHh^jquz^wlQ!L%_%gou#)F3}n3)hFOtk+Nei=ut8?IwxRH0zra3`@&tgi@B1TciEc zoebBdTA}VM9&|mKx~g~YHWRaFBB^9-J1mKp;>ya0JaEo3ChVr7qK+0Ahi&ZS6i?@V8+oIqNB2o?)GY~iN0A66L| zeJbB({l5>A4*?^BlKz2>u)j!~hs9PU9p&C?26O4k!je@~c+9_Uv5^7*+koQGxtHc7 zCaNH%;CqALvCdGCK-*#G^vpI4r}|Y0Igb(474)~b%7AVR#~tx`VSL2uj6L^yNcX3~ zuZn*5?|#6|+P9?cxy8jkO&))zfykj2aP!d6Zo64t!gjpB46BSqV=Zy^WO+tg2Ol&x zDhU9diWek1l*-C)fM}b5?9#`os`k5lbjKko4uL^?D0G1H@*400;}H215>}UFLcmyJ zCV;lLz&L)rWf=lB;qgCxp+#1C1TI<<+9>zW(e`WGfg~2xZr~SJxBpp^!0I)Uhb;Tv zaU`(8KoKaW^w+M{+y^vg!JW`;pik@;{<7J$=hA`94jENvv;VcfpHi;nv`}#Z)<`x$ ze4wzJ1PPl^QesMShx{KKC1Cb>=JENfWSlULZ=QaY=j5+K_pQB_#b7~4IWfA*jV#18@ZIk;nxPAI)Nfs}BZ z_gx$S?^T^wQ7G_g`->5Kh%|pyd}JL6_s3ZIdx3p+6G#4UGDd&T*pdoz>Q1$s2JrRE zHE}x>KqepOh8#F;Pj~@7Q|Zu?-exFGn$d)@`P3%UzrHSUa&B ze|F0Wb-|qtm3|KX$y;&M1g_nvKCg1-)Ze}EQ-{`dpmE&@gy4Gv%Yrm8=#;o`>fx$VI zY|W?1=A0H^8aHX8{~#dkT2eM=QinYK>*TN5<2pTI?#8_h4EA!z>~4}MILVyAz3&@# zZzY;<^EiO1hSr3P^M9{1;l>#jGIW{e}KajB)V?r6M!M)%X*MQCF%@t1=_6`_mhfl z?)T^D*^5LmN>7E{MyBUqF_%0SAKbiV?kc9)8_?fV)z`|FFZryRP1mfwSLornvxzVa zFK%&LZt%F$~c^t$as@0i6a zT>Vc+ z!-whU;vnl9HAVR_`$QJpFVzyAz`5HJbGuJm3bq9JJk$pUPJ7jLv-!sOmZ6Xu6H$KyP2^i=yE9c)mCzi|)rRA6=*BxM>+%fHJVKV41Oh;?5xQ&xH{J26+2_hc zGdiUsL;lC4JJ>(lExfa{d~T)_=K!ZA9EgSSr9-LAlK3$9#T<+DAM_-$(;OT?3o%!h?ECZ$vVxOrxWY}Hyeof9z%IwtAkSy^8vh(W z=M`O(bszYronli}w$!35vna86V;C>2DOh~@&Tj4KN_AfG{ceAeA%*r0655_fU~JtK9j}DFYvF3<|lO?sr~yMJPaJiBaRUhOM#OikRr>YQ`oR>cJ=PF8k}q6 zHaZUcdKqNc^UI?hF_muPrme1fDbmkeOvc>{IVH z77=lVX1d!(Wi!+_D#i_wW^m97?@s9vGW8d#5PU8xkSEjvLG1Y7)Y*e)bW{@!L=_-o zanFQwYhHdm*~VB!BdD4_+A~KIDEyCR_gk~lE2-aFwq^L|jEQM9tc*Sx*Z%f+;x!CU zm5aIm8I%B1*50oB#m&jB9|NSuxn|F*`^mH(dtIu;o3#b<*iY@fmY`8FWfv?Nqmoql zl}n)&6n*q?GB7b#XF5ggj{M$&)(8%ZMW_^jz!7TJ{Z}q-KZ*q?08B$zwUG>B?_0-N zgr?_Z5dBbA7HM|CIkM!?6t1I9b`PmmMr4ov9pb`2Z>S8$CN!XQgT`O^`d5}lzJ-bq z-|c}E>pM2Ow2B;i)<3>+Ek;Y$&Ra<)3r)vVu={N-(kE<-T@lOL?3%#s4Yj;1n9=0Q zZiRb6SD97apzMs|u?Qoaqrn0fw zHi%YeFO1;8txGf=BJ~6AYhVgB&fn`_(1xd{>`31Hpa^lh<1^UNNRs+dNg0-Ldi(pU~^w*(Dwx z%WJ(-gARJox{c-fnw}3{HC4bN1DGiYL3=$)+KaK6gM|>NuZRUpAuX;mDE=sm7T9eL zkDZ({(ln^3PYH3#b*5>20N&01Q(k~TG=Ra_&DlZzN}ckRNoXa|i*0^SFFI9%j*Q2s z?$toNd&21x!Tn>mXhT4c~t|`f7cBt4O@79U!xyFC;I16lN;E6!nHXhZKmB2v(53XY7-wwbC{Rz@(f zGUZ77@#S?KJH}1H`?6k>@l`stUik;Xv}2AHk-yC^SbH@-P7L(6Z&!)Nk0#`3;Nu%> z_bwh_eKu4+0J$Nc+Wd!&Xj4+>Aa5uvIt;{l_$0#1#NjR=#7%H2AsoF9nkr$NGZ{IN zwm-(Kpgt&rO72R$$W05{~&+%#^uX^G4^HtVTY?Q z$Q$Ap17)A*r#LPf5c(4yhEU6ieCeFw2Tm2V;w9oi7l_d5C?CPEB&~zWZlwWjZ9Oyj zy=0TpYCVuOdY%`yPE%FKKtQimI$Lu+9 z!MtL2N>abyN_^QHnv1E_COO&B^Dh13WA3j%tnS&75A6ZdS}Bxn=%D?V;+`^>&GA2# zt;M!dkki43G$HB0!~Ig}U#0F*O+ijBE?HpF5wtef3oK}LV9EwoyKIh8#AhjriG8d_ z|Ep&TrIyDVvb$5lSk&O_A2({G?)~g85aMp>dj?fj|52Be)#6;lW&RZL>#GrW9JZdi zij}4&E=|@+nrrs6mK;BR9OicRa4ZF=FG)j5_YdhQ*MlhNu^$EZXY~PaE%3X}+%xwb z9HLfMvtZjZ5}p#iG1xS{ti{j~=ZQuE5Ut2$*a*4o;iXDKg>w5x<)!dHuq9hvZa zl_%(h>2v?CQK23^d*cM$7CMbCiZin*;8Sf_v~7xP$_Upwyiw$NOji2i!gD*jR=PgY zA$quPQc21KRG|HSrZ9r7K2&a>>CEWt?Bpra=cJaBk}~6t@1YYyUWOb+3AH{m#WT32rZIB6&+3rXe&`Ls79+AtyTG{uE!HDr4Z}O(ip7GE z11X4_{avofCS_$Y@sgxq;x+VDkqUGz+E}}%EVsi+v2LtNhUUG-li!`T)=U@_&=Ez- zUKPuNGwT#VzRtpYIo4tK83W0W$yu&W-{CTP0y?Ik(;(-XkfgKs$BPwifUGSq?`v>8 z@;NBnChvsN7DHXVY7wJwatEY4+G`-WmE-^UMW%JLpGwLy}W->|V0Zdp&iFP&}k6z)SuoYgg->T>+?lp%23gdv5EliDom zrS(B|*)u_zdV|qD_>>+W4|UVAxN<)q_x~F>>obZd-21i!TLCzrw=866_Yvk?H6RW@ctGks_mI%9!Aa z*!J|SR+8>T@wKnW8vd%SHEWLhTpRcg_x;#W6STYP6u7zUUQ<`6!cQ#MOF?;2Ywy0* zuR(PVUlLJlruCXCzZ}=t;Pin#m2+U=hQs~T-cg?86`2e9@PU%bUU`mO#5VU?ZBJ?G z4%E#ADI}sqNf;TjK0<@O zA0U)&cQKYSl5;AwNm%DIOkK}|N2O~cfxWn*Brk2;XM*s?$4f`tl1o;ccFj)iq-z!_ zjQPN{n55;KMM1m3+sX_^*VkYATdvsO+47){HSOdUbk5hwf9~qwfC!$c&(xuHBtL0h zMKx@fP8&>qv->nH+v-&AEOV)WnAmD>XYun)=l8b8Lv3IR#d*hN<4X^thl%0ha2_~( z1qxVUd+x#ymt(xKAlg4RGGd*25E>q!bc;wcjeUkcdQnN|zGI8S1Xfk+aLr{MBiV7C z{C%P|=EUE3N)}+p3bglWu2<2ZVNE7S55KaH85EQhgJry8CLlJ)%jMbet8~{D-OaZ- zrk`|CTTqB$ITBge30frvFJHc0S($-NkrD(p1hzAFB(zT9NlB>$VV?chO6Z&cb9w;( zEMjh-KZQC=S#>TSKKzkh9{qhkkughK zTeo4K#UxoB^%A=h7_**n_0b?bVPQ6fNj0p6TsQ*=!vufS;Ip}yUH-l2ItSNu6W6(A z>#t%5AC1qKl(=t>MS+kG;Tj#Y>P}4qkWHV~vzxUIp;W81Cd%tIhW(^FKRe%-m zJZf;APK_rm^Kxf*j`9p1_wM78ctmk|T_a}X{SgDcnYKa>L%T)=WCwP<^YiO1b!@5$ zIs`VY1YsYKx_ii4r=vr|S_c=t-ku(XA=sQx&Vm~nBcpM8x(sZ=-=dYOX_2Nq*VNOX zZ6^=va-4Hnf5*(@A!yM9ofUv!0DGxS3=fzDw)W~YH9X9>y`4`dAREu6$S>pnOou%a z)_+{HM2xyK*Q^J~+x1+%ecQY}CCwy>D8=^;vFenKK`{O4eFYpQGGw)vVld*@n3z)9 z)P#kF_e0gaBo60^=p;USa~M^!pa;Qk3GYjI87`S8vAW-1R{$-mugn#V%--esmVl4M z8l39OYwK<)90l_HGN;F$o5J{NoG5egWQYqcQ!`WK$r5N)W;v; zaHC|O3-B-ZP1c2&JU2Io|Kla~A(-*=0j6s_%$uX^?C->e>-v;eI^r)E}^6&Vjj4cq4_vg!D!{25XKR`b;^kluqv=#c*adu}!^kKl}du$zM zyY9-!tijs?3Op89PHG#eodH*=m~88w+$1L_hl~44jtF6)$Dk<&3y?4eGjqwTM#umX z+v)wlJTKF3F5}OiW_p2t7bfLGBY7;q0-*+OOr~j-Xw9*RNK?3)EA}PO#x>_p@1;vr zMpZwmtVoj=NnJ!)ErnApWl!Bc`LX=>XZ!XHSzq}!TWI~|W@o!BRD6bg2rrf}V$Ye} z3TP_WvuJA%G$ zeJLWGBx3erYb61`lJqCuuEs{h*a0+3Y{)l0%e2m{BK}8?%Ss|59^S9LmYv{_M8tnq z>#Q!^&|xnt7pW}4HQHEPLrf?a8EF!3!u|gI=0wxK#ievBO$Cw#j`8tgD(#IM{QQz| zyq&gwT5nyXR?AINcDhGanP18*o{Phx9cM=7BeZS3Gd2iBD>G|(Iw0ZNyYR!c?(&$-pb8fP7H zGB4}E`}$MSMuUa0G5nshH7FNhWokLz`9654G+)z(Bsi%+_C1(j6 z!p%)+tS8%XIY!5=Tf-PR6A2HO#$Z`AuB>Fc*p}aId+t5F2=&#Cp@U?LCub){2S7D8 zPo+|(wc(c;XeP!tnSnC4+z8xUUg^rpfq2w*3+~l|3~rVl4pH9%5vb$Hb^}ujT3T8Q z*l{<{-&la+TkdB|!VC$WkZ}*ku~Q$5&HH8kci73*`?AX{E+q3nRD?qZ+0h;lj8!X1 zy^W}I(Q$TRJ-_-|D!N=kybsfTWLHRrB)}l*w*F`&7ahpl$W^>NRNWL^a@(xu1{e(y z6e45aLCRFzSY18AO}hhPlHhxvf^2z_IdHV^O7BnBukQ#qRTUHa79JjTLhtY~FD*>u za|;W-@Bi(7CS;QN*MIKpyo%r$Y(ml|61je@zI7k(!fpEk>l1SPQmj-X`a7@2WjVcGxIZZh+Yn!SE|!=uN%;8srcn>RLf2hAA;7ZrBKv`{UX zyPSDBZElnujc*ex#YcznvPeGV(A|CK^XCL?32AZ~c=U4c@`53yJYO^{HuzjQTUaVu zN#q-$TfS~^2@s{Lt7|d})nxK@aJ&cq_5ME1x;#@b9lLuMPw&@^aqcziEo+$(eB?k+ zSUE77wiu^8G`Cq>nQQfUg9fBuv0KG9L)K(plW;>rlwa(^K7iW1Xk}cJ&T&EOd8@|` zkF2cJzt$@#v;==pFkgi(yy{qm1w-cCHUBCW!NsTFL;I20&xbQEkZup9zmu#841H${ zi}eam=l$GV`C*bBXmC1VgureSOhy|T=EfP*RHXKI+|Bc)+!lC+IdZFGT8IC|ajx&V z#_{ahr?kpk;<4Bm`+J9Y>I*5Ut=&?+59d3B25*8O=d_|$*KWr4WBLmMwg% zgYT{;OvUn8pVNu-{BPy` z$Z7(SHGMy_s%_Df`Ab}--Cvd5+#vFW(bNF{@4ad|N$HOu-|HQ#G?DyCv0@DPu?KhiJ#{(`6$X;++ zTy0vP7uI&^h5=v4X<98;mzQZNoph7xSkoRjz2$R%p@JP$?%JM!KG#e~gK29bSVnoI zWI_Z3vyuxORmORxB{TqAH~!f>7?*BsZ_mTQQKI}3{Ws-^MTN0yK*h*0)&q-hXl~B@ z`zb26*YEDjy~qA@M+mv9*w~c9>rbPGN2kAkcae&6GOse}C$6c) zXve>G18><&Ru)a|gBYyQ0CU|&HjalvXMAj`Cqc13N*EGFczgabX)oXVPbUXvS9p;~ zlu`oqlDMzRv7^*Z>+^`E2y8G9D1B|I{i`}V*SU{?@mB5B)Y!}&h>{*CunDqi~q>MYndEl zM0?R)jMLOCBu|9(FfrV(ZfMSo%A#^th6UuQg^dB~04^wqye=*bJh~-aTv~!<15^pY zyY22vy30-&yvh+biFkQ2fY}L&k_aojK}(jNua((}lS`zhI6vO3oNPW+V6OG-`=Nik ztX*-W>HsliX;9=tf4a-44^a`H&N@F76FB6Q8lB(*zP5e+nqog{o3-ay?14$`)P`e4 zS%$kS!b{~~cGtq;%77gI5jmgi9BbgXfX;(RI9nPa^(L~F8#>mPj>w33190RJ>P3iB z+75sIR9~X`pMa)_R&%LirQ@PQS-Mn!iu5%_hI2bS&^B8dHy2-xy!_dB&}y!Lr)LPF#*Kb5~JMA-_nbXLCsMcId#xH@AJ^@uA&XZmU^jXX@1A&tnnF zv)^0P)k8Dm$*3>IEBv}`$zj(#%>q^Ex%62iBzT^t=~$mHafaL^nI$4Z4Xn{|eMS29 zVg3Y-NTT+(FN6I=p<)@GzW0rcjK1c$xw%28SH1)=Z!9->H1A9$(fasw)|G)cm(Z0z zkqHS!UvFRJvw1rC`+{n^*vDy+zX3^PwG-9=jIXpTR>*OQ8LZ0zuZVs1YNzk@dyKgB zXi5>9dzPAWrxx!?moeyae?lmjUHjy@Ao9#fD6g>>CgzdcQGa4VPrAO-{Qn)D}kJZO%%6{HMvQ2W~;`9vYd zty_x#;d^^NS-w4LcnxsqWyfCX%9>dSeSbrLbn3zgWrK6VkL(8{xDpo= z(ZxWC)4Odo8YD4zjMz2&5?jzc!VZrP3CRUXkhPi4>ozT-n?bf@rCsZ zZP--rjcGx@qZy5~>gQdg*Ld&SI=11im*f^jbf$~b+O8QVK^~Q;p7pd<$31#$Hs^ya zRz$ksS*`4yJ4Lbriyr$!e;cYvGBPOVV5KM|`AO)Ro0~s>{w>LnbrW+1Qh-oPYwHL; z+h>lwivaj>>b~8cpSj*r|N0n$OT#0=8pn7;j{n~ERwIZ2S{%324Gj#a$i1VZr57Ws z?rj-=UMr@yd@QE9O4~-FKrdLFzv(hh3}TJseAXHa>-4pjNf~cxpV==1ujixr>Q7e z+WosGJ9i8rg+kIdKfgyD9IP38ag@C7LeDzWD>)2hMuU(tTh6GRgh+{4{D@mZBlTZ= zv+w2W*Vj~4ld?0`7m^E%TVH8odZL)h0bm6&w@+VX{&gDLNMKvDu?6r&n}b1MFg?a< zZB`#ted)uf-BrXc_P>JVu3}(7;Y1UqqLDUuB&m6NR_oxqlk5ljBHq8Ri4kPLuXY;4 z;-X*p?N0%FY!J`+?B0>v2rl(@beOq7m-A#V8fD@6dtMdb9_cVbcv4UMno zV{K=umyd>C) z;g7y4pF_)MGdx=Bn}OlhN*ZDP3ZGs0SzWl~c=Bx(@DY-cDPTgne5kXRE@_Vy!JnGs zgXL7dX=m>2jNa3;p!CngfruC&j|f+Z-7dcT&^bDXCr>5bnqW^3Wb4noJxv2*fXObv z2r1I7q*6@u>w+%DP(>hieIU-;`*B|Ofy56nHVK)RWnqk|VGr~07IHC7e>*nr_7DFR&JSgy7i=MwIUcS z&DxJ&5x6~MRz(lkvvF{#i`j&&@ezZm!O&3}XIvcJX%GH2?4F>oX~!w3?Ya0S z5qLx~^!?5IPoD&!C|0CJYIEc%#LUjl77V(nih;0}+w$yCg=cF^%c>IwTt(rPtDBk( z|9n@QX!82@ILmUP(G#@$z$O*<^4L7>&Dbaz!$dp2SeGTM7I85{^HjStJEDfV8Y}S! zh}zVkX|+6_cKqZLt~Dumzr@5WY#bXpiqWPcBZIozVL9Z@n>R^G3`dZ+9y?1-4QWaY z-1p74fa<^Vv#7P=kwP2BZ@QxK|Jz1N@593laI2>jC}H@Mt#FcrGqgCgdP?r*B5#F&xaX27vnuI4oGe z*xDOazSX*Q>qL|A-d`AJ4k|Qc{wF|kzq;DlA*6+~s;P;clT*oG6JD1~8Qglk3rjkg zx5MlQ9P3^m7;kb1m9>Wdopffla2eKhn*``|n;^P()YC#lM5HN3kcEXMr2E^qZ_24E zzV{(%X4g6?WIJsG>T}ITr%rtvjF+^Jp0A3MZTxfxE=1iOgF->DPSHkC5Cfp8JN!)P zC~juOjt*|PpOUiC@9F6YO3+SI3NPSFHOLtU)BE$=80m1*T)LEH+L;ara~`;>50>p3 zHpQGiabkIC$*46^dVRkC9Xc4mL>CIU-NqN4?zZaz`a;m@{8l=6nujNxA?Ca=NEv`Z z%g)wJ8GuCF_3X~#U#us>KsjQvCoeBNTw@bk?ZKF5%2QWci-#7E-}&af@opO09hRvf zRey3WrC;?AI@S1+!RVkuXyb|HvuAyQ!ublY+spxq&~YnDQA~oOj2qy17*UW5hpcYJ z3F9p$ArYpIKt&+){#61xupW^qvgiQd82+C6)pqiUp`o6kVSGnFoaD$8o5*W5I=PK= ze-HMGE>1fegQ#rd)^VUh!d-&K&HA_MVe!mNOOh??Kb={pZgiwg3zXshj>cn6A+-D zV=$MlRl;vSUufJ)soz~2oDDD~5DJC2CT;YuUAs2ASdC`E+rk~-ooYIFYCfBqTw}%g zq28y)#?4swaQtq`mn5CRyqSf3GiOL-92bU8klmujl-L-zCrHgee@gxF$H9s}B0sfC z!nObaciYfi_Pap3GT)!I5zB|9U~+gs3b z_#Rq_*6jH=Cb#t;KTJ`>)6<%Z@r3b)5vTM8`}YxlHPllxGeNf64i1s3A&bZUn9 z7g_WGOfLl)6&2N36R1mFgh2y=+Mlw$Maw)1#q2jT@q+88vU79$uzO&Hb<7T=)%5f@ z^s4m4nc)UAk691sk@&J{@xg}-z+WNj&NZ$te|czkcNej#tZr}Tx^*iHJ_W=X!r6|{ z@!32U1H&-U&h+RgZZoIqK>)0y08}Eq)W^@tIs*3q0AUdVt(dw{4b}8M6J6bb6lIX| zbgz7i_ov?6+@8U0u!$6be}@TYB$V{Oe@}+%;D5BYZ^AwRJ1RJVXVD~Xl%+otsBaZ) z?2)*2Pu-J0D|Y}+9O|2~rs_Sm&>6{r1+X_BWedkH$tg~P9|=)AG;qpKr>Cbwb2lg` zh>&O?8KeccXNF2bHj#V|AQ(6js9?9=dhl`(dBY66{$LqJqW3@YRbI!3>w`C_md9NI zD7cE!Dz@RK_P3sJJ4->a+G|mA^wgwIu0v1mS5Yq#m2@w#LHtQYoNqB`xi(t_|H*#3 zt+}bGsj^a(aRG1^TeJ|ym%F&I5QG#xA|mn~Ug}6lRJ9}wGPS#c-Evu8UY_^LY`5M( zX%ln`;a(`a=-X3ktGh|h=3gGG3ZUUpiEs9<8LC(p+8k{~S?z3CCX_dU>_@jD+RoZ~ zb!|b%0k!_LjU7;R747*zl|W%BF&pwfIyn3!)v`Ko$! zsJF_O%j^uINb|vf(+Rsh{|I9LSpM^F(3PKMKwr$*PpA|jdEbLWbw53U-+*&YeUwEb zSd{}wH7= z))g-qNWs29!~4QRq465(<;#}=0Rg~_MXWoB)$^Z!)`UfC0zisw{@!^8`_xib?gU-Y#%Bp)R785zreS`_OB|7jfDDbqZ&#wXv4vc zXVHJSl60P7lg^maZObRImcL^!iCZ)#XMV5pKlI4vp8!mo3~b{%ae3oU_mWz<%rEBJ zh0{U(I-l}$xszGH4?(oj*{r%$Cn3?%`c?Fo6B^kL&owzo8 z^4h+98U6Al1OP{3s(ablaI{zhJ_X$bz2Y z``D9S+R+fpH`kh+*OrC6?xVx5Q=<3tuA75k*eeElM2p}Njaur|F$JNfM~}X{t_#w` z!g{NmI{xndix*uVZ#DUNr=~9Fo9Xz}bmvrn(h3X8zQ29SlQf1Rh|4tJb>q)jvIt&F z@0Ku=+7IZm9V_L*?c4=#6N&lZOZ)bmVOP+-~ZzW6lR z8(O{$c)SzY1%Zu47|LOt?^^bPKr5j~Ij^~Z+|pH4G@pM%ef>H3wr=D>Go2jHD<5y5 zfJ0<9h|dFYEU^IU)m$)Vq{wwx>_uf;PgI0!Z#@>f8n=<#lC11EUKw>qrhi-9o9Cg1-lpW#MAFl@)s={J*_13(1AA(CQ|T&9`NyPZ*1(2;x)tW6dKM|kP_Kr3o#DrwMcptQHU z8(7QohmP7%1c6){w2)>;N1t#y!A;toiM?Ob-f)nDO6)}r14v?{ptE*cE!W83`w`mh zFG0i=PUszAhJ!lVtV&K zKq8QAntZVOGdU^u6tXdSF}PV`?*6KzWSf?1<2t>zG8?quq#hL&7DB(_XI0gpK}l$+ z@}ewUG!@#l8EA~gGNQLOH-Sk|Q4x;2{P>8Pni{uhM{H>ctnbE{ez>_gec;ge#5m>X zD5%JfGrGesOjN*i0GG|WnmwIS3Q9_)#?F@}bEz3_rH(*Hl8bMK3X9KLimbM&Ugava z`Pa;wI%4zFy$Pw}txl_-LMq_OnzWP@6&W$Hwf?i|wjdN_Mqgb_EG$y{d_8pjaRL0= zQtd}N z$7QEIZW=_sM~8>M_>t2NkB`UswPjeyNknp=R+0$e6C^WkO?==J6hNy1J&PN6LW4?h z^8;TVcz8QF4J0>G-->g8`t*Z0#1*Eides9!d{x<*KgU1<`=`V2;T!!EiCu%n@ zQ0TPEj#~QT)wDX*D*yHVuLkLw`e3(REBvm`cfM;J95dTEp3V#$zrzbUfWY=x`S{#+ zx1vGP!R{Y0l)?`AqC4P1xr8T5N8k*ZXNAa1P)`)mm$;TsD3_RXC9 zJxqJ($A_{_XUHV0_Z+CKpkDFr>h6CKe-pOs7>b=;Hfg()|1r4kfUnHwkj{Av0G-nw z+Uh|1KcKd2pw^+Rnp}6ac8e)a2hiBd`sfD=EM?$j0I|3(QHtr8 z^5Zla%~(0a630o-YQ8k8dtKt~=^2e3MM&+=Ru>oYhMfm+lJQncuJM!B#FsxM!C0`b z*mh+2D)4e<+rH{A27!BPE!O{hbHY z-rr+0(~-CVB>}C|>Q<-T0}GNJm{TdgM;~u)tm*nm;Lcu!;_AAD(~41NykyDnRj4d~ zW7gN|YHCiMEMB}SGkFbvWuT{L zY24ilcDcteG|us#J7>hN!M(8u!Sp;$&@zIXo2fxiJ;h2e;p*@EQl`y!W$CA?+@-+U zK7SsUmzNN)cV}SpZ;&9eeV>%%Wd%ugXQ^Y(u;P^~pX-Rn3c6#!b6tP|Y9*bgObiSK zv-Yz0?=LJZF;UA(OG6?{PG(_|p@CyFhUtXfvaV+Y2bx8m%^~Oe_iVaTZA8#P*2dk@ zt18sS@ELJNwqobWgLVW??xcj5&f1VQt91c6kjt+{AhTw=ozCm+JSakxK~upSIwQB; zc8DR3r4`&VPxz@rd&_#<6B>uWBfx9Cc(D;cdknA+L&Iw99xTH`+B9(WF%e^2@b&X! zvF&(r6ILYn%Bwgc6=DzE;|7L!=i4{pQKPwV)7`SKkm`}ue|f{x`T6;WG=d51T0x-B z`TFhKclSZf$UMijIw1Ptb#3_fP%@4jnlwZX2){hPIy0F3xC`Sf>!TOy>*3+ivK9(A zf#t=h!MeP(n4OhXOKfSG_?-k~FXE#sQyluj7n1W&5)*S#OUucXmpW$PS6U50<)zJt z6ZO=<{3^=v4mqTtM>dO4N5q9`V_)_4ndjn&PcET3CN6-ci!T)bp~?wPt0n;9F_JDG zONo*d-fe^fWwz_Xt~xURX9@E!K(+wgxH``hKt@Ut0HVG~Lykd1zHVjAjqR<;$-`s- z;UY z8QK^ol(Dh#Oy{0}JN_UU2y&Fpqzly@Bqk=7m6avyE?y1Ss}2C4SzxzZzkWT`X&nZq zF`D0}W@&5?H|P%6%i(#lhd(40#-i-B2ry&*td1`hi}s%FSuOc+lbPAMJKMs3Zc7U} zqL!AHLi8_Png=@4D9CHMHPqA;w&E_v3i(U4#)-%4*AHl94SPa_CPync{b;VpP_J#m zq-##HOx`(qZl``=UKX2duV4#E@&;ASVRZsIuTp-{)A_CNWo1 z$EJgqgSNJ|yu5ruBPGQ~o|#5KI0B(gCl(f_g2}JGPDZD5*;>!a*6L~cBIgo2=|cxy zr2n^y%nuzS=_;`wjNmX-P1nq`8e@`_tOgrJ{pnf;^b1Q%#xe)^>f3O4#PT~xI{=xA zY0G9~;WIHM%cBPm9Ov?QLV_eOMQ}f>aZMQ5{o}=e7IcQI)MNejgH&V?MiZ{b=H;z| z5@n}J{bJuV%nR~AaBx_EfBgVTLbz)C(~#$R7w^*_FUY1K%ENnzKZCjpSZrvg>5A;Z zgK&|i-8%A)^>FN6!H3bxPCv#b6c8|`U8ALfG_;|rYC1l!ObzQ+4SNw9u~x2-wgc{k zD_stO)~3eR;9l7IQ`#W91csk5FeXIME7*hHrbT;269_W^>Leggy5B?*fG#0aUv-%a zM*4_~9~trf~303H|>UAG5-ix~`v zcm1~i!IV%PcP*FHX(6&(90im?0#F<>INsrLyJ)i@s_zUe4Jx)zTn4``=Xoj>kB;W{ zm+UdIuz-!3T(Md2ns(X6#WuxrP*4#1sUFlGByQzcI86^7dnja{=?w_n5-mv z5RmsigY)+OBN8!bQ@l7*?N28>4}N6ePBuSp{*!-+0(2cbqxtPYei;-=pmD*c#c09b zJY{o^UI1jsy$cI@X=rGus3zj{Vec`@Z!@5v1Y|GU_zrw&08H2w9G0^HW$G%nZEfI* zvj{=gEo~?+XF7%dD@lvxw*O7&dyFBPk(^R zCp5am`(Gxbz|1{Gjp$(m?Okc4wuX`R>khp=++{T2p)F2kF}Y>jpL^Qzu-}q2(}; zv)ynuvx4JR6YFLO+>qwUG{9lM0DuD3!$6#PWsG1i!CsVz>kz;o$gmQcSEUL%UN_I5 z0t8d}DiZTp*H=4D=jP0+{fbJ4C85iJ62<~+yCV@HCK4W7Z^$=ta+c>hff;Op+jFDA zpN_hnH+rmMqiL+rK%2+JHE^=wz_Wh z=X*OAU%a>6q_ezmV^gOxGF>WM1Q&7t zf-J%;zU6A}u`=x>Cr_4X zma2%Y(Fs^G@|NC>{k)_X77`rXt5@E}d_^90JJw=i!cfL&FwsXM-shdnX_nK}m^e-}JVUfI{)_c=qRK?M+AJ0$m5=sYzx zl9(L($^!gnAXXv?%vh8~2i$XkX!sX?4Tgro2335s!!}Sc&r(vV?039A{P=N=4DwR8 z?JyAFXvxq~4erAL$__x`?f;H%A~FaEFJG=6Iy3{Ve&}L}M0D|Oho*WC;@mIFGtG#N zdU5qKarCgdF851ZuPkgn#FM_ck*-a9@#5_4oS7%}W`mP{PmQj5|@%=p%bYaO`C2GKTvw8G=uJhTK*A%;&9!x4q{p+o={BiLk?E!iZ0f7UUe7rdx z;Z*Nj6%sNA{yA8DuddnsoyxPwR6f<$2SS1k+;4DqcTXtK078-SB_O-RR>3`!#T6U4 z*3Gyb24(Zd>3L`h_WxJE5+UB|b_1odaP27e;`8X;^tW_1_ZdxJ4yq1*V=va;nS0x* z?b7w@*EgflzRmYzsrm0}u9BYKoA+XMr{zy=H&N#_{hgx`RpMlO1DCA;1MmK4)e-g7 z!eViR-}1TUaHK82*ywIIhqjxw z+cTxUfkW==(*yZN6$$l!aPGNEVj;p5G~75xjnO~HynbyDE^~9M=;vf^X222~fpMePF z1=z^-nMfu`cw#%O7L1rsUwy)ttTOf{hR2u-n68^N3EdGYACwde%jmO8{h5K~94pB% z#BSDc+VfD6sV&XDB^BCS3kat;QRXs&;afj7xrTmeDBv7lY|)lkmRja&u}GCsVALTZ zrtLIhouH6)A0}c)+;nT@`QB#V1cN_T_QEHuQNvVD1*)agc!-8wR(Y+bx3_F@sf|ZF zhPv&ytXNNh@lsX2V(5Z63Z)l1E#&OnE559~Ikio?y*icrNbuG!-dsz)pXr6d$}O_2 zTw9I;JA6|HNwR`4gY*;;)D&P_?`pbb^*J7{sS;-1$3n&>0QS zu?P3DM_(>8PIt|zg0C)%=2Ectqf74Sq9XHOH3v{j4fZsxtx{i42^3rW)X0!V-&~7P z%Xq}^{ya^Adc9*?N3!}_Uq$vX+tERXzWj>L<+Yc40zeeL|4B&y$24vL>n^qjoJOmm z0*lDQN4#s6GaBm~8yU;oI+$DS%(ZWh1Z{`2xh!|#De8vSqP@hvi02&5(Q*AE+q8xn z9-HFZZkIH`Zru;AI)G~VD!SaAA=HxmIcq~c)xGEQ%De`CRipJ1wUEnww7;oPK7z>p ztamGuHh`{0d&c%0mNWJwK#$L$1qnCK?7&m?*Jn`%xZa0O{{VwfcnJCh*QZvuc6N3k zcTqqZZ2)rv+2Jd~NIDY)RC7@B*nu|NyLao0i#Kc2JUuH99bBQm^Y5ZHQS956X_jc$ z9?H^5mKmRWN#%~M)p1m zsU($^Eqlw}qlE0e_uhLP9OHjKM|%7HpHH9H=dI&B>;B%~dtCQ*tx8p(`U^4R<)Kt- z?^8lTDEoufa?KnE8>@H~})DQ+hj-i%*Qh(3!NH60vv)S)x|AC^}O!Siy;NTeaexc_;ZG-|5bbJVmMq z)tS$BZ$4U^%7n85`IHVq{hprQMxaR!X%=W23G620CY0{&=KOlPNDhVmeFTL_b37$Z zoYkL>uAQCV@`IaLIMngu`mJ%F_nVH+P!ok&DQyh^SGGKVPAqOV)1e+@%x)L-cXN+h zQ&lxq`Y0``m*sYu92z#hKg%0$(JeRZF)m{4rW!6spqD0FzvaEnG;I0RS9gt{Mt^Eq ze5CSJ{!V{AWgr6?&9f&YssPMQP*pAP8@K8qFIgeG=R0oSuWnpk*^_PTFv9%piIMWr zK7)d$L6WdfJ~kYioH@B9Tnf5p9*Wh#)|Hl-DTU{uOc@y9yBoK&8r9f4D|;qhchUl% z>nOd8hsQ{~j6WdWmjG>(7*c)&lox?+fU?Lvm7YCwa_Ho5*m8WNmf{oDJjn7QuUg`|ySzR{Z^c;dzAghQx z83$#$qy9&?_cAV7&+@3YdZfzM*RNmx5~7xF01)<_io@64dtRizH4agsn>$@8?!>{! zSJ6{5ml!?c6AzBoEKzOg8AkY5TdK;n=)?21K6F*C}IvUIo! zig{*YLO-)4`E8ZvF2Tx<`vC=-M?*6+_7MKCv9W1rXzWkk0UGt?@Gt*Fht4b=n^k!j@60RDn}E3= z<>WYUfenFRPp81_D5P(IXu1bj`TdR6WvTXT__=*(I5Jm6hXvvKLNWx%CR$o`hLNp} z4QTtH!|oDW&~G9UILL!>!mSqdSrzXO3+?`{DFVz9#IWx^yoW;gbNsr!4Yy(HNOv^x zX9&^p3BwBOHqFPK5>+$xNo0R$&l@wR7HxcAe$?VqIZ#zwOV4jVq&Yc@E|yN|$C=jbI|c~cT!lRz#1hnr0u>u1P6xz#jGw4iDY3L&_m?&+e+vj;V1qIIY#$jScs4 zQQJFoPYzR?6!XaiD5q`t53Bekclv}n6@CAH^D^uDP-VYzhOztG4^;iBuzOj5PjZc= zrq(qvVYn=iGSD>NPM{2VAe_;q$h zy%a3NtMKsuDW9}87HO?Z>RG~L|06Mj?3_kCdg<#*`-ihVHMvPg$jB-kc}WQ=FulH? z;_jhB$vK9~&z?+AH@p7}%43NQ8k9WaU0{7oyq;M(IpSh9xo3E943@`IZ>KI)hh$`B z$urv#1j}nqhra4--&qs@82PXZcfiAkO_le56;yqy7CS2I3LOk^96&GR?dxl#tsQR_ z%sVkVYYHuR$e|A7o;J|E+qVqP(SoNBrjgpPAXsuQ*c9lH{jxU!JLr5S5DPu1?knnV zjlTjIzJ%R&Ad-R+6*(02$Mz5B>8jW&qB9Ra+zt*3QFhqwe790vj*A{po36kYAw2gP z*5rWIo)Wua;n6UF+(s>-LwE|S2O463^|LY;D0%3d-tAuLgTJP`v-Q50E3Pt{cqaBS zd4dDaXn*K+g5=rmyy!1dc{R0_l{;&d*5FC1$&=+Vdt`fdJW;I1I_nJu<36#X)3vq6 z_0MD4NCm2UYK)o+6;}DFE}tD-Fo!Iw3~!Ix9!*7R8NlVVjrV5d0^WJk;@V3#A}bEr zj}0?mzRWx(Pg~iz=SOdnDzBnpG-c?cn(Ry`ZFxWWK>5%X_9X`iVLY8rhu*jxu6~B+ zgvym{FlM;vfIm+420i0dls~$%({Fdc26zoQdCjF zU{Yn}+Fad^YJAv4Kb(p8B+)f@U3@rinbWh3)3&^Pf{bNX+R9CAb<6b=5sQ-i{lxG3 zEvd)=EdNfu!1f*rUWXv1@ggqs-N+`G?QYLOXi&*L8IeV$3T#>$BKKYUoG@7u^}4!Y z7x;4hXC`#C$JXcj%Gc0;U!@K4^Dui!T?Z-0Z@(NYe7|9s(#@6AykpJgzpk#9V{k<^ zcppTg>dnWVUH~N#JQ^L3s@}(oP{5!ol2u2->D1Y>Ojl6{P=F%$Kzf$ z1i0CLggi%5K~}c=o6C=?q44lhxx{{BKl75U_a6kI%RMFPfmXc~jq1r$?1E_)-NnL()Q6mC3 zdRKJnx6L0s`2Lq53-H)tPZfovJ1ES(976KYS4d7emAzT*&Y1HaCpT<^gfNAgV|DAv zJ&Lb%4E31-C=#J4g5dEA_EI^hih73(CcMIBQOPoJ>3Sh9E~k}K8dS8m>rcikyR()` ztmO_*tTb_>ngEB-M?IAc5$_UnS{qi^08XHu0{BP1zA=CFTu(>W!VW;fKu{{*X%e8N zsGYU&nT3NEFwWv5eHW^;KVy?7M+1lrwR3FpB2_d z+3Bu~m3&K&uK9Z&)in&;%Qe)-MV3AhlR)o@T*~)Bd{y$32zJ}}yTfKTg|SWJ8rosG z%391X>BYy(@b~)%%Q>M#lAk|+Q@ffe{T_VDpb@M9=H#KHCC<(`Arh6Zsp0(8fDyH;_Tkpa zXsg=Xc2F@hi-7g3GaeO{X})vk;N&>{2`h_Afu(N)tDA{=$*PQ(B(l~MA_W@Agsxgr zQuL+d%w7zyiir5>PPnjFPBx?E9;cwJyuQ{kBPLd(~VsaW$EkUh*?%Xt8XY z{cny63^oJJ2&68KC!NSxmYyTdaF8%Poe{RV)5jWbb5j!&b6e=KIasf}NB9yu`u=q( ziOz$Q68;T9I!55AuCDndWW-Hk)-HA0;j@OIUdQJQU|gpMc6m!XJLMU*PYetUsHtc) z;4^`*xL?1&5N*jbXOyFcr8>t^e|uCQT-~lH^e7UW($X<9k^+mp2ru_u=W}nUO4O{G zhuP{(zdeJi`j3+!V_VH<;7iGfOT3f0bhL}9KPG~mcczq;=6>umFZ?6Cm^#+dmeqv; z$KCCKCr^gb@5xI0{DM7+l6Sp^;1!v2k==?(NdT4oiwKdCeG1b3>p0D_aqaqbXiE9} z`xkIQL8CMhh#Ranmyd2+avr=BXVK-UTLz&-{MXuX^C~-je_W!+Zx>KdFeL1-VqFcr z1V-30pEps#kUCoStf@93(XijiUdhhR{md0SESJ2qwdN1PIDhrjhMJm;o;m;R1cZ9n z^c~hLqN1*j#fGeH_PXib0DdjFCMM4*a{x)e zarU1v8RF3+JI%Js>8Iu>-F=>>>_4Yy#dstsFVUQ&kK6&PQcjry@wK3 zgO?QC+ElY#hdOVP`NX+>f29omY7NoMe3quVb-f-C(Exl_LUxS}Yp%Xk|2*>nOS9Vo zB@d2$YtdKZV`pQ#el0r01Mr!D4!tYvhrT&h6itjIa;uoGPBxs>n#eR>pHA-^5Kvc` zc>CbNg2g6ry1DcCEuGr8%gYGQgb!szb8~c}POXiw)zQLA6%)r{)7w-|8^&EU@U4qF z$Tc<3tes}uP%Hf9g*8tUG!!G+z&L|_&Ivf!2!t@#m)}dxjnF7@ayU+r~P532Cuwn^WUTOo%8IxRJ1si*|I_(L&?YMd~)x8+H_TWa#R4(a_7u z1_QeK=6a7fG3|$U9v)coMI4ig*VIzT*dk&cflVt38p)+Ft8<-Kyxi z>jR3_r!QEkMUJ!h1O=5CcF=T@7yu~Hviv>Q*1EVq@}NBD%kH(cmlf-eP4&ic?{T4mj^{`_wX;R5OV8cm_~Zs4JkR`LSC6?dtXT0QwAe_G~H)E zdwHm=Vekj9nswh;Uf$7I$uMs))6Es%i3Wx06hVe;hfOs6JqQK0RaS~(2`3AwQF%D* zFc7UEC)f2NTg=IK-&R52aT==jX+4znr~LgDWaZ?pUn|eE(bLh9cyxlg7=cG%k8tVx zLLJ2;{ZPzhNShxhm^XY&iM|#RNETZ`kWe8GJ82ZTJ@!H$;*+H z6Q|pL6Fez1$Wn9KbWK*Vt|7QtCpvDmgmW?H1ZKQ>L7P-2UG>oJ**GkAi z)DL*vy}d`)vEh}hl+?uw7gCxwxY=e+TS1F(gWoYf&t|ekQgWvy>`m^**@NqJ&Sq@C z88`8j%WaYArqP|uDd8^e(8MjFrFvf(gM@lKQF>gHJy~KR`hsJ6cVE3a1o&M+A)&Xk zL>v}8Mi2|uhk&Y8c$OVzPSVg|7HG||`a3w8B(Ts=>)ZTT7{2C2>s?iZV2-HhZ{8Gq zVj)2QxskwPsgX!zqW^*?IY*{phb)-}*!}*|SaHoNKLr!#?@BcOeBff|ViJ*Mx(A)K%>HkDyLob#+_nq_4%c? zkAcgd&%a^pv14>c?(J#B!t0#}=9r-3Tk4YBsi z+xSAJ;ebx7R5y^`+WAJVtFezNMico}8rs*K;g-)7>g*!+gzcINY@F zlfArKrKO+RkzB8`Cj}@}UfB?cQ07(v#GcoVedV(#?U5rJHCTBail4CFj|o2kJs3v~ zjz4l~Xc4#&n+Wgg86nj5zi($+&QSSF*1o)LpyqJ=;H}^|#j0A_FQlDxbl?!qE3i%q z)=XvgR=cY7Y@LNyf&XbL9igYbz-Xw6P{bE)vO~sgv68CV+I^5gr{8P6ZJ+&Oq(TEy z1z^BUvE5no0u&YKgMP(Q%x5xzv3NpR=yWf_zU2mDFX9_YR&eH2kYAn8eO_@r%wb}* zu+2d1!CT9v#@gCoA0I2`;=i>+oIQz-rNG@Br`g2gJSwJIJrl(Ak9y__D}uSxIG?Xw z$@)0`Kn+bpERXl5qKf%&Z?gGBoNj27^^6}a?|sh(evDIlQU^p7V99M8i)E=s*QF>Me5QkxVfu%!fV+Hw**2b;5>NN&O-^Zd(wa%cpaPlh8znva9nM?Qc;rpZ z$HSw?jxTwKgg1YpDZ2Qv`@@HO>Gv9W6qB>P_?0=VW`7e&DWIXtYX`p+BPRgoRmE~9lMOPL$}uF+Yr z{_c6t07$|6QjXD*RWD~d-lD-YP6%yeE}&3*D*jsrhqXlyu>xZ(8CjUGT9Z~^f%Qdh zvvA;&r+nQ$ZY= zn3$jn@x}O40UP4d{CZ2S-mA^DcRm|K6FP*A)KTWRN_GiD&}z>2mN~tf|tB>2*R=} zfJTP2t9IOO&k9t{K}04G2};8)d0+lqMVFLlXLYOERzW2IzLmI+>~Fo%SzvkXQGv8jY$K~VgUH30_FS3MO%#(Wa~ROYn};EpBb?19L;(;m->nF=fYGy{*a(Xo4I^`*L5dgGYx`df|~*&l`zt=F2oi?dp~kj`2?e*D26n`8dQr%t+U zF**94#N;-c!_s`Q>yc!J>suJZ=4Nb_V*e^l-ESJXe?uo#Z(A-^&6)Tp624I4EZ)(! zj$SY7kR)d0t&^K*7^CWD&-wj@#`W08Ms)7_m}1!_xKP~-w=_#3ThUU8Tb;`Zg5u8S zEBMs}uiO*jau?fG!q#W}`7QLQ_n&0}@+@OJW^#=Clm`@08jCY+iT?W+`nFC!0f{t0 zYc#xud1iK4bbv{HJD9=iZ(J9y@8BSVFVSYX-BP?j#qE#UXbmMa|Cln(zIZpf=KRnI z18^RSijP%&KxYszCMG5?Ev-pX-n?eCsNt}4Sj+m5p2WR3t6Pv3Pft%nix(1hVkYIx z!u0g%sn}SouC8DZ1f7kyg`WU47}7YG*ROXmiD_wRAhJm7{ZIr(^qpfHr!?Lv+^suBZ1`{bvHYg;a+SAp19*kazBO1#m|9(s%mP)=YMZ8 z@BY@T+8g$;wC;VWmWZK7lC#27uw+IclOejy#l^+JvGxTQU}eB6W{(?B$3cD>Vb9Kn5$OB^KhY1{g6@rk~M*;yccU1x4S~8A-yZnp&z%@QXCT0wr+Q+ImdduKe4w|sgZB-Fy!X553_zTx5#@g zc+NqE>|R|+!Hvt8EvkL?RfxiqS3pZQ^Dr6NHnO?lVm&l_RooMq;_YR8h5qk$YvWK+ zM~TU!OMXvh+9oR%@qKQ!^t_ zxV2jBHOoP=`=cp@Im~tpSEXwnH~0)GX>+7#ERzZ=)MDy%cD5)Btf@f(q2S&#Zx;x(*IJOo?MBPBa^2K{DUg-X2(|1Cu=c>~I5K zPdQb9xuYm5Y6JEfcAnrc6JnuB3uOg~*`6Gg$B%s&O#a%0p!so6{V=CGkC2qF0U4+O z{e?=ovCX3~$?%82I8f2C-x4T}LspE+iykIz%N!ep!oC z-eyW$u@u_KWy4z}z?R4$*1jKCGlwgoPnoHq>)MNi})|sF_7rolzaS!Xnfsd_i2N<>|jdxWB<8xRa?fL{)VM7Lyb z*S?@HrAc*o&*1Rk!>}7;Hwhz9D39OUsC;hBJOBH$j82ASYuqmBu1*%8l0@5#xn zeWb+TpPr^Gh}Q3%FIxcS8-E~+uMJpvs;BoI8?^qpog4456&`4Me}T3A3W>gObZbK} z#`;rvn=85rPG#L$0;x(FZrFdpnv}Er4+Y|L9Zoi?m?0sg1j*V{^**9@8TlhKCLBOk zujEPuA*+W6O5D*_%0^S~@gu#=TbF6>hzzhWa%O2e5#zWLX%3dwxDs8L(8|d_DnN5z zxZLf_7jrwu*Rw>wWtEgTP`h84)w%~v%Y3n+qVpbvv4cJy_Ku+B2|0-6OnY7tj0lxp zNm9dPls)0KTP3MKrNX#bT+E+x(Rx}|!kqw5q5sbsfFE>_>uav=z#peQUuAna+m||W zw$H@dxb5YX#N`4a^CPx|s>)F*SsIILCs$Vpm)nkD^j~jp<2rKO-F@}>Thp6QH}2gR zQiw012xo#Bt2B8ErUD_)i7<_?-rndg-4$(j!5DNuCL(IImv^BSD-4gbjSn@M*c5i5YGJu++Si(mWQ?3j|PLRHBd0{9home(-!m%RRinapJR~5 zf#cPgB{ku~SpuAT{pcQ8k2Lq}j5@z(gooee=NGX$IST7e0P~`bDM!`Y&krk+jk7_B zI6WA$2j+vDL3MC?2z!1_wZz)5P7Yx`-{y%E@0kmdyuHg3<%`CKU*h5|UPsdJKgXvl z3^mg7R>h)TAJgvz>MRbbLkd6Hn`cJ4-JJwC4#>mhK^H`g5`JO#w*p9!8h~J4>1ij} zEMPLOj{*X(!84(D)2|X!sTd3X#sE+i8Ky#Q`w|LlKe7_`*3W8M8NXA}W@OavC14D( z;;$=Sy~O0?e{SOnJVRY*#o!q)dU$!E(P&+y5Sb|sK;4@q65Cl`XQCdLt9S9K)%t}tlg^BZ-*AzHCr-R*|L0LT%cKD2`4KjSCJ>&b=r`+A^C;lF+R zfz<==O^hM`?naR1j1w4M4lC9Po6jUiHaCC4ZsIup5V8$27OAr!;`WFsyaD!pXlP-( zSyilT=AeZ}e(v00?ROaUD6m>0_Y9jJnJ>1l9jzLX75KZEz%>Rz>VZc%pQkPMW|kfgnRV_H5`cD>RI1#lllxIOVei!V&ge4kAbve7EeR)1gC$fB*rCEkMdeUC{S(z%hf%q(6G=H1HFt71@dD>6vCAC6|LE zP^T$^J42_B1ssuFBIgHkj}g)9r5`StpXKxCJ?ktt<#xl zj%LwkciO+D3V8ACa7);}A-tmZ@84I~)W8s7FVf4rbQd-i=qE!xK41ueWGP#)M`t}fdL+AtOU`Y7gd_9`8*OjT~LaJaBhRpe7um7 zoSg4@MbUn7To-#A60yM9j_tV#hQLS`@TvdytpvgrowQLd!@vC%SYn=cUF;09nvz%T za}C>HD5VXHLhaCLz%fUEp!m5LKhG^j#{2sh%jh|a6V9=;wA3`S2GW_uhe9MK78V+i zPNN?0i|n&BuJROfwTm$2s30%DwlJX9rxYt0lq|0zB$Sk2`H!X5#Yu)4&$Ki7seNmP ziiAW+^#y@lNvP@s1Ck!`rilvvf4ym-GsU)Z%#(A`uPC;e)rYZ-O+8*9Iaz^RX4cA` ztxP^qJhml)KQTX_mWiorAk2&IpL6AEZ7lBE+PcL`ER{K_kF9kGBqSx-fpP4wmY5;Y z=dWVmhTI9Mjh}*Hfz~w_Dg6F#tqfo25rT2lpCY90mrU)5=btIYR18=T*tGqZAmiW! z`q#;)+nQIzJ-Ju*Q%Ea^y^cg-)#Kf}$6{>13GQZe6`&^rIaFdKikRr=)Ugk;ksYak zdPdv;C3$F_ubl?$2s}cWh{!AMr)Ne+7gwjOJt=w9-8>GKCj2zk%x?yMI0 zHM6>dgZQ?0F${-saa$=ZwlbBDHGOlr+c)yx`JDYs2OPNwFEoo;xsij%hT6SKw$^Wg zS7H|lD%lzeFPu38O7z70+Z#Qyf&dc^14Yo8J9^~Euk!MM$F$f2^#dt&^;?$H86e?c zsk2cV@UyY;Q+T+brS6o)OBlHH{BTMEeW3Y?oE~-4LT|wZALXrf$RBC^Uzhj_sxEel zif^%Tv*0ykQLQ~WSFV}He)B0iITkaNd6ZKHkTHp#RyrHqhVIc(lX77kS`Sj?x4wD( zcTapp!N3}Cyy@1IqX3cA+&h|U+;)z#Hocp%tTr^5gYlqN8Q=v-hq`4qBGZiV?V zb7{yUfJSkAf-GzGA5(LVnQn;<>Uxo-Yy_q8xTGWqhl6HM#4T-37y@bATC0o<2xjlU z80KeSbF9KoToLJB#GG%q0=v#j?5RY9ZjJatToz~F{-QpJYhj1@dhXQ=|2-|fdVqd7 zPK0#vgvdi-6u6UZ#sj#}vrjhXUi|(7#tnrt0;=AXghV{7{5FniIdW$Q^%IbFIQEQn z33n2*gqpct+ozQucj_N2C%Xl4>5h((#PR;t;<@7bKwPf%&cE>u_wnOtxOl6dz|%qb z8k#Nucf7`XM4ZijeeVb!9v^1b0^14}WNZ9QfTJ7+Bs4-)hmGbp5h zR3rs7P9wc-Z8>S~Yib7PyPQ3%xln>~kd`j|AMcub6@{uRLie|(MLw}Q7C1PQit2{a z?@1QEi^RlqSagOS9^!$Nq@<)kXdU;&x(qI8X};kn`nEWOWdDWBaP? zgaFoRmHK1lH_wBjF9qV=uAb+~%qc0!*pv8nBcHS$yvM=u`^>p>p91vzi!k5S!vOA} zZd@On1Cyv>j#l~Dih6h#xXti4>ZucW0$^$O3q@1&1tz9tcY%o4K&0Xs*Tw%DA~;es z*MzAlDW9b&!nI~;q*F6cuNO|9%q;%Cu(c80IIX{NG%XTIxXFB zn(}g8km763G0D00T;w;>eZmQZ%8N7k`-o%Ew!{|0?jHMb4Qer^9?-o^QO^37nOPg~ z%;Q=~LV|MN-L5WOS0cQ7U;gK18;7@v)JRB~z$OQ+cYG&r%GYoB_O?Nl8yU2~%KG92 zUO-NBV94?D@vtf2;4Jw0YJ*rqUvMxRq`Jx3QBgLQ_z;H*Y>w{G(b-x4yT|p8{5sz9 z`ARI@(ziAd7+FNTQWe47BH$8E2k6KJwt3G33;{bE;?d*`EPk+Dx^#(|xn7GkF9*r3 z9gz^>zC)o5%B0w72S0(Z*&wpgYtMW7-_T%w$-ktqvjl~fxBH=-Sp2GSMkzTPXyYbI zU-`qH_~#XE1L{=j%8eU0I61Q+*`jf6(i=srV6c4Eu5SnJ)iE`!gn6eOLs7`gTG;F}T4Q?+axblPdwR*2(*jiEuHM9S*uu3ps_Uj%2#i%xB7 zIgw|qkQd@eW@?L7Og6Ou;!%!I<;hDLt{lP0 zCBs+$WQBs}Oz?LL=L!_jOILd%ttmmSo zcFZ(@jJN*r76ua=HRsA zb|2IjZ_qFsfBd7+*6S!f{=RcoCIXv&ge)CwbsJb8c6WDyd;uFdn|g0=Ury$%4yXdJ zpbx;R1VZU^Y7dT~WFXZ)IFd^tDfDO2P*GHb5GT1G(tY5o5YTT{H~|f!-#(Bv8NA05>VI%&mUlrEdP@N-i4%-))j`lzRnV@@o!BAA@y&COiKvwGIaMO zm6exU<8$`6OXZ8mbpvM=@D@V(6?#Wd8NgZqI&VCX2C~KAfZhUhT$_Q6b#>H3Noba+ z_8~)Y2M3qf!={F>FHQWJ<6*m0$}Q zM9dlIbYfCcAggx$`kZ~+o!uT2rQ+gkLs*yxME+)^j}Uj$3LX&v~(#tTXSTce=BkT~Ys^umvg=Ad1{~9@(x4E?jUALpeRO-P{zp zZf>^hN(7rAy#$DTCdH@an4~JS{l$gA!UJIL4oQZN__H69eo2fq6ebSAq5VTC1tR+o ztk)G@Ly-s9MjISR3BZ*|br^XQ4OQMTCMA6!1l2jIWop_8@i&MIfOUO6pJR{qSJ1el zD0k)H-rzj1p}QI@;b_&D4{?SpFf*0Fa-pHQn|`l50>Hwe)FEW&&o5Rpupw=#3FH@z zA+!k(jkrPJeg#Mauw@(s6y>Y{R2T2w9&6FtCJ&K4*Vmhef;zN?7{ogVhhX~RVk6Md z%?+R)TOCt|0r&oF#pQ`Qdq!-14L&x=kL@7F>}P&67WrZXM-Jl5oLF$rnMnW#0v3wz z(UNJ3%aM^+gzmYhY+X7y1K%%}5=IEga2E9@8px_7^nyXNZEyDu!Nm=6tG9Mwd0qm$ z%Yg8?2|%qbCZpdFdA;cTZa(}g?XQb4Wq{jRV`kof{CO2*J&P}Z>@qeA;D>F-+Z$xI zZ(FBm_U0za2D4hv7x43ILWO`n^kB0Kw>(bp@!h*ADJ3O(=qn61IXLcUYVvGs*=-S` z_?Lc-e)@E&i)30@*o}fUVuFAU$$c3i*i^}d1_R(NHh$)xko;6>oH}K^E zHzBB1pkCp@n7c!*I4je|pTI^vHJUaTUs;W#&0jhv} z765ZOqTqSKdB=VMRSIGj>2 z|B8gc$wG$}t8XvgM^{yq4{)J)dqjui&vEIAaQRV>YZ_K=b`VH7frm+F=zb3ve}F0# zZ7+Z5?7XqROpZXDm3tM~@?l8o6*gYI8Sog!eT-)z!AHs+k>TN;#yPxf+t6Hw^s$w4 zb-th>!T#@CQ439hyzEBMPwBDbvZVnD3pf{%UqU3elb%>rN@_*4^I0LoV zE|UJ)(W+T!3|cJo4?)c5iw)l%Am#G2!cPng41h6Wn&JVFU;U|^+7Jsr>@C970PZw< zk`B6kUD-w^9#lwp^XJf`xnpMmQrNuq*^j|AVQxTXRJj$C(KQ!rq&gjeA7yrC|APXyAs+g*O9Lg<2 zL`)ptv=M)MEYR@H2MBb^T@Icf{FMCUuaN7osoX`ve1XGYQq3A#WkYV9CiO@`3AQ6H z{bq4&h=H@oo{sA*&vNZrbQ8rkR7;siJ$^hjeGa}!P%N$M5!gaVKrr`8Lr$-mXTA*W z1tE&V6{l5#v8Dy*hB7i*eJ$meVT|9~B4pdx z8m1?*9+?2-Ma7pJ>s>}ixAi}vyiJ69QT_=Us0q{a{<;RWQcCOE+ji_SR&V_Q2{oIF za-_R?bFhvp3~b9M1Q))`<_Nq81qfbzecMU}&CFPl4rOT&-}3J}fT@%8pi0wkNdb6R zj_^O}FivJ1EcD~V#*=M{9$?Z}X)CmK!;}iF5@(4_1_5>pJ%XP#dO7RnP-TdyDL9zCUw3dvjPF63{-dtV~^(r3rQ%Tu}@!F6g?!Y%V*x}`m)K}ouzXk+MAwh<-pR}SPpGiLk zpK!N*GOEo0+nOecg^4e#=BTuU!~a+}mDYT(HJ3^KC$*uo*%(#pjm4@wb27^rzx7(S zmi;z3l{*DIzVh<&O$>%Be^3E9!=$A_y=ATfI^oXax*5JF5br}CGTX!D2oYaq_YIQR z)wv#VIm-X;rZi)=-!Uqtf*-KXT{J1(xl0|;ICp)6S3{r=DZ>|0s!dT@*N+Lurdzs4K277u|DzoRkKce(n%maDymiz~f`)PQh{)c4DqSD>a$$Y-je zrDan?ndY?f5hgicb~tzJ<9|1TlUrHGrE$lodoGAi$YR>fE&}S0Z1%nw*?$Y?MMgkYLdA?<;#ZSOoSOP{oa{ z_z*w?6JUICo3!Kc;HoWSiV0it8Z>j4>BpvZ>oZ9mDh?r?)K&D*MY122#^uT zz53@K*-MbZtc0F6q(MbyV{e)wQ@=vlX@9p9MIa|OxJZ2l>8t(?Ck`{nZ^KClbZG$w z^5x60+{L9)Z*db+g!jJ8uh@E4?B-j|XJ2W<8Kcu>M~XU>2U{Zxi7OswQq zYgU!4)L-8ZmSTCG_-0H{Do<}-Wm3G^($FAjg;a0`r;ujNE2yKdtr^+;041$sG-hUI zz56GnaG)v?q zFC_(Bd?%sTbdqfM4$^HyPStn<>DhPz5>~|IAA@Eu`F7794I@`gX(02F*cLOq15Aum zT=PSH1%!zShy(j`*aTDE;W6&bjlwopRim3W`fNtt!Xt!jPZhdDKtaA)T|Mn~a*qno z2w2mvb(q0`ZQeT*vslirMuW%aoaziZ^03$K{HcMOlE;RAl`3Gl$pJ(si zcZGnH%KN$(W-69YOTp#_R2wEESJE>Y7!_}Vz?#zjT^V5S3T_EH5n>V&I@m_5LCKCE zhi-k((WB*_5>N|-dTzz9`z@ZXCewzP>j*UG!xP{Y~ej!7N0sn|Mt?c%Qr6b zR?{{&`$W0<`7v8OghK7!-EHghepijWgP9jPT=Kq{&znyWzf4JNHV?z(z#dk-)=nd> zi@0O*3wYZ&XsLKvp|>EMz#G?OkQFNtvaAX29EYo>hT)tLRHttz7w+w*?QJ#~svkcH z&*9(oCi5-w!OVq()N1Vx8|hm=u=lnT}>0b&5M5zH+yeb+3J_%?j$ zSt+3@VU{uzG6hOtkg1#ufXlkNHBF=tVNHH}F`tBCd}HGVANtJH6kY?zKN01Fp92F6 z**(UlW47t1fx&RWlWQF_UqGpoAw11^`X@k0fc~RD?Rj-#YW=4wEop4ohnyO@JBTMg z)rm)Y1_Jo4a#y>$G=!v4%1`O?rEO$!d*?p{agpj`9s7K(e+V=dq#e-7t2 zhU2vlp^5Ly<7VG$)zip3e;zn2=`4w+c6KrEV#CyvTCNqYwKJkn0`VirFL|EDb#m^B zlckTP*gn4qi>dDJlP0$+Z{3Cd9Z@5e)|m`9B4wl3x`>GO!7+$eRTT*2ltiSYmo16j zMaNQrA5gcjxNk5$J2)u#=Zi^@FVc%SRqk^`!XK^8cNv9Y@O zl8Hk&g2Y5;&lbKMS^jnpV>5rHcvHs^Bv2-{{_%oW*{x<9<7F0nc-(qm=K3uuQv@&; zL=z0l$;q`>QmK6Mmf^59iv{_lhx?~HfqjbQhXiPjh#?R0N?U|5++}VHGT%wbXH%G6 zmn=WCy~zOGR+Wx_tqm{P5!1eJZD2xaFtd;;P7%_2x3JP6t3GgTe0QhPIPY5KbJ6Hl zq*Ulk`}&YTsS!vK(D~P##&dBYhY3w*sJH7a^Y5(o09HFDTj7EyH)oJ|r2bTZ)PIi< zCw%?|XAg)a8TW1Vj8<7&%wN2;|6Zn^BJagb=<}yfpL~7C!f818oq_T}QXS6!-IDVgW|q{ab%E3{FdIcM%t^sH`#@YRx`Vg-bmI}2 zkhcd(aXy{eK{EBPm-n4gJmQqDLxbq%`HLNTS<3sT99>w5m9NZ~wuN3b0J!Q`5ZbbX z!}D=RiV?&JdmAIJt#^BMW;?%~aNAyK;Cev$%SAp(ac9gwNaREAZr%iyPfZ>gDfpSP zQOD!rh`)an4fP%NpgNEuR7eDG8^mRjt(<(qZDo!NK6SdXjBu|ea%aE>QYi@zyVXlx zPX9E`1ciX3RlR7-GDPBYN)q8;4=n$gs$R8-<_Z zf--^g89_IP#(mBux6<)xmc60$AT1h*mGnP)GW4l6*cr|s&34@BTyN!MQlZ;a{jjuz z-qzMWW*J9Tu}fxVONvj(?axbdIRZzIY;+{pDh0%chbu_2IwUauyjx4@jP(a#(1J)R)G884K<|$RrfR z93%P^%0wn}rr>Fw_)fvj*QYv~*30H%QF^5doFqi6uSs@KA%D5YU* zdsOIcr($$Vb&m;kwpLY3)*Lm_pn%yZPBQ1W|5*^8E)xDg1%S9Nmt2__FDziTtCBj^ zo9C_lY?rxB#RmmT9yxIO&N!%jr!RgHoPJPz+cfBbRB|XM`ynOQ@R#uk>6UZdoVRZE z>qkq(8uVoQDhU0v?#RQSPH31ao^Se1cKXu%RqrZjVZC@7jw0Sr$0wvh&88itm+M^~ z%eW`>`p?64Osd7}eH_{JqA$PgrKdz}PmW1g&RO`*+`B=X`OpcjGT#x{Hcckd9R77n zs3dXa01FU``6t*B#9gYoelq&wAPnEHUEoaeYNeZ=`Tg13i+}48I11R~UESUPIAzjK z$o2!2llf7*gi+gi-I5?Cr+t{(F}= z6T91NAiB%_Nc-1&5_9P0{<#-2Fcjk$>3CNnC?wzYluslP($dkfyM?60MZx@zbOkAznYq>wfy_O0y@;~QBXlfPS&Y779-Ak`b~y3emrFn|I813UH3P5sj8dl(iiCV zeY7p&xH4Q_kL0P&+my0E!-|Ked&v(rduP0BTxbV?gSVv5q|9u<$<)j}Q?hq_s~zGQQbA-zX8Ifz^xIRj z^oF+2LbI8h zS>n%g3-}^NiKF+r)xZ)2AxD5pCkTd1p;eZQ?2P?4QM&~#F-6iniK|;L0NfaG|KNt; z=Yv5Hmg2n`mZDa=i&b@Z_DXSC`jaTg|xpJk9)voyaT!}AO`oxpxuZ90s{8E zgy=*)Ns>y=+)p>@SYNQcnZ*YJE<;HoE$Jy!|D4CO*?M43F@5x2yo`-&m28^BrvE|_ z+PC#?3cWzd;w~nPD}WyENh$fGHxD+)OS%QiC`>uoilBZn`L#>WY~gmDgQ(gQ;EJY{i^E=o;hfl>{0IX?y2s~_Vs>e{b*8 zr*QbgBm7Ss#V$|D8zUdJ&qJ{S1G~>MWM939rL9hq+INk_k<`Q^oq#tUilI$$>^uTk4zOVb=a}>PS z{_S3MZGg9?W&{KSbl8~cXY_jyFGO8gv1Pq7{FZu#n)S&)E0nTmtXQ##JQpr8c6Xt(Yv2J=bCqj3M_~w2Xo{m$I7n z&EVrFPP~14Y)ui#j}DHgH0_#{N@|UbnN;^Eg3I*u^s$cvfaD5O&&!f&9C8Ee9B}r^ zov8=U(EC>Psc8Sb#T2nr`yNtN>0!eELAvttO0!P7jKR%qutKu zdkS892e$~9DZ+TEl!a+-6}D%{lUkMdguY4fE&aM9EKD|PR%K--E2l(l|Ki6`8H!15 zOBLK$^n1jW4jRCIf;`wX!Ub+5n>EYpeF^->&Z7wlNp5ar!^1uj3_u`=0pC%0_MgzI z@thv}(z9nYq93CkLJ+sLI%U=(z7xG=k=Vv#K0dsI@nTZF4QvM=rOT1497GJ#ODeHV z=ol10znHbDt)Flcik6;Qvs(}WYmcL(rWQ7sev!=CPYgmz4E13w(upH{P5=1E#zi2P zQB?@#?m03GNnxsbNa6N3mcqsM^*M~X?N}PrDQz}E$P+f-x2K()MIo8YQ#EEMr}Uq) z;K6P!WgSKKywR-9`dyF_n3*?pB&>YCa@{0v>~o}O&~nE4fA$svy{zLvw*!tb7g~2# z)2(^%R{OUbksW7cTtl}$m>q)Z!c8PE#xZaM7k1^`3E>()Cdem7Sd-;zu=xZz00@A; z5ZV?)V4m!uBtloO#ozJ!r)t>P2wkDk39?5aKQn-<2E?oe)3w9w=ZIk+n2}2?4&&SW z2y4V{4pD)|X*~o!KNi~2vA9maZl%RKHa>30038>>WTT$!iC6gQ7RovUePk3AYKVyz zqV}ln-aWK-?4MXe?-yh+UvGIitan+1l_tR&eCTcL_5Q?4ePyyn$xev%u6d6US1)Q$ zalzp-oYR?SMAILSfC&v1}Pv&NFyk$w4{=XbV_%)f~bHfh)4|S&>`InsDN~L4Bg!@#Q)q;|3CIV z`z+5c%$<9`INv$%`<`>^ZhlHm*Xm2|V1>#-fIJk;=TXgkIP4r0)Qqpd$|t4XQJT3z z!~67G!{Bx_tw+C*VWR+eK2Url&_VbN+*8!;YsKlM^SSCM{HCC82dUu+I?mfDEC-me zE5ZH!yPrQZCg@Z1e<{H&NV95GIo^O#_;W>1Pj#kgnVIFZGnGsZRg6ZOmRVw345Qpi z0bQ|~5WE^xBe;1N`RjgfSSiSW;_S;z(+ej|xS^iA6gm(=0Gi)JgGW9F2CR64TE<|1 zhE9IL9kkEk5SOy-K~R+xb%l#CZmzgX=fJ2Vxw58)GM`soo>y?A`(GaOKyp@R#TbQx zQn()wM^9eT4lyB-#na!*5|BRpDVj@8Hk8ppe}@$?yiy<1y~inyu-=F%(gmHl(r6B! zbVf3-PEAvTpKPg}+$S(OHYOj+$-u+o+>-?gf>Z)zl~9tnyAlfC05+X1q?mIE!m;1h z@+0JEQ=K`}i>}K}*U{ygAfjuZxg(E69e*yaBcPIjSb&y)jTTl%L3j65h<2DsrgCAv z`NM}bV>Q|1*5FO}0%W>ij!bQN9AZD-ip9JR2;jYV>Rp{JzZMLklT%?n0@bvO0e}IG z6wUhbs_}8JW<-{1!?kPQ;U&^k^HU{7|9mq{y3$vxQK&1X`VZ=xG-M%gyE^Ld@}#D6 ziR>;#{QK`ndppH5-Pr!_OYjj-id*ot@8SH`M{)w73!p{}{BM)t{=(JDN;GHaYAu)p z+XYSEbx5e$nAbp%7X<~;fmLLHeqUi;@C%&+g|N_2Ry(o`e%q<09p20yGbkg`o1|2Q zmX2yOIoFRgD*}}Pa{j!B^QWi+&bpIykaL=kc-8G<+S)J3uJZ8o8jr)d*^hI*`{(xX zMyo9_)aU5?FP}Yo-HvQ=dvEg`^wIumKOe9@cN_dB%)YbH{%*B^gT-h(-k6uX1xxZ0 zJT1_X;+-L7W>6_YZPwDy@EGMPz}CdnhY`iw)ErZ3);k zWeF+jA1?e37B=&_52Qc2eugd|lk_R7=DQQ&v%o)Yt8HTC0lm|LODnwTGEc{jCorjwK;{g&ec4ba58d)Duul zuQa>jd6hwSQis(#@nMs7RW72rDWdR8V&c7-D}(2#sP=wdJ7==qw?R2Q{R+Uu{y0gb z-|f$%Ey&nAo(3aH2+(rfxHaM%%cOKf^4V0G@wl+SdFq*>?Xfpn6QpCUZogsX?n~an z8Ct*I$ieXtR4*1?Y=w}i@xK|A^=dE}C|b`K*}p?)M|NVaJ981@vUKRNOd*Hj&)2W} zTtt*AQPkFEMi9pz{LNkWI}x!u&#Tbq;#N?(g>R8XH}zStB{QE?oCC7lxBc$*rB-Pr z|Eh>!maYQD-EYK}`g#|2Jlx`0@x;o3#WJ+*)Wu zm2nSobBCWC>%_rQ3;FBFZ{S8g2C?e;Un1ZWTKvO z#$nia4T8ZGheK?#XwX?mn^_v-NK*PIJ~45uN#r&HYU`u7M@9{@^>@~gBuME`f@unj zU+{aRd=FUyDbTqNJU8%N+1e1_l@+q2G!Wk;qOPHVLhQ$ndwgureX37Qr!@5AmvoiY zGuP7PxxdA?&bjQQ+nonpmCeT=3Mq^=+k<~g=cYO6tY@^K77apkOpe2 zwW9I!b_Vc*NVEc@GIMYn3AiJ2M9}N4G#If{e7QyAkV*jjB1)B>zKZbgEtmhC&rHC% zY*=F4G-l2#QgWLN2`Tt!rp{aBkD$fK> zf|`z7h9$J`tMY%(k2u(nBo6lPPOiG!+SJ2pZU7nqt%3k_@FZ-3A)dB`rhqqZpdnFB zx=w7DA+&6D<~;0cWWxRgI+z=Y#y)h1Te|PoFwDXU_wBp*WWCe98GQPI;C(hbg6L_b zln$VLA<+amCsEoNo2rcP{ga((eV-y1^v+}g*Rm?3k4CGava_r^W+wK-5h(QcReqr% zJb!n&8hk}DXNLi9{ww8}=xE1@dK^fVeqlJ}O2}f6LyYaI;|#pjpk(v&JB1IGo?Fxe z2Jo1559c6(0$t4gG=7im@jyt-Let>Q=I?KjRh?`!hx)d@zS0mZWkPlv5E-PjgO)?( zk-sRgp}Y8yMHmoZ+9lJzytJ3#@0xOkLQ}P_*!%Mf0brSyygqz`qdVWs6d>%(~)+@TovO)joSGl-K( z&>sMfTJ??V*ME*%0~T8#lhAeoe+VO9#vR>EWhm8j>&ATsyF*$n(bd=v`g)XrEc$IQ z|Lc#D9`45Xy|>XJ@x9n|jePU9sU#rHk`UO8;5owEST-AR9e){gkPiJMxsM`<;V=;i ziTkiO(?D^)ji%}&M>;@>VBB`5cc6A$j{AT7vaHVZz2)*3&)~RsZQ%A0`IN7Nv4GtI zSbj;xbJZDJ{A<)BYdJd_zm|anP#e=mrA8@YNw4r6|C0}&ycYJ_> zd=xJKCU4@h4GJ_m9;E2tNW)Q~=(CasLmhY)0~J!BM^+gH+s`>dH`k9zNtW?w)VtTs zngt5j03s6ZIz3KaJ;bOFk;29ughwE~d}k;J1`=Ewa2j8~Bn*Ilcyk~#bI|-0?jj6h zy*@1r=-lU^&lhzTJ&`B)b$QZP8leyc`0p22aq*MG8*iPXIM;h;_~}6nQvi3kO zx3*RW#)^)v0(=rH{pZi009h#NiOI*m{?Zj>jlTBv1qlQ)|9K* zE%YO4+;Vjriz4<5nlEO}9TxYW!6J8dQ{8Jl^mWZ&9^F(44mJSp6}0ARGe?i?j$0SH zEdn6#J&9)~m(IgCv9}m;$?jX?*(l1stt)nL{ST=(rxaw8}s_ zbVW-|G~#lZ=P}L{zZHNXogm&QP&#+KXpP=m|a4{LzAu1|>T)YT)TjJrd9(R}(h*2Lvk+0HK zNCtx_)Iu3k+g zrHDtPkqRS0Z7v%oDJ3PY-(UHI+*631y-7<*S}L92+i`7*gYKTXdeP_&cc}i*;Q=5r z8hvvCIqxaYA%t9mw?y0-F-S2_WR!F$2WOt{2Q-0CFWpdQkB7h7q80bq00tRAfPq0L zC@QILUIKjdM&qw%LH_MYFTs{EO5^)5P9pf@$7E&ZT=n_Ee;DL;*EjkO$i<+5wtnu= zc)dY(rJ}x0nL{Dm-gR@})!moJJL?zuE>Kd=&DPCVz>P$oeLF5vE^Tsr_xE<=fE!oZi0^xHa#mh;^1wey)|&Znzee6g&`Z*mKs#2M z+0D%jMY@%1*3$}2X@74?(SbD0LV6C4GNlAl%~TP$om4V0^xM_vY{(~nU82v{=ksUb z9O%s{l!#gC$u?Y^ZhJ)zX$HnY(Aaw&`bBZ;L)%5n{!R*6)`@fbc573aFCj%ZnAq&_@J*8w>XiamT`iZ_=1@2bSoNOpPQT9S07T; z8RX+H`9Ee=|B={{4Bi(kGMh?vQ%ojkROyX)eh+eQ~)%`;sY8Bne$R<|RW z{iD?Q&kwxFZx8lg0u*+NgamroU*Z^%fU<3MxX&^d=#|hI3{*jNnRmEFO2wm`_33xO#HHkQ{P2D)^uH#;4u(=>4gy`a+J7r^qQkzfNxt{D}}3ox-;^^+o|!6)$erNcZ_kd_len~mWfG81M9}2 zM5K0!;~O%lL0iVb!6Ei2eV+jtuJS%`{z@d{T7awTH3l;QxxSy(5HeCTwBk7ro7{BH z+$$<)hqf`f%t>uo^YD)ze15+fVe0;wjhd+WU;BO?xj4`ly&z1WJb ztE{QRpP&^L6>7UXU7Bsq@N`tX?v|F0Z(uxc($PI#8oGPo!iCu`4@1t-);4+bft^uV zUjKrUI}8kl%Oi02j~_eR;)T?em9w5yP#tV~#1+|@s&$Frf#`)FV2g!Ja-Cr{$$<+$ z08w$8YKmCQk`(M}&x40rTBs1U=Ggl=ZM6V5Hse?8udxO4P#WxrL4z|Wz)sLX-GTM* zr!@v0pC#4kf!MfVZxiccg;q_`Dsg=HM+jLqM&S%qN{~Azw!6E^4l5~LtC)yx?x;IVs8J8+ z!pL=qVBff1T%6Cxwod14y!`HS8iK9mh=_>sI<+tHWlBnBxxH{oLt5DGu4~4Ye6(yh zDE@NzT(_1k5bmZIr&qVhi|8M8j#llh!U4wJxCNpP&@8B_ zsTt~zvuSMf5Ym=h^z{!HZ|luN=D7JbH+$axTR+MeEuqazh%)4_ zZ&tRsshy{x5jN{45qs@Vg@N3@4N0s;_fjd@$V9m1NfMIW5WAW77U2OkEiEkt1wEcj|;;x3X+?xymRS&Lh(}EFB z-tL4QzPGbps4M4-Hrd}j1_CLu*G{Vw_ar6j##e@hqPb1Ab#kU2xHN!p{rKs!%}R<8 zP^rz3A1Cm85?u2~3jjx%P$uBrGK9JlZ+MIwic-2J z;n!W__dOr1CygKpyKrgg}y#L-M#0}qkS7tE1R3eBg@dJxkqOX>wz>6 zA1Kxt9;}o@rBAm{hxrCvzVm!81H%c@kNHomiy)RgL8qEA81eCo$pBKq)zhsh-b`BHqGZLs?9F_wJGgIm{sv{>GSCf@lkJbg)yLwkZ8QsunJDA+!BV~-yzAU(S6}P3#LPD~HV(q9lj#D)!HqQJ zHi}xH;xZa?+Z;G|=@OIIqq5xraKejQ1+QEw-`DL-H59O$addhiLk~{HS)_AAa&mIH zs7Iluc0RizOMnoM`QFYVj1#L?k=gc&2jTJKcS^^yo5)YlwYHILOqY#}1bP#zoupGv z?#?w0>5+F^@9N zQu?+4;`q*pfv->F$gbW%udhu9^h%zjPD#$v+*L&@_UMdFP6}uV*ig1&O$s62eqW;5pP(~=VUsr9Jven{`hQ@t9`&DFHZBR` zc7(mftXd?;i0L4E*lpQX2O7eYeKX1JxSUk@WAKZFj31|$70Jet8g&~2l zxtRIRw1MxZCBf4_D6~oF2}o4768G7^#`NF<4ULINmh*bN)oA2J9y9P;OKaW7mWG2w zcE7T)&gX=eA!lc^EyCCYtEcf$`Xfgt3Y5&XwJTDL$hirOzXO!x5X;YZTWtvFO5bbw zZ-CrX@e-4ekO0RD^k#uHo~|+*c_I$?UFvmX0kiJru&$TKNeZ?;$|YP7Gwa)E+g_dY zCIg#I>%P^JXD)Jr4hoi~Bqz`5pE$9+0f|bP{E*=R^|`eRkHQl$*euF%VULAlZs{t)eX>uru1)p3$N<=en z4i&aIA^`=BoF+mEf%LN;DxaN`l<=Dpu^e23g#39d#%J&6E0Vq_w~h7XQN#9r!KF5N z7l#EwC^6@;UIim0nmy#|bBBNz%Kno3LQe_?$kx9L#lZrRAU{Q!86RLhR{P!+ zTnXf+*|KSa0xx54$Byc@!B-zV`Tcv@P?pZk%}LU_%>}+3tquU#bltcw_C6BIxZ}(> z6CYj^7Z+z22E}CJX!QYCs0;v#50jL&v!X2riYzUQ=T+&v6qDwffGr8*F`t2qH#soG1>Me32k{Sav>#Tz&Fnn>P5}H6Q9d7AdWsIDUem#`UiE#fJ`m82}BNC z2&|P~sE7v|jj~s_nUGod#EO9fthhTnt2H7-En2a%Q{YfA7(ERF9=KASQd$xX>pw%! zh|giythcca<+XZQb?lgtyT##_G)!I>Idp&AsK%|&3h3AB;buXPQC?mScGhigJq$wB zlXQ@%Z74hb{j^AXidvIzMnjW`r3Z(3Zycm7j8zg7fU$B}pW$=aAO@USU;n~MZ$ziR zqHL0D(iqVL6~aO;t1+IZ@aRc#GsS5@qVvJQ#!3BB=k=L^;t;Z{-0NEMH-`otpJ$a_9 zYwr+}6qZdVeq1(k7xH;0W#iv|{`}dK;2kIu8iKY14)r2(3LQx5k+0Yj$lu@kPv)UwL=rKI{tY|lN6Tn7?#ldu!P5X^} z6u(xs{XA!>a7yajq9ai78&4ta=U};(CB(uOS#4pb01C@EdE&$yKR>REr{q|I0s|x1 z5K+MM;{JYDIGZC{tsdhxm~I=&y$!G&cAf;LCBuRL_pXE=qBe9;zPk2ce}(^6vj`(& zIjcF`Bi+6eQk~MuY&S9tx)*iNoEe6H)MlYlB3#bPA6Be`#ON?1J7vDvd=`CUNy?er zxIHhjGiROxK=DN46$d|mtGgb^xP@_MZYioW;CIK_&EA_1M96)7*kTUecJN;!D7j4t z)tqkty;bf3#gsq+$P0p4tH-|N55eDF$1@VYpH|dna^1?6f7)pwJdcuHcilCINM_J)bFo`AEHO0a2Z{Qz+)_- z+9}F*o95_9ZcA8ZtQz)U+o7cVLhpLv-aq%f`8YXcT0bM7m`Bc-aEZ8{uTNign5ZzG zC#{8(2C<*F@fdeBDCNq;eIURanAa`Uj+)={q5a<%Lg7+%^VooZtMv2}D@tJVvkRH8 zUR8dpX=j)Ty);x{p+Kh2iIb;Jbr-Ggfut3Bb!5`^5^5%!-AR! z6KDieHp?&z!0@ZTy#=K#G9dnuJ)Tyb#Qq*V`5KUjc+}U|LaaQ7) z9L9ZM1_ki+pR4%?RFv>bL4m6RPXZt@AjHKnGw723>mhZ}ItNYKs+Vhl>MpX2-Lr%F zhg2VPY}qwXf6YmDW?;3|)rG-x2BS$qWxwc-D}NzG!CJJYQ`v^makLxL&Nm<&GABML z5WXJfmJD)ONrbNIc_1Tm9shTH zsiZwc?R=1~g()61ghC~!h3^!X^xH01%$PV-9~-jk*cG`%(0m06mUt)#A>ElD#fE@F zF)&Q~0D9jowy$|-3bY8;1EUGDn?atNH?QBk`DGA^p#EG9Apm_rme4Z|tQuWN-H{`Y zuneK#(m;yl=3uF0Z~g(!9ssk1&FQxBS5*5gWp1-9+K{vct=0CoMt`&?*NZbXtBS@u}S?YQLEc4n^0~ z1a@j4mFVrjf?fWAhk(`=ICgEaG0eCxFU@&jxr3oZPr7^&PlrD zl!Nq-$a?J@t(KRK*fP6&_ru2+c-iK5n8Ej+uuoyw+c;5j3|`P+1FFnx*TB~e1wsZ6 zJ-1!Q!a$0qD`#xW=W|pk%Am0bK(K?~mr+Ub_wTIlSU5TTpix1T4-I8VMC!6?GCyZH zD=`JzEI6y?`6M93MUSmitTz`#=HlE!WZtW)hJpH_c+q{L zO`byP9K!215I`vUHy33?q0JrH;4K>g-keLNy7u;H#C3rWg+4Q9T{{{q%tV~h^ap+qKx&OF+8|fPeJmX3K z4rsN%0a-f!G6p=ncPw_l$ZWvCn)}BmBGnkjpvuy_I)nOxF1#fD&sc2H`j4E*7TGTl zV9!_@50R9j{yX!n-Rzb0rZ~ z>Vk2E01GTjP++@x?-bOmV`l<)^E%Si+ml`nvHGD9f25l&L5eUGbB7g$2sextpwM%! zkPE3mI;i;By-l&j}U=1|6c7EOe00iyYICk|!0Tc=^Yl z*D6OlLnqT>2g4*K&AWDX>&YrqfL~EkBz)uts^TD^6i1qpwSRDD|0yxlpuIYJ`A+ob zqr4+krTG&-+f&jQBX- zDZj+nR9)GzK3s;~#JLaTt6?pf7eTUE!ntNgO^_H3Q0<{hjs&_&ygePQ2zotjA_~72ckU1>n{;e-pka~>+9<(mzHd- ztem!%o7gSg@ex#Fc5~Ys9a)&=|LJk|Y#`|Vxb*(v6%rEC!Y5!aF@svM`BJD1 z9HB~PpNP8X%W+yzhL`_7K@(c`wAzvLqs7s1I#eW=j`XRY$nV|C=pLaM?x=Y0N* zgE}-1wSz)KJ2G^tc?T5|yW6VbdtrEGWm%H`vk{tV#y7GJyec9kP}YQOg5}X_CMG5TFKdz6#iL_q^^M(OpK+)_tYj(wzi}a`4R^!I_4YjGHC5H=x{Lgx#2Hv6TM5b~D5A@h*IHS5 z10M6*HE|XYridO>LBB0Tp>kKkpxa}Fpwrz-SUQC+n~|^m{FEdQ1w91&QDb91r7j-N zcek9h2+uGv83UsA6o;ge5TL(%(njCT%gci^mU#hM9uu8D-GwJqLROafZd(qjU+`TV zkapgf3(d}c`3kRuM?MD^^Ho#Rl=k*DUkY(s>U&TmfQy|SkVWKI_`6C2@QJ_W>({TF z5v)n!47HGRx+OLsFo>3!z1V@hW^hoVGV;?Wl~3$Z)8icq)Q5p|#?%KvMJ+9xwkWZ= zZmaIL>=(JYFqg>f9dBHk;U`dtsnO$9v0uv0%j4nZ20%Dn71W8IZyD+6_=JU9TC?7+ za9Ub6C95>3%o$r)bf!KQvP0U)|GA=xZX3unZ$BF7NZ~zqHjqK?a!emy@};c>_OA$1 z5aptT)1=VF#V(GH1rz6x4a!VMSLkdfEiQg^T>s^9yB5`}f9?i9-^Q#0Li}T}lz~}= zbGo}l`u8j*;|)l&9_M4|jRbovGZ<3SAeuvtRMGoul@yCxJL!s+P{z$;e;=nmGk@ZL zHx<1*J$=c_YSYecGd0yrN9RDhw3mvCYML2&5l=O0*y(IA40QJ(TN}AANH=g0DySpQ zoPt-e!!yjbLFSAH`&k;AAQUQY7)cxZeR-Y)e#yHn;UGDsm{xf1V9nSdN_emcpJy_} zT@LF)y46!hMn(p?uNYAUJ%SR8fBP2en^x$;+gUwX-CA30QhU(rM)RGmp0UF#JuC3`XJ zpcpxFRNQ&pBx6tGXxJwd%5A2eLo0zXMZ>}3$Bzqpp-9|uZUWP-!Nf&KmbX-uLf2oOZyS4h`1p&qNNiHm(x3)v50Xu2 zB&ON#M(0&p>c0YN->{36l*-9^vAPP-VBWWycw#$x2sE@s3qG_0M$?3 zoOrF;O`@cYeQB*h-D07rQPFwP{Z^{`z^gin43FjZzzeIGC;=^^GZde+ds0{G`1}1& zS+=V8kfX33w--lGmnkR>X4Td^Ads3Qal(Fn?%-fZ z2%9qc1U)^ykaLcmm6ftKeMsMF>RxfYZvW3fGIl}HIw8S+)Aq#l*(;tqX#-z1i85`P z473QDN_|6`e7ufZ_GAt}G?{kTs;{e4GKC%O8Jh`}XP<%k74q#NngO+v6B-!V&CM=V za7Yzi+~M!s+Q-Sa_t~_>uH!bN_?_2IuOE(UqTk~-5BRJ`zI}bFzW1{i{^P`n!qxGR zMU&NdPy2iKu|n4Ul0?hZQFZaI8?u=qL+Zlj-MhO9s-#?&P|J2(#0K z@bQIY-iFtKJ+V-umu1)#2|{!MK0c-lu)>hH50v&RnEgEDAl;qpvkbAF>yCB9O(dU} zyk9B6*JCV<#2~+~=vZHW*{$&q?p%|aFrKu8-0+1y2QeKTjLRmEdhxYr?(qBrCf2~f zb9+rFldkx<^mD=8agt0P`?*r;8Q7d6@X&KjOIu={SnLp~HRBO@s&~J4>PP0IAn^f} z!*LQyBNl){6UpRICsQ?hQXk*e_hZ{ zF8V~cD=0*zoTQtcD{!Ru0}8bVL$!h#$g&Zy_zN?dK#D^NZD*NYXtcQI6F^dOe#pi# zR+NCaNHOljyx*RNVrp7Rm~VN!0#}noj9b=-qTst_~XYH;~?_VqIH%>QLtfG zzb!&BqTbwvse$zDj%$VT3T9|Rq+)^+AT(_+^VW1Y6*9BbF*lS~* z`moiy{P4VV+%&F|e1g2S=k`7WIa??$%d|RR?-7yJdhhr#Ov4$m^I>`du5&|GtfpbS z>w)w==|0D$^|{SV-T6kJB~?}R+V^C5NX3~3#mjZ)I%vE&-Z$A8#b@8{)pMIdHCg$= zwo>Y2j11B8w2w~uW6VufA#+^1td840^q?jmS8P*EaNTR^L{Y5<%=H$};|kjh<)Uyk zgi34RTY9i2>;)W@=~m2t4X>$r^Vf@g#fCR+lAqGl*Q#3^UhbT(!z{r^#UL>#(PpXo`$ahC^O=DuVAz;hrx-%*O;>UR|3h_T5aH=Z^Ydws_8okdTq zxo+#;ed!4)Np0n+8+8#84vSbC3R)MQA=|!A>Xo{U1uUH`L7wSA=1*|hM8%PzmuCx+ zynjDQae85)5pk{+iseuxCLMtk8U~h@DZ1Z3e#}Xbzdb*fT6Y;3{6Ckc^<;C*?fG8r z+qYQ^PIC+epS$3;`O}KlIJL2*BI!ZgM99k{ycUmxM25ODHiz6x2`NhSYF4&e&H8Ai z^UqVhP|>MNWYsAVKInWV@y^9#1OPG%oN6B+>!Y%j<>i5E{EGc5CnRJ!NVnCU@rkakVyl1!*72)!HI3No%_`Rd z>xMvfL)VCp5srHj&)cdZ#a{QU?lUy3?B&`!WLWHdkuI{I>By6gyIOp~xdz;1SV30H znI7g^;UYsJC{(EvE($*zAF6JGo7eeq--d`F(N~6ENuLmEYKz5ySOBc_z?TPcE}I*w z&%TdVA9dc`9~%BHX)<@nTk|{%H90j(oqfnH&Y!ov#<6@i-y$vdIlE{bkGTc|E5F?o zo7cr|heWb(i*q%JQ^of?33ZA&M~m4JP*<>_F8kwwqU&ut`wGO53?r%YCY$fIt&dtb zCkEby`(C9(>rPd}`w%-!ZM zwZRQ&rQ!|qAaW&PoJ1JhM42aLci9WR4Bnj=aPaB*eoa&9Hn+fZl(UrYmP@AC>n#^6 z4OF^9wIC(Dcw>~j|WJp4ua4kgd%1cX%E3!kj(q<7_w8&cRaF)4%ZGBBJtqT$ zl-RUyE}xfWg3g1TKYkR*hR3THP(;f@F>BLK_K>QodYJ~$CLB=H^kurN`mP7urU}@4 z{y9gWUoFZ*V+O~w!nkYM791@)9W{WE4%QPsEwvq?th_2$ik zsK}$?*V&oZ zI`XvkDBZpNA43}A*oT?lec2yVdY%`X<6Cm&a-NK2ZEf_SA)yT6xCO@#6GX5BL3QI| zuR&gd00!PvVM&4D|$6G82-F(U6Vtk&p7vHie(bCY`C; z&zI67A~gL6Z?Lm3c4rb;TFOK0=RZi)T=u=1^!g13^8Rw!;StpYdo5#rHg@(5g*{%Z z+Zl3q4Wdlz8Xa)=&}Eh#%%6^7WToUjZhVlImM11!W8b>q$RwJaWT3LAKcJevElV`q zQIeajNk={1@ys)4iLWHToi6zO#HLAi=S|!Gq9XsC*Z#h2qpUK12iVzQ?P4-9Hk*f; z;xQpNz25WHqGgYCnQJn6LABKWQcI0Dua3k1pM{|xoN5iR=N~`Q?kV{>`Xc0r#USYgu`%H~tpdGt z+gn0Hvg*6J`tw8k-#ad<=sxa{BKi;-{CLVyUEQSO2zPBm!w2%m?EN|S25I&eK8y;3 z%>>ir|F(>!L4|ZmKv|XpN_3q-!kfsrxVW-1cYI{l+1VK%AAjZy`@kbmWJG@%8CmG- zRaFxP)cR4u^W?mSB5BR!P=Z%ts(nnwC z7yY-7x-V~z(7SR<5w*kzZ*Dn=FexV`BrvclD$=N{e{#%gD9I{(S^7-V)l5(MUI+6H z+@|whd`IimB}LJFdyj3o2;sBmDCWnmuozz-KmS%8oP>M}pNaADagkzJu_N2UE{%=p z`W~#u`0BLK_qPTFk}XFzV=YiF8lN@3pcBk{%7lmAOQ4xr_`7$ca{4s@WJ>t}z_kf% zK44sNaVou@eFFn11QdvtI7(=5+$n>Kiu)88Xg~793Dz@93bTnBUT^$svPCnmUeyJ6 zw_zPLi_AR%u9fu22FC#d)2}5l(XvR{?B&`%PY6hi?hc zl&$S%J?ken_016jx$=Njd^b;a)q7qbx_<1ud6 ztW1HyvgqFRA&Z6c@4Js5n-E0wa#sg`Wh))~cgM+HUuZD+P0IC1h)AQmN zpz>>YJb74k%GR4i9HRKLTbjQv{rI5n<<-AE8TAoPf3B9x%`uRtkc)Ux5#w(&gxO2n zqJZ%<)OklCcA3A#@(Cselkw8cIOIP?Xt@Wwa=K1^<=?ks-@cSpG z&$@obO>c`Hgk~qu-(X1oY*?ixVusCqK*V9IyjY1zT^Ji^`1zA@U%P*ig#xrEC9cam zS2KDG4SjRAjQS_RxnyxSw{P3*kIF6ZoFA8C@3J2~6gPEMiO-=JZ}H1;6#*9}Vj>O)E^aK%5=-_fSt*Ra@bft8iV@<3^LWCKH6_OVQ>)M9$ZPMTP?Gh=qx zVa){9YlqvQ%-Jk&^b|d?*i#R=8lX9mHPWnZr$n6=kXUO6m@vs@#JIOnFc&0Tg}TzU2hMmMoc2RBB6*(;}m!OfP|A{SS#AX2<(83z>H2 zOgC4w_4Z21UOH^E-uU!UHguw#@fiEr1Bi$!z#%dFp6O^;?&SNt+r9#g_VSh9`^kV&8;gK+L(vqxfdzVXL`uH|KnCV$)P9L zXc(X~+h?j!k+u6&?CAGN*^d~#2c{Vtts@P0uLTQU10b5Qv_w#LkLS4O44Zbzou}Wt zxJ^499nUWpzxx+@1wc}V@UtpEz~M|;sHLvm7~lAC?OJah%D}Me9&vuLlTBByY51#C zJ@j7uyzdAJN;bsAzf1UsZOmr0spqS1csw#})Z};VKEN%CwCEn9mOS4b`}?Mptp9xP zIt4&76c&Si7x`9FpgIoJy3H$UjCCO-bu}{V`fA*^TtphH@lGUpkUo12@IWbEk3 z(KiP>H1R4M+e4z^Aq8=#$9;LSP|ztEpH%oo@%e)v#h+E zS-eT}s*#z{6gIdKDSqdbrLOBA<(o1^4U&X+Eop^K>iFMQE2^%0fz5dwul@CH6ou(7cn z0wnGSPnU69__ z#+;a-C`-TkI5v(D8h}lZ6WT{Aj>i8BR`5J>&Jcrmd&Dy;CB+obW&pjAmm`2GhpA|3 zUTi52<5 z8q;6o?(wtoA|N?-Q0fYBQ9wrt1Q|l=qyYLO6YB?E!PD=r!kQr9*EWokls9ep zHv0Xv4@=UUcV!G-iI3aVgI`$}eqWm&9q1pMsXIj0i=KdrGSP-jEA4%&?Mc3nL-5qX zB7QKBAeu#qp{X5_P%O~`xLHdaDg)3i>iv5KGxTp33WAIwJNrpFWjVR@l`yd3O`kbp z?9C}uDAgaUT)GvVjYfNi9f1S)&!xbrtxcklYx1S)RZY!l%RxU-%ZF0BAb%k$e0)_yUe0M1pN?DSN$#*ek21HdN)0 z>F9XgnR?A`rkj+yS3&FWDl7^Nqg;KvFW3ryeEL*Lo>2=|uC0I_b8~|%68?X(KpsPZ z=%~A>6AYk*v2haK>ww0G=NROSgwJbVa(3PkoAUND>j2iO+;nQLM^IdRcsi*S+tXi) zOLbm{h9y+^8T|7?&3B}wDYPUR{d00ae|t>dz##PV#gNPn*bWrzul#5RbYy|GhXr^G zhR*sPTS&^Cp#%j+C^Y^dFi;nsU|ZAiSV8fojl*KX?0MK~ZTov|sj11QE-CI#QqnVs zK)pohNg6;4Go^Ys<5=Nu`KIG3YKsN-^Y+;W>vi3=O^eoYau&FahW7LLbNgglmmLI{ zKpDdJN>(l^f({EnuW->qbXk%I34J2&yY;$t3j@;0kJ}`IUv+k>;x^f5n`6BHL#ZlA z$%eHLWIlV?gM_^d^4eeX@{%>WWU294;L${gd+}P6Ex^|o$~v&-DN-&G|5*^uZ~gpS zR>q7o^>sXi$~5wMm^X5=v-5It7;O$2aDv(&Jv}jVvY@;KVs&hOK$H3ne#ndvA`*&k z7HSfmftCRyBe5mW&N@py*976=J+mMPu(z_hndgT|{4*W!v*c}S+ighc1Fnh5&IdR^ zLHFG+TEzw?4S1yO;54w*Uh7KO0;d_vdM1ib)q6bq68~guPHA@0S@72NH~eUE5=K>&;5m`}YD}89t$*DvD@B8JU0M z;!ywH*UsRrv1;%*uQ8^zQ-Av&2lS;0wyaPcZ|X#!y2cYJl>HoE`T6r76=q08@+N~G zR1lv1`X*iqw!fh^!|p(_M+(^W2ah%T_rkc%mFEggyG9b^v)j*;{cjFDIUj!=O3Bh( zSoFA01ZsDs^&3ZOQDYu~|NhH9Jv-Z#q}2pxXZq-QR*q?RF|iWKmsRYM5J1Yxx?T7B z`ZZD4XlrKgiR+5U0||*Ll@w*xX>V|t4Ge-=!c{tD(!c4B#8S_r*4EafoQLDuC7qfg zfe$yP2RoB-8ZmE`poAXR#Z|dS zX@%9ObSEfPaT~FDtj=rSC|#24W_6;Lo-FD(!nS2f4~R#`X~fjtrwj`!9B4?NUD-o3N@w%gH*&z|8#& z6&QARPz&(a*>G63*i1If2o;Dw4il7eTboGK2B;Pued>+4eu>?KZNiAN2vq|8kXc&1 z0YwWTub@-oI!6LFjSwvE_SF!8?V$fh@_Cl?C-J%a)2FC=M-!sxQ!Q3<1)KuTqt zK&Ga$r|0qdUm~#8zkY2!*nsC2E%fsGV$kpk+SVp1UOpFeC8(p_70AH>B z3<4J`*l%Lr~zk#T!3T@)MZdw~Svcwj8}tbbYHgcw->! zAB??vXP%wUdW!wp%pm3q1vIhQ-1ey|Q5)69BC+REIrVY7d1|4}taA=cg3m)zR?^QS`0b7dXT|9?9Ig4$%2lq&EU zq@7iu_HPvS1~^F#UPs#JW^(IbA(^W?t0gNZb?Zi5!- ztJcaMl}ZLkzMcTG2#*tE8@AQ??--2T2@OhKEe94|a}6hdg9M{L`6@hL+?(v$t9Ly) zc3N-JgK5&li`iH;at3nD2QD3)V+x?*N$g5=3zwVkvzL;U9>{f=-S#y^>-Y}8lyu@U zx~b(Typ+1wve()h=RUgc_G-+*bi5-y$RS?{=kT}Y5^?E;s}9!FV*|3x@9R;3DYGc4 z%U>2LgsiX|Zh9a;fkGLc){=NnV{&GO8BwknA~5~Of5gOE*)ge^UvJHJq?86`f!PL6 zgOT<~J+Eo!z4c><)B~afxFpXkQcehbDKMe zH2#ZV1ee`62*ppX^$9!d*CVt>WT673u;9GM?&bwz3!ecQIl20%egUhUpIIut`;Us8 z6b_zxubA~`Nf5Psd1wvSd}k=fMHa`T_dcm&*6!oJB^C%Z2#;etve*rGDF#qH6xhGr9^D^ ze2-|>W}WMJgI{{36r99_nLF1x0~*mE%mkTYP;ua5A0-U z7GFPL1N@wW?a4@!$UeQB#`EloVQ~pW=?V6RO&l5db~;fZy}v>%l> zPSRbz{I(}7LpGdV^4;!Jb940Jav20uu$%Njg7%4(3Zlno_hE-cB095F^Ldl@n_1Bd zR3u+2L9cNVwPW4N3o3~y{%s8^Qw`(j*{&l3EpA-X)W-kE)mMN;wSHftUIjtI0s(=G ziUs)%%V4l0O>fV6Z=ch?{wAl=>F-ORvz`=I{*-tRmRjr*m*X#EXN8H(-S3N}_hi^DFD1)Xf$E8Zl+=CP9Ydzrcq_9lkc0QEn_9Cddigl|4%# z7cvpnoh5bA60(=u=*7d-F@V51}7_RIQ?kVPs(J zgVPhM8JH6nHJ6gy@3#`=eq+)788vPPGuTRZU8Cfn($qKh-C4%RLpwFYqqJ*LRlwG=ds*AbWGBAoFY>o2q@^c9zA;&La)oo0Hj;F%L=Z4qztU-)G-m z#5}REDEUts8%g^#=_?(d*%Eg5`FW5ezQn-5%EeV;Ie(R^>9}8Q@4EKEQ1;V3pR21R zdrP$l+$bW2<61{NC0W8Xkna$j-^xdp&2M>o_|0?6211 zFqIU+3mu)EO^V@1^VB$_g{v+m=Ba~mnqFArVyihO*0JR(@{;ksO~`4&N{V|s6Tma8 zGu51({zs7qOSq8zw+iY#RBY=V*a=NTgK?LE?LpOnD&T5Rn6YF+$xZ_5v^G*Mva7Kh zw!XF|jMJ-_jJ!?%qp6G}k%LT$Fi|)0_;Pqym|8;Q$dAGA=(}-MkxrFsq*e#p-3&Zz zMLqo@0WO>$rc46Bk4*oH%)Ra`ixT;D&{9XLJ#_#|6XOD<}=pvUa ze_ML@bBOF?W17txg8gmTjS|7eXi6X$R~rHRTI4)CmW%b&V<; z`;f&>ppdfCgi?78guwg+fU_wI?r}3vHlI_0nh~aVH8nM9 zXlQbMNTB8P27Q4J%!G=%L+I)^@;1zYK zh|0nO0|U$UmG5ky8H;s&_s-V`PeGwG_P&8CAm=aP2;{oMC^=c0&{uys=t4+|jmdZb zcUv?t!P=th%c%Da2Q#B$k2ygy1}vC2WMe;9-@U_-2IlqkqxF5sqNNs#b}ysuGw;MQ z6eVtq^NM}|HXeF^m1XuPQ<-Kw*7K46Y~12dz7U)6>ovx9{XV9UgzK)d29^ow=^AtW zP<^s(<^ll@iM}@>InK%gF*Vt^p3csv2$k^{DPu6|t`i?$A&`y$O9wK>(*eJ9fbU>Z z`M(Ke2V|2{RdoXcsv>3eFkH}Law#(9#1?gMnK0c99R;0$(?SjOJ~AnoRR?14-;Tt& z1Ldx;utu7O9H|Y0gMyi6eOIsCRhCcH)7>+k{BhDZ9@ui;n}CVCH!5W8zL!jPMQ}oB zqqA680ntaKNmZus%J?f*p?>%Q(B(mIkAC>ta}8E8%1D(7Ibd<0h%d7yDX=<8?Y!F- zp%#38?;yWTDP}{Q0ikSI)OP9zrmGhVzMk00BHc+nf&g`?GR}FH^8@y<)6&d}re_4Yv-87gfR_m}k4dk4yg zZn6pUa4<*f`6p?S7A}tr@2VVa3Km+ddVAMxn|My-@#g!00EKu`4N8tIv4=V)31lso@0HS^tR5)R34S?ppgL})hzVY}Zp&(rP zEE9G5uW#%u1*+hofYEBzqo1n7Jlz+dPQ=H%<(VDn>*`AmQ(W(Y{w#3L=KIZMw%JP8 zrK^72myXyh%n8S?cGqF9V;$3SR&-kK5ws@VFJ3I>S={cmZCj4G z5T5v!M5cB|LVDn%C`N<)!;g=0ZZSx}0)m=ZhP7Gx=KD_}Q|Iku>0L52KXN(j+#1hh zrasAIJl9#0*zH~u?}&K@drv!C0r-TCA{S8XOR%$GmlZSX`A_V^oL#b{24KSHK>xa? zrbb&!>kxW^uF@|&PS|eCV0uouVcMyxYLJw$C{a8=Az`P`Tye0-Qc-gD&+~^@8BSi_ zXEH5~K!KRlnr>1v9M~b&)Vypsd9>p>WCG@|SyL1mm8EEwHoExf$;qnfs>fLDAmkJv?X%&S?W9IZ|KoGI z)0evUo^y-lHX6_fQCC+7mQpvTNW@BQ!Wp5aP3rEW?8gy0nZx|PwJ`Grcf#-u`X8CT zXyDN#ZJ+WgSRakGhE5y_)=_V(!4=ZToEzz8J3U8cA27h3yvM3&t$TC6CJ`c8J6*g+ zsa4^<<{b`7X%6Ka)Ob77cyL~#S~N1an$C~FI+ueUUv>Ea;~D1WEO|YRjg7;@P=6!j zS{ArLw_QQQI?bIT9o*SeGX0-CSrsMF*2e$O*%tYuq=X7Ax0!i(?$iz&#m8$8lu)kD z#vAMNQpqTk7HzXXaje-=Q^e-Iz}CQBdhM`%KPvn3(8Ya7n>9-2fJ+G6vAPx-;s`ogClg} z*J&-Ip`!4B@T;lpYJAJjmzAo4qc`%joCE-E=*?Uw-Z@-U$l3JrC07K}tt81a+I)s~ zkjT_pUHxcf#q5|90-X#Bjn9@AIsYZ5cceedwsRv%l|Sgsb#e-HAp@+i<0ac|-uEO_ zg{Yd33aowPf;|~`e4*2=T%;2QO;`88iDeB&my8?v7odRX)$E?&2*iSf)327K?fhFs zTW;f0XzR}J+owj|IUUkI(OfkWp8 zYhO#e#pGs>gUv}8zXf}iFiL=|bNhH}cQ<>^4k|ruq#VbL(@!&gF7wLwEyWZ{<%Yjg zZ45M_UI0~Fh87SZKqe2lgA0d6GZB$*^-&1Oegf8PGp#WjC(nM``I7xsP)O+1DfzwI zUjPqzPdp#>AE<4nx;OhyKmfUsk(nC)k(?+=mgRTFQn1$tODxrfzeffn7lVql&)y=n zBLw%)?(R1^ld)N0lT&KgjA&sIE|pY>mS`D&?j6CmcGpv`?CN8!k*n_b zhAD;`f(7u-t`MmH2dsF}d|(UvSyPpN|Qze%b(~J05_kCr+?XQ!JgLd8o*emw_QwtNuaJ zhZDE6D=sgUU`9>o?*W5zkbfJnx;;R-AoGwCmpUg}!aH?Y4GCQ5VG!juA46b0s5zv* z%nS+XZw%q(4kegWR_ck;@8+51KaMxj`P^{-eayIZo&MPPSrDayc|i*55WPAUIuR$3 zx&9_a5kSv}g zX0y?&#fk*;vW}sU{4?hxa(7^0{};C*GbiVI9^_`5E2EXbCWPL#@*_91y7u+U^c%>H zl1T%5Mn(UuWJP1pP>ez0q^cAih}96$Ppk#cJw(KVeqYYtW@cxJ>4vgF5%GRFF#$oE zMp*z%>~)zRnGBALds=xy(uK_bG4m|H#4NY*oaMo*nbxyzY-)TcA+DVW{8}kbv+X|1 zVX8eTNdf!BsZASMXlZ^zvWNKJ)r>gMsUe>%DJg;Z0Dj9k9R`{@ros{-WGZbEERO6q zbZp$or5hXk_Mg3iHZBm%JgB;=cpQFBBPu;RzrPKH;Qw8IbmKLotZO^4>DV<$K$a}B z>+F$9wPbQb>0R|UOG54&H*U;y6)NU8m8vVO^a(-}(&ju;3dlhz0P{bU?}^=6tt>6i zi$W6{W}N)}Hn@a@#CBo$E&8q-IS)^#{KD*v(p{Rv_TTTfZSjEfNyL5&l9@4-GGKC` zw*_kOk)c_6d1DX%vB^LBv37aBJd$UXGPC`<=^_Qu7Vy8Uf!UPkjMYg?`sM7 zWn{nipxTSFy=m*C0CPLuMt=`cv?i~7;L>_Y~on#k`Lf$oKj6F9vfvoF=vNwN!5 zQ&(LIz^a@u7ccS{*vbNRH}2av3Y9{w`tsfNZd!he2P}nz64Iy?@rNVl0Ruf4_lg=F z_3{sd&p}APuxRLRr~|HlDJ?1YrKx4V6=PE^n3{N{81uk#@Gy&) zi9%M82GY@t8oLUEFx}*$hvA6=&#$`L10!Hb)t@;o0HlGZ>b4U<3mZd7PyF+bK1(0! z(&h1z(i)3}9pGOPFAmeRyal>2{k_e(>bm-Kgz>ZOHN^$DlG@t4@}NEXwDa$79G;;K z^anTYUWaEn-He~FGa5C2_-vTjkVb|C!fuKNP9js9a&D5pKX}vPMGjuVn#{Nphj3x2;X|P}={`U1$l1LtwGr zi{E-F2~-XnKWuEAf_`<;;aqLx7)J+mrrEU&3=A|iW1v$fN}#CN4R8>#+fir5et6;< z4mV*SELVS?qB&2mb0;<5PW$z1%jKa5{&pk&oF>n;sY8hP_^J$I6N?~6hDXAtE~xe& zEMI*uc_a{JBTsIUZuU^G|ssb(m$c1*8T*9*ngI*ek zZkvu;Jf4Mdg-Z}jIWbB*#rM=@Wawy)zuYScm`Q}_< zP_ROqC-nw3B<&T5B3E><}Ymkv`SgSX!x?c;JS9&;g{#U{k@VUPWG9Sa=d)&q2so zNqQ(@k8R|2-^a2|)2*&Dy-ecc=5~ZU0ET{9Y)mHW7GZdFAG_WPrJ?AD@87?a9rV#r zQsP!#%)u~fT=4qzJ6>bqopG-StNE@61g86TJKrSnW949O7v!rxkwrht-ougX7&aRZ z!EHMHs&LRf%Qwm=tLQH-jEPY@aHXV_cG`JSNH#W~UXzG1JfgKZa;I)(RO1vaOuf0f z`eY3Z48UA4w|>$_#M$})$7Hngp9c=FI-UM3yjj`i$~h}7zb2c{!&KGn!YN3;|swWwrdl|bp;WXNV)i<$Bw2Qs(Pj7 z=f{8iXzET*d{vs36Lr8(f3G=wk&4&pF2M^;O$IfA7ZuQ`E4b^1T`Oiv1U1^uP`>2Y zk3Y7D>3mSNkgT>^!y3;@ z;3~8=yCDDDISt`&!Q%#g1|?-;opVHDVq$5jqm4}gP*rX}+uhrPAqp75$IQfxwsAda z4mTWjFgJTSCbFvq58U?~=5=FmPqL!@?1=M`u-6Srpmki>nQVQEcA&GbkGbriTO&T# zXz(7v%~uceQ&k*6+ie|I0&EvZFU`z-0n!&gW)Ey7`z-^-8_o91#AutFu_MkAK6}hh z8(<&>GzKQ}4Be_dX}*dOGN`G?dq$7sK|c1RFiSU(jdgLM&E@A)bzMz4N&ol2onKq% z1?F)hlYzMPM<%1B*<;rYjAQcq5MJf_ttIw!tmVQ>0%VdJa1dK(7AaR zIYNJ5RQ}*Eum|5$z}l!@dj#2FE$o_(_;@lDFgMD{3Gg&m&^n;BAW*Fgp(_|f;;+)X zgoL!`=#J~7rS&x1!P`A^t7oba<4P74b%%Qq+!28P*I4aXTT9734H5;hRuQovB-VCk zu{!b_wA>{KV33lI*69wvoQ#P?pQw!8NgV@u<|^zir=ejZSMEqt7>byRD=sT5yy)LQ z9~53aWH4KAK;?;+*5Ly(PKqa_i7yhF3GlU##)=%XKQxXz%r4=zI7dg1Nd%@5(1X&T zrk--Q$itVKzHvAVc73^9SficEr>iiToOL1g9TuxXMR*{x*p~~`pCXIdx->NuI0gU< zc0L?9c$LsiCoD**M&mV0&JwqqYAf{hz7F3hlJs3 z7cTKgP>|xlKf~?x;j~+BU+SPGu{jm zU4-=Dl+jykJ*`>OLgUTSOim)OeD|M(_}frm8z)nFLy zPc{bAd=zX~262x1dNx3~q6(tB8SO;|G+M3EiU=37yYDyJ#y#KO4*RU`U}{lp^(I(( zsVjACWrfJq^?tDOUrZ*vFg{xjStJwr`AyQ^3A31i9!Ea7O~R9vV^ji(BY^<{SIviD z%A4uYF`5f_EqQ?&wCpa|n3~zC3v;MCTfl6%KUC9aycR974hH~eBc+%96&|=s2HjB3x_|8xS zwzXiuYeZhzu=+D}g@bPBb?5`YTQY46rTvqbJ@Fc-gbjz)HTz?Z*qKf}-dGvs^zm(< z50g)3hpks!EHHcJZ{ldM#hwKS=0mC58iRjbWeW{R%AYj?&*GFbbVa~an{Q!$UIi4- zecDE3HGeeIHSEd15TciJ{j+i%}+n7mm~%mSMn!CSW? zx89bQA6cK0++JVzL8oB)Q@DB0i+;Y?JMBvGpxbG)FLwa1{I=me$nNCN8fuBqSs*P78vaRP+(&6Bj5c3kz=51?A-A$XpxXGLvIrk5$uA6Np#Bs7F9%*^DXkApZA zhCe!^pxDcE*cH^!AeCfQQdZt-m+l8um~&(!sfpZwMY$Fax%lW4Bnwa0Zb{A9aUprtZ;?%D$adMSg?t=39- z#B!=K-ksv`% zM@OGe69hyYC%m_ejHE2R;^H;b3(d@BzC@6n!~VIO@cRA=D3fPoT;t+On0gEjvPX}W zu&Wg%b*r|N`7-jly!Z6ZTZZ9VO3J5-iVy<*0|@EwSz1~?eVV(`W~>p~p^fON2$~$O zfx*GShKB2`tddhD5fQ@x)qHYyPfbb5feCC{by$OLq{~1rmMOM^sm_ZVH25vf;P=6< zT2Kdt`p{bqnAjr&h1zF|{{d1yXJlMB^o!7sP=x?~a3<Sm8RW>gH6P^L&-N^}jm@1qaOtz-qBB7rA+)a%6Uvsca-(p4pYm)YKG`k9IRQIA_4_Ar72a_oR;e zn!t0WEF#@;Z|VjdF|)22F|X$z5S{A-!ncfu5faQ$Hk`_o<+8S zyt=w+_c~x{d3jyKIIjN6%KOt%a648;IJ>Oz@Uq}610DIGNiz zGz%h{o1T#0pm)Y}U?bQuhK12of2NF#`kT)=^ANPYX4_jK*|SDNP~6DW)ZRQzxTpB! ziS3R_&qA*|Ea{|VW88TnI4fcArk6Q+Ss~C@jtdPIuX1E^5*%Be1VLq?z^al5IyOjN zg!lXcP^)3#DlLD_&&T*Nja&Hqb%x*xeQ=imktJgP*EjP1Z~=%79j7Jw^XXvdW1)4N z+HvCT(7k)A(6jtm{w^L|hD%CR!KHa^y;;Dxzoxma&TO)d^eMCJ!Ap1+BS*x_NpGAY zbd4@4!Pfb+NJ&YVP5Fy697>4Qrm0aKtX8g!w%2&rJBUHU`Kvle3Vxq&QZ7|<;3`{3x`}6e& zH6cL=WK-kj;ragp;T1uw=xt{&fB(racFRR74kv76G1>+HE`&ZMrOzGnz>1Y&783KK zZHbqrprhOF(|qxw4B1DXKzjzuRgy)}Fu>EHJ}&b8#>n?T+Ris;D(7XLa>>x7UF zI^&Co+`NY(gno$Ld3lm^VXA0{apxn0^Q=2@@!BWp1qDO71OJwuOHEEl5VYs9+L$@8 zcI+&V+Epb?z^J^Uq9iu9qoTs0 zGYN&k*w6E@!^fk2070ViIV>w<;|L`2QBRZyFBBgi*yngFUocz!9?*8{&qt|k_oS*+ z@fr-jq<-*R=WBB1BD*r|D|VQO0Y_P7X~fiV(+&j%m8tM>Ev zkGN&JG*T`n=Jf!y0FNKv6~bZ9g0i`}S(b4Nzjl*BoALv=FC$iPU*3(v##)r5rN!ErvnXcSB-2tYxQ)XB?o?}=KtMDi-`#dkmrZoGBp|01aE_#{cTMs z@E~**eR^*%FDq*Y;RQYbqx1vyB8%K-oc(NSZ=q!$XEfNyt^YcC8Hr1`kIBFedXJ1a z#eVy?hr!ebLH^WVhC)Gp0OL|G@boGEaV9sC#lc*Cljo7_C{uX< z8#2hvr$3K{*^pP{SU+(sIEX+wu)!7yxwTDAnORvG*~vKbS>HY!B@{ol;2l4nFBSR$*jn%;oVu=EF?(>4;Vh|yVkBh4fRb=)T{SX^_g%J7^f;oUV)kB=#UfNF^ zs@>RFkP3S{N2A~NLvMR&lAL_%zxg_wi<<@k!3v1a`Efcd_7TJL?jvH|4QgS6XfYY)(W&$t~1&L>Yyr3G6xnpWVMr%AOvj;ll$tH3qo>Ao-wK<5?R4 zkHC$DrtQ~zH-5eOD4WP>rM!D}bxtw_-LjAci|5a!)7+a4Dj%LS{XZ%5GBcN2V@eYf zKW>=|S-@H24%K^oSoGb_YGB-2x@bGxboIWz*eDdu39OL0SKm^d5$Vw`D0H@lO zzfQHRys;RloZPQP&h5 z{TAi?=Z3(mjvDMYh)ypm?dAo39%JL>6`{Wq=ItHkZOX^QRB9C_O)$EgKGPDFD?1w} zQveah&Sqt_0{-TA91;>9NtOevtI2E%q`+Ot0Kh^rOdA5jVW*XaUM0TcWuHGASX)0E z=Ese?Npqe4Yt|f(=FvkLWGxue^+YCDRJ?2o{TMFn7~N$?nK9qJ&cRvV-k#kYG3+!e zyER$Q2bmKeA1=MA8|@hB<>e+jJG;2JG&>vJT>_uwwkDEjT=`Yvf_U##38Z#VBta1Z zaEr41Q-vqbtU9l?JWkhi)}$eTYaaNOC=yFT)J zntphP^(PF6Vc$PcCh_?yC}>w@ zUIE`hdHq(Z^sirktWTe1SAF=|OIlL0^h#Jx#tlUzH(6R98?)J6d#y42{a{}M#sn6m z53RANjzL-U1}w1MNa+GZmZzulUsRqjyb6oeqvNudMa#lluwC-A8Z2MnJ`1y^B ziYAc*o96fGP|XVOZ+M8&>ZXUuc)(P>F3@~oZGHGa)Y^Kotrk4X_AvG$dpZdb5u$Oj zJ39s44PXmW-`o5CFm;VQ4U6YkjLbD2;~}V(UKtv)YQql&vqnS?*v3XjgeH4r`<`8P>Hn$57I-zzIpbk919wKy;KlfHia8b)yw zhaTnfOAx@Qo$7LISeSRD1BZT`9TXrhVxJCMoDwq0KaZE)y9 z)18~()vS(%JC&>R1oz7!p@kM%CLnFb0|`%ZC&x5I$$c#L%-OTQ@-ep6)kH7BwmVG| zUvC~m%9{QEBtpvf?ir-3(=6|i2X5rx5L(MMcF~@75 zWDK~3qZ_i={zcNj+L{_MCs4~Aot_3RN?IfQ{b^P zbf}l|J00w*2n#RmNg>DP2;1jP8ob-@0Je<-f`x)YT_~hoU`$(6qt6G)-wi=XRwTpt z*#!l^4b?)Z)z`0wcFWv|JSa*4>< zLhlzNL733@}F_4TPk zwL_%>`u|zmMPK|aH}^J6Fzh>UzdWgV*CC4oBg|LC_uB&iaR#WJFvLMKL5m!V-7lSPj_3s-8bIm)d#tyu zo5G5(x#)DWjR<#xf!=IuOy$9T4Y!|!3WzP%c%jT!$GDH-Z}ntNvh+E^-*Y~KByh9< z1jFHX;yf7nAWjXx-wk+W;KyC7>7{E{2|h}p+e0d$K0b-%{{fl80rgRS_UxK}mN0F; zQK_A!g_RX};KhAZRbH*45D|uFTU8Y|?8s}}6q*P(YxeLfI-iJy_r2mO+S>9K{JLQ3 z_B{_mzNo%*t7o{o`)<<&w1gP0e(Mwn@blZkEF-pqT;9NY|KF7=V7>IR#?z21OCDT8 zkg`Li|0>lp$!uuNsN3l-y(hM>_MpzOT^}Q%QT}ybolhXi8oVjUphWpVjU3S?;snpI1 zN>#wG;GMsh{{C+CE;7F(p}#nSdqT`*qT#Quiv~u2P?NUG+4BMD;2Q1*wOKJI|fYbMR3nHmx?v=j8aw0oT3^cFv#}O z$$1Ph;d^NU(+*Heq^1}E4_xTYR&IhabmKZFXEA61JY{(%5^Z7z(KJRe2ay8!-xUVa z`a~pKygXe!JQtuS0r74T(@U~)L_^t7ng?-;2$)_n8z{KLsV!^>J8$_gdM{A`Vsion ztI>~qudX4w>VTjC=y9HcLZ1`DPz$GP#o|xz2muR%j)kmJdy!(};hT+VC;#`ZKpOB1 z0CG?KdzYNHg)Bg~`wGp2UUwTLz_(OX-<|mJ@n>(gh684C`mpTBBRv66HEL~Z%SfhN zI!^W^{n+?;F0vtKKsF`L-#;$2))?KpQqPW=qX9g;zL_0*sNMJehOKkJq9YAlO0HbF zom~$Zg?u&<5BPV@=IGJ^9#DcisE-lb?lwLYy{5VcVNV|B?%{NUtA)TL>@v)|OS-vh$yJgjXH4SFb|L%JN-Z3#%19KR&w1IpqPM3OCwpkdV-* zbY~2og8eFLtGD6KJKEOOK?Djp#GGW9eqm0*SP2L^e?r`hoPmKERMSw61+5P|te3Y$ zl}OyBS*&yFlb9# zedMzi-9c`tY`HW5Ze>53o4o**#ItdJru21tuJh)#pVCtfkkmk0dx)PPe*?LkmsCr> z$|@)f0ea7x3TC~R!Es4h87l>0ST4S)zM&-RRjobvJ+=2bBHwGqClP%NuRx5JmKFdR zV&+>|lmdQJ9amnAlUFAol@Bdui9Y209nORyg(AG{~{+B94r*#fI&l*E_ zExc$KH^Y!W=}eAPbzeoJbY#k#VS=CoM%Vz;yXMi`{}U29BYUXP)Ga&1&}k-xle0rYxRNb z^=0?sWZ~=Ljl2Pu0DVJ4CRB21V+e)FW`_x%@6wVKl)l@6|2co$KYgMQ)hQn7j&@ax zmol_k7EX!V^z~^2!pWQT^qT32GF^iP_PxWzO;`>H7ADIjrKPT9z*qtOAr5x%8H6LO zJ(Gg6gD^OzqgCOx+l zso|3KIPl;`{(WNT8asQpSPlxB2~I0B^oA)8lYO0IV=v)fM79nJQB(NYBI+B@N`1jN zn%B%&UQuy)R~FP2obI5lj`EPN(VeqM6!Y3@7Qwkx2ZDj+aXM6q>UjO%=P2MQt4Lu{ z?g4q$v7;s2XoLIrC-u`E0eaqA%r{?L4AFH!(h@w6v&iFlrlKOi&kr5Qy0X}($qI+% zjp5W$6YKWjpxFyE=UYk#!`K;;7X+b9$?@PHPxj5It0zT5Nsmgk6|0wbislGg`Q_Oy$GxuR)c1p2aEb#%QWt z4KoW%dpoA}Ijiz-`DjJ}|K!JT2v=kn)VdrKdoxGPg1#AzSpr+lsgK zido#nSxxtILAvYy{i>7nqM}DF%!~c}8iq~$D&!67GX+xN4C;A_2ox|Wkr)M(Rtscr_yWt}Jx_MJEiK`%m zEzI5XjA+X6UcKS@L``ieaeQxz=*@G)q=|s^Yn0mEJtzS?EAhAl>xLn8Z&O(P-uAK; zYWDYCL|$5o5)y2{m?`pKntlFH`S~F+n(Kqbr24ON0d+apOm`g`GJ?}T#``!DU@wsU zzNbL6fy)>5Q9KS5pb|A1Z{mGP+0`nwFyWr=8}+T>D#*%@f4SMsGGx1$T2upW-c1@M zk>wb@mX9m#q8}PkB(!5L>qiWmk66#%*2CjrRy0r3($eU%Ce*2iHbR&HetiUPAv=i9 zapM!uS>&yMUy*XKgx|ao2dc~9K-15kIy);vRJ$Du5Tu`FlY?&wyE2!G_95Sji}u?d zhzX%>?Cpu5hOmU1r9ncT`RV=p_aQA4*Giz)K0^BOnAkyIiM~n}e^pbSu1s>*U5v;O z+VF$7_mjrk76uJX!`2ZV!q8}=oS|#URGayE=dOnbu6qcFoxi{9y6a`ROgT{0*fl6X zLc5!sP+;?X*@-heLV0-*ZckwP0eY%FH-vXWBL~+V*-4KML&U$qd_{3*k*Vds`Wt9G{-V6Z=KJmcp|UtsLFouTRn36|Ff%ow%`;y1%7`E-wkORdMP!-Ew%P`mzM3Q%qz+?l_(h?2E&M z(W8{g_?fR30X*CsQ)*|iv{ffytd0)epAHa06VeR|UYlu~YIM)dOi^~61qx1As(&9M z1pB{B5@}I27p zH~w;4bE~OLL@8sVKA1g!ad2}ry4iCH8>3RgCi(#)K{NVb>|L`+8fA~;a}ZhaZW`>m zzCYAHc$dG>rm8KOubYsNXxIj&U?3W5Vb(D+YIbyiuRw#@w9y_@YKz<5o|Dus+k5pU z)gv|3g?HWf#O8uh@v%I;{a_~{`{n+E@w(jP2-aOu{@%9o%x@!se!+q|6+iuQ>KvK*a`$X=I@2&}iJqY!^HSWU6`{WaX zl=Sx=s~R+}?xmJF+|u{7a5xxqg)P*!TD!u@%_(At-QDH=)~WuY20dslj4>Ji#I5<> z)352L!@JhZn~QrEsihsuZY0;0_9o}q8+XPkcXNl=VgnucKY)}2or ziGPRh`T)oqbu5Z$U;@!CP-p`5cYpt3Cjmu9NK5~B6^Pxuc@i8;0FvJ$X?qS>J&OXC z-^QfbX}@Sz0BS8fy!`@4dvd(@RpsU7z&$!l`=AWfZT|+?NngY95wvPiD1+rR2&%B{ zjQGZ_Q&=u{RCQJ7X+Ff)9qEry5HC$(qv2=8EY$mJTo1XSmqIo+GkaFL(IyJE`j%e3 zf+Ix;*>+b>cOce&wB^9di+a^1^b`w9ox#QC<;se7wPZjOgzu0Bm-WEwetnK-A9$$c z?)2x!m$A9nlr)0|s<}k`wszA}Ta?_QJ(#>c4&N&2Sh7b=Ef|Uzh8_%@n~n3Nr}-v? zkzE`m6~-w|&TrQ)6fT$S1<2nLq^2p{3$)}u#zEIKa6IB+95)^NvX?e$Wj|W062ESr zAb+N3ox6rfHxV8{+bUWFm%xXD^Fv`vYqr4LO{y(BcyEJZiDx=1@ORPBty^MPU`{{z;+$>|SLNEHw%CMjIn> zuO>Cit;k4DKE8Y$X`<2T)3(49XJuncwC3R6^oft3cSJll{#>^yU>muT(bK0|I1FR4 z6$}ziQV(^$r>}G>$e8GNrMMayu@2i#-2oPmw;PjIFV_&z>wPk}l#o=Eut$5)ad%ZVmTEq9%lP?$ zju$IvyYUa-NokibA0Bs=^-Xa|Pw9WKG?y8?Frs%cF*OU{-m(V@Nc^RP{BpH>8-*D^ z34nIT-uM;%KPbZ=JCWSpZbjEaK~CwNBIRur>U(NQz@*Yzgges+2zJYx&)5tdi3o|T zaGAz+a?SOqTaOZJVcDD$-B@Z}?_Tca$=1K>Vq-TjaZ(O2AAOb5X2!J&Tl#xt;iaGe zLq$WKtvPILc1rvGH>keb-r+~S3f?l=aLKZ8NL$jHc<((PCK%1wsC`xf_|oJQ9s*P(w6 zgj84x&M%(hi+mrkwYQgBIYxVfHqEH598L@4sbR2YrKCKbZ*)0qAji?&Vr9}TLZb9~ zZAZL@&g{rFmk*ymCY35<^5|uY)AO)zv2Y4@W0{~|w?8*0iCU)M%}~^!|IsrV<3i>p zbx~4MvHsCa^2&Kp_<{?3JH-~&ja8lHLkAH<#v86>*58v$i${Ju(Tsc7v60hPDeW0{ z&41X13_9U4Zk}YKSH4~4of*BZp81#`xA-f0+dkwBXA1Bzov1H+A$gw=(=eVvRp$ z!tOVOhNw4~u^A{rf}@079mAO1V)_vcKkNKRE-uoqMeG`)(bvKOGe&Lbf`@gEB+c3YLWi)jC6iHVz zKDl)0tpe?4Pw2f77bV5UZd8&6?(P&oS$ZS&{$Y%~a2O+phF~$AFdU1QO>`kM7{lj! zEpmPDH3Sn0!(_!F$LzZ}TJHYxFt2_4vf^=VslhEVe)i2`y&hiUC(DaT$w_*i)^s~+ zNj4tT!pi(H8(YNkFlDb`s3ZpjLF0ygWQc6z8rl+Fp|!`dQj)E7Ke}6nr{_Oj}>G|7Psn##H_A_y%63 zr%yKr=GjRv@IF>9F?`+q22C$`0ClG#NM)BLov;=)Tiw|ZE zkEvOf2X?y^HBwuv>;9ZW@TwyNIzMF5hARH*OG|ToS(-JG@6~fHX7}{F%|!NQp3YVV zBYD4I!{PnqJ}!bn6-J0mjE`#~e912>GcjIzd^FDe=L7u)Y_no>Hu5;h$;pQu&^w(J z-x^hRmNl%6Bp*thS{xpqX%Z>2Txk1I^pPyuvH#1lvIDDb6{Tm&oz$9e2n;eaC+)Vi zHj}`YD;XT&kX%DgXDWOMKu0F_*@)lb#C2nUQ0|L7EqgtCqZZ(F# z5{8lRd-tnUR8*kVKgavP$jAvOU6YTitKy6X3be61H2@;yBB}$wo9;F+1_fPCXu2OT zz^izi4*-2Mkkj~!Yjmeg4=5;0JbdIsVqkbMyuEW2D^FdfBJ{c^A(Q%!t*995Jt<90 zeZvOp7mpLPvH|cRJBz)Tzj$C1UFK9~HJ8%eh0R)mjM53yEi-@&)AMyblY%Oz;0p6rNls!I1V^%$KO&>j(c1wXOZu}TVAsV+e^37@i|(y8(HuCb z^Gb_d$c&{?`;CFi`AiH#p|G8tcGf~rcJCTPxV?79cSat?L~Cje?OPZ%?y`&QIV`L& z#%j_);Zto~M#IdWet|D59V;<5W@I!N%&qxg-xqpH=Lz#Mb$_D=TX00X0YGm2zBNX} zcu*P0-kUfHbi6gwqp@m)~eHw+N_%cZOv^-W?q+YFCSP-A`th^7Zs`3)_pwJW&7O`LXz4?z;C| zDC}n7>(D;?nUH1*-dz99#Mj)fghRhXKBvE@^y-JVTn%*&noP8>Gvls_z^nu>MYkBg zwXY|m(9I!W^ALs^6AO^R~bHx-2M=$g5s)0gO|pWsozA4FHw9 zeceWrlT(u?;ml;wZ^D}HJlC@eCX0r{0437SHwImD{Jq-;G?#)XTFS`jgyCo>xDmXmaF?Of)f^ajR z^^%2z1X0*wHr>(#P$lg@5cCfdV}LF}!-pLDAFSt``-Qq<;-NMqd)d0iAUEu^Ik20s z(eN2czbzV}Ti4-WTYWeUw7s-8lYIJ84aeow4hu`50VjUogks?^UljeoSo8Qxp9SZ1 z)4^JCI%K9UWKbduALL}IMWo4MmWF_*n7U)@PgYS=kJ$%v3L#7z4zu1M(bi*(T1XWb zT{?#8+nCF7TsCH4V1U2czqR1QCU0YN(4HzLD70i?F_BM%-W#nqj-ci3?QfrN=v{$0 zm9BQ#@9tEk?fRr*+`AXjp1WE#0V?g=IQoPMPy$nE!mF_%84ToE(j`7OizP=^Cm0~|tUPz{% zz}U-ygDCJ@s4SiavTfaU)yU1wRLkD5pS?9#v76oM4Um>`zuKa&^%NmJq-2Vy z(zVvneRz69!P`qJ>qDtR*?N`1l+Dtm`7XtzST;l6?Tvy*)@c5M;oGy%8`-Q-T6P`cfarN?_I9Nx_1%p`_A*6=bU}^*?Y8v|C-?HyBX$QZ}Zk~O5HgxT&89w zJOEg0DbOp&SA?LpU$s@cl^z@Ntnfn+dm=t2oLj|*Z2AG{B@`%Or6n-G!zU?p+M=&) zdh**VpR{)Oq7)y)nJorO1>e6Qn?ceY?9zhlxN}xJ`OsyFY^-GLAt>_WqRCg@#D$j;DDi1?Y z0O0I(ca1)Wq-)@cor{wW)Ro1@SiT(VXHP~}9Uv9X7VY7`Gh3_W5KF&)Y~l3a^!4l4 zqgK6-oMIgBxHmQmLvHWvmh2#q{?Ww1N?H2H-CC)l?4lY-aMxzf=zDLtwSn^%`k2(H zhUEB)pxM{#AZuBY28d#G0tSW6;Aa~4A#$&NzraG@9#hnfQjd%*iu3v6x85Y|FyK|t zjP1*wmTL$-@8iCW(tdrs;eSE-LW+-g-?7+cTT|ZDOFb`$g;mZi+7?8Ys4f{9>mMyv zhFDzDFzHW;JRi({iLTbrLdbsKl_c!^uh**hSARF-CR%V!^>2g?TVb?IHdCQ$kS0 zpP?{*cJ^;1(w3C;qe`Nj+Hli*UOh~LQU3P`t`RREQzc;#UOSa7O zi7%6LQ}LUKa$Vw6&bsT#RRv~)KLc6yy*78_?{C%mA+@(B)8caOdEQ&x#%av6{W(2K zrVfWeQp04}_5G^DEr-2!rZ+H$8aG&dJow{n!IEcsVj_6YqwsiqfA)TeSfcsh61L|{ zjE}J6r^Mx}FgQssy0_fioUd0Y*6Z>Qk*j!Jy-jcsmfL-UwT&}#ftiTNdSz?t5`nqR z|8)%N6+$yTiu5}I1W9c0xQrzl6%`e7^s&wSHaSd+9Hn=roOEI-w6riC=vA0jo@tk6 z5OiDo+0@amdLlC;V`yd-%AtPrTHL6^ZNXKi~M@#2>RbcEy&PZDh;CMQp(({R-> z*LiJiQUegMwZ2vP=`wOFCm&D9>Z<_yV={S3Bn3$MsNw^ch2`k55 zMn7`Bwo>LdpSBhQ_s*Yg1FugrATRq2dl3f9TAAhLva%O!J2>?Y6l`pcy#6Nex&FPx z7k*=M)|k{e7 zfC~L`nSqXyflg&VWto~|p*!K@QR4lNza~`Tyqr}Z=7Pl>s&rTKH@Aw<+`#ESFYw>n z?F@tH0G;~w_TatqYXZPA(?{wqE-u<(c5SP%gmJifI>iN6LX-EURM2b2m6x#GKuXEd zhx5$o)Bikx;dMx!;`J4RIgmQ&n-6Q+(@F{**EY8p5C)Fr{55+Drmkg< zvs4cEtZ@3sFM@R5M+S23K?|`10)rtFA#*2n#NT>MVuJfWeHL6}&g786feg!h;6>umS1=G(@K~;_do7wrEs;!pigfUP`j7pIJ?6hDPS6mq?rY_s+egYfM5{~5wVI5!M8V&I z=>k3dmjo@KoWRfuEh%sf@<(HYw{xGCM!b86;&kJ;6`LKe-L}P1Q&G`UtiD+y3@ZJ5 zi7Pno=BN3Wlnh!5%RH{Bd5%LKW0tTDl9SC5I^fqtbLTsUzL<*jZ&qCB!>%!s$qQRs zTTBZaP4<;Q)wJ^IRi<%xL4Brr4o$2mzCL+?R z1$SieSARvBtpvV%cZQ6tDF2r%uueSxW@3t6#Cm{aQ#~>9@^X*twOhA(M=IhIp2xm< zv&~BaR`()Izvf8l{@kMzA|l}aV7FW06RiWqJodHXKF2g%rdUr2l;c5%-PRzDy08&uXc1G_>&Ic5c1#Lp1rSDa2KcvKl@Yl(cfTQ&wTDrPk z>~G;iu84xN)_@TZ#8&QmAA5l{rCzyn5Vrt!K;WLp0U))z*z)CcAj^M4b7kjtRI~o^ znD#lA1K=;5k%gy9S1DdD$jdv}!gz~`-3PCgVTCvJ<4&HxvP`H8WB%GHiMqsnxs=22 zXpMwu?BPn0?$zyE+J#^9@?O~4+4-6X-n-}T9}+@N2J=FbM!>)XlY@@vfqM=;h6cYD z@!3J|&*5|g?cy=tU)egK4 z1SORXy1n91!wM%nM_OAaiWnff3yO!guV!U!ee&c<9^Mp~Wfp?CC?*DuZM~YD@Fo)K z-_Pw|>mfNed+(WeLssA)DA3FPk%~EXrl}TT3t0WVm~B`X@))hqhkUfEg2=oI!XGkP z+85pR_?T9#0`xXk-klSr0YO1+plig#E2*dmv)t`K*fvZ6rX)$J=dOALn{k0@_U!B@ zkcEl3Z5}4t@<#?5dPcxz=hLUlL&K51&Y`OG2yd}lw-(dl>OqeAmh=*ql<}^?bn>Hz z%_x^nXQ9c{?M~So%~ajaXUDEjcx|1B7y9z4oCf9ukEnAg{HJrXEv8oKC6P&+ab7dmJ=&iYFh>?FP=wojGF^4R&(YD`Twi$uio9 zfmjrNXyVGn&H2g*0o%P|OM!!WvZIvQY0Mh(LlMs%t8!;D z26`*8Ng))M2kg=tZ1bYXeTf@a$8!7!F*?Xb`#)~iOu@?PORnv=OiP6kGR2`P+s^p* zdHg<=4~a{a3l|gbM#9!_aH+A>Y~`f=#grPZTel3O5AMO5ZOqm|^Fpp+9{}7ptlt)T zX|CAocnRGxy5?12Ipm}mveA3;bAP^ZWvN4T%)J*YBzg@40)wr$bKgpaZL446(o2>M zECaiA#uBDK?ugcYJ=GSN8JU@t#XiXfQ_V4iw@0V0_@Y87slx@Y{mfWRPWE>jdeY2& z_&fwU@Bjj3OA=yY6SK&VA3yrJnBDyN=dhsyhVRa5ucd5J|y2D$kdiCr5 z+9boo@?r;BMbXeH1H*}6MnttsuE#_@pRl9ZZKln6wf&Wr;o(S&p49v9Y~Yv?dGj~# z|KFR8zjozH6_avRMH1YfBYxOgA2(*+0h3QgU#xGjj`7ERx>XNnH8V?)i zknN)@73L-;>iuAXUg_J%eq7!$_{z}lxXQ5#r6bVt>n8u=p#Av#6kz^>7-1(H%y_|L zwTRCS)W<_^&vLm(3oWBjacKX+NcGKyep!jsLvD6{PIWXT@WVY~@>nLOn~$l~ zXb&>f9A3ESM{vcZtN#-9+JhM}#Qui)%-FM}i2uGN!qR0iQE7|!14DjtQ>4S(7SJ6Pak`AVS7Z}KM=Z?(rZBx^k ziH4Adx;p4?nsYM{9W)fobhwkz*^Lc8-wY!Y=C9V>+8FA&HX&t$DOd3_+ON`8nQ5no zv2QmOQ}*f-g)gF_$e{;}2;52o#SCYxMsski{V_h|Cmkwlexx|b|7n@`)WB3=xQgFM z2)#XmiHXdj51ui#{m^B(O3wy+mYVI0)M4P)#vxK~im-lpok8u)UdkjrDY65TPyTZB zg6by)&M`)T1e1Q*q}ys@gND8n$J3IR{%{-(fBR-9+mfiHlnZXsYcm2mWsZ-lJl*j4 z>lmo+p}hIO(l{Yh_^YD@ND_ zs)KGs3rJG3vNmBb}lLpE}*4yp+K zVA}kdl@klWR}}SGt|EpF6a6n zV?>yluCoML_hh92gR6FUb4GFByqA1JB3Zg2rwEaGjp--H?eNl`digT^Oo91~`etAE zR~O4Zo5sOhNu!DO?2l3*8j6CG-l{aWINt8`R(R5Q!A2(~br3FBX5w~U99bBsgmW46 z1^14LtCw%zZv7}Qtd_2<-jl8nQ&wo!Rlgxpap!l$g|o}?2H|b|dlB*@X^E%0_#%c$ z1kBL5;D!1#)D9sr?8%`QEmMU5<@|dbbmax%s3z=Q$s4zB-Fiso4I1i94}2J3E*82C z@TZh7V-l{L%6kkvtNAYkoHkvCq+sBn|O_0Oj$0rY4t%b4V zrf9z}W_=mDfz-BCVPamx=jr-&C4h2hW?=B;0KulIqho^nhC!cH%lI%iborY~nn?tk zVD&cQ&mo9-4hXW$%u;M>?e5NaC@l0V1Lj66r##rRvjQs7gwykTn$+*JJ@3O!Ss>4X zYdVB~7(0idC^Q;fZ+}Ak@keCrHKvSi{+@=zc$?6cI4-1l=CS8r<(~Mn6u|P!DJxf$ z05iGNBjkjbqAl0v3l9wUW0$yJfxfo&3ERuYZbxFe?*1}6N&b{G3hdIcqR3RMYlCSH zA-DC<3%0G#gk`GZX+>O{zX-C2UpHM<-W4!z3+8lCm8Hz9zCpK&RDPhTo(Jm5B5>NpI z4(FM(XPajwSXfvf6E}+fic)%Y?LO0*F?w`wZ_iv+ugqI*7bj#*%Yr!Cb4uhsefEs^ zz)0e>WOxmb*b8p$R9hg`AF2&A-??G78MzrW-%A~KQktASZ5VC#ajNASONlpje|5qX zPFw0QD4Rget1m~lR3V0~c}Tm64ctKY)nw0fQU2Fg=4coTC{{W`yq-J5NXppG?ypfF(M7TWn}(d|HDo zF%j(y_2u|;R@SQK;cpQE{_g{*!WzFeI#73{X{&sFlHejQzrXjVHVmY6e{!XF^zA} zsvi19S_(f?ci+05|Im-(BMZ42`u3lnOA=(c(c$5fzYKEmSC8{vOuPap)APvf?S|sq zU>;1DEma?t`4a!umt{)K#6#U2+da0ux48hxrK6+V$jBCH)Yiyx?av(8 zUl}iGZaF%{dLKIdI69OqjA1tnzH;bM|2}0d{oJ{V{R21E(Te*2>ndsD>be8@@#I(H z>iGE17L;hYOUKH922^jwMomURMuaC_$$K8hd6hapFYl3@9B7Pl=$1L|nMQEvs1r(6 z-KS4^qs|k-ROaK#-BV7O4wfM9o{CiUo3|e>zdiN#@2L(Hg7jov{ZB7fuQP$atUnhG zI_!L3+hpI|#2px_wJ_@&DM^`WDSrS}xC~D>lBp@_z19j?6>w*%Y23GNsY;QaSE-fLRsY2gpr;H?e%KdR zJ*e0;zkYS2pwKF`AA&T#=WCX3Wvc(8P~md-COczQPE~9b_vtg0A8&3RmTg`N%e*om ztw77dR4KgOX!&8g)`5uyT#`lx^tbcT=zix=a{GPf_>UjiL?al4c!z*{`}$Nt{>MM? zo0qpI$HymrDNA8kk1o>e5=2zsJNbEe8%HhzqHz0ZiC89K)Qf1Rk&ppCNO>I5-PhM< z<`d_CPf!quQuG9Np>JlwaWE=HXKr z_4jvN?i5T4BMPDwDzt0}mhaX&$aDEqNZdXTj{01^pCx6(mcotIpeT5ej&2~&ut!e+ z+MPR&ZJ$M>1sI#V{}X_?3EMUF)vH%9_VMi5Gbt9R825H}Z$c9WoHq}oaXF%v5LYBb zDnu-ct;|$2LSM}Nz*f(r5?fQlH|I~aNZdG3lE93{1j$nOvxnt68aL>pxU{RidZ6pa zUA8n^QyY=#1@i&Vn_dU=vD@I#>^++h&`!Ekw?(2wIQhnp$+4E;*@=f#;X-Ip6}J~_ zM2$lsHKXz=T)5bmsj5QkRle2R(?dCSePd^}zy@1|EnWXw?DOB}fUluKii!wI%IlVv zveqPS6M&{AB#=X0a`0+^MzpLW4yho(&E1;#pHD{2lZ2r$2B4Iqqy6Rg?e;HTP*B*~ zF6SHf6!no4CF4rQlN!hvV}8X~RUN%QqvB1E*i{(BLKWPto&x@%$}xIPML*_5rIV79 z9zIz9Jl$rgRq>|GP4Vvj{#-$IT&zK4Z0zX5ewZ!e7on~FyjrPKxJtvwfkM~2q~L@- zr5ZEO$D^A2jZNtX{bZ~=2(!N^s}w%ab_ArBqr*eBJqo0H$}z%a^K8|y_Y8hSZUjz6U0|*ZALdP zQc$D5bdRAOX7b=PcE-~h_np$OdSCUT*0ekMl$O(d!n$FkAgtyl@NkxR{kprzT+trV zL?FQf!TNL4DWcMbAyQ;6u8NhLO<6)6mTP}TOflt&H*otkQrMyda`TFP{QW^2f1$=lnv&&w^KeVCnG#y_?mC-VvkBgq5M(Dk z39%{iaY}RDd2dh>WBP^1%lj}AC1*bj>;fz(1^`6(i@#wsnoC=DOCu4xYf~vO z)%L$Dlm}Zfj!k|fZ=L39xVhB5o9o{($cvN|)4Iv8B#Hf|nJ$G>mIC~tzXK(8`@RU_v;;gKXHVWR)QGn${w z(b18&ux@X2A0&`75`IH%jjsqm3rED`iwq2hV>LeS72umT0I!mRW=1H(6%l{et=rvA zk0N4!9qhJ&IQBf$y}Q4|!M~4V^vTaJ#Q%3>_xEocuQdg4iQ!`FucbH7UTQ^K4y@Mt zby(Q^p2HOkh%G)z)JX;MYfL9joPaZx<}>6DCGMN^b#)TDy6!Je0Nx9cGlIi%X3+|k zE1=QMD8|fP0GR)G8P&H%d;iYWA6b)7Pz+UKD($E8e+E)_ja=Z+?yYoc!S(c@wFztC|g#Em{p0?26|7^x$4_1rozWXWSUBIeKBQrHe65ph1oI8I;#H(HOYG+4tey^#T zMM;^e>JqSZDTcneNAA0RJV~^|N~kQ0prDk1(&#Iw8^C=-PbD;TY}?HH0PHul zg?q$)e=Edotgl?dnVFf(@BF^mcZMFER|mNN*e8GwDoB8O7w<>l%uU`#9F_3in2aSr zrvJM_1Awvo@?|+Er{FL1O_-~Nux~X|B2}F2x|yK?C37){pJIQ8ldPmsL#(`ZtKHGB z()rCVDvsOl{L@ekmHTjuyu6D!-B?o-3x50A5~bRDm!(b>i7TSPr_Z0E3L`}w_jh(P z{<0a28LF1E9?Cnyq}jUyHn_q`*i%uDQ_h|{*E*X8Wjc^Ldd5f~D6=s$_hSzq2n8M< zK7>KbC49^{^4b4x8PYhqk&^KkNS)_14vDMZycqyQ5?lu(U%m3)%DT+Jzyp;ttI8$Q z4*MOWw@QX~Qcd>vO-Ou6H*X$^G+=$$J{q> z4IblF1Vsd4#+aHAByT&Ac{BZ5T$Fdw?oTcbu>+6-xP7!WJGhEMyJv4O4;guT=!^_1B&M$(-dMRhsAY~)HbX&E^eiP@dr&q6_QhmbHvr;1Yg%20pyyA-t z{oI<&NE_Cf#l2Ye9c*w=n-<0@l?QITQHjvKcu5Q+%&;*5eg+W&BeTSUf^}%P#r&sm zf~_pZ4dpWA9}(;*dBwcIz{5{>y|S}8_KR&-ghAITI+{95 zvx`-j8U!gv>fZTes5>>aORhe87ZReMXYy`uYMNnTzSknOVl3B?g!8G8sa}c9VVOL? zm6lUWOKpW6g((YaS{`#R{6({wRz{9qb)n_5Iz_rlX3cl++RzQ?&vovUrC6d+Fw=TA5Ji6kvePoTU5LugQ!Id0Qr^sfO zZCGekYG?Bytpx7!4^?@59Kc6Av+di&92ZQD*#^#tAXl^0gWSpH`6`fu~#FCum^FG^Ru&WM$Qa-JZs3tTya?C?(+4DfS zQ+XeC3r>xJ>ow|Nbs+#J;ADo8ln5?k)Gin&pXv>Y)`%cIzjR#m4l3e94EaHkv|vhp zu?o8Bkk@uNtMucsmxBkI4ICza#3GPDq{@d+72Y^s)&Q@h4=&NTT0-P($48cs?lG60 z*{U|ofLgBh`oYhFXmqZMMF2H>LQ+z}^Yx5`r2U(59%H$pP~1JOw6esg+cbwkz*38g zLEA-goAr(bD&Ne;MTlhD0DY#DUe}t0DE_{)v-4vgeJK`@y$J9JiBA)PdkvYzaN+cu zGbf9{-{^nWOY)1fd+swA7)n?lZUySkEF0>m{rzz5vOUwMJ?sDxJFJHrX z31=(6&3L@Ja#vr>V@s9hSPZFlC=?`F*V?;?jzh5{t*o0X*xfFTLh%$YNC2Zu0BeKe zy+gu>;QR3Q?Wy0bOB=|G+rE@mxGWbdD6m?IAppXX zt%0$^OJM^ya@X=*LSFIFl?60T(o87yS7jw7eN4!wvhna>i+Kfj*(2eV0KRGxzrO=y z)1qp+8M#`8GIuFh4Hr7&-S{X7(I%fy zUutuKZwIASy)ZkwF}FIcHG1Coi~2!Ty3(P^?mG29VPJTEm}jwyru37Pl8hB`kQ=JY z)tM1Hao-!_NgIj_xx94pgZ`bqNiEkN?$s+Nh{T1!r!KSwP5?RHop=5P1w4e;?deDW znw{~Zj+gd#-_k?>-jP>v@Q;N(DG?j%O-u}i7?1Gvr%63rCwyI6BAtrp3}-uSK;^_7 z&ShuAs{%tMPDR{in$=PMg|=8NiS{Ee?w>g}Odk-)6Hb^||8OV!-M!2_Ci{u$KEH8t zZtchigO%k>${ER<9w%*wi=~F_a=oJ4=Y5P9>BEETU>`&AkRE~=8fFi&2w*0QX7};f zeuyjY#I);+urtZi6+J22mq<3)W$RB-gYY|eL9BZb z9cu&b2yru}(6t8$PkRIoi9K5c+tsUADJek)3L4l$Ds+ukW;l;1H@VqB_5~2QeR9UX zegAgbb;oV3pD9N|(?TPvYWQs?O6vHIck3i1X=ltC<l&P5-fQe-E*Q9^q@mKxRq!tTP7D2sMvq7-fJ@xxe93bIICdI2x@=6M<=*B7 zR!mH7(Zxy%*0{>K${sL7Sr_1oM`8i;(!@uS2<~o$dWqPZECEGKK^O z>Xff`%x^Y-Ms;&(6ouz^#QKZ8ckMWQ6ya?>8zV8qB0Jdu)KaUqMt9f7gS&#M!hm91&}CM_!VoO3^xu-V$B zdw$`9gMzyxJMR1Lu+mfVW)-m}dv(7p?gmpPe{M_c6d-V>2SN=Q52B!7 zVcHSEl<$S(q%iMGF73vmlJboczK6!|;j3l3uxT5184a*3%gOP!*d7jyGgV!hNv*G- zzE>Y#%ui5R0Z_C5|JLQ#uU)$@(d|0vSp3uVP^hc3Q@s4HawE9tJ$-txKBF{z{&mRU z{ANo;%}@5@R()Qb-K2vc((`93?B<8sA^^LVoRsPPf^Ez!h~0YVb`2wi2%FG4@)qN$$EeGq;0*af%o2(j<> zrkt_Db@zQpOtx1l*HFN%F{w)fKI22(oU%q^=zzc>J`T2=8 zoH_jKkgu?r+>qHdrqtf%c(so-vM+0E`mPKN$h&PFD=PBJo9i!*=EO++ybeaQl)Ez=;nm>_ zGWgCfi&>gjT%x}K4ZHZelvM$)R5n^aEVieU`csbA`=R)29Jw$~LB7p6e3MBZ$>+Qi zYWx2EXo1@toaZ&t4!%b<5yF7fdNusx7jDzSrm5S`0Ccsb#Y= z(V?@vDRv*|t^n_bZvho30}0mN-se5c9-J{=e$G--lAi$u-pO)C1&hucl&q}L;M|>P z(=7vZGy@tTH)ixjJYf`ZIdZH^TG_arz?rF86|naV+;to`*eTp%7IRBqy-HZ)C|9M|RO1X$gsf=_znxIbk#*0O(+ z%Y~Q}wZRrVlmH;l*uda}^OT>_`qsK`-ix4+YTE}7UK`T*F>liGf7KG`(JHQi2l>qf z_*u~737R4dBQ8hHk|(_m*)Fn?&-LISseCx9eYV-2Q=z@AEFJN19N0_FR|YfR3*d*R zr)D^qic{2}RiivG;$erJc_peLl7mCK;_}`<{Ar(~J6uLXd$eCt6nClJgJLt$yRB@h zrEF2;+sw`!Wo}|pG@qHsVoObPNON8fi---@b7S%aYo>A^y9U0$O6AqTsSgcctupLp zx4hcJ0=LJoxES4Ud%(2j7DwUZeVOO^ngA}n<%-lB+tDKYd>bA4^((`eNY;h1-Xufn zskHNg>X_nM0MmNY6fqlA9&V=&HU~;ioE-UWx%}T<|MFa5h+^m7mKO{Ty?gg)Uaag3 z(8tDi*JTV1lPcVTiegSN`T<7?Qpk7yPUd|jU98n6skylb`^Bpif}TeD`}{ExK1V02 zNREdwP>?}guZOk`-d$o(p|hUfcKCqyODR~i{#f5;hD}fK_e9|76m#ifgf^aNVcz;; z1?RnI(YP6Zf7#NrTh76T(hAC3CHwX=s1(xvOPoeWlT8yRYRjahBq8mZ@a}CTqof$h z_rm@%UT+pGKN3T3u2Xj``TB~u)8}oE1!qKLWLhnT)B15MG(Vf}KzJVZ!2m+5;ukR? zPdWE$ue8xKb}hk9WD5d3Jba`fuJ@r0W2ysucfHrOVx!X2^PQsY-%`mt`UM{sS@e|6L+?q(2e&Yg8^K(kgBMCk z6LT2i)GI%5Ti=^604m8AQ0`2<1)N4!y5@Z>(Kb&j?4$MwJLE{SdcJq5`mrWe$40qq z!V4^MCVw`@VdtfOJd!2?i#dhL(cg92O%$-LIc&VPeVwU0UR~G82RBYBU4Cvc+tZPW zNm{WqurV>BrJqZ0{F!Mk{Q-RYiZn%-l2Q_L(B|5v`uSqpE-8t@Kx)fDp3M)a}v_hE>{K@zUS38gAh}k(y`<2sZ%f?1+KjB8e?lopl2A$)YJ;N z6WUc0`ZWdf!PhKL{XKGq%**V#(!H3?(a~2x1cDQvmLL}S-%H#VlAD{%%ode3T>Sic z($Xw`wzes`xu!-&fa4`)W*SvPDOYMphm;M0TxKJI>u1jG*~sPkpLi~ZfYKtT1Kf2Qouu!jwYWjkp} zOMX@@7g-JTR4W&BA-d8D?ELbw63>WCHv%kbMEeEGu zl}Rn5CI3O#_)WRB^NYe(yBU&x!HewXaUJ<@BD#mu?!m4&`03D>*+&(Y8l=N!iUKUp zvoD$}S(Hpx&Z$L(<3A@~x-Hkqs{(-ZcXf4Nni?}VWMQ?| zP8WKyRLK2g`@MPlP~h>1DB-b|O| zK`MD$!I9HnWs3sB1`tk6kO=FxA5(^YK^MY0J)T1^TlD?ujvvv!wjbzP%c5=TPC`hpPyHwt^wkqPg>nFA&^K)b(RlXvVR=**W88k*o-i-BbtqB#(c4Z5=2(!JFaFHurD?9}D``WfJ*o^CPxXha*0 zD|4Btx=vEdD7ir^_N;j%>SJ|OXOV82$nh~zT&_ocp&r z^uM7p3dYakAuCNo;ylB26{Nh(~Zm$07uS-Cge*A(> zL?ls$VqH~W`msVK=J|sMKkyhau>9%i>Y5uWD2KGWUU|Zh?>H@G9jX0Us-{LaO@%(M zps3ojerBj3ZJTkFT`x=G)v;K#Sd#Iwa(|O?Lwzm$RL!+lP{!h|@TAn-$nq@tmSAgb z=lAae&Xv0iB$}iZxK@^1`W}4(JTUTyI&Wf1yqP1Hr19PH(5S#0Xi*k?O)U(n&T)B|=Bt*hxVv@`qS7Bm87 zP{rvY^Q@WqQJ+2mca({Vr9Bo{^lIlLxfVYBGHl~-(`LhZHTS#&NFwb$qam}Kre?77NdDJ6tHK?*_okwWXv1htb(oWClkeje~Sne6BGrnajX%mPc@>cuYp zab#aLeJmrh6S^ekvQ3FC-<}_>9DtIW$17}b@E(l4I8A(!(k-=j>WHmOQ;d7`;sA}i zv^CdbyEd6VSFLJb(CtG)zO{r!n|6%C-DN2RC~Cj@>r@PVa~0Z}E5>*^F*7qWKW{(F zB1pA-zqeJcjUFGvQ~8*=Rp;J9SwqC6bg#aW?CQ?`!7k~&VPSTxS5zoM|A@*~URt`L zez@2y?09hq$%zNLl?mhD-5!`X<=&M_3R9lB^pV&GXcv4l;=rTOy%2gQOaNTE6y%1_5QpaivOz zMtbVGSTSUz)DUEX+w@}b?-gTZcb{dT=jP_fmavG8vgL~Of(ZU<*@0YMXG>U7nT0IG zZ~kWW*(;h)E{R{Gw8wM^?5@(PWv02uuqejKec?+f32atX>rKsY$Q?f!K0*GYRx*XW=}VUKj`D}kb`UWUc&`J`Df3*`uW)koyC>F zoD9rC{q@&UYSN!fw8hBK6(Px5IbRUoX6=wZddXFN6DAj{E4^^wqX(R>dj@rl;7l#o zAd67!&|&&DGZPmcJ}O^$?%amF{PDVO(niOr6;6zc?Pvala`(23l1;Otme*0$w?7RP zDK2~_)0M2tf1?(dYF$JyyYL*zpU7h(Ds1oX=LgaUC0Jy0urr};uo=4L#l-d};&MpF z$w6n4mC37oqqnb5?TT=3w$}_$z3dSlY&SL(%rlk8Lzu#21)`NxdK}vRYU0FL-FbiDcf>A{8j*Jd6jL*Br(h8Z!UMuIDu<-eGpZcVBj>D*5OQk z9JQkj=57$Hn`6)Bdo;K-y=UOJXiwZ_>aKh^<2Vhc;NIr<1W|06GhO%gEbBHPUx5R; zy_sSCT;1RHZ9iXVBfY5bB11DQk?9xR80z5J`0KZ$RfNQdOo&&*+X~_oYf}Cu>ABNL zs)VEXV!MPNaQFehCa^fjZN9Msf6>43Rgz!$+!TFFK%+H+acU}ML1R?!fkXgxfy|7T zxbtw)!t54aS|LW;@>zUbtUH_&D=RFKk&=9je~4(md=Il208DZ|&_Zf2IVQu*F#Ze5#boJNG$D{_S6DhcF&-L**Wc+=fz4@RY-Phf$Jv|Qs zsky*;CgAfJ#R!LW6dz zTaS~OIaP9d3w{?Q-wT(Hhw@hmMKSsHAF?IG%v=k7=@dGFbPOm#C{7)J#8DKAwAYO-@0dOZU*Q(d78RA<04w<>PD7+3^k&+3nF9L0=Xb!K@0D=d?ZwMpmn%hcM6_&eeIgIwFL`6j*{m{rw zgeg?0QrgSRc2qUBBH5Oeo9c)8Wt+wHptWb-(`>!`ib23uw;GS9iTlS^_pw?^x2X-j zd;O}Qg)3zmfR}DaKfb`O>ol$pVt`f+Coa}P*@9VQ>%88xk zNE!nCEtcO#IgOuzw!G*Zl4^CvmrtvEjD^Wq)j29!^G9Nd+L;zOpHMj|BV=6soSeI| z3m;O#?>A!qN!R1qO^-&4N+y3vau~K`ut#KA^`oCRHD3z)T$yRr8$a$#>|0w+w?5Eh z2(@!6eU?VjR(>gIM99xRQY>;OK2dh}eTA->3Z|Hh1889SxN4-|(V?)}|IMlLVE6^d z4#R_A&r&slV)@U`&TkiP24Ds?2eNfo^s7AQxe2R+8d&Z&fd{r?)@_m6`q%!Z4C~i;Uwa=qZL0#Mk>H~M^8@=#ihTw zxyi@FQ-ns_jvkOctW}L&2Taq@!otAH%5}bX4z$SqWnzS!a`ee_RMIYVoNBjM%XIGU zX;Dd*sk!eXBw(q|t{B_8{2Wdy=!F8|v=#zzp5tDMtgOoxIySe;CMJjy)BOuWMu-LddskIL_XV4iC!(-WhU}VGsn%=9kdN~7%UYq zX?QC536=!EwKi)*1PWHyR0rr&4>`aj@!H0QT-O-dX<=)9h6_xxw-*LjZrw7Q?WAbx z7_D$~06hz9Ofk*9Z`Jmbtx*otTzUt{_UiCgVPRoHYIb&wUj!XgCiROf+BEdZ!174a zcgZJC|K(l~uh|oQ^OZobojVUTV2%#@zOLtdZxkhq!qLIHV*1w3yT+*&jp_Cn7AA21 zU{n3NQu2Z_RZ;PtyW=TQZ!K9xF6hsAYHIGZMzv6L46jU~7_`wjw$Gl$;|Zj}#yQ6# zn2vUSLg1?W^H1ozQZTm)3J8F~yBxxq{uR-mt4xdtJ|54kI{EQ<_j&8zQ@y?nIub^E zC6Ah0rm@3#krKijF#I(Ay=SeRT+&_i2-!n?9x~r&UzkNUxsNt2UVyu|b*)Pra z&h6WO^IsIUxBLDn0fH?xNMp=CT#|k|uU_f4A4$AKpO2YnfQj=M&rLQd%>6%>ohu8t zC{tYb1!;-d^^VLyLLWCxet#910<6uEoVqsF)}oHHp@2Vu|5TDp7!#PS!PNK@>PZMe z)|h^#U(1aDP*Ej|9l>ff7OsNv&iT1Hn1}rw9nFq)j1ekTgF#qUOr=LhwvKHTS67)+ zi+c8`Crzqp$I^AFb98qNG$Yt-*&w0{KK~(+Qr^*)UHj>75(p2(Adt`kIowVe$kA=- z#JJeq>M63MHr~VZXJek3n-67bbST7(0Bs|}#bt4DRW;D(_3Jc+7*3|GEn}%5TCI5T zDhA<8a&bpR-B@bcy>BljxTJ%>IPGmrox3TK0evvIVAid+Hm)_Uy4Y>KW}zP+6g({p zWg(FaDR^qc{S6&{cJ|Eg-@nVXf?qLwW@S#9Mok}R{fRy8mk^%c2+hrOjU?wsvYAw- zF?a^Nb;}O%j`d*P)C{9ZxY7^@3~bHrC_&OWQneVH=sJ(4#8o|DzK0QZHtRBh4-f`2 zVT^6HyqPVMJ=e$q;gMm{GfXb((?&|Iuo>@fHCp-qxVjForn0SzI(7xIAtErwQKTyf zC@mHc1t}uEsz`6rYZ5z6K?FoPO0S`XUM%z~9YP7clK`Oyl7GiH^PcnHZ@y0)Npf@U zIlHXA_S*U~fL;h{#l|M)LTJ66jaGl6HfG2ba2`o*kDmsyVfv=rF8cMqVV9$k9u`ZZ zz<8iRZ{12m>q{@Dh)d#I_bXZS`*`Hgl*P$MhKxi)SqpUIwdk!=YBrGDS7}Lrn027u zHcSfST-4#4@0?Y`PS5By|7dV%n=^Mf*~9{EP zY)mZj&3i4*PrltBq)c<@f|rd~<9Nj~6%9n)nwO)}L@{3#Z+7|l`)`bgcA_@(a&z2U zn0&$uTsnvYevs`X4*zP)qSg#Xd8un#Go3Nq%P73B{!j0nLO!(@Ek2RoPe`i!Uo#2% z7?P-+Vyx|+E7aamY5|RQA18vzl74^wi3m!5wk!D}Puv1!bUd1{pP701j2~&Ts0Fp! zOB(dZSov6k+#<3Bs!^$9p##L?569l_k3Fb@M7wBjf*$QA^{BBG+o+*iUw4Nj+& z4K_8+!|;$x!or=6rRyUPA;!uzZLu&BcQm6BXaXk!^-EUYo>n&u>(4dCPNYIHZE=*4 zUr>ME9@H zSoSb+ghxf8w$^=Y28uswxsfL_%-f|kHd&RzmY%D2Xr_Hs@5@&V*$t>2E;r3>=xg0+ z5k7Dx2n39Cl6K~68yHAXjJTkrv^w6xdb%EKqof4?5eo>^(kFFzyHSI=R$Np$8LFUP zkNGm9uRFo4!28*ZXb{)@`0*p))9UY!tFUJb6e_VEn(3?P*!^;|JT};5UNTEA<*-DK zv9eh$Vdkl48R{fzF+-nUcbwIzK7J|Xz38r&Bbc9T$s9|{Te7(o>|Ge|3FG$I_k_?4 zck|k(%$Kk54O*I*{p%Vy3;}a$iA6}y3#MtMktB*#4T?W}i z%s#E&^I5C;dR-k6R3ny5IylH-fERX}y-Le@*jo^TN|CzeUhB<7h>n*Ea=)f%PAo8L zN=zB$;$8cqwzhkHb6&T?x?`wfKp_QbV+8Rvl8T>6NeUsvr1xp>C`VIh{pdL?O5>vj zh<`o`9Im(RfawdfU3U37c@}4mbX2T4D89TI%)iT!H99nu3-R&fM>$banCLKySAn-_ zgP6Hu$SOYLXC9;8)%UvIetjXuY1Y}qSX+A}kX1Ob504+j1P3T@L+c2szi4@- zdoPbLL=q5RKop{&90j8U^m3leM_vP0zq!(uFjAxL^?Llw)%U3b%cQZoPY^YDdBxl} zn3$LVL59srAAlSe>+dNkWeOcT_FzlBy03u5BfNhszJ~tf6C?O=IB*Dsj|0HO`hU`O4+_M{f)!4{qJkehie6$W4Hx$E) zJg?mft83(AbX=XgW}Mi;fsz-i041>Wbcq;Dx$Dr^{Y=zA*x<1`aW6Sl^kIrJr?_MC zV-M&qg87yDy{tPrJ9_S8{n=M6SPv$ak_TbOwMUzuK5qYXv>BA)#{4FMTRq$1+-7rc zZG`;Nz!R;KBIj0EL?{VXpGi1sf$sp?^0%#)isJX~t@()=ZLhK2xdZeAv6{0ddN4wh zYR5a}0l=SyrISlZWeLA|>b?q^rNcz3wiRVbo{KL+UMD=T zmIEcUrUdh2gE6AR+q~17Sku9$X|s<(WZ^L-A$f1UkyFNOj_E*`f~EkWzIc2@PdRr@ zez_?AU|nYOicDqe=hYFx$3Ct)y&8WXtC*Ir(W6^bnVBgt&Mo$l{0|qPZuNd|Psi~08^G)*ZsCtQ@MIR(?FtVNx|X>?Hq- zij4`>_+=P}D`_ZmI{-}#(cJW_^*w>1F4ib9vr0HGEDV>)f>hCf9}AW_@UqdKcc)tA zWY8PNqv0ZbGGh_8gSM>*Etw07;Zf1(9~~WIU!R|l$9+Cp+uCX~TD=?p8Ra>H)mr3a z_VMjNTNIU{y=pMqlw$*6K5lNvHBlX9?@o(sPAA12ICzjZ zyXC|)IUr`VeQht1zx63BEQCwuaN22+bc*iKaCORJpcG@|%De1B% zv3_K5--ygesaNizJ-qpohH(PT!mT`+dgmNr;H3 zvx0JpWb&Us>+5qOlcacHMv>}d0J}uyA*INDFqSa=ZqWOs811BH8pb67Llc0}g{|eA z%@X;yZy%0~D&g)#A#%)G5D!aN&hQGru>Bze(w%1Fi{%w()9qAi@Dm=oX zqE)!pO%Y&Goo0?>4w}`zkB*WkI2u^&&Jx;FV{SoAR*o~LPE_3U7-mY#ZXjeeo z?R{vdt(jS@8z$ID@!nhcSNT~N(J!1;-UkR7Sz78N!rWJUD}37%6nH^MGvW6Au&_&y zWHh?;neCj>Lz<{yLvxs5WOU2ut{_dB9vpS<+YNsHvm}ZOCip(yjo!U`H%vYUc_#HB z$kOC4DAArS`Wg#QY?)3SeEIV9hGAWy`&3Whwj2{Tin**`Y9;DVj<8$@Ytu=u?%?0( zQww7yE~LSi0t4kJIo3}Rp=n=8Xb7}6NBnxhsohmn1lX~}dwHhwfrC?fVw1d+q2Eb< z1GHN(fP&t9I?JFI!&dK5m|||%iud9y=R9@lDQzbVwzRP^$Zq7U>9Y;!%X(yV^X5o@ z5&0y)&O;Lu9c`{Ye7LB^GR;r~IJfbr&dSQdyFnFAP|gkhl%01)@UoGqW_xpH;_BNp zOLom}aflgau9~rM@+j`q*Q2g7%szYeLHQ`g%#4jK&FjMGl-cBzS&~$H>CvF=~KG9?RuXMma(&|&d;=Hz6LT|0Nm{3R|Pz7xr? zo+K3iN&`kBd;Zxw+`IDJA8~h;D?lHud$yb89Kkgms`YDo+5qg)~%+_<>f=;cQ;R- zq!CO7d1v#z`%5&F!&v5f&-5`Cc&&L zJq3=C8;@AI`wAY|3-Xej2{0WD+8@m%4WM7QJW@`c2O-R{q5Cf?AgyC8VO>dQ>{kwEmF*Y)zC&G;c0U< z6@s1vK6Iwr|a1Mjg2i_`q^9LFSNeW-3b+DIJk?8 z``zFxhFCOy>XsRUIp^((DCkgBfetPemG{BH%dK+l1y&nrbCr>ik-^`fhY4$tu{F8M z$SQOv1sN$ul4vT6ZG%CI;B490*jDB#jfsi}xs=hpgXJH~gXn1il7Zbl z4Q|}9!bB}Wf$c429`h85+A$EK#;0KRThm}G9>e#b7MR3z>~?2e9(hU9&!emTAFeVj`v9frffU9Zc1fq?NH1dNlDlS%RMY7en7F)`l2hSI!Y0CoUj;67a>Snj%Z z-v#u%3d|owq}J`Df8GCF&wM2uCL+BrvTrs1x~_!k>CK>)TRU#N++$&K=#X#4j0&rj&$EUsDgTr!Rf418o_(gpYj0b|%+j*?*Rt)M+K8UJ({`}&P^ zLYdgP(Qu(tV#KDqL4!_?jvacSsLOa5H4_(*`0+kO{ZKlLlHNWC%2G$k_3c|CVwBht z4Fijt$!ZCF2M-^%9+Xs*IVrFeeSxl_^!3>5LH6q+5GV;CU|T`z7f`JEV5mF(Zcu6+ z<3C^L*Pkk=DCwvpM@LdS;+^JtsGXXIMb7g&&d&Z|!&6f3`c#3xo$AT{@zVeF)u&&- zKHnu@cKp<-OSXez0s<@Yjg#Z!E>k~01MUa%HNs+I1vs4g1lK)R(@O70u#dw-L@YW! ziLd-WVr9T5vHU~-$y5M|;OBf6~ddCm3p#m@8Y89E}C9m)5b`)u0)-Hl&_6e%Y+ zS0qT-6rEUBU0-iOo;bWlV!sqid$wa+L@>rZRXe32@!rOD*5uCKHN)MhNq#9TGhHc~ zx7DA96gx{9t%?cDJXv12Ok9y#`2ZH)_2|!U|FH$?JnGOXvU@c=JiNH11YEp2{mBot z0!l<_S7u2}G;r&92N^z?>vN>vjN5gP_Vm|0-NmiO6A~4r4+Ho}Sfa-npxd}>x>M53Lf~Zh>CXE*kppaZObIKXXWJBJ2>!ToMJABv9Vclan;zT z?^fAgT}H{lJm_XIm`lX|AtY?erzL6nZR8qv3d?fHuUn@_a_69V3MQ2+-@BLIuQ$|8VTLM;tKOk)n0(+z)%c^rJ;ZZqOgL z>B|`F`(&V5r`YpRMDy7cbM7@mDc2`hZyA|4C)9`huEMKBymlgE-4_=YlC}0CnHSgA zDquViNOSW@KrXNVmbe$6V>}ANyvVl9$jJW6NsTv?~3QC#NsA zFjybB+q$|sD82*~cMl8aKyx4hQ>%Skyz@Ypw zIr*xQ(Yaf}o!+p-y{@#ZgT3X2D!&Y5m)6MK9=9$s& zkmT9$7?~&Qe%N%KGRdtDyImnS&JmuS{0xU=CRRJ&qDeWTAXBs2uq8q}EiuD8&vN@- z+R1r;4rHEF&Fyj3XNFHn94(e|gkq!iK%>2gxF41sS*zs3o{9RQ477*yX>tLaXV$ka zadAx&x-zdaqnFzf)MEC$+gv&QGk);_eloJ+DX~S-QaQ$_^y%fIM8%BiZ%v!auHVYa zO+(78;e^EaV%T=1ve4@sApeto{do*jh$<>DYHDho@z6-YL7a>c+p|Y>f$TAc@%O9U zAe-Z$@A8J~Z%ZSYnVh`-=CIWA(M<>nUcY`_U2Q_&5U(J)-|#CBU#cq!56h4c^{FMJ z_B2tqBxX-{AwGOMPU|d)@$+6H_$uml`*|*ne7&D59c5`_B7lI2V1qfo<&hiKspnzUbVsl8|k8CKVI30nVyX;vCM_y1i?K{%SATijZV32nR0x zblJ(^m@o1&V?6ZRW3vtZGC*S zWv~RZU0IOC7g@4Zw%9&5e@133DMX<>45?6b#l5m8RPL>MHK{^kJ3_FWHsME-z>#N#Wdgbd~7WE_f5w?s*T&}*M7_uQ&9Z=s`dcTeY;QP849g3NE zb$6FmdTt2iFQ}Hp#26Y+LLkQRc(63a+A7@ug~RM#1r;W+o=q(+3S(v`=o{ys>v~mH z^#v$kCu4V3l$J^Y@DU=P5IV(>H&9=^(rQYAtSkaeurz-JR1uFAjKlY-7!3jKV$b0; z!FS}<<<@jUi3s1%ifkdYQ%51O1^3S1Cvv58dH9xroqc+Hxgri92inngAarQ?=+o=n)ou}NhD`d8|XR8 zccgVapcXW}guXw*C2FMRnkigQ8cs;etj)lO`2o?G52#yeRpwV?W* zYPH0gRi^>zAt{-)ucsq&Y0$KOy~pR)32$o6n-LBasa!<%!LsEeo5kw1V={k<@ShhY z=9y$Cc@?M*Bu#aEP7}IQ68t4>uG{08>VPIhtsmU8t<(JLf#WsF^PU4X3(G%iVAEfC z8HCas8|Ut?fu3Olj2P$PvH1FI2Uz!K7BlbGxYD(9b1I)a!xHlLb1oCx^o1QR2&_g_ zk!7D$kC|Jn#BGaAOyVkTSIe;U^SWkwkmT!6{}f?i;bLJ)@|{0?$STXa4u2alh+n#a+aaYQ*i-eIvmR@RJd-i^sc zkXIoMpyj$cV_c!x$u>P!we%MP(q}bfwmf%5o|!dk*}LbJnSbY%Lww(wn{Tl8*Oq36 zH8wQp;!HMNpjDKOC9Z5;eslalJdA0gR!xDIkpOT8p*nm44YE7n(&)w^7$J0_m{9v1 ziPcUZ$uLNjxGpX&43m=L^;%sJ|C|%}Q_Tll3=*l#eEHJP6^!%T)v<|*C$_e6l%MWf z0lo*2k}0aRZfbLNqKS_J&Qijs_I2=>P=0s1wgPK>yg~AH#{|Bt{9AQ!GD2@P4CzW1oY+C*4DaEQxRghO3`nj-V#QjN%#HLP$k>zR(F$C=vmaMq*t;8jS7^N)h*+u%792T;CE`8j zDyg~Qr|HUj*2mX(bo#%1`7$MCdh|Fn96&jdZle&YTdtQ{HaX7iVWbx}gu)!Dk>%u@ zPQj6p00d#71gUC}7_WEtPT^Cs$w&Y8LJu)6K|xxdEplPmF=gQ_NaDfh^wq(#8eS2R z-yRgt4VY8sy}sc#EuFVSi!ZR0d(OEK|1?9>kTrNJ#AUR41@;tTggBvHz541^ZhdTd znw*aU1kOzFh(zLfgz4yGdB+}wJH8M0*w~y8K)p|!))ckbxFu6vCcXHs`vSlsAAx@b zF~6Dv{i_8A1kj~GU$3Qh&Lk%%(?djgi{A7ikk6CbTanigI>E1f^>Ke%3**#ESFjI~ zT8t1Y2zEAwPpnAac3NJ)4F4j6#*e9E(gi>x=SBab?bDSR5FnxOiWe9DMJ*uYA3Ajj z#1I3yxiy2sULVvf+gi#CHH>zqI4{OkXk_4X(A$|Pijo=QHI(>S!2WlCiIHRt3U`;4 z@kB|9+UOlQ)4yN`Uk#xl19Rj#CV?aP-z)XzlQHcO`Od7*CB$2#0gvx>bx_aKUi-Ww zxSk-W#hR{Npz49HN=>LbczSn8_V(j{+y{P%-#jXgm3uH1mH<#pFTSh~fgWJDac5GO#!A%J4lBVjc z#0~~`7#ENYID+rIdRpgUHqrR6OxM-vNLW1*eT>FE7-U-kh2eQmqrB5fqo@~;U^(aUdup|4)W@Ci? zcs&liT@6;A9aeHQpvL#kicA5Djo51joLga=3>N;5r z8V$(1kpu?g=N{W5#Ms=)<}4g;ZE;l!bs^``F66NwRca%vN`nDO1&5-Wu!wQND%z)GT zl{j{QO4}ZVP{Dl*2W`4HS#jamwOtGXVS12^efQ9$cptaT@#ZFs7=R0yU~v!>UK@h z_AuhSk8XPoY|YJCFrMkbp(rZ0wgvU_7a4&-z%99z7ouhk#f)LL`@mh zAV6(Q2X~+qWyWCqi8_pdWZ_e^-AYyHCO6^0gXk?AV{;Ko?#B7@qRqNSCh4$^=c{iW zqKY}okPpZ?{y`3qP+ZUVVZoAjHbF3=z_{;?`=ChVY=^o$<#?Zq^)>sshi17aA@11~?O_MO zmTJ3dG-un&r15OA6H%QC-T6a?FTu&sAJ~yV=yimWNwAUIT@V?o*jiF}{P;^~sOE_$ zdt*22i=#xA-?id}gR0BPKUY!5l2|a;9Xw~H1znV3+u^)o0!Ue62L1|fY33_}VAVVM zhy+TJ;mPAJ3m&uMmyHM*(`mtm(W9d*TUqN(t=LfJ^N<>02P7gby3wh2?KOq6Y7!Z` zw0TY(fEJ+je$%76CW*R6z@$qZJ2J$6WTBur=)Wru^%mXp=k;N38=2hxL$h_2#FU$L z=^&#`GUX>j{g45HJQe-P1$nB(d7Eck!5C!ajS8?P0*;vv3MwBX3D2fJ-7&T@Ht&qn zt!P1R;_>*~9!=fCEEALC*7#xr;UITzS?&elOIMCF&wu%56Xn6)V`uSwtUKTgGMSt2 zjL_4L;5Cy^5hswXy4G6tVhid#Awri_PQr_+y(}Z8S2|zGSKFVKKe}nSyD}Q6imeR}6wkEt z4*je4V;y0_chB8k@c0c+cO8+DgVy+p3XbSkC8jNlC;3maojyGyedSpW*u;`2-|DN# znDS5d_ySs;dxYaan?38NMMHbQfkm!!|4IYNcG3685*XEC(K(uMTB8Q9KPkPnHm&F z&P)wGF?#SI3|T56zTx@d_3MPCw&FJ{rPz<2myHZm?QfzAyd)2UaM+eEYp~JbXBak1 zOG^(A3ZU1%)-Eu~!_g7u*`?2wGN`!#qa7f4s>NpG336!V9FuO@m?`r$4(3(x)J*sf zuGB~&v+f++YN<{J<6-j)2$1Nj_ck+s)JyKQLD&lkeaXsNxY0lyC`nRVgD%dO6prm? z1{6MbvZpP<($CkoKKr*m0EQ@EUtidy4o(?yqlJr$lfptac{c3e0T}9AfIQWifJTW0 z>{VamZft5SlVp=jE>`{l;vkP+-o~+?!BJL1zJb)7WQ}yN(_u?aTSG;sn6_DLd4$(X zl=VCev^05ldebuekDUz9X5PS&4hN=V`qSqzZIz^slm{W<%nV!a#Of)ejb6i~+R?Y8kRyH1@xt#pQxFT~N0rN#B{ zjm0oCXE%lK1}GlI^;>j*{cdaP{^!r7ivvn9m`~6>)9?{uBRH%-kq5RQt5`g^rK+kb zBrMD;!p(58uHrLR=uWxo=Z@VUPoAv*6UJs$CNxHfg=9W6_9_f>dcfM#m9Ac$(}MiO z;c;n8XReA~#Fsz~`DD2+F1rxeQ%HQj8G?)4TwG$@(_bnoLLr3db3t6ndY*8;DTn?m zQ=Cwz6B(bL4g(}SJX|Mx9uj55QD)}*y>2_c67-txXzp>_aKn=Ue5(JN5$z{*6|?B+ zQ+D6{}O~Kre{dav3BeU~HW@cKe@?h)OEF?5k_H2qVF56mJJWeIi37tGU{=PGA#0i^`$@zKf z$B&P)vTD=siw0H;A5cL}e;Xn$WpvJH+*s?0-SccqeHNg~FmF8SJTPA-r_2%X*5_p4 zg&Xf0US-WFoK8200b1voX)I$eSV4Ae4yCJe{^RupE9!3 zg4C5&ru)O9D?Q;q_q2b};OjqJfdAYdk(jBP!lO52`tTu0HYz{od{!S46?E(vON8g5 zXHUw4F>h$W+{W9sZ?<#En*5FYGL=nL>e?HNbFAR3Wh!fH%^+z+2;+ zd})qEKU(&yueXbLeSTze27sGWV9C1B;eO^5v%Y!e2{wkPUYYLBJu^2Kl5-s}ja5mg&f}93;uD;Sgj^Z#D#KmtUmy#XIKy&Nk!@_!tIW?SYCbJ~xVFGpfMc$H!-8Sq z2(T_XvQq76p1*h%j0ra8Q=Qj^Gbi;5cyf0||Eae2+qy*G1M7C-LUnYsfVe+oC5sbH zFF}mm>F;%^yiVB9@RLnhS(*9nojb`3U|MmFjcGw$`b$GuapPSD)RWjTFC^Uh}!e<}wjmoj- z`e)Xx)#oC&-Hod6k6F)+Yb zr)9kY8+~WzeAowDm;3bFTDFZF7o-ez1 zLn_X|5Y0!gD~Qk^0?dlaSlADC-n1pUsi`TW0}AfHUo;(9eJXWOoY8$sr4ZgMG&Bt? zBK*qr-i!1%5fl{s`$@u^z>WbrXGl1l0ard=4Xd6aviH9q=5e_1P(jmm3QQIz0v^$q zZ=E~~^a{`vXou3ayaVi>!Oe|7R-WTNjg;^l)|baCE`LP9yQv9U{Zdcg^p zP$y!hBKGehOJZ_zAyg7NENS64};=P}-Yz)(RiFHHmbL3pt`FA*3SX<=>s|Gp)>T_g^d0J~STa1s5^%sVP1w{mfhK3rdJk-to2wXE1*UAw% z29pAR$wm1vGq-FK%Lk>EAMRE|qtTnVLro-QN2|s*!;gNoHOG)yIeBd^&g-UHxh62Z zS8U~90a8Mt0~ckassVTpKaGFh^7?-G(4m{RcKvhf0YLm286Q_yQ#;PdNt)IDw)b3T z%7dE0L1_fy3!p(EQS1xx3U?Jys5adQ=dA=O)}dK3;4F8`m8Mserh>|Hnq1j-@#@=< z1ob=Df5w(?gUj2DKhbP#YO1{HSPx{Py5gvWFvqN1Qaf(4pEb90hHD&q3reNs88<&P z$52{2lxr$Pm1O8Yn=E=Vhb?SgJ+P&M##w03O8ma-dzxUx*@>fj*5y3EdKcU-CM$EB%OP(itR^%@OG5-Sd=}ty7Jv=IeN9i zYqdi1kyR3l`(K8VwB$b6#NF1tJ>;s%ZYw>_BA)~UdCTsChOGp@yfli;n8oeQx>|3Z zRH6i=D>EgwN}EsW&&|tMd<+C2)%%PzI*%vkXy8F^mL$xEn-^L?ZOU_Mz!1Y;TUXcV z@_SYiEC2ywf~ttcSW2$<-$uIiOLjBjmywQx6ZovBudh4#{y9(tw`1IY=+M2pck5u! zm6kr^()U!oIcpFVoReK(z~S+vA-bfFb^7uolTH6d+xy`k2B*?Ve>gpA`e68Y)yvwj zY_UY!p;W3==1KSSvKC3gISC0$U~^FfssIppc%UH>P{E&u3F5eU^4y~LCFbe={Ly@Z zXur2Y(_3YUGC`}E^}1u#rRqM}d1aT~wnk1gWSSaa;`Nnq>=h9rlN-^fBqi4h-=h?2 zQUYfSmGA7e6yIhqG=$~b3qNe3)B69NN^mHV1qBg6QENv0<4|O?{`u;uA2LN4sCFpsU3lf|?@z+xa02Hz#E;vUYUZN1 zi@`tz^Pj)4-P}~~c}QG^UC*~9k?uf~Z-N^-!o0Y&1T?$$(a0f4Hf(G-n3-=p=S=k( zWqy=K+tQc87g)um5P5GYDK%qfyI;xPj`Zm(w_)8%xwAA z*N!^RIa=LwR&u^&8>68tHGuW7#TBoU&h8Chr=r?p>Rrb<(~L%pWMzsBjfKc26Zm(t z%C}`Jt7Akii|$`0liEHz%>F!SJn2Abp1&J&kC_>&Q6v*|27QTKJ5u;d@}neAM2E%z zHL<&N`oVy>bXt-71?rry2(RvIpi$+IhQFI->B!5!Z=)x( z={Vo}*MhBxj_I*c7Oa-Dq-0}To6ui>CVM1h9xgj=mdUYSBL7jJ$*o;Krh^jANIE6v z+jX^1Sti}(TZd|Lk$u^=1>W)T2|PYNwNq!$_0JSp|~IrIj!Qx0YuIe@R@m|0U^oBm})CAGmN|0(Y_2o!Wd!}7VQDJ}o; z1PB-)_+vbHFm0~m8COTOwQlgY5~D%%)W|CbpIwIRXd$7S9!o#M+BF3>KPym_>Kp2W z6RDZ>sF#IYbRCC_xh~39eaj%}iR{-_@Gfh9sXyvxB zuyBHoee)VQI8E2tx-Z8vLiJk8@paj1nY}LSeKqO2Yjf)@rC5djiEaN^?3%>Qrci^l zN9u8NjbQ#O43_6Br#UT5L;>J4-xi~hvFVmtes?@ozc&^cW@_c8LW{(tpnm+e^E~H9 zJ-9R3zvk=Dk9(a*08kjdC`Ura9$#MW$lhZC*z&$&)9(r`H7>;d?5wQhj=5)Ct-Y15#y>x+_vL6#jEy<6_Q<6? zjkvlxZ}LqsNbmwil0t^!-@x8Ag{!C4303?ns^O{wlMhXi!z*?ZCKJ50b$+1<$M)DG z^KmD!T3uKFH0wF|vPJ(Yt$|cw08o+q_wYTh4^5Hvo-|H#V)Q=;zdt;Sy!y3US?2NR zXz}5hG{1=QG_sTmFpb15?y?7vOJ=d@? zrX6={(zi^w{IF;64ZX*nl#kZH8ICz%9_~oho6KjA*y9B~E$icJgd7`F_Wcs8O(W2y z=TPeHXx2%boz5MM7QZX=Mp7)R^MSITcRP)G)naH^y};i=UT5b0Nvl?;Gs?JYXJiJ=(E^vuK-aoVZ#!;0RWLSsZ`y=bX(Wd zntt!D0tl1ehx-C+&3uyebLk}bG53wCK(utZjgvkLYH>bTyB*Gl*x>_i<_k{~{=olS zu;t{vxbpm%0j8mFh}9g@)bs=KB$W!`b5qfWLV)Vuc6 z+F+)+bvv|(jZ?C{y#YaZ2J=UiK87}=QeYe8?VQVQe$Fh*}y za>p5-Ig7wDdTCZU|OTT$NI)PqsQoYVdZ*^22JSk(9c^n0T<6dX{gXo zzhdEG)L{u@7*2SY>P60Szg&-(F^n$@IdOQEs}RPntGV6 z)5T8xz?L}99JyXp;dEB`^5u<3#I=oT1Lc!f&`Vp@5~hZetGj2B^?O*s35Mje*vhUvS%3M0x;4Bw4<)r$ktO?AB z)LMs@G7*!;Sm*ihX^G$aW$1NVLSZ%*qAuw(%twZ-O-xe%1KKPkA6kxrz4HQe0=&HB zKzm~J45)}h3%lpiSRFlJwAa6 z`+b2x5x7Z8qB;q7?{>W?-&j7#TofLN9_krh;#7SDNbBcA(w-h4Cc5|<`Kv2d6Wj6@ zmV1Tqvjlds#nyI23e!3XfLXPTqtfb9Z^ zcSCl*{n+@p*Xt<8!-qSxf5C^zrvTJAPF`9P_gI}9jf~Yu18NHQ!Yz?uwZ8i@0)}O( zt2sc8to>vLvS#^li8k^8o~p4z-{6ck!RR4@Mdk@*P+yw=MTPF_HYkxaNNbzpG;cyo z3f;7b4>5*+B77!WxXJT6)C_Fm|H?)(WAmETJmj)B<(Gy+9sxF9zqm*8ePViMxnG)z zkf^jx?Wg;q22NI}na+c&26>)7LKrFX?P~!8*|si_y>&WST;1!A7je8Fjxe~#o0h1w z!RiD0#bL&r(N8lARk9SxC-GzhVzfL)vPnXlr@L4H@xg9e=Nd^?Cfeq-4z+4+wzVit z=xW4~wX2h67bpK%-=w#TMcbY^l76UJUlJ=txKeocn(`oKELO-{;jMCsXNqc0)pouu z@`v$qD(kI-l9n z>k;`&p~Y46hcO1ZsrP5!hg8r$I!QDP;Lv7wgcB^3N(KyBp&d`Id_`xHDz$b7kA2d2 zHCB(aw78^@`z0jI4F+K!J|-T5mQ+5wyD3Lu63tE4K9RBm4K4X5bp$Ut)$WwS@zK}8 za%OB=ZyZ=Y$X3>U%dRXf%ZL&x{IprHmX(N8yrxVXz?XpZ{;K9u0)zWz97@Q6D;ABqd9imUc#~ zaM)DEY_m(-<-IjNX;PJ7=mw)61)x7nfwiY2>m)N|q~OD^l?l#4S{%|=av@5GLmWM3 z_aQGY%T;9=>TR->!x-5&{4o|BE>j(tig0YlW0bUuGl6**@5yCK%txMGV66~GIh-t} z*y3d4?XIh=H~(0aLqK+4v>fqz9QkxOfVREZeF7mgR`lFF&}UeJiIY%FdlzcpF;%^p zS+yGt8KZzlLP$b_5R9;SSL`^RRu}EGD&1NR;kH;a@U}$BM+qD`%6EJ_ZH;% zViXz-TQy%;>W3->`Xo7XZliirYm|;L!3>@=M{iQ3|5-Tzkb`)IgqnZEMgJ##m-d{Q zPI?K2`2VEu*Q)?4jn(?`=CJHv0s=%k#zit2dI#z01s%9hqi9$Me@ilK;xP&XFk4k7 z^pj_1Wdittkms{B@c|$2fY7y6StNCpaH76JeYQ(d>4Usa6bNv;mRBYu3%7zw+h|%C z$bPe4erh(-n!L*2=Uw|zzpqWe(7nT(5^x5OS$+?rI(n;rH0jHT+7Q0z;TPJ&84N4D zqThQMPJZ2uIaSGAQcFo$#3uESbc}@VgJg}=O@Yk%q3;Arhkk{f)U5MI zZ`UptL5$wJ{{92bH$0QaXimq~4k(Jm$Pl208$B;(8{#P@IqUHeA1EY{QaIB$fJ2a; zeQ#{MM-e+5LhQ-Dh)Vk3!U6Oyb31wk&{FL}HZdEZQCJO1s+dBI4G89Uh_Y20fe-;~ z+FyXr{j^S?OFAyxa{8HoN&=7rk>k|jk3HGUZ%3yXR8X;^SlM@@4cxtSa?Oib3bM(*qi85~voqcuh_NkpbCsVZ)WUI6@ ztXpTSSGpKWJS6gNNm!-jE1jvjKRej@Vu<1B_j<%D?k_tL9)Iks+aAr<6F}^Avp>4B zjb5yAYj%hxO;RFNEl`VfKI~(rlN`&|`_8@!hF-0G4Fo;(ofvUfOc`ah=LW66^vKN` zMiQYfG^wI^GF;tK14(H+Nb$@9xr%JIoJrPamv?V$-`Z!{Rn9hRO0?@MbE#t7TqU+& zGJL%WWX1=R7q?$%ipD|XG}P&-g@i4RPxdn-u1F2dAog&D!rcvo(Ev>jOcFU z5N#Ql3(?982hRe*Fg7pGvBsa>PUk>)rX^+pnf=ldy*R3nxrz6Cz$J(>>g|}uQiqCT z{7c4457K6NL;O;2?n6?$){H{+U8^*^%GV6`4VO8QqJ)RP^u!ILH@0J{2iaFQTDH~# zDoU)XmS9VT<@!C|UFx2n3S^MgG)^ktt4mIsX~>e{;vURp1(x6#kKU^6gXM0$VmJ4- zP${qb17F6tQo~?q_zGJWlG@*%?Xo7xu)x59UdqNuF4l5VS0~Bks|i6ZXO2-+HTCSx zY5i-w4q;_NH}@$Jv_!{o=GnIi$QZQe_kuyv5n>8i1bWm=3pmcc>Z3_7R;2`4T3DRq z*DnPf*&{a%G@SQ6YCFeN6@9S~B%nCAH%)^$+%COR!98h>wirR{Z{ut$dHe$;x7Vi} zq-nLn%6vM-u3e?Q^e1>W>D^Wp34@}+>o+}2qeVquEg-uMDLoF#ogfI@)g`^!|A0Ul zSANXIBsnjfbfzt;rMdCI*;0cmo#CAaS-NMHyOD$L?GkC4ot>R!x$d27 z*lqK4cK4O;%(+3F?!M2;*um@us$-vGyJ=HDfRVx7iSOWAmDmHuj z(gu5ToEjoOxSf3^7~^t(?taj*Oe(gAR0iE;TXSz_qhppH?;G~eM5m!joL72d-jI8Y z1f8bavN5#scV$p((DF_Y|A!0k%XWAsfB2Ak9gYxvb!2mL0z;~|9e7H9*P`r}ZKSjo*XPpnprqJrYj^fU&(>1gwe#eO;KmZ; z5o-^oBBB>EZSq4Xda;4#Ig_n96zWUmqz)RjF%I7y97jdEj@CJ|O5*KHsIQ)=n=#EzME8|X?RScxxQACvMkJjTCMB$Gl^b!-NNy(c{+yuSczA`J&4O~ z^TP|oz$7en5e6K)G@A`Kt8=Jv{si)h(T|F?ced=S6Ib#A&+Sc0DzKg7|Jz**U6)r# z)5*U#Jy_;&#SSzTg-x3|#cb5B(8oHjjO|B%rPYC<&&))Vo5W^?{}K}umB>WeZnqEDF->Y6wQk$$l%d#f~$c zvxhN7Yl(eEERJT~)Fna19uIq1RuXNtvNS#N$oFXHUbLl&&wd)|iM?vupr$BD^AQ3h zDM-S`qqz;M>}B{Z&1g@%?<|6DG+oc(bgiEpEbl6YstpY=&jdNr#;W2I5)aRaE%37F zd2TCXGdxj5*-=4A?R&^Xy8#a+x48|0D45HGiYTy>MlF9j;c${V{|4!GBpSU~l+l-8 zomo2f1-mtdRF-(_X4%=79pOo~rJj<=U79awQ*EbPE>S^kRO|Y|oBLpEF7BFRrR2PB zQ7(g5B=;H3amVOhMGZzr{7kE{Gj2DD60`A~Gfp3L-kiD&f1T$RNB3ZkWQX4Mp}8n8 zCz`^y%t$Izb2+{ zKPc;AzzAP4yM(iN`HP^}kq;lJwmNAaGor(m&8jicqb$cL`gYZy+9#EwFMBThlrls* zryY!m=}L5p*hScJx>c6t9lO-#di5Z^{zJbQ|i!#Z;o*v%tHU=L^|Yd zf?lx^iQ&o#g-`*hwSEU|1$Fa&+{{X@--Uahex_^Z>e`lxfQ8wz>QPx~Q(%dH`kkr0 zeXqscQDCUPz>HH;FGolLzlIQ=ZdlP@C_x69>`E)9$jZTY%G?lc{ zV$Cu|a#~PHlI@g46iIf5N~shrN_Hhtwk$=qi7aK$o_z^f$3B>0e$V$zb$svt;P-yq zkNbYydC%+pTCUf%KCkOa?ES)urX}{RK5^+%f4TJ27#)Vifzqb_`ge@Cg;JK^n4R^O zLe^LF74E;zsH&_?2Zuyk+q&dSHSwRmGWy-B@_X!RqU+ygI{6yuqBc~PowP+=3Y)># zsOz78f04iW2Skzd$=Jx4nEvXH+V9`#!fVsdwBJhBj_avUD{X4N+WS5R()nTama%7E z-Dn_MZ%u({ENpgOzg;p$b84rPdS*sXP>)bmeCPKpdy}y@B89#}^&bw`l;|t=jStvW zebUs_OoYsX+O96-Et{^JYE_Y^Quy?{Nr#kq^+g~AEYru%r{UBtY#F%381LWOYIteb}c)3r=klw`OT=h zFC5?nz(&H)yK$a{uZ)%_)21G5s`xN2e*G8X%)+EWY^yyOOr z!Ps>8g{LY$KYIK)&32&t-5=GS-L zn>9{FRx<)GRwZcJhGYr{mZdw4C}!*$m;GS(jrOl##m;G*jYoV>>p_&_YE0C2*(hl9 z{n*?|ny>8FHsov zmeS+ves0v|wZ_JtP&TeuhcW88Z{8G{Gw<950th6`cjtZvSD8C{&Y`?t)SEYNf~}FP zZ#&SSbNu+<5gA;eOPBNcPIqh2QC;+ak$8ge?(?v(;;xj1Hsl!)QGVi4RJw3Mi<^{i zy%}m+XVL3byEcgXBlFj7N^@||Ob8HbQ+&+fkrC8RK%?Xp5#bm%$@Hsp`O63to?7Yj z;moJbyrv(l%Bq``>0PCYj6}AaW{>Uc4%r;6koMlJYMpsV<3uN`R}KP+CxTvBpSI;!EA|iEuxE@!|!0hfs^u zwy$<6dxw(Ds&E`WwL_rM&C=3Fz14KNK_u*l$XZiIw<76QWQq+-!Fpum3!la`ypP!< zEnRTkuzRp|&N`y!b|jg-mV$x>q-_MvvCn|kqyU{xrhhKi{XX|)^Ja#9wWnL=`{o*; zTXb*1);PHipTnXW!TcSowGF2OdgG|O3)qez;xiXTM6^imOs3-3oESsug)fg*D0_6O zECXnYm+uR4;z`*5b*RD5K5QR5}T{b*f8gjL0r_h3hU1-?7 z$F?)rDHtuA(6LocJnlJVpe2rCV}9^pRc*YebeS{zq`0_l$Ca1AdAeOQ6}L;RVYJ&? znHv=z?`=d5_FA#!OgEP?+^dC{c`m%D;$#(RDFl}@2xyswy0`>MJa-L8>Ra(~fo)qJasKffpuh&q+yw2&1#dS}iY zMAf4DB-vdF*akM~jaQ*a2QpSFtE-VHP;H{VZ(mmP%s8s)zK6E3i&Bq;+Rz)Rl-`)C z#Pd&b>s(+ou8|%n067IZ54X@-AF^{#%cO)2_idT?Jv&FOCmPmJ>J-QH$3HTuCQ zFOXM95QrAN%BYMv&g+OZzIt^Ypf>cv20TJrTiT=~kT^y){jL(B{QCkct_IkU^IcWER=vA-2OrN zzhzt!OD|lA5lc1gYbtGU!kXi#iu9X&2D+)E#lq7+hIy5AzP(6pI$e=y;@gyw)^GP2 zlM8a4v9s-e!!K!O>YheGm+Fo_ z<-0VG9|v*e-Q(8`kwy0VG=nZKCg#-)h~iFL=FqeOWipuFRDV=gS3qv0Xt$=Y!}na? zY#z$xZxcfi?z{sZy6&h2NX6-Wm{KLDrrY!;c?s1Axs03Sdy^#dXWuZ@1(c5z6pbP>v1W*?49<)4xN=v%eevZ**g z_~GLUInfAu@b2cRYLWY?zg+P-`Q_o37WF4lrH@}tPe(_~X3UGEd?k#1#9=vk23)3h zv7G59C)%Zkl=xt4lt~Q$`Wv_+u%chj#Hvl3UoRki?;KaWZQdRl87UzW?x3y?s=*sp zFI(pKsRC5beJ1Pr+_AvN4<76=En7R6NNHq0ZW>R(a>Kk1^_Pn%_@}&hQGRVsB0%Px z9bHfCDDdvfkhr;ZYcJXC^8*q<$c6wq%8&ow>a6Q33$>%26XTO3ef869)hISS9vNxI zy-#g=Yc4eb0nh|#55fMSMff0cY_F^Wq{dgIE9HcfbM z87HEaDZ988o)|`=M`; z@(y>4Tv6hub^MrA_rv*g#`jcj&w5(GDkb|LcO2i*%*@TneKATE4qrMo1;;6g%ydusHK6jyVo54<5<8%i%a|s(O}oq zcsto6g(tVUQVKjt?z*%LlzDEvpYdz_kD`WP8MvN-fj<^dly7}kd5pjzuN^Tq5-V=; zuH1I&DC-zX3K>u-(`~t)?eToPL5l^X8)UnKYlrlC8tQ9%1z$1NP}bVMJ>Q>JaX!7e zw)fZMorjAPvd*_PH%tAC{g2x0G=IPLS&hWa%n#KY8*53?Qy6 zvh|aP2QPv&Xo#{RqTg*36T40qq#8(A4<(3XI12JP5g=?sW^2v-iM|@K8M9=ud;{3P z^-;+oj>9Gzf_t1xb$g|wS<}rkf=UwwlYIH}3|uROr7wNEIz0H8FfE+MzkG>HPlxik zGi0*w$+FnnF6YM5%-1+FL#z*V#Zl~R@~kov8KW7d%*mM3@25V;y@jwQwyw1Bptt;} z-%?Sb>SCF5EJ{a*YB0t5%W$}AxR76kv=gixfd@6>Xy#KoS7e2;#&qvDSrKbj0c?>5$*Z;CH%KjwSgSesdzz3rjcW}smk?yV9xr0s2DNv8b#nHkQ zOGZ)4XjWuWQW9!FtXQ!^-@f(c(5c0@|A}60S1cWyIo6a$mu(RYSJK{fbNqn=#C?Y`;}&qOoVj{ZtlBBe^*pCkMN4vRZ?xeN2l# ztuMNw^tO=vWOkyjp3S$;?EyyOhW=6_?t{H#)&MQJ;T^qp+RDO#8$Ml!7#kbw9e{4~{i~{Q3@Qn!kLNFOmM;p_KXLrnN~M&+=n<()P0sZ$c8v}! z1#;$;Q@m=CB>BapNSFQzZS7>bs=?O4%+dSCxFHm$_TZ;=S%klZ#u&dY3=p2%H%);(E>{+1(?1Y-OgncGD&p zIlS55B0`2bM#QGDK`WH(hi{sQt#-{i)A;DdShbvGew~YIGHtLi&Nb24^C^$w%;keB zlc5wED>Q}LXssIED1Ei1#k2H7%kA^3M;u)0Zg?v&&00sr^&Pr>@`IZhvJ^(fe>-)O z5dPV2e|-Czvtq@QCGZ>iBU#ApR_KK}&XHh7zJ?T8v6ysliDp;UG`0*S^E@kT_kK$4 zz2>CMt;6r(h9$T0Eg@fu}r45TUS+8VjOnYGWno$T7#vQrds{>fVbmdsD$ zl#w$PPh(EaFn#!xxw}GaEMPs(8xxQ*Z|X}EW;!YJG2c8D^AchXJCQT`+Tz@KV^hAD zKf0R$+u$be)6Dq30P=^8?w7k&3}<>RSw22K%ata2ZW^vWx#RmAVVAC|>~7q=4^|N_ zGhE5PU=X331IVstBGgr3FRt8IUGN0hhSPHPmo5GzWcK0>LxdYId}_2?Q(Ie`PzH|O zn70^8{FZIo?&TZoy`f7zGo3Sk0D|7R&bTl6+{+gg-+xTP&bDv!b=S!%;qfGf68D@DM*bnk#LgAM|F&eXQpmPD z&VT>GoBhEgaD~#dJ=0Y%c!l#E=f{~xl*Hdq4RJZ!{^~vn*0ejbkIqsUCI{O~*j{cI zkM(}XI7{pc+=bkvqOAc`dJ<35FLbNhtLT)JZQ|nV{i7kCd9xpo9KPldJoiu75z1`F z&KAx+x7T|i`4C*^F0n|biP!mO=eOs3c`C%wib`Eb?mLFAG2UC$Pi6Je9DdN?0Ji6D z^&&TwZ=QbkX`zsm=?_Jdl_xS-U8R!LiLZA|oNZ}_8kvJfxSzj#!Tj_Jx>N6a#=u<# z!8p|HhdVaV(XlVaV~y+gK`Hrvz|HNlbh>Ww8i2Q0+q0-ms9|@hemq_G^yEy5k(i7T z%~E2xNE3cSJKB7%JmH=!kUgd zWjK(&J1@Uvw8u*CK1nb|;=+BJ9jO6P=WiI(0)d3bpmSj*N5`vmB>GW*FshEGC^g)urjJwO!}L z<$~MVA&wVnL!U#EE+8%X+)JmqDke7HUb*>n+0WDbm|ulzE#5LObfBfL`~2q3=}hCo z_xo;KS@#)2(o_aa{@N(?9O$%2sYl*dbXR0wUmr>Vc2`7fo!Ga`u4WEBZ^`)*F@M=K z(-1p|D&yP&Y484W$?@SXDyxbe3Sh8o?NA18T<&t?EgO&IgX-r`_O%36MVjX!ei+p4&6}-0xAq2sYTF~omNj(6$-&3oLf>~y$~wf~Fl5fuc#Liz zn9iS$N9T@_c9%>QgOlpqt+=9S7+g;(F6s&5mrH5w6rd{_YHE(8u>$!kE%)~Q3*FmE zOa>nIv(HO4C_8P9j8w98H#XV+^BepsVFgc{VbYKL>FIDO6#HvE4G8%9Lgf(KqF9_` zZR9ow!1+a_6DLouv1_mz3z525`RrOZKr48N{&u?07S6BOOq-(&%iWZzN9o@k*;8?@vLUQ$Etxo zPyOFJ6n2uErhJQar3j(eUzenxdUmqZGQ|S%F_QbTTZ?*~k3`hweo|!lwJ*Ho+&jEA z%|`aUsfE=+6`j6bcV02YuImA!O{b3^8}AR94t*axUM^0N-7a})`qmha!qDe_*N};+ zipOy6ISlIl^fGWs2*J8UOk#S<_`m}#%|t+YhCRh+lsM9?U>VbGPB(I&&CGhTZ!T=# zbqUl&a>sSaH(p)FJ1&26V6@chTUQL4Kb~4|(JfH8psQ#qj^<)rTxVxwd0&2{GRsK4 zfl;${HyEJa$XJvSpYw=l&DGC6)ka6F5tr*G^^Xu?%<+k|J3I|F2m+PwyzpAVdxptZ z8XNhB`E7B{0DV0onTGMXVzM+(VQ0HidMd4T{*nui)w}Z>h6BiXUbJUd?XotncU)Ak z+Gf1VV0+*irGE~qrO`U&jA$j|;z63bXix7XkF9=GA3bvH6Pdilb|#ewonD47v%#rC z2)_!dp5?nG#kY+TayoODcGoJ-%PsnOZJytEeg=~d+?x)>e|emP*CvZ zO_bfDHGu;A2tIlP2BV@9%-!?_6j+|cpFcm_X>>sE)gM;U$yX^LD(=?ni6v^6o=jye z%nOo|vc23jO;?=idpv&?a;kWheuMg{~TZK<`MYg@PEX+`W0auZD4dhC!xz3*BQe{e+#9;awM9#J^I>9+sMU zvy=Eqy+x!AA}*ukIcLc6-x|$db$dAaF^en2h`( zCgU)1$4M+@#5-BAsHj5Gx{KNeAZ4le-rD!+cHK2CQ~3jwA0M}>xwIKNQJq_#&yid~-w9ixCd4ltr($fG8Bh6i zD;9=;>?`ZO!~I{OfKUxs5maUmofd8I&T8b<_@#QAzRRPE3K^qea_Xrau}-Wj41ulM zaPHaC>bA=|G`nt*8@%-E2ALj*wSD-|N-qKFEo`?C$BD6|?KE`ejcQpu6Wk~wib(WU z?byEZ@Way)=!q~I>@?s9Fl`%RM0=xY!DT- z>t}{|Ot~QM;AL>5V~(Bl&z*NW5P!Kffv{-0=y%qdca`YlCO1#y-Q*a>No*fZ4;0a5 zN|Djg_X?BX2@QYw@(7&GV*eFjFySwt9_QSPfvN|Pjbup zt7!NoB4XT{eKSneJC>CMpDIcDR?)Ma>(@m6+5@h#4d`sM1MV`9C70HJ_Lq#>21n5O z^QGJg6FYiq#P#2{JcI|_&HJr!;hUA)UrZR9aP=q?TLa{7h7;W&i-r6{a9h*_g?*kq133*Z7I;d8ADok(Zm*Xf zU%=%|Xr^J%Ox1(sWeqA0+*`F&>6xr`C+gF*NiO?EwQhOC)w)sA77dT!|JqkQ-d}~l zoWk_z<8`0gJ_Xv=sol@O*PX9ykQ)ELkNJB;6kU)Bm<&BI<;Y{qrIQ{ad-C7e_;Xq_}NEN^Kt3=14ZbD1y9P* z>fgDEdyV|0;}TRnJM)EVB(Ea^SWuTFn_yD9iIDQ^LR;oL6Q(;VzvL&kXd`;4rzaS9 z?Z1gU#Y7nN(nCk?wONL*g#ETAkZ&LIp7u(xCxW`C=$I+9k~u}Eg`kOFoq1fY`P$z< zzkjwpuNa|&zGkW=$J6ruVn^scSvFDa$C1fwg6bO+8F{-V2^5J1z`qz{dGWkuzMv1}WUNkNX9m5=lfC|Ey${3prJHWo?EO857t(eE z*WpTPXt>9naM!c2qN3ie`_URUO%jW^@#x8u6-uYx{<|-I-V$L&dH2EpS;SWaj!<74 z-n-4$3A-ihhV^=GoagO(*M%=1g-7TKRM7nEh5=HSP_dT?^89=hGZAa~@Nd>5_-5CC zKK;(Dzuq#AU*exE_<$$&6N>U7c$rYy9H?GF6R%Y}&yM$ft53G{Za?yC2(ERSr%%6g zvb!WP7u`P|u}vn<<{iN1ozl_KL2{mzAo`WwMhq1(gPh+n1}?6LesXsEVD!QEUV0A7 z52{;ty}#srcP;dzwY#9dX7$u3)8NT$a-lcMEJ1`|EGjN@^{nIHe_^0uE(qtHaiI@) z!h(f|7c6*T`Zw0TAFf39=Sl8!7p}~)>O3eKG>SS-)m2rwvu3a~^7S_bO9Nxpj0-j( zlNo~q)D_FW?|(pe^F(m9{)P2p1vfifM^=Fj*?);b|9bxN6p znqxRXC2qnY_}>sB8#h8u=F$J6eDdHy<@Mk_HfDk*zpp#*HCgK|O58W*sSKUS0QozP z?UC9Zqs3N9jzP*U*@td2&I>6BD+?$(PoO_oyUc$#o4d$Q^J|Q51pLaLYoicg^WR7U z_2+Ya`e9Jc-hjn#-oLkn5`@0I2Ohk$9}F_J1pLv_mx_}%6z}yr!Nti>#2RQIn$`+Bd8v13&^lv8UlL? zW#FRlG)$~yo<`phsw?ZYW<=hs16XWU5_p$4J9OVMd9ApV6co7#-hTQeXa9F%|9KHX z#paznaU#dA4@)R4D1Zvg+Z_Mj6druA=DXT+^(vyXtM>p`f|e8K%GP=l`QVCv#1bm7 zgoK2Ii4sBCE9bb+09`*M^jibpJ7@E@ZTvgdZoM8_P!L{KCAVNf!g|7hx*d$$V~RLH z8n!ICnIh-48*-fBCjYyHmv77_!H!>SZd}3VD=H$g@)rRqU;$-_7Tx4UfyOpD+wY$r zCY~>T6C3MAJN0}1ZLx4UxbL`liuF%IL1Lnlu+{!V4g-k*1M!E?4@JS?rzOj zNAAr2dQ@yI5ot0#WQR~T6ujljlmTegYVx~FJYd+gX!dOVJi(*LgJO;l97;;*n7 zmz(`&aYH@*jP?H44Xvyk63>5`ob=vqnM;eMbbNuloJg{_wAC_-`?WP{+E!LN+^rMs43!6x<|i*07=!?O zu#(Lf!$6|!g%P3Sb(wRiFtZ`A)Pm)8vb=ff;%zIkbwezEgOa%1P+z(((WE9R>EvRe z6HxrYHt#B8G~47ReKdjYiObB7Y`iONGY`s1iR!98wmhCZh@1kCXu9dq^xDxYT;3U1^ zN+ej3OJC%%ur_Z zN7h$%ag6(I1iWA{-UkKDPo7*!k4JbOPNM*Mhbs-DKZA)V3*xGx5)O^y#=MUG50ICn z`0w76?1%!fWP}rC1iyXzhR!Uf63!iT&fmCU!@V^Mj!5_gh{KC^?$;@B^~8azNK1zy z6n|?;-3M!J_)D)}-{kN9Yv%;7g-?M@7#l7Wuc@reaUtrYa~= zusHCiPHwI-pc+sr*lfD&Hfa45HZu`nT?7@e4)_qz*TE2UnxgT${&CCOjPbfYh}XxD zR;OQ0w(g2WTpsfN))Mdw)2k3zXOPz%i+1YJKpEdrg~CfnE^{z@;jDFhY}JWx>z6dI zhH59gue#yGLb#f=*!*_!&siXHc=Y7SYTi#8a{Wo#1`gq*H9Wu7rH^M|XHke-5w>Xp z{3iUR1g)N)!tsgtf@M8J-7H7Q>AiEQJB{*CnBAzrXY=Bnh@^8KH)Tnqy!0?{i~4uH zJC~lr5In1W@JU|wR<;vcX^5?yvw{iDp$Z+Dy3o&ybn7=&UH-?G)&wn#QhxBpy3ci) z8L2PM4t=}^2@cwo*aMa~h~f!x&?b;suy`l4Qd495wrveb7c`X@{jO-)(o*cF3B*!6 z=W;^BBJ#0kt2c< zn?#A*Fs6yeI-Y?As)kW`#@oB^syT83UXgnEsp8P`!GhV$$V3s7`va{EJvEoyKx zP9A;mdk4Z0JX&Ii0W z_pZp?xj(mI?gGl*444iQdRa8^5kQ-qJN-;noBo%KAbg>xQU`tx^;N6(odomb-pAIu zM#0y5K$j+H!H)2+`DGLL$t`X5Y&< zP5dzi@YFITTq^U>Nuzu(eF&evZ;1l4W-pXdJzsKE8n!%yl`H86%~qX9iKSU=dmE;gG~0 z9ES|5f&4`(LjSDRb+;DrKMD?>`4Q$VHER`4NBoZ0rr9Nrj*c%qcd04eW~gn&@2z;r zp2Ne3U*Xf39O;tQ+Yj|$wkvQqU_W+E4iT-#e=mlclumED_2|*fumdXeiA>(?kJofK z!5AT&s37!0^g4X%<0D~Oz;6~BE!vn6(jw3vV zOwUm@FlYjcM@&dSqN6XdwCU}cPjDX!Nc`5$S}OVgJo53`CaBOL7SD{u)hKa?sR|3L=^Z*GS_XIKy#n>(06$hC;nBQ|C`x4FNo3mkQ#mQD;m=+*EwrtHAx_P za|wpO8Hdq;oXHq4d{`)p{n49i7lkFr)~x z^{I@LtwVs6Dulc&8}RoEhWzaakSDr<`1<(lfAHklGy8AGzJzQ=Erq2-e3bJzU*B#x zQ_Y-wViGj=4UyN+N+zYTt0Xo_ClHv`jRdJCLMJj^fL*Q7AU7)i=ZWZ{Wz7#+ObWEh zGg)_-*a(mY1jz~=aM-=efUL^Vp-^USEfzQ#eQN1GXtBfYf1ww8NT&Tz8+Y5U32-Ss zl)6+m{Qa?}BIDZ`P_pN?BYjj$?C^$K`u&2g5Cp>^%9P5jcDoZy-`e7cC!4i_%xl$%5a_>HvRke zekdL^GqYv23zyP+eZPStZnDN;9*e$s?pg|Z{R^5_Tbv=4@=yWyb_cG^=;)}f#Rm~$ z*Ex@y#=WlKfcKQ?SDs?41&n`m7VG+oyGDhs6)gbpm9wMhgTWLz{Pg0t1d)WCt#RqY z9lnNMeeu_RjlmVNir&OHhX_85jnGZXpdJCGRWdua&Kd%T0*s=L&bd2a!-zLA8)+0i zV#7GkN70Xnpc0rZB2wW@;b(V@=``Qi=*1P~_pCS?>UgDvcU1QPGnl3QdaHR&F@Q72V}U9PHg z+YlIMHT~Y|#?#3IO|`!~_hlPSoD>U?wVu(YI-WdqXk?RhO-y~t*<3kay?y2DTpz(rRfJK`{H+rrMWE_&(she(LM1$`8nG@=$wzvqM)9fU);> z{etHK0cTR+;|D`LbE+!QOMaJR+Ybm}sY_mcfDE?j{XBD1UT_zb2?M(6z6>3f4i5=J zUWolUoETHwi7sSl?DE5kIe!DGXag^4n{n78;|-UwOSSyn4^u@Y=h4OMTWICXp8DtlRD8w*KDRM|<<8+fN(e9%tr&zJsZ>x{=sFhF91#)W(k_rc)eES`;;;y z>8Do+jBm@88B%>UpIZKVEp2mzTrjvthr&q1dA$&~q(|o(<`zCMhub{>Y!{ zw#<09$^F5Ts`gqkTH&l+!awnc>S1`c>HYP|Fm#NVXfD>;K$Bl;dB-S{p;xe z1VbKjHa-%2MR2L_Ut!Co(VLuLnaes1fBy%R`SWQjUhjPm(zx(avOaLmYYy(E%mA{i zu3q{-z5_EL>PUa>okv27@%0KqnJVhOi;NVPH@IbSZAGs07Y1izc zt!I@hJTvG4F}~vwo7faX%FFkp*@~#>TSbeA`bt{pt+ZkDpsKPPJTv1rc-|{82lY{a z;NF`v?Rnc_a_l0^a~U7Y!8u;B(b3V|R50u^++p;vcZPyN%b**$|8|OT9pfic3ci0y zJm4k2RgU4qy&Ie0!8U2NCc}>nE#f0x=$8Y

    0nF;XcHHAkddAkU?O#d_o8DiF+NgH?MKKnCd+R*P$FEiJO7dnSWWE04Kd_0R z$wJ|=OliG^tHFJky|Ki9d48S~CtPb@qV zt(3MP5a_L;FxEwxcAV)mNtU>{N}Sc^6OeW;=k~s1gpV;t2*(l$orvhs*>!hJb`AuMIRE&hxQL`{c=) zHqSVP$?qXb+};Y~VTvwo=7)Sks6Zz4ycSgz!pZU4nW+kKRT3d&qKFdkb$ho^21)2ev=p1F2w#U!*T3U z*bbaW8&x*n-KgTP8P_`-w0Kxhn`YFT&vi{qZ%- zsWdpkxxi^;xHIll{MlmvcZ*j`nBr2NKTm_TNon(kt=7-Rc2S^;NsQ{FXGJR!cQVpqZy8ztj zDAe}hgo}V`2pJk7HaGMY5O4I#*VYCuHscA#QF2#JciZ-5;5(~qDyd0VI#M4!Iz9); zeYa0wkzNnsS%Fcns&BOl5i^*OEx1Z3qsc=ZEkC?o)hiv!6!XXm47^v*;rqkD090^fd!!+!mVqn7E4a!Ax(62*$^A08ux(G}1%#fLiDsf?n7qSq6v#m3|KeU!TtMAKztH`jS-k~D{Tr}LGt?W zu@gcXR;&y(6Y$BKynt~$4hm{S3ugGb@E@t31DJ)|>YhA-IC58DqES8^1Owi#&ZS@m z=$mX)`!;cpO^gm!n{A@Und z8ZUpcvFWM&ixlWGt|J~enqutCcWGTf&&edE|S z;!wjzzJPMLj!Gi>^Zvz)MimvO1qVGhex)w}oRZ{aa#J#(jaUzT3VHHaTgvClfw=uABhJ zv2wE-_33)6j5+fQ&gLUsICUV^oXTj_RpthP?HNtp^~6_OF#RHW%*Nk%xLy@;!hA2J zE)lff%8l4uUG-c&K^LkkhcTX$(p>^6}a*k76y-S)Ek7mJ#|~OC)Mapc%4pJQ@2oAFY|FtdGrJh2ykl*Ot9H z7rJM#xN#c!@{bVxwDFt+E)2TxL|1b0=YLQWUXI>y&CjoqG1~p~X|>EVXJwNcQH4_gNM;<^3?kf-Vr7J+NKiQe*o5yL+TuWcG9uh~>{&C@ ztSJSvjKS;_qi;ln>uAs@t(o=0Q|zt~tzP^1i6lnL;cn!SOI%2RgMzq-CHYeJ;o%G( zgOf+!lHAL1-tO)>%Ct*O%yvn{S?0z!yR1?ATvW7Y)L#Ql<+w@Fr{7J*xdyF~+kLqu z6zdaAhqCrA{)QZl*(y4Ko+ArLm{~leeHty+E2!^lyN|MPvYn+>-@m278Gr`~Lh&_W zC1G}4w+*4$0hjma(cea{e=l3sQ?2$!SNgSzXS=$5JXFOnAD;uzmyaC0@XWt1<=|tV zS8AG3)pnyo-!5MJ$h6ZAmx(ojGD7}x$b!!$^r}lh=LG}Zl5#gLWz5m-6>q6g?<9O*+|Id37&*)Hdv<2lT+fs z3lS(NCo}4=3@{%$Dvh^#2)pxw=RbL9)$ly-)k}$cLNCK5Gbh@t<360PjbOMFn-aR< zbEzSvV6*5(5s?FI-6aCnsgWp1+a0a9(}5M*&sIkFR=tO!%BzIv%S_c=P{bk}yR!0YzqD?PM+EYF};Z41*@ucOT&mBFuW1 zSLs4`gd;$hXzefuL~GCJf1<5#v#*kbe;JChg*CL8VBjE<&aN)DUd6Sy3Lt>@7b=|M zEkDVPIvaO1d&BTrPFM=pz0ryanHd!|36hkM zV^s2HTe>pRz>jkc%&_r&L8xn4-*OrBpv(>OUO+-orZs~6g#NvEY<#?aE05r&!h)VP zY)QZ*B*AOAaG-Y_&?mUe-YO|4GzldHn3(>a{F0oNR}u3f+p9&W3n_EM*z^cqL^=}8 zH0uk6x&+rUY#bB}y2&>KZ|jxs9#FUwA!bSL=CPABUL`B5p=BEP?q^iu1GRpD7|3SJ z1%gWAZ}=L{P)oo)`icg5C_S%S8JC|k9ltm zpF1zUB4=D+4wv9R+|Th2^m%W6s8xx)*^fjHzdGWueSF$p*<*>?!GnL1m{T>ZG~f<- zv!RWIxQtISnR7|*@FQ;By!n1F^e93g*}B;^3{BfL>ucdea3<&#SZ|SrYBUi-Qm>$U z#oup6OODRsLbyX6I$I$9Zt(`&pY01_F@3=dZXz|IN#R2IR%nw(h@180{V`_>-WOCH z!3V9{4Nx9;0SN-e!*#MS$7n)_SkT9KSa}JGE~z3LD(|rED2m8_=-Jx<03g!YnQ)u_ zB-ST@S-!Zr&{BT%2#gJj%*nhxHi|P@p~#ikW|+CoeTUUV1y4$D<|x7t%%MvMyqJgj><3%+O-?R6U-az5`QkcVi^-?etW*JV8h{o$DkP5_GudBE86_X)r`orotf;q z$%|kjY}-_5dk48&KXm1xj!265lr^zXH<{yldI`>xJz&K<*w$T2rvPr{7Nq2ZjS{X9 zV)-D1Fccs$WYm3DE?u;$jP*rSm{uM>lC@j;R-i+bmUd;7Hm$7i%9R9RhjUk9NZsT; z+nb5SA#2OXH>K(7Q%owYtoj-R@(9tr^K!G|IW4R`EKyFlqL~4B% zU~$i7tl9l9*CnJR^O^yCMOebL<+)`!P8BZWyayx`L3zNFs(*Z?4m5nI$lASm^JWyF zo33Ba3{${7xvKK7&qWk^D{x3l*%wJK3ib=X&77l&%+UyPkRpQK-4$U=WK(Si^v0%o z`FK_h-ne(KiDOrvI4C0W&aN*q(Y8Nz<@Q~xCC!jXFpgxusyA9`4kPD1rcY+@DnSTC zL4kVu?CDe6A1LUtBpv1(cvC*WZ%czyz`eW`w?rFK4IXb)1HMAh&=x;Ij0*6+Z!p8x zr-L(f1NKo-UJlpQ5`~aJz3LRJZ(UAo7h2AfV`0I5J6hj;OAMLTW`!aadGuZMshwwX z@A9E>B0V>=zl-_DT({Eg$a@a=H2_dd9|carEC?>KHWvLHx>|f2;R7RVsb+&_ur*i3 z5CkD=M?%V=SI=9#+PSHgD$T4f;Z*`j!c{TjQOc$U`=`FiU|q|55qEc6A0-4kza85p z>b}Euh8d|$Y%u$g*@8=zW~Q|dx<31#+k&9oM~6p5z_cQvDG5PJKOe8V>FMDl_e>Y3 z{cNsJ1J~z9s2}Zpp#^am2>aEKe3moJ@Cz62Lr^VapI!Ry!8z+5ptH;I;|b@!JeoCu zi8f^X_7Pr=R7^Z{!4AAw247H4P7aE1{6B+2#=Tf9@cx|f*lmK8IqyF3@u`I0l3=cE z4)${b7Y7=0Nq;uCV9N(Dz-;;Yxuk@Mtzor7#EgDEhA*)spmxr|qe=Yy=v?-@M5Grk z6kWFH=Da$nf_y0z9i7IoSo}leYPQuIxkPBs%kc1G7#a{K9LnSMe)M?jqsNC|5bptq z7jXT0F%*hDW0jBDj5l(%^9^BMKk!NFWM=@|%fWt;Yw+fmLfzF$*Z{!Se6Y8lv9$z> z1rlKPL~=hD>H>^Z56>_A9F9t2&JRJfh)xGc&pxnBF4*cLof(Y)uCllM&7wKvwY%=G zmh3^EUBd@!_JlZJZ&~>EY;N5zt5&1*BhT&QXm0?|8lBcGJZsBXud!vY0!oVdI0Ej; znU?wc(O0eu8Yi?T_Sta8bYq>c7$K|Bp{tpE8wIl+~6ExFmi z?@85qHvf8)L(Bm|7hBtL*iCHR^XFX2371>%LWi9imt^nOBJ9>}0(%2%1s7=cZcTP{ zY)1wdtVC8+Zzu_3D1ESNh%dxCh`mxePWWIxWA@im1%38em2Q-_yTJY2m8Hnu zz7q=bD0}r}rbjE3xig8*@SG>K0LW!4D4XTwt2sAj3`c53+P*yoV#X&xZZ4i1MC z6FEN2&_mFL+Hw)`GONz58mm&+e97V zq*1c?fL!3s`L5SPz7E>=^3rPw0UXm8C{4!II1yB<~%P74a} z-C1*RwH#A9-JA;KphLRILGpcFD9kF)t9y|YLMc}F3UTd{yQJFv3MMS?Py zp&>%+^qe*7dZ`?k)h6Z7am?!i}w9UL8GaRGCN8&3em~1{V|5!TO6BR02kj zMu;MjGB|rshu)Z6m{s^Ae4BV#>lvnMS0dAX58#LuD_73uvaN6&iJcw=X0DWT4pJC+ zU=h252B5mLzn_lppE!2xYh1`RAdfz}5_ek;rv+5(GesB2S%)Cl)bPPmKq}gG_=`U0 z9@gO=+Fu2VOiVB3a#u;vtm}Pwm1X+FfFPGcm4tImD;RV2Cg#eUEnu1c|6J}QxEEf$ zP(bX7pMANWnBXdeLHeUIl>;=1S%VH9Ogz7xn*_Q>NU;kam$3oz2~uw0TcYSJc{r05 ztuvY77*vVUPn`A3WBuwuz)1l#|37p{-MXzI-c0LS9D&ZBP$DkP8z{BdCP27O&ssmT z@gBbe=}$Jd5O>FdsJD286%qUehHCca=btY=UG^f^N;I%+7n=ZkK4MP|p+mtA8xi@B z4OqQ+`BFmM@{6CzdCrYh!^eku0l}g*d>A3pTV_!;61eRK+7c3mD>O>k*C^B<0;#P| z2c{4-2l%~biR8V{B)3xc-EfQuEEi!ou?gpL!r5u2NW@D*VE(!_!}kK5<%`l)XsO-m6;=I{bxf)@zDLyUSN2rtZ<@ZS4U z<|ipY09#*ir4tK>Ia_E9p03=S0^@1tSQX}>*mb_G#&YS&vhhs1Y zt&apa3;s3~)?&-)pR-U_^V^k%pq9Us+I`~Ug`VDto@;IxlxL0n#1n0U*MQKb{(=T@ zh34s`*|s~;Ty~uMN1aV3Rrk?UO)?PPZKxG!naCc6Gk9noh{=FE>m&Ge%R*52iNz2J z7cN|QEXv`)vtF|(4HlKUkr(kMPwgU!q{p6XXL$$cNrJ-@n)AjpXS`%TR7n@?K#Ud`YK;n92U=* z#X<2db}d*z<6@nJB!_$u1CBhD$?OmpH%PZfg7~aUS;-wBl>y9N9*P%nh7QKiZ_eSM zp@WNOPMn=}ha|IMauQ*xaW=yYb%fk`^9TwPs{2d;CK8LZrdeA&6|l>=WOGCyR&K`G z;>XzH+(6fvNyNhgfxw?Nc2xu70SgyMg;=YzIE1ksgmL#vL4g^fWjS}2%_jOz^ay|W z;HXJ0_&5~tuv{$gtQpL|4sllp1f+?U=>Nq5Pap)`q4}zaUuH+tv9NjUznsto?N?a? z+*XO4YUaeytUWoQ3qjMIXaYFJVz#^q-2)NuCK#wV7_IQycp{`cdwh+@8;g&qU8;;T zjN?pwH>Q4QHIhTXnsMy21ajmpWJpOmjbFDe6*`snK131}DRY+@A{Kgxs09WsE8kmq zmR`75QUWJmP*A{{iX(AutuQd0Q~(jwzB4Zs@eSl-v!UX%;4I4!I6^F>__2l}TU2wV zzjp=lJ!W#2wa;JNQyJuKZo#hD+-UVk>ZJ*28Pk z#-?~PK~Ve@vQ-i_WLn(~Q37%HcJjl~?8>O;E8WwZ^!}2rN+V$swu6~hse*o~BS9!4 zQX)r4_F3G+Y!y%sUP5WH)R`BYZ>+;NPV?{hcW-I10$`c?$Ro1(4Z+--4tVk;U^TnW z=6pOE<>)`C^%#p{adz#tlzmR<`BA?^3^t?iiDWK9j z!@Lzy@bK?hUtmrRe(DG6@-Wut2ejgSVz!~T2qyR(IJ@x3$R9)b!n25OEd}6`^+=eh zG3f1OV8hoD@<5rNpC8`UDrD56{EW z6Sv#&UN%t}$}kn22D5bG%UfXs)Dahn)B^@@o^yLC5etE5j==w6b&=M@4=0ii9WtXe z1ueJ9jei=b*A)5n8e75VihRGuW%MRYYJ`5ns$&A!5X>iElPmpaJe`a zXOREI$?A{fnZF2natkvq3A_oKF^tU^&nEmb1TB5cCk`SGNIo*-TPbpR=&Dds2aJQEN>>rmo)srvmDo-YpXK_3uIKCgzoV#XFQfY?S z)$B=-l$$Fwfy(7X0Zc^fT;Mcwo@n)$b;AYMtEi*_;v?+)t5-9f z($sHo_HR#aIF3{>_93u;`tjK4Kw7VO#;8|8!6CK-EX5e}+y-n8u;`=kUJs=9#zIta zJ|~0km+v$R7Tn$W1)fr&$pR3Z^!cL4BVAp>_wW6+%z*d{;)R0urFlpf>ykE)*EArW zc+8RTr*cV_-QypLOYMmTJVJ4-(nT%c)qx=B_#azwr6twD0)!oZJV(kKYtVxn4aI}l z0PMi)q@;6gIliLm&hT?>SIrzoyig->Vi=(ZuLF6b-MfKfa6njFwH*x*peMvrJ7I)+ zm9Hm08hH%9KI?bh|ipr-Tc)?76D<08kpkn`y;`0o1d(cad)}h*@girc!3t%J6;5_Z=@(bCb@UAD{f9F)-7WOynga=!T7wBe@?7qpXnA zF)&c1FhhutibncDIHWDp`m4_ud&${TU?{_F)SSgCDm5JZMrQkj%#z@S1Kz0EFY$6o z;M@Rd*V@p18HdFcXadbL;tC4edk9asBJ@l*UZs>ye{-x{9C;o_n9dXd68$3Ly9gzM z6%-VD#E3O2+W!9wAmSAY?Xja^3`IXmi(Q;%n8wfx7q6}qkWZl%OB>qOUC2Pt`0gG8 zZ&wP}Q;QL5ejvZci8$7;VXEX&gklv&%aEmiweCU$oS3MNg*v>qj?D)z=c?3`ZnB>S z4qHf0k(O?aTjEq5ts@7_%%@vHM8oG#O$k>z(kddTOO;k3ZVGekJ?hjEsbm_|j;Az> zhLmo&{|0KrMK^Em22ps%Ff6Fk)wSOdsv7w4NgN2Xd-pn7%=frPRy~y{#pkPU`^D{# zX(Lgjt?xNsw2b6_=2J;(>#bhIvzI9ms+0Pj?wtHJ0*TI(cLBx<4D5qE1`|B@|Fw5L z-cY7{+}Z9;cP;96%T|VUx3Yt+n~E#KLAgzS6cr`Zs#J^72x%}RZQZ(TORFMwDwHYH zgbbQNl43KB!W7N4)ifA0x-ou@G57P*uRmbVJ?GxjbDa0gdA;X-pZ9s6AK&li`}usI zX=V!+NNaT&;sQ^(NP+h}(92okF3TWB!!HyIG8vR8g=s=*LTizJ-_4Sk)}lkpzqh#) zMDYyYKloS!fxx|H#|1q^iUqz7fK2T#z!V7r2c}knJcgzSApr4)G<~yWKu$2I0nI|u zwG%;fC{;ii#pdI=XW`UZ;~vhc*e+@?T-mDbf_c=+Zgg?v2N`1}OLFX}cMJ$VA}1QT zxr2Bw^%f1YA zjNR&`Qh-FWa0EsQJ_wEsd*4KE#w=K~k6{!8*^5;?3EWUxcxiX+dSULZTcp%f`+pu^ zYsinfuv)(|MuF5Dg5p4X09b>=F9O^~jj$v?)7$k-H}Xr&AY-j?j9_a2>I;amW`_|sg(c!RARZXl#Yx%7YU>sAY-2hRig9I+5R&NWw~#Usa(6ao z>6EEC{P2$E6eCbGR>VX$ker5Z^AP7YJFJrHfd_QOpJN?!9bv*B9E&gQ_U_#V#U`?o zq-$O>x}6HhQzl-$x7#g)4v?lZ+ zY;)WTnAqUmEJbHUkE&hku&t(h&KzF)MuKtYT!xmTKP-4I+J~os7Nu_RJMKDd&Yb(& z7=D{%YNBZ{0+tu1yX@RqZytd>@_&nYaB8k3l>J3r?JBiDx+B}6PR%zbj4^s6^sbOIrWZs*`H<>;hf2hhYyoR3*m@wkLda}1(Vso0Z)vPUzjkKyb^24z3G>F1$z;}NU;0mw06e_@lR;;kbr ziY_{H_LKUdV28X_-j>kAp$+V*v;@}H9E9VD9mi}3qB_)lM7;B2NJ6x zQDRSq4NU%u)N@ZCf6*mG#;uWfB#CK73iVT_bUHoF)YOZtZ@^D@_3IgF6XQ(N%1%jj z&wX2lleP7A+D^pK*~X(;K4)#&SJ{1!8&y9oIF6U=&F~(NdGqoz2)WU!uNMUwE4nwI zy|;sJCs-;N8?H%C_s(@F+g{h9H#?pUb)(`*`_!pzvyRs@nL|g8h*|u&K5;_R&zkx9 znN3nG!7!Yw*OJ4ZR)!;uwXY_3vd%h5^b<2D)qh+T(($d-#s{k?u|wzYXG;`4JvTWm z4@(9>1^89g-&(#>^~lgB!Z^N{(^rsb5gqK97ks0)5Ml&AlgXrcFU*M3sFIVD+p%?2 zk(2uN%ycZ~i;Lv^9(kBehoriaHXwlw?n@z&NZGd4RR{iU$g<&&%Qa`9a9;}pTOO#5cqM}rz@S4C_ zq*Zhx7uLeK=je;6dfH-E6UeNV+4sd_5w4dB@)l<`rMhhY$@5MFI|r<|ii(kw?q`eI zqbhttLb?Y{^xrn6N8WG0k?QIgJ#u@8vJUYprwN}xr)EFv>Q&x8QJ_sWMB+TD21m)( zJfwv1Y}a}x5JjUfP*=~1unVP-v*_Fl7c>Em@9-IJd#l^~Xy@dE4FCFe7`=V2&L5@| zp`j1OS?Bk^;O^?TwXi+e6v*geS_*wT z_ns%b%nv0=_aqS%_^5m~?SlxFIQ>=9rwcx{!-o#?sXt7%#iw@o)D9m;#sAGb>1=aQ zCrQ1zV(X$T^Yeutzu>cgN=H&Qw*D>a^GHZDe?8^&?2)mYKkBu) zd4K%>nn!nc>@7$X&?+3H+3zg2$(v_nkM4LMjG8#bUGV!aoBxHC`G4XO!-mDD&aD0Z T$F{{pQ?FU&g diff --git a/api-app/infra/bicep/main.bicep b/api-app/infra/bicep/main.bicep index abb95c3..09b340f 100644 --- a/api-app/infra/bicep/main.bicep +++ b/api-app/infra/bicep/main.bicep @@ -32,7 +32,7 @@ param isPrivate bool = true @description('User Assigned Identity name (existing in same RG).') param userAssignedIdentityName string -@description('Subnet ID for regional VNet integration (snet-appsvc).') +@description('Subnet ID for regional VNet integration (snet-services).') param vnetIntegrationSubnetId string @description('Subnet ID for the private endpoint (snet-pe).') @@ -54,32 +54,35 @@ resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@ name: userAssignedIdentityName } -var environmentVariables = concat([ - { - name: 'COSMOS_DB_ENDPOINT' - value: cosmosAccountEndpoint - } - { - name: 'COSMOS_DB_DATABASE_NAME' - value: cosmosDbName - } - { - name: 'AZURE_STORAGE_ACCOUNT_NAME' - value: storageAccountName - } - { - name: 'AZURE_OPENAI_ENDPOINT' - value: '' - } - { - name: 'AZURE_OPENAI_DEPLOYMENT_NAME' - value: '' - } - { - name: 'ALLOW_ORIGINS' - value: join(allowOrigins, ',') - } -], additionalEnvironmentVariables) +var environmentVariables = concat( + [ + { + name: 'COSMOS_DB_ENDPOINT' + value: cosmosAccountEndpoint + } + { + name: 'COSMOS_DB_DATABASE_NAME' + value: cosmosDbName + } + { + name: 'AZURE_STORAGE_ACCOUNT_NAME' + value: storageAccountName + } + { + name: 'AZURE_OPENAI_ENDPOINT' + value: '' + } + { + name: 'AZURE_OPENAI_DEPLOYMENT_NAME' + value: '' + } + { + name: 'ALLOW_ORIGINS' + value: join(allowOrigins, ',') + } + ], + additionalEnvironmentVariables +) module apiApp '../../../infra/bicep/modules/web-app-container.bicep' = { name: 'apiAppDeployment' diff --git a/api-app/infra/bicep/main.json b/api-app/infra/bicep/main.json new file mode 100644 index 0000000..24067f6 --- /dev/null +++ b/api-app/infra/bicep/main.json @@ -0,0 +1,441 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "1788472209259277111" + } + }, + "parameters": { + "namePrefix": { + "type": "string", + "defaultValue": "aiinvest", + "minLength": 4, + "metadata": { + "description": "Name prefix for resources" + } + }, + "environment": { + "type": "string", + "defaultValue": "dev", + "metadata": { + "description": "Environment name (dev, staging, prod)" + } + }, + "appServicePlanId": { + "type": "string", + "metadata": { + "description": "App Service Plan resource ID" + } + }, + "containerRegistryServer": { + "type": "string", + "metadata": { + "description": "Container Registry login server, e.g. myacr.azurecr.io" + } + }, + "containerImage": { + "type": "string", + "metadata": { + "description": "Container image for the backend app" + } + }, + "cosmosAccountEndpoint": { + "type": "string", + "metadata": { + "description": "Cosmos DB account endpoint" + } + }, + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Cosmos DB database name" + } + }, + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Storage Account name" + } + }, + "allowOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [ + "*" + ], + "metadata": { + "description": "CORS allowed origins" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, deploys the web app with public access disabled and a private endpoint." + } + }, + "userAssignedIdentityName": { + "type": "string", + "metadata": { + "description": "User Assigned Identity name (existing in same RG)." + } + }, + "vnetIntegrationSubnetId": { + "type": "string", + "metadata": { + "description": "Subnet ID for regional VNet integration (snet-services)." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "metadata": { + "description": "Subnet ID for the private endpoint (snet-pe)." + } + }, + "appServicePrivateDnsZoneId": { + "type": "string", + "metadata": { + "description": "Private DNS zone ID for privatelink.azurewebsites.net" + } + }, + "additionalEnvironmentVariables": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Additional environment variables" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "variables": { + "appName": "[format('{0}-api-{1}', parameters('namePrefix'), parameters('environment'))]", + "environmentVariables": "[concat(createArray(createObject('name', 'COSMOS_DB_ENDPOINT', 'value', parameters('cosmosAccountEndpoint')), createObject('name', 'COSMOS_DB_DATABASE_NAME', 'value', parameters('cosmosDbName')), createObject('name', 'AZURE_STORAGE_ACCOUNT_NAME', 'value', parameters('storageAccountName')), createObject('name', 'AZURE_OPENAI_ENDPOINT', 'value', ''), createObject('name', 'AZURE_OPENAI_DEPLOYMENT_NAME', 'value', ''), createObject('name', 'ALLOW_ORIGINS', 'value', join(parameters('allowOrigins'), ','))), parameters('additionalEnvironmentVariables'))]" + }, + "resources": { + "userAssignedIdentity": { + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "name": "[parameters('userAssignedIdentityName')]" + }, + "apiApp": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "apiAppDeployment", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[variables('appName')]" + }, + "location": { + "value": "[resourceGroup().location]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "appServicePlanId": { + "value": "[parameters('appServicePlanId')]" + }, + "containerImage": { + "value": "[parameters('containerImage')]" + }, + "containerRegistryServer": { + "value": "[parameters('containerRegistryServer')]" + }, + "userAssignedIdentityResourceId": { + "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]" + }, + "userAssignedIdentityClientId": { + "value": "[reference('userAssignedIdentity').clientId]" + }, + "targetPort": { + "value": 8090 + }, + "healthCheckPath": { + "value": "/health" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "vnetIntegrationSubnetId": { + "value": "[parameters('vnetIntegrationSubnetId')]" + }, + "privateEndpointSubnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "appServicePrivateDnsZoneId": { + "value": "[parameters('appServicePrivateDnsZoneId')]" + }, + "appSettings": { + "value": "[variables('environmentVariables')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "9094118072846182188" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Web App name" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for resources" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "appServicePlanId": { + "type": "string", + "metadata": { + "description": "App Service Plan resource ID" + } + }, + "containerImage": { + "type": "string", + "metadata": { + "description": "Container image reference, e.g. myacr.azurecr.io/ai-invest-api:latest" + } + }, + "containerRegistryServer": { + "type": "string", + "metadata": { + "description": "Container registry login server, e.g. myacr.azurecr.io" + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "metadata": { + "description": "User-assigned managed identity resource ID for ACR pull and runtime auth." + } + }, + "userAssignedIdentityClientId": { + "type": "string", + "metadata": { + "description": "Client ID of the user-assigned identity (exposed to the app as AZURE_CLIENT_ID)." + } + }, + "targetPort": { + "type": "int", + "defaultValue": 8090, + "metadata": { + "description": "Container target port the app listens on (set as WEBSITES_PORT)" + } + }, + "vnetIntegrationSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource ID for regional VNet integration (Microsoft.Web/serverFarms delegation)." + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, locks the app down: publicNetworkAccess=Disabled and creates a private endpoint." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource ID for the private endpoint (only when isPrivate=true)." + } + }, + "appServicePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource ID for privatelink.azurewebsites.net (only when isPrivate=true)." + } + }, + "appSettings": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Additional app settings (array of {name,value})." + } + }, + "healthCheckPath": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Health check path (e.g. /health, /). Empty disables health check." + } + } + }, + "variables": { + "baseAppSettings": [ + { + "name": "WEBSITES_PORT", + "value": "[string(parameters('targetPort'))]" + }, + { + "name": "WEBSITES_ENABLE_APP_SERVICE_STORAGE", + "value": "false" + }, + { + "name": "DOCKER_REGISTRY_SERVER_URL", + "value": "[format('https://{0}', parameters('containerRegistryServer'))]" + }, + { + "name": "DOCKER_ENABLE_CI", + "value": "true" + }, + { + "name": "AZURE_CLIENT_ID", + "value": "[parameters('userAssignedIdentityClientId')]" + } + ], + "vnetRouteAppSettings": "[if(empty(parameters('vnetIntegrationSubnetId')), createArray(), createArray(createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', '1'), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'WEBSITE_PULL_IMAGE_OVER_VNET', 'value', 'true')))]" + }, + "resources": [ + { + "type": "Microsoft.Web/sites", + "apiVersion": "2024-04-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "kind": "app,linux,container", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[format('{0}', parameters('userAssignedIdentityResourceId'))]": {} + } + }, + "properties": { + "serverFarmId": "[parameters('appServicePlanId')]", + "httpsOnly": true, + "publicNetworkAccess": "[if(parameters('isPrivate'), 'Disabled', 'Enabled')]", + "keyVaultReferenceIdentity": "[parameters('userAssignedIdentityResourceId')]", + "virtualNetworkSubnetId": "[if(empty(parameters('vnetIntegrationSubnetId')), null(), parameters('vnetIntegrationSubnetId'))]", + "vnetRouteAllEnabled": "[not(empty(parameters('vnetIntegrationSubnetId')))]", + "siteConfig": { + "linuxFxVersion": "[format('DOCKER|{0}', parameters('containerImage'))]", + "acrUseManagedIdentityCreds": true, + "acrUserManagedIdentityID": "[parameters('userAssignedIdentityClientId')]", + "alwaysOn": true, + "ftpsState": "Disabled", + "http20Enabled": true, + "minTlsVersion": "1.2", + "healthCheckPath": "[if(empty(parameters('healthCheckPath')), null(), parameters('healthCheckPath'))]", + "appSettings": "[concat(variables('baseAppSettings'), variables('vnetRouteAppSettings'), parameters('appSettings'))]" + } + } + }, + { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[format('{0}-pe', parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('privateEndpointSubnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[format('{0}-pe-conn', parameters('name'))]", + "properties": { + "privateLinkServiceId": "[resourceId('Microsoft.Web/sites', parameters('name'))]", + "groupIds": [ + "sites" + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Web/sites', parameters('name'))]" + ] + }, + { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', format('{0}-pe', parameters('name')), 'default')]", + "properties": { + "privateDnsZoneConfigs": [ + { + "name": "azurewebsites", + "properties": { + "privateDnsZoneId": "[parameters('appServicePrivateDnsZoneId')]" + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-pe', parameters('name')))]" + ] + } + ], + "outputs": { + "id": { + "type": "string", + "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]" + }, + "name": { + "type": "string", + "value": "[parameters('name')]" + }, + "defaultHostName": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2024-04-01').defaultHostName]" + } + } + } + }, + "dependsOn": [ + "userAssignedIdentity" + ] + } + }, + "outputs": { + "containerAppName": { + "type": "string", + "value": "[reference('apiApp').outputs.name.value]" + }, + "containerAppUrl": { + "type": "string", + "value": "[reference('apiApp').outputs.defaultHostName.value]" + }, + "containerAppId": { + "type": "string", + "value": "[reference('apiApp').outputs.id.value]" + } + } +} \ No newline at end of file diff --git a/docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md b/docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md new file mode 100644 index 0000000..4221cd9 --- /dev/null +++ b/docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md @@ -0,0 +1,495 @@ +# InvestCorp – Zero-Trust Deployment Package + +> **Solution**: Agentic AI Investment Analysis Sample (private / zero-trust topology) +> **Target**: InvestCorp, Bahrain +> **Validated**: 14 May 2026 in `MCAPS-Hybrid-AI&HPC-Saad` / `swedencentral` +> **Author**: Cloud Accelerate Factory + +This document is the single source of truth for deploying the solution into an InvestCorp Azure subscription. It records **what is provisioned**, **what network controls are needed**, **what the operator workstation must be able to reach during bootstrap**, and **what temporary exceptions the operator must request from the InvestCorp network / security team**. + +It is the companion to: +- [PRIVATE_DEPLOYMENT.md](./PRIVATE_DEPLOYMENT.md) — engineering-grade reference +- [`infra/bicep/main.bicep`](../infra/bicep/main.bicep) — the template that does the work +- [`_assets/zero-trust-architecture.png`](../_assets/zero-trust-architecture.png) — logical view + +--- + +## 1. Executive summary + +| Item | Value | +| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Deployment model | Single Azure resource group, single VNet (customer-supplied `/26`), zero public ingress on the workload | +| Region (recommended) | `uaenorth` or `qatarcentral` for data residency, **or** `swedencentral` if model capacity in MENA is constrained (Foundry gpt-4.1-mini is available) | +| Topology | App Service Plan (Linux) hosting two containerised Web Apps + private PaaS dependencies, all reachable only through Private Endpoints | +| Operator access | **No Bastion, no jumpbox is provisioned by the template**. Operators run scripts 2 & 3 from a workstation reachable via ExpressRoute / VPN / hub peering | +| Egress from apps | Routed through the VNet (`WEBSITE_VNET_ROUTE_ALL=1`) to Private Endpoints + service endpoint for AI Foundry | +| Identity | One User-Assigned Managed Identity (UAMI) federated to both apps. No keys, no shared secrets | +| Validated end-to-end | Yes — Mac (public) is `403`/blocked, peered VM (private) returns `HTTP 200` for both apps via PE | +| Estimated monthly Azure $$ | ≈ **US $620 – 780 / month** at idle in Sweden Central (see §3.3). Excludes Foundry token consumption. | + +--- + +## 2. Logical architecture + +![Zero-trust architecture](../_assets/zero-trust-architecture.png) + +Diagram source: [`_assets/zero-trust-architecture.mmd`](../_assets/zero-trust-architecture.mmd) (Mermaid) and [`docs/diagrams/private_architecture.py`](./diagrams/private_architecture.py) (mingrammer/diagrams Python). + +--- + +## 3. What gets deployed + +### 3.1 Resource inventory (production-grade) + +This is the exact set of resources observed in the validation deployment (`rg-aiinvest-test` / `swedencentral`). Every public data-plane is disabled unless flagged otherwise. + +| # | Azure resource type | SKU / tier | Count | Public network | Purpose | +| --- | ---------------------------------------------------- | ------------------------------------ | ----- | -------------------------- | ------------------------------------------- | +| 1 | `Microsoft.Network/virtualNetworks` | n/a | 1 | n/a | Workload VNet `/26` | +| 2 | `Microsoft.Network/networkSecurityGroups` | n/a | 2 | n/a | NSGs for `snet-services` + `snet-pe` | +| 3 | `Microsoft.Network/privateDnsZones` | n/a | 12 | n/a | privatelink zones (see §3.2) | +| 4 | `Microsoft.Network/privateEndpoints` | n/a | 6 | n/a | api / web / ACR / Cosmos / Blob / AMPLS | +| 5 | `Microsoft.Web/serverfarms` | **`P0v3`** (Linux) | 1 | n/a | App Service Plan | +| 6 | `Microsoft.Web/sites` (`app,linux,container`) | shares ASP | 2 | **Disabled** | `*-api-dev` + `*-web-dev` containers | +| 7 | `Microsoft.ContainerRegistry/registries` | **`Premium`** | 1 | **Disabled** | Required for PE on ACR | +| 8 | `Microsoft.DocumentDB/databaseAccounts` | NoSQL, `Continuous7Days` backup | 1 | **Disabled** | Cosmos DB, `disableLocalAuth=true` | +| 9 | `Microsoft.Storage/storageAccounts` | **`Standard_LRS` / `StorageV2`** | 1 | **Disabled** | Blob, `allowSharedKeyAccess=false` | +| 10 | `Microsoft.CognitiveServices/accounts` | **`S0` / `AIServices`** | 1 | **Enabled** + networkAcls¹ | Azure AI Foundry account | +| 11 | `Microsoft.CognitiveServices/accounts/projects` | inherits S0 | 1 | n/a | Foundry project `aiinvest-project` | +| 12 | Model deployment (gpt-4.1-mini) | **`GlobalStandard` capacity `100`** | 1 | n/a | LLM used by the agent | +| 13 | `Microsoft.ManagedIdentity/userAssignedIdentities` | n/a | 1 | n/a | UAMI federated to both apps | +| 14 | `Microsoft.OperationalInsights/workspaces` | PerGB | 1 | Disabled¹ | Log Analytics, `disableLocalAuth=true` | +| 15 | `Microsoft.Insights/components` (App Insights) | workspace-based | 1 | Disabled¹ | App telemetry, `disableLocalAuth=true` | +| 16 | `microsoft.insights/privateLinkScopes` | n/a | 1 | n/a | AMPLS joining LAW + AppInsights | + +¹ AI Foundry: `publicNetworkAccess=Enabled` at the account level but `networkAcls.defaultAction=Deny`, with a VNet rule for `snet-services`. Plus a Private Endpoint on `services.ai.azure.com` (recommended hardening: also set `publicNetworkAccess=Disabled` after bootstrap — see §6.3). +¹ AMPLS Log Analytics: ingestion & query are forced through the Private Link Scope (`PrivateOnly`). + +### 3.2 Private DNS zones provisioned (12) + +All linked to the workload VNet. **Customer must also link these to whichever VNet operators are calling from** (or forward `privatelink.*` to Azure DNS over peering). + +| Zone | Used by | +| ------------------------------------------ | ------------------------------------------------ | +| `privatelink.azurewebsites.net` | API + Web App Service | +| `privatelink.azurecr.io` | Azure Container Registry | +| `privatelink.documents.azure.com` | Cosmos DB (SQL API) | +| `privatelink.blob.core.windows.net` | Storage (blob) | +| `privatelink.cognitiveservices.azure.com` | AI Foundry / Cognitive Services data plane | +| `privatelink.openai.azure.com` | OpenAI inference endpoints | +| `privatelink.services.ai.azure.com` | Foundry project endpoints | +| `privatelink.monitor.azure.com` | AMPLS | +| `privatelink.oms.opinsights.azure.com` | AMPLS / agent | +| `privatelink.ods.opinsights.azure.com` | AMPLS / ingest | +| `privatelink.agentsvc.azure-automation.net`| AMPLS (Monitor agent) | +| `privatelink.azconfig.io` | Reserved (App Configuration; not currently used) | + +### 3.3 Cost estimate (idle, US $, May 2026 list prices) + +Use [Azure pricing calculator](https://azure.microsoft.com/en-us/pricing/calculator/) for an InvestCorp-specific quote. Indicative monthly cost in Sweden Central at idle: + +| Item | Approx US $/month | +| ------------------------------------------ | ----------------- | +| App Service Plan `P0v3` Linux | ~ 88 | +| Azure Container Registry **Premium** | ~ 167 | +| Cosmos DB NoSQL (1000 RU/s, 7-day PITR) | ~ 80 | +| Storage account (LRS, low traffic) | ~ 5 | +| AI Foundry / OpenAI (gpt-4.1-mini, idle) | ~ 0 (pay per use) | +| Log Analytics + App Insights (PerGB) | ~ 30 (small) | +| 6 × Private Endpoints | ~ 50 | +| Private DNS zones | < 5 | +| **Optional**: Bastion Basic + Public IP | ~ 138 | +| **Subtotal idle (no Bastion)** | **≈ 425** | +| **Subtotal idle (with Bastion)** | **≈ 563** | + +Add LLM token cost on top: `gpt-4.1-mini` GlobalStandard is currently $0.40 / 1M input tokens and $1.60 / 1M output tokens. + +--- + +## 4. Network requirements (ask the InvestCorp network team) + +### 4.1 Workload VNet + +| Need | Detail | +| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | +| **CIDR** | **One `/26` block** (64 IPs) that does **not overlap** any peered hub / on-prem range. The template splits it into `snet-services` and `snet-pe` /27s | +| Peering | Bidirectional peering between this VNet and the InvestCorp hub (or ExpressRoute / VPN gateway VNet). `allow-forwarded-traffic=true` recommended | +| DNS | The hub DNS server must forward all `privatelink.*` zones to Azure DNS `168.63.129.16`, **or** the 12 zones must be linked to the hub VNet as well | +| Outbound from apps | App Service VNet integration routes all egress to the VNet; firewall the VNet egress like any other workload subnet | +| Operator workstation reachability | The workstation that runs scripts 2 & 3 must be able to resolve and reach `*.azurecr.io`, `*.azurewebsites.net`, `*.documents.azure.com`, `*.blob.core.windows.net` **on their private IPs** via peering | + +### 4.2 NSG rules added by the template (informational) + +| NSG | Inbound default | Outbound default | +| ----------------------------------- | ------------------------ | -------------------------------------- | +| `*-nsg-services` | Deny all from internet | Allow VNet → Azure services (TCP 443) | +| `*-nsg-pe` | Deny all from internet | Default | + +No internet inbound is ever permitted on the workload subnets. + +--- + +## 5. Operator workstation prerequisites & outbound URL whitelist + +The "operator workstation" is whatever box runs `infra/1-deploy-azure-infra.sh`, `infra/2-build-and-push-images.sh`, `infra/3-deploy-apps.sh`. It can be a laptop on InvestCorp corporate network, an Azure Cloud Shell that has been joined to a peered VNet, a Windows Server / Linux VM in the InvestCorp hub, or a self-hosted Azure DevOps agent. + +### 5.1 Required tooling + +| Tool | Min version | Used by | Install reference | +| ------------------- | ----------- | ------------------- | -------------------------------------------------------------------------------------------------- | +| Azure CLI (`az`) | 2.65+ | All 3 scripts | `brew install azure-cli` / [docs.microsoft.com/cli/azure](https://learn.microsoft.com/cli/azure) | +| Bicep CLI | 0.32+ | Script 1 | `az bicep install` | +| Docker Engine | 24+ | Script 2 (`--docker`) | Docker Desktop / `apt install docker.io` | +| Node.js + npm | 18 LTS+ | Script 2 (web build)| [nodejs.org](https://nodejs.org/en/download) | +| Python 3 | 3.10+ | Script 1 helpers | Usually pre-installed; otherwise [python.org](https://www.python.org/downloads/) | +| `jq` | 1.6+ | Script 3 outputs | `brew install jq` / `apt install jq` | +| `bash` | 4+ | Script 1/2/3 | macOS / Linux / WSL2 | +| `git` | any | Cloning the repo | `apt install git` | + +### 5.2 Outbound URLs the workstation must reach during bootstrap + +These are **only required while the operator runs scripts 1 → 3**. They can be revoked after deployment completes. Group by purpose: + +#### A. Microsoft control plane & Entra ID (always needed for `az`) + +| Destination | Port | Reason | +| -------------------------------------- | ---- | ------------------------------------------------- | +| `login.microsoftonline.com` | 443 | Entra ID login for `az login` | +| `login.microsoft.com` | 443 | Token issuance | +| `graph.microsoft.com` | 443 | RBAC lookups (`az ad signed-in-user`) | +| `management.azure.com` | 443 | ARM control plane (all `az` resource commands) | +| `management.core.windows.net` | 443 | Legacy ARM | +| `*.cognitiveservices.azure.com` (mgmt) | 443 | Cognitive Services control plane | +| `aka.ms` | 443 | `az` CLI redirects + Bicep release downloads | +| `mcr.microsoft.com` | 443 | Pull `azure-cli` / Bicep / Foundry containers | + +#### B. Azure data plane (for image push + final smoke test) + +These must be reachable on **public IPs only during bootstrap** if the operator is NOT yet peered. If the operator workstation is already peered, they should resolve to private IPs and **public access is not needed**. + +| Destination | Port | Purpose | +| -------------------------------------------------------- | ---- | --------------------------------------------- | +| `.azurecr.io` | 443 | `docker push` or `az acr build` for images | +| `.privatelink.azurecr.io` | 443 | Private FQDN (only via peering) | +| `*.blob.core.windows.net` (region-specific) | 443 | Storage data plane | +| `*.documents.azure.com` (region-specific) | 443 | Cosmos data plane | +| `*.azurewebsites.net` | 443 | App Service ingress (only via peering) | + +#### C. Bootstrap supply chain (script 2 build step pulls these) + +| Destination | Port | Purpose | +| --------------------------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | +| `registry.npmjs.org` | 443 | `npm install` for `web-app/` | +| `registry-1.docker.io` | 443 | Docker Hub — base images (`python:3.12-slim`, `node:20-alpine`, `nginx:alpine`) | +| `auth.docker.io` | 443 | Docker Hub auth | +| `production.cloudflare.docker.com`| 443 | Docker Hub CDN | +| `pypi.org`, `files.pythonhosted.org`| 443| Python wheels for `api-app/requirements.txt` (FastAPI, OpenAI SDK, MS Agent Framework, etc.) | +| `objects.githubusercontent.com` | 443 | GitHub raw asset fetches (Bicep templates etc.) | +| `github.com` | 443 | Clone repository, version metadata | +| `release-assets.githubusercontent.com` | 443 | Bicep release binaries (used by `az bicep`) | + +> If InvestCorp uses an internal mirror (Artifactory / Nexus / MS Container Registry replica), substitute those instead — the Dockerfiles accept registry overrides. + +#### D. Optional (only if using Bastion for ad-hoc admin) + +| Destination | Port | Purpose | +| ------------------------------------- | ----- | ---------------------------------- | +| `portal.azure.com` | 443 | Azure Portal Bastion connect page | +| `*.bastionglobal.azure.com` | 443 | Bastion data plane | +| `bastion.azure.com` | 443/22/3389 | Bastion control plane | + +--- + +## 6. Temporary changes required during bootstrap + +The zero-trust template intentionally locks every data plane down. To **first** push application images & grant the operator privileges, a small number of **temporary** changes are needed. Each one MUST be reverted before go-live. + +### 6.1 Grant the operator AAD identity `AcrPush` on the ACR + +The template only grants `AcrPull` to the workload UAMI. The human (or service principal) running `infra/2-build-and-push-images.sh` needs **`AcrPush`** (and ideally `AcrDelete`) on the new ACR. + +```bash +ME=$(az ad signed-in-user show --query id -o tsv) +ACR_ID=$(az acr show -n -g --query id -o tsv) +az role assignment create --assignee-object-id $ME --assignee-principal-type User \ + --role AcrPush --scope $ACR_ID +``` + +If the operator is a service principal (CI/CD), grant the SP instead. + +**Revert**: optional. Many customers leave `AcrPush` in place for the deployment SP/group. Remove with `az role assignment delete`. + +### 6.2 Temporarily enable ACR public network access (only if operator is NOT yet peered) + +If your operator workstation cannot yet reach `.azurecr.io` over peering (e.g., on Day 1 before the ExpressRoute is configured), you must briefly open ACR. **Two extra hardening flags must be flipped first**: + +```bash +ACR= +RG= +SUB=$(az account show --query id -o tsv) +TOKEN=$(az account get-access-token --query accessToken -o tsv) + +# 1. Enable exportPolicy (default is 'disabled' in this template; required before flipping public access) +curl -sS -X PATCH \ + -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \ + "https://management.azure.com/subscriptions/$SUB/resourceGroups/$RG/providers/Microsoft.ContainerRegistry/registries/$ACR?api-version=2023-07-01" \ + -d '{"properties":{"policies":{"exportPolicy":{"status":"enabled"}}}}' + +# 2. Enable public network access with default-Allow +az acr update -n $ACR -g $RG --public-network-enabled true --default-action Allow + +# … run script 2 … + +# 3. RESTORE +az acr update -n $ACR -g $RG --public-network-enabled false +# Optional: reapply exportPolicy=disabled via the same PATCH with status: "disabled" +``` + +> **If the operator IS peered**, skip this entirely — keep `publicNetworkAccess=Disabled` and push over peering. + +### 6.3 Optional: harden AI Foundry post-deploy + +The Bicep currently provisions the Foundry account with `publicNetworkAccess=Enabled` + `networkAcls.defaultAction=Deny` + a VNet rule for `snet-services`. Some customers (typically Financial Services) prefer to also flip the master switch off. After `script 3` finishes: + +```bash +az cognitiveservices account update -g -n \ + --public-network-access Disabled +``` + +The Private Endpoint on `services.ai.azure.com` already exists, so apps continue to work. + +### 6.4 Operator workstation needs internet egress for bootstrap supply chain + +See §5.2 group C. If the operator is on a fully air-gapped corporate network, mirror those URLs internally before running script 2 (recommended for production InvestCorp deployments). + +### 6.5 Known repo issue to be aware of + +The current `infra/1-deploy-azure-infra.sh` names its ARM deployment `ai-invest-sample-` but `infra/3-deploy-apps.sh` searches for `ai-invest-appsvc`. Two workarounds: + +1. **Pre-flight**: rerun main.bicep manually with a name containing `ai-invest-appsvc`, e.g. + `az deployment group create -g -n "ai-invest-appsvc-$(date +%s)" --template-file infra/bicep/main.bicep --parameters @` +2. **Patch**: change the JMESPath query in `3-deploy-apps.sh` at line 163 to `[?contains(name, 'ai-invest-sample')].name | [0]`. + +A fix will be raised upstream. + +--- + +## 7. RBAC summary + +| Principal | Role | Scope | Provisioned by | +| -------------------------------------- | ----------------------------------------------- | --------------------------- | ----------------- | +| UAMI (workload identity) | `AcrPull`, `AcrPush`, `AcrDelete` | ACR | Bicep | +| UAMI | `Storage Blob Data Contributor` | Storage account | Bicep | +| UAMI | `Cosmos DB Built-in Data Contributor` | Cosmos account | Bicep | +| UAMI | `Azure AI User` | AI Foundry account | Bicep | +| Deployer (running scripts) | `Cosmos DB Built-in Data Contributor` | Cosmos account | Bicep | +| Deployer (running scripts) | `Contributor` (or `Owner`) | Resource group | Customer (manual) | +| **Operator running script 2** | **`AcrPush`** (`AcrDelete` optional) | **ACR** | **Manual (§6.1)** | + +--- + +## 8. Step-by-step deployment runbook for InvestCorp + +> **Pre-req**: Customer has chosen a `/26` CIDR, a region, peering is up, the operator workstation can reach Microsoft control plane + (during bootstrap) the supply-chain URLs in §5.2 C. + +```bash +# 0. Clone the template +git clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git +cd Agentic-AI-Investment-Analysis-Sample +git checkout main # or release tag + +# 1. Log in & set subscription +az login --tenant +az account set --subscription + +# 2. Create RG (or have customer pre-create) +LOC=swedencentral # or uaenorth +RG=rg-investcorp-aiinvest-prod +az group create -n $RG -l $LOC + +# 3. Deploy infra +bash infra/1-deploy-azure-infra.sh \ + -g $RG \ + -l $LOC \ + --name-prefix invstcrp \ + --environment prod \ + --is-private true \ + --vnet-address-prefix 10.123.45.0/26 # supplied by InvestCorp network team + +# 4. Grant operator AcrPush (see §6.1) +ME=$(az ad signed-in-user show --query id -o tsv) +ACR=$(az acr list -g $RG --query "[0].name" -o tsv) +ACR_ID=$(az acr show -n $ACR -g $RG --query id -o tsv) +az role assignment create --assignee-object-id $ME --assignee-principal-type User \ + --role AcrPush --scope $ACR_ID + +# 5. (only if NOT yet peered) Temporarily open ACR — see §6.2 +# … skip if peered … + +# 6. Build & push images +bash infra/2-build-and-push-images.sh -r $ACR.azurecr.io --docker +# (use --acr instead for ACR Tasks — requires VNet-enabled agent pool) + +# 7. Re-lock ACR (if you opened it in step 5) +az acr update -n $ACR -g $RG --public-network-enabled false + +# 8. Deploy apps +yes | bash infra/3-deploy-apps.sh -g $RG -p invstcrp -e prod -t latest + +# 9. (recommended) Harden AI Foundry — see §6.3 +FOUNDRY=$(az cognitiveservices account list -g $RG --query "[0].name" -o tsv) +az cognitiveservices account update -g $RG -n $FOUNDRY --public-network-access Disabled +``` + +--- + +## 9. Post-deploy verification + +Run from a workstation **peered** to the workload VNet (i.e. a VM in the InvestCorp hub): + +```powershell +# DNS must resolve to private IPs (10.x range) +'.azurewebsites.net', +'.azurewebsites.net', +'.azurecr.io', +'.documents.azure.com', +'.blob.core.windows.net' | ForEach-Object { + $r = Resolve-DnsName $_ -Type A -ErrorAction SilentlyContinue | Select-Object -First 1 + $tc = Test-NetConnection $_ -Port 443 -WarningAction SilentlyContinue + "{0,-65} IP={1} TCP443={2}" -f $_, $r.IPAddress, $tc.TcpTestSucceeded +} + +# Apps must return HTTP 200 over PE +Invoke-WebRequest "https://.azurewebsites.net/health" -UseBasicParsing +Invoke-WebRequest "https://.azurewebsites.net/" -UseBasicParsing +``` + +From the **internet** (i.e. not peered) the same hosts must return `HTTP 403` / connection-blocked. This is the proof of zero-trust. + +--- + +## 10. Decommissioning + +```bash +# Whole environment +az group delete -g rg-investcorp-aiinvest-prod --yes --no-wait + +# Or just stop compute + keep data +az webapp stop -g rg-investcorp-aiinvest-prod -n invstcrp-api-prod +az webapp stop -g rg-investcorp-aiinvest-prod -n invstcrp-web-prod +``` + +--- + +## 11. Validation evidence (May 2026 demo deployment) + +| Check | Result | +| -------------------------------------------------- | --------------------------------------------------------------------- | +| Bicep template `what-if` (no errors, BCP318 warns) | ✅ | +| Workload deployment (`isPrivate=true`) | ✅ `Succeeded` | +| Private DNS resolution from peered VM | ✅ ACR=`10.123.45.50`, Cosmos=`10.123.45.52`, Storage=`10.123.45.51` | +| TCP 443 to all PEs | ✅ True | +| ACR `/v2/` over PE | ✅ HTTP 401 (auth required) | +| Apps via PE (`10.123.45.54` / `.55`) | ✅ HTTP 200 | +| Apps from public internet | ✅ HTTP 403 (blocked) | +| Mac (non-peered) to ACR / Storage | ✅ HTTP 403 (blocked) | + +--- + +## 12. Custom naming convention (InvestCorp CAF) + +The template supports two ways to control resource names. Pick one: + +### Option A — keep the default pattern, just change the prefix + +Every resource is named `--` (e.g. `invstdemo-cosmosdb-uqyihrdx2wrsa`). Pass your own prefix: + +```bash +bash infra/1-deploy-azure-infra.sh -g $RG -l $LOC --name-prefix invscrp --is-private true --vnet-address-prefix 10.123.45.0/26 +``` + +You get `invscrp-vnet-…`, `invscrp-cosmosdb-…`, `invscrpacr…`, etc. **The 8-char hash is non-negotiable in this mode** because it guarantees global uniqueness for storage / ACR / Cosmos / Foundry. + +### Option B — supply exact resource names (full CAF override) + +`main.bicep` accepts one optional `*NameOverride` parameter per resource. Anything left empty falls back to Option A. Supply only the ones you need to control. + +| Parameter | Resource | Azure naming constraints | +| ------------------------------------ | ------------------------------ | ---------------------------------------------- | +| `vnetNameOverride` | Virtual Network | 2-64 alphanumerics + `-`, `_`, `.` | +| `userAssignedIdentityNameOverride` | UAMI | 3-128 alphanumerics + `-`, `_` | +| `logAnalyticsWorkspaceNameOverride` | Log Analytics workspace | 4-63 alphanumerics + `-` | +| `appInsightsNameOverride` | Application Insights | 1-260 alphanumerics + most chars | +| `amplsNameOverride` | Azure Monitor Private Link Scope | 1-255 | +| `storageAccountNameOverride` | Storage account | **3-24 lowercase alphanumerics, globally unique** | +| `cosmosAccountNameOverride` | Cosmos DB account | **3-44 lowercase alphanumerics + `-`, globally unique** | +| `containerRegistryNameOverride` | Azure Container Registry | **5-50 alphanumerics, globally unique** | +| `appServicePlanNameOverride` | App Service Plan | 1-40 alphanumerics + `-` | +| `aiFoundryBaseNameOverride` | AI Foundry account base name | **≤ 12 lowercase alphanumerics** (suffix base) | + +A worked example is provided in [`infra/bicep/main.investcorp.example.bicepparam`](../infra/bicep/main.investcorp.example.bicepparam): + +```bicepparam +using './main.bicep' + +param isPrivate = true +param vnetAddressPrefix = '10.123.45.0/26' +param environment = 'prod' +param namePrefix = 'invscrp' + +param vnetNameOverride = 'invs-aiinv-prod-bhc-vnet-001' +param userAssignedIdentityNameOverride = 'invs-aiinv-prod-bhc-uami-001' +param logAnalyticsWorkspaceNameOverride = 'invs-aiinv-prod-bhc-law-001' +param appInsightsNameOverride = 'invs-aiinv-prod-bhc-appi-001' +param amplsNameOverride = 'invs-aiinv-prod-bhc-ampls-001' +param storageAccountNameOverride = 'invsaiinvprodbhcst001' +param cosmosAccountNameOverride = 'invs-aiinv-prod-bhc-cosmos-001' +param containerRegistryNameOverride = 'invsaiinvprodbhcacr001' +param appServicePlanNameOverride = 'invs-aiinv-prod-bhc-asp-001' +param aiFoundryBaseNameOverride = 'invscaip01' +``` + +Deploy with: + +```bash +az deployment group create -g $RG \ + --name "ai-invest-appsvc-$(date +%s)" \ + --template-file infra/bicep/main.bicep \ + --parameters infra/bicep/main.investcorp.example.bicepparam +``` + +> **Caller is responsible** for the naming rules listed above (storage/ACR/Cosmos in particular). If a name violates Azure rules or is already taken globally, the deployment will fail with a clear error from the resource provider. + +### App Service (api/web) names + +The two Web App names are generated by `infra/3-deploy-apps.sh` as `-api-` and `-web-`. Pass the InvestCorp values directly: + +```bash +yes | bash infra/3-deploy-apps.sh -g $RG -p invs-aiinv -e prod -t latest +# → invs-aiinv-api-prod, invs-aiinv-web-prod +``` + +(If a fully CAF-compliant pattern such as `invs-aiinv-prod-bhc-web-001` is required, edit `var appName` in `api-app/infra/bicep/main.bicep` and `web-app/infra/bicep/main.bicep` — these are simple one-liners; a future PR will expose them as parameters too.) + +### Resource group + region + +These are caller-controlled, not template-controlled: + +```bash +az group create -n rg-invs-aiinv-prod-bhc-001 -l uaenorth +``` + +--- + +## 13. Hand-off checklist for InvestCorp networking team + +- [ ] Confirm `/26` CIDR allocated and recorded in IPAM +- [ ] VNet peering created in both directions; `allow-forwarded-traffic` enabled if hub is hub-and-spoke +- [ ] Hub DNS forwards `privatelink.*` to `168.63.129.16` (or zones are also linked to hub VNet) +- [ ] Operator workstation can reach Microsoft control plane (§5.2 A) +- [ ] Operator workstation has bootstrap supply-chain access OR internal mirrors configured (§5.2 C) +- [ ] `AcrPush` granted on ACR to the human/SP running script 2 (§6.1) +- [ ] After go-live, AI Foundry flipped to `publicNetworkAccess=Disabled` (§6.3) +- [ ] Optional: Bastion Basic deployed in the hub for emergency admin (§5.2 D) +- [ ] Backup & DR strategy for Cosmos (`Continuous7Days` enabled), Storage (consider GRS for prod), ACR (`georeplications` for prod) + diff --git a/docs/PRIVATE_DEPLOYMENT.md b/docs/PRIVATE_DEPLOYMENT.md index 4d18bb7..a6e1be0 100644 --- a/docs/PRIVATE_DEPLOYMENT.md +++ b/docs/PRIVATE_DEPLOYMENT.md @@ -1,12 +1,12 @@ # Private (Zero-Trust) Deployment Guide -This guide documents **everything you need to deploy, operate, and customize the Agentic AI Investment Analysis sample in its private / zero-trust topology** (`isPrivate=true`). It is the companion to: +This guide documents how to deploy, operate, and customize the Agentic AI Investment Analysis sample in its private / zero-trust topology (`isPrivate=true`). It is the companion to: - [`_assets/ZERO_TRUST_ARCHITECTURE.md`](../_assets/ZERO_TRUST_ARCHITECTURE.md) — logical view of the topology - [`infra/bicep/main.bicep`](../infra/bicep/main.bicep) — the Bicep template that provisions everything below - [`infra/bicep/main.json`](../infra/bicep/main.json) — the compiled ARM template used by the **Deploy to Azure** button -> **TL;DR** — In private mode, every PaaS data plane is reached through a Private Endpoint inside a customer-owned VNet. The only public surface is the Azure Bastion control-plane TLS endpoint used by operators. No public DNS records exist for any workload. +> **TL;DR** — In private mode, every PaaS data plane is reached through a Private Endpoint inside a customer-owned VNet. **There is no public ingress on the workload — no Bastion and no jumpbox.** Operators are expected to deploy and reach the apps from the customer's own peered network (ExpressRoute, VPN, or hub VNet). No public DNS records exist for any workload. --- @@ -18,10 +18,10 @@ This guide documents **everything you need to deploy, operate, and customize the | Plane | Components | Public exposure | | ------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------ | -| Operator | Azure Bastion (Standard) → Windows jumpbox (no public IP) | Bastion TLS 443 only | +| Operator | Customer-managed peering (ExpressRoute / VPN / hub VNet) — no IP provisioned by this template | None | | Workload | App Service Plan (Linux P0v3) hosting `api` + `web` Web Apps for Containers, ingress disabled publicly | None | | Data | Cosmos DB (NoSQL), Storage Account (Blob), Azure AI Foundry / OpenAI, Azure Container Registry (Premium) | `publicNetworkAccess=Disabled` | -| Identity | One User-Assigned Managed Identity (UAMI) federated to apps + jumpbox | n/a | +| Identity | One User-Assigned Managed Identity (UAMI) federated to both apps | n/a | | Observability | Log Analytics + Application Insights joined to an Azure Monitor Private Link Scope (AMPLS) | None | | DNS | Customer-owned Private DNS zones linked to the VNet | n/a | @@ -36,18 +36,14 @@ All parameters are defined in [`infra/bicep/main.bicep`](../infra/bicep/main.bic | ------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------- | | `namePrefix` | `invstdemo` | Lowercase prefix for every generated resource name. Keep ≤ 8 chars to stay within Storage / ACR limits. | | `environment` | `dev` | Free-form environment tag (`dev` / `staging` / `prod`). `prod` enables Cosmos DB zone redundancy. | -| `location` | resource group location | Region for VNet, ACA-replacement App Service Plan, Cosmos, Storage, ACR, Bastion, AMPLS. | +| `location` | resource group location | Region for VNet, App Service Plan, Cosmos, Storage, ACR, AMPLS. | | `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment. Use a region with model capacity (e.g. `swedencentral`, `eastus2`). | ### Networking & zero-trust -| Parameter | Default | Description | -| ----------------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | -| `isPrivate` | `true` | Master switch. `true` = full private deployment (everything in this doc). `false` = legacy public demo, no VNet, no PEs. | -| `vnetAddressPrefix` | `10.50.0.0/16` | CIDR for the VNet. Must accommodate every subnet listed in §4. | -| `deployJumpbox` | `true` | When `true` (and `isPrivate=true`), provisions the Windows jumpbox + Bastion. | -| `jumpboxAdminUsername` | `azureuser` | Local admin user on the jumpbox. | -| `jumpboxAdminPassword` | _(empty, secure)_ | **Required when `deployJumpbox=true`**. Windows admin password (12–123 chars; 3 of: lowercase/uppercase/digit/special). | -| `bastionSku` | `Standard` | `Standard` is required for native-client RDP tunneling used by [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh). | +| Parameter | Default | Description | +| ------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `isPrivate` | `true` | Master switch. `true` = full private deployment. `false` = legacy public demo, no VNet, no PEs. | +| `vnetAddressPrefix` | **required** | CIDR for the workload VNet. **Must be a `/26`** supplied by the customer (e.g. `10.123.45.0/26`). The template splits it into two equal `/27` subnets via `cidrSubnet()` — see §4. Required even when `isPrivate=false` (a placeholder is acceptable). | ### Application | Parameter | Default | Description | @@ -63,9 +59,9 @@ Each module in [`infra/bicep/modules/`](../infra/bicep/modules/) is conditional | Module | Resource | Public access | Auth model | | ------------------------------ | ---------------------------------------------------------------------- | ----------------------------------------------------------------- | ----------------------------------------- | -| `network.bicep` * | VNet + 6 subnets + NSGs | n/a | n/a | +| `network.bicep` * | VNet (`/26`) + 2 subnets + NSGs | n/a | n/a | | `private-dns.bicep` * | 12 Private DNS zones, all VNet-linked | n/a | n/a | -| `user-assigned-identity.bicep` | One UAMI | n/a | Federated to apps + jumpbox | +| `user-assigned-identity.bicep` | One UAMI | n/a | Federated to both Web Apps | | `log-analytics-ws.bicep` | Log Analytics workspace | `disableLocalAuth=true` | Entra ID + AMPLS | | `app-insights.bicep` | Application Insights (workspace-based) | `disableLocalAuth=true` | Entra ID + AMPLS | | `ampls.bicep` * | Azure Monitor Private Link Scope | `PrivateOnly` ingestion + query | n/a | @@ -75,32 +71,26 @@ Each module in [`infra/bicep/modules/`](../infra/bicep/modules/) is conditional | `app-service-plan.bicep` | Linux App Service Plan (P0v3) | n/a | n/a | | `web-app-container.bicep` | (per app) Web App for Containers + VNet integration + private endpoint | Public ingress disabled | UAMI | | `ai-foundry.bicep` | Azure AI Services + Foundry project + model deployment | `publicNetworkAccess=Disabled` | UAMI → Azure AI User | -| `bastion.bicep` * | Azure Bastion (`Standard`) | TLS 443 only | Operator Entra ID | -| `jumpbox.bicep` * | Windows VM, no public IP, UAMI attached, CustomScriptExtension installs az/git/bicep | n/a | Admin password (Bastion-tunneled RDP) | | `private-endpoint.bicep` * | Used by every PaaS module above | n/a | n/a | -> The legacy `container-apps-environment.bicep` is retained on disk for reference but is no longer instantiated — the workload now runs on App Service. +> Operator access (Bastion + jumpbox) has been removed from this template. Operators must run scripts 2 + 3 from a workstation peered to the workload VNet. --- ## 4. Subnet layout -Defined in [`infra/bicep/modules/network.bicep`](../infra/bicep/modules/network.bicep). Default sizes given for `vnetAddressPrefix=10.50.0.0/16`: +Defined in [`infra/bicep/modules/network.bicep`](../infra/bicep/modules/network.bicep). The customer supplies a single **/26** (64 IPs). The module splits it into two equal **/27** subnets using `cidrSubnet(vnetAddressPrefix, 27, n)`: -| Subnet | CIDR | Purpose | Delegation / Service endpoints | -| -------------------- | ---- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | -| `snet-appsvc` | /23 | App Service VNet integration | Delegated `Microsoft.Web/serverFarms`, `Microsoft.CognitiveServices` service endpoint | -| `snet-pe` | /26 | All Private Endpoints (ACR, Cosmos, Blob, AI Foundry, AMPLS, App Service) | None | -| `snet-jumpbox` | /27 | Jumpbox NIC (no public IP) | None | -| `AzureBastionSubnet` | /26 | Required name for Azure Bastion | None | -| `snet-build` | /27 | Reserved — ACR Tasks / private build agents | None | -| `snet-mgmt` | /27 | Reserved — self-hosted CI/CD runners | None | +| Subnet | Offset within /26 | CIDR example (`10.123.45.0/26`) | Purpose | Delegation / Service endpoints | +| --------------- | ----------------- | ------------------------------- | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | +| `snet-services` | 0 (first /27) | `10.123.45.0/27` | App Service VNet integration — all outbound calls from the API/Web apps | Delegated `Microsoft.Web/serverFarms`, `Microsoft.CognitiveServices` service endpoint | +| `snet-pe` | 32 (second /27) | `10.123.45.32/27` | All Private Endpoints (App Service inbound, ACR, Cosmos, Blob, AI Foundry, AMPLS) | None — `privateEndpointNetworkPolicies=Disabled` | -**NSG posture (deny-by-default with explicit allows):** -- `nsg-pe`: allow VNet→VNet TCP 443 -- `nsg-jumpbox`: allow VNet TCP 3389 (Bastion only) -- `nsg-bastion`: full Bastion ruleset per Microsoft docs (HTTPS in, GatewayManager, Load Balancer, SSH/RDP out, AzureCloud:443 out) -- `nsg-aca` (legacy, kept empty): platform-managed when ACA was used +**NSG posture:** +- `nsg-pe`: allow `VirtualNetwork → VirtualNetwork` TCP 443 +- `nsg-services`: empty (permissive within VNet; App Service regional VNet integration manages its own outbound traffic) + +**Sizing caveat.** /27 yields ~27 usable IPs per subnet. The App Service VNet integration subnet needs roughly 2× the worst-case instance count of the plan. If you expect autoscale beyond ~10 instances per plan, ask the customer for a larger CIDR (a `/25` would let you give each subnet a `/26`). --- @@ -123,6 +113,8 @@ Defined in [`infra/bicep/modules/private-dns.bicep`](../infra/bicep/modules/priv | `privatelink.agentsvc.azure-automation.net` | Monitor agents | | `privatelink.azurewebsites.net` | App Service / Web App | +> **Resolving private FQDNs from your peered network** — make sure the customer's on-prem DNS forwards `privatelink.*` zones to Azure DNS (`168.63.129.16`) over the peering, or replicate the zones in the customer's hub. Without this, your workstation will keep resolving public IPs and fail to reach the private endpoints. + --- ## 6. Cosmos DB containers @@ -144,18 +136,17 @@ Local auth is disabled — the deployer principal **and** the workload UAMI are ## 7. Identity & RBAC -A single User-Assigned Managed Identity is the workload identity for both Web Apps and the jumpbox. Role assignments are issued by the individual modules: +A single User-Assigned Managed Identity is the workload identity for both Web Apps. Role assignments are issued by the individual modules: -| Scope | Role | Why | -| ------------------------ | ------------------------------------------------------- | ----------------------------------------------------------------------------- | -| ACR | `AcrPull`, `AcrPush`, `AcrDelete` | Image pull from App Service + push from jumpbox | -| Storage account | `Storage Blob Data Contributor` | Document upload / read by API app | -| Cosmos DB account | `Cosmos DB Built-in Data Contributor` | Plane-of-data CRUD without keys | -| AI Foundry / AI Services | `Azure AI User`, `Cognitive Services OpenAI User` | Calling deployed model | -| Resource group | `Contributor` (jumpbox only, when `deployJumpbox=true`) | Lets `2-build-and-push-images.sh` and `3-deploy-apps.sh` run from the jumpbox | -| Log Analytics | `Log Analytics Contributor` | Telemetry write | +| Scope | Role | Why | +| ------------------------ | ------------------------------------------------- | --------------------------------- | +| ACR | `AcrPull`, `AcrPush`, `AcrDelete` | Image pull from App Service | +| Storage account | `Storage Blob Data Contributor` | Document upload / read by API app | +| Cosmos DB account | `Cosmos DB Built-in Data Contributor` | Plane-of-data CRUD without keys | +| AI Foundry / AI Services | `Azure AI User`, `Cognitive Services OpenAI User` | Calling deployed model | +| Log Analytics | `Log Analytics Contributor` | Telemetry write | -The deployer (`deployer().objectId` in `main.bicep`) is added as a Cosmos data contributor as well, so you can run the FastAPI server from your laptop against the deployed Cosmos when you punch a temporary firewall hole or run from the jumpbox. +The deployer (`deployer().objectId` in `main.bicep`) is also added as a Cosmos data contributor so you can run the FastAPI server from your workstation (over peering) against the deployed Cosmos. --- @@ -182,67 +173,58 @@ Every setting is environment-driven; the same container image runs in either pub ## 9. Deployment workflow +### Prerequisites + +1. **A /26 CIDR** allocated by the customer's network team, not overlapping with any peered range. +2. **VNet peering already in place** (or planned to be set up before scripts 2 + 3 run) so that: + - DNS for `privatelink.*` zones resolves to Azure DNS from your workstation. + - TCP 443 reaches the workload's private endpoints (ACR, App Service). +3. Azure CLI ≥ 2.61, Docker (if using local builds), and the right Entra ID role assignments (`Contributor` + `User Access Administrator` on the target RG). + ### Option A — Azure Portal one-click -Use the **Deploy to Azure** button in the [root README](../README.md#-one-click-azure-deployment). The portal wizard collects the parameters from §2 and then provisions everything in §3. After it completes, jump to §10 to push images and roll out apps. +Use the **Deploy to Azure** button in the [root README](../README.md#-one-click-azure-deployment). The portal wizard collects the parameters from §2 — including `vnetAddressPrefix` — and then provisions everything in §3. After it completes, jump to §10 to push images and roll out apps from your peered workstation. -### Option B — CLI (recommended for end-to-end automation) +### Option B — CLI ```bash -# 1. Provision infrastructure (VNet, PEs, AI Foundry, jumpbox, …) +# 1. Provision infrastructure (VNet, PEs, AI Foundry, App Service Plan, …) ./infra/1-deploy-azure-infra.sh \ -g \ -l swedencentral \ -p invstdemo \ -e dev \ - --admin-password '' - -# 2. Open an RDP tunnel into the Windows jumpbox via Bastion -./infra/0-connect-jumpbox.sh -g - -# On the jumpbox (PowerShell): -# The deployment auto-clones the repo to C:\Users\Public\Desktop. -cd C:\Users\Public\Desktop\Agentic-AI-Investment-Analysis-Sample + --vnet-address-prefix 10.123.45.0/26 -# 3. Build & push container images to the private ACR (uses UAMI on the jumpbox) -bash infra/2-build-and-push-images.sh -g +# 2. From a workstation peered to the workload VNet — build & push images +./infra/2-build-and-push-images.sh -r .azurecr.io -# 4. Roll out / update the api + web Web Apps -bash infra/3-deploy-apps.sh -g +# 3. Roll out / update the api + web Web Apps +./infra/3-deploy-apps.sh -g ``` Flags accepted by `1-deploy-azure-infra.sh`: -| Flag | Description | -| --------------------------------- | -------------------------------------------------------- | -| `-g, --resource-group` | **Required** target resource group | -| `-l, --location` | Region (default `westus2`) | -| `-a, --ai-foundry-location` | AI Foundry region (default `swedencentral`) | -| `-p, --name-prefix` | Resource name prefix (default `aiinvest`) | -| `-e, --environment` | Environment tag | -| `--public` | Deploy the legacy public topology (`isPrivate=false`) | -| `--no-jumpbox` | Skip jumpbox + Bastion | -| `--ssh-key-file ` | _Deprecated_ — the jumpbox is now Windows. Use `--admin-password`. | -| `--admin-password ` | Windows admin password for the jumpbox (12–123 chars; complexity rules apply). Prompted interactively if omitted. | -| `--bastion-sku ` | Default `Standard` | -| `-d, --debug` | Enable Azure CLI debug logging | - -> **Why scripts 2 + 3 must run from the jumpbox in private mode:** ACR is `publicNetworkAccess=Disabled`, so `docker push` and the Web App rollout APIs are only reachable from inside the VNet. +| Flag | Description | +| --------------------------- | ----------------------------------------------------------------------- | +| `-g, --resource-group` | **Required** target resource group | +| `--vnet-address-prefix` | **Required** — `/26` CIDR for the workload VNet (e.g. `10.123.45.0/26`) | +| `-l, --location` | Region (default `westus2`) | +| `-a, --ai-foundry-location` | AI Foundry region (default `swedencentral`) | +| `-p, --name-prefix` | Resource name prefix (default `aiinvest`) | +| `-e, --environment` | Environment tag | +| `--public` | Deploy the legacy public topology (`isPrivate=false`) | +| `-d, --debug` | Enable Azure CLI debug logging | + +> **Why scripts 2 + 3 must run from a peered host:** ACR and App Service are `publicNetworkAccess=Disabled`, so `docker push` and the Web App rollout APIs are only reachable from inside the VNet. --- ## 10. Operating the deployment ### Connecting -```bash -./infra/0-connect-jumpbox.sh -g -``` -Internally this runs `az network bastion rdp` (Windows host) or `az network bastion tunnel` to forward localhost:50389 → VM:3389 (macOS/Linux), and requires Bastion **Standard** SKU. - -### Reaching the Web app from your laptop -The Web app has internal-only ingress. To browse it during development, open an additional Bastion tunnel from the jumpbox to the Web app FQDN, or deploy a self-service VPN gateway / Azure Front Door Premium with Private Link in front of it. The sample does **not** ship a VPN gateway — Bastion + jumpbox is the documented path. - -### Rotating the jumpbox password -Re-run `1-deploy-azure-infra.sh --admin-password ''` against the same resource group; the VM admin password is updated in place. +There is no Bastion and no jumpbox. Reach the workload like any other private app: +- **Browse the Web app**: from a workstation on the peered network, navigate to `https://.azurewebsites.net`. Private DNS forwarding must be in place (see §5). +- **Run admin commands**: `az` works directly against the resource group from anywhere; data-plane access (Cosmos, Storage, ACR `docker push`) requires the peering. ### Tearing down ```bash @@ -256,31 +238,30 @@ The Private DNS zones are inside the resource group, so a single group delete is The same template covers both modes through the `isPrivate` flag: -| Behavior | `isPrivate=true` | `isPrivate=false` | -| ----------------------------- | ---------------------------- | ----------------------------------- | -| VNet + subnets + NSGs | ✅ created | ❌ skipped | -| Private DNS zones | ✅ 12 zones, VNet-linked | ❌ skipped | -| Private endpoints on PaaS | ✅ on every data service | ❌ skipped | -| `publicNetworkAccess` on PaaS | `Disabled` | `Enabled` | -| Web App ingress | internal only | external | -| Jumpbox + Bastion | optional via `deployJumpbox` | always skipped | -| AMPLS | ✅ | ❌ (telemetry over public ingestion) | +| Behavior | `isPrivate=true` | `isPrivate=false` | +| ----------------------------- | ----------------------- | ----------------------------------- | +| VNet + subnets + NSGs | ✅ created | ❌ skipped | +| Private DNS zones | ✅ 12 zones, VNet-linked | ❌ skipped | +| Private endpoints on PaaS | ✅ on every data service | ❌ skipped | +| `publicNetworkAccess` on PaaS | `Disabled` | `Enabled` | +| Web App ingress | private endpoint only | external | +| AMPLS | ✅ | ❌ (telemetry over public ingestion) | -Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly to the bicep template, to switch. +Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly to the Bicep template, to switch. `vnetAddressPrefix` is still required at the parameter level — supply a placeholder such as `10.0.0.0/26` when running public. --- ## 12. Troubleshooting -| Symptom | Likely cause | Fix | -| --------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| `403 PublicNetworkAccess is disabled` from your laptop | Trying to reach Cosmos / Storage / ACR from the public internet | Use the jumpbox or temporarily allow your IP via the resource's networking blade | -| `Bastion: target resource id not found` | Bastion SKU is `Basic` | Redeploy with `--bastion-sku Standard` | -| `docker push` fails on the jumpbox with name-resolution error | Private DNS zone link not yet propagated | Wait 1–2 minutes after `1-deploy-azure-infra.sh` finishes; re-run `nslookup .azurecr.io` | -| Web app cold-start fails to pull image | UAMI missing `AcrPull` on ACR | Re-run `1-deploy-azure-infra.sh` (idempotent) — module assigns the role | -| FastAPI returns `401` from Cosmos | Deployer / UAMI not added as Cosmos Data Contributor | Verify with `az cosmosdb sql role assignment list -a -g ` | -| `nslookup .azurewebsites.net` returns a public IP from the jumpbox | Web App private endpoint not yet linked to `privatelink.azurewebsites.net` | Confirm the zone exists and is VNet-linked; re-run rollout | -| AI Foundry call fails with `OperationNotAllowed` | Region mismatch — AI Services data plane not reachable via the configured PE | Set `aiFoundryLocation` to the same region as the rest of the deployment, or open an outbound `Microsoft.CognitiveServices` service endpoint on `snet-appsvc` (already enabled by default) | +| Symptom | Likely cause | Fix | +| -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `403 PublicNetworkAccess is disabled` from your laptop | Trying to reach Cosmos / Storage / ACR from a non-peered network | Run from a workstation peered to the workload VNet, or temporarily allow your IP via the resource's networking blade | +| `docker push` fails with name-resolution error | Private DNS zone for `privatelink.azurecr.io` not forwarded over the peering | Configure the customer's DNS to forward `privatelink.*` zones to Azure DNS (`168.63.129.16`), or replicate the zones in the customer's hub | +| Web app cold-start fails to pull image | UAMI missing `AcrPull` on ACR | Re-run `1-deploy-azure-infra.sh` (idempotent) — module assigns the role | +| FastAPI returns `401` from Cosmos | Deployer / UAMI not added as Cosmos Data Contributor | Verify with `az cosmosdb sql role assignment list -a -g ` | +| `nslookup .azurewebsites.net` returns a public IP from your workstation | Web App private DNS zone not reachable from your network | See §5 — forward `privatelink.azurewebsites.net` to Azure DNS over the peering | +| AI Foundry call fails with `OperationNotAllowed` | Region mismatch — AI Services data plane not reachable via the configured PE | Set `aiFoundryLocation` to the same region as the rest of the deployment, or rely on the `Microsoft.CognitiveServices` service endpoint on `snet-services` (already enabled by default) | +| Bicep `cidrSubnet` error during deploy | `vnetAddressPrefix` is not a `/26` | Re-run with a `/26` CIDR (the script enforces this; the Bicep `cidrSubnet(..., 27, 1)` call assumes 64 addresses). | --- @@ -290,5 +271,4 @@ Use `--public` on `1-deploy-azure-infra.sh`, or pass `isPrivate=false` directly - [`infra/bicep/main.bicep`](../infra/bicep/main.bicep) — root template (resource-group scope) - [`infra/bicep/modules/`](../infra/bicep/modules/) — per-resource modules - [`infra/1-deploy-azure-infra.sh`](../infra/1-deploy-azure-infra.sh) — CLI deploy wrapper -- [`infra/0-connect-jumpbox.sh`](../infra/0-connect-jumpbox.sh) — Bastion RDP tunnel to the Windows jumpbox -- [`infra/2-build-and-push-images.sh`](../infra/2-build-and-push-images.sh) / [`3-deploy-apps.sh`](../infra/3-deploy-apps.sh) — image + app rollout (run on the jumpbox in private mode) +- [`infra/2-build-and-push-images.sh`](../infra/2-build-and-push-images.sh) / [`3-deploy-apps.sh`](../infra/3-deploy-apps.sh) — image + app rollout (run from a peered host) diff --git a/docs/diagrams/private_architecture.py b/docs/diagrams/private_architecture.py index 5d25c34..eae75ba 100644 --- a/docs/diagrams/private_architecture.py +++ b/docs/diagrams/private_architecture.py @@ -1,26 +1,29 @@ """Private architecture diagram for the AI Investment Analysis sample. -All resources live in a hub VNet (10.50.0.0/22). Inbound from the internet is -disabled on every PaaS resource. Operator access is via Bastion -> jumpbox -> -SOCKS5 proxy. App-to-PaaS traffic stays on the Microsoft backbone via private +All resources live in a workload VNet sized to a customer-supplied /26. The +VNet is split into two /27 subnets: snet-services (App Service VNet integration) +and snet-pe (private endpoints). Inbound from the internet is disabled on every +PaaS resource. Operator access comes from the customer's peered network +(ExpressRoute / VPN / hub VNet) -- this template provisions no Bastion and no +jumpbox. App-to-PaaS traffic stays on the Microsoft backbone via private endpoints; the App Service VNet integration subnet reaches AI Foundry through a service endpoint with a deny-all networkAcl. """ -from diagrams import Diagram, Cluster, Edge -from diagrams.azure.compute import AppServices, ContainerRegistries, VM +from diagrams import Cluster, Diagram, Edge +from diagrams.azure.compute import AppServices, ContainerRegistries +from diagrams.azure.database import CosmosDb +from diagrams.azure.general import Subscriptions +from diagrams.azure.identity import ManagedIdentities +from diagrams.azure.ml import CognitiveServices +from diagrams.azure.monitor import ApplicationInsights, LogAnalyticsWorkspaces from diagrams.azure.network import ( - VirtualNetworks, - Subnets, - PrivateEndpoint, DNSPrivateZones, + PrivateEndpoint, + Subnets, + VirtualNetworks, ) -from diagrams.azure.database import CosmosDb from diagrams.azure.storage import BlobStorage -from diagrams.azure.identity import ManagedIdentities -from diagrams.azure.ml import CognitiveServices -from diagrams.azure.monitor import LogAnalyticsWorkspaces, ApplicationInsights -from diagrams.azure.general import Subscriptions from diagrams.onprem.client import User from diagrams.onprem.compute import Server @@ -63,36 +66,28 @@ graph_attr=graph_attr, node_attr=node_attr, ): + operator = User("Operator\n(on peered network)") - operator = User("Operator\n(local Mac)") - - with Cluster("Azure subscription\nc91e40f7-...-2a6bf8402aa4", graph_attr=cluster_style): - + with Cluster("Azure subscription", graph_attr=cluster_style): uami = ManagedIdentities("UAMI\nid-aiinvest-...\n(ACR pull)") with Cluster( - "Hub VNet aiinvest-vnet 10.50.0.0/22", + "Workload VNet aiinvest-vnet\ncustomer-supplied /26", graph_attr=vnet_style, ): - - # --- Operator entry path --- - with Cluster("AzureBastionSubnet", graph_attr=subnet_style): - bastion = Subnets("Azure Bastion") - - with Cluster("snet-mgmt 10.50.2.224/27", graph_attr=subnet_style): - jumpbox = VM("jumpbox\n(SSH + SOCKS5\n127.0.0.1:1080)") - # --- App Service VNet integration (outbound) --- with Cluster( - "snet-appsvc 10.50.4.0/26\n" + "snet-services /27 (offset 0)\n" "delegation: Microsoft.Web/serverFarms\n" "serviceEndpoint: Microsoft.CognitiveServices", graph_attr=subnet_style, ): - vnet_integ = Subnets("VNet integration\n(WEBSITE_VNET_ROUTE_ALL=1\nPULL_IMAGE_OVER_VNET=true)") + vnet_integ = Subnets( + "VNet integration\n(WEBSITE_VNET_ROUTE_ALL=1\nPULL_IMAGE_OVER_VNET=true)" + ) # --- Private endpoints subnet --- - with Cluster("snet-pe 10.50.2.0/26", graph_attr=subnet_style): + with Cluster("snet-pe /27 (offset 32)", graph_attr=subnet_style): pe_api = PrivateEndpoint("PE\naiinvest-api-dev") pe_web = PrivateEndpoint("PE\naiinvest-web-dev") pe_acr = PrivateEndpoint("PE\nACR") @@ -109,30 +104,50 @@ "App Service Plan P0v3 (Linux)\nplan-aiinvest-...", graph_attr=private_paas_style, ): - api_app = AppServices("aiinvest-api-dev\nDOCKER container\npublic = Disabled") - web_app = AppServices("aiinvest-web-dev\nDOCKER container\npublic = Disabled") + api_app = AppServices( + "aiinvest-api-dev\nDOCKER container\npublic = Disabled" + ) + web_app = AppServices( + "aiinvest-web-dev\nDOCKER container\npublic = Disabled" + ) # --- Backing PaaS (all private) --- with Cluster("Private PaaS dependencies", graph_attr=private_paas_style): acr = ContainerRegistries("ACR\naiinvestacr...\npublic = Disabled") - cosmos = CosmosDb("Cosmos DB (NoSQL)\naiinvest-cosmosdb-...\npublic = Disabled") + cosmos = CosmosDb( + "Cosmos DB (NoSQL)\naiinvest-cosmosdb-...\npublic = Disabled" + ) storage = BlobStorage("Storage Account\naiinveststa...\npublic = Disabled") ai = CognitiveServices( - "AI Foundry / OpenAI\naiiuhsfnmz4b6d4zbsz\npublic = Enabled\nnetworkAcls: Deny\n+ VNet rule (snet-appsvc)" + "AI Foundry / OpenAI\naiiuhsfnmz4b6d4zbsz\npublic = Enabled\nnetworkAcls: Deny\n+ VNet rule (snet-services)" ) # --- Observability --- - with Cluster("Observability (private via AMPLS)", graph_attr=private_paas_style): - law = LogAnalyticsWorkspaces("Log Analytics\naiinvest-law-...\ningest+query Disabled") + with Cluster( + "Observability (private via AMPLS)", graph_attr=private_paas_style + ): + law = LogAnalyticsWorkspaces( + "Log Analytics\naiinvest-law-...\ningest+query Disabled" + ) appi = ApplicationInsights("App Insights\naiinvest-appi-...") # ===================================================================== - # Operator path (dashed = control / SSH tunnel) + # Operator path (dashed = control over peering) # ===================================================================== - operator >> Edge(label="HTTPS 443\n(Bastion tunnel)", style="dashed", color="#8A6D3B") >> bastion - bastion >> Edge(style="dashed", color="#8A6D3B") >> jumpbox - jumpbox >> Edge(label="SOCKS5\nbrowse private apps", style="dashed", color="#8A6D3B") >> pe_api - jumpbox >> Edge(style="dashed", color="#8A6D3B") >> pe_web + ( + operator + >> Edge( + label="HTTPS via peering\n(ExpressRoute / VPN / hub)", + style="dashed", + color="#8A6D3B", + ) + >> pe_web + ) + ( + operator + >> Edge(label="docker push / az deploy", style="dashed", color="#8A6D3B") + >> pe_acr + ) # ===================================================================== # Inbound app traffic via PE @@ -153,10 +168,14 @@ vnet_integ >> Edge(label="image pull\n(MI auth)") >> pe_acr >> acr vnet_integ >> Edge() >> pe_cosmos >> cosmos vnet_integ >> Edge() >> pe_blob >> storage - vnet_integ >> Edge( - label="service endpoint\nMicrosoft.CognitiveServices", - color="#107C10", - ) >> ai + ( + vnet_integ + >> Edge( + label="service endpoint\nMicrosoft.CognitiveServices", + color="#107C10", + ) + >> ai + ) # UAMI -> ACR (AcrPull) uami >> Edge(label="AcrPull", style="dashed", color="#5C2D91") >> acr @@ -168,4 +187,8 @@ appi >> Edge(style="dotted", color="#999") >> law # DNS resolution (informational) - vnet_integ >> Edge(style="dotted", color="#888", label="DNS via 168.63.129.16") >> dns + ( + vnet_integ + >> Edge(style="dotted", color="#888", label="DNS via 168.63.129.16") + >> dns + ) diff --git a/infra/0-connect-jumpbox.sh b/infra/0-connect-jumpbox.sh deleted file mode 100755 index c9e08f4..0000000 --- a/infra/0-connect-jumpbox.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash -# Connect to the zero-trust Windows jumpbox VM over Azure Bastion using RDP. -# -# Prerequisites on your laptop: -# - Azure CLI (logged in with `az login` to the same subscription) -# - Bastion SKU must be 'Standard' (native-client tunneling not supported on Basic) -# - On macOS/Linux: an RDP client (e.g. Microsoft Remote Desktop on macOS, -# `xfreerdp` / `remmina` on Linux). The script opens an `az network bastion -# tunnel` to the VM's RDP port and you connect your client to localhost. -# - On Windows: nothing extra — `az network bastion rdp` launches mstsc directly. -# -# Usage: ./infra/0-connect-jumpbox.sh -g [options] - -set -e - -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BLUE='\033[0;34m' -NC='\033[0m' - -RESOURCE_GROUP="" -ADMIN_USER="azureuser" -PORT="50389" -MODE="auto" # auto | tunnel | rdp - -usage() { - echo "Usage: $0 -g [options]" - echo " -g, --resource-group Azure Resource Group name (required)" - echo " -u, --user RDP user on the jumpbox (default: azureuser)" - echo " -p, --local-port Local port for the Bastion tunnel (default: 50389)" - echo " --tunnel Force tunnel mode (open localhost: -> VM:3389)" - echo " --rdp Force native 'az network bastion rdp' mode (Windows only)" - echo " -h, --help Show this help" - exit 1 -} - -while [[ $# -gt 0 ]]; do - case $1 in - -g|--resource-group) RESOURCE_GROUP="$2"; shift 2 ;; - -u|--user) ADMIN_USER="$2"; shift 2 ;; - -p|--local-port) PORT="$2"; shift 2 ;; - --tunnel) MODE="tunnel"; shift ;; - --rdp) MODE="rdp"; shift ;; - -h|--help) usage ;; - *) echo "Unknown option $1"; usage ;; - esac -done - -[ -z "$RESOURCE_GROUP" ] && usage - -# Find jumpbox + bastion from the infra deployment outputs -DEPLOYMENT_NAME=$(az deployment group list \ - --resource-group "$RESOURCE_GROUP" \ - --query "[?contains(name, 'ai-invest-sample')] | sort_by(@, &properties.timestamp) | [-1].name" \ - --output tsv) - -if [ -z "$DEPLOYMENT_NAME" ]; then - echo -e "${RED}❌ Infrastructure deployment not found in $RESOURCE_GROUP.${NC}" - exit 1 -fi - -JUMPBOX_NAME=$(az deployment group show -g "$RESOURCE_GROUP" -n "$DEPLOYMENT_NAME" --query "properties.outputs.jumpboxName.value" -o tsv) -BASTION_NAME=$(az deployment group show -g "$RESOURCE_GROUP" -n "$DEPLOYMENT_NAME" --query "properties.outputs.bastionName.value" -o tsv) - -if [ -z "$JUMPBOX_NAME" ] || [ -z "$BASTION_NAME" ]; then - echo -e "${RED}❌ No jumpbox/bastion found in deployment outputs. Was the infra deployed with isPrivate=true and deployJumpbox=true?${NC}" - exit 1 -fi - -JUMPBOX_ID=$(az vm show -g "$RESOURCE_GROUP" -n "$JUMPBOX_NAME" --query id -o tsv) - -# Auto-pick the right command per host OS. -if [ "$MODE" == "auto" ]; then - case "$(uname -s)" in - MINGW*|MSYS*|CYGWIN*) MODE="rdp" ;; - *) MODE="tunnel" ;; - esac -fi - -echo -e "${BLUE}🔐 Opening RDP session to Windows jumpbox via Bastion...${NC}" -echo -e "${BLUE} Jumpbox: $JUMPBOX_NAME${NC}" -echo -e "${BLUE} Bastion: $BASTION_NAME${NC}" -echo -e "${BLUE} Mode: $MODE${NC}" -echo "" - -if [ "$MODE" == "rdp" ]; then - echo -e "${YELLOW}Launching native RDP client (Windows mstsc)...${NC}" - az network bastion rdp \ - --name "$BASTION_NAME" \ - --resource-group "$RESOURCE_GROUP" \ - --target-resource-id "$JUMPBOX_ID" -else - echo -e "${YELLOW}Opening Bastion tunnel on localhost:$PORT -> $JUMPBOX_NAME:3389${NC}" - echo -e "${YELLOW}Connect your RDP client to: localhost:$PORT${NC}" - echo -e "${YELLOW} User: $ADMIN_USER${NC}" - echo -e "${YELLOW} Password: (the admin password you set during deployment)${NC}" - echo "" - echo -e "${YELLOW}On macOS: open 'Microsoft Remote Desktop' and add a PC at localhost:$PORT${NC}" - echo -e "${YELLOW}On Linux: xfreerdp /v:localhost:$PORT /u:$ADMIN_USER${NC}" - echo "" - echo -e "${YELLOW}Once connected, on the jumpbox open PowerShell and run:${NC}" - echo -e "${YELLOW} cd C:\\Users\\Public\\Desktop\\Agentic-AI-Investment-Analysis-Sample${NC}" - echo -e "${YELLOW} bash infra/2-build-and-push-images.sh -r ${NC}" - echo -e "${YELLOW} bash infra/3-deploy-apps.sh -g $RESOURCE_GROUP${NC}" - echo "" - echo -e "${BLUE}Press Ctrl+C in this terminal to close the tunnel when finished.${NC}" - az network bastion tunnel \ - --name "$BASTION_NAME" \ - --resource-group "$RESOURCE_GROUP" \ - --target-resource-id "$JUMPBOX_ID" \ - --resource-port 3389 \ - --port "$PORT" -fi diff --git a/infra/1-deploy-azure-infra.sh b/infra/1-deploy-azure-infra.sh index f8970ba..bc4f19b 100755 --- a/infra/1-deploy-azure-infra.sh +++ b/infra/1-deploy-azure-infra.sh @@ -20,16 +20,15 @@ NAME_PREFIX="aiinvest" ENVIRONMENT="dev" DEBUG="false" IS_PRIVATE="true" -DEPLOY_JUMPBOX="true" -ADMIN_PASSWORD="" -BASTION_SKU="Standard" +VNET_ADDRESS_PREFIX="" # Function to show usage usage() { - echo "Usage: $0 -g [options]" + echo "Usage: $0 -g --vnet-address-prefix [options]" echo "" echo "Required:" echo " -g, --resource-group Azure Resource Group name" + echo " --vnet-address-prefix VNet address space (must be a /26, e.g. 10.123.45.0/26)" echo "" echo "Optional:" echo " -l, --location Azure location (default: westus2)" @@ -37,15 +36,15 @@ usage() { echo " -e, --environment Environment name (default: dev)" echo " -a, --ai-foundry-location AI Foundry location (default: swedencentral)" echo " --public Deploy the legacy public topology (isPrivate=false)" - echo " --no-jumpbox Skip jumpbox/Bastion deployment when private" - echo " --admin-password Admin password for the Windows jumpbox VM (12-123 chars; mix of upper/lower/digit/special). If omitted you will be prompted." - echo " --bastion-sku Bastion SKU: Basic or Standard (default: Standard)" echo " -d, --debug Enable debug logging" echo " -h, --help Show this help message" echo "" + echo "Operator access: this template no longer deploys Azure Bastion or a jumpbox VM." + echo "Operators are expected to reach the private endpoints from a peered network" + echo "(ExpressRoute, VPN, or hub VNet)." + echo "" echo "Examples:" - echo " $0 -g my-resource-group" - echo " $0 -g my-rg -l westus2 -p myapp -e dev" + echo " $0 -g my-resource-group --vnet-address-prefix 10.123.45.0/26" exit 1 } @@ -74,23 +73,10 @@ while [[ $# -gt 0 ]]; do ;; --public) IS_PRIVATE="false" - DEPLOY_JUMPBOX="false" - shift - ;; - --no-jumpbox) - DEPLOY_JUMPBOX="false" shift ;; - --ssh-key-file) - echo -e "${YELLOW}⚠️ --ssh-key-file is deprecated; the jumpbox is now Windows. Use --admin-password instead.${NC}" - shift 2 - ;; - --admin-password) - ADMIN_PASSWORD="$2" - shift 2 - ;; - --bastion-sku) - BASTION_SKU="$2" + --vnet-address-prefix) + VNET_ADDRESS_PREFIX="$2" shift 2 ;; -d|--debug) @@ -113,6 +99,16 @@ if [ -z "$RESOURCE_GROUP" ]; then usage fi +if [ -z "$VNET_ADDRESS_PREFIX" ]; then + echo -e "${RED}❌ Error: --vnet-address-prefix is required (must be a /26, e.g. 10.123.45.0/26)${NC}" + usage +fi + +if [[ "$VNET_ADDRESS_PREFIX" != */26 ]]; then + echo -e "${RED}❌ Error: --vnet-address-prefix must end in /26 (got: $VNET_ADDRESS_PREFIX)${NC}" + exit 1 +fi + echo -e "${BLUE}🚀 Starting Azure deployment for Doc Processing Solution${NC}" echo -e "${BLUE}Resource Group: $RESOURCE_GROUP${NC}" echo -e "${BLUE}Location: $LOCATION${NC}" @@ -168,30 +164,6 @@ fi echo -e "${BLUE}🏗️ Deploying Azure infrastructure...${NC}" DEPLOYMENT_NAME="ai-invest-sample-$(date +%s)" -# Resolve Windows jumpbox admin password (required when deploying the jumpbox) -JUMPBOX_PASSWORD="" -if [ "$IS_PRIVATE" == "true" ] && [ "$DEPLOY_JUMPBOX" == "true" ]; then - if [ -z "$ADMIN_PASSWORD" ]; then - echo -e "${YELLOW}🔐 Enter an admin password for the Windows jumpbox VM.${NC}" - echo -e "${YELLOW} Must be 12-123 chars and include 3 of: lowercase, uppercase, digit, special.${NC}" - read -r -s -p "Admin password: " ADMIN_PASSWORD - echo - read -r -s -p "Confirm password: " ADMIN_PASSWORD_CONFIRM - echo - if [ "$ADMIN_PASSWORD" != "$ADMIN_PASSWORD_CONFIRM" ]; then - echo -e "${RED}❌ Passwords do not match.${NC}" - exit 1 - fi - fi - if [ ${#ADMIN_PASSWORD} -lt 12 ]; then - echo -e "${RED}❌ Admin password must be at least 12 characters.${NC}" - echo -e "${YELLOW} Re-run with --admin-password '' or --no-jumpbox / --public to skip.${NC}" - exit 1 - fi - JUMPBOX_PASSWORD="$ADMIN_PASSWORD" - echo -e "${GREEN}✅ Using provided admin password for Windows jumpbox${NC}" -fi - optional_args=() if [ "$DEBUG" == "true" ]; then @@ -207,9 +179,7 @@ az deployment group create \ location="$LOCATION" \ aiFoundryLocation="$AIFOUNDRY_LOCATION" \ isPrivate="$IS_PRIVATE" \ - deployJumpbox="$DEPLOY_JUMPBOX" \ - bastionSku="$BASTION_SKU" \ - jumpboxAdminPassword="$JUMPBOX_PASSWORD" \ + vnetAddressPrefix="$VNET_ADDRESS_PREFIX" \ --name "$DEPLOYMENT_NAME" \ --output table ${optional_args[@]} @@ -217,14 +187,14 @@ az deployment group create \ if [ $? -eq 0 ]; then echo "" echo -e "${GREEN}✅ Infrastructure deployed successfully${NC}" - + # Get deployment outputs ACR_LOGIN_SERVER=$(az deployment group show \ --resource-group "$RESOURCE_GROUP" \ --name "$DEPLOYMENT_NAME" \ --query "properties.outputs.containerRegistryLoginServer.value" \ --output tsv) - + CONTAINER_APPS_ENV_ID=$(az deployment group show \ --resource-group "$RESOURCE_GROUP" \ --name "$DEPLOYMENT_NAME" \ @@ -236,12 +206,12 @@ if [ $? -eq 0 ]; then # --name "$DEPLOYMENT_NAME" \ # --query "properties.outputs.appConfigStoreEndpoint.value" \ # --output tsv) - + echo -e "${GREEN}Container Registry: $ACR_LOGIN_SERVER${NC}" echo -e "${GREEN}Container Apps Environment: $(basename "$CONTAINER_APPS_ENV_ID")${NC}" # echo -e "${GREEN}App Configuration Store Endpoint: $APP_CONFIG_STORE_ENDPOINT${NC}" echo "" - + else echo -e "${RED}❌ Infrastructure deployment failed${NC}" exit 1 @@ -251,14 +221,14 @@ echo "" echo -e "${GREEN}🎉 Azure infrastructure deployment completed!${NC}" echo "" if [ "$IS_PRIVATE" == "true" ]; then - echo -e "${YELLOW}⚠️ Zero-trust mode: ACR and Container Apps are now private.${NC}" - echo -e "${YELLOW} Scripts 2 and 3 must be run from inside the VNet (use the jumpbox).${NC}" + echo -e "${YELLOW}⚠️ Zero-trust mode: ACR and App Service are private.${NC}" + echo -e "${YELLOW} Scripts 2 and 3 must be run from a host with line-of-sight to the${NC}" + echo -e "${YELLOW} private endpoints (peered VNet via ExpressRoute / VPN / hub VNet).${NC}" echo -e "${BLUE}Next Steps:${NC}" - echo "1. Connect to the jumpbox via Azure Bastion:" - echo " ./infra/0-connect-jumpbox.sh -g $RESOURCE_GROUP" - echo "" - echo "2. On the jumpbox: clone the repo, then run:" + echo "1. From a peered host, build and push images to the private ACR:" echo " ./infra/2-build-and-push-images.sh -r $ACR_LOGIN_SERVER" + echo "" + echo "2. Deploy the apps:" echo " ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP" else echo -e "${BLUE}Next Steps:${NC}" @@ -268,4 +238,4 @@ else echo "2. Deploy your applications using pushed images:" echo " ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP" fi -echo "" \ No newline at end of file +echo "" diff --git a/infra/2-build-and-push-images.sh b/infra/2-build-and-push-images.sh index a5b8662..62a48f6 100755 --- a/infra/2-build-and-push-images.sh +++ b/infra/2-build-and-push-images.sh @@ -18,10 +18,11 @@ TAG="latest" BUILD_API="false" BUILD_WEB="false" BUILD_ALL="true" -# Default build mode: 'docker' builds locally and pushes (works from the -# zero-trust Windows jumpbox when Docker EE is installed and the private ACR -# is reachable via VNet). Use --acr to submit to ACR Tasks — note that against -# a private ACR this requires a VNet-enabled dedicated agent pool (Premium feature). +# Default build mode: 'docker' builds locally and pushes — this works when the +# operator host has line-of-sight to the private ACR (via the customer's peered +# network: ExpressRoute / VPN / hub VNet). Use --acr to submit to ACR Tasks — +# note that against a private ACR this requires a VNet-enabled dedicated agent +# pool (Premium feature). BUILD_MODE="docker" # Function to show usage @@ -253,4 +254,4 @@ echo "" echo "" echo -e "${BLUE}➡️ Next step: Deploy the applications using the deployment script${NC}" echo " ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP" -echo "" \ No newline at end of file +echo "" diff --git a/infra/3-deploy-apps.sh b/infra/3-deploy-apps.sh index 0f9edc2..bee88c0 100755 --- a/infra/3-deploy-apps.sh +++ b/infra/3-deploy-apps.sh @@ -156,25 +156,25 @@ fi # to avoid multiple az command calls get_deployment_outputs() { local resource_group="$1" - + # Get the deployment name local deployment_name=$(az deployment group list \ --resource-group "$resource_group" \ --query "[?contains(name, 'ai-invest-appsvc')].name | [0]" \ --output tsv) - + if [ -z "$deployment_name" ]; then echo -e "${RED}❌ Infrastructure deployment not found. Please run deploy-azure-infra.sh first.${NC}" exit 1 fi - + # Fetch all outputs in a single call DEPLOYMENT_OUTPUTS=$(az deployment group show \ --resource-group "$resource_group" \ --name "$deployment_name" \ --query "properties.outputs" \ --output json) - + if [ -z "$DEPLOYMENT_OUTPUTS" ]; then echo -e "${RED}❌ Failed to retrieve deployment outputs.${NC}" exit 1 @@ -482,7 +482,7 @@ fi AI_ACCOUNT=$(az cognitiveservices account list -g "$RESOURCE_GROUP" --query "[0].name" -o tsv 2>/dev/null) if [ -n "$AI_ACCOUNT" ] && [ -n "$APPSVC_SUBNET_ID" ]; then - echo -e "${BLUE}🔒 Locking AI Services account '$AI_ACCOUNT' to snet-appsvc only...${NC}" + echo -e "${BLUE}🔒 Locking AI Services account '$AI_ACCOUNT' to snet-services only...${NC}" az rest --method PATCH \ --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$AI_ACCOUNT?api-version=2024-10-01" \ --body "{\"properties\":{\"networkAcls\":{\"defaultAction\":\"Deny\",\"bypass\":\"AzureServices\",\"virtualNetworkRules\":[{\"id\":\"$APPSVC_SUBNET_ID\",\"ignoreMissingVnetServiceEndpoint\":false}],\"ipRules\":[]}}}" \ diff --git a/infra/bicep/main-linux.bicep b/infra/bicep/main-linux.bicep index a2296bf..c8ce887 100644 --- a/infra/bicep/main-linux.bicep +++ b/infra/bicep/main-linux.bicep @@ -12,25 +12,11 @@ param location string = resourceGroup().location // ################################################ // Zero-trust / networking parameters -@description('When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources.') +@description('When true, deploys the zero-trust topology: VNet + private endpoints + private App Service + disabled public network access on all PaaS resources.') param isPrivate bool = true -@description('When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access.') -param deployJumpbox bool = true - -@description('VNet address space used when isPrivate=true') -param vnetAddressPrefix string = '10.50.0.0/16' - -@description('Admin username for the jumpbox VM') -param jumpboxAdminUsername string = 'azureuser' - -@description('SSH public key for the jumpbox VM (required when deployJumpbox=true)') -@secure() -param jumpboxAdminPublicKey string = '' - -@description('Azure Bastion SKU. Standard required for native-client tunneling.') -@allowed([ 'Basic', 'Standard' ]) -param bastionSku string = 'Standard' +@description('Address space for the workload VNet. Customer supplies a /26 (e.g. 10.123.45.0/26). Required for both private and public deployments (a placeholder is acceptable when isPrivate=false).') +param vnetAddressPrefix string // ################################################ // Application specific parameters @@ -39,12 +25,12 @@ param bastionSku string = 'Standard' param cosmosDbName string = 'ai-investment-analysis-sample' param cosmosDBContainerNames array = [ - {name: 'opportunities', partitionKey: '/owner_id'} - {name: 'users', partitionKey: '/email'} - {name: 'documents', partitionKey: '/opportunity_id'} - {name: 'analysis', partitionKey: '/opportunity_id'} - {name: 'workflow_events', partitionKey: '/analysis_id'} - {name: 'what_if_conversations', partitionKey: '/analysis_id'} + { name: 'opportunities', partitionKey: '/owner_id' } + { name: 'users', partitionKey: '/email' } + { name: 'documents', partitionKey: '/opportunity_id' } + { name: 'analysis', partitionKey: '/opportunity_id' } + { name: 'workflow_events', partitionKey: '/analysis_id' } + { name: 'what_if_conversations', partitionKey: '/analysis_id' } ] @description('Name of the blob storage container for documents') @@ -53,7 +39,6 @@ param docsContainerName string = 'opportunity-documents' @description('Location for AI Foundry resources') param aiFoundryLocation string = resourceGroup().location - var resourceGroupId = resourceGroup().id var tags = { Environment: environment @@ -146,7 +131,9 @@ module ampls 'modules/ampls.bicep' = if (isPrivate) { module storage 'modules/storage.bicep' = { name: 'storageAccountDeployment.${shortHash}' params: { - storageAccountName: length('${namePrefix}sta${uniqueString(resourceGroupId)}') > 24 ? substring(toLower('${namePrefix}sta${uniqueString(resourceGroupId)}'), 0, 24) : toLower('${namePrefix}sta${uniqueString(resourceGroupId)}') + storageAccountName: length('${namePrefix}sta${uniqueString(resourceGroupId)}') > 24 + ? substring(toLower('${namePrefix}sta${uniqueString(resourceGroupId)}'), 0, 24) + : toLower('${namePrefix}sta${uniqueString(resourceGroupId)}') location: location docsContainerName: docsContainerName roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] @@ -228,48 +215,6 @@ module aiFoundry 'modules/ai-foundry.bicep' = { } } -// ################################################ -// Operator access plane — Bastion + Jumpbox - -module bastion 'modules/bastion.bicep' = if (isPrivate && deployJumpbox) { - name: 'bastionDeployment.${shortHash}' - params: { - name: toLower('${namePrefix}-bastion-${uniqueString(resourceGroupId)}') - location: location - subnetId: network.outputs.bastionSubnetId - sku: bastionSku - tags: tags - } -} - -module jumpbox 'modules/jumpbox-linux.bicep' = if (isPrivate && deployJumpbox) { - name: 'jumpboxDeployment.${shortHash}' - params: { - name: toLower('${namePrefix}-jump-${uniqueString(resourceGroupId)}') - location: location - subnetId: network.outputs.jumpboxSubnetId - adminUsername: jumpboxAdminUsername - adminPublicKey: jumpboxAdminPublicKey - userAssignedIdentityId: userAssignedIdentity.outputs.resourceId - tags: tags - } -} - -var uaiName = toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') - -// Grant the jumpbox identity the roles needed to run scripts end-to-end. -// UAMI already has AcrPull/AcrPush/AcrDelete + Storage + Cosmos data roles; -// add Contributor scoped to the resource group so it can deploy container apps. -resource jumpboxRgContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (isPrivate && deployJumpbox) { - name: guid(resourceGroup().id, uaiName, 'b24988ac-6180-42a0-ab88-20f7382dd24c') - scope: resourceGroup() - properties: { - principalId: userAssignedIdentity.outputs.principalId - principalType: 'ServicePrincipal' - roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c') // Contributor - } -} - // ################################################ // Outputs @@ -292,5 +237,3 @@ output aiProjectName string = aiFoundry.outputs.aiProjectName output aiServicesName string = aiFoundry.outputs.aiServicesName output isPrivate bool = isPrivate output vnetId string = isPrivate ? network.outputs.vnetId : '' -output jumpboxName string = (isPrivate && deployJumpbox) ? jumpbox.outputs.vmName : '' -output bastionName string = (isPrivate && deployJumpbox) ? bastion.outputs.bastionName : '' diff --git a/infra/bicep/main-linux.json b/infra/bicep/main-linux.json index c97ff3d..153ad95 100644 --- a/infra/bicep/main-linux.json +++ b/infra/bicep/main-linux.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "3235998341901409051" + "templateHash": "9720362099855457754" } }, "parameters": { @@ -35,46 +35,13 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources." - } - }, - "deployJumpbox": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access." + "description": "When true, deploys the zero-trust topology: VNet + private endpoints + private App Service + disabled public network access on all PaaS resources." } }, "vnetAddressPrefix": { "type": "string", - "defaultValue": "10.50.0.0/16", - "metadata": { - "description": "VNet address space used when isPrivate=true" - } - }, - "jumpboxAdminUsername": { - "type": "string", - "defaultValue": "azureuser", - "metadata": { - "description": "Admin username for the jumpbox VM" - } - }, - "jumpboxAdminPublicKey": { - "type": "securestring", - "defaultValue": "", - "metadata": { - "description": "SSH public key for the jumpbox VM (required when deployJumpbox=true)" - } - }, - "bastionSku": { - "type": "string", - "defaultValue": "Standard", - "allowedValues": [ - "Basic", - "Standard" - ], "metadata": { - "description": "Azure Bastion SKU. Standard required for native-client tunneling." + "description": "Address space for the workload VNet. Customer supplies a /26 (e.g. 10.123.45.0/26). Required for both private and public deployments (a placeholder is acceptable when isPrivate=false)." } }, "cosmosDbName": { @@ -134,24 +101,9 @@ "Environment": "[parameters('environment')]", "Project": "ai-investment-analysis-sample" }, - "shortHash": "[substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)]", - "uaiName": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "shortHash": "[substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)]" }, "resources": { - "jumpboxRgContributor": { - "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", - "type": "Microsoft.Authorization/roleAssignments", - "apiVersion": "2022-04-01", - "name": "[guid(resourceGroup().id, variables('uaiName'), 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", - "properties": { - "principalId": "[reference('userAssignedIdentity').outputs.principalId.value]", - "principalType": "ServicePrincipal", - "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]" - }, - "dependsOn": [ - "userAssignedIdentity" - ] - }, "network": { "condition": "[parameters('isPrivate')]", "type": "Microsoft.Resources/deployments", @@ -183,7 +135,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "11703013425078531364" + "templateHash": "15751875796585908564" } }, "parameters": { @@ -202,9 +154,8 @@ }, "vnetAddressPrefix": { "type": "string", - "defaultValue": "10.50.0.0/16", "metadata": { - "description": "Address space for the virtual network" + "description": "Address space for the virtual network. MUST be a /26 supplied by the customer (e.g. 10.123.45.0/26)." } }, "tags": { @@ -215,6 +166,10 @@ } } }, + "variables": { + "servicesSubnetPrefix": "[cidrSubnet(parameters('vnetAddressPrefix'), 27, 0)]", + "peSubnetPrefix": "[cidrSubnet(parameters('vnetAddressPrefix'), 27, 1)]" + }, "resources": [ { "type": "Microsoft.Network/networkSecurityGroups", @@ -243,188 +198,7 @@ { "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-jumpbox', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [ - { - "name": "AllowBastionInbound", - "properties": { - "priority": 100, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "VirtualNetwork", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "22", - "3389" - ] - } - } - ] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-bastion', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [ - { - "name": "AllowHttpsInbound", - "properties": { - "priority": 120, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "Internet", - "sourcePortRange": "*", - "destinationAddressPrefix": "*", - "destinationPortRange": "443" - } - }, - { - "name": "AllowGatewayManagerInbound", - "properties": { - "priority": 130, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "GatewayManager", - "sourcePortRange": "*", - "destinationAddressPrefix": "*", - "destinationPortRange": "443" - } - }, - { - "name": "AllowAzureLoadBalancerInbound", - "properties": { - "priority": 140, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "AzureLoadBalancer", - "sourcePortRange": "*", - "destinationAddressPrefix": "*", - "destinationPortRange": "443" - } - }, - { - "name": "AllowBastionHostCommunication", - "properties": { - "priority": 150, - "direction": "Inbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "VirtualNetwork", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "8080", - "5701" - ] - } - }, - { - "name": "AllowSshRdpOutbound", - "properties": { - "priority": 100, - "direction": "Outbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "*", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "22", - "3389" - ] - } - }, - { - "name": "AllowAzureCloudOutbound", - "properties": { - "priority": 110, - "direction": "Outbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "*", - "sourcePortRange": "*", - "destinationAddressPrefix": "AzureCloud", - "destinationPortRange": "443" - } - }, - { - "name": "AllowBastionCommunication", - "properties": { - "priority": 120, - "direction": "Outbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "VirtualNetwork", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "8080", - "5701" - ] - } - }, - { - "name": "AllowGetSessionInformation", - "properties": { - "priority": 130, - "direction": "Outbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "*", - "sourcePortRange": "*", - "destinationAddressPrefix": "Internet", - "destinationPortRange": "80" - } - } - ] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-aca', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-build', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-mgmt', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-appsvc', parameters('vnetName'))]", + "name": "[format('{0}-nsg-services', parameters('vnetName'))]", "location": "[parameters('location')]", "tags": "[parameters('tags')]", "properties": { @@ -445,102 +219,42 @@ }, "subnets": [ { - "name": "snet-aca-infra", + "name": "snet-services", "properties": { - "addressPrefix": "10.50.0.0/23", + "addressPrefix": "[variables('servicesSubnetPrefix')]", "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]" + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-services', parameters('vnetName')))]" }, "delegations": [ { - "name": "aca-delegation", + "name": "appsvc-delegation", "properties": { - "serviceName": "Microsoft.App/environments" + "serviceName": "Microsoft.Web/serverFarms" } } ], - "privateEndpointNetworkPolicies": "Disabled" + "serviceEndpoints": [ + { + "service": "Microsoft.CognitiveServices" + } + ] } }, { "name": "snet-pe", "properties": { - "addressPrefix": "10.50.2.0/26", + "addressPrefix": "[variables('peSubnetPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" }, "privateEndpointNetworkPolicies": "Disabled" } - }, - { - "name": "snet-jumpbox", - "properties": { - "addressPrefix": "10.50.2.64/27", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]" - } - } - }, - { - "name": "AzureBastionSubnet", - "properties": { - "addressPrefix": "10.50.2.128/26", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]" - } - } - }, - { - "name": "snet-build", - "properties": { - "addressPrefix": "10.50.2.192/27", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]" - }, - "privateEndpointNetworkPolicies": "Disabled" - } - }, - { - "name": "snet-mgmt", - "properties": { - "addressPrefix": "10.50.2.224/27", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]" - } - } - }, - { - "name": "snet-appsvc", - "properties": { - "addressPrefix": "10.50.4.0/26", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]" - }, - "delegations": [ - { - "name": "appsvc-delegation", - "properties": { - "serviceName": "Microsoft.Web/serverFarms" - } - } - ], - "serviceEndpoints": [ - { - "service": "Microsoft.CognitiveServices" - } - ] - } } ] }, "dependsOn": [ - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-services', parameters('vnetName')))]" ] } ], @@ -553,33 +267,13 @@ "type": "string", "value": "[parameters('vnetName')]" }, - "acaInfraSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-aca-infra', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, "peSubnetId": { "type": "string", "value": "[format('{0}/subnets/snet-pe', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" }, - "jumpboxSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-jumpbox', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, - "bastionSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/AzureBastionSubnet', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, - "buildSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-build', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, - "mgmtSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-mgmt', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, "appSvcSubnetId": { "type": "string", - "value": "[format('{0}/subnets/snet-appsvc', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + "value": "[format('{0}/subnets/snet-services', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" } } } @@ -42995,349 +42689,6 @@ "privateDns", "userAssignedIdentity" ] - }, - "bastion": { - "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "[format('bastionDeployment.{0}', variables('shortHash'))]", - "properties": { - "expressionEvaluationOptions": { - "scope": "inner" - }, - "mode": "Incremental", - "parameters": { - "name": { - "value": "[toLower(format('{0}-bastion-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" - }, - "location": { - "value": "[parameters('location')]" - }, - "subnetId": { - "value": "[reference('network').outputs.bastionSubnetId.value]" - }, - "sku": { - "value": "[parameters('bastionSku')]" - }, - "tags": { - "value": "[variables('tags')]" - } - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "_generator": { - "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "9423121226804345673" - } - }, - "parameters": { - "location": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Location for the bastion host" - } - }, - "name": { - "type": "string", - "metadata": { - "description": "Bastion host name" - } - }, - "subnetId": { - "type": "string", - "metadata": { - "description": "AzureBastionSubnet resource id" - } - }, - "sku": { - "type": "string", - "defaultValue": "Standard", - "allowedValues": [ - "Basic", - "Standard" - ], - "metadata": { - "description": "SKU: Basic or Standard. Standard required for native-client / SSH tunneling." - } - }, - "tags": { - "type": "object", - "defaultValue": {}, - "metadata": { - "description": "Tags for resources" - } - } - }, - "resources": [ - { - "type": "Microsoft.Network/publicIPAddresses", - "apiVersion": "2023-11-01", - "name": "[format('{0}-pip', parameters('name'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "sku": { - "name": "Standard" - }, - "properties": { - "publicIPAllocationMethod": "Static", - "publicIPAddressVersion": "IPv4" - } - }, - { - "type": "Microsoft.Network/bastionHosts", - "apiVersion": "2023-11-01", - "name": "[parameters('name')]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "sku": { - "name": "[parameters('sku')]" - }, - "properties": { - "enableTunneling": "[if(equals(parameters('sku'), 'Standard'), true(), false())]", - "enableShareableLink": false, - "ipConfigurations": [ - { - "name": "ipConfig", - "properties": { - "subnet": { - "id": "[parameters('subnetId')]" - }, - "publicIPAddress": { - "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" - } - } - } - ] - }, - "dependsOn": [ - "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" - ] - } - ], - "outputs": { - "bastionId": { - "type": "string", - "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]" - }, - "bastionName": { - "type": "string", - "value": "[parameters('name')]" - }, - "publicIpAddress": { - "type": "string", - "value": "[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name'))), '2023-11-01').ipAddress]" - } - } - } - }, - "dependsOn": [ - "network" - ] - }, - "jumpbox": { - "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "[format('jumpboxDeployment.{0}', variables('shortHash'))]", - "properties": { - "expressionEvaluationOptions": { - "scope": "inner" - }, - "mode": "Incremental", - "parameters": { - "name": { - "value": "[toLower(format('{0}-jump-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" - }, - "location": { - "value": "[parameters('location')]" - }, - "subnetId": { - "value": "[reference('network').outputs.jumpboxSubnetId.value]" - }, - "adminUsername": { - "value": "[parameters('jumpboxAdminUsername')]" - }, - "adminPublicKey": { - "value": "[parameters('jumpboxAdminPublicKey')]" - }, - "userAssignedIdentityId": { - "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" - }, - "tags": { - "value": "[variables('tags')]" - } - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "_generator": { - "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "5495470989234358791" - } - }, - "parameters": { - "location": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Location for the VM" - } - }, - "name": { - "type": "string", - "metadata": { - "description": "VM name" - } - }, - "subnetId": { - "type": "string", - "metadata": { - "description": "Subnet id for the VM NIC" - } - }, - "vmSize": { - "type": "string", - "defaultValue": "Standard_B2s", - "metadata": { - "description": "VM size. B-series default — cheap, enough for az cli + docker." - } - }, - "adminUsername": { - "type": "string", - "defaultValue": "azureuser", - "metadata": { - "description": "Admin username for SSH (accessed via Bastion)" - } - }, - "adminPublicKey": { - "type": "securestring", - "metadata": { - "description": "SSH public key used to log in (via Bastion)" - } - }, - "userAssignedIdentityId": { - "type": "string", - "metadata": { - "description": "User-assigned managed identity resource id to attach to the VM" - } - }, - "tags": { - "type": "object", - "defaultValue": {}, - "metadata": { - "description": "Tags for resources" - } - } - }, - "variables": { - "cloudInit": "#cloud-config\npackage_update: true\npackage_upgrade: false\npackages:\n - ca-certificates\n - curl\n - gnupg\n - lsb-release\n - jq\n - git\nruncmd:\n - curl -sL https://aka.ms/InstallAzureCLIDeb | bash\n - az bicep install || true\n - install -m 0755 -d /etc/apt/keyrings\n - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg\n - chmod a+r /etc/apt/keyrings/docker.gpg\n - echo \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable\" > /etc/apt/sources.list.d/docker.list\n - apt-get update\n - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin\n - usermod -aG docker azureuser\n" - }, - "resources": [ - { - "type": "Microsoft.Network/networkInterfaces", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nic', parameters('name'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "ipConfigurations": [ - { - "name": "ipconfig", - "properties": { - "subnet": { - "id": "[parameters('subnetId')]" - }, - "privateIPAllocationMethod": "Dynamic" - } - } - ] - } - }, - { - "type": "Microsoft.Compute/virtualMachines", - "apiVersion": "2024-03-01", - "name": "[parameters('name')]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "identity": { - "type": "UserAssigned", - "userAssignedIdentities": { - "[format('{0}', parameters('userAssignedIdentityId'))]": {} - } - }, - "properties": { - "hardwareProfile": { - "vmSize": "[parameters('vmSize')]" - }, - "storageProfile": { - "imageReference": { - "publisher": "Canonical", - "offer": "ubuntu-24_04-lts", - "sku": "server", - "version": "latest" - }, - "osDisk": { - "createOption": "FromImage", - "managedDisk": { - "storageAccountType": "StandardSSD_LRS" - } - } - }, - "osProfile": { - "computerName": "[parameters('name')]", - "adminUsername": "[parameters('adminUsername')]", - "customData": "[base64(variables('cloudInit'))]", - "linuxConfiguration": { - "disablePasswordAuthentication": true, - "ssh": { - "publicKeys": [ - { - "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]", - "keyData": "[parameters('adminPublicKey')]" - } - ] - } - } - }, - "networkProfile": { - "networkInterfaces": [ - { - "id": "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" - } - ] - } - }, - "dependsOn": [ - "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" - ] - } - ], - "outputs": { - "vmId": { - "type": "string", - "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]" - }, - "vmName": { - "type": "string", - "value": "[parameters('name')]" - }, - "nicPrivateIp": { - "type": "string", - "value": "[reference(resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name'))), '2023-11-01').ipConfigurations[0].properties.privateIPAddress]" - } - } - } - }, - "dependsOn": [ - "network", - "userAssignedIdentity" - ] } }, "outputs": { @@ -43416,14 +42767,6 @@ "vnetId": { "type": "string", "value": "[if(parameters('isPrivate'), reference('network').outputs.vnetId.value, '')]" - }, - "jumpboxName": { - "type": "string", - "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('jumpbox').outputs.vmName.value, '')]" - }, - "bastionName": { - "type": "string", - "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('bastion').outputs.bastionName.value, '')]" } } } \ No newline at end of file diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep index 70cec5c..06ab21b 100644 --- a/infra/bicep/main.bicep +++ b/infra/bicep/main.bicep @@ -12,25 +12,11 @@ param location string = resourceGroup().location // ################################################ // Zero-trust / networking parameters -@description('When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources.') +@description('When true, deploys the zero-trust topology: VNet + private endpoints + private App Service + disabled public network access on all PaaS resources.') param isPrivate bool = true -@description('When true (and isPrivate=true), also deploys a Windows jumpbox + Azure Bastion for operator access.') -param deployJumpbox bool = true - -@description('VNet address space used when isPrivate=true') -param vnetAddressPrefix string = '10.50.0.0/16' - -@description('Admin username for the jumpbox VM') -param jumpboxAdminUsername string = 'azureuser' - -@description('Admin password for the Windows jumpbox VM (required when deployJumpbox=true). Must satisfy Azure Windows VM password complexity rules: 12-123 chars; 3 of: lowercase, uppercase, digit, special.') -@secure() -param jumpboxAdminPassword string = '' - -@description('Azure Bastion SKU. Standard required for native-client tunneling.') -@allowed([ 'Basic', 'Standard' ]) -param bastionSku string = 'Standard' +@description('Address space for the workload VNet. Customer supplies a /26 (e.g. 10.123.45.0/26). Required for both private and public deployments (a placeholder is acceptable when isPrivate=false).') +param vnetAddressPrefix string // ################################################ // Application specific parameters @@ -39,12 +25,12 @@ param bastionSku string = 'Standard' param cosmosDbName string = 'ai-investment-analysis-sample' param cosmosDBContainerNames array = [ - {name: 'opportunities', partitionKey: '/owner_id'} - {name: 'users', partitionKey: '/email'} - {name: 'documents', partitionKey: '/opportunity_id'} - {name: 'analysis', partitionKey: '/opportunity_id'} - {name: 'workflow_events', partitionKey: '/analysis_id'} - {name: 'what_if_conversations', partitionKey: '/analysis_id'} + { name: 'opportunities', partitionKey: '/owner_id' } + { name: 'users', partitionKey: '/email' } + { name: 'documents', partitionKey: '/opportunity_id' } + { name: 'analysis', partitionKey: '/opportunity_id' } + { name: 'workflow_events', partitionKey: '/analysis_id' } + { name: 'what_if_conversations', partitionKey: '/analysis_id' } ] @description('Name of the blob storage container for documents') @@ -53,6 +39,44 @@ param docsContainerName string = 'opportunity-documents' @description('Location for AI Foundry resources') param aiFoundryLocation string = resourceGroup().location +// ################################################ +// Optional explicit resource-name overrides. +// Leave any of these empty ('') to fall back to the default +// pattern `${namePrefix}--${uniqueString(rg.id)}` shown next to each +// parameter. Customers that have their own naming convention (e.g. Cloud +// Adoption Framework / corporate standard) can supply the exact names here +// via parameters file. Names are not validated for Azure length/charset +// rules — the caller is responsible for picking a compliant name. + +@description('Optional. Explicit name for the workload VNet. Default: -vnet-') +param vnetNameOverride string = '' + +@description('Optional. Explicit name for the User-Assigned Managed Identity. Default: -uai-') +param userAssignedIdentityNameOverride string = '' + +@description('Optional. Explicit name for the Log Analytics workspace. Default: -law-') +param logAnalyticsWorkspaceNameOverride string = '' + +@description('Optional. Explicit name for the Application Insights component. Default: -appi-') +param appInsightsNameOverride string = '' + +@description('Optional. Explicit name for the Azure Monitor Private Link Scope. Default: -ampls-') +param amplsNameOverride string = '' + +@description('Optional. Explicit name for the Storage account (must be 3-24 lowercase alphanumerics). Default: sta trimmed to 24 chars') +param storageAccountNameOverride string = '' + +@description('Optional. Explicit name for the Cosmos DB account. Default: -cosmosdb-') +param cosmosAccountNameOverride string = '' + +@description('Optional. Explicit name for the Azure Container Registry (must be 5-50 alphanumerics). Default: acr') +param containerRegistryNameOverride string = '' + +@description('Optional. Explicit name for the App Service Plan. Default: -asp-') +param appServicePlanNameOverride string = '' + +@description('Optional. Explicit base name (max 12 chars, lowercase) used to derive AI Foundry resource names. Default: derived from --') +param aiFoundryBaseNameOverride string = '' var resourceGroupId = resourceGroup().id var tags = { @@ -62,13 +86,27 @@ var tags = { var shortHash = substring(uniqueString(resourceGroup().id, deployment().name), 0, 8) +// Resolved resource names — use override when supplied, otherwise the +// default generator pattern. +var defaultStorageName = toLower('${namePrefix}sta${uniqueString(resourceGroupId)}') +var resolvedVnetName = empty(vnetNameOverride) ? toLower('${namePrefix}-vnet-${uniqueString(resourceGroupId)}') : vnetNameOverride +var resolvedUamiName = empty(userAssignedIdentityNameOverride) ? toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') : userAssignedIdentityNameOverride +var resolvedLawName = empty(logAnalyticsWorkspaceNameOverride) ? toLower('${namePrefix}-law-${uniqueString(resourceGroupId)}') : logAnalyticsWorkspaceNameOverride +var resolvedAppiName = empty(appInsightsNameOverride) ? toLower('${namePrefix}-appi-${uniqueString(resourceGroupId)}') : appInsightsNameOverride +var resolvedAmplsName = empty(amplsNameOverride) ? toLower('${namePrefix}-ampls-${uniqueString(resourceGroupId)}') : amplsNameOverride +var resolvedStorageName = empty(storageAccountNameOverride) ? (length(defaultStorageName) > 24 ? substring(defaultStorageName, 0, 24) : defaultStorageName) : storageAccountNameOverride +var resolvedCosmosName = empty(cosmosAccountNameOverride) ? toLower('${namePrefix}-cosmosdb-${uniqueString(resourceGroup().id)}') : cosmosAccountNameOverride +var resolvedAcrName = empty(containerRegistryNameOverride) ? toLower('${namePrefix}acr${uniqueString(resourceGroupId)}') : containerRegistryNameOverride +var resolvedAspName = empty(appServicePlanNameOverride) ? toLower('${namePrefix}-asp-${uniqueString(resourceGroupId)}') : appServicePlanNameOverride +var resolvedAiFoundryBaseName = empty(aiFoundryBaseNameOverride) ? substring(toLower(uniqueString('ai-${namePrefix}-${environment}-${resourceGroup().id}')), 0, 12) : aiFoundryBaseNameOverride + // ################################################ // Networking (VNet + Private DNS) — deployed first when isPrivate=true module network 'modules/network.bicep' = if (isPrivate) { name: 'networkDeployment.${shortHash}' params: { - vnetName: toLower('${namePrefix}-vnet-${uniqueString(resourceGroupId)}') + vnetName: resolvedVnetName vnetAddressPrefix: vnetAddressPrefix location: location tags: tags @@ -89,7 +127,7 @@ module privateDns 'modules/private-dns.bicep' = if (isPrivate) { module userAssignedIdentity 'modules/user-assigned-identity.bicep' = { name: 'userAssignedIdentityDeployment.${shortHash}' params: { - userAssignedIdentityName: toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') + userAssignedIdentityName: resolvedUamiName location: location tags: tags } @@ -101,7 +139,7 @@ module userAssignedIdentity 'modules/user-assigned-identity.bicep' = { module logAnalytics 'modules/log-analytics-ws.bicep' = { name: 'logAnalyticsDeployment.${shortHash}' params: { - logAnalyticsWorkspaceName: toLower('${namePrefix}-law-${uniqueString(resourceGroupId)}') + logAnalyticsWorkspaceName: resolvedLawName roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] location: location tags: tags @@ -112,7 +150,7 @@ module logAnalytics 'modules/log-analytics-ws.bicep' = { module appInsights 'modules/app-insights.bicep' = { name: 'appInsightsDeployment.${shortHash}' params: { - appInsightsName: toLower('${namePrefix}-appi-${uniqueString(resourceGroupId)}') + appInsightsName: resolvedAppiName location: location logAnalyticsResourceId: logAnalytics.outputs.resourceId tags: tags @@ -124,7 +162,7 @@ module appInsights 'modules/app-insights.bicep' = { module ampls 'modules/ampls.bicep' = if (isPrivate) { name: 'amplsDeployment.${shortHash}' params: { - name: toLower('${namePrefix}-ampls-${uniqueString(resourceGroupId)}') + name: resolvedAmplsName logAnalyticsResourceId: logAnalytics.outputs.resourceId appInsightsResourceId: appInsights.outputs.resourceId privateEndpointSubnetId: network.outputs.peSubnetId @@ -146,7 +184,7 @@ module ampls 'modules/ampls.bicep' = if (isPrivate) { module storage 'modules/storage.bicep' = { name: 'storageAccountDeployment.${shortHash}' params: { - storageAccountName: length('${namePrefix}sta${uniqueString(resourceGroupId)}') > 24 ? substring(toLower('${namePrefix}sta${uniqueString(resourceGroupId)}'), 0, 24) : toLower('${namePrefix}sta${uniqueString(resourceGroupId)}') + storageAccountName: resolvedStorageName location: location docsContainerName: docsContainerName roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] @@ -164,7 +202,7 @@ module cosmosDb 'modules/cosmos-db.bicep' = { name: 'cosmosDbDeployment.${shortHash}' params: { location: location - cosmosAccountName: toLower('${namePrefix}-cosmosdb-${uniqueString(resourceGroup().id)}') + cosmosAccountName: resolvedCosmosName cosmosDbName: cosmosDbName cosmosDBContainerNames: cosmosDBContainerNames cosmosDBDataContributorPrincipalIds: [userAssignedIdentity.outputs.principalId, deployer().objectId] @@ -182,7 +220,7 @@ module cosmosDb 'modules/cosmos-db.bicep' = { module containerRegistry 'modules/container-registry.bicep' = { name: 'containerRegistryDeployment.${shortHash}' params: { - containerRegistryName: toLower('${namePrefix}acr${uniqueString(resourceGroupId)}') + containerRegistryName: resolvedAcrName location: location roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] tags: tags @@ -201,7 +239,7 @@ module containerRegistry 'modules/container-registry.bicep' = { module appServicePlan 'modules/app-service-plan.bicep' = { name: 'appServicePlanDeployment.${shortHash}' params: { - name: toLower('${namePrefix}-asp-${uniqueString(resourceGroupId)}') + name: resolvedAspName location: location tags: tags } @@ -217,7 +255,7 @@ module appServicePlan 'modules/app-service-plan.bicep' = { module aiFoundry 'modules/ai-foundry.bicep' = { name: 'aiFoundryDeployment.${shortHash}' params: { - aiFoundryBaseName: substring(toLower(uniqueString('ai-${namePrefix}-${environment}-${resourceGroup().id}')), 0, 12) + aiFoundryBaseName: resolvedAiFoundryBaseName roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] location: aiFoundryLocation tags: tags @@ -228,48 +266,6 @@ module aiFoundry 'modules/ai-foundry.bicep' = { } } -// ################################################ -// Operator access plane — Bastion + Jumpbox - -module bastion 'modules/bastion.bicep' = if (isPrivate && deployJumpbox) { - name: 'bastionDeployment.${shortHash}' - params: { - name: toLower('${namePrefix}-bastion-${uniqueString(resourceGroupId)}') - location: location - subnetId: network.outputs.bastionSubnetId - sku: bastionSku - tags: tags - } -} - -module jumpbox 'modules/jumpbox.bicep' = if (isPrivate && deployJumpbox) { - name: 'jumpboxDeployment.${shortHash}' - params: { - name: toLower('${namePrefix}-jump-${uniqueString(resourceGroupId)}') - location: location - subnetId: network.outputs.jumpboxSubnetId - adminUsername: jumpboxAdminUsername - adminPassword: jumpboxAdminPassword - userAssignedIdentityId: userAssignedIdentity.outputs.resourceId - tags: tags - } -} - -var uaiName = toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') - -// Grant the jumpbox identity the roles needed to run scripts end-to-end. -// UAMI already has AcrPull/AcrPush/AcrDelete + Storage + Cosmos data roles; -// add Contributor scoped to the resource group so it can deploy container apps. -resource jumpboxRgContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (isPrivate && deployJumpbox) { - name: guid(resourceGroup().id, uaiName, 'b24988ac-6180-42a0-ab88-20f7382dd24c') - scope: resourceGroup() - properties: { - principalId: userAssignedIdentity.outputs.principalId - principalType: 'ServicePrincipal' - roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c') // Contributor - } -} - // ################################################ // Outputs @@ -292,5 +288,3 @@ output aiProjectName string = aiFoundry.outputs.aiProjectName output aiServicesName string = aiFoundry.outputs.aiServicesName output isPrivate bool = isPrivate output vnetId string = isPrivate ? network.outputs.vnetId : '' -output jumpboxName string = (isPrivate && deployJumpbox) ? jumpbox.outputs.vmName : '' -output bastionName string = (isPrivate && deployJumpbox) ? bastion.outputs.bastionName : '' diff --git a/infra/bicep/main.investcorp.example.bicepparam b/infra/bicep/main.investcorp.example.bicepparam new file mode 100644 index 0000000..1ae84d2 --- /dev/null +++ b/infra/bicep/main.investcorp.example.bicepparam @@ -0,0 +1,37 @@ +// Sample parameters file demonstrating InvestCorp custom naming convention. +// Replace the example names with whatever InvestCorp's standard prescribes +// (e.g. -----). Anything you leave +// empty falls back to the default `--` pattern. +// +// Usage: +// az deployment group create -g \ +// --template-file infra/bicep/main.bicep \ +// --parameters infra/bicep/main.investcorp.example.bicepparam +// +// All names must satisfy Azure naming rules for the target resource type: +// Storage account 3-24 lowercase alphanumerics +// ACR 5-50 alphanumerics +// Cosmos DB account 3-44 lowercase alphanumerics + hyphens +// Key Vault / web 3-24 alphanumerics + hyphens (not enforced here) +// AI Foundry base <= 12 lowercase alphanumerics (used as suffix base) + +using './main.bicep' + +// ---- Required core params ---- +param isPrivate = true +param vnetAddressPrefix = '10.123.45.0/26' // supplied by InvestCorp network team +param environment = 'prod' +param namePrefix = 'invscrp' // used only for any name you DON'T override + +// ---- Optional explicit names (InvestCorp CAF) ---- +// Pattern example: ----- +param vnetNameOverride = 'invs-aiinv-prod-bhc-vnet-001' +param userAssignedIdentityNameOverride = 'invs-aiinv-prod-bhc-uami-001' +param logAnalyticsWorkspaceNameOverride = 'invs-aiinv-prod-bhc-law-001' +param appInsightsNameOverride = 'invs-aiinv-prod-bhc-appi-001' +param amplsNameOverride = 'invs-aiinv-prod-bhc-ampls-001' +param storageAccountNameOverride = 'invsaiinvprodbhcst001' // 3-24 alphanumeric only +param cosmosAccountNameOverride = 'invs-aiinv-prod-bhc-cosmos-001' +param containerRegistryNameOverride = 'invsaiinvprodbhcacr001' // alphanumeric only +param appServicePlanNameOverride = 'invs-aiinv-prod-bhc-asp-001' +param aiFoundryBaseNameOverride = 'invscaip01' // <= 12 lowercase chars diff --git a/infra/bicep/main.json b/infra/bicep/main.json index 99de425..d630565 100644 --- a/infra/bicep/main.json +++ b/infra/bicep/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "14153731485685723076" + "templateHash": "2508985449853863683" } }, "parameters": { @@ -35,46 +35,13 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources." - } - }, - "deployJumpbox": { - "type": "bool", - "defaultValue": true, - "metadata": { - "description": "When true (and isPrivate=true), also deploys a Windows jumpbox + Azure Bastion for operator access." + "description": "When true, deploys the zero-trust topology: VNet + private endpoints + private App Service + disabled public network access on all PaaS resources." } }, "vnetAddressPrefix": { "type": "string", - "defaultValue": "10.50.0.0/16", - "metadata": { - "description": "VNet address space used when isPrivate=true" - } - }, - "jumpboxAdminUsername": { - "type": "string", - "defaultValue": "azureuser", - "metadata": { - "description": "Admin username for the jumpbox VM" - } - }, - "jumpboxAdminPassword": { - "type": "securestring", - "defaultValue": "", - "metadata": { - "description": "Admin password for the Windows jumpbox VM (required when deployJumpbox=true). Must satisfy Azure Windows VM password complexity rules: 12-123 chars; 3 of: lowercase, uppercase, digit, special." - } - }, - "bastionSku": { - "type": "string", - "defaultValue": "Standard", - "allowedValues": [ - "Basic", - "Standard" - ], "metadata": { - "description": "Azure Bastion SKU. Standard required for native-client tunneling." + "description": "Address space for the workload VNet. Customer supplies a /26 (e.g. 10.123.45.0/26). Required for both private and public deployments (a placeholder is acceptable when isPrivate=false)." } }, "cosmosDbName": { @@ -126,6 +93,76 @@ "metadata": { "description": "Location for AI Foundry resources" } + }, + "vnetNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the workload VNet. Default: -vnet-" + } + }, + "userAssignedIdentityNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the User-Assigned Managed Identity. Default: -uai-" + } + }, + "logAnalyticsWorkspaceNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the Log Analytics workspace. Default: -law-" + } + }, + "appInsightsNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the Application Insights component. Default: -appi-" + } + }, + "amplsNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the Azure Monitor Private Link Scope. Default: -ampls-" + } + }, + "storageAccountNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the Storage account (must be 3-24 lowercase alphanumerics). Default: sta trimmed to 24 chars" + } + }, + "cosmosAccountNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the Cosmos DB account. Default: -cosmosdb-" + } + }, + "containerRegistryNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the Azure Container Registry (must be 5-50 alphanumerics). Default: acr" + } + }, + "appServicePlanNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit name for the App Service Plan. Default: -asp-" + } + }, + "aiFoundryBaseNameOverride": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Explicit base name (max 12 chars, lowercase) used to derive AI Foundry resource names. Default: derived from --" + } } }, "variables": { @@ -135,23 +172,19 @@ "Project": "ai-investment-analysis-sample" }, "shortHash": "[substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)]", - "uaiName": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "defaultStorageName": "[toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]", + "resolvedVnetName": "[if(empty(parameters('vnetNameOverride')), toLower(format('{0}-vnet-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('vnetNameOverride'))]", + "resolvedUamiName": "[if(empty(parameters('userAssignedIdentityNameOverride')), toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('userAssignedIdentityNameOverride'))]", + "resolvedLawName": "[if(empty(parameters('logAnalyticsWorkspaceNameOverride')), toLower(format('{0}-law-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('logAnalyticsWorkspaceNameOverride'))]", + "resolvedAppiName": "[if(empty(parameters('appInsightsNameOverride')), toLower(format('{0}-appi-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('appInsightsNameOverride'))]", + "resolvedAmplsName": "[if(empty(parameters('amplsNameOverride')), toLower(format('{0}-ampls-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('amplsNameOverride'))]", + "resolvedStorageName": "[if(empty(parameters('storageAccountNameOverride')), if(greater(length(variables('defaultStorageName')), 24), substring(variables('defaultStorageName'), 0, 24), variables('defaultStorageName')), parameters('storageAccountNameOverride'))]", + "resolvedCosmosName": "[if(empty(parameters('cosmosAccountNameOverride')), toLower(format('{0}-cosmosdb-{1}', parameters('namePrefix'), uniqueString(resourceGroup().id))), parameters('cosmosAccountNameOverride'))]", + "resolvedAcrName": "[if(empty(parameters('containerRegistryNameOverride')), toLower(format('{0}acr{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('containerRegistryNameOverride'))]", + "resolvedAspName": "[if(empty(parameters('appServicePlanNameOverride')), toLower(format('{0}-asp-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), parameters('appServicePlanNameOverride'))]", + "resolvedAiFoundryBaseName": "[if(empty(parameters('aiFoundryBaseNameOverride')), substring(toLower(uniqueString(format('ai-{0}-{1}-{2}', parameters('namePrefix'), parameters('environment'), resourceGroup().id))), 0, 12), parameters('aiFoundryBaseNameOverride'))]" }, "resources": { - "jumpboxRgContributor": { - "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", - "type": "Microsoft.Authorization/roleAssignments", - "apiVersion": "2022-04-01", - "name": "[guid(resourceGroup().id, variables('uaiName'), 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", - "properties": { - "principalId": "[reference('userAssignedIdentity').outputs.principalId.value]", - "principalType": "ServicePrincipal", - "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]" - }, - "dependsOn": [ - "userAssignedIdentity" - ] - }, "network": { "condition": "[parameters('isPrivate')]", "type": "Microsoft.Resources/deployments", @@ -164,7 +197,7 @@ "mode": "Incremental", "parameters": { "vnetName": { - "value": "[toLower(format('{0}-vnet-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedVnetName')]" }, "vnetAddressPrefix": { "value": "[parameters('vnetAddressPrefix')]" @@ -183,7 +216,7 @@ "_generator": { "name": "bicep", "version": "0.42.1.51946", - "templateHash": "11703013425078531364" + "templateHash": "15751875796585908564" } }, "parameters": { @@ -202,9 +235,8 @@ }, "vnetAddressPrefix": { "type": "string", - "defaultValue": "10.50.0.0/16", "metadata": { - "description": "Address space for the virtual network" + "description": "Address space for the virtual network. MUST be a /26 supplied by the customer (e.g. 10.123.45.0/26)." } }, "tags": { @@ -215,6 +247,10 @@ } } }, + "variables": { + "servicesSubnetPrefix": "[cidrSubnet(parameters('vnetAddressPrefix'), 27, 0)]", + "peSubnetPrefix": "[cidrSubnet(parameters('vnetAddressPrefix'), 27, 1)]" + }, "resources": [ { "type": "Microsoft.Network/networkSecurityGroups", @@ -243,188 +279,7 @@ { "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-jumpbox', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [ - { - "name": "AllowBastionInbound", - "properties": { - "priority": 100, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "VirtualNetwork", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "22", - "3389" - ] - } - } - ] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-bastion', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [ - { - "name": "AllowHttpsInbound", - "properties": { - "priority": 120, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "Internet", - "sourcePortRange": "*", - "destinationAddressPrefix": "*", - "destinationPortRange": "443" - } - }, - { - "name": "AllowGatewayManagerInbound", - "properties": { - "priority": 130, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "GatewayManager", - "sourcePortRange": "*", - "destinationAddressPrefix": "*", - "destinationPortRange": "443" - } - }, - { - "name": "AllowAzureLoadBalancerInbound", - "properties": { - "priority": 140, - "direction": "Inbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "AzureLoadBalancer", - "sourcePortRange": "*", - "destinationAddressPrefix": "*", - "destinationPortRange": "443" - } - }, - { - "name": "AllowBastionHostCommunication", - "properties": { - "priority": 150, - "direction": "Inbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "VirtualNetwork", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "8080", - "5701" - ] - } - }, - { - "name": "AllowSshRdpOutbound", - "properties": { - "priority": 100, - "direction": "Outbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "*", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "22", - "3389" - ] - } - }, - { - "name": "AllowAzureCloudOutbound", - "properties": { - "priority": 110, - "direction": "Outbound", - "access": "Allow", - "protocol": "Tcp", - "sourceAddressPrefix": "*", - "sourcePortRange": "*", - "destinationAddressPrefix": "AzureCloud", - "destinationPortRange": "443" - } - }, - { - "name": "AllowBastionCommunication", - "properties": { - "priority": 120, - "direction": "Outbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "VirtualNetwork", - "sourcePortRange": "*", - "destinationAddressPrefix": "VirtualNetwork", - "destinationPortRanges": [ - "8080", - "5701" - ] - } - }, - { - "name": "AllowGetSessionInformation", - "properties": { - "priority": 130, - "direction": "Outbound", - "access": "Allow", - "protocol": "*", - "sourceAddressPrefix": "*", - "sourcePortRange": "*", - "destinationAddressPrefix": "Internet", - "destinationPortRange": "80" - } - } - ] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-aca', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-build', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-mgmt', parameters('vnetName'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "securityRules": [] - } - }, - { - "type": "Microsoft.Network/networkSecurityGroups", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nsg-appsvc', parameters('vnetName'))]", + "name": "[format('{0}-nsg-services', parameters('vnetName'))]", "location": "[parameters('location')]", "tags": "[parameters('tags')]", "properties": { @@ -445,102 +300,42 @@ }, "subnets": [ { - "name": "snet-aca-infra", + "name": "snet-services", "properties": { - "addressPrefix": "10.50.0.0/23", + "addressPrefix": "[variables('servicesSubnetPrefix')]", "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]" + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-services', parameters('vnetName')))]" }, "delegations": [ { - "name": "aca-delegation", + "name": "appsvc-delegation", "properties": { - "serviceName": "Microsoft.App/environments" + "serviceName": "Microsoft.Web/serverFarms" } } ], - "privateEndpointNetworkPolicies": "Disabled" + "serviceEndpoints": [ + { + "service": "Microsoft.CognitiveServices" + } + ] } }, { "name": "snet-pe", "properties": { - "addressPrefix": "10.50.2.0/26", + "addressPrefix": "[variables('peSubnetPrefix')]", "networkSecurityGroup": { "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" }, "privateEndpointNetworkPolicies": "Disabled" } - }, - { - "name": "snet-jumpbox", - "properties": { - "addressPrefix": "10.50.2.64/27", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]" - } - } - }, - { - "name": "AzureBastionSubnet", - "properties": { - "addressPrefix": "10.50.2.128/26", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]" - } - } - }, - { - "name": "snet-build", - "properties": { - "addressPrefix": "10.50.2.192/27", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]" - }, - "privateEndpointNetworkPolicies": "Disabled" - } - }, - { - "name": "snet-mgmt", - "properties": { - "addressPrefix": "10.50.2.224/27", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]" - } - } - }, - { - "name": "snet-appsvc", - "properties": { - "addressPrefix": "10.50.4.0/26", - "networkSecurityGroup": { - "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]" - }, - "delegations": [ - { - "name": "appsvc-delegation", - "properties": { - "serviceName": "Microsoft.Web/serverFarms" - } - } - ], - "serviceEndpoints": [ - { - "service": "Microsoft.CognitiveServices" - } - ] - } } ] }, "dependsOn": [ - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]", - "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-services', parameters('vnetName')))]" ] } ], @@ -553,33 +348,13 @@ "type": "string", "value": "[parameters('vnetName')]" }, - "acaInfraSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-aca-infra', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, "peSubnetId": { "type": "string", "value": "[format('{0}/subnets/snet-pe', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" }, - "jumpboxSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-jumpbox', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, - "bastionSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/AzureBastionSubnet', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, - "buildSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-build', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, - "mgmtSubnetId": { - "type": "string", - "value": "[format('{0}/subnets/snet-mgmt', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" - }, "appSvcSubnetId": { "type": "string", - "value": "[format('{0}/subnets/snet-appsvc', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + "value": "[format('{0}/subnets/snet-services', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" } } } @@ -756,7 +531,7 @@ "mode": "Incremental", "parameters": { "userAssignedIdentityName": { - "value": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedUamiName')]" }, "location": { "value": "[parameters('location')]" @@ -1311,7 +1086,7 @@ "mode": "Incremental", "parameters": { "logAnalyticsWorkspaceName": { - "value": "[toLower(format('{0}-law-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedLawName')]" }, "roleAssignedManagedIdentityPrincipalIds": { "value": [ @@ -4519,7 +4294,7 @@ "mode": "Incremental", "parameters": { "appInsightsName": { - "value": "[toLower(format('{0}-appi-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedAppiName')]" }, "location": { "value": "[parameters('location')]" @@ -5336,7 +5111,7 @@ "mode": "Incremental", "parameters": { "name": { - "value": "[toLower(format('{0}-ampls-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedAmplsName')]" }, "logAnalyticsResourceId": { "value": "[reference('logAnalytics').outputs.resourceId.value]" @@ -5658,7 +5433,9 @@ }, "mode": "Incremental", "parameters": { - "storageAccountName": "[if(greater(length(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), 24), createObject('value', substring(toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), 0, 24)), createObject('value', toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))))]", + "storageAccountName": { + "value": "[variables('resolvedStorageName')]" + }, "location": { "value": "[parameters('location')]" }, @@ -12589,7 +12366,7 @@ "value": "[parameters('location')]" }, "cosmosAccountName": { - "value": "[toLower(format('{0}-cosmosdb-{1}', parameters('namePrefix'), uniqueString(resourceGroup().id)))]" + "value": "[variables('resolvedCosmosName')]" }, "cosmosDbName": { "value": "[parameters('cosmosDbName')]" @@ -16849,7 +16626,7 @@ "mode": "Incremental", "parameters": { "containerRegistryName": { - "value": "[toLower(format('{0}acr{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedAcrName')]" }, "location": { "value": "[parameters('location')]" @@ -20393,7 +20170,7 @@ "mode": "Incremental", "parameters": { "name": { - "value": "[toLower(format('{0}-asp-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + "value": "[variables('resolvedAspName')]" }, "location": { "value": "[parameters('location')]" @@ -20498,7 +20275,7 @@ "mode": "Incremental", "parameters": { "aiFoundryBaseName": { - "value": "[substring(toLower(uniqueString(format('ai-{0}-{1}-{2}', parameters('namePrefix'), parameters('environment'), resourceGroup().id))), 0, 12)]" + "value": "[variables('resolvedAiFoundryBaseName')]" }, "roleAssignedManagedIdentityPrincipalIds": { "value": [ @@ -42995,360 +42772,6 @@ "privateDns", "userAssignedIdentity" ] - }, - "bastion": { - "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "[format('bastionDeployment.{0}', variables('shortHash'))]", - "properties": { - "expressionEvaluationOptions": { - "scope": "inner" - }, - "mode": "Incremental", - "parameters": { - "name": { - "value": "[toLower(format('{0}-bastion-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" - }, - "location": { - "value": "[parameters('location')]" - }, - "subnetId": { - "value": "[reference('network').outputs.bastionSubnetId.value]" - }, - "sku": { - "value": "[parameters('bastionSku')]" - }, - "tags": { - "value": "[variables('tags')]" - } - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "_generator": { - "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "9423121226804345673" - } - }, - "parameters": { - "location": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Location for the bastion host" - } - }, - "name": { - "type": "string", - "metadata": { - "description": "Bastion host name" - } - }, - "subnetId": { - "type": "string", - "metadata": { - "description": "AzureBastionSubnet resource id" - } - }, - "sku": { - "type": "string", - "defaultValue": "Standard", - "allowedValues": [ - "Basic", - "Standard" - ], - "metadata": { - "description": "SKU: Basic or Standard. Standard required for native-client / SSH tunneling." - } - }, - "tags": { - "type": "object", - "defaultValue": {}, - "metadata": { - "description": "Tags for resources" - } - } - }, - "resources": [ - { - "type": "Microsoft.Network/publicIPAddresses", - "apiVersion": "2023-11-01", - "name": "[format('{0}-pip', parameters('name'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "sku": { - "name": "Standard" - }, - "properties": { - "publicIPAllocationMethod": "Static", - "publicIPAddressVersion": "IPv4" - } - }, - { - "type": "Microsoft.Network/bastionHosts", - "apiVersion": "2023-11-01", - "name": "[parameters('name')]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "sku": { - "name": "[parameters('sku')]" - }, - "properties": { - "enableTunneling": "[if(equals(parameters('sku'), 'Standard'), true(), false())]", - "enableShareableLink": false, - "ipConfigurations": [ - { - "name": "ipConfig", - "properties": { - "subnet": { - "id": "[parameters('subnetId')]" - }, - "publicIPAddress": { - "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" - } - } - } - ] - }, - "dependsOn": [ - "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" - ] - } - ], - "outputs": { - "bastionId": { - "type": "string", - "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]" - }, - "bastionName": { - "type": "string", - "value": "[parameters('name')]" - }, - "publicIpAddress": { - "type": "string", - "value": "[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name'))), '2023-11-01').ipAddress]" - } - } - } - }, - "dependsOn": [ - "network" - ] - }, - "jumpbox": { - "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", - "type": "Microsoft.Resources/deployments", - "apiVersion": "2025-04-01", - "name": "[format('jumpboxDeployment.{0}', variables('shortHash'))]", - "properties": { - "expressionEvaluationOptions": { - "scope": "inner" - }, - "mode": "Incremental", - "parameters": { - "name": { - "value": "[toLower(format('{0}-jump-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" - }, - "location": { - "value": "[parameters('location')]" - }, - "subnetId": { - "value": "[reference('network').outputs.jumpboxSubnetId.value]" - }, - "adminUsername": { - "value": "[parameters('jumpboxAdminUsername')]" - }, - "adminPassword": { - "value": "[parameters('jumpboxAdminPassword')]" - }, - "userAssignedIdentityId": { - "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" - }, - "tags": { - "value": "[variables('tags')]" - } - }, - "template": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "_generator": { - "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "5149576106587506965" - } - }, - "parameters": { - "location": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Location for the VM" - } - }, - "name": { - "type": "string", - "metadata": { - "description": "VM name" - } - }, - "subnetId": { - "type": "string", - "metadata": { - "description": "Subnet id for the VM NIC" - } - }, - "vmSize": { - "type": "string", - "defaultValue": "Standard_D2s_v5", - "metadata": { - "description": "VM size. Default sized for az cli + dev tooling." - } - }, - "adminUsername": { - "type": "string", - "defaultValue": "azureuser", - "metadata": { - "description": "Admin username for RDP (accessed via Bastion)" - } - }, - "adminPassword": { - "type": "securestring", - "metadata": { - "description": "Admin password used to log in (via Bastion RDP). Must satisfy Azure Windows VM password complexity rules." - } - }, - "userAssignedIdentityId": { - "type": "string", - "metadata": { - "description": "User-assigned managed identity resource id to attach to the VM" - } - }, - "tags": { - "type": "object", - "defaultValue": {}, - "metadata": { - "description": "Tags for resources" - } - } - }, - "variables": { - "bootstrapScript": "$ErrorActionPreference = \"Continue\"\n$ProgressPreference = \"SilentlyContinue\"\nStart-Transcript -Path \"C:\\\\Windows\\\\Temp\\\\jumpbox-bootstrap.log\" -Append\n\n# Trust PSGallery + ensure TLS 1.2\n[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n\n# 1) Install Chocolatey (used to install az cli, git, bicep)\nif (-not (Get-Command choco.exe -ErrorAction SilentlyContinue)) {\n Set-ExecutionPolicy Bypass -Scope Process -Force\n iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))\n}\n\n$env:Path = \"$env:Path;C:\\\\ProgramData\\\\chocolatey\\\\bin\"\n\n# 2) Operator tools\nchoco install -y --no-progress azure-cli\nchoco install -y --no-progress git\nchoco install -y --no-progress bicep\nchoco install -y --no-progress microsoft-edge\n\n# 3) Docker EE on Windows Server (best-effort; safe to fail — `az acr build`\n# is the recommended path for image builds from the jumpbox).\ntry {\n Install-WindowsFeature -Name Containers -IncludeManagementTools -ErrorAction SilentlyContinue\n Install-Module -Name DockerMsftProvider -Repository PSGallery -Force -ErrorAction SilentlyContinue\n Install-Package -Name docker -ProviderName DockerMsftProvider -Force -ErrorAction SilentlyContinue\n} catch {\n Write-Host \"Docker install skipped: $_\"\n}\n\n# 4) Clone the sample repo to the operator desktop for convenience\n$repoDir = \"C:\\\\Users\\\\Public\\\\Desktop\\\\Agentic-AI-Investment-Analysis-Sample\"\nif (-not (Test-Path $repoDir)) {\n & \"C:\\\\Program Files\\\\Git\\\\bin\\\\git.exe\" clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git $repoDir 2>&1 | Out-Null\n}\n\nStop-Transcript\n" - }, - "resources": [ - { - "type": "Microsoft.Network/networkInterfaces", - "apiVersion": "2023-11-01", - "name": "[format('{0}-nic', parameters('name'))]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "properties": { - "ipConfigurations": [ - { - "name": "ipconfig", - "properties": { - "subnet": { - "id": "[parameters('subnetId')]" - }, - "privateIPAllocationMethod": "Dynamic" - } - } - ] - } - }, - { - "type": "Microsoft.Compute/virtualMachines", - "apiVersion": "2024-03-01", - "name": "[parameters('name')]", - "location": "[parameters('location')]", - "tags": "[parameters('tags')]", - "identity": { - "type": "UserAssigned", - "userAssignedIdentities": { - "[format('{0}', parameters('userAssignedIdentityId'))]": {} - } - }, - "properties": { - "hardwareProfile": { - "vmSize": "[parameters('vmSize')]" - }, - "storageProfile": { - "imageReference": { - "publisher": "MicrosoftWindowsServer", - "offer": "WindowsServer", - "sku": "2022-datacenter-azure-edition", - "version": "latest" - }, - "osDisk": { - "createOption": "FromImage", - "managedDisk": { - "storageAccountType": "StandardSSD_LRS" - } - } - }, - "osProfile": { - "computerName": "[take(replace(parameters('name'), '-', ''), 15)]", - "adminUsername": "[parameters('adminUsername')]", - "adminPassword": "[parameters('adminPassword')]", - "windowsConfiguration": { - "enableAutomaticUpdates": true, - "provisionVMAgent": true - } - }, - "networkProfile": { - "networkInterfaces": [ - { - "id": "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" - } - ] - } - }, - "dependsOn": [ - "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" - ] - }, - { - "type": "Microsoft.Compute/virtualMachines/extensions", - "apiVersion": "2024-03-01", - "name": "[format('{0}/{1}', parameters('name'), 'bootstrap')]", - "location": "[parameters('location')]", - "properties": { - "publisher": "Microsoft.Compute", - "type": "CustomScriptExtension", - "typeHandlerVersion": "1.10", - "autoUpgradeMinorVersion": true, - "settings": { - "script": "[base64(variables('bootstrapScript'))]" - } - }, - "dependsOn": [ - "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]" - ] - } - ], - "outputs": { - "vmId": { - "type": "string", - "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]" - }, - "vmName": { - "type": "string", - "value": "[parameters('name')]" - }, - "nicPrivateIp": { - "type": "string", - "value": "[reference(resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name'))), '2023-11-01').ipConfigurations[0].properties.privateIPAddress]" - } - } - } - }, - "dependsOn": [ - "network", - "userAssignedIdentity" - ] } }, "outputs": { @@ -43427,14 +42850,6 @@ "vnetId": { "type": "string", "value": "[if(parameters('isPrivate'), reference('network').outputs.vnetId.value, '')]" - }, - "jumpboxName": { - "type": "string", - "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('jumpbox').outputs.vmName.value, '')]" - }, - "bastionName": { - "type": "string", - "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('bastion').outputs.bastionName.value, '')]" } } } \ No newline at end of file diff --git a/infra/bicep/modules/bastion.bicep b/infra/bicep/modules/bastion.bicep deleted file mode 100644 index b178e36..0000000 --- a/infra/bicep/modules/bastion.bicep +++ /dev/null @@ -1,53 +0,0 @@ -// Azure Bastion (Standard SKU) — the only public-facing TLS endpoint in the -// design. Users open a browser session to the bastion and SSH to the jumpbox. - -@description('Location for the bastion host') -param location string = resourceGroup().location - -@description('Bastion host name') -param name string - -@description('AzureBastionSubnet resource id') -param subnetId string - -@description('SKU: Basic or Standard. Standard required for native-client / SSH tunneling.') -@allowed([ 'Basic', 'Standard' ]) -param sku string = 'Standard' - -@description('Tags for resources') -param tags object = {} - -resource pip 'Microsoft.Network/publicIPAddresses@2023-11-01' = { - name: '${name}-pip' - location: location - tags: tags - sku: { name: 'Standard' } - properties: { - publicIPAllocationMethod: 'Static' - publicIPAddressVersion: 'IPv4' - } -} - -resource bastion 'Microsoft.Network/bastionHosts@2023-11-01' = { - name: name - location: location - tags: tags - sku: { name: sku } - properties: { - enableTunneling: sku == 'Standard' ? true : false - enableShareableLink: false - ipConfigurations: [ - { - name: 'ipConfig' - properties: { - subnet: { id: subnetId } - publicIPAddress: { id: pip.id } - } - } - ] - } -} - -output bastionId string = bastion.id -output bastionName string = bastion.name -output publicIpAddress string = pip.properties.ipAddress diff --git a/infra/bicep/modules/jumpbox-linux.bicep b/infra/bicep/modules/jumpbox-linux.bicep deleted file mode 100644 index 610dab8..0000000 --- a/infra/bicep/modules/jumpbox-linux.bicep +++ /dev/null @@ -1,120 +0,0 @@ -// Linux jumpbox VM for operator access over Azure Bastion. -// - No public IP. -// - UAMI attached with AcrPush/AcrPull and Contributor (scoped RG) so scripts -// 1-3 can run end-to-end from inside the VNet. -// - cloud-init installs Azure CLI, Docker, Bicep. - -@description('Location for the VM') -param location string = resourceGroup().location - -@description('VM name') -param name string - -@description('Subnet id for the VM NIC') -param subnetId string - -@description('VM size. B-series default — cheap, enough for az cli + docker.') -param vmSize string = 'Standard_B2s' - -@description('Admin username for SSH (accessed via Bastion)') -param adminUsername string = 'azureuser' - -@description('SSH public key used to log in (via Bastion)') -@secure() -param adminPublicKey string - -@description('User-assigned managed identity resource id to attach to the VM') -param userAssignedIdentityId string - -@description('Tags for resources') -param tags object = {} - -var cloudInit = ''' -#cloud-config -package_update: true -package_upgrade: false -packages: - - ca-certificates - - curl - - gnupg - - lsb-release - - jq - - git -runcmd: - - curl -sL https://aka.ms/InstallAzureCLIDeb | bash - - az bicep install || true - - install -m 0755 -d /etc/apt/keyrings - - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg - - chmod a+r /etc/apt/keyrings/docker.gpg - - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list - - apt-get update - - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin - - usermod -aG docker azureuser -''' - -resource nic 'Microsoft.Network/networkInterfaces@2023-11-01' = { - name: '${name}-nic' - location: location - tags: tags - properties: { - ipConfigurations: [ - { - name: 'ipconfig' - properties: { - subnet: { id: subnetId } - privateIPAllocationMethod: 'Dynamic' - } - } - ] - } -} - -resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { - name: name - location: location - tags: tags - identity: { - type: 'UserAssigned' - userAssignedIdentities: { - '${userAssignedIdentityId}': {} - } - } - properties: { - hardwareProfile: { vmSize: vmSize } - storageProfile: { - imageReference: { - publisher: 'Canonical' - offer: 'ubuntu-24_04-lts' - sku: 'server' - version: 'latest' - } - osDisk: { - createOption: 'FromImage' - managedDisk: { storageAccountType: 'StandardSSD_LRS' } - } - } - osProfile: { - computerName: name - adminUsername: adminUsername - customData: base64(cloudInit) - linuxConfiguration: { - disablePasswordAuthentication: true - ssh: { - publicKeys: [ - { - path: '/home/${adminUsername}/.ssh/authorized_keys' - keyData: adminPublicKey - } - ] - } - } - } - networkProfile: { - networkInterfaces: [ { id: nic.id } ] - } - } -} - -output vmId string = vm.id -output vmName string = vm.name -output nicPrivateIp string = nic.properties.ipConfigurations[0].properties.privateIPAddress diff --git a/infra/bicep/modules/jumpbox.bicep b/infra/bicep/modules/jumpbox.bicep deleted file mode 100644 index e14b37e..0000000 --- a/infra/bicep/modules/jumpbox.bicep +++ /dev/null @@ -1,155 +0,0 @@ -// Windows jumpbox VM for operator access over Azure Bastion (RDP). -// - No public IP. -// - UAMI attached with AcrPush/AcrPull and Contributor (scoped RG) so scripts -// 1-3 can run end-to-end from inside the VNet. -// - PowerShell post-deploy script installs: Azure CLI, Git, Bicep, and Docker -// (Docker EE on Windows Server) so the operator can run scripts 2 and 3 -// directly from the jumpbox. Image build and push from the jumpbox uses -// `az acr build` by default (no local Docker required) — Docker is installed -// only as a convenience for ad-hoc work. - -@description('Location for the VM') -param location string = resourceGroup().location - -@description('VM name') -param name string - -@description('Subnet id for the VM NIC') -param subnetId string - -@description('VM size. Default sized for az cli + dev tooling.') -param vmSize string = 'Standard_D2s_v5' - -@description('Admin username for RDP (accessed via Bastion)') -param adminUsername string = 'azureuser' - -@description('Admin password used to log in (via Bastion RDP). Must satisfy Azure Windows VM password complexity rules.') -@secure() -param adminPassword string - -@description('User-assigned managed identity resource id to attach to the VM') -param userAssignedIdentityId string - -@description('Tags for resources') -param tags object = {} - -// PowerShell that installs operator tooling on first boot. -// Runs as SYSTEM via the CustomScriptExtension, so it installs machine-wide. -var bootstrapScript = ''' -$ErrorActionPreference = "Continue" -$ProgressPreference = "SilentlyContinue" -Start-Transcript -Path "C:\\Windows\\Temp\\jumpbox-bootstrap.log" -Append - -# Trust PSGallery + ensure TLS 1.2 -[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 - -# 1) Install Chocolatey (used to install az cli, git, bicep) -if (-not (Get-Command choco.exe -ErrorAction SilentlyContinue)) { - Set-ExecutionPolicy Bypass -Scope Process -Force - iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) -} - -$env:Path = "$env:Path;C:\\ProgramData\\chocolatey\\bin" - -# 2) Operator tools -choco install -y --no-progress azure-cli -choco install -y --no-progress git -choco install -y --no-progress bicep -choco install -y --no-progress microsoft-edge - -# 3) Docker EE on Windows Server (best-effort; safe to fail — `az acr build` -# is the recommended path for image builds from the jumpbox). -try { - Install-WindowsFeature -Name Containers -IncludeManagementTools -ErrorAction SilentlyContinue - Install-Module -Name DockerMsftProvider -Repository PSGallery -Force -ErrorAction SilentlyContinue - Install-Package -Name docker -ProviderName DockerMsftProvider -Force -ErrorAction SilentlyContinue -} catch { - Write-Host "Docker install skipped: $_" -} - -# 4) Clone the sample repo to the operator desktop for convenience -$repoDir = "C:\\Users\\Public\\Desktop\\Agentic-AI-Investment-Analysis-Sample" -if (-not (Test-Path $repoDir)) { - & "C:\\Program Files\\Git\\bin\\git.exe" clone https://github.com/Azure-Samples/Agentic-AI-Investment-Analysis-Sample.git $repoDir 2>&1 | Out-Null -} - -Stop-Transcript -''' - -resource nic 'Microsoft.Network/networkInterfaces@2023-11-01' = { - name: '${name}-nic' - location: location - tags: tags - properties: { - ipConfigurations: [ - { - name: 'ipconfig' - properties: { - subnet: { id: subnetId } - privateIPAllocationMethod: 'Dynamic' - } - } - ] - } -} - -resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { - name: name - location: location - tags: tags - identity: { - type: 'UserAssigned' - userAssignedIdentities: { - '${userAssignedIdentityId}': {} - } - } - properties: { - hardwareProfile: { vmSize: vmSize } - storageProfile: { - imageReference: { - publisher: 'MicrosoftWindowsServer' - offer: 'WindowsServer' - sku: '2022-datacenter-azure-edition' - version: 'latest' - } - osDisk: { - createOption: 'FromImage' - managedDisk: { storageAccountType: 'StandardSSD_LRS' } - } - } - osProfile: { - computerName: take(replace(name, '-', ''), 15) - adminUsername: adminUsername - adminPassword: adminPassword - windowsConfiguration: { - enableAutomaticUpdates: true - provisionVMAgent: true - } - } - networkProfile: { - networkInterfaces: [ { id: nic.id } ] - } - } -} - -// Run the operator-tooling bootstrap script on first boot. -resource bootstrap 'Microsoft.Compute/virtualMachines/extensions@2024-03-01' = { - parent: vm - name: 'bootstrap' - location: location - properties: { - publisher: 'Microsoft.Compute' - type: 'CustomScriptExtension' - typeHandlerVersion: '1.10' - autoUpgradeMinorVersion: true - settings: { - // CustomScriptExtension (Windows) decodes `script` (base64 UTF-8), - // saves it to disk and runs it with PowerShell. - script: base64(bootstrapScript) - } - } -} - -output vmId string = vm.id -output vmName string = vm.name -output nicPrivateIp string = nic.properties.ipConfigurations[0].properties.privateIPAddress diff --git a/infra/bicep/modules/network.bicep b/infra/bicep/modules/network.bicep index 88b9fcd..bf7caa3 100644 --- a/infra/bicep/modules/network.bicep +++ b/infra/bicep/modules/network.bicep @@ -1,11 +1,15 @@ // Virtual network + subnets + NSGs for zero-trust deployment. -// Six subnets: -// snet-aca-infra (/23) — delegated to Microsoft.App/environments (workload-profiles ACA) -// snet-pe (/26) — shared Private Endpoints -// snet-jumpbox (/27) — jump VM NIC -// AzureBastionSubnet (/26) — required name for Azure Bastion -// snet-build (/27) — reserved for ACR Tasks / private build agents -// snet-mgmt (/27) — reserved for future self-hosted CI/CD agents +// +// The customer allocates a single /26 (64 IPs) for this workload. It is split +// into two equal /27 subnets: +// snet-services (/27) — App Service VNet integration (delegated to +// Microsoft.Web/serverFarms). All outbound calls from +// the API/Web apps egress here. +// snet-pe (/27) — Shared Private Endpoints for ACR, Storage, Cosmos, +// AI Foundry, and Azure Monitor Private Link Scope. +// +// Operator access (build/deploy) is assumed to come from the customer's peered +// network (ExpressRoute / VPN / hub VNet). There is no Bastion and no jumpbox. @description('Location for all resources') param location string = resourceGroup().location @@ -13,12 +17,18 @@ param location string = resourceGroup().location @description('Virtual network name') param vnetName string -@description('Address space for the virtual network') -param vnetAddressPrefix string = '10.50.0.0/16' +@description('Address space for the virtual network. MUST be a /26 supplied by the customer (e.g. 10.123.45.0/26).') +param vnetAddressPrefix string @description('Tags for resources') param tags object = {} +// Two equal /27 subnets derived from the supplied /26. +// offset 0 → snet-services (App Service delegation) +// offset 1 → snet-pe (private endpoints) +var servicesSubnetPrefix = cidrSubnet(vnetAddressPrefix, 27, 0) +var peSubnetPrefix = cidrSubnet(vnetAddressPrefix, 27, 1) + // ---- NSGs ------------------------------------------------------------------- resource nsgPe 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { @@ -44,102 +54,12 @@ resource nsgPe 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { } } -resource nsgJumpbox 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { - name: '${vnetName}-nsg-jumpbox' - location: location - tags: tags - properties: { - securityRules: [ - { - name: 'AllowBastionInbound' - properties: { - priority: 100 - direction: 'Inbound' - access: 'Allow' - protocol: 'Tcp' - sourceAddressPrefix: 'VirtualNetwork' - sourcePortRange: '*' - destinationAddressPrefix: 'VirtualNetwork' - destinationPortRanges: [ '22', '3389' ] - } - } - ] - } -} - -resource nsgBastion 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { - name: '${vnetName}-nsg-bastion' - location: location - tags: tags - properties: { - securityRules: [ - { - name: 'AllowHttpsInbound' - properties: { priority: 120, direction: 'Inbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: 'Internet', sourcePortRange: '*', destinationAddressPrefix: '*', destinationPortRange: '443' } - } - { - name: 'AllowGatewayManagerInbound' - properties: { priority: 130, direction: 'Inbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: 'GatewayManager', sourcePortRange: '*', destinationAddressPrefix: '*', destinationPortRange: '443' } - } - { - name: 'AllowAzureLoadBalancerInbound' - properties: { priority: 140, direction: 'Inbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: 'AzureLoadBalancer', sourcePortRange: '*', destinationAddressPrefix: '*', destinationPortRange: '443' } - } - { - name: 'AllowBastionHostCommunication' - properties: { priority: 150, direction: 'Inbound', access: 'Allow', protocol: '*', sourceAddressPrefix: 'VirtualNetwork', sourcePortRange: '*', destinationAddressPrefix: 'VirtualNetwork', destinationPortRanges: [ '8080', '5701' ] } - } - { - name: 'AllowSshRdpOutbound' - properties: { priority: 100, direction: 'Outbound', access: 'Allow', protocol: '*', sourceAddressPrefix: '*', sourcePortRange: '*', destinationAddressPrefix: 'VirtualNetwork', destinationPortRanges: [ '22', '3389' ] } - } - { - name: 'AllowAzureCloudOutbound' - properties: { priority: 110, direction: 'Outbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: '*', sourcePortRange: '*', destinationAddressPrefix: 'AzureCloud', destinationPortRange: '443' } - } - { - name: 'AllowBastionCommunication' - properties: { priority: 120, direction: 'Outbound', access: 'Allow', protocol: '*', sourceAddressPrefix: 'VirtualNetwork', sourcePortRange: '*', destinationAddressPrefix: 'VirtualNetwork', destinationPortRanges: [ '8080', '5701' ] } - } - { - name: 'AllowGetSessionInformation' - properties: { priority: 130, direction: 'Outbound', access: 'Allow', protocol: '*', sourceAddressPrefix: '*', sourcePortRange: '*', destinationAddressPrefix: 'Internet', destinationPortRange: '80' } - } - ] - } -} - -resource nsgAca 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { - name: '${vnetName}-nsg-aca' - location: location - tags: tags - properties: { - // Intentionally permissive within the VNet; ACA platform manages its own - // subnet rules. Do not block traffic — see Azure docs for ACA NSG limits. - securityRules: [] - } -} - -resource nsgBuild 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { - name: '${vnetName}-nsg-build' - location: location - tags: tags - properties: { securityRules: [] } -} - -resource nsgMgmt 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { - name: '${vnetName}-nsg-mgmt' - location: location - tags: tags - properties: { securityRules: [] } -} - -resource nsgAppSvc 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { - name: '${vnetName}-nsg-appsvc' +resource nsgServices 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-services' location: location tags: tags // Permissive within VNet; App Service regional VNet integration handles - // outbound traffic; inbound is via separate private endpoint in snet-pe. + // outbound traffic; inbound is via separate private endpoints in snet-pe. properties: { securityRules: [] } } @@ -155,82 +75,34 @@ resource vnet 'Microsoft.Network/virtualNetworks@2023-11-01' = { } subnets: [ { - name: 'snet-aca-infra' + name: 'snet-services' properties: { - addressPrefix: '10.50.0.0/23' - networkSecurityGroup: { id: nsgAca.id } + addressPrefix: servicesSubnetPrefix + networkSecurityGroup: { id: nsgServices.id } delegations: [ { - name: 'aca-delegation' - properties: { serviceName: 'Microsoft.App/environments' } + name: 'appsvc-delegation' + properties: { serviceName: 'Microsoft.Web/serverFarms' } } ] - privateEndpointNetworkPolicies: 'Disabled' + serviceEndpoints: [ + { service: 'Microsoft.CognitiveServices' } + ] } } { name: 'snet-pe' properties: { - addressPrefix: '10.50.2.0/26' + addressPrefix: peSubnetPrefix networkSecurityGroup: { id: nsgPe.id } privateEndpointNetworkPolicies: 'Disabled' } } - { - name: 'snet-jumpbox' - properties: { - addressPrefix: '10.50.2.64/27' - networkSecurityGroup: { id: nsgJumpbox.id } - } - } - { - name: 'AzureBastionSubnet' - properties: { - addressPrefix: '10.50.2.128/26' - networkSecurityGroup: { id: nsgBastion.id } - } - } - { - name: 'snet-build' - properties: { - addressPrefix: '10.50.2.192/27' - networkSecurityGroup: { id: nsgBuild.id } - privateEndpointNetworkPolicies: 'Disabled' - } - } - { - name: 'snet-mgmt' - properties: { - addressPrefix: '10.50.2.224/27' - networkSecurityGroup: { id: nsgMgmt.id } - } - } - { - name: 'snet-appsvc' - properties: { - addressPrefix: '10.50.4.0/26' - networkSecurityGroup: { id: nsgAppSvc.id } - delegations: [ - { - name: 'appsvc-delegation' - properties: { serviceName: 'Microsoft.Web/serverFarms' } - } - ] - serviceEndpoints: [ - { service: 'Microsoft.CognitiveServices' } - ] - } - } ] } } output vnetId string = vnet.id output vnetName string = vnet.name -output acaInfraSubnetId string = '${vnet.id}/subnets/snet-aca-infra' output peSubnetId string = '${vnet.id}/subnets/snet-pe' -output jumpboxSubnetId string = '${vnet.id}/subnets/snet-jumpbox' -output bastionSubnetId string = '${vnet.id}/subnets/AzureBastionSubnet' -output buildSubnetId string = '${vnet.id}/subnets/snet-build' -output mgmtSubnetId string = '${vnet.id}/subnets/snet-mgmt' -output appSvcSubnetId string = '${vnet.id}/subnets/snet-appsvc' +output appSvcSubnetId string = '${vnet.id}/subnets/snet-services' diff --git a/infra/bicep/modules/private-dns.bicep b/infra/bicep/modules/private-dns.bicep index bd0b199..09a415c 100644 --- a/infra/bicep/modules/private-dns.bicep +++ b/infra/bicep/modules/private-dns.bicep @@ -1,6 +1,6 @@ // Private DNS zones required by zero-trust architecture. // One zone per service group; each zone is linked to the workload VNet so the -// jumpbox and container apps resolve private-endpoint IPs from the VNet. +// the App Service apps and any peered operator hosts resolve private-endpoint IPs from the VNet. @description('Name of the VNet to link zones to') param vnetId string @@ -34,22 +34,26 @@ var zoneNames = [ 'privatelink.azurewebsites.net' ] -resource zones 'Microsoft.Network/privateDnsZones@2024-06-01' = [for z in zoneNames: { - name: z - location: location - tags: tags -}] +resource zones 'Microsoft.Network/privateDnsZones@2024-06-01' = [ + for z in zoneNames: { + name: z + location: location + tags: tags + } +] -resource links 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = [for (z, i) in zoneNames: { - name: '${zones[i].name}/link-${uniqueString(vnetId)}' - location: location - tags: tags - properties: { - virtualNetwork: { id: vnetId } - registrationEnabled: false +resource links 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = [ + for (z, i) in zoneNames: { + name: '${zones[i].name}/link-${uniqueString(vnetId)}' + location: location + tags: tags + properties: { + virtualNetwork: { id: vnetId } + registrationEnabled: false + } + dependsOn: [zones[i]] } - dependsOn: [ zones[i] ] -}] +] // Keyed outputs so the main template can wire each PE to its zone. output cosmosSqlZoneId string = zones[0].id diff --git a/infra/bicep/modules/web-app-container.bicep b/infra/bicep/modules/web-app-container.bicep index da69b7b..3b23997 100644 --- a/infra/bicep/modules/web-app-container.bicep +++ b/infra/bicep/modules/web-app-container.bicep @@ -1,6 +1,6 @@ // Linux Web App for Containers with: // * UAMI for ACR pull -// * Regional VNet integration (outbound) into snet-appsvc +// * Regional VNet integration (outbound) into snet-services // * Private endpoint in snet-pe (inbound) when isPrivate=true // * publicNetworkAccess=Disabled when isPrivate=true // @@ -77,22 +77,24 @@ var baseAppSettings = [ // When VNet-integrated, we want all outbound traffic (including DNS lookups // to private endpoints) to traverse the integrated VNet so private DNS zones // resolve correctly. -var vnetRouteAppSettings = empty(vnetIntegrationSubnetId) ? [] : [ - { - name: 'WEBSITE_VNET_ROUTE_ALL' - value: '1' - } - { - name: 'WEBSITE_DNS_SERVER' - value: '168.63.129.16' - } - { - // Pull container image from ACR through the integrated VNet so that - // private-endpoint-only registries (publicNetworkAccess=Disabled) work. - name: 'WEBSITE_PULL_IMAGE_OVER_VNET' - value: 'true' - } -] +var vnetRouteAppSettings = empty(vnetIntegrationSubnetId) + ? [] + : [ + { + name: 'WEBSITE_VNET_ROUTE_ALL' + value: '1' + } + { + name: 'WEBSITE_DNS_SERVER' + value: '168.63.129.16' + } + { + // Pull container image from ACR through the integrated VNet so that + // private-endpoint-only registries (publicNetworkAccess=Disabled) work. + name: 'WEBSITE_PULL_IMAGE_OVER_VNET' + value: 'true' + } + ] resource site 'Microsoft.Web/sites@2024-04-01' = { name: name @@ -140,7 +142,7 @@ resource pe 'Microsoft.Network/privateEndpoints@2024-05-01' = if (isPrivate) { name: '${name}-pe-conn' properties: { privateLinkServiceId: site.id - groupIds: [ 'sites' ] + groupIds: ['sites'] } } ] diff --git a/web-app/infra/bicep/main.bicep b/web-app/infra/bicep/main.bicep index 9a62396..81d1049 100644 --- a/web-app/infra/bicep/main.bicep +++ b/web-app/infra/bicep/main.bicep @@ -22,7 +22,7 @@ param appServicePlanId string @description('User Assigned Identity name (existing in same RG).') param userAssignedIdentityName string -@description('Subnet ID for regional VNet integration (snet-appsvc).') +@description('Subnet ID for regional VNet integration (snet-services).') param vnetIntegrationSubnetId string @description('Subnet ID for the private endpoint (snet-pe).') @@ -45,12 +45,14 @@ resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@ name: userAssignedIdentityName } -var environmentVariables = !empty(backendApiUrl) ? [ - { - name: 'VITE_API_BASE_URL' - value: backendApiUrl - } -] : [] +var environmentVariables = !empty(backendApiUrl) + ? [ + { + name: 'VITE_API_BASE_URL' + value: backendApiUrl + } + ] + : [] module webApp '../../../infra/bicep/modules/web-app-container.bicep' = { name: 'webAppDeployment' diff --git a/web-app/infra/bicep/main.json b/web-app/infra/bicep/main.json new file mode 100644 index 0000000..c3cb337 --- /dev/null +++ b/web-app/infra/bicep/main.json @@ -0,0 +1,404 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "15590331550205299670" + } + }, + "parameters": { + "namePrefix": { + "type": "string", + "defaultValue": "aiinvest", + "metadata": { + "description": "Name prefix for frontend resources" + } + }, + "environment": { + "type": "string", + "defaultValue": "dev", + "metadata": { + "description": "Environment name (dev, staging, prod)" + } + }, + "containerRegistryServer": { + "type": "string", + "metadata": { + "description": "Container registry server" + } + }, + "containerImage": { + "type": "string", + "metadata": { + "description": "Container image" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, deploys the web app with public access disabled and a private endpoint." + } + }, + "backendApiUrl": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Backend API URL for frontend configuration" + } + }, + "appServicePlanId": { + "type": "string", + "metadata": { + "description": "App Service Plan resource ID" + } + }, + "userAssignedIdentityName": { + "type": "string", + "metadata": { + "description": "User Assigned Identity name (existing in same RG)." + } + }, + "vnetIntegrationSubnetId": { + "type": "string", + "metadata": { + "description": "Subnet ID for regional VNet integration (snet-services)." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "metadata": { + "description": "Subnet ID for the private endpoint (snet-pe)." + } + }, + "appServicePrivateDnsZoneId": { + "type": "string", + "metadata": { + "description": "Private DNS zone ID for privatelink.azurewebsites.net" + } + }, + "tags": { + "type": "object", + "defaultValue": { + "Environment": "[parameters('environment')]", + "Project": "ai-investment-analysis-sample", + "Component": "web app" + }, + "metadata": { + "description": "Tags for resources" + } + } + }, + "variables": { + "appName": "[format('{0}-web-{1}', parameters('namePrefix'), parameters('environment'))]", + "environmentVariables": "[if(not(empty(parameters('backendApiUrl'))), createArray(createObject('name', 'VITE_API_BASE_URL', 'value', parameters('backendApiUrl'))), createArray())]" + }, + "resources": [ + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "webAppDeployment", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[variables('appName')]" + }, + "location": { + "value": "[resourceGroup().location]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "appServicePlanId": { + "value": "[parameters('appServicePlanId')]" + }, + "containerImage": { + "value": "[parameters('containerImage')]" + }, + "containerRegistryServer": { + "value": "[parameters('containerRegistryServer')]" + }, + "userAssignedIdentityResourceId": { + "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]" + }, + "userAssignedIdentityClientId": { + "value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName')), '2024-11-30').clientId]" + }, + "targetPort": { + "value": 8080 + }, + "healthCheckPath": { + "value": "/" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "vnetIntegrationSubnetId": { + "value": "[parameters('vnetIntegrationSubnetId')]" + }, + "privateEndpointSubnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "appServicePrivateDnsZoneId": { + "value": "[parameters('appServicePrivateDnsZoneId')]" + }, + "appSettings": { + "value": "[variables('environmentVariables')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "9094118072846182188" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Web App name" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for resources" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "appServicePlanId": { + "type": "string", + "metadata": { + "description": "App Service Plan resource ID" + } + }, + "containerImage": { + "type": "string", + "metadata": { + "description": "Container image reference, e.g. myacr.azurecr.io/ai-invest-api:latest" + } + }, + "containerRegistryServer": { + "type": "string", + "metadata": { + "description": "Container registry login server, e.g. myacr.azurecr.io" + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "metadata": { + "description": "User-assigned managed identity resource ID for ACR pull and runtime auth." + } + }, + "userAssignedIdentityClientId": { + "type": "string", + "metadata": { + "description": "Client ID of the user-assigned identity (exposed to the app as AZURE_CLIENT_ID)." + } + }, + "targetPort": { + "type": "int", + "defaultValue": 8090, + "metadata": { + "description": "Container target port the app listens on (set as WEBSITES_PORT)" + } + }, + "vnetIntegrationSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource ID for regional VNet integration (Microsoft.Web/serverFarms delegation)." + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, locks the app down: publicNetworkAccess=Disabled and creates a private endpoint." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource ID for the private endpoint (only when isPrivate=true)." + } + }, + "appServicePrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource ID for privatelink.azurewebsites.net (only when isPrivate=true)." + } + }, + "appSettings": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Additional app settings (array of {name,value})." + } + }, + "healthCheckPath": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Health check path (e.g. /health, /). Empty disables health check." + } + } + }, + "variables": { + "baseAppSettings": [ + { + "name": "WEBSITES_PORT", + "value": "[string(parameters('targetPort'))]" + }, + { + "name": "WEBSITES_ENABLE_APP_SERVICE_STORAGE", + "value": "false" + }, + { + "name": "DOCKER_REGISTRY_SERVER_URL", + "value": "[format('https://{0}', parameters('containerRegistryServer'))]" + }, + { + "name": "DOCKER_ENABLE_CI", + "value": "true" + }, + { + "name": "AZURE_CLIENT_ID", + "value": "[parameters('userAssignedIdentityClientId')]" + } + ], + "vnetRouteAppSettings": "[if(empty(parameters('vnetIntegrationSubnetId')), createArray(), createArray(createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', '1'), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'WEBSITE_PULL_IMAGE_OVER_VNET', 'value', 'true')))]" + }, + "resources": [ + { + "type": "Microsoft.Web/sites", + "apiVersion": "2024-04-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "kind": "app,linux,container", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[format('{0}', parameters('userAssignedIdentityResourceId'))]": {} + } + }, + "properties": { + "serverFarmId": "[parameters('appServicePlanId')]", + "httpsOnly": true, + "publicNetworkAccess": "[if(parameters('isPrivate'), 'Disabled', 'Enabled')]", + "keyVaultReferenceIdentity": "[parameters('userAssignedIdentityResourceId')]", + "virtualNetworkSubnetId": "[if(empty(parameters('vnetIntegrationSubnetId')), null(), parameters('vnetIntegrationSubnetId'))]", + "vnetRouteAllEnabled": "[not(empty(parameters('vnetIntegrationSubnetId')))]", + "siteConfig": { + "linuxFxVersion": "[format('DOCKER|{0}', parameters('containerImage'))]", + "acrUseManagedIdentityCreds": true, + "acrUserManagedIdentityID": "[parameters('userAssignedIdentityClientId')]", + "alwaysOn": true, + "ftpsState": "Disabled", + "http20Enabled": true, + "minTlsVersion": "1.2", + "healthCheckPath": "[if(empty(parameters('healthCheckPath')), null(), parameters('healthCheckPath'))]", + "appSettings": "[concat(variables('baseAppSettings'), variables('vnetRouteAppSettings'), parameters('appSettings'))]" + } + } + }, + { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[format('{0}-pe', parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('privateEndpointSubnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[format('{0}-pe-conn', parameters('name'))]", + "properties": { + "privateLinkServiceId": "[resourceId('Microsoft.Web/sites', parameters('name'))]", + "groupIds": [ + "sites" + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Web/sites', parameters('name'))]" + ] + }, + { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', format('{0}-pe', parameters('name')), 'default')]", + "properties": { + "privateDnsZoneConfigs": [ + { + "name": "azurewebsites", + "properties": { + "privateDnsZoneId": "[parameters('appServicePrivateDnsZoneId')]" + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateEndpoints', format('{0}-pe', parameters('name')))]" + ] + } + ], + "outputs": { + "id": { + "type": "string", + "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]" + }, + "name": { + "type": "string", + "value": "[parameters('name')]" + }, + "defaultHostName": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2024-04-01').defaultHostName]" + } + } + } + } + } + ], + "outputs": { + "containerAppName": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Resources/deployments', 'webAppDeployment'), '2025-04-01').outputs.name.value]" + }, + "containerAppUrl": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Resources/deployments', 'webAppDeployment'), '2025-04-01').outputs.defaultHostName.value]" + }, + "containerAppId": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Resources/deployments', 'webAppDeployment'), '2025-04-01').outputs.id.value]" + } + } +} \ No newline at end of file diff --git a/web-app/package-lock.json b/web-app/package-lock.json index 0135bcf..bdf5922 100644 --- a/web-app/package-lock.json +++ b/web-app/package-lock.json @@ -3260,7 +3260,6 @@ "integrity": "sha512-Bo45YKIjnmFtv6I1TuC8AaHBbqXtIo+Om5fE4QiU1Tj8QR/qt+8O3BAtOimG5IFmwaWiPmB3Mv3jtYzBA4Us2A==", "dev": true, "license": "MIT", - "peer": true, "dependencies": { "undici-types": "~6.21.0" } @@ -3276,7 +3275,6 @@ "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.26.tgz", "integrity": "sha512-RFA/bURkcKzx/X9oumPG9Vp3D3JUgus/d0b67KB0t5S/raciymilkOa66olh78MUI92QLbEJevO7rvqU/kjwKA==", "license": "MIT", - "peer": true, "dependencies": { "@types/prop-types": "*", "csstype": "^3.0.2" @@ -3288,7 +3286,6 @@ "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==", "devOptional": true, "license": "MIT", - "peer": true, "peerDependencies": { "@types/react": "^18.0.0" } @@ -3345,7 +3342,6 @@ "integrity": "sha512-BnOroVl1SgrPLywqxyqdJ4l3S2MsKVLDVxZvjI1Eoe8ev2r3kGDo+PcMihNmDE+6/KjkTubSJnmqGZZjQSBq/g==", "dev": true, "license": "MIT", - "peer": true, "dependencies": { "@typescript-eslint/scope-manager": "8.46.2", "@typescript-eslint/types": "8.46.2", @@ -3584,7 +3580,6 @@ "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==", "dev": true, "license": "MIT", - "peer": true, "bin": { "acorn": "bin/acorn" }, @@ -3809,7 +3804,6 @@ } ], "license": "MIT", - "peer": true, "dependencies": { "baseline-browser-mapping": "^2.8.19", "caniuse-lite": "^1.0.30001751", @@ -4189,7 +4183,6 @@ "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz", "integrity": "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==", "license": "ISC", - "peer": true, "engines": { "node": ">=12" } @@ -4279,7 +4272,6 @@ "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-3.6.0.tgz", "integrity": "sha512-fRHTG8g/Gif+kSh50gaGEdToemgfj74aRX3swtiouboip5JDLAyDE9F11nHMIcvOaXeOC6D7SpNhi7uFyB7Uww==", "license": "MIT", - "peer": true, "funding": { "type": "github", "url": "https://github.com/sponsors/kossnocorp" @@ -4395,8 +4387,7 @@ "version": "8.6.0", "resolved": "https://registry.npmjs.org/embla-carousel/-/embla-carousel-8.6.0.tgz", "integrity": "sha512-SjWyZBHJPbqxHOzckOfo8lHisEaJWmwd23XppYFYVh10bU66/Pn5tkVkbkCMZVdbUE5eTCI2nD8OyIP4Z+uwkA==", - "license": "MIT", - "peer": true + "license": "MIT" }, "node_modules/embla-carousel-react": { "version": "8.6.0", @@ -4497,7 +4488,6 @@ "integrity": "sha512-t5aPOpmtJcZcz5UJyY2GbvpDlsK5E8JqRqoKtfiKE3cNh437KIqfJr3A3AKf5k64NPx6d0G3dno6XDY05PqPtw==", "dev": true, "license": "MIT", - "peer": true, "dependencies": { "@eslint-community/eslint-utils": "^4.8.0", "@eslint-community/regexpp": "^4.12.1", @@ -5241,7 +5231,6 @@ "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz", "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==", "license": "MIT", - "peer": true, "bin": { "jiti": "bin/jiti.js" } @@ -6319,7 +6308,6 @@ } ], "license": "MIT", - "peer": true, "dependencies": { "nanoid": "^3.3.11", "picocolors": "^1.1.1", @@ -6543,7 +6531,6 @@ "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz", "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==", "license": "MIT", - "peer": true, "dependencies": { "loose-envify": "^1.1.0" }, @@ -6570,7 +6557,6 @@ "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz", "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==", "license": "MIT", - "peer": true, "dependencies": { "loose-envify": "^1.1.0", "scheduler": "^0.23.2" @@ -6584,7 +6570,6 @@ "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.65.0.tgz", "integrity": "sha512-xtOzDz063WcXvGWaHgLNrNzlsdFgtUWcb32E6WFaGTd7kPZG3EeDusjdZfUsPwKCKVXy1ZlntifaHZ4l8pAsmw==", "license": "MIT", - "peer": true, "engines": { "node": ">=18.0.0" }, @@ -7267,7 +7252,6 @@ "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.18.tgz", "integrity": "sha512-6A2rnmW5xZMdw11LYjhcI5846rt9pbLSabY5XPxo+XWdxwZaFEn47Go4NzFiHu9sNNmr/kXivP1vStfvMaK1GQ==", "license": "MIT", - "peer": true, "dependencies": { "@alloc/quick-lru": "^5.2.0", "arg": "^5.0.2", @@ -7390,7 +7374,6 @@ "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==", "dev": true, "license": "MIT", - "peer": true, "engines": { "node": ">=12" }, @@ -7474,7 +7457,6 @@ "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", "dev": true, "license": "Apache-2.0", - "peer": true, "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" @@ -7769,7 +7751,6 @@ "integrity": "sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==", "dev": true, "license": "MIT", - "peer": true, "dependencies": { "esbuild": "^0.25.0", "fdir": "^6.5.0", @@ -7863,7 +7844,6 @@ "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==", "dev": true, "license": "MIT", - "peer": true, "engines": { "node": ">=12" },

    p_38LUJ?QYhl3-BjM`AtH95XvTePHcGELGZP_ z4Kg#MTsHVA`JDApn@Y?X8J9;!EONMOi;FS;{{c(W54ilOD22R@3y0m^KTP;CP*eYC zYWnKr2mhviZPNV>ujEJ$hp|WSHAI@X+Z7a5PF>E9M?)xC5(TUGRF}sK7rW-$rQ6yB zO-;`?+oB3ZM3AX!b7eE|NKfQNL3CuSf@20XDU+ih1=pyq*rOJ?niBo_6P2a8`OL~l zu@?9JYxCT0(RYtc!0Glws(|s(5(}ocN$QTW$oaxvd-*F=mV}xY3v*F@>d)qA{lg+q)z@VM>xAnGb_mWx|Bp_1Ci=Hec zgL(@L92~{vnBLwVCDHgq5H0V}9};-qqncf>*zf=Kdr?R2yKp4AoTg)nJ*Qt@vWbF;^nC!45o z+Y`BPsLH2fpbM2=5U`uANIMBhuzRtBg+P82xG0Z`TzgZX|K}dt)XMzM#Lm|%b>Rf0 zE5ixiOIxh4a&Qolm~PS%JrUlWZFTP4x4;+sg;$0qHapSuqPyY+m;SGC&eXI0&efpZ zkkqr8;n_{*f3K;_dn_3wk=kW9ZS)lmu=RYf^(GOYi@N=FCrLlbr_h!ly=Vym6Y$ld7U9HUh8~Rqn0~EFQdM(SX!mbu%oK^ zSW~k=hi`qc+lXJlqqO&bjoL|qXFVvN^hA}EZXuvp;abUtMs`sV2c#{kfsn{4^fl7a z+wAV3`ZCf;T;sj2=meul|8fDM^*SQMXu1!N<4AuizRF0u%NpzN?yhQTYSYyPz>@>p zA>re*?&QVb*rjDmq^3Dotm&tx4?SGFc)C@OT-HbGp&{tFX>&Gee1IY>Asv4-asT7B z04Iv^D(~_n?@FKO+++ct_peiFrB-Oljj?E9EW+#p6S>RyKzBtT(9uS_@O5eh`L57G zbsEa2S8w(_Hwg+CSt++oyE(&o39Ozy{NMW#juKRhY0?z6Zhu4&OWMy!kU zwAY&)uZitxf6CEuvDYz^Cx??Gb*Cw2=Iw^4_zQ`e_il~WK9W*1x|=zqDP!KMHgc+_ z;xwDA|GNiYYbqHUYMPpE)V;*^!+ugH=nY&jyRFs;t$)a`-lA1hB#B^@9tkA6s5bAb zdWlM2W)es*r!8nZv2bz5QkI?l_>%!B?2gfH6SGFMB!hNhoSeW1({_>`2uS(fS>M4V z4;tY>jP3iD^;dQbr;m_&Jr1WNASIFK=A1V14NwQWf?QUs6h@17whTa)IM6v%=ewz} zm7@jrmLUNjqM{?$^o{!~&E&7+;cfgX#l&QIpu2WHs0S+JWE@Pltr@Y7N*7)d68JsN zGW6&O29FOT)l^P@=YNSWWVaQH@6?^0Z7?ldUtc4ubk5n)o-}F(aFjJO6EtkUYuBC& z@@VL3jaGS`OrxR$er$_*dgP15LGAgBGa){q&3G*(Qss~RdvIW3f6?o>XtgCw0vFe0 zeje7N!1;0e#0Ey?P*Rm6BbQ)O(YTIIPUl5o<|rt0P5{;UK19B|ZAIVMxG$vv~P%F43Vz*Hi7EDDrJm!`qeqsvES!E~Qg>ptn|+XLG|dxsi< zm8IT;x-j+|c6P|eLj70`zO?X}nN-vF&p-qvbfjO%Z(?Zq|L?!#369oJQ$T) zIsY?IcA{%##pQ9Zk0o1Crim?A9gMKf>LK6~ou*es#k})zpF;8v(xUSRgpVAyb^@O&4-x zN!$+9NVYa_w-D7$!m1}Si2vnMalBE!oZKxA`}{G)=5F{ z(4jDy+P928Irjlx>8&y-V=1eBM}#+%1l*vk8knA|Znxb_XVX3W=@Vp%HrxBUkKEXz zo}&4J8}J8jZ}9OZSz253Si9{q2LYfdzekDL-pVF3$-Lqw5V12Psyns)4+g z*2F)xnbI-#qxGdWVZENCG0a9i%ahkh+^RM1>qoDDV_UTs`wfI&A_$N0{5W6g=MDp+Z#WQ^ z`KgTFbQ)6Aoocl?W3#Yxkymep+#FfB=y@R+VHAUzzyDGWkt3tRlkd9KgYD?PsSO zX2Nd)*IQ+7JvrZ=u62X7w{&w^zysTQ!pg?@A0&|5R*;megKyi&^y_B6(Y~{@hiWdx zqT&fk2K<(FbHdB^7pCajaJ)?ckET%{L5|3|A7^>K6jHr>MQ(+gah$KTwGpbfjrJ!e zwyNIVvzsVLT~NMJi1lQR)q+eoc_|B({&|JdUeLkXpzWXjOsC!M1gV0P3U#eb&HS0A z5^IO5D&$jgwbxGJ2{PrRt&JUshJ5w+uR3eHb}bdx^Tc^a4JzmT-|(X%QK(-9Jf*i>u1lk|TLp-&TaqSVl*9t10^g``NQ= zM{o8*@|T;L`ToOubl;@?2VPZj)4vR+5+lL|CxqvP71E`;SmocH z{l&?dt&yp(jQVeLU3va6LKM2 zY%6Y}gkn%Zkb$DOoGJO9l@F=M;O6*T^|J0^^@9Afx_j?j@o}9Q*M1kOy+M03Nea{q zpM#NcA{;3k+yC|)N-R=<_1eH z+bh2-aVXjTA%CL}2ApntE7h8s-)3f<@Y7N*r5_jf+6?beWB|dm&e@|=S4aHTAz|nUk*VkZ`jmy+@0JE(+K~rv>q1p z`-dr%Sum(6CkHkW5?{LRfpZ+#T7VT?RwIZeGL~%wJtax*>9PGpriR;N;I^iHvvxX= zLlg1~XLYhRB3{eN^YjN6DLN0IgXJMo_l?IvwIfN^zmr60qQF)UxmxKG!h-psJw=)b z&bW}+Sc&e$*?}>b&ER#OzJdhpY)vtTE2oP*ctEtjPIF(5l6_&R+(8$nZDS&>jt?fS z`R5Nwo?rN5MTiGctrHtH?Gg(Kg6o5xaNSRXhU|`x6@HULUzCjp58}_yVoG;9erFlD zY=%45C$`5pT`SDHZ zjFI*}N-@E+We1~oOsCcSwDFzprVs*ridP+A-DNxq8<%Iiq=>YUZCmOrJh0!YW zo<8K6MI)EXdgQg_s4JJ0T4e09xFMSaDwFOSOD~-DM?Xh-jD~|4CzM?amkQYn%&_A3 zcxO0Eo1OAjkG)oxgK~c_=m~ffTP%EYVbyaPVl8CTDs=gfGVJ3`Ayl$Bw9pt|&eBK+ zWzfaG;TnesmcKprjP=p{hUBMd6ap1c6u;^V%`Iq`K$8g9k!p#^)Hv1Bc-Lul5d=G; zk2eze-JFiLGi_}4ka6@fBf=HGP3yi zF$rgPl2NlH+7H9;Y_h2It1Is-*@=4pheHX_$ z@~=O$JDnxvq%B7-4|H!#o?(siw`Y>0-Da!l@@Rg+8H@qfgu?tIRlMe{0|P89iD7>E z;q95!vm^Ekis?o@e<|tq7koJDJ9j?7k%%X8z|CLcZBsn|?rh(x(&L0z>S&hy=0S;b z{4=jt`^ZDbq1(vSN8Wdr+R%_CKK+N_S{oalCiFFp%M*Ib$5{Az*LuVI5ULe(6{Bu1 z@;~msJD!b3+gK*{j6_>Ym;Sk|1;y)IM-IQCWa86h58vZ53!X%UP8_B5)2CMusMn$go!z6R z_LEBo)+8 z(T+>#I>-U+PY<|`R_0=k$IOA;j6}s(?-AH8 z+xngOG~*QRJtFIZqz@wHx%sz|sT#`7U`fou?(64wTw_w|f9O(N+t}axeKWniKazIi zA^IzkdwXfL4Boa}Hc_>U@|4!2MFD(M$#2-9VAo$a^ik%G;2Anf-G{u9Gi>x5ByD_C zQ1Mb42&vbH0M+|d%b;KXEm|~8tPd8G9aU~;1us{rp>ZN2qG14Y9N%B*q_f0M3^@#T z>bUH;4FB-^F@Twa#mM|XVAXEuj51L67aj;Ji;5e{6?^T&bVHaK14rTzJ-U!h#wFfEcc}gT3Emhp@|BR0Z{%KE&Y3gq#K{_n;%ub`90S)v{L?EpansaDB(ZLTMC|k?{f~`SAtG|`U9I;t_aVJjzk_7 zN_1WEElWMzpB+szNkge??QFFS9t_iw(3Pl?bB+IGo61ra|CfW(ui5`QDw-*lY3Z(a z65M_4rr8h!YUdlqfhOGtY;n!tW21d&=qC()p$M1SsDg}=@cDCCWtw5HUjt={<>FIj zSeS05^N5fcOsuDLCGrWn-sCas`j}iu{qJgA;@)b%7<=OlFaTO>>vi$86`)MT`Vc1iwW|8fVKtl95`pnYRQ>s3ARlA;Z*qgVj+1_Dv8#73kqp%~LlfomAm2s_gp8x#wHDDXv&#>9_ zH$KnPZrZfHHV`}shVW}=XXopM0Du;DbxVS8Xsrma)11*DhZ{mE-@bbHTxjd1cV&+y zwCXl=q3eQCXO8fYhpg*$>ty_n_)=S|aB-IQRVXi7 z*2jFIPAdM%`~)y_4ZoGu@MbKO2NT8;WSC_ELjB+m%*hYvUQTJ+c_2WeDp_>mdhNl?d0^SnBRfVrFPgLO z!8&}7$H%#U(of|jTqx0e>y0qfyuMcuJMJ`|5gFddpZ38~Q+al3aO26Z^v_#$TSGDV zQk&t=IW#?X_Q!Q9v|Ng9wgoT+C`laYGqRKirz89w_=RT##ziL<}v zpo4(UhyM2!ApC``2^#hnDZW337FJ$dU1G*~5)YvAh;R`#WJGzPQT!Owrjn zDLnkNTl+6%AE;xi(6QJx`nO&GftL={#tqY8cVDD=sdbAJ6H{b8Ue^kbZaP$Q>lW5J znGPh%$Hc7C@Ikf!dB?HK!5N=N2xjJ9!`%}}_=$Ype+N-gKHa)6rk?P5Ewv>OUAB8LD8+=AfRfW;@Ac@N0pFIDAF#9x6x*O#Z&F_$^26u+>is-=I7PrX^E6dYDvon(jIzAp1yc7 zTA!8vop;ye>JU*Kx##rIn|E(nOs@=Q<^J(3 z#d?)jy?Wp-x2s*{mY?zQE`q;66plxiM(4sbSx?U6vNtw&I7iupAe*|iq{e*j4gx5~ zTwgqIP5~@{yY05k53JUw-El(Bg2)(lxwWBzp^cH;vB{jt+S)qBxVz*1rGc8x6Z($$ z(6Bg>l|3vn9)(MzYRQT(1#xWLq@fQVa#4MN4Z&LR(M#y0fe#1O_u$EKw=>mH-;}6;p%zeMP%a9!JJg@!(Q8;=odvSjc(MswF~P+1O$m}_OyuA`N1T} z5w6q?)ytkbovfCXwNFnYJ+rwZ7^|ErDhSm>{sfny*iWDQJDeZTzNT$I+oKcFk%4@R zqQ+HGQ&qM5y@0hf%9N72I#?ikzC8>l)gmh$gF!RHETHK;_MyM`EMww}%7g(w%Moc6 zOXJU_u_S9j3|O+WHEYk!XDM$!vRDJGOVakicrhavJqf~P_2=0$WrhZ0lX>jpWYo)& zPpfXyp5Eic$@d){%vZYJJS4EFb&-^O8ce~xd|WL#@u=2?pg1w|!tomB^+6sb`HNLN zQ>bUB-RDl?C+*OJ@a|lrW@4y6;Y3MVYtZH5{kXS;TQieZ@$yu@gXT!ZWdTU#cYo=| zNUhnV9n#Wn#Qc%{Jrnn&2i-w7G!3CZiGy5jt4fD2=cHmcDA;Zx+9wsQ?d)zR5w|8H z#Q8*xY|{NcE3se@g`|9GAqsrR#!90X2Yp`uY`8gVUrxO8xDdG53GsB^2H)z>B>IZ&)WAG2&ZiE@0zT6f_ap>jy9{}%@z3F;Bn6Ud1ZxTn^O4rV0YnU zh0h@KWO+jW1|N)3!-};8hyc{Xt`D*#lzT30Ni{f)EOXGJBR%HnU$Vd6Kv4a0J{B8B zdkJ~;`dD@6w={>zmfeY(j~a8mK9w08QktH+cd+xt@BYcY6VB;S#0nH8 znV<6%6b{&wHB?JIm+M$em2h>o8D_K1MKF4`>+4;(t!FM2@}IS~J&lbc;dkwc?7sb9 zHNc1dvKm0e$r;r!y~Oo38dqwIotvA8u&GubVs!CXQsS_t<_;Oqm-kW#8MlB^h>Xzk z^v9c+{Y`Fewr}8wRO@29l*orn2{_$Tmis;}z4ZKfXj5AvABb`c%`MslIKV0==j6aa zuY!k%^F`Oz$-$S2s^#Za+5l=@{q+TNqIe!Zx;sI`LkGAVP0h9PPe*1qh3u#5!h3t! zMMR`atTG)+8qB&$mREshOh`zOh=Y|_>C9Zte(8^f>R7A7q+Q^&>Q{Slt{YqLw6mCu zb?pi=m~V8UQ`%K5frFlybU580E>yd+vhroLgmY^p4(w3kIe1A(FP<}9YX3=jJv(}) zjl3VN8TMFD#IUgyXe6&lX2lokFDIZ$ABk`5^HrEvUTPFHc-+EO7DfiGM>kN7>--wC z2$^*E)>WW=?)2bKPDfBksz^G!>j`;+d-G2-GZWLuNc`2Ml?at<6FjiVoSY{-ek9Mx z^{&J2KUh{4aW?f25BL@o#5CzE)wkdteA^5v_8#ZqetxG3YfMf~vUZs7d0A3x<0X8! zLtrEC?sCwX5KIiu&BtPzi%ljyPEiO>u25REnlv)_y*#oGLm;Ps{4 zN8dEsS6b_VTFU_!{^$~4Q7%ve>erow$k@G>cg-(kXvAb;$#M?aJY)J7Qk0fXF zZaMn02wA{LYzZlw_tnk!gAa6R-k@-kk8$Y#M0$CCTDDNAF-s|9iK zu^SO)t2O`A0yN;-*z_u4ouN&DI;y?KE0dRZMqK=iK?YJAL?19|rt6~-D1kNq@L2x7 zcN9!s43^nNcC!bj*DE~+I~w17&S5sP5&Sh;S(f?){Lp*8%8t3?q9!IvHGuCWY^hrA zke9*1lNC;>htpGx%0E8@-5nV@7H}sMbZ7!HLQ#+^(^N!g_+yeWmbJu?K{2NbzB4Cb|YU!JD zbnZI5`iSb2AF8W&NJzIwch$j!!{!av4uONK%S$T`MM0ML87{0dGPqeSKMRV8C`w7F zC0C>9#7BgN_H%PsXpc)&Y=wEdq%x<}h?M3&J5YS`L~IYMg0sAstG=PZ$i^V&(~zT- zk5RzWHZZ1NkG%2tsuLDXdJt`t6QcjzRPuPx>*+=ROaM`^E&{y|fy@;_WNL9Sxwc|@ z|G|6PTf>X;CzD0=StptiqBxZlsXxEh)Ch9(sVRynK2s(@dT;f`jp+xPG9}q@?{91~ zxATmQqGS9Mu_EXUX69)mXHn3dL2y`bn#sP=*`j4#LGInZmyR9#^xMg6u{W)v;53nh z&Rz5(GyC}x^^h@xE}|b*ShLx~%jR=&lOf%F@Vfw2V0}Gq%mXxZG=ck!jPuSGf7dzj z*x1_U7!NJo?`4nnqL$u*(epD)Lgu)R^(Qwia>8hIN^JGqH^%ggS*d6CMv8s-cw|TO zXK$A(Lj=~(W^Vo-?K*u+OOF<7si?=+4_a6AZuK#$W^7BW_-Kj%69%5pP^A5Y&&o<*02`}WY2ND#T720~v zh2GhG^~$=VW2n1#9gktR#>z-q=XP67@vyEg?qKf0>9(03x6Zhz&-rj%$=eUP>B9g;~oycn-ux-Xy@!NZT~&gRx*OoL0q$6Tp_EN@$A{u}mKQ3^szq~;0jSlT#h&NHwR=R$7OBB-z>FUm(oyO`Q%lQG#&C{?QXHOcRpnS^kEkwdKdbf;pG*v6g@(!22e}Vd5v&HJK9DaWO z>f-}mJkO@iwwxdhXN!wWl<%mwsc!@mFlrEMAXHgYqYD@(^!Or{+Fwb z(!|=@*xLFDv-p#$8mIfaOTXGr4sz>{pS`}hqR`t{$f8rhXW++Iif4}M?oOgToST@~ z`9&h^zFOB*+r@4kDW)~2VY2mI4|G(Ox)TzUF!kzNe)f@(z4)e zZ_5h)Y;HEQ9@$!^5)!H{sc;YUh>VJkjh1%{}d^L?;i4$7JfLdkB_qQAcsJ^Y&8M<`^ zD_eO~utsrsT@J}IHykKeYm9ep5xWs1hepek-WaDN#wU?PA$p*C|7SaL)7=UZ%4Z;$RPsHuH!x=ti#d?|`PUClLl^MEYsQQG~ z9KFor;3=}TCqP6(l9`q^vo4@1D;w4k78P~NMkn(gtbK#My}dEHl%341hKK>(r_$|e z*+V=w39F|^v*n4>9_0=UFhV;zG4Un80>?>eb+9`ghIL(CIi8I#E+54Q2akl_arQdV zwBzH0*ewl4b=tZ&7vAB@jmf3r6&6E9OW-amtE@!&8)@agw-Nku{ZzpLf_x=qWgYFB z6ag=QL|Iv_9sbeTpT&dK!}fYXefwP1}T_^%C9qp9*`AMD#ZraUy zcX?N)3hi%V_*M%F&KTxcKZ7Fm5|Ld;NIdh2X@~A3qy5JZ=z-Cf(FaGAp&mXVuBw7+ zOIyoRc_|_SqO)Un>#4QrLJ+)|6tueF3HeC-FkifE-wwPUfFk@EZJVvvzW0dd zC=*~GpHjYv923@rc-cPRKk8kd8m&iq`f3=ENH%Gy&@XROY)bt-io9fwGSbq;n&kbG zgOc}-HjBC&NCHqRH5^aQX_g-Ym~)7zvlEMg|B4Uc06DlrieJ6M#!?G7pu$(NLYV5XxM!aV|~c=G1ajyfZw-Lq$n zK{ssDw~bV@hZw2qYVBtIl51C!1Ug;a+~8Ko`=32`Keet6gD-CpunSwd?j-gWdg>+_zkbke~(Wm^vzmlxOm^he!SanggAC6qI)GZ+yTRlK_NYrfD- zp5$fn(%*v>LX!I=iD1-`nGka|jLYS~cFgB&#;KBCIBu3$i@0!bJPJP=5w@0PCb-kN zC`D95XkuoncY0u`X-MLsAS(Y#WwP-}lR`aEC>Ivzl;_=4y-3`ZwS^oKz2tgFX_4Dp z2Dg#BnOsGwm2MmKC;P8#(869;lvLzpPiOC1r z@<`R*w6jyh!ZPX2#zDx)J=Vu7?@>)rqN2*)(x`C!7ScWTXLdX?l4OMT_&8~_sMTe> z!poSIj&8isq$z=iG?=Vh#(KXq{%3Y}RkAlEaxn7xSWC;gH#H?7pa8Z5IkdD4oG6c- zfHeuo5o)H6&14@>Nm>q$-Y%ONxb$_a-J93fU>y(6%=N>tcFI`SXDlF0UcJ^^R$zJO zPDOFCqPjZ1+WvoO%ZfI1ZpBnuND+-;S1p zy6_C)Fttn}q7H9Yzd9eI8N=m+?m)sE87tlBI=33x^4o3F1n!y}SLsJ&i7{(<<~? zmwmCL4!7+%RiOynZYpC{l{~~&>ScE}Ovnm95}#9fZnTus4rTeUAbBg+bj%D`2*W`l zzt5Z}gk}sP@}}+`v<_t2!dN4f`_?V%E#$K(dW2xl>Z>6}p9_hks)T#1{=l41$p)U*?eNXk1TxA*z+(v%B-&kHAmXe~BqGj90I_HH3 zmr%Vgia>SMSXp9Yh#^~hLBV#$3HO;Ng!Qbfo3QK3qmawj0tZ{+lx-u~?&{O0PiGbv z)t)`GKD+np*Dsisxq<%WZ&=?S?H$j%m%iSL=*NpkykC*U#lHnu{@E~3sZjSIGILP0qCUb|$iFY+e$(@D%omYJKt`Fwwl_kYF z>@Fx8;2Iz|4X-j!7I?0Y6(e~jN72mfrFpg%v*#a-A9~JgO=;B|95j4Rdh%iEtb90d zT)47zhv8y~M>Ii2WiB(npy2d)Pp?V~kZU9PM&=?S?_a;Z`yQW&U9ajLa3KkKj z)cpKyjg8S-JpXMnUbHG@77ICW`M$(%ZZ2s95|@AgxDmr$ZkO-+?+b@tc>OO%0(Q2z zf--~{lyLVSolufu$=q;Go{-h-#Vt>^Z`EHaONsfxqOpHG!}1}zn(2c7G(9PQVsO7D zKbO$q_9M?JFbZmUbe~3AUBz{#>OG6SURj6}hA*GmM(A7qCJ(0Js@DSDxvT{bsd=(2 zzK!sD)fm5h@T3;s+x+9;!~Isc5m)!WkIq%T57>3sa5?&8f_ES9o}rXuxw&t3vMi!%2P*2i|_A`|Nb5Im)+POD+_?H5mF zJE_9zUsb=o5zFbez1eR%StZrc(Q&ja@d}=n6O+&BA9+vDYo&$Hi8$hXqodm(^GQqn zS)O?PF?pAs53^Qr8zdC(RSrO_U_CN-vTed&3Yl=q1Cu{9*1&d{btbeH6%i5FPOx-Q zP*PJk8jt$^tC|1L^JCMc(J5rM7SiGBGiYurvN&uS-Efvb>n#_GMMf4rY8R`Bbo&tV`JIP zd!K^#B?^WSZel)A&(nDNR9i~Qd!Zu?QBYDkURM5IRP-7KUFC%?r(I%`Cu0i=*nlNV zN@{7d=*OGY9P%YsyL_@VxA^5t`cemTk8j_uHA6z`OnB8v0q)iYe;#bo1xZ5KeAUkD z^~IJrKsT%LI#IGQ1E#GGO5ihG!u`j}%CV#Gi(dBk-#|kn=1sIDKSk;W2HGZtQfq1` zE`d-{xij`f5gnlg`NWFBWX%C_Eb zEq#RHBn;jV@X;|<<0CBUJtWAeZ)|HJTEs3b6AyuB3-XD~$ST~g~2*x9{Atc)P$n1le&$l6*bS9bxz8LW=jLYQ&h`JH8E$BLn))$Xu(#n1>(MrOC{ zBl>@L)T@RoLc7lZ?FLDPrsm{}y$--Iz+Cn18{!@dP+9%o!3O_#*8AkiZEETp`;EXy zE0oVG-SoaV&p$n-{>Cq?srgt(CqFOmb;ZWfLgy45)8JuwR&_^o4VkKYSqN6)5#hJ= ziY=mJV+9fI8qbjAWSCa1T8)yYdhPuLMuK0wXc@13X*rM$#=rB1ZFn;3Im?iwB{gyu6tOD<9uQThs}I{KQb1UHvB!uktwX zC3AY()Kq~(K?c_4^Ul;l0j*5!t*wjh4VOcJjurY4q!IofR?SN^@1-mlEk=a3v?}+q zo`{QAl$RHqDg9qRJDl+rvGD3%|6G**18aAp*2iTZbF_rHwUhZS6H{1(e>nlkN0?ZT(_(gaU<$K33<9+Lm=4};9t0u+<+~y4GO@~c55&8;fZi_^wSePQ&UlC zYNEe_B+9XK4V;x@e7JcmH8VT8KIwB40jdBbd84Z%5`&G7`PfB3zA)=X4;OdY1veyfmv2}>!vF6hh=@2kIs(m*7LU-KJ1-jzff!lhp!@$k2Gswy!{?lww48M! zpSfC}3w3dEt_Te|LO8))*3?xM6l97~U>5jzmy!Fy0|14D;2(OOe&n=_#zBBe6I$a} zYV&4e=ud7@(a$1t8cB?(+2-78j~I~BvO2HbG%;~QTu->lvxCr(rY2s;im7e^EcjRO zCfC(9!~LxA!J-nKnK?@I?SPi1^Q<%VRVUp2{bXC)JM{Em%eA$?E>U0KER|YRlu*sU z1wSA_P(+k^-|AL(l*6{_>FX2gaNKRzyvv zm)@nO_Y#=#|E`B)H%SzVdi|dD_1Z)Hx*mnqvGUp>8aV8rc#R0_Jk0t2eQu^V{nMw9 z-^T7UGkd@fl$U2bRaawtVmYuTE8B^{FyyOi*Zh!&7X23=JJ_V8{;ZG2gz{9nBzLsm zj|{(cuulPcV-*bzr|BQ$0Jwp~$BN)xPxtPWNKapScgx{Sqckv|5q;opn3_KAWMpEx zf#vn_<3|;B^^DJ-vjMs^HAO}H#I|!^SxG5L&?`DLR9#Ii{p;6n>FI-&E-Ww_zr6&E zyH|dGa5V-6Rlv|0KEMt^#-EmEZewF=V*@Oq{Ut?p?Xl6*Q%_FLVnFV%E-k&Vsy!Nu z6RH6G&DPcngn}j44lvOm+nA`8j|>MzO6aFw{{VUn%;#Eba^vFSfSo)zFz|@)fR$VA z=w)GW&DMra+h*;iW~ohZyq1s6VsBGk1x|`{0nEr%laSliUPB4M&uzk_al2_8f2{Uz;(V&2YG1P@rh3QYxu&; z!CVZKx~*wBRE&`;!cTs}V|#=wO^o;d_;C}_tqGEslT%X&g~XpW>NQvwz=Z|}0udgb z`30W8!s5=7qASpmh$qV(Vs0!s@;;k7m}~7L=W{MlXDYZ&es&A#O0F$)TsFkRn>8)b z*3$Br{?Q0749a2e-YvqsQor?bFCB!dNN8-V-Sm&NPoHiwGc(`&(9%K#<_SPwJ{vB4 zmz~XIQ43}^z%MjO7Oc+1D*33jBM}4k57R&BkkIh(-9782f2bcku(7hjr#OdQ{?)^U z6e`XZE_Qad-AMu%h@4!qgRs!XLg!6hot|I$L{Rh~g_ zoq@sockdoDZh0K<&WF*&py)4jD6*Rc|Ks}#qkEzfe4FuRgB5Nlp%U(}nNqtT1j7_hg}S6o`#xMn*6uX?sJQ=x86%Hj{7bKgGw{ z*GO#!ZSMq@So2j_M7c=Z-9kkqnsx81Z5(e+N5Hd#tnS}8?es)_>TMiQL6o2hmzMUs z?I<%d6P{Xhbo6=x(SK_qrF&-9usebG8q)4PNkx5cq@#me%kybK;5u0X#v?4l5H&Tm z#l`u1ch8q3;=#ZTV7ds^y?agF-SX6K9Ekl6@sjP&#N3*XiuI9UL=7RTXF??h*ajo^{Iyw@wx5o+#qrre;NcfdI+m#Q9L-o8+J^@Ai(WB29?=o|8o?bhJ zxWi=~hzF*o#}XknSA2_#csOVno@9)F2 z?H7eluXJ8VL9nns01*J@h$G5!a-cDJVU({<#G;$T2 zYHBXV%BJp z$4fmxJLY^4(X`ke`7pZJp|?#F`$U|dm^Xt3NvO0RoT!hT8yF4P!Ok5IlGQ;kmrvr7 z&`n|9l&i3BP1rG$YiVg~q&IfpkBkfNZ&xBh&i4g)>^ojJt!_*fuJ@wVs{M(boB7p5 zcA~Mgw31wNyAIdqWWnh|@T&(-(rr#>YJ%PIgTZ7{H56fcamLx&EU~}+Bn6E0PgD)M zyF__k76K{{f#f;9_=D05(*>WrJn^9h6WNdTQauRe2>sK;WjQM~Q@nK0o|j zZL4=*O6oG-prIkZm0wt>s1%NdtT>+oHrZI1^FdbDY!DfbeP+RS;FVe$i3efM9FUPg zN4B3ZE}oQ(rvMlD*^>`+D##Ijfkd_Jk0=NV3Jwn0qw7fR8P~7&_7DApVE+)Jy(#$O z6Egy+T4vfg9_SU9R+!1NBOf{2-$r6n@D%(S8$&=F_(=E~8o&VM+E~mww==V{h;R*{ z4MT?5+h2o8AXG$C^Pcgb?F8+{u){Ur^T5(O}G~74V zAw!8!2zehJ@9`m!RDI9Q#YA4d3{h4Ryy9C~2^dbM%Zv%oeF)MN;zHA!z~>TQ|4I63 zz}~v0SQkNSvN#?UIq=%<85!XX2i}S8C~(>+Y72Go3XK2#m$V zq#TN1ynDB+n3=K2&L1qD#0ZPu39JYS+= z+uBcRJx8~039UElN&p`_;G-L|Yys`#Ytz~B9vvFkLhYsb!3oA~bBHP|C-)sVLLqYl zLvyWo!=ufRlw*<1*@IscV81mAP5=6`gKHGv~| z?))U^byE7oS zDso_pT9*|Qwubf}q)!n>_u(T$3>O#uS+m#+e8TV~6*B8g)!d}U{Nbi*{2vYS4o@hA z1RH8HQfY~9*?+#wD!4efxv75p!^@>*d#<3Ttn7tQ5m+KUm8EY0cbw@;i!0GQQBkq7 zw)gfG#;At+Z7?6rK!p*s571YE;Ae$`HB39)yl#C(?9zUNd<{gF5IR;q2({(0R;v(obmdc%04V7SQ z^voN%&F8!|(+DiHNui&E2mBsxsmYTcveYP{43rZHWG+ku$mj0Iy97uA{}DrZog<7K zgMlz|6MvV*Ez{K_;+8`G$w5c~gXlBU8uvY$U!QZ3o?0KUDT}#M*O&hP@pP48QK;Q^ z2nA6@KnW?OrBpyVq>*lGvNEje`Z_LJwf*vx;mH%KgX||yo=^hd zu{E#!_)+h+n!T0PbG6Eb%e~shj~{1GowXH4#p@Gdekm}6D|hIZcaFGX*1(1%4+MAU z)IL;kBt|CzI9J0rSYi!;7T419t92zHFi-)m`-liBEiIDKr<~-Hl55Z-giExL@;W0o zU7USKq(C#6n`^(nY{1XYzp8Az)SWh%2hN#!dG#SZng|XDrZ;WD9!PImKZgS9j(F1* z)eJl-gNiv##z}fd(29q#&l>!d3b5a89dM<=d8XN7xf6c5YrLZQMn76mPiUH{Mi7K7Gip>w)^kjm<#3mc#C3Lw-@KqCuoXZ@b*;f0@0 z-p02NO`@A?dy0a9ay0!t7v=m3e3ytf^WxD9U0Enin-eq_=N8CKgLlX+{s zczNmG(#5_C_w7#Jx&i;uv-1lfB>0F#(v8+zgV2g}u#i2$5(tZQJcKtEEFo>zGBFVq z71|FTM8eSG!v`@0sO{~WeZw$`ME|UmHC}0(zkM4Mt;+F!T1r7@eyI`@u{nteuo*kT z(WyGL^Q&YuGH48ck#fGDUN6>D6?aPslq5sM@SGftjG!KVHKntjYjvlh;#_?oNTsOs z)7CaYVl^D1!qE^#I*kzP{Qyx_^Y`TV7m8;*yHGnj@9HZ~>v^1$OtE^wY!;zJKWJW1 zZ}6fZ;L_clvs@pcns;G#Qpnc7e_#Ln0;^=}@AuTU3UkSk5a<8(Lt3>m349w<^M!7% zi`6xMk(yx6N=~kg(sZ)N{fcovSGo38-$4{(V0%b~&+V%(5%bT;7Kx{0}}#4 zN!212^bj2ZregC{l#GmpIir8`sO403&CScq$HD+VT^-K)`4h{)fMM4K-GoLYwl6>I zSMKh4=Wbo@?nn4T?(UDylJU;n^SDkN_c+?d6m)*+*Pcv|A5lK0%oWF1#KBR%A2o1K zmDRju5nHgJ1bidBZwckFyCp)?(-5oHwkir{=ca?XywHTNJ~V>4?Df?!P;uRBGIDaN zi7gRrYD1DtA7B_NQvXFbJRXp5r>C`;aC&wwzik<)T0W&6mH&F_xvrU&{9A=tmquJa z@+4oBrgSSIouBUa@T1=~UR1Q2U*%;;Q6n_DJaRjb8y$8m+ouKIcrLwrdgzCIUWD8P zZd@KJCI9v|Zv1c=kBe;_mg>ygMvA>S$%!ZK zf*U&rIUt_Ip@1D{-*x%AqGk(*wm51mT@ zu2s4S-4|b>u&cR)SuXB9;Ei}$q-{tkIB0a2P*<#TK6|$vChD4+r^uec!4Cr%G&$bx z&c6k+MV}mPiE%&jpYI`bs8sP8x$W8d!XiXr*R4JFp9l94&il`(usN%Jb=hdLCP7k- zcv&NW+|(Y5a&}OPgpigtz=`E`xsx;Zr%#?H^k8i%6rS#LZEPRKf}s2F7g6FYE{AjsG{@)qxpk((d@)Q@ej}dTlr)vuKNy;Mj5I2fxJ> z-%ltHNIE*%?rWKv=7ssk#v%p4N%tEYaxWi0l~icHi6A9KaXw(yyV?{MX^&<*z(@^C z?Kjphot?#;Ql6hrez`$5*Rp*%lrx6+~9m?mcE`9#k-6tnL1L1<@ zu^HM41BE&Lrf*VSkq`9blk)y*kFH2f9rBRAMY#{) zR1F?i0RYzI;-Y#}E|jesl%IAPkM7+5RH0FVZs!Joy=oC30mrweQOV`F z+}uR&?hSC(na%#MEWHB^tbQ0tz{pgc^90r*6c3PRu#o_?yMGR-R5mu_RnP=+YJ4nX zd|}5(qUDD8R=4ijH-+wO*aKVhL^Gasb~EyME} z^Knz=Dyt1-=oBqv*q&^-5FXS4as%}{jp22SH2fnbED$^Zj{)*Trgp22hL{+1F_?{n z*#@PtGKCEE%4L2kLC;}99X8eO1-X1&1~t}5)QYFfbfe~2lzg89T1#`0!PhZvWJC5 z9r+V()HhGJ(-cJ{loCYGG^fSb#8dly)PF&;7vReyWEp?v0NysD-!>fyEiF~lpAQ6g zsBvIzubbh4m4n;a-`$-ZH8sM~F%OH=^t3e52Oc=rhh)#k>)AyCm5cuId$C~Fx_U7i zVGfD6L_L57&ik`Yme5;NoVaPD@Swg}pM` z|Jinz5^!|`02FOklny!5JxFTtdLr}ll>%2@$Yk!s8f)I3;E2sp^s^CO-&m2#e6Oy) zm??d`qw-NO$qRQM*e24aND5|VpUurak5Z(s=AWRq(L)^0{0M}du!;%m=!Da)Q^KB5 zQ@20c_2=l3np5=$Zkbqmix#`P)#0Z3WNjs zQ3~RPemH$)Wa@8Ye9E!Zg(?OZY#11yfHNwdq)|Z()~=W?drg=`ca@Ztp{10LWlp&N zDVZA|O8zHwoz^^V*>h(bl>u-lSxmW$*VEZ=aJ@A*|FyG$U9KQ+Xe*;2Cu9BYl|93Q z`{8}~ILbKp!_uFpqZ0mM^-WLt!YVB;C?_uA$)qhGr`ST5pG#ZF(38jTG+TE;wFD!t z^Y$m}*<3XrLd!zKx@ruBLN4#T-OctjE*8pxIBBHE1Ku!41kXNV{$-B_=vhvkCsm}( zAdYA>mWAC9%OSJD(gBtAq1*J!v!$N7Oqm7amVNuSX2mvl{0IL|a_%|2{Xk|S2!OP+ z^Xa#@&FY-|*DiGV`P)TN|Lr50t;-1w?4BQDL5bNVjTukl(DYY>7z>fPqRht6`Ut}wTd`9Dry$UFRMx+m$*pM0y7G#q^N7oU0~-F^xFtu?``x1#?@%$nevSN85+L!L;i6 zj&BsnV}TC?2}fJAQc^on?EiffI`Y!eFV4Q!I17>J2?&5ZMJ6zBc-Vs!d{H4F8jNxP z0uZm~wh)?%)0j&$l|R~K1E*aEJbGGMTK+}^LP}bCVSc`WUT2_eqE>Zr;ej=GAlvk+ ziK>=Xe-#Ve>Z6}6oVRle3W7Muh5WegkgPV5#sXDUUET2Q+gr-wDftXnJ9Al(|B%he zZGSFV!*F^=hUy9aEYS?3kWF$u3$jkXece+U7z`R2Ez#3XJA~Zzs~@OHPu~YDGfVai z@@T+-I&mz=j+#u5iIQ)$hwf5bM1Rn^%Xp;I^l!gNoXcpx$b17^D(#t_z4bf$)wDk! z(?5pvVDRy|5S{z^e@@CgP*U!f-*|ry-A>JBDcHuUc)__v)s1(4;bPhCL0+EI#>RxH zsmR_g*AP`nf9CJEzyT}0!4c6Sl1;~w)?3jVm8CDy%aL9vT1B5c9Php+ zhn@&Q#xyIvl_B;7g#jQ8opQa@#&ZV4H=HS1aPK;OL0X6OI|M_4y-sfxZEp!6_ zeVq*3#MCtOL-LdwS@MhDW*_P@f`Z(HME3XhH^-~Hbc@d~ETI!L-%HR)9vcoW6oKgL z?P-DNr#jV+JInzbTwG;kIH!ihjI7*GtgQN4%@^d1hN~8)VWP~j$m8mm3m{30NfoW8 zrslx+R3i{J!9-qocFsm7VVcuQw=goYkN@fzGz9H?8kK_S8C05D8$|4yBID%L)VtH) zi>Id{>c_Xc0!o4I_I5&!UKIfW-?33U@dLY9OG|3+Ek=4NBt+bohy-Uc&fo4Ox%J1W z%LT6+IdOKW;c;5Os2pKvMCGTS<&CE=8o5~S;btWAryqr@9-o#7b75x2G>t+ao8ELB zt8Nce)He`FAMPHN!*sDpUl5%52X7IB6cXz;fBn-1;L)VA$!S3v@u(-G|DXBH&=*vH25)%c_D`f-$uSH39hV=9X(RZv( zMh1^odtV~2#Wx^oSTxpPsg?U^SKVPEom!Xl~ zw`q0DtGE5L%UO??Y0i%&SXA!$BkXi5Ny3hisIHEq&Gu96c!4^ zn{A&#EJ!k+9V$XJB$4t7mD}Fm7C03$GN|)RUEQB*Dk?T>PdltFKCtEkEN~@Fyw3SV zH-C5_*&X%YgY5Co7oD9F`tL8#MXao>U}zl?p=4(Vc`wQi4#Pz3=a9PycIayhFSOOw zYrcM+Jy;t_6ALMLT`UE4{EsJ2PSr3dg9#e91M(SIy)iKGym@&=#BPz9nMulJn_gIG zG5r$%rq_3UW+5T6o2cWX)i!8}mqOA!>euTuSTwD?3Lg#atSh=mF0kJD;5;+|+i$Fr zjFV&k-hH!^faP{3o#5fY0-&(@n-bjNIvYHPxGZXB9&Sm*Cb)vuAbK9PF zAJA1%ncSIEJ=);jm}40p98Ai~vExXdwWRXidh%Nq6(R6et)8?LBoPfUWQb+*-G`ZJ zFQmj&qZX({NnZulD{1dPrhfBkHr!1VWvIhsw7g9QdzBf8t~Ck)%t6#m&CMviNN4>! zz3-5fm0wQ}SFeoa(!GmcD08+l3>Kc;rgoRn@t<{$8$pV#L~EKE-yi0go$ zAebW(vs-AME%~T}`7qd4{oY`3XM@Df!y&5duF_({jWa+%BO3Vq1;xA*5pYmPS(DKpm7E9lv)d{nl93~&X$nYWZBiKoL&=B zuQfAoT&h}d7G8#TjtvV9=~7jdAxQ`?D1O6PRY&KFk|&}?cl5wvcFFRLUk7!(PB7T^ z+t_;n;3H+LG9{f%{TUocm`_J#-cH(U^tiiTBI?_Q3UgyeLhKSf4mMf+4bDcLLL+N8fB$zEVj>mA=l0!~_yf>(6czwGJqLcP|#% zyNK0eHCV)kXPF=#{sk*52ttsWCMRWHzdlB@5smP}q8QE}rKc*-6vI-qSlYd~OHy<1 z-WLwT&-W^E1xTW+s=hSv^?=kwsq(qQ(dFjm#pu#!vaN@>dwfq;y!_F+^|0r9H=SHU7VXK+y+T4lOny)F0hvGMSIOVMTzq_W1x`i= zvnd8EnQa>kFrQxeo=OWxFRZ}lGu)^H-jJp+RJj%C4{=WG)58J-S7B9dLw!A>X??)k zx(4^)H5Nb}j!RQmpjJBEtk;k@@l&nT)!KTuI+5bK%i`iSC*f6?5WDl9RO)7I>`lr z9oALl%r+~S+wN`5~&0s;bW;Vx$}lu9EH4o1n8N&Lm|O@?l(i1* zGxp?DAsr0dPP?L04Y|(Fj%y10LizchGo=VCjQa&eMAUGq-@lD+y!x(~Rq>GEU6?o& zph`;P!0c$(wYGMiYS4x(sSB8XUmw6=(-0P}*p%V5TmqXdEHspI?r2Mq&3w1KG(ILW zvTdWTDkU@Q|?Sy1D?e|APa(K*!=YH(2OsZWeNLg^Uv|9i5)$W*~1}o;$63g7xVT?LT6k^5D;( zi3#sNz(c&WwieQ>)OKsAT9%X4P!(1xi|Bx&{d7pHy|crCg)JyB=#}Kjq8*V9>3oC9 z2{KsB`WqD~nQ5C?lM~)KGV7w=FwW_K$G}(r?By-f%NSNWl|54*U)FsE$9n{bu}h0) z@SNjgVw*MQKzt@x5Fxh^;@z66kBkkyJRhAStv7qMeQl-vh=M*VC3}AJ`6?W{NbE&- ztccv96hOQuW0RQb_5bCHf7LqvqsBb^e?@UHSiPEoH2|bxKxizG-XPONX$K;{i6AuS zcxP^RZ?CIMt)!#`M(k~?aD68wQ9z;$WTM_b*&5;mvH?}O*=Sfx;8k>ZxT22EQ^=s| z8>klx*+fEO=d8#~OY7&Lee$G_VzJEw1<6&Ak+jewt))TZAj^Q?DaW>OubP>LPF@n zRLK6CX?|rvePI$(B2#*1VNU*6!?B(Zw#}xK97V)?R4|iMR;c)>dJ?|0j>(Q$Bvo z^!V{*xmd>aPrOEANQkVma(PD;cwmjCA3tDR9GdNW0sO4_?_O^Z@2#vBX{Ckv+ndvT z{&dQGZ+ZzlYCq`XEE<`gWc9H_xJyl{L4_q;b01c>fC2YJNVgf~HWW0I~F%A6h zfdN}-X=QHiH71=eLoz_0MnPjcFMiJ7SXEdE@du@`v7C9TmG93=Wf&P(l{9-ZPistk zV@w>5>hJ7OyANHt>Xw{NOdMskO}Ubk<>Wu&T(8P&>2)iKyQoUU7bNk?$|}7U8kW9e zf$JH*F;`cTBMfrDy~EX1G{#c@w|y@3k5iFnft85>T0%h$l?If>u!rK~HJ}Q+cluy( zc(|=C3)D}m9pTZSVuH&nKDno@jpk7kSXSRD-ttfhzCMmlAIKjV0}hOgjJ%FzVB~>} zc-0ZbgkvV*uFV9Ym=YI`z6%Bh`j3jT2Tscg?!0AwQ{3sngVq_dqbM4bcwAtLNzBa3 z_Bg&pHzzlz(mL`JhRWO<1CbkI;PH6ApF=V4#ACJos4Xok7#4^VjnHcXL=rD13PKMT z2F?AI{5cC6b?H;k37PIT zl_J12-i>be2ryR|Ujw&32iOikA- zhkE76Z@5oR^1-++F0KuWI)3KCI6g|){wysHxj@Rjb2ds7W0Pn{QJ=FXqAJQ0;48enX-;eG-V z%{*Xa&CT7IM)Cx__3`7!T=jYfooRijh?J6&u_s}SF49zP z)!E=8O85-IjBidzAzr?G*<`bix;kHlMI=HUAESD&T=Uv>P`dDBJ4%IKbd)g0R#JCRo__)0LH!tbT(2t;YSL zwb?I(W7g&H94x2@Ai>?EU%RBV6yn{jE>1D=@&YvU|7RoeaDCd317=)(E4DXo_zXz} z2M6Qf;QZPY?OsGhapaAZJriC5qqnU42=Zuq*dc!1b4{ zZ>B47Q}t=$1+*nf=K$$kQO9_!vGpWgMn{CJy|zO`fO``T)~&m?wuFMMaPkZ@C7b^q zy5ucMz9W7@i0FOCif}xQ*~1mEr^{VUe>Ks)LDcp+S+Hir4#W9$qW#U)W&s$srp&@q z&+OSXliymr6}mY;@9+PqQ2mUi&0d8m5e>1_LwrQ=ochw7;npe>&7CZCAdnWjNCP>y7|)khpE5=fnuo}QIubPMATA_X}5F!x5hF*U6QVZOrL>3oMI zh$`TbYePa#En}O^(Z>sl1_nMCJQjz|R+zU!k5XB--ny~gAZ?|x-fyFA_kscOY^71X zJRYr*#U%Jkwr;XKP1;s|`^7fL$teE=s@O#fm#W13f||Ibq>zS-36})G_rQYpb%ap} zSlvEGLcC@Gyh&i}G78FGQetB3Ba7*{7kQ9D->7%nmaCwo1k$+GU%pIf=>Y2e^;3!) z8ZP7G{zo3KG`pExWu3|blI+b1uAQPzIl(>5kyFW)R zK}B}Q;y-e$+~jqt z+kI+EGFC>#hJ%|_?PUAzN1*6`C*Z(mZ|`Y#m7s;gjo18*ccrL>CSX{aXS#-hHZ=5= zLXc76O-jhBbgnea-@+AVRreYShVT>0 z(a}{Vq{sVq>Ze^>SesKbOAX1-OwfyoiHk3j@ZvAV$i_@qFgvSDuadaWEPYz}E3caM zqdaoeO4ch|_`9cJoscnCwf6m}FuyZaAz$7y+F~Bux%#nLESMr{E1unEwhMoUe%LJE zgn)qAOn)G9?<$eweE*f1WuvS+`!Ba-7PFr*izh9qp;q+dap(xNt5K18qR6t5^#blI zF*ABqHR5NEjtf?&m;}zJQ)!T6HAS)0LyBuj;iKTb=Pj6e=N4(T%~>Xr7r%_Mh3S&G z8IQ|DKcxTiTR;T!{o-sZ87_;}!moUMuC#yp-saU}c*orj?^qr#iZ=;N*6|CcVb97i zC>~u{qn@ZEEHxd5G$>9M{a-+!eSf(A;zNqKj?Qp%b3of%ZjSvyX$i9yXwqj}!YOf{ z^p%*6MuEuSaCOk>SB${#!=(VZFHTn@w8m=Kl4JSJP3BVe^meLBXu*j_#w%+4^)(-p z-RU>irG_sx2DGpRO`hqswzFGK=G1=jrNoN{y6Wo6$`^4;J-xIWw-pQ7FAcBbx*Zki8P`*&d#tc>T{= zQ1FDoCBJiQHQS%{R8msJjw_*SaI^P&wO-p{B3HF_^@8N@@p_k$2{+mxQ9B0*^+tDr z$i0eBI*k@7^w*K`z3kpnIkW5r3r8lM^GT8A8^6zP@n3OxwR>T&G?3PxUN$_>j|?z2 zm(hP~e8I)5d{Pn~vb7ce!)${%f-$XC8vB#?&sJ?WgDi+V_q=*{PD+GWZ6~s17F51MZ<25Dk<3zG=xIV{`S=&j-|X`Fkd9v z&IajAvvZd^o_ovVlUn6MjYvWc7E|}{5u}^FEq={barmU8Nc$)M#k_930S?YT^n+`9 zKtO~JRyjj|*46Cv8)&YvR+&&AzbGwZEiPk~Z%E()3FI^>tgMX*>EIid9W%JYOuYuxZO_js*(>R9!Y$acrF;C^yLiE(kq1;G; zJeA)&Pq#)(XMi{XQN{Yq3zrvYv9W3e>Vz6aOQ281FE(dV~00+9I&~_aEDV`+L%lAG0GP-f%dQ@dHU)DpJA#HiF<|*iH89 zBa>reE#JSFbc%JnqEtxc(}Lc2=)Lkk(9-umk!w+fnyRUxf~oo*a!T(81_y7Cx#+{9 zj3q2uu&&ODy^)doetL;Pt++zAQGn3$54=WXn*wbFnITgQkGYItt0`Tip{|K&85$N@ z#(ICTP37%jQm%5lR0VKD%79m~vpaA+Rd&VBOHF<5HWZ?m)dTqhi|;!d3)A}EMHU63 zcfm4G&;GV;uHuWQG1l8&)hfBS-kbA7E=q+>`R=4654Y{7Dp$~&vd-E4^~1VRAoWW< zHYTh?-vAB6CoDmJBH~Kj%>Lj-t&6kRguB8FNdxYlLN%|==GRyoe78}%|12Qju+)6} zwirZ*HF?<~TD8HAuCWd8XN2wWKg!wsoU>9^UDbetZ@gO1+GbB$>P|pZdirpsWgD_* zv?@0&`geVzbdg{4x?;Ht{gF`TTkLu-10f z=XNyI`pO!>NWlO^olL9jT`IFgbX1f*^uvhW!3AHR4f2N|aq{v)!`(nM&Ae|oV~S~> z8EsjLWxU3Uw+JcbwzP=+Tp2_1KJ*W#nHk}~$4Q=wk z?!H>96E}NCaK}J-Wu*wPt`LlaEf8n=k!2pP4XciRO-&WZP!J}!dV$mky!Qp4;}bg? zWOv=-n0E}2+U>agrDQLNsIpM2w!!_PrpMrXbIJom<79~5jKGl8)W@F3HcS6i_Ahwv z9H+{rXJ#V5WK`XT{bpltU)Yb5kDgkj0a=o|x+d^|8y?a+c}1VSc(K1@wYP6Joa$xs z!l4NL`E#0Fvr5dV0^0C_xpjCBky@5W_s-{gCYP+NtiKrZR~;C91dB@w-+p|6;iGG8 zuvcCGmsrMScz5fO8begQ(AugPMR-SUAgW3T=#o-4l)AcqqXo8Dznge%VEXP|nem!t z;6DJ#HKKp-R6(^!^lHD~7cS1c!izzLh^SAZA)8yX3S(!_(B0;2ZAZAc$nZ1A>YScq z@3F8BP^g!cz0S!Ye5##}gVdOxpI|i?HS#ykVRil?4o-T*kNA(wE^{lR_AQ?XmwKjL z4_04bZwCfRL&o3>78V7`w^l}(_)Anso`F{wB+d3Z%=eS8QmfLHDCxpG4AkQof-9m{ zlhLR?q`am+TmSXLtb#gHy+(dBIT?uDj63vy#z z(vY^Ly^Hgj_?R;A%Ar1l^_vOI3wXjcd!JuO=wf>t9YOHIgfhD820~+Ow`dRk9^O-J z@_XorM;wm+)z#p_aOrWC2>-RQO262cGHW|K<*46pdVxQw&m6nz9hpl^ye|5gfRxZF ziQwBuFEp&!n3&_UvjE|*+uJsRsn0k$7dj*J+|CYj#yJ@o-4;5P5pOIl*&Q~CVHEN7 zxChjU*Way)Bf)RMWN{#{J|nn!^F>cC6<%O6uM3+Mc{j%h@dJGPsRlQ0=)fr`yaZE0 zH4fU)GE>#7u^ipv$Mi1^ai)0~jvcw(n)6e~XKYQ)`QgPTslAZK$V*cYk1_r%0$@<*#szlxU;-1bCBW znvK?-yc86ah-YIn9qtC^^(*{d$-onC_6=&p>vAk(1F~bEG)||xF3Isle_>~jke45(k)mzfUK_TgJwiqViGsaeVFO>0a-NE?i;2nVXTnmX z>BZj~!c9HDe?LI@dnQAtRJ=pO|NJg7hd9qjh4~mBJ-y`D=g+irB&F$27 zFbY;9yx}{L@whwRaX_#QN=pz&O3N@cGG6YlC?Y^~(DYR#kcXES=@C8s8hlfT>8&l< ztmv!VD_FX)5Yc^pSk1NOs92xw8zZ1SAVak4mw*(TjK@)KbOyFFVj7$+=0f=CyfT?% z*FkkD7ECN}4^wDuUM5txfOFUHW0hMhEH;x3Zpo36d*@E-?hV3^2%ba_?`gP_hOEuZ z2+yBNNn@H?q5iYm{{NQ&Ss|g+O&oP{siQ%(0O5zvnq()G2V!5!{hU!M-o7uGjT9S0 zP^kVwvb?2N4!-W_b5{YiSnqeE^=I>;6xcO22?4l%H*cPTVzqJ$F2J&~Tp77CVJH$Y zuo~?zPK69=w$4v9+}%l*ZPn9~Dz`5Jf3BG#c^VC++GVMgbA0V)F10?~A4`7f6oDAkvhj6YyJ6?zBD1|g#}an z{W&0jTfl8}eK+Ji6I1t3U%^yh+riP#&dl7|-QC^ktfBWEC%_y1GKiGqtJDz^BL4T~ zX6-cp)%fnBw68d&O2=^MvTdBW(qXly&cXS`MMSLVO|QNT$tB6?LZw1Q@=!n$KlCi2 zG!->oe$C2K4YB#RX7qkYbo0EI21fqe_Uo_XlVE0`&wL_@=OYvZ<*#?!+|G$BXohfc z!(j@3El%ZtWwz9v7+~yeBFlj1=j#iEJ(QR4-+%M+60)~HOcnC;7KFvy1uO+qaFbkH zlSDmF;&GZ?SP&t0+?f>tvC-zZKQ;xy=iM`Ob_-Bhy12OLeoC`h>c(E-Lqqce(bAWW zd5CV-hHy4MzH9m58ss|;?QlaevNP9))YRTi`{}oOagOo!JC32?Uop~n$_q^p8BR~0EBLnakgAC?clLxc}6If*Ujuy33o02M*I48bI);HIv%gw!W8}OH7IU-TaezVr`J2t-?1xIrP<9 zFY(=KOzqLc`>S7AA01>B$kt1Ck`8@P$OjUPO_;AvjDn!PWx)xUUtdp1NB}z?s_>5X z`49o{m>`;!XAjNJk4vyg=5qrF0*3n-WW1ja4mZDi+5YIrR4AJ)8&wC@87!EeU{In& z6yT|O0GnOROjuOgKfo!yhMvFCbELhaqxjo1)e05@+fZ=^JXKYD#+BvwNRRj%XT7xF zzU2-u-PwL$Sy6HMqx8Sp`{6BEiehk0!`Qa9HIpq7Vvxrw%=0u0F<+1YE%5UE1j-I! z|KN7>Zg7=HSWMQb4SVWqN$fWF)mlodZQqruo|s6b;2 zBG|xd0njY)WR#Xk8kZ_7TW(JVK=Fm?qIT8xj{K*kp73m?PhMWiC`nWYGn--ON{IJs7u>Nw z%$h4<#chdBpZ_jwGO4x$p9`Pu$lQv>CDWJTxw7jy?<$!Jl?!U=N zl0waDWJF=%Mq~hYwPu6Uo{nmvCKV9+)D>vw=jS8TqoN}tMa;HO&U_^2*EU`TubNj@H#g@})Q|Cu>v+!0hG#*2c@vaI4`&=lx!=e$CK| zul*0l=boU>bLd|}0E|aUVY4X{&-epK6o}PJUabn+EzT;q(<`RR-M@c-d2J04cLO6M z`mIL;q*nONP*;QDW2Yz!3k&!oXaDnavbWU#u55FnRt(B4aL@1~b5BvoaoC!CfYD{t z&F6B+fW2MoamCm7Cr6QH!NeW$%%JoB;7Y{l;fBlc_S+9Hfp9fmtk(uYQ0$FT!{6k8 z+(6Kk`qo6fQezdiJrtjSX8i8#RJic?@KSF0C|!n`nfamJxkQ$vMQ6WqN4x)UMFGhU zKMjor-Gi&t|A;F8T^jcU?d}o9zu%r7&5+DmS+yR}k|g=kp%04<2`MpvCLUYxcMz;3 zjFT}kj|32Ig+?EJaEy(M<1`!5L@bZ=8FWR-A?^kIja$0Ndnbog*MBSygKy zMyhRwV_9a(pM-p;#ro#sd$~S4t67Z_Ago*b`oY6kDQ7FI98IR8-%nPJHpfS2W|n|g zba`sJ1|fSfzvw>N=j6n~`xpfr=F68$A-|hogX-7Qoml&Q&dTd!4X&H-ot1@+4M7Iv zS7o+qhMjZeG*RTJ;2rk|8b&{?WUFdo@@X2p=pd3amOf7EMby5M_cLUgg%t$_BI4rr z5U$5^`NlC#;NiuWwxBe|0U)aRdz9h>?PX{w!70`Rnim0i@0xuwZz-N_$iD?sz zDrA%Sl+Dk_%U&i^M0fS~_ruPfNE9Z|*|fH`{ru?@GGu`wL-r`N@nE^3KlAhK7csqOBnJhoxUyQetgmvu3-I9Yt`bCMYO2F%eEVcvRQdgL9AyV=yrC z{-s4WaPr>_PQ-n-YU5ICN5mM}NjLsM9=c2=x`n0><%^3PHay4(7zw_8x12mt;{@}M zH5(7Jh9^px){M^AuaVsXRmdrP@*3l(r1vqLPIgyT3y~iyp?&zkm;3Z!pF=WQ2FTU} zy|h=n^n83yoe>WZ&)%nayjxZxKmQUFV`6SD%Ah~+t3Zv#VYycu`gK<3S!_n5Zec*D zAwgYfbA1LoUyki$g`h1+Dy@(Sle0Kf>|EcIx@$ar4*gv1_HjC%}p{guh0Jes8Ckba@rUwHxfJ&po`3IQ0i9eS=tK_ zxnb%hlLZj_Ct-u~bsbd}BN@O?{h&8mAGJAgy@b&1wjd(Ob?37~H+6NDrS3w+Hn{kJ zDc9)VxV1H#fO>kBU$2X2!^w^>PVMrZIlf8Bs6BJ&j8<3A*K1=_sj3Mg^62crr+o@j zpru8;I@j2w*jORd^RH>i-oBT&5V!F@lkwHD7cWokExpoYYU}R)@wX;}sW9-Lrc^HR zO%s+|1Q0RaJagpH4&sFp;1y+6nm@Dz(&W_=Uq3(frv29BT+_?ssPem$kaEq($05Wd$VlYZ zObUHadCSDa3M4jx;i{Y=kHv&@nL*bT;?3c@e46M1jp3Wep-ru=;{#=%gcJUPtD%*R zsgRkG!9u=zISQPf2|s?QC@sHA{gR;owR zg9GqwGRY3lUHv;KbdV8z7m^bWav3cw%-zq-Ewm@mu&`*pE-e0zfzK8TAsU1c$Lqq1 z(5!P@S{-zOhB75(Q%0sDNS@~3CUw;Z8gO|Nliaj4J#**QmKIJfE){JC(idph*x14~ zJv}{^KfG^gGT|fa!Cn|lQ)=$Ez`%q0i$ul)`^bohdqhyW{NxRUsu6l3W;!~FRJnUy zN3pT7H*VaRsIgn?jHEw3T{yC@udi1|t1K_S*r=S!<>3wzRkVnXR8C0o=Li%`ZSU#P zskSx%-l|s7U2H%VrKq(O!&~(Kl$X8c;xc23ZeFmi(ljR_sVHQE+A+RsaM7ComXmhl zrKXVAk2$MBRgVAl-23IJec1*EVHhkc_e_s4331?*Ydn<@`rX%?isa-(X1~SveZe|Y z=AsZ!?4RPYoM5SE>vTI+96IywsX|L^=6^kwd$;c1Wqc#@)LSkwCY~rho`_y2n2;q! z2yJO#;PX&HK|s_sknS9L7lC#+-@LyS?g#ClOob;yLx#T@cR~E;cyW3O&R?%Gn7@K& zRohdY%!AE|mUjOvvj~Zd(b4lz3jEE{y};1EwnsX<6O4$LdhgB0TiNY%`mmCMViiaQ z*4HmO&gUvOe@@ikX8qlzJoUHHsJ+R<{mN^0#8_p#MTF{x@s_seL+(SzY-}6A&_sGcm^#?beCzVzfO@h60Ah3ii>ksWd}7i zHEPN_|4%h+uE)=Kd3i&{T_JEIJKOZy8-xm~{ORO?SM*=6iuGtXh=T#J1nG&74=12W zd~Sc^UYOoM{tk6*mQ13VxjAEW*HoR8&2-Zhm+kiI1oyYjFoHXAFXas1ym?v2129dB z07~RjA_?*Kqv1j=d~{T(5wGS#rp(Qy#X{~vJ-2G`CS|PDh-NT~%$;Co!U5Eu80BT1 zWD1P5_b6!^J9_YK*GH1x-MX6uaW4bI!xN2-=O@izZbF}T^Yvztkl&1o3iaCX(`PI! zg(43Bo?#DfUbkRiQleF3n^PRG$>ag=@5^JMxO7@2BUt0ta4El0H}PPscdqcydA{NH zH_!Z^_<&)RYO1WEA$4(TT}W?+WOO)e1tPmE)8jMaqowo^z2+-g*ojW4b&Uwn{BV{?4oTEVNJOLE%=H+<8g1!m=^Whq$d zu#%xGDCi}?*{#pWFj(k@Lx3*XC+}C&%SHfFU5>tj!&8=POwcn>MR|MU3#Psw$S&p~ z4SBsFy8@2GLSS!?APpJL2n2$2B>)9%daY)+fs$ulXjfPR+tx1m8BdWX&@0JNTb|89fyX8Pq7>}iCYrY7CJ z`>`!tS01WZS9n= zelliDR99DD-z-@VdFbirkP)#`nP#xi5ZmV`HiLTf?4U1Lyk78ynz76VpE5J4`=D~@ zN#>W$Z_MHeOiWA+4TbPvHUt47VY#IapJI24fEOH-!e(cu?g=~XlarT#K?tU9k5}6O z+F4R)R)k z#sXDlLQn|a0_7g0G6PHzoYkTx$&wY&$J{`C;V&p(`O4#a&Djd=JG z@kmG2Qsa%_&8Q3ZBH{9)N6$`wMRL8w%8svM`f<2B-TnAO>l9i#+p*u=!d4cFoDNPKfVp&72Uu*ta&bbt$U6_hym zBh`-EIDhFQ6huQtJRH_PGB7k|Q(4!-yeN_>ArerTS-Zf< z=;%cZf?U%lOTFn>WZcDMh`D($$fnz{l~a1n4eVl+=)xtwIV|SKv70Z=wbm0KzxWGY!NoWrTi|`80hFll(Nt3d@A|8M zkB)v-*?(^G-_#Y@xP1+vYJ>bIJ>8#=)TK9FOh;!OQ1I$gd4mGsWWY;++Ie~2dwuD? zIC5u>Babz^k|tw7`jN!^P^YP(q2Ma91}~O{4k9dsTvBaY>-6YItfqPlr(LP_ z$k2ClLx(vDqxmlZ($w7@9RO)>Pb6Rz>uRGSGV(FL*o9p;wKo1k^A!vSV~91P@4M{T zb8@j+d~@i(KG-tck}mGt7BN_KgJtS{Eh>$iPLqaX{VYJN2c|Q-i$Ku%#Fs=L%kcl5)3cIji65+DHI>`0#tEsFk zc2Faz2PlXM8KNQ5MuWk>F_*RVx^cU(pywUWqpfF}ae1k!sh&F62zcuwd76XZlLxM! z+S>V0XN3^9>;0CLd}lrKeYn)}y^wrnFbC>S5Wy&U6c4Ypv~0CeV3J*oZ%t3q>N+n? zIc9ly%Ii@0H439k+9y64X9NKcP@-J5M%+JcCnqlBk+ z`rU~>!&aT(W)F>JlDVg*Mh%Mmk^r6Fr@Z@uDQa_gcXPHmFgaOKvy|2BSI)lyeUcou zzCGB&BIM)n&tSQYEG?n6JoX!tk}2ACOrR_8p!=mh51H9^g&NUmGltF7ACpM<-S*7v zEXov6BJR5jopY_>Iac3GOR=!A1?*--rKLN7rU>vQWBCI3k6(O7Xy|R6Ek*6D&^kTf z*R~*&;dkHDdvdSMnJ(f4_%N8LAoLh-1NJ?5CTEKPX$wZN2n3kBz$mp}_4Q)pJqPQf zf-Ye4FmTo6R#qmOAKE9z5zREui zB9w#6Roi54TkyZZ>9SKr8h(46JO9Ro;hattnZxS^qwzqhqbi zdc9Bkrf_Cu@8Dqn;N?-c^-ly6(sD&bwg{;+zxU$sSH*|HD~8Dh1vD`3>cUr)e0V52 zE|!?n*==G%IYSo#$JNAi*X4|}xnAknVBcW*(wM8Ulld2BmhIIy#0))!D*+KDrmFJsll%CYN9I1(kVt z9*`t-UwG=33|nzlABeHU?EQI(6V#aNJ*06LU5tuK_--Jq0(7Qkt9Nf%8XGm-7x+=S^#a|`cV*|U-?S1A7MnOA5 zoL6SJigXceCM9q&X~YRu{SW`TBfPRdEfV$-JI+<~YpyhyUwiuaY@&N@jB&4R2z-&v zI6n1Ijkdj)+zkdynq}`k-ap*!h{-uz*EBR#Z0wu;`y57LAt9KPpaSfF8K=z|6ue78 zgf5om(|Z*+ldFo#%fFYGE7fWh>Ye$bT(q{@j+B*BX+S-=y<^OSi03J7?C7|OfSgs& z+S9_~s-vPSd$;VYS z=(1nkgv(vh7$iK)e;B)yXwaT=TK}C`EWC984T_)=69-2>ut!Zc=H}*r582q*$h^eM z&Hx_q+CTpQX;7%fV7y~p_vYGcQwU6_q|mW2Gs7g|as2)D86e_7>SU*f-NbTU{*wk; zGA=IgjV_N3^owLrf9d8V?&Wn3Z&NvOARsz@2{3u^vb3_XVPfgQ@q5|WohAz>X{8UO z@0o>#zlVlEbtRvr1OTW(0R+$SNy`5LMIc`ck3U;T@{t7h(FtO&gZo9!RvH@y$=2M-pFQR?^0rqG|N6V+2Cp{r3h__8zwFPeEVeEUI zytPu5@e!{GAcdX>r0-5E6{lti!MG+JdF{}j0tFEf02pui>Edm{GnMG@5z*4_Z&ePR z$S=;ZFd1}1ghbvd8Iyh%C2yVI0sg7N>vz9z5{^WK)oJh0L9%!MlIR#prM zS8$Ymp^$lD#;!3hq&;uE(PCsjZ==kKiU?{1Z@bK~{I=hPD>UzOa|J5nfM^pVR{(HZ zi-~4K#&bi+fH^`k?Ij@cQPR|^y8n&rf)$i!`|fcVczT$GP249!9X>b&Tzoj}larC9 z6?^9mEpCfGImL7aLDyF#+j9he>qHAmfGZw7dIrC)^5VUIR?Yz~&HmW(l*}Zmt>Y`h=b^`&P?$ddip;lHMyiOLj`U<1{^89>nAW($SEf02= zD`p%x@^p@jfb04V#2?ZPH#;l|VkLgXg6Gu(JQ6S3`R?1L+E>dpAB1cN6~0dEuKvZUoR2*HgQ;`TT?-f-!_i0IQ-bTO4Z9S93aKaX^QM4!8BM|LO^g2S<-cQ4mmt z3nbaXv>C(hii)Qg7#P?$$grO6KMHS!5?zgf+TN?5B22=OCqXs?R}s8P{!K-NZZFfy43v3aRov?)JYuCNeLi+W8!) zE!KvfK?UP9_>%tm^(u#jDGS+~$<&aQMYQs}xMWC09pDiVfPyw45)fXPZ>p%_9wC_^ z>d5Q3GzOrrwN;0gSB-#+?i*?9b|Y5Ar}lZ_WGI4|s;kO?laU#I#5{|F*y`Xh`xMt$ zfB#?5NVW33$xmC`Yb={*CTL015%nR;;~mzNkTtaXo}TZB`-e*goj3S6?TwHGQJ{?S z!yxRdEfG$JXXCXEKC$D2BC#h^Sl{c4V^$*%gM|Lc_@I0MCSQ0f{69v;&);KreIGq} zBOOz8Jly~O| z=Wh9>35Us3hky1pGB8NbXt&(?e6?PEj$2nm$KPq`BmbOTiHHDtp{7OmQf>ol6e%fC zLWJ;xAS&c}YVR^Tao!8b|EEyySm=T6d#X4ys_)d4jwnX@seCv%`2pR&{Ov`1x}0vQ ztvz^BaL_w+@&x{DNu&D#T7!HU|WBy~>aK0VW7Fpt+?b&M0VFi3EPgIdkeB z$LWCq+H$Wd%FnvG4;36m-sh8;*E^eBoG+!Xa7KY3g1y$^Os>-@bkoVkWYQ$D!1E$phC_oMmTz(Bfg zh3Q*Qm;|M^Hg=%sOP5DjZ(F}%{L=_fMpgcc79-Y7CG_;u+IP~_6vAFW49jLjM1BYk zb_J3LesOXxfK;wj_dDW4zxINv!R7_Y{qo#a_qeQ)r%xWc&VP0ySWsEX$+2@g<(c1^ z%qbfh8S-#*)L^%*tc*#sI7McJN+)sE{+d4Fd+WwV7)r(;BHPS+3Bl#J>P^8miYrH6 zJVaqhNlvXM^khP98mC#`?c!H!08*95cz4U+=45p2dvUmE{_n^<+FN%$d&4f@rJ0Tz9q>w?|mAa=OK=jvSzvbb?yMWsA;dkEp8K{>L5Fkc71JN3bTV3!+vIWVobGt z7$=+T_1A!U{ne#Hq#r1s!d})|fEE~pP5{vx|CD23q6p^*&?19(@X6o*Is~1^czK$m zm_&a{AnIu`iI0nU`2n~eDrNG3uef|CzjvC3^P)_IL@Z0jzAb0&i|YH(^AdCIp`lN$ z{et{)?LJ7?-Paw6p{?&-M@D zdbPtVFgMSF3qvIbR3d)Db0@XMqx4s6`1f`_ArKWCM>;NlOirEvaXmt>FB2u4=5`6> zpf1`sz2-JIYoPgrUe)GwK588(NO>3Tzu)CB8y%1xr|SC<9zMR*bAAJRPu1no%|}W; zoSY^N{wwxA*%FkWg|AxDLN~P6XKs$19LQ+u?fzmhld<|Tmtncwf98rWydu^i3WAw0 z1c@6t8(Af7JG+9AxM7Ru^sJa$z*wG#pMWua^>l5;1ODd3At`B%xvO#h0vV8!tuRf~ z6JE{`fhy>`t;5Qav0KnE{QSVB)%#`6uTXuRWtq_4f+RWgfdKX6s7vqd z9q!jC&-iNOs8t>=7)&iMAFlFeW>%Putg#@r7%o_@Us zF{Y+|Q{pERyr7GKze|ytmKPUKLYEOME#BGjUo`J(L6ajX+1Q%<`tHEU0a>kzt=nvD z6q=e222nv66YL_L3IHa^Vhb{?Mc3AD>@83JkAlpG{2)syJ*^R9X{mwUS6<73$4;s+ z(HX10o}$8@f+dda?K5Wj@O!J0D85Z|*{M|vZ$*XVzhQ?8e8G08aH8IS|6s== zV?%gFPUNkTo_zhRX*LAf$y!4i8Dbu{ox-NvoU8<17xTp~!>}-3U{JG{n~d6qt>}bE zCRp&lY3xDM{`tZ9VSa}C-_^>>GyLO%PDG3}a2MjbYXi-we$l+MwCJe`B)MR)fK=ZBo% zSj`h;Vfk(*6QH1R-uwp@T792|&>!9U=S^^M@FNj_c4h5MDwv#xi|%(f@LQ|^<=wzK zy(cl!TE(~jcQAw*+q0EyJtkidI++OzXy)7iE1!69x5Z@qHEi5#ZE&dJLgP_XrDLLFl(;%m$|2p%Pd$$wu-teS^zop- z`}EKava>u*AM4}MMXK-O)3eRkpQ&SO=U&XX;YnJDR(Mpz(< z@Xe@p5obHF*SljC9bu=WHO|dzS951l^neU|;!AK)ZBH+IB)33KYf(Y67ea=o1 z>9ND0vj4N+GU|-PIX6Ssc4q#AE}`{AnQZ0Z*sf&Ns(Q!`vz>GE@^Us0rs~iTuN)jKv#aFWA(F$% z{Pt%h9S!nfOfZYn>vJ-=`(H?d*PgBluG&*|C7|57cH@SIW*n-okUTJstINZ(ly^ZH ziTLSAX7P-GF;+=StIB!Z23j2T^su_6|8lJyHCtPjk&)D$eB(E+ruGDe%GJ6%B~@WO z1GRt%c^L3SK<9@EQHS$BRl9cWxT@mm(5NP`Mu>`6yd(%SX>BLfY!i0s^11re&z@K3 z(+t41`d=Se@9p^_$bhMGib}l>$`qJO2`Ip{-P1MwdQ=#bM|k(o z4)#6_^c`j0*EjpcPga!-C^8SHh=UO)C_Z5CfMxOZa0j0y+v+{De;<~$dTHR=pbKcR_lu?*eSe{NTTV< zf;`Q3(iqgkUWs+N=7Ov-x#1bu%}Cdkfr%2*O-w&w^UkT*BjwSw;wDOY|vS}+BNAI zuMQ<-PW-kZ3=)$^fsMv^=xM42UE0;|->oezjrLv)XprA+F*XKTd?mA>$>ep@9I9^x zr79$TdkS`T$Ns6Q{e4-JSfpc$s!^#6vGO9|r?lmBsXb9NyYvCSHzEWG_XGhiCm8<_ zy&=M=FtUngP(RjDe3IxV=0`uk0Aw@H<@oPEeW<>5Xti;rdVlIDJT3+9a5~LcDdIX9 z_|-f@^JmuHqer|8z9(q7@}|r>Uim$%xv~3phqfXv8+7#;2wQUDg5N?B^ZUt??}gWW zTW3vqs>)D(M-TIHQIIvK<+#hWHKU=JL{H=I(fmXfn5v2+j@Cox^?gVrUU-RpXI8JU zuxc?vL_aYZ*?pIxL|5u<`!OP|votO$=tIzvTP0r&G~z1_KKaLYS#iPXU_%9|cy)?0 zW9og$-asm@4OK#h|K!#z2==tJh&j^zYPEXLZh*Xg0uVaTTM7=o7ET7bn}U+^AKc{s ze~}jc(A*{~3rj(d2ng*?5cD~Fe_QP0Vq$fm^M>!m`8kv$W|I?PYPq+Q3jlVUDAb?+ zZcguWW_R9|K(DR!;Ht$Lp7vWDkhtvXcd?)a=eJP${pk_PzmfR4bVs1YK^tXS!}aqx z-MY{&czb)7lXu?r0gB{W@9#s(7Z4$dPw^aqI6A60KB~y7W^#gI8xXXWUGPJMrGmiW z?x*$W$6ylP-+%tRGjn`Zh>oE-Jw5$xW93eEsLN(?02Ufr>Warir3*#WB`JcSOIz~W zX+Z1Rg7oF`R9Fq-)&5DNIj-sIE~fqQrtL(aq@=gG=_&%T93N>} z$$sqvr-_Vk<}fg=qYyESa<-96Y)ns!TD%<^KXe;mJ^J)E=~jaM176Md(<0&|{BB!I zt#5fR#%%v&dv>rb%3`lvl8DDa@S;nqIheEOE~+ysRvLYK!>gdc_UM^BXhrePx4K5K z=npq0?OZ2`yaoy>rQott~Ob3Lw>(D%yD<5h3E%-ic& zCt6jZohG3~Y}9;w&_dS_+xdSl5}IVb?8Od&>J;s|^x^g`^};Ea6fwEbWk@ZZ*MEQ# z3zrc@!4nfq@FiWCOk8Fxl^GEMWOoj*(W?LDn~cGbGC{f8uMKnCIcQ@w+W}!wxNGXYC5Ef#2nHF*9q}Kw` zGLJl5Td9~C6x%GG98g08-0{y-5gTXc^24VCLTy$E-Hyj*xaVVbu zbL|?-yh#I~^`C3uEpKx~bGIj+FU-9$_PK-%Vh z8z$#H_xE>4d`e7gT=YR8AX6qG;Y9p!kI+$5Lq!0eSEz=GaJ}GrK}n}5v&QF+S0E2# ze60t&VCaqHJ80;<0wc|?bWLEcASvq&n!7~oqRc_~p=~FATn(sE;Ugu4aiG#5D7c1z zaplzED2VOtR^jAmwaCZ{TcCVZw6wC_Eyx8#Qxy^t)&sMO69wf|_)Ck$6vKzBN}VDa z0lGFeGD7nW418TwB!Dn7Suir)Mfo{4HuO`d{KVzCy3V`{H8{sIseWoD2L4AG0~A(Q z#qdLdD1MK~ZyL~av7Mt@pxoZxwP0$pfbb2&39aBtVNe@RVE_q&l4=wh0)CdrFE>%X zT5D<==scO{U0VXM|c*RS6R5L9grwUv}ZUTjSpI-OaYIkU1(Kt*-;vJxrj z$OCNRH1eWqcc^H0b?}m3|JNt;UjLlx$M06U$2vX_xrQs$Q#z_|vIb(2Bz#B`!NdxI zh(BSJj`lM;EZm57_=i|8LT|Us$>R`i^3(iBXsc&~q8u$zmzUEb{7ePHTwaMNMcW73 z>B+Bq210yFhDUtJZnn=OFYQ``6MQcB4-Zni*0omMorPy|ToHvu#X0Grsa|mrQUm8t zTtI+y9x|$m=5dfSSqUfMQ6HcF&rQuJ-~`pw)MnAW!G;K+HDCo~lnE`KJgK6_2i$cP;X0pNyIqVxXi(!aWsim0g5)4u(%dsRrDn2U~ezWd8>6anI&KiDMk zf$!gGX_MsTbuK&7*|n_nm-K6M2wSA4)=yMA%nua_%Ec6)CHV|M7eV&F47OMAulfQ2 z6YORh^qdG^CNOGZk0USlMoN9ISihSb9F@|-R`O=C9Q)^O3d?Q{9bp$wPVc)ui>Wg-xE1us23o(!vx4F5Ag}BeP z5gO{SakOf06ONwvq*VSYDdN`WqJ3@HUg0)_a%-JaD!GLudXDbX5_Q8!m?WVFc_ZW<(iq39a z9XxDnZ@<$s*V+zl&Z464$oP4LMZvH_`W_KcmS*_@uENWg=)Hz|U!B&5+|!r38jY{v zz%{17{F0Eo%6`7CE1@~iZ0UDmiD~Ggl+p4en-Rx=faf9hj!q=9qP4YLo}Ns1dLX5% zazqQ5=I`r+2{rVLU5Xn4=Pf98xdYkkJuAZ&@#Psyof=!k5 zdpnn^YT)9+FAAP=RW6%Ea49*AZ+ANq*4r5S5+_IRt>?zC<078@N=D?_iiC`es_ z5U1jzqHMqk%gyE6wO^B1ti?vFIk4778jC$QX{w+VK{hp3$vU6Te=@k#6=Fs{ME0fc z1+%9=Vx$rgh0_%`ux3vx=(T@6)PYb|Ow_-0)5PigY!;b2s^s!VTyDebm{>}bhbIF6 z2q!H0HA`>6@dNE~bp!(OHBscXt|9mmiHTNKRYlwe%_J)a2cwIz#Zd`l^sWG^g3NK= zCL%JDl+7d%z?SjxnDsuye$a;xzc$7bQ=czqY zxPt=EUeN(kS@srzDD>6cY93sCGsgZ5$GmK|FzX?6 zNPv=(a?KAuH>CLJP_&1e8!P=03xAEfQ(>W5Q|?srUhsqAa?@^XX=~D6Hb8Mq5_n`} zoYGC_+m<_coTQz|a6sAq1ir&u`n@kE&~=hU^ZOHhcknZfP6TyoG@Sq=BS$(6bS&yP zv0qtflkWbL#?*oC{Ud9!gQz`siiV!PlL4>kfr`XZa~}-bNK02yR5Wmp7CQ(4H`YR> zXgII;h?cMZ1b(y|&LySRb$xltj>aZkXLiQlOF5zwjoYf&N* za!qhze@7TI}P>gplC$$XQNCL4{9ez@I-Auvyz>W zft%j6_w`5dh_ZSju+KhV-W zrlO*G-Ygn9viInWq}MDZxpkHOHyh8AQ?c%59R&?0CAltgwx4lp*1mGJjKOq-!aq3A z^VLo{WqMdrlqvwjuw5@iYE%pfiHKf^f+o#^2NivW-WH#3nIZxqbPg>#ai6wiq@)r8bZSnX*u?YV z43B8AT=P!gEeFE@n9a(?ezyIrAS8slyW?+T)j6THoh>NGGUek-}&@DyquQ z{6EUuU8SY>B=_$TMUX146v7yA!FAgE&(+mym1JW5{fqtm?OPLdt65c4nj&t1DFt0W z1r?P-HrU*~R&7z;|JfP4{3W((4WEmbHA*%JFw@o965uv~v^8*@0fB7y zn)q-bQjOEor*7DlP%$i8Lu(71;>d`M6k(S-^&_SpVB?ngW?ekHFkL31DQK{tge*`K zqzxRhak4rQA00Xugy4kf+imMAEBASG&*=_WGi&p^tbIF-HP%d{^ii5JH8v&TDSjW& z5vR!#9vNRFSAde{aX zU_>P{&-?fvh!bDEXAEI_EcmKO0+6Wmy;x2LB58$IJ}7ue7En3CcfT`95IBfweC5Oa z<=$rKN4SzBK&|%oh2r;dLgUCb**S=zVBsHk{jd-si5WE+RTkS9O zc`@3fQ3bspu|UugGKbqp5NHVJ4;rACnS$UJV0N&^f`gNkukF#|Ozu0`pCzK2?$1ch znyYwwwZ8eluh#2)qyD}w68E4+V|}c|t?o0CXx~`FShBbvxkjbUb|bwhv>n5TS%_d+6w6(O>E_c+IMh8WWGAGwEntd*(I|JDS zXu6IV_Tu~Va~k14q^&})<+Nje3_w5KJD!bmc@$NUv?=&~bYC+nu%+eaP*c_VW;_Kf zQ=f=hT|rS$aByD_?fJXpm++d7j*l4`7*^=;3aJGJCr3w5;k3HpGfa#Z8Hy7U63WPQ z+LxnVy{5BRPLpC=+3%*jjY%*_+~;^Ffm!Drr2kIqBhK41tyVNCV3aQ*C1pKc<-7hc zL94FXXrBec~VRd*I|Yh|iW zq&P+MP|XKvjlwRwyc`256u2B|WnFu8dGFS(Nk0Daa@$GpS~~z4Xr89#+L#+mvgABF zJF^l;J7N^SeH44AxQ?EU`TD+^JcaxtQ9IElToapH(+F^l1))~uzOF)pHBmeUw2;yzWDz-tg zHE+Yg#RY~iWkp4H35!=R%~z02kW5?)Z&P3}^2?Xa{Cs*rpO4+0UDJ1rzoiYl&*A@? zG!FS`FERt7U~vLWw8r2ncRJiS##I>1w}!j-QHmc1O%VzD)NNB++Y+Fn(xhA%G|NCi z>$mBV@R?>vmOFLNfA=+zO&EB>4w%LBYr8AFu}<6XN}3{O$@bUUv%R ziJ6@^u*gA1>0swPx>)m8)k|D-*MyOX+sdR<9CDn2I`=9J!7e$8)eYJ#5fKa-Qlu{>x%Wny9i9i~$v27D7zJXNE)3|hrV zQzN7KMM8jknW9eDM_tN9aBv`-vmRfWUG=DMG=4g&j_~D(i5ZS!o+Kn7uy_1UlL99V zs^Pk}HZ_=?w{C_Ak=UGYo~%uSd1^3cexM(JGU_UTf7Ghn5z^Mqnov1xY@{L)^!7Ve zzJ~b9f*aM}CgC26D!70i(0W!RCW^rNl9?&7*p;`x7h6p7t*j%K-0shDJ5pQpO@Y&xidDqv+Ugm&<^FktE zcy#pWcpQe!KK7nPn8h0y)P5u?dCbr609BH7XqquwnFtE|OTeh4WM%msTjZWSi#(LO z3lIIOvb}A0a*&6dcK~A!cXyeDg!fnH#n;$?Rfg^J#G)~cs%62u23y_P&kUU*bi^>p zxg-^p=YLuNYFb*R$7(0FrJ$}04rWkS&-%>OOhe<--O<+7*~v`D^!W~9c;x5Dhtu-# ze3)kd=?jdxi)cP2j@o;~w*YTb?AkCjaa*j6vX8Uy*pFPw1&cE)N<<&6q2V}(rAbjj zii(kmiIhYDjzU&}D_Ag|PrXLIZ$7B;h$@Q0{!0Dgg`|3UVU{N*8CjBv;`)a&`=<}Y zu2G5kjbyt=eEG!A`Xt{h$Jf`_-yJuFx|E$4erR^O3cq{>L-aFnGN32Iy?3u=`jy6a zGX*#rANf2Etf1-r#%)pt&2bt^N_HrRbai!a+_*6Y9T4#OeFtdU_I@X08yoM|6#??L zjt+f}LF5CHb)-+X>(Lg~=rhDuSpcb6!0NbEz>7x*S?dCKzSVnFguTQ4QP6&b+`p~! z!!;DLE_mEys|h}zwV?~Ej7-SY55g!`3#%a3DgIFz$3Gje78o11(|}GOLXS7Q44Hc#LsmIw}r*oi=c@D`qGqeY{HJWOw4`NQ%M-L?r=vrP-%-ju&WgedGSaW@C4Z8mq*VY&q7&@NA{(;YtwrW0~TB*ft z9B>nh%H5yT|9x9V!1?FG%inH61NE@vN*0QCEafRRFwDi{Ajx~K0e=Bv z$K^H#x~fOeG%=R1hL8t4mvTdY7=brwTOr0CW3!rIycM#fV6@{yrv zmsOK$x83BnAV50d^R@2TYu!`=e0&&Pq}U3E1~bt42Tf@G`j0cUwU`D62g`jfFF@x^ zS6%udoEl_&z@xl{_JsS(S6@ebHOW<*R@Tz$n2+?K7dfw#vHt0sA4+ za6K=x;vTCi^(%F9C@Vn-aYMp2Sdi5Fqw*r2dle0JqVR75d!bfTbSsY24a~rcNWOV` zdzYW?JA{PFneg632-Q5yvyv38j0s$B6{M}2<#yS&dH$RL=lB8g<%aKI^0X-4y)%K6 zSs#@ZDY@<+-mA1YHJIMI&IP2}qd#u*;coqI-fU>9JFk9{uuEX;ar89vL*2)uTGD%G zi2?pt8>9rDoctT!T63k0t0v5j_bDDelyChQNJfSeRuRuchLp!&MD^vlgTH?aJ8y3f zv+QkOA;|aF*0f9)A8BZ;;DCuw>`{m$B#vAkV^Qx>| z7}`khgg|h}slM8I8V#E0xgIW~F#IxCjYV5sJ#k$gAuj+UBdtfrN=rFRI@CxA4#NIs zCtIdKUQY+&st(I4)I#+P-Ha~MDVcrmV4HPxbt`SEknz@E_TiuQaj)99w;)TlPE zp|PA#uhQ#s2b&#E69s!+H^?-cnT@I3M9}gGB0Eob9G|+m?r-=Iu%1tdGpn!+)zb({ zqNuvb_77T0iqf^A_hw)w2zofq^HPgW(vV;498iwGiCB5AriO__bk7W4uRmN6Bu@+N z_sp6lo1h!Dsxky7X>A>>n>yXY`nv=cgy?6)1>kK317+J(w=giFDu=dIo{np!Fd@MQ zoUTOPgVzt^qP09PZ#9@yg^==B?U;W4yQziV-nsMYWWN1sgl-4<1QnOv(+99VeSIe{ zr)VfBhV!+9N=$84z7IV_u$!^4=+emS#B)1zmY5bqgJ-Tf+)O{^0)m1zM&^^hQF6KM z{E3b(uxf@!`wISU3~~V>>-^leVeFSM+J^xms@rZ;3GDT+6H{BQ9LGTccLkNRelqV_ zH_T=fxH5M~9=<9!y?7)&`)#xH^LbQ0zY(#^#wnB*sscR~3SKcy@3*3}|Dn$c^tbQ7 zVVdUM(Rw5)x+9}7bweJhrcP8{8KUs=B$bq=IoFpCW+V27@w{L<>g;=Zd8g#$WatPJcr_)Yudkma16_rhWmdy* zj^Ch?3g5c=`j)uc&YYUi&t=$EuP#HE7Z(@hr05s3TCMCHzr&;!?3<4l)nRPrZ!k#% zFFZ2Ebvi*Q*Wg+wJ!fjg_@HB?b9p-IQ6_07>~|9YDq2 zMVnoJKXK1&PjWENrxN2P{~Q*XI}FxafD=t3O$!rN zbs_AdqZfO7y9{BYA~^irnx5c5x!==mTb-K9KN^VmI)aBk@4R`y@c1zRjU_tg;ARA= zF@l1^+Hkf_;M;YCue+Ff0R|3^UAO>$mZuS16SX3Xfo6SMI_Ia(lqv5+-=?HoIw0HP zTokBubt=w$&41i_3Pt3@9i$t)9v&DN$>T~h>pLK*j^T4NS5d+KcaPl;i&T+IA_2#vC+>T{ccw)_~_q2ajCo>eeP6wnHixdZ?KHhTMO||bf{sZj5w8vX;5?R0{ zXJzZ(?5m3n(7BGxF-n2Wcl~2@^Y_t_Xw_}e@9g~pOfJSFr1UP9_YO2_O?2mty~VCo zPS(~^l5@-oD91zH*wh@V>yH^j^586S{UHZ6Kfj`gi1BwXR~%pRX(}DX~6${5T*$qtrtAeezcmkb{Av4;Tk;+u5ZFzPXEs z7td*AInV*5NVI^LvbXoMb5 z?x9;;4Yh&ZZ`mZK#l&%w&e#M#H~Y1rqANt?f8Q%L?|pPTblocBh+A2?F_KY6E}^Ok za;qb4Yd9G3PhBT#=VjuuuMh)^=YY7a4t9fGO%j`_7mT_6yF0(?SKH6O{`Rfn^=s`MB|A`$1iANSRZz<*qrF~I82-i}xbCcR*hc$IX_8x*_vb20 z;bJ)%lUF(J>l-OCC>Aa*{jTd!3Juuc_f%IqO1jYrLo2mww&xZS78QDQqZ4D8>YXo3 z3ad;6)TQA> z0Ql|=MpZ)VF!a>ws0}q!NtN}RJ^s6|Gc8fAZXlc+nwu9F7FJePR9F}0+oRNK3-nt% zJI9NS+aX(Ov$+c~4nFqwGq0ZhZ`rE|aJFeFDLbxMnTN_VOGB;W=SjbRzfx56y1Hsg zYdi?|=cR<9`VKUkX?O-#vM=!fT;^0#=?vOchOM8i=~cV*c(LKH!LH}&84qs2{q^Eu z&~tHoY>kVLuMfE-!V)6PLh0t@A>47Zi;Jcgy7KbTQBi_h%;s#JeT9p>{a95FM{Sjp zYd@zkq*Gl&$)r~H*9IcZkK!u~Mw{LQzyzjq-CBK>t=U&kDcGcem!j9+l1EQbrt(9{B;Q?2)Pn^;~pW6@^?scdxKdkIYJ?(cC`u7!3Kr-+RsNI0f&-iCxs|0AnzXAIU=);N5 z1dw<#<*%hjGHNnuS1G9<6HfkxI1#@75^8E@KYf{ikpXx^lE=jc>?j1F=y|+_X7&nN zSt|AFOw`qB(|_JZTu4Cdh7`nh%vD}RrLEJN;oqH~ytC)1&nxUF58|W{u=1Q%N@S9j{otu!%lj$b)mEF^^I9yvB^LpQf8}{wnQNC9inN-c<&taJy)2ksa zqD`#)=}lFl?7xe8v-fYfVuC(ut)shu1fLG0x!)R>-&oXOSBld z>I?2CV|kfN%r0dAFsMIC?(=mCEx#M~r8w}7b2V{1A;RKAz71{}MPG29rq|v+hfify z==9X@>Gjb7$d8GLEdan#aQLsh**Lou`sB6lRxc{@>(__m#oxc@j%sbu!yW)oRluSz zv$)?2Mg?qaY(VSqe}KN3RV=%LdZAuQK){pHXW61czLRxz8<2=_b63LA_gxvT>K9i~ z7-(;Q3z1sB+8=wJ+v3YCr0F#^-9->mpsb>{9(O+iDB_ACDqI^bnT@c*zjH_4#v(u0 zR8ABJPKg4*-C~@q2&Z()#IR za(l-mAyK%8o1XKC;@vqabMD#~Djl%&o&dac{u~=hu@w-~ox|+DxOzRm4R2UWaSdp%J~{=*Xz-?HA{n27I!lAlr#|SJ}6(7d}7Z z$I#H;Z-F~y)9`wBO}{jBUgPd$m@N0|9ea7ng7za+i#%n}_E(HPlq%Af znfln$^&Lu+zlDO#%Pq`>MZ3|2EzcfEDLXDM67qSG3X2k7dRYc(Y8`E~a+2Q-?|(V4 z`Er&8F~xQ526D5<&_J|-1}Z`X;i;O{en%*jQ%Zt?9b9=;E=rFsE~0Y7U=x>X9cwau?13$IYrf^KN8{YP|pkp-61F5=<`}>s7w2}we(^u zkc}&U(w+E}YTEcWFS*5T6p`(!khn)^L^a4GzS{hd#b84tcR$-x*4Iz=724mh4hsHQ z^Xk}p_`=zmVRvU&*{Pa0l1L@PTERWVYmPZ-8#diZ+zLn76 zWN4ruzGDCIAdLC)B|G_bMppziBV(o0>M!JFBA3HL?09t)`pvD91c>+W$-YWqm5hw$ zrs~or6=z>SH69WIt;J^J{%jl{cfS&z# zHY;5mzr%03NO!2p$Z%ZUN5*`7WxBPVx)KtF`uKOzghJGi-XDY7KOFCJSx;`*7#eoL zk{|W{xOhOYL-l4I4H6&L;TL#^>W@h`4@oSppJsa3th*+3%Irlqofd|sH@WxoL_rNfDu7Kldb!tC zCocCku*EW|U{GN4b6hS%aAZf)PY-paXxt5CRDcp@6|F^i!N3|qo(l>E2$l32F5i=n zpgk>P@uPB%NoE#p|CBx`6$W!-_`OcD)k_AfhMuUxdR)JKbqPbQgbpjO02)Lan|$!j z7ehluLknzaL+_@|&B)iO0d(T37ysosRC(Zt3a{kx`?rhl{~i{09e|NO1l)Alv}t$# zWU)Fi?mYW^lg%_ATpawbN`+*o$^q#In?(NXQv`7y*8K(P_@(KEGVenhIo$A-af@3B z`N~r=)C2yf?at_k%xkQoqO182^mxVn{73hMUy~u&Ig^v8L1NU_wgWXvI5jskX`5T+ zj;1sUP4Ls8qMq$8gfLfjWEEDVyk75caZ&MfpUud%&d4104>%wbkQ0^sU|(j<(AM>* zf5P9~m8=qySLI^wP!@Z&0>g}aB4V>`cWD?Gn!4Os{aEKU84!${@eJ?l%?F!`6>qHa z9-d1b6sWPfHTCHO1pOmXwLFqwE^YT#K(wR!0WTY>&^nQz_teog+OX_)b(yUo0SO5` zFzK`6HlqXfow4c|1Xh5s4@0~Y6%)%Y#69D-nW%JMyuczdA9gE=+~NTl&1WQ4R(9VI zg$lE-;N?;)Kag_j`51IW1b2?c4$p33zc177wbPbrZgpY z{PXAo&3-Lq@r=wP>2>7gx8{c5Vy~}RQv4h}OcrQ9#O?XT-A+kGX=!*x@#v8NW|Ind z0QnyPz08E5s)mkx=yx7pc$3uL(V+!iG~jOw$BdO#12i$=)G|XYSGOGkvEQ=P^AQ`H zgm~ty6hQKj@HlMG)GYUkU!7vW2ir10^k6$_kAXpPrM$5OiI&Tn8lOeqn=Hks%}J!N zD&gh}R3R)}LVVS5MPnep*$HlC-C730zCA*)tXK&o;d3Q@t z(ilz{(AJe&Ou%S@I_z|RRm(y*k08}RH>peF;*P6zZC-e2MX-tc*tz7w=P!7RCfAi% zf4YtN)}3Fn1r>kxY}LM-VyiU&Et_@iU|u^bYdHx?2}w4GbxKNlc1!nV5?2ZZ>Or&k z1UWg{DABK(56Urwh$%uN<9Uc(+$PdKw{8`UJoSc*_S!#3S9YcPzwREef!J-T|Ar-w=lTJDa^+6u2HJ9$;#hb*sNPSw;V>WADox`*5N zPc)|+HbCqM#Dx-Mj=@)%ql8?+FB*E7kEyPyIcWX(s1kr-P%#L?%u^+Bp1%aGOH;^w z)fH<%w&7#;9YjjQAGiLGt*efTYW><+AO<0d0s;a8($WGFBHbY%Qqm35(gux%R4C9lAEzmwNTuS1pDeDXFC1COsF8<&^=xBMTboI-{23=Ra~+TX&(F+|S&$f*@keK_wh*w#B70^lw*>{u zAQs;1P7)=eqB8soV#4b`-D;?J8vixFRr8q{<|TPHkBxn}ym&CLaMen$=ZYR%f;KEyb_i_AKSs+Mzq$B*EB7zm}E??mojM zx#A`!FGpXwgyrS^@bvtUE!CZ&V8y`TUs{^PsEtcOp4_*hDifFfEYs{=L8eArEkfP~ zmG{9e)yV=dLkcgua$x0Y@c51XPM;7yNJ<&lKqy~^N$a=Aol!r{%gc*br2KpGYNN1y zWp#9tkRe6o>z6N{%|IVFd;RJglsdw`_~6v6b^sCS^ZF3I2X4-P zuoIlVc&FB|O-{?X#E6JjQc@GrXlU1?t8GnlgWu?8uB1o3U}GeZ5J=yyO*m8>Gyn6s(Y_dp>2JU5c#-LvL0TT+++bOGPO0Oe;CNeqWm#>tGgv({ zgE)-DDeFz6(rIJ6zrW@cUXJez5 zZye?Ulbr$M{Cj-zT-upGZD<&qs9N_l0R7V6Aj_&;qSvEqzfh9a$8aTXGB!xAYtV$J z6ctlFthC|VMOezB9tD={?nb6g-l!(Ql*K#iAg;AkZ8LaTw?eT5mjm>2c}%; z=;t5p4$CfsDlpC5tDQpv1IGkj7bJ(YPhHdjXx!3qv9&#($<6@3OCA;&tt{&YaVl)^ z8TYtgmuxH3X85Y%ChXEBV{Vi-n1z`AL9rs~I(@4W1HIg0QEY293>1PXjSJcDikAn< zl!i4s&*NS?Z*QG@uxrdB!ttY2l;0jMjR>nsL=WS`jq+P}l6_O%_2f)eQK+NkmjYtq zt4(3%Nq-8|*_R1wm0^@l&Lg9?)EraaC$~#B`S+~vxO4c@4qg9dNDJdiZ1{;<<)vjT?RMgZv`&`>|$6vRaF@;VVs~iu^2aC0f za)y9wrIZt=KN3}v8xRyindrA(@w{of;^T>pflM#OyE;_=>W}klRURc;Ji@C6%ckn9 z^Nttw(w$!hBf^8HR_)FdMBejjRRT98Ai=A*24VjYS(LPVyNVE6Yz<=oU!ag&VCCs5 z>@>Z4F9>r>04@S|Ck5LeaIXXt-ubzVJs+&UON@mG_)JDdVlbT+xm+QCv$f6ch(qw6 zs&4$p1zDJM$a z>gr&<#q3y6pd1ud5m$NT<* z?j$bYV5%Cfi+&}ZCyLwg&M3AEuy_W69S^Z^)lv?+#^#&->gtr0Rp;uJH94UoAtmKkR_1^<>m=`9ea>oK7LeET4ggj;6P}LNpc~}a}z}nd%(aoaP z%Yfh?b9YOv_oF8pdJk;J#X=fQC#x8#I0EA05b_>5+vpnXrlRj^}q787)$3Hb>fhfF}rqW#@yL zZdki*iVC`{7#{K=1ygE#`hy5&Cg$)kJL0jYiN2RvV+H3+(w7dfxLEWc39|kRpCw*J z01*Z-GY&4UL3{cmQ0@H(pS=M@XbOfnx?>Qw$kG2@lWBwH)`oSqZjsYV2Cl0Ey_C{l z@awG@uUxz*<`IyNUV>hHlG*skU!oZ+0l_Yit;fep!1Bp{ePsAChR3?V-?u^W?ErLX zeqPrT3^dZUn-HjXmNGI&lN9yuW8J%KU0%{AZmMi^3sV|vtDu!1*pSI&9-uX|=*}FC z)u_w47Z92M^Yc0_1euyRb7(<83A^H=e&veG!?0;KHeBdJK!>FWxNN)&@(qy<^Og~; zy@1dCD!5%xVCCd&4i?z`zY~>n)d@{ZvxhK_h%*NmhL1X_Nqc(w@ECQnyaQMI2_Al& zclz$)9CK$c%5+s|_(vnPbo4&0LmNAYSGNO+d7=U9Y%_ek*2g z|9FR$jf%tKVrF?!YV27^ZF9}Xu{0`G`on`N<3V#ZDKV+Fe#GmoUJ<(XTZ2zTJ4H5` z({SW5*tJ()lD!Ucb9<4(-)1`fhMVwO#X(Hw#~XfeoWOaDU@wV$?vRm|Hgw#oPp^8w z?Yt45l+>5P${X58u)1b_I$^WWcXB}Vl#YsU=b%5QN~PS!7RW8+iJ^2R;SLC%D%58* z>FO2sjL(PSJXQ7mVbE>_o;-(n+_*qr>fonoDQ!jbttW}CgJ&z`_5IXb@Fm8kM(lwCLF0^`_6_t!e_Pn9uPSuJ(@mo2=?y?QU` z9(81*^QaW8FPz3w7TLius}Ee*bkPM8%A(%@v3nQ#__*zIoB6T{gZsp0W9a>0`AHDybOn0ZA;I^}yMKp6+1-U=y=ew^@Kt*4697fizkU7>)c_W*uL!gaq1npo zaKF@c-Nez6fE37Ks^b!Lr0Hj2L7hQlUvKU9sH;bqzGoK9Z5X0nYpMqE#HBcMHKiNu z9)2<3>L`$_wo_2JsoEX~9RCPl%PuZBBek%Q1%7j}p80UkTwi+o#)is6+99WdwRR{G z@$n1`9;CQXKRY^1kzAnCJ3hVv%W1xqJy*l^8U4bDj{nnpdaSdUvfbDcHX4qjQap~% z5V$=J!h4tUgFKGZUbYjkby*l}5}k|V9_cRXAa0>QO}yglK^uz*^c1>7xH_|@XJpcN z=MmF~B$&0t*OYMe>Q#X`9`hSkZIBc+Hn=J%$j%aq$-Y{y^@UOJB&3lq1{xNRTn2|{ zy$k{tvwotTQ;St=wUeflZ~lqF(k7EnvFh7Gx8;84^4%*Ep>tB;Xr5ttqldYNTd7?? z(o1DQwf&vVz^xc(>J1CH0t*Ew6}?32aN6kfh|#D zR0c785!1wFx7MNB2=u{C?o#az(y;Gs-yJc{&#kc$;nLmgo2t5s7=1G4TDqEqkJeo0 z>OZgG9{p*h`i{>t-PK(M1YnBxHsC1z!Y!qXVK+wawO!->*qk;YU_F0wOogL=uRGE= zwvEYsUdxCfLQ5*8rqi(IW_!xKE8!!q9{bsq7?|C==V??q9Tyk3$z)869f2RE#&i0q z#4k~M^Ofzmik^<1$#A}H2&KygBT9%-qqVDYO!o=yy4y!BJ z-LMDZ(!IM6u(z!|!sQ&8Aa37Q8yGzP?vXN+0s>Bv%=&KnZM)t?{@h2fM0NlUvo3l$0q_T9%rtQ;IRlhw?YmP{}sPVaBS2!t5g z*m%brEG$kl^|b>7DK@+nQ2dM{oHe5HLxL{I*M>XV%megdULIXvv00ZC5=*)i92{#C zAO$>lBr)zGvb`_1F?l$dKl`!744FbdfQ|Plc|%CZ{ID;4o-*f(Q)ukjZM@{ss#oRW zGKTFK*h6b68I*EzJ+J`-4k16%R9C5EbO|xEent56WJgt0L}O@CMZ_-_y(0G4=XxQV z&nT!<(&B@IqmQPxW41goPaNElZ2V|;J`oX5rHD{y^+X5u{WK;{F?fE^ni_b+1svW% zSv0$uFq<=8`tkVWxOK2IH92*gx4F3@f;NCJ!rEJTsWp~3s;m>4oE^jX(omd$udh9zK@sq z(_KVt#7VwFoGE{zrOAA{s$AP_jqz>oTLoSsKaZaj5E%n}hthX@dO8ls4%crG%(eT1 zQqkMbugX%Fee{*5C$!>B^#@nZj=7*oOvGZK*BQG`DNO`XMCO|sLGj#N9|S!32@mth zo_jb!ki^Q%!4m{Id9va!7#{=;q$x`uNGmMwtv9vTfiN9X052lf&W&BITGQt0#bOR6_o$2^yyni=lJ zz1S0Q@c>ZKl%N8sCKMOdbAak52Pmq`_|1RL#a``rfG+Vcx!~LN%iVgkh0ZU>yl|z0 zGhba~TtmRns6=G_YX(i0JLu?m+~s;Mm0vReP#OcP37}WBnt^rY+X6k`FTdk1Tbch} z<1@dsv`&B~0bw1&kkbZ~YqT)`rPTr|;AJc7A3uK2%DRsW)`J?%t{1?6-h-ehCgN$c zIq@Ve^&b#irjvuCT})CE8VE3?6bBnS2XphzZLgN%$9W7h%YJztQN2ODFJA&lauAnF z@O80O2rk~z`Sh|>q84e7F?WCbxCs(4V0}ceYGlmbT(rQ?|2vk~mD^_JdGXgXalTKk z(6Fs?DB`tU+nKIg%vEz7%23#i<>ne1Rvz>)r$MYiRTCUs2sWye(-i%<0i);U7H zw$7g*oP-2U$`L!+wh+buuPs;r(gz*azy@!jRckqSCHb2Ax9gmD@>-kQ-s4vH_7C`f z$Iz!fFI6?07alO#(XK5AFgi?S>LK>=^yM`z$YAIWpMY(KgHTOaDRD(>bMVDWab;yz zGUi$NwIDdN$`}MDO^HhDG==$8Y-IPWzdy zuk-$lXDz#P`@BH);n{D}kNv-!nv{0tV@}ztoz7Ler$7?;F_TbH>Xp>?;EvNx*Cv*$ zU(Z_!EV8+)xBytI%(MmzkVgY#QbG z!2KFZaO3m`#q3B9?Zy@0PyA^X0eDm0|fQ12cbgyw<{*Be8J z>{PK#7EI2~z_5_Ldb{tsCH*ZUgc*4nYR~AYZ&sJR;MoBl#cglp7bc1Wo4;+Jp`^u5 z*AWf@HVX<*AwQU{(g%&_WB{N12}fOcmY}9_3KB& z7)QCl35Lbf*JnL(DKA%@nv!yfprj)wr=z6I?Ne{-z4PFKE+8@w?&~~wFb{VJJP8*n zqkQ}8u}|wf^vTh0-`{E9@+$KD_V}MMqtrR^Tvk5W?@3QKUwAimzR^E)fp97ORa)>7s3IZ;Oh(S*CnE zkq0BuAe{(|0^zEs2sk_n2m~*upYfNK`$BFN%An4x`P~P;D0Y#FeskZELdR({QOfqr zd~f{V6$uqSzE7Tj@^T-#YV~HADoCZKtWALVhe{aD$ViT46E*J9Ig=jVYtj>}$4wO% zRBzZUy{981TVAvyxZ#3gV>pmigomf>gUf-0bn%~GxpLu4uqYLtrvtyJ zu(c158mxFg@J|53|IryYODUxq7#uuOWJ~}l*+}_CwQfe*_=N3VGRh=+#N=-c^@!{& zQ~e=_3^xbwLJLt^4@At6raJ~uYPqZ~v}tgLEgX6lNHQhIu}@YB}T?C%rg zb9i_)B24up%*>W&xJd)U!U94z3v3(#}fx3iCN>ZhlW(k8W;l3ZjP#_1b zjj3=9W;F{l&zb}OUX|Mtn$d~cT@`8UkT;pTv|~rj6`GxPx+y};xvX@TY{eRF({*%K zD0e&0PcJZutF7(KKVqi(_)D8TGcQ|RGH8qDFj{Dn1@f)^3Cq!VMH-nf{Z278)gQ)r z;N&u?(klrG?X-r`qI)%e`V^##84?!O8N3MGBG4S^fpBGgZ?DIgB$yPmJ@oV~XF%dk zhqg^2SQY5%Je{9&3El!h|6q?;@nekC($crU@B{Rc!|8uMwhoJacSKl`6?tPdU2xmtNk)=3o;ZA<}v$oVX4PQj5YON zJWWQ2Vk$nY^z>WhzWyTC9|dzNF+A$-v)l_vwr>p#dqzna<>`Ivb_CHx+4bw(n_V5T zhQwU+?JQ7zg#?8#*l$78$gSGhc`9%4mcOr7qE-g=iohQA)8{0N>dMPamY)7`+*9ox zWTdqG0*rBquIs<{mPRV5>)fupMt6V$c7H$P#H~6b`i9l8m%+Y}|LnxW3_N0JU*y+S zJn$8VJ|%QuThyjX!9e=?bC?=hYcgkK{eL2y1`s718g%PDvHwe$-52Y}8H{*YNQvP1l@@pEL^e zbdwv`5%IP^n?BCjOFC>5x8P8Nv{|QLrLP?r3bTN$mN}m)f2G-i0Aghs3Fcd$WPhGO zVTcc)TrXe=DTMg=7Z=XfCMHfsMh-?s@5IF3flCC2$L_hKgOn7JEQ{=MhzJu?;LJ=S zz{wCkpgVbK?&Ia-bB@s4Y!YW=#7;@&aT@zGZwanRLcS|pn!jr-&5N=rRinrKVmJi^ zUJG%Ws3A&J9-=YI=6|YLq;&Q_vz|=Od|2s7T>hbh>2?7wK%&()i`3X4rvV!HyQg-&m zmVHa_`tNtXM@5Bm?Je0Yuat$X;u7FJI$YTh5eUmYrc>wf@XVsks<2*pC9q+o6kYMb z+Y|N9X0>5E{i)x0gFr(fuaMbDaXDC`E-rknY(SMhIT^BBqo*PPg#WqyNg9KOw%0RG ziooHFtfQZ?>owDAa03#K+QFU6vs4g8Wf0AtxwqpCIX?4(6ltO{JN?1tDoDG(FKZOJ z{Mn8Ls^Z>*MeGR1Gj|F6oidxr5{=&Sqs9^>aL;m z-Q?f^`a>AVAV2gx#f0AX(XD@oa54|T$f3%v(-nXRn54PpC=zVVMZG-I;981%U|_XS z;@P>`(d1Iv)0c#(-hV+NTQ(BK&PsnYKASy>!yg`Y^|u^qF*9qn(1#aiMeI~4eZ^Z_ zk3dpTEdK`l^X!1S1O6pL7(1&HlKYa9`>o^F$2%a%-^Hb)=(kS;faOEv`b`Bb6CF;+ zk>3D>w=}ms;<6X%w`=R{|4Xg_DCTXLyg6>8T6_?+fOQ zHlPrEW6i&P?Ml9kVm?*_#+^JtK3RxoD*6)j;n>%M&61|iXODKY(Qsu0Jn*XHe2jCM z5A8cRCh-Qe7I+RF@C+m9V;sUu49+=s=2vWDRqS%e+;kRo!g7&r+Dq6t;mc0nIX2`M z&MFYbZOvZSOsh)@irGq77|jj>4lfSIJ!9ES?Q?^`<-z?Vt5A_WUE>2wJUqC$FmNF{mz=U33RI{-F|`O&MY4_Lg{O&vATrf~%pv z{w7JIkR*G~zSUv4LUk6BRk5#HHUX5cgDdLM?F@5hyQz^d1^7O1@45u|r zk$gP=oc_h0$XQq^f)MRG(M=i}I$erEUp&TqOa3UHui?J&I3DhpgvW$;SQcV(T7_wr*tARH0AX`%dlT({PmznL#8;WOIr434>n2FA-ncQ3fs#=I&H&22YN zofjt7TOWTW@wjSqM0>HlReiWMu-Y6Z{N;cUeMHG3?C`|Z=p5P7^}NS8awUEvI5gDd zWbe<=P-#mQuqUv3Kv_V2$e;a;o*pUX%gi*M->8P^RNvg(;wv!!<^?X^fq`cO+2TUJ z_vRPaxhf`zd0qUzpNVkY{NxGBAubObnEavkwFm`;_mxt~_QtsS@Nk)w6!K@`zraYJ zFdp7;g&kT&+3|DCR4JQMr(xF_0WR=s9qD!<7Vj-|_5U-CdyQR;hK-7b&fETh<@wYn zwA2*mkN18A9A#u>6)MuptA@waR9u|6AGVX(VoFKsmY+UNQi!y%D~Yuqj9QsbbJvhINir;9a~?m*Tk)AKMM`!q%o}t3g6H;{=t6oQ(m_)G~=l9#? zW_aV1)VErV&uveper7J z>ZKY-LTC!xE|a=%X>epHDGiz9bYHgAdPOKh-ZJynbUS-niN8JPcSSlnj8l)6)<0oN z)f6u2r71I7{GO%ZFG$?zE_!!e*iP5z%^S`x#t@Amh@GoSntfZ!&3{_d5L+MfE0h}a zHRH`$>??a$<_TQcC;>73`UTzPu84_=2?QHgNu*&81$bI8k!}UmI#834XkMHhgV^xu zzK}0I4DW*pSYQ5alwq00a4L8CZRzi?k2Vb2xxRfX;Dbw1Sb*Z0wX}2u^(dGIwRg#s zpu)r;7r%Uqp!HF1{SH+|#{+8DOK8F0V}0=twKM(-9zbC(E}!AwfTIBwm1w}y>M46@ zxKyhqC!I$_^-UL7bK_T1S|>_oCrTS0O%)BpOc~|teUa90jC)>59jEGBB{%X)dfA8L zU$T%b+ccDa53H8;SavWK8eHi`L5XzRBV?pZjeC@hx>fLaO^9pAS4vV`R7|R`zdLhC zT0x4RpLAAS`S>+kR28hIZ)TTCNffC`6fn8c(0C1ycr!ZwOHwbrmBCrQu2zAl(ttG9w_ zR_W(A-Fk7kEB8ibEZ;D0Gm`LZ$=@Bd@#?rmh}ui%ikUh+iuStBvG%sMqsSw{T(2uQ zQ|-M&Eoc~c2D~+T25pPdw78isGfXF6JwW)+OQC5TPiMX%*VPTFxu!{#{s(qk>Xr;J zmyqyK-_Lcr8}}_KX-?~K-e)|_Rq`k>CMY@cr_%NfpgMiJ{DO)=h55rc{238bF!4`i zF#+EjX5Z1Nl^5_Fc-;Hal7qD*VyBnq+%|3mKKiou=3p%DJD53(d z-i+9Cxn2yM9S6ZLy8W&_iM(^ix+8ixJu8b3WFelkw{Q1KM&Y){tgdfVyR_nBvJq(G z{C(5-1jmb)VxpoGHGCdeOr|4~?NJ1_YeVIzP3R>QxIZJ`ei!p`4BT0kvfPVl%ViMr zMvx0mN_kgH-o(ZU`w=V~1dktzfx)sNfeP>>AXwJ)DOFrtl-w3w(K80JOBK1=lEN?M z={F|jZtwP7@8}GD)5S)R)N5J#%kM#QDy(yvLC9XhMXgzzwDSA=zj?5^J z%sA;JQmE6fm0;>49YNd&k#0N*|5uG`zh}4K(kh1FoWW>=@Q@H)-EVQG{nc=T^70}; zp{p>_4`aK`&CNN=sLfRVsXDh_S682c$PoY0k~mj0@#55b9DIj)&`!hbQ9-WTpPKpY zh*8cAVS~t0U0z!*v-uO)zB*6_pLFD3cF~fjpI;oi`S@a|2I1oqI`x;nSWKF~F)3<1 zA3Yd9pe|pJvWZht{Sk7uEG4!VIzwNT!$M?G0o*rtxi zm4XRH2F6OoJY+}=pJe`aBaYbaz@$D&wC?_c%tsl2{kmWY-F3NpGp-Z#@cMesZcka3 zx&45lalOstEpXG|(yJcr%!_~K^l5+`Gm=U7RQ<zat($X>Ws6p3k~yDA?X7Z4W{9v2iI7bEi{C^+n#oR^D{ zmy3j#GT|9R)r{;tCZioA$@zZC`8QG21}sWF#Yu;E!1!dWYB)YN|IlxLgTQBnP=;nNsNScwsm6Z1_9p6i!1 z1RmPSGivY2M8SSy=d3tDSb=*A68I+&2u76uehI!8@wK@L&*NilS%89~BCv|9s~itQLql(^84dqR&dtq*nJCEyC`A;E+YMegWCp1yC|GxO3$LMk zl3`*u$Hy=KX6s!JO`uLN&4}f3Ztu5w34QUz*^weNfHHO$rBjfo9WG^R0AwUrt|S;4 zwP0YJ8~l4Yk7j}Q?s~B1%czZNyVB=wi;IGiV7(Q8SYm!$D1UZcQ1BS$mJkrIC;WF2 zP~jqY!yH?rVw|Iv0cMDjlQ+OZ5TeHpj)+*Ep5BHLoh=m*W9PvUP;YjS@Fq9e&k0|G zl9ZUMD11p^CE4o-n@BFi9hf({4<1wCA*x%j?MT759{!@+42DC%2S;9tuLU2s3-|VD ziHTj|PM)Y@6h^u)0pC6#^GiiKbM(m~mxQTk!E(N`E)i3!Lh^o+U%`K9i{ zIKrI+TPqv2)#-fu*~V|<6(!04sy^Ze<`y5`dG!2eUS9K1sVL+K!NE`8oq|_dFbvxU zr^ylM2E)PE?AeWhV&m2{oBx)UjO=Gi1t5+v&f3op!&jA*{OMC2@M;UGIE`d6v;@mE z$U6VND!aM4d7|R*2)cBJXz9kLBjL--FxXBlmGC;>{Veq=t|wDZLG#fSpFcc9z)lY% z>y-0q4wrk`|4Wh2a?mhiL1To)pOo}8RU-dzR|WUpFZ66@6cmK{?!s$GsF4f8e3KhI z@sO7idAQwy)o_a^4wfkcg<^wUbnASv@t~j3vu-3`%AlK6Lt_$n$)D9=2IdRfweW-l z5?IT~*z2Bv$&c!DH8dcT?r4s^aO=;raj7E!DS=g zMNC2h#`dNc*$BfMBM-jjo9(=gQ|#LxUuuKOeLon;#YZ0@;NT}f3*V{o=g-;w)i1A~ z4w)QO+V8?d=BIRYlK;w{JfA@IQC+B7a7Pl z2otZS_Vn~j*PX(u_5h79^1xy;*fPd~QC%=|)%W{%>P?4}Jt~s=mKJXzdRYL=D&uyMU_3ug?r{JSnbHOsvTHqRr*k(CRCS(2u2hxWlO1@uBci z_2c2z{`B0ndUJS|9849p-Ie(HZ~b?Yd2t`?8+Ir9eno9>Yi*@;1LymVu7sk41LyfU z9RuNOC|IvNFi+bem_u#7BYS$}4!6Q{(w<2pPXQb^@mP*nZ-Ut%;G{X0Ux>q66=YtK33WmO;Ud~E<^ty4 z)!De4(P+_Qk8ABvL8x_Q1nv_sf>~cb#l3&O8>rR)9*M}Xdey&)%heGK8@_HT`+s(V63x@a2!}zTUkdjeH25> z#t1@_a>3gEWLucw>~NX>)3&LjJca}FMPb32xR{nVuEZoRQ0_zM%26(GYz?hz zt8=}GfU$yC*h|pG#2$6QR;cfM9!V>}OZ)DZ&hEx|ZK3?%5By065~Z&-i@VCSp)hNd zkDHl!w>MQ9B2KU+dgjuSfv|8BX#Z~YLAJ(bKJik&<1r)SS<63Ra0GIZ>pl%D-9KMV zCVy+tf{+TX)rLYsY!Gw!DVPH7cINtLX6_;HwG2IzF`dN@*J>wGU_F2i{tEIck&-@r zqN6%#5zt9?V+GTkhnD(+49CN=!0Po?{>SBf1c-9y;{6U zl8OSoh_;JMg`s|B)%d60nk`Po@{tO+(PwrZ93glDif5s#V!Tpu1?p&i+0PE%N zH%@S4OG5qJG>eCiueiYpGHEv~nCK~1=GFs7RgVb?VbsI*m6MYbFhyOTsN(uBSvmpU z`)Y4$P-G<2`jgeHA>VfO96$gHa!@nA4A#-^cRwO9c zfZSAXRuwdLXwA<`vFZI}Ic8;||K*jtaYOC$0$OEe&peH&kVQc$=0zGGM?CAc#zT2jlb;V1lkO?<)!OMF2t{;K%w?CyN+Rr%B$PEHJD!W0g7 zyX{yh335T5@m1K;IXgcrt;p5LtFeQS2L)Xr4h)3MJgan?Os;M_=r$J4=5$5OraEZv ztDigWuT1(Fm9L11iqol9{II?C%HNFJ`}}^ZNgS_>%R%5U^2Ig8_laEW4mY3|P`^GJ zX1g)wj>Tj?Aus|T4L|K*UBz~(D-z@fc+ca7JutFAq)Pq$$VaROTR1?bOOE4lUKz~Q zm`7ShffQp$hc^u@GR%&;}N z6c-fIo32mUtC*tHsp|Y;_SHm5<;HnASBG`h!aj$^l)&-9pRbfLxEu;={ELFy9jGzn zZr`JscG~ipbK|P?yz(X5B}Z+H2aj_*=394mckGVWNZp1oN}TuC`g<#+djoqTi%mv; zCkkF7P78)F9XEN%SZ9weW}#KvF45Z8J-FOe^%`@O$h*ax_lyTl?WTxyr<|hV6E^|j zrXmB)O0$@X^z;vH->;%zX^Mw&cKdDNbp0zaLfpCQlE}cxSq?*ycdjG;$&$?uOvco9 znqb9&q*F^v>-q}RJD}=bA1z7!ucz(3x0e;e`3?=8gq?ok#f;t4BfUHe zEA53u_}}-ogp;n(!#@H-H1W?uJKj2+EG_T&@KhYGsdkmA@l;@_b2dMgx;b2?r+<94 zBHvcxtA-?fd#TIC$xOP>jo9YceaC@KjmaDpu9S}-o2L7c`ph{dD<3-SPV9th@m5fq zg}$TbVB|Q{c|lTdnmoFo8-+826FcrWkRa@_bAz$+(dFF>H>?H3ch6mHH>^|i193Lm zfY1O6w>j6=+{*9hc)u8Q#;a{OPdMFvthKGxuA_$W%JVn>c}-dI)(-u}!>u}Va=7ci z0Cz1@iTLr$kMER}tm@ovxM5MI$`-!9g7WD{nPV8Zsgc0hMIKXOn$}TEv%AM`KU(g( zfSxTYs|~6JIr@Zc$XoKYn-n)Tj7JI$Wn{3*AsL1v9>dK|mD7siOFM3E?Fj1Uc3k3@ zrO>}V1h+Xu{VQpk@LzV57g+cX-yl8u6gNB7)%nK|#anFuL=)507a_a0^YnNAL5C%sGcS6ahaVZ9 zvoXWz&|BQtyO;=JZ!~Oso0{KNyvy4`W1IChUt16}ib$g2R{=RmeczaMVr#wOZmQvm z!99MtAh|*Mw<<0dWvvSs_#A01(ft~cSUc{gjrK`aX0|yQ?ir^>cEql6>ANZS`0vf& z=yA45h)Se?EUp>UPzay-kz)uuo>-XGoY&R7;*xGZ65&l=>t5PmK<7P2XYhzrcLqlR~RyyS_i(YJGSY zpTnR%mbI=z@5Onl z!N1{?#2wuw5hl>*51VjvbARRxYYqAF!(jLqd9v#7+Q~^*5I~2lLd~?jy`2#7Puho{ zXtii&y>8@H;i5PPfXaPq#+PRsd791!aQy~BU=S0h@!a*|DKbrP8R<*MfLM-(=?(@u zFu(8A>?uS zc&sH!*nTYxV~JoDho7QMB9hBtqo`o;x3s(Yi_%vT5?RKZITD+XNp!Z-YOg90GwFG{ zxz&HdzBXjSMpCa^=5u=e5K^j1|I)ZUR?*kuU$JHio0q$@g%@9UD0L{GCqwg{JLY8s z>hC%wj8>W!X5ryGCC3$`lduh(vTdr&6)b5;pMBb_!M=u0GB4?+049ic(P5&{9Rl_& z*`Gq^geRN(Y@;mfRWgCsxPAqlW6}oV|W-D^I=v=;=j$96(~)3fRdOJljs5f3L8KW zxVAC2Sf5ThY7-`xdq-ieI&$S4Jpkx|h$U^Y(KlS+7Rr`YU^N9J!GoxljNpJ!3z{?B zUcE-^Lq^o^k7^`_d`huoEu1%Nt0Hi@gyL!^&C3EqqYvudfR)MX#ygr5F>Rf#(w@?J zMDN?zPVi6nJv@|LmzAV7svOV#ux85s6jWCDV?m&w|Iz(A{KkXMfkesMDHWR@MB`5P zPpLw&dM2xRN$MTC4%@I7NvRnWjn5E>k2KUY+dUE}9$G??5t&A5DHO@EJPzPTU)xXI`k4Qwm%mr8Uc@_XR(Y#lyWC0V z1y{XDy1J`%H%ST}>kW^LO2x1jIZ;1>2=c30WMX|(IyzbioB!lsJux$LxX4)Yk`_+f zyHNTVO`W~j{JB1;FNzCRC82;q9yi$~ws0&Uzhh)%6cQ4;x(^y~Xmq|+R+ep1$OUn& z4)|sPGy+pIp}Fv1>R_|HIye^|&QK`dCl4LDrB_GyBuo#OUWv#4K`iAcWo#kzM+QXW|cV2n{L zHDp_pxX$P7N2wIa8AfUEY>KHnl|c`)yZgp|c}J*TsZ-s8=mWLOyx!tH{yx@znj9s$ z^lnq@K%AgDX?GlccYk8AUT-|BWign0!rxpMg^6&wsO24M&E2WP{x;$;GJhVLk}ct{ z%KckH<_<63MpwV4&tNFXWg@SGLmzc}WRd0BQNxuhlo0{Wkjo&KCDtu4PI>5!?(+A% zp&&5tx{&&HE<%xwM?i49kK?f)ux!44yOFHAKL`$a;5rr(6-6U+34AM{&txSh3sU`4 z-m=J$kc6$Rt3guKjUh)2nBDM@HMi@99zd#4^6hu~5q>^BaK4U|2!0d1TJeji0NEx=`EvFJuTBp_ zZc9t+#>@O&wo7EuAkCXqL?8!s0wY1mQ3;W={hQ;}x$_{zhY_d)ZjwNj*;ZGqHsX%BrBP*ElvPPfqLaI+z8KJf_(2Tq zg3~P$n1l6s7>Q=2ruMFn3g36#BVa;7sp$l0P1IoN!GD0A zLwiq<2?;9Nb)^Cc6^*E2&&$UQd8_A{hi*So=prxPp?vnM36t36>5AzUPy6paHZySU#89oDPe`Xx_Tb|22 zFWDfYQ21Uh$P7xWZ_Rac1&Bd+h$j!8%! zMzqv>ftI04S7$37`u3Xlu(0qS9es5)k~y4y4TF@3pOOPP3n2+2e`|NO{5s0dy z{v9mPz*rMP+2E+69Pv}(ccbd^M>d5I)8>LrZ} zYv{2m>*P1d{rrlIZRDf z7zNyhHBS*mE@K{JkJQ`R#n~7AVk_*2^$xu@>?e2dS&ima=EZK>JDqMHD2(2|eG8pr zQv+c~xZ3iV%dDd`t~{sOi>DyJ$xga2GYteJ>|^ZTZhSjwoLo)ykEW-lCUpZS$hPN` zs01UA&^OVAoM8w*!w;g`|3>6ZbC7`vG9&Y}GTb0FO z?+k!1ev#b;_k;u$3aLWy$w(lC&ZLVhSU{SXd`V9yS%1R&+*0RqYpd$lFJA8Fkmtg| zhZ1Fra#V2SnZZC2)1S83>cT^;{Hk^79V zp&g7>9(N5FU`t8;M5fgYL@z(W>^B1Bu61$K#wLW@QBfkgRHyMy?pL%bWL5?=+cZQ9 zLwM{Z9q)U26y`yx_k}Tufm%|weudxnCW9_8cpqG>O%y;GYJ0pU*DoU}DW*G+HC859 zm470wRtR}e)HGX|v>I#<+gnm~5i@^IDMxLMjg8DsHufvBX^NQwTAB{A`Tb4^2|4xB zGTc`-Uuq~Z45r$}Ry&?=%q766_L!_ve;b9m#-I0rEQx!Y83a|Il{zoH$24d)Nod!dj=F@l!M-0^M&G&mp|W@Kg6 z9l`$R65N0PCGHtaUG(<#Wo5&CybnW1Bqbztbns6)S;WP}z;PG$C-t%l^PVKp(GqiE zXbB?^nL=&hshNf-gH)`mVq!baC)OCZeW16O9CIUH{b-A%aoAq+!Q7@e+*Y&4Y^XCA&RQxs#{iM9`1m7az83 z*2oJYE;v&vI{U`NW)X@B9aOiNFHaXvS5>B4X-92Oc9bhnI<$#L04 z*?!nt+IFrl;PxQ>eJ3JX-1Gs!)FXUfk)bJ+eM(={TjZ%c&Z{&qxb#Z`9 zxPu9EFxv`YNnSHNj6DvGrbGdGc}Y>xSX=LvF~sFd5|VEqcS9an*ifgm@Hn5m0mh|{ z&YOH-l($TOaKD4c&!AKV*OwWPYQQyR%=^;1BUz1M2>0bIByezi;>yi;15}Xo}|iAXUbv*@D-s58CHM$keSAWSdB>mI^*Yr#9S?ejsl2FQ>wrz6?OB<(6fdXR@tkQz zv2UC2{b$ta&(?1a2ZTn4hDN8PWu#@~w6M$?t{M`TSw7_;;h>}u&h%0|Cf{fn^Etnt znVs7H(qu3@riR1V#SmT8Ygioq1QXY?@ja^thIq9E4im@LiwKSEON;2`r5C;Vkv9rn z>b38LH<$>kdcJ2na9f9HFYPJ*BQ#{7ulp=ldt9-6AFqd!ha$E?3;rqqa}I+pHIvs+ z&$yp(F>{eKe#1&k&s08!_B4x*>c*&HZ>XrKDE^r%8mkcH6%@X48Y(K~Y9~i1A(e8G z-OiPF>b9>G<;?ElUgdKRj#CicM{2et6vYg~!gGQ@LYjU|6V6gYiW7D)Zg#%8<=LW62#1o4H*_6x6%0Ncz0x5Dm9K_ImxENI>7Vz;4qE;GXZutP2;#2uKeP7-z1b;D>{5=H!GvoY%Fg;`D@0 z<>mjF`U5%S{Qo2Dpq`PZ? z?+jl5-}@|<>t1DG=9lN}v(MgxX4d~vX5z0ykVj9S0-k+@qOGm(wX~Y>$$FnXxg@j) z4Q~Wc!2x&U)>aeePREsp54(5PBV_ondO3?fnLm5i0t^T*^-jt2Vjlr3924RDbZ>gY zDNCdH`aQH6=+IEqbJ{4-Y8}W_vt1qGd0hsXPIUAz1VH!xw%KA3*ewrY+1t-lxtDk1 z(Mt99DM2%%osuH>|e$ISYB1Nz;SKEuwx89h8vW7K+SZ{W*jO~!V(4syKk=)s~2;9Ll<}7 zKv@d_14i1Z5IA`A9*&4Yzt*DqaJISF+FReTD@xDh(+wiOyt$R1xup}c#72SPWhMFK zi6Iw|(<+^}tihcHC_qMju+dZ1t=7Li3t#PoMTmZAv4~KJ>*$*44f0b{83DgK8Xvp) z&ez&3mw|&dKQ;9+BI2IhKwsa^)>aSnvHyq5$6p4m#I|1tvlB1G_>k)heHq>#Kf0+7 z+5;I8&gFYZ|AX|btk*PQ7@aS`ksg}WI-8nwz`?Jl$Nx+@6y8Z1q)xGq2v4>bq7x+s zxGgPGlWqfP{W`izoPS_Mji@yi4Wc;~wL z4cNGg_9&5W0N zBIxUDn1Zq`1S7Jnidw_fp4DJAJaZWFKu=Rk3pnFOJ}_DEqy}YX+KpFfL5QLZ*%{!g zAiKrp1y&z0MF}C3;DC$3b`Ytq- zq*Bg41@!tirWydC0d7UQQUEI2ND40M?V)Dn&@Gl2{JJBji8PU)z2^=5~y5rTV$G`C+Mdq zv?6}bT|n31(GQYr`;k8raLCZx?8l7FB{=27wnh6w3JMAs6p}T|9i-#4Q&UTzzyxJc zh33Dnl8brsM%2|c9MnX*@n}bumopO+_CdrEituudU=+4D)ld%KfsXSQ0~!KSaLIam z1{_Zpdfo`#Ib-a3@rHf)02#4~<=RJpyl}d@jBim^?bV!H6Y*YLGr9}o3Iy(B)PdG$ z`9RNs6R_0_=+54-myxJ(IM zW_Ihwjln$qXHU^|dw4u17WavIUS3{(y<&1gaYpfWN>TP_JTRH7v*6(3vMZ!k8bUqtR@G z`1pWUF^MJ`YzX<)6~Y2*3|u@dN!cJ-N?nU9A2OXo!(otNgPlzsX%eX52R&rb{|H!m+CYDpII z^+-YYvg&Hj8LbTH*Jd}w3j_iH`Vqoq<}Lg&QjzxhwG5o4@Xk(3{`@I8+KcN!#|)mF zCiP=weRZv^gKceob^iaoKVgnak7M0B-{Xx9e;)#1{Ov5wNg!^imi79hqaFgmCr{F# zmjZfh;Z%a~T#)*OQk-DSKa`u$=b}(o{oEELO!t+6s|GtsSf0b}V6&mCD`eqCCbX+> zz}$o6#lNC#d@_{qRC2~BNW&%hkn`V**N&Edlh2Ah#-L?-wEr=BcnCN(XPb!?h?7Fq z`r_i?-0f2BvJ?B?*)N~(va{+>6b@3!i~!=LscJYX%6&+T0f@xsIb6S|C!-og_46uc zqhe$Qv1ybOe{4vIe8c7N7BFGYiik*cZ_=r7dH~dE=r?>__WHHRix)3i!k8KUixT!P zk+P2AT`32S+EaLwH#kyBqnV*~g%drh@hH?AU=Z!Bj;f*4mFr-X0-QvXJquRI^3?K` zJ@yI2{;pFmE0|h5+)7A7E^K{Q$-#q*w61Q?Veyp+A82Xg2rx76z)?tsW>_X&?&{jm zD5h+rfG`N234Fpr2UfuTW@Z3tRy13OAN6O$2~I3U+rFx2;VjZ|f&zRR>*K9(OFeSi z|DFtZyyn?UF@#|GwwMob4D|FQP$2AnwzQ~gIEoJ6Mi!w^qKu6BKrlm7SEw%lmlt)c zlAgxU5iz;5@M!`UKr$}^D9eY1gvqz503jqxhvUwJJ3_40{jxB=o-&HPDPxuNNBjGJ ze&f3LN6XZH5AOl!nS=&ACOXR8j}}7c=FmJ<^b^vMOo3rS^*2Bu4_7JCWH}?QnPd+^ zE>{HACg@359^-V`Hsa>y?uu6WTS25X+c80VLJlz?+B(1X!>NR>ae>ANR6+LXAdTlX zQ-K!I{{@3?(c%1X*3XEHJ*L1vH8DUuWTTe%-?N3dvYdYIL9uO|Rp5w$aKa!9Z z@M=civZ9(Mg<2)R5YY3XhDn4ra5>{V4X%ksadQ{sFO3#kh6hn-^t8j-Piq9_7w|oX zPB|j*fGBYd*VFG4MNj#E#5`%EH`hem1mg&vTcg=+P#I-|LoF(!ALgvItPG0VM5LrT zMP`xZ<$V9uw}ne0BIYBbxxdAT_CloeR6~Of$Os@g4<`aTtX>-}f750l8&?IUt0A!7 zyiWD-P97SoWV|b@&Fg-+DdyJ?E3OA-%ABvjlS8x8u_+itEoe!B$L{Qn3SZa9mrNfpiu}({O1oZ zAZG|5=q|QYVay1F+XLcfV<04A5bka0NvWwt`ukJDoGo=FQh*6N`k`)So0q!aj@k!J zfm3OZeIOEnkq`tYeR74Mf^Pz}Np$rnFff>c&-cH`gn)N)($RJIR$Nq+2p`f2@cSqN zo7E9%_)sQly1HGZw%iT%>z@QLymY>%q|B^UKV;2$F;t+BPT625_40|g1v2reDW81& z@F8{d$^zN^;e~xE9kxmb^k%B2yE_|DxN{p=wXnqX?n8YFXkAG3?@q;3S0{TG-pjx;f+&&ArZA=0GE%Mv9JMjJ|;I@4h#>BwHM4allGGsqmW)H0Z z|GRC=^qSg>je9helmIX8O3Kde{uZDQWKif=gF%&x2IlxDsL7kDQk~6K=-02Su>#s4 zrW(U#{=3RO1B{}K0Y4-ldtHwCiRh!DbL&%}I~{D#kOu2~CJv7%dPu=({@FL|B8?9) zmhLQHrg_y{Ab;3+ND?eSYR9tqILRle9*7k1^2mhDiskKtap;4UeOv9mp)8@()ZVo^ z6lscY!H*2~A7Jm+s50jXXrT4E?Jiw*&Ed{R^2lw@U#X=bk#B$3RAWDt^jPDEitzYM z{xby$klX44;2Fvv6&}0lB5GfihLsbO13!NLm{}s#A=%;a<~Sz9(L%F?@R(+3u(c#q zDdROAcAjeH(pCqp(KN1w~F=%2M<%q__V`zt{utNRFNXbbMLYOX?+~nk5T+ z_jhR1xg+}Xx1J##3xaL<962Vj67eM(Eoe<%{=L!RwgeDg&va7`(CLfq(uimfIy%E+ zRXK(BDgVwA+#twsj!~tK9v-!WxmQL~I+T5Hs;H>UG7Fr&2xIc&r!8p_k@nhJUk3ttXy>YYQR@rB zw8f@|GJIErvlhC)NjvRpqk&HJ9#ri~KJ@Tt0U>EL$yd1MKDz(WAO1mX{&gpmYe`5+ z;&>eHax#Q6jFmV|BgaD~qH7!50s&CLGZ#YO=;r@k%@}RLXJWdixlr_wo6j*~`g?DZ zB5;bNw3NgOp;$WG5N+t)4mHrJk-0Cpye-6ig}sr*=hrkV*)2yZMwT^`J%pwNX>MDo z#IK#xsWb5P`GB%KXfsdKFL3b>*|phSXZL; z(G+w)Xlx*F&ECB6Fb`osOdaO-)Ndd86xZ9Nvh zNc8u>n83f52)Ea7;KSn3kdUK5F$f|A2pH355ADGt1I#?(z<_opm?w}i{@8T789yC^qVO`OEhX z(HHtulhkXXwCxfjl@7(Qw+ zfjvpK=ejhhtj4Wln#1MX{JJK5R-p=@cm?`#Lxr6{^viV~d+z1f=or_n?zRvG3FV5X zdmf|3*p|=)NbOUw)Zgx$#Qw=@{J_06vpV+JwJgZ~j*k_UjkHGOHPNE%!DgvHd|Ufc zJz?W~y0`A~zMmJQ-Brlk6J4{F?dV%qS{y28gl+6deMYJ(yI5AeAq{kxv`_Ro(9x~( zNBIe|WCcPMF)Bv!J+dMqX4<0Bzefq}X!~ND6K8xPe*Z(p|WZeZJ`MT*1Km~jI z`Xc?HCx-<};ROXrF-s~SeH8>c#5Rs`VPXBCiq?f*3Gj%nfSHVl2&r+35dnZ-EKE#b z=zs@tR3SAaX2Qbr;5?7cQ3xnt=C~}iZ;>=OI%q4%$w{Ikb9CWC`fBuN&&a4~W$hkU zE6Zfdz%D~8Dg!!ZoMR#m-6sqG9NO}%xPp7g^KCR^QH)fs&D?uQW~ zZ(t{|jk>=-M|aT(%>krkK`8RO%@2N+a-^a`JXLQth`^<}?Mq5$6{^ zMsMI;N1~e>N=vgM(hvGg;Z|NKG(Ez;TJsaKzf>Kk3RO{9U+9phr&I3hS>qC*F}LpS z`;!6QVRBeq{2PMrfQD<07pqBGwP6Y%;8uwrE3;pMuGM?@?#cZ_JNQ6Za4gBcf4-{( zEN={7#OvvHp|%%H>BI-S+t06;x5oxTyM8X3n1h4iCAlz|yW@*{Wps3)wDbVNz9f0N z3VUcFjGDXK@m0_Fq?aZ=PzhRI-ZK?80^xQ_FQ)O3X|ohAc1{K*C9xg1b!Smzy06Jv zt*Q)4{F>IAl5UksukfkKP?Wxbp{uBRPX>G?^}l`m zsISPP6$kF^(Eb8`Y(%0XqXVH~VfM>|QNIDi%l`IFhL0M~8xmgoJRIE7moMT0rHrqy z?`=Fi4R=0UeqKV@YtIA7D1!%}UvJaz7G6_tucElPuSsegv~S)4L0iByUYBKMWrc^6 zMhBi+oxx_P+-Q$>g?ywKkDiZz#iV$x_sHDzn|i)xZ}MV5)(f@ze|QXwZmw*Nyx|heJcZ8|P#*cc}-D+ihfBhcEj5@?Lc0b&~6smYbVf zUm9SZIQ*gd6c%d0RfJ{kx;-O5lS6+=wwHX`;1;0z35nBj04=r%Ygv>-IA zJ+vw+48|)C>U(TWjg1-3NNMI!n)Uer@tU*L7PZfy?Dx|dE`D=&a|5~)+lrd(y__*3 zQJ}~k4m*3cevhQd581yXuPtA-84huGPE4uIG%bd(G~lYvK-|H@%jR>q@Q}oGDM%tX zI}Y@b0e>#&fwhYANl2KIPaN4>6M775zqeOPOe`i=VEC-@2qr%P&Ea{A?u7@sT?DLu zKZ0(!ABRd!Zqw1}ZT|TMF5TBs0aT~pclxeTZ1FD@>CJU3lo#0MHsJ>iId;96Gz8UUUnpU>PFoC0}tedZHy#JP`{8KrsAReKP2LgMdS!7vd0)`I=0Wr#-&f= zuL-;l47!uhe?7~TZqtyX&!pL&crSB!i)C-Lm`Ve%ouu0Q8A(w+mNOiQSUFcILq542aqPRo9L<(Not+m8Al7l6LV#8~(7 zUl3=1Rc_r>4s7qhd|OFzObGQ56#8XlWnp32XLmrRK*s05RD51n3CNHVLAM?}eE9NT zd1aSbvqZlyT_96|0|0gMr3K@|Lv3A(3logs-klR4|MN$}ohA6CxN(VzZLHN&RaTRY zi+!$YhF}Fs&CAa_?}fU(i#a7J@&B%WAb zA`}SpSmf#tjAk3NN2yR%%sTOpePn)yyfkSPR@OODQYJ50;bb8W_ zxky%7?e4thTPd3m3x|&2J2%BQp>yXZsyDZ;K;gJ_WuYhB)ye7L2pbwwuZ4X1()x}> z2!xWwq@^S6rOw9i(-r{BV?QPR?EfM$7zX>9n8M~yB_*M~@J|txFn`q5VPCyb!`nLt zJ`Qb>>?z>bGUSvZ6T=0dE_83-`^#_?UMY7wa4;|kiqVqo7a>dhDrU}Qx$CiWUrB*T zR{iba+*sv3bMwIdtUxsgCX9&1gKo(^e_m!j90!f9a3<=)s*IPRKwE#r(oqEowL1Tt z^Zf1C!sTuL>dz}^lkv1Vo+MYmjpG>~iYX2W1Qbl;-({M=-nxxdlmk2GMjBq#f3Cc<9s&BLQ;WzjnHwtu(y zqmJq^f}c`oO#AusH}-$CPow?sZ*;t$7fz5;QR#r=CLln(y@sIX2Z+dYokN_rcOA$J zbOEsx9WD^eB=ZA%>}$96iQ9G&TIo6oiX;8F}%d#BB^Czp*uYp z_B?j^T3&e-W5RX9f4%C}uBWy?vf{KevgxRUd0O9rp})} zqh+D-nE3HJvbqia?MK#E3B=tjX*?Z4ezU3XCgY-obhfN_zTFlQSV{CwKrMzSud0{+ za{W|P<{71Czch^a5Rhx&bKULA(pb~k zbgHPRc$2G#4Nhx60zpdN-vJOa;h2p*d_kK(nGrXXyU-sQiX>if0%Sp8zTMg?1#+6J z`Uu1YLcm6I+jl%KU3dfKXG)&u$Cu)Pf7jM#4m9NVfBSDS+$3Q8>78Ry2AtJpXVGeR zxe!F+-M0m0FlbV;vw!eHPyF=MGJj@LlHKV^53DH*i}A8uVz}jd9(4Nu3O-ooh$|PQ z!c%uBM0p;`SjD^$YSxyLTCOYByk1hmWR=F7=duP{SLL)?Ve0@DiS~)&U>D#N0Ah)P z3P`my$;&<8H+m0kD$>zHEBQTwyiQ!p%YNRNzPLBo%!Fl>Wrm_TlyH?G<}@KP@dzaj zC2^!2kBkh1ueA7t_=My)R4QLj%3OAadQz;VqfM?-nsx9#bKhK4N>5JaC2VLEjDEDi zO=~i=eXL`ht(kbi506Ru*lIg>z9qE2Xj zqXWu+;OeTVq@*@?SOW1O)|KlQu(4Ih!#{t9dYt**>gdh?FnKTE*4kPqgbmZsgp8JJ zGcFpzM@(I#zWR3hXZ$-*jcU{K68@fOdj2D>5@H%vLBBl(dwT zVvY^tFF(BuUxhaJ^f~qQIcL;)h%v+_CkaJFz)n#kVM0Z0b(PO@+~Y%>&W&4c5lAVi zZBkYTd1a4JQHxEy5OADXfl&z@&S72o;)h?XA2TCVWTtkH07vyN@a@%jzT?#N5ggwB zKRY`=xH_+m2|yc3|5rg4xE`B7Gf)*B!Lf*c>ya0F$-%>+Sm#>`Hrv7W@5Hn8nz%sz z7>I+J-WYDL=jThlJ#)N(E%6<4-A>8U(qp!l2v61=BF__N-@kh}HRl?Uj>Y)N++c3C z;)xe4BO}OjPY>wCFwQ-Cq?(b@lG_59MonX)#0H`_;jQ2jbzh;;*YUh>=a!(R2T!N! z3#@8iIvN@gu#SE5#2*PYa~oUR;X>0U-d>5@cke>D#?H)~HBcn#iDpl1p2Z+ss=p)yC-r($AlwP1f9%m1Xp?I7su*P?=g+uW0LarF7^@F}Q? z!EDQA$HdYsvxWCBQiJhK6}_UQq&UDpw1|$5&R-HoWgP}QnoakI--;kqvO)Hx;J*&D zbI`O}U~j4?CT0#tKA(gH`DdHCV$CD*+CId%7?e>3Vem?kFO#+!egr%iR6;g`8L_M0V z_O<TY0cywDyafi#*zpv2BkFhc(XL#bFW!-svuwkz6VU4(Qr{oNjdp3AwfO_1S}1EtBY3x`olpsibtLpU?|w^z(xtaHk<@u!hM; z$2m|~5knwe^`%3`r$4`c&h5%;VJId+y{|~O4lcJ-8wUp)yMo%64G<%4K+Y@Qyh!nu4^J`!XtheeW+(p8~lHHYppsY5RY>fP?nlJ|_WK zzaw6~cp(hR_7zWLWsARme?hTW`F{>pNR=VC)cQXMYbxE^7|BREX&`5bkHp#-1?0%? z?%s0im^3Pynh#yJJ8b7EV+Xtx4od?d_Cs25w@ZugAfov-4^Jikho#o$pN4pf~&V|Dz_~_No7v|DkDZ;Km9<*`876IWoBQ01JuN%Cgq9W%z&8+f3*A{jCnEs(RX{m&-yaF?6Vp?% z9RL**@T_yE9cX~aBZ?COw<2Ij{C8&o%cL~<{+FzeuJF8>)c*1pY zMP6QZ?=BVC`iccyKSY35>57jJDRe2cx7U?if;124$PD+JgKzP8Awlg8%C_~DoaRH4 zwBQs9?Nqi1MV`5xrD8ab@6ejBBm-@qI$?0ou&OGThv#u#p5xK>f+S*Z^|1tkpEiL- ztF^5)ib&qdsy2%P# zQ{j2~fN*D_=NE)%$n)n#KYrA{7EPuv#x!$y* z^Mfl_0xq0CN5~2nH$A-{(ihL37zfs@Dx?$Wi=UT+dg2=4TVG!jQ&RyKVlhNm*!64I zKEiDeu`LKxfWu@;Qc{)ML0)F2=JV&GA|f>O^m8Z2*ih~QsViDqTJYTg(|T7Qp3qD?865D=WZb8{Di_=^&` zmYy;*Fu3n!$6u5vleR0zJC7+`2Wa?@ACzz33cRGa5Kl9);pFUmKthsf3%)=k6cl^= z))i%C_f^)*ZDw}AJuCK4&6{vsRD7X1VhaoAlo*v)Q6XbvsdODx64K0*qmyDy7sFdP zbJ;^SPEg2|D+rnNZ4ITc9xzmW%0UQ(A{(sg4)Muo7dqibskH7~8ly%{eB zC~EbbxMr>8+SoMQD)CBc>(eppiez=*nYJ@nG5xFBRNH#`jwV4?7e4}mnXD%HC{DCLh`0L64pv> ztzX7Tm#J~uw1g$hyf2iJ)YJ-J#!LzAt{(HTvY!47*+HMt@cegl0lDKv4F+xVuV2m^ zQ*RR!>4y2wojV5=!K3wabKv}>k^2%WF1Xt1>@}T8saXEc_80b%G-8J!z{Sn55DGqu zOH3H+&QG48qxHr{!GJ*b>r|(2$|DOu!d2CioDNJrSh=9}4IdJ|&i=yFUZR*+D- z+ek_TQVIz#U%EjHthMz6L7nZfN@jKS>&)tdz~8neI*DwA+kJZVGZx0aC-j zpVs%;FW39yWlm%C;)jLRr3YHwA$aoS(t`(8A>YO-Z+$j6=k>ZPab*_&i{gO|+?A#S zCx$<|63H{Fz>n?f6+U_UB(?mzec~`gO60l4Yu^&LPzPJ&pvg2VZqRx|K(BE=-S#?@ z73|j1#h?9IS2Df{I9fOshM3SVc7M|%(hb_$_Zc$~2w2u_zkc1JCHge0N&nr`b9i&pMz&)VVYk@30DV*^+dZvN3~X+B zwl-W`vH7#kcPHa|$B!SM(KBTNsW->NhXx}hwg09&(K}X2>;qJHqoZ50CScDC&_3km zHjFR?kQcHesvu|+c*Mu&Y4%s37~p~aYR_U^^4&Q8oBLZGpG?>&;Me+0a54^`ss(0S*ir2Jt1d=6v%8}N%A zRyCIw%S`6l=@33aR5dCDI2T|wKnMdD&#haTm2YH6%U{2t0wN?02=JLhE~(^t*~-A+ zE+Mc82<5|BVr1fWX%gOEA;qOyRg{;v-e1=l;cz|j9O%!_Cm#fgvQRa9QxF9!6BEG9 zdg9`ZNJ6JEHZsvokZzfOP=EQhkjFZYP^FE#~Itkx74(lovDm8v(%k8%1M81p7Du!g(B* z#qv3}wXI+a>U@So@f4_%){f%`OF8X90){p{4@$d(?UvKzP&;JbBtE7Ndrue5e5gxm{8yy$Xtzkl0&CK z_!r4o)_<07A^QMk?8}(mt2_a60K{JzDN~v{Kx_ z!^3lO^7`IBI=V64*yw=#MgU5i{URsdzJ7I?s3Gfzt~+?*AN-Ke$33UA&i>%RF-`#X?VC3_Txke+;{FPv3)l-pf>eXl4koUmg13C^`^ zmAmX%0B>6ribD9Fr_qRBrxSxJ=T8nBQ*A`_sGjaTB={)b)hdtDP>pbyf03M=+{#OV zQDbODAw(KJ1Nltv2Vv@ot;dB09Lcg&eJQdMcjHW;pC^lmh=?vBBBJT-+s9B~LA)|D zs;RVJ8QOu;s#1G}-NM6SU3BsQm@^>wz$g0r@#90bPN1EDxPOUGHK?h63@umG!j#j| z0e6>!x zoSU0=bQQ*(-JlivX&x6^g9|NS+b~aM!GBSrn*OB$FwN&z*6 zlP@#>Y-I>1dcV;T`w$UfWMm|X7_rP{W@1`=By49_5FM=n&DMn*u#AAJuBEMA6}0tt zG2viB4lPt2^J6RRw%g}Q_Z$koprmj5FGJY~?kg*UlYn}z%tj^LwOClAmvC_Ka0Am* z2~<@hY>M|=ny0FyFjAY6zTN5Cz)bc3{+$RNyVp1Z%Pj?(Nd13yteL&~b1dNMK-l$} z;nT~PlyiUnz}*&>@ds*NHsn1iG`ZrCUF1y{q7&#Blq@IG63j zv_4pDJx)K%U$NJz_qwS}X85u(AwexxLbeUw)D~FP&>zmu&MsKJdZJoc zSqVw(#^gRw-LZEd z&=ubBIw# zf8o~Eo@wD>oGmaLhOEKt!$JHX!(Y{zC;A_UZ$q})K9jAQbFR`3*FIAG;yyIIFflVT zgA`aPEtQ0bh;HqhgKE^Kt;wPW?dzy0^}eVBIRv1nReM4B-f1m{_E%n~Oj62j~G1dj@o2nytY-h^sx4_$~mbb+Voa@VI^#aAd0s$c=ATAV6b;QA(DAkqcQ=i`R;4X6nD35 zpbIl=FTXS$Cec^NFdDqi=K;jF+q8BlfG)ptvyNM>2;St0>=Fu^-Ei`jz@P13dgc)( zg$Qw^qwl)i|KQvrad4A@qN1FlVk#F4Ep2x}TI1>P(*6b!EVaf)ai!p`j-Z54I%wg6 zuW@=bNZVVOBKry5p+_>KihU3ss>Ilj9v;}n8*t2zfvC-GS`b!+RrXpK7{l_|^vw6} zMesRVsH&Tg62Nu&mj<1-I znS@TmA1y`9<*w7K1v<&O&#>hzq3dOI_~=9N9u44@05#CMY~JSL;P{M$Tc6Ky^(QYi zdsHUkY4uTz$=z=3H z1_oE>2Bw!~NN8-K<+LE}qV8~_?OJ>2^qS51%J6r~q9Zf;F3$n+AXj3?!;T&VhxrM| zWBtdp_gU^&S#63+y^{Lz>4LPDG!Z+IhQx6CodSuF;PdX7&it`UF9*I)eE-lw6HH5$ zmY&hB&2?1A21)u+@oGm$3jmZc8^c!xPZg*h2zjjUi`N9gE1y1l3KXGMzR11h@%*8# zY^@T9)79gWh?1#dsVft9<`{d8S3cadb?;$XI&*xV^fHh@%He_$B5C zMbds;N~Qp+Q~7Ai!+tCo+l1xFBYR}{Ni zsup~;`BQdkPfNyO(+RAFKg54Z9!6Kbb>GbY)6DagTQqo;Z^%Jq7?TuFQrUR(Hvf}| z2WH|kt$YKksLIo|D9tk998->Xtk-QYKPzS$Dlp1y8I00=4O1Tdnp^hPquRixk>E*# zptuLxPu1_&a8u7~66}R#e_c(v;<52yqgv|l4i|6H;zV*obeNgiLzhLP)tT8l(VpWd z*O~J04$ZMbhk+1A30R*4Ft5E=AYg~OKqgwrS9lbr!Q+TaK_Z1=i5k6u!^2gepX7fz zT7}$t#yA`WfC5~-dKC~$KqTARK!^1aly;yylMv@ZU!z1I87D|5@Y7uTJBLW<(YW!b zQ-9-S_{p(p!FLQCe8}A$9XpzWiJ;>=v)0aQ?MIt=R#jDhx)PNd=i_}KY2@gfNwRGS3h9{EKb4yn73p_CtOu z@plKlOPo@|Ei}eg2`p}D^=Q>$4Wf|uU#=43T9LgldO2VCYbpQI_)JywD{h8q^NWtO ziDBZ#X~x*aRIN_Yxi;-j1?Vc<-FZ{0WM+ok?@KG*?TBS!V0J!P+sf_A&0-eHXQM_> znirev_C1dwjy<4}LoS%tE{fi0lifOmmWh|?W!mc@Wk{Jorpw|ev(ksButi$Cn^+KwzpJOqgPAc zUDe`VtiNzQdvuOsf|-u7?y)+r?E=G^LX)SEphu$1+-UxdRsii$D3P@h@4ryTQ~6@}b1|z2~7= zwvVb^QD<+%+CB7C3eVR!2+-3iD9{`tF8-JDym;ngkFkF@^engsdJ6Ce)rB5Iq68&M zL9;!OD+4Hj;=gb9N{2l@KT?{726w2}8*bmO$G$r6u{yE?`bGU}@gYxTJG#4!hf-we z`$ejxBqftR^(;du3Pgv!ReK50s+dTG3~_JS+OjA4pvc_Q#X05`kf0X*lxMRFb_)IP z)o^=}^Ej`MpL%`ab$U1a$a9LHaN*`sA)BcP!b1X8(oHt7H$BfiK*jIEMi|56B2G;J zlR9iud^)iD%sF(5w>y+?-xrfyP;(?F-L-bFBztIEC&hL}aMk#0yKPMA3f%D{zCo{L z^vhYf`M6o>I}E<#65eUJ1B_E5`NgGPB5WCgke&-E%??zA)^8ihJ}P|3ICST<9Cd5{ z!hj&Q6}l_HdEBEi@hoR@03e9Tev&VhW)Ax0!ARoI#K~=O;)qMZM3=8z<}BbS*$|Ga zsrbUbnr`FSA19}&Xl80q{-XI!RkAyT0&cGAXWMHC#2XTFa^Ppx^5R%mf2p=#68u+5 z9EA9)8jfdl4lgOm@3dY6qHz7eaUmfOtf%THCMHa#;rPSGy9IM%n-%w8Fs&WU@yog? zr~v{j6{t(fLKAH$qoXSJYw_mR%mdKbjOIv_#VXCxz;BDK6o2+?daarppUR>Iefr8x z_ivcO+>BK=6_D33J0A5}j7MAR!wQ{%MZ)N9fWrZuBE5ZTXWP`M4&b zIj+nyH6@Ax&hF5VPc#Xn9omX`cN_1v$MIKJiXX{D#kkzu;XOIBw&15{_d`xmHQBOK zG!4vt5@#-}IAz+|2^dgn%Fue9Q{t;L_xQ)r6&uvv^t4%{((zEa2kTyc##|2Mb=ZNo z5QyS87Pw~I>p7L4B-e>Ob|*H1r%Ue;_}|-f_*0yMwa-CF7+d0m^@$Y>?)t~k9a3(A z{zMcqUk00b8(fPm9=Aso@-i%t{EK^2-4}TRs8N7o;$FQ9WwPf$d;{a)CG0pJTLY*R z7FxTzy94v#u5?uI>H>P2;Tbd;9a5E*?df1Ony8@!mzOrQvRSZq1czO^Q8m6H0Ej=wmDX4|ft)diyByZC_!Y<$v z?j|nxar6rEZXN6Dq}Y%Hsi|-5d5>I6M~mk%$~|j!xhwz57gDR?p~InOljcx!4h#K? zq>|gKTFe4jWSU7)>8+=;Ga$=4=BF~jm_0d=hT?*SjjDdUOZ=GxY1Fr>^w8!ZoSm^7 zTzY*YN`8)1V}B~s^oPUZ9yvjR)yCA8@FP(%D%Eajc!fOie6LT!%S&jw34m@4Ow010 z?l!x)MEwga6MgwC7mIy-E^a1uE z8?~)rv)Q!v%lq)-S_f$gvzO7bKsKg7gv>o-pUzK)5l987K)40I~t zHaPO&TKn0Z*9U_?kaOy7e+#HOhiyC3!;#nIy<}@9NB#VbP^}x?54)$6gXt3J%7ecM zS;rza?4kW?`Ab!?_;nhPRB6DNn8JU2UtViBL?!mAxlhB~CeLY+Mq zyBAYro;{(XMJFjPsEG%_WiU5fv~8lN=AD@DOElfhPUEevSUz^qywgzlo3y#5eVR+q z9m`~otp5*UIM|~4=y26fXYcu{HK(Zcr41O_n1DwE<7q+zSM3(3h@IyYmNxy7$Xn$e zt#d)LojvjDPoQ%Y;KP9D3hdB_zImc%7sZ2#xdIiO|B=t|xW{|-fd2t8;zJG&U}*P( zH;0l^Ru&y_ye%5v--L9ruW@C0nO{Hv8Xip1X(sx?_03reou7At+ETyBMD*bB-t5+6 zclR71;RLq(6P*KKS`R!H0FDr_7(p#BSBUxX12;~s=^RF?ClmpoL9sViFS`14SE30Y zL(mkIVG+dhpJNP0;lrSFGgM^X}&m+92=oJSZKqzV?!+ zB+!7j&BV#X(sOML)Ah6nh=rR%GoGWThkmvtoO?*gt+)o3vD?*Yyfl35(Hb$bO>%z7 zZ0(Zfz%{|j;riA;iF18iowHn!9^~luMx|DqkJG;K-63bv?|x2%$JX9yn2dYO{S@lG z$?*4Ir1~gurLJ;O4OQ&?R9>BVOGGN@PD>eV_|ky(uCER{%7zB>OZc7zHZvBJ4Exew z=Gi<@FaBZuxjp7 z)t;0@G%!uQF8%*mq4=IG7xz5?sD#@gD~m4|Z_^p5_mOP6Un?q><2WTUjqLDIZPBS;SjjaQ)gAT2Ui*w!jH&KpjmNi-YKNEjSjEKXgE)6tkV2=|M z91#!TVn*IOvF0Zd--|~ykjZ#Xo9XlFLIrzvmp_d0p>W4zm&xNJtjS6Jw6vLq25>=!KQqPLNoUg1Y=L1G$?@x8 zLvOU8U@$|a`Zxk0<>s3=ZG~=dv$4tXT2b%TytWj=l0YaHBvfc3#KlD=BpSP)4>dnc z*D4?4JtG`K76n2*rUnLhOT=j+JNiQAVvkarx#myXYYJxqS$<(94*=L z^nCM1SC9D7EvU#@aEM9Us>;%X`vPQb2g)nMe5ba;Dj!-NOb`XbaL3 z8+~1et^LTF26*KoRI}}Bg5W>T$VzW{+JDR$977yVY$urNTD{6o$+{{(a=DlUAPnUE zoRW}dQLM_+zz3vapHgX{o_3RZfqBQ^n-igPXC`!s#aAS?b^-3--TaCo;;5__F z!XdC(05MnXg@_y-R5+N#H|R{T~f&Ui{hl07Jn08DnZ zE2l~20-L!ZuXTUD_b@)?h=WxpQY3jr3SN|Em>EtSZZ|g+qpRijmLFgKxl&ZIiT0nE zpOA*;H?_|8H&2sU!v!5s%ygZQkS3v4@8X(zc>wb6uyh!NW3(1{hU32O!@=fg_$%M7 z9sDWS#|-x4Hur>PPVEQU?0rlNLtsV1!F>3eqPmHbIGg~&^7Y6>!{^%HN*P=OIJ%1#W?3TWcN)!Jb~3APEql@zY7l~EY4nt@nZp~Gv$s{05TQ&LJ8!NDmKtW^=E*X8wjwm zwTB1I5^-Fv?OaHuYcK=@Ym*O1A?@)}ueV15VHn!F>>V9tUklgp5@O)cfmSAh!((>e zWO~}*JzWCaH!9?D#oY2?Us@Lw=Y2y z!8n(BoAwFAla6YE^51qDyb=R)duD^bVME!lmdYT%729dlfu%|5?316 zLexXs1O6qaQA?}H{U)JSrBxwY^#>$}J*WHH;jZnx%FaGI%fYQO3Z#6QVVJ2>n$?Za zZ-2*AF1wbkS+z!_67M^(uAs6UC$@<=5!g?V4)8sZtJE&B8EBRsi!LEj5?^6Y?O6R( z-f*YhUs6rUIce)>dbyF&|6}Scz@qxT@8MBD3W9{Bv{;mYN(u-FC<@XgIV#=K9SVp_ zNsBZ{mvl)eh8T1F60f( z=Hnr{`YM2iyO!18BqAaCxxM9FZXEu?8z1Bce7KAoFn+vnRWlqN7oX;8lSA`~sIu}m z8?scIot+BT(__$K9cc8+*M}%uX*_^t)%w}iVV(m01gN`oc3X>H9#}36($;TnXj=Jj zf#XoO;FGP+0}eh?;Ihfi%Bop0jECAgCyZ%dth95%Q@f@}RZL+rL;i;$hw*fZt;oL! zzV;pV&9y4!dSn%3(<>*BzT6l6;7hU5)zhX9pjWy>-zD8y9W%jlRU5IY(i6cd7l5FX zlD;z?<;PVde4YmUVPF+`dQgwTh_>>z?H&Dz6)#>LKiLRw?YjfcIF{}`?#1TgmaPXC zkBYOzi$GYo;+Z}D?VCyCFEoK#jBY9ADtT2`c*r(d^(8noc;}8()>63Uxpw^=`m51+ z{D)mGfU;|EXs6?~Fg0ZjR~W6&*RvC88BiUKEK=Pwsdj&Tp(GWIKA_1}Y1gQ`pgGU9 z6)ZkN!h&|#7NQf<6O4$Jj)czOnqDNk)=!7MHH_08h$i)`J`)w)9zePk6qwZit7Hg2 zy1N&uuX`JxDvXNc*4}QHx0u-U@NhS)dO9y3Gyb*ed$i7l1)|=0=P%&W3f}EF*7y4F z-St!SnD_9ol!j(uv8i^{U&70zHk?>HqAus%lZGVFN=;)e-P?_N6w6cFBif%u<55x z;r50dvTQ)YCOF8OTY%x)s!T<4^=eml&q19QUG#N$y029OI~J(EDw=cmN4*dFCGO+E z1^bY!yu?PL+qYQ%mW9noBd#PFO-0NMbU&cy<#pcFGpC9Kc$*N?BPIf>{+vty^07*O zOep#tNy>ueF$|(25j!n76w}d-Y>P3C2+^_KOrENAG1%=x8VMbB9<5E;63~4Ua!%FJ z7e5tfSCExkw>{heF!|v^$5~?nyq~P5oLnyS)U8bwWqJs+Qo+$(zB?l|H3hz_Ww?F& z{@Yh}{Y--BmQa2c<>fy;DKh|@0?7kmFbQIA(AJ6?$dP0_3r1Au%+nSo`OEr~|x|pS^O-nOo-A>)V6vzFksg=s! zQLUkohe9ZZfvuhEVJip63>MyJ@pr^$FYM_H=H?lwm&C*_{g30qpp*_;3Bw)iA8iN? z_LQ@uxXy|^&UMlJ1g?jsl8yeR{h1LrZ^)aw`e1{i*t-4CzKpTuWk;=Y+tr2Gfy5b1 z5gK#h1%Ov!2I^Wr)5nkCZz^QiZJw4!@xM4DTfwwPI$BDcl!FWk**YmqHOMcu8u{Rz z;d}LS?A9cImsV-_^pZlopv!-!zO#FWLcIg*l2W=<(BcD^dvJ7gBj0&vc3?zZxMaP% zO914!*U=Z<--!oI!x3d5J+upmW&6%@kRKx`acKh<(1JZRHGI6hZ+4cspx&AZ&%akl zs_@&lA`Y(m9MBng_QHY*P`1EuLQ<~Zz`=95MjRaX{Z_}n^@HdOc#oXV)eb1Pz8dng zDq0$PfFIDuFJ-D`T0N$@KU!5K_3Y!vDC*rjP9~<7>Ns9De+&a2bEy@XG_qHjyox?w z84h$naIHm_SwsJbK@%{yLC3R>?}^Rj%gr46*}dKJ6S>;Co}RpzmKZ*pVZa;wzhQpFxR(Un9+NEtBJ7XP zs%Mrm)%rG;Rr}-PvOgIceG`AegmI{VV+*HF!bWKKmc;4XCA_TNW0%e{099P4I*tY^-Of zq+u2t35j)h2l>kQ*k_wBZqVW(9a;23QPFyJd=AK;7={O@k(rrLNr|r`L`@%`!*aWe zn4kW=oHHQHxO8beC@f5eW)?WRy8o)&h;ica_sFG49*d$PMJ;Kux`kq12l=6{KpVza zFU)H%we4?~u6!OHH6SJixCe8^t^et&ZJBUG=IcoTez%GNj+`q~13GkJ!M%p6f3(2R zb9?1xXi+--`+%Kx%YY@F2j&lm+2v&@v+jNU>Y1hxJ~v;f4M)Jg*JPxCL(m|mlZ!-5 z3?9P#0y$(wXaBawKE=BC2;KQuR{5#eEoP&wM!E-KVVT75WIMm!7u9aKa)W5iUN<7* zQ|*V`e*wlX98^zG*lR982HslgSsE=xL5D+TzVL(!ViVQW zj1gZ<+nK#N(3RlK<8;8;Jml~kY#{&kabfNPX+G1ik49%_DiB^hK0wVs@hSR$_eamV z2f{a@mCntkD4_0l<};wgu8VOlbf^^M(!X;T53%{9I3MeVDGp*Tzjk=*#Do}l0h`xQ z_Xlw;!1DkFT658?bUvJI7A6l51hG5FCP0R%wyUcF8lB!uw>AfpSGYtr!<77cRjULA z1_BVGAN?KbfjBpRGw^dOEbV*YROH8n?rEJ|J@tVE<-~{(nGJ}xSrkYbw$tI$#7mX>f)M# z&U=E+Uu~!fB?MxYA~@<6hy&vaIE(De``?}YYTVU_uA@j*)tccl4$RE}yA5`rw#X?} z)lztbwQ`Dz&X7_?MG5pj{)h|QC-11Jt>Ho|djVR^^IC(ctT~Vs2|Uz?4jT#3JAygp z{Jr)bhzDrBefw57`aQ6aQqqcdhyQg#WBz?Fyp!}ui(OSdFkD>hJZ;Y0`b_4G`x+6* z{T|JcoAICaXC*8e{BIrPf{bx5=pJFh^5Z!FD>Oz5%E}-MVFTYymDsQVwdbce0SnyY z$1v8Bh^QmI&3Poa%wl#&cNu77t4)@|1*$*DZij?yeFjAD@8!-;NK71{|NHMf9|?)5 ztVs?Pd>WC>Dbs6od60F{Gx23vMQCprkca_F~vhOy$E-AM;%a=bzHdjTQ8y+0aQapkZ@;OQnI$DMqTfG%W0ks+h2YCBV^S{0D6oS zs<=&%CL?+kQ>0DpmS2J$;sd}$p=SI4ySKnX%=G$5;C%tsVPV={?|QO?S`#V zv%1osHTuE1*bJu3ah!n8$JB%y#nA%hXLAHby0cod%(`{h(New}o>5%3s=6J_*qu#W z=un`14^Uul@0EV0)VMf*GN6%`5=^VyHq=tLCPSbRS+K9`y+vH|2a!NqEGBM4dL51XsMpOpQHz#|TY>x9lW zL3mEP?W(!cvtGEdF}8IBcI}@@`70`foKf`|DicI;=~1JjnNd+{4;4j|?%OaI2clLx zFoOga=UbT7o&EitJw3p<1y5OazPGOee8|no$isiMpWhw_&^Rhe5A2fi{c;Vu`hmB= zs_qH`F*=d3{3}H=l%H0eR?3Tr{I1t^Ffbs2CnvjFA?>QEPG^P_54Nw4ch`9H7O?-7 z8vIlo9hDs&$uN-`bPCDXZD0T6jK%TMGw)TXmIjG~_cR{fda_iN0dhdM)w;~u@U^L_ zp0ROnehT!vy^n~f?M++ocn`#dO3voj$ce1OU1XKhZcop7v(dpax6|Bw{R}@D%@WyS zW0msf!IfJ-={`$6lQrpiT53A-<;M?mAvG8V?Mv(SVz(IC+W9Qr|64x>KX7n91E1>y z0SpiJkEzL5nh-AbH=r{%ZoJ&$=1*uv2A);zmC8yLv+*m)k~MJ`7uFB=p+{5w8WoC` z_s3H;HOv0YzJY8n%#+<7d@!KP&1$0YfqRf&LzK;%de~ucy4mMnO2Vn-jlYjaHQ&H@ z@v7WN5lG=cvUT=Q5UJ81aa>n_)t2JTofN*!(HSqdbA9*D14OF1T^!{s){E(W%$MlB zvbWwU7FyVl)1WTCy1&>(zVcE|Zi?y}uffJ_N498_MwVFUJZTx>=b+1hdUeSirYjIDP zq2t;lrIJz-(sc-E%2JR|##NS)I|qDxgKl(Q@{Y_2MmlA$NAbRzw)1JwQnU{_ltELG zo5Hlhe5g2Arz76nC%6~>Va5p0@E;^c%+Tc$99+7R%%SHz_IOrDH}S#+I*p(9OKVf5 z?d_I%d1AA~gg=^FGn8vx8)Eu0qAy(;EZ4&eXgq8X#arw%&d%T503CtrySFZ*z^4$BOjFEAHOOb(7 zkJYE1)4}r9J<5*LfSG~kH~5K$f^Xe;^I90P`Zk$6kH{yMFt%@qcilWC@%bt zKFlYCoLl4s8y^v;OigXlpB=rrXux6I{~$&T5%;$8Xd>LSyf8Z7q`iE6bW43^x92F9 zcGMv*&tT*5peN_pb<@Y`DuW$HcsNZ5{`%wAAhnl`G6K-AZ^v^cK}n?DVR;V>VEHfJWFhz9XrMd0zz!_PCE;xY%XJ!jQ&E?5lt+D zr%%LFz9&;IqRe-8tKdvpo`L$JRbknFWLy7vaBnXRkE+OYT;TB4L2Edb9r}uZ)qKrN zW8c^q%E565Jt!y6P?a+XZ7@634}&x->{3og#i|Y`YbxX7P{8o7wCkvEPLuYd)Ep_u zEzWi5F+#FxehZ6X^J56O_F67Gitx?;!FHgWTt34Kduq}`uIrOIlHm^?a6HOTq~Lh_ zYDYe$J@(XULeTK1;XwA6PFZ@fdK^+gbkD+sU3g4o^Tg?DYqyFsBwg$V zKK>AK(WU=1aPVzyt*N^+26irB;l~O%tWJsY=r4eA`)h%aTv36cofW8ff2UixG4xa@a-tfUkwaPG(+)F_+!$M zLJSQ>KGp>@_(gKNq_kpI!*w_4A8HLdo|>M1<}u;aURRf@lyM1qI}*iryP&y-AD>gk z((+HxZ4_{D(TjTxvDj&fZ{BSD@~Y}jp99ShV^!Fv6zhKf*4h5!kSN}vnx~_wq4DeM zeU~}u|AaX-4p8!)mDde5>hmRl1>!}R#*|id_o%+Vrf8zcHT2o8$s&NR(`r+vvxBX@l$SYJCO z!0)p!-;bH<(5f6AJsst2xzg2-mHoD-f^6I%lwe@qIhP+UDk{<=-^1*vnAuYzJ%Tpf ztjbU)lna!jQZf1IbeK&z{c8!g+ewj;gji4JOC_DN!rsoKVe>r)55fd^F8p2 zOYPI0W08**9F3t&3U?0ofCb+X%j>rJM=CMzDcturN1pA>Rn@vR%&OHQCl7yndNL#E z!q@aSSZ>6z;kkZVXn%g8mRaeu#ZX>DL$`483kv!={|i_!UkZ%7Zm4)n>}IHlKM^-J zHeN7UQ!g~^NtcTJz8+7^;7KTSd~(>3B+0^Cxqg|AJX=$JZL_1>UN(Ss2+uVlB0|V~ z@ZRh8sHot9y#xQ~hnpp_$ozxtO%2ob?xdla0LPsW$|F~xVE^%>V&{0!f4Z-)XkB1! zyE|2Ts$RYWg*~OwQBOiQWa&ojH?Hn9m&cC}-@o@H)bgX!w`;pNQ8@_Mk;V?b<`URx{}J0hL$YsAYo(crk3;Z~9yq3o(8X4sC) zej2SwN{8Y%RD4wDwo~1itx(@ZkLNkf1p3JbOvp?eg}5*~1htV@9ForPn&I=y z&%0ZD#AR^lm0im>MkXq=Mhdd6*LLTs8pY~wG2C(E*pB4qK|jL+7cmyk!6Ms{EL8CW zExqO80+u_>Px(koc;41_P!;`Wnzkq>=lDIX14|H;xPD7-?5AP`qyYrK-+J*`>YIw8Zb1s!GT$kWxoR zr?H3m3)F;IuHQ}-Vy9fdNil3p@-j?KgR;#94``r|>3<>p{IY=6Q|$G}+kb|KhrM3bG>()zmD|cBCi0j}&=OHP{yEw& z^1wn0y}iD0lhi7GVdC69cjDbc-%W3$|B`^7MJx+k0WD|&kPJi-b_a&NrF8YxrjZFVV?EQ z@^h;N36~FTfBJ$QH@_Rt5EK18*bOIgy|4G8P$Kk3V#0T_Mj5>}OFN78_AVMbxH*M| z4m)URcJUz-myV6Or}JzljRp%JoBqSrAEl0-o>OpkX!O5Kf5&xOskq2=dwc7xXJH!WMS|s&M#EyL~i0!c64;_WVq$ABRv}iws3dm zG*SfVm*;+zeL?)#vno}tc#^G_5PdoK;tBofs$S{o$yYeuR!v7%I`>Qny*=7HXKSmR z2dPx*w|DPOI)pl69?XrHj^G268Cn3|(F!5b%<(gT@Xblf{<+F?DFHFu5AJ^}dzEhe+@W}*`}&^z+MeKy z7a>_cndqG>xp}!bICZ88S*S8rsEQ^^Ef|>Smr~4K)iw@^=smNuv-Mp%ymx82x6RZN&HNU+ zI(GNa&n2FfZS00lxE;96h6L{a+$Hvw*3s3QbC8%2u6pcq34e~JQthNKue9||!W*OB zv@T-(kfGUcKq)OIbKmeXi<}6F0kha#E5~ZEbCR^YcI7j7Ktus?lRsTKqHRtKaPh@TpU^ zO7pDWidDJVxHzK)?eDE;*ujr91usIb48@0Nl(AY-ruFkxe;U-m-mP1A*wk|0G-s;r zi@PxJh2@~nS2}Ne@AQF@LI}rPxv~XfNH^?oQZIUmbR~N4npc_1JbN}xpJT5=eCNs) zTw^xLoF_&`!@na=t?cY*c{@{PGcF(`e6!6WZc8S&MeSD|AIgASgzNFP7)|sq0mRj6 zr(gM%DKIcn2MM*e={I@pJ&hS5BDFbl)IU%(xd!x?Rgrj@fF2cV`RjnGg@Ph2Au9b z+dEpBs6_rjtM8$Hu^pE`!*U`(J+c|>J$6H%I@ENyJl)F8n;OCZH;i~9qN@Xt&Z9|g z@Ev$1={_ty_3%-hL{vGWN0-rphEn_}5kZ1v^^qcZyV&m# zmb)iaU(oK3TS~~tAS+!f2&Yj@3VG#+o`iERr1X8M7(B5r<4H+BZ+2)NP)MHL&*iXF zQAsP8>CRPRF(h1{{X{su%A%4zUPABr@}y5?Xbh~v`M8X({OJ%P7j zt0#wl|2F=FJe$i{Dul{Abz%`tlc9U%zzAAE{B1jYZStBR{H<>scd5UMn>(MiP@&ZM`aG1^{9dTyu1ROC=OmuMeHfHO6O=wuFteL zWw=jGw03U@jyEt@E%1IAbF*nRtp_0Z{mJI@x~5b{LqgiCa)t7@4VTe>jO4O~39@oe zQmW7nCYimAj1^G=Zk1*c4<71kRXA`Q4!rr^>#*&u8WE%QlLdnb*vA4TcN_i4aIupX z8jK-H>h%f@b?~^vb$YZZTjlDtPskv<0fnn#Lxt+N$C?_NG;{6e5sa5{yx=&STUMr9 zWXjKLyF5zg76pe+b~{D{Wk+{|Jofr>bAECAPpeIT&OO_MVqNP~t3+9&qhQxI<#M^l zLQBT4H~;wSIGg+o5y!UJ?H?ocQT`8&_d?=X%fp9ghp5s}2d!3c0^3ua!F|c;c99^q zwGemUI}*#0;J1T7Is5wSz1pVyTPFJ=0~vV!lu{Iz^OVtLmg5>$~gB7 zQ7HZIDJ-6{M?Fg_ys@rF77|A3(S?QiiQ0Gs0mFUiq{yc*);~Evx}J<4#Kx2r<5aq+ zW6L$yCtVAkO-RX5uZ}22kB45m8W;#)4(<1OI9h4dBdXSuRZb|(JS!X%W=naNdsP<4 za3{p#6>;c8L>5UhZ=R8KaNdj*c`z{@?-b<1jw{TaD*Gaxg358(PTVaa23Q1GE`0t`r>vlhRCkK~?wP3-~+q=;TH`epX>Z|-Mf%8S=!y1Lj+ zOj%h}l&2bbG4ni*5w=O0h`@M45$wRLG@6S~AoB_T{Y}X?&GM5^K=`GLqrK8^bPO0h zpS_S^uGR?UcyRB_r4g0vEu)Y|V!A>QI`j4O(P~VqZa( zLl=j5hDryE!c$FGB5VZXeK^9hs`u+O2ib^vx4+Dt2IofFFIaK67Ekky7jw%Sx3)J2 zA1kJOJu!5gX~9b?&oRnM-&FaXqmh_LINg~oN_;5ej4I@K+GgLwglp{co@bBLzj7*r zz4gl{(FW)HcRC(^X!yX~hPlrWUmKJyGs))w!9UFAzLhTg(EBboepa0QLSVE1G9WD1 zLfJAe;YGynSskSTM>1lC5?s;RS}#H+7Nzd~ezrX&E@l-$ySbLWNFGS`RF^eP%|pXt zVm6b+>s4a;owsH`84l&8XQ)?fWOQUadHRI(EnU5a+(f7d5@}%gDf8~w^f(m;6RJMU zR7fF%8p{`Oi1d$%F+1Fm0^TGDjLeoA{@LypOSIooSIQuZv)R_V{su+ei`UH5s&MHrElzWf#9C z(eBjD=yyCNeKk@I`erAk=COnc4#z67b=?C!#3E6AZh}k`$#sq~F(My5>*_)yx##$j z6q#`kmB$l&+cWyx4g+ZC1kgI>=B9>Bo?mxo0@g2=nir8Kswrhic(A+e(Vs?`e?G`2 z>WC#*RTcU8fRvd;_irN~PJ*#YPF>w>b#=Za);m3e(USg37Zw&}Yv!r44CVc#l&UCR z3)#y97ZItU?a}JahbtjpzYYcnexoJZ5k~VOBnUJgY0`^9=55*Sh7NP=b>6oAG>2qY zF?9by^;!g*fjlK@%w-7A8=#nOVHue^(2fq6B{&R;|h*Rj}6? zk7&@^YA@BFc_@fW>(c#hYQi3*{9>gxmTcoi=zUCpEPuN)Ho*r&8%F^>`RH+%MKs$c z!vSa~fp)0+zbPqXW4P86ZX4Fq-6F3$pi0WaV|dT0Iq1jQ8o*~+=gvh7o$z)v^Apet zIB)2HAeoWcaG*lUu-jIkwe$SmdUti9vxDK9n-94V$Yx7D@!t6}hyKItc?}XvT(|wX zCmKU#lSD20f+j`nHTm&10YZ&U)OAUJfjRSc*k<~G$jpYcD_&tYl0eUe- zYwN~%QTB^i`p}}PqoZ;8@{)kbVETX>A#T>^$dNsIQBT5h0y^50dh&o+K~jd} zIO+Y#ZH19Mn*j%$;#hj;m`+Qd=xbDckM+V3bK(?naGma1&W6jx{5<}2&t6C=O}=Yr zsAfV)7Ja?*nzHizZH@a6HX>ptPEL;b!<`L5xMqFB=!f%uW=KfE>smdHDq3bcYDAK! z3Ib1$eJ&&yTTwMED!$%VUqz8{@ah`P-@$vZSa2GCgk zO?Q4u2YReB{PZ>)zq)DN4~tg#m)&?-xmM;2BayBfbDum;9XeM$hlsz|3~Fg#*oCrM z3QK4U9M0~7&N<)=t0b8AMOk&|+Q`=r*xoQ=H200>5Adbl2kW@;NPEnN@6IP1eo1JC zj1_#tzmOU{YPuTGDJkgn^DwPDTeeWtHEjhQYecP z!L_%CXifUMKTmw9O-z$6j|~@vUTW>nZZkV|ijIjHKY-?&``lzAFOUUIqdf{!%O5*a$f)fxgmn{Hbh z)|q+b4DCkuMDY~oO)2;=78m#CH#>}#({6aaoI#;F^Q%=k;5?v#zAkHLVZrPi zrzGgQ_qqZO)t&KUxcA5rvIl)x>ZX8c!rLZ3Z36)w7R$zSvXljjoxl2Pl(E5ivLVcj z6*bh0>iZrppGG3`;u}Yr<#vn6N1=h!q3$eQrNnf)m#+894i^E^xf@xWS#sWbY2pdx z6%=P?jA_LOd^{nlE!CYNB_9=CJv|(HH9Ip_n*Estp{KS~`_i`skM=|j*XByt;Vq1( zhNllzC#ts7WvUJov9A)7a>P$~4wDr+aW3c11kjYu^YZbt?b*EJTnQeJ?PXTU_-4Vy zZkMwyl)XE#>^9TlXV-!Oa#FMWX(G!@L&JG$fo^Erx6#?v74|nnofXxjJZf>-iDdPQyNN^=!h`^dD#kC%ciL`>JKFsTvHJEYcRlKP@VB}0v8Wv( z9|Pml1t&=_k-$w|+pH*Y@f{S8@h{J)9>BJl@s!!s3g#N=^6jpZh`dx+vo#&D?fAy! z=;&zfNIqn3ZLKBrm4@k%2=eACJ9HF>VNmZVqXjF{6%M}>9bW@ChX)d$R?gtNcG#^D zEiFmV7qH$PUlM^)K-dQZJm|Ew#-`q1g0NbT`7>IY2AL!fToS+DpBE^ zNtHEK9X0nkA86#dcv;jihh3DJMC2nJNPuO@&P8$OHgMZ+6&g(3xW~EHs*993#7e%E1bHn>dG=`O1C{pk z8>v&d)-&BvtJA8pZfNa!ij&#^p(E#$g(3E6jVQs$-JxGd^7*pw#;4gM(x!)TU04ru zj^R&SSItSSu?j*%Ofol{=47`D*l_FL66{9emzeled^XB!j0%7X?8Len@mM5C7}qy6 z3b`Ki4s~^PR!?r{^ZfdCWqX^2mk)=YR?s!-TiE>a;>&rwF%OBP2M7C`b+bC;3@OF^ zZ9pvw_-Mbsk>nQ|sydWczpgxfgX!Tzfg8W-nwr{&54MZfZm^-(ds1xs`{(uanElql z>v^xPZewT1!L?Ar7D~b=PC!lf>HJ*sLqnmxMYZWzj4Z}YW&J^*ulzyD%e}|HH4fn!@3Zz@Kde9TBD|-S=OmiJVr{Snl zxhCC#?D+QfEP+Q@t$@`_vMMP0Y@r`prba3>$DJpXkG7z`zpTP=%LwIkA+TKYDuoMJ3}#Ls?L(6GG!jt>1`JFG^XX z`m^C^0ku>gk(%O7ggXxo0Rf*Knt?7>>EK{aB5oAv#_AUkU@)>%E~3G2HaY-WFFnbA zvX9xC*ss6J%*xV_=1ZIf&Vs!UF~hvRUUIR?e(309L|h2=%>cF6CrQ&xbv-%`5J3WAYMtt^4}5(ht8G(CD#5N2;9n zy@HofTD89K51>SA#Jojh*5J^{;NZyMtPsO#>b_*TlL}=>Yi|7w%<3lbiiydFuTiEr zG|&cYwibu17P9+tkP7I#vdFoX2u_1Z)gV$xiY-ved%F`dNzlT(#;2~{x{V_DrQx?b zISRdhKeyI<7gMHeOO|D%X6Bvcs2Oe_9tJ13b8u5yt3xct%0-z&Zf004Bsf+qR#q&V zA|Vh>(chN8G+0bkhlj zKtba9QM_o2?-hDaSw<5EnXtcJseX2-{tEbir3%6voMsv$-FZ<}ZgHcJVZzUx~=n)UTeN zw|I()#;#7;Ot@9q?xL?daA5wiT0Kq9BUW{F97kK5-tz(L%DCrc%f@#NANQuPFvr;| zs6JwWFk1Lc;XvqbH*D}tvP^N;>+J4^_*vhTs1IDY+4l24^DJi2i;LtiJHCJ&l5iHx z%uJ1kDX&FkgsP4?^zK4Tzzi(rVpPh^Vuf<_P;16JUyAM?Y6`2F%Nn7t`cU`^D^7*GK(2A`@Nfx9j!$1*+7WQcrDry#I(CM6)bcr!1*>V z0KlMT#s3f?=K=7U{|(`8tITq)zmcxP`9we(Ai1+~;rz;JIK?xO8N}~p(3L>TbAtJ4 zs?fI48nH-;$?&a$LNCIWf`X9?_WisYR*C97hH>igBBhls5HR64g=fIOyoKf*W%EdR zU}fcatQ&0zz$NXIHJW7XG0;%1@?g&O#34U0u%?l2_iltGK!iHIse&AOzL4p!b&2=T z2|C|^j2&~u4S^~%OpKCpeoT;ti_>G6Ymdp=W+hoByy3Eb`>iNmdb=B`X&?7DIf#io z2_@*64-Q(+7^T97ofU`nFk#`r&ELP*iJ2kjvBwk?5rEb>-sj>ngyq)U>$rA(V{M9q z&TTZm?%?t{MA8c=0ZzE`&kf}-h<Ra$+L*(#T444h6fvNpC^Z?nVRsgKlWKg(*Zn9RfZi3xkIgBcrKYsJ zl68E10kaPCUe%;O4<-wFk=4|s4>H|!oT<1YyXO#}Q_aSVs*brQs)fx*OB}H9qkwgA zHfF-~pw(LP<_W{in-@wwFh8muNi+0_mGiiSk94{1mrq0_0(%Mn)!ruuwcha_SS+Cu z^q!slwnFx@e`ln`r+Crw)4iD&5JEk+7pGhfwvs^L4Cce1>88M{-@jYJUSt&-+b#YH zTN((6jfcB=7pV@0-{dbU72LU4q`4%qy z`SbqGH2)b*H3u&a4tjpTdn6gBY`ul+cA5wh&77RQ?C)TH@4l<3*gn|CWmd7(0+!EQ zE6?8v3RT%4U*F$LJ#K>qh5@6GJpm{iJ&USw!o9`t)Z|{TsDYb&lEt4abrnh;=?W`x zwCoqD-$kZ8PCFq70;D3)2I8k0Kx=tM9+#yA34Zkg1Dh8wG9e}mwS=;ae1E>OGC}}@ zWmMDOzp=ND*A_Xz`c4hiztY>^Pb*Mje7W~L;-}E>HYt^y7?onPLIA$k7DPnwE8?MO2Hh{rr)3viv82_Zkvv-+ZKsxHjwR^&p`nT_VC@>D++MTfU zet#t<^W{}R-Oo+GNkp){emS&Jjx6=e;bR(m;zHK8$BLcozEoDmzwIU@)YTv%ST9@xPZ>sP0$+w;6#*!W6%DR=k~^)hH<_nxL~Q$6?bE zKwK#B!Vd5o)~m;RiA4$}D(*dfJ-s{^Xw-iKT9#GEwi2Lde|mswNtLq#LhbCo-Mcrs zynOSQSFGyGugzblmWMJhk^g_Ad5IH7b9tf7YOLUSdQbx6 zg?ZC6wU-F+*VmtyIw+*cV$;J$Wi(o*R3wU3iZMk(Fh1Ja-mW}7@p1M@Kt0OVhfBs?vRh2*fI@m&kpq`NdrA z!;4tncoZ9M@VuL%&!i6!*M&g+(adblxG(+28FvlA$k+xpaUvn8kzzfa@2|7eB$D9h znU|N)pH)8j$1z`DrZh2rFKM*IB1<(N(?Ulh#AZ6q7$VVwPa}|+V9lcVg&%{@xpyaP zRs7l6>9i;0a%9#-w!PA9#Cz6D0nwubA23U+NGl z8NRIdyYm4z*=fQ4ZOxLmHADMPi_Pvw^0d+rJ_)6z*f&`jX4(GZWxe?2WG!9}+pa zW0JXGd?@BTUa$VzJ0{f*_}#0fjs97-DCO-hgk@*Sz^Nf3@u|vfSyl^SnA-#b z)9hT|TS(B8g6QOa2J~m{Z_YORq-TR;VD8}He?_Yo5KX_jy7Z0@E-Iy$upuig(4(<% zcKpA1;gyjwv$b?n_sZKP`H%8xm=p8^J+a(3^@6Ej#{aI?UIp59eIM-5_ua6wB zigjF&R+g7ne)>Tqo-vdzMe@ZnSw@nl4GpFK`nq~|7#OIoT{A$XZkuOs9VR4YWB_vY zGA$_E$LF~ZnO=osb2Nr0TJ7{*Pihx7QQ&qaDPYJ~v;sCjzH0C@ZjHWpTOv&nEOBca zQ*?Wh=~4?iKj4-B8OWJJqcgji5s06k($bp$^lb{BI_Floy|Ui&srL~Y=;;aN|Le=- z{?^9kn}CBsU%Hv)S>vC(U0na8S6;6k8imZI%2}o`UZ&x<^#y@7w-e{=8HuDkr(HC( z!wDU&dA#Vte0bOmxC~@_&Q4R;@myCUQ5ZLbo^PCTE31b?`6_geKEoTNN@O4qUxXkC zBuS>Y9dF~fomK-4o)szB)7vYCmOXnVVQDC6v#S@q-dh{b&i1#|{gIy!pCwTPcx13w zy_Hb+m^iF$Z$~fnq{zewL}PwZ{4~D&K1oxShpJ+8Z28vUQ0#x%Nd5Us_&?&NAega55tJ{J%7d+9F)Ln z_j&rh;NW0F5M-U+Rsi3vzJY;>JY64ZjI$|p9K(jn%gg%$O~N<_8ye6yF8xOx z%#SS*QdsB!Vp@u7(@Q;Hi5b|oRwq>BWm5|X5yCbh5=o<1KL^LhKL+w5AVb{Tf|%TZ zmszgGwH5QS2-!d?9`xeU5+6T*6Y1o1{TF)Clhv-o6idurk8uALUn8U7U~kVz@_B7- zZ9s;CiV6gJK?jNk$R3trXNMjeyS=p~m|D3mbc!uCHObP^M&N%2@jt08S;`5vv@*M0 z$VL%})9#)gE-o%P<|jZV9%&%Qj)RZSqSCIIjkyDa zEH9Lfne~C3BL;0hF_5^fL_%=@H1LT!&hC-&6|kGcKo1ei?$u@+-# zV-u2lP-q+<%B*ycvp4+y*~cU~kLUUgKHp<(i_?>1fsV4Wvi>v${h0>8+cB6$2dA6T zhcal-7NCH>1S#^fA_pVAe!B)fUWK`lQDzyD)6Rdl8B(A$`Pk+*Y(JbJMbE)OY-$P) zF5f}f^50J4P6QrU(2}D#er0oB>ScieWW1Qyk0Uf#>rvd<*%A5J)YQZywb+x=0am|k znq`W4f9FWnBYQ%JDUorf_zU&YV6^0Nm<(?T#heyc_4Id_A16MI!SNEYxeeqil^iV_ za`K0H1|3~a9-iIpZPuZ)rcFRe4owdsbi=maLi69M51Xdi?K^j{ zE*`Vm5r%j|10t`(hHPJ!+s<+y$S6V1t*8kg`Df{P*{|QeEuv7M1Jqc58z(;Ge`v*J z9`o^@t}a^}n;@2Ifc)0iKUpfB5&0521Njj+;Gi&F#Ai|# z*yr!wy*rD2mJ9uv+utm4IrI;>)}^je>^rKuRtd`WdHMMs0PYmq-7L+IyY*5nOkr%g zvhpx93wX0R8D&HWcOt-Xh>75s`r*R|KE6`({_k*uNlB2E5)%h6N0=vNWkpBq@3?r_ zSX+arVNZ8ANO{4Z@bN*g1yC4F)Y!hY|M9bC#vwjgh|oNRm&$sOq?Q$4o3;l`AH8jFZc;C(Qc8RFIYUo}Ap5sj4a|S!BxK zy06+;eg|^d_KtDke5N1Sk%uNH?Y{WfYl>@i}fS63LvcJ)?!W zR$qWiowkiI$5tc+7TCp>;P4E!IXGzJczFxu6&Cgm3@CIRKsHG&WZ*6bXY*)Yp1M1q@}>bXyF5 zp&tX-OG%D7RP@79EbvB}gT2#J>;5mYDR&*f)JRrjw!$0d%m42`EN}Q)9$gZ0JJB#U zMmg(gRngw{#Kyx@U=H2qj79wkyU)P^sDZDa)IBb){;sZ1pB-%%JL8Q9ve`BE{EWu` z|dp{xJTXQdL1!_=H_&u+e=AVW|iV*ZM~H! z9uRhSf8v+d=H_!QXcT+obpGd0wF(Q@cH80Js_ok=JM_ZybwGQK<_~vS;xeH6Zr{1=Nj*m>8|T z^wWKohQUEzK0fHizdNw5F+D^4{ar>zhIb=XtQIm}#DSlmpFYZ{H+4MOZ&yFo5j&CtBT)2B=e}nS$Ofb9xlzJ7RitB^_O6r`*69G9;qr<)x^miicI2$$r|qE%ln6`R^26U>OX_k0`LQplg);v!6bYL%o@IY`Lemd z4x$_*b#;SdV-?zs_)tg`VFacN2sIohNrroZ%4!#^{%|tGiOPzsEUBFX@B=(V<>bf5 zzXoE)Tq}QRc{$8fPy=UidLKJcG&_3>#)^$C8!VK|ocAT5P#n!?15)^#MOSie-MIr2 ziU%Nm23~x}Uhw$#zkkl?UcR!@Qh!(l%Mr%y98 zQk`Y=<}N{|e0`yO63)L|C?T#!#$#x35St#fi#KBXlcgf-p+$2jPZyj>Z<9i$3r??+ z*48G#*+ccuag=}Y_V+J>hyjKdFQN}}F(na;xYyZ80z3jYPD>qg45T)W3kdk>m95Pv zLQ2QR4)aLPoeiVgTzjywJja6FhTCND>!ba_T;g}{9{Z592OXdwf`?%m8$eH6;;fCt z)m7a}i_L}zq;9u2J5nH0KF5M2jRN{vf`ala=W+nz4#5YL=@NGe^jP_BGXt?@Wg@(o z>DYlj*e-%ox7KV99U`@*#Nxtd-RSihEI}8_;Cu_r1YsnDjjJ!CyjkfHE33=+Ph^At ziul=LLEt^{h`j`snrz@C?+iPKnp(Sf$9zI!;^ve$T{d(A_s9rAy2m=?iy4_XGH77p z#+=|3CM)^@CTNS?rRB2*v&Aq={m1wD-30eG<{~d(*|wuUGHL;`3hv=+8%C+0>(3$b z;9OV~7$}$RF*UWT`}rp50N=s`XOxX7*;30S*W&~DSnOjG49~AHi^m%dk6DthFX6m9rG;gljb&aaKPGLJh=)^6>&xTr zBq}%|J@u3LcP_+CvV2u_^~U=8Ct_lXnJ@3h8bU180z+cR8@=&q)ZQ;)h7(cE0?08f zZ8oIZT_Czb&1cOAy@8+0KEg?AXH{q@(YqLCA9FtzqKWPLD|6v$tx^SG7J#pzKTWxG z6fcwKTU%RhZtixgZ{C=z5!Uyn$yx@oYMdPTg6m!Bb6^< zc}G1uv`c(?YG?;+R;DbqLP8PirRkfVO=fGYLLS-K=-K92a620w8Ijxs9w8Js#pvtS zXBZ6DF2u#a9yXRL$EvMen{bzi=J*CTcTHQC^ZHrL>jm30Q@{bzRiK~@!{VOY&0I~L z%Fe(5XSj6`ia$zGefhG$Y|IgMdZif?;1yhllou{|5aIqX=$ZyEOX;uo((G0%Be_k( z@LhL?>V9SQmlcNhsxo+X4h)$0X97PP60g!^$PyvdrzgqHy}Y!AN>XTX}IKp z3=O7WUA?_PDcD@bjU8M_yxOf#~GA8G)t~xn690p|$ohy^j)9P~Y%*Ex=zY2%k506+qD=RD9 zD_6io&>r<$(B*(y(3zK!v8lB+Lo5MvV0KsATPa?Fd!ynniUsVZD^0;CNz!eig5O|k zQ4rRtg<6?)S#Lxf4lK|#NScF#vp)A@1uMsB|BnlRXfpf#Rc?Gd%Zdh|=hhE+RFZe9 zS4QF=BE#5MA#cD2)515ZqrWqw2&cgaASV{XzEsKn|EPNJc&z&`e*BW8lF^+}ghbg? zM79z_A;}(J@ zYHDxn?W3cjDvl1uI@W?Ybf!WW4M}!)*J8qOlND0r{4WKusjqJh!OZfUFx;4!7`*)3 zDF0XyH)%W?z~@x_MIp|HV~zx#6KZ&B$PjyMtvyjI00m@#dtowA0PUH`4>?2OuM^$m z2Sg|s$fj<&yLx#pE-NbwLafv!EG*#^`6Riu7@tBF zrJp3)-~Ii&Y`1<{Erk@tVd@n~X=q-<$OHf6eHYyCAcORx8iJ9`Vi?IVO7<~0el9yZ zJDSJV*47Vi6JEVDx{y{@3RDw>BJ&uy+4&ISV0(uke^z}c0vII$mQ>vP5Jo`d>~HBq z#zi#5Z*un{OCM)o(CRjQ>$4BXVmPOGux6w z4zLY^$JXx)Os75*L1hB?W2=ncgs7TSV3{ly6qv_v#>d}=9xZI~2xlp5#H!Mz50R%@ zcWZc2uG7gM#us1ykid74Oi*eW#qeKJ#md@59Zv9IhL$+ghiYnScF$lkb&Ka2(LVwL z3I-XSfnZ5BeD`jAg_^;Nh?s&Joe|1~llW!|7#fIg;C_H|SBwOLv>P$d!#9i_|I#M& zOVcYb37Nm6z5Q;3RPeo;4YD_2C22kv*~LlxxDAy1j`Q_tJ2Qov^U*n>W$_Hn|BBs$dv0W_58?2qL;dOG5_` zEggRdB*-&%6BiTA%2kjcTU(o$0XD+HUgg&tperYD-cN;@q?7wIzF?V&Zh|j^4laPW z{K8vZRL&-fmWz|*<>l=|0t8p0;9%uG@mR-7UtfyDEPUtUTAvf!s&gkd+3o=*3V)9U zv(e7|!4FK@0F0bEZOSA1$OT=?!OgA66ac6(Q~hKqpat>q`v+uOw-M?El~|_R8EC)N z-D;YEGF@n|LKuB`7!W1C`EX#FPZVu5H2+JXh%s$WWQEepUGK5?;F=&6B= z9UJ@Eb?EXVFuo0aeafKNn-J3+F@)^~h4AOk5c=18Q=&sc6x6WP)WTee#C^`yR#%^= z0oE9%h&gS(k3?*zIK&?voDehXt{$wE!B__pMGKTQJxJnVluNWclV@gqXTn`zbiRLY z^djClgE0nn5v!@;rlo7d6kp*VuXO5w8=|c zXDida^=CAn^Q>aP4-#+Y$t7Kfnyy__#B!fxfGe=up=vl)k#SPsJCe7;u1Codr&q}I zS3?Fc4tTIX=X;o^*fPS9=Y9TJQAgX6nfL#zPJfN4W!3MsC;_KQe-@05+^q| z(J4pb37O4Dq|Wc5G$3WYH|QxT4d>osNx>xa88d|_hNhI8y3M^KqN(K_QtIkMi?lG- z!feJdxWord$Hk>^9xB_{LA(ha$G&g)XPLP^bU9~jXE$|mbzd>w`C7<*eO}AO_qq_x z8N!ge9Q_~&8*FTH{(A(PZaH4)Jo5nH05u-0$j>%*-2G)v0Z=UXoD|^Ps^g<%AW2p2 z5$wy^Nx=SUu)n`tN=T?0Rv`PxgZFJ@|FEI)Xj&^2@k`f>Bo|A8XJ?yJP~g2}DFx^s%p!-8D6-lKZGq@4!FWW_n77EFuj7+{qGp+f;H}~kRXaN}$K=1Rcx8X~I;yMb zT2*XHFYD;cyi9hq+2@>}Y7Bb!F8=oIlVw+ZBO^hJdH+8@guI{~hm2EFnsH)G3~&&! z$*Q;QTBe(wCa)!pUIS5BSFT}bf()9RoLohzct6>`!N2tj!4ZRifPkIKP@%3g+8cy@E)1P+8VmHFt3dU_vpm zcNuBdsg7s2mp(vBUQ>DxW-mU9lKtD?|A2>QdU3fiJ|)FaM@JE|U@0jx7_A8TKKQk9 z{K(|wg~>_(p&|N=^mN$M#(>VIrmmKjT4 z0J5(=m<;;Tz@QQWCNOK2d=~R>QdFqGwbhiaw}guWbX{CbPK-SA_oRk~tQ;IapoM0Bc(Ml)YrB>m7p_kQHOio;DP&-EiESrYRx>6qyZ0vQT1#%I zon=ctLncqRgHQJO1D3p;{GDgYYLd*)n6o-=8|Kw?+&ttHg?#Sw(ZtL`z??tQG?^z%jr zCI?;JR9a2mpkm#POGr>WA`OrvAtuf?9LV+iFQOMY$MQCqkf@#{Us$O3*bU_~G1gu& zJpArp8#`J=*38nfXLwlsEp>9Y9xbg_ghLO|xsSKUAhYGU=vvv(5dB)@rE*`@;NTez z=Sz_h3{19A6z!T|KVR1npbF#Ot<8~NVa{}86#6Y$xf`bE<`PrDpP*1OJ~(B(t&m(r z$@&Kcjg&c+&0Be0GAWNrH)*vVyG2^|3`ccUjKix)wEc7V zSIg1bZwG_ulCp z9m@Un>vmc5Gplbg$slE}u@D3A+4~vVQkz=~Ntr&ZtgHiNCs6;6eiY^F0Ik(5!sU{( zb8|WG>dLCA`JpuvyY)oLu!LE+MjuL;n0%c@-qqDo$0OUt{+y=vc8&VEq@=mMJy%M; zTw+tq^Q!m65fT}lpZ_Jx@T+KaW@2Jubd>1w<)|#o18Yle4vm2(F6@P862C;=C!YXUw}u(V=Bux$`{=PzudWhbbX75YZDa(az3#vPMn^v~ zzl^G1DgUT-<+goTsH*J51&Cu-cbs^H%4B(VsVgZb5!nuu z?`1s4FTyeHPyGBtR7&b_bSTu(?6&CX18DN%KkUpw& z9$qLEAjTAO6Hst90bGgBNE z5(nF??^?oUXWz50{QdMP8s?LpJ-7dd5BeXvbVWYIrl81?OKNImXJN9v!HbJ}`vL}y zlUc3nYAl3@heL7Cwg2utIo-ro*n@j-s#SGbkJ)%J3cX7oGiFisqwSwY!uh%#uY1F6 z(a47`FqDbYWc)D<>K*FBq=|x`UGa^2o>qzQKA$;@vj>#{H@LQ;a!n&zRrY0SYD?j6 zUUN&h32fGlNT0_Ma%5M)VR>syM4>jmA8f(F+&xJYn==lw9ydo}=*^eY5F9`vc2(UrfI%VM~_XYiA%!(9+V9@B<9; z<&fRbAao@k>P=Bi2*t!7ZEi8*tzV^4ddmef`?u)A;Ej_}eqvHCbKLP~)NBys;@CLe z+mOIMx9RTyKJ}b&)6a4kR|gH?yeM`YVI&q9JZmN!8yp$4gZ>=oEg(LL=`M8KvykSa zQn1eaJV7)6!%M%|TtoEb)8uOXO+~9Pcx4GcWV2lCL>@hYL43eiS+rq7L|)K%9l|e% z;8Phcp@@jvcDG(madlei1INQhVq$@dTF?PDR-OrFHQhRRi$cx2u&MW_svo2zCvPO6 z*`hc63?2RNUpOihLiX(%Zbzx@LZO@2%+Bgd*o2`5qi9UF2{@J8_E z%&)Y{LG&z?D`oAICNQl)3_u5l|9@3)YNi8OLm^8QLssQQ-e+rTIanHwQ&u?EmE@_R zv7G5Mlto|BnH8gANP}6|1zg;sm&v76{C{<-z6c-|B_M#d@I2}lE7$gC6~p#S?amNn zkl;r@zmB_FpH7!`%)-cM)0--C2KyYr;(fE}#~=S)GSb6KpCLyFG_slW@SB$xpr-{e z@wm8{pE4HnHVEKUwibG|`m@)fMVu4+TH@bkiTIUc#B#y;ueU(8;9V}R`H>OT;S6y5GPL3ZyL&UOwhfhxZOr0?0Yo8BHC;I*y{eX1)kp?yZC zWwqq7(4DMb^@U0O5=e(t5X;%W!bIX>ad`Oes6F9Rr-EIU6&xxH)p8=D&Zv z;sPuq)BI+B{*Mb6bRJ`-OQH(PKcPQbXOBV`#h1^aeb@yW8k)YoJ{WX$YOhh|+VD?$ zlBHc%$Ev4gs85TH-5jmZiWXVTYiOYIzP90mc2ohAi^(n>tje7u*1d61kr5CwE0-R6 zey7D<9J~eu#X)fJ4mj2FD~tUWvlT9WAwzacDw4wG$#?J4PkLianF?BPh@ZdTllQ37 zl^OA^|JOc^w|_z_B$ogk-h4a1s0f@XFL;LKQ#>bf zbihw^TSL1a7!Iogs$m*^ge*YK!rbPsJw1V7EJ!HN)W7?iehgq@nH9UL`T1iN?YLYU zGo3!N!|lbdE1e0U5aq2XLB3w^OH<0MV6UyGcTczDHxf3&6)OWQ=y{x6U!Ji~$k1?h z(!0retiv2+_x9H+a7P?A+aGW`S_;?sORg_a# zZpuJ^&WPoFmtMsu&4g#6s!B>MaLX{F?c)1g{Zr^ni#p*7Ro zOyO|~54lu+LXUlb!9`qLjv+WgAQBj>azg+NQqqPHOjiot*V@{QyjZ?3;O&9sf*6O0 z^2||R-b#8>lEliex+oaLSEEp(0c7WW$HR2E&aYp0Ub&Ly0cUs8k)<=EsEJRij=XLD zzNLX+u(wcn{vXL5!~Vg(te}4pr1@tYp{lXT$xVOb)gN?>4<6(f7uy5Vwr+tj3QZlI zD@O~Op^p_&yqB-e+JWRl&_n|d#>`}z>4Yt6?LhJC#6(5o6D(94HZ5%o8h#Ki%D}aQUyD29}e^4#K=#BlX3F0d@KEq!(m1PB-9>QB_sQ zoaedT z<=|wmRde#_qr{u>ZaA=3!3EZdr*Mm`1#HbP5~6!khd4H-Q+{$88ohp<0VdQ}!(pov zpJKafaoF8meQJsXs@w`O*b zuAe_c>2PgbU1Jx<$eK2^vIDsE>cgtAogGCxD+Wb{K|P?CeT4Ws(!(I|}$0vQ}IyTH5?Hd?4JlvRp`}4qjR$l3^xkkh#;oqB^b_p_?zxqn9T~j7w zgUag*zI;d|o){OxZPiz3k&$PmgV|Qp4Gu8zZs33DBw&Ot5Tte?JTT=MO(n3uX@-1Tn9O!( z88j}eg=g9Vq{CILX4_0L5%?~HS>(ZpPuHQJ`;89?$W4DnmcVfv+ZVmeKye|ks=UJ zk#otzD1v85cDof)QqtTJhn5Z@wwJLU}Kp$Zy6 zvq@N*f`T5s^x@m7h7^?)1#@EO{qe&+=0AV#?+qD2@?PWF`&+F*6c>|uj*tu3)-MkU zedR?WS3f!)K5o*}2oZS%4^4n1ynEMXA4f>Sud=dIQc@BWCT!xEv$mrluD-Pjn+n24Mudg4b1vNKV!T2ivcJ>poXbBp-?9ZCQRuOa7|0OHDn)m0lR zswLo2H)<&~VYof`BUyG9<;>-yowDQ#ujkJ*Anye4V?l(xJAUbA4PjPKm=6bezQX}& zG{&q8TY*nvkd~H)-td_$y9N3A);2aN>O~6Pm~7Pd;l?yuTA5%&P0d4i3WQK@_2*9> zwZJ#hH#K!=Ke{AwAL)B7gJma)U~gL^)Zd0(K%pZ1yu9|^s0E=b)^jNSx`Y?%INv1- zx9yS|9Lb*_U%^G(&(D)V8?l!@=xS_K$3>F1a?QqORuG5$clC~Sdh17QW{79ca=|xH z&fbvh$%ci8H#RoHkaz81QgZT;z(C8xT@&Sa#Nd^`fM84iaQAgIGfH4>d)YuMX8M+6 zP6Y(TRaG;6{VIPRnC&d@YLpZv%E#Ypfjmt{CQ7#WaD7AQZ_9do@pXmzt;#3 z8Dd?L+F*FoV#~`ZuwWbOY|TPWduV(Rox0B;uCbZkTG5H=@RvR`LIghNYjhLCnhV}o100siNOg>CT_;!hB z9{GvLFFk1^lvj6EAk3X55>ET{X`hssxTg9#8KqnrnD}}@vy)@3+FCIP5He-J*P4R* z`vkn!i}-ImR?DVJe>cIbVZ7*%@89pgZ$o%QxWn)%N;(U3^kro=pC>>O!tz$Hkc`ws z3`W6l=?X-#qDT}Q+pPz>zPHyN82r7Xr8NON(0C8?YV}4T0P9Z9%hR2RmkahV!rE+T zZjLil&8x2mcwwtQkoCa9Uc=XF`XhE-aq-}u6&R+RFlZAe@=w}`x{6BAuYhENXxIVgx?p}DmIv06iAX#E)OmjX0}tes zA=W``3k1_p?8ZcVv4Hdtq>o=NUCRVk1^_bUbI8jPwup<31y)%);yNI0L^l``S3p}0 zTmIOsOA~yNUcWr;L^*V|U+8_Yzq8|KavP3?(rTw?Y;2>rWC&&ka@wrxC@b?sd!nwo zgOuaeZ4G#|jEq+H_WY2am}4GomqsgpCnp`9@M(TBdl8(1SWJ7OJQJ*nP68~CxufGT zXwfIh5!4XXz23y}jLT5vZ?x!(b{c0C7FJ1sq$rZ!`tCE+)3*)`sMmf3W9%=fUFOKL zi-nTaQBqcBQ`sCFFfOw`wwHr*)v9YjEXfQBi2%4*f3)Tf`QX7)-ipKep9NlbRasn)%bgh<5=rBDO17|t& zHVqCM{PB~CuuFAnHpm?CCMbEcv-9%4W8Oj8^O$pKYI`{W0X3?| z4qL5G$AA^zhK*G>ova6l(gfxTbr-_;6nftM4-hBD`Dw0U!%Ga$@n9fe)f&87O)?%r<)rKY{-4RAsfoo47L~tm++hWUlLNTqjhbbk$t@K z^qSfTpjV7KsxwrqAQ){z3vKMppt~_>vaB5>i6*mcj^K#kOV|xL@|KnspW_=VpI{Vj zw=)(tK!Nfa8f+7gx54G**VmV7zu;_bWW;9JpAYUHo`$BH+I9GpZE;en1wiPA`O+~0 z2&je)Gc%L`$>ezVR4H@v2Pn1ICPp+f-biU{$IUXJEQD?MOFm-Tb&uA9qx;*hG8c(? z9%0Oi>wzp1t>9Vz-gz&J<}wVyyM+91lscq)ZC9^dyRX;vBu?&6(I~xy9E`NKgcjcB z*~MDO4HRpOvc2=Rg)5Z;`qorlUtgmgXGDmY$@D=Ur)~ll#)6MGFDVMYn z=l^+Qb20yQ)fwZJ7I?arm7je&J6Dj{Zh%#l3tGUfbr;@(z!Wlz77zFZ&UFQ*x3~pL zzPUX^mgFp*F{e#1atE?!1fcnMr(AG^uw&cbLtLP(35lO>SK@P!5|!Bp%k&|p zq%A5jF+VKq5Wo_!BsuPYgcVuk84hfF5+t!hM9&ZZ+Tr0NIKw(L8++O-L|%oxJ!p2+ zlM*^J4{ds9q=s#Dq>YR|!Yj>rZoS(AMFe_7rptp<6x~fyIkzc@&pD(8zxDL+8-wApqCgMA-s|e1#tsRnts#$iwB?L7gWv&=(MyV zWK;~Qi?qn94!nwut>y0?b$DRZ_ID(7Fd_Q{9U#Pw%vY|qK^P5mlr326zsLemwg7P< zJL+@n8yI-|U=_Gjm@5Q@83;`VUy@Rdpp|6+awZNe-kCGD;-WQyL5l81ckP)K9q(Jr zD;30tKlrXBzggbfD}vbd$Uqp}Zu7YMa0b0Il5b-Cem1)?=m)ZwB*0Vc^<|B4-MjZ6 zC32zUyA#lkW!j#jW!+r*@t03ozta`XeL{zatB;gAa2x!Uh0x~U1G1W}LBOhi+-{bX zkRYQx(0C;c2+4ptQ8f;;^Nfp%1ExY`anYB50Hh11O4X>@@=;Q z%TFDeF<3WYfFJzmpr~o#O$A^=KovDLH9;hWK#g!b#t=$Erc~3LXV)1o9j)rDf`oG~ znS1N&mD*{bY;(xK1{Y)<#gGgX!(3W7)*jZrDW5fw{2YOWGK_V9%BUVymMvsOj4*>h@BFh6&IIM7bdK%tG z;m?(^vG!t{4VY8@zx9EjQ9A7EVJ$@r@;+2vMH)Y0{TpC0R1FMMN>7esc1E1GYQ3@{eO1kU3?b8v+Ul>=tq~>JDtV8^sZFe)j>^I; zTomJJCuZLZ8TMP}^gos_2Nvd*gx*N0>%X@_0dM1nSPaN@JK8BAs=J7X$7eGBd3hRK z9x4%C>y2+}W(JUImmU_D0~2!&e~N+?gnTgVrxU_FjEj(E3J|cf{Ek_kr`R`ZE`ECu zyh=kJZMV_PjzpzoSZ&DweS&~I4>;29LTK834HW#n%1G!YI{@dzWn?h$I~Yg-_yg4J zb%-=2V%qubcV(^ctVO8gyEhnq>mQC;}CxeD-`hcjr!%-t(&S0lT+ zyZZ);ved9A#-(kov-8s5Ga&v{R=gnp!EcrOI+dR1da#L#{sPItc-@n>#TR= zLPD+c!|#oaV?uAjuOGc29Z{TbzZVasJsu4{7F-VB08{dByI>AFe8F|MBvx<2+`P2OX;SDG*8?q`k*9$VAP(GOZll@x48bimC|l(+Qfo{6p2E@z zNfyk5nwyxQ!B~`DxXjNYuIIj~G2r0n?n=rkJ2XxDODK7!Ep&N^&!9hBHYGQ4d<%e$ zwY3C`>!%hvLSSv7M>HfPC@iin$?KHweqcbzQy1KxjV71d&XU@*j`q2T113nJYnS8A^yB zZn-voAJS>Pa7Y`Tp#`}S+#Wf#`Lx~L7lMLRK)}fhtEfzSQ{Jtqx%Ds6N5gY?O71n? zPHmnyIx{;9u-~9CS z-L535($XRAV8~xD`S|$M0Zv_Lp`Qo$3d~-7Y%Dz5$SV+Z_hluJmpup8#BRC3F-F|; zkmWwC5O4^YWQEi-*ez%oz5cF0mC;e<7}WXn3W5YyE=fMQn^%2xV{_9S$bWbDwjsnW zp)RQ+PW^18G;l2eS!NR$YxiXu@URq>0xp9@Kka_-rx4#d*z>=|tj;ebrP~MElMUOY zf#_GKE77X=_t(kpv(6v?G_yW=THIe&rr2$Km*Yjr@qQv?CG(j`Je0Tu+}aT+@QzmXMmX?bURosddXgfwC(u<(MslXhFC(Ou*sDb z^_qo^b!*c9;NL$B<>;yCk^CR@>>katfXFQV{U@l2a=a!Hjy zN!lVQ6UxOLc)Y)VuK@B+3Qtu6o+_9lyPezaurm0cDz}41=pYt7-WK%&;0Uq!?>4e)N~4cEa`YLaqBNzCK%v1jhetP z1qL=Y-Ol&|L}LOwC=Sm;2|{$p7r_@m_E5+t8YhPjWe@FYN_ zmw0&M^K?L76Z#N*|DFNlR&PtV6cdx}C|D3g1JHF%GS0Lsu>!I?@@&O8vp!B zii{La?gnA${AMIXBS0}jaro@!>50;_7_?0{dxEk8d9zFqphIk}q7pw#gq`tWEDg*B z_(}1u)3+)J0ed=NbJRyPtgO!xaQ`8Q%2gYt z$fuAG1rnJTE3pd3vfR6?n{J_>Jxe4a3o;dcd$0)Jr+&hwAXz@%6dyKk%k5Frc>*fP zAU*-A4ZHD0aSzKv(R}ke(6|am&Gf+a^=Ios=kgM7L{0?ZZf52>q=N9%82AZ=Izk=+ z4-b#PK4p3;8RAdz@t;Xa@i`vmr(z0}UtNU{I^yKysH+=1OB89O|5tWuWu*kT8o;%O z&Q*iBJ}mY%+(2b7EmcI8P`!+`G^qD5qf4p`U7Gv2)GMj z#4}{K>OeXqfxxkJZyJI*XPVjJ5-s>g03(eSxr6}6rd}SNe0{kop*cBmn6$#7C-M7| z-z{`g$o*TiwE9gy5ij@^IpHTHCmPU%A{QERg>qXQdm?vk^lq-#VMR5C}s&aisLd#zvTslUQp+I0STGgrj6HQ7xK{mS>EQ z|JTlHp#)a?+X)USDJfdOt`ANXgS_}?3>BM9oRMkumJ0e(wp#fO0wsVpS08})^ch}M z7uD|-yKj(q@zQ3eHuCOP&o1@nSno}ZfrWX)p<(^Hwj<7-2(kRaM?hK9n3_Eb&!=_4Fk$mW^vH*W;rDSKRz$_@)`iMF0 z+wOFz)k~%qlo-K+PiL}X5F~NcT;RBOk9H_XNvGd%APW#~g%f@Ya1@}zfJg}ls1w$? zy1Ih17ZnqmA3I&-b4$x%7@P&11#IRym~0*e!~y1f=hJ`CUtwh-=jG!L)b0m?;o_1Z z40HIQ4R~xh8dM0-BIPv@0?_MhVzzx{ok=Lt(!*QujgHPx(u)Nq4Hy`=GBuTovC5GI z`6jd=t?{N*{r7}R07>-KLNOl@ z8gTidE?nB=v)j&8V~+`hUczdS$!gx4~(ejH{JHG^3 zkgyze2^#|Brw}0TyEr0HEMjD&r3E2wcf>S;lXU~$%wV{fozvV`jJB086O!@rk0qdY zvHq&*<#4o>&0hMGsWB0d3^G#EtWgLGH_Jyx?BD?dJ#w<&8xMI!*@>eFJm8b7oQX2; zXCr^9U88og9WDRbn;JJOi1C9?q#3elj)Dfkb`@aR~3sl~!{v`8$77eSMS zd|@HC&4=_5%C0waM-$|kTwGix#>em7ySHhE1pLmtKp+J2n_Ox84vZvNI~jB-9dGQi z#FGbRD;l|Ko#PWSb~Xjv?_aSX>4Y==`qomZZf7M>v5;Q|fC)k99^<;&h{W+4xWqBy zxbyi)OluGX0#w(whpkD%VOCGq(RbQFK`FUg^RGi>VV>8Y-Mj7F$^-QCr(+S=OU zYNQaZoZ8{!Xdby`l2Ys0fJWyAda0G zDe*TukRLnJ*RIJFh{F?3u{gGe^8_tFC>mfjaG;&l_+da?DxrPVe^rC@GpAF-sWo4Z> zK2igvO6F6$O>cr@b+{If=RnH=6M2C$-5W6GgPu3XU~phYqMSLg>`HY_xO_4z#Lw&y zyvp$bcz7raV_{})Y-s2hh|;R_W@TdP zFLfvy#&i&q)ei_#WKk!FS@33D8Yp$VOPda>k>)_f!?8eUl&OQ>+Fmye!k8rJ1*d0h zOp7>2XYxDT+y{UJ2C{{})X-R4Z=_~bTGdC$FNR1*n+dOWc>Hm|;9p6D<_FMMOK9QN zMU-=Ya_o(b{dVdrjt)j6(Wx_5rJ)hT0Zuz|5*6X%0}k={ORR>fe;-(K<>~1eLu&+oo92pH1TJ4cw$QdNzN@bTM6 zU=)xjB4_U1YY#xym8H`vi6{!8$UY4%0y@V+%O&`)-`AJuC=9vLkv-6bCgj20eBBpR z*%xNjK+f45$_F?Ul#P5fO5y-&aeu3~^X;{*)z^EVrvd!H4`Y_WO};NPnfOHQbV;*_ zi-~u?{*vv{&)Dm;(fsMKjeh>#`A za&~t2six|)pmR+6FF5qIt~8#MWMuC;_PK=lMceHd-HO#5P*kx$8TNA7F}lvF*CyL( zlqlu)ovTHC>mUVXF`R3Ns{(ps$cz33;JsiOJ^%rYgM$NVSEy((n`yD-mGs*g%}6oOOfSQ1)t{7s`LcBX4tXAG}8yTnuFsG?Y{i(0F-5Clpr^bOsuVynH zxl*{LEX<|s5`G=^)x&XaRUD24%?{7xdt{1xv!lXwMfjwONWDUA^A!t-}N zq?PXfA=5lmf})>XgIt}~R{E1YNdWm4l z`@cuEDTAJ6nq>ig$5ujV5bid$v>bFQ7JQFU_e|f$4zwjueLXSDCLt%?|5c>ytQuc& ze&%@8aG6k~H2H&c#g*Zl@$Mkd&m2IO4@&jZgC}wZbbSU|5J*7on-W2G2%IGJCxSY7 zF|jX#n9fA9c67HjK$N$=zf}YQ$d-Fb%1a=eAbJN>7~hQ`916o#f&F0VeDg*cYO}m# zptrAce{FsJdk_OG^g1CZ`&ymnZJCIG2uB%n;#WU`2>||YZds!{!SQdOz}_uUz%MSP zi*n;dV(Pl^#Po|{7u6S+xpMk zr4Ove8mQ^B=MRh3JCB`qat>sF?YKKx5URb^?S(FYi;{n-@CE|1|DBkDvgCdQG zx1W%rN7Ecnw(Qci@z5~)gN`_TuzfILpfyKt3fkmsZN{8}gD<40Oo8ZGEdx3!ko{yl z#^*Nut)WWaiMeg^Bng1W&dnll@fCAySln6E0JQdea+RZ%uI65_iYgH zYd9TQ1W3lsU@&I)I9Y~TA8I2bqjzsQgpp6Zxw5hangVcgIr_bi%%u!>*6Py!Z0(2a z?sodoZOzww0yS`A_ZR$ym5GV9X6}=H04@Nhk@(0BS#e5!Ykr=+?aev%uLOHO$44cP>5;qOe5bggb(M#YPd}$0Lf(!J zIRR<`%f-LYFr&Wyi2xe08?dpnka#{)Jn*b>EabA}t8ymq;k(IBu zy#3)EkfTaUoc@UEcU}fQusN8+u;SB>nb}6&x4k-$DuE`~!~4v95G5Z$puc}9M8C*= zY;*f$7c`-WLo!82!JWQJp1Zk{dq5{)`re?oFhD<#%@B>Z>9xDHpzSGWz1gam+P7BM z7}&kZ38VpUEcE{mk)h;R=4o&5Yw57~nre42Sy#pMu zVb9Z;13-e#HkO!eug-thu2E*fbBm~8HVETYJQ`N471)_2lu$J8UbS}3)GG7o-`aDd zlL+qJru4Lq`eKH{2F)Odd=;aakF`LjM(wD?j7j%Vp8<40j%{Xo8soj=Pdb5J@%!-u zM1-j)F$my!{(E2`k9I>)W8hjWq3~6JkGv=b#6)X62$H(NLTxSOmDS&4q8ZDklPIyx zKoWxa|9-y5F8-eu0MKZ=m6A-o?q0AAFm3CHjF38%_T1pTm{_HdHe3qw$(N}Rp#fVO zbpSE-S>|G=qw3lqW-8L;CDk1QWy9B<#VUEwdE&m&TV@HroPep$xA~SAm#Fe(bqzwy z4kil{=VUl8-nn|~R?eDhV38HI@h0lBh}{=$V$HS%2Tr#oI+i?D zQ>j%|j#kdy;bc}YxNyln1;%)p*E{(KDT1G|urj7SE#dj!SxWiAtR?oh6*5Wk(6Fqw zrUnA(*%Nd4z^Hw)|L(o7{dNHqEr1|tK>1Nwaq*j#VWtwnXevp`LgnYr`%3KU5~$<4 z^?(T3UdCjg!jxQ~L9VZ-hEf;AG?DXdmmnz;+nM>F@z26Z*$yM&HP>kd2HOZh`5!2P zx4Lmq&R6>zJg!h^GO{+wlZV<8992BlRv)?`?xT5?$Fep?XlLE@WWvduVXSHO`O5Ly z!aK?RE4aJ@6C=?Fk0t#4-kjL5^Q0CEIMYC=vk%QFfUe=XfB*8(IyK0FGalgdiX31((IHao9ds&5V&W)`xvsm<^^sf;mS=ns;l`#ig z@1ZB9N3-Z+4(-iMQR>6F%rz~SRL#HJb!j~*YRT4*dp~NzbAHLsB3NSR5u5Vcmg3bD zKtxMzx42D@J|m4SP&ddRpg;rT30-6!MM3+Fw8TWB4kA)g1$lYmYu6YjF?ZP3_xty) z9#u_N5R! z38tB76$Nw5Ku^#G&;-C~s<7U>$8~2l=U4IOddZH4&B>AC)_YHog?@qg%C&!l z!+nDkZ}5&8dr=+?cf^hTgDB}p59e{b#9n}y1|Ii7p6l6c!1Z4wNH6rPNoc}0l)qwC z$u4||J&~d1^4JZvD+C}%nufa7;sc~;Gp~!y#DpH~4YY{7=J>=fRP_Uta)ADzp&jyQ zS786pD#$@;CJ%4v{@@b=Eu+%hRFjQO+@a&Dzg zjvK>Q_BQADkBWCn(L2L-E8p-a??&og5mzVX%GT@nee?w0BtdgB3ww9XW#N?jTD8Si zBS&K9HJWfm^X+;1IyxSmCdBTDZ;Whz4-#w09;BqMbQ7Iw+14i|o+AzgW!^BTcHiVp zx=QoPFh-sOa`wf}1c)e-)V;6s=;-TDK>)lN^F~YNiCFvl~eOn;~!7bBLyX;-)V@$v{v%7y7fAWP9j9X zrF%Q&@yub0f(BGG{R|>~H~irE$1JI^ljGstLul_yLj&7==<4rpF5$;(`Mcy~7+EX| zBxPwDpbvz(?NI#^AMc?zJ5p8#G#+vm?L zs<|w*v{mix&*d>de;<%oAg%;zZj}sRKcEHxm*Uf^JqzQ<+j(+o_*TCC(3XZk7VFh5hKHf|6x|Lhye_X%X*xfQW~biNp=Oe36ad_``>`a)ZU*Sek!^ z&UcA{(1Rp=^#S6-5aIzv^o@JB8;{&e%r6$$>I-V8r7lX)>KHmPyuyHH|4PNaYXuji=`BSiEM_J5T_KD0mPkunjj(?%IFc~_!1#ch}j2nLo2#5cL(bg>RSpaWjVP&mh z+XZG1|LUDro$=4WWS_y{-}SSN>_JexVX-p&9IRhiPn3w1&P?t1?@nt^7xoze94Ro9 z$o%HvBV=e`Fge#Jf$%>li%(u&wmrWY0iO-}KX-0!ZU+dUN)Qzt*9jflj8z8EYxETt zc)GZRYed7w(z2TTpp$skPspto`K#|NZA`-c)lfO*k^xHeoKAG+_iU0Kzln%xwMZ_{ zZ{PM-t8idCq|o*<-|wWNqlw*T|J_&=z`p1XOuC0Vo{2mT*+nMzB)eP`uYR}$!u)ihF|mYtN@b{7Df%6Y6X3XDJh%hI>n)9 zNjd?R^UC}{UZV>xyW9&7CATN8FO!c;t)JgZSp58%AK_M`Z_3;hM{bNS4aD^Pw&qK} zm4$>H5BrB4=DjHead7f;Y3pMk=bW3<de#XTst-(%z8C^{Ddf9Wa_=}dxsvDD)) z76UKG8?Vr&xo1)@4Hu^K7dfoNi0~D82&P7fir9 zg}@ctea@%$8IO8s;NOC;Z?DT`*gh1fIXE~($to!+{q*;*POk=-x2IKDJYUDaXg}0U~mqZo_s50n_cI#qnz=k*PoGD@7H+%5OH}+1072*E^f$y<9F+X?535=|7f`ZnVq&%_D))Juj?XO+ zZD;4)2Y!d{-YD7CU0-)zD@)(UNcoBLZ|EEb-I2$mM3V1wc1^da3%zTKo}HEX9fQ)7 zPSXenleOkT86iaIbimcnoT85}1}nMaySx0$dJhg!nU|zFQd;$o5x;n5E zxfppJN|uC>x-^W-a0;4UDZ8PB3pVGcAY>t=V8Q+UgvxI%lyviA{fi7F!3?KLU z@?zEnUym`yBz+3*ThXyQ+{$^VCt^xUljR>fHA_68_uT6ti0F_n5*I8Xo7ZpN`1$%q z#>Q6Lm;2OBKqt+SVjB(`nvaGUF*HhE+R}14S~N72Gh?~uS*@cA;f*}N%ApCBlIz8%OIo}S+y;j-B|H{Czb|0ScpLFO)#F;oV*BJ`I zU~OTXT6B!i-X6~M3>myv%*S{|2>0jF4I*MvQV=TLqh6)GNk~XY;AS>nec|6*k-Y|O zDU6^!COf(oa-jyPmjNSjQlZeJGsxdR-RSl7@=!vI*b$%wDqAA1UrM2puN>J^l<+k@ zJ*KR8UeI0+#M#iyI`DPXbg9k8M+;)%oP4Jfo40Snelekuk1qV|{gAD%OI0Ko4e6&( z_x6W>PjWwwjVzx^zLuVt{GaxHhnr0GN3|Pgd`W`X-2lE!3u43Z6bk1u%)i7sVg-)z zmQ*ei1H=FGx!_%Vc88IQvGCX--i3zw(BcEiHs1a_#DKf+nuIwxXyGEtVx^`^1N9H% z({v~+o2uN{M~e3%Q&OJ8NBYb^wh^G3qjwYYz5zyodNDf3leNjI58DuYoA{!Xcis!z!cb6%))H@J5+ zMCaX~Kp`?b7Wevr0X};Ax{(pgM#2xt3mX|7cP704&5Vk?2j?Ci6LXD-sG9e4u(*!~ z?*q;s^~wY^G&0vIL(K}*B+QX}&?P-om?K~@pVl5Tl%`fNG0mlWa-3CDvtAU!*(Lbn zHhy1`RUe@Od4a{k!^e-aOG_=AE#dFUli}dFR#x7Ok~QC&568leZ;2@3y0?zL;(Iak zhx?P~%0HfL_l(LZaNLMK{CyU#(^P<;AL;c&>z!q%;dv`dqY}ODZ~DF4&^h#rg^ISd z%@#Sg(VYd1{s)Chaz;L>Mukt~6!aZ`r=yeALIeFCR8_e)c-7@+{Zdzl-~KE#{2i~F|o1Tj)oR15O!s- z-IS4O#la)xx81BC9*(fU5Cy2iA}}6d0(Q{)>~cuRJebS_IolQYf3b(lyt_ZWjVi=FvvxS~qvl;K>wYS91{?NL!tFu$? z`Pj)Tbd4uHG}iA?gZ`LuU^Z^uf~Hdp$HsGB)J{+WC3>@GPPWMXaWuQmAu%zrq~vEv zN{Xz|{beVMbXFa=<>Wiw_A5!)zjRph65m-ddHHQ=Db!sEAK&5Df0u(Ab=$|$9KWdq zY(*b~V)I#u(iIRE7%3^yT?SLGq}odp-HPsnVUX_iZL)dNlvi%Te}{` zMnqbrQ3RBbP5}u)5NT-;0YOq?=u$ySM3j&&X#{C$l$7r7?vA1FJA>!0d%xxS&-stU z?EUR{;|T@`LwvlOnm&H?-}V7{BW7CKDDQ=Cb`WU16R(m*1C?v%?H5q_gG=L z?DjU|f`bSnI8B7b=I7P$@Y==nO*1TBy}EN;_e4bG3SL+QDe295Jb6vciDX#@ofV*y zfBuFF^UnCO2vN=T_6TlDE2|Cfl-HeTQ3bKB!@WT$PiN_s57B&rQ^C}1kw6}{8$>NW zl8TBy9${hAG@zSD%;9kGa4dGSpUm8co-RIV1Zw*J=DMDhsnzqvC?8NQW&q8zOHUsR@Ub9;@-AkVpcLL zf1hm?jue2+buhsjWzl(jJ@D;Y*!@Wp?=>r2x#{R+RaBg&B)Mt$9J}1AJ{*a0Sd6$e zHT(M*bta8&Z6m*YS$XLEEC2Cv(CKj`jPu()hK!Y!6|_~Toc2mU1r1J2tOP5EYZngz%!`AAq_s-<{F$z&2U$&LhW-{| zUeJ(0p)!Q5XZClN>n`9%v%Yx|0Q>>7gX^b2_BO_tC6X|d< zg(Z=)s)X`~c;5n4t*;PQbz+)!Nr8lh##is!03BHCd(P8iV^v~cfX-$<^pXa!F+#4+ zSa{-M&V&~8ZE;`$v*|N;d^B5eQXb|F5fZE2iV@AmF78lvRj7B;Gjc9dRUH~AQXc|x z%o{vjZcZrohA{T;jEi2y13`9nE-tEg_^Ug#E;DaI!hi9e>tj6u#x-7hj9bfM zUp5gQi0-p9E@9zCJuK;OYWn6q)1(F>){n(PnV0bcvVHWt>3L8OVzM-E-M)S!ioej) zThR3*fyL|Yw7)G;el?4v;^C8IsImKb13SLJs6B)&t7&IhP>kbs$LGM?2L$bb zw_SmTLK{Ebn7lLB{?_|=f3dC1snvU~@@?=$Tti3i!qi{?iTfX#B6ba5zPy5`RZ$K$ zF7Lf-KWRM`Q&+#$o3%<5Fz&Mn_Y#PIyL*q6`{P@H;A?-`0q%P2B%JZr<$E(frK_~w ziHGe5`DYA_W6z*1Hd+jH*s^0|CB!(~j@^caO9%q9R>dh}5H#W37I|J0xHJRh!xGMB zzcyzJ!^3X@#Mg(?+xy+SYpH1)K1M4;+Y>50cc#2^auggLL+oQ*kBS*Jd9($>_I5|< z;O5=m+M9iN2n;DEEx!JShN0S8g;H^WJ8Jxq0uHpiyvRfQ!ylMsju5`F_Lb%A+cALD zkzJ$X;tD}xBdH9>+z>Z`CuE zSY#Ju-XEdS#*r29rX5jmjLX(8c7& ztD!f1tD=eu0p;^2PvlE$S~3Ie{p^?dX%n#iH}=v?S6cVGY8*-!KJm-q_<#uQNvqhmcSzH!EclL&m-`e zt2Hj*+FIJ$qO4-pCm)uTI^qRJM;D+t2`NLot2@coYitG=j_j zU(Dd#3prGC(?@BRYgZ6CjWso|8$%LEn1{$%|M(-NoA(ZRAKtyI+xL@CS*UBWE^BiW zdmume>uF{vprE1>#c2}cB@qB>G7u*=_Hw^i8ES`XRu|F}?XWOjV&b#wyj!Cnz1>}L zA_#f}gJ4c{CbkE-mCm~>diM5RC3f<pC?OC2u(GxG)|f746~zV@!eoo zvr~TjsKsy{$EmJBfOflMS?2_+d*t}UOkPEWDOX%pRzsj)xuLqcvbuV#k%^f2U56zn z>-vBVFtYQ02T-bOXe2Zdv$H33JmF=1TPaC}a?^lIPrB};8eZbPP2uM7V3#>Je|hEU z(Ej*DWvodH(Db&7ZCoJd?7gl>)( z4nf=)jAblmn!>;ZWPQ)MhZl2xtl=;)z^hw^43Dv_iyqYIZ{L3CAinJ!-BCiz;UG%d~f zYpad(f{2te0u;N4duEB!ivP0e3x`wQK0cT6UK<-jqWA&Xcw+D9xWBizcW_WrGU+IQ z8GDD(fh}d6+^;v|_K;Ih-7ItDg?0s#fPjMYvA+QL6gY0qxcZPSv_vJF4RXy|S>m~% zzwh!KXk5X00f@Vi{Ka2hbxN|bz3mAPVGW`q3W|WbDBev&I1u26%4q??Z*|1QcDCi~ zV4rBrjmKcPemo^dg1U6+&+-g00l@eLlphh z#<&y#i_=ivAF!NlnXLP?cd$2ni@PP)?IcrSLyys&4TK4mH8qDS+zKg|I?J3&ZZU#? zf`XC~8U6;UA^3A_Y}?`CSt25Xi(apwBfkWAtn%_}i+t|J$+3`%TLHxlt{$Vop3J7Q zH1#C0pqMC4g>Q|@U$Xr;31?jH(mFWM2o}&bL9S|*ZS{r-&{yo+rh-tw?4@$@R2933lxeC8jQr?45A-!g7U>cwpcbC&hV0_u@#IA()~S*)E$udlsFU37Q1YK*4MU%@9lVvGqpL{KaVie|)#J;wONRfx~A)uwj z2uVpBi>KX+ZRX=ae|K`S>a>H5IF6AHWg{RE%FRR|fL*){B*wk5-`G9WoZ~S0>yx2S zPI!JKM@=2@?pp6xH?H-qP@4dz;Zhi@oVaH!$M9 z(CLCOSPSCZy9Mtu@bCjt+SA~UCthHPJORAM4O&*#>CIUi0)nQV(|37@`y2usV4a}F z!@0)l#^02dmV$9g_~*|rOii0W6%+k$7nkI$0_Y#n+~Yr&tH>(i8w=!Afu zqD8XAZq?yvABnW#NVkuKOa!VDIJdeKMbP6#teGtj^yk0MJ)Zh|zr+^Il#Pnv8qU_c z_}Vxvcjas>AMz;#mc4gnGAbMZ|DFlOv62H>&XMy7eDHU)8vpa7%t^Mcj;?=@TkY4I zcV!Rnx*?7|GaVLDy|eg2Lu}cZl{%i(b}?KQ1HxKII>bi=K4O9LmMrKTYtiwQzgY%4 zm0gvQZIzO4ZTi~`Jp_6NJmc4Cq_^hg=3j@>#r~q_=AEIyyQyx+;Kqee(h~V&sHMfk zU-I~L4x+kn?`)TiPb4wDXKPJnyR{dg z5I(_AJw&ZbgHn5fgp<8v@rJ!-&ugkx(B@w+D*=9k|HrKh*Qz-mA@m1<#LjIlaDy_Y zD^9c#!gLTFa7W^~n?A_1`sC)q%y3Wj4*os*Hw~M#K2Ku!4>=rL3p^7(>>i8=LKbRG zY|8hhOX&XnS+@X#SpHa@+2+MpoAv@URyQ9^kGv-_DF2!5-|fLlF)88nhDXTviEptC zO67E(G}lOeyXdvO1}60}-#_SY z;}p}0()UO5EIP*l@d zAvs#Fa0wvM5Dn7OCVvpTOdz}K(z^H)_v@>S^;>&`0i^gs=Z?7ngNS+DS+Ao0l0Y3C zDk+}#QFwuvo=S@+HpzblKDV0Y`5=B`6TFBGn4q$ zqJLBuy`o|jbOu&OD@2r)4IquVEpdDcT@t@C)$WN6b>;(FI=TRuG)aKxkN5nL01I+r zJiIdJy*!A=2m4fWpa{+?V1Q%RNh}t0!y#SZ0NeA=a)~UyeEqQDDouRFNZik#^{I7k z6d%fI;wgp)v^NJs@Z9ciDvm|8ef4uCXEz*JV>{r^{c*Apx9WFMko&A{QxvO6={jmY zU8UU3^Ac31Un)`I-PEnbjja`bEHzx@cRCGCP?0SMCKG;Oc(}UF7WW9b9$>rE3>v{J zgG?9t=kQSVf_4$CnhWUiECCplfNZ2+SJ%}Z>TaX$g<+`wsvPkE6;58>5*q!V#Q>!U zCCP6;%#LnL^Z>#$2oPiztGw96hryAN4KORxa%~B4iGwFhxx;Fv79AwA&nM*(RA)d0 z$l5N(ajwmQg{7C>kP9@*qG4lX;B#2sjz_IE)_C@x6mK@iN>I{FRu=|PRBUZubHa@# zS$&`{*ScB9ZG*IJ>r(1%lgoW=l#S|Tr8p`H>DSSbEqRjQSm6JIpT9p#oo_Fr)p30X zF7_JFy~}>sggn0cA_#=wg*><%wr85XprNri|2h}?Z{cGT6JlbnuG7US1&q*#1{o78DJk`C zTq43PZ*Ne|U^s11rCbGAHA(0v*c`WnM%W*$=~lRYEiiu=9va$Oj6Ef8Wo2AwZdT!- zA|*92>K0Qu@CCs}$HL+UOANT2+?<>O4jWnEC$hfR05xy@Z(%?9z0#F5gN|0lququb zdPmq33+*U*R1_38rpx-lr;ON~h6V>Gf0=X^jH8}&BuQ{ftox_Tp)6LY7@4nDR780< zMc_=lx$o?ZNbyaUt@5sK$;A7w4LSerjL_aoBcuB9H`S|tHMLU1QoBIS1P;HT;J>&B zF{NZ`D$*F@4<=GIaM>Ea3k-}dD_i!&=2r7k3Wb^^eqfo)*EC9WNVvVw4JL@en3M*g z6b(#EmWp37LKV&3-Sd@itz8bD!I@wj#{TC_T2-o|8_vy+#R$8-eeJ3BUq}1FT2hw~ z-_`W>mp)VHLPtoo%yA}DOBza&sw8LX1v2BMqKHStw$?o@9<9t$E`@#mW_7rwOru_; zkB?VVOFL4&xz$Jx6|}(MU{NteI(ukAsnFbIdMNE&wZ?BTCtkM3)FeIqCYaRb+jE~u zEMeu8^mI^e($UaBpMIE^ZUcei5Co164h|i>=sWlVE(IAG8KWnrZid(xOO6=;xeaML#^R0syQ3M^B5?fpR1@vxnPXogi&7UtKvsN9Y zrE`Pt+u=|MY(h7qN1mzz5>>T);|tH^E_|kjZHG(F2js<00=na+f$l)$HQ{CXie>%G z__Uwj*OrgSh5DA;vJvYG&g{uo^K%HVx5w!n>#ST~KaR=$;J7^}=W{hsGH<5!{lwt2 zWew*t(I=ML)m0D0^!puyzNBf>Qk+Gk#oJlTx*Rb9E1Bc`CQU+p$$-cv5cW@U8(D-9hYH{54r z1fz|*cjw)3C`X{#w0G~GbB{P8-xmso28-=tgqt&9{xHP7i+9D7eRx>|!e*yhBztxh4`&kIAhktpv9Qz2~|~ubK8a>yNBPn5jFO4mk#Ss}J;FT^e0p zj2iV?VPS5VVMy(@Ceul!`U-}7uFVIZr_o*S|+k=Lg%X1heWSk_eY3+hAM+h@F# z++56-FnGh36YK2{SQeu$cj7If`4l<$XWFW9DJ+cac>FIlO^!KtSn_x6ewc*dEl6rd zN!&(GgQr+Rh_XHjQ%OonUcYn>c7lYMwzf88iiRzb|6L#?9i6#A|JJMeK#Z?8dj+BY zDcz(F3dGPh`FSny=jN=%&OAFcx60XG++wF)HPFK;7rcqtX5Y_wRe_FkV}EW$o&RPj za`CtO8AUD&!N{*)>x!|BeNIsdg9AM$`R2GISBE`!Lji%8jZtFJot8F z(a!=Bf#6L`Xut3O;^RHpm9<-ZE>mC;nU$QZ^{O!bU6Yrqq9?6q!@^@?CNGs8wX?$0 zT1EIdFKaRA=Q;b~gg+)2C*L&5w?-)Vw77qWERuzJy#%S>TzK)xyDUJH+QtQZNmuH0+ox z0mr<9z0JY>ElWXXlt_gufr|^vM4o&KA06ERjdMb|2t7TKmQ~TOWG>>%Z>4u;>ynh0-lt}rh8RMO!`NQun%C`eh4;H-(G$T( zf{)$sS6>L&%;X4XfedUm2&jW=0poD9-legx%AuRB#leA@h?;EHPhG2$d9e5 z7nx121<|hCoQZuI{SX_>Hfx zqM*AK@L*<1Hhk(wRu(#!>l?Ew0*yVO?LBgJJ+nysMC$2NaMu*?4ggIgRp-Z9cjD3C z6*~ZyqM*GtgIX5?Q>34^%Oh{Gl7~z8+>wO!1tVoq7XeApTtY?`4i*|$4e78Xiy%S! zNLu(Env@aTCrO!^4SW}cnfs3Olw|6@cxw-7Mu(9-FFrz_uKwP;tm!?gByM6ycA2Yl z>(UdX&ris!%N!?N#VH+Y;(c!2G8W@-9Y}+zswiFDUfzCvS=J||XpzrM@p7s4B}DK8 zXZwm6x0TjYC^tg*7KCIgP-<0_lcPd6a(Z}20seH6ojn)$cG;(Jfs|$_yMylfMF`0% zqhT|>d-sQwNJ#5(I7DDCH>Tp0g`UCjf{p$5?c2%C3I7t@NFpf4bS35guy6E59Q%Ek1DZR1~0mVa@A@QW2zwC;IR^eaQSTl|6BwY{?w z+!=vA@nz`PJ;wq zGz6ACnNj4Y5lqTee*OrENEvkmnK(K1w&pxR3IiKAK%e|PTWyuz0GRlpJM~~;;P^nV zHmxO!{K4==xlN_~X7UT1OAlEB$d0*;|N3eP*&E3QtOy}ri;6+aT7l#b^2Sei z7pEpx!uD@?}E!-w$ZU$wH^6R8GSjc z%fxjY98MZO%Ng}h?Md0_qGM*7eK;e2lzb{&;dr_3tL5c#wtV*&^sNVvBk9VI8a)!T zR+q1B$51mebm8S0uM}tQ$8aN@dwq%cA$3MCQ}iP&1$%|!^0{{)6AUwzs`Wd-8|7RM zq`ry@x5tk!oR+iP)s5QYecX<=)1#xgU@d&U;<9f;e8n@A7$EBiFO=^Umocy=N#S1|URTprq`U{r(QWaH>4$qdAYI@*uUF=@u={OlvXNiA9 zvoI68(L7vwaa%Lb+3@-EmTe7OxV7=**$4M=v2a@sk$RQWpTAFabv!)y#b>6Sd&ZzlT8rUj#0fJ$KR4h0*AgeY|1v^_E3BU(h>;GGxabDy?phm2kcnjfcC$^`mXA?@mKT&A@IRD2oQ(mP#pjQVGfj= z<|igPET!G!Y)&aD^N9j~{ zYvV`2PKNq%|5v)Kk7WI$ot>Vobym!4H~=NovEX25FSgX9d@P!%`Sj@@hz+uID%_yW zquS>+HI!*^{sv* zrITc1Co6=UHelLZT?f~rFcoA(;t z&lI`($!`}ky-Lb}>dSk5ANvZ3viYeNBHX+7=96trdRNNcjL&#n*3QsKs~#wBDRnTA zy^!WnS?MJPj_0ILF!HMIHqZpkHR=5VZG{tPk%us$txg`;F1^6TJ>sxz|){c%0pz?==%!GuTWn#ivXLEr~EW`sE zqOMRBwYRK*`3Hfza_5_tdsb^u0j}Zi8|W#_&$qS7TWpInka;LX9}36wldmC`MUhMz z#4lVC!fEtxe%Y3tbg>z4%*>>H{LXFn>=Q@9f@!B~T3V8tL-|m(>S(oUg@BW*@2^|7 zhSJ*4$?(=WpQ_^yCC81%Htazwrgr+^{V6t>Dh7R(oI8644^mA$c~eucW zcz`k=tlEFz5IH2JVD&3~eXz|w2x!$ki`e^~nmQ6Edf)9tSdDV+YY?RG;egV)F?Wjj za$i6r@pqOrPzM*yMqN$2(<*=u9>HTN3Fv@~65)FvDJ!Z+MnDeD$Djb3=g_JVrh4$Q z>--6b%DEcNEgtN~Jak5}(a?a*b+%gW1?XPwEcLfHG-PN$1oJ$9DYEC{o>}pKxF4Wq zJK;L6<_2F&Km)EVbeC{j2%=D$TkAzBX$^K(IVbSiL7*yRir~Ezq<)(-X5RiX0yajN zwh0*mb)m5*VVf!Hk9nr#r>jz^H|(qnwo!LiaL8)uH)z+`{kEz@v)(;7yi-O^b4|7; zZJR!wYtmlI_{*h>h|3_cTcy*6S#Ss;G!*WR_HWrc_)kvUDe-V_vgw03xvs7*SWN@& z3;pP8of`}1YGuO(bbd?sbYv%CF>^v3ah-%LlX$XJceaX z{L-hf{C7e~cslEfoOW#m1xdi1;-THj{$u})S1pJAE!TuXzL-Ff3Ljq~GEzObUt38@ z!0q@0G1ILdTKp06x8$IYxj8!yhUjjnHSk_s^-i&zbcBhC<}^{-oWUU?N?#|uWU|Ny z_#VgfsbGRdPi=}e-EC<@+HzZQ+;4$fch{?aRM%H# zbX}rRkQ)o9pwcL3 z`*VN7-3|-%U*PjS3TjN=ct?QJD7F}Vturc}Ai=T(prNkRss}VQg>3BB(2)gqVuON% zgNsSYhBy>Ue^R6~eZ=A+Q#ya{9H{09(a~jTKius3VJ7kM4LIW{D^K@2i|?l#UoP2sQtWKvDOctu>BiP) zPkoD{ZV*A^PsuS<{%D1(WwXnM(RimHexlP6AMkJMo31XN@tiqvI{fnb#)#j30Z|IDxoE?voiep z&|Ve`ORML#Tqk5&(E>&5i_4I#++dBTELTj?4Ghc%U@lOs?l3TP!39(`7Ve+hJFMMQOUz&C78zT&n7Gx{p5O5lIKnSL{XvO>GqX7Dq08Q|2Kiq9kN zRaPg3`p9H$q3E8hTHGnC2n*ZdV;Wae|C7tIEC0M(MWKD1A&qDzk$5VRgydBS?Iwngy{C^x%@D1OZ8ZSpgMhcMIbHFd&kRlhZ#SfEye$kIx9vY^<&E z0LBA+z-s+T>)=-MvORV$qpY1@lts%v;^qh@7fFhU+q;)BPcQ!QZc5 zIhmhH0Df?M{D_1FIE`Z1=RTANDzhoBbD%?S)JA^kgvE{r%%TO#KIOn2I>y$p0MFTQxva2~5y| zs{%wsD158}?yAIg*%2CL;2zGv@MMhfA!b&K*sNy&6vzu<2Xya*FXWl__qEA!LwlVV z9kKQlxOU@yfsYGi_WoRnC-InSfc}@n#C|~5IYCtnnk+l3LQVj)0`YPX6??}(?(k-1 z2q#c-YNjW@X{V{lR7M8*Sl&wP4n7(_fm#P5oGc(iLEvq7&_WOD0+q$-XMbsCdP&$p zNgnQ|{$J}Les2h%kOYg-76FP-r1~;=J(mN5kyiRHB;xLA3eP*abID)4;uk)AE${l+ zwI}&->HE;uw~2R8%ZmejL)^1;8}fu2zik}F2$B9ZxA<^p{cCsWX_3Y4ra#!l-UuOb0$4aHY_Qc~f5jeT&S zKJfj54HJG5H`>lRg2SL;1JJYp@zO5Jaq7vC&*2kckcRg)*=@@T){7w#>^f%HdT-qrPy z%@*B%$m))307HOv5rj_Ef7+vOZuZByYD0^`)F9Zv6#93s-O;=AlO7`Ds}&YI zJJIhMqSP7r_7(N@q1OD#pdf}13H;|2T~X}ETKSsx_ES(n;J2eFvRh4sizG&{?Db&5 zs7al&3JmT9rPmO6+axcKgwV_YWA7+`SVvmG&*5Ja(Zjj5kaaxZ-+hhnfiFsv)oH`Wa_H6hJ^h0ms!~xeNBc@h-<@ zWN^F`s{knJHPW8h=|(#!_M&Ud&d&HS;Gd8sg4{|_KMx!%(xJ~@DJfw?+6e`rVwEh* z`zk9rd4yyaj1Qo@?=twbTcigZgl1hk~FpkKKHS885FxMuPs}e5cAP zplwb2l}b;5QA9NjjV7oX{vIDwQpW6Ucgo*(GFDPRWfT>?&B>`ODk}Q?!lAvu2yoTm zf$}f9qzjKEzoFqpx07XfujrHRZc#BGUVEZ+A@s-G3++~O4GWcyc))pbdi@t5zD_9; z?&<((cUkBfpKURN*l-WxU#tsH)e6lm936>au;>y7WY0ZB`9rg<^ATL+3*9C|zu(VZ zxQb$+dI4f0U&A@FUkxjZLU@BsV!Je;yf;xZxU!-sDiZyZ`HOOPwht*68StGJ=K3Nr z_2@&tGg!qk(E>qG4?sWec~$N)hv-|+&kqVMUxVS+14WqYURA)o{*S0Q4{zvxd0e9M z&dW^%V)}b}`t(>E2Njh!@)8zcX+U3sh{)k|I|!%UyfMeD&e7g$=K|n3XJ_V}MQ+R1 zXvJ?hUyH;X$3WGwy<=)Q^S`CJDPrp^pZk{59g@g6=>4}KO!*7qqrbpC`(<`l*Y>K=cb;N?LsgLIJhb1x_iY^ zjhv{SURz5ka|%sO854&K`m-${uAqSj;uQam9t73$8?GOR_q2Yq+`H$Cls*qeQ`0ju z;Eoz{T6$LsmJ}1A7A#+vC&DH%my(ox-IEbl?HYv;)<(`xKrI+PqFE31bdKHX{6nW_ z%11nKzj}!1!rQ%rhgn1$e|idzkB{zy{?(7TxMJtM79j476mNe<5-NQN32{WXx`*JB zUz{bGo9Q9KdL6vEzkL8zC40vfz^qPA)DX1Bj4q6~ld~k<2yFz6;H=Q`H!CgckWzu>@)HduJ@tK_6B?==<%xU#ki7oYVZO8mbIhz$W9eNZ>z0CIC*ALvj&fK(It z%mJ-YF78JRZvl`<{}PSw&pMNEYCnV`k*>d?NDTzGO?|2{ zNKeM~^`gGq*>6I}ebF&GKP^T#jt*2Lrw;PfGoBDECP?&NIrl-Yj#<#LD+c*V2{?k2 z@b2$EUF&F*Lu1$AL;-htIlJAJ|35tYO4+9c7Y_N53;ISz_Dg-N{|a>qQ;=6@5Fla; zz<}VHsOT~rc^RU|o@w{ohInM5qzH{PvFbYDra*=$b((xn1)XMyEit2frm8UzmR}>| zfu<{Yj8L*$k!%E4v`E|oHa1&;z1k+O2?3-6&MJn@#w}Q=Kz6Z}&yf%q07p}8=Fm-` zg}ONR0DsyY8D#q4LECVyp;~J+5K#ImZ05OocsmvYgbFlNFAWX5y~MnU>F!)Zue1s$ zw7MlsF)oyCD!{J6o1TtN0`@A5k%#OPpp?J_MqmHVKcr?Vx|;>Xqng^gP?d34_iUVo zZ0#6QdJu8R&@dK(E)Ye)U~xXv>7|>315oJXXXLIsOW=z1$*@Ip6}XTP9#$`I^YUB; zfyd`^XgUs`GwKgi`+=cz{-Rf=`nH{`>+eufwE3j#A-=6VTS7`oU+-?bU*k9A;?9Qs z(B5WUB!3~Y(%n3xME@hqVvYf5eURG%4$z0-1b*O4tvg6&ook>>gpSRAX)^yC0A{e4 z(YFiexq#T`r+@&GOXqSpp^Xf>V$OmmaDn~{q51%@7?!nK6L@Oj5|axwhMxf3T7T1Li=8b7;-j(LUyw9CNrhXc8* zaMdH zQIQ>hp4U5tsh}tTXH@ynpK*FRLg+xi%^t zi{j_c&=J~&DvaeMv7w<#FXW?i4Ue0kG=@Mlq{qgt)%c;=K>x+b`dDyi zg)dzLNM3TXp}c%xRu;>@wL1;<3*hen{%H^JuEvhu6BA!RkTZ(kPVnyCBrAy<+%1Y7 za6p~Bv7EmFMTW16S|_*}@sP{)X6XPbtkAa(g8VQ!decz~EVMKhz{`Qshks{a<2~|ajWWkVXt5wSH;@40Af((aZYP2u>@OY`)}LYBCoL(-Yri%G_50II2~sr&bVuO3SYL+P z|Dw!t&OodzLv>wDLLwq8%;os72vh`+&uYE_lY^Ic4}}6&IJ$cPf!IQDM8x7M1x~tMb~t=*ae7VLMKC~)Mq7OAUQmX9s+Q|e_UvH zQz)Bgva_->Ffw+vw^PSUu@L=f`%Ep$#?H>7Q+~P{5NRr^swjwvZqtl_i(^m`td6k& zp%5YawVwbok|$?}NcFzTG4$bd;gpwagoM@HOl!7-mLV$Px$<;G*iDE#pq9ypG-mRl z!HjM79wXzv)n2&*Y;K?dL+rBec!+E4UUJYiHdd!&ev{AUQ-vE<2~DaZ-$0>p_b5#u zFwxo}(ylSmL7I$|jzg8^>(|c5{`*V}48h22=#N_hIF!8CRlrWh#29j{fS-Wo-+v)S z&KZkejht_Vg~bFY0?=X*Afc&7qWrO}tjyE1<}KDm(7&!a4M$^>erObiwyLQAdLsa< zJmpAJlh1s_c?#g(4DDo&X;N7F=;o(?NbY?BQ!%3%DIt}bZ3qi4aujzx$ z0}bJdAYmC1v~6PH<&}|@HJP|-p`t=3F0S2kl5IC?sT_JlS;z9>jq2HVm%QG;i=PlX zM|AEFnRk(OL_%qPQy@r6^5&9-sfDSB6A-C{6YL_Y&;Qze<$dMS*_`#=x?ak_ursrj zq3e!t3@rdj+FL8ySK+nTZ8vB^@(48DhPSNo}u~iQDf=_95P5d_Y(q=prr25 zpA*K#r9A!Y&U;$vvt(qZM~9`;*B}JALdVJqyh*VY48&CKmE2l-8#FXLuEQ=-_$|A_ zBhG5n78}NH2ytsqbF<6}Bdh^>-=LtNu`z-|i&4n7p;7fiIXwwv3=QTCty+`S^tYh_c;|g!c?Sm5 z85wB<{i#68&B)MpnU%4!vXZQaRh=p5dMK8fXK8KC^e5DOATO}JJplBo{nj)Q^g%nz zWuVnQJW}=u>q1bbY~S8iXaA>9oUfX0B+f(<(6sv z{VccTi!);zk&9?aGva%o-i4s+>D#ag%< z-UTIAwufxvcFh;l5yss)8s&$Jx>ZS_u7I3wut2=>hjW~; z1t9JFyC=?nzr1b^FPq`Uh`_tM#gD1P0e$!~_30jHH2U4z+G;WW#}f=ZV$qajIbsmZ zx0|Y$-59-$8_-wkU;=1Sqw zo16E>tP!-o2L?K76188vc$0b$MSJItR)s5=M?YT(;IpKO2U_|S&+@xg7+6Z|6G+{` zB=ezu{S+uwmA|avCR(@?S>wme!_&8q;`quB^-KCl5SqoNhSiN(+6aWfh4U3xWF#c& zIy%_y-hG^?5ZwMQCOR7Q1Ii!>0JW_|h197}@QU64WP@~EUfxGPKa=5oGYySturK*u zwGTv3XzeF}WUGibvlgFn`g7!L%dm*|TdYxbZf+709=;xYSl=9=VWeAeQ~>i=ygjIJ zGfOJ?-g!!9kG^8$V48Be=XFSffpnDh{D=C}rmCX@T<{{|=i{4^1y0l;%s4LYZUnal z6uZPOWjpU(!Ns+k*Ixp)Sg1JB(b8U~27tIcv=}`+JkXJTP!QzB3K|-Tetv$}X{f2k zJ7tBWK`u=MsKQAQ4T6;*{ItLo!nTgYGf>cce(wjz{xHIw8@5~cLnlD^W<*8h52`&N@`uBEpeBlQW9ew2Y?}QR{3((26x`?@G z+1|g?5eF&!#CM}m5twdK5Q9Of7g-qy3s<7nC#PHB7rXxfgc9f`gAq}_(!Jmgh(uOC z-r{_G$@0+tbJuT^fiCe&)I^6MglwRTprlw0-70epNHrdx-0vSai)S@BiF9pR)N6t+1@b?$z@owD6bKdJ& z=nf`4LG99rgv3BtU5;Rv1~p^@hhvKX~7|C9)_eDr$0kJi`aAah-Dg>D8xc z;pz=hXX#0w`rm6LkBdxEtUI2Ksn|zN-UMl5^&I{1^77~*AKzh?iVV9qKLJ2fH1r5w zOdJs9_2$|rtdcR8agLbA3gUB^(i#Zm`+>vY-@k$U&*b6kL;?4HwEQ8+4xJv^9B^zZ zoLL3_Hkif3Le2-pOA#@Nx}eH8^HhS=)!ukjn*%Niybo6IR0=E)9?ZlrYE@SY5Q^v< z7(5}WhAl9af8cQ)FuI`0fiEIpe?2TZ8jpko?f_S6F({dA47i9~O6({YV_5)$*k2|5 z6`L&@o`)|XYJzKEXU!-_szkwX#k5<8m z&?v3DZbdq8&@0M%rekf~g}3}PfkOz3S6+4{ic&}wa7O)5h8aQOSZB(+C=K5}{Bljp5;IeJiK zu^InUW7rx!-F@hB-D&4s^h44RHv^GBit`ig2@+s}*MS6|b>Bl@*CS+cw00tm5IMrP zskIe&ze^p75nw_S!tdw(@gsDVft5;;6&p3T?5XNk)cp%S^Nw`a6?nm zQ!s&{7E@9R8nX0FfhurjW+oi^P$cp^9qpx}q9SZ!M&S9RDOExv)y^hE`AZdWXjnYt z?wR@KRq0TY!^5OiT~nh~WW{+R1V?y>=-s=u4kryv~vngMC(bM8thN42G9pn&)>`yyCrJ5pOsvgTd|bdc4JG zIfz#8txwjuI6F^a4uf|CAhYoMy_d)J9~u=$6(=qrw#4j#+U^}aKD0LcdsT&=P{bR& z$T)Yu%v_=_-(Nrn2Pc}biHQbAM&EXwGMbt)XqGl6157U9u9&}i6|b#|pr`Q^sX#6g z17+w2xA{+SODxre)I(E?G{r6cH7w48f&woIg8xR>x4krfu%y;7QA7IC9|y{sGd$%%o7)V!?_Q?^m~z54en9dN%4ipORrC-n>r@?DP{ zF)KdyI(UHI_DE4o-s#JZkvw0@-Pm&6t34!i-}?Mba|<2OOP0GUWlKv-f9g*BU~w}~ zOiX;#u4`+1aPr#)Z5FXa>__}Vqr?{Ag^_%`XM|3>Qr)LHBm8xnVG#pM(>35DBcb;96FR?Y#8m@RoBKzzao(LpQ zGsA!R>FzPFbUSK{h(aBU;m_JYz6mxp;IsjUa?sET`Ze-vBntUyiJ;bc{bkh$fB5G~ zL53refBt1>QZxG2^!9TqHtyajcj4#Zy@ilL-@UKJczZ15@=#@7UN*B0A;Yy96af_xU- z&cx*8T0PjVBHjS>qbKz3PFKMMV2Jb6V=q`dc$`s^&d#ORX&ye*>rU&2%LNZkO^Mm4 zG((g0AZ9M}A!iWphL;6bF6h==q2Ais`mVPQqa~%F2#kt?4HxzKvs~pk>}`06L>RU9 z2a{wpKq=evI@F+`OS*@e3_LH?BP%U!GF2atIQuMuYZ82aU^hdc2lAd_f-W;7Wp6v! z5*5I-k;wzd;S)>!)&Sr@P1N{7B<}9+ZxL+)Zi=S;O(2PpzFu=+7{>TV2{;(5s}I2YQu(nzm@Mw`A$n_P=iZpf`o@OoX!$S% zs99OL!f^p@BSx z2lVt$kFd6UGYng^6C^5T;oNKHg`f(;7Dxv;f-rOdcl^YJ1a`OMS*(lC$k=BF!R?13 z__-CGLhnMi+w;_y3$t}$p#2=Aj7^eh`9=YLU>fR}dFDq2*J<2N%wSDGHZ0*(mSR zr-Cht@KVrVb!OB3Guz?w4j<^5cDuwtOASU}*Cva`V3D@5b*OPaNhOQoL`YHMP|MM= zHb5xz$rA@{cNRKCkVmcm;`8)Z*>)D6HP1k_@3^X+m${OD;-&WAHHV350Ao>ADGY8e zieRQK5pbN8aYD!{D7fAh*QQ-IU@~QK1SilGG(gM;2yYNuEScavlyK3u)|WtZ3(CNt<20B*Ln&49yrTU4~F)cPA7$Gg8TzK8zV zW{7g8ro%#47CymOsA=6-;bLWH@9c5yFX`;=Cg)izgZx!eG);*W8m3HLZvfl~!S&N` zYkLVGxR#p>ykwC5-lQ;VkKc=a$bS-c7-3ONb)ON=g+%O^kyfthI6_J zI)x|{**dBbp5Eu-anhTi!50$^@oc;G&MxPZ@LD^K9o)DA1 zFD#5!oIphn;6kTYFJTZ6x1oxueMa^rfb8`2HXEea*%h4*ZYifJ?af9gUA;=Uv%?7~ z^-TW36@E?7qytz*OAE7GNtO|)uq-W`lokw!N~oyxwmbuM+3gS9L*J8z|os` zfC#!5#a|H>6=l8lB89O8mvY2#d4M@Rs3uFdk$gY;q_54BZTr*AMy*$kFuW-&|x+VU8%S4e^>y7aKGqpT#;0z zE7YLIvc0v{@aT7zTJ9@w@&jCJFghzl#Dadvd*$?Uu(FDQuxiX=X(=Nrl5A%M=gWQf z_wS{SsOg@G{rc6VNWaAyh=IW%!uIwHpqJeUJ}g*R?;%qm1T=%g4kIWsWnz*U<5YRk zzqlB_R_rBu)VRTK7O0m(o;DpjM(1$@x;=^LJ6Xe4dFdj$1Nv7>4mdSh64DuAu6#A+8mQJ zJ#x2W<{@FlJO$!s;H10$XJDXMfC$vewm>-lCK;Kgp!PNR zu=irioZdgrItEBi1bn@FZ|=_rCIfk{FJAZ%ALiub$VT$auB>Dnrx4K5K#7K&+{B3H z6uzA3nVk*gjjsv{(E*evTCfv`EUy@YWde8+T9i%SMNhDt4IZ8f0sfc&llkMr)KH@j z-Yc$<4}++KRb9Kgpv%5en$q9VQ60?bBOEt9HN~ig-xe>fH`0DKmIJ&L0ZHl#s1~1P z)Yg3NKz_Q(_c73Oy~&c56n+V_J%#6AT37&ZZ_e90UFh)V;}yp9_(a?E99y6l{H3b+0JUM0pm; z^AtYc+Fi3jM-b{;9YE$)+veq@qCx=xKiEPy4aq8k`6TwsnoVxeSEalIZ$1#zbz5PgEu~*5WtO2 zpWp;!g{`o+Da6giMaFMyE7f3KG%+bI;jlpS{7w8JMR# z%Y%>|!_i_6qWndF&v**=0Q)U6+KVj|IB6f`vWSI1g7QU{LU;_e7;(p-Vf29S?UW#( zTc^c{vSNO0FcdI8a&-6a>o0Tx5`ahl>PQCO?#3j55cvfKq&IJl6>6_ePe5^K)*emq z@q(SajTBs{;AA8gxRUX|6_bOFafMXM33CiVjpcRe0#oHo%|tjeQnlQ+s3?mOyQvey zMf?Zi1l(Pl0<})cL+rxQA3Xa@g3{5^QD9VbWIS+masnu$K%-jeWJABhGdE|}&_ExK z3V_Xq>%l{NY`k)}!ATT^GJq<<0J-lCTD8gF_PMR5)kEl{pe<(7!DY83WMPq?k>UU8 z6l{}m0`ONd^5M?k-`n5}8p6|RDlDuX;OEp=>wLPQ?BF6!!p38H>}M!=OB7=8MQw1V z%FEM0Uv^VfRXs-TgHop`NZp?lryiIAxCH4Ft`?T%VUH|B=H4nFoLB%xUXPLC-RyEa z*r;3TymZO8u#^o7*QEc&BKz^`iq)=q=gnz6s3^mET64g&QP0F=1@g4h<%G})&PZ?V z%kzf8$R>Y%F=@jFBW*A~P!I*Zi*r!@=ZPXn4OrTiuM^UiG~t zSxHGW4rfC$sWMI**gN4-QJ03Da?_eT2x5$9o8qfxw!!= z_;T{DHVOvvk9#{UU#qHC!6C*9Bh|zUNE6`WGu1IW?cR2Vi~Gn%NQkDitZaNdj-BXa z#?9k#Lu2|9=j7*F`_(nb4}*DHCDh7SY-~)8%+2qgY}kA_X%lr6_Z?2YfngN84ry|S zkgcW3slc{?B7p*$1KXVf5d2Q+NSqo`9i6R_GM>@$-G>ilu=oAt_VzsOFvj%v@9TfD z2|QTY8n5oIs^VS>x{Qwxq>m(_qypblSS9ox#D9*rZz4b@f}GDub?w14{3M4pVUSQd zNxua(E?p9zblEn2cR+Fy2O(R4oyscSU+3w04pKmCrHzvc;VB=VD=2%OhH6b(_Fc#E zsy!-~jeP9K!vHd6;1Kcg!;j)(Ykyrdq+MQwki+!FhJ4*Zp$?b-FLev00kT?>n5O%Z zos?8Z$Pj(71FfY-tsQb?RqRnvPkctLy}rpy6CEKP6YE3N&$h_sNbo0y9r$IqIrtc8 zI#O{*Hj-_+jv*kvE1A?~Ia;1p^9c6HkyNY?q0qOgfrx+G%A6Rr@l|2N9}@hM5+-+S z{KVzttnl#g7#q`ZETD!xkch7~YJ$M<=Q!D6&#WM5abn#JG%L4`94_S;Pkm>3{~ocp zyqv`~562ve&G`6N>?hR@gUE+H+~a~?%-X~^WT$uXn&@HQmhohvD`^EwoCXg<18F{( zoj}`Kb^+UZxbE$0a2zMC;dhIRz;>VDGM{!!Zq`j<4 zaOGg7rIpXW3BL^lkl;My-{h?fzlHwACmol&**%D@G-(OQvU?0 zAxaP@o%(*}bUATkCLn>VR%Q3!o=+g{b&-&;+4Vk$>&+CV1UU6+GRL67!7|CN`}aQvBjg>i_o<);tcF||qaq|d$tfwVruCiB zG#D7L2RV+@Erm8%=(-On3V`W2OG`uD^Nj&J^PMH^JTT(I!o{UXoATjf!-P}oE7}zJ zc^-22mNXT*(08bXzi)ZO#>TpCJ}uVXD;|Eur%7qfm))6Z=-c`7p_y#k zk?lY_NzB)HIugeprBoS*_S0*oS$)g5=eKTEH7snB##HmxUH zJjAJZ1)G{-UulHr1yH{R29&t#K{99?kSmB)z~ah-&MJ&(%#2mqSQ}!WRTD56ZU8z( zMX?B_pvLN`bL~578k%V~p1n~^cQSU9@FN>2#KR&ZSN@k#3NCKVR|%x~A2e+me&|4r zJ`VfXk`(yS28bcY)%nASbQ?s6kWb&=z7*%c@Hej=OE-**-j4s^h#Li@f`OSIRTxoX zGk)vI4KdNi@QneG#Q`1^=%+FMaXo`0Xf;%}Jhbr#rkdkVaT}Z#UX9ALiNvzdJ-7t0 zPG)8%pav~*FB(9#toYrgj=MXC?$v2+fkPJA~ z7a<&d|3XU$1Ht2B`5NEsXSM=z+j5UyEpeI;_sy6Sn6D!EwfA066>VJqqui;*&cSYP z^7rrRvPS1&!P#mHt?F9c27FFd&Vq7HWclh90z8D>Y`8g|T4#B@+xn5XDW!l*jm2UW z59iuN>K{^`#}8L=7j^jrqK`OVa zh95gWkzcJOw;C>vo{cotH8UNm+soNcDC+I)iD*-y@!W78T!+I{Qg3)Y{%)UzOm&^j zF@7!g!V-E{4Q(ee$me!2R9RVKac`WqI%o`Ghj40Nvb#Otm@&v>pxEZO5hrpU^fCD? zCl1_>8-vI=n*_Rp&1)SjW$f*xDlCYBuE9V6<;q*6eQHrr(rE&k*p@QojbI3C z0l}A;J&sv*?rQ%~oSMwap;rXpSl_K0UQqh{v%ERyS zy^4NhAUZYhy@m(*vren-Fs-wT|N6XCpYp;L>U^y#7IWGDswK_@S6b$h!s3Iy3QH|y zKhukqo%zL{wwetgpX=Vz7pXbWbyjQZHrv@B)s!qM-4>nD#`Hn)#6l0EO7zg#hs-Xj zsMdW#FxfJIT9JywY$=utyp+jQbdX>;4gA9lICY^zfp8NYKucl*QY@$?;FZYR#q#~O z0`beV$1E%zAfMRW46MkPYfpbAODFI{q5?ND(|1+uSKbASy;h1dIBX5W!!j51j*-vV z*bANPVt}N=Y4%#JoeLUXFbcZ0HT~)Wd_99V$8nwb#XqC%70B-qaYfI02uS|=W(3B4 zWic7ZQ^}+ViKpA$S-M|_0GVR^r~;e%*xZGCD_ zqrW3YjmZ$J+7FyI2jO9aE_!q050nqc*{p|TC6uo9sX84kB`AA)f07ssP$vtBWD|(j^cGGCjKU$AXO6H7QNL#ytq;q(8@Unq~f~6l^A#{Qb?;2XDS4zQ_BKseq~nq z%g|vh&%!uY>zoV6atTD1E7U)pH_)Rje+WddyXPDZ`XkUL^~&ber6fW>1p=x14g2Kz zUthNDOZDw7)P`;qFV+mK3P@vRmx73%dR}Rp^FY|^^hqR(QAv`DbZYZvc85cTP zfe~U_a4=(7b`6*e0h`fwp%9FV0TPahj&7mAg2g0*wa(r3^?$&41e^XEeU6ICudUsz zbEO7J#895rN$6i+p>}bJKEhxjl*$gXS)1EFTA8LY#Vqt7TFK&p z`tJI+sXj{A@TGh1yn2C54EpIzQ{P_&>YpgZ?KDj&($)*>5;_hPxRus^3}4~lSRoYJ zxiwS4%y#cGd|v=*!7RP%3IG0EH1%w!LB1cSo)QlGDy zaAulY7*8yJ)P#-h>rSqfp&h45wbPOyEUje;*X;n~^6fH{7Y_LvHGBEUY9XImwLOkq zBSz1+7HcbGV~2g4@;zMM1@9ULgnYgW{710P{lGJ_#7t@;qIB?!rq#(P?9${t16n5d?vat_@n}z?$QZ zQODL1dt>Cx5mg##4<-feo_jo#^G7RiN}lT_Bv%Q0U@w+6IC~mpgGW4$Dh5|SlnCZT;Zx0>^+k5uxYzoBtq7bdl{j}0#!+yX< zfXkuMJ`kfoyKHQH{Oo`K0m6LRH@nRE@MP+E|=Ln6EI=$rTZr1yl$b{PXb&z(8e59g1X ztAm^V3-W@PGQWN+>gFr7n{`5x>*cb=kD~;s{(-fa-Kn+e!S$C-!?ki0W?iZ8Z8t~I z+LUQ=au{kA=Y*9yf_G?I-}XbkQx=uS*!$vldR zifW5`veproxn8Fxn@grq^KNEy<{Tj8;QRxR7O7dwf4n;w@Q=}8Eu_4L!yp1mEdb{N z(g83#cnQhL$-$)KEWY9c&_{b{(wF)D`*+Y5Iz`S%f}tut+(yVS=G=J0j1zhjeoI84sBQl>_bdlphw+gG{YF1?vgP zYhstEvsDpCHbIOS_w2ofX3qYhtDmo4zDdW)>Cn<7Uw&vAf_`10twEs?$26Z$ys>CG z!3{Y@pQq$2DLeu^_f@A7MuS7l>)}#Cs=uiQX8LxsyAp$GLQ`Z4C0TSDcN^(n(qI42 zva8hicz<%e+@#-Lx-;DpFUS3Z^NQq#46i7Qa*4EYlD9=&KOFl8PsAMx8kXgHkBlBRSVn3SQbTLnD zACTD0C-c?o{DaNUu0wDKM9*J>Z&wUk45YO{)sgCNlhLW+_wB9*%sRdF-W7@cY_!zP zhB;b0TkWtqso4H%oAIr2XD`}3AS)`1kOs<&Fy#GCxm5p_x$}%ajx#*;&&a*Xmq4)0 zAZ}Tzw98%GT%DghV%<}A|Mo+MTBAl_?l_3v1vSF{sqvFYWUj%A=eKjzo>`TPF%h6G zNT)%Z)adJH4Db=)L-8D|^Hp{TWyZYA8=rpw8Dofdqmcnc`7QF{g1K6<8zFu5gV{yRhH!D1V)a1!v7jg(Ek=SG~e-?6` z|IU6C3y{m10?Vz$U|#rW00-dau5rck8)jer9dAxNe%7$AkJ zMcHMA95LTlD!?$S1*o#am2Ih2eGJDPm2q*R+HQT8&^tMHYqPU)>XSa1Cn4kr?W)`o z%E}Fh1CGZW#pPvz0f7NkWcoTL$@RaNes;9A)!6NZ6DAwPMO$h*9{1Q$dwPX={SZvj zocQ`BGLoEhpAEWjze6%0_f6oFa6|L*F*DB`Zo@(S4D}71gwBKv0r&Vll%tb@LHPUk zbwWv&ZxX+-0NbIxok=-MM>Wka%F9coKYNZbtn8)YtF;Kl#)YLN_=o^ml5PsZSnMth zhcOx-xXVKy$LVM%Dj^}lpa~G!%2Jd5T*Vy4e7}oMw$#Rib6g)4Hd_g096hd(AWf;et*`X!0p@v(vRR$m;!)!)86xu73&N(s zzM_)y?WmjB`!lY(6#0GalV}0gkNju77e-MPzXSpau3WO≀JaDtsVVm8r5X&|+NB zCBJZqI(c0LVJ*PHsC2Qrt4tdmJyw#@2`t&++fNC`+FQ*B8#Qnp$ZKxe7X{}uO3}&E z@0FL0%7w^#5eAG+gw8jnk$F2%glm3C*U4D~4i;7s%HNq$@gSa8{N2{wXGgkbW@7?_ z%K2tyMwu|$!pX)4|E(y?GkB9|si*hGC=)z2oKMzHV+oy>VaV?uZx2iyAt5;f1Eq;` z&!3CLaqme<;oB`eWiy(3ofEF{yKegN?~xH};Jsd_bHM-y29`>&qyZXQu&$hN)Jt@+ zrx;#|E{RY>LBV|5DzUe>hZq4(AJM9+DqwrTOe%;II8czY+0bFXd?Nvxto!Q(i@g~i zu?X4CGRt*G)WI-Jx3HNgWL%VX-(jfJZTbWLXtEfaV{im#^4!>CVYW2Jt`Qpz507)N z-z%YuJh;_FA)+-~nNSo02y=xxaE)suDdUs-xg_Ye?|Nrl|0Lz(PA<^w&{dj{-fxo+ z_d2mKt*9sSM^sP-hJbqb6;Y?Xu(9KaqY;%%ed&YXlszPJ(>sqV%bjP_7*rBlAj zGs^`e#(aO0-(gyPQN7OMY}IVSEo+9qONTj90dYOOJ<=3B?D{{67tu}E`IY9G5}yG~ z>56ot^TaMZCudpVLw0udqKXPTJM%XtCOQ@tu-TO=i;F59^~qwgMJ9mD=m-n%;xe75 zMgWuzXXu7`c+~bh2RPrt0#8GO>{}H_riy%8rLxjQsqxH2o*GC`@j*M$X_-0T*qj?| z+o3I=uQ9r?uwY~YYx+f2p)Um*TB{?D48%vLP>+Z8htuPFnHqXT&~G?oIRGl^-by7j z!QplV=Z#Y~cqYTzm~XB^mK-RQVx#J>=BA9Ox;oGpq!wX100-2U7yqoND<9v5_V4cU zAdDyc%NCu~@e$-Fm+#9~iJt7|Op7|ms@2=9@N2ktSBY)!7{RGh?$B7=R!Tq-z~Nlq z)8st+{Ntj4G}XAFEri&$wehs;nAG!SOZ`Wa-!LThO%s@9<~TH`IZP|2q+g;|bug(l znn^xGd%@HDQwCi|xwVOCKi>IaAv8Z-pv-|u+yEC8a-aGx_%mUGV1b_N-M!$VS?dE|B|5~NZAlS#f+xmM5V3QZ2z5M{>f3}M~BQ4o4i{|d9 zGzMX&P=}`S8EA6CjoS1&{ieV;afwzLjExJV>-UQs);CF*&_v z1>D$k^YWPEy7%Ywq0rh^YKy6M$&YK8bgSzwwrd4Q!pPY867`6!Ny+NpaySuQgmTrL z%|DI0GM~i+T0UmyY)8Zq(y(fyk&Z!^sbg<*F{@W}HUDH-?|@_MNeKAXtHVFDvUWw? zMLjpPrGHfIEYo;iMA1I9tldf8GPvQg48WnqrD2-dFV$bK!##5cM_l-s0`Dun=nhQ| zo&uhTeUcDOq&wp~v&AosD0efo()Kt}_2ic8a#)loo#-KgA2y6?vE6S0X@}6@z(6Uh z3M4upB;@&I9mQNHW_qE!ALe?XN#g-|Wts$M-FAmqifB8Qe|AsNI9+DJ9dqmn)WS>G z>pD9+x|`bonE(Tc+Z?%h!N#y+_DMHZX;Sg6tk8FSS3ct;q4kRpBkf2S#v$LA> zURM-$6VN!Go%l1)c6ukcAN-l8s?)9?IX2zSZ)a{VNY%XGJT%J_LCX7l-Yt%2e>ryR z!95Pffy`oA#pUd(DtBbR&A6!DF~O0cfr03xKgYwzh2>>#`a(JQd75Nqzt%`FHH(0w zK#|eCpX?Q0SX}h@A={U=ePp3lP(5Grx)@p1O_kx-;+*pj5}vFrTisf`ma#S^RPuBayw4^&GnR)(ILNJ#*z9UtF)y;kb>OGy9zf^3j- zhzr%jlY38w3KHW0kczh0!tm6`OLw1zXobgwJ}@d>+4 zkgLM&cnxSfT--|7Rt#}9WF=SeNMIa}L8x9@9#H)DHp!(yhfpT$s>`h1Qs%ICnL$_s z9?8{b)zz#C7b-isX^p{^<3Y3F!RTIMulLCYoMrr*L3={2QyJC6#FDHm-?7D)UMw1_34pLox@W|wJ!co- zo?qzhy>$yhFf)4uApFg35Rb=*uO2x|05HR!$2qqErU^_)Jb0@ zF%~in*Y0FHkOIbT;Lvj#8gW2wr{uPM%)^r*BYpMqWq*I??BJ^a#7|7*-@bK%6fw9n zD)yL<4$L%BA;!vA>7n18ql_6YngJ*mAt&$7%)AVCaoUE4$NkCz{7%FL9kFL|g%q<* z0t=WH;1r*{?m{nxk&G+`1QwToiuvV30w@Cpw{j#{K0aX z7^tBOK}VnQ=~Fz@fjp2&V1oEy)H0@j@))44$jBy5&68perWor7%11umN-4KE?rv&g zzVpU1f`!%{X>J3F?^vZC9PG{nj0gx1l4`Yewzo5neCg{e{qki4pJJlNmK)+s%zb$` zSc%X7kj$E-DQ{(Q`h&%Vh1V)7ik?6m&}sfc4Xs|FJD!q{T1q&~d4W3J3*%VWg6v)@ z82Tz^N3M;Ms&8ZfFp7ruFNgV9|0Lhjr&zL8Z?DMl$wau!4_l_i0ZZ^+3OP!jOSjZi zseZN!FyH9VaHvA*R$E8MQH*7y#n`v+qocbOlN`GXkJ4olRODIuv-LSG#-;$%V^+B) zQ+i1(Ft(+m!*QPCG7M;jUI!M>`Z!r=csR?yez~RXEWU?aQ)43?ge6+q=V@|^@UaI4 z1<7UY?C-lHS1V4j3+vV{nLo>;azLS#v4-*in7x&*$fTW}t3ar}BMrQTkrc6NP)^H1 zIKO@SEywiuzqJ$gWSXCq{tPp<+T~*F2|veQR2e#1D)Q_OYlbi?7x_qcbD?_@3I#LN z0rkK@xb^(kSDo>zP<0#X=1Fo)C7d-Z3q)pw&JHV5DAcNe}Tx_oapM@`T29()YQg* z`M@^dH}3IXT91Kw21+-O4pKZ_0FTR=vMJnW&P)c~-qkc(0A65IzG@lhc#5sb6h}SM zEq$qI{=@Syh>CR0I~F`qAn1>jZ8MY`!8uE{Tc5CB8|#F)^1nh8@4P@w3zR(#4Lcw6U>qcXvNMdM+>k5(Q1CuYkUWmj0t&T57$$v`%*IS}+W%&i)d+ z2q-NMj^7Jq<@w|NYV)ygiGa2PSp;P5A8{WAk0t%p*3&C|Q~wi6yv><;lI(?d8*hwY zx*55r`6~({LMVf-ZUbyOY%c^}v(Wvkd6^~$JOvQMg(-tsDTQl{irIaD|ABrGpOeBf zcP99q9@93fBXQ3A$-s4f0GsE_GjIF}2m$cym`dx`@MFLQjr4k_rXE6nQ4}vtH2vhq zGd>8*9!VC_dKLQ=Jhm2~y+g%&lhJ|3u`f64XxbkGvk1tHgn=6<6`y3 z2GgOD5m7NQ<4nqPp>L@$b3zE5I1V?up0nsG4cn<(68_ zF%jc+$9En-#_~;$DZmsp4%(-){R*f15a$I94PLo;P$y5Hz^t}MaGPxtMk1`~zt+RJ z(!$gm9$;QQdK84Qfxk|I);dfBM7#hXQs!D9m4F(eF6Cdea!H=@9xN;>0;)|?Q4vU{ zhA~OiOJCfaa9#&ufZ0Ti%0B{0C>5lqvD|ilhD$;@bF&n4jtB%K`(7}y0#!Px%fZe( z5zT=8q;a;OSO9mmXg*|bW~SKL3ob-A>{Zr;@4bS_k@^q5m6fdgNHa})`;Hh=DsI~z zfTqjJ^u^O)EB#{P;_B}%;-<>Sb`EfUd48bMYyf}y`j5Cm7lFx`blDBYFo49Zf^c)S zw=X}PaFNPYEjxzG4T~pm0iR)hZjSQl+v)b!npzF8jP9FcVPI$*AFq_Vr*Vo<;cWQ9 zy_K)YH##)*_HT2+K5#yHq{LxXDxSmqXM4>4e1``5lRkE7xoon`)%LG_hDMTKgs*RR zPg*Zm{0Rlo?-Cr3Pr#~$5gbX$Tq7)Ej$B71eE9-y>I8`lpp(!h=rhimZ^~4-29?)CKOaHGO#2% z^-9oIAU!GK1fxi=T|)!1Gg?lGr6OQ?tyc*U*QgQ>M#KPv=*l0*u=Q+);J@14G*17w zs_1~Uv_n6V60n6R))W8U7UgeaZT(kDAsHkvCV&6_vs@4{2E2%}EBKUGfoS*%*3?%F zyQVac9y!;4P{cM_VSmGG_6EF9QS=8b6B83TxvyisFZ&XoeO#MFP+i+9z&*Je&Zo+$ z?5`{?Lp1`s@6HpjmccSq>kC}L5=VwUBN_n5BQlT?=r7QMgDL#)NYuO+Nag;3>u`P>crY?e;P7h*8}HL6KWTxukl5IxmJ|q1;5%gm(>m$4keY7;OS}%mB>5j< zZQODE2(X_djFK@y(TSx(!eatt4^tb1xhk}$YwH*o*iSD-P6xE6F9~I3X(c7Sb*=@N zhZOSiGqAg|5fVyDdytUU)@t;hpinRc(K9d*|I})zD~S)zAo3UKc1dwDL{)2`Rky|Q zpn=OM9^&?Hwib=OoZH*YVfv;H`}SbwK_W*n$EiPC@qhOQ_A~qhQ%Y%R`d-Wj;@$^d z-rm4V`Bw_Ug${Wh4A7I1k?nVS!;tRF^$E8nORJ+Dug{+)u~$C49dOKXLTwa{-S_Ke zokTr0{1H2Y49XE$G9K$Kysixd10MGym!95KceU`1yMKU{0B!t`kgrm`|dEVvadoZ~Dt3pIZ2AFWZA@c3hqu3qCfD4@#o=RJj z*&&nJA7R#p_gT)go*j6gYO}c_V)seUzO*5fwh$ARe-SI?g?feTNtY6E zA)hDD3~MNAj&C2j_N;^2G#~cwkp!r^VzZmTAdh@>_WAQp<{jb~n-`S}M2Kn%pc`EaT$={c51 zh^68PMuE_!>y)68#o84}9R!Vm%s)3b@CJGwD6F{a*6}{m%yhhoo3D=o{g$!?OLUph_*Vpf_kFs@24B__ z{k7dquU)XfBk!?#VZYZJJ~+Yb+_Xa#5*^Fv`S9_hmY6423qMhvm-)!Khb-R$jDq4s zV3v^Q;0`b|;_GlVdgo;_&uVTO5;oy+EXtgpF1(w$3=6ruU zP6`QFNPTR~)dW>wNJhV7`M8i!U$}4qjYgj^ssy8K!BOh@b1y)evFHZz=I$;ynLNW@ zV{y;Dr7VUD#b_HWCu*oj_xs>drR{~E>0zClZP#xsAho^xhZ6`@@btOThUTh8_ZN-j z;ORvGu01A2UZFPW&ne^4*-!f`VY*)sMtNk8wsdR-9>ATld+zF(8L!kU&a5lDt8+}A zPu-7DS-KgXgjx5qCf(3^3aeM1-hNBBCpi>SSl4iLncCib%x)K@Xe zi;nyDTJJ{;Qm7hgjcUTgcm0;%#(7pMkg&L8hpIc!K?_J5Jt%;>5-7rux!(dRGf;?= zp3_6E#BMtBI}ReJQCnNopTU9*k~h@wXgG-rkRR=azJw7p1JFT$Kyjbg4>F_mp`sa> zwLaZ3!}0~1?Pqae#=Z&56_xP=t||E58iK63qXRw#_i&-M`3Z#%_q-RDiE7mS`Xt;6 zRt_2(C7d_C(PyrpymlvTFfXSf)gRiUJW$hOd2Y6@4qea}2OPHZTEZo2EH}w;o09q` z@PtO}%rkOw)KZiJu%wpwZ|18U)IYtRkfuIAbgG*yu_|d4x(JY-?>3$4Yn6-CsrX5R z(+lw_J;h$=E6Z%TDWIo4y|(phg*8=d-+Yw5H{y)fK!&vU?+}5@mwY4nkQM(uV5MJK zH3vC5pm2UqsCyZQ`8YVeBPA4H^hHQJt^@5s&DP@ z)XTpY?5cWh3jI`4&InF7X(`+Uv?)f*;&{9f!Kuk*G&mN>_08?jX{zacTT!k;*=vze4~!6iXU>GZtN#( zd$FxYWdw zVeO4x|FhAqbhoenv1vet1(3e=Tf(B#kxQH@3hxh8HL=B0hNh+x!Z7*@_qv(4i4jcI z!vMwz%xU#y$-@xI5LT1|2PZ&ONT{XOImr9!rXJuh9*vuuivXUO!l-*s`YW3`N{opL zhX7)uBMu-yehucFlX|PBK`8K(Cx)bhe3ZRH_p)1OJntxKX70MP^bW;{!~Uo7mfzm? zgvh9 z21jo$hQc12RuCTTFpqk*=hNKW*W5q4D|e8#f%w7cg3vxfEgFj(x4F5}(gjX!z7zi0 zN0E0|sfFWCikHomIYA{xrUwV}@pRl(+}Sq3f{SwadbrnJD<=Gxt1G18(9)C`-@7+m zH|DSB-<7r%&UeP&lfQqL{r!8<9aRKo0%pyG1m!bqUxrJXsQ8>%SPSmZi!J^AX@481 z>&@(AV+(6rSWAnSl5Qh-{obXX7ydK9o>X2W=zW+IB{=#b(>(d!W0_Er`zgy}lE;1~qkdj9F0MJKtT}L$>X~&{BD@tfydPdlq2E2`pEiiQkq<+?9!hyVzVRjh z|D}KZz~HhQRE77FVQ`o3^#*M+khW)Fj*-W{ZE`YU6)UfU(`5uAI(s{d2wZ|ancBM$ zOu%BKq*{jI;-$)=^jF&}E4)vh=$1VoBO#FhYq0VD;@jA7`_5yQIQe}pFWM4qyzNh* zpK7o&QCOW}*je`+**NaQQ@nhUXmz5{S#m1!hPm2{Xz{w^)zPxnfjPa|()E!E_h#nempWm=(T~hf50N+a9114&kNkKBRu=?n+#@tKG+i{< zLn2zjn(qC&mrcN|T5B|tXw0R;Wg3x($3v;az^unH9K+^(?Fls>SDa67jEb^a@6Rz$ zt}k=q<`ia8GZOPGc5A~bT=e%Id2ul`vvzg&{(jMZhepD*)kGpnHS${b_EmMM@dKCL zex!;@WovjIG}YF+Q_hZB-TojXD=SCSJ2= zXwZpFJCYE?E}qA2PcID^vnL&ak$l!`zMif}wop#4gAW~C&Cb94f?Qn3C)|dwkm>;Z zVt`&3DaC#p&IaShrmJfLH5iF2Zo+Kytz0Ffod*29k!;Ri6LP3ZL^S=&nLoFG7Lz8U zs9}Ce&y=BG9iEaApyaA!EwqJUJ^zG=9~$nyy-KSBX0=we3jKJZ9s_El-!ZtB1d3v!zyU z{+pa?(%EGz_V)$R3&O-U)N^tN_Y7hi{=BeBYkRc4fO(L{tT!<+=&JFZn=)vBCMe-m z%-(E9LjFYEF(x)Px+pGl0%%1VEUd`67%o_G%tiwVk9}@WH&GGAWgIpUC)DqZM{22y z6_J*^uVUNGs$)iMpA@aNkuKD>w>UN8!=LH7<4DWx$8e=^B^)h$u3^|-><^GGuwZl8 zv0dSBEma|~tHJl6n@1f+g1luh%ne~*iQ4?&C<%p|% zyiN~Es^PAhkLvuzp<@tHV;GcB+wGqomC$julC1b`{|}Q231 z^S^|D{!v0S$%9dl%^jvNu5xQ~F5|oMJ!IXkKU<`gI|w2LemPuz0w+4nGLtm|Q{sOo zV*f|MdQNu1r2wDuauBetd;G8qbb3VA5bPZeuiqUg%FCyqk2PRWpN*P&ce~U5=VS$r zjI8F-N@Knc-Wq41dvht$OqF0e)+M*|z}0+gPHkx4vDJRk|8pL9`5IrrdY^nPs(i%Z zX2v}>7c|?}Qr%{R{h>Y|f5wE(nVRjFFZKLMF~zP(qVkU?i-5y+X{eq+Q=BGvtjf;c z2ed1qt?LVbo(eA>`;`R{ub@ajxly~O>M70OymhHtSZLVU3KLM?{Z?Ha8L2S2IF0x7 z=U7;4>)5zPU-0Q*1X|bJG%f@jl|!_a+r0NFALBmpZqMD5ky64Zy2mf2Kw-8nHyGnu z!`3jn(Msk%bo1Dubm@(g$*RcDs@9jC(NCQ4i58cZ(QZ@wu#&ll2JI8CoKrA?@$A+E zbGk7iBQ(K*K0bQ)icLE8{oIB1^i05TK#8Tfqot0}iJF#O7cT4UC!qRxJy`J0n>uFZ z`+4OGNu^(WB$*|{(!`9^L9`Q0xcoglK!p!os@*V{y*ub2DIy}Gr?*q6Jt5pz?J&<} zLx(~mQ}_LQT`l5yhOa6Oy9?!O(nci;ScK9g z_W9wssSHm0xs35|_V3b@zUksluJ5#~aY|nBXk1$vmeALq{fO)Qca}o;U$XnX8nBdi z_ljP-EcM+_$4-~F+LLp zpUvDOy@;1Ca;4hqiec{SBJJ_2aVmH6@Ak1r*RI=Cqzcc?_QxIC1K);#itgNb3L9$^ z4x=wTql-9+NntlqC%Cpn?5EGuTw7G(wv8TYb0n6Q=-Uu~=VIQ}5wbcOR%)w|3C zF^a{E%4E<{j%i=Izs~W__v)tldV{fV@AFi-)GL436Q6v59&|X^Puo{mPDLduEKFZl z*JkB)NF82KL_|bc*)9+sWw6?HI3Ceysd{dxO^4QqPLQk##wHlitxXyGTJ9o^KgU*w zOJ+t3Zcw`QH>8l2V_|BrkcEyoJ`tCL^@P32s097RGA|RZ?z(nlr2Ql?B5&lXzcDZt z6~^ojV^&oW63oj?zcl^y%hzqJkd_r2mrCf&4&2U`cqJln9DHm4O0C2hO2;cIC}gg+ zg$IAFCttXQ>Ls6g`&9E|P0a;IB3apI!Pt9>HDQuifTpJ(ro{%CSsvtIFqr4;CbT=hQc4wv~K7eHKm z5pIEsk`jy20pEUGoUXUo*^Jk8%K1O5%4ae3KQW%DvGK5z(87)kyG z(6oKP!_zrFo`!F8lDiA?0aTYAP`Wtu$tRxAF+DFQ&oUD;9U*u}rZsEdVnRZAwYprZ zNc(*6T8?;sOu~z3rh7EkpIqn1Ae`r-Rid%!k1XW!G{p|Z^vToUEa^a%&CfY)>uK#! zN17Ljpy8s9^5K8I^S-=8zw!$;}MTlhJk15@AvXGkQeZhvWurDhSOw6y@?G3x~|>cyNRw2X|<)1qKF^q+WAc3 z6g1JDJ*ZCO6#tgr1UZ$wB4+0OUzhNiGyZ{;d`;NQ1702wm>_I0F)^`3#Ds?ri?Phfc@%?mpRI;2b)cuL(nKp?3Rk>l@<=6Ct$iCjD<0o zm8;)Umx~1j(ge%ATEu=mP9mLT(JBOM+zN^ZER1gPhrEBZ|0BYSd6)}9TDa8YPd0px zq@*{l2eV06IrL5h^NEIshh{V3*o4nG2N|Xr63H5iFS1IwYctyT23-pqofKcWCv1Cf zt0jrT+wZc;$iuwSRNEI3)LNa#PH&pt-^#kxvMDvr^9Z+OM|gVpHxLyE@Rhkcxed>}mEEeo`l#1x+_S%CSL68oanTS8=+KVnn!gLOWyjZ( zVEPdhpoPb)5qdelZ!oVwuq_D;q*Xq*;WPDC+37wO*&Yb@{98obbg)lHBn8L-wNpO{Xc5%49uWtdaYs(S^ zH@824C5(?(XR}hAtX7|1+s>o5`av7Sn!#{;L-$O^Jpm%fG+vkKhvnC?5anssRK+NA z8fwgIa@2;q7o+OOap7W=Q}z%qp?}0P?#S)vRI#&WGGVtZ9TOI`hBBwONgU&|{JnAy zftg%qe{gVs)=dw5AzY!09?i8}`CO!QjR{)`%ukLYyzPRb8Vnxeeb=7x-rZUg5vDQk zZV6zDI-GRd$;$|t-%09?Vn(BRH#73%^OtIj z#pfB$+>UO$^~%C}_li`}OfDlz75=y1E}fB!E$HLW0)Yw{NYi z9-SsWg4e+?r3lt1kqDf)W>$u0xX3#^&g2sjbw7?m1w{CL{!B-su6MFH8%|F#Xx9A% zT9ybkb74F6Lk6NUi%F;UHFnA1piSOmE}O1w*Bto@DZE=e!ggLttE#Tw{xz8a#Cae53Co0V%g;EinF{H2Tc*0McQ80KV3bLNfO>84(0{q#*<~ob2Bkf z7ZMpOC8dO)H{x@-B1>)P=Sf4_GVVDpbNX3f9J_s4~u}KRd{$; zVZ>y3Ipq~Db;{8s&5z+-iKAWY_!RVn-62fwW4xP0*ai93mqi;$u0l_I`Trf88Wg?> z&Q)LGYZMgi#3*PycG{Egy^3Zt#-KrwEK5}6c_jN z%_+X0JnWCcp6XGTcMWta@#|R_*EuaOLERh?9;&3Ga=$2K;}ElrTrdc1*K|rAYAxlv&ge5AHomlTbL+kQ;YSjGGEr*MFC2j=!-5Jr*&4>_uI$bzhnx2 z>R1^Vq+8=6AXzKFUexyE$B)55P_L++ot-tqHob6g+OJVz6d0LJ#z)?--hp)j22Lm3 zOP%B(y#J%6<-y&%OYPx|tjg+DwhiO8IjUz*Q-D>l#)=Dx)3D*`w@>Z9;0ZwpT(jxIF>ImdV|$`|NbQr zp(drk0+apwgIVmCh;H4y^|ahtxO$z!z^ECtT3))i{0O9If_QTQl2hm1rMuTInZ`H% zd0U4;14CC8dh?r5@_d5(eD@x}$UE=vuM1WObr&}w^E3qLlE?n$DDMR-hmw@UUG#XB zloa9TFEM;d(!uHaiw!TqFYbngg~2@l(g7qSB$C4gz91o}s;N0qq`UrO9XmFQBN!0R zC&Br!Yq>w?I(9R&4Fc1FieFNpcCK@9aP^1R5NEa0R7;rJWf8CHYJb%yr%(n?U$tz? z5eSJ`HGFaf&WkQjtJ?48W~mo1Hn)~EBYq1dO+n80*0xjyu(KG>nPm_{?Th#^zuAqO zp`aLk#ZFS=xPoKPo~of}`|dn{0+H-9rLnT9MYEe@By$Dq-T!pV87X5iFe2r9N0NIXG}*Z*^3j>+u^w zORr>LZ64t%@woFhwzYk;GZiZ{IN=OIlk6f?J-yxCnl%RzTh`}CRVLJp7DQMgmKRkr zK2SkvZUTx!eQj;;CThYqH!tnR;^Qodh`Vit)m~?8@jLwQn6d%W^{7yrCwOGY;pS-e zygE(GE8jZ%1HSAZcF($qS0~+7rKOt&2LrHs5&L?Df7wk2+-^R6nDkGVjQScLeuI*- z!~P#0=+Suh;oH7o+GPbX)$&rXti6oqx*BsvSy53$SbcYAC4Io-EGjm&BGKiYvcHV zvcYZei6gl7_SY;cRNJTcGAvsS#eHFg#=`gi4Cm);<|GMyJx}2&_?)a|HaCiE zj)5;5$mu1?_a^hCb$l+U2Tv}dWe39PkW^K`+HZgwzwa5qi%p3 zOt!wh^k1qI`S%na>6<$%{6=4p`5N@#^xI+|&Pg41W1@1qt2L)-nZLWS(YiO?vJ$4( z*InbHqg4bJaRiUE8JToGWVBxH$LCu^6|$Lv(MF|I5wlxYegP zc;?N7o!u#}*xVHR>LN~>!Yu=SlemNgEe$X!|Nhl0pE2@-K|z4mn|}T*JVoN!et-qx zT$_rftZY4YVcPA`E|M1cJHM>7Ci&rP!NJvXVAs%CwHP1CV!dCGGVQ9d=bTGe2xvbXn@SuLE2*l&LV$xTaJP1$qCZTo)mDL_X2^IhLG! z?f<|yS%!mW%nDcBpuc6-)J;r|Pk-kQgc~M^DLSXuZJ}jPs`keVl_h|p3fe$f$->0s z-XGL*=B$%ewLJ`uA_8-O?{W_$^_=YGO+`-^0q4fS!8g!#u-cxR>g$t)L-7f`zat}g z;^W6B4Tzkbe0252Els@jAB)!C$9j0u5~+K;B_-R}6ViSOyr^-&{4Pn|L7{#`NQJ!gx3)+!R7WvaoLZaiohWSCc(eKh1kExTGBSt|BC-#|dnVqRW0C^X&K8Kn*M zElXU^J3xFNIY32z__{qlllEM_QAG%{@**lKoYd4_moNQKatH7EGs-zeaWHy})( zA51TU6ENcJ&>!{#$Ifk!Cp`vG^sEjh5ju*!iBy znLr$MJ=?n`7+;^ee1j$9?d8+F931!XD{TOeY--b<`XH?fWK988g=LcMt*wFfixj?6 z?0ozR@OOx)7m*D()?cBB?d3{waZw=Wa4y}8LMNw4@J0?3kFNfg^?!rcu=94CYFhq6 zzlL3IRFZ9HXVL5y^X{0F@S}gq6(6esdUH9@TuzsZxc?QMjS&;Yd}Xq(U~6h#Fw*a| zl5DDHx#TA12j40Zr`5mh3C9RRmULd0;tx%w82IL?;@gY;%UT05Oo+oht4x2{qh#?t z;(8n@{*}G>NUB{6bQIg*pvL5PN>1B)7o|7yCk}_fSu7q*#jk#P1S&=y^FDQ2_fFEo zSPh|e8~(q3*OgcyYlJ+WQEey}VmqGzK%MF(mZG9Q3frtQG8Fiswh#;p7#|Q2tb$NO zYpbF&!DX&M8R$>;o&Nc(5`@~zoR7(dm5g9oV`^m70|4|cV+#~)M@y$SFs}MPM2mQ) z{nnP3z$pZj~ z!3lsnh>qxe@ZiC1Ql1l7�@b`>z1T`$qJ9!IPAy8#&rS{?KX_A0xb+oJNeI7N@(9 zH>VS4X1)>5HR^1Ebf1HLs+G@wM+oK4GtfqZ%3-#pUqRMj?aT%cJxF%k+-3dUN7MCp zMt)C51O6O>5RyrZEbKgg4aVU7gvr3Iy$7`6KvqA9xm zSYFi2O(lO#PErI|q`S_fCx1O@~-ZR1q5!ul~yt;Fh;j zUJmUJ9yC&}F&gJ!d&`#>LLYb|j)Oy-xGoScmB`}W^YLHJ5onAPPh z$lbk1z_UF!YBtzx^eYgP)BCYrbK04~@0I``P>49ARp-{HQMXWxV!z{am6b$zt#Evs z!`LC>L4oT3>2or23IV)!bziaNIDTTlz?>HC0RB!@f^O$#bFydRa0C? z=bNI*+Kf&LlHhsqA*^j^0OBkj5EQawW4%`CneYh+5)vqu`ZCojqU)d@9WFd4VsBmc zBrQa2HPJfV#rU@oU2l>p+gR)rr#;{F>w2-(x<%i%D!I}8h^o!WTmI%w+<P;d?GPCj9etyl@f_bb>~w)N&qCnlH1urC+Yd=e!&qB1Ilk)Jt#}K zB91CKKC_kk=MR&%)*ABWUwqC!UEUu61*jw>HyrPCa&p?)?Gtm_%F4^9j zenP^Xi$pCeCDk-lR|UDhd`)6=W1)V2yFJqT<6=Ti&OVG7Nk~R}LNB(aAZbkJo2@=I z`Kj>X!$Nlo;eN)UyL-^i&O8YT;~iTe^L3KyYGW8fx5b>F=ISnsis;<2HF8a+UpCZH zGGz43=q-tA?IDGN(Rj`r4^j(c6O zu{F~i=jCMp6>fXfa4H++H8Uw6aK&$N5gSDBSU)Am6f=-Ahp(?%K^{>BIYaXo;)R~>2 z>0vYe9SDMuF_;yJ99vBzXrg%SsqCgpiE+d1PNVPBWCsh030w|~a(_gwxL36iS12}t zkTd*E^jbHJCtQ*)lNa9|xS&JNI1iGNlS@lVKr%XhVqY4jzJN~;7Mc=W(4SGnggd0+#!v~ewbX=7; z3#?lscAG^`IA_;zAphlX+Hc?oylMOox<@&{LIzWKv7jLeT^c!TJH4)6mrI7tUtqez zHVn{Q{u|+;p#1)2++PSnq|T%I4))fNEIhubr^|1Ev7LpucxB3bghtP0J%sYl>s{mv zAlrW@MGOp;+2Qk4O%}Ffyt;VL{7?~RqNpZC;()?Jugs??>%V)7 zwdI1*88r+R7dpSs+pLf3j!MKlpCK4`9Z1uVpBfMIZfA5^Di2V3*wvoZhb)8OGalZQv;LU&m~43s74cT3St5hWbixZno9DM-AHDHXbq5f+FE#Vqc=SI*0s=sN8?7+!M1YZrg8UO-l*-l0D*VXpw>_+A3L)4(4zqrseX(T7#n0J>PZqEkg-U_%? zZ}F$)fB#=!Ac@RqROvUWz;(pqDrrE~2t-hL`~>*;7abXx`)I(m@WDGRHy@`#COd=F zG?}Vm2bQz8=;i5d&gTk*#LmJtFggPRb`~?*+ZSi;-vj78TXZZ7WmtKj%q+9E7%PAI zf+^c|mA>}m<<=n=W9aGfJ8&zFj`j-(xZ+t8EP{c7{uKs~gP1oqpy_E9s}vEOv#l8P zi}yZI=Ai70@}_>iNDKK%T}8HMSHtB_Zc!-MQ083*LKKvA?Q=H;gL}}X0gMFt*d|n6 zlCWoq>r)4KlGbIh+>@b0*xuDhugseF>z5O(keQ&8kwbfO>-yC~nG?^Bc>)4R z{mZoXzCx~%l0q{=pqOVrT1LEfK*I?e+IswpZ`2R6Zk_5xpe>1tH0YWDs;vKJ-g zMXbyK4G_8Wj*`m6ANQvv!!bqN6d7J)y`f0n-L*O1UEbA`nBTMqzTWLS6~*?Oj!r!O zULdrEjdK}UfT9`X?LB#Hbt=Fg&vU2~{OObWcqO-!6LPy>2zT#u_Xj^eb`VqJb~;$8 z^#-BI@SLBCzkZdcr;9xLr}eBx6wTx6Cq7Ziz|fFpUFH%=>VKU`XW>GtE3EP*O`U>? znM`;~KcUQ-g?wl+IpvGr&=E5@v(}e%+(`Fwe@$g8@aMvP4)2+RT-&( z%nctt?a67&R9s_YV{#D@5ox@W0rA8VFjD{n_(Gdy`O7+tk9%pTU=@qkss4hRRG`y@ zYJMot)sSNM)_Y}ZHlnpCAmCXPM*%x?mx2u6#rH)qkOU&|NbxK1tQ_~oUA}hp%XrE5 z!s&h$0qeqPjLR4a{=WOFb+}pIuV+_3^?{|)fUlIieEY0r7}2HyA;i~A2Igna{&jcL zFe%K;-oJP69?iY`Ci7Pff-Gg?y&G#wt!iSz8yquQ1_*z#nwbnn*G%F_iEs6Oc}ej{ zrPOk^uiSx7m-!_U*+hO~DS`X5aK;1}ge6x%>M!(hJhBJO8IGvb6lzU+>hBpR5VX5f^i3I$K@RN(jW2m=1jJ>-=%9HIuA5?5;v$;RM2hlv6hu4sS~rfOlW_`mXM3ID#$X=@n9moG;b@bn8Tk{KqoQbx+T zwP7Z<_pTYL>Ui)KBPDe0?QMX6^x*t=u2@CE#R!l77MG1t4XKOMXlcQ;AF;6K?Zb&c z33-@1Ws6?R^#0d}SFt~~006=lPYs8bBpv3%Fcvac%m&k5wvKQ9E+FyrfP_R!RaF(P z*yIP;dN%qQ1Mm)>E#uP<^=UFG5WbDXKvBG=z}V$@TVgjKPvbGR0l|ZXu%8c%jD6rV zZf|2iLWHDcaCD_7_A!(9%YW?Oe@DGeSbQMjmHL?18{%sA<6t~y)U&f|A&gONvs26$ z8|u*CHRyAquo7zJykKJsra1uOSq`yqw=V$;B{lN10M3NEmxy1g5&%J9?7n@-Rp{2k z>A@co>EsPP#y^9g&`{OV$ACGnjh1Z>XZOVk(20t6gZQ1Sis= zY>fLeRmxub=)v>gwwzgMAa&8#)MR!l-UkV72Ksjcn2kIxE}&*04!F5GmcJR-ScD6+ z!{OE}s7#QfWBIQD!~PD706%}2n`kIwS+TXkXr)9`U6S$piTvi~udwhBex=$C;@F+$ zRhba`d3dfFiElNK5|QvY%}jTn`)Y`)eJD|dD#*_-wOkb<8)ax{a7Z)Qw@aoz!M>HB z|Do;npL6OaiO1xO5|93|19wKKyRV2c9uN#Znbkon%hRI@I(es=#X;Xox;L!qDjfX2 zyCgy$@R*X4`37%^YII0ZKCunMwrhfCb4-} zgzM&((W>z58Hwb~&p88Pf!Yg%q|y$i&1yNIoEG*Oea3 zec6|zpiHpA(9Gruo(~vK{XveIUcMx_Q56o6+My$w8>->62{)|&(6gn-0g57zLrhXq z?T9&HgO{WYa-xCGfm48_vqJvC!OmFDbgH6>nXYbf7TZOX7*lVpF@9#Ek77SRIH1@b z@!Vl=1uY<;(-SKO94dOXat?!ND8Ag;{kAxWV}r9D1s&tDzPR43xQ}4_0~L zWI@BgFlp(4OZjbj`@DoCxxAcU*`V){fLrs4$S$WP=&1(H&m?J*Ekz%P@NB!Y}-rzd&XOJ<m{9^ds= zWduiCeRKp34Gp+VXmJJ!v9Pm~JkzR$bvBUFRJWPFgra?)U_ZEZ{h)vq<#$t055WE+ z4zEZqvfHw16bBbme&%|fpwL-A>C9%ape)F9$jK#fqyX#!f;YQS*O%m8z1jr*EJ5;D zQ1*dX#AasA?fl)Pr^`ZQeIv#yS^a(&B z5aBUd9}AR8@pE!ZiQy&^5@b**{GFd){(+2^b!R059RV9+$RAY-{>=z5reEbyq3LpI zWV{CNIx*+xL}^1Or<061@XaH6f!+ErB{`YapGqto&goYlADD7tcIM}l+9eBDW_fs!lm(hHPGKwRKVEM zqqbHM)03Q{1E^(Bt>P23ffx$%k#>7~whj(AN=wZT_Mf^Yr@_3Pk?~2q^RYNFFG;0A zXDh5b(VXX`Q-|WjuPLejnmrTt>FJ!I#!`# zKJ+CKdOYM9K^fWzdoFbm5%ghi!cQV`X-K)oMvYDPwzZT`((aMuEI5M-X7@o`}ZiTQ$Py1*t#7T&4m8s^T< zrx^J0Yok7*5)%4Z*Cp?hl6J68!5xATEHvS`BqYytn`ac*mSr~&orHxw!FrVP@#9J( zSlyll=VYi-Xo5vxnmW0>EFdWOkYqh3d70G3L}$p^`KY+0bdQ!Hn3xv zMn{t{WjU;=zUW>9^9~S}aSN*kFUUHdsvwahLDrA?8hLtcpx6PPkhH-fa9|zXIH@8+8P)!ZPFjF_`EW8)JCa@{{KTy`ituvZAA7 z$r%{wx~p>XYPx3fgBN5rnA9?;m9B+qd>(UgS(&I_bKqBRF$IEsKcIJ{G&Uj;=ztZ}6tlc?JU1oO+g*;qQ{=jY|dkb~*p0wTYwMj#V00lUjmG|8$*9tKX1Aui|e zyLT-ub____kiHR6{Wr-DIWtvHe!ydj9-N4aRnIq?{jJ-wrIc40&2yR|7E#H@R+sgy z;9u9&@iEo|097|8^M;E^@1S$A+phdU!@WsF$R77`rhydo8`1t^U#91LTf~mCM7i~% zw4osl&hFZ3`pK+~&J5C*R4$@v2PJ|n&jw(?zRck?8GW!Chx1@OUa6)g{us~4e54rc z>%wE0*dV`Ie2$Czl%3siQLyz?SD%f49_O8!CUy4|#_o)Lb#1=&(DhJrVRG`UiE2CW z#}Ck7URxRxeT03oE;HqFw1`h`X|c$mU2i=L;Z;0&bpLpL`QgKruvZ!yG2nq66A+LC z_TAt=OGgzE7M7`8&^0s^4tV08My1m%bP?c10Zr`9JC^u91u`;uUEMLlf~vtHKC&H* z0g7IAb2o2(6cRdux>ZQ%=9e!YfeZrMssRBYh?Nx=7abO6p*F_h`la@yCP`9OM|alg z{4@lBFtM1me(AC|HjW&rS0rLpfWf=sa7!{fOT!;Xr7mY&<_nS%Kry3S0#@#mc=4#S zuz%SaOd%APfSoG`G9QDpQynDZ#`=0N=;i=fHHfV<0TjaZ-w0}Kk$S5r_A0Qs6&5!5 z-{8)*9u&HWxdsFtNe+*iT3T+wgXVSII{?W-nD9^^AhR)FHx3ce$`tca64vHnITp_Y zeM7@OI1!bs=4NGZB9PPhryDJ85uqxI@5h6O(5@@P(1VaI{k+MP54!jdUXu__=NgfNpMLaZRRggzHt7voat+HpS5{1cKeG#q!OAhqk3`Fri`?gACybUAw& z6p;Zgc(WtX2yQ}8S9!i<7-zSHW@Af%(dB%*>BxvO4e5`jnY1*JjeZILySS)CKrk2< z_EI7yd1f9T{^{H3+S#>vP5!B{@QsQ}Y9_%Kj&vDeK}wIye5xaW4`C z;>qKc^6Htp!63EcgbT!EuH)Rt!&@KR#>WW@3p+U6rHaqb{{>aPS7UXx?H?2cJ-6}3 zMg#Jte{piz>QP<`Lj{gGId%|t$JNEf+kSrS&(lv6WYzIX5!8As2tq+kErEAC2Xfqg zntlqCi3lfz+x-Z3Dq91oDC8t|R+NSS>Go;_dVZ}}rQpuYTT8`(C*+WP#QaH!y%qr4 zC^F}LM2_XZmZ`#tEoFbuE9`&QyK%To-v`e&okGC#qmqgWb|)N-l9EF~R)?(*#KbTm z9Q{~aUS9siE;(No@1FHHFR%om6eAQ7ym8~T<9_sGauBM8g+1n&2ViKHdQ)7i?PNLo z4S8-+5p3>?2?EDxzC##Ss=+VQac|{~AXr?NTg_j=0spJv>gq3EpWOtkEVpE*Y0f7o z#UD1Cd@s{(coz1qes)W*eMjL=0+*DYUVCSPX8QWZ_IwFcnNL7V)jK0 z+k(Fe@+VL9msmxNBaWM!X+b5~PX7E7DnLPD1Bb;Wk;iudU5DNTh&3R5Q;5rk2}c*e z3zZ@>Vm70oExQXU!M`_3ia#H6?nQk1L~;Qev}dVh08qK~G$#viv%3)Y)&LX=XL|+5 zQC_~-ivW4s!_hH4YgVRHzP8K`3@D2KeEKsDUt z=_fwpsai4w;uP!QEi`lv!iNtzz>E(-{SEtd1e(#_$|fL^MJ8zK`KejQ4v>GL!loiO zH)qmIv@`EtSojHg;>Y{b!-Y2T?I*|U7_F~jcq+o&z#ddkC>jgxl&$ddXL7wnT~SBfYJUQtZe`IQJfoOyz&a|Lu(JcU z=Uf%R8N-1ZEGvo&0_IAG0p5yff-}?8dOC?3N=i-iUF8le$%v51NcB}g5LJ3c0j|gI zk1Qo(C|M}3T&W5BJPtGBy*2JS>m}qjg4MLIu&wtCetpW)RbZ@=JYhHSC(Pab9{JWb zQ7ruFyv+c)-|mYN;)^hBh}g zJ|f2rT#CRYBqU@;?TF!3zyx)<ksli#GQNMzoxq$4T>D{Vub@ z1m;fr>dww;@Xwt8;+^QTiRzr;BD=$5bG{n%rMLZAXT3tO-Fp2hgGW3+J^T8I98jWj zs7q+HaczLb-i2HQM08^Lt19#RSIFE(JM4Es+R7%v%Wr5Rh6;Sm=Ys?ywh!%P63Eb zzE+(uoBu7^kSH=olLpSk4N2VxAfqnY|Lc z|JCk9I8~YY-V?#v?yk%l)yqeU;yMH=qWAUDX3Q&UUNHtXhIh z+}ygh4H8Mr51waL{kjro(btEUq0sS^mGuGh43WA%Ef%djeIDYp)f*S}_$Yc|$VQd# z4?zj8;rC#$Bs&V=l4jWn;nz!kHGS!ZS_f+<7=yya1V5gO{BF%Ob=$3Oh=8(DvRF2UXLNL?)z&BQeyy+&GP=q0apz$7M;YLItp&ZY*~j>buFTyXNJA$ntKHBJns-8W|mv_d*B;Whl31UDJag4 zRXD$UH&!mpMMozZCn=jTw=z9VCc|-$RaA6aE+aXVR?c$Z_d4t{(%C)Cl+8_C{6-Md z7RK`I=?4G$7%mAHb$C@j`}60Ey&0L=>)u#coABO&-&y324HEg#%a0P7gTJRcb||A7 z;%LY4{RG+~5{fi|E+4$fxVgELrV*z{Z**Vs@}Bo=bngK&aOH~d)vJE=8kLqS108-3 zU(&Lnq24}N_fF7l3AxV?;aLp6HZd^~E|rJ7`z(FRfcvx6vMYwd@$xe4pS9vAx`N-n}ZV*7DvAI!oymkzzHK=?gr=*Nmxws7F zlR7z{ZtWuK2h?j9a!WB}CD9L$P<4pBOgTj0E0Mk#-gVXibCcGA`sKt?GtEmPBH z4qKAoCdHNoN}`J(ipi8snH^)&UC+SEO8erVlJGgQ*PpphdTtco^YfWA@P%28dKzxt zJTh0cn*1wIOk6iqz}tj_oeNYtrIIaSAm!jtBm<98bnV4Zb4`s+ck-Z+P6iKSGUeq8h79wn>ayJ;tZyNRo#?M>S27gp|WD*=^|6(h#$=TRIdsKoW zAtQrM?g|A3MN(<(%-$;4b+<;a=#RneNFqXmiDi|^;E#UKl?wl&{R{;R<>C)g{aM^c zd#6wl@VaBu23M!V_yz0{avybPsX1CN^}ye#jo+&)DXP?F`Ka;+o$LpgBnM(^flfcH zC*ksghD3p3w{kiT;%IRmcGOq?#clt5HVq*TM2weudV0=pqut}iXEaeO{vZ-eJ3D@u z8sK0^CaCqW=-R1gEq)yTE$-kF>6j}m7q5nooBDtZKbPtN6aW`@x4&C~rWgh$CJ4cQ zgRq7CP?uwpaLul$4mCCH?FP1m_rki*{x-%BCL}#MmK|E`425-rels2G9V;^Tz`)Fe zgtlWw9>+a_UgCRl$;nSbn9eIzUp7c3Ac{Xsei^aI4|a2FgVzH1q2sgBN`ge zay8P^(i$nVD}#IlnR<-99i(U7vElsnW>mdQ7ri9~;Q8X8{{HjLX>2mVJUx;xU%tSf z4uYqHpk62l*)h>AHde-*Udz~6r3%#3N6Qe$tNq={&f2=V!GRmIEuk^Yy18+a=jsw5 zMxcLQrBDOvrSci_a<>A4f*yD5GIYnyS4GSL_wQqk^nJf<@>4i>YK zlt4b?ZPyCY|# zp=9BHGT#9c(9-iq*87#yW&6Zc7TaUXRy;oGwZ*?zBrdt$uFBN2m?)-TfsvV+nMZX1 ze@!ZGZnd--2`O-!FLF9Px4iS6M#i-K~44v`eU>J{;e<~^Q2Ibn=-;jwTKsFwz zLgK#0JdSvFlYe&uC>$#+#s&udjaIbB38aA3^L{;p9lSo*zQeV$*Oir29M%SAIyyhy zTBP0uQ)}j1FXlhfMu4&TQMp4P5&OxTH9_UK5)v;FCyx~R3CEp_Qtj5!K*OC@pT`4isk7|%F5Pp} zq3=}_{Nca*e`~q{o6LhB6eZK733Pa6!O#_64e%>o!?l!6mrfF?*c^G~b`z73bz>E4 ze)TUtB+2X6wZt7x&>iXDH(-i*|kPzyLnzL%RN*YK8NkbzMdAXPVvMWhqr) zytgM{I#m4nb)9O--CtwC)1C%zSLdyoy*?C-Da-209xB1vFFRuo!=s*MY!9 zpL+hyVSaM5)M5J}F77msGv(1y^mk4_j<*6QAj@R4uI@z`3ev-%D22;Eo&7sOmX;VW z+SOGJ^L<^=gaGB-k7c8ws6b_hOyE#9iaKG#Arf2}Ah+jUiiLsUGBwHO)S1hWU3Bb@ z4V7}4{mbH8$X|PJc3rRPx)8gBBk>yb2JehtMMZ_|5`4$I{O(`AfT3+mzR6%N5RHH~ zap^N*Ie)av3Em^REgWE-i-PV0K(~@o@XnrD{Fv_Psf2vSoQbyf;hun4L@6Ob+R3R~ zPZ^RLEcq0Zln1=-gJx##kqOp(A!Rd^R#+4KhY69;yh;pG<58$aJJ-jZNC*@^Gc$X^ zV=Lc$d?msh@9c1%r(`-+X1sFs&Ye5*StGFg06PjWtOS{B%MT2$@%25W>DW`RTQjjV zLc+uQ^4tDxmQ|V^MKuAmk3gr-fL%lT(c#lWJ!&M zmUeEv%G~i|X~niwl628)pD$-;R4mNQJ!MGE#aKhw+|b#YDdG1T7_cwN<2wc=M+U{G zNm2>Qfs}2V`@A%E4_Ehk6>5b1Rv=T80;P|}4zBa*qGDo!XA^0TnUv8bH^gEss2k0}c2 zyV|+D3dkQ41;r>Xh!Z9M8wi653DpCC87OODfG5D;vrY6_t8RE0Cd5hLMFGlR(HBzK z-({jW?$3@3UE>@386G0J{<*U96TerXX+-7vXApLWlxMrQQc&+}oMC4S-<~f4S_vRP zG4rbPMbiYA=IKj-^+0=1+IEt;-;8)--A$}DBTY?qxIzmH^Wz9k5#bc-a(c@u1Tir8 zkwW}20PUY=0L_**xH*0^?8t;?@KD@ ziBrU@S1H-5l^4At5o-)}CHiXuMv< z^{=y&0LJ+0qHsBvAW7l=FiOTD&j;ZcAA(W(tG#vtDd5kXqdy*sWUG=>@~ zFtToa<4oev_V;X*_cN!}+4{l3b+X!Gsfx4hCx6t-?Oz`GC=s!fHuB`@HpHckGab%) z=HT)yQ`vY^xf~C-mbmC>{I=@oBt@uOY;C01-{BQ`_wLMLkC3dk#OHZP_86JkhnWKh zvf8~-VPFoNV#OeK^QX0XNy~UiyB*hfBvb7M|NTpa|LfpT;xa*~ zrZx%}0whqt-XU&m6#0I4kD!$cr0QsEZT;%&8_J3C6%)RSfQ4s!bMq&==_bf&&iW;c zD(4&gHt2kg&p7hn<<_yg`(uc6ug=eiArsQ{{Bm1|G3gihQs~9+eYMa*+)U23hTza|1kQ_|ML3Ofgss!|J6b zWAVQIS>pkIZsy!OYbQV^`0VYyIikTcp0nBS9kY+muUdL{ByK(wuw8yH?&E7owi-1@ zY#|JhTP;}H#Ka~Xh1>QTW#9lnfARzSFSvbOoP9|;WV!{1CmS1^q|Y%x9^vETgSLFg ze35P|NMshakw9~-A9iY?KT=+M0l(=0>(eLv_LwS0kVvP#2WyK^ON__AzD7hOx|;<& z=x5NsOGp%9Y0S;eLN8GbV&O$5gOU{&myOM+H{GHaRFXIff;ew|CG_BbW;$fR%{}{# zpaq`r$Gx2p&Hz9(vX7dBdHqOEYbL5SnAAAhMn(kJ1P{R=6rA|>NnKV*c*=zlUyz#s zV8;Ufgz0R=D5hF!l@2Bcv#Fk+?yI6!ZGRrNBYlgS6lKC&-cy3n-*3+G$o;{y#N{6j zfl0?cA8odOt#3B*R_{~2QyVC8-iEIh#Xmo2^U`!Hy+tO3xoW$5M9f{`GTJ-0I%q$i zJSe^1UQ=O~qOO5XHbUrZZNGjuxS8)(XM0P9%J^G;FF4^M#D6zs=0!Uy?6sWh(33o{ zqc~aZ(&k277VL`Fxs;16&STGr&Bs1IQp+>ieBPTLg3terxRd2E>y|TVXUjYm?liv# zc3(S#<@Vc4m5~FicaRXNgGFFBbp;Ip%x#Hit^m#;c`)Yn2@dYf)or;@j(0t`Jw1v7 zJNp*cu|>Z@OdJ))QuUChJY`5>Z}-kG2uf*&-dGyQLK|KaZxyc51!g@X1JZHvuU$kM zva%TSk7LQuJ*Jkkg?APvcbBs>fMY-bSy4Voqy*@Me*O}mNuB{?yOQY{1@O*-`K0`> zf$*5ufNb$TEkftBm{3f}z$Ra7@~y?!TrYpby3!lP-M(l%W~r?SSpn2Y z3|y*7Zl3-%9@rhxb*uXrclnXG1?+>JMk;(0+`9eMb8-;g%_4Z{#7n>8ouWS-sS3^=Gqv76VCuKjhP+WT4Skts zYGr=IrM>5qHFo3ZSgHNB-fqWxrd98&k6<9u67{<5<;%e{5LyyRvi##pGjz7!KQfXi zjK#!T72DuXk;sDX!JpLJe5j%|wcQfRw7ifwv!wL;Of0SS$MLyJEMM9?kiO-Cm~xVL z9ECqHsQeaS_XZdHw25IX4{SCy+M(g#kEc$fLvl$#+^V5{!MVFO`NaK&^^8f9vKk)K z_>Z4IPbPJ3tj8>BRGNMy2h)b&@WUb^2H6_-t>AWj{PV{mNx4#|g#2C+MI`8CrFLd= zm62}PT5}`3gzTinj^mrZeqo&icc51kXx!4&$gJ^1`m!N^c(5;+35U8yQBl#hnu(QF zc1>_79hjHULeeQ@!HtJ6IujVo#VjzA3xG)8$n@f%+Ly?VEhiUJCe&?m84vMJM!LIM z09HxxehgpE7hPb``TltC#$}ybSEnDdOA7X2&B4Rq_CsZdx2mTrXW14`5E7#2hU!90 zNchAq(&=y}5cU;5LSOuSOpf|qax%?Jm*EntmgZmpoY)(C^S+)$e7bUj_a5h-+%R~l zo2}wb5xblv2}NR0Ss2WC_B(7mJ=x`dUnnjAL_b<`iP{k5q2IA*6b+P!;d3VoFwf=<}Ro_b6ApgDHl~d9R&K zo1ZE1G1q-`Fgd)2d|oKALibL-L$9(2ZtD=ZA>o1UJ!HRkNz!+K+S%V9N`~}wKtaiT z>T*^}>T;rn3*`oCNlEWBX6f0Psjv52UT_Q@9NsV_M^0qFTY+<}O7VvZ>k)t-;mdoL z&e!Ep(d!!nDxl>o(ySR%%9C$`69{Dmlg61FfWiRA)YYFg@TLE4g;QwU-v`Ad4vxh3 z#*V8i3xf)~EcHD?ubX@k0}88;+{q7T15;5yne!^2oolpD{0qnR_Sb&zPCCq()p+nbNM>*5N4`?;dCUJv@A`ULePU38GyR zeWD%lO6Ijwg@;3B#p0Q?V7ZQZ)wpN61mNs`o;U=~=Mi~=YipRLYtVdYWYZ#T{m{=%XV%qRE|U?o@jVe%tn^xn#?V7lip zD4AOfOW1V&v9}rl9Wys2rTnTUJVV!qL#4e{GAS^PA}zIJ5?rIF?gMtGw$&(ghs`Z<9meM7uVRi83)+;}fnao@I4N_&u zG9LGr#uSQxaTIVA|oKhnEk@gE+_x3P@{H0;(E)g2epl>PV%!^-)yX| zY4NMR={eQr_hPm=nxlGvJUbv2Ewv$#_4Y>9#>NM->o=;Lq|;=fyn>$1*UNr;-W$Gz z`f-*jT3>f}Ao5an^z|A2i)Az&W|uo|hBgYmFq|zTW;^BJz#d#Rz!^^Dzeff87i|&! zBD#`>QhB8}A|tfBI=46qUmve>2dpG|k7H{|E>mvy0?n1~|4W zX?Ltb81VJ^C2zn_0MP<L8fQfcN7y7^WI5MDgd*9dC@6UPP28uV|!FKGZUoWp_L)ezyycxdkoZMsZyjF z&V%2+-R7-&goUMW?b>N1Z%bcab6rw=jK=q&ZR8sv-PqEFS(UzyEzB#(1su-w}c zfh+vCI-$Jj*YF>xIzNEcV75Je^dYe+9>dYmP{A;esY5tL$L6|&ktmBjFfZ;{>fJ5f*X1t|ywr*qnRwG6-4TMZ{IU0p_Zg8`>M15End z_76hB!W`yC#=C;0_nA6&c7k}th#;@nPE8echbAW`qLZCfS`E0-(ai3jI+#>q>=dS`oL;aU|F+G! zbTl>btPOMzEiu6zX8vq#%v>6>?2@As^PG!UgRyxGN!-$SmzoCu>q{tgXXY(^4i?QS#ru^(^hXuZ%{PMI06#9ClWp0Ci3@ zZ>1UE_+HnyN)sp*E39nhzh8+;wBsz?F8-(&sFL9CjxD|4QCoYE*IChlnnkD7C3{P% zIeo^9?A)mPCC7k?DoaAL=xZ`}zxE8rVQcGq=2Wc++4!Db=hH+;U;(F9F3)v;25mHT z>r1c13ee?Em-MC0P0yYkkwgDBlw$$Ar?khd+l|JPcF?uTaZ#e**dMygQNEJR#3;&5 zkfaEogK7NZ`zNrqGlQ8_2P;P4{gMZLkY>#nIPpyvT-fvN4Nbt>V1)Jv8ArO)<%aL0 zzlPyKZ>1%q)&L59P8*}c`id7XH4P2dmX@a0Nm&oZnNq-;4kcCL{e(xd*fJU!*fVVo z>YvW~T{}TFU#I-|v6)6@P9pM!W8be$k)*5n1So&LKuO8yto<#m7VTkpPNmDw4pd3 z`uS*Ab+CMf73;of5y>h{%d`MR*=k3KvP_&8K&pp!Ad zOl5FrXlZGQxti%59(qDbN|EKP$i=8@LZjX<>X{X#M&cFfHK2eGWJaV=)`vlEqh({u zG#yTMa4ZcCJw82-gUUhL4yjwq_a^TbY;4W>FzG?q5xBKkzdFGe2Xp6y7{n1h^+H#z zcV5_ZC~1Q5{@#`)G!cEf%XTyEKk(gd+PoDLgMmngi+b4i?*QWRLM*|1!-z5@sH>$A z*J%JD+b1JXL#Se%nNx*szrH|(bFgxBttB}-TcJdH@cEGQAh5s#6EZ~$&eQIO(+IdHlpRB(1^~n?I6s-|o$unVrRHP_$sQ!+T_x=r`UJXnnF}Je1$b zW-L$0qW95Y!O@t(Lw>Q#Hagl&rSPD>fy(KinL@Z7$_aL3`KnlC-k&A9{hZaR`JF`N z3a^}wF1X|IRXCkZ>^Ekmyu5YxE9Tk!qML8f|z z@@33=LQ9)0oAx7^E;JB&j>c?3G>U@k!;?cFD~Qnl;vAwC;BcD^yV(_2H(1O5C@vUk@iepIGWQvFYoBz2LI> zP(Cjh89Mhv{svlaiGx-B{uO&Bt1^FDwnNoh7W*g7kOVCoXdd-nt(0)WiBDkt)vxQp zFAOl}#m^;K3#F%eIZt&5JT5qWFApoKu=v_{SBL-WY+U()G-5RQ_s;&Bhk?Nu?1T=Rry>SL9Z4^nT8`mTK{19i`9Wl?%R7Kb5T|e5}7sJ>UUhFcQ zw*={=T;MNq*>Ch9LA~}L#=v#^c*tzgf;YaehJDYPhMT*lyF2r})s=tD_X&M->AMxZ zeujk}<{&P_`P-W^7+;Vq z^n0`rGb>$Un5?hd(*PYr7N2b{qcj=?xAUKlISuVzSE;+qqYi6zb`L1 zIZMj=!LrNT(z2P8>4oh|WS*6wib}>+|C@Ye)JAp(VjaJAlr2{dE2f#d0%zJ2UUg7p ztMQ)YVgHT$h+jrac({1!;`xUNrp^A5k&)B~hM!q$%^`eU%$=y$0NaJMV7oQ*1X)>` zP`-P>YCfg_vy5;>5GCSElJ1AobuJ1(YeNH7B)6j&@x@yy=W=?$4hPX<8i9^p`q*7E z?KZ51&0^k2jp^Aev)_z?{}2x+tUK8kOg*3mj5BB}))PouJ#qr{^04k6J ztTanhOW?xL7@1jND0=aB8kb={#_uH(+}sS~u^HKHbsI7Ih~VG?fGD9Z7Z8v;Q?RnJ z$@%>hc4DQ4S>YSrV*(W)=Z!}@$LkHnW&Hu17_myeME%OY-!~T+7cCylhKcAtwOgA> zP5nuVP$aht8A+3GD^ceTdUoEMFpD(`{(mV6iE7t`9aOluiC0SMLFiW&gjAtDZ_) z8d6GD4VS;;IRS!HIc$O_5M%*Y|o0HlbE zAHH{NJ(0#_vU{QT5kxm7_RIe5!oVqMqn_cqB!$cX=uQvSo{LY1C?NS zX|Ep;A=J3;-AkqYTweaxxF?XYs-LGRPH&C-yrv4m|yR&p`p~OP>7(4Olq2zTuroy(+8Kj=@zDX3aOJamd%?tGoOc1Rh{sB{P==`La?Z6?I+4x zYVl%{0OocbQ#swX88;=1xUQ%(itsmmU&ONjxp#6pQ=gj{tnTlRblmQba(*T8mTo`x z^bFpCdgE*p$?}*y!%bsNsWC;jJBWUXC&I|I{h~IHY_8VRY(bukc0CE_MRG7ntt_0C z9=U~xs3JPhQ_N@)qFXc_UVM^N}TOBc?Fbqln#se zhZ`34m44}22txT+H?*zkW3$U;0Irsg(nC2({AZudOcmESPCaH!p`8+XS>eEJMY z99|fZ3R0c_5@85)by^Xkqo13m7H_^vO7NQZK9vo}PC3scoI*84Y#?Q_kcImHX zVRna11ObG+qFR7m)h~Z;j@G56h5o`fF@L0zvw!#MEw$T5gA)IHJVm|}9lAf4|MWb@ zlgW*5`YQ}$DhkjVEsDtDYOGD9=IC$sy*V{3+>y;~qGRRq*?anaMh~}Ek1_Z~%>HP8 zou{>`L%1o(o)Onx6}Tx`6m0A3`6;OO_U(b9s(wee{~;vws-P|CcHees_8jy17&-D` zddWX1zvf*3loQOeM<7cYOj&g6+78t#k8+3#x2Pp)cEInB5`(}c6P8z&eqT+ z5i-{$jVV&4hdO6?Z+9^Lt`c&rL^kZF_{2(|wUk~tBfBho7x#jEjs-dR+cQ$M-(n!KiurrUm$GAdAS#$e7$De8}zKk00#@qg+?Lp~3bN%AO%1PugC& zNyVLg@DhddGnT)Hddn?Oox;icIsfMYiXH{4E+5*?-jf3};lPhk1X!^7qW5|e|M|z| z!6v41MjE%qw7bUN^}5!n91KqUHr=JNwPxgy-*d%gS4sNSk&Y+w`7GlbshKP4$NC#x zvwpax(5=}JxMb#WB;&}$v$O4=>}G}VV>nzide^u8!HYP49bDCXhYU&y^zFxw^8zL| zg66t~a)I|4ejerEKzk(>9Gj)3R~vT^G-TW-X2f1SDIp>buHCzz!>$rzs0L%u!1j%Q zj+I;SFZj3+VN0j$T_q`ny1pSHh}yVrnVFq(AxEVdrYtNNRb{=_)rICsOk;Ap{lNDV z`0*e_wmqTRyODiQ>sRM2b*rVzucDpyx%`>`dRS?vcRAxw`zb!<@h~l$dzT7}>6zu6 z{T+1FubMCC<5W;CJS7v}A?EY_%_u4&^2pu2Ec`7s;pbkx`t>8`(!b-Rk9UJ?2uM}L zOxv}}6cdgEK~`WCHP&;Ar2YKkN1n?v1CVM4O`?ve`3uSrop~);j&p(x4mw++28kMBW!d^~+HSnEI6Oolf%HE1_O9;wq*D`F2>yBtN|@O_RL4cE ztY+AAoQE1+ZMRfD9gOGUKD>W*&TsI5Q8^el!ErtcOsi?F;Zq!VOnFo7mpf+DY|OZA z*P<&bgd+>x6lU^dcgfcHuF}6GL)wC?N?Ci5KIoknNrOFg<(CzaH?y;*G2Gau_qBfl5k+c<7x&7E{ z-x=Vr;^YrvHgFe8sJ+#%oeP%CtdM?>v?TQHc&;+~Q-JT3^2MoxNb#cH@@6Fe)azP- z@q}q%7P4h*{r;yTCIe5|SIv4edPO|fq<10zmVfsb>lv>E!APt^Tt)E}O0I`>PC<0i z(bCegh57TBFKJs{@}i>I5L94P_nnqgF2TS{6(z^o?B_=`4)ILwjJmdETVB*4mu|u3 zGcIH&AP?47{PR<9gSZZYl>*8ee-@FR(uBeU^?%do=>c8mlqU7BUOlZG{yF0f*}uWp z0zjmbyWXHmlht+~*DcUdZSIgzC*w0rt_Ww94Up4eVfg~j{r2tt>@=$5_xFla$c;tj zI;Y0D>z4!+ztD=K-1WA0VgfmyA3nVD@JJ|hrR9-=uT^yV7Lo5z7rQ~sA)Qx% zi`jOcWUlpC8#+(VA~CLtEW9$tsTqrn437hl(&FaL)HaP3Ej>Leusd(v`hr7W5x!B< zPv2N4qdaOu#!nvp42$v$3Ql&WQ?=HkDTl%sm@KoduYVJhXLr}S?nxC>WV--aV_uqh zF95V`*VGiXrHz}u#?Y{>J+5RmGPDk15s?Dji9Hmq8RNU#LjXh9(#~%P)K|z;>Rvlu ztatm2SpC)t*}A&=3c}(a12V0djEV5b;o)D$BmPX@^LhF-+iH+W-kgXj?4cNVY4evy zGtHT%D{+yt*oMT0br5rO@Y!DrmTNwA1N}rj1(lBPl^~y-1(C9FIrHoo=W11_#06Pd z!y>n8w8ncrwnIilB^@O7%7l~=zI4oy!6mQ!XSP0indTW+_k=n!;yg+mGmx;~8{ika zqHLvR;Ly7qO+V*qZRj&X%8~&S(@y%}r}s)1d;yi9F(b*=JQ7YV zQ7g;w#~WtE*ows(rv={MHTIn+*DhODo=X|O@YwkU?b5`rj4B$&{O6ehmjaDcE8<@n z#aBojpUjg+b;zo$WuVmXrc_N_9P5Q+UR+^}?`&gvH;Twd0J83^7hXzxzoL$95I3LFp?mgvfW55a^fqXlacJIB}|7#{bn>L!3a zFFP(!zfv7?aL7US9&*P1t#Z5;l_(J#x?wa&e|O12B*n_?>4pR-ws*z8EOP z&5R6kfztn{{8%`+iv=J{1#wMHPty!m?XRt^L0~0n^n*6Af`Du?Ol)@?Y>d{ssFH2D z?)c&}xgZN8zG!8C9wwcYsoEF`Bq-2v5!+fg&q?l1s`GTGeZ*$7Nk)zR7RLq_jt9FN zfBZ9DxcG>*PNk<#Wlvq*ZsNGTcOj@{1S=6;OV1h99f)MI6RCQM-r_0(~_8n zWw%i_k?+=r(}oq__hGqEf!r+x)xl%Oj?uWhWZC{FRLoJ3a*hbDJX+j3IW;Ebmlp*H zyo~{UPUZ#%uLpIA@Yz`*-LzE|boM&Oi+Oo%wxcxEG&#+Q8q4=vcH!4-JhD{T#8Y_a zx`DyXTenVN?;H<3ZE+WNKBX|Zv8jomj={w}P>x^vvNIAg?e-;4lcHsuIc>viMXd$` zXkXh;EfQ#1=cDb8rQV|~Kr~Ap7Whd^XMLb!@OkR$z#&LBzEj-SJi)`T#>kaICT1_0{~dx5d|^E2 zAM?UxHiAXrc64~Gy;SNk`_+m{B;x#I6@gvM=L$43j2C5@t~L(HY~C4h`O1~S<_`~L zZ0&X0a~ilfzhONnBkhheypE3Kx%Pf#dXOX6mIp%liK_95ZBN{8-WaO?6(4WJXTS+M zF1TFa>Ds(ij?o_P5J&cuAb-#nU|M!h-Z{yl5C#EuFk|;hfjv3UmfaAn4eP|T%Zbfbe! zgXMUAf|a$ZIyoTTXbX|=8nCjlxz04Sp;CgVTB*))w8Qxg67r!2j@u5=cc6~uy!6|3 zC0mG@xxBggebFod>^-_1ab^yoCpdxK38GO)F#p}CP6nDX&U5WYkx2nNDi6OP`ix=b z59%m|%Qn9rZBN@v0|auVuf#JL0dS#s%D6uoDcXnTN||!MKD+UliK=B_=%7ZRbsGC{ zkTV;L0IwJqFALWR7UI9Wd@S%qMQJ?mxE=DR6oI|IZIF| zx!v!A2>qv9+Q})e?bXv%sL+U;)}=8K8oILa9@<1d}1@1(MKmqY&?uhie1RJlKK%W~D z#I1+ODsjnWjIyGj_d2gE97BTH26(hhqr+;V>mu{{P{FYlL%G1ziCME8eNU2<)bqqz zsxFe%j29~O&%T9Umb)sLm16o!wewr1%$7=;N3pXGkA9~wQ65vW7QOKcH_=`0PQ7*O z9;wqJA~eiWQc}G;t`Z`!-urpGzj_@!b|nlc67da^xoGt-Z)v$$mrI@rPKk*4QCfPg z?qL3>mX>&_hd&AmoR(lgq5=WAUkN*%Ygoer`kgy1Kx>Yx6-bjMd1F+EpfigD}(10Wr0A3#vmGY7z4x{9EDCO zeSUl0#wi@p^H%y~jMmskZp62g#eq2zF6L+orT{x#j|SDk0fu*I(`c+tMjucellV4& zoXGj1gd3QiP#J6_x;K|=s_P<-$LI=25o@0M~*9s%R4K$|QRuabuc zEMJbjMK*}2I7uC~B{4VGjm!uF;T5rdr$h|*JWdAH610As@s$=7nqv3_j8*YBexmel zt|zWm+#LKd4j#VDvlsgg9^^qDcM@G#j~=~iNoy)&>>J5dC-B7! zus5?nX?MB+3YaIo>p@0FQHSZBAkU$MFmhS`(l(}!p7}phl+?)c!i5VWwqxT+7r=A> zXM?CL1(Ce{iKy35E^4UrZh-d2~!%b-j^H8|+PrYFaF_%`G z*xF~&;(#7C8iRcmjY%%-f#9iB(OgfN`!j8&!frh`B7Br`!+BujlQBiqimlWD_vred2{{m`7yyVcok91i9Bic;k0*+g} zdW}Bd5A;ZFJV=ykiAxej#K7DfiaxvO=ve8<5#r7-!@@Xi-`>2@_R#{84-k$cs#e5D zx1N`gk#O3tcD)tyZ|L1^Yt4Nkr>}TDw4jR8OEmV+hJQ{O;FCq7rX3@#A9@DH3rU>$ zTDdk??F+5`^0fr7lh44(W@aeqqW^EjO-m=ieYWUX6tknvv>oTQ_y6m!Fig`tLFyRX z(6sGv8!NUux+K?s`)^}|iXF8Hk&P7Am^z*yOK#=(xU|ue55Wuc)&n`z*;rZ2DLec4 zV{exN6Lm>#ZOYDOiIvwvC*aPFnc?_}pvmaw|J>K?J>E0g{`Xpqic)tdT7@ni7pWk| zsLlb>pd2{c_O&Rf#;bU2-lU5&AJV2lBWgRBgVogda5LfAhMjwMKfe-L&<*0{m*DK2 z#NVF>zcS7+A}~IsbJukC48h5Y;4ffpQ9HeVAm=xEx}Z z*X+o){N*Fzf@TUf008z7o2=Z$;()wRulBV>U$t^GaBVjf3n1oRLDw}fu| z;eks1yv2FMChN=pTWdQ4L$3V!Q&U}iZieW7p}8C*7l`K3d=OfKc}Ph6@MOd7*;5zd z>$$WV&*E;PT&#ywnS@h=L$yZlw~V3UF*ojEGu{z#}TZ9n2lctu-5Lg&A7sfyhmol=+%rA8X{=G-aBmUTsR3$}p~$4{g-?aMMIi?j7g4 z_3Nu4)}oep?YBgVm2JxK$O!Zi8vlRyj%J-^xVt?>^&&9v>V*rB;r{(FwB#5Y8)70g z%IayR=vO|1jNbR!U%7u%Nh`wCKG)T>QGR=I6?Ui~o$y-vI0c^32(@^lN1g zCo$(mr~c|MkxoDU45w^0OXPQ3f6}76YabWGx3KKV;w=UJi@pjHqf6b=pJU~hwz>?v zyT7T6OR;n8pAMZyI@Os=zZ=DaFGS6Xa;<(zN}yN|km3fLYis?sxNI!1t^EM15v1In zd3z%xL8N7qpc;P%b%S0Eo-)ofYmaDdp1eQ{gsMNPWq3gCXO;^i6{h8f`UOV zE@#&^mrdrKKTG|Qjz2D4nP22SD4Ln_>XjT;y8hxTMfjiUl9HCGK(Gkkq`*qvaW&etHptX*!aP%#idlYMm8vFKOlJW#tx z{;%#0m@s7gA2xy42K0P>iQa1asUuy_yu9>5 zPqDPimwL5dB;64O4q!3_KWgpjqWjl4Lm3q6>G56kyLK@%Mqh9K`O{{&(G<#7XgH*7 z%I|78Pfp7-_W_F$UPS~HtaxCW$P3xuGa~-WG@CJR{MPXGYif~T)fN<0fvmW>)vYZw zH#B0P%jCMcoQt9rj)>b=lnJio&4A%%j2wU2K$<0QH{pl z5)*5`H^a%pV+%hEfZK#~tp^lJq9iE!ZwE^GkQRjkDQY}82z`V5HyWTB5wz{{=d6@p z|6OgBY}o{){4pox){`{&Zh>pFG5eNe(V$^XH~Ja4%j7LTuSI+ivZ6GzNGk24ql1J% z3gF40pW?%f%iTjmM`1xWLX5@%3xDH=63K~|PfY9_ZoU5dt9EzVvuEQsX7>E)>BoY= zBm^WtzJ7oJpdoIhp3?E-8d1L_uARW*okOsIySduF-avII8TJ*i%p+ZYRT*Hbfx;OH?azTZm=hk+e?{6H%5RtN_EqdKv5>sDe*i#soZJ^n3(Pj<~*7>zU&D|8gy zCW<~p9(27Z;KhsP^&NAKNt>bYkPA#?eTR_8&kPebcZdPKfH6nd8vuxRu&5*kA^>QF z<}_wQ=H(i11%Ket0i1l$b)rp6h2K< zU`4QP0I-g?pVAC1&}OJ~+&w17ew}%~Q61XV1M8zX+yTXF>*$~=OQ-Ht+2>{jKz zLT(-LnYmSo*)dV>gdA7$yod8Ycg}Wo=j;u8`&Mu4(AzhUKU$2N8k<#ZtJ)U0S6ySw zG|O}M-nqZ$8+udDAef zvitMi!cy<`Z{H}H8X=~&v>>2WaK^4xuwd0;ql(HG&5UR0+X1k3&#aT<4EeH*%PFW8?2f9A`cCR=z@S)LxE7S!bJ(OFGr4Z796dPNYO5V>@mBHEOuH^x zshi^za-(HkA)t3bCk_xgJbT-*_HH=C0|!EwT(#$%xnC=XOb^r! zP5i3kB(g5bmHqVJbq6MJN;S6jHgXk+o#@NbDcvgd&WEnTSFbZNK)Sl*+duBozkNHZ z_H@OLb#At{lf4hmJ}79*9Q6&zg+e3w*B9CL+$Fi}C9OYyjC_43=D&q>>U-dq>^-BE zHKuUE?hGmfUSH2*yR0v&uKt}nUhvo}U*hGl==uM+05_x*Q4tymBbRh^U^)Vu#L7o8 z0RgUHvkw@U;`Q|v<_e74hhu^(hGcS)4ktzv>_6fv;yBs0xm_`#LFzGj=81h?)gsdY zx$BAPY3=NL`d~P$?VlS1-;-CDNWLR9RCcyXO17xh>%>0G)JStsUayu+&c1xW)Qe$E zd2B^(sBz}~`{S9G{kvM2@f$Xtllt6)IiDw5ZK(&CfV$g<9OlgCmgoFqoPI3U z$9JwQa-_Ph?yz?qw!MD+`u9}*=nb2%yonL>Z$~!fo5FfbB3y9P!$)FFLcb!bV%Mch zme}<)5i(xJI}W!Q^?VIyX5Orq)yrdS{RA-^I?}{gSXBDyCF~|3`l{x+Ph>x;4_3p! zwGv;THz3sdo&aUVvE~xI#F}p+gC+5h7O4n`aogrE_F@=htb8Z{X|%ei+aOevTz7X^ zEq&xKDmxO;Jp@R8_lB*9Gtq11Xx|WcZ_c)>r|t+VE8<}lianYX;Nxqk3RT*$dC|1( zv@G_^ebcTYZ(Ut$!*ADKrX4-L*Lf)u@+-eqmP@T&`ka@%L5WmOu&ys}2#_XYSj^Y| zoy<$b$-Jha5%S_iad9ye~rPY*=X?lQT}q5m=tdIN+IMxyQHCZ=b&L12X8}5@Z|Hb*^B`J-$P7sK^R+kIo!}x|$A_9cn2RkqzL^n=hb!Flg%i5!s^;HUKrSCuEy7IHr zC6_&SqvVZSckWD&X8B*1zlyL@On4z4Ht>zCj~e0^5!)-lCI`o$PQ}5IpkFB?k{25i z@=hx&=>IVx?l2+GV7jZ_B4wg)Kr97puUj{6@Vc%zt^G<(W8;@GG1&T31k8BRjbq|!2#_P+qVov!rOqe-2F&OCUe*o?Y8tc&$gHKX_{r){Psw45Y z-i;L9Bz@U+$K6Lp?)@zvcBt9Iy$NMk0Y%xU#R~G0JD5vp=`@2GhZ*BE`>C<8+MDShOQQd1^rvFDwrNd7bcKNRy^LV1;YQ_{ zQ@S6z@r3I(N=`ie3sIdRX(-3k+xL zDZ4vVWgBkX@Yt|^-|BRoZVU6x${;Z#qngE8(_^B&i~^>bP0h`>`>RP5OW2#Syrgja zU_n8IC%rM_U)&`@~w>cN8z z8(bEOi=XVlrJk&P0-+Mskc_=+`Re2ZJkT% zxem{i6hrtrhyt%IxSz*Pra&$&ym-mqi&SO$W@ee!KfQr|t5UQz6Av?$vfuzIJ+@aG1$@ezngtcgn7@<#fpyoCr^}YGBi!~^xljd zr)EA6@6wuXlm^|wrMYoR;8RAzWX}A&p&<4?PCUZOIlNhYkcm&h@wUAH4vtd@H+|RA zGEi$W0^B!a=x*LB<)Q57dzX}d_{Utzf`(+uh|Nf|Q+3#uK=wdCM8;Cl7QnBt8*5Rd z3T%JQgQ#c`XU}o=kaMKxolcjxYDw%tLBDf`9UhLgJA2ac>7?qZBzOE5Q$O9ii5zvw zI77s+NFloR{e993uhab94I3VyD!t|uNNw$v8#j5MQ2VAzSiI_$8Z%c$>>2i-t15~*flf)AR|6-2mKM%SL>Mar?VT$toOaf1BMX2}ATln7Z! zyV#6ScS7@JWZwcmg9qSe1dUVSDR=uSss;uevvZsxKYxCG4U%TSOaJErqd0IFgLMy0 z)EQ?$*zS^iAJ4O?jhLid;Jh@}lGZ=jSNX5OFlUB2Eq-EoDagvWHS@{HK4y2&VXkEi z_5aLBP>WaAwej4MZrm{6k~WP3L^k_PI&js-WEcTiMXO@Zx!v#d83wKsWz&D81J>+ zO_F%`=%~&ssfXC+uvC|c*v`!fvw!zW1t0(;Hu~q+(g!zhd*MX3b06_7Tv+IL23CkT zu6#!=tNHk*#l^)}uQpT6N}gwP^U~R~9FgMkbW(UPIgWFwZf<@=m}|SPNDJ8CLGe5- zyZI1Aig*Abn30i@(aIdLZ>1k=v4oi0o3jrXvg>AOK!nF{K#mzEP4r_BSJyIZqK@*v zp(&`B)z#i~#pG@#^C8y8sQDLir94`^$Kwz*Iv34h!_1Km3f3u4H znN5xi)kzVwy4?i3CVa%>I-=Kt4tH0*|JYKhf z4O#G6jh1+1{fr_`iOL~mW9z9Hk){b6R=bz__@l(@9~j6gD*N(BjDUdgM{rSwt4OJs zl?b2-u>tsCVL4~BcjaqG zM*-xL;Z)&A{fNN(NZqpom%!s-&RtIxkqZWSO+=*gg1)#jL#2D;*uEy7e$j(wH6&ki=tjkH|yq&I)wepIEu zx`Uoa7eD%UXjoX#EQWrlaB1>mQeWkAy83>Bcj`F&peA3;7X5dx?A-xVSqf9>$uX~Q zVDPo1q}=;+<)&@>uNxW)p?hd8Dt+jFC~wVDo)K~(-`VPU6ADuoZOS;#AY3(&zwqUe zKwFzOV$yx^M*#up=RB@ZZ2Wxa{Jc9nZD45~iuWnkcD;9)*``pVnVL&=Bx`;_U~ckV z?!CU6QXkneGrw58njJezpfLM~?HJSPyOS+xRzQ!kJ7Y zDG;|F79M`<)~z)w|M=P0RqX<&x>m>Uww+0sdYn+< z*Ihy+5t7NFBGxYw5~ki%$r9TE^mR;5OQ^A5Y2+uWE zwnEZ*2?-i1s!1O(&Q2UOGfPH|gL+4VgoBki5_(@-AVHw%qb>W&3tCk@`iCZ+D?Q*} zqQaHGlJ4$a3Jl_QLj_+-j&2enD3p*iK2DTAdv-aS_1}j9t)Xi(qY5w-YW-aj0DUiA zx}-KynI#S!1L+15S;}_sEoy5^l<}(g{o4R>)?OV%?h*^V3B|>w3r?>`JeUNrNn9r{ zs<$v_C(DP%Iyg8$uYm|Tsh%bidGrur3W{(nIAo!GQQAF4_4Ej0-tOXc*z{VNoY!nT z523yR8e>Pgk-Ck|tjU$FTSYnD0ie9_FiH`;dERG!zPPJPj1uJ$_Z}sAvuLMCEWE3% zEJvji68OrP^kaddBAJ0OIFcO+ik~uEmWK`sRa;m$l$kB4XPK9dH1Fz&_qTnr zJ2O@5UN}k-&})^F+ClNF(&|o5uaUJDuKF&{BoF~$L*Uu{Z)!)R) z&AkE?M%S|1oAH-`Nlt5PY$@?k`%~~_#Lqg#~Z9nisSU|wEJ;(Ha%iMJX z%WQD__5f zHd$j2yJ)W$$`gG9wIs;y7@C=}<+A$ln`yVUwcS~=DUbyx!CsF%-y&*5R{n5v5IzBs z>5)$8({9~%$a1{niQ@yM_KZLVD>F|BZHWxa0`S~YilM4-Nc*Sq*L`Ts@ z@c!Th!X;LnO1covh}v==Mu`!^b0hpzWj^mzPe3i$0~stf9(S(v{l=uw{R|9u+H+PT zNeEJQY!z)o8VS~6`hZEK_~^Fn+xKz(JWg1#|K~xjT)Fb$!w2F)c1eMTfPk_P5=o)_ zM#|dSZK$^BXW_%WyRa;2hFMlay;t+MWMo$ z8o(`Dxa^?Z^Pm36xz3NfSpWA@cK`cQ z@GJl=gg3Y-DUs*JNtR$Q%*^P3DFRDRfVKd@Rc*$_e-a^Cpv0{x`Vv4h zj3k0MVB>UBsH+28JlPez3IzTK#4S4V>?ucPQtI-z{5Nlo5y#kN*RJ5@W%}D0-f)8c z?UOb^JUb!V_2QKNTR=7=`?mbdnnT}K&A`CXEPlM~@7YLP?d)d`3K;*!SU`7LR=H*u zWLCCw_uzG-+$^lpL(eSugS^G9k*Z;HN!QYrM?EKW(4K7Eb+|V;n8|<X^J|7v@YE?~#5@nYysCVe&+RyL z8e`&4v~c0Ev&VABT}GN}NH!bYq&NT&rvCc%OVD=AkVEY+O6*^+g>fXgF3YpPkX7HQ z%D{*xX$lDP^EVR-E9x(bUE#u0xew0$!KpxMje{L^eQNSu>uc!;ff!f?znrQysTs^I zju5lBq@@24QqyaI4O3F$>XTg?-rw*74Qu1Zq>69f0{&-EAG{i&+AD>VE%o@tix)d3 z$chIhZfz`F|H`tz8Zld4oC3-qX>u{o!x8EEdLCuzkqcC=Or~1-(o@Qox`*cPt)8k# zz%^_Y{gM1AT(mI%KuOM|?W4_wvVTBZ`2D2> zPbKMs0s&91&9ZXR%T|1+)MJ!KTU%Pnyw|%)b*I&AA}@a&X+go5_T z_RUlxdS+((_MiTZta05sPn@?CffdDwQm`5bBAAOuTY2HXP2g-slABKGXx6bf1WzyJOy=TT4 zs5(0RSo#CDBaTEng8o=r4L`%?7Nv1ST6`z(YQ!rKVbISagfZ&le-GTIXK;`tvb(Zz zXs6^_AB=qQ;%|3AMD6*GgU?x24hki+!iLerf%Uu-1rU^C5T876e;x-j06NS=kH}q8 zkbKug`wI4QnfKz(FORINDk?N{tSE&<%4<1JwI8xLs5kxVQFZ}@C7tEH(|l4?G#BH3 z4JvhJDPEuEKFrW))3|4C^ah3SMR{T61T{L`J9_VYk-%RLIaOa&BnfN;noiqyN+dX4 z1Jv6UNM5GD9G){VSQmgMxIXGjv+E?yurB$zj@jk~8oTJM)om_yoY2bDi;>d@_XU)- zY|~a|^YKL}!?q}`e!}PjR7^sJ#!)|@z}S?#USQndQbxy<)K%(6TK8Hxo=qXb37XmR zp@QX<1*d~c#TQ|*c4N8)^6j%{_W)L7&+T(YVw0$uf#y9CwD$P|Gb32>)E}&eT?pHF zgz4fHmmK}d2>DQ(6S-)h0pcTbp-f6hNWH~~N>LRt;pR==yeGe}c6%;J4?T$){b?V5 z#{NcY=7aKb1;BnsMf<(12D?>WyN?1G*CT3P#3kuc>c({Mp=MHn?YJ)5^l3k1!HbHH zPz+UvYI}}#eqJ6D=OqYWQ4CcMq|~a_k{(qgQznms}dB8tT$w zN4OcOX*2`F!^K>j5JN3I3=gl8WpbXVQ*iXG-wf&5B9r3cwyEinr*gO-(uJ@5M)wG_0A%F8(% zbyrNdgrZfhMNe2t;bFpWKg|JSvmu4FyfnTFRQ4ExFI18-dhYrZmF!0vfU|oN}!IH%ok8PJ;TG>fsB9t@&(?85^G78qALATFo`91 zy`5-zdAY|tRA8#g>RZJVfD$p716k$ja+rh&!!H?6#}%mvO2fYf@oW&cenfBSr1# zsMW%3UfQ|p4}=>-W2K2Dq+GqEZS&0P(016$3}w>*9bg!E;w$J2ey1A0d;k9V=|PpX z?N%Qxo8Yqi6E3CWGpZYybYs<+7*!Se03^jdyLT@}&_DC>*}1)aA43k8u&{=#*KRwdmN1 zV(PU1&70kyA8w`OC{)twVA77XSoZYvJfuat5L|^LVt;+v{AlEy7?y~EFQa9C(WzQ1 z4H%}pX%qKB5v!M}!+lq6Ki$8$G?y|xo6IB1m398Sc1Mo2D==#ea|mo-m#7Cu|Jsaz z=S(c3eS7jar>T=u8OkSUU5YG9lA8&Pap+Ay>kz28xI>pV&d4~0&p+Z#AX;*P#D38?Ra{t2pLS~oI zU4wc(yXX)jRB4=-XQu1oYTm@fRhlh?%KALNmkGDK>rh@(QP;xG%cx(9FAi+5H_GM~ z5UA>O{YR$f{~3J8%l_z@@)N!Zoq{XU0FJ-pljtwkxT1lVzVDuHt3wq~33Y34OV&tMDO% z;i4ZvhoJxgR(EP&d+F*fBP7<&vy&G-W%Q%VVde~gU#gD#(6u*=-2TyOa52Za6~u(s zh)hT>!mY{S!4IW*c~WvDR`Ym7MYU||TY&?nX4yiWK>Zl27zLc8JletzrVc4HrG$pU z<=N2GB;W$l(g4J?P;Q7grC)*2RxMdu_->aZ;5Ue^4bP75=i>`ZO3E0a?JC4btDazz zH#R0Mcs4K1n%^r?|AGQ&w=#Qwn7h0C!~`jsw8{YlHrfKgw;sk`plr^g!;Z1s#ZUav zcn@A8grnpFj{m6;MKUneTdsngfdLon8p>J)P74k*Lqo$7u7ck&gw%D#K7r@}GXQT1 z;3au^u2cThJs=yCdR8b z+SyuJP0pIl-u!|A_3&ErO(dbGbR24_Z)U&jOvug7&aX$xVo#obBC#^x^Seq5<2_Q8 zV=B@NYdU(lyu9*V=O;oSl>;@FY-!I;#FQeG;f?{{<52pnCR|!lvLMfW^)%j>DL5nH zBKEnt!7wfXlr1tfv z2r*go5!9y}=_EBO*<49(E?8ESkumVt!L*h6XU5dejNvl)Ijq@Lo2J$SLdm4z#&hV> zcHMJqa;|!9_fky=5!)9Q8X;S3Z0tK#_H*aXp*I5VGztaPS`@c1(?ke=M1+%SiSO$0 z^ihbWq0`n^r!pso(S!xG42MN?!GR8I$8s%C>0%{eqcyU|O2b%SB6dk(Hir>;-U4abR%XaI1Z?6u%DGp85fQ(}3yW%N&59o%M%W;F?%V@p%?}>T zU3u|+HF85bK(wfj05?(nGjD%7JDbczds3PD*Kq3vlmsM&VlN*U>KCf$bp2EjxDJ^} zs-+btCI+H+xG`R(s=8W+S}ETl1_2OaQBv0?GSUk1<@8daPEPaooQsH2_4@yPZ<6A# zc|@rm2KoDA_KS#!W=n%{Mq-!xU9ZDpKRY^He!RJe)uPzi4$sg~lgc2c`+GJ%@Vpcc znmXoY9p{+09{m|((!^b{9%|}nw}J@zbU?sfkW&hr9Z{LdxmCJD3YLE!Q8?(-$K%im z#ci0Ag1<&Lq(Jqf9Q=ozrHAZq z_wjV>rLz_Sol#EzXl@J@NCOcO5g%^Jek45Hgw2)kMN@>p6`7hkh}2A5QjIFCn5d#o zf+za&{^Fs4gLQG#f!@WX3WMv!^eb#(q9`wh zc#}t%K=bL{2Zkc_HZLQK(Fb`A_N>zTv*;-Sf$h}P`%hjkdM)iK^K3t}=w^J!@!g=) z;(|Je!*C-P=GR7u<@P&4`O6s#Bt=b6AKa3*!IO?7_7LiGD~KI{V`Sc0F!~;~4qF0o z;vOmRxT;>#y=@R@+M${dzK=`uxn)Lkb2GZQXqaCLnM3SKu}^reqXTzrrImiW9B&lb zXgOx>B0QPSOQUD{LJJOwIog1;UiszAxfaHgQLYdKgWg5D>*_y{D`Ss`xBx`4Ren5r&>y4@^ z@<`N4R8YUU6x>)=T^rNYm5))VUJMQ2gnt0l8!ue#1UOBQGvyskkbaY#XCS(Ci=OM} z>6_Zt&mf&o$5#iq+yb`}pmh&|1J29WRJvT)scNQ*Z?QqsEFYP=g z|I&7Ok+FrjXeq~G<|k!z8!S_K$k-mK01kDv17W!iGZ;Dp2UsDbzhU!i4e>9x`CUV+ zw(gX8eFyVnE`*G!q~96D5Gq!8*q;>onz<>H)gM-osZSlNtw>-%`X4LDU?hcw!Erj;r@!igq=*{%0UOLtgJ>F5)9SU zX44D@A?S&Q42pq9hs4N8;_6(X1{}xg>Z5?&^B%_(l-Vv*BT_!h7wdzU@CJtf@Y;my zQKS}zNQM*COvP+Q@=}LK+lx9~%YJ=9bzOI*hl46g@g-n9@O%na@4K#WzV33EIKm57 zcHET?%)go&++kwk38DZnUXt-oQFb6Bmv;=q`(cvZ|OPk;=dzIw=< z=hLV6EG+!OAKCId&4a``!2$KIEZ2P5PrxlerU}lR&4m@ZT^7RZ?A*M(@hCd% z+gIXF`(Tsv33sp{Ld2Z|Xpf#cWrk`lYCzoFLnWSZG|Vom%f_7rBx+_brXYWCiTONW z9DwUmkD1Sj?A%XulhJ5qTl8=qeTl)@Ee_vV}# zQFw9c+H|8%1i24s5e449d6U!qty0fIVpB_+mOCwiZ&0?~X;HI+QpawoFp-(o_cuse znZ;K=j(rQcrXkIN`T%-<|r+#a!%lPza?1sB%2LrwMEVe-7An z8siYdNPn>UP|(dX?^L#tSQ^1JH~_ye;>gr-m;4LbzugDw;zog(9C3%YVH2gH@{L2z zDZZ4rN>Advmd2KjwMK++t1eatO8-E5@~!evr;3)@2zAz~_WZCn>9#`G-8#X8!#jXL z4Nt$Y{Mt#NQVih5I7EVWvWd*k;58W!elZO@iSm{tJ6}ni1RZAlA zaBzt7sT|1I9UIG5ap+}qbpE|J=bv6w$Xg}X;a zq7I!=PQ)X^c6o#^TLn`!)7Ljc#fCqAnaqL9)B5TJK+u~-(fVc@H;pS1_tk%oA)!j!-_t6VgXdSy5Zhi zRj`p{DlSKzBF$AKptGUyqgLKW(`su~_MSw}bIirRzIgP13yC{qb@%T3^mHhZ%3Zvu zbRS&`#BZr{0R09gXWO=j)q||Zj&T$=LPZahkp4n}Gj_BocM=+|q@3AoeiNNSXsQ}) z&C;oMU2k^|mKW$MCSLk5G+c`5ju%2EK8GB2ZcNN!VX_K!OSOV^Td4O#9aX@@WGg^K zDx;S|DTO9YexNDwo6P#j^c)fGch=X_+q8KcM7YdJ|8)9>gt>o!=4G0C&~&>+f&eO6 zR2Ct23^Q@YrfTe;?f7?-o$T^x>m3o{nSIsTwSHffQ}s)}kWCm{aA|`=lPHr}H~I zJM;0?xkeZmzk?6O>;b9Am|OELOn5o6pPCtNlGG-^%j?1`Lv69VXsw@2AWE&EXP@)d#?XE<?!vPHeVYEbWDVp{Dj_ixfpg3L6*)!h%AO)_|$;wqIJ6wtf*2yk>2j zsPO_N6=r#9$Dv;J21hSYkemmo2Cl78I&XOCs z1TYbDLC_0mK&}A3kJO;Fp&{F0Mh->wTpL{|xL|$1O>wvHKl3pS=#>3r7NB}ct%*2B zZhB5(TeB}Dse$?er2E3Zi5xY`*${+a;pMf!@J33kIFSOT8H3=6u=UVqU*F{lKQ?(| z9^Eq;hBb}Prs&q|R|KdDqJd)KWu080!-`41Y3poLm|B68y}o_^`}ekov~p0BrU3tq zje`Bxt5t8<*aW4%N|ZV7{xK!-%KUoUIhc54=(^eWW;(}i8W|Z8;be1x80U!-gYC+m zsS8t09UpfI-1<7OoApj-msQ@&NK)ECq1XR*k+~iH)s}q;CECEzOToz!PV;a7Kd!zz zEa(1xKRg*BS|TOxs5EI&DdZ*;ZE4fg5~Zajvydb$EtU4t-h)!K_tf5dYuE3*JAl>b8L zFCZKm0~(cX*5x?fa{4czYzBdn;fwC9j>Lz3R~pbjJ53*z+j$rEYImQ)<7yO`ZziJ;?)-WHa9XZ+OCy# zkQY(C@9o#q)3LIgus@4AjL7ON#u$o4xv7R1_-O2{rPZf$}4ju8rI(oItSDt zC@|0g#%yre*+E`enI)H~DfUsNxLVx*5#~<7w;;#4^y)i`Dw)8%tQQTnVFe&R#p;v} z;;j66|6~h}e62WN!w1ul1z=H|W5l>R95#tUL?i#)ZDHWE?SjVou$YQR(=;xEc@ZMy z7YBTbj+}Sovz`QjYU)195Du?vvA2Q}g(FcP4^?TrewXk6N+Y{}QZvDz`qt{7z`sN4 zzf=RfulK)Xt;i_&|ITUNy-T>A6gul#t&wAevFg~!$gi74t55?pqne7m8OXrM7#A0U z0nhtt49EbM=D5pT0`o}^*BvtP{sKc)%^4p1Ls0-FhrNG;`fH)xj2^HE)_*?8%y~=U zsMcisdU;{ctO%iMporzC{o3m*oAFvm;ngeyrC@F8bYF>s_lFP3_RD1h<;wX>jrhuR z!}`&M)0&z$P#mHz7WjpFP|@#O`SNIqn;J%YU%0xO^Bvlm9dEA<*RnWmo-9*F%r$1c zoNR2Rr**DW28wQ?@~n>_&wT`s1vQAMZta|zDb>W^%6>HB4hpN=A^r{Su9Q$t=oW!d zgDVGqwO$6T4JroHHi6b;z3R+|4waRaBz#BKW^F;aKLi;bLAhV;mzzmR&1n#AjWsPq z!5bX}m8dxV_)H*mEj#gw%6pmL(amOY51DCk?@)xNi zO(S(6up&rA=g+toEO@xJIxk!O?-pZ z3Qu1Fx9I>HPs-#==2DF@bdTrn(J`LW@|(OA5_0a?kHYSOsV=0)4pj%&L$ap#`DPEI z>-y@oy9+mjNxT=>8PApZ@cLL3mzBlX&be=H{s`7W8oOm{@{gb(r`1Z*s366_8V;sq z3HkXOZ?5s0o10VY2?&Wh;0rkL!v{=#D{))zWfoUd(LW_9s3ct9o?{F2YPGNx@BHIl z-oyy7F$?6wU-LSq;Xids-kMulDp?`r(4Z;+9JQ`Dn@w<({P<#v*CB~q1T9!p_?qF? z2I6q<-cPkJ+hEv&PQ;|$N|rRnBG&{-^y9}NCs{^tNP2(xt6(=$FUEaP`+`cJWV<_+mOuR~nF2Kjr z$fj+Ol-LTtt*|S57lWNP(oz4m9?O1&7;{iTG*gGmwSP#Lf2@6n($I?Pkr@ym#G%^^ z_@E*|htdSe6qYD%V>mu-mKkJY;aY91W#PsGl?YXCQ`0R87Y`Q6+()0{<0qc)>MME2 z98`7g030r z0DitYsgLY;k>j`BOt*HSQMqe#rc_HIlCs{230sI-HC_i}9*pQGn=1dxB*~S~gu`L) z#0jzG(byiyv#2GwROj`MIUe0jc7Xyz=DIK6K>oa)_jrt?)UoKSdbw9reCabBhCXec zLoHPTa=lDYu53nvWYCupO|TmI_1_*jt-S&fK&2o5#sAwjR|~OiH2z13BWcKpq!G!} zD#QtQA})DjZTWw6=jpEN-j5y+EGcXe1QYCGAIX!O_4qmOj;+65)AJ@Y8fk8}L$~+P z(o!yBRkNtD5UvH+;%^lQbS$!BY#A897#I+sX&(>c+-Ug|TA%9q1(mWgKXS-@-|(`Q zi&j*PN7ud)T<;)^yMU4LIv{=ij>X4#E}dy(SK%|};2?&_#Q`iVG;}iPzd<+oC3|~` z2h*LOKYQVC-gi+-iazX>xPJYUd2xNpAfk9jn-evCk9^-s z_A|J|eab*r_u&4oSFL`kwPZf@0ZG-9)v|MX4FEnW%)pQH$9;0lo8KP`gj2?JhxHh* zMmEp?QEp}#K>5&sREdLw14FY`Sa=-Y=J-N7N&Cmsr%xxl3eJpvPt0`wTUc z!x`XZi<9{;Uz)8<*pD^c;Nwq$)~R|R^>;W#amGz&IXT~8>CH_1N4$PQl9BcEKv@G# z0jM8(%3-yCN0?9FDMiWNEq0*-XCFuBU+V32A`1GGqCE~jN;;W^#>X%`CK(byR&37= zjK5xH8_vf3)vB(#I(4g?J^kSHa&ls}ahsHDg@LU#Dl#~?!Poem`4^H!PQ;$QyHo&j z#W5y9XVkWnjJ;08au$WcJg6%a#SGR+01*%p8f~dvt<-`kq)LI~LQT!HtX41j*Yp`d z(B;_M_eRO_L)C+O^CvxD-G>j%>N0PIgJ)faT!Cz0MSZUz6(Pd^6(Q*v8T1nO(%OIo zVsH$?TB~7AID~Sj6-NEd@|U}x?Yr*Hb&>?MckAI)ZfR5X;t2OXgOGz+Oe_xum`(BROE|rjSNC}Y&WYfM z0ODDIGYPV;{Knm&`0(BTJr3n>to9GStXn?x;EITE+9SnT3jZ}Z-rBdUzD4$nuHF~% zObd=6wTFHqGFsB?VV#D_x@;{fC1y|?mM=*RftLeV< zcj1RdMdhF;(AQfhd4q7gj@`R$DThlfN(zx%E>GxoGsx|~NW0r=JnEi_oQ}I#k};Q@ zfYAlFj@vrLPqnACr(7tW3PkUgYL{5uIGEB}{hDIW=$xpqFh4k^w)*TmIdh$A-#^Yl z<@@m4(>o!uryfO7*5B4 zwvv3Dy_1>V#fapi{A}Fvjo+IQVrO|K4SyEjT9Djo-@M2 zeywRqNykE;KmUhz$-x0fx;Kx8h|P32`eFq3yum+&kCwYmDUZ1Q(s*R>%l%X_tI%t` zV=kbjPHrwO!mavVPV_~-ObsSDKPqd{bSIi6rjS=+4E~PLk-cfyAQ0vM4~Jvi%0$1 zwO?9JOopv>3p5*njWspHEwytsAt^L$+l`DIi@Va5>fO)(LDm4|A6FMfQ5rb3yxT@b z7b?r+U}dY+TjcbbR$hrk>)t)Nu(Ws1du7;rjSo$~*lr)iABc zbZv#5KP!k2#aG-Il9=|EXr9<@abY=G99X1^_bw&`tspJ-MC4oq?lg+Pv+S?{Y@G9Ox!?I)l9-;}d(CsZsK_nrN2z)uXo5gp z`^t0(hfUb77f)d_c*8$k8$?PmyOm_7A#T+FAA*7eog7PL>>m5@#3QH6d}GZGTz4<) z)UuME2M2hA&Kfo3;tD*>FluM(Fh(;*X0LbsHEmKxda=5O@|Oxd)qg}H4*b#drZjyU z$FM&yZ@b!OQ?8{=@)aWi3NDTc88_iYz7@qQy=fn`_3l4z$P4q-Hd|B4S*X4u)TLC` z`tM^UBm20IcIn~^kkaMjyA8Cp3Hx_aQ&YE4lGB|yb!vKLVGQGZD|mw>Cu@t6T8cvO zI_%IaoO^VSyZxg0Cn5pe$m0joCh5<}E+{Py%gq;IL^|y3|4NQJ*#M88NX^MlaY~OWt9#rVq96aTatJ#2&S6#TelfV z2j^=Sy|i5z6;4LHM44povvnCBF6I8n(>X$E*{_W)1(Hpc48sg(9~D`he7*E*cIuCi0AIZ!`;9u{Xnb<=+n-Ik}^352#xN0zokcHMFa%YaHuS ziel2s()^98dlwBW4s;~;lKx$6dl&YTC&BQRN>{Ld9dgMIIE1FMvj43l zYd@JU8$R`^Z<+H?@8#Ly+PQ@V%S#f242N7>-p%dpd2n{C^93GBXRuxE4-p8H$Xhx> zL&LnkrnRepo9f}&`3~y^+~IdjO{?Y)op(Iiej3k~qh@}j$Zp}&e#TsbvX4`(RkKdO z{TZ2<&Rb9VRv#*^uC{==GPUdcn2p5+Wo0{z+_r9wSX=7*-rX%+Rb^$uw)IIh;acXO z>HhKDw~<8Rm%9VQV-4dwxbtTHgg=$nr&}R2;E$A>*kb=^c5d9zNOg5Yspi+{p{e21 z*FNjW^GN=;VacM-vQIywfN_r(nma|sFVWH0h?oW6{x&rR(f%}O9(ytC2Ly(kXoJ6N zi;T)6I{NNJn^qlHd~@RYpVdCLwt{;1b?=H&etlNWt1tSU{`#{CGB0j14LVUwB!HPqdh=ztAB4zrF8oq+H zpbPhnXN}9)o$WXaCZ@Wqur)U}^8fs4GAUiI#?dDz(6G2*xfyU#1L+We%iqta7D{`!~{QwiL2GwzqmX?zXogJxha=Eu%L3C7pbl@%`qq z-|2d@Dbtb75)|gtG?P=dhv=G8n-6S@l~F%V;juKQeAJ}hhIGRMV$3{i9?4oh(NF6c5<}0K>dghE%v5T;+ zExB>?2J{@u($;&KUz88b+I-^kdpdCx^PqUoayrOcsSciHIeLep9%>l#xj`7?dw6<^ z)z@XEH1`yZJ$)Ks_gLtzAjt*9|BBmaY*<*D&CKKUXKQTSH_ZQxFW?$AGBQ7Jz=%WD zdJ!E}WH~Rxs)^|j=*EWTY(YR@>?txZDc$nK{g$fyBhg2D6go-=4A0D{bz~OJHpgHZ zo!qB+TvE){ZvO1x<+bwh@!uJgC%gu)9j~)qSH69FK89Jcs4U5$+;KIgaq=eda@lWe zN`>ISxVI_)6D%z$-u||aBj7d{Ybb0e^o!csM0j~YdINm_Wa6Hz^V-_l5!|21)glN4uCCGeA{=1E)VoC+{%4pG*~EM<6YlbA?6jDhwU?BH-ilWqu*VAO={el; zZV$j7Y@D%;=}W=kQk&;2SOL)=YJceBl5V` zW2t`1d3QHwMTJSr51%Kq&*|1ae?QH+bmGJb9F#&r#OIgS^2s4tQvk96x1s~|^rfV| zMYa?n<`iTzKWzI#;+NI?WCV=C|6AcQL5y?*c->M|gt=@lOrvb3Go|<0zd$A~ ziB<cLHGV6IhcqbDDTC8=)ZwnQF<&^Z^KmaPle4mJpJ>a9ZHnHxuj}i>zBQPyCi_5Y z-CbT2CV5y?bmldknpc@bdWx)L{&=v{&E@4Z_+GBB)&A}{e28I`S=c=PT&U8qrlvtW z`G&^EBmDZ`I&$Pl%a>2CKT@l;GcbBGC8jmua-ykO{G?rM@t214883w%jAc9;XsQMq zsii8fnUY(KGqg^U&B@W;s&?q@zeP6Iz{6AVXBE#vx$Au4eLz6PcnrlFwspCcK-6t@ zp2dtVM@SaBz^4RE9387h8GMy=dfGol_B%SV#?n%^iKEQkKFXhCW8;x@Ief1iuOO-p z?ka3I*A|-MB_Z+sGkveZDj=~285G`JDiLja_b~Q%Pv;9#r=|Y0yqx^u1NC0F44Fte zx`pEc^Y5=7N9Sxt-XCvr`SOn)`(9Eb;0%Nuns#&&`8J0RsaQ{4(bF4%eow%7P=W}$ z<37sHOGM;?9zK_OmVqx-W$E^Ltd_Nl7&RZ-F@ zx=LFXuDm&_@t#hSxRC3V6y3P|OvbP)eYs4FZE&ER+Ouw>&CY(x*^?-+Fx1uYscG?E zt!!gubLoVSp_yM(ac#(o+N(yv)VblD)s5)ZlhxHFoh?_3qXz`n=WhNF68*duQn-)f z8GK%23ah_=e_B4kdi?lTCJK&cSC31ts8N1 zj0y@Y5m%>1>gnqv;*W+3nf~_OdVZgKiFQ&}U?7HHOmjfy+LHdhg4nt!Ia7e7YUzyQ zZE0z)uE*3)Q|x{NAJyLxH!P&2>Sq~J)G~xndw~j7Up{8c>70@(0NGW~*SiJMe#!O~ zz8eEdbi2stdIq~L?N08s*}6WJy?xC8toOjlLH&}O@6w44nRnxP9E0N31P`6IqM|Zw zwY{BJSY7x1i!Hy8J4M*9`uh!zD)W_YGKu7+oh_dYdhcl@mX-$7;2DxW7sw@&_9|{q zx*hQGW3h?FSw>^yvEpK4`lX8}9zJ+*JM%#g=po4O`tk2UbEPq1q9#9YNBc?fqik$u zgB3?ZWbf!H-OrdMD^$M5qYPJMusfmVaG$9A;g2UC`Sq(#Maj#(m^|#jERgT?Y1>T& z6k8XLzAvZqqMl|!k`}fJ{I9~ketl0mT)JMb*|%c5!;F*fyjDpn2v=b`r5@tqmlPdf z#cr{=QUCTWmwtw$Ln)J}_sbVAxHQjs7(O&lHty=Yqy*6y85!MOfR4zE0l8G?bP-xg z*nAai=ARpr9-oNE{q5NQbJ?6RW%Mf^cKU=e8yn^^R#icH5hQbEBH8qTjEzHnUXR|y zMlWdioG-iGu^2J6!}6|B&^bFfo@hq(S8WZW*NOYSM;e^y;P4?8d4E4;yKhZDE4!no zx3Dy$)0mK!CU|RlH3H@{MzDFsks1f3F%%K4=*#eH2JmXz#-<9mdU!y6$()w@9OcB5 z7*5{AI~BgifJYaVH6n5JLaQs@+}0^^Ts!;P1&jkYl3phQ{gz8?MW&9MOXi<(l}F$* zrx^($2cptH#}Fi`EcGKY3aoZY-Dsuy0m6lbhCY`Fd3I@UwBkw=OTMwdU~ND^z_uM5 z#|TuxO-s5T z(a5*=Y8AJhv`6M4mCEhg>Bfs){i5*6$B@KnWgeo1Q1JBJ+|n>4^lKd}{{_?nxAzIY z*@rOP_wovlHSROdnoQ*M_R9>}#IcM1;Y@&46-$EkYhw<_%?tVC2IC zKik9OYMN%(lPwxH=Wd9KCfzovO69tJ>Rsa;p5YT~hI5%}_lEs0ziFEKo%OM(M{%~c z=zA6LTxf;!eoNkOu3}-ow>r~Dzq&BTx%e%1tMil1u|%3P_t!+v+AJ12*WXGEGDHhx z#g5vz%>LmC*4}-Dm`3f~BumfgL!;lqhEpHyqH2uSxRfWxDm2sGV=>Cz8I-WHlC5{h zv#9pLf|{+N%oDCN%PXCL(-`|_<&L3t`}_~(yr2ZlcSQ(t7|-kY&s3{ zbta*47}GU?b17u1>W(8To>cw3D){8dE+WE;L^&7C6)PIX>FDV(MmEFXHD&`9!qHF& zPGJ3}%g?XC&3*Ca&3yHQmJG8^P`;Hq5;Wax=58}Hx}A(|&#^vFWoSHhs`2I9!a`>Z zdq74}Vg}7xboI}AN1Cw@s7id?Sd^kRr#`mkgY{MEpWzY(O=-;5g3L^MPWa{kK6p*Sd@_~WZ3)$n%A#Wq}X9n-B((4eq`%5vaeji!Z!#Wd}DJz2VTdk?V|=i zt~Z0oT>1;1A?`fANx4u&CyVzEU2l`916 z#Ve2tZL02GJ9z2UA26@{PP4Edy;Bw-tfQK?5+_d}Te3fKc{WFqjmpDN@Qj*IelWjc z@xqR0S1RtNs|i@hISuy?h|=?R$(d!*C&fDY(Q6Ovn)kQTv@n#ppsD|;;f0>1y}r}U zoBu6`C$mq1K<&ZlNBsEl;}?!;mQdj85LBdxT^yjIc!8t-5E$J*Jy>8sX=GwjVFh9= z*%B*JvXobqRz5FV&x?E7U)&*FmK|Ibj`oXWpGP0h5NyX=UK~2qifK58xZF5^D?bUD zY9lgj`c9NIYf4(0rG@boqN-|Q#EiK4@wd^X7NGpj%nX_fPQfT)^7pc&I|1XpeBEE# z;=zd_$8hG0D%>)-d$%?{o|H<6Du#uSkY^RQ?_Gpysk=+MNo!1aI5dvT;qoUvbX!|m z*uAcUX9JILGc(?#7R0CB8{Ch|F#TT7EeO^KMlD~zLFNYj$ps=pVp0B)3|v_BE6`$r zZpbIK`_Fi580sc!*Zx9hq&Pk5$i9=*5_7lcCGoh&RaR-=>~kKZDIDkRcSSNG9H#EKDSlh=r6%qDdv2fN^+ z8xoT5>B*$fZE!DYYN)yF=T%)}PW_h)3#O1^NUUF27!z$ubk9h`6`9WgQYE;nCKGK1 zaHuDhTZW}#4kCnO$Mi-ULg)k>akIc>4jMz(KYz658e(y@lWHON^E|%iYz>F1G!-K3 zt1D`^k;S=Wf0g#|DQo648qOJ}3EHq8_G?J32o3G^Z7Ci~x+bkteP29KB-K7XGB5D9 zgL2`JLxc09Ju!kt1^p#G4|ylYznTijmPW1Zj{o1?Eq;J>vYaA!gaovLN1@y2{re|d z3(VXwpMCJ)!JRwZP>l+iwtWc;EBbd4t(-XiWxt1;8+rT1PRRB+fsWw#Vf?#>vhB_o ztu6h4pzhnZl(EL5u3EbC%6LD2wG;p=rKN0{nGJ_eeJ&UcK@7vo=W%SLdjqrcUh^y> za!1=$(*ib^So&+jenKjelOmh{ zv)Yuf-ceQMZD`V5W&JzT71E+(#|}Sz)=UK_ZBakf{9vb`=+_OY(VP}sWKXJne3ajN zd9nC#8a2gLaeZ?DQsD{)kJ0c*>vNYQ=WJk-vy2j1rka&WB=vYGV%tbVE3BWObD27l zGK99Tce_UFsfelim2vu&>Mq0Mt;P=@{z4%_@#2GUO-;xK(Bv9fEz4opo5ir5=A$P6 z=TXf3U-{p-Ki|Nr^R`GJFI_sN+ZEd`!mnv)+@yJY(a5x+J+ zG8g^+y{5yK5S1Z)uzqUj3`NMcZ6c+^nc2`}}*L z|Fd=h-|)yUVMfaKlYft;ZaSd1dN97i$1bJNeL}r(D}*D0#!Y+BjKN|XFO_cRv=!-2 zQ;fsmDg8;Hr6TTi!jU*dj*gDQX~siUfWo6fzZdaV2d(EI2o_jwqme}6>$xFbJ_OwD zF&LdWh^Y$t^A7oF0TGds%6OIAEvF+K##?HoEt#oMwVX10X+M51#>#1PasWdD*&Q;d&!;gTBMLmY^CTwQ-F9E3^;A&ot@R_!!AE^KXJ^fe zie&bCB$^#wICtyT(*1vy4#2C+KyTpS!C^n&gZY-Vx$uR7KAB2xb0g5#d+*^tY$w8X z^#pdMgRbi?{JYgkGb|q1#cP;clW~z-SkXM zur{H)bjhJ{VhWHAoCVkjc6Ns&^cte_F%2QDisO$h>A|WBXr3kAKd#E8Ws!dzr|I;} z!}dJUIP0lDgM(f(S9;+?5_Db$AdvhICJ6=4_N1^OR~nxkl#EIbC8PQN;o;faZ+_V^ zpNls!GgUDp`~+8NZI(JE#TuFT@ZBY@PFW_UOWf=}H=YzNeFPaDj1fv%IWTLbfOShcz%`a=|;$n2c) z4^kx?`t+H#+3%$cPtS>|f@(fK>LjKiwZ-1cj47v$o2nDVisPR71OyO?r%zY=71(pb z)yPSJPO>zEx6=kSBuG~s1)CT0PP4G|J&W`VSo_erbGN7?sQ(MEj(_0NXAu;Hb+u>f zpBcmTZ>LpIEU|f9b#;k;azn-kX=ledIZK;v!Qe-OknJEkTjI8Z*zo0A9yAIxwRq0Z zAzdNjU{_4Mf0;1GZ>m| zrMW^pa3De>+lEF?TYD77#V%2gEl(?CZvrGnW$7BFDHb_cd3b+qn(-pSk)(;Z3oOl( zSwcP863;mWT_7@v*zoP9eDy-(>Q$R-L?}A}gHY81CI+vIB^0qaG#(Nmzmo@;2|(6Y z=M58&lpx}$t04aI8)#+|&2|$WFHN@&lxMgO=S-{CEfan|m~ruUvX2YT|o7h2nQr;49ak4Go!g*31M<14ZqZ z;#NZXdOu*lpH{jHW`pu3Ut_dFeMcS@)ny{a7`)flMV`M5LSLf1N!gmz_rTF{3l;fx zE1I24F;n{+eOz6@kn}1ah%pY&ri4_hg5i-&P;ro`b)XB}i2SnCfR1)#FT8hw-0UY; zYs?Ct?PDQJt8|@&Mm&HM)P{?brhZegUYr@?j%xuf2e=M`E<+^tmGbhizn`=D1njy( zu?9|A=7i*AzCeD1Jr+!u=*bWfAnnPzSHJ2pI#yzTPp!>BnIZAfOm93e@Dl{5&Gh<+ zy)2=K7>(B|@NtQdVeSO}w{Ur`DKWTw&7SF;4fq}2E+W={^c}4vF3I?Kd-IhKpKdNI zF8+%31sJj71>PQrP^A>}u52m5+msI}V^YqywkTV-wB@?l0rSC{Cvk{61W|wm*#ANA?(NZkgYr@3A zF<&~GtD(NWwx;HeC~aW|fqNzO_>73;Gv$<#uQErz=)Jj8uqhO-ZjtAHp|m*Nu`6>m z=SWaMhxvnp52p{4+IiBaZhTmrgr1T{YQ_a56Q5d z98ubG_sW%$9EzGG#u~%k4^3l|5=;v=CnR8=&8{Q6YHzb zd{?42)+6_OL>hQ@Ir>Ww;iwMfFca0n)Kn?$5*WFY|H3TfD8}&91EHOb6ej*fBu!`i404t8yt!EVSzB<%|?QwEi>iTs(RYl{ulF|ZQ zRdlA+wAva4j!t7uvZNKJOt%y$Y~gltt0LVJHULW~F3AnG6074UPFzwVy*|DoRW<)j zweCd@>B>)yoAJ?hjlHNqPMX-wvwt$A+W8L}no$wFc0O{)NEt0L+gT2(#wfWPO5LT! z#vN@FU0VyBW@jm$OMELJcjVJ=8EuTmPpP*rEI$4R?UF|31Ac+|JyfvzkEK}C%%Pmh z;*)mPa@>eLg>f8yweSL~;ml0kh#x>mBMM~}^hR6jm6f_PbV~0oj6E2x@v~bDigJ1d zV#8T6u{SONB^BtFehp9%7*2hDgUEXf97Nf@2BQh&02d8*%j(SZzA$qT39fE#Xuw0{r?R!Rb$~PH z=oruau6&E;gbsqoz2*caJw~_EK1^&7CGo)pr)14%=QodE!4GY1Msg>Wt(_gd=nnX% z7?r9pGd#{z74+}!wv;~OC*2e#$xDE;Iuzyk=mx(&Osl)V}1er;ZW!xs&-xU;Nv~m1RIAX^54Smkq|t{feXen6J=yI6DWCz(V+z zd0+j4@|>0RrJgi3gGftLQ~3|Q?$RI-c<`~;`%?G&9h1`o%lNs$kN*q|cjm?Kra!{T ze(Idf1Gfm)j9$v(mfYn+>#npjLPAl)+TUX$GBeNeCVu|<)up_#rnYvYf?AS^Dg52d zYs=ww!E7=TQ(aw9{reY1Pn+#~GW&toRjeRMkji%NxwvqHRgV)M>gf=;@_R2X1ChK_Gg^>=5w59^0(VzV^K?0URv)3x0-4yDk`{>w4_hWUO(%- zVz(e$iz1AHA$WmfX1G=kcB^iO-PsFdvGkAeXsX{d;LMGs39##xam?a)2j6$w)~zJ+4F+Y$UPv4| zVCAfGEb@A5!6wn%yzTo7tsVi;R{W@G6yR>k03HB#*7<^4CZ*1sP|}@uSb+jW<>>z0 zp^iQ18{i*MT>Km(qZbm(361pSXWQ%;#Tc#--@OxrA(5Il)yFc41q~SB=mP2q|n#d-oV=^MI_r4fT`CQ?e&!SPf_H$)Y(%#?F<~yS0>` z4^^iGo#zb_Ni#m7xJU&L!XqjwUu4-|NL)O@m@wLHo<;Bol2`E!*24U@w9jyK)W{-> z-EUje{#}cU)E*(><&jE@4sqz)FG*Gxv`$VoU2w>c=Sz<75*_^G9guqUvSv*88&${u z&E@m?qT-*DYU;~G_=O-Dm;hM#Fac@FscC6?q6}XR5qk`$i;EX8o;#8VA{wTK_`wrz z$jft3wYJ#bx+rnErm+zPxJusRcP2Xkxev?^h$7qXl#mc6MdUm@H%V`zZ+O^d%_dWt zRn)v6+ghWuvGQBU6?#mvm#EC80wr?A zGrSSN8_#z%G!TzdUkk5;3_bP!#Cie)qE<|N-9WVlOYH0T3|4`Tc5jw?LXI5^p)F+y zp$7gg_Yi`M8z=InCd%Hlw6x?DJ0+vD_BPec+oP4r^T+?ow_UQ|vL*1(#O}?BjLP;5 z-ssPl*4C{*zN3s(I}=R7uqik=SYm7Yqw9_{^Rw!qndQ)@TeGBDVd+A(b4gY8d)dkO zf0kZ;^ge#BMT*!|705aC1jt*K&2p9h#E^TU*+}QGjwH>n@93fCic0%Gv%gNampBi6 zBxOmEKHXu4Uzy1A>9mu4U10Iyr=cIT1Oi>U#gc0Tu@ zI~e(6gtE#?G4uZ6D7o`x0~8UEd1&~#4U{|OJQ^{-e_s==t)gNB+!w{~rY=Iscp?;4 z7I^Q}9zbQ2^~NAEas~G%Ix5O#q-1E$Pig7<_jeun4v`36I(hOM!Q;W%0L1$pB}6NV z*!}qpB?a^k0Q#Y>sP^NB`AJ_zeSBQpIWaMp;f?hjKwfN@XW?LO2y7oL{LZ&PSU$vxh91Wzw`BVaen2%J=4v!X8YW?NWa0{9h1PAQSrY|?@7!BDJjw$#Z*36m`0AO z5A&8obY877UZ44lE1pX@BDC+?FDHv{x>)Lxl0E}j5TqL#j+i-I<*2+SBO`;Vb%r2* z?3i50(zI6cz}RS`%lr3x?f#6f-jOjig^gtXg+gWakMJlJ7Pdvh@AZMI+yDKaHT4j# zH!eDNyGHq6^_rg_6B63%CS#wSWhzCu?k2u2EV<(eB>kLHJU%Ibp>b6~V)WF>JvAXk zX5t^cy){);SLDLr?f&Aq$;B)F z#Sgfbu8u^yda}uQ{nEwiXv=))xe|uCEa3R!hK_~NMwsh5@cDt@1pqXDHK4XLOvzFhx^frPypa_B336Bu=H^6gOa$sk(5_9J}3GT|)S- zEG*10V!60J0+EJEN1K235KS$n&d^WrdR@m+gSI9-5pgyW!K@la3+b6&sX;P zlQ@RLts)|Ad`vOQ88Mn2qw5BL4@)vxIs{Oqn6`(c8C#>_lH-1@sd+2D?fyM>la}|& z`9=B6!PP?#bWt3usl748^-zda3j61kZ!~KQ&EbFkSmAfKp9_H~apGy z1&$5~v@c)S(>aOokC2d8#o7<2Ium(!ZnAu^EuyLp0 z=8gvlGd4W@m1(F5=cU77MQdA{vE}5NQ!rJW>Vlok(k|uZlDWakldJclqfg>TarxO* zkdvNnMc)6H6Z9{G<-^Vw5|}MC!d5?|21Uu~(;gG*vL~?NRFKpIe^ey)va^%ey!g=F zs|{UncII!nxrI#WXP%u5)VeUY!Bb3(nv9h{8_?W!27q<@*JGJVoH7ena6xX_wz9fp z6RWxv6F7`x5FVrSCQRoBel%%~E=jkDPu2lNJ-G);ii#W>qC6_BV94n0eanX@a35pK z)WpPP;;5I+MB6fKZzR{VsIRf6K%&|bt>C2Xy`O{UcE;1H^pERq-)iUdTC@aDwi_mNb z2W|Wrcvs$xn$-o$$YFO4lBNKk{G%j-7m@+OV+!3};^N~`6Gi#+=}`n%cO~h(l8+9+ z|0c0k$hwVBS&o`Xgxs0@ecEJ)Eo_y0=0~7zvP)t5hb-ow@Z<*_*&3qOM?k>1UlmZR zsw$CA^NsV{H#03OcgU~aMo9aeGpu_K#0;JhkjUMr%*f3f92giG7&z&5y|0%V*4-5q z(w#yruOw4aQ}^r^T}wCxwG%LH&rhFX;^R#*>=6L!{BXMa;`MO(#v2L>7KKkXHa5h3 zgRlTbC1>VMMn+l@a&d-V0i&I$#Kg@(XZU64R|RM)D$dX9y}nS`+|+~@qmlinv9S>> z5n`(Svdk34uD{P>`p3+l`?q4f9j^Y=MDezDOF`~Sjg-Mew343$Q*K^$;Z8hVe)VWK zCvDmH?}Q^Vb0`q`{NB3Yr8eVOSv<#iZmsdU3It20^@9@@)LGd=NBDFfT)XyAUfvwM zs(ZtC392djOg`n9rL1l!I;~Ny&5!WotO|apA1r|eLQ)d(C+t3)x_p-}I_G}Akbpf% zJ4?QG!=HbgtkCYGH|@Ze%P3)$E~Tf~Q@+d6C@(I3B_ABPA471fgJkS7FdD6@tV~Hy zM}W-9E|0L#pg4`y9sHXb%kS21VH_cXRtORf&Dg)cu>B9Pt-U0<4)A;Sp2E8)K?z2L zD02)26T`yb8X2m{0nwjp#&Od7=l@Z{+S;y`64-klP}Jz~y@io_=ZT|ah4~{{PT_Q{USI+~ujkrc-X8M-a_slQh{*DZagIvd$%V**kbw{X?fbegHQstsien`LChm-voEo+B!2xJPia;dYn0|Y^h{2=!5;IY zhg@S`^Iq{_&~;fo%Lgb-O}VjLLb2_l1>9Ype^)NQ1p)+*Pq`J(-^codqT#c1$}7pf zO8?E7MKez7JPYxU$p{DZLBGh%oME?kn|+#v;CunogSvVJ+^Vq*T`2-x;P@!E<8Fq9 z8tN!<8(P>sUwpPbL32Gvnzg-Pa|+qhxoK)J=)|oCo`magPti}T1wpI5TYSsG5CAn09WMW5Jx9$s4BSC3a!-BeE)#54kv z+qgKc36kVVZFFobHe1Z@fCH*U!p#d83SiobvU7E${vHcU(apd$&;?57YwPNuzlF+Ir66Lx%qk=-pmA!V#%FXa)j9CFf z!Aj_D?1qa)b8|CG=*zu_W1743HtDXmBD)FPs%NbUa$(4w7p3|&Fbn(+w&UQY;Gl)m z;~)5q0~%yvViJ9Hk9YshPX2Dx(OS7KETpj{Kv-sf5~m78c1nua&$A$3ypTBNaTQW}8mTlXom)B7ELw3%ql1yY@OYYi9x(*L8iRUJyrhc5D-IUbQ z@|oC4Rv3ZvzdGR17sUfSssbUV?U24WQ$&V@9NRyw$M*s-+3*{`?_gxz4w1#Cg7*(t zWBK_!?vbu1ZT|i|-Tn|~J%Lk-Ny}HK+5T_A!VMT507$=;5OC{et@w)zg+9OfQD7e> zNS1yAYX&-ek%ztg*v{{ch?V^AbDSSO?I#VM=Q79^-UAoJ#XHegcwP^elareo_4GU0 z3hqWqAeaShlskukd=3l^C92We{~33x-=URjW7wWP;q3ejucyFRY#Cl?{MHlh41)4X z9rW~z(6xei<6255`&K|1~ zIu_dd{pp8ZiM>2!kGI79Gst{z!5co9G?<4>1PPhGj`_%gv4AZ%biD@|bAt?NU5Qvq z@_8luU5V&K@qdA?RsH;FgWzIgaz{uQ++8yDwYB+luih~+86U3IX=KiGSgp!;aDr8n z-qLi4boq}rJ|xRKv#JOBm)L1zaRSy`~}RkRd$+UUii z^5#~XMF)%lD6d+2fD6QQ*l@12%yj=&OdPbB!OxyjSb-%EkXIM>W5>3TJ5EOc{X>sm z4I~Wg9&kEN3$723ydkXtm!B<}G14Mf&MSTHyP?o=Sv^mduL6!O9cMa5CWiGTFcR!x zUtG7kXSj=wB3wOzmZIy7;r&KA*`u87?~U)>n_m7@al_MIeA4JIr1iw?U3`3|g+b!_ zYSFfBIiGwFI?kR&0p_%plyi&Q4n$AAVNE#!!7OY}HklwoXj6P1GBsh!fxyOo4D~R6 z(;8!>qxh!50ZJf+?E#XV6UY?9Slm0gIR}VHZ;gY@-t{cwO?0JyTkY{w zLr(Z*zNB1O{Il_H`GxG4pC<_1Ocv=njyxd=yHY}aN;Oieq(JbsA+x@+08B~gc2ut2 zVrOG473e51PlPiet?PVa4*8D6jI^`~STsmTNT3~nr2&pHI7bHJ@t$JJRKMSx5C~5m zS|%o%!-tIx7Dq3&qx91k&c~4n>cQ(D+W$XQrWPQnTIz#X$kyi`W1>I*cfft;f)fdL zHGg2EG_fX^ctQNotB}_0|k?dH0zsp@8JIO2-j`r zIOE~NXF$=@&wjOwro?9;oayfgq{xa<|G-^}HGl;mOU80cOOXb=^onxg;^GK(2NMl9 zQWvZYC&$PCB_BPJf!BL}MTLo)8YkHKWV>+~z^Qp2$`~XUJ$o9FlXFH}luD7~#toj} zYAjLZnXLtXD@ae5B@#jZ3Z2YfIs}>QF2|*iYK%@ngTPgXF;ze0FW0UaA`hLt`Cc$2 zfTHGE0WPYk_p18xKK&Z_oi*pM`o}ij0F4_V=2m4%RaJtmMFt4ExK`bdTyBb0&fwaS zoSK@8m@#Qquud2b=7ulbI9_MgT(!6~^B`K$$iQIL%(;sb4GIcbDNJEgk>9&RU(8mf z+8Y*UZ{1~DQVpf%2JhR8Z*B%t!!?A{70lI{nvky8whYtus^1g^RufZDiAn3^SmpPX z+>pL@Z5NaUjJY=(TZ@bPo3-fqtOXw-wq|4P1&EZ$!L}@UYv{>J{_aSJF!~5+duwZX zG2TCC-k+3_?pzEMRJ(aiv zI%!DVb!BUe{G?%fvw>12Y7ubb`b35vS{J4ACtKFD)b}bmGxJw|gN2>TaD|^mm(ylU zAqbRnF_M1PKjAug$H?e=F2_+4q~v~x|D6kudgf2sC7^)sU3|9|fMTtpsv5<%9Ho4e z88%<|KvT4yabQW%v`rU@CKW1hl8c4qC!gOq{tdGOOV`4Mp#;=x;s-I^Z;3R#fozFF z!kJm|2y(FW$LuqgZm%jYdeHh%K%Enmh<0rz=9`~$Hty?}yZMpdmS4|!D_3$i;7xG8D zeM0Q?uuRJbUZZAYVWC15+|X}il)Nd!_V*_u8ZD0HEJHgG* zw#+#!@Bqd+j^zKWorNn6A$0p*byO9;?cZ>*JRHAm1NV!DX0ud3K1*lnPP2NiShXVqh` zT#z*c51k7{T(e~#e|`Ftc>mc+E-u~sIm~BIU9dD0vj~%z>J(FsUl9`*zsRE;)tO>x zv3k>z`8<`N*`(Ei(LbQC$VVtvx3qjlRTx7F4Qo=8Yf{p+>R`6w(gJLmhu5!{_(viS z*H}-_$j}g}uAsQZho7LOAeT6%B_+j9YR<%is}(k#E;`TB@GxBXA-8^zul>i56X>Yn zfPrf^*GIXY(z4Fws^{Vl`lW{g0=BB55-RD*M?Ha}PCFrgtI>(X{<474^6;=PF4BTq z-Sh{~%I0NH#S;nO>G)4idjcicPPwOh#s=RP1Y?#^(D#54obG`6XP!AHH#dSo;CGw$ z_3Kq|3a($@xYO3c{vi#}s<;J^XIO!asF zDmDgogPm;)GBY<97Y;u~ZuBL)cI}FL`81~L`*--}AusM`AP93`VJQ3dj?;Z9EQTfd z?c9S2oA_ zEf}8J`n}otZ*#YsqF*VcFcBy&#&AtdEAoz+|1L6)N^r-}T6U(66uv!FbiQXq)QS-m z4F$y~%`LU!H%&~`b^CP)MxD9B^>v|_=Kw6D$v)@Es1$kARH=G5JrCdEBS*M>FPq@F zbR2CM!DGbDxY_M6M+ER$^8138ca@p;;Lh~4G>3_%xle*jzHTs|QgYS;0=%}o+mGDT z-l2VX6xBEzTY;_+ZWV<1NI9^(9)Ht%^~U2tf8bmHash6{Lm;B21JAJyI~RLG;2F`| zw|(&^GfPm`Oj^qGON2iD9H65c8XO$z?+=fZ`ruiwt>c-XnHQ-#KlRL;%ho~V@{^cn zMLmGdL7LFae30_^myRfZU4PzyLH`?;1|jZ`des5h-8X+T!@ShAAxem9VTAvrh)9sj zJ4O{SQLhuZ)hM~x-&56A`meeGQa0^)yptp)!inzf5*iw`;~(i01m)&z5Exx?oVlD- za3rlG)yg2TPs`26*zX;taywXS-10SuC;+G@QbuyWoNSE%#D~QBqJ0)-ziqA(R~L7* zw!L$qFo(C;}T^%_cB(w`e^9aue%G@W<{wi$A^WjCl3e?8k zdN?Q(i8QQhkHKyrv?b}drlg2br5T?&$HF2-cO^tN{a$Ub3z3jlA9;pK?)vrY;4XI1 zyONfMg1Z_MrTa=OB_sy-*J5Cb+1wS<{T6U$N^-%b%c-mH74ypeTC)Pv&NR-qE)cLz z3^l)YK{BT0+R_Qa%0ja%w9!NXDD7auOH=!D?;L|r+-2g%Mju)dm*M#lFtar;I>+gi zI}<@8b=X+DMfgxoH#xaQddu>UH|?(MEG)4aIX%SwZdt^BcQy1O@yv97*l~15(HTx= zXAG)T2^2er1svBd5LA*vE8e8TI@N zaG|WLD=PGFb#b3Onf0J&7A$<`^Nw*FZwMz&2(q!^-t;-yufyQiwM)8TZEb5~o(GOq zxJiEtAos!Kx;skKxw!b8wUw2w_>Zdca$X*uyR780d6%`+)w#R|U5ORD{p;|vy0*P~ ziuNHfFNz%(*U6L6kZ<4qmxZmlN=MJgXui3zO+QP=&TiFwDg0k(k&X;!Yc!NEP?=<4nG9vyTSMLFiW&8gDtDd41GRq7_c4d{_ zZD+5fY}qR-dlV9qP4?!t$=*qly~*Bt@6G$Y>G!_>n>%Ok@{GQ+O8H?S< z`@anhuUlDehP-$X*Y4t{0crj750W6UU&ipU?0J7|SFCk0U=2+~vrDJBEwJZZ5iDWZC(0eeCu_*WuLeLI@g!1j{;o(S> zMBHa8svN*gxU9c|X_nA^Lf1*hf)=S==*Z?4`3h0#QSP z^q4?0^+ZI3SaVWNfObE>-oyub(5Q1Zcj1IQ@JXl(u`1tf0;0xOFO*}y6&MUOwT3E# zo=%A2_TFA=OA8g1+K9677f>2gpbsT&%k-3i=4zhSsZet6nb8Cb9-d&TFk`XiYbcQ- z2vdiBKf_(ne*NtUg31VBCskGKx0Nz?7sK@%zQzJ)m{s_Nq(qI2%d=-?EziCGbjbd? zndtBW1z+Or$Xq0YYRk3m8!HoxvfjQv|3P38h3DJ)`7<5$+l>CjJ{wtzf&RVT8eJNi zT$g9)|5-P+v&eeNsi7yV_cjogmvc$_ify+s=m7lwH7VJOx^I8!Mkc!s;I{raRnN}v z8$Dn%U(@5@AZ!_U%mj+nJvpW_LK!Tox#}z5zb9wd!Rl$r%NX+WKwRohbSQb*+wk}A zdXXLIvD-7n(&vFpNjJ1ES_%P}^XG?v|L1R9kEs@c)EE_o37=Chz5FK>Z}+L3oyn*s zx9nT)W#krR2#e13>icTv9~f(ynEFL=ve;NIPEX3O6$xhMNG|o6wS@Qf^vK%ielM{4 z{0B6VicnXv==IXMy(b-CLh0}L@-Znx$NvzuJS(HiJ)~ceJQGScX49is7`w;!wY2`7H2-L{rnWPxuRo=Fu7! z`Y{!Hrp9&_#+nr{76}#e!NlZ0K7b; zeJJgTm;iRc%qCaC$>k2uT209~zAD4+R2Y{)4g`M1K+7cn+_Q0gizAanXZj05HSxwdi+>6D+p77_fD;LdZnv|kmCmp5V4n*R#%Crd~Zg3 zQKiTZeWBoA?@4C>R|2qBo#a$2wON_~tun)Ik-k@jO#ln6w%fp^6jD<=fiS>GD6#R7 zhw}dY=}8&>6EUVscmxE(p>t5yK`-~?;yT!eHEiUnmTmT4u1S-jM(Ph79Mco-%T=s5 zzWsh<1*mj0+z*kNnJ~#WhK4V$_ge^qTXXFxg9O4fzJyG9MW#C&LN~8Ldtku#`@;OY zGiBtyVXnG3H5K_S;^|gRqEoIbMHM8Z`lbD*H6X6C7toec!d*5;B|uU|%&3u7)3GG#TFSTFS@yeYw&c>_|M z@>+}PRiq4sU+zrEC8YcWA`-F2N#mwFx$!Rq|@8T;-+KjANS?m9_4U&d)|0 zn23p^>3kwYD}*RRyf*Zx^k`b<^0x$ zE34wOG1@U|r4|uh8DvIABC=drNjE*?d$K&8O-4e3%0!NcT<^i{Pl-VRI9)ZaXK+BE z(CLiQ@W7u?CcC<_2zy}?eMBzu5rvz9H%AJ`&Pcw_Tm=9^IL-rA~Iia&S0Xb3rJDretTUyrfBce>J)3GQ&48 zn-voi0}xND)SLIKH)WOQ@bN3LG5)5fH^x5FdK8{1j^X`PI`8}8_U!NTZ4&?A!}TjE zxETM{*4Fy?@CAy2pj>odAoNj%Y}t@k;9<1RZGj9j_@-chmNVoKtPzssf+$pklemh? zz-+4*BaC+tiBn9e3oy?dM$yY_1jMvI2Vdn@0~yI zo`?U!BE%w)3Ly7S+xO&n{P;E`Wa2O=HsQtZEn08o zq|~eB-2+vp0JVy+{$a*Az$(^g)$vJ46v!pwhQ((xno^!fm+b)6FWly`XSI%xIj=;=}7aY91>QU0o}trqsB zsE+m-T%`d#2%@5>s25gz!hjE_0G?i zyeT#r%GZf1F9*VL!q>0TW@f8^Wr1J&+>b(__tBl3WvbE`a?1Jzud)KEc_G0}`D^|n zG)V#@Ftq33a?RvkM9-x+1>Ze~(FA+}2AP-V=n(*YvX}Na98oJXy=#901&oF!Tuyih zNXBj>y1H30Kr^IoCi7@>3lquom4L}d0z?v<#-g3($S`c&@$VkUQ_*EuUY%+{&R_$j z6WFb5FjI#K(Q;RPXH%2W$zhq~tSiM@t_D9R14Bvjbe%}k#s>H*tkQ__M%N_SquUl05HLA2V|#jhYnlF{e2`^F#Rv3V9$RMU z&m=uLSsS*8*+g>O*!tl5u$8JRX%Ue|iCG(r7Sz>GhKC*AudOalOsvA6=^jrUP`#Q0 z1w6)de31eStQ**_Vi+5{t1gT(U zbqanmoIw4t-}GWSrJ_>LeUZr1S9;o50^%>=2*!Ifbh( zKtQ7OfG*MZfn^|flv_O?nF0X9_;}vi#vpKy0^we;^7Ck(=_0!UA;<`{(5(@lWyQ9z zTv{VlIE?kg&99*$-^Rdzg#0vCNgSz(=qUAXeD9JK}_me}K&Sm-GNAE*}@7_Y$}&a$V7 zWu(A|5CeoP@(M?knxZ0Oc=O$xBCz1ihf9Sqz>a4Y0!BI(WNOGqpP@DjRtSf#by{j_ zwZl%+@86${Tu%;LDO`_Ls`a5#KR%`*A$B?8>=>;YVMYailfgpW?o=iZ9LJ-tV5c?t z?l1q@a*1|*F3=dOtNAlCGbQfhF5V`3mAadW+Y zZ?$BxF*)<+PdNV>PmPxB&_2LJY_g7a z+|K5byXr#96j`Hq+0Ea(e)5K^w}O&U&x=b+dL|~*h3ekFEGO{YL5E}Xg*l*0=#>FQ+z?uzJ!`8_TWG&NgdR|WB^FMR(8eWUEUb@U{OxP zyuhD=|2oFsU0(Ao9q>=>PCa1KI9-A^CBU*8{H#taUHQhowR66VhEXx>EkEC>8-%Bv( zzTE44ezu~G)pf|4cibxht6x_eyc&hH9GEM#M(yFb*UG*uXDPE@ctQ!D?sHy1ll@pb zfoz`uE>Uc8*9P1vw5}b%Xuv!Rsotj@zLhW%yKqm}~|h zI0{V$EI}l{X94g;Kyd)g9Wh&GWF17&larIA#6%E(FH4PSlikH9Y>hS{ss18bYh~m?Or34yPq1~{9%g2FS>uYsL=FGr^5=73)bivNbj#;!|6k&*IJt>4#f%8KWz z$9R8!`qV)7o_j)K^xaF<3I+m1;<2SwMcu7X1`Fe-|h6gX`pe8>MM!kw9VRu&bKpQHDXOtGoH-<_=gufm64=-F6IQ z;d*+hLh_L2Z*PnsLIFqw1Uq1E$y9?QXm?i^Aao$##`gpAg*?jhtI(-EI(j%d8dyuv z6leztjh6Jf={?Y>ot8LW}n?8#yd0R9syCG6Z(Qi?{FEQ$5+7j(@Jz%WcBW z-;2JkO}EduAiiM%u?RP`H79%LL$cR>%AU#C(Q|j$LpuOo0D< zAf3V|A0hV5k;;UGSg~K27_W@9h!1gM_vs%#{L|Q&z>eQzfAd=1$jAxwxWN=}3OsSEDl0)oSV>V)$QFe|jBf=# z|K#K^wrg;gxowP04e62}UqN%qgu1Q4U&Cy`@=t?4$YS8R9GQwrN>0vqs?W8XV`HrE zt-lkop-}XNwurG&hWQxztE#%x6y0hE0tt-Hj&V?FBmLiT)oXUV|D2JK;okT>t%l!M z>8B2CzZ%kPZ)MNP`yofneSA|OUbu0|gpWny1mQZT+~_y^>rm=AM(61nMEqyx)@c3c zeUC>fq*r{Uw`ne+Azin(3&WYVxb5Dx=BPENhXFD5WV0E3K7Yd+|Fmj-{^W}=ZyXB@ z>^r%@m{gJ`Njg2n492TaN$gzms)MyK3664r8LI|kSn#)mr0T7{es>HC5E7DISZLjw zp$2ta+T*&v`6ryFuf=p=EmcNGAH$K`4q?C7=2(WG>H5u^98bEU9_ws(CN0Ut3?5JU zyYrRM^9%HX*wybZ8&Kg&OG*|wlLJFI1_U=uhwb9auU&8&-24|7Ezz--Ehc{YfoPJy z#?IbYVpZ2#rtV3n9t4CiUNfEI?LZ_Qa4 zOp(?`9Jx3-<7VHT->E|FPBJuN(hmXx7%&M+cyZ)`prizHK|V}HtVP`&es*-cgHsG3 zIFPvf00wAPd{7lYp@u%zyB5? z7ED8Ua%5XlVs5J6FR4U8@lBw0b7R43eY}i}`)iIm@6wSd19O2}J|HPWxIA@h=a*`%Eie-$l5 zT1_;W)*ze-i>Ri&qo;PQIR+}9qQg*M1xHrOHPsFGl}z{w$ROAUEtT_F__; zz}tHqGcq!q53P#|@jD4L>wQ*|M0Qv?=eh~dh~uI03SB1(JUn9~qb`7%0I(H|4V7nq zg4qFJ00HyL0k&-|l5YXfINhTpC6$dR0nw)QbuSnNiHmD1DBuC_2(o;z42vV-VA~dP zaw4Vt)ta3Kxc1&xfQmmk^n=BHA80)!B;G;@T3TA2DWAPLC`fGAP5~eb|E#a6+3{Uh zBE66}EZE-{kAePBy~-!F@dbDsUMq*BmYCl~Gfnz^dHL{K+|~G?r=+_O8K7VD*<1X3 zA->C;fl2Xe&2b9V96k1wi?ZIWy{mU-cWn*ach)_wk6!+8y%)HQr64(5Yznkjn|N+b zT_{DK-1!0^VnPY`RYo+~lIw3A^nL5_)T50S$0ab5f|OO*2`$PZ4-Pz2QglQ8-`@T6 zKPnyCwFcJiiLdphRX2bpzH_Y1%PTx0TK*JxE~fg-=BgAhGc)Hnwbz`Da_TnSx81Au34=Nb zW@k{43v}WVJDd!;-uJ)>iish*z41b>M_G0~76;;#sZO`Sw3rMDi3CZMh|kn>U>FbDrI~lWg#8w|&O5xj6eZpH16#U{8+Q4Q6MW&@~R*jagIIwy5nXfooHE zpYj13%101qm!2k%lQD6h)7vvdlpu#Y;b0yPaa~?7>M)SLBnVB(D{u*+OkBCqK zb6WnhXkf976f+6j8y^}NxQ%FPY9eIWb=_GcpiEZE41+>Zl7{-}zP9K0A2+@iY{|=a zrMt>2bSua|LFz0n;80Un>9rDLlgygwbOWBf>+hXrCjryii9Beh=ee9z0{}gWC5QS{ zT-5(suG&#}e!h!{2#3G^E7rT`84TJu-WR_e$L)FR*_I;l;7<_rs+{gx!Cy8>4toh8 z&|Bmy(lf~^D5QWaZI2dx25~Bfb5LxI-O>6QYfUKqv4NMoO$zKo1+uwC2 zitp|g7mA!O736bRD#XBeyK&W}J&r$({Wcp0q+#H<)YfJOT?YsO6=3i8>eb)V69AWw z$zT{l*9RC^!c>8>57{_5=Pb*t=YaUUO4 zKSUr=MSM<66BYZD0`k*%2v~cdW|r8l2IL%#p4wC?S9!;5+r?>3GqY0=3-_s?gk!s` zYzL5{P`*Rowj3;J>zy~pYu#_$xbZaFr}^#l>@1U7`4^u;yA6b}7r1=O_Bum3Z`SkY zqtSA2Gj!4-AV|Z^;s(ZF5mZx(Mrnl8pu-KigK+%eAYjlU6}uc27zh|l`at}v|B=G{ z9|r6#?JQ1v%nT16sL?YeTmuO_9B(_QfBcx#f&rO(UWv77j$NY zn?e&Tr^+adN}XsK9LJL9(w@{$tWBETedF|Aw3_#*ZF#^}#A2`{eCji06@OVt?9Y?+ zIrOjp-A2%yJbgD5w}ouub9Z?Eju?2vtojqFr{p7lP1uFc@{CrDfF;UzTU5DHh)`}mt5-OcH%ci^c% zZw`~%-m#hgdJfc=je#SC4F}^t(8}{sfb%0bSV2({To(*luig@C29$rX$->-RcwF2W zJR@Mdj8@p11B}`S3kaz^t%{CTm6B=&dy>VJAl$pb=?IL*=4O~WUQ)s_FfmCiEe4b#yaRwh zH!&;bCMPWqHkC4*e|k_nBefCcyyo6GW2BJwWWcNTK~N&d41sSi4gx+N5DW!v9?}JZ z#L@>GRC9+fPD4>qatAUo^qccF;05a8@hdCKgq?jC$l@53;8h$Odjg6x)0R}>&7fu* z8w){14@&qvS?Fu9BbrK8rI?jLF@LzX_xb%N5NZj$?V!osbi#?YUIl5&x5w%rN2zuo zb$sK-sDg&3?WzeN|J7RmQH|YX@`^dYSABK9QxnVUWY<(%z|EB`J5Z-!09QN^dJ*B6 zCcxj66l@RevA;bT;;0eHoI+W}BP$Ee3tVADg}&dU&|Bcv=!^71hTP)z^ApzdLBV zpn^><%w=o%#%22NXKH!zFrN$&yavOu6NoWx#BU9doZ22<+V*3h)#!=I2_Q$XuQMCi z97qAeFT55>@%Jy?+IKpI41^$!D)2K7E)fx&Nn7RnZ1_p}C;1Hsm-dQq$(%w7yvr&69gRDX@E@HIWS)z!|%tUEo5Yiy%*Z^Mw;!MM@ zU-AUD(2^r4r>k^jNx%a4fcRp4^WKcm>gt5V8g0zIfB;`?a*yzuu)#imoS<(HIoQ}F zB^*UD7EoQtNa7??BL;qsH?1AAoKNjUXZnWGkR;czmf<=UKp)S1v~oQ&2GDEH&dS#F z9hRt)U;KiAg%-zd6f&1A-hBD;Wi>Uj!J?xNt54&g&tz>QQQh&Js&SyuFwI|PO*$s; za|@spEX%3UdM-(krqS|ptAC4H=QuXc+@0bd&|em7m#aIJZ@7E+S>11@N~e|4UvaJl zYaQQ}FqdT1ad)`B;&f$rvXAv3ogCj(==D4|i7s{epm8hIy@l+(um|d13Pmx_A=l?owSp<{05FT@D>z{)~jsVom zJx)*1>gt^MK49d5Llc~yRL67{ zgR3(x0{V6~)}?fGjUG53+%ytofG@h(Qws!ar2FU3pXcW}f%cUktx?^QfCXy`UVP6! zi~Ulrgfb@~J6q`#qWW{*z)wSJNLNKA75>ww?|L&vpa}wNUZRE{=#HS6E+Z_gyFNbp z;^qZ91}zR4IGE7F|A}baUPzj6+f)H;id6PCCRt1C&W#)2p(DGxJp97D3@x5qerBF+ zMAl@Fap>zfY6;aEO;WY^jxLj_B0`c{q-|Dr0s>Y`F4zf_u&`QR+j+5LtAZ--kZG`}eMl){jwn{M|hf z6jqutHiu@9Q3U{il$2DSKj*}EJcLtesu>@3K}f5`#T%ruY0zo|Sr#tc{8v2W*uZ6h zmu$bMC$Ei-jereB&$aY)3PL81#}lFEa2lN%pRNCR2|W={V;!9-3`!tMdf;GUT4kg> zAyJWuSsY68TIxx6@dyBJ#*ZHY8EOxY*F!`AvN@XuCpQj4Qj(7`B|5-O13N)WPDxiP z`sw~?)o18#Ie!;)aiO$%r1g=rI^crghrA`PzzVh1P;CNxoOz{wyLkDO6A>q;C{6HP zd~5erAVOn5GC9hjzDXcny|2|lYCoXNG2YbJn1+?y)y{mVH}dxj4(?rm#=VQ$h}o!UN!UzUv~E>?rkp<;*5jbgGiBN z+^J(6A0DSESNuba^T3KcLFF^?5B8cO8fPb>PY>&VIXkmBv0}sGC$+J{BlL(T5#k4}jmRgx*(Q%QSTrL16F({>? zUgIHvFn^sA*BgW`N`EpEkf+`AfY=_3qit$BGt=vj14xv{`FR5{fJFf%uqc7al?1Ub z4zwz>rEI|P-3bPD>?e=V7C!-Q2*O)m&dAmVD1(ozbn9!w(3PwVb-6&i$D6i1_;}UT z@~IKS%VVDRCTGwF7%HLYBFk8W1dhwLxZ)jfD$!(bm41?XU4HTcqfzXpqmu<+V7PO_ z)~a(_y1O))Y5El`FDZ<&tu=-EHpi7gHfoPbiS}}vIg111k~O~PWNgNR^Oy=IBlgi; z`w0;bDDUr$G}DF?-A3GO;pSX;GQ~X#pqL&ba6&O2t=!1hAyQ!^98o#HKzbmK2*8g| zN=t(V1dJnZc)~am^`(q@a1n6-Xx7DEQC*FtrXVOtL+A^_EB6EO0mcWKY+$pS^iuI) zA#Fnuy?)jXW~)A5T_j9X_`t{=Atv;z0LGX=(m|jAUgkB~i4MCGYAR2U;Z`SSRFUiXAWa~#q?1a+rNEs*S&Tf00?TO)(hW(6b?d!5t4*p zCA?O{^Yp2Z#RO808tL$}%!&vo=Ws>Pm+j~v0gROKX&QzAElu#k948|^J;(j&mj}C< z%5{W{`vq2WVB4eNAbWw#Knq#uNZ7i4J6Aa;8q}dyR#&sq(yGkI?m__&4$t-1q^(Ts zINlvJsVzI9`h+qi`7bxJG!uh0l&;;*NO!b(ln z1MX)?&le3s)4_v&evg2=E_EK4g8_51*Dl4x5Nb3ZS+p}Kf+48Fj|Z;$Edi4LFrh|L~DH(S~*-ok5hUMGo<~Y|=*Ci@`$K6UtTO!cH&4^tGBnS}; z75HO=8i>Lbep3LVCAKRu(e-*6_O8UpB26>VYD4`@YW zrG2<)83GMnOUDm}XWe}D{Yku&41Dje+Frj?<^H*uRUX#`Ld2icl@H2@wHgfm)P&lB zGW&$^_N;HO^0QB5nUz`jYXTOBhkskHe(5AgRj)bdIBfN5Dk(HHEtn7AxH@2g-FBiX zA5!-=y@aIHtA4g`8nyF`uBt(oaj@VO{pAmhaJ3+24^pkd=YtkBH<>yt7XfT2a9q&& z1I2_efG?KFetz2YpeKnsGHLKBH3qALcxUZL{<^w2277h1CfF&!3&T(2AvfP$1{j32 zav{k5JdhwPHq=o*r3dO6up@1Nl-y(HsAv=C=~+KmlnF`(>GOIzI0{pf?TSeb)q=u|=cP;BR#saWl-;Q(JhrQ(0MnaCi9(o@dv`S@q4wZtO`%Zah?z0$MSEgum1lys<1m}6Fsi6lS!^Yj-~R3(n2rVFp9OG#z5HruYwt!}d|i|M1k zL0~9>{hE>V9@*~rtP3yi$|kQX@lZ{Te#vG*OC0a+YH!VpEsf!4d@q9HBryy}_OO}U zf3xpG4IIw_VQC0R2!Yf~l>jdagN{Q$z>xJEYK)1t@0#aM(E(y_;9n(Zk@0Z7;Cn`< zFEQ$C0!&&bXEl3DUz@|vdi(nghj!6tWNzJx4iDG&Cm(^Q<>Yj2Ze|9=nc)lz&HbtX z(f|y~%#eDwG&N0H79m9lec82t<=v+K1lkUBb42iM&X#X%;68$2KRDCUGBHU(3|v?M zA_<*3@VNzLJIefXUssk+3X(`mtHnf@&;H-Rw-bSHJ+PFv0U`z<)bPd^pqmIykeU

    AI Investment Analysis - Private Zero-Trust Architecture @@ -144,44 +146,52 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p > See [`_assets/ZERO_TRUST_ARCHITECTURE.md`](_assets/ZERO_TRUST_ARCHITECTURE.md) for a full breakdown of the topology above. -#### Deploy with a Windows jumpbox (RDP) +#### Deploy -[![Deploy to Azure (Windows jumpbox)](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) [![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain.json) -#### Deploy with a Linux jumpbox (SSH) - -[![Deploy to Azure (Linux jumpbox)](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain-linux.json) -[![Visualize](https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/1-CONTRIBUTION-GUIDE/images/visualizebutton.svg?sanitize=true)](http://armviz.io/#/?load=https%3A%2F%2Fraw.githubusercontent.com%2Fsaadmsft%2FAgentic-AI-Investment-Analysis-Sample%2Fmain%2Finfra%2Fbicep%2Fmain-linux.json) - ### Before you click 1. **Create (or pick) a resource group** in your target subscription — the template deploys at resource-group scope. -2. **Choose your jumpbox credential** if you keep the default `deployJumpbox=true`: - - **Windows template** — supply a `jumpboxAdminPassword` (12–123 chars; at least three of lowercase, uppercase, digit, special character). - - **Linux template** — paste the contents of `~/.ssh/id_rsa.pub` (or any OpenSSH public key) into `jumpboxAdminPublicKey`. - Leave the credential empty only if you set `deployJumpbox=false`. -3. **Pick locations** that have capacity for Azure AI Foundry models (e.g. `swedencentral`, `eastus2`) for `aiFoundryLocation`. +2. **Have a `/26` CIDR ready** for the workload VNet. The customer's network team must allocate it from a range that does **not** overlap any peered VNet. It will be split into two `/27` subnets (App Service + Private Endpoints). +3. **Have peering in place** (ExpressRoute / VPN / hub VNet) before you try to run scripts 2 + 3 — the private ACR and App Service are not reachable from the public internet. +4. **Pick locations** that have capacity for Azure AI Foundry models (e.g. `swedencentral`, `eastus2`) for `aiFoundryLocation`. ### Key parameters -| Parameter | Default | Description | -| ----------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------- | -| `namePrefix` | `invstdemo` | Prefix used for all resource names | -| `environment` | `dev` | Environment tag (`dev`, `staging`, `prod`) | -| `location` | resource group location | Region for most resources | -| `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | -| `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + internal ACA). Set `false` for a public, demo-only topology. | -| `deployJumpbox` | `true` | Deploy a jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | -| `jumpboxAdminPassword` | _(empty)_ | **Windows template only** — required when `deployJumpbox=true`. 12–123 chars, complexity rules apply. | -| `jumpboxAdminPublicKey` | _(empty)_ | **Linux template only** — required when `deployJumpbox=true`. OpenSSH public key. | -| `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client RDP tunneling) | -| `vnetAddressPrefix` | `10.50.0.0/16` | VNet CIDR when `isPrivate=true` | - -> **Note:** The portal one-click flow provisions the Azure infrastructure only. After the deployment finishes, build and push the container images and roll out the apps with the helper scripts: +| Parameter | Default | Description | +| ------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------- | +| `namePrefix` | `invstdemo` | Prefix used for any resource whose name is not explicitly overridden (see below) | +| `environment` | `dev` | Environment tag (`dev`, `staging`, `prod`) | +| `location` | resource group location | Region for most resources | +| `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | +| `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + private App Service). Set `false` for a public, demo-only topology. | +| `vnetAddressPrefix` | **required** | `/26` CIDR for the workload VNet (e.g. `10.123.45.0/26`). Required even when `isPrivate=false` (placeholder is fine). | + +#### Custom naming convention (optional) + +Every resource also accepts an explicit `*NameOverride` parameter so customers with their own CAF / corporate naming standard can plug exact names in: + +| Override parameter | Resource | +| ------------------------------------- | --------------------------------------- | +| `vnetNameOverride` | Virtual Network | +| `userAssignedIdentityNameOverride` | User-Assigned Managed Identity | +| `logAnalyticsWorkspaceNameOverride` | Log Analytics workspace | +| `appInsightsNameOverride` | Application Insights | +| `amplsNameOverride` | Azure Monitor Private Link Scope | +| `storageAccountNameOverride` | Storage account (3-24 lowercase alnum) | +| `cosmosAccountNameOverride` | Cosmos DB account | +| `containerRegistryNameOverride` | Azure Container Registry | +| `appServicePlanNameOverride` | App Service Plan | +| `aiFoundryBaseNameOverride` | AI Foundry base (≤ 12 lowercase alnum) | + +Any override left empty falls back to the default `--` pattern, so existing deployments are unaffected. A worked example is in [`infra/bicep/main.investcorp.example.bicepparam`](infra/bicep/main.investcorp.example.bicepparam). + +> **Note:** The portal one-click flow provisions the Azure infrastructure only. After the deployment finishes, build and push the container images and roll out the apps with the helper scripts — **run them from a workstation peered to the workload VNet**: > > ```bash -> ./infra/2-build-and-push-images.sh -g +> ./infra/2-build-and-push-images.sh -r > ./infra/3-deploy-apps.sh -g > ``` > @@ -189,12 +199,17 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p ### 📘 Full private-deployment documentation -The end-to-end reference for the zero-trust topology — every parameter, module, subnet, Private DNS zone, RBAC assignment, app setting, and operational runbook — lives in [`docs/PRIVATE_DEPLOYMENT.md`](docs/PRIVATE_DEPLOYMENT.md). Use it when you need to: +Two references are maintained: + +- [`docs/PRIVATE_DEPLOYMENT.md`](docs/PRIVATE_DEPLOYMENT.md) — engineering-grade reference. Every parameter, module, subnet, Private DNS zone, RBAC assignment, app setting, and operational runbook. +- [`docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md`](docs/CUSTOMER_DEPLOYMENT_INVESTCORP.md) — **customer-facing deployment package** (InvestCorp template, reusable for any customer): resource inventory + SKUs, monthly cost estimate, network requirements, operator workstation prerequisites, outbound URL whitelist for bootstrap, temporary changes required during bootstrap (e.g. `AcrPush` RBAC, optional ACR public toggle), RBAC summary, step-by-step runbook, post-deploy verification, hand-off checklist, and instructions for plugging in a custom naming convention. + +Use them when you need to: -- Customize VNet sizing, subnets, or NSG rules +- Customize the `/26` split or NSG rules - Understand which roles are granted to the workload UAMI and the deployer - Switch between `isPrivate=true` (zero-trust) and `isPrivate=false` (public demo) -- Operate the jumpbox + Azure Bastion access plane (Windows VM, RDP via Bastion) +- Set up DNS forwarding from your peered network so private FQDNs resolve correctly - Troubleshoot private-endpoint, DNS, or image-pull issues ## �📦 Prerequisites diff --git a/_assets/ZERO_TRUST_ARCHITECTURE.md b/_assets/ZERO_TRUST_ARCHITECTURE.md index 2f1cfb8..5a707fd 100644 --- a/_assets/ZERO_TRUST_ARCHITECTURE.md +++ b/_assets/ZERO_TRUST_ARCHITECTURE.md @@ -1,9 +1,11 @@ # Zero-Trust Architecture -End-to-end view of the Agentic AI Investment Analysis sample deployed with `isPrivate=true`. Every PaaS data plane is reached through a Private Endpoint inside a customer-owned VNet; there is no public DNS record for any workload. The only public surface is the Azure Bastion control-plane TLS endpoint used by operators. +End-to-end view of the Agentic AI Investment Analysis sample deployed with `isPrivate=true`. Every PaaS data plane is reached through a Private Endpoint inside a customer-owned VNet; there is no public DNS record for any workload. There is **no public ingress on the workload** — operators connect from the customer's own peered network (ExpressRoute, VPN, or hub VNet). ## Logical view +See the rendered diagram in [zero-trust-architecture.mmd](zero-trust-architecture.mmd). Inline source: + ```mermaid flowchart LR classDef pub fill:#ffe0e0,stroke:#cc0000,color:#000 @@ -14,45 +16,33 @@ flowchart LR classDef obs fill:#e0f7fa,stroke:#006064,color:#000 classDef id fill:#fde7f3,stroke:#ad1457,color:#000 - Op([Operator / Developer]):::pub + Op([Operator / Developer
    on peered network]):::vnet Internet([Public internet]):::pub subgraph RG[Azure Resource Group] - subgraph VNet["VNet 10.50.0.0/16 (hub)"] + subgraph VNet["Workload VNet · customer-supplied /26"] direction TB - subgraph S_Bastion[AzureBastionSubnet] - Bastion[Azure Bastion
    Standard SKU
    *only* public IP]:::pub - end - subgraph S_Jump[snet-jumpbox] - Jump[Windows jumpbox VM
    no public IP
    UAMI attached]:::vnet - end - subgraph S_Aca["snet-aca-infra (delegated)"] - ACA[Container Apps Environment
    workload profiles · internal=true]:::app - APIApp[API container app
    ingress: internal :8090]:::app - WebApp[Web container app
    ingress: internal :8080]:::app + subgraph S_Svc["snet-services /27 · delegated Microsoft.Web/serverFarms"] + VnetInteg[App Service VNet integration
    all egress routed to VNet]:::vnet end - subgraph S_Pe[snet-pe] + subgraph S_Pe[snet-pe /27] + PE_Api((PE · API App)):::pe + PE_Web((PE · Web App)):::pe PE_Acr((PE · ACR)):::pe PE_Cos((PE · Cosmos)):::pe PE_Blob((PE · Blob)):::pe PE_Ai((PE · AI Foundry)):::pe PE_Ampls((PE · AMPLS)):::pe - PE_Acs((PE · App Config
    optional)):::pe - end - subgraph S_Build[snet-build · reserved] - Build[ACR Tasks / private build agents
    future use]:::vnet - end - subgraph S_Mgmt[snet-mgmt · reserved] - Runner[Self-hosted CI/CD runner
    future use]:::vnet end end subgraph PaaS[Private PaaS · publicNetworkAccess = Disabled] + APIApp[API App Service
    DOCKER · public=Disabled]:::app + WebApp[Web App Service
    DOCKER · public=Disabled]:::app ACR[Azure Container Registry
    Premium · admin disabled]:::data Cosmos[Cosmos DB
    disableLocalAuth=true]:::data Storage[Storage Account
    allowSharedKeyAccess=false]:::data AI[Azure AI Foundry
    + OpenAI gpt-4.1-mini]:::data - AppConfig[App Configuration
    optional]:::data end subgraph Obs[Observability via AMPLS] @@ -62,70 +52,66 @@ flowchart LR end subgraph Identity - UAMI[User-Assigned Managed Identity
    AcrPull/Push · Storage Blob · Cosmos Data Contributor · RG Contributor]:::id + UAMI[User-Assigned Managed Identity
    AcrPull/Push · Storage Blob · Cosmos Data Contributor · Azure AI User]:::id end - PDNS[(Private DNS Zones
    · documents.azure.com
    · blob.core.windows.net
    · azurecr.io
    · openai / cognitiveservices / services.ai
    · azconfig.io
    · monitor / oms / ods / agentsvc)]:::vnet + PDNS[(Private DNS Zones
    · azurewebsites.net
    · documents.azure.com
    · blob.core.windows.net
    · azurecr.io
    · openai / cognitiveservices / services.ai
    · monitor / oms / ods / agentsvc)]:::vnet end - %% Operator path - Op -- HTTPS 443 --> Bastion - Bastion -- SSH via tunnel --> Jump - Jump -- docker push / az deploy --> PE_Acr - Jump -- browser tunnel --> WebApp + %% Operator path — via customer peering + Op -- HTTPS via peering --> PE_Web + Op -- docker push / az deploy --> PE_Acr - %% App runtime path - WebApp -- HTTP internal --> APIApp - APIApp -- AAD token --> PE_Cos - APIApp -- AAD token --> PE_Blob - APIApp -- AAD token --> PE_Ai - APIApp -- optional --> PE_Acs + %% App egress via VNet integration + WebApp -- VNet integration --> VnetInteg + APIApp -- VNet integration --> VnetInteg + VnetInteg -- AAD token --> PE_Cos + VnetInteg -- AAD token --> PE_Blob + VnetInteg -- AAD token --> PE_Ai + VnetInteg -- image pull --> PE_Acr %% Private Endpoints map to PaaS + PE_Api -. private link .-> APIApp + PE_Web -. private link .-> WebApp PE_Acr -. private link .-> ACR PE_Cos -. private link .-> Cosmos PE_Blob -. private link .-> Storage PE_Ai -. private link .-> AI - PE_Acs -. private link .-> AppConfig PE_Ampls -. private link .-> AMPLS AMPLS --- LA AMPLS --- AppI APIApp -. telemetry over AMPLS .-> PE_Ampls WebApp -. telemetry over AMPLS .-> PE_Ampls - ACA -. logs .-> PE_Ampls %% DNS resolution - Jump -. DNS .-> PDNS - APIApp -. DNS .-> PDNS - WebApp -. DNS .-> PDNS + VnetInteg -. DNS .-> PDNS + Op -. DNS via peering .-> PDNS %% Identity attachments UAMI -. federated on .-> APIApp UAMI -. federated on .-> WebApp - UAMI -. federated on .-> Jump %% Public boundary Internet -- blocked · no DNS --> ACR Internet -- blocked · no DNS --> Cosmos Internet -- blocked · no DNS --> Storage Internet -- blocked · no DNS --> AI - Internet -- blocked · no DNS --> ACA - Internet -- allowed only to --> Bastion + Internet -- blocked · no DNS --> APIApp + Internet -- blocked · no DNS --> WebApp ``` ## Request paths ### Operator deploy flow -1. Operator opens browser → **Azure Bastion** (HTTPS 443, Azure-hosted TLS). -2. Bastion proxies RDP to the **Windows jumpbox VM** inside `snet-jumpbox`. -3. Jumpbox uses its UAMI to: - - `docker push` to the private **ACR** via PE (`privatelink.azurecr.io`). - - `az deployment group create` for the API / Web container app bicep. -4. Container Apps control plane validates + schedules revisions; image pull happens over the ACR private link. +1. Operator workstation sits on a network that is **peered to the workload VNet** (ExpressRoute, site-to-site VPN, or hub VNet). DNS for `*.privatelink.azurecr.io`, `*.privatelink.azurewebsites.net`, etc. resolves to the workload's private endpoints via the linked private DNS zones. +2. From the workstation: + - `docker push` to the private **ACR** via PE (`privatelink.azurecr.io`), **or** `az acr build` (ACR Tasks). + - `az deployment group create` for the API / Web app Bicep templates. +3. App Service control plane validates + deploys; image pull happens over the ACR private link from the App Service VNet integration subnet. ### Application runtime flow -1. Operator tunnels browser traffic through Bastion to the **Web app**'s internal FQDN (`*...azurecontainerapps.io`, resolved to the ACA env's static IP via the auto-linked private DNS zone). -2. Web app calls the **API app** over the internal ACA ingress. +1. Caller (peered network) reaches the **Web app**'s private FQDN (`.azurewebsites.net`) which resolves to the inbound private endpoint in `snet-pe`. +2. Web app calls the **API app** via its private endpoint over the VNet. 3. API app requests an Entra ID token via the mounted UAMI (`AZURE_CLIENT_ID`) and calls: - **Cosmos DB** → PE `Sql` · zone `privatelink.documents.azure.com` - **Storage blob** → PE `blob` · zone `privatelink.blob.` @@ -134,58 +120,29 @@ flowchart LR ## Subnet layout -| Subnet | CIDR | Purpose | -|---|---|---| -| `snet-aca-infra` | /23 | Delegated to `Microsoft.App/environments` — ACA internal VNet integration | -| `snet-pe` | /26 | All Private Endpoints (ACR, Cosmos, Blob, AI Foundry, AMPLS, App Config) | -| `snet-jumpbox` | /27 | Jumpbox NIC (no public IP) | -| `AzureBastionSubnet` | /26 | Required name for Azure Bastion | -| `snet-build` | /27 | Reserved for ACR Tasks / private build agents | -| `snet-mgmt` | /27 | Reserved for self-hosted CI/CD runners | +The customer supplies a single **/26** (64 IPs) for the workload VNet. It is split into two equal /27 subnets via `cidrSubnet()`: -## Zero-trust controls checklist - -| Control | Enforced at | -|---|---| -| No public data-plane access | `publicNetworkAccess=Disabled` on Cosmos, Storage, ACR, AI Foundry, Log Analytics, App Insights, App Config | -| No shared-key / local auth | `allowSharedKeyAccess=false` (Storage), `disableLocalAuthentication=true` (Cosmos), `adminUserEnabled=false` (ACR), `disableLocalAuth=true` (LA, AppI, AI Foundry, App Config) | -| Managed-identity-only workload auth | UAMI with scoped AcrPull/Push, Storage Blob Data Contributor, Cosmos Data Contributor, Azure AI User, RG Contributor (jumpbox) | -| Internal app ingress | ACA env `internal=true`, both container apps `ingressExternal=false` | -| Restricted CORS | `ALLOW_ORIGINS` env-driven (no `*` in private mode) | -| Private DNS | All PaaS resolution via customer zones linked to the VNet | -| Telemetry isolation | App Insights + Log Analytics scoped to an AMPLS with `PrivateOnly` ingestion + query | -| NSGs | Per-subnet deny-by-default with explicit Bastion + PE 443 allow rules | -| Single public surface | Azure Bastion Standard — one public IP for operator access only | - -## Dual-mode (`isPrivate` flag) +| Subnet | CIDR | Purpose | +| --------------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------- | +| `snet-services` | /27 (offset 0) | Delegated to `Microsoft.Web/serverFarms` — App Service VNet integration; `Microsoft.CognitiveServices` service endpoint for AI Foundry | +| `snet-pe` | /27 (offset 32) | All Private Endpoints — App Service inbound, ACR, Cosmos, Blob, AI Foundry, AMPLS | -The same bicep can also deploy the original public demo topology by passing `isPrivate=false` to [`main.bicep`](../infra/bicep/main.bicep): +> Sizing note: /27 yields ~27 usable IPs per subnet. The App Service VNet integration subnet needs roughly 2× the worst-case instance count. If autoscale beyond ~10 instances per plan is expected, request a larger CIDR from the customer. -```mermaid -flowchart LR - classDef pub fill:#ffe0e0,stroke:#cc0000,color:#000 - classDef app fill:#d6f5d6,stroke:#2e7d32,color:#000 - classDef data fill:#f0e6ff,stroke:#6a1b9a,color:#000 +## Zero-trust controls checklist - Dev([Developer laptop]):::pub - User([End user]):::pub - - subgraph PublicRG[Public demo mode] - ACR[ACR · admin enabled]:::data - ACAExt[Container Apps Env · external ingress]:::app - API[API app · *.azurecontainerapps.io]:::app - Web[Web app · *.azurecontainerapps.io]:::app - Cosmos[Cosmos · public]:::data - Storage[Storage · public]:::data - AI[AI Foundry · public]:::data - end +| Control | Enforced at | +| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| No public data-plane access | `publicNetworkAccess=Disabled` on App Service apps, Cosmos, Storage, ACR, AI Foundry, Log Analytics, App Insights | +| No shared-key / local auth | `allowSharedKeyAccess=false` (Storage), `disableLocalAuthentication=true` (Cosmos), `adminUserEnabled=false` (ACR), `disableLocalAuth=true` (LA, AppI, AI Foundry) | +| Managed-identity-only workload auth | UAMI with scoped AcrPull/Push, Storage Blob Data Contributor, Cosmos Data Contributor, Azure AI User | +| Private app ingress | App Service `publicNetworkAccess=Disabled`; reachable only via private endpoints in `snet-pe` | +| Restricted CORS | `ALLOW_ORIGINS` env-driven (no `*` in private mode) | +| Private DNS | All PaaS resolution via customer zones linked to the VNet | +| Telemetry isolation | App Insights + Log Analytics scoped to an AMPLS with `PrivateOnly` ingestion + query | +| NSGs | `snet-pe` permits inbound 443 from VirtualNetwork only; `snet-services` permissive within VNet for App Service integration | +| No public surface | No Bastion, no jumpbox, no public IPs — operator access requires customer peering | - Dev -- docker push --> ACR - User -- HTTPS --> Web - Web -- HTTPS --> API - API --> Cosmos - API --> Storage - API --> AI -``` +## Dual-mode (`isPrivate` flag) -In this mode there is no VNet, no private endpoints, no jumpbox, and no AMPLS — useful for quick demos but not for production. +The same Bicep can also deploy the original public demo topology by passing `isPrivate=false` to [`main.bicep`](../infra/bicep/main.bicep) (a placeholder `vnetAddressPrefix` like `10.0.0.0/26` is still required by the parameter signature but is unused). In this mode there is no VNet, no private endpoints, and no AMPLS — useful for quick demos but not for production. diff --git a/_assets/zero-trust-architecture.mmd b/_assets/zero-trust-architecture.mmd index 9803cf6..18c2c5c 100644 --- a/_assets/zero-trust-architecture.mmd +++ b/_assets/zero-trust-architecture.mmd @@ -8,46 +8,34 @@ flowchart LR classDef id fill:#fde7f3,stroke:#ad1457,color:#000,stroke-width:1.5px classDef dns fill:#f5f5f5,stroke:#616161,color:#000,stroke-width:1.5px - Op([Operator / Developer]):::pub + Op([Operator / Developer
    on peered network]):::vnet Internet([Public internet]):::pub subgraph RG["Azure Resource Group"] direction LR - subgraph VNet["VNet · 10.50.0.0/16"] + subgraph VNet["Workload VNet · customer-supplied /26"] direction TB - subgraph S_Bastion["AzureBastionSubnet /26"] - Bastion["Azure Bastion · Standard
    (only public IP)"]:::pub + subgraph S_Svc["snet-services /27
    delegated: Microsoft.Web/serverFarms
    serviceEndpoint: Microsoft.CognitiveServices"] + VnetInteg["App Service VNet integration
    (all egress routed to VNet)"]:::vnet end - subgraph S_Jump["snet-jumpbox /27"] - Jump["Windows jumpbox VM
    no public IP · UAMI"]:::vnet - end - subgraph S_Aca["snet-aca-infra /23 · delegated"] - ACA["Container Apps Environment
    workload profiles · internal=true"]:::app - APIApp["API container app
    internal :8090"]:::app - WebApp["Web container app
    internal :8080"]:::app - end - subgraph S_Pe["snet-pe /26 · Private Endpoints"] + subgraph S_Pe["snet-pe /27 · Private Endpoints"] + PE_Api(("PE
    API App")):::pe + PE_Web(("PE
    Web App")):::pe PE_Acr(("PE
    ACR")):::pe PE_Cos(("PE
    Cosmos")):::pe PE_Blob(("PE
    Blob")):::pe PE_Ai(("PE
    AI Foundry")):::pe PE_Ampls(("PE
    AMPLS")):::pe - PE_Acs(("PE
    App Config")):::pe - end - subgraph S_Build["snet-build · reserved"] - Build["ACR Tasks / build agents"]:::vnet - end - subgraph S_Mgmt["snet-mgmt · reserved"] - Runner["Self-hosted CI/CD runner"]:::vnet end end subgraph PaaS["Private PaaS · publicNetworkAccess=Disabled"] - ACR["Azure Container Registry
    Premium · admin disabled"]:::data + APIApp["API App Service · P0v3 Linux
    DOCKER · public=Disabled"]:::app + WebApp["Web App Service · P0v3 Linux
    DOCKER · public=Disabled"]:::app + ACR["Azure Container Registry · Premium
    admin disabled · public=Disabled"]:::data Cosmos["Cosmos DB
    disableLocalAuth=true"]:::data Storage["Storage Account
    allowSharedKeyAccess=false"]:::data - AI["Azure AI Foundry
    + OpenAI gpt-4.1-mini"]:::data - AppConfig["App Configuration
    optional"]:::data + AI["Azure AI Foundry · S0
    + gpt-4.1-mini · GlobalStandard 100
    networkAcls: Deny · VNet rule snet-services"]:::data end subgraph Obs["Observability via AMPLS"] @@ -60,43 +48,40 @@ flowchart LR UAMI["User-Assigned Managed Identity
    AcrPull/Push · Storage Blob ·
    Cosmos Data Contributor · Azure AI User"]:::id end - PDNS[("Private DNS Zones
    documents · blob · azurecr
    openai · cognitiveservices · services.ai
    azconfig · monitor · oms · ods · agentsvc")]:::dns + PDNS[("Private DNS Zones
    azurewebsites · documents · blob · azurecr
    openai · cognitiveservices · services.ai
    monitor · oms · ods · agentsvc")]:::dns end - Op -- "HTTPS 443" --> Bastion - Bastion -- "RDP tunnel" --> Jump - Jump -- "docker push / az deploy" --> PE_Acr - Jump -- "browser tunnel" --> WebApp + Op -- "HTTPS via peering
    (ExpressRoute / VPN / hub VNet)" --> PE_Web + Op -- "docker push / az deploy" --> PE_Acr - WebApp -- "HTTP internal" --> APIApp - APIApp -- "AAD token" --> PE_Cos - APIApp -- "AAD token" --> PE_Blob - APIApp -- "AAD token" --> PE_Ai - APIApp -- "optional" --> PE_Acs + WebApp -- "VNet integration" --> VnetInteg + APIApp -- "VNet integration" --> VnetInteg + VnetInteg -- "AAD token" --> PE_Cos + VnetInteg -- "AAD token" --> PE_Blob + VnetInteg -- "AAD token" --> PE_Ai + VnetInteg -- "image pull" --> PE_Acr + PE_Api -. "private link" .-> APIApp + PE_Web -. "private link" .-> WebApp PE_Acr -. "private link" .-> ACR PE_Cos -. "private link" .-> Cosmos PE_Blob -. "private link" .-> Storage PE_Ai -. "private link" .-> AI - PE_Acs -. "private link" .-> AppConfig PE_Ampls -. "private link" .-> AMPLS AMPLS --- LA AMPLS --- AppI APIApp -. "telemetry" .-> PE_Ampls WebApp -. "telemetry" .-> PE_Ampls - ACA -. "logs" .-> PE_Ampls - Jump -. "DNS" .-> PDNS - APIApp -. "DNS" .-> PDNS - WebApp -. "DNS" .-> PDNS + VnetInteg -. "DNS" .-> PDNS + Op -. "DNS via peering" .-> PDNS UAMI -. "federated" .-> APIApp UAMI -. "federated" .-> WebApp - UAMI -. "attached" .-> Jump Internet -- "blocked" --> ACR Internet -- "blocked" --> Cosmos Internet -- "blocked" --> Storage Internet -- "blocked" --> AI - Internet -- "blocked" --> ACA - Internet == "allowed" ==> Bastion + Internet -- "blocked" --> APIApp + Internet -- "blocked" --> WebApp diff --git a/_assets/zero-trust-architecture.png b/_assets/zero-trust-architecture.png index 55a46fde2ceb7964916e8e317963a77d34673a13..791d83031d00a9f171102ba21052d4e23cd92321 100644 GIT binary patch literal 396188 zcmdqJcT|(v+b$e+6cqtc0i{Y9k&aRY1e793mEJ+=9i;^b0cTKY0wTSO7)g(XrI(bM)t-~^}=eIW;wQTdp7W1j? zXXWx6l2&c3tO$}eJ3riZP@>%JX4a2nk(w94*Zp<8OnxkwNB;8@1hTe&{^-}ImyB;4 zsD6EF`SL%UDl4sqK=w4bbX?8N<#hE<{e4%1UPhh+*T=}#&fokXt~K%TbYzre!gpGt zFt2|;ca26)q277mhne2s?@`AWjvz<=Pwfp`#t=ULe$2$Y=t9(i+Z&djw?WHNSap z7HP_A?@hnSuOh9jxs8EcluY7ogN2Pa)EoX6(@i+1kxM3(oqBqDS)K$X4UM~k*7-pp zA+2~YSCE&EAtV9HlV`tlkqkm^jw z4;2CC87<}Gej@mm2NmDz2T#lmvZe~o6R=dYJhn{N_cnTwMmo9CS0m>-$i991mbpAo z?@x9+>-`v-bkxp&Y;2Mez3tTa=2#rI65opq6|(QIG$>_R!TI|f?S1#z&Q(v7nrV%i zuRpFhINDzV?;OJ&cSF3ty@}oBoYm0CoS>*^@Y}b#&_dOu9jBo+8(Z5~VXCJ5Mb^yB z9>PLG6;2YL5r^P1Unl!FY&o?(U(eWkwV=DrDe8m0y+NY+b;&`#1GcEfQ6P0Jl z4J%!6RjNq`EL=COz7UBvsnY(EzFvB_2v?~oC@2(~W!kn=B&f(J634UDjm&T_(J+?d zEiD(Si0ZmJg@OFx?W27MhNPMl2~j6ZZt9yiO~9y_rF<(KhvjC!+_jhsYWb1S7|ShlGR-m)V)s`)O4;r=)PlnN|ze!0Bi&KbH~``lyrV z11<5{?woC}6t&Yt%e=l4NSTsw*Wz_Wg=dZ?WvO+6t4G1YEM~dk4=o>`YN&wQTw5(X zLKs}@Zr4n~u(O31el}RRfA*q&z1RAqR!W-mbm}&>B=B>-)1)Heuo|c6EhcDFxV7cjpRGXw+s%dV zGAD_9*zIq8hwnI+yWoNo1oh~zFNoS}3-a)6bR@wzm37{K4+_ej?=ri6`!*HBz-)KA zAhv=Dm`T#TV$$F~1_Xqc`41+@PRzVPwAf+rnVVbGMH(d`+X>*OM2!re>kJH@_xsDKClLqs8OX-P@E1nlh<-HxP6R(AFQ?BU?)v-$F$o<3Z6n{k zZf>5Eg5?aK#mI>rSP6x7mnbJWmd3r88 zE0O~r{>bYsHAYPlun|MW)7|e_O>e{jZ?ZMQ`a)fS6FCg7>=3YpHeCZy%_38eS-D1c zaz&cGv*+rrQInGk&hB)k1Tu&$Q%6GOFM2EuXxcdrEC*7vRdWt<>+Z!TCFSeiHIS9f zcrk5Q?f^5X_k(3T5*EzvYk1(lHqi;~{V1Ozg$I!9bQa8w>&4S2MhSt` z)qVbaUb;TYq`IuTw>MWOuXnEFFoIbUmp?4sIsm+4z6&>0YO^F@72@a40o&!mtMa?x z{5YT>JmimZg`Sp`k?BLM&8Hm#hu9fKIh-N$EGrYL_uY>TS{{QhZ!OkGQvw4C4h}{t zi47E*c!PNdrokZa$t^)ZK1~Y22?YT|qk0&N1#2zsy>Wk9oUrT|Q>HFQBpwC_RaNV% z3{Orr+APw(vuAX3yGk7#8ag=Gh2(jyqNsS^b6G}CE?Rso&!Eo$6%-Z*Cmwl#;m7EG z%E>W6xh7aN^KmF#uzs|Sr{OcJ+dlHX^PfE7%J*yh$A{`1Xa(mne3oM;3cjmxYb`W5 zm`Tvud3|a}(#OlvnnPCh%(jQ4W3ubzl+4V`>YmO{c7hfNbi9WBFMz{L-u1%wTR9A> zg@%UGff)731Fx+C>l+;G>+eq%cJO-8uz!}k2JOKh>Nag{rEQO^?lIhx`1B&ps;i*Ax1+PLkt67mYQiAjof z00$u<{rA@iROe5u-7)B|6#cSD1*y5ex5sdOf$UtJwn%naaVwlKGG^0dO3U$7(x$T- zc#R8IL?I>n1_MJ#%jSGh47R&Fh$_tZlVUoyk_C^)TUy(F2+}u9q+%YmYkErqeyOed zUDA7_284>7YCC)TYP4Q~Zh>#WIfN%c{JxJn6*cO`^eRY|9D(@n-@eiEC7a3d@OGq1 z!nb?GV=isXw6+tlqPn8Ae2$yxr!{l6nyo-|Bd7I>M?h|Ni>|9?yR3RxO;aaGYHTIo-@3qWH(@eSy^Tz<66a z|3)NxZO&spm#^=+HoT-XK@&^Q&UPg2qCJlnK_sK3JPUGbG{4zVXNm%B<^C0FvcS{d zL$Pr@i=Qo;S>Yk&$;xZHkV&TbRU!#%m=e;>>70mxsRf_wTJumQv7H0jm`YFgGmA zF16_@9xfdOpHUhaiHEys@pmoc3k*8}YN&$mt{2r)hK7Z$;{261=bUM2t?%9~ZfbgS zmVB;Ax8N&)46gGcyv9S;!zE78-V!7_s6R)`sw2@v0><2yf_0y5V`51xQ%m6jsn4Lq zaw$nPT}|zldTNd1vu6W&dP(l&-2=ol=@btAJN|=(yaR>XgrOH@SvIn4Yykme>R{1- zq~W;6P~tFW5r1M6r&eqg3bnVl*Zl1p7>(TUjvKb(3^|>1E_j*o+Gb{HN=-69@QUyq zMqy#$@p{rXOdc#rD5t|O^<-*$eogJ^)1BPuan(r6$7CRwf{>t~&>YeNE-o^y&GYRq zcL<&OP9URPu5w?j(8#bhGB6NwGK4Sb){_{qxAElEFP?K$+4k%$_QiF@7t0vj(=ReD ze;eA<+ef9G~XP?wc6R%s?*lTai0qfwqk&oIAh_YtVgT2VB z?CPc^e#a}@OE9qB6LWJ=XvQNCb)yGuwGU`Oeg;!!-};^xzg+r=BCF8Eh$EC5bNHM~ z+})Oun!4PxV0C5e6tuVAKQL3(Ayn~u$gPobhlM4E&vt!v=O~Psn8-7erz&v+05^pw zMzNPGgfGXUSZGh?FH=aMK1UK_sovA`(55Tg9hR2*7v?qN;^BctDR+GR3fLo zDdC3AoDq0E2reNF_d(pF#=}DpO?{T6`5y}Kz%z0`>{h)cxe^l-ld|%rc393wsn@Bg zg{i5|Bc8L}Uw$ZxzE`Py>25`Iu(z{AN?2EKb90{+G&lpE`0n@@9v5qhx_ye3)!)X0 z2C$oevU0Z=e%v-({UBxjr$;T%pBC-OfIXi(1{l#qFse%yaJM~SzBZ+FE-)^fvM>*h6Q%-^l?hOWD zn66X{10DTyXJ5T}Lq#ui+>1+anb--2+Onek{(CMgemi7R4lB8OSB3GN+sLm0mcQbLh2Dx*x=XUnns!y?|O z9JczkrgqoIhtg%-w;}$nn`xczCJIN@(EMv&Atf0`mCRn=VHD@@tu7nqKA$`S09D-m zx(5jK`GretA3vHGn${iy+&BVq_{D11+3@#22sr$gWK^y($k}rv*Py6l|Y0qi#^Jwek419G|8uak`-`vAp&3T`sqvl0Iel-q|b= zISY+M*{mvo{W{noDWl%Me_vKknx|^e0kqN8btDz~J~^2OnwWT_;N4>-rQZI2l}h#8 z(-*IOmhy2|t-cyYk6{xNGq^ExunjLVtM7Q)^g~%JAIi%5P)|=ZKw)JZ;l8`VM(urc zucfn7*UoqC<`cPaCiIhH^T*WQ>(IUR>6-{dZ8TLl!(el7?|mo~z@0DLx{j;8Nbl-t zY52~@-g>AcyyApl1YKgn$KdB7YaYd4e^TIggwfi=1%Qu)9mF~9(t?JDhbx?nNIQhU z-BoEF!wTnZfI`~8e=k)}3#MW@#}x*kscoONZ44IyV$+ zYnnKcoI+am);AU2?m11$tb*wuD8l8zchf*rF5-Ji7%}l!+VR@ub8M#cr;2!}lUoJ` zKDaT9g|cN}5WTd|4|f8pJ>WvN-G=~s<<#|bNq6NLRW>*L(HBjI@IA6HH(wecXjD2! zeE2X39<{c!EzM0X>!0c+cgsTC1jp1bLU7(l0A7Pw?r3Ks<&U071m8Qd;yaBv(UQ z+eeS30{~C~=gg_oXnZ5g!}H_M09a| zNTC^|<4T9Y&(9j^LDJW3c5O?n2k*}yN~DdvdYgEGjz#jKlJK8O$cyLi@k8c&gAm+^vN5v6&ct1!1}XS0AhC>ESwxgWysHTr@>=C5pcbQp<;57pn_WpO#)Mrm1sCMIc7gYOU%E2dQI-{jLBVzzbh#}gU7gs-`B3I zL&J4MMdQHK0h8grF&@USD=EofU|;~ufRl^s;70;C$nBRS;k&8XX=5c;B=8G*QR3Y@ zYgVP!((&=v5esz2C6<4p;TRxFU<$BqB;wT@#1Tl{wLIIOQEWK8WO4@BDwj4#y7MKf zh%3PQ`?OO`Ot?c@04s*?I%}alX92J<3BW#VNyK^X$FsJ9L^cIaEiyRt{p|>p zYoz@jhIzUkFoJjuY;_%IXIx2t=4$5#U!@zXdg1@|6$>x}Ui}Hg{zgF=CYO9~c{K^> z8DRa6_UC(6#w00Or1E$QlyCX_rZy3G=E~60W=!6D&^|RRqm0O7Nl=ru#EFJ2M$2RBBd3pP0MTOMKHv9Z;FVE#k57; zh6P{Q5p|JzBJDTP;0nOd5C0-Sg89s(a!hMYZ>yWKubru5`j;naWvWnfbBFe2kwSuk zG|f?;KL+4&#bppJ6fgDK2d-4HRU`y#>^bMJQXV)Y`d?tHGT`#o&Pwcmj*~7d2&N zZgzGNfNS*lB#}rUIvG_glV;;yLqGmV)x}m&9PFlT?7cYA97aZRNUv~RtClJ%%L_e{ z(T$Yg@qOW+;k(jV5U#*A1H;6#Wc89hTYr|&c6W9*0k3UhUj;N#0_MyG1%!zSSSca$ zRYF!l0WvEqYGXzoV#f4Kb-ju085m%`_jwv*v%~GA-a?ars;XDOGhe-V1me3ElRE(m z8yykv0=^S-xxKMbQb3^EpTr69yMcZ@AdmD64Am$Uk5L8C*itTB2)?B(o-Bpkw?W0=bQc!26wKUa+9mfO>^95ut!>x&bZ(v=d=NAT0n)Q{qV| z1Ys((ZJtYqtJWhA7eXTi`~gIGM#hV@{LZTj`fDI~&9>837Plrjd&h9a==N3tsGoJL z-MZhIR$rKr0Z`i_n0~;b01eH_3J(d{Szm{};6&T@cp+~|Nu~R2hofO+fHh->W^@F; zva8zj8dU(6tOV8kq{vFGF+j4K_!g|}GG3#F6LB_n>;7;<*#6$|kUp4Cwf#u}=2H!E zH`o5c#Sn<40tLfBclSFG71R>T^yM5KH;C)a*Y)&ndyq*=j-5J_8KU^*&jBFx7MGNG z0i**|9zfOGP(C28bj2vUOn!Z#mBnXN;h0piP#_!FbVKE!ktznLgN7AHHY`2HsI5og z%O?a8c-+X)43lK_d{KSjiH-vJOCRq|jIC;7f1M{`{Ojwa`}gsgBT{9C(|p~a}A9otUmIukrY6B1Z<|bIK6uI_;45GoB7r#2`(-}39SlQ7+y|JPH}PF)*+xOM@2;eo+`+3Gp5p|5#S0{(L3Z+ z5&ba#2C{U~K53qUifD0gbmIFn}pW&??ZFFiW&YRc_&@~{pphGxoPC+B^uMKw^bbsg{J*F@{SSBjr!4jN)UB=3(8R4R z5lg`fyH>RFI@sIVT6)kJ1pmru5X*$@y;nJKH6wb4`Ciu2hTEax>gU74Q-?mjq5T!< zAP;C0F{mh`1c8$WF{ioBKgu^s!{}H_cK&i>ps?QgXQm)G$=LocIn@$5H9gJtwXwAN zqNU_NBYgRGd3|`iT)uRzySqrj5wPuf_AtQjq~NbGx5pu@9lu&nV~_xyjVY<9sO)}G&C?BO2@hlFJ>CK?pJNE* z02!IDS+To=`)>RJe`;0;IgQOd)6SReF}KU>s5(3RuZ3=y_X3LXYDEEo!flvg4nI6H zyMJ3SsB{_BG}HJe@`y`ckT5+Ws-~(U_!RvK0M0`?5iP(|dF!V^zKh)mBIE z9#U{i6d09wHI^VXA|pFrJEo8iH#L7RFsuHCdRGvNNdF95jV^Nqr=6{oCFmKzt;beF z?*PB(Q#d0ol)q~0*!?N7JytlcewO>&;KRS=6yOPKtzZGM0|nE7o2O6TzQiOwIT}1o zSQ=DTQK|7+pZf7a8e`Y*)tM{Yb>>V4l&$t)NBOX-t7#j$(VXZ3b$wb{)O($d0Y2Xp zhGT!rBJL+MKaSAjkFQ5Gic{acbEn4ZKs$hzw^=2LII%Jo9!CF3{11K?;!*f_<$Tks z2dJ>H;Nj1XcI6|^h0e~x_^QyBesA*3PNNS68PnQGdyHYZ?4JQKG_Oi;t1?PkzRN-F zFURD;DQ+ZQW+_4*bKR%1ia5XRW~E?GN*aG1Gxv%9E0n%RwsTX+ z)UoPNMQ8H%b=h-FyVBX8VD)?kvC3xPAT?8_#&x9>ESieWmOg&`cqx`=XQ8_|KT0d| z%B_kbv%x|K(d{g5gl8<5nW>!GIYud;i3cPN3s)nMTwxpq??7$WTipS?j#;{@ zh^WmUm+Gof@v(0#Ni^C4$D5QVJ`z`6K|fNP7gR%j;jwTge471HQxjSQ9@>&hz%GYg zU(MYbD0S1aUf?AnvIt2i!Kd^WfY$r<&^Jp(@tB*>;2ktZaSbU_mb^6b#uy zt52ISMs{fwvGLX<5-N*^r3jf1W!2DFQv54Qsp}4Xc_>$yEL}8edLN-Ax6H_BV&CsL z-nj{UAk_NU@R+QU;&3O+XHCAlwDE9Z zkQXqqPMy5j^8Hn{Q~<}JS8h8!gJSsg7={AM{D zv&zw&ZW}F=Z5R{sYZY3l1-gfU<)L&PX;K~KYAN@&zN7^=K@k;eK+XuziNK$TmsBHzSf zklkhb30I8$aqq1GkqR0vbT-41uv6wTK1b!#kt9-=NdhhG*q@=(9$Rh<98kn@u^5=w zr%%6wS&-OTK)FTjZrAg1OEOe!U5*?`A)(W33VgPcDmRS<4l6;_+S^~zjwm`pG)*B1 z)t*>XD_S8hR*FGnhX2U~AxU(^(2#qc)RXf<_Ka*JF0QB_gE`(=y>2GQMqn<2yes{m zv8V?tWDQeuF`|T7z~7^uWvnf_6>lh|C8r<%CNr}*IJo+jI9FSDiz2GfprpzvT_)*> z(r;fb-33RVlxXh&3K5FWKO(q~@|cwV znX&9xt?IH2WR?W0yFZpGTk+mxNAOo(*dxurGZA}n7Jql~fT$V>G?CDdkjILOK@sYp zlnl^<4~d9yb=^4JZOtWV9^~>9(=#$s;^U)B!w{1BYFkQI}eTYE2+OXh5 zTNcQTf8d~{0)Q+)tS7(d!*p#+{N5f&#V&5My|su#4N%zzl^38x0MQqN!2sCKsm(zG z=gZ54K+O*Pl$Vp0mAxUSpdg`B7JFNL1qf?M$Kua-;6Mt(EN5mmO-@GU(DU+koRsNf zbHN(K$H!NUwY1#i;$n9~=j3R3d1+VU#4$BF_I-VQVG-(kT@wcy8pSO5gxvmUs?5Zb zauTRa^c{0pncLWAvoJ9w*$Y`%1hlloYj@>lsqHdl(!>Nmx%{B%9~eIT9q4Ax<29tM z#ZaKofzssXO8yfW9+a=mzc1SlxL1^v+z}ACbN6olz#LU2iR4AYEDUQo$}c?KGQ4L4 z{oC?xa?8ufrAWdF_;jqYiVWV7n1**yfo}yrKY9=qqKlW2sB2bQyPd>RATa1Lp&c zQHpVf8$0IP99PqIB@+kE`kG|;FPHjE{@DfJku5rnqv!tBTZaQEhM$u0Ub#Oh_@qC@ zUfXT7O3J{5n#c=f`^ujpc3h*1brEkb>`0;|?JT9&7b1@rhQ6GcS7YSY$XpiXomf&* zQ>*hj*qWd9)Or;5HstM|M{9}86FR9sf4SD0>Tka#<4Wgky}T@evRzwibK}MhOAq-y z80YeY7s2XtY^-kEqZlQmW{!|B$%gD3a3k;uiS*cPi|M7|`m~%3j`j2YDbl+F92{e( zJ)JiIPU>kHx`#0a0UR6&N3@Fr9~42gW`J1s;dX#RbObO>Dzn;D{P8DlDJfHRb$+Y% z^jbK`M*CbIQ(DEy+kemOgoDp6pD!qJ@ETFx2PND}XI{Oc)PYP@M6Z;ujXJZ`b3V%@ zbF+nSld@0&n~hIt=e7>F=U-TD80zxltK2(RfdfOYP%}$?gsH3UG-qt*ZTnG$a1tXTYW23l*fpk=EkCN z%K++~ldo}d^-CBlD?su97HExatgXUL5`~LJf9PZxCx9TU>rv)^JoQ@B<|WP#*%h-n z50JTOt=GD&aF8Ov`6w;+U1#h_&(H_GBwc{pMfpgpAFBZZ70zFd#ykB;xSwO)I#o}+ zU+7D$K^E}%-4OX*oJ&d0`Di=Njn!zCraej9?S+uYnknjIZU({%{pV(;I${$a(GkwAFT)wj{kGm4wOLZn8-^u>g zi!ml(wN=&BRxp_u03pS9S0wB@S?>1qq;4+}5r;dG2>2kMX@9Q8{Ijd}Y%lzx8h z;g+Y-Y$6Akz#WhA(@soG9;f{3&~M*{<)JYe&VUmnp>-wvTI$`>>P!x|akWpUcP`1=?SZjOz-RQ%y^ZjuvuT@BPEV&y~ki1~FsmsPf~D zm2w`&Q+ZqDYop8=7HQx_%+gD{;FSk>4UXEozd+x=y9{viedq3%N|;>r_-%NUZb4vp z+T|;ZjMTKLx6SG{Vz`P7%5H+P<74gGBV;pFEUc;*1VW; zDkfJ42be)Y_4YZ^R%r>xbHbE7_2eX-dRq1KgML7xj69Zqhe`|CJ}I?aua&}5yuBp< zsU*)KN*FM@_PuKr+ba-q%R61a@l7d4+n+vDv-5surOwv&oR}`C+Tf}X6HK*2|^YN(mSvTKTiU~htxfW^dgheuS zgZEwDx&iG4%&P0a10mwPXV+BJrr?BjKc3wc!!MoSz(G@l|NR=5RY0CRl7zO$Y7FEI z%T{kfv6N)C_V!Ip-}-a)x@u)m$~K+-PQ7KW9(reFGfuxI&olep-@{hm$eUK2u{84`+WB6e)OUDc%7fBoH40%Vl_ibJ7B|(EkYOnxx4noRX`?8 zl4|8GyLOyT2$7p-r`H+_z0l=I8}-y9L79xEMNc=6Jgx3dzrzC$z)*qPE#H0q8Gyqe zW3*SXcbNSxo*$#!plw&Q$P9@Pk>XqF3}fI=Bhz`ok?;Guz+o^*QE_carS6pPm4A(W z7$iHR$^*hUQ#a58#oQhx#b3AbkZ-u%ExI@Vq*XUXydy=xTN^h{8|z(BV1%7*_CsxL zTUeOOTTU&b&JqZih?(+=in0>%=j$cAZL@t%Z+CE;^DA05j3Jrzb_C$<7e|KUJPuY3 zeA+ToICqbJ3;lf<)7BqBS@`O8>ne`B@=X&MFzA<(k6N`Zu*n@0A#T3%OrjY;4Z0VoCtMa#JcRp@&fInyrP&%$kP}%$tL&7 zw)H*q$_9IthfR_8F~ubcI0ds|PNG9-B8CcdWs16%fgGuAY3Zo)R$NXyM;kj>w7WdO zI~(9BAHpa-G6^X z3&G!O)s&iZW@2sc%kf)yg(L3S)LOd5!M2CPP)lcVP|)&74JUB3w$XhWV`I5*4Qut! z>MJTLd@vutvX_UQ2xo2D+1Y-Ad!GLcHo^7yptiv17}Tu2y@i*sqA9XpUoy@Qu1`b1 zHfHkbZ}H89rAMwW#qlpQh64I-UYK(HH9>G{da6xKj78F`;ak7s9{<%YMv3a92vn*G zTC$o{85EzG5UN-{BAstiV@uq!EA+t6v?djSxdQUWCEug$7kLAmx9$5-?IYhq&%w6w zlJ5G?$ePEDDme(=oAdnh%geRq@~jevL2J*q_q|ziS;t&7azSUeRa^3X*D6sq42Do^&kB`4I zmVR$fL&aU&-25Y`wNp{h7aHDinP+#os-*=2Euac_a$Q#IQk}4%tSIukC5|%9pgk5# z%L7_buSkXe1CFRcYvfopMqO665mY@xl~EwXwnY1@q58V_Rz2F(g@xrmWx~fKv6UTr zb}G*lnr~Avt1ycl4Rv5&GcgXX4ohU>BHXf6XsLlSGoK*~RkZZlTcYa%{WUh0j-wUI zgCZu?A&URd%3G!W3_vgId4Fs7z!6qxSn#e^wrx=y1 z2-``#2QLh=wYSYYbk)QUmF^B(H1}sw>1G?F4jUc9{S1YdKWp_eU__`8RP%j%?4TP zFsb_d`N1E#0|ROa3*^2`r%ug_IE~mirDP!vn?MoIa_YiF-~U2(_lc#=&CL$>_V|Sb z&?G(Im3MC>ELjLe%D&r{)uW+tVSRm$mX?#{0(`f#<(r(5k%Uf0cwu3BPcv1iFMvYn z#p}criAP&2-gCspql&Z9JKdEoTB^|xDeO+7*Z5Y>plOYWu&DasB7fr>AQw#@BEGgPoa~c{fX%orUb~Tk!5>9{pI`a^L8%kr6n=LIYB%qWunK0X# z;+gEu&=&(RhC5dJ+9J|OR%!P{A9HVQnr*K>8sZ--Q&-i}>T4SjkMgiKPKqopJ{bA- zgJ)JDr*6VVJw#pRm(IJ#0xJ6(JL5nf5OSM)!krh9&wbiesPYX33lZTm`QrvuGfQKd z1`E?J(2>XsJrDwn1?9W*1E9Em@~i9oa{oN3IhOZOJ>?)z?!uu?US@oPl_$5@&G}qn zfYCO~X!P`!fK=Pc(#FD2j)8>wc3qs=N7;x}CZDYzRb6`q^`xUE7c(ik65e05eXmkk zNol0a4%ZY0A1TX`b{IH+CcqdlpS4;-pi182LHNsOVXz3x4Pb=Iy83jP%AhnTj;GDu5QzpkTTD* zoT*u>m%}wY3uyaG$6uX;5A2!jtJIuuQh9j~DxOPlWcQRUf|3vrw;Y=<{Y`QpkeR2y zz6CVw{Hrzb|Nm2&|5C*}!SDye?u_)k9v#PSBODh0Piz;vZE zbG?UPp2Nd%ODo3@>FJT6v~~B_@Rw%qkztFKq?7tz+Trs)7s3lG0f8mTy zF+F@~64;tY!pKjL+1`9_`WDmzI1^yGE2A?en4a;Tp^5PVBiz#WGyfJ;h9m#i643&t z(xvN*tPdq~FQTF0-NaLX)Y%KL-{cemelj9%mf$N^j`|2r3#!0-3G zzP@`ncJ5NV(0qhBQVG!vqXK=#|0*>rf|dchvG?DZnZ#o~T)8wqe%skz8u1{oLnX;5 zG{kw5B#h+d3Jh#)Eu+_;{LO&cw*PwyBkSQGqvQb?h4V2PkSdt^A%{W}0e zn>CYsmqsw4vecC%g6VCuUrIj_*O{3lVmjh%_D6?#v9QZ05JkAoABe|;c0;zfPNuAg zbK1GOwN7z`Q3{lL=ZcKSFb&<=4<^5Yf`c{?Sd4E%f%*>P(5Q-V_E=Qz@$4sVDliOxZ!Neydj-Ce3bs$ZlzQZ`EGD-2DO+H?q!z z2L&kvs+}b)7m+-~*u}-y)-w`UPWBB(Z|>)!F(|j`HwWEPPEJnLckc?8Rut>#{${K1j`)q8Rinxi z2BCSYJ=W+5Th!-IZ-lfisM+6)E6`uZe?2-!eNthN|1{*69CH)vO}(`YbOSKlGe<|!w0~8cE-`LK#l{W*^8k8<_|~9~$(X;Z zfR>;j^#z{;A@w?6=*Hakl6#=A$X&p~Yu$HL5-!pRDo(GAR`Ef@zlSo=-=G0?EP&d( zx}QNc0SvE|@GUDV<0;7ROuL`suBN0U&h-3~V(=A1L&Jn4PoODurQX-TiC^ROB=jOd zVS1(`%?uQaB)FhwmzO(J#3L8!&O!DnEq;{IULq-X& z4@EXu0PMC~|4dky4R{mRnL3PWJp|JU${`*rV|sGuU`wuExN**mN6e!HYzcx)nLCf) z%OCO*C@(+dftE+wTo|C`i{N4X1&o+{$=O52E42XIQ$jUmB9})IIx+=z)}4 zP1R4`-6}TU<>#dkg(lVa@)bm>hkYCB?F&Z82V5Ajq~_EDz%jigx*od`pG3rZsz4yU zy^82^A;=8R{|MM|?zHp44ocTtlSk@~MN?+;v~sj3)6=a{ZvJI9pe4U$X>cw!R$N@1 zg}}J8Vp45U=T9O!J^ySqUX!?p^kLcl3p8WU@3|x*6BCoN99!9)$<7KViX8Xyk0oC; zvH?9q@6IfbkJWl_V$ALZ{oHh-DlnY(3oa9-0kLUO8M%GZ7O6Xs&`~HQlnH3}9NA-K zG3PaZ!;QJ)gKZmQ*IK{cRMA+E@;DH=re*us^<{d}ez(|4TCOyV) zd18O5Ynm@vYCAnOu9L_DhcPjI2m8y9oE^?N0~#(J}I~A=k2Oi)CudZ0*vo z1=3djX8R(Lj=NCakmtc?$m1XvN72@m)d;)YICj=s4+J7t=bvwMjwaL|{%GKYE)@Li z1u*Jd?2~Y_Za}AeO_PL&x%4b;qbMt8D^IO@hJ*%thh1k{!tDFbtR>G!078j+>W6)4 z7{(RLg2~cbm{vfko`*c>NmUST==z#sYz*8!cHKK(JVh<5?*gm1=aQc^>u^@GS*I2K3yoDt72F*?4lG0}9nZhw zKa3p>KLZK5aPhBQtq{n5$G~_Uy#AC-5C9A70p~6)4O7tN0MWoXy8BYf1?{K~9+pFK~ zQV(IyyM*peJu8FZ?=SSbm_Z%ID*#6edGJjBr}NybU)(+jkbs?M9lbA^!Nx|lGP+(b ziLN{F8z}Q8AJ5UNcb;aCq^4e6TqIPx*8=UhV`&g6@5oKZmp%3&Jt|ars4q*&ZPupG z24s5c@hv-YYrosCY{CDv&^X8Y>T=&af3lQ+I;aJ!WgUJ#grofr%U8Q6wfqv}qT`3a zyi5S{eCrtq=M;BeU8e3zQ$Ke9=#Zl+&1V#un9DSrrKjZT+SGnx!Gg^Z9r~Y#ng&Fs z@8235&D}rbKYlS#rY;@qv;Ostlug^r}bS?6qhkAZ~gW+)rNf&TxpldrcEWFNh zaca>*;nig+zuES^gOeVi4z$T9@9L0n)S^moo2PZIo``M_wI>N;15<<=DRQsz1resTg?U%qArFttl5e6{sTFucbSfS zzkQA&pD!}L=f9FGY~r)+N6lR4HL&YJFFfwP=6|CrS=ypHDztr$#H7J-&E(McN%^bI z5|mr@7M}OjXWg8-J?G5JQ^%*yz$=_lR*eVzHpI{7#G2pAeY%D>t$cl7U$*i^G*i*9 z%}fT6eCfF$AA-_AMrGNxDTx zmiRKW!TiD}NF~BKir1I|8XFzIxA#zSa2#>%;_J&_TUxUHO6LHNXxU1Y$wA$RP3_*MVlhSgK0e=5 zU~tvW*w8&YJk-CI{5Qxo(`!FPo{g^8?-clMDO=N*m6!St?<3w^qA*06FTL3Y)3pC$ z_~PPz!qq@Zl2sb?W_))uPUIj1fL^m;wg zWXo1oS65TICc`sw+0t^0#P7nTS3H$u!UFlQ_G=-YJlDxJ9jkY)<(HBktonb06-#Nn*TS3uoV5{0qNU90U8 zk30#R4@)Zurk7Z?HY9{fhXT&mt74GhNw|-ef;?b-@H0Anc(5dGJ_EGwbK&&77%wS5 zzX2}HHrRh;TzfEx;r^pN?gHxy4n>&Ot22$tbcp3KT^oCQt|LhT9c$aSKZY_L53Nhf zdHgs>x19tE<{}lISL;%e36+kn<8eNGxJ}u%|_Rg%2_s^@@xP zj2Oc4?$x`ABF^K5DS>gj<4#6wY|zXjp{_n`7GiLB#~FLDKJfu5yTOO-MZXQY+dEk$lDj6Y9TK>tKRJ{Ql$TXCAsZLg>8Xq6vj_*Br zd3bMkB^(|Pnt^@=Ok+EIq~>f?Qk(jR*%7@ zSj5a%%5r+qTjwH}4@-)oIwPZb2m`fdq~tR;^r9jnsm0Gam9v0BbxG!N{Hj+`jSDGl`yZ-w<*+q{cuE=6;3Ql)an)8KaMp9 zy>KNk_aFD(1IU=Iixsr;H!E!{e`NO#P z!`cpy9z7ZkCue0$P9E3Pggi*M{2lg7OoTv+B7Sv(UMzcD>Q}QNq_T1i^77A61)smG z#}EF9-9{q7UXpLW;1C4z;qtWfrJsA-Ap7%cVPvg2cCJ|uG^}mx#y=;cM>#iWesxDd zTBOhDtx$vo$4Q(GDWPXB^jEpT0}Ju}g&`o24NNyJ@0)UaPT0k3s->RGmndubVIfD4 ze)=)EA_l3sn625Ga#}tLm5?(^ZTa-S8wv!%@$DBP1)IEO-u@cp|E5zvF~5 zYe7!)o$V>7&wlM&;6SlKAjC62$Nut1=P1f;u9FF+1zto?=I3}O%sT!1%!=Y9;1PhR_hQF?J4rWt0XBdjxaDDeYWWWbyLwFlPXs&#;MLi&eHvQuK!&TEpW$?HDk9Cl1GbuYac$;E)5d!V`$kdHPu2O?QWmOlVFBlEB)T%C9x}A2(u*R!5fGpjl`t5k>eAQ?$1cH+N`Q9If zE?n@w?=X-%q+ec^6d%vXc=TlDiGZ7X8G}Rx*l{eF@o{RTl7;ztmC=eE81Szp{xFnq z=b5Lz{-PA88Xi@XD0Lfolm{-?r(qlxBuG5zK@RHUeDvc zulu^zwbr@LwXU_&EP?xy&yynGAEpzYka*p3~#v!mTqoTLw*Jn`YD7^e)6h?pL! z;(!5>V2)A#e0N}2$*ryO;!c$`{mvl?zlmTGQ(n1?b|7rVO`-tfTOE)069G8@;Y01V z(Qf_Ha%p`E&R7{u_m-(}Xta0r$~9M1TqM3TRPT^^ey=Fbd$*+CH2C_wqQFgJWgzNQ zXsD(c%RlWUF--1K2hP~{%_XOw3YCn?Myl0F{))X=rC5a|tKKrZGP>57 z>QqZqCH-{3wKd<4ZIW*w$ds;~WAx;o!QImu><{K)^V2hnV&z6$CPS~>`j|?+O2+Zq zGsAK?`sTw={*1r!{P|rY?Y(LrS}V$5b!lmZe|oz(J8zdIu{vB+yNQUNP+40>-@g?3fN3Mv~oeru05b`lA zuf0wzOMKZv>&s;S8I5VF>rwXe-%IH8R$?E5`03N(qTkRi~fNhOJjV;grbjxK#D&!-h0_IsapZ^4WK$W68P(3m*l0?PGTN*&6Z& z!ztv7LVhHR)V@_o>e<-CL6@cnrh^$K`qq>d#U*9q!DyM>wpP_%(rYD1vN50Nx{{#M z(2+LO7;;VnRT!>~ihhi1PSJc#rqw=}CgQP?-}YEq}~; zX5_u{NLdk=WVAGEk<>?pa&6y538uZ4vGeFKwJr2D63B4Y@$nPkxI(XYux$$qQ; zLmS?cS!y3=MDBEdaB6-aw_`PrgFC54+U-xKAb;%Z?j)apKrUHMmx2j5tWR8CR?tAc z8^f_<#>4jm`gP1sXY9?XtCaZ-QDem&;*OLwxB7p+ zxS1a}NBeYY(;s1#-jA2vvPssP|AMAmTC7H0tRqzK;z+u4K16=3eT3i2NJ~?b!CSXZ!w&l6Rkx=m2e|CZ6n<96SyO9t1V>8FFIRmE@Jb)9 zI???ePTh-zubT|)nsPF?-I|U(?>@wBbjamrW3D^*%24N9Sm&=-t^jD=l6l)4!F5yF z>gPV`{QD7pX?B4pjoU|_TgJ*gqTJ4Kdbq705Vg|%{GPhOazlBi)5dNV7KQ%Cez6Kv zB0&PSbB*^mz7<>+=r>H4kC7j1)Ya0e&N0r;ZTav<(CYm~;gJ##;?=A?c;F)#Xgv|F z|0<))oaO*0V&k}wC7)wIYJ?;!S2CaeZ*<4ae90grCZE1h56;=3fZxkB!z5K!nh*M& z*DIum$<4+R$rwYzQo?5Dx})+0DV*h9KmXY9)=>4l4;7K0OcWMSviN5Qe)y**}9Uqf@+kl}3LFSXa$XT#5QA~R9R_zf@oeTWBf)%cja>IroRaN_?(yQ4UNNBb*91yZO zIC8Xn)sgB(-ODtS)#-kx3TBsQ?ddnQZz`m`Z^>0jM{0In;MsnJ6eNx+wC0^)9h#@~ z_ZJ~fxX9#kSrW3;*x0-b*H~c@DR6s41RR!lhl;Zusw#nx$L-Vv4+tDzqFz-j*|p}p zJwzdu(Ev7ui=z}5?u+S8f7<$bW>`r%Q8h5;dVu{*Q;>PTO)mZRpb$Sc7qU<3CZJsp zF|vyjC!0@38dY3pbs+;elEnAs+_h_ANPbUFzEkw+MRar?T?>vzbFLZ>1!m8J>ry|Q zAQ@nCYhl%NAFQ?rajs;*0QdRXnZa;oDdH19-+t$pdNXlU#R?AUb!Nw)f%m6hckC6} z>5#t&Jnb-Bc(Yx%OwOtQwGoSNif$L2svljwNqMW9D$+N=s$(yIHJ0q5TtgUL`hDLf z^70NqlV592H_b8Yof>UZq36AwqLAcC%QGq=F7D4yanOaVQY3hPdvGz0a*xk*ougjM`<+S?IVJi~(-q}us z`Sv(1=cic}TzuUzb{Cf5(amM)e1p_!yV+g=KW}euGRAH#LGbdsil21c>9TmB>@Xh8 z!^}7~PWqSGE0nai|Lnt}>34L#lrEh3*KE@8n8q1KM%#wOx4E_w@z2O127*k$z)XAsEGacBSFY-nI<6p#nRr zoBSLu`ZzCTI#ge8+)7|ssPlEjAlccD_PVNx)axr zS}$kKPdGmd|Kd_xD~lA3NaN;2@GUCRAzldyPHnbUq@->!3#4>;$5?L|3_e?8-A%u{LR+DzxT`*lKrCz)n3( zc3{8WWRgP1_~1DvCZ^Yt=|=6XZ#HgmYbC)pXl}|c>?xsKOEah7M=48wrCs4Uha36r+c&d)^z&b%;FRyst04~(nb>Sr*9>_M@#;`z2+lQMKJ8vZ&sGqJ6UR_|h=GB}=mDn=g z;3wo}F_Z*CA%NH)j{GJfiIQO8497+!Melaz^Xf ztixC9pYvZ1weBf7BP7Jh!=sStOhE;-xH$8=HGfq!*R~GD8oq~|lgQk2PI8ovndS+f@D1C~@JVS1O*N=d*XwH7|b)jN7{F&BAE5#>-Q2 zHK=-tvKyszBy+FeNGBF))X!{V7^b7+@=}bGbu*^r&wlJ4bk(4)YW@cti z!$s1O_GwTkKp3-A69j4uh;hte{F9TUzJada#0MSw%SV3EtShwM`AMpl56h;t(d}ki zk31Qyi&IC1Os|V}IOGG_U0xV+ymTp>&oZ_y=6d9Qg?vwAAF^ z!!2KZHScpgZt0QIAkEKp0#_ zMHjcbetvgxe1wBimX*TR;Q+_3a?O==$IBP99#Cy#9bSjFOq!bBdzim%-x+k+nye@M z+Tji{KYNnwL&y%N4)#-Cnv&>FRVAOXim_&$CAbEVeMBMqnfy4Adj&BUAzJKRH$Zbe2 zBa6??{gSTT{SO~vGk7iQCw3nW`uzE%Q_PpP+%GT!O$TgqrF8A;M2I;#)3@#tNqurN zSDcEf*u%p~?MGSPw?p6aYMtI}JgD%WmqDeyvAh=5QHl~eety5#uVYm+PnvE0)Y7>! z!3Zkg0?FDcYK1GG%Ezh69?1)nY93dhy-Lv-nF4Q73=q*i{ znK=y(>sdb-DI8BwU+gw8FqpV=hwnAVQ0QDnhB&9&H!0u;{0JYI8h+lNNa0HSpSzqo zWn3S>%`A%O8GR86O;v)Dwt-ziiUzYIY9}`2FBI<@X;w;eF~2=H6Sh}<>VK6 zT%oe@TW3$ayL#_LDF10=3K1i9WOi%)8~tnDQuY&Gt)a&A!M!(a9z8we>avbi?~Jv- z-M%-cS8~I_B-JxcdFOMR^NyAwj;ES$afN0-e@HNbd#jRk;WH+`TqeeR?<9dgkPTKx zq{%R?IVMR8?u=9)9&(yLb1q>9Bbv3S2@k)_!X7M?l$eyBRB9&O zV2$XUd4|jPWkH*zgF1^v2c4wSHP6}+Gt{sCN`+VYAw<}~ji1NlJxTN_>t@-4V+dfX zAW&)8%8|pj9=8$}+_p35nDr*2yS+0SPL>AMRTx%gT)irv9U)K0igZTAgCo~=Yex?G z%y0}@S4sO>@ahLnJ3c^E4$-^1itpdQeH%tv1n{+KZCLN>%;>yUEinsKfIl6dn0b~z z`#eHzhoZT$iu$JmwiFA4}s(?hbo?sa|HnM_NQ!pV`2=Ru53(^uo0T8 zu#=z-U>`ZH{VB{afHOfohxN#b3HOM6Q30p+JW1gP%4dz1TuM*f+TWPm_PP3K{|#!$ z=g}UM@uH3H7iSl5*h$}bOL@$d48Et1s7q*Njs7Y4(#i>u=Th}ZUZwNi?HQk%-{DHe z92r@??WWVJLu-Q%a=x4b`EROJxiM%L!Iv>2Q4OAWM6tclUAuUe?)1{|SaI3h94R$d zeZ_YfV((`mPab>B>9xK%q2U-I`*Kk(cB-edAfqvVQ6^WN9tXakJS`g;5lLKQ?O7>B zkWXG+UFv(}m^B&E-L9w@A6GKknGw$3zV--(F-Su(!>lWrgmU`4aa;2b6&_bIhS|~W z4FAv|J3nzb)X=es@m!O=3j#Bp{s70qr(EX2&n8|rHGi`+EmNY+xMp6Oq<}( z{?6XBbGaP!yAJGI84l#O8R;qnDI|CMy&vimR8$ytwTZB^n}`SU8c^}_t8&DzBo)q@`J~n7HMf|(+8_$i0|BPsMtStea5#>%;4<;|5)qFkQ9Tcf%Q}RfTVA8h7}Lx0x5a* zYBO}>g7O*D(|2TkUe~K4U?$RT$vx-ad`}>>W?*;iEyPoTq|D9koVh(=_T!;0m*DDf z)uHCV5RFtlw{uso z#s#>G^PD=xHGGr;&_g{6$<*BG?+D>F8#8g)+PFAS`F+@kY{pf%+a%) zbzC;j+jT~I>H0w1%1{!hu9I}R!Owz@MBVpGv#j9ipRr>2kBQvTmbF|wxQEC!03I0v zVepY)%GlYDne*0Emkt&rcXz}z{Ajy4jm!Z}6V1R7d8t>~As0uQMToD)4XeZf>F;33 zDf9EOilC~UpPS#tfL*t7kjKXFnPBe{d}#`-BUFosM@{k5Z49lsIq)%mHTbddB&sK< zzIE&D8KHGfA<+vzzFQ=^yDNOFk%?m7H|2=!nRYxqqiPH;7!#qMMSK2DZ9^6po2ANy z%xI5QjSeGJ=?;-!?f3e1Ok?Fsc?#K?Ax7{RaNg$1{lP(usZc|t)5ybmYI>N#Qu-x5QM}*^c0Rce)FZql)L73 zr2F=n@hB2&8s5}MR<>mL5~F?Tn{TOFzKP?~!9zz*Fq}Fi$LBQtyfA^^5+XQWB*%7C zHs)ITojnCtH=rP1b*y$2wt~@)?Mt`5T}t4y$gv&h@`_Uk*kpY2#0hc{QJ1p;>dh=i z6q2<%LJQJ2Z+=48=v49|8ER}9XVVbHw=%m!EnqwBKRtADW}wb=?zVO1NtKN}QwIdX z!5$eo`z2i~RE|*QyZOP6nlp`05PI`wP2|%Tb1_rL6gX6WR%d(ymx~CYCBZ}QEjyc= z)7{;L$or>f;s1MN)uw3~$9kv7e^ty#BOgJ5BPjnEYZcNmhI}r&k|BjvO<-sdWJyra zYbyKI*W5qVi`d*-TzS6m|4lQZa43GN@h+v*;Mk6PpA*N%$qR(u*bEE@dY*STQcZ)t zY@Q2dzG7<=`TjV^Qd3Q5Zo9@wJ9$`&tXX<#rh_-Cex5Lo6gSb}`O!CR*q!&10+ht^ zufqfL!A?Q^ElJvos0*~v5SMSe$YJ2nQX(ZdJu#_r+}w>!3+JhFx9-}enimh2!#qkt zZXY$gr)p~u8P|mZZ_K5cw$#(48FH$ocP6np?Hs5lWZHtBAix(9kL_}?@okwZ#3z$r}j65I;e}k@%Kj(gub@ntAaDh-@n(NK21&Kj|nL%DynAU=>F|~R$sdg zFESz5q4p6~{ZYT_R)LyBS3Eua<(=}KB;)FeE?zhj!0MemRr=}C_-z$CJ1(wN@$M5c zGXC}TVi70ZZ$z%w=EeFiriW8=&MHI|2eX%`~0uT;C(F_@aBzV%T|i5a4yfJJBSeT zZ*>=E!dNw1iYg>+Ln35T&+zfzk5ynl9C2ZDS5!n zL?vtj)qDPazah(VBO#vn%zZ7(IE1xkzyf^BGlI8p*JBOG%2+Mij!zGL0?sEoxJ%}5 zx*Th1(Cd-nr(>Mf=oa*gY-}xl=Ih5Xaugtr=+}P;9^G6!r{~YZ{QkFldr$xT&c(^e zV{Xos=}Z{Sy8ol}=1qj&w|#8CZ@qM z`}c5z*Qs@x$;B}$ZSC&g6Dzo$k5gM4uk`)vS9KsBqMmhP;(}KaXc}^el~7K>zm=zj zy?^ywX~c>W98uww^?QW3X3s|Jl|TIb%+>MBe@nJp5UYty!$66I^R(9dO2*#Lu0q$Z zasT=9I$-4sd)uv7sjh31=*y3;3iIx3Q~2H6*H^&GNP`dwf0kt9PX9;B?}ZhVC%C*) z+4kq>>w^AM@!gH{`uZ<^FQvk|W9U&^i^Z2D%!zdC`hyvPx@Sgq{C+9Nw`&q7dWa<| zJTmgPoUEr4gm}CVTf{{GB_U7_=l>Fi%mf3sTl2X=+T$AnjUwqb29!$Phd)*$Tj zgS!q4Z2L1UAyxc$fBpK^t3r68djjjyWh)izwm3f_AVnm6qHz7zwg^4@@M9P$nrrv{ zEDgTTCPc&Lzpw9^w1`5B2 z$MP4Fh8#z$jt09~($d#qHv$FblfL?}ApwGjsA+8yTrWn5wQk*r3>P+mpwS zf9nCWb%o;LusEU>QB6o%Au91)dlk*SQ~}3r#_f*!`L&+IT(7e#pG)iOv$Ttuf6s~D z`kch6Wj{f;n@hiMw3aU-tU29cx-}?hn6TgOeOq4zF>ozD%wDW=r58pI;?e8B5vpTk zG(0rK@cRwc6_d1b4zGTH#oOP{bzFb$;n$M%WYQOYKelo`t7M$7=<&SpD0UD9as1zT zlAaTApm7}kafGl{qz|rZg--LHlDiC3gnNewujfe2)h1~a6c(N%+?;}V{h6rhY)x2C zY3cPqi0e0$(k*(r`dfogP^^DB5HxMxq~zY;&y-%*3a;X1{?mjFA-rMTQ*r&4Y2NU@ zS@zGD*JOcJ9Bym?N1KkG-cf=CY~TJ@kceEbh&|N%SvC55>_nY(e-k3N@6piMg+IUV zbZ`AtHB&4GBBP@f|NMOY3EW!R-6*|0^i!YZ_Y=t0pWue_?o0C;giU(yfvfeJY2-%f zUL4&0tua3R=N*bN?r=Ff)Bm>84_wz|s`Ht@zlo{o_0R|D1es!0T$ct?X6B-rNUz_* zxtVm`$nv7w6U*7NxlpQ{{0wK5e4dBZ>A$b8oU$O~s}H$K2HZKnI@XqdDJ3YfW?)K$ zn2E_1P7*E=hR0rBB-yJ*tm;-JU%oVgjgH~=b5vHE7(7QLtiGjuAEdioiL z?8uRqz7!+(H%8gpx1t}!tDtxkd#Jlr^ZfZW?w7I&@~@tUU6GKmYm(K|i`?!iG9g7D zCC$2WWN@eM8<`?CPeStQ<$!bO)}_vw=DeDpP&0ru1rV-ewis_+WZ!L>zCN+**RMxZ zvujgD%f8(Ap}gD=M)jy4IyWE_GA%V#t-V!^NZ5M~+#Jk5%wkwOcqoleCP8wcUqQ=0 zN0SHtES3F%D)>rDP0WV}T&wWkmKGHyMMX5AdWE1o*z45eD9S#zu;L#S6#rfS+V$(F zXuRa(P8sR=q7o?b^qz;w#HA@GD8K#w1?Rtu<46ia0|R5cys*EO!Bi(Fr=+IJ#>9gY zH#Uk7*YNlMrEvr^wd3bm|eE1aqc({<= zh(>qT7QZjEqiT8fr+|%AR8$NN4YzLHnt7c{U-I{LCWwrV?)5VinW0B5EyA^Dk9l_y zp)MB+(+_OgvBTWXPG##>TKu_m$?xsk1pINov<(STj%u5T4hpSpppvvk#c3ZF^3YID zH1pX-;zhi}&Ku>8WslPB-@l)5=d1o~3KyEKQ1P5ts)7AEewuPjV%pY0RaF%sb)<6D zZU*oXwBNUT&z`sPajs+^KAavMO&lHNIB)>fIg#AVCpN~8tmkWMZ@+S0RrNDUSG_s= zXeWuo#IRD&WIy?lBg*K4u?lU%BxWzzq#MOWb-hF%aO#b}-b}ND8S-COR zejThMcD$gViKF8IBwEccWMS3IsHlm?*J0pNzR+rp(`aij43~tMSaMq01e()Tg(OEs zMFj*n**TGbvffXL%Icq$FrB z(KEU=oz~S^KnN=#z!WL}N;&3QgrLL1!W?L4m9p16PLBV+jt{%JxU}Zn?QTqtyMKRc ztn3k$d`G`~_ry}RY$DQG%dDi(xN_wP?j_{7BnIIZ79Lqy-nuY9|CMh0=11v-%i5ik z4$)!MOaGu-HU{4VBfiyLbP7eYdnC6Kk^Nmx;R(yBpApAYo;0`ca~syD$R{Z4>FJrV zh}`e%>8Z`RJK0zMsw3Na?2G4~4*SWgUNnxVGM=8C{G6YLh{Ag9F3CPY@qzr-+KP%6 z=_YMMwJ}WA`zcQ5{k{-yM$Pt?{$S1nC%STv%Go22gsAYPck90hi>QY!R~_vHDZMVP zj->k-ERHve`LdqS`ci_Pc$`WphyY&B>?RUUUVnYgC@GD6Cn1a0j0q&dnB6=V+VI{W zmFCo~M5R;(*mmjoHD{r)%#Y2w)c;tV?9pD*2aI92>S7TulaKT1A^nG_a4k1eI_FC< z3l;>Rgq087%a~nI6Yv?(FonkYOYYgTC)H`yG4px|EAfsU{1!i-5hT1-i6~@l4c$DX zg2)>iqqKRulP%4UQ)eBQY$m!2>+97jU zNNBjDHS+TiLv9_Au7VPpM~^X#1tjudfQF+|tZa*{tmBMU)htpZ7yTAY^AWoRw8XL}auh-)R>81ZPKK0vZxj ztgAxKVaM~`n%lFP=-H0HU{*Q@*`5a8!RONO8gg;|zP^Orxr2((tVK0c+83{kPMD64 zj*t_?CG&Eg-B(ZAg@&A@q7uz%LbdR=WQ*o&B+D=82eXglV{i78)7DfQjEcQ}0b?AbG4UkU~n?3|iNiHHlqoQpq%oPrelw-TkS8SZgTC~!=)Noz(j zS=anzKVc5$#x*ZrE(zqi8NMezA>pb&`vCgr;X8~p55aZ%^y#BV#hPtqh669YJrSgBXozYc z%3!5AIXSJZtznjwm^KorZ~ePq_Y_e2s&8oM)tx#8*fAZQ@b`klg^#EJZa#hbq?}NH z`@yvs3mglzuy~J|va&i|dq0O_{8+UVDeNZ794mkOVLDgAvF6fo6fC@1(U3mcqKCaju> z2pDC3eSQ30e-{iAmbk686o_>D#-4x*4@p0)GSqu>a#VD^O2dq-*>gXJDA!FRN zD!qZoY)#)C6pEI`_UauN2po~|y2x})>FS*O`vlpeY0Ad1!`oQd4~>1#uW$>}+sC!U$W1k7;}T0~w-^hU;o5Absv~W%}j8!JwcZ zv+0=d@NjIS7|EKYSMqT<)PVa-UA@Y+RC_C}`osIUnt_uC{Pul7aBQcB4iW^USs$N7 z;KILNj7C=z16B-0mA6>gqY=TFRqAvN=3S#4I7_znIB7*Cpa^AUc(57Wa61n2Gp!xX zg9~osu(oyJ;xMeuA3mbc`v2`CJ;t@u8-<0aG{++T;@OKAKZl0_CDh{N6AqlU-AApP z%H9cOl&V**oT76DyMB_P(G(q(?dN}CLfP2j9`0rP0Gj}VTpfz`A~-2Z_&rIqh@1cF z!vY=5;*w!GBrh#p1*=(JUJflKVBRMVO7=0A(?lT^VLS15ji3>DMUZ_4E0OTTr@#82 zX#S9(;0i3fhzHgW`ex?=feh{9CpfgCRB693H4u8o7-Sl^e2{$2=XKz$a#F(%By>6o-2UdL4RaG3sI|9%O_ybmat&#Z1(Qd6!Q**>C|;m=<4t?^3FtKHtCJg2U0 z_epu*bg91RId>wt?iKH6mLmH!xpiZn6;U#)6nSJt)EaAyE-&A4%wNpzXkje7oR`#3 ze_+;8u;095F{pCzO+`P1mwThGZts!nkz_I#FS@zAyQij_3k%;v;#mNP+6Uv7qV9<- zs}W^s>33R%+YdZtq1fIek58%_8idUIz5xx#$H!-=as-r3PfzQfUr5x*AMNeEAlld0 zCvbrC@L^Yv?K^fj*xT>ixf3-ZpxTsQSIE-tQOFWTZ>GmPi;>(}T2Tr^uygL*If(iGlR72iodv&P7jmg`rCHI-W?#!8K0akNwYJZn z!(w9xC%TJ)WL4hX_~gxWskOCLQ64zwaM-P(}5 zc~%zohThc!0yb!f7U<)XYETmiKf$yu%ktBM&7!jE>TkTgC%T{FwDX5=H8p5$Z8X-N zD~i*p{PuI>SgeqcgY@*lUkHWIT2fL{08ij$xVgGY1o0+^hxaU7fns_uYx8d%-5XRp zoBrkkV4{fZWsA}C@J{zdREUMT$+jHQGcm!iPc!nF^>|n~@dfqs(bYY?c+1q(sq^z@YwKB|mAUgTFQWCruii2r zW{H>l)``LgdF|(J6SN4^DeAtMTHi)5}}*S?C*>LQ{nQg4RabF6e)Iz*pD_#?dBR5Ez|&&p7CQiaTIX*S74>y>ey`t~E-y^O zSV5ckypBu4G{Z&%+n|m&tQ!au%hcVE3Nb5hy}ikYEObmd@)F|WT5|2IXX?=W*rQQ} zFM@N&;jlc1MeIK^@*(~ADJfce;bw7=_xALlOZ1DwJ9h3gviD`cq8AB1Y=QS z7tp-ym=T_SegIk;qI!ShR?H2zLG>ZH%#6zK^<{K)daxMy6z;#%T<6w-As*di&xuX{ z+&3}}yMO;&H+i1z^iia80Qy^nq67^*BXBC{4qDQAJG=}>AbNkI?A!II&H{IhjN9j$ z-B~OLYh%E%cz6)+-Me?-b91vY_R@gD=FOYyPqC&aScqaz93dZRO1&gAv3lvw6nu1e z8<>rM?xWdd8jEBQ^7&2dkAkh6WACi~H~xWl3MLdhhsa@bFgEAhbJmlUle4m}F3q#BuC^AsE64+Cqeq?un-U(t{rmSV)3vlW z1PeKFr00D2UT8(7_OG1#upMBOqI=@S*KhxCf6?Qhqh1 z-b5F%GjJ)P8L|v0IaCRrBRGzCJh%DKAk)T%m5uF^s3_U@_XagR)y0K{ZTU_erKLv& z1cHvq$jYJ_dHvKt&942tKSoDKhlU6O3th^~&kw)gbnQQaf`SmxnkcE+>1pV>5oj%- zmE$I@y!VC2d%o`3y44*Dm&|*(>O7Wb?EYFxKK}1=<2e7!LTOPlceSsE{e&wtJ6?tR z6HGXiGEniE{T28(m>+<6IGM3gQR%kRgTamq0~iu^M1RF=K;+4Z2_@ui4ei1|45BlF zomQIAeRe1*AAQ%Jla}~A5>-+r-@Cp?55Og=3Ph6s3x+lPwc}8btEiBDX zVh&&#j~}lBpY+uZrbv)}`)<$hOl?3+&WMQ0>({B2l@g3cg&~%NOWEz?M^?Jmq!Lbr zy)0qT(U(z@-{e6SHjSE^+UCu!U_Rla!BVI6B5@n|zdA`&7Tp-Ypu+a-+AWSDK)FWT z$4AhCUn>$DEHX1QfxJ^{7ITyJQIZl)ag*!ayLVBEXH0rw>%`Q+_4~r_Y^QfJz1?z& z^&g^-DxObgQ{O*^9lE7u`}lA40iiF-du6@#YSB?q#e%4@_tk35KwrPa(i6ShaXCic z2+wt3e`l+0$Y`*)JybtNZ+K)Q(LJe8*-KyljcWaQMZvT-G{Olg(&b45{pRXL-$M-isN$D{#seKnh{HOaa9FVL6#bkhCS=dOWy=--?u8Op zOqdhxe;)Ml=1`^3s`!;Fn#=aEar=(n5H`OwbtLQVq#oc4y?{+s>wP?iU*tb8xa1BY z-1S@vUJjE+$C==wfQI_|QpYynf{~VVXg|-N=oJn)la%c#%IMwl@EFCT!ZFHmeisQ* zt>lb>!=;6)JS%R4a;7__-UwuZSZXWpNJWOgkGJRk^B6L6IXSsw%I`gjyVHzYtbj)W zHjHird3tUe6S{Ee5(f9IxVyKvH`zGdsOfX}1Wd1KYsRPU2}UL+Bt2xPjzY*he!{+j zQ0X_z6gW`X(UA`vfo-?2umIC)G>N@~eR9ts&wA`lUf#+;P1I1^vj}oeQTWcP91V?) zb5X<5SqYg(fB@Flta+ll_$}j9?L9`uZn5^&!CgR>NeTqVd~})N?<776H8tb%u>^ zZaxXtH>DzV^A1Xj(bgv5ney^uEG+%TDknj*fBE84*2~AwU&hgqYsaHvqNTN)n)--C zzW%jq&s|+NyBD0`<_70r3w3zD+^+8%HSYKB-EqoPXXgUoI=muaYtZZ0(2QTJ8&o(M z;ah_&H#aluGRp+M2O44u8)`_hyL*@18yNLz@zpC=?yjOo`@N_C6-Qyw@USrG_?2>= z4oFWT6d?3re1kFI!EY_$2zEgvR2tQSKYa?t;S5#^u}k-`w4u_h-j|QEvAK#6TsZfg z)F>2hWNI1=C-29PkhgDBQBI$h_7z_HjCtQqIzHJ$yXk}+gS?Dda_*WdD()*AM9L(i zxBkzn&}kD^FDv|)_Oww|eZ4wRHQXgnR&H*Bodg7fver>^#@}c+gTAPT$q{~eyzj&V zk3U?6ub*F`RY4d;LEAA}V^qt;wA^N;s7K-t4GyhgRL^R&Ck-3yeGwKkKNzc|qin?p&w2~vKO zGh+X#TfU*83~W%zwt%Zf1bdThHS!Wjc*_#GjJ>@*NHOp*j~?x4fz>z!PNU8Q>j)LvNtD|ctFeqH7$B%a+0%wqa<2oGLJ>G~y`ukHZii>JEOz)-L(I}m( zc+%h;h*I_+S@ZeH1l@bx`9DsAu;>)Jh4b@g12^v%w4ZA+&8ItU^uj_8QuXSU3M7H* zm~yReeE4~yxY$^alG<7eu$d{_^5(jBK=+Zlr&X+JcP4%xs{eso7o1y?e=J+N^J+3@r4xZA>ARVY~$ofay+N zg4^KX0C6Ry%+URR);#9_YGmjHY@`qEHg3)E_UiPZGw&N43-n1!X~ynUW1Bb*e}Ac)V-&Ia~*`BM2j zE&9_=A0>x(;OW6<@sn)#ZdfXRb|tKb-mP0lU!{QKXY`JakAJM&n0ix+v9zqr9EG^c zuAe`z4Fv>vSm3@(=uX#{2b*{F?0#oFq?P*=o50_053qM6_DyeDKvM%A_2tVKI4Qtd zXvx6?Wyj4e+x$VowB7d9wInyzqeoL@?o~g@<@v2d?Fv zKwTa>703%)QC8MBFt7>4|I8QyAFC_yH6*#seOEXdqzhO(9`F`=^u#2Fof*qs>;fSP}QWOqJq)8q@f|e1C!6V+tbL{co*0{ zbjw6+0K`ZnkEt3-T^xD*O^Y)BW55Pfoa*+$1Y4>1U$lRak>>b~drzNM!X z58ja2^)u8=#fuZp9?yMz&aPI%Uf}o{bl2Q?=Xq=+gp#o9Q^gwl!8S3fH6p<`W52c&+ih-xuxRrEnVF7l9 zOvci38gUqSuwbU6zlizCqRogGedvF20VT8ocZ6%$_%6LDp~e06Z=Mlgj7lA(uhfkV$Wbs@(_T6k#C4s zntXE%CXGJ$AG^EUM8aiq$_oOgEJOY3n)^uq4M~LP67PIm{e7USYVp7YMi~Is#;csz z;|Zam-%E5%;fNq)HR@|==~<{1D&3f<#-G^=9jL<-u&6xd21grVCs67BJS0RI+L5p9;H%Jg(2g*hW?!K>Xo5GtBZp^#AYm-Ofd*>nf}%=HOjKnF z5@pn^^Hyu0>Pt|_oxUZ|S6V7&a7V)QKK9=BO%LkgZtkNV$Ww{N_F)lhudF_K@xp~T z&w&&F!LLg~O+1=;6KYQ|Mv37k*JNdD8yb?bRZS+dGV9u;Uq-g?q#YZHOD6`7Zd%EA zd!DR z^js6P8NcVj&d%Q0fa$%%8}#j)c&0HjC~oNK5yA*r8#jS;1A>FZshWl&By6Lvks|}Q>s^-zD-)A8V)yFm>L~>zw4pIEUj=35 zi+9DB?7HGLHZM$|5>pwLiV zopR&|Cc-ls>;)218Iq^nGCU4-xAvl9z zAB>wpTUMIt^)H2mu5NCz(b3!ypkayr)tXf=p6`}RR;+H7d4K%jLoGQuZW?@Oe*=DG zYHI4$%aP}CN(5O*;yb@pz2u^HZY^XMf3{qb*kxK#pyRo?$Ni7PpvcrIK0PtgN zhzX3J`LC9>9|Vj=Dkf-%uYB`}L{!Jhu`wzmc!X%8^MeP#OkgpQt^qt=UR_*NH1qSj zvoUy!lc3fayKeJh@zT=L9O9~3BwoVsA4VP^ykteuXA1{ouW*ngH!4)8e2y0qHD1eEmf(IX%SbNK9x@ZWA|YIfp%21Z9A zczIY=gqQB{?gt|biaYBS=*r7SE^C}7A*vGb^B0toP}A2<`;fU2xzLr@9rO4u&gCBC zNZple>0}5lje_NXzA}hYufO;SFTH$Q~7nguVmL zu)KK~2l2pOT1L?>)e1N)$Q~q%S3g@&5}kY+Ba3|W|G-{KDFeJUv0JCK*`(+!!pPP3 z*lr@(xzpqFg$un7wu_BD_SKbMvop!ZU%p6yHqFa(Z0iNm7^6OpQr)w{e}KqGS}4~X z*x<;>i;#IBXvk0BZC)ceq*Di-aRg!-j=OwFIp5JaVFXo~w#v%OBQccu(9+6qQ-_<| zmWql!`O7n}A}MAUEWcL@nOfZ5*YRa)HCn^z?CZe!8z8l8?jm8EaD8MMx=z3I_bHjG zVHm(86n)hDe)jkEUA#0FDCkfRfp3Zh{qOER_AD|!F)`2a>@v18!f8%c%L^nhV@wy9 zhHw@I?vQ687~%F@JEZH31;>=P+yw`Au}Dq)U!+Jhex%@!<9?5a>l7XG_rw_&CMyXc zU-XOB9IBT-{k0S!cWk`nBqx%9mY%B60$4ZIWG!lPiNKRe?36so?BKKDTOrd-EDMJ& z+&mhMPIx`Ldg4<+hz-wX<8H(y(U; zs7y07KuCh-#An7+)9B7p@$vpfy>H_>pFBhftdK^IO-xQsYhy;sY=@L?(l%rL`JS&G zPxl*OUM+h|>!6~Ju(BdyEYwi6urWmK6^+SUZaW8th6O&D_mh^>?Z6M0nEv%I@1;-H zDQJ+(AYW>6q0O4~HJ{~nQuWHB&MSehb^&Xtrrj#9iE^rYRaq6P2dioKt7jYS0dQ{< zrg`%(i-)+ahF@T&fI~hA@GllxcbpM_@x!L`b74qG@L=C{B_$o~l zwLgcNjGEdp%0~(b$|yp2Sf%9z*Gdmc*DpZ6yE~g`G0ec&e_xGe+0YnoM^{#J{Q&33l5HHla1CVNL zd~C5WH8%F)VSI*bC4W<$R6q&udSkn%)+@>cPpL~8xo&#L zl2)1{orn2ZpZpkyjrJXh$58_tcx0D(m`&_Ea+9s9H;qZFG8xP9e9G>v`eM`0a3fGV z`wD-0XxHG`4;^={Yg_J_$}L+z>TjcYccj08cGt?qME9|G=ZDU|=@5FutS-=DGi{R| zr*uBySb4(el;z8pG@`P|Qp!8Z7RRpq9_ZeEai*|@`ISJEF*FB$O^uE0q{rPiz%xMza8c}F95N-3ndXbb9$QAW;pJr!&|9MgC(N@rt z%hCbavzfnmR*sLaD5NqUxa!sF*={pt(_%=7QI&PJNg6kG^;lhM+uz>#>4&o_ZO34r z3eS((eBPYZws+n%xpL%V<3FcYSbhj4=L^c-8FOM;kgoLd3ZfeuAD++*7U)Pw8)}cC z&E(Cg^XYeQrZc6jTogLPJ@Lb|>wDv6lay`k`|P_b4WQvUHTvk!nCZ3W{IDEi#6%A| zghAl$QEo>hX#74b1wisW68Q{-a6nCi)b`XzBmmGFb!7+`*vH35_~5}Xq!Sa|M1ubz#{0q_`zLXEmJ}k7tK94GZL2rlFBFAEWn_xy z?8ne;ZMXNU7RF1(O`;Y<^31_wxfTY*sAXg>GbA=s2>!+;z1SMKsJy509pmr*(6_SxVuHQ7UqjCOV%d)YpRZ+k+&`r4yD zzNx6+Zgsk02jk1r#?(8IwSLn+Z}thDJ0Wc2jDIGm1XkOKiIsvkh>$~?skLASKSSq3 zqdUF5d-3tNKq0Xfgw^+m9wHllPI=RGY-k|!fyZd;-I9JgcNft;GDgFu_+G@-0nwh` zw9@wW01sp%yS`sw|CDKdM0BeAsiu9Nwbh4bg$1#}zP`+Dn?HRbukPAUcT?(h)(el5 zT*1HQ+ch;$h`!e@)@-61?E7$;rV{BU5sPeRmk-1VK4Rfl!K0FtQoTGR--tgS<)o~9 zL?y!5HJPh4qByN&GCY^*xXckp*J3?9J~vT(oN-~g;gMM;@+4B5%LDg_iUx2*OwPBv z?+W&-=ipZ%B;EJhEzZR=hfPh{RW}!YSvuNwYGs8M3%Rr;;!k_ketOV&AhGGa!LH!3 zWgNV$mpAH2KJU7>xa-K#-N|pg3k%Ht7h~@M&Sn3G4{H)-lom;pQC3A%R-u%htYnWO zo0PI=MKq+$knEJ1ovndnWs|-42-)L3Z%>~0_kWM~J&yN2p5OE9iSPG&fA9NqU!Utb zuk$=F_ortsO5mjN#bJ`@{=HClL#)V^f)^~7Cee{CN5aqCd)WB7h_W>_l%d+WsZGDw z67#xEaJo$u8cEtIscFG)`jQ-!tooDhmE*O7YASc}89Gl2zf!KC(eUsgvq*b$yVE9` zU_pOoVPEBfEn6;FbiWezeJf;B(e*0c@m3E{HLrg!Yis7nKQ{}BS02u_?djhuRhh=C z&wYi8s$S&61?D}+1s!k66wOaPYHIqilT-bZ=2(lqo5c0&rv%^XR`Mur7A$DY6gB;I zvMEKU=AE#_{kaL1!Ii)>Q_A8T{q zb6SxZncKGQNrK%UfQYZuCzKM~Sea!icS}o8xw~tWD{rh9NnVT%4RtR}(Js^*-1a>o z;rw~QNd0fAhNX>lkAk(5qqhqdw6yHW{KWZEF{HQXDf}!BGc$(Njc8Y>1~E*ScwTw7 zi(D(oPW}9Onrs6kQZ%p9E!EPI?1qbz9_C35aHCrFdhI1fKojQ6?ddC;P-tf{4CX>N`edokK?*YMtpG_psIadC5h zh>HVII@_3J>CKuMEHuwSBW&kazVlM|P0{)53JN>rR8(yGD>R-A6h8AuVs%-fIo%c5 zru3WBhHW`pBz(NRk#9Mq+jo7t4Cp^lz>MjNmZs);qHsq6te3wN6L8BM(~v_sEUQXL z#Kauy?e)d2WjJep9^?k6>q-sD<`m>lCnw3>-&+{NwOG6{7Z+;8z(;VdY2NqcoeN`K zM}^g*ud3DiaENAKqu87sxtGH-UCQiwa>mvsohJ+?aA7S@3uIU#rF`Re&}77j)haed zP0;cfx)8}-%0eSUKX!h+CdkGX()y&aaB1OBcD3;-!TTY^y1KcS)X!N%Nab#F#vd=Q zlTB;^@89d>^2+ka-E;cHT;lYBiBjtDz{3}^Nd$0c%PSSdjk*<>4 z!6UUZld6T>r{WxxDLEgsl)G*zt2os}mo$T1OMCXDqJyRN$Dn5|D_*(tMR@RLj~rIg zC042O;-^oXH%Rx{?R&XHdFGDq!5hhTZ#0A>1$|ocR0>9BzEK`;(xfidDQX@HYS;ki1r!_OVQY`NDV1(<4PRhu=!?+<15({OOFHD>0lcq;*{QiE>Bl*mw zO3EfSQhd#YON`x3uL|g{&2;#SSf@M+*-{o$X;l0)2oIO#VZCj)LZ+HhUf%Cde)ec2 z_*L-pxYL&L=^3+l<|HZhc#b&9zmwJ|Lp&Ks-sAW@K5J*c89^^cj`N#wBg4wbkC3XG2;t{(=Mb#AXYE(8oAJLtzodFADeC$SH zQp+vlVsk(f`(tUE7n7sUl$sVkE%#>Q(XOPo&l3>5h9LF1a%OKfudQvujXHgQx_S|O zu;9h>=R4=8TC^O`%+9u-Vf<5!?jgyX+tJ$PN4g}=tmxWgJ1klPbI7_sn2fpygs1oR#icx6UNQh_D|&H#}`?AS50Nw@WkN1K%4;8bm` ztD>T@sCqd*XGO~~Z(*P+9bL`fQ^u@n$@-OfsHV1%k~%D>m7rq_sy#}MBRfle_{Jt` zTsh3FrDaARRFxdCG}j#?Xm#?%fiv&l&oMfg&kj@_7R}Gh%WDe@Qv(1dY#zCrM%ZDY zwzSl0eiEInM_<3dgqLBwkH4h0b{fo4K}!i2H#6U$B2bb`&!7JcJHr8bw=9&Eb5nkTcz*GBVH9l4meCj#|*1`bLS>{4}9_0uVm?VJQ zchJ`-rl!{a{OFDD$UV2MAy57nkmtAJ1YhpSoVDncQm888S>GuwxOH!Et}NDaTGqXB zLl(6YZj=|nbC#H1_+wn}$^NI;U#mWQsnx*P z*v|Ts+vD43tS9dDR|q{g^a+KXgztC=FHvBe+xg^M!8!f8i4EM`Iv&rbH*Sgu6l5k= zxuq6_dpd;l9S6cZn#Yl74uriL|K`b!el~3loHg>-0kuKW|8l>Y-C)x zu&{_`9Ke`XP)`B=85-$Sv|9rJl3?+X2`1bx&Mn^o0K@o&AJ~$ga=Iva> zg_x5Z7);|87#G$3k-uYyTG2o(Hb^{ZmB5KxT5>XV=A8f+q3`XRks+{n?A0ac#UqWO zz{FDtL8k6r{%0~Ne^APW5S*crz#`@vp+#64sDj7EZB*_7r|*gZZH$b)FyPv2PE08|JW zdR-Bo-??MI_K#lkCcBgSoBYSJKbridKs3Ml*z(6W|k2{)D z^3h+7eb0{n`1#`p#B?ei{Y2Dayk@`jqK~q3ly>jl=y&guwT_6;XeXU!VYzTt&?`UR z3H?D71X0^omZoIas=>rxPX&3pA9y`{>f0i`?&Ah8Y{3vKZ zZv|CWRdx0ER;R%Oj(}wWz*$I=`=Kq2LY6B$tk(=T70V;oLC>2KB0*#ag#xCe_%h|J z$B#=%MvK?gXREpU=e<5|R))kO=CVi?-#*Z)bg-R(l09Oz4XX+wiC%LcyCBsSupR-i z8=>avrAyY$&d80rdV0QXO#k@t6Sygd)8%c})R#i=Y6M$Cvgmn&} z{?hcf%A9RUI+8%Nn+^tuIyr)SPot}+_kv#FMQQKQ@UWnuU`l2-L4Re) z>OoSVG<=)Dgj{NPb?FHH3MdYZ-N%)o*hF^&Tpje$jf~9Z&g{f(Joh3i>sS72IeLMW zZ6472Z_jY!0V8UOwKQ1LF10YD*yuJ*SYKiAhB)Qx?MR%&m%Ap z-0dmwC}bqSwSepmkT4+oBvAIy`vaAiCf9KpM&23%W^FCdal)_Ok4ueE9B6u=u6h!Rk@^>lVJ(UO<`_|bOk7qAet=-!;QFv1iIY-(da!yY|;d{I0N5kn_f z4S+lNj_6Fi0Xs!J4BRX5M8V=CI5V%H@CF72hW4dP?vQ%ZKx-kVq%@0Vg4GQ4pgqgN z`1*BZ3Dy%Gpi;hg@j^SPv7}@WNId#)Egx@+W4H70D9^Q<1>*^1tOk%DunK2pmGSg= zPX(X8+Xboa4s!BepYBHF<~o?0PokaGsGN%cfUbZe2sX*_8R&WgutifBEbg+m!r5!x znp5x<0D}TJ9~3X(B;v}U!G&NE78VAOat8%P(CNF(!yhn#de3Hrr=`7_R^zZq&Yc-+ z4GInxzEMEJ&#QHh6weOHcxjo*CG{3L{^qgb;?6rQEv)F(E>v16U+2F9$ed(igRs+z zeS4k*?tC1N5$L8!vD$D>;Ick3D0_VZ917-e2u9G{!p%mqu<$=zJ3}M{60{5qxrQ~Y zGi7(ME8>v@{}4V*s*Zv-?{}RD72)v^!2TV>phCQe_Q7a3>Yx)BzNUx3F1z`l|{?XX=R>`1{Lk* z&6^>+oV3nCcDkzyISrlXF>GoGTp(=zNkBsjS=`kRTkJ{^BAA)^_esx0du4_32ZNmp zJq+ktpl$$x26q4w5u`5e2EhE|bd@W+z_3}sU~_%_4Cs;2T|zyOq@px*wdCY@QwrPg z=;3hWndrw!Ubt{wQSqXrB*qgF3|ao2=_$bBdYG3WlXCwKvj6VSkNIIqK&W2a7iLBg zyOrhSek-PJ1vAMFl)aD?WMVK+AhaH(y^u0F=YA(H6LG-Pedjisl4Xro_Y?B68hh^G z`yh?;(O4LPC)aPd7d| z_e(=k0xUjs#!f(0c=s;WZN|rsjbK-ZA8m5uH~sb94{R_(_K)1Su~C`dMQ+b2znI9QA{zH&zb$O_es1ls0kIpJ9` zFOiax0>40CTRR*CDl8^MZPXX6Gu{kqjMHE3?IA#aa+`gwf`<&ycvu7S7;{2lmvI}M z&qa^4pEWgVAhaeXn%%iGA<%B`{qp6ZQ3Ydi5DD;3{Hc~;a#HN!1VsU<<9)>Yrtd=h z+ZgT4qB+4(0!IrvJ+wAY9Xs|kwI3QtsFRJ&zO0c90TU z(oNNx(ts1fOW@V3S4i$nwuMwuLB&Z)nehJoKtp0Xa`sI1F(`+@<}lUQ7tsAdi|6{) zrAUa_Wq&+o4mhE65rqmqrL_a!O$g)}d$hAF1gM1K50-}E&4>3h@MuvW?7&rnZ+uk~TR5fL^*Z?UHF6_HJ&mrqZA{Y7+iKbo$%K2HX)N1!9>-~99I*X}Q_6xErV zu&x>Q?(N5&1B0;M0DG`WpAe;6cYlBJS(;57H_}NpQ6s}brQ)CT%K#7%a8hAhCQ5fv3xs8=S(PU8kgL>$(rMg{~L z1sXcJ;QfK?k&t+Wa}R~<7d%%b5Z{-63J?aV6k@eXvNL83*`?9mV&87Xn?nzsY! zSeDpI&YyqKqGM}#o(P59#GUa1x-}GDQMkfpjGAbV4RhPOwE^Ln zqXk_q^ukjQ55ma>`yi+s3gf&2f6s-450|Ek%ZT(spCSG3P1W-a{v;7}E!`aSBvx@p_bW>kJ5Zk0Vn+b3)Y<`y_7_!%y}*^L`N zTRPWImH0@u%}xayCq6*DYo!;(v!M z4{8MaaQ@pZ%Ga)mOMtm?mid(ks(%k>83y7r zxS)9LM*jB1{c9&50aX2W{M?9Z-r+p~(l7D>nkr}@iBzqRlBjTrqaz=!$+x+=%TS$* z>Va?d0oEBj@W6RZ2)gu1(D@5-fj$%oXWxtU&7WjN3Ht z-y6cg9E7cv<;8oMEeNMjwNT65ycy={>4_MKng@$#y7vv@JLpUsHf(^98BkLa7EgM* zUth}2uUij#T7eXF(6b@UxWUC`bNwm8wgG$*)W8Ql1t9VPWq|odS=j-oTd{m~SkMtc*8_+c~wivR8Z^qnNCUWk>5@6eTi z*;x{=-D(c0I2a%}Si-?-2Q-IE0#`X^m{9pVd2$(MCP>R0StVZ_==^Ohp#XCRq?o89 zNw;j#fKr;B7BqQr85t1!;nC&in~ka$x;9waG>M_~<=puM1l;WVgI_c^46RiRz8Jch zvJ>DqeM~9x4#hZS=;W`-%3|6h=$84rsxsOg!IQTH_uc8;GM<%t9juSU*SP?Xks&kI zAi__P&=pWJ}4(oq&ReoBK8bDe564u(~=cP*bGpc)BASYFtaMZ;$sUvjNw2RytANHv(LP}X9PMDy+l8ym;b<>JbZSQL;CAh@AkW#l($ zL{5cAfBN7KL~LgSKF==X%P8kpppxl5IKF6-X_Dfhgo__y~~XlLTz~ zAlVeK=O2Tp2+$wAFnaHt2EEZ=tr_#In8Eqev5|srePnbrk{8MYr)6(@!%GD!JU~7W zTVOnDKwuz3PG5ij@Zexlm0SMmirtMHp+Q0PG=|2;`MOtd8sEQOI_&J!f>H$}Ym~)n zo5tGdO~_b-1p(?I&Kx>-^cB+6`9muEe_O-f1vmquWDsQ35O~m)+$?&&AC3LqI)EUV z*YQ2!@Unzl3zl5)UxN7z$jL`uU4jhGoiI}%a!F8@f`XdSC20C6hL!+Mn^2BJU&pjY zRR*%YZQC{p_^y_9-hs6W%rSPuI|{;2xR*Q=N62j3f!$)|Ji_}CW{_^N-u@>nhs2|1 zU(3Jn$>4(xz{vxZCj{?kF6oyCp2Eg}I?F>QMO$A#8W28q<17B`?Ch6T3A6<1HPSLj zmcXl?MGXiDc=lgCIPL_ro$}+>K6U?9#bWxPTLp_iE+fH zl{5U!Y|fQZ@7os@Q4@A_Jj+C-F~`ANd|FCs#VvP{@>$nV^Jz!tD1i?TLuu$ObvWNE z%SOoYonYmE&P7+~o-1*+b{|FkzFl^layn1w1ozY`C(VB2CO`H*lvYJ~kL80|&yp0L z4HD;WvA0+D_NLs^n|WiWm;07PwBpQfhwfZdXEz{;pk6Hlm8%R|+BYs10G#M9cY9Ok5m@p(qN2XU`%C8@$(Gr&3#FXz~tb@Fn zeA>80$p(_|XZ)r&PlDD~i`vPRTH(J`<=lqQ4$__!R8F&lHEYJd|2}J>k;LBzVf)+0 z1X~2<`weRASp&%h$}OUYoR;SML*TbSc-Hg;nHGO6k5 z1@Cm6!#tDqQ}v+*lM6uYbA^6FehgAVkMw5D7#IIc^_|97>JL<}=sbWzeQoS-Zsr;Y zD=(+lUS5+$#>ts0Xw@xY!$G`qrH04=Mu??Le*b3XZ(K?;8~y|!a}l}OmyOcQPUH0f zTa7-><|+F}B+gwfxI~Aqz58eX={upwa0o|U;voNk+ex+mysGZRmmbd>xyCdz|C1BmQ^8wVFqEg@j3lU1Qc77)mQ zzHS?nACDHso#ewk4T@GAhK$+3A3(KkMOhBIJ@6K^acIQUF}$z5+!Ug^w{PF#B#i6h zO6ojrHT6T8gIpjFkUv~ZfnY)7Y!4^^zXiD(>OlP2`>7MwUA%0VSinhLv;??X#S-FR zya{Xo?*tk<_?^DDm#dLFTpqy*%b?1Xu;xj24*n!0}6cj!yN5I04A$8`^LiD(%Y3 zN|-P~EsX1a5CRxv!B9gX55Xr@15}5p3gr3HS<10>fM45NTI_MxK<&dohKkB-@0lQQ88o#Cq^GulV^>mJHseTrPxXADuC*OBoorT;^~Euyx~tMOgx6 zV3IH}cz^$W_R1qF5nQ4o`eKN|Ur>j`i={dY=4I4fD0r&F0Fn;3StDhG0T+~%Ei(}C zA9Imqr^RDcZOkO$L3hf9S}JPt8BgAwd-sOHx=_+`U@4a>I|TR?s}*cS7$E3AzJ@dc z%M(>weND|Sv4P=X^yVjlTp^2r%_6cv`Ro^BVXyJ+a3ye=bJ0R-X=BA^71lv|%M@#o z&I6hzVqV|BPut}5pVj3vw*c2E(D+=s5Qo^dy+Qx&vR@Q1hG|_fL)z9nD9;~Euz5(#TQEYuD>LgVb|fMei{a@47zaiB`i>wQhv`8qLPF{Si=#*=#N2@! z^iPbUo`H92l>BA4-5iRvV(KU^&O%?2nsCAncqtyzZBX#x%PwkY{b zT)(otFr1A?+7i&r#mR|m$Rg!8rjFwgL(+%xiq)kNk<{-i3MZaJhYFgT)qatl=+D?j z!mfuWY=3Kx&9&G%)L`oCyIEm5xx^TKx-gH!l^$TG3`G8DdZ!nHNwF(Sb?yfG3jbND_1 zbNB@LQ5n(lgHH0{{+Udp!MXoT_z)i?tA6)Jw%dxps( z?hl|L!q3aAmZS~WdAWmQdr4%4272$z8-}`^ww?g*XtYQALCfV!WP)~&6Jxbe4otc>#_35Ny#M2iqAhMInzo3N`2^tDatONQ*UF?;lG-6l1R+gNHo74LwIbnt+7g(!zbMz5Z{c>tRzpUhtqZ zUd@c}ynUr-Y#fyLi;e4Tz_?&tZ>9_cOhQVF zkq+dLfSy!XjBMS&tFY)o4bS@-WMHAkk>HUreZvJgrttm{F{$C-!&$v_(JYXp@FKzv z^r$eMSbt#f^OweD6XKWqp<^^OoNu!m|2xr_c;z7;_PH>L8lyBs8kksk|IMlJlXC}? zBH5%80H6M9Y$S9s>+2govnk##>VwIv<>XXUh_P$)Qiyj0#-?`jF{9M`C%f2wF#H=y z@Rx@ekAJ0NsX)z_pqYE@e@=So{AVhbQba=7Q!By8a($1&YkH{srX@;X)k(~2Tsvs5 zqw)lpNaU`E4(rW@MIt*Y#O_8+xF8Paa3k!OC|uTlgMxNRmKg^D+o@T&x&*;G>_B0toElfp+}Zz_S4Z^7%3HmanXsH|V$ zj#k_`0e*h;GYC5z5Jb-CR~%q+k%}5>&Cc-kMJ^Ew9szPBQE+=csL!Ho5IlXFQzbbP zo_esbq=UScnwg*95{nw=wTSaa84N$e`@g#`Fnz-}$7YCHH|I|07qAfw(thDCiy~#f zJD)PDCEV?rlB1}#vBAr~#_53{iBp`%-MAXaw~dSp-ctp@)1~96_AX~kXK1Bu!kRTm#8;PSI9l(4Jmqs)|kQxxQ zg8qIu{vIU$xftqVX_)KwZe)_0Mj;7${e z0RRsdY9#*1A`f4DPTVKtjIPwUkw`uFi1ESZ!i~}KQv2mThnr|SXbOafglHk_d-qSk zB=lbzndZ9ai{nYsM79d;D8s>nV_jX<=qoZwh>1M}oQ)DtFxvuiO6I~|o5Nbm%4%)E zFmX!c-_e~ST5q`O*cU075Wyp7us?tZMLbYg$0#I-S_hUvuGC=dVTZ?8zs=8*yB)C{ z9@Yzf*j=`4-h6+!-V`+f_A=fz+-Z5P+Y=I9VdHvE!@wK(vOpvuMf?LCewCpGEsuvR z!gAZOPG9UhL5$~IJJ@BhEdz^2vOkG4LwQ1QSI|R8*u*L{z~aO60));8!4m!+k*>mM zp&W6U`2CwOmIosU>TiP4Gva1|fPvf$hP$cQ#DSXsKelhVz_0!AHzN{~fx1}#X>P+E zF;I~c{9Dx9gOCKG=S$x63OAIR+>u?8kFK1sV{i5SH#o|gzYYk1V~Qv{`+N9OAvYtQ zSr=*`>ZqIA+S-r@tL0e#Cc+4SD?If~5-9xp%L1UdoyU?QQk*FH!f)Tmm>{(}IUSd{ zI!+~rWTO%JEpQ~PxIbW)lDldnUqE%71hW_bgm55=eCCE~4Fx!g)X*!C54xdudI_A z&l@&vc^jG7IuyjMlVM(9-^D8$-@g5}(*v$@NNTG;75-yjFo4YgCXg0)@A?Q*kkIZT zrQB}TY73vz>y(N5RHC#5mK*PN`IffVzvPi#?^4*_5Zviw>;k27j zQQ}~EfbSL((vJ9qaG(reop2xSD0pD*hS!A1O^DwGf~FiT&9I(hd@m>}(j)c)m{ecA zS~prminRKxQ>SbXmu5~Q92+u>dH#LxP>HZ#q$KP`uRGnC&EVK&F8S}@coGO3>l-6}dWa2s_bbTt6+sq4^BQAB*I#uGvQ+V^ zDePAWEJ@`j*Z-bmizuxyeB~w%^E*tr^Uy(6HG2JDc5&;Sr--M*F}Yen1NR4 zHeHDnn#jIo&2bInsx!>A04ZR)e9TXxPtBcJAW)mtA(cu;j+g%Ev z3P9f1PnmrZCig`i!|*0Jt5Y#UKSEC6VHDZQ0-~ z&&==LeRT@093Meil5@B!H)nC3pt>Zk5^-2dqA4J<^bz?vKW5%w zyB5W?jkhmf0@Bw4%LNx4+WsNa)66e*>4!18H zXU{@<_y<^u*E)pvTPZK+-uz^Rux%=wBej$ppW(uR6Y~$5T!MNNgbbg+Y5nwx5Uerm z8h>*!VjGyC+qPxe%}QhJooetAm-q5f>a$~}bo_DPrW~_62d4>KkBQ{8v?#1>;*c#s z;6Id0M)3?)Qb}ue*k0~8i`Xe#sB!xc1A(~V-^j;+Ht06zYabF4BCH^Q%72fr^~mD}fkRbNB91`~o=1;7GuKx5dg?0C^H6 z1qG-gRQNXq1?r~{7b9rI1_lSu2ns614-NJ8b@nN~Ly5F?>w>x47Lp!XJV+Puq|yu9 z^3|b*kHdMR+1OYlt0oCHkqx(g)C&m z1TS<8(P}g?9VI+u*8T(2lp4uCc3=k}4xr(%=9ZL%@dN%0Yd16>$(Xk9*bR%Qs4LC2 zaZNuze=aI1NwBxkKYUm`^V%koN%x104qJF5~eEg$QBiY{I%N-@@Z=dLJmus-k0d$At99HGdjt8&Qxu(-IZ z!Y;n!a~TH=ZiF7c#D@OQsZ%W17eah$kqW2s4O;xjPh2sT@ujqI&Emx5EZA$pLsD<9 z`P(|q}{iVofz~-Jegh? z-l&%-xSRT;5EE0<)u0U}C3M)i;DNK{W%0Lf80Gc-GgEf>jji%b0HIYD)FP_j$bo;1 z(vGUeqa!ij-kG0RQ!Sq|E-NF0t3dpZ_&=F_`}Pe`uFi^$TSU{6KbpQSeD7XOhT{=9 z0eRplbVZ7a#FUsJN*tj*Pd$|Y;W(_=G;>yN-FyJRRaF3Q(66*9k7v*BSz5ABIG{#-r^!-Sx9;eaR7_CbK!v`whyy& zPqv&?%d@uu2rK2!?SB2xzpt7&J2rNkOO@~YBxIsa8bRAc4FZDN@U(`=h)YlGI{qRpH z!v8rY6!DYpO#QhLcz2S^66X~>JfJ?l0RQp-@)n@9xm$M_>E4F9)_m79&)!SOTFf7? z2s3%gM@fM-eQiDKrxtV1a}X_W`DE7qWMabo{G+UrSLj9cY~)=!^a%F80E37TjBAG& z*{hc?t;bsaZ165278T|g-aY0t3UiKj9Rng7W^>x(#=&Ein@c7p#G3#7Hk)#eFI7_Cc>?aJfLZROkCwaY;x_L*wSkrO9=BQ-<;^dIW80zpWIAJ^hxhi3r+C86gv zdan@IfLJl^s_`p5-ZDf}jX0cFPdlw-W!u@b-UQ7m#Oa{dDdKETA^ea5umy)Q2{qz+ z+?-$(e>|6J^k;mlBXH}mFq!Q8h8$KP0KF8XU7Dx>glL9F1;Ef(>(^pM{KG$}Q{RpK zEGqiZkP#I31c;QT?8MjX-SqUv5XcP;{a2^nO1;9qt}qr!>8%+iyl(u`ndjPuKOLo>mxB)M$72^%)fVpR`2)kn2#Ub9hdWvCHkRaA+c6N zvh8S#`VA!-*evT|hvb$%rm6jz{uX&T58L&>?}^UsBy^9v){}-Wm0!N3+Re@=D#lf# zHF~$e>+N>|RGM(s`mYLTJH*Gg)RLM10p}oVf)KaTm}8TIrY4e@|L*Di0Q4j>e7fR*SEB@(gIrRMF{f^dZsKfG?CZDaBRug)qe#=P?i(wzG zEgw^Ilp(sZhuVQEni(SnU&|!_7A9>SonJo^syG8#4yf4Heo^!U@r$5jU~~HKep#lf z#(Q{NPtp71ICrxIH^RIa7jpgyE^RjY1u7~k4%1bVIHk$+s;Wa6@bY)*7YK$avQZt( zxj*{rRpr|#y8SHvJc)bv+lY_J7G!IiX>PqP}szOvr=CVIc z^!u~^Rtkq!w~!WJeciFraXyqfTtm=xdLz3ZGxN&rX3M;QfJeA|q32M~9Lz-Ko1KjY z_;;D2B0mp$&$U^tSeWx8ztRMQ&t|HssE{$ujEfHT^c#PWCdqOfPZM6tmVGWJFiAbDa3l8BZ5Zl_@+cDpD4FX`-W@gr;WE^wquMpQLg=Qb=Vz?k4#>MZiQp`1D zhwF@&p6@T^<%6A3dueRDFGoh3$ixc<$()>pT-&IB+O1cX+P}Ijh6q{-J9Og;x>3z~ zddj>$e)If7m#n(_(nROV`SbqmrxjIIe>Ia<(C>HS-lwU#jB?C>`YdZ-9e(c5-THmL zneFOAl+)_vCM{m8v7vZ1Dsm>Yjbg4l%?!_)HY7wKjCQx>{+#v)EdjwkMl0VeM8u=4 zCZ6P60)w!v$jOsGzD7td6orZFzpt}dy^0M))&MtL8o~=!6bH~=tgV!DRXVqC+xC^! zL6?5n4cv`bMN86q30GrAtg{-Q}(lnh6@E;4p#j)=ehAn!N7 zkAy_CA75KBUI?I9aNh5xl)a1&J%a-V99j_YOe7#kNJH_IW>|A^Z98T6!Yt#~7InOb zRaUbH{p|IaZ-*r-q}(8BRrs(Is<`*rB0(P-x>3sI7ErotU4EJI8z4m z>X(f)VS^hJ(3UV``i2V?S&EidzWu!4yQ`w0)qe^IFqF34>YQ=6=X=w3?^>3M3QG7# z`yIv>W8IIKAPFE8B9W^O4lAGW6d&@0>cPIh;_F_Xa93*iUY^r)Nqk#|Mw*Pp+*z*< zkuzD2F2r7o4)dU!zdyt`T`9UL>J%IHIg=W_f;B^nN>ZTO7^tVg z#${*vYdf~3JZkOX`bY94qWOaWK--dg3lOd3KkRHy-T(7lxid<_2H~XFua)rIKOMM* zZJ(d999eoVmm&-r(eP}1f>A6UgT(gMcjY958*aBdUb6k@&9-{dawMnlnSia$pT&WQ z2LTj@d%2gOS){^MoE|#m*pPs#AMd4t^_3Zx6&OAWS zDlPS~k?hZ2{L0dFO_q!(Lp?6%tHb)bD`dA@$#2)_oy)d-be|(xZ$;uh6)fj};}f>; zJ3e0@Puk?PdBX-aJO%I?ICMP?AoP*6EA3}hR0FSMe7w^+&d;w{^KJ)+&^_f1v}WjH z?x3sv(UNDXc0)lS?f^2F0zt{;t!8@;9B4u38I*#xS}v3foSe7RU0+(JX_=q!(6Dwt&Y4=yPCf zjNeEB=vpa)$R!Gon7YfGw*CWFP*G!&7Vx06eA9+lK&gYIkl`)PhIll~#8+1$0mItPpSH9H|bASE%Q+F}X zo6~mc%R0}8ia3WhkQJ#%Uz!ZT1$gr(Ik`0SXNJ5KJgndAU!b@+|{z2swpao>}`g!EAZ+9uyDb2l6%C1!QCEfRccw z^LOj%8ynNp(LrLa3&0CD?d=W%m!hQb=;in;J?iKv&dY0cq2^FpG1SpXGwSsO?{&oL~|X!fb=jA&$RP$>d^u z>fW4*t$34JpJTJ^%i;91p+PCuJCM&N-?%{zalx=E{BwealdGF#*_$(BG404d%7QXj zr!)XX0Ln61oDt{IlxWZ18zavG)1!Z^>c4;g+3s{J<8}mqkLn1wj0A_z4=rB2u)N~; zk32iA{9AZcflu_&u!hQo8a+w$CFT66Ous(P#SECYf>zHHiaty&j@v23eA~_Ou0B>t zoQ$c^ac<(W-|`Vw)@@A36xbJk7emGIDXLaEJ+4M{wWVQ)142G$h%%f&U8y4^XGiPf zgHsO-2k$$dtT28I?Nf8aT9~{NpJw<1R8t;Cu2$n>+V6j-K zk?DrNL1Y88U)5hAZ`G3*#;Z=knXTI4XVY?&=dry)Td@-5p!xqQM74 z9n$5a%zZiZmke+ZYzM1%Xtm!~RNPbjG)>I?UVj4AG*gHZ)%lH7q9#j4L0g<#&fe_` zPfDs9uArl%s|Y+5b7L10wuj*CG=W-=%+wf@;?_z4*&aAgI8DpdU|+r-r(9oFHvNby z#?DS)c6QZbb;Y}SDgT>I-bwqQ1fOTj~>Uwtx{5|t=pK| zobrwOIx!l+mHN-nb$?1cKb$VsOLGC#U47*pHdFNjipD;B1iaJLrl#XKPD$-g#?X%% z0CmW=R>oSX4J))3Qg$EnVGv!3J#$YHy>ls8`(qr6rz8V{rvih ziXK-p`(bFj7+KWG&d-n7#N3^oyR!z3@$Ok?EN|aV$TA9{4%aDWs$K}7*eh-DE4A(Q ziDk#7yQWA2+$cu_yaPjCMC-RA_TmZFGnk!t4|S9u%&67gm-g+-wElguJkU4z&4ISl z@Rt~RD_op6$J~7&&}DPo^ZgtL7)I|$L&oziy9o(JbH*%W*aBNbN#?mv$RU5x0FI(* zb$+mV=_ERuh5NUN-s(r+4_Vf~RmIaMP_F>AUcsDIR044PwzfGnfgAO^>nipufHhB^ z7#Vu0Keig2X{@Pxa|B5jqKW0`*|Sb7@V)e`m`K2+RwkFQ&iwYtOLj3Rr%`mx&zG|+ zRm>MN=HIpAY0sYBJh(CHn9w-h$O0Z_jiN|FY1WebU(MkBsErr^Z&~d(4L;M3#?h7!Fu6Q>WQu}+yxqy?x<3#Ahec_WCl~qa^4`C1MCt%z z@HY?3QLd6x+Rb&QfrbS7hyl8fkBm`(It#?AWdtg0F>Fc(_q0CUC)Hc4IsGkoFW6IY z3zQOCytwO)(vZ+}_w_Ag1uA;8S`hgtmLu}!ty?te>)uB$w*e&DDc16dhEs#^@MDt5 zG_QaS8ooxcC*#lX3!4xCG_JohQDO5v2J~z!|2H?bUeU#ouW)boJ$9mWxfxwv)~j@J z!%bhlv{Y4%0hvOage7<2n5S6SOQ~y3Cbas-Y8WMZcK=MSw?d2pH!G`jpzeDeLql#C zGAhrPlr?*4L68<*`uMxAd)e*W^s4#u$Llhv7QopN)^>J;CP9xY7MnA7JqoYmdD9+_w{zm~cI zBzjwCX83vaU;Jc{5~M|iG7b#9IfIc-XwD7S?2|K$=oy@xNXzQsc zhh04CbBmuJ72}yZv#q;J{#SGMJaQZTa#b6Yq}YBuP-Dc__4VZH6jy+_H|$EW>f(9< zatjzk!!ZY=*Cx2O zQIq)QO%zy9m(-Frf{OH%Mfla0G}Y0*zWM|PEi$A}heFZ}st#e^dB%1Q?{+Dn41ox|7+p_Tc^EG*2tRlb zE%|(4c{uSJV*d13Dkwj|J$=J(`Z_5|4x!({J_k8Xvi3Z{n-`Fn0%mAj0U3Z_X0E|cb`JGlx?UiBph_(z@r zE_R$M$5%uO^LaA zv|{%2y8R)JsvzfB@+3YUEOuyRtBzO8_UF+-?dY()5PZ>N2oIm$ncT^i%was4&-VPO z5xCvFhuw51=ErGj=(tgGVV<4S3fSsTDA;6HE|7JOw&uu$NH>Y@A^H9Us|+A!+_mU> zvmE(|DmZUQE!066`qF^!L6IXiXegj{^{gv^J3e%9>Tvu9Q1 zg9y|4weqq7uo)%>55~5mPxa}O^@m^nxk`yXn3TOgeRmlsjVcjUfk8o+-N3J^s!Bvb zRyN@aW*M-JUyaJWcf|9yYwL7l*@CZgl5gl;-ryyU>w52x=GjJJcGSS0Lk_LGN|`(^ zP7Php3D)=^u!pP$q|t!bM}wk!OIk8xH*J(YAezVjRY%CYXT)V21tb9<6pmhja=z?B z&GhQQYNRf5vEGw2n>E?ExJG+R_g%Zzy)?S#T*>{#nXe$1pVU2IYI1T#%fSy~mOquE zv&A06t78!xT)zOz6c#QH3^+pol5LQzeO1e7Gq~jwvD(7>l}hFH>ATt>zY!2LNrwig z^L~D-^YXmnXvL;RH@9+`RV!Il@7-&0|H7y3d(k-WjRfK5dxyD78sEM2 z&oJ@=TwL}d_$MFSwM*a3Y-)K{++1yRml(pg<;cLF+u=z4#a#9~&iP{+JCXMvUHg(G z6Nx|~um1CVbVRB*(@n%dq@)4ez0jASLAp?PftQ4^@3qb-`i20IzhIP1-IY@LYkH*V zMCEczE$6%B#QQ(p??{dNoDE_K`1R|pk(Xw9i?_`&BU3S!3*X35$2YC$)V?fp52rf2gNn)FqfA>7aQ^pgb8d~K(Ji&RhngMDV z2jMuSN_O+cgkpYN{>`s%XGVkiwJ@|u)*ASDxLm}=zn$oFC+__jO8fqOZ$*VPIAw_U zjC=#bpiy3l#y~GnY5^n+aLJJ)2Gwx;=G>xA`jsr&s9A*F2RRh zMq2ud5X}GO+mVdR*2Rp0#x;)A{rJ zGd=;01uq`0N?#*As4vF(UMmK5^$Tc3$x|>12@m(_RKm;q4AK(&5j4AL_3-w5u>1g( zW&La9+yfK%CF{&(H|%eVbKR7p%hUHHByKH~f<{Z2${E(^xjYuJZFmJA(4F-30`}I4 zv+aq2`NH5MeE-gl?Qg!B3k}s&_Bmf!xW7R9o4vmF$ldWUQ8P0!oo|?ghbE{Y6+r@8 zv2{aqi_?Rxu#|@(1?B#e(+yfmQKG*2@2;xRF^1eQGwU83^BWJQr#t4y9qcvUirrr9 z*+Z>ur(h3{JZ-(L8|o|}Sxm-6s71I~S&JZ8&b1hxVRSO7I|Y|Hcx4c(af}&iNi&}9 zD!ei&d>OrHG7uvlowb;>(GIC7e72fnO|$&sEc%JA)LZg*4uNMX0L8@L$Kl)t$YElr zzm$|5bPRc3QKgBQ8ue50u?x`6w6 z{RB@p=0&V*K<8WHbK*DLh9wY#*PFMpcMf9OOfjR{50ItN#@rr#)@miya#U3%uk`=o z>b>Ks{Qv*)UiDHTgb+fVNOlO>%0UQaZ)I=UnNPr+U4= zpWE-c^+&hkoa>^Z5O-BJaGQI>)^2@gu zO%xX}mVqt@;7=gaW&GFa8!rQKQPZ*G1;9!HAP_WeDR_2GfMjxQ0MG~@DEXIHa!DlR|T8Y229$?3bFRRbdcl_x=mJa@ z{GkAu^V37CqA{Ffa|;hcAaQCWp6LFRxr2+@p2E5 z2m!Shl+Ln?&7yC77ecSJ36n~);BC;>-5vawQY#b&`2MdXkm3af;vV&xxl}H<$9{Z| zQ!sw-!34l%(_UUiUyxrl^rwZ&0cQ)3|GzmDavMq*W90$#-;9C1G74h$*!s{LeV+Dw zli>^&JN@>U|9}y|rDb9=o2Z_{;Dq;y5fJuaa6*gvKA&=T!J!(EZGgb{KY(RExT==R zCLhqtzh?S|4&as-4b@)O!$Mr=N$S=xfi|qyz+PvN{Ik-pj@TopsVi@1x~iJ_g@$@P zsoglZbm2L{7Lkyp9RNCE(FWN&{AGeM;KL!7l_xH-Mn z_#8y0M4P2>uYl~LWSZUw%~uv#@Z&}wG#^7l6@PX?b7*(UTPiD?3CpSz;8mA#mNh@# zg~?jyNyG2Y1UOs(!Tj$YF`5jl-*|H4H9QOO!G29hm~@d60NghSS~nTufF)`GJXslm zqyJqVjbx2mEVf%GAuY3F8h}7mQr}X6%hQd^@c#EenShRs+$h)dO1b~TK}dwf@&*AXWoS?tej)VcB*UedCm+K!O?Uzy z0Fh32pdkIXgh_-!EC+}bT#93nTD-MI!qc@Dpefj%`M1;_S2QRF=Z{I%thtl*->N13WnrK)8uZ>~X*I%goYp`=*;lbtn0Pcih zt|rspCi5Etv81jrx|x?|O!XVDCaTEG4LZ8sQjx$-=LvqAy;&-sm;NI|S+quQ zgO%-Py~PQ)k*U?y+bx}c=gKTp?_iO32RX8^|6Kwm-zqP$AGGrGTrUhetXL=yt^-V}<{X z7bMgK-BD(#>PbK~0BDzTPS@Z2cvY?R^%Ma8(Ky_{M4;ycW;*JpI=%1LMmwPsdoSNVPNSM}Fw5aOAAP%Qgz zsDEsM^ckX*do7*0nhhOMMY3TDa2ZoS;GISw{QaYLES+U>vG4`XDC_3A|9Hg534{f`5|9Uy>$3J}0zgorO*5*ry-{JXSH zj`;=lyKH&=YVh~hBdvm}zN>4MKZ!*X8_(uCxRkpbFY#QubQcDlP?vCRt`Cr3pu!Xi zm{qvhx^11Eg$fMre{ZE4_54yMwFc6O>U$|>PPKU zga*svmp}PbrOSX&DR{p+HJs}|Vq3P)kE#ySxN#?#LoFdj1Qpf9k*$eD z+C4{pD$0Ydn2w{E1C-0MB^Ad8_X2u}`OX6N2el(3Qg;$S(iXM10-X2ckBjh^=X$Rs zJK{xQik6r21g`&Hk=|%YLFo>OnA%YwioJT_I|&*oA#W%pwMWdfN<;)>>_P_PjT1Lq z__?5#V+!GMB9zMENHhN`OXuH^@lHrG%#@vrYrQA6;3@TR+0J1ogT1xYI|`mh<)x3n zTvQqf>zBW;FN@Vc2%Rw5!*7f_J|ryTkZ)+*Zw1j_HrDj6FCKcS((QmTv9kj_`bhQZ zV7z-E=YvkBpkJ;c4u^emsR-;65Y5U~=PvkA(h*rO4-Jqjc+BU4ouPbk7Y>PHxCsFz z|0+qeKa`4xg=J#IdHdJr6$U|=RTtzf2fKG@Z-+{N`bW^8O-rZ@8>ebCwIf90YDjP} z@hz91b#?E2_SbQSN?FrHaZaIDf-V|;e`B;UK}!gNC-YnKy65W?LGJsj=-8-*l7?69 z^@21b_+>j@!Fvx>{ir;hbMUfmaK1RV4H_f# zZ-Dsp9F=;KolqmAqJQlA`QjU`&+_yd#iprGGF*{18=9kVqiztuntdVTQPw636NyBk zA@e+tkU{d5@e~aV?w0`UaU!I$F4%O<**CK$#3z`>2`CpX= zCu{lDHPpa>Yp6g;1Uc%mIcfCy-d?06f$uvXpiqOlv4(m~wW_U-pO+Wy;kt(Gle&s& zet*G{>9b>#%IfOCQArwCDoLkGn!RwT=lux#6p{C#yy?MDV1P<9hP``l4(L_d)SrG> zum)dHxP|4WpaHr!5C(%P?teo}^@sMBA5leJeeV1mQK6}kpzZPlJ-uWB*OX_`oGu6J zpSQMHG&IyeQlP%Sm>DgV4CXRid?!&tx3jcr)`6iT6+H~51QY_dq(SZs)E?92$V=5j z5idB+uVG>PTiKdfE_SLQtn4kI_;z9bK^cS6dX{Dt*PW@@z(DU8OOD^o*jTD@QF+h3ws|waRPzgc-hV)w(YRk*wCOL?@SZ_>CeW4 z-!!MFvPs!pY;6jwQRM$z=zFHE4R*3Qepsp7!h(*$o5y?3TwDvyc)uSml|ZI)G8i30 zPy;4-BD4?=!fG^!6dA+B!m@^OssC&uh)S-ou(v^5Tvc@*8tJ2>s?w2cv+c2ieVGSr znbj%JRBlnawT)Et6dKig)m3&SojYw!2PEm-6>Ahlf@xlpN`Ywpkd=8(%ti*&3iQ4QFn ziXeRDPrL>fq7gVK|h*4SUnZhl@}^Df!9g z@v8pp`qg*;{6omdWC8|PDqfM%(eYtnNAqo01ZxC9vjlRl^-@c0P^treH~>!pysxDr zHz-~UP-B#+qf;6JUowsi+Gsj_h>#o`{4_3K=GmDKAoBgeZjjT|*2W-^ju2E8Jk+@G zW*M3bA+Q8&AMtr1AvZ56E6aQG1hx*LK5rs71tm~W27u~|KjH01a6CLf_I?#V?a!uw zl<%HNJddq%jhlw=eGU$tft;C(9$GTNA~Mr3F0axWy0rj zm?eCLc4!UQch4-JYQ%Oha?I=~oSt4mi+lUSfP}0Zc&&zT(eK|otqgR$Dj153V}6zn zhM}J_GOWfi1nk$#ll9CP7zz+;u-sO-qCUlIQNe~*x8{5hhd{9823pZp+gmhsB`t(8 z9*uS9FTVM(vyclsg-Xkr$1oD0`^#x&Y`^*PCO+&po+{VGkWx{D@4dBX5Nadkc6Okx z5(n}h)*#eoxH#99gaVV*N8B6&&UV=T4HA+q*RNW6dUojQ12^7;(^wZ&tBqixYmIJy z@xp#qUlQkwEOfu7 z{)rX#AkniuLZM`$9*TFVpeO7F`4^OwYtW$-blk3iQ5N~&6$k(^_b`uy^)zR2;=3Mh zF8%uaFWOuJwcO{dThc-tKs2>3pm_T_L05(XyIK*wQ&@4qj)ndD4?qYCxSzcTE$uCx z;ht_b^Z?ONeDN8ysiA9d>rrRbQ)lVGm$h%D;3fzH#EyG&qRf+F)s+43b3JE=Szx2$(flzT+4@kC)8L_ur62Fv&bqfkgVV4eM!f~ z7370P;FM15y}Vr$Q~Wx?{jrCS4=_RfwDj_nksuB&gA5=a`9LN3WwVcrW7mIzfRHdg zCI%!c<-fYtzyC5j+pCbNPt1L^akzCAvAw@8-~Hp##h*YlDL3l5Ok;a^FhQ4-!{qmn zIJfUtp~XhiLgxGTn$^x+?PFCGa-X5OHSp=~6d*t#+jg|st)FYLm!R&RK5*+PIHjkQ z@$vzgIicIVJ*eZy^Q|Sq5NiC0U^ho-DvM$Cf#=Q*%~fZi_$C+Bev=08G3 z+gmyk$R7d!T=H{!lSEMI6be^CUSfu-*cOJ>ED058$q;Toyw%DD4pulREnQ zWM!}1BwHS; zq%`ttX{F&?{*0BvY9Sd>DxT8Unk(}5Zsgw}d=9s3n| zL#8@9Nli^^UNtOM8a0%{NPYbxHnw~pC^0OwCVqE5nD$8nrAECE%DS>5ZiP8oK}%y5 zKaLqLobUwR!pv3KVPFViXafAd?z#JA_{kr!F>2^(!7Kp87Jya*}J)~ z#A1Pn0h+}n-+Kx?qoS5iQCnUlC$T(4OS8Q|6jgit_|?y!qD*STKq6;RE4E%6c75{7 zTsrW(GJy2C(Ul}DDq3t>6m|`?e78!$06yOIFJ$0>g&jrdA%74&?ZNx^2H@1s6D(y?d!n) zvbttgY<^nt)j*B!dXINPQqt1Wk}RKsK9=jTjkLJ;*5*)#ZR$sz;r`^FVPfz%;(2$<4ZhHD@Dw#Z%hfqYk z)|YIJ-L>Hl9~g1HHD($4e+JWxNXPnB+88Y?bdU}YlZjjurzR*{6HHoNy+s+Mri%az z^73+3Mq){7g1OnNMTOOjX82gvJ3H9AERv4Jf=}S(`FRNCf2p>|*FXivPuN=#>^jmi zw*4#)BSS;$wO>rBHRm*atzHttzK~I+kZA|n2o+zek{AM?M^qSgg}r%$8G4IE=!JCb z_DZ*2c7DDD>2cWNXc=jHyWEjW!)h(|h3A@eb@$3kSLI&Ntx%~*5XIoRctU$c1c^kG znBaJBr>Z*f+!QwdImNF)&zn_5>7v!C_H6yG(5Igoe9g&GbU`>d4Y!g#;*8cPtxU~m zW;n?YF+kmgbVEFu7lgaY8c{IeUA2mG5C2{)KO}jvJlsld>Iw>!zsr2jfl91!2d%;k zK0G&K|1wR$+Sof>NsNd{n&t|TFOr<|R@UqnxT?+1P|M4>ii>-;IpvvHfWA$W9TjP-`q5nr&3>P=Q;certxe4onD~d zKl@asqxBcQyi;e^i==s2>lCfj;pIcegvr#GP?g=^-IcfbPeJ#>?Zyx~e~3jGxEEIj zd>Is5)BfBKx%#j;EKaC>h@_%V`unhgQvb+sKL>lJ!Y@mhJ?XPP@cL#!J(i%CBM9rP zk5v%;zZ=~IzBK%1!<_SMch~v%McSuiyj{?r4|7xWSGDtB0qLM!790?3Xb zA`T@5#QuehD>qJVOac!aI(+}<#z=tTJ2-?cH-7-3&w5wX6MA;^E+bD41Em;>n_wbP zD(sEx2cnXH4+)S%pd;|5X9uvNH`Kh8BhiKwUxtNhbMyPM)$9RQ@PE(GZaFQ8ff1^@ zIg(E!q!6m~|K2T|tyOadLLvY6-4NQ2Cy8C*=U;2a3=a(@ym3R3I}g72i>fvQkB8P% zB=Q}|qJ!1d-?{)4pHz`YLv)x*Y{8UsdbD$xvO89?+ZgF(DpVl~y`?VvMAZUHQb8>P z3r79j?6$qEMj4AP3CBG>Js=6Bmh6Rn_3G}{lBUrV`b&-<*XC|dj{YH=LkXVkGnKm& z>Cuwj?1Ft4@~c`VX1K+dloxUXO@VO2bW$IYI=2p{wlllGoZH0**+uYHKcdsJcR~xKVYQ1S%wx+Ghl$$ArJVw;lapibvSsW{kXf} zwdXJs`R;I{+D?f@d2Fh=q5i-~Yfee&?SmPAY?&l3&C$W(#G|V%#4{m-l~^rgZcNt%!olt$3G8%Jb@IPEVBMLNpCz0i9g+KZXU2dNLx{TZg=>p zD}j??QSSdL1y5Vq|2YFH~S~zcI$csPVG}_9lqU(Eo2f ziAXrvtsiT$FbR+JpL!arl!c-Ye4O4|9hNqk)mN+pXw}F1G(K+SxHNieNkAH?uU{Og zlI@2JPP$IObpQI!egQqQZcQrr`EkI`3$og
    7gKS08lbbx8sO+<1vg9}ntspzwe#rqJXU=m&~HrD`S6ZA>w_pjA7vdHPg zCG$Cb+GeKXEfH!}R3z}FAtK9L2DO;br#~)VeosUuq7q3%EP2Fd7aJ9&N>*tn^|hjMvXU%to=K_>aE4o#*kaSyXPaJA<7x*oGVJ) zJZey=RAJmt&FUZ`6J-pYpC^9m%M3yd8JFz2O=$|EqNGf((K?JolTEc6{Jy9Q&m)vd z?5ka`_YQJ=A1pUX#!%4D?c4@cz`m`4gU#zb_s99jQdN17>JZVq4I;mCAJZK%rHXQNTp$>C2^CAfIt5MDR8 zqTqIM^D{W5Qt=kY`-%tnVSkEc8mw~04_EUT8G+gNoh1!QnwV7i^X8RqYg5jjlx5|V z%#`g%?ob9a-{m^wOc5o6f0SlfKKJE5*6cNneSXn_8{=yAaN03EZ2mmZqCu|K=x- zb@wh;s@~jQ3}v_5ZbDjwy*|go0qG4FZ3QiPRK`WA>gJHg(&3zVQS6CDVV5@?X8n&{ z?SfPt9(OtZ8Q?;DN*|-~Dfl8%U(I&fa{DW!B=JKC|wCo$&MR20q?SC{kEMb?}z zLP+GRsR7EL)h|gBv(!^M3buQ9qswyJk8hmcHa*7cz;q)b=ei7?x$L)>A>ns>y-E5T zyYdC$a*kEg_n0*kZ~XJqubj5K3qi(ejmnwogr3_|T|b+X0{X^EgZ@!VsSlR(m>M@A4cp5R3~dI~8Kq5?t?2q@u!d!|*3L*GzivR))uL zWB&5L|AwKyT~G;mT=^ds08Ym?p}y%H9n$yhe4KYnJRs{sVlj@wvc4oP8l}f6cNx@87j)(M1{`njQw_E}_s(7X`sXsfL^Ykz&RASLQTC{a`sfG)DyGf$&)|#RAgU8459W1>2R_IV zq}!~x*z;n0`n6)w_YafCN{jHLoF(NOF&o!6DAE>f{<|;-Cr475D$&@V6G!3tn_bpO z-4~4xt4}usQ}Dux_J5-Gj;h&Dbjb>1En&8eB_*W{0UcME(suDW{qaLbzgyNuRX@e$QSkx)p>oVoZ>Y#5eVTOPCsd+fN+80 z5|uWV6+841{Vlz@?&3NEf3#MnI&(>gt+RHXGBrVF+UwrFBP8_= zEEPr?%3N8&ade}lCMDNmiQ8>RgeY)3tZY4bH}a8wQ+xrs8PYz+_gT;_Lcno1?Uic_ zhYUC6XwAsa^x7Q*nP!vkUxTQMEi?_xM!p;-+goT&loBUfylhgE<8@>#)ykFbxpyR< z+&BAS4yT|(oVwf1{T)5e-?i&dMeiOz!JGkkWXW0eNNf~Wi2lU>c8K+x_=hOFPwt+_ z_NeOn9Lt5Mkk?13buaq+K+glAOn~vuv5`e*s~>w0piNoV#-Q{fMk5j~kvueXk%%bJ zGzLT{p_x~#-i_{4-yc)La{H_(ie)9@{=rZ|BEBWOoeFoD*RA_QQYtgEdj5WEgIc{< z03Ns7VqMv{x-lqGj*dtgvsgi8fN1H6eyXA8uyNv{K3$&AVy|!g@#Xh{OcEzEx<|`Q z&Ysd^PMgM^oiCj2%mpkTrmcFC)W(dQ^qEiad}0%5MJ(SmaV+bXISDDCeR!5h_h*~C za3lO^2@~Ilbda9sQ@0`6;HFUi6q$vv4^(X#jUxfF?1R;QKc~ zS7U;LA0&g(dmq%{1ZTpO;MYCJ2~pf^X(5UK;G!~sOto$)PqrDU)}z4Rqj<2};v*r^ zS{;J2GrN;WgT25rJfQKwJw=K_LsG5{hUToU`_bvrP|smC|Jbu#?y!`odRM0^$5}rPM|;~q4$^L8v>6$%lh_f-`721J+kQiOHw3d9*;^*e&dZP# zJ&^kVMco?B-_R}JgN&c)@1OcvbpPJ-&zDmqN!rMHI^jk3;SzUoLd@YB>+iR zDl#KuS?fIO`9SAjsT)R*)!FJ2r!)>+jh&+Cj=s#VU+vP;$A$)ag@^HidiF=Vwg;=j z?|r~9B;`0LKOI5u$2zPVW(pJ->CdNu6;{RGyyiq@T+rdb~8J(H4h?J<8 z>!D5Ldwj%r)zeS0+W_2iFn8RZf^6)QCxOvXQEs*|2w~`5OtnRqc&Yu+#td&cO6jm} zNhG=9v%Mp7E0E2<;W#D86Fm$=lDe_nYI1#ppC+GwFi|?bZkdPI$MKLcJ4=tLyxeJT zjSRYm@6s)*-1cMs1M7MGoSP1$3}U$u1Icta{IOh_f#eXYX$Aws&+mA59M(inHI7j35n?1=1>z2I@efd zjQi0bQ0hKVpj4C3$59=n+M>9oy*?iNl={Ud5|`uhl@)Skt%8Q^g2t5Zq3o%F91k

    e3n%O^Z7 zMx#1^!jNO6bP@WPnR%uJ_Kn_lf2MpZD5pokg@*{#ufM4aBSWhhZlf%9+UYRF9;M&HSCwi=*`o?ipu~9{$S|g&hV& z^v%dv$J5>C;gJ#K989?H-_ux~&epSVSiE?v1$l^z`@|K^C|TQ6$$VoIwt%D9C*$re zP-X^uRDO-VHu47xP*+n!Y&x2Yc~n_d)z~SvhS=fQJV&EuE?n)=vOou^W@zyj*a^#>2Y}!NkHUG+SG7^0*R?iit@s zEQD-~!UKU_g9s@pQ83-r5~{yi_YPBT`T0|F2hA6@$r8-XC8Xft zxpkti@8v95pnc!a5U;|;>4BT$&L>KGC0Dc<4pSz_uCI9$4ddek;8@uhm`{}X)PDTf zq)}T_yC>ZXOW7zq&%gmx^J3+Z)v0ME*zYrf4Q6IsL^q)I6KdELX|iA@ctGhT0_2mp z`0mkBj*Xnwkg=g*h7z4PeiB4jf>{`R=Ayg2XJ)fTy! zC-;-DukSj;J=$NF;O}>##LT8-QG`*+Nl(a<+eb^a(0)H_EV)^WA4trKZ$4SlJnd`s z=IuNBxX9>;yDtYNm=ok<_)y8oIYkdBw_##GrmKZtQ-n5jPv5pKI)Olz-@UUcDsAkC zyRcX-a;dYId;&E(@eq=byjV`8jh;9GZ{(HUCa{3*?d_n7i#Pn#s_!8e50CNUg<$)5 zyV#Jtj9klR`8Naz7}}-u8j_8EN|NaQ{f<%=Hste{FM)JnIzB-`j39^w%ADS-nUX)> zJk={WCgEwEoRrv(!t}cXDDhjWN^_Q4@1YUqeuoh}GhCSWwiQXmJFd%E z#GgkwwmTz;!?m2I!tpK&SiQNA6UfZ3#}#95mf!iW+~MWG{ycT)_%#I}F88j1(&jM@PpeXS*-cnK@6^2GP&Y&r|9?q2~2x zy;O@hniw0K4`8nU6cm)#;SA9=G5M4}Z<|6etJk&;Mw5G94lIURa;1ZuscInIdmVaU?~2!nBRf~tLqQieu3j-H1$dol3-$PUqCN4Rb`Jg!Z89M zo;ccT<3!yt>}`N&A7@zy743a>4#VM*U1(Um_h1`Zvf4E{#B+{P9FTD%#&W_xL}k)q z;{@nDwYRlx%Vb^XE4TEhe1R_ay|AQ7P39VX#gScm;HQH6JBVZx!LadhGo*VXJg;s%d3fC?{u81x*^mIc~ZRd^W&`oHkK9ZJYW%8 zyX)sy5>@A?Dxc9l!LC;~)iv@3lL&g7W21V;Dz&>*5F}(&3<1QUr$SO#_RtEK*%fx8 zBFA0}Vs4vvlm_hemG6cYVYzE{>r*bJZtvKS zE{zU)gD3dPRkF4YlyvgZ0dM~|xp)r5vomi9L<>|!uif~+7uyy(cRFZR69&2zSwkQ+ z5{P!|Q>4X)a^6Kn^NA6#m?MGj#bn-$jF-Ah8s%u8V^5m*6Rp<<*pvD7Pagp;g^~`9 zXU~cY^;HNVzq7>GtoJzs`4P+N(>s#;e7OD6ZgxPmk@}!_@~|d zeNiB<&SE{UURl`J2C!apK)hsbdCQ8tq^qTcV7l6|@zB_ED4PS=8M)6t6E1b${IWPH zhJ8y!<)6c2&>%*`MU*HgsHK|y#SFasw?iE*ZbSI^YiBo8PRlL+a~k>&c63i?qRK4^ zA+z!MWV7*1$R(P8Jv}V0t<8jqIUgDui_FYy$;HKGa)}?ynb&4nZ-FrZ)G$8fRnmdX z2?8O}f!>w7t>HHU%sCYe4J8xDJycoQxz$x9US1bTD$JnK4B5ADsWImlKF7t~p}|wD zsI1CD(V=5t6w`nbK7BTz_(C1>`n3xe4_8Ce_w)B+F<%lAK8?As_JQVNY8ck$=B7&B zX|}KIiPj>P}@4n?g0w#X=!OmNsrJiEJ&@at%r?-dcsaDt`R=&UR{b2 zPU>i}*K#I)nh+?Cfx53ZCz9BwbM(r%RSKk$B$Jc>?CiV^De*X4TA6oFGE{TlcAG+T zf7rLWHs>iWAg__{n;_|E1}Sl+;4KY}3FATG1JV zO2~&B9X&35QEgc-8p%YmxXh@1dH0q=BGv?8cWn+_3lp`ivfDz=Ql>9isd;w0-trpj z)vNIrKU!Mu%haDE)zt~u7+A{2c>DU&CfB}czrbfJR48pjc*Mj+3fNakET$i*IbHe? zlWZ1kN8%Kg7O8UYSlcc$L9-F02Qzv_#=0kkt1T0?PY(ythj^|;3W8$&$J&H5kGJ8d zK<6(6OuEv>73AaupyPHm&NjjqTmAk0_j=;IE8JcmRo;Ub8q(zIl;2WCWfX(QRC$09 z1=0{*j8|kfegd>NUTWkd>QK6#wP04zI{B>bhAy1Wlrt!5DyLWh5lO7mvl~0)CamLw zW?ra&HYyz=p{%t=P>F=*cMnnlg*LT!%XQ-LPckL)BS$Mgkga-rgP-KI56$J!`gpJ+o65hccWd72t~NP(4= zm^|KRCTeSG@t=_I$zPqQL=N7(Mjk11usS&W`kFFS68KmYL&GijcTV6yot&VJ&4W1_ z2dF5hbL;E()YP`>D+~<{(Rq0cV48jmsUD%G?(5r zakmse{cYTad<1#drOgu}&u!em@n@5J9HzG%=otDnA=yse%#05xPKs=v8epNY6C(j? zVwDZ$V4BB|4H`cv6q=6W;uD&bcr;dgP?!n&Y^Ui<}2d@Co>d>MQuz z8Rf8z()~Zy@?TyOssLKVapce8aVd5+-@jw#s1`^RXixViy)QB{Tl>C~gOhLvA|=&6 zR%lIx`y?vWMq3Le$Z6rFKi8y?6Ng7i>PPo-rZGXVym6>Yc{Rk>w+W0nGI(v#+Z-&D zOw~ANh}(lhZ%lYQ9DJ02-XzKKkU81RbU$vU$a*~$^85Ads`t|7<_AzGN=r|_MUH;u zKGsly;I2`O0H`D(kSt~YW*@ZK&1j*1jq7CuD;s->f-8}^#dS0-t?3Lcf!YQWmz|rG zLJ>|LAq`dx0W0jDlj$;ci5Y<>2%$G8jyQYb(J`0P)4nbAYI!UijY;s zko6SUXe-$~Al}?!(VJJd+nT@_f5oj{ugAcoS@EO`4B0lczcggEYRCy0p{Ax}c|p9) zX50GaaJ3(&tgK8@R=Tx(CSO>6j8Tt|b`>bP76e>K0Kap#pD5-AoCAyH_Uqk4I|*fF zwz}&%L$J>gAo~Xo3gIF3EN&A-O_wTyd3fG5Yaq62J(OAe4jz;gFvC@3j3in&A5#@@mHmaujeafI6ho~rhU`YMWU9E@b zpsvL7c7RL$^<+cSz%7EcwV%DcczGLBOVn)U>*x@xqg`k=I~GDrrQ^+2&%Ejz9&VXn z@0?p$xDVMqJ{FoR%PV}-9*M*UryYCOSw@1-ZbFNKikcv;_4qMrp*1|Du&@LIiHeDy zFYd)n0c`~Aii3?EURL)@T6}z?Z~1^qVG{-q$+T>rKj|ybVNRZ|I{KKD)waRqwCYrP zI~)uYWrS*MU;+636RmR$Q0=)585^IN4d}%+7#eH;*rCQ4unRa9(R zMA;4{=Jaenh*KM@mFUb#Z>j=Az2;QWQwfNXL>vtb!)<40Sw+QLkj#lt*GxK6)=00 zn@6PIpVFJHf(3T5R)4<(!f#9Uw|ixeyIf_M0zTg~NA;t!% z5S8e>+ZPoZZE!qko2cq6D!m7z2G6Zc`K{^G&Kv3c94 zBL;TW=Hg7poo!*K0TGa28cn1XWfmkQNe($!TekvI+)vE)njc6eIcLKZ1U^qrb`8l6 zF)=WR04zxdbbbA*(wbj%h?J|a;9$#@45FzC^fkyeMA4%?^ ztx`J1Me3~IK}Rn)83o)6%6Nw*T9E(58-GFzoo+JZ7Y}6ai_f$UUznHtUYzCmCjjma*o+;{VYu#9ZY!V4X-gE;r2ZwpU9sDN3rTxuQZ@>zZEnIu;`ML*0kXL`|}qDfZ+n1G0TXJ zr=<62snh*8O4P0{$LY_|z=u~rzRn~4uPsCO)<7Ro!qzZtk(&GoJHAphHV@|6jONWo z05@i|+qZ95R981oPs6iF%WG;-41>wUHD#&n?Cc))Rl#5K3-Di**#Gi6q3^=O!|6%F zR(-Fp)iC|m`(hp#r#D@F-`^)3Rnf@i6O~X?xb`bs*4|-ez#}Uc6(c$H4NXpNa`(%( zh%i0b9uL`ZS4Rb*-1_L~sE^Kq_^u`F4zI%{HQ`_ug-{mLHd(anr<9a=lWsSqWuSMZ zko{uMY*lq(3Vfzv>i<>9k?tnZAg5-&@BQ|!Z+Gzf$kLE9ncoIG1y5Gq0au=M!e{D& z8{)a@%Zu{j*E7(@w2TY}l1|Cqho$ja#46kAPf)(4DLYGsJss!f?%3#fIJz{ysk{J> zu(q|uC@uc}J-jC`H}}oYZVx*<6+}Wh+pA0J%bjYKoBEIL>gTJ~GilCKL^ki__Xt4G z8|Myf*3}Z5z4bK+-^V5=$?51`t;Vt$6W@yA%(KY@6u6KxLs}XdwY8W-wx!<3pg1_# z0J*VV|GX*DH5B0li(eu`kYp-*{=5L1t)EJ1b^HSZh^F0l<9-$Wv%Tkoiijzrs`#&~ zsW3QfN)DWKp{56@5`6#OLeAEsaHo59V=Z6;`11!Lp>a`43sp=yRi6?H?7}ueLKK9+ z_(5jx_;_;b1;fHJJ=zQZ;9xQ1R|F`iD5CHa+iioNg`;zui%87O=uXf|gUwYv7FPDG zeS9#TDAa~#KAhd#+pCsme>8k{@I2+%>%PJ6NEaQjyeayX_9{2JQt*Yv#YYcbJmq*Q zoFTve{KwO16ih$Y%%QN}7a;onES+vMBk?$FZe*+a|HCx{jjS=HQ{outZIMd}(;~v( ziv?8#d6OnGk5Au5Bu?;50E&-_50gSA{jX;SzJdUs@+tkjAlDjEIIqLzCuMq^iPlze zD`$$!mZ>Hbx-4U1UW%t07T2~bA3ujit1MInlc4_qbds}cYfS4iW#$=~<|gkRAR=B6 z?i2(T08YajVtT!6K_3>I#fOU5^@zbKxw$AO`U_Uf9B63en=H-)6(%I95+RXnsyoHo z;#N_aTe^k}oHVOV)RjQJ`vE>5hRIO{uyPt@yKTT4cprn`F<&|=E~Im<7^QBlc)zud z>tp>+eO0s;xU=8KFI%nS@fi0CA34G0DP=L(73AyH9df4K_$q+eJ6 zA9wU;yd_?sz6Q>Fayw_qpBiT^L|Vol!)f!;mwAJT9>3sYABRt=n2Vv`$wm3cJkAAoeA@5!r1GAiRCMg!G{5 zLwaYOT2B7_JZ2Zv1p${SF2KQDBe|mDPCdL13lWVJr#qHyk9~E0J=-2d%+-~zzuFO< znAbsi^>v*->h{X=Tm&g|GAJImg&^wp>RgCzoFDC=l8}%D4J$@kOd&OTksnL*7$cS)iCXC4Cs<4b}hWwn#u%utcN z$zv^ACVB)2hz8~dd+Qp%i0w2Dbzyto^;U-;+yfP{TcC^{W_8u{7KL~Wz{_)^$#@*h ze3FtFni6z8;J5uBAn$cBFgK6=M54Lf3$zQ>RH{J&mQvO9=V<=z_$sw`^%0Y*YWuba zH^m3W(&jw*_&$IC`e)>CN0iC&{n<0C%h?%PFe%H;EXa%(y=GikRO}%g@ymFJmI11u zh18I*!W5xGkHgx7Uccu2Q86mse&o0@LO>&*fI9)o!U4E$_pn}KDTha-mgJ&9boGqi zPhC_F=Su*LJrCx6P$6ua7fTe8kU&(*QnpB_jb{XvWu+~*oQ-(LZwpgr0m72OpfubX zRIk6#s)N%5g8GKl(3pbM{Iqn#M~wWb69-zFaqGEXNAhl2Er@6K1^fB6cs@7itJ5-_ zx*sA02*aD~30}QoVSlE=r5bq>5?x8x8bTC=N>p~=Eki!OWxN<~Zhqb?Ee#tOtAG&{ z5*|p8e6a9Ee0j#){*tM%9QY8OYPpU3IHsb#Nq$-P0qD|HnG6)W9`h6RfBwg2zWGO* z%2jY41o9Rq-M0&A)Q0`{3l3}i!5;QF+01;(x0dXpc*#qDvxxlx`umG}g(ctbK)mOq zI5EOeCkB*MkAI`r1=wsbxm}6aP3WFYP20Pmt`k&X- z@D)1kxjYDg?-Cpyn0i@$byHfH09%F4?|%d~%IOdv)uxrcq5lLn2@+r>)tD1n)(j98 z_kPI4Ws6F9F}PaCB#>EKTO*;OiW?cR0MX39`W(iJIbhiL?SV;&(Hf}MQygxrttG$A zI3D}%%zjIQ?Pb-~w6i4$|3eF%Da?KjHj`M^^OFSN)g$ur*Ak8n*Em1Ry?%QaloUPd z>gxIcu~$gG7LWeq2)ofpS3&EAs#>)}UJ?A{2*2-IB`PZBXAlt~;Vdw5x}(8zyN6Z< z#XJd)K-5AVK3KjwQ(wM%bsJ)9`>clD_Q6P=R zB?ZO69lyZquTj4aUc&82%PCp!h4p ze-3iW`6I3~dhzQCbO;N*F5lPV*U3x%zt8Zhv!arw*Gq{jF=?d_8XJfxWXLWOSB~;W z?LGl`v#?tHWPZ2hCw4oqmwC1CWMjR60uZF3Ezv#sSb+I~T!PE|S(>4Okt7m`7{EX= z_y|l>?^lgGdTT=_8_6LM1$0EVed_@mvBM|pgN}E=tGtgp$m*YirA2@MqgCOy!W0;Y zGB;U)0sOQ{iKD(gs1b(smH06~$$P@CYHMsv(9~qn`12>Ikil3o^|WF>e@%EFwd!(H z7%VQny}7j|+Q_HuQd#Nj8=}wvpK=A_;tlQn&nYiPj^LDG?VrQLKSa4$v#_(iPYvS- zxqLPp;49q`EN1*XD=P_H-D;ClQ&aoTeG|eHLIY+$8$mpCGHBwarb` z_~DYT^u#x~q8XA7ef*383$R=ZS65Vs=D7hn>W5fZj3u{kX^d2rt;B!p;pcBSkOHZb zM|4ySlAiQBsA_(aA-QZa77@8!Vm>Loa53Tq?BM1WAWmyO=xJ&q?vCXgJgu{Ly9w4R zD!3Y3#A;vgzI^tw#IoSZRs#GgHT*U3?O!*Qr$f&^gvc3y{B2naI}*?MPumJQ;yv@A zGpB*JOV$4`lSEJz8b z!-mQorXMSUfH$*LVHLEt5fD&bWTVN&yFfix!hW9!Q05r?U)lVj8IqL|wJVxTZE}nB zUx(+FvW8ONZI`P)CnrqEj~3Bn0At7SfkRSbfEmI6dC|?WWZ*U4(J7Y9`A@~!Au^Sk@2^9D!F@Kqr zDk%fhieaG4AQ@PX=vW{=tc`_jhk$qmM^s}%y#JmRG%&5K?LX=m2-dJV(}RkAM1CT_ zDd7WT(mS;Pd7wYIJo7m$ENI4k`orwT=tCkrWQdiOm8ef}Jd0cF6MO=KoLoAFXIS-@ z-|vBKMnO$Y0MRvib4LN4*>1HDqaY{|$<58J(w>Y-+cPaqG`aTO^yAfyjfE4P^4a|* z8DD>YFt2hKzy;e{QF4l?fm^}K{~!m4j{b*fq+!Hu-q}T9}1C_k!d-eDVv`< zE3QbSL@R#E2GW3FEf%AnEG4-VaZ=M8`^#y2nU~Bjel|5>3g&Bk+^V;1*74YCg2xf7 zt7{|!lE^3l1Kg{zJt8KZ2bd!qmZY91cu!O{22;FuD39tjAiA3s_g5#&J%V~_K|r%D z=s4dM{n8h>d4Su2kb2$Y=Hb!X{XB=yWrP$MgfmmVo)GE7X78q)g?{oBSevY!8Mue< z1QhDZo^W%u7xywm|9zb)vT^x=w8uDmb5I(CZ*NcweBMl*kaNi4)o;^qh*DHy;)~GS zMnQjx%M>pd1Wsnq773Pfxdwu?x0v_o)ug2r&u-e3`i=kJX?X;S@jVILLD9u4Ngmhl zADl?Z%Zh5dlm2R!028Oad!?!P83O`#t1bXiJakdyM<;weT*8orhR?7 zUGWFF%eB=Ipj`hYCpEJI2^kg}03aa`Htu+Wp8?H9qFV~_4cUn!jRPIhm+^y2qDR=+ zxb)L9(V$a1XDcMsNmx*Cb@c?WIv9`>Z%Cz6QzN19y>Dp1iek0p5Dy{9up_fCkZ~2} zOS`^Hi-V0lTQFT+Xx+@C$9Lk6_JJv(?cxA0SuXbY)bxZ&?+MtjFEhHmywgvoZh?Z> zoqSDq?6Ne_a&a)9yq$Sf84?oGeC>9C)3ozb#}J%SFnXA)Rs6u^$!FwD_m-C4(ystZt3UU_5$6*P|Jw7ufl&}9iA31GeM+$09Zijwa99ES z#*!Bw?bnNVRXP#UrVfO$-at9!CqF$?abnBEm zl+u1)C708VY-+ldt5YwYU;nzCv~P4&qWbuz-}2~CO<8#suv9%b;jvjv%A8I%FjSu$ z%gj|&mQf^!#h#Qk?WWPBr>D<|16Vo`Tz7uBU8x{yWCIM z)m#3!@!>$CsHE2g?yLN|__AGHrnNxIm3w|iEGMqmzEgav(oJS)WwL@5=H@|O2e-Hj zi(yCP;3!Mk0|)#D(A43Uu0#jM`*a5y?$|EZg`g67w3N@}31!G@i5&p65a^sI+L)>p zXppa)4wMk6Ue}Obpp!O-7I0qC`mXBoG}+}hivxLm}iPL_uV#=e^)q7m~1>u{Kffv%X?0tnKTUIp-^DbZQX z)X?3;5<^Dt=)w22Pw25hrxv|s<^oM`(vr8xaHoE(V#)FJj2$Cyya>)&Nyz4`1(3oo zv{mncGJA>n3<7{feGCppgC1|+hJY~ZIcTMdngS9xs`8K&-SqdjeQ5dfDPD703dzft z^^FV;HZRf*7H&s&pSqtZ;PbuV0w4|+Qan5wFAn4R8l(C1e_oZ7|5*>_=Z)bNc<|zZ zT;+eftMlCYoHs^KK2jZ_S0Rzwqpo4&0CB@dE%o zF{B}3x|&6Q(I_hRHEph#f&zM?>oN7^Wy~#znfcc4oJ6ADyjM|0Vi;wYjI1x-uNDR0 zTSEPmR17Sv`!lU_pq?$NH#IqlnA#fHlBdw*RhPT@Bz;9xOEEN*mY(Sr1bB_c?(SOg zjnqV>8X%eW>HT{Ih!6m4HBaA0#`6f=n)L84k3@HMb)DVXqSSbaH+mQH)eTNEQDTk= z0e|>5vW$!#I9>0@%IvWKdKv+O;kZM=bWA$M&*#k@$*d*14VM`0>**ognsCfKt^}C4 z))|*;%%kqadZgNmL#zqL*JZ-sBGY=V{tOiXm$pK@C*X0ug35Ylt?Zv;W*_puvO9B7 zHYjBIE^5*4c85l5*n#`^%MauF21g|(<(V4?Ggx~NNyXklV>B+PT4zLzrC3p}k!_td zXS1+q8R;-4z;$qP>ER>iTO+qcmg$N+LIXq#I;#QxfkGM@^u)x(5v0{>1p+ti41gL7 zn~7t3@Phuy6Cr*56c$dZ(<&pmnY!CvEHQ1S>#$Us;a=Nlmru_uzObp7SSQyRVcz?7PE$9BzxBT0<`&jbvia~Z32<{W$LIjJ zoD<31zD1cA?mt2BDq7lf?{HUn%<`Qcxrv&pGVSzj$W7OTz!|UH0w#JIKUv}Y3>$#c zY!2w@8IlWhYpaAsK6v*cNcZH>1DsMz!6Zk(Imibd;+{W>YM<&N-r}(nZ3~X?Pd1>5 zii+ykQp6igmy30fZX+dRGxDVsT07mNjN&nW3`+i=BVEXzKVR`?1%$#g(x52Stx@u+ zIuaf1Wf3J;v!IbS(N7FOz*a^Er!<~8!iOBe6TnweQYgHSYomRiC9=-w$~H2$R1m;^zR&ypIwq_JR?FK*3R zhdXH*a(I47OHgFl$jf<6qu>Z2-YLo4JNNYb8pY;J51_$GR(#BY=rqA(EdZmYr?2n7 zSD^4?cP=%_Quk3;R=@^O>``7i=h&KPZfwNJ%A$jK=61DPm`g-Ff_vMCV%(x0e22ED(vsL(G-1npQeQlapR*oOJ&K435b=`E!Jt3<{J2-f zJYT`y_(J;+ZY3o{q+p%yk2(C$_mC1R6I4IZTOiaUl2ZFWa4!D}pBrIw`!LBUQ-auO zULXBR=bNWL#3fRUg%}j;OG|??3q9c-@hwiQ+-=INZCHh3O=`DzUh?1K^^!ZSt0~9UdlQK_k^gnAZlWEtuq{6SOQog^G6zx;|fpze=QRnh>EPVz+kwR2~sj zZWdQo42Ca_X{{1OFzOQL#ZQ@5(gHO%l{r5=|U{)uGKYTG# z+1#~Dk%Y%cC<13rtQ_W-cUk-U={FQ5jEo91%`FX? zIal`618m#?BOzf9`IAjWR0Kv7(xh-u*C>c|^BcF6YneqT&|lnrUSV~W3+nW`o~n5o z3m?VEnlcnA(=Ucv?ECwN^NvsOfy2slTe9g(b+fbUE0}38**W4$6b};H0$68azCs-f z*jzKBA_zgoD%9`XOK6z;c-=Hs@jS0L;9EXAX#f16q<<=WO2fR<|4fJMm-ou{c>1h( z?`-9|`Ec#PiiS^ka*0nZn3NYJcXuG81>TQXSzjUJ@YjR(MA3X3`{{Bl&IA*{8)m|E zJ%5jP{I=G=?}ycq+c-ddK78Z!0Y5_7afe8dKE;mz1gMd$4pru4 zTJ9uF1NO%d3_`-2p$*LkRlb!wU83qnzJKN)=x@hDga8EUs(R-U%kCXe`1~9l{k}VP zKxGYvA5D=aR~15A$f)fByiozA{r+2kcPgS60$oxthpnb zJSCO#A*nkeC}==D6V(btH8=VDYpNZaF>naz)=ejJD|cT_j;6oO;Ydl!Yb!OLBt1q$ zGuhf$+6q#G9^)S6T^ZjkvzYb*_*5kH`j23vwR;B~xtB77z{A8%8`NYVvpLLyEdcfD z?a`AcNE7(mU8I~F!_OJHTo)_KI-Qudu2()cxdZP|e?sEaG0ayj+buh{w1l9b;8;;v z+0@@i+KL*8-7|gC`#et2V~tKt5>!G3|92(yxWvjGI|)0^2DP9xCaqTgufyW~=B@e1 z_mtYr)027?&^eTj1SA1JKNJa}jpLNMvjaT+iD}-S9bMSxz*_uRYY3ALdG==2>XZ{b zQ&sN9UF;tyJPMTriPvH)5l2ZYz@>}2y?gf#pWlJ6OaNEicKMJ_lgk6Q=l@am9pG%Q z?f>bXv^_0a^Ju9})hcSVs%on(R#nZ|n+PpMOVJuto1$iHVpEFRdnE)_D@1CKApa-M zIq!SUd9UktUH@FCp-oQ4_j#UseD2SEf4aM$sHi*!Xs2aY!vmQq5MdzWtUt?!d^~%u zlDX8B(ERM@o3ECbFAMFNOEclvX+MkUgmM~%!u%H*|1+Og)=YOQ5yJzWu+)4td z4X@F?ATUY+a_M+Lx$W2+TYX{91j5wRo9QOG(ko1|Erg`AbI%lWU(Vg&@$5pIY~tIF&6Ae1GyxWI{R=VDm| z^+)ZUNq4En4*mN&R{$}U+~i^36{mrO8YSO32Ofo_+_~R|MxRdh*`fm6^4XT#Dhcn# z?0fw4^YeSbIFwfaw5hxk$0*@tGQ3;h=Ih!3uy5&~h8r zIOhW#RVcj_x1jFM`2Ca&G|}a6T_PHP>k@(eTv-WYW%4->s%mis_@(|#RjEpvRImje z15g82RscG9>UP#(V0E-bM+OHkD%S6+RG?m=lWCL5pY*Isw~AD`ltdSih$O$#s zsspKcpwAl`zUr25IFDbvKxL#2@DZ6MVSM3~f3xLiFLZJ5-#s5RZ(AnD$N8;0?`_~Q z#=IVnH2`aW^keWBO#H!Fi`#`BQtQa;yC zU&4i$b=1i{S+F(fhOc8E28G$mE4PN!f^IolKi<Z-9);@0V9{IxU2VITsHCIyV>LZQzl&`gD{ zOO(s|&U{YAgr@%X-x9@2o0rElOl&9Anr|R}s(75N+y9|&VhnL`DQ+z;ko-vWY4C@9 zZjuWN*=q@9dV4^;G}E5}dpHT;w$C~}D?>RC{b|%r7^M8`!F9105D=(p!RpyE zzGRp#eZ=2GY#j%09nu1dqJ0_8au=B-&m#5DuuqtFj*7_QNyIq~508p$Emh@r4C3@e zl7!#u*N;*O;fe5HE#Hb1Mg})LJ)d0dS?PfZ|JYc(@DMZ5L^bKX9@{9!#mV_=ZcvmQ zrR~ji$G+-L#N=(x-cV=#GUnKc`nWH`2X<4w)_ zl<^ka%j@e{v)*5QQshJP6tOwtl9O`YS% zZyEb)%7N;FWF&zA#TuODTkumv1?^IJ^wV@V=v_C1g#k8jRl95Clj1Rah7=ePY5h z3yXqZtk$yDaI!a#@^!y=KXqpMO%fxe<ICjo+iWZJd}Zh5z0xv*)C+q_-35WPab$lIw&evaTCW{p zOM$x8b7v|l*nI-S871DTN)hLt)_%Et?-xM@bj7jZVxF*!mN`c{C`Y{w32BWnMg-}j z8nwEeT?$*PjI|qvAJeN7ThjGFWbzwY@ncQ+gA>HFcmWH(A8Fxr>er`s(}T8O-%J#% z=d`w;s5)I2T9Z4zE^iN{VeBR=xk}G$_);+;1dV6oYT;WmzLUt`HoJ~ zMvVR6O5hv|oO89PM}qb}NygI)&-hT1>p1UcYQ|vnGOCCOdZ`H4m1`~ygYME zfth3EKSk0_zgMrA#p*WBgT#Kudy4;sS$Y$CSY^>04nG3`eaq6*SFdU?E6FneoDzge z4sOF(z6OCm`dO0Et1Q2r^V)v8AK`6#<2r34C{O0+m%;mrB@JS#o*(t3?8bb`O)H<5 z)fkbB%{=n0AFSM+3p-8mPS*6Vo{#&FJv>;xC?U?k564ey z2n^5;Z9AcOKVSYFLc`b5Rq3THDLseYdsU0cDcc1@(u=!1&Kk!mgj!JWmDecy>LmJWP@>%GbVQ4qBtIh;5mt9uZ(CX>*gH zR-hKXUqb4=+6q4xc>46hFp^72i53L#XB+%`yFjq}4O5cIL81(h{Uii`m37(-G;rRr z=zeH}Ev0?@c!U(W6R~%^ow@L0hXbs!sdXX-# zAyru??tb&<@hC9EB5QrQ95zYoRxbRc=liv}#QTnqP3{b3YgowQ?fBfyJV1)0r9b4j zb7biLad*Dd#g5CHQoioXUxocQKgYzyOusLj>lL}v>-Gn>vylw0H(*$seDxC@McIoB z+e3NIGai5Gw|_jr`=*lY-gO%4+f5bU!?l=B2lz zzHxGOb9n~0>(k@zy&^il_P!A@&*$~)RrNKhv9At3Tg%(gbruCZb*)3Acrb4gjQFR$ zD@aygj2g4ihN4Hs<`eF3e=sJg1W}rK5s#lZv9To++d_TBzMN&(Y~wr*Ou4!Bx^mq%>~cy5+qW zta{GZx_dr@S9y0iuFG6GK@fY#yzhsZB&^zim&dpW-7Dhwqrz(m1br`t%l|1~*>Fi? zzVMOj*g-di8s2JV&M4eTe2#sHZyTMrm3#bnVb@m@3Gg|2^~t*0&3&oEyxjac zJ+lljtWeZha#%IfICXIFm4Y%uR?YbRj7$rUk%hjrc)RM&)5)}ajGn0`I*~+Kv&;v-PwyQtF-9gQCxaoZ zt|_3Pm0L~N&DdhP$G)iB(8)yF$-{cjWO$M8uZ&qF^-q00!748s(0tyWNqb&b-U&YL zwbqtdX1hdb4_+eqaBZG#Fw?!jYu;yTS7*)RKGsbs({htA*@{ULT>TBPHx`3+1G+sQ z3v@HU*z?`IXrMTINos$vcYE|*5CyZ?i8EVTCMKyLd5CC?i2dPB0O{-1x-!Nj*A?6vEjXXWND9Y)0OjV0dQ{jDqMpbiD(BN@%i=Gl3LTQDfc8EufG(BhQk7mZ1v zC3%Wv?tfNYC;5}9uVYz7j#`l7C80Y<8Zk$UE@eK`8oqYAke-JAw>%?>9+3?oXGV*T z7qJy8%~Xn=qVN~x<-V^pqk4WmJ1?&vtdUA}3y^@hj)n~cYnpq zA{QaK`!fVOf+<@UuQcGbuQqjw>hEvac~`yE9q%$?h*}^oIq7ga$-K+E4lAZgO=F)o z8*5=aXt;ep4@gw0O(J5L!AJh~?c~7e%@U1rjf<$19!&>Qwi>e>~D> zaJz&cu~{(@=mzsPirX6t4G-6t^r5-FN6iPdv*a_ZYV1`}q=W5%@#ejkVfr*j7xk~Z zsi0ir<==TQ)oKx?tT2DEAl7n6*}ooy+|y@ebImT35-d$j#XE^n;ALWiDDXKsoQM)P z{~j^k82%@>MfgY?Fr}5xJ3G1zk_kNW=qlIh9L`*->(^2!=tSVH8R;7%*xECiYHIBA z=nBV@$3}um7!*MhbP>3Zr#v{IqW_Is9$mRE-ed$+J+)mlUm#sCGQ{OfP5rK=nQ%6J zta|(9b5pS)F-f6}!`?Ks4W_E8cgy2`aByC2QY6x-Rt0pq2iCp4+Cq!I9VvhHcGv){ zpcaqElv>48GIgtadncGIf0bz=Vpv6sh9QaM%emb0`t(w+vUNM8_Ha);unwtT4g*O+ zM3{uXOwbqWZ@-wU97dlJB*ZbmMel6@w2~H$T=lfVS?EN3QA&E|F-*;;mkN5hp#4R6 z^3Axk=~`6d?$vbzVUH||WB(8~fW+k)cfPHEQ!8YV#*23~qtiYbh}jUk{#7oS7Ol-? zJV3T(wCXzSq4iznmhhkarJ&3HB3{&a&bm9Hl42!hmU6e8#;gM@9+ zpQ9cel$jFk2%o-Y`wvRi)Yd@@bt6ix2DIh-aY9QJuuw*!M!5IS?@ya5D@M^x?^P1Q zpYA2qVz;pG5LK4ndeN;d&4L@{v_DrpHpZolhC6jg9Fc9B^A$ak@%EM&8{sZ5JVUah zY;&{ZlJ8m@O%f_@R zsDm)(CCg4ZC;m## z_x1ck@0t80DLeCy#WUe?O1E8?uY=Yk8~aIR5yMUu_bL=J}sQOZCQ9U!O3%REh%h*hlQ3b~JSm2~qfLC?9vm6;6 ztzplgH`cN~@2Z^RoY$r8dtJlui;<*!Q4zn_u5p1U(a6X1Yw`DminXF}|=emr4 zN=P|8lZx#!mz8x>i{U*d<}mf1WpPtvQYcRV_hUNH?cqZU88|U4@sAMVax$&k%AN{n zIS#C|n;&9G`8n^tcTC}Gf6L+rImY(`i-Y5p$z1c_pUSKI_@tVHE}508b@OCVfLYF3 z5u9^W54QvOrL#-;rL73q6FEhgS^JV3dm$mguDettT)e`M+u97Hq7t%lL7+4Berf<+ zUs(7=!plV?oN>ZsiDx9Y#cpKF-reeOKOl}Yd$V%FjxY)&Vte8s8J(R?&|;T>RQt}X zE0QzNne~2y1LF2m1A{yinAv#9Od>HPcP$bN$-MBHtF-}m^H0&V@IblcEdp`xq8k%sO#tX-jF6PJhb z-g3J~?{yfUa}jawTq4!gf$VNC9&N?Md7M-8VB6jJE+8-klmPW9<`35o<=VSNpD$o) zJjs6J?#97tc59i<*!*VQ7eoH$I~Fr7$o9_r%eL+W?2rSw%{3VzHkpa-sn`7-Os+mS zLun26+1`E$A8>u6Q$%iV?*2&CLoF26tG*>PIj2p-CkIfXJbH*28(P7vWT5C0gTo%w zoE}kB?YUE9ZM{sU1V&gz42M!=zs7`jLI?0np*DHV)tOK*#8q1!X^ znAVbk|M=#JESG{zjhowgoc-%!9{n6d+ILD5R)-Tps~(`rO#ZNunU zlPK<{%!FSnkFi zxLf>uMTTNpf^v?(z}V%Wk#58guv7lYQnH*2gT2Y3E8WQ1r>tP=LtVxE5yYwfG2ef7@AR zl5{Adx;^0@1g7eaumJ5G=mi?y%_QFyCX%|Ne0Iybx+gZ@sGm4v3Ov>V9#bZ6xVQ+XaE5PJHdxdqPq>7qO2D`32W$14 zzA93TRXBz)A~w$1V-}r230@&KR@7E3AE+HLG=F}2ZUqx>tXwx_O8KI>z)T~=I zD_OZ0>-?4ZD=q(X-Q1N+kbCZAF!^t{6um0BP0g3aDLD*U=(w^XWXFF_P=n|fL(4b$ z)oxYhU0xj+l*^(5(xCG3>S_@vReu29rZZN|wfM(#(;9rYV^QF`sGO7QlI^7@5&3mq zajGxLI?KN<1OWwF*1$s*hBPWB-{;6zC-&Na#M`XXjh4_V4-X{4tR?M|)qFl7D%p4e zuV4Hk;3K!*(|Kb3T6@PJD%t+Msv>;qP~4?8@scN|<0AqYN{6!UP4NNtYa}A0g|;=E zVd$Ah1k2_^pR!@~Z4Pj3QG|8R3$F8tB56uXHY4PfxLmdCilTW1mlY(}5CF2#*6 zNW?9D?=xT!jl*OWfo)zboY z%j^gHU#l-7(&UU^e1aE`kMBc?unP}B^7zd1%&Aj2zYAV_@8~4F9wA|Ys7oV2Dgl{q z7-=oxdl&d0eK2M7lB9!$zp4JiWJwy!&QBi#>wNdu&49_}(XDtSB;?jqdG2b9uoqr2 zQ%SHCNVt@G?{eCUa~At29j;#m7X@g1GUFd^be8z4c@Td+CP=M)HreYkt$#me^G^4B z2VXBpgQAj>OwOv}`dJ^S9!{p+ja3T8&L|Z^kyTshH9E`-(BD?fO3tZYTZ#WH8#R#*mTu0oO>GXptU+1#Ic zdmAJYZe=TeHuA;G0)12lkd6Lu#sav)=Ku~H?wohU*opwbis4Fa#cE)#XXoeVZ7p6b zkFb&ALCK8Re}@;iH^iPn?}F<u^Z{7csg}8xA_HYp~wyX3BAb*vyYJ0KVAx&PN!)*dOTQAIhk}!#@Hn1dP?s z0weS&Zrpw1K7J_Bb+BVg{*<9!x8v45t$1$nG3LK_YgwYD8<0m3g%0(OgDCBGPaFS{ zgvqZHWp?Y7W(;l7EELzpG=+Uh!ubn9xpzcV;cj>!^~uW0m7hdvV*GR0y_}gN940gF zPufPL69Y-=m)`BT(&_wVC8T&U<#t+t@XuoP>-z_=rnUxGd^+0|g3Fvcz$|_B7!};G zPad=K?jgtJ^#Gy)O@AwfH;d^oMnF#oHhfO&bv1rOo8Jy zzuAse=|l{Qa>y5*J7;UqcL`G!%{A*-O~pw2xvxnBQ$?S`TI)Rb`SyS89{I8)lL23P*oV<@LAiqcIRz9|`C%&5Y1{>RTg?^Gc;~1oy`G3%@ zN)SUy^PmM(GlW>t#-%!KR}3*#EaW%(<0eh#x$mxOHPgc5R5|V>mMA%IUkg}-S?3`R z`TYM5sJbZ*OwV|Rqs;7Wn*N@3+9Cni03wRAKsMzhm$yLEc;K`a_&7o*+5d4}Ew3O< z&v=ESF8|#NNm+vhl|(!MGvlWNlW|3@jCTIP5Xk(^|G^H%dowkB^*X65$9Zi##s-IH z|N0W(C%TtPgDqF5fRP+cG}~xrs`TNowYh%&{^%+}NP{TIY5(?Y2!!Y6DD~%cF&7;# zEH5Gkr6Ck%y-Pe*>Z4-AupX1Dv=ld`ylwuVP%0y;7Pg^6drRwX_#gh4cRr z$~9C5|NEm@OWWjZdkjo({?A7N8SX#c4LbO;;u`qW-2bxYrIi1>lKoP`veYHAyeLKe zVv$l;(f_^>TKaK|4^YcdjPTkLGd>j72gXPcj5@%~y1`!*eHzN_Ib~}|36cKy)-w58 zemQX@wYq=Z&B}d+QcIMRYJp~O*z7+WFokj(yRA6;f@!n7sZnMVok#ORIG!$n*e92a zn{X$=7T{Y1RSw`3SQgvZNI6LT`pqQ8<%krElz;BsW&uns7+7{iciC_w(0mXkF z#0`LOc$QuihrnZNcKhG78)KJH3T9s+c zy2a$s^NuCjiB2$j-cKs`A*)?kB$l2tMeI>?Lx-no5^hzZE1gk}$WnfaZsJJ2vBpyq z$FwCF55VXEmR*kv6ZZi^=mVIl1m~9Nrm?+^5Eo%5=Yte-5_1aSn%Xn!vZ0Dplql;2J5d8hQA4rvz;x?OeE<`IR70*DCBv?}g-wog`+P7AA`Y?s44g{S3*Ky**F_ zP?a{8Hk-Si0Qui?wq*( zkymeeK!mwV0p(omDsxp z!YTWiU?@#bUwBB{i+*5WmzrbD6(X>3LjB(22G=!eYIIBVv4(J(e_H|rb>jM z&iPUfSnYO5=+VWTYQ0t8pY0zYB&MdD))_%-7K7H(oz{$<;He(qS$uRSf~C!w``Myy z_~N&E3C83y3C3`11IEQs_hK`rs(RxoqBP4u(X)&h(w(+jkzt!eJ*D$SvEc!n0XrPb zjmGDu4;6yXs%5(QAmLBJ`$4};9q#fG97poyyC~Hn(o0K=0wEcn8=u>b7Lu!3dCuMa zW?U5b3%m=dJ3FI~@gly5Hx0$i{7zq7z?AwqYNI2IQ~@BiUOvEkW5BH$g8Ug#%8!L) z#L-qu9=O!mRZM5v8c;#@J^sha0&r$CgdxiePLq?BBOS|nCi*fq1KDvTzXm}zOmAhS zG^TFUaN@bL`VRf9XSKw%p3X!y*+w+Yei)ej*fH|~ga1$+rp9ushl6DIY(sv@^L{JI z5eIDzgC(d(HzEBLVz%aVUwJ9jTsaF}S zs6a)BkvA`?Y#z4d1d({cEjeJtX7sjC$U$eIwQKEkSd!$Wi|5r86iBD%2S@Sk9bJ(a zymru=v!{Yiid2W;aI^s16Wpy$wC(xOF{}Q-*=WztlQt1yQKOrNM$yOjJI|NvU1PM=YIXC$ z^<$0awO#je%WGc5cDE5{FeM+woH62$u<0oyB5BHo>YukkA_D6PhxCX3$1^Jt=>zWO5{d z)UEZ@q^J=S1RH&SZ30fP#q}~jjBweOs8=&FDRK`rCgC1X(2tH-;OnKfi|cmH(@==n zQbi%e-r(aAx8i|X?aZ{46g3b?t(ON;%13vZ=ejO`NUMxHn1e&>oXUb#s!q2q-SC-K z1I0WmLU#XoJ-dvd| z!S3}0&M&;s(i+;^U*{8YU!f6m`1M}(vMqonLm4F=ieMee$cf$Dq#N-BCs*!!7CmnB z+U*r3(ATjTDl$3HLZM#@E+vrhQeva1b|@sjFc2vngeofL4-LXe;l788uwk2D<;3l3 zX#w;52J@Tnh3QFlapD^kqKQIkD5@>ydP~KGT`eg&9KdY~0P>LrkbOkhK|{*u=ygL; zyt;C&ckyw5@5v4T`K+I22N{1ZfTqZx(o!B6z2o)g);cn2;I5Z*ul0*ZxQJQ7$ZTyU z>QDSDB^$uCVIRdyMe3o%5bG$dA8JOGhRs?k(L)tlvkq;GYYC@{o^;J`JrUvsR*pAX zv-(AZ40VY7D^F_MqG+!Bg^w8g4z4koYdnPex`tC~wqBOf>-tj8%K(9B_$@v7iwlq< zo1PI00&SqyycBOQY`yb~S<*CyThGMu5=bAX@lAB&O+eCk@&1SByDjkq>wQ+!YXclr z@TrBaRfKWNeQj5+NBtrJ*ZUK!@ZrOF`KE@%cHT)(dIg>G2)ozT@x_kc?l0vbEMw zm79@WT`KnTj~~!hp>&QBoJ*cQs_pWcfXfpFA;2WxrUl&@6 zH$W7YNgLyNhjUJ3pdHiI^;q4awZ&)e$u&k=&wTjl;t667O_f-gYA2u)trkn2PP3F| ze?bstn~&A?)x1#0HC(rEttC2cYj_u=lO^vMg&rOX$EVu&eV&z^aavz1L$vbB7^7KD zY0FwwK|!tg`D%G?E^K4l!r10vS^r!YW@E{il&reYmF-5rrs>;NPtsWrpgG&QHrDEm z))$$?y?|}o?|wp&DRyu@ z9prsHT*Ymwf%)La^ki0xoqcp!9GnnDsr)oEjLmNtAZOIv2GFHL<4*l&mY3=sfLPnD z8i4L8OgIy6fiyLd6Vx>%el-BK5ku33@Q_gc(h>X7{wXMEH8!zb`omHGb-)wik01CA z^5g`$F-+ud)EMTtXtICjtN6>GyB7K~#kr&uLiI8zK|~X6_*};=+c0B@*Yp0owNn40 zW7U1mJeQop{_NV_q4R4c>{W&VVnL^}oGX+aO?+^_UCFArBekpFWornSDLb#=pnOmY z)A6b`EiQHxgs!qttFEhr6`mr3R)3U#)F#kF-a_YUWw9Ey7o-9Cj`r@mXjMJF>%q zT6B@x6bg%c;TWKHU(U{BYZEzQ6E_d*K->EZgwRI z>63j@7{?Lv%OzyC#)_>2`vYLn!^LLCbbI8|6xo41efm@^AsShKfImg{t%Th&*b?cL zupLTY&Uqcg9qHACDp^oVA`??2cc!i)YORs(2HhVF4z~SOT@E$}^u3XDSa``;UI%Y{ zmX1aDR#Gx3PAMn*1fq&NkFs;18??I^CCm|g`6_BdIdQJhMdA`bX5)0 zYlR@iGv^IKaJ`QB6rt6|aNO1C(aYye`%%4EWByd(Sag*d1oF#2>O+ySez~_k;Zsfy z2q_bMeMWBMMNJy-$-GoIGm8f0*vzLi$ve(T&1{J==}<vH#vs-v`)19TdJg}qW`x8W& zmNEwl)U0vR8DA)Y{&W)a&KJ3GJ0SW>M|&Viy9PL9R==iRMWllW9b_J`qB2!E=X@<) zUCXpBFdFZvyyM$cK2EWI3j?n`BN=hg$`FwRKpZ1y>^|Goa)Lx8DNBE3eGsW%T;-~4 z=im!gM(S|YaT7Nr6LF1!Dtl6jUq;6eQ4)MUq;}@6z$Lo5#L%7(U>h=^NJ=+u5TlFS zlfAYU@{ zSZ}XL1k*lv`5Pp`>fhn7&s~Wlv#%Bs$cabl1#JWMi(P z@YkJCCUFI(o&y6wc*z<9j0Zn;Xb0e{)lSPt3`*Xt8QRY4h^^2LU^_MZMBRhvV1KW> z?Z*$(i+GD9#M28jd;{OF(11$OA#RvQ@9o=jdlUA)Ls^J$Iw_wh;7ux~-ap&KdDdwo z_gXMIMn+cGoo^@K3U9rYIiN?lE+r)ex=?N$kF*}(O;1dU1r2-+XxjAq8hx3 zzn6?H+Y->bi6SrM#i$FTKF$$gqlWI-bVi9PKzMuMivO6mz&hT;$ z5T|Zrp*@#J7eCV5p%Qq*>5nj-W!~^*71VOR={i&~x+z0qmlw~K*SA({hMV9}levoF z;2r#;lIjDprWZny>A-SzO9JBLOpDPnMaYMA5J>|T4it>MfL6H#+-J+Mb6dEaIvDBa zM+^J*E49kwX8^SBc^Qguur1a9?Of=E3{e+#%eO3AT3UKdmPHb*A;H*6=04fRnrF)RUrIeG9^p9l*kVm|Z!Vs~3#1Bzo|1Rir4^|WxB-I0y;5Se1o{xq z3({qMOu4NNu-x{cDkx2Np9nDiQv>D;cox=7SMonMUS-w|D#2Y+vu=m-xDvpCNt?53 zdutuCRm6OKfHZ0W?n!}8^4U(n0;pOpejB)Z=F$yG7bHXn`cs^iU?g#vTNlfW$_Q{L8G7EunN7&5AnLTf*qv9g)+wLRWj6wyh@um5&M^ zqKPU8oAy002kWM384$_`ZY7913t4oJpPrvhOoe1rRD2ppa(22i)MmhIfjkIxy`8UR zlFBc=IQT4f29zbzKxycyfJLp=(k_^X$)j8N2yn=rIy@<~t6HU1PL|XX)|Y6LR!=k$ zKg{f0|LzgmGdFKJ6UY;{{v0VZ6AolFGe_-^mmI8T z`sgPW!0Nau4=VG6dzG%)IayS>yN;xkX7w(!pWk@Jv&9i5r}W*z-!<;LgQIAhz2%hHornWeiOWrAtC zXF`@;eK@K`xy{?G@3w(+Zp~!*)VreoN25)!)qJK(s<7;7eX0cutJPYVX#}~%_{09` zn|j$IlRDD`JCp*pMNkhTN7?q1jRA^7^}bAq zYTHZ`8^9mGO&H)8Q$S7b2}qC{xv+IS`gL0Jj#jnnU_XPLAIG2(vo8R;UawtqK|3ed z=^zi>g3{Vt6S85mPIM=rCypOqqK9|zjBs&^DS+9ZaNOY}Ox6vr4PWt=!exwzWu zt49DNlEbpCcy3n`<4+r(usNUo*rZ*eqEoVy;lcj?;LN@qZXz=i>r1-TB{4m_cms_cCT_?^`%#MCl~+DEM|Iu@!1Bt- z3IRwfjf^AmWNAA_E3Q!2c-w``fi?8<)kvcD(aF2ghL3XdfwKk@m$>U~025lS@x|Rm z0ArF9WBW<8y)Z6>kNWy?!{2@r%LVa$7aF#=ksT-Hdlb@b;iVi3zwUuDtTsq$QG_q? z`C5~bwY1}Wf`X-s%}J-@y9lN8_m<8oc}6Bwm8NcDeGw` zqCuREx1rYSydA52Td%YKlIRKc2J2zZ53c|)-P=4Lkd2;J2gx~nEr$#(ZqaDwj<48x zq&^1up*6PqCQ?-G%Q45VRm*-)SY=0{HV6O=e2IH6JbXFj1q!p-LPwx&NjJP(HAd9s zrar*wTmtnCUms{{a#2y@#jhf-jvb>F?iAr}o>~1q_&rL&{lXXXy^ppeAk%w?rT>( zHqprbrMgC9+kBSsq@)+2HrBOUobh3`^$=8sL?N=T=|1Til3MV&xZT|c93(nnJJ9c$Q83btc7GY3-@sug)ray+Y4zaY7KhPO@(mYAkg$)0Av`8@|B zRkDvXALG7Fph5JU0%aQQNS5`Y?Vt8S9HWz;Upx4QKC#X$rj4PzHe@;fK>^>5RCg>> z%v_c5Wddia+dpn|}LYCv~bpz~cNmDYK=ec{TD<^|B zUrXlZE%EE<0NG|qQ?Te8jTZ!57u3E0Fi%rfHY3SrPoB&u1#LU#1Ar(mXsITJpFkN` zyA!P1F%mo=L^=-ufAyGer(x)tS$&ym4VS2%Pi49FtBcNJiN#|$N>jr+?`V(Vzr;kUexRVin@GX}qKrN;Wrn;|JI%YE*#c|a-aikWmBUAkc#nD)5 zw{14?@NYCn(kp*l=`Env6k^^D+)m2BVPG%T`zHRb3 zE7vnDn~Tn`zy^of6p(R=D_8Jz5{Eg-N?OmNIj@mt?ON*%AIwp z1UM`b^pN1*vK{s>BcMN^LM(UhKJ0t?0qZ93n9ck|E&}jqVXBV<$&_Hg8;nSwC+*tf zCw+VG*o~~XWMtAcrF(5xru3C1gaO>edQx({_wd(D56FO+<(;Z0K=d5y1!S5Lb7Qb& zNd%j7^#ow>%awYxIRW}PJ72vts4OD4v83;JR;pkH>d&4XY#+LeSck%;EY*CQTSpjm z1wDTK-s}>bzi9v}c0iiCG?h^4yRTSc1lK2SG4uk9zPL+c)R(7cf1^byLD0y&g#Yu* z)GHaRDF{1~B&tWM*dQscdUTBc*cgzm0l+m753`BH%nX+&DAQuiH2=g?8ZH?HOk^a= z<&@&2v)yL3IWh;CgE}UDee*i0s~mi;EL&fbY!tFg#ie9VLWg)8Zbq^Uh%$a0yd0@i z{3+vEye!#Ux2y8wZE&l$V^|-zBQf?xZ|>1d3eQrMk*aqEht{oCqRRE0Vc@J z{|I5~ca8e{$X5uYfuD3R6)I5N1KNQ%ekckc{2W-U9-t)M28PXeyE7cvVP^Y=`56abDj;e|O7k)B(S^hL53 zF0_dkY;UG9&T3Zt2*&^rEL?K$wV#aNY^k`WsTB2_tAOAV@dKy|5BxTg!w>47nSc$v zRTl#|`+!qqf8Dv2K?K(Fj;*#wQ`;>pzjg&QFuJLsR_4i>J$!39dOrPfpGnhca=+F< zPDW98%e>{(%Q`gRG^1+mCyy!DZDazJNDWl)xTNX}hdn({ojPwtqfS5r*16aIs#H6e z9Ff23$RPG;0S(Ky)=bQ-)>fQ^{}BKThwyc6h`R3%%5M()kPh4zmb74GBJtwr`W_l) zzf?AY&3E+%g&<`TFd34W1K9^`r`TCfp_<<=#A#I$uCwrA!IT1F!-Ez27by_GS8i*<4Id7kwmu z1vEvKw%go2SZIn=G21)zWj>^4eND_YHhBN|c969~!B!la?I8^-N<%3tInHZnoN@6< ztYPk@C|r~6skrJ|wd(bppANe|{5K$wl(I*U-Fkt!MeHH9b6dhHE1I_zt6$`)tDhG1 z+D8I5Tab?rikmtF)wAe=Yj`CinJO~V64u|tRMXKb;z$(iEb;mEpd}=r8Y$CHMn>*f9tcv||5b;h+-@J72LgUBIOm z{*fp7jGpJDhq`AeIoI>_)+7diYKX!RrB389IGWwl!iG`wIr0)sLfIDZ&=uO8L&vY+ zM7LSrzO(4^N%?lbDd>;{r`oNEheAbiaOIUTBh%`DZ2cE6_v1VyU1*=B=GShq1>a}=&I(Y>m1+WI*QeFOJZ)IW@=yY7=sIW)yWZ$1Y&WXDR3RVP zveYGFJe&?~v=0k;_pbL=eT}Mp{ic1{1qx9-RApprgPz<|*dO9MkS;%iX!L(5gIQdu zw(H{}`KSQD`~2SakYC1TzIci+Q|)exB5tG}Wnu_GQgD93D;ud#`h;FMW(^V_1fdBN zwDcn+h;HwTQeFDf9(w@Vl8dlpav!iBh;G1abOE$;od345j(W_aclMk0LpdDS_Ds|$AHEKlBl zgM5476zIIN++76iGKz4o&D3W0#5=rZ6}72#7^Ms{9%bedw&A*_{`yiIOi{c99XmF` zJP*avQ$B&5l!km8vJ~vy)-&9WZk?f_c=`J|7abv5L*-w@2ZA3c?#J#HGuX;#Vd$6@8 zmDLY4m1vB2x`UT;hvLjFEQCZ*DG!UXuvkW0JOMsc;L94nDA{iAOiM?nb31+n%nmGd zRrH-8`rw!9Qw?~1iA2(YFEQEm=l6k#^yjHr0Cwe~4#D-+hO<{Gl-fvyyLOnv2^RBn zuC^~U0Y&XuiZKFFyZ!FIe81E|CaD(dvHpq0O3^pDjyNGTOY%jQRPN?=*NEJdr$tw4 z=%Z|5Ymbs`S|`0VZl4{*#`VWYxu=iKK$aFs`pJVVf9{w+e&qdV7;f^i+6ijcDxp;l zw{#!5)x~%OoxN0jZPPq3J63E|88@(){n?4CVA@nS;<<@_ZT9Sn+^#c?()FWbL!5 zx-zpzP%t~4b|jL4;3vBe0d+hPKTUBie)u`6li<=PUPgIAZ_YV;$rf8rtP zC1GV_SYjQPadUHPux!}XFwtXs15c=zU1+rXiwm#|dcX+7klsfp|H-JgdE`>3eFJZc{Cu25)0P&4Yf?UpcNgn^SJ%0lhi7=oK&ylkI3X`<0~?SU zUp)1gN%TqzHs29YPbkRO!;Cgc2b1Afc&9mrjD9fP%DyB9MRtfqw-& z@4dtQ_h4i&GDz5Kt*^{Ezi+MGSt+8zrTOfHArhf^EBRixoRV=r{z*8CCPv88cEx#s zp1gd=QYHyaMK!uo-(#*(Y9BNEUYjGG1Td(eeLX8sb$mR-%tT!?4)o-UF8yi=Jelx7 zHz!^|x7Zx5Zg$#XXKj*d7B6u0fv(Kaf2W3PAKr!W*4FlEW%f^w?#XMX?>8qt=qa5& zo+^r@PK>HFN~glIXS-juU6jB3*+A%?vo1`lZ^Z>44?i1zedAcFfAD|X3TN38$8SXN z!@y1AGBHkaFvI*sv>sgSa_cRunQb%@{(g+WjqmL(q?%pSP;~+Cat5wHeS9&xbO#=f ztQNqmOY(z%H1gw?X=|#uc;Vjlu-MsC(!p~dABy!FleeGYq=(NyMeLm8ee;0T{t*0n zJ$iSZAyjQ|F>8+wGDs)>>rUv8lg*7zwgqp^eo?G;<~KIV_NZl!nxR&V1^+qn_d!R~ zKZaj^A(JTox|}hIR4=FKlLI`1c9jdV*&3}zihWF?lue`(wB9B1NU`Wt@;%|wtgpAB z4rUs2eM&XDIHm9^Y~+Q6s^xiR=cZn5R!XnQO&F_?5MkMpNr-S%G)W;UzZf~Edh-ID z-6ew9flWBgz>m-PLwM07je23pjlg79% zClAFrC@ffRTUnur^$x6*<_0;`N|vrLoWk?<14)3nhVrYIWoIsnG~&LzVxXol{6ivA z!b}85jhD$MXGlh*_SG|38-N>lt%P+Y@$9gM25oPShR-JP3EUJ(Zm2Z-7I z;WtbmjD3G`c84&k2rff&KFLkg}~a*Wn?N8l`U?WRjKWh7;D2Ts_flHlpU`K zBnfHBFaFZ0JcG$sB-q2RxamzjbVu}z3a2L4UXiw%Jm=`ejmWT-0_h|S+GKr3W+D`jx*N1)d^-8M|Jgv5V+ z{mesEVloS~v{8(qKxzXwb#|sh$yr@k*I*KS(q#jD!I?w$8j%pvPDVEH~`m0BanxoyH_sQneFN)E@XaJ*GRG9hs*ylKn-8Pf2s?4~~B+A&_+$Xn5kVqPH$ zuBPG7TZ7se?r2a(WA0;OE9f z&edd#5-~EOki=(9;>M;g1c$&PqW?k-PoCA6vg@qm*1BFqJdSHJf_|tNPCg}k#)II^ zseC213r~*kX3Izu6SP<(1PrFlNf_W37e4sk91U;gd_@cwWH*Cr6@EW~!|4$y-q1jt z?btZ8p@K^piGmf;yr4T}5LnX~T;OJ>>f<&WiMCW3&?_0W-T(7`COQ?EyJa^C z9~+4&aQ5VQF3@@_$=9cq{Hxbkk-!1dMeIypZ#!2PHsGI+j(vi56M@?C1>c3G-Rd37 zxhXB)-(jOtX5K^m;tgpv+bIhu4X?Se(wAVger)GG?-H;t2&R^*c)&L}+!PFlNF$ZhQAZud zl+<5xx!2={GyZbgBjlZCxI|I+Gp{Ib#8hpC>0_syq%80?t>JA~q1toiGeS)vPVV)% z_zO=m+WJf>M=essNr~S|dcgo!iJ?84#j_k1slvin;^sIMYxuK`swEwh{Z^C;hx0{huK}JCRw}7>t;D zL;iRwV&8`SJ0k57)KwIJqipJkL1$@Tv;QZ;GUk;Mc=YmiE#ELZyt(}$TBZd;!v|Mk z1k_gLy>-k(d3Lq&&X-M<1=_(y&pGQWg5p@uMTr=b$MEUBI?@7}-kR2V-RmG&GI_cz zO~&a}hjqmAYl`ZtWqlsa0qZ)EB`SEu058d|E&i;amtS-2Gvmm_#2c*N9sJ~3xC{&5ZT>DHescMr z5!cIY7D^73dOO`LxTM>0j<D*ZG?k^R2dLWzZ!0m3N>Ksrkmqe-L{ z&Ur#6=GFVtS=|Tr{WU(~P$88b%>HQ?#XJ~h_m1X_N>sjDb+NNYJ>lWfRC<5fx@lpV`(2C2KT_&y61=&1komh|Fkg8?W39FszU*=z2)JY-Fw&JehQs&!z^Cpo_2Y%@U~oajkM?FYTny(013yBriS=S zl!k5*B15jFHajRl;><2aH(_fnM9&m_TZc8=D6{M#HWpE*l{kuK#nlo*f&{Dbw>aU{ zHrpkl&QrUx`%Xfc14S=#c3abi017`2@?Jt26{O+Z8a33dXcQNh{?5cVZpA7^l+g#{ z#+8>6s_mFLa%h8M@wX>v^U(DVr3V9fpn4ekeml*e6d1TY{NDrA@V2G%oYSQhqI>}> zxlLU)zgIO15R~}cAL?baMJ%o85AMDD{iLcUzb?4xg{(%oA|9(=w4Q}5JCl#d(qi~R z9hYb&hySV0a{wdgM6;56qaG%8O$7Js0el?RtHVkeys!GMr;Y?n32AUfvAGKBD&c^q zSe|e6X?(355NsxHZZfFVgyqynd`Uvu%N&|V? z8YIvFY3k(au&@4c~T}0hF9`(CC77uRX*I-(eQ-*A;j0_Qe&JEjkSixQZfT zCMRtzFLV!1PK?l^y0X7=>DE+ZE;P(ET0naau@*&!%?+LUoV5F`Dj1og>|y2g+XOjW zxs+}l|9`FWLED{M`ij7*AcKy`J9Mpemvr}m##<_TAA#Hwp^2m*j6(ncg`AR4;$C_| z;!zqZ$jH!t;?h}JBHj1*IS>WxcSaWib{0BiEi6h1T)K!Txv^&H>~RZyQ<>1=mUFx^ zSEw5)$9q`J@mqswUFv2+fz*hqh%Q+0@%)Nx#=CHqaPc{P{D&>GLzNr?*iu^YGBSL@*8hO5p8 z3NGz>aPJU~crAFEUdbzPoBaL7Kdwhj?I4hcG&PYk2xI%&CL4hF7CLty?=FXl(buRk z`z~&W3)l;1T5|UiKNqli2bH|`9!-Whyl#)Ht`RK}UqnDZIW4Z{rn-~6?&~Dab)y5a z9v}y`EzfJ)p=nuDh+>@YRw<&X>k644$b1zSOD%(0=LO+M>K1aE0)6$xElmt?->=D0 zpM7|b%^ZvCFH;!ERvecY51^|HdEFXUFxn6(5As#^Ea_SDRch7HI=f}zmyv@i+L5=a z7yk_iUkhe(DtlVssJW)>_GfvUQ?kws z0&Ec82<9F9R&@wcHrF`<%Iq9n&279hSy3v{Y zXbz;3ns?6)E>6vVy@CGbdL?-FfGj8q(^- z8y8JSDAH{8(t06>h?HaG_)A1I|!T)qF4|c2kZFHt5U{kdd@_9 z)2nUs-#^Ira08VBEb_K-;TE7_H_Kw|q^<6g#st`a`3DE+rU9hOR5`+;d$p}_>NwJ& zUziiJhtW!Nf*QZ&EQYtfuz$NqehLET&O<;@Mk4++D(QhP==$7DEo1>vhSnATWS zPBnX9SxTK?&>YNMe&y>6p7&c?^!*x(_1ZC~?D>W97deCcx{?7fpj+sR*ma}5p33v{ zcAw$b?7mxEtGW(2DSB%&`YIc5&v%PPe-B9M>dTNly;`}m-=6jz^e+HKk*eJKFI4}) zXPA3sxVLvaE|0Ft0qW7Mow?sk_MoOXAZ(&ezaKEiC1?cz4a;PuS7|W z3ps1}Hq2ci;{0mU;}c`-^}c>W^V+N$R)ONPwssUPq@bh{c^z+oqmHhBy@a zdaJ@B1;)>w%dODTo>Z zj7*UQf#hVVN|PijwI7$JOps{hZ1H6`3onJvj>0L?XAvNQgU^L}t z4&gS()PiUGNOjGhQDEO(t(P#O#vo2QS!9$AGk^K>bJ7N-m6E77MppOJx=^tCNyj?U zliAAQQUr2!D$bG(q&a$T<)Spgt6bphuB7MJs;#n#q^=-SR)_9QkBy!gs=RbxSZi z&N40Ldn2o+8Ce1T6R?A^CXkaFoxWRA-={xJ$C~7gtSoeCwUW-Ui;VS?%=C7) zhb!duExQc3E033EZ&0Un>}7xe5VuRIU;~-$6fsifA9(fR5U$K09jMS8@3e#r7J&yE zYS}XI?Pv6UE$O~_N^JTBn>gA8zOz!D#7~b^qd4pO5Mwc~E;>IKINs)%{goIMThbIN zR$654Dw-RrrQkvun0VvseTQRA+=?RIphx&|%id!4lUBYbMyxlfT93>=Rwm3w$XtE{ z0tM+>H=vi64R7-N+`cCYZf{1ijf;ZV4HwB1Uq%eAa1r$#F6JTEbe^P^v5Jc=^y!FS zHr%*#`*$~K8vSpzyV zn6_c_Fn83O0}Iva>utjy6E;kATj{*r@(XJ*bI{d?xQo{*pYY81=;%V5Z`8R{kpn=9 zSkX>oQpmfTv6-*IZd%ge{`I(7+|w~$01}!oRUbj9l1j(R+Xg@z8BW$mN(i^byE(m( zrM69TQCoNw5i#;UW~n{vN+9OzmJ1SqdPnV3i<88=g$KFS92K_xS|@t zuN%5XO{lbo6<5dGK@d?-$n9B6BY-hn>>cA-fIQ|3_JF1B#?MiGyx|(1^Hc@yYCuE6 zupkj7Ai`8xgmE|%(`2@5H1`+wvhQL3@^pg)c~Vm^kMTct6OAY5zn8n3FlgK8@g##` zP_1^#qAB(Z^Ax1^LkrliZe0t~yIW0LI<(KZnp2<36LJ+3`=rf=rWk_j?W6zAJmaSs z6ajD;{_e4}5vJ@oCAI&TC1Mt2@?MjC*^``Nq}f%jKh>H;^T0CL;Bo`2?%i#tRlZ`c zNz{Bo@wYNBxD@WJPcMQ%bcm35ccB9ZhU+u!@xSiPT4jF?U_r<86;|2B5LL@Cv zCw1+jNdlG9JEU3%if&W63Q(NrGk%|s;jeet^U=YL+st(BAi>B<@9I>wA4D>hI&>Lh zyh@`NuNADMP;qviu6~ScXLT!@-;}V!njq3`&=JSkZ7gL^(ySlz_P>JC^s;XZ<}CxX zS;%rnA|p8XPfE>WdzmY6uz@%ZGv8+5BP#xl(Z1;`(F~VU5dNnRe~ZtOEr9HXcNOtj zj+bBC!D;oK;9!p>lBS~r%&6#jF0Fo1p|ruxX8ZkkT>Vo|V-XipEyISR$TabTNeDi$ zO=eJ6OmyKz(;KrK3!-z;irM~x967>p_OJyq`@SEW4ApCI55=r5()Y|3;72M^za_FC z5*T->O1%NAEZySoCyFtXW9$SNkLyVGyS$tWf#Y)(BAU_s{JGI_XW$^XDq2X;sJ61j zAgZns;_2YWYDNUuz5Y=~yni zV+2q@>*sKejAj==?5TkqP85ax^eFgodmLZ4fzZ@tW{=^-zntKK zMryUSj@PV){PXiGQ0RMWm@b|_m6wR&PMXel2KvX(D*DYGS52PnVuzzKD|DkD^1U!L zg(y_>)(g4Zo6)XC!fbP_zbGFnIHfN4 zzm=@5)z#(}IKaf8yn$Xdks&fqwu4xfdsbdzsie77pR0So*VVlG7tgrpvGQYMEc$iw z`QDvFHUmSq2JkNL@LIiit)_gf(UEsyd2-ViOpSN`gIX}x25RL@@$Ru8<}}Swda0x$ znwrSC^8&Z&`~nai{%k|W>(-<`XRgDiB*INLmfb8Fq1$o}re$6U|QSE~^2{-&JPu7{l!_vn$D9UOavbHq zt^%vmczx^`gg;m3c6*}~i~vAARL+1QW7J$5NW0awGMJYZR`-RbOvVP-@PLaH*?rJ= zzY4~qUQsSuALfV`C2{HEP|_@ebAC05rmsTqjT$4%EhQ_VK%~?4T)_5%Nkw8R>1|fO z!%jK(|BQs-n6}})f=}Fvz+Dft@kLgRQAj=$BJrC>$$t2<^U2I%~Ef`t1-bKNNGyt0i~>d zWnH-t%={zQGc-zYj}Bv5pK91+wIu?K7P)}X2@GTeEOqtBrQf{Y*g+=nz`*`_eVJEq zGFl_9;q6eMVZlGpwfmH`ReSq7(y#Ked*W*?5j)b`8wR>=kjvb@>`KWz=kN{IrMYg; zU0RdvAzZ63$EKsF?!tR-|9Tw9FF0j_cp*pBdJHN?JuF}7vsx6s`o~ps2GYbmtDtHN z5VVUiWm~H4?Wd@#GyL{lSxv8hALDxMnO@aC>-p#AjvRr=Dg2CV3ZC7I<;zG_z|3Jo zn|@c{l$Ii6#rmM$h@8SF&>Y#MJb*O0IMvZ*{DVL0(3Y=3?%aA<+>``7@d7_D)((!>9_1^wp&Q2(%YXKnnIth) zipXM7FH6&uCx3a0fPyBdJ_A$>^awC+psrK$-*dc@w zQjy7*roZ-&@HmgyVe(x@tvq(@uxL=bq@A#_sT+$Wx2+a1{vW~h!>BU z=stUjbdLSkCl%<{87~-4K0az|tw8|W%55Ne9HR8eNHQI*B<(<*=-5x?Fr zu=@NNgZ1Bui3QdVygLFTW<;K9<==YOMH26Ul6SnExVSXXycHE5f(M52;1DR*zFY2^ zhOIvBC?``i6ff|dig|yUVSGQ|r?#BStyNpcT`@Fjh1Z?8g-{oJSri8u4Mm1cT-wj& zg2?z{^`TBAt6e0(oh1=o_B7cyL@gq7bRq|Yg){9?O3J?QCTeI-R1?5 zXP5M1_-k_)=gR!Ty z)ieMd;VAF830mlk2dy6IZk3C4S$R%`>v|JE8tL0=)-aE-fO@(PGi9nZGGuOn+jUU$ zAkIE`#&ifSq_ur}=RkQxHwo<&B~E<_Seo=KALZSjDJ9ezvz2=cvs9)J%%Z+VG$;47 z0TFVI`zVI0D$quUoHjF_>vyO~qRd@Tb>OTn5 z>B5T~pi>V$8KvPR>B&M+MePRLj*B{T$KkJ+f~ZG3Oo?G|?{B^_)SIPw;G{@;QZ7?#4%#igZqMt9N*&rVkvX{ zj`-8Wav`pkIClFHgjVlVaOp;r?|R+M&jU$UDzUiqTtO_~hzv-=m2kYv1RmJA+|-4o z3I1n#tNPFxlfJITgcG-JX@JlpxQEQ)C|3}Y;YN)hEJRyuyL|niEb`^`(GeIaTE7jF030H6w(KbdUy0b%(~fJfH(heOanJP zN>8u>ZV+uD?&#liQM@ozS^VXxnj25dUbp5HEHo5X4e^6$Gd9772P6x~Sa=o&K|90p zExtNtUC(2=20bIKb(IroBE|y*>NlHA6(<3(9cq@BE!ZP=9}9o{X76BJKfWGakqFseSHZ z@&-@cOohhS=9#y`Xr&)GfTn0VNq(OXw~3G^()}z0H{f?bp{hoe%amRLUmyw_b-%A{?bbJ^=p6bzaJ5fd=2A0WR8Zi3O`GBXS*VRmofh1W!ECz zL7nTKbYgMmCQxfCMT;cQ48pjbpb9QBoR?^Y*pwn5B(8+0HT9^2d}}YR9v1Ak{XDess?EU)d(mMP91J?5+iwh5i~mh7~yZA@yY0*w)5eq#7_IkJxf~W6S#uReufR0zr%w9JeVM3#0cQmr$Mn$ zO-;+!c8QNxWA_y;>vYi;mP%cQchVbm5u{Q|JL3}m_zYkvu}a?TkISw{VJt#&GSJ}; z8)yq1Gf-$tob^bSpw~m(qLY~7DhR@;;9^NrUug$z&W1kQ9&eP_HyUl+>>(WwquspK zv_+VlBde=Ub-s1 z^9yNNX3;}jH1fDT1&L!i=Y;)A1hNhyd%ny4YskFoi+NUVCqs9k2BIubEs*wnxi0p$ zmcO6Aq11Q?8hd%%@yYfNrZB9D>IP*v_D56y~X4_2>l>(8+N)bD*pNc`bEYV z4HX)wwob~R?76B{nyvm@9PKYW3`rlv$SIIZCOCst;=DblTwR?f2fl>uPd7tNcrE9j zfEvRkF4@8jtTatPD^Dzc@$xi>t&zvE#vuM;V8xcUr5QeVA)uR&zM8#*kx`Sv^4ZAJq6zP_^*D?*M{i#arT~JvfMUVzE-@Mle zUZF{KeJcn&P|I5A5}8Mulnn<{isFFqjXyIdaczG*M-%Cmuq5GH{43KY)mz*fxJss?=S%Wm0+?H z!?>l|1y$6xcfJ}2NVnAHyA?Qi^fw&PW*Vn#=K{eT5g||OKHz2$WUgTL6&X$9-@d2S z8RzEynXu;J=05q$(k#$_!T7)3>R0b=3BTO3-oAI)DIjob8?HR^>&9qhnK>RrP+?dd zv&LGYSRE+G2^k+7-x8Co|RQKs9-5HDJHfVP%zH7u*2+hqU~up(Q*3l&hp$lAB?ZsfQGGv z$WI!ooc!;xpvO4&C92%D8=KT;zCvk|E|7@hI0tHNl^mc`O9+3I*?D(uvnH*1_Jq)v zzX1EntW2DlbWh+BX-8pe)Dpwx{IZtrDRef=rrDbUH3Kbq#_Y7AbSF@;$)jANpvKPJ zv^~!=#7?&`k4<>W+J#eqnR+aNAmbB&DQRrX65IZ>*bamqNSoX?S> z-@|-wIF0DOVM3e72haMo2Jjpso}N32EwUBmrLJ81OAFD`-a#^;t%v|hllS}n9#B)*Yw!^83t8-nL)ve`)5SI2t=th$+M)P-9e*a`J zT%qj!E7kq`an&~UOrAoPFCK|KT>2=6V0R^Q<5tI5&8seBC^2SI@--hQ;UjiWIVgEN&t!U^(KV6^KfY_fCT<@PWY7ZoBJ4^d5W{F;y_kEXz3+gk@#&5cQ=Td z2fzM)wVvi;LoRP@yjZo>PTzN@A6MX)-^fW?So(}x!|&*l`M;YG(9SCfVgaDD5M=Iq zN+3LNx;jNkfpOAFW!5!67!*}Cuuf_Ys^T>LZ9j+HILB|wA&B43XM|BV!b_4LVak+uh zZ&}}j_mEI^4b}3fZ(>48cGdTH^+=(FC1PJUGxCI)vsQ|_t~^J$yK5OA`w!@woJZo& zRfetGT$CoDB;w+~;YK*vpucWRr;Hs-M^Bi#g`_ZC)ba}%r|#TK?Zq#%>*1Jn*Ot#R zj198u2fiPDzG|ExxJ~Pi8yTXsS8{$H3=7Kxm1Yy4rJ#5Ct(40Ab>ThP-~GIVhliQt z!os`UQ==CkgS6Gj+;5TnaV1sMAM}mIg(ko0$)JK3>`^x8)j^ZRdzh~PbKm6OoW7e8 z#YAU{hS z)xp(@hoJEpipKASxI6s`8X<1&hzdWe19X6Fr{A(Zvz^X#U^PFl|If7Exn2|;tP6>I z$|@#ks3QY9mBID4F}A30Hiy zm}8KN_o~r=pOOg(ld`%GEfGDL@DK_z`}a>tK+C9UWvBB}{3Aj|S3n>fhkZlMdIrCE z0S>BO)n&>R#Ia3>Zos3B>%wmQPL6sEhi|f!_jVs7E>Z&Nx90!5q@$p9F9HKxrVHB0 zJOXg5>q;bAhS_cY=lXG7pi*_g9?|YFF9(Y|oBeb{urBP9SItSOfflE0D?(Nj=5xHE zi9q2}EGn1d2y*BCFYm$^BgmXX7aB>KtODJbG;Pw~f2MsnNdq&HCA`pfcJucX5?But z4+0>+?(SLX{`D{7_otcrnr#YNtS{N#Sn!Jr={W)@!UK9cG2i?_&nOn%y`H$8?itL- ztJ4yj8OPx$q`8=X1^^0A=H_Ku-C5vv+C^|i5)d9)?`fvGd<}MwlA~3k$1N(DN7x{& z4w`bxh7Em!2T=0?!)MMc%)emgTMJHhq%qcB_)3^gG?z22UzrvN@AOEf0wkFMmu0er z4`MKdKpbY5+coGM0@-@~_-06(xeTb0@QJdJ(%KzmPe`Rra;}FOXxTZNUB-bn%|ttV zjjpaxNwoG^y{mBmCHeTG3qeccD1lh^u2KZRY#+zVMeC9%=8*~Y5pO3i;rV+72|n0`FC7?ly#7H6Kw@?0lIyuURNPdl^=@sTg0jg-gO9L=1-} zCVnEL4*EqN=*k|p#~Kie5dOO~c{8Obp86$PTsn}CHp;gGUmS5I1E?-E2@oE9+No|V zG2)xL!6?1Aq6KIeMk@1SidR2^$6;oi>`a;54Bq>dS$@$)d@GLB zon(1?^qjfm+rMTro9eTsH@kVNj#MyR*^#>PD3h(hs_@zTSO9gweRIen2#E+?p_ghp z=Z%b{7Y@&ub*{)4&ffj;A#%5D(;@K}7w_>^Gl(nX?xJ@H7Q=vnQc#bAul_l)osv+% z70jlHg(ySjX1 z4=gj!bSHlDSIO2^8qvFen)CCi{o)=ZF{~C3ZFS{5*jRVO!3I&oCUVl#?YOTv}V@cbTyF|D?2ac~DMdWoF^c%Z4 zmKL8dX1&KDCqJ$pl%>6ukU3_l2OATqx2ia^FctK=xb>@L`)@eQcbL1k(fhd%V0IPb z@-_u@3fcIr8uo?gw|%%PBg1wN{kz|NOQ()K7l0TPv60LK^(we0m;6lxO5*PcX|Cq^ zPglpgr3yWhQ?i6KG)owSDxnJeylcPs;W+2N+bvoCGuv*5RjVHPhIJK)!Qaw82x9JO z-TgFW(uZL=)4{uBS+K^|5vW-4J1@rZA?t_&^yS!&y!5g znQA8;W#;HsyXz^KJDyf4WVeHj4)tg%O40Ba=e3EVvnk#(%UjSW?C?dV;u+g?;%D?6 z@`*22hB7E*^2WofyKAErb!LT3pm+!B%MT7x+e#kPD zW|3A&?At~Rgl$FI@DA44yf*OKy3R-_J8u>)&|`G#cm;`kz1S@q9LsIOzq%{f=jf$t zcJi6$TGH0yAE~21fh1~H<{opx%+oF=64sH zU1#>mv-#2O03TE^TYST7ZztM_3;nmQF%pXIftITnDOl8S&=HU%jodyU_spR9^GRN% zSyd9MTh#>)ek|Wb*GE0#SV*x-uL?0=e^UZ~J(S#jqw_&PrM>cb*nQ^@CVk8*KAS-4 zBnv8HDV;ho`*&>OfDyR{Evb!OTju#FnB}(83=eU`VV)qpYjf{Lb^KH%Kw@{Ct`xGF ziUzUkBJK#Y>UNoz9b9X3In6CNY$OJ1R(DNBgG-J(F*b9d2g! z`Szoil~O7hDh82L+WqahH{kC-Iib%Mv5eVok~)!N6KTe6GB08*7;K|NuR)!#(ULWB zt5K>{$*~&2VobF_A79q=2?0T@4go@tJzin>cOB}yt{v2=O(+!C+TF}4EH=YN&uTCx z`4Z|b=F>hR>#Nh#QS>EJ8hTpV^c2$vVK{wPfuie5kK<;3B+^R|)qpypx0wF^QxUhB zcH-@wp9tuBjlaqiq%L7#A}sy%Uvt&<%EhtTY)iyGgtM+$@K(Z_lP*}a1Ofc*0>t0N zEG9kpix$Es*x`;ughc;O8$;H))YQu-PQfbjK`@)BGZ+|>Kc%szqZO#iKtDH}tm~A| z-Zg%=8sR7{_u1%gQ+tD@)~v-GF& zTvtV>nW5U4xyKcT(&ed`|5EL6*_&-$)cZO4Hq#TlP?<%p4x+Q}U-KR6wODdq;)b%k zX3-haqPNA(Ad5K%cJ$=T^f}0rl7ibU0g9FUWv~tMyw^6eCiF^i(3m^PgdhuUAXve4 zXh7JWi>H{ls73o!xbcNNqnHwR}+9L;rY{KG(o?Y~$Is9U#psQC7iD_bUz#}z|~Px56o6}`}O?XJ#bax!+)p8Ns((DKW8sj{3z z?nQwQfg45(!(z% zWV_>DBd!d#Rqe!f5y#kfj-GjtIu)kWh--#PChAQpRTYK?+JO405c-L5;Kch+3u{5Q z*D2~PPrP$pCrhZtxc890+fkzb!#|gYocH#u)S$@|))}5U2vvhR!9;eQ#I}N3l1^g2 zA+OY_i$!N-kFO3+-nCkCw zEooBvF2qkJD()5{3uGgUnR_KaPX8yp-sArDf&wh-+17ZsnLyS0YxWeL#y2XAtv8hG zj1wD2Dk2lsK5_vGtm|j~Qi}VRmF#cnA?rWNcc+tU(Jv`0_Xg$HA_tN(BWZ7jEN3h2 zWGE{XY?h77nt9i<#}0LNrdp1V2rIvHXptPuh2s)76d``Q=ELtzc&y4uu%8q#`nNcJ zCpl)4YJ_yblhkTGFS8QOnWsiBCW#!XsHcXCFZuk^#NxJ7n&BR`bvvWZT9fg(N>xSE zf?cuP-SlCrD`N?M#6Av+4`jzeHCT4UR|F`iB@Bn{nL~ULsWPd!sSO#dsHpu7=FW0h z{bfX#6vK&9aN5jwSyQResq|!r|21q9_Q2qh{czUGM^BzUb@}b8vC%AiAJ^hgJ*?(}xUDce@fc^VO3qfSk+nO`PQp}(FiQ7H~jjW;V4 za!VE2b{glN0<4+6WmcWj9#cA`i!mk-E_2&6rYrTS$GCI~r6M!e0 zIQ7at@fA!mDiMDYdrxSPVpBrmcfyGza_Fo&i1om(&8FOOL3xfBnI~Uj31xTe%14EX z<+?Tw&RXV{HV#_9D*^-{)UwMV31a~sEJ0N}B(>pI-(z5I6Cv)u3U_zEO)h+uqPhPA ziXHB3A=|htZko;M%}ZnVUYNYIV;S>pW{z0nLW$~2EI&48f`VuCnlr~oOUts-M|d(` z83R8Rm|vL4v>KB{25DMaeVQy7QH?;C-Ka*?DAY8*-uu4(ne3Oz-5?$_2ZF4%SirAh z`dA<8D&7o!p)?GWfTh?;!K0WazJ>I35PxY|^g`~@H>`k&Q_iG~P*ttb6C$8S!|^ED zh4KX2UdQDZW}L8?+v*p_cdwa4BYn{9o3 z>Xvh7)SU8g;$WGwWMO-)&q8zH68e&6_F|&~KG6K7OQe2RGH`^K6V1l@ywzqAWxslx zB14vn{u8{k`k#Q!iob?4R%_Us`73ll)^xqn}R|*D-9AV%IG3Sp! z?%XsQefs`-(^5z;1pn5l;hdv`6}73!7_80Dk`6iiu_AVLMwNmAr(!R|!JiKe{kOa8 zd;}^7@y8d45AmN_^P19!cJJ!OxXO$vFBZv=68h9rm_|^*Eo6SB-KH(^|G5bCwvne} z8ZJZ3Ttwy<$qT0swsx2>w6UflRDDN-4ZvC7O_2@Pgq4%$I8IH~yjrc3QH`5pqudKt ztjc}8x5lbU?nr7F6rGaYw8a4EOAEG?nVslfPx;K)ChGm>-HrH1#I7%sC^$&1HSBj{ z6MMDrQ1?|?96mFw#B)Ku`Gk%E6FegeBd8NXQ!`6mcW6*<;INk)eF?r4uQ;!_!`}TL2R1dcqJ&wrFg4aDBqxYW>KOPvr&~hiW`y ztG_zBslB7kFZsAQ0^u<(0Szq&JJAWaiq;!9tA7z;lagZt$xgyIrunoJZav|+^4j~6 zglb&^d7dD)(~?|Ev}%?_>E@HT0(;xep@MU*LcHTAn$4g^`pFiz#rGIL(eV2X!dmNG*MexMN(GP;iSdg4vBceR{^*`f|aKH^zq=JY_rtVMh3Z&|9x|jfZ&XFPe`m`z?<$lh6)R^A z-uE+u2M!YZYMawL&gDkBlRrj344GcIu=9C(h&{vA+uMUO5msV3Hk3PxC`>^Nzk?`| zW)v0W8miza3CWIofGL0o0rvf$-s$l>6qbCU)r@zy_)AAF( z^mf`haX00qzG%5;vA=;>pUkk!nTz!Y1~g;!tV1p%t4P?g=N$+a_v5_`>b{YuB?@ZA z)D8KI0So%$W_XFWQ?JvnS3`cfrj2h#M!W(61&C8q|MSQL>Hh)jGjIDZ(EHLmW3J^g zPOo&x3HR~A6ZYw#{}t`TTgST}TSevtjSb~v65=o~YIJDJ`xwi6A=^`uuswpNc1uQt zE;$JHbw~n0-i1p;*%%n|FMQc9#X2}bK zH*vZ}qE3@T$)`6KzT0W9Q^IXNPwYJEs9`>)kt04wDq6AtRGx1vw26h-r<6Lxllf{u zjZqr^ekSV<441=WA+#V5fM#Rv>%Ntx0RWPS-6&v)rl;Uf-!HcUB=)eQOE!5vSn^Y% z0pP|f3(<1|Se@J|`kDYLFtPirEQrBpu#AaDJD)~AXqwI$R+~_5mt^dV9IyqaT`oig z>G^CRRxuO1net)40(@ZaFmk~hAeSBdsJmlD#p|k}0!l|xyZnLHWlaw+R15!-0XtC; zl)D?G!KNJWdPJ_kx%EZ`>5dX4Ji}15Jhe>a#maQxptVvdK=O)pjjvmHk8`p23a4$H zeU^*#YHA89*R`e779G|^*FN7Z$=`V-%f&4?PqZZWRj>5JO{cDjI#=72AlNtkTBan^Q0Eg%ZP4_B9*IAwE} z`MUtVBeuGIIkL3L4^tRF;{0L?qU?-iU#NG808^9G!aELVCEl-B41>5K_&fuXe4FcB zC2=EOCFg0qAz+pGm44` zFDE*T(m3B^lrGk*p}U-rIpJp1;e(U|e}9+(o^HId*46X5y={{4|1!Yh60g*<_ER>U zqKrk5E!9U)Hj+k7=DbU*n~rMKB2;zCGQ^2pLAO!&N?@B5MBz&fCjF~%r(?WH!$ua# zb7_G7b1bD`o&p8n1kSAe`RTuA$mHmUy?xibOV5eayZ;UE0p}3mFCOK?-x!L7vPp6e=Wk0iUNRKfu zJ&S?Hw%-J;l;8P5hdsj=r!eR3*5%}_BSgqU2?u;By^@sQt<#DdvV*W^ZIVAeAGi(w zt4!p`5w13O8u0tSSBd<|r>C6?%T43FgBA;I0yiV*_emH>vd44Kc)}s_iNg*BBi*U(=wmFoHT1L}O1)emQ zK8rSJuq5FC(>!t*naj7G<6;W{3K4?E$9LBInZUlhRHD)gF-*LHX}v{Aa2U?g<<|4; z?UXA3Dw@xPZXBO>(yg7XPFXIVvdb>HHtT>LW_}t&$vZ?W_i9NG&%4}~#9tZM-9E8S zlL4?Bd3$4h>0aSWgLSEx$B0YMua1{St_a%4HL?fGT5VO=PL+)#>Mc(XJM#XLGEo;y zMo>heE=6SDVo3+W!Ry|)@kUW^t~ zY%boGym|4roJ*Ry@lJ@gx&3+R)Z;P>pc>Hh!S3y1xgiaBp~|V8?`5{&O)WHKdm1UL zcZU{oUb_+?iTU1*^HMdJ?d{23+*Sh{K=4+(%S%l7{>=GGPP^y%A->jrA zY4RowTpX50Es%Fdgk{{DfAfs{90b`!_E?vQ!l)I9V%_&{7aM^@j@73x1jg?#YM8D> zLldec?f6_tJs<>ysLZKvtFq2<$SFc$ymw0+>cso`pz4L4?$t8`L}?xczw4_^$A z_J=3tLvy1}Qt<*O06cgvq*J{XPG4Leh5rf`lWkI@KE_Ljj-s9fodp)^`sc;mx^StQ zc_WO*v)Vwp>vjnnJ)(C9I4XEb@;}M#_?s#2i4ZL&28rLK`yv4e_fJtXPd*e zx>Tn0Sj#9uzV^Zro2hU{1_tO0(gVQ?w&YKQ2BqdQwK%3$ohm%a-(c|kaHEj4jWpwl ztjJi)vGLr{y^eca+@{KBP_4+kdv-HscRJnXd$zjr6-2Z2;=+9bCwoCL@vUnAU#J1L zVje3G#I-2y(M91I4z?j;7hUlJvU7n$ptLEljYxcGSiahH?dXy6ONT?P7~8(s05PaD z9TXTUkfWWO2qceE4;?gN+TK&)_sJpHY56>K9w-p={3JvWpY zvM``c?F(@$2$>ns?)vE*S`p}&f$lN6`<|5`qxvMWz&m2j*yTgG=y7n&&;#RiFT{Tb z17Rh*KmAMm#9J%>oJxvbYI3c)f!ry<@BM#lT?JTF+uBx9FaVKmgYNF~sGxL7gGhHb z3?L#PE!`zC(%mIBG)Q+zGc*hx{~A5#-t(V(_T#gk!5N0V*Z$)D-uGK;9ea&b!<8Rp zg3WT2$^M~@z(;>;Bje*!WWPHIitzcwN1lw@!u{R*X=9G`rS_er&66a8g9(5G!k6U$ z9^y*ZANX1j1Wns6yB`;&k+nob(a$LAAfsKlZr_}$IC*Rjh?AJ3Lr}%h)%E|8Jfz4a z9qs+Dq|r*)rK#zo!Q@c}h)=#HuZXmP?NdM=U>xtqZDw7KsmkioDJb zw>P}Ns#L{S7v8FRfimI+sa0Jy*Sa+B&LbP4o}}Va?Mse)B>*1W#*oYTC2d%J_umA z9iTodo*htvUk39C(|~-`JG0(;4DW^_Y4NSi{xyJ6U9IxIjZ{Wm_URR&*Iy8dHx_rj@(7!%vAkg%(DV0MS)GaU9Wg4H`Wr z8*RGAAw__l*#2p_mRpYnzoj)B_9{aWzdSQ~XU~fK7ga30oJc&dpBsRD!26T@ z<}mQUXrW#Oqmp(jIbrWem<}fpzu(i~&izrml$nCKY(lk(4HB`0MHZ z@ytD=4#sxy_e#{u>pxcNuC^7u&zwuLl(rwbi|HrLHoP5WaC1Eb!lA_s&lbtnX1A%N zlURSSJ=|wz2CNe@5?ZKiuUnTBXZmft;G##?vKwBVG_%o3eeK>AF;yEWOLN_`G?+Yi zwSO~H;{7jHig9s2ai~(bf}dmgtqEa4(y0Hq1P2}zq*Bwg!(7?3E}HZBJ7D+h=l|q# z41xv@C|KYuBBwQ7z2SXQo_Xz+!XxXy=gydYiU3i@GOn#HnXRjWNKWEZOv9CZa&X9X z8UBjy$KIZ;M*B{g0>|JhI;lEOW(%;pY;|g}QIO@5qb^M_6DMNQSo|FAK%)Ha-kU+7 zOBRxDjHN($p$}Mr1WhTJ1 zULr*pSF(B|j)t*)!B0#tjKD=b{5sAL_=_{x>tY!#ryQ;wtQV#ZWNi-0?QP0{@Z8ZV zJ}W&2szhSmaw~9mg?}`Esg5N#Ql;8ME{y*|4x*zb*&TLhus6aC=ECVjYDx(MvHi?76U&cpsEnMk~lxH3{ia-^|%mP&2 z%iB)^3>xwgc_;A3(>ATMBmy2#s?SVLM!eh3uQxn_b(9fu7Ac2BU4nbzxf3?jrnXM< z_!U3b`moe2PaCm8(%T$?db`dIH={g5GcitpVO5DPT>tE4{rynB*Hl=|fAGDZfb6oJ zlQ)lG+5IKpnVa{ChdHPhRO(Tl&boH|m=+0hF#Xi2vVWEw`L0PxLTsf_v@jr8wJ?Qc zU7hYtHMEKx^6+_ug{X`wBpSQ-ndis$mI9ymqqksBnJwj?n?vX&ok^Bh;KT)Z z0TBF^_wRjWWK_9igeQLG*5&SFx)Y+T!Bln@sQ92p`97$g1^WpR`tFy0Ean4Q1;a)j z(W#C0{rK?Wt0kbk)nD7a6(KL|sL9+_3_nrC7E;r0wEm{;d6DpN{ovfStP3Nzc7>>u z^5jcf-%QK_!1_hXqRR2K{PlbrhqDHfC&u0hh2n)NrLLYmIjW21C^xKGM%N14e%sKW z=O@(!j_%tlTgQL8iKPy9q=stFnHn7k_Yw`89sE$*id^1-aNu-m#v7g&3mN!u`Jd;P zZv7bRKoT*zF5S7~^tcbgVT(*vjpwgd5!x3cRRwr0ulArBf)s$LIc&U!-E=>FpJJO` z9)nWKtX9;;LoIKN6oV*A0Oi9^R%?zp@=;Z09!SXuCkqxiKJR}!v4OBF7EZJ_{giux zigM$<_y2IuQ#{Vk6KX3Z!eunwRf>ZJ{sLQXPP$4x1wbvS zrGaV|_KLn!qW74ESmP;$6L)k_* zB>-YX8Fu5rBxw>84J)zhmbvNl_6kS3#lrmi^5!wuK}6yWMoVsHW|jbjoM)>#xvqX4 zdDsWL|IFRBY0_1rYj=8L(2{v?Z+!dO(O`Bx|3R^gc4dHaqvV4d-+g~o4gY;6-+irt zT=fenW1NFsQCG+&mdy5Nq`Ho)`l0ZA{VLH7o&oB<(8969M)HKgoy&F6%kD~QMCV&+ z9f(zKhSjS`a^gPtabuCRz!^IOC!*_fzP?6XADz|dFBcaZ{hX0bkmO-at(-rxl5|R6 z`ZO`l{%nCSx7bAnEK1_!{f|NoW5GwOaJuet_P>ZR`XpJ+QNGwt(u?5YEl`G{#2Yqg zKPPqdIx898`-zAO$HC!8q-;yIuxPo{yGDSCFk5A^c?vymoSo)3DZ$;y z52U(mni@l#&sBZ(Jgd)jbuas7yST0WQZHz*VSq(&x{$!>_#4k^;r#G1wXIA(u>nzk z#3LjI-hGdJLJ6ySOx*lJ_xRiR)|WnwJQVg>j-OlRcg!lH zTqYv2TV)M&P#`RQj!^aqDqMKMzjxK!k)s-_3<>#9x5h=B9j6*5V)b#q8KgLFO|`-3 zFfh~{h14YhQXpJ$=PBYSw=-)RJBMopoYV<8^ebB4kit04@&bFg#aOxZ96`?Cy>trH`B1%zaa|*n!I)f{+C#M zzxzTeMO@|tYQLq3jDzkkuqXCKbh{vH8E@X>D!i=AerjE5Ty@3u&K);H~6>I7O3fOZlz93>1&bb0Z? zkOn~LnHVU(`+7+drZ}t{qS^J?1FQk){G&%1@Fn?u{i@}sQMXCH*bVBotX<|R3vd(F z*YQjsz^sCQPH#hTu{mBn3|92aF_jx=9~1d8H1*KQl@d7|&uNI#A+D#Q&|*8&vTAj{ z&q;m#oQH_eRgG=<^q^iIO+BCX6b@=+o?Q;AvR!#p;H$R2?D5Yr!8GEM3u#uKCEs3G zI{(2JSe;)GYDZCBq5MMMo&GJE`9-y)I#!&F+lgT z-_sKfFRKjK)DPue` zm)Vr-Ys);pW!>*6eQ)S9+?gtuhSjsHr7~6>1t}a1Aa|I)vcly@d5GyV0LN1S+&2+_ zBMcwD7to8#5vpR_6oq-XbB;U+D*;wB3YW@7rA3% zV5V>#=y<@m9JOn4)t6N1CLG6rAr)LRNv9fv=j*O~pnu41FE_>WoA$e0^${lGFeUvM z&m=dyhM>_|q?n`11nfVFuv9(I$rU?~3#4yO_~8tw17|4c4Aeb)Z-VJ#F@k^2a3q>UpmLdBPCiaBp$6DTxFyxR>(~c_`G>_FkV3jK|eMI}}u@U+ffOcWwC72FuO} ztlo_^^7Cgt07=B6HQDhH%r%h3Z!-1U5l7LYTgHYZCfeorRTzBB5s3-kp$cV3f)JHH zJ}r$hSH0m4*G{^U@S%DOfASa$EsK%ouAbBD-nqZ<^7M1?EU%S=i?XS&`lV}l?Xp#cL#Y}=?^xp1 zhJ8kL*WfXbVy%rxc6iE>58*!txiQO*hf+9htCxrER{ft1iEFep4n}p+4~(C|K@Xh& zLpVu#gXYGpp@w%2douDSNCC5HQbKBMUs2o@!DI!JVemk>OpwZwCOoPQbXIn^BGht~(N>?w5aN+Wkf!=y^(2xK@ z{zlV%Ex!sJ`Q{qzw!vyTs1vi=NPHq-u%ci71I_yG|4iO8Ao~`C*a_s+`mP zo_&MpasH^uyR<|U4w*ukJmX!7pc@WU{2vG3m4r)U2}t9j1ha6fxRi{})~Jpi_u=EU zcH-kdo*2pR-+?QAoE?m3fQSwTeo-4fF1Wf)C1Bw{vyTxYGd&TZoOTcR~&2 zl3AkG8@_<^NJ=uH)hRVrib^O3HPYxqmdHcU9mjOM(|Japae2-<(e;f}!|$`@$mhHl zwfi)Nz{w`;_kYM2lhb`x?=LQ=N&huzyvU2|1xU|BvatMU<{{-3_1;cO!9n6Gr5nSsBi>=7F)EELU~nXTvx9x@J$2Ql_Ax zz;Ib*e(aQsDkD-JovyC109D ze0~MNEzlDcGMiWDP{+Rts*US;AEvXY*Jx$wEa`8XKLk6->;x+v4!lwd(-L^#oD|U~ zGloD!9ME%5KG2=X-KrGi&Fq}iC*JP=7yz)8qRi={It+APVc;qF z&v}A7hxPBbgH0P zeN*b?L5gseQO1i&76*q4F!b zxwSOmT=JpFh_HyT`sE#xslj1ML;5u0fh4_~$!x@%5_Bnh(ZPwovfPjXXmEqY=jWyD zpsOathYg&oBsp5zPV#iLaoo63`AfCMQtl};vZR$2MhU_#3%h5NOpJhWg8cRKrx0|`L(kJQ?7HRWu>VfgW9p2D#s zxuEkj8-B%@g6t~Z&STNbnAMbcEmq?IxKYrJeRz~v0(zH5XoeiL63ueRC!;%=^njz9 zxa)YPTzM04!^4;UkwuMQ$HUVug#Z8ysjsYlDH4BK<9A=sHP;WnG;0S;5^Q#K4zfA+r)ZI? zSaGNyDKj!s*YeeX2J|-fD!&9x&$QxQZErSuPd7SUa!`vm-QRtgj@Uyi9Wjemy1WNN z>moK0DX%iAs4bk?J7a?ElFkrGF9`Bf37rVaLz2884{&N>;>@vp&cini>*`g_odzN# z9!YV?yMndg2UGyndX0EK7oSm+T~G19fml^MYrYb$FRFcQ1cd`0c)$;bON$8=G>U+t z!}OE#ADj9~5j#Z7ipks#nMj2Q>V$i^BgmEtni&if!I1H-E+s~kE8CDVgye6O$2Zi` zq&GJOIUZ$|RnO;sIf@RZpwbDlJT>P%6)C+xM+5RD^&|!>>|gsrd_WryX~<)5pjpSf0|LAQXp=9?r%9(|BG3yG z*bQc5 z5HDQ11tS@<-IKBg`yv%U9?jN|daLgSSL>w$BL8ss=p$0F9v5E>lm;eh3MtOk6;fsj z!fX50t|<$;IP(CeLN;0TSYWzR#N)Q_^;#Y#$pLya(M`+GOt1l>2!I$37ZKR*XsS${1LS%(#Ss2?lZG`ozozB88E&vOJHm2JPP~(Vx z7@RaOuR6fqrf+>OU?`gWKB&*${1djz5s9Q5ISCe4vNWdo4=QP?)n&|Fy8YSdlZpc7 zE_7wp8yx%R4~_UdmyuD}7yWjQW_LEw7M^p=yQr?8q*!j^U|3V&c?J8#%)*H~F?wtV zBz}_ye3Ke%M@D8P6ZOmELfJJRt(nQ`h-f2aD;t~QM}=Jn_I)$c&8%-rCy@VeMH#MC zkG+jDdhcj!Pt1W;V!9bh!Vy$@FZn1s3B|<>@%r%qroXgy=`*p1(W@?x8VoYXvCELW zHcn!`yxyEKG1oHkSUugD*cRKjg}yRPXY5wa)|~BfjEc!A8PdwmX%&Y)vJa2H9q|Wi zu-FH%Fs=tr;b1Jm9|Wik9)sH{>EHO!8p7g|V%K-gNZ^X;b=^M{-92<)4*SugYC}ZhMZo8O9@8-L zoy#u7u@!oqdb`A{Uq?oA4Y4BUZSsa%TRRhTMsGW%AT`YV?2)h#u(d^>=|J&lIAOOY z-HOkHg9~U1<_{i4H|Ov>S%GYeK1G%b;ziS{7c0-bJgcjo7n_1zsm9E*aOHz}j2@?; zOP7o)WWS9~NYJyi4ACuip7Nz}kB0MR2>PKv%Bp*#5a0gEfc2jFLOHnLM-!$|gv|Y_ zzAKeRo@Tv?oTW7fL5%9m(j@fq^$f`OiMI0^`~LTqAk8rkujrqzZ!r{(6(he09NCq9 zS-5mo%gV%hIt|zyiUF+fHC9U*H+yc>+p}E@Qk4m&=6qZVOCs0ZcdwUQX(dO9!y^jV z@w1|JVfZcaw_+;d?=;xyM*6>~+OrrhKY+}V(6g6dSxmB#=+WZdmy(q&Eh>6W=&M0| zqZ~&y;(ar=xQkbY!uM8^M#E>|KyWq~ucxpvM(%8$CJf7Fn-V4a4T#R@fwyjW)IY%b zeU*PZPtd2#*@^VV;p5XE)Y&X61#wk{Ts7Juzw6nv+5xYX4+nHH3XyrdFjdKG^Qa@= z8~s`WSe-V}?S~baM2Wd2U-Ig<)LUUCZ|ln~rUPDZEnE&fV}S_vv-kz}MCpCaIP#t5 zE$)eoZiyHzo{Sa{kzYB7W}O~uPrj73Go67Gw ze{9BNL#mklmNrU)P;dL>M+S-N1446B-Je)+sI{V+^(B0c2i!+k5^Q|A8WPU?%73}% zvyQc6Oz$Fh$H8|8GEzU;o@2(*k8EEk9eY`aW=!pycK3LvM+!Rbg5SF|qy2r4e>*!d z_9L7RzvEnVx214sCoeY-`;o%WAobn9A8r^w?{qYEjBQ%gKB3;izP%5cD{)6&I()@i z!`BHdM)ljY`iVRpCpycg>A4|m$tktaHi@3L_50A*0f}S`Y`iK46}XD%81Qw)5bPFn zI-Rdr`Gm>(#atFc>fGhx{1S}U{TdOQW-@yM$K?Y9Si^PO9WSEn7O8+?D76zkpz(`7 znY*(2qJ3DoUwd4+_g)qyF16yxs#%lxvTYotI4f*eb1}(~kJI!Nl~o?kOjncT`Cw$$Pk$T9N>f9f%5CT3&hN8Tv= z2nP;gY)ki3o4LpC8&~h@@rtF3+gK}1Ap|{e`O}0#Ppd-futLW?B&xXWGx$-8&ai=0 zF?ek53n|QZ!nS!>;g!DfJJ0tOUF{JDm=zf|%4-MAKKC9=MG|RI6dBix;lH@*S7|5I zKtHWKF1M34@{Mdf<08?zds;{Xb*Z*W%Q^sm>ak2@95bxWCG)$t5Qd-~Wq&#v313k& z8;$sja`jAwY%I}7;*?|;hkA*yR`AW1 z2MfNpJ{QpW_$pFRHJrnE>n%+7iBgCqPa<1Ybx~ld&H8+T+1MoXVQIKT(K+{gOq(Hm zS%k#Oor3C$T-?Cd4FlK~h?^9FxkFZ?huOfm`)nDodNSwu-7e$ z2MHvp`d$Z%23J7noF!tkRdI{&^PSIXQh|Z5Gz3piz*`c%N6BnfR#&GEi>(@WZ{by( z6Y7J*3IpJQE88LHe(FPqoX|D%-A)%&9HngKT(B8AQ}C8}xEv#XTtY%^L!<;%Gb?4l zvz!rndE7_sY%oH|9L?QZAD=vl=+yMIu(Zr7FOM1>RgRC3e*+!T(5T`XZ+$O)i@Iq~ zu{$tb%mze=34T~J@Q}gCh31Uq{W6`L_xCU;{i%vE{napK&&rZ;RLc}^d$n9$5@C|} z{Fwf^=z>}BpiiPRhtZFoZ**{c&1Pwv@%&*%Tw+kwu6$T?_{Y~bR|0nTKHZ804uYFX z`L{>+`=wJE#n$VIq2b5G2WgM;-GMW6anK1mS!J$wXqh!7uyc&pohV%xJV~X8r}fv=*Y= z{WL8R^jx=JOXKN*MZCXvHc?HI++uGC^epeMj8_d9`IN0IMa8Z$XlvCT|6zFc`8|?_gM+?1e zrrhw@N)%VLr?;0)Sh%mX^>%4#DI+6eQB~EOG&!)q4n5vaUh06a@C9-4aLtEuH5Hl< z6eKbgI5|1L^skzjntsjB_J;_|nwf!4v!uhr!yjO(41JV(`BRUVc}=hINF(Mc*(|>_ z+0-v@yMo~flm4Pgm{gfa#Fj`V9ZRb!@$@auH!&=Cdd|0hh?g6iAoy%4U#l2Br-m<7 zW0niA@rHOWet`2kC$}`XGxzoiU&ctHzsvq&-uw2ff=#>lP+9|9FQz{i_!@KO4XR&H z;P0pEMfdgjh>MofYZ*FvTgMCBhdXY0vsC`SV9y&eQd8-${;HlBmB&stHO=lbe8i^c za<{6W94&4wS4?+k-4(zNVPHq$QDs#t=Rq!iuWH+7O}>fd4P_%QU1M6`sUZssMn+|9 z;hgBss(W;cKVjtJON*`vLrdoQZR*`UJ?Ie;5mM69YFGhi!E8c8(rI!} z0=`O5ta2r7E9*SdE$~Q~o=@A0v3y{R60zQz#!J z?Idp|ge+p+#$;l`Jf58bBWts6>u+j+rkx7foq)T<(W<(}<00+5Hs+Vj|1B?omrEhX zCuxQI4_B`RZU9u6^XDjsX>DwWFp^==p{_P7wQI%GmA;iW?my+?IoUQ7FNM;jdR9op zPETOeEugkUI5MCaOVkQZM*KY9FMO)ZoFUzc)y2_SHMolhSyh@n-ise6&2hH z*~9re&Ny{ye=$E^-(J-N9U&A#+;yKkdC=|P;oKatjD>cP z2w6H5iX0$yb#+rrx>_PLCdx;sf#vrKQkrapxT%tm2!C7kfkF4ONjKV}Zzv5$%RzKo zNxtNdA4wfHso9;Yvu?Kbj#;~PBddm^>R*jr*kIVVG5?tVS<{y@RO6fYdMAxBszk>= z;|1WuRElt$+UQzTLYxuIqOV?MSpIADtV_P|z$_4JzrU(aQdMs=W8yT(xcj;&LS zyQD`eDDfQRijoX|J(T!oSqz62S?lKZX0uldN1R&0O=KjgxHQod3P>0cyVuK+ zMQF$B0jY>bB2BXM$JgX8pTIzYL}N{A)S@H7?cYQgPT3@FU~_px?lbbKLnfV@21P8Y zI4#x_O3-_#8I?D*Mvlh&CfxY9Y{#_JYHAdC89w)m_Va`ECt8kQn6$=4t6nNAvB z@^20Pm>-zl9QrZ8P>5wd1(MF1oUbjPjx9Z-r?3_buheOw4wEMe>YE#VK4_+*1 zg<<(V^?Bi?2$k8By*`vp6n2ldt*-OOvr1`e6PrSp`Y(n6;O=YvEWKK{{Be>7`17>pmIi~`N6W~9^>Y73g2Q;Nd#u6V7Zxe z@7Bm}hDChyc>{n|-_u?akshxM71OdaGPg=e`AEr#_4JE=T7W*V7cw^AU0ZuIFcS5( zUg*i#{0!%_(sYW{S^??eSdgdAu_K#X*%j?$>6&J=I}q05v#P6!`ygA+a_^e;yca)bK2L~2iHF^H5_?@y zj{iW4Ko5rh65D_#zw;*fy7&P!bmdgVX_>nW?)?*)sS+nXn?hMhf zGHJVJwXIL%S#IM`Kaq>4jR=j#HmeJm)sLB(;8hor`|`Jn#9t{eKhJv9E^Fm109?S< ztrS0pEr?N7n6xsn>I*BUmA~WSCr6Tpdu*f%?YC)(a(6Qj)?_CuGiq0>eg}fXNe!76YGy9$nK36*jh7mz zsHmV)1TauMYMT*2jf;6Sk@+?P?WGB$lx4W~HUG@a49Q$77iARH^xKaymg99VKqOhJ zz@lc=C^?iRka_Hl+fN*LWcBBnSZsIG^#0> zP*TcbdglRz)h4=nA3cBK=)bY5$AJ_R#HLO(%~*B5=lABD_2bTK?cn$2Hu|7z7TwmC zb*%~`)27vxo3nlB+QP%F$yuo@4j`h{O;>(jQs^Kk@G88Jt=B zvY&`yK@;%o?EL)n>bS8#j>9N6F79c-cF^;JC{;56qJx5hcD)~8d~lj`kFkO*k_etI zMU<75nOmo$;zT#8Puqj}o5cg~z=PXn#Q*lm+GTQguRmGm`#|_YJ z{lA6uS{P2f_A(eGLNjN#T>{9#>|BA9_-~_9K=ae!01>>3Rq36>^e&`h{6*``mamkY z#!0{qAE~9Jor;DphhAnc?QwKf!Ap(4)!Bm0no$8jzNB~FkC1$1b7`0ADA@01<(U@d zX(t=v-Ahi=DI*d7X>ZRa+4IWfo!b_dudgq#D%Dyy;2lzE?*Dd)v=h9M$Ez)@4AL0w!fBUtGn z6W3W~Z$B*v871zXfA7=TY28vD+2z|E)4e$tlU2M2i~R(dP0#LZcgQ7~ys}Me%&~MK z_HgTITWmGZADcb^_s*m6FIZudSeEpHc+PFL_C_7wZq8qD%Q3qE_5mfIi1_2JHsfXL zAyZwV*j#IKx^Aygd+90150|}k+uI$xO|Rm{hbtExv*YE^G3W}9cH?{_U&EZ@z=YF? zsdSyHWKuMbb5)e*;u2Dq-1wZMJcJU1J|p2*1zzRZ98#n@x>;jc}fLaLaA3r!~)*$hmtXb zDJ{(t$`YFt7@H9KS=r@EJt0$FnvjszZq8kr2eNUFiH4bB(or3YA?!zlqGSB+Ek>!` zBcHZd%4(nRN^xEEKs>*;fK0lrdGq-=V5CcqS^t9EC%DK3PHxkQNE52KAoe8@%&&h3 zq7BMr0c1^SB5r4sQ@1hRuulKdEqBvOd|`OpXEOGPcR1eAQ!>D7V#6@9PA4$xQ?-KT zfwLZ%7*9IS6S{Je&cbP1$MIybuu;(k0!gf#bq$Qs_K34v?USdE;%@vg z^`$)8$LEerig54nFs`DaBIF=pZfSR+h0Bwm(5jmfOQ|RX#Y6omk|}Ze!s<14hW)M% z%gzLb1)F+AV1Hhe;xa@3$NZOGm%PX+egP7Bda6pz*SH!m>Kq;nIa^Y{l{#6ymi%5s zp4PkYRs}{XbPOdzqI@~VS&5UO(ZC=B`zGtMp((j<$lB&#d4v)({f~^=)5nA$n+1op zJuT=tw)?hh{WltHJbYocfYE)(V3S^}4!DxaN)E(QHe}S?BA>Tlv8a%*ZMCMv;h`M8 zukWdZRHW)ht{UUua>{j9X@)es_2Rr9@|G4X;t}OmP1Atf zu^}BA8*9%kZ0Is8tcL+pVly=2F&KM^D~e2fr>8E4hK9~7aYoKdVXr{}55KQaLjCk! zw=?fN6c-86ZP7s1w%hSbBrcJ{i)o2i5}RU!9z*=>yR>XPDync5^JmXA#|UZhF`^`1 z@VhTwX^u5H@URHcCOMjPxNNRV42Z}Xn%7B$n@_IrM6t2fysyrk`DyW!4=||JWVHVV zqM~TrQdW8y3UBTPUg40szWFN$)(#|#rKFRo?ZnxuY`p~q&!jCj3Ng%|7CFZOyu)LMvvfxZyLR;{JhG4a@Cb4q|=7o z?x?uI>Yu63m7%~4?--iK>bL7y7F3|~dpk*WR}&SjTY&vlr+VzW5<=W$WVIK1)eOMW zKaSe2h&y zdAvU;$wDV+LKaTB&=bdTfzZC@qLE2_Z)oVNpELs>ZH+BL7cZMOUhy>>g7w`k|#>&9!FC!#592?|s%?w@Rj9l@k>4j>U!MR?#9ZVK?QhoOcWwIX+)?n87c=zO$L5s)AC~3f-9%+c$}UVj3XpusuyQD6GK3j44XO=XlmFwDF?5ap~gp;M2m{ zt?H#AYHI3}+2e-xe$OjA@cK=-zB|dAXHu##%KP%j3W$s`lF15#@?y!nHCyLp;xw;c z)R{ld-CPFkFwH)SyOx*P9X3xQ_TFS};6z~EX5O;6DKsO%Vm_)G%Rm&=K=kZc$%7G| z1|$gj|3?O9@}_%yipQ?gjf=0>w~>5MAKssQP<`1dgnZLvK82;Hkl(U~5M-F1o-{F_ zesNhfQo#@Ot#GU`aaF(Nam*V;;L_j2@wuzVRIvDd%l74##De$@X`;|tfk9r(ap~^*mBdUI|iJ zRBya5%kQ#J>A6SX*|fR2i8xyt1!Uar+|`t4x zg*Jf|hHUf`olK#Z5tv}Ing%U9X0AV$^kyA!T2s6nh2 zkoz}8!!L^vcE7wdyJR^qlD&kU;r$s?9Lg&PR?S}TCsvg`kIb7j;jbawo3#$JBFhze z-szB9|8ze0_5Q`-g=VjgPy(G4r0Xi?(q-cG70cWR-gP)5e#p$6xYZjB}uKdnPs&lzi$81z`mHHC-T2ii0 zQxqBT@si6r1KOU6oDGD&3I8N=(IS$OpPzpemEQzYl3H3sjmu|H0EWe#Cs$l2pnn2= zsLKo@Sxbd0YCItTJj(%TPo4C}jomb!+s*2EJbgC%z90`ppPl*qcm^^XP1wDp-!U)e zvxHw_CPc9BlHz{OUdDNTas{P`6zqQ*gD^HZic1XOZb+9l^m<`z=2`(FQ}xil=CdRr z>6z&nn}_a01iS(s0X|)Vy>Ze1sZkuTPMF=|6@b$9-R-4hZb%ZHSRxtI-bos@dP#Zt zGH=LBX6w_91;Iis<|4TeIQG{vT6ZD*mLdEk zDE!3W9IZW7Sib@R%0uMN{EdRed62H=_j8Z?M%-KW-3qR@&-!`xCMb%JR2oZ1b(vz} zjoMeIlZ1LqBjc>vGO|w$ z^xX`mxAalY3qAyQKYkE7OBeZCTwJ{3kk5rokwsw_Q?qqLqz1UoegkA z9>wlWTLHsVd|DNB4vwc7)teY8Mx~(O8SG)A?&-5+wC{LG3dqr;?Ru9~i|RyHHX?RT z&6yuZA_f^I*4><=CkFA_hcisI~F8c1vvEz3Q?1xLLL1G+)YQf)|?)%q-GN|a6 zl4f;w%U>LnK@J|5$wu)1@H66Oql;tPmMg=%w%>atFkt>Z#VET)*w4ia@ z1l_pv>~`|YdA^hF!f4s6&6@5eae>Zq_{@m0KL#ZX+f!FOh)RZ$h~}#RP8hYic z-AKyrkR4l07GAP_cZCkUdI6=Bj3}svnjEYWd3NSfvQ#B#V{p0*6y2mTtC-8mQAtHc zorf$m%;Hi))l`Fcwp822UWOdPIJuoqQd}^th5YO%XOiu69E$Kg_#&;HpptIslJk?x zMr>$;1cGDRRYvR}s`aM+TWt`PEO^N2X}5oUYaVfh^H=FU(N^NsUR=Nk6fso8++5Td zpq_c~)wSxOk(l(~;j);sA-(l5dClVIrgPYX2)t%}Hvx;)E;gVeo=%3X#JfT4=wjO4 zNc?-r0UZQVfh}FA`F!|2&62BqGnh7}gso+Zm}a|;wW{R@%({e7@kc}Rlo@;95Lk=6 zE7R3>kn8ig)t_yFfZQh2}dBYgaL6&X%Cmu)Y$cdnR|E1N|x(akU@A5rJbqsB26 zyaf@&bZ_)|vuuC+AqXE1Tr%60i|gqM#Zodpj7(HZ2Rtys+YQ|_P6kcQuL&eRDU}*( zVRn0!C6Uo>Hx`CPM<=vX5TYn5KD8^|%OW?cHvg=*D^jX4X0wap1YM@NxjQpPal`he zJx}eXnIrFy4QnUA?l75{=*|7Asog#4SFiL%{~El%k!4|8>yl_Gl*`b2i}Z!Zjhg@A zfI>9U)Jw=49m{+g`S`rlsNmGxtQCad2E673XDdS7dCTY(^LZgfIA~o3 z)OMq;Sw&ny6H=Ms3ksfbe&ohA>#OT!-2>@-@$rJfHFCPHu83+|Zn*94`)CR$gHE3O z3sMd?Ja!HeoVEnFG6A+H*~-h~I`3huyl6Y<%pwshx5mddtj$B)>yxY@g|C^HX{7)$ zYw7l{!$yar?^3lYKT8ZrTJZS;brp?wd{ASjTVPG2`AJ`*vpdi{mWvmsiS!hK3$YnicM?Bv>gh$5a;85Mdj#N7xna*cdR^KRbRDSoy{0k$9^LIMB)bHG8TR=lAHQ! zWb&qVdTM!p-XrGxsHSX5(}&LgbBBfaUzOS4Din||T~18E0F!;-L4CI{?_G~z`U|td z?8s_}Z#6hl_J{WO72{HOd(rbeA|cee3;2U)jfhijc1#{l)Iv%eXF;1P|FE_%4{5qS zX^i7p2DLen9aUyjH$uJK1WNT4@B3s&y?!z2zn3)WT_BN(y;FC9Sy;D!pM!%#Lv>~a zzP-J2b-uH@HjvKA!-M1d6bAd z7p_xd%*(SfII?E#6w{3&#O&l$!2Ii5f6TSy*reg0%M%qDPA{6g zJvCPY{__@WEL1<`ipNvj;( ztbAlPM-VR-Qmbb%wQR5Mffgi%?B&#q;3E7pv@Ue?Xu9a|nrV*8b9YlFMkSqW(^%T? zQG6{Ek78yW{mzeFAPrOLLMl7-fR-N3YMlR7Nd5iPQQ!dSCot}IVAY6U3HDL}+R^t1 z8(Pu7KQrvV_*_=FO%E+0mLAp<^%JjM{e3~=?#8m{q@6|C3h6X)v)T<(Qu5ik?;S5X zbg6WTYxbTKk9lc!Wl}8;B_hV>5?9`v1#D;GZeiSvd+sGpvY^w!%a*L@CV9BFM$1yS zd&{Ulxs9;YXT+kwoV(lVYQ<_F&2twG>GL0G1FT8??D=~K(qHpIPFM@z`-_jS0lOT> zucAp}#uOMB_$!Hh_d)>=AjqCyYp8}g=jUnma>zb$;}|g75*r;|m#y%H@`l(uJ~a8= zG7n^Hs6&{%U*g^BU)ZMLBTj$_I@zr#jj9KEc{Q;UoJ%k=!=}Z+cH<1(fWYsG!uDMu zJIg{h5<_o4ssclqCQxW32`cpJe+5+0@G3!%HHM4LmQ~gJ4-!d4dS9NC=R2wWjtB}y z{nIne>tWA)a-Pa4@3gv~cVQnp@$C9UzUKZ`|CBdn@6^_c!frWMkwUaNPt+Mqs8)F;8v+-8&wCw#>qs#hnO4aNEH&Q+MW!a z8>JlocAxHH`(8zw0)R3z3=)jqrO_#gfw9c$qp=>{7L@2rF=$<__el9;)AE^~I0W7- zgsDm_e+mnucaM=|q!lz7QcERNKg(izdEonyh7_!YR9)DY?gX|Ye5dF6( znTw2)9!CpyH|m6~|D*D}kQJUU_Li2yqoBT@>$Iq>+ajVJ3oUJ0eQ)Nf6`b*UvQ%(3 z0ig3LUM*N&nDbKYmpv`@lI}Ed?X^A|h-^r7UTAqYLp#t7E4y04shjin7}d?z;qb*^ zp4s>2=H`L9Q;@l{(aN>0tu`CwMyG>Q!H0soH&9SeKnsM0qC>)>55c?nf!B}0W{XjP zvX38Sv-!LV{r*dV=}=}HW!Ls15Dr*RV2^LHOmj_|k}$3ol>7QtX1tN*rP1r>dft9J zg)DD62_?%-0rgCj^v%{FRjRrKaonRm)i|^>A%Tuk8ol7sa%$5eSJ+PA3JI})t_REJ zvsMO3C-+|^)pDq7O2gF^!6nT}Db4lRf2vmj7|*uFN=qj@M`kRqT0PTIdMEo%D4t25 zYnkCCm$$L-`qeh+gXP$D-Bu~OhIPWRn{y6TxlFx^PRoE0^IF*~ocvheLqmoCwOk?A z@taxu4F=AqQwi6z)mJGA7v!T3Oa-0TKl!57Re~2|A78G$)@*>BDz@9yu5E7@@Vzyj zYjD>uonR_3K2XY4y1LrAPEJlH4|y!|Zpd9n`lEkNRY7Pv7U*{gW0KElK5y~GaqryM z+&M~+*m6GFQ0TWKX=fEwFz|S4xRZ?QcAU}4sZ%%=)q1QqIAiP*Sc zLZV!DKD_PEZke;I4gzid2G*EjD|*7QMUZ9Y(EelRO%wZ$+lT@gkPiOM(z>@SHWuET z%QN?CF7=GF(7h!vkywTQC)%kAFCLsUp~47q5BrtJNUs&5HFA z_3Rs|gfi81?%e@(4}aCRt+B#Ff|Is!-f10+-G9I$p85|s} zIVx9lPWFS>a0U13vvY;cm>_!qrmPyJfA`yP{!=Qmsr!F=MdD)tQSfxrAW=>dy?Q_qlMP4mK>__o$xb7%TI-70CW!RTQ6Sp zRIEl7R5X&=zN-w@^4J#S2>-zowLAPMrI38DsfJMD^-K&^@fQm4*f`F3J z4GM@zh%^k{T|>8sgi_L73Merk&CuN;HFPtKbjOhY!@cjl-~0VPf6v2+Adka|eb!!k zt$i@CMvJo>AQ5-xFXq~8vLoLi2@5#ndae=d;+a-Io%J4z*=%FE-PTerCadH%o$VdX zTWAigY$Q~_>28DczCN55a4(sFdjX=p+Dc7Noi}PZbWt>7&)8LU9x#Nrs0EdFdA1{2 zY*vq*5U$=u_Kt`H-=+f60*YIjZI6j778N%3M=WQ<<=g@Khr%eW_)=qn<=lJGx(|4L zFwGLGB1ljg5A)iip`)j_*&iD2G1<)Sp{!Gc7+j|Hys*XF6ciL(H(shozW>xfYHQs$ z`xLC}FchYflIa)2Y2h83cg-5>rI>ro@ZCrUN=#z0VvzdqOi;hv zO}$7GP5+s_--!gtU?ja9?DWVEB!jk7q_q}rKFI2CT_b-zHG6p$rhB(;wW8wm9n0JL zCM%)6X}vqG>JI0~qIYH0Tk?(dNppu(xGsBNR4+G^A@P8Y<$s~z|7@?3uA6+6Yv+=M;|Zuk>1Lg z!$z^yz%;!xdyX32D!nJG3emm|bn}Ew$;2s2x&BdIBVmiCl6<_q<0A+t9JaIghDEDV zoDfc#M=Q|v>lXpKFVzGFD{AFhgT0SS$u)@dYr=|RF+9IA%E*Y z*Jlp1k~N~AM~m>=dSbwgdYW!i**&3(%@k$O&0nc;$enqlsTxz3ROeH(DU**y!58N3 z$lEpE|3(*XWM>zidcOBPstd(jAjho=@xR3NyXZaxi|Rx8r&zH|8SP?BGMO|lA4D;P zDb2_}W_VPt+I+0qUSqRTMH>{T9L5_C8|=z#>Iw^i^u^1Ad#PXs?-`>BIJe9ClXqjK z{)?UX`_piZEyK;hQ>udV%`4SxTi7#RTVbo3;eUhdH9{Y>t&M6-8$K6XC4s^ZIIYu6V|BzSkGEm--+d`!c?V6T)P@w3=^wP387dQl^5G9 z>D~r7Z8jL9MWR0ixa$=*n^+~r6Y-3FTTAu1Pv{!#Ei5SiDRJq%7OSVZl~5t5h$6bkD*0WE$yam(X?6LDEz3TOV4TKHbQqbAUDKJ+^84^z)$v9&(s z#NYEMoHqKqKGco}`$^kUFf-8|jlotm&b0`o(!g~swDF0_>jTGY}8s1X$n;RSndxzJ(* zTH%E18nKV$Y2O+aq)#}wLgXSoE-#w_wcXU^uuX1lJxBK@FND9QY}iHO^_S5#BtR^G zrf(L4F|+2;VNasq!0nkiznUcQsZ^IRw1n{}rD!o#o=K@tq^d!Za(5=j z)GHIN9dO@NixG1-FNL~96vjL)Bm{N^sqWX252wkr=VO~*wPN3sFLI(;1KYA&?Gp_J zN#$;K!m1m<*E)E_%Zd2}Gp!U8i2AvA_Vrrum$D17F)_baR}C&x5ynV3w~$azOAs;e z835h2!TQ6z20AwDb)5$wfM7lXrE6@~UDOY-#MJe%qFqpZio!=1BJR$lh9j;s&gUmd zs0~kdo&KpSq$i@bS9$ENz7kD@$9)!6*EVe9>NSj4N~&%T&Q(A~i(&Et2CY~b#lYcoc4vf zF8G2r?4hR@zad0n`q3IjB87Q=N(1ROiXWKI-hg_p{yCiX9wI-TZ8f~30@R2y1}TYI z9(JIcl<&+ZFl%TFlg;yQVWudB)O}Z<1_MS}C58R?{~T-L!h1t8eO{-#iNrb@<^2CS z>lQlcG%072=C+yd4hiew>8;k*F%3lXuY-{uuoSkw@q zT+s2@q^`T*Q9YWzH3$L$@?pwecsXm2ol%ykl8M!osWHe&m4buGDh}oN52zx`Eq((> zEolp8po1qDa&y?niBvX$8vzh=IOFY2LiS3$;qHBG@OBL4QCFsGNZAF+;LgvSlch}K z8CX2EtH{X52aMGp=NA<|d4M-jmNi;M4>G|u;8GLraKx1jp*%Uv7%QcbHTV`#EY(6BT{D<-Fs-LU}F4XauL~4`hmjzCD&fpmyw+v#e_0E5!bN+l+WsTM|M6fHO z0*GPNFqXDkG_S17&-NBgKkY^u9XMu6woO)+3;c?l*R}Cyq*vp{u#KO$MA?i}lXOil9;NQ3S+LBP;^7iCdgB}1j7V86s?PG<3nr|AOF~Z-K zY9@yS=C!CB3Kzp$P_uMlh|fkjh9bC7ts36UcBuJdB{Az0p;wP6ogt$MhJE>*9nB## zG_hR}-%YZEHJJro+hfh}NlV+o!wC&GE{{IWYgbJA+ePNiQ1t7dXU%bVUpM=|&o zcP1~)H8fn)>IQ?l#!XW>#F|wu>kHsE`3$fxpka$E{W=mrStUutI|ax9`T6;+Ykf)y zko9tTUUuO9IDdLxM2;Y|Vj- z9`h6fj(2NKwgi0_m?)|jdHs_o29$DRiqS!fICD9{7J0gu2E_Z;jJaR$rP<5eUTOmb zu=ywNKs&u)%|2i4e&ogVdNSXFf6s9ulsn!Df27Cy3&t5&?}#y&?Vy!;IBM9wxLGJb z3`-rVfTQ7_S9-nwv@+4^WC~@iwb8k?t_Wi7)`LxOJXthAv zRNG4^XK6OeI-Lp)=SM0SG^Q8ye|xO0v#b2E?e@x z^c~nLWOrS673xn$MCq{a4cp4%)qO=;EZLBocDo6>csq4$Wwb*Z>lK(@%gBvDQh!8r z-4eeC(z-}WE4VP6SvWf?$lLc3?FiS}WDK>=ZIWsw>f0(Ni)cD(ZGJ79L{7m0^z785 zQBbllNK!Lv9`bVz}>*$y+x>eh(eS!Cqd zyv?FSqb(#L-OVLf%O@t?d2v)6))@JLwlVSwxq+!ngnEZKl9Wo%qWW- zW?9i*yFpkbpx|g_5S;#RQZceHryZua@YvfeuW{SrF-lihciCE3J-HBq)sfLPJ!Piw#(CR7Lpqz#&ge&X z2gi*p6Jne__?2H@>_|o<3@4CJ#)8WY0~Oepi!wzTG=+5yODfGrmVNI@cNX-ggcjDw zUQp$MVp{O={OsQ&_1AFy=Vjxb9czQZncTJKDO9NLqmF-tLfl15QGL57(6Nbl>bc>O z91dk{m;Fg55k!PZCGX5{Qcr5ZWn<5rRtV`l%Pn_~QzQ+AU|j);_b0khw^u~dWB@_i zhCj-yQ{>*@TicM_Svz2IhJuE9okr4%o{xD;p&=a|Z-78f6~Ulxf$>P;FzF?D<(S0} z`b=2lYJj|_U2E}o^cPLnn%s)2VbKa+ik(z1&8)JkzBx{1{HMkA_sOT1B0s^MxyVvi zNudcIWqY)-nkKNER=F?~?@sU9{kb$NShjJapU7OK;80nFk6NJ%dJX9&StIgLE#w@ zwifZnk1AUzhx$E24qty397;5HpBU(=99eBY@-UXhdd-67t-`;&=Qjc7g&`)_xx0h@+XMWky|H>h!cW zu)F|m1sLbIDS{oP79+Pmknwyd03x+U@Rzu_xHRzN`Bq<_r`1+)f?vpe!l57LB$%Oe zV}R$BdkA)lh@clJc&Ovo$HRy6#9X9jB4-55C2uIVX2>at)9tJ zm3uay7ntrv2nfrgnwJG*{X0K8`p-x_20mIBkrD__qTBtTd^GQ`X`*lN($4l$vH<2O z2An91n1!Y-5#ifM$71I>dN7MsoL4$jD6lSohwBz(y4Rg`aYs|Za2;h;#zM~10Yc{vpP^^esQNB3hC3Bt|s_dKB4FB?73+K_J;HyPdmqB zQl4Uj8Dp$5%U16&6^Cj^KS5vqKlPjxsOr5V6K(0L5Xd1g6)mrYpN!> z-7#V*V=#QfEp=>2tLfX8)M5V_U_ILTFYoNMC1V1NL_UAN13{-Ih3p0Icvs|Vo zxafsa#uHHOC_XO_#Lw<;`882Crn3AQp5OEL>FMYy-1b)(RJr;NJr6dfx`6m13~S^yIU8a+JlUmc0tI1y%M zW(Jc_s&dw~StK%1&@M<|8BZ*YITqgE(6pJ-;0TgU{}f6B!4 zsUAh4rOczYwX5!h`A%R#Uwu>*L!}k`6sfx)Avo;`d)Osca8oleXmpt9XYQ1dbg`I4 z=VJ<#*Vnk2z3|42C4u2g0QT{km*3U#zwy>4@S+E;QTtj1A_NN&J|495Ho1er#2;wIqHCs5LfS$zr;T=;0k3K%DRKs>fx~P< z-&yVXOiqs5e|2c2d4=D9Bd>1+uLR~)4VnsQZX3@>4@Eeb%2hd{X4EV|9aGQ4!($%@ z3wR(g!#Zcml|jE(+9e!h*}yGALP0^B z+E-vc1q2QqhNi%KjzGkRhT@f3Pjv#j+gOn3oHY0 z^QkL;GeSc(=ciT%BIlRxJz?ge=UN{Izdat-rRl@oe49y{lo(vWZGst7lawC#5=x>! z?Ge~--lH4rQ(`lUT-k~D3j5gB_A-s?O$+XXhSp7}<}`_R-Os-0pQO%COiRB;XXlxA zC{^GR!NDr=$vD=l5R_DV^c=gpQ^u#3?hh6Kh$;=xMmni-y||O6R_gKm{?>|m0PAMZ z95UACvfA+ePr#nY&UDq|{r&%iKUW4)w)r@}WNPBLZm%&FXZrQPOMkH|W5+$ct|V;v zR76023EZ{*sAvn5Tu$_LFFbku%{b-u=n!NflcP8(@o8l4&`gq`pa$wSG1>(tjU^OP zSXnN8j2Cub!dv|<{K5|AuVCevXl3)-zA=*-g)Fs(_%FivV2DYuA!l@_hlZMC>rPQO zLb`b-dL6YYD=UAmtjx!oq@*h`*zK<qf3?V@j}niZ7Z|IhUJ^WKXWy}#RTtuV zt@nOm_`(Blh?CMEZuf=+bSp7+weLhd1R%Ry78d-9=DS7-8(UD20R$J24#)UJo z+{sDwSbJK<3L))Ky-*WraZTrCgJ0$kU&E`^l@oe7fgA}~m!j~2P4-*f&wQTX( z&c)R@36cK2H*Ymjc)E9M%pD8$eNmei zGU6tFmo3f+>wfexdzmzOosGzSDj4JM(yfm9_~X?O0F*|q%QE#N8;5V&qAxA-UElwp zM+|?}e0DwTK)8X7SX=LjbF}>flhNri`+uD{0?jc?ynUM%v_)Gy-%WnpxJMMnbX_ws z_a4(dCe9fAqrTUzkmTI$I^pS;28~!m+!P~Cj(=g5U!>^pAp6sDXF6U1d2NEpk~j+t zDQj{(YHU4ZkEd-_IBNkiJ|KK?#G!RM$Eb?n*U$<|nK0^V#tqp%z7_?Po$<-ZTBy%U zV6?@=unwBu?r0!3q}R&}3&R7byyARs;qP2(%7Nj27dYyRJWrf7N8lDBva+&*hm-at z<>kfR7hYf{?2?Xq7htX_0h=eeMVl>3xynGZe_5(tt$r;ZXkfEGMhFDT6Uta!pDZ5t zQxI`3R(^To4mg{_I5GCQS@)YG$@uTEuSsX#m(P}nV!Y?4FP;stZpUo6VbeeoKE*wI z{lqh1byv-E1cb$TmMGu-Y`a%^jeb0>v;0AQtX^S1MdC=?Cx#>n7P+y&G~}4%Ai0dLi6XmB=^RZJL1&kZw6xgWm>-#He^)W#gCAB=SRz8W(ze8OkGksHdsttEhPs{MmItY z5E!o&b(2gr92)zWk>26ornaWiW+?y#bQSY&Pyer!=dZsw`-n~8d7tjSe)*qYUnKI~)C83k;X3zyUOX z<_K8Kdk0T=UDABec%`20MIU`)*7taRMrSQ1KfNA)4-}VOS!GS zl$H4zuk2L%GDFEWA{(|MB0B7=-X0D~<`BKuu`4riwwMrKEAlnj2X$}M2BF|&&Zcek ztWn4oM`&uJK6_c~>wmb|qB_TlmNFVcpIWnlz7ydzuU$544v}kdNN848)(Xx$_A3V| zHNs#e@F?IheV4#uvi#lRmXXE26s*_7YL0O)`kV0K|F8`O$R;{D&gr48{vVs(&oz& z!>h{Ix|R#sFGj-I&gajb`5QBoD+jUNoN@eZ8Mr;VgnMzCZGGM{I3iwf`hEQ)t*}-FyiX{l*jTWz8-LuZ%}x?wS4M3mRQ$S zc=?g@#m0=?`Z!mk?e@);s$tN%`Mkv?y_MLRtFVsI&ppvcJUg!I;NZzRNh-jH;FgL-kcowc5yn63 z2{=&GEhFFgzA00b$=85HUa!@-u=5uSIl$|%Lv__vPAAVl)!EtM>cyj zozO2qNHnSldPBaS-=@VNU|fdWIvRT%eSRCg5Je7UWBc-RuLwy9_aW_;%@#DA^=9`X zQGr3}T{N|q6SJY>w{%+1lR41r4`x&0ehvlxssHaO!WJ&ZnCWXLnZKI@!#q+&{+}Uk zva*of3h||A77VBp6z<4emeTSOC92@pKmlwmLv#(#rf=u>(#?d3@)^pZxII%Dw>_?w z(W&rRlW(-bkY})Y=%-u+1G2HBpZbzW;=wB$jNfK+^v7@TcsJNoWA?$;D{T`Ob!Vhd z)lKeogcaOwg+df8T@{UqB|Qt~!NI}my#eV<{qm(Q&B4iOV0yauG64c0I+5FoI52155msF(*}x?Vq#*KNz~k&o`i%1goH#7uokjdxxzrcp~l2w;R${%^&j`^O?$0J zEt7oCp9qv^np*GKS#x~ZbGvD)B_^ku1f%_`QY<3_m%H6lSv9s_o~p)OYJtNhkTEcKhvdB*!+2jli!bQS$6*56Q0 zMy24(lQP>G=QU@>V*{vWr0O2=z1+x5hN*!0S>l$9hy6_~2-YUczCd;D$N^&eHTiq6pXeK+UxWR9$07MK z5AD-f8Yz?@M!zDVY5dDZ%;}R^|5y1AXGqan2s^*Fo`tu013EjSE7XS&1#3plv3JE+ zlBQ*jnOvmc-X(GF*r)q$5iF;&ihZobY|<*q0<1%(&XUJun`aVWA5#7?qBjp}q%OdN zM6O(hp}!hbU2dUrD|`DS9nZ9A|BqeeGl{cDlHm&QT7pcNE@rIs{x^Frf3!LIbc&I; z^XHG~JV}?g{7XgU94(<`PvorN+r95n@bjZ9IJM@Ib8j3cF05_X2D8M7a56icPVsNeE34S0;tq87PfBCcW1~OZX2{zw+2k6p$ z*npJv=0@Fx7Z7C00qzHMFxfji1eDJky2u8{DUDisYc9!ls5EG@*4xX@#?~-83IUYr zr9r--;U$Z9b$fGjvp)_)5t3z<-=;Z@;j+rEa))W*Mpb?TqqH6F+EjE_O;4LWajyZq zR4M0PY(WfyQ;Cj;_#MORA@h6koK&sLZvNuk>5mus`-u#6?IU97y!#hu=UF_3?iju1a;|4l}*XQ(Q4%20>_UEX-#74J_3! z$v|+_44ZrUD6g9FjkwZGKLAT~6;4=h%A)_xQ<^lbSg18CpLaX1XQhzZAzxYja$#V)I+(jqKQMI^e`FkZ3Tv$Bg+e@W`?TlUQ9RE^ zq@JAmT{HrGa`}MbnLbNhMOFOL$2MU-G}lj~ z1)Fc4zntppb=}~{OC*$|QA<9uX6AYy?a8jn+Vx!?_ul6YJl@fxMcU8+? zjd1-+IB==pX|f@=G?BJQid((XUv#i=BAnuEQlfVk509Of_x20wa9u#c3T`()0LuLL ze>1IsJukv~xb6)c8mrndHlmLTa zJH)VYRH@^j@g%wK9u%;~b8`??#Ee#V6u(%zu&YvWw6+On--qu+5Z2 zkj}gMA0Q$5C(EAhDe0vx-^&HO`ffa(Vn!}lm%XTkz*anb!1tGFnGyUY@`D$ zptu>y!L@?{rrIaL^^SK7U77p)^A%guuHw@%cW)W4A6pAuHg={HbNeip93*%)?z8pH z{VJ0pBg#p=Q9S8r;AcPI_^KCUmtUneD~DfX#A2ifvW1Y z+5{{F&~seub-bng{bu{3nxnxlo82DuWuiwOh6@t*{F|x7cqKc|2i%c+B4ZAg!kQ}! zu9UT#Gura2X__p%py%2)__+FOV4(4`48nTa$hw8-^R(_~dnGTPsgSP8GUIT8&A@xZm{IXrvl{Z|Vk+R|UoHO6oEGm4ntW<;>mOxbzZ%pH1U-e>1j zSlYuJH%1CSyRB!MA==%yJL(%^II!{IeS$-0W-d){_U@|>x(3N)V-+9j+1XW4Lx^i9 zPDYZ=>d)mI$;If_!`~wIY^2^j^(PDx!G9;!Ou_z)c*eP6jIdlGq{23{dpMjO)wz@6 zJFM`d(XZo6IA55LN>4w)6s>;>cnSd^8QwM7JY&03pyQ$b50h8)6~ zFut(??a^Y?7OQyj*C0tuy8#87C=LzMBh-loqK;m6AkijnDzM=>kj8f(NZ=h90iBJa z$AyU^ZjVy-s~FSxGt^C63RCG5!Sb4L8^Iw76Yeryp`ZqKs<+C0B%fOJoekd)?1Mpc z0hZopL_r>)_nqbzqBKS-Q?yX6c|0-oRE?<>#H`ESfbX8>Npx6rLc|0qbvD^Amx^g= zdqe?rB~B`jWQ5D1v?Z`D`Nl2)g<#R%WQ~pM3Men}w$R&xeUhEJQ)cz{ewgPmq!taz z45k(b@d???-WM+jMIlysyOsBuEKk{{(rSnE>!2aLUJP>lsG>~Pm-^xEkR^0st%+$T zKc`Xb#k2zam1Zq;X%BI&*uKHPl1|l_Ni~b+Ce%ixSrxn?>p#``vYSk}si>D)fA}kF zi(Ifj75UFfS9z&8u&{bqUR1@=aj|`dla%`7orZD5JAwuc;-w?qjCMth;?o)|=CxI+ z;fF*e+5>C>I<9HatQ+R@Jve;l2i>^z`O)pF-zv)v$swk)wl1$}`mAgW6%BCvwBql% zrv#vtC@n3^d5}aXOaFZkce-HcEmOL3OzeN8gbgu@e=HGo=!9@ zf-qT7rTfJzv`d?q@UcM`FIV$Uim_7(y=wN#gh6nF^If=E6R{K5_7IYZ2Ep*XRT{9# z_GXohF0~T*=<22CZkzgWl0R$4cQ%U zJXNoU+_JFJS_QxPBxB?4&kuv9UUcw=uKq%j8Wa|+O={K;IfOvfbWG79!6B+0#G*wc z_#(k4?E|rHD{nh zBC5AtR=*buzQY?EPtABNX3muSx%jwUkW8yGy;23rqnw}06b*uVNaiG-DZcEw9fTsR%1uLPOj{Dm-o z=O+u=9KADHIMLH#YL>UkaZESKtDv(DvSzj5q}E#hbeH6G9wNrTP4!_Y&SBXmbax0D z2qTckVbsUSSWeKYeIRn;t{co>(*rG^`qnA&H^{)Rfdq9+_)u(4rXd(^_Z zGinevr#;e7_3B=Wez;U-(b}0?N?Wbx$x)`xF>StfP3P$7s8n?I5_wxX0)eP?Z|}YJ z)T-G8xO5GLUJ*$(v|{VAwMNMB2Hkv$3VK|O8UIX9UlOxCMry?@+_Cx~O63LnT#>6{ z#QDaPkyb`>5uvusboSB^r`oF{J{7k@)%hhlxCnOZ?H^T~o#r?e#>~l~%-h3e5{(?b zc1|ao@lVVjod=*RHk=;?mA=Da;y}DVl9($mV2n$k@jj91DwE3%1=9yu> zrarIgg0BTFNCTJRt<=lPX#?GR8A4`}@%UH~q>*?b9nmv&EkjcqNj=79rlx8bYNRAX z^gOV{p@22+QSw{XqiRhS&`m$^tH!FP-1kAjysMoi;iod3;J;7IM4&Kon9RI zPF)*`&f&o0-I$*lK`J=^FczZj>fErsx2uRRMu#f0cq9vHbf;fZIZWf3BORSw+d-@g z%h_z3Np%OLw@zW8#Dfu>9!~XWjx$QdS6%olO2Fbh68BVM7cC#7lq~_Eoj!mn;4Ca< z?GQUDcA1_>^XuH^b=MQ-G|MNrf8A-{w^rrXKpmY;J*zAh*3dAhcA#rmMcZq}*Ttm>!TDnjz0}9t) z|4#NJsD;|z-X1VRNJsL%U10Y_G3sEjiCHvfLHi4w14Ms|J{!S*)N|+Ci#1P79jWWnzh9EjWM0mykQ5J)8S7HHd^`Nxt1AKre>?k zMg*b+5+F(L_$Wpo;gVAIyD}5j-0TqYX?dK2-vnB}&_nA>9K<4tYmt=P8j zN0HwaPL~B109+fa=7=(3(y3YywOuh{6L&0|F=i(z8e__LUq!nLm6Vn3VEVjMOj2C^ z4cRfq@k)UI=}ufxH{CV#jc(edQuV0|H1=ZpcYb7!TBFRPWH z??9wfW=!F5GKVn8TT164l1IkE%ErD-NKphi3)F^v?u%3b0w5;KIet#rg zDusq(MQ>-Y9$(ivUhIs=qXyN(*0Jf8fjHY0Y`Nnn2KDy1vUi$#xnpNsp7$0|1`Z}V zBG0A~X8Z$gBgT(EKf2At<7O3EtJ4m0Y~#26D_Vn?HCH{wTspHKhw z3Zr+`@8UShmt)S`9>)-4RQt{*{wFnItF;*IPe~J4EiPc}IP~UjscO3MHY_%K=xgEu zh9yhsQZqL{r1ohks%<0mI?xEOEz5uk(_r|vnPdg8^Sh_LA!@i~y%*e`Odx^kiRdtl zyDWHis`#T_FWaJCRxuqM9hr}+p>Tz#gn?g88#d*D@AI<#&86##KY0m*PNgRb8h#iE z6mLfZv9-;B=XAxOVgYz&Q4bQk=h`Dg^*9eiVC)fc(jG@#H= z%1$}rJ#4~3DXSh9#Auu3A0;j38-Qj>lKU8*sd?vF?6+5C)%V1hj3wzcgAIs=@CkxQ z#uGfD37)NV=H)7<%oTNAD2$LD@)ER3@H~$N-oJK@8Dy6to zuiylI%+AYmJHH5&>+Ui_&HQqVigY{ZHbM{O0mkw6f7G628#ze*DR_(fKSD$;e%@Rmc?rTXP{}yUydMC% z3rweKZ6g3EaIWhD3^U^5{N$>& zTMZB%44Qc@@Ob%NimpIXm@~Z6iErx%!V2h$yE;=33C?DH4?yXn_IzAmhRvv?JhQwZ z@PiLb#j6pd#!FR}ls30>yDTn!cvW675>xwRIiuM0i)=asX8g1MXptQ&6xSs`J+t4W z4M`YZQl)#*3W>NAun~HcaO3H^r9CDS%*J{mz8utyf+WD?rUyfMrc-5SW_$?6*OC;$ zkuPugT&4$h_a2peoRj!*fP9z}v+dE0ROx8|wLQB(Wi0AhCS{%}<*XM3@4*IO)}T6@ zLH=7)iKR8b)0rM@9MmAgTxNTlzR%u>}llPstp2U^LJpBx07=Zk^F@b{dT{h4KAEjYU(Lia7L6+CHY@SVT_K%N4Rdr() zcrSrA}d}#qxmHMAz8o~Szg2jX@hUJf*6WuJIa5YIH@)hu4jsH zgE#sJ5v?Z3`I%Jar+?#WU6KW4X~%=<`6yZt#rVDPLy{XlXjoD0Bv@E2ynz8j;&3*vA-#sPKpsV^U6^_+BC0XPtW26RI zmL1ADGO-(LSJH-Od4G+s6(e|Do9v<4;z~JW?!sOiexHr1)7)Q(i^u$_&1|@lo6`yL zQIo1S)ulF|-G=d>o}t|DEgMmrB9p!L6U82fzGk)F`VkGEurs0Jx;8?R%QOa<_r!hO zJM;1C5w%TAOORWYXsl=_=O<=?RWA7r_DjTV?^I`dkDsgI-n$u)m>LI^WXH$H$h7)mbm3XiJHE6n(dfW|_E`6cP+umf1#s-P{0_(*NE2dQE zgo~7vbfq@y@&W|Va0;{w1!XN88{J%{c$p%gpy3}mfBx6oCkk}`74_V)J0JNL(r}~{ zqA8q#=x4f}U}m{BicB?hD{CFLc=*+b&;~c-KFf(ymYGe+oGT9c&2Wy98@H|#O9g5d zi1U-Gl)e@S6q>$|SQTYh&OdhLsaH%CN|{{ik5hAd3sIM@)km!yXWOrgePZpK+^lF+OANd0*@!=%odTd3MnE9J5Onb#$NB9asN~y zCTEh=lNgiV0Bt80!_Kr76N>FpzN1^|U=r{GbOBoVquq@CZV6xpcdrnCzs1MD$BpP@ z8gp6rx98op7dDDXGp;#7I>Nsiby5@N>L|$2XLIvysRiN-mf1vh=6T)Oh3wwv(@&P; znhwgYy9-3Ft;-aaGrn;a!|hA9DXE=yyTLdnmm&G8^>K3pP4%)9h-sGNC3o8F0>6e# zR8-l_2y45{-Eebv7uk2WV17veE<+J<#1lSV1M^b7)5!=*k4_E3pqYsG4!w8dbd9^~ z(OkfrC-)t-MB40*T6t<4fa7MjlPWMnr$df+f%afyX7B|>y_L@5dP5J|y*J=0zs5<#+Dv?d&J)27 zs5A@Ja|gJLL!wz$u|1c0!~6-DoF({%E6)py&biHvkijGeqGWui#j{(su5^pOh3`{w zZzLt(j%Sjf3ZQD4#B62MP_W=Txv#D6{kC%0N@_vJ3QTAU4{qAIQR^C7FLXC~_Wc?p z`Oa1>yerzq_GBKf}5>1wg#bVH7vSoy3zPahMVPq9HXz$X#7yF-z{C|Nh z;Ne|60C6St^tHKO2$i-=w9e$2^S>}QTyDAj==9jvO0XCnuG-tXm3&Cg$E`Wb?Osl- z{6oUS7T%uSf8QG=v%v2k6ZIPShI)GJxOv)uDsFIu@Eh~`9AcF)?fRnB)g}a~A1t~j zKJY|fGSM3CN(p8YTvhX&le6U5Z~6lu#OlsRE`Xb^jOmE!_BGJ=v2?sKe_?D)y>>Tw z({^pNkoJ(m|FQSpYwzaGi}TImOP$o=5*ioWQnUp^<8$CN1TA$|DZ8MZhU{zOrMc&K zgBvRTnM)FAgt78cVtE_P{AWF~_6fW;%w20%rrY`V>RSRi-fDNjwj-rzPy;0zl?!Qs z*ir_P#gz5EAyi+xd(AeuDJSJH?p8n2d=f4$cx+c7HFNz4cmSJ)SL)g8OwO;o3Zi}`_{GKL%F&q;#m>FWDR=L~ z*>K)87q4sJ9>x*_xO^umbHam_ATo_oNA{i?tRPjCpVRt=vBu)2-(?Dx4;Jc zdJr_3YV>`vd&q718!7U?Nx%!;&xFYBVJJE`ljWU7a)IW!qGzX~*6(a#BV{VLPJfkj z6T_ZSJ0BAfN1^ZfQBUpO%2Pk={NyiPDDl}q1fSU8E|GpRMTmp(6NL*?brT8dkeK_? z^Wu&^{Y_mQbLjwa}H#RoR)YAyB`<&0So{IwAmlDK3)>1HRL9In!9^-Ld zv=H&6|FG`D^K3=6u5x}i)!}GM&l4>$(?3#sz{LzL`SDc~359DS6eh}TM(XR|gTO@Z zWT2Rqp8gU*s5<@ShG>WZt$-&_C)SmB(j;=`@LXB>rD0zByLhkoZEcm}m1%EPfyoHHO@u6yW2BLA2YW?`Ox2;c;lrSP4J`#f@oJbz z>~Ms!T*{j*~wtN&0Y zN=9{Hd^`t$ud`FMNNN-&9-Pb);3}Rk8#Ra8!^6W`MRSvU-}MWB^!Ljn7}qMj&oStI z5J7&_)m?n<^Hv~la|5Zz@ZjJ#OYU5RJz6D-HCoDScd2J(b#)NTD`;jTP)L?nq{;Gq zI9FBm$ec#qCQtm%l`EQbDCy+8gNLh&iJQr)(u!#Z!SVzUxTeDQXz3ND zr*x#0AxaFiJ3`+o^9mfsJ5Tl+_Y{-t!B_X^=Bn|i7?pNovOd~m=1b&0v@g(<{lfdb zTu$Qnq@00O?pTd4953n9zIW~OoQtz_el8QZuuxUH&Cr->X-Uh@mgT_VbQbYn7$Q z!oU96kqnY__`4vpv@3L!(A-Q~0v~RUbf``&hw6`w? zj({9+uh2RO^z*CA8e(F;l~q;4paeN~wY6QXZ1L)qEp^cu)3?dWTAijDyk}AxU)z^U z%LAgM)R}+FbdjMig2J&w6!adUpJ+Wj$P>?AD{;Q~d9WY)GJdok}t#m!L<|aRP z-0v1K+V%CSGT67@qMruvrx{mpEC$VGbc6?cNWMkedtyg1>`nXJt2t@->F;mS<`Hd> z{VwH39kA>xb9gcef-A58=h01=s5ESAX%kuZtn`2L*Vp6XewDApCnC#?Lfl{mLFa8f z6vqozTF0Gmt4brUnk7T);D|VmZ-vvs$~nJF^&sZc)vnM|bLD77n{*AC}td3lyd}h#4 zpN1lBSNnHVlpTzp^R;&jgTvV*kfdWcVIc^&5QSQT)gI@7J+IBcofbodVjWp7G!sfX zcgf3XVyMb9+{=|yVJ-iR6eWJVeL{P8aq1zC7MX$s4y=rBGd{i%yk9n?^aXpG&IZZQ zEat~j-3*;Y@Y!_Y8VS~wZaSXU8AEWY{Lk~^p{07ISjs*jeWBO*Ny+(^y|>D$Z9E%D>`({_3{A+GXMG{qolF?uwA&kk9#tUeq^|Qr8NFvu~dck{F&jMW{CT zPXf!r6s(Kc4Hd1LLuE}4T27B6?7stX$$8iRqw6ccqT1HK=jc(df!?E{0wSKnAkxwu z7BGMe-KBI(3`nD1c#$`*l7K z)4(@;7NBWJ$bI!4h@BbTXX}lys-~u?-B@k)HiADVS9fr3obENS zua(*Cly-X2o}`vHr;_i z1pZA}T_fzcuLKIs&c5!9;kA&~b*+>$;3*D3eGLssyl09FMa`%vR{Bcv-ny8sAU9^x zNTZXwBTeH{F@qp5`0JQU~zlJlw>p zfjkDnVLe9i%8S zpFaJg)N(*ol#A;vIJXipJ3DJ(VW9->2Dx9y%gbxNwNC1L_wc#X{E)|k9t@4QeWXUUVSJ6OK{+jG!ZC zg-|eVZ(M*q9*vg(CIs?ie=IT(4F*#RG3tJ>3}`EE*K>2Y_H~4^`zFd)1rI4w_{QH#-_9|}33Dh^a+o>(#JUXvXRd38n zuCUNCyt=?YxY8_(K7Q(@r(H?>@Kk*RwST#$Sa>7ZUvLE%ZUHGyxjCNfKCCVjTa{IC z6LH=@AOL)WP+zK#t8$PBpW1YAcrKh41?Q~>hZ%zAr@lhVaPX;B0pNz+q&%7{(huAl zc!TX@;lDmA$cC}Dffhp+@h`4iVY5$QFh9nnr0g4sI<;nL-^Nnbp54-yCL8^&qYSjd zsw#vSiBea6lqM4VJhe6QGxArwC`|e4<>H#gq!e(9SqU?xdEmU&SJ?{d-02nqfh~wQ zl-u~dS2uDiQZEu-%~MUnCz}df#Rd77x2dT7EoqIrPm40q1ng8EhkdL4JpA<+HFw1l zrO{g?Nwh!h=>FrsdSXisPFBIScnI0D!_G(4zq`O%9z3Gv_uUg~(+O)RblTv@p^IPa-$ zC*nd=k$AIR+qN>9Zu^Jt`quD{$GCmztGw{WaYW-|Hc+!lMG?Bwfd;(op&{sAg~7f} zX9ZC!Nj6Tpx^9^znF;X@xgVcQ3Ubd1a@UhWj)gWq$-ud0$g@+ z!${0RqhUs2gM3WK+DIracCog>`Uato%4wkQ7cPYgQ0Cx~BFP^809 z(Etm#K4qooi=#w=xQ9t5M8Mzww01zSk=1B!`Qy#6IC*rCgZfaI6`abD{VH!!?qGzz zEyvE2{PNJCLc_qLxHQ4h^h_odX9t-^t^8?o3iz-zv%gz)?G;`go~ea8x*q-Qas3Pp zR=u80-PZyEya0_s?=deQpWfzIUXT_R~9EHjI!+U^(;krs{)y|@VK0R z3&zqu2$8eff|3E0epCNGt3#B|N+q08SmvhDWZOc!O4Y!g#oT_twfVhj~`S z%~x+5^_-Wc6h%RiWxXrMQ?-z_E|9M0oac|DSiMRu%kHewY0JQCq8Z>~tx^lk+K%q- z6kf~jw9L%R5yPy>#?^~A|9~l^*96-{U7o6ba-TA>k8)?gEQ1%9tN}tsg2Q0AIDc_V zM&f(rDa7Z-aKeQVZF85*9IMAJPur#I@t@X=w5q~W3{!e8=kCREKkJ((CO?y4d#i*DunSt5jRG5`7$$fI!Q{Tog|IBq&J5 zP_NO}{xyeTl1I(VsOfW^;>eh`!}o!?(T;{I_0;s1O&Xl-pY>&jd;;Cn@+8B(hHd=( zPKIb8Z@gq-R+LHYa0TgIlC#%}vyj*JW>T|eGWg&$zIrXXnhc}7rY%<~Uw>}Y1J`Gz zrp9?{l{?L5SX`Qn0Ux!#CEpj>PQExGGcoaQcVDC43b?~>GM^ndT5~*!j z3OFUJ<_X}aydF>z>gw;$y!k5Q4L<+AVv_TaixfDU+AH2|u2c$K5|jfXt?`X2@EySt z_#AOJOdxfs^NNV*kVKM|5a8=0Ox0Sm?et4VOe?MP0O%iNH1q?;~Ctu6(Re8MkDzxCK!Sh8Y` z3WzlM%P@IeB1(I*OX$@9N3n0b4@+LbmmV#LBS6d*wI`PuNkZcY!wrl-os8mbc6nx@ zl;q_5fg+3l-CnlcQ3GEotJb49$yICC7{;cRZ{q*#dfJcc zEG|#|a=R!_z-m~H#vJQDNN{*wF)x^!iYV2ilrt!t_$p|g6fu=rd0(`G85`nko?veJ zJk{;e@jfr1_Dre7ljFD0M_8<<&MdVqDxkiPTW)Q)-E%|U7vk0FrS@nj$$jruUY1t{ zeE)`a^HZ>rQ@^?N2IsBxovN$WmUdVtV=(g`k~$%(q+gA=*?imqK)7Os!L>P0yh~Shj-j_l5S=|bJD-Eh5 z-Qb`N$`=VBP`X-YpIxNgsE*Z27M`zA2Ch0~_+w4+klZSjk zWI9|rUmh##dMbBmuvoUQot8N(e|>4%3>BR-T*ZVXCRYs2zGe}#okCdldu-t+r&YXs z7U2k?$2YoJq#AmHu5oJ`He?jGWTMW%YIvkbyilEi$vrDtKZ~`}rboDLj73k=;WO?2 z*?r;hgNhJ8tb4zzrDdkm+(0_G@EN(vkw7d7>L+OpTHWf5KQ^?X||=+b73Qoc=p z8TReP@7|6an!H7Aj;#}jcARTm!cQ~pP4(ppJ-AT3E-0zN$)cyH$C4aPyDp{afwQFn zgipV?_ZgrTX(}-=gACVd8ZV5ptlprRJw#!!RXKvNNOPlRtUz4aMMYlj4q7^yrE_kl z8eUL={akd7V^u^eZEM_aA1G6hjrNG8dcdP&-ykJl71aJz@va#UFn+w2983?_lLYKs z7Zeakx|?LHmtk|R!_U^gk4CiF_L1&cSc%Z@iiXZ245W3J@sR?T@ZjUeR3#OasZd+f4hJKiG-}LSVYuYO%Y=;~u>4?WyPa2i zlSW!LN|eof8IDjK0cmoF(U*_#$sdikrncTL#|B)?&8m9HYf8>EmOb8Fp#V<(|1jjd zWtLcvM^4pFi?~^V$lIQPs;u(MwpbMF?lx}SuDw!^tgj71m%s)2=fD~KgATY|xdR;> zsOiphCh1qW^Dh$kYzERmobx&Z_#K-PhQ`ke;C$vsVYf8rrq3=l(g%S|BFi-|O&=C& zTkDZAW{rIL7j1b<#6THz@HMTuf}%lnkLl^p!Bto*YhE3D*Kq(N?m6+IsUVx5x#yg2&P$lgA`t_zI%f?k|L!;**ev_|t`(Q9R3Bv9ted4p|7j8Y{IWypXwbHczT(a}wn9%_ zv0FNQ*;z!7UupJ2iw)61?R3=AHvcE4)3^=HRUUz!4js0$oML>hU`(V+U|>J6lnlyBAMIEQ6Dn&En&W*w3GgZJR>#xVwcm~ z6oMZE`Yh%($_klv`CKTf=YvFa*^$B??XF{z=EGlB;BE;>CPb1FE9F0_#N>N*$1iM6 zKhXpXOL|%nU9_^MX`(e0Y4rUnauAEjdx#AN*6GOqD73Y%eVm@qY6UrAP`(!<7#!#J zydM5Z=_-Ofed-F1=-BaqA8)C@5miOP+Ty?F8mh{lL|E9^bc3^pmd1jS4J(X!sFp84 z@aTT-q&~%uuX%+um#&dR=WjuKA~-8XnvUYry4m$^FOSstV}h9&HT~1n*eEVFCL|XZ zK&Diw^R(9hqk1)@T0Uo3`S{bkQ;ooxc~gkWxQ2iM4IWWcALX7AjpE0 zGrVkT5%aHIHtDb!l95vJZBj_M!>Ibq6~mBb6SA@J*dpln6jzbhV#PdMPqhz~*q6qT zb!2!QI}9#3%3KvN^oz;OOV9Fq_?!<0>vAM+O4!E!w{S%z$-T7O+$0XK^rxm@@=?976u%FMf|-=bJ)a17`=`vE6hTb!to@-YLy*neg6x) z^5ji;1O!D!Phsuv+B8s5D<1YNuUZVvA^*KLg84;-9VqPV=3F)x>biP+1#?~a)bt`k z3q46kK>7ip{^Qu`;dEgSP}c|6>aQ^FF2cGXwNXdR54 zpQ>k!>jYPPj=NYL$DAqEkte(KBJB)C3S0Q2PY}gWi7b=my1qFRO#&Cr!D<*4{)aYIqb4YxreOHi$TwstM_{+W zU%T`v(W`Y`{LrKkgyy8ATd{lDPF84ezbFx;VKD~1=ftpug{q*A6Nh;+auTamDD&`& z{M3`twY=LhwZzPje}gpvVQ#;K><FUi*=(;cVq63rL5--tk zvTa|VN^~80$yngIeO+W1heO2=nb;;4rsiD7TP9Mj(Jy|nv#ZVYFh=grbA^vHk5Mo!XRdy#O> z{l{$-3WfI--%QZ+AgO{-hZ%upK8ES_;{@@wR>|W8jQb+Oy1(c_x{AezaaAs$b-*^E zbGuFg`C>lrDk&Rnfn>U!)jHt&s$WHB`I#4S?;-}FC#Q$MYJmdf?2N1sFrSg*x-D}YHKFEi2DPiS5juJgR{DRyq9q02DL>)wv-O0*%LFxfO zJ;UuqI_t_&c9>#m);idZfo&1 z={N`?nM2#Hiw9H0H}b_hf{|kBjzXgKCrvSqLfG=TGFfuN)Y}|SQf7lmevf-LfvpsP zXxFH=`R(AY9vft4Vq37Ox#AIEsDb|RB)$lIw%CRJt@Gvth{CST5)H8|Km)P3D(PPGgs2<&Qa6xe@ zIrL0cN|#AU1-XVWcHN8<*Pcj3^V_OvYxnbBmWd1$=Xkgr)rf_`BuGA(wg8L*-4f$^ zj_oB!r%oojLU~@|E#t!X75e1`^97G=;)na*gh@G5!@ddq53Us@PTsC`{NaLV=ibVq*5|L!T_L(g{5T&wsRZUqr7?i~e!BK0Kn~RM?kH2{@u5FG@X6F_a@eSJ5(Uy_AwF@n} zn44pT)gNBb>nQc(w6AUW)7<5uB$pGq;|R>#qJFiV&Zd59Sd6fgNgpJ`N#d!o>QXXA z;m{J!>}M@#kHK!8{vR@S54EOu%@UU8>P1~A$Fzkw9pz&EbqfOkfP*LFy+-792AtMs zE_=m=C}dY>XHv9nl_t2%p)*4@b7{HXmH@7^Y6Y1#kaiMznUIQ^-vDW(Dssvn)KW75 zgzM_+$|Ngs)#`KzinAjZKY)^x5+Ga68J?WBj`?9s_s)e$(t4ZpNm?0nl1$3e^eFcx zH&hbPr|_H|P&*R|n}K;FBz{Y_%RQZKyw+LHxB_asam!-Z;i1(oEveo51x)pkUnucN zZ|fIL7IpT9(lKhBF^}_{4p3r?-aKP+dWU=<9^gEZ&SMD#G(ySn(jo^WuO${Vj24)+ z{R5&4Im@2xE>PhCAjM#rV>?;Esa8t_!4T^>=mlufz=U=?9ba#MAU|FbFIv}du~XWR zP1GhP^2)r6oY-W<%1JKCzFQov)qQW2q(m*9U^QdEiiXa5MW^t=!m3UaBHEGgg< zhzwBlGdD0W&v<2gYERcW86O1_ z&N3_O%zlbT%ijKF!Q{Qt?jV>PI@G%AniiGCV1>jrvbTk}^FO4gw9YKNUMwwj{2adP zV|A;7oq~V5&VHc4%vCF08yudY{7B^U__L5t=mAu0er~QJ4Zlt23kn*Li%Y6>TbYh^ z9%_4f^hD?Ia1J;U(){sb1)nEJzLHq(He6M5D4*;x7Gt zek2gwjink@7__$lyJeBdXi>n2}>4+8Jz#!cT_goSUj;b+q11TUXpd$)tT_UD=ue0$wuiH`oP#&MBk2y<8rw1 z*w_Hcy11x21FX(@5EVXGMqrN>bdWr8_9|HeNZ)i^`s&rrFJJz7D`vyOFIzUKpenS~J-!l~c5?sv(a`ANL zpjs#7IQ53C9-w=N^3*Yqfxh|bVqGp8UMe7_oBgwsL`&0h+y&!496rARybO?ewXn4X zHT-Zg^i#5^rGZ|TZZ%V7kksZtRU;Mbgjy`77P}@EHsUEVnx`f;-%D53kpC25vb7brJ$5AY{dE27`fNS7fqM)hfGyo zy*jm}vM+~Bz>VY3%}LS;VYxguk_UIzv}+^fb?dRJl#PdJ!x13fx62|IX~2zzLUtqn z0sH0wl`l{n8z;Jif_|JlcbyOwef=D8UJ2+|0Hwyev9Ynhj3|3}Y$Z)pMdhkU>Sf5+ zo-;lZoda6#{wnCA87vkFDU|fuk<{Bj)}d{(Mxto&dZy>aI7Vepv=6?%>+$fe7Ko}` z!WMxm^}qZ1uc@dtXpq@iYH{XOqVCR=((9aT9c8(* z^?f4CRV%A~`)l1G#Vuwgd^)POSAbcO;MZX%tz?i4kZ0SsoJ*?%&yoZTu)_V{ENjih zb)6Nb7OCx{M+) zQE6Pi>(nVQ_nc0NCc2Z~UCB1iJ-_zlE`&>9sSImng0ncl5|U}aC-C=WCM3=NT>aBf z6xe6aGClCaCta@**o+5->VGVgLai~|i*3h6-~FS)E?Q(f)I72qv-pFUWz{{|!`#|5 zzIxsLxmuCSDJI}y%Kh>CN?uv(Z-4t-R}Kj?g-SJ&#*P64Yn7qL*VORjsbA!v_Ip2m zwQI)8D8rSjNpJ$<(MLeAl02Qh>A>PHf@N`Xp+SH;K|od2Jo21^EQu*`R+MRL!j9{6$hIHF3DvXAFDTE zxkFiBC3foF3LY+x{CLLm85qv^e`=-u%@a9nqzTA*Y)7|oLVHz*#$c<}Rdr>8RlbA3 zMCC}Ep6yaJL23OXn`SeXKko%e1ZFV3T6p%*B4GScVKX|`Qv*pofm=!^)>rU}`IXZ) zdRhdH-S-TrL8lgoiko>z~_WKS9?W}ii)6nrOJ<=5AN{Y1qSne zS)c4br}53wMpv>i3X5^APBXlV064<`Cr&1_-`&GgS4%tW#kAGCx56i3x4M4sPoe&r zyLr3Pb0!>}GkCocH(Sc_u{2Cu97bmuT5X^`*ISsg(4FSU=L3 zU+7keNd4*Bh6J$c8@E9iE7+sV9^0K)N-nyk>AR~aRp}6nf(-|%g9~N>it3)s0bk03Y=(){JeCbHM}dxNA_NS-~w{7 z5spty3*Oat1Q;h&*~>~+yUD7FVzUGlX!#%8qT%V~y&b_c?dza9xyDVtg+ z4lT)>M$wt5#Ac0GoR8cBjj5KP!lP`dtGy4}RJ91Oyiwh+%o8zV=RYfg{#c#!vIy46 z^Hcz^sSL+rg2g|Hk)ugx^G&%z z#u$3_1McP6BPK-cS-W}-@pd022ImC1`YYT{Rk`~9p?~-0-hl&W?CWVdB6|q4Vi-Wy zloL1^S_-vuIcE#AJ387gWflj7lUnMfO(jijg3c?jRE37&NRIs%ShKTo>vYT|{+ zp=Ba`5ueo)2pSu8vYu8bb7I!+%W&_U zHA(3en3q&);J0YG!WK1Z?%L5H$>@e*ZVux3jhGm<+nWaySq|i8L-8 zHCr6Pd~G1Bs-O)Y3W_#kTW|FQRn-2LQF)at5H#RuUT0@A@D^hpjN+rRl^L9gaK>pI z!-OpQs};Ms8lhxX*eSZSkal3VCjTRJW*&8t&5dlW3-9U4sd;MF7-jZBl|7sz@0tHU z6IpG~S?*ZtUz%D~c&oed%60uYxoD*7XAx`D)Wz&NAb=a~^XD(lPY^+%`)EKKj)GM4 zO2Jb22yc>~UpfkO3^PmpzSTFJlEUHQNw(F?JJ_xxL1WOLp4+abmutMT3Sl{%ir3v2(pep)^F1`OOho z01pNedsV}I&cQ5Zw#Ngf`g67l;oy@KPq~9NNl-jdYj`2q+nOe3+&MS{ymTf||0}2# z?-pjHuN+qI_BB0EF&3;0{E zd@Y~TUZw?hfu|le7aDMu-L*#s&FZyMX7%6#zs_HlVh|q?h0=Y6{v5ZI z`Cv*&L-Mp5-zV}tb=$_yx|1%ODCP7FEBKY$PXGCLUeKF&GA#d2ekyV4{J;Lvw2rVr z3Okt8F3?4Ai#Or9tDkHpl#5y%9sJj+D`<(YNBCZUJ7RWyLq?iD5B}-8rez$RfCKGW z?XZmXfwGl_RlEmbXahSLNb1Ne3l5mWoXLPUKM3XFS8eB-dS0H)L^Tjnz^BTURf-O} zd))XQ;ly)&SgZ7zgA!b)HxapRFD5=SHS@Jx6j!ls)F-r@TIeE;|5?6;oo(F_&k8xS z-h`uz!N7InHkaG5m75!@5-W_=q_y{)y)f7~X<1*FEE&7c)n_TUAFL5_xzTVp;pMS4 zEb=n@&-@7Rc=}8ZKs8>n>56!&t9aGI_h-Mp8dBJRF7CgltDYzZTwN@M*DFU~L%ONE zeg9{Fo;2O#2cN1~+;dQNs1jOUgx6;mtq}XMI7-N*#*j&0fJw_;Ir>Wq41T&MV7yMg zqX#tu-m$mJRbhXzNx>1Afh7&0a^cgLf4Z7L^sTuL${Y%JwT>5?tec15Kn(S-q*g5X z>O*&G1evsUcT(}Hhvx5pnTx~gZ&I(*2}@}Hh=wC=+<9~db$wp%Z!~`S%0Xjt8t2_8 z--)-%90+tpxv93ECo%cM{rxu;+@QpZry4a?pEsrnyTrP`e(yf$s*dY&IZ1*&+(3j` zKM?@e*Ffehg3fvSqqgK2i$37Li(5~$=GyWiWKM19oM}`SCRFB)33Til`#gsg)_MQh zw1j`z(h^HYdnX$1;{NfjkLCW-;}1=!NUtq5z8PE%-WtW_n9d4ko;u*c>@5fnKC;sR zc8ZsIA|RAygG$C%KfC<)fzBAXi{l^~d{252A{Yh`9=-6enVNKXUw@eaF|Alzh6mbe zL}kxqLzol>S==868pI#&s3v0s+IhvQ@wL|~>OiY*HXbmm2FB^|VPJaeYZ=2a*n|9kU1d&QUl|% z{7^By^`-1HWKLG-P+#t+>Y;ETkoGITdg9a}}n-*`ref+cR30__=_N5^C6REA^*~jOp{w$)a$NKg zbp6DMK&R^Ih7Hb^LzDn~{Pb%tw_p?*XBx&wO&Ab;!u^X&6O8}YixSOIPf#RJpa=&- z)Vc!|B8ADAAIVq67eB%49dblN0kc>SM0e{Dqg2yXxC}RE;0OTAn7)cE$VTa)8~wVw zQF_9q%Lh2L4S{3>ShVYapy1jUWi-6HcfAo9qDrfuHCi&!EYugW@+=>>o1FB+mXqR5lT|N#Dh(s$(#f8CL7S2_-2$v5rAMDZtcc20iv=O2U zQE-I1v-&l?;*!S{`)aTx3RxEFTSon9rF0cET(*auRp(bd_3%imBSEPXO@^SeKFh;Y zmCssVA0k6g1r@UEqUuqb_w8nfh{mC@Vk3C%z@1f5!C*qMH*=V|166NzhHSL+W!uMq zhHzvgKyKm||KbL}-c86xA?%c(EwyMb>~h0L`9So}7K&B$;jv=ez!Ja_*ZO}b07-*L z*)SB7rC#uyYc?i}<95YPrAYpGJ!EYL>|SULz=ZDS!S-Z^PWB(w$Dw8L+kgw zK_|>>7)TulcftD)j|I+G>m6{)H5{VtAT!dw2}gkQq_1g~Cqblx9Xg@KT#_X?Ee=RW z_kel{$PxT}4v&P|ObfPOJ~_#V-~;{Qgdt5`$ee-DIr&!nj&*G$prGrYhroeCU3SbZ zezxb@Wa$ujbI1_13PZ`Ct9Un{iHxT3-lC1!idA2Ih}Sd(QK|SAU0!oflBZeo2MBN+ z@-|9kYrz$H-HHgbG0nA>?EsGhK7IQE<&y*Uxvx>}YA*r}5N&ZjnvUZ@B7LE%cQnGG zmMoEdCr%wOY91nJt*{nxe50Vv*hvI>QqPT9cx4tM-M&!iK6*ukDx~*94g&4yh#Jc! zor7%jBLwN=Z#Rh=-X`f)tXCau^zkZ$XgvS5lR`HAha)BkuDLKVpKn|@aUk7~r=V}X zvAm(LUwIk3t$E;^2#7!|6!n*i`qS-XXGk+|ecKV`3|ZA(=&GJx6?AlDzvf^L?g*VL zCT8|vAg0Xs3k0v8M|w?=y4>2P-43L?CV~6FShO0X1eWqhQS977k6n(w*4*MDe4xiQ z?+?9s{2X;mW=ljI+Z;1XJEk;=~uzTQwPR5O4n|M25VZq69cV>;RnoY?te^vDOg% z?11R!b$YFUFT1|PP=7TyvU>gA!A4gdAsdxOH^td|kn{?shYnQbM=yk|Z{Vfh#$MZx zqy-1Vah1y|Mf0Ai2cYcE1;I!-f;m)X0+V}vmue?^wk!UR7gd_UK6k11fpX>Ifdhbq z(jw!6RBQ}UelrtZA0}?y@~Sut5|{;=9=HnL=OV?&*8$lYpkzBV*16J0A5^J^xc)&b z0-v;ZI5!8fvXBE-!NiQri0_)BZgC*;GH16$@;ng`!rg@I)&0{mbAI*t4ZYIL0}*$J zin#ly&e4{ZB*PRqLeGWhthv%MeIU6%9zvL~s-Yj}>Oj&fnZ`hvpm^vF2b{*6hs_^> zHBcLl+oIh7>i(J00`w?fhav9WR@t*gHTn?W^P3@sEmctDg$dv~7gomAb&G2pSflL^ z2T}}+n<_IeR+-;W+l2Ve?h#PBv~`Z+>OUFYU_^xNEPS@=tEz%fum(Do#rsHpRWR0& z>Oov}cs7eUs?%IaE@o(>`izbIYD4`48bb_2jj6y}l#xk5Tr}LJdKR}EY5oeQp);QN zMq}!c?>byO!g%2Id^-vypIk?PIRAyf$QbzA77d3Hv7F`rE?c2+|5zeB*4~g*=E>#fF6iTN4knM&8=IiR?gKbhrLWlf{ zQnt+=TEVVD!e8pxLvQpl#>905l7S0V`~Vz5@u1Z-WZ$8&&~g%5>%9@xcRT z9-a-Zj@)+L&3IhGmT?>cK{GgXQn=Jv+E^Cy24)6|=>xG|?+#?v{}V)JeP?R(Z8C?P zIjSoUl-VDG^Dy6;tP3rTA)_e_2(^kr5td=sQpi|PUGg1Y&$q!2tyH*69hf2Nmr!mt z#+>XK`;w3t3=hoGj-dr-Y#lK3FDNbE74V&_FI2XXMi)328Gi@(_J6%N=(uccPTd&- zU+Zn$iE5c^`S2^B)F}*st*b?&Qn4X;L-q&ginVPTvO9jD2@3NN+;3&E5!oo3_E=dI zKG1~Le;s;*U1Z#nirdu+J=UWg*PJp-I0)huaEIOmh9O&=&^=9vt6a<(f3)vCr@2A+ zHO1S5ak=}V*iRbGs^_5(!u^AIPNEVbnG!iRF}9$i z5RRDB^mGH4B|$bD2wh+%kWKcp7417OT#ehYu_M z!Z&YMNF)s2z~i|cX8x*UL}2}na zB0=TPV}z!|2GRJf8(zP~GAFM+xeZ}3G`L>c4HhX!C*cUEx&EL-pzrPa2x2wG96EY; z(p`7@=e<-QJArx|V%)Q<4&37<<_I*eZBEl66CAGxk<@tP;Nx!Vt_{q%^Tl7zV?5^2 z8_khV9*|Si@cKkT_}HK*B=S@^2jxX7(CvvRrs4me)L(-Ri5q;pJe*{%po|`y8!t|+ z%&a`1-ccxit`D4~N46NJ;$+ZP{aa4gbU_l}S3>9To1d|hTOOqC@XI?)AeVaVS8DSL z)Jn8+vfY;Z~5*GV=;tnLRMgr=^csdYVy!0#Q-SH<5@a*tlw(NBL!i@gw zkI-YiY}H>5fxAIGRPL+EDjtnn17EpM4nl*hl?|=Xisu#68bud7CE9^?Dj$eIL=g^328h0$IYgYma=bPkHU|Mm?8<<5UcEYI;b9?*wS< zWE5W|o#UQwS#z01<}e^q;+*WhgF+&8(4i4>rLM+N?TYfuAjY>_Okqza1^(UdY>V?> z89?uBz4nrpQkOy-b+#%-I&F4-FowZ+{(&IgMZ12N9blZcN5oT7Q&SCoCVzftV)_@| zO*WsXd6tfsp4-|4>02}?dH7_&V28~3%}0y5$_{fcFT)W&3q|CzmxUGmyM1(J)QVdFc?If6ouC z$9$^ia%QUT08$kO`vG-5Z(3}J5FEx@+Ysnv!X@L4Ip;kLl^E3mGSIZzmc^=7xaut? z?y)O64V(vIs)QoB&QX@m&q&T`+T$9X_wx4MwczTz;C}rQZuMao>!P^@0 zkPBm6^h36f>+jBhQ-Gi-@M`13e+{`EM!J5cub*3b?q`IkKXMd{gg1Kea3gI!C*rGx zJ(@mO(t*_MiT4mMf%m&DZigdX1$-GHthYJoxZ=2Hx4qZ9+PZ?~MK`tv9C7^l);&dc zU2B&*$Xrl>qy%9WA4(D#C!Pg!$f2zUOBu*@x;>XL4Vg3dgxA3)E}T5d-EH6FQh@?O zAiw#w5yjkMTM%Il z$pJig4h5trPLHN!Dk8X<2z^;^M^&x5azDA<={sm$PSn5b#W<|FI5=ZHti9#J;LG=n zXRF|~D+|z@vrwtyA*hU|KK(qFj@Mt^RFzqEKjw(ANowxC8bYs)PInCX%+HSL@ zfD{oNR~LNr+`#c!SD7LD-5EkI5KIUTgN!oDdA#NF&c0`MMg%BjBZc#DjMtOtoutIf zMD;jPuopKHXxn<622~OV8-a~(KP%c$xQhX)a;CzlXizvhqI_+Y`UgJ*7RPAXIeQ<5Gih|E8FfJK;yC%24%SMbxy^ z_U4J|Dv6vmZmXJiy+feh69-kvzQUl)nOM+j4HulpfWE1|gVDhMR8Osn>b4+k=*x~L zdMzK-*SE~IZCM5_uB)sN>1oaOa2d)m>3VMoip_CcVqTup`-!pE+^zB6Tq*~g3j)2~ zw{BIqc_|&6zLgV5BW6YFjRja72aOE+Dr41#5@%hTL=%;FG~+a&MQ8Cm`8>e0_`<5HDTQwBYw~3sW{D{>`?dob^KHLzkcFvhXJoK8VOIlX?0 zLdw_x_mplepTN3+9S~W3kyZYwxWB5XR)H+@1>%Q>1)+yzc7=2QT2{FvW!7%7$va>) zHpRSmw4t)2vpodfOQNCAUvKRaTi`rOeSEBTP6p#UOxkEw%}>q*4-ErsHGF|194sALsw`FZ(CKET7S<##a|M@_4$g)g)^Ti}DOo)01H3JR zI z^e89EqBpoZRDsL5oF9TZCx#fG~HIDI6i0U8dZ9g|FfBjLT4pZ_sqCM3uE+%(jsyCtIc@T3pZg+14` zW`^6iFJ#7bZO+`n92EJ>roWI8VlNVvqG+4b~r^uHo)N1zZ zx%%d0a2yiN%5T;?Q$10&D-bOZrL560EYAs)i?i_vhO3LX+UZ4bCG4SEldI_X}j<7S`t28HLw3g+)?1tZ?jaBMY@dT$%jTFE5Yo zRI%W4{iqmO-Q!MPMEn_uYBs4B={}rX%9xLZmyWc(CT@l->`O%Vlgb6sj6EQPjkP>_ zrgVKy)9~vLvSKJ4A|)^bq-H0UnHYFvFBiAzke&UWVyup6Wny~?(;mdd{v0?$jVjN6 znW{>iybEX-3d|vv4qGC-?ld0zXBJU6#@V$lVo)sfD2y|F?Sd85yVs97Uh~=i6m4c+@4m6xMG|F%2vC0HN&~|qX zP=Ihq#)j|M9p|ZVBYvTaTfK{kSk>6y#*Ch&J6pMKu9TLRHX6Q>Q);V5SEfZC!i)~O z2z4?-2xALO(cp$AlOL2()!MW@h&$>tinw?j7vC$v*1qjwIP%eLlxZVzh55oGmPOnhKz`ik} zY;*70qAoY^Sm5==m*|3kd!@4buNk2!e!7Ri;K_Kh{`?tyj&6GT&TbLc<{FMBz@18 zCfQazyH7UAP)}AlO@+DFwD4|!OQMZ9AK3UY;H-k@o33)ogZe;@Ucq^u2eN3ZyiUnp z`%=1Hd0vK!V{Gk@hxB=i;cBvIKey3dorS>Hd+D6k-a<9){K>A3u~PmxS+u+LcFx4= z{55qxAWT9~zuu8~1G^TyTS>z^$3)<{Q}@#9@!Y$jG@cI3-InW8V`+43unmf|3k`^i{r*H)rU|Tz5y%I5fhU*=jRB z4f|kty*78s*rpq9uShLnx+vcvyta@mJc-5IG9apmG1k@e|)s>+lc|+Rw|W%41v%!h+I0#oL;^b z!WO=zh&HNi!V41S6n_oUQbvf;0sa^Q4Fa!Ciw;inG~1hGv808Hr4W`JPk^9}0m1Gy z=EXhdZ@S0RTm0n?1G;2KD3}aVF>70GRD1>+yTmAg62qKC5JNg?m>2KDy`am?{u&~* zD_6T^dr1wV?E`%=@Lso7jHcVdUq5*Yu{jc{%cD8-VaHrKLg1zNbON#F^vWJb3~ab7 zU0j{29K$PyR$b9Xv!A7m=D)k`%4WbJ+0^pTEuPu-Kibz)H|%=vK)ojT#Me5I#8%mJ zjEEOYH0U;(0GS7$u|pt0xbLF+tFuZXwYaT^4>xj@-2J&aUOoAOF=sDWtQi<7UfE&4 zEdB(6PLk@G6ZFdG#1CSf$&`o?hI(Tinb`E^rF`@{3K zUVo{=Sft+0ClED^khRZX4wB%8q0i9q{gZiClOEKZLQa;hCJgWSAo29kAnb7}vobQN z;Qw0P!7Sc#Twk|(*ALQ#u%gE8?DhmsS=nU;i!vQ>QM!Tj%HM-2+BUK&cKK}MGCr#w z3<-~^XoxD2dG-AF>RxZ)kz5}3wF9F2`9s>ar#-YWZgo4LokC&$7_reG zi3HKXt_v{-$>74o4648TCTr`i!0Ua^`PCDZYxnX_@$`Zl*_@>_-&xS`!Rcv-mK0NC zkO|mzYn>r^V;J2n{hVX}kF4teYbxp5sEdB;BI_zBD6pEEbZIR-LKfx}+2WqeTDetw_=d3YZ#b`6=vd#~YF`#gkUYu7FF%tU{~F z??Dnu87z28w8OI$Ti2rJB60*Wuk71-+ahNFB|j^s_w$yhp({c3+j8)+k!ZFrs4yed zeFDILExQ~gdYPZVJ34ee8bY4gmY+BWw38A&K%(vRbKmCTX)9|hr=FK4eXSfJ&>Nj* z)#~r5t)TvEQ!g+0CW+S##zL5SoF4G?Y;Uhl^wM}bj67_Tcf*~OhnfnN{_Mh5tfqW>hAmfe$gCz#BD41^v#FKTinTO6CY=k(Z$V(8F!obII$Hp`aa>R?qF$o{0%e3@iXMI~|JNv{FWl*F?hDF~hEN#0?d1aX z@2;FfV(}xv>8nd%Nn)7(WEQ#ZZv^92(DD7}PqAb%_G0zg^=U0U6t*0{)z*MD^vgVO z9>tvqbq=%1CfA1G2@qV__$qZu4Id&XL%8*`1CtD=^`dVK<(W@{fIOwK9eq*vK-GK4 zDg4FSJGSviw2>k_PwY|T#mb>}imd(j{^dK;61DmSo^5(_!5r($`hn!|2hQVxmUVuq zSsP-lF%2mZ1<@&MOG!X2G36lgc_`+x{Vz>p!r@(-QZI*EiL-e%Dc>-eSpDvatz-rk zR|XcxLSXQrLC?vLynNp=CynG!Ep0U3r>yx)4PVf+yanC5`I7<@V6^*qDMqtyz{k+n zhX8hgQWqp#ptz@|mSXxedq1^;(ReFKk-HrzECI~16_d6y5Wja&Ag(#*vZ9V2i_r^} zhXXK_u!tGG;XO4&6-U^=B%1ZX=UhW+(?SH0Xc9=Kw{&{{qUvY$8$dciDhGT009YSQ_T&YPQRCB6rgOz22NE4#iMd85+juRld1P7Y!XJ%h z2scW8TIZ&K1n+;T2JLFL^_Sb$yLm+KF~wu%0BVdsrH*2wIa47Xp3mRMhZL#?i(>kv zQPgs06!e{*hz8oXk*OmkekEil+RtFKa%0XOphwhpwLX8{)@Vp(u6aZvmerc;o&f5$hl>e_fMq~XR%zQkgY zT~iR#PEyt6=g1vHSE_Hfwa)@`T#<}AIWKQ|2a-H!L7xDHUWGJ#^f@~Iw53gc zy~2*VzWhJ8wKN|Ep!MQX{+T|>a_`kd4zukshXdCxmUVe|du5y45D$j{wzwfcPyfvm z=rQWrRR7#FcMULvv{4PEJaZ9{*y~Q7p=A%T{|^BYn{?a~!wCa!58>(7w)ljtXT?AK zK=IQucF(4vG1Ln+3BR_Ebk|LdmrV5 zP`yzx{O3`$Xz7i`_byt;gYvaPazdJ& zZ{AO}IGPFnJ9x1hE34;YAmq+7+LIGmdj~Cg59S4TTb6p~*Tu&YGu_}23ekOWC-E{R z=+YGbTq24&LLpTEkifa_PKO+u$Y)YNu^;K0eGKirp?W(DuKO(i_y?ZxW&kp66>Udu z0I=-(Qyxg;^kq}tE&;`8zyZ5qIfD>2o%`;eCs;!Sn2T}J{bmCfMnU^~bESJL!C9fg zWm=1pK*jtEF<*54j1E-}t9SuvV5c{T0o=IuzBBO;MdoC1QH*DIX*mrBr_^es^>+Ax z!cgH^v(it|`@t#Q_vZCe(36MR zc)91I|k_7?}lhfjMY_RR5_)Q81Im(0N-8EMP6sXAoo$pNF3C0pAGqD7QgqVlr^a^_{Kg`42F zq$}_wS!!Lg+-sY7;FS8p05RLfi0$VFiG>nK1uHy#%Nv+L^^K||5mc%A(<34djs}@Z zpn&O9_g7v*V1U`ZjbC`n)yY9gguugTPhrKrp~30%IcLHlO}r&Gt^KPB&iO=LiV1M; zXE|(Y>RY>6_9Z2y-+Q2@yi4_6w|-|61AWJh{ruyL7uNPe^evh8j^%kTKWi&%wVVwN z%?Va}ML!-&TuAa-0sCaXdc2s>j!%wfHSmg{13QuWXsOQ2Tb6k2XoRj_-1lt(&XN>$ z$rI<^r~Anb)=oQ8NGjr>xh3;;d&pnS);9Vh`?Xnx#Op$O+jg^{Dr5qKgUVqed%u3f zA-W?}U_lI^dN#@Q(x$DwYl)(r2WeYPf-uM&9ar6yY{mCh+m4N8pba^xjuO0mdC1GJ z^1O;M-*umf;O!|m+hl4qD-iXZ=rwHrjEGJOew!Lc*7i{gn;Id%n&{bAGX1>~N(^bw zzl+Jkj@7~7XfuU|OMU}9KR^Q!*PNLth^`V(=^`CjIQAkmm*PK+3gs!qAP8)ab;qfp z`3!_S`?{$4^<=>_sa#KgEE=WS-T}i_d#_VBc&?v_sh3 z3HD(xl4#|JgRCuW8w|CH@p?%WLa>hFYIEPpT4eDCz@n6>O5E>F+P$;>;sq!V$vc@f z$Ebe)2B#Uo(Q_dEw5+%ns&NbHg)$R4usv#VhUS)6*G4N?H&5ZSSD)}_>gG=j&(gPm z#5Ec+ZHVW^_HJwIcz(#(|B^`RGbJ1+(YRtb)Q3fJErW(Q?wJ`x#cHffsifrpWgqDlf(RoV`$ z-q}JMV3+DHd|!?p`;8GD?_q7Q^%S!#t5msDb|54U-hAHJ8>Zldy=pzQ^FlkQ%X&)! zTFBVfYi|J#0Yog*&W@^%&y*Dv3$5*g_Px|pZDf}VF%A;DJuy~NT5^!X(M(lUxaPFM z2s@_Wr!qXjj}TjKGGM!JxEB0F;OI*YJqm9*5u5dx&Ra4o6v}Hp#m2lfv5rbahx zks-zXrd+1Fr5c${tY1=TY3ZX5YvlLsgi{06Hwbvg8fLHq9Iy?is(jb0x^EWl15)A# z1hT5bbx;SfO+&evZZ;o~fLi)DX_W0jqFXNHX-VamO>jb7q53kl_2zjp*cTWVw{HK?&XPQJ zDC6Yr+U)jrW?Ek>rSu8vew{YISFdaBEH_= zyO-hVeqo11U7k6qZ4F&`u3Wy8EwR0PWPi0dAJzpkd4Ov)0jG%)V!F2H9S}6^gEFWn zF%S_E*{fgo+xwa!`mIgM{sN8oV*Hjl8s{2o;zM(53qP>E>#r6~UsX!8;kGa2`zy`j z_CR270aNDTcttr$|DdzOpW&RLka%919{iD6Q}di(3!kM;+<~Y?iR9yFI{G?*mf3#@ zP}9bv9-pp4maaWJBFD?NIb=$2^!5l6T4pO@Nf26VO+qY4%52g2uOU4qwvd-3H~J0_ z6R1i5u!$yjRY%spz+;+!DF!N6pUAPRjm3iCd1%>$bHPS3AR&vY8>wzv}A=Hmp(im2}!0dI- z@;913G=24pY=j8oiGwX8-tTsg9LoeN4{7Mi3GrB}J$I0F(0m2Nx>E1(-0EB(56p2q z4ci6+{rAbI0%sDNm8>-D#THyq6V0d;&F2z;82$u$9xB$S-a;&G65e)qcT;%lUScB@ z^tZsr2A9$=SG%}3DA1&^#EZG;!rhFtSKSv}XlrDsmFyZ0aBmq?(Z)Awr`z!}S0441 zSRO=Gn)_vK!`t48;eD+#1MatyJctcXr73c1KF*KXP#f~yB0^wcFJ4@|X`wRm_l5P<9Ri6nzW9n?9B$pC%t zySN9g7IsOo^?PJ@T|(ts@7;i-8Rp57U|mK@vjnMitglHso) zb%!7Un#H9n)xsIXiZ+QA03pNPm_$#03-ndrcSAZkD3p-$_R6c~7)dCs1EHLJRl@o0N6p2Cx=^gB zNfK*h)OuaG@B6MRfMhrm%yEcj50?%DWfq`5n`;YTm#f9XHt5C#?U>ydnL97|ssXq( zYLkoyYEK21;QRd{OaRv=Y+wYan`7$-9PhLGjE_*DE6|D)I4dD#DUt>-<^)L2Y@bk& z?>LXG-^r(IQ*|5#Er;-PF%w`2TFGvA*L3atMqxBHenMa!m@j0p!#vmK!}$zmfFTeQ z2_RtsSA1-?iC;TO$2#EZI}vNXJaNJP?0#+!ZVYT4rw{5j2&_?iWsCe(cSdb6mwo7wHZW1(`bN;gFJxec0Dd^N_4 zfsGAp8SAsj?SG#tfvHkZqCHDQvlK5kg(rBx!QV%_So1E+Y+#%~=b>4k$+wWv_b(rx z38&%YKR6320hK+2V_?;khL1UxgL@EMN7+n)Bhsyrv!ggcwZyy_7U>2qj3qpbL#qfblkb;p|*Zy-9ol$^3hvq zCZ=9F1qA`oO8~YuIXbb3xk~KaF}887{D(UrF5!Q-JPyvv9Zt~5*O6!V^bs;1%}MMl zSC`q_V>AE%5uKus50sn})4DBr37#(PHDNt4(*|Zu9gu(VxMM|$Nxv%#)Kf#v*F!Cz zr$9wT_GLqZ|GSp{-QuJq(J!3JGrc9r_guGSBQK`~i+Ziq#xa1lsE8w5^sJGcv3rNE zr;dyi^<_&RdTh20qkivAj=k;6Huvv7Pv6^n9uM^@vBvY2C-8-L{uq^h_1}jPQy8V> zCaZ=$h7aq}Rhi?*qGA&EeK`$#WMX1IxU_Zp?l-X6xYkOOxJegGFGbt<&IsM|by0`D zX~a<$K5x}+#P7CoODjn8QflPb=qv|JPN`MppMPG*sshHFDKarUD<%dMuW)9XcQv}0 zSP#*Vzb~RdQ0+Trms##2E6ve?C6oFR%atpp=H~G+AWPVPhL>G^^7U4GP9&+i~0bSVK!oOR!tCrC?K$nFmq=r;2WHGdwAA=cQ^=SK2g&xqa6s zZEVoEkTciQ#bmbtDl_I-+42%hwekI6W!RVL<~`O+5;x?M3=OYv99A(@Nulx^H|^Vn ztg^LsHi5Fj(^pFbDfjS!gdcm0pGZ4!*cWS+&goiDyH~XXL4SP$8o}n`k`lag!;zr(lnkqIAAN|o!b2v zW?}m){A_G6c++&(lbtP;N9UD{tgQHiALls^FPot5lYFE3H7nH&U>&6<@ucmly&o%{ zodU-jslqM{Wn+o|7As9Cs|HT*p2$QCp0kO~(~ ztfjig)+Y1hnLodwe2KcY{Y9FuUcCZhyOR0iXp%DTuHSR=-NZtKC3|-gYmpYUsixlt zUM3-W@lSG#6bT0N+7piV+nnwZKMAV(qLAcb8oPMqPDE6`)XVE*WqVR zyV6bNHIW7~Nl8g?2=IBI)9>2$S7=&mA-jj5UJ(&7oad66_vH!1{`fYyeCru2#w;7s zFyd(OrH!8Z%J`cG(8@}A_~^^a%f(#hVoL4%3p5d0R)ir8?d$Nv+!`u7nTndgg^sS< zJt>-*Wni2ABxNX67lvXfNEHd;TpG<6M$8D>{1xAF1t#{V*FV6U%R@PUJKchZccPr| zr%m*WhZvUEmabnv?Z4b;=Suy)nv5o6RIX#BY`_cc?!un?EI}cfO0K04E)EVE2M34O zK|$d-tH>~9*!K4J_~__mdV2a^qHwRR>-3(~aVF|3D1S|6`K1M-E}7*=vFW}W%ezar zTZpZ5jlF75?|bm66v46qKGEfij$#RoEiJ0|%rb9ubVi1Ut50qFpI|u4WT1JQ;SQgp z+VFt)V!dpL-qNe57T93`buu?Q+%jApinmQ zZC|=KL$*MGg1~^roj9KV2>7jWhW(@1{7<%86?6S9raPjlDhHG6Sn9c-0bys_d)74W z$aNWdhiRJW3deqc023)IAszQq@d{h$D4e@Vd`ZYn6=3Ta_Ec{ATe53^35Sgr7gsfE z->U>j-)*eNpu2rl zq?9>USIys#bLRJekq0+6w&E&WDkGyO-#}<-kMUHP(S@rY;%qzc+xmixLDIJ`T{>~% z_}ivw4LP+U_!(tRULnoi*jVs7GnxN4g>-W74rz>`Z5Gwi#@!j4isI0+s7q~_F+?GI z+xM4=4<;OMP`&GW0+`+7+CRvf$G#Y+HZzY0c8+%;R(27y@W2OGT1b>%Xw@uq!oqtbM zLkX>py+~H2dlxq~Va3uM3IH#7R0?`+gn|F*m5_LZ?jIkW<>9xtFE%+ed9^JTF;dLd zzD*QhhY2GTkuIAW1{X+tC}=J|=W^g>^l!r7T$UcOQ52b4nuT>}@B zF7_dEdHEt7Vq_#`(4PL*MmWBqfhNN3z>7Bi7KGzA^7A8aZpDMU1`eKK_&I~(%o|Vv zQr$vZBhhvC6AqbkJKxMolO$H0b`bYDj})yGt&S=0plk?#gXZxTb$d6m8XAvH(^xOO ze>K+t`(&-(m1}oOwS3Udw%7AkPEKsD9{P12qkPUhIAON=w40!6e<>Tha~cjIANwua zZnO>rBn73T!)gzN#J`W_;Ah#!e7WPBdAlY5^lfE0+h*sESV9S5?E4OU&=wM(`k`~{ z{5WigRg!toNi8RuW9O4`VYV5@^YzQuH(FW5y!EZ|L@hg|A==(E;3AxhO40J*>pLcR zj|DHMpZM^h;vI0x?kY*Yr8pl%?H^;PF`X&bBXkMj?B77xO%uPGNDZW|CTIX<-v7uo zc{x`V-J3to1%R_A3>fgx^F>0)UbHiaA*pO|Yd!zQkft?GjnwDzsBi+iBg(~P;Fmv8 zP?q-UoVPt#{!NM_Gaf%xdl7c6RWmeL19LCrQE{(=0uacZCt#1t&rdX0C9Z(J!Y7US zk_*@-c*b=m767SfM*u(fKUP!gdX-meJ$NBSu@LN#VDPy^B0>dle{aqNMWq6VC}h#6 z0YC~oy-Gh&*j_Zn<-!`bfWYLtaq#PteEe;xL~(j+Qr{r30#FgP6~^Tn8R2FVuFC)B z-|;c|00Vy?k$&A_%(GSL1+EioIh-)vqDhgExV?z)PM=0!;d;X{7eabLpPw-rk^}cM z4Ve|cL*fxBpVHYras*cf0?h9x1zOo5=@w){e~InZCDX|0;D98}lQ|j4g zTc$zh73g@4oUznTPCh%sX6IPs4dO@_Bs(&+_A}?&MjzObYQS);8p8{09gLI_*gSXOOXOnGk<$r{@?R! zX=LGIf>W6>5zjU)mNaxlM|FFZ`K4X)U zAnL|T%n9q{YlUM$5NhN{4>*pAMovEFynI=P@;k~+YGzukmQK7{2<{gzxN~)dJjfd{ zZy0OFUms@w_u@Y|@7&_&EWxWpKLDj9D|8)v zV>Fw+kx_v3bDk2%vN={(v-(4incn^XChz?ron5r46mgb-DxGxQeYZLw2)#kHQ=FGF z8hN7mLx{r?iua-S?D@TK+oAQ~UF8pzF+-LmbEV6w?hjBpnmLZ9nz{Nq<)Wf;N(vf| z-;QUnXEly|5fBI4@uDRF6vFz`&;~r`%r<`M4Njm4{cZThf6oM_;jA%3P3N~7&Fq$l zqeNZvL$hiv7gwv93HG7e&?C*E2ZwzRU!+9&;wknJBT|4vf#0kQsktQ$M0*7V*Ljdz zpJhBvf!Z)NJEhPY0yiQPBe}9ZT?*{H6#dE4QI4`|h!*bn7QXmFJ`lFZWO74if8~Jh z0?ly8-TykTn;~IY$m%H}opq(D>?0g&7L!Z7o)(P;%x>$-%S)?5l<83(|Kj1tqJqo# zhntq25Rf_=x2NHu`SpFLL_~F_feOL1qNCFv6sJ)>TPB-l_V07cL8hbrURl~_XvHgF zLkkYEl_=6xZeivO6lfcJMEMo)$Z_+CsD~*pSVwU5=DUW>Y&5WIgIffE-&y`;)SPOl zH@cfe>l$RQqq1} z$qq~19f|vDAF6xL$i$IC^w4k`{O9;z8vj4b3tNevm=*IP-DSU>#URs#nSRaW*zdW0 zP0nuLULfmsb^M<sGU zDNl`5X2G7;v#i1V-~nft8X^~OskUdtpmV8jU&N0e{x>kwv^GMuPjw6nx5>f>?9ddO zE=DVfd?$$>lYz(Ew3+VrbQ$s+e=G`tp$*!lO+1y={k3WL8H}0$6OsRd4NgB+YjJ%` zQLec6p1}!xS%wKKWfFO;Rz`bDKj2Svq=b2a;bz8z2J$m)`u49EWWE>|#_Tf=d=mdT zu9~Jsl*zYg*0JnjT$O9WMZUnKSkfCXUf^ZTTm|OQ)X7W<1+cJlx>?|+=~_vB~e!l?i~Le!_&tmzANApFntiiR~d&F9C@x?cNkMUP?P zah`X>6e{&9M?r6771Vpx4v*aM1Ed&8$au7hDZ2F2pP6uVYq)l)15z|OJat5-)w4Xf6<|v_JAg$z~ICS zYY~ufF-O6%EZA>?gqd@>tA&Q)E7bwp|+aqByiIaZGq_h0HS`inF( zJ_1J>(wdA=f5r;m^GswW$6nfNDyHj8iv&` z64moe6vngsBuC0W>WkTE#Scv_mk%(aC+v1$l!yd%dgGWNI@7VpS3G)vAIFt+m0rKt zb;j;WzQ0RNvF`Ryu6{**qWIr~m;Vx9BDetrM2q=xu~i~{2X3mKioVm<;;UiV%Qe&Q zn9{qnKNNq*%U8%LN0k@SFvrE&VM(t1z{|Z76PdF-u=xwW3ZfOaL4s_6qUtir;UteAX4K!O3Dl)3kDzlbC5 zDr3+K!g9q?!yT|w1)v{d0Ke7TGQFbGehx$vVGHaR??Z4CY7D1%lbj=r0FhJPw`cr| zotBl*VJx2mg%q0phWFz!~cCDX8fF)hk&Cdfj*`t0^apF|0#`M@p#GKyT-s zPtT6u^7;wE>r@SlQ2fQ~ot$qMR&J{A)L!8A)B%y%XlLgwy!cO22XUdn3>C`)C{xOF z&A?MBHz`h37O3;J*1^GVhoEk=@kM$b@>D}P`y%se1 zT5i5rl53Ug5;v%C?3_3KF4`KwV`tW9me}TT)n@=j<{BSpSVrO{SxMFmJfOTtrB0{i z2N$>hW*R;=3X>)?h!r>y?n@Arp;yGnPmAXKFo@>DiLZ`>;;Ct>NoU8-yeq_Hsqf2` z{lC|=(UfJ|<@BopFBy(C_lH=LQnAhp&y`*)OIhu!42X{3;z~!vp*J%s{}ea_fw}y1 z!D7arwjx(o?;z5Ve|_ncuC{HO{XAI*q$1$n#8LG0&~X+QPRrzdbphe*BtJ-WPdg=d zeK87b7y-ARqVjP{XSR0UWv5u}ucrUlY&}s|MKK*Li>N!d`=b>3c@p8o!kP zW9EDb&x1!jA2^EalsSM*9r(6X>%i%i$}3F-p08t6s!*l+m%yT+emOn#%6c-g;vpS7 z?D%wjm!I*ueCRg%$8bB)q^YAM^1N`qcojGh(sI4y0zmcQB2|AO0?<1YHl?Qb8wc0H z`W*atkSn(vNzKGcVQ<{6GzxHRI!HZUha&yg?V*>zv}Y zYeKKXOb^4R*pNCFYh^3HY+)`HhZ#E41x?x(qen^OH-wV*O4-37UiH$;07qUTZj{d z(zf4hR$<3pJ41z1H5nfc7{31(ufJbUzAL70$wYJUc=w)GXcX{UfqqrF8>?x|Aov#P zZp_J2K3x;=HaZ^hWPQjsxZYa?hRekZQYb^a!4U>#u~A=YKIqYhS#{i6cQGH8JODEC z$Nrnhr6^D$8zAvcEYr2i1jzt*X8moZP_9L;J3BP_i`~jK@xQ^>J#NVLl0Gs%E(&?| z?R?A&Jje+@l+Y2TNrV?o6eS0FReSv)Rz2Edc~p3GzV-wiE|0e}*a?p-gDnhPr&Nuu zT%jUI`EcBSvt}CUX;2!HoR=KpRM<3Gm!R9&J;iR${)159oO$L!xyNza2d+23IlI+(HN46Lk zwRAM!A(GZTGd{eH&I0$BPt{cWocQ1WH10l1|NC#mm!|%$gzid}_0~B|csSg7vBpoXpnh~!CGD^y1W|)nkhL!QIg2a9jX)@WW^93o( z;AGw(=~r6frk7INI5}^Y-JKOpR8ou=H005~im!%NM#hIbIbv!~RE$Kq&I}>Kz}(MP zwxW%~+CP%9a_~*)HCeRFRC-U$r_IGg5tN6CZ}+Lhg*VaY=-o}HSCEGJkyQS=kZ82> zQhDD9+u3Ej}gjmuA;k!)J)8NuBnd;2Nm$EI%;xe7sEUr_s z1=?0A5$BhxDWpCxwp?8lGkeuZ8a@tyt&;gX?u=^r8gGlLr5UsM^bq}W&*&2N#nYA{?mQxn{6g#o=ZNweQV&7X&$c}2qA1rqBbNlL!_0c^y-G_}*YU*&5 zO@lEgu1L3qxNC;Q3-h~THb(1LyAk}>vlAf!$mqCty#l^n_SoHb$5@&3#61Tz$8@JH zEniFdD!?OR-=-S$qpddHb13noSvrhsZju8n>)c7NvADI&_@I_@U!oO@#QV1MMlM7b z+JgGpItzR&5uSdpC61xIHB23g7cr5H?wr25>glQ#m8qPRU0!TH(|LXLEE9vlm~Mv0 zLaUbLd}18jM#3I2-Er$pHX*xv~t->k>QE?rha_g6)0;#i^WkZLJs08W0U2|{yHYc zMOo#!xf_{kS}!c5Tzmj|L}^6Qiqps|CgQM z6nXbF*YYFAY4uA&#b2VCP7WBDz8<(om`{}D)c7Ow*&t=fH=QFY>q9=RF+!qC&kemNuvw8DFtw&` zZLXU)@4{e!7R-=mOf0-*+3=CJ&f!y?Vi2z|cViY?HNwbux8XcEburhW)6A-)Dx*V9 z9c5h)Zufm}2#%R;aP!M-AKK(LGe;hpn}1D69v>Q zbGSSmy5gk^C~j{iP~B1M6uov@U5m5yr+aeB^0=s$3n-H&M$<=ToC22(*sxnsj!us9 z8Gp=rFSv!op>Q)Z)|BoISDf6a_h@FzIB}F0woD?4FC@_L@iwjTb`%%0s;X)E_Qqum z%D0tz-ND4uUlTbGR*^>E>=!RRF2}yt$n3Xpk#388hkd?~uoeR59JY7CJ^%c4V>GMTbUl6&+kKJvxTmk9fa@ z_MGGIqSr658?Os2da`S(($nukw~{$PXp)3=04J4ejl|v_IsLZQY=@jR-Pqa)k4B?6 z*RVz*%p#i3q?w{#B9MH=Qg^?gN#9u*sPi@f=YJU($UpeTrWTx$eDwKIy?(c=t_vUM z`YZLYt((2)(Ka~U%Z6ThhC@TN6TI6#Nkcxi=}R#>0=_D3Lp~>)%fGG{+&t&G5ZSZ` zhv4!wWt6ek{t>dm2^RoG#0YxFbm!{;P%Y}Mq9<&t(K*4Zq-Wk#M@I{CGh9yAX(T42 zab%>fylOxnI06HTGY+I@xfxXX7sY-72dpf$S7c}7hH&upPw(nFi`kj^U%mkb+{QN7 zR@+zdFfmS096I^o*%qmDm8)(ePS}?8kq6l{Kcf1;(Cl7C66VDSuc|r@{584om)vyNhU~d%=^XZ|BF$m?8Ay8y6}3g=nXsj4?}ki4^yW-s`VxrnGDGp zB(j`nHo#a(zqQWSL8-+ufdU!eR1N&(D+T8F>_@B5^G5SvufB71FMAQ@PAUP+dc}D6 znpH<$`E^6A8P3v)ZxzGSTH8~J!{Mho3khdASKdP62MeO_VR*p_mZSO)*Ja?D3frwW z3-qw5lG`>4;L2Cn^5SaO*Af1+WL?SdCt;GRDH79cPo6NWHU}X&)798V2egy@bf?<% z3Et$`r3woNQy$FC<&e(C@bqo3olP$`t{dFCAP7b3qMtPrmI?VJypmeV zZw$99=)Wy+bQeasmJ;mtc>dp1PKB@6memu}X+dYV66|0%@LE}LZt_^f=oevXqTX2a z?AWRE^`K&#k(qv06m5z?bZsT=&h%Cy#oUOQ33E>g<`WZRQ+_5`!8&@$)$D(`wKmsp zyf|_D!%Y9)Bd*Sc6<;pZLsNI21!jZ59$<*jth9UbF~&6L90-5kq_Ir(wn(gMwPdyV zz?Me5NCCbN#}Q<{yVAUJ;`cn2v29k&7IS@nsST)D3f7&Q9b%X;p0h>ilD?YUc~sng z5;H$Kn`R|s#XOq+`Ak+zZ?Sb&cY@kW7s508hR!C$7wFc|`mIz`t=gQk%$a;{uKdfM z0VxmYd^SBys=OvorMb_rftPnQj{7lf(fn)~Eg^4FRV$_ZLZ z#eNH{>`AiM>O=+{XPMTqr9@JZ?h2v9X>LlDI8ch}AxD1tL_uG#6FcYEPSq{tj{9-( zi>#N3iuU%>%GucwzmkJ>_H6s3TIw7gJfIb_9V+S}=OfFN=;>JB9b@xQ@Y#||$!k^^ z?W-+wlP*8+g)S>Xy+dg6yDGJ)zecL5EAubw7Fj%T&_^giQ8u`W9@5iicbwHL`(G!n z*n<~oxzdLjPYPOg4{Y?YbFIlLJeiFbvAY(E&_Wc{DaI!|5D*3B1-F>GKz1R|T&|Mg zfIXDLNx^r#K6*zu+_b$nRbgt<1eK6-uL=qctaZ{JN3DztEUEv0M+im2G@R=dLeq$_ z%CKm3U>L*_mufmAQdkTMEV0yN-c(WL@%x!>dy8NZ+xuD7(25z<={C!TceHW}5~|-& z#;4eBgnqjG_c+@hkL&8)Jw3RJo&^0^d=hq83 z&zUT6x3||CMyJcAKCE-FyOg2rkad;;m!rK9JPT8E##yn)t%u!Hj8Ak31u=&^P$r?- zrE&HacTBNP6OVie5*-%y_s7d24$UJ@UVMA1%C>+S$RA};|2TK*h^tt6N|TD@XP$lO;K07i`awMVF2IHHX@K(2t!R|MeYu$e~rufmw zLY+fpzj&i@VFc%FjuLO9C@OeDUq9H(d}2savU)Ots8J}R#K;g3pvl*6^6}%xHmk6& ze@cdFBJkH#0KkGF0;1!#8Oh;K8AK%{ha{&l6i}pdT zJGqo%5mztSZ=yfn73xg92JM@$)Zwj-{vRcQrr~4#FR4<)p5}1(q+*4A5^HR?-Z7;) zRiK%JB83P^qUi1XTtoAH9C8}WkMzOZ$f_^>_@>L60zgS;%X~M!9%7Mnz9o>Us46Qf zJ=k6xJwM}w%iE*h+pU>3PEYXEg#?Ef(jNE=`(c$;K6-1k=fMC3nr2E$?0s<= zo7w@5Z5?sQF;`HK0&&`NAr#qlH5WwCpuy(WhSm`K^waE3EKBZ zu^gz=P;#uHsnu99;kg5NcKQj!Q^CiJXPB=|owgl#Z-~&|&Y%M)p%3r++|zjq0YLrh zUY&2Mi9;dta#t~J_u_kx^YxLRE<2N4Y+J=-@+(NKJ3%*Vg>3s8@oh#R1UJemcW$~^ zJDbiT*vHRtkMH`8CpyAa`gcDMdd^JV?sKpy zb|^5wC^6%f&d_=ui`_3Oshs^)LpZ*0+%;O?Ri#wnrPj9#KuPLFoA3RlX&D!S=Cgf< z<;G`_TNBKs@_jscCaYlZ8!mk4-T9b0R@g-a;rRo`=eYS@nbqge3 zt`47)KXx|B;|b2i6D_gqFx^u3x2h>6k4Eh4s`|y8#U`Qe-o1;AdGi+xqvk{ zy!pfaVxWu$*U~7>@IPdal}DJ}{>P>hX0nv>snB*59#=`Gae79rle{*CuAKd@2Kzt# zm+JvbpXQ~YhTQWDk8dJ&hzA*V#GgzGZzA3hxd=Ygm{)V+HiaHx-tCYLVUf~#82Ks0 zT2I9O>NOGWnMbGF-d+ym*R6Y3QknnEp~`zY*-msgB7MeJKiG#dX zUU0!;pkY$H0)$n3?p^5%^@W8pawUfPbEg5CWEy?><>jByQ#5?fK|c{)GU>fx%u1PR zk_Mm{6sPw|qc&%76{=PAt?)WT-X@5t(# z`k0CmZ6qI&G|6@{DDeX8>72F1iu0p)j?tejGi2X<dGF=c@CBqK9(s!d%^|1~_(r^tP!>l+I!SEn-6sw>wvI7?xBK6ut=ophd^ zot;}qNE&C|rK0k9Q74^03G^lKqERAs^5^(F-~k-iI$$7@NRoXy2D9zG1A&2-*EkV# zt-=+*IN{!#)yp&1Cw@pp1YN1<8n&JMaM{s`G&>ht+iJAYF9F=sVB1Y=?fkAxy4lx> zPBS~NfS5U_H)Z-S*hhi$)FE6T6JD8Y<#WXh4CwDj+811}F0MCNUS5+#4A4BTc4QIV zTny6|dhF=NA|JHhhL$K^H`Bsr^rgNNKlYrWR{ro`YKr=d^A_Idd+RX}qqc1kZ+o$# zdpjJ?S_;dzsfC?k<6J`7D~Bqpae~-;d;7OeXU-^3wMj8Dk9v}r&z9K%?AQ~&CsfB1 zy_dn%nZ;N>G{+=mwe*n?;(%wxv~qjF5_D5mfii|TCcNZU1==<3k#gpV#+HWmGxSm^Uh`hJcy$ePvU70|gr=T|ZPx_dEb3AF zf|%=SHY7(Y(X(QH^MaBdQnk~pqI{63Tk@b9V%a+S~0}-8@O4wHZ#e+lqvw) zgxUO7Y(*$X%!pXMo65Fec@@$Q4>)<^EYDzXadcd%g-4&R*-&NCS{1{1((d}~dO4Pp zmse9M@D8|kyhzygJ_7KG2(82lxtpv=#aaAJy=D0LmnL;*+>Ds_)U8)|^!=-HN^%`< z0@*ZXtqU|)81q3m$S@Euoec}X0?E_W4IB-Lo2rYq=XFjT+L`a%E_aH6C!_=58{$2} zH0YsiFJv{K0Ejb9E4kODw!L}SD8BAG7weFE(wtM+_L0M_sXY65 z^z+(UR@H!%zfjf$)ej#oUE%ocu_Q?AGwm-T(dVjCC_MsjKn_v5&5sp${-YIyJ1`Na zU+BTIye>NH?BnaZ?_@xuiVue?7iju9lC}C3^z>$!#~lC3}dU8a)a4+otL+IE*os-9PKTA*7EM%^t&3rYiOK3 zse1P}OUT*NM}9l`hIw$1?xg4Y5Zs{a!UDbT#TXM>x5{fnNNlT9t5ecSuV|%=6+ zR!7V!bYQxVR(bX!Cv*obkz?7U6(_bOLyqQ*obV(spZf~#aY@I^1Z(VilRFb8 z4d1^>nw64G4rSp#r;V>{O@4c&MfVG+EuBB6h2(1cW+<#jC@zbxQ%cA!-JAVOCQE#8 zZxH(0V+J>JS#V<3zBA!+@A}Z7eH$O;Re9|GNJy4#SEd)17{Vj;D#m!9L1b#MHO8^^Lvl?1=(E z)Nk}Iin`y*QcCP1FJ4O&KX*lk-JZ<|G;ii^Uk=MwxK(~N|J=C?S>g3zGd=B>#azC{ zBpB$Ak4)!uWE{}|oU(J%bJn}B%!-wgBnn0Y>3MD}$ALb_@zI4W@PV;8ILb)9e`N^z zzqS@D6u015@TqwMaOtPA!JS{Z_sd^%OX|YNC(BGd6Zu&BxVV?&Ak!;ItmXp}bCGU- zU%4$J^rBcwQ#5}L_&m32Zb`02ekPEXPOInAM~_4aUww{HHcfZgm#?=rz+goqk8|>X zzRy^N%&W-Q&I0}F^!Hy?ba)v(82S0^jikI}4!@CZKmK;pnXIQZt>G% z(kLpdo)^@!E1)IrcL~_cDuEL5oBlkBP4qopAH`@BKIW}Ht+{N9@S)0=#Hm%@InXRI zW-N8HNBrMfPveils4Ot};2ffsZ%#%+Y$c1e49w9Tu`kcK9`xb(H&-P6kwL%5l$nZ! znnZAvmos*KaW%5EsgI2S8&-j7@cq&s>7U*mCQ+aR^^FGehEd)&a~+-U`rM|-iP~LA zL-Xj-PLAfxHOv#=A!vOMo--w5cM7X&kPEf0e?-wI|G8gYTC<0kQI}uwr;3Bq)s%dIHPW@o- ztN+qr{{0&a+&LbYJ=H;Y2n05f{u`aqjavf3A?WV|9TacQ!Zb9ZPkwpt-eV`;Y|BAk&FC2)a5ytUbF@3SqtXwPo<4SW>jl*p z(YSvxP=48A&NHO7mz>mHo~;5?J9JJY#AZG6ikr?~$|CmS9Mra_v9lar|LtonV-pp< zY5AzXkXyZ^sxHr4n-L)$w6>e=^fq-995MhFtHkXtWo%!HIFjezZES#Tljcj`T$PT{ z=$!NRE|=8bjN`i-cwx(Gs|YFub!ANt1buUsY0Ka`}J;IrL}w>y<)ypT(!e~8KL<^Jk_8e1ubnb@Z-=!bJY_(c|D@sCcb;l>-99JEZ_(}u>+HUy_KEdx&teHZmzC!chgFW^ zd7>-Vyf~z>3c?b8dPgsAk3#aVYLCfhzXt?7zr@e4w9TWOeLee(8TPMb!LPz*X2_b!7V}v9W|Q=cjFX&yrI#$;4G4VRIxt{hN|aq* zUJ6H{u!pK^2BgkEVz+v0xH6lvKy7HHorH&8S*^-jdq#v)0uGTXI*@FPO{H=DZ%MSL z^ek3+ud1(i3SHMBUveF-D>At*yPrm7NwuBL4vENYl62KZ$##tPQtufxg>iQFcXG|H zw449|HzM<~Fgia}-J_+GT|*;$!x`^kSZ9}Y{(NyJti$4Jp8va|jkk-hMrl0(;GRuw$V!Hwy(H ztx0Z_9eu*H;$QdHPQSM1yHS%BezlG8$c!>syPc5ywZ0zSHllU}k0NAV(*nGrOVeEA zTAxRW$H7sm`_7*`cjLI8P)SXqik(kl=BBGzbXD(m9nUTGU@iQLJXj>L3Qr>2gO z42yIf^jQiWj3f$-I*2pF=va^f?Gtzm*CGT@ z1wGL#y1SUqoUet#5LwsXE|2?pzJep#L=IlPfM+k@W5e_m7M+N;SB!DZC`2LdIiZOU zqL%AUmh9T|yR8?$#H_lWtiiHncS`SUklAPIvr8N`)n+54^1f$kqXqd+fzkBGf7_j2Km9b ztMrwR?6?$Jp5E{2@we4UAmH%4k7l$C<$aoa9QPXh< zy{4?5{OVeE8+bI>To}j7jUm*^t!PJ9Vc^RT556zZwW_(!2SgPr9fCW}8DOeEBGcHU zYx(RSFu%cm$KFb`sn6yJJ9^s;E3BfE(vxd|VDg%9W4^3?t=AVgSw(@K9lqW6&@rZP zZU;lG8dhjcL)~LO{6aj}$x3?t#PbevF~?B(6e%^>d1Ql0>`TL&W^)Lp*H&b6t`xv{MHIA zQrV20BmI9rLJTOd?WtDa3HsfJShi!+{{b`TYgN>)_=h*CgT-y}11FQy(o290S3`k1 zpL5STWg@nv^9CU!gZYfhZC-VDt@uYS@sbjq_I=sZS#HIPk&5y%ucnu?f^6{%U1O|? z7SHF6>rUOb*DKV9DWEtIGKOW=Dq@WQtDgCLoVfz|twprsO1uiBP_XMM&WJs@Dxwr+ zrJ9`C8eK3G&c1zyZ2f&bdR~rMRv7XqM(6)-H_n^d_Ws=bsK|aXn_Rv!Xz;|C}YboNf}VuYWYt9v)(|RpWa&ro?== ze1G~38}dK-wdC;=uS0OVDzlyfccl5~v7v0+#f}kInRBh7Eudz2`r&=22Gbd_D~)iy z;^vhasY(YO`*t@)%?2eM?N1qTILbMnEo5piHy`rxZ!quq{S=Iz>k439G28gf=@{M- zJPv1)aT|I6?`#K8P$>^Dr!UA7$ufSer{&}xKCGQklwcMzz9oEw(=HgeyGHi! zU*4C^&mEAVnw$tRT?*Am8K0gkLP`4PC?=D>3wfLW`V}cO3nsBAt+=;!Xy-pPfIb*; zS<%qLCCl4y)bvE^_6`34r9nugSRG~%5!qYqB_O!DsjjHGn4mM$jl7$UH>sP^9nc)J z5-hh{*GwcSE2;DVe|6g!he$0z04fk=F)p}BQZXU8+Qq{L0d59pa)ga*U7aL0f;{F>+mQzCDu%hToCWZlrS!#xaKTfVEC7X~X zm32)pt{T{#+IOc9Mir!izLd2sliW^(T~Bqq?zYd^rejkK4y2Q-@hYq-@L3;^?g?d< z=s&rHL3QQg{&s$=-kq9{Pm<+9?)=67?d$#S3a;P5obfqp^;x@H&t5T8qGGGU*psi) z%+EK%zU`6mK2GT{xS*lro?$tb4^Ytm6g%`#nw6$?_aEncP?i2}X-+q_|1 zI+_n2yfXJ%p6ngtkjg{QQoz?vg_1f_uILEFZe39H&R#fdH&TrLaPy|9W4rZWl{FY^ z7}-hr+~!mtJu}>$qh_vmZFSLf`a%O&SzHM`XQ~uqrAL0!cOetIFaSy>QAT{JW|LxUVWMkAH8`GNu5t(Wx zK2tp}%?;NVt{N2eog`tmX6|Nu8XpsG%Cl(cif{F+OZATvC>yW`!W*{NdEYX2>}YEz z2C+_IS7d!wU2DDUx9oYQ7awnJxV@L=kbHPuPsl8SJ6`3Y&L4%v_z|Bx_q#G2K(`{- zo^Vbv-!!8#WoA&OS8_CX%Xml}9C^&-MRn^f8og_cPwG-fSkHcbyd{Yg8jdsS$%y03 zTgyFg)K8~DI%xEYo_A{1K=(!K>4EHuzNkOO%I`araJRG!7(`m*byDiRy3uAWEiGq; ztEwKDn}Y|0x{s*x)KYrF;mW zG*&h|(9qVl$WDFRVxhSisy+>3okZhNR%GfRzlYVRd9jzV!#2CivftLIab>lK#K6W@ z&_QKQm-NX6y4s08|NPSwH*=&Lw)V`xs&cfzYA#1N1MzXX{)%{>CTvqzK8he`8_axW zdZNv1PqDn&mUHW?b7-8JerG)g@m9lufcPJun#z5ynlQ7#gH?_INTa#ry6sSm>Z=ey zBrizUZwawiSDqhI)k zmUU}Whg@&cY-eY!>(Uc$KJkmU6^?OyUc4`y#gAJ@Wg)lTD2_E{Uz)Er`Ny}u4`q^( z4Cugs_cwbg{Q_NskeD6ETK^;|0UZsTDsYQ(Stkdp`Nd~&>{hxEd<3oW89Wa*qg!R&>r9$i{mGTb0=C0rv1 zX$OdQg;-bLHz@(k#2aC3yld0dv=vz=1HVe!BApCfldbL9jz-U+NmaX^!gUTTCeeMq zKU*Y6{mfV`m2KFWm=(k#>fLjPqq^vVc`tvn3?o|;T-AG=ZZCyTP%+gq=WK3nK|A#OfC z{!VTJRG?MEm(ey|_0gdD=ZI61ky~tVZQI{hY7H8IC-b&OYJvnw%G@|Z z*P%D}MCONpLjoYMfB;tE-g~IwQ{$y?%a%+?%NG}MNd=mgzmYAi9pqYzArNQYyXZI-Hx}nYLrL##R>u8UIgDz`I?lK`KcvO=`)WJ`QH^sWf zmx_B;ip}=ueElHrO0|2&ZELcaepI?*VrwRgk zIs?lSmLS`%z1zzn=dazOsHpTJj4N zAC(Bd!Jsv0C%_Oo@LcW8I~wx0j5`A;B&Zyg(ac-sASIsotK4$zfMUecr%%s_J6IJW zgw;~6Wh1w-pA;kP`ie7Xa@)qmUdx$rRm-DU8{fu`g&<-sZ|FcMda@QPOqXABb_SqC zLB?Ayr&Z^-3A6kt_GHJc7j5w(IpvG709d1+hlqZAsy;qGm-L{hKW^6Bd@2ZJ{9JBZ z{0g7l=jxZzue`Er$)L^+ncpjnDTE@r7%85#VcWCmGz+p0m@i8ZLFC`|zk0D(+Gr9^ zEDZr<>jlM`kqJeU`iG_wJ+y!uhYB@B8oa~g1{49dbF&%g>6ftRp9K|>N`7!WgySC+ zE3l0{Fg5i+>snbfmC1l#aB62Y=t}Wu?%R#}zwhuU#VEZcvZRJ~0f_B-Z#3nyC1!n{ z|HNH2r(jRBtbMI#nn1W-Auiq@tno|a<^v4q>cU9IyBV>o=?n8aj3`hzL;0wP& ztx9c!^K?t-aFz0cObkcIxeJxPX4XyUvI$^Y&#xg0F+*2xh=_;9!ua0zo7LUghwh#c ziKZ1=d>JD9$enj%U-(GIWFRbXSOGgwGYk@~w<#dDXG8&#`j+I;?@*6*j%P zK%FVkSXb$!>M^obeT|uVDcdRAFQ-_>r$Dp!dQBY*MDT~eMpf7Qs@+2jE2!ka)NKC# z@J!$J!&8yM*qE?XEXZp@;_@0zs^Ns?(`gl_&b>3$dKJa!c zlwzOUk@Df6o0`Gs`uZ}e_ki<)m0F68FLrZneU^Isf>spoh_TZ+uX#_Vd|O?siBxXN zMU_nwoV4Q^B=IR^>Cz^w1o<}Dzd>OR3qSPP51x*5!wmh3Gx${v8 z3FZF5K*2DKQ%IGORV?!n`p(e37W}3BY(AI#n~$v(Er36w<7R~G#c$8N+Z_r*atQs9 zJiB^9)UoeFziFL!v_|NX*?YKSw1AkcyT`=eI~7hHLi7FZ1^Q#r5~JaDKJP_I9y5a< z`(*+6jfjlwHo@+EdBbl|y2260F^ttS5_kN&al}WCSAjQ2l)$fDU6SI5!CnEfg`)KH zsH`}|y^2ixXlk3fq?R6$IVmokENx7l#Ud9KtR@MA1m|6n(o7O z=sFKO(yBv*8r|mR63y*B@K!}eq0S)S5TsoP0TT21`~hcFH!j5NprgI&JBLeo(nkYp;P>YoMn7b0+nSvwU<#P%>~Yel$DEc0*- zS4s3H0T+TY;lEIFaD4C}Z9$}RWaKb^i8s!bM93pt-#U1#m$J`HJB;YZ%)*v9IsDDk z)UNCNe0q+bk2~8C2!0@|&ah4v8KE8<8=HhUHxG#Lg~nbo;BW9;QMk~3`HIWKho2E! z2lGb1#P&EXDg&G69ij|GKjmxqjKc{I2}N_z$cyjyHM$SDFrU0z>03Js4qfBR_5av@ zJBGVAS4Ux+M=47xr`^F4rlDcW@@f28jKd)7kdcJr-SmMZJGFm&eP3NI(4F6owZrF~ zXkrEo;1$QNbe-n}C_=NdJJPEM8L6w1L@_&h^r&~OkveY6_RZ}O&H`RZw-^-ir6{TC zQ=`rNO!S$hMu9WitwFX#(i~pUlFk`vPh-FOppE9{J}hN~K{_KP{U)lPZxQwUCfzs;>`qVHj7Aj>fvJ|mHXg*qODiD z+BUQaWQd29^jOIHZ8~Z(ieF0{XC47+(VqTd-7?+m<;j*rJ))^><269OH7xxTaJay? zL8;LbKV^{9Hn*BC2o(pm|(YyyK}?z27>E){n1 zhTW)JEh@OW7Q(39N0>w#p1Z|2Fg+=$r%;D&OoZ(OTLxemvlGfJyAL!pH7M3<9MG=t z4$(&Za}$4N2r%K({>4r%&Ti3R3q@cgFky*S8(CI1(^G)DaWl|%^4Q^(u@7=9$#X|QN8T|CBWG4*;7)MjWe|Q`eZ#KlM2^`fBt-*uk}h_k*O_!)WlXR0vbIv zx%%L=(c&fD%Ohi7tC+u?q+Cv!c00_>S14kwrWo;0M~b2w{i(VfA@Qb}woP-0x#G*0 zhFtZxXP*-8M9`I^G>g*C_7)qN>Fg^2r7BE;G7wZ(=ksc59r1O*y$Iau*RNF=y&x|O zvQMwbVM0u1y%)vO7K3Ky)6^D&6M8EJ6S);SyQ6VT%)U#TDN!_P)l*lT zfORBn%zHBVuUD{lBzO9#l#YClP;LwMR1l%gT^T4$b;oyoa?5Z7TwDJFV7P8Djo!`4 zM~_c^v1xh+L4iks$NzUYc8~i5VBW%0mO7Vo6`d}VQB%+EaG*V}n^;%$#D#YEl(leoL$DM4t ziBHjO9_Th)p{Vm~X6B}N)&>DTicT-#m!b@`A%lX2lCV|3WvwHu`Oba49j`<+bUUe! ze(ro(iafGDgwZ=(U1w=0Lwgc%)z3lE#l?HkpPp}-*cALN1xRW5V0?<9J3DTlJ~f_h zQn?suSOG^iiGBFTDS8@6zX3;M2~&s|NSZ)ww~e6F5-RMAtOSkVO_fC(Uy>!F)^=u# zH#`jTf6HQTNp4BMU?d$F+`sIXY(m59E|~Sl0&_gBAc{qg;L9_T+nuj@kHpqD#IGXUM<)xH)11!h*H&Ql~g`;F@D zsrA~MmaXH*rogl9hI14tF@}FT6?5}>_F{qDIEHD~a(gHJ)fq8(8=&2+2r5cyS1S=4 zdgrQGthjl2tTyUjwCM#qI60+C;hg~|wsioTDJy)WCuO9r+<|gno>+6!S}i%M*A88w z`-vHsAa1~d4}ee2I!)-y`ds?<^&IHSCm%i>&7BP3eKFw>6D$KJlEXR%$|hB3X(@8@ ztiy!TsUV&B<1VYN*{H3wd_qb1@`P|2C<kVBb3-ka=1`-n4tw!6?{y>>_Sre2zZa-KAaT&O!CN|2o@W$~3}N zM$(Y<;h%~5+1R3*g&4uzVhfM=u@0gM&sh%*P&Zt94-O(7W8ZePyjN7$na^Wk!}5gD zQ`}W{>FHn0o)*w0-)eg!mHEsPA;{2w?HG?ygqS1s()`hp{7#PS+($u)=nFtREoC!Y z9{|dCe}@uNUn&z!QqpdIhM8}&KO!|1dtS&ahTEjpvojlR{i&%#Jyyu{H8-eWWV=Zw z7~htDATd()CkauWOQz0!=F{5?hc3lZe~T|-lQ=U3mD_*m%QP&3=wm7?E9o;?&dmz99{=<?4TcPoHjutWWJT zH?DPkq;xO}*L9{B-m7*+)_G3<)o)pI&3;w(OS`#MZMe?IYv(+Pqt5kiq=auCi0C=} zW+?3w=z(t+pmHO}f?>g#S}6z)?AnzfOnL+ z(3>&o>E{<#g%c$_As7#(9e{fK$w4s3)WkU4|FR<#Wj-r3El;ba30;~VJ z=H}McHy=D7GTX-wgBf%JdWBIfI$`R80Mj6Ww7EXwee794KtH#ZM%aT^voE?=<^aoI zR)2f@xBZ&Ihgk$89wc$pEHt2H84<%F%qKRQChUUG6KE2hqhY*Vtj11GDDLHC7OkPE zCv^Iq+m$Up+C22D(H;lYqyG(I__uC~_Pbt_t`IKMIUp11OEtD60q*=AXM(7ct^GmN zhF)SHN-KTfGNi$EeD%*?MvKB4t^LF@gu?THJAhcy2K~>$5+VJjFpg+Y0Mubt=Xs>q z2t}Z;X#AY?JIe6BJxTb>MbJ6m3k~!3sIHYJ>Y8vm6@Ug@c3lie1A~>w;nS%y2uXk$ zjex+5U+3bx(@vllJEjn3VH+Zk-72Jz9HXns?Fh2HNs!qRs}4m~IuN-jJ4m4}m#_4i zlQ2Y?lFq)6CwaNKcjiaXTC-2}1VE6E=*d+?Otd6Q;3$4uPBJI}hdCrmgg?SlHcpQB#{P#ze0P0&tNhsP_T1{AYQ^Y@G|P+m3Bi7^3N1=EDFrCYqt-6DwO&g|XZ% z_TupA)alry%XBZyTN8m?qKrwMM)#zPvvW8|qsD|%?9Lqz%z%9#R(VIfkweNY2A(3# zH@UX91~FEkyfXALI;U>t%s0AP9!@#(e zcqMIqAS>YTWKKe43_ypVyWf5~mY?JGjL-Qxm(e00zoV>gCpIO4cL|PSn`QOJifx8x zH0ulxvqh&H*-rpp2zS(=3~zvbVH%<3-o*54{KFbmzj!yC#` zGe#vJH1Mj7ck^-X80;0O@Sp+2TZKyH*I`nj83TR?y|xT*^aMI#!!>T_&v|VeB)8cCqrH}GY-6@SVG$Q5`x5A##!D42vDQiiD_Eycx#x~e>CYZPNz#XOhx^0VcV11m`Y3~h#vK#XEUwi?~= z;Oc_L)7z>#*~Tz~NI^;GZ*hI}I^&_rVg5;58kV;wO=G4b)OBog97mJ;th}{xdcwFs z_i{G|U8nQrfjn@_G)*8u)h$T_Jl;u{$tZjZtjGjtV%Ge9=9YMS=Hq2yF`K5t-=lXW z#-q}I=Yx3qiSyL0%DfH#A#M2vGm%viq6KAIaUj>}^Pe>}R`k)`17OK4zjSMcNdWI3 z5cf2RuFs#v@oX_OBUPJ(I5bHM3A1HQyaitC?hK(usX^qVpqTY!dDLb?MQi0O5Rzqp zA|*eJ=ws9bI>|0BrQ3$}caVanu1)LF`wFH5ZU_&I4?^L9*DSajIzIw5(ZHCnpz+^k zAf#Z&d_h%2<&xG`cb)NV8Ur#9VeA#-n+K(Z5&t~-3ugsnJ@REaqu0n^zPwJ4laBz# zTu?>axeln$ffQkIgkzz3)SNN;%o{Ug0x!trIb@UQxzjM9%9d|^EqI$ryQ>CYzChDXsTB#X7FA> zkAX0YK<%9a!-D*BMs%gum2lahw4AtUQ;yl%P)?R(5mJO&l|m-eJXp|Gk5{KzFE%#(}wxQt1`p-d^% zi@?Cf;KaE5Fpa#fy$P}&m?vjMRov#V6CA2Wm0djpa;?}~dF*Ym%-@CK;zkSZp=xRj zB5Te6F#w?PU+JJx1lewZnM8Rzz9}j(_|1Ab4K^Al z*s^rFY698`m&ZkQM=ybqFhxyjTAKZqvi*Per=&_B5qz6YO^@N){@71|#6$kRrNfky zrI4KawGmGOPSR_+I+RPcu(=t&yhM!+!=@_59(_%5$T~al^;-Z1bpNZ>*yZvUU;oKW zThag>XwbdUC1Nl@y<%Xv(ENU%q}xm;J}_{4xaRK`ey`27*0v_S2`;Z&mcO+Qh?!ZL z)c7jifAgl)@bdCyQ)42=UmSZIh>enAeo8=X(>EZJbCT6rha7My|6zD~zIIkVzixiS z{cu(9(pe(tee-dT2eY%Y>wrER^FxG4sA{U{4Xogr26*(-yL)caOYJ5kaOljE{laZy z`y@3^xqNelFi4l-;_e(Bn3DtUD}(YYCNXi-FM8A8vW-?z#1P8d83k%>+>opZqDr+BC<@K7Kyt}hu$BphF(5nJ zWfUGImAj2d0u?>8i*TA1liiTi(R<2ryYr4`^?p1s_ua=v(4U`-aT4{%HI?cMMsPcM z$c6aW#pHVuN)V8m>&rHDRFW+XI@Cyl=w&82SYC!Wzo(?Az*%o)Y?ama6fcwA+H)um z@3Kjd+8HS1$BVsx*mY?C9|b-Gf(&e0EcJyoGo%U!cI7I>uib(7FPkwr5uaUrvoFGt?k!nz8^_-A#~#>MU+uU_`@~E$ z_YNIMjkfS@JRf{f&ta-*cx)Yt;{+(yfmzA?!oYhz61&`Oj9oP;(qp0aViq}+?gSHj zkW9VBuLZrUsHbZrbGG)4gU`NuT3DSED_+Q?tN9?E8_JWtU-NPnt`Wc(HziDAw-<)_ zma%+kGTz)^@7cN}Aaq<1SN+U&&|l+0=>X#=;d{Lc%s#g*yHYB@2d~oDr)Y+Z0Q!C3 zUtfrxb(^-19dbQI;QZjx4`@oy*k!8JXdb7UXZ+w1CfR~pS=!GEBm1a`+_Df!BSBV5dl7CPCC;V$1ga`Xl*7T}& zJZ*qV-|fg;G0PLvaD~U;+*P2q$ru0se@0w1)vEii765$A5#}}#2g$*jgt=lM@e;L= z`h;jBuA~-!&YKgbVwFs z+$|o`ol@e!7s`y&Q!#-{=MdcvwBjn#lK+B?s(Mr-?U`}#ZarAD@5ieAHGtu_7j`J6 z+py~9e!YTQej$Djo-;BRG_~<=wNSU9(rKWOxoxL!z2u=u^+UDEwcnZf4YeCyF>8%@ zGXd4$VXu>vau4l2&7wiQ>BwU{Zxm;nPV=-#tb_3i2;C@GSWnC(HK{QMF{CeDy8DmN zZN{lvkA{C5H>fU4_2}r#X&cpiP-+mNEoycpWcr%w4IZ|C1^d+}!2CfB=eCKKcyKQm zFyRY@G*24`m^#hF+#`TUVfS`DKi>tnJ9p6E;|REgA6~D6-11fnIR#C1KAxiL=#Lwi zyhLa2m2=bG+4v}0{WTFpWd@1@AK`9@L&3kMctKk)WQKkHO&_SNpc)_{$^o}9!LYV! zrXN?5ah)1ta6-1>;_xAKg=bn{s$mwla>T_Vu8f;3t1|$nwSX;Qka9p;|GD-rA4R$O zHMLQv#Qdpe%_p1kH+y?uH#+g6cNgl1dw6#<4G4S^x~SH;;pLD<)Ve;H z{(y+7SOY<^?Ysg01%nnyx(;5RxzFTNdWRh%scqyM5HloJrQ+Co09AWH!dELAT`;uE z>F%M){nAw8{0ktxttY0s0S}@@eOs=}H=6Yh6!7-?IkKS%lZV|3yGFiWq?sCODxJof z*a#o^+Mra*&AMrlWZe5!$%D$|tq8R|gwHa5{jooPy~x#&-wf@(Qr>%0X_!H_N|U9R z&S#cLe>%X>x(gNSn(M~PLyR*t_w1>`7k?H^z)Zu7WR_6CB;U%VD*MYY_iJ?!IQXGy znTw3}*q8Ue9Etw!W^>z!9>V)_Cm6Qr?5ML+j)_Qny4%cj#-?U0*`m(e!8u9c};dr9F%HemU&#%ee^<%fawfzW=n9_X6t8E43Fr zfF0{`P=hnUB{e&GIPXD~A9zW>zN{P6$GM}YCGMN&M{>`;HmUX53=Kb~NwPyn1Kswn z3GaC=^~=ov;%m6hS7iP;b1vZ&t(#af59SqZR$h6O&(C>-IkP7aFxj2^*~9sNFI%j( z5H{i24ySXpjyGwt3usgaryM?$o|C`w8sy=BuTuBRRrai(Tp`fV+g;DTsEZ-mB!I%h z&}+pBjJ4>Q$zCz(rO)(#-xFF9fJgpAl&4k>@wtaPzw(9ZTsGA~&mPgT1~$8lz6h>0VMf0(f@#oX6j=T#f6>O!kWj z`5Qf@-!mcS(O)XFv&_OCX1JNR`dSjfy-`eNtq&?}psBHhfm^9=afKUM2@HibxCTsU ze1>nU#5}>DD5e0W&He+3OmlbgTTco)?Shg$(#F3afOi~V;%mC$_D7u&Y%$UF>K!og zH{;SS&t&{r{wW(KZ<`v}@_zi@LLB2}Eb4$^*-d6IK^tdKc*-0J^>U1hsy2GOG#W;H z=i>f^-uEc*#1HXnrwQ*D05|BL=JeOS|M*GT6aBZEzelB?)jxjt(y3Rk&~G|LMP9}$ zCUQ4^iW9#Qc{MRhgK@LO!bFp zUpJA*`~ycT`e-uHMd@Kj2e%f3>lfeBzhF?4OL`ZxYqKTwDq94_$6v8-;JH|Qqzg6DDk``XsSRSgRv zS*4{vrl5s(mYOZ|@=X)1PsxPekXUJrZZeC!Nt4WGowuB#jYT7}t1bt*NOQQC4S`bX3Z<6+7aiK{VaA zB5rybU?jh-9GUh~6oSninXXu4*EPYq3WhKuoDmA7^#-kF z${4EUoDZkQ!*k%0thhtv>|NLM;LVAT!vypu$*dn;x_jWI;~5e&!|o$i9Z7F@0$7Ks z!=jg+v>6vDk^T7scEF^!Mb|=)ByZ%gT7t%U zm5*?1eO4J`lU?VkM4XBH*4LK^net;X^48$C@2a;Wt=%1cRyTqZycGBg`h1t`%QHm- z$!^+0l8Z*urEPonpMsXh?03e)(iw}iXOHiF!>WEMk0cQxY{J^dBdP9Mc5palP2dEg zDW!@H!*bpFX7mJ}rJ+ zrxz}ApBP7Xm=W_@!jWc%6GZJ3_9m;f?U%uX#~97)?{3DMpEl#^HP0|2tJnKX`qX15 zi>@cmc|}FI#p#`*gbGfUwLGmdG^7c(facT~gHIAQ$O z)Lk04S+X-TGk5ReJQR=|y;cW@W#(fFbB#?&eO@FoY~c}VBGqGF&E{ktziatCu7}>VEVDUG8e- z=)I8;9FI`X&nNi*XUFm6?Fsg3AJlJ$p#Yf9cpCWkYoz_@Q(+T3)ZulBpt7yw=({lk z9>qKkoZ4kM1WlR0Al&gqh;#~Csq1@F%%ph;>g#@-KI>n5`uf24r`O*P9jHTMTt8Qp zT2m@_EsE{%j}~<@8@vhAyV*3|TdVHB_>NGvwxw5=?&2kcTM?u`uY_8SB=86v|m`y7eZc%BD&O z7qu`{=8kMm_Ic|~ z6#S5p4wW{ht{1_&&c6RfGsBgTirYp+o?GfnG`TsNcua?v)tMw^405EFc9rg4MD_7c z7vT?_^SX5#IsMWYM)qNqL3l=tzk$&vYvk1@O3jN~k2{13Rs&0XgzTdP2sx2$NkJu{7B^gakuTuL+Ahgd&EQPT5K3v^aM#Jj=RREu|&G!p=R+l^2|#A{O8?` zSSZw|Xpp_WuF~hH-A9If3v<~x5yc#Q3 zt1>yp59RB7Wvc)*v91ogvF>zju1ioue%fhPDKU67 zn;Mq4N_LY#ckEIx1G)P0_PzVhhh@*+^frz_acqo;UMgVt^}R9;kVuZTW2A28Y{P&{ zn2`E19~30@Q0J0rc4A8rWhRIDp}Uw7`DrIKq2QrQ3+gIRO{FhBR$iV<=hZUNO2*1k zQ@t#<`{{GlqdDDbBaH3NB|y09Hs&GR(Qg%HP)je8tV&LtPk6tX9Q)n`uiAavh=qY| z?2rBw1{LjqI=g0RMWbeEx`2|?giQV(2Jy97X80L@XN>dIv98?rrx;18M*#f%NRV_B zJIkKul-j8#8^xL&ZLS%?MqC);jQx*e;9mZ;Tn3g|mg`-QN87&^ZH@;X^SvN4nh-OS zFmuFjLp}c5!h3r8D01?V$uT}C4Bm^>)iR1~IwhTCl(MdzVk!!&sHjLCZdGnWXxEJ) z$a~EcbCPSB^&uc+ANteHw7|3l0Gj*`7TTe zbQgAtGj7ISQ&+dRd0*KAUQlZ%LXViN$MBE??y?t1?mKqwc76E_P0`iDlBPuVlHWrS`T^j4G0hJ*@^ve#b%;)jTTZM1G``~oHVLdeOZ7%)_UMo6-D?$ zhvMk!7UiQX7GG&pxocn|}9P-+9jI=0;NS}LyY}+g#;uH$xnkSB#CcLCHj`KDdM{^{Q zjiIRf?m(6OMAz^-ebl9iA~A^$i|zeyL~*VAd&s`Cp0OW~c9MTuD>P<)GiS*0;Dp>o z`n3$}qv{bV{$9QtX2?4jzfbBeAf|vaMDro2eBQA*^+ikr=v%=mLQ2urK^6T6|F6L1 zE=^c69b!1*+T2fOWnhDua9?lu1Bt&fe{gd7?I?bzZM6NB7}vz|L1EmMh{AYI)3&v{ z6R{S;3XiD8phk-{<4lFhfSglm`3U%3-S7*8oQa59KbVO-EN%BTkfA@`hPVLQkk*n5 z)huJkI1OQ93b&Wzk``<|o4DTiW+z3Y&W{hc(SAJ;vwi&+{OM}s6n|w$wrCKS>z&u|lSJI%!vio{xm1CPxM4^oB!~yu#5!U1@5=2Du6!6R8 zQ5Wexk(=y;5F)ML&!U7bJwngoUzwn zK(}`r_kVN{oG#7e7=Gj?CvJgr%a-i9-3Sng1$jt#ve0N_Vr5IXnI~}TtSWycKjiLT zkUCIwM2kvR$@uu0dQt`?t3VuCaYU%#XWTVv7rgK68rN* zhHbf9VZ;P`#d@K_hE=!kkmJ7^q}T8!AR}S)4i?I!sfmVzCAw1mEvIGUaNB zpWcq18@4AfGWs6OwI5UNS;asONm3u8adMU9*xVat5+5BcP-@>Ww7%_UhKn1xK*_*h zm!6t~pp|h2-m-GUXL9g6b^{dwdJ6+{!%`3rn%>*?+za}C0nZ;V@MVWjSg-?Bk7}c6 z^>*P#q};}?EZF$O3=o~6*gw3|p1S;jt)s6d zIyz?JwMdPJ|K38W;7)q@>w}A4l!WXT_3|ZdG5pfyZzFBJCZL;ep zm!AK)C2LOX#B3*TvcLW|ea&gPDi5jRrs_6{6_K)LnvFdnnG&(U?j~P3knYtP574L# z^?T5YU+mhKm!Frv>x;wGq?H9vyEEc8yG7ddw?F#gyPY(Rr-I8xL^(AO1rh80PS%q~ z-B2aiDH2F((c{8lIo8YAN0-K-@cYR70jLdzB@mvDKID!1`njxs1J_3|A`La=s=qQJuGdaN@0oaS_#? zf(2YhE^C$b+RB@C8|pzfN5KU9)V-TYF_6;=Rt>)0b@-65pO!0FNm)sxx~*nN5_zcPvJ#d*4h)tA`Gfo12S3_@!Tz~tt z1P8~7i_&nM;X2V=AWYf}U){GVBa^d$yy0$Bi`b1|iLyVY#}ZDC@9yFlw;X6JH$lrQ zG>pt@8*Qa6Y}(z%SBvcsNwKy7(J&TG__}3pg7j6S{cRPl1dvq>Nkq3;PFUSg1FX~m z8x<>dDGjP})BJyo_D z#mBa*#P)p_xR;F*P~C|<*ub&E#`@~9Gb55!7nu^RuIF^S7!uAwHovgaDYm981de`W^0`dK{eO20#5E* zGJ}T5G8X_c*J-j?6;g5?3sge*9)Lrc2uu)ou9CAhmn&{!61!KWBTz9bFMHE}1Tj^d{`&0a&m?Jhu7d-nW<_AjY;*?Qs0 z{?1S#iS-%JVU?laAp`(C&}BOJ-1L?C&%UJQRLg~VnxG^YHJL#}1X44LBkskt1POPH zg-{b685R`|4Xs#JVV}t(}82D$EIEjmZnwlN1f|uUhSU}jRjV$=4 zHUZGSNBp0kHt9mAbD&VobbF`QTGl3__d=|7=O!vMyYk{OT#ZB+n*I>tMxm!Iu!+aO?mZh5vT!)PK`-o=HasU|Qn=#CdQYy4IT6Pthl&y>mWPeWA}!WVvC; zg_&Lh$~xF!yr(=|G;_-6ui1dr?G>vK^V+CrVZGvKbFrN*GJmGR zjr?!+foeZc0~+pb($4?=XbmOD`Gw)H0l>#y@u77vsc)T=klT!f5`&aL%s7N=U)bKH zBws)#kn1=#U4b&!z9&WqDUe~!)Uil%YGvaR%0~zY@~MW690it#$Avp=X4Mzo*tI;m z$WKZ8b|Hj2LDI&*Q?nkg3ftyp5DW2Wi`)3R3S_ALkZ>%gzX61xp>68-EG#N+|KxQH zaJW_Dc>$4{T8}5gmjBfP7-^9(Te?yZ9J!iHi65vLDBiCF<-A3&pO#Yf9iT8tGm+0N zXVRM}vrBTVNmXWdBA|VbH1)ssbXDd;?8?TC%8^oeDD>S;(i=@o)ev!H&`%z6{yF%f z!t%=p=e+NzO}jXT+ItwcDsR<8!~FNONW$MA>GVG!Q>XiPb(Dcq zEum%#$fQH1Z74UP+CT+5Q<|%q$<6u z2oWh6=@0@q4tmuQq}PBAklv(2z%tU4k={`$ks2V700Hvt6Ku@5zIFfj{`l6r=2;68 zN}hAhKD+$(Z|~=Mgn?hZjjVXfg}E+6?@N;vB@Qnoz5S-c-6zYO^Km+(zD66y31()p zo#cR{=+xu`KR{|(a6%p4`&#LzG}Z}dMv7>ZGRI?XT_^toq8vJoEEfU)u$eGfYQcJ8 zXlh#WHjIXq?N#IxTAGM&8OcByAfj@u@50m+B;9kteG2V=_#(Ko+1d=`DY+O!9 zxi-5NJx7@mS6z1CM+a-ch1Irc$30>_?Y&L8I%gk^JmfvAA3x+2Rm0Z=0{%F+=&sdRUkGMAj*h62g=c zBM|3yv*D=EwLd5IXSEH*2by{i?joo!DU?lIS`xmw1mORB(VLPEfY zzy+ravWOVA-JKfCW@lvLS*~8MEyo}W z=+`aXw<)qwdlkb}j64?X_B#hPF}8g{<6Z>#k65O+XVn!)P1b`msYh@JoHB{sX6_g_ zz*1Bc^;E^8s>iBh5IC9vUNjf$jL(8vTv+eo{g9!lweVKd|^29H2lXcrt0_QSZU*{RKTLwA1A3=_5_FttuR zzrLOi%?FOEm-fK+l*}zu4rlAG;EXaB-i6T`cRPiB&ubN$&#FAUMLWzHVP(80db{&=!f)Y5W*61ZRm@A3zw=R}rQOm_wGpk3BgnP~Qg#SdMHoS7uG!)=ie0A5D@aCOlT%W_!CwsoTipotsKHn3w+;2hcn+efH0(2p07XC-gSY|d97fDY zZufm|)JFaP@jTW zOD*vnCh=o&1^`o@DzS91?)6nVDYTBQ>+%hs+pXULUcYL%KHy(-tDed4qi5n7Ylq_6 zOq8g99IA0v`VDc{p~K1^Y{{Y}J?P=kzT%O`X{!3{XHm)G`*A(7?R^Aq5&;rrt;7o5 zntM99WXpQu#ses+`q#SCEe;401T21X8or0D%#>u>RlOt7Y(s?+L-)4)5dZR9Qp`-3 z%>p|yMb7b$12=$O+m20$g<858;%_2Qq~ZXV@z=d2n{b-%Hbre+G(zxlC}{|(%+v{F zv(4Gsly`jen&*s3YFb_JSdXUW>1I@by3()j>U$$B-}c17FQ>s00(5PT-1KQcu1!zv zqm2e^83fyw}%{58$f04#^cXG<>;H# ztkf*m>;w2{;6x%;AQj)=&D8WZy|yYOe;_XYD*sz@6LTr9jf2)hfH_8$`|WNIE2gtg zDB5r~H9vXPw!ZZ%o+%b$O>Q!T8o-M}HC3yjYqU;@1x%`2UkO2{ht>ivJb>x~;>!6( z<_n9ddU+mVV98KS_w&GMpirH&kOsSsf)6?7xr`mN21<@( z3YH*`kAn(U4J70g=k7_vBcORaIb?pl2Yb0ymX>WFf$O;eX%0ydngoQT;o}Ca2E>{2 zpG;2#IjMbztc=-FsEtfHF8Bi^Xt`a4gN%Qy$K1KVW^tT&bg^(OaoKE6f}2;)@B8u~ zvrxK`nT=5!$^yawKuw}DM)F|eeZroI?7cIj@qC+hRI?mSQBbuA=cV<85v+AW*8=K0s`)7LzN49p3)r3by^64SJ=lIVrd5ex>N#I|Klo?Sy(@Xt%7vO#=%9w)( zQP)Du?X62jOo!I|s-rvs+Wk#K_@SqrtihE|Pg^eB5RktV{@k3^IK4*){d>qQm;NHI z1BB|`UzI?9i@3P)#lhdqU7v@m4FbFw?J1pX+Rw*aikiLLD+&)ZL1i;XGgXUaKd_~! zT-TFBH<1Sf8lwWDAjxwwVLMAjZdqybX{g0Xi=@E++U)Dkkyh< zXNU_hpiumc$~V64!4;kt>h#&a=_ME|VFr2=pwYsPWZ9DmR}{8&vFI6gv)2W=YHFQ5qCS&s?PYM=M1WPt(r8@ zgNKMr)u)%xYNxivDS5kGcDS79-Yhag{F(K@^&D~cszc=a@o zpJeD=2sjIapVP;ENlO>AA=3?(^g0X`cX?gOcu-Q{PpS)r?lK6zDo*AesJ-H~f1%yP zD5B!_#$v?~w%r*~-|mg-4X$2esv~8r0Kq)kw+Ar}dPfezSbB;7{_D0@;m(+yjeXud z+xW(5(GGZB7e-S`yl3#)Ig9|m{a(x6`ho@(7#^N(DlSMdqy$>ULB2GuMip^gOTq=b@*9Qb8V z3!O0~;a(4w$3R@&BNONYw)|@JtG^`@tP`wey`XUCu1ue;yYCvnm)FEdRGUF=Eb z1GhvJvj%EWm~FBv+lo9y+yhvz;s8zME(*1q@XB$qU9n)Nwqw06Ze`n>QhLAX^h{aS zhisLrPE{P+FQ_ih3KkmmptI^4qDPX;nI?Ahgej> z5GWCi_L#{!#~?(Hm=T>uGt^e-xEWM^{*Sq|&w?gJ|v*}20GM)>$zTt5^ zh3sMGm+6=vIajr;epH1Yvl%+3_NJxdzDI&C5gdaYn=ydZ9&$}T!2dUhg}LX4PVm9t z9}dS$cf?}{!K0wBi%>Z&ap-C+@oXcZtQt}enT4TgRH~A7dg6|{h=4#_8i%Ua3EVoK zu}*>zrXB!NO^4#cnU-f7KyK$#ut0$1bEH(7)7|?4C>`Mv9mx0aylxJMj-<9-d%(?4 zd25s8#qkoRvBD!=`8cuN@)E_U5e*$3EvOE&AGf(4aiG9LnbF8}9X1ZtrYvs!gm~<) z0)fV!n#qfjzOr%+6}9cibH1t*G(*$|yS01lo#3lN>#dyw|8YE%Yx`9aI_p^Ve`Ap* zh(44?SqXl4sz-rv+{n<+f`(czQ6SPUjgLzx+Y^bp|4x4uKz)#wEQTqcc0?cnX)zGu z>=qVKk<@5v%yVtXtngB74AQxF_rtrZ2`mTdjgZ1iwR@-ztg& ze{V~(E8C^_PafY`lz&!R$J|xtQw|rkNw`!For$UlD(l%Np*tZxh2;9Rs+?ndD0wi96$S)zS4n4>sFTP#kg&K`HWAK@} zKKMi$85s4Z?16iN{ctsXS@Q}|dq8hNyi4#J3Q=ax6rZh+r`cAa;E zWtzMR+ADFx2QzCHVO)u;?sEsRy#UzeS| zvJY>y-0rr;l1#JEwso@VSaBg&unWq|#|oab6=na7%rZbd>gylcengG$Rb8JhFZ42K zXwap-7)l(fOkD71#HCj@96kR=h6YI~qh%P!Fuvg*?e9OOmPF3Ge@f%4*RNVsnj*q1 zMQ1$PZY^m=R$RZnz7Q@g42+RiKvl1V_zv%e~`{on_B7khU0!u0Ne|9$jz~Q1IyqW>b&H z_$xvZRWX(dY4+?a1^TxiC9PnPMrFNXPfo;)Vr?4%EsEP z?cVIJo8|pPX~u0=R=iVY_gy}Z^7trEf4E%PS8wz$A981vi~y)UgY{r9G(vwnoJ z<)!&?|9V~O^0DhF8`Ko?b8}_-J2}_N3+cSxml^qpS~+@_$Lr?}qHIQ6fq#9Rv42RI zvF;#c_74?WnphfRJd$tbZIFLdlt)D@Ns?fEnCoM@9v-%$YJ1!#ygncs=i@9UG+R#c%vu)1 zyH|v4TE@9lR!4gjOxEAVS~sGvd=lnS+5?}!W&}AhoHmA=Jh#GNJU$?1w9D0oupi`t zG0aS+rGE$vxHOjJPYI^3SoTdW8V>W(LWS3DuUN@j2d#7gqx^C){$pMMM+01RATG=y{IR(ZUDxsbu$+iJWd;3)vF`fk(Gny#IAVJsF z>F_w5sBKzK>xP{-3h~q>Y3t(sLkDYeZBjGR#9a2l+|UuA)(cA1SGstzuXw3>Y3XgS zjEcfsNzBX9;qr2Jfv+dWzhM*BO2@W@uE~>=SE^p>k~em|Z&E3wD2p62-T8_@0rGVC z2s_N%k3B8eeMOn-=&icbHbOieZU5`(xyd-ZU8>$GR~w?0_jKol>Z`mX?p#BQ{bXn+ z>2|{@474;1jq^RnXF5?vQDM3yX7pC9a?ynOLf=(RbY%xSDm61h9Q2{B^yy8q?;pz^ zXdc^*{SwI2<}6ZgQ~9#<`6lLow==t_$s*rxeHhw^sT(^EcWVA>y#`O9hImuI?G zga!+i)oOa4IjR;fcyMJtI36r5D|c5IyhVeq>cSbnncCp95RsMzw$kP&+h=AH=)*UI zQf`-j&9m3`nEpD&UdDNyUSCnsGMzz-e!RYkSdVLAa-O^{-bcRLLy*dV37uo>!y|@G z-@HKMR}Excw70iU?f4#kSh1idD8(i8tq9kK*i@f2H8dPN{$Y~hxZIrRU_xJgrNumb zVMLU3_i614f#T%c70c&Y9y(A~8HbF#&ZR$>$18q|4wH6GK$LNw+O62S?5sM%KFlJt zJch18w!B~+nng#@fVW*eBlSSK#p+C!4)zfljS@RI+B;`Z#WAYpg~SQtrS^r^Dg<&B-wjW1hwtTws zk=!%bbKK8$E=uvr0?wOJhXH-~nOYL`veDbVIvvcr9;tL*R z(FLMbeh`)7NF>e@T!-d6v4LVhcG-gNR(&!A8fsgW! z^~5hJK`>{&jo^$%QG&lu6pV*3O`IA?_BORgJ?o<==ll=U>VOJ`iBYa zU5;yzY8ZSD$~IV_Fw<6`;BueS;G$98u;hk9>cU)swTOnllnK!XPq zWd3*7=ukb?a;|U0M+R@nE-G)GJLyyHGl?xrcel2J8)5`GVG|yjCurKZGd7B>Hz8$h zv#yQl3wBv-<6S7GUGr^XUD>sZM#oxP8HKEy&>bFWqz;ZW_BXtu(DLq|AJ`~@o{M}= z&YRV!kZ*9{QAw_9cKN(x?m*SG+0xzKXrk{A@*j&`Z3tV@*t{Giji%2aj{Dr5->5-S zR4e}SyW-dQX8bEz{vsNMvUsi!s)?k{jJNTDEb%!TZ{ zE>CUBPR(|#d84iF3RWf9>ms2p?=RE3Q%*b_?(__v^i|Twf)M-|kZr5UU^;sH5LQxB zI8hQ{24v1`@6jX&(HTEhZ3BiPN%aVJOJYCFTAEPjw9gc%D^(<92vm`RTwU0nY!WHCG$Yaa+TABK7m z!4or%S2r*82QSmK8t%|4#wu$Gy_K~$6#6J7m{}6HpAM>5(Y}>n0MQXSBgC*5IkI~tqxZo z+XtRq6`jf_?*`NIx-=>_#%MwiCCE5TcvE1Y#XGeygp|*-x)<)TC$t)ZB&pl9w+!NF zoP%muj;==NOw){`d8N26IPni#*qNsQ7m%DV-8MDPAID!ibd{ml&Ay^KvU~tXP@@#w z*E}e(lRTwFw_cS+;>Xkh{cME#brRlrDZv>@f^4cO0IINVp`qnCQO3%hBA5x5KXH#` zf;IfU?scFA=(N8wqevqZppbIO^rfv%O0g;ODq--rgNsBbhup}2WPBT#bkupXbz=#+ zS+U<=iAK<+`Ep`5>oEOC3V?~~B>Q=;iby#YeTsAa7z%|~2f5P=#(V@L=;s~UXnH+M zTIg$~h_({EBXVPj?39LT>4Fs?isJp3LV)2Y>{?Ke^YcGg+;=H__+ z&j)yw5*n^DpLcfq{Ajqd&y_nrqu4d#+shB4?<{(whk_e&o5Hm(#!YnkRU?{vg>wCk5?E?1^3Hi#~go94zG%%g6HGVzDwm-pPrbL!24-VT+)Rmu78T&rA< zT8-s~7bdD1OU!}#>J1`3u1sb%XvP_Yk|07hHZ0A~ECl|(fRqkU{7f)zrE+K>b8e!u zxm2yJi;0ZdHD@3dQl+@2(59W1+o#S+N>Eb9C=nL?#dqtk(Ohlc9hKS^PkparO)6$% z-QWiFy&nvWjIYcRFBsR8Ay6p~&T?h9l==zGz%Oz}QI0XBvd7z->ba`^d*QkxJn=5b zt|kVQuxlzwLV^O)17M5%B!G`0o4JTBo$Y=H*z(FD#EBb7fF4DYx`y6!x3a#OciG?k zyhPRa2MB{n4)ZR^{U<$TjF4R=ZwLOK?G`*&klESn@m-l2%ht2|>bMj3u8I@yS?kvM zyWIXfo~e6WNX(rsd^^`F4jtMnpacDWht-s4Dn&GgciFjmPx*r3*9NZ0DE51@a2Gtr zW!iPX>s^}+1G62(O%}QLQpPX$#_f?L2F(%9nwu7dYF?|Rj6c&tPOW{a z)uPh%2g_qouI}?^k;&A|P8pMRiH0^FMHAG%wsoDYrD_Cu!J5g!W$;IY|BRr7mB&P5 z%}$$yiPfjOz(xseoAVL2gL^3@3$M4i$Pa7K? znh~X~qVrXr0@mCEXFRr&k?ll$Ja)C)ee*0pnQ#7mUi4k=vEPIj0-?Ht^z z1#UQkZfJQX%u@Y`GA#Rl#JnndmAQl;}#kV{MilD$)oO_ouvw3CU)v$ z3F8)(3g&H2R3HsfC9-|qjs2qD_(#hTpOaZBxJOt8_3RYfppP>wyz!MliHe5|^2G~Q zke+vTbi_D~dDwL?T6X68=@u4^Qwry>`6c!a(0(oS7MKk_wz1DDC5gC2W z#tc9rTB7XrJ)}1!(q5{@8>9xCs!EVmPwssv#USOxfkZ`B$dl5q@wvFabIICb z*?_#7lH0+eYUe(Ns*TKkWb<6c#8ob$V8pR2L2|4R_JmOAyV%@WE(xGd-|`GYuWf_% zMM(bOW6Ayx6o>;wO;``{5^o$B+=trr`nQ%h`Rb%`KhQI>MQNpJj?xjiG7dcwEN2{iW=9~9UvpIqT*qqJKgDU-Y( zyrIziZqu@p$v0$vd==OIP-P^pn6xt84UCTl=f%WqQ19vf`3V4HE48d_iR?O1A6S2E zV`Fy{EIcl5a+ip^JRX6?br!3)6AYGF6Mm)wT8!F;{&=}x@yT=zjiTMCos66HfmDjx z2>#rE(baX($LA#eqVsuX0!t8rFGL`zZ3&h1F{4Q1B$#Q}ZdFOMwC-r;b#41}ysiV$ zJl4T1FRKt9?KGxuHG1Zk0z1DeQl81zQLg*+=GC5WH`aBNB-ps#O+1WST)yv0#&j>icgw|*bc}h zlS({@ZLL|<(%4Aw5sd(QW!nocT54;?IvS7^N*ZE zd+x;L-@m_KKtLWxv@}PS+TpOOS&66D0J|NgPz&x-lT7y(!SuM=UGzD;ZaWd}en0Gf zaKBD}N9L?9bC`Ka7vi6cw8~Oaww%07Xl_i%V7+>n@R03JK-#B{8QP4d@7A|&y;}5`rqL8g zQz0rKRM@!?(;!8$^R<&@1TJV%v@iO2NH=fN=a1XdI6r&orJcI8Jh4c4WU?~s6|dQ^ zv(<1}W3vUJNW$S5kB4LAs5uCzxWVSJy}zd2 z8a0S8Ov%fTmfKlyP+VNs@&pk?jl>{~mJX5~6&E;bbhgmf2`t3e4_z_XVyqxV2mP?~ z@U!#wzw9Rsp0=Jn;A#UHGgMepQU!oTHtvzU%gwXj09K9JV)~A?ibge>kXd%)NQ0q%N!= z0!_PoQZe*S`E+DrnZ&}gLne2)8t-t_+q83rdEtESe>B$q=iV)WzaNcMmDEdnd;sIJ z+iU9m{|^cIUcxkBb{zVgeg}N;@cfl&7S+NiTwL$M1a~7dzVV;GPdxvr7PdM-)zZ?^ zjK_&UC<*RG23i%XXKb8bt|BLA`a*c^9D=Wp)TRzily=2pqJM4G;8vVOWaV2hcwOB; z8&PyZyh)$);x*i%^O@YlA>*4Z?ga-WE7;%SF8IFHOy>HrkLPbA*WR2Sns|A=bf3u8 z8{9kC<%mFzdC^keCiJ46k66Bp%n6;(@(=i=o-&B!kP{e2>9$2pLd8-hJ3u`5(~kAT_j_ziovuCDpjD<=Evq&H8W{`CWDzHNCAorvFt zRXykWDifLA0;6ZGjpKy*1^8y&J3^wW-PyIk-Zs6iqQca|VkCFPQ{YHq%Mv#KPD@L&^N`;p#YY!SgnT1~p`dC#laru%LTwih+bk(LG*hB0EiZkxNAJT& zS6}_FkBp?os}V)u?$H{dnQ_=WVtw+ylwTsa0K!XRyuU)lT)|UVW8>{W3uRaN?E^L^ z;9{oFkEyvvEnV6(ye{s%pQ=VvTb`8q)(LSJF%xg@?p42h^_-obS^-bOEH1w5D#VfB z?>V{S&+9N&kdupX74nbojENDhEls{Ii1j&~l$3VSYiT|cu-IM!Nb8Y=>>W&_kPZ#M zjgjFW6*}M|{rOyY0x$~l(xJMlO9x!@^MS6sUaHJ#&_9U5h`UH12nvNgPP%|94<;Ic zN57|Ym=-?HER0Zh&J~+NdMCPx*FF(0XZ!J_#YKH_DkWFuPWu`2gwulMQ^^9eR0Gy;sX3z@O=T5iiLOMff7>Sjgo9_JIkHS z#>SswwL0+g@3m4jGCdQ5S9bqykCWsHtqs9DxadqH zFDK`&3}4o8*PR5aAl|A{HLeJ+Njzo~61vur2H%buNu71Gr2bKLWF-g4Gj;O>(ZKDv6%HSxXhncDSU)PQGJr@1SXKY8ukC_IwVFXYb#|9(z7g z)*6-@5<-nn&rGF+@iLLK2x)q{pUeDL37MOjon~c{OYD%wVxtxU z0~@HANB6YWLWp?-jnG@SZW$Pbr=;cWv$eJTJ?I|}*AWB{P}4WHx4-O=c6-lSTjJR( z{&zy~|5x_H@yB`|L6P{ocbqYge<*zx9M7q*$$eM#X#AfLk^giA?D5BggtKS|?%nc>u2 z*{;LG^UpIH$A2>T+Z}z}=D&UBM^W(P{2hHh3ghoM{!tWvhsaN&_&Y>?CJUbbWg+tK hu=sIv|NF2g>Sba7qUMHP5&Epg37z9vN6-E8e*kH^WfTAa literal 0 HcmV?d00001 diff --git a/docs/diagrams/private_architecture.py b/docs/diagrams/private_architecture.py new file mode 100644 index 0000000..5d25c34 --- /dev/null +++ b/docs/diagrams/private_architecture.py @@ -0,0 +1,171 @@ +"""Private architecture diagram for the AI Investment Analysis sample. + +All resources live in a hub VNet (10.50.0.0/22). Inbound from the internet is +disabled on every PaaS resource. Operator access is via Bastion -> jumpbox -> +SOCKS5 proxy. App-to-PaaS traffic stays on the Microsoft backbone via private +endpoints; the App Service VNet integration subnet reaches AI Foundry through +a service endpoint with a deny-all networkAcl. +""" + +from diagrams import Diagram, Cluster, Edge +from diagrams.azure.compute import AppServices, ContainerRegistries, VM +from diagrams.azure.network import ( + VirtualNetworks, + Subnets, + PrivateEndpoint, + DNSPrivateZones, +) +from diagrams.azure.database import CosmosDb +from diagrams.azure.storage import BlobStorage +from diagrams.azure.identity import ManagedIdentities +from diagrams.azure.ml import CognitiveServices +from diagrams.azure.monitor import LogAnalyticsWorkspaces, ApplicationInsights +from diagrams.azure.general import Subscriptions +from diagrams.onprem.client import User +from diagrams.onprem.compute import Server + +graph_attr = { + "bgcolor": "white", + "pad": "0.8", + "nodesep": "0.7", + "ranksep": "1.0", + "splines": "spline", + "fontname": "Arial Bold", + "fontsize": "18", + "dpi": "200", + "labelloc": "t", +} + +node_attr = { + "fontname": "Arial Bold", + "fontsize": "11", + "labelloc": "t", +} + +cluster_style = { + "margin": "30", + "fontname": "Arial Bold", + "fontsize": "13", + "style": "rounded", +} + +vnet_style = dict(cluster_style, bgcolor="#EAF3FB") +subnet_style = dict(cluster_style, bgcolor="#FFFFFF") +private_paas_style = dict(cluster_style, bgcolor="#F4FAF0") +ops_style = dict(cluster_style, bgcolor="#FFF7E6") + +with Diagram( + "AI Investment Analysis - Private Zero-Trust Architecture\nrg-aiinvest-zt-demo / swedencentral", + show=False, + filename="private_architecture", + direction="LR", + outformat="png", + graph_attr=graph_attr, + node_attr=node_attr, +): + + operator = User("Operator\n(local Mac)") + + with Cluster("Azure subscription\nc91e40f7-...-2a6bf8402aa4", graph_attr=cluster_style): + + uami = ManagedIdentities("UAMI\nid-aiinvest-...\n(ACR pull)") + + with Cluster( + "Hub VNet aiinvest-vnet 10.50.0.0/22", + graph_attr=vnet_style, + ): + + # --- Operator entry path --- + with Cluster("AzureBastionSubnet", graph_attr=subnet_style): + bastion = Subnets("Azure Bastion") + + with Cluster("snet-mgmt 10.50.2.224/27", graph_attr=subnet_style): + jumpbox = VM("jumpbox\n(SSH + SOCKS5\n127.0.0.1:1080)") + + # --- App Service VNet integration (outbound) --- + with Cluster( + "snet-appsvc 10.50.4.0/26\n" + "delegation: Microsoft.Web/serverFarms\n" + "serviceEndpoint: Microsoft.CognitiveServices", + graph_attr=subnet_style, + ): + vnet_integ = Subnets("VNet integration\n(WEBSITE_VNET_ROUTE_ALL=1\nPULL_IMAGE_OVER_VNET=true)") + + # --- Private endpoints subnet --- + with Cluster("snet-pe 10.50.2.0/26", graph_attr=subnet_style): + pe_api = PrivateEndpoint("PE\naiinvest-api-dev") + pe_web = PrivateEndpoint("PE\naiinvest-web-dev") + pe_acr = PrivateEndpoint("PE\nACR") + pe_cosmos = PrivateEndpoint("PE\nCosmos (Sql)") + pe_blob = PrivateEndpoint("PE\nStorage (blob)") + pe_ampls = PrivateEndpoint("PE\nAMPLS\n(LAW + AppInsights)") + + dns = DNSPrivateZones( + "Private DNS zones\nazurewebsites / azurecr\ndocuments.azure / blob.core\nmonitor / oms / ods\nagentsvc / cognitiveservices\nopenai / services.ai" + ) + + # --- Hosted apps (publicNetworkAccess=Disabled) --- + with Cluster( + "App Service Plan P0v3 (Linux)\nplan-aiinvest-...", + graph_attr=private_paas_style, + ): + api_app = AppServices("aiinvest-api-dev\nDOCKER container\npublic = Disabled") + web_app = AppServices("aiinvest-web-dev\nDOCKER container\npublic = Disabled") + + # --- Backing PaaS (all private) --- + with Cluster("Private PaaS dependencies", graph_attr=private_paas_style): + acr = ContainerRegistries("ACR\naiinvestacr...\npublic = Disabled") + cosmos = CosmosDb("Cosmos DB (NoSQL)\naiinvest-cosmosdb-...\npublic = Disabled") + storage = BlobStorage("Storage Account\naiinveststa...\npublic = Disabled") + ai = CognitiveServices( + "AI Foundry / OpenAI\naiiuhsfnmz4b6d4zbsz\npublic = Enabled\nnetworkAcls: Deny\n+ VNet rule (snet-appsvc)" + ) + + # --- Observability --- + with Cluster("Observability (private via AMPLS)", graph_attr=private_paas_style): + law = LogAnalyticsWorkspaces("Log Analytics\naiinvest-law-...\ningest+query Disabled") + appi = ApplicationInsights("App Insights\naiinvest-appi-...") + + # ===================================================================== + # Operator path (dashed = control / SSH tunnel) + # ===================================================================== + operator >> Edge(label="HTTPS 443\n(Bastion tunnel)", style="dashed", color="#8A6D3B") >> bastion + bastion >> Edge(style="dashed", color="#8A6D3B") >> jumpbox + jumpbox >> Edge(label="SOCKS5\nbrowse private apps", style="dashed", color="#8A6D3B") >> pe_api + jumpbox >> Edge(style="dashed", color="#8A6D3B") >> pe_web + + # ===================================================================== + # Inbound app traffic via PE + # ===================================================================== + pe_api >> Edge(label="resolves via\nprivatelink.azurewebsites.net") >> api_app + pe_web >> Edge() >> web_app + + # ===================================================================== + # Outbound from apps via VNet integration + # ===================================================================== + api_app >> Edge(label="all egress\nrouted to VNet", color="#0072C6") >> vnet_integ + web_app >> Edge(color="#0072C6") >> vnet_integ + + # Web -> API call stays inside VNet + web_app >> Edge(label="REST", style="dotted", color="#444") >> api_app + + # VNet integ -> dependencies + vnet_integ >> Edge(label="image pull\n(MI auth)") >> pe_acr >> acr + vnet_integ >> Edge() >> pe_cosmos >> cosmos + vnet_integ >> Edge() >> pe_blob >> storage + vnet_integ >> Edge( + label="service endpoint\nMicrosoft.CognitiveServices", + color="#107C10", + ) >> ai + + # UAMI -> ACR (AcrPull) + uami >> Edge(label="AcrPull", style="dashed", color="#5C2D91") >> acr + + # Diagnostics -> AMPLS + api_app >> Edge(label="diag settings", style="dotted", color="#999") >> pe_ampls + web_app >> Edge(style="dotted", color="#999") >> pe_ampls + pe_ampls >> Edge(style="dotted", color="#999") >> law + appi >> Edge(style="dotted", color="#999") >> law + + # DNS resolution (informational) + vnet_integ >> Edge(style="dotted", color="#888", label="DNS via 168.63.129.16") >> dns diff --git a/infra/0-connect-jumpbox.sh b/infra/0-connect-jumpbox.sh new file mode 100755 index 0000000..4bca8dc --- /dev/null +++ b/infra/0-connect-jumpbox.sh @@ -0,0 +1,82 @@ +#!/bin/bash +# Connect to the zero-trust jumpbox VM over Azure Bastion using SSH tunneling. +# +# Prerequisites on your laptop: +# - Azure CLI + ssh +# - Logged in with 'az login' to the same subscription +# - Bastion SKU must be 'Standard' (tunneling is not supported on Basic) +# +# Usage: ./infra/0-connect-jumpbox.sh -g [options] + +set -e + +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +NC='\033[0m' + +RESOURCE_GROUP="" +ADMIN_USER="azureuser" +PORT="50022" + +usage() { + echo "Usage: $0 -g [options]" + echo " -g, --resource-group Azure Resource Group name (required)" + echo " -u, --user SSH user on the jumpbox (default: azureuser)" + echo " -p, --local-port Local port for the Bastion tunnel (default: 50022)" + echo " -h, --help Show this help" + exit 1 +} + +while [[ $# -gt 0 ]]; do + case $1 in + -g|--resource-group) RESOURCE_GROUP="$2"; shift 2 ;; + -u|--user) ADMIN_USER="$2"; shift 2 ;; + -p|--local-port) PORT="$2"; shift 2 ;; + -h|--help) usage ;; + *) echo "Unknown option $1"; usage ;; + esac +done + +[ -z "$RESOURCE_GROUP" ] && usage + +# Find jumpbox + bastion from the infra deployment outputs +DEPLOYMENT_NAME=$(az deployment group list \ + --resource-group "$RESOURCE_GROUP" \ + --query "[?contains(name, 'ai-invest-sample')] | sort_by(@, &properties.timestamp) | [-1].name" \ + --output tsv) + +if [ -z "$DEPLOYMENT_NAME" ]; then + echo -e "${RED}❌ Infrastructure deployment not found in $RESOURCE_GROUP.${NC}" + exit 1 +fi + +JUMPBOX_NAME=$(az deployment group show -g "$RESOURCE_GROUP" -n "$DEPLOYMENT_NAME" --query "properties.outputs.jumpboxName.value" -o tsv) +BASTION_NAME=$(az deployment group show -g "$RESOURCE_GROUP" -n "$DEPLOYMENT_NAME" --query "properties.outputs.bastionName.value" -o tsv) + +if [ -z "$JUMPBOX_NAME" ] || [ -z "$BASTION_NAME" ]; then + echo -e "${RED}❌ No jumpbox/bastion found in deployment outputs. Was the infra deployed with isPrivate=true and deployJumpbox=true?${NC}" + exit 1 +fi + +JUMPBOX_ID=$(az vm show -g "$RESOURCE_GROUP" -n "$JUMPBOX_NAME" --query id -o tsv) + +echo -e "${BLUE}🔐 Opening SSH session to jumpbox via Bastion...${NC}" +echo -e "${BLUE} Jumpbox: $JUMPBOX_NAME${NC}" +echo -e "${BLUE} Bastion: $BASTION_NAME${NC}" +echo "" +echo -e "${YELLOW}Once connected, clone the repo and run scripts 2 and 3 from the jumpbox:${NC}" +echo -e "${YELLOW} git clone ${NC}" +echo -e "${YELLOW} cd Agentic-AI-Investment-Analysis-Sample${NC}" +echo -e "${YELLOW} ./infra/2-build-and-push-images.sh -r ${NC}" +echo -e "${YELLOW} ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP${NC}" +echo "" + +az network bastion ssh \ + --name "$BASTION_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --target-resource-id "$JUMPBOX_ID" \ + --auth-type ssh-key \ + --username "$ADMIN_USER" \ + --ssh-key "$HOME/.ssh/id_rsa" diff --git a/infra/1-deploy-azure-infra.sh b/infra/1-deploy-azure-infra.sh index 6743051..e29abb9 100755 --- a/infra/1-deploy-azure-infra.sh +++ b/infra/1-deploy-azure-infra.sh @@ -19,6 +19,10 @@ AIFOUNDRY_LOCATION="swedencentral" NAME_PREFIX="aiinvest" ENVIRONMENT="dev" DEBUG="false" +IS_PRIVATE="true" +DEPLOY_JUMPBOX="true" +SSH_KEY_FILE="" +BASTION_SKU="Standard" # Function to show usage usage() { @@ -32,6 +36,10 @@ usage() { echo " -p, --name-prefix Resource name prefix (default: aiinvest)" echo " -e, --environment Environment name (default: dev)" echo " -a, --ai-foundry-location AI Foundry location (default: swedencentral)" + echo " --public Deploy the legacy public topology (isPrivate=false)" + echo " --no-jumpbox Skip jumpbox/Bastion deployment when private" + echo " --ssh-key-file Path to SSH public key for the jumpbox (default: ~/.ssh/id_rsa.pub)" + echo " --bastion-sku Bastion SKU: Basic or Standard (default: Standard)" echo " -d, --debug Enable debug logging" echo " -h, --help Show this help message" echo "" @@ -64,6 +72,23 @@ while [[ $# -gt 0 ]]; do AIFOUNDRY_LOCATION="$2" shift 2 ;; + --public) + IS_PRIVATE="false" + DEPLOY_JUMPBOX="false" + shift + ;; + --no-jumpbox) + DEPLOY_JUMPBOX="false" + shift + ;; + --ssh-key-file) + SSH_KEY_FILE="$2" + shift 2 + ;; + --bastion-sku) + BASTION_SKU="$2" + shift 2 + ;; -d|--debug) DEBUG="true" shift @@ -139,6 +164,22 @@ fi echo -e "${BLUE}🏗️ Deploying Azure infrastructure...${NC}" DEPLOYMENT_NAME="ai-invest-sample-$(date +%s)" +# Resolve SSH public key (required when deploying the jumpbox) +JUMPBOX_PUBKEY="" +if [ "$IS_PRIVATE" == "true" ] && [ "$DEPLOY_JUMPBOX" == "true" ]; then + if [ -z "$SSH_KEY_FILE" ]; then + SSH_KEY_FILE="$HOME/.ssh/id_rsa.pub" + fi + if [ ! -f "$SSH_KEY_FILE" ]; then + echo -e "${RED}❌ SSH public key not found at $SSH_KEY_FILE.${NC}" + echo -e "${YELLOW} Generate one with 'ssh-keygen -t rsa -b 4096' or pass --ssh-key-file .${NC}" + echo -e "${YELLOW} Alternatively, re-run with --no-jumpbox or --public to skip.${NC}" + exit 1 + fi + JUMPBOX_PUBKEY=$(cat "$SSH_KEY_FILE") + echo -e "${GREEN}✅ Using SSH public key: $SSH_KEY_FILE${NC}" +fi + optional_args=() if [ "$DEBUG" == "true" ]; then @@ -153,6 +194,10 @@ az deployment group create \ environment="$ENVIRONMENT" \ location="$LOCATION" \ aiFoundryLocation="$AIFOUNDRY_LOCATION" \ + isPrivate="$IS_PRIVATE" \ + deployJumpbox="$DEPLOY_JUMPBOX" \ + bastionSku="$BASTION_SKU" \ + jumpboxAdminPublicKey="$JUMPBOX_PUBKEY" \ --name "$DEPLOYMENT_NAME" \ --output table ${optional_args[@]} @@ -193,10 +238,22 @@ fi echo "" echo -e "${GREEN}🎉 Azure infrastructure deployment completed!${NC}" echo "" -echo -e "${BLUE}Next Steps:${NC}" -echo "1. Build and push your Docker images to the Container Registry:" -echo " ./infra/2-build-and-push-images.sh -r $ACR_LOGIN_SERVER" -echo "" -echo "2. Deploy your applications using pushed images:" -echo " ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP" +if [ "$IS_PRIVATE" == "true" ]; then + echo -e "${YELLOW}⚠️ Zero-trust mode: ACR and Container Apps are now private.${NC}" + echo -e "${YELLOW} Scripts 2 and 3 must be run from inside the VNet (use the jumpbox).${NC}" + echo -e "${BLUE}Next Steps:${NC}" + echo "1. Connect to the jumpbox via Azure Bastion:" + echo " ./infra/0-connect-jumpbox.sh -g $RESOURCE_GROUP" + echo "" + echo "2. On the jumpbox: clone the repo, then run:" + echo " ./infra/2-build-and-push-images.sh -r $ACR_LOGIN_SERVER" + echo " ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP" +else + echo -e "${BLUE}Next Steps:${NC}" + echo "1. Build and push your Docker images to the Container Registry:" + echo " ./infra/2-build-and-push-images.sh -r $ACR_LOGIN_SERVER" + echo "" + echo "2. Deploy your applications using pushed images:" + echo " ./infra/3-deploy-apps.sh -g $RESOURCE_GROUP" +fi echo "" \ No newline at end of file diff --git a/infra/2-build-and-push-images.sh b/infra/2-build-and-push-images.sh index 911851b..228d942 100755 --- a/infra/2-build-and-push-images.sh +++ b/infra/2-build-and-push-images.sh @@ -18,6 +18,11 @@ TAG="latest" BUILD_API="false" BUILD_WEB="false" BUILD_ALL="true" +# Default build mode: 'docker' builds locally and pushes (works from the +# zero-trust jumpbox since it resolves the private ACR via VNet). Use --acr +# to submit to ACR Tasks — note that against a private ACR this requires a +# VNet-enabled dedicated agent pool (Premium feature). +BUILD_MODE="docker" # Function to show usage usage() { @@ -30,6 +35,8 @@ usage() { echo " -t, --tag Image tag (default: latest)" echo " --api Build API app image. If specified, only API image will be built." echo " --web Build web app image. If specified, only web image will be built." + echo " --docker Use local Docker + docker push (legacy path; requires public ACR)" + echo " --acr Use 'az acr build' / ACR Tasks (default; works with private ACR)" echo " -h, --help Show this help message" echo "" echo "Examples:" @@ -60,6 +67,14 @@ while [[ $# -gt 0 ]]; do BUILD_ALL="false" shift 1 ;; + --docker) + BUILD_MODE="docker" + shift 1 + ;; + --acr) + BUILD_MODE="acr" + shift 1 + ;; -h|--help) usage ;; @@ -100,10 +115,12 @@ echo -e "${BLUE}📁 Moving to Project Root: $PROJECT_ROOT${NC}" # Change to project root cd "$PROJECT_ROOT" -# Check if Docker is running -if ! docker info > /dev/null 2>&1; then - echo -e "${RED}❌ Docker is not running. Please start Docker first.${NC}" - exit 1 +# Check if Docker is running (only required in docker mode) +if [ "$BUILD_MODE" == "docker" ]; then + if ! docker info > /dev/null 2>&1; then + echo -e "${RED}❌ Docker is not running. Please start Docker first (or use default --acr mode).${NC}" + exit 1 + fi fi #Check if npm is installed @@ -128,16 +145,18 @@ echo "" echo -e "${YELLOW}📋 Current Azure subscription:${NC}" az account show --output table -# Login to Azure Container Registry -echo "" -echo -e "${BLUE}🔐 Logging in to Azure Container Registry...${NC}" -az acr login --name "${REGISTRY%%.*}" -if [ $? -ne 0 ]; then - echo -e "${RED}❌ Failed to login to Azure Container Registry${NC}" - exit 1 +# Login to Azure Container Registry (docker path only) +if [ "$BUILD_MODE" == "docker" ]; then + echo "" + echo -e "${BLUE}🔐 Logging in to Azure Container Registry...${NC}" + az acr login --name "${REGISTRY%%.*}" + if [ $? -ne 0 ]; then + echo -e "${RED}❌ Failed to login to Azure Container Registry${NC}" + exit 1 + fi + echo -e "${GREEN}✅ Successfully logged in to ACR${NC}" + echo "" fi -echo -e "${GREEN}✅ Successfully logged in to ACR${NC}" -echo "" # Get Resource Group of the ACR RESOURCE_GROUP=$(az acr show --name "${REGISTRY%%.*}" --query "resourceGroup" -o tsv) @@ -148,26 +167,41 @@ build_and_push() { local name=$1 local dockerfile=$2 local context=$3 - local full_image_name="$REGISTRY/ai-invest-$name:$TAG" - - echo -e "${YELLOW}📦 Building $name...${NC}" + local image_ref="ai-invest-$name:$TAG" + local full_image_name="$REGISTRY/$image_ref" + + echo -e "${YELLOW}📦 Building $name (mode=$BUILD_MODE)...${NC}" echo -e "${YELLOW}📁 Using docker file: $dockerfile${NC}" echo -e "${YELLOW}📁 Context: $context${NC}" echo -e "${YELLOW}🏷️ Tagging image as $full_image_name${NC}" - if docker buildx build --platform linux/amd64 -t "$full_image_name" -f "$dockerfile" "$context"; then - echo -e "${GREEN}✅ Successfully built $full_image_name${NC}" - - echo -e "${YELLOW}📤 Pushing $name to registry...${NC}" - if docker push "$full_image_name"; then - echo -e "${GREEN}✅ Successfully pushed $full_image_name${NC}" + if [ "$BUILD_MODE" == "acr" ]; then + if az acr build \ + --registry "${REGISTRY%%.*}" \ + --image "$image_ref" \ + --platform linux/amd64 \ + --file "$dockerfile" \ + "$context"; then + echo -e "${GREEN}✅ Successfully built and pushed $full_image_name via ACR Tasks${NC}" else - echo -e "${RED}❌ Failed to push $name${NC}" + echo -e "${RED}❌ Failed to build/push $name via ACR Tasks${NC}" return 1 fi else - echo -e "${RED}❌ Failed to build $name${NC}" - return 1 + if docker buildx build --platform linux/amd64 -t "$full_image_name" -f "$dockerfile" "$context"; then + echo -e "${GREEN}✅ Successfully built $full_image_name${NC}" + + echo -e "${YELLOW}📤 Pushing $name to registry...${NC}" + if docker push "$full_image_name"; then + echo -e "${GREEN}✅ Successfully pushed $full_image_name${NC}" + else + echo -e "${RED}❌ Failed to push $name${NC}" + return 1 + fi + else + echo -e "${RED}❌ Failed to build $name${NC}" + return 1 + fi fi printf -- '-%.0s' {1..100} echo "" diff --git a/infra/3-deploy-apps.sh b/infra/3-deploy-apps.sh index 506dc51..0f9edc2 100755 --- a/infra/3-deploy-apps.sh +++ b/infra/3-deploy-apps.sh @@ -160,7 +160,7 @@ get_deployment_outputs() { # Get the deployment name local deployment_name=$(az deployment group list \ --resource-group "$resource_group" \ - --query "[?contains(name, 'ai-invest-sample')].name | [0]" \ + --query "[?contains(name, 'ai-invest-appsvc')].name | [0]" \ --output tsv) if [ -z "$deployment_name" ]; then @@ -214,15 +214,30 @@ else echo -e "${GREEN}✅ User Assigned Identity Name: $USER_ASSIGNED_IDENTITY_NAME${NC}" fi -# Get Container Apps Environment ID from infrastructure deployment -CONTAINER_APPS_ENV_NAME=$(get_output_property "containerAppsEnvironmentName") -if [ -z "$CONTAINER_APPS_ENV_NAME" ]; then - echo -e "${RED}❌ Container Apps Environment not found after $MAX_RETRIES attempts. Please run deploy-azure-infra.sh first.${NC}" +# Resolve UAMI client ID once (used to PATCH acrUserManagedIdentityID post-deploy +# because the bicep ARM property is not always honored on first create). +UAMI_CLIENT_ID=$(az identity show \ + --resource-group "$RESOURCE_GROUP" \ + --name "$USER_ASSIGNED_IDENTITY_NAME" \ + --query clientId -o tsv 2>/dev/null) +SUBSCRIPTION_ID=$(az account show --query id -o tsv) + +# Get App Service Plan + networking info from infrastructure deployment +APP_SERVICE_PLAN_ID=$(get_output_property "appServicePlanId") +if [ -z "$APP_SERVICE_PLAN_ID" ]; then + echo -e "${RED}❌ App Service Plan not found. Please run deploy-azure-infra.sh first.${NC}" exit 1 else - echo -e "${GREEN}✅ Container Apps Environment Name: $CONTAINER_APPS_ENV_NAME${NC}" + echo -e "${GREEN}✅ App Service Plan: $APP_SERVICE_PLAN_ID${NC}" fi +APPSVC_SUBNET_ID=$(get_output_property "appSvcSubnetId") +PE_SUBNET_ID=$(get_output_property "peSubnetId") +APPSVC_DNS_ZONE_ID=$(get_output_property "appServicePrivateDnsZoneId") +echo -e "${GREEN}✅ VNet integration subnet: $APPSVC_SUBNET_ID${NC}" +echo -e "${GREEN}✅ Private endpoint subnet: $PE_SUBNET_ID${NC}" +echo -e "${GREEN}✅ App Service private DNS zone: $APPSVC_DNS_ZONE_ID${NC}" + # Get Cosmos DB Endpoint from infrastructure deployment COSMOS_DB_ENDPOINT=$(get_output_property "cosmosEndpoint") @@ -291,10 +306,13 @@ if [ "$DEPLOY_ALL" == "true" ] || [ "$DEPLOY_API" == "true" ]; then --parameters \ environment="$ENVIRONMENT" \ namePrefix="$NAME_PREFIX" \ - containerAppsEnvironmentName="$CONTAINER_APPS_ENV_NAME" \ + appServicePlanId="$APP_SERVICE_PLAN_ID" \ containerRegistryServer="$REGISTRY" \ containerImage="$REGISTRY/ai-invest-api:$TAG" \ userAssignedIdentityName="$USER_ASSIGNED_IDENTITY_NAME" \ + vnetIntegrationSubnetId="$APPSVC_SUBNET_ID" \ + privateEndpointSubnetId="$PE_SUBNET_ID" \ + appServicePrivateDnsZoneId="$APPSVC_DNS_ZONE_ID" \ cosmosAccountEndpoint="$COSMOS_DB_ENDPOINT" \ cosmosDbName="$COSMOS_DB_NAME" \ storageAccountName="$STORAGE_ACCOUNT_NAME" \ @@ -303,30 +321,37 @@ if [ "$DEPLOY_ALL" == "true" ] || [ "$DEPLOY_API" == "true" ]; then echo -e "${GREEN}✅ API App deployed successfully${NC}" - # Get the Container App name from the deployment outputs + # Get the Web App name from the deployment outputs API_APP_NAME=$(az deployment group show \ --resource-group "$RESOURCE_GROUP" \ --name "$API_DEPLOYMENT_NAME" \ --query "properties.outputs.containerAppName.value" \ --output tsv) - # Get the Container App FQDN - API_URL=$(az containerapp show \ + # Get the Web App default hostname + API_URL=$(az webapp show \ --name "$API_APP_NAME" \ --resource-group "$RESOURCE_GROUP" \ - --query "properties.configuration.ingress.fqdn" \ + --query "defaultHostName" \ --output tsv) - # Force a new app revision to ensure the latest image is pulled - echo -e "${BLUE}Forcing a new revision to pull the latest image...${NC}" - az containerapp update \ + # Force a redeploy of the container image (App Service caches by digest) + echo -e "${BLUE}Forcing the App Service to pull the latest image...${NC}" + az webapp config container set \ --name "${API_APP_NAME}" \ --resource-group "$RESOURCE_GROUP" \ - --image "${REGISTRY}/ai-invest-api:${TAG}" \ - --revision-suffix "$(date +%s)" \ - --output none \ - --no-wait - echo -e "${GREEN}✅ Updated Container App to pull latest image${NC}" + --container-image-name "${REGISTRY}/ai-invest-api:${TAG}" \ + --output none + # Workaround: ensure acrUseManagedIdentityCreds + acrUserManagedIdentityID are set + # (bicep does not always persist these on initial create, causing 503 image-pull errors). + if [ -n "$UAMI_CLIENT_ID" ]; then + az rest --method PATCH \ + --url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Web/sites/${API_APP_NAME}/config/web?api-version=2023-12-01" \ + --body "{\"properties\":{\"acrUseManagedIdentityCreds\":true,\"acrUserManagedIdentityID\":\"${UAMI_CLIENT_ID}\"}}" \ + --output none 2>/dev/null || true + fi + az webapp restart --name "${API_APP_NAME}" --resource-group "$RESOURCE_GROUP" --output none + echo -e "${GREEN}✅ Updated Web App to pull latest image${NC}" if [ -n "$API_URL" ]; then API_URL="https://$API_URL" @@ -381,38 +406,46 @@ if [ "$DEPLOY_ALL" == "true" ] || [ "$DEPLOY_WEB" == "true" ]; then environment="$ENVIRONMENT" \ containerImage="$REGISTRY/ai-invest-web:$TAG" \ backendApiUrl="$API_URL/api" \ - containerAppsEnvironment="$CONTAINER_APPS_ENV_NAME" \ + appServicePlanId="$APP_SERVICE_PLAN_ID" \ containerRegistryServer="$REGISTRY" \ userAssignedIdentityName="$USER_ASSIGNED_IDENTITY_NAME" \ + vnetIntegrationSubnetId="$APPSVC_SUBNET_ID" \ + privateEndpointSubnetId="$PE_SUBNET_ID" \ + appServicePrivateDnsZoneId="$APPSVC_DNS_ZONE_ID" \ "${optional_args[@]}" \ --output none; then echo -e "${GREEN}✅ Web App deployed successfully${NC}" - # Get the Container App name from the deployment outputs + # Get the Web App name from the deployment outputs WEB_APP_NAME=$(az deployment group show \ --resource-group "$RESOURCE_GROUP" \ --name "$WEB_DEPLOYMENT_NAME" \ --query "properties.outputs.containerAppName.value" \ --output tsv) - # Get Web App URL - WEB_URL=$(az containerapp show \ + # Get the Web App default hostname + WEB_URL=$(az webapp show \ --name "${WEB_APP_NAME}" \ --resource-group "$RESOURCE_GROUP" \ - --query "properties.configuration.ingress.fqdn" \ + --query "defaultHostName" \ --output tsv 2>/dev/null) - # Force a new app revision to ensure the latest image is pulled - echo -e "${BLUE}Forcing a new revision to pull the latest image...${NC}" - az containerapp update \ + # Force the App Service to pull the latest image + echo -e "${BLUE}Forcing the App Service to pull the latest image...${NC}" + az webapp config container set \ --name "${WEB_APP_NAME}" \ --resource-group "$RESOURCE_GROUP" \ - --image "${REGISTRY}/ai-invest-web:${TAG}" \ - --revision-suffix "$(date +%s)" \ - --output none \ - --no-wait - echo -e "${GREEN}✅ Updated Container App to pull latest image${NC}" + --container-image-name "${REGISTRY}/ai-invest-web:${TAG}" \ + --output none + if [ -n "$UAMI_CLIENT_ID" ]; then + az rest --method PATCH \ + --url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Web/sites/${WEB_APP_NAME}/config/web?api-version=2023-12-01" \ + --body "{\"properties\":{\"acrUseManagedIdentityCreds\":true,\"acrUserManagedIdentityID\":\"${UAMI_CLIENT_ID}\"}}" \ + --output none 2>/dev/null || true + fi + az webapp restart --name "${WEB_APP_NAME}" --resource-group "$RESOURCE_GROUP" --output none + echo -e "${GREEN}✅ Updated Web App to pull latest image${NC}" if [ -n "$WEB_URL" ]; then WEB_URL="https://$WEB_URL" @@ -440,6 +473,22 @@ else echo "" fi +###################################################################### +###################################################################### +## LOCK DOWN AI FOUNDRY / COGNITIVE SERVICES TO VNET ONLY +## (Restrict the Foundry account so only the App Service VNet integration +## subnet can call it. The AVM Foundry module does not expose networkAcls, +## so we PATCH the account post-deploy. Idempotent.) + +AI_ACCOUNT=$(az cognitiveservices account list -g "$RESOURCE_GROUP" --query "[0].name" -o tsv 2>/dev/null) +if [ -n "$AI_ACCOUNT" ] && [ -n "$APPSVC_SUBNET_ID" ]; then + echo -e "${BLUE}🔒 Locking AI Services account '$AI_ACCOUNT' to snet-appsvc only...${NC}" + az rest --method PATCH \ + --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.CognitiveServices/accounts/$AI_ACCOUNT?api-version=2024-10-01" \ + --body "{\"properties\":{\"networkAcls\":{\"defaultAction\":\"Deny\",\"bypass\":\"AzureServices\",\"virtualNetworkRules\":[{\"id\":\"$APPSVC_SUBNET_ID\",\"ignoreMissingVnetServiceEndpoint\":false}],\"ipRules\":[]}}}" \ + --output none 2>/dev/null || echo -e "${YELLOW}⚠️ Could not lock AI Services networkAcls (non-fatal).${NC}" +fi + ###################################################################### ###################################################################### ## SUMMARY diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep index fa6d9fe..927b323 100644 --- a/infra/bicep/main.bicep +++ b/infra/bicep/main.bicep @@ -9,6 +9,29 @@ param environment string = 'dev' @description('Location for all resources') param location string = resourceGroup().location +// ################################################ +// Zero-trust / networking parameters + +@description('When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources.') +param isPrivate bool = true + +@description('When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access.') +param deployJumpbox bool = true + +@description('VNet address space used when isPrivate=true') +param vnetAddressPrefix string = '10.50.0.0/16' + +@description('Admin username for the jumpbox VM') +param jumpboxAdminUsername string = 'azureuser' + +@description('SSH public key for the jumpbox VM (required when deployJumpbox=true)') +@secure() +param jumpboxAdminPublicKey string = '' + +@description('Azure Bastion SKU. Standard required for native-client tunneling.') +@allowed([ 'Basic', 'Standard' ]) +param bastionSku string = 'Standard' + // ################################################ // Application specific parameters @@ -37,9 +60,34 @@ var tags = { Project: 'ai-investment-analysis-sample' } -// User Assigned Identity for Container Apps to access other resources +var shortHash = substring(uniqueString(resourceGroup().id, deployment().name), 0, 8) + +// ################################################ +// Networking (VNet + Private DNS) — deployed first when isPrivate=true + +module network 'modules/network.bicep' = if (isPrivate) { + name: 'networkDeployment.${shortHash}' + params: { + vnetName: toLower('${namePrefix}-vnet-${uniqueString(resourceGroupId)}') + vnetAddressPrefix: vnetAddressPrefix + location: location + tags: tags + } +} + +module privateDns 'modules/private-dns.bicep' = if (isPrivate) { + name: 'privateDnsDeployment.${shortHash}' + params: { + vnetId: network.outputs.vnetId + tags: tags + } +} + +// ################################################ +// Identity + module userAssignedIdentity 'modules/user-assigned-identity.bicep' = { - name: 'userAssignedIdentityDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'userAssignedIdentityDeployment.${shortHash}' params: { userAssignedIdentityName: toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') location: location @@ -47,44 +95,73 @@ module userAssignedIdentity 'modules/user-assigned-identity.bicep' = { } } -// Log Analytics Workspace +// ################################################ +// Log Analytics + Application Insights + module logAnalytics 'modules/log-analytics-ws.bicep' = { - name: 'logAnalyticsDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'logAnalyticsDeployment.${shortHash}' params: { logAnalyticsWorkspaceName: toLower('${namePrefix}-law-${uniqueString(resourceGroupId)}') roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] location: location tags: tags + isPrivate: isPrivate } } -// Application Insights module appInsights 'modules/app-insights.bicep' = { - name: 'appInsightsDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'appInsightsDeployment.${shortHash}' params: { appInsightsName: toLower('${namePrefix}-appi-${uniqueString(resourceGroupId)}') location: location logAnalyticsResourceId: logAnalytics.outputs.resourceId - roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] + tags: tags + isPrivate: isPrivate + } +} + +// Azure Monitor Private Link Scope — binds LA + AppI so telemetry flows over VNet. +module ampls 'modules/ampls.bicep' = if (isPrivate) { + name: 'amplsDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-ampls-${uniqueString(resourceGroupId)}') + logAnalyticsResourceId: logAnalytics.outputs.resourceId + appInsightsResourceId: appInsights.outputs.resourceId + privateEndpointSubnetId: network.outputs.peSubnetId + privateEndpointLocation: location + privateDnsZoneIds: [ + privateDns.outputs.monitorZoneId + privateDns.outputs.omsZoneId + privateDns.outputs.odsZoneId + privateDns.outputs.agentsvcZoneId + privateDns.outputs.blobFixedZoneId + ] tags: tags } } -// Storage Account (with Blob Container and Queue) +// ################################################ +// Storage + module storage 'modules/storage.bicep' = { - name: 'storageAccountDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'storageAccountDeployment.${shortHash}' params: { storageAccountName: length('${namePrefix}sta${uniqueString(resourceGroupId)}') > 24 ? substring(toLower('${namePrefix}sta${uniqueString(resourceGroupId)}'), 0, 24) : toLower('${namePrefix}sta${uniqueString(resourceGroupId)}') location: location docsContainerName: docsContainerName roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] tags: tags + isPrivate: isPrivate + privateEndpointSubnetId: isPrivate ? network.outputs.peSubnetId : '' + blobPrivateDnsZoneId: isPrivate ? privateDns.outputs.blobZoneStorageSuffixId : '' } } +// ################################################ // Cosmos DB + module cosmosDb 'modules/cosmos-db.bicep' = { - name: 'cosmosDbDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'cosmosDbDeployment.${shortHash}' params: { location: location cosmosAccountName: toLower('${namePrefix}-cosmosdb-${uniqueString(resourceGroup().id)}') @@ -93,175 +170,127 @@ module cosmosDb 'modules/cosmos-db.bicep' = { cosmosDBDataContributorPrincipalIds: [userAssignedIdentity.outputs.principalId, deployer().objectId] zoneRedundant: environment == 'prod' ? true : false tags: tags + isPrivate: isPrivate + privateEndpointSubnetId: isPrivate ? network.outputs.peSubnetId : '' + cosmosSqlPrivateDnsZoneId: isPrivate ? privateDns.outputs.cosmosSqlZoneId : '' } } -// // App Configuration Store -// module appConfigStore 'modules/app-config-store.bicep' = { -// name: 'appConfigStoreDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' -// params: { -// appConfigStoreName: toLower('${namePrefix}-acs-${uniqueString(resourceGroupId)}') -// location: location -// roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] -// configurationKeyValues: [ -// // api app specific key vaules, uses the prefix: 'doc-proc.api.' -// { -// contentType: 'text/plain' -// name: 'doc-proc.api.DEBUG' -// value: 'true' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.api.BLOB_STORAGE_ACCOUNT_NAME' -// value: storage.outputs.name -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.api.BLOB_STORAGE_CONTAINER_NAME' -// value: 'vaults' -// } -// // worker app specific key values, uses the prefix: 'doc-proc.worker.' -// { -// contentType: 'text/plain' -// name: 'doc-proc.worker.DEBUG' -// value: 'true' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.worker.DEBUG' -// value: 'true' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.worker.WORKER_POOL_SIZE' -// value: '2' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.worker.WORKER_SHUTDOWN_TIMEOUT' -// value: '30' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.worker.WORKER_AUTO_RESTART' -// value: 'true' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.worker.WORKER_HEALTH_CHECK_INTERVAL' -// value: '10' -// } -// // Crawler Worker specific key values, uses the prefix: 'doc-proc.crawler.' -// { -// contentType: 'text/plain' -// name: 'doc-proc.crawler.DEBUG' -// value: 'true' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.crawler.CRAWLER_MAX_WORKERS' -// value: '3' -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.crawler.CRAWLER_DISCOVERY_POLL_INTERVAL' -// value: '60' // in seconds -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.crawler.CRAWLER_LEASE_DURATION_MINUTES' -// value: '30' // in minutes -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.crawler.CRAWLER_LEASE_RENEWAL_INTERVAL_MINUTES' -// value: '15' // in minutes -// } -// // shared key values, uses the prefix: 'doc-proc.' -// { -// contentType: 'text/plain' -// name: 'doc-proc.common.COSMOS_DB_ENDPOINT' -// value: cosmosDb.outputs.cosmosEndpoint -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.common.COSMOS_DB_NAME' -// value: cosmosDbName -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.common.STORAGE_ACCOUNT_WORKER_QUEUE_URL' -// value: storage.outputs.queueUrl -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.common.STORAGE_WORKER_QUEUE_NAME' -// value: storage.outputs.queueName -// } -// { -// contentType: 'text/plain' -// name: 'doc-proc.common.APPINSIGHTS_INSTRUMENTATIONKEY' -// value: appInsights.outputs.instrumentationKey -// } -// { -// contentType: 'text/plain' -// name: 'sentinel' -// value: '1' -// } - -// ] -// tags: tags -// } -// } - +// ################################################ // Container Registry + module containerRegistry 'modules/container-registry.bicep' = { - name: 'containerRegistryDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'containerRegistryDeployment.${shortHash}' params: { containerRegistryName: toLower('${namePrefix}acr${uniqueString(resourceGroupId)}') location: location roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] tags: tags + isPrivate: isPrivate + privateEndpointSubnetId: isPrivate ? network.outputs.peSubnetId : '' + acrPrivateDnsZoneId: isPrivate ? privateDns.outputs.acrZoneId : '' } } -// Container Apps Environment (shared by all container apps) -module containerAppsEnvironment 'modules/container-apps-environment.bicep' = { - name: 'containerAppsEnvironmentDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' +// ################################################ +// Compute host: App Service Plan (Linux) — replaces ACA env. +// Web Apps for Containers are deployed by api-app/web-app templates and +// are bound to this plan. Private endpoint + VNet integration are wired +// per-app inside web-app-container.bicep. + +module appServicePlan 'modules/app-service-plan.bicep' = { + name: 'appServicePlanDeployment.${shortHash}' params: { - containerAppsEnvironmentName: toLower('${namePrefix}-containerenv-${uniqueString(resourceGroupId)}') - logAnalyticsWorkspaceId: logAnalytics.outputs.logAnalyticsWorkspaceId - logAnalyticsPrimarySharedKey: logAnalytics.outputs.primarySharedKey - userAssignedResourceIds: [userAssignedIdentity.outputs.resourceId] + name: toLower('${namePrefix}-asp-${uniqueString(resourceGroupId)}') location: location tags: tags } } +// NOTE: ACA env module has been retired in favor of App Service. +// modules/container-apps-environment.bicep is kept on disk for reference +// but is no longer instantiated. + +// ################################################ // AI Foundry + module aiFoundry 'modules/ai-foundry.bicep' = { - name: 'aiFoundryDeployment.${substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)}' + name: 'aiFoundryDeployment.${shortHash}' params: { - aiFoundryBaseName: substring(toLower(uniqueString('ai-${namePrefix}-${environment}-${resourceGroup().id}')), 0, 12) // AI Foundry base name has a max length of 12 characters + aiFoundryBaseName: substring(toLower(uniqueString('ai-${namePrefix}-${environment}-${resourceGroup().id}')), 0, 12) roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId] location: aiFoundryLocation tags: tags + isPrivate: isPrivate + openAiPrivateDnsZoneId: isPrivate ? privateDns.outputs.openAiZoneId : '' + cognitiveServicesPrivateDnsZoneId: isPrivate ? privateDns.outputs.cognitiveServicesZoneId : '' + aiServicesPrivateDnsZoneId: isPrivate ? privateDns.outputs.aiServicesZoneId : '' + } +} + +// ################################################ +// Operator access plane — Bastion + Jumpbox + +module bastion 'modules/bastion.bicep' = if (isPrivate && deployJumpbox) { + name: 'bastionDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-bastion-${uniqueString(resourceGroupId)}') + location: location + subnetId: network.outputs.bastionSubnetId + sku: bastionSku + tags: tags + } +} + +module jumpbox 'modules/jumpbox.bicep' = if (isPrivate && deployJumpbox) { + name: 'jumpboxDeployment.${shortHash}' + params: { + name: toLower('${namePrefix}-jump-${uniqueString(resourceGroupId)}') + location: location + subnetId: network.outputs.jumpboxSubnetId + adminUsername: jumpboxAdminUsername + adminPublicKey: jumpboxAdminPublicKey + userAssignedIdentityId: userAssignedIdentity.outputs.resourceId + tags: tags + } +} + +var uaiName = toLower('${namePrefix}-uai-${uniqueString(resourceGroupId)}') + +// Grant the jumpbox identity the roles needed to run scripts end-to-end. +// UAMI already has AcrPull/AcrPush/AcrDelete + Storage + Cosmos data roles; +// add Contributor scoped to the resource group so it can deploy container apps. +resource jumpboxRgContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (isPrivate && deployJumpbox) { + name: guid(resourceGroup().id, uaiName, 'b24988ac-6180-42a0-ab88-20f7382dd24c') + scope: resourceGroup() + properties: { + principalId: userAssignedIdentity.outputs.principalId + principalType: 'ServicePrincipal' + roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c') // Contributor } } +// ################################################ +// Outputs + output userAssignedIdentityName string = userAssignedIdentity.outputs.name output userAssignedIdentityPrincipalId string = userAssignedIdentity.outputs.principalId output userAssignedIdentityResourceId string = userAssignedIdentity.outputs.resourceId output userAssignedIdentityClientId string = userAssignedIdentity.outputs.clientId output containerRegistryName string = containerRegistry.outputs.name output containerRegistryLoginServer string = containerRegistry.outputs.loginServer -output containerAppsEnvironmentId string = containerAppsEnvironment.outputs.resourceId -output containerAppsEnvironmentName string = containerAppsEnvironment.outputs.name +output appServicePlanId string = appServicePlan.outputs.id +output appServicePlanName string = appServicePlan.outputs.name +output appSvcSubnetId string = isPrivate ? network.outputs.appSvcSubnetId : '' +output peSubnetId string = isPrivate ? network.outputs.peSubnetId : '' +output appServicePrivateDnsZoneId string = isPrivate ? privateDns.outputs.appServiceZoneId : '' output storageAccountName string = storage.outputs.name -// output appConfigStoreName string = appConfigStore.outputs.name -// output appConfigStoreEndpoint string = appConfigStore.outputs.endpoint output cosmosAccountName string = cosmosDb.outputs.cosmosAccountName output cosmosEndpoint string = cosmosDb.outputs.cosmosEndpoint output cosmosDBName string = cosmosDb.outputs.cosmosDBName output aiProjectName string = aiFoundry.outputs.aiProjectName output aiServicesName string = aiFoundry.outputs.aiServicesName +output isPrivate bool = isPrivate +output vnetId string = isPrivate ? network.outputs.vnetId : '' +output jumpboxName string = (isPrivate && deployJumpbox) ? jumpbox.outputs.vmName : '' +output bastionName string = (isPrivate && deployJumpbox) ? bastion.outputs.bastionName : '' diff --git a/infra/bicep/main.json b/infra/bicep/main.json new file mode 100644 index 0000000..c97ff3d --- /dev/null +++ b/infra/bicep/main.json @@ -0,0 +1,43429 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "3235998341901409051" + } + }, + "parameters": { + "namePrefix": { + "type": "string", + "defaultValue": "invstdemo", + "metadata": { + "description": "Name prefix for all resources" + } + }, + "environment": { + "type": "string", + "defaultValue": "dev", + "metadata": { + "description": "Environment name (dev, staging, prod)" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true, deploys the zero-trust topology: VNet + private endpoints + internal ACA + disabled public network access on all PaaS resources." + } + }, + "deployJumpbox": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "When true (and isPrivate=true), also deploys a Linux jumpbox + Azure Bastion for operator access." + } + }, + "vnetAddressPrefix": { + "type": "string", + "defaultValue": "10.50.0.0/16", + "metadata": { + "description": "VNet address space used when isPrivate=true" + } + }, + "jumpboxAdminUsername": { + "type": "string", + "defaultValue": "azureuser", + "metadata": { + "description": "Admin username for the jumpbox VM" + } + }, + "jumpboxAdminPublicKey": { + "type": "securestring", + "defaultValue": "", + "metadata": { + "description": "SSH public key for the jumpbox VM (required when deployJumpbox=true)" + } + }, + "bastionSku": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Basic", + "Standard" + ], + "metadata": { + "description": "Azure Bastion SKU. Standard required for native-client tunneling." + } + }, + "cosmosDbName": { + "type": "string", + "defaultValue": "ai-investment-analysis-sample", + "metadata": { + "description": "Cosmos DB database name" + } + }, + "cosmosDBContainerNames": { + "type": "array", + "defaultValue": [ + { + "name": "opportunities", + "partitionKey": "/owner_id" + }, + { + "name": "users", + "partitionKey": "/email" + }, + { + "name": "documents", + "partitionKey": "/opportunity_id" + }, + { + "name": "analysis", + "partitionKey": "/opportunity_id" + }, + { + "name": "workflow_events", + "partitionKey": "/analysis_id" + }, + { + "name": "what_if_conversations", + "partitionKey": "/analysis_id" + } + ] + }, + "docsContainerName": { + "type": "string", + "defaultValue": "opportunity-documents", + "metadata": { + "description": "Name of the blob storage container for documents" + } + }, + "aiFoundryLocation": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for AI Foundry resources" + } + } + }, + "variables": { + "resourceGroupId": "[resourceGroup().id]", + "tags": { + "Environment": "[parameters('environment')]", + "Project": "ai-investment-analysis-sample" + }, + "shortHash": "[substring(uniqueString(resourceGroup().id, deployment().name), 0, 8)]", + "uaiName": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "resources": { + "jumpboxRgContributor": { + "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[guid(resourceGroup().id, variables('uaiName'), 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "properties": { + "principalId": "[reference('userAssignedIdentity').outputs.principalId.value]", + "principalType": "ServicePrincipal", + "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]" + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "network": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('networkDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "vnetName": { + "value": "[toLower(format('{0}-vnet-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "vnetAddressPrefix": { + "value": "[parameters('vnetAddressPrefix')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "11703013425078531364" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "vnetName": { + "type": "string", + "metadata": { + "description": "Virtual network name" + } + }, + "vnetAddressPrefix": { + "type": "string", + "defaultValue": "10.50.0.0/16", + "metadata": { + "description": "Address space for the virtual network" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": [ + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-pe', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [ + { + "name": "AllowHttpsInboundFromVnet", + "properties": { + "priority": 100, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRange": "443" + } + } + ] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-jumpbox', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [ + { + "name": "AllowBastionInbound", + "properties": { + "priority": 100, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "22", + "3389" + ] + } + } + ] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-bastion', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [ + { + "name": "AllowHttpsInbound", + "properties": { + "priority": 120, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "Internet", + "sourcePortRange": "*", + "destinationAddressPrefix": "*", + "destinationPortRange": "443" + } + }, + { + "name": "AllowGatewayManagerInbound", + "properties": { + "priority": 130, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "GatewayManager", + "sourcePortRange": "*", + "destinationAddressPrefix": "*", + "destinationPortRange": "443" + } + }, + { + "name": "AllowAzureLoadBalancerInbound", + "properties": { + "priority": 140, + "direction": "Inbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "AzureLoadBalancer", + "sourcePortRange": "*", + "destinationAddressPrefix": "*", + "destinationPortRange": "443" + } + }, + { + "name": "AllowBastionHostCommunication", + "properties": { + "priority": 150, + "direction": "Inbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "8080", + "5701" + ] + } + }, + { + "name": "AllowSshRdpOutbound", + "properties": { + "priority": 100, + "direction": "Outbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "22", + "3389" + ] + } + }, + { + "name": "AllowAzureCloudOutbound", + "properties": { + "priority": 110, + "direction": "Outbound", + "access": "Allow", + "protocol": "Tcp", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationAddressPrefix": "AzureCloud", + "destinationPortRange": "443" + } + }, + { + "name": "AllowBastionCommunication", + "properties": { + "priority": 120, + "direction": "Outbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "VirtualNetwork", + "sourcePortRange": "*", + "destinationAddressPrefix": "VirtualNetwork", + "destinationPortRanges": [ + "8080", + "5701" + ] + } + }, + { + "name": "AllowGetSessionInformation", + "properties": { + "priority": 130, + "direction": "Outbound", + "access": "Allow", + "protocol": "*", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationAddressPrefix": "Internet", + "destinationPortRange": "80" + } + } + ] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-aca', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-build', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-mgmt', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/networkSecurityGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nsg-appsvc', parameters('vnetName'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "securityRules": [] + } + }, + { + "type": "Microsoft.Network/virtualNetworks", + "apiVersion": "2023-11-01", + "name": "[parameters('vnetName')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "addressSpace": { + "addressPrefixes": [ + "[parameters('vnetAddressPrefix')]" + ] + }, + "subnets": [ + { + "name": "snet-aca-infra", + "properties": { + "addressPrefix": "10.50.0.0/23", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]" + }, + "delegations": [ + { + "name": "aca-delegation", + "properties": { + "serviceName": "Microsoft.App/environments" + } + } + ], + "privateEndpointNetworkPolicies": "Disabled" + } + }, + { + "name": "snet-pe", + "properties": { + "addressPrefix": "10.50.2.0/26", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" + }, + "privateEndpointNetworkPolicies": "Disabled" + } + }, + { + "name": "snet-jumpbox", + "properties": { + "addressPrefix": "10.50.2.64/27", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]" + } + } + }, + { + "name": "AzureBastionSubnet", + "properties": { + "addressPrefix": "10.50.2.128/26", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]" + } + } + }, + { + "name": "snet-build", + "properties": { + "addressPrefix": "10.50.2.192/27", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]" + }, + "privateEndpointNetworkPolicies": "Disabled" + } + }, + { + "name": "snet-mgmt", + "properties": { + "addressPrefix": "10.50.2.224/27", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]" + } + } + }, + { + "name": "snet-appsvc", + "properties": { + "addressPrefix": "10.50.4.0/26", + "networkSecurityGroup": { + "id": "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]" + }, + "delegations": [ + { + "name": "appsvc-delegation", + "properties": { + "serviceName": "Microsoft.Web/serverFarms" + } + } + ], + "serviceEndpoints": [ + { + "service": "Microsoft.CognitiveServices" + } + ] + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-aca', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-appsvc', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-bastion', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-build', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-jumpbox', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-mgmt', parameters('vnetName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-nsg-pe', parameters('vnetName')))]" + ] + } + ], + "outputs": { + "vnetId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName'))]" + }, + "vnetName": { + "type": "string", + "value": "[parameters('vnetName')]" + }, + "acaInfraSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-aca-infra', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "peSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-pe', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "jumpboxSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-jumpbox', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "bastionSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/AzureBastionSubnet', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "buildSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-build', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "mgmtSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-mgmt', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + }, + "appSvcSubnetId": { + "type": "string", + "value": "[format('{0}/subnets/snet-appsvc', resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')))]" + } + } + } + } + }, + "privateDns": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('privateDnsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "vnetId": { + "value": "[reference('network').outputs.vnetId.value]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "1570618753248278487" + } + }, + "parameters": { + "vnetId": { + "type": "string", + "metadata": { + "description": "Name of the VNet to link zones to" + } + }, + "location": { + "type": "string", + "defaultValue": "global", + "metadata": { + "description": "Location (zones are global; required for vnet-links)." + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "variables": { + "zoneNames": [ + "privatelink.documents.azure.com", + "[format('privatelink.blob.{0}', environment().suffixes.storage)]", + "privatelink.azurecr.io", + "privatelink.openai.azure.com", + "privatelink.cognitiveservices.azure.com", + "privatelink.services.ai.azure.com", + "privatelink.azconfig.io", + "privatelink.monitor.azure.com", + "privatelink.oms.opinsights.azure.com", + "privatelink.ods.opinsights.azure.com", + "privatelink.agentsvc.azure-automation.net", + "privatelink.azurewebsites.net" + ] + }, + "resources": [ + { + "copy": { + "name": "zones", + "count": "[length(variables('zoneNames'))]" + }, + "type": "Microsoft.Network/privateDnsZones", + "apiVersion": "2024-06-01", + "name": "[variables('zoneNames')[copyIndex()]]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]" + }, + { + "copy": { + "name": "links", + "count": "[length(variables('zoneNames'))]" + }, + "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks", + "apiVersion": "2024-06-01", + "name": "[format('{0}/link-{1}', variables('zoneNames')[copyIndex()], uniqueString(parameters('vnetId')))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "virtualNetwork": { + "id": "[parameters('vnetId')]" + }, + "registrationEnabled": false + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[copyIndex()])]", + "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[copyIndex()])]" + ] + } + ], + "outputs": { + "cosmosSqlZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[0])]" + }, + "blobZoneStorageSuffixId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[1])]" + }, + "acrZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[2])]" + }, + "openAiZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[3])]" + }, + "cognitiveServicesZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[4])]" + }, + "aiServicesZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[5])]" + }, + "appConfigZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[6])]" + }, + "monitorZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[7])]" + }, + "omsZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[8])]" + }, + "odsZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[9])]" + }, + "agentsvcZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[10])]" + }, + "appServiceZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[11])]" + }, + "blobFixedZoneId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateDnsZones', variables('zoneNames')[1])]" + } + } + } + }, + "dependsOn": [ + "network" + ] + }, + "userAssignedIdentity": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('userAssignedIdentityDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "userAssignedIdentityName": { + "value": "[toLower(format('{0}-uai-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "18363861408042767464" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources. Default is the resource group location" + } + }, + "userAssignedIdentityName": { + "type": "string", + "metadata": { + "description": "Required: User Assigned Identity name" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + } + }, + "resources": { + "userAssignedIdentity": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('userAssignedIdentity-{0}', uniqueString('userAssignedIdentity', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('userAssignedIdentityName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "16707109626832623586" + }, + "name": "User Assigned Identities", + "description": "This module deploys a User Assigned Identity." + }, + "definitions": { + "federatedIdentityCredentialType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the federated identity credential." + } + }, + "audiences": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of audiences that can appear in the issued token." + } + }, + "issuer": { + "type": "string", + "metadata": { + "description": "Required. The URL of the issuer to be trusted." + } + }, + "subject": { + "type": "string", + "metadata": { + "description": "Required. The identifier of the external identity." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the federated identity credential." + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the User Assigned Identity." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "federatedIdentityCredentials": { + "type": "array", + "items": { + "$ref": "#/definitions/federatedIdentityCredentialType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]", + "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "userAssignedIdentity": { + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]" + }, + "userAssignedIdentity_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "userAssignedIdentity_roleAssignments": { + "copy": { + "name": "userAssignedIdentity_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "userAssignedIdentity_federatedIdentityCredentials": { + "copy": { + "name": "userAssignedIdentity_federatedIdentityCredentials", + "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-UserMSI-FederatedIdentityCred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]" + }, + "userAssignedIdentityName": { + "value": "[parameters('name')]" + }, + "audiences": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]" + }, + "issuer": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]" + }, + "subject": { + "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13656021764446440473" + }, + "name": "User Assigned Identity Federated Identity Credential", + "description": "This module deploys a User Assigned Identity Federated Identity Credential." + }, + "parameters": { + "userAssignedIdentityName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret." + } + }, + "audiences": { + "type": "array", + "metadata": { + "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token." + } + }, + "issuer": { + "type": "string", + "metadata": { + "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged." + } + }, + "subject": { + "type": "string", + "metadata": { + "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD." + } + } + }, + "resources": [ + { + "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials", + "apiVersion": "2024-11-30", + "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]", + "properties": { + "audiences": "[parameters('audiences')]", + "issuer": "[parameters('issuer')]", + "subject": "[parameters('subject')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the federated identity credential." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the federated identity credential." + }, + "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the federated identity credential was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "userAssignedIdentity" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the user assigned identity." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the user assigned identity." + }, + "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]" + }, + "principalId": { + "type": "string", + "metadata": { + "description": "The principal ID (object ID) of the user assigned identity." + }, + "value": "[reference('userAssignedIdentity').principalId]" + }, + "clientId": { + "type": "string", + "metadata": { + "description": "The client ID (application ID) of the user assigned identity." + }, + "value": "[reference('userAssignedIdentity').clientId]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the user assigned identity was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('userAssignedIdentity', '2024-11-30', 'full').location]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.name.value]" + }, + "resourceId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" + }, + "principalId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.principalId.value]" + }, + "clientId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.clientId.value]" + } + } + } + } + }, + "logAnalytics": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('logAnalyticsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[toLower(format('{0}-law-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "5234070563222356141" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Log Analytics workspace name" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "User Assigned Identity that be given access to the Log Analytics Workspace" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public ingestion/query + local auth (access via AMPLS)." + } + } + }, + "resources": { + "logAnalytics": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('logAnalytics-{0}', uniqueString('logAnalytics', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('logAnalyticsWorkspaceName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "skuName": { + "value": "PerGB2018" + }, + "dataRetention": { + "value": 30 + }, + "publicNetworkAccessForIngestion": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "publicNetworkAccessForQuery": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "features": { + "value": { + "disableLocalAuth": "[parameters('isPrivate')]" + } + }, + "roleAssignments": { + "copy": [ + { + "name": "value", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": "[createObject('principalId', parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('value')], 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Log Analytics Contributor')]" + } + ] + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "1749032521457140145" + }, + "name": "Log Analytics Workspaces", + "description": "This module deploys a Log Analytics Workspace." + }, + "definitions": { + "diagnosticSettingType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "useThisWorkspace": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + } + }, + "gallerySolutionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive." + } + }, + "plan": { + "$ref": "#/definitions/solutionPlanType", + "metadata": { + "description": "Required. Plan for solution object supported by the OperationsManagement resource provider." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the gallery solutions to be created in the log analytics workspace." + } + }, + "storageInsightsConfigType": { + "type": "object", + "properties": { + "storageAccountResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the storage account to be linked." + } + }, + "containers": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The names of the blob containers that the workspace should read." + } + }, + "tables": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of tables to be read by the workspace." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the storage insights configuration." + } + }, + "linkedServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the linked service." + } + }, + "resourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access." + } + }, + "writeAccessResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the linked service." + } + }, + "linkedStorageAccountType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the link." + } + }, + "storageAccountIds": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "metadata": { + "description": "Required. Linked storage accounts resources Ids." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the linked storage account." + } + }, + "savedSearchType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the saved search." + } + }, + "etag": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag." + } + }, + "category": { + "type": "string", + "metadata": { + "description": "Required. The category of the saved search. This helps the user to find a saved search faster." + } + }, + "displayName": { + "type": "string", + "metadata": { + "description": "Required. Display name for the search." + } + }, + "functionAlias": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The function alias if query serves as a function." + } + }, + "functionParameters": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions." + } + }, + "query": { + "type": "string", + "metadata": { + "description": "Required. The query expression for the saved search." + } + }, + "tags": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The tags attached to the saved search." + } + }, + "version": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The version number of the query language. The current version is 2 and is the default." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the saved search." + } + }, + "dataExportType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the data export." + } + }, + "destination": { + "$ref": "#/definitions/destinationType", + "nullable": true, + "metadata": { + "description": "Optional. The destination of the data export." + } + }, + "enable": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the data export." + } + }, + "tableNames": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of table names to export." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the data export." + } + }, + "dataSourceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the data source." + } + }, + "kind": { + "type": "string", + "metadata": { + "description": "Required. The kind of data source." + } + }, + "linkedResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource id of the resource that will be linked to the workspace." + } + }, + "eventLogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the event log to configure when kind is WindowsEvent." + } + }, + "eventTypes": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The event types to configure when kind is WindowsEvent." + } + }, + "objectName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "instanceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "intervalSeconds": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "performanceCounters": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject." + } + }, + "counterName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter." + } + }, + "state": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection." + } + }, + "syslogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. System log to configure when kind is LinuxSyslog." + } + }, + "syslogSeverities": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Severities to configure when kind is LinuxSyslog." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the data source." + } + }, + "tableType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the table." + } + }, + "plan": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The plan for the table." + } + }, + "restoredLogs": { + "$ref": "#/definitions/restoredLogsType", + "nullable": true, + "metadata": { + "description": "Optional. The restored logs for the table." + } + }, + "schema": { + "$ref": "#/definitions/schemaType", + "nullable": true, + "metadata": { + "description": "Optional. The schema for the table." + } + }, + "searchResults": { + "$ref": "#/definitions/searchResultsType", + "nullable": true, + "metadata": { + "description": "Optional. The search results for the table." + } + }, + "retentionInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The retention in days for the table." + } + }, + "totalRetentionInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The total retention in days for the table." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The role assignments for the table." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Properties of the custom table." + } + }, + "workspaceFeaturesType": { + "type": "object", + "properties": { + "disableLocalAuth": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Disable Non-EntraID based Auth. Default is true." + } + }, + "enableDataExport": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag that indicate if data should be exported." + } + }, + "enableLogAccessUsingOnlyResourcePermissions": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable log access using only resource permissions. Default is false." + } + }, + "immediatePurgeDataOn30Days": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag that describes if we want to remove the data after 30 days." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Features of the workspace." + } + }, + "workspaceReplicationType": { + "type": "object", + "properties": { + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The location to which the workspace is replicated. Required if replication is enabled." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Replication properties of the workspace." + } + }, + "_1.columnType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The column name." + } + }, + "type": { + "type": "string", + "allowedValues": [ + "boolean", + "dateTime", + "dynamic", + "guid", + "int", + "long", + "real", + "string" + ], + "metadata": { + "description": "Required. The column type." + } + }, + "dataTypeHint": { + "type": "string", + "allowedValues": [ + "armPath", + "guid", + "ip", + "uri" + ], + "nullable": true, + "metadata": { + "description": "Optional. The column data type logical hint." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The column description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Column display name." + } + } + }, + "metadata": { + "description": "The parameters of the table column.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "destinationType": { + "type": "object", + "properties": { + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The destination resource ID." + } + }, + "metaData": { + "type": "object", + "properties": { + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The destination metadata." + } + } + }, + "metadata": { + "description": "The data export destination properties.", + "__bicep_imported_from!": { + "sourceTemplate": "data-export/main.bicep" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "restoredLogsType": { + "type": "object", + "properties": { + "sourceTable": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table to restore data from." + } + }, + "startRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the restore from (UTC)." + } + }, + "endRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the restore by (UTC)." + } + } + }, + "metadata": { + "description": "The parameters of the restore operation that initiated the table.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "schemaType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The table name." + } + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.columnType" + }, + "metadata": { + "description": "Required. A list of table custom columns." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table display name." + } + } + }, + "metadata": { + "description": "The table schema.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "searchResultsType": { + "type": "object", + "properties": { + "query": { + "type": "string", + "metadata": { + "description": "Required. The search job query." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The search description." + } + }, + "limit": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Limit the search job to return up to specified number of rows." + } + }, + "startSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the search from (UTC)." + } + }, + "endSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the search by (UTC)." + } + } + }, + "metadata": { + "description": "The parameters of the search job that initiated the table.", + "__bicep_imported_from!": { + "sourceTemplate": "table/main.bicep" + } + } + }, + "solutionPlanType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used." + } + }, + "product": { + "type": "string", + "metadata": { + "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive." + } + }, + "publisher": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Log Analytics workspace." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "skuName": { + "type": "string", + "defaultValue": "PerGB2018", + "allowedValues": [ + "CapacityReservation", + "Free", + "LACluster", + "PerGB2018", + "PerNode", + "Premium", + "Standalone", + "Standard" + ], + "metadata": { + "description": "Optional. The name of the SKU." + } + }, + "skuCapacityReservationLevel": { + "type": "int", + "defaultValue": 100, + "minValue": 100, + "maxValue": 5000, + "metadata": { + "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000." + } + }, + "storageInsightsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/storageInsightsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of storage accounts to be read by the workspace." + } + }, + "linkedServices": { + "type": "array", + "items": { + "$ref": "#/definitions/linkedServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of services to be linked." + } + }, + "linkedStorageAccounts": { + "type": "array", + "items": { + "$ref": "#/definitions/linkedStorageAccountType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty." + } + }, + "savedSearches": { + "type": "array", + "items": { + "$ref": "#/definitions/savedSearchType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Kusto Query Language searches to save." + } + }, + "dataExports": { + "type": "array", + "items": { + "$ref": "#/definitions/dataExportType" + }, + "nullable": true, + "metadata": { + "description": "Optional. LAW data export instances to be deployed." + } + }, + "dataSources": { + "type": "array", + "items": { + "$ref": "#/definitions/dataSourceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. LAW data sources to configure." + } + }, + "tables": { + "type": "array", + "items": { + "$ref": "#/definitions/tableType" + }, + "nullable": true, + "metadata": { + "description": "Optional. LAW custom tables to be deployed." + } + }, + "gallerySolutions": { + "type": "array", + "items": { + "$ref": "#/definitions/gallerySolutionType" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of gallerySolutions to be created in the log analytics workspace." + } + }, + "onboardWorkspaceToSentinel": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions." + } + }, + "dataRetention": { + "type": "int", + "defaultValue": 365, + "minValue": 0, + "maxValue": 730, + "metadata": { + "description": "Optional. Number of days data will be retained for." + } + }, + "dailyQuotaGb": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "metadata": { + "description": "Optional. The workspace daily quota for ingestion." + } + }, + "publicNetworkAccessForIngestion": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Log Analytics ingestion." + } + }, + "publicNetworkAccessForQuery": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Log Analytics query." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both." + } + }, + "features": { + "$ref": "#/definitions/workspaceFeaturesType", + "nullable": true, + "metadata": { + "description": "Optional. The workspace features." + } + }, + "replication": { + "$ref": "#/definitions/workspaceReplicationType", + "nullable": true, + "metadata": { + "description": "Optional. The workspace replication properties." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "forceCmkForQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether customer managed storage is mandatory for query management." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces@2025-02-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]", + "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]", + "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]", + "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]", + "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "logAnalyticsWorkspace": { + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "features": { + "searchVersion": 1, + "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]", + "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]", + "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]", + "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]" + }, + "sku": { + "name": "[parameters('skuName')]", + "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]" + }, + "retentionInDays": "[parameters('dataRetention')]", + "workspaceCapping": { + "dailyQuotaGb": "[parameters('dailyQuotaGb')]" + }, + "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]", + "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]", + "forceCmkForQuery": "[parameters('forceCmkForQuery')]", + "replication": "[parameters('replication')]" + }, + "identity": "[variables('identity')]" + }, + "logAnalyticsWorkspace_diagnosticSettings": { + "copy": { + "name": "logAnalyticsWorkspace_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_sentinelOnboarding": { + "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]", + "type": "Microsoft.SecurityInsights/onboardingStates", + "apiVersion": "2024-03-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "default", + "properties": {}, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_roleAssignments": { + "copy": { + "name": "logAnalyticsWorkspace_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_storageInsightConfigs": { + "copy": { + "name": "logAnalyticsWorkspace_storageInsightConfigs", + "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "containers": { + "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]" + }, + "tables": { + "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]" + }, + "storageAccountResourceId": { + "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "1306323182548882150" + }, + "name": "Log Analytics Workspace Storage Insight Configs", + "description": "This module deploys a Log Analytics Workspace Storage Insight Config." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]", + "metadata": { + "description": "Optional. The name of the storage insights config." + } + }, + "storageAccountResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Azure Resource Manager ID of the storage account resource." + } + }, + "containers": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The names of the blob containers that the workspace should read." + } + }, + "tables": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The names of the Azure tables that the workspace should read." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + } + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[last(split(parameters('storageAccountResourceId'), '/'))]" + }, + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "storageinsightconfig": { + "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "containers": "[parameters('containers')]", + "tables": "[parameters('tables')]", + "storageAccount": { + "id": "[parameters('storageAccountResourceId')]", + "key": "[listKeys('storageAccount', '2024-01-01').keys[0].value]" + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed storage insights configuration." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the storage insight configuration is deployed." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the storage insights configuration." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_linkedServices": { + "copy": { + "name": "logAnalyticsWorkspace_linkedServices", + "count": "[length(coalesce(parameters('linkedServices'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]" + }, + "resourceId": { + "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]" + }, + "writeAccessResourceId": { + "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "5230241501765697269" + }, + "name": "Log Analytics Workspace Linked Services", + "description": "This module deploys a Log Analytics Workspace Linked Service." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the link." + } + }, + "resourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access." + } + }, + "writeAccessResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/linkedServices@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "linkedService": { + "type": "Microsoft.OperationalInsights/workspaces/linkedServices", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resourceId": "[parameters('resourceId')]", + "writeAccessResourceId": "[parameters('writeAccessResourceId')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed linked service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed linked service." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the linked service is deployed." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_linkedStorageAccounts": { + "copy": { + "name": "logAnalyticsWorkspace_linkedStorageAccounts", + "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]" + }, + "storageAccountIds": { + "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "10372135754202496594" + }, + "name": "Log Analytics Workspace Linked Storage Accounts", + "description": "This module deploys a Log Analytics Workspace Linked Storage Account." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "allowedValues": [ + "Query", + "Alerts", + "CustomLogs", + "AzureWatson" + ], + "metadata": { + "description": "Required. Name of the link." + } + }, + "storageAccountIds": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "metadata": { + "description": "Required. Linked storage accounts resources Ids." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "linkedStorageAccount": { + "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "properties": { + "storageAccountIds": "[parameters('storageAccountIds')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed linked storage account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed linked storage account." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the linked storage account is deployed." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_savedSearches": { + "copy": { + "name": "logAnalyticsWorkspace_savedSearches", + "count": "[length(coalesce(parameters('savedSearches'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(deployment().name))]" + }, + "etag": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]" + }, + "displayName": { + "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]" + }, + "category": { + "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]" + }, + "query": { + "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]" + }, + "functionAlias": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]" + }, + "functionParameters": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]" + }, + "tags": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]" + }, + "version": { + "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "9015459905306126128" + }, + "name": "Log Analytics Workspace Saved Searches", + "description": "This module deploys a Log Analytics Workspace Saved Search." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the saved search." + } + }, + "displayName": { + "type": "string", + "metadata": { + "description": "Required. Display name for the search." + } + }, + "category": { + "type": "string", + "metadata": { + "description": "Required. Query category." + } + }, + "query": { + "type": "string", + "metadata": { + "description": "Required. Kusto Query to be stored." + } + }, + "tags": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01#properties/properties/properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + }, + "functionAlias": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The function alias if query serves as a function." + } + }, + "functionParameters": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions." + } + }, + "version": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The version number of the query language." + } + }, + "etag": { + "type": "string", + "defaultValue": "*", + "metadata": { + "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "savedSearch": { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "properties": { + "etag": "[parameters('etag')]", + "tags": "[coalesce(parameters('tags'), createArray())]", + "displayName": "[parameters('displayName')]", + "category": "[parameters('category')]", + "query": "[parameters('query')]", + "functionAlias": "[parameters('functionAlias')]", + "functionParameters": "[parameters('functionParameters')]", + "version": "[parameters('version')]" + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed saved search." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the saved search is deployed." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed saved search." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace", + "logAnalyticsWorkspace_linkedStorageAccounts" + ] + }, + "logAnalyticsWorkspace_dataExports": { + "copy": { + "name": "logAnalyticsWorkspace_dataExports", + "count": "[length(coalesce(parameters('dataExports'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "workspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]" + }, + "destination": { + "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]" + }, + "enable": { + "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]" + }, + "tableNames": { + "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "8586520532175356447" + }, + "name": "Log Analytics Workspace Data Exports", + "description": "This module deploys a Log Analytics Workspace Data Export." + }, + "definitions": { + "destinationType": { + "type": "object", + "properties": { + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The destination resource ID." + } + }, + "metaData": { + "type": "object", + "properties": { + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The destination metadata." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The data export destination properties." + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 4, + "maxLength": 63, + "metadata": { + "description": "Required. The data export rule name." + } + }, + "workspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment." + } + }, + "destination": { + "$ref": "#/definitions/destinationType", + "nullable": true, + "metadata": { + "description": "Optional. Destination properties." + } + }, + "enable": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Active when enabled." + } + }, + "tableNames": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "metadata": { + "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('workspaceName')]" + }, + "dataExport": { + "type": "Microsoft.OperationalInsights/workspaces/dataExports", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]", + "properties": { + "destination": "[parameters('destination')]", + "enable": "[parameters('enable')]", + "tableNames": "[parameters('tableNames')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the data export." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the data export." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the data export was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_dataSources": { + "copy": { + "name": "logAnalyticsWorkspace_dataSources", + "count": "[length(coalesce(parameters('dataSources'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]" + }, + "kind": { + "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]" + }, + "linkedResourceId": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]" + }, + "eventLogName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]" + }, + "eventTypes": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]" + }, + "objectName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]" + }, + "instanceName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]" + }, + "intervalSeconds": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]" + }, + "counterName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]" + }, + "state": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]" + }, + "syslogName": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]" + }, + "syslogSeverities": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]" + }, + "performanceCounters": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]" + }, + "tags": { + "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "8336916453932906250" + }, + "name": "Log Analytics Workspace Datasources", + "description": "This module deploys a Log Analytics Workspace Data Source." + }, + "parameters": { + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the data source." + } + }, + "kind": { + "type": "string", + "defaultValue": "AzureActivityLog", + "allowedValues": [ + "AzureActivityLog", + "WindowsEvent", + "WindowsPerformanceCounter", + "IISLogs", + "LinuxSyslog", + "LinuxSyslogCollection", + "LinuxPerformanceObject", + "LinuxPerformanceCollection" + ], + "metadata": { + "description": "Optional. The kind of the data source." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags" + }, + "description": "Optional. Tags to configure in the resource." + }, + "nullable": true + }, + "linkedResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the resource to be linked." + } + }, + "eventLogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Windows event log name to configure when kind is WindowsEvent." + } + }, + "eventTypes": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Windows event types to configure when kind is WindowsEvent." + } + }, + "objectName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "instanceName": { + "type": "string", + "defaultValue": "*", + "metadata": { + "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "intervalSeconds": { + "type": "int", + "defaultValue": 60, + "metadata": { + "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject." + } + }, + "performanceCounters": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject." + } + }, + "counterName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter." + } + }, + "state": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection." + } + }, + "syslogName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. System log to configure when kind is LinuxSyslog." + } + }, + "syslogSeverities": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Severities to configure when kind is LinuxSyslog." + } + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "dataSource": { + "type": "Microsoft.OperationalInsights/workspaces/dataSources", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]", + "kind": "[parameters('kind')]", + "tags": "[parameters('tags')]", + "properties": { + "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]", + "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]", + "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]", + "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]", + "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]", + "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]", + "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]", + "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]", + "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]", + "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]", + "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]" + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed data source." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the data source is deployed." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed data source." + }, + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_tables": { + "copy": { + "name": "logAnalyticsWorkspace_tables", + "count": "[length(coalesce(parameters('tables'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "workspaceName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]" + }, + "plan": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]" + }, + "schema": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]" + }, + "retentionInDays": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]" + }, + "totalRetentionInDays": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]" + }, + "restoredLogs": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]" + }, + "searchResults": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.36.1.42791", + "templateHash": "315390662258960765" + }, + "name": "Log Analytics Workspace Tables", + "description": "This module deploys a Log Analytics Workspace Table." + }, + "definitions": { + "restoredLogsType": { + "type": "object", + "properties": { + "sourceTable": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table to restore data from." + } + }, + "startRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the restore from (UTC)." + } + }, + "endRestoreTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the restore by (UTC)." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The parameters of the restore operation that initiated the table." + } + }, + "schemaType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The table name." + } + }, + "columns": { + "type": "array", + "items": { + "$ref": "#/definitions/columnType" + }, + "metadata": { + "description": "Required. A list of table custom columns." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The table display name." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The table schema." + } + }, + "columnType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The column name." + } + }, + "type": { + "type": "string", + "allowedValues": [ + "boolean", + "dateTime", + "dynamic", + "guid", + "int", + "long", + "real", + "string" + ], + "metadata": { + "description": "Required. The column type." + } + }, + "dataTypeHint": { + "type": "string", + "allowedValues": [ + "armPath", + "guid", + "ip", + "uri" + ], + "nullable": true, + "metadata": { + "description": "Optional. The column data type logical hint." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The column description." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Column display name." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The parameters of the table column." + } + }, + "searchResultsType": { + "type": "object", + "properties": { + "query": { + "type": "string", + "metadata": { + "description": "Required. The search job query." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The search description." + } + }, + "limit": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Limit the search job to return up to specified number of rows." + } + }, + "startSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to start the search from (UTC)." + } + }, + "endSearchTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The timestamp to end the search by (UTC)." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The parameters of the search job that initiated the table." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the table." + } + }, + "workspaceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment." + } + }, + "plan": { + "type": "string", + "defaultValue": "Analytics", + "allowedValues": [ + "Basic", + "Analytics" + ], + "metadata": { + "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table." + } + }, + "restoredLogs": { + "$ref": "#/definitions/restoredLogsType", + "nullable": true, + "metadata": { + "description": "Optional. Restore parameters." + } + }, + "retentionInDays": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 730, + "metadata": { + "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention." + } + }, + "schema": { + "$ref": "#/definitions/schemaType", + "nullable": true, + "metadata": { + "description": "Optional. Table's schema." + } + }, + "searchResults": { + "$ref": "#/definitions/searchResultsType", + "nullable": true, + "metadata": { + "description": "Optional. Parameters of the search job that initiated this table." + } + }, + "totalRetentionInDays": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 2555, + "metadata": { + "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]", + "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]", + "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]", + "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "workspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2025-02-01", + "name": "[parameters('workspaceName')]" + }, + "table": { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2025-02-01", + "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]", + "properties": { + "plan": "[parameters('plan')]", + "restoredLogs": "[parameters('restoredLogs')]", + "retentionInDays": "[parameters('retentionInDays')]", + "schema": "[parameters('schema')]", + "searchResults": "[parameters('searchResults')]", + "totalRetentionInDays": "[parameters('totalRetentionInDays')]" + } + }, + "table_roleAssignments": { + "copy": { + "name": "table_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "table" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the table." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the table." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the table was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + }, + "logAnalyticsWorkspace_solutions": { + "copy": { + "name": "logAnalyticsWorkspace_solutions", + "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]" + }, + "condition": "[not(empty(parameters('gallerySolutions')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]" + }, + "location": { + "value": "[parameters('location')]" + }, + "logAnalyticsWorkspaceName": { + "value": "[parameters('name')]" + }, + "plan": { + "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.32.4.45862", + "templateHash": "10255889523646649592" + }, + "name": "Operations Management Solutions", + "description": "This module deploys an Operations Management Solution.", + "owner": "Azure/module-maintainers" + }, + "definitions": { + "solutionPlanType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used." + } + }, + "product": { + "type": "string", + "metadata": { + "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive." + } + }, + "publisher": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive." + } + }, + "plan": { + "$ref": "#/definitions/solutionPlanType", + "metadata": { + "description": "Required. Plan for solution object supported by the OperationsManagement resource provider." + } + }, + "logAnalyticsWorkspaceName": { + "type": "string", + "metadata": { + "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "logAnalyticsWorkspace": { + "existing": true, + "type": "Microsoft.OperationalInsights/workspaces", + "apiVersion": "2021-06-01", + "name": "[parameters('logAnalyticsWorkspaceName')]" + }, + "solution": { + "type": "Microsoft.OperationsManagement/solutions", + "apiVersion": "2015-11-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "properties": { + "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]" + }, + "plan": { + "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]", + "promotionCode": "", + "product": "[parameters('plan').product]", + "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed solution." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed solution." + }, + "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group where the solution is deployed." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('solution', '2015-11-01-preview', 'full').location]" + } + } + } + }, + "dependsOn": [ + "logAnalyticsWorkspace" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed log analytics workspace." + }, + "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed log analytics workspace." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed log analytics workspace." + }, + "value": "[parameters('name')]" + }, + "logAnalyticsWorkspaceId": { + "type": "string", + "metadata": { + "description": "The ID associated with the workspace." + }, + "value": "[reference('logAnalyticsWorkspace').customerId]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('logAnalyticsWorkspace', '2025-02-01', 'full').location]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2025-02-01', 'full'), 'identity'), 'principalId')]" + }, + "primarySharedKey": { + "type": "securestring", + "metadata": { + "description": "The primary shared key of the log analytics workspace." + }, + "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').primarySharedKey]" + }, + "secondarySharedKey": { + "type": "securestring", + "metadata": { + "description": "The secondary shared key of the log analytics workspace." + }, + "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').secondarySharedKey]" + } + } + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "value": "[reference('logAnalytics').outputs.resourceId.value]" + }, + "name": { + "type": "string", + "value": "[reference('logAnalytics').outputs.name.value]" + }, + "logAnalyticsWorkspaceId": { + "type": "string", + "value": "[reference('logAnalytics').outputs.logAnalyticsWorkspaceId.value]" + }, + "primarySharedKey": { + "type": "securestring", + "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').primarySharedKey]" + }, + "secondarySharedKey": { + "type": "securestring", + "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').secondarySharedKey]" + } + } + } + }, + "dependsOn": [ + "userAssignedIdentity" + ] + }, + "appInsights": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('appInsightsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "appInsightsName": { + "value": "[toLower(format('{0}-appi-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "logAnalyticsResourceId": { + "value": "[reference('logAnalytics').outputs.resourceId.value]" + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "17022316607490420998" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "appInsightsName": { + "type": "string", + "metadata": { + "description": "Application Insights name" + } + }, + "logAnalyticsResourceId": { + "type": "string", + "metadata": { + "description": "Log Analytics resource id output from log-analytics-ws.bicep module" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables local auth + public ingestion/query (connect via AMPLS)." + } + } + }, + "resources": { + "applicationInsights": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('applicationInsights-{0}', uniqueString('applicationInsights', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('appInsightsName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "workspaceResourceId": { + "value": "[parameters('logAnalyticsResourceId')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "disableLocalAuth": { + "value": "[parameters('isPrivate')]" + }, + "publicNetworkAccessForIngestion": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "publicNetworkAccessForQuery": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.33.93.31351", + "templateHash": "5735496719243704506" + }, + "name": "Application Insights", + "description": "This component deploys an Application Insights instance." + }, + "definitions": { + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Application Insights." + } + }, + "applicationType": { + "type": "string", + "defaultValue": "web", + "allowedValues": [ + "web", + "other" + ], + "metadata": { + "description": "Optional. Application type." + } + }, + "workspaceResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property." + } + }, + "disableIpMasking": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Disable IP masking. Default value is set to true." + } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Disable Non-AAD based Auth. Default value is set to false." + } + }, + "forceCustomerStorageForProfiler": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Force users to create their own storage account for profiler and debugger." + } + }, + "linkedStorageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Linked storage account resource ID." + } + }, + "publicNetworkAccessForIngestion": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled." + } + }, + "publicNetworkAccessForQuery": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled." + } + }, + "retentionInDays": { + "type": "int", + "defaultValue": 365, + "allowedValues": [ + 30, + 60, + 90, + 120, + 180, + 270, + 365, + 550, + 730 + ], + "metadata": { + "description": "Optional. Retention period in days." + } + }, + "samplingPercentage": { + "type": "int", + "defaultValue": 100, + "minValue": 0, + "maxValue": 100, + "metadata": { + "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry." + } + }, + "flowType": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API." + } + }, + "requestSource": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'." + } + }, + "kind": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]", + "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]", + "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]", + "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]", + "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "appInsights": { + "type": "Microsoft.Insights/components", + "apiVersion": "2020-02-02", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "kind": "[parameters('kind')]", + "properties": { + "Application_Type": "[parameters('applicationType')]", + "DisableIpMasking": "[parameters('disableIpMasking')]", + "DisableLocalAuth": "[parameters('disableLocalAuth')]", + "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]", + "WorkspaceResourceId": "[parameters('workspaceResourceId')]", + "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]", + "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]", + "RetentionInDays": "[parameters('retentionInDays')]", + "SamplingPercentage": "[parameters('samplingPercentage')]", + "Flow_Type": "[parameters('flowType')]", + "Request_Source": "[parameters('requestSource')]" + } + }, + "appInsights_roleAssignments": { + "copy": { + "name": "appInsights_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "appInsights" + ] + }, + "appInsights_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "appInsights" + ] + }, + "appInsights_diagnosticSettings": { + "copy": { + "name": "appInsights_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "appInsights" + ] + }, + "linkedStorageAccount": { + "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "appInsightsName": { + "value": "[parameters('name')]" + }, + "storageAccountResourceId": { + "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.33.93.31351", + "templateHash": "10861379689695100897" + }, + "name": "Application Insights Linked Storage Account", + "description": "This component deploys an Application Insights Linked Storage Account." + }, + "parameters": { + "appInsightsName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment." + } + }, + "storageAccountResourceId": { + "type": "string", + "metadata": { + "description": "Required. Linked storage account resource ID." + } + } + }, + "resources": [ + { + "type": "microsoft.insights/components/linkedStorageAccounts", + "apiVersion": "2020-03-01-preview", + "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]", + "properties": { + "linkedStorageAccount": "[parameters('storageAccountResourceId')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the Linked Storage Account." + }, + "value": "ServiceProfiler" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Linked Storage Account." + }, + "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the agent pool was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "appInsights" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the application insights component." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the application insights component." + }, + "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the application insights component was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "applicationId": { + "type": "string", + "metadata": { + "description": "The application ID of the application insights component." + }, + "value": "[reference('appInsights').AppId]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('appInsights', '2020-02-02', 'full').location]" + }, + "instrumentationKey": { + "type": "string", + "metadata": { + "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component." + }, + "value": "[reference('appInsights').InstrumentationKey]" + }, + "connectionString": { + "type": "string", + "metadata": { + "description": "Application Insights Connection String." + }, + "value": "[reference('appInsights').ConnectionString]" + } + } + } + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "value": "[reference('applicationInsights').outputs.resourceId.value]" + }, + "applicationId": { + "type": "string", + "value": "[reference('applicationInsights').outputs.applicationId.value]" + }, + "instrumentationKey": { + "type": "string", + "value": "[reference('applicationInsights').outputs.instrumentationKey.value]" + }, + "connectionString": { + "type": "string", + "value": "[reference('applicationInsights').outputs.connectionString.value]" + } + } + } + }, + "dependsOn": [ + "logAnalytics" + ] + }, + "ampls": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('amplsDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-ampls-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "logAnalyticsResourceId": { + "value": "[reference('logAnalytics').outputs.resourceId.value]" + }, + "appInsightsResourceId": { + "value": "[reference('appInsights').outputs.resourceId.value]" + }, + "privateEndpointSubnetId": { + "value": "[reference('network').outputs.peSubnetId.value]" + }, + "privateEndpointLocation": { + "value": "[parameters('location')]" + }, + "privateDnsZoneIds": { + "value": [ + "[reference('privateDns').outputs.monitorZoneId.value]", + "[reference('privateDns').outputs.omsZoneId.value]", + "[reference('privateDns').outputs.odsZoneId.value]", + "[reference('privateDns').outputs.agentsvcZoneId.value]", + "[reference('privateDns').outputs.blobFixedZoneId.value]" + ] + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "3981484094208687748" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "global", + "metadata": { + "description": "Location (AMPLS is a global resource; use global)" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "AMPLS resource name" + } + }, + "logAnalyticsResourceId": { + "type": "string", + "metadata": { + "description": "Log Analytics Workspace resource id to scope" + } + }, + "appInsightsResourceId": { + "type": "string", + "metadata": { + "description": "Application Insights component resource id to scope" + } + }, + "privateEndpointSubnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "privateEndpointLocation": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Resource group location for the private endpoint resource" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Private DNS zone resource ids for Azure Monitor PLS (monitor, oms, ods, agentsvc, blob)" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "ampls": { + "type": "microsoft.insights/privateLinkScopes", + "apiVersion": "2021-07-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "accessModeSettings": { + "ingestionAccessMode": "PrivateOnly", + "queryAccessMode": "PrivateOnly" + } + } + }, + "lawScope": { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', parameters('name'), 'law-scope')]", + "properties": { + "linkedResourceId": "[parameters('logAnalyticsResourceId')]" + }, + "dependsOn": [ + "ampls" + ] + }, + "appiScope": { + "type": "Microsoft.Insights/privateLinkScopes/scopedResources", + "apiVersion": "2021-07-01-preview", + "name": "[format('{0}/{1}', parameters('name'), 'appi-scope')]", + "properties": { + "linkedResourceId": "[parameters('appInsightsResourceId')]" + }, + "dependsOn": [ + "ampls" + ] + }, + "ampPe": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('ampls-pe-{0}', uniqueString(resourceId('microsoft.insights/privateLinkScopes', parameters('name'))))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe', parameters('name'))]" + }, + "location": { + "value": "[parameters('privateEndpointLocation')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('microsoft.insights/privateLinkScopes', parameters('name'))]" + }, + "groupIds": { + "value": [ + "azuremonitor" + ] + }, + "privateDnsZoneIds": { + "value": "[parameters('privateDnsZoneIds')]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "ampls", + "appiScope", + "lawScope" + ] + } + }, + "outputs": { + "amplsId": { + "type": "string", + "value": "[resourceId('microsoft.insights/privateLinkScopes', parameters('name'))]" + }, + "amplsName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "appInsights", + "logAnalytics", + "network", + "privateDns" + ] + }, + "storage": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('storageAccountDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": "[if(greater(length(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), 24), createObject('value', substring(toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId')))), 0, 24)), createObject('value', toLower(format('{0}sta{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))))]", + "location": { + "value": "[parameters('location')]" + }, + "docsContainerName": { + "value": "[parameters('docsContainerName')]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "privateEndpointSubnetId": "[if(parameters('isPrivate'), createObject('value', reference('network').outputs.peSubnetId.value), createObject('value', ''))]", + "blobPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.blobZoneStorageSuffixId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "8066018424758563884" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources" + } + }, + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Required: Storage account name" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Managed Identity that will be given access to the Storage Account" + } + }, + "docsContainerName": { + "type": "string", + "defaultValue": "opportunity-documents", + "metadata": { + "description": "Optional: Name of the blob container for opportunity documents. Default is \"opportunity-documents\"" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public network access and deploys a private endpoint for blob." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource id for the private endpoint (required when isPrivate=true)" + } + }, + "blobPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for blob (required when isPrivate=true)" + } + } + }, + "variables": { + "copy": [ + { + "name": "accountRoleAssignments", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('accountRoleAssignments')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "Contributor" + } + }, + { + "name": "blobRoleAssignments", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('blobRoleAssignments')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "Storage Blob Data Contributor" + } + } + ], + "deployerRoleAssignments": [ + { + "principalId": "[deployer().objectId]", + "principalType": "User", + "roleDefinitionIdOrName": "Storage Blob Data Contributor" + }, + { + "principalId": "[deployer().objectId]", + "principalType": "User", + "roleDefinitionIdOrName": "Storage Queue Data Contributor" + } + ] + }, + "resources": { + "storageAccountRef": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2023-05-01", + "name": "[parameters('storageAccountName')]", + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('storageAccount-{0}', uniqueString('storageAccount', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('storageAccountName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "kind": { + "value": "StorageV2" + }, + "skuName": { + "value": "Standard_LRS" + }, + "accessTier": { + "value": "Hot" + }, + "allowSharedKeyAccess": { + "value": false + }, + "enableHierarchicalNamespace": { + "value": false + }, + "publicNetworkAccess": "[if(parameters('isPrivate'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "networkAcls": { + "value": { + "defaultAction": "[if(parameters('isPrivate'), 'Deny', 'Allow')]", + "bypass": "AzureServices" + } + }, + "blobServices": { + "value": { + "automaticSnapshotPolicyEnabled": true, + "containerDeleteRetentionPolicyDays": 7, + "containerDeleteRetentionPolicyEnabled": true, + "containers": [ + { + "name": "[parameters('docsContainerName')]", + "publicAccess": "None" + } + ] + } + }, + "roleAssignments": { + "value": "[concat(variables('accountRoleAssignments'), variables('blobRoleAssignments'), variables('deployerRoleAssignments'))]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3530476863855541150" + }, + "name": "Storage Accounts", + "description": "This module deploys a Storage Account." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoints output." + } + }, + "networkAclsType": { + "type": "object", + "properties": { + "resourceAccessRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "metadata": { + "description": "Required. The ID of the tenant in which the resource resides in." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only." + } + }, + "bypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "AzureServices, Logging", + "AzureServices, Logging, Metrics", + "AzureServices, Metrics", + "Logging", + "Logging, Metrics", + "Metrics", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics." + } + }, + "virtualNetworkRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the virtual network rules." + } + }, + "ipRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the IP ACL rules." + } + }, + "defaultAction": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the default action of allow or deny when no other rules match." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network configuration." + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the keys and connection strings generated by the modules." + } + }, + "accessKey1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey1 secret name to create." + } + }, + "connectionString1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString1 secret name to create." + } + }, + "accessKey2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey2 secret name to create." + } + }, + "connectionString2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString2 secret name to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of the exported secrets." + } + }, + "localUserType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a local user." + } + }, + "blobServiceType": { + "type": "object", + "properties": { + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a blob service." + } + }, + "_1.immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/container/main.bicep" + } + } + }, + "_2.secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "_3.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/_1.immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "description": "The type of a storage container.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "description": "The type for a cors rule.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "customerManagedKeyWithAutoRotateType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting." + } + }, + "autoRotationEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingMetricsOnlyType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of diagnostic setting." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_3.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/_2.secretSetOutputType", + "metadata": { + "description": "An exported secret's references." + } + }, + "metadata": { + "description": "A map of the exported secrets", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. Name of the Storage Account. Must be lower-case." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "kind": { + "type": "string", + "defaultValue": "StorageV2", + "allowedValues": [ + "Storage", + "StorageV2", + "BlobStorage", + "FileStorage", + "BlockBlobStorage" + ], + "metadata": { + "description": "Optional. Type of Storage Account to create." + } + }, + "skuName": { + "type": "string", + "defaultValue": "Standard_GRS", + "allowedValues": [ + "Standard_LRS", + "Standard_ZRS", + "Standard_GRS", + "Standard_GZRS", + "Standard_RAGRS", + "Standard_RAGZRS", + "StandardV2_LRS", + "StandardV2_ZRS", + "StandardV2_GRS", + "StandardV2_GZRS", + "Premium_LRS", + "Premium_ZRS", + "PremiumV2_LRS", + "PremiumV2_ZRS" + ], + "metadata": { + "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "Hot", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "Cold" + ], + "metadata": { + "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type." + } + }, + "largeFileSharesState": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)." + } + }, + "azureFilesIdentityBasedAuthentication": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication" + }, + "description": "Optional. Provides the identity based authentication settings for Azure Files." + }, + "nullable": true + }, + "defaultToOAuthAuthentication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not." + } + }, + "allowSharedKeyAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "managementPolicyRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The Storage Account ManagementPolicies Rules." + } + }, + "networkAcls": { + "$ref": "#/definitions/networkAclsType", + "nullable": true, + "metadata": { + "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny." + } + }, + "requireInfrastructureEncryption": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true." + } + }, + "allowCrossTenantReplication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Allow or disallow cross AAD tenant object replication." + } + }, + "customDomainName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source." + } + }, + "customDomainUseSubDomainName": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates." + } + }, + "dnsEndpointType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AzureDnsZone", + "Standard" + ], + "metadata": { + "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier." + } + }, + "blobServices": { + "$ref": "#/definitions/blobServiceType", + "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]", + "metadata": { + "description": "Optional. Blob service and containers to deploy." + } + }, + "fileServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. File service and shares to deploy." + } + }, + "queueServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Queue service and queues to create." + } + }, + "tableServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Table service and tables to create." + } + }, + "allowBlobPublicAccess": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2" + ], + "metadata": { + "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore." + } + }, + "enableHierarchicalNamespace": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true." + } + }, + "enableSftp": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "localUsers": { + "type": "array", + "items": { + "$ref": "#/definitions/localUserType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Local users to deploy for SFTP authentication." + } + }, + "isLocalUserEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables local users feature, if set to true." + } + }, + "enableNfsV3": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingMetricsOnlyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "allowedCopyScope": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AAD", + "PrivateLink" + ], + "metadata": { + "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "supportsHttpsTrafficOnly": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Allows HTTPS traffic only to storage service if sets to true." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyWithAutoRotateType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "sasExpirationPeriod": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The SAS expiration period. DD.HH:MM:SS." + } + }, + "sasExpirationAction": { + "type": "string", + "defaultValue": "Log", + "allowedValues": [ + "Block", + "Log" + ], + "metadata": { + "description": "Optional. The SAS expiration action. Allowed values are Block and Log." + } + }, + "keyType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Account", + "Service" + ], + "metadata": { + "description": "Optional. The keyType to use with Queue & Table services." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "immutableStorageWithVersioning": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning" + }, + "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts." + }, + "nullable": true + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]", + "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]", + "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "storageAccount": { + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "[parameters('kind')]", + "sku": { + "name": "[parameters('skuName')]" + }, + "identity": "[variables('identity')]", + "tags": "[parameters('tags')]", + "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]", + "dependsOn": [ + "cMKKeyVault", + "cMKKeyVault::cMKKey" + ] + }, + "storageAccount_diagnosticSettings": { + "copy": { + "name": "storageAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_roleAssignments": { + "copy": { + "name": "storageAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_privateEndpoints": { + "copy": { + "name": "storageAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_managementPolicies": { + "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "rules": { + "value": "[parameters('managementPolicyRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14529265638306912023" + }, + "name": "Storage Account Management Policies", + "description": "This module deploys a Storage Account Management Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "rules": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules" + }, + "description": "Required. The Storage Account ManagementPolicies Rules." + } + } + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/managementPolicies", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]", + "properties": { + "policy": { + "rules": "[parameters('rules')]" + } + } + } + ], + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed management policy." + }, + "value": "default" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed management policy." + }, + "value": "default" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed management policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount", + "storageAccount_blobServices" + ] + }, + "storageAccount_localUsers": { + "copy": { + "name": "storageAccount_localUsers", + "count": "[length(coalesce(parameters('localUsers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]" + }, + "hasSshKey": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]" + }, + "hasSshPassword": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]" + }, + "permissionScopes": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]" + }, + "hasSharedKey": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]" + }, + "homeDirectory": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]" + }, + "sshAuthorizedKeys": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3261275799710495788" + }, + "name": "Storage Account Local Users", + "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication." + }, + "definitions": { + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "localUsers": { + "type": "Microsoft.Storage/storageAccounts/localUsers", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "hasSharedKey": "[parameters('hasSharedKey')]", + "hasSshKey": "[parameters('hasSshKey')]", + "hasSshPassword": "[parameters('hasSshPassword')]", + "homeDirectory": "[parameters('homeDirectory')]", + "permissionScopes": "[parameters('permissionScopes')]", + "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed local user." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed local user." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed local user." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_blobServices": { + "condition": "[not(empty(parameters('blobServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "containers": { + "value": "[tryGet(parameters('blobServices'), 'containers')]" + }, + "automaticSnapshotPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]" + }, + "changeFeedEnabled": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]" + }, + "changeFeedRetentionInDays": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]" + }, + "containerDeleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]" + }, + "containerDeleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]" + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]" + }, + "corsRules": { + "value": "[tryGet(parameters('blobServices'), 'corsRules')]" + }, + "defaultServiceVersion": { + "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]" + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]" + }, + "deleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]" + }, + "deleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]" + }, + "isVersioningEnabled": { + "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]" + }, + "lastAccessTimeTrackingPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]" + }, + "restorePolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]" + }, + "restorePolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9925173705553594819" + }, + "name": "Storage Account blob Services", + "description": "This module deploys a Storage Account Blob Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a storage container." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "container/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false, + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "blobServices": { + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]", + "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]", + "containerDeleteRetentionPolicy": { + "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]", + "days": "[parameters('containerDeleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]" + }, + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "defaultServiceVersion": "[parameters('defaultServiceVersion')]", + "deleteRetentionPolicy": { + "enabled": "[parameters('deleteRetentionPolicyEnabled')]", + "days": "[parameters('deleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]" + }, + "isVersioningEnabled": "[parameters('isVersioningEnabled')]", + "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]", + "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "blobServices_diagnosticSettings": { + "copy": { + "name": "blobServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "blobServices" + ] + }, + "blobServices_container": { + "copy": { + "name": "blobServices_container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "blobServiceName": { + "value": "[variables('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "defaultEncryptionScope": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]" + }, + "denyEncryptionScopeOverride": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]" + }, + "enableNfsV3AllSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]" + }, + "enableNfsV3RootSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]" + }, + "immutableStorageWithVersioningEnabled": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]" + }, + "publicAccess": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "immutabilityPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "5026123498979497429" + }, + "name": "Storage Account Blob Containers", + "description": "This module deploys a Storage Account Blob Container." + }, + "definitions": { + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an immutability policy." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "blobServiceName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "defaultValue": {} + }, + "publicAccess": { + "type": "string", + "defaultValue": "None", + "allowedValues": [ + "Container", + "Blob", + "None" + ], + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::blobServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "container": { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "properties": { + "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]", + "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]", + "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]", + "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]", + "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]", + "metadata": "[parameters('metadata')]", + "publicAccess": "[parameters('publicAccess')]" + } + }, + "container_roleAssignments": { + "copy": { + "name": "container_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "container" + ] + }, + "container_immutabilityPolicy": { + "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "containerName": { + "value": "[parameters('name')]" + }, + "immutabilityPeriodSinceCreationInDays": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]" + }, + "allowProtectedAppendWrites": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]" + }, + "allowProtectedAppendWritesAll": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10782942397325758470" + }, + "name": "Storage Account Blob Container Immutability Policies", + "description": "This module deploys a Storage Account Blob Container Immutability Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "containerName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment." + } + }, + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "defaultValue": 365, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "variables": { + "name": "default" + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]", + "properties": { + "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]", + "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]", + "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed immutability policy." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed immutability policy." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed immutability policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "container" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed container." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed container." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "blobServices" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed blob service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_fileServices": { + "condition": "[not(empty(parameters('fileServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]" + }, + "protocolSettings": { + "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]" + }, + "shareDeleteRetentionPolicy": { + "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]" + }, + "shares": { + "value": "[tryGet(parameters('fileServices'), 'shares')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "2735186993322606805" + }, + "name": "Storage Account File Share Services", + "description": "This module deploys a Storage Account File Share Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the file service." + } + }, + "protocolSettings": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings" + }, + "description": "Optional. Protocol settings for file service." + }, + "defaultValue": {} + }, + "shareDeleteRetentionPolicy": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy" + }, + "description": "Optional. The service properties for soft delete." + }, + "defaultValue": { + "enabled": true, + "days": 7 + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "shares": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. File shares to create." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileServices": { + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "protocolSettings": "[parameters('protocolSettings')]", + "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]" + } + }, + "fileServices_diagnosticSettings": { + "copy": { + "name": "fileServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "fileServices" + ] + }, + "fileServices_shares": { + "copy": { + "name": "fileServices_shares", + "count": "[length(coalesce(parameters('shares'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "fileServicesName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]" + }, + "accessTier": { + "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]" + }, + "enabledProtocols": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]" + }, + "rootSquash": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]" + }, + "shareQuota": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15881640847294537074" + }, + "name": "Storage Account File Shares", + "description": "This module deploys a Storage Account File Share." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "fileServicesName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the file share to create." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "TransactionOptimized", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "TransactionOptimized" + ], + "metadata": { + "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool." + } + }, + "shareQuota": { + "type": "int", + "defaultValue": 5120, + "metadata": { + "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)." + } + }, + "enabledProtocols": { + "type": "string", + "defaultValue": "SMB", + "allowedValues": [ + "NFS", + "SMB" + ], + "metadata": { + "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share." + } + }, + "rootSquash": { + "type": "string", + "defaultValue": "NoRootSquash", + "allowedValues": [ + "AllSquash", + "NoRootSquash", + "RootSquash" + ], + "metadata": { + "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::fileService": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileShare": { + "type": "Microsoft.Storage/storageAccounts/fileServices/shares", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]", + "properties": { + "accessTier": "[parameters('accessTier')]", + "shareQuota": "[parameters('shareQuota')]", + "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]", + "enabledProtocols": "[parameters('enabledProtocols')]" + } + }, + "fileShare_roleAssignments": { + "copy": { + "name": "fileShare_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "scope": { + "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]" + }, + "name": { + "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]" + }, + "roleDefinitionId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "principalType": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]" + }, + "condition": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]" + }, + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]", + "delegatedManagedIdentityResourceId": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "description": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "scope": { + "type": "string", + "metadata": { + "description": "Required. The scope to deploy the role assignment to." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The role definition Id to assign." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User", + "" + ], + "defaultValue": "", + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"" + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "defaultValue": "2.0", + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[parameters('scope')]", + "name": "[parameters('name')]", + "properties": { + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "principalId": "[parameters('principalId')]", + "description": "[parameters('description')]", + "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]", + "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]", + "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]", + "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]" + } + } + ] + } + }, + "dependsOn": [ + "fileShare" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "fileServices", + "storageAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_queueServices": { + "condition": "[not(empty(parameters('queueServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]" + }, + "queues": { + "value": "[tryGet(parameters('queueServices'), 'queues')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1100093319443502715" + }, + "name": "Storage Account Queue Services", + "description": "This module deploys a Storage Account Queue Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "queues": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Queues to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queueServices": { + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "queueServices_diagnosticSettings": { + "copy": { + "name": "queueServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "queueServices" + ] + }, + "queueServices_queues": { + "copy": { + "name": "queueServices_queues", + "count": "[length(coalesce(parameters('queues'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "name": { + "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17963799770990303971" + }, + "name": "Storage Account Queues", + "description": "This module deploys a Storage Account Queue." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage queue to deploy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair that represents queue metadata." + }, + "defaultValue": {} + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::queueServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queue": { + "type": "Microsoft.Storage/storageAccounts/queueServices/queues", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "properties": { + "metadata": "[parameters('metadata')]" + } + }, + "queue_roleAssignments": { + "copy": { + "name": "queue_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "queue" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed queue." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed queue." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed queue." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_tableServices": { + "condition": "[not(empty(parameters('tableServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]" + }, + "tables": { + "value": "[tryGet(parameters('tableServices'), 'tables')]" + }, + "corsRules": { + "value": "[tryGet(parameters('tableServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "13069389074590786512" + }, + "name": "Storage Account Table Services", + "description": "This module deploys a Storage Account Table Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "tables": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. tables to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "tableServices": { + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "tableServices_diagnosticSettings": { + "copy": { + "name": "tableServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "tableServices" + ] + }, + "tableServices_tables": { + "copy": { + "name": "tableServices_tables", + "count": "[length(parameters('tables'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('tables')[copyIndex()].name]" + }, + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10905926757212375091" + }, + "name": "Storage Account Table", + "description": "This module deploys a Storage Account Table." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::tableServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "table": { + "type": "Microsoft.Storage/storageAccounts/tableServices/tables", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "table_roleAssignments": { + "copy": { + "name": "table_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "table" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed table service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed table service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed table service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9368972709899985618" + } + }, + "definitions": { + "secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the secret to set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetOutputType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]", + "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]" + } + } + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed storage account." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed storage account." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed storage account." + }, + "value": "[resourceGroup().name]" + }, + "primaryBlobEndpoint": { + "type": "string", + "metadata": { + "description": "The primary blob endpoint reference if blob services are deployed." + }, + "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('storageAccount', '2024-01-01', 'full').location]" + }, + "serviceEndpoints": { + "type": "object", + "metadata": { + "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint." + }, + "value": "[reference('storageAccount').primaryEndpoints]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the Storage Account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "primaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The primary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]" + }, + "secondaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The secondary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]" + }, + "primaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]" + }, + "secondaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]" + } + } + } + } + }, + "pe": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('storage-pe-{0}', uniqueString(parameters('storageAccountName')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe-blob', parameters('storageAccountName'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]" + }, + "groupIds": { + "value": [ + "blob" + ] + }, + "privateDnsZoneIds": "[if(empty(parameters('blobPrivateDnsZoneId')), createObject('value', createArray()), createObject('value', createArray(parameters('blobPrivateDnsZoneId'))))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "value": "[reference('storageAccount').outputs.name.value]" + }, + "resourceId": { + "type": "string", + "value": "[reference('storageAccount').outputs.resourceId.value]" + }, + "queueUrl": { + "type": "string", + "value": "[format('https://{0}.queue.{1}/', reference('storageAccount').outputs.name.value, environment().suffixes.storage)]" + } + } + } + }, + "dependsOn": [ + "network", + "privateDns", + "userAssignedIdentity" + ] + }, + "cosmosDb": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('cosmosDbDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "location": { + "value": "[parameters('location')]" + }, + "cosmosAccountName": { + "value": "[toLower(format('{0}-cosmosdb-{1}', parameters('namePrefix'), uniqueString(resourceGroup().id)))]" + }, + "cosmosDbName": { + "value": "[parameters('cosmosDbName')]" + }, + "cosmosDBContainerNames": { + "value": "[parameters('cosmosDBContainerNames')]" + }, + "cosmosDBDataContributorPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]", + "[deployer().objectId]" + ] + }, + "zoneRedundant": "[if(equals(parameters('environment'), 'prod'), createObject('value', true()), createObject('value', false()))]", + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "privateEndpointSubnetId": "[if(parameters('isPrivate'), createObject('value', reference('network').outputs.peSubnetId.value), createObject('value', ''))]", + "cosmosSqlPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.cosmosSqlZoneId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "9379637736520502099" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources" + } + }, + "cosmosAccountName": { + "type": "string", + "metadata": { + "description": "Required: Cosmos DB account name" + } + }, + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Required: Cosmos DB database name" + } + }, + "cosmosDBContainerNames": { + "type": "array", + "metadata": { + "description": "Optional: Cosmos DB container names used in the application" + } + }, + "cosmosDBDataContributorPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required: List of principal IDs (managed identity or user) to be assigned Cosmos DB SQL Data Contributor role" + } + }, + "zoneRedundant": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Enable zone redundancy for Cosmos DB account" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public network access and deploys a private endpoint." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource id for the private endpoint (required when isPrivate=true)" + } + }, + "cosmosSqlPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for Cosmos SQL API (required when isPrivate=true)" + } + } + }, + "resources": { + "cosmosAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-05-15", + "name": "[parameters('cosmosAccountName')]", + "dependsOn": [ + "cosmosDb" + ] + }, + "cosmosDb": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('cosmosDb-{0}', uniqueString('cosmosDb', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('cosmosAccountName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "capabilitiesToAdd": { + "value": [ + "EnableServerless" + ] + }, + "databaseAccountOfferType": { + "value": "Standard" + }, + "disableLocalAuthentication": { + "value": true + }, + "backupPolicyContinuousTier": { + "value": "Continuous7Days" + }, + "networkRestrictions": { + "value": { + "publicNetworkAccess": "[if(parameters('isPrivate'), 'Disabled', 'Enabled')]" + } + }, + "zoneRedundant": { + "value": "[parameters('zoneRedundant')]" + }, + "sqlDatabases": { + "value": [ + { + "copy": [ + { + "name": "containers", + "count": "[length(parameters('cosmosDBContainerNames'))]", + "input": { + "name": "[parameters('cosmosDBContainerNames')[copyIndex('containers')].name]", + "paths": [ + "[parameters('cosmosDBContainerNames')[copyIndex('containers')].partitionKey]" + ], + "kind": "Hash" + } + } + ], + "name": "[parameters('cosmosDbName')]" + } + ] + }, + "dataPlaneRoleDefinitions": { + "value": [ + { + "copy": [ + { + "name": "assignments", + "count": "[length(parameters('cosmosDBDataContributorPrincipalIds'))]", + "input": { + "principalId": "[parameters('cosmosDBDataContributorPrincipalIds')[copyIndex('assignments')]]" + } + } + ], + "roleName": "Cosmos DB SQL Data Contributor", + "dataActions": [ + "Microsoft.DocumentDB/databaseAccounts/readMetadata", + "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*", + "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*" + ] + } + ] + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17715929342484596741" + }, + "name": "Azure Cosmos DB account", + "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group ID for the private endpoint group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses for the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoint output." + } + }, + "failoverLocationType": { + "type": "object", + "properties": { + "failoverPriority": { + "type": "int", + "metadata": { + "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists." + } + }, + "isZoneRedundant": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true." + } + }, + "locationName": { + "type": "string", + "metadata": { + "description": "Required. The name of the region." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the failover location." + } + }, + "dataPlaneRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment." + } + }, + "dataPlaneRoleDefinitionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the role-based access control definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope." + } + }, + "assignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of role-based access control assignments to be created for the definition." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition." + } + }, + "sqlDatabaseType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the database ." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "analyticalStorageTtl": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "properties": { + "conflictResolutionPath": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'." + } + }, + "conflictResolutionProcedure": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'." + } + }, + "mode": { + "type": "string", + "allowedValues": [ + "Custom", + "LastWriterWins" + ], + "metadata": { + "description": "Required. Indicates the conflict resolution mode." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "nullable": true, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "indexingPolicy": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "allowedValues": [ + 1, + 2 + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "items": { + "type": "object", + "properties": { + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Set of containers to deploy in the database." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL database." + } + }, + "networkRestrictionType": { + "type": "object", + "properties": { + "ipRules": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`." + } + }, + "networkAclBypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"." + } + }, + "publicNetworkAccess": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"." + } + }, + "virtualNetworkRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of a subnet." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. List of virtual network access control list (ACL) rules configured for the account." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network restriction." + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "description": "The type for the SQL Role Assignments.", + "__bicep_imported_from!": { + "sourceTemplate": "sql-role-definition/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the account." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Defaults to the current resource group scope location. Location for all resources." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags" + }, + "description": "Optional. Tags for the resource." + }, + "nullable": true + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "databaseAccountOfferType": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Standard" + ], + "metadata": { + "description": "Optional. The offer type for the account. Defaults to \"Standard\"." + } + }, + "failoverLocations": { + "type": "array", + "items": { + "$ref": "#/definitions/failoverLocationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed." + } + }, + "zoneRedundant": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts." + } + }, + "defaultConsistencyLevel": { + "type": "string", + "defaultValue": "Session", + "allowedValues": [ + "Eventual", + "ConsistentPrefix", + "Session", + "BoundedStaleness", + "Strong" + ], + "metadata": { + "description": "Optional. The default consistency level of the account. Defaults to \"Session\"." + } + }, + "disableLocalAuthentication": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true." + } + }, + "enableAnalyticalStorage": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false." + } + }, + "automaticFailover": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable automatic failover for regions. Defaults to true." + } + }, + "enableFreeTier": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false." + } + }, + "enableMultipleWriteLocations": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false." + } + }, + "disableKeyBasedMetadataWriteAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true." + } + }, + "maxStalenessPrefix": { + "type": "int", + "defaultValue": 100000, + "minValue": 1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000." + } + }, + "maxIntervalInSeconds": { + "type": "int", + "defaultValue": 300, + "minValue": 5, + "maxValue": 86400, + "metadata": { + "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300." + } + }, + "serverVersion": { + "type": "string", + "defaultValue": "4.2", + "allowedValues": [ + "3.2", + "3.6", + "4.0", + "4.2", + "5.0", + "6.0", + "7.0" + ], + "metadata": { + "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"." + } + }, + "sqlDatabases": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlDatabaseType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL." + } + }, + "mongodbDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU." + } + }, + "gremlinDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin." + } + }, + "tables": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "totalThroughputLimit": { + "type": "int", + "defaultValue": -1, + "metadata": { + "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of control plane Azure role-based access control assignments." + } + }, + "dataPlaneRoleDefinitions": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleDefinitionType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions." + } + }, + "dataPlaneRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings for the service." + } + }, + "capabilitiesToAdd": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "allowedValues": [ + "EnableCassandra", + "EnableTable", + "EnableGremlin", + "EnableMongo", + "DisableRateLimitingResponses", + "EnableServerless", + "EnableNoSQLVectorSearch", + "EnableNoSQLFullTextSearch", + "EnableMaterializedViews", + "DeleteAllItemsByPartitionKey" + ], + "metadata": { + "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account." + } + }, + "backupPolicyType": { + "type": "string", + "defaultValue": "Continuous", + "allowedValues": [ + "Periodic", + "Continuous" + ], + "metadata": { + "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"." + } + }, + "backupPolicyContinuousTier": { + "type": "string", + "defaultValue": "Continuous30Days", + "allowedValues": [ + "Continuous30Days", + "Continuous7Days" + ], + "metadata": { + "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"." + } + }, + "backupIntervalInMinutes": { + "type": "int", + "defaultValue": 240, + "minValue": 60, + "maxValue": 1440, + "metadata": { + "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240." + } + }, + "backupRetentionIntervalInHours": { + "type": "int", + "defaultValue": 8, + "minValue": 2, + "maxValue": 720, + "metadata": { + "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8." + } + }, + "backupStorageRedundancy": { + "type": "string", + "defaultValue": "Local", + "allowedValues": [ + "Geo", + "Local", + "Zone" + ], + "metadata": { + "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible." + } + }, + "networkRestrictions": { + "$ref": "#/definitions/networkRestrictionType", + "defaultValue": { + "ipRules": [], + "virtualNetworkRules": [], + "publicNetworkAccess": "Disabled" + }, + "metadata": { + "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "Tls12", + "allowedValues": [ + "Tls12" + ], + "metadata": { + "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInControlPlaneRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]", + "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]", + "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]", + "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-07-01", + "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "identity": "[variables('identity')]", + "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]", + "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]" + }, + "databaseAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_diagnosticSettings": { + "copy": { + "name": "databaseAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_roleAssignments": { + "copy": { + "name": "databaseAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlDatabases": { + "copy": { + "name": "databaseAccount_sqlDatabases", + "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]" + }, + "containers": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]" + }, + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "7141543733238879531" + }, + "name": "DocumentDB Database Account SQL Databases", + "description": "This module deploys a SQL Database in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the SQL database ." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of containers to deploy in the SQL database." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL database resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "container": { + "copy": { + "name": "container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "sqlDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "analyticalStorageTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + }, + "conflictResolutionPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]" + }, + "defaultTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]" + }, + "indexingPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]" + }, + "kind": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]" + }, + "version": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]" + }, + "paths": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]" + }, + "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]", + "uniqueKeyPolicyKeys": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1789954443166349986" + }, + "name": "DocumentDB Database Account SQL Database Containers", + "description": "This module deploys a SQL Database Container in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "sqlDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "analyticalStorageTtl": { + "type": "int", + "defaultValue": 0, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL Database resource." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + }, + "kind": { + "type": "string", + "defaultValue": "Hash", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "defaultValue": 1, + "allowedValues": [ + 1, + 2 + ], + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + } + }, + "variables": { + "copy": [ + { + "name": "partitionKeyPaths", + "count": "[length(parameters('paths'))]", + "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]" + } + ], + "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]" + }, + "resources": { + "databaseAccount::sqlDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "container": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": "[variables('containerResourceParams')]", + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the container." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the container was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleDefinitions": { + "copy": { + "name": "databaseAccount_sqlRoleDefinitions", + "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]" + }, + "dataActions": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]" + }, + "roleName": { + "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]" + }, + "assignableScopes": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]" + }, + "sqlRoleAssignments": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9570871897890815068" + }, + "name": "DocumentDB Database Account SQL Role Definitions.", + "description": "This module deploys a SQL Role Definision in a CosmosDB Account." + }, + "definitions": { + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the SQL Role Assignments." + } + } + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the Role Definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account." + } + }, + "sqlRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleDefinition": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]", + "properties": { + "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]", + "permissions": [ + { + "dataActions": "[parameters('dataActions')]" + } + ], + "roleName": "[parameters('roleName')]", + "type": "CustomRole" + } + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "roleDefinitionId": { + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "principalId": { + "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlRoleDefinition" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Definition." + }, + "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Definition." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + }, + "roleName": { + "type": "string", + "metadata": { + "description": "The role name of the SQL Role Definition." + }, + "value": "[reference('sqlRoleDefinition').roleName]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "roleDefinitionId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_mongodbDatabases": { + "copy": { + "name": "databaseAccount_mongodbDatabases", + "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "collections": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9160691107424630312" + }, + "name": "DocumentDB Database Account MongoDB Databases", + "description": "This module deploys a MongoDB Database within a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the mongodb database." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "collections": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Collections in the mongodb database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "mongodbDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "mongodbDatabase_collections": { + "copy": { + "name": "mongodbDatabase_collections", + "count": "[length(coalesce(parameters('collections'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "mongodbDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]" + }, + "indexes": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]" + }, + "shardKey": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14050805189442830205" + }, + "name": "DocumentDB Database Account MongoDB Database Collections", + "description": "This module deploys a MongoDB Database Collection." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "mongodbDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the collection." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "indexes": { + "type": "array", + "metadata": { + "description": "Required. Indexes for the collection." + } + }, + "shardKey": { + "type": "object", + "metadata": { + "description": "Required. ShardKey for the collection." + } + } + }, + "resources": [ + { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]", + "properties": { + "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]", + "indexes": "[parameters('indexes')]", + "shardKey": "[parameters('shardKey')]" + } + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database collection." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database collection." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database collection was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "mongodbDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_gremlinDatabases": { + "copy": { + "name": "databaseAccount_gremlinDatabases", + "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "graphs": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "16834580070429190924" + }, + "name": "DocumentDB Database Account Gremlin Databases", + "description": "This module deploys a Gremlin Database within a CosmosDB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Gremlin database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin database resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment." + } + }, + "graphs": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Array of graphs to deploy in the Gremlin database." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "gremlinDatabase_gremlinGraphs": { + "copy": { + "name": "gremlinDatabase_gremlinGraphs", + "count": "[length(parameters('graphs'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('graphs')[copyIndex()].name]" + }, + "gremlinDatabaseName": { + "value": "[parameters('name')]" + }, + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "indexingPolicy": { + "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]" + }, + "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15062578211366932944" + }, + "name": "DocumentDB Database Accounts Gremlin Databases Graphs", + "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the graph." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin graph resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "gremlinDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the graph." + } + }, + "partitionKeyPaths": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. List of paths using which data within the container can be partitioned." + } + } + }, + "resources": { + "databaseAccount::gremlinDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinGraph": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]", + "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]", + "partitionKey": { + "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]" + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the graph." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the graph." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the graph was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "gremlinDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the Gremlin database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Gremlin database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the Gremlin database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_tables": { + "copy": { + "name": "databaseAccount_tables", + "count": "[length(coalesce(parameters('tables'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3429971823201332257" + }, + "name": "Azure Cosmos DB account tables", + "description": "This module deploys a table within an Azure Cosmos DB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags for the table." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "table": { + "type": "Microsoft.DocumentDB/databaseAccounts/tables", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the table." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the table." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the table was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_privateEndpoints": { + "copy": { + "name": "databaseAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the database account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the database account." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the database account was created in." + }, + "value": "[resourceGroup().name]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('databaseAccount', '2024-11-15', 'full').location]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The endpoint of the database account." + }, + "value": "[reference('databaseAccount').documentEndpoint]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the database account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "primaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]" + }, + "primaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]" + }, + "primaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]" + }, + "primaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]" + }, + "secondaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]" + }, + "secondaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]" + }, + "secondaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]" + }, + "secondaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]" + } + } + } + } + }, + "pe": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('cosmos-pe-{0}', uniqueString(parameters('cosmosAccountName')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe', parameters('cosmosAccountName'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosAccountName'))]" + }, + "groupIds": { + "value": [ + "Sql" + ] + }, + "privateDnsZoneIds": "[if(empty(parameters('cosmosSqlPrivateDnsZoneId')), createObject('value', createArray()), createObject('value', createArray(parameters('cosmosSqlPrivateDnsZoneId'))))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "cosmosDb" + ] + } + }, + "outputs": { + "cosmosAccountName": { + "type": "string", + "value": "[reference('cosmosDb').outputs.name.value]" + }, + "cosmosEndpoint": { + "type": "string", + "value": "[reference('cosmosDb').outputs.endpoint.value]" + }, + "cosmosDBName": { + "type": "string", + "value": "[parameters('cosmosDbName')]" + } + } + } + }, + "dependsOn": [ + "network", + "privateDns", + "userAssignedIdentity" + ] + }, + "containerRegistry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('containerRegistryDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "containerRegistryName": { + "value": "[toLower(format('{0}acr{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "privateEndpointSubnetId": "[if(parameters('isPrivate'), createObject('value', reference('network').outputs.peSubnetId.value), createObject('value', ''))]", + "acrPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.acrZoneId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "3096403326932700663" + } + }, + "parameters": { + "containerRegistryName": { + "type": "string", + "metadata": { + "description": "Required: Name of the Container Registry" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources. Default is the resource group location" + } + }, + "sku": { + "type": "string", + "defaultValue": "Basic", + "metadata": { + "description": "Optional: Container Registry SKU. Default is Basic (switches to Premium automatically when isPrivate=true)." + } + }, + "adminUserEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional: Admin user enabled. Default is true (forced off when isPrivate=true)" + } + }, + "publicNetworkAccess": { + "type": "string", + "defaultValue": "Enabled", + "metadata": { + "description": "Public network access setting for the Azure Container Registry" + } + }, + "zoneRedundancy": { + "type": "string", + "defaultValue": "Disabled", + "metadata": { + "description": "Zone redundancy setting for the Azure Container Registry" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, forces Premium SKU + disables admin + public access and deploys a private endpoint." + } + }, + "privateEndpointSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Subnet resource id for the private endpoint (required when isPrivate=true)" + } + }, + "acrPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for ACR (required when isPrivate=true)" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Managed Identity that will be given access to the Container Registry" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional: Tags for resources" + } + } + }, + "variables": { + "copy": [ + { + "name": "roleAssignmentsAcrPull", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPull')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "AcrPull" + } + }, + { + "name": "roleAssignmentsAcrPush", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPush')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "AcrPush" + } + }, + { + "name": "roleAssignmentsAcrDelete", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrDelete')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "AcrDelete" + } + } + ], + "effectiveSku": "[if(parameters('isPrivate'), 'Premium', parameters('sku'))]", + "effectiveAdmin": "[if(parameters('isPrivate'), false(), parameters('adminUserEnabled'))]", + "effectivePublic": "[if(parameters('isPrivate'), 'Disabled', parameters('publicNetworkAccess'))]" + }, + "resources": { + "acrRef": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-11-01-preview", + "name": "[parameters('containerRegistryName')]", + "dependsOn": [ + "containerRegistry" + ] + }, + "containerRegistry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('containerRegistry-{0}', uniqueString('containerRegistry', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('containerRegistryName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "acrSku": { + "value": "[variables('effectiveSku')]" + }, + "acrAdminUserEnabled": { + "value": "[variables('effectiveAdmin')]" + }, + "publicNetworkAccess": { + "value": "[variables('effectivePublic')]" + }, + "zoneRedundancy": { + "value": "[parameters('zoneRedundancy')]" + }, + "roleAssignments": { + "value": "[concat(variables('roleAssignmentsAcrPull'), variables('roleAssignmentsAcrPush'), variables('roleAssignmentsAcrDelete'))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10440624024470892086" + }, + "name": "Azure Container Registries (ACR)", + "description": "This module deploys an Azure Container Registry (ACR)." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "scopeMapsType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the scope map." + } + }, + "actions": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of scoped permissions for registry artifacts." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The user friendly description of the scope map." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a scope map." + } + }, + "cacheRuleType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined." + } + }, + "sourceRepository": { + "type": "string", + "metadata": { + "description": "Required. Source repository pulled from upstream." + } + }, + "targetRepository": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}." + } + }, + "credentialSetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the credential store which is associated with the cache rule." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cache rule." + } + }, + "credentialSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential set." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityOnlySysAssignedType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "authCredentials": { + "type": "array", + "items": { + "$ref": "#/definitions/authCredentialsType" + }, + "metadata": { + "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential." + } + }, + "loginServer": { + "type": "string", + "metadata": { + "description": "Required. The credentials are stored for this upstream or login server." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a credential set." + } + }, + "replicationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the replication." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "regionEndpointEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications." + } + }, + "zoneRedundancy": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. Whether or not zone redundancy is enabled for this container registry." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a replication." + } + }, + "webhookType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "minLength": 5, + "maxLength": 50, + "metadata": { + "description": "Optional. The name of the registry webhook." + } + }, + "serviceUri": { + "type": "string", + "metadata": { + "description": "Required. The service URI for the webhook to post notifications." + } + }, + "status": { + "type": "string", + "allowedValues": [ + "disabled", + "enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. The status of the webhook at the time the operation was called." + } + }, + "action": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The list of actions that trigger the webhook to post notifications." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "customHeaders": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Custom headers that will be added to the webhook notifications." + } + }, + "scope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a webhook." + } + }, + "_1.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "authCredentialsType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential." + } + }, + "usernameSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the username." + } + }, + "passwordSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the password." + } + } + }, + "metadata": { + "description": "The type for auth credentials.", + "__bicep_imported_from!": { + "sourceTemplate": "credential-set/main.bicep" + } + } + }, + "customerManagedKeyWithAutoRotateType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting." + } + }, + "autoRotationEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "managedIdentityOnlySysAssignedType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_1.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 5, + "maxLength": 50, + "metadata": { + "description": "Required. Name of your Azure Container Registry." + } + }, + "acrAdminUserEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable admin user that have push / pull permission to the registry." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "acrSku": { + "type": "string", + "defaultValue": "Premium", + "allowedValues": [ + "Basic", + "Premium", + "Standard" + ], + "metadata": { + "description": "Optional. Tier of your Azure container registry." + } + }, + "exportPolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the export policy is enabled or not." + } + }, + "quarantinePolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "trustPolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "retentionPolicyStatus": { + "type": "string", + "defaultValue": "enabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the retention policy is enabled or not." + } + }, + "retentionPolicyDays": { + "type": "int", + "defaultValue": 15, + "metadata": { + "description": "Optional. The number of days to retain an untagged manifest after which it gets purged." + } + }, + "azureADAuthenticationAsArmPolicyStatus": { + "type": "string", + "defaultValue": "enabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registry is enabled or not. Default is enabled." + } + }, + "softDeletePolicyStatus": { + "type": "string", + "defaultValue": "disabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. Soft Delete policy status. Default is disabled." + } + }, + "softDeletePolicyDays": { + "type": "int", + "defaultValue": 7, + "metadata": { + "description": "Optional. The number of days after which a soft-deleted item is permanently deleted." + } + }, + "dataEndpointEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "networkRuleBypassOptions": { + "type": "string", + "defaultValue": "AzureServices", + "allowedValues": [ + "AzureServices", + "None" + ], + "metadata": { + "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry." + } + }, + "networkRuleSetDefaultAction": { + "type": "string", + "defaultValue": "Deny", + "allowedValues": [ + "Allow", + "Deny" + ], + "metadata": { + "description": "Optional. The default action of allow or deny when no other rules match." + } + }, + "networkRuleSetIpRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'." + } + }, + "zoneRedundancy": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Whether or not zone redundancy is enabled for this container registry." + } + }, + "replications": { + "type": "array", + "items": { + "$ref": "#/definitions/replicationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All replications to create." + } + }, + "webhooks": { + "type": "array", + "items": { + "$ref": "#/definitions/webhookType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All webhooks to create." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.ContainerRegistry/registries@2025-04-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "anonymousPullEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyWithAutoRotateType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "cacheRules": { + "type": "array", + "items": { + "$ref": "#/definitions/cacheRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of Cache Rules." + } + }, + "credentialSets": { + "type": "array", + "items": { + "$ref": "#/definitions/credentialSetType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of Credential Sets." + } + }, + "scopeMaps": { + "type": "array", + "items": { + "$ref": "#/definitions/scopeMapsType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Scope maps setting." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]", + "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]", + "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]", + "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]", + "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]", + "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]", + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.9.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "registry": { + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "identity": "[variables('identity')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "[parameters('acrSku')]" + }, + "properties": { + "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]", + "adminUserEnabled": "[parameters('acrAdminUserEnabled')]", + "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)))), null())]", + "policies": { + "azureADAuthenticationAsArmPolicy": { + "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]" + }, + "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]", + "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]", + "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]", + "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]", + "softDeletePolicy": { + "retentionDays": "[parameters('softDeletePolicyDays')]", + "status": "[parameters('softDeletePolicyStatus')]" + } + }, + "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]", + "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]", + "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]", + "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]", + "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]" + }, + "dependsOn": [ + "cMKKeyVault::cMKKey", + "cMKUserAssignedIdentity" + ] + }, + "registry_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "registry" + ] + }, + "registry_diagnosticSettings": { + "copy": { + "name": "registry_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "registry" + ] + }, + "registry_roleAssignments": { + "copy": { + "name": "registry_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "registry" + ] + }, + "registry_scopeMaps": { + "copy": { + "name": "registry_scopeMaps", + "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]" + }, + "actions": { + "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]" + }, + "description": { + "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]" + }, + "registryName": { + "value": "[parameters('name')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "6143951528715126111" + }, + "name": "Container Registries scopeMaps", + "description": "This module deploys an Azure Container Registry (ACR) scopeMap." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]", + "metadata": { + "description": "Optional. The name of the scope map." + } + }, + "actions": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The list of scoped permissions for registry artifacts." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The user friendly description of the scope map." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "scopeMap": { + "type": "Microsoft.ContainerRegistry/registries/scopeMaps", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "properties": { + "actions": "[parameters('actions')]", + "description": "[parameters('description')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the scope map." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the scope map was created in." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the scope map." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_replications": { + "copy": { + "name": "registry_replications", + "count": "[length(coalesce(parameters('replications'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]" + }, + "registryName": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]" + }, + "regionEndpointEnabled": { + "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]" + }, + "zoneRedundancy": { + "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9998680016086915512" + }, + "name": "Azure Container Registry (ACR) Replications", + "description": "This module deploys an Azure Container Registry (ACR) Replication." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the replication." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "regionEndpointEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications." + } + }, + "zoneRedundancy": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Whether or not zone redundancy is enabled for this container registry." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "replication": { + "type": "Microsoft.ContainerRegistry/registries/replications", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]", + "zoneRedundancy": "[parameters('zoneRedundancy')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the replication." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the replication." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the replication was created in." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('replication', '2023-06-01-preview', 'full').location]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_credentialSets": { + "copy": { + "name": "registry_credentialSets", + "count": "[length(coalesce(parameters('credentialSets'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]" + }, + "registryName": { + "value": "[parameters('name')]" + }, + "managedIdentities": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]" + }, + "authCredentials": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]" + }, + "loginServer": { + "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10146775336818580275" + }, + "name": "Container Registries Credential Sets", + "description": "This module deploys an ACR Credential Set." + }, + "definitions": { + "authCredentialsType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential." + } + }, + "usernameSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the username." + } + }, + "passwordSecretIdentifier": { + "type": "string", + "metadata": { + "description": "Required. KeyVault Secret URI for accessing the password." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for auth credentials." + } + }, + "managedIdentityOnlySysAssignedType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the credential set." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityOnlySysAssignedType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "authCredentials": { + "type": "array", + "items": { + "$ref": "#/definitions/authCredentialsType" + }, + "metadata": { + "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential." + } + }, + "loginServer": { + "type": "string", + "metadata": { + "description": "Required. The credentials are stored for this upstream or login server." + } + } + }, + "variables": { + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]" + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "credentialSet": { + "type": "Microsoft.ContainerRegistry/registries/credentialSets", + "apiVersion": "2023-11-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "identity": "[variables('identity')]", + "properties": { + "authCredentials": "[parameters('authCredentials')]", + "loginServer": "[parameters('loginServer')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The Name of the Credential Set." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Credential Set." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Credential Set." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('credentialSet', '2023-11-01-preview', 'full'), 'identity'), 'principalId')]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_cacheRules": { + "copy": { + "name": "registry_cacheRules", + "count": "[length(coalesce(parameters('cacheRules'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "registryName": { + "value": "[parameters('name')]" + }, + "sourceRepository": { + "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name')]" + }, + "targetRepository": { + "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]" + }, + "credentialSetResourceId": { + "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "16179895563671172347" + }, + "name": "Container Registries Cache", + "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[replace(replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-'), '*', '')]", + "metadata": { + "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined." + } + }, + "sourceRepository": { + "type": "string", + "metadata": { + "description": "Required. Source repository pulled from upstream." + } + }, + "targetRepository": { + "type": "string", + "defaultValue": "[parameters('sourceRepository')]", + "metadata": { + "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}." + } + }, + "credentialSetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the credential store which is associated with the cache rule." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "cacheRule": { + "type": "Microsoft.ContainerRegistry/registries/cacheRules", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "properties": { + "sourceRepository": "[parameters('sourceRepository')]", + "targetRepository": "[parameters('targetRepository')]", + "credentialSetResourceId": "[parameters('credentialSetResourceId')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The Name of the Cache Rule." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Cache Rule." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Cache Rule." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "registry", + "registry_credentialSets" + ] + }, + "registry_webhooks": { + "copy": { + "name": "registry_webhooks", + "count": "[length(coalesce(parameters('webhooks'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]" + }, + "registryName": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]" + }, + "action": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action')]" + }, + "customHeaders": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]" + }, + "scope": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]" + }, + "status": { + "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]" + }, + "serviceUri": { + "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "6514847976022081392" + }, + "name": "Azure Container Registry (ACR) Webhooks", + "description": "This module deploys an Azure Container Registry (ACR) Webhook." + }, + "parameters": { + "registryName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "[format('{0}webhook', parameters('registryName'))]", + "minLength": 5, + "maxLength": 50, + "metadata": { + "description": "Optional. The name of the registry webhook." + } + }, + "serviceUri": { + "type": "string", + "metadata": { + "description": "Required. The service URI for the webhook to post notifications." + } + }, + "status": { + "type": "string", + "defaultValue": "enabled", + "allowedValues": [ + "disabled", + "enabled" + ], + "metadata": { + "description": "Optional. The status of the webhook at the time the operation was called." + } + }, + "action": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [ + "chart_delete", + "chart_push", + "delete", + "push", + "quarantine" + ], + "metadata": { + "description": "Optional. The list of actions that trigger the webhook to post notifications." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "customHeaders": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Custom headers that will be added to the webhook notifications." + } + }, + "scope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events." + } + } + }, + "resources": { + "registry": { + "existing": true, + "type": "Microsoft.ContainerRegistry/registries", + "apiVersion": "2023-06-01-preview", + "name": "[parameters('registryName')]" + }, + "webhook": { + "type": "Microsoft.ContainerRegistry/registries/webhooks", + "apiVersion": "2023-06-01-preview", + "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "actions": "[parameters('action')]", + "customHeaders": "[parameters('customHeaders')]", + "scope": "[parameters('scope')]", + "serviceUri": "[parameters('serviceUri')]", + "status": "[parameters('status')]" + } + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the webhook." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the webhook." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Azure container registry." + }, + "value": "[resourceGroup().name]" + }, + "actions": { + "type": "array", + "metadata": { + "description": "The actions of the webhook." + }, + "value": "[reference('webhook').actions]" + }, + "status": { + "type": "string", + "metadata": { + "description": "The status of the webhook." + }, + "value": "[reference('webhook').status]" + }, + "provistioningState": { + "type": "string", + "metadata": { + "description": "The provisioning state of the webhook." + }, + "value": "[reference('webhook').provisioningState]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('webhook', '2023-06-01-preview', 'full').location]" + } + } + } + }, + "dependsOn": [ + "registry" + ] + }, + "registry_privateEndpoints": { + "copy": { + "name": "registry_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "registry", + "registry_replications" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The Name of the Azure container registry." + }, + "value": "[parameters('name')]" + }, + "loginServer": { + "type": "string", + "metadata": { + "description": "The reference to the Azure container registry." + }, + "value": "[reference('registry').loginServer]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the Azure container registry." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Azure container registry." + }, + "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('registry', '2023-06-01-preview', 'full').location]" + }, + "credentialSetsSystemAssignedMIPrincipalIds": { + "type": "array", + "metadata": { + "description": "The Principal IDs of the ACR Credential Sets system-assigned identities." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]", + "input": "[tryGet(tryGet(reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs, 'systemAssignedMIPrincipalId'), 'value')]" + } + }, + "credentialSetsResourceIds": { + "type": "array", + "metadata": { + "description": "The Resource IDs of the ACR Credential Sets." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]", + "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs.resourceId.value]" + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the Azure container registry." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + } + } + } + } + }, + "pe": { + "condition": "[parameters('isPrivate')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('acr-pe-{0}', uniqueString(parameters('containerRegistryName')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('{0}-pe', parameters('containerRegistryName'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[parameters('privateEndpointSubnetId')]" + }, + "targetResourceId": { + "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]" + }, + "groupIds": { + "value": [ + "registry" + ] + }, + "privateDnsZoneIds": "[if(empty(parameters('acrPrivateDnsZoneId')), createObject('value', createArray()), createObject('value', createArray(parameters('acrPrivateDnsZoneId'))))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "13486389120136922459" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the private endpoint" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the private endpoint" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet resource id where the PE NIC is placed" + } + }, + "targetResourceId": { + "type": "string", + "metadata": { + "description": "Resource id of the target PaaS resource" + } + }, + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)" + } + }, + "privateDnsZoneIds": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Array of private DNS zone resource ids to register the PE in" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": { + "pe": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateLinkServiceConnections": [ + { + "name": "[parameters('name')]", + "properties": { + "privateLinkServiceId": "[parameters('targetResourceId')]", + "groupIds": "[parameters('groupIds')]" + } + } + ] + } + }, + "dnsGroup": { + "condition": "[not(empty(parameters('privateDnsZoneIds')))]", + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', parameters('name'), 'default')]", + "properties": { + "copy": [ + { + "name": "privateDnsZoneConfigs", + "count": "[length(parameters('privateDnsZoneIds'))]", + "input": { + "name": "[format('config{0}', copyIndex('privateDnsZoneConfigs'))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneIds')[copyIndex('privateDnsZoneConfigs')]]" + } + } + } + ] + }, + "dependsOn": [ + "pe" + ] + } + }, + "outputs": { + "peId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "peName": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + }, + "dependsOn": [ + "containerRegistry" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "value": "[reference('containerRegistry').outputs.name.value]" + }, + "loginServer": { + "type": "string", + "value": "[reference('containerRegistry').outputs.loginServer.value]" + }, + "resourceGroupName": { + "type": "string", + "value": "[reference('containerRegistry').outputs.resourceGroupName.value]" + }, + "resourceId": { + "type": "string", + "value": "[reference('containerRegistry').outputs.resourceId.value]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "value": "[tryGet(tryGet(reference('containerRegistry').outputs, 'systemAssignedMIPrincipalId'), 'value')]" + }, + "credentialSetsSystemAssignedMIPrincipalIds": { + "type": "array", + "value": "[reference('containerRegistry').outputs.credentialSetsSystemAssignedMIPrincipalIds.value]" + }, + "credentialSetsResourceIds": { + "type": "array", + "value": "[reference('containerRegistry').outputs.credentialSetsResourceIds.value]" + }, + "privateEndpoints": { + "type": "array", + "value": "[reference('containerRegistry').outputs.privateEndpoints.value]" + } + } + } + }, + "dependsOn": [ + "network", + "privateDns", + "userAssignedIdentity" + ] + }, + "appServicePlan": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('appServicePlanDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-asp-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "17476769051930529155" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the App Service Plan" + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for all resources" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags applied to the plan" + } + }, + "skuName": { + "type": "string", + "defaultValue": "P0v3", + "metadata": { + "description": "SKU name for the App Service Plan. P0v3 is the cheapest V3 SKU available in Sweden Central." + } + }, + "skuTier": { + "type": "string", + "defaultValue": "PremiumV3", + "metadata": { + "description": "SKU tier (must match skuName family)." + } + }, + "skuCapacity": { + "type": "int", + "defaultValue": 1, + "metadata": { + "description": "Number of instances" + } + } + }, + "resources": [ + { + "type": "Microsoft.Web/serverfarms", + "apiVersion": "2024-04-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "kind": "linux", + "sku": { + "name": "[parameters('skuName')]", + "tier": "[parameters('skuTier')]", + "capacity": "[parameters('skuCapacity')]" + }, + "properties": { + "reserved": true, + "zoneRedundant": false + } + } + ], + "outputs": { + "id": { + "type": "string", + "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]" + }, + "name": { + "type": "string", + "value": "[parameters('name')]" + } + } + } + } + }, + "aiFoundry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('aiFoundryDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "aiFoundryBaseName": { + "value": "[substring(toLower(uniqueString(format('ai-{0}-{1}-{2}', parameters('namePrefix'), parameters('environment'), resourceGroup().id))), 0, 12)]" + }, + "roleAssignedManagedIdentityPrincipalIds": { + "value": [ + "[reference('userAssignedIdentity').outputs.principalId.value]" + ] + }, + "location": { + "value": "[parameters('aiFoundryLocation')]" + }, + "tags": { + "value": "[variables('tags')]" + }, + "isPrivate": { + "value": "[parameters('isPrivate')]" + }, + "openAiPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.openAiZoneId.value), createObject('value', ''))]", + "cognitiveServicesPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.cognitiveServicesZoneId.value), createObject('value', ''))]", + "aiServicesPrivateDnsZoneId": "[if(parameters('isPrivate'), createObject('value', reference('privateDns').outputs.aiServicesZoneId.value), createObject('value', ''))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "18356341267398099831" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional: Location for all resources. Default is the resource group location" + } + }, + "aiFoundryBaseName": { + "type": "string", + "metadata": { + "description": "Required: Base name used by the AI Foundry AVM pattern (max 12 chars)" + } + }, + "roleAssignedManagedIdentityPrincipalIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Managed Identity that will be given access to the AI Foundry Resource" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + }, + "isPrivate": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "When true, disables public network access and deploys the AI Foundry private endpoints via AVM." + } + }, + "agentServiceSubnetId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Agent service subnet id (optional; reserved for future Foundry agent runtime private networking)" + } + }, + "openAiPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for privatelink.openai.azure.com (required when isPrivate=true)" + } + }, + "cognitiveServicesPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for privatelink.cognitiveservices.azure.com (required when isPrivate=true)" + } + }, + "aiServicesPrivateDnsZoneId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Private DNS zone resource id for privatelink.services.ai.azure.com (required when isPrivate=true)" + } + } + }, + "variables": { + "networkingConfig": "[if(parameters('isPrivate'), createObject('agentServiceSubnetResourceId', parameters('agentServiceSubnetId'), 'aiServicesPrivateDnsZoneResourceId', parameters('aiServicesPrivateDnsZoneId'), 'cognitiveServicesPrivateDnsZoneResourceId', parameters('cognitiveServicesPrivateDnsZoneId'), 'openAiPrivateDnsZoneResourceId', parameters('openAiPrivateDnsZoneId')), null())]" + }, + "resources": { + "aiFoundry": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('aiFoundry-{0}', uniqueString('aiFoundry', deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "baseName": { + "value": "[parameters('aiFoundryBaseName')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "aiFoundryConfiguration": { + "value": { + "copy": [ + { + "name": "roleAssignments", + "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]", + "input": { + "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignments')]]", + "principalType": "ServicePrincipal", + "roleDefinitionIdOrName": "53ca6127-db72-4b80-b1b0-d745d6d5456d" + } + } + ], + "allowProjectManagement": true, + "createCapabilityHosts": false, + "disableLocalAuth": true, + "location": "[parameters('location')]", + "networking": "[variables('networkingConfig')]", + "project": { + "desc": "AI Foundry project for AI Investment Analysis Sample", + "displayName": "AI-Invest", + "name": "aiinvest-project" + }, + "sku": "S0" + } + }, + "aiModelDeployments": { + "value": [ + { + "model": { + "format": "OpenAI", + "name": "gpt-4.1-mini", + "version": "2025-04-14" + }, + "name": "gpt-4.1-mini", + "sku": { + "capacity": 100, + "name": "GlobalStandard" + } + } + ] + }, + "includeAssociatedResources": { + "value": false + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16692041582792913299" + }, + "name": "ai-foundry", + "description": "Creates an AI Foundry account and project with Standard Agent Services." + }, + "definitions": { + "resourceConfigurationType": { + "type": "object", + "properties": { + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of an existing resource to use instead of creating a new one. If provided, other parameters are ignored." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name to be used when creating the resource. This is ignored if an existingResourceId is provided." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the Private DNS Zone that associates with the resource. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for a resource, including optional name, existing resource ID, and role assignments." + } + }, + "storageAccountConfigurationType": { + "type": "object", + "properties": { + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing Storage Account to use instead of creating a new one. If provided, other parameters are ignored." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name to be used when creating the Storage Account. This is ignored if an existingResourceId is provided." + } + }, + "blobPrivateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the DNS zone \"blob\" for the Azure Storage Account. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for a Storage Account, including optional name, existing resource ID, containers, and role assignments." + } + }, + "foundryConfigurationType": { + "type": "object", + "properties": { + "accountName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the AI Foundry account." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location of the AI Foundry account. Will default to the resource group location if not specified." + } + }, + "sku": { + "type": "string", + "allowedValues": [ + "C2", + "C3", + "C4", + "DC0", + "F0", + "F1", + "S", + "S0", + "S1", + "S10", + "S2", + "S3", + "S4", + "S5", + "S6", + "S7", + "S8", + "S9" + ], + "nullable": true, + "metadata": { + "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region. Defaults to 'S0'." + } + }, + "createCapabilityHosts": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether to create Capability Hosts for the AI Agent Service. If true, the AI Foundry Account and default Project will be created with the capability host for the associated resources. Can only be true if 'includeAssociatedResources' is true. Defaults to false." + } + }, + "disableLocalAuth": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons. Defaults to true." + } + }, + "allowProjectManagement": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether to allow project management in the AI Foundry account. If true, users can create and manage projects within the AI Foundry account. Defaults to true." + } + }, + "networking": { + "$ref": "#/definitions/foundryNetworkConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Values to establish private networking for the AI Foundry account and project." + } + }, + "project": { + "$ref": "#/definitions/foundryProjectConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. AI Foundry default project." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Role assignments to apply to the AI Foundry resource when creating it." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for a AI Foundry, including optional account name and project configuration." + } + }, + "foundryNetworkConfigurationType": { + "type": "object", + "properties": { + "agentServiceSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the subnet for the Azure AI Services account. This is required if 'createAIAgentService' is true." + } + }, + "cognitiveServicesPrivateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account." + } + }, + "openAiPrivateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the Private DNS Zone for the OpenAI account." + } + }, + "aiServicesPrivateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Values to establish private networking for the AI Foundry service." + } + }, + "foundryProjectConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the AI Foundry project." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The friendly/display name of the AI Foundry project." + } + }, + "desc": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the AI Foundry project." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Custom configuration for an AI Foundry project, including optional name, friendly name, and description." + } + }, + "deploymentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of cognitive service account deployment." + } + }, + "model": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account deployment model." + } + }, + "format": { + "type": "string", + "metadata": { + "description": "Required. The format of Cognitive Services account deployment model." + } + }, + "version": { + "type": "string", + "metadata": { + "description": "Required. The version of Cognitive Services account deployment model." + } + } + }, + "metadata": { + "description": "Required. Properties of Cognitive Services account deployment model." + } + }, + "sku": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource model definition representing SKU." + } + }, + "capacity": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The capacity of the resource model definition representing SKU." + } + }, + "tier": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tier of the resource model definition representing SKU." + } + }, + "size": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The size of the resource model definition representing SKU." + } + }, + "family": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The family of the resource model definition representing SKU." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource model definition representing SKU." + } + }, + "raiPolicyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of RAI policy." + } + }, + "versionUpgradeOption": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version upgrade option." + } + } + }, + "metadata": { + "description": "The type for a cognitive services account deployment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "baseName": { + "type": "string", + "minLength": 3, + "maxLength": 12, + "metadata": { + "description": "Required. A friendly application/environment name to serve as the \"base\" when using the default naming for all resources in this deployment." + } + }, + "baseUniqueName": { + "type": "string", + "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('baseName')), 0, 5)]", + "maxLength": 5, + "metadata": { + "description": "Optional. A unique text value for the application/environment. This is used to ensure resource names are unique for global resources. Defaults to a 5-character substring of the unique string generated from the subscription ID, resource group name, and base name." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources. Defaults to the location of the resource group." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "aiModelDeployments": { + "type": "array", + "items": { + "$ref": "#/definitions/deploymentType" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. Specifies the OpenAI deployments to create." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the AI resources." + } + }, + "includeAssociatedResources": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Whether to include associated resources: Key Vault, AI Search, Storage Account, and Cosmos DB. If true, these resources will be created. Optionally, existing resources of these types can be supplied in their respective parameters. Defaults to false." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource ID of the subnet to establish Private Endpoint(s). If provided, private endpoints will be created for the AI Foundry account and associated resources when creating those resource. Each resource will also require supplied private DNS zone resource ID(s) to establish those private endpoints." + } + }, + "aiFoundryConfiguration": { + "$ref": "#/definitions/foundryConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the AI Foundry." + } + }, + "keyVaultConfiguration": { + "$ref": "#/definitions/resourceConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the Key Vault." + } + }, + "aiSearchConfiguration": { + "$ref": "#/definitions/resourceConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the AI Search resource." + } + }, + "storageAccountConfiguration": { + "$ref": "#/definitions/storageAccountConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the Storage Account." + } + }, + "cosmosDbConfiguration": { + "$ref": "#/definitions/resourceConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Custom configuration for the Cosmos DB Account." + } + } + }, + "variables": { + "resourcesName": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('baseName'), parameters('baseUniqueName')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]", + "projectName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'name'))), parameters('aiFoundryConfiguration').project.name, format('proj-{0}', variables('resourcesName')))]", + "createCapabilityHosts": "[and(coalesce(tryGet(parameters('aiFoundryConfiguration'), 'createCapabilityHosts'), false()), parameters('includeAssociatedResources'))]" + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.ptn.aiml-aifoundry.{0}.{1}', replace('0.5.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "foundryAccount": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.account.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'accountName'))), createObject('value', parameters('aiFoundryConfiguration').accountName), createObject('value', format('ai{0}', variables('resourcesName'))))]", + "location": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'location'))), createObject('value', parameters('aiFoundryConfiguration').location), createObject('value', parameters('location')))]", + "sku": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'sku'))), createObject('value', parameters('aiFoundryConfiguration').sku), createObject('value', 'S0'))]", + "disableLocalAuth": { + "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'disableLocalAuth'), true())]" + }, + "allowProjectManagement": { + "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'allowProjectManagement'), true())]" + }, + "aiModelDeployments": { + "value": "[parameters('aiModelDeployments')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "agentSubnetResourceId": { + "value": "[tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')]" + }, + "privateDnsZoneResourceIds": "[if(and(not(empty(parameters('privateEndpointSubnetResourceId'))), not(empty(tryGet(parameters('aiFoundryConfiguration'), 'networking')))), createObject('value', createArray(parameters('aiFoundryConfiguration').networking.cognitiveServicesPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.openAiPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.aiServicesPrivateDnsZoneResourceId)), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[tryGet(parameters('aiFoundryConfiguration'), 'roleAssignments')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "lock": { + "value": "[parameters('lock')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "11906964530752207086" + } + }, + "definitions": { + "deploymentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of cognitive service account deployment." + } + }, + "model": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account deployment model." + } + }, + "format": { + "type": "string", + "metadata": { + "description": "Required. The format of Cognitive Services account deployment model." + } + }, + "version": { + "type": "string", + "metadata": { + "description": "Required. The version of Cognitive Services account deployment model." + } + } + }, + "metadata": { + "description": "Required. Properties of Cognitive Services account deployment model." + } + }, + "sku": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource model definition representing SKU." + } + }, + "capacity": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The capacity of the resource model definition representing SKU." + } + }, + "tier": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tier of the resource model definition representing SKU." + } + }, + "size": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The size of the resource model definition representing SKU." + } + }, + "family": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The family of the resource model definition representing SKU." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource model definition representing SKU." + } + }, + "raiPolicyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of RAI policy." + } + }, + "versionUpgradeOption": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version upgrade option." + } + } + }, + "metadata": { + "description": "The type for a cognitive services account deployment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the AI Foundry resource." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the AI Foundry resource." + } + }, + "sku": { + "type": "string", + "defaultValue": "S0", + "allowedValues": [ + "C2", + "C3", + "C4", + "F0", + "F1", + "S", + "S0", + "S1", + "S10", + "S2", + "S3", + "S4", + "S5", + "S6", + "S7", + "S8", + "S9", + "DC0" + ], + "metadata": { + "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region." + } + }, + "allowProjectManagement": { + "type": "bool", + "metadata": { + "description": "Required. Whether to allow project management in AI Foundry. This is required to enable the AI Foundry UI and project management features." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceIds' to establish private endpoints." + } + }, + "agentSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for agent connectivity. This is required when using agents with private endpoints." + } + }, + "disableLocalAuth": { + "type": "bool", + "metadata": { + "description": "Required. Allow only Azure AD authentication. Should be enabled for security reasons." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the AI Foundry resource." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of AI Foundry resources." + } + }, + "aiModelDeployments": { + "type": "array", + "items": { + "$ref": "#/definitions/deploymentType" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. Specifies the OpenAI deployments to create." + } + }, + "privateDnsZoneResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. List of private DNS zone resource IDs to use for the AI Foundry resource. This is required when using private endpoints." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneResourceIdValues", + "count": "[length(coalesce(parameters('privateDnsZoneResourceIds'), createArray()))]", + "input": { + "privateDnsZoneResourceId": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())[copyIndex('privateDnsZoneResourceIdValues')]]" + } + } + ], + "privateNetworkingEnabled": "[and(not(empty(variables('privateDnsZoneResourceIdValues'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "foundryAccount": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.cognitive-services.account.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "sku": { + "value": "[parameters('sku')]" + }, + "kind": { + "value": "AIServices" + }, + "lock": { + "value": "[parameters('lock')]" + }, + "allowProjectManagement": { + "value": "[parameters('allowProjectManagement')]" + }, + "managedIdentities": { + "value": { + "systemAssigned": true + } + }, + "deployments": { + "value": "[parameters('aiModelDeployments')]" + }, + "customSubDomainName": { + "value": "[parameters('name')]" + }, + "disableLocalAuth": { + "value": "[parameters('disableLocalAuth')]" + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "networkAcls": { + "value": { + "defaultAction": "Allow", + "bypass": "AzureServices" + } + }, + "networkInjections": "[if(and(variables('privateNetworkingEnabled'), not(empty(parameters('agentSubnetResourceId')))), createObject('value', createObject('scenario', 'agent', 'subnetResourceId', parameters('agentSubnetResourceId'), 'useMicrosoftManagedNetwork', false())), createObject('value', null()))]", + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', variables('privateDnsZoneResourceIdValues')), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9381727816193702843" + }, + "name": "Cognitive Services", + "description": "This module deploys a Cognitive Service." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoint output." + } + }, + "deploymentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of cognitive service account deployment." + } + }, + "model": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account deployment model." + } + }, + "format": { + "type": "string", + "metadata": { + "description": "Required. The format of Cognitive Services account deployment model." + } + }, + "version": { + "type": "string", + "metadata": { + "description": "Required. The version of Cognitive Services account deployment model." + } + } + }, + "metadata": { + "description": "Required. Properties of Cognitive Services account deployment model." + } + }, + "sku": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource model definition representing SKU." + } + }, + "capacity": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The capacity of the resource model definition representing SKU." + } + }, + "tier": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tier of the resource model definition representing SKU." + } + }, + "size": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The size of the resource model definition representing SKU." + } + }, + "family": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The family of the resource model definition representing SKU." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource model definition representing SKU." + } + }, + "raiPolicyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of RAI policy." + } + }, + "versionUpgradeOption": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version upgrade option." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cognitive services account deployment." + } + }, + "endpointType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Type of the endpoint." + } + }, + "endpoint": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The endpoint URI." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cognitive services account endpoint." + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the keys and connection strings generated by the modules." + } + }, + "accessKey1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name for the accessKey1 secret to create." + } + }, + "accessKey2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name for the accessKey2 secret to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of the secrets exported to the provided Key Vault." + } + }, + "commitmentPlanType": { + "type": "object", + "properties": { + "autoRenew": { + "type": "bool", + "metadata": { + "description": "Required. Whether the plan should auto-renew at the end of the current commitment period." + } + }, + "current": { + "type": "object", + "properties": { + "count": { + "type": "int", + "metadata": { + "description": "Required. The number of committed instances (e.g., number of containers or cores)." + } + }, + "tier": { + "type": "string", + "metadata": { + "description": "Required. The tier of the commitment plan (e.g., T1, T2)." + } + } + }, + "metadata": { + "description": "Required. The current commitment configuration." + } + }, + "hostingModel": { + "type": "string", + "metadata": { + "description": "Required. The hosting model for the commitment plan. (e.g., DisconnectedContainer, ConnectedContainer, ProvisionedWeb, Web)." + } + }, + "planType": { + "type": "string", + "metadata": { + "description": "Required. The plan type indicating which capability the plan applies to (e.g., NTTS, STT, CUSTOMSTT, ADDON)." + } + }, + "commitmentPlanGuid": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of an existing commitment plan to update. Set to null to create a new plan." + } + }, + "next": { + "type": "object", + "properties": { + "count": { + "type": "int", + "metadata": { + "description": "Required. The number of committed instances for the next period." + } + }, + "tier": { + "type": "string", + "metadata": { + "description": "Required. The tier for the next commitment period." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The configuration of the next commitment period, if scheduled." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a disconnected container commitment plan." + } + }, + "networkInjectionType": { + "type": "object", + "properties": { + "scenario": { + "type": "string", + "allowedValues": [ + "agent", + "none" + ], + "metadata": { + "description": "Required. The scenario for the network injection." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. The Resource ID of the subnet on the Virtual Network on which to inject." + } + }, + "useMicrosoftManagedNetwork": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether to use Microsoft Managed Network. Defaults to false." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." + } + }, + "_1.secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "_2.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_2.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "customerManagedKeyType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_2.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_2.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_2.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/_1.secretSetOutputType", + "metadata": { + "description": "An exported secret's references." + } + }, + "metadata": { + "description": "A map of the exported secrets", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of Cognitive Services account." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "AIServices", + "AnomalyDetector", + "CognitiveServices", + "ComputerVision", + "ContentModerator", + "ContentSafety", + "ConversationalLanguageUnderstanding", + "CustomVision.Prediction", + "CustomVision.Training", + "Face", + "FormRecognizer", + "HealthInsights", + "ImmersiveReader", + "Internal.AllInOne", + "LUIS", + "LUIS.Authoring", + "LanguageAuthoring", + "MetricsAdvisor", + "OpenAI", + "Personalizer", + "QnAMaker.v2", + "SpeechServices", + "TextAnalytics", + "TextTranslation" + ], + "metadata": { + "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region." + } + }, + "sku": { + "type": "string", + "defaultValue": "S0", + "allowedValues": [ + "C2", + "C3", + "C4", + "F0", + "F1", + "S", + "S0", + "S1", + "S10", + "S2", + "S3", + "S4", + "S5", + "S6", + "S7", + "S8", + "S9", + "DC0" + ], + "metadata": { + "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "customSubDomainName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set." + } + }, + "networkAcls": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. A collection of rules governing the accessibility from specific network locations." + } + }, + "networkInjections": { + "$ref": "#/definitions/networkInjectionType", + "nullable": true, + "metadata": { + "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + }, + "allowedFqdnList": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. List of allowed FQDN." + } + }, + "apiProperties": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. The API properties for special APIs." + } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "dynamicThrottlingEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The flag to enable dynamic throttling." + } + }, + "migrationToken": { + "type": "securestring", + "nullable": true, + "metadata": { + "description": "Optional. Resource migration token." + } + }, + "restore": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists." + } + }, + "restrictOutboundNetworkAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Restrict outbound network access." + } + }, + "userOwnedStorage": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.CognitiveServices/accounts@2025-04-01-preview#properties/properties/properties/userOwnedStorage" + }, + "description": "Optional. The storage accounts for this resource." + }, + "nullable": true + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "deployments": { + "type": "array", + "items": { + "$ref": "#/definitions/deploymentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of deployments about cognitive service accounts to create." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "allowProjectManagement": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable project management feature for AI Foundry." + } + }, + "commitmentPlans": { + "type": "array", + "items": { + "$ref": "#/definitions/commitmentPlanType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Commitment plans to deploy for the cognitive services account." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]", + "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]", + "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]", + "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]", + "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]", + "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]", + "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]", + "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]", + "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]", + "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]", + "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]", + "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]", + "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]", + "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]", + "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]", + "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]", + "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]", + "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]", + "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]", + "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]", + "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]", + "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]", + "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]", + "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]", + "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]", + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.13.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2025-01-31-preview", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "cognitiveService": { + "type": "Microsoft.CognitiveServices/accounts", + "apiVersion": "2025-06-01", + "name": "[parameters('name')]", + "kind": "[parameters('kind')]", + "identity": "[variables('identity')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "[parameters('sku')]" + }, + "properties": { + "allowProjectManagement": "[parameters('allowProjectManagement')]", + "customSubDomainName": "[parameters('customSubDomainName')]", + "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]", + "networkInjections": "[if(not(empty(parameters('networkInjections'))), createArray(createObject('scenario', tryGet(parameters('networkInjections'), 'scenario'), 'subnetArmId', tryGet(parameters('networkInjections'), 'subnetResourceId'), 'useMicrosoftManagedNetwork', coalesce(tryGet(parameters('networkInjections'), 'useMicrosoftManagedNetwork'), false()))), null())]", + "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]", + "allowedFqdnList": "[parameters('allowedFqdnList')]", + "apiProperties": "[parameters('apiProperties')]", + "disableLocalAuth": "[parameters('disableLocalAuth')]", + "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]", + "migrationToken": "[parameters('migrationToken')]", + "restore": "[parameters('restore')]", + "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]", + "userOwnedStorage": "[if(not(empty(parameters('userOwnedStorage'))), parameters('userOwnedStorage'), null())]", + "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]" + }, + "dependsOn": [ + "cMKKeyVault", + "cMKKeyVault::cMKKey", + "cMKUserAssignedIdentity" + ] + }, + "cognitiveService_deployments": { + "copy": { + "name": "cognitiveService_deployments", + "count": "[length(coalesce(parameters('deployments'), createArray()))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.CognitiveServices/accounts/deployments", + "apiVersion": "2025-06-01", + "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]", + "properties": { + "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]", + "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]", + "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]" + }, + "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]", + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_commitmentPlans": { + "copy": { + "name": "cognitiveService_commitmentPlans", + "count": "[length(coalesce(parameters('commitmentPlans'), createArray()))]" + }, + "type": "Microsoft.CognitiveServices/accounts/commitmentPlans", + "apiVersion": "2025-06-01", + "name": "[format('{0}/{1}', parameters('name'), format('{0}-{1}', coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].hostingModel, coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].planType))]", + "properties": "[coalesce(parameters('commitmentPlans'), createArray())[copyIndex()]]", + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_diagnosticSettings": { + "copy": { + "name": "cognitiveService_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_roleAssignments": { + "copy": { + "name": "cognitiveService_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "cognitiveService_privateEndpoints": { + "copy": { + "name": "cognitiveService_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "cognitiveService" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-06-01').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-06-01').key2)), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10828079590669389085" + } + }, + "definitions": { + "secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the secret to set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetOutputType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]", + "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]" + } + } + } + } + } + }, + "dependsOn": [ + "cognitiveService" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the cognitive services account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the cognitive services account." + }, + "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the cognitive services account was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The service endpoint of the cognitive services account." + }, + "value": "[reference('cognitiveService').endpoint]" + }, + "endpoints": { + "$ref": "#/definitions/endpointType", + "metadata": { + "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind." + }, + "value": "[reference('cognitiveService').endpoints]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('cognitiveService', '2025-06-01', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('cognitiveService', '2025-06-01', 'full').location]" + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the congitive services account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the AI Foundry resource." + }, + "value": "[reference('foundryAccount').outputs.name.value]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the AI Foundry resource." + }, + "value": "[reference('foundryAccount').outputs.resourceId.value]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the AI Foundry resource." + }, + "value": "[subscription().subscriptionId]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the AI Foundry resource." + }, + "value": "[resourceGroup().name]" + }, + "location": { + "type": "string", + "metadata": { + "description": "Location of the AI Foundry resource." + }, + "value": "[parameters('location')]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "metadata": { + "description": "System assigned managed identity principal ID of the AI Foundry resource." + }, + "value": "[reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value]" + } + } + } + } + }, + "keyVault": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.keyVault.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('keyVaultConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(and(not(empty(parameters('keyVaultConfiguration'))), not(empty(tryGet(parameters('keyVaultConfiguration'), 'name')))), parameters('keyVaultConfiguration').name, format('kv{0}', variables('resourcesName'))), 24)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "privateDnsZoneResourceId": { + "value": "[tryGet(parameters('keyVaultConfiguration'), 'privateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('keyVaultConfiguration'), 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "9899473530932390252" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. The name of the Key Vault." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the Key Vault." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing Key Vault to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the Key Vault to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the Key Vault." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingKeyVault": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "keyVault": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.key-vault.vault.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "networkAcls": { + "value": { + "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]" + } + }, + "enableVaultForDeployment": { + "value": true + }, + "enableVaultForDiskEncryption": { + "value": true + }, + "enableVaultForTemplateDeployment": { + "value": true + }, + "enablePurgeProtection": { + "value": false + }, + "enableRbacAuthorization": { + "value": true + }, + "enableSoftDelete": { + "value": true + }, + "softDeleteRetentionInDays": { + "value": 7 + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'vault', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "8811577289487069918" + }, + "name": "Key Vaults", + "description": "This module deploys a Key Vault." + }, + "definitions": { + "networkAclsType": { + "type": "object", + "properties": { + "bypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. The bypass options for traffic for the network ACLs." + } + }, + "defaultAction": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "nullable": true, + "metadata": { + "description": "Optional. The default action for the network ACLs, when no rule matches." + } + }, + "ipRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "value": { + "type": "string", + "metadata": { + "description": "Required. An IPv4 address range in CIDR notation, such as \"124.56.78.91\" (simple IP address) or \"124.56.78.0/24\"." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP rules." + } + }, + "virtualNetworkRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the virtual network subnet." + } + }, + "ignoreMissingVnetServiceEndpoint": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Whether NRP will ignore the check if parent subnet has serviceEndpoints configured." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of virtual network rules." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for rules governing the accessibility of the key vault from specific network locations." + } + }, + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "credentialOutputType": { + "type": "object", + "properties": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The item's resourceId." + } + }, + "uri": { + "type": "string", + "metadata": { + "description": "The item's uri." + } + }, + "uriWithVersion": { + "type": "string", + "metadata": { + "description": "The item's uri with version." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a credential output." + } + }, + "accessPolicyType": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tenant ID that is used for authenticating requests to the key vault." + } + }, + "objectId": { + "type": "string", + "metadata": { + "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault." + } + }, + "applicationId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Application ID of the client making request on behalf of a principal." + } + }, + "permissions": { + "type": "object", + "properties": { + "keys": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "decrypt", + "delete", + "encrypt", + "get", + "getrotationpolicy", + "import", + "list", + "purge", + "recover", + "release", + "restore", + "rotate", + "setrotationpolicy", + "sign", + "unwrapKey", + "update", + "verify", + "wrapKey" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to keys." + } + }, + "secrets": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "get", + "list", + "purge", + "recover", + "restore", + "set" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to secrets." + } + }, + "certificates": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "delete", + "deleteissuers", + "get", + "getissuers", + "import", + "list", + "listissuers", + "managecontacts", + "manageissuers", + "purge", + "recover", + "restore", + "setissuers", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to certificates." + } + }, + "storage": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "deletesas", + "get", + "getsas", + "list", + "listsas", + "purge", + "recover", + "regeneratekey", + "restore", + "set", + "setsas", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to storage accounts." + } + } + }, + "metadata": { + "description": "Required. Permissions the identity has for keys, secrets and certificates." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an access policy." + } + }, + "secretType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Resource tags." + } + }, + "attributes": { + "type": "object", + "properties": { + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Defines whether the secret is enabled or disabled." + } + }, + "exp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z." + } + }, + "nbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Contains attributes of the secret." + } + }, + "contentType": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The content type of the secret." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a secret output." + } + }, + "keyType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the key." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Resource tags." + } + }, + "attributes": { + "type": "object", + "properties": { + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Defines whether the key is enabled or disabled." + } + }, + "exp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z." + } + }, + "nbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Contains attributes of the key." + } + }, + "curveName": { + "type": "string", + "allowedValues": [ + "P-256", + "P-256K", + "P-384", + "P-521" + ], + "nullable": true, + "metadata": { + "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"." + } + }, + "keyOps": { + "type": "array", + "allowedValues": [ + "decrypt", + "encrypt", + "import", + "release", + "sign", + "unwrapKey", + "verify", + "wrapKey" + ], + "nullable": true, + "metadata": { + "description": "Optional. The allowed operations on this key." + } + }, + "keySize": { + "type": "int", + "allowedValues": [ + 2048, + 3072, + 4096 + ], + "nullable": true, + "metadata": { + "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"." + } + }, + "kty": { + "type": "string", + "allowedValues": [ + "EC", + "EC-HSM", + "RSA", + "RSA-HSM" + ], + "nullable": true, + "metadata": { + "description": "Optional. The type of the key. Default is \"EC\"." + } + }, + "releasePolicy": { + "type": "object", + "properties": { + "contentType": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Content type and version of key release policy." + } + }, + "data": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Blob encoding the policy rules under which the key can be released." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Key release policy." + } + }, + "rotationPolicy": { + "$ref": "#/definitions/rotationPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Key rotation policy." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a key." + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "rotationPolicyType": { + "type": "object", + "properties": { + "attributes": { + "type": "object", + "properties": { + "expiryTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The attributes of key rotation policy." + } + }, + "lifetimeActions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "action": { + "type": "object", + "properties": { + "type": { + "type": "string", + "allowedValues": [ + "notify", + "rotate" + ], + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + }, + "trigger": { + "type": "object", + "properties": { + "timeAfterCreate": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + }, + "timeBeforeExpiry": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The time duration for rotating the key." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The key rotation policy lifetime actions." + } + } + }, + "metadata": { + "description": "The type for a rotation policy.", + "__bicep_imported_from!": { + "sourceTemplate": "key/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. Name of the Key Vault. Must be globally unique." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "accessPolicies": { + "type": "array", + "items": { + "$ref": "#/definitions/accessPolicyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All access policies to create." + } + }, + "secrets": { + "type": "array", + "items": { + "$ref": "#/definitions/secretType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All secrets to create." + } + }, + "keys": { + "type": "array", + "items": { + "$ref": "#/definitions/keyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. All keys to create." + } + }, + "enableVaultForDeployment": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies if the vault is enabled for deployment by script or compute." + } + }, + "enableVaultForTemplateDeployment": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies if the vault is enabled for a template deployment." + } + }, + "enableVaultForDiskEncryption": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios." + } + }, + "enableSoftDelete": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Switch to enable/disable Key Vault's soft delete feature." + } + }, + "softDeleteRetentionInDays": { + "type": "int", + "defaultValue": 90, + "metadata": { + "description": "Optional. softDelete data retention days. It accepts >=7 and <=90." + } + }, + "enableRbacAuthorization": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC." + } + }, + "createMode": { + "type": "string", + "defaultValue": "default", + "allowedValues": [ + "default", + "recover" + ], + "metadata": { + "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not." + } + }, + "enablePurgeProtection": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature." + } + }, + "sku": { + "type": "string", + "defaultValue": "premium", + "allowedValues": [ + "premium", + "standard" + ], + "metadata": { + "description": "Optional. Specifies the SKU for the vault." + } + }, + "networkAcls": { + "$ref": "#/definitions/networkAclsType", + "nullable": true, + "metadata": { + "description": "Optional. Rules governing the accessibility of the resource from specific network locations." + } + }, + "publicNetworkAccess": { + "type": "string", + "defaultValue": "", + "allowedValues": [ + "", + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.KeyVault/vaults@2024-11-01#properties/tags" + }, + "description": "Optional. Resource tags." + }, + "nullable": true + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + }, + { + "name": "formattedAccessPolicies", + "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]", + "input": { + "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]", + "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]", + "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]", + "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]" + } + } + ], + "enableReferencedModulesTelemetry": false, + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]", + "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]", + "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]", + "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]", + "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]", + "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]", + "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]", + "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]", + "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]", + "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.13.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "enabledForDeployment": "[parameters('enableVaultForDeployment')]", + "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]", + "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]", + "enableSoftDelete": "[parameters('enableSoftDelete')]", + "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]", + "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]", + "createMode": "[parameters('createMode')]", + "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]", + "tenantId": "[subscription().tenantId]", + "accessPolicies": "[variables('formattedAccessPolicies')]", + "sku": { + "name": "[parameters('sku')]", + "family": "A" + }, + "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]", + "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]" + } + }, + "keyVault_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_diagnosticSettings": { + "copy": { + "name": "keyVault_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_roleAssignments": { + "copy": { + "name": "keyVault_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_accessPolicies": { + "condition": "[not(empty(parameters('accessPolicies')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[parameters('name')]" + }, + "accessPolicies": { + "value": "[parameters('accessPolicies')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "8803020983329720581" + }, + "name": "Key Vault Access Policies", + "description": "This module deploys a Key Vault Access Policy." + }, + "definitions": { + "accessPoliciesType": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The tenant ID that is used for authenticating requests to the key vault." + } + }, + "objectId": { + "type": "string", + "metadata": { + "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault." + } + }, + "applicationId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Application ID of the client making request on behalf of a principal." + } + }, + "permissions": { + "type": "object", + "properties": { + "keys": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "decrypt", + "delete", + "encrypt", + "get", + "getrotationpolicy", + "import", + "list", + "purge", + "recover", + "release", + "restore", + "rotate", + "setrotationpolicy", + "sign", + "unwrapKey", + "update", + "verify", + "wrapKey" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to keys." + } + }, + "secrets": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "get", + "list", + "purge", + "recover", + "restore", + "set" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to secrets." + } + }, + "certificates": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "create", + "delete", + "deleteissuers", + "get", + "getissuers", + "import", + "list", + "listissuers", + "managecontacts", + "manageissuers", + "purge", + "recover", + "restore", + "setissuers", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to certificates." + } + }, + "storage": { + "type": "array", + "allowedValues": [ + "all", + "backup", + "delete", + "deletesas", + "get", + "getsas", + "list", + "listsas", + "purge", + "recover", + "regeneratekey", + "restore", + "set", + "setsas", + "update" + ], + "nullable": true, + "metadata": { + "description": "Optional. Permissions to storage accounts." + } + } + }, + "metadata": { + "description": "Required. Permissions the identity has for keys, secrets and certificates." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an access policy." + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment." + } + }, + "accessPolicies": { + "type": "array", + "items": { + "$ref": "#/definitions/accessPoliciesType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-accesspolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "policies": { + "type": "Microsoft.KeyVault/vaults/accessPolicies", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]", + "properties": { + "copy": [ + { + "name": "accessPolicies", + "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]", + "input": { + "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'applicationId'), '')]", + "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].objectId]", + "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].permissions]", + "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'tenantId'), tenant().tenantId)]" + } + } + ] + } + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the access policies assignment was created in." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the access policies assignment." + }, + "value": "add" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the access policies assignment." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_secrets": { + "copy": { + "name": "keyVault_secrets", + "count": "[length(coalesce(parameters('secrets'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]" + }, + "value": { + "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]" + }, + "keyVaultName": { + "value": "[parameters('name')]" + }, + "attributesEnabled": { + "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'enabled')]" + }, + "attributesExp": { + "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'exp')]" + }, + "attributesNbf": { + "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'nbf')]" + }, + "contentType": { + "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "8701309639990049090" + }, + "name": "Key Vault Secrets", + "description": "This module deploys a Key Vault Secret." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "minLength": 1, + "maxLength": 127, + "metadata": { + "description": "Required. The name of the secret (letters (upper and lower case), numbers, -)." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.KeyVault/vaults/secrets@2024-11-01#properties/tags" + }, + "description": "Optional. Resource tags." + }, + "nullable": true + }, + "attributesEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Determines whether the object is enabled." + } + }, + "attributesExp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible." + } + }, + "attributesNbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z." + } + }, + "contentType": { + "type": "securestring", + "nullable": true, + "metadata": { + "description": "Optional. The content type of the secret." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]", + "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]", + "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]", + "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]", + "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-secret.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secret": { + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "contentType": "[parameters('contentType')]", + "attributes": { + "enabled": "[parameters('attributesEnabled')]", + "exp": "[parameters('attributesExp')]", + "nbf": "[parameters('attributesNbf')]" + }, + "value": "[parameters('value')]" + } + }, + "secret_roleAssignments": { + "copy": { + "name": "secret_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "secret" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the secret." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the secret." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]" + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The uri of the secret." + }, + "value": "[reference('secret').secretUri]" + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The uri with version of the secret." + }, + "value": "[reference('secret').secretUriWithVersion]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the secret was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_keys": { + "copy": { + "name": "keyVault_keys", + "count": "[length(coalesce(parameters('keys'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]" + }, + "keyVaultName": { + "value": "[parameters('name')]" + }, + "attributesEnabled": { + "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'enabled')]" + }, + "attributesExp": { + "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'exp')]" + }, + "attributesNbf": { + "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'nbf')]" + }, + "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]", + "keyOps": { + "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]" + }, + "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]", + "releasePolicy": { + "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]" + }, + "kty": { + "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "rotationPolicy": { + "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1266219369073699726" + }, + "name": "Key Vault Keys", + "description": "This module deploys a Key Vault Key." + }, + "definitions": { + "rotationPolicyType": { + "type": "object", + "properties": { + "attributes": { + "type": "object", + "properties": { + "expiryTime": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The attributes of key rotation policy." + } + }, + "lifetimeActions": { + "type": "array", + "items": { + "type": "object", + "properties": { + "action": { + "type": "object", + "properties": { + "type": { + "type": "string", + "allowedValues": [ + "notify", + "rotate" + ], + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The type of the action." + } + }, + "trigger": { + "type": "object", + "properties": { + "timeAfterCreate": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + }, + "timeBeforeExpiry": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The time duration for rotating the key." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The key rotation policy lifetime actions." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a rotation policy." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the key." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.KeyVault/vaults/keys@2024-11-01#properties/tags" + }, + "description": "Optional. Resource tags." + }, + "nullable": true + }, + "attributesEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Determines whether the object is enabled." + } + }, + "attributesExp": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible." + } + }, + "attributesNbf": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z." + } + }, + "curveName": { + "type": "string", + "defaultValue": "P-256", + "allowedValues": [ + "P-256", + "P-256K", + "P-384", + "P-521" + ], + "metadata": { + "description": "Optional. The elliptic curve name." + } + }, + "keyOps": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "allowedValues": [ + "decrypt", + "encrypt", + "import", + "sign", + "unwrapKey", + "verify", + "wrapKey" + ], + "metadata": { + "description": "Optional. Array of JsonWebKeyOperation." + } + }, + "keySize": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA." + } + }, + "kty": { + "type": "string", + "defaultValue": "EC", + "allowedValues": [ + "EC", + "EC-HSM", + "RSA", + "RSA-HSM" + ], + "metadata": { + "description": "Optional. The type of the key." + } + }, + "releasePolicy": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Key release policy." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "rotationPolicy": { + "$ref": "#/definitions/rotationPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Key rotation policy properties object." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]", + "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]", + "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]", + "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]", + "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]", + "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.keyvault-key.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "key": { + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": "[shallowMerge(createArray(createObject('attributes', createObject('enabled', parameters('attributesEnabled'), 'exp', parameters('attributesExp'), 'nbf', parameters('attributesNbf')), 'curveName', parameters('curveName'), 'keyOps', parameters('keyOps'), 'keySize', parameters('keySize'), 'kty', parameters('kty'), 'release_policy', coalesce(parameters('releasePolicy'), createObject())), if(not(empty(parameters('rotationPolicy'))), createObject('rotationPolicy', parameters('rotationPolicy')), createObject())))]" + }, + "key_roleAssignments": { + "copy": { + "name": "key_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "key" + ] + } + }, + "outputs": { + "keyUri": { + "type": "string", + "metadata": { + "description": "The uri of the key." + }, + "value": "[reference('key').keyUri]" + }, + "keyUriWithVersion": { + "type": "string", + "metadata": { + "description": "The uri with version of the key." + }, + "value": "[reference('key').keyUriWithVersion]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the key." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the key." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the key was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + }, + "keyVault_privateEndpoints": { + "copy": { + "name": "keyVault_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "keyVault" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the key vault." + }, + "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the key vault was created in." + }, + "value": "[resourceGroup().name]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the key vault." + }, + "value": "[parameters('name')]" + }, + "uri": { + "type": "string", + "metadata": { + "description": "The URI of the key vault." + }, + "value": "[reference('keyVault').vaultUri]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('keyVault', '2024-11-01', 'full').location]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the key vault." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "secrets": { + "type": "array", + "items": { + "$ref": "#/definitions/credentialOutputType" + }, + "metadata": { + "description": "The properties of the created secrets." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secrets'), createArray()))))]", + "input": { + "resourceId": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.resourceId.value]", + "uri": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUri.value]", + "uriWithVersion": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUriWithVersion.value]" + } + } + }, + "keys": { + "type": "array", + "items": { + "$ref": "#/definitions/credentialOutputType" + }, + "metadata": { + "description": "The properties of the created keys." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('keys'), createArray()))))]", + "input": { + "resourceId": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.resourceId.value]", + "uri": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUri.value]", + "uriWithVersion": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUriWithVersion.value]" + } + } + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.KeyVault/vaults', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the Key Vault." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + } + } + } + } + }, + "aiSearch": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.aiSearch.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(not(empty(tryGet(parameters('aiSearchConfiguration'), 'name'))), parameters('aiSearchConfiguration').name, format('srch{0}', variables('resourcesName'))), 60)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "privateDnsZoneResourceId": { + "value": "[tryGet(parameters('aiSearchConfiguration'), 'privateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('aiSearchConfiguration'), 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "2804046174313565921" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 60, + "metadata": { + "description": "Required. The name of the AI Search resource." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the AI Search resource." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing AI Search resource to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the AI Search resource to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the AI Search resource." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingSearchService": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-05-01", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "aiSearch": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.search.search-service.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "cmkEnforcement": { + "value": "Unspecified" + }, + "managedIdentities": { + "value": { + "systemAssigned": true + } + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "disableLocalAuth": { + "value": "[variables('privateNetworkingEnabled')]" + }, + "authOptions": "[if(variables('privateNetworkingEnabled'), createObject('value', null()), createObject('value', createObject('aadOrApiKey', createObject('aadAuthFailureMode', 'http401WithBearerChallenge'))))]", + "sku": { + "value": "standard" + }, + "partitionCount": { + "value": 1 + }, + "replicaCount": { + "value": 3 + }, + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10902281417196168235" + }, + "name": "Search Services", + "description": "This module deploys a Search Service." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the API Admin keys generated by the modules." + } + }, + "primaryAdminKeyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The primaryAdminKey secret name to create." + } + }, + "secondaryAdminKeyName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The secondaryAdminKey secret name to create." + } + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/secretSetType", + "metadata": { + "description": "An exported secret's references." + } + } + }, + "authOptionsType": { + "type": "object", + "properties": { + "aadOrApiKey": { + "type": "object", + "properties": { + "aadAuthFailureMode": { + "type": "string", + "allowedValues": [ + "http401WithBearerChallenge", + "http403" + ], + "nullable": true, + "metadata": { + "description": "Optional. Describes what response the data plane API of a search service would send for requests that failed authentication." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Indicates that either the API key or an access token from a Microsoft Entra ID tenant can be used for authentication." + } + }, + "apiKeyOnly": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Indicates that only the API key can be used for authentication." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "networkRuleSetType": { + "type": "object", + "properties": { + "bypass": { + "type": "string", + "allowedValues": [ + "AzurePortal", + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Network specific rules that determine how the Azure AI Search service may be reached." + } + }, + "ipRules": { + "type": "array", + "items": { + "$ref": "#/definitions/ipRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP restriction rules that defines the inbound network(s) with allowing access to the search service endpoint. At the meantime, all other public IP networks are blocked by the firewall. These restriction rules are applied only when the 'publicNetworkAccess' of the search service is 'enabled'; otherwise, traffic over public interface is not allowed even with any public IP rules, and private endpoint connections would be the exclusive access method." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipRuleType": { + "type": "object", + "properties": { + "value": { + "type": "string", + "metadata": { + "description": "Required. Value corresponding to a single IPv4 address (eg., 123.1.2.3) or an IP range in CIDR format (eg., 123.1.2.3/24) to be allowed." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "_1.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateEndpointSingleServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private Endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the Private Endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the Private Endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_1.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "secretSetType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "modules/keyVaultExport.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Azure Cognitive Search service to create or update. Search service names must only contain lowercase letters, digits or dashes, cannot use dash as the first two or last one characters, cannot contain consecutive dashes, and must be between 2 and 60 characters in length. Search service names must be globally unique since they are part of the service URI (https://.search.windows.net). You cannot change the service name after the service is created." + } + }, + "authOptions": { + "$ref": "#/definitions/authOptionsType", + "nullable": true, + "metadata": { + "description": "Optional. Defines the options for how the data plane API of a Search service authenticates requests. Must remain an empty object {} if 'disableLocalAuth' is set to true." + } + }, + "disableLocalAuth": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. When set to true, calls to the search service will not be permitted to utilize API keys for authentication. This cannot be set to true if 'authOptions' are defined." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "cmkEnforcement": { + "type": "string", + "defaultValue": "Unspecified", + "allowedValues": [ + "Disabled", + "Enabled", + "Unspecified" + ], + "metadata": { + "description": "Optional. Describes a policy that determines how resources within the search service are to be encrypted with Customer Managed Keys." + } + }, + "hostingMode": { + "type": "string", + "defaultValue": "default", + "allowedValues": [ + "default", + "highDensity" + ], + "metadata": { + "description": "Optional. Applicable only for the standard3 SKU. You can set this property to enable up to 3 high density partitions that allow up to 1000 indexes, which is much higher than the maximum indexes allowed for any other SKU. For the standard3 SKU, the value is either 'default' or 'highDensity'. For all other SKUs, this value must be 'default'." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings for all Resources in the solution." + } + }, + "networkRuleSet": { + "$ref": "#/definitions/networkRuleSetType", + "nullable": true, + "metadata": { + "description": "Optional. Network specific rules that determine how the Azure Cognitive Search service may be reached." + } + }, + "partitionCount": { + "type": "int", + "defaultValue": 1, + "minValue": 1, + "maxValue": 12, + "metadata": { + "description": "Optional. The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointSingleServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "sharedPrivateLinkResources": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. The sharedPrivateLinkResources to create as part of the search Service." + } + }, + "publicNetworkAccess": { + "type": "string", + "defaultValue": "Enabled", + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "replicaCount": { + "type": "int", + "defaultValue": 3, + "minValue": 1, + "maxValue": 12, + "metadata": { + "description": "Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "semanticSearch": { + "type": "string", + "nullable": true, + "allowedValues": [ + "disabled", + "free", + "standard" + ], + "metadata": { + "description": "Optional. Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations." + } + }, + "sku": { + "type": "string", + "defaultValue": "standard", + "allowedValues": [ + "basic", + "free", + "standard", + "standard2", + "standard3", + "storage_optimized_l1", + "storage_optimized_l2" + ], + "metadata": { + "description": "Optional. Defines the SKU of an Azure Cognitive Search Service, which determines price tier and capacity limits." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Search/searchServices@2025-02-01-preview#properties/tags" + }, + "description": "Optional. Tags to help categorize the resource in the Azure portal." + }, + "nullable": true + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', '')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Search Index Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]", + "Search Index Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]", + "Search Service Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "searchService": { + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-02-01-preview", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "sku": { + "name": "[parameters('sku')]" + }, + "tags": "[parameters('tags')]", + "identity": "[variables('identity')]", + "properties": { + "authOptions": "[parameters('authOptions')]", + "disableLocalAuth": "[parameters('disableLocalAuth')]", + "encryptionWithCmk": { + "enforcement": "[parameters('cmkEnforcement')]" + }, + "hostingMode": "[parameters('hostingMode')]", + "networkRuleSet": "[parameters('networkRuleSet')]", + "partitionCount": "[parameters('partitionCount')]", + "replicaCount": "[parameters('replicaCount')]", + "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]", + "semanticSearch": "[parameters('semanticSearch')]" + } + }, + "searchService_diagnosticSettings": { + "copy": { + "name": "searchService_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_roleAssignments": { + "copy": { + "name": "searchService_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Search/searchServices', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_privateEndpoints": { + "copy": { + "name": "searchService_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-searchService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "searchService" + ] + }, + "searchService_sharedPrivateLinkResources": { + "copy": { + "name": "searchService_sharedPrivateLinkResources", + "count": "[length(parameters('sharedPrivateLinkResources'))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-searchService-SharedPrvLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]" + }, + "searchServiceName": { + "value": "[parameters('name')]" + }, + "privateLinkResourceId": { + "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].privateLinkResourceId]" + }, + "groupId": { + "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].groupId]" + }, + "requestMessage": { + "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].requestMessage]" + }, + "resourceRegion": { + "value": "[tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'resourceRegion')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "557730297583881254" + }, + "name": "Search Services Private Link Resources", + "description": "This module deploys a Search Service Private Link Resource." + }, + "parameters": { + "searchServiceName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent searchServices. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the shared private link resource managed by the Azure Cognitive Search service within the specified resource group." + } + }, + "privateLinkResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the resource the shared private link resource is for." + } + }, + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The group ID from the provider of resource the shared private link resource is for." + } + }, + "requestMessage": { + "type": "string", + "metadata": { + "description": "Required. The request message for requesting approval of the shared private link resource." + } + }, + "resourceRegion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Can be used to specify the Azure Resource Manager location of the resource to which a shared private link is to be created. This is only required for those resources whose DNS configuration are regional (such as Azure Kubernetes Service)." + } + } + }, + "resources": { + "searchService": { + "existing": true, + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-02-01-preview", + "name": "[parameters('searchServiceName')]" + }, + "sharedPrivateLinkResource": { + "type": "Microsoft.Search/searchServices/sharedPrivateLinkResources", + "apiVersion": "2025-02-01-preview", + "name": "[format('{0}/{1}', parameters('searchServiceName'), parameters('name'))]", + "properties": { + "privateLinkResourceId": "[parameters('privateLinkResourceId')]", + "groupId": "[parameters('groupId')]", + "requestMessage": "[parameters('requestMessage')]", + "resourceRegion": "[parameters('resourceRegion')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the shared private link resource." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the shared private link resource." + }, + "value": "[resourceId('Microsoft.Search/searchServices/sharedPrivateLinkResources', parameters('searchServiceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the shared private link resource was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "searchService" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').primaryKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').secondaryKey)), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "7634110751636246703" + } + }, + "definitions": { + "secretSetType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]" + } + } + } + } + } + }, + "dependsOn": [ + "searchService" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the search service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the search service." + }, + "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the search service was created in." + }, + "value": "[resourceGroup().name]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('searchService', '2025-02-01-preview', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('searchService', '2025-02-01-preview', 'full').location]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The endpoint of the search service." + }, + "value": "[reference('searchService').endpoint]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the search service." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "primaryKey": { + "type": "securestring", + "metadata": { + "description": "The primary admin API key of the search service." + }, + "value": "[listAdminKeys('searchService', '2025-02-01-preview').primaryKey]" + }, + "secondaryKey": { + "type": "securestring", + "metadata": { + "description": "The secondaryKey admin API key of the search service." + }, + "value": "[listAdminKeys('searchService', '2025-02-01-preview').secondaryKey]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Search/searchServices', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "System assigned managed identity principal ID of the AI Search resource." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, '')]" + } + } + } + } + }, + "storageAccount": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.storageAccount.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('storageAccountConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(not(empty(tryGet(parameters('storageAccountConfiguration'), 'name'))), parameters('storageAccountConfiguration').name, format('st{0}', variables('resourcesName'))), 24)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "blobPrivateDnsZoneResourceId": { + "value": "[tryGet(parameters('storageAccountConfiguration'), 'blobPrivateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[concat(if(and(not(empty(parameters('storageAccountConfiguration'))), not(empty(tryGet(parameters('storageAccountConfiguration'), 'roleAssignments')))), parameters('storageAccountConfiguration').roleAssignments, createArray()), createArray(createObject('principalId', reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), if(empty(tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')), createArray(createObject('principalId', reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "10412454114821386555" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. The name of the storage account." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the storage account." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing storage account to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'blobPrivateDnsZoneResourceId' to establish private endpoints." + } + }, + "blobPrivateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the storage account blob service to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the storage account." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('blobPrivateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingStorageAccount": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "storageAccount": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.storage.storage-account.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "accessTier": { + "value": "Hot" + }, + "allowBlobPublicAccess": { + "value": "[not(variables('privateNetworkingEnabled'))]" + }, + "allowSharedKeyAccess": { + "value": false + }, + "allowCrossTenantReplication": { + "value": false + }, + "blobServices": { + "value": { + "deleteRetentionPolicyEnabled": true, + "deleteRetentionPolicyDays": 7, + "containerDeleteRetentionPolicyEnabled": true, + "containerDeleteRetentionPolicyDays": 7 + } + }, + "minimumTlsVersion": { + "value": "TLS1_2" + }, + "networkAcls": { + "value": { + "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]", + "bypass": "AzureServices" + } + }, + "supportsHttpsTrafficOnly": { + "value": true + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('blobPrivateDnsZoneResourceId')))), 'service', 'blob', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3530476863855541150" + }, + "name": "Storage Accounts", + "description": "This module deploys a Storage Account." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses of the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoints output." + } + }, + "networkAclsType": { + "type": "object", + "properties": { + "resourceAccessRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "tenantId": { + "type": "string", + "metadata": { + "description": "Required. The ID of the tenant in which the resource resides in." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only." + } + }, + "bypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "AzureServices, Logging", + "AzureServices, Logging, Metrics", + "AzureServices, Metrics", + "Logging", + "Logging, Metrics", + "Metrics", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics." + } + }, + "virtualNetworkRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the virtual network rules." + } + }, + "ipRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Sets the IP ACL rules." + } + }, + "defaultAction": { + "type": "string", + "allowedValues": [ + "Allow", + "Deny" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the default action of allow or deny when no other rules match." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network configuration." + } + }, + "secretsExportConfigurationType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The key vault name where to store the keys and connection strings generated by the modules." + } + }, + "accessKey1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey1 secret name to create." + } + }, + "connectionString1Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString1 secret name to create." + } + }, + "accessKey2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The accessKey2 secret name to create." + } + }, + "connectionString2Name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The connectionString2 secret name to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of the exported secrets." + } + }, + "localUserType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a local user." + } + }, + "blobServiceType": { + "type": "object", + "properties": { + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a blob service." + } + }, + "_1.immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/container/main.bicep" + } + } + }, + "_2.secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "_3.lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_3.roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/_1.immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "description": "The type of a storage container.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "description": "The type for a cors rule.", + "__bicep_imported_from!": { + "sourceTemplate": "blob-service/main.bicep" + } + } + }, + "customerManagedKeyWithAutoRotateType": { + "type": "object", + "properties": { + "keyVaultResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from." + } + }, + "keyName": { + "type": "string", + "metadata": { + "description": "Required. The name of the customer managed key to use for encryption." + } + }, + "keyVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting." + } + }, + "autoRotationEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used." + } + }, + "userAssignedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingMetricsOnlyType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of diagnostic setting." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/_3.lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/_3.roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretsOutputType": { + "type": "object", + "properties": {}, + "additionalProperties": { + "$ref": "#/definitions/_2.secretSetOutputType", + "metadata": { + "description": "An exported secret's references." + } + }, + "metadata": { + "description": "A map of the exported secrets", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "local-user/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Required. Name of the Storage Account. Must be lower-case." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all resources." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "kind": { + "type": "string", + "defaultValue": "StorageV2", + "allowedValues": [ + "Storage", + "StorageV2", + "BlobStorage", + "FileStorage", + "BlockBlobStorage" + ], + "metadata": { + "description": "Optional. Type of Storage Account to create." + } + }, + "skuName": { + "type": "string", + "defaultValue": "Standard_GRS", + "allowedValues": [ + "Standard_LRS", + "Standard_ZRS", + "Standard_GRS", + "Standard_GZRS", + "Standard_RAGRS", + "Standard_RAGZRS", + "StandardV2_LRS", + "StandardV2_ZRS", + "StandardV2_GRS", + "StandardV2_GZRS", + "Premium_LRS", + "Premium_ZRS", + "PremiumV2_LRS", + "PremiumV2_ZRS" + ], + "metadata": { + "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "Hot", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "Cold" + ], + "metadata": { + "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type." + } + }, + "largeFileSharesState": { + "type": "string", + "defaultValue": "Disabled", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "metadata": { + "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)." + } + }, + "azureFilesIdentityBasedAuthentication": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication" + }, + "description": "Optional. Provides the identity based authentication settings for Azure Files." + }, + "nullable": true + }, + "defaultToOAuthAuthentication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not." + } + }, + "allowSharedKeyAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." + } + }, + "managementPolicyRules": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. The Storage Account ManagementPolicies Rules." + } + }, + "networkAcls": { + "$ref": "#/definitions/networkAclsType", + "nullable": true, + "metadata": { + "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny." + } + }, + "requireInfrastructureEncryption": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true." + } + }, + "allowCrossTenantReplication": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Allow or disallow cross AAD tenant object replication." + } + }, + "customDomainName": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source." + } + }, + "customDomainUseSubDomainName": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates." + } + }, + "dnsEndpointType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AzureDnsZone", + "Standard" + ], + "metadata": { + "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier." + } + }, + "blobServices": { + "$ref": "#/definitions/blobServiceType", + "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]", + "metadata": { + "description": "Optional. Blob service and containers to deploy." + } + }, + "fileServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. File service and shares to deploy." + } + }, + "queueServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Queue service and queues to create." + } + }, + "tableServices": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Table service and tables to create." + } + }, + "allowBlobPublicAccess": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "TLS1_2", + "allowedValues": [ + "TLS1_2" + ], + "metadata": { + "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore." + } + }, + "enableHierarchicalNamespace": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true." + } + }, + "enableSftp": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "localUsers": { + "type": "array", + "items": { + "$ref": "#/definitions/localUserType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Local users to deploy for SFTP authentication." + } + }, + "isLocalUserEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables local users feature, if set to true." + } + }, + "enableNfsV3": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingMetricsOnlyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags" + }, + "description": "Optional. Tags of the resource." + }, + "nullable": true + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "allowedCopyScope": { + "type": "string", + "nullable": true, + "allowedValues": [ + "AAD", + "PrivateLink" + ], + "metadata": { + "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet." + } + }, + "publicNetworkAccess": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Enabled", + "Disabled" + ], + "metadata": { + "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set." + } + }, + "supportsHttpsTrafficOnly": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Allows HTTPS traffic only to storage service if sets to true." + } + }, + "customerManagedKey": { + "$ref": "#/definitions/customerManagedKeyWithAutoRotateType", + "nullable": true, + "metadata": { + "description": "Optional. The customer managed key definition." + } + }, + "sasExpirationPeriod": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The SAS expiration period. DD.HH:MM:SS." + } + }, + "sasExpirationAction": { + "type": "string", + "defaultValue": "Log", + "allowedValues": [ + "Block", + "Log" + ], + "metadata": { + "description": "Optional. The SAS expiration action. Allowed values are Block and Log." + } + }, + "keyType": { + "type": "string", + "nullable": true, + "allowedValues": [ + "Account", + "Service" + ], + "metadata": { + "description": "Optional. The keyType to use with Queue & Table services." + } + }, + "secretsExportConfiguration": { + "$ref": "#/definitions/secretsExportConfigurationType", + "nullable": true, + "metadata": { + "description": "Optional. Key vault reference and secret settings for the module's secrets export." + } + }, + "immutableStorageWithVersioning": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning" + }, + "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts." + }, + "nullable": true + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]", + "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]", + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]", + "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "cMKKeyVault::cMKKey": { + "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults/keys", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "cMKKeyVault": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]", + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]" + }, + "cMKUserAssignedIdentity": { + "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]", + "existing": true, + "type": "Microsoft.ManagedIdentity/userAssignedIdentities", + "apiVersion": "2024-11-30", + "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]", + "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]" + }, + "storageAccount": { + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "[parameters('kind')]", + "sku": { + "name": "[parameters('skuName')]" + }, + "identity": "[variables('identity')]", + "tags": "[parameters('tags')]", + "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]", + "dependsOn": [ + "cMKKeyVault", + "cMKKeyVault::cMKKey" + ] + }, + "storageAccount_diagnosticSettings": { + "copy": { + "name": "storageAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_roleAssignments": { + "copy": { + "name": "storageAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_privateEndpoints": { + "copy": { + "name": "storageAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_managementPolicies": { + "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "rules": { + "value": "[parameters('managementPolicyRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14529265638306912023" + }, + "name": "Storage Account Management Policies", + "description": "This module deploys a Storage Account Management Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "rules": { + "type": "array", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules" + }, + "description": "Required. The Storage Account ManagementPolicies Rules." + } + } + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/managementPolicies", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]", + "properties": { + "policy": { + "rules": "[parameters('rules')]" + } + } + } + ], + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed management policy." + }, + "value": "default" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed management policy." + }, + "value": "default" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed management policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount", + "storageAccount_blobServices" + ] + }, + "storageAccount_localUsers": { + "copy": { + "name": "storageAccount_localUsers", + "count": "[length(coalesce(parameters('localUsers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]" + }, + "hasSshKey": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]" + }, + "hasSshPassword": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]" + }, + "permissionScopes": { + "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]" + }, + "hasSharedKey": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]" + }, + "homeDirectory": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]" + }, + "sshAuthorizedKeys": { + "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3261275799710495788" + }, + "name": "Storage Account Local Users", + "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication." + }, + "definitions": { + "sshAuthorizedKeyType": { + "type": "object", + "properties": { + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Description used to store the function/usage of the key." + } + }, + "key": { + "type": "securestring", + "metadata": { + "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "permissionScopeType": { + "type": "object", + "properties": { + "permissions": { + "type": "string", + "metadata": { + "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The name of resource, normally the container name or the file share name, used by the local user." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The service used by the local user, e.g. blob, file." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the local user used for SFTP Authentication." + } + }, + "hasSharedKey": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key." + } + }, + "hasSshKey": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key." + } + }, + "hasSshPassword": { + "type": "bool", + "metadata": { + "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password." + } + }, + "homeDirectory": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The local user home directory." + } + }, + "permissionScopes": { + "type": "array", + "items": { + "$ref": "#/definitions/permissionScopeType" + }, + "metadata": { + "description": "Required. The permission scopes of the local user." + } + }, + "sshAuthorizedKeys": { + "type": "array", + "items": { + "$ref": "#/definitions/sshAuthorizedKeyType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The local user SSH authorized keys for SFTP." + } + } + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "localUsers": { + "type": "Microsoft.Storage/storageAccounts/localUsers", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "hasSharedKey": "[parameters('hasSharedKey')]", + "hasSshKey": "[parameters('hasSshKey')]", + "hasSshPassword": "[parameters('hasSshPassword')]", + "homeDirectory": "[parameters('homeDirectory')]", + "permissionScopes": "[parameters('permissionScopes')]", + "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed local user." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed local user." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed local user." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_blobServices": { + "condition": "[not(empty(parameters('blobServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "containers": { + "value": "[tryGet(parameters('blobServices'), 'containers')]" + }, + "automaticSnapshotPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]" + }, + "changeFeedEnabled": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]" + }, + "changeFeedRetentionInDays": { + "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]" + }, + "containerDeleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]" + }, + "containerDeleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]" + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]" + }, + "corsRules": { + "value": "[tryGet(parameters('blobServices'), 'corsRules')]" + }, + "defaultServiceVersion": { + "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]" + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]" + }, + "deleteRetentionPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]" + }, + "deleteRetentionPolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]" + }, + "isVersioningEnabled": { + "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]" + }, + "lastAccessTimeTrackingPolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]" + }, + "restorePolicyEnabled": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]" + }, + "restorePolicyDays": { + "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9925173705553594819" + }, + "name": "Storage Account blob Services", + "description": "This module deploys a Storage Account Blob Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "containerType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "nullable": true + }, + "publicAccess": { + "type": "string", + "allowedValues": [ + "Blob", + "Container", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type of a storage container." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "description": "The type for an immutability policy.", + "__bicep_imported_from!": { + "sourceTemplate": "container/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "automaticSnapshotPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Automatic Snapshot is enabled if set to true." + } + }, + "changeFeedEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service." + } + }, + "changeFeedRetentionInDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 146000, + "metadata": { + "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed." + } + }, + "containerDeleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled." + } + }, + "containerDeleteRetentionPolicyDays": { + "type": "int", + "nullable": true, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted item should be retained." + } + }, + "containerDeleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "defaultServiceVersion": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions." + } + }, + "deleteRetentionPolicyEnabled": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. The blob service properties for blob soft delete." + } + }, + "deleteRetentionPolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "maxValue": 365, + "metadata": { + "description": "Optional. Indicates the number of days that the deleted blob should be retained." + } + }, + "deleteRetentionPolicyAllowPermanentDelete": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share." + } + }, + "isVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts." + } + }, + "lastAccessTimeTrackingPolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled." + } + }, + "restorePolicyEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled." + } + }, + "restorePolicyDays": { + "type": "int", + "defaultValue": 7, + "minValue": 1, + "metadata": { + "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days." + } + }, + "containers": { + "type": "array", + "items": { + "$ref": "#/definitions/containerType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Blob containers to create." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false, + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "blobServices": { + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]", + "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]", + "containerDeleteRetentionPolicy": { + "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]", + "days": "[parameters('containerDeleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]" + }, + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "defaultServiceVersion": "[parameters('defaultServiceVersion')]", + "deleteRetentionPolicy": { + "enabled": "[parameters('deleteRetentionPolicyEnabled')]", + "days": "[parameters('deleteRetentionPolicyDays')]", + "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]" + }, + "isVersioningEnabled": "[parameters('isVersioningEnabled')]", + "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]", + "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]" + }, + "dependsOn": [ + "storageAccount" + ] + }, + "blobServices_diagnosticSettings": { + "copy": { + "name": "blobServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "blobServices" + ] + }, + "blobServices_container": { + "copy": { + "name": "blobServices_container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "blobServiceName": { + "value": "[variables('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "defaultEncryptionScope": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]" + }, + "denyEncryptionScopeOverride": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]" + }, + "enableNfsV3AllSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]" + }, + "enableNfsV3RootSquash": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]" + }, + "immutableStorageWithVersioningEnabled": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]" + }, + "publicAccess": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "immutabilityPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "5026123498979497429" + }, + "name": "Storage Account Blob Containers", + "description": "This module deploys a Storage Account Blob Container." + }, + "definitions": { + "immutabilityPolicyType": { + "type": "object", + "properties": { + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an immutability policy." + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "blobServiceName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the Storage Container to deploy." + } + }, + "defaultEncryptionScope": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Default the container to use specified encryption scope for all writes." + } + }, + "denyEncryptionScopeOverride": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Block override of encryption scope from the container default." + } + }, + "enableNfsV3AllSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 all squash on blob container." + } + }, + "enableNfsV3RootSquash": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enable NFSv3 root squash on blob container." + } + }, + "immutableStorageWithVersioningEnabled": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process." + } + }, + "immutabilityPolicy": { + "$ref": "#/definitions/immutabilityPolicyType", + "nullable": true, + "metadata": { + "description": "Optional. Configure immutability policy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair to associate with the container as metadata." + }, + "defaultValue": {} + }, + "publicAccess": { + "type": "string", + "defaultValue": "None", + "allowedValues": [ + "Container", + "Blob", + "None" + ], + "metadata": { + "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]", + "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::blobServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/blobServices", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "name": "[parameters('storageAccountName')]" + }, + "container": { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "properties": { + "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]", + "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]", + "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]", + "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]", + "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]", + "metadata": "[parameters('metadata')]", + "publicAccess": "[parameters('publicAccess')]" + } + }, + "container_roleAssignments": { + "copy": { + "name": "container_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "container" + ] + }, + "container_immutabilityPolicy": { + "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "containerName": { + "value": "[parameters('name')]" + }, + "immutabilityPeriodSinceCreationInDays": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]" + }, + "allowProtectedAppendWrites": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]" + }, + "allowProtectedAppendWritesAll": { + "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10782942397325758470" + }, + "name": "Storage Account Blob Container Immutability Policies", + "description": "This module deploys a Storage Account Blob Container Immutability Policy." + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "containerName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment." + } + }, + "immutabilityPeriodSinceCreationInDays": { + "type": "int", + "defaultValue": 365, + "metadata": { + "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days." + } + }, + "allowProtectedAppendWrites": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + }, + "allowProtectedAppendWritesAll": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive." + } + } + }, + "variables": { + "name": "default" + }, + "resources": [ + { + "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies", + "apiVersion": "2025-01-01", + "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]", + "properties": { + "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]", + "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]", + "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]" + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed immutability policy." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed immutability policy." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed immutability policy." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "container" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed container." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed container." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "blobServices" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed blob service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the deployed blob service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_fileServices": { + "condition": "[not(empty(parameters('fileServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]" + }, + "protocolSettings": { + "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]" + }, + "shareDeleteRetentionPolicy": { + "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]" + }, + "shares": { + "value": "[tryGet(parameters('fileServices'), 'shares')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "2735186993322606805" + }, + "name": "Storage Account File Share Services", + "description": "This module deploys a Storage Account File Share Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the file service." + } + }, + "protocolSettings": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings" + }, + "description": "Optional. Protocol settings for file service." + }, + "defaultValue": {} + }, + "shareDeleteRetentionPolicy": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy" + }, + "description": "Optional. The service properties for soft delete." + }, + "defaultValue": { + "enabled": true, + "days": 7 + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + }, + "shares": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. File shares to create." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileServices": { + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]", + "protocolSettings": "[parameters('protocolSettings')]", + "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]" + } + }, + "fileServices_diagnosticSettings": { + "copy": { + "name": "fileServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "fileServices" + ] + }, + "fileServices_shares": { + "copy": { + "name": "fileServices_shares", + "count": "[length(coalesce(parameters('shares'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "fileServicesName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]" + }, + "accessTier": { + "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]" + }, + "enabledProtocols": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]" + }, + "rootSquash": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]" + }, + "shareQuota": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15881640847294537074" + }, + "name": "Storage Account File Shares", + "description": "This module deploys a Storage Account File Share." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "fileServicesName": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the file share to create." + } + }, + "accessTier": { + "type": "string", + "defaultValue": "TransactionOptimized", + "allowedValues": [ + "Premium", + "Hot", + "Cool", + "TransactionOptimized" + ], + "metadata": { + "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool." + } + }, + "shareQuota": { + "type": "int", + "defaultValue": 5120, + "metadata": { + "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)." + } + }, + "enabledProtocols": { + "type": "string", + "defaultValue": "SMB", + "allowedValues": [ + "NFS", + "SMB" + ], + "metadata": { + "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share." + } + }, + "rootSquash": { + "type": "string", + "defaultValue": "NoRootSquash", + "allowedValues": [ + "AllSquash", + "NoRootSquash", + "RootSquash" + ], + "metadata": { + "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]", + "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]", + "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::fileService": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/fileServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]" + }, + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "fileShare": { + "type": "Microsoft.Storage/storageAccounts/fileServices/shares", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]", + "properties": { + "accessTier": "[parameters('accessTier')]", + "shareQuota": "[parameters('shareQuota')]", + "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]", + "enabledProtocols": "[parameters('enabledProtocols')]" + } + }, + "fileShare_roleAssignments": { + "copy": { + "name": "fileShare_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "scope": { + "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]" + }, + "name": { + "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]" + }, + "roleDefinitionId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "principalType": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]" + }, + "condition": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]" + }, + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]", + "delegatedManagedIdentityResourceId": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "description": { + "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "scope": { + "type": "string", + "metadata": { + "description": "Required. The scope to deploy the role assignment to." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The role definition Id to assign." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User", + "" + ], + "defaultValue": "", + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"" + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "defaultValue": "2.0", + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[parameters('scope')]", + "name": "[parameters('name')]", + "properties": { + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "principalId": "[parameters('principalId')]", + "description": "[parameters('description')]", + "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]", + "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]", + "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]", + "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]" + } + } + ] + } + }, + "dependsOn": [ + "fileShare" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "fileServices", + "storageAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_queueServices": { + "condition": "[not(empty(parameters('queueServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]" + }, + "queues": { + "value": "[tryGet(parameters('queueServices'), 'queues')]" + }, + "corsRules": { + "value": "[tryGet(parameters('queueServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1100093319443502715" + }, + "name": "Storage Account Queue Services", + "description": "This module deploys a Storage Account Queue Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "queues": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Queues to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queueServices": { + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "queueServices_diagnosticSettings": { + "copy": { + "name": "queueServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "queueServices" + ] + }, + "queueServices_queues": { + "copy": { + "name": "queueServices_queues", + "count": "[length(coalesce(parameters('queues'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "name": { + "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]" + }, + "metadata": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17963799770990303971" + }, + "name": "Storage Account Queues", + "description": "This module deploys a Storage Account Queue." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage queue to deploy." + } + }, + "metadata": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata" + }, + "description": "Optional. A name-value pair that represents queue metadata." + }, + "defaultValue": {} + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]", + "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]", + "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]", + "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::queueServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/queueServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "queue": { + "type": "Microsoft.Storage/storageAccounts/queueServices/queues", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "properties": { + "metadata": "[parameters('metadata')]" + } + }, + "queue_roleAssignments": { + "copy": { + "name": "queue_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "queue" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed queue." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed queue." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed queue." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "storageAccount_tableServices": { + "condition": "[not(empty(parameters('tableServices')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('name')]" + }, + "diagnosticSettings": { + "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]" + }, + "tables": { + "value": "[tryGet(parameters('tableServices'), 'tables')]" + }, + "corsRules": { + "value": "[tryGet(parameters('tableServices'), 'corsRules')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "13069389074590786512" + }, + "name": "Storage Account Table Services", + "description": "This module deploys a Storage Account Table Service." + }, + "definitions": { + "corsRuleType": { + "type": "object", + "properties": { + "allowedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of headers allowed to be part of the cross-origin request." + } + }, + "allowedMethods": { + "type": "array", + "allowedValues": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "MERGE", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "metadata": { + "description": "Required. A list of HTTP methods that are allowed to be executed by the origin." + } + }, + "allowedOrigins": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains." + } + }, + "exposedHeaders": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of response headers to expose to CORS clients." + } + }, + "maxAgeInSeconds": { + "type": "int", + "metadata": { + "description": "Required. The number of seconds that the client/browser should cache a preflight response." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for a cors rule." + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "tables": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. tables to create." + } + }, + "corsRules": { + "type": "array", + "items": { + "$ref": "#/definitions/corsRuleType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings of the service." + } + } + }, + "variables": { + "name": "default" + }, + "resources": { + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "tableServices": { + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]", + "properties": { + "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]" + } + }, + "tableServices_diagnosticSettings": { + "copy": { + "name": "tableServices_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "tableServices" + ] + }, + "tableServices_tables": { + "copy": { + "name": "tableServices_tables", + "count": "[length(parameters('tables'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('tables')[copyIndex()].name]" + }, + "storageAccountName": { + "value": "[parameters('storageAccountName')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10905926757212375091" + }, + "name": "Storage Account Table", + "description": "This module deploys a Storage Account Table." + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "maxLength": 24, + "metadata": { + "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]", + "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]", + "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]", + "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]", + "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "storageAccount::tableServices": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts/tableServices", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]" + }, + "storageAccount": { + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2024-01-01", + "name": "[parameters('storageAccountName')]" + }, + "table": { + "type": "Microsoft.Storage/storageAccounts/tableServices/tables", + "apiVersion": "2024-01-01", + "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "table_roleAssignments": { + "copy": { + "name": "table_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "table" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed file share service." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed file share service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed file share service." + }, + "value": "[resourceGroup().name]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed table service." + }, + "value": "[variables('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed table service." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed table service." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + }, + "secretsExport": { + "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]", + "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]", + "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "keyVaultName": { + "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]" + }, + "secretsToSet": { + "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9368972709899985618" + } + }, + "definitions": { + "secretSetOutputType": { + "type": "object", + "properties": { + "secretResourceId": { + "type": "string", + "metadata": { + "description": "The resourceId of the exported secret." + } + }, + "secretUri": { + "type": "string", + "metadata": { + "description": "The secret URI of the exported secret." + } + }, + "secretUriWithVersion": { + "type": "string", + "metadata": { + "description": "The secret URI with version of the exported secret." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + }, + "secretToSetType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the secret to set." + } + }, + "value": { + "type": "securestring", + "metadata": { + "description": "Required. The value of the secret to set." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for the secret to set via the secrets export feature.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Key Vault to set the ecrets in." + } + }, + "secretsToSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretToSetType" + }, + "metadata": { + "description": "Required. The secrets to set in the Key Vault." + } + } + }, + "resources": { + "keyVault": { + "existing": true, + "type": "Microsoft.KeyVault/vaults", + "apiVersion": "2024-11-01", + "name": "[parameters('keyVaultName')]" + }, + "secrets": { + "copy": { + "name": "secrets", + "count": "[length(parameters('secretsToSet'))]" + }, + "type": "Microsoft.KeyVault/vaults/secrets", + "apiVersion": "2024-11-01", + "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]", + "properties": { + "value": "[parameters('secretsToSet')[copyIndex()].value]" + } + } + }, + "outputs": { + "secretsSet": { + "type": "array", + "items": { + "$ref": "#/definitions/secretSetOutputType" + }, + "metadata": { + "description": "The references to the secrets exported to the provided Key Vault." + }, + "copy": { + "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]", + "input": { + "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]", + "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]", + "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]" + } + } + } + } + } + }, + "dependsOn": [ + "storageAccount" + ] + } + }, + "outputs": { + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the deployed storage account." + }, + "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the deployed storage account." + }, + "value": "[parameters('name')]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group of the deployed storage account." + }, + "value": "[resourceGroup().name]" + }, + "primaryBlobEndpoint": { + "type": "string", + "metadata": { + "description": "The primary blob endpoint reference if blob services are deployed." + }, + "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('storageAccount', '2024-01-01', 'full').location]" + }, + "serviceEndpoints": { + "type": "object", + "metadata": { + "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint." + }, + "value": "[reference('storageAccount').primaryEndpoints]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the Storage Account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "exportedSecrets": { + "$ref": "#/definitions/secretsOutputType", + "metadata": { + "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name." + }, + "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]" + }, + "primaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The primary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]" + }, + "secondaryAccessKey": { + "type": "securestring", + "metadata": { + "description": "The secondary access key of the storage account." + }, + "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]" + }, + "primaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]" + }, + "secondaryConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary connection string of the storage account." + }, + "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Storage/storageAccounts', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the Storage Account." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + } + } + } + }, + "dependsOn": [ + "aiSearch", + "foundryAccount" + ] + }, + "cosmosDb": { + "condition": "[parameters('includeAssociatedResources')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.cosmosDb.{0}', variables('resourcesName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "existingResourceId": { + "value": "[tryGet(parameters('cosmosDbConfiguration'), 'existingResourceId')]" + }, + "name": { + "value": "[take(if(not(empty(tryGet(parameters('cosmosDbConfiguration'), 'name'))), parameters('cosmosDbConfiguration').name, format('cos{0}', variables('resourcesName'))), 44)]" + }, + "location": { + "value": "[parameters('location')]" + }, + "tags": { + "value": "[parameters('tags')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "privateEndpointSubnetResourceId": { + "value": "[parameters('privateEndpointSubnetResourceId')]" + }, + "privateDnsZoneResourceId": { + "value": "[tryGet(parameters('cosmosDbConfiguration'), 'privateDnsZoneResourceId')]" + }, + "roleAssignments": { + "value": "[tryGet(parameters('cosmosDbConfiguration'), 'roleAssignments')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "12826689517691444097" + } + }, + "definitions": { + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "functions": [ + { + "namespace": "__bicep", + "members": { + "getResourceGroupName": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]" + }, + "metadata": { + "description": "Extracts the Resource Group Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceName": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + }, + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]" + }, + "metadata": { + "description": "Extracts the Resource Name from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getResourceParts": { + "parameters": [ + { + "type": "string", + "nullable": true, + "name": "resourceId" + } + ], + "output": { + "type": "array", + "items": { + "type": "string" + }, + "value": "[split(coalesce(parameters('resourceId'), ''), '/')]" + }, + "metadata": { + "description": "Splits Resource ID into its components.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + }, + "getSubscriptionId": { + "parameters": [ + { + "type": "array", + "items": { + "type": "string" + }, + "name": "parts" + } + ], + "output": { + "type": "string", + "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]" + }, + "metadata": { + "description": "Extracts the Subscription ID from a Resource ID.", + "__bicep_imported_from!": { + "sourceTemplate": "parseResourceIdFunctions.bicep" + } + } + } + } + } + ], + "parameters": { + "name": { + "type": "string", + "maxLength": 44, + "metadata": { + "description": "Required. The name of the Cosmos DB." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. The location for the Cosmos DB." + } + }, + "existingResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full resource ID of an existing Cosmos DB to use instead of creating a new one." + } + }, + "privateEndpointSubnetResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the private DNS zone for the Cosmos DB to establish private endpoints." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Specifies the role assignments for the Cosmos DB." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Specifies the resource tags for all the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]", + "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]", + "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]", + "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]", + "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]" + }, + "resources": { + "existingCosmosDb": { + "condition": "[not(empty(parameters('existingResourceId')))]", + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2025-04-15", + "subscriptionId": "[variables('existingSubscriptionId')]", + "resourceGroup": "[variables('existingResourceGroupName')]", + "name": "[variables('existingName')]" + }, + "cosmosDb": { + "condition": "[empty(parameters('existingResourceId'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('avm.res.document-db.database-account.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('name')]" + }, + "enableTelemetry": { + "value": "[parameters('enableTelemetry')]" + }, + "automaticFailover": { + "value": true + }, + "disableKeyBasedMetadataWriteAccess": { + "value": true + }, + "disableLocalAuthentication": { + "value": true + }, + "location": { + "value": "[parameters('location')]" + }, + "minimumTlsVersion": { + "value": "Tls12" + }, + "defaultConsistencyLevel": { + "value": "Session" + }, + "networkRestrictions": { + "value": { + "networkAclBypass": "AzureServices", + "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), 'Disabled', 'Enabled')]" + } + }, + "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'Sql', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]", + "roleAssignments": { + "value": "[parameters('roleAssignments')]" + }, + "tags": { + "value": "[parameters('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "17715929342484596741" + }, + "name": "Azure Cosmos DB account", + "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed." + }, + "definitions": { + "privateEndpointOutputType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + } + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + } + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group ID for the private endpoint group." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "A list of private IP addresses for the private endpoint." + } + } + } + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + } + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The IDs of the network interfaces associated with the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the private endpoint output." + } + }, + "failoverLocationType": { + "type": "object", + "properties": { + "failoverPriority": { + "type": "int", + "metadata": { + "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists." + } + }, + "isZoneRedundant": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true." + } + }, + "locationName": { + "type": "string", + "metadata": { + "description": "Required. The name of the region." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the failover location." + } + }, + "dataPlaneRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique name of the role assignment." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment." + } + }, + "dataPlaneRoleDefinitionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the role-based access control definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope." + } + }, + "assignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of role-based access control assignments to be created for the definition." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition." + } + }, + "sqlDatabaseType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the database ." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "analyticalStorageTtl": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "properties": { + "conflictResolutionPath": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'." + } + }, + "conflictResolutionProcedure": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'." + } + }, + "mode": { + "type": "string", + "allowedValues": [ + "Custom", + "LastWriterWins" + ], + "metadata": { + "description": "Required. Indicates the conflict resolution mode." + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "nullable": true, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "indexingPolicy": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "allowedValues": [ + 1, + 2 + ], + "nullable": true, + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "items": { + "type": "object", + "properties": { + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. Set of containers to deploy in the database." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for an Azure Cosmos DB for NoSQL database." + } + }, + "networkRestrictionType": { + "type": "object", + "properties": { + "ipRules": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`." + } + }, + "networkAclBypass": { + "type": "string", + "allowedValues": [ + "AzureServices", + "None" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"." + } + }, + "publicNetworkAccess": { + "type": "string", + "allowedValues": [ + "Disabled", + "Enabled" + ], + "nullable": true, + "metadata": { + "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"." + } + }, + "virtualNetworkRules": { + "type": "array", + "items": { + "type": "object", + "properties": { + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of a subnet." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. List of virtual network access control list (ACL) rules configured for the account." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the network restriction." + } + }, + "_1.privateEndpointCustomDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointIpConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "_1.privateEndpointPrivateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS Zone Group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + } + }, + "metadata": { + "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "diagnosticSettingFullType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the diagnostic setting." + } + }, + "logCategoriesAndGroups": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here." + } + }, + "categoryGroup": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection." + } + }, + "metricCategories": { + "type": "array", + "items": { + "type": "object", + "properties": { + "category": { + "type": "string", + "metadata": { + "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics." + } + }, + "enabled": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable or disable the category explicitly. Default is `true`." + } + } + } + }, + "nullable": true, + "metadata": { + "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection." + } + }, + "logAnalyticsDestinationType": { + "type": "string", + "allowedValues": [ + "AzureDiagnostics", + "Dedicated" + ], + "nullable": true, + "metadata": { + "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type." + } + }, + "workspaceResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "storageAccountResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "eventHubAuthorizationRuleResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to." + } + }, + "eventHubName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub." + } + }, + "marketplacePartnerResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "managedIdentityAllType": { + "type": "object", + "properties": { + "systemAssigned": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enables system assigned managed identity on the resource." + } + }, + "userAssignedResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "privateEndpointMultiServiceType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private endpoint." + } + }, + "location": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The location to deploy the private endpoint to." + } + }, + "privateLinkServiceConnectionName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private link connection to create." + } + }, + "service": { + "type": "string", + "metadata": { + "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "resourceGroupResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "isManualConnection": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. If Manual Private Link Connection is required." + } + }, + "manualConnectionRequestMessage": { + "type": "string", + "nullable": true, + "maxLength": 140, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with the manual connection request." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/_1.privateEndpointIpConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags" + }, + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "enableTelemetry": { + "type": "bool", + "nullable": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1" + } + } + }, + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "description": "The type for the SQL Role Assignments.", + "__bicep_imported_from!": { + "sourceTemplate": "sql-role-definition/main.bicep" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the account." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Defaults to the current resource group scope location. Location for all resources." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags" + }, + "description": "Optional. Tags for the resource." + }, + "nullable": true + }, + "managedIdentities": { + "$ref": "#/definitions/managedIdentityAllType", + "nullable": true, + "metadata": { + "description": "Optional. The managed identity definition for this resource." + } + }, + "databaseAccountOfferType": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Standard" + ], + "metadata": { + "description": "Optional. The offer type for the account. Defaults to \"Standard\"." + } + }, + "failoverLocations": { + "type": "array", + "items": { + "$ref": "#/definitions/failoverLocationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed." + } + }, + "zoneRedundant": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts." + } + }, + "defaultConsistencyLevel": { + "type": "string", + "defaultValue": "Session", + "allowedValues": [ + "Eventual", + "ConsistentPrefix", + "Session", + "BoundedStaleness", + "Strong" + ], + "metadata": { + "description": "Optional. The default consistency level of the account. Defaults to \"Session\"." + } + }, + "disableLocalAuthentication": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true." + } + }, + "enableAnalyticalStorage": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false." + } + }, + "automaticFailover": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable automatic failover for regions. Defaults to true." + } + }, + "enableFreeTier": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false." + } + }, + "enableMultipleWriteLocations": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false." + } + }, + "disableKeyBasedMetadataWriteAccess": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true." + } + }, + "maxStalenessPrefix": { + "type": "int", + "defaultValue": 100000, + "minValue": 1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000." + } + }, + "maxIntervalInSeconds": { + "type": "int", + "defaultValue": 300, + "minValue": 5, + "maxValue": 86400, + "metadata": { + "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300." + } + }, + "serverVersion": { + "type": "string", + "defaultValue": "4.2", + "allowedValues": [ + "3.2", + "3.6", + "4.0", + "4.2", + "5.0", + "6.0", + "7.0" + ], + "metadata": { + "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"." + } + }, + "sqlDatabases": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlDatabaseType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL." + } + }, + "mongodbDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU." + } + }, + "gremlinDatabases": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin." + } + }, + "tables": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + }, + "totalThroughputLimit": { + "type": "int", + "defaultValue": -1, + "metadata": { + "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of control plane Azure role-based access control assignments." + } + }, + "dataPlaneRoleDefinitions": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleDefinitionType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions." + } + }, + "dataPlaneRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/dataPlaneRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments." + } + }, + "diagnosticSettings": { + "type": "array", + "items": { + "$ref": "#/definitions/diagnosticSettingFullType" + }, + "nullable": true, + "metadata": { + "description": "Optional. The diagnostic settings for the service." + } + }, + "capabilitiesToAdd": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "allowedValues": [ + "EnableCassandra", + "EnableTable", + "EnableGremlin", + "EnableMongo", + "DisableRateLimitingResponses", + "EnableServerless", + "EnableNoSQLVectorSearch", + "EnableNoSQLFullTextSearch", + "EnableMaterializedViews", + "DeleteAllItemsByPartitionKey" + ], + "metadata": { + "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account." + } + }, + "backupPolicyType": { + "type": "string", + "defaultValue": "Continuous", + "allowedValues": [ + "Periodic", + "Continuous" + ], + "metadata": { + "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"." + } + }, + "backupPolicyContinuousTier": { + "type": "string", + "defaultValue": "Continuous30Days", + "allowedValues": [ + "Continuous30Days", + "Continuous7Days" + ], + "metadata": { + "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"." + } + }, + "backupIntervalInMinutes": { + "type": "int", + "defaultValue": 240, + "minValue": 60, + "maxValue": 1440, + "metadata": { + "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240." + } + }, + "backupRetentionIntervalInHours": { + "type": "int", + "defaultValue": 8, + "minValue": 2, + "maxValue": 720, + "metadata": { + "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8." + } + }, + "backupStorageRedundancy": { + "type": "string", + "defaultValue": "Local", + "allowedValues": [ + "Geo", + "Local", + "Zone" + ], + "metadata": { + "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"." + } + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointMultiServiceType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible." + } + }, + "networkRestrictions": { + "$ref": "#/definitions/networkRestrictionType", + "defaultValue": { + "ipRules": [], + "virtualNetworkRules": [], + "publicNetworkAccess": "Disabled" + }, + "metadata": { + "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`." + } + }, + "minimumTlsVersion": { + "type": "string", + "defaultValue": "Tls12", + "allowedValues": [ + "Tls12" + ], + "metadata": { + "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "enableReferencedModulesTelemetry": false, + "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]", + "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", + "builtInControlPlaneRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]", + "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]", + "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]", + "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]", + "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-07-01", + "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "identity": "[variables('identity')]", + "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]", + "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]" + }, + "databaseAccount_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_diagnosticSettings": { + "copy": { + "name": "databaseAccount_diagnosticSettings", + "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]" + }, + "type": "Microsoft.Insights/diagnosticSettings", + "apiVersion": "2021-05-01-preview", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]", + "properties": { + "copy": [ + { + "name": "metrics", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]", + "input": { + "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]", + "timeGrain": null + } + }, + { + "name": "logs", + "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]", + "input": { + "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]", + "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]", + "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]" + } + } + ], + "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]", + "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]", + "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]", + "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]", + "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]", + "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_roleAssignments": { + "copy": { + "name": "databaseAccount_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlDatabases": { + "copy": { + "name": "databaseAccount_sqlDatabases", + "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]" + }, + "containers": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]" + }, + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "7141543733238879531" + }, + "name": "DocumentDB Database Account SQL Databases", + "description": "This module deploys a SQL Database in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the SQL database ." + } + }, + "containers": { + "type": "array", + "items": { + "type": "object" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of containers to deploy in the SQL database." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL database resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "container": { + "copy": { + "name": "container", + "count": "[length(coalesce(parameters('containers'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "sqlDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]" + }, + "analyticalStorageTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]" + }, + "autoscaleSettingsMaxThroughput": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]" + }, + "conflictResolutionPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]" + }, + "defaultTtl": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]" + }, + "indexingPolicy": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]" + }, + "kind": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]" + }, + "version": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]" + }, + "paths": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]" + }, + "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]", + "uniqueKeyPolicyKeys": { + "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "1789954443166349986" + }, + "name": "DocumentDB Database Account SQL Database Containers", + "description": "This module deploys a SQL Database Container in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "sqlDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the container." + } + }, + "analyticalStorageTtl": { + "type": "int", + "defaultValue": 0, + "metadata": { + "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store." + } + }, + "conflictResolutionPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions." + } + }, + "defaultTtl": { + "type": "int", + "defaultValue": -1, + "minValue": -1, + "maxValue": 2147483647, + "metadata": { + "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "autoscaleSettingsMaxThroughput": { + "type": "int", + "nullable": true, + "maxValue": 1000000, + "metadata": { + "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the SQL Database resource." + } + }, + "paths": { + "type": "array", + "items": { + "type": "string" + }, + "minLength": 1, + "maxLength": 3, + "metadata": { + "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the container." + } + }, + "uniqueKeyPolicyKeys": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service." + } + }, + "kind": { + "type": "string", + "defaultValue": "Hash", + "allowedValues": [ + "Hash", + "MultiHash" + ], + "metadata": { + "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning." + } + }, + "version": { + "type": "int", + "defaultValue": 1, + "allowedValues": [ + 1, + 2 + ], + "metadata": { + "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition." + } + } + }, + "variables": { + "copy": [ + { + "name": "partitionKeyPaths", + "count": "[length(parameters('paths'))]", + "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]" + } + ], + "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]" + }, + "resources": { + "databaseAccount::sqlDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "container": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": "[variables('containerResourceParams')]", + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]" + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the container." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the container." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the container was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleDefinitions": { + "copy": { + "name": "databaseAccount_sqlRoleDefinitions", + "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]" + }, + "dataActions": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]" + }, + "roleName": { + "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]" + }, + "assignableScopes": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]" + }, + "sqlRoleAssignments": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9570871897890815068" + }, + "name": "DocumentDB Database Account SQL Role Definitions.", + "description": "This module deploys a SQL Role Definision in a CosmosDB Account." + }, + "definitions": { + "sqlRoleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "The type for the SQL Role Assignments." + } + } + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The unique identifier of the Role Definition." + } + }, + "roleName": { + "type": "string", + "metadata": { + "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account." + } + }, + "dataActions": { + "type": "array", + "items": { + "type": "string" + }, + "defaultValue": [], + "metadata": { + "description": "Optional. An array of data actions that are allowed." + } + }, + "assignableScopes": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account." + } + }, + "sqlRoleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/sqlRoleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "enableReferencedModulesTelemetry": false + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleDefinition": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]", + "properties": { + "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]", + "permissions": [ + { + "dataActions": "[parameters('dataActions')]" + } + ], + "roleName": "[parameters('roleName')]", + "type": "CustomRole" + } + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "roleDefinitionId": { + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "principalId": { + "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "sqlRoleDefinition" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Definition." + }, + "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Definition." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + }, + "roleName": { + "type": "string", + "metadata": { + "description": "The role name of the SQL Role Definition." + }, + "value": "[reference('sqlRoleDefinition').roleName]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_sqlRoleAssignments": { + "copy": { + "name": "databaseAccount_sqlRoleAssignments", + "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "roleDefinitionId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]" + }, + "principalId": { + "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]" + }, + "name": { + "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "10102303164433641479" + }, + "name": "DocumentDB Database Account SQL Role Assignments.", + "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Name unique identifier of the SQL Role Assignment." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription." + } + }, + "roleDefinitionId": { + "type": "string", + "metadata": { + "description": "Required. The unique identifier of the associated SQL Role Definition." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "sqlRoleAssignment": { + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]", + "properties": { + "principalId": "[parameters('principalId')]", + "roleDefinitionId": "[parameters('roleDefinitionId')]", + "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the SQL Role Assignment." + }, + "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the SQL Role Assignment." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the SQL Role Definition was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_mongodbDatabases": { + "copy": { + "name": "databaseAccount_mongodbDatabases", + "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "collections": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "9160691107424630312" + }, + "name": "DocumentDB Database Account MongoDB Databases", + "description": "This module deploys a MongoDB Database within a CosmosDB Account." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the mongodb database." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "collections": { + "type": "array", + "nullable": true, + "metadata": { + "description": "Optional. Collections in the mongodb database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the resource." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "mongodbDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]" + }, + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]" + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "mongodbDatabase_collections": { + "copy": { + "name": "mongodbDatabase_collections", + "count": "[length(coalesce(parameters('collections'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "mongodbDatabaseName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]" + }, + "indexes": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]" + }, + "shardKey": { + "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "14050805189442830205" + }, + "name": "DocumentDB Database Account MongoDB Database Collections", + "description": "This module deploys a MongoDB Database Collection." + }, + "parameters": { + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + } + }, + "mongodbDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment." + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the collection." + } + }, + "throughput": { + "type": "int", + "defaultValue": 400, + "metadata": { + "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level." + } + }, + "indexes": { + "type": "array", + "metadata": { + "description": "Required. Indexes for the collection." + } + }, + "shardKey": { + "type": "object", + "metadata": { + "description": "Required. ShardKey for the collection." + } + } + }, + "resources": [ + { + "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]", + "properties": { + "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]", + "indexes": "[parameters('indexes')]", + "shardKey": "[parameters('shardKey')]" + } + } + } + ], + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database collection." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database collection." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database collection was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "mongodbDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the mongodb database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the mongodb database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the mongodb database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_gremlinDatabases": { + "copy": { + "name": "databaseAccount_gremlinDatabases", + "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "graphs": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "16834580070429190924" + }, + "name": "DocumentDB Database Account Gremlin Databases", + "description": "This module deploys a Gremlin Database within a CosmosDB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the Gremlin database." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin database resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment." + } + }, + "graphs": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. Array of graphs to deploy in the Gremlin database." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinDatabase": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "gremlinDatabase_gremlinGraphs": { + "copy": { + "name": "gremlinDatabase_gremlinGraphs", + "count": "[length(parameters('graphs'))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[parameters('graphs')[copyIndex()].name]" + }, + "gremlinDatabaseName": { + "value": "[parameters('name')]" + }, + "databaseAccountName": { + "value": "[parameters('databaseAccountName')]" + }, + "indexingPolicy": { + "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]" + }, + "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "15062578211366932944" + }, + "name": "DocumentDB Database Accounts Gremlin Databases Graphs", + "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the graph." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags of the Gremlin graph resource." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment." + } + }, + "gremlinDatabaseName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment." + } + }, + "indexingPolicy": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Optional. Indexing policy of the graph." + } + }, + "partitionKeyPaths": { + "type": "array", + "defaultValue": [], + "metadata": { + "description": "Optional. List of paths using which data within the container can be partitioned." + } + } + }, + "resources": { + "databaseAccount::gremlinDatabase": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]" + }, + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "gremlinGraph": { + "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "resource": { + "id": "[parameters('name')]", + "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]", + "partitionKey": { + "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]" + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the graph." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the graph." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the graph was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "gremlinDatabase" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the Gremlin database." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the Gremlin database." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the Gremlin database was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_tables": { + "copy": { + "name": "databaseAccount_tables", + "count": "[length(coalesce(parameters('tables'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "databaseAccountName": { + "value": "[parameters('name')]" + }, + "name": { + "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "maxThroughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]" + }, + "throughput": { + "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.37.4.10188", + "templateHash": "3429971823201332257" + }, + "name": "Azure Cosmos DB account tables", + "description": "This module deploys a table within an Azure Cosmos DB Account." + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the table." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags for the table." + } + }, + "databaseAccountName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment." + } + }, + "maxThroughput": { + "type": "int", + "defaultValue": 4000, + "metadata": { + "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored." + } + }, + "throughput": { + "type": "int", + "nullable": true, + "metadata": { + "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`." + } + } + }, + "resources": { + "databaseAccount": { + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2024-11-15", + "name": "[parameters('databaseAccountName')]" + }, + "table": { + "type": "Microsoft.DocumentDB/databaseAccounts/tables", + "apiVersion": "2024-11-15", + "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]", + "tags": "[parameters('tags')]", + "properties": { + "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]", + "resource": { + "id": "[parameters('name')]" + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the table." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the table." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the table was created in." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + }, + "databaseAccount_privateEndpoints": { + "copy": { + "name": "databaseAccount_privateEndpoints", + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]" + }, + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]", + "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]", + "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]" + }, + "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]", + "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]", + "subnetResourceId": { + "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]" + }, + "enableTelemetry": { + "value": "[variables('enableReferencedModulesTelemetry')]" + }, + "location": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]" + }, + "lock": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]" + }, + "privateDnsZoneGroup": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]" + }, + "roleAssignments": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]" + }, + "tags": { + "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]" + }, + "customDnsConfigs": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]" + }, + "ipConfigurations": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]" + }, + "applicationSecurityGroupResourceIds": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]" + }, + "customNetworkInterfaceName": { + "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "12389807800450456797" + }, + "name": "Private Endpoints", + "description": "This module deploys a Private Endpoint." + }, + "definitions": { + "privateDnsZoneGroupType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the Private DNS Zone Group." + } + }, + "privateDnsZoneGroupConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "metadata": { + "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "ipConfigurationType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the resource that is unique within a resource group." + } + }, + "properties": { + "type": "object", + "properties": { + "groupId": { + "type": "string", + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "memberName": { + "type": "string", + "metadata": { + "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string." + } + }, + "privateIPAddress": { + "type": "string", + "metadata": { + "description": "Required. A private IP address obtained from the private endpoint's subnet." + } + } + }, + "metadata": { + "description": "Required. Properties of private endpoint IP configurations." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "privateLinkServiceConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "metadata": { + "description": "Required. The name of the private link service connection." + } + }, + "properties": { + "type": "object", + "properties": { + "groupIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`." + } + }, + "privateLinkServiceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of private link service." + } + }, + "requestMessage": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars." + } + } + }, + "metadata": { + "description": "Required. Properties of private link service connection." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "customDnsConfigType": { + "type": "object", + "properties": { + "fqdn": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. FQDN that resolves to private endpoint IP address." + } + }, + "ipAddresses": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "Required. A list of private IP addresses of the private endpoint." + } + } + }, + "metadata": { + "__bicep_export!": true + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + }, + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_imported_from!": { + "sourceTemplate": "private-dns-zone-group/main.bicep" + } + } + }, + "roleAssignmentType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated." + } + }, + "roleDefinitionIdOrName": { + "type": "string", + "metadata": { + "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'." + } + }, + "principalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to." + } + }, + "principalType": { + "type": "string", + "allowedValues": [ + "Device", + "ForeignGroup", + "Group", + "ServicePrincipal", + "User" + ], + "nullable": true, + "metadata": { + "description": "Optional. The principal type of the assigned principal ID." + } + }, + "description": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the role assignment." + } + }, + "condition": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"." + } + }, + "conditionVersion": { + "type": "string", + "allowedValues": [ + "2.0" + ], + "nullable": true, + "metadata": { + "description": "Optional. Version of the condition." + } + }, + "delegatedManagedIdentityResourceId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The Resource Id of the delegated managed identity resource." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a role assignment.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the private endpoint resource to create." + } + }, + "subnetResourceId": { + "type": "string", + "metadata": { + "description": "Required. Resource ID of the subnet where the endpoint needs to be created." + } + }, + "applicationSecurityGroupResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "nullable": true, + "metadata": { + "description": "Optional. Application security groups in which the private endpoint IP configuration is included." + } + }, + "customNetworkInterfaceName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The custom name of the network interface attached to the private endpoint." + } + }, + "ipConfigurations": { + "type": "array", + "items": { + "$ref": "#/definitions/ipConfigurationType" + }, + "nullable": true, + "metadata": { + "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints." + } + }, + "privateDnsZoneGroup": { + "$ref": "#/definitions/privateDnsZoneGroupType", + "nullable": true, + "metadata": { + "description": "Optional. The private DNS zone group to configure for the private endpoint." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Location for all Resources." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "roleAssignments": { + "type": "array", + "items": { + "$ref": "#/definitions/roleAssignmentType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Array of role assignments to create." + } + }, + "tags": { + "type": "object", + "nullable": true, + "metadata": { + "description": "Optional. Tags to be applied on all resources/resource groups in this deployment." + } + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "nullable": true, + "metadata": { + "description": "Optional. Custom DNS configurations." + } + }, + "manualPrivateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty." + } + }, + "privateLinkServiceConnections": { + "type": "array", + "items": { + "$ref": "#/definitions/privateLinkServiceConnectionType" + }, + "nullable": true, + "metadata": { + "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty." + } + }, + "enableTelemetry": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Optional. Enable/Disable usage telemetry for module." + } + } + }, + "variables": { + "copy": [ + { + "name": "formattedRoleAssignments", + "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]", + "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]" + } + ], + "builtInRoleNames": { + "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", + "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]", + "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]", + "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]", + "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]", + "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]", + "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]", + "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]", + "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]", + "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]" + } + }, + "resources": { + "avmTelemetry": { + "condition": "[parameters('enableTelemetry')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2024-03-01", + "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [], + "outputs": { + "telemetry": { + "type": "String", + "value": "For more information, see https://aka.ms/avm/TelemetryInfo" + } + } + } + } + }, + "privateEndpoint": { + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "copy": [ + { + "name": "applicationSecurityGroups", + "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]", + "input": { + "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]" + } + } + ], + "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]", + "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]", + "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]", + "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]", + "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]", + "subnet": { + "id": "[parameters('subnetResourceId')]" + } + } + }, + "privateEndpoint_lock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_roleAssignments": { + "copy": { + "name": "privateEndpoint_roleAssignments", + "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]" + }, + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]", + "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]", + "properties": { + "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]", + "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]", + "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]", + "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]", + "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]", + "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]", + "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]" + }, + "dependsOn": [ + "privateEndpoint" + ] + }, + "privateEndpoint_privateDnsZoneGroup": { + "condition": "[not(empty(parameters('privateDnsZoneGroup')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2022-09-01", + "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]" + }, + "privateEndpointName": { + "value": "[parameters('name')]" + }, + "privateDnsZoneConfigs": { + "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.34.44.8038", + "templateHash": "13997305779829540948" + }, + "name": "Private Endpoint Private DNS Zone Groups", + "description": "This module deploys a Private Endpoint Private DNS Zone Group." + }, + "definitions": { + "privateDnsZoneGroupConfigType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the private DNS zone group config." + } + }, + "privateDnsZoneResourceId": { + "type": "string", + "metadata": { + "description": "Required. The resource id of the private DNS zone." + } + } + }, + "metadata": { + "__bicep_export!": true + } + } + }, + "parameters": { + "privateEndpointName": { + "type": "string", + "metadata": { + "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment." + } + }, + "privateDnsZoneConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/privateDnsZoneGroupConfigType" + }, + "minLength": 1, + "maxLength": 5, + "metadata": { + "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones." + } + }, + "name": { + "type": "string", + "defaultValue": "default", + "metadata": { + "description": "Optional. The name of the private DNS zone group." + } + } + }, + "variables": { + "copy": [ + { + "name": "privateDnsZoneConfigsVar", + "count": "[length(parameters('privateDnsZoneConfigs'))]", + "input": { + "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]", + "properties": { + "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]" + } + } + } + ] + }, + "resources": { + "privateEndpoint": { + "existing": true, + "type": "Microsoft.Network/privateEndpoints", + "apiVersion": "2024-05-01", + "name": "[parameters('privateEndpointName')]" + }, + "privateDnsZoneGroup": { + "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups", + "apiVersion": "2024-05-01", + "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]", + "properties": { + "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]" + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint DNS zone group." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint DNS zone group." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint DNS zone group was deployed into." + }, + "value": "[resourceGroup().name]" + } + } + } + }, + "dependsOn": [ + "privateEndpoint" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The resource group the private endpoint was deployed into." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the private endpoint." + }, + "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "The name of the private endpoint." + }, + "value": "[parameters('name')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]" + }, + "customDnsConfigs": { + "type": "array", + "items": { + "$ref": "#/definitions/customDnsConfigType" + }, + "metadata": { + "description": "The custom DNS configurations of the private endpoint." + }, + "value": "[reference('privateEndpoint').customDnsConfigs]" + }, + "networkInterfaceResourceIds": { + "type": "array", + "items": { + "type": "string" + }, + "metadata": { + "description": "The resource IDs of the network interfaces associated with the private endpoint." + }, + "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]" + }, + "groupId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The group Id for the private endpoint Group." + }, + "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]" + } + } + } + }, + "dependsOn": [ + "databaseAccount" + ] + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "The name of the database account." + }, + "value": "[parameters('name')]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "The resource ID of the database account." + }, + "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "The name of the resource group the database account was created in." + }, + "value": "[resourceGroup().name]" + }, + "systemAssignedMIPrincipalId": { + "type": "string", + "nullable": true, + "metadata": { + "description": "The principal ID of the system assigned identity." + }, + "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]" + }, + "location": { + "type": "string", + "metadata": { + "description": "The location the resource was deployed into." + }, + "value": "[reference('databaseAccount', '2024-11-15', 'full').location]" + }, + "endpoint": { + "type": "string", + "metadata": { + "description": "The endpoint of the database account." + }, + "value": "[reference('databaseAccount').documentEndpoint]" + }, + "privateEndpoints": { + "type": "array", + "items": { + "$ref": "#/definitions/privateEndpointOutputType" + }, + "metadata": { + "description": "The private endpoints of the database account." + }, + "copy": { + "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]", + "input": { + "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]", + "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]", + "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]", + "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]", + "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]" + } + } + }, + "primaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]" + }, + "primaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The primary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]" + }, + "primaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]" + }, + "primaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The primary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]" + }, + "secondaryReadWriteKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]" + }, + "secondaryReadOnlyKey": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only key." + }, + "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]" + }, + "secondaryReadWriteConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-write connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]" + }, + "secondaryReadOnlyConnectionString": { + "type": "securestring", + "metadata": { + "description": "The secondary read-only connection string." + }, + "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]" + } + } + } + } + } + }, + "outputs": { + "name": { + "type": "string", + "metadata": { + "description": "Name of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.name.value, variables('existingName'))]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.DocumentDB/databaseAccounts', variables('existingName')))]" + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Subscription ID of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]" + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Resource Group Name of the Cosmos DB." + }, + "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]" + } + } + } + } + }, + "foundryProject": { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.main.{0}', variables('projectName')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[variables('projectName')]" + }, + "desc": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'desc'))), createObject('value', parameters('aiFoundryConfiguration').project.desc), createObject('value', 'This is the default project for AI Foundry.'))]", + "displayName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'displayName'))), createObject('value', parameters('aiFoundryConfiguration').project.displayName), createObject('value', format('{0} Default Project', parameters('baseName'))))]", + "accountName": { + "value": "[reference('foundryAccount').outputs.name.value]" + }, + "location": { + "value": "[reference('foundryAccount').outputs.location.value]" + }, + "createAccountCapabilityHost": { + "value": "[and(variables('createCapabilityHosts'), empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')))]" + }, + "createProjectCapabilityHost": { + "value": "[variables('createCapabilityHosts')]" + }, + "storageAccountConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('storageAccount').outputs.name.value, 'subscriptionId', reference('storageAccount').outputs.subscriptionId.value, 'resourceGroupName', reference('storageAccount').outputs.resourceGroupName.value)), createObject('value', null()))]", + "aiSearchConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('aiSearch').outputs.name.value, 'subscriptionId', reference('aiSearch').outputs.subscriptionId.value, 'resourceGroupName', reference('aiSearch').outputs.resourceGroupName.value)), createObject('value', null()))]", + "cosmosDbConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('cosmosDb').outputs.name.value, 'subscriptionId', reference('cosmosDb').outputs.subscriptionId.value, 'resourceGroupName', reference('cosmosDb').outputs.resourceGroupName.value)), createObject('value', null()))]", + "tags": { + "value": "[parameters('tags')]" + }, + "lock": { + "value": "[parameters('lock')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "8997226659817763257" + }, + "name": "AI Foundry Project", + "description": "Creates an AI Foundry project and any associated Azure service connections." + }, + "definitions": { + "azureConnectionType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The name of the project connection. Will default to the resource name if not provided." + } + }, + "resourceName": { + "type": "string", + "metadata": { + "description": "Required. The resource name of the Azure resource for the connection." + } + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Required. The subscription ID of the resource." + } + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Required. The resource group name of the resource." + } + } + }, + "metadata": { + "__bicep_export!": true, + "description": "Type representing values to create an Azure connection to an AI Foundry project." + } + }, + "lockType": { + "type": "object", + "properties": { + "name": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the name of lock." + } + }, + "kind": { + "type": "string", + "allowedValues": [ + "CanNotDelete", + "None", + "ReadOnly" + ], + "nullable": true, + "metadata": { + "description": "Optional. Specify the type of lock." + } + }, + "notes": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. Specify the notes of the lock." + } + } + }, + "metadata": { + "description": "An AVM-aligned type for a lock.", + "__bicep_imported_from!": { + "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0" + } + } + } + }, + "parameters": { + "name": { + "type": "string", + "minLength": 2, + "maxLength": 64, + "metadata": { + "description": "Required. The name of the AI Foundry project." + } + }, + "displayName": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The display name of the AI Foundry project." + } + }, + "desc": { + "type": "string", + "nullable": true, + "metadata": { + "description": "Optional. The description of the AI Foundry project." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Optional. Specifies the location for all the Azure resources." + } + }, + "accountName": { + "type": "string", + "metadata": { + "description": "Required. Name of the existing parent Foundry Account resource." + } + }, + "createAccountCapabilityHost": { + "type": "bool", + "metadata": { + "description": "Required. Whether to create the capability host for the Foundry account. Requires associated resource connections to be provided." + } + }, + "createProjectCapabilityHost": { + "type": "bool", + "metadata": { + "description": "Required. Whether to create the capability host for the Foundry project. Requires associated resource connections to be provided." + } + }, + "cosmosDbConnection": { + "$ref": "#/definitions/azureConnectionType", + "nullable": true, + "metadata": { + "description": "Optional. Azure Cosmos DB connection for the project." + } + }, + "aiSearchConnection": { + "$ref": "#/definitions/azureConnectionType", + "nullable": true, + "metadata": { + "description": "Optional. Azure Cognitive Search connection for the project." + } + }, + "storageAccountConnection": { + "$ref": "#/definitions/azureConnectionType", + "nullable": true, + "metadata": { + "description": "Optional. Storage Account connection for the project." + } + }, + "lock": { + "$ref": "#/definitions/lockType", + "nullable": true, + "metadata": { + "description": "Optional. The lock settings of the service." + } + }, + "tags": { + "type": "object", + "metadata": { + "__bicep_resource_derived_type!": { + "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags" + }, + "description": "Optional. Tags to be applied to the resources." + }, + "defaultValue": {} + } + }, + "variables": { + "hasConnection": "[or(or(not(empty(parameters('cosmosDbConnection'))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]", + "createProjectCapabilityHostInternal": "[and(and(and(parameters('createProjectCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]", + "createAccountCapabilityHostInternal": "[and(and(and(parameters('createAccountCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]" + }, + "resources": { + "foundryAccount": { + "existing": true, + "type": "Microsoft.CognitiveServices/accounts", + "apiVersion": "2025-06-01", + "name": "[parameters('accountName')]" + }, + "storageAccount": { + "condition": "[not(empty(parameters('storageAccountConnection')))]", + "existing": true, + "type": "Microsoft.Storage/storageAccounts", + "apiVersion": "2025-01-01", + "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]", + "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]", + "name": "[parameters('storageAccountConnection').resourceName]" + }, + "aiSearch": { + "condition": "[not(empty(parameters('aiSearchConnection')))]", + "existing": true, + "type": "Microsoft.Search/searchServices", + "apiVersion": "2025-05-01", + "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]", + "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]", + "name": "[parameters('aiSearchConnection').resourceName]" + }, + "cosmosDb": { + "condition": "[not(empty(parameters('cosmosDbConnection')))]", + "existing": true, + "type": "Microsoft.DocumentDB/databaseAccounts", + "apiVersion": "2025-04-15", + "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]", + "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]", + "name": "[parameters('cosmosDbConnection').resourceName]" + }, + "project": { + "type": "Microsoft.CognitiveServices/accounts/projects", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}', parameters('accountName'), parameters('name'))]", + "location": "[parameters('location')]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "displayName": "[if(not(empty(parameters('displayName'))), parameters('displayName'), parameters('name'))]", + "description": "[if(not(empty(parameters('desc'))), parameters('desc'), parameters('name'))]" + }, + "tags": "[parameters('tags')]" + }, + "cosmosDbConnectionResource": { + "condition": "[not(empty(parameters('cosmosDbConnection')))]", + "type": "Microsoft.CognitiveServices/accounts/projects/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('cosmosDbConnection').resourceName)]", + "properties": { + "category": "CosmosDB", + "target": "[reference('cosmosDb').documentEndpoint]", + "authType": "AAD", + "metadata": { + "ApiType": "Azure", + "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('cosmosDbConnection').subscriptionId, parameters('cosmosDbConnection').resourceGroupName), 'Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbConnection').resourceName)]", + "location": "[reference('cosmosDb', '2025-04-15', 'full').location]" + } + }, + "dependsOn": [ + "cosmosDb", + "cosmosDbRoleAssignments", + "project", + "waitForProjectScript" + ] + }, + "storageAccountConnectionResource": { + "condition": "[not(empty(parameters('storageAccountConnection')))]", + "type": "Microsoft.CognitiveServices/accounts/projects/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('storageAccountConnection').resourceName)]", + "properties": { + "category": "AzureStorageAccount", + "target": "[reference('storageAccount').primaryEndpoints.blob]", + "authType": "AAD", + "metadata": { + "ApiType": "Azure", + "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('storageAccountConnection').subscriptionId, parameters('storageAccountConnection').resourceGroupName), 'Microsoft.Storage/storageAccounts', parameters('storageAccountConnection').resourceName)]", + "location": "[reference('storageAccount', '2025-01-01', 'full').location]" + } + }, + "dependsOn": [ + "cosmosDbConnectionResource", + "project", + "storageAccount", + "storageAccountRoleAssignments", + "waitForProjectScript" + ] + }, + "aiSearchConnectionResource": { + "condition": "[not(empty(parameters('aiSearchConnection')))]", + "type": "Microsoft.CognitiveServices/accounts/projects/connections", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('aiSearchConnection').resourceName)]", + "properties": { + "category": "CognitiveSearch", + "target": "[format('https://{0}.search.windows.net/', parameters('aiSearchConnection').resourceName)]", + "authType": "AAD", + "metadata": { + "ApiType": "Azure", + "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('aiSearchConnection').subscriptionId, parameters('aiSearchConnection').resourceGroupName), 'Microsoft.Search/searchServices', parameters('aiSearchConnection').resourceName)]", + "location": "[reference('aiSearch', '2025-05-01', 'full').location]" + } + }, + "dependsOn": [ + "aiSearch", + "aiSearchRoleAssignments", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForProjectScript" + ] + }, + "accountCapabilityHost": { + "condition": "[variables('createAccountCapabilityHostInternal')]", + "type": "Microsoft.CognitiveServices/accounts/capabilityHosts", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}', parameters('accountName'), format('chagent{0}', replace(parameters('accountName'), '-', '')))]", + "properties": { + "capabilityHostKind": "Agents", + "tags": "[parameters('tags')]" + }, + "dependsOn": [ + "aiSearchConnectionResource", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForConnectionsScript" + ] + }, + "capabilityHost": { + "condition": "[variables('createProjectCapabilityHostInternal')]", + "type": "Microsoft.CognitiveServices/accounts/projects/capabilityHosts", + "apiVersion": "2025-04-01-preview", + "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), format('chagent{0}', replace(parameters('name'), '-', '')))]", + "properties": { + "capabilityHostKind": "Agents", + "threadStorageConnections": [ + "[format('{0}', parameters('cosmosDbConnection').resourceName)]" + ], + "vectorStoreConnections": [ + "[format('{0}', parameters('aiSearchConnection').resourceName)]" + ], + "storageConnections": [ + "[format('{0}', parameters('storageAccountConnection').resourceName)]" + ], + "tags": "[parameters('tags')]" + }, + "dependsOn": [ + "accountCapabilityHost", + "aiSearchConnectionResource", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForConnectionsScript" + ] + }, + "projectLock": { + "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]", + "type": "Microsoft.Authorization/locks", + "apiVersion": "2020-05-01", + "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', parameters('accountName'), parameters('name'))]", + "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]", + "properties": { + "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]", + "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]" + }, + "dependsOn": [ + "capabilityHost", + "project" + ] + }, + "waitForProjectScript": { + "condition": "[variables('hasConnection')]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.waitDeploymentScript.waitForProject.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('script-wait-proj-{0}', parameters('name'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "seconds": { + "value": 30 + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16818353602719638288" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the deployment script." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. Location for the deployment script." + } + }, + "seconds": { + "type": "int", + "metadata": { + "description": "Required. Sleep/wait time for the deployment script in seconds." + } + } + }, + "resources": [ + { + "type": "Microsoft.Resources/deploymentScripts", + "apiVersion": "2023-08-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "AzurePowerShell", + "properties": { + "azPowerShellVersion": "11.0", + "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]", + "timeout": "P1D", + "cleanupPreference": "Always", + "retentionInterval": "P1D" + } + } + ] + } + }, + "dependsOn": [ + "project" + ] + }, + "cosmosDbRoleAssignments": { + "condition": "[not(empty(parameters('cosmosDbConnection')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.cosmosDb.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]", + "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "cosmosDbName": { + "value": "[parameters('cosmosDbConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "2297586848184477491" + } + }, + "parameters": { + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Cosmos DB account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('cosmosDbName'))]", + "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "principalType": "ServicePrincipal" + } + } + ] + } + }, + "dependsOn": [ + "project", + "waitForProjectScript" + ] + }, + "storageAccountRoleAssignments": { + "condition": "[not(empty(parameters('storageAccountConnection')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.storageAccount.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]", + "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16405095293780360423" + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]", + "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]", + "principalType": "ServicePrincipal" + } + } + ] + } + }, + "dependsOn": [ + "project", + "waitForProjectScript" + ] + }, + "aiSearchRoleAssignments": { + "condition": "[not(empty(parameters('aiSearchConnection')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.aiSearch.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]", + "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "aiSearchName": { + "value": "[parameters('aiSearchConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16025941000331400340" + } + }, + "parameters": { + "aiSearchName": { + "type": "string", + "metadata": { + "description": "Required. The name of the AI Search resource." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]", + "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]", + "principalType": "ServicePrincipal" + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]", + "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]", + "principalType": "ServicePrincipal" + } + } + ] + } + }, + "dependsOn": [ + "project", + "waitForProjectScript" + ] + }, + "waitForConnectionsScript": { + "condition": "[and(variables('hasConnection'), or(variables('createAccountCapabilityHostInternal'), variables('createProjectCapabilityHostInternal')))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.waitDeploymentScript.waitForConn.{0}', parameters('name')), 64)]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[format('script-wait-conns-{0}', parameters('name'))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "seconds": { + "value": 60 + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "16818353602719638288" + } + }, + "parameters": { + "name": { + "type": "string", + "metadata": { + "description": "Required. Name of the deployment script." + } + }, + "location": { + "type": "string", + "metadata": { + "description": "Required. Location for the deployment script." + } + }, + "seconds": { + "type": "int", + "metadata": { + "description": "Required. Sleep/wait time for the deployment script in seconds." + } + } + }, + "resources": [ + { + "type": "Microsoft.Resources/deploymentScripts", + "apiVersion": "2023-08-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "kind": "AzurePowerShell", + "properties": { + "azPowerShellVersion": "11.0", + "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]", + "timeout": "P1D", + "cleanupPreference": "Always", + "retentionInterval": "P1D" + } + } + ] + } + }, + "dependsOn": [ + "aiSearchConnectionResource", + "cosmosDbConnectionResource", + "project", + "storageAccountConnectionResource", + "waitForProjectScript" + ] + }, + "cosmosDbSqlRoleAssignments": { + "condition": "[and(not(empty(parameters('cosmosDbConnection'))), variables('createProjectCapabilityHostInternal'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.cosmosDbDataPlane.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]", + "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "cosmosDbName": { + "value": "[parameters('cosmosDbConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + }, + "projectWorkspaceId": { + "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "11649050309693252000" + } + }, + "parameters": { + "cosmosDbName": { + "type": "string", + "metadata": { + "description": "Required. The name of the Cosmos DB account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + }, + "projectWorkspaceId": { + "type": "string", + "metadata": { + "description": "Required. The project workspace ID." + } + } + }, + "variables": { + "cosmosContainerNameSuffixes": [ + "thread-message-store", + "system-thread-message-store", + "agent-entity-store" + ], + "cosmosDefaultSqlRoleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbName'), '00000000-0000-0000-0000-000000000002')]" + }, + "resources": [ + { + "copy": { + "name": "cosmosDataRoleAssigment", + "count": "[length(variables('cosmosContainerNameSuffixes'))]", + "mode": "serial", + "batchSize": 1 + }, + "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments", + "apiVersion": "2025-04-15", + "name": "[format('{0}/{1}', parameters('cosmosDbName'), guid(variables('cosmosDefaultSqlRoleDefinitionId'), parameters('cosmosDbName'), variables('cosmosContainerNameSuffixes')[copyIndex()], parameters('projectIdentityPrincipalId')))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[variables('cosmosDefaultSqlRoleDefinitionId')]", + "scope": "[format('{0}/dbs/enterprise_memory/colls/{1}-{2}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')), parameters('projectWorkspaceId'), variables('cosmosContainerNameSuffixes')[copyIndex()])]" + } + } + ] + } + }, + "dependsOn": [ + "capabilityHost", + "cosmosDbRoleAssignments", + "project" + ] + }, + "storageAccountContainerRoleAssignments": { + "condition": "[and(not(empty(parameters('storageAccountConnection'))), variables('createProjectCapabilityHostInternal'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[take(format('module.project.role-assign.storageAccountDataPlane.{0}', parameters('name')), 64)]", + "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]", + "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "storageAccountName": { + "value": "[parameters('storageAccountConnection').resourceName]" + }, + "projectIdentityPrincipalId": { + "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]" + }, + "projectWorkspaceId": { + "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.38.33.27573", + "templateHash": "12109249428053532616" + } + }, + "parameters": { + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Required. The name of the storage account." + } + }, + "projectIdentityPrincipalId": { + "type": "string", + "metadata": { + "description": "Required. The principal ID of the project identity." + } + }, + "projectWorkspaceId": { + "type": "string", + "metadata": { + "description": "Required. The project workspace ID." + } + } + }, + "resources": [ + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]", + "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]", + "properties": { + "principalId": "[parameters('projectIdentityPrincipalId')]", + "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]", + "principalType": "ServicePrincipal", + "conditionVersion": "2.0", + "condition": "[replace(' (\n (\n !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read''})\n AND !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/filter/action''})\n AND !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write''})\n )\n OR\n (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringStartsWithIgnoreCase ''#projectWorkspaceId#''\n AND @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringLikeIgnoreCase ''*-azureml-agent'')\n )\n ', '#projectWorkspaceId#', parameters('projectWorkspaceId'))]" + } + } + ] + } + }, + "dependsOn": [ + "capabilityHost", + "cosmosDbSqlRoleAssignments", + "project", + "storageAccountRoleAssignments" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Resource Group." + }, + "value": "[resourceGroup().name]" + }, + "resourceId": { + "type": "string", + "metadata": { + "description": "Resource ID of the Project." + }, + "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('accountName'), parameters('name'))]" + }, + "name": { + "type": "string", + "metadata": { + "description": "Name of the Project." + }, + "value": "[parameters('name')]" + }, + "displayName": { + "type": "string", + "metadata": { + "description": "Display name of the Project." + }, + "value": "[reference('project').displayName]" + }, + "desc": { + "type": "string", + "metadata": { + "description": "Description of the Project." + }, + "value": "[reference('project').description]" + } + } + } + }, + "dependsOn": [ + "aiSearch", + "cosmosDb", + "foundryAccount", + "keyVault", + "storageAccount" + ] + } + }, + "outputs": { + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Resource Group." + }, + "value": "[resourceGroup().name]" + }, + "keyVaultName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Key Vault." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('keyVault').outputs.name.value, '')]" + }, + "aiServicesName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure AI Services account." + }, + "value": "[reference('foundryAccount').outputs.name.value]" + }, + "aiSearchName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure AI Search service." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('aiSearch').outputs.name.value, '')]" + }, + "aiProjectName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure AI Project." + }, + "value": "[reference('foundryProject').outputs.name.value]" + }, + "storageAccountName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Storage Account." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('storageAccount').outputs.name.value, '')]" + }, + "cosmosAccountName": { + "type": "string", + "metadata": { + "description": "Name of the deployed Azure Cosmos DB account." + }, + "value": "[if(parameters('includeAssociatedResources'), reference('cosmosDb').outputs.name.value, '')]" + } + } + } + } + } + }, + "outputs": { + "aiProjectName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiProjectName.value]" + }, + "aiServicesName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiServicesName.value]" + } + } + } + }, + "dependsOn": [ + "privateDns", + "userAssignedIdentity" + ] + }, + "bastion": { + "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('bastionDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-bastion-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[reference('network').outputs.bastionSubnetId.value]" + }, + "sku": { + "value": "[parameters('bastionSku')]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "9423121226804345673" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the bastion host" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "Bastion host name" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "AzureBastionSubnet resource id" + } + }, + "sku": { + "type": "string", + "defaultValue": "Standard", + "allowedValues": [ + "Basic", + "Standard" + ], + "metadata": { + "description": "SKU: Basic or Standard. Standard required for native-client / SSH tunneling." + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "resources": [ + { + "type": "Microsoft.Network/publicIPAddresses", + "apiVersion": "2023-11-01", + "name": "[format('{0}-pip', parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "Standard" + }, + "properties": { + "publicIPAllocationMethod": "Static", + "publicIPAddressVersion": "IPv4" + } + }, + { + "type": "Microsoft.Network/bastionHosts", + "apiVersion": "2023-11-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "sku": { + "name": "[parameters('sku')]" + }, + "properties": { + "enableTunneling": "[if(equals(parameters('sku'), 'Standard'), true(), false())]", + "enableShareableLink": false, + "ipConfigurations": [ + { + "name": "ipConfig", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "publicIPAddress": { + "id": "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" + } + } + } + ] + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name')))]" + ] + } + ], + "outputs": { + "bastionId": { + "type": "string", + "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]" + }, + "bastionName": { + "type": "string", + "value": "[parameters('name')]" + }, + "publicIpAddress": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Network/publicIPAddresses', format('{0}-pip', parameters('name'))), '2023-11-01').ipAddress]" + } + } + } + }, + "dependsOn": [ + "network" + ] + }, + "jumpbox": { + "condition": "[and(parameters('isPrivate'), parameters('deployJumpbox'))]", + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "[format('jumpboxDeployment.{0}', variables('shortHash'))]", + "properties": { + "expressionEvaluationOptions": { + "scope": "inner" + }, + "mode": "Incremental", + "parameters": { + "name": { + "value": "[toLower(format('{0}-jump-{1}', parameters('namePrefix'), uniqueString(variables('resourceGroupId'))))]" + }, + "location": { + "value": "[parameters('location')]" + }, + "subnetId": { + "value": "[reference('network').outputs.jumpboxSubnetId.value]" + }, + "adminUsername": { + "value": "[parameters('jumpboxAdminUsername')]" + }, + "adminPublicKey": { + "value": "[parameters('jumpboxAdminPublicKey')]" + }, + "userAssignedIdentityId": { + "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" + }, + "tags": { + "value": "[variables('tags')]" + } + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "_generator": { + "name": "bicep", + "version": "0.42.1.51946", + "templateHash": "5495470989234358791" + } + }, + "parameters": { + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Location for the VM" + } + }, + "name": { + "type": "string", + "metadata": { + "description": "VM name" + } + }, + "subnetId": { + "type": "string", + "metadata": { + "description": "Subnet id for the VM NIC" + } + }, + "vmSize": { + "type": "string", + "defaultValue": "Standard_B2s", + "metadata": { + "description": "VM size. B-series default — cheap, enough for az cli + docker." + } + }, + "adminUsername": { + "type": "string", + "defaultValue": "azureuser", + "metadata": { + "description": "Admin username for SSH (accessed via Bastion)" + } + }, + "adminPublicKey": { + "type": "securestring", + "metadata": { + "description": "SSH public key used to log in (via Bastion)" + } + }, + "userAssignedIdentityId": { + "type": "string", + "metadata": { + "description": "User-assigned managed identity resource id to attach to the VM" + } + }, + "tags": { + "type": "object", + "defaultValue": {}, + "metadata": { + "description": "Tags for resources" + } + } + }, + "variables": { + "cloudInit": "#cloud-config\npackage_update: true\npackage_upgrade: false\npackages:\n - ca-certificates\n - curl\n - gnupg\n - lsb-release\n - jq\n - git\nruncmd:\n - curl -sL https://aka.ms/InstallAzureCLIDeb | bash\n - az bicep install || true\n - install -m 0755 -d /etc/apt/keyrings\n - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg\n - chmod a+r /etc/apt/keyrings/docker.gpg\n - echo \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable\" > /etc/apt/sources.list.d/docker.list\n - apt-get update\n - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin\n - usermod -aG docker azureuser\n" + }, + "resources": [ + { + "type": "Microsoft.Network/networkInterfaces", + "apiVersion": "2023-11-01", + "name": "[format('{0}-nic', parameters('name'))]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "properties": { + "ipConfigurations": [ + { + "name": "ipconfig", + "properties": { + "subnet": { + "id": "[parameters('subnetId')]" + }, + "privateIPAllocationMethod": "Dynamic" + } + } + ] + } + }, + { + "type": "Microsoft.Compute/virtualMachines", + "apiVersion": "2024-03-01", + "name": "[parameters('name')]", + "location": "[parameters('location')]", + "tags": "[parameters('tags')]", + "identity": { + "type": "UserAssigned", + "userAssignedIdentities": { + "[format('{0}', parameters('userAssignedIdentityId'))]": {} + } + }, + "properties": { + "hardwareProfile": { + "vmSize": "[parameters('vmSize')]" + }, + "storageProfile": { + "imageReference": { + "publisher": "Canonical", + "offer": "ubuntu-24_04-lts", + "sku": "server", + "version": "latest" + }, + "osDisk": { + "createOption": "FromImage", + "managedDisk": { + "storageAccountType": "StandardSSD_LRS" + } + } + }, + "osProfile": { + "computerName": "[parameters('name')]", + "adminUsername": "[parameters('adminUsername')]", + "customData": "[base64(variables('cloudInit'))]", + "linuxConfiguration": { + "disablePasswordAuthentication": true, + "ssh": { + "publicKeys": [ + { + "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]", + "keyData": "[parameters('adminPublicKey')]" + } + ] + } + } + }, + "networkProfile": { + "networkInterfaces": [ + { + "id": "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" + } + ] + } + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name')))]" + ] + } + ], + "outputs": { + "vmId": { + "type": "string", + "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]" + }, + "vmName": { + "type": "string", + "value": "[parameters('name')]" + }, + "nicPrivateIp": { + "type": "string", + "value": "[reference(resourceId('Microsoft.Network/networkInterfaces', format('{0}-nic', parameters('name'))), '2023-11-01').ipConfigurations[0].properties.privateIPAddress]" + } + } + } + }, + "dependsOn": [ + "network", + "userAssignedIdentity" + ] + } + }, + "outputs": { + "userAssignedIdentityName": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.name.value]" + }, + "userAssignedIdentityPrincipalId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.principalId.value]" + }, + "userAssignedIdentityResourceId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.resourceId.value]" + }, + "userAssignedIdentityClientId": { + "type": "string", + "value": "[reference('userAssignedIdentity').outputs.clientId.value]" + }, + "containerRegistryName": { + "type": "string", + "value": "[reference('containerRegistry').outputs.name.value]" + }, + "containerRegistryLoginServer": { + "type": "string", + "value": "[reference('containerRegistry').outputs.loginServer.value]" + }, + "appServicePlanId": { + "type": "string", + "value": "[reference('appServicePlan').outputs.id.value]" + }, + "appServicePlanName": { + "type": "string", + "value": "[reference('appServicePlan').outputs.name.value]" + }, + "appSvcSubnetId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('network').outputs.appSvcSubnetId.value, '')]" + }, + "peSubnetId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('network').outputs.peSubnetId.value, '')]" + }, + "appServicePrivateDnsZoneId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('privateDns').outputs.appServiceZoneId.value, '')]" + }, + "storageAccountName": { + "type": "string", + "value": "[reference('storage').outputs.name.value]" + }, + "cosmosAccountName": { + "type": "string", + "value": "[reference('cosmosDb').outputs.cosmosAccountName.value]" + }, + "cosmosEndpoint": { + "type": "string", + "value": "[reference('cosmosDb').outputs.cosmosEndpoint.value]" + }, + "cosmosDBName": { + "type": "string", + "value": "[reference('cosmosDb').outputs.cosmosDBName.value]" + }, + "aiProjectName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiProjectName.value]" + }, + "aiServicesName": { + "type": "string", + "value": "[reference('aiFoundry').outputs.aiServicesName.value]" + }, + "isPrivate": { + "type": "bool", + "value": "[parameters('isPrivate')]" + }, + "vnetId": { + "type": "string", + "value": "[if(parameters('isPrivate'), reference('network').outputs.vnetId.value, '')]" + }, + "jumpboxName": { + "type": "string", + "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('jumpbox').outputs.vmName.value, '')]" + }, + "bastionName": { + "type": "string", + "value": "[if(and(parameters('isPrivate'), parameters('deployJumpbox')), reference('bastion').outputs.bastionName.value, '')]" + } + } +} \ No newline at end of file diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep index 216183f..6492893 100644 --- a/infra/bicep/modules/ai-foundry.bicep +++ b/infra/bicep/modules/ai-foundry.bicep @@ -1,7 +1,7 @@ @description('Optional: Location for all resources. Default is the resource group location') param location string = resourceGroup().location -@description('Required: Name of the Container Registry') +@description('Required: Base name used by the AI Foundry AVM pattern (max 12 chars)') param aiFoundryBaseName string @description('Managed Identity that will be given access to the AI Foundry Resource') @@ -10,19 +10,43 @@ param roleAssignedManagedIdentityPrincipalIds string[] @description('Tags for resources') param tags object = {} +@description('When true, disables public network access and deploys the AI Foundry private endpoints via AVM.') +param isPrivate bool = false + +@description('Agent service subnet id (optional; reserved for future Foundry agent runtime private networking)') +param agentServiceSubnetId string = '' + +@description('Private DNS zone resource id for privatelink.openai.azure.com (required when isPrivate=true)') +param openAiPrivateDnsZoneId string = '' + +@description('Private DNS zone resource id for privatelink.cognitiveservices.azure.com (required when isPrivate=true)') +param cognitiveServicesPrivateDnsZoneId string = '' + +@description('Private DNS zone resource id for privatelink.services.ai.azure.com (required when isPrivate=true)') +param aiServicesPrivateDnsZoneId string = '' + +// The AVM pattern creates the Cognitive Services account, the project, optional +// associated resources (Search/Cosmos/KV), and — when `networking` is supplied — +// the private endpoints + DNS zone groups. Passing the networking block also +// disables public network access on the underlying account. +var networkingConfig = isPrivate ? { + agentServiceSubnetResourceId: agentServiceSubnetId + aiServicesPrivateDnsZoneResourceId: aiServicesPrivateDnsZoneId + cognitiveServicesPrivateDnsZoneResourceId: cognitiveServicesPrivateDnsZoneId + openAiPrivateDnsZoneResourceId: openAiPrivateDnsZoneId +} : null + module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = { params: { - // Required parameters baseName: aiFoundryBaseName location: location tags: tags - // Non-required parameters aiFoundryConfiguration: { - // accountName: '' allowProjectManagement: true createCapabilityHosts: false disableLocalAuth: true location: location + networking: networkingConfig project: { desc: 'AI Foundry project for AI Investment Analysis Sample' displayName: 'AI-Invest' @@ -32,7 +56,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = { for principalId in roleAssignedManagedIdentityPrincipalIds: { principalId: principalId principalType: 'ServicePrincipal' - roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // 'Azure AI User' + roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // 'Azure AI User' } ] sku: 'S0' @@ -51,44 +75,9 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = { } } ] - // aiSearchConfiguration: { - // name: '' - // privateDnsZoneResourceId: '' - // roleAssignments: [ - // { - // principalId: '' - // principalType: 'ServicePrincipal' - // roleDefinitionIdOrName: 'Search Index Data Contributor' - // } - // ] - // } - // // baseUniqueName: '' - // cosmosDbConfiguration: { - // name: '' - // privateDnsZoneResourceId: '' - // roleAssignments: [ - // { - // principalId: '' - // principalType: 'ServicePrincipal' - // roleDefinitionIdOrName: 'Cosmos DB Account Reader Role' - // } - // ] - // } includeAssociatedResources: false - // keyVaultConfiguration: { - // name: '' - // privateDnsZoneResourceId: '' - // roleAssignments: [ - // { - // principalId: '' - // principalType: 'ServicePrincipal' - // roleDefinitionIdOrName: 'Key Vault Secrets User' - // } - // ] - // } } } - output aiProjectName string = aiFoundry.outputs.aiProjectName output aiServicesName string = aiFoundry.outputs.aiServicesName diff --git a/infra/bicep/modules/ampls.bicep b/infra/bicep/modules/ampls.bicep new file mode 100644 index 0000000..5e134a8 --- /dev/null +++ b/infra/bicep/modules/ampls.bicep @@ -0,0 +1,71 @@ +// Azure Monitor Private Link Scope (AMPLS) — binds App Insights + Log Analytics +// so telemetry flows over the VNet via private endpoint instead of public ingest. + +@description('Location (AMPLS is a global resource; use global)') +param location string = 'global' + +@description('AMPLS resource name') +param name string + +@description('Log Analytics Workspace resource id to scope') +param logAnalyticsResourceId string + +@description('Application Insights component resource id to scope') +param appInsightsResourceId string + +@description('Subnet resource id where the PE NIC is placed') +param privateEndpointSubnetId string + +@description('Resource group location for the private endpoint resource') +param privateEndpointLocation string = resourceGroup().location + +@description('Private DNS zone resource ids for Azure Monitor PLS (monitor, oms, ods, agentsvc, blob)') +param privateDnsZoneIds string[] + +@description('Tags for resources') +param tags object = {} + +resource ampls 'Microsoft.Insights/privateLinkScopes@2021-07-01-preview' = { + name: name + location: location + tags: tags + properties: { + accessModeSettings: { + ingestionAccessMode: 'PrivateOnly' + queryAccessMode: 'PrivateOnly' + } + } +} + +resource lawScope 'Microsoft.Insights/privateLinkScopes/scopedResources@2021-07-01-preview' = { + parent: ampls + name: 'law-scope' + properties: { + linkedResourceId: logAnalyticsResourceId + } +} + +resource appiScope 'Microsoft.Insights/privateLinkScopes/scopedResources@2021-07-01-preview' = { + parent: ampls + name: 'appi-scope' + properties: { + linkedResourceId: appInsightsResourceId + } +} + +module ampPe 'private-endpoint.bicep' = { + name: 'ampls-pe-${uniqueString(ampls.id)}' + params: { + name: '${name}-pe' + location: privateEndpointLocation + subnetId: privateEndpointSubnetId + targetResourceId: ampls.id + groupIds: [ 'azuremonitor' ] + privateDnsZoneIds: privateDnsZoneIds + tags: tags + } + dependsOn: [ lawScope, appiScope ] +} + +output amplsId string = ampls.id +output amplsName string = ampls.name diff --git a/infra/bicep/modules/app-config-store.bicep b/infra/bicep/modules/app-config-store.bicep index da1d525..4d6f7c7 100644 --- a/infra/bicep/modules/app-config-store.bicep +++ b/infra/bicep/modules/app-config-store.bicep @@ -13,6 +13,15 @@ param configurationKeyValues array = [] @description('Tags for resources') param tags object = {} +@description('When true, disables public network access + local auth and deploys a private endpoint.') +param isPrivate bool = false + +@description('Subnet resource id for the private endpoint (required when isPrivate=true)') +param privateEndpointSubnetId string = '' + +@description('Private DNS zone resource id for App Configuration (required when isPrivate=true)') +param appConfigPrivateDnsZoneId string = '' + // Create list of role assignments for the managed identities var roleAssignments = [ for principalId in roleAssignedManagedIdentityPrincipalIds: { @@ -40,7 +49,8 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto tags: tags sku: 'Standard' createMode: 'Default' - disableLocalAuth: false + disableLocalAuth: isPrivate + publicNetworkAccess: isPrivate ? 'Disabled' : 'Enabled' enablePurgeProtection: false keyValues: [ for config in configurationKeyValues: { @@ -57,3 +67,21 @@ module configurationStore 'br/public:avm/res/app-configuration/configuration-sto output endpoint string = configurationStore.outputs.endpoint output resourceId string = configurationStore.outputs.resourceId output name string = configurationStore.outputs.name + +resource acsRef 'Microsoft.AppConfiguration/configurationStores@2023-03-01' existing = { + name: appConfigStoreName + dependsOn: [ configurationStore ] +} + +module pe 'private-endpoint.bicep' = if (isPrivate) { + name: 'acs-pe-${uniqueString(appConfigStoreName)}' + params: { + name: '${appConfigStoreName}-pe' + location: location + subnetId: privateEndpointSubnetId + targetResourceId: acsRef.id + groupIds: [ 'configurationStores' ] + privateDnsZoneIds: empty(appConfigPrivateDnsZoneId) ? [] : [ appConfigPrivateDnsZoneId ] + tags: tags + } +} diff --git a/infra/bicep/modules/app-insights.bicep b/infra/bicep/modules/app-insights.bicep index 6ff6abd..54bec1f 100644 --- a/infra/bicep/modules/app-insights.bicep +++ b/infra/bicep/modules/app-insights.bicep @@ -7,28 +7,11 @@ param appInsightsName string @description('Log Analytics resource id output from log-analytics-ws.bicep module') param logAnalyticsResourceId string -@description('Managed Identity that will be given access to the Application Insights') -param roleAssignedManagedIdentityPrincipalIds string[] = [] - @description('Tags for resources') param tags object = {} -// Create list of role assignments for the managed identities -var roleAssignments = [ - for principalId in roleAssignedManagedIdentityPrincipalIds: { - principalId: principalId - principalType: 'ServicePrincipal' - roleDefinitionIdOrName: 'App Configuration Data Reader' - } - ] - -var deployerRoleAssignments = [ - { - principalId: deployer().objectId - principalType: 'User' - roleDefinitionIdOrName: 'App Configuration Data Owner' - } - ] +@description('When true, disables local auth + public ingestion/query (connect via AMPLS).') +param isPrivate bool = false // Use Azure Verified Module for App Insights module applicationInsights 'br/public:avm/res/insights/component:0.6.0' = { @@ -37,7 +20,9 @@ module applicationInsights 'br/public:avm/res/insights/component:0.6.0' = { location: location workspaceResourceId: logAnalyticsResourceId tags: tags - disableLocalAuth: false + disableLocalAuth: isPrivate + publicNetworkAccessForIngestion: isPrivate ? 'Disabled' : 'Enabled' + publicNetworkAccessForQuery: isPrivate ? 'Disabled' : 'Enabled' } } diff --git a/infra/bicep/modules/app-service-plan.bicep b/infra/bicep/modules/app-service-plan.bicep new file mode 100644 index 0000000..da97a30 --- /dev/null +++ b/infra/bicep/modules/app-service-plan.bicep @@ -0,0 +1,41 @@ +// Linux App Service Plan used to host both the API and Web container apps. +// Uses Premium v3 SKU because private endpoints + VNet integration are +// supported on PremiumV2/V3 and Standard (S1+). For demos, B-series tiers +// also support PE/VNet on Linux. + +@description('Name of the App Service Plan') +param name string + +@description('Location for all resources') +param location string = resourceGroup().location + +@description('Tags applied to the plan') +param tags object = {} + +@description('SKU name for the App Service Plan. P0v3 is the cheapest V3 SKU available in Sweden Central.') +param skuName string = 'P0v3' + +@description('SKU tier (must match skuName family).') +param skuTier string = 'PremiumV3' + +@description('Number of instances') +param skuCapacity int = 1 + +resource plan 'Microsoft.Web/serverfarms@2024-04-01' = { + name: name + location: location + tags: tags + kind: 'linux' + sku: { + name: skuName + tier: skuTier + capacity: skuCapacity + } + properties: { + reserved: true // Linux + zoneRedundant: false + } +} + +output id string = plan.id +output name string = plan.name diff --git a/infra/bicep/modules/bastion.bicep b/infra/bicep/modules/bastion.bicep new file mode 100644 index 0000000..b178e36 --- /dev/null +++ b/infra/bicep/modules/bastion.bicep @@ -0,0 +1,53 @@ +// Azure Bastion (Standard SKU) — the only public-facing TLS endpoint in the +// design. Users open a browser session to the bastion and SSH to the jumpbox. + +@description('Location for the bastion host') +param location string = resourceGroup().location + +@description('Bastion host name') +param name string + +@description('AzureBastionSubnet resource id') +param subnetId string + +@description('SKU: Basic or Standard. Standard required for native-client / SSH tunneling.') +@allowed([ 'Basic', 'Standard' ]) +param sku string = 'Standard' + +@description('Tags for resources') +param tags object = {} + +resource pip 'Microsoft.Network/publicIPAddresses@2023-11-01' = { + name: '${name}-pip' + location: location + tags: tags + sku: { name: 'Standard' } + properties: { + publicIPAllocationMethod: 'Static' + publicIPAddressVersion: 'IPv4' + } +} + +resource bastion 'Microsoft.Network/bastionHosts@2023-11-01' = { + name: name + location: location + tags: tags + sku: { name: sku } + properties: { + enableTunneling: sku == 'Standard' ? true : false + enableShareableLink: false + ipConfigurations: [ + { + name: 'ipConfig' + properties: { + subnet: { id: subnetId } + publicIPAddress: { id: pip.id } + } + } + ] + } +} + +output bastionId string = bastion.id +output bastionName string = bastion.name +output publicIpAddress string = pip.properties.ipAddress diff --git a/infra/bicep/modules/container-apps-environment.bicep b/infra/bicep/modules/container-apps-environment.bicep index 89fcec5..ed2440b 100644 --- a/infra/bicep/modules/container-apps-environment.bicep +++ b/infra/bicep/modules/container-apps-environment.bicep @@ -17,6 +17,12 @@ param userAssignedResourceIds string[] @description('Tags for resources') param tags object = {} +@description('When true, makes the ACA environment internal (VNet-integrated, no public ingress).') +param isPrivate bool = false + +@description('ACA infrastructure subnet id (required when isPrivate=true). Must be /23 or larger, delegated to Microsoft.App/environments.') +param infrastructureSubnetId string = '' + // Use Azure Verified Module for Container Apps Environment module containerAppsEnvironment 'br:mcr.microsoft.com/bicep/avm/res/app/managed-environment:0.11.3' = { @@ -39,9 +45,11 @@ module containerAppsEnvironment 'br:mcr.microsoft.com/bicep/avm/res/app/managed- workloadProfileType: 'Consumption' } ] - platformReservedCidr: '172.17.17.0/24' - platformReservedDnsIP: '172.17.17.17' - publicNetworkAccess: 'Enabled' + infrastructureSubnetResourceId: isPrivate ? infrastructureSubnetId : '' + internal: isPrivate + platformReservedCidr: isPrivate ? '' : '172.17.17.0/24' + platformReservedDnsIP: isPrivate ? '' : '172.17.17.17' + publicNetworkAccess: isPrivate ? 'Disabled' : 'Enabled' managedIdentities: { systemAssigned: true userAssignedResourceIds: userAssignedResourceIds diff --git a/infra/bicep/modules/container-registry.bicep b/infra/bicep/modules/container-registry.bicep index cc24345..0212853 100644 --- a/infra/bicep/modules/container-registry.bicep +++ b/infra/bicep/modules/container-registry.bicep @@ -4,10 +4,10 @@ param containerRegistryName string @description('Optional: Location for all resources. Default is the resource group location') param location string = resourceGroup().location -@description('Optional: Container Registry SKU. Default is Basic') +@description('Optional: Container Registry SKU. Default is Basic (switches to Premium automatically when isPrivate=true).') param sku string = 'Basic' -@description('Optional: Admin user enabled. Default is true') +@description('Optional: Admin user enabled. Default is true (forced off when isPrivate=true)') param adminUserEnabled bool = true @description('Public network access setting for the Azure Container Registry') @@ -16,6 +16,15 @@ param publicNetworkAccess string = 'Enabled' @description('Zone redundancy setting for the Azure Container Registry') param zoneRedundancy string = 'Disabled' +@description('When true, forces Premium SKU + disables admin + public access and deploys a private endpoint.') +param isPrivate bool = false + +@description('Subnet resource id for the private endpoint (required when isPrivate=true)') +param privateEndpointSubnetId string = '' + +@description('Private DNS zone resource id for ACR (required when isPrivate=true)') +param acrPrivateDnsZoneId string = '' + @description('Managed Identity that will be given access to the Container Registry') param roleAssignedManagedIdentityPrincipalIds string[] @@ -46,15 +55,19 @@ var roleAssignmentsAcrDelete = [ } ] +var effectiveSku = isPrivate ? 'Premium' : sku +var effectiveAdmin = isPrivate ? false : adminUserEnabled +var effectivePublic = isPrivate ? 'Disabled' : publicNetworkAccess + // Use Azure Verified Module for Container Registry module containerRegistry 'br:mcr.microsoft.com/bicep/avm/res/container-registry/registry:0.9.3' = { params: { name: containerRegistryName location: location tags: tags - acrSku: sku - acrAdminUserEnabled: adminUserEnabled - publicNetworkAccess: publicNetworkAccess + acrSku: effectiveSku + acrAdminUserEnabled: effectiveAdmin + publicNetworkAccess: effectivePublic zoneRedundancy: zoneRedundancy roleAssignments: concat(roleAssignmentsAcrPull, roleAssignmentsAcrPush, roleAssignmentsAcrDelete) } @@ -69,3 +82,21 @@ output systemAssignedMIPrincipalId string? = containerRegistry.outputs.?systemAs output credentialSetsSystemAssignedMIPrincipalIds array = containerRegistry.outputs.credentialSetsSystemAssignedMIPrincipalIds output credentialSetsResourceIds array = containerRegistry.outputs.credentialSetsResourceIds output privateEndpoints array = containerRegistry.outputs.privateEndpoints + +resource acrRef 'Microsoft.ContainerRegistry/registries@2023-11-01-preview' existing = { + name: containerRegistryName + dependsOn: [ containerRegistry ] +} + +module pe 'private-endpoint.bicep' = if (isPrivate) { + name: 'acr-pe-${uniqueString(containerRegistryName)}' + params: { + name: '${containerRegistryName}-pe' + location: location + subnetId: privateEndpointSubnetId + targetResourceId: acrRef.id + groupIds: [ 'registry' ] + privateDnsZoneIds: empty(acrPrivateDnsZoneId) ? [] : [ acrPrivateDnsZoneId ] + tags: tags + } +} diff --git a/infra/bicep/modules/cosmos-db.bicep b/infra/bicep/modules/cosmos-db.bicep index fe6cda0..5bf7885 100644 --- a/infra/bicep/modules/cosmos-db.bicep +++ b/infra/bicep/modules/cosmos-db.bicep @@ -19,6 +19,15 @@ param zoneRedundant bool = false @description('Optional: Tags for resources') param tags object = {} +@description('When true, disables public network access and deploys a private endpoint.') +param isPrivate bool = false + +@description('Subnet resource id for the private endpoint (required when isPrivate=true)') +param privateEndpointSubnetId string = '' + +@description('Private DNS zone resource id for Cosmos SQL API (required when isPrivate=true)') +param cosmosSqlPrivateDnsZoneId string = '' + // Use Azure Verified Module for Cosmos DB module cosmosDb 'br:mcr.microsoft.com/bicep/avm/res/document-db/database-account:0.16.0' = { @@ -33,7 +42,7 @@ module cosmosDb 'br:mcr.microsoft.com/bicep/avm/res/document-db/database-account disableLocalAuthentication: true backupPolicyContinuousTier: 'Continuous7Days' networkRestrictions: { - publicNetworkAccess: 'Enabled' + publicNetworkAccess: isPrivate ? 'Disabled' : 'Enabled' } zoneRedundant: zoneRedundant sqlDatabases: [ @@ -66,6 +75,24 @@ module cosmosDb 'br:mcr.microsoft.com/bicep/avm/res/document-db/database-account } } +resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2024-05-15' existing = { + name: cosmosAccountName + dependsOn: [ cosmosDb ] +} + +module pe 'private-endpoint.bicep' = if (isPrivate) { + name: 'cosmos-pe-${uniqueString(cosmosAccountName)}' + params: { + name: '${cosmosAccountName}-pe' + location: location + subnetId: privateEndpointSubnetId + targetResourceId: cosmosAccount.id + groupIds: [ 'Sql' ] + privateDnsZoneIds: empty(cosmosSqlPrivateDnsZoneId) ? [] : [ cosmosSqlPrivateDnsZoneId ] + tags: tags + } +} + output cosmosAccountName string = cosmosDb.outputs.name output cosmosEndpoint string = cosmosDb.outputs.endpoint output cosmosDBName string = cosmosDbName diff --git a/infra/bicep/modules/jumpbox.bicep b/infra/bicep/modules/jumpbox.bicep new file mode 100644 index 0000000..610dab8 --- /dev/null +++ b/infra/bicep/modules/jumpbox.bicep @@ -0,0 +1,120 @@ +// Linux jumpbox VM for operator access over Azure Bastion. +// - No public IP. +// - UAMI attached with AcrPush/AcrPull and Contributor (scoped RG) so scripts +// 1-3 can run end-to-end from inside the VNet. +// - cloud-init installs Azure CLI, Docker, Bicep. + +@description('Location for the VM') +param location string = resourceGroup().location + +@description('VM name') +param name string + +@description('Subnet id for the VM NIC') +param subnetId string + +@description('VM size. B-series default — cheap, enough for az cli + docker.') +param vmSize string = 'Standard_B2s' + +@description('Admin username for SSH (accessed via Bastion)') +param adminUsername string = 'azureuser' + +@description('SSH public key used to log in (via Bastion)') +@secure() +param adminPublicKey string + +@description('User-assigned managed identity resource id to attach to the VM') +param userAssignedIdentityId string + +@description('Tags for resources') +param tags object = {} + +var cloudInit = ''' +#cloud-config +package_update: true +package_upgrade: false +packages: + - ca-certificates + - curl + - gnupg + - lsb-release + - jq + - git +runcmd: + - curl -sL https://aka.ms/InstallAzureCLIDeb | bash + - az bicep install || true + - install -m 0755 -d /etc/apt/keyrings + - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg + - chmod a+r /etc/apt/keyrings/docker.gpg + - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list + - apt-get update + - apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin + - usermod -aG docker azureuser +''' + +resource nic 'Microsoft.Network/networkInterfaces@2023-11-01' = { + name: '${name}-nic' + location: location + tags: tags + properties: { + ipConfigurations: [ + { + name: 'ipconfig' + properties: { + subnet: { id: subnetId } + privateIPAllocationMethod: 'Dynamic' + } + } + ] + } +} + +resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = { + name: name + location: location + tags: tags + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${userAssignedIdentityId}': {} + } + } + properties: { + hardwareProfile: { vmSize: vmSize } + storageProfile: { + imageReference: { + publisher: 'Canonical' + offer: 'ubuntu-24_04-lts' + sku: 'server' + version: 'latest' + } + osDisk: { + createOption: 'FromImage' + managedDisk: { storageAccountType: 'StandardSSD_LRS' } + } + } + osProfile: { + computerName: name + adminUsername: adminUsername + customData: base64(cloudInit) + linuxConfiguration: { + disablePasswordAuthentication: true + ssh: { + publicKeys: [ + { + path: '/home/${adminUsername}/.ssh/authorized_keys' + keyData: adminPublicKey + } + ] + } + } + } + networkProfile: { + networkInterfaces: [ { id: nic.id } ] + } + } +} + +output vmId string = vm.id +output vmName string = vm.name +output nicPrivateIp string = nic.properties.ipConfigurations[0].properties.privateIPAddress diff --git a/infra/bicep/modules/log-analytics-ws.bicep b/infra/bicep/modules/log-analytics-ws.bicep index d0af93a..9254706 100644 --- a/infra/bicep/modules/log-analytics-ws.bicep +++ b/infra/bicep/modules/log-analytics-ws.bicep @@ -10,6 +10,9 @@ param roleAssignedManagedIdentityPrincipalIds string[] @description('Tags for resources') param tags object = {} +@description('When true, disables public ingestion/query + local auth (access via AMPLS).') +param isPrivate bool = false + // Use Azure Verified Module for Log Analytics Workspace module logAnalytics 'br:mcr.microsoft.com/bicep/avm/res/operational-insights/workspace:0.12.0' = { params: { @@ -18,6 +21,11 @@ module logAnalytics 'br:mcr.microsoft.com/bicep/avm/res/operational-insights/wor tags: tags skuName: 'PerGB2018' dataRetention: 30 + publicNetworkAccessForIngestion: isPrivate ? 'Disabled' : 'Enabled' + publicNetworkAccessForQuery: isPrivate ? 'Disabled' : 'Enabled' + features: { + disableLocalAuth: isPrivate + } roleAssignments:[ for principalId in roleAssignedManagedIdentityPrincipalIds: { principalId: principalId diff --git a/infra/bicep/modules/network.bicep b/infra/bicep/modules/network.bicep new file mode 100644 index 0000000..88b9fcd --- /dev/null +++ b/infra/bicep/modules/network.bicep @@ -0,0 +1,236 @@ +// Virtual network + subnets + NSGs for zero-trust deployment. +// Six subnets: +// snet-aca-infra (/23) — delegated to Microsoft.App/environments (workload-profiles ACA) +// snet-pe (/26) — shared Private Endpoints +// snet-jumpbox (/27) — jump VM NIC +// AzureBastionSubnet (/26) — required name for Azure Bastion +// snet-build (/27) — reserved for ACR Tasks / private build agents +// snet-mgmt (/27) — reserved for future self-hosted CI/CD agents + +@description('Location for all resources') +param location string = resourceGroup().location + +@description('Virtual network name') +param vnetName string + +@description('Address space for the virtual network') +param vnetAddressPrefix string = '10.50.0.0/16' + +@description('Tags for resources') +param tags object = {} + +// ---- NSGs ------------------------------------------------------------------- + +resource nsgPe 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-pe' + location: location + tags: tags + properties: { + securityRules: [ + { + name: 'AllowHttpsInboundFromVnet' + properties: { + priority: 100 + direction: 'Inbound' + access: 'Allow' + protocol: 'Tcp' + sourceAddressPrefix: 'VirtualNetwork' + sourcePortRange: '*' + destinationAddressPrefix: 'VirtualNetwork' + destinationPortRange: '443' + } + } + ] + } +} + +resource nsgJumpbox 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-jumpbox' + location: location + tags: tags + properties: { + securityRules: [ + { + name: 'AllowBastionInbound' + properties: { + priority: 100 + direction: 'Inbound' + access: 'Allow' + protocol: 'Tcp' + sourceAddressPrefix: 'VirtualNetwork' + sourcePortRange: '*' + destinationAddressPrefix: 'VirtualNetwork' + destinationPortRanges: [ '22', '3389' ] + } + } + ] + } +} + +resource nsgBastion 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-bastion' + location: location + tags: tags + properties: { + securityRules: [ + { + name: 'AllowHttpsInbound' + properties: { priority: 120, direction: 'Inbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: 'Internet', sourcePortRange: '*', destinationAddressPrefix: '*', destinationPortRange: '443' } + } + { + name: 'AllowGatewayManagerInbound' + properties: { priority: 130, direction: 'Inbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: 'GatewayManager', sourcePortRange: '*', destinationAddressPrefix: '*', destinationPortRange: '443' } + } + { + name: 'AllowAzureLoadBalancerInbound' + properties: { priority: 140, direction: 'Inbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: 'AzureLoadBalancer', sourcePortRange: '*', destinationAddressPrefix: '*', destinationPortRange: '443' } + } + { + name: 'AllowBastionHostCommunication' + properties: { priority: 150, direction: 'Inbound', access: 'Allow', protocol: '*', sourceAddressPrefix: 'VirtualNetwork', sourcePortRange: '*', destinationAddressPrefix: 'VirtualNetwork', destinationPortRanges: [ '8080', '5701' ] } + } + { + name: 'AllowSshRdpOutbound' + properties: { priority: 100, direction: 'Outbound', access: 'Allow', protocol: '*', sourceAddressPrefix: '*', sourcePortRange: '*', destinationAddressPrefix: 'VirtualNetwork', destinationPortRanges: [ '22', '3389' ] } + } + { + name: 'AllowAzureCloudOutbound' + properties: { priority: 110, direction: 'Outbound', access: 'Allow', protocol: 'Tcp', sourceAddressPrefix: '*', sourcePortRange: '*', destinationAddressPrefix: 'AzureCloud', destinationPortRange: '443' } + } + { + name: 'AllowBastionCommunication' + properties: { priority: 120, direction: 'Outbound', access: 'Allow', protocol: '*', sourceAddressPrefix: 'VirtualNetwork', sourcePortRange: '*', destinationAddressPrefix: 'VirtualNetwork', destinationPortRanges: [ '8080', '5701' ] } + } + { + name: 'AllowGetSessionInformation' + properties: { priority: 130, direction: 'Outbound', access: 'Allow', protocol: '*', sourceAddressPrefix: '*', sourcePortRange: '*', destinationAddressPrefix: 'Internet', destinationPortRange: '80' } + } + ] + } +} + +resource nsgAca 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-aca' + location: location + tags: tags + properties: { + // Intentionally permissive within the VNet; ACA platform manages its own + // subnet rules. Do not block traffic — see Azure docs for ACA NSG limits. + securityRules: [] + } +} + +resource nsgBuild 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-build' + location: location + tags: tags + properties: { securityRules: [] } +} + +resource nsgMgmt 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-mgmt' + location: location + tags: tags + properties: { securityRules: [] } +} + +resource nsgAppSvc 'Microsoft.Network/networkSecurityGroups@2023-11-01' = { + name: '${vnetName}-nsg-appsvc' + location: location + tags: tags + // Permissive within VNet; App Service regional VNet integration handles + // outbound traffic; inbound is via separate private endpoint in snet-pe. + properties: { securityRules: [] } +} + +// ---- VNet + Subnets --------------------------------------------------------- + +resource vnet 'Microsoft.Network/virtualNetworks@2023-11-01' = { + name: vnetName + location: location + tags: tags + properties: { + addressSpace: { + addressPrefixes: [ vnetAddressPrefix ] + } + subnets: [ + { + name: 'snet-aca-infra' + properties: { + addressPrefix: '10.50.0.0/23' + networkSecurityGroup: { id: nsgAca.id } + delegations: [ + { + name: 'aca-delegation' + properties: { serviceName: 'Microsoft.App/environments' } + } + ] + privateEndpointNetworkPolicies: 'Disabled' + } + } + { + name: 'snet-pe' + properties: { + addressPrefix: '10.50.2.0/26' + networkSecurityGroup: { id: nsgPe.id } + privateEndpointNetworkPolicies: 'Disabled' + } + } + { + name: 'snet-jumpbox' + properties: { + addressPrefix: '10.50.2.64/27' + networkSecurityGroup: { id: nsgJumpbox.id } + } + } + { + name: 'AzureBastionSubnet' + properties: { + addressPrefix: '10.50.2.128/26' + networkSecurityGroup: { id: nsgBastion.id } + } + } + { + name: 'snet-build' + properties: { + addressPrefix: '10.50.2.192/27' + networkSecurityGroup: { id: nsgBuild.id } + privateEndpointNetworkPolicies: 'Disabled' + } + } + { + name: 'snet-mgmt' + properties: { + addressPrefix: '10.50.2.224/27' + networkSecurityGroup: { id: nsgMgmt.id } + } + } + { + name: 'snet-appsvc' + properties: { + addressPrefix: '10.50.4.0/26' + networkSecurityGroup: { id: nsgAppSvc.id } + delegations: [ + { + name: 'appsvc-delegation' + properties: { serviceName: 'Microsoft.Web/serverFarms' } + } + ] + serviceEndpoints: [ + { service: 'Microsoft.CognitiveServices' } + ] + } + } + ] + } +} + +output vnetId string = vnet.id +output vnetName string = vnet.name +output acaInfraSubnetId string = '${vnet.id}/subnets/snet-aca-infra' +output peSubnetId string = '${vnet.id}/subnets/snet-pe' +output jumpboxSubnetId string = '${vnet.id}/subnets/snet-jumpbox' +output bastionSubnetId string = '${vnet.id}/subnets/AzureBastionSubnet' +output buildSubnetId string = '${vnet.id}/subnets/snet-build' +output mgmtSubnetId string = '${vnet.id}/subnets/snet-mgmt' +output appSvcSubnetId string = '${vnet.id}/subnets/snet-appsvc' diff --git a/infra/bicep/modules/private-dns.bicep b/infra/bicep/modules/private-dns.bicep new file mode 100644 index 0000000..bd0b199 --- /dev/null +++ b/infra/bicep/modules/private-dns.bicep @@ -0,0 +1,68 @@ +// Private DNS zones required by zero-trust architecture. +// One zone per service group; each zone is linked to the workload VNet so the +// jumpbox and container apps resolve private-endpoint IPs from the VNet. + +@description('Name of the VNet to link zones to') +param vnetId string + +@description('Location (zones are global; required for vnet-links).') +param location string = 'global' + +@description('Tags for resources') +param tags object = {} + +var zoneNames = [ + // Cosmos DB SQL API + 'privatelink.documents.azure.com' + // Storage — blob (add file/queue/table only if you use them) + 'privatelink.blob.${environment().suffixes.storage}' + // Azure Container Registry + 'privatelink.azurecr.io' + // Azure AI services (OpenAI + Cognitive Services + Foundry services) + 'privatelink.openai.azure.com' + 'privatelink.cognitiveservices.azure.com' + 'privatelink.services.ai.azure.com' + // App Configuration (used when enabled) + 'privatelink.azconfig.io' + // Azure Monitor Private Link Scope (AMPLS) — reuses the storage blob zone + // above for AMPLS's blob link, so do NOT redeclare it here. + 'privatelink.monitor.azure.com' + 'privatelink.oms.opinsights.azure.com' + 'privatelink.ods.opinsights.azure.com' + 'privatelink.agentsvc.azure-automation.net' + // App Service / Web App private endpoints + 'privatelink.azurewebsites.net' +] + +resource zones 'Microsoft.Network/privateDnsZones@2024-06-01' = [for z in zoneNames: { + name: z + location: location + tags: tags +}] + +resource links 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = [for (z, i) in zoneNames: { + name: '${zones[i].name}/link-${uniqueString(vnetId)}' + location: location + tags: tags + properties: { + virtualNetwork: { id: vnetId } + registrationEnabled: false + } + dependsOn: [ zones[i] ] +}] + +// Keyed outputs so the main template can wire each PE to its zone. +output cosmosSqlZoneId string = zones[0].id +output blobZoneStorageSuffixId string = zones[1].id +output acrZoneId string = zones[2].id +output openAiZoneId string = zones[3].id +output cognitiveServicesZoneId string = zones[4].id +output aiServicesZoneId string = zones[5].id +output appConfigZoneId string = zones[6].id +output monitorZoneId string = zones[7].id +output omsZoneId string = zones[8].id +output odsZoneId string = zones[9].id +output agentsvcZoneId string = zones[10].id +output appServiceZoneId string = zones[11].id +// AMPLS blob link reuses the storage blob zone to avoid duplicate zone. +output blobFixedZoneId string = zones[1].id diff --git a/infra/bicep/modules/private-endpoint.bicep b/infra/bicep/modules/private-endpoint.bicep new file mode 100644 index 0000000..97153b7 --- /dev/null +++ b/infra/bicep/modules/private-endpoint.bicep @@ -0,0 +1,56 @@ +// Reusable Private Endpoint + Private DNS Zone Group module. +// Creates one Microsoft.Network/privateEndpoints resource targeting an +// existing PaaS resource, and registers its IP in the given private DNS zones. + +@description('Location for the private endpoint') +param location string = resourceGroup().location + +@description('Name of the private endpoint') +param name string + +@description('Subnet resource id where the PE NIC is placed') +param subnetId string + +@description('Resource id of the target PaaS resource') +param targetResourceId string + +@description('groupIds for the PLS (e.g. Sql, blob, registry, account, azuremonitor, configurationStores)') +param groupIds string[] + +@description('Array of private DNS zone resource ids to register the PE in') +param privateDnsZoneIds string[] = [] + +@description('Tags for resources') +param tags object = {} + +resource pe 'Microsoft.Network/privateEndpoints@2023-11-01' = { + name: name + location: location + tags: tags + properties: { + subnet: { id: subnetId } + privateLinkServiceConnections: [ + { + name: name + properties: { + privateLinkServiceId: targetResourceId + groupIds: groupIds + } + } + ] + } +} + +resource dnsGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2023-11-01' = if (!empty(privateDnsZoneIds)) { + name: 'default' + parent: pe + properties: { + privateDnsZoneConfigs: [for (zoneId, i) in privateDnsZoneIds: { + name: 'config${i}' + properties: { privateDnsZoneId: zoneId } + }] + } +} + +output peId string = pe.id +output peName string = pe.name diff --git a/infra/bicep/modules/storage.bicep b/infra/bicep/modules/storage.bicep index 0e439dd..48f45e8 100644 --- a/infra/bicep/modules/storage.bicep +++ b/infra/bicep/modules/storage.bicep @@ -13,6 +13,15 @@ param docsContainerName string = 'opportunity-documents' @description('Optional: Tags for resources') param tags object = {} +@description('When true, disables public network access and deploys a private endpoint for blob.') +param isPrivate bool = false + +@description('Subnet resource id for the private endpoint (required when isPrivate=true)') +param privateEndpointSubnetId string = '' + +@description('Private DNS zone resource id for blob (required when isPrivate=true)') +param blobPrivateDnsZoneId string = '' + var accountRoleAssignments array = [for principalId in roleAssignedManagedIdentityPrincipalIds: { principalId: principalId principalType: 'ServicePrincipal' @@ -52,9 +61,10 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.27.1' = { accessTier: 'Hot' allowSharedKeyAccess: false enableHierarchicalNamespace: false - publicNetworkAccess: 'Enabled' + publicNetworkAccess: isPrivate ? 'Disabled' : 'Enabled' networkAcls: { - defaultAction: 'Allow' + defaultAction: isPrivate ? 'Deny' : 'Allow' + bypass: 'AzureServices' } blobServices: { automaticSnapshotPolicyEnabled: true @@ -79,3 +89,21 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.27.1' = { output name string = storageAccount.outputs.name output resourceId string = storageAccount.outputs.resourceId output queueUrl string = 'https://${storageAccount.outputs.name}.queue.${environment().suffixes.storage}/' + +resource storageAccountRef 'Microsoft.Storage/storageAccounts@2023-05-01' existing = { + name: storageAccountName + dependsOn: [ storageAccount ] +} + +module pe 'private-endpoint.bicep' = if (isPrivate) { + name: 'storage-pe-${uniqueString(storageAccountName)}' + params: { + name: '${storageAccountName}-pe-blob' + location: location + subnetId: privateEndpointSubnetId + targetResourceId: storageAccountRef.id + groupIds: [ 'blob' ] + privateDnsZoneIds: empty(blobPrivateDnsZoneId) ? [] : [ blobPrivateDnsZoneId ] + tags: tags + } +} diff --git a/infra/bicep/modules/web-app-container.bicep b/infra/bicep/modules/web-app-container.bicep new file mode 100644 index 0000000..da69b7b --- /dev/null +++ b/infra/bicep/modules/web-app-container.bicep @@ -0,0 +1,167 @@ +// Linux Web App for Containers with: +// * UAMI for ACR pull +// * Regional VNet integration (outbound) into snet-appsvc +// * Private endpoint in snet-pe (inbound) when isPrivate=true +// * publicNetworkAccess=Disabled when isPrivate=true +// +// Container image is pulled from ACR using the supplied user-assigned identity. + +@description('Web App name') +param name string + +@description('Location for resources') +param location string = resourceGroup().location + +@description('Tags for resources') +param tags object = {} + +@description('App Service Plan resource ID') +param appServicePlanId string + +@description('Container image reference, e.g. myacr.azurecr.io/ai-invest-api:latest') +param containerImage string + +@description('Container registry login server, e.g. myacr.azurecr.io') +param containerRegistryServer string + +@description('User-assigned managed identity resource ID for ACR pull and runtime auth.') +param userAssignedIdentityResourceId string + +@description('Client ID of the user-assigned identity (exposed to the app as AZURE_CLIENT_ID).') +param userAssignedIdentityClientId string + +@description('Container target port the app listens on (set as WEBSITES_PORT)') +param targetPort int = 8090 + +@description('Subnet resource ID for regional VNet integration (Microsoft.Web/serverFarms delegation).') +param vnetIntegrationSubnetId string = '' + +@description('When true, locks the app down: publicNetworkAccess=Disabled and creates a private endpoint.') +param isPrivate bool = true + +@description('Subnet resource ID for the private endpoint (only when isPrivate=true).') +param privateEndpointSubnetId string = '' + +@description('Private DNS zone resource ID for privatelink.azurewebsites.net (only when isPrivate=true).') +param appServicePrivateDnsZoneId string = '' + +@description('Additional app settings (array of {name,value}).') +param appSettings array = [] + +@description('Health check path (e.g. /health, /). Empty disables health check.') +param healthCheckPath string = '' + +var baseAppSettings = [ + { + name: 'WEBSITES_PORT' + value: string(targetPort) + } + { + name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE' + value: 'false' + } + { + name: 'DOCKER_REGISTRY_SERVER_URL' + value: 'https://${containerRegistryServer}' + } + { + name: 'DOCKER_ENABLE_CI' + value: 'true' + } + { + name: 'AZURE_CLIENT_ID' + value: userAssignedIdentityClientId + } +] + +// When VNet-integrated, we want all outbound traffic (including DNS lookups +// to private endpoints) to traverse the integrated VNet so private DNS zones +// resolve correctly. +var vnetRouteAppSettings = empty(vnetIntegrationSubnetId) ? [] : [ + { + name: 'WEBSITE_VNET_ROUTE_ALL' + value: '1' + } + { + name: 'WEBSITE_DNS_SERVER' + value: '168.63.129.16' + } + { + // Pull container image from ACR through the integrated VNet so that + // private-endpoint-only registries (publicNetworkAccess=Disabled) work. + name: 'WEBSITE_PULL_IMAGE_OVER_VNET' + value: 'true' + } +] + +resource site 'Microsoft.Web/sites@2024-04-01' = { + name: name + location: location + tags: tags + kind: 'app,linux,container' + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${userAssignedIdentityResourceId}': {} + } + } + properties: { + serverFarmId: appServicePlanId + httpsOnly: true + publicNetworkAccess: isPrivate ? 'Disabled' : 'Enabled' + keyVaultReferenceIdentity: userAssignedIdentityResourceId + virtualNetworkSubnetId: empty(vnetIntegrationSubnetId) ? null : vnetIntegrationSubnetId + vnetRouteAllEnabled: !empty(vnetIntegrationSubnetId) + siteConfig: { + linuxFxVersion: 'DOCKER|${containerImage}' + acrUseManagedIdentityCreds: true + acrUserManagedIdentityID: userAssignedIdentityClientId + alwaysOn: true + ftpsState: 'Disabled' + http20Enabled: true + minTlsVersion: '1.2' + healthCheckPath: empty(healthCheckPath) ? null : healthCheckPath + appSettings: concat(baseAppSettings, vnetRouteAppSettings, appSettings) + } + } +} + +// Private endpoint for inbound traffic (only when isPrivate=true). +resource pe 'Microsoft.Network/privateEndpoints@2024-05-01' = if (isPrivate) { + name: '${name}-pe' + location: location + tags: tags + properties: { + subnet: { + id: privateEndpointSubnetId + } + privateLinkServiceConnections: [ + { + name: '${name}-pe-conn' + properties: { + privateLinkServiceId: site.id + groupIds: [ 'sites' ] + } + } + ] + } +} + +resource peDnsGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2024-05-01' = if (isPrivate) { + name: 'default' + parent: pe + properties: { + privateDnsZoneConfigs: [ + { + name: 'azurewebsites' + properties: { + privateDnsZoneId: appServicePrivateDnsZoneId + } + } + ] + } +} + +output id string = site.id +output name string = site.name +output defaultHostName string = site.properties.defaultHostName diff --git a/web-app/infra/bicep/main.aca.bicep.bak b/web-app/infra/bicep/main.aca.bicep.bak new file mode 100644 index 0000000..4234027 --- /dev/null +++ b/web-app/infra/bicep/main.aca.bicep.bak @@ -0,0 +1,131 @@ +@description('Name prefix for frontend resources') +param namePrefix string = 'aiinvest' + +@description('Environment name (dev, staging, prod)') +param environment string = 'dev' + +@description('Container registry server') +param containerRegistryServer string + +@description('Container image') +param containerImage string + +@description('CORS allowed origins') +param allowOrigins string[] = ['*'] + +@description('When true, deploys the container app with internal ingress only (no public endpoint).') +param isPrivate bool = true + +@description('CPU cores for the container') +param cpuCores int = 1 + +@description('Memory in GB for the container') +param memoryInGB string = '2Gi' + +@description('Backend API URL for frontend configuration') +param backendApiUrl string = '' + +@description('Container Apps Environment resource name where the container apps will be deployed') +param containerAppsEnvironment string + +@description('User Assigned Identity Resource Name used as identity for the api app') +param userAssignedIdentityName string + +@description('Tags for resources') +param tags object = { + Environment: environment + Project: 'ai-investment-analysis-sample' + Component: 'web app' +} + +var appName = '${namePrefix}-web-${environment}' + +// Environment variables for the frontend +var environmentVariables = !empty(backendApiUrl) ? [ + { + name: 'VITE_API_BASE_URL' + value: backendApiUrl + } +] : [] + +// Fetch existing User Assigned Identity +resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = { + scope: resourceGroup() + name: userAssignedIdentityName +} + +resource containerAppsEnvironmentResource 'Microsoft.App/managedEnvironments@2023-05-01' existing = { + name: containerAppsEnvironment + scope: resourceGroup() +} + +// Use Azure Verified Module for Container App (Web App) +module webApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0' = { + name: 'webAppDeployment' + params: { + name: appName + location: containerAppsEnvironmentResource.location + tags: tags + environmentResourceId: containerAppsEnvironmentResource.id + corsPolicy: { + allowCredentials: true + allowedOrigins: allowOrigins + allowedMethods: ['*'] + allowedHeaders: ['*'] + } + ingressAllowInsecure: false + containers: [ + { + name: appName + image: containerImage + resources: { + cpu: cpuCores + memory: memoryInGB + } + env: environmentVariables + probes: [ + { + type: 'Liveness' + httpGet: { + path: '/' + port: 8080 + } + initialDelaySeconds: 5 + periodSeconds: 30 + } + ] + } + ] + ingressExternal: !isPrivate + ingressTargetPort: 8080 + managedIdentities: { + systemAssigned: false + userAssignedResourceIds: [ userAssignedIdentity.id ] + } + registries: [ + { + server: containerRegistryServer + identity: userAssignedIdentity.id + } + ] + scaleSettings: { + minReplicas: 1 + maxReplicas: 1 + rules: [ + { + name: 'http-scaler' + http: { + metadata: { + concurrentRequests: '10' + } + } + } + ] + } + } +} + + +output containerAppName string = webApp.outputs.name +output containerAppUrl string = webApp.outputs.fqdn +output containerAppId string = webApp.outputs.resourceId diff --git a/web-app/infra/bicep/main.bicep b/web-app/infra/bicep/main.bicep index e622cbf..9a62396 100644 --- a/web-app/infra/bicep/main.bicep +++ b/web-app/infra/bicep/main.bicep @@ -10,24 +10,27 @@ param containerRegistryServer string @description('Container image') param containerImage string -@description('CORS allowed origins') -param allowOrigins string[] = ['*'] - -@description('CPU cores for the container') -param cpuCores int = 1 - -@description('Memory in GB for the container') -param memoryInGB string = '2Gi' +@description('When true, deploys the web app with public access disabled and a private endpoint.') +param isPrivate bool = true @description('Backend API URL for frontend configuration') param backendApiUrl string = '' -@description('Container Apps Environment resource name where the container apps will be deployed') -param containerAppsEnvironment string +@description('App Service Plan resource ID') +param appServicePlanId string -@description('User Assigned Identity Resource Name used as identity for the api app') +@description('User Assigned Identity name (existing in same RG).') param userAssignedIdentityName string +@description('Subnet ID for regional VNet integration (snet-appsvc).') +param vnetIntegrationSubnetId string + +@description('Subnet ID for the private endpoint (snet-pe).') +param privateEndpointSubnetId string + +@description('Private DNS zone ID for privatelink.azurewebsites.net') +param appServicePrivateDnsZoneId string + @description('Tags for resources') param tags object = { Environment: environment @@ -37,7 +40,11 @@ param tags object = { var appName = '${namePrefix}-web-${environment}' -// Environment variables for the frontend +resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = { + scope: resourceGroup() + name: userAssignedIdentityName +} + var environmentVariables = !empty(backendApiUrl) ? [ { name: 'VITE_API_BASE_URL' @@ -45,84 +52,27 @@ var environmentVariables = !empty(backendApiUrl) ? [ } ] : [] -// Fetch existing User Assigned Identity -resource userAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = { - scope: resourceGroup() - name: userAssignedIdentityName -} - -resource containerAppsEnvironmentResource 'Microsoft.App/managedEnvironments@2023-05-01' existing = { - name: containerAppsEnvironment - scope: resourceGroup() -} - -// Use Azure Verified Module for Container App (Web App) -module webApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0' = { +module webApp '../../../infra/bicep/modules/web-app-container.bicep' = { name: 'webAppDeployment' params: { name: appName - location: containerAppsEnvironmentResource.location + location: resourceGroup().location tags: tags - environmentResourceId: containerAppsEnvironmentResource.id - corsPolicy: { - allowCredentials: true - allowedOrigins: allowOrigins - allowedMethods: ['*'] - allowedHeaders: ['*'] - } - ingressAllowInsecure: false - containers: [ - { - name: appName - image: containerImage - resources: { - cpu: cpuCores - memory: memoryInGB - } - env: environmentVariables - probes: [ - { - type: 'Liveness' - httpGet: { - path: '/' - port: 8080 - } - initialDelaySeconds: 5 - periodSeconds: 30 - } - ] - } - ] - ingressExternal: true - ingressTargetPort: 8080 - managedIdentities: { - systemAssigned: false - userAssignedResourceIds: [ userAssignedIdentity.id ] - } - registries: [ - { - server: containerRegistryServer - identity: userAssignedIdentity.id - } - ] - scaleSettings: { - minReplicas: 1 - maxReplicas: 1 - rules: [ - { - name: 'http-scaler' - http: { - metadata: { - concurrentRequests: '10' - } - } - } - ] - } + appServicePlanId: appServicePlanId + containerImage: containerImage + containerRegistryServer: containerRegistryServer + userAssignedIdentityResourceId: userAssignedIdentity.id + userAssignedIdentityClientId: userAssignedIdentity.properties.clientId + targetPort: 8080 + healthCheckPath: '/' + isPrivate: isPrivate + vnetIntegrationSubnetId: vnetIntegrationSubnetId + privateEndpointSubnetId: privateEndpointSubnetId + appServicePrivateDnsZoneId: appServicePrivateDnsZoneId + appSettings: environmentVariables } } - output containerAppName string = webApp.outputs.name -output containerAppUrl string = webApp.outputs.fqdn -output containerAppId string = webApp.outputs.resourceId +output containerAppUrl string = webApp.outputs.defaultHostName +output containerAppId string = webApp.outputs.id From f0552b40501e9e41f2c7a683411878def2a06fac Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Wed, 29 Apr 2026 14:54:30 +0300 Subject: [PATCH 2/8] fix: Improve formatting in README.md for better readability --- README.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index d23ec65..ed7ebfb 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,7 @@ The system uses a sophisticated multi-agent architecture: **Investment Analysis Workflow:** ``` -Data Preparation → [Financial Analyst, Risk Analyst, Market Analyst, Compliance Analyst] +Data Preparation → [Financial Analyst, Risk Analyst, Market Analyst, Compliance Analyst] → Analysis Aggregator → Investment Debate Executor → Summary Report Generator ``` @@ -153,17 +153,17 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p ### Key parameters -| Parameter | Default | Description | -|---|---|---| -| `namePrefix` | `invstdemo` | Prefix used for all resource names | -| `environment` | `dev` | Environment tag (`dev`, `staging`, `prod`) | -| `location` | resource group location | Region for most resources | -| `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | -| `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + internal ACA). Set `false` for a public, demo-only topology. | -| `deployJumpbox` | `true` | Deploy a Linux jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | -| `jumpboxAdminPublicKey` | _(empty)_ | **Required when `deployJumpbox=true`** — your SSH public key | -| `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client tunneling) | -| `vnetAddressPrefix` | `10.50.0.0/16` | VNet CIDR when `isPrivate=true` | +| Parameter | Default | Description | +| ----------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------- | +| `namePrefix` | `invstdemo` | Prefix used for all resource names | +| `environment` | `dev` | Environment tag (`dev`, `staging`, `prod`) | +| `location` | resource group location | Region for most resources | +| `aiFoundryLocation` | resource group location | Region for Azure AI Foundry / model deployment | +| `isPrivate` | `true` | Deploy zero-trust topology (VNet + private endpoints + internal ACA). Set `false` for a public, demo-only topology. | +| `deployJumpbox` | `true` | Deploy a Linux jumpbox + Azure Bastion for operator access (only when `isPrivate=true`) | +| `jumpboxAdminPublicKey` | _(empty)_ | **Required when `deployJumpbox=true`** — your SSH public key | +| `bastionSku` | `Standard` | `Basic` or `Standard` (Standard required for native-client tunneling) | +| `vnetAddressPrefix` | `10.50.0.0/16` | VNet CIDR when `isPrivate=true` | > **Note:** The portal one-click flow provisions the Azure infrastructure only. After the deployment finishes, build and push the container images and roll out the apps with the helper scripts: > @@ -275,8 +275,8 @@ npm run dev 1. Create a Cosmos DB account with NoSQL API 2. The application will automatically create the database and containers on first run 3. Ensure your connection endpoint is in the `.env` file -4. Ensure proper access permissions on Cosmos DB account: - +4. Ensure proper access permissions on Cosmos DB account: + Follow the steps in this article: [Connect to Azure Cosmos DB for NoSQL using role-based access control and Microsoft Entra ID](https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/how-to-connect-role-based-access-control?pivots=azure-cli) **Blob Storage:** From 48307e6cc4c1140f847df6275c556cd638d1393a Mon Sep 17 00:00:00 2001 From: Saad Mahmood Date: Wed, 29 Apr 2026 14:59:06 +0300 Subject: [PATCH 3/8] feat: Add full private-deployment documentation for zero-trust topology Co-authored-by: Copilot --- README.md | 10 ++ docs/PRIVATE_DEPLOYMENT.md | 293 +++++++++++++++++++++++++++++++++++++ 2 files changed, 303 insertions(+) create mode 100644 docs/PRIVATE_DEPLOYMENT.md diff --git a/README.md b/README.md index ed7ebfb..6cea80d 100644 --- a/README.md +++ b/README.md @@ -174,6 +174,16 @@ Deploy the full Azure infrastructure (zero-trust topology by default — VNet, p > > See [`infra/1-deploy-azure-infra.sh`](infra/1-deploy-azure-infra.sh) for the equivalent CLI-based deployment with all available flags, and [`_assets/ZERO_TRUST_ARCHITECTURE.md`](_assets/ZERO_TRUST_ARCHITECTURE.md) for the full network topology. +### 📘 Full private-deployment documentation + +The end-to-end reference for the zero-trust topology — every parameter, module, subnet, Private DNS zone, RBAC assignment, app setting, and operational runbook — lives in [`docs/PRIVATE_DEPLOYMENT.md`](docs/PRIVATE_DEPLOYMENT.md). Use it when you need to: + +- Customize VNet sizing, subnets, or NSG rules +- Understand which roles are granted to the workload UAMI and the deployer +- Switch between `isPrivate=true` (zero-trust) and `isPrivate=false` (public demo) +- Operate the jumpbox + Azure Bastion access plane +- Troubleshoot private-endpoint, DNS, or image-pull issues + ## �📦 Prerequisites - **Python 3.11+** (3.13 recommended) diff --git a/docs/PRIVATE_DEPLOYMENT.md b/docs/PRIVATE_DEPLOYMENT.md new file mode 100644 index 0000000..f58514a --- /dev/null +++ b/docs/PRIVATE_DEPLOYMENT.md @@ -0,0 +1,293 @@ +# Private (Zero-Trust) Deployment Guide + +This guide documents **everything you need to deploy, operate, and customize the Agentic AI Investment Analysis sample in its private / zero-trust topology** (`isPrivate=true`). It is the companion to: + +- [`_assets/ZERO_TRUST_ARCHITECTURE.md`](../_assets/ZERO_TRUST_ARCHITECTURE.md) — logical view of the topology +- [`infra/bicep/main.bicep`](../infra/bicep/main.bicep) — the Bicep template that provisions everything below +- [`infra/bicep/main.json`](../infra/bicep/main.json) — the compiled ARM template used by the **Deploy to Azure** button + +> **TL;DR** — In private mode, every PaaS data plane is reached through a Private Endpoint inside a customer-owned VNet. The only public surface is the Azure Bastion control-plane TLS endpoint used by operators. No public DNS records exist for any workload. + +--- + +## 1. Topology at a glance + +

    C0DRncT_AsziYL`j9EZLhuDpU+ z(yxCiPshxazJ=Wi;P_}N~(b0jx&a;!6WpW&IIijMn@--m>bNsK_Y=FB547Swiexh9A z1>Zo$kgtE1Wi7`y zZrnw@V7&)M<{R$ftNZk1sn!-?`sb!l&ydqKK4e%wf{46%A(6MahKRhB&I<+x-s81# z=|ZIV)dc~<*y(Qvn1{q$54uY{Y96xjev$V^FH?|os%Zw!OkQB zb8RZvf9k_9e8oOJ3c^(Z8Z)8F5&O4)uy!_Ps2kKeI`n@0e%!~u2ckfGlJ<~4S#%BtL8K14fZr~uD7b{ z%CT(bziuxe7`_>@Jcn1A(_pcA>89_j+8BSdx%)dQe08(7&~A0|ALO&2?fLoJ$5;OE z^MCxThJR3exX3p2;AfwI;rZd)INU$}7&&?G;C6#Qb`;|qTMI|~|3%NY=#YOD{er@~ z{Nmt5`d_|1v*++3=N38Y!Mi7R4utOAzh=^&j%L^Od=H;GeDUX#y8~ldiYit)zqADO zKo?^C{j@h2gPrpda{98svDvX{uJ+1FPRSEb+@@uLdHtLgpcGMQ&AK-qe;5K^4o}MG z+xaO%=ETZegX^@ZRKx!LiN`I^68mRsBL~yPCGP8^-`NhU1uWg#C#@Zg_g}aB&L()H z>diS^{-4`<%aA!pg!h$lQ*I$brAEwNoZT-|+L3lEq>Fv~mri z=Ww&7RK2{I{GZWt%Wya_fMNX#3ri}`m{g5Ky_>6Qy{nOg`t|i7n5B9BW-u>-+h58Q zKLHwMZkGCJJ#K4xD+xY)vYx#fw^h$f8&X|>DPB3nk8U|oc?=+*2$}epxe)(GIl85v zvHk_g{&vPK1WR$Q2E66D>aa%YkL0?#x{*BS7MK4lrG183u9)II&I{ZD3l23l&cHvg z>8Il3UlAyQs?zWi9L_ju8z$h;Ybr`jy=A)ZpY4vlc-cr-nW$KrGa_D#MjupF=Qi|a z7{^fyf|pm{8C>um+g0&9Jl$oaD1|XbKz&}d5h_(*vs1O`S8m&W-o`U z#KQ|;XFZ8dUXIb7Z{5xLS)el% z|7mY^bx7B2f;ktYG=r|b`XbcW({_u2C#E)k;Bx20vyk}P2laU^?WOAvCl?)3@4JAg z+U*VQR}E&t~)$q~-%WV3k|5)E$M*viUEZDS2+pp51ZBGM#F z^p0E)CSxp^JI56Wo>n;8g%Yl}^o+hzr>Ah8p~`N7lDgRbRW3ukY~wtV$a2`#dGQB7 zT1y$|DEgO3M+1l3s$F{lV=VTM%I-fL} zI%j%8pqw2QO*$TIsr`xarav6(my`w7AD-MS*7L`$rCkS1_JVCzJo`x?kG*^LE-A4Ts-EqNy{KmtSm1A@a01&DIN&nW zZbFLFD)l=|bdL-lttptkABJ<>(eA7ax=AE!1}vS)%gcj515NaqAKjRonf#G#xf+y@ zY%IrI=mYMW@Jd^a%^0AGweK(f$D^v|&`QSrfY(@J+;y<$cubN8&zQ{#WKkPi$P1o0 z^6R_6%O0v;S?SM(0|z>_&y9OMy(e_YBMbf2ny)yoZv7L+m-saPK!kI0Z)*&Gb*jNY zEKcHnn5hR{vVBZTd0gKTi9AOlS%XxjMqU^kN)2MqQb7fqcI{jfRbsu=@Y@v&zo5;n z8~}YBZPeY3{x|boC_ihL*e@}0fm|miKe|Zoexv-N$c-YqT`!8w-w)e@^?QCy;^+h3 zJyAmS$2ZrTrEoR8ylrW>ktS3aX)LVOgto*qy7QGhOrYe-ib_qbWeO1&zCQ8f7dNzv zGUHQ%UG!4BWg8M9O-P1%azf4cp+g|uqqL$T)!^V>GJbg2FE4+jN)7~GJ~J;X(lT&O zpKQ5t{RJlQPXc-LWHV-4+M}0~KOc^6;xw1+eP-_iDF{ni-WH#G0V?%&MX-HkXaiNa_7u4KJvW`X0(kpLaC^!*+M+;?J#p2 zi1HH1LV32Q_)s=u{W95(^wYnkL)QGkE$U6P2u)>G?^$1AUa^0nQ&fc|Yx7VHv-*2N zf#hbU$G)DGB$5@X99kT|+IQW`ZQ6AI#e@Xa6wKvj&emCYJfn9ccgny^i1>v1jlD6if-kifl=ld}S+MEmU)m@MIqe~u`Y7AK{UoQoMq>9iG zAF^aViGce4{rnpTOwXPr>^XY4`a{>%*Z=D1EsOxC73C##TK@Fa_Zdq|CkPKVmW|>( zxpQ>%lFM!`wG4V7d{I=I&;aEfSP?Ge+BJ>m-9Z0OqGMVy-v~z!(N0l<2+Ap>rS_Di zk0ApF{W5p-@MyG1w=p6sk=KVdL~C|#yV!;(+0m^d51Die75+hCQ*oj9XmZ&Av54UPX()-9v(8X12@xP7!e^kqHYxh@c~f1r}8`@nI~jAQpUL=w1NT@=3i#Z?3dgV(S7 zW@qZ=lFi9>Z$n#RfkfAWKs+QfE}U9MVZrE3d{IL7*4zf$Nl9V{sBzj>1(?IiDpY%_p@P`jo_Vr9j_YYA+&;tZ_WA)VfNRsF{`c;MbbG$#d zuX}7-v>_xqfNm}SMd}<0$+UHsdc$ ze_Upp26ZB&w36`til^ek4%vu9l>TK?dM7YULF@w=*7f10;fY3w~;KW0R7XarHQ~w`;E|<#{3BYU;6F#CT`)dA?-9aXSbccQ~c1 zHD*BiS8w?U!>_Y`(gKt5-$PKgQ9uy{t`V4Lh|gHt(u8V!!!2fHbbCLMJRLc#`$GkUNSRCxB1z#Zho3)d=gc0&txq7QbWx%Z`Fijta%P;zj& zpTmG=@Nr^po8t&wRQrVG=M@1{gd9S9&mvE$NLP1vCz?7qmui7WRKK&TS24DSQ z;_8q@M{QxcNVL#S1Jsq5%mEr527azIIk9N3BhK|}2%;N2t_)F1i$ty_vKqmnZ_nJV z7xn^xlG@)CY_y~|AeNtO{Kz9l%tm{6K#2dGep2K$dTPC`EMyGLBPaQJfpY^RxMX#0 zgG(?-wH3upPlIBz8CvSb2tjoHXrDf&k2>|r$pZWEQEV&MgzUBLgQ}nXuFf2(LZ26! zzfzMjF#rqv(tgq0*|0S{=cu`gV6Ndu{qX-KE{dMk@d@h(4PPdR|Cbr6lTqqPGgLiNmdx2yfvuv zynU4G>>e5MHHPKP9E<|9NZJX%1zsuky{*Y98P|msKN4D$%-QW|A6=i@{$o0==*CSQ zC+93{v}PQxFzZHD#K`;;XeN3PDK$Qwy=4lHgLBa(`{ovd4u2>reKVj(Gzor6m|dBM zpA}E8KC~(^c?F(xMOo;cqQE`1VEDzp=6#NQp_VcziwA#m^!&Lq@$2(ggqB(Bo_8aaspkPewv+^aHCW`3U9-tG<>|A zdh4GqZWiOD?2B1rw!sy~gF+i7sfe1ZzauSWdy|@82p6_$FT4~D0I(v6~asn9)E__Y5Re_(b_>4~n6#t}c0`Hhb%_h^X|};NWPI z2M-!RKztYx9utmIfu4mc_v(35^K^fSfE4Ul ze?O%)TNL=)*x1F*)kviI9s48?It~=^{V-v+ac4B+B#I6P?h6enzo6<*d3E& z)8)aedtD_WU1jPT>bZWbWPCL}kb7E{wV?(YqmYU4^j~m(^tQ)wu7@^+ddLp`C3M%_ z;I8>e#+!hN>F0-u&%~xO6jmiLf1UqxTnP8_@(j4yVy|&`c^k%Mu&Dy?i9sO6Azz|d z@bfKW-*pbS@X@fB2s`|}qm=y@d&~>{u0`R)&nv3gC?GY18-0luX=Fd9T5r(C18!rw zHFtfVZJv72ge{wKn{ABTMM}FC7m#ebf;*!Of>7F#OV8^mld%upwi^v*{%#>v zH{qT{B-LOflW+3{p3th$KD8LAqUy2w889gGt^3M@zAcc}X8UY>yn_PaU>vrcpx_Pr zW+&>h<^bEE=wQ!X!nTkPfhr<5Hv9c9XIv%Y#|fKCY&IJOncWakckY`pB5MXMoiRFc z1cS@8=RKF|hvEQL%=HIFgZF}8;zFr61YVtT?Ra(Oh8B_hQii=s0^IXY7blC(E8F$* z!uY{9RJs?ASX&1T{fBI4Z-0bJBEfHPE~E29kd%+ndeN^!js0Bjr1;yEp21w+%3*=e z`s$Wv4gx>g0DcMz>0aO!uQLQ*aYes@608Bj@G5I$yn6iGZ`DW(@247x9_?2`8oi!x zLJHB`>Iqq~-&`Q@iWWb1A4>B=a~J4gN@(Yr2|$uPN8OxzOP%X^)ereL;HccoTT|3r z0$YOmh;;Cx6T$~?7#om`cgN$4No-@dv6YW>CH-lHt@k0`DhkPJt?7-x(CXu$ek=K4b} z3PH$TfmZLjLo#wG(TJ69j(CXRk{rk9S|T^9_?=*1jV7mN>Jrl*MB(+r&kyhh5vkMh zrn&M#0yjLd2ul({wS4_Ue9M=I=cL4?ot*_vFBb|Sry$70b{?O`Lg8{&Yn&k#_cJgCE z_CtGao;lVRubK#8nl9SnsI*ILTTTzS*hjO3hok*clC>W{UPnTOXV6SA_E9^>lp=qd zgOuZ@Z_IlJtlS2^%;Sq9C5FEAad&rlhzEIu7szF&>&F34lhYG%Q2Q}HL!sle3MrlM z266K*g!<%}Tb}M8`4EivMWJ8To}*fVL_m&qIb+15f!-RlvAHUGB|9)nBq#o$ws(#{ z^Ob+5Ekc?%h)h7`a6rseWrG|1jtp z+E;Ig-&c>FZtyW|WzhnJF8{1s0=kW7FE+VPikmrjI)i&)4M8pMjkN9*c9H zL7%SdPHbP!g3^6;(xVe-z^*Tr=g{3VOV?4ioIEus0GVdy_8#2U}<%ZF!g{VBv8!Q#7Q1F?nv&bmu1eJdH(C+&6KhbETABOJL z_wp44=jtldV+n~n&N@yA?zlJwb}q)fI5IZvq_nFF%?nrlq0o)425^)7lwsP)lO`eO z+^%@0iRw&C0Q(y@7GVBCGeHzT>gbpv6H~JoeA~6eb&t!lY?syTE1b0R&%~z?Zw8ud zGgaT3oett6F3wWrN9Xzjkt**kFqab%*-6HOyITZa1$+p4Dm(~M^_lOEVg!B*Y%=ukbchjW1M1aYAbLZ_1h zR5HGL>CI(%I00!{X+AM+>3?v`&OL*#W%DkSpxKz2zL#1=Pxi877W0)ETKlb;F7T9 z8IKs#8JL(b1(e74@6Nu?+RXJK^G)v7GTn0R15OqYlY}5H-QO#^q{7;LqjiVAscf$X zRpMfT09oTmVdBM)Jb$oSktJqQ<7P9hB;Y%n7XNYOJK{nq2jM>leX;0urneqQFr}-+mjMoqk>^fon zOxW(Q(VuaqUspvQbQRl zSO(N#=sRNz8-RF(ctJ{hpc$Re_nUD9*yMTK=3x+$wu8?^lWk8g6kANPng7pk5(X-N znp&zQV$%mbMP3}zGwDW*qfQoZ$tgSbh`Q^O4eC3+RyQq&B#e8Pvtp_igs#dqH2~7| z`~o=wi#O8Rcv@q+))RNY42lGBE(TxS*5(a_fDLl>j@POT_u`2X;UjAw_~G11U@+zt z^RJV~f^U20g2f0lP`HNnIV%lz4a?eqTvy*Xo@%5m3n(~Goiy_!o8h~09>X0mk{W7V zW!a=t=14tOP6$K_z!?Zmx_p zWk-H$ojnd@BSPzW6Vtu1{fL}>U&Vss6UeRMntl)P^LAi98ZFo8TN^WkG6(o}=;><| z=>6`lcB|Sal9J$oUrwG--X-$#xvwt)5}M(Ar;&x^G*d{yXSB2+8tKO|YP(h_VAz^r z!@6)(9||az<+n4D6K;AQu@`_%tXP~U+okay4wx%}KXLqL<-K0umDn6h1}n}@HA>Q| zU~J<9|MjkSW@l#+Kt=3spmdO_3h0dI%*4=G@a+3~6p3|YH8$4(_4)qv0-5!^l2F{& z?*O2&d8K8R^Gkb&HSKA7@am)W)b0SjKeJUXTdrZ{26i^!t7n^ES{D1#K^o=lgE}Dq zfTQrB@*ggzV$6i&IbEZDN~}x)3HeDA&m~FBxDAM-YDtcmuP^xGNWs=r*f(`_#Cka} z-5Dg-2HVWs{J81o6&~&Ihlh0c9VXg4ICycPW&$2iN4Cf7magv%GZtUGFnT98_F?vC z@P`6a)AXI;zU8Nv%@_&~B`)^3`g)s0;Ui&(;*jLQ;lK5&It{KG?>|3(iLo};3nQ)@ zS4BvlREpbuHPd!9bR8)~97#0-I%m8$^7mrme znlPC_anLqzMTEtOk}h0ezkVR?K>F#4qbRPt9>DVD)uB$qtO0DA>o=6#< znY;~)QK4drny*lq-KKGrmv`UA^nyl-OFeJFmCkp+ISG)dQooc**2n5qY^+{2STr#= z*RUBJ7=>pt>2c5z!WWV{$vMa0=D>bAsXhjaY_{#}j9I#>E4NYPxhdI=)sH}kqe071s`(22m`AsnS zSVheosGBv1wmi$tEA1$gZj{GzaVS0YM$88Lb7Gi>fdLou+#E(lt9grq1mAprn_|xb zw7RC}$K7HM0$wfMx#szC>Gg?~6Y#pPOn9qXe1J23bHx@eo&btV{^8pF#d^Cch&ho# zju-)}Ldo->G)R}zqgSC1mD8@eUn)Q@(3f?bvZEq9CuEDU#Br+yD$TvGgtB`7zIT36 z9Qw|*d0qLI%|>Ou-`ejg5DR`UY{9S$?!_ky4!hB6<_u(c`^=2_YDL|!lfVIWd;9r~ zFHKj%O-$zxL8rxSh%O|W9(g=M@&cl{Ez3!%uIPXV`Jv1@G9cD4S3Rl-eSyUtXT>Q5c=RH5JG>-+t$Adlpjg3{&sF;F5nWpO~T;9@kfa}J( zykjNq-!uJMqx3nL$I^8^*9E);AprkCRMLQ~Nm6{IP`-Hs?Mis6?!I($3zElpO}op2 zuOv2XzP!*NCfaO0;P?R}xt8m&yE8|^*Sj-;n`&0Bf`Qe4pmX@NhAi^ zkgI`#fe{Baqw(=cNj3c%OdzDOQAxiGY(Y%v?|mr%YH`xphIC@f(O$rP}!gt-sLCf#n z85kHq>>rF%zrF4VH9vf{pGmd=pyU2$a=l1t#F5fWSa1H>mfHPJ0Fwi{20G)S&SnEo zFD}l8HDlw!7r71LOH=sjdm^Ij`R3tIigR5Dv(A(qvr`$PO$`tl-U(vfabI6K(WCWs z3O7l>rec&&jug^IEUjd&FZA}6Z{;9qwh7f+?P#tj^}EAWA%t3+6sbX{51@i@nuz{3}C18z)xR7+$TJL1Dz>QLN?>%RHv)z zJxR1i$7jMddMH2&w9H~A;*0%QB*sQ-8nV29HA)gX%Caqs&0heDb#x0)J3rTd=c+pV zPa$5Y+Ri3Mau0lckC;haG+(?ia$uk#%b875$`gQaQ;!&YIe}{kRpD_$&Bvd|f5Fk* zw>E<(0rTLCZ}WUVbrOu(Y~~S02wR<757s-k8VHRuBbKN**X1b$Ryjj=f&Xd?(lVKA z6w4Yio1L*n*vdjc_eb9X?kWQA6UHn?{E!XOs`0C24BVnLD#oR=b|*Mrx%3uCJ6}(E zSWi}X-!TfT#{w%qf>#k!`L8YPYPND2h_qkN)kKnXJr}~B({OUJ*!+T3MGcCboSZ~b zN*bpUn&E0ozcehw{2q}E#CoR!RvHbZ2?`53yAMcBI1Pwb0oCHIQ3`b+sYVGt$4YbL zW>Ne(qj6+Bd-v|uiKs@%O6I-x?ORGO@>_jil-2+05d<7$4LY)FDw<7Y*;WU!?gEQX zdZ(h&0+)T`myMsquoce9BY5hO(H52#BR0Oqe6DD|J!CbpgUYnQ&VZnj2n> z^V1ZiRmnjv28*ki6J~EsgRJiRhlp|=jNVz{dCp5lh3~(+O`1;Z`V+Gs>^pN=Z z4V>{&gnMf8qq&VCsG)<(e#355X6ZAnFo2N%=M5Rim3DiD?WcQZBXf0?6N3A`c_=N} zc`}k^k%yc=0l+PRJ1kUp9j9~~X+s-kA-;N4*2F8&^##~;NWE=HNTJ*G1u~%7LtYqz z2dh}*Zijy9*^hUS!|n0!0|C)Zdtsb8T4#|C z)Xe+?w$oQL+Xk~UuO9c`EFLD31L(<_CfPB2Q82G*z5=D!PK5{rJ3?ty!Wi^l+gn=d z0wsyl0!~23DSLe`ZKk(Km8eMKy31RwWnpvQ-AHvDh+~vu*@&aENCb=6xD1g`fOsl8 zgkJC6UeRSpKvPiyy0f&5{QDQceH<;Qs{l0UXc{>!2`86tL zS$wfTZ!-V7NiVk5y{_fM(e&7eaJ4Z@O;(*YZ4mYUhefJfn z{64yoQVov|J-~B}gi^YUayCchD#K+} zmWw!6wEFL%wK4TK6gvSl{)xYlP2#2q1b1sy*k6j=DoSOy&GZ> z#$?)$udhIW$(fnY+{h?Y2+^KdyT5=6xj8-pOx}h2RU`md2Goe5nc1&3ThAM+699sg zm@+RYrS`y{E69^#s*IAMJUgh6fmgfz(G*MbrrKQ&Bi2={Wx%XVoHJfyjevwaPI3DgTxaHQOA31Ieh$gE}1g1Et?4YwJvBz)ioaU|wr2m$NMCmsC*p zzrV^xx{k0eGrlOj<+pWoYbxYci8pAK>pz5Y`hS?5enKoj<8?pe>niv2V^IY)aJD@z z4?2RO;bVnj37{WYTJ>%jLnW4eoC1~xnG>1G$?LLP0|(Sd&L?Ln1=KA9=yzis-;gVI zp5lkx3*w+lGgD3;1ELOso}N(SHsGfFy7}f-*%lWI{Ox?)4Ahf*c~A;+A9xkhUEGZv zH9R@W0s^<|TliKrB&6;}Ut>dpdOm2~Ehr5bbNUu;s6l;%JTjD8wYr$;0nH!tTUUsS z>uebyk0pB}V^3HUx^4i9pz zj1vTX&8=pc_(Uo~E|K*4b+3A!Q5*vcAuy^%+_uAL^w7N{sKdtY?@i3VMg~R=U%g!* zU!$%f4-bAF11@=>lGe^48+{S71s7+ab8zgASp!2uDBfYi34LS5PDOrn!pw7K&RXhX zz?mxoWSO6fAs>7CfKxHja|G+PE6rH_3)l6#AT+ps zo4yZu*rN1Zu@HFtfH4R^zj#N8qnl~~P;$I|d=3*gS7y`t=z-awRz|(WHv*TXyTFA6 za;>E_??CYaEgM%TCO}39K7fbY=U(gMEbIlCoiSM4dg+(`(uWyHViNG8$9{W|f8rAU z@TFSLpZz^<#Ms&5(@{<>P6_c}{bSctxgHU@lcK+Wb?)NR;HI7DE`IKKckFxfZ>>U~ zU1-VQk3aTDq0`CuS?gYM*^jx)^j^8$$gEhNh2fS3w0g4L>8{bUX$hU<|^X_b(5f?ziwPwrk6m&V`lr}@{>x06V4^7 zy8Z>3N3bQ|6X6mf1<^ifaKgm4txrTLj!g!oK zMCSu#$+dCW$SvMZRAD4_bQDKAB$eJe#@N0C6B+4@U~9!5Q!+C-ytjjn-~>Bz8X0iaWw^clyYO^>ck^;q0QF9bVPF4~pv8i1oti@Mn2m z*BmyqZ{H}h{fCiDH(76kq3X_u?JM>NtVzc*O=t$>KDr;lq0t7FX#4kvw)~J^mPaG;p#v_t&BEj0kF||+XLSb}N7}AJ?;vBbMPK15 zRLS9lc1t?HJC8rF*8(^5SzcKl`EDA}cVBi^DO$)Ld|OoLN=zd$10DIZyQ3(}fwG%FZ+iTgJxK$rIK*akHk^E|4D@)Qv3Ce|w`G zWKpZpJI$qIjf@bEqXOB3ck>Gh4imLCN#CWWrlMVLdA3)fleJr1Td;Syzr~mDns5)WE~=8oZO6Tm7$bHo*59G>$|WDa0Xg_Is%>>CD!+4Ub;NE0yt@qcrM` z186=gNbYlRvl1)LaHXfucD>#8f9ko!de_na6T%(x7I2SG%*q@uS@)NoCMsHFj#4UF z;K~N|EmYk9VvZ|VW9&(t$h7sOk&BByd4wIMirR;CZhRVEj`hOM)(P4eMmR6qobTUT z>4*g!K%5J2{7N3McqyErq7^Rkm!gC&wHdDEVo5xk7ES4U~0!-A<$e8lrK*=+{p#UjHV!53{s*o1^^w#< z@Bc+>iM=Ocok=JUp7_zZV|m-y{R;=I4av|BY58i2h*q4E&(Sc3Q!@7UUbB5P1bCY6 z2wdWciy9_=9jq_!L9@jjiCQseU$|h{XdmPZbP|78+-WPzkA5Uy zNK|cG9PANPA9{A_f?kyo>}v6_L^fKpBgJGN4Mv$9}t)%Uw&=aphjkQ+k%mS|wx zC(gvhu>;wiR8czj`)BFTYIkh=1HNuF={3ok)+g@~Wj0VWxLDcdFf9b@?hT^;@1&zT z_a2o~s?{i$xL9&p`wHK2nSSVaVI3nLlCMovR9BB3mNA08{g$ZW(Q~o9(WVRop+{*B zv+T*a_`q`JxQxd$6$>aL;Beu>7UIte{_IJ{Og5^s>Z8`zyK8^1+8I3;0b!lLxh1O1 zJ6bfFm&fkS`H6*xkq7!kj=By18rQO%SDpwjiSAC29s{24v_&b6KwP|K_g$sQ9BPdU zeJ{ZJw%d9ON)qt?Cr?Egu{4icRu(m1am!}=D)!=9!{CK(-B-&Slgs%6a@$yr;qch4$ZiMCgnA!3YrWAG z+QI?r4YJT`&jz7D&p%%%60ebmcHly&07$=2auwAE3FhVU6bgk%HX@WJL0W+!20gR9 zGzGU=HzHX!9WA#aPuS=WLV1=D8(Yj<88q$wh7t31`|_HAdbuOEJlFGRZVnJ%IyE>p zvvVh8HcCZsrp&c_$rEe05SK@N|8VX&E%?&mOjS5P;%>!AToBm_H(L&x3EN;pwTk|d zQ#fG}jaT!(p?T$W!JBiM8JH&u40^`*L`_E_J6SGYcHUTR8sZLLyAhgO=ssXs-k4O5 z;q;?!8xb)?vbkJwK)_$fOqBKsBS&A>-C~a~sgINE-wi#u?{epIt%j_VQ+z4w;RUR> z355T?qy9i^Z|QdkMbRwF5Z4TA zPtfu%wyaSyr?@e#swivIxgnHG#jJV1Svf)Cpq%NOqV_9p`sBX-+#z@`C_uMasr|Rp z9W>|z`(}UrZ&B%(?86V(7^Vf!g()}Kyt3;8=$_E#CHvf;bklFmW}^CeTma^iD~0i@ zV%GB7g*1pqi_M&u5U&nswJ!q$_}ipGeH+I7g9XCOv(pQ1&J_%E37W}#g>keFQ&(SH z+^qm@R9XSijq)MZ*e;J|Z_brRl`n>@r>#$KEm)*o0Y~?#(`_);JAZ8S>#!)i!viV% z>j6+|GkTux<*t)qtdA_2-)10D{d@9gcbU@-0K=Z&v81((Uwx5M?ABlQ66EE_m)B(r zU5iPSlM1nmM8(`)XqRz*7JK@vC@>gLjjw`ZYgjShJGPX6N@~uV_sDvkos%)5)Nd$A zK|FV~cIn8fZW%9uatP`pYi>ry3s2KGf?ZV##X@81Ye=|2Hk8P{N5ena)+Kbv$_na} zr%#_&3mVyge_Wq=xO(iu0k|Blz`Vg`{gohdQ2IikihFH4D~7l0F=)O|CNc^;S-t!a z9Ljo~31>|5P?ESXY~;D|z8($cG97!t$;k=sSkUs*E_kEGpW7Fo=H@1=(RwL9u$sHV zfrMEzBiR`c%zo-IJ_J;HzP!AAu!{=@LpiIv#~1h2qNSf7^25L~ZiV%gsR2iX4JoEA zoL)*Q?XU$e4o{TdOQ@T8dMf$8?YVK2?RtJy0M4=BhP(E5)K5;DA@&9Evh|iQv$mH!rS2M2W4vmUKG4;xo)fJ52LnBta5f;zC zpE0+hF{Q1fWli5inK!S3H+|(Hj`6n)8xP4KEt;Ghk^EoEZ)j2En#BajiWL)KtliXY zm{ErAe3{{QTfKMOdRdF)2IqH-{!DF2aMraTk2DBc0tR^ne>(UVx(+A046I!E{gM))FYXEL$jHlFVJQ#qm+>})4-W^?7(74G)b-J;( zW{fBP`oLrS%{yp^!X-3TJimtN{rq3#(W<=H_I{ zObsZPOB>ib+U4H*C)4g7nEefbwM(CeYncW#R{}Ox`wy`k0-Q^1|Ec5E!|-w0(Dqq& zMK(0}VA;|8yAYn=CULWex<*}$+c{!nE&LU&1G?{wfVuH}{ z6AQLyvfr%v5XsHWFAoy@pCc3PF7v+u{*R!b97h{3Hfk(GbT zO-+1wzgOWf@yHPwuZ0#FEMiKxB+!D1QQZze&79=+z}Miey*gsWDb(0UoUBpbEhJQPGvSPHeeE@52! z<~bkt=&I0`b?#_LCcgL+6m>MtW(6uk^djRO8j@=Ha8@a9b8}#cL;I1uXYXDIySI%i zI9!U^i;$bwHa6Fzkxt){5Dwl1c_?{gZpAxmfC`zn0;H0lhx@65@~%?mVf|P;)_@iA zdUC9TYS22CvO06;ro{%sxAMWWZD`>Bp18uo;>bW7HLa_tP$YIl=z$%%Qw?hy%|6VF z8dM*j{F}FVeYKn-UBRi9n={=n5B2x=6UmU#kJQAtAkC~D3qO!+S53xO(}sHCxEnOJ zKsUhusmJE0v);i6dlRLZ4ZkQ1K{dgnUci@c?@_x*V^(Fu2`-lLRS02~HwM1IilNcX z#!mm0=kv{|1zI#_EsF3&dzXSeOq2p5;lJo*C=wMlENTZ=pJ06Lys(Etr_>}wImP?q z8WaJN|6@}?#usa7Q{v5}f5c3+rYryU*)?8Z6uyYnS6|FVy){a4P>p*=qd{v#5SQdk za)&is_-R8{cA7h$j&*Mr2|eL9j&Fejmgv3Zyu9PVS?}m=hjV`Mw9$deNi-2aP}M7oY5nZ-9WI!SBPxB0BWval4J(0%_Q(*jo-!CoQxG;>)_9?~nYxuRXEQ(lfxldsh!xk@n z&7SK+Jk3hNY>F8x^p6FBDPX)9uv49+At-QzQIFNFk51E6t&J=!AZAn!%P1;-RJIS5 z*0W*$ej+$agSa@~{2%R7MU3uRVHD)!T?*kq%z2hp9pyE)o{BfZ%EkAP7_^7BEMSoI zh-?W1GBRan9W1Xu>N4ro-@RGW0iA$L-VtS6KcPsOYkw_dL)&x7j_-nUH)9~*sEL1q z{9?|h-Mv`aakaHa(N9|XpzMK4g?0;C8*2!0^GNbIujTSW)i7}dLo#qor;2{{fWo<> z6kRr;rTG+h$H8#|BdL^I4z+N&5R=)VrIO;!S;AVD{_6#ea?Z73T3*ubYCbnKqfj;w zL>b5e?-1xM;3X=O-i3*c7SKzh@X$cXDhq_OtU7E*086aJo5ZorecC}wS5fpBJhQ*zRRp!zgmqh%JHDQXr7y)R(Fbhh_uA!`#s zZnSpESe6rbr|y6a5?1Ky6Hs{((K6!@60d2fuAxEf1W3!x&219SEnqEyx)Bu2po5qL z>-wdO<6BYEJ}A ztpSd4e%_?HX0r5@<}-Ig`T;@nQ8mA_sDkUn^l+=64!IrJ;X0|W@1l2uNfvlA1Jjk1Y0 zhUABYpy=WBhh13WUZEfiHx=r~Y27{Lc%rA%%1`Hy*zXcwfIR_H9kdGwof}AEIH^`9 zGj8vJv7MTTm`l|qz^RKS&4HfsQtj*92A=dy=-`8XEcDc=3Vn7TmK+quCY7DCe)Vg1 ztA!iX;tU(dUcVKPPoY%q`)OW_v6DXepoYKVA?(0#!r2fHBbBmO+C)!Qn21{NCgQTu zbFy6M>28&ZluU6KP=2tkC`(d-d)hyFh}F^Jxw)C1O}O;HKH$iMh#+XDPw_AFu{GM* zoP3m;@wF?q{?JunC(XTHdPyFDCVL$x#?IFFl4+wAk26ulCaQTj+nmJv{3r+tOB_XZKi_dkC1* zu_qDB%QJyKaHcSJM21zCXx@zveYP;h=;!ce4}r2`Ypqxp`jgiMg?J4U=(X#dGqS^A zO$hnxcD)TLDT)At&2u0=laohl$-oBh8*McrAh39_(Dly0Wn&3c{OVGTZC3v`*f|*( zoGm=Kd?W|+h9%n8IlpAL_O@G>KhRAVyg!Hzbi%=)V4IEAS-(g)!SM`%C9w2r3!Yym zb!(zuba#hfroxKqKW3yRUNEKiMnK7DddV13QCb49|G3jZqYxTw@fTf7&F zp_N%CDh}N(bNK4}M)D5xV>H1|Ulg|Op($pPq)(?PDR6wRO>t?>LWjqkfy}<8rGAYX8KWfsa6))$6SZ{EYCnsV~fxQM)xE>!{YD!bK0(0zX5pp{iSLM24S)2E|= zgGWx~pmlGtT)&kUfv4fMIlN~t6Iyq%!A6Aw_*bCRfs1R7x1c-KCcP*V{MNurwzlSJ z5*3xaW#gcB1G~0RP-L<=#^7T@g4#MnTSVdUddt~Hi;-LJrN>0KBDRYi`y*t5g>K4&>iCrkLgUNNn_s$q$X@(dHhJ;OFv?XI8c?)kC))L zRtgE+@Rhv%iAmTBK}Ea^U3>muFun%7(Cg7qyB(Xl zUqQePo1UKW0hS-9?jowjJQkKQl;S&L?RcoTTEP2qKPao^+u^lR;0Kx}yalG0-U;5m zXdlBGOz#6PK6x=grh=PMkaoCybBwXZE?=2^)V6CGHjHU?^OA)zy)O!1?6c}F6>bQ8 z3}8NC*V30g7%t3?gfJz}(Spk<6tQ{%xQ0@*(>dx2FKnpz{gRTkFQa5oio`HcDNni< zEKA1UQ}r0_dxu)A;U(=QCQwImE*R-49zy=}ouGFB>)(W-3>dy$Sdewo94!x#<=N@X;@1cD+k2k&7SKfSMc9 z;4TjRmWOcztn2+ijPMh@PdMUc;&b*v;{+aB#ehNAm>_6T# zglSg&^G(b^WJ-jlon*vs#^jo79W*qI`&kbvX;$2W%eOCI2d zDO&jobt_}tBxFTnwKim&S@+SoN_7kD$ML&QuS$jjS%lRAF!kYN8_VjC%f)f52j_#X zV9uoJo1UJY#j)2LoN+26_$YALJHl`h%*AnPZKg)i5#kY<^hI432|ECK$GnmD*E3ow z%^O}&C%lg$p)FatJwLy$AJ~a{S@4SBNW4q<*KSqhv0K6v>}C_7pZIT>CBe)tUoaPw zoBEL)bnBz*uPi=`2A0w&OpK2dc;7y(Aa4VeARjNys8&#umCH7reTiMH2&0?M&x{4h zOt=3uRMOX7`?u&^LY*LV6grQS%Zfexu&?3GV0# z$|x_@f{u&BMR0Eu|1t_q4LV&m*S{5lM(S_Bm4z%pkuUT;7lJq6pO3wfL9PUCHazn) zLR-5Y*m-rD`_knGlx!_+OwvGog!@|idLuiHuBeI+SsaP)E8T*=ozV9k))^z6`xxdS zn{?_y1W2&)G(QQqEBP*z@*?)Zfj5PDdq~nF7HmrNE_S zX{8Xb7AGC3aN8|nmLx2o>4U`X9Qcc{#U^M+XJkzNELgVdr)B?tY<&k*lS%h?)`ksq z?etZuAfQ4(I_d%j1nEduk=}a^K~Y&nKthwQ(xe2WccLO7ARQ8^LFv7h1d{yc3822` z`{tb8Wg(eoo|)V4Z|0B_hVgH9Ijn>=uP|T+NGwf3IMc#SYp$G zeb<;J1aBXRKX-|Tod;R;jfm`udr|tTMbf!)_*Bge=&R2r*_>!RTE3PfOn*ztUw6 z+wf}psc$~ftS1Ny!6NN<0a#~{@l?zebaq_V1O=zTh*~K_2^)W(hZX`m61n|7SiX-N z9O3NXE0IJ1i@AwjaRc>>N)*yx>eGZPy&V)80-+C3s?S>jNN<4O2j_+L@X@)1l0hsH ziCcI7Al4wJ0tUUfblhfW+D?fVU+h{{F%K;)WLWBW<>pNY z-^6492#nHgB6$}@8ArMDcG6@JwAi7^9s2sm2k+WFZyEr&YC{7BxQf8E<9LV^%d-YK z-y?upi2CTH%4K_Nvv3&G;8?WD*CwHC6#y!t%I`{LFyq4P4q^QRc?nSTs!Bp%^cg3@ zL|2hq4gaNh1M`r5QI|}rFG0XdH5t&V3%qIYyclXWxUjedSvbNI7%~<_=cfZgpvwbY zUtB2-sO5U10d;VGY@U)%&4&DiQ#-YV{H36@_Ua`N3uE(s-7pF4y%o0-{QTSYUB6!T zCGc)5y&O@0dbh*V^Ro?<0dPNqJ3VcwmAauuv#;X{g)&FJu_Mu+j+8hPzXU@!{ng@k zP8H4RgL4NYnr`9ZJ#qgB6RCn0?%VO*Eg2wN!fhG{(zP#Nj(ln8gtnjHP+259V3Yvb zf{Y7-%0{`{!K{XlQPlv#Ne(RY7`_hKM!Y*I2N(if1*P7;7lCjGCjzw&l=5y)V{DP% zf#tT%bbntw07F}XdbE)8DwYqDSYmcy1p-7COLaFlw>WYJGFcwZ;wU8K>NlF@xa(uX z(44>k2GhU!3sfd9heY0g+iwTLZkJ4=FmYl)ErA^wq*J76Mrq07hqF^<$LE2+^8cfjE>klNft8 zb|*)a5FHAz&xG*l`|7U&KseyP#|8QKti0OR?Xbpx8q%dIts zMPkVhgw-ouMsE3Swo=R|FZn+!F2{=bc-S|C8sxxp(ej(;30yu)nMndy-R_L!Zgo>H zS+pimPg3=Odv4Rh8F|r|hFbTSP+3$Eof+s}?fP3B+R*@)k38bv%)@ zz8AK2wL4Wg-*?re%!hnECy}}F+c#TKmtENc0Av1^A=3OZxq(4=x38m{2u=82!dBn6 znoLP6&aXh}_El?=21)m4?@vsSbS8c4f$#^QuF(=PGD{C@ZwI}>S~}>8Wg+N` zUJMLfYM)&0sW4UcD_onVGrw1Tt{N$ccj)(ghgt_kot;2EI0uv%bq-5*7|q>ML=h#a zF(`CiUS2w-3I@CLV78djUq$&xGc-+jt7jnF*Gqnq6VT-62wrF-VQxM+AR&?i2EXa` zW{#f$v2bqltD@qXJ9a`~H!YvB3A7J#Tn$_?1q3Kk4M|C{!Pw1;lBf|XIluz|&LV>! z&qE*?3LeyVUN)hYpbA_M!#-*PTud%VG5OGnFhpoyq{ZlAAGh*6RCc2woO(S2AgmU0 zdptFN%`qf0TZ_$~1k6 zG{~A-Fk~<}HPzS%mC^>4?9$THU8q4qSFc`O5+YYnhuA6hl+Q`jS&$%CzOx0+HdQ&= zufh_fb*yG_xfH@kZ_nGAO$=r~$gsU(+0l1h7^I&%2ptGZNkp3B>wu{vAds3Bt4oD2 zWn-y{^3bQj@beTv_>BhRmyc1~sge5V8qh2=nAy1TT}ViW6^uSB6?iwRxm(w$HH1w? zU5^%t}2M>i$_xDk3nIl*1Au7 zHF0~Ccr8-gsT{SEurX=7rDAOtmqbBf7UCo}|VLbl?YqdVKS6)$ZA0=w-t zAeep^I^95p$}+(HfX$5^*!q){d_c@$>r003;t&Xa0Q=CwZ}nbz1-K%e-hzrhlH>~v zkHlaQesBRbRg*T0YytwF0w8jAoSVTW)H<-p5PQuKBGJa3=>5mm9!V%kaFq9S(Nb9m z3F-0>K9oiOsEfN@tCu}mAvmNsTYfbAWkTFh4`4`(tI9m5JItLGM*WtE>j?V%hsYJd5! zJqMT%j-ccA9psezXLj(3ZwBWpw$CcJ?Co#exDkBw;Gug*)5;rFoFjw!KVa1J9vW1I zn2&AVbezc>5%g*j###vE7OjhK#(RxlK8K4~r!Agv^@@O!d)&w>BF<1HZFpbNL+l=| zbw(YUqyaBC)YK4@lEB4fZEcN9tlAX0Z&<8>4!>Q$$KPM{iqA_?I|62JpkXG)p{>zP zzT8&Xi=SV3`0)}@GV!6G^a8S- zCUZCrghNXiQ+u-=Fa*ZHN#?P(uYdjM)f~wD$su4pzrZK*#a=>3P3Z+gSTi@#SHlch zF?kL878v)m-gjnH_On!#_@;7Njm8$0&qm4TGq&u9J(_zK+T8Atq@T?Ys>qLbz-?r= zE6pU`lQ`pO465t8R;DR12fbM7G?7XR31PsJhwIFfR#^b5JIiu;%*DI%>5&}#G3@%l zkw#Ft#Zl$}!#t0L=YRbeR=xpkGYNvf{%ywE21pbQzNsV?y@B{<4$9dNzNH zOBvn&bjef7+pNbKIp=0mmeEE1AI#x<*(6aOoPSBVvllP*LbOk*6R6wKB?7_=4wJ8 z{bpZawf1ci=iA&%Kjr9g?)E;|r~9guQ>#It;he0O1n@Xku4gCzvKU+S?#2z~6tArb zNAWxj421e4X+HSrulyQp#~X`*B@Dl7=gsAaihnv?AvN^zzvG=WyA@gmvUQ}8*QTO(tT=~Bpt8}DXBFS2-gh%EkIKu-$I{NKYvB`9^c9Uhk9kc^m!LsUhhY2aIi=1# zfBV&W{GFOW`bf?mThXW25)L1s*S>xGB|01}0_RaI8`t~zIx04EI=8BLyk>{fN_n>$ zcYcJm$^SQy=F||Tk1AECv*~rMEW1hOox5`3qG%VBZdVCESo0?l+PeTOoY;!;fB5e+ zx9tY1Z`zj_OpDrfMJ|uMh88$qPAn*#zn7t}-&a`XS;GA=829!5WSZ$;MkC{+ll8K` z-(6`H=D<|Z{sXQ%Gs5HuB3#m-bmlT5t||6t`XOV)6`sQpe9Qyej0!#`N4P2=r1<0h z4|ED^g_4#wvI}&hIOyB19#-x>=W0V~%wO-G8xy7#5dt6g7vHJ&4t_3&i^Ch4&XzIJ zb04xtTsaRmyL#XrEd&YvI$`j+=5wU5830R+FI%m~76F=*b9{aEyfVkL6a?COifM%s z8w`F4J`0Vk`ooO}ezDuo!;|$E{4#>7Xf1u6oV|3%7*+Sd z9<_2$KFb>a%Glw>@e0md{Jt{3*LK@v0q@s#SbTGLO>&o&f{tlA+rHMLsK=FGj5 z-*-FxuuMaqs*Pb!+kL1n32m%MGX&lgP9L{wV0J*Db#nEx&IfdkesD?B11;joCx5~{ z6ha1#^HhzK?g)Y6uImF%{3z;$H>d4;Q*wRD%;S}QAN~I#wcH%9rh%{k^E`dK4F>?z zJL-pPCa-uSE2i`%3+FAf6nLJ+g`9FdksR;*-EPSfDbdkpPZLSdQdYz{o*mP)R?2T| zBNap5FMSPj zF_yh1jXB#%dnW)SIoM6v`O&{K7R_cC9Ap@LAbg)t;6U0J-gM54cY}71g`SY5Q06TygThTK6)Fv#7Yp%Cy}an*CY|_c1NMmVF3x zMe@zuO9p~6I}NvBFhiyDX}batM#@24RCkuJb@uV)bA`u*oGe7YlROe3Wt@~5*RS;A z5FBccLmQ;TNw2crl6n7rR(pu6ObZGkj+v8P+wne*-X-{_P9Z2@b`<#Vd1;?WNvF*9iQn|O@c z+tp*QT2*p33@=(X_pZ_?-%;YGYfZO{*`_09Y-vw7PV8Lsu97^+_M53%ES2;N!53Gp zY`nsMh15QbGMXTcW#9-*vuS*C387(N zP(dkLktQCs*cC$i=zcK}%pxNEj9Kszqf@*wuULGXA87=B0yaKvw3R%4@`M*<9RfGe z{-7$uewq#Dc+pVO;n`19Q%=O@v9dy|K0$C!JLA(%D_QWr9~o5;p?P(2O3XkM7$e$g z++_cILy(N73N~#Y|3zr5wwv~9=i_NBzJLF%zU!=1k4!vvanQQEdzp9v%;lKj)ho?6 z;PtO|p!ID)On=% zshr-~qcqrjkN>?Z4=l^MgPUGK)HWSi5*0@e?ft%(js(S(0sf>ehj~&UuDWmlYGwl) zLcjSnouh(ioCp_OAMIM$fVl~`dva3Uj$GT^h&a1?Do1c>-(LrdP3Xi(vYuf_`e#$P#L4=vmX ze*UPZq8gfC_cRq^%k(Gz9S7A_s#8t$2=>4D(vZzuHHka0<~)M0KVLgIxDrbbi@xD` z_q{#fOSs9>8eg}VNX!x1v%(hMtI^*Iisp=*$3&IX*w9*&v~BJ*UINdH*H+apgb!-f zMaK!j<5ZYVv0gxAS~@bT?($l6;6~|Pm2=So2w+NBHkU&JTW;Z;@Pq%j%|pYW?VJP& zSEij;EBpqISTRm9k}iaiHpPm}A4dll2llDKc)UFZiAMCU2Pr{@7Kwj$Q|k&};e`=WsUgSaru1 zEyV=ygI(viAY~}#Ya0SbkrT8t9W1ZDhGfY>hRK+{7^faV+Eb2i{IP@K@rAtLa?o%m zco-naJI>jikY;DzX^RN-adci!%oG8e#F?>lD-zTpwV=ILc6$vRnBANisYNPOLz1Ap zJ9v(qkTPQeZ(#B=&qyjwCj4{o51Gmn-uVvWbpN8qv#Kt%=?#pNmr>j=?sfFa>$8m& zb}5IORJm74^s^p-^lcd>v*$%SRw-9`>a`o2Mfc3y!dyKqsatL(&uy$>t^)|&1?sRbje;tZ{$$0MV z>&tJU>!Ucbb0omxc0i)C!~$oUcg`#s&Ke_2}vQfiWT&`S;DvNJ*<~ z&WwRsoU92-*BIEqd|<+V98=90Aj+V1^O3uk{F|3mXGEfQg z&QJA|AFSjefah`j(XM4>_-f(9WtF&C4#W~dzbsQurXURV&-gZQICPKv-IEE+yIRkqxmgHt%m&l&?zrCy1lV)+8i(J zdoeYYOv0_R;nL^J4J6%XX^z;((!%UV07-v`k6+xHCX(BH{*VO)eqraCPOx($dJP9T zO9D?MDPI&%E06=)JR>u2zF!)0qo5(k<6dFpVt%`1EDN8b8(2|u4`^_~^9+IZWq#Ex zYb{BI*@gxw0Xfb!8OIO$tq00l0z33|2zcK%ixdk$-8lo=+x$_*|K*pl|8bOyM_M0v z8C_Fr*5hGkRBk;NVZCUX@>JsTq9vP zg~m@y&zt((0J#o%X+Hy>3Wn&YsiC(wt!Kk7ui#kAk zhQ?>{B!PkmuTBJVPeeHwy%mymiL>7v)J_|QcBqQ`&wVvh(vN@xs+!EnI8d`MCIT1$ z|0^}HeuoyBBt?}CN=`S;x@X-RP%v^EHH5g>^1H3*fb)Q_^kUb8qQYWp#RfmS9`$$6 zdrWUDO7aK@2$1kuxs&WvUp+bowusj8Mc&6W}GYmmH$w;Hf1+H z#-b)EnmH7U#Pte1~78D}#r+6`_-Bls>@4H8nAz_V2$>@~>W9>84|E z+i)@^vki}9y$!RD;PjUpPV!9rnD^Z*Y$a9;A?3|RM{!#@t$qqe&Kf#2XJv&>E%Nwf z3G@{=XalIj;bX_}U;pM1vGJ~+t6pXhPiPSwC*P7cOQmddnXC-HI4$8F7K}*kO;}?y0rR z_l4{8I?qp{hd*aK$>01<%g4{9sWhuMBqFWt?7DN%(oC|V1_1}Spvb~?4pDBUpqzyC zvy|0moRi%pI=s?muYfLLR&_U5X>Kkbr_gCtn$}z4S)^QVp-4?8MKiM=D>F&d6hHEb zY^2%g(~v-iJ6PJzIB)gfN*f!u*6`iH`8psG8y_O7dd%- zU~!UKxYpg(wP6$#Dk38C{_Wdk;aL)iWZ&u|k*pBXg*8St$6`w!$VcxDMbnovgS8_&5o zahWL(dfp7BtXNpv+b{O{l@@BDyvFoS+YM&VeEa4ifqyDPP4u0G>8PHNUY zd&*U>b6|B)?e2tFE+(rJkhl#S8(U5ck%$(glqXC@Q8ydS zUTzLtS)0za0z%FP_j1zDhKY%3Wvyaf&!u7@C+_UvM9ElDs&YkqMTK*$!5IMn46ZUJ z&qQOF`o#SD?@Cjn(+k~eH@!)B?(ms@J7;5pLEav4eiwQBp*ulxOhUnANh%I^+~sI5PUN68Vd4W?$%wI>%gxj zILM@Y`0$}1ar{9N>Q1HmwiZ8r?GG_k0)o^yPfe>%MxA#&PoI8|JpT6u1YfR$SUe=r zps^=lz#ji?vNM}F^>}s3)$=I#9{-_}Q?66E{p{g2gGAxz^&^K@uUnP<&>8@Cr1#LE z&_rxjPRGLin?*yz_$knov90a=%~OB>{q{<-!lW?OtAcQ)TQPLaJLlD_XC+y`Lnr-ar*&})&V0WOiOK~%XqvqEAH;_Y^`Khe}Bj5YtV$Q8=(F>uI#6bS3bx| zNi4HZe-ZMcV;My(FdrG`=jK)blCA9y8}ZSY$(2@z0nJvaE0E*t-B^>Y3cr4hW!OvIYN=iyh)b2MEOV_4Ct!&+k3B};HNN{uG zQXlU71S%l@%a^}mC2gVz#kwXYQ?e#YQ{PgMqJa zWlq@?pUq%bf3|kkoru3vfv&|+7h6$pC1t4lrOExvy+sxO8t3ZPJY(n%WusKfENApZ zM#p7sY))v!bpxpcC`)yHVAY*`iS<>C_5*m&nuM8Y(@r@$hY;04&R(DBn_!B8=W7F&9D z(Un5+)I=}J*-fC~p&>VP@XBw!Ktu!|(f)s8!3-IBZ~1a8qku!-&RudqK@##kXv5$C zvQM3Bl^W@oSEaGtrT&y}SCUVkK5YdB6C=fmnyy2yl<63vGjgicbFl?VC5EyD*KA?u zihXw%CqvynZJxltAfBsZ$Xm2-b=CRjL@rV{G z8H2Q)3FRj_zi&1ZgXw=h7}Y%f>aKaHCNhTmx6Cb)W2XkY7$ z=zuJ|YtoQ8nGjQKs}A<{0{9apWlt)|#ew!)CLp^N&S}ScsjE`FpvZ00y}KK4Fr79w za<|9lXL$l2zi>g{EC}&6O}dgIZ>aSj^nFm*ZHY654&!uObDBX;QZ7#-sX|}hpvX+|xdJ_V_94Aw z6~*ZXHFYrK-z!%3aAO{7$u?%~Ja4MK~8^7^72w52#;q zKRNAAQ)h>n12Iw%+Qxtb425HX$D&CI(`8rzoD0gp7gwpRt&Q_+OhJ%-o|VZZkbgAT z<8j@1o5{GQ!j)#T7a<`yX^+9TcaTe>PuI*jx&w1wOX{MKYvPCmGdGvra z+95shHd*Vz6^foe>~)XETl2wlr|jamX@7Qv9Spvdh@dW)z(&|Ntu((Coxa)--^a^tBP*G-RQ^mxDD4v zQ!-j*7v4nW8jk8Fj<`y|@AqFrj%k*7h}YTA4&J69nWQ_wOd4m_Mr&ys&5BV!4{NmLpHS(AZ^j#>~JR0gjT3#Pn#0x zRM_raR#~|9Tzs(>w^ZJVI=`FdaHN357Tm4zA;wVipQP6G(^>e5s5twGX4lKGgI9Y@ z6)ZcxU+Fb8e1|J`ha@s`ZcRSF?;AC^(s`9hnpBWv-~tio8G)|u<#C(OPZpt+q7kwR zNUHtVVebmLhPl$xWufx>k0|TM?&#Ob@#|nZespM@p6|E9Fus2MzDL;NE;PkR3TI@w zA+FeGu3R&m`=#vkaBXd!TipG2`XhxdczcXtfr1Slqr2FWFmPtIGXLRo`-)NS;N}*Y z+;Ok!x=_}vFMsXTLKYTiIk{bbq+QI5Safn?684TDt};vo>Os$ecu>1?dw(B2 z{T-j#4^j>pYJn=VY)PW!vA63FFUCL)9`!w^vtRmnGJk`q`Wr@Vps49u|xKsr%$4GBH19>)h#v>7x#wO8r z;oP@@lVj-HYpNRh;IufVObQimW{1gk?^v)^XNHN!{PAEJI zjiH~{X55?O!yKA*F?#%=^`@6Wz9PL%E#2P8F_MKnDzVZ;?R|||Xp7+~RTd%~$8LZ?@ zJG8Be4ZMRgqTWB(sp--_>xijKw`oze*`zAX&T-?nUb-e(>$=&6A@oP+ySw5qdXH=p zwCi5CTYO_b@e`Hg<)Mgg)dZSKQ+%_ zUf>40wtt_-C5R1r8*Cn9naC%%qL6hCY$s19M~pnQ@yo$;nif)5WxZ!!o5XY}4jNS( zZm!MC+NoxYCsCjN|Ey}m5AiFOpbQ9)ojaUS^(2eNPt{Yr+FeBn_jeOELpSKzCH@Vd zOGlumrkD%O`rK)W%vA1UUHy~dXwF=G7OHZs7+e4dHV1OO)uDPL6_uHnr>Ybep|F<>W`6y8(8h0K;XZP?f}nZxW&mdf z_;x6ngqHxG1Bh;TI}i_(M`J87rlj@hbaa)ER;5ciQ=EjX3#E3L+L?OLvOdSC*C@Z< zq3_A!FnR39j~{-^pWj_LJ^%eJD1vV}y>^7^KmG9vwy zozaZjG`MseG*`avS5@I#2An1>BczrrwR_mxtlCdpL{nC!ThTfSJk zW3nU;Y3#;)ri`~%aBwg!#6?A}Z(2y}-jSsq@!Ijz|8aa0kK9eU!v>lVK^^R}EN7!c ztp~qeOZIwvJ*6{eW8pZUfrHy-2ycTd_hq zXKF&d_RAN;%-3f@_HZ&vK4>M2Ak}V05D*iXS$qBc`#BKjxHFBSE~FIA&Uz3!H~Dp} z9lc|fjLd*}=U4ChGfiGeS*2*~SiethH7Pi7WYrtA&dk3mP(CXwa`}q7sX{1}`2^@7 zMVX{l3G=a)NhV?I2!a<~I`Qm8gs#@qn&cds6G>X5wmoqgZW+Dm`uB+w?|`7U1O~)b zF%J(HF>-C>cFYBk_Y18bF0rRnmKnA50DIt}YPzO-oC+KcCr#nm(F67+IpYoJ1N0rJ ze)nm;q~*yid^CGk@9H$h#Ru|@^Gqf!Ldi;^am^%)Q>?6Zr-R(m)BlJ3{|w=plmUI1 zU)J9J@G`;?5#pkRZk!&Fn3VjyEl7YF)`c~BoL_L26ESOFg0tfl0jc-L;mziqD)?qy zkd)-Ka&dZIJlAh}sdapABm3Dg=BW}8YEl9H81fs#>q42c`Y(o)aoGmgA1AmfuZbC> z65>_U3B?d1YA#zZU3v_X!GV-%8|P~*xMG0qV%-?J7kwh$CZ}A9u+ghaE^dw!Hjv$# z^LSXYN&S|QS+1XjJ7wvCcy8haxvs07ihjIt&0{5$O#a-3CdYgZZSC}ClweN0WJyyo zFqz3?>S19_vhKFgZp*o^@w4JkNb!;=w*qR5Jb#KE@70++*BE|)n|mrRiSqCLw{O#> zTYFxzT)A-!HQqOnIGl`9(2HU8-Wr#co-XrVA}XI<+cj+O{bAUC>iAg`!O};p{rav$ z!Rz938K;I!<(M6-ad)BXxnJqlNBkiD{`p1?C!$u;BP(<2{f~cP$Ky}@d{8)K>XJ?5 zZ;Hwy-3<=AbpQT+(lV87EM|x@ir$k{`u#2v#QCOUWXbADrIXxPWG=RBMxzeY0zGu7 z9CEMhKzJ9```}%u?^JlnWCMY$6V9!wruFb)G#PTvY6!$)Khngp3TZq&-XtAVsD5cb zk+yG~%UFzyicT#F=9xO4jLwTfqeUR}(aJ7g14IuJ;2k!AeB zkH^!iGny!kx`}o_D#O2uiqj;U+-^5mA?t$x5=Dk4_)6`-mX6JHe1qB-f6X3~9R z$%n)f&ett<;kqY5N&+}@o$tdqB4W`GE-9P*TqbHw@pV%6(g9Y)bVWSm;^9hIwkZP) zayl{+67bLJ6u9V_Qo2S)1Z!`l4=;MIeEJl?=N4(TFyucU^DnKr?%~* z*^Ic${E1zlz@8hb`Vrc13iArX_M|HRb8+oUv_TW|9}b(b$o;Lmz=lnY?Ujg(ik$vP z$8Ndtfo9mL=>x+qQdcMI-PHRKEq46$d``z_n=!_wlk8{HK|2d(pRMXf0P6rE_dt5O zQQIOQe^Lvx8HFtyq->B!lcaEyKw%3Y^~;5+%RVRmV3#{K{Ol zwP1`N6v(e1z5-wYk9BYTcQeV*v*`1U1a!)0jAT(+=@(iKdT8lYY#5Xp-a#jLpZSe# z3%Yt*wtQT&p zs6^-e)Pz&Ob3m2;O*cChD2ETZ+(I|H>u!TKR#<+Al+JRAe93V_grQTA_4?YK{r9h_ z4=F#VFRB}Lv-_1^ms@xZKm#*tEx9JSgu5wYV>Bq1XK*V^>c!y#np{7F&A)9gmZS*< zLM$E}%j5U@0%F&0R+!${GB2>LuswVKc)zGPHc;e{m~ufk`G?3OA@Mn|l?VRVNh#8* zvYPwYIpF!SPK%y_5PYBPK4}+3N_|+aCul2%LRxzpr$DNXc=<1|zos>biOJ7sFgEEw zz%ueph|uCX00as^JiclB`eyrE284zetH)ovfD&acSs~r~ZxguICEaH_+D+?ezU=7} zKihcD8e=|uXu(DY70-5z{Tz6v2^kkigQ?g5+RXGCZG*YmTz&^w4GS{@fE{gj$qqmw zJX7jC{Qj=YPWkn9as9HumL26U!Cv( z0JPr_mgBw(N7>U>RzUg}_`}6^1R4OSz;Fvsuc9GG)-DtydfR3DAYVW~%woLXdRt-sYM=XizTnT=c07M~m^k zmZyQt0AcHU5ddc*yNeiq;eS3^ee|a^emlp3u(omN?4^GSZB?DwORc#twg4>^s2F6T zmsadOYV4}`~1Ilsk4Gqv$!pF`PlyZM_2#c1%z2?Mm^N;F3o zz>)PCZNokt7k|_H%Ih81=X5y)9Jal9MYYE^!Bp2Su4gx8c02{5d1146oDI{A<3c|h<>&j&8f|rscs-Fwg49WaWwcB3(18x zkUs#R&|zf=Mdu#QtI;%0@X3#g9am4BJ~5`IUnd90iNu9KJ7gH~2SVqODc^pjXf12Q_nAxsnYNBi zvx^OrA7VmwAyC)re>hr_3N!S}XIK#(nce$=Z^j*%;4`qtA2EDY5%Mr*d3$mV&Kjov zw{W>L49xE@Gdz4u6(3A^%@G)|E(Ct#NF1hG?}j#{xv%tQtZb+uI>z$3-8_*1OIX}h z+9KrTQz^r0W%)Z(^BBKvB3wdbW?(wkW+efC!)|rd=f2LMo7+lJII1GX3WcmDG(RWT z@ZJG*BlmHLx?ST4{92k%Oj-fmHM3@IVHN~Luz)~|RdCbPZ_GCgB5aEzGmS=MZE>ECX^tso|&6{0AlwWJj^1z>L3>Y?g|?i6#3l@101?LXvoj)$^QB9 zTWe07E(2I|pi=Vu#8>T>L|7 z?Nfki`g1h{F;|@)?}{GQYo1^KT#e(OtI-R%aO(8bD^AE(i05`pO@tIr>Ms}~i7Bw= zEhEtj=R2CY$4iQhX3A~9mH)>-^s?@?8BrCbV04$>jHWsO0IT0q3X%negU-C@FD$sD z1c%~L{Lrq(wC5N7lMIgjK?W-J-VyM@yS?i@@{Rak# ztFw?k?C*yRPiXje-R*pLmfcG+lsf*PYO8Zyr5<9V7Uti?Y8)O1E)xJ|md;pwi%!Y+ zF7cJAxlj8x_}9P`Ug&yH48V{>F@hX|B{cB@a-)8DHM6QF`HaVSQm;;lwSIr5&8(Vf zg<>^7d71smrH*w#_N1FVo zHB|(iI$QJGzkl6iPi*Rx_2lzm>osye1Cw%m@$OcblD>SHc}2o%v$+lvCL2EglEcWz zKBdRr;*CyovA4k9B5P7+;c) z30mH*USVWyY00Y?DwPC^1qsWmk67eZg~?I_ssEUtg$+@xPRlbjyNl|}+h>b9yIBeF z2RC1`FU;>R1!W$Dv55*toz={Ji5Cf350+J;PX;P9 zsrEXrh0?puH3bE4IZ_>;LjXijf7LG0XKiweL_T&^4EqYWXQQC6R`YPEA9m&v?E8}b z?1f^QlU;?@qwl3>c&q)dooofuPYa`@rQl05*GPr>f0IX}6IfOG;0l z7$|jX5lzoKu$QiQ-D583Nbm_|+9Eeht-Gx$BcmsYK}lO?z)1*CU#iN;SXuS45`*>g zW8QsTjZ_#cFML%Z*gRgt+*DSD`(~b%U|w-6OjgQMYpW$$DT*0W>0)+e-pJr~kv_tt zC>FI+Ll*bDcgaWbz*Vi>RDDj-2$;WdKK1!P!sbs!yfSD^;P24l(L-B6X?h47%VfWW zMU?WTp7OO|+BWXguPGnk(4=#*oVq7?yY-=!l{mPZn8mWWxNK(e*T*Q0Q}Vs?`GdBj zgm`RXiIAYVyOXrbbaS?Saej|AYTBei`;=7?y70v*t8pr6!P^+?$loecDJ?rF7RBR! z%)<5qHIyO&gusJ&(+Z6&?M~|=m&s&ivvFXfiS5)(@b{Std;VyKX|A<7vN=9RPxVK* z=zRI!VUwf0%`H2{BqsKwmO6rB5~^P7R3wxP`tjUh^SjiisMyr9$6w&B(J4KvLT4){ zX|OwucVw#)TF3AO+MwZ z#u;%~+boHWl)u^bFGP;IvK5hI3jBbt@(Vyz$tELe8#nL~r<1`co5+Gdf6EnHZosUf zgNhTYlF1p`^OYlO9iJ5%wrSFrRg$}Ic}7_F7Fr~(xzcOOwm}{=$|?-Hpv>HC_}Zi? zM)?R4KkhKnKO1=o9&1(HXN3w}Op#3in_1XfR#+M)eD>^8@5<~Jsn_`oPOQ_Oz-YS% zHsQXR^gV&oO02JJX|fp&?voEq@6=EGDDAN_bZcBjxWMp11Fp*?>tX9H6sXSgR^55q zZ8X8>B?~=tbi9mkp4+M~^BuJYOKRK1iS~(mxNymedq~R?C%gr}<(k(?uM$ z_+vFbKBlR*c2y*Hc2nYBmms<}*xV0^yhvRqGJBbN3*w`Y#~EO4WCp3c3Kx^D3Ge41 z6SL5~Q^RB^akIVJE@OSbONlfyGS}I^@W~m}Z7%QueTiktiW2*>njsR|Yr5Kkbn;97 zvaJuQpIfJ*b&X}(y|zek79E!78tMEU9u#!9%zW1O^ZTJQ7@yGEXwEO+pdycsY<6!U z=r=UPl*LySzDf-?@0IT{gTYKNs1HIF>D*|}ZCcG5xd1Ns?KXjQG+~jxhUUEZVgwV^ z#D%w&rsF;!vHtC`7>*_kR?rRP%_Z_Y=pYKNyf+&-Q1ijpCs=_P`s^)iAtW$5lbU)d zN37G@qyCn91#f=g;J30keq!zD)A))qw0V|fFA&v@6drdTL~kyAc0caj+Yjw9MRCN9Gplohqv; zj#(DdU8W-4`E4-ny-)wIpV zbFuT1j>EVg=1_vko$W<=>W){t4*G-BtJ-O71zWG33!|{amI7P8Wi(Pm-}tDvm`X^u zW=4OR#dyWMrZ!FQZVZQPZ74FbvC+!>Ib0R?$%CG5&)jS-Q(hf`T5rJkI@=V@#AA)r zQ@X7Ik=0(ZE$k4i093|5gS6FUkS-D9p=|X?t#)wGgeHDhXl{;u{nXCcKr)xaR`-qy z8P8q`Aa~F7$;UzsM z0_bwxC{g9@<|RXY?>Rvm^phFBl#P*$0zDHGA>l)?@{V3}{^&D!7dtDC={QWj3+4S! zW!bcGT^F08F!R30GzRq5-O+rd4vC(YynS@m2(&Qh+&)*_@Z5VmF@eCFM+*b^&;R@( z?c=<$SdZqMW}X&b#tG40qu@jPw~jh<(LQ-^yJr((C3t7kvan_yN%?l0Rp|BGjCN`@ zITEz^8;*o?fI4%^^c=DtJtN=c#;dQ5x1NDM_9nV&rVzYB_vmWBzTLy*ZXYrmXHp*qymF?l6 zC2f9(rCC{fqj{E*JMEg&ipZ`_rz>=uAw5?gv{||G##L7(1gyE1xXY*g^hhMqYqHif zpH7H6UR|45!V0=Wv4Rc2uq;De7 z$8s@dRyEAhb5ZS&^nt~T<}6sI$!G8}M=>eN_hj)84xmA~-~B6C@A&{Ucz~fiTBlu= z9~e1d#tH1bwmi%j9sMd24G!fmxKroYe{=5Z$St&F(t9F+jG}FdqxKH3f)>5C3cbdb zG`;eHt8$4)C{-V{K~qgY@@HjbL1NA8#k;TOS&`rjv>J1WYdBE@J-fn=m0%-i-5aXA z`%NIb%UwjYd=remo4yNf6a_Ch@WBV)BDFg5gA$GH2Jjj#!S#D=i<(p+Ch||*DZ&gE{{55Cfru8sLs>K;solSG8V0q` zhZTj@u*)n9xw0F)_*}xJvV$-swNn>gT)2pCr6yZw^COBh5UCwa!fMbm)OMTK^m_mi zoA0ohAm&vGuZY*Fh&I9X8UYSmkNT4c2KHxGPj9dwKX4RU}rBST&(0OvVG$>Pk=&dSgVS4y3Ub;vcwq!?$V z^)_K?Pg&?7T60oL>=?@^1i9Q5cj@?qn`CKmxs{c~_S+$LO=>8U%+t_um*a0~8jB@OaP zf?QlR+TuIyHF=xE8p2x0xZ21Q$`HHlMWBlmBujLDiGSm3ek=8iEG)OtzANoS!wUB* z=y6#0qpKFJj;Oi=qz>Il%-^Zw>%n7fU+x{S9t3H5*Aist{9J!@%fKZ_!c#7{=F^t0 z7Rx~gD$PqsRzTMCRdJp9{(|LSl&pJz?tt^w1Sp>(k4~yyQ+VMV4jZb@T<>;v^fg!u zVR-l+yGgj9P28$iGlA0;A2YLkBa18=Wb)esW0NvrQ!C$E+_qMZO;arBXb=3JAHs63 z!9n)m%1Ys1sTHID$JTqtHJNSU!kKZ@Ga_34@RNrwz5_4&#dfr zuds%ET$;2um}g;Li*%puP5>Iet-;nlJ){W~&B~-+pk7c>w}@3|N?}-9=*=X&h$H!z zpo{qNHm@A*`VAMp1nd|u83Z&WpUI~1ha!Qf6*^VK{z8Y!038tk(-1N+1%hvMYTdWB z%eC7J1k&eZ0;c+t9G&6jw}LLVH4x9io;?+;eYGe2b@0F?CLfm%dop3T<;>i9*FqE* z_B+63wUmyF*zN;M;OWvwRSO8B0U+I)z8q+MJkd9Zk2psLE7k>Hq!SEOiihdg+m1on zKYKjLPPK&HW|E9$H8MAEH);G~g_4ClmnYKFexYI-K{68=vB>Bb@`p6BZxPbXud+$@ zhnsuSXv=pKJ|H$1-eMdF_W(w1XJ$J6$T8UJ-l=WX%s&AtOJtzZHtkdIjy(%0hZf9X zI}bo_YQ!|rq9LUvC+FCHBr(u;uC;$)NWP^4tY2lS(OJ5hmluE5KT z1JcBdUReWy_IjK6aiCptW^lC`rA0=nv7NUxYv`Gnifl4gx+@{Mv!`Qa96c@ZN*m2K z=}<&ja#3Btx(A5Do*y|D3<`~nX{o5H`ek+~U@1C_{?*Zf?d@5>eMv9$%%4>)s8OEb=3@vQ(7Y z34rNaEh75*86ci{K9SuRj3*n`po!DTI6=Msu)Fh}uW1ZMDPyjmOY^lp4i12;ewm?- zn#Ltqs1P>VT##}p5h1gG|Kjuf^_5M+mqX&tMjmr_X#3g{Bkhl=z#iH4&&8AbJAG8M zI0fm_z&*`fhw;|)kj>(QV=IN7IJQy&={Do1J1*>7X;l?4+b6Hl#Y^6D28N^cAnh~M zx13i`wbDKnC7aA@WMYCDt_;v3zp#89Yi%Xvv=1{XORL^4Dw&Ce_e9>Wot(^vxLe`34?)2erZj|C2;i|BdLAhWS* zd)U40O~4|3I0csI+sAueI4%MTt6JRhVQmFzcC|Q~A)Nu6F1x0A_{{#cgi>_pHhsa|kTkla;M~4vm%eM;AHVZ2dT=Ui#B66y%odj)g>k4i#}K4;Raq z01X_q<&2&1bu>6^=GdBk<=ZACC-TNP=h_Ao(xfl=A&~cFv$uJS*Uo;#F)iawiaTM9 zAW%1tbr6}BVs@gC!$wclR`8;u>6384oa$T8igk1!yMu3XzLQGwoqNn_nBHEu0Abm* z`T1d0HMRJ(^N?*dw)VS4$z#puhUGNX0?P%YLv}ajM~(Rfif7lq8_x`;SnN-i2z%;M zdk5^!HY+O};AFN}Z2?nC7=ER+G1NV|G@_4voQ|!#2&sryVFPU{!>4FR%&`q^-efU{ zG@ee+ftXFUT~yL8&<9pT67Wb~-SN*K*CE{p2Ze+ul(j}-SC5e{ges)rupw0bGDdpInPI~oFNa}04F;3j-m!P7>oTJTQ^mTB|JW0aG zRXQ0wulpTf_E=5C^h*Z^5HiM@_V4AkUPQ3c0}?{uAM6t#z5l~rRj0n`sQNmJwjOh54a51{@A}V&9f59cv}zN0H@4rS zrMF10=UL;`HZ%0Y!p27?0b<9WH34S{-0PR49f2b~5OMU`jCV}7F?Fr3R-pSJ8PsuD z@yL8Gw39pA^~Fk|cs$IOw7#-mxAT#ai@Tf^T4Zbe++CD3@Q|CUchK3|#8(h+EUi<( ziVK@$C4WDsPWeA;%D$*1y`3~n0O%(3EyKU61)Yozl5;9qku z`mJ)gZH~T(@K@ubG-mPwK6tTQcMun<2#{`0!O+?k<&BS!KcZcx!xe@O1V;m+uv0(# zRWXtgP(FE}!MwkL&h`Hb`3jN4+{;%+X~&MfWxH3y58&kUXy`~d+;BO3S4l@}>+~$6 ze67W{H{ozw`kd_BBWP< ztJ_@l%G$e*O7+IBZ5aWw;lA+ ztXE1XfAWQe8K-l@tbMKsDnPi}`n1UCEyf zx;Vxo(3og!!3SOMu3fQm4#)&{@A&z#_0Lx1$4v*5op=NRu+n(W>UWiDYW>pNn{_9c z5q!zeR*%flDA{-x#0^gPkd5d6^Ch0giG@4?-Z-!s0MljcEy%U0y5Ou9;P`|fX0vnCfbX%fPI$yS?|+eF0k~D?`culZM$sbB z!dxcc?ZywAk~Gx<9QTLQCSMJVr%1>nZFZX~&%6Lc;8+kB_2GeOklNlfJ#&vW?UQZH zm_vUs4G*x6u2x?KzMj;$w5}*bZkRVv4^8QD^#1heK?#4$XT(|DLt2z zbjEPefN7s`c}SU5Ry#-MnXW#YlLf&)w%W5a?hpud;4Wnxp}HLH4yJW9onamxMrn!O zYOJaNdBcITi(xfLptBRfpUTfyHFNlyAqZJwSegAi_zg-d1b})2>c~s}z#=d@5KO_* zJNzEF3j@S@`4VV&#q|6%D4tVkyAqkJUG1KpWX3O^+s2rBOBqoXKK=c>^=V$iBj)4B zj|{Twet=UC+utvb;ZkuXA88G~p}AIio3L>Vh9PGMf?~w)t{x)dVG>U590Uo zaASq`+E#2}Fl6lohXd%1fAIBcZ9dN4+<)i6?3x3IMqZC?tRY!#^#p=sU z9>`ORj>WZr1Q0lyH~)U2^pBRH-lTb8cH#Kx&yQ!3W~-r-;0FN@T@D!k=>LyGW|$DA z>k8a0c7EuS32T|TGvzFAsI>f}HUu=W1-PbHDKvM9;0C{BBM-i7s6R_l|W*IVPLSqjSwNl%t zq~lla|9lrQJT30?(Yj|A9Yj?MHO?RC>LaP*MDB98i>?iSpTKMikBgig+~Z z91nP|rkAJlNFip#p?nxU7 zVKW(_2>QOt(&}+ClNEIFtPg+9NU85DVco_Jk1f=E3&H_D*dO_^+kbNFIC}(s-lJ9p zVPGK_4YD$zUKIakVWC0IqW+X{dspOpl)SoPi)pvj_zW?Xj z0{ot{9+XR$pe01>P2JR7MgWM7hJz8J{=W6()DL*zE$-O;KR{D=WrS%poNu-}?bPnv zeA!G|8WIOI-EMmqwNoDk0vQcFlO8yJw*a;~=>$c%iw_7@j_?AJJobs!v-Ebb%wqx> zVxa)WiJs6B#OZkvx`=Bhr@p?LEe%K+t!Ha9Dr5^K^Y__;uSaS`fF$E>N#R=Za>2o< zB1DW8i+SPh6vwNzz)rt7*coSegoU8bj}v}AI7Fu4yP=4T#j1gJC1$~9$B?A z(QyG{D(K?rGzbX%(;BL$+ut6J`ivO&v{kBi*ErS)@WbC0eF=o?C=w3Ax>C1iJ~Kme z;_+%eB9*+Xw?BsJ7Q~@-fWf$XW-vGyq$QF&W=l%Q`|7M31s1yWvjmmU;^mTO(|yID zz4qnnyYzWyF7(XCZvIWSv2)$h=k7MvpaDfzJDoKyEPCfFfSvrc`;>r8} zC^R`-JrfGqsUQ7m;#Q6oVRim?)ziu2?zU~fdLbSDk>!QO6-;+ zm|%K#CJwZ1c@L$x=aX`P{nV+~ZyzTDnmxGsIH&@@YfdqawWPuCHm)P>;~^P5cXZfS zYaK7+CutQ1CuGHzX) znwsQNmqs1?lPNn8s+(tDk~*c6ownD%Nj7daZ50i#uk<5WX`JcPk1^r5+7s0ogDvl* zc~4+Q_wS$KZW+!qt#$`m?Xj%W2iTs?Tofaqgh7Q3h`LVE$!5(5Vm9os+6MHj)#oW` zbj|-qz^KmzOcJ}y*sXcctpjW$&7ijJ!tu zc8WbEa)K$s)L8J>O*K_Aat5M$TJbZ)y}P@&{(X&woX#RX1F7dwavafg;C1kcxW9ko z13GpE{_w5__+}W47m@kn>?LE4U$Rg55qL=?DwG_#+4vpX!Jyiy)u||}qlS7YVkbDb zZf|_=MBKLfTmoDrk9GqCSQ>v|qJ$2{amSGH?wJs90LTbrkgS>PSB?=rk#x3B6>caQ zFaf3mF};~oiAJN1oyobz=MysfbKTwkgqRdE`Lp`RX|dB?jor2B=ezmd<3X)ESL#ECEf~JAhVRUba^>?BESmY&<$zw-URkrXJ_Bj z-$1V6#JgTPla{xDBGFhGi)WSew&ZgsS5d&*UVMPtr#C9MoSuO<{y2dJ0w2GBU19_3 zHneoC`(eQscxhU>wKS-=DRinp_t@tR+vkmmmGxmjxgDrz7`C^`9`0VSUff{zW)jCM z`UU?ItF^_maRYm8L+u`!$8af7k zKd=blkKYrPp7;`sKNYg7T5{@ZX^vuNXOTna#K-RM$nRf7#WG%K8q{VrGIW{ArpN58 zwyG2tIX?3*jq}oaYmAz1n!8KRmb7_MTFq9x*wk~d;@IFj2H^1SG1D%N%6NANCt)D0 zI2E)_6_R_0kvoaQI}c|DlEH$k9lusyKGxRsKlqg@0)FJIBhK{`870S4uUGSL;!9xOhBISy(fVLrSX zOLScz?m_9Q5=j38Ws%|Gi;}*uJB`)#i1{6osj(^cQ>%3{@phap+VZ_X`nY+!Wo-qa z-7I_O5YSc=a)w?~kgqIE0Uibc2YpxsYl3_=nSl-REjIQ#UMs}U1bB=M{NOiavN<_s z0kr)b0LaIDCHTbq8{|;j?K_AE7G01~OZU>xw;_jO05ZU`lc-#HXG`Q7qSI4rL1i1? z^oR-zeb;T`ZLYAlW~}1+;u{zT%noLwa-D|R94l>b6Fp>`V@7RtB=&mJ$stVZn{1tD@u% zWVMax?*UL7z(Zs$^wB)iQyb#YK!TF@_)aXw!px}MINQukYb9}H4a5||)&FR0{uL&f zHz(E>jYbID1Zn|mYf;1*1`3Wh){5fxNj8=4yWj6S7mI+xy*wQMx;TeBsGR^T+038` zY-L2-JROPQ5H~>gY#xj_57^UGSJx!Pl)CQ>2ji%~R?2pX~E9dPU6aEwFTeYsWT zrdYCFK*UiX@MOiI2bQ!9#bm{HJ1$jX`t8gi*a7*G+McI9r(!Y4B7FgvaFfN;4DNWAxRR-e?XCnZ*Dcl?KMZ8(VSDTM%~Oz=y}@`l_nhe55>b%a)#YwSuB@mc zI?aqacU7{gVWqvcGrgaT{X%KvGJeRE&q*U*pueGa+)pAdn^O&3OstT78j55+-`1F!8Z zukDKN&XuUrL8$^ms~pL(dSuiqrro8{Wt(yL(m`wQareHNh+w>iT)CS5xZ52td&Z4H zZJN)224y)iLa*m>n`iG=a|g9)N782@I_&C!zf{L?eD6-G3#9{E)8st(7@wRpRtIx{96CZe6x>tmiex?!;U|Ai`r^;?9V+R6mNn zZZlsIrl?wQWxzV2j%e#~JI^LEYCgen9C_i&`z2r!S zyjwUZwu_A`rcxyFi>*eWs!46OJ(UKhjcX6+vAg;|7{=ZzF{bgw<+5Ni^0oG$q{wW< z>F*B0jJM{ZKl%95aG0bPwTQm>R3(h?x^q%kM1GNXMW_KigW@<=!UoJ~c&iK(3VFQs zo{=lMt3Vdfzcrp%;i(kYg-55g-%q9B0@Kuk+OqRAECMdY=Cbt(PK&C>`KZA!yV#sI2WRW$Hig}REI%2sb9RYz-{obLSHgIk=#dul?8?W{qqVtcCYEZ zssqz7#$4CT!%O>Qa_(|1K0RRv0eo}(;Mxq2iwEQEoQRAI%k!R+S0SBOlIn8equ&OM z2oir>&eKpYH{p?yKa>WXF%`vs=BC5d`=4CD!w_=93ycPTSkK3V>KiYXSpwS{l-1(~u6U-E`**`!uu6q7LhCP@b z^8C(FWVXk6&+-e`gXz^bTU3!e(dA(^kqa3H7zYJ=PAbkh!rqR@vs)oEaTm*-19C#H z(MIIBD<%y_$95RmN4ZnJQ}jE~A8^|3HY72L zw@r)J(#~cgk;#^Jpt#`bCRlcbMLdO%;Sxvt2?Td1>UwnnIzMSUJwyEXWF#M#A*lr~j(Wggg#uH>wD^ZbY1q zn$H}#N?Zu%a**WK&xx>8&IyQ$AB?wmw=5s%<}(Pz>bxCxz4JpRm#*X2k$%G>lbeI@ zP~4nRcXr%&?n@$iVJ2fAVk@>I$zM|*9MfUwb=CSf-39L0y#CkTynb$_pnT&+yZE&8 zVpwhJ%zBTmFf6WQ>O&#=rUB$^FHPy(7Z%IBNGecmu@qbdBesgH-B&PP)anF}#}dU# zQNf;%Ig3M6^**n&Dp&P&fZy>7ZM6%_cvZDve5 z3s+L9hpj}WldR>4{4E34IG&OH5Z1=FuiqEmi1Fq3wkqO`HLu3Dy_K1F`*w#???SzO zF?Wxen&?Q?I~5$;cotC}Xj!)r-D{h&dX9WE|2vdyLLJ8HJ(ucE&NYbU->brcmOu;y zURQdym;o`cE&iRl)oijX9D4Fe2&7a^@K%58;vh7cci(3zl+TS};RfWJpCrO9K07-b zDm!|0U<>)~AxD_+)f**t;CSEC(-)A|!QcpEo!fmGV2MxZV%Ss)7F0;Bq8lDvb(i$c z`z!Kjxv>%)mC`J^4)UEIXly^gNsDEAbbp_fIr+W(|IV3$2)BlwSCNKuYD&?EJNz%$ z)rNKIC!^#+h;z_0FyMjGG11~OS(MDcrTPR8d^9>fdrMh+Tc)pwD0`JnXeX=F=@ufh z{d-!-deAsr@1=R8TjWi>5KfJn*DzHDjQ#!Ha7s1!aIbL}7YSqX_FB#?BU9+&xUBzf z&*Y!wAu%em#H{Yq$X@y1+hx{o9B#(uf0l>M`TEXQ0cS`R?(l1{tAPmdr!_vK3vq5F zu*+HuzW3bgQ^}Jwr-aOYLNh9|qesS=`|_9g8kqVx$I7k zh1#&MJUwY1!@`sbo;d*r-N~@sdLFv6Dk)Zl7JPZ+<%rpJc)oPL%kn~BUt3#jC70GQ zsQ|g_`tQ~A#5?;;3X3;mp$K>@T1qb7RkCMu(C_{WZJR{w37Za#SZ~UNpaxI8Kn!b6 zpB-_i8Uy_G^Bv_`KE`nMxwYc=4YidT2Wzoz`gihU%>TQYWM6n`K5bB-H-A?s4z32f z{POTE?I#DiWSxb<-Scs~X`=2PxVrVM?iC4b8B3IGYCkse^5Rr}*E#0JgRj0O- zft{Zl+0m={fO`1IL1CR5^(V%a6;p8oOTb-Iw}0fVd+}9kT!)F9?b&8teSVsZ15?Jb z9ZmN?;RL-s$QlC^yo^Gz{{dZK!gQcvFOLf^z^i@h1&J{nX|V*9W<_SVAxE`i*Qp?h zC|-Pztx&;%f~(VF60b&waRtMTJehXEw?Ttn{}+})HbsNHB?eYs1)_}J>NBeHguKld z?61>qbau`kh={=D^RC?}c>s;U4zGEr`(9`z&3$-(;k%s`U%<$5xh&+{r=Lz;tJuPj z{m6ag`{=mZi{4?N+bRe&%;emZ(N8A6V6nJC1*aE>czgKb9vEsu#zeU#%G`N*QEi(A z631Zp;#ziV4kaoJqd> zWR$k6>YrPlf+^sd=$O}rS}@+Ef~d*g<{AKz(CYRgBQS7GR25eW_)>Z8VTeE5SMHS6 zH0UI@| zPV^>`@88?Iof0WG6KGncYpw%~AtPdN@zPZB^O2V0vIz30l`F^5MocA2h%(=a0L8Ya zz{xc5kE>+3QQ+Jv@^(GQ;E}`qn)+(}6#4=^rqvEhZKR0F zd70dqgp1@=o7X;#j34-GS~T39JDG*cMLH~ZLrNmGKk5qQ!s>JF_Chwi7pL}#4Qi5H zt2wO&0?PXo|J9H^%I*uA(FwS5Mw=0bV*kv$C}D&vz`@_NJ7(QgSP?3D+8u>NMG&mGtxuYp@@asQ!6R9m{et-a=iqP>X$9*;?8V z>Q%aA3#K>NSfTi$y{#=fk+>9I$(p7eMrb^dGrk+e=Q#f&yBWSQ0<+J*l>d1)n&Fit z;4R6I1kX?QD|J0c$)J;`r{VB-M%rXekvId--(P*!u(@Y-H=qRNIIeFH3qVaG%55jL zHA_p8MXLp@>GmIhbN&MYeQ;0LO2`j;5z@(@+oo$|mz3{dud8F0-HX<)WC6tbx65LM zwd#CD#IUxhg?Y*1?qz3DanWi<3W(`dD51>dxhZz5#p4+(YE9J@v+AF#q^9?0QMv^R zSiXKkz1uP4bjm`M3inDfVT5~Q<4bx<5~w0sEkzxeQFpLDr&>HGuu~5Pdbh^!@D={& zi>0pJ6RXhsa@b(9?M)OjPG9cnzIeqUL$pvlaPx|&8Sa}GS-?8~$i<(q{@^cFw*c6E zgm6@X=Wylv%fWJL+5>R%n7y#z^QXK2%sxHgcf@M^O&GS9P&@Gj)lD=tvp z*{M=t<>2RMI%Z}zQfgD_CAaY!?&}-ZWjz)N;8l>$>TX?)U0=v2A_sDmoyVmbv>@V_ z#YeNF`khi12>};4nm+NZEU#cL{tbTpG_}d10<@?mgdYx$8+G_6l+bYn~LI zWBV$4aXth-ZA|>eXd^J9@=_x2l%$n#w7|+?Ff%O<0QJ7Mov7N9A1#hXzS}iX8Y4H* z2%-(aIGvbS@PW4xYJ}Z|tv{i?k;_%)<>(H=gFX{?PfcRB9f+_gInc=_%ihx0Am4r+ ziZ6Qc;uq5Pb{d+ueU_A;k2Z}XSmkpH=rye*U}vM-rtP~yp!hL5+jJbjRvow7IYU18 zKlt1aoqjMWm!$d-?8pLfSsx54xG5^eMa}Jc2PFF-=8i4vR$w~9-|)TN8}!VB%l>$apIno5Sl4E_5pA;BC9-YjQL16MjjbQ~#9I z$wx7lHYmQ3r*r|hlD{u}r!`XKl?=<-*gb6claV3yYg)m~T!^Ax{uQ{@>Sw?SqX*yD zRR}WKo^*9+`M3SU^1 zC%UP+blg4rFj6w;e>t+Cq7LfAI#sTt%0eD~qPs zv@o{!KO9K52uar48`bBl_FF@0s^=gQ%xgaPiB3f->@mSsAx~`0{fm<6 zXC2hdD085YAR__YYr5`Jzlw_Ue|^ARR6HKw$;hn99uqeuLB~YbJ2&??9eqmK!Z7@wu5a#efxzrwidNQ* z_jY<)HXa0RLUYlBA_9JF!0O&Oyq2CnYryFyllw99Jp(@aqd+Fu5YB6nbZ3UZx=<~g zqvUQ{C8I1}XSBe)Tck@=fSS`&v6md8r}E${aKpo>gS{M~P4b5j_mXAir}2fwb$rjK%vhx!uewSgbO z;Rjbh+*~DrkbFdpjzumr_JN?;Gb-oVa3sTxQkiyLcTW_s_`Srg^85_&;$PlSuO=oN z(0wIQaF@Gkl>^r{&G-F!dvt6&-kyr1yoe*ex!JX)7e)y0=>=IyQ{g~Z5i3_p2iGW# z`!U01eKPe2tOU?X1Ffxq+PQdM#irlXMEjOEi1^6w8LrBn4PFwp^21fKdm4I9?}k;4 z(}t8&-Li^aY(h=ye<4Bh*r_|^b=6uWHBQ;_;^H?|E?y7)Yl}Em@bTlH3D?0nH?3?t zY_u*?RHpm5h4bRQ0I^4%Kvr~dDrpuIZOv>B}q25eNHkcXY3or1*BaGwrWPvYefj^YB$ntnBSbP!x(33a07w}#R zuK+!eP!y8m8N7DaWat<~B-;IiH4IZ|0MGm;MJ3igA=mAt{Zg6Wp25w@&Z^|jla z(TTjjZzkpr6q{z@#Yzl3t%5Q0;KcTQ>dnnQ*rS}s%GBcsF~M~eP6hQvdQL?}Xvup3 zA2#VZ=oj^mR=cx8CzW-`n*+CfF;uN|DQw2C~KEh#U zVPM9Xukdn*2&cxU9bu83I%8dLCL}R=9uh>MZDv%AcLp6F)F>!0AS326_w62m zPyH+KAkV{}+^U(1PoZd&tB|kPxqkgRf8MV_6bWC9r6eSZEh?kzA8F{mTzieyUo#&R zxy<$LPMNiOQh)=AVQfe@`}~bqj!cQmP`N%$9lcQV>O%8I5d05xm1usM)w+}ZWNN<7 zi`2FmKJY|#NG|Jxhq;%lbSv0fwy$KnoqJqK*7D$Afcp?%S7nNb?ZS_YC3r}7Z4Q{y z$Fc&!S7evqx&_HCIBW#ARTH3i=^d;q|)NNi_^ zSJ>bsOFHc@vppb;toMT!IXmWSd47F#RX(iSAvsycI4dPNpVVPRs(JDx4p6bG&73OH z2o}5B4)aZ#rj0->Ug4E)Air>Hgp&m~E_o;JQoOqPv`Yrx(lO7{$@&vOD~pIA1g~us zSA|1!8`;PtEK4exg#G3Lhr>OV43#Fg*4ZLPs+LuD{LE=UUpzr~(axeiHF4AIpuqL6 z{p;<&GY$pbtu`GXJOl4oIvA1Stl1dVmA zym+k-3y)P5xT$>lP0g}QQXI;vQN}lZDUq>uz2p=`vymJEJWUPUygI-E$550np!3C{ zL-6fW53k|K*bZYUCd{1Dt5;-%2e!`$qkq-64V%mzErS-05 zh@0j0YKF3M#i`7Hd-1Ykc7vY-2y9}Sii%2^YqJy-F(m=tY|oqinhg0S6jKU@zCh=a z#uK+FUpxE}tv`Sc7i)Z?%qACg(;(Qx(lV~tLK9V;695bAd3rAO1y)4QWMMFWSG(R> zvHqssdA;u&U*3dij}nwsX8Am$)aC$+vu9MZmx(bLuL#$d1GtaBIK(REyhV+j+EBmY|$AYZdK%M%vdoUq>kda}_lI?AbHJHYuq~l_kcdrabW? zH2^aP4d;mHW~I1P>1QI^zYjkXLb1G}!h8t#cH;rN*F6phcs(mAGO(y#~Lls_1nk5#J2HwS~*)6y~VXErPpK`2}*Ws!MJ>?soZ3tt&d`_)UZ1&SZ zAKB;6l;!0_-r4LvrBk<#tE|odI@mWh$|f4T_L$>1Nanl}8FUg0g4NVTkolbx^{Z6W z3)qo~aWRs;sa^{@G5rArDyMXXIsRbucag5}83)q3bplxfed9t@%IwDU)_vF~yhJ4g zGbS_tB>w}XQ=Nj2uFP>*8>-D6*Bfc$RSmRH9UC26!QlCjV-sgnLo&26%x-_ZbUUv8 zR`3yH7awU+Kuly|i>*ALa>wdcOL5^Z-AJtELYKqr{C06_o~U~V^|~*Gl|{=pWq5@^ z?h0|S@0`*roMb$Lpb0X9O&$a93-z%_VNyd^y~N2C1J;*+f`Q|?x$B=2f6eIw3Vl;= zmkrwXiFU0)8}i)3!J(jczFoUEIscMbxpg(j?Lh8&T2&Vt)uNx*)@LhRN5zJN{|B)y zF>xN{OdkZTB?7;_dDwh4;rcI4?F`V#XZnrK%s5$T-|}*fe4hdB4;En?zOrEMQ@^j6 z*nC(uft%#}OdI)^-5=A!o(KQqt|xR{a5B}+d4tvI-`S|hKJ-(c041fO3ZiC5@oI(0U(b`Y$1bidc;I|gH0 z@Z0#S(P*I}i@*rh_6jH2!_Vd zR&*g9zcTTaP|jBxV0&A6uFzPI zX|^W?x88SQy}|?;2B;*a=Q+siMYWaX@Dw5qjpt?9Q~-81cr?iOb)7QYV{B2sy~Eg< z+|;Y-@;A@ZY8UYSG$~J%>FF_~rpdp7o*JH+b}}U9KVz&8-`X1CEhZDEEQe{WTxcm*-yECr*6x;stS}k zK|xNAUeAZb-3u4`2gWmRVB%{)7|*I^UiQ|CHIt*3#hw<*jcljshza|6j8rX{`aL&z zNDBl~{^eax4fyZD>)g$V$&@!!&_~F+X^k(d92y&cD0IZPx9ch+UO!fj3^c8XMvh*U zV2QE=;2j5kni@MJ`d^I#@p%2#ifQV}>vPH-_zL(_J6V63+~hYF0a3tK|FR>q^aliz zn^Nhwf5TY`Y(&%LpVAuoLuEc_(5AA&yNydzDuPY) zQI_!}l5S>ztd5Yn#5NI6urs9oK3`U-nVDIBK}j4|=_;VHnsTPsd_4LhQZ}0em=LV8 z<({vSX~Y4Ps7}4yuARlO)?aF@hU;u-HG_wp0eDQHHrCruqkoz2iIRa@E|qO22?oQEK@zru}NFx9TwDsjLrse-&-efM`)V04SN%QVlBOrfXr;3BWl=-ZZXdQg6! z{or<{P5M}Y8hr_faf6IH$Z5zCVZq{bX2yZTk5%k$`aPJKeI^~AMHSM>4U%zVhV};L zWtQ}O=l7&vNG)FWtga6%QF0_YrRk)=yO$^*wLV(OxGrBGKR@_Bt-tuAoagJK`Vvy;@PX5DO{?H94qiquoE9T7uAk}u)_4LXQW#7uk#qK@J!4~h zZAmg(mMw^f=YI`IxZdTMJ^6mY9&i{h+(pK=@L%TM1#B0&=&;9d@$L-_Hsp&I7^IOH zUPYDJ;v*TQMtifGm5iw`UjP|D`y!)yfp@YBYV(w+KzY*aW@3Ja%E4jE zgh%UMRkJeibjK_j@iom>{swQSPw0JJ_(56}xBp+S8(g zxRZW#ka640_ck}XZLm); z>R!#eq?)bd0s-5|*&?G4585t<#9~e8Zr%F2f1ZN+Kfjspz5uesnQ!7!qg7w;kLG<; zyS3bxug9ZnrZ*4lL+NW4J5J=l$H~8#fW0q0m{K9|-YAuBe>1(2XslRuuG8)1Y#^A=_)B|rC;-VP-K*BQBP=g@|Q?Xm%N-e{`x>Stnq-%kPWkfTRmXL z8RnaL<`|&F%CtRmFuL@{nc7FDu**6Zq-`!K^roVN$obAtY{9~{5~L&(&%$8GgKlj= zh+N;PyFFiLUYlhe5y!Tk!frtZOW+ay@3D&~|1rquqsUu8b8LR?xf2{CSss~Nj+UGA zDzqbWpTCr#RL2MI08jZ1k)oVK&BPeT3S7o9ddW(1;Jw)w=tp8=lpM(dLp&QtBVU$^ zm~G?7w*Aa3EiHB8hbue>qK;Np#`6UHcX-f5l!1}_z;MpRfSruPDTnR3ba@hV48EbJ z*zTLffgH&?+8>bxN8h5RX2YxL=I&eJh|di?!j|L{=6Yh}#6)BY^Sqb)kH(K!{AYcS zvZ(@BU)C&-IOLLQ1PEIm+naNbEDpnZ=iQH_|F{-gacj; z<4bVWdPlpoo4UW<*i8P;1Ar=c9$RxA=4>AS5&S1HSB$Ti6C{fxYZIUC3Q^j*mRlhD zZ*+a(pOLQl1tMVgzR{xFox_yZqL(x3)phQ$t_m>U<<<5gsd0n-;M?Jz6#?5YePKDN zd(UZci@3X{5$I(eRqkXGxHlQKKykFS!VyQA#u=?VSI_)|-hawu8)?(gCp|J^Tvk0g zjs&xL=f?s`hdS{ab%qWmwd04gEByk@ySOs5?VM32d<7|5!*9Kgd}iAX^*YWawOb=G z%TqIl)zpAp=~ztLua=dO;l(7&P2_>Mv5ui1C;{sc(>v6VKXmmH%9eRehywbj0q zl)Ga{AvpK4GImgcz|#CCtmpR`{ae;q!G9pznC*_CePK@&oUjYQs_U9_gz~fV=*-Cxg<_VY;`&AX0X=ytvPf z>*)(b3f{f0M1y&E$Sn9;O(|&}>!*Kk?q#3zSOVO)VTZV4d-USv?0(fOaeO1|*PO-N zo1E3vf&4epu?317vrq)EysKaSCL>`GrIcU`y6DBJo#of2^*i`}F}-Gl>0Lf_CC)|U zTZy1-r7Zd>;%*^84m-R+VWjMx3O$XU!#%|}>u+NuI;OAFg{|~WX71snc7tlNHS8t8 zoR|GX1|v6qw+O8P6>g+lapq?x&%c;^dwSAQ;uQ*OOK%+USr6ua3wiRzk`9Cdp18V8 z^^VY@o3R&x}!OJ`p=q$8% zpu4K--8701MMkY4aJ7a)C?WpUT*BKJX&0=*+!Pk3yiPXT>5dqK{)KB;pc5` zF$5}t1cTYe{IP@B`8xt$Pp|5mITa<-(dYS%b{)8L0}ofTlS>~i=i)xK|H;Q^b)6Hm zae*X;>K7a422-#Hiibx;Iba*kfdrypj9Pr@(8AwuH=BC?B+}k85Q&S^>)c|6nv;ns zWpOe6MZzQdva;LpZ zFkPxy!;W{12QS$uw3XEPM)&*19A&|*ZC@65SBX#Y1JoDnn%Th=9L-ZWcJ2-%vj$h1 zjm61ssjNSS$Ksi;}>-{n<+#7sdh> z`F6peJ|xIXP;5(rhTrkoO6B&14hrK&)^cx#7%L;4`1(ccp{{qsR=JJeDC*Mq=&?=O zEX5+r_T>*rkBq&E<-zztGv5fXrJ0Sp-zL^KfL}Gwmkn|6_{TfImTcv8~R~ z?dg3b6MXKpR8Pwgaw2de#dFrd!d-u-!GB_VlepJlQ00`Idq`lG%ZbAzq~oTridL|s zeC`fWF(v~UCIhjQ=m}<@`HSELGv>(ECu7?$_tN+LJreYJE%L+G-6}1ANxa9P7Vnt1 z5f7@l{I^i*Aa0H=b-Ym^)h@_x07~HKI?llt^(aT)XK2UW0|}$#4mY>tFN*!lz7KtO z8*(aoEWWsPm;9(3(yrD53a0CmrFd@5z<%sgqrQ_ZDEzaC!QFeqE`QxT3MJp*oXM@? z2dF>8F-tDCQrL~sC`Vs!U65z+{ENe54`FO}r_wZ_j}vZm{p2Y5`TB^bhYA>Ym6T+2 ziF;2?3`Sd6`vwuoH0rCeH=)&JxJ`w36}g$ltGT}CpO4C~dbX&Z*SElYtN-)omOZ2k zz5<}`o*4?I+cdgccNiaJYe{wwr;)BkK8Q_Clvwc`u8_^iSbSO&i}yseOu5$2mP~+o zsu&Z2Dj6su;NS}j2jAX-c%xlMsFW2L@=BCmk=gk`mA*f;(bGEu??saa&GK3mDX>3E zo{ZPU2v=9h0_KQ1O5( z%hkK+#E6OMqh#iC+-DUT+Ik-Qr6XknDv@*hWm2~rlf?*NipLkNadj@Cp4@u>iT4xejG)TOS%$ezfVndn82XD zqczFl@SLfkA618Y(i6A=&{#-N@ZAT)!qpE5#5LR?Za&h)rDvsKjndxUQD(}NN`5PG z`DpDZ1-*2g`QY!FuC#*a9<75P9P&8i!Crab(JyQWD5w&1AmzuwcZijXYA$}wMmFj> z+Pf=z4SD{1RPP9LTEQ$=!4Pdx0q5Qh0*^;?2x+%yuztBLy>dck{awIjOgd+hOm$%% z2rpK48&~*74~HfKl__Sh@{5iFTS)?bT4`ox!T9i$!kOOKlF`ETGSlF)@B)KargOKDabX=qrg%L5(p14{C1P^(gbR6$rv zvgodS;O47Y5o~p`c%D8V(G2kx*G{a@+k*v5$$?K+{E!z?bRv&~* zHAm$O@4x@lev?o*4|{P7)84Lc{z3N@QfdneZ&}AWIPct8zZD?$LH)5ZpwY_eigf{p z{i}Ht)5_(7KpC?#1PeaCwJ+ZIVa%l;4+$G|HN~0QRskB(11Hug=+VFP6q*X%K&fin zy^^Q%brqg11c_@a!pQv0(ULdV{s-LyAD)j8B_M)4tk*(6RW(%XW);mgtQ_67sNO5c z<7-pS(FUi2tDmUX*bdm1I~c|v8Ls$mTOhp}Uc9*HgkRf)x|dayFUkfU1W;a~RNFBW zp~F=WrOTZ5uE{+0yS?8deB>DVYWRnwt%(Ti6Yd%;jHipsXB-;LsP0(X~YH=AkV z)FOc7O~)6J#T68Z&BrkBye@0uH~uJYIyx;T#poUv>NB;wHG0$I4Gu7DHeq-kS1CAUAS{ab% z^ff7Q*>Ak^?w6eLiLA1R`^Mka+wD}|b7gESkZ{R5IY%E{GB0uS4Vh(ikK{XtBtJ7Kj#CgaN5CK-{M}QS;KAN|(6DXWOhNMyu`N7UJEWreTq(qR*A_ zef`~c=QP}$h{jY$funDbSPLeu_o{|UzP`zJ7k1i`UPhyC8Zh{*ii?GUX&qcvqrus( zo%*!RNJdEYtTo88;1r$=Jx*8jGvO&r^yLFr?qu*vGYtLnk*tf83Evke2P3MCCj?#< zMZCcq=+L?W!Ts|a1K*QgT%^t!Wb9^l6yMqkv?r_0k75H4gzChY#vmlNe$5iQXq!D% z!}r^pNIdx2exE5qPlbP19DJORZrZR|$*R)pbJ&r$lh}(?C+(o1DZ5e_&!yXw1QayA zdT>z|3ZKlK_FEm_ndkF+Y^Pfywc1E)$e%bUKD~`3bX7F;cw*8eez@-YO0~_Nm)uF7 zPWjmkQpN*8Qr_{+KN68r%h|p1%*ZF3qy}mg4mr_SN52Dcx|=s+Vft1zxA|O9HFotj z3Bu4#|HbsxnhoDcFUjMt92BqV7KBo^nzt8vV$E*2q|mBT(uK5Ldnc={>3SSs7dD$; zRSfUs#|skJkjK31Qw=qxQh33t>^gl%&!bdgtF&j~d(Fyl)u44zXZn>@RbJ3V5L;$0 zHZ>v)(4l$Ot4|k5$={wA9XyBk#y20va^#pIs;Y=Trv25BN1rg_v$H1L$=xe`8MKPQ z=q6&4fd7$6!4bZH6xFb~PmF;ff1Pt2Dxl%&u}Rz3RyWCYa#IEpA&@vR;dAT<9@Ysr zHpGPhZ?sTRg|mYj`7z^eJ+ZUO0ejjh(S-$+F^oy4^krf1h%qT~*ro1^Ow{p%1hY`( zhdcT7*L7B6l~%QG?u5jzs4j?vJ!K0k00HaS?+rqcAzz$>8>E9Bw-WSv6j88WSk4Pw z+I@z(<&Rz~x6Zm$FSiL&0&QJ!0hczXl^u61P@g!58hX)~^NA;MS5iRdD)W#=tR|ZN z;TiK&8sts*gI|Jw&YNoc<$nc&AB!qLtF-6A#m3IG(ILK05)pY5-{fZuM4mWoMjbflOeo$N2B!jC&&!_WMB=hkvk_yL7gG#52hmK?UTU*ge zRZL!o&XQYSXEozs6#!C)n2N!?1|~#Z-B!DWZT8D^0uZFbPv?Z_EWH?wJ-Sd zO28|yQ?<2}t$m;p#EAX%BmkNI@@Je(Kw4WOdIXO(CoV_cCcMvy>7m6GVXcyE(G<%) zv93E?IRG6}YoxhRRL`=<;%paxmY~Fm*-@irqpDNudW#ko-%AbTk-6rP@-bi1h$8#; zRww?~ZGJ+d$=j<5on)A?a>Z1AB(jE)iiLk{N<246yk!h8&AXVx{D+%*VH1c;{?}Sr zrgn#zis&PKbd8XW%~NfHczhI46Z>+f=x8FoQSO~3Gs?HOEceZ1xe>8=ja-m+t@OFv6@ZB%qA`PLNgoOvfXA;f#H!=D@Z%pvBa7SnJBd)zYlph! z_9yC{e$%9vQriK1s&(lwec%!^5urT>|3iL*rA&$en2B<3~9e zw4GDAt-C3qC4RG*ov&A+s`}R{&+6J_C7F}GL@4no2G6iBYnZDA%NhCUt?gvKN{vrSn*X4s6ot9{Q6x_j6?j?gebwF$))aM zO(kb?x9#e#)lP8yqU^%X%}A_j#cl^wnC$vZ#851X1jHifHZ-(h=DAQF}O(Y&`Z?=fM*4r>2uj*bm0mjkKT zCTmJCq->b+BuUz5kI@RNJxwA>3e;>ijq4g#`mq*!mjxGFLLPQsGf#dVeE!+#ml3-v zPi~#^e{(V8jpbEE>z8C)xu+FIy*t8jF+9SDW89F$GHUApzegB3HqT#L+Cq-I@a_|XzXiYaX6N=TP zX|K)MjYhE+q>A&|@M3yPU`lcC55X;pA{wFe$;pXbSm}pX!0XAlc;2DhQ2O>YQY7^; zUg1k$BGJ)j-7cC4o^=i977xqXJpL90@dM`^M zX!kj)Q6CN-??H9165jW32aHH`lu%Kzg*$UxWDpayY{1PA46ue&SrRw{o@8W?7>G}flC&$9Sgu-C`TkI%@WUf!Vh{#X zM8~q6Xl!+6@6aD}l55hR&EAqE_Cx*oIY0AU`mxI6SbtQ$Qg5_)EEUdnC0a}voQd{o zvq{93x9YhjCJ|4CJOcx~(d8G*cNn1g&2|dZBOWVzLF0%IevjOPTced*BYNRBj~}ZE zcXRax1{=+j{|%)JS^paR`Cv%MSIY5L7v%`)PxO^3yI8feuI{(kxE962lZ-;IYEoV_#VR{+IGea$sy^B!Uj%{%lwM@BXq zLfJN8d=i@HJ~$n7a)M8WE@QlnwThP-c-4-X^_DfIke8Lr-z(zLXC9J~q0Gmt*FGD9&}D$CNokKG%GCg(KAf0-+AVj zw^AQ?twxjH`9v$Xs-fcW$gp6m5-lNryF@7t;yIwlz?M7ZR1vl(g_=@`{_ZZD)Se*| zW?m@mtI;hvJ}C90@w>aloRQ>H0Tyz}xCPq3s_HnQ^jxmm5i^mv`!T^;ZILmhj0D;5 zW7AV5(~J%ypLQP;J%DvMjB7b#gat?E1y10B?)3jyownja z%H>aYo1(JUL;ZjzOTkr6Qwf3gu&8Sexu8k*?9OP<=!aW&@6{r;^vXRWxp5kIB5w>G zcWq31Tkbgk`{7=#Q_}b}`JsJZJ7F~@I@(p=b*Lv#IN55Tl)~7H*O&`?{a*QfEDL+HWH|UBof{=T!8gTM>f~G1cx}&E^5} za+y|0d1h(z=ohACneVb+wHO4N+x}E&JXCbU6*Zu~&iWfWj zrrO$V_HFkv_eHf`z#CtG!O`iS-II|}ExfnXVLoZQa^6lPuJ%W8{KtrE zPKKPlyEZajVZ$+&93z{NkKG4E804T*BWX zVKIc0Sbj?e^yI(CM{OHF?S(H} zS3{4y#}!Y<^k`plsYmo%+I^MkjMLNJ8 zG5K}8T3Efue2bkpdZbV97fM*z=*G>vH&{GUzHwrvJ*Gs%Qbp1Rb&Ry!rVxt3!Mz8> z0OfY~ZY?R(E%)@zirw#zZa^r0VX3k8H{xI@VB6+lu*G$&8-W|1+sQkT;o%o43JXh^ z_0uTE1>!dSN#}@Tlhew!)B#V33nR^$D+Qe~y`qt>rX30Czt$E9M~8&AT-D7oq<-v? zHlyrBMg$u6-V?p%h2pP&h*{bD;>>WgHG;W01P-(gh)&`KRXam}il6jGS~jB#d}xY! zym$Ov*M$X+bO~A*)Kby=!1ZDo7b(a9wZ^_gwSjzNk<9nLwPNZhSQHWImJ z?5%Jc|Ho?doGydRkR^qY2yc_W)$29#aZ$`3w1jGpw_LGLv~`9{m-NV|#9j`{l9l6XI<&Ds*L30nFOF$`y~ zg=1+j`BhLmJG+KAQ&;U8BW~dZu}k7TD#^5-b&Dr| z7VP9ER^-Q?)b}#%)Y05%wAc_c1i}t_!{lZRaHl&I^?+Ag8EDA;bXQU3A=lsS75X`0 z#?J2A+;ZWZoX^&pIA7Sj`Z&Nhr=V++8@Kc267$>b2P{n%sxP0P@8B0hl)B!B-Bz>` z+`YIuL*%8x+Cu^t=B>UgDoT;4z$H{R>mCido?5V}Y<_Ze6MFsz?J)lgqgbQd3?Z7w zl5W|$#YgHwZgN_&;{M-Shw|_BmNc;i0rw*0Auq^=T#Eog%AKDhn?5BD6OH=Pm^~B8 zAKzr?ZZI@{6GM9cGV>##8wk|M17TXBAgqADLX>l)2O0V4**EJ(uc~)l}i7ldbDeA1*zy+Y~-i$CGx(PJjNQS^LvK<7u+ zWe+M^3IhZ0$z@)a1Y*wXJSioaEgc8K*I%H3V2zalWhat*X8jDYD+@vQ{&Q^SQnqVv z*mWyU!iIK5RilXJ?ULjl*&+9V{XJ8RQFGnPTIPkdP|A%B33+fGQJsQ z@=(}RUn-snzBJeq-DFGuzQZ{shOt4VNro=CZHWKUaG~u51YEz`=-xT-bD^{Z*-Qg( zi-rvvjKprZfFJa}%H#%GZS8E}+T7Qb zh-(jpgxLr@d|XP)R=!Tw3T1lAqx$;h%~So6huI_L0|Sxss7gucrbXmVRl^38d6n;rP)Y8@3HJIaviP`aFx>dDzQEMW6x0FlWmhS%+$k9; z1d2JE?iKB*?3o#}b$|Dg<6j@o5a%6_b$diVJ*=vI_o7sGApZkx|rlCqIm#7(XE@WR7;7KEfm|m1}(0 z*c*4dM0r+Q#4ZjLV?7_wdRMmLo0|`6m zbz$H!Sw##lK?0{7YW{{vTSx0XcOF37Un@LHPGSm(Egv5jeh))n=44N(#cV=9pKRy_ zuLZf=9)-Mj9@*Tf$;$)EU`f(pel=^zy+w}`4M1*QjuP$a{_CK@{(e+-^+ibx=|dd1 zLBvKmSvEv)Ccn%_AzaXX83lmRdU&TZubbtMfrP-@nDM?fWsHeX$)gJwUcF&6epM@( z{n9!lv&?_A=PUK;g!A=5t3wmp3BdxoUluzd9-{cbX;}UpT;6J-3rswW$!VU)O;|n95kik!F$TL0~&{8X+gf01tK>jx?;0F;)Im-V|?A&#ik4- z^JMXX{|5@$?XOV+kbXAvJlt_f$wO3A6_Ez~C)!mcG#1!kS&;PU-E4w_(1`DFq^JkY zdvu7ErlT?VzIRZyQEzwhYv}7>(PXcbxNVA)#a7GCbsnRH!QFA`!^e)8*<$|gekh_E zZn){WXZpq6en?9jm0NG%T2NT!wtR(L;HjyWjedu)z~|YY&Z`PmA{{xLTs+#^upBx% zdigQHiH&SD8=4+{r;VDbIq=_CS|7(CqY4`(;_Ih#Lso^0Mo5R>kJaJGL(I9TmN!hk zbCKByVN=Y{;00c;)M8_RYP^{}HpYstvO#TkLr!;re-TMqTZEVw={4IA_AXB_K~`2) z0Nu4@8YM-4^W}?;;}zX|JDzE8>oi3zEiDx;&~{<+o5A$y=;)3-Nc&Y){HC?Z+g<5} zy=zmFTlF?c2G#bOu8_yzOZO&N=o{%aH^y9!&Q2bLn07=~9=&5s zGSp;E@AdeEIMu}s_a5j;w19U42lDlg7uF_SjU|QufDT0HN=!3@xq8k1zo#btuk-HIY6oDMVGvWrugS8DH*e!0#bFd zT8qCxd$~UYZNQ7~E7>vA$1~T#&04KNR1a!Z`q+ z?0xW>M)ywpaF!Eb0rd81gC<&9*_)&#OgjU~=p-YjZLIC3zYXjQieYeDveh zs=`1j@~0H=Z+2Sa)R=9a{UdO!0UWrgZ=z;c`2Nwi##zVq8J>a zCGLp6$Rw5N#8R{l-RPrAE`fUJlikywaCgf#S3^n+WaOrmW^(*(C>npe!~A9vm69VeVt^ft;lf!NM|CDBbgawE&Bksh&pn@^!IPU)2>E&N}{be*Ra%+}8E% zhHRTwe#(8LflU3!0kh|+WUq?#O_fYJ8M#wjw3F9paUYbrF|?uS*ST9aUq;#8LG_;4 z1H6k-T4qvX4Rvo0+?DrXg^bf5oL3W*51Yx@Rc-X|Jc)}q*DLH)EYH#X!u)o?LGGsOZYVmhpb}uLmkyj z92_)!R8>_q43S8TL&H%wCnxvd@#}L0K>eLmOyoG2-|H`Q^bXiK9@ zm6%(Ao=~221Y}Cq3E@Z~3|^udHk@+K1O7;x^znsinpkY*l;M=yL9Lk(sLg0?ZOs~g zUiRQ%>gU3EmHDD7PzN;xfx!9^Ahg%VO5Kb3`S~mDdegEW2|>Jj8#ZD_W)u0x@j(AI zeYmk_9;U8qD$V&GF2RRf4uzbOq!l2^c1fy_M{~m0*TtN-=DzfDmFPQ99Y>c*@)Q?C z;2^iy^sN>w`Nwv`2r8ot5^1e&Q} zBfS-#m=sOlS7>XsoD`+p-LrE!&FyAjX6nifiG1r!>B$^rk@0t2W*P`G`{_!Zk;v-we_qq0A2_Wa}s0U?Q)iCSJ8BmTtbU;4_vOlFe!=p_Cg%lHCm+m)iOXU4l|e7Ad&xgi?bA>QBeauA7G?UjEy<{}nl89W2}!Kn0oo`38pL8WpE( zzWww(;eazTTUsvcQdwFoZ62>2MXL?PCZi6z?^F8yk|AY3yPvQ#1{y-OQ_^#C@D7+Z zt{QVBBJu5^-g~K=%C^ivl+VoM`DpKGE8aYiZL-#@!UVa>16cAknE4K44A43hIT)H4|!%T?qY_T9xbQ~k`Dhrp91%S1fJf&=izFEc5>>HP*$qP%VezBNIJ2*Ht4ftPIVxkhm|_y z^KOOLm<)K6lkXGvkOwKjA;I_Z%YP>3qJTuilmJDNNEZ6Ta>W9Gb(lU{n4}1JG7D_U zf^NFU`?%_5+Rv`&lM;(1X-rl@XQ%VQ-2B3d&onU?ZCoL?EEJCudO2j=oLE1-(3_l> ze*EKLanjU^+q7PbL}(&u-TDR{Jw)!Od8|^^OmfcNah&j34i#S7PCw38c3s1%3{*+> zu8sM%nJeei;p-%6%@;Q+2sZ=4?T=5bAz9e>hMb83HDzqRs$d(s7(gCD$KM3af+{YS z>17s)SqLUmK8tm}Rs*l1e1pj3yCdEXYI*Jx>6@c<7C{2OvGhq&p(#b8Ogiaq%O243n&)| zaN1A1FPu`0a;p?5YHNEbsB?y__6qQ!S){|;O~=EA1XI$H=F!Z{bAZRdu7Q9x>o-@8 zr=Px6!q$YL-2^0)pyP&--)4~X;HTCgP$`r;n0Lak1B6$JF+1;cC^NX*xRw4-ZWL#3*_NU5mGwX z-Gmwle@jmqmyX^u1S)y|t=F5&0_mhz)eh6>6VqN|1+!ckDrtm}e$*hNw_b1oVMIUj zIAY3ayqE~wb}l1ylc8d|g?t-im3@*;j-%p@oVq%u(mW;5N9QgY{S?uJZMZq~wvAN* z2F^tV0iK*MZ(kSJAIA@fiOH_}3Y|b7KFg%sYWuN#ALLIi(Wq)TQqi@5Ykqs5x0d(C z_BdvnREb<9b<9fAe^_(znsf2#Jzo3SG4B$7xb~CWBEhQn=C8xY%K_hR%S4SJA4*JC za(gve^ka z>$MD{noBSGaG$g^m>n@f%eIfjU`nzzB5el=vxY1a&|@iPB0)FGLi^t8_L3 z=Lbj=Z6&*85V+0l9SAnm>an)5c6N6s#?bM~gADOSMyaB(9$p$+nu6?Fy$U5oi=+kC z(5vsBA}Z0U1OgQ&`?N>)^81qQ; z;vR0@*$zDU2aIuAW!<@;z(D{CRl2(Y^P~0HKh3tFP+RO^tM_uQt51Y?*z6Jp=^x%> zxlnd69?h4YxmWBc2Kng|MoiPtT15xsvyYNWQCp>2^ zPgZQk_}5{0=1(c!WQsR2PA(bYd=>F&UAm%7C>yd3)g{iFwH0ZN$@l)lV+k_Jz>G*V((*xqg_m#Mz)bNu2uZ@zYak^VC8g@j=WoNa8XZf06f zv`wMe&!ps?fpL;L@7~h6tv0yLtt2%OOWghJLFuH4NShmCsRtVhcN$M8*oV!2iLl@# zoU4P2)4gRGGrJ;)1{M)@lJ!3k$h@3Y z2c~UAYXtY~4oNdDH5)&}*)&sIAM`vacBbhE1(`+gp;x(x+A%^xp}`wz~F-JE8)v6og#NetYc<5Q!ra zIlq*~%vM;4pu(lzeTGYV70HJSy4l>i62Go2t9xtihJVjB2?}8UjQcc2fQ|e~l!6TG z2KrAnzhe88rXIbisp%o>7x`xF?DHfVx4Z@x;9~;~9sNW7{WtwqHaD4vnt_yh9q^N{ zR*~OGN2$J2)3UKA|2Wyl7%SjPj6kYnl4J*5i33tYNSo%+=Vt9`x%mq*e~x1`zbPRT z;XO1ib;tD9cH?}U1yeQ^eDQFX4#jhgc;kyf{e6ZXvY&w-a z{tfQQl*v~)W$xm@_3g!PuL!Vhu7%!4q|Ti1d1O6#MU`5l-DPN}Am5S33*BkAXcL## zxbyiZ`5%D%VD6Bzg`U*A5Q?By@8{Sa;2o5auJOjwGp;vsQ3&Bl)cDkP-335h&QvRF zTb|QOW{!bnOPyvl8yB0R?Z1lkCUm_ssoIg(kirgq6r`%-j!!9M$!&)bues57m>p9q$NB$gN-_wS704b) z`HlG+%9thc3Hhw~5IfWYGjK`dy{THymB`?L zD~X6F%fZp8e6_v#*1EStO479)+TCO}+Os_SfQB2dmNuQ`MSeRLwjaChnqzHovg#m= zKHoF&=MxCjJ7)Q-3Iy|usr+m=-mQ2-WphTS+~S2;yE>%lKWL3We$Ut#CKn*JJA)ja zZYKGOxy`*D6Biqtn#uqVX@gQQwfp&*El)sZNWpb+@XLL47+cM6F_BZ*Z@XiV0a|#R z1Q~9t4^L9UZ;_AB#OKxezT|fe85|jk+A32jj9(GjJbd#?e?PtvZKjZD60g(SGw@6> zW17i!q-<&?W;ni-5pfY)d7zd4y*lgD+v50MTzm&JJ8gHwZG4}$8xuYPRu4;>*g~M} z$JNK5X+aq_`(>z7#YSn>S!t6_wMy>_9nIqB`=EyCa@BjV*$&}BhsQmc^qDgW) zE}5~hKG4Ggu+zf4Y@lI4!FJDC_92f;A5MB`M5d+|14XZ@$Iai1r>q2kd;js7puwTZ zEKQzbF{dA;*L%|AH_Bfucib0r93_nH|B&QhbRVrxCPWDzHYu-eIfgnX1_sMW!MS_Y zTjHvPJy!RtkFV))v|Xtl3wl0=D1aKbIR-}O5w^Y z_lZ<@r5z`av+wjP&~cs4WyY2v8vRR{8aE5Q{jtoN57AiqzHYFACcC-F`ph5M0u#9z zQOfBLb>@}=SB!XgC_0p#OVt6bBgB9Q3BXB`ZwScp=i7-C$Woj!u`E}fwvV+mX2Xc{ z0YU&wQ1heahZhZx9CUAi3Df&U)?P$VF3kk;N@`8#5PLFWm<*+GT991mYG(yu%Zoh8 z^wFOOUdcXcxz1Y!|7)8PZtKKaep%(Gc{lzSdur?b>;j3B-BdaaV2I1!+^uPwb^7<4 z0*3m__T4DdaDTlws5o7Hm*;M~-A*|1_yY{s;dg<4VwDGGjAKU;XAi_Q#rz%20vxiANI#B{r=9!x$|dV z8&s^&K|qUiQ0Y+2abDw;WkKh@-P1T@hj82LC3vpQUvH;K%hOA-9=vXQX(+c-qPx3St}Wr;b&=s>$voh&g^OnN z?y#EE^Bw9Y%nWU1Di^1v=IoPyitH2kGeu>|l)8V9?>C0k0{$F%Rq1_qLmA9eDYtYt zjS7{J*Hq+u*1B1fy$M~&zh8ZJrC6_87Gyp(bUngV(`@@eQ&S;K+|~JydJDWwCMrSh zwo_Xw1tygyOeM&u;uwHEtk+~T93 z2TtgKHIUnCuW^u~ z7VeYZq^K>9c@NT3V7z!|mfP@WMZoX5QA0U5x9XtjQqyC7@e8)OVM&J-v^66hfq1=> zc=h*)#+7r!r)vG@7O^$bISPVN?ZGclT$eigyFL6hwoAM^@_(>EqRgx}qE`95i&o@T zcfzQTpAED`_rMgq39s}GbR)B(BA`+=LbpFXEq<*o2_oXX4e=bdFarCPn%JZp35i&9 zn61tay7{x$J7L7^o7aS3i6%6GaklQmieAQPH!ESNd4=H7u(5Ml-q~eJq^7;>Bp*%s zG>aQi(=Z!9{jjOZNM<>DxK+Y7*QvUe_{;+s*$vLSMqmq0w#fDp{E=6fY zZ_?|d@BT-H$8vCSX{#V&S!}GW6`<>$_qu6L;WgKTd1%+nL5sslw>$@*-o?2K7OGFQ z%_}HnYP$FaS7~Vr9`eaZ)x>UzGCaktFly7Q@4?u08ai-phw z?^`ih!iV$mRmZvFup7&mdDgkA$^sUp8gA~vmRH~2bj^rpu$UEQ_$W{dyRGyG@**y_ z{jE;-8n5Jf&=xjW-K|$9~I~h5&gP~Ubs~3h2_>{|+{~@MzU+<)={IT0$Q-ep<5WA3SLwe$X zUdJFm8|W7bvbzP+Q3|gA^U=y^HTHb%!Z^^M7~9_(4rl%L7v4bPy7pu7 zB}8nikfC)$sq=D(!2i~Ck+)Pq-MMrA5`laet0_OX;;VI^1EDrh=!k)EKcz>*wH_KiR?v3 zmCHUqqlBm4q-2wrSAiTT1p$qCU4dxOssDRfe$qwBVwnc!fyl*bPC6zAf_Ll7ylXd^ zB1V`~O6hEMCq7JulK{Qb+3h&EFmjxuY_~GG@ckiZg=}nKm{z>uq?{^qnIM0KgGx=D zF>@}T4Vdp@KNrJ1^Ovu3Mgb(^NU`x2u=p~&#W8M}A5h_-j$F$owqjx84@B|z2YLXy zo-ZC;>spOjFT5jRLwQ~vpz)=|=%y3rrMeSHQ=?f^q9W6|-B6Xyo{gXpHBh@0gMBXj zXLicMnwwqx|IC!kW}%F-n3sB`zg{X8bde|%&+KFX{#&sjNn-lTR)3h;{}G`v{()xo zq!COki)8aU1W+YkR)1#K@jvq|v(}?JNFU6Qq%J((Uk`p77)|s%dfaVXt`6e;$njZv z^O!-7Vv~aRT}D*9h>lrYAJ^2@?IGT2{tQh6P}wu}>bf#`EX%<#zB&jZF|tc6|8 zCKo6i)y zwr1y}z0yGMAfZBj;mI7ZKF@;xvu`gR*ync+W+D8dvWuyX{$hs|0HU_c*U##=*5J=# zMo7)WathD|8h$dbK`T>0lvn}9>KIU?y}uGJH|S=acX8ccL4H>XZEeAh3g^3|(VdAX zFm`^;Nm~>Nt7FS~*eWRGv3yU6c{FEaYM*1CRu@o@x-Iuv!eIrR;vaaly+BNM5>x^+ z&XLaLAa2VX%sCd-_ed}!IOWB{{Mk8#;hm?;f_Nvcanp<()=e$$2Sw&hhC-L%(UPH0 zVmix*Z9f%_p!lt#Urjx^dDdso=ym@a)r+!~O(;X^VMIZlmEL(QWb_wrs~UQ`xN3gX zyRGqbH?B9L7nXa1d7NPO;YoF#Uw@|5?*#l=KBpK!8q1 zbi)em+Z0*aCPaHYe6(zB#qv9C_ItG=Op+g>hsw;cG$GhZt4%2$5YZksPJqSAU;lhr z@+X$Lz>E|fEEmoEcBc2sKuQk1c7tyS=R$FeP0nI<)R1tqezKz%W`b!tKpcA8Bpy{@ zk1;WbE}^W+v4Rp%%|0UY+u#ACDTOCN;^zqCGH`y|3xHwJ{Rr=5v9^-68Lp!HyM}W{ z#CF3=R;H}lE#A!}kh0@`>^v8~rA4^lj@9dO-<)z~XuVRh2JwzF<2v1Md^|Og6}WMG zl!Fqw)u7x>;a!y}qA9Gi2y~u-6Zfz*;1s>Hq1%Fa4vsv?9}eUlt-c#QJpv{yLjB)8 zy3tx5MH$c-N4$F;4qt)-;mQ-aFkJ_n8uv^-T7W?N>fZ?QzOhB%6N5UJx-{Pvo6+iG zd8WyNkxBQ8+SIGdmTcd}8W$tg;mwb7ZLb$=uLsj>Rec+)47iudC0@cZ$!b&$5DYmv z04K`xzb494RT(!gaDgyE`*X-_%0+d+3RYI33=>Ui?AZ)sM^6DE4YvbRJWCx<38#xN zSIUwu%T%%E5tNHz6C`0~?^`6A>>Jf3MSDaSxCnFLb$M|=QZDMeVzIeJ2Q=`f)zV;tPR>y+4D-|h z&)0gZaq&H{Wo1@+P(~nDH$r+I_BIc&%3=d5i5EMR(sw*k_9IiOP?PFYnDA> zno)7blEJKJ=h!1Rwpbv%_&f&Fs^AK=y2_N2R+3logwCx=m@~Yyt#=ivM?=L(eg0|tP`f`mZK|#T6Msbgvnp=-FbW9%1 zK%zfJ%(?1wp5NbDEbOc*V$bGISBkSy{^ASt_^Y3Yyl}e>byuif|7TfQAr+{Ju0qAD z5CnXG+6LZsPV1TxZwZ%DZshR`20$5@JVRgas@E=5nl6O3A)k5fNu{B@n?Z$EsC# zf(VcNf|?t$^z*!1%hv~ebEzP?HtcwFAktxIGS{xV-b2x`SgpYiE`EYuU5>sB#%bNe zj*-*@Zu-al|D?1ZMY!>O2%5(b4eT>zP`GM?WA{WgWq>wY&y zJ^ZS3+3JFrA&zh3C%rYA4fx0EBrul}nG^jh{(zmxo!UpNz zt(LX(9&J4;1jG(|Qf6slVv8Vmcc)%HfrgY%zv!z|s5k{qZ7ikvmP3Y%;i*^)bpOH% zbcJTS8C@{ZO;NiIqx)+w#ZDxx4_LdSp9&5B%~iIf<;3$Afr-q`7B z^5KNhg}L;rA7npV`}bQ>*+V1TBN;OCgZS}6paoq1(l6GXtQoygem_7i@WAcx<5k;< zy|=0iUIy;p*SbHxHdcue7Y-eoaj8|7sSxlp5D-_2Gh522R|Oo8!tzO4)>-h9iuEQ+ zDnKI6-VlTiTzDMM6RTQoO!*1 zU@!xX715#$4tGO`FF-kK429`CGd&2Wq9#fl$+dMlA@g#dNd!mKasn722=y(TR(r) z|2ZP?Ib-l=A6}p9xF284VeEKQ&Keqx$L+q|Jw|z%eYW$zl;&MwU-%_CCaV)~fs)2L z4+UuYQa_NK*{(1}rPj;HGU2q;`wC%zZ!?T5mJ7IDr*fwVtX3FB;r7!wL;8B4EC&ly z`yb5uCUN~bc?`W1%8nfk5A`c&>}c#PDJlXnP2%hsvEi%zPJ?mN=D8<%pFd*&U0?o0 zn}){L+IHaM#~1Ev6FCIC5}=DzsQ98*62|PS5qiMX|L!gnr}{aXXfbyU<@?E7n|HLR zWvgwh!J~voBo3(Ypkr=x{CM(qfNE%;0&9PC?9_19{5&A#uUUR(cMu0zlHu7 z&Q46Zw~ci#4{Tm^EA(MUzlOIO=mAuwZzCi;U1$|X{lz_-h%UWOLq6~ut^8g~&6eEN zk;45vZ0uXM%7f9x%4hz?F0KI2T)#J(-93ISehXPBy7UscayNB~qe;Z|!(CO5x(Pzkl`vFR_xh zuP)5F&Uf$|y}6ev4{#;yR*^iN7~zp|P*~otg!@!7Uj8-1aq~+w+gn0x!ZJ70Na;-n z7aa>5_sEVV!Y%*S}Dk>SWXT@y9p~rWhT)5VG zPwnXoZmS@BHup78M_d$-zM2;D2A*fLD|;*3|A|DxpPzP?znSN6zsR`BSd ztgNiyvBrg>Gvka^lxlat$jo@~=-u1@4eP&f+XrW2$UZdoh|Zsh3D!_09S%J_%YOO4 zks9?Z4BN85UFx%W?(d-1uZ>j<;DM{00eHU%#kn({$NkBdD2SQ6iP7Z|(mp&}R>e=B zTb7-k?DxD(wxo53;_B?PzWirug{4jXFFBLxr=H!|dMohWZ-t`qm zf4Gk5E8ywN-?>D7`SdS|@NB+IPhCrB8w|ZmQNv+@Ow27VYg6aNV&7V1T@R_a>SW_g z(W&wMgXX&j$?0JFF=h~98LPpT&GR3!rZU{b!Ai*rzWm?XSpPq&t^%y8t!W>+yBlew z8)=Xbq@^3_21#i_I;EvKq`;v|Is`1{v|S z@po0`WCJX$QOSJOFAa!psHF_-7`DmNUmb6|t&rVvn^#Tm+udqeJWoXbTdh&GI>!zn z(sCiF!v3IwP5g=UQmN4ziTru66L`$>lX?{)8lEl`h|WgfT>+cS!#>Ze{xpcAJNKd_ z)GMx?iUM{dX$Z0tF`kH}b0+~RjF@~tf+@&YRyvv9{~*eZkcWzuMNYbPGL%0G`8m)` z&u`|-(F7bw$5n{C_<^M7do1XCYzXQvEK0=Zh#=TdOj!8y$l!5`&MOh8KlU#GHB8rY+A6GwGsjCwF?yU>+7W}=x3 zbF1Syx_kVAjqCpYd}U9e&`ONyhc= zxey4MFnVw78n-o1jSd<&F;9)PFRYj(xB5p~qz+}o4kJW^EYY`yl$c^NG6(_!0@>p` zu}PWH=jYs(wE{tnEfu8_oIW-SBNY*E(@7v1E8A8{9?kt*n52-+ouhq?~PYx>2gIqdC%pd9c#RGdyes z5T#_i+6mZJ?^k#JtHF9I2gTsA157~vqp;md!GCNiD`pjQmw9zgWe$`xys5f2R=N-*MG z1HX5!v{>@}*kx?Hs1t1?>Kg>uX!i647EAs{I4Km?z-J;VJ8qWP*sx*{?33%D7a;#r zc!aszJH(GP-#J94Ke-Wj`iM6K8khDdNy=6s5ijBe^`t~T9Osc6V(RW4czglF@G61g zNYj|~K$M8kHP4}d9vuzl(gLRtcuV!S@|*O41qq|Crh)rR%P3bb{-hi@q%aA8R|wS7 z(ozHwMsm**1e05EXH)Xw%o16#ZxiW=NlJd2u;#&rAib)g%VuXoF_x9ktcST!fLI>w z2Q&A_(jq}1kZsE&F%38TD(82U;d)y9DRH>MV{5gR?r;^ki$Sq8FNK2$2np!-PB#7O zO6)}bpA$oSJ1TXiqOFbwSmmAq^Yl_kS4}50V3oPfFKTis-y-bB*h^TLz)|*(Y)3LQ zT@mN&=E}-bBVV02Gw1bKow(Jaxe6Ox1>Ey>g_*^wI>%r*sJZ1#lXUj>!zSc^Q`kA; zx7vr3z$W%=xyr63Q1TvucBjOxw$TAmhC>hN;NhF5IL&vG=6$XKl+QyQ=a0isu>045 zq_#_}VD8%NjVvybt0*bfWV`5)tHzaL!m>V6Qh`TR!l=gH#KmUD!Ilrl%mw35@N!e* zqEj;mjn2%3mX)#MCMUGp@-i(PeyrgZC1<190UT>2wH^7uaQK@>+HTx@LindeDP@sU zt|0ku8-c@QAsQx=;rSl-g8+}O+wV@r$45e3E4?yQP$wcINE~B#grQ)~Ph8vf@SP5x zVKfCB7D_q_nd!9jRrL5-`sV=5z7b9QZzaa}3 zcBlMUY>(l_Jy!|ofO2PdTag82tAu?IpMLA+30;=jK7elGU18>Vc*_Gao;L4a5!j9+qr@gB13WSvzdq~! zY!d}g{GrkaVeH+od^ui8_A;0b%Ab}83kn)19Fi`TzNP6n0{6Ec~WX=heGMZ0tn2penF8 zF2TAOX2Wq{Xy{v+!pXNo=Wpfv`+FX!6DwxDDEm2ebaa+oet}DE1zbE^#_SXcnUDuy z<~Ljwf7S}=ci1PWCwSj97FAw{5Ixzpzn6_hS^FE7M+tu1o)0f&*jq|*!!#ns>=ZnO z$u5dS8;LGtcykJ?jYl|Oa%9g$keyYh_}yQ<`3w@HMSjI?nXSOlfrHw$iPSlb6)cDu zZ50~F48y`o;l_7C$z_0%p(9zP(hnjI4-?ap@XDe<(9O8Yo($^&aGGiRyJum8X6=^(7phg_M*$ z7IdfP5b4EIb$0Eso;GptBR?M4bgHD1k_)P%0@d%8gqb_V&kv6B!+40YMTftZYuCt* zgJ_tCYpME*!ggL*?tY>n(mw>b@xD0r%^-s)QrxX*b^BdZZ%;HZj7P@c=NsvOft~lf z;OwvQ7!8VnlKZnrIFee(Ygd(P+fMxO*0e!ifxUt#z8oh@MMdltKxw37z#CVJzyHD! z*FJ`z!w4i3P1=24#i@mZlW6ZGp`~HegA!uvh|tMDvD?#08b8LuSir9xGt^2cpa*q+ zBk^kF%m(3qj7AQ#9y>;&I{nC=OHO_*8olB~c1_-^ojN+&ws|b9Od3Qg)pr(@7B}zK zhYbQfY=Q$8u%vK6TIbfxKNLZfU0U?us_`gRCCY-W6WA{PDFCy*l5Xmc*)z}Uu$~a> zu9bB`_kM;1QDpl;Lh4apM-nA$@R8<)`B@1pl(xBW(uPh&9XpbgtP^`tcgo;zbo#Um z@d%4OKb4&v)hdX{Xl1-BS#|Z${&@htroS5{E zOit!ITHthr2V8wPIQ2{p$Y3aEkP@x%shTf0qW`Ogz&lPB08N2*h6v;i3#~X0Vzyl> zMTQThwV1G2U*1<&T!pi(^&AO>^tT-g4j5dBqAG!r2CYYoRO;aNB2*on>fngz$lkWR z`%Vz2JbBO~$fNJk3MM;X6%8;(sv>P#CP}?Zf50rZ^_fw#=)J9Vn{e~Oj5hX&lPd2i z<;DSkf9K6AZUP;b(7yp(aF0^-AIpi0j~=3|;)Ltt;{yUgqysl1HmO)>Wmkp(^!j|< znp?|r)YjA@4;npvN4UdZE+&ZD)o3WiS_NGP3 zr|dT`X~Q{CRN|mM(h#+@VlE1e2Ho2!x-`NZhjhk%21|AwhtN*AG*y;-LGViT8d*Q5 zrtCfhb6BgVe0tkCrpL5dnDz;;JW!EEBGfE^@b9xK2>c5TR7b*a=;0+8Ty)Shm@^UH zq^qoy0a91QfrUCVPom^wA`|nwS~>|gIreA)gj%|BeF6eGh;=^T*LN;36!LGl_^Z}N z{c9_p6gt;9I;Iyabp{1^ER(aTckJcss8x|h?YS-llHsaI(53J|3Ce1Pn+|6<_8MmS zo0qsBQ-T;WR8208bOT{z1oXGxAz&pG9HN<8dQ_p-2>8s5ueW#b(x-a*0D%X`XI&5_ zvX}}OE24@82&San0-!vjp40tjy4HI@f5ChZH(!1G)Fd28xkO#7&XKh%9?;lM9rh;F z&sK~ee`WrUYj}8wAuo~L^V9#R>(dTpViHFPta~g8CZ3-_pZrf_sRT$+HiyK)lh7bb zJDc8gDQR=J7*`rE3HwUTc&xzWR1_25^X-%iI>Bv1X#qs50xF>0ajF>%6lkIVTuIdPsmtcS ziw8V+s<+y6ys0wnpkxDIG){lJdG{Q4Q4G%(gPp0KDCXDOwxwccCuBvURYa^Z^X;wv z(?JpC*8*zKqXNjV6;Pr5nFYUZwsc z5%8$Vzd(jRK99Zlc?mrJrv%0Rm!8&fo%(>bN6F`_8utZg&(xSu1ax3FHa5nlq=Y6+ zsO9UDxN9Tn;L_|WTU?qryrJ+GNAet;XudUbs)CZ47eWj+N=2x5}Kli$wW#*TWKRVt=y3i1F zD|1L$$(@DJq}Mc6woQilky{1!69kiX9n(N`zSVr=*E2|utc8;eoh|_Y!+Rh!`h9`V zI{s=t*hxcE6QgYj1N2I^3S7!yIQtY!4oRes`omTCS9m?DfZF@!bhJwGExC1q1WEh= z6jxO3-a!#pQU4W#31vX8J}(qZv(WAqHQ4|6KYjWo;OYwNZq*4s?oJBCWy@}-0cIvC zow@bK_d)-t!~Lg0AS5&!8KDu!{S?Oqb6q_Jc3h+#>D9*FPOyACUMyvrdVwhg1s-`c zlnP-o2M{!75~zvZf6&#T*MERN}s%nJ}H z6{ZFGl=NI^3J@|xxWJ+k$V*wPFJpF5O?Yr8SG@@OK-8+UHG!rqK+XPTZnMh_`PW|- z0{9IsIUK}MT2+?Mfb)P*+DRu5Q+5qI!F!Yj%Qi?us0zivE-=t^pCD9$h--{WtPkr1 zrW5t&Or`-3zTNqDq$n1vyf;7|%I5>-4YWA7;5}ln363>2OsrY<YhZDb=f@Z8E6GfWlNeTH8poSuu*}3!PrNP4`_SED$^9;Ir*7`2hFE z{mYbS+sYlB+lrt~+ZU?D`TP%yg!!+fCzb&kOv1RYq-yIR=8B7UVo7o*%Eoe?WubZ4P&LI8uEdX2&vN}xv%&(yimj)rp$lz5|BkkSS=1Q>NYp&5a>gu6y zB~#b5s`>uhAhKDz8NLN=b}vCdQyGbyynaUB-&z1A z%x8=mqr753i=?r`jwbph;XF5P4lSx7YFD+Z-N9VWmP48rXq8|&Cibs+Fua>!20mb9SkoK~o6^I?sKl9NQzLUF5bsKg8dQft?)4Ge07Le)ly zlV(C`2m>e%RgLR^dC~3CFmPyXiN-Qu=z~y=ddq|vQZ+z<9qg->IO;t$a3e$m$6guA zfY8$2umBof{BQsdRe?%CDF9@tPK8`5UCI*ste?}3_gD5T(frXafUwnh`3!^?KNuJy zCdkKT5%cv-0|oFiG<_V z01CA{l^d)^w{@SI!`uJ(A|mXt-0J*1tU!5Z%$rC!XDIAoW#iWD!- zOnekPY9O1{HlbMMp8UE%&dtr6d3K^CdP^D}QLvI`cuSnbs!iH8L>HX7Xdv{^E4t>P zPMdi%Zx}+lJzb!;y0XLpLqY$UVh12Z$p&(F`>-&Qg#Of~3e zTS}W15p{l~JvD`(pjQQrrFNNPe)hYE&AhcGkQYp|F|5dku}Hmvn+Njn*gGnFS2Xz7LyHp z>_!@y`#p9NHGA_B1pFp>=uZ+Iym5e03#yHYDW7PNhD9Es%Nh^ig)Tc$0FD*#H4SB~ zBqEpHf-9(#(o1W4W-%;CdAjYpuslh@a9GtESCYT$o+%9aS= z?MrHRGv521j{q!pHCvG*-#>o(_bWjGFepf(d>RH6t(ht2Y?IbWmXTEzQ7+w)?ux2J zMf?&z3Rx;lx|H?Rw|qeRVy%LuX(=^6adY~MX?4mrAvmbJuUr(f)_nCw{7CzaRU?EB zx={3E@u7%qajo$ieZF1N-`S3;U7nOr)}6HDaTQe4;gKHyn3>tv1MDwtMnHdTiqzZx zkcy>^4aE#A%MX%dXP`wc;sqMo%R|5GS~NtU*}xb|hG^STOw-{5e5$Tag8fGGEMR$# z!<1H6vP6On0N+G%UE$z!eo zkhH4WM){~bI~fA#l&ynfc4cow1#|EIMeR0E%4htTNw_er^bG$<4>C25MvKCF@i=`wZI$~piwz{v54QI-cRpw1qRmC;DmM4 zbAb#?OUrLuk2eH$Ne(fDOtRRAO^;B`Eyh=uB2gL6U+d^2?$YJe)Gi+P5A5u|voR<) zFE@2DBjhEi3>(N&k+YywRcDb$)5;f?s{~sZ+>Q$R7%1D{v z0f~#zg@g8$F1!>`hhGgDqNJ$V`Q~hm#7vH(H}ky*&5|yMlH&g25Q#=vgccn*hgUuQ zy>p{8YeAy8X_%x$fO8z(L0`@wCONmp+q6gpoMVtQZGZ|tL0K$KZfkGE!l3ZX(ypX) zIYz7Ue&;Pfw3{)~G5?Tj|9S3V+P#;f{wIl9kU0U(l*%OdOqSC&O87g2qDJHIz#tX$ zAIj>n)#v^G?ol-lSOLT}$IDWYdXl5&+r`keOurpkcm~FHQ_dBxtmgMK9EOiSl1~P` z4!eQo4b;0$mxnFOFbPB5yNOH{o*T&d^MqVS4zt+mO`F9`C+!%A5k;Tn=}gVc-_DLj zI6c0MS?<;}2%A}&T8vJb(g406ZPg}8k(8Vfy*B9zu(SHS^9jg6ZYL4WoYd0kWzq+- z3sya0CY7BeV9mpQjhYJPOa33*LclAISz$jZ2Uwujv8F^#zxJh^RG!HfG;j!7@Dqyd z_4zynHBr5F)Z6Ybpm2P>;ExG?&L$+_K6y+KL{2hXB_i>?MoptP5GVkz$Gz;R2%zTz zx3QKZV&z!I%Jl8lm_25~xZRmFeLy%{QJzn5tD9lDebU1%gakTeh6mWHb|4P~P}%I3 zY8)9)Y2$*-n$B@PuEQc{_J4dc2o$+b_m7<=HbD>ZF%lG{cGVlY-kd)I_P5jo(2|>= zR?BKSv&GWhiYPggF76E!MPUF$x@6v7hMkZ!w~Q*kAaA*Vq&%khNYrDy^frkG37FZm zy}ujY$U2lby!FyXS5PPug^4D&un7KNX>_ ze=i-`4V)gg4jj{`Z+v^!^f#XcJgjB0oPt8nz~^x&&<7*T4MDf=JJOYG3Lt@9xiL$z zHXBmbzK#$SPg_#Kpit4TJy=#`_u7iaF_+ZDi0hiJruO)+J5g^Zh`3clOIzB}4 z@T$$-EF%REd$OP~zE1jJq!j=pr+?8QEb@;A5jWABugC&17(=`D$a46YTIoPF)zTkQ zyjxPIV~2#)ZNio59~`SdW1UYz`OnIy4s@K;%IDHmZB{TJ)r0n)w&KH#o`p%9LKC`Q-p2s zH6U8iB;{@BPCcK>`+?u4^svTgyHtx}XLo@0OcFj2im|UxtKJi@tnC-^`Ubi$!dTQ% zOALYGd$>dK0Ck{ao>Omf8|U#=>(OFh>A=8;Ufurswa;6b5&WCE$)#Nv(|TOCOZvPd z2444Q&DTSMmX@|a1_l9?mq(MES47w?HSP$YDk^$GuWwt+3kqq+ov+zsCVbEDkDdv$ zpgsLV&kc1_es97M3<~kAc{CvByAK=~Qgr+0CvI(ni^XxjL~ylQT%9)&>eQkvN$8olO)@g=O& zLL_%7i~L7}+@6`z>>RB)GfGNXOXur~`g{Vv`Dxf>QPOIgm!NEouveVcj{SGcr9YGc zv`Yfy)+e7Rjml3tMr1RGr4b8Je1JO+-R}ICHv@C5@4KSGPUjWUMD@QYDK1fQy7Q1^ zVdTJioy;umUN8LAJk8*}9n9ff=Yeub$YaW~hZ!CazzFZBMg*{;dD}JJ;`>Wsp{p*6cI#TIDc;sgUp2d)^D5&QCw|hapUH=k zu7iEgdaq!h_UGFufL=bmnofg5luo#KE&?3P0{c{^vu?Y2lcOdcNa-AT~#%1)8Q)SH3y{!vbNi` zEKKx}++Xglvm=vcUB5B}PxjB)mTlY@!XB^7NkY&Ht!*M&;ad#Y6xF7e%bMDve?>=! z`T#Mupxa?*bVgG}Z8NFp!wN>M5if?oW$94_)k1x(lx2SSVaVAP*qx6+mf ztClcG`Y(SPnSS>G%)&{@k}&xR@kfbgPdmM;7}>$$XXtIK7lugP!&uHOVb|7u!kJH7 z)^M%xXFzf*?8Q(|S@G{fB5iPY1lWNZ-#YjC_lw+frVeGCV<=|vGoF|au&MAb-iw_4 zX$*JDNPdxKt){2&IQOcm~{i9j_lw;wu^OSSp%(D&nIVn9z;?{XfmFW&zikP zkcd}%uE6XIOQjl13BqrIkEq5r8vSyzdxE}i>GJJ&400h%F6321c4$PXnV2t8sA?Q} z_)?l<6)i|*;h?7sFwv#E0Zf=p$26c38?}_r)}24@BufWgf7C7v2q%C8aACLd+h8J{ zKzJwz%!9wxX1?J6prW~bjF-{8HIYa=wT6N3MQzdCMlvLXA^hrlqbsoOv2Ggy%s5x& zs^|G;48!-%NYZ1B@e3oPR)dkRKXGJ!w|U+Uspsf#F>}!1=8v4f}{Z z|F+fjqy;j5zapMp4rg!)7Sr`}8u;45lr{YF^j_tvU%~KuFeDXu=R%oa2fn=krXghk zogcee;eG7+TF>rpkCPw0R!cXdC(qCs9(}XqS0mxKYji;VO~b;S+kF;N9Xm^B^Lu(v zPI(Mh*#AK=NyA+#g#O>eFc9g@em2ku-yc8)i77d-{h|;M+BGqg?cDTxKpYmja%#T3 z^m00F7sOhT6)=I8!#DWw+QA2vZ{e0xW6^`{-H#*=p)gBql?Z5NPae7WC@sUdfbJLg zmTHx^TvSBs$~`+ zMmj0r5X}5;MHgp1F$p(k<2kHV%rE0;UR9xH4Tn(6Fez&qQaD9YA~xLiyBp7TzYb2nob?lq z`B7Y48UQW|zenXo!2t2Q;G0uvpJWgABgqp8AB6P`;%MXyw{V+^G zwqNP+=zDj*)z<#<^3if)%X2@ujd+Ha7%hd*oweA;8k~s%@;J+Icbq0T5;K?foM`<# zUbuE+Q`Qkt-i%!ffCW-WQTu2(^4*HxV*qS5(QACR&Z-Eup43F9PbrpUu5D{yzUIS; zJ=UgWC5QY>C!I(a3QL-rDysCm*;{hl*q|V}xWF#i@)24*dK2|R1YLgt3Kkj)HV_Kn zo%3~x`It}!uXYL^_I!0)Q1}LwG=ShqGyN^;Oj+G~4mKvm{~siIL;LfTXsl*EdO{h? zc4oHRs_5v!I(y%J?+vGFW<}@}e-u-&V5e@{fBTdiE?w=$RKIhE2KOmaBUcdDq@>}; z7#L!@DPcwllV5dhQ6y78S|A%LODNQnG@%l&Yn?NwMX*~Z=rc(MR(l2TkL-Ty;3Xh_ zit^=~IDwQ}lI6EmTNI#j?UU7%c=tY#@uecBwhGdyQFE1uGo48#eZ`jQxp(p8_ZhI; zPW}K$;+NzOj|(JH;{JW6q{iphUPt!|jsp5vwN^nv3`{I!9^Mytnv!q~zyvD-pgq|4 zz9I5=he|%HeiaY7$zuK>aolH!_ZAimEDhr-f9|ON6SO3}bJctw)KxfdW4QPRwun$EEL8ZfI;K zFn{Ci{4X-CuimqvKIaz~D?1ihB(6&U!i*7e6a}`*L99vV3VWu{Lr~F8Ir%N)6hvG2 zn4b`J6#+vilyA|K>FrO1TMXdV$;ykv5u>5}k9_w?8Xi(@sI22?R;t~-ktj&{*_GqX zh#Xq)(e3Zg3*oIbOATYLowu^Td?mVkSeC(Z#>HP>d$?^CJ?5tuwE3Rp%KzlMm$H26 zibWvVpiAGa`4lcMe4ywL08v1XJulJ?L8`zc-n&}`Z`=EPtxDVV=@Z;2=|CBZI}QN8 zqC@ILnKywai9qawzA?;&Y;0T|kvI^#WO}t;ppkyz4+nNzS7!P2&NqM{2ytKZ!61%; zPcGFD)D^v8lxJfi`^8U7Lrb?>DMQ}b35No2ebm~9wAA+K>mjuGA$94f*TL^Gq#C(A zy!(v2ky>I^&R<@lj z@J~qb`&Gb8R#s!+v+xrwCeDD{nPeyEG`W!+y*qO^Ycn#g9kV}13s9`7U|4Z~IS`OD zO)}M8MhmXY;f&-h#3|0E*Yq%U{tjUy#t1lJ4IW1*ZUZ9St=abEk%9sfF_Tk`{&L3X&-|DCyHFiu`kYz1# zXy*(Y^820IX|T1X{zGMGZv?)<$H;S+n%a7d2~+K!*X6Cj<%`$(&$bL2O;2KP8*O>L zck70wg6IK0xtH9RpQ>F}cIkeK }nu**-x=Zu~*e6@Y;CK$f?_>>8&mxfN~q*{hN zn32^!+g$cldoG4>Xh~TU)Pmcs*!_v__vEZ>S zm6$n&kBv$QX&WQs>&6>C88`;OVoMLc(25=YoWoZb3J#@sJQfkUp5OwunY5J?M|gok zph0;IVRBqtWI}=|A=;?%Tlf|zXNzI-UlycMenMwT-`}l6muqubtd{$EkirKVXKMh- zzFxlzl)LSYkmFMu5~?22<71_YmF_K|3R&89$ie%9No7TY@9|P$M#lhvcbAeAx;nZc z=|Jt&YE0Wbn(s}7;VQ(PH+uJHhY_YjOEnfS-LAtVMko?6WzoA0C#PpwLIH4RTT&BG z-bsiYqt)*b2J2#a$s5J6Wlu4$ATQGT@XTk?E_})))(l92a z3AXK<#2mUZNDnO_hq_;~C`fbB0=NkNsHf^pba#(sq>pdkq01(XE)ujaCXvg(=BDf~ zB}uMT<@WS>U{Cb|N=;GPN#dkMj1trW{J}KTQv`)ZR?&E0=vZ8yKP)~2Ty|xm0T3H4 zs7#|}Ykf6;vW=D!%k-+h8Cpq669!Ur7|_IS^spL0s-{_H+weJ21ovU0+EOM|6Rq6e7w&;0Fc6FD0C}C*0lx^ao!=h2H z7dE`)#zgM5{;c`t&iQKPvQ=<>27|qp5+4Re z>4{W(DkSRo(JX12^2D$M(s%llsi5xNd-FiLkD!=YTnA;P_%_uUYp)zp?>Nx=a<;X{DN zfs#=t2+%6Ev(@Gj`KoAoy@lS6%ODYcN8l)6rB=l@81BjQYOor@mrN4#412tAS%0Ng zPTMV&!e=oQ+pEQl?|mNU>H%>4SQopg@m=KZa#npK?xnJF@{vHV%F*F7BcL68Xm*pRks+v$Vge$1Y2#{(EWvu{s@kk!l914*Q-gO3-+mEC0`3 z@jz;Su~z{agWZ*XHsjOVR_D=9kWOxhTrLbKAqh8U)q^%QRd*R+(U022^_o3$I`y$f zgQRg`wa#@0hF<}ts^mEpA5Wzbfa)?D?O<>6SpiOvEWA($`wjFn8saPZ*Eq8E^r1cE zYym*7uOk;ANV6Fj(O)~WGyvuQH6COWm9JKx^nn=8rr=M6M@CNu6wy504Gu^&>Ir5& z{rqJibQG+yt!4b<8dS!xl>+s_Ht4~?WD>8lp+a6Z2>Lz6R`qY{9v@eMK zeDCVJqAOk9*H&aGx|-5>r6vFZ{n57%FA;JLwmL%J zp7U6<6CMLIS-uVX-KRZ^+1uIa=($`361Iy#5DH*zbbu)#cv2MVOs*-QsW;gA>+B0^ z^5l3N;ey5jbG0q`8tIUWbnv8=3{S74ypvPIUDd_YXRH~KI=!M1!12yB+mQe>`UrUp zlFR_7HqHTb7F@d2^Ypx_xP9{`H_$9KRi;(r!;H|;+J$eH^-we07t*dK4Fd*qGeV%} zderkJ0?jxm!&kv<3@~@ajuK7?FDtwP5xbY0?mRM(xl|Rj((O9#P`SqB z|FIb-w4u;t_d~?r=!rk2mj4_yd}608SB?AwmC9KD)&l%3V5X@6rop?o&VqN9L@v02 z4huUfK#%<+18yEZ>L(fzh(r1fPksb%j}&~Zwpd$1I20`$DH>t_!1BT9xO7V}e)27m z(}0oqOMq<3speO*u-MX$B-eSTitT$cp0%8L>+A2=cH#D|)lcXi)xPaOqe!h7uo;Jo zfes5^Z0U;A+8Ii;(!+3|dhb(npvL>|Xz9V>+Y6w85SS`|GAq~`8dIttktK3RIk9_k zd)2oR+8QYD={XnLn_rkOJqeF8O%!QRPVz2G!}$S#IzRq&suwyENPdlHgWy$Ik6VAxWKxmQw z(7y|(v(gO%kbk1Rjb38jHbR|}%X^}KPS`wcFQ9HD03(D>c4d4?Ym#Dt7%STpz+iV@ ztDmI%`>cmXv`u-VL|9$eHZ(mlG%7J3aw+_iPjGl8Q9B5eEQ+`zB#{6MHBt<>ol?NH zvaR+!#bx&)tu&)oxE63ERi-%jX7omioZNY#h?hI$1dd(|x$Mv;OHSVWw6CeDlbT%e*kk#5UE73!ru5^-z&CYG zy=V&Gqo%8^rL537w$PVsdbg(pNA1;qe%RB#ch6H+SEVN}fi1r>9rNg`W@19?6x*Ji znYoA+?Z-Sd9;0+~MB#I{~5SlsG|k%&s1+T+FwgE0bb zeVq|T(ZFygZeHHpO;fuGLf}+~Y6O+WhHfR*bbwVD{5KnQ{t&N%42~>Nyarr+(xq3H zB{mxIddkHJYPGZ_cNO-zR;opJr##9jHYz*&e^tPAAYZCKh5Rlbs$JbpY_5N$3|{^S zMr+uMW)p*u-M~x86fVKA&J@;=%!j zB1IMn-z>*e0(m`^EScQVbXSKiS*6z`HH%Y=!9UaYKlB2V4zCt5jzVZ;VR%$L!vSs+Pol%NquZ+o;iZlbfg#GR&h)Er?j6JJ-ZECF+S{v1qfYoY=>7vM|j2~v~M0U2EzSkj~Yz;TKI@2N9HcI%1I zaqAqiw+mQ|^rJ=MKpCvg~H81t<&K01%mJKH-GH01fhuXJwd`6g*^CASUh@dz?lB~uW>qG2Eod1ohz>N0X zIkI%G1>TvXQly?62f@JsVbx3hmoUHqd*D2?Z>bjkeG4_#sO1+aD4SCppbWdWB=G>K zgM~?EgGKZg3a6ok60--I(fpoeO{T5g;B@ynRhBJHwrVzRv5uh5JvIAIxe*bW0eVav zQ&~kauZRH|5&F5RR3kL2kC%m4pE=*GsTZB=I9K1m-9zZm;XaM-jJ!SXweQeMy4TX} z;-yHuDSvg}fU|SPkH{G1$7__GKI$Rk$z{TjPG$!xabR z)Z|mt>3#Q@{%JLkeXIOWqlR|bLx}q$9``TEYt|`u*4rtL48K7%KC7)VeJB%$=6glu z52|MBiS`W}8k5u02$8xF4dGvVGTff)-`9SSk&xhUyLm)EGP-}QF+XTr(|L3>A0J(+ zGO`DTK(=K9N*U-IMMQABiOb5AV-W8tUPKBdJ&fcdp} z$q84zIt%u~4-?~_%Uhy*=jqc+p1OkW2k3+mk)g`s28T#nFEoJReDCP!iosQ!Mt3rz z*Iyn^R+kd_jl>GKYU}IwS`o-miRg;qHy@LwmQwd#c`>HmcGe1Wr zcuh$9?SDG z>%`u@`0j!E+`p|k@5gW6vssOUrvrO(SKn~wEnmsSqw`rzaUXcP#sEdIwdM<+cq2<`(|VM?Tix2yMzjE$wyC?cqjH5f2{)e~fkJ&ZirKuH zbFItO%^obmR5lSkmt-QqHfBHhece)l6uV@{3MsrQl~D<3X8~Md{Zv%_LRri0FLzJhl6lCZ z_thtF8IRtHD<_l0^n~>#C3$(&)N0GVvFy%7je6bsh4;zm6O&})YcH_43KYBUi{+v@4VqZT%_onbHdUJ2fTLDNPu0feRdLH@Amhvw6Y+>M;*WdOUdT*%TKb+79 zOf_5-kl>P$`TU#~!7>!wWAc2+PloBy!^69|kxJg)Whx&jCF0_?R4y*XkNBa_3NdKX z7=F08&MyB-lW{g#9q21UW0L7yf4?nrGj0-N^>c>fq4J=+yYaCjBw#bsb(83wKpg7_XiObZqunUiIT(@p*&e z;1D5YNp~suhcuohPx0cx&N*qxY~DA-rc)ehZebP!Mipb^YWO8@#2zkLVoa-P#xIrD zXIHpikNm?+QYXg_RV|5*VUhM@?4bG0+CjH+=Zh*3^?0IpOym@`ttD zAGQVboSvNmmgD_^O}f|6^!e2rrT)E(n_h2`tVQoF{RPi8w79${UE_6N+&{m2+STQ4 z7r#`>&t@Ea$&|BQel$37rVWZu->>Mq+iXVe5DUM{n{t>b3VMxSQdahmLNOf1{#pL! zL0xnA(8~{>{o&_Q=JcHFp6gutYS$7w+oevm36yMw|mv4Q5K?vw6Yq;ZF z@SR?OGBGUG&VAi_Po|K@DfNab#udV3L~0Q zmW~em+G^wSUNxz|5Bns*!zBI!=~H+i0A_w)Erf7SqY8nk6M4W$#`Dp_EV!u0CCy=x zGS~F5uv8Aa;!QR^T=s{dwnqq1f1;sLQo9zVw7|?uCtWy{ny)1CC}h-}Q>j8RaIXw} zvK!q!w*FGTzrDw36z*La5;#L;F#twJJuHhtt(9n$PZdv=Gzqcs(d%j&zL$Dc{el!- z_+dL&4%o@j8BV*T_dB00)b#an*dHE#e)R-6uH3Q~2fwd6y1IDyZWZgRH7}}NAEt*V zbwlu6?HGR+1H!xjboS_7OG5*{u;bFOpfElWR?Z3>++2;>>-MXM({~4KY{@i<$xYFz zU%8CkntX4MU*1e5YQiUi0HbEz{X<J!*sRapra)*<#Tnxq=D}@q`eQV{{X`1M1v)fw2bX&2|`F41N0!(Z} z?cBem0K5=>Hy!)_IXT$&eMC2SmaAY7kRO|@PJ_p1&asf^14DyoAn*5dt_gd2-7j$M zl$1Yk$(6y^7pMM=%ag8`aVycTG&ZM|)Jnu9Dp)Ua>=r2HBstDRAr-9d%VTJgdI3X~ zh>cgk0b^2Ao}=yxv9rFsT0e75uzX>QPy2B`kr=07{Z&(^9lrLz-jHp|Po(m-gu6dy`gW4-a6HDoO#we*BW0*>xPRPP>0Wkpbo5z2kIQ$=`^^pn?o!IO@wJna zlg7tIFEd_>>uF*92&rjlUd~)O{J7At#s1ccc5W{NyJi*y}x{sVJ)N(Dti17@g=ezuXHPj7nZ=@p%5R zCx*=H=N28!x4jj^#d0o1!Hdu{&)pXmoS)ADBMOONYhEroD{Hy&YP{b}Ydx=3l>FD< zNSjB}^er4t{?N}L$h}bi8n*Iq0RDjw6aQC~BbR7o0$SRiiQ@7K3g}pL7cUgdK+7I8 zEatQ_K~|>k5()~scWU;b1X#TMhlX5t2lgcghvX-|b)5Vl!py&NB-xOqM*`&bs!57* z)R_1)HUt1FsTm?-h30PFeoBLK69eb43Z$eZrB{wpA^%CNT;{_+&G6~J)Gyv^j?5&; z#wYL_wL6vb*!&+=R~^vw`n@svDxlW@r1eT8pmc))IJ#3n=|);cDk7Jb?gr^0u+bqZ zAl(c`D$N+38-w3F)O-DX{y=d1)EnnK=Q+=NUaSif<5%LarsI)uBlht!0QpuB@rHfK z9uawgWX`2mS~Bl^_P>3pJsNO$$0uvS)wGk0-M$fFvoZ%s^|8wdSIhQXuhHi|-W6_X zX-(_f?J}<@)+(aC5}1{pJ+Gjkp=JJ|5nm#|yF${7Zm60fxcKnu)~@Bjoe0V_WP)n8 zh=K3djqlLS(%$8FHl_Vz78fb)8YJEA`x4qs2O9P#N|1(L4;NFsD~q*k;*k*%5y-0! zHM$J-+k2|=eq1#hkMMIaQGhgv>ExB<)J&gzz1Az4H1wJcx>mrlyTQGVjDg$`<%}yI z$FP6v9V}(=l4|l;(hd#@5zVx53j~${JI=egsbx=*7!xU|18=k3HnJ=^W@g?yj%vN|G1`TQu*| z2oz*x4a__t!d{MUXDk{kW=)ocM81#y{3i2h<77o-L@2PYgUj0zIzy%sK~HKT=8IYw*;((qi6fzkG8v#TV$ zLjCPUD9ubeeF6C>urVgT<;HFQ8>tguhhbKT+&>}x#cZ==N`rO7^gC*C4QOz|cHgQfx4`E>^ zAzGGtduQj0z4&+=-x~ROuK3Si=&1Q#W~dQ=aMKlYW&}X8l9IA0$21TCiTTC()R$D6 z7S`6*8hVxLxXw-{NR9BAoU(j$i}CWFjVnt;TedfD-)28eoUoN73WXvECs&W^n3^V>SKL6U6Kn`YR>=Fxgj%eDt_-@7I`0Ci=KrkYiaZ@C# zyiD(^#%*UY-5t7XPMF_A(9dskpdWOmYHr^$VOmVo=7TvWMBmtTm5?w z>if4Bhz4^J3IEe++Fs_jW=h>xc`Sq zHvBO=OU~eXbU|6BLgyZ}nC1J6S67a&C#8Ay=$2@u^4O;+Q3=9iVeVPAvxi_Wweh8f z>v!!soZl7o4HvuOl3X%!4a&lgw>b`(0 zP~d|7QLgKqoD)E8GjzP z=ditb|JH+FddSObqOoKh*M=S}FTd!`#N7irkhyKSPga_4TpDKn3r2%;8)WP}3f$}r z3JvrrIyEcH28A6VR&or&vWX@=DqVhSO=A#N;HSD1`3)QzcexK4IrZwF=~69&F)Snd zyXrB~|JeS!;{RSRQ}sj5b!!-{`on8|G&5q*r27t(nw6GrZpE*yem^nZ0Nhwkut$CQ zU9TpZ9qrQ7u9M_a{qP(yJGY>0fb{s#04j^AQ)_8xj5jR&-;J~WQu_}x{&iNJ*Vyzy z^4umC{xPR#Nl2WXd-?h6fy!X>|C|iAV#T{9>14%QM5Tsf2^i5h=cW6(5eX&m@4Vzx z@upIr*91*arWn@A0xkC<0eh~Yk8i|s8Cm{pTvJv;CCAg__Icya_o&71KPuYivkocJ zB`33Uk{JsPAHM5!osK7wFqX{e4`HQ1#)1z82AW}Z{~7lk?L0%b zrbZ~{2DJd@jgKm*AZ#8D$?HyH1124!S8p3YO_NNjblSsG`@G4Da$hMJPy-X4U_XI*Tf~fP!hiZ;eyV>Aptt6xtp`<q(8Pj=210}T$+Uf zmoN27^3h#d$rsJivzjjq#t7Kf(ndO7WW;zzr36twFirr30i(NqGQ~Z^!cw1kmu!=t zBY^WBMa6aEmI5!?Sa!GJ4)kvO1jCvWq3tC9=$^8~#0N?GqmC9uhb^x74^nKs%YEhL zP>5P&k!~Jo5YMk+OGK2Bhv7JWluNT%WIOl>!8dfCu4;6ZFr7oM@$#FF@{N541jN|B zVzQWO3zO*3=xC1Jc!*|Fe9_KMrcB$Z^~%s^G;_Jh>M=n-yjG(Ac}C~-jWdW<|1Hof z^-p(K=q4!0sG5h)%e|HGVR4R$?p`pkXpep&W+I}U$DPxjj}Y^sXIt+H)Tvdpa(I8W zC8Lu_9mt`7UNz3|-NER6(7qUza~MKl^KIr~xen(=mQzPD^Hq582Y!4$m;ZDs?eP9L zqy93kQ3_NuSw-nDjzpD1YsMSO^}A)-F4xpE2Kssy6}5jN*uK*vJ0~I`7u=pzapl6+ zwiBY}<5RG4y(;FlNXfGXnP`?YW0#+BPf15j=8f;TrdIZw<>l4@&?{0A+5hf-<41r0 zE{9BMNr6VicoFv=pS7GGyg%|0S1;AtG*_|ZgZsY-0HRN8D(7(vjvvwk#S(R6qe#{#4`*c}CqS|Kr7q=r+(8ceAPzm@QtLws2*W@nF?sDDawa>#+<*0ph=b>Rhd z|3Tv&>{D_XegN+Fb=WJ*|JIR0eVjUV|ul8AQ=|oN>H4nva>fTBx1YG`OE2f&Np=Iq97*V7FL?bYI+Jr7M9Ui#f1L_3tcJSID<{*ZvjzZg@jF7 zyVe0N#2hg6tW3gy<2XIli!HjB2Bzv<9upIpv9WYNdlvln|C^Rq6VtA7Cb#4WL?~~| zuY`sV-rY(C!So~T4PuAiPbuCxI8xZqVwCUlMGP|me`>cjvxWP(VM*3Q7)%whNxaQ| zF-w;sBd;Y1y{M<)GGtHh&FiJSH^4-h#$C~F>hhCe2~T#mtmhkAx(TlPr{CRq57-eC zwYvx>ZU4&JBt&UX$!maLO#)(gJ3hSqUr}K)3NbwVAMja#`yO;5VeK=*Xz)};^JE+6T`P5dhl!|$}lB9 zA=RaM;V%eyu^|pUS!idao#HR4{OepP<+1WP#S-iWl?O`CKRiJCE4%jrX>M3TNlbAW zPcr94#Sxpqdh+bWZ@|+rq*lo#|?3+o7Af|O(euezm9Oas#k=8PB=1%!x(6DL0}bTAF<$2$}6H2@y%K0po+wx zn~)Uxm;CB$BJGfnE(>}b6UDEzeAj}5$s4Xu4Zh=+Y zJO3AoBitc8_>YEtKWRKL2WR!J#rW+Z>kuX7(!xPkKv!yjN!(U7JZ$?M&?9~N&)kOH z!Is<@Ac&qyxBl@~om626=Y^>!ncIAIg!A>|0% zNH|XM(g1;;oUH0SF_O0_>W_q`ihJ%~^a=xu%tFIYt<2Kw*0wXh=>{m(L9qXN4Xvkm z@#mFgf3rN`PjOqVkvkXUn7lzsd2y&QvgW#_RB3xJCO_!D9E%)Nxq2U zvlt=Oy+;8V=oq%qG*Gv(W&L?c@S@onf4C5Vd%}+(s&oO5LfnT6Cegg71C%Z*2fu4S z%vVKoYRCv@LQ6*$M952zRni+@Mi_c7o#pgFU(3Fm$q*C~GF<&2n-M}EA)DT-pV4@t zP5S#*FL^4cfzJHr;dk6>8uh{K>k@`cv(RSOa&k%r3>h<*;`bf$myuBePzZ>6C=_W? zRSdu$36(2P`Eoy>Hszs;Ic+Ft;K+w_D1&MR03fV-D`U5yS19_mF>GqyyN1#%In)V% z;oHBew-$i0LziEKTx-B-Xuu6TYQ}y!HNrzI-TV)Q-+C@%F8ex)k(0Gx9d|*l=jDmp z3u#`$=R3{~CHJiW6X7J1dbwh}E=3)P?V=&U5fPG^Hkw+R?ZyJ>8zP?j7eoc@C9kvsk%-`79$Z!==SJf>rlEiwJJi`Y7W|Y1fnEkj{P(OnAN+aJfNYP}R^K%>ZjMapllO4~PXMLM&NY@vAaxBY)haBM1Vt#oHBJwy zzy9^rME5_uCwC^H_Xp}rfqzD{9HJT@QvN&dJpVo?;43tMM;Swf$6FxqX8LUe!G>M zlTK}^dQC4(K0!t08KJhAphNby#GJ&CdA#{DJLiWUKR*_S`@fjf}0+>2i zsLx}Q>^09BZR}FCvVS-b2iSNzmH{>o9o;K|q^p`N+-~x*|CCZ@B4e}jEfTuluzzHd zYi0%oE3;g`drWUc;IaMFR$p2bkG-SYbJ8bVS>_?2<(80o$!N{;g}br#Dcss)GKXGM z8Nv^O{9`4ID+gq|)E-%fpJ99byuw0ZxW}Mwcx2?mE{$N(ZEo%McE}&I_!^YGbG319wGK8{gVb1JfJW+el`B; zQkH`Oy+)c#zAKHu((6Ea;U5U#O<~p8q>Qbc$FZxd!(>$xg<4g(e{Ar3Ws>J(S?H`6 zVUxAXd!j=q6tzp&?B-H!vi%xdZ29F0haPmRxA#0<-C~a@pXtVoU)eN%)6uto_$VM` zr>AL}M98OQKHh5J?Iqa;F3<{n@xZ;qf8bd(4QnMb#Msy+q%Wv*_l+SXVA~G9klCL4 zq%FoBc2!l?B);!AA#^9Lc-!Vj9^MlE>c3x_=zP|{CY;E>>onkDE#SQm>HX#|!U&oF z&vx%#1j|GB6 zOWyH80)_8h&=go6=8Y+?I2#^c_Y8}Z=O#|w&$CD)WA_J_E=|WD(2H-+&DL&L>c`Hx zT%`3~bLcJln9utB-rs*eyLz(a1ANwr&f~}a^snZwfk8cpzbbLlB`mr0q*;}Lu!l__ zQu?dVJS~qx)J;0cKBFW+zn=8vINPf^p`QBRIBP&73VoXrbPntXrJXBaJ7N3s@6#y@ ze)viK7hODmzfARjCt0Kt_xQD%y;`+z9T+VHP?XU`BWzqvf7IelEeeGL(sVbqvoV*D zk?yVoS_jwV7D~4EWkL$XzHYhIZ??O;yRZ-@@dI&>A|%askIH*HizGHWHMji+%SuGV zu}ofX;*I<3V@=|vBO@bR$e`fRp-x|1$Opy5EFediH?>&KG&+8imrh;XV`TK|p?%eO z({$fxJ}6PZ|GdYl!UEmWB$h|gi+jhcoRaV0i&ksc?2zy1__ooz`AQ5shQIo4ar;7w zsMFV%_!*owaj3V1?`v4?f{3Pu7Pjs4moK~D&NamhTZ{id5=gWqZe}kG)O$8=(X~0X zR4wUkbTCMI7C4)Cn64c7w?>%}(xH|w*-x7+-1cNo&U^D=ri7Pu;uTypfq}-}{=@P; z^{UpqOAM+(3Sb=6G)OFVjdIVypr`T7?XUk)V4tJ_J+1pkdGVYW4VS?sY)?e*(F&b7L&t<_3d={$UxH+$$& z^U&;R-9GI-71T#7=TBu|)Nu&26$~N>qb2{_r?zT4Pscv7im~FrwI(BAA5vk?K-3^| zLSwYPbBoYtGjn`)D~thw?ni09=t>Mb=cLuIH>!<`Nt>B=iyfgp4Q|Cxc~HVBL`0-~ zyo3k=u+N_uGvj?NU#m%n5J^q>Zg@D1YgunOFa2yPEUA|&ui#X26jBqYK5+;@BrliDLs zmyqSTR)5!04CE$yeVlr)l@e@P%DokKcN=^?Wp?PRi{xAAA=K*%`^UkZ?zu1)eMTH%RQ%W z@H11#k_-z5UA^yE3iMMWoX+9W^71zEZ3+vYs_YUJKERMx7${xQu-j-OV$hDQnswzR zMF`XL>DgU3VfVp>?uRBIsWpY0k(8|`ggt%9{2(2)(BiP-FFBoG<>OwX<-0?vxjKE}BvUg1<>=PnXBC1{|3FvGW4yR1jv-cgOp zF+kYI4!hu+4;pVvvOSBMv$j-sRbONxaBrzrHa2LNqo*y8SbjV;lW8;YJv`=$sCfqS z!#AJc|FX6yEUfcUcQ|~3CZ!S^ZNj*SoD0XG8uB__83CyMG%Gx&o7$saZd+rBUqq+U zZ3e1}8W9HAKGUD$; zl6Y<2HF>$uuOJEwFyn$h1EG`@@Lq+iCBNv0Ki|vN+&t9R^C2YlHRKUDa(M&fQuuyi zRyTnn&gV^;nPr0>brEX+Gli2EH7>c-mlw(bKz+s}kb;5Eez|-;H9S5pwqW<;^@3)9 zHT*cp)1GM?ahS*e;#DOis@kLC%Fu;I`tI(YD@pDdFs1z|-zF~!qdYXccCr>XmEMkV zbB7WV8cSr>o${h`(e!nX*2UZcMtrdK)}8L>yMpB91``HhLx)vOIgUn$jSn8aHe{CI z(wdcth+^~*qwm)L`0ZCw$rRHcQto#~g3> zx3P1vU7|ke+~z*NDl03?;W{IAa;$5S!WG> z-vo}q>nWfnj`83A`JaLN?*7?@n|9+cmNaN>XB(k^Z#5ew?cg|edKh4)=Ww@jZJW>f)+CB@hziwOc$q$4AC<7B@E@5dat5ZJreH9G0a zh9OAT`8EDQc#sNMKY#m!RtqxlCQ8J^`y%n>OalE`*Eei>8jz2Z(TOoWKLKmNMl7}$ zI%hZYYe3@P7n`_Nv%h#TSJVvv4s9d%28pA&8~l8H-!xS-S<;Rxj*quE&TPX#4TONe zK=&FYkauqMoZQ8_Oo;)7PhnP;TGR35`tF+N`h_kWa2XxOWe5A}QPKRK3!#3(rS*Ht zla9R+yDdrl>_F4|a`U?PqUSVnh2IA6OwgHtl{4RLuXx$CH%*^Nfv3^^G-@X}or5kV zkg-anw@z@KrItYO7QQh|uvXBXiA8&Hog@v%k9_T>JRHJyIm|v7W&;X1oZurv^a3T@Wd3iZyK+(kv|Ku1m&H2H`lfMppYK!f_PS>r5 zsv5mvMGWd=DI{C{ZfH39^}}{z`7@V+4I^ZT8YT-WESA40OKh%tHW*Gq7b9+xljjOl z=>yxu$Oe2ND4QzNBF0R-vf{ERE*aTw8r4fV5tk_R+z%-9wzzt$#%y_#6$%Rq`t97O zm@3BZl_F{QxS51?;|-l0`wqM%56cAXr-}*j%BXC*S7C(2A-vPZ2LKy>x2`3>G9ZCn z&YV6Hcy0^$6qkOmJnPwFp5(~kbiIb6B35k=jlhLYs--kq}nL z$&1K6R%EV7c^t^*{gpO1BBkJ;TY1gPe$mQ$sK3n2%=4>F1Cx@H;4X*k-DwZHf3a!@ zr<^-%fI2sf+VVLyxZ2yO!zK0K?IxAq-2oW?UT)#%&!hT+opt!{w{k&HYDxsUcL_CS zB&Ar{GaWUN&94P2;{nOPhQBgQ|)xMhoLCdhdff(ofzJ)8Wz+ zmMq0_L(#z@VX-+%ozYP#O5)g!$AAs+4{vE}LnpGNtJo{;sc!4tqaaK(mqoj(i=m)D z@CS?g1({|2k`&jj!Eo#N0x-T9*}(LjboxSeW)UdWklYMDbNNU@K>CQ&dx$pIG`xS# z*(e8;DU?NpbJ?X-2nPV;1cS^ww$ z`bbieoS(iP*b_My{npS&O;%V+(YdYzJ$ahPd?!>ayX1R8EU*q8ScMMmd-fB3i zYFfeClwQKt9%BM15zuawUzxr`y=uX^bL#`x?hvk_>N1nFtqVRoWmD;*`}q+BR_=ef zbMQzJ^h#TdRzPv>D3(goh8zU7BTbjk)Ms`8=~eHHMgA+lZdO&Djw;sVst{ zPO-uN5L0-rM}!Xu2R7&q(CCF+Ro7K4id+8~s8=?6FuZ*;_tLu&@5cyWYu21)9f9AJ zQnsPwqfSFfk%sK=?kD{JL2_~_#j4jS-F5%o;evnOdos zWOEES!|ZE1ti!@V>-qh)lAKYv* z>rz+RD{ZR1G$N+|m@6bxtE9P<2L%TY%mv-xHy_Hs8^=PYsH2m>teB9YdRLa#*<;|l z8u68(x0|yrsMWEKr^=GX9t08FbH?;u4nPO+53TWvT=r7}T8&f@iw}gEW3^dMZf$GJ zCj|Dm1_xb=6`ijUY)n6|a>VU4+jLvw)jrMXXW&P}*VSU3lf9#;a~GK}l^o^xUy#!` zP&~Do;>%%G)BOx5J29}@JrR$FDL<2-prDJngk(`4&7qfJY`k6H);>KF9q}yd>akaL za9ooG$if*sg~$zTyb*&$jblbWGj;xkaDgY}tcUdynwUa{( zEoPX$K#ruMV=)D}4xVJjQe~9dlr15@+xIvPx~HqDp>Z*+?dubp=W^v|z_260FNt(* zSZcCH?TfSyfgWvjgPA4{Po;ol=Kh7*RKdY9Eb41k%(BI{yl?F2=%sz|Dm z`T4jMa`{WxUHChHCcDpo-3AKti&x>`&3&Nz20V$c9-Ka)tOTG0&}XAzVhv z7sMmCAv}qSg+-QpKU*;14|+dxO!ooS*xlbt!U}*!F6v3a^;fa!w3!1*TKotP1kO+Y z@hsL*6=ZmXEVtu0ADRG#Y3)&R{8BM*&;8q{I*IH9FT)x)d$r|v9_*9%mAiK}A3BT3 zMJuUd{~4p^u}xYHXC*wR;f2E*_IneB2A+F`ds3-dFx{f|8?C>TGkplHW0RQ|vppm+|51=l`hLC~!A6NW}OG^E-$@Ry>s=s@}CeoFK)rwdkXL#SslBgh)x8mcWbc)c5OXpgs5J!9l;O!RK49+VVK(6=m88 zodAx%jNN2odXCl{_@Aq!6}tuYI}*KpPax`b2LZ%9iDc|Hf@@e=J-%svl~;)B=Q#jr zgmlS(DfjDmZEn$WP_-Bj1fz^DwiMAk#4cV>tv$^`P+}6l1UA6AA?8B+V_44MpFmM6 zX6B|(qX^)~_K^MGZvb@tXVxom^-18nuVYLQ`OcN$fdzgcRm+= zKkr{VxJspNRx!p1K?~Rp_{4YqmsI-yHo+1EW{d^7-9@o=)TBx`s6Bf8-IKWQIq>`z z5BT-GLQSAFtDle<`KoLi*7O41ixN+NKOiSx)HAj(Zd*+qNpE4jF6RB}Eg~ZCus;&d zw?~VMbsFkx!LI0~)k?g_`uRigHyHzQRaHRQ^*ho2>4b0-{dzedSFu`LXtB1ji(yRc zra zseS8@{gJf>K5B1$J>`XehiiVSsByjD*?_grX4Vcimy%3KLWW)krvgwV#0BL4dA(@` z$SE&bklqQ2=hD`aN&5Tl-LUZAIZq<&|Nf)HmI8j^ zitS@57(VGmoC$KKt-GtzNwpt1FKDasUOZ3MKo{QA}?T~F5U3~E9-p~Lqo&7*yesT zzW~A!A1p8DvN3aqu0w(`-CV*NDe#nwi|fi$PYqSo$h|g}d}$KN3vhePM^_t?bX72u zS9oJ7IQZ=wepI!xI^uX@<3=fk_cyFRxLxzVIdWI-VJf!W(pIM_`}|Au^XK7O$bYy{ zjn46Ma&mC5d254L$2C3w$swu1lF?r?k4Qz9Y`yPUvO0-r+0)Lwc`J>GxSsGi6|Rc~ z&Nke3a>7{$tJle6ljfHfs=0CJi2B}}nwwjF9zttAdsdwBNebWi+^1$10EdN>or)2= z(Ts*N$6)2BD!RIfyVdFG=_0PANJaHLOQ|Lw%`{{rdh+C3HmcG)5JAUpn@`_((kQnm zw*6UN4*^9WytSq!px>AC3cC!ng|Lf`3NKz{F8G}I8^>`CE|ln-2_%=aiHV8boXTtv zc^7E&b>js!6}e_M5X$H&F3>{d+| zI88iopYlmg60lOkY=WuYqot*m1NWvWWKEjOcDr_t95lY2=x%&SWLwyolt$-wqEPDiisZ(gk#w3-a0a6y|HxTpxr)2B;YJa0cT7Jr9{IRrjr=et%4>W^nUQU zjDd!Ku9YoN43yy6SiM6;yuGtABFWYgwU9~^zMSM zp|Fo1RnomTbD5`KRa_*cgN48jBn?D83b|;!V=t113>=`D(VG@&!&wQpEM!aEK^|eR ztxZ()myMw=J9DRd4&%0?ec12lp`@fPT6^HBYqZ|M`qCI+=M~u39MkTTWeZ4Da&ofF z$uzl}iPQF$3p&+ZTkq+Dsm%y%@LYr#b9B1~nlRH{@#emVvCNY%O#)h?JGOhXT56pp zUU7!&sx4Q8dQOi`V2LU(HglqL>4Y-s*6NJXkJc-!Eeg7992!c%=U+bbc6Tc}G-87< z?w~CM8!KU(V2l?sfS5cZ&1!`v!@TkJNM)eAbHIL$)ZJ1~Rc*1RdLq&FFf z5X?MTA#cV(o)~Ogim=Dau>4eO5n7Avby3ARA|Y2qO@*aNl?Pg@;Rr>uLQR#)Lhms; z=1BMoz|BuRxUsZfCj0_-R4lLkvH6n z5n|dtK70E(iIWu@CMK5goeLK(T7#KtedDi;A3uy+z^aCTkZesoJ!`rO$8B?OF|_)m zV`n#_*3e*gIHhI;+1S|aI@UrdYC4Ik_8~N;{(1vh!%{9WR!AhReTEq*@FCJP?)Mn^5nP;)wq)t z(m}UBSlWbw%gRVEhiMx|bwZ5Zg^xEGMSqye0EHZNaK~7SOoInhvViYvz%J;IAX7zM zU3AVc$r?3*&zFKM(knR9_`m`$@spuwH)+Jc723Wp%3=j!$pZQ~V0(7A&<;xtg3}*6 zao{)9O=X^2q)E_8#z~Ly5+3TXk>mP$uZF#mae?(-u+FC;LSiHyZ?5@DoSoO9`D_F3 zyR3jWaBND@;|mx5^~(mW2-xR(M#(O z+|6!^2!j~Ywbzru$CNW^7K6z>gYT)NQCCsP@9Mgj+!%xmui{|53;B*2x9P|U67aqh z6x7izdc036TZ$YVYTfnR_rDtJHsgm$LWUx74h>e?Agnt(4)3?%l^BtxOmP@&G97c0 z=GL_ytYT%B0i_8L%bpuk%e59LI)RpG#`d#KXLB_A0O&|a*pFtvuNju?Unab%5bR{k zd-$m74ZOX;3Wcz#`ZdI;{X-8P>+w4j`9Mtycy3gro+|&Z%<1j^MdS*xTfcXDHn27J zL6(?YKl3%YUhe)ayaziQZ|5Z91ty{|7ZHD~_)S~RzRW44V`w6J9Hfk&s*N=J>s1=( zBE(JmZr8-C7q<)!J_hiI{hpX%=tcxsC#UO;jj3B}p)}0+5_q+Z=vlVytSdm-OcBIS%hzI#IyhlwYCOu(wZ360rN5fq{YFZeT8^M}N{*m-s5X^3;#-h*LBG87`)_$bJc3eqEcW1?N-HR<#4^M4;?f?KJ)SknZ-uxCYgv0dl zE0DPazB@KH)(X^65O8KTVvQ(Dry1QYkPMbUlvLSE&NP5_a<|VvDS5`K8@KuBP z>7}I->HO-z5tWoK^bBV{9^2a99u)S!XpJ>+FVyUe8}SGT2*7SG8tvfg4^fm14%<>S zi~#}fR_dK)m)@~O+tDYa;)jt*O*1TJbYhmg$GyH3*1*w3<*-FFTko70yoh&Q-Xc$` zdj2}D^jYq}fEq;Bz4a0andUw$vKAkgJj{GMb&L3 zD;N@N!c5YcckakR6k`vYJY(BjNUxTT)aL1lu}R!{ST*S#5q|UL=#KI&Nu?XD5k-3< zh)t@=28&Wf+HF)~ zqck+06{ps@ab(G}fB}qNJrxxDUF?wjio}ZWJ{TwXSfUxrn<{5lB2g2%8d2A8L>HrJ z!ej_gE!jT(!`B?fWQ3ZUI{!Y70d77i0)!%+mmQ`XC!A%tbqn*-JPn0wDzEZWl9OA3 zR6K}!>VSF}rfu}f@J@5HfXN;UqYlGRcW*CJ+j(JS@~UJxeQ!_CNYs4iE(lL_ao{DF zK8)uP&LuYtJa~J)8*5uhaN>?%mcS*T%?{XSvc{h1xZG zIrY@Qd3TgLwKo#UE!yU@IG6#pAh%$1u=RTM=F#IvH`Cu+x)&=-p{+{|)OB@rYt2vw z9X*x4w>(-3eKnt{{e9Ja-?~JTCcWRF&V3xN%*Ex}1*Cf}!~8dP+KJbTY)qdZwg5k( z@!|eS#*Zpa&Civ$a@!nYTZ~Wk-N z(tZ2lP?(Ix&!vidQa*Oxb3a!8c23kyytKFf0<@osZ;g;B2+Ezm_GGb$R90AefGC0x zZy0Rm+`x=8l!~r3%C;~uxwR3@Q{B4nC)lfjcDL1uT$?-v1O*#=@Aof(y8sl9?i$^9 z%9)s$D8_&R(>U-0!XhW9G!n>bp=D$10W7_J!#2z*ge7%VCo}h|xrTS+N~1QxLJ<-1 zaUCm8-aIsl%zDsz5Lb_uj>9*MAW45V#a8Sfbw!P{El`o3-v?A1Ug(d)kLtNn(ag{tPz}MMM= zYHEK26hKDLr{aHcCq5)3gbS2$K_}$QnQ}g(wc}j}(x<^*Nw2(Nd6ONypwSrld%dz1 zBQ%;oMN}p`l(#cMfR}R}?-pDJf2yq;wk`S!ZQrmPv)1n`1mHi-Yv)?`(TuqGeLOv4 zZ@)@d0$nkNLbM&f9#8tW>y=dLA|$F`@aV(6eAA)_h2qlVi%@*dV7bmy?w3v=I9z$> zA9!U9jz2n@11NAgg?VZUx)9X1JD*qKvMfzm0NNrpocrFrA^7tCN@)N|?>8u@*#=8* zF~;@5nsdz~pgJ8M3suE%ji`>vrB+*E=L@fu8ksAaj^uzk0k-EQ>mx&Q`LbQ`9S={> z8K;t(=@S(UA;%R3_r#Q9y<7RbaX&0Mao?GkFnS;p zZYn-iulW%gmXO1-cBElKpHg%tezL%?k6w*j`tF&GMgaP#srVIIPmUYv-0(7V9hJW3 zgmg3!k?h9R-B`w0ig-4`*^kkLWl*0~pQX|fN$n1g^kjVrjN{db>bD$PRW>hl&I^yq zQM!!u^TE4JKaQ|`v9oC`o$e)|j|{KVqo=2j%1QUZD}vQb2>Shf2T*?Hm64&Ltb648 zU{Snz;|Ywb&N_5!D_r6|Za1YS=~efE+;lIoLsKs3QTeDVbRBW&>7}~~K!*+2cj!-R zC_~+-(zPGDDrvquD zOfqd?1Z{u(bXVCj4HbDVArQ3(HL!NMn&ylZ8xFNV?92`FHww_LvBh0Xe7bhcIcu|j zz4hS66$$LimNSrns8KP4DMUc@4Ph-)zxXS2@k=TX69=~CZ}t^$oxKL^hD%_%9SQ4& z%1ils6JWd-SwyU{b8-#?xfI-Zm>ocw9w^xVEjKq8x>Uw8^g!$xh;q^+cf*602Bc5i z$8uxC6RT!eT3TB)MLxhpC()GD*Nu4>HokuWv2}ceas>cV{G7wE_0go}=4Q7xP!(Yq z?mZvy5AAn=Q-)7gD_lF_q9xv-_=B?ee*J>i1AUq7GL((*58f3JXi57XeR%Wc5fd{D zVUSuQD@%5(o1gdXMwbpI?V=G|Z@Zxc0Atf;U@%w(H2>6PJNV?7$mew)M!Zc@h!EQ1 zkMydtA)s{L-NCGYbnMPr0ni)+)d-u2d4Wts?V}h%@)d+cNxt7U*R9Q&7rs>~?yl7V zXOUr_?RQ-zVrZc!YrbanM@UIabnznJEj~=8J^&_k5?(r&f*>Ph=#kQ@MCbYWc>NF- zx>+>32oy3i0=SqPBBG{}Vb-a=1cFaC!On~`_>v0&IoX18$~Ujm+N$3#5R>TkvPCg5 zF|o6;MS7Bp?xwAl`W^#aVI%_c{d;C0Lv^p7*zzqvT1-mf?I+!k;v^>rDDnJQCpLrKUBO_{mi1xu^M*9FgRQs+vt`Pr|{!L8acV;`^O|H0BV~ zN&~PNGm4N;uCg5l0xbk!u*_mAd~_2b{Ke@xCFAa+aNN#HuHQ&WC!Ht=eL-OM1Wf9( zJxo|w5!_Erar#%?L~3GXLCRec`$99^R!od~7Cta|xG^BG!bDgB={GAq>i&V!`iX4Y zO?L3|jXa5V>$x5tP|f>latd-k-<>fJnvAIBTwkujxI#~^Zt6KZdh}xs55Ps+p z0z@URB0r?oxg$|f*M|U*vA0#%)v?uk;|3+-vrCO|efR5Xk}GXhk>6IxRZ#V2MT+As zEz)=H$TFOj(0aQ31UGx5u--!VnOfEfjWeQWWl(=H{GWmMug}ddFYA_w0n|O{?LKX0 zCkcF1iB63iKsqCh5fYY@TVM7k=dH)ciqECVcF~^z>K3VtxUbR)Ull2 ziJU%OHzw*!sHv?5)SxqbCVm>^*R+e(bSytkGQ$XylPKlNi3)Iil6bX^x)b%y8bd=vFGnD3#w$Axqd+Z5 z5pRBXm=?YcwQy!UxVrjQA!03PU|>M0L(B0&PIlWkVClt2_NGR4q{(RXmS3ITn#CAV@EoRLczqkkYO969@>a<8&+D)JXJCgVKvvO}>@_y~`Yl-6f~1-&}s{=`>U zs}i~%`1trxyY>8qKiK9TX)G=-*3&O7bKC*Fjno3M5jzJ*#U265%NRI%#2Wpr*!!*T z>b5U@ndCBQOq*|u4+!cDwK(B0)ptE3^Bc$fQ!$`+Ks6HOGL>WMgNCZ6tip3Dh8ammTmAfW#n% zi4n||qe@I9r?(l%fy8b%;a;TKr@7^Uq)r7}+8i)ThT_nr+Dk}Ocfo4rbZ~VoY9!6s z*}2H&sQv12TD|^8d*Sx)kVOdOswS`^%s|!;p)IWd0Zpi^Z*TQo{E$!E|A?d>|5!v@ z3`)FOdVb+9@Xo|2I1)r5_|45&Sb9p7@u2-!xmigGa#RS5t*NQ80z{cWTg4Unp|%Q% z5*I~~uBe*EeX^fT1Q9a|UP|YVP!t6Lr!Tjj#`oHmmKLn#0*in*OePz;zoKbH53!!A z_W)Z>DJ2$z32%oLup7$)-DR|PfI0|0#nszkC(LtkBRn;ripobz2k= zaR3BN%^Z@uwb(>NlxHz2>_4~s{SE}=U8|N}s)#&BHr@wq?N*@0 zXIM|o7hsRlEJrLVG<9@#?N>E1_w>@vEfceg#YINGAjIS)IoSa*fNLxhb{pJP-~BG? zpn16Xu05JVEWOTiUOJdiSa8wELv!II_y!f}#V|T?xeAFRDGn0~bmvL;fFe>Ek?hWX zA?65=w?k=8CWs$CoKT|s!a-*=?0H&ngGg$2_->zmNfIp{-(T+S!OpLnlJd=Q!oXlC zbH1Ngoxmh@O}v}}GNHWBO`06Zd(Dpn*=a>zeIiPB1DU}!&x8KUg7*)hYgL3OQqjmX zo(oZFXrfMoTn8&1$&x-WH7b;R+{sn*M6tf1)7y9W`|@%DZmp&hb^^j| zH9(~q_}V?2HCIfw>aN`-q$?jj%p?S7U>c8xvT?EXyKgUy?~tudm;Mk0%pP^!X&AZ`=l8pM=~C6@9mAuyv8#@C?NgvaR6Wl3!dimG9Fq{t#Uv*6nnL;R1<$f z(`(O)=+9=rgeohRK(Mce3&-3O!S`5^_Y|#x08+ogzM(aY$^@D2x{*pGrs8{|;*$EOSpMJzUEoSX^48!zqbnwDcG3q-HnHc=6WZAUJz{U2BF0oByjMGIrY zD~enjC{nJ9N)Zt09WM$3Qj{iLML-C>w-6Ks6#+$%-jQBZ2qgicA|N825C~m*ub~CP zzm9s}``&-X&@mhX$;ml;@3q#PbIm1fUpfgLDYVZ+ISkw}4IAN|_0rGmyGwMT=(6d| zi|OmKlXmA87i`Wbbg2uCOf34pc?5zBx-GPBg!#mn@-cMBUUYVG zX*VjYOno)zej+scIppS=!xv1gT;#opQ=*0o4TZR+r3TwtsZCa&GW_&&Wsc5snlcu% zYJlD}dh{C1vC;=zUAu`_l#^RMJqsDkCf`Lg0g$L$Tb92E?{V4y5@sd6XWn*lRcq3p^jGGkB-3>(Grg*mWHYO0MdOTltQ5p zp%?mg+L!C_@P}((w)T1Sn*O2Tp}H|eFAeR7iqZ~C3V~YIg|Ke?rl2yT&8dApJ|nCj ztxTg4eI&{ZiY$Mzl*wiUVB%GyG!jHCSGe&s(tw{4=qbd|pkNTJoH*Ne*}^$;+7sSB zktK;l)DJ0GE#C!Pc;p+7LiJ!v)aRZz*ujKsa`D3wlSQt9&Xg%x=NARId6bFw^#0?T zyZwceE!5;GlYQFZ53a-^guQPHygWbfWrk5cw~O z3u-dSEJYup4`?h8wI+Ui2Z8WmJA$==^KV;_u%#iDW>9}jS z_qVkNR%^3qZl^=#FLRt`$vnbhk_s>e3Qp$lKYs9fm@4VLjTM!yI`{B~bWg%9?e@bH zWFC@Q_yrT65O2!F85M-L#@f{#j&s{FExUmcG}gIS3x>d1n)9Zj7?)o+PxtA-ZgelP zWs>JwM+x#)@jgQN}9v;2HR-bEmc5$^QZQdCOM0%Syj8Cki^H z$()>mZ|WZiXOxG96+p6wd`HN=4fEYlKbv~&iDsCcwBCy0ntzvh>{FFk_o;7xlEI?8+*AK%QFnI-QVBJpW#lX@0_#b=m!}I~c zTZ%Yd3Fl{Da7_9|%vUvT9H2YdGJgpwLv4H0s&MW0VxKjR>#mbCf3j`wCixEi@CUBq zITJUY|H&d)YsGo}l_pZCbHryu)f7Pbxh2oPGjutNb8TJLl+A8RkkUhKHHsS-&X4b8 z&CJXIa=cM$^NwWZeXGCU)V&-q7vKN{@LnzPl|wwEPpfn@d= zaKdxd-~YfptAP8tI{T)z<~qA{U@n%h!((MXH=I_->8%wG2ybdv8Cq3C<(7g13Q9>R z#&mY(6FH#`hbIBkor=kktr9D60=kMax?{-${0p%Es?x6tR_~=uwNzCa8ynkfB?1H4 z_tA&aY)EO3bKi#dZy2v){Ulukv1O%2yL6;jKFWU`dTCJ4XhRW+-dt4n zo~~S@G&m4?j{DlcgMbRiX3Fi&%G#IffW!Dvmj#jT6Y?r>l0FVq1$BvjdXSWhP5bzC zGrs`N%hW|KDIemjhWz$s-2LI7GgsWES+nDf6|TS84Te zIel~2`GBiaZDeiKQ6@gg(re|{Eo|oM^AACJA?CiqjoS4NFl-+C9ltone|d)?g9#lP znmWlb_v%upY2kDJIV2mdfU6vjM`)kQ@`1?-RBxVvu-km6dLQ1+<(oGG z?L8z}47QqGGq`l+r11!6o9?|nW$wH>#}^lNDX<@BJ(>r5$ELae&Iw@aYI2CI(34*D z+mvleD6RE6e~*}lJAx}o{5>E=H&yUmy(AW1z=Ot&XlVPA>$xqy_dsfswg!W^g0xBP|^8<~k6h^PT5zR{79 z9PK(s$X-8&mQOrhc5B@?u8(U1)f;M&lVFYUt$_3V_|cU4r`h0sVKg%`2G^J zwTIH{%^(pscR&K-ZPr^{M&<`pV`2=#(`#CVhysv@0k&>>Y@qYSNyn#KyQR3(d$hbn z?M~Lz?@B&%+OO%K^ITlnW$AZ%JZ5f>HzgeJ70a4>{`-Z)bHA1Bf3(FPfmGoE5CKNh z^s4%NSL=qO^wYhiE_ZX5HpCnX`el6*J6Qn*u9bd6zmJ}m`|?6@(;u5souHuHVERB2 zZCBfZ+smrO7mIErY|AFFH=M!Ii@c8DQ6a~e-q>}XP9e=ogw?HqLYm&tH;v>%3PPOI zR0M-KFH%lxVIS$=^l;xxr@-jx;{CQr<-;@d%QnZ&~-Q;MleqzQ($pj!0;CoD2K&Yw7&8$ERlg z`v+a}7zh}15(rfk#FCA2g8M5stA8Wix1I}uggppjm#t7+dXGk`ZzK+mk((B6`YrZGzZ<_ zAyoIrrvQ#*!&ioS*xKpG?U1S^XQ$J@01dby|Jo4bEB?MZw5z2>+DWHhfP-jf?AK~m z=DFdS8;4u5*eJNuNPXMeASxnnELlj<(Q!=zr0xW-4^|ZT%mbPK?)*O05R=@&Z!Yl> zf71=#+(S)x*HtDlIyTBDd0rR4HlurOT;qQ<&+*UTlk=E&Ht^~_#K@g%e{RCfK*!Ss zT{$$t@{PG}R4jhCDwH5TnxS0Q%1USUMg0CLR*B&5yggKL9zUa(M@t3uhlUj0&0pHj z+4Ou!Lc+NMwI2!RSqF{#j79HvY4NX9CS01;-sbDvx$#~`RyN`PnhQxBB;KOC1L%{a z^zRag&Y$&Uf2*<*3uOJlspc+}m3^N|)062dH58KDzPy4RXPH zK4ccG`Cqn{f-mfQn)L4d+%1Ml_t0LMScx+{bjbw=7#a04Lx;$xPiOvt@y;n9@^HWO z=SxGg830Lt{*j!xL~+$ERB*7nA(?7&>Z#N#vsAIh-URmPVmHPGfIMSNf2jeGA9pMc zPpvjwqbjR*eK4-sSMFXHV$Wei^78-UeMlew?5eZNnt;^_It6nUQP=k%mjI$ZZ&unp z+htsX!T$8f@5~1IMV}7*?=En+&m1Gaa=ykKeEe8c;bNtclysZ*L5EQu4}F%%h#0JF z<){DTsDldj9Q~@~?LzfMuCzG(<1fv(@2qh@b>&oT<)TxFtf;IM^}H*8UC=}zIDI1e zUF>DQyq8L8|D(wi{!!EY-*Tk;l>K{e-?X(qe{PydpCv$w>Z2O|^WzJh+m`OmXOUZl zBmc$c!PHj;iVs|uwH&|x!^pn;tX94RQQN8vp#{@nd{i>o+jTzYli05C^qF|${DI=` z|BeD!^TNLhwqL)=-#gEt=K^#aMnc6q`rX#a`JesIZP6>i&K98ewmcz;s1A{fExY+! zHg0t>i6?e1odiErGw0F*>nEI7P)AUm_FC>5)m^s#y+Ar0&i@uFfU1bu}XDb6RCxoN-1OYQJ!-#;HPK4{UxI^b=$Z4!~12b}(B;Q)Low}G72lNAAUH)(R zjk5F$Il{TXNC+OG%|AZszwQbC^0#qD3XwmTqj##*<^+iyCb5B1daAGF`I}=2ay|cP zf~yxgT$-mrl2cNmuOtZCOrxj6YO1OtJDEw)ifRZ1AJ4gS+IG8lA7^IG>96#j0_k3q z^bU1Ho>xqupmqc2F`dyMSYB4U%w-MJkPJ&;G7w;N#l<3Ex1m+~?S_f((7qQFy&Dmo zuCEb8EJ9OHZKI5k}Ver^&7&aXln8`eEsUt*yIclEGr? zr8{}*l-PE;mlwIxqmX7;rsYD|xvD9%^$JwUJ(fS(MjNmXx|dk3Dz?I_MFo0e zjD~#y^6)?{tn5;?Z7L{7Ehf|Nla#406Vf+0$X&U$8HePJ&|ZMOt8*7Ny3tcipw$Bx; zhk7`u=R_X(3WDCQts9{W92tz`+37wx`K;F3Y}bY$r9bq*#Ix^r>#c2!!}<*?flRKZ z`_}KpHTb|T4xekzr>WA0ORxUUCnhP`I*DrkVZvV#Hn-=)FdeewC3N?M=&|z`-w+FJqe{Z@!G&eyKf`PD*)|t9Q(KS$y<-@$nmXpxj-f8XGO`s z6-q|fRYMOY^n4>p)OSMbKk>i6aL7cL@dtzJyuwDs_c4hAp$jhV>FvzjWHr8@%WnS= zt_3lC&)XLXH4Nn|NcN>O2Qo(@B5Xp$V{XRM2CI1m1WG2E4%lZFHA|_%gthlPzS`if z9K?b77Xel11BQw}mRPrEC=Eve*YLEp#Ei@Ypkk%>YD=3%LnNTw*d0V5zHzQuS7Ex- zZI10?&SdknYy4EX##*e*&JrIlFYm{a5T&%HQ!+QuK5L!Ot6|rTYxK4Sq+)ZdXWq5% z35q@T^WDo20oU+e?pxzhNy1RDAR{$}a*#A(2ro)2GLo6ci^N;wV3Il_yOWcb{>}a+ zv`U;ZeyMR|Kb^uT%&JIDPd|Pl>Nu)rH376f23H@6QWJiqe#uUY&{Gg^V)<_gf-}(# zx-O{iNe*52?7TD`@C~|fkTi{QN6GT-?e@03*~gCqD|>L~`W=9sZDg%WhisfjvKyB+ zQJ)$mz~_<36}R7O`Y|whADOkhHz?ww?=cuJPfrQSKWfW(i)&?I`yg%tCR=em|1fa7 z*$wBPSOi&L!l|dMM>~HY0VRu5RZWdT>2;vc>V%<8y*=yI<36LMYLkPt13CCAst{?l z24@|=gBS)Y4* z2(gJrWx$u3ua0*}>W`Im3FOL#HX8GSge*`tp?qkX@}zo~8=16asS}w#$fg1L2GHQx zm>sg3;6%ldb6hIgg>mUoW*9~IH3^h;P~*)oa7+FicdozAVt9}nrc0n`kCR-tN2YB& zMWLxe;^w;=IARKa9WhmK-mEsGygWCuOui~Sr98W>mFahdwJ-kFaXSC+0K%hMKKZ>c zz!@{E1mAxN{Fog*R_MqVs9M-9y0|K*$irR@7z0p;v(;a|%gRA> z*^7`KD?3dBDpo*dzCt+Su!6~Dt{=*C1p*+XM=kav`i*Db{D*h)`<;@1RRKEHUus&t zCn==Jm>AvRayaXYteH-Ud^3bL0>BqU=5lfoq!$K}b<#i~Vswz3GS!;a<}v~dSdG3} zQAxn=J(RKB!f!jW16cj{;vK3ZRO0e@u*Mm_yy%RU%6{RYZ z^wksQkPXO{nVz-&Bvl=V>=&$39hQ}Rf`lI#{ypi zO@JMXyP;v(Kd>M#{f0GFjN1?O@@NUau0i(pnDa$ub(@}Sg7HfkX9l_~s<-=mPM^;z zFCZ`=o$3r!k0Ta3a9Y*<%4Rxl@$W{DOx@El_@ENA$T(asjnoX!E)x8u1_MqBLkQ$j z`Q2hf!C0;1W(Gu2-)9G)o$xTHq;p_Y^qQSUWw53+LKb4FPeO|NC(Ay=7;QR{vKS;pt!FkIu^L%#2*iEJXb(4p)8`hqODD z?g{FT*Z|`(K@%rz8twYXW(X?=om`oqiE-6S>UTE>A+Pp$D7)Qe=y9E$9pLpBGt{dt za-y#_qJ48@&B9CU2J9;dyzG7H86Jg+V&m)v-D7CN&Y^(k_)bso$R>sO+P#$GW=Xo_w5?^&2$~tVH?KVuJu>`>T;M>6U2Rc zZp|tX@cAyf5_B1H>`q~l~aj>6cBFpc+9!Fv(ZsLm9xhgnJL$G z?%eM&G4erD<~7%zcAi6U-m60|+SIb9uF$7fvP^D^WMkAV)hYm0}6-)SA$OJ(Kd**o1?1V8u7cuS~djWE_3te0W6qS0SOX&!cqLMW6ZVuspmC zh^wp>2t~Qkw`2j70v>~0DsKuRzsyQKAjA>9uQfkp{3|aHAzI*$;$qf$+|*wHsv4P% zkBwSGYpuJvUZDvJJv%p70QeGXLiMfrq6=UJO(5W|D;f5{QBc_XQww=}@oA}NGvQO@ zx7LSGX|zkMZ*Jyj7Mem^Kop`=0mVm_PpSP>hmbK4h{e?+I4 z?W|XK3(<9)0~t;yi7~}LJToqsT)OazYxX<0&MCYPbj0!l>bEjj*)EEiW1~#;H>RL= zR_l_!H_OvLW##7PevvLNbT+lN&Q8Q^oIv5B9hf6tZad-%*SqvCP{sPr){3AyZz`oN zrh5?uEqyOEIo-6QRj_#pC>y_7G%x(f72Er=0@8AFEKL6b9cXg>?GRpbW3Y`!WJ&Z{1A*C(QW!j}>1PwkNA5YYId|@?=!4&j>N8qBH!^}MPel?-JURN3CvoSGdsk6!K#?Fr@<_I0`^Iu zy}1z%ED_viE+igpFeYqdc2;+8>&usa5p-a}rEU9w&|;H|$aVwYP6z zsmsnQsi%fu4oO=*GxeiMg7EL_(5cWxyMAL3 z7(=@Jmg_v%1zuoX^S8GfOpd``udT+H(;NGhB1N|r>KAgfF1a~LN?QwxD!B8mrDc#| zhyMVwn;uqdDQa>jN4&}x*rOPa_=V7Arutz}yR*g-Wn0Ez6DadEz4DPRPMR_Y5hUHb z5Xw-CTq+jA~;PpKA2zC%(<^$*b|@+LrfOV>i=9 z?>KFt9ac5`Up=w?w@Xps?`tJxEUH8)r!br{7Mo8qw42T`%EjjU5U&$EKll4w$m0rE zS?w1uU!&1(lskqiT!{Z#kr=i=tZu`vdCj+ZJbv%Ddf9RGh^tg&WJ11GBIYWK8O`Oy zapsb)DqMz=c<<`L?Tr{K=#*3l);go23R<|h9bdI5Q!gx77f7RfXGNX1JgY-KO^e%K z$s71+hqo1r%ayhM`9y4dreJtxY6GmY7O9pLGM2v#ej1tDlKYuTywy8mzkgSS{)dJkN4D|rh76}Aw3zyRJc9RMFSQ$JEts8k$1fdZ zD3(93yWhn{SJ$L(h;_f2yH2s=Dk@Wt~`DS>-3`<^}pQ4?NQ z&wbr44usOU<<%Z?Z|9`z)a+Wn2ewj1)~zv8-xc>Z)^NCauku01r4(ZAvQm3pmQOA)$SF#6@?@JrUi+9kaWCB4;Cgmx_X-8GgPOpvPVrG{ zQZdj|T`m5=Z?h&!3e{g>-sA?u$FuV)Dio=hp_t6$oGceraC2iuj3hR~HnBQCu$BhP zjuC58GI-R)Yr~>obxTb!Y8!J;0&pU4YNPndnEXJS4<|Z3JpA_4Cr>7dv$b94O+0MC z6f&^<;KAUPUNymAta(%YYc8Zbx$*Dgj3g;tansWG#GtcbLCMMg?Ay05yLe?GD2_&> zDYKgy8RZJnwj*hj?(t0_*~;r$I>xqn8cD)N;+HD){Hm(*n_h#CnXo;aWQe&-mH+Zy~G>UYHkDCeHzUB1c-d3snrOpg~qw^{U3#(LF%sd~V`YM^^(u?=( zH=f1AEKo2(?z2(n(=TkbGV{v@A$R%XHxNZmu$<0qJ*PaeYGiM}`1j=Nxw17mSlW0p zXXSDU0M#qC13M|i=}r`wpMeQj1PqE)I?P$%Ghd--UiVUN%9jpDnt7st{#bbM>V$?>g44`^pli^a#KrwC%dYS$ zOE!N-E5>VNn)*^i(QDQBx3>!mc`h$3G#B-4yB%OUsI6p~k!#Wx+HALr?y`}IZuS-T z!nYX5=(9l@Vt8=>@~$vw&*b6bGopyag}cua7w##Fa-Z#;`H1WZI@xdjU4N6V>_VuC z%454!{Z-(jpmFQrgmh=X^SY&}(-_o|L=muj=8u*)yY)ICB0M&ubiil8@z@k{T)9{^ zw=JY7hPYJH0*5{udU$vsQ>0^^$Rc3)K25DrTdB87D(5)4y{Ld=MsH&UjNU8U*4AqI z`L5xR3y1ezVcS6k3rnl%=koIJpq&cWS!hsNrCrx|>&*oX*L~cuF_7lLjGOkj=M&%P z&I@X4hOnb&f~4@%5_s>b^E?vVH=qeQr?4=J%i@7$PV#%LJ&KAwZl=h0b0wTti$dmM z5?9yONH93`fkW}>e_x2%^`}AwRC7(4)2-mgOdfNJv>j}!Lp?0a%;jV-w9L0hn%yBj z>*Lcq%9{6_I_112sF3~fA5NVPk_Kpklq&x-4R!OSm^ zoxA}fmb??W`p79IKjt+d0KQ0wXdGJ*ZD`e|lUL3aHF^X2DL6V3z4B{9MPE+`{k4J%w@ILg*I6cyTELvQsV zDsLe-Y2I(gGuZzpnQUm+U7}9vcP&Cj8ROPd4;m#fDXhiHa^27i9&uD{X!}n2HkokH zex66^Df{6pwI+w{9U;hZwjPX+OavM^=)*ynvNOf!R{+f*g(fZ);9C{A+FBq=Zs=*~ zX(=crmP$40IS3b{eSHnttvcnr;|daw1y!d=&*PgH$|>0(mH6y4r#F&(m0aYIl<2v{ zGpnf*$u+B{(i%XZfwpSnoqcXf`B+k`_zoJ(!DO$a)yqGw73h1nIgh5>hFAAzW!=;M z3o$@r-`esO9gR>i{9qFT3;Auqo$MqtoPxbxZuh%i)Q9(90}2is`!=$06?#u&*nJlH zVWD`_`%N=Nrx(L0A`6Sas`u|7u_tEc;0)*e7E)3i=JE`@*XA8;K5qq!SS&p-LDw`> zCilF7wi_|V4G@n#dcA|2V#PHBhKF5gl2+5T)6BdAVtR6Na;$Hovrq-NFYnR!ZoSrc z0{@+rJS{FJ+hJgOD+N>-_|3Wy_H&w=&E`!+_PTENaq6ov@l_6n7f2+#8`{jmf2FuN zT3XpOF)>!!=k3<^mhm=xV3ObB=yQR>hMb(7m92)t;t6^4Ib#6f%E)o0_QXCWnXa=k z+2sIEOucvt2j(N3o)MOBFE=b7s`hQH$AFw&KTa3py?Lr{XQA-WFpDXgcxz7x=XUjQ z-62h>+j{OLrs!ctMYE>Q0p266b%%yjps^I9y`H0^W3VJ`>8F}uk-Z6im2?WGVVCxM z>E{lqG_o@odXG}X$!vTo;=SHJ!3*hQRKL}lC>;~+_BroeuBP&49wE;kGO&{)jnY!5 zIu+rmefvlA>AF}Y(^<(dj56dr$a;3&<}bzmrHRNoRzAskl%hhn9`Cm6`A|&^g_-jU z_o{I^QDI?1*Xk@$+v5r6_5_}CxM9j#`p6?Md z&97IYa`orICF!4R1wHRu7p|nt(Qr?KjsdGNQEtN*jP=-#+FWh)S!v}QM-ekIw>$gY zoV!lLtl4a%2f3(I>CmBN$SQ6b@ny#&$=%5*8}N+o+Fznq|0+ub+xE)J$m=l1WwLLr z7uM#=^*Kuxx)ohe^9H)#xbdul{MW2?qlf%fG7cxD-vbgJCV5Z7&?8+HhQo(D0hY_} znZwl)OX20P|7g^O-4mXkKGFwsiVG-1_wGrp%@i5VEF)^JZ%59FToSsacr1w9c5rAg z6YOUDJo~L>wDZsPV4D+le!6*a_*Di_5M z8rrCPuvvM;&z~!8{Px2Ys}_sKAR9`;>Ep*DVAJ#z2fW7P`LicuXJ59DPc2{HanCne zp@<{3kCAa5yK`rSS585}>zcDLbHN}_&)~u9%*-I@8^{4j84<<^*^0aWcqr>SfM%7EFolJ=l9`!A>_=0%RKSJW z8)n42*5#MFW|u(Fw}G_SF0{xnAGb4yccq+=cW^_)DrFWlv7Eq9!wm7w_--Ttj_L09 z{@JW)O>L?c?<_DV?Z51|*k%D!7TmFdl_U3MJqIe6mR2I#Cp*F>L4|Kl&~KaTD-gn9 zrrFiwq;$14V=h6i!f*7U%?*h2j%P<=g|95ZPqCRhJ zym-L|e2Pfrc0ZMu`;u!uW;w~hdTz!5NVo~1@usHwTh~0x?C*HyTWZLw*VLSc?LorY zG!7MBx3GBUcju!H=z2|qrs!KFi;g`m9=;1_oVAzXQ|6bm4(=)@SMDc=b!O=EmVU_y zk5!^9j}AkH7h0+~q~f))5lB1DVw#KhbMnEDTl-&TFyhlW8LSoKq3KH}zVZk)Q>u*eu z)#gMm#mpQI60;?zemxTaq)*rCuOh}@?u^KVJEx>wMqO2Fx-D2mU)7#_DWliqLURqlgmZ^vdj~!#sQk6gJuN+R#6dFae zu@lntHIBD8K1nLrWMyS7hDv+3t6U8q9*&4Ps{^8gM8wE$@yl;U=EpOSR0r~SHFK!6 z!K%`Q6PFSvcB)q0UfCZ!E+w1hWCn)rRh&Y2iwT~p^)-E%*;KHa{LE3EO}?L4HQ4LI zxJwmqCBu)t<#4q6R33lg%H1q_nGCR?SA%ITM$>*rVg zIN))p&up4fXv>eCeMhjhP(DEiNh>WvXI4|aHS5T^LsxOtM~}HR>O%X0Ak%)BhkWAH zSQp-bkRr=<<}>AP7I>@t>syhyPEe+d89AWt+)oW;RPT8I^_ogsMEx642zI06bShkO4hCL*eaGJ-z_Go`S5+bJd(a4v8^+PCqFF;qi(!P zG>ha@F?>s=?umf3+Q!bieTN0VjB+)UVFF;(Q3k1 zos1I$nlMtMvvXFO*wvL~!KXJ3`cWY~aKk_tG96(({nJq3$3MSh>ZNBC4qR4o`XHo` z?M0{I0|*c+84~DFNjcstw|&+){rrVN$XR506G>f9a^635aCU27f312P1ys7$;MbQ^ z+D&G2z$Qk=c|%RudLntmQKHzX-O{ehQ$nF00s?qW*sS@Q{9c$tdw&@l%08+dYDq05 zh^-{JbQ%N>#w=b8fze^<5GRe%Nq)4NTYDl5i_A#^vg^~z4@x=xmW#oF#ng)?$vE=` zdtLdati?w@U|KdQ2ZizmDlCFi(9qsc`jduaZBw=Eb;FKwCKKt|Bs+vZI2HXNWW1Xwml zr_^6e%Dbm{>;xxE=0y&lV$}Zj!vot30aH^`#&$r|$Zid87c8VJJ`M<=e5&-AF2T<^ zfgx6@CKTBwyME+LQhx{=52*yLQ>n;YD8q8^klezY9Nb0*UFaK?RvN>Cv$jR0NkjYh zQP8sV%mx9YdsXkF>(}5@hYuVM(VdBod2w1+?aYvT-zz1+{L{1F zT;vg*_2=c~i+mmP4$YIz`c~rWe?^)C%y)^(KW@3;djXc2gQEY@yGMPB#Gh_>QrRp< zK9u86@34wv7CuOdiR*q`b!Z3cqaWXI-*k12qkjAGy)$7=HhJ@0 z!5Q%QSeZ%MNl&@BP}{`w<|3yH+B-u?q@<)o4@Js%5Nfg)H`N|xVRp|hxcB_I6!K#2 zg4%hE(3P+lBG3!T5GL}zL$Tv_IEc2mD*X|{I>hi$Ne7tSggC*mOM6(uIs_$Z%40nn zJKN%E%!W$r6|Znp%<_C71#xaX9Pw61gf_jpB4s`k9ohRyw|AZ2Wr;Kb} zQ(e~DncoMRHFb$W)uE6VhMr0mdEhwBG{0BWXQBARhYywK_e`8+5)aO(**DRHw&2aP z(Q-BoQBqznsl3M|$~yyP>X$C$P)YQew6Gf}Z*TF~Xl8bmfK3%1?vb03(MjZpmH2u> zs^=}#n2LYfLK@E3YdNwoG&N9|^g``0p?ECLfzYliPv|Au( zbl1_*`E}ND^vYJ~yoz}+aqzF_S{=`{Pl#K-{c^u9S_its}#ke7F}bO2on>*vrm0fsIlNV%!v zZCp#1m{BS=#U7WsF7RGiik=o0E;=;3CbxA1iu_w~%go1*yJm%sf%CrWHkQQZhW5Mq zXwGNi-mI#sI|YFI{kWCz;1e9oo%gr?-y_>F&!Ndic1vOG>*6pa*vP()dgQ{ zd%S0UCCP#ChCm?LZ6|3`_t(>&2bQ=`YP6Z3w@pPdyB@ZLUMs|r;_R&5a-&QeU zyXjhVx9QLGzQ?5J+0VT=Eo|guZpr6)H?P}b7u~`e7M9a#Pd+cIQWyRIz_pDrqSb#+ z#0%4$?0ExQw*X%;s<0 z=k>gE=!5Y_YRNH(#E>h#t`6d}UYpY+X-awB$B#|^f@{$?beHMg4KH+p z3WtuaP7jQ>U>BX-1njjC)Ve-69A{C*vdfJf}x3T z>(kkS<%d^QO5C69VXtp)p3jO zo_X;8JMtSV!rP0JR>n;396!NR18xx2+a+X2zjwfSn2}Y&5#~FuN`L?ML&nAg;C%17 zcTtq#N3PpLtpo0>3!&fp`qojO($GolZ8Bd;a}uj@uA!?+decH*{CBZoijFbugg&%Z zEuV{Kw!bfGGCXNd9Hg0&&F*BPpSsz+mmVFmwDwViO#KW*6VqTAhzU*~b`~r5M3u|w ze>69X7oXeDF8u?0&c15M8%+TuBnhKO>X>+bG0EO-20&&}N<_V^GiRl`ev`_V!Oyti zPNS8dxrODMP&cPE6v%o1y;R8ItMKSiZF3cVdb$nruV0|=dYQz=hO@8;-QZWLwN=9R zhRjhk;D3Ybv7*~L0O&Mywj`(b`H1>!89p5YgsBmby;d=vR zBP!VN2L&Q$gJlsy1ENbkKUCdWaoC{EE46_P^Hi!V%V%GwrlykR5bt}szNrB-%sG5t|Kx1L_wU6Zh14TSCTMJL zdW6}42rQ6R)D)d5?Lf#^q*_0G_z+7dsH#$2_VnhE^{)f<&Dma0mq~S!Stj_c6*S6= z8~fM=O-;On+NNZpLDI9O#T0TS4$Kk{DWDo*s_~vx{V+2i-=s=so;IxB=eq62KW5GU zk0)*4_;hYF?Oj;Emk~0!r8exeM+aTnbu&zU`p8HVTc^;|z(7{ALAPWbTT+6#agqer zQ1o!V{Z{OeiRVB6tvEhV$TMhbZuu_9Hem;obMfSf{^R{tC|Bl(>$>d`n!um6E$43Alo5~X&!pAJ%ecESjoEv$v$hBf2 z)4eyEOT^Xx3;khNEIeT&bR5d)OZ68KRIRJxzV7{83V}s8_U$voTILs&4_$!q zS$(3l_dmd~y8LYDb5qK5MZ;eI&5ok5u$hPhoJ5v3F@Gopm%r#JPEXO%)h(40 zz=tR#jLFE#gq2rqD88(clare5&^FqN5p&B)k+pQCKDNW(pABT>-~2gzpKCjkD41K>eW`iv}7x_IyDu`yj;wj%q6<-Vi=o{acRG2K)>HIBeG5$s#bFlJr{Ei z*L=522bulw_$?B<8l1W7?iXfn!>-Hyf6m(kvLM}Zqlzs9&-?BKLv%8QuvS@<<;Y2L zb~bIm1VGy$i48!kTTV`;P2DmIJlti}-4W>-?@3GpUTQ9ujS;Y4?j=B>QcyN?dwZBd z5=qAFa8&+Y9DuTuf}7=BI^Op``5Zu5BUI%;%koYc@t^GLS`-LrUL7Ck=!!F{GAd@T zLWHaX{37D)mpId8Lqoj+b>&{GU)c?^HoT)&&p)M;5YR}xd=-%drf0Myisjm+(fYRHQrAsf=2roLMpfGJ6EQR__zg7fwL*-Lpf zV!5O|>sC@%7dP~c!Kjjn?r}36P$ob>v5&$~!1u|W#=b*O1L@AIY|aD=x()PssDuLr znI$j3Y#TgFfA|p59OL;j>z>px4Jj3pvDZ^Bo(sH&FmKu=p9+1zu2Vdj564#8VG??= z_pFrcW>8&^+_%G<8}Fi~lIE+X8D0Wn-BC^0PT=qvAu;^*mlhnxNNqOCBJ$Mx0r)|V zPKm~1K5v+i=b=h;YYrfYtaQ&FhGBnM>FGK!c^LIU{pYK_*PjHP-rRh;B5b^jUYWF# z8qX6Rou3y3A`7;~WDJX`t&lz%4dMk^cro&`YTbnZ^^$OzNj|1Rt+!N9%5)Kp5`3A)q2ZG+kLyA!0M~*Y;As zkErw41@k5Zenc-W26;~jHlym7MuEDr5h7U}6lkT8jMMxY`#=7KzF5KzMO1dJtzi?` z=x>v*xK6}$e~73*2?$~5T5#0K$4?Q*1w`nOAhp^QE#j1VMxnm0P8ka4hij{SUhyW9 z1L4JBe4$945pK3!b3$%@0tZSNSp3;3^Lbv&`d{D&=uvZY7I*a)qBN-alA$${Te$9p-xI+#`9aw) zKfMpnh{X^*pI4bxjAZo~(~9=7V%o~w=l3Wy56|8s@(9rkU+bmhU5UH>Vk$!76MmM_ zC;6FzCS`3|%gHSueA(uQ0ODg&*@Y~tlxA>r#AO9PYNGQ`N^Gm(jC@`E?-`#;1bUu1YviNo`YQn*BbRCd)uFd|P6 zg-0Fy>#r70j_rKf!h{2IHUkM|kZ+IBGtU+l%;o;-g&mBfRS2KR2kIvai&0g!@Z@h- z1B}g^q|6iHk7-os+MTMckzw-!!g#3JM545x(+{DY&B03Zg83;Yj%>bhA0VL$Mz0<@ zBIWgEU2F|`7|GPFas0fFnVG|c^n83#PbJ_K0xfTvX*EOvKEC#Fi-sOI{#Fi1Zv)+D z$nTisXkS|}4?L$4yLh2A<;k7Ib?wrbq>@}ns;$%uMJ?R5P z+vX^G&3&5I^AoC6tE8=>`>AP0dH8!n*iAqL6!XC=1W{7v$^x4PA(r*A3(27?>&d#O z3Ie9DPzPvA1Zwqg;6Hhfzx?}4ur@xpF0sAAL=dlNbnWkz+-w(a#x)JR2DO-!YsHx} zXS|0aqbM!s2trTXv9=`Q6739B)F{Cen2Gv+8IOlT)YY z85dB}@BfBJ^Kh<6kh%P=ppoNqh`-Ty80nHTxf{U8y3P6Bym6<^!|x`eBW$7Q#4 z&cBpb+_g=Qy#k%m6Lyd=iTHFLLepvpqY)4Tyld)ezYPpD&$RtsE|4clA4%RDJp&ud zV;?tU9NbWpHlp%1B zHZb|Q@@M2sSxg@<7WXxqiM>%W-r?jN+k&eo#xLj1@9bA*s68##Gas(UtCVsi&3AD6-T4WaG{uc&V zwa-;jk*I&4Vwm8gw}!R^#{KsdDj2-{Et5bO?+AJWt9Z;KhJ$e&cR}f8T2bMv7EMKsXrik)3V`oV*~kchCgj}8ByE$ei= zTKr_@L$q#s*hDnrZ|A3q&YR96G1}(Qany7V)DbU;rt|Xl>i;z+oZa-{fSpX6+{;?0`JR z97a1a?+J8>9Pk4_D~R4-1Z^4bT)j#a71=v49L~pb_qB~odIXerwYTR|^U0L7>1TI2 z=rt;lTZ#GbqYg7acQkJD9{N)TIv}|R9sF@TkQW_Tls&||JsHTaiwA-K=B5o723Po`c}$t zd_LoO=5YaZT%ZY3hbCwZLjchFaFQKgx*9=P2q`L_NV_T=>YF%q88^hWA48IyroTAaoqKfWl(gQEKC;%BuOGF?^gsyG#AHQe$R%3|% zRs@EDi`POPq(=c{T*R1y%{EDT|KRTeKP*EbYOW;@z=mSKM>D~pp)sI{4Qw>7Q81l9 zSdw(R_js?(x(p&~ouLo#M`H15IY~^?hc-K}2+d-KagStbe;#@!=xgM>C)pdCeyzhl znj*`ZKa}fWSRw~i74VnDKd&xa5H{;?(*gS&ATAk)A>fiBf+zE9s-emUbor--z!=l7 z2%SzkcXC~*Z4FpVv2eo^*MVD-T41wL=4g{}lnL7RbDN@@XHWe}0HssB$bGaUu1@t+I*a5xIP zwxw(und8)Ms}pOGQFS?}Mhr3IMR`_a-L#g60uFG|C@KU=dR{4K7qbfBiPp?3M`bm| zcZ#9;oW>cM)BqszT>hF8yHgD z&bN0ULv?ec=Zp|?`C<%o19UCjGiUs3<+wl!W#eG!^9*TDe3hp1>e+uHlzrP49{xbNYs4QgO zd@au-nJ5s8SxTwD2|-iG7+R@n`R9x=;wRT%Va3u?r89S6?#H~v6C}_wtmB@;$ZA5) zatHS0o(wo2u=eMRPxCmOjguKP0{>a7M=pgnl`QDaZ;%A_8k|-Bq2KjNcgp@96_g}J z?3VK}`y+18{KlY6=2xGxy9H08Vv;rGpfkO|RXd2Gpl7ifYC&OH?Tfmn26UArb6DKA zuSpT7v0YcBCxZ;RkN!*f(!lHR!RcdG6dF5#;>Woz)Cif!L76Am!|==BXnY^sIin6= zIu~Z}i|v0d7}zELXE}#BK^-a&yzfUe1$qE=3ko9 z{KX)6ots!TKK*lF2{|vKN>tPb&H+>)y{&UOhwUD_E@0)3S4&6*2VbS4xnXmr0sgaD zex{Ke8llM~IU&V5b@<1LMGUR}PbC_Hd6^%Kmeq)sef=gYY%l*d%|=KF+l-$zAPJh^ zA`&>=744<2r=gaKe32dW`zp@Z{b*9AWErS3u=D`X0A0uPRQ1*<*hiov-M@w4U(ymC z6j%NFGH8Jhq*5LO3F_M8^O*(z_Gz7jG?6i{c56*b^0G%qOUd%RaE5c~SSka=64xgC zI^nx~Z7q0N*5P;hqXhWKGEt!XUuHaDe!ek*M)A_8#Pt$1D^?XQmC`l@o}JG5uf+~} zAN)%lND_mUnNH=)FcM&39txtR8YPqHa*v8WD+~!#1FsH!vVV7Rl~=qzn3+e_ohf3H zbf<@7W)r*mY%DB1Xa1w%cfSPFXqjHJy7>!6@E4ZX|0T_mpjDFjlXQl>>@OL_+UiW2 zgF=~&K8!LXIi<|?!%!+8TuWZ7#5<@0jtA9X6Qn;G)BW3zqM6~53_{5Y$AvBltKrjo zp9rBFA5A>TBms0J^VlRU$XJfQfkAJ?UkCA(k{9(m@vH`BBW3y#JAuGf8( zdL_2Z9k?G{#KBVV{`k?FVHX#8#P_#}4*gmIfh3U(;OJw^mT>)Z7xa)02q}pYTQ?hT z5hVGgL6HAAzx>H;++IXZ=2MQ*DsaL%M=~v*Ch4mLg@r$)NsmdEK3~w5(Ao@xD+A>$ zJ|j+MOjwOKYrkAQ7S{QT1xM!=eptN-08e8M2PgJUg4n6e!m#y+i}h4?m+bR*no34S z6V#WWw;{qVKwC`io*4?!e@(5)>)I*T{@W6^ZJ7SlBOSB2A$GRWj@4peQ?<|7e9E>T zF;RH543=J(f7Cj**1e!VT7%7N1~EpxqWk{$Cb7zD>%ics5?-~JRKX56ez#5*+nI!{ z=D=rQyQs<*x2Pgz$=Oaxmn7eRUO73JwA;DovXo5XZDQ}gE$JJ`Y00_8GFa_L#8z29 z*&tNf+$m(MON;9d!If2~YlM;HOcsbH;-~PD1^@U;%;BsCazh8xIj3%2I8=UfcAhLZ z_lGJupcULDWA0dK<^(yRbbDdf71Lvn+maNqvF+{MeRV#EP(iMw1Fx(uWP;ZP34*TV zKFraR(l#@X1C!=2;IQ{UP4?-X{B~QcmP0zKln<$=3BPINBt-1@M;!$c#E2kV##7)GtdbKgHtprl9F2Ksf;HU_STpQqV~lP@;$4$^z9uP+oVx z-j(W^2!b+0nf{O=962=^CpcIvnjODzE^#NykJ-9eHTBEj>d3Oq>pv1fkddAPa;^9& z0B;jt%6jZe^?fk|1hWOt*)`uxu>#yRX6D+udQTITZ&jj3IsN+PD`xCI#cqwkjb+M4Grt-y>oRuEioG~e+zV~A6s;$n4Q}^J5nm@ z{9|e!Mj5FDsNxOGtkNU`=n}NoBR-;>|W75RC|0UFg2k;BB7cL!{+PlQ- zL3Nt&fPYzwTp`KVre)889bzccs~4|zul+}eqe1o3u^5zHNU4OTrV~^gQN`VP?T8#} z>SXIu5k_r>(6QJHOROAD?TuY`?XQPktSKP;RovRxwTgmmyZ$y=OvIZ?tbp~L1K5iI zHmZfQv7rI?P6M8V2!Z$s;Ht80ef#{_cbRi@laT=&{g<9|?_WZJs!t1QCfOX=O}1v7 zA7ZKR&n|>1;#cCII#7nd^d~->*BB-LXS90d3han)lvc$oMRLrHWUb9+@Z{*(y!xoR z{zlA{m76OJK?>yQsD^`(sL)#LbM>>pY8$0U^~d5GC30sn8YKl1Hv^zE#%WY-9|oMo zV7(Oi7qEu+s{wBk*xMVQJ*(QfqAN1M|JlAg>GNL;_=sM>;&~)P+j7ju9F2HAcuN?` zmMiB*JNf}ImX8e0+@A-ilW5z1UjrT0a z$l4?y_(s4_wKNN=E?>DL3k%Py%ht2ftsjVT_eJ_0?_20pED0fB?qk~tc{;fu>4{QE zb%3~y9~kBrZ&)vOGn~6x=;ihf|AM$islm#=gufj%t!y*F?6j^sw0BuQsLpqzCi}6d zqtK1!$InrjcRgIU--uPYqHbPGS24)?#DdlcwRfrmAw*`?**E zH=hvPss=kkb>6p))hmCwWCDj&9wrSnGrZ+&zC7Dg2T{$(car!#9Fi|yx_I`{;1-ZH z5X37qbQfg_WYg7h|E6^Dk$~(jYmD*Et^Pq*8`>ce% zMyOO>op`Yhr<1!oNOWRFC#U9r{J7)pUP0z_hQPq7;6KgFET26|r(}%H&BrKDIH6pf zO6$kW$|k;_OmA+vsFrnM^ecxTv%K^MWvehGn5a+SKaBySb-nVEiheEc#}B(rC+4SD zmpULOZLMEs@m{_%o(8VN#D5U!C}VTe zbG7QkrwOkUsn7p zlNGavf-$0{sQy{V?9x_mXF+R9)#|@8_zQgrra+TZvV0u|_PD+&UH6A8-%a}) znL~jMYY8jJcnr#x?QLDEyI(|UMdPt=Dhb%wSe2#BVgd1SaMTi7+7;@T)-Ou|ZBV28 z-unHD30go421zfF^+gpGDen_V1s-b^XwbH{MuAjeP*61>H9|)!fXeFr{(+^^)A+mh zzEV)!!nD3~kRl-jBG3~o4m!3&*P{r2i|6SaAG3c2G3L!9EETfG7=hRNl?`LeQ5{dw z%w#RPU>*lWaxU$uHP6(CL@0hvkW&(V&*}M5h^wxj$~@}K(onti=1Mc0-8Kibz~2i! z@Ug=qX-@>gdU)Fk5D91GqCk&!G$?R*dU+=3L8sB+F9|r9%OwF<*Bv%&zM8Re@a85F zXq$)n^iyU2200rxU1@(mfQ^Ms*-E>TikezPw0>$`N!=BW#)0lxx@&+{t_pVVfBkxy zl&HACXAclxuio2b5ff!5pa zj6*`hG#r%tp)Bx^ACKeD!Z_GL@&MVJQuc~x3OS`51uAiAgEOm9U^JhxP^2@Ck97Po zj>55d|@3%W4;URoyBzI`#e4T*F?qyuQr9EDCPkX|RfqkdNg(B`_UU|6!e_2`a z7*!|NMlRT_P-?v8wkAJ*kKW!sASl54>*rI8jqW$IHDtW?681A!sHQ&K|72(&Vvtg~ zD1TTPh^N=2dEx*`hBs9tG}5|CLN#-yN3Z6n0OXK#6}t5W@j zF@6yCy!icsKkUNKx;|J{-(HeLZbnuHgMbXo{?Z>`rHw(N-9xX#3spmJ*7tnUW=Ph? zY9%@0#Hf6h65+de8H5$0!fi>GXX+oY$q0|}R%8>#lmj9`;VoG+dDr(+1$gp}Xv|Zc z_IQmPSYe_L-QjDU-Fj13sL=}tZ~aWpn=5qc6Vw)_vesV5aGxz3!`PJI^Fv!eBRvgr zmJ6S`gH2UTW}{c?`f}E(1znwulqv$B@rm+a#wrVc{{B4lPf3(KGDc5p@axx43|7_% z4PIX7s&QAzq1bs;L0*5jEvI$R0&PJt3Pl`XZx|$peq;KpYDV%GO7-F{#v4w`d1e^|Ut9 z>eDYB(w7P2^BT~c;0Ot1Ve72XZI-N*&>fj3(N&0A-3>#_k;+ioM53TrS!6-@pWeHD zxrl>UO6{yN0gC;2g!pmFpZk74r_=pb%%m2H&tG6#Z-FHyD zVBbS$F_3b{!?s~XOM623hvtZ>e6ZRxG1UjQ>{~jtcwk+4p%YHhO3x8H&~ym(RhjI% ze~s4XAhK@n4Lxg$0&cRY!+Lr$>j{&`f5D8=m{R&*-&3R7VlD?gbKTr25$A{-KIrrEA{P#;}jKDUvET<%h6oYc)3}L??!-$@Mk}4yPRBpI8>ekSAM(+eE&fC zu#{oh)ZN3Df+hBF-E@N{3_KnBwbldY*<-3zgzlS>ZtEB6szG%JGw2^57W2cwhxpR~ z#$bAF#A?6SA{Ptz%re!Soigrvj>h}>;dnp`p3qSB=oP8IB89#VxQiP%8Q`XmtIEju z@Bl8aP=MRan&E+~F1zUb*e7r`!1Zr;<{L?W5$)c_mE$Hu{E1w7w;0`?xgNn=2E<1>dX)$*h z+L0J-3kmnjEt)9YU23=p4me{Y9m$8`f)g*RJiiwM}aK+ zu>61;Ppk?D4#9GY4*DYCOKRaSZAPMeP4Hp2p@oIg6q~BL7CSu!6!C~vB zi3=$cJPGgn6W;UOQcaN8S>A53H&h7ykjv$6Fi^H`z&~u;zft?^J&8n_p*qF*HiAK=XU@crOl)EJv8kH3-xUeIAD9fP`lX5Xll474LtQ(vvNEK@(8|b)!XBxn~ z2PZx14@4Ak=7)Jb9B|Zx<5Smypt%l1>Ww6@dPcRVc0${UDk)8jzUJKzy?Fx`+x;72 z_O53;jwpr45w2(x`GH1bpRI|W4!a6%y#CNXenkqCQMsEi*zmnjp?<#{{4X3~Pr@Qv zU-)xgCMt%$RrS6^`q!@))j!6yZ|t=%JNT~de)<~u@r7eo4>wB{dA0Mz(a~!rrW}e; zX1)jfNFX3hv%wTypka~g)^K{=X=575Z=q6!HnT|9XVAq_KPhSr&nCc#U$jIh_q5hl zE6SyqxyGCjWO1Yu6f?K32AHrC2hE~LDhtBTl`tkfNY)M&;orCCuN(;)GN}$FUSF_u7Jgz>HQACej~EpsL6iy#h8=h*~jC$Ctti{<6?7f zldCx@XUNKdwzql=*cMJ~%RTH!=Fy{6J+7Qpfx{F>I;^gEgmjyl&TkLB;HR72wnZL# zKonH+N-6LC)5XnU?d$uvwf9CHtR?sw>y{fd7Ln6p3F{J4y)h+4~6%Nd= zqt}=1h;g7z=h6rLiFqesv-@RYXY)0js~_tdOQ1((_-LW$j+4%mV#SR{SsynL18KUE_Gf)Av7K)hY7fR`WK@7t z0__M`D?&~1<%-CT5Su6N!^}Zn@eiB3Nf_f#%t0Dv{lZCyR8$>#7TCZ_fcZodzdZsr%`WmnDCp`s>l z?TH@vB8Qh`ps{p~k>Pxow~yrpLYR0FUPj7_f(yE|?Cb>;z?#u!D%XB4Yxs&+aR0JT zn4Lo5nWK{y+2|E_x{rcNrg+uQm*h-J8l3Wx^f|s1^7In|x3=dpx158w&46xvjh<5} zkt$xb;}x7T8%$Wk#;2)EqYc1c>?B2FarAyia^TC^qT4t+e2E()Th>&ZB~#osCNWbY z6;^xQwrpG+Fb&v9hT-8ow$R5NzXvCu9R(W98!gByJqLq;jaP zzw$YIo!Y0vtzPn8=0O{`UnWtU$PV^&Rbr%@R##o?(VP3{0+4NyD0y&#w36v>ORePB zJ@Yh=1VYd{+jE*HBI*@1k>E_VJ?QT5cWA}8p{b6MXBu*xPt-{iL>GUWJhRyTioc64 zA~S@D01F!SJsQ~fmrBeEX+z6`Gkw*IT-J7WzS`~4Aw)!jgIYPmYr3VCMG6%2NH8w7 z`x1&@jOvoRhrHVMr(QGF_n=WBJOoF+Wp)#v7Q+?t{2ZQ-RC^6gJHmmP4`C*~?(LUt z#YU%SY3ZTn_dBf)Z4oY-myU5)FgUgFByO<)n8L(J zT>^t3^EegjoU?>UBxj@2Kq~*{0?4Aka8GXkr}xWo#L5n@J($##hpsv^N8_4i?xO`~ zF7(e|O-bS^=`Nuc8G*;ulLUJHDr>+BE)T~!weTM=%u!c)?1uzCdq!`a=IQAh8%vJ1 zQ!QJuu^F6H!!C3YkE`jkrj4*mhtqs30ecey3> zfV4r0`&na^zb?hHCS>P5caez`#;}=~mzI`hE%iqU2oAGLL{?mspg0?CAT@X4qf6$*f#OaH;=jK!>-pe#e zOd-Ne?e*ZkgEP=+@u9=7tDA&1n}75}q(~F#2z6;8j8gvwpt(2q;i}F*JoP^h=GFi4 zt3&_jbCinvNM~snXxzH&(7Lgghbez{NM|+VES;)iBDt2xO6XLr&&JNFp>0(J8SK2} zTeW@}`q&hNq$YOH(%VT#PEHQ!>Gjgn-EJJv=;1$er6=F#du(jvqH7F#cuvXBM%mCV z1l(K2!3_o(X0NXYi-&TYU`>aw11q2B%!kTMdPB*KN2&RL@kaOkc@%UYGCtSAJ>1>s zXX(lSp7FizW?+Vibn39g(ZKas1*GdqzZpNjKyGR2=n6g~;jgGv!@*y1eV#()p?c#C5C+xmcA9YY zfQuLEC%Hy=vJLbzjFc2je?Pm#AjSmG49oB>E8%2e%F{^aqltk>pwh&s+37LC1h5~hXVt4@V& zABI+UsH#@V49U28Si>Ia?J7j$Hh<+}`}M!(c0AR!{xi7HjL`o)nHSDJGUR8oRJWHP zpUnr(toFLW)nQ)IcK@1Kx&2<%A0NDbff*f7=q#wawiaYme(s*u>s7gX58Gkxn(sBP zy!DGyaze1Fp} z`e2#ca3HMC7dY7IJzr6}3PPeMC~QIB59aHZr4Bf<11a~L`UylzLYnLUV z)YNYFA1-p+n7({M6dDRJ-dnsxtJoL_K=oxIa9<2?7+uqiYggWX6? zQWK5sOFG^{V1!&Y9#h(IY_@I`vqwEgoAAAG#WR*0F5Tz71;1vX42HYoUTS4!ynwM? zRfuDw-b2~77~77YWF_03GOt2&)9M3oWe=UF4(Q~V#*)&uG_}`lvw>ODIP3Fz6#glK zoCQ9WSc0EP-x~z74Z@V6Ej#O#atG)QU&G@!k|8Z**Gtp-f8G^y{q^9uPq6+I2(R{Q zQq2?+y{c)LyEVVZvT9=L3j!tUFVr>~;ABFkevcTT>4y1ei+F%(I@>F^K_%bccw zUmc$)Eq!hU>777$RMd;L=^@nC4Q}=n1vIW1&ObDyb#9^lVdVcJf{T_sLlvZ$o3P;w z7vX}ZJbCoT+Y~7t$N7QJnq%a%*S#dfv6_c_YyBC_BuhoL)oRK*cPl0s8}Dn}cC`b$ z*a-jHEG`^KPT$ie@e~BKdxYo@g>N3k#&;#&xcCJ|w$|9O4t#nO4CXEaGXZvdR3mX4vZZ z{6=g^;-rT-uc%ebTB+N6>X9rSr2T=cF7?2xmfgGxtfBLdLI~X?rz*=RXPl!=dX{N5 z2MeDAO1#)s;>8wBJ!-byHAQ?YTo~iRN*Xpj;t|w{S!pL+1EoMoMbT`rYPZ~M)Qf=r z1@WB5jMqv^5v${v8qxZTfPZ;7wN*7efDUe3&fkkx$l-q=RN&rY7&Wn`qAr!d)-E@{ zh0wfz4i$fW_f|-v!xAlRhZP1c{9H+VpNC}F<5sgR_%)-waWhQi3_1v5((?_LU4C}& zx#j4_hIxS@77DCAWXK71W(NZ-JOOEVT9JcN-=pZXju<{s;S2zH|2x26mnSy~#6kj1 z5~;48c^oL3DD3_=dv)jfwH0XzFDcDxJ4;{VJGdg?Z9vxfbM7NxUvscN`$X3H6ATp- zWv_!rNa6fUm!gvPI@Vou@j|KPIuuJWUgU!o#^|XENB4dI6+iR=|73b)J+l6SU-4hbh-8~p zovJF;=s~jU#%MkX%*Yc8x3Liw%d6Fkd?JGGh9+Wm71k)W?Jlg3vZ2qu6#w9G>%0?2 zslTjaac3#`lGn}2hm4&LsX&gNl{sA&(zPjkoDf>a==TJIv-N{oK$8WG=fpOCZXmX zObtK9JZIn&5YN*LPaB@t&{q=u5NVaj9)GTJ9{0nf?1pYk*E#H@=n^GHSe#a7s_VH) z>dJ~mWl^g>;AG@EM*z^2w}yAjtH_x&rfe7rxoUvGDIgfX67}lEd5;8w;7$B@nr@Im zEo5K~S7mSEk(I0h|XuzvH5^ZPzA%u`oD?3uVC>w}{< z><{gs{m`-&)%EdM&gSliL6CbpsNOh!?!2|d9)FI-JRDjQU%L-0y7XwrGk6tHoIrt+ z9F+FScV{9ZBI@AbZqSKTXy*4g=B(X+V~?Y+KW41mP4Po69mU}F-QN|NU93mavbI$v zg4tQJc28?MTOWmpH=6*h`P0l53d8(^Mm)=OB~JFyRJ633JPGXxz0{eUgK;XKt?LHE zbz&mGMrquiKQOx)*e)C5y1o1c^#3{dqUcu;+{TJjS$^#jS^t;X~Fck#HcW{+jZt2jht6WrzN)b` zbQMi)c)7`@01-(_DLds{`LXUUDTAF z;g3>W+z3utRT9tugMc&J2Cf<;y1J}iiqegY{>f6P_0<4^7E4ai-uMcB_L8~(#5HC! z<1QV*N0OUwkgm{#qIT{PNL5;TB`CTjWwE~htRh6%c0yfMgNz( z6$$__ikKI!x~7T2eMKq|hnZ>)Z|O=A5RBK`SJZ9yZ?XMNFz=w0x?OlAj$IK@$2Bd6 zvycW`y9wk!=Sv(K1!2v!@5XBo+Sq_V2;5NMpmR2&?CygE&*Fk@%P-a z;n8nF)0=voXUSs!$=@%Xe{~?D)>ko`$Y#NJKa5!-GUrCPct%=H zKa*;IgrN{p;&8wo*ePAw^JoI*pA1DX&p?i01$>uFLA9py4~OAd*^tof(diV#QIQyG zLJjWO4^FIoNjSG(=Cvpwl_^)%Cz$@@gR;~oxjmYsHd8(a8?74?*xbWsX(%+?{GO-g z9f*qoE(d${$8kEcwJV8Q{reg3Ky85HkJI7(#&D-J-%)W+8Eg78e8BO;NjBg@wfPO6 z5N0^&3DUsKdre>HP%-h=+VQAFwa;Vqid9X0oUuCpMqF33Clh$IKgI6)WH!6L&&oP= zFG%ZP%WIL`bq?SDFHt=AcCxPcLIX2^-Bfh6Bix2Uc>sGO2NLp|_iGIJ`3G0zxNFlF zvJvf`8cI^ydAsX&>Zb*FYTZ`g#MekzL2=x9^62Yp#Np-bg9P`Tug=mQ@A0F8MXIKb z(Ws4li|W6nYFlgUlULTd@;oiCY_sueR(RjLy5G->0<1vZAeOZ)i|k5TgI%CO zl1795z^eDNkt;u`QlBelz3usCLzu5Jg3#j4ti|WcU_vYNixEpb^;=?`O+STaeAOp( zsRk#NY|czM^mYzuuwa*^J}HB5gm6Ku!c29{Vg-t=qio|t3SzTCd~7Xwvb-OKYTrro z!CmL$<3WMQI$-feF_oaOc*e%*(v9(e(&e6$ZEBFK zrewzBCvZ=L4rB*=p(+FjFty{DZw20o>&Sa^xVKW7sR;B+md33bf~Y46AmtNJ_veiq#o)-zaXt@zA4yL5No6eh*i~gc3^+=EtWj zyKn}6p}43v)xRH+{F;wzjWc|Kue-t0jAt;mRpV1R>vb1EHh0^4LigY&k@R_<4~)zo z8P9f2OR|5tG~2>_XxbAVCxS5->z;MAnYkxY<~PH|FEEHPdg2{pd=q#outH!1&bkK3 z097V;dxe8A6eMmDr!T58u2Wh8S)gz(AZ+U=jb<3(kR=!^6m*v)>@wdqQ@BCWTYr{_t2i+;^yUN>4F zjEV=|9eHL2AK7_i3wc-^dyFIp$P^Fg{HO*2e&S((BFw+6&2+3Vw8tbjqa8WbMOP+J zrLMcK)?hKxViUb?&Ul*G)ojOAd^E}}mTLF5uBtCo=ZEj)xv3v)yyZ|+0-X5(gLTv#9sP6MQh$>A;`it73d4cjkIf=TD3yc1UNS(Y z<>|wkbdUjuBvsEt9R1+Sk$-tP-*Q_EeQb~Pet0a9+}Hb_!cI$$Vei9iJUryv)K*ew zo12+kPhJEu)!)xF@_odmxo+_83@ZAE&5m_F)~5<@(?CAmf|G)cx5!IkH5nEA()p>j5Siff#H}!YWSXalL7U^qP&Q)u#p4=8 zDv-r1l=W@EE=JG{DjM2GGaS#w3LKB6`AQl@O#C!Gp9NSx7bMv)96X*{%n0Q?=Q||w zE-!yMT+W#UQgeD=Oj|$p;D*S6z5O|_pkFhXw>(zq6&~F56Ij^cu(}Hrl!0mniPbkg zL0|;v$*f1YP}b?}_B)2ws zp7_~yo=o@PA^`i{ucYbwy4Q3y?^CSDb(s$U7Q^`IlHKt^*?@MKwob_M*Lj5@HO=#~ zI>1JS=zeU7cigi@GT|vftQOC`hyjp!R4hY(%^{nrAnM|dc*Y8-fE*$#FNf(Rqq>*~ zyaTD&^ns^WzTZ=~BD8tzwr2GkmC=vHRs5_H|BohvIa~A(&x*PPdJcBo!GKBU%C*y> zCbF6RZ~a+H+9{xPrZE-XNEka*;QJ67qYw^)0}>}Yd*q=lu64(WVjN*wPL)GCft`RH>)kB~Km7?D9h;2h^SbokH`@9q0or0{SIw@e5l zukb{@k>jVHa&*7D#qp-Yx33Jq!Mr0)+G$(`j?%Ah0Z2YFU2K~)TzG8lJ|Fy^K zCjI!P=?%vvLNA4XYi{7C=-pAXYFG%7zyw5thAzM+bvL?nSL*q*p59Fu+Rad^g9-_W zC|OUjR0@S4Q1H^u09AiBwrf`AZVJCWe)3i*GLTk{4`u2~HtM{8N=~?dRZ+o@6ZU;T zY=X3Z#xOpLfp#Nx03f1JGM}np!qb$Uj?8n59ZiXJZ8VQY$t92Xeb;aeR<(<}(|Dg_ zjlD{YIrL6amzrZMMzZ?IdTefZA16nZAj{ggWk2=f&eUf%s=eHNyEs(hUY=WvF+r$J zKEB>;6gCQpvCAGRXX7I!qK<+w#M5{(rA5A zI~(Go-Bi14?Q5TX;(wH_7dBam>#Fx6qeOGSfxgeb0ki);-M7F=y|G7Ty`A0W~8T#ta z_S}B!?$^ z6eCJk0gB$GCN?Di;ISuPyNWtAQ_7{tQ-@ zTo^#!pkzLHSwJB!(=X451f_x|2!98+6))VVAIX-kK)6~~7# z0BH$dn?JO*M!7AI($(+sd65&2GBh5{Fn4U8m4GL)M!u;A4>#XtO>A)bZML&=HoX`Q zgiNi!Ykn@9i-ixuavEp>pz1!l+G?Dqrn5y9N<~A}x4r#R!$dZOa7alrGi0-0g!kR; zy}vH{+RlKkk()gGHPiXc@52?B78<@2{ulce@4eg#V)m~Y7PByp@|xIr{3?o}EaDlb zJcz{ooQ|)k_Rt#c{pm(EuC_4v z%2s^MY8O@1pXcAhbx6gkZ~%xe8R;{a1KBvbvDKkzO6*EUijxR&hu;Xt^&%s9JXLL8 z3D#SBW`CD{MP%kgGUd;g`VxFK4z?89L;qo9_5*`{-FQJbPLM<4FKA%60coNb^FXJ= zBO$PGJKe^vFjyKFX)p=|tatlXEhMpdC?!?NW5VpOPS&{-S&1k@*O{g2#d3gZc}tvE z>Ks*v)G0tQ3mpk{1!zDN#y_{YOFA;CqH;@>@G~vy@6WLt3z->ZT&eArY>B<53>l`) zF)hZbo~gQ0;&H=EuJy3t_?1XqPNab=oMZV&=_$bLgg%w~r`#g!-tNQP5$2}}APqj2 zjx)7&5V}TjWevsZipn0$Yk!fG9KN%)&}J;CM(V`!y(I794CdAEtU%^ysw6mTY`HLP zp|5<{wAu(#z*YYta{2d3#FT(gKRV&}g*M7UCVZ{vIf&eMyn4iu^hZBGGc4c0)?yA4 zWkGsx@8(r#em>Jnsnb)kz^?~E!Upr7tO>aQ^y&eXx~5{<-49-dohBt?F^hZX;u?7~ zWD`1)q$2~=aw+B+wQZsBzrHXRCss>Humw3o5cDhlR(s}CqU;*Zz0@qPrrMVUI705gL`VU>iiI+e7-5`}?M#Ab7W4b>Kr57cmI3F2S^<<(1Q8aH|5WOBHC; zXvP6yoV9GqW|gf*i_QZO-wYwSD1vC%Kx>}n=X#l{tX&-0V8<>2UF$c8h$^mBjS-}3 zV#>`LoLggI9?CZ;(VhMSw^F(TgV|#|fc(>ovF)lFc2-Rpu?JM70RXTD=zaIM&Pr(h zu8e9QnX5Z6E_Vy^GCc9&#Y;;7KZH0)gI5rWX_WWm_P}XE4!OlY-8@N4-sIC#m?1&w z`$MC#CR?bL;k^&JRbB^!RRv}g{g4UO>Ufd&9#FGzar$J!f;7Y4N3%Cx zJ?;^>va@LMj8Uegx=~0M>}UXjXI=fzFtC1Y+N=TIV|C z)qO=8rRr1vpp7zqZcqUyj#Y@gA>?Ahf=T`GHhZx@D@}rSS1u%Szk&@A>sCA0!vQI0Xovc^s@GB9 zOQ+(zf;UXuXr7yU*O2T|Ng`chwAHk@2B?Dh4}sK2WaFnkM%TSDA~ymD zd1;k-eD=)TfwaawyTL~ujx&_d#@4Do_N1XH(j~gw_~5wESKVD$Om~M zZ9;ZA8A_@8#Ianqd5-A&Gh7pwy$wxEZnbYwjgQSK`yl0LeH?cpnE0wAHAJm8CkcF| zO?{s&DxPLmag|%yA?7d>#7Xd>uQMoN5j+N$?@O$canrSE# zQs62s|&;|}_)bmB2 z$4%9js0dqP+Px3F+TUAQ1H)*TO06bUr(5=zn^8oF>tp*;+!PtY#$i{rBih&I4xm}+ z(JAxTu558K0@G<`p+gO0Z?NNaDP_&2FH^J;PaXDp6AEgif{HaW>N`K$SmUHWA&li- z;d5#P6nvG9ksw(El-hM(0dgJ>mm=>;chG7^ciku7p4c%(D~81?=vVzS@crqN5Anb$ ziv~H9M7%S*wp^<^6P?iJ{YMeh`F19TiVt(kSA}HpC1rnpGdb0i-BP>0fN)$$6WPIU ztm3j_-O1t40eqHBi>_(tjtpp7vHatVA3&J_T)r}IiE)^syjg8+$Gn=VNebWuu*Va! z-ytVN)!9XlWA*CsUL;y|AmnK#NJN6v&bbrO`A5-gP^c)^zJ3~=XQ`6FLFmbt=Oz4U zFX$`VuZQa2T`>-_qVL(sh^*;#dskI>&}*4(r6+mLYQZkg45tk+A^u5Z#uxJ6SqRK< zfjw@sQ_hvT>1t5MM4SpwiO{kOWXKs%vTDV&R2-_S{>*x~tg1#Xq)z3O>&KBHSNnii zfhkr#p?%ZjFC+b}D}?G(g{qQ1YpDD~TdV#D`&$W}5K+2eeCKCT&Y5tjCY_(}Q>Y$( z`+6U+#u?&p(>GXi2CM)(2oyE3P0ycZ7@e>&oayH`6`-F9Bd2Z$fnSTV*7p)y+%H?~ zXt_pSMAEn$yF8u^{e4JP5+jeZ7-^=E%iihIS4VZaW0izq)MG^p=`;e8dGGUP^_>sW zQqe`i{mg*bsXpg!EgUsC|KS}JI5hAS-BMBR#ndMGj90aBR!hdTOuy-38q%y%Q=U_s zv3wF|$6;kEZ05>wn_2Ym%BgJKqgOR2-)jY-fZw0LVb*O~j+<_1#{1NQhw*q}Th|(e zR(8BYhTj?5(8z{4`4!&}PNKk5hXn+ZK#<~H{M=Lq07GqCoLjZpO+q&A9`2ks2Bl?8 zk&BvUo(VL2zegd8D`_yshz-02X4CfKF0!P;e8(?!%`1JAL53-Lc1PDW+3eeDTBXjPDZ)T;a;h16d(qlyBz%*RjYv?Y*J_fZFugInLWJ?QpZ6BFjSQ}eaXX)XJYm790 z?!s)=bN`wUZ6M*++W64i(Bkzu8^cgdyEx;0lbSw={Re}6oLD5GS9AQaHY-#S*y6G< z6?#@p_AkR0@)!zCti2iJZQQ~a&PP96>RfOd+}_S_X38!eAI9x~)B2R$f_ws0jTt{r zaRt2Icd7;_;*@w@voK#IPd%d>jxL$UMF|gyApI=q`;0u6Gt7fHem$Hk-cnY^5FwJC zMCeu>L4h3@MiEKpgX+-6DjDE>%ywUHNfX8(oIXFw+ibju-2Lzlnsi*~kUBfHg`)`a zBUN1L^!!Mst~ZL!t$m|xO6U&7^=3QXIp+yA?YZ7*b8M;~U-|-7Trx@9N{hD%*Jt|d zggzz1YK4;}i6x2S9z*rJ%`^MZ6#N1m%!BH-e?Ax!w@edvT@VX{E9fRe1_CxLkkpv1 z*CiT9vs$8jn-jBP7&WO$9GL(~6_n~=R+k>QPJUlSw5M!lX4@bS|t z;-)f$WCH8Ts#SIfrbU=rFE%tn%v)b*!DLPY1g>_SYxbeP+}FL(JDRo<|7Q z(8$|0L8M`jI+MNTN@t64$zxcGoG>HXF#i}~{M@Y?L>x@@ElBV)VkR4t^q}d5XqzTQ z{kj)V*ZV+wHx%wg5W+`XLGFQ1@J6?_ZcrmAE-+$T^{N4l zs%7otz=x?0C(%@;*8n_bZ5V+ZVX7fN9QpCCGKhkG;FmxHJk%;$c| zUMk$LZ~erM;tx$?ShkB5o>$f&{CK2o<=6fi8=JEXU3FCU91r{!4THX0cGlDJ!P0?j zBpa5e@oGZR6|d_dS6XoGQ#=W!m%X@9xSy;$rS%z0KPUAk9wys$^(bgXLfc4T!{M2V z;@Rud7l6FjynG>RYo9W}tGHHiR!Pm*#%Bz)BG5nmX+Zh7Z}P}nW1=dVi{PSX=TTAM z*vr5g@dz4iN*2y%pF+5rG#)~{R)0OdqWIpnI@aSVFBKo&zM!i3Zu6ULzl3-CKl0de z6Sv~#e9SQDYoB-IRf`s8S@r33J-(AN%7ict2)jD#1R5{NO|+L*j&ch!%EIXSOOoC| zGXo*x1*c-r7Db2M8t>Y=K$?rC=66~DnoE7LjQt|$!H7N(<86pmg_02`D9qbPg%q-O@P>(jiEQba!_PNDSQ}-7&=XL+`!s z|2u09%Ow-c^PKa<-us*bl?66F6jrl5T`$Ni{>Yl=07RFZ={;v)=fq18NRhbi;v5$` zo}7eM;>nJnZoGWuHeb*4T}vXMo`;_n5JCO;@m5t$)m+6X^7sTm43Q98m7$Q&3g_}W z1Uk6HiCXU8!?$;cnaB2TeFLDOc9e@UcQ3P2rx^EV5PtQ#fh(ZB>=_ zeVJkeaC^WapIuu&-Z$cJ&6$2!i&Q z@RE^;o$331kpmBq&N6-#QA|dH^me6roP0{RaRDpUD=vo*M9zD~8x1ZCeLFUdZqrtB z<3{UsoAw=56owzAy1sW)pv}7MW|!4H^EG~#5W5z6BYq>(v%9sGom2EBJzdw{p`3}4 zk+Q8wwuPFyr{LTVVPvxM=eWNW74}JKDgM%QZ>jAg<`ke@11fHY(hOF&k9c`c9mL-& z7lO%*43>pPT6pOy&JV1O=5FEdodxA>#r0aVe16i88$(Gs59`t8 zz?UxH?H$`<c8Dxz4OrKW18Fj_IhA~M zPhMjOg|>Bt2rcxU>$k}nT8aI3e}y60JIVis(XS6*X{m7- zQZZ3-GoSsSUS%OfADx-xEf-xoiFA)p+R_1|W02Y2FD?CibP*lc+}vzO0bi`Da`_2! zJ8ZZjSFo@k(W+HP#;+4a;khxV*K69Uto@6Yy}QQRX11Oy-mA5X!VUZvqfIRe@!T^3zH_pUc~ zfU8B9L_64fhx=Dz!&%p^vAkkV9pw@5p9_#rSIbAUb^g|2nQO^`0DgqXX*eb#!*uxu z-f`6(buzi?EaTO^^|TX^Q%H(c$Qnl?p8h!PYUka=z_ZRcCD7iC?=LY!^(mz-;Ak5gXZ=JI&?dS7KvmLbevAeCt#I%A| z=%;VEgTXLf2`aM-tq)h0&Ls3+`w}3mN~b94MOwDPmq~R-*{}Py-|Bzr!g-0G))5hC zx~vc~d=T{43-pNN+;#2~sNUCb_|X+&W0}D#ymgg)#ti%&v;USGHTAcw$8-;FB~tP7 z^76cZyC`d@c3J5)t%uAmoK<9;OremIYPj%|GHaIlw)=Y?pPX#(@0*M)H0{pU-21M4 zPtf%aWSc)$^|pn(a10%#O;bEYx?EASCSno{TThf98k%!FA((CkZ&Dr9Sfxx>^LpRs zfgJ7;u@39*ui1*dN4|icYe-5Ob|SlbQIVHeZYYxMY@Y;DCzqQMBPWp)m?jw8t;QP0 zen{ue6p#@)SN_wIIzC{$>7U~=YO#kM`A&{)9QS9s=$$m+bp zIul(4BTQjV*#U9c3^B`gV*-RmUD#NNNscT>RT%h=8ygB?oL^ZHqASPm z)3zC`at9A=8Yfyw{H)%_5?A#J*-NZ!AhnH?$ac`qGCz+!**e(!YB(woH>?{r{sntS z=C3__iUv=)hxNQ)`uJQ+SuSNVq_1-EX-nA0@=cEZw=yIp+jIX|9KzuY#4cvt%EOS^ zxw~5-x7DIEgtaxJlM0Gk;J@$=K(m^X?7F?4;C2X+ zE-PG?g-744atw>WEr$hHPbKyn_RprSPDC!E3NxI#iRNw=Gjfdj<0P!_+uvDS&G0qL znwl~ojI><|+4!`W(c~y1i3q5r6hZl(eS^wTw3=cyOhA^4NO&!bFLJqq^3scQ?M^9 zWe>$TyS20;{+ijNXz)X5vJ6w7kiDdJU?!Pd^ZGGxc3j`P(2@vhYEHXp?9q{BPE=`u z;UI&U82#7&vZ^*Q+=!^L^1{U~`x%A1HHu>~Pa5jQE!iworXiUA{mHf*D{CnZTyZctkXwkFB6t%}$>OD9QOXBZ%mVz4h@a%4Ncg>mi z??PjtQ0aIb1p+)SlTOdwjw4r`zL5c;-P<-Xq3}9zmKzt|U1bKHpp(}hkc-}Jk0@1H@FDnIp3Hk5f1{wHGVok* zyPR+;Im&C9!zBPOcpZ3I&X$3VZs*nq>h=ossOad7*BsjPV^ApEKF=Q9Q2D(^7%0DN zPiSfXEltt3ZXYS@{rq`odi5g^mW|Cux;zGwm5_7o@A7}O04q2ta?#ljG zj5;PrLg&F5Msck5OP&iJ6CQ6SNr+Rnwzh=Lgfd2?orcmOXZLp{iWFtS+j`}kTvs=y zAfa+=jY*lLG4-9Tt+iJ*-ej}Yvd8XV(T#v;Va{^T(I=ZHw+G&EUqCIJH{Rz_QXj_V zv%CQrsj9AiucLyiVGEeDzFU_9%i3b4%}V}K93LCjS+`5er#3va*)MRFO)s|s%j)6C zGgpdD?zyyE|BfoHsOUGyA{|+;V?a)$B zEeReN))Otio941GKiG}Zq5O9u1IgySl3(nD zH6!w+(C|r1o8j2&BB~9}V2uuA>|AqB)5*fp9=+;Q+A(Dn=}DK5s$}3Xnuhi2Su+a? zR5rXU7XqzT{3D-%p;Wmv|XGAtHeQ!gQm_c@IfrRjAqsh6E{Vaq=Bh!=u{DEgzO zxgFQ%&gW)#px_dIU}JDna3A8t{MT3l$Q7n>j=k&kJH@BOJKM_w@BdH^FOMOR0y|DoLLmJ|YxQ7~zO;KEZQ*Y(Zj} zD)Z+Te}1fOrIuk*QbSIzZX7R8amu4c&^#Felo%yFq!|zcBn+$$>;>)ksZ)?%QFH1h zrzB&kvoZIA%u>RLxG>dyZu%y)@0YOxZwWK5))=B#v7|TfY72Cd5UezMSktDDw_U64Q3OD%Yvj|B}ruc^WiZCk#s z^K*fEJiP6>re+LZo`!k>8x!{kT(Vvu4K^oKdAOVXJ{un+pyY$$?WhA2_z`Tn(`&Zx zh`N2%G8s7$IWtDy=VvD-tkUHPlZ@RGXK;8teR-y@RMVn~P48FC0EG_9HNpT8w8%lb z74&Olzod5VU*ELdqX=$pYk%?$f-Ig9Nd^k!>{GWJ$W}Ogzq3y}qay1|UbQKjA zdfz-haY#L>D~qE4UlnMt{!$4iR7D{eF=1SmGQvKv+3%62=Iqlz@%J+Ht5k&O@6{IN z6cugMXFY^NY3XSr99}+$fGfNEI*%#X7R%N5}L7c0e8FiD50mL zqkAcU)wOwY)WzoWq-8O>V|htvu@)n`N5aO&bupvIV(_Bn;?qMBh>*B3I)FN9GuQd^ zr%;Y(#Y>YY(b|v@NmXMlP_%0G;n+eH2a{s|X??BbM^=L2K`K5bv2|H!j5*=ph$5BI zEWdof)K2{tsqi@tonEh@v<1b5^{3YA<;wgd+PV)}wA9khAKi$bDd6h;T-oktZFU&_ zuu=roH(0jy!)Xn=_8u+?DT!qOmI3827Ov$)OvH}QVgr?$ z61*&;;kWT^%`svH21_KXpx|NPynrPNL!Sw)57w?xKjhhP4k>PeUZ-bs_ir$NGdu!{ zL{Xyg%y*E#^PRpvHp_FE{|ZT0`vRY8V8yQ|V;NM^K%Ag5a`nFzK`XkAX9?l|0!@>8 zZ}7o0*yE_YC*H-y5I)#jRjY-~2n7 z*!va^iYQb}5&V+6yBko=g&uIB>x9>GH-GS`)G8(8?pW>S`od=^4ytGZ8-uF5uY}66 zv4#H@@?P}b#QF}aAn?7vnU+rCGgZ)z*tX@j2pht(ldudyQ7Yx{vi&?j&)*B z-cnQB?|xv#B?G&qVsx}FBaB;&kyUc|^JY?o8wLAK8FzX?Vlnh*9Wi0t2*6bvo9u+P zQC`+0X{)37JF87TQ|=3%ccSO}o&idSOH(+p$`y%qhs;3JByV>m9>KnFBleGX;vGiR z`}e)7e(_cRoLT5gCYZ7tt;_rWijZC^^B|~9Dxd+QrLFClncO@XpO}|m%zm5``qD_F z(#4UJ-Stq&nLKP@y>t1e)OTv|GC|7~OUvbu4H!6H3=QcqH#hI`G_;`Z-Uf@EpP%1; z@qX?U*0Fz)r0DHGIr)+Nss~JyaRR?>taWB#E7n1K?XF3TM!>8O+_cH8S?e2kvbjo{ z=Thc=9!PLGD}jYr>N+ZJ-MBwfOM0?cRat#JHc*0%`Xs+_rfazWB@hg$u?f=$ZI5Lc zj@H?{4CE+OfMRxXKk5SsXPrr*R;o8 z%NxtQ|CBUF)D_ZqG^^I6K$}HatBqVMH-jvJj%=kY&fCWtAerY!gP9V_GHXJqKmMsB zohp1D6DpbzDw1v^^VLE4+R$|nUO)SN;rjQZj1$_N_q?V=c;O?Nj>DXCT#bC**neUi zBosJfpt$~0*!w)V1?MU9)n-acqOM?IlCcVyO#XjsYK`(wjI*u@?_@^3q#W(Vc$&c<#zbFrSbT&x!E^cq=^0Xv9~XuP+F9bI>U;7UMkVsgYw zi})FgH!t4kyQHinriGN0;61!k6d}EMcO{n#6)2)!(`{Rq$7)wzpr|kYq}bsH@{k|w zQ-T01tve|aiy1L0gtW3(hW$v8vdx@5eO_|8+>)f_iO!>xThSC2e8&dTRjt&{!yQ7w zo^Q+U*z3Cst$QW9`GvjPb@tK6A$r28qg}Lvd)gd9I8okx#+b1Uje4pH!io@GpyN)1Y_81TwxoI=A4Xt(4 zb`Wmrrl%GB zg*F(+3h9CLwRRSpoa}EvIDHOblivHionvy~{rC|cqr9Y-7a})r4ffNZ`?Gg)GOc@I zC7~wNxD)qtj<^XW^+q4yyCp^Iv9C&q^CWRqfbeH*oD-K2Zx6I;6-GxZ@AnSu>-bMj z#~&UDW>yy9@eLNsxyB^m8m}_19!%x|LH&%WMbGdNujO|)zw!_@ChwWf;3*jE&xG{5;t2VO5F21#IIaOb-gWjZjpKAyT2|WVJL<$P{ue__X z5%2cKx|i>9o`<4P&F0pPj9lmyFGpTm`+qbV$HJf-UtO6ywzO7qi~Vfy<|EF5o_YvI zA#6SfWJKnaK?55X=oLvJd8)}vAUD#zGbzAGjUv=SotDNDpw3&E|9itLyaG(NjS!9+ zj24H$%Y*qHNUf5zQBoC!{mbmOv;ss=)jv1|_u7klharv=dW%|1=6~oew|b1vjj3sQ z1p8G>hJ^b~%k0~6b{`X$&8I?|zm19vDZB40R^gNeZx4z92?@)BLX+|Hm-xd;ME@dy zb_@mlPDXX#nuY%KpOW+xe^%YEI3rH3u|K(O6gDAmp(O;2+?kq#K0UFCeRZS9seu zW>z!^imJ|CdVb2ILM0VeKMpomU_=~pG{8JR>fYwIr5D-)3XB>g#&-@e@n$$hsNc@T z!iT)Sb7COloO-@%2WwEtsg&S_{xN^=w2Z96N*LP6MtX1t(h`MYOYg6h$73oghN*IY zq9bjy5nfItbInBL(AmnvQoYrf*#&^I_p$wMcAx-BW$3Y-*h=8ow>0vtXkA*=XqH4ANc)1~D`pyl#N zr*?iH0w>pNx=!pqh2MG}y{f@R4P=*x+IZi7R92>L_zD*8CS^$&=&GW)L7;HIhrbc6 zaU1wpZM{f7K?)RJUt^3_fW(qkvb$asROZG9VJ=B|wXt^8d===L>K-cnhGA-FgXY~^ zb)HuQc|=#0i@Bl{SbJtG=|hp10h5HZ59WQ=)wf39fZ%H2!q?0X7cDD2OnaOY8Hvat z2YhebFIGGFMI_FrEzLm&z6MLSgs$T{+#1L!T8~fR%$6QEkI&Ep)u-^*`h43y=Jojs zq$1L2PRJjWhTcwjkIfU_Zi`MY4pmR7o%}3mZVhOubt4@{`rH2`4Q>oFgO^j25YVq~ zgb$~=)K@QO{;rN*$+*}wNq?71&AKSTp))+-1)=n&g@_@&nK^kmvCuC>=YT*yq&pYi z9e(ZGc!Wj|E-oktP8O-Uy!HELy>sTC_)%Fdc8Vm>h?;u!TR}m%+GG)lhMwDgU9EO; z=>^CM*5`Sya^FV=x}-u75o!80Il+-r>-s?e0Oa!vN+>k$ckf9JINKUnPcK`Yrof3E zQh084b;6$aO{=^cW%ZsDFYi1@guoxBezDsOr-pRD0D3Omasw?33LgMZ>dw`DoY~7p zIq2OWyq%RKkWD8T%-|3f;orgCdsJV${24g0SuTBU;!O+4b#N6Zya5DD@k14Mxus}n zX$%scM`-V?9O7^aq+5h!hVZF+VbS(-W72k66i*iWguHH8%7!i|H z@(o9y7pz*g&VneXm$+^7_+gtBvRgI1ioCM+(L*N`v(?WuODh;UG4o^_I*fV|UUh>~ zJHI!)ZD*felpm`0QLZ}@IJfk{7(jibpGc3`l;*0!X_%_?XDvuZF%*1E@4CBwBiP^p z)0%CanVNK%ET{V~$*6Inj+@QQzwrQL#T$d8+DOtK(3sxQ{MWLy3Uu_eF_3fxT?O7W zo%zd~I~wZ)ETrj%lBi+Usxbv_oq3TD2lI-Qgm3&}86f6#U9KXbKwnGEDSG3FaPKiN z^=8sEPSJEDV*4907&exJQg~2UNbKY{)>6S74p392H3t-ggc=G8Z;7Wk;Mdoer<^BGREVMkP0WQO67l|dMhPd8MUyF-`q=5)Eh?<=10RpRY zD@;w7S5SU@ot8}cD%d<*tHlD zptYP? z&cSkF{X@5!o*t-ZZ_gk>(-jAoDUDYO_-M||^^LWd*jRBJ8#V;h2A9bC*GzPDSH5Sv zyM^yJZTVB<621gBc{#}s_1gEv8EUigAqc==tAZx>_M8B!86C&5_kE6N@~E5{ZPwe= zzbkGftJEPhq<8x1XJ!Dz*?^F-SX%DpE`spa0l+6Ur6+7#V2zwv;CO{zBfvW;MDD^i(#OiwEEb4U3iVgz=WU<*S3PR#?+4JDu^F)5K<@>L= zPhpi;%+7)6zd6jRFdow%opr<(IS9`zc-49cX?>sJ)=vJ=V!A`sLbbv9c~0arJ}@v{YKMz}C3?e{pzXT+{oKcHZw6u<+|jlh7WUp0sK%F< z;RhHNS_9?kj>k+iJ1$=L@VGAu;r)pS|9M*|yY*Vg3oqk};~y3-4 zWE>>+plb56+f|I}rWtSu^(fF6y;l}>*jCiBZ}jy_LO-gu~(HQD{v(wbD?z~H8_ zyXyN^8gmNqb)BcK$shjwGq^{sY{ZTQ6RQ#+1!tE!sLf!PC@hW0Msx!FV*poTJdRfi zBPfMgkZ^0TZ$*so^_7JVNcha{?0m|-u1bhjPmcQnirhX?_-46a{!;!gj|BNHuvrQH zzM%EaN`i|_XI}Vf4(J!!VE;uo0?u%N6PVqpPx3ajd-y{_LgdJg+|JTM5Mtui3^pRh zN(byMXLE})A-_f7JpxG)Uy?eY_hy~kQ4yoV3m z(RnjK67{63ig3$n&9KDBeWgZ}p2BrT0xe10Z}BH2cx|5OgM0O(&AYAKVmpIcY9Jmh4m=|wr!>DU zs!5g7<5bj#%?ajvG4z^KNbU}-hZ|3!FBShaIHx@HUcD+7sRqrLkI%|Tm5iPc{ds=>)d7NLq@Tn?nIhW7cD$OomA{?ia9pI`0>bc|1iIpI^+@ zTal>w9CldFlml$tt6>q-Is5K#l9Gn_&!3lZ0u~l@tuHSbfc8abty)4tVh+IG)ZzUF zG#T(;J)kJ_-_kzMA!dh9SaeHvHvFvQ3vIScS}8Q#V$EO2_Y46OABa!Ua}VU5k@go8 z*IHW>Oh8)#$smO}D9#3*1Js|j#YW$ckHj9HNGwgdRGdj^dXS)_^A_+!65$trC&~;@I(s}X;>95cghpWCP?U!$KTQAC9YF!$$&l3~uE|G|YlpGW#=#_> zfWZhyZ3PBD{lo9@Up(Ap4eo4h`cL!5{S3@Ztb~tI9y_{RlsA}AV8{;{>_NXIiM0ab$$U1YW|)C`obj1O?5fV|$0IpYX*V8}EA*1n1qtH7|m{LleV@2EFRI?(h%ANL=n6gGsb~K`@TU^(xA5ShFP=i6De-lItRwqfZ3EXU%YkL zi#+-jCEUc`?6`~-69WSrAhW>6_+LvzXSDyiWJ1+bU&<*Skj?-}I>E8I%5lMDz#5}} zN^-hEZ;ue%(JJS-RAD6u_g6=z<;VDa!z(0#ET1deDo~bAuuU4xNwSgQ%~M?h4eQ#B zfvAw~NdEB)5C$~L^?4gECd-X`SOLUL_;k%d+vV(~&L;DpCqOmbbx|>E0)V9Np`-X9 zs{rB_@dL~T#taSsm`I}a9H3_zS-5qQp3f`J3{7kJWVW+K%S983hTI@aa%{JhL= zfLC)?=qXZ^Zp0I%kAi^$6{ZmmoX;U!Ol&Oc!?P^|51NDPAY_E(7d_t z1+4WkC7#>it7Kf(o~PG4-;0V?^G(wqeFa*0_}zKy^NS>q4eR2~^^~I+!127e^v4Gz zBbO5?RlD1ywAjSq$FvXH68qZ~!`Qhfj<+vy(#`(_wJvUSK!%d*MTxBuI;QUn5R%VP zVcP6m!CAi~QvnDdDemL2oGI7~RE?pi=Ik&pD^M22ZTS8@PV~VRlD>*p#vi%BO6=`9 z%N-GNVvyLIAK@`pWj4LJGX`VJ+#$QF0b43=%9bCPn-U$PiFOG8v9+`#?8@}L)}o}E zBHM(Ah1=PXe5&)yUsCVi&D&gUOxbjCGmJ!6kVgj#HQ&lNJIxl+ zGB8ls%?=KtTf={|%-uFDD#v6{MWgE6NZKvc-myMN8WgNijmKZ4uW24nf*R_K8BqrI?ZOoOiPCPBlY zqd>kJIGuwCs``Wrh5k>({^vFWn(-%ZVw(UvwQ zjMyu;XyJ@9vWZH#K~l8#CuogwvMwsK>!y3@y4N>Uv8&n4wgwP_4usjDNQ~REC;%tH z4Z(O0qKG@}f@ks~5X5ZwI`$l1w^(C-{rOoAk(lLs)mN;L!Z5cRAn1saS^srUl1#2V z(^_RtxCVU2-9HoC2i`+0>bB>zWdEuDFXb+$pdn>WGmwTcpKU~TE5G?r^U`v%NJ1xsG_x)IOtvC%)0CguXzEGk)xnp1AqoSTU%dK(iDum(Do*h z3JlIDu*>G?I68`+>%~hb7Tmafcv~aGerDIrq19Ouccvsg><;dSAO#HoLL0qrClVi> zN|<`1KC93VXD)8XwE(u4~PUwlN&0to*E}noPCO!vUg#UJ-xW0%oyukxd9CY?at4~EDf*v6+RT(5dgCYOYP_mG4Z4vuNKJz@3 z4Rd_$x9Y2_ZHoP#1FXZDYZf^+76afG9Dpx}%2;TTU_?d&TqxeslgoLE`_5p{p||LT zUPh?vpv3mU0cgYPkM&mi8Q&sOGR;f05=19upsuIS z0;{cX(SuwqR`IL%zSCm=!YyMRAJWQUb>D|;T76<5OsEpfJ#Y*O~sK78U}pm zx|0-ly4CFIRlrR}b+}&R`*&6sKMCpZAfZdAV=rRoF%c$re^YVe-zP>vqylAW21rO8 zIVwUzKKD#YzW}X-KcXdx+3{sYp(S2okJ3(eY`sI~$B^OqI`@cypK_6q)hLXi?CytR zH`c!~m+=)%BwBn1sxOA{&6)$C>gwc;>wT{t-$ilf$+viWmsS?_C-e0{!l3VJ_v)gL zCMNjGPsf0C`T)3cGVz1SUQ4z^GZH$oo;axA4u(5AUFgqBx0u;`tXrD^DyzAQ`o2M# zp6!U5cUBApEuhxnAH*+Rrhd-N;7^K%J_GKvDo^5Z5KJQ4Ui}AViprfOSi4GgCSO<> zyxXVp2P<91K-V_<1>6b~(LkXCF(x*B1{FBV}g?2e$GKiK3-9AwQP^L#;$GcS>H8`b%o6ocF?E3SqD~m46$h&ip)3O_5jb ziCo-&d05*(ciutHMQUzt{tfNV`}I6A^+zzDvGNsdxik=iu1J`UJw zuB~9I4zH}PsxTPm<+WZ=DDXadf$OIq^ScS|>b(atH~VB_)=MzyZJy60m!>S)b!v|@ zw-4Cx&teE3=fGY{`t3|!@+mXd!B^??x-4?cHULWOYO|(8}0F^P8|`CEMkMSV>%WVY8h1Wo3`ar0oC={$KcwaE*8H)beuPSBBh4!=s4)YZ$dZH8*%`;%hv@cq zK$QJrdy!U-Xv>X8Jx$^iX#hHB_txFr<7$>hvD9j_*iMciczk|*AihXQ<77_r`Wm@? z!N$1@ePb|L%;XI*W-yo(03aSF(6S>svTJT`nzS=_g(-SJlr&e&IrhN}b)OVO1^S*n zPZ$pAR91*h!CTkR)`q+@4+@qU+4yQ)ky{`6@S1N`(PCd1LrJHGGrn+?-#8kpp+iZ{ z3^HAe+$1D?(4oLbNE#qk14K=r7I%TM98h<2Y6b|IWkm1k|dp0i5$V-Lz z^kC1qJ81Z56|VhH>rce?YD6&5zmXI{b4Jkh_(~0s|E;}ld%fg)R#-Sl_-FsYpR@sy zkvd5hd`^T2C>v}Po-kxohA^aiQx$qW_M_zSIIq|r!dP23sW7`sJ;Go@aXk-Ib9I|f zLC3@}(2&l!G*6~~X3b}sQ5HcLz9CJO`Df-frdUbTu=N4}`&>;9Bwkdnb9|CCNG!gm zOTbt|yQY>fdOW1o@(nHd8ZDizt{Z-?!QtUK{kaRqo6`$ABbabgL*!RuJJ_zL$tLZx zUB0^dnro%KiC~S04jMWEqt{AYBOwEEbuFX0k(+}ACkdh^vS3ckRfTD%VDi&542;6X+HK#Fp$wse?{FSoo}E4Jz^f;NNg_Lm$A4+Z zhsm%7AiGA7lLeXpftU867D@FOY(4-W4p+|OjYr342U2$Uppf|fUn|tHDzUZ#XDs@{ zz`5YcYKyG}B~4w!KR)@lDXGJAXc;)ZHO5^zn7&uXrhs<;iJ|nk1J&E)sK?s!LOyd! ziZyJ6ZU7(^v*%RN$PFb?O!c2Kj*|TdafJXvRb4lFOx*q1xz`ekMmb=r*^RnnOlEXT zp@cfOK3c(5gZ}c6h@2#W&^S{%rTKmEe6wzSkbgEq_Z`oGo11QGuGr6V*z`XVl}FRx zch+2&5pd9Dc&PeFSy_l*ft{ji(R;lcgpIKk< z=cWQGwHY^u4wHS4Lka*C3~JJgos!u8#gy7`<56epC-5>zbXQp|*E z(alZd?dQU>q}=#@yK+N!-YK?^Zn32I%DAZyDxWq3Tlj#-*4dNj=JDs#tp#wwqhL$X z#@?mR?H?SU74;q&8%rSrjw15Sd$s!Q^)vnV1~{`RD9=7yR`Xz$X7dY70s>RoC>YH> z1-Q-|L8;fFqy1NgDKs_3PlHI{Mv;ucQ8%9Nwg9tN$b*ocwocta;VVp~L&S z=aW2#W1vODt9*uT!FbY5=7IK2&~=I`13mrmDuri8YU(ay_J8|gAV*(`hNy8re0qz@ zz??b|8ooKc2x@Jfxh_55**P#ZRplv|Y7FsfD~IAoJB;XlVg`x-w*%1Ji)>YD#?8 zgm?CKgtqPghAC0+e*a>(xOgMl5uxuV9U9v=_!0>*0&q!7#$-%lT&8}51O7Rxh~F8uArV7gjn=mdtVQK zJO;A2I7$ZM&Cjavxizpga`t8|9i#r#gdrg^odE0Fcu{_GbvBRnyqr1RV;!SE7hgp= zj$+4*vkzc#0D;p6*I=56P~jc{i+byXnhw!qwMtkxP3Zr`-QU>lW|1W6>pmm#UAYOQ zx*vxE8r8AsU*eR6oud5_ol3n~B|g3hx^848Qxam{tWU1$YE}84bIeu~5fU1WPm&3@ zoM$xF88}SClXGR?+T(;146m<2@u4wGGqv*3f4gyZsZLi#WYLEfXDW!pmlWZ#^$@r3H#Y}9C% z+CPyB418e4aN_IJA9e#SkCF|cKPloM;u7i`TCX@!SB1R$FZi`w6(V*))TCV zXt=A3p7aKNL}GaxZv|8`8K6d0>E3dIA|t~)Pc~{4`2Fs@i|3d1+xw#_SYMwmtr7I| zXAFY?N=gaRiH}7MMIW_xEh@jI%oj z@$0DBPZIRRh&S!+?Sv^Yt#h!7BrXe+mTozPw=3-@!zVsv|Ggvdw>*NtJj5exPd3+p zsW6!C^`ugh*;RN!^sFGi!1N@Z%#25~xaFMF5S)clH#R!5cl7huSobTN#-2OGU|T^Q zuYC(nqNGHw^rZ2;SRPg@?1C4Dmr5@JLHFz4A5@LSoq6BkvxypKI9V*vv+{0y20J-B zjgF1A7mIkf9dDZgK^TeB#z!<-=tt*eh{AX7(CAvXh*;hAM@Gy_2vBEqHDFvXO>|!sxm!^*@ia zy~tYRCT1sb9F&h*tG+rMTp<2Y$lI9bhNAK)K`pbkD&>A-BI|o8zr1+dXF`^b>ypPa zejgD;`3=eNAHBt04S2?BW><@M{7Dc|Ckn8XK{12&n-$}r?$#)W807X!?5sTj4ROAH z-BOD!SRN%M=F^Eb!Y98!n2{{Wf3RMakdLbQ<2K->qvqS~usF4;_a8MRJfsP1ie@`i z_4LTL$~zgW^cRHhZs3c^_2~b&`Qb&K*gui$5vV#_kx-HnIh=43bUn$J4Kls<^M1T^ z!icoIGh$$CyygwYq#)~jDGkaS=-O|(622Ndd4Z2N4oLMjo9UsDxXv=|yGXP|VGfcZ znR|CFs_U)Dnkm~gvk~x!O9|XLBgq`B>rmTsEdfX^DEffo^~-EBKgsh(S2`w zk>W$^_Iv)Zv7!6(sq(Tyyo+sm&Sz9XU)EP?*uCR*OZQ88S|@U#IZwi#OpYGLnrLwC*Mp?0~x%MklD>B(Pe&#N8y)OVtXd9=KD1-jC4}` zYhuH=F*9y$=QjJnHZg=3l=$rlM0+UKqmkJ8VL^YjFDm1 zx9ho@S(CiR@??yZ>N4{k1x$hjOv9XS&>uf)=d90ng<7wpt4p1Ftdq57ZR_T}$Y})Z zm`yWy5;VASu?cWRLMBi-JY9v!@6HZ<5V6U~y26YHZUnsn^kuPejilMBW>(%@BT27@ z>hspT6hW$@lG4aC)@ac?N#BC!;voxPDra0bZE;ijHO+sYtGFtMKy2i~OpQ&L!5#jD zuRlg$e|r=1zNh_{OtXMMdg^qHUofK^9wv{=k+?S*$$-|jv)ip&AvQH-yPV)gUhpF& zb36O&KJuk7_ci)J1QEYSS5?&rYBZm*4QtUHC;O95$0-EeA43ftvGWltkWZ7-eKWcI z-i+hoS!PM49zN)Q}HDkasmdV~$4kN+8i zjgIW*%8w`Yz7$3V2Im2FqEsr(b+5( zyrS!`krA5hMy0mS?tB3LnCl|(EH`&U^kVP#@2u+P^q?SQe}8{MTmtEvMAyNMak%w{ zbxI_#Yv$9ZPtUN>Xt=ln61Q4Wa+$)!o#Zj3f}_8VZ}*aCNC5%?%_1L8-q{)ExVSGI ztSphWwdySq0?O#!&2S4jsrQT}-yhh=&zG*TIJmdo6zFJZt2Yj6N8Pg)j7%)X@L@#_ zexLLQA7dk`&W#NAJ~!fISoCnncNgZ#6Z@>YUDnWczA1STN5L3TL3?k_^HZQjVA@D zUT$iVKnPR(KOxLo*%{fvM9$>mPF&lXucY~eiqC6D*-=m+LG#}P_26O2`@TYIsyCrA z*jxh%sZtVPG$)Lq4DKx^Y8uP$j1=R!hMQRKAfCdPNl!zynifE)ceUi%t%ZS& z-Mb%Gd%t^F9~2(Wb$BZF_=vouRga{^dx>^)v}l(=zrT4RMo4DAzya}iyKS&P*9iON z^^nG3rHa<^g3rqkQWh^zyE;0P9G)I+h8rywtMI?* zEO}yryq8_kkeHKv!+rw`pIcOLR*8>_**(!4S$j7`7>VM2y0@x$>u%w78=_PC)B*|7 z;^NwWRI%=(yzj(W|x!{>z0};X;#(#TV*t3+oKacG{nuA*kOx13l*?LA3k#a&y85F7zrUGrJ3YT-??6cX^Bg10j+*V-f9jEiP- z^px`QY0QW8{LkhTG*mBirv?_*Zaoj5^Z4)sG9GH`nGtYU0D+*?{>sYB?(WGJTq9Sv z&Mo?tx8@bxc+W_9Jde4vsgFQTHwC7NjKKs-I?9#hCy&*r6)E!ZWrJ~Jv$M*h-CZux zQY6~{yZ{^5meKT=1@p$-dI_yFSFK#hpx?Fd(65uifQ8U9w=^VK+|;FU)XE#?!_@ej}PUvq{`XE~5nP#+e9_M}KD)Qgf zg`zIkueIA%ZSz6sp{5{m!!)0;by8>H3WE_jfD^ED{{ls8V-foTI{moUuZy{b=_=rVK+Y3T$(~2)W1n2{3`buqY!)2Vrw-}5BB%5&|7Qq- zdpq9!gdimnjf3Ni1F2r3ua8sKC3cF9I(V!)C~%PtSFE4PhC|E2(K%z%ytnToIStKA zA8i7<)GaJl)@pfK7vHNXOT+F%PmZMDUSWDHSRe6lhx?2|;#du+g5V5b^3;j^bHE;l z+h`N11U8C!3R?QDP8IEwA|1OE5n)l`^SQ@}t0iYCm$AYHO*<1Qa#~jC`b9x4PhLWc z838R%C72rVHq^%`)9b5B>CXQ!~q~{5t;&La&c1 z&g_GOvVYb9GmlvYY}D+S<(ybwM!tXd!jB0c@bWcz zx@xfIwY7M`Y_bj(mZEWSam~b}41a}!1|NESa4|b799OSm}sL88&4}HqOS3~ zc`_JjxyG6XEe>9M@Y@9qR=d+LpURX4hh=+Y?;C^Z;7jcH3_ES3W?^6H?n2S^CrT+; z;gevrX=Ev_cDly9ujt$qCKfvP0tBEjvP9lslMqP=g$i#Oi^)%zipi~HWE^Pz!o?kN zW5J1yHr-qsL&D+KnsBW7h!E3E2w){Gm2Tu82o9H;f+9ooH6_xVM@1sJ?aKZ7@{>%U zd?fsZ_V&v}Jom&&R6OVZoh*YX5>b^}8?{ktlXXtANuK$Kz2pnA;i6nQ5eNUWVjnb-XBaefoez zNVzg~3-Z3_Z(v{2t5b-ts5jI3$lh+6m>w}9Xh9s1Y1W!UcJVx`+`j5 zA0pF)rpV$sr`Q~}=TK{EVWAHkz&tm_Ii6n`&GPc@kE0XZ52oj)y7sIaH#C~>$oV(p zsf#&&FFuExV(%;WC0B1+2tteN+-Zm`_e1ZNYLDrN!#^4-I*ytN8ck2UUJh4_coZCg z=@dMd9jH9_Ee}oo#rK;=nm2>}He5*qY7SLLSIxJxGQ9&m+m7CD3hLTJ_Vf+g8ah?$ z76dh0!&nI2(lj6{uGX_J4y>%|Ll8W4uhHmKMO`zJBfEnuh8$u&lyEr3>q?`n+vJAs z%!Oyctvh1oWQPudii&zRp*p3u+~mTYzvZdhI2FcV`GGMzo#K8a+1>NXZ#|Rb@S*)E zj?J-;@c?L*H7A=Il(f`Pe_8=oxhcycAtk%KQ}viEjH}(}w}JR#$?YrwBFlSSo?r>j zoXDI@#nQ^QZ~fdQsTdGR${z}6dpNNf7dW`%bQ?Xsqrb8$#t-P0h$;AyJ@jIi`^>Zw zeSD>`_0Xz)&oO-xAa%eu;cXC;$#;}!N&Oj`HlLqxY#q820jYwx+ghA!v0+>onWB0l z=B{o!h(;K=+D5wLw#e+xC%0+IjM3pCM2dX682TNY&O#*K^XkYgx5QIlU@0I6q~KQo zVj(W4og|;5U?A#G-MF-~4TB5*Du^`YZonM&f!w_7uuU1U`y4xZ}F2er}qNG!Z*L!59?j@k^1`i zrB3%6O4}OS)@cIA)o?Z61GOMsj@=4r3^?7Ry-^!FXWVt+h`#Rlg_rHLR_tJFW4LR{ z@po%ZR?-dM6>$ha5mFx4yPF`gKwjV7#r=qvU?asH(kb*DlR@~SZg!o8>kbJC*??tV zYN4%udi5o#-sws`ga7_uwA&*>cSR+Yam#XB zKnaek?~b@P*f3HmzXuT3Jk{779`QvNYWj^&qV87PPyZfAlEn!Jkc8#h=qU~8$f;fbDQ8LpymplpI^4QcvW+Ax4d@;x!oCRHtx~S z?c~Mv=LD!Q4la|)$C)`-lgDyq1v*_55TmUyL%o4uoiYgzB?{W4&-l2YWw#a5#8brB z6mm(ehMbahu_w)?JXMj#*C*YPc=0gxjtSoa@d$N^TuR8sDHaFrcM#8_jbs=}N9In_Rg>8KbcbGupA@C6SZ=h%7fpl3yM+~;cCu{p$ojqu?JsIgqPII< zE!$~m1-ztydqy$BTh3pyfpQ;nA zZuRNV9HPZcLs(xvj)l|RJ0-sR3iZN$dWzMH>S^#;#7va|^2V>pnuSBJFaxGIEL_6j z+WukVo3Zj|RmVr0emV605Jy;8SW^q;m+R|muZ!yWgBgqNr$h=K@r+SGfhmd$Id)=M zD=R}kebluOdJ&`PF)BVU>KlNHeUimqL}S@qNl8h4MO(jURXBC2-L1jl&Bv~Jh5x($ z66bf#`CB}sZt-gGx=TWimTnFHlOpdY|D$9Eo*nzqQMm=DvrkPIVF~UPpwu76xOw7z4dqqW$a3xqsf033wzO(+Lng39ud2LEV8Y}s{HaC~Ts%`~l`F8%O zX@2WZXJil|>XycDYtvLCG_50`l4ex3_cmWDpS6w}H-}+kTl`r#DP3TojzjVBB}Zhf z*3apy3sXVzh{QalTNijZbEuD(n`{bLs6*$@Dk3b~90_Z%J;n)+Uurqvwb$N5A}33V zHiOfC%cAcY%^soVXEJ9tR5^X$!Z{OL2n&cmt8(> znmdG0eh(B8)yS=+526`gWf4Px(1#zpp25~UK4KqAZl;$^uv%fKFD{VVV-WI}6@u`` zEMX&y660wJJvTg5^tc_Vr8qSKTSN74%EhYL?yv!%vHUX}g!&94tRlA*PI_Oglk|-D zvFz?JWEnre#9<$Gfh|Yk1ClTWm%Pv?EvOr45lx3jc;n$jY4b5vpk9pZi7gxI6;FrE zAG8`*E7+6-hG{q*160lIJ2fmd$@Dxt3s`hy@j!mE8AR71=QN`c_0dD2!qmV1T&^0f zhK!7Sl(iAm+1Z&so_uZFy<;~zI{I~b4_ZJ;iOpi6qic}RzTI(o<;m)?74A;Uegj<- z+&t&JTt%R#E|;KwKrnTOaT`Az>O8~;JlY}u_|cu?^SM&ps`(Fp3XJmJK>y8Cwm-86ja zLiUm&)}9ynN;wOgoRTrAljd@0en8fNN5TNKGD_i+J1&qOIvf&sN#5Y1GN&^7p``Om z%vm&i*XfQ9Ui*M7qY^sX(}~(`vy=Jq+Xa)SO>X6^#Eixr+TG`r&Xv;iTy1G1a-tXIpfC~eID-_O$o<({9>jOwe(44*kVk! zR0^sXX@Zb-%-4)|iQGiNTUQqi$!aQwMjO{HUh`8RECsEI?s93aPdjDg@(Rj;uel>e ze5iNC%+yw|wC==zX9TPARMQ*fIy?_v6kStkkpijs{}dyP+hdWaYEDyle7A;}!Rg1R z@yIoRy4^mAwEded854!cJsGRBi=55}a{j89SXLwg;(>B>Oz*!f>_pby_?(XIl6|aq?y$44GNapOL0u3~( zH*YM{mwg~9Zq1*k@5WI<0CFDm08h%_a(TG z$}UIdsM1s2ypOUwl#scrdf(yV$$Hd=73+>~gprzx+OuCgD9AS;Ajys=vRBw#BDmPv zNNKVKDypsdZR*4v%o;39CW_Fxnw&j*G5S<_Wf@}5)_HQjw-Vq}>|~wxUQT##1l?Ge zB<*`B@&hFLmHCRiq9pn;_7BKf6x>7 zgNo}Ugp=3O5g)Qp`1xh}4v}ccM53IH+G2*n9Od>oD;I8XjId`bn=&@F3lH!wPu&`4 z8nyS4VCkw~OS*H5g-0{G>a#`Km0_iDB4vzzQRZfnk-c zo5d6cj`~?33gWU^z0lQk;|jr`(;aQ|8%T}|Y1QQ@IyhHSy1;~#fIB(yJj6sreaM2y z>Wi#mO&H8kS)gF}2Rixr9{s>(GoVveA@hKTlw(~xsgEs-2w`l`0OJE$J&%ZYhxHD~ z8auiQnAZ5_x*A!2Rx#dW*PZc*noOL@N@}GYez7kI)@{g6@~tG)r^@O#ZS#xfZQbsl zTGR5~O5JG`RoT*V38D=j`G2;V+<9`Zu7`5bqIUb*oGmCO4;G}AdfNzG4Oa9; zmCs5exSvt=IsPzzc}_ZP@zC}rFKn(&DIG7ufXwEw4WHrXKjgU<7Q@+ z48~G4wv1pesxJ^a{5@sAr&BmMIU1B!j4#ZIdK#bt*E;Eu08!QkIWjyaI)J9IFcxY# zvzpW8i|kLyUu?fa$@^l#6;3%VpX$OM8X6ng%n!1kjO*OPe*w|va($yzf3|FG&T78Y z2N*cL%*{W$b9=eH^K_@dBiAc`*6+G6Q8V01Yui`~p%nu^1RiGvfoQO=M(p7-Gu(e0jq0r?T0mA+WzFQl#BC*!NIO#j5c%j747syUpZH0Y6+^)b;HtN)8+rC#VMbT$Sj6vtwiu4!LBEh)oKjRWc@?hJ*$59ph6QZCR{>&nwJ|``%OvlK|X1 zCZ?Z+;2^cfqv(X$MrT5eYD9g{0i+6-Qic=#o{> zFK&4OHLYo5y+gQpiY3v}3CWnDeS~4V`PG3W9(Qz>3H{*}77((ovoPjk+N$3ZzrSb7 zMtN_;V}%*K+Gz@p~g8~u@5C6** z@e~DHH!jN0^DQ|_5hWyR>@Ts`Sr=uQcPj>@LR$**w^>S>(@^Ijgrb0`kTp3}0J}E| zA=%xD@`l7Z1fDUms4qykc=C^&;u7~nSFs8iY(+8%G8H(oiaiC`_gBo|YCn%?tWWxb z;<~&eHEE_o@!N4^;V^A!m591k*vdcdRix95_iVpSD#U>k{jUq8z5)vt7Ve$>W0`lA z|3(l%hy)BX$x2djVG$;MnHFR+17yU!(2=8o(wH*>qyg>Xk_mq8ViFu46;VISByez^=L^#Y^*a{> z1frU(`vn1*iXEIzR2!a06m7Q%scLaQ9>;MSXymWNYu#fj9K#;xCKm^r3*xy!a^T-2Hs7(E=MV?I+ zc~sbRg{{bApYr7T3YFwFSq{wd{>_>tS)KE$w_Y-f3M_c*dJRb z_|VeQPFCX)U~~a3S6pD%rdAVJ50~8(6%_?`QG~8#0*%?PNui=%M&~)nJ z5fCn+u{oYP$q{qs7kRS+-{UFGEG4re5Ko6Is%rx}LE)+iw|Z=AT4c7Ip6 zdg@@8y5c&P5%c3sBc9I?kMBGtglLjKr#SD5l6siG=LJ3#yqvruMfHs9gDe!dN5pJY z7`k60LkK}d&Y0I;;lr%(q-+l*&LNSP>k7(M|RDfEwDy6;ts zf4s{=mHlcJBV-vFnGXZ2XjR1}ry`P?vby8w5wv(fx*iz`vJb+5i0z!jCsP9gjpl z!jU1lY>wX*Sz0z-c=KIS#9?DMhELB-I7nd)>;#5}8iLMYp?2lZxrDvz!%ysYLSd(; zXRxFKl(eLNTJ={DvRWGRIeb7n(BX6n@+ziAX~=nnybqe^*;Q77`Pe)=c{(pCl$2Fq z3&V$g|2CM)$RGvDe-s?`BrOO%|0q zzfct)3Rz~%{9TvDdc!^kT~eZe;dkw}NdMU2zR~E)s45SEm;y$Kd6jJ^)<~5r1OuTQ z6zs%snA$f8mB}bsuUO7~;}42(RRiA&h!=!Szs8kS`X#b6Dh!KzuTY56cBCv5sP8U9 z4)GaT0VwxWeql~_kwP!jfn_1kfK{0=t@QR)!m?Xv1)O~>$7j;D z9NI2ZoOlLcV3Oste*3U?Ddf{BVqc$7CJH+~J|HE5q;KI18L1tzPH|yFMHN;=mmi-P zrRXp|w%WEvaE*ENieJI=>A4yDOo@nwRDm+`+*E4jzhh#n_wfmkoJoovNW_kW(u)5V zp68NM`Zdn* zjT@Ji**g<(J8wavVB)r4hdN|S4H13T!~v^8LxVy@3Pw}M%|^`~w;j|GV0gKT4r5Vc zS#fB&k}!%@1VuLbbv$=3s9YMgd9>-Zi>pnvPV}p}fx|XCv+!G6x;{KIVOCvsxK)DZ z$B51?K4gVHepTOIQxZ~Fnh?wZy~}|e!_1twn7E(5_fC{QacK#dqv=yfC9~|rUR(n6 z5TdO5*^+yAp*Jhuj;VN_HK#2glK$k79(A9uD63t&wfK#6mb@UmZpu^a4ujDft3F9c zt^W+6Uply zv}A;bhXdRa6T`A3qv&7T&TvuAoX|mYFOhPPeB0lVjAe0V?On@eLMwl(lv)VnB4|X5 zg0hjFa|9QuB+(BRfj>6l7&WQPLB;nQ#TY=yS?9D#2C?Vp6 z7$saohN4N)oZ@e=9MlzcQwW8kp4;-}xo-f`Rx^`(n@-Zf;Mm&n(X0G7{FlmrB1mM} zzE21%zaD5I)+hgw)DaYdSF`R%r2CK$gsmBVMl&ZQVsCxtHK2sa@Ni#?Yb(gbD{_>T zKT74|jxwWcH4J5ZgP-4>%gwB_UO+{WFHyfJ`KdhegVEx|)BUll!aCwdCkJW?zgT~zl1lKS1y-QS!)(Lq!e*9$m_Du>H6NLs^g?$6wpreZ` zJ_krSutnnyKDzk#-u1otak3W$l}U%i`;nE6N%3T@&`>@1@*3qqiu%vKK-Fz(mC z({^a{$A&9_=VLxQU3Ef!yxUaaVvGOa{Krq?`g7}WG>PmXCviI+UBa++!bC8i0D0dr zGiyRg$lf%5+l@5zvPY)MdaIN?`M4-2JF~>*vB6-@gOftcKG^VO_55J`)iVEvlR{+V zY|V`U#FTf*N+zTPgi}C!bz*e9-OuP8>&f5^p37@g4lTO6x;hv8L7d;Ur@`9u+*))? zURNQI8`~di#lH%zux2=m1WDYp2@*RY@ zu%IFgM!G|0R>Jh_J-M%>Ai%!tozE0PV5j^+M%D$ZFkxz<^9eI7iEgz$6taMv{U)R( zv!U+r%OpTl`VnBQAP*>jbU@hn$X=F1ueZAYE7N#TIAikGQG@EOBNJX8{65b@XDd9e zefftt&LJs@s2?M`v~|oRv^QseND?&CI(M^ch6MG#qQ^-7n%{r*Zu-Z6IenCvoH@z0 zJiFBX2$F|@p1!d$IicB}lPtqS4LCOc#!$mR>D$#1P1^r*I)$O}cNAhp6BTy!Uz2Dt zQ3~pEB5JPaq#M6j*sDQahOTQ^0}?$C0rw(X{gE?QQuLqHcR+VyfQ2<+gGG(R^qa*C z6@2P!kL)$7=Qb`BQ@5}3DYO2OK!1>0$v z*_i65*yV!0lL+SV92uV{UgVakgLzJM`M&GI0o195vAMomWcKT+9I1E*O8tfaJ~iEyBtB^1-$r8&B!o;2qmBd1 zT1-~0KmJ~_QFon5koZS(@+&;DVa}MI8ItDEBRR$0`b3`c>i94tOP8px0pw<^IQl}N ziIH#GolQtl^}ioy3Y<{U1#2v2%`c*D%R^9neh5?(=YK~EDQ&+D-f4j#Z_&>PY z7EbnK$SWzxXc;imS}HHim;90(;wK+5`Zt6Nr*x2r-9~GCo`-t&nS<(To3y;i7fbN3 zy-8Yqo<>n|vZOind!s9Kl*$yKuP}8DUT1FTb#;~wj>yd|IcXEKvmz!Yn82XIVROs? zwtWutCAD=V(#S`m0?*ugCLV+&X)?RuQIPiI8ZI|AAodqyx*eyr$G4jLhwD?9=b7WA z?(c_EN>&q%y0zFmZ&`pfZggS+p#|UhG0I-$x9;TW1_@a>Dg6_K``IZt4~U$$s0egQ zg?+`Yg`9vJ4+Chm9`{)9+u9*HOnTpD%Opv72|`NeL>4sJ?z-$gDeE@b@oTBK4 zhr8Kw`Upot4`6B;Rz?iDc0;Dqo!`9s3yru1lflwC2DcS?-F`-4!p!z2 zHm$&qS8at4am9PC0{FFBlLI9u=PZS`AF)`7tM?+TN111R@p6{V6IXu>-GwCL4K#Gq zhRAEoTO%o=j-K&3+1AU-;S$dS=8l|o2G=2TvH^AJkE+X${z)J0t3#d+ir0L8Vl+=; z>y4FLXtJ;m0U|;_+z6Fdy7!KDF~HV6p!>53umdPe3%+g3M%72qvEhLp;9TH2hKT$LT-)fZx?`W!exdhMBy-bt1Xj2Sp&@%|!nV}C|11C%6$;MPSo7&E zIM_4|@o@?W2z+-FC<5y6_wLTzH}liqn>`U%sKt>t@N`&gMl?SlvM*kKP*eiS z_8Rcx9Rqi7_-9<~H?7Nu%@K?4SEpCxPjD?E#SMMWH)3SIma%fo=kbhdZ?KS6#dFIo zQJS1CCPeJ&xKcdq|1)FVawE zKLqbhS2(<`wTYyMTlj_Ptagm;)m|%f`Tj&BSP!7`LwRJfER4&1MO=A6$47UR+P^_M zfmPEySu0KisBuQVP3ltDs_hD70YIa#w}UFq?A1xZ{@t~b{@bzMUfzIS`yo;$wmfgB zUNJ{vpqxgUu(Omi4)u_}Hi$*DhIbJ6+E7j_o9t|AL+X>Pmt9|&{~=DG^0#*TizQ(( z(c_EBewUkr3y8v-KL$VFb^$9t`k%gkpRzh(<$Va>ra!QaVAoXlH}LBIGry5HImKGC z`G9zTnB06iQBGg-S%%LNgIc@TS++g$+zlVjU^OuGl~{3118c^p0MH8z*1A&(JH#i0 z)Bl{ffZ~6)@d!fZ=?a~|>mGZ`yTWg-&R=l;H_8ViDNVdcGHHm^jEu;iV@!Z6Oqzpz zzXqLUM)!ZZa9#c+^Pi2`KkcxBPW{=|&;}v$)33~q4peO`7Mz>gX}a|T6&+*aLj=0o zYyB~K1sN`5Wn(hy=G!uQ#hv~poMeZk+5(rejTkI&67HT0W^#3WrwJ|34%?mnsxO}Q za2=h=*E6q) zhNSY-Wi^yrVCfgTm%VL?tnbfq&<@oD<~KNumb>W46Z$kxZf#F>+zc7YBi{$I;y$qF za?s}Ik4-qDMA+@lx5=7UtE}2o!`303U}s26nhT>)GZ`@M!aQDP=L^+#wuYM*5ay!_ zT}O&SZEXs__;X5OK?k>QU~9FCSzG|jOt2+yK}7LMt4#ZL@Hu5AZ&|0+{%W~pX|Q-~ zadxVEDgPc<@Ci*Zk-!hA12RR{>nCBKSRCDtsff8tyIw1*FE%u1_+9Z^WHvOsE`Gb6 zLHi_qmGWOkCz7_<^`$ZXl<@LP|Hfuk_4L}M%L~n4|2~|kZYUJ{Z-IvJK8!1Nhgv9b z+}N4J)XM5v2?z-3@9F37S$cp5-IZ=X>uX8b??JJ-6s!6fLBYZAxTt=Xo*01js4Oh3 z3TjFplskSGG3L^sjkUD?SIT~e}XeV`b+KP(G6&nuN zEEv#k@puMWxXEq@9uUA87`Y>7W=y3-)^4#!m!Fb7mhg5ZR zA2n9Sw2O-q7#>arv?QQulhM%Z$5yc=Bt6{Ru&}YC@*5+R+nJo>Z~@E0_l&HpiHRwB z1&!BKB;@2j!0M%SanxRH{-$9t-OdjF^ss!2Q2Yb|3Ard>u(K7++XuOKTSa)EN~Mv%BV;h3r!-=uXy^i&(O8iv@>p zI$Se!ibd$N#0N$YwqFlO4XHCMAL#{MEj&TcKOf9=^{^8Gq_MH$wUnOU4MOI)@en;p z{Dc`PZK*@TmY)XkXt`dt)YxK^kdi~!r2jaGEYg4s3`a2O{iX)_+gNulKHudwLIrv5 zI{S}oS$3j`^dV=R}X2*!EoU7F^ zd_K3+pOZN-bta?PLo(Fw>Khun@s&=*qiaKHM%!p3B0;jG7M9=(cII>$4Y9ut{ov^b zN0X|#Tae`FU#`3Q9!Eq-a$j%Si$Pp(o~u53^#Zagzp$@6Y5)zP$w3)!@|(lev>fR7 z0o{9gTbK9{9o?ekHbdtSDlB&Qd&nyKX1}qcN?FxugLWe0c&>QJhBU(&w>ye)y(_YV zs^RNlvS1i%Sibb;l9EXce}hX)WaW!8Ek`rGe*UdD_&}98&jjAWyUAbRR;66ewix@T4(6vs*#EBO{9riX?-1 z{wn&1i8qryt9bsKN4nmht3y|k3q(LRnpLxZ0cQCg&-tH*eqsnA#CETB8kfr{EQ9^( zu&U)wP(~X{U>m@#rv_Kjb3c1jw?&tMfsD?d64gGI$Cih4jrpUbI2jewi{e$Fi6s|t zJC&OCBT-Qm?0}Nb=DFkxt-@nVk`8E1?KWh23senYodu1j;l#M{k5YkR#nYq4W;tbb z{;NOjKqrfmf=9^yGcH}s>zMwq`L))y9BbwimxhTcc3F+(mZ3#g!|WWp&MX~+&2!3* z?u(aPI~R7Vg;;9J#hSg#1P|QcRLzE3W5jBYCwD9a|1VQ$XlNb4CSx-+Mw(;snGLqw zruCjLjN7r#Fk3o~XXF$D3_Eql)^Ie3va%63Uu9h?f9nn4&vqjeA!| zOOHH_*kB{M4Y+EVVZ2Y1fQvfmYWl_Z3wRKlQsB1}_VdrBD41C9XfQ0N?`SvG> z#3nD4zNUgcU!9RV2=?4{!wRV@on(`817jFt7%Hm4ggWNSoTxH}HZDDA*qu zL^5*AkE19LU*SmtuBLr>Jes}i%!ZIIW1uKuDwRe4m+4y>L3+u zZy%G#vqWo8SF<3$ zjNCylT&ky6U*CxgwTv00bRw$viK*{U1qI1MVTj!tk&^OBNh!aE4D0lAhG5F7%XKC< zykPS#^O>82sk6Kk%%hjpPbYppZly01&v+z{oxrO;@xi!9^`NgTJDdA}lx%|0&b{~&Zy$c*b-oFmFrdFYgv_-=iG80RI z;O6@ANi!hp2WTkOL54A&?e}x+-Q&WrboECpN-KOiF}p&J2;Sm$=I2huxwLc*vpnMG zO=bLDbD-BnVv^$YwDdco(3Jes;K-Em%I~8hGUl|akr%amO$@5jV%|L$C(yNgZXOr6 zF5VBY;IsoNvd2fnX)q!o!|BieJEE7`>($GoGA--6qOgXiV`o^!4?}H|aaDG@1{N;6 zNHmUOGWFgc4SBYf9|yje=Po?)ZD{Cht4*2TIpBLu*0S>mJFH%h|4!?l>*0=Aa+!O8 zB%`bG#issEID)m8^2lfjRmazb!n;-nImwVnP&`4D_|@ddiro7S=d`+*h>9)_u3VYH zb_!ncz1%$yrBY6-H4%;eAH{}tx?B~d28!ST0eoo|oL6I?@7ct(l!(md8+q#TPAa;A zT(>g!G`!>)!0wp*MCkolvZ~>#1IEID0n6ah|NA6~?{^mNLFrzraqIZYm@0ARx&6#p z?m@EpIK%J0jjj7(t?t&Yrpe2M(l6WC2!6uaG}jDl*gFi_TkUX`8SQYUY{}5OD|Od( z9+f$raBElE?hxv{qoK;{zMGE1JRU-2KX>ttktBL&%S7~{;Wf>}W~WAOLC@aFBc$F* zqUZQ)?a30)**go3+hi5X#M(b<--ux@T%K+2j=i+$N%{A4X-BK1Mn6JCevLnyhu+(US%qLN5~@J)BUxdf|~h zj7r?Dl_XyVeET*&ibH~PobUwYM)2+602DJPIhtL*3iMa`VOPlwKk~~y@GdQ578iT; z>Q&q7-ccc0=yb}YJO)G!U?U9k{qjvy`?5}+^eP_*Z$cGsf`w~VXH4i)*LzGq^m?!U zX-U;u9?jILrl+8!%s$0$OoF!OY`{<^8m$b6by>vJ+w7reErU z$8096Urea*_f7x)3cUO{=Z^x_k=F2{>S(UtKhe@+u_@%fP2YTP*V8Q&qMUzJ?oB4r zCol%@UlR*BT6$0@0x=U$XljdqLtPa=h9VU@a2Ng6;}`@5zY2@`Mn?aXQd1*^79riA zjgj=yW4yR{_I0LAEzV1k5x-f{%S0d$*0ewfIw=LNytnAs(iRSAM6H6Bm!syarj=y( zQe+T7M*+NqoRTqlf8YmNO!N;GSz&E2BKIr8%!abyXpDmCO0Fd7c<>{sUZP&4I6YN* z)FRkr5<$jHoK!PoS{z~fUKS0L_S0g$%Yi9U{ndlfXS36MB%jfJM?|Fh!M*Ob4Li3= zZ?OkP4m78myj(N+nV-`iHFdiqYR|j%8Yc-Ci5_fY&&3Le@7g!)z_B~lP~RCnIGQ;h z&gm*wLLQIVW<=yPXW|k^^Nfy{FU)Vj)|9x-5;nPb z%@lpoo=juDcGqeTIz8*dWkvTZe7tNfyj#)ICr^xsr_sDVT8hO5E*_qnroA|p+#OtlhZ$t+u}@N`u& z>$=Zlpd*2PF&Eqy&CjpewK^Bg*Mzr`zi)N_$mI8$)w*rBOg#^nKH|Jd1`;97}f~lmt&&> zg|v#Pp(UR%w5V!X#fbrk{&)ZSBmfGxnGKi&>~m9N2e~gt^efAb&yH$V%5F?qPH&n_ zbwor+W%$l$bZFIIwj7`9J!t-qjt;JjHWfp(9F&Ki6`L{LQdv#;q1#Uys#WIrdu&#~ z-JN!Anpx0mNW#JJedN2YzQKEON$j@RQEUYKL}3@zS8hqa=PhAiq2J=6eH3-0itYl_ zj3KJkdavCtH{{ior9FL~O}jWWVJxid<74_4vkxcH5?O7-h8-4{bYg+=@gF0b~K>w)}UGJ?`3^Z|>H1{z50A|mMX&IfuQhS=E?%LiwWXe(H6dqx|_5QpiO-${!K%*8y6*PB@90tF@|2b1OBT_ex$v@ z$8D;ei1ti=b^KYv<%g2khI@|*b5`f4jp5u$t=AkUBHp>IT*s^Go|Wn!1ah5Ow>?J) zy#)1U;@z|ZD0}X<0*3ws455wPHcC%t2#PH6@hegxLJ~1*SLz*$c)#>_R|-f$zBPFF z&|t@f&oUA1KB?@Sr)a(!VEi-Llgcc^q$~sDo7Vzp;T?U`pvJL8W352J*F9ECNZ)#K zUK*8GwbF5i!lJ`y?lYRdaSvt&>HH2hFz}?0+MvCRCi3O({N5HG-P~b961`cPUcvnH zFzoT^YI%>-&D+}Ch9fDr5(ImQW8~l#v%Q-;aoyp1yk^>O*Ao-aWp072dKU;(fh(p=1pQ_5zl+pJ= zN_xkTdgOLym*nL7jj40H{!$htjsFVY z#JmkJA_r_Y6!5AzxRi9X28;fK>lU-EzZ+pGD5zRjY|h;Se@bKt<%~0NQ2rSBu@gEx zL}Iy(lK#FOjv)cOMXq9zPE#sHAALla5SX{&zS=k0*hMVVZVrNiJ@c>&)ybPQ|K{@o zJDMx1fQ~zbF%J7BtScebJ7JycY2t{o8>&DsTjaNhsKn^^kZ;FDdt<`jC zy}3X5&40CXGQF{%np?p-L;87D_#6hVZaZ)H6#nvH4h-6!>aMP?-PWeB%?EGvL%u>p zGVIFS_xjz%J-KnyaM_aOX;)aXO)^$y9Le}7^{ov_$0Jc=e4qdqUe&Fn&jj;pKbGWt;6m(G+gY$#=yOgEM# zk-sa*N3?G&%0Qui$Ff-e_J%Q$|NR`hNODK8M4wusVqa^m`yp+wIThFznb)G< z-;6gxIOtGXmN4#?(n3h#;`NZLWM4?)gK4vf_8r~9{7DF5zW^pzO=Er)hkKWc$B?`{ ziv5eVSfBSF@p&UF3e`HuBYcVZWa=Ky?D*!FM)p_(AJgOoOPZq@Kip#jGZAao$1j3m zbqOhyhgQlqc>?2MFUfLVTnr)wQ(NxSTfDDM4Z2ld_LB(ty4N&L9Lv3sBHJA4JeIho zr6$5!z*g~i@I5y6<7%qlKjBp;&pJ1!rsR8D`itP;;E_EC;qDF;R8%odO&&xau?N{;ACO23K>I=+2)g#<@xCi~W`eaw>yNmdTc>1eL^@!>A_cV2eW@92>c zhSfFHK$(vud~^gpqj!Jqn?_tDV(+Z7VkE zFX*_RX#5dB?H-jiIGxYjWek5Evcj}n1p5p;Zf`ITH7-=58x2cW4lY6y!HB$1umWpGt24yBN=@UJV;|^gK|;1W!<#e zP6?0?jL^|RQKlfP_s42zrGbHCqa&f9U~sw#<{f{%Sub zy$q+mePyx~baD|9F`N!&y9=!8NZijql6~qiKJRe=REuztn8>Z$l6|>DMl!n0e%dOU zPG<;A%iY$K5D6nc)EL6S+S$Xw!L3x`TJIm(`J!~ErH)|vhsAyB>L`B|CS~EA@X;GT z2LZ{z+0RctWRkp__H#*DT21(yAI3}>Q1y;P8OOB0Bt$evUb0~}i~AbRQssUtB127o2_ec$@rEm(3I#9lgi*T9;6f!grh2B-^hBDhlHu@1PnYYa4=> z@vED}uH`x!+p4^PHW%m=2K9rPEfxcKGqrMY0=_qubs58vQIMz8A=`)-LQgdRc>#i7 zOk%+DTNfGZrHM)pA{eVye4Rnz6-~;Y7nIQAH7;)#aScm)=p5YV(@o1CquPpl=H0^l zT(JrL_QSj)L)l^YRvF3#af}9Rm^yaY9~9)>9q>Z3zDDqA_6+mWX6J6t=#>h#5=kX8 z1ihxO4b2o3U*uEv^u)JrzJQVRdJNj#4JWUX%~O<$V@gV}Y6{EU9wL7~Q)|zC^|)qr zb-E_Q_d!VLF69CLlN?&|<1lKWX6ZoVkS@dVmG^>-xq7$WrspI-_?uv|w*whKHi#?6 zq!)wa(>O=1*7SS>Y5ep^H#oTCAg`t*qV@cN_`iPr8v78TrDLLpx#X``QBfhQEhp}w zStvtpau^O)$e5e&xheWg8fO$1B7pP1TvV})%WGru_mh*)9ZjeT@<(zfeSLlL?CY11 zK7twFc2fovy#0r3c4MDKzYtXB&AD0Qo0+Fl9ui+3F%G|=~B8&5G19fLAtwJx*2+aA^wZ+ z7yma)T*}hL%yZ8@xzFAg04^pkMV*t=1{P_tu<>QhBnSZqRq`EdyPYvmET#=h)D;tm{`E&oL^^SXzUPE_(+ykdj!_P6N~nU!SW9gz%bgn zsFi<_KwW)i;qRa6yN7ytxS;e&+rkrf%>y5YbTAOQEbiol6A*Cfga6hgil6@TAM}XmoeJqVElpQ93olipo{vP$1-hhqCpPcEnfS|%#uM&idm-34<~mrW(|?f zgh#@(B4N$R6AG%xtPhGDHQaU`!4rF zvMuLLb5~oAH3`Y@X=RP&&jSpWbA3`?dcZ6Q`3`tUz(9}7(Er-AV7&pj9npuT3#$P(y-@3`nnDr;4kFzip4ua3)=|6Pk<6)%`^2Y4VmXdNa?L6sagLwLKYl2E&* zq3^1JB}Ymf3<7l{%$!`fn;0J-9O7LX&A*8`@BOZXgHM~qj0)&pQj>+l1Ft0y7SrTR zRXHjAPJ}fLIm$KL%NvX8>r+Nru42K$b^M}u$b6)|3^7+If0d=$Tism%rZ>vggX0#Xb!y{qZ8oeKd2ze87z5`&H-VQ&XM(qwtsU` z3j5|DWok|#YmbdEI_(PU8gI|R9r>fXg(a7b?uGj|%8nJ@*Qu}ldzzewFK2(`=El-x zc_t3&)~aZ!J^3{D!EEO%rF@!D*nU|HT1MF&)Lc$h&U5pE_sVKlrKs3O$c~dZYA{(K z;TbDmmgAhMkR8~nhMev`h!j-zb8?+7P~cbjt<%DlHLN*pWeL`Hz}%RYFE7kB4aLO+ zpTYr1pCv^TP*>t+ZM_uOpSE{^I_udoP5hAGim6>5KiY2@9uCXwWu^Z+M)%MG&^bSU zTKNv*;^Od`Ps`hBAH(cwrj}YDQD;j3>mt(Y9ye=5{yNqFnmbU_(5!Ol(h<2iuyHy= z19iJWO|i;PHlnB}Pp)vuh}t55;wB4Nk?#H!7e)XqSEFBFf^792QS9Q;A?O){DoI&Y zHDo;$9v6UnAET#^M!-MbocPD~V03cL8$c0+gCp_I0qfpRpTc3>5IBOqK%95v@qZ4i z;^wMElQxT|D{MCf!sP~lUFFs1=l2iGcN$UIPJ+pYmB8nZ3ts)jFkv zqc4&2jDP+_mrF=l`ogztZfX84BVlUA9ECC(5h*Suhe-9^K&ry&aaiHh(lZ!3yLE~v zRceuiV8o^RsI9vvS?;8ndu7=#jHG9F8SxVGpWwsZ?@`>}I3R@#{wU+mlG5eB^XYIFxxMYrC?DgT7G|mEE z;!wJciSEs6@nVlGxBQ z*|yv5&vm~3*NAF&H}F2BX}P`SgjPy@H|`AmCLt+}OGG3ILfxb8%ZnEtUyw?*tHO~f zuIL_`Acp$HEJ zs%VIT#bo4X;o6nfh*brV`$=BJX{mMhKXd`OM>=GIw0~fIiuZoNU6g6-aK?a!i>q_} zGB*|nV{@}UiG(T9ZplDPZNt%9-IzJ!+iB-=Mdn+qr zSTvdKN=0D)YmMXHK+LbnUq>xg9$@6kyk`rQ}3vy^v93x z^@=NXaE}GwR|3(`B{#wKh?e0I*6gFCbsH{XSy{Py@ZrGaJ)SKqtV<38WG4;JNjz>> zLkMFJJU>cVZcDiP)_lOm6gp>9P#7ZLKYNDev0hp`mmJp-dJdXiQ*kZOi)*_7u2KPP z%od;%B`6B*fBo`?_=()FP&xfR$}Y*pNgLWyPa}>(`Ytw-cVe0>M486^9q4Glos> zY4Q|Aa6jd4s&4uExdFd?K^5L~{c{}?XY?35PUfr5leNfmEO1p3j_)#c%F?jrSY6F} zV2!OSY9Cf(nNnmxJ{2v^n2o46JeqU)<9#o1MTU%21+uac}v&gpv zP;?y47eTqXZwyLBgqCHz1ikgq}{(O2v?sYCRJ|65^XJ~k?bixYN z1}XeW+Xps>vHF6ue!(m-OSvqRGZ;wuRj5O@CZ$FRCG# zYw+a-1vOvB^3aP^LJB#r`S(D{T!tui@NeD|6O-Igs~UasNI{UCTc2BV?=&@r-gtcf z7eOBZ>Tf@@!C>DA3FI^^kN{PdIkW}wMUu|3lg6V;U^{^00AkvqBO z@J&@^#8>X}Bql{1m1p-APXUEQ3g%h)Q|WonqB?YvZ^N36gBIxnX`|=Y@84NeW%gij(gT^R4qPIxUbT%l~kLD*sgL?4fgb2*fHUjEm$SokPIrS4s7$^JyUjEJ zqC{^el9aoL&^O=oKZ_*g4?ka}7Feu(J^xGz4Gm*;tS8f?_iIkiVlC@U!A>Y#esOty z=HOrn%ToF1*HM;_!1cC6*GzNy%;%r97&Z_~DqrmkP}FViMSx>>8|<%m@dCf{svt{v zddY1f3WzF10Ql(XvuB>iInuLDuEns+gyNZVFa01%NpMA+K{Cr>IWj}E~Q%+r1qS?{j#b%VaUrqF$s zrBHhu7xDAj<+@Ltih|EGGzLZn5>IyGl#FY11e-;L54{aD{Qo63|9)HBcnOx!&k-b* zKUh_$fP63(&*sW;myu`7_N+*uSyB4UruM&noP@|kS--^F62CTig8OpGS> zUC?DisYQ5FPfR((BBH6Bdm5S_{g`GLht{0WuWS zy^&HKjwB5L6$0J@5^aL4!tGb(ycprA>M>6Co2Qp+6>3k?ToyTuu^zO2LqFy}*J?&D z37W>rFU`NW^`3*j=i?8fufncrvOQ8|oHXk)5SLtMxtwolUp-a$py(bISs#yb=D<~S zi98gsZ0X!^wfY8+!tQlWcFWTlb_x4L?jj>DN=>Y&$S|=}z(ijOtOHs|z%SXKU*ov*jYtImj`XqZThY9u$Pd_{yoc_;GYfrZYAKL8nmP2PR@1V;$Eji20 zJ~M_7-GeCwF1vgI@But>4#MM;5KM@m7WB;o6~4QPSMJd?tU&+VeKY{~LSm1=L;5>=mY{ zgQ#VeKm61b_t7ChTnk?c+8^l|cx(uwn20#%67tbrYo|Pg}KG)X_b=m3!xgwcjS$w2Q#lq|KKjrl z?@O;qE|*>`^wy?n;MCA%6t~*^mph6deB-L)UjSg`J30PaZ|}9M6M0h6%*slR7`Xh^ z-Hy7GoBf6}Hm{x1mgx^%x6p(n83n87@$$wfxZP3fO73?FU7{2iwqBc24^F$11SUH# z(JKph?3eoIFZP9}?+#i0w{AT{0(n`18(0Mb)~my!6jjXjuw{bn|AiKQ;p2Y?no7-o zjvU^rXbj5%&i00=GzJD{Xv5Iozi+zDEF3n?3BGdhh5dnZP7*mL=%I*`3e4*3Oeq*L zyPX|7SZ>S;%JS*jDix$JK0fNGnA&&dOE&Di%rNHZWC)QntDQg8^99B}U&P*5`u=|FC14^=NHln?g_ue` z+-gzKe!phnc3=)FCekYlAP3mNPH48+L)|(03 zh@)S*zA$JF$*8Kjb{}+w)rnPFy2oKmGRduRx}=1CFx?YPF7X!Sjk)>L2z=kJMd$6t z+Mk8=+Y?G6F07aeGUnZpb4vn>Z{Jc)6pWahV6Gti@;fAc0rp$B=?{bGfcoF*EUpqR zMb_xs;Lu5FBjK)TDLjCMG|Xr-MUgK6W)4p0 zc`iS_%FgDai1OA|(86%?xCUw9B|l`bo_t2YcD8P8{nB$geH~-;THV2c%`)AKk;3nk z0WL~GfyuBU)_M5m`N@eR`NIAFH|guk5Q=1OUxD?WXc}hjM=nJ2CTQj`d9Wfw_!_pu z9QhLKI>fuUd_?3--rZxo9N;2q7wi5|zv(ln0R7NWi-l;HiLed3be0g` zGypsUh?@goROoRX1x*$<ezK0ocm<0sj{%+DlzBotp4S zdQO6`;tEsx`%!aSSgt9!7m_f>YbST2dTxc;W*@g z+ClY7NG5cBE~WJeJv`IA{)|1mtSQc5Q%wcJCxxJY8*zw1W2|2vyQ?Fa;_ahjg=)TM z4NCA{SB}|y@N=YS<~45CBxGvZr07u`PW`=aN(7#FJ;!h(`|#Ju7?<1Ctz>%nK~R&l z;J<izz>bYL(Hpq*Cl zRchxyunI9SGN#gHdL{1clqpP(6Wk%bS5rf&4i+Se>}IK91<+8VV<@NN>f(gQ`rX5- z$_qcO-@#%h?60~dp`OfcjTvA~xXOH==l91IvEfAKculqHxnY2Ph`5#k?d-ax3&372 zJvGK-v|W2Pa)$Ej+Io!2uJxK0SVT=t4U>LFyKkCKsl|Q0v+$*8d={i)adC05Xv$`u zv}gC+r?uoDsmE&V%CQM-wvpF{hf*NS z3ZvD-hoWH8Ft7*Y1R}FL&r3*w6>hS*8qBM%F!AyUY+{_r8$4nOGY`VmoE+PQ`jF56 za7>L$Kc=knt4ls_7SBwW)Qr#0c23Hyqo86OOliygOT0S6+DKoB?d_!ew|g}*aL{kwW`auRvhUo26s*xX4=bfAYLuGF?=+rC?= ztkwEkQ#@Xck=w%eh3T4|kyfXWi?!;uAZk_>zrIgn`Da%5Bqd>Cx9n#*D+b>adc1_u{+fXMPTn6>qm^wa4n2P0#DSh)4` zu-Qh-B<}@E@n8<)wLEe%%Z)<$W!)>8n0;Gd*DNg2J((WCy}gAjwG#w)rd2vWi;AAS zq^x+LjRP~*G3P$iioxXgp^;)9&v5%s!p-_SD}1hYXPC4rQh~;&sg-T# z>dx{@n}P`$Npn0=7Ht_BD}F%dIQXq2ED}Y$Jnq@Ee-(dkI4D?$U<6sIFjMa`x!Kh3$`=Q8U; zavJL;l#+ak9zV!S`GsJTF*y#W)0;nmYd)Q6q|{Q;+97M^8;&v6pX{8rJu}ms{E-;o z=GK0_KJsyW^M%%vV)eD68h&v^RDD#TdN#e&zx?DaDJuXAprD{+119uOng)LGX+zzf zXRLp0F^(JV_VyTw(=d>oEzKfN8-^yUU9M=}pl0Xgb&_SPX?a|=-)yvrH;ZT}RTE^! zC-a5&ko%|pIz9%oi3Q+p_4GC}f6-8`IslRd3u;yfmaD5Px~wdfkRB}{Mhy+Hy_`JR zz)Mh3(;2qnq=U{S-(rg1fAJT-(Msz}b`>D&2zgHJJo#?f3o0D5FuAu(76Z0Y=Jm^` zUG9@X`Z6qPPp%{iZSr24S@9cqG}65^N%DnEQTxoE%3OLbo(o%aB~Qs97;MGRof+)7 zHQjINZftJ5*Tr<1toB)E(m?-G9<^>mgaz!}&!r4&tF;816kI1;ibM!ejBDL}K1OOR zoS0j+?0MS{i$3PCp#dKjVqn@gb{KF(oFR{?^J6U=^Y{l52m10)S&5}vcQLKm4L|T3 zm&UFY57~&(Uv>95Ec07_&ESsR5JOGAyYss1z;e7D{lIkvOG$RW{Aq@+WPTV-Dss1` z+u#4XLa@Pqc@9iT4hA;I3JkZ_&PI%PYIvyOWdq=Hs89wZO zKvg;~QRh#*`|YeRvi|eS?}Jo}6eSo0a+vBTW0xuz8ob8tp6=Qe+U3SB@-GP@Lumzh zdZpFTD3LyMj*EM+7PxLf?cHZC0gtoJ)9*Stt*E_h6`Mt@xXHx>W^W`U#& zo?IppSnVq(m_i%FW<4|Rl9BpW$PB)nyYf?waVt|W%YDTY_k-`y!wRnfSTbBOvAy)@ zHjANo{W>jgV}o43+5nhR1t~7>w(F4N$qD&Dem>0`eAgOoEvDy37s|@Y1{B4OptCb> zT_be66Sst+^m!RV@hLaABS)2;-O=Z&4d&ChBZr2DCWL^4fPg^A&k^^OcS%Yw9eM}E z2ij{v0!fh0ja)Dw^X|P-7OC@Gc!JRJF?A+)I&aLx_8=vv^9!Wr%!ZpA5zO~0Hcd7U zP4(Nyw{ooOSLTB^*-5z#B^b>j5d(F~dBtk?j<+AVRCT)M=YNc%z zQk#&J>E>M*+o{oJeJhqYkN%rZiQ;Zx31qhpF|sLb=K!e5A`S!Y_0c8TE39XnOijhQv>_0 z7jcF&krUFZGTSks7Ct^J$i+a)VP>!`;A(f0YfhhOUUh(4)+SrokOX&yIQz+0)k*qC zvO`CXxZ_ukR~U>^-p%NFBdRCh`M?f&k6hi-qNa*9e|cS?!66_960)1TqUPWr{Kg); z+QB($El827tD<)RY>#B$wfV#mRhsNOcizwA(3dYi?d%Yi$4rs2Xf7PTf(z+r>!D!Y z_>pE0QEqIW6a7n+eZECfK0diPdF1vS2(p5iz;lvm$GJ^SrxTha_iIA%R&Jz>KKW;n z+k=)G`M`|cwcum^7~>ih_0hi^{ahxgpdX%x&7Rx168|ELPae zfHY9=FjAqnpLEEQg5|&=i<(YvzqG}m)|i?=-$5+xB0*hUO+($YM2?S9;!LZ-YbDyw z8SswP>6P)gz7B8yO(w{XZ+Own``_Ui*Gb}&imS4|=pzF%c+e)_ly<)Cw|DXYw$908^NRC_qS<_&BVkl9`H0smMRIs}i{N|=N&rI# z6J~_L`;vv~pvqHOK-AW-vwf?K_Z5(!KhwI21`K21+RLpe{wlZ$Sqh&LA3-`Fs4j>u#6wiz6T3 z<_5unkTBk`2&A zbk?YGV;7AyGQFqhfRC03pFlHt;}FstNl(xH3N+y!9w|vlZ{Lz5kE8m6-nr_Er3I0@ z4eIWwv_EwxxZaa)_7|9Ml#K&mFvE_xY8__rkRP$JiBcb3pCe-&e7{P{W&{zRq`dVr zXsCZCu|FKU14*Q#$!v1mIgHr^O9hLV3Tp=Sz~9x>unGbR`K4 z{W~7f9VO0vIKUbm27fp0!Y1Q$$Uk13|ECTj{P5NkadAbHU*v300n3+_VK(L&M=lWoL8QTYW9=K@ zB$-6scS$eE{j{|f{3?4c(mb6N|BI8KbzQ*%)AQ4LsHa3KCkhyf7hp=4qrNF-&rv2B zEquN+=|@;CmVBZ7gd{HX8L^Va0e5=BJ!w_&ZCqXU2~Osu67iuT58lklZG#Wmo=y{n z5{LDaSyyuXOKK@FuHkFT@RZOR%hj*BQ|Xxf(vhQ(hQ@rS68M$ZAy#SMJeIr}0Nn zPv43+VQ$-5S-FMK!GHM@jF7G39W9NHva=v_5sj`yEG!Tqx^%4x1$mm#?P%cS^yGQr z;qo4c*=rr^Z`B#`W>y@i4gD^JN1Bh({I5D593j4#rOhApqbC{Y~M24o|{c z0{Jg%OWmm687-`pa_s3uyFlMoNexLzV+TJR3;yg`aWjr+0h;K2q^#!vP$!X-z-81 znO?=^K(cOzxh@QX&)RKL0T6<1Rje(YX^@ufiY4_V!{9!%z3hZck`(sOpv&x8(g+Pe z_HXPEfH zHSOEb@5~03u@rtf!@)zkfT&VxcdN@6ME5^%oSX%UkH#8F&ixt0`bq0PE?i-N?+Xh@ z*`Cy%2t|2jy4%kUx)+K6rY2PbhhUy*s)`G603BvrAe^=Ttom_jvia|>ygesRKtp<( zQs-xjpsv8<7O&fcVR@~tP?bS}sg?uRN|6+*&AKXhCssNhOU@54VV+!C5e!8uZ>)SV z)D>VKsuN6{xpSnVlu6{X*#jINj60u3(e(?VHFvkR4v6k@&t=#$m2C&PUT@6scrRrt zez&mI!y>TgWaDA!eFWzqRZf6SgCcc4J+uh7nd4g3MvBFge^-3m*SI`diW=BFou#9* z#C^nzl6xL7RO^haHdHufLM#)K60iw(mb@48X=tR$s4>74d&KSa>j4=BxwAbjVRqoL zj~XF{JI|4TMvTeH8U(KJ=g+M%>H98lZK``d!W#VHVcU;fVY6!Y0Q|L} zp=;g^lxMYr>XDw6zJbodM|02_El9(~JTjTaC3*gJiPg&@E`?yt5R7h6Z3MTGM~a^*rJLtld4DGsraYJtqZ;Z8%NTz}th5L^TBKAt>QdeRCORdZy-Q{?ur`*;6i)5K8*;%|~g zFYxfKW%po>r2h&p+~B+#l(FZo7tc$Uex*SCb-Ej(bOH5p`|6Gt-}6s^Ymi+eaY89& z_;E5Zeq{^9XxRwQo7HOgv%|!ZeSS4{)zbyF@=Z>2vqa*c3vo*rC#NC>r+A# zB7F8FqQHl?+i&*Hl9!lzf_5~TF}lMv+J;WkzqV77Jp@t3;$8_^!Tl1@FBvS}oa6Qc zSat+L3WCnf6vs!viVRh!(!iAjCmaBa&Kk~*KjKwt?-jw=Z&q_m^f6%o?ilwg!f*U% zSM=zQxKFGW0(|`8>RnE4hxJk+X!~oQ(>cxC)E#} z73$39oZPdA3%?OX4v?=`45ilW-xR)uqrXGK?AIrbjmuWFNRf z=op;&NH@rZCTZVnN2)4qj=0~BH4E8vyBvX{eO_KmAGpcWgyPv|%NXh2(Z3t7$QvG7 zc#MM!GC3C3ucR4Yvx-{W9qyL4w5-nCprE3{f8Z5jpb|>&p}67o^ZQ{pv#2f}g1)-k zx)de0aw(8xXhRJ4VCX133nv~^f$#r+8la2F%{-+rt4sPnu2c;4mv(Zuw(u{HM0*=4 zZeswV5o{4G9`c-f37=Gq$!Bn7?w2)vv5M=##i1g&KwUw5jtb}nr=4xrX2&`&UrL~6 z|El|9UOas^jGR^B{vei`wu!*@uMBbY881}td`etz>4sJjAjKsjuUt7xdh7Em^`V4c zBBEpJ8Y6cGRLApobey*sgv=NO5m3#OmGrl=%o^pt`${lGESa((N8v=-6W|EZ90aF%Yo)RnV;RJUXSgMj_!I0)2Ij<+t@fGTYva;2SeCt5 z($qI-Yta{kf2T+;ujivj=N)RQUE#wIm(vyidc{j4Q|XJgiUhi{Bp!Aj$?K;S`1D#l zmW_5YfPm3!fNb$2f-vaGyUwY_>SmZQfbkT~h!k51ed0kM~) z*(_ODydnS66phu)T;APZSMVEwjiqgHW+or%`F#JBIsI;)1&)ORcNlk@7JLVIx4{3i zmIX1qdg)`?W|{9(t&YTnM(MMi!%1D?4_)8|*u;U%G&+Y4ATa$)f zDDm&FS&VlHoRCSWyaR2{)Rp?P+d9nG@P0i6J5vPT_$2UJ|k^3D)1CM(v=;;E) z@158B= zYi)B{S}ueOJS_*~*|&Rs0;YI?iB;CsmF^#TZ5Aus$Vu#iiM}@R5PEthDt7jO4Y9z*@-(mhw3bY_ z{-2Xm6n-(+o7?x}4m_-pT0? zNLN^Km$m7b(rb8>XV2(-Jy!hh{i*m*T|2LKCpNDE%m#7PowanefR_i(;UdnNh=-vf z>ow?3IaX@b`tXMjNIGPvXsdQ#xbwfg8W)_uFMAUjP*(9X>;kA>9j@g+HUJuKg6(Rt zvB|ry4wL~1DDhy7IxH-FCrCDkPd;D8cyvE3D$Hc7I_wGt!^X#dJDf-c*v?$)$pBwF zAOYHU{+&B!4OW37DFliATaQM5{qwz)68;l5lab+QMs0Nx%YzJN?&j1QAp`qvc-duL z!zlYCkuUAMva5fpJ@kQrW zm@3&s);oJsIQU(Swi&<+2OG1w9q?U3_EGcv-Is`qiWvI_1gmiKLAp$ap@dL(Fh1a& zF)3m*ecx~H8)!rKBQ608@0+8fRG{gq z3~M~s`@N$-g1s{tL$)SPS$qBd*FAXl%DG*S7UlL z*Yx=lI&J~Ssf1OiC+z%a?*q+Wh<9UXXehe8wKeg{32JrCg`RCi_4%k3@_A=h&xMYX zqRj5ZmZ|$2VSJC_XTA|}oT({NUec%Bp!=pR+W~v!Iccpph9|;_I00hvBAY z_`e)h*KjY1qILTiu0F))A9fLHNik4Za#W=x~RD_xt$jz3%vS z2ZR#mr?E>OAG+E3`%kgG4Dkt?r)x#L+KtAXWk0q!iA~#{R%v-IIkD*RVOD9=4fpl} z66mdPxg;=q6_=OiVr@FzvWijGo%sVwir%3ilk3We6d}h&EHy@OF{n7sbD3zjEa-61 z0;X(DEK5T$3|~^2@>Y9$UN}(GB9;+nNtFo;P_2ij4>Se5EGM_#c({aqp>u^H18|!S zHz)7Hu(ahC8x1pgmCULP)piwL9O>?dq=bkQc3$Zc3JX54<|y)>S+ z!NUIb4eu?yEEPxf8m?-Xl03}=Vl6VFpHAwY14U{3()+11$e8uw^Ql(_F+}H07wX7t zy0(1dPVBlRf#gaO5*vCd@3nd}m%8AZ&exvl`E{L6?6o>}G_IOg%?(~T;@(ti*Ez6H z{1`zQIh)okcOEFEuvolm`KXkiXC`VhQ-)D)=sJZ~Sy|~_qg{RV7LZWUzh-`FwAA3v z=W_gVoetfnY&*+4v7upp{Y=ky$ZE=yL(;V8^k<_;2W#ey=hg3r`!@fRVoSf6j&DBg zBI0*|UaKO5z~G7iE{;}dbz4bj36f00QwFIK`H}s%+8XEaI)c}?Gij%-6Vt&|Yhh}w z$3yPj$$_K!7DvzT@uha!_V3UXWbLFnL&GqlOI}BogQCHXKVoadxc!PMh^{Xbu*!mb zJizGXCt=D=-eo_6q=l#z(PP{$;Y=Q|ANCR53lK4d#y%QOdhz3tZoV=hG-4;QEwu~N z3XPqZ=qe5&VP~r|@nQ5tQ;t1L=Ed5GqGril(UeYU#I-kaSd}^9dFEVsxX2?ML6m|< zkByz2h$q)V9ggPC3rY0+aC92?Lb%D$cW@|dyH+m^FAXxX@^Ymo!zMCI{c*s5-xs?W1MjPKzHzV45xr9RdEFV|;6{ z`6cP7s$Nr^<-;X`UHwG|;@&@O(mD`;KV{t~o)QSnaYI0Uj?9($X zzb=}M?M#4yC6+6&XyS~Gz8Do(1-aRqy^Sx@ZP0Svp{I>&OE6XK)d-DE4-vS7 zpH{ECcCLu)Ph{~4L|3Ym)=f@J=#5h4NY2QQ!;sjh!;6daaPk#yc@xTu!R355IBA^W zuV~=o;i>ETU!gbz3rpqE6_3uH(slV(3p6cGjmawP+F8rGL#=^SXN4fgJNY461{y)q zviMl-H?mS9!F^nd=HP8gbV`djA@9$Wt{$(7!wFq%tdokke1)}KLS}On$;q`;Dr3MU zGmTG52)1wBS(8(m_nSW_Vlwcd+@C2&%&w}6gWPY6A1pM6C@o(QnV6aYO*9DfY%8t& zq;teiR(Ih9w?xEs#pVP7thqIyDjAO!I z(Zd*iXM?Ps_w|+?wUW|3#~1cO4(&$YIn6mzuAs2ip(S_U^vmc>Ut3)s`;F`E%uO%` zJDl(Dh|!2BjY8q=H;i1bXeQxW4@F ze83U)UU!?Z8!N>W)R!gD7FgyDJlYKr9*EbcA^~qcNonHl^V+ZHYp$&Q$r-;FY>qJ| z%%i2NGFufos{2Tzt-U*2GEG^eu`&2cFgBUfhB#%{N~=^usPrQjR|5(XvLBVrNhXeu zi0HLv{a_}4!uce?S)E~Nfa?Y>9GC4@CKgTF+!y0NTYLBdKGi7TX@-Zm0X$d-=mA0nxA69M`U!l{E`7qT9%&B?1-lJuU%ogZ#6M=jIlxB#^8>J z5PkH(Y5c%Rlu9T1TJF3H=~*GJ{v}3BhVT9x3!w4Z@Bxaf zNIcF(NR*P|vpZn8=^Z1C({i|5kY#pxQ2!!|Y@zt@y{Jf-3`Wc41vgEDgh| zIeC}(C|ym1fyxMixP+8ob-}VtCUf?*zJB@j8=JD1A|i>Feh-=gjSZ+zkoCJgvrmN*4JvDC}}trsNbNlF}u}1|L7KvIlTE^K-}UU2G{@O}BB)cKdrD z^1C+k>MQ8je&$yMcQoa_@tX+jFp#42o3=`pGl9moLziH8th*^_hY5 z5wv=^x_WYSe?U+NOb(VYV9Rqh3-#+g8@Y>Gc{rMJadSfuCdguX&75CyzCn;tO-Fn3 zS3HKz`!d~cn_pE^uRi@^f2Lw9qZS@`4WXOfK%wghL(_;o--_5AKOdIXTgIZ|qN@&w zKjIr3o7WGwJZ3+kfh_1opMbff5TLuEdx=){Pg=~3z zwZ2s)854p+1Fd_*=_EGD#ogQU?$A|DO?@4Tc_48TJD`&S zH}Dvb!$wmIuSiYFO6z5ws7y{t!3sc=G~?nRa+vxe;n#XdpRxS1SWdUjYy3FacVuW6 z^*zF@!Gx5e$?30QRw^oLRu`T;;8@Trc4nXCn$pF7QAAC`Lh2y3<$p@j)Ok^kK+q+P5Q( z4uHf|YB4Q(ElAhd&f$SbHsS#*<-N(+4kpobS_lz+tEYGS2^_p(J%j`ZrjuxzQp0WH zZ3>-itS@>)W^Ss<_IkF5mHblYoVQLF3?IVR)-vcmCM6^cA+C6R{i#|275wq|lpkLx ze-g6v|D2AnzM|wN&xmDsbmtxdrb*HcN_ay9q+&Lu0FI()^E#dn`B{CnnKLEL0`B@%YnRZvF*} zpF`?uH7*!lLJ@tPYwQ?yX^DN+=pb11{wz&C_zPW#MmQe7-!jI0pBhI%V6d#QH0-Jh z;vSV#i!w+h(jjXHeVuc0ePq0^bJy*>)?-Lr$x+LtduYEV$112;^T;sFz522B6(kcn z8raJ0;uJeCK>|uwJk%Xx|3LVNdkMj$$o=snHFZzc+S(cg>2scCUR+9wq?Z(u^OnIU z;Woc+XN6?GZxpxCn3HO+*-9(w5Dcrsolq@0{M`WP7G(|7{4tG10Q(yxvG z0Ad0knBYU3X3LE$fUh#JvKCb4qSrR2bV>;J^?`pY63C$X! z|MH2TzxSmfqMhhu%*bF$)%BQ?-!MQLGq4K21w==srKKC2QIw*spKd=RsHjdTLhZu; zbI75+o-8sw-H(5hh)0N*__T$O>3_Q~3d(Sj%<10~NB(26PZt|bb-FjqP3ia4huPWL z$2K-CoY!kKaZsLIEr=Qjl-^5|=$EWigWdSQ5rC%eygHt;NbO$@xkH4M*CTyWlW&Sz zD%>92Z_z;gB3EtYXmg}7BU#>Izq%welELZsG1BLfVu!QAOY0(GeQct$@pdy2A?gSj zD}ifeiJRK$UPY7YphOnY@e;JcBuUd4UKdI1VMwD z!Xa~2+vwMN;5iPkw8okz8S-y91Bq@<^M0-$@+mwU&d>9KzwA~@{&R(j8*FC#Xt4kD zA|icC-{)Bl)Z}VNe!p+Bq)<58n%GPGiZ!yC#I!n|AJIFa?h%{bh~8nOrwp&D_xnZG z3V=hD^sHNvIXnbQ5$OItG*Mr*PGrecGWJ`>()fQ|eFan%+|u>|1f)T_kwzM%OQc&w z>29P!8V(@RB_-XZQqtWmB_Q41-TiO8?|avOzq5`CEEb2eo&C(rGtbO0K7uYs1u6ym zul@;Ersd#)xCWK=tN~(z)0#|Bs|bvLsO}3kAkY?JNTok%DH&&Us5(aY)Bw$iYThqy z-`b+YA-dgK>Fdt7@2imS%J0Z*WTxc6R4s2^!+z#gJSia;pN_Uxr2X>zw3u3ifWclB znM663%c*>H%9jVTjXMlR@iAF?O)n`UPATWDl40gOeU|S2Iq&)r^ek)&yXM}6ck3w8 z|KT}p$R1OWDoEZQSw6Iek6~H-%6e<;4 zrNotgomkKfoCD+$LsU-3l7OhfqpeYo$OrgRb^QXP41&uNTgke-#qJfnXum=$xkc~pkLr`M-| zF30|)LjE|$@Mq##;#+aWA(NG7!Bt6{$M9|@-kb|sQIYInd{!q8E3VFJR1mF#8Qe#( zB}4Lehk_%LM3T)n=GKyVOv`DKZ!xS+-0J^B!GzzK<0cx>qPaIYu?mG(*TYF^l0{T# zlUTS-k`fYJ3v2)HQ2|n>FauZSyh#clq;$pb(h^u?o70Pp~%s=S=1Y`cCK$_;BxoT8$cc#Qk76!LGQ1XXQI3r z)M`l7)q#yg$hB-`%EC}qzWs{RsYthKqJo`=2RgZ)9`E8=Y&~Y}=`MQxbKq}wL@88Q zWj^BA6_ds(YzX=_uZft8r**3n`|);Vwy5*YpYY`x<3%UEmp1&s9o(CUm8|uD&q4e; z|M48g$eoS`>lDELoODUGQJ)(LDXFNmq_$&57K5WtwbUIu$jcnpV35x)7(lMe76?2s zpk_g|zIpDB_-A2kHP6)+2@rP(@hm#xs(Fey*x=GeIqE?TUrxwNcYokM>ROWgArytA z{KC=Yup}A*09kJW^;<)0EJ8J7dN(*xU7?SHg5PIEY7TQ;lM_);qHCSpX^moxl%1o4 zP`g4HdJFk~qqfN1%(fF{yriKD;7v|+w)J6-D{AL10Spr9YbqTd5M%|vY6)YcFgU?$#nV;anHqI`-2iyxN+r*8?-(3PfbtCLeZa zFrU6%DcneBZBleLMF9PC$i#n7LOHVqtNr-sdjgv4ogGyivmb^sG7Mrw)zPQna%Tf5 zM=$%hXe1-Yy9QrO+pl%5HhOStz&_w+OB^T>^drlDQZKYBfb`=_)(}|eXrXE`2YUX zb0q;I>oCt}_bqm8hr2A>^}wf1KLS*_Os-dvJhvRvThiD()tK=KW&GidF1s4jSCSu& zytEZ;>gpTewl^%SO{9*qAgD>9DGw^d)qH77j`0 zl|j?1MX)#F!qQV-2F`1Icp&UDiB!r}|2>L-KIm~1 zdpwb+PhcymD$7kg*onDqMT!ooeP~cN?Ay8243&bq4Y@It<0#GWL#M(36Pj$>fKV{@ zi?O7H%x(b?eF6tIZ8l2!@;2z_pI!Ui_x_#;{THK1)2o`7@&TdkCdvo2j}zg5TUPnPi1 z-o;d7dVCcQK@RM!8fQa(Wm9bLslA*gYyE>LC7LI@BGUn-9qUhXg>I9S)VW$w1HA$GP;5y{cT}YI;;H}Q+MUgQJ+H^) zdRn}TAdZce)6CBS5H3+E8PHKu9zz3qKXY~Ya&?JnI}B!YTNX}BnQ398;d)$Kg@(vb z2=j&JoWe$PAj{YpM}0|AFuW#UQuSy2w*>O9ee`VRQxov9K7oZH(otwQ{I#J@|VOexC zgRz|gLbX_>kFjW>uX`R*%Q#j#qO{ELHBl)yijsA4MlA?auua8UnzHw9n{_G^z`$~n z6^dVmA>y@^W;vte#>wS0luI%Yc2&-Jyj;7{SoyA8dSf;50Lia&U4^^6&VMS(>#O_# zZ+;c=%^*>LYw%YBHF4a4t~2k<5u%v7eAmx@;BKhso_vl4?ilOO3Hn=a^&F{|jZU^y zLG#A?^0@sZRc$Urk2xCx+T~}XrTJ^oLN>yqU+4M%DPG1MWoLO2~ z8G0P)I^!IGH6YP(QNkT@e_sGK{WCp^T9^XuFRR1mgRjHeXBgKxQ{aLI3lQufDRWs_Sv`ZY8+8To!}G(U*#$`H3k$X)AbS|jX3^C? zqdl@O1soZe0@42FKVjZs5C}1;;Vm(lauW7p>`cR9UzAxory@oWcQ4*i1LK|d4J*-chE0-(^yHIy$(zL;d}2Ka8gT$KelZAis%LE-AjJ7jQl>0WmL#gb`<1S$UFC*83ls zLvbl7Gy{LijR?>-gs01vOl5)_tEOt7Q|R#O4up)4i*sYTB28{5Umu@11k}8J%u=G3 za81}t&BOdC4*RPdQoA&E?F# z<`2y}#5-+nLWFAhfz|6?!c|&HgSSKpL8yLNtMs%v5{`%F_{oe~7Um~WWFmreuLk}mUURR!Yzj}$}yOkKkd(~OwPLEc6m{KHVvg? z!*##f(MweWrQYYyY4AN{(a--hT-*=P&~e<1daC@xW@~kW znDKJ=mc75X4BKdI%8}zEDCHKQa~+r5oyFD*93mo;r+wV1kS|V-6)hG*4wZSXPs!n_ zD(_%-XwKY<+2Ed$D6pP~*4LoIX%t+VxOs{&r8>sXQKw#w&>OAVCvX3l3;HIp9OGu!<%BJ*U;#v60`BQ-hkbm1ML`{ZwX#*V6IS;JrF1g4Nbx zn!4$c<5kX&vkZD$M*!$a2j$zzlR26yQnAu`JY~e;b6HzAX7}iNX{wmqA9XCNsWpS} z=b$C??a1ic+TCRu>S=6nSN|J1g_I`(UQ(Rx$=6J+5MbkL9fMy2h6<0=jAu@#rAR_hk9poMh%cV_rTOef4$4wh~e@AJdL=%sUuHb<@pAOj?PbeyFsyeAxZy50wNvB1@~FSb{EquP*fz4-Uo z#0R}{1yXO-oJ zrg$!F6I6i1$3xT6%?`DKnPAZaOBX$Z+euTO!1_XOYLm4di`6dU)`q=pwZn-k?Ynho`55~}l<+aWxH3%~VKdJC(Kp-x5ER?HKJXTfSg(c)hK%8g}aH@q2X z!BRt<^Igp7k_#%c>zsV2syIMR_goeT2skKB*E-l~dnHZEy!H#O#^7SPfHV+1h`N7*wbUc>&EPUjCg!9hL21PGJ;2rm6H#`aK>Qq@slDkGtt zcmtrCsOH+(J}NCI22bX~Y+X#GIam2|A|3!DEy3>1gMmwa;BO?GM;Xn(559$5W17$L zbCpH^)aq+Nv76(?)g26|+1{?z;@gdLqt@toYBR;q;@F>rGX{kR6Sg5s40?f$^Rpk@ z$9AV&e69l|le7fkw$;EYE4}-B?^RQ?=&#YAI5X=c-rOe36dVN4+d+eu?C4Qx_?Wy?~?(OC@xuBKu7y#Y~Ztk{dsE8Gn2Y}iNGBS!iZ!{v8 zDH}n~kFrmBwD=ZVgvO?(2BoM&E_{G&1MTZY4_3_<`Z;lfce~>X)jB@z>l@172IXROxdA&;JO< zW}_Qwe2#PX6bG^OuFguNCJLl}$k!aGet*;%@$so2sV{gLbMw#8Hkc z$vWyNQT9aU$4n$436Uw}^3pQ>j#V&x4AMcJ^Ceco?oj(9POAvdv{8TU>C8|Z(sJs zmw=*X68Zfidq}7Ytla?D#K~C6okx1pnn~{M?h(22+p_e*!9m@btgP%r@7CA*SJfUe z3JL;Cv)-3?wysyX_z*DU7>Khu>8v(Rt}g$il6M{)AiW^vfx#zgpITH-?hI`LD%ZriuaYx*1MDlx<#6*pT<6m;OXG7jO zKYnn`4jOYr@zACV?AOG|vDV+l8m09*F2y&yeo7Ung88|7Tu`&Mt_5>>H3aRitF(mt zRA&;r>puvJ5I(zr2SxpQkvk-Q0e%Sht{I>;nYpe&LGUZoDNlMVPz!m4+*t9T`tdn# z*zZ;H{9J7dRdhw&lQe|K*t zJWh-6-}_U!Qm01q=>=tseSkc%JYOj{FE7Fi5q)&?L)(VHSzH{PFC^6$0!Gl$(h0~t zYJLFp{^*?Q?;ld=Fa>?l^&hl0k1<%pd&yBtbMxTa+1Oypak8k*09QP`g;DmsE^%Sc z4sZ-I`j{YX`p$mfPp9x$$4wE!iwLHp84M|y>rM{T1gs_CE(1L0!=4b=$|%3%aVc-C zL-S_)+-Zz@^%w3zni`6-(xXtp!9^9~A}jFi!_mkrZcZP5n@G>aG{?)ZH;|ZS6sngs zLtAFq8NIK2tf-95y<4YxK5z$B5l~AcGssuj8;CMZ$cNFf_VSP92B(a@Zl&1Uzdm#~ zD+nD_#jhkc2P40O<>cvv|LRs^)0EyyK0gX3B*@Erkf-PPQ^(Kmx+#G16M9!CJOjAl z%1TA(smOv^ACs~f_rF?zyztqJ@S9S)NhLPqimIxS-@i}lw#{wxbBxLLZnm4xki@Su z;`N|W-QL&DjcrErCG`cNm6mGdUN@@3H&?7>hMi6Xk_UH`F|-Qn)y-G95Hz$ifNs%= ziDPDka5Oje{E>*_wQ~v|U7WCRN$2vd!OY~Fi#_-j({gr;mm0*Bd8=nr9p?3wLh9702r; z5j>cnl-4#nf_i#e?0sKOesb$LbZ&u_iTW4l9Ff}xpA4LmW!}>xNuGe`c%iLCE zx&aYoHB;wrtyTT=;}(tJ0v7=kU z5ccQCC2Ie;>ZtNK10O0X-vDHuef}Zocq(9>4ug-;;R~SVJdaR3|4L$bF@FcQkB?0{ zuuG_t!0z;nZwj>OX7+3Xyly@H9+N1vf(i6g+dQwf5|)K%!WduZx6USl4v>`747A7B ziE`8l8|zQ85*WtAZbn03D7MTMV7tW39T*#UBKDlg)K4SPIg80%i5U(X+28yEern%p z>H9$3AJ;mhwAIBEU)kVN2N?qn#(dN0l1I%$C?Mwm?YOEWKxA=&;F|xZ{XKR}fXTjF ztvxXN(IpgzjLewtiKXovfQ=19ZTGQf;0}q70VFP^$96sM?(y>W)8A_-pBzpH`R60J ziR3Vz9j0A&JUD6;Ql)+lW1lo!k*dSFg0!;*RTAZNXc8n_8Ogfie78rgdqx=Kv(R@c zCmixO3*6|Q8M}DV->UDU>cU*KKP|i@>lVXmJVm-dn)XQ|;J4p`8zjB}%cro=Do-(0 zQPPw)R|>t{WynUbNQiE-Q0oGnIn5M$8$)+ZIy$$y?CbrY*}Npv?7D4syI10kUSei! z%Heg*1ZsA&mIZ-x9wAfBW*B>1>IKfKkmoK#q zwmu`pIs)!RH=e>kgFTQ^i+^fSZ#^>(mMTv<-h5`Vp8OfH@NmzwbXI%9qCejN&l??W z?!cq0qBF2vy^zzGO$sXQ7hY>}x5rxx%Ifbvwk=4=^g_vip6k$66T+4}AfL*gdW202 z1cg)0wyclFesD25H`X~s_J9R#PS>)zJ4EUhz>XBTH*&T*s9nIOQ#9=A*HACwuCiVD z)e1-R#7}5Js_}H>Vd==#^-_d<&!yj27+-Py6AIp<9rcPc56sW?)Ui7R`o_EQ zQPVFmF*ErCO3>4G-RG}4P5TXjsBLw9ZFp=7Y}#NxXgI+;b8>eMIELGQ8muSV3| z!&TH@M!=)sV?9Nfs&i8*IWjc#Xj%vg4c!?tqbA>xo;$z>4nQfVE9`XV{XgOVs?|o% zHqx78=WBD@eQL$-THU^4xg-oF#>+L7S=mZZE{1<@L+n&XMc5Nz9&gl0+i&^{ z!`uxZ)tuHGeNB(k_JM<)nTjk~@KmIgO>9EL*gBVCaa zrz&rMm`^H1huhS!AY=t2>*%-w^mS?2omHxT$<dQZ_aqEu^G;#*U};vi$4Z)K1m@pz3te2McS5k?rE#+NQAe z00+TvuFJX`vU+``Ua~YpiGYN@v7j;2l|g}n2b z^@n{;JXQ_&U+n4L_Xi)HoSxy54ge8O@97pNkc34}Iox879)~#G-|yl}l zvJeot@EZ7xl>Wx^fk(kRo4UVL^2X7?4!lzOIS6iE0-xhKLpMo}Uq(QxnMsof84Ud_g6>?pc;NL_Pz_}t0ZJXjHG1Nx$JbJi5d zPE!J_n&h`4Cd>=xm0UJ9QI=vHyVaVHorFDay50ThU^==wjwdf3;sKz2w)MD*B6zT%v%Ad03!Waj+DZd&h}=i(tghEl$0$0ZuNULba&UgqI8b*2gZ&! z`f50mj7~&^eA5l%diqDa67PEA_3p<07VbO8u(`Azp5`kGhVR|pE=odIuFc)=(N}AK zrvswDZo)OW+Dg!3hFObycz(Y8fawK)k{pZHc)o&6@BN{JqT)W1*yoIm#ykA|D+kxc z@4dLt*`Ytu!sG4s%~W@{!5s-v(Es1S$|DfzYg7N5=Ys&3e_PY^!_Nk4$`!rvKsnREox+dc_0;hp$gkByO=%tRP|NICoX z5&gbH=Py>4r%w6IcF;Gubc)mF)97#y&LvoC341U)`Jd4YpPNW>i)+}A}1ySRT?UTWxy&Xx$8vtn~M9;+@h{S<}T}IsO(t96|F{c7_{xj#^~m3%BO1fsv-j> z7#SHshs3Mq73luS#T(G8(q`>(v2WTQ;L^TBUcaKqgx4q2E$hI0xvJw5II*Bpji4mw zSi*gRPlCbcz;9`8B{*$))9Ob9qE;BYy~>H0gjGmJj-9qX9)%II+_3Wa-iw z*FmAM#Z2|QJ5_@xm`saFj6IXDP&6tdDM?F6m{jI^2KGn4HB?7I z3j?pA7@a3{&x|CGANd51H<=eu*j5T%Zy!ayAtlFn443>!ppCMghmao3?V~+G+6IUO z9?wJ%Fy4IlF$Pca=%@!fdYfDE__|-#&F)Tle;GMO7A%4jAf$ON91)BiQe(FS-_dn` zx2z+Mz{35P0#<@*=0Qscf~9Zx8`INl)bxC0>R`deRowRt%7NK z>+QVn?Me=XO<%#w^J$R?M7dQUpi6A$c!Ey{4|cM$$HxBp<2p-C`>|8B*dQ6{uC(Yt zAyD7?Kz6=rMWV6tGk+CTt(QY~?lLp^+6%*RxHCTb@-ouGja9sJtI%L%m4VJWJu0y` zH(m!ive#Mf91wqUaspPUsWv;YXjVMYdWQp?3gkt>i^Q)9IP+zC|2^akw~D)MN$gR>}YAT^mG($%dow@=p;CO|j^esF#1;gaS2 zV$3nD*LZo<#d|;JqM+jRDT|ts>s_?U?R-S-VOuDW@&JW6=suyJYL4tx$vdAZ5kbLc zX`3FBpfVdsB26RC=+fx?9E`0r-PF9%_DaXTbL@7xX9zM`bFbs6%c`n%aDZJ0Djz@Z zUD+nys}=DssWaNv`N#3hab&oGyLRY$En;I$A$eU&wtXXnGn6hJM%X)102H_0An$yR z3Y&>}um6Q5Jsk))6upOihm_e z2%S->n7YpYDP6CIB}mpmqNEuLzAcB39gK`~A2QYqr16DMapo;c%XS#DV;DG5W~WbC zbw$PYgjs-0$!OZ=#_8k7<8^@@2Ic~iHlVe7v}P7yc2vSito=h~!wJ;O)_xE2(|Z^W zlVgM4CCs@%wIuQlnR=*QJp=Qy&tZVSOFaw<8u}gJ%W$^W}4$1U2$BgRTr|O4OOaWbQ(}aSr!}J3A z511@K5r3a>d+2UmbP~H4irk&*P+y+M-yrBQ*Z|!?42p<&F2Kpyp!@#)SpEPI4!8An zb_#e{&r}xBz3Roo?Og3uNfdIiahYTA{7FCHUP)d*a?#_CM_H-tFaj0<;xd}%pYq9>Qaq* zXRaZ^JDl{pemX?8%bOI1$TLKV<^O>zhZnwYf>^vUm8#Q^*A=VAUzUHL9=LwNW69_a zoflkQK5Gwe(Ai#2eT#3&n53??Wa^chyvM~%^1&*N2X@psRN&t4ue#cUJb$Vj$bcn8;;>EE9aLQuUXNCuEjKSe?qg?AX=LVm6&GGS8~* z6Zyv8=u1H(HFMb;;Lyb8jVjSwI@$kgNI3m(QRZXp!^{F^lztJo2Lh%Wc4IZ~IB?Ra zDL1|V9aOG_^E~gQd{K9wqM1Os<1*lyYHN>P2|ZR(Ydv2t6y$*BiJl&IR4UK67v@Ht&V`<^YXJK8ua>vkg{%2PBPC`*_{pNMB zB2A;(E13a?nY_H*GzSlbfusAaEkd{?@|LI+c{d5Z-vVLl2_VKl+FiJZeRWj4k|_-c z!p8bgm;`<&e$|3Fz5^7S=`+yzsn6C^tRu7}SIS;0pA21w#7mLgk?A#Fko}lPsW`gw zeB=)+Emh&zOyz}7@R^M7ZzcK@_)rSQ+}rGb{D?#p<$C$YaWAA#=}Le%ufATOVb{in z>`nST>S-xGJw0-u`PjP)v@-YR`!p1|xRjK($1YX3Q3S|%p6)~?nd(v(CH6{1I*=}5eZLSN{MzmQZU5qppf@F#X^!qA3rY9vX}~=| zSW@ySjdYY-KC`+!%bf4qGoe*H_`8**_%lpn0k6Ix*})+_UxJl+%JrP*iS*OY+OVJ9 zVZ@L#Cv{P4h&>tyv>N7%i-)DNw;EF&_sNexxD3lC=?s|X44>S2o=#=+9q=94zT})9 zPQ38a#W99I(niX(f}uJhNh1wg?rma29_h3{h@X$ASFuT~8OwQZ|^~S33wM-62UOC@9^Dk5bc}tF;+5< zRll-tIvu*rs@H#j_td@EMZ{E|Y9PZOFVYA;S0xX)gUR8XBAk(n{(SU?K*$Sjlbob0 zZ@-eW3J75+DSyztP<|EP2y;>7D3<-~=$-eIsQ%s77ET6fjtInOm**$#t~+2%B^P0) zQP4>AM|Qz2Ury0eNzQn*(|YGm6fK4CmzvIOW*f5z6=Q51TF9}64ef`B1jzV!*bOWe zwl*7{(C?XZD%g;dDZXz6J@S-w&M6%LnH_WATIg4Kfajt{(^-gD=WB#udy!{L @P zHT*mSwatDQUhtnN+Lq0IJBMK%WAG&lP(HQnw8;6-&8w>lgmwznrVgx|+6eY}P&RwJ zI@H%rX{bIxGRC%Ot4r`M%bGl>P!ZtDrkD^A5HKSp3@WGWffClZ9NQ>@+jbrna_HJ% zS365UOx&5sng3;IEn{@Yet(xRXB2xvr^;$h*!qjCQ8wJeah!L1B=i(c@U(^X%V18) zqzEssPirg8?FG-*)EHxX_iGh(Fx<9vw6@K?gQ;6M)FI8q`vGtDCiD41frP-m&k(B?E zr0F)-I|+5JmMB#>GJXMy2))}0RDLmFJ^W1HKyZAlVPVYm{@r#;oO>fEqu#N|C}Yaw z+f9;p8+fDUcdG;$%hAhn$dN0=ZW>@ZTh`Y^PS+i}4r* zX-QEvam919YyqPe6!dLyN*gci%pZ$T;nk9d%%ingc0p)>=6{dQO*%nBL#@ba)Ob<**s?=aLWk|H(H4Zc2fFlDFpq+8K&<(iA+o8qG*mJ6YW zFp@|%m{wvFVYz0ph8%r_p2L~FiNz&3?#@&Wc5Ub98Go6aq2kzb`1b7=V?j?SNi#3D zxGlAxrv=NB%&TnC@Wz4^*Rv1!NklI(ugr+Cm|wdTl`T_cL1a`9e{azXJ4?xp-F!^0 zJk+cpkioJ0$crYUnz78P4Bi9080P1?6#c%T>7XDy^zbSe^aW&IPsSI{gD6r^|JVD! zzUaou`XR_+%cHY0Ib#$KDo*N(fw(w8_5o0@4zlNF!i&Wv)Kz7Vz=C3-?002ju(2nX`DQu#R4B=Jy%6~L*@?2 zeT&4}bO{UWD`F#(EOEBkaRQBV+^BT=Q0l--c_`-XW-_oXw}Pg_!ei60wLS$!RVh?2Jx+?OCDLFxnD%BON}g>J zR4ugDm}^0s9LXWeOPxH9WGhpdEkE!g*k6t92`P32s4h_|I)V zJ^#P(W^|FnHjXdJ!1^3lv3>U49X#x#4r&_-F4kO`5hqkSZ-f_m{L=lV59Q6sx3R-I zof@Ny0dwcrY9f3r9pb=jEY<}tPIPiF7%E?OoIZktVIH>6E37H6>7V(J8JgA*K86I$ z3|WvuD~{JVDVXpuk!JzyX=yVd6<5(=cYey|y2uv#K_er|z~n}-yOfl|Gg*@)4AA}V zos@$Ih0SW?2wj8xreVtw`CBT zp_g2{lWy%MFtXjnPv3A5psLq8oEZb|p~_%E3 zOVu8BiNCmD0F@NF(Zjvj;i-y}Ji?9O$mky9`uhDkvuVeiw=$kf zC*C4gjoIIk(r;JIel~fC#ril!r+c!~@#dr)?bssE?j2YwM*u z_+5uzeS(pFgqVq-@^y1%xqMDuuX9+0Kq*Wm>OTIwVH+_i50tM?mD!n@*D*#xUn!0J zVEP1RhNtF{rLr3fjh^-5AOuL+UGKu@yiI(e_E!s4arhMSm4~R*B@Ww#$+5*`WZ){L zHaaZ-hRSu(3e)WMcRu*7-^*W^Wn9ZdK9Q#qh}y!p#mv%@?rV>SO%&U|U*(e#e`o12 zp^H4`z4-2_SZ4;$^x?XappV*JFVD}Lf%LAt z_-1UnTi5KJ3mi_6-{3TzG~O&Z)Y4s~dMoS`uubGPObm23~tl^&33%$#>cvDm?B65tZFGFe>$J4^&C-%(+N4JTQ8>^L%wqb4& zg9{J-p!@k8kj`yB%po$7y^R}VrVk4U1NiuFWa!w62dx(lt6 zepzj!8%rL4{o|mOOc!>e0mO&?srsDpC&|v{z@6|cdTD$b;M|V(sM-l4%$^Sz%%(zs zDJ@sAAnI0+!$&4A0V5&Tt?dekymJ6M;ssq_e2Uynn^|pju(GWee8u4JV$<9d>qh(YMoI47p=w zj^CGJiSPWbLRad%cWp6*DF3;$;UV$?pIYVBz(kr)4tS(4G`8 zNzyHJG;hFh|3b6yU>*|L9r{ZDNw7Fcccf5ci}|B(h1l&BRg0FS-`9S0qloNVlk||< z2)iQ{a;V|(&#w9xfL_=S$~OHqvOYYM6tvtUb6Wx_sb^13k?Fs#h6K{;C@8C94&vD} zeG$*hfxP*d-HBYF3#S|YDDcbLvYIY`)>n0{f1&yuz`pEnI;Lb-q}j>qHfHjIu~_KwGJ$&*VXSenxtbD=gy;|Yr5f@h1 zCTa=O#KoODjfM>^`@}Pbw@R5? z=2~lGcBp;f*75e3*gL@Ne&fV-={vc>VrM=k>7M_)l$lSEcWF}OSGeZ~-lkpLA~#b? zwABYqW~_x(wf<+bbvN9Ah=;u5Pi)~{peQ)>uReh1PFbc>}Bgi{U7Iz;w`vXPhs+B!Mxy^=DJ%-Xo={fy+6X0 z{dN2+<2kcd6NygWR|Tl|1IGPA;l|B*b(638%TMBz5ygXpA)uJhk|~C0cY8TZI5Ydu zE_ViY2DPtzhh|)^JrQk56LL|2KKzM^Tsi6{OTE1>uD=*`yUh#2FmP0Y{?Pcc{1xWJ@d85P((%NEJqH!srSeK01 zf&+)bR}y{cyWZX=|J8ZtnOShORsZTe{A*J?9S|DLiY_q&?aiI;MLS5XCv^N=GaO;h znpu5(3cWgp(GzjuZElgivJ(`IVj{&#=aF8!cHBG~G8pR&3u{yo2R-3xoLFo0GM^E8X@2FEZS3tReaR9V{C=VeNdA zu|`1F;QcYh*?8PR1OtZ`XsfvK7Kd;}ET3)Mn`8sypgk(EIilP9Qs(wn?;dmE z;SbsECTB@oQ%N)VjrVorqZwsB_|svYr;B}mbBDQ-`&t>tbH6;jb#ij^{e{<7db1Bz zAO;KsEV`UOU9TRjRf_KmpIEr*>OE*a8z@mCUZ$3Lc7Hxf-hFt838EzZj-7*>M#3R) zx69$qL)`4)&vA@u3KsQOKx+iybzH}Rv=~iJyPZ6NKuRV8ffqIv zbiOLXjhV^Lh9U8~KYTw!^UU6JwcR@)dx*T&q5I`Q=ok@N7#etwN-4a;xeCnWJ0Io_ z`rfZxsRTQ!9-o1jM=laJgIbOkU)FG8iUK{d1FQGXd3o(e(YEhLIAnX_i;H%s?MV05 zj|lbm@eXZU6aUr6#sDcv`*Tm$w_6`I{6s4Gnd>HsUu%WpBfw#+2e13JW=L6v;?M1< zQjvsbzDc=)qnC+}k~Om{&c|T<>e4o~n~*R2*NE|GLlwhatZaN0i`u*!FkdmLF_|@- zRFu&m4WV^XFd_@vi6LrB?iCh{kF~!w$xLh(dCee&6_>x$Qwqt)rRU=Av&egc9O>v*=5i^$LoJi=)lqX><3%IZ+#GSKXQwRnGE&3kGRoziZF&P`|5~{1wO7KxI^j^G zjSf$kB=*SGpH*vOZmWjvo62xv9H{{^=u{O81_M-^lbzA0*AQuVfCii|~l#RXgu1~G7V}P~Z>DN^qk5vb$O9O1A z;4velMeX4r-u`$MY1Z?ES-r}T21iCxX^2nodXtLRRsUhtzQl8_!2V=FWyq!RiRddP zqR#Y&1EI;<9Rx5D5KUN*aWG9NT#EdTOSgsz$9%5N2JE{|#of8l)JB!%ziLCGj_K{4 z(X*crDu*goR@D=O-RV#LyI>&cx0h0-H&rwC!0EQH9WAc*;)B$eokZ9bQ1=92s4HHm z6NmmTPqQ0=W)Zr=ps9NQ*WQzmtf27Z>cuIuGz5s}LH$BoPY^j+b?BjM&$D|j390lb zEO2UORSVxxq8ZfKnqUN|#w;NdAQIK7a%Zqh9`al#_RUU#F|yA`<*r&gBF#7mq0jsL z0Of*DJ?sMi7`nJPZu=vo-cn@)fMoJm%oi=`9v|3QI(ujO>M2%S_lmRO%(@K;uP08g z@rQFb$muDX;iO1NQF5J`t^DH;dACvV0&paoe!4Wvh~0Nj2kcE6o(2e{gI;*`5mOp}qu zFMZxkMv8;KU7z%t>;JM3VWJ{LqaZ|U8Tq5>_iLwnL*zli^HPlb6-Q#n{oRm0NbHKI z_XnCExEprnyx)~V!_g!?_Z{^*%B!R?tXJ}w)vPVq2!5Il@TUm686H=q3b+ioLPaqTGcg`$<}aFD zvcC*vtJ5!PE!^@q0VIY?csdFQFj*1uo6G#nVe?}5L5$n0hX86h*V|Gl2n5v3FLBQv ziU+i+mhQZ-H#o=Liso;cL^|&-yvdjBo<33};LqZZy=ejdBbW3$PX##fi-u*J6wjp* zBiazk{aMF}!fq}CqQiLaGxpm~DdDFQ%3pd-f7&kiO;#VYGFUU?G2WkZrgxSa4XykQ zI2X-;#ua)#n!d>Su;Ey9)RkOf-t4q<-V4bEfx*LVeo_1^u* z_QL<#9$Iu3MH=JM7m;AGd+KMkZwJ~R-8y`)HjG zOY_^%8qW7(hLBI%ERpxE2B)WI@lIii`Thk{zWbF0OIFVBs$Wsoy)MtjA|5Xa=$m@d z*wheg-st5A$XQ92_>JwFzm^Pn2m8~d65Dp>4{W-G$i|6@97hDgv&)+>*6O)X zCDG`ks{=inM015wu z5FITJpW~5~8_T9gmd$TrJH^iuDm%pWiLtL6S8gVhgv`Zamz)ZD;PJm#BUCt4Cw6~-9&2Lp*Mj$WcF7&wM*IgC_=I)OLj*1R$A=cJv4}@?& z!{%+>B1b%z1(8tLE`*heJtkG+`Mb1>k#P+P7NDDfSty!!T>;#HB(pe+ zRW&`x!7%%z5#b9~7Barl`?Q}foB0-ekQ3$h^f zyKS7f*JvW1PPJiS{zIGCfv(D#uK`G3}L4K`ab1G=dkqP>4^# zcPt*81@)DXplvOd_;!C3d~n&DG~?gm+Ef$IRNHnZagBLLiixZ7aFex`2S&m{rl+TW zb1U>94Zn?*lX(7vE5<-}VyC(3kakstT|G&YwuyvU&1xsS3i*A59k`R~4F6J}=}( zug0fgmsn53AjpeH?n_74KR=9pVA86(O&W|JFdcSW5*$nw2%S$m`EBlG?#w?tHRZoI z;{sO2sTH12G@i#vchJGMJ{*PWwXP3nWzZu>knjhMnkhafAqt$E52}hlx7wV4BBi3z zd0kxT$r9Keh>_LYjL}-EJh>ZgepI;_kZc2Xm^5Wsb0>F(vZl1S@_t^=GqsxhX+O>W zB=a|KKww~I4~Mo5Ps99HiRI9Sk(V;f!DH$&231tOK9j9TNa2N&1dD@u$aK9k>*j-2 z@COCu|Hsx_Kt=U^VZ(z6(p{2Lg0u(-2uMrk3^6p)Ee%qlgdicQbVzr1iHLx73kZlb zh;)g(X9oTKeZTKL>n@hU%ssW^+0WkhToV0Ii``jclBlELCtPu*Zt|l<*HLgO35|Tm zg{x<9hC;6y%}Ya^Pp|o%PThk*Lb5S!C-%;c^!0y>nRav5{XE7&L?eXC!Y2o#YGyYD z!ZGXSs#_+O31B1mY?tyh>hYv|Xeq)jw2ax0%|V@5K=<~C3FSGSwL@5GWN4{u*{I28 zt^*FvX&;sv8%a3EE41BjZ>ya6A0V-wwDbW{k>PV7Vg%P0R`a@@xZ+xW5HQQ2@XFi- z$TLG5|C@oH-XgCxy>t18K&?2^tq1obZwy=?zTf?mNdod2&i}O`2d&Oc;C%;(zu=OM zlx{lPd<#lE;hmj#PL|M4ipN{fYg)!%q&d+B#k?YZhErQJV4sC>*ai<})YaJHSD1A& z$VgJUxNZZkLeA1mDk|tbv+&+zTIR z^h^X?c#)L*u#Ee2^g35QNs@pYgON*J##mv_zIPSEvTkX{{dD!et`dt^rne+n^%^A? zd-@)#`mc>&g5C_)B=0sO2Cqp=1Y}D*zwh?cX_fcJ7CNUi-Y3Q^<`tOjwjl9mN%eq` z!4E%6QwIu<>Pq@w(a~X}Lh$f%k&*$GB1aA0aO*Ocj{&=6V}K4QyK#~|>l3XX(hMRm zpspm9e214Ul3YRMm(=fnyJ#M*M+g+pwvy`|H9r;WMI2qokj1tcWpS5akkKHn>?wWa zDKwhI=dzxzD4EiDIEfz1bk48{5ws&)5;u-omJCZe_rk$6Hb(G!^O`zc&Yz7bKkHM6 z@=xPf3eh6qxKT5hQGJ-nRpa=sz?5NcK19=(+3ItGz8i$Y^nnbkQG?WUk8pM$fNz+{rX7%F1Hh**7;6H+! zZ*w3^^~1B<5(QGpK~ICvKuRmYKq=0)^@x{J+^!gZcZh&QH_h3Hiw3pS#pD`t&Tt(P z$fIkR)Ywb}eVmbMPte5Kv;!aNiYJ%6kc}s^iJSpvpIx;i;@qC0te8P^0<1?oz@wQ} zHe=o{5yOZ3&{9z0AT&Lf5#!n`T=Z(sIjcjjUMw|*+nN-Vn72q?X7vnXv>4vUkH4Zd zXd`gpvtt$^3Iw;r+p!;GesX!Ub2sMmk{M4>=|}W>WuMCyf>f;BA>x5s2F<_a%h@CX zCW|}g*pm?qzWejsKtPXha@p#m7h8=i`LKpupvqs@lo3=OKX0iooQ5PDM(C8jc#fk6 z#$8wtjv{r~Sl9%Rc|2LS*D*H1gI>N=b(Aj~Mt~NCR~K z0pCTlFXfze^C3!04_@pXZhY7z92q0q&}+x>P!F1LynWQl$1m=d+2CU}D9-mBrYx)D zN}1nv)~tm*s{;Y|_>2&0*Xt?xO4D+X(TFw9_w$!=_Mz!vcvoR)zJ6+I3GhzLDrsUj za$d#%+B?0bk}4D>+k|V+`PB$xhXN&d?wb+|&+Nl(pa=toA5*Tbf9cgR=z{*22Uj#BqrFFh} z3tx*cBT!mdxVM?1iRnglg3KKw*M{zDZCC@zRnq};%zgf*bU>iG=A=-ElrX-iYxCpY zz}}6VWo)z*F&C7g1dqGo$o03PBx|8;g4++-O8Xq2nxx!RHS!46;Lw&X{e+o-4P(-i zR&Q+Wc4rWgkJ2u-dT%?)Bl0qIEvv7&G%Ef|$jcfa|(nUTVHZrnIE?T3kA8D3koVFcL_VZpc$D z{v}vZ3XUq^^*+lwqJG&H2GOf$F84F5+Urf3-gK#3R{Wr(gHmOwH9{G-i8$Idmqngv z?^NW2FdheBYgtLKhSn*jKr#)A8Dwqg&}E}XMzKnm+VBcc zKjOM$G@#l6z5k=-7#A!n1X4F+uw-LZQSfm;WDo>ag*8&Y1+TrFb&H5CsPSxlF$~39 zR6?;xrS#_S-U9E#xoQU7=&Zw8^nJWp6@uu&!Rj20;yuPZ8AaK+{mKzmJQORLk_<@^ z5@jJ()6Ytev{H7qABnt9K`hn#_8}hdB{SX9O^Gdpz<~l4?V|E&+b*N#V(iPGQ10Mw zLL^M5Ndo{^3}-BcxnsxA6o;s|**{;t4gq-BuxTPlyVUu8;nK1=L)QFZZ;iXp;ahbQ zX0$e8s_tX~p~8vD1T98jxaGB+tgJTPA)Z%EqKje5RAU`Gv{WUR%DQr4G{VnsChwed zvODxy#>&ZDlarN=euYjzwJ8PIfDb1;VL_kcT;9-pJ!MPW_@p;~GyqQ&57z;R&PRoa zP`xCTQjy_JFLy6sI_1cj-eD1i#o)9w`ju(_CrmIZOQqqg*K)Z8ksk=cS=89%t7_|J zIO?BFYE6|Sc;!ceqN6I6W&x?;wPF+nkjEoaH5L&Wo^Yrd(2PeeO?WJvq`Y?emFisW zHUG=+X!@aMy|lM(V_cgM>UW~3ftALTPFh5vMIF2VH7UJfA8m#fIH?e{2qsxD3jk5$ zU-^l_vn4+l!e1Anv%alnD}Hj*i8s0fBrsyUFfC|0v4QTc%yc=?OXSa!&N0ig*_wdW zVko5kC;zqXN$|3q4qQD$JVc8og3U!Mv#W1c{m@IkURTt_=1}Gw+E8{81N{Ng+BB0@ zoQ*q^6*a6<5H*fTS3+Kk%>Dv78N?54G)v{-EJ6xgQ#%o;7EsNYxVbWK*dz2fc? zXNrnp```%r2iOxE7K{S*pD}W=L(MJIuiK8={`|UaUtd#2Xu;Vj1XQQ0rt5k-4BNjs zfW?~_hR^>6ghoB$=rP3$YfhAP97_xkFvfl57^d&e4UKqeY-Hh|%y^vy3(4^izGL|w zJe3EY`qS0EbXJ}eEyVwnKQ64HC)pMKo>Bzu8>$wb8PRf~2MFjn^8LB2WwHJ|V$Rb1 zxsYg*n?xj^!UDS}A421vH8V-Ti#@>kYN4TQT!~!m{ua~~!%WniTCR2nV~xm6h0L>i z->ilyXm85!P_Px1u!ixxeWmktIuiYPW^X*l8{yTGH869+Xhnf8r;xvOa1_#i< zfcwQBz;P|U?O?6!T9?YD!li8Xctqu3SJhbz8$Wz!jBw20-5%otKKtSX0I1KWgfAY> zjbl?zeKq~yfu~|eN3DQ#16FDA3e4Y~h2&zOlm6@mNI#!-7O(Qkh%oIs1SC?u{E191 z8}4jVaVVDy`jiX8jjfYTYz~S8dVZvp#ULFCo2)ts3A42+MH*^h7 zf#Y3W>uFMzlsTOLdXU^g^fm>K$tUnCPF6S3XmFA+a3wKgSpnve=*>^{*oD1uK&`>qloA7$&%&}$0a(KL0NEkwVzPT#1L4`(^c<`&IOq=l9!d>|`B zE7RTnARC27mP*NR83}C8_}7|)_dcW3|c-p{!X#O(za@tmG&r3=gd<6v&yFu!+J(w!(=JN97HV7<(8|8j(>cPm~iO zKHL?AqEKyxbB>A;nMj`T-Of2B~>njNsni=ogM({2khcMwmS%OVz$-X^hvlPn{S5kR!qh5?jE_@_^f@S#{z`} zDd&<1!HQMFV;mDERq(kFq@owVc=%5yc}Xs#_9;({VV$hv$4SXFpdb%c`YLoK zt7|j3>N6xqN93h3>nq7jj1sL*e8l%cLrb42kSy?TF7R4c)EZ0j8U?;%<;jPYuZ<5C zY&?B$C8`mAt(i;|WS1w%b9%a~B}xKeWx>HwcL<01iP4aHw)0c4676PGYLv;&myd;q zbtPS)Au8kqgYixdBH`mIQsZZcy+mkO;qhQH;1-=5sKdG#_$ZZ2`sl%5yx#qPiavcP zUq;it{7FDW|8O>yYIS!0-sQfR)!}U&YR+=LQ)Bn)b~Cp?%uB>dKsf_%iIZICvpQ76 z{FbGn=1fuJlw1wdn?)9qk{RYaO5Ob+dlQiml7?~tED)&8Nove=&1Z9n#*BNrK#&74=LtK*GOZow$7Q&POcD zRTww9Uu#nXti08;p|w{|CtB|p^>knF%WDvd4qjqaau_^mQpk~bo`ZQigj~Q9;A9mf zPBwgF$Auwz(MFCC@~jOaNWL^-;E9I&Dg&TN6-ef1HYpW!VCNCkp@b49!P;cwPVb0PTP@9+quhgeAHwmAqek6!Wod53yW02RK0dPFg|7&0j*&&Pf(7VYCL)jCTcey3 zP3YOSx`jE2g~Z^5{lUO$EG+M%;o#l?+Se-v%DtZV>H6_t6ZSvUu3Ab8j0Oe3XE#EI z$G@Ua73okQJP@LB%G;>7r^RdiI?3Upv% ze6R`~X@O*!0%#zs77ObW`a5Ldpgs@D`-E=1sVN|J{QUtH;Iz<)Lwd5UbPSa+P<%x# zT_EW8*{C8~#_YQY1LGoeI{0(*BkWxCTg=-vpO9fcIfb-;NF982t4N_9KU<#_nbtHbU)@t+e~ATg1t31rMMD^3i&Cf%ppMfB& zOeYTBCd58sB%=mwK{}3h7_#>0BSbd|zS{I>E2(BJQgHJK2T0V4-R@3Glxby4WCsJf zW0C_g(R>m2K~TT=%nX+um<9&82#^2d7SE8EuZq%BI2ow0>O^uZxjy|~@4Y}K~< zl@E+~uNm+A%_muo#sos2sWamGmU+I@N!;#(APFj@p5T?hKcp7fo%Foq`PM*`wykJ< zyti@vXvd0wv54EAj=~HfZ0a@gF?=^~S3|GGK{9kWOnrP(kbPHYgt8qf(m!eyN-xs+ zbc@%S7Q*x8sa>xhn0ZkZjl1OyB|JI=;Spgtm9nj7?dtLa8LZnB4QD*-%YO#TlPzV< ze#ctFRbZ#rY~ea}I8=}@aEOR#7}%mf>7Do;;iP;MX2h(+Z-CIXqmLYmf{N~un9-Y> z5_m~)_c%_~G#@@djQVetWx>Sr$Ez+qpsXZ!$#Ce?(}k>%nt%{oE3Tu`nk5#N_gA4f zSw?ly9F7Ep1Wi!z&6R?>%Cp5wGQ19`485%elLX2Nj&lklWw$ZF0@ADwGmBMUQ+EHZ zFI z5r01#mZQs8y-bBtZt0BOZiY(S78%$Y%NTYgG>s{`W6Pki=2D( z^6Df&q(3Y@(J2|n3`RipLgw(!koy;hs`RATAcQ0Ux(Whr(j!Jf+*<+@QFgo{%YwQI z(HQ5iG0ul)8*9a+YtY$Bg&!XzohjmCmYPe>_oH$8ZIG1=wvREfF~9bF4ymd67pv!wD2qOb{Z zzcny8GdCbMK8L7c+%~8?D@27;@;m(a-h6lFv~NU6np55?+? zWoIw&q)p{a(YOsDri^Rg2yO}%)@3RSifbs9PcLcAd3DWPPT8~&$E+cn;@sDot5CQ= zZv0xDdv)@Y%V7e@Lc4JoQd40>cp-#Q-SmBXF*pRk6hD6aSf|xT=)n6T=GRSNl7~lf zZOgM7I>J^aYBZ0`H3{?i8-p)y>t zc$+C?FL;SSxQ$w|x0>-8S!3R0027SEF&d#;1trzhAOa{cw$Zsk|xQIOxxG7N)jRJXbu}XN9o<1U5 zbiZTk=lj{Upy?madKRDePvbQe5yM-o2lx@diPNn_OBB3b_%6kuF>BiMEY>%^W@o<| zDAK<3*;Mq~$`o}$QsEy)n&8M~Sgvg1MAVsIZHaW%LcSn;C~%1$L@VYsqF2>y(`GEQCtrfq;6r96cxnuWX@mH1Z(zr*tYKD#oRJtD)ke7la~xdUjzuSM zpppbh*VT4F@4wSPX@xy_jf2ZbN)yDPsQHD&`3_hJP)?Uzsp?qyc&^`3`k2!(Ey@{T zRyQ=BYX!L{qtv+xM-M1^`Z2X;fK&L?1C;Y5>PBBomU(18`?LGl$*UvZe1?am|9EI> zgojSbVvRMby8HIk&w7I)ry8X!8JQfdj%}Nda>h8Xb$pIcN#YJ4JVPi2qFtHq#VYXZ z!t*=^7^WK0bz@M{)h0qL!=e5DbeBU*2$ysx1bnbSA#W5MunmX}NclTd1R_;1v9iJd zRYcw`em$2Wh`X_MnRzS?c=+H!ZuJq3?B3E?BxK4$)IWa+ya4cvk(BN^L!V~kU{02g zBjT)1zDHTN+TX!UN=9G2HlzJ*hS%YW64T7{F_ns+&F<%$imLud_aYQFQq%#&!dO`p zfx~F=f1i$*Hz_-Lmeg>8afMoSJRZT}wCaJPSLk^4gX%(R{a5E8evazY76?I)} zk-(25%pd_)UBPlC6X6Ju4c>cHTq}`Hq!vd4vN2(*JJwSCD;3*z$rzxTVHI5yNkSAx zYZSbA{hAQiZa}1~e_#Cs0ZC`{ra8R28Qc;ry-jDtv^OGI3;#SScbe+!To8&#Ie2=0 zV|U#(ddLx(AaqQ#CW@7va}#*9tgz1KU@}(Lgb*tzLy9ct1RvEC;i&*Du4Y!4e_WI9#%!VvZw(S|iFM~ikVxv*&;&~>X72V^r^+wI(~TAL?h~kRVAQZHaf{6(}ev1GS1|G&PCGZ1AWM zh%kve3yzvxgesu@sB5s~6EE%QfRT7i7=aAwD=n6*2eqzXiroO7PV&sHpBHz*D8}!g z5Sz%@CMnnFjH386L^Z$5xYfg7()V~`aoHeZYOA8%dTgwk?9VQNtVP#rC+Pjpw;4qo zSjKE}cZoS~v&CZ>))8AgmMT$1j04#k-xp2tf2-Jk0%_+qd&S?^_%Q549B~IP?-cSd_&I0_WXT#Js9M74Qq&HE-L?y||Ej5fV*t zoUQXo$(ltm$GS6qV(yo$UE6BZYMwDz(JVG12;cp+@}^OgJoS(PW1?;HsPfH-X%&^LJaIX^et zB1m^Y7Cir}e9Q|^k;p2`LEyP02(ELr-V3j&xC_!e)ipK1{{E~2uM_|e;(j)EH{MU( zY5Z2}Bk&T+6kuj{9r;X#A9xx=?iGHf&Ls z>ha*{vFO~W=&>@vEsTIVxxfH9^-9)h2JEcnB2HU-Mlbnpbrz?$PXtrLj%24-e(C^p->n6QW~o2LWQ>6h`>Ue`11V#*Lbc7FQcQkN2ZGsl@iV`ypY z&1hbEcR~K-(C9u|st&hp&X`)ww8m)VcxCNx-K@-r!RbKSyjeV{x>rZ*!I|Y2rhdvY z7hz{};K6~b$vg;vFdy*E)N*^76wU8wa!|(iEzho$LR@1;7uBlERQ=MAV@fYsFAc9g z4*7D}u$g_<%NR_VTM`mwdGK)Vex^#uK*JyNaqV6iEGhQYafN&5sS2YE(XV)?;97r2YNu1x%yI0U5kds@%Ol6}(;zQY? zb*i*^dKV~BDwb?;u8A6G{vB=G)~6L*i!NO*Z95df^inbN+d~nZCK16cjb2Pyw&%|& zF}%OK5NhFF&25Y1TAWjtlThlOw=I=H?R=WR2?XoL2?I(62PLSZ@YwXrXp^AxpRdi>jfM zZ@Ht|>yxRE>~}NeOqDJepOU=7`vL8PKo;1R+#1|AtJ7;>OirOy!8HdK6uku)ofwoqZ>u$ zd^(0BPwB3$G~b;L*5t(zDoOC^uN2Xe3byYtuOTV-!FqGyOd0ds$>VBb8ASkrUHud2 z19O&GBHp0%!BjzW%xSQpA=_p`h4G_RLBX3}s2_UNP7QwnLdIn`lVF`>!$(;-xrz9x zRfM=EHw(vYc$GDe8n|_cQ>t5%`g8YAn|qflfBCgF8dx0Ws4k$k!^e4`$}4#MMoZG1kDZ;!v!CD}!s~W6Kj^V6R$| zO%(jvjGl=b@4p#c-*TP=J=eoYMtZ_&@Av11O`DTe^})pszj>|Be$8Nbc~|BeaTwD_ zzSdP0T%{lLFWpff;!*d^jQDi^j9Pq$UK~>!C$W#YZII>017}q2W{W;(iB{s|rb&kg za$*p7>9N(3#kZlf58@{!OEVJ_dmGI;riO)nyunz1T9(5sKbXcz1XQj*YpS*cxJ2iM zVtuYWaLH!V&$K!vx&xCCgjWFr(}b54!b=psV8HgyFT$i5z=ahgx#uZj@Pi2SrTzTb zOW(7RNm_LWdljT6^+YVZ`y8{kX*q5)#^tG6WvC_WrLq29UOr}Yn_2wN91u(JnIPi@ zd+_`!%%6iTHh zB*1?4Fod7a?RjvnL;Zq&PPB%fyVZ$6(L=+x75vK1+*J{1KidV~)1~&5Z0jX}6t@*8I`I*7in`?Gg z#_Ka=>i&1_51Y_ThmGk|ja4jE$dC+JS}2>fn;Wb_UxkRuTwi(Puu)4}8&;ylFDzUL zj=i}6mRx-DIs+ye17<|?PQA4NthY2j8m&oNoPCQp`{fS~eg`-0`o~Q;y^P%2nS7kL7xON= z>TM)CtNaMf>a{qg^@h{H+u1K8CvHHDSxCcWax_4|m*Y?u$W>*p7q1|Ljg9@K#x_xe zwv_^4ivV`bnv_^>3Rp=>)5)nReB2b?xAWkKQzJ(fvnYkI5E8VczF^{SrZes&P;kw zk04f-S7Uc`#xz zjDN?+y5X`uq$C}c-fK%gImE7LJ|{x9rE@X!QOfxNF2Ax~_dw+W8pP?e*P;sePG04z znUahUorD~Xf_K0)Sn(-@B2>Oq2l&w43em8r?S=*Yk`&FmsZg<+3`w>ENpJO_gRHOu z8Gb65%vtxBv^K+@KB_g_ravIAv5)6nYe)GAw$O3{_M8Kd?+nX-B=IL965go(fj78n zSoJiGCW0A>G3KfIWo&xZcgPl=;6WDlGzy?lfMV$xCLDIyznemZmBJZvX$uzk6V?dNEcq3b|B&pKO;qO^HaOPkieW_zss ziAPxba=}%Ho4K#jeto)1=3?Wk&T1Gcq#QM@E6b)P$!_L{JNudh*l*x3^tsrHUJ_&> z08ewsLu$t+*}F{~Gqq#IiSa6FP+_mVK-=cu<&qbSSjSOp)Ku!MV!3Mzai&uDfa|mW zGme0Pmk}@ScQ-5t2A3(jR!{*+{wj^ok*n7Jh~Tin)#`Rux9W0DwC!4aPNf5_t)uqI zv9RFHk^AXiDCi#O0jmaa(yic7Tz1y&w?J;TZbFV}MZPhQ9P(B}*0nhmq8`BJK!xhq z`gpnP-x+cirg0eZ>G#lWO!l|!J!t$f!1!Q@PZ5VBYCvQWel zO)pE5KLESCW*{>6o-|vB!`6>}dRqWur(Oa5;eKVcA??gf{*F*1-!Zk(YByJb?6SH0 z^qp%;+i&J`=1~1w8nniX`bgucasz2CEfL$=526F5(JgnXdYtBc%dT4co2h3qSfJZ> zFKU&<_Z5U7Afoh|7pj_8qi^y25f7!W$uJcz@Uc;UeWEkt!rgM%EP0WQ)fK$#^b?#@ zfN1SnUBSSyZDCREfzj&YpeWRva&T~N=BbK|BZfQt{+n~19`d6Q2$wF$0@A-fjGvs= zmn!3kciYz~e|(6q5_GTvhjI2zD2AKQ`6|DAT!R9cQi+h2N-%e8!qrE&o6)M8W|EtrfxN1oTu8XFB zYXNXJ2h)ranP`%^kzmAbs+Kcv^iE>6KcPMU7;b?DArKsCk!81?tC5P#6qA&ij#ls!Z)OcXV>~%_4Zlm0kP#b5acHHLe zoCE6Bz#vZX_5aT;Z_4dVUV6NrGeCj{F}?v_w|6s`zRz?Y$43yL&}_{%afGESm*+G>ul=+w4>mSu7=-sF}(i^8vpx? z#}CH2kV6t543BsL##0bik`KGTyeHf=2W}*;3ZNzO@8E}VIKsgK|9|CR(SU>PC@61@ zEh_p_e(=Rvw=N+f~7j9$^$D*BJ`i?b#G{e z-Dx?8rz|x{UK-YXTf=& z3C8!4y8|pf~cZvt5RY89oDpY{0IUF4K@kHP|O#A zun5uo3OWkjpy!z)^%{XDUZlDAMVwbRCXARm%hz}#?H)74;G2`+_d`$Do$j5nlKV7k z?ttJ!wDw$`_MFapCZbOoGpZVb4Gl`ya)-qq+0dn6ZJw7|GXGz4B~C@nRhK0-8iuEA z-nZO>KBYnUy}NG^}K&^w`GD@`t=7u2|hs}a_K4Q|D1A0EQXq-YH||w zq-cnv_U+_xy}Z@x#x#uveOQ71Z6(ZlEI@>%PZr4uzFW*h+5XC({SJAYCRTMh8>hQjb{0xrpx@t}}x4^z~65*|{P#xPko9aLOJsq1Q zx|^GzHBsH%nCqR5;EC++C5{&8RI6&nE;XJ8`!?=qda%=m_ii4#HvJjIf(X7o-KaKQ zs&-%H;m_Ub-#k~=$L)cWs1KZW$xu`GEC&NJBkTT#jd&od) z1qII5%&~7&F--nU692%k5X6EG^58TWaCMz$&pG@V1SA0e;1u-<=|083S!lvp)uT5nmP{6~UUj0(`6!a$~2CUXRQ0711Y=yKM+Fo8<>>!t5fN@ak@>bn^^lkt0byJlXA1w5p&{&l z7_YT}{K1?iU^4R@m*YR*Klo-UPnV2QV{lwsks&e=VVwKeQjunj%VC~c=nIO!1HqQ zZ}U6TGK@JG+EsdVEzZXw#DN-jBPb|FCC^qNK3U=VG%59;@BZu?XGilw^)1xiBNsK| z%!P60*8FN+!pl5Ygd~^03rOWhDo&A}LWW`Kn@TarORq0W8MBjE>QcmIx<9Dvzc zgY0M(g_w=;tc`F-aCF^Av`Nnklc2LlBtPh2fPYw9sLqnQ2O`7oN9Z#@{##@H>3>D} zR$F(b>dwmzK5@(=la)9wIAK3#*6sz z`wduKK%ZA~ZU)*S#?X^B(i2Obf-OySHdXffe&foD>W*~N-vKZ1{u9TEhai?XyXvO= zh*b9|4W^nfAI-$&#a0s2`g#MyeX3GN)$5=HjgSddc2)&|$ef0!Z1FtzOte(8Pfzu5rDzv3ozFuj>|Hc(`} zY{MzK>uz|w9a#&zN9$_q@jfqhlOKR&tp*dewI}ZRkN-}kv3q&9z~3zK?2)@$v-_R4 zLb}VmGPy4pPq1XsNy4JokWLQ~N`uV?NQ|%)nQ~aOF8g)Dd9hk{p%&wM`B13%so#DA zmk0RU5Y<2XKZTzDaHwpjISJ$v58$=i5N7#CTee~_lo}2_Zmu}D!BV*y{=c$QA457p zF3_DYt#K8!^zAeath=%k$OFa;=IR6=&V1`aub7SXD1^ClY8o7G1Da?0l#>+#db(E- zBf@!Ppl~&}c7c-fc*Gg6Dy3w^iFn4(RaLCQW&kvcz0okgov*7p1OS1|E z;i;g@1G4|!3{v}S#(GWrSoScnO|D>!=deoC%lF5bjvhb0YFiUzWnIXf;BQQ|&?$W* z*LBm{UnczOQ+D;D7Z>Ib3_s2mGSj+-?d4xMi|)7yXB-)ND3W(z!77?Xe@S6x|2 zQet*@>+w#UBD347Z(9i!zSynKj(f=H=7bf5l)k7E=856GrR6AqUv2-t$LC>0tbT>Q z@l{u#)^M!qo1U&#!o~OAHd1mba^LO~7NPl}R`=fs=Ws%#GN;NVL6GvJwdJuJ_WC=+ zv*Egd2f#X$ZqTXM`$LC2tYvQGkpd$%Z~W9mxrL)H4JuYuOy_$Zb+{KhKia)>DY`A} zls{vS5TJJR97mqwEob$3A6UP)q67C6#BYDeBBdPBZMiZi(myt$8&7X3FSY3$iTe6^ zy#w{ae!Lk7a+~KJu(TGXSIiIM;}Fr(Xv5|O9pIfrbrG~w^HT6)^aFzUQMyUu7yZPGT4UK6=90kLb-=9=if}H48Yw4x? zF?sOpDYu}502P}>0#E}@U<@>b3nbljH^UtZVC*R#_IAdmA&qn3VWS`;Z@(WAtNh0w z_mdibJZ?Phn4esj`a!etXLQ4vKUV~iEO-FZzseck8BIGyK3I5gp7t{G=BHR?=)#_nX-U^v^@U@ zs@WecJgaX#M0mB#Nnz5AxELl;QKKuC3Nh#a_E)3C(WAsezh`!~<)Y;+wu@C-_dW#e z*UyIC{uoE`R-I3*u=T@KLwa`D$44`1$28N2U5c#}wVW-d;oS#-b=Wx5^Op&Ecx-;y z^+^^?y)iSCjL`e>2J&Pr0oreCnQy z%*ANa>B!$bfSedN;A8Oc>M7@Fuf!R?ZCXg-CeX4omaKU8qzj#;dNucHJjL7Tkzdn? zK~cYG`|PZbPU$ux68&;fJ$@(Q`Tyv{l0B>AdniV!r_nkwLbb`<(rP$i(@+W@jWeHd zrU?GnX}C>;VdL?>%(I<6v2%Jmp#m*|latKG`yOn#z*T-} zk*^s3F$JLHLk?P4#P8I>H~t?RWkE6W`r@wdegP>+7tH&M=FK9^7`O=WE&DnJ#=gn)|J*{G&m6Jzi*eM6ow7rZ*=sPLcCYi?eKr#Zut$7@G{| zVEWMBFHCt2A5ZU16a`y4QSo(}-03lPRl4z)6=7^jL)0{!eqr}_vI{c?i{maC!G@}+milI>lUy` zHxyaN5{JglBlQx15rCbJjexYH&GM^}K9^ogZDbq=bS=j#IU-3R$n|M|deQ!t>Tk(1 zk&94=ix2bT+v#VxUd_*HH%*`0&#>_;rS@nY#Ex2v3Z=s`C!n2`=DI*$M`S;Zc;^(@ zmE>r?4I41qEHt!TA9(rZJ#8NK3)aJGh0(DBSD8U(m$T$Ljo!&5o1|KJ0`tt*`nFm- za~tKBdi}8;s7&4sn@0QMOx4dH;xX!%ot>h9eQqoP?xm*Tm2*)S(q#`3|LdPo>RzGo zkM4}WRWf+^P!n1>3uRdQ>fF+ldmoXLd;1Sqg%~SR>{8lfPhpTasJ334AJd zp}&(Yio*1vOi%5@U+)#6MI;9Y_`kCa{q~y9rt(_f&4}&FG|Z+&j<-=x*Or+2G7_vi zu2y=x-z|eS(D(V>7hG>q>PxVmws~7?sK?p6$9)MKoQj;I6I*ckE?GsfI!zDdgM#^;*P}erS|CspKb8&&geUjq ztJ@c9m^5awg6+bD9k*|y$5lo( zwSS|_%#gjS@iRV#syFv&Ei6Ad$$)(`Cnqp0B7vjG#YA_lxY7EKZvJ|Ss|T_oTRokZxa2Y zIA^pfOg6f5n$uDSZQN_}p$(a2$AGiUu*I8gQfxbm+8J^5S-Q7Dh2_=+v@xLce^dp; zIAn_sZ>(Y?$KZ&j5Yl1@?zWS9%n(Ok~D{hF3(#zG+MKE-!*Ua?ik@V2EMBh}&r+Hp^Ps)*2y@>y-2aLc$n3?=VWuD9p1PUV6q1uG z!at4k6COGgOnjASJ459%XG8ENy_L+5&TZ5F(>UQQL(T$yJ4dOPQN5e^)=pb+TxI>d zj$Kho%K7Y*p|QxLp(1!f2@tu&#C>mpx08K+X#C2y_xAHsA=HVZYVAvLGhK!|EuU&1 z5T?48CcN|R8&fDKHR4z%b$YPuBE(0$-?#Mr_thYcSO1|P$~$SB=}U==!aV#5cWQtqL=&u3 z)bgN>Fw4xkKnEm+QcT4X&wL!1ul*mkzC0f4@B3eQt9PN^EfPXPWJ$@Ay%MtT>)5hn zU$Pr(DT+cPBikU$WSOyK#=ewfnX-+2EJckiiSqURp4u% zX7=^EG$B%AZuD43udil0J9fJ)bP6UaG z)vG9;7;y3ouDCz3eZ=42x5O2KfuoY(^w61i1(p^UUiDs*kyiOI-7_C>jr(?S@I|V; zw@dNu2+^}1HI(WGWOEk^vjNr)nhKJ2s&7W!@M4v%+;wz~D|@_SCVlL; zIKUZN#=EH>W!LtQy4H64)5;T zxI07@*veG0M=Ia2WKVn2J|$*1%)+~DXo?-)_P(uNfD!sQUFd8AS9=Pty%?2e8ya}1 zZ@0YBDDgk?zt6TDl|RD6Hi znURW?foTWADT#BWQck)A?u@7$7P zmwq|XR`-B!?mviLuG8$Av#z$t7xJu{E>SJpmcppYfy^SBT=Um_=QAB(Fc~5*#r|N@ z{74#LAuN&T$8^5FF1z~|!WV**j9NX{?d-~3Lb>^?R8 z=(WEN{#sISXqX1tyYN}Vve_M6Ok^=9xlrK~NV={VKX3kQ`&-cP!dN$TMto0dep#rO zbgo0k9gHQ~-{%ODOLJx2*YTxx#t_p0W-q>Tk-C!hXuc` z`Uw4lgZGxZ)}^CnqC8Nfs^+v)%i?`zcT{F~H_F@F%HzL#0caLf_KNr}!X5N4+=P|C zC?w_DIsJ6AE&@WTfB^&c&{N9sCmeKb3K7N_Q0ocPowLagi_|DaD$Zp=FwY7e;8L0{J^wd=?7tE>6LU~mjD6X^yk1!G z;T`obnWXNp;Jdn=7r)w>8L3SF`uaUkV&>)MYReaI581NyF&7q05lYy8XH6pj*coWW z_#=&Rgc+`vkQ~jSkkG%g9HS)6RN$PF9-}47vu=Jwle|tjsvwb7_c;E(J2EZudT0;R z+o?-p|B+`_N*{%WjK{m5IqXXw8^#(GrAjBFXJ$ww=w}ThMm%h^?SaVdL(KdBN2vIg z{7pXkJ|<5ZTrnOW-q`9@i0MyG>Vjgisv z$d#8`vKK(&dczXw*AlVuMWbOp<%z&&-!|eW(k)}wVqDg<677muCCVbP(yy7;%a0!< z3cUC-16M2=T9CsxeFbcE1B`w9c_nI#qZ?M3N#8!15wtadC;BjEnEZLX&rtFBU<25o zE=1wJOAJJGehJS7D;MHBXAF1UAG69_eE~-SKx%9p1Kn^ndhNn1uAz>VK7p`14I8j` z6#9%$pA6Z+jMC072Y&JK;Ws=e*BrkcwlXiK9DAj6c~j)vQa$Obu3c$>+VflazMLof zSe?vJ?wCA?-U8Yxp!R@YX-)V&3R}bFPs|7U>5C>L-|y$>+>c0qC>Jw|fL9|I=5_TC z=5J=+)T_N|R9es~(En^Toh8cZq@j(A8Ba{K%^kxKg=^P4W1c)xNKVel30`80{zt>@ zQ51RbRvgFZaJG-wjMYumnBpP5Y*h9YUUpWTbKZy!jw=(yi|@W?Hb_Uw3JNP>#Bte8 zPVu`odH6}HrWp49iq;_J9tmGXbl)j8rro1@Ml+u z7X>?3XVUAT0O?A87%d>&GO&D5Q$IWT1!DBdE2JOU#a8s(u&PU{)9J&ekrKJ*HWJvk zpmzqsp|)J(9Seall5oA>c(TBZ19I9&-Z*jcI2BV@noc<0Lf2Ie6kRf&`z{6^l&<)v zQc089^md`p(>Q1%B-QjWzH8*2Zimo_M54Cr_?(o_WG;-Zp-9z&W8F$57I+&|C za;|lGEf~}ftfhJs7jwm_i&=s=_V*CN%>FnxZKqFaKV~W%4hx7Ug(0m0gE$0#&XbrD zt7VSfl;-{|AdPhPn4g&LE7F#_Qk^`aZ|GrxYfFMv6$?HdHWBVeeoubqn87hLoNagY zERF|JZuwAHKNWV2{WP)9-|wiiiigHNd`9uhK$z=*e*JCIJ99&k5U45NbU^|3Och$? z7TBhr4&)v@q3*IDcr9x=ZmMDKjxIVOd{@S3H@B+uFgny*AWVNc&M4=a&&S5&5z1Za-*kNUH5;BIldj2ay%Qm^6X6f zJv3&k2vNPv7Ehel7u&z{NTHE7*{IGk!>u15($2>)_RTd9NE`!-3n!_sytkthR@HMt z4^KD&(WImH#;AZ$tMQ(VsS{PH(x5f0EtiryIaMqNl>ci;3mSWn5^%gBp82ozmkpU% zvBlFzQ{c*?mq#luprWvL<>Dt2om!J_9Wj!`Upjf{#c=$SnaADoa^<|)h+Eh4COQk7 z623qY0>UaD+DzmX154%@-#$XD$TUbUO-KxQodSjPssbO%jDa~8S?#sIcXdsN+&(_w zQT0d@ajNgJT#@plsFZV61;keHwU=4Uf1oxi{v0K&RR{wYsf|y1x(#v_nb}wD6H~U| zCjk9>O26c*SS1e0(GCx>tqR9RV7MJwXJhCn!# zJMvV-QPxT~*9}KmD*|fx1nr3coE}Ce34e|Xs{8q<3;kcvl|$pb1Pv%Th~nuH7yMK`08!`SO#MX!R4>LkIey*;| zhHU1SK)u`bJ-cfgv1e_W0~gWTxfEQ>Yf0Z&73BnVlBCGreF*4^h|X= z&PF?nlj_yx?yYyX>LTr5%szccDdrr_tC7r0WH@MlT>Gu>Y1jdq>mfk{ncHm^spSr5 z=QqV&JMqMa(c51KdAH_Ae%Rb>TcsASir9(w-t|;pRiQe%BJI5^+KRaM$ery8a3iS& zjs;!jD^eVza5J+8Da$3dzy7YM2$=G!2oq&>x=h-Ot9YpJvufx~JB=nCAv@aKTo8E0k)p1LOvBZqXIp^x$-h~z~X)%O8x*tBb zVSWq%HWO~W2xGeEUklmOz(&pV{`c?U8K30o)m2rPto8=+@km+RcsFzZdxKjra>q?2 zx2T}9zoECrnb2KjZn2=nM4rgKfBvwq6uRPM;(9d@P|VS}oDY34@(R?ZT>HXjRg?3I zdV``EE{^`KR6NvCJx+qR>G0axjU^s&H{u|HKMhZDq0X`^2qg5l*X6ko^M90ZW6##(wm4_|qv6?mngJWv@UbkJZc6L+YV5GVeg?Nr9A}IA`>asR&+}sn)a10J_tNjBO zJFGJ-(ZmntAw$yvc4C^=|;)_gsXYeKw zg+ZB|7L`r0wAfa$M|=}sSH6fu;)< zLIu6$A#w^p9Oon!HEJ;X|7D|>Ybf?`+DbT4WzQLAEml=7FRHaibT+VKwahOP{ijd) z*ohY7rhrT&!aAekVMyf4k@Mt{xd^CFj&Z8~yM#|i74^Er#9)tSAuVy;!&67Rt>8li4lnZq$J82CRNrv@?7i9PV-B6&+D z=;S5l3Z{l&AwiF1w(ttd1M##&>R^xXZ-yq>fG^k`!E#kl2;bLsX)!n+l0f&-2;!Br znbjr!BJw1?S+(2QEF^Z7*bRd1&HbW}_})0|!}nUt7SM9bZS;5Sle?OxD@0vcs~c*F z95Y<^;!s(r?;Wk;G>8tiAErsgo7eK3_=h-?c$lWCyCR(Oc&{&+jXOx0anytPaEV` z;qN6Ayy>I=5gL{F&sh45PNV4K2%u135;1ID2dM&LhMkUMq(`zt{LNS)iBFZ+D&Z*kE6h3Wx^mgA)!`l_GCMxHbrC;k9){nvGY#;or${PZt*0et5pZ&inIQZ7cF_ zs!B|ZW=k@Ylx6+b&~-cxx}c})-3R|>KNkPXpj>Eo4uZAa9hot54GsQITT6@I%HqOY zgVbQXUb1yErL{DFu}ZzXwqDbs7^0ZC6Y6oJIMxB9OSg5)F$0t=Pkl0yIP~TWjmU_xO>m_^c zSIj3d?$y=`YLq4SEu4qQ%t!A$gsY)nyw}|eGK;HwehJc+@EnCD*Lc%!99_^Rer&64 z7gh=7v%IlSUGedw?WibapJ^Sv#dzL?faBHIgdAtLKeB91hOkk(;7@F>;|7)qXe7}~ zzd@lPb382_A5edhU@_)Uu&Wf4(f#QhzcmDchwzz8lsQ5WIXjNoz;#gC2mQ)pyx+U2 zML{A3=5!0q$Ic;w`jqqM1C=S$fholp%8H$36rb0IPkn*cYvIlWkA1uV$sJ8*ZF}cq z?V{}OrXj#`r1c!49J~nERP#dDkAj1@{7lNSD}0JDjh7fG$`REeXS3koC76{!an~7J z5;@bkwe<*#R4a;zQQ}pEf9RHXQ&R@$&}!#b9G!vg1qLI_{wuR8oFcbimhuRQ(Y1WO zQ(a?>m(yS56W25}A4Z}y9>hKRBe#(mW@?5UtmL8b#Rm$6#;=GY>~0-~SN4 zw}~?5a_<{`eIeHi*RN5Pm2ab{Iq+<{$s?1m&Cf#f6dQEaMz^js{sufhE5PJ>4Bu|& zuQkfn|JQL<;6IaOD!Fs--PBo5#D<1cXL{jvMO{a~FUCDR?`xBHzJ)?wd02)pRSpNf z_Se8oS0c1JjLEO@-qKRWhE+pwlCcyqI^4&!^~KKRFYV9R zgm9;2d0#JFX>(Q26K*PR_{^_}V2e*{F1AU2laqGuKI=VAFN}WP2goYDNv=?nj==HW zCJ3~*#A1v5r6>=li8(Wnv>XIWi7oW5O0ks6NaRvnb=7k57X5}>-{lRu>h^-7s&J>7 zpr9bK@xsS^r<#p9Vy$Iu;Z9_nLWx{%Lx77B%qO5|4+^k;7yz4fQ&DkH+h|UfVy`hb zLd~slXdgDsTOqel(no2lJ-p38g4L~6jrH&>_YLkPT1|Ef{&}@f6*2 z4h~fTM;2!p#F4lpW9OT{S18=~V*;?_*>|p{#c7?hAdLjB{)a2bzwaA=R_&Z;>E(u8 znSC7jh;Qo{LUu^Y0<&`eBGdSQ>r^H9Pv4EXCj}p+hTIjSt0YfqZ-@@K6%M8uluGe( zhuwO(A;tJ^!N|(BV&k(+9~&X}rsFO6?e$H(M_X2K>pPADa`%mZm@$Xx8dM+~3 zbvn8zH$meH$|%TYV6g&rDYeGCV)mcilav%TZb6O@!wxwWboIDQN1MIE_HiB^>neR5 zpIal*OnGCV&Vc&t{(XXmVl3M^tdvU73!ROBQbi1K~KK?@c3agj-X5L#> z^?`W4z_CP3cK+Mclnd;J0%e8~Z8Dh4i{TQv^M+xrH7~O)lOv}FL_9Q0G!*N)<2i;? zj0BFy3le91R54iLPW(XVcmND!DD)4j1>97+GxPcU$u9cmif(ls_h9)ccR1$ZUyRZy zV12r0b>SPnK|z$8Kml|Q-4=fHp!?cd1VMkpy5L-ALhO?y%G>RFrZi9&-yPN=7bILm zE?M+GqnAoIeO1uwildYw>{ug@bE!8GA90NLXGcZi+i%`4d&Rf4uhYA?q%fs8G;i^n zhqwjQ_~F+F(Ue2tb7egKmqWk2hU**R^4tAf3a}315b3=2_RFIZYjSQHolsco04q zFs-V)x~~(nS#di?4qwCa^4}5!Bps##=MP(j_+DmE+=n-?5_(l5kpqmx(oIVV_<2zt zD;xa`mFFNks*_3{KzcI)yy`49HgH62*UMxE{Ua^+dlhJC+&{3h*$iJf-IrWdy_+2N z!Zp?+V?(UfZ#>J)S0?n4Y^RtIf8c=i+%ibI3zw@>LPPIp@lCe_KE`TN6=uiM)9+&t z=c-Bq9E6*eiXH2_1oT&E?68)hccQkh*NTd?-?~Sy_lXczng zcl*tX_Rm$DVDmY4^&EBQ)B|bbB-j(;y(Myi@>Pjdf&ql5|s3I zC+n!lwtdT_YDQrNvyc0PF?9KDLto8_9b_5CX-G>yrubZNNBqeWjV*jo6y?MG^`|TE zPtvErHfaCb5_4!$bTQtk~k!rfvQMX7sA#V)c&Y6Ck~qd9Oz~=D z&aKAYehrPCrETGAlma@S3ub?soKSC<1y!>h8h4T1Tx~bfE}ZL?k?Y}{3UI^Jl|@sQ zp|;<~1t2maEw2x)20!Myz)@CSsDMWLADz+0uDV=hTBOi>q6HIKW3_}0$g8%?P#4i+ zXWZfpz)u^6nP$kpH4YdI1oQkXo^Zlm6(k4=nDpiVm=)KVU5q#P zm{_lQfy&kyT;<1oQA`(cDPK-$gVylNt{vg^!$u2f63bAPW2Wq zuMsu^|CvjSa5IEK97~}3vwKdqq-M%#u zp7k;R5yu%VQnCfDn#zrL3ETg6E|=@bWH0{U`uJQy50#!UU6sy3l0Ic6?1n_+y+uei zi*9{p%U*Iwe1tDMP!mY6!Sd5`*A3${bYvaZSClH7AHklZFw|gKao#IMs2^N`xF!A% zIM(Gx%&O#R^OZ|vE?@^QY^C|s|Fc%{Yk#%do!cje5foMh@z=+$Hn^#UV-R6x#%cNf z?w=JVB~C&GB;D$QN?$d|h!?iKZGT{NKQF&qLxYMo^kp_MmsyU@<%G3TWcvuhbzzGl z;?Keq`})(&JLkzJI8iH^{MYmfc$4|ng7S<0&@{B&t>`GBIkspLq2@q&7=JFpv1`C( z5RFV$)2C9h?dwIcT1mn5FM(tBxdFXYT7L1Pq4ZS%QX5hKYkBp|tE;od)Wfu#oSn0a z?D?cKr8A|}V#;?D)tzr|-Y_Nqu{&#FM=3-Z20m70(&f?7K^nPX7(4A@(;R=YoMBY{ zzX8Cm&%Bvh~E;2m@<7o^}1< zhX?20_#j(m)$(uY00O-IQjQM~;ChuT1jIw=*)eB~lhhc85(1fK-7v1kN1xiA#A;-q zfm%IDIR_gC*^JT({X9VzQ8*-KFK8g6;Yq_P$Qy;0LSxF+|cdM0vWu5X0}s~ZLNyfCB58-a+3+W_L!fppaj*#*$%eJVhykP0 z%lR?Q{syjEt$wLJ0!R1*5rtm1W(f}^#jVy2u!QH+-kC0_OFXUe&T_MF_ zz3CXjVEPE27K(x6u(Xs_e=)EQanlGWQj)k%qy$H zC@X1r&BWx9-Dsp<-vK_eJ4%MD5MWbM8IlE!DRJFbg=2o8_607WF9$`6Zd-0SsP$FU znB${>9^<86FXwinPDi25XaEfgr4ZyQIK(hZ9=$$$!7$|tY(y)r7Xt|0b9SHzQ=l+9 zR4j8afeHgPIJwmT>+u?;eKE<`?p$%Hxn>`nJBfO$hzW0?#0KCY&(f&gylx<>_&C@1 zZYR9a`lrj;XS13Lx0KW;En`?3idkx{LG5H zCFzX9!mr-4s<8Wcxz98-R^8M{S;8!CA8*>TF7f{J`cxGn8!CfbpLNnqQivz5@1*(M zCt>Q_b=^Sat|AX_eAm0q zyd>T?`~VdA8fW7`@))DaWN0BYMrJ9teD75tg@giI@`?gKyS#2>mb@MxOIv+!{8D<|5{U;-<4ogF7ik z@Wi3^r3){~RrJl(mh3nprZnxnm$DAd-3Ic-ha z4zbD4FS0wS>f!w;^E|2czlCqymByldM|bSI#=v$`*x% zj^B}cU1J5P97jG2t6ZsU{nsKcqB~Heis@y{*IKW>PCFTlR$Q6DX;?j`&}w{KCMPNi z&-#eYo;C7Eu#DzO7ilqU=8o4ln0&3l^SQ|kDmNg=EB7LvC-JLb{k9|{h>MbYs){Ai zb1aW$Vi_;1_8in_dODRN=`&(W&CYdl|hE>bkKo9fzfA| z_wd^VlBfC`LVZ%_$6gqTo_Ve+ORP5U)Neu;bfxKG9i?fHwLb|oJJ`%q_OaoN;GWF2(k3<$T2L38EQVqLX zXmn@XgRu%nVm3Fa)nwdQ*X1}5ZDF_8Fx#Ta{1RkiHeC7yaAD1IjimF!wHs}o;Q>92WuqwqD4a6}M-9}IMK6Lwz?B`61|G~* zxsNlRW>r=3@hmq!s0=N?%=ByupNdNWSfia0;_wv*4Ut726-hL3M~@D0fepIV6G7dr z=$<#KU?%SD|06j4W>AvEzMVNf`XzU3$uMo9Oc}}d;JO9};6Vt2Qs;i_{Mx{xtoD$Z zI-qCCfKr?G7MB7PLFi>hMUcC8BPuygcTg*%xsUjS)lryC*Qw_zTDsfzsA_GDII?OM zS%Cd&UxU($d+i*|!A}@s8;F2FeWtB%)IH0*4-Y%WJFrakn3s+FYnYb-016J$lTAGQN@uxLgy(lUB_2bYi!e(c^(QWrY0O?Khrid1Uf{X(j~b+xyPpOtTlUMLfjCt zoX%mdRE0n(*JOGv!&2sKkS(T$fNOSx!?ae-DEl0*H%0r1JE0M8Mm2#MJd0C^Skn_Jq z29>T##Cdw(kgFEG23hFHxwX)z|5pu3*cg@AcY{)H)-l|`^@ud&H4|#v`2g53x=^3q5Ks*U_(cT-k18R^ z7COJeB`4ie_z_eJC7UQYaJ&I7zm+na&f(B3<*v?H!%sl@L!TQ0A2*8tAid7z8n9-J z6bn3Kp_W?U9O((DM?b#N)N+L?WwwK@8ex7or)JwHNn(C}fqWG_zv5=*-bw>WJyKY% zjxW0boQ%DJK@D^!k-wnH;&F!#YRHxFW;IRnYBHInv`UKioTyhi@u&3Q6FD7NW&ti5 zU<6>xmv%MR4otBg(OZb^Hd?YTYSqcLuoBKjexfOSb;GZUSXu>X?2n>HzN~7Lqd}( z*p08`Ms{2@nA*uWySs`e7xy>?mv;#=c(5gSR2yW|jWJW^t1lu54gd1j-9`L050gz0 zIxutj?lnuYJCl5HC+D*qJ=W)ha9;{#BuUG6VAEBi{i@g6mSv?ZA?MncF?1UG`JOs# z$B!k;H-wv^k+{A*d0c<6oXD;O?nic*{}NYE|22z5)MTr`3_PkfDEU8pC(4{CjGV$M7v+nK=C_MB_|jGDKFHh`56 z&GZrds-wHzw3#t`xl%>27aPjA7Z*o-IX#jiL6edyY)Kr_;!vqBuqzwzp#%oSvM0@9 z=$m7$zH&@#puJaOohMUKR+WN91!qreZgv5V{q1$e_vb_dl6Ec2=gb~wCH@7FBu~i? zcvXutM4Zq)_47aD1Zw=WAbQaC_hV>A&z`v?{$EA!iBh`&*u?UBDz?x+?=aL&7O94Z zla86}bH_x^&AMXI#x2oha$#3gCc^XQ>MoBeq`_~mZT;fyY2bTv09KpRJ;1bhRAWg* zB%jxS+}BUBg|uq9OsOFH?v6}0lgO-qOGR#Shulby1+3TEt}Rl#jpPv*s4*~_kpMhJ zCDs|&Ph2mE)%fCTCo0n78zL7rC@MaDqMH`dQ-5%9_p3^R_h8!o7hyjBJ3Sk@wnHTO z&~nKlRB}8IG5v8gt6P}lpEJocKB>UBLC)vNZ5=X=+&Ofz#n-pAx0j%=6cUjC3Y4oC z2274>fKvg7TOoYODd8--=PIvr2@Vl;jZn_G?qpX(mGfoN(iVEy{uRoPXW{vpkK>ht zY=&Xc8&LOMsYcH1HSZ5AVBkCLy%tuffp@)Jyf8kNvLosV%~?>Yh-BsE-lxFI#&Kt zE%FfmXc2sJ7WB2nA=NiLt8>}_vZ`1MB}dqU2A#$M{OLq{jzPMn+7h>4t`BQYW-(M7&q@>CaKVqrP9c*7~@ zmFUht`C*q+%(2`O4$is01ep!rX&oD4-igq==Gves0m)pjL2NUv6F1dCkHIJPbgPf$ zx88BnQphnWDFzb10tP8GSZv~X?aj3!0M%G?^H8tpnb@TpG8Ly^v*P-KLp+o~8&AS* z_QC#aq(9@#%9{tE_*p>>zF>SJ{Q|&^hee+>j~Z}PJfWp2qD9oNZFYPQQn?(Sy7YN_ zESC}&XJ5Rz7GZo}9nDu4m{o4${nr{2bQ*i}3`|ztw1^OyP0R%r-A1u514smD6*8l? z^Jq56%OK+%)IdGd?u2eN+VgC#fnCgfqgtx`HytAmobVSobE}m+*H?i}OvP%67=SHa z3@RlStpihPOC$>>#+2cd$Fuh)p43YXBjsoh(G4BleSFvN#Hr-|exqx!UTiw`^@ok^ zE||Go-^S1GG1ny5=Ep3X6=N1!GB`T(r_6&2zfT(PSA&r^r2g(o>yS%44~5lJ^^Q@S zosPP-z2ZCm+sai!i2mnWY2DEHXM_A=b6ebAwAMBAJ?#h=CrYWpO|>Wv*U4C2r_kFl8Gr(OBFKYap)JMREq^s8>x-4%;%c7Lexo|oH)zn((d^DgDS^iIc+!8ZL7XUcl_a4x-=P7pJnC-Ng{nc zbBvqvAKieDujeQw6$;n+mu3#Myat6`-FzotQ;}c;aLZ{s@~=My+TYJWhpM#6;%dGh zQT9Oxd2rSYG2P}T$CT<;cO`kiWl|~~g#M?X#p9eEk&O*6eYGdMMuI2taoNG$ot&Ba ztp2AE)^tkQmkryQst`!E+&lx(G2$~2jW6eV`8u)3D9c)NB~ z9YHDpM!KR<{vu4|oe)`+4SsR%ePkpLXg}Mh9_K#Sr!dr@+mv6j|2);@n517sAn*%2 z8LNgJ{p3%p3td~Cb93ZdKt93uzcFEv{o^&}H#s&{KeINIz>FOW<|9!||9Y(|WkUYZ zPy{_diPS#3F#mJ@A6vq_gFx@?aMkC%YljkQ>H?LXo};U7U2a>4lI5tuxgEG%h7hWi3y>e_CDvrJ#mI~;)lC8(}b>! z5bsqR0SdtsTVMsZN6ga(*DMH&iL2O)CzMDG*lSyMu#H z{kR{xIaI602tjKv@~9rB(*SsAw((XmqQUkSZE5EHysGoZEkG;umfBHs-zzhL?gs#f z>X-QC$BHryq>w9J$Qua09-(pq!HW2x)?(mDtPKkW(pR>3a9XO1_g5!W!elM^?DS7}U zbgu_%E|?3=WE0CkS63jSVr^`3;s+P5*HiRmkYpYOl(SYCcutnAwS%*~CR=(DRyVEH zm-~Kp&zCH%HAwvwujnkU{JEBJ=z6VLVWBz7Hvn)1M(_Kw8WCe-;8#Bt{`ig#RgGc$ zzO$0x(jwPTH5pSws1L0#f4L`Oz0PzhkYw#@f?RrF>Wj?%Y*wDJv^h+7%jj)miI9~>iOd*=wYiCH7{A}DT1TO z7^-gCZdhPR>&LZVJoxyHm)GYA@x9!D7nFQ%(E2$UOu|L+(it5w7B~+R^Uu5&^Ym9@ zBlvCh(YxH_D(aLQ+a0ms5DXKK>V&6BsYy}OiG6FfAXgB?nUBnFR&a{6*1Si5_L#qg zt1J^->+^1gTmov_9oJS5o5I1V1vyN%_V}=Prrp(&a|5Lo+VmK#e9A>q;xd3<*i0T{m$8|M1=HS`~jjSQyVVN4{#&vY3#;$I;Tk(#fK|#Kn0Bb~l!9QPd$#L)Jmm;hTup`?fDvkMNr6 z@jz_VUsgT(thMs?Yfq4^Q|7(*e#|3VMt#9FbY*?!Dc|VLGZ%N#Bbt~iW{u>&2>(}E zQGhUxi~UkA$Y%JV;c`qR(1g5(Eb}uS%xr8yu2~cw{Gf>A@bjMlQq*Bf@O$zV*>Yz)xQBh^X=`sA)y4HYgcGq}}Zf&o;3YoX2mYMpL?(L=rE}!b` zk0U#t`d$L$?ws#pkG)|5?)7nSsXN{Ndq?>8f4?o?z=wJ@4&w=#es|yb<55H|H1oHvB-e|Y>`%{$3Zn|^` zf1!c@m&)h-ThBWWJ6;ND@UxRIoS)f8H)n_B4*6FR&Z6^f05$Ppx?CE%8{|-?7+lLaA%Ujz_QQMw}*)fn;RR_FAg+f z{$1A$xxKLTaI(2Nn-kFy_Nm(ch%(cPaE2Om*7dF?_4?@DQREMI;y?D?iJ!gSf>t%e zod)#!s+so6fWZ6+DphR6oKf~u){+AZO8+={W$gy=qC+lFi5Z3kwl*ZU6?hESt93{r6G6ylMJ{X-he)o}iM5 z^R1IM4L}MN6*#lu5_m2!mHTE&g41NM;e;3gmL-huCYTyYx0VE!_pNKy?o5+LiMvbU zdMepRxzxlQytk%V&vaT@#5rK|8WI5e?~lQY%j1Tl1q zon7Va$!EBD1IYmNvGDrkY8!ZksHk z<+AIy8%2F9CDEPp9~^m3=yo|^?0@RPLYCQ*h1nrV`UNO8TKno6{=7`Bk#+cTxng8# z@I(*9;o>Xve7~!}>1TXctk5d#c2t9TSy+HKnX+sB^T~`Ql021q1(pLR5oJ7tf^KRoL6lc{(@()ICU#mE} zZA;;uH)&!ZWlXCw4)odO=W(WI;2XjM&65s`SGfski)t#~ZOGL=nnxx@RXBSXKUv}d z7&QN#cX#65d;57o1)Vl~mwE{oKN-{9Ta#-H`*JllHtlMgk_JsUqk}Wlh*`t}&a)mY z&p0>O4Ys^I+DiU8ge7cwZR8-jqEIlW{(%*Y{KG``DZFNO==W;VNU$pEY4c=S4UVEj z=1ASvqU8dci?aDT9>kVx`i)|b&Y9j37^|B=YL)Jb$Xs-*<>-|)h1skLh29C_hFk;B z8V1`r_pBw;+is7?(VPB1?s2fMH(=yK8s63yX+(TRtb(?%^fZf}qa7b+6*$v-_3(x= zad&{*WIHs2aJ#Uzf!YEru3fQF4GXn%h)FZju1^1~X&TDsDnPA`v!yb-cqRPf9l|FG z;SVCF@(Sce7s9x9kpAx|R0OVpmI=fQ;0AwWz(_ekP z-1AYJ-vMKd%#F+*5Mg3khIm;xf&1D6!XXbr+p#y)9vqmeco|K%(aYYTiq9SJbzYGX z=o4w9m=%_d2Y6ny=%$^G<}lFycAlcVD#*kEv){0L1hiu2d{tW9xc{{+y)-ocRh6?o z0*Phfr*qS%eH`yjd`cR7^Bg*P-L#f!?W}0m@VY;ju>XaV zDYywp-J^CJR1xt+Z(B9K$=SJfKWSF*j*0fWXX<>&4^mK5F{<7c7VT5j(rJeq`6z?; ziefduB@|)n8@1a>DjVbeb(@iJdT_-O(Oc;kE}(wB{IxCzr?bak_N->kw9bbr+|KKEu1|J^2klQ5VqrXth&oqpBrBE0zg33&fcROHry7rU; z&R6auoDFLKGBe}JMaP0(ohGMo?MSE7Y6ska0!j65PEYN)4-elVU_sMR$uaxQNrCCY zXot52#;J$(srquic5=5NqKgZ%fqezuG~~BZcBZA9UPWsL??3X=L~MlU2*AZuE6KwJ z>SqbFBVbp)4GH4E@JN?D%e{f+VAY!O(7Ff?0(NO%eC{)@^P_;$a~rZ*anr}OtVj|m zm~uh9m)$nc{I}-9SHV%GE`WC!X6b9ZqUnU>0z)kmnyXo33H>2`5VSILq1T9%utADf zq}*JavOVPF>JK4cND^g`$DhJkQLtGpkfE%))CZeQeYMA=RXcxt>5NhmAA!|oT+kI| z)IVmG^zt5usj|-Pu!un$`d0him_|s)y3sPZd)oyOCn?3wv#V0 zDkjHk`!nW{XKopRe&ln{foajqB<=KZr^kZ7mCW+*Hf&}_C@cFFbi2Na?*!3jw#qn` zh#(vlIF$v?tb*zz0y*h{=zrJygr}`sV{Wv*<({T-qVb6M$NGM@iOc>Jc7x;-ee#>Rf~#@5vb8MvO4T*3DL7 z^P0#>XE7`NDxy>VMC*uyql$Dqfd#`_qZ&}%osZcAWa z^QJ$0y(!V|C4LcX*)&o$bdFL%h2yHQ+o!4TQ~G>2RArxJw2CrJEy_*Uz-(h1Lcbwt zHCQmS`Qa^e-1ElH{17-&hU`rGrFE)WDi7pw`Kr)Xhp8yvZpeMq+2fKFT_Db`>a6|@ z#@BXN?xPVa)IIq6?Tq|R1_z8VlhHeeHqi^K>)=g;aBz*q+>7A;B|CqFxhkUesL;w~ zyVGz6)kqDN19Wl&FHJm%8plIJsg9LY7YnA9}L_iIHJ`mNB_| z1jt%{A_4FzU`T%`7n&o~7?+wDz%o@teavekxHjYDm zcnU3s9^J=YXfnC@-RU5x@>dE-p4qZ<)fE8+u-m0C0d7lLmga1a=faoRvtohM#r@kV z5yAPLDW1|%{hZGt)fwMSTraacW7WGn83RCkpI06Bc@#L-CLtdG?`*&Dp%7*CboAmQRh^|`Ed%BrjLG`WE8Y~`~hzn|WYI*q3hRAdE4{~>&NxyOR# z)R?~3-HjiWh@h!Tfj+Z?3HxXy=s_mD^7a8DaH6$+fumu(cx%(cNFaUIQ<|o5s(<^H z-<=3p&h*8T;--$Z3(%tsd`9oJ5rRdke_L=(dS}S(0Y8(ib9%RFV%xkol$xw90 zg|xDZS4!^c?1r>PX`2_oj>b?E=`!{yI1hruG&AMhYY`H8{cfPf!GoYH4kQVkwE;Kz zv=E7;i=Aty<63;bcU@PqEj@yyEg7z_Rp53CH2T~S9I_oU5E#HyB^tWKK+P$C4bG(7 zx3KoJl1Gou=tnqFZqhCh@}3wD4m>8pwpTtBA*wGG)5kE0TcBm$&MxzaTWH5%@*)veA^uFIzrR<|ERj^xTe=H3>Fp`hyely9im7{DkwO*Yn0M0 zEh8fy|G& zHFgGUmo}i9{(gQ!c9i8%p2cdY>ME#Qe(_6brJ$j$8`+_|35@}+x)?uVscLsDI^*F9 zL_xnRWjAs5bT8QpsM!=5Ige+(2x1!)iaxGiYke(0!2S7sxuxR$;pOP}f6tEDOqvN3 zY-<1@^I)wl+5UHAZo_l4NokfI~mUQ}@CV zog1eZldH4hM|XLxyvzBNNF>rSp!}Y=mhcr{k@CEaSda%s-kBxU2XiQ!CTMzZ@RBts zbC|;Y&x)tK`sa!GoOC0$YvV!;rTmbAQ!_>L2-+IQv0zHdJO6M3fYn)`(=?UVLrkZ> zI=h%$#%VbL%xyZXCVvUQ)~x)e#(yyPTA&k7X=#i6x-$23^gs6|n;re9cMeo*&y8s4 zSOz90l3EoMbn%p3M4F^*bbfx zN(u4Mz7=1S@EN0$aNC4s98Tw;DbQEiG&u5*{u%!#riusCM02>1u^;x!OaJXM=v-A% z{o>9P&gH0Ij-860S`xQA7dNH5l&7iH`f;hU+|qkBvXM4O7pYOys<@&s7c@A0p1n7U zLrJ(n=)*{?zB=_daL>7c#~k~g8L0@MJsjY9BY>dk9ht4h!Bq{(_u60Y*XBzUjT7m| zF!WIo=Kow1f`9N2fyDG!BvFSWs(qHOSk3;vv0gr7_e{& z9Q?pA_Vl;fY|)(H;4((lV1_LN$I0I|M|w5oS4?2`3Y?%?QkDlF1ekGISzN_!RGMaf zxn>R{W_v^mib`4}lB_ zGqH5gBQ{8YmpIb6CPnz)?CxioAm1(jy;?9aa-HpsfWEl5H>4~^9=fe%D-N@-EP!W;oIGireY*b5)x$mKhScFn`LJBjqkKTGgI0czM2V*6DvA4JqRQcr)h5H1HTPP|0 z_dT@uh=1IfNb&t^X=E}rVf#!T+5xW4msbz2IWW?w(A3RDM-JKCv1| zY?9ShEik3bP=*HAJ4oxciyr>z1H&^yS2k_!Z={XyMb=v1E@WPMzaKl=3gS1)^Icx{ zpQR~!e0)KRBMPj}2D|tf@%1sWx=TRmD&-3eHKg`^nseQ6X}+91TVpGHRSn~3{s86T zGs1vf={hF-@uZDINztX&SZyb;}a{Q~Tdxt9=5JJ*1o_|EQ*_j4w2iRa2pMlD!^q9BnGHP# za5oyM*@c8ccES5y2@^Ju)GLr859MF~0DK8#inM(EHjTmn1N0Au5MT%GJPB8$Dt>lQ zQX&?cuWr9|AR&c#j~V7~2y%UrdZ?0pe&rKQew9%&v|uqi)Vo2%pzmQxkvtRU)~Q`S zTz89m+kIIYA9`@kf}yzP=Re6-tl?_!f4`Kf_^F=WW6|v(kQ8QYG!S1irh}CfO47d~ z<55{`^&cMTaOdsl(_@V74>!N7>&h+tmEo_H^CWL_Qr`L!56siy0jHH>0zw4sJ}H8y z7CqS;l@n_R^S*)1)H+b|D>t$(gJNxcP9-n2UjV~uAVj8YcBZsQqB zgt_=?sF~{bjqWN!JEH*BP!mc6QN8=faP%?y2XB0Jp_JG;(6WuZ6>YM&#U#E3uAtpb z1bMv^X8#FMniv{=-3%*hBm>q&!+WvT$hZ?kWpD^5hAnJ?NgSnaiv81%S!ONN2Cf z7CN#+gV;KSqE8y`po3tp9)}cmoD|{u)Ofwa6@+rr{s_E>g935fW877uKK?iS z3_MTg0EGu^cg1Q$SLf;C|D|xpxA@j=1BP{loI>YJc$Uwb$vu;_h2n`1KVFCryR;2_(#SV`|YPFFRe!+S%4bDDkJWNUZ)A7=bho~ zy*SMFr=m!cmDS})j9`Tn!!X#kwa!pOss8)p+gkQD6#CQ)lhPj{z-Lo3WjwWu z?UWW3OEa&8+BkbXcJ9_DOzT6e7wi~&j_Ji>WRl+Z3J$qTN_khNVen?UlwYPif!%Dg zW#xD2L0#aJqp>E*e2ayn*_ErAWA2+<4hF&?qp%`f0FTw+xcc6*+(T5Kvx8PaOUXk@ zrV^Yk6s3$^_(Fvvk-Bpz++F_+ouzy4aCB`Z^{z4<2l(d|=X>S#T3ZY#@ljLQn~;B! zMZtT0(?Fn8^zLAtu*)0UayS;y-H#(xdxwQmtmmKnY8j<*73bFt0Pyj^Y?Vuw-9sn)%$nV%Ch1NW;C*FO_Nh*j+tSjyjUgDroqzs09J zTUjE>&9G_ftfzg3*3un691S!7g_8>^YA!bxHRh6{O!Zw5T`ns>Q7QW~Om^tgxx`B zo$zXTq8Hzzb7m-OX{6^i?W2Jw5KWiLi627X8#qg^znPj}12v3v_>xN#OuzRjzdk2~ z7HnR~Hf@Vutc*}nA1itC5oCbgdVMdrYEGQt4{R_S1bFWHI6wqxX^#10>zm0{IRK== zr|i^DgmVJ#0cyD|23s#&DCcJ$JFlnrMIhBOgeNHs@ki|pS7z`iQP(P*t8^s#clNCs zX;%^0-P1U8z{zd@PKR+2=vV8iBG606n`+N?zSagR%7E;nZh5VocGC?i=>%H?L9Wk7 zi+ldN+0PKrat5UD+Tgyrost^flhIDAvIb>z+%1j6S(ny$F<+zaO*0%R#eM z%5$In{p@aM=WD8{v<+(K=fIdcpRp}W%#f)Lbc5#9b0 zG#ykFVa4LD8A93_qpWbjef4wQ&jqw{=1NZVHRxp z%3pGKU9|#8!x?140#xxxoZ4NW>wSM_6yV~nT9Jde)T#*ZcmIzszq?132#z0va47Z9ZWKy@@H_evRMwEyazwrZ#SvH<`TV3IZ`zGO58z;p+*Yp;&j zcW%)_Kus=|V#2PmajlQN;$(lIFGt&Psx*?~o0k_C=F6*ZBMr01mc*KBFTF!S`PKO= zK)auHUv2v^BW5>*HRQRd%d)*oQq0m+w02Xp8t|2-N;ChzuB}6ZDB!@<$3>nHi@-P5 zdP^^|7D zfm$O%gixP4pjnr{l!i{+s3Ci&3_UY8=0R_ESUd>WT7IqQk?YtNbiKV&+48eAsaei% zZ?p245vj4N}X?xEPtUi|U3{i46a7 z*E^37zQ-mtZcV>qTUyI>)4RYmDS9CeBRKR-lJryC#5asya!5&4TsW)?j>rK z@d%IUfx|uzQnUSxH7I0eDx)$lOR?wdeIaM!I3$-7mt7Tlq&IP0O=13_ox+)HaGrJFsd-k;LYe1?@e_19d3k&}vFt)s^-12GzpkK4f5yEqB zvwhkO0Il{pr8uE`;&Ay)mzJ4!3+=-sgSpZZqm}4%_omhlT>$!%)3S9Zm!2_FF@3O1 zROHA2AItdOb`N8IzG!zBJCm}qqu{7uuZQs6d)cE)R|s1K+s@$!@v);zi&Rd}{t=NV zv-v&2mtdxgau6GwRZHTQ*ux`cz)6V|z-*nZjU{7g_mu1?=LFxPrwzN(-T_I4Ztf{Sp zxMf1BvnDsb)G*D>q^f@KF(=?m;s4X_CCPHFL($L$RNMntZp~>U{DKA`qW5X-Z_tZcEGmVrZ zX6PgP(zIs?%Y$B+tWTeA8O*N}atL-h&dd@;{bkm(HBP}=hpILH>sjn0PmaT$FSu$9 z0AG^Z%b*vF>pE5;#r&QPz(~!KRd=?Ve@`3uI%WB|R7FmzKX7$Cc397Ob=Z;Q@`mI& zzV!o^k`u=WvlK+;Kh-H3X>?^NZv%N#EwU%K zU6$1Nq=7_*h~Av{o7z6(2W3F4G3&`rb<&s@mg&-2(|O(1p8ZIW%~AZ8R|OCj;1v_L(cX9 zA*EjFS)$P7t%pzQPr#2+RZ9~LRh(JwWz@vS$Fv=*@?2W2+v3?sIYfyr$Zuq+nHw#0 zw^mtzB13Fh*MvAu1mF+6-yP0H(enuSF3n)fve< z!?xPp}e;b@{sg=RmrEj(Y7TPc!neCP#9qTD_! zAln^`qk|-gbZ^p|==A8u1BfPKbf}%4v;4Ni_PO38f%a_@plAO)Mt8@BHs?q{)@okc zG{xxa8+hWkK7v3za`Q|4%la)9vp;u71Y#`!y{UB$Rp{9M-hU~FWpaX9OVFlM@U*cr zDGUp#h|M*Oih77usTm!Rt;mn{At6=x%qW<2n=Z%wxsojK%?`C7avZVE*B*j`snTyRPz9u{u?#y_g>zjv30edqPtI}crSC78m&YSNuz_5Hja*gRAL|amQPkDv zexCRPOR1z|jg7A}e>)$`#+=ND#l;R{$rq8MO6G?P{nO06+13w z%`WHm>TrMNaiI$YXviLJ>&-)GmYg*0msjh?)-Nhfb?T8v!`bdWnzabN#1~@Hnj!TZXMQ4W{o_i}P)jK$<#i{evt${lb+nlTYdsR^F zd;`>1l^}UG;)9-2Ljlz5Cyft`C7kBD?|q)?yZF7rSk;v0 z#@+J9kUFR0C+ zHW-0{8cIK}_oRwv8)oxBLgZhHyT7O8gNZ~*)zJ)1#zeB+3(vgk+`!#t>mkMv7#8C7 zca|%q-8rFM_UE)ED)KZ znQU}R3d-T_FxDcKz<$9uA(&svbDsD0iEXbFR#hy0V*tp>j4X$F_Y-yMT zno?n&qbsNeo5r8R(OPj^loPVP>&PrF#FrX@0;BRx8DwLsh|=<~oKcFji-Gr~N}_*g zQ;G0Mm;KA1aIT|Y#mB78C@ko;f|?vaI!)p(vi$@6sC<2cuD|iCtYnv~4e*htq%@-> ziauiYnihb4PO-V~Ma#Ci1Tv*EsE@9kF=0(Mf86nKAFR@JHOJ1yoYg$p%Iq`CUrTA_ zpidu6N_-qTEHO}9D3I>(m2-SrR|vRCM0A|{+ULBix#`!5+fG_si+BevP=xpcoAlb*995*Z| z-yDj6X;{QLUf;?c^5<{*&Vlau#%_7GTsSk<@y1VZ&K9m8x6vbBgoOlM?|cu;V)Ih* zDzh>+mfxl2aHSY~xj#q=8y|d9LrFRitgoMkgHqR=y-^l6+3FyCDd)X}ekFGW*Y!H) ze314LK(VQB^ zWhwDN>3Nue$07wF*^&k}Q(LaBS2C;(iVHK9mm6iooE#fFe+tfdQT>ZGKq^!=iAt9^ zwG9j-*;<}ncf?E$Qqq~tq`q3x154OHJ5-;ftCVToYqK!rmmGf7>~Q+OM^vd&zsXcr zCv3fBepgn(Nx|44)SS9)K<;@Bp%=CSy4) z=c3huHqR`B5}O3`sitGU)i}y9OP8c8->=$y5%Q*t@!GfEg9Zfx0<{;TGrnM$m};ud5w+_64pFdeo*9+0yS4$F zew#}e=tRP`jcV<@g)X9FQ=FvMzaECIlnC&g{podWuC%}3g;W+muG5pO^x0M=k?|x? z>q9>h*2awMx_{P98-A2}3@$U4r}W z`ugi^RSchelhL@9djQE*OYKkf#~m!YC;b`&dJfLq&ESK*gP}xZIQNPrgJ%`ODOsY!S0)*?1NZj)|sX~H}heWKc>~J+t)V0@BwDsHrM%Ts$R1}iuX=g zT@)`?(go(0@^Ae^Fc9BXayU8XYKz!xpV`OlQ=10UH`u!_N0JvXWGT|3f|`eTN6?Sj zqDDd?eu)>g&$PEyh2qSea~B_gSNDg9)zlm%MFp()ZjRZv#XO@C>Z_NN>hV9?FsmTx zY;v#_LDoO`AwzCqWItLQe+87K{?QnN7f?}lzfBt$_WB>ik}@4eanG9u7Cdv=AV4K1 zuXec_3|K2nHB`^j{3m<_zvm#Hg0*vk$wz|hsY<$8@uWq&@R>!g06fOV!J&RoW4NK^ zO+7i$l!zxN9JH|_^!Yr*d*F2+!ox7TaR-PT>sv~ZhVTN()$PwCoBJ}vGMN#3B(rIZ z1JzFx0#0OKXEy z=W>G*f`9u=^B6Y9p?wT()3WWR+7s_>JuiwUTe0n01Y1Yf;RDGVnC)_l_LHbPk}MG{ zJ}X|Zh2#KFLrl~5BQGNK+-a#Y&2qqRLo^`|(qY?p=VuC3wc;u2e`;{v4^~-DO)EH( zxDHQBKs9K#RCFtbhV_l!dkb^%{*W+f;#Yz&91P}QngpKg-$xwcy_SAI!9~9^sA{;1R;qLZJLFEuo#hYl=`OiRd7P=fy7&f}5q$OMjHh##F2EJ6 z|eOq$Oi*3|Fq&vamty3K#C(w~4LV<>E zw!%j_qAhb^K+wBk%B=jdEBG#Zwj~cYzm~aq)DyqxIK8}@n$hA7R_>46@?7)PH_hi) zxA6_5zFgPfrRC(WlkAYHDOl!>8#fLuGl@Dljns^H%&g_r*WX|>S4wZd)SDnXIyzqM zZCqGRjWFx+5;K+H-XZxkm^AyNj`lXy=wWfuQ>JA?d)r_2GhjgpvF5B6O zH_%Z1Xt8tuLvm3qvJ_p8f@1=7t|9gIMiS0XN=h5&ZiQ*dX6fjJ-Rj1eaL2XrB1SFT z5&s>C<0bG8o|;J~h$j5z)OV--WRLl!z3!;qBSRY-r-UuOUPFx~-E+2`8$tMCt;!y$ z$q+tbQ%^1()`SB1sWNz~X-zP0UgblKr8!gEQ(Quk~!af>)sV_wC> z!!x(`+;tDq*imKH=uICHW?fa~PWRZKntu{}Pl&MFo> zUWpqzd`3EbV&bsBM_gyNaov{PNKwO{#S}=~+>L{M4_MWHs`(T_3NrLrrR9F^cD3V9 z@agt`&W(9i-8HxYZHRg~Pl!EKs*Snopd9VUOz0NH68f6ej!d*=XImO>w&+nlYgbC+ z69nf9Ji$3RqT>PiF!gq0=iI1r{^MZSDxU806zVrBD#h`QkhU?|J3E=dL$5n4 zu*Z)p=F|4#&#tK9v!ht&ciahbZ_&-(k|6& z(X#%3*^e~hM=6o+DoJa?Cz{havsd@d`%Ddo1e*VMS@e;HMwm}pL6rZxQyg`lx6y?8 z?E9OL@aS0)=7SyQl&w>0d#do8k1`d`IJ>dZbH3Ap-)uov1_Ts|IF5}i-{I9OqC0-; zim+X^K>3mc@I|$_En+z1XSb~BNXi(ih^)auVlHS$U%leb68U1nl0%J>v_n-)Ko zK@nC1i93&-8+VIXe80c-44b^NJx;^gGYFQyFCOD;VIUZ!>?ZW|nhk#bzE68@Be zcw~C3|86h22K_TDwtjt?3HGB!Z>;`c?XPkLt^t5UA z9;Xj%Brmy|vzY-6#74?q9bFl2W3E(8GYYyHQX&e&h7&{QLU-LnIRZ zz`+HIS()M=KC|FiM?mX!LMOIfx%Ipso!C0?9d{71-`jLMyzC~Ef?2-9+D+n16ETw}i zeBk4qo9@$ZGa2aVaaDx{1x9Kzq};S5Fd07oOvd*I_Y&^-C72eDy5Ht%VT$tZa59)0oZ zxe9;yq`~$$>%sH9fW+<`GKt6|I50Kc*n2==<>BYQTaLjT{O~rtt*Y&w)tc;@aWy=) zd0ILVRowDSEZ@hd&J37a(vMM8UNP4*AB!yGdxwdgR%J&Wh`00+Hy>Dn>B`~AWg!yq z`*tFUD&PpwkjIE|Ce*3sfpw}>O^Y{-fEEqEB9GQ^aiNh3?L_lgYiT|1J$kL)Ane~v z1FA^{_tyq@gV{k%Q+BvpE#XJbNn`1;bb4TEcN-ZU1#E{_*EtAEPP;G8feBB8-l^E9 zy8V0ZCzHo`RXCO~7B~|` z%T&M;f5lN+?cu}M9IBF!=sA-zLP8W9h*L%?_ZGT5w|zcsx`ANQZU2z)e6MMq>4Yc1 zHT$ms7QvS9bY}Zk?CgjoyR4SF^vr#7(cI_;j&UezfOVrpQUzi(gJLP zn{)XCO+fbRFGnCW&G%VIgabRUXB+)QoF+1|mGtcPccKnU%PAb$m^!|7HQ25TKjGh| zR$;qw5jRnz5IHM|CRRRrp6T~O5sen!+usl%>@JutAKbVhWIJ%gSePi7{Ooh!#WqKz zD4A3V;0?*{V(23o)Z8&+|J^r@W2=)s9@|J3T@w@X2f1?iUA!m)4Nt|mHr%RRJY-O) z3*eLAPQRoSAv&N~1wapz{c%L?cFH&{PV~kN*$8P@WNU=X=%tm7`9%C;y!F9!Rq8ly zc!0grW36TIaO>i&kz1GDN}jgZ@$b1pnySHzVaC2|?!Y0U(P%7!y>s&meec&L_r0x7 z0j{CXk3v0$?We(m{Y8FY1Etb)l`7&(IIl{U^p z6xFU&ODjRYw93P?%0V@=Z++JildaXL%l~uVIMosKN=ZJXxw`x#KmlcDFmph0AQZgI6GSbb^dOHZZ6u?7!c> zw~Ux;H1zNYi{&#;2l!?WM;v`AFyyX(HkeH%85X;O2@3RWoAbmL)j6YknCmLs7Fci- z6$+X1bQ`CBe4z7RH7FA}aeO)-4&Q=$iABymW8)R)5l=hF`}&xcRfH|A5x9vdKj$J- ze(rl35eIwzEnluOa$dh~0_G_7R^7e=j{x!~+H`-M_rV$Ulk*MdR_@WEKVnM89bjAW zn8i_y403nlQvT@B;<%NLc4(WBsHi=8|B>PToF-|ngy=E$Maz&G#SdV;32^~+czMJ` zqEjGHA##s^MOdeL%f^|mnWLVS47+cUJV%VH?Dmdo`C-9Qqkv@o&p8SKI99=}AHf@& znXKKq^00&_B=UYNR@l4r03X$Pt4>`hwy3Wo2D5|SICb)HI9_$6DAVmaq?fdYq^`gs z>*V81#0RTb=;;f&7m~775-XQv4!lR4F}taLE=JUf=^qiym>@WFQF`N@G%Jxrj{}mI z9e{v5oVlsT=oWMRNu>-|u8iHkIsW7z=-Iu*h*Hi#yu^R~iMDy^Qz14f#l%p?a$nOh z&uEe5B>MA&uemjm$JGyoTZqJ4RO-*V)XllpymJDPrn~yalYn0Si{NhDf9#U4OwD94 z`C$DxVvftllXiQ`r%pbCrGK8Jr5Wk*X;*9Cu8lrrGdccl&&DbB$gCPxKgP3ZLfe^Y zP|2;wo{1_Hv-FleocTGZs;A>DJp^ zi*J;0pDK3?ABEa0c6R9KVKL^)4)2QUr>8G&<44PaIn+|}dSwpQKbm{ZlZFv`YRLg6 zog23;JL31+l#tk_7m}vkGix>@JyQPEipitSy(tF%pQMACr0gEvw^28jGkdP;Rpa^T zV<>PGp7^OteIqTG)SO)=?28(WR8&+L`(&Vpk8KVHl1UdXvHEnGK+lKNEDs{An@Ugz z%^Q2uo$Lvcwi&7{qVj&k&DeGeP2C9PNsk5oHZ*aq)bLEez3aWh)Hcj&i@*H=)wRW< z%gJyWnNa~yF;FF+W#@q!L8;Q-%R4F-kI=BpRC@ctSLdj2n_WrAk|*)#Euek=9GdW5 z#Mht)2nVmu{{Ba@pKz|kSbk%%`|VCuOM6%(x<;$lX~cyyoS9$gEQ&^qFccO2AteXI z?xv2T>pJj)Jb;fg*p|SUIDV@h#aI7m4(5@lQ>*LI(J;wZNvyKlh;=lquqzZ{xs$_o zFS)yIje8&0D|J>Kikx&Z!<5rn1_&ki3^cg zNsX_{Yv7N8Z7*b*0S0hqMvYrUL^n#66;m{Yit@T9lNNioI3Vmwv~SKbE?P zxY?+-a>kEf9{|$>fo*h4qF^Q|pngo3KMmc=$Z{nGuo!AZ-Ax-dE;7D7e?wGM%>+4u z9L`m9ex#sKAy(AL;BcI@rY~Q?rYzJQhh$xx=DXxp>f><`w^%2Z0u|tHeHM7 z62yL72$LbOVKCV}XV1ATIu|Aa=0f3<*3$1mr8-{QsgSc+vP(1T?!DPMra9?m729*~ zx<;=6Z)E2T`ZKdm?X%}0{f>u>gC<$7=axZe!&F>-Bum}D7XrN3r0+qXZM00BbTR`+ z^Z$M>FR53*ZnqFDj=0Ye1p$Xs#qs;xwX+$g!g-J1Kv-L;`v@j>*M5JQ4_k9a?%Can zQ%d!(RF5Dn5YjN zJ0RongrNhek!f*sWo<6o0-p$gVbEmem;#8~AY~|Uf(Zj91V;aD=<>fslZO*4I*2pyWEqfz) z5arK)Jmoj4*0(A%XjVAgPdj3axMMC~zCnLALJl=jpV9>KgfZ9u8_338a70HZJ@hNC zF=DUiHY_gdxRk~QNp<49e?rX2-Tj@No!uM(rlX~m`{lJ*CKMR8wtRTbaFuVlXwh#A z7ufe$O$jY`hSX8zBofc?q^!fLjF(4T(>9;((Zh0nu1w*#C)Su9?>21$+Y=FI5;u<9 zLQ9h^8gJFD$bvA~&-Y=Vrh`#IkGTDSMw?O1I@9FAcXN1tk<_xkf?y&)ZVbiFf0SHp zbgO3Ujy%NW+2Lqe7m8Vvn5k`%$nfnHwxkt|SMF%Pl9rT2oghWj#C@xQo{`#Q!i|>o z;;RW*QFwj5YB=A}-$ z=5nYdIieqEEaWB)fC9x*u8|azvM2)f`+Ys>5*1#ExclB8%zj3PH z-3oMk^X5?-Lt1oF|sSnFt#KQ8~#V1n0j8Rw2-u(Ppyv#JQkbt4* z&>By{V1I$c57E(=)p?P54ud7k3>`JKYeDwHOPeQPMBFxE_j3yzfsmQkr;tbi-elIj zU4BvbY5{QRW=h|mSnvMhq&wFhNYUfO)km{-CE(hIBL#P9I2LiVmT)`wCG3P@7+&e| z>1z-dmy*W0$kLO9rFdI2QIJFSTt{~#Z+AR+)I4IXRp<8%o^4#I{OkQY2|&mIPZwFf z7@Ey<>lWRFSF3knxR#DVwgM|D88FmH3g951<0ug$`sUqcJplpaaj~hZua9JdxWll@ zGt(5;uds^F&rKSdzf*87J$}LLc+1t`r(F#`ZiEhm^A5Ux>S*oWa;L{as1`$%jb6sh z+Lm51-!ErJaX|OGM_P_)JKkff(p$hnT@ljJ)az3H@^h09iapsI#lU*b$}=nWkR8lw zSLW1EJSm}@`M`Vi*O2xjymapuu3V;8WtfXmeEbgob5~AE@6|EdA-`>srq`qgVi-A| zWy#w(oFL3p?l?|YGr4*(!h0sH%41TkNJCq@tvQ)0?IyrKzlY@hmN&IFH!tnF zde`su)(R%Oef~tnPKmqOsTG^5rl+SZD+~cj($?0zg&Y~5uSx(HITd9V@ASPYX>Whw z{N#_!JNasKVC`&pY?AM~zNJ+bBCYtV9<^KOm9OA3k^v%@_`r>6snx4GK#{fBTm8^|4QAo5MtL zz6u5SY!OCikXrUn#GqA9XI7B82i9k*QX^JfaWB)okSWv^endAN9i770uXh3+O^|vc zMm}Z0gn}}u&IIg;9;uYLJfLLV;Z#+Dok+f;r=p??rZP;*CAu|541_6teR;rG*?xNY zXzypH8Zf+mL?1~O+*E^}Trk~9!!uORB>y|=U%MEi;MS-vz;bu*<~(#mvfcn(M_e1i z8_K)+^IpR{r*n(vl{um!BO|pnHE&qEm38nUVj`o>+@TOpzz@2zX3Yi{D7m_+@psx(WVOd)w=2 zZF8;_)%dgr_oyqpQ*ZSZ7{nbp()(PJWzu~^0CXdIvZ|`Ij0iXNWTj=2et73jKYzG$ zxq6oiSL@0M5(&8EnApAGXHq}E&%l5OONg%H6i-b+aZ$nM|U(9zCjTTaTJew+U5}vkm9nOcA z{fIlktFOm<6(|t&{rj`Xtl5V;(RzD!UzC zTpb7~8-7mnuEQGq30_mX>P#XI1Fd1u%}*dE3tk|@eO7%Q0(f5ND?9TBFoYhHIZ1Bv z_Y1SimG!!6RS)(T636PiP#}l^lmNqpi%U`78y;x1sBL!wfx7Ki2)i{yWa+XHT%d%n|W$CjN)4V!nK3Qm`S4MZ?g6+37a%siS@7IB>maw(byTPAp zZFTwEiQn^l+?t!aT^v`gRq^b{^u;Q*dke~s9zA05ct?GhNHe5cv@d@~W*=(&?2~qO z4u?H@*#owlJ)#5E0!BY&NW*I#=GOr zAcy46$ShSI@FMq>up`a`vk>|VOiTzsunq#P<#21mY~&S1RaNoj1tCpf_OwTEK}^|Oo^2#W~=MYL0FlNEpJtRl)?&9h_INL7$OBI zZ%+~ba&_Ia|MFKl4>$K9_($4W%sW@0gQMF}z{RYR(Q-i6DL!_lN8^G23*CS+Rf;A` z1bhx@#d_q*l=E%(IQvVdIR~8m>0>pN z_ar1ldJn@!wRrl--{piT^KmV!hcz#O1e;$2vx7S|y zzU|(oZJQ*ytDT-ug+jqY))i5E^=g-F0M#Du?W>{jHX$LYbllOO0E9JKmgr1=XcZA} zYLo$F9B@X+B_HX(H5ygnyUXLZ-|mYdjR0*%*nYSQMg~5P09L!0RjT|+fC-jsfmSO; z{zlsS5#gUxJ63x!Ldx)2r2FmTi|N7s*(MDzma>S1G3rS^XMxr#+b5GMfV3yI>e0gMiTOq05Uu5ujD zcO3Uzj?p8dmp`6(djj_TMcw%B394&CUGe}<{qqE_b~_1UGtSYVemXmB*`QyD({}$A z%U0Nq)bg*`un9hl;k^Iy;ur z7sx-MVT{82dFEAY6h=+bH=;*urreWtJQAq98ALql?zP3G$MIK|U|XXYE)J2_fLHC~ z)8u3i)Z{Z#MS|E`bmpo#*uwxAV&hQt*=WDdYYR6gkjA&em?bm;!BP&}>arUoQ`o~f zW*MpZ1~DZEkbSw5>Z#+P~|k;Z;vSKDFhZ)svaqzo6$P+imhKTKfkHk~feZfa_r zVf*SlJH!OJIaq?rdE`e#5T)q%CJ7;3sX_W?QJ<%jymY-_J%ij z{CkqwLeLhdt<;1ocgI+s-Ffm^tYI@k#t!6(P>*+6m4PyyDUug#rI_g__uv zSe4e|B2a5nyIQ+(an$hzH4h~MR8TlNB!JqNC6Pxtg`Fn!+1WWO#hd^;R7+eP-vs(L z&-LqMeO9Cr1^X`7LI!~9vDcZJIxwgvm2>@-nwXWk)&bei16NVDIgcWzm-VLj4*88^ z>unbnodu+Guge`fy7?jgLr&+d#QXsA#!*YcSBLFy>5Ui%&qROXY;!GcIC1t_R=L<# zl$vxw>ePOed5??rCX>StU))Q_o#N{-9D2cHckWWhkH=0ftf4I#OM|^=)B!2-R;>-J zuZOv-21J*?TDz_kFg(O<4X&c9taSzykH3E>Eeul>FHvaWz}uy+ z-5hfa7nLIAQ(Z$GJnKF&zd^1~pT~VGHHeH(o>Vh%RF?b=Rs{7bl^94FWPM zG(A!Nf7_>P6NRQ#s(?n1%!=3I?6eTPG6BSr^ucelLv5)7AK0?9#Dt!IHG3s-(mD7* zVtRH^Z2@!cwzi5+wg}Rg6VkDonEv80?D9naHuQ-`iR(72x(g&9w!I1x3HEpeOU(}^ zA4Lu3Pu6YQ;ZsP!62t($sQU>A5O&8(%;P#bc)_xScXhd2T3MBIJLDiJ=Id!!GX)-8 zWZ;!S-rqg?##Oj3`u%0(>z(J8*4vK4XF0xsURHQuJ!7Jy?RNf3@927bW_gFX29rXZ zIhAmCfgd$C>4nKTWzBN(E-x3~@O(G)0y9H4n0gPfADu**yRv{r2W74@4|^X~ zgs5uj>IMl4-Zea(bgI&gwn|L!8NLoFYJ z%k=p=mOtbJ`Rcla0`%ddM|PWw=dLr!3~fWLe{Zx6_?Sz!ZXjod< z-;WyuHTW2WWQEtq2WAYGX}1JGiDM z9l1*^F|ooG$Kfrxp9Gurmy!87;Dv5MQatQAW$nqKtP$YRSFoU z>`hcg*eGF#0R9|Q5zw$?BYT5D*bpas?;R0HARz<@D~#}7tc2M2f6n`U&#_5?`@QR# zpXa&HJ%r*e8A^#i?FO{X@p;B{I;M3RBTSZHd(X3GgLjAr0-ek0emr*#qMP57U%1-) z#}Hd54|D6etj5M$U|u%pe&_MKAn%MRIVH!GDCxSEfAWuO*L8Gs4tvrUVs{pP0Y9va zl_&&6pKhV#Ecrh;Eje#`n?2bbeN>-A-!MnpSYc=rJEd^r&+-BmQMt#Oq%m-5LM$ zHEH98bT^m@zHmA=vjhZczW?^dX1~{5Q(ti(d++F+Xc3rLRpIE?UqY5|RW#deA-e7w zrBB2DDEQ}}Uw-IV_<}@pxw*x--8byJAq+t4dyl(J+~+iPRc>`u>?r4oS}DlRkC1eL z@t^$4q}p>aH|Q{Ks?l2J4>?0)^Bm<`@U%!N1SGU1%nPZZiW#Rj=15Ce-3kc+*@6QU5#-s7MHr8p5Gevicjq?tB z?jP&=*~lDaVM}=*?QIaf_*IsP>9<4%V<+%})~(>~*Li|)HhBwqg-Xlm_I*?hNcx(BT;Kj`d~D^6BY=F)Vl`Bq^zGafwoDzN z19v}jp36RUQ6&r3VJRAOqK>&JC&LgbyrTm6^|pa#{(Fv}m^xR0Hgv|;YE$ZrGb|7% z8;L7wD1eZOJ51T7XJ)dG0>AS6^P9{f|B-_cIW24}BqJN}!@ExycKZ)p%0$!iwW z53O?UrpZW!AyXS`v+KrJW7-IDV@4NMLkyjq@(L}%Za+~sv>(b@5x6W&d2$16-Xj7# z8`^%vrOm9=Jg$sn2rp3wD`C8An_N^0)d!^a-hz%dFujTVa&0}~b?#9927&k6TG%P( zGUPdZ*%Yj|?K-6N`%3+=s6^$-C)IvM>E?=Z{C)4*0~b!Sv!}jFRmrZXFs|HO%YFM+ z2Vi4Qcx(hN^Xs|mr}ivkLus?0IFlfbH8UUpAU&k(>QU#C*34h~Kc?pLnd!zY@PM#BX`&cmm5W1df+ z1r&r0U#H09y0Xe{N@j;E8;yW5k#4TQ(Nx10s-^;26eLI98& zTb{2A1ot1K9KR)M*p?I*7x#iJFav$VtSgw?EG*N&C`56C4886pwa6$Vwo!gy6+V0M zLSMx;qr0c)%&EI#Re<2XKkt6~wJFF_RM)`N^_0Pqme^SI)JuNdM9YkFG8OwtOBC?{#=)0 zC0{#}tZy;=T|)iP)BJNCe&2iV4@gwXiN#@~DL>+V%rMsgC<8T3 z%}8$0F|cE^>)za$$Jt6$o4Zw;ANKl{>H7WGZMHxdo8%b|kvu!-&vP+IZ4e3|_C@z1GdfaU2=;EmsPPae8t5c&JAP4gjaXt!$5-UF#}$h(-lI)PI=D8tx@ zDUclWc?->0sfKH?)#wVhNv+(!xT`J{(k~>`(fR*HyTcKqRgkPWe z2Iy55t~T|nfgLS2Yh#q(yRRGTf#?;7xPWE(Qn45zP4A&9BDW!9BY!|<%(SL@IN62% zi@h%vECpTL5D80g?C#X;i>VFT};{`hL}e-?)s zr&bV+w}1KUMGPCj~N%<9(GdW zcG%BxuGr{qW`}ec=ZkH$7u3mHxO~n z%ya+8PW`}@B7*NTdNw~(`>~cryyXp!cYY+D&RTDIOM__1tc;qjncd<{!;Cp)kDoYd zt5JlEB&*PV0r}sg{NB6)3$DE?Pra$gu@*a@xRjx=PBcv&0c>F>#vq-3JG+|%@$8i$ zc7xqf{rG=ITNU;??Us+cB}CW5{?YqyI)sB^r+ztRSOO_&xaLRXa>{v09692--}&yh z1`**VVGyN-g{v5wtt0F~kCM1JB?RYT>d5t-+KAWSAP?x-Uxdqc8B`0|B^;kP({Qoteb~P>Nh1)`ol`gt|g82 zl-EdNEVZHs-u)=N{*Nw2)3v}}{K*9Q`-VQHjk5pzrn7^&v zgwXf{pvBJZZt=*q*7o}PbM0qKLPpUN-+~#}M;Jv|(HU0zzT{H!xHk?QN~JK9jxg*m(1<2} zZfUNSIT5?e{TnCa{ti~z_&s%{0>fg-o7w3{{`+9;g$%Q?52bH``C*B+V!o@3uIhc-O+#@)aq{Z~n`U z-oe_T5!`(dr@v|RM|}($JutL_RI1T7V#p5}Ha5;Y7^z8!v6HIUcMf*v{)-}?HYqc< zS%oL<@21JcW+%yWW8jGVJDnev>NNF^{T=!T1-{fM9J=%B?W1S?68Pl;Qc!GlS+` z(Io_aR2s}^SpF($x-5v96UFP5C|}0{;~r|L?zM zpZP~01895$8pU#MaR1c8_mL%wF_N6i1mS9S-E<+`5uKaY^dFK3q68$8DWuNj5zz;* zdOZly?6ezyKJNVK*Ei44%qrjhIqlbf?kH{$PRTbE;Ac*q`uXnzpP$}St`fI@<8@^@ zN|Ha^5+*vm{o7bk!m`HT)ye|2?KE|VHeHz{$JJcA=SNbof!tftd7U5PzdF-u zE`Hzm*VFWYM~oLMw}=I-qAtgpB^`oC+f2-*n_NNIpKZ^DK9GmmpKZ(U_)ytW?Crm8 znlysA4r>c%3Pg3$r`mjB#6x?)Gt%TX_BA(kvIM?_J#tcwtYyHXMW6O<8PgFv_q%RC;z_a)rwyf+boY+xrijzmD!rUSd(?xt9sO^2Bj379|6Z_{DK6oynMb>1 z?FehV9h!`QUy`d(8e z9>cM^zcx9_E#eZ&N%Ol@nZ7^R^c!O%Hid62f*p($B}@Lcr?--1CM!I!&KWjvT9CG} zX)3F>2f`^L>hO0<*r`mR2ws@7NKTARIJBb4qefSjw|y-T9*u)aPn{Q}x1WN|v*Z~5 z^Ayv&jeWl9*GWZW=&hJxBg!h?@MDn01&^Q6J60nn>v`TX8G4#<)y;gT?AL=#MF+&c zr}*3{>3f?ar}~1RqhC#!IA`y|uk+_#!$8ef?l17m=Bx!@p~JTM1Fo`VSQT(&p~!{4 zsllE3NSn~}eI;3|!|@xV)aIJsdG_0ipI?8klbvN;y?StjQ~=ndXtr}tJP6evX;^kK z*lciNkwE@1T}m8$;|X_m@XTHR7_0Vx?d{@9u{)#EA;hN zvHxj*U;ldgf)MHKnQuahePy+YQQ9TLP&!HIXbq#ias--D+|z=zMsiY2g0woD`s<^6 zJtr@pknvb{z?YBZV`YH=xI?0o#o6=>xWS3R3^S0OZ=(z{ym4D!7fpCH4(+wQ?JG+z zH`rh%)^%4l6P_O*$?gDGSu)*O*VCb25fA=4Kzs#a$?MyLg~-x3wPTMaQXqh zQ1jW*g@lc?DvQtmZ4U1&8|x`l_dumx7L4W9gbu!BrzvDcyxkiClbXwx&PW1G^Ceo2nUA7RqDg7GbXb8C=ZXQYrhd{eAx(Y@B{`a|?=lgfw3GX?NyY^qCv0h7e-rNrK?& z#WpG^P*Az?>f8@IhYWIW3Ec#DfH+ARf>w8W()KihS>CF_w6tdfCj|901E)`$9O?F7 z@wPZCB_1gXEZ*Xp88C6Wy&yEqZ{=`wU`*DK7lIRVY?aXN zjTE4lP!)H>+7AkBTMa3W87=tJGOSwAO1&hRp#I`5~Q!7G(^KrYblPypSkKN!Xoo&_}o) zD}DkJtagsUb__JwlM_rRKRa{HiK@K0{0*Da8PR~5_aDcUy@lo;dIN2Eac+9Iy!)ebIL=eahcwL98bPy7*)$g%B9 zALpQ-#rh+z={f}0r5xl^58ifXd)1OG78e&si6*)I|YscQ!r%OSZj(Ga;s<&hdKo zMY_axIupzaE(9FF#@n&ec2@T*=cCwr)MHl z{buuxFon&wkB?1@}GU;MSoWpQb1Vn{mu#eSDvqxZLk1oO*FOQ)(ZqorD~TG~b&wZB}r5yhh( zOaR5iS~w@YIySKZPUC2-Gu2H@*y!B)5$Fzzs3@Y=(t^3V*}#HIC$n z=tu!jOYh(3`Urv=Ik2>KOeEipmJ#RLq1rBe5o8HFdW^4$)LaJHl}{c3!qAeQe(X0D zFQyB^#aSZeMVDAD{Cr%hsAV_vD=VcHX-$39rg=r0YHE6Pg;R6sH{rX5@tyWTTvdnZ*2v*oD z)RIuxDriGDvI8Z(J~Ee|4N-N*STwg_9aOKl&ex2>$&b-8#CZhY)Z2!{%Q?smJv=TI zpJ31{#}A5+km5!B7sZBPNsG!Wu%x)xMo^>`M`AJ>Ea&t`SW*;+*XWxpOIf4}h&V~k zH~~_k8_-+9gy+S6ccOu2dYTdCG**qgJFj}$HbUSmeevQzD5x<%pf)wjbLj{+`mL3h zP>#h~bld=;M$mtWlJWpkC*eazgqcrofK#>cJ~(~|>c*qPQ;iqL!$pv@JL#~nc}EY7 z#JM$*j;`)*l#O~+S z^Ef${+sDchd4g@R|A?({%#~XGeZ@cAyCOBJE3U9GwwYn!;W55afb7oJYq(jPp3XC{ zJ&o&2G%%Bu2RU!bXmARxz#ufFOKvt)cD`Ndq`aa2$lV~)$d&?F4F(CB(>_?MJ&*Lb zftqToT$u$jzYTPUNZq_o@HUp!$>e?f=EipFE(;@~}+0YW*o_?HLu3=IwcAeT~3oV%7B&=m`g z^x8+lgiTAcR*2_SOD?tH+{__u)Y*$->ihclPObdHyNlVmaeDf)bDal+>w#jCUM_m{+yP{TYJk~R zb&DN2!Pc20>1a51nAZY*f@3%nRAreRPetfVW(Kgy`)-c9^^li724lisT~u`{J^v$h zGy?@a-KZl^$%MgR?Wp?W^W(xKffhaNV0Lb4&+q=X>qKJ$fHquLEYmRH!7apByc zz)NF#wB@Va{k%)7#3y#(F$+F_>T(q{F&FsGykEHszjd}lSg>O97( zgS+W}8yQ<0iy>>IeM^G<<$E)9 z4j|Ym30yXiKMxubVhaPdt1CChe>Ew~^XEvked01!g$ssmIcX`9KBa7&)|Lw|>7f0M zYfC79p1|}DBeti!?l9Lg&&MYmao0e}i8(_~{Lv*eZ6k;i-nHmrP1RoS(G|E6d(@9Y zvUhMWC2v#kZ5{G!8g>Tc-by{+6@rQW<~CP>HXKfI=s+yISJegL^qV%_c~Ust`7yKu zuyd8=P`fn##avCxOo}OKIfhzT=qD>Aq(D5x6vs{fREr`l6<)#4y@u+ z9UZO02AB6XEYQOflnHTJI0xiMMr1#Br_SnmeK@aXyG1~?S0ui7Kx(R4FhEBioIh;T zk`1x^9NH%+BGM7Pvq_ole2diCUTjEg29+kZeG`6Va;n-hO}gT9^v&ux^gXRz|xbDHyl4F{y%8e8n24NhyA@A*p?;NzXJP zV5y1R0z_=E19q!^&Fy1IfHT^&>w_|tFhG+ktlLo0+3r+2snrn5(NFm`{J{3+v|f^2 zxxsdEOQ9NR`5X}`43y)ZR|ziZ*vwhl)!N(;B`bJhOda=RkUIobV_tr_93x&BvADM| zO#RKwQlqBg^T2Re9rNla%`LDbb?B&a^b_(hThlm0bWTo=->MjwP)?te_|yot?oSw~ zO6W)apSoL{L_nh#2BD*MZMJn3oU>APl=UFI4%d=%d6YzXoqDnZ6f`r`H>-=H4R5hl+C&9HVHcVD_Bh(#Uh|Z; z`x~U7^irAa9kf*X-9a*&oV^ZbOlcOw`WX_-M#yU5oR$s=?2kEdTb0AdxXYVXLj`>O ztDwc^+pxrhW0)P%^86S)zkPl*9bUH)xzh@yVpYFSf10aik{>}2kIsR5PlOc%<43ak zB-3q~Jsjqp%r!XhH#T5lt*s4f^G1I_-2$BX_g%%jNTO>6+D`8N^_{tj$rFyXJ1><^ z+yZ)8htx4JR?)nIn0ssHznv?%G(H*HyfC4pr=!#5pgB-r;kIg$iK|kii5@v$gf)ek zn1O-cS{;R(>o~8@Nmni}C6!TYnF75mZL+@ua_=zV+vW37&c5Xxf*vhySmLpzKBcne zGG*QEBNsmF_p4vs3mx=x%U|Qp|1YpY!+M`42r<&hl^o^-zmM_m@@1M}zEc zZ}f_rI;K|wpPS*F?Rp~$S!#gct($8$bnEFLB=9Z&+QUtlh*@wCL9nSj`Hc+l8Wh0e25jm- zJpDa`v9m2Y4HEBGE09V$iV7g80emmMt0~xRcu)a?+Nj5wQx{r)9OK-6v)PM?RUz}8 zsW<1SGnU)k1#X`UzxZ!7wzfk1jdS*O1}IZb$3*VPbI7G2RF++mxGTx%LosMOAFa`J zBb4=Bq#kIR_hVmq`+a5SU6zKMV?V4v53-$_++5bS@i9S7Egi{(f%VD$%D5c;^yOf_ zzf@4$ld1%y=E;tBNJGxj`D&{|?xs65lP?5T#5 zQ?#<@^tQUIfOg&au%*1#myw>XKf6CKCP~FTD!$H6U0APsLgZ4sc5(9rF&0D%v`|~f z4b&)gsYX|sk*enCBgWIrsIoH4W6Qj>W^U$3TxV^Dh zb=k?TIdhc+eZ51I?@?o+Lm6MN!z@PNCZ-)<)od$3&M%vFzgwz-ZIHFqNS~ed+9gVZ zt&NV7UV%@FFxPl0FSZ(CYME^owP|VgGKf#8ne&lsvr>thj*tN^h(c0$VJCUr)@wd+M@fX+=m6i`l?hIVfNy zl%1e(5x_7lOVcd_vf9A7%;?hsA1%H~0D!)2LikP-MU_Kk+M6|qIG0M|G&M%N@Pd@Q zq7-?g(nz?*%hWPXFG&`fn8cSU+zzNQl3}h#)uV-5LZrrH6?do^HH)}3!#0=0C&vZI z{%Z=-q~6m#Z>@q-Dk+!+bj@mg+K2TTxMBn-KnF|c-@g_Drp4Z8Fz;q zJKjo@N>A&7iigdV%#PPFNl>Kbd?oo|Yl2vzT>)~_a|ltmC_P`1Dr(!Rr3}Z^;Z9c4 zHq1m3?eQraB(L%Ch9qxZ$kO|hb&9H79(H$Kl*X|m5>irlDa^LseBEXp&`j(m#n$#H z7UrVE$7hlz!(;^-IN^WGxI1AT$W43!*EDzRuJqL+%D2{+$auWsj%LC3c9NJ^dyPA} zOCB-*7NM~EwxlQ5sKdY(0JxfTY4nRi6$~@Fvb4qB#B(|W57-fBwYl5@D+~Y`k`wYh zOTpo)45F+^Kt1Ym8=nF-DdyVZ6N7>naeFs^P&jr9xV%j)inJTP%X5~m<0O$PyqdA* ze~6fuR`k&%@?&JsWp@6w4~M>?MOI<*CZ#U3-8MdiY#4mrC#eaqxYl$YxqSCY~rC;i0u)-F;@>s2-bq{`~n1tkv3w^>J|OwH$-I0ZND6E_EF$ z-q46&zsalRcVSK2`_is!BWBn6&Jd49U>{KncQ$OJM4;mi^GWzop8@$wN&#YNF${T) zYwOGAF*pU+Cb&_(o~e9{)dpC(5Y&@nXU`JYH)u3aWRGu}9lK=-%JlW)OG`_w3BC4} z>p_a`xGeJhk$Z{n(B>ob0y+L6h$ESNlLPBCX2)J-O>QQGMCL73!{z%88llArWyAYva z)egYK1lh>70~NsR6N4-P2VhEZha#9C%eS2i&X`HV61Sh-)JqMBHI$VH1vb2%$MT_F zvBJPS)hM4IGfjXur5l}*fSVdQFVfD6SfaxG=iq|QiOYom&urvV1PlXQwn)dbBBt>z z{_Y038xP6jBD(-wBny+>KB?VmA1i@QY!v_6qX*=37`Zm3zZ+%l2W6D>xmP?0rQhs# zG+c4%jrrzCuG>Ju0G<_7AtyUuq13en9I>)RxMr>0f1k1o`<>0lY`U(&7QdF)-Jb_8QjD4Fww3=*b<%WHoPV@q zLFHemW!M6{4iSGJ=Lz4@!K>25JiXxgaPEWheNvzv3IVtCyOOO+j*H*P_cxM z5rethH8(Mdfh+j=`unfgR4${)(-o7US^%NEOAC?WoyNuO3=`r5a$N0hDJdxl2nv=o ztdEJgjJ}SDj>ZFn+I*Um=}w!#zDsV@5IP^@ij|i59+#i~Y|`S^{Cd1{rf#@b*sd|8 zqoe7V*b!@M%^+P>xd zrekx`?D9qc<^Yw$cbcuet^e;E9FIMwG0P?z8v(@bQq;k9#f%_U<7Y>jT zK8WYAy}K~&{m#@jpZ_I*0jiOgusi27eoATTr0mrzdJ?9YYJ>jJHdRR*41{j;wl7H3CE=) z!d!AKPBP`~!$z<4qoSwh9!O9L&fz`XsI95@vz1?F-blL^`cs$k!vP{{?hbYKci&o& z;G#q6H5U&vvl;i^huKuQ&+Cf2*nQjUoSm*Sc2?Kczic0C3#Vo4;kC}8w>@L7OibK# z?n>cNb_AzdVvuW`N!8?p+gW3NEhOroYKQO(*UH(l6nRxn54+};mT+!ug+=$p(N{rd z0e|ZO26kI`xQW*esJjX&wr=W{1Mt<8r%DHptcaNI)E*OV0{SOmdv!>#npCE)^5Ty~ zaOw}=va?N<*ip{AVOE2|^VJ#KU5m`KyX4V$;Yg_rel#rp)vJr;ZT~nwg~grvsMnJT z&ML|R0=-E|?0W4fdrPrJM!cp!AOvi<xjB)b#yy{2m59U4Fe;5y%Nr(%Kp>?JJB^#_!gfH@zdw=R~h%CP{kdm%JE5w#Kp^U?Toa*RcP{7#U6V zj``wIzxMQW4#p=bh>Ah4-MP~~lIvRcU^7BoqI@c4(~S=|0n`yS z;<97LhV6H^2U0OTL!11;dub|L8D;^P2~I)>SXzynxH=}60^k<68$%E**!rwCAZ%Q8 zrF_iO$fcT8;7%CjhsAs9YF(Qc)Hf;&P|acX2?*z7QG{!fEr|(}q{AoXu)KICCRh8h zuitCA+39g{Vx@L5RC7v+s;w<>yV{3SU41>x7m<7c-oBo|0E9BAwUI5Vw$xO367A-E z_0F3VoGefpyAE=^d-r1gYJ}_5VKveS+RVN-FXdhcqNTanZTV^tYah*bBmsglbFD4O z@?Y+9&3Cl7Zvqjh0SO0G+PpJ!1Zt{POuLB{vp(d6?n~~QH>#%|udYi?*5WfdkZcZ74H;KjJT{;+`& z?EU|qP}^K-#-)WdHGZi$fx^L}!qp2mzE`6a|l@@4x@=`V&^@kF8Ba#CN}XfhyrM33REI(1!lTg ze(fx7#BKC}Dk$CXintsPwD;kY!Y)hVpkRT)cwu%nKZ|46CjkgRC;A;Yn2J{E4wTnB z0PjR&6)mDcqK@jxUfhef$fb!zB%FFsOcbQi_;2c4(5x`DbG^uE?C*3yzDA5!!#m5) zkC4sP2uwE|`f43(&^j<^<%dJNQlGq9%rM}``f;<8dtIMoT*IQD!b3LgnMHfb;TU z7??2jXy%C6I5X3};ji1w<2e-%yK@WcUTr*m3Lr$`oQ^nIk%pSJh~wuw6@lhxE1FPp z`}!+cGqXLxFt$8L4X~=6l7WtHt8VCK1W|^I~!irN@1&F&EI&%7cnJ`2H3rv4U{ZWEu8zM|TWjB+M(|4xp zgU7BQl3VIDM0gJQxN{{#Pr4rEXp_)xIaEU+4k^A zjUd1oF9Y4wb~3a=gLOfeOAx|ln=*5 z3Pl5KY#szZo(=)zU?03zPAVHY)7F-R`BTa~Kz)1-AkPG;ad$ItJbY;b1YuXC#x*dQ zfhi?ed`C)cVfB&FSRc(`WK%JY-?0qBN$cG zP0?l{sIV90xb{9lg)i2xeg$EcH@hA?k=MhW8E02X70u&*2@WaI?z9~6XkfIRKkw!H!J;f@L7CN z^wu>oSf335v@7xBN0xG-+XY3LAo%A)jWiNnq_UO(ua~>&Gpj}705qUvMqw9{{boZ9 z&v1BMVk>t92He)vX>HioPpqPMKYa9At$YR<#%(*7v=yEATc{4kiEO7Axom|y7voQynK(6cpMa3HWvXF4|e z`{bP`EX=&xLbqjcL&H2iZiKJ9QSBF8-8@`uM&VrJ(70V7%`d>2hF`dl9{N3dgo(*4 z?`rjY1Te-juK1JCQf{AgxEd?oTI~kA(+gbM)z;c#F2SBwn?sQ({;dW0>Hkghl4Y4h%8I-Kw&n%JFtCh65dX| z4Gcaa}%)d1+#+ z-V#@mf(WQ4^~Cgh>^K((Il@s9ps<|{4|dq)qq^nK9T_z>6`$YdRSo%kd8oS7tzLLW zLL1cIxnH*$DUz0#muI(KjjeUnd0HMPT_Ow_sl_PNBBo_`D1BhP9Mjhj)$JBCcm%88 z#W93CbkdXwT+z0N<&%@GRMwi`x%7dfvzGC3Muezz)rRKXJf3erV)Q7~Y+peZDLW1n z$V6K%1xRl#JTjA5m>ou|w}Xro;N>5qj9Z0Wj@=|W2O#*Y3d(o=WDD{zaB-$ikxgu@ zQUYWq9ED*`$|y%&TU%P|m?MMIdjN3|!9)-u_# z9T??Q>N5xm_y@2r$q#w7fHWzhRs!_YZ>6jWg3_yBZeI&K7gedwRxQ6t#PeYmrZM~Nk||?lc89{ zkXMH3K)JfsNlWWx^xNj<9|p^wuWM;J?qFet!JHF=O{0yV+CDzYz=VpfLpmA`9X~pF zMGV%~p{I?BG#v^uE55^*PWD>t zBYdpmW^vROHaMxLgfg^!WEW4}B`AOI0B1I~I5-GoQCBDGUeQzA)UtsbA9~Qhp~hhq z4#MV9K;Bw+Ca*ZY>@TqJ*hSqQ9dSilZVCzri2AK}9_LbUM-zuPwpa3J!|NoF!*g;> zcRr$B-u&_}>pJO!{I;bxZv_?pE~&|${&ruHj=?eZAZ$|_>z`??sNZh>%>UOf-S0g~ z&j;T-zIP)HJPjo271sXrzvmYEXY}Xp9Z53+hZ#7#5!$zS_39Me$c-xlkl zQ~2sQENP9K&vC+SDRkUC{34_Z`FF*Zd>cp?WnYRkak$EGd*gR$Tk64h+0@|*d*jzN z@(w#*V+cpMfxf*#a$z+u^RJQICV8H1rinJze}8XB|FG-1v|oOa>G*GR_&2}u9acvP zIL`TcSrl;3mYtedS`$}C;anPxY_mTXy`VS!{-rZYXOHK>PyU$dKXuB@OAKU)=C$kC zgjhVRn~xRe)<;>t9hPwPiF&mUNPlmi+?Mh^9eDQ#S8i#rYKIU<3{d*|_I))WR8-oC z%HtMn&t*t#^#y25`q_`7bmaH@8?Kuv@1+2OpWI27RZ(fQ&Oyo}l%pJ+P8`~(a_oM2 z8-n`mFpxKGa+vpfuO=2w(i$!Y=%W9gw^< z4CQNBS4Vl`3}*2OpZ|Z&Ux{JQy>(LlKq|G7^^#Dao$Qd5GdpY9o}{Pz`h>WmW@ zW(tQ?c^JQ@tVd1{q0$QK=BsE^|E~TrR*bocZba|B#+jMnqV?+2LHQ4v zvjFUrOR2QYTM(abl`O%}~8VBNkF8m?OFS z2G9HY*k@dz?)AL)nJn}`imrA6JzzAhT{RZD+@$ZX98x!Gn#G@~!Y|yZ4qiDh;^=1J z{w{|acg%gW@fV(-5$qhSd#~C3oaq#sAB_kLtecw)ODEMhH=PD;u?mAWuP7~rJ~-nXR3B->1ae`!lYb5UY7UoM0~!>`g1yJbC%61Ed>V^}sTRzW~{|r~c3rhi;Qv`C&xY)w3=Y zb}pYQoQ;8Hu!F=~rqWYC%vB>W+GHT8!A4Jc$0>@Rf#)>-G-N_K{EU$>BAKGqX& zAT3ZnxcvU9-bJ zahT_7{cD|%E1gPfedn;Xh@^3U{6PT8+&mHVQCb06@5m-A7@7OF;m6wuy%2*x&4 z$e-wo?=V6(w=_p4Ci-Y7V&X^TBF{vNTY(TCTf^84!+Z!{#D)8{wUR~#5}viyl15%H zUfec5JnBApD&&CFwE@4{|heIxB96c7i zJddE1-reRUse|hL&tLp90DNBek$kDfhKB0#T9Daf$#RxvP$oW23vm4Mj^@!{yS$VO zuCIDTS^v6-Cl-_Zay)QzuVAm>e)C`?h2Cf zYuQJS9<`_!6D?W({K2)+b+`bkMmL*p93GN`$={XvtSp`{M2jkcY=(Q#VDZlr8V z1`dj-0Gf}bHlIgs%tpsj>fN9Gd_+P<)oglV;*FpP=2l1T!gF|DMV7I>{VbthXxPSC zsV*8LVwN7n>3b7|oK`Fgb8<{Ev@-qOf8a*hR9>x`UYok&rNH?L_;VDBK)X!i14tPe zv-8%UYLh)4FJ|%3qWb(Ir`Zw}BL#KjebI-`WQq!BMk z-=x+&Cwba>iSRUJeBAPRXs9k;IDwd#B(bTPZ&}-JGuM=9DRk$DBX_5<&)@bj8Cy#Ow+)$vDboDFFCICMRaqn$^&zq#ocaer8%kx!o5LD1mT6M$L%CFFl%L-d@pBX7IaP^Z*xgejEw!eQ} z6?uGQW#Wjd9qt88-0jotXb+R2$_@AT(fNrY0s^`snB_Eo+JiR=TVI$Hs9`k9>y=i9Bkyu8NTCnbD$YKPVP@pE7e3-a-_@qeV?VXUt!0Fg zk?}3kaK+bTzl2w>vO#>ax)r-sNEF`*FJBocggVZT4)hg5xuU6kxdT#{%+%$ep4Aqh z8fH$5F}V0?r9V!|C3a^o7eH)%&lmyqZiX_eD8G-%L2E5L@`{ zv`Azoj55{S*xC(CLXt#R-<2ZVSBElX!@zALg`g~A^m(kvhVop4~j^#)poQeAk0H2Cnu*?ut|~NzL&KMV_-sA*D9`^UeTC&lPEvgCw5`Ha(v?c zOa^;l*X|{dhz`q@`N%8~`Rta)ie0cg&1;@#-%}>tuypKbn16uKvLCR8I)>4RLdvyk z6}h(U-i8Va9 zO01UmLn+={%6R@uS-BZn$kH2?pn}JVAE@2jDLJ}+w;k4G-HoAnd( zFM?Me@+76Ce7J`<_EjOWTv{PS8k4>6-8<>y?VXj8Q7;|!s>|7?l-EevL7(7yN7mzyT!S?+`L({u|@_5DcMuO+O`|(>szO;o%8E{2Cf=DX;Clf zI-JuMSEh!N@i^Mq`R0*?+ovWr1*ds+uMo>3`zScImdsPyowsHrD5* zjjYnrZ7XoUoNy?s-2p)%5wy!#J#PX6_zq~bhq@4meZt!rmk^QLY*&(#Txup9YN`FB zzIc#rwcMkPnFZ&M!jmvb;Kooj3(uizKE73DT+YTA2!-`>FDT({;QaRdN)>PUMazUC5@4-wr{nfY=Le`F&{oI5068cf9!E@SiVIz`w=%5GAAg{( zshJ8lFygA?ZkU^Y(D)XSx~6zuJ%s3y8~QT!;t1MNJK^o?nJiwCgnhRGC}fT3%Qss- zH304muv^V_ovp;%R=o&#yTCr?GoUYIRyUk3*YxqD()I>tA;@N{Xt#7x<-hIl4Bs+w zKdX4@`lEhMft}=^(v?iY7B;OUz);IgB#WJPfUOKB0 zk)n9aefrsZ(U`RCOlAA8LDk$4?VYGMVqwI;C_3X#3<-F(|>5fPCt z=@N!+7@B{N_xgSM{pWeO$E(boea>0?UGI9=+IuY!5RzVX^zQHLJ4;GSa(i8OynE-! zdEpY)qobnIZQS3}%XhKEiiFe~_7^zR zo7=qco7Dh9(w=t?i@;-IO!W2>g;f_4_6W=TW=*`@o$Z=xqeXtp^||uAC;B| zu!f|Mb|uJi-p5&alP@CUa&vn;KzPQ|w8|hUDMcqNtT?k|;@W9O)ZIU~lQ&*xFE(%yq%&KlN z7rD{PCAjHEvv|U(fRVc^sq$g(u&2af{2{cI@5-!vrRl1KDYjMa4d`Y9SbWvs`8`6ywHU2gbt|icVUDZm<+0@uyh&uo+ig$ zwWxx~9u-^Na&OVh>u}IKAsRH}W0>(eH)THc4Fo;KV^WRs);J7@-RG`4NbR_o-+V?+H7ny#J4Tp=y+I-K;)@=b}r|8vT!rb8MHdj zP8UaQ+&n)VW(6H|Sff*o(%$di@jcjzP`CoyaHi!?hy7=%71#&NG3fJ&wJBT?^!rrz z#wa{m9(!sqBq9SnoVOeVWJ3Zw`0&%vGZ3_V@DZHqdYJa#_X)JIfSB0Wwe;YW=x$SJ z$3h+lIl+hqeo0eR-^oX|4#b;F?gB(#EmxR91R|ot%vDe`68pntdq{`6lNzgUX<^|p zPn2vY=v%{m#0HQX^c5V}Ap+b@o~600{hWIQESb#$q2?Okcv+L@h|V*I$5Z4Zjl%2{ z`f&zB7ks*MZi*!p&Q1|6%0u(*w_JgA!g;F8Gvkt+qu~Ah^q>c@?l8dFElZP4{LBL#gAn)QnIc$^$^v6eK|$Ri0$fz$_KlI3l63jkx$-f=y+bLS`d zywQ%nys*)Y1XdLf}I)uJ<>=Myw;6Uq3}vOh&*DJ$=6Gw;`BLUDu|F+e zkz_z=r&&Oc7ISrjsW{RK!v$dn@Y&?zE80W8%~SU|*ASX#brS8t(O9k#A){Nhb6J+d z+mVfp-kHvzah0@v3!A|$)Z@6|;9%!zKy)ajF-NE2Mrx_T&BV?2;#g#Y$_K(;YOs_8 zoYT|u(Rld&{z#0LVG%NUYv#6NIdg0#*T-ixr)Ot$oK)Jhse&>*Gag|r+9$8J>n?L> zE;q4V`}oXPo8g9|e6Xa2{YpV?2L~;MmK`_WCvaC}mwoqeZ%wp(FWf z{&w}AP~aFUScu(IdZr^pn1x^D#QGt+3R3hY?G>G+4oJ7O2)nL;Ogg9Sq!4I$m(L<8 zk1DV;4OtE2$zd!v$BFZXAHauo%u`CV%$xJl(n=Ki(2zt;;z^E1Z4s1HRG{)W!uH$O zz8I=xUY9(<<|a(V5x;vYE0*KOU?Y3@_TKyV;q1J>5=-+AV_C5q7qzwW(8WeC%TCfu z(<^(&AzKXi+Hfz(hjr&l0In|6;q;r!5^wkSCIYI&AWQ5%_Jbet25fCBt*QY^Dd#k0 zps!!Q9z8#qMWMBt!@hF={9!Qj)crQ5hNfy!mO>)6?99@qQI1z|=K0k=!HpLHj`$+X z`#huqP;sKE086E_JjeF*_NL#fO9AfCW@HwCrJO?Vz+N-{D0P{9rCCWy4e;-_`^U$c zh$xAhUCa4vckl45(D~1mmtgDSIuM}a=%KvnC@iU=qotLuuRmod%~Q6pcuUdIL44R0 z9UaX8w6jiXGlWJEiMP-jn@^p}8r+c%pkZsK*67O5@BLd$H4klz%quJvL(P(`ErC(+ z*6!kaf9>rp*5O#(Vdg27NaWs$q;lPuHHc(mL)_~aiylqzObJW!h3mJs?NVJg5{84j z3=98F<$_nzh6~bc))M;unpx47_QutSOi#%9xZjJ}5jD!A(XpF4HrUM#6nY?vR4F63 z5B>eL5lA9>zJ$OdHLLfaACF{h8|pJ)R_j?&iZ;i-4=I^AC5+P_2fbWH0~{8SZusTV z>|lM#Bc(>Egxw?1Uo_UmB`YH{(a;G72=im{gsVpI+MLr`a1a;xby#$53oMuNxCyoL zigN>pKT;eLM}vt8w&K;c0rBnB2cO@+`TIPe`d1>X9MACvF&WV#*-1U^;?kOX{IG3O ze0uW!$!qG9u>^gySY6ES|2~j^zl8bKpR75#(cUKO;7DGc!_0l81sh{`B&$9BS2AK4 z($7gj_WR1e&sAuDVT>JcjQ@-PMBk+~guJkAk_YKXtd*csYS^!A-ro>|_!$9?e@`J8G2L*>mHBVvF%pDyBKS4H1w=P>$uYv*V?`J|14#27h#2xJX zh&?bSZ~S?K*o!UYk$vM}JJb&|D(91P!$saw(lXFZ?6r4BLt$_KU$V3JFTEn*{=K<> z$Fg5=*oznoh{f*_ty0T^t&AmFcj&pOD1SfM-)ByuzXtI0p8+uSMk5B$VKWr1mYL+N zbdkUkoLN2mhnDy2^P&goeK8yT&Lx8Lg6D zik>ew38R#>bwf5nRWN`T;nvmYX_5Yu0Wd#P7r9 z2_lpLQ;^D1NvxXiN@qUlVd8*Jrnd`}Dw|O6a4<+v{QqV9+sgl}7g+VrNhaL#x!eQ< zzy=$(muc=2m6(5gbRf^JVOL)5_W#oDyf6QrDYD2W~1|VI!8nIu)YAFw`9%!H|x;1 z|8I&ZNd0M%VpwnYhaU(v%0P!g3XcZA_`vjmlyAUACjnJAF1I|ZVEX?LK~(L}w7tu7 zHN`M!xBB^6_FSd9hKYNh0@*`)h!U7(&93!w^ab1$6u+PO?=vU*pK%@P80)A15~tZS zL74uB)L<~vXnxPMAk+W8w|~CFKgZ#(w0SJo(Fh&091C>jvBI^Gnikfb*w$PfsLRw_ z2T(Ys;yZGqz`z zT=wcP?%jJZktOtS(TGRCG=zn>wHx;Dr!DUP^(waOl*tW#@W>e1&?_5fYwVQtj*?PR zQpp0%dWMVPDGrNV49J?ES~sj*a}3UZ{{1YFu;SuUOTQNtp%l+B$jWEA&!!d@(kc!J zxz9R&_a4gyeLK2g|Kh&|FHh!wh7Q2W6Y=O96J?>C){-^f3T*r8txLx4Cy0#L`Ts3`^f#He`!nUs%-T{I_XUnK^jhJRp`dC#Y?QCT z{aF@O_dk={r3dCsEgNx_lw-7bzS`<5|DU_qdf(dG`l$o#Ap`fg9=LrNMkoBiE7 zbk&xeNC-wo)2I-G1jk=`Pn#Gbryn1af6*j3v32Y;7? zmU!N=rF$X!s-PJA^5a4YBmz_IV`?H5y~(g{|tGT$mBp}1fFB?#fpPt5i_N$i9R!{0>4!7Op zCi_^a(p+XrTugGY5h1JH02f6ErHjvwAtFio>qv9_^HG8{f~FPZo8LWxpX2cxB=erAcm-Xxo$B76T?sg*2BZ^2dv+$svEw;H>O~D-Zm#oIJPHC5hw=s)2FasGelMM zpW8qR`?I3!YOF}JQ1y6ALs78=D09x!!yV$~gA4CB2&o|==@7nO9b)4pleM$TkpgXP^{P5W4GC0Ms{>T!dNqkHIe^MAl(O5KvKQ%WZyY ztT{bBpiOehXdl-3Yb^ec|#nZ*mGf4mxR5=-(eP8(&&J;E4^jc_3bI)+Fp zGc)tTygF@ArwfIM`nS^~kSlGAx5b@x#<`1heYnv*U<_w<&M3}+y+zErQBs;*o)d99 z;0XJZz+P#BV(%&;dRb81-B-T*;StuVcal$2Gv>3gvy0~M30_vw+gA*dKy}&$V_G>g z>^to?q2w~x2zUBsb+|`<+F<@H3q|t$!N>dHtJ?-$ur`YZ#Zeiknbq{5@UK>gt!LyC zdF(Z9^pi49DGd<=fZP%T$kF1RL+Fex;2u^LMYDRTZ ze(t~u**Z`zi^00W?qQoDpo9oSkn2XTvqO4z9gfiUW2r8yGPPSbnJh1O)WDWv9$)C$Rpzb0Ok-f`7n~XfOcG!Yx_ZJ`r4O9AL$iimJ2_k$|Xb ztZ{5?m7OQ#vP1j6W@nDl<<5P;*Dsm7I+M-8d;KOzi^&kmfG9r5kR0)q1f$@rQu5SJ z)?yM85L)OBamz&`ZtmYhw6VK50Oald=@B6P2h-%Q`t<4M)?~dJwzTbr5_tH@f@P`G zy)VHCNI@=yOyHmtnngdC(-2K%;P|3UF|>d=aWY9K9XWAdPXIw6{Y?l+@d_4bkK!5| z8>#ZM>a@G3YJ0ZR9^dm}WA9uHp!hcdE+q21qAg$aMgEG~$R zdL~n%L6>4smq7SH%5w>gq(m@4i`Q*^$();6e!As$l{VasAoKfkYpWRazst--3|KTVHaRMDGbstB zG-8c#=Jjvc@&bn(9RvLPufrd^%dV2q)BD%FpckZ)xpfZb=GB;T*DPfrp2`GO1LlS? zD<%ET@sQI`yyodc_#(NCxkWjn90>2i>n8TffYVfzJpNhrb&Ha`f`*E5WPAR<-~H=E z9P!62bm0X{;xs)y1F7iS`n3X34l=@_j4rV%obj9%_%1z;s2Y#a zm^w^N9o7>f2VdpCf=5PNB>WC6GXmlaSZ0yeQ1EU3H=X)*t+1s(iEJ7l$gMB{$p;FQ zN-opqM)i$}Sc;>5p{rzR&fci&ja!m(%mrf`g-(Y%DtLXTw0+w-r-}O-x@L%~OGKr^ z*_(6XUoa)Ab`%<+Vl11_UU^_zJ!S!RQd*xXO&u&pTsCb`*aKGVR!;kC3}BqFKPxEH z>VMd1ZcQ{#c?zZ}W$>Q@;LG#%I-9;&_V}M^5szUuEkWA~4k(E_(b*-kNXQGl}Q&|8KRO*@J z$@+Wz0BYIOdz#I4oWo{Uv*nTR(GQ_izLmu?2q-xUMSN94aByQI%Au?a+0IO(5~w)) z4>SCAAq(C=Vw{1;ptoXnQV}S51wHjnZ$0On1(y4@r}-E{+X50p6K0Uh8`TlPiC4~= zJg`0Axy`tl!F6yu{$kJ?TI-4TF@3C!Gj=XiNL_Sbq%#y9RI-}ZVW7(wCSqO6e~y7C zf6d|q@%5|A3IQuUpYRPlMk8|j0Q_ouM}y|WQe$HTcHbjxOgZ5*sQlvY-e&|N*HW-+ z_gR&bZC}v<>c)Xf?>z1;{9C=WpgUT-m>7WL1SVDyBO)U{6|k9KU%5N1sbt9;ZZ#q- zI~7&!bYum3`!ZU3R{$zKlIw0yI@ehHC7di9G{;;CFS*Rm*F7BW59803hxIiq4#|f% z^u0ajgGLbf6s%RgYz$>Sb&T}!@ku!1XLg)ZBlnY_KZnahDJUrpJI29Iwtb+^r#4%@ z+G*4(J13iwS;zoHOOEB`@591WT7|ndE}Z)!6ZMvaZ`mEhGM_p3XxdJ-80ghfcUu*! z=<6qW9j~Up)6y^5Ei03n!$-gg#UK49yMqqia4yeeJ0yAKAv>1!$paP>x5i=>@22Yo zX|K~5orcjPQZ`mu6OGU-!c{ zhgcOD`kBQ78lZcKc!G$^w|y#EVwXjKuW@FhdQ}c1UxRJ|w~_ds?%vS^*Nv+A%KoGF zrii1qpWVbBAAPYkH8irjQoW?+Saj9RSvVN=7`2MWXjA=iWVNo|ls) zLF7BTq^w~nmtc@`0KA^|r$}}EImdV@W}AOS00_JEcVlJb5C`R)(C8nOQrj;p+u!jA zJr{AG;h<54s+%~kE=cCH9Dv%MA!Og1)Upq#37e}pD*;gUw%gTiL@9|3pDwWuUi1q` z^-k7hJV;~KDYuFt^gD8m>aU&JYPfzCe7G1I?<(hxt!ZdjBCyk}WZ!&l7*(o~N-E&a zz2PS{*T29nbh2u~teY|dg*Q7M(8Mi?(WYpd_wL6qx=tCuM-Ua0$&GFslZjW^JCKvT zw;QU%L$0G)8yn1^@Djj-q4xoE^WL$5bThYq!`;TNuN|4k&JUaqoItlYtiL9pgXy2} zVo*6@18RJtr~roEBO>CfQ51t&Pt3Zw%E{ zUQ+Yg1R%Q&Mb}!(hoxxATILTr`kPejUr#jd?B;yq#+-MD=6DYg@~=KuJI2+iARsWs zk(7{}PELDf%;^XgM zZffg?Hk%%Kg|ryG&+LlO%0s2NIbwzS1{w7x((Ne!swz$acZvTw)VWdUKs(|89D}6H zltQF5QRqmx!~{sFs4>X`4UKgI`MWBq4M<2Tw`uGYKZNq+Z@rEa7{7r;u>S1CL+?cx zTt@w#&csBW%V|aP)T4sCDg=8y1*0C;7q?fBVsI)LnV3G;&N0W1db{le*{}4rA1aB6 zg{<_NEpfc;FFxe5&l%sqb6+k{7`wUIN-odx#qd)G^__8oz#zFV zFyBk8{e$dRAtfa&_u*&OCu_kwBIDyN zuTEBo&Y)XOBl*}ZSG36G@tr^1`N*eCoc0{>?GH|JBi_u9e|=_3^q_oGo8NGQ*uSRT z&TaGK+tpde({J~Dgq;b)Q$vgPbsOQ^;>O15S#FTv^WCGQ31vF4m%X7-gUPN*1SRFt zm$_E9^71-d{D2&V1ogGEIF_z>alBIRhAjFz*zTT?YLN#j|LCKvXfyrG_vD!HaG z!xkrG0k^H#kt7n*^2Kv%i;=P$NNJW)G^=ArHw5`j>28ZX=@)SMNmr%Itgo*xH-nGY z?O9jj{ z;<&d>&CI84nu|6!t#GKzxx{ckq(r_t48^r-E>o3m3AOgw*yxKZ= z;6sDi6*?wbSzSsq+__LvzNM@4hdj3tTywO3XE?WC=H`1lY{{Gc5LSIrF|k)!Zr8qB zW(P>~?I}XI1ay~^%geAOUAcm+8qW>xiFzEk-&c|p7X#(zNM5cx*uavjEXFW#jyB&d zh@()_@|1oT!izK$bG_&#hyB={v-!*H!2i^|JY_!l>*;PI)${S;UVGy~{98+t8|xc| zW+#b^E|*?W?jiH~DgnY{+U14JR{P_{1 zz(Z_o>^vf}Aeu1Z%%w}XvGVm5wCzLU){p9kkP;)DupAj~!qgA`TC+YqK7ywK@6fRC zR5a8Mp}qEpV3T|<;Iekud%*;%FQ~+*6vM+UCNhv4LSw-m zWXf3%Sy(Zy(l#k_6MUHZ~p|#Ez98S_%vo+@92_Wydz*@iM$@DBYo1z#?gk;V zS@rpjbwsuZOWcTJ3N%$ug^loLv>jG=J{p+BFU|W>Ix12%<*e*VN(KnJAt)LeuG{Bh zdwKzppoVXdDT5xIB4d)V#Bc|gC^ANl)=^M4=xNCODghvek2`3Bdm>HmQHzki4{!&LrbZc=0jXoB@Ur%RJp)tf)MXOz;B zULN8|_6NdlAVt;CJohNnb#MYpU`aIYJcDo&C>1fGw|bZ_X&l;36JyKuEO5D;pO}qW z`82LJs)`E&u(*2{zx)DbR0e)_KUJFSj%}32G#JXsF<_JOG3YJ5*raX(4qiq8HRDBFBYANt>y1{NWs* zPyoqslhUpwSU*-$td(1ZfrqBbH;|WQ<`9*|y?s&k0vWs*>Ld7^Z`b0*(=ZgUfiAK2 zxP2LKN@8Nj^t67Gus0z_i(Y6wN2};Y?EZ&@1kN-g5g*Py-=?GO#(UVxa`H;jVCebv z4GnE`b4uJioKzB;jZVu}fhFeMf%h%_p{b>;fTx2O8Swch72Q2KPP-9YMMcHs5?6su zSi|Dt3m@KPeA(x^t8Q;mhy}Z(l1J0m(;5HH=C}2VX++^?Q zR8`G}(9*@oapr0D`xFgtI8qB6x*19g)0iF0N@&1V)^ED=5D{2a(b3WQ)4k6|QM>y; z<}(pBG>e7%=U-~XuH^V5kt^W{xH;Lc4z}S(aPFZX>4SpTJ!8w&_N8Lq!D_?q@yGlM zA!c1e)=km{9}T?WFIJ{Kvr#6rD_l-oo+tHE8I1@y~j>3pzPF7Ym!u zd}-aC&5EG9Azh2`0Cju#yMT^pmRk2z+q(82tsWy;ouA8FX)P@|9#5aDj`R5(<}nH8 z`%cvWsA5U+VTZaQD>Xpb=3!j&oA=b}hC3a9r|A;;+Y1_lh(Qb~dH zNp1e3AKtvh`E10#JD` ziSGfrVi@^0A_=(fL?X-JsVsY5!>_epKN2l0_DZAr^HqXBtGGV*|LdL4l$W5=@$vD0 z>h2!wo0)$25(_h6zqKeZUjX{S$c8pUwrJBkbI58>dGr`eBeu<%E%+8TNNaS68vPzGS8n3?#i;`>tPn zw%*h8CDu9~#Hzx}jE7(9*q#iu6TJ4|Wm(>cEJTUmBk-ua5X zloU^_&p2&#S_uPC4oio0C-^2R66EQPOtMui_ne3F zlf|GVl+VaFjK~Ob3naG)$1CA}B?4X-yqcHgQmW@C9XRvLYdXu-%=vx3sn&b>ksi~U6!0M@m-9eN4!t1inE?=OGU00(cTvf$Ak%eS9 z?TgQOw2tfF;~9>mB&eGNr+dk*?<-3E54EVJ|6k@Wi~H=!1)RbU$6ZUn-Fe62-s*eW z$=ElErdFXJL9+zYCbf^KQdRrNNLfV0Ppp-k0PP=p7yeFcftmHq_47}SA9K)U7JSN<0RwBe zwSO~{-#ax={aT{dYRId}qGxr5ugX*R)VtYLq&6rQsZFcW+_-;EZx4`c?Tam*A1#)Y zXYeh?M0a-ff~Vuo4i0VSJ1qf}=g0H?bAFu*&5dkkL#WDyqfk%XVnPf;*8IV0Ti<@H zhwS&|vJWkBrfTftkZo>=8XG@8-khP$_w@A20Nnt(SIGFC2pW&KV@5`-xM;#5MAFAw z?K`bSpJ%tGb~{Iu%oaGh$4iX6wr4813dLn+o?jdfJ01Gg;ixlc#Eb*S_00-^dUjte zL6ZrvoKF2F?FHv>Qju4K{lc^uh784V3DY=81Xi3UCzY1a4{5J1$tC-@X9}w9bPAm3 zXqA$oBy;063doI(#(P8LW#)4t&;($$hJFj4maN35k;^6iBNH*x13m#m*Si{9r>>1T^*1!2=uUpXB6N9T3- zy=65k2@=xP8Q5IEnHHU#YH`{Qp(zk^J?%ijn%~^iPv2-3*k(TTD~rqGK6@8=0&BZL zBJA}{RjGvrYvrbY;ohEhrCoEDW??MOiq9V3^o(6o-P}|U21l+^N1HL_hnQsB5?1Xd z?Yl)kcXm)A5RtluueW~aCm9ShnDyM*D&>@lLMK=7!67nXjk&0ILEoCJY7Y?dmRZRk zwF>q0;^elUqREdV#8pj*plOLP4nU2M&|tV1g!AC0bTuW7?|#1N_E{KYVHuVx{#;Zv ztjKo5nW6Iz$+z-C5$w9n@DO3;<>`Qm2%!HMh94zwO(Kle`B3m#i+Y<(y2Q_jXc9kjP>vq4=1gmtD~&EHc}n2vC>q zazN|>m7?N`>V5-IIuJo%QI0mW3X~{rlGvYJGi45He|h$cL}sk>IByH;JUV#eeia<- zbzF3q@cPm7-bq(pw|%M?EMF+t=+R$4LP7%U9IVzAa@qC}G4yc51lRwjZ+(GEzBqjf z=}F2|rkh_}yvd^l7BG0ESuROgjMrc_xNX}Ube$v2a&?w6<7e-?+vPt^#F*&cBY|DM zl|}P$(~;6t8QLJPfWsP`d2>VVPmFVs1{vIy2vU+0>(T@Q!ya^2_mY6qb2a5Wj)lst zciOxcQoLf#x{4l4uaLgacw^}X_(#;xEauWaoGdq~pc3R%*G#-z*80)xPENKyik~dt zDsj2%Ku2(A1Pl8MkQCIBR~_#cl(@9B+LsWz;r$;_)UpP~#;=%*xNzw`4O7>C&}!n!U{$KoJ-nzk`9*`Qg#863z;^w*mLH(eQ^dkClXj4V;ZTs6dCxx4#F*<9Wh z;pG)Q1>gFr`Xop$o58h3 zHNVOVAdVpv)h5h$#j@#mD8#{u0eyjyh2;xyvd;mNqB;Qn2_@hRE?xQd;Va?e+5TC` zu}KHbnlF#pQ1I?<-t2j1!!a}3O~q6`6JfjI0<-vy*cI5Ertw%4tJx7KQwa66swy%p z8jfkuoD=rlZGYpwu(T9Vv}xlbY|ZVqIcZDALmc*z--O0b|AN%WUq)SaJ@HDU$CUF& zIsPvbYZ$)=z|Z*-1t63Bdh6wtboQ-iXsJO*u$r(K*a?xai%U|H*ZoScFIgl)L9b>p z0DWn&(t9o9;HBxyMO`_$Krdd0RopTkWZi0;S31MFlyn0PW!{MIZg5A>K#M~AC?QIK z6h#+1lIE|1Yy9Nh0I}r#+jw4T-4Nt*swcA9xapb<^NVS35_NA#$J~`elA}($4J71v|AbbA-Qc~#qPu+QRNdC38Jp5Jm!DKjs z{&oh9ZCzb}V_FT>spOlqR9kgh@h2Nj_L zP{pm=2|OWfq4}vXji81EyDvo~q7v4>^kWa7*Y~){CR~yAT0c4m@F(V=bR_D>^fL`^ z?W~2G^6T$pWw~nHT&JCJT-HL{{E@P(_Y<>J#0*ApqZuyiGUZECTA5PF&7l(8&R@TZ6^c zadO34c%#)jA?4+CfNpdFg{#=XUWCc$RVfiu^k}o75W?*PXI{akWo{l~%@y&s?faTq zZ@Ub5V8+{_th*ymjUvuN%|1?m(tJ}*W zM?RrSPFUF~`ErhfVlota`#v(>j{WDbMteWbb)A78 zRO{sE*nU0hLF(L^VzizF;2$U|4}mfmq?#|0I99xS*29`9e(rX!0Yny_GDEK6is72Y zksm(N6)FJkDV)mJv*;rhEyDJMnX;q6I%YgLyDc*D^h|fQRI#*c7IM}8Dj*oo^^D-| z-5wlPRfgj0Q$hj)^%alj{ueVn#aPM}os*-E{q!+%m=6Wf0PSKM50#>ItmkNnSVUWY*8*fJ z%7#zX7Hazs4Uxy0AV_yZa4;%i?=@)m7pN!LpB=qh!KM^eb3(NRmWI4}?OnBNpih##5A^>k{|hKvB0O%YWA6Q6Qzij#vsoI;43d zZY_~Bc02GUou}7pG=N~$Nik?}^~_hb#79je%3T^^cLaT30lUik!Y2CePYip@u)MYX zO52AQ3!RVOMldzNpxo0VFEY;aVwA;ocP3r^A~C14rRVgA1Ixnzy=by5aW4DsYMGHn z%KkfXm)hI!0+Tw9&o+}s#kzpL2V`a=a*yDT_AS&U9l zgB&a4lc^ePa-kq}az8rnb_Gv$xtLLBFqwNu;0H%BqeDYQ=Se@Tw$|%lAZ!cWiM@K{ z***Wo61bTTat4dS2!Ie&NZy?~)tgGFE^|X;=O9p3s-S@e;(%Z9b_HBy2a+ zAGT0U#fAg#$HmaQaO7^UxYxI`D~e=ug=z( zcfh~TbDIh1`n=?%2J0t53W<9wg{7j!ntIicR~>!_;j67Ip0o@EHTx{ zAHlq^61n58Uq6~pl$zE$*;G! zN~V=Zgd1nxcFJ_CeAUA>8tZTX?# zE$B7)1a|IbOV+EUkt+;ZW1 zoYp}gtMEjmBr+;007zsR_Nl_lCDqnDh9p9M`l{YL$+c`C9IB{KNg+FN*{1?((~G&Q zTPtU4mF9TfYwW~aHp=l^NOb77kjv#bhs_goiR6~Ox}NH20w9GJl6yY}-Xfz>JW}lQ zsL!nzPKR|+bJ5tbHx!v@#bQ;S&!N?!uhA%xl4T{*pT5#h_E!%>ryX+Hb=6EOuO-Iw zQ$%x7>*zj%2O@k<0r%e`GDU`*_n9!{yU2&vU#YM%pj_I%4EULovuFwrrZWi1tbPUp zqj{}VrdKENo z=!M6^vW)tWKIR(({62V77?0xlY#GQ_hbGp!ihNO>^uG1>c4pD1$~~0>Vou7#156O7 zF`)~T6O3f4YhTwla?!17#@@_&x{fksW~(>n9D((a0bTi~KX|~8d!Nox24OQ-mm+|G znS-NpK*ACgB6&iekhHcor*Sk4 z=C!WpPh{5V^YaP&#|gS`O<0|dR1_Hf_T`u0ZP`pVXsA9sIJ795D#HWX4%awX-)OJl zKlFMhRwn$`t(&``-%NI&7DJ53awk!l{q>DEK_ill+_nQHwt6RH6}?MX$=f@R(3S5> z;!S2y{G;{E0M?|HlKPS#kDC6GNZy*Th{sAJXr+a*X=!uW;gCj0cX#RJ$?C}16uT1i*Zy^dT7y|Cl-<*H zj9O-}IsROVtFRV-&pDp}1Q6xsimR!=VM*p+Y_wm|OM;9(-Bt3?{`m7p%6WP2`VV-w z-lvW2N(#}nk$8@eAOfxMvXDVT#73a!z zQEQ6E_`fEUG1Xr(;|-*==fZAaXh1D8W={Z7W0z8r#M2iPPsN|g8T5d>%J#Q=vRnBo zO3@E9W&|m2dSA_2RSsk&c7FaM7Y@Ac!q%4U!3KiT3~qH$y_XsOh?|_3)pX3Kw2rJ===$E7UcWl2- z84PQq0~jDt@MVszzAmA-g9lZWtpyfVmdM?1cYmgjoKflJBWdf;M2%23@8{YN7*$<| zH;%NMSCsU_BCdCoZUXEsKZB)GEj$3J%hjQL$_AJ9w}pG?Q1?$L{x6bCzIfTq7R49U zcusL6;!ma#Y24d_=ZihK5;w5cN5uoqjs}5$uCf}vyKQF&t!Idlt0@_@V5-Kk78fZI zaN4XZ8p|`j72-?@`v zhEoz~Hz48xx`6Q}hf2M9w}qtietqhlD7vrasO>M?r1m1}rvwslvp;XMziAkr)&b_*9l7*$uj}UQC0pI_6 zBZfqwCzt{z2hZR_!%gQjc_-(WhngC*2E{H4Qt$~2J zFttOt)T?Fm>S_9uamckZvtlyet$C@p;Xs0|vD2o-pejGyUd*>#17RviV4x%$;$%Nn z*>3z0CzTy7^4MV}C~S2qHzF$*n(!VFKI+6mo>fMdX4aSeuj1l}K(>2SUmjRqFgb)G zaq99_2^vnN@b@AH>+#P*Jf;JpO#1u2`8TwI5wF4>$U{tcycZ_S*{o;dpp#JY*mT9M z$@`pXt@W|dNuf%)5EcQ*u7dM6C(hA2HOB0z+0l+inK@3C#Vkn%-Qo_ZKsh}163PcM z?W-zs^8=Gu57~gWCuUdm;di(Z#SE^>LCkv9`3#|qk<6w*JlvC+{m{scMEGiNadf!dcw#-W;B%rf< z)WOBI8;vtPZ8~y#Jq|{-o#(c|wZABQuBoG^}UyL{GPGdYf?{MHz z7DqX|P4;$8AS#{b-HC(zO+QFZ`6V$805r~7Pe?|V8#}`t%2YoTuoOiKxU+Okfk%%Y z;}wowyqj(k?4CZhooX8$b^0pp3Tliz95*XJ@}8Q=`mROvIIbT)K+ILa>6vo(Yd=sf zq3m{**F|1=!m=PNEL@>0CUzqzj3m&X-*tB<5aYyeq1Ixm!8QBLZb;h?h&o=F>*R+x&;wEYlCUFop+1Sl8r^5F^uEJwuX3t_Y0~yFpqWjg>ync&RKrexM0+6(i z+q2soEk{76UrWpCXr=%{1a!O@Y>9{_e&$@M5+M>KGH(CjjqBQ>m(Ssvx%Nc|JE!F| z8ZvU=TYg_+uV&8qZ=<8g0cUgdH{_B9W+TR!_2gccfYO5$pJP5w%Mmo>z(7zqL?Hkg z;z`947npDor-NeF>crO$CEiveG9&_yHy0Il%Dja6i37;V-=Xrm2PGyxqySitY<;6m zzF!2DR=R7-N@TQs(t65i4j7zFi(4-u9XDYtfza521QcQtx3ow#r@!DzYe{-vYTZl9@Rm44HWE7d# zP}HLxR&?cW-QDda&E94UN8{8~G~cXTt;WlZyHr6KD@&$D9}*C7Yt|cP3vMuP^6VFv zPXK}5hYYrbr#0AsuD$K&na_bN&c=X<|M8qZK^QvQgqI5@XNDs)?TDL7yGrN%UtlTx zKVV6b_;Hf;cA=8l(@dhW`R5FX;`wd+jLD=M9-jzIF?_@Ksi zIVBaEfbxqq<~qR|>KmS_sow_mZR_73B=I}vjMM|aD;D5&^li=`YrNzgLL(QK$5JL1 zHkGM|-SU^q{)8w6%pRZfedy5J0bo<>%FA3Hl(JDivx`ow+OqL-9=}U@}I$GP%n@Jtl9dZvhIl}<-!wZhS+Y^ zlY3Vzw@@N9BzwQe4C=!13v`esX%Fv#fBIn#1Tf5SG7*-1qI;H(ATkSqA#NWrhF3%=@0R_u6Z%y^p~s*m|5w{nOJiG)L7vf@61%3J=*( zpca}=d`x_9|LUzrlk)Ll^{M9DM|($A<8=|w@E*t~oKR7aa{Ulnzr4O)>eXh)Cc;)$ zNcpOmuV#3ao3_~CIuEplvaMubXEfN%3_3VCpm*;7B#Q7;_X%gi5u7ZDHy74N#`IrJ z?mhIfUoEW?rgoJp3Df42q9gCj_%=hW8t#7fZVc_dXIlsAivTy+V;A#?1>-+fr#T%4 zoOcG{sGPTdZuLRHM_#Gn=A*z5fm)pUMH(vsX#26(ytTL-HnT)cMHe`y zt!=$2Gdb#vg}P@5fO4<~=MaE86IK|yQ|W4737kAORZP=aJC74QH&UvcKK}?~d>#bB zgWK`Ku_z{5#UxTQ7T^T}Uw%rXR1%x98=&MYB{8qZUYEzgZUcDODqUkyhyhp5H?D&r zpU*}?V()=)`*jqUKmi2L?BEn<5*Uw5O;zbolv`h3_D^pX0iGr;ulfS@UV_OgZ_-Bn zi|1`Iu>We0+9M{!iUhY(f6U<41S7M2ui@ZZ5-}o9a527-vpig6F2NI3#^&aAm|CmC zxmfsJx|1Nl94`q*&l|z=SdEEiYD6Nlp<7e6KNJcw48!i>V(C1FhvZ z)>FgPvh0JiBL>HY=qFMJ!`HZrzc=Vf3smd4KvpgowF8jWa7?Lp2we85cz~vW|F`tr z)T{ctBe{+9gSIkW!1k1H@qr9|;n8m`?{@7A42dxj!5;z_3#Q5snz;2!?DIm3#*6nn z6~RtzAEYX~3dz8KXanyD!oOi(iSP<2WSSTB8_m*bE-WWMwOniua1!wvN(7ZS)WMWB z=H9rsB27L7O}=1o9*juQs&tF)xXvj1BD?B)-t_>~qK&WCIm65W4wLViCDv~qYCYdA z+Nq%QEboAA>;z$3$#MgfxB;*2ABPq5#`^NR1mHxTjFj^8&yQKtw@O=b?F-JFzmn+8Yv92M>}e@CJOF zJ;(+l&J-lQ#NdG~0f&MBW+-i$nyP8t{&njiq;Yc-_KgeJN8PL^Bhu5Yp5^m+-jTu3 zV5Ylc!TGBctA#Da+V!KOV?dKVdKB|{3HYpPTSQSGJSZcocdn9=mu;;%z8BlglPb?q z0IY!4lZi24rUqc@5Dg6m-1pbRfc~9jYd=O&{$s*trzrE9KoSS$7@bJd!J{AuMX7bl z|EN)vIkJgOjvG*2%?K2&@XiR5)|r`^c^jNL^&cI4)-#T%kj3@&s2m)HzipXA4J*Gk zN4f_FP$1}=Gq|Bilm@i5y(Xq68A|u>SrQn|4IS<5>~^Nh&@3x-UNJKk)bsq?ug#IK};k~&dxvL=gvrtdzoy2;b^j^BR=`k0yU z{_gzTsNn#@VM%1X9vK3SlEFJX|4O~1$RyUN2+^X| zMWL9|hz>!`*TfRdIPx_S74rY7U9Xv#anf?r)&=};%lFvIidv3l)PngbZ`)DIItgm zh*jmvh`+qQj^Zoa#89#VwDmO{9CHd4Z>3*Y=%^yVrBPAjTMm*rB9g{Hg>}VQiqin_ z?<_aE?Aq(sxt!T%cLss!L7!@!t!`>TEfQirjfkU=H0cD6N$i?usI>#(dq^p~urm_c z+0%n&qf;T4q*1izUMxIqBJ zyqMX;eeYWW06O&t%o7Yp^6>I56-==YRXDCcI6nh8@$u1#g@jZJ+eC5pH^bI%Q3tpF zcEs<*V0#zkkpvEs2V9dB;p3+hkfQfPGOHg4xDDHAF^0qB-B{Z3Us&Gp$Ahg4EjF~P z`lkx|`}(S3euXjg4Tp+KxZGWB2A_pQtxM)${?d9}!M~*VH7G zxdpPa)@fIwY|&ru;LHe5;+wg=mX8qSdig0m8!EO0PPj5dk_=vSKIc-}H|oL$HNV2; zpD1}SEb`_LWs|zBMzqiSz(AZC(%cbl=;g|zz@|6Ri?ia13&ZgiKq(tM3)Lf^r^rxqi6RMzaoJ|0A%U%TBulI7wjMjp^S?LT$AXzCCL| zkz5Rj%6$xs#xmZ`Sy8QhV-;nuCG3^4pVr?BYu|#x)c!eb_V70B2dVT8CrPxgl6+q? zq%w3o86=hrkyk8B1fQn>7dxT2?Sov<%Q2$eIoQ9QTl$kO9Wz|>Q>MqKrSz>8#NpN1 zj7gdIWg&ViqzDRG!sG9>e7QNVY5vQVWzMvN$q2Mvfb)lyN}ySz_lDj2z+g(pxA--4 z0dOpNu`IojQOKPz`Z;Prbo#6O!fV_bn5qb2&OqcyH*}co^Ov)$W7~*QB=krq7>n2+ zkdLyKl9D>|Nvs7wt#DzV>2!odLc(mj^fDBgu-thtVP|eAMF#sle2O1CG2e}|cEC5W zC)Np~CU_EfTS&(E55Xsl)-nJ!E*$F=a{C&QJ?%iqH!<8{4yoT;h#T_q&EO-{#_&$o z!TtBMz`n&lN4Ok0w0l!}WQ<(KAtgT(9at04+PCt;k`~y`JMz+u;2(0k7zI~0Yaco z2MtTQc|-+CNt*U%j%+bQLoJUIT%$6qe_JzgR4Ohred)(j`~0Pt7iSRi-D(^mB-i{& zU1{dq!IHtl2THm^FH8uGT3XcV=L82M$zgZ&KMxg!nWOWC!A+;n(|*#|+TM4Aq5&*` z)j4*swSD2TI~CT5bspX4eci`BSSpSpf49SK3|Ps!N+5jacwNBpxoj9X3$LQ(siNS{ zyOXNsD8`JM0Z&uk@un^8KM&J^+ZZl0!!ibpJc;>TMjNmEaEfX zXG`0e{w3uP8ehnczSC$~kVN9HfR{x=_zG@}E%zT4Y^Ejd&T5FOCo*t$$qXh*$j_2R zRSa-N|GKn%$;0R6Oz>2+oz9oeQ0=uaqT84I$YF`|GQzIN4p4u^jRG0R_PPQldvgqR zefY-<09ybdAxt0yX8o?VwP%_BVQF%Dd3$}@QGdD645Oidz1oTu3=4xH;feyEHtw)S zabPFWt?|Hr8Y9Ej)jNU<9DZahxA!Vb9f0L|k z@A6m0H?-^jZ?l|)S`jD`!YQM&pRj61Ih&Q29vf14a5v&~4s%Un81Y{iZ4Np8CQLf$ zS@?KiE8z`%BTm=HCntWnxn1N{T>mUKoM_qt%{#U1>2dV2CybGbkVOIwx3^MVPT!`sgf-dxuP>HBKu19}x05Y|wsKWQ1X-_bnpH``3- zW);Y<1tykYRVRA~|V)g^em_^Ct$&+eN`9e+oYdzaV-mT4YNRb3-=L8Di80$ zMGbUtuov#MfgES2*gq}ofu16i>ixn^9AmR>+$Mai9p`mH6+^DCib!kyaJ# zTDfkAly4mP9=dlt_41{`V0M89oH@_^J0Q);k&%7{~jBA+&SVlj*o})jWK-qqN#{Wc8fcuy|;k9 zW4+N~yQH~)!2MrA7yKpDQ>#>^z2&!Ia_?Y9_v6XB6weRi^aj`J7(N1VQRJFofJT}W z6xh`8z=b&nrYFUicw>SCdUQbMrsoQ+Zr}sdQSE;W2LJa?LZB(H;C>O~*$SoppoJr8 zIQeJ-jBFA{zGjf-7Dgm3$EO8P|2LWa{jT64sF@*-+I-0`$Ec;d4!$Mk5JIx-ucdL& zGDCh)Ke-Ek-rlNO!;_pT34BpGGfW3yZ*JKBi3^}Of~0PSFT->oepZ(rzvg3@h+Wm5 zv6vZDUtY{bXsUc$#~u9d8~yuPo~el?l6AxgFvOI(GCBo!50V^S2Zbzh>s!DlthfGbi<_qT21zi-x39zox% zemol!B4UNj;{H0*y1!m@Nx1+tiZZ*<_KL;+_n-df88ko?yOdcaOzu*ONd9c^!yX5< z>|O?0irITy;uR< z9kODvK+jc%!K6*xPJ&o z1ezyqX!=l?!EX%p*vIfe9&mB*PA7>=S|Tr~@is0!jliwIkE1kQDF#A&-25;;ugbue_zxTieUG{Pt3un|BLk2a$Gk$%tgt`fD5zu+MWv1 zZd(I=2^gxPM}bW!5Fmj!6%j!EE-zbL-+sNtBi!`0>g~u=rdtQe{1p(NA4FkMYOImG zuDp$qTws3gd;{R(!AVTkudW-9Idb`@xIQ-)v}cq8fxw>OrcrROj)#z)ur#O@}eVE5OD--=If&8`Tz!zgik^sNk9vx$I1&~D$ks#TbGy)-M zO^^6+KdBi6cBV_F>WP$K6OOt#h;ZJ>0>|n`YUjVrgw#;H2GJ;3?_CiPE(`j-i>x37 zl!|Rl7CL0LI(`*qPHX5Lk1?=9z&J|@6b3y zMRLXi!HyavMm%}oEcvMpf$WRC3fReI_3Ad3Fd5UI6nWs4}9W#w#P3N%65-%VP^W;g}Z@UOzhF)VR$My{8i=egv~x+EViI0 zFTYm*eE(5-+9^}6**-nNx0iIE24(zCQmwbn5*8?Hm=b>FlqJEZoo}yh$KCe-Iu>Ae zH;rE~Ib(=Ywez~RuXUnsk|gz4Q1pI`}6Y-EgoL*xe_x-jzZM+7yKBD8!&-F zBrb>tZ%{Q;>Mlp|t}NH{O=Dd;1Oo#jK!Ab7(zj4A3u?hZ@>_nOHU10U7fm&TaTRIz z*vpmr)L335&^xzxa-~!^7dhwoz+R%$tz_l|FI`PrJ!rU$jpiv$UTjZU_>Iks`e|YQ z7Itp5sj6)pBwPG3Ug-Zu?hR#AXW7Y_jrK~uYh^5xc5H|Q3Fk|+vA42cC|26gQMp1O zkSvXW1A2_75*y01-^4RIf-;{HLZ@}}Dr(<4_k8-@#xBrJ1!u)*ZQt9RCWS^sUKk|m z=oTyoLhvO#0*w3n@58)XKvTQZI7Fq#j_Xvp%S{^=gYkmbx`{g$=(kfZ7GlK zv>P>jSvpjW`C#AvMD>lgcayk=VP+QV6aLpKa%=U+Lu$DK*jf4IzD`BZf+Omu7N zsboL}zi&_^yH8u_O;C2b&m|2GDu1Ji>YVq!#y_nudfk9buT4T)>Nv4SF{9h$5HkVE z_P!1qoSiMqBSuG-7g!Ft!}5xsici|UjV;~@-mp){Sc;hCd8eOw48c6LpHrsasIuTI@l*5fHKkQUK`Ey$ zUn;5x4ZaR;*tb2yxHQ@eCP0lzI9AHUQ%i^8Z~e`4G;f(1ank(X7$p3)!e8~*BMd+M;W)X^LM&JPe?YS;lw$X+q!m)Oy8cdmVfXd3Pz8RLa4fK zj)}DzFY1bza0jQ%f(1}K|Eh&7a86BIr zF1npDMW$+UalLp$sD+N=u>LS{?s>ZSU7jk*fA9mf8PFd5JbFMAB)z)Yu`cUqKjU701%MZ9)Xt6#! zEw;=z?!`2%Wj95RwIok8I_2%_qxjAvknJ>bad4ct&(vOd{HUzJ$fIm-ny~vD(*E_8 z&r7|srZlS`Zu>34;s|9XB;JYo5j-c4r!Mx3Zd57DyvBhgnG|q84&RgflH*!Rd`4Am zEXI-}O^R(h*qn!(!5hvNXbjnA*ws?C6<1F}w1~g){u~lwPBV;o3i2UA(gr^qDm|w73VX{j;7d))(GProZL8 zh;vgPh;Gc_YJCCY9ONih&QWz6rKe2pmP)bI0K6&Ca z>#>3{SIH>zD7Hj5C`#xSug-N})LT4&`b%5-gwb&OM;@2)A)fWZAQn$F9qp^$l8c>Q z=AmgQCL=w=i%w4N*^SHk3t*GMrrf`*_gZD}x;X3#wOJ$gCF@TVZt7Z5QGFd&(sYX{ zd~<>u8Y%|@IUGbqC7LKHHuB_$T5`EPoD}WTvq?g1k)r{0^-tq3Dn2N+}17$LE6{h;NomCU@_<~ z?OL|eeDnUxZ{rf1%XfE9=GK<2b^8rb>Q>|F;Pf3Fdt(j~9DL%BE2flTQ>yOUQ>cGnh;1xSVY?`FheV^JL|hWym|KQc~FO;sJVGw zW}|5eo5(X(DmaULqwm(250r|awIsCJ*-)cTRbz5~!yNl>#Ty%KJ~yK?z5|Sb!mrpX?hvo>oqJPt(?WO-AxEw)Q4%;-+L>uuD1URbF;u<1Uj+w= zWqK28(yRH{^_W0SO@o?;2Q?vv&d5{|^UiC&2D<}c|KxS!JA9v;OEc@)FJVWa44!aQ`yjMS+l!(pZ}r3aNzuCdg(3Rz4dIk*IQ&8{^;+A-4HUB6&}w&jULeH zYD3Ba-x;(WO_3uVquM(Cj&xjoT6t{Ef8@D1ANo-sjdmyW9pev@#S0o->Ifl$W*EA` z`J+&bZoP^~0(+n%FF#*>)XLK8@Yt?tX??+`EoeP0SXD_Vf5B#dvgV=dY#pj(M@OiK z)+XC%$M0s-(2jno=ZcNHyk1TV*{Ba6B0%C#s40Ya(c*4$ArSj*&FfNg`TGF2+U@aIsx}j;Ah+!zP{y=Us=j0G@ za#m_&JWM`)K7|r%m=|o zmMgA)RodiIM=lrpqGReIVV?iX8&+Qkp#FtA!%FHy$GMy*u?L0HLgi!+`mZS$Q^0P; zkJIxfEvc*Q;_~JNi00hYGZKC`Lx}uUS2&!#J=j$39i7xKxHO#K%zSRbFON!Cz0}pw z_)zxFWMkx4vh}y@90vF=erLX#d??rzl@%HG`$8RjIz{8#WXGq@b&SMp^WOIe0_V$e zp$pl)tF0hXe|MaCaZ~N|j9|f=P*LbGP;X}DFKh%h0obW(+ZR@PS4UbHzv~sr*^!y+ zZ$dLujzWJ@Abg>bX-(R1ET~no;rF>@4~`GrN&mRYMqKYsW8f%fji7qY zRsh_gi*It(Z&g*tzGbamp#F4= zk>!S&zL?!Nhn94h7W~qBh%v_3hb)$yA}hB!JctgvGEP=Fx))mYW(fQ=WzSHYWXrwZ*RnB+L}w? z?u5PiCednWa&)w$QRA+ZBu>{Mn?WGI07S3FkGc0#C6%`}9vZRB$3W#*+b+~@0tjS! zRNh=-q4CZ4`pidWDfjEPZ85db;{28h?m2%@QC!V-d1DC{qONUVlj8?%j^r>{-hrgY z^!fu`>ZMuL66t*XVSk<5;n;+St{KbvwQ@piLOyiWW)6B$Z#w5O#>ejXj)k30T3x^C zZPqd{P|Z-u{0!EmGd6zw__2rzSa&l?>-t{A0|NJAQBA$E;~KLy=B)E>*C`Y;U{>&C zrA^)X@#wPzY{}Iu-n+!O0Ea>k{t`1v_J`m!v`~}lu+UFU&abO%iuLL=oCg2|fHD-C z^Xx1b5EXj*z2C92vSKW5yhB!Zd!?!GbNrmb=LT)oec!MIpr2K{xes*&bGfw?7uy0b z58FSFEognm$IPd6#@ZBH8R(3BD$UjQg8ihVA?3pX*jD2rj91*F(vWm~Bt-M~rAr=6 zFWFae3hi~j;Dn>$co2DAZ?u0OS^o4re>&3nE0;YVK&+>fe_(o42tWykzZ{wK8rv}; zD$&s}2tt&Ux`q}&|C~{kd$0OBFR!VbI&k7k)n~#rG2M-0teZvA4hmp=K7OsYU)29lxG+t}wZZxq6x4oykzbu?E z!p9|#nCki^=Ai>!*Ydt@!^$fv*dEamzS^gotg(uNQs7WT@|H(+M61BgKKiE=_*%jftlhN`4cX)jHr%xjJ-aXCCq;4p_ zZc`F=#|R-}n9?4>OAC{e#e>tevC&W;eCZN5NUQI*l{VmkaR=s7H(!(*WlU_V_a-JK zIgBjWo%5~Ny{ntMXh^DYJNihM2X6wR;*JYHf$#yAqyq5y?m0Nx?~Z9MjVIZ*%h3Hg z=5w9*TA!mps0CAxu)bQTHXzckx?(85LiYQZ8IruSNfh(B@WGIFlL~SA4=}!O%ts?` zkU(F*s&3@aF5xliOBuz^9ivE5F|YawXMNA(B8v6S%3Xc~SDxBAI^VwD79I_6-V$Jp zX=NW!etv&dw_j&-USQXxI@YgapR;^yKh>0~RixonWh|3+H}j>gX2u11g~A~Hy4LRA zr|?>z2pHny1uUqaDkLvD-zo{+!-IH#>P7K2J|rtL`D1$e_`Xu+0tQ zEdTRRF>~Qoo?jMoPO<{klQk;j5qt#?Z%3eG7t-5z#t{EgYL2@;#aBZg;r-D`+7mdt zBQcuYSKu8ke=GkYw~-J_CkPNo7NzQ8gX+vpDqFPm^GWZMf~Xel?~;ci@~^1Y*5-MC zi3$*4XrfeBiw*Z&2spZ9L6wo7sa?Uh2>~E6Z`ZnU@P+O7%V^)=C|%9NxAKz+IQQX=|5WTOa8Rx4!hyKYQLGcrKW( zTn&!CeH^r?pr@Y=Ti5eKW4u>J z9`HK8#p1ba$7R{h%Tlv(0tSPnkHM6!rR9-lfwx`Q?I(znC%3Uz=`$0hgOH>x4|$T!a|~?qx8x_5*#WxrI%~ zKBLCsT`b*k=~D8vy7Z6D zx{BX`*Q$^1HQsV1bNV)BK9za&qG?UX`d8oSsIhh@mhfF*@7=pnOWj6_ef+pLp^gJO zsF3Q-{i>{L3HLYNr$OsDxVRXQ!OiLQD}&^TdH64twll~wpC5-(gS=gPN{ZLp6`>#v zdVL@UYvE*GbI*u!Yjco0XtQ6Ed_{$H&p^?Q;Qb2oe}1O|JIV7A2pYK*o`@s4 zu;}^aCf%&Vb{|lOLo0Q3bPi_97Vs-REgJmdzq@!_=Q~%*!L_{Caekg3RnygX=n;8& zMUl>pFgKwsO&%moQH}NX?OTXnpSyeY$eXxkoZUBejlSf!XFG%kES2i|F+Hx zfj1aNW7%{<<^K5+ebi9)3#p`n;*Pa_W_k-;o!s7@x80LS03n)sg2wPQ+L0}AOgAni zVSZYtKlvO~$iaBsy~bE^?M+E2po3q^DReM03q-N^gNep*t98@*YJo~k7q3(vVqvw7 zLeAKE&yHD&Y7WOy*x8a6b@wFRQ zvZ7g)(az$#y3&ne{_mbjqSwAiNbw+-qbfqC#j#%0T!^W=`Dd4^9P%5)!>qnsi&bgZ^NIP>PF2*#~3AQEia$e z$%1|8P#O{yriw^iq+QjI3s}EfkB%!*QBfjc+d?ITFRAW#?&`a>1tqO%1N;-myo1)A zV7~<36wMrfYEQlJ8i*_Byds->Gxw3@gk-4o7rjBikikH?cRX=3)sQQ~nc6SPLoT7x zE`HA3S-0;Sa=0?g`a+Q0B0nD$74@K2sgc4?&6p;W`UxDwqru~jjxI{d3mm(^MYMhz z|JxWieCdmy71`KK*4a^lnzYpFoMPY#TXS%cDo~UeVt)8fNE?PmTsIXco86^8VaD`hPGs$OPrUaprkk_tcVky!d-ZL&V0Gv> z5v005P4zsa?eG{I<4jGvb-w-I*10Wc_0-2ujT}0_BdxSLcZahX=vGriOJO)6$SYb} zm1pKak)OukWGuZM-1H(eF&IP*VY9@x7=28o90o{HhD>yN%Xb;yhu&{#5Rx?rcXI4h z@Y3#-@|0H2hT?u!zz(8PECra1gz8V<62vbymY`$3xmiT_X8mD(aS{gu4(tM^`P^ks zxEvoHJRX_5#m$1pO`~LyuMR}t4>1>6W)jGH!_N{uWarCUR#tTgQLPk znv@y|?uMjrW4-M;4V`B#s5;u7(WQjID)O)D>ZyrLy^~eGO$;J3pJ@OIcNzeZ z>GmpkNN?>d{)=()yWx*e4-cJ0==dcGn6dM}X7fD80#z~Xa#9Sg2_R^6nFZLq>|HV%R5)vPt@X!$H6y=QlrWL(5zT%SP6R4JU0@%lOL*Ae6Iw0q(Kb*^ zkl_5eX7wT{`Nyq9M1zT^ro100PwVRzLfx-3y@S#6WkN39(S8mOz&%cbEG_vgN%C`*ynUI9@Fs6C&WY)Hq87W|%HUP7IBFuO!ghxA_`9WS{sE_Cv62^Mu3!~V3A9vqr;7JB1dZknF1~mIVf6^hw#KhF4)PV}dZE@Zcd2}Lt$6DP@Uh^(l7#!N|CzYjA(ZtG4Nb2Y) zXk%ig(6*ypZvSgYnu>|Zy1SE~OaX`vNc1*616=?LK>dH7cnId0C?0x6hK5UQ#k11S zdOrSc1xWH#uG*hlj|_fqZ@VbvC?pK;vK48B73QlR&V8m0^^mbhV4$%Cq(LZlJou*i z?xm3)=341iuR8{$Jd*Dbn3$iJS9mfCtBHZEmU{c_#WR(@pkF;P(R`-inOtP&cJvol zFw{Oh*VOWq`93n7lDmJqc7E^qE@s`jnQ!vHXofdqTC}56v)}7H_0N^Fa1aAGkiG?z zvQUWy%S0ms4M-y6en|$bttI=+(o$j!X9A8qu+U?x3`L_xp^DqT z#1<0^c*~aLO_1{q2dO=wB81(FRY*5#*p%>$lTT%OSxhqQ;TVXHPYzsnJ{zn3sQnK8 z^}#KM-~$};YXDxz75~3w2Il9TRSWPjK$Ug@cFwcJ5WNMVU zm$hzGZ$l|R8I0G}DAtLXeV(MEo4HrTs6sZ2lJm2dQLW-zyGnyCx8)a)6u~#G0kyak zIhZnA>D(LFqn*k>&mM*TFx};AZMam;&B)4{G2wi}>kG#1 z*f!qr2^`-%oU1e{)%t!Cr(X(wgMlh+x$>RPn)-9Q4wRvnLSJe>kidxm8flUo^Ec?P z&NEX?MGR<3&+Gfuqk%{d&Z*9<{)Xs&xn<=%&S5h738Y%VkGrc^Lqa*@A8l&CWvI_C#Y%IJh~p zYVwIYuETI1k@#;+n*SA>c(8Ls*uy&^A(lvS!M7%i;PH_WpZ>Iqe1)a@(eL3Jy-rb1VLcjU?`qQ+09i04M<|>BzQA zDeDk4vFa1L9Xvex+>4Rz559h{bgh{H->Raax0esV9z`kZ&lLhPvcS^KO`+X7$24+y z1O)GC>EQ2!gL)H(=QlOKGan9(&W8IooVt|Q$bJq~s7Z3T@T!^l^S(Q&)kkouyZ5Lz(S z{cAqD)e+!E=|mfn5u$N$pgJ~hQlOQr+!M#;dL><;x~Q*Q-*)GX?}9R~I|m1urGC_0 zaKp7de?L*03VIE@T+kN`zZG>@GvE>x-0< z!)0K!95lE1Fyp+a^+4~A;`h5670uUCwbLFOCwzg@fmB>CkcU`RSWptNv9TcyqWjJ> zcf+CZhVnY?@jv1zY(yN&AM$UJPmU~#1Sp7QwP6I$T=!~!z$F$*lIz^3wRwq&`9Yi6 z4+l1kXYRN!hW}p-f>U>?7Kx|s{OoWQ^BKrUUhf+TP37SHt*XGGIl4LmcUB3ODb=ma zk85`!ezk!{Dobi8#27#B`=M5r0>aV~fu7oWGb?8REO_s2gR0(suCK}sL-A!uRM%#1 zs{i$V1L^(cIX`sOpQk!XHYm6tO49Ba8A3wB1l6&&wobbm-LAuuIqC>-3ZUY*N?bn9 z=}S87O5_aH86V9TdbqNIO+kY9C?rvWYBs=iI_pRy8 zAp50(hO&XClQO6fY{dYoOForHMJ0v?&9447(sC|=cM7WGq7lo`ZrlMC{ti&Sqz!;i zt+l@tV5RV@g+Wkz3^QxCVWOGbnupBL_80a zl#(&&pbXGb6ICG%rfYZ`Tdbz{w0U9D6@tC<$tV>%xEj&;9 z0zrCfPn1O5k~HsFBA5Mb-#e*e)^+!kPIov%SRXheF_HDFU_R0RKJ-or7y!33mFog_ zbm=qK^31dLHmtY6z;af*dxwnjPLIK_k9KKlfzkdl-29sqqFe0t4n_#WC6anit_XpI zmquD3ok_Z5WPi)a{${Q!s)(0vy`{T}$v{`;4|(#t-w_>#Ee+?ws4|}gI92ctC*N$32N~URs?5-LN#9LOmDl)M@oBGg2SFpobv{iyHkb80ViCvUOr|S zG-jz@7{l&eJ8(@d$S0#-P_)Z?Q_$E5mytnrE3_vV)a67}c0^Z&hEo?98H7&0Ld8E?gf7SD!%{@u{AOvn~Wr|Hx0!s`F{ctn}_u>{tg}A6ayC z#`L%`o8fRfTBtz=;N|Iy?I52xZJ?H~|5`q(uP0WHpj(#e&snKN4{N|7gboV*iO~7n zVlPf+lw+;a)%v}iZQG|h38V#DfExkn5pUJLlPXoEkz+<1VPGJ`$OBNn280xtQ^DQ zyV}RDo;URqNTSL%M&;AWx@w`znXfi5Jlg5nsc4@Q<3um9Y@A|qW-6uPf>PnV2gW4hx8*z|Bij7D{Pp1^v&r`wn%S!{AFtDi!%*i; zS>GU9Q@))}^PO^(rIo%49^b9^=`jJD3rT?&JnA;CqHsW=q!#S+r2lEA?=_ZNIZ>!z z@_?}BW?0U?ZJ}7DXl8mk2l|m@A1eY)PcM$H=X33((zC1>^$Kt}PzF$;S%-%7svK%` zftpwWO-+q;8C)TL2Jp*iZU2c-;fQ`#%qX1fb!e!8g|&qF%Mi;1re2=)*04d4kyxMg z0CGoiI-d37*nJ%gj5wLpbagB(Z%Gyg!XG#@g?DNsI%bYS5u7L#T}O*0{Nhb0Z2J1) z<8L%FFiKJemkzzh?YdQe-Pue#A)%o-Cg$tdE$ zMk5VrxNYwDUVZxKka_ge#jKVm^1PiXZQE-G@ny293ibVaQyLmt19?lf zR_fODk;@m4MDhFrMKB)0Be0r%LE|SS(|T>%h8c$75;stLNKD)utHW;!hJFE4ig3LC zQy|Jwh5ykpfCvFKkhu;2LC{Sl7h~h)9SSgAytkYS{VD5pJ9qAF>Dr1TooBi5T-#sn zMXfS^EfpY48;&ermIZ=p>RTjnK#h#iflnR&EFQRkl{_o2IH_a_f5wqfUdP-!iBiNpL?<%)Zgk87?C z^OIdPY3g;foiD6AC&Barz`BMe0{y46x)en)HJY01De_0q3HqGzxK@CJ2GQsin;xI! zk^jK~%jg8RnSZ{&z<|Tz7N!;z~vflNhp!qi5 z8%|#`OcWuY8}2YOTrK!^s9epJI_ zoC3Mo`(etX`g)9)*oZ_5Pl?b!oMF=@k=u-OP1)@e*m!sx>33M2D3spe#9enXhYO_p_5AeS>+%CzF4`~< z=Dk=_&iJB1P2Kahuj=5mYT=n>wuy<`LA12`w#T(MCA#k~$_BkCz~UjLdEEukAgxhUl#${teHmOG#TR6Tt2JgA=yuXEO9uX1ovC&O6#Y93v7AD0O zi~F)fyh4s`9Nklz$9xR3>gNE#b63qepm41+AXq$j@bEB7dTe4pMln7(FYl#f(Qzg5 zN~imr8BFgJ(zxZk4h^Ww!&qocBg45A-Q1;nmt>@YKR_U{Jel~gsazVpQ3JIbjW zL(I6f10Cs@Ps@pymT*EMKT4XLgF`07%6jn>cRv}&w5W1qi?d^6(; zNueHSND6)PH(VUbypBS*Coj_Q{0p82Kc?e?h$3T12n#j=st0Og{zK*yX5S7o zsPzKIZ*l)Mk6gk@tL9`m>~ND%KeMv9U)8Zjw|X^_pVenpOFo4SX^fK-z!t&8tHZ~i zAEQX*N8(RLt%ZVhgV5<88zCs{N~oyC)2iCTJg~F z+1c=*^*4UNNoNfVn)e=;lHmPkFBmm0);ofRF3M8Jb6d$<5yB{LP+%tm0EX(@J-0;{dzeS z;FSqGesT9OQt0R<8OXd&e9uF}F2>Aj1h4or9;g}#08cTuS1FcUiBPNA zE#uYj_F+k!e*4(OLdZ`jl;T_v$WSl=7D&taU8fL(c?ZXXqwSKc#zs+a#&8iMdx`@ksz|H zWMJ@0OUL=y)xm5AJ%7RVr*EmTSdTeHJV}AW zgSL>+(34F!koF_fj_F`rm-@@G$dtP8M(ZzN2Vu=sl9G^w22)o1DtGZ?-wBlP_a<`T z@7LeIpD$ zNQH0|7_qhF#J6NWx%7Qz$*BgS{eh_$Mz6V4re|m4$09$pwAxaxFCofU$_NRK1Z_$@ z;V7477^3FFm2f&3)bJARNS3TZvwp(_gb$u8;&Jh*m^q7*{AQw+L3SDC2e!<=8aJZ} zQ3$hN{%ya(mK+(pr$4(Lx4*Koe6V%j;MXit{!Wy8;4N^YNK<%0TxUHVawIki zwzK=p^3)&x>;=^gJVZX6bLnTo5X8^4j+BxBsi2bgMK%1hrCpd>ES60} zx3XY&_wZRy&s-%Akld^EJdxPz1H;WLw$A4QgMyYQ!wAo>Gz7pJC@85Wi_`Op&fIh2 zJG>74s#lfZ+i4+KsjV$|kpA_X%EycS>wTlE9~R#8Ywb0ThaFw_qQiMA2z#zHVIL!< z!0u2NbZZ=o|VGtzazht!mky_b0fc-=wacfR0>)vsNhuK)kY zdJC|qy7qf`=~_S24{3Ma2GVx14XRU4k>)Dq!6(2VK22 z{Ey`9@9$#epuV#GN+}G^R`|`{csP^m#m*_oL;l8UwC^;q72PTssCG@?{KsD{f_z2x$}_{ri|`x(EXf~UM#km>#_+~GLi$3yNR zVS!m6W6_)rks%Aee*|O*Na9+x|4P1XjRx5U?$jO(v|i?#2UZ}f#iBoFu6_6@QP6>N zlU^7Dbip%F|5iJL^M+!{ z`_R8v4AF9tY|>ZRowwDEq5}uTy_0Hj+GtDg<4~^rJ;;HkR@m4Z>v@2FbXCUmSj#n+0(Kx`D$SGtL+!fhCEff5n#Ji z1-4LbW&5gDZMApyfp8~Tg~Z4rLRn(bmy=Vi-Y{$+V)(Lzg9F4&t&ti)#e-q0KhSnS zBp89cEbqA#Jf5$x8t1trF9!=gLzDUPtAGWeU`cbI)G%&Ze&0HK@&KP-$F4cZLhumgZjGvIBu{|N?J*I)qMA| zy7m6ohm6?B0(lS(o508a8EW%YB^AAui>(?4FB6()D0}*Q z@7UcA=KTN0OPjJvDJ_V(IEoW zSRNA-KTzGEVqmzpc5n?{9IfBwt&gYw99LRI=XUSU1~QS`I2z8#tJ_N;O)U7m$O`##oqQ|69z6df5`?~cazO?ut4S;~ z89eo33)RrMyQZu`aty;H)KG;mrK(^VX4wbWm}AkHk9KkLlu7z>qLL+@CyR3lO1?{2nSMOR&0w0I?UeofHYD7?}_&C6pZB&7|@ zS&>c~X0>UULrTbhRAivwT}Bg5jsa#piyNUDi<=5Dav`0y@2&c%_?_yBl)A+3+@uAD zwWbBkPg2fO1LB@3$@snaPMBcx3Y-Uu_DV_C#+h-Gb`c&k5vB0%-2bFX{C_w=z}F@L zg0oO9eY5E-pNSbv&dgRhR7yTXztcB}8?mgI(VB~Hn$lh${Ky~eo|T;)YjP&geUNnY zv&ynrxt{$wr+$~FUpTUYT+E1o(8S0&=xgw!L9kR`*6)xYvhVLC zK;!cI?pv9v{;*hF<*!GFuq~jH!^E*D?s`f@OdAW-+?S`|i$U9+KOO~!d;p3CuQxLN zwFNiLoQ8EtSIzqavr@P_Js1iGMCf78)t{}lKU+1_`1q$c;Lw3DPd7&YBf7v>a|HPD z{Vp)@H?b*gSw~iZ&-Q80v0h}ZbHmWSrfby$RzAU~UKOlS6|6&QHuW|NM}TpmK+z_M zybH-E?UdRkO$}izCBQVZSi6PB!5pjrVN%hL#hP0C>c#v*)(vwEe{XYQ!!5UA1pB!^ zvt8-V*uv!ZT_L($`6L#ZqFn=1wZLvTn9ti2qH*(~6QJgPqOs@UD?^wwZj-}LZH9>% z#G+I^Zx3`c&d?0!Rzv63#Vo%2P4jVueXIh4Lb*03{IW1vLOPm#EX{`>Rro0XV4Rw> zWGa9)$gP0!dVKSJP1V3#I(H9J;a2teO@;hLyhyS6?VR_GBIBly7&&H|_CXkqbNiiu$Lyq-LybSx#R~o(xy?QMVI+sH3BT$AZhj8D*?nLu9*6g4UC}| z@50}Nj`kqlNs!^9wz0gl{w2z(ery76PgojbY{ElkQ31#*D++Rb9^2CrDHCcou<`S{ z*5AK+%FH6IL>k1{9@V0xFdQYwB>ljYvFT$HOP8Z(&cOGu(rA5wNdrcu#|)wID=e*x z_~|3)UmtceGod%LE!OE*uyb=LI6Lzxvp&K_LK@qyAG4_^M9rP%yPrIZn>@Qf-}9;o zW>wd{?d%ouUaY%z!BKd}ZWlpOBDdowY7j-m#mIn-84`kG2F#9sG+>C}y;ov0l?|h( zS`~ZW)Lhg4E%-4WzE)$)_}aU%&EF#nWsYxhyLh^|LuD$#%E|nvcZEU*n742auwuDQ zHi&`hP~6tkla7w6>6F*mI5J5tXvO5AiwDeEb_vf@J70zIW&e=^z!5my47U1Z|9l|^ zXH=X3)G5_-3>AyifpUo6YttPSR+;SqCL9Q8% zi4dPM9MvY&R2Dgf^JNL0fL=Z67+BmwH0#fof-94t_SJe7&SG>RSSGP}Pq~X_6tkB-k=MH)%gUUW&rFm`8JRX?143%f zkL{cvc2{i#Mqp&Ehmo5&v_9ZIsWaQ_bTWDPa|GE2v49}Z=l2;=%@?{+)I@nRx69HW-I)3!cR`Vr zU=>L-zeB5Q?ztB(sc62t_FliIT^BrM*JREgbMh0ZN&Y6RY`xU! zHQ2dYt4~(zTUg(u{X_Xb==N7}rIhg<=lt@4i0e`-t_S7)#xZ!{PA}Br>e0_od_eMA ztjwE@*wH~6@u1++!LXaB{Thp-V5km3Mf!F7U^#Q{KN8Yj93#fccJBFQOU-owvXOE)a~B20-n!eo`d(wXZ{B>mi`g4sCP@XelPuF zhA!k+v+~!bQ798JwCp&gy2fN(gPc?&(MXHGmWq;D^%U6~d7lJ>CHy)59|V_x>Ea() zu9vMmUgM-fjh8jyoq=XT48e#>@yYaw!uq@ZX~se-FB=)O%8Zl*e$mIBX!GNW^l$Y* zN0(~iPxof?Tlhk6LO<(%Cxat&6`fYn!7kw((S-izHLx8KoKv1xFB+}=0SUyfgx{N( zd3K{A$zu6b=mI0s^3n>r6qDz*j-6kI0Fc%u-Ll1dnGe@8yau=2J`cM zGE9L;LQQi%DCQt-|E) zO-@a9AC5*WA4blvBY`=lR{s`|t7q+xy#3Y9`JXT+PVwD8h4bBq@#U0K>+3VkK)q=^ z9C;(8#Bt>1u=)Ld@?F%`F-H3`6td`Y5psQD&nA=S;Z>#G?wg9B)R}rxQ=ugDJUaKO ziUwY88v2*UX$OQx)Bd00Ig}I@{iBPPe3x&X!blLuETh;u{I3xP#B1)XWMJ5?M(*gM z+bF8XZQ+j$|I*ENfbHxZn5uR@-w*7;o4z4VZ*r7(Fru@2y{m5U5(CD!a_Xh7r5lC9 zrq&mByzb?K`rqh8q!A%+E+#Y`&L61wSZ5zQr%+x-`Nt#Tj7ei9h+31zoA`l=BYe8sjL9Cypa(%s4e^? z8T>l9M2vW%@@6d4l6uXNP?0=jf<~-D=lA0yIR;!wKNTX`;N^dJr?XR*uOOCtqY3F1 zf3`Aumhb!&DFT-}jCZJMx)X(%o4naR2*%lMz;0?DPeyhRFP(?<+J5 zG1+HMe%*+>FY^Dp`*X7xuhxf^X46`0h%8mGZ?E-4=|$eWlFe*Yql>?*EQeJFg`7_b znjZ8iWQcNzJ2)J{Z$!+m{?t1p{7*E3@|Nz*=u&iJ(7diL6brga(XDEd5e^C}H}_W| zj4)#?+)fi4PPk|6Th;V8gA=znF!jiMvbUu~XX4hd`Ltw9C$BL!GZxg>hhAS_FRk&u zz#VkRu+^aX{fMFc!Kdlm~=Y`Z=-INL(6mC}>kQ*xlM27z9=13hsy4 zutYmIqq#Snvd`*8a|M!P$Nbh%*MgiIpCyQ6oq=Ji1c@1S-hRj#w?zO7B&+^!1!O>3rlX(vxBSV$VP?chVo?!1RK2#Yjcdk548B#Mr`*$qj;I9RK;K?Tf&AfRH zrJIoxp3@8SC=UMmFoQAm<*2zGeJ_vqOyd0sZP$iBH@0MJpA&{1+|dv4AYZBywcr!M zB$)ax9g6YG*l|i`rV8>Tilt{W?~`fbv428Zw81k&{3rjJTp9W9jRvO&il7qs=^%l7 zyzA*{x^zePPJQb)hqqUNtspr#2+qKWH1MXDxG77dJVF0|Z}2wpgqs#B(?xAFy-BLz zJ=zIVw|0F6Do8g!oxu+5-4h%)h@QuTg(OTfr%JBB1v~v412o<9nv%5AQcP528%Mh* ze3Va~Kab%MQ6fYIW7SWS=*Wl8%@oLE?$bNJ$AELm6Ay2Rx5NZuig0Ur0VyPzp)mIRhB z%vhA$4d!j-7M=EF_mOCxA#)BQ^9wvcHy6v<33{*JNCwtz&Ofd7s7W2AyhV%+^di^L zsj?ky`+Rq)oo{7CvD|O@-{9iIhxB^{P|p4JBG^=`cN5CTQWiuciGk1aM|N(yat?7f?n3);Aw_p$Q+{)1JuHDlwth3OY zYx%AaiJ~ZQ9S6{G%2G$CTd?Ewz1t4~M>A1@s`^iKR;H^cJWvKO*T)v&% zvCb1LIl{N~EMaU|A&{a8tnAT9u1*HyDuO(ACQ@uB>bNtTz!c??H{9e=Iu8If+h)v* z3zHV0mJy*<5Fu3%pbjo)SAQjX55h?va}QjUxYDG(Q(KuI&{BuclxksSO)yp^j&Kf9 zTGirG?E4+rlpv5Cs!hA2qR4=2ue3OPJ&M zKG)YrtQn2jo&WD%_Z{NH)rur5FT>Ak<_IY+J#|k`df|?;fkcIusGlKT0#QvT5xN&j zk^0v&L~Bu6nqQqvr=~=v%kvc5BV4Qas)H=2o=t|(0|QC)9XQ^!t<6uDE9K9(=f1hV z^K*NyEdc6DOfQp5u?&;F7bYtc1~dCQ&aS1cf*Jo^z`-+?1gkI z8u4L>u7pJiw1ChdG;QsBiuq9r`RamX&_bCBeW~Q)(ul%7L>SL6XvWpklO)CGke1Ov zYBMItP{r88_l<<_M42LCXDkw!f?Y(t_s`TGI!N+J!Qytx>T7AdBDvN|G>7+0)fXz0 zgEvuLE3rfum+8PVr_;BSvdl>gRVa~y<9~)T@mQh@Ei6{IB;+Q|9IU~kqNZ`0*P{%AfMow&p z4Q+%>gBcPpHO?!htY?I%php1L&y9_HwD|dzjp)JBkmx+=X?IX8!7e)7OG}w3al!Ss ziSS?^N<}l#A!ktv`N1hmYLHKvgr?jO&M|8*U)s=MoDQPrQe`xw#clu;n^c56L z!w8z5L~wuQ9qu19lT+8#f)veTMK0oxb6Wj81qO0+FaHTyeBW93&R#3oy8WmwbOJOC zbqpr658w>hTVGWA3A(bkUP_PS8cLN>W*a`@$o-~PM6qHrWOwB5LP%4}?B%L)-|=d7 ztYF@t`UvOx^ziQK^LbWaCe$f$t*+nrfkWJbd_5vPFk9W@OTo?Y(arg(M$GrBs)X@) zV4cOxE8L`Zc5|B{>UGjR}5* z&xQs`QULi!1dFs-nBf<>nbdT?;wXAmP8VvVwltbahXU^wsWDxpxVV^5s{w2cDzeOk zYt?j&nOp?u{#AP|Qw?!j7nd+9_Ds&g*F*kQ_q}+zKq;eC7wfEin2giV`g|Ps+FAwe zZ1hbRoA*84umTDT#8%Qcr-}$p!=IFQFE5W@EBlSPlLvQp{_dE^*uCM}1?n_Ay6bUd z;Qa++vtt4V_yk%B_7HnCvR=x%%(H#id*qQ3OaWoJh5OyRr`_3^c-g!-;A`{PzkGK* zSUNjw?4-kIqs3=)Gm6Y(kE*X{q>ck&J?zHzQ+%n>kK#FPyjECzcOG&q?PFT+%NAhl z0FD3z$6>rd25(Ln?^X~0{~84F*=eaXUsTff?_srleSO9bFuEe#{@t=2^#w+YrA^jh z{pBDkjLn`@1FkPp-xxw+*}51i!p@^@u7<9<^byudg%07e_a;te4d|Q1x#tI1?iZ$I zIjO38Ff_0}x`OdTiwZZbBu@9FYFtiO+pfAh;RSfXK`m-$0(U2)t+?v?7aMu1P2eCb z`24Q)qBSLYW$SU1ZmpZ%_l<@IcK}x?!IB^PFHD0;8eX+)x;IjnECDY^&)kd@m25el zJ$sILh-s%?_6r_E+~DXFuete0Gy5ZOFkxiMmq22IS{ zi}vKSBFUx#u@MFs3fXB$2k$5=F|s>COdxMrtL|KtLkH!O?Y|6LBCC<+wjwuwgXbwEXyJ z-rczMfc|gh*B3jl39-Y^?ELjKj>aq!EPh52iR@q~7PPnvjDfp;39w90aS2q{TNJiUP5HTKf?ezp-uu-t;uIHx`p7e!Z( zq_?{k6O`9^rQePUB&V{s8u#a|>Sh6Aw&Escmb`}<9%AF@sF2eldQW+P54X59+LSLy zz1aPBX=Vm95{3lIsDyqT@JZwZmJHz=;m~fj?52U<9?n6VNj}#DxW!QG!h{ z7G%m8XI?q=W{fsJbf*MWJ*4{|58+u^cL*{qzrT;{?AJtQ zcmcOsmJ~XMBow{26!AQo&Fv&vH^tY6{PBqrG9F>SY-=Qg9D$B%E$mp&`MGS-{K)T1 z=kehaz~FRuhd5TrZBH}Ak6%SZAW<;Zx?TRpM|q#ZZ8E;Ue;PR*>|^!P@^i^vmbfF# z+d4b5KAG1Q~$eOgYU22`^nS$gVoe8W~Ny z>}GnJor&McrHrQ5oZ+*UbY!>s;^OwXm~WK+&~346D7mhdBk0;lH4MR8@4qL-OE3}) zdG_qt@s)wo>QJxA{mCEhbe>CaHou4Pn8Dndz~#j zv4ihIluGfNSn}?S%~iqUoD8%@=j&vNwfvx=)nKDuk0iohAUQ#fKoRVPu;@=2)N}r$ z1xUaE-P-KztonP(?p4B&F2;~x2xulCJ)!Xs=?MYQhdYbJ78VvxF|wxOIHuBouTEM7 z+e_u%vj{V3Le!`{Oz^Y?$^V5$faVT7T6a2V9&=$2Vca055Qau=9cc#_Lv#eW`PVU7 zFaM)Eyay6mt^V!D4pI;Y?3WjFJv=^ zihi#4ZV0AzHc;J$8F5mJ?$)v&``5dw zbLCtn6Q#bi6G%jPT8%u@H3p1)v{5Uc{jagu#wIE1*nYHsCF}i6vW<~q+^^~wrXert z%Jamy@;l^%ryav#gE-lU@b|(JVx!^ar%&D`tgSJrSdS#iRuIthow@)#MS%T-dI98@ z+S+T-e1m3Bc9pO@m++Ndd?foe6yIo?Xr3;F6gzzERq_fDw7EgwAsUwTV8*EBLp#r3 ziR{sY@Nr3=k}^LZSzF)hWF)vm z^FH!=>_7e*EU%kqTTLp6V;KMY$}0fPD~MXTpYJD4?N12{^c?D^s6s3A8!LHkQL=)+ z@Zkc>%D*j|xMzk0ZT_1*NRW4W`qAwbx@M*|4=qk>!|Cn>DDh1-ReVgQ-NxPNPVqL+ z&QBY~EGW@|4THeC4Jq^~EnS<}E+Zbq zPpj`NF=j1zoncc2>=s$$N0c+)_{>e|DhqySF|5oIu&t73B5FJRCSLfvB$6&-E8BaJ zG;6Z&@O=GkKYiC%BACk1Qh<|Ak{~qYtp%v*1q1{N-P1GoU-QM=ZZ|f)X$0B}%~`B| zhUINB;kz?*&DixccFoUJKMJ~ZVt%F|V!bafS*2*a@#SWH!G>PA#Si6Vs zP&-fO3^hEu@&lMBc$BdHGZsI!;yx|ZPbkIZ#ocEW;>U|~aTgw!cI8G5^dDMF?~ALT)Xy$p1YP^CX8Yju>FpmcYiy2Rz9T~eV=vv!E+W6a3|!16RP`L0!JrLQb5Joq zzAZUF0Vn!r&xRO>Dx|IkM@L~j$0U4a*CK`jCw{S%j`%XRygw`iNUDa4PAFC~_38-m zo6=G~yiZx1TQ+0}^xI-^>II=Ixw5n9?6AvC)Nf9!{O+Lj!op~}26)dZ_YXi%mwT7X z917JkquqBq<*d&<%AfX&j4$$^q)r>g@#ibDE$WCRj0k-c+bYPfaJoKp;JW_(9P*`d z(5P^uY0;m6_H1el3KlLN8iPrI=t1BwGl;aK zDt;lY2YVr{4?D;yEJ~S`*>5c%5aeLS+tam}iZ@~0283}6`~}6BngrswY_x&2s-oLZ zAYVX*8xFG7g%1gv@|VNPyEt3lj}p^vrvXdz7K|TU)-EYbx`iLSWSvx+&ahJ3{#57v zc(b+h+o#7g;Aa>{?lv3oAZ{7ZKL3@o*|)D(Oz-ZynQYsgFU5X5kupiEnf}Z>%HaEK zntz;C(?aU+?ie?*hbe{q^#cm3k*6yktXHcxJsi;2P!eU`M>2~ zG2{4b_Y1Z6fKI_G*|e?!o%5{@(WgQg?H^%MzDqW86ZKQlpLKD$6QAy$`+~l(wQ~#1 zSpeX_@Gud8Eo0=xuPBfA`$#{Z9;P8{JG74{GCe3xr5RfwmCg~3Qs;}k;$o1Xr)ZPp z_0uz+DVXdy2Vt5T_aEtYGJJZ;i{#F0Q!mV5nBoSdf);&q$E$ZX4ZPzimB~_3-eBoClUS7%5yg zx7{8Zq~kL)QQ3w!ID4h#(W$^aDnaUoH1+Nm@o*Mgqgx0h3U?ok*2>+B^C8~+#zvmp zYXadLo>doZcXwF>i0RtJF`Xj?M0S;r9zIWk*jY-c!h(XiB_&wEO$LVOVEP#X2qS6T z)FbC#FE=4Ws;nP|h+^c(|5@FL6O+9C)e+Xwegg(h4oiLZiWAmi_L16Zp!liuDbu#C z6Q65q2PdsTm@;T|gjEH?#erOojqA0&eNR$Vs`IOQ=u1XaM+9k zIyZzziE?7&~HGz{PQ^vNqz7sHch}5n=b{k@$kLMc+qOR=?f1 zhfWmJ-RMcAHzl3^1?}PKL?GEf@#)arU|*!$?IjCQY71p(iq(QZ#Z*iI*yy>ah$_y! zi_(x)rAg1f;3VLK`8*w@2S9=ar z8d%HB28isN0%`&`rb2emA=ji4FQ-=Sf~qOPF{dP#Y9tQnsRx!`07LDyWbdSD56pJ6c{lf7?0ryeI*XYba3i)09leGm}vVLNa4 z6#@*SF!T}am~ZCa5Q2O$I$z9o*6>Xax%OLdgPpQ}9aUrJ<>BZ8f!Mvdy(*RakVIz4bbhT-w*4^Oy2HolYyZt)TaRU^8yU1+JS?#p3 zCe`$yBCGhf(|7yuUYqFRUk_qZ{o)Y2RWnE47pK!OERq5KyvQAlcWPd*y`27N+<9i~ zyRNd}I#0LgxSO>EHx+Vhxrq-uDmVlEf@AaLxz~Q2u=t`57x~}qByl`Bp#)Q!i&4n; z`c>2K@}r?s_6_6Meq#|+X4Q~1pTo{%SpV}>Zs8w#P;>e2b&g0nYz@MRxp=n(k^wg% zE7f#YU0J`(_2FKXoV1 z`5u3`TRCezRI$CIqr$bAJMO1X9v4-CZrMlD+T$ZM1&988G}f7cNIdZE(c@vMyYPnH zDY@xWp7Ys6PL@mpaq;HTM2IG4u$_+ZdT~HJ#KgrW)LH5?Q?^~v&Dg_3`bhH#|ikU)kYR{K*)vZ3eKKj_zZC=v@dk+MK2y$E!#9{)3xX?o!f&bc} zja_BtFb&z***}r@7Jc^oS#?<+@{b=sY;0_#840BURUtqfhrzes!q5sssv3b`G={X>b!dN5AMcY zI>mCqdo-JP5co6>uw@0A+$;-TEaFYC|It*F2?)rtT@38};~Hs(sxmU-1)M4gV|s}P z7kMZ^z7GMy)5!jPRb3t6=?aE4xi%VKe~REG=T?R8A?5}^qySGukQ=@NYoT*Ixe;af zG{_@z*Y<-v6`mu-3(ur5C34g66d<+^G~nuwVMYVPUoIxtp0QGmMa_nBl}1eheT zm~~&cfSsPYxr0m@zX)6>G=0A7gQ zf24U+%8pHcIb@Pd-xQ99CUOg$InAz{FZe~b@)MFI&$aL(_*DqQVn=Kr@>{1%*b?)k z@iT8f1XUMEt4G6~S^Z>Eo!I@^uGEgV>keM$Hv~YcF|#V5;Q;X)6e=3l$h8rIf)7*nqM3S*3Xn{f zaWNZoxj=jbA@J+qV94^JqN*ystLvN9lS@$BubVxS-t~k5=PULH-15iY=zvgD2CQ1U z(z5Y|$uPim0*u?iGwp>zPLfSS_qH3rw&OxVkbnOC`2}DgNi0!$lms;(-h%$L)I-~1 z!qcGIY>}1pkX_zgoBLBba+E^eV`wf8qS>(cN3${BVY|LLf*B6OvJAYwQ7MdBayRPN zp1#FiuGA;veT0j`;Qx?73V!^daQ}Awqc!MPNe1J^eq(t3QakTHJV&u<7lDItpoD3y z+v@lj5nTJ}{j~;1yR7O~Bm3!M))Pe0@#5mV;O%-MyMHDikVn=Tk%1jY=G_Tql3Bt8 zP1gqsGxm*P`+y4b>o|%DtL4fjD9UhqG3cOVHSpast%XOwS z;nELlJ@f@kP|vRR-dwmE1=kl_wrpD7-BKq@?f&3|^6o|-wAFGK8_o>uz*Au?e|S$U z|ApK0N3yjMMV+PH#T=Ve+WF(`DS;;rOMc^vFA(hQ4P={U%aaG$Hw8U>AjlX%H zplM|#6hCalt{1o)A2kI^g!eut4pp`qy}`83@ZgLW2M;H#@< zCp$+~ePb=%nSF=POv&pL;O5x++<|_4!RJJ!*=F8$hKT6nz^CBTQ+}?> zs2riZQ};JfFU)InO&j!A&%9PnECEdq_*Kw@W1@b_E#=fw39YmRyfIifon-*52BJ~0 znbwaH{1OQ&SHJxpZU2qd}bdk?Tl^%S@YrKe9X&fTDnjHI~Cl$d}+ zparsv%W!XY_QA+Sv&a!(P-C@W4GdkV$HFSh{)ZhUBHB++GMZfaPR#!S@M`db4w6(u zuY156IKk`YGez~En9*e8VMD_gAx+EaAJkKlljHj7uisqfy@nitq2g7H14TzwRoTU& zEZ<6l(ba^`PO1c{KaAfV!?~{i3_dvOns+k0yV2)`@^W$s81*dDVy?vW#;D9+UQCQK z9=d3VLNfd}sj3h0^=Awcq>jT%_MmsI=&44o{D`2foG>3(rz%B9ktGGwI#2e_?!C)= zwmesXoCP&C^z+`Bp;C9Chb*7(V|IoCkrzH>3~yzYyHc_>@>E6GFdu_1lAa9KYZPFCxIx3e8IpAs}*E2j1wX0Syw zA;Pe&`uB1ItNhy1L9N^D={uTEU*mLyByX3uGYYKaFFZgmgG9m>+pif2e=ad*trmE7 zA_w$}{i8+gS#3Ok&_s0i)yrXT3!$o!B#3V1IsvxI_d|5Ie&T4b^X|hD+w2>))Lgk} zKDV#$!fHVc-+$L`-y0of3G^cHL+b#?$BExu@*ZTyeRO!}Zf~`gk^HuCb8Ev4)a{hQ z9$YK~j-^sQe~K@DCo=2zf6t;nH^LIYNJ_Ehl;+Uv2Ozr_C^c2w121FBNWg(|Q~Yof zwL2K8Y@M)=Po$>N}SvT-x1gR<(XzmL%X%}8gMHk1~FD+J6W5mj* z)8C9#_6>Jry)J}bC%)|%>6uacOXUd6=y8#Q8QRpJK{iC_ZXqu!4P+A)Lx%c>S`nKg zX&lc~Q4{w;X+BV`8dXW(Aj^3XgYS5n6qb=;7)$+_I+;KM)1p645sa6}^1Yw|uw|SA zqIdlL`ynaCVb3?Zc@0gYI8#Q5yapqtY_|{KRzui9qG9?M!M5N?P_Vdc)YQ%j{vyJW zag4U-j9a|MZQQl|){1*@$m1TZV=%R5?moUdq6fCQkh1^#zW?)qj`Fc!yC&)v|E4|JJt)0)+?ynuz(kBVR*43v~Ppi56JQ-E^e^Luc#Dbb$AwB+NUM?z*(P zEQwmPy?2;t#_GL)pQAyFS9qFqZcLJPEAQhYm0f=T%V^HR>$cJclZpeuKy%an~9kUaGLy@m^OaU?C@rastCa%VOc^eEp{9Cu`EH=a^ZUXvhdXD zaxo4xLxrv}y&=oDo708UP%yJbBkXi=p!rKn%s4gcE5Mg>F&HwA*fj6)BOswqM_#kh zWXCm5v%h;FpE)AwKcx^>3T@M~i6sxFeH^fOw78XVdoB4)SWk)meWC4kCyE0ryrHoY z9~>5xJG_3p@*Te~(YAZIci>zeB)wS+ha!Y3U1;;1Y*%SuWR2QxwK?}#Rfn+A77Zp(ug+>3Aq&()DOG$*N*2a z!uDP7R{+W*($}%G0=Dm7wbU$fnJQJni&6&B5Vjd7yB=rn;TZuU(R}ts_`YtDI-#pTn~7KKkQ4n zn19E)nFqX`*rvabRIkn_IuMlU(0_sPFvS0`s{PoiXy35TF>~8r*rnTx*5{~;?qC`; z-|v%Edwdy&RoR!J4!%XZ?k~ae3%0tNi{{6e!a=tMP8mX2(7jR0i zgeW7l`i7P1)3+tJ{%oCVK)u_S3O0TSHe_a5oGXBZ*Vfiue*l!#ViHS8rgM`VUVy37 zbm$l`rJevQZ@WTtes!W~^=Ny75IgdCBd-_KdiPSQF3?AUr6YHLLE~F*-K5&+c~!4h zkNv+NX!R-Q9BzL4C=&Q8&*{;z_rDIZvoSG4T1hT{SB@+oA3DB4eUqSq%0fh#mW_x# zukyCh$v-F_8D%1CGep(3`%|$sm(=QVIk!G`Zdm|Gy^Xz%G>~NqP>1KGb*5{RqLr2+ zMnX08BBpo40gVG&6$s~TsL^+DZmj^{F{VXU%LQbz>e_<2S(V#1_9DlF1nPmvIHSmMx7;&ef3-LkaQ z{DAGm`7!~Vz}qIZB{$&%GCA{Su=ZF6xw$8>T#kHNk_r)^vM$n_$M=lrpGSj)F54ly+8LukU2acnT_?a>N6D{^hA0ZN|7 z{?3vr!tBeo8)&`2GEH%&1S~@w9v)EV0lfr$6@^DDbI1PUb2CbGR0I|gKCuy2X!nkc z%2j~6b2hSa7rgme$DBqeKAwBryFH;-TNnJVbctL~#BKvV0(hl6ACMpc zuDu%aIpjj@@!~$6%z)UbDY2AyxZ{T}Wd zp+Ef=8krL?Q&ZUC|8q~{XcknLHk@e@>Stl?jwYU>v}gFKN{y4U+;(=uNSKmUO%v|F zPkz6c^H8ky>re&OfSaENOUp>$?KL&yT1Cah)kFRiWaJ<@htvIe@;9(N)gX#!!0FS6 z`k|$8-?8QnZ=IO0h5hMJ{Qg+gjr9Znqltbiu~E^ROaJ$d-rnAzaW4G*%EHuo6PymT zLqjcAkvtIKAVrQGG{3Rq)~ctMnb2ZHWpAM`wk6OmYW;c?ob7dYa|TnZYD4C|IT5`+ zJblRzT#Gc@!MS*8@v~rgl%6Q(IQ=V_lsZk^{5P1mIww+GI%1&+27Wbb=(eou=ENOi zLpX-Lzc*4FvC*1Wj9H@Oq$_=s7XD^F3k>jq?F(e_Ni1N{@4`o=pp08+Be9F@GIRg*ZaFIm`dJ!^g}*ieE7xJ}@)D%gY;8PSb6B8KLKa!k%sMKaY3N8is=RV0HC)TQ#VN{9ef64(b7f^0L}R{MvN~P*K11Icd#GGF!>XxhCr`7 zG#E0!9=_hxVET#yRO!b^}sMtSx^k(D;rwz(j_m4>U&<(^E zt;7nLqpW(4Rtsw*`o6(X0I_vylWi34&4PnZ$?vDzy?%Wyp_y6x`!~ux{ET#AO`+lAsA67Ry=!jwGuHGISxQDv{FFFm-`i=3Cly!EMWer zdbS&(O-aY|7{CYb3Bce=Nu~{r3M!z{lpzEVido(Em;hF3Y2)qN-kefSxAxP=RB=zn zi5+EfM1i00${Exw`30Pt2D}s2e<<+T<-wS(W79gQ?VK-E~pXsR3SzmJ{;GMl5

    Cjem5kUp9?%MweGq2%cvVxCQNLaS*Pxbpp{$ z(AzMCj+@Y7J0Y+oE1F|6s9+}{Kakm1uDf>D$=$qu8Zsw;3~>kqI%a2DZ1fwc_kwN! zT@Gg0zfB>r=S)s3S$ahB8-L{U>DG6AfDF3taze|TgI0N_(71k#`W{8+CPe^u+Z1K=;&x zB-ZCzR%SH~6eIO~myM5x9L9&#V?Audh>eV#zQb#wHhB$!_9pP`-&Cqy%oX3=kx>nw)c1w>^1 zMfE7hU7_@Bvz-PX-vukE-Gmei1mecRarlCuzrHRIQK#Shh7$;7Ux?s{+j0Jz&M*W@;n2ewnmLgsU#w8!XL=G@ei5RV2!W8J$C4`2KbJf`8 zqhU3}DH3j?$=ZyTx38H1TpnHMY#xOcx^j?_b7H@bpK@FE0rMxGjFS0Fp4_nWrWgV& z>KFjWvXkoef4+ww+y{gq4?`enM(1+If;XSkR)^5aqH5hUJRA7LUATcD{DBIoLt#T&d9w5JT6ioWo^>Xb2w34o@a%5*n(>xpL9$#^= z8w9Sf;QezHkhy#RJ+A5j!}Rkat~2t7apV(YXY}01yafec4rm#6>e|=urW?c4L3P0R zZSDG!I9qLP5&#)MxKLpWj{>m1VYE_7r-Fb?uR#1UMbZ$94!eawuQ;7uKLEqW`g-t~ z{$3-wPB>E7-Acn6*QIc9k_P--HFo=L-W~ac#v71X7fH38I z;0iaUK0)2`?d)llbad!5(bZm3;CFUhZZJFCT}IOjfkB*D&ooeTR`H8^M)jp>}QlJ$x;qT#P^~<-*@i7TaxwBpF42F{@l% z$DC0ROfD6?{BgjREGK(@+gVuw4TiN9N7DlQeKPwJNUj3!{Y1Y+bWFZBPxp7Wm4cQ2X5>NAAIEf>5JNk zM~fqjZ%?tE9sgfmq6SakGk z;KOJYjCtqC6Hl)B4kWu$g|sxIdzj0h^r^bwk-@>4rjjlomqzz@cp>~ZsF^@@<+ojj zr0FVX@eSZ)gM@t6!yl0naMmVYJWAAK{Hd+Zc8E7(Euq0AcV{g$#_qRi>Eww`rg1zA z5sXZi*sh#Mdz?l9v)pA8jhTon?&F9WP{YT9+hXsq6|iVENp$_=yiOHYu2!|EVY@m< z7$sOQN95nPOoi{sCrii();v&9%~r4e<=_dU3h4T#p5hheBQaoya^$WRdmb!M3WL7_F;1HMCx~_Gl>@|eN1xiAv!Wsek4D> zt*$JtuU2&ZN$2%a9;@qWbHBQPaXQ6mC9d_84bNcFbB&3%;lks?-8t#oS(6%Kl%>)|K;%)Z! zx2;XyIPO&2o?T3jXT3y*^7}OJ$L!P>u6XGSJ*K4$2zlAXWz9!3>Gm%ATd2Jfy2IqH zRdO~A2`-R#;dfm=y19_FiW2R1?i%S?dcTL@7MCm@<}=i5%JI~}=nd1l2`3=@mvtuB z`oEeX*(s^icvDo;m2)9XtxxZ?6I|M{u3t^2J^_{Xe^8PbDw^>nk58u{GE=!U%^@$% zq#|bmKT8VPUvNM-Ui<{v)vCE5jfp?#1PA6ct^{{~_hWA~dJA+@ZD=2i2O&Z2=0abs zg`lE)hDucYmp_S6`vyIhY+3S?2VaK$@qau!?LVmT-fp?#ZVsA0t9iV6o5@uECPX>( z!kMPM^WQmqo_J&-L6Fg5j`!My+63woEx>m?));cog%9sGMDgkE?E0dx1Nk2OSL4~% zrzJDxSsW&a0gmAVi*oS)>l2*@hra=p{;QlHM7EFdznP=(Y3>b`>H;X>kOQ@|6A05 z|Je@^B^H>C?oq@1(8Fu|@2Nl$&;8pNYIovVI6zmx3;rMHg_U#z@7n)wq2>M;X?~q_ z4cGw#yjp4Zzu9?c-Tsxtuk(y(ZN1mo3VkiI&SZ?kkVjET(As*x=Pf%r-TzssaZm7! z#cEFG+%nu(nw%&`Q$95WY-cWRfuvh3kP7|wW}QUpUDg+Ks^ zf3~TxXgwWgIWs51n;@^_xW~k+TkxAT7<*@4_l3lpQE@ZQ^&Z>D%e zWQwSjvM|2{q7E`Y97!JHU-H`m#l~NsA}seJolKmB)%tr?@UF*a{refF`)^*x+s(|V zcj|b`f4@CG3iE1)0jv4{TO2C?50&}%>=xSpL-T%p-FWB!T`&6Amq1&-{i|XALamvq zF?Il*|F;DFwu0C8mGh?wzNS(14LC)Y^7%Yxv0rC5d5R5g-um;`-}X;`YcREd=PBH_ z+WQ6X$I}?`F&C}TK-`>^)`4Qb+LWbwZ(gy`Z~3u^o*h@+^f?i0@ff?a$CpcEzs50q z{0Aha0!uVso6Fds2x0*YSU^67{XyXNuU2Edd~UGZ4)G@N#or}hp-0Em_vz1nQ#R!* z|B5te@#LC96VeB#YL@> z@Azi?+xRrAe~FE~&|~m|f>mPHR%~m6_)6w)oksc7yfZ!tfczEC_%J*HzP|hAC~s=xodPXRcFNbR{I}B_Zs(}oe0;#NNL3iA&5;LrKliUiAeKGr zc&`DrMrxlNPw6PAIcJ0Hm!~D&g`^V?irT@dBH&Q?jA^&!nyX7LGGBK9FuJ{#=JD>?_;VD0+iyNH3-S4tgIJQ zMU&Nm(Kd8LzVO*i5Vg*xPDlhRX#ZY|Kl{TYca}PPBGkISLi5Vmz?ar$Wze2%L5rG*HW=UmAkcU|xcG~eZD4Em~YTro}foI?=sZ!$q>^E*jLWh>Zzudgsb%oEfF6ICTs zdr}A(f$y07c&91A-88G!f3Fmx{?Cy-^OQON?h7j{W=(9p(65tVEr82}mTGy3Q9v54 zyK~D0ZHMv*#dFFfTD_#IML0T&4$Z&+EfZcU0b|doZ27$Ye6c}vm&kSKo0m<4wd1Ez zqNXX{zJ7rR3iPX5Wv7Dtf^ok`;P+?H)avf#f*|NO-M*QIk?p($rNdcb=0;UEr&+I6;#{H zEo1Ed`c)q|xO?R&ue?8dseQkl3j%pjiR`3+sO?8*?ZVh|V6E%BF4WT$nKIREn6=nHSEW|M@?LGF_S>SoHJ`II;grEgRn* znG=8Z#pXrEfRAaaQwr$J*uisdq~~)Io~zz#&OfV2s>c7)=Ma3TW7XVXxn=lr;0vIY zgO7jYMNM_GyaK*ki10spf*CI15(O3(cVBC%IVnk%b#wjd`XOicb`D>=xl-YV>lj~T zjOxk>Ja10Q9@WTtlw^k`_N8YrC07z#l;yOwQu^}~;GK`UPx_>bpo?p4i{Gc8fOdCq z(I7l_6VAE)qENR5za8;v|4Z5}^*%H6({CB6E}ltt9lU_<_uv>hVi{p%@$!m+_wQAC z8w}_f0ID}&zjY( zbXmet-@LIv|CTgv?o7ko0e&t zB6Uqi_c0X>W{7vDCGSj;+9qIMqGeL1V}c+buF#P$9VnRS))fG&%C=!0VdhS4rcQ0x zWf+{VZ4&IuVDKJT7B9?{7X~kdW%0qxOJQ(u%m>Tn1K+Y!1_upkq-&{(r+`g-vXnC4 zLs&Vt85@luyoEQj758%~h02Xk!{=NvTC^u=Ujigl=ZyVsB%ZZ7mL`fB+ z0;Dwz4olq)P@dy=0-kfQp`z2cUftb3c_wXOP0 z*CsG<@EZL2P-n?qrBzKQ-ex`xWd0Jl_{S~k|45Tph5*kbvU%;LGEn%0)6O6~%S7 zoE8UmLrF##-dE^h@cQ%j)3cpYHTM)0E`m;RWu62QEpOgux{K#J2xmJuE04?SMSM-W z+4XTZ9SXg2E-+*8<*;202DFhW!xn*li{Ln@KH*9p#3YjB`sr=nJG5B@*hYn_v1J3b zXC|IqY*u}9k@+$Yv95t$i8ZQ&-aSNKare|;YZM{0r6z*$lWW!34fNLq%sxiLS) zcneolmpfyP=coKKEk z{UGo|C~cp3);{6dHt{U4Sz>jhmu4~bM03#)A;j=beeuTZ>2bJq%kM$dGfqszj zys{`DULfO<#PAI!RjR;%dykr)cz9>XcmBcwl1v=rf4;eVARJ~{ui2DwOqrQrs|o#n z10%z^muu-1ez3s%>6yN5wIW+Hno?r(7%6&jVlQ=}&e}hHMP3Fa(?$c{ZlStd3Zd1j z-Cz;|a^!j$38niSA{#7*`9zAPzx5(|NjJ$Oq;G zQHfrqQymi8?V6nGa!x&6bKUP`v${QZmf&lXQJoeG^{#>Up9l!{TK5%DB?wr*EUNtZ z6y0~G*>*d^;i20;(SS>ARvxM%nA&quNS`CFU8Gjt%PYutZ)G&Dz?`3IH7ildrx$~} z;dzb0xhPmSE$2$#~lK341i+-76$QSI0(VHeo1g|S}?VWWM`cI^%O5+QeVmJ7Ot?V!8Bslt;{#?p@U-HlU z5}+QtQW5t8GwuX_x)tOP1}A|x1I|4xHo;%c9a5_r>HX67R}|#zv=^X}z@F&nSh1MY zP>65ltj`Z?YS`N^eBa*3CnxlFi{J2}4Hgv@U9%tEDH62#;r<v&A(k4LjI{m`<2( z+nwoi@9JF9klKW`n zL7z=K=_w`_WZ(I&i~q^ED93`2#b-}2F012U=p~cdOgW36(CQgw=#`ONrgGU>rJwRV zwbh68%TX52+o;FUP4v=*Y0@R@Zw=uZvWvZme54M`G2C(1z8sgK%sS0sNX*vQU3(o6 zc9kJymM?YpjpU-zLihf*pFPcl9R(pPP7v>8SotWzVKS}#QN|q~yc`k_{&Q9}b?585 z^$(Ukl*4ZOw<0rT82nUlNlvjk35m_lG}m-pTo9rQwWg%r$pod4tc3L&dc{z3>nM|= zA9oRLxRrB(#=wA$E?(-o%lclP*-gt>B-!<}x4`nY)#OG$>sbB(L*!&^k0k?K0>T`2 zPbCzSON~@jWf6)-DKYmnJ%^n-^>~epWCSmtqhL?%jN{aez8uzkC9D}yv$ocG<6@+@ z0di*68@LMc(>vf>qNzLe2@|3_7^B-3%^}RTgG21l8N%HEB-$1ZJMKHe?Kr2I1-f%T z@5F~%*S{Pr`Dl9`LFcenw;@rmQMZuHn@DsYL)q;u3z3V7<3oLyf=4a8KB*$y zmp({)B5rvur^g!7QJ3JMcN3?3eTTV-UXB#Y&r?Euo*DeikME@3V3|+!bAQ)y}9(* zbk^&OS=laAsj>3r5NZa4W`VQ9<-~&W2bE-{i)+3DecR#r4yDa!QVkF~(XA!|-$#pc z2SPY0Q~oR7;6L$~rtE=Y-|hh8Q1-d~{6#Jlf;XOJs<>t!J3>Y-Ds}AwKHfZ~=k!(1 z)VIE2S7;0e3qpBpx${#i9P0Px3+=lKw0qPwb@OF8vn%QdTRp>mT{CEFxmd2t=eC-K z>a(QwiEfwBuIiRK#XXTAn@TUUQoLTe9eevkZkMiIrB3(vN5MorMKF?#a8RQWvZKC} zlMng=u3@vzjyQ;8sl-f-YNdv68tF+92a4NgIAVFwF8zjCS~kjV!w3~!q#Z~6e)7VO zYy%M$-eLxq9!ECRl+E27oXS4qGyPxzy-L+nZiW&a_F8x_Gd<0zJ%t(F+Ix4J)z;gx ztir})SD0Tw&|;vptl4C)>ElYzxNfaUM7DfD zamoFDxWszzjkxU#7S}QRp~)u;Gpx6oqxo&8mW$^XR{~_g(SYYH#aq z%$rX!aB+3X&#JQ2+b)!DkK;iD8^SRxt-eU~-Wnqt<@;GHFO+l}>y{&$hwOl3NhxAIQhvgohuFbA2O{!X72DYh}l1Dq!Z-1k>)#$ctWQT5v zyx)GsMoz>2TCj@S+)yC_<2ExHWgh;;j;=d#U&5g(X=_QT9{zGm6xt0fGoSf%z5_kF zyXz$vJ3GsuEMp$WjNoT*p=j7|N@nW889Ee&G`~K3+51*XYS_0&R|~%v`|Y-j63EwUXOIc!H$ z_N>KguD_fx%bH&(yf73{w9*ysdzVBpN(XG9J}cRUL3C-rK&z=v#C~}yQm{szt<1`L z?Luya;BDF&6~db@?*Z}7dsfpjrx)H*B0;T@ufD%X;m3i*Wch7RxyeldR)j#hO-HLv zg%MrP2fjG-;s%tuXJUKG_MfJ|PM_Sn!{Aj*+e&nwTUt)5Zm3(Tj%YDlk1^p>9cyufJSxU2th%aG9OdE^c_)iCvzdkS29PB|~Ki ziF+;^fzi-7-+F;-N>;deSHjS+q@I%~!OAXA-O0F+SpW?>itCVMz8JL~QlGp=9gGVj zWFHc}4VX`o0yO@&Dt56~%fY{1e$xcXRJYbUEBh(OZQQtY92RWuGUCtkmSlnE<*&*A zxcZ+3eWH;zL4UzJ(RX884DqC?d0YqBqP7@{nFkEsojJ|B?QLYMn-fZLy>>Ng?T(^! zgSEsfyL%LV-DTE&Y{{)(O?WN)zTp$3{E9~Q!V<};8tVF)+T)8^?rk#f>#h}i!aL>74f~j54 zef*rh->^Cvofl#7q7Gu_8DXSO(@STA9VkjaF@IzSx9;vD4+m&1!#FC8C^9xc zs*a!(DI#5pV!_Z`KsrkAN^c=p00jZ1N(bqogcgtzBBCNSQbL4KMQR90Nq~gFcjJun zd;edS5p}uX$-U>EviCmcs=RFIS5=FhhtVIi@Z&DTtC|=#PmALho*aBeRsjVbeFwXh zG9-cCRJVfR9NGs#KEA}FwhI|)8Z6esb?lLEI*rSyfPJEP`z4uy@3j5b}%o{f!$G;INIKYRk!=el^51Ch+DoNJQ?AxbM9paI|Jcr;xbEp$o84ZpF|0!o@f(l!6ZevE3Vbi%ko10|mytg806o;^CHYbCMXY-q#-lCSxZc=F2&*bdZ*k@K&PCSi7on}2u zpKI99-`lf=&}Rh1*ya}&Nn+PhYn^%(rrv=VKDpnfSLgj~N)i(N?84~jIOoB+3hIa+ zywJjnmY{2;&u_SK$Ij3F5`e!zE7;{DvIzwr_n1oaPaKaRzm5;P1B{3NVVdv7d`_EC zGs)KNnw6FfEck?yZhO10pJp^Q2Y2^*h^7toWrb{(>W!CYPqfyMkg%1Y3dY-vp6S`T zGq@gjajx;_-B?QKCWS1py7Pj2R2Lf<(2^u(EozZ`?k`8PuudGgQ> zPJh+Z4sGLyvQF!rMY1vRVvZ&3s>Xv~bG>P*mh2iVTGHPANvDt9K6C6g zYA1O-A@YxOZk|6}T@U~O$pU%$?8du`{!xNEbWaqD9UY~0?D)xC2D!p}zPR~L47T|m zkv{}b#Rk{p(83KJ#gMCx&?ed6hR*aaYR;wC85p|luM-PXuMb*9vnS&unwQmqoZc$1 zjTJ_t2ng>)o_l30RZyH0R)5*@{ty9JJsl4pH{g(4zw@;E28>c`)8C;+!8R=x@gN>7 zA2fUD8YHF1s8T_lL=y-!20^ymVLr387Hj?1NH@*r1UPt!E<#bu% zW?Vp+{v>r+JY9b4he0fyh=COgDlf{C!LHIbjiS7^$n3|kga)LJMZNnq+rYjiKc229 z<{aWm(7_@dKB(S>#ibRT8hqi@(u&BcpCF8WkoxhG*D!p4!M`_K#annVP=HWf?@y0B zu{z_2(g?U=^Y`l^OxW&G7B;=$+KJXM*c|vA0%2Q5L9hvfijC!3EYT@o*Zjq;_1td8 z@uaQ<>|5CEbUED_*Ase439VZhF|F4&vYUBsCnq=5Z7Wr>9eETF@C)^}s@=zVKPzYF zv#qK->_b9|J<%lp+xgWA)L41zO98PVAN{-=Tbh)bWE@6+JdNXfaf^X-389QQd#;u5 zA#S54@oMBwcz-ufLrH#ZSwR>rAgn+rM$a_XX~A;kTcd^A{-@QhVK~vk>uZez%W>~? z%v4eWQ(@(bwV$uQi=oyA7truADex}(n!xDy{kD#kxWP+0uS*%Or*B*z^NdR8cEycx z>04Ep`k_>D!@&-3!dnmUW`y!LfM0W&n^anFTcDwp$_?`7v66~fJw85k*W7yhhEHRQ zk`isGeLu2poF=sNA>ld zfw~D`x_|K*XXm7L+4cSZu{Upo|CR1Y#hrZdOb}%0Ur63BX_SGqm;AwjP&0a$n8a&A z02^C9Z1Yyxwq2Co+MV6Ia9p1{%??)zCAgwoyOKEke0{+s;;G^^;N#Ret?JZ)GdLqa zyFS;eVurT~NZzYie_Rs;s#;LJ4Gvcjd^@mkvH0RUS}B>8468gdFTrwnE6QHB=So&X=fT7=z5R_>GxHlkDjPjM7y6og;crp| ztpdiA9nN#JE5BO`zc0R}_S4ynL?t4X?bTQ|=&SUt=hG1XW*wtqZ4=^zoP%^)LJ%^- zkq&Me6g^tSy=r%DSV^gQb0a5}CGGCO=2;DXZ6Qd&IGNL9vbDCH|Icld?Ve@ffD37? zQKQYa#6C=lYhbVpzmyJgTAcsh22G8>mGp4bZ`9>zo!k6MjjaGA*cUfLEoN`g>eXS3 zYLq`U^RQ1tm{-)|^L+tDVJrY*T~WeW5@^Y&4@ef_v$3C#z_r7+LiQ`>bKnLcTlIho zNbRv`+SGr14HnFY-CEK+|)O$K~jbLvgEHX;1n z)k^o}V>r*34ek=i?Cb-6ek{0=ab#a*SVaEQC`+upbZKi}+1zJyS-C?)_f}1frJJq@xzw8}2HR{&ZIE^4zEoxeyK(Dv+ApO`1c%?15s?W z(Fc1YHRg_8@N#wWuTW3mi0MuY5I}V&|SPZ2}jNENQ z&l7aE!y!7z)o^tPL&IWbe;jSj97Z z8PNU(D(5+wsFe{sX`YZ*h5(x7hktjm3hmz!BI*rQ^Ho^Nl~E{t(~E$SG8Qca$(#qF zo)`}xM(&r%Hrp+>ZOSMadA>D&kR`3OhB%nfGbVQteQI7KKYisga1{+<8X#8S6K1W0 z*Jcd>+I4fDl!Am=cc)|tmElAoO&fh`#O6ubDwrcu9;Pcl5jZ}*-1p{e_r~kH1zjn% zqvb4P^`BhDkLoj!g27YtH=(=L#Y1>CeK6oRHn`)O=KyVj7B8LAt)@DGu7whFVAhRe z`cnfNSah!2-dtCWR4u;TW?$XRW3I;~f2DfVmc{d|3M5e94Z>8FV zRm-(h8C>&Ukw|l@H7AoTTF+&W-*4GK(yzeMfxx7bzOln5x!6RElei1C1WAC{1nA|^ z2%oWO07j{aio**?94!pJ8uO_jQVGKd^sdKBO3&vuDdlLh1ZFWa+4b7XAR0?edUa6d zEzTt=nuWL#+1$95FhBpTGIXt8+9ok)-a%TCG(sp;326qY_$3ebpKjh-=ptRup@KQ3 z#yIJu3E*H|WyJtlzg6`9mt0oEu`R7z2DTC!6bht!|1m}9Ui_;T`V3V~O%zPiDLOJT z(M97IEwc*xBqTKGblJM3=rc1wosZ)|C2ul8d!@SBw#D1;4@$52B|rdiWy_^$H|;f* z*`x0H0lUn%AEB*;+*<|1L2*Oh^w+A{KRTk8LMG|*uvIm9IkYUB3#SBx4P_=OdBr*A z`AGPTW5vBz-;c8(wH{P~2jv#bv2Xhl@m?w2v%Hl-X#Vkal;lDYCZyp>+t-J55UqoU z&a35Ye~j{LC!4bAVMreGDbF%x04W6Ew#}ZaST;N;9ZisCWuVZqmLATB!weU-UADW= zm|BK@c^~_9r;QzMXcDqdn<#B)B}Y!Xq;{8fOE%xLsBb}lkCmO^V5&m3hlCH@;wSVk zEiVmQcm?C{SJ+kG+r$b4uNrvBr(%hNIXfl(E8i-zu5CHbSE`uTJ-h)49B?C0qZ;-- z%)$)?PpXuYez}CB62fTgnD3xPU2v~?g@q}1?%)UxcF!)puv%H5Q$9ifl0Z6lKvS*^ z>J{gxc~Pt5&6f^)r9^}M>s95R4TL1k!l8+Y(z91JpT^0RhZqp*-378KETQI)rfUvH zUV;GV!?e>EW>qmJ+p%Kvw<^a95l}g5&f`s-o9o>fT1z&~vy*3zMRup`1AknccC}c* z+p>AQXs+mUf=`nhzU?V9xZf|2?Q`PN@`@>bFZ^|7_Tz+yuV3F2cVu|tZ(RCDH!IS) z|3Flbzc@>2>*JZElt7fb>Qv`E_cHG*1yIj>dsU-K!MKT$;(ChpC+1V_-JGn4{ruQV z%0jLaZN6QEAlL$B{WSB7bX9v(wh!&IVM~0E35~wf+V2@z{_Ux-O zPehC^5*dN>(Zp=3O@Yns`j)HLDpw@{n@FRLPR8doW)vxTL&MCQ;0WjPR5okEcPE=s zVf2`;7Ljs$!A0#mIkYiTa)e~4x~UCxf;QJnFcv58|61wr0p-7F=FD_g13bV|ei zHA_OhM-;<+0qS&oWFLjMv^L}s`SBx?h?F?u_PT&&1zvEueD*O-;OwLE3(25j3)z}T zNCzMmaIf;;*H?EtFhEc^yli$=CWNBhn=NZ3n?3MX$_u6X8PZ11{ySYYdR;zuyCceV zr%?;FJNEi%i)Jb+3CBFMX5i(v{sSVEXX@okeLL8t?qJwCRMJt&%%UW4!OGV~>F&LW zyPUQ0GM{g$Tx?cih=#hCUfePamUSP8#Zb-YGiqVi*S3kAe{XH2vN$q=&Vel#K~+qH;B}GH672TC zudt+a&J7WG3WYtghu$e#* z_*x@>pyuYuFW!+e9$G1;EgCHalL8_V(e@p>?qa&x@tC(;K{?o|=0iEHVvUsqO1P1*!&-F=Q{hd-n}chen4WeK;nU4(69;E4&J zIJFlZnWtNzLa?f&5sUH)i-xj=Dw;_Gl}gn>TYGvAR}sE{e}D$VRWy$OeT|=Yaqmwy zwlzeo?>Lo;Zit8sR-3p)R6NUbs^Stq{9anxS?+~Zd{h~pxP^ghtL(GV&vJ2n)q_)c zBBCN(`rqE1*4Y{K!3~VP1(!iP%znG$mzlzWy&f(l@YvDllW}l)hEaka-fFTRwng{; zmi_MCz449wYaMkf(~o^UDoEaqmhF31;BM^Bo>~90#p@ZaSvuasvYpfJ1CI}Sc<=mK zz1#BTxm23bcZVyNgmIa|K8Bf3w0CP&!%vys3M^q=mo|PCu%P1M<(1>g8|ytJhZyZY zS6mBunscXd@LYIVG7YhO0y8q5y_?(k6nL>6MZ;Bm# zcR$8|`SN=31Wh{SYs0sDt5a{VZ=O88gYH|iy}YII@C(<$Bx*~$Z|GrRonaqorHkhM zSNi#Bmp*nZRyM=G_iuf+_X$=9aOLcwXMgNv7UlQkpePj-R9%#KrVm0=bZ zmUveT0BLP_;of>bq*u)VZ|8@Ag+Nb-Blxx@tc8`vWYh>yP)He=B?|$h;imU2{31 zpmpznB5y3B9$z+UjT~({=uH>X?-VbsF4c+E@u1ohR2ge=@uTq7_RAK*(F5h3tgOo3 z?-hRg9>&-3(%66VD_th=z$QjUwWhGyE>4v9Y)rnj6LHwXTfx<#x*#q%r=;Y|iH44j z5EfmTVR*ND&{|pi5ZI3;v>@AIV@sjmhWb$#sB!LJhA%6b3{6RG= z1Y-W~VfOllkFlktlCjT_63R~Fb)SMABt6vkf1ZcH=Z3E zPj5VW)UOGNPE=IXHPK2)NPOTR^-{IvG?VU~qTK5aqdi@9e5^-TR|S&t>u*p-@8G~W z{yZVIxi>=cFUzaG%@!+84J7gdP)tbZv+&@a9dh^i z;D^ILsNmknywO&e5HJ~#S(j6pvHA#b67<^IIyg8^^6<<+-8@}XiexVlN8@fky!+e{ zn=M=E7B_rtwQ>Ns(pSvPEf)$5dqtFHht4X^CY|l-?(WB9!eTo7pFY~`xRMqLzs&1p z!z_TMwY%%CAyBA#+A?W*A*p+Iz2xwrL&A!R{Z1IQ?8KbTzP`;r^%Dw~meTWC^;y|A z_7sQ4aj>D<9l|ZuVVH_uR6Unq5uP47a^U_aEn7%PG z{`lp76wuWDX(^Gq#AALu!cXCNgukyJ`Q4R~z z4Y|2YBho!J4!o?!OGF<1ShO`RE*J{Mm$l}ZRl*OC0=^rElh;x@tt`OBRZ^dAU07Hw zCf@+&VI%fsUc5J-4BY!*sw;Tb z#RO>%yO~d=(a!jOn<;7fyn=HBr6X04-P(l92crGQ55|mw0tZ6FTk2y^;T$q2x|PZ$w?{f&9Dy2-*gf@ z2XBg5FEl`ojEu}aA~?&4{w=**GItP2=7#a|=QKR>m-}u$hUhvaQmIkw%EzR*9duu$ z3d!Cu(W)t*I}{On^Sv0;)EDid>kdw4Nm+giwM9=^LZDD1WVC3psA!g}$13j<9~YOt z3nWcbt4k1)*7bDyw-%tfy1J&wA~`#|$XILX`RcE`K>piKUd(SkCpu)KcS}Y=LBW%V zl4)@5O=klNC7(Mu42Y18mX-IP3Q^y-~4 z{B#MKRS%2>P7=iK7@`km14HYe%TMqe{LHa=#i?&mx>&H=%v8;owvdlRFth0r2I(;W{FQgmG0`skd0GdY>)WvHPM@t{aTB-lA3NrA+ zico6XeTks_AyIGTc(4N6Dyvp4^ygD!*uUVpP1Iv)YiXgH>lq`>s?xdxYMX; z#*a=;mbIn{O!&N83)WSoEl-lSPhkUhRo3XMlSOB`Q@59q14Pf3#pUJKwRvW7qs%x3?pa?sm!DPm!5mI|)}&9FC3Qo$%#2PsR11m-OWB^h z#LRT;lAz$doyNs3tWK&Rs?N`~w~5bt7zipfQkhk^_TCj1-WC@ZA4S=vg2@L7MhVIH zyYjA@g>M0WdzYs#*YnDx1mgGsz7 zUGzpDOVf{pqb>C$Ns+<1-ke~Z$JvQ##YA+yq?wtVkl@F%($1^7KRVQQ(z1h>;-ll^ zHyS73zYh=Fo5XA&0I_d&Is38h;ln}JFfdC*6HJhaFx3Z+4~VXsZhAIorGf2p98F42 z%R76uSWH>j{iDwn?#~?Ib~4U z!c3h~`9pu2TAz2F&xEB=NMdV$(z!wQ4cpo`#46Jl^ts0GDk-TPOfob|=#T;Z_#H7R z^|~W`vEZ!hu-plYJ$d4UsGI9R-h07cLHEdsL*XKS%PFb5lyyH~&nx*1H98(YXPTjFNk z)4v`TzW?D`uIu7_aKQ|1RJWcfKOlVA4T)w527VZnm3e(_$H05a8Za36+dJ3tGDB9> zkxYg2Hi2gInOAKFi#flL{M~Q}oO!cnqJ~~oXF+A z#2jy~?fx=svwhWNEBnFtqj?p60s?^`)6|qJn^#&KKKg;A9%^ARZ;&B}w$%m~hEB1A zu+>LBh^TaVMYnkjL8D>q6dpEaaE`yY?gZEx8vhuA$1^d#I+k$qzk|*@q7< z>2l(Fz?M~ae50D0LzJn&w*gw4CqLWcEuJz9czOJ=UVYiScSHFTBmJdns?>tL?S(|? zJ+aKW4gB)Mwu_0C=s8Vf6KG5!+t6!P(5syMWT)&MHNXQ|#DIwo&!7KUVbx&3BkxWb z-H#Sa5tERhIO~$0f1jE0rHnW&wzK1@V_|Ez=S5^>?8o8)KAq{_>?-pLKE%)1kG7mW zb2w~CadytJw6<33TEL2lP0l=L=FN8XI{VJs{HU27U~8FU?#NN#IhR^#VWr&?7Uds5 zDtOTCqq4)66#e{tgUR(Ml-}nzMiZHe#V&I%7e}FWP9?*GKKlFQSc~KgpM^DIdD+(J zYFC+w@a4;!&%sSOKGNsTUAIB6Xa#TT!PiPK)KP*t+VSc7y7$oVaAi#ma1O_VHxFfK z11;W)()Y{@pr<2^I-N<+M$!Z%+_X5lRVrOO~UM`8ltoBRA< zpB&zh@%b!s<_u{tQb(XHf1I|Xm;eOPX)~vG7dAyYLh(aoqZ6RAKvSuqEMQ>1zJ7R* z$Pvw2!A@7*Bw1O5qN!X+CKuC`WKr(95owPahfzUDZ*MQ65@7;$KxOtRHSUpBgKTZD z3im8dgkX?$GG$m2r)AaM3^@-nYt^@UkK%d{g5q+M zqGB3#$=b*jB;7ZoJl;DQEz~^()T?wId+LeGJ06$^7fAMd9Gv3<3acU zaDY}fsX+#Y<|{q|KAH)wVRTf!>gPb^OUUMxn9x9#1&Vn||f}(>g0Np5V zUkTXgom801DXVqL`3@BuMeE5~P_I;6OTK;k_EKi;JTV_fR9>>O8V}wYXWv|D76=@Y zZ2a*Dnw%0KJTMLHX(1I8{H<&+LNc>LGIV-5kI*pgpD5?GW6W|~CS;SoJkP$^h@qQZ zslK9$mlR(M)8^!0=q!G!r4lM4BRNL+*bt>2#ttYW7Iq37L4bqf?NHJokp3h)f=j z)Iq1A%duAEYWKy&7g)w%-|%+6k^oU~X09B8?D7AX4`t?VpK<=>tF-T<(b+bvvfQyv zKR?{IvvvX~ObCtv!#VawURVifmq+41L~PtyzQT2^X{AYWDeju**+I)wjg-5WQ;g}; zTbQBJ;y&Ju*6K%Bn)X`-0-r&7`60hE9b2s`%QN2tTk8`=F3R26 zUyTX?Ro>1F23QY_P6Yh5TjgfS*4CCAovPEm9D(ib?j1IQ?>v>3j^q7P2HX(A58u5X z5gG9^m=2QKiH(_N-@Xwi5g|p0sf0~YH-}BZmp>=tcYZ#9NdL*wK-w2P_JHKqseHTFJP=Z>BnmfxY(Q9j}YKBP|+~<@FN+7HIUxm0c^2ZqS0}SSb42= z#vmp-dMGO(XjrhcvGMjkJ!XmBJ|o2k12BFOm6p|aoq9!*a0zzCTNHV6~3 zF)u17aR*eA{Nz;Yu$%K)0e#PD=}&a1vyv-=8(2*Fyh&?rQPDwuLWN08>qZt2W1(Y% zDqmRA?iQW-v8WfXS^)40V&|p(BG@M(25w4maw32zv*Fj9isbV93(JWKZ1nc7*=*RS zH&arRf~??+UlpxkpB~p+kq97YAZ|>0ky`ruUCY?Oe05=2R)S{KHQ$cf{`HHPM>@&YWf(jfXA7aU1XoX>`6fd#!=fkv#@%Gan zf~d5~eMMi|sXvmEUj2mxx+r4|Z9HeQEy`_Za&om=WiTa=2Sb+43h4_))d%kHDvceL zYo|=y0A%nQ=x>F-$O>>{D@1CIurCJI< zZF|VDI0X}6acpej2t=tV3T-VL7fhy5*a-qBP9S`>Y6b=ql3%Bkzx!4K$>d;q_%>Sa zu70Tc6WwdDdN2(Y3N_2`ie`mEhf9!1(}6t6D7-NNYUF`8ha7qFq6So+Aa#BA@z#De z!-A$*zyz`imh>O~%{bgdQGyl0Sc;|%kN?l*=w4@TAdo0qzlP5|ESK{lh-+9q6?CDr z1W6xep#}Xt^(x*}fc4_@7sv6LS2yU&z16h#3-N9M*;H{2n50`-wSJ$x!4Gmj(nzi8 zeQ*PeD*AeVe?F~d=~kr*KQqYpOeb^Aql{2}N^G0#AW&=e8yIx;)QOzGzuX3ma&uM6 zO-PXDbM}O4dcWf6oUZxwh^qqW8NZWNuHouBW@OjurhZQSC7Q5|Wq%7O7_zDmkH zt(D-)t9$!dl*l#0#TX$!_3Tq1?WYc;Vx|p3rgw_%QRbiN_lyiIESf1R;wCp|4&1); zOiV>ZXJkYU9zUB0MCDp3*0U!Bx8Y(rNxdm69i^bTT9gqrK65bAiKZf5T-+V7mmq5J z^COPA)eMwFy6$S3gj#M2>KT%Nf+#u|^&t*>@7?tS2WGZtb0EOGx@94Rk^0cv zg#b+qrQE)ANA$wgn`UNdnpwG9lVBU)ua(rIp>7j_kjl0jXJ6jQLfc2YeGo^V9M)qF zsrNF~u*eWx{IKD)5hKpnbtWb$i6x>%otsFBB_(%( z@=mMP3CrCet4DFmNXRTmvfoz@(7nTxh8e&YKb{_vDX-`N=NpoY4Z*qUTE@)zD-nB{Z&{b_$58Pq~};|LgLIv(+(!4y$4_(FbedgoBL7}kK)G0 z%DbXPp-_|3%HdLMSeX^TW1{^zN}ZivGs1AK!`?q3XxMD{sF5f;*jsMJ2}Xssjm&E{DN zo9dwp*B57WEKm=25+FGTHJs?wUjBwu3G`Pz(4Ve*TD*dUC{a3{VhlA>dthrA7+5kO z{>v`XWg$n_t|TgmFfrMk;^ZuT_f8?ppX%=C=U-a$)-d@@at(oxo0m695ZDyrT_7ep zW~gC!x+Eqg8woZT!@ED`!zq0JysnN;Z$bf?N7cl_E#s}-Te>v+9b|K}hTCwZKvUMM zzlyaa8o$J!I>1!)c4g%$qP*0|0h%RRmg!1d;I5ayeEHVmu)V{*#H8#LZQGMfwq308 zf0|DBsGsS(Yz()-Aj%LRBdSD1i;~G(S`5D6{Lil$17_Fq@gCp zi&JekR~wnBEXLL*dFwT-XAl07+AceTddnU8Xkeb3mz)Y3@D7bg_*sY5Pm~{CMJU-A>Ip&qh9le zls^DX&ai#jRw|+b1s%xCRsR=1DktRH`$Vs=ZzN@;UI0@#=CA&rhu!^+9!a_4;j^w* zk3O*iG{Si35k`(_YFi4Vo}P_68Q?r66r`lc0eARXMo!l4)4EVX!H*w;Sz%O>u zc4=fJb8>1*SzVna$s=k)4X&!~GCt}DU??M9-Aebgvkb6n=l962f1Y~(-=RiKFU{?Z zpZ%TxchT4=7(~$_i?>`{Jt3vZsLLHv#VK3BnA8?Qr<#XHzNi~8+F4^5tahw@GcqDV zcs!j!M@oB?M!#Uq83I=pD4Y-y5)u&+fo#lSjeLA+8A&G`{$kXeJwk--_%X!W7Q-{M z$*g}Kdxdj_>Uzf2)JPxs_eS7<9_u|M;$If?*WVR78^=6xI05~jLL*>$IHimq-i@J@ z^e2BLQ;_ckEh5cc9JwN`z1{-Y9qsSmzn_+u*LCVqF(UUVC8wm6))i=vTUjL>j}T$F zWJHaooA!+w2S;Ifc~gLgN;4nY4hsH%H_`UNzumh3{NtrOhQk4*EC>Tav;KbmlN?~^i1-Bne?y}}|M53z z+HGAuJ^Fifp=JZ+hxq@K#ep9+_3SqU{p;su9s(4(Lx4<4OIPW77m%o;juUtUIK{!I zO*<>nRVCPcnpfsU;vb-23shgy#pw>ZvTl1LM~&SAO6m%XXC2Nc1^&zxECuP=r%yDf zWsA-0*RKIe5B0oJ3D#&=`Tq4S^`q(4u-Qa6sP-9~R z24j;j)Zd?{r@CXD6S`jd{nW`Mn^$FHW4sX>xBh?2KlSZ@BP@-c4H^{V%7#I#(b?eW zJAVs|s|)@M8(St+(J^Zs`+iX1qJsU9Nz#Xgn_wv%^xp6L$blF#+ULyO6qIT zG~lraKv9s|Bm=nFM8_`{q&tF(*Nqb8%H0M&lQS6G=I@`f4!}rIlFfs=o&NUQVbehi?PPHm{H`U-|;){{P=FrQe=>>J55-Pa}Bug_DXaaQi0-TS}uY_MwC|?K^m=q%TcBMaqyr$O0Y8} za^%2QG}AWEmdS^f$@hgn#}F3DR2 z?F0d1q$?}_Zv{ajDE&KqdDt_0O$lmbw^f3wucx}CpX$C>DZbUd#z<@9)z-=>tCIbv z;?+WXh~zD@8$Dg;<}~DN+G0Aq&l0G~?W_SEpv`vh>C>8P+)x8(*?P3OtPI;ex1_3s zxtUyTjkF;+@#VSi!y%cVNlg1Nuz4lY<_P2M>g=o!dGrF@;ffo_iGwbE5^m+K%BWSH z#-p`0(Kji`mR-w;h=`paZ}8-q3&28-`}>JrmhPI&|NT+IMSjn^1NAx!z>FC*3j>%3 z?WE4;HzwYd^VqWvjKs{jkrAkx0yD-qsVTw!;r_xJ@2D;@S3o@$1Cd7#4CtCh28@y% zw4g=3i~g3z~c>=9i8vCw!`nCKZ!~rzrKH;hv)BQIquxv#5P)YKXG87 zLR47zm3VhiIFmXzuvDqmf`ii;iIjnL>37&C@1bwA!+BE+h%WFcO&ICn)xn}&mmRPQ4nH@R z!P6*QQ4j@7-!B0{h)5a)>$c`x`p^9t9sZqFy?=CBWbY58{;4cFg)9WHKBE}(dynE*Z@ymQ{W z8Ta+;+X3%p%`OrG>6Jpz$mzG$H#97lzS`5(SqDnUr27Mm`=?)lBv;mHf;UTXOB<(1 ztiuFiG^4eK@RO1dR~MK5BDRdpwa@Vm)#k?c6s*!l(thP-zaCCUJM?YBWf#|nLnXy! zMzRjHl5w3{Fxf}&t&`6x(U@0dq>*OYhlYGz3z!F@sRJKKOLJkvEr5m$cLN%BAE z3q@IaHUN+e&~qbh%dE$bo9KGhJNBgKZEpv{0@X$B-Wt{vYHnDWl41e~`aBY#Ly9;#oZEIAn|9Z=&Tw!jEt?BeSVtni z(0*$Hih&HjJ)hDp5T@4&dEpAc0zlYmU5lZVIOF;K{QSfK3c0hRXzshB&JeL#V%`4k z^P*GZ$sb}QLxx&^M%1E0)3%oLNmqO+sE7Yb6T-0$jZTmUoQj4 zuyw%w04Stxai#)M=B969LHk<&_3K{%qa%*_^f3nKB&9f#NB045vji5-IKVU>U%$lN z?Ac6@y4kSWN^91XEq>_=hKWk~{o@A^sq~6%U$sF8VE5C$i zh+g*?&$B${4r=VO{QR3V3P)Mssw!}WcN2m`LQu`l@&25o*I@Tu29G9XWmTLT+&*Lr zq)k&F&+w(@mM>mCb1GHX=S~rZG3@@Im(hQ-)i1qRa&1=K+ddUP3TSiHZQED|O$CBD z7lQrxaaTAb4Pb$bXlNOECS+wm(J4n(!l$mj?w5lzGn=haLBn99|L_f^p!Wy@#&_r$ z-@7+e+t4>MyG`vK@%A0nU*V`EC^X?)B;40Eu4LXJ3xjte85JQ3e zAM=RP>X0E8W@cj`_o%7SMAQ3d)TyVk)V2L)BLMri^IIfj!}lEMJ8Q*5<0QT?K|WSD zP#Oe#&c-m_U`$qPfftNO)>iYV#Ay898z!UwhW=lw##_TR;sLQ} zDS@w2$>PhR?rp8&NDVLxQ!CW>H*xs!@%+_^z5EmH5y$agzZEoN;7F6b)fu2S;>W3i z=_t5Uda765rTUz}RIGwY`ifrD)(?tdT3>V7W^E4LgifbxD5tXV$Pq`8p<0+d^1*bISM#;= z`LaZE^M26gb2r$;RqUSCXFxCg>_x`8sDbkRJMfM`%V%&q*$AwkqASm=e>047@neUu zJmGIp9RdUt-1BrP2s9mrzW}k&URSm|({QG2!T%Nx{2}gF7cb*qE>&yr2Zb(RFD61gda%_ zCXLtX3DLB0c>JZ`fw699M!c)1rt}|UJ-e$c&sf;sucC{;a~@sq$B!RV`@|=Q;JY0T zAm<*Mn##3?&+w^izH+kF(Zk+QS^H57IzBzs5HrV)A72vK55$%2#n_A$`(V@5e49bp zqDC9>A_Fs1rq+8A6pO<1a&yly1#Kvi>Q+M8qX{h4uTGSJZxKIH*(Xt9Roj-&app`Z;0Jk;jewML z@v8%YVXp7m&8__(G;mr{e1+{70kTvGY@3~Y`V0vd$(F(R+3~QgRmrtKEfNY=VXFl5 zR`(YgK(w_uXR$IsAvH(30*&Y@nwD3IrielYK5=Fho7EO|PnY0;Jf+JHo*`}pM(1rs zdRkm|MEU@q+|d9eHp$5&P{U~;a=h{M=~GqO$?tYa86L02#c#W~bh1i;lK@D=@EIdR z?;4lP2Qvayl3zWv@A#@9FM zzXQ5L=eQrf0%(Z7=MfGZIKcP_+BYt${LFPa*F!{N@{uqSccI{=*c}Cs?l%!vEEqw1 zV1P9_1-dX~xO$nYIJtKuR^x z!)EeDC|KI^M#i5V!M(sH84Cy`JT4`}0Nw|f`Ab>=LMt^2le(A3On18{+_dg=p_&lw`HXi zO48GrlZ_ROtvyY(EQ+zMQ&ZVyd?i06N{{s6hRR6_WBCJ=AMuE|?~^E%oL zCQ)piDQl+bfAIsjshr2R0&xK^0~6gM)}vtJX!Vz=`Nsc(D_H%9yT5DMDZ!K!M_i$n z;8%pVya&;)rAhs2v=;D}@2%6};v9>K{j*@2nCRzb6@ zIRwWXrEalf3%2nAfqnOM=76=YH93NrR%C`wSAH@OFLr&gSAK%rxH=6oGlsBYNWv<( zS|f14=|g*a9dKS$!sH(2m%bQLS!oa)JgP5#p?3+j3Ot&28NM73P(9bau|fOpyNo+i zg>dCSyYp$jksoMd3galpZ+F~^CpLk#Tks7KFg7bRDxCFCHpL;34U0kADGaL@h_p;Mk52)GffdgOY`)EKjf)0B!-~-VBK5%{Q(y+G1Zf zKe&MXTKm7ItDyTE7kYRyo%L=tIZB%~K5UxI<#ezeocNGYbR(%PP@%)r7< z-EXNJF>}f)P5L1Sw8h78fMP@prD`1x+avVW96pFf);fVCYRBk{pFS%0K?dOTAB z)_$}F@9eHHbs|>=T?I&;0|2q#Tp+ZF4Iqf(&58tH*4dg;_+Sv zeh#s6?jxe}^OcE``9Yxo#Hw~v`dXAA-K;6b>#e~3gVJv&!<7W+j!f+s?^f! z@E1%9o59`bj>)pUU=*Po@X@9rTgygzdhvp#s6uFloclmZe8ZO%2c!Gbz5wZx-VXW= z|1+Eb)BiACg%^NoyWpt@(WM|p`1E>Vz#^FP-9Xqx#zNI?E=tO`7 z&-8A!P%HpRj3v9e@>-*8=u7uiHZ#<=mjfEnGwj^y>B^o_k&z1od3x&J&o49W*&5(H zsqQ|kV7$R5JNBhl^0Yoe>t6F1uA;sCJQtf&(o$!b;H!B*uYUD1_u7>?;uqGAnYbz_xref&8vP>%xo%|JH=8Z=^ZIDXoXL374g`)bz#{Zp}`57zj0P@(_o z#08C5D^CdUy`o|wMrM$-2M-$j#NR9LuI-jVeR7s`F)K1ydK3HO3}qy0VZI)yP3NF12lH(iVsj!V}Z3oVz~KIMUVEYvSfs#z?i+CLZu92kIvb z0ZEGvkDLoJrJ}317uRDJp?Oz(b7ScDx-h=}y!2lN@IWVaqD?vnKQS>4jnR6pwlss@ zSP`Xf7PGt9zQ4A25tj)@hh*h}@gaGj?*)iQ8Uo$rxisLsi7wmkb6)JK?=q4nF05M$ zprC*&bS0;=-9*7?nm-;6f%M*t%$9xLlGDaF`^i(7fSSx@d+iQNVfA7-7R=J3W?(nSxUQ70sQry zIqznu1)*SowOJIAi74};jBuXjIu|1ZX-wmooi7xV{@Xp_60o-S&L2O1bZ+~wlO8Z^ z2~9C|-C9v$ATcR2U)4bFMsZ!uMr&$o4sCu|?2`O)4e{0O|6M0-kKOoxE;$HKyw`sJ zhFsLf8D%@voA{-B04@ohdTi4@>&?apXFxX@V_v^}vM}8!atUOi)-;}uS5o#ex?$Y? z_Ss;8R^93!d@=;&2ZZWOW|oza3EYyfQCe0iojXnXX8pq;WNJ@fsXWLjE;!|VZtnet zGpBznX{a^b3>fz-V>C6#3V8L`do+WVowop5&7tkmSNDhH_lRPwY<#eHi6aSb%Xu@p zw8Z?VnMMxXU0mc=z?ud!a0nB#vH|ZXQH1ON$JKWSQvHAb-9Hgb}iweiIY~B-V)L+bS!z!KQ?Y?j{DEvz{0zn3b18BGCa= z7KtH7JeB^h+PtN7Xta1kfj4om=6Zg{KouJ&3{zKUB5xNqtNzvh$*NzV%#OOPxpd5P z@7MP{%ddP|0W%s^7*_^3tSCsIiIfeR$Usw}TvpnYIXE0WEdh6+qouX#v0+Lddaed} zY`}q+ijamkvQ2~ZD@lRfG>e`xK9c_iH1cr_;rx`(<>Ou;K4FczjqhXp1v{lmjoW+PfW?X?c9n*DWSzu{hLRGD_&-E1;7bUrQ zalCqYe2$8RpO@%81jkouP8#Q<4Fc*dT(|oLW+8WL+-Bz;1jkUQwKTAX#Ce%|=x@<| zF&^IXyn%(qU^;+d04~N~YP+MHUAb1cH|0jTiZjo*y8JYFXNPhCQLNShA6QX0w19!$ zDy_Uden@>dJCyKyVraCfyhMsndb&5O>p}tckR%A;=?2f88C5K5IzL#U2;f*Jrk5UR zWNg}jg-jd5BtydE(3kV{Ac8*BasdlBJ%N}b-Icf55B|`pyWoc6fi86qR#j9iTG-pG zU|@<#G3;0x&#;*dmb6PNE2~dzG1%GfEn6NDUf!-;ra~OIA2xY+<^GFxan6PtWlqA^ z)Ab$e*n;$^1LmLjTrf2XMr8zB7Rn`y+A^wl@8wK%F6`wL=B10$%-IlftE(&}b9H@* zdc-!!H`ugYS$&%N9w+iA|2@L)z1xI|V{|K-FVpj5Rt zx4+9)C4n^j6{tNwKe&}SyrsDHon*K*lo493&35c>Zx6Sxb*%;V`uR2KyUur*w+#>H zJ(85{_{yRIPpR#vdRDv5+|+Y&ZpS$iKz?iX{;mdQe@UgvWqN~Zr^ZdeZT~I*cB42A zHT87!;CAW0^mgD>)%HR^0RDW|KhPR3iu>Q)wlvOB%*|7@cJG(%--kx+rCsgRXiP#$ ziG$0OWR=r+mAIgwpVk<`l!Q2vd#SHqrGKlhdoP|fkClUSvVC!{*$kbPH7N@%;ZNat zEN!n7P;I~bo=F?)5@mH1@iQSa%e0YW2J^Wy=I%28t52iX*)HZOZLW!h^2{^bEM(;1 zu5rhTCN6k^`n|KWJ*h55xJj&x1C*RYfZ}-mGvjPL5j;@!R)qVWg*TAKovhvKrrD z%pT|ruiWt5TPhpowRSc!d7!O*Var2cqb1J1c|1gC_p94x)AjnX?^^Oo(kX#$zXa<^ z!ov!R^O=y!%1bWa9gZN1-+T;w9TwKbetRO&xG_=07hT_6`}raI!xa@8iLyqY<(mUj zG_dO!ro3JzeT%@DTA{ut8r@%hrg`FtW+L&#;fFMHRg@|U06 zl4^EnP*lSHriSy_)DUJ+D`%Q&$D;}ju6;NG#ku20OYIhGtaR-IZ*FZnDKs_tL42Ce zvOFO{ZeoH)(wYEDcnXG+w3w4J>2oV?d>CeZ^~8&tM(r4cUNr|y6&s& z%iAriQ_)L`J{FfTwhFCW`&zV0w!fj~vU!>XU5I+UghlY~hK`326$~153~z4@V;JLh z-?VphP-f3B{6HmE$nKA>?cW&btrQ7blw( zcK7z7p0U7Qi(BUN=kbEj&P$1ySQlziyQ;~DPLPsCw?a)BS}(mJr$rZ+z2!LWKqi)t zLT+v?A0ag#NVv0VuWElVe$1?D*Lp%IXoazANjEfvYn5uhgUWD#BfS8#dY#SI>0RX( z#%^^oI-9<4t>MIJ0QQD=Ce5bji(rYnZE>?F7xy34X#VW!4e2D>?dx_`s@hlx=Uz zL}P73x#k<2MR_O1ut$@Z)0ctD%2cp1Ex0&I(m5>fex||j)u*Q?Jno-8=VxGV@Q}NN z8-+&8OIx(HFpC2GT|EQ+hZ*ST!;RmI1e!mw3Lay~G-c;GY|wZsf}YU(;Tr;+Zf!wV z=sy|~c^s5fSIF6$ka$+&xbu(ElT?p_WP-+QGLr{J*o%L-uCMQ9?)^LmlCkGb)h5~2 z60ZP#u9AIz(&*^<+S)o$a}OFCkSt6siM2FMO^*5bKVmGpJ+PrWyG;(9- zUueHK?5?1wNaLcKwK9@;5|Z#C=AT0vMG6mj^~|+k+mB>SoL^Xy3$aFiV_-s;znwtB zU*g8djMV$%fBt|NNjH5qZ)Dk+_=`S3Z|Wk{GxGn24JS|Pq;(o98s?~7o@v0N#tK0G zNQ|Dmjd&=^2*p12PS#B$ZgRlN=Mnx1K~gfZ?v0+}rPE9D{Zgq%MV^ZZd*LAv#p9%A zuFcbj$(|t$1sZ+6ymNgqwWq-)Xq{eHC?3SB_ScXo_bx8c!GeK zJC|5@be{^V6sBXUDQajIkHlxsduGN_(w@TzOPidmi99l zykGh|MwSu|cl)mW#d;vW^M00$Oz>)?3Jd*n-*FHdU)BmWE_A4ii#f8h6}`WA#agG1 znx2Wk&nP`4Ldh8A(D*kxd3 zk#`Y{ZEx>5EAemQoB8J7o0fcPr7dgcx)OLT@O76$H^-eZXwj4+_x>*@|w&Vt1 zRK!{%Z&k)4YD=9uQeA0v^%POxB{}s;DXj+?M{qRQq0bsAH_jv%m?y;_C+RZiVp(#7 z2)GLW6+7!)RN$!e#Q0>|FQY_qA%e&^1czC%a3;PR>k4*kx}lma?8Pyhd_heRc;y!B_fvM zjvV|PsUEx4IaZfv=wT(Y$UrrRlFLvcJr$dYgW%f6nr`iV37&O$egS2j!~NMnoXGaN ztm97nWZ&BZkq zC>j}|YP^BMeviksS?Ygs0T76r7x6=W|6t@44fT!b z)gpDwB9AJ=Q$M>$HbfMC!$u2jOx(4*y~Va4U(VzrkKMf>A?N>I*Q3zvsBxF zIyxOIeBM>SGRrOQer%GLyOQTexI9Tr{ zR1UeCnwlbmD4FlJYwTmzLqcLQN=r%QF>>?_KJ(6hro;ZPq%Q@@;h(E7lXySOFV0W# zrVmh+rQ}mq<+Htclnz4o+icRG$%sqmzM$r*7o);SBJ9rcR!KqM^S>^<|>}Ub6F*z4t~2+(@bD z>-|N=8y*#u1iJ$pW@17Onk?{4Bw>I1-OC0YnWuq*{@1)f0nE-U1a^;w;%F=14waoM zNz4(7%FdS6(n|Q3wm{eMAJP-ZG`5e6!`+`(%5S9Hjf(ljVE(_mtlF%RPzeAflZq99 zxq0npaA!KA6iH3YwIo0CCA?)yR>Lk%HR}{uOcckD&MwY$-&=IYCqH3S(v|ToLoD(7 zzx*AeL`3(Ow(*qLGQV=n1RA#|zN#e_x)ykyjng;;pMo2hSP>}=xuROX=S$Mn(V6a= zS222KD(z+#CoC*XeC9Z@_rvjb7RI)9nL96>IXE@2Y4&Xv@cHIfO$Ed>DM<}rLr@&} z32;U+NB`ZcERp|1c7er?&-o(SS=`_R9x9vUS_jLE6AgM3Xl$D5NP?(@MElq5@{F#z zOi~I;?2A-eJ6qyFc3$38(0012B?()ekn9`YD2C;e>hq@;4EHDs{HcNWAz4 z2Gf?jx@vl{%aDLE=*chJXEE)jT7d# z{Cl;e_0%iN*@E%Oe;7N|pud$nCmy7%nLiWrmz-()NQgbAk%50rA$#E(%}11rL8`Lq zekB8aeQUsbK_TxGK9Upj&Rbrb{PIz)1xv|ylVb+RD?+0aL41QCH)!NYf1OlO!3WWF z6cob<4J9@z?@QZwX`eU-o4s_c=);qtNF=iT;}7=VcXK!1oGT-+=Jtsf_Y)JbU*tHX zQ&pqbb7eG0MHNz=ly3l59N*b<5f^JQ)@n>lzno1#;Qx#iv|MAOm^@f#gsJc*#_&Md zn4ecGu@uU#vQS}UM$gXA27cwh&Qg8<-mc3rh|Vb(B6Fg$IOu6;YNv}~&Qu1r?yT|z zE!_$35M7pAJOE$7n5z5MnNe6|M~zg8Rsk%ZoeLoQ>fppb3ZOcfV`|O71bUk(tEhDw zSN(MGfLAijr~*GzaS6xqs5K+oXVRnQ8(-dVG$xdni-lgCNKY7uf4TAG7_JvsF%vkn z)^lsj1^H^Sz}BF7h|b^<6TD*QFqef#*&_%jP%&`n1zPbdwZ2&qa7%y z+^K#{UspoL4-?##;!et)t&VLDGg&t|7U%MqKQx59tCN|!$c z5OMwYCiyGrj{&=KB-+2untLjIB7-Z|+Xu817KOGFf=ysI(TFZ{fl0Pu~h zVj?Pvp`?zs^S7j=BB9?6ui9V{ZTSKPhAJ8xA49QnoTNOMR-(VP`b$oIc(^kI-MBCa z&=Kbm)RlvuA;M)WMT6A$Kca=f#))|WyS{Z|~3_zzdHtPfl-xlutH7u8YYI`ZWWsCSnM`_ zp*xJkB{c#_cjO;81>t`Bsj0R~a4=;_N<~zxiX0bKTlnSDv9QP{3pt?Z?C7rYci~V{ zgeG|~c5-}Qa;%}h?P2Rsu^g1-=O^y+^V7M`!QM>Jl?SGlsps#h5vuIbWYJ6Cn%ur` z_05*Pc>X>i!&wr3*v!uluF&r>qKYqaZOJ}-A}S^rXrW*=Q+w+Bm^Rp#vPg?c{L{I* zez|`RKN`4UWleD?tb0se-)U;>S~5`QV1<<=WGxz*n7n_4^D5~c=Xla z25TH5fEd~Nk~c-)@-9{6bO6@Q>%ClbEy%Xe&U(F>58gDQD|6IsYzhVpNpaJ|0<4}n zIf*RH^v3ZPm5<{DYs~2%I=_DkOdkp2_kCpViGS}MV60~g#GynJ=^3B1R`PXz^WkvE9u=WU}FCp_Y5qt4<9 zf(}!36z)4M0k+9c=YI~t{V8Xm?YL!=;b#uUY`dAB_9PI5p+r;Y&dAgkJ4_1(IF~V% ziJ4hEyJ9aYDw_jcmZ);zPr>Ar&MWsS1}jjRXlWPi3KP!ge-7aG(UV8~0wnHYtbp;b z_L)0dz@a#VLq#=Zs`-`a2^6r?U*{7F)ja{OMrdp;9?mi1IxQnBYXj<&qo^>gs7&Pg zr$l_OPksIUvLa5Y@H*2?HA#*(nz;{m-69XKork2sL~Y#3Yre*AoZzVBYD{viuDo1$ z#rucw16q%NCNDP!bwElHjY<2O`Rc@QPBN0acLual8mRE`&l|EWI1tI66>v$%39Ib1 z%6N4(3N=f=GO(;EN$6MC&!Q@GBy3g-pm&;ZJsfIl=NI>je0lhIM;$kt?6CeSjOz5$ zcmP&e@U1R~g*&rc0j{fV_>0m2D)hP8U*kI5{+qIiSPlL{c6wgMc?&}*SMxDlA0!p% zwKBkkv83139o5;}M$^54^<)8X=-hj+=ECO!UUe##)xd4x(t1^Tjxfwqq~GH<4NUT& zXK)q0{Im#Y$U(27bhiubT0D_MRcz zmv+bxj4b!Zx{mFcv9W{tu9apDso&cZE?|uw^W2{2*w4cld0=m!E%@BSotmDRFBD=L z_BGdnK!u<6Yc|jsV6Jl8{~`u*6vf~xrzV}Yl0V*Y4kwv!J+!n8;BD3=g7|bLZ68C~$RgD41$i9sUi=U2oGQYT4P(C8hMHJNgaSB(>p}H1a zc6L^-HPxvn&iT#{3}H>`XAX^^7^mPY!zQPT)JO}99HY`M1M_Q$;$j7bJM8SNiSdE- znPv;*N&x_v>pH}v81X~HorG>2W5rol&7Mi)I)je$VNuFaotqzIf!RUQ*xK3ItbZy4 z_gh-lDj0=gpu@gZV1eeLGGP_>cvYesb4ln3y)RMVcIhsA8?0w-m$8!OoPrXX{Va_f ziyYbztoYOUd&#Q69N?eh=IBA>qnt%?D4zD1qB5qC~COLivwc}wlN=Q1m1q$t)C)Ps4_HE;8=yo$K-Gb z%=s$a*s1q7FdS1l`n>G|cYv9L&?dpQcMQBQ8cF(RO};+4)0jK_soQpx3>?ft4x1&y zB1hd%UnTVZ!n@cp@+HJmIK}3F|4}O60q^8%MM6~LHF-s%2E8$3TI|BAQy+_qW3UKN z&p;a7FZh+jf%z2$nPqkh>DfgZiqYAqT+{=-yxzZ>D#rNqkcjfH%y(Z(Ku#QpO5fNY z*w4Xet_bPWsn~m^2+o6_|53!$P~TP)oFuhR3il{-MaCeUG3X9 z*pI;_icS(&tkxFguNX*EfZ%K?ra{gb&u!H>2}mhAg=ZBMeo<0pGJ?A~81|Nx6U59n znPPi36%@OO0RPZU#+EpV;d6fQ$A&}{CzYT6I!hMO`Xxf;Y5Nd)_hs=cAzf{Nl8#o#jOa78b?KZk5p3U{iCP9gUs4 zIcv4xti$A_(NZ@BLR#xj)uyE=wBPJLOk8fR88W)s>KFij}}>1+pc*m+@$D zS3RO#;^45=Sf&x?RF`>jy}#i5GIT{8a@d_I+7|<-37!?mJ35yBvtOq=5nA;x4lZ9A zS;os@6)nF1OnKVKZT}uvBsQ!5hP_3uI()p0;%5tzQCUnuO^w~c*j2md)k;rG-H#WP z%|h}y_rM+k_Dy-&=EI!&nDq^FlvT3nX*g;}lCZyv9WfN$S$EQBls#jtR^)*A= zwLnL_8{<(CvbTtM@+ry4GJyd(I>YF$$DS6$-Kc&vQpUnC$H&K)org80**4&daM$bW!4&H)wnDr<1KQ>h{f?y4h-)L#Y#k4RN zGLf#ly!K8h6;zaHYKDUEkyE%;+S`H`1pyXR8ePYiFA+SHwgz@~ia>&&1h11)P$=r^ zmMAN$5Rs7RTdV##fabgVS^K}n612RS!p7D^Pk3B~c=?yAveby4hz=hJJ^lRr&oa2` zFNSw_4)Ugqwq2$;{=%yZYgwvH$O)R}Kn2h zbHs@MgT%$K)kr;paF@+`$@s6E6v}K!OCp^)BbP`~pZVN~rn;90^m_tCzmbuljJR5X zW2qwsg47V70XQdiJ{B8bv3eYgGDhj_h4}LSIf&vnSlf4x4=JOnno)yQeecfw!>m)E z>$?0Mx7B7TB3c&~hT;pR4bVm?AB>y^3S0`017yPno zu?DrXz2dIRu90C`N_#sY)~>{&Tex9<<2b=lQSrxZ3t4ekmN8#AR2=XJPa*22ViN3$ zd(&rs4Ez$m`t1#onkk*4xKLmQXXO^|-c_+h2yK;HSXru8(m$_?ZL6Fe+@fp=#HibV#!Z&O+j_*5O^> zMF!eCBBmgof}^$niYJ)GobZsO%=HF$M=Fm#f3IxD&Pc=2JI#eKXDGDWnVq*w&$APA z-QSBZc=_@Ph(%1NRMzL0Tz^h_Ejc+E(kh=B$3MG&Zb6_EpcHDur>^(i_F@IX^YWjV zns!6+Pc7`cnn`^7Sqdc3>Eh~r`pc2Rf8Q{+xE~5B{q~jdHy6tTsF76VZi*UPwRdo+ z#|Z>WbBrC5VlWXRc=Y7npT!u57+-buA!Lf7wMIr7lIX(Kx)-=P6 z?oc?$E21`)^S*zlW57d<kQ2ylD$ z%rxolsp?lmXCO8?si41}M#-E>sSL(MT4{n*lOJ(od61FR1KhPW3j`+t!pr?QhLn<2 zTHh%ZY%53>fHE{mIXM=XJDuoJBM)e-g!QGW>5-!1;eZWNlXuN71+`fm+&tJBY=@3S zb!5k28+y0G1u1j?Y30(A6{KMxXu*}we&-rqx~+x{t|&i#9e}}Xv2t{ULSe(Y_b+kZ zQN0U7h@$`lx=9v{0>?5Zux#ke|0e~D@;vElx&wBDv3kzBN8*N^*bMuPE{T#&M z7s)8Vg(=reS7a^7nU$p`Y^(E;yxcp`1B=8B_hrw&#Nva|!>DNNoj7~$4c$$C2{1&l z2Hn);I~6&n?hiLo%YAk_EdUE#YCp=M!K|p>O#EpH$ExO+Yd?QZgIGKR8r``!5`UwP zmMAd4vNCJEa@}QuV0?D+@f~ZLV7I(u2y^LV9UW2aPXGtWAKKsuu7JP1Gx<&ix zHXP#3Hrsa_RxngbS2oLMxP7|~t7JzYf;5F1ozxEv3rsKmObrPmf6hVw-XB^8ia7~smVOK@?)frqM%x2R#!L!PoLgz;xv!>mcdl9>}&RwZK`eX+@hh4jr@7! z*w{^RF^Tk)6w&TJWt}`B+y%tEjp*U(^%Z^Nk2@~xobQhPBZg@;4@i*5u`a);$jyM6 zkxiUgkx^c4^lh&RC*4)tBJBym7IWQHbVGuRKWpC;KRBoc>IXb*1C!3=x)eO%2dr&} zz41T8{qa9Qg8S5m+|u}y6oRCrHjG60eEiRX=v~IgJvLEd2r_M)#f? z+_k<7v03r6x<)7#S!d^r`!l$IT_H_YpQ}11n~SH^&y!GRnnZ zWkhlRGsB8m^YagdcE@D`0Q2>IJB-8ZJ@{b z45-=@lQDwE-luX(yX2DV`k?&Ir#K}g z1!G@u|E%9xAFWSNzQmp&EbgWh{wpG8^mDB0hG8y!+^Hs#?oTej(fIlRx6;pKh-Th@ zR^j|YiY{q1M`_TEsuQCB@dXe|;JBlZ7M~?2Eq(E~u0dSq!l!^Y8Q2`mKC1k$i|dU4 z`!8+xDLg{*gxcvDs9900Mo$E{--@nrEBGVmo9Exhw9bg(*bZD5EjNLm8#$q5FA&A| zHvA4VCVsLVJ$c_|)eoJh|FFM*PtcfKX{OXQQ(2d0Q}sB`=dGsEyfap>((js_N_#m1H;s89;8=s(BhR(Q zv_dRs)cg~UCSE_nC8Q!SbitT4lIQ}-zE#SRk)1>223WtIfZ)X}RZOc0g4hfvNRUvjVr>6}nR+hvuT?%tG9=778H)xQ)0T)+e1vX{5AN$(u*4Y49 zLW)f%i6IeCd%u!*=fJ=iaoE^(vXpEQ4O*hG#Sd|ROik#0cTYvu+T;yb7m$ECGX7UB zB5qcA?7Ek3)vdm_dgSDEG9Un|@e`9w%m^D7ELmnUuSiQwB3%nag z%=-!pcc7Ph5CMt(v1*}zWL2epy@|k?<@VSk((Nt!wP9gt6!jbl$8%^Mj>zE$jY|&(P0-SSsy#nYg4GT&_(7shZi=|`2&)Dy4^Ni zAX=A(DtvI!w|4pw;%1~@CPjgrf0|i!^1Yv_KEX^EAr7#z)n<_P@N`Bw7 zeCTEI;2dSXaXSY+QdwQOE6!!R1&%CbjzvvTmE3LjfZ3+`agKp=H3Ep_8X3R3{9xc+8SaB=WaxB!}-UZpP; zB-by6{c(6LnD`3<o4>~1F!_`oQN4TU@Nf|We9$CTLW6{USg14xHm>vTUp1|a70>Z{VR%Pm zZf(fcA`9s-is93aj|&J1>3&zQPyO`Htea(jmc>xVUhdqY0Cb6bM?kPD_Z?f_hWoV9!Rpc99R@CuM z&^umT`^k(Gd*TT9{kRI=0N=9Gb%DKim+>yy{-<=sG+DU;2q7m$i;t%bgP8~VThj(;RA{IJNjy#0ws@2Jkx zhVbgSP5TY|Z`{Mne8cDTD-+_LHcy?_Y?Y5i$zakMkTRN5@4pjjo%R2(+8oo~p7O>; zq`*$YpQntUF-B)~MXK=|QdBaM!OTqZ*!6=$+IZQd*Ac`RW-z;w-dCtw*7&uN2Dw>( zT29Vh2FaFUY};t!(*`EusZe6#v@6?hsp(mt1qplk-C?JMMEno0|09m$x|-UNKDId_ z8pU7J8i6|kg!$(5Y(DzKbO<%1`q1BHXdHQs&@`7i%ujev#%G(KrCg%Ay++=epVWZ0 z(!GvrMsT~0Cebggt+C!Z@HX7v`9VV0ogvFa{G}y$Vo89l!H7mb-e%3S{_!NMeJaIR zM(ah})1!!6*Nz_#u&l_+&g3k252E%X6Hq5kPKGFJYkDIO2YWu zC5Q#1KfpsY_N!ObMRIe;t$F07q~fI$j}nixe4;*BMXOqkH$Db)2N~q->_SX=+0gtU z;#M);`-3Zl-|;MOzFC$_Fm5DL_Y`W-m2G8GUTlgAd|#3-OaJGhV4 zPxH#cMV_>}6a~eqS`&r#e6A)*$)GAKNyP&z?^Af~r-aUYA{sH#))f;_ z**o)#QJgNQ$#1dO(HJB1Bsjx!L;RJ(Uajaar*0dWq$$b@dMGRR+e|--*K2+q3JlBh z+n_&lB-50F$396)B2_ks==ReW&c}|P@yAEtQT@BRF>4+hro|*qQ{ML-HfOV3AwMCOl#UI{6GFnA7?&-@5L zOPsj|wQd8xppw%I5>eLPH~yT_Tlo z`>~bTTDKQnp!%HwvugRhBX^OP5bjUE&d#KJ2h%c6wO-|>AP5cZZiF!Ig|Ux*e^R#b za_qSC&Gs!git>>`Cj9(ST-B{P-8@KmO}@YzsGFfF|6hLd4nrpIKAM~X@y;i=PYE^vNsT{`;W z1-pezg8vkGXvd5k5H|9L_?y#ge=bc`D>hcG&+h%b)w9e&)RHVLG&g7(wBlp_a}V?w zK7^yIr7#?;eWlCqEiHWqwyu8^F>Wir?Bh?Wf4CwQO{upELmy;b(fZ`uEGuwua>7%a z$4;zk40rBG`i3*fJk)uK6};~E|HrDApD?e+@U1D7nmC3|5sH+jNO*?Y)=(` zem=G@+(y+;JTr*;92%N!A(vK`Sh-jc#rgl-+8K+|N~B5=mDF0!1CT9>`#o(n%H^6V z-*3FRbL-$+?q5Z|y)<|w@{&>8&Xa(Oi^=O#JQT^SSPxidH(a7_Qn@8LG&Cga1^xqG zPtS*2kueg)lma(FMddCj+t~JTxEQ^;n{hGm(}BxWeFdsLb=7##cJ_5$Mdms>8d=I< zZxK%f4-roJ51G?I1#i@R**W9=_%R@sti6$Y0?aW2g0eSif9f3EqPs5$Qlpv|n^COX z&_?K)w2;HAm>^4kN~~0C(%_Oj6;6Bf+$&w}s&k!K5c(d?^88R$^a4HZX2qQV$_ zPu6CDyuFF#2xe|2hh7oPK+l!3!SsQ0!dM;~W!aR64Z|&Z)~|6(J_fKg-P9M_IO3B5 z_$ls$=9jUhVxOs}^YE6bx{O`BMnp{Z_=qXu`rm6`QEBrI#wR!>b5GN~Ego^{0ronH zjg|{{dDMo-XN#UNMMV;2pRh`4sP|%ddT?!LE>clZF_&3J5)#rHE~hXXrDcbI8f~ro z#zagM)A~Kxm&4V$7{@qAzE8|&rnBi!>x`a?WuV7$vx{J!?R>LzPqAig?W?bo^M=?9 zfpLuePC>Ey_QuwwOQ+m@<<&agk8SE28EpI*)<$DwZ~yv*f0@Dv&iR)0p^bH~3QFG@ zbr+uDCYKP0iW;3OI*EcuZygT_Rh%1Rj%1+Ev|Np(78iZp6?B4)n0(w!)%;)s*Ttah z^Fr|)r>?G^p@v@A58JX?iEel`I3%s=9CMLboi4gb?|@JuzUc|o*U__E=i^&q8zVCv zu$g=eO4k0#hilh_8LQ)(ac?I{3-)OR_9EI__KQ9 z019+kF_*)WOgy2J2*GoQoVW5depjRuqZ>}G#H8nuctkV5uLDY+ay+j0Cn;N%e0{2; z{nh^w?82Pq&YeqcM#{rtIn4$VmU1nTGOp^CqP~wg%xdn6N8Lr<@E8Nlf9%tpEB88r zg5{+ZP`L?O@HV}1)I2RIUzjGD1OLp5y#15c4+M|tF0Zlk;DT7ySB#$-g;DpK46#OU zR@Ph}z?ivAbQN(%jp+AFVnnOH-&w!L7T&AK zr4NnG5fgU0AebJeGk=(Pn{c5|34~`ZXs0R^VNI3h3;NULepyE)QU(rC? zK#Z#CaH$$RkT5bf?(keC3$bDsc^r0ALF$%9`ALK(*R9AVeBald5g%@al7y!vB+1!2 zg;PTvRHfC`rXU~aJCQk}>9)DuJ3gf!+|(~i30B?{y3GHu(|mf~F=OqL-BRCOKVkrH z;S|HwV%2P+GHiNIjyyV6Tmnb&=|%1L_}3AaUI_`KQgUTNbtjCT8Cg@9 z85zmS%BmDCgD3orNE+*#xj((ieoaEc3oJu5GES;nJmi`W=VtTc?666h<_2kC&@x_m zeNqF`)&Fuz+~!7~PRaH_E}W}x*-YDceWImm{pcd0mSbcypDiCp=K>SX<#Cq$PBGv2?I z#wXaS^tZ zTEo!+>dmdbGk<7_gpq+k#%{o-%yzLaQ}E=uuQS%DQk1A!kZ=jPb$HVatKCGJ!9IlJgCugcrYh5T5%S-{Sbo}3QNV#T4omz<(v_zyMP z-gz})FUXOBamzVEEceOX@zJM&wX;`QSj;vzHXG`@ML4N6u=wTmJ|=!Xwt1Z>4#hcSyPSa)(AOZ;sy z+#@C7lqeef#jU$AnELG-6Za2WOgCl@UR8JGCmD)L#$89JVsPh3z4PLQS~l6-tf%Q; zkLafUp;SO1_zvjoZ1j41Wlk@~EYHEPCT2$T9S2e`xS<$v0Ak;w`*zV6YaH5Y#bB$s z$r7i6mt!+seRYD0rS&__X^yM52R`uh&aoD{_i}E1)sKE}4{^`zAN#75o-w;?OWa9b zS$%#s5Ap`Y-z9Atc1+CZa{M;05UTiz!mp-NS_YE@PZH2;D|+(q@`7Z~;8=7^LwcXW zn(F1{2dV9I6yYFXutvCHZBQ>h1+le1 z^jE}=TLTf|H<}_MlTPJa$afgKK^(^vNKNszLH<_*A+vJsqa2G1XZ#5f?ln)Bm&3g< z43cKi^xB1o;x>`t*gjXIWop20163gX<`ZrU28gz zNvk4PX@asr%-&`TRrhCaLG8Q-6|;R=mi<+EMW@McGma~5W@MMnyVta1bh{V6nanqG zCHObrRNS9#y~nH(lK}LHBZFhF?%JB4?IvH7873J|068Xpp68qm(^LewH(Aj3 zu^>Nx`qMf7&Lkupn*HIS9f4@CH70ZY3xr814%h`YGkxNZEZvGnp@b)hQ&s1~!U}zP z{H=Jcxm2pQCd@)2E@hj!ZSP;EXns%6lKuA6sCfZz8PC}_b!t|!dHsCkHas7z4G?F- z%3sK24u24_IV+yU4@eKQn54|ox8sq$0FhUJxKGJz?`cKgl)iY{QX2f;LZo*v(PiRv z=IFw-EBi00XL@o}iAll@+Jc09{K!bpfr8L{FLn0-jR)}>@An6RxMT@sg;xixSf)P( zbUg;GH3qN~!ZTGiv;ZrJB*NrMw?HoIiTQRUIIxY6jhSj%!%o9bT0Vh`C*0iFn4UGx zRshY+Y1Wqjrs(ejlfxPrEK1a7X8bA#f);n#XZZh+mgX0Sy-gA|GRY%|WAI*7t>2cS zy>hpH+?+>k_qOy{zBAGXK$OduC}6)6ugKw{!y6rd-0{h%QvU3cUVueoB6&hNUnfv& z?8YVX1E>Tyk7jY=Z@=xHK>5bh)Ic9R^hkh|SabSb3Ig5v7ED;|NdP%#X3r7ew}R;u z67fIW&PHUe1PE!EYrr8{{rdH*4b!cjxl`_JI+QPj)!I%8-`u%IVfkTQ)K$Ca2a;%MFFK4pL2Xhi+m zLmSb;8Ak9b7**|aYK8p zPvrl!4V?dM5>Dn2Wz&3UY--v81(@T9T(@0_FUE#|h~TA!x<<*5Nv4@kh@Aez%RH;SouyFUp?Sy)7(cfZHI3&wN^vQ!o;^V-eJKU=T>E3QFr zxeE}8t*!2b?tH`G!AbksnPH=;=8CMfZ82Lr9rAPAT^}h)>z))&|4A)%p3h7x?kbLO`Gvl4EW zv9DkMQqI+>+}r)CQJhw?m5X=GW%1~A)|$0Pmszu%>-}_eiw>)y(f8wOIR;_QE+;3~ zfz6BAJq0OwFFClMcldE{>Vy8=qLa&hcvX5`ogOl%R;z2aiZ8pbuVZW37adw+S0zE@ zD${x8u1U;f^W%>0D%&a(&P7V?lDFI6wch#yD(k$tu{GTn+RXqQ7k$SR8kj{ZN2#pT z2y|o98Nh%I3l9&+dP9f9^Zai{cR!C#PL?0un6!gJ;T>}kAjen3tI88r=kCmH4htlY zyuDI1rc0b^y`+3O zf8K${e;irbhUs~$vuHCn+reB*m(}M^#6&+Rv#BR0DZ8`OoK#JHYZF$uaB>)asd9feE-f!FuRlj}YSaD`pubP^ zD0jBPZPo{iO8qeyOi5;KD!_%Eojue@r~vlEV(8uH+S=I)H&<(66W&r{slE!{ync># zSgFHu`@mLL=I{^Bo40T8y>Zws($nvcvv~xhRcd53aA!0uEOc(ZXsF}e8!^6L!HbMn zpMH0k;t4+|pqw4IzsP1}YG^gbLQjwR%2JiGyM2!S_U+LZle2TAXT~c|SF6Djgu)*@ z@4scJ0syDzCO7_sStBSRC(#4vbga~xH)x;aId_X8fMS|_P3+h&brNV3KC00T&Mt~e zKHbcDjF*9)-iAz3K|TJ?u(M)hP)U2)N|Ns!*477oXk(#w zw%9p=oiyl=*UYPEW+_!x3wyhQKt8-LXB9B_tA4)-I%l#`@H@+ymH%pXn3`=NJ=2N3 z30sMH*Zpw20$R3u`MdOV)slBKsvg-5m%jLpgfmI;d`!vv)}h+`tF{0~>taF2Oy@C; z&6a1i!Oe0{>}7@>r=5%zr=7AK_^}qq8z%lr{!-fs4&_3v$h&-eG)O-`KgX&0^?a9p zg5I(pcp^Ag4-Wm4hU?n>*t@P`9I1_d1mICxk z(#r#JS7-Vy>Rh*7^mg#s=g|XO&x%KRkU`+>WV^1C6=`>*hW232rHhqL16kLR!51!A54)^SS8gvz%e03)6Hqk!`2V>24zQ-OE?QA&8luZrgY z;l%VtnB20lG(sf^B(+zB4s|y9?mW-0aEu`>HRd8Q#yix5Erf7O-<`^M)hx7a!TnVn zb||ZK$U`40YP(5qe-oXUm~bC*r{WJCa9I3xLs`YPO1Gw3b z+$BqRwmD-r*2v34p`!N6rr!yiD!)ue$KI9x`L{tIqAe5KHRDdMS{8;!EbU}yO#lZR zp8w2Nz~wg0Jig3@3O&BipPQ!teDD2Vun5xrd*p!a@9j6c#OVYBu~caBAchxIWN_bm)N9JX{OkrwwBXw z9*T6|g*1}T+R)JT`s5uuGuOF+w2Cg5{I%X|X;5$HqJqcXbC*U*z=ewnLJd! ze!jiW7_Y}#Owx>R;>J^y7ZO>xP_xL&sp>fF6$`=g)*@bheb`N{R3&w)=t+mvx^VB? z5sw7#@plM={)&X~Xuagjx=g`VhrQ<`VHqo&^v$u9&qSiUuh*_M7?;MjVKoPbYt)X= z>NHLz#u$Vo0HQ(g`A};tahP%GEkr@b!{!MO}Ne9@D!cj z+m_*B6SN&7qgLrm6B4Hw1_%*l5@l~q3^B4}xVCR+j|G+VFcRhLY^tjd$wLBl^~rw7 zc{d&W81fdyL(82-o9eH(y;w4ga!k#*2+=nVj#T^>;ko z6jj#G$A_^y__|L1@ABZi8k21VgV+28*k3P0SS0xY%b%XUEKPlGPi~d8*HCP{0#I76 z0BkwPLfbY&)9vo~yDm`k&T7^TdFK<8@}F~n6PqXbexY~}&rRLO=<>Z=Z;)X497`E@ zD$Sd9Fsj~ofgk9{@YzDwq{lb`XO)nt(`79uMeKrfjooxg$$SVgy=&Jrrh;64Jg=*r z6Q?6)H_r?cdJ+y3%uAKRo*me6CI>6Iz<;MseTW9!;Oz022CR~QfN5?qJ4~*srskT* zia9(pNNRZ0saL&xr?eXQUr3^kZ?xUvhZIjaEK@ZuwQbNRurBBv`;19ay`{wrMszo& zqN2iycAob8D7%blNs?CYnf&AiN}3PfCLYq#CEAd?X=w?#`ozq)lr#xP4*A0jth!KJ zs?=eP-+x@Ztl+ciE9gD)*9UK>^eQx(^p4rSQZ=r`#tkRC{TRO8hbmy#bFpY*2@Bq+ z9#S%zZ6?U*8;*+T(F!Rq_LJtBT=834$-L-XBdnH|#f+M-N8kL$(;a`82YU~RZEq42 za}TaeSq%*cZBi*a3=Vj=MS`!)YL#&)$*U6ga0d_7%QSA^E>l!&lzBb%0VveshRHEZ zRg8ZA5;wPCWReLKvPURDk+&#DzIgN}{~~CJG|eRHxu&c)aG=0KT0vQPxegf8o z+tdz&@}s9%b{gtBj~az{7A_Y}CR`4z?X<0g8SdtO&2vSnj~sshcW9^F?djWDXQQ+p z+X3|U$s}7lh*A{e60#4@C@g=Q-dz-irzHacEooTlLD^)1C3E(=M_u!b^jiJr+uULt z_p(s3y!X{L5&f86P5Uo*VBTw?`A`q^!ARfHKO9lu8G7Co&!d*miNaRqM--oGQA~t> z@Q;3?@*uD2L)lupR;`t2(4-B=O!lE2cEse+jt2!-8u7M3ZJvc?ipBmq!|s_iPg2m# z#7yPK=RRF#HHjk+1%6b!c1_fvmihmC}iQBjW#kgoE0HL zjcp8A#jVOE-GqY8#{gDPmv@qgD*~0>W4*wpVvO)NQAE2p*d%QA#-^kT$yT(n%jvP( z3csaK6p3-SW#DHteO1!iKeVWNP4Q%;;-x~ zmRUxU>*sqGr2D?Z*(c5FQMH|?4j!Z?joH9dl{2fl+xV{djl|b09@sPX4<<{mGmBaT zdH#|C%?5rLGrD+4YkA$*uH3o(H)^M!9w|U2v<( z`10kIQzCJoJ8#No<(bd!iY3)~FtFgsl2_?ke!{u_n!RMw-7gUl`ie?QuDF$zqdF#f zSQe5So(6`%;^(z~K%BFgpRckH!acd)hFq_?>!D|9xk!|(_ZEGFYA1T0IcvRqM3M53 z$xzptk-uSW`1Xzs!kywZ=rN`l!1W8=)n@P(C9+_C+RP4*RoS6Xizw9 zGSgt4zZA^sLJ0G2Lz&}!MTUC}aMC1|AW)NAIWTre9*)|4AJL_+wJfb_rxtpiq3qPH z?w56pz|W7x?k?v4NXN>KLE{z!*}WP|BU>Q#neEGToAU4HSu1FbPs~7P(Ysa4jd6BU zF)hzcLi=rIhA-8U^^7yl7(Z#yId4T;GlDch2U-Q>UrUpdx8AK3(j&o4&-Gq|$li(K zy%gxiZB30>F&6miujKl(`6lj>j*iR4-t~6okLJ2M((1eWK23gEm%WdUvp3G+);b|D zJ5_nMD^pe1YWlK{9`Rn7>q7IJ=ygkGFDT1=ij58ZM&o0?3;=$iJ$BkdOTX$32SF|6 zQ|CFXzY^z^aan5X9(lRBjTn||yQ6#W#APlvW4x)rdzkU6>8yF!TwRC@tO9c~>g*lf zV?Tf%JII+Y!w`7Knmb%rz_uc?+1Q*Jtu;FbH_ z$8P)ucnDop!IS$DG6F__zWtN>WaqB1sBlhNnh{wBk<}S?0%%|pT{LAI%CY6o=IlwU@5q`LRNe;CM- zQ;?!ivoT>mP-j>(8*3-4^khS9vaGgDhr-ctUEwheAz`?9XPS|a;S z2jVG7Qu=voYsX8gm&WSLjZLOwgJjXuohhIC0H_*V_#GY>dtbdX|AF#D-Z1+k%?pn& zqkQv4?1!;5;MLc8{JxRVg(TEQle4gH-U} z<1;hjRu1$LadwrhxFxkPAoRvOY(?U5juV8z));ZK*tNO7DdgVD4vuDg1`=ln`a3fv z7b^7JTR3Dilw_P1|{g^{L+61siX@L$@9nVd(%g}oIQ zYvcfS{U#K@(px?GiyUWY)tmFW72o1*-w%;n;!1fJpFADqs;i*XEH^US)uz~p*xxY( z0)b|vR%j-}5Ibgl-4gkjhQ6}2`O6Yy%< zy~qrv2b4Hnn7y91!OL->r8Iw=%C8 z|NVE}p{21#84u-_7QV1_NMsUJ<1ahnTRY+nq2e^2q7o-Vz|2p~PxQ3*yWIfb2zGSo zahBHVH=NTJYjfw8DJ%0!_YufKvI}xHkF{PoQA)wAt-rW`SeUE=pjGwS*H8V$=6G6l z4aM zm`0vCb!xVPY_A8C5;8fSTTxL`zmkhYj!!MR<@_@z_`?UO*7z)J+SNm|?|#;{C5CTZ zgKmSFG^ax-br{pN9jws$^Uo1*G2m3QNaCVHPZH|(P%FQ&0PDfTO?%D%{TQ+8)k|Z*5 zE9zq~XtgHW;?i&^(K1RXvt*rZ_@m{#bA|V>fH25zEb2<)ux;zp`$a|i7~L3^ON4~{ zF7~}0&`K1cq}zmCo2|STdYD^xSv|EKT{zZGVcn!| zR*1~5JxV4f3#{{BHSGPtJxsFDT9r=Bh6bHYL+8Is>qvQe=q@<)Ad!DJ9Kd$2SBJ^q zp1t?B)XFBjEt!OQZo3V-lke1eUi`9ed)rx|EA^TOD3!i5h} zaSwVN-Sz(;-Pwn&SCYHC)$Jc}{CG}qszKReA6B^fkM#OL3RwTrYOwCMgC$M4KOOpu z8=xkiBXbd#*)V5dK}|m1^+ld8+F&?agO(*$5uFzB>%*%_drLaNF6fy+WOwAKnk(r^ znOEP5o%%h`4;cH7f6A#tZZ(`meLH4ZxwB03y>C+n2FC1|h0IJ-S9=-u3}Ak2w>vYA z4w{N-nVY*{my*=f?!3{|vMk4Wd)dTFxHy(NC`I#6JAk3<>)YPhS)D7A)q3!i%cOcf z=Sk;uy9PiQY+stXR^pu!lx%E*Sl!1{Sf@5tr4^Nfh-yh*tCjm!j^B+-iHA}jJw&Wf z@ic-+Y}*FmGVe9$O^T##8@f+2q4Ox#tEZM}_zk3jyPeSsy6TVLa8T|`fhr~EL&FdbxP+f zYJNL-*m_C-;B&}z&9QM3vb3yVCML@_GyR;_#F!b`RZ2oa5%$Czz$|J!Nn>Dn{C zX(-R$CmT7?EmV5jgkcsdu%o*Bi;r~OZjG#OGp=Ao%h)(^xq#x$ZV7t1Qk7V4?xKod zNqn{@Oy}Vao)k$m%8}h3 z;pY5YU%un{l{|$;V-fko+tf3#V8@?LGJO%ACRZIb4C(KeSpC>iw`eUfvU z%ABc{mCb^i7myeV{GOXrFM4^E+0~GBRg~XN&o+t2rV)+3<#cp(4&6OOch=g=YiD9? zN+8Z;y~YVXNLDwTw;JIR-7+J3P; zM=MKPUmue>X%T!*5HT`V=StG2@lMnv&mzi!x}@%DP0zpKhO+9C(+nMPZ= zdwTLh4xMOu+K=h7O0Y_!Of1@u&X<$pGX<4!*n{40glFr1N{@Y`wv!VYZSS>VWmM%A zQunuU?;;@1SFgXVUu*p$<$Bezcej$LXXG8o#KdGY53VgoQ!AWPp+%*I=I@4vj1}LV z8piZ~%eciKp!CqB$3cfE1Xa@+o1<$-AA+>nZ&xBJ9F2)9&4m`QVW6xLax<>TY*S7> z3n%D)j`qMHjKPGn*r`)rvocn+f{!0Qdrv^?`vHLu(5j5{n9ld*Ziz-&_4L!9YZSQb zLUDK3$36OZrA0Bo@;R-&JCp7tPMQ9Itxtm+hr1|f&dPW+ z2Y=|JX&-w`Oo0_48(u@2G z4*(s!gOC6D^Q!Q_tA6`Q0Ug~9SvXjLY@r@I%@~QNR#r)WU!uwZ(G4GZfBc2t+d2}- z0J`I1j?c?xvq-u&JS;_5<{A2$?8NFC;%oJ$Te@@zi4Q}o)T@7RPPz4-YrSbGa3hkuH|8qRz23tgg zj&)0gQEq;Y8|C1^jhWmD>ww_jMXz4}`K^m)oHNwT4JS@E~P#Hxr_XMY47jkP*`4~h>Fqh zD5dBBeNeo-r>DP&U5h4|8oeX}vSV9ZAvRp%j>Sm>^pA=0Yr46y@p#Z@$`-NS;SqT% z`pd{;D}eANbTm@TdGp_7WkvscS2vPeic1@Y2%HMAOqkAtH10#j&3z@*(e9y+6!4h| zGTw+^c6X03uyGajNj+F8#o^G|+4nzQxXC0a;rwCpAl<5(olk)bRZLDr1(RRh`};_R z$L9Hi)RhUCya(r(wc(2;+uMl5>E>6cp2J^ws?U=Aj|05&s ziR*n{l>$@*23pLmw7B71Nc=1^@qGTDMkFRDCUSm1nR=R;IqgN@q;*5;<{9Bqpvffn zo|t&9v#1*zKUGv}GF;gLDf-EinBw9`-n)sCkBTU)TcN(oHI4ml?F3bogbe7goK0K; zaSg;AYLN*EV?B$uD?Q3UW~%hXek($jZ^MOxA9!DlkPl#SO-9= z&Ol{qRp6*$4Bi ziV9uOk?~v20a>-WdlWtV2Px3<=Cbqy&ja#|gUrFcvmFd#>s zt+Libqla>gysfPfmgpjp01>vy^ca2IAhk+Ln&P{+ZdOX46Q-@@G=dr&YwH;3#9%8j zCsU^e$_3@ZglzjC0VThFO2ke%$&6_MlH?w&&n7dCU4(wHzRw+lb9vU+-)Cgls^=d# z%gt4KkIlAs%+f%?VOlG3DPXl)l+Y?T;=lv)ZS*nv6K{kXgORuYmUn_Qu6TAyZ^aHS?#bi8cdeI&Qn9Xq`7 z6lPxw5J_DtWg`R%?Y2=eU1>;|xHM!R| zX=gtqub`m8(dg~WJ4&LY*!;o4K_QFVY=dIfm*W6=_H&d=@c12v zY`L8Pv{vp(6B84aYKJfhXB+##c?J@;HZbb4V0g{cFLZOYiQ*aGWRLTTTr@17JTL!4 z-wgKT24-?}`lr3jk5Xe{6Gl!8pb5F#UV)Af55=qL^dvEx7%mWNn}n^@W$DkhXSGv+ zqC&6BZrlcP=npq2>GAmSQJk$)@bdDC%l3xC3x9b?-rGdDggJHEq}Kz0|37(9$kw!U zZKlf-&>DLlS=r$~uw*^G3m0rpbxW!LzVv&4ky}k?YZmjQ*LH*6>_EPs^;cKRL=FDk54On9X zJ&G4TJ38$~4Zm?dgDiF64?vfpC%Sab1tR_BC5h*UR=b?qq%~&AXEIENjXjoLSRRpz zdYhQC=(C}pjQvrHT zUc*n_JX@3FA z7!VNfw$_xpR2UnPl!X1e=(U8yXtC+oD0Gq1pA(0v{FYUmzgFGZ)rqCL6d*7GuY-$F zx8&!YR(sERZxb{>O)6ZlHJDzA8SA5|ej_AjyPNV=Fo^VA1X}lQ0#9VMZdJd8PDO<$ zZ>WS$s_sF$WFG6@>=e67_uSZnBH_*>i(Je^`|b(?8CLMr*Eu>mou~MR2Qo(Yg8!|8 zqkaC&zth~2sg{(=sien!{dyzg*2CRfgV&rY9wyeBcEk!ZA1m;n>^LtDx}EOxni?Mm zZQKH3a=3(viBooWG2MY(B~hySi;HDTg^EFmjoyO?eig|UBKa<4}i^hY+zI!)Gy+|C7q@dD*ot-(N4VLj1 z8zXY8u0_Iy$1o;FKa5|<@X&8Ugl_JWLe`^V?jG)^%2lnVkMkK<8j?yD3x(4v%E~TZ zzO2sDUrLz6FRG8-r9UdYhYj5`di(ZT$|>b}|ThK-q?VW0JIMgij#C}Aq+1^3ZkWm&^9(_>)YNq@4gH^kiB95vG!i72*; z`KRr6udv0TgTlo2lmo&mYctEs%f(GwGg-SiS|fj!EDeaeS$}!+bi%_#4{8JUY%Thx z9soJN#3kLZ@sW}IuU~a%hq2KXt?~SNdV2U3i{>(eO<$QkA0HP=hyPwjw22RP^C;tt zp<}@I>}HNhQews4ZXdEe+2^fzvW0?LTW2Fq(s{c(V^8#nrzf)c+YpjeQGS5NrQmMb z=4){x3IAxnKoB%sa-CgpNCy|B`ygqe5s{_Xol8fjeI_w6G4`rMrK{a=jx=7tMv7X` zRv+QD5MLL>f{}2U6%&)A^J6df^nfFz4K1I-gCFm+Wsk3l{ER1s6TytxmAe-jdyYvP zT$wNoxX7N?UFn|8=lbo#p9!)_7GiFbwq1d?$`R==cj@75s8~x<%@@X_458XSKGk5m zBEi6ZYhv2un3;^rI@N#AO=Ig#38KWgdX|XQvpKFO;jvnl_+(Z*MgSERnJ&*-trpG| z%uDeIaR#UJsh3z9GD{`!bs;QUZ%@}o54A&>H6H@*{EmG6G&C9Se0Hz~tYH-fK7DQy z+N8`z>g}ab$i79Apn1*G%KFD;R=Z5ZW+2slWwKZJh4CpC77&!)BZ&#mR~q|ls?7JF zws;pE8HuU#WUy)-kf(eeTXFtGPb7t8q^F4~L1n$L6zIKL4b#{FH59g%Nbiy_bSL zjATToS8au&b|$5-PmTAFCP)@{zPeB~KB7@#0lmfiIb zzsy?c^`waPz8Sj6f3%@;Jw?o zwfyaIY3<6&3gsKS8u{zZt*MM;aus#f_Y_-FGTyT7itFxyb=myscfGelr>3UJRqL`n zul|%9pP0~}^El|f87UfQbFa$K**QpNbCnkiRpoUfaw@tU`~Llo$8y6|Kvf+ucekxyfuSX1Okn$YFU)6wV9FHEtfm+%Ga3vE-Kym61tglCBKxH$Hj) za|}$}1h#~ba{`BanCpl^oO8+5u0j%)^I*s7KtvY^^krksO>c~0wPH@rRAfv{j>#Fm z9>1Fhy33WgGw2i2K1p z%&W`7_N>{0mZ@_g!gg~eqc|mYZf<=B>D6M*){I^j5-{D4%@*bO@<{7>+FD;6I=~q# z=`(P7XWrhI&vj@-P97wv_PuqRn~XrM@knwRbaWIPVF;{3wKzWg3^hT1*?zobi zTy9`spat{~KXhz5ZFN-{W3U&;$cMOyCh#c0AG9w|poPpE=}VkodQte7-EZEAfOIQ9 z_MlKlL-+`F0e?^;?%gBF-HGU7)VHs{AW4(47gqv9Uh9O{1v_sw&oGI-$A*Qs&Wx#5 zclTfI;jT$D*)nfHTk{hQ9->z~>xrWPcRG_%*+L^+RmFLo56^B8H558aXGZ$gnyMHV42 z{Y8uKL~MT7$`@A)dlcquJJrMFYQ#{E?}`8rlE=h0mu9G;uPOqUO4iQtAmmOM{j|_r z^xHd-nQLS8%kRE@s{!AL)(c%zQ&Z@{17GoixBp?PbYj0T|LCLShxkZpBJoE>B|bcB z()W1=^7aZBZzZo_ze@*&G812Se)vUGTRUj5;4VFLYCqRSTIIuYWc9HM=`TLcPjN{#Go^H?1=1H-Ci-X-O=SNOSs1Dc3=0pZ z4~}cn%fkt0Sb%-?XY&!syEb0&i^oW<<@l_}!vj&qRTX6FwNJw9)itxu8|OfU?o&;( zt=>zUTTpD}&d_j^fGqkr%PkItU?wX0#Z*#{O4nj%`M6S><)iV8yHjuhv>tXrBJOcd z`#Yu+op+1&9PtmmA!G4esFveWjqiCKp4Barjsbpa&43BhHQ9-4vQ-^fwT;zj50%iVnB({#24jceUGi zl@C?nNlcoYImX^Kox^|R1|RTOLlLMfjlxq3Vaj0@uGVP}iIg{S%(AS2(1z&5k-?); zQge;by3PqaI#>km;=Yfo1KHw-rw0HnW4ARd)u1_~fPkK7n@5FRx6cx=Cc_=vKjBJv z3O6vfeuBZ-r>_gnGjGNUAH5nBC(0lcB-kk!;VNU~;^nRA9Nb$bhQF`g{z5qJ;Gtd? zNly`tp`n|c2z(wyb@{A=_}LWyq{7-|a7B&0_OnH8yK1eitr-Zc(^N?8b#uellg67= z#=5R9IUg4?4=b%PqCWDCYu{LL2xPojVP^4h zv1#O!@7X$|3g_!W7~_2VVPjYNk6dam&y+vae2k7dSm*5>9GtpIgU&UWAVZO$);mC< zm)riwSqQs3hh0RjHP{*ZB;MiiR71ur@?PxRNQB7Nx_-@QZF7P-uJUB-CB|4KY~tWi z>6fvzq>s19hPb5FQSvSc8(J4Ki)Os}!j}OiOgppxdqf$Hp2Z=}i8-2td>vj0GqQDl zq07#PbJ*;|5-!D#n>^s(XT6ZQKF06W+3z0LLx0r`QTA37DKHmImE_Ff7!fvfs6gt0> zsi-b{1Kau#7TFy8>P-!|0SBd=9vjAXZL_Y`m^``L`C@%$2fTh*2HK{c zfmJG%E73z$p!%CAtOIN_@paHEks#(x(aRJj2ZyDX4n=;cqNdhxmHLpR;$XEzv5cDs zwiqR9-q#tpiJHl0>-79O71_ODbKf(kshC|3;hfy69^j2-F=HcH59Np-4@@XmA(~ zc>X&$AMO>r`0+}(eW{7*fWVO>HWp_~j}_W0OF#aq{u=A>^~1wYy$uZwJ=^`Mez>;y z*H>Iy&KK!xWe((nu0w^{_b4Eas;?bmL~ILLy}q)No(#!3%`wr*ZfzSRh@aF*rSK>X zR#baT#?(94H_yD>NR-|Z_FQ|eC?2gjiEAmZn{1kkAC0?)9UnCv@T#pP;J$3aUU=zH zU8_0n#o)I7>sTglPdQT{BY#Jwe^TcpABmnmCqF-*1`OGio97OStLpVdAfmPk5tzp2 zW}Ys}i9jo5%JMQ#S8O)b(Xkm(Xo_a!8?+%wH9&PBQB|hYYwXnb?mz-$J0cCfo8@#c z%aIyjmec+(v%Ipl)HBW<-kon`pb)0hxhUyo-I6QZ*wo@=k|arNPwa2h)t@`j(Pcoo?-4tTffDL)A9o9NpZyYK*;Ay|>nQR^wX} zBxm3HPcfPPq7r9ShY_7wX{*820yb^zGr{M*F)SL`{PE9)@+sB%L0|Q)HP+%<)3Fn) zb57XlD)4aOIjbsRH*Y?D=>TCviW9`d^Gu4I4Z}50AD(AnF&Gz4GYhK6S`X%a*;H*k zy`|rsk|Md<&%D?Nc#lH(r4YimhtCN)N{1mXoY~$K^4{BNtEw)liN|f{(XQ1WJuW;p=)ASLI;kBl?z!xv=M1$;Wb}XcqKFiHQ zw265w!7kXeASEx%clbACF!R*dK*I_eZ7(A@?95N0XBKpAF|$4g*{^#bKI-WvqO!AWZB@C=zs6EvhNe5}6AADa$ClPE*a};Z-j}lh zD}VZIZ}T6XGqs|{k7juAE?r%nlx^9)jBu_`^h?*w?lv|x6@3^890P3S@YJB$nZ0jm zZKs*fm}Cm`YC@diVKsCfzj2t&2a)MTDzUXao0XYJ46Egxo8&VpL4YPG>reT`l?<0jjjj?Eb4;@(H|8(;}?#p?UnmyZL zS^-VA-|Phi2!YN%Q3Wc z4Dam*T&T8aIkZ#Ft865J)5E*kM%WijPj{I0`+j{7nHarOLVWxxv7Qa6EQduTKwHvl z)7~EA9W{NX;$XJiCsgj%wxHtmun#Q#Z10`sHrZP3EBRknhLlK80e!u8k(Agb`=h(zs3p^UXNw1HgK8DeCaSN0RR`U zVX6k+GF7VFvy8d!q37BR4ZLyV*Qs_PXFFvb&(&*F130)uT$ax;RU_?X1F7DCG4M{! z9&4uC-lDH7D$c37M6D@bS#(fLVc2Uut?+sgrvfB-G;|ciVXSX~l`&7ZoZexO(fFtD zwgMz=#kWcqx;K{6c%}8U6Dy&pL0`3rq>t>CK*~Qo3U&+mOd{F%3K#1!8rn<8pRCHq zf+WQ1qodMQBegL|ompU#)ivpvx{1M}YJ|oK^r@39X@*Yuy8H$yLp#)L&rrL61F{?R z5s~gQZU?2RzNaDG{QDqJZdKXFZ?&~t5mt6s<3X1_@1nqXLDP*tSi~ORKFYX#k(?Cg zbWalis+|(|xReV^iv0Zi-=Wp^YNMz1TWj+fB)hmw`x>JM_qSjwUtX%?Ew8AUHNnbc zefZ#a(MjO7JX@8C+mL(G6~;im5~nFv+TI+i59V1O*!a6BKuyeG6cs674fZzMu8IPu z6dv`Pg8S^Qpu`Dz^?udFP`*B2w^EuGF-S`Tqmz~7gMs%}eAuM9&;H<(!JAT)SI5~l zK-z+g6Sda@3>?~o zM8?IT#4J109gvLe#f4gTI2GX zF1ZI2VDzc4Pv1AjC5|=L%|2)ON+6&z4Sjv(AIyIL{dHJ6$v!DRitqWcdI<3PE6wqk z3plN;wOIfj9=0w@u4~_@<6Mc>FP))M{s**!9AD<^*Ab(94h2A>FhFh_9A>^yf}oC-4p#Gv67ZiGFz)vCxm$vHIrnd zSLa39P|Fd&A31KP|3EGUYtPcM+cZy|n8FI%^ty1i;yIw3c^0Umm_yPN)QEBR+a~44 zS(VCXWf416ipcl)X4gL{(gQ<7VDR>`J!J)HFGdv3mb`=v*In<@Cw(eZ>z+Z`0 zgu)l_*?X&B53FAnD>HwJG9=-`Wi~gAS`wv;wA+mIHwi0UWb95?{_CE>K^5af))MUS zUJX&$b?zR7f}f;Jh9$n=0QDQ6N}|xvV;jOO{pmQbYndu>d2Yj-r4@#xf)9(I82O&9 zu6Bja0_UCEK53|JqR@~-o!!#uFXL3++}sRHzq{*GVOB?(CF0Wti(oUTpVr8VItETJ zm*(`0&+C;UA|+tbBVH4J(rPbaOlM4%9 zgZz%V+Vq2-2u;QeRrQODF&pv$?o_r>B;n0t*s7{}#BNX#R(eEJKP`e#P0&zQ&SMf; z)+_SM%r&VoF3$^2t>ua*c9Y!2(1h?Y*6Ks8F#VzgN~{-_Pe{m&gH0or1SV2{GBn$m$l{@*gfp72R+o zA*=@iy*w~2=xXVQToLb_jl;T~zS4TTa8($Sr|#4n=C8->x<)s5n40OhV(U9j$r z8-CAe1k;akL#5Pd#X_HtadVSuHSK2{qI&qU+VK1D4MY5xp3+CC>lDylWJEj4$TjKO z>fC-*$u~LtL5*hY!s{sCF*9I_D;@%VeM2WaHZ0d%DTSW9T>;Qq-+-FOPSPqNFbogU9b(Ne^(h?5k z4n5Ybuz0(w#Fp@%zt{G3*_lPo7IPzeuG|QtvHUu`dZ^){o#U;?=+qfCvO>t;5?Lf1 ztda_^3!YE-SK5d>!IlG4_Dt>G{OUOcFOMT>=Jr#!xwgqeAfTyE?;nCP$Lm1=dR?~NguY@pWGYs zpARYi{3JU6BeEya8R!xoKItY#e2Eq+_-v<^o!$0X<{$64(J}^^M+*DPTvZmfooc6O z4r||DABZ2UKEE1qbailj{F2Tu?D5LC_ujUxtq$M4!uP-IHg-Dhl zkqLN{qBp$qsr=`b^l+qb)L;ra(ZNf1Eq zG9(^v6zgJ17rw85F!=|zTs4M`S)fAo`S^Xcuy*x_$)~YiV;p=&mCEO4&H=w4@3ZTW zQa5;2m!4U~+1Z26@0O5N_w7$yYSD3c|9B&-w*CA0@Mrw_g#8!Eu3ws)dmy!H?~F`= z1-H$-VLi!b){S+O7oiWLQG5y)qDgS@W0TP#_+0sy=yiY6KJ-4#F z++L=!(=AaJBj>b#)!Z+GgL0zEvB?w^k-SlG5=aO{jYYzBLBVc}rznk#`giCY`N=`R zPk3%`_c=YIG}M|W9IR{=!VgqJN38=KmqIm#=sHb`V|G^tSSQYkc+`Ibq%n2V+s z`#x@nTb&-zJZX2oQO28Ow_oD=|UC6rT2r^Ank)`^QRJSgB)!>sqJ^#{D>|_I1QrFU0))DE2 z@wqE%YHlE{;LdgzbeZcmHoHq7ofR!#fYOU57G6)nHWokb(DYuRc#+D0C8pNPCO*E$ zk26v>Ol1^cAe2W48RU86qnHFMOQobXx}Ct2&t?~rU*&3}v=0GQ>RFfDxuZ!F7&e}0 z&x^5pCv~%lQ9uto6<|6zs}U?s*Z}1$X(FTV!%wlqS3bK_Gi+jfF0Y_;U}D-Cet!NL zeZ-I7pT8m^q6#HbL|R*#_*M{>ZI_@q;gCpcb2C3-DfZH}YkiMv?ubAB`X-9c1VdB7 zx$T)}+Eu$dzFk2#q4Z*UwF<{<`pbC#M3d@zC*B;NCwt{AY{QBOgK1IPbQL_T3@d%4hwmtsfK9 zhxpcX$hP;q1xboK`E`xOphVPnL*sYk2B2+pe!LKOSYT z)Ys-8lS8K+HDFk@?AQ{jh<01KY&7nhE+R6z zH2RWC)y?2op(qa8)@r~ufueZqzwh#LF36cgO#J@&$ZP*fnEV=7{?n<6)qTCWLzye` z#RVpbIUtgJ)^H-WMxS**_`c9GHvoX&jCdsnXC_yg6wFnoYU4HMgX=NJd=>wJz(9oG7_ijF zmX@kqGK7FohqqMO_X=Z^juHMc#-OwljopUBQ_a^ur=^;%4zA0dd7`Rs+yoH4hDJxg zt5@20J?<`X8D5Z;HTm80q|4}MYnnWboxP|VWtbzCgngEtl>xP9Cv%5tAdyy7QQ)i3 zQ%B@jpQE~dMA#0M4EK}`7T(d?nJ6i+p`E!=|CnovK@7S42F28Q(!R^hauaYo-$jy0 zm^@*-f9~Us*l{WVP~Nqi!RtIbZvC%8NxrzbDXN_`LPRSK-$b52JN{$4)zx-@nvFKJ zqx#(1v=IF-EN)m@a(S=M*DI>ZWVO|7sN&t`2{YdW!_xhriw4%$e$aQ=1`NrmvYvr0 zRxQWnj6*$KNl)$#;@t}3){{zQ+Cy0IwqrS3m#q4W6>2AA-@QvO9o|*C25k07n zl72M!-7mkW2)i`?rV=ZrnrM8mM&^Y(Kv*;D!|M^;>on1!KU=Iprjrtqy2_0xbdCh! zlT88Jq(C=|U>2!`Zw7VlOj5D{+)$i|J+3PH3;^G#8++Bj`rUfk7RvGe$;d>o<(DsK zm%lvDk{wg3Ca~nBq0vUnpoCL)x00qmJe3Owc^&CIV*LEML5^>Yajdvg1w4X4Lv|h> z#A4;j+vBV&IgI5ex3_qesQ9NopWNjQ%nmqb)$ z_bTtxD%bF0w~a7}lJ^F%C=oO;#z9wC_bE{-?oBpLf3;z#sQ7e+zf^S2uX@MsDVTNo zCFo*KLk?>e2Qbkl9#Gb{gx?jzTl=||d09cJ?R}inr1Ia!UNiJ863*QV?+8d8Q1A?S zFS7I9{}w1i9VQ|F4_$8p4)yxR535dfD$A*eEIFM>h_Yv_r3l&gb&@P&%^pG}ltS4f zyTQybBaD5igm7$Q#xR)4&WwG{{(nYwe*gD~~7!mIfGMM4H^wE%6G4)va@wFVq}dX2shO=jlV z_CjA#1^MBP^!M-K$EOq!jS+K{*RSc!2|7<@j-<8qBd5X$QxAQ&VfwBs$$KOn3ZPDS zUb@WJ(o!$)AB%c)^*M`M6|^SybiMocKkwhK@g$hnt#8$|wf!p%wsrOzK*5~=@#f?S zm_^=>uBX5MCaGBVUdcP5~U4B#X) z)WMlZ{n9#Mc1bNJJ{5(E=2jGXO+cmX{n8Z%AwWmf#%U0|ig;^3e*EG>;Ho>=CSBw6lg6;Bx^1%BoeMFMkv(HE z`znA38a6cCE`xdV=H9U1{utQICbL8Rm5)18H*yvCXM@1%PjbExjjvaEX*K)poh^W9 znqIw%>OFOBXRte-Ix->}5)uN3=L<{m6Rz*?llM)Dmc9BQi&4@9@?0JNaOq!T=i$lG zQQXytQBuTw^Jm+90^m4eoDR5AZH`)ubKmT7?4!>n%ZM@C8@{vsC+Zfz&_JdzEInlL z`)MBe$GL`8S>E)(qrF4~fNnDlN9Ra?z=jIyC-x}xh`>_c$k|A(4`f%7hKg7xe>_5e z4)qgv^BDt@Dc=^eJbk=+_v*Io63Xm)?acu1-L=A*Zuaq}4epkxTFcVfAX>?@GrA}D zA5+EBWP?c37vx=D*bfIn-%Zv2m^FZS>?FI&-(UP|*bCaD6jD7Du}}whwUFj|upz(r z_823l<)~D;ze{>{PWJ5R8rKh65zC&*w7+nYXx|1jMDP2@mh`=vYVSFFuC5w~M16y6 zuE9z(&8bqGd8wKoE*(r8gKp~2@Eaf-2>|#SJ=+OdrD%e4Lm!B0(uwlCAv<@#A{?A- zYUX$R9MdpeKA30Z6x@+=bQ%*gjM3&96jr>b2MtkxqKq-6JUTa03l{1vGHd3mv6h(a zB>^ZWr#=v8kffn4r0y&8!t))RhPNnXjy-2Adhdf}l6VaY7c_9Y(z68+S2~jP-gCvh zJM-RD!WLw2ZSH}fiR8P)ugy#r@$cTjxOCpjTd!P5x#TA!1J)bx61p|7)n_%T?G<-y zQfZsz&G_kQ4nS3DDxL%^6&&E%5{hk905meaMx^vUI}+j2QsGW9${rFL-Tcki`ly{o zqK!mM(j5}OyUr!=bRDNt!T9L(p8D+(hheV`o^UT9MH$1Sg#f0mdLvy<>cO~fRdwZb zMTf=Od=0OVK#S$*kS-*UAoVeJ5D<=xv5 z!2-l8*1JPWgiz`rqpjVErrj|uR;T8;S6eK1nV@=6Q=G6=aFPMeUB1ugxFD7Vh5}kCO}@2SwEG>&Vn#YjK?p%9F~O=I+o;Sb=YeG@ zNbqR9>+Av)x=_F34t$2YvDMx)xqg&jBN?p*P1sZ~zxvA5HGD_!Wt5v0R2>JFPnokx zvdwS{Z;0+$cMj)+`^SPofx%nOEuzms6pPg~ zDm3CTqLcO56V!?VumC^a{)Hc>z2{rw>Nc6bFi)yq`x0I#SH58A=7!!{U!e7mGh`kE zrX(r;a;a=f4}#&!mprWVth7*U?ygNB>sdDV(@)Q36osOShigs_DTB_n)8EO(hdY1n zZ-z(zVIFvMTU8c1F$+~@`AkF@n7Sosvc}Jf^QP>s||y^nP~P0x3~I@|?(4|~U3B6oQ*AmJYe zToMOdL`&Y4Wv63`6}B12fb38|r~Wl0DF3+>!P4{PjwU~VK+H(hKKVsUn_rg2 zC2>DIa^}!J!xsHg$ zB6H{rueI#u0wYYhc7hYMNP}J&<@9`Bp}MuH)hx^67O>b3en5FgU~Pst*n>Ev95p&h z6`HwKm!6R%;J|J!^%UtifonS23`&X;uWjBbol<;6AoiCA<~NhCw~7YOezUQAn7DVO z_SYP+#$>e7gBFIT<}?yI?bMqJm-D&w8VOO^rgN_&(X~wRfNOV-!+mg_6Qs95uO{NT z*U_R4&3K8^df^`J-_HSetR$6~edq0bvRS#a+lgWHiytq<(*~=3iou#S1b*cu35i}& z;D9M3h%!$yuXx9Kvuox8Nz+SZ1Po~xN%X_t}yaruK*t#@5=zp$s1 zh=ap+MpdRoV>k8yS zJdQSir$B!?A1T?I6{4OVUIb7*1?q*dfkZdZ_XM^7DL7i2iNT3c#?Nn%2&&P5vxv+z z5Qw4m^QxUxsJEZ+9G2a-9t?Mc+laphZ{%0s_FVwHfsfm=_WkpeQwqP3rcZ>C{N;mr z$n0|>-?PxLAlO?aLy@o2Pti9p=o)M~oSGDT1dg_nqs?ePvE zzJLshHK3p-0SeFj2mjX~r@*@CNyr&68s^FA0%Pik?>yWB<)-OfLW($0{-sIH+Yhly*6 zL1@+d)%c-ZMi&?-gRy2UHa7n}JnHnw}p{O@I}dmAdsxbjjyU zb{u*AAqmu*(a{u4-8%YWz2nH4j=&#+uH=&8?zdDb71@~vnNGCGBNa^;-ZOBzBM(H| zjDXqTPYHy71^LZtee2T{C2)Y-RbLSOGv;M)KILkuYdXCRVWy75uwoGF0Rncz^#8Kc zCO_?Tjq}fZ_^{7(zjbH?b2;HmVB@-=cf0X%hocNqq3(6ZoVqI!PiRub+vk}XS|n0C z%qs%m7o~l+7=36xy?5etIMd6Q-`{hhD7h8X7|0Zo$F9QLc!NqubvxjSSV}Sh?vv6XPA2!Y)_|M zZL4b7(w7V%X~L&&Qxi-qJ6|yv&D-CgQu~1R z2L+sy!~6|uSK7U;VYgLPVY|o1t`#tGi7z6FS^)0=g%9A^&1v|zS_?2^=!Tn3xX%$# z0L!77aUfw7vs?8H=iA6xK?yEBsDA_w;eZvYG7ldaP=EMv3P+0mZ^oBD$YQRy_L)?J z+4}Uk5%|Ks8^DVCOfT~CcQUa*w6}L|Z7YJX1H|B0YlP%Q)Yxr zHpgD|LFSs9{IcfApoqV!Zqzsqr(jD=iy+?L--4RkV=O%XUIxjjOjYx$Rg=aa)fZJj zNl4zI&|~d`?H1?XpN|#Y0sW0*p;CeKN8siZKz;#DAW&l=+zEUDRm3k zf^lxUB3Xlg&WynO7n#-Q0lJ0}%2Xbe0h&Won=~r zw;Q*+NYg+?LK?GD&gBTs8MK^3{4}RZ1hY`ZlXk$k1F9Wdt344J?N0^-_CUIBIDn=F zx4tI3`GFj`U`sFXx_3JlNQbR0gzOs-nWzHlo_<~iF&BtP5Rm#T<6%4s0Yh$4|6gWU z*ZQf)M-c^6C>l0xb$cPuWehwF4Vbz%!kYdOKV$pyJc_uc+x&d><;pOyuJCjkX0?y7 zy8fUvk)sb-hQ4JsXDLvfqw=H|u%~>4YQI+9jC}cq2#SxcDD2+4R0=ADjs54wV z@ZG>h#*a2R&39vmhK8jar>_@TmVfni>1dm%_FAv=^pJ8hg?EiSB>(gIGE-@Cb`MS|B|+zrHR|NJ7ry^*IrOAHDFt z#l(!V%Nqi9uoL*>?w=QDwKz&{D&MvX9nFqL78yGS4pOWJYy7Z-<$de*gH9-8XXhlc zG0NwnigZaRSh-=%I9(}tg_lNdVVrfkO%C0qKsVcUA+20_n`ZpIq z_QS%|)>K1d^Kf8S8Yom_rnOJw)dvQ)Rpwa88JM1&aOa)Mp5@IQAov-VzSrcQ!j{xx zfWRoN^8{_w>?1(wLfaSuPut%}oV;erEj_QfK@q7LCKoC=^`cDtKvk@|W@6!=YoKw0 zrjV#0fhq2C0ggt%!G+i68>YfKQWb4WT%;{tH+hJ;l54eeRQT#|t;E7{tbZ z7*dU3nR>BB@%Ky5yH|A+bl(xzGDwwnB`iQ6!<)&97z|kj!A{!%D&LdSYchNMI(OiF zGl0mqwWJe_SWsB196dWaA?inKQra=|&tKtJ2hto)bJbTnQlzBHRPF7RfG(Ckm-L6g zQ9b-1P3VM5irrT=Hn{85C9q#Gw-j*hE?ImTR&iQ?XgQC49eCj8b#8MqJ z|89E0_d6n|7vb&%;!Ks3<^)pYUA~416s?gC9C);M(DvFp8;Pfu=@ z&I;(>1{kuXn4HAr*lz=q?ag~a~5Fm1_2BIU)g9pBAtInwRd} z0tJzO&u+NQ_UloHQ4xHw{_f8punL?eeGZL~@>*w?bQ-@t2iC^sW*BxpusTzD>BJJ& zx+b{+dICt%ZlqUjtz_(rGr^2k+_^9oHYM zaL_mVne6)w_^0+z>iItVw8lIT%euhtV(CH;!*!7Hi0N@qkO4q)Iy85eFL)x>? z@#}Md$)se6zw?;WN@Lr1iy)z-2Yxa|N9nvIVnS9*yEhg!MjqYp?o#lZu4ve-aw(r| z2=X0%@o{T!qu$Cks(16Kd4;HE;Kn@5b{!zYy-wd+I-A8ZGwesPqV^SO_FH0z`2=U_ z7tFcL-2KqTa3*H1QbA|UG%>4L3MS&hPWFZUN#etbL6x9q%F1B3<8QnT=#3)MQuj9< zqoe{>r|FH3jElB2c7xYwM2m)*3wG{c|rO1qK*Z&Negm4OdX^E&&eI zQ)4uC0{O1fpbM>o4j8GThD{=Hg!iaedaf096GK*zvZIc7XRuYc52CToeRn|1XNE^o zk8U((oN_-F%G4>l?`n{rGw;yuPAawz+uXDXlF?2(*C)-W0)AfTs|Xr2=27x3`)mqo zM57Ea{U!HcAfe(FLCWxZS{hh^4w(I@wmKe1iOor8ff4Kg0J%Gp zFeT~Ie_uAOQ?~*1arxn4yBgEb0E*3mwX7>Xsz!6?$?PrYq{!Mvj*gBwS;j@KWg?*~GqQB4K}zd3!fL_v_a`g64XT18vI;LXnq! znAP^i!0(*Ay8EI%JUg~{3vy5&3le?M@Ml}L}3ko)+WLPl`7>G3Aog< zYcsh-G20g&YPURU(_&0WSCQ%_^t|P|ClA6fZ)U4_}UnJwW)Bjm2 zI0+1J_f}c6r4-H|c^ggA2NOLGCOY-^M8{YwNX|6VR6@v`E;NTWQYGS<8F&x-ENnYjq4D}8>*Dr5^iF)rsQac^g%Us-0~}@v zGYdb#jfd%cu<2wmPe2vF@lR%3vk{6<-8FU;ME#Uws$&mQA#=V7iHTuA^nLi6l;=aj z@uZ;%x1f4CP@k+v?XB>OVsVrj2Oaf5HrYveU(qRUD6i?kdO#5Aqis@lP7WboN2e-< z!$k8&f}iBB8Ks-us|RLHFRj*1(c-NSpA7{ zZX*x%_W|p(d8^Sdk#oIGJG&)UHLI!wycfGqH?=e&Yy*zNeeSyIpUwacaD(atF=x)6 z#pmmEb@yWQ;)paN=tGlGcTE6KdU$fZvml_~@cP z(tB+ZIgUum5V6=0Zpbu@m3**sV_=TmT9ON-?+50)HXJ9G6Cm45qdm5&upi$>PJ;&V z43>!C#k7_+SYNnq;LcatT4;u%!NP}#g&GSrFXjkRMQ5ERbT?)n98kr@${WKTub)R< zX){dynkyYJM&WJKYu}EJ849WJjQ;R?ara z_y4)OJTS$t4h>lh=8-SH<~`@ouvMfQeV)sSBIOVs`8x8}Tp;gb-3^5wk4oo((PuD8 z50Wbv+Ai&g&DD#`6T%uy{R!mmD!CsPS&Otw5-y8b1194e?;FaR0ckpa{5+!XM!t?Y z#iQ#Q{pO8!+qY@_^V3GJB0XVWUuKEayBT=j)zXW=$G>cT#Q!qV6V!TlQgQH^kel!0 z;|p$vn(v)>!M?rGex1?oVJ=9D*9|y-75M6mFPPk~@yFiqN9rzwtiFoWXyaE8&lSrN z_ZhBqe&~GbGcaxpWuir5Caz2e`{ax$pH2drY?&YrNHUf)TP)K8z`b$W)G&*ccKa4< zQwr-}{05Yl7{0f~#ed-LQv@>Npv6zG8PkeN zm$<)pf51iheV(AYO;a2n?3*sx1e{sQ?FCnqHZt>)D=Yt01;2Mg7CGeU+X7sbZ(N7# zb@m^xjOi}r0{!2Py0v3gO2Jo};(q>}fk8|9@6raq$zykNH?6n{Z0qa$x4~m+0REh+ zX&`j{LXlM+vU7=M90GbXmlW5>mz9~fh^8nlJRh^TzEF2LDh8P61;t%ztzzvhT`mGJEJstyM#yrRY77_DT|VT=h-}CHcgvpKu5vfM`5tZ`>JaGJBkR1_ zZPP|x@sHXon08#Fb!EW8Q*?{V&m$w;AXa*wH>^%agLvrg<=9vEdn;*gmqhy&Pck(N+5d53BYke*Mv`{hU_xMCG?5a zHCMl$>N@4zBEaW3`{RV?jkL993D?OE8=xEyx-_$_CSXExdNw2&+qJ=Kr5T{Ps&~$$_g&52ij19i)xLAq zW28v<>xq?s#x1uG;zd16_tL~Ht|{%i6j+(-7h*FCabLOIo$x#T$);=6L7jn&g_AU1 zac|QcTlzRsZ8^gA<$R(Kx<(X5ir{{&cuOJee2Lli>);XoV2IK;HAFV-d)b&Se(qxY8%zQ7~dO5ZOxn7++kQx^}tDPmcy+Y-YY^T?2)yZVnKhx~^ogoFiS z?NZ(`AFnKAthY}F9oL+zJ*eJ*Jd2kV6;-?`;g+7Gw6o^JRB!KCWP7e7gS~G)nXG=~ z7_*!ARhfJ5g(7;-_sQ%x`f({hW5X@aT3-bUM5;ks>+U$PZVoQauHvihk=_T&o{zFh z%IEdxTjkYp-D0-mpho`DZRLb06yO7s_?lq&Z}s&3^GKEy_`N{UyiD5~12UtLo=%hF zVpL+j^NXL_w3%yzB|Z(yr!@H0FEz)+4bQ&>io^_-_4nFwxF$_($U?AsZ2JUGq++-* zK0f|WwPOrLjpbNjpIKePzAE`qyJgd5KGhrld|!T;lIO|HtMB3Qu1&L@mGKx`#@ozs zUspm=pw57cyyj1OU#4t{F(%P2#VL*hqdump3gOP=uj>?e{_E>yvYkxHGk#KXC$)U` z#G21t^}Zq*9Yat3CkN5V!HX=TT*9+b-KuZaYhXM*quZudW^!02X?=rJ1zMh|cO#B7 zoObYos9<)3p?_RDB}-Aax*GYy$GA^>3f>f} z-v3mL8D4Uv4x?cb`GR!@)qJgEOVgnnQ=nhw)i3W3DUZu?Po2DSbZ76t-XA>ICqmeN z@}=Fk_ zmfrQCRZ@;IauwaoX+ddi$KU<0SM?{O|H;8VdUp6(CNMC6)9!7@VF!WFwxrr2a^-3d zlww*i92j#qmQj7InGrYaH<@oR5D=?M3t;5PMb~W$N-JK(jr@MsBSPk{rp90=WUi(9B8m$n@zNriyjLxAvPW?N z_UeHw+`W|js=G(S_+$A@;teW><@JbGa<`=$D+|PapG4hfNPHDN9TlC4?Gv$lK-A$b z$|U&ANWt&>fKM0s-|(_$W)|P(D)A*uV+vPi(pZdJr%vH3?ZJjX4dU!Vy@pu8Laz0Is1iYw&oQ!5qvYI^RT+D zt(|V}h+%XqF{XQVhS)Y!23>vp`-@a21E>TJu%j0wXCPwTuxW2^L&ZzH3`^o+gjWT(^UdY5_p)FJ6>|gN|-~v>?00e}xUAh-abVM#kpI zB8&3Yva6t!z_8T)Jv@4b=Mv9v^9uHd@Z0}R2hb1OaZ@1GNKbE|;A5g4Y^A&|YgB!> z#uu-$(UJT3Ao2mv_B~S4e#mrfZcr_j_0K=bzUSN#x_b4^|6}lP|8MXwLjtbq$ocZP z^bPe~5|`R2=K`cz!WX^YBhU@uh`l^4scu#6o5<&1m#{V6xapZxbBT-N=P*2afAZL2 zaMI{s|Ldjq74UyW%)fh~Gi084{u%6(;VY>3E2mCrJ}h$tru^qsrU(pSZ=Q~Ud5fgF zzQ0+O;@0A&%_sHrO?Yrw25X#L!8(x}u!|iHu&zEWaE<{m+Q{QJ2=WVty!qej~zY3#>(onl--mf<{a)KoqpsL zgR;TS^ecDTw=9*cb(NUC2z08qZ5;9a{^!6gA{Qo%1QaKGLW1^NM9$cHNqR#?d?+Tu z?Iqr`)2DsraU!@Z@Fd?48&$TeU~;l;|M}_RHd5q&8B*m-Y-~wRjd@n=wVf$zgCJhZ zKl;yaBb({-`qitR*;EIi%Xw5?lg@WJ=Gf7=Kh=(cSiDG2f(! zA_GIi{x9#OwNy3;`Wrz~q&nw_y%iM8OkD*f@?h8<52Y`cbkmZ5y!h$!Z~bl&%D})0 z>nYJX`Nwni+Gu_lxrG)F)%6^?`QHS$@n7bLk=`Imjj=GaM6$4>2|N{+ypZd^$M#bK(qSQ;)5ttKiYDC_ zTlQc;qp76@Wstv0ckPr>8(%W^IQ#1L_oAz^wyX6Q=(SLeNOEX6QbpCo$hdOC`_3H* zHyzVzIydv{(HSza7JIG6Muvvg@z@RCe+g8d!E0@#-+wKWZj4~*{dDtvET04izU7pn zv4@Api=4yY$t4&s&7#D#r_%Ict?=#rf&14Bc6$9mrlUbSP5z=^Sj}fyrePDW`Rym< zHVpuA-OGbXJMV>gCM8*Q?Jw8ZcbKIW(yj)=OCOoRJ9s&XV|38R1P`I%k@TCEALpIRvv@uI$^Hs?4G68R`n+#qGZfgG8mrUsnlA5d!S^Zk!vt#O3 zu)8B1lF&YZ=i2{)lD2cjKMNWFmITn1^+52r+HKN+4t{?`Wo-Y)7cWwojY@&Sqs99{ zD-8`MQwsav?2JTXGwb9OjgSPzPu2KNgQAE2?Ccx@Hc%&uQ$f`) zXz7sbhfc`GH#r}D_xg32B8!z*09yEh2L8VDYQIN{)RZsX2QJu8s~~r0`|~1;i~n{3 zovhl+f@sF-I37O=3MSz|th)Adwjar6|92eYFLE$C_290WF|oKNzW4#m?(iKTkgIDR zQO*wgg+>Ceh&|P2Iu8-IMwVMZ{jCIr!{O#--))EG9m;2Y19KaXJhdNuhc#|t;f=R@ zpW?le7KwzLGIm=E=%nMp)ZcQgsHtsEw$nT}6GqvKk!MRU-WzL)rp|@bqj?4^5IU4# zk#h!N`L}fB_x8*DHqek3Zn=Ql?)7_qMdlyxb=CifB=HGESh-Kvb9zyLWHt+zfw6Hm zWp5egI=Bq$uhfW9lT#c-x`&ME1&vwk7r{z_=spvdnE688uCe3LtFu*G%a@=A`l*Yi z{4<~GU4l}4(EYK)Zp4@GavGZpp{3?sdsG;}(q60u3JYWXHbm!!>omED7($%V76K;$ zA@xvHtGy=m>&f$#G;4Kzbv?cQjghM$LL8c~1KsLM zaOT8chC|e${O<4N%TPoJ*HJPFzUlEAeV%9Tz){|qlc6eIsL}!opPBzV2a#i*5TLcl z*woab8LQ2$l$FqKqAGobp;Gx~12j0pJ~;URvl*+*^W^lULkgX?oDb8~~`(};zAzo=35sllW=wf%*jh+AP%oe=-g zN^n~P0N#N0nvmXO_DbE=sc>Z~$@)*>-_;+MQQYr-mwGXn=ZxxCNI#UC4^3zC04PEq zJm(nGG@7g+@i;*Gw=IeVD72*4x_8}1=l1gUZX3wpw7L#D^)F`8QzI!&^Edo%U*gDp zdPcNJX?Nr(*sM;2pfmeo0>){SDGoGsDGQ!++Ffd*v`(#+e+w4yjDgJ|6KsNh8G|}f zg$@Dm@>ajNhZJ@Bxv^MLK43rIS$Df$K2`;W0Yv(N4XRK%?K@#%TP;xQ9)SF**n&AV zFZB$|yO$vdz<`-jw>}Cqh~GPCU^Fbnt7WLz$62^g(ssQliwF`$6BH$O-#X}|a?spI zccj!3RtfAELJK-a_q~j>2O1rK~03mkIiX$>G!e+l#iSwv>3_+uE76 zwaOM!_C}}ZfR5w84WN~56o-^*qiVFip?6sy#*Bxg61%lJhtVTO$MG?7+$dP0-2FLz z-^G8oVqmb8K73P?oH@>9iexljK6>@27I4&#-cz~R8|!cX!RD@Z>gg0(nWk^*#Tu>1 z5-uYsbE{p_2Va$N8+@G@TH|$+L+h0LUPOv(c-HDFE7L5+>iuqY`^4xRU196HhOJrb zHODq~Ny8bL2`T=NPx{@+>PaR;9@CZMB4)AN(kc!HMyVHNU5u)bjhFApG2W47tm+&` z`Et>_3^1TUDCgZepe3RzijMN)LbQG0p~f4+2W z3v}AP&JoWy*G|p>#|YB7;zE{~8CM@F_s7sqJf4|T(aF1@?qSbiI_8Ua8?3Jj-b|$k z18@PrK8`QbH#@un7Rglr@`~dNT3olNUhBMe1;}K_df#6l7YEMt)#Y1?Ch@giXY`pP zS?#aw@=`m9`&sDY2+FC za7g`C2+5_g7_(tK2C6s(LVt4sP|Qfq@QX=SC4(-W10qe;E|DG_Mo>|~X4n;yjlmn0 zNFNgGm^dq~Ot4R|3BuH*Ho!V2@Ar+(q~0o!dFIpSA^Q$3TDNiN)`sqWy%iffdoKv? z!Bkfo9-bVKH$pBR?V2c3)Jz8}aspwr>1?Fvj1a#sbe~gPL^ELzS&L_vWGyR14z1pE zgH@dOBr$=tb2RQjnvuU#p=P89iFNKe>zpJj?K*PVG(U?Y0&bdQwIr$n{)rxcb+D!w z6#{&T1wEIr9x91f0ph~1=`%Rzg+~W%AFL_Rx=RHUdh_I!5u9vUNQh~Tig^my(MGmI z{Yz)@fIl_CEo(Vto@gg!%JA=qw-E3FOh4z6fbvr~c2_ZDM=|4r!^y)|SBaDxvWD_A zg`my@5Nn}kG-BA+kelDM4=|TflcXi{ngF8$_nGXlfa#w7g1&U#@=5&rQoGWDTXQ@X zG7(l8;z7m*k8yN!DY+D$D!CuJ!Kcoae$v&vK^tTXMb$NEctMw)*Im0n_53QK-{Y+0 z!|6wB(*%pO8t-1e`i-3MhSN-rvt7ReEyuavVeeDT=CV#!Wr!C8VXjCh+0Ys$)Ww5` zRls*5Gna>NPSj|z85#z$1>Q>t6!8x=?zofcWxQHz2R5sRsEVsCBmCU~tl_fOOWkXdowM2cvofFAR)$5!W%|LzUP z4_*E^a!~7L9`zK~I)^o!ujpjGixi?-7{Y`wR||GdmQveYk(vJ#?06d7xnRI=t;wdS zd1$4Uuk`4$p?aime>|(L!5|01s!*%-qcryQM^sR)6~ZGNcb3QLY|v#jp8+#TB}z!EGYQUst|(e&%1x2cl|L%!(;k(GFRv4?-iRF@c`KX} zQS==r>mk2$=%zy8#=BuRj9BM&#>i+RC*!PzoMnzJ2yg+!xXmJ4=ekN)a$Ni6UmX*OZo} zKx!i)k=40z3!CLkj~4AanNven`+JJZD{wg-W?ar+ZH{#mug^G9@&P|%I;vrxe|D?0 zs~k4vFo>MLcv0_?YD~}c$1y3VSyNEbNDRP4^$cZ5{WSC4r2hgW_9&VAMr`+%!S27u zW|Gn-BIQ$Xz2H*QAs)e#(|7fBtKf&Kf(Y8LIk9z;56kc~T`P$v%=HmO@DD#SdcVU9 zmB>0Jj=xAoi?;gO@sS8p16k>F+|=}0-3Rem97$RqnN`HJReH2lq?wV{<;I2NY|o1P z&mJe1K5}+rQpLCZOd{gPHUFZsTArR_lN32HI`VNSbD>pJi0)%iH3iFYV$Ue@i#qw! zd&ZA_@>nF{pDHI2&BvjM%Wa`;!kEa5S52^djc-Y}2l2A4=uUO;9CG-aA{B+$ISn1p zD`dMX%`k&Pl}KL=J?6o%7Wx9Syd9oPbFZ}Khr@v*k}EXiCi0=-u9sWQ9cBSu|6`B* zr~9!r5Z}2AGuI!nfmb{>mE*^%q}dL_bIYd58Lk6`8)Sb23u(L7sTHXkWZx5tx~EOl z^s=s)Jf65rtJQhQ$R(=*SCxwm+4DM^U{DF-Qj;Y86sfVTrpHcZVzpt6@+hHyUZ z9~1bmh|gSXPx@DXFOe@LxnSS07eK~mmMkEK9NlOG#km`7-O+KuJXaVC%5d>^g5Eb) zXIn<8kVgS9+Fyi^sTYlYz*X)X;t@LeLQ&D7fXd*6@%3f8>w^eEs=P-quW5TAwc@j` zL|ja2eA_EJV2=E8RupO5qT@Umz3XEg6YYzDE{L|x60OoC^exZ@bie=U>n~+|&`;om zZ{;dBoEF2%C}pMzpgajy0y_}>Gx0F9B8W-RIdfBnri8>u;a!qP8*iJ@TzFRbN9i>! zkAe`S!4ds5&Sa`?MLF}G0o1Z#l9gvawO$E)_TT!m%r$u($;gm>nic3{CkV8F+7m^H z@h}6?rHsZy43)K;yL%9fEVqbXyyM>X0=0>BxM3?f{ z&}lg#A!J{0qZ`H#NI$1YZ=c(pOGvsE)Sh$|xA-mxu&A<&KlVCwoN%@P2c^!P(ovCb zN<4k_Q_qeQMEQ;O1IDB#E_5Kgtix(7G4(sy0Cn#JS(2Nj>%X8J^dG5{c8WYXYOi~L5R;@Iq_whE!kL3*-rK51D#-;Tg;(4m4NKZRT6 zA13*%7bE$xuRaQvh8oybS4x(@)>OfLaN>1O%0k}K_@LvO_B;;(I^VRFe95>zxsjkhY#r$A#!e>FsDcBLxX^37=-TcH(jDM6!-Eb0Ai+B|m60xGKnD?_YPr zt_5>Hv=FNP^+**GroQQBu<3^B<6hTDd?=BNf1KLv`wHD=R8x&FEmHZY-D)rK@DiPl zq%3@fiwiYVnm1Dy(r~Sz3v*-5gH!RrV|t=5lc1rwz}hD&B8v8!oiPxwc-U3A zMqAw}-RE-R3eTD;b?^DAE`!+rbknoSQb<@h>h2-_M)HnAUS~3#xVJ2D^vEG~T(gg} z_fEf_-NL54WS-SFYZPao>yPyCEIcy|@-FZy-j5gr)t}7#%ryT#`K_rlw}HdIxcXUz zHd3)R*r$SlT~jCV`rOW-30I23l=0e3#=!LUFNX-t_unMNofjWxxf^(D$K0zQB^430 zHTyy*f9U2>EzO&~y50H&7*3+eF(vR^DK>3H691{nNF8ns8`H~>p4wW)sS5Vk8BkdB zoBe!X`j{(BntrV?cUQmgLLEPvcQ7I1E^vm?R=x29n3}Ei*{de;5?^}g6XW>O?mUu_ zqYXmsX;ZN-lA9&$JZuP3)JlWgIi+a+cW+5NR#DTH#D{XgT%ZR*PmMtu zMb&hBB~9*Oihb0BJBeU)Hs%9}ZQM6*hwQX)`B+z^`JaU~RugP?y%wr;puywLHbHFj zk(?`0n!3s}xA+7q2-vgeUMgEVzxsro-4@_Ba7o)!{~f@dd#<5L;{fjW<;$v|n6^l) zv*haesK*lMf&$&T?RA3%;9xHtVF9Tk*akYyyxQ?uqKNeskT12}uwOuwK8>~O+ncws z4e0~J0xo6e|9VGCM%t-A%govlH?SjTMhe}VyD`&yd?11J!9vizTleqBlSfR#*&z4K zcaK1^L4|Dvv@e^sq6x>OOAAR6rsB6Y9+)LQPlRWhN!8=rk(Idox%{22ZQ~04(OFJ{ ztcGpP4XJ9)c-*L~XaA3GGrolQDy-WWGuEA`dSu&=n0ZKnm6!MIOfmhT@GY^=^TwCV zguE?;R?Hz*7x2|NhjuCDC)xb(Z9b2Mna39DdSr$#<8}A#GEkg0`*vorN{+3(g>4or z+ahUKSR9+OH2A9-ecWl?$(^EBgHjro#Ispdc<5xI+onlwR+65xSLkxviMed;#s#i5 z5BUWI)F6@oOi4?x3y8p;I(4dSbu27JJjmX3pF}`;|LA@eKm<%YJtBITYsd>Y0bfW6 z1dr33P4C8P&Y;iA%F;=w&uf=plN}Y|C$FgE^3AwzVL-EYu*IxswKrAJJ$)Uix8|Bo zP0`k?{Mtw4H|$gMzvM(LG-#p=uK3W%fJM934R$Fqu*({xC-522C)O>|lhdZ1r>lgA zww8MLb3Tp<+>Hgn2}t>aiu#C|#jGQwq`LgR8?(`iV-NP8HuQN!?V4%g0ID-yRLF=m zfaD5_i6PW&IZJ<8%Wm%fHe%7$_EjwCf3d507Lqi+7x9@0v@(+0VM_->erR}f^ z5SK{TnCcHtDRU{}Nwa5BSb58?lOiVDaU0ZOOfzealR^&lEmGz_Qv7eW_U=}31KFmV zB4p<)Qe^aJn6?%1lEx)S6<)AM^ul+)nS{jZweLX^2}74J9)Q~n1!_iUr-HAxh_AND zf1MHk+9Jdq+a#GbpC<-fmcvVv(1$C`#?hu579Gp^^V)k#UqV|$RjW zFGhCmRNKzGdRArsLr;bjX;2Qm=M;0gXPT8UwKv6%d{pBzoXZ7Tt`q^$8*0;3@bH7c za&>?<@uy4OdO2|Q-fZ8!w8Vp!e%TW zUm#S>&5Kst>gTlUb|-1ehL8EwtJJ(!+cWk}V?w6Xfo5gF7b~<-Bjue01~-Ki}nokjcNL2ogHGrpMRqB1kbI8{1ixTylA0&h-5Su8#k3h!>@N zP-P)hyoRtAn@O_J3a|nE(8Ygk2ofqeJmJUkAU*|GGIe6Movs=UUc{%UiAJUDY6+F# z@2!bGCO2_LXgkY>1?&Z2Sq&k=jv8TXH`xsDf@J{QAxD*HleD;5Y7!N<$e6EcUx^p{ zYz=+ucr#57t_nFg8rHH@E0o2^sL+|6cYnIvPWxC>{1oVLl z-J~!y^P5|U1t%LW>=(HbkMwLXPwLLu`h%GcU!Cp(ryhwBe1fZ<-5tZZK z#G+D3m#=r{I>_}En3kjYH<0R%$##7nNNd;|kj>*~s|*F+ zCWe2zE+7bH(S;W6)k%z>j^S#@&Qi#Tm$|*<}~Ij+wsujr|$6x ziy4iJ83Cl^RNub_OzOnkDm)5!L7j`W25S?DsR^Wwzm-VfZP4;WBuUz7NGo*Z3sFf< zW%;-kk1&%Et-ypg*g8weU5I$iIC18E0)K#?Ll`sr(T4={uk?t-(H{^GdhPES-MjaO zPf%d0KykQIke-U{-twlA4JbPc3#}8Lgi7D?er<4wuI6MY_5QORG(z4cz@00K6*Gt^ zCTAkxCa<+~7knl%GI5pq^iC}8kHzJ8yltFeq&W|kr!`y3)sy`<6c;lu>^6^;40b6< z3UmB);AO!uIT?UI2nF;CdWGx`9E3D8GhK*j;pDl;`o zPc&4qqp@R{4A$}xpUwOgY80KJR1{NFcH90s#|%B?Z!Yy;dRTefG;y3o!!9AOO$dIg z0^yk<=&rn+;rAz2^rLp_7W{@!<&8{&S}kPbv`7v~sjIHQy$FIizZQjXZ`v}o!MsTs zmQszFGo+P=KQ!WXCMb}RdnMGDPM_knYd`?V;b`N^1UT8%Th{^l;>P?d*)#kVhE>fiVg@) z4U6aq*&+PaPEv_a9OE> zP=iq12hRS_@X9L(&1WqwPnOWDcQzt8l{du#!h-?GTCS@LrMTIO+mtK2%djQ zuU7X-b@_5eda2W=Wms0D5mF_2r33MXuO^#^TbIs(do)q73Q&*SlNsw5Y2b1 z8I#636QvI}IHan*J-*H%=FFKh_)@I>Q&Z+<;;Tp+0i3{Z4 z|B*2P6|?%5Pii5#a6zm}3S*9kd+uhf^~6M);oeLy$ZeWvI3aO3h!8@{Gt?{eb7u4; zci*d_F^z=}S)FM$)_4k?woz7#8@&~@+*1>q`{qKOPY3qwCGOJ<-#rtt0obd(fY1C` zi&I7%@Nh(Cd=yXr43r+REgij=hAuAKD1&aVgi_y)#{<6>;&mOTYryh^Q=AW=^lSHg zogN1$zh?P^?K&!^KnzX_Aq*9XZF5OkOR8W4-5e{5J+j!NZlnd+KOsEHF&BfEqS71e zjlfSzYU!mRMOaX@j+t5zwU?Ylt5$QiG)WTg{XmVM*8T9h7XcoeK@{qSfq#h2R8*QU z_}j6-HD2r4{goAb>HZtP^PFiTxYp&T>*xM>*q0t22B8X32m5!U@)*%trk(xYwSBzJ zrY22lD4fp5I-W%-{z$tIGUSsP9M|DPC7GTZe_&l2Od2IDQ*d(TDsm8l00FW7QCfCx z90~60=&usatatNf*7_{@5(sj`ctyH-pp_~;Jv~3eDgnSNY*e*O34QeHl{)A3M~nOe zG*7^G#7T(9r@!kd+ytJqo%cNQO{Z0=JkhNJWwDV??W=P*01K4I{o4SS!glQJFD`}Z zA-X>R_7CdmHAh6|7yRDNQ)6BvUTq+Oj_eTCE<4^m4l*t|>JIWMIVdfSSEVphwIoF) zp6+*}%4?so=QNSd4SC!*>N0bZqtYx*Y;qwdh0RL7FeCeb-qXFYS`}nsZugO6&a=+n z%5oL*kC1>q*6WhF6ug9aT%ejTKpJ36zD;*L=wi))nb9~`>YXi_$s@39o@|BCVfH5o z_GAriwG^n8tUO;aRHtT)cGn+HS{}-al(%=hXRvIDFh}>@=Vt%@d4AgsKi^wbqTt2LaAT4eZ|A()yj*7bL!W|G05R?=p z1f)wqx{>Z4>6Y%2P625I0j0YJ7#O-iq&uX$yQS;?hWC5#_uYT)S+izX3uT=-zkT+8 z_OqXTPF&j7aGaqrG)$bzqSHdX~~1P@df z&z}#x!OEs<${MHXC~P+ueNI#duXAVx12>TWeLeQ~T>G$l^%w~L$~L{%YS|Le5zgko z?|~s44zW*X$iTxTApHfe3~F)xr_B$flQqlG1S@G6Zp4I9%DBk?;V!sAKluxyuu(F?_n(jZ9 z9}*(=xYsC}Smr>PTdoVhq`6p=y3&s&(^9_jLAa4{aD75HqE z1t5mF*5yZ~Q;8gzd11em#VlHj-i%US{8I+-Yb6b+))uUiVW{*2Ny^R`R3Zzqu?Crs zB_@p9`2&m1P>4${I@eYwS*}0nAiO(kAAav{Sru=|)UWO7kb6o1t^0geXL%RoTjFFq zI9U3za@!i3luA0B1~&0<&6jk=2pivjV*Cf-xy>6sJ*ts~pM?OeYjNAE?1y*m@NQ8q zn~z#wpYM#8$Ue&4;Y+F|=kenJNYGWq-4j=EzP}{_%G$z3CgINTUjoD29U1?FKufjS zMYCqcVhPh^Ojd@-SGgiq42$~(^!Tg(m$MDJ5%Lu`5`DIOu0PAGvt!Okept&(((Q)j z^00DVG!vfQ6&=Z*o~v1Q>Yx7I@(cp(N8Ka?YAFx@`}P*@PZB<-pl`Lj#M`Z&Jgu^~ z10UziIF4uMB9sgqS8v^mj-}L750K9$DoV3+Og0do{0WBYhVg7(kTPQI_^QY6oKK#d z6~*WFI@QeGz^|YJWLn#VPW$H4K*{+bz3C?EdlCO3^1bH}570hTQXi<4DTRpizT>ZD z1kqH~YJ!!~>Qw0J8gs-y@=Y6iAd!F^_5k5*um&O>fpJp3<{%@NG%j?2}GS53+FKE1PE zjY1J04AQ*|52TRrXkVM4+cTSG;L_I$5GU{b);ji7b!uWEeD;U9DJx^{Ad&X*wB8rdet? zd@GVcb&mLXd7q%n4`cR^)=~41)+H8a2ciDbiHFZZq5mYFVR(Ez^2^POw~2B_^D|w? z%?%4rUu@=#D%q!-gRw_k zq>*+6@ZR%&dz_v^s(06z+fo(x#DV??XnE}2 z+e3;^UREIJCu^EyPQ=NYmT*v~8dIcD_Myz|GzVy>-o{L+vy9njf$EH>S<8UhnAKg@ z3jKVcmNKERoYn#$QYW0|StE zQ`6MtoP>_kJja;V`?tKwP36ndTifjPR+bJ6RCdV+t62ZqE;e@4I?M<-i}Z19VI&Mw z>Fvv`{^098zRjeJdcGsI6Vxd!a>=F8D}V#ymBg?v#HH2tFU%ZQ6YJ2@b?1^>G#VXAUFPn!GilI&Ru}l#DsDxQdHnytn;99M|L-Tf6Z?^?Fs|=Y(}^Mv zKNFdGnZ~)LH6W_Upm`)cTSX(ElHjDW06+R(dSs@FTPan)KGUbL8m>rzt}!XX1$lp+ zpv2sXbibY-6KgJGY`-Q@y-A7VzXNJmEr0`Z$aBdkVo<~zI1eE6DwLf0Vo&)ha4 zgFMwJ(t|qVHHj+JEqK5Jd!`*(=ct)CQ<9O#{PE}VaQ+(+u{zMqZmWmaSrYzRL!^t4-S;FQq3+686)m(-8u{A zlawva?}ZvnDj&40c>ptx-qG)tOPS=H=o$SSLy8k5dm|R3smV=9XL4R%8m}$cE27Or z$JS9u^qkruL%nPH!xJuM^wn}6^7eqetbeA9%as;8wGh)uVHdFqYeK8Ud@Z$|NDcR| zBhj3`iwq^b)M26QWy|)6vVk`%W+3jX}cCm*UkIrLSZSg%jCU&=RBCjRkYuyFpaCb0QYdoqzTE^{=tr^v;r+#m_P~={VSh5Oe{| zpQ9=NADd=Lh@F~AXrr*BJepeIj>3G+k{gJ%j-Tzpsc=GTx=+M)Z0U+#QKXilUD{fq z0Bfh|527F=#;Udch^0$Gy|5)uVN*MKq*pGbY@KLE_gMy%CZ2bWB7F{`vthyQb;sm3C5_QI>D+y@XU8^>8Cp_z5B0x-A>iz~8 zziO?+hgbL?mIuLoQpUwJD)jxf~rL^q~OWTri{N{Mr4wC*Ulx_J}%z1V7R zcZ@ZkH*!J-Kc3vAEvP_mW8A#9fWyzfHuN0(H^;2|%gt74hIq!hvLi;FDol?O!{qNw zocK{hKH`v3m^+w-%YlX- zHu$>5d=2YGpR*ssbo;w3NuJvto~+*<@p{1A)*|sB8+$}^kfdvZ0x~dCey&*KFGZ=Cp@w{<< zHCjW@))0I~d5=eKKN3Nfz=4eQjP}Z11ab2JWRxFsPIK=B`P2P1?}$3`B&i0QGM~Qte@`^6k<(YvX84r#bq!D+z^v zoXzXJxGf^KvMYO>MR!A_MGv1>U!S^2LgSWu!A&P>cthZ44v2RSp#-xkThYlZ-n^)q zY?Uf?5G+KPU+chT;D}152!2AMPaXZ9zMtn_oR@p*002u))wqrJ&1!_~b_HtB|6Vl( z?4BLkfx=F;~fE ziU-d7nsUXVf?MxCY-?jIzse|S?P8Y#drew}0mbU_X5~?wA4I)Ec;67Q>d4S&-(FB< z&?a6maZ!tHI7s1!AmfQ4qQ6D(Utsk=yBS4A#UvQ`gEavnzfCrOG>egG3L7cs$RxM5 zGj5-18;pjAF(}|IQj6-1!`C5goYhz6IGYnz1?b3FnDyn;u_?-sx5HRq`@SsHH&bj; znSp!{JQYr0vouT1ZpS$h+wFeUisL~Y&YNa}i3Gvj(6;3Y<1m$Oa1aQORtYb$2TYz( zD6FB1HLy`Q;um1EPo3qD2lp=n@qUnQk$YMA@~X8%#(!iL6%p;*?7t#;-Jz-|7&*J( zJ}Z4y;|jQcw(-m-H>|w8h#-x|zx+sFepv`&f0LuM2YQ?S{F%tggjv)_JAItJ+fn$L zhXw}2_HLi$-*Erm=hpl`@P^$eDKX&BQ`fFz<{`{%yMCl4WwjkfS{M9+HqIddQ__K; zbt4Qk;#b44T!BdKmxW4V+tINxJuktnM9- z=hAby>THWt)tE9h0vaLP#xZSzer-+eS>RzUBbLo1gQyb9n z0IWM`cyTs-$otwhCsvxhroT1%@WG~sXYt1OVkIbYXtq=EYIH%F_MambKj%3sXT=oJcWNs|7C|=N@{mqZdM9_LM5lC8fUWvQsr?iX*Sck=m9~ z-;U4%!iKV=6mf35D|8*l?VWO;O}D(Olf_%AC}Q5Ymiu;r^k1{3P0htOEp-nBZVqD- zpjM&VRW66=b@j9?Ros8wq&&v|gei&h^BurnvEDk~(8dP4MifcMuHJ}kTn^xZJi6rf zb^s~7G3eAXe`8V#-EW-iCYG0asUQNzuXF$DWy6+KTi=B*399_DJPThoWzw+Iuum?S7Q2sB&D^ zvGJ<0+uq367&%Jo)fYlX$lM82l$?apQ5D}e&sbI9f5s4u+(kZI>Mh@BNsOeC>|2*wDPRje$ zAl6&2*;mgox2CCUM<>e0`D&bjY>w0>2lgl%LXoQ^>qKkY@6BN#26&0`HR!9UJ96k9|ulJPbtgC{TR z*9n+l1Pc?r08uHv-&Gttksti&uy}?t@7d2k^FnDz^`kEyex;%YwT*eR1CH8aY-A$1YZ7QG9Y#c$JBe~l zNU1Qq`wrcZ29;Uea5`63Wx7lhqoo?&;qD%#FJ4o3uCAJNTsXTfGx*-9UtZ3qw>=d) zIY!$DM{#{_31)sc(_hkFyg@J;nTjj*rLK1yH~Gox^pbaWc6fZ+|Hk)N)oTwoJ>|go z-<^zI_dj_SJCSVS<=p`i5asY1c*kBTN*}hVNUl(DKv*FVUOY=srmaMnxkjXCFV(I9R&l|x`gZr$SxN; zlhQvp88Ln0pk#>!ou9pydWAk{rwp9=SAILF`e+T#D6u%NB9bq=%)Y|TBawI|Fmfgt38toWyv9O_=IZJQ$ahzzDk!>mSc7t-47RqB6- zSv$%&jc3s%vZ=>IFO4F7ZF(p`$igNXADXDtZHkqYah0)EkP#t%d1T3@rb$$pVo-X< zp&=plvq4n^G8-A^$e&WLaW*+=e`=P982;9WqaOO@@*3SRDD<84XJ?~NpOA(Gn-I7b zJx-lT!vXeT=60`Z@vGq{pM1yh@yV?Eyy~?SmuSH~o_D$JGm>xG=hN@4r*BAkys$3r z$0kqAx(gxDUs)aDtXAj5#E09RK!+eJ?|UPm8{a#S>`()!kGZ~fO>jg5IVma0#w>nR zOly*Lc=4+kzpc<@jHuh1|KiFQ(tC|*pw&bU)!%jQ*!K3QVG#jzd!YUhc`>U-i;q!xS%dldz(T_aeR< zFVB`gwk@k3WJ%HXv35sIL75JO1olUEA$*rk(*D~MS4vCp#ijrluP(_ls#k7Vxsv`4 zU9%(zf}?WH6+4QgL^?jK7DFdk5)CPM&JcoxB$5b)i19 zYhcLybT9$JyMjT-nuPTHJXvZ7ag)O$Bp3sAib(&_!bh}4WqwS}7Of@|1;e(@(Y=jP zFvb>;dS<*NTVthpf%ve|TGqMdsM%F}=mp9{THuCeSG|wy{236Iq4Jj}KDnqf0DXaz z&+oq0f3n_XD`5?y2IU=hhwyDyl6JDuob`icxzx&ogV>Sf@hz#I6` z790(zmgKu^rdKnCuR+fF@yoh$F+!Ui3>2e7-L!r+@?w4%Kbn4|M^KgUkb$EP1bn<7 z>|*4o?F}A2G*<6&r1&mh{o^N850?D7V9SMPSG&8mjk(1 zJnmKrb7BYu7RCqVu!jqKxRv(;w=BXxfstk5=qB71t^c|UNX@x9b0}=w*cHq1b4(9; z!sWfuRqn!+=bcDAwGfd&^Ps5buieh=aa||JK z$au>$1Lfkj10wzqbykSJKcxHRw8zkyUDhWVvb0!kUIQ{4DMnkof^c-&fS|%h7h*@X zYGI)5N%#PBM^YpSp~wuEGuAL0(=!{~9xteo^4aCkvxd4X&ebgEv=`0uYSF9d%n=4w zOdfu68h;&6_|5{;h@0HOe7G!S%1UIUuaK(g;}0lSsh;$CaKpqRgA|ZrSW=)9R$zW7 zG@=KxSj%_n;P|$N<$gq<#Ic^t#>_M$)kC4~vQc=&Eh{(kZHx4WR5A|T6AdM1tY@HD z`G4{)NfQ$)+uCi9V((9wlzzaGQ^pcj&vu9i^KQ(6Z;}5;(dVei>vx6}djLLxu8!m2 zs?{5qF0)=ahTVbZlf1;MRawz5Pp1CfqUdbn!$ewe%b0!nyzzZJpPr zjxPe8pzCeZy|hqS>wPIh;A~>2T@G_dSqb=^RRIK*yZ}YwNET;S7H?JteNGl{@fxXBSeK6phs23(&YI=VH8vF4 zkwSsNmQWl}4n}A-Ic{*FfkSq{_0PaOyaldDi|2L1q>+PD1-?!1!}4F`eEWky2K4th zDOfd|w^VOJeCqQ2%5-O&33{CNj}s;LfAfBJVK6UI8_~*DfLg?^@@Akj+M+I9)`l+U zi1~_KcP3OUe2Pmi3Ts1}M33T`&g}gr?5!rQD<&=vz)`85jlx7Pj+bgW0|ku<&Ri1Z z&4mE>qMnwNzR@k(X8{%u%W>n zuHv%yp)VlImb3Z*P%CHnX_RmI|p$fmyWk5`|zqH_Eb9yHiQab%oF`VPD_->!JG#0{i8#cxdgR&yDufwd1lt?cMz0nYEZp z*23p?@D+-Tz`U;8RnUNjcSpQx^9y(&Fp(M)GxEYvc`2y>$fR@}x12u)2)H?l1f%Wk zjvs$v%62nwC4RD+w=ZPNlT3pqi;(5lP*7>UO4;XjzkozYgTKPo5qh^uoyHR&u zr$v$)5kP75`Ir#Vf&=jjM7XQJA4o=7szrOKyHZfm^@X_b<68;QZY%#qPkgw7acaMp z3q3b{qJsF02q}pk4+*>td-6E-RJ!Xfd45;!&~zK3F18!oVJd5PdIP((waMZdH>l+h zThm5eR|;m*UY+eI==@@P>WysnJ9;d%xC??I+4WekAu<8yQx>crZn*+MIm(PPO=Wk9 zaeXl_2&7>;m)7g+y5}V^G>$O{>eMe)Y-a@`j>r|Xd@Gr)j*x4m<`mpe(u;Ay$7@Sp1 zef?i2wuL9Xg9A_tm)jGpw;SUQ?PEcsA4(BNdhl|1iQeI-n$>MvH?DCkg31~syRx9{ z06Y>C$4c`Z|CA*k2@q1@T2Fuy?vbN5dZCUXw8{hLi;)m4$Vp<1^vYo2nrzVgL1sY)r=kI)^iDLjAav2UE6kL=#GD+H$Cn0 ztoJsKdcza(m~uT8dcY6(wS;!){(itb)uLemX0ywl8VH9RH(ovtRdjX5UKA_#95AgIc8 z>)=uiSUv9Fx4gO}q#R|Yc8EgmCIG)OdUacx0@%atXpG&=#^oAh@aC$Dk@byJ$<5jz zJ%V#2q1&+rP#(hnBcbNHN9hO#WB=68UoMXm1B~L>Vf(fEfk*BdAz6GBuKl@?idY_x z10$^xz6!wfvS!P4^wVPk><{ALMzgphc=NT)24qyQOGrJw8Rp{-MoRs8fwf+B-lzRsWFd88uVvkVkL~Bv^CfaI5H#6edjehR}1NghBdsLE9QIx5HvP@ zFK0E3ja5f@Qul49s*D?K_Ue;u5kN?yq z#*y-oCaJ#f&ztXg@AtXgvi{WqoRPL9v~XfRu@Hz9dm9CfdQL3hIQ0@94!2a(1(&_$ z$J&q6Yyo5Qy8WKsiQK1dV30xj;{JTn&EmAvOUG56;LY`Xslz0x*Ja=Ze-QrJh}ExO6&neAu9i&hAEMpLrINMwlwR5dGE$F|W`-p#%}k8pbdC z4{FlI=#=Mgr12-UdEHT@`)1&K7&{w1|7R}Ya!#glF7&~U+S7iO$nPmUxoqn4JFS@? zNJ^czYCoqT%41*g&qVJ=Nt#oV+1q{z{^f?H_(tk&=8r);8hgId;tlE1H#DF?cK8YF%P)RUP`nirtbL#bs4=Nx+-!IF+UKY+r=pSdQWJW}yNrH5JuhXtW=IyuTvOJo9{O1c__kymlW%*n9!MLT1m>6)Z*iGsP~_^B)vnJT=r?5J|Y?;yB_LOA1w;E zABq3T(!SH?CQnTlu0Gfhc8ZqL@IMo<8Tg)poFzDr;CLa2?D&^HtuOKdDW4?r$QmKcdFd!z?vPY!gml zRggS3ss$obJpIc*$PNnLAYfCgiijvBF5iuZ|v$&gyi%_s0RM_E&c|>dY)( znK4lOZ8YzAWPP@BUJ-BA=&DctdHV|Ex-%Kz1t&^ik-DD02dYiKZ0gn$vuT-SRb&eY zRi7^}-f$`rl8`tYvJJG3YBX0feY6{tX*0hMPRGs;eA|*|LElu z?aXXcosl9}WTZTRoCecr;M*;UHy$|nptvyk!1yr=DgRFtqKv_rS}0syQ9*i80Xj>|J3p!c@|4*OK-DFzOk5$0_k;Js`DJ{9 zW!@U2!a#&3x*F57hV!z8mu;UltXLtFjb0Icc82sz?-ce)xqy-m8XD%a9k7&z8$ZLN z>qxTAL%KKH1>_*71Esah593n8*RhOpx_Iije1- zN~n{IZX|E+?|!r7w#za%1}2uU4gVSC2UJ_YlW_d<tK8M*!4K+Ot)(7mCL^<>okmN{SWgl2`V)!@;qT|OUTSRE{OGd;qdGGJ$ikP-(C z;{~RO%#B@ILW-+k^YMTub|hHtYGIT4!nT*&?0_FA^%>b`9Qjn%)TG{H#wG0uG5^OJ z;H#Lm-TvPq08P&`NmU?x7#7d|Kw5ei_Se#24PTwH^J?Bs0e0y)aT0b&$_1;Uhy-+E z?p3N6R(XEtb8ZS)#&o!Le+j>>tNAD($Rhx0LIOK7%*zyu!w^5|Z3gPYnEk;tN_@e6$MfR2ysRJ!*q2EX|!5I9W zv_V!IU$K(1)WE24#m0P}$mQ__w{z%8J)XS3l(50as^C-Y0F7ZRF>xh-`uCXe1^ito z@~EhcHXoG;V!q|?3;^p5R6`|p`#%D^kE+^s9%YOj=5sezyL;#Q77Ih}VkBe>V|;8R zc==urP%myU3y@~of2xlbLjt|pI;_#<;^e@O)UVkfpLHR7)z0j5LZO~gg^dLQV8r?I zQ-_Q6+d_uVgVxa~GEH5qW(SQ~W{Jgp?^+P`Z%@<_K)-*BUXHl7eCe7LOlo=PJeWL+ zZ@IJbI%d!pwXvCxJD8svUGXd}EbKV1cd4$y*X^6Wq?6?O+e2cDLr8*I6a3#j8lph) zUwM=>PUB2s=aAm(U#d@IrHF7uKz?NeuBJq%A$v~{WRLU9Bs|;Aj2$lmOyE#F(Rk0+ABnzsaT|Bw@b_x$-QlfjhBW<-GU zHqf&Hg(nC6RK*pR!bP>1?v!p5)Yc+(=lB?V&rvz3VeuMow657RtzTdI=I46bn`bu| z2y6AqXwk2R+}rA)XPTdUpib!{xF9)zoCWFaPml)&*KznECI6#uNqvritMOop_;9sC z8-=;eB0uE__IyJ-$3wGM2Vq#iF;1pwbTVA)YJ?ZgcQ}Mv%1szeKtpe2;9|uq7y1B* z??>(!evSee#scv1AQgG>bh6krl4`1vCj%&n9-K1!sy!Jy^pTRN$EjnoI!D*>v97iX*me&q~Phc2tW|3DUp8vW_|fs zaDNVvr6Ss%eDw|WtlTUiK)2iKj#X(IP)Heh4cXlyC!TL10I@jTi*PDsjRhOd_|o7! zzk0AfzqnXlC*Yjz94*A-Y0JOhlyr3khmKr@OcgOqh2Fq%cD>Y z-S;-;#Y(`lAFDQYEhs;V>oGFzYl|z^09tSie4h22D|@~cF^Zo%2~LAAEgR~_ur?LQPqIXF0~cm4f+7N^d3C)!x3AD)&5e?@_9*I`1B z&5IFTT+XUtUr8@*dLFdhuQ~<*c+q}MGqGIcd%;z^8>M~J+sCZ1V@=w0qsr}jg+8kR z&l~v3a==u&U^XS%A!G3-3@hJci{~7G5 z|MfiP=p>}9$6EPOQHD=~>G+drG@lWX?}-N{zE$=#PP!Esa*I9->LO0}o)d?h8+|m( z%yGgL&T!RP8Mh^QdX1^x|7mSQ5)qMr-AY4{!VglWVt($7sE^5t|6?F@iA2`8_CAF+ zVF=YwK^}C*iofjle))^`GqrI1!h};Vo6{8IwBxJvw?l~Pt31hm5JW7x!G|5||8<~WMY-tb>ap&t-Q0-o~ zC49ML*D2pyjbFV6^n5y84VTLZPf9EES>wJXG||v-sbeF?llxl{AhFg+h)M|@^K%r_ z{ZuDvb=ed%b>`*e<=;1eIY@=& z`j4t{8k6%XkB_f&DQN-eDDHyYK1Is~am%W=>ojyWisaYnkl=oU0(~M7l5Rz3f94fv zeEt>mo%cr;?d78Wt*2NP_Uz@LjrMW(p)XeoiNtdh83ZPS zhBrh+r#eLyO?OBN+^nm{Q7AIt@&Ct7RQ^{QH=^BPuVdtDMktAbiHaJi2C~QVX?wpx zE7*@0_R`3(=?AlYRo86k{&Cta>aMOQYxbhf4G%h(qj4Tm6b2z6kd@FC1A@3m6Mq`N zEI!j04s2uwE%pd1dF%b*n51@6E;W205E*^&230^f*wrlyLTOQH59Y(;6%tNiA9ooj zm>&9D5=MPVWTi6AE5#Zs`RR3LpIGl|Ws`(IQ;#qfLXaA|+zU&%K}1wR^fso}I~;Y; z3lEzqKm#BB{`I)z`6^mJwg_2a*#eOZ4xzo@V(%DaaRF(c=Uz97YzNozETd;*%|hd=J4KFYuG7_ve~10Rq8jV~?l0mQU!2 zod0-=aQ4l^b+o?t+nCmYnt9uB5+agcO%ErS#DZ?EoIdjdHE#(+UkWI)0_^*7&yd&i zhx-BF^2mqFrw^fUP&2^9M&0yzaAT8m30{pfSbjTu`Q+hrk%j5OPLvzxgViphwwwtV zzrKO@bn@x>p;O7j=tkt$u7FS5CgbGM(YJk%&VEh7n17rM@Sd-Cm5xREZ&cD>l@6WP z<$Zom6p|05?pP|`Ni-%!YJC=Il#UM-k<$Ppzid4i$7FPtvO3lEezN|@q)to|x%Fz| zQ-B`?gw&s%ccgOeWVwS@`#6>g(D4z?3)SqEtw7;K>;;JDn|r6ZsAM=;KedaNPwKFB zn#jUx1|khKolpT*10W-tYylaf_>kVm#<`%@ol~E1HIk)~J9;ZfbR2`-kg!Ih=O+%A9ouI}Z#E0{CjImQ+2IH)-DBBvNjP0>#vttxg4<5&`7&jV$cYAvK7C<) zNaUG+1uz5~bd=dDC(-@G+u6`e1k6bJtKH>Ha&3zA6q*TsqXuX}ar-Q^5&f4z+14b} zVeRj#3FBz~HNr7Ogxj9Y`!>!5nOyrrAzu>T^PY#Ghs&CW@Ws2Gmg9ZjJ2S79-=wXb zm_sv0#v`v5JSU&hocs}(_qb`WKZeNK7#|;VH=mZ+r5(+H43emukLre2>deyGfOPiS zBYHJo=vvU{V)w?z!PRF;6jkzVHSD9LQ&!g-AFSkb-{--GWZ2Qhs}(~_`pwtzbUbEt zQ6z$~zQwfYFPStQWiB35V7Q&pOC%pW`B(j$+CvGHpwG{?+_EKs7J;@nVJUo6E5xww z_DlR6!~?{!IRUE=mOhNyJ(`To_BN5&=iW9Q1?N>MW)*tco3mZWC@VO8d}HQebbtT~ z)KTgOiwIM&3duw5hblX4Ga9f{IeZ#EO3g&gcuP5~mYJEW(owtv+L*8mK`B9w8MT63 zz;ZS*hAxdrJqMb?MhO!=Uwk?~%Qb0b)>~UeuQ)MI2ts!_@4`a-Hp*ce4m(gsb?wkN zMDVjf>_Wjr;=l}7^Y6`QaC;P-hvX&1wF)Bw-D;~+EeP}dYpD1i5aeN-v3fwu2La;* zKi%on%)6&Sw;k9oChu_SAlcH2BRb<0HMm&Zf9wn-*&};10QJr|+n{I0<$eZrnUMr2 zn=Z6upBDvZP^6*_1B^fj6oDAjDnDBN)XvT<6cJT&GVy_KLyhr!R8x<0d)ajBEJOLn z>wVrWGR9A8vB|5aX-!R}eg*uWTZhJl<65Ecv5pHr=HB5L_9%OQsVZ5Z=3prUoYUE2 z#10j+KdVw-g>e9ceA;3eb_tudvZf}_01ZVJTgS>ef$<135Go-r;boR--C8fIG`$CI zKe;dIgXf(6DFQUUzSho2LpE-moSQqlwtg>Z?%5V8+46#GrNjzcQG-BUaJhgPssz#M62rSJsJ<6_-+xl-1Zh7&#@`4mja~k z!&L(_8DWuMngV&e3<3zKMzQd-y8)iCW7vh5$C1`oz;lpajAG<_GxI+{9N={8F7y9B zl3c)>f}bI1{|k!VK0N@&5r@@)gqJKQZEi!ljY5xm!j(h%gkG&`KQ;20{%2J`b8(Ej zEspR|K`22~9w5J(8d~B18FX~%C;sKkZkjAH+Y}Nj{MyZNj@hqP{H=L4MzIxx;r&rV$5yfu~}%c z2GPTY7b_W|x2 z<<6`ivUnLlZKwF_uepb?*qZn_J5m5S@S;U`Qs8Y$X)(&(_t=cuuiiDA5b{@hZ$Z>> zpQqic_pmX$VA1gA4PkrUCZ}7c55UkZSuNgj{o!DbtNL7=g`~5feU$0Yjplyq`vsr@?Q;S2+*{ku_t%Zj-f>giJVqh7Eyc_Jua_&tz}+HYgRPsR ze{o=2>_&|zA&uRj`AptS!rUc z9C<(`8#*94T5AIfkjf}~Q@ra=uQ&So8NJ46jv=?jO5JaZhvr;A=jsqPRPD4^t7FD&c& zIZZsyLgmbsT-4iNOCB=>c5*L{OT3*xLXS2v&3@8^c&PERt&z~*Z|ArT9+gHkcOfk>K7!9d1|Dn_!@@ z{X{|SIIB**3oK?aqym zD4KFa(0Yo9a-HIbdge}zI z#k@=;BO%DWa4t?O5*TaT2-g-$9?N=HAn+lzTMk@A*Wn_p7|0KW_mEiw;m? z;D-rC?WY1eEmsn{lggH0ou)>A$VjOFX%W{tCC)cR*Gw}zY?mOIrRAf4*5!KP;B>A8 zTitltDlgD&m2IV#B?wt*+yEt11!AFvyk(=wck`js{n4?KPp|HRd9%kL0Bv*}_rj&r zG@nX#PwC+S5cNo0C@jvRN1h6&KJ>U!>}_&>R6bR#hpFC7+;Bym9q%kE_xD0XQoYx| z_4UC1S5<_6z8^IpC+W>rA4=LSvVfLi8A|;iCx-)oVJlzp^6?%IKY8&h4hI5R8GOi8-}K87qH*!lw3`|;;kWaU8+C-q=}GDVa< z-shJh65O4_hx|7rme_Aov&KsUdh_6?i476vh$F(80b`oq&@&=7q@(gACQziKs3q#E zQjhg^XN?&BJHqt6!<7XFUn@SbI;S4dp#$>6pq-Q@r2|PwAXWkTGoZ~s@HISh{Hlci zQK6s~rsnCe*;_tEvTLO6f_PjkN$+Dgorbzp=IEW|W6FUuDb$PCuWWb{+U}NFD?id}aPXl9 zkru#N@wZ7hIKo}uLMIzsoTCY=<2tVG=En{H4_9vi6;&6u4G#k-4k9R}q##I#A|j1+ z_YB?ANJuv*BMs6$w8$_tC=Ct*iiC7`H%Rw?hUb0X=lTAI+cCAB!BtU@uQ=?LX32=p*>uE*03wEc4OHT4h4||r7PS~xX zc2TJ>xRbk~#9p88t8-qv0ID{H9et=pFXQuGJaCKu&cjx;04c5R{niM1QpKBQZDvd9 zjl1kdwNw+|wgOB5k;*Si$CdLLd@25N{}mv|PgVXlwTJM*&IdR&AjQH1#P^xY8s<3f zU$g5r;DnQL0Zo94g;pr~8Aa>oK$<7Lfg02B$oadr_QK81o6+C5wfkFz=l_M#47dN# zVDJ0uBqy>04KfOIocaR9*qI?xpGAby9(c-7Xg~R1EkG9wUl0E_DR86+0{+E(Q#3Ue zP?SBO)p_*V_l=Fnt9(e-b4*i{sT{GRBT>l46&w*C^OEt_!qYk#*Mo?))kn|%@E~(7 zyTpVT_mw`qlgbNdd=?u}-!i;2?%B)xG_Zh>;XXdARq-%)y>3Ql!9TT>VG1QsJur(A z52Y4t(2y5UF)?LN5nWcT!{1y?vC#F~v8oJFnAnC^CV5A(`)*Dlza0x`z^L#^a}JW>ThC5 zq>zmAHr)pY%iD<01Z(`!O+|_X5uo)~_vt{H$Is zPjMF6CrN$#U9Aef9@y7=#jW$b)W0sU@K*R7hWlkc{t>4#i-s#`8|Zxh+yB7Ocj+#T z|9tt>G#L;`mCh$MRLt!CXo`OS1_dM`u4$sK<1&Fd&B6XkHBV{Q#2OgnGt)71zGO7D zME#GA16R`Wf4j~JRMqF!>wc(|-og_X3;k=_U5;##7Xj@edcB}mFuUpk36Li(+}}*)tDQLzIC!L?ApcKh^EN> zi_2|Do^0>&<@~f#Kmb>Nl4SKGUrkoi3SF97RFC4BBkyL!(d2<^=gP*46zpm0mdaa= zyR4vml5uRfZ5mz4Te$WpqU0ucitx42w?l zYljO;ep~X6m{nWJ2Rx4}ecI~@1-+9Ue<#Qx1YhHZLl?Qn5}0X7J=^Jp#}b$MTcN$@ zrI3}{(9bwGWu<7WHk6HptjUsU$9T!!@Y&wEPXppvusKw)V7=qO7F)~`)KE`i>NnX+ z9yJnS>71)my^O6vKu8R5P@)J?=xqj^5<4($L9n_G%ymgKi``Zr%03SIn}S5J68S{q zv)Lj0BT2}{6!S0SeKK9T#0k2uXONhPN}F_zfsx^oq20rU3+v^V5gogl! zz=s9M$T+yMtl`hT#h5?eA5P6`(QDHfv(KJlE_IC~+n zNj|j+5zAeA_+v1b<^Hb*5cGA5R0TZ?gDXi)U6|59IqTa8(C05_N`Iy@Gim_GKK93) z^o-GnRDTQe_wt(D!?_88RwQ8X4m-}PZx6C5e~9kXSL$Ebe4WdN-Is>pQgz3nZb`Yp zNXIY4mnEMSQ7lwG8x|6rq2M3LaLVo;imn|AF)DT=HLRsFo=FbY@OHQ;RXU;J);Z?Z zA^&o^SE(5On-%og7Sb2gQa#L+sS!A*)FTQ*1-lBmQ7-L^{rk9&vlcOPs>U$F1^a>rOg+E`p>IlZA{hZ^dA-zDQw}T z35ObH{lRCf%N7@n$IJ1^aPh@$bbN7X$XvYp;&h5rd5H1}qu@Y?xNSsUw37dj1AQax zN>_{(zHfWq@A~lN_KcQ^$&HSsPpPhgW^QYP?&TSzBF{7S3c22)WRo=hAh3&Pff-PV z>`e=kF*_hMMMR8d5E{ddEay{0vwWU&ok;N?r#9t`dyV_pn~#pm3RtAi@V_8H?Y7{! z!z@9WQqj1r($vI zO#W?#xqpBScP^sqDgL+$=VraLWh&Wd?1BQUo_O_c?1MHsf*1%caLU?K?9Oo6sqVzC z<2HVCcKP_Om=h9X><1*}@bF~5F)sn?Jvzt+J&n02)`0~48=3e; z5$#u}9R#a|G`sFojGg7YQgAtI*%$$%T<9eqMW*D0aSA5*8Z6?kqT(Cgu_sg&k0DdQ&+-_qt9YAH%FtED{Dha%xI6oBDnsoj^0 zn|bwZy|$iP2INXRI)MYeV|Pfph^G|)mC}hvry8|a%2rhO4k>I&B#$~~NQ_Odn~VZH zhSedXE_SH>W55ZfIHW=cdYQTloeaD7^Vo{Op2|ucluGfy0ZOrl1_Vj-mh@e&z@8cH z8ZBO0^OQR-PH#Fpc6{Ba7F?G#F}D`xi3l$BIec{Si`Jj|dD!kco2BD?3Gsj8iO{<< zr;Cy6E&t%+Vh%hyqFY$3L+kbq8;OUv{jUfX8jWfX6~1oQozq-&T+fRJuXvs;8J)Yk zc?)73$G66#;iqp%=pxWl(-0u<=;K%!z8-jm`D9?^sHB2R9OTpW?v#(kNt7ol`3xec|(Kldt;_7A?{;o%nl&-NO8br}}vAtN?C zechy2&Ww_k^o}m$y*tkyZQe1?S{$Zw!%LoyHMcY5tE4 zsERtDgr0GC+BD$z#{FCOF%b`}R%#K0aKQ zI?eCeEVLXFCuUqc9r&3p2jgwmB}l5ELbd6};LKKym5zC9&t9bdFlroV>$9e9c0qo( zXvWNJ{1}gD^gsda_ury^xa#sg#}mEt?taI#=>5y7X-q%3(&_rl_3ipb_(c2GsL#4> z^8s6ZBPML+2)1XX_{7PL5&ceqK9>3Ix*4C!dr&(P zJV0RbQnG@AU!hLXJ%!rmW$WkL66`eC* z*&q!pPi=YAEiojM&FvKbyv++Y`R!As_%o*%%M_E11k$W&*=!qF7LtISte{;f4lt|g zk{|B`(eDI*$P1$7WlS5>UMjM}YTM!Yo(uGie_n7xNTprvvO^zq-I7^5*-B-urQpmz zj`x$9cU_Q!{Gs4(YaZ=Rj91s*lD$adp-vak?^ua~^?ixbj=5nxT!Lfejh!^+x7vsr z#o9!J1>Y;v6+Gp#NTXTzyKt^Yh<4wS@#JKGBj>&8rsN$Q(YtI-IXIJ6JJ|WH#MXSI ztlfHKDB2x+RwfCo$QPip)t$x+6#`tz!&1+OMG(!4dF<(zMG)hLTbocP*m_W#v~+IC zQtEQ5MyfTO_cKEgD{jz((bYDBxWtM3iF$h*Ls62ppI#`cv!*4z+=!f6QHt8U)nu)a z*S{GmR5Y#>-``!A%1lbZNmuXVw__cp46Yj6ByUdz5y^*+l-%1TcW`&?ML@PEyw6FS zG3cVNTk!J4I$hKsOCelATSwke#ra(L@GBI^;BL(JS&NTW!rBl^KpYm{kxpg0vqfc05*_xYtT72q zWo9t<(6-lIG{GgqEen&i?jgnYWl5dQz}*0l>2CGtt_-tqhzJnlvCbjE8eQ#>YP;1a zU*(dKqXvO0bSw%7XJrw|8CNm^PDp!43h)Fq(_v+0q$ZW*bn46`Dee2!Xtlzts2G-F<&igvUipEudB&AeC8W(zMpR-MPO5b|OA3tCb8xt|9w zl)Jok$0TkL$WJ-etRd{_8VcilYWFAr_d)hKmQ!gcNO{i3B0qM%%SJ$hBfFy@Z+-96 zx|bTnLZzBuYltdJj>SojICw#hXk0?c4+ZiCl-EdlbZA}h9RDIrhM=i{<5Esr(RfM%ci zaQ~|}xC@7A7xXu5?%R%iA)lq9-dUBalZ{VmK|H{mht@}#%{2Mmq@lnZW2RZk^=s8F zdBEmth=Ff&^oakp`2)Me^`n-{;tjE-PY^L474I}K6p+tGGV>S2i!%qpj7*ET%BSOMnjX!MTZC-r z-LDILulO{PS2B$26Rl#n`~p5hcep;Z;>im&`3~|_W^>o#HuT`;8M1~m7Ob=XYZbR> z8w@K9aA+LCAjG|T!bp?eSAzd&0Bi4x!^3Uwi|B^WXHHZ*1NlQ|<$x=p85GOtN2F!s z$9lKQY&sp+`eiw3KN9A*h()`vd0TCWxa(zm=JaTeU&vt!kfW2q{FHfU>i}uj3!#V+ z9M%apWeScWFOUVLld{1Y_>x%!@iKqP?Y<1mwYy9vVQJ7q4sM_IhvEl;pVs(;k+1Wp zy1}rt^X0~jE>vnUU97a68!SSF{_Rh;tR*?R$MFewaHSn`;-wZ&;QTP#pf{yyT?!WF z&8aF1OHKl(hiKg(ho+H^wN_rAr8lj644C!2s$6a9M^ixSO~Q4(Y7T(W&2O0i{8*Uz zxUzRWgOP(_Mh+$4GoB9`gqhObw!}Q%N83kkHvohGU!kXF4mn;!<3rP8w)=8Lua(4K zb#5KZ_^KE;teYUWO{xpJo=FEHbuM(6FR02r)vt8fJgA?GoExyQa*+I_*a<)HpIO-$ zYfIk~K-`Yd0@6mB+0!pjUrl}g=*hz}83r6~817LNRt#9+yX+wfG%v1ve5Z0!lNJig zqL7FCefjf97Ujm!QwpysqnI6s#lLV>A6rBjzGPA4rJ%QtjMr2zL+vne;SITIsM{f< zwH!&aQcDLcWTl@JY|8Kbs?v#-M{2-f$*IC|=+qMMa82Lf_31lG!p+k8UuL|6Y<$Y2Ix<#t z!OD0Iqhgwfa+0xJvX(4b#<6>k48YdRVeKeLmtK~ zADBhYqigZC_4R*rc0zg@&M0WSFAnS-Zn%n@S$?g-a)d%oUJq_YurMKl7!64VfQX4 z(!8kWBQ!?)0V&UD3Aan<0U|cjSP52pZ0#6?YT=oY73i@Gizm-X z-H&)G&z(k13K)CRGkoR9@?Tef-!9oMo`-0?pcHExDt4>PcS-LIa|$GcfiKo5sW&rs z9c>(3Wtzz``H|$e=lKDVCFuHaEV8dT=-$o}ly0I1mT}3N35xX(e!|O=hCO>7Shq7W zkyxR^=9w8;M}g-+25+^F8_acaaNfs+Y9BPn20nl4BjlPBXvRazjAwU%)qF>@t;b?0 z?DnQLGxHtPL4fMCK8#~gGwVeWYd#Un;}DWt_sd4ZcKhT5Dt~{-GjW-Akj*2McNoX# zDYB4><4#%n^+wbUro>|cq#e%sI=r?y@rI(^bx|l?yPmWcM?;xu8Bl6|UIXGNCp}*{ zt5sE;X_H2U?81j7`uGM7^7cgO!s#{U)zqoMC9bkg~+eOFJ<_R%nA(*JL4 zGyiMjZ`45Jz8G|MApS5R3{J0@jO%&y5Co*?M=ykZk_iSNO4Wrr*`{aHeL`|Zb01Tg zbl~|%<7;PQ9%fAj@vKxGlWkwt97wU!(@W<=%?PLvB`w5GduD7QlvLE2QTTG*=NBG6 zgvno6s8Vn^?ZMeqJEM8>QREP4v4y;RTYiQ*xHu49I|SO{yys~CM4V66lg7WM3fT z{4Ig~?wViy$}iQBXDt`n=|PG00h+Dk?&i>u2vZpJ69kXmxR`BkyC1lYP%Yy83z5zW8-&Kbh5R-^GG2c^r^QfGbyGDPdJnGGW!_%Q zH!4l?Xqi;r^v8B~_4Y2r$cTn(8S#H$4%^Le5DlL>+nNdLprr`iwwiLo-zruDwJdhA zuSYI(?)=}J17YFlKTKkxEV$HQ-K?_UaYB*iUi*up7DRc?orsN6`3ZPQ33^1Wr@s9j zC68T+t)KPl?U(zhq_b=FsWsPP1aXI^Jn70IsL+08Vt`F)iD8-Tx40PFeo+_@zHxuL z;bn^q8@9{)8d)gU*Nc;x93N_5;gM(Oskseq8LgknC%S1}9ZGDm#JF&-cA2Pw8*5A2 zDg1Ere+J|y{x}bp%blU-9wD)Ub+=0tQg-LGE=R{Q%57*3R}nSJW6!j1QJbf0wj9EOuII*-E_Ryv!&7@rJus`KQ~2nI*{kC|PgF^X>E0Q5 z+G~NsXF2;ez|Bckg_jrz1%ETT1P=2!;PN589X(V1TkvL${d1{n{5Nfmc^X2(SuEvY z$^SzPtQxQ(O2j5F|J*<->oBavZa`w_wm3^yj&e+CfsqVeQGm-{^yFKCo`EEfNLbGz0x85K>!7!}h(;%vcWcZD< zy^zf7J7UalKY`-a+mGc64~U<2u;Jm|cXwA`W5mK^%*vX-wCK+4Dkoa2@uB^-#o+yC zo8N$I%19-@B{vlrxfICx$i*QmJb^UJrYa!49urxEm?hUMt zGfk`_?x?_&&xAAUi1;2#$rfFe@5cdSx7^~1z`UZ?ISeF;g4^lHsi^O~nxK$8OcuSv zLEvc5`@>6%K7@o`Cn9rC+yYijt|jYSEeL!X?{AD>{aGj*U0cbDN>6p@&VZUM4YKbi zzEKq}0Jm1!q-xX$w#;N~&7DS{ouET0D27bqtT5AC$8*{gZQ1mf@!~Y|5;tD`WRB1; zWPvHl#Ky+v+c#;+`Xyqk#D8k&H_=9N>EFmITREI?lEhW*=rJkNIKNaK^e3FGSSuf1 zw8w>b0HDN8YcFl9G^t?g0s2NfO{;J+h_$5~m2b(MhS;x9F#Cy!baOyUV zkakC|%z85QzS?1z?F2nz**NrzSBo9-mrY{=Q($vpD0YsMabaW)f8y_#kqKwnXmK`l z@NX>665P>E1s5=!yR%@tE#EDde!*0i&Z=pw;pbp_+IG8II;-R_DrX-bC{~RAi;U9P z_Zsz|G-<yrhKY9-hq9rwU4x8dO*ibZOr!&|Ss?p0MHWA4B`YbmV}i=9Z%ZPMZM zxl>s4TP>I{_u4|Xglqb^UYq39hn0jCP24QXA38(iEt-vQW|ba*orv?L(?7uKByQ>H z3{5*1aXFcA{1{sTg%=YQ1N^LNNW~`OCul?t{7hE$AKqBM( zN}Iz+9W$RUw*?({LEHYjehr81dU)?aTtdfSzoij>a}18Im%Jv#XEDG17V{kbXN+6_ z8*AeMBFfLvDWKW2G<>GXpUS&K6P9d4@_xNJeBS9ifJm&7-q9G{VJcWfL9&#P>xqSg zwOI4AR#0+mz1e5*^{I34(}IZcCRqe*df2gN#7Q`1EfDg$Ftl z{*Pd6i<0VjEJ2+V3~N%Kmz?+Mdn(YH_0QC^Lt~3P+3aBko58+9HO(Jy6P7){Nk+C6SBAxXR$6HQR6UE|L6K}v;*7kS9#Z_t ztBQw7wve2ED3~j)W4K2K0CSV6d~&1>kgDye-mZMW!9kIm7rP%7)2 zH|Xerd|#fbm8x-Q%L2-HY;Ui*7f?7cEwh($d!1hga6iP1maU9z zMeAb&KALSPWc2UKxBaL)7Kzm(5e&PX2_j90hUCqsV#GY%)EBMznE9<+^1Ui#!ch8E zUv+C7=jf;XudyfHXBz7pIq1g;TCZjU{}X`SsQv}kj3xH)lgp8D3^%?eIXZAKt7j&e zP10-d$%fWe6X%}dnTHu2d-_PYOeDIGjv%W4ec$E?3J?0mIkLLgwUQUVqyKn0gRDoe zWB>)B$}F1C{=iF>BK&rQ@_)4eg~q6LPI`8(S<;8H#cy}mxalc(?xbvCrLN)GLE8W}uHv#9)2QB3U5k58rY#|6gATuS;# zaPaou64FjTd^IB>VqxFaT5vo9r1k{+#3D9L^#SGV zMe=x6*zhIJG9%C-^_3nO0+dQ>+;m44*N)(CVr2uom-ul5hQQz&0(DrzoJ6YzOKXDoydxh z_~}ikr$Y)ubf>beJ<|J)^n4R(RCT+hS$Lqm^>&fRsxc{P?_~yNiR1{X6vJA1dVTK9 zoNQc^gLdbS4S)3I%KWi=>F#MMS(O(54(^P3TT@vcHa|2eWFLSq!uOxM^7CP43LdS9dRG%g-uDKQ*jH; zH||k8M6fv2yqMa(F(kraM=Khi|bY);l3EeVl$BYYBe2PEJ^QgeEaQN=Lj0n(~Y&HNF&aoo>Gk$G)d;-vWc zhxp5_3Te!38zFsZ%yicZ^!MKDxABPLm@!jmF{c`db@gkM3wf4FU1CDV$+?LMD1axI;G+(^=Ao5kB)S@ml`(3D+PZcjErEk1F;ca)E5>9!Wl9mi;CJ#{#c@3o8iGd%$~ty9+XZu_u2^0Z~8 zcp|Pvwua8(Riz;CVW+t{ZMxwgQ}b6Ne8EJmI&Ie7a!q!rk_2 zkpJ;(!c2bEHjlTK&G2 z461aBxuS?tEacj;3W<+oM=kVZtf|$TIG8lNZ14HDW->!uV_Wk6_R)yru@9*kwDeOT z{znUFpez=paMn5t0O3yz{bmGj2#aJ|>_1onf#Nt>f~wj!9sGxXy@G5pJY-Q!;;^Kw z=qHA%7X|roVW-cO3&(T2DK1zSm7)$%$lE_nv5mw+8BPm*8v0yVCM?QBWBVL`K@z=s zs(HTnGB^m>S*R8##qLq){2dzU+!3Z0{RHtpR3-;x1SWo662)lLjl8Os%V!V2#%1rh zS0l|$bU80Pcf2^ckr`dyUe|MDcv)9{@Z}2IMrqy3% z!hH{B%V6dj$DZ|CVvTg>#g@mHvTbUalbcD-B#%kO{W8X%OvX7vdj^zqC3G{)Q?`w7uschogsJX&_A>-R1fO>;@FR=(Q& zn`3g$<4Vdnky&)*dw!+foy2tyz#NiXs_+O{DzrL+IpUg> zr+}vbjffU+hnw}3^+L5homMloUJ1MqD+tRj5-B(SRi%2Te^MyQ}dMT1#cqFFww7R^cSG%n*R6SJ@~vV zs2dr)Pzm+9@}MT9`eITsw`5y~kjoAz*AB7iO@NG2d1&w8-_5zG9A!~wIT6pMXMpKp z88(h~q>bFNBGk+_iLW(VltM;b3R1FIcSKZI(Q7?)jvHG$k2Te}-2bH@TI?&B%A6qL zUL>n|eb1^{XU6FG)jt2j=H%|?&6R>F8F>~sA&mZFsNTTkpGK*vBl_yScNa z1p}R-W1P>FA|j2YA4?H-^FJe^kq%2tmnqu4=Gw3!xVmxSLN+O$Y;C0ulm#x!I_P^x zMe4-ZIzWr-5Wp6aqUzGhu2*rqjT|pGIesJCq~*aSPi3rO)jakunW)pKCzkg)Y>A4E z$V)Einnf>*?3y_r75Ks{y;*@bQ>WyqpG+Kk0qLA1k?(`z%p3O)b6X$uef91D4`l4@ zOkCP<(fR*SHJG_=`#;&2i_F9-YlDwxKoaLcB=XO&ST^}*slqmKeyz21!@E`y3XokS zjiXhkgcRFwCH_SPTB!bUKYzy*(Hc;aTRSIZT!8ahG%U|8`j8sc)d$ueYpRu!q`ewT z_}pfy=}w2_hzEcHKvl(lgwZxXR%3yyvbtcy4@)G8qychal6NIr=U39?sc>n1m;1Vk)5+Z{{p3_;=d#^GEz40d9|HXX_`qd+u~|y!wgh^zW1UjiK&ReRAb#sntb1qs#%a#{oy|x4ySv{h zn!Fr{F;V|vEHpC74LmMVbdTP+oa4{E`KJQ3d;k^uH~}at9f_ILa;P0MZl_|((b?++ zzY1F`kPG(=fRs+TTck1;Wz+S$C$t}B!#7Bg2<_gm8mZWBO`yc@MRy|6+Qlc6F6NOR zx-B_(+Ydop2CEC>i8n&+m@S3g3-Co4A?W0nZK;{Lr)QG;P1O3|i;K7E|4DP|axWLh zK{J9QGJIu_Ws7i>5HAVl_UN!A>_CZCY+(cvqYKIWCGG zz19A-Ij=1Uz88W|mj)$_ra~?hF{QoYh6e8F9Ir7;S1YJu1Q;tHA=*3Gw!&i5ZA8MKD>nC#snD&3ioBvF**`Y+JRw>R&Uw)vPQW9A& zN7WM?wLPw9Kjmo|Cj)HaY{(@gQ*7_%u&2mV7^-d(>HdR{jtO8ToNmsU4qK3>bB%FQ4PjNdvRdMwrn9YE8N^DXSmLQ)^ z31)j63g-y5H#RWB^YO}zW{QS6ddSBw4sKyMyKldNKih3T5d;0b91qa&8zwqKS3UW? ztv$%L9gC*u3#szgnohmL)td|B&EZEp9?o>1qJbeV@sL> zzRh@9{{QXw{9kEZomrzBZ_Dqbv(>wKmD=yhsp&omo*M-o3eT44&^8?vJU54Xecfu0 zCq1w2AxvYVYVPF~zF5azIO+N>U{imS+T&lLb< zz`I?)od+GYh@AJiNZz{D400jO0C}gcs+{gCvf`7$!Y$JIlcRn=$ zZJ{!!w{z&^`Q-iNw!%LMIQ&i?`g&iNazj|>ClV~irK!Emyl`TrGjzD`V_(5p=FaZG zfS-M>Xw-#S>FWJ2b%uTxN>m^bfwS5LYI}}nveYUxrDiihguTRV6BMz~;3ZA7#ZT$T z(sEu9%o{xAmbq(ZK!uqPUZ&x{h^42df%+2`Ew z@>fE|sIbk{<-@-`XO?!$n&*`)7DJ}W-6Owl5p*Y+>kOT8Jgk5@IUL!--IK&GcIQDw zTNw_Hz+RVtr)-i4CY)_Sh+(2@}tBAxzm{Q_v6)9Z#`h64y}%o6qU?=Jk$hhqQxQvYq-uTxI-PU zMF_i*xvK-rB-M!QtFE{^UNP2wRO5;pmEbUE)J}lf4{P#fi;c9I4Hr87HRn<*_B&;e|(#6Kf$=J3ssYCiY-i*i4#Ha)iLuh(;o7D193Iaj-9cz~@z?>U3Z+fc<*{`Sz z*4H(;do{f{w)WfWx+HH-J9208Eu4vI>NUh`C?}fjNcty@Hsmzo1 ze4BDRGvO^5fj>>r?00N{p!6zYDE`y$Wk1G4)F!S-7Y5Jta$*Bnnjj6jbgb0lGn{=a zgJ3UNyBZgJc|=!qc?8po6G|;bczl~S&eFYM_VrhU@yRa&A<3 zE^HgOAlJt!_kb>x=hmOzSU$azMJ|hS&F$xg3guni6=f(=9>%?=d}i@9z&FKopF$9u zPDiDeaZJ&BOZ-;c*od^ZJReHZ z|1N}xc|R^6j~U&RI{?F1Z#gU0HG4_T{y+s6L}@u5rzcH~?V?yC&MTem=!$GIlQNj* zl5P$sc<$=^6{uv3TKhF01b#mU7$X76*YWb7 zjYNT8%n|IVF2>_B+Fm$=z0q`D#&z;MPg*LG6g{o~4X+R=T2*DMWcw2?jWv6sh#MIe zkYw1++{J^Bb!a+ZvhY_pMErH$UXfd7$^5ThbwII7Yj3nq;GS)F+{dYJuHHT8d^_e< z;)CK?Utrl|1h|O;;3=Yqk`O)NPyqiFm2%_7@WSf)&{|d_6M}Pd2XwTAG`r6RBGQa% z!xXwd%308TseS7ld7vweRR~Q^?fEtRq&cdR8+vW{ra6gExIf%b?RklIm5u*0TIlWO zj8DnY@@B8BL(?0Q8k^e^g}dM7LsohZ|In0i-&9TPeLpZ?JvxT(V@p~mms8Z{iLwyV z8y99=Qwgyb-TPfQmiz{zoCH#0zq5f_F}e@BF^_*Iw5Pf`Q!jEIbQ!P6nG{<`kb?J# zo%Zu?6Ap3@0Q)M4i&(~^Y!(M8e*$|FB-7yKw+w@{x7srY9&2iE$l4vmK5dS%&CDH0 zWA?q$#y#%w{^IfT-RJVJN2hld{6}B9uOBCLzv~WkWv{2G*gMib-{)G?V3VNejwn`K z>xvpaMR75P3+@aI|h) z-*D3bidh!pN?XGgM_zWO@5tT7G1k6e_Af$OxH#ztS!#*9U@vjP23fZg1tA|~`GezG zhodc+`WJWz2%VK^Nqdtm>|d|qdgrLlT1F3y@Yzd@5?FV=*Yw@gY;C=~ZR4>hOC9{# zS5rtU#<(1(&$U^)d@hnKS6AxGX-V~a6%eKHEYk=>Pl+tbg#jS?@=)Qn*P{fHUninL zWe(`p*4sd3YorTY7?JDZOrtfUH#v~8QN`0I`e`P4cQmgU?~E87C^PMNgK zjLXxF%+DJKIeOhNl{rC6 zZ|yC~PZbQM45G(`^zfyq`WUOV-aqJagqu3(%PA&-A0X)M;$%FRHA>czq%5+evZam* zV)8Y7**{*ib7zzCc(>M!K&Y(wwGxZr_km#IbOZm*mm(tq&ym~*nkRR}B z>Tnz0F`@xVKdrImS!D%RqJ@;!6=g-{L8XAm#@sJ65#{YY)%_}V?f!#rWfN#8o&t+# z*~R_M-U+LmyeWmmqaglazeMv#RUX%EJ}ju?Gu2DqJwctW_O>EYi8W?_#Nz~@&P>;| zZ$cZUcC)Cda00kQ_VIUpXhDw4UACi>qoY$wm@tPKeI;vlZ_P_Pm)uxQ^J!gdw0fSHjF`qt@178vyPL;;S1RZ;qG3WNd_s=#CS}9CYKt z+ad$hF-qKHGHjonR#2}$$?V^cl0*smKRmx*(AE?6e|4X1wY=vcO`MO?9%NNjx<@JX zdD*>-U3qAR(z%M)II_1SyV!{R0msXpexr@^;C+3k%yyo^ZMK=v)4P$;1LJ&E3nlzH zZz8TTuKV(_dN_ku;V4DSxfnTmNt%%Gx1r6R-wLR^{fS;`*i2?w7CxCeZRHb&>OTX80 zlrMRSNv|_!VzYsr0*0e1(#yTTy3v13g<4oz?v3?|;DAEVc)g;>=>KqBZof|kNwzP$ zp1kszr|Ih2nb_L85hC`p);D5d31~5?uQlDPV zMrR`Pm2h}bhlNkWH!5-su-ofG!?Qa@Yl`L1l(R>PJk^j*hULk;SHASth=Z|K-md6V z35a?(Zmpf_DI|njgQn+0P%)*$(Iz zViy?ADh~&+K=C2|_f>z{zMXp8t`p6aD;nsb+oaqS<8eO*mH&w=)h|x7;!%vShzW|b z>Y3_kdUq4r8K{5R7?B1)b(rV5**EHp|IaqI1Lxh{<-@>~y%%2CDXOd}#%@2`rd*cD z;ui(&Ooz_hsTf4G!wx^i^KC*vt5K^q_wYMxbLS!(X}Y{i&j9!>Lc^~Qn7}&x)B;9* zb$1gbz%CqbK4jvYr@nfZq~xvSt9q(=v`xTcFl=0`oBU+ZkkE`bIWkPfe5L}y0&m&V z!BROP0>5fz?ISpRm6#`$ANDQYoJ;HuZZ@tEBTmqB9t#1Pr90g<_cRelL1uPtylmJT zk6v`Q%5E$1|IPnXk=?Hd%PD- zL%}viig687Yk+9=8KypF_xA1Fe47GBkTvOg9D36)hk3{S`737Dhy-eguY6xXnNLXHn_YPeb;KkG=5nhK#=e{U>;UCTJ<@N46Z7XgRh{ z^&Iv&lW@d{EDtnsYhY6)MVKLOXcPq%6-P3aTo zqopIQLd|%bp1dIhx)kMHu#4|-eKPMk(e{M#{(UnZKh}xVF=NQ?qWZ#1`n7}J`p+9a zp^8eIGd8M~Y-&Cl_^_2613#4TQzrz`n#!SbzkyrDp$2C|{j3HK3v$TZn&YFf%30?5 zf)Pfmspac_A29NO%$zOHfI)^nS5j2`UJr+CT$9{y5G!U0VTOzCe=w+-3-;^;5TMtP z;-rW_SHGs29LOf_kH5xUsGe&}jJi@7yEEc6L;gz0;Jc}eNiMn8E`XdodZ zrQO9Tv+U}aa)xeFA3swg2O5Ha7lrVuZa>hwJjom?L7)G|K8SlNpRKtX?6i>m`pr}+ zk<|&1zZEFI;8xrBYwwPeW|M}8;oFbYJ+Mr|Zt&z46Jb|Lwk`bU0~|DqIL!~MEF!D(BSM~+@*tRJqf*z?>&HGK-`hiEPg zP3z+U%{&3;%WTOuR&5J6&+A)&EI4WSiI98A&Rq>a#cYK0pr+x`{GT^UqMQ0zLS&>o zDZ4m;*p|tH)x(>mYq;d>rU9sbbmVw`S?=~zHcUAdDAAScPI?sT>~V*X==uVn)HJu$ z(VPcJR)|bUEQiEcU2Z$U5{55k;VJ1uLaAdoxEl~=km zm7c%CrcOCkV_;bkP@{`PR3{oLaAoOscz>!TlcUa`x;87Aym?&`|5y~AF z{NpIGfLTmS`-N-0iF#r@jSI4V5S-K&Zq zU~||GTnh@*3AE<<0kag6*fsDr;mH?|mSd4vtJ@H1_gp)aY%1ZHQq13Z&Bm*WhER1M z6LUVb{--O>ah1Bytjhy<$JEpn-;!r6e~aN0k)K(q|2@J=QcB;6RfYKq|HFP%v458p4E!`kWNOw0wkAMP0*U;Ua-;KV{ z`@Lr^hT#YITK75o?0xO)Tzj8#bA>!JJ)0J$WjfIKF(|j}!Q48eN-1chfe(P0UZiRmMv)z6U_n=Nd zO+!lMdgOgTU(o2r+A4&FR(;|5(b+DG8jU?Ya^Cy?=}vHpk`KQ2@qBC$Vn7P zH|pg~M2|&8p%<4z>`|&U_j_k^^@8A6(?GefK=e7qL18lP%M~@kvGVkymyJvf>AafQ z4lH3yOhv%O?Hk)vHwEl}?^SskciB$T;*V&#mHPbcpOUomM~XfhqCbEB+yaClmYC4J z6(z@${tV!5nX692uB#6c|C3AskZB6^Uya#s%0*pj*D{_S#N<%>@HR^gZ6)Rb!NhR$ zBRnO_5)>CEIpji;;F96xkF)RFHi;pa@_fK4DbX~aVVi>(cZ4q~NuKDbG2Wb44Io{i zYIdI+uYQ}-kcZTSEb91s6l1PoM0`{WQoe7IKm@cnI1mwK*v$AjOHOphkuYrBpM&s; zTimOa)j57AZk@7dRJf`^<2(>51ts6$dB{>1bd zSvH4vKtY?BH+$h6A`ri}o~Se2*qwh^-DiGBfVu^mAMAIvN2j=5WZbyZcAGf%^fL&P zhvC7A0t9m8NOapf{JNoJZ}b@L=BkK|twaj4_nPRG`p5Q>-S&^{>JBW6OD*fSpQFXt z#_e00?m8oL9X}<`*!8YxPS27i@Z(Slrytwh4cSapy(hs*7hunB724;Gdd% zCerQ9u*=_mtkYe*r}mL9B8%;2TqI-SS4SK7G2`|_!V;Ohs=KkgGLD|c~)cGGpoY{w1SHZxSJF0ZcsiQSBq`8s3p<;`g697`4DAZCDODKw`RzA6h_D`JQ+m?7=1A3(_ zTkKfRG}mcasfGScbf6x$v-uJA-7HGh+-D+UE0Q|fUw-2(dD+{MeHR&{0d z`WKdxrsy${#&|(aN!r>-WcYVb_*~HY;kYD+=JS;lZMc{9hG$3$7aGAQOZlfh$rJ_29o3J(kFLR) z6^|X*FXK-gVm&vVgOj4^f54c7%dEkJF7${^5}%LvaBUrXa-zRged_*Q4vFMATAKew z927y==>FScv?5%HzB9j!zlti9p*z20LCun?plfl&eARRV-Rd)zZfAbfaV9NyxVnUs zwTd2v0|6yoWr#Yf@`$d=WaZfB4<&!Ob#lxHfqAZ_ggme zRK1pRW5z4Y9t%CH*~H~G9x}lS+`8B{j-2I0`=CAuHWPYY*z=6)qZMO`1c|nw0^qKI z9B2qtRY#jHQ~C(xrawkyaTC$JymZW&>kv&lF~qM)ya+KE5&%1q$>94q?cb+;LzyX*nIGh>Jo>N z6IGdeI7*ReyL>vfOp^oeTtsYoi%3;(#T~@UEt@)2gsrM?gip8+gohZQR49eAGzH58 zP&IfD9igi!2ZdT_V8q^8>QcIso#1>&IOn2E+eZ%LZ2$M%xCceR^nxWcA0~VP(+%%s z(JYhly5~;Rh{AJrxa-26Zwh({D;D8)lBzPloK7k$>=&}#u8=2Y)ntI$4?KuETh<6+ zd^=TXxHP7NIMZv@)$G%w*iU2~3*8A6va{&Rk=r{#%6`4vdlys)3Rg8oX;rDGKAtC) z@F1p|U5l0h88ppvY5!w=$sMW=S{V6N-=W1r+&y`Yu9i&S`BkPfJ{pXaX5shast!?y z|9;8fmA9Zt zZH2M|1aXz~yUssP<#nTav6Yv1yv1qA;diR;;@G`{x8S^61z@6`UaCFr$5w=#y{XI(m6_!E zHq^ya>S70r+}&9Clt#Iwm6FM~8!b1Jwjd)z0q)7d)+Y-(PQ$&#Q~}<&KRGpkAT8-L zB(+|-aFRt)VX|dOmo4m~(Yd&z4kf#v<;afGBGT#3L()hPU?9B5d=&LgnJ#|wyK$6R z7rYqdfDMEh?+OM*?mDjTI&Q4a&}oEs=gDlt7YouH*6P)E(;$W9ksh@BhT?^j8^rP< z1n_QqO9D|-iSKJh_+Vt9aZOmlDxT^Aw%<`3#apEhf4o6uwaXZ8wb_^+?lm!o4z z8^K00mgEA}3cmQB<}}xmLfohiDh@7ShIx1Wv_~gTj9R}p$a_*6tHo3LiWifyME5>u zujgHYUcDzKN{fd{5oZ_QV3TxB9-i)oYc;kvNuQCTiq?!_WBX&y>q^_xK){^thWpq_ za&k1nVP$G;EC{SFzD>S}=+dh4QbBQWQWs24R(l!l_mnr2Msj>VBzlka>3iABOo1Pr z{j4TPYia`{0lt;}n|@9udzl!8qQb$zJ0D?c=85WDtrLb|%$<5(7S(vJwfcH_dBuBc z(UePW*4Wa<_0A_CmIMV8y!mN{7zW$1jbzb8w0+|Ldv4&&{vM6~4_tiuR2vzRzWm)d zBlJ7fhpMWNZ=N#5Cz5*`tYdbqvQ(I@4X~v;t_$L(c&lvbr5LL!CEqBLFftW5V>n^E zu2LM3$!U)MO5&JKe4NNO0SlbzSdhtlEXNw70XCP5=aQgWeJ5P3bn#nqJdh5xc5q+2 z{7_ajm8_b-YjwXLcT-To`FSCOO#XhkBq|4`r#Qx8yMfkSYpRb3f};^&1aJ`BfM-C% zm7i7kWw`Ymt$b^AIL)j0RYg3xV;coC8muI?^RJ)o6qJ`oFOe6es1Xz}6AgT!*PzbN z)XsXQrqVFUpF)yrjg(RsC{3+LIoXe>{(W!leOQjq0JeA7&j(m)*H#d64%KpCSGeXd zV>s)0nDx}ce9*P4kFqDGV{&NiUNQ4)@H|xMDy>GZcVRmZLrt2t_Q+>Ds_Ayd5Pw#W z8O0#BS3FOpJgMd1;1Jbh#O)e#!FKTNJgniinScmE!)y@)lt;3HicEpGu>Z z2ru`NN@>H~yrAP&`SL+v_LAoPddI>^Wywb?HH;+h+egLNf1H3<(K~etN!dOUGAT>4 ze&y!w%EuyF4==Xbbc;rS@@+ya*$iVGpa@>KiV4Nl71T&Y!E&~uv5C-=S+&n5?qgmVts z$;HSe5#8!j|Hnd}KFw2>as98kn9HJ-7`#x%wWSj%Hh7k2C6f-cv+GL+V$$!rXG1bW zV_D8tLHgHZ>EqEBw=fEH{XFjtEOn;tUkM%%qi{rkjs8PH9F&ek&38z2W;BZ+FUavg zC&{BEzE(+j&(A_CmyLNB@FN!z3 zXwilO9n^pmY3D9b+m_w(U2tbjSZ#pIm1MMfEXEEFbP9nu;5%rhr7&!_FNTNFa+Z4; zqKK-T-d_B(O<<$C%i(*NIG##xM$I=f$@%Dfq@R--*SjC|AK$XtEese4*bp zUpF+)y6ELw-G_|AvcBB&cH>j8l}1rz{hm~F(H3Kq*lA=IZ%LFMbLFU9S%GU15j<>D z7kc#-+#TBCm&kPb?(#8-n^l z@)ZUqI&4;+MqYB0*%OnWITZvTN0qQtLIkhg_dvKtaoMucAW_mwj6ZM2vh+(eXl-rl z!Tj{ZA+|w%<4;-u#MX&v8MU_yrK2{v_ACdXWLD=7^mHE(-D4j*DM@eFG}~52HP!n zX`x=#5k+z9#vh6TrPvDRsf`*d9aWq$7`jUDcsio-NiqT_w@?_4UgOTdgoInk3B;N< zCO$xBX+&{=NY`8;t}%%3DHOb}WT{#v)^-_MG*;WGV4t9|F&Ckjsm|` zmM;2S`cX?w^Q#@zBimsuo^4Xz(;QD%mvjkTm!lO53dYP~Z-2B=SAOBzF0)JWgyzOf z?eUqH8VVuT*snCJ^(c-#S7np1zEioFP0Gk>2SNjg5U>kKJC%%bJ01ct1ZyCa~dGSLHBo;%>d(Rf3k zg~7+yxBWm@yCubxD#t!9XoYDa4ht7Of;yee$yfO6l9XSm!kwG=Gc*{8l>ekNfOcLT zamdP->oeP|W1noBpfyf^(3oDv_a2)xsUkL+uCZv_QJ|J-FtdoVa94Jbj%sf<+8O(r z64x73kJr5+%Orz=Rq#3T_3s+Jlz$+*)=8>k2twhMFSS~%$)+?@&qj-rS;##T1EqW# zNLn!^;yp?*rW4D9ABADj{}_#tOv(1sh^VTD?~OAgtt$I zj3fB8Ah-(alqCJIqzX{-mm`T+s)H%vq?Pygs%e$;Xfnh!L26~&Vo$7g;&N0wOZc_`x|dG$%Qr?m~El5KB{d)k`! znYS97-T35YIk*Us+$d2?rB=l6V8+Cu5zaDLlfkAvfa^^`&EjO%-i>9lul7PQTfK1d z$#*u20`cs7N1y;SYHW<3gx}xBey03B0Rz^HE`qbvCmcRJrAMV>$Rxg;$nZASq|Dll zil)X$LU?YRjl%HV%8zPR!RE8x&c)Wf+65;|$X3UskS0=8YCOLq2)uThUXtltm$tn`(}KWEg` zM75km^OzTUcNY@>8K&9)iHN|1w5xLD;tBZr!Ui#-0=w$FxchWC5&}(FeeZ!?&}dzJ zg$?7H8xfgylv}zP*<2O%qRt#$UzCKl40p>j5ntRAzI+k9^(Zzaqd4@ulnow+Qz0kc zR+*~h_x^Yk{6i) zwy)Gq0VXje2r*K)sLtqicA;Vxz{h zv8UuPi<oi@P+vOL-pF57jt-ufz5Rsxj*1o4YlR_Ym+!3Lv z5Y{GGn2?x9nKuX29@Vi5iMHVRz!R%MZU>_F7C*2q8ib8WYzgbo)iRvS$!|?ExLc8v zz(3XNY%A;6bMG9YzDRv_U=IQIbkF1CwlCe;P7c0#9E$oc09X9!AtQ99ubQ~PTn`>` zgFR@sYveMx!JMvUhF!Sn48*6menA1MSYE_z>85!dpJH6%`PhgBc(qJ&O!H2kgs59V ze<>DDnx~SB=1{lVkf4j!8Yi&~aaLP-4UR1Ic7a|r=J2gLT81J}c5K&_ziDJq)iPz) z{00Ss>duAa)Zn7IK&`6DuN>|6Vd^m^6VhQ#%7w{}b}^IOVJV+XkXGz+LNMM!4v&Vl=jUiYI>MP}=1GK)S8k;oxtMGg%W8U0b_i3_SSBP=eiI1#XRbRE5 zyC4KLP?qnsKgvU9jntJduVv$RvnPpSjSG|UR5!nEx2nM8-f?l7c3z4e zJeHZ1HMOnn%Ul{+I_iH6fb=!zvkyVTTRR>-**~^Pl}N(}q$*co0(gvF$y(G5zTpc@ zmB^%U+*)K=^i;>?=YcoZ*mqxSc8|vsE3sgxB!8FhqKhuFvUf+-QE}@>j!B4^*&!fX z{<_o`J1F04QpW$#y##S^RINDbo@GB)s>vde{p43VT0*m)@XLalM`AU=9mA#!^ETAP zXKOh@BqKH5U}OiRGF&Te{ARl&uj}=_Mh;TPgLkcJ#_MI)DyifSDM}!!nWck$eI{Oa z5CuWFYD#B*uSihD(@6D#%M{p)Xk|pl+3!Fdda7Z`n+`AR5=*C4t(3j|cqi+2;{~Ue zqyrK0b;2lB%c!tFQ;&bL)tycs(|d34CRjBL8;||)Gq9i<3C1>%?0<3_`&OO$&xj-R zPa%u4NybF)??P+TR0nfHg7-gnd$S5}#uE%HO@LeYq&_lU#^NsGLQ;o5`;DW;~}<(Mn$0SnIZRMQrtUb&KG#(*~?u z<<725mzmDvvA|S(xl>A&R;wa=w!NIf1j>6X-k8q9&GbqRJ2w}CuQj_IjldxhN9}e^ z_lgzIu6lz$^;B6hj%xp`)(ut#O7PSX4P*Bi9^1LPV(FnbjFO91F?JUF<`%hV+fLVw zXpMB-u({u6SL)hMolJse>vHIX?i`bqp_CM65H9uoXQlC)H&;kAswiM*H{lyQc!9 z&LOP-A(VUT{mF)*p0%_o*CVW)^ds|E!MzTu+5R6LAQvALtBfKF(J3>&v5Cj(ud@YEC)BHo0i^%<`0bj@B4Ta=@nf{dOZ9 zQ`%b7hdeE`tL)uHNSGVy@R4C|7H`yI2Or}Wsg=!w4amdZ-Cl+TaHVL}xCxV%taq>I z?2$&fU&mqh$Tsv8#R^6)@gwh#<@oTPntPh6M(}u^HixQmz#=M9`>b&^vNE4Mu$7Nk zN#6A}I#;)j=v6{ggzq@4-?c6PivdLvgL28A{WHIWgZPa=#M z7+ixAa<8M9O>R$em=)BpODzCkOnd2Pp2)7uN0&U6G9l^;izXGG04*n=fg=`fICBC< zs`AN(<@-n9K`xedaHNR1p&|7>&0@Xftt1zOFb%K|ybT{gvP~f+rilg}zKd@WpfTau zdX3xtS9gmRm7ScFoTbP1o{i|=HHH1pUg6gH2XbppCdZvrl-@YzOJgO>R3fxl?(qy! ze1pxjDk>+PX5k-ZGu}LE_7!0zEq%;7oqFK8E+1tRBbu(XrlVFaN89NwE|ZHYh>88I zV`u!TYC*l~!5A@~^`Ju5YgKh4V^`t`y#oQKnFWk(A{AL3V-wxQ-psDoY-SM4CU~fj zUiGnHts4905~NnlZ+bFSHdB)>p`OIlR@Dd*;L2afAfI_J&kGl@|8wW z7dilo+7y^L^R!qV{)`6#?;hk(B`Nr0IMni~u&UZ+DD`I$!ay6{ zr%_1Ss_DPtcHpl%f_LUDx%Tm^3DLvz?Y)r-pblcMa#(K7^4Za>VtL+W18)@v3`)-H zP8MPYAJ?Ogs-S2^I%R+pLa`Mv&Un+mkjv$8BMG~eX-sPGDHkPK#l?&}H!0{)E4fxa z(L!`kP_$4ezX0Ld214_r*Cw{SU6A&+kWWQ79968aF3|%k_&^ozc_k{%M$`i4v(o6O zVk44SGa1T3ymeL1VPq%b#O3b4VREKs2Qe%3sc@0eDHKr>>C^>__dipU}Ng0E=z9 zky7BjIFGYRVbM{XV>v|ia}v1l5;7)xmC=chJyZJ<^vnIT9!$D$(t2eI*q;y|pUgGg zhuv+5=ppIG7A*n8G>S#;afDN>ga!2xnS6MW_Ri}Af)sUX=BA@Sg-@Avl@tNif-OL3 zI~OXLAkAIk36;8PK%WU;7VvUcH@mP7;AXs6nJaUVejM;UD9`Vek)01zlhMas9+OZ+ zj@RwBS@BOuajF)pO|!$ZHQO69V_;-}?9QA*u7bN00HPA$`Lpn#@ETcI=Dm28=vSrj z1u>#hC1irbFm&|1Prf#P%J;L{wnj|1J*7MbIV0}U6;rqW;VsHX1y0x(=xR0} z@I0fe4ni%7h4rcWLvU8{=)+fYVnZbyODe1zH|+ixtri|k^y zR0xuz91ol;I*{kabSFfLv#ghB@Cwn@ZYb4E)_qy$+w=Ch%OJf*NZt0yx>`tcv%$sa zk<)yur~%|g`($@+c(mE?I>0S~7yAO`XVgVC*XC9#S zWk|2GROLVscaK)-_@F(&v%bRX)@DVbr(Xnj_${KR&5&H>gjZcw=9?w#UIu zzX^|EovSe|&}VTfMguq_CCLvA%v@?i%Iw__C3&!=y*dwL^Qa(Y#m^n!(|ZBLkxXXv z%ZJ$7e4V;u(1+dVj}4lfB#bk)N-fC&L@X|c?30Nyk?b#PNyc`mY<)|TMjne^%f0Th^w>2A2e0_|s_@+t%K5p5k9Vis{syZa zyYKRM^)q)v+s#}yelrFDsjR;21KezCF)Z-l7>1FP)(h+mpC6&!d}bUMkLr@;`$~%u z#;$DhGt8p9`piz?m!B)GUZktZaTaA|!E(9u9P_L=t?4|gJlhIj3o=zJncqY*A9Qbw zv%Jy{Jay0rc_C6sHR?)AF)Y|!?)fyk%jKUExrWj*AfMK+=Y*;9p%=?PR11Cd_B1%V z9(KsDaFn{xZ6)m(9$8m!-_|j>5%IeNxwJIebuHhx%S)iC8^P!vRt7*xn5=L;)64)B zO+nxI_yahcHgs}z@)&fl5x`wn7bUk0N}}g4Za2j)oTwm1x`^v{@4A6dWO$%ez?meE z*v?i7HoRIkTt2a1YB>#D_sJ74@D<;L3509BV*%Uo(LuMBvbLBpnhlm^YbwHsA#RA_DaAe zl?4nTPek$}-Bf(ak|i}(ZJy6pU#Bw<$%<2E{X(%w=Ce8iZ91`-_dEfBm|fMEar_r6 z9L?K{>};o{falqHg!alBH7E|Q1i~LsJqw| zDc5k!QL%o_H2jYt@uP?AZUkn5%Xvv;Lj_TAC=yR@?fw{}&0J6WG7kIbX* zkC3U!^kck2V|!Y}lUkGo`Y)=uQ!VA7kHMI7{MBd-j{&e*_2L@?4J)PC4V&0Ojc=;q zWlc-Z$u=I#spHvD$<4!-(}vsc)m!y!k;2aY3Lw5x<3%sP$JaUT<0r7`2NS;aI!2D2 zCuN+|7+x)ibvmUklh%L!EZu+pKC<^Cz4T{wk_h{aqV~x2LO7ln627uSSo~d!$KEao zp4@0$KF_6I`n#6%#+vcuWeq78Z;LZb)@TBa{{uD&B+%N(~i%6Cf`MK>sXify5ok*)U9 zX`?Ad7`kVCaXI$aFf_QaWPvw*Sp z%M1QGmwubA__GSV0C&BV%Kd^e;G}L#SM%IieB{I~x{Os%O>kKxp@K-1wa@Y_%} z_0h3VmZbA66(PS=otDf2oisl;Z?K9LG_}knv$HlOgxIRQRr0s9c}Ibsl8@4RfM*u< zPRzK-%dng+EN)Sg(iQ zDPsb+V(#0vAig=_0f*a@U4X3yVx8|*w_jM1ZVg?v-+3JERVe$7@FIBe-qksxWIx;R z8s}zU?j}mQLCN=kK=@+3Eq?K$)9{KYg4&P7-)(dB;85(AU8j0?d)ul`AK0-D7E(S8 zp=BOTnP-eDi56{I$S+Q)3Ou)ik$8&p%Go0Zj)x~jO8Z7F2&7DgI9Yz@7i$-)5CQmR zzTd)IUjR5IKm-={EmeRT&Z+RhHXu1_=GoG-S?kkD#Rz%vW>bsDY3|&8vw@Rk2^`c5A`USbfXbAHsLA>se@K0$A`}W+4g)ChQn^};GPZ*n0oiE>Xc28~` z`a3cnljQ+jJ*L4BjZWV`m}&puTv&<1>*JWAcUr5C!R4q8^u)WxqAm!ib}2W}Hkxc_ z8r)<2)a5)`19$CpUXo4X5rCsut;+K{Z?aPEQm#K^nyv5b?`52Ty;+#@8abMvOe>|M z(t9R#}HM4>_6OC!%Zp**&$Q ztM7brLgzI@(bQuU2_DmT4sxwOLt43oXENKY{UmkH>!aN!SHb01%r2t#r`GEGkUig~ zCty@h_)7bqL{{C#ubvCmLNeKa;)dohb|g5@FvXGjcu5bg_o!IW>t`&BzIK!S@=YAV zbiCBpsLfr7YI=aN<&Xe+iwBKohoY#RmiyH24P>S`g zTEmNFc4SC{$i>y>_;r(P=?T3g7Qd(SftVeVPM60&gz^rEd z6A3l4zJ20qMjycx<7#u5oOp+(dl1><+ zp3<2Y=gwVNP-W|BB@VKK$5^7~v^r@)A-N$`6is?eXAKtjE)Kpp%U`~YoqQUiUcm%! zc4M2-hNlEjt#;oxm#xlJb8H%j%_D*r+VhP}fm)rg>wp{xN2E>`T5qEtf;pBo{%g53 z6Oqlh8?8h(eO~jCevVVKI*jDLz5Kae(htppf{WT4R^oTOd9U$ewWR#G#J9O!O$EdsB>9SN)6!w!1D)$7O$S zH3v+vM?d$z>>W%4MtOd$4`MIO%+lRz&Od}vIY%FE=$jRazR6W%^ZArwN;x)HVC=*3 z3@n#Q`tV@F*{&&RkRqI+5?}E4_d;AY)0hg1-)ex8WQ|5_V$&=cUA+ z>(dlc>?F0E%UrtUu~%#SrNErVEqBswRi{>E1!|yIP^D5HtG|{pjl!iEH$3;4ylT01 zm?hPzE=v_~iFo$o%CCNre`~5HciRV#+V^96x;+D9?!B|MBkeml9A&1uH-8W)mDyOC zA;^ac`hcU)W(X-xxU6#@GBH8wJwCyyg+k!VM_&w6x*^bsKaz#lhgxpIPWd>IIWmPI zMcsLaSg*6^clQh8lQ=1+jkLzhoD@J#*2mK(7%+UBhi@O>w2vAD?bs$SY6?df0xC_3 z*CM!f8lW2D-TM(A^!k2{p&T70l2@sI?v1aoY&N9klvy8_=Tb^r;D~4^V0!7}s-90X zlsbZ6&M#xRTumfti;}W&34#F5+Mw1tCY+eQ8L36|&1JlDFZ#o#swkixOR0|&X1=q4 z&>D+fD#d1xXdBHE4qo1_%UscUQ~>6kgbH6ZG0n`~8vk`?jAVS9whbiDw04Dk`ouly zc)q3CaQ+bUz;=`4C6xW{Id{W30g#*hjk=!;Uw*GZlc*5&Rc0R{xRxDSX#QI1@eICm z1L#94ek}dG)HWR0OA0D)RAK!}2%Jd~DM=SO*k}m%($W23Q)s-WO7Dap9j#h`Q&d(Z zIhaWXITmk~Y;&|MXyZ8SgvpywW;pT{#mMM}9Y=+;fdp~b4UhP_7F1sZ2^KC}yu-9d z!vu~DgsWKL7Sw%*<15^G8y>FP3-}U?UKM)_5iIOGJ)GPGdqZ^sH=EvEjV?ujBqNs* zBZbxiZ^AceEk+9M2wax^E8u3&#%>g8#66Tqd~CePK$MuRhr0`Wq2S`V+V|d656}nz zN~>_w!Nw4bEp`?#he#S;z2|sDZw91)?-IHYK!AQ@QdnPm8@bWPFI>)n7@h6&+tDnX zOqb%#<>y;)G4F98&lRuGs^U;AvTxBZ%a_psGCCWM?6$=7<7#}HCcj}$ZGT2y_z6!A z?=10iO}poWI@Kbxv#F@_ZKmoYe&}*#x8(C@KOQ;&d7_9S4$1w?^q>Ri*enaEe#Yxf zsqSZWoYJzXy*equvuRpND8Jf@htkizDlQkj^u2$?F;c&BcEWhUNG+eNjdK=WjV9h@ zF5yM=mnVO%!@@sOeW0wEmp*PT-J7)A!E-J2L;Fdoy*l+I{jmNZ+5x)v& zYC8Lw51*RY_a;%h^T|5=jEOWeIlfajH0WLGa5thF6#gIYtCOW+k)|uM9hJuJ(q9+B zMYePbB9)2ZZbn~+jRysTD!voj*qQDuj%7}`aVXr(G9jVej7x&$1evi}KvrG1)19Uu(J?~ue^MlI@y^NCtdc~p>fNL?b zJh9K-y`!ajtSgNd-?{HhbWRLgB&DP*&eY7J@^UkD01>{lbkTejaDXtaPD?z?(iY4~ zn2@>C=z#jEm86M@>cr%b9Ii@H4PZn++%pl{*KV}MeIn*DitxtMCb4N6;&-< z)oJz>?s%0ynDmrdER|K4j3v@me%}Xg)zcIl!gGEesHQprVYIhE&q|Yhp1nIAw>S^O z_H(p`0nN8yWfMjp9t^KNVjR>IqAf)+eVx~43!^7dBZyj2OuKk?aO(|V48Mu4a=R&w zdhhzgs5!SnV8=E zmE`1T9phnPqTcLKvLqX^@P6*Xyi2T0!HHk$GApVk8w*(! z{H1O5W?$u9%@uwqi(j{hu}k!g(6(e+1(42p2GyqN-0P4zeqMMmh<>GUiBn~tD9#CH{>+L~d?FVmYWu^kHwZLL zML!rVvp%N(c9KJcr=P^{gv1(ghf_OA(sir%Nx^4wVrL}hr?)q^=r3>mu6BL5#SW-% z799?cP>cf5GZ|b;uhcZ58t@VG0N@Ee>Zczuv3;o|V45B-%{Gx!3UQcAV%*ICwX1UE z(Hc*M8Dz@E7<~-ImDvB#GS0| zg!kQY@O#`Wa3bwxf2Z*@dUmcJ1S(BnVvY~39;`QMi#9XEFW3@dx%}8X)_D~L08J@> zBM_pGSKqE2v`zFH}QE9Rv%{gx$YH{7vMQ2QU!l*4_fTp!X~>&_u-C(q7O z0jOv&_*7AaEl$Aqh@Txgh4sfQ##)SNC-frJ1e>NMp4PF)`q%Wq7R}&2kI%xh^GsTG z$Ak}<;FyjM(7LeR;>9+I*K|%KxqzyKbT%U$8sGq zt@782BM6K=L1??--jj{v;|bT*6bYfaT9$GVZer~RfK;U}*}n61`@=h#q?332Y%1KL znFn6OMwIkI%^<`4#x!2Aa#HVC$qO3w5bFvGWf~Wm?t~=1`N5DSSbY z>tpcM?5RfN}9{ZO~Imt#@42*2xH=rZ%1))A@4*7!inRl;rI`U&;rZ)$Uh zWg`16Dr00cPL|%l^Z1{VMz04y=&(eb_wL=1gHqH!i2<0@G;u?IKx5vhII!b%?mR22 z296Z5uD5=(k45^jSB77STwQ7A)Ltt&JlhGx^qDY1CWQ#tI?voDOpxcY!bqS{i-d>x zeKK2nlCj+HLr-Xhu}?x?hVqYH-QYhZBBEI1$lakNoB;1IX8 zxC3>B+wF=fptsKE8++py1TUdZLmf%i%|7EUk$akdJXQILq*d~{QNE@2aORT0A0w%U z4^pgr#}oag#^$mBkbW2Av`0rL*rBLr|J4Ej`S1gN$Qc+R@*wIGhM@?7(VD@-jn*?Z zr|l(N(4dT@hG2r?2ZKeV2%h-aJJrd@0Qw`<)tXBkHLxrDJjx*GK?~O6C`Wi7oaD~Ri zJ&HTYSYl%*-VK@e@f2?QM<}oX(&!oO1QK`CwSF>+3eKH6=%k~iOLFXb78e+@uJ-{o zVf4sQCv3oTb3x|Nt}vTIt5_alyY95;*-mr%DZx;now514B6QXPpgOLu25+%Oi*%<> zL{(#khAUOOx&J-g911(0JppX#cBnb}PwGiv) z8WgQs;{ZbHv^{_hW3QBzpT-mBG6=h20|i`LdM@6#T(`2HK|47>$`!<0t4Dt7Zz+=L z1)Xe!3^~JyV1YEU{#B^YOoV*eiOjkKk>UcSK<%}$9DA)|Ooe4GL>Xk~Yz34y1x2`q z0H86zMwMdv%QsrEM#uFE`S`E(y*zz^@?zAj0B`>#A0l?uCY9AbFuZI-ybzG~85ce& z&5;QHbBjQ^>p3)CDgzSs-GPGspZfsxW5~EVV*Gnx>46lO+q3@dh(vd&!z6HV>swuO zTayM+P0W88m3s3h6}bEG2>Tzc0tzEO*rZi$e>8eur_Xp;T9`G}#p!yU2S+IA4`@)l-+Zf!BO)uB-NNGKad_>2?HP@jj-mi>m^X^u)-_i%SonH#B2_6 zg+{Y_ay8#QO?EG;EITp9(Y;9ZdQbNaBd)+^lVhVVR22?X5i%DH+mfe)WSf`UU&J;7 z#W%o;;nWcV6)$Va*&X>--K8FBh-XjD`!UK5(xru3M%STeVo?F4)q*`L7)9^c) z`yz`Ymw$pR3`;aN-uv|z2wJ*> zjf}tBcCJ7U#o19hu5(^o!gLKji@D;3^B1M}Op-)8)Xkzf@qyOX7@->CD%R>MPqVF6 zvN(9%P2wbxQQ9xO&?@MId^U|GYM#d((bt}Tln+&q#HksqjiXW6Y|tAT=xegT*<0%( z^!<{%29#$i5QAedE7>@zAhS@k>^L{g;AxQwd02Y-PR?zno3s{{6Hmb}=T3IJ74`v3wcmu&x5*kVTh$y~1euH1gd%2tTa zU`r}77b6*oSNRwB){5WEPwGT7wcO|dWJe=Q{Ayfh-gFhcU#C!@Wwz!OKU#&ETqZ@S zOPYj7HGWCAPz#cu=qoc8dKzw%XF$WpP*n^4vymN^ifsQmeo^@P)5vIQ``^Mec2u2g zwvD8(1UK2ImG2OkDcZVxGGm5UG$0WpVsTumqJ{3B`s_O6$pH%Yh{yg+^C@OQF=n-$ zbJ`8x8(W=?r&qJF=<7KJcs(|AGyZ}&;B)7J+2jAD>pl4#+T}lEH|9b(zbH#HRhISE z$ATfg-VtG74cm`%O*G2@hzSCec^~;&oSSLhUtOqWlytC%AVXh#iceCKx08-5B-Ba1 zJB>r*qKCtQ(gY6)HoIgxEnbluk02;OqQNQZ&A@=`W9 zexHQ!f(jaPGL^0E_Ng#`lN8Y?DlUmtE00>XHs#^85peJ1Ty5KNgYkGuH!wVZY42o8fVhO+(09#T7 zmrA&`VYjh+spCOF0-KBH9;a@Noj#Db0S5S#II+rcgsV}fkWj{O9dH>}wS#;Eac9lf zR$djStt7(#zpNY=BmWjNXoUBQx4LdyEN@uZF`Q_91{+Cbgxau-Za5W02Js2Fnv<8j zJ-SG&E*W&rkEjs*r4wEBC{1^bPF7Tpw1T2;-o?Gr*-uA@QM+0QGvdQeA>e(VFP3kO z)y)Li%>P=!_FG5cx)-~p47?HP_27_)M>`l>GAKva_1rI?0IDHRxo=nGT3P{G*Lt(% zq)MzI*FdbPNd!9P;e*+7P;yJua)xC{7t=dZ?Q^WuToy)4@HFZ&4g(-f&#EsBsyH<4 zG?luHC2}jacGorG-}x{v$Arq5hlDls*R46+wjRi@d5+6JiU2fpmmz~yOmb}%Sj6bo z9#ks0g`3<*rp%o&@s~O^m(oH2|8W3?O2t>5ca;pWT*pm~&)(yDi%{dxk`((Bu=)jx z5yOL2#jJjtabr7qgKhu=J8AZTW-rR(EI`{uiBKs&`H&^|T_1E?FR477_$|rZlHH9c z-T&cJt>p(We#Vk0ipnXv6qLA8uF0db_}!nghS+X#n5t%mNFay!8Pw=jsd}VwNEAOh znpmsI+KG7blsdXRG-xvN+`WK4rMKBskBx_1P+DoFlw9fW*ffqybyZPJrY^9HrRFlL z{vTa$9TjEQwhw~=DrF$jBZ?r(kkX}~bSTZx(lc~73Nom4H;9zP&_g$pL)Xwfba(T+ zhWovr=lTBl_FAx*wOAKi=iX-@$GKUPRAgSu#f2D$M-&JrBmvaA*n_PfZnB0iMoMgi zSgW_qEnF<~>f73uivo;3yL;zfw(~%PZ7Zt(TqL_J-uF85x}-v4vf9n^v?^Sy`~cKi ze;Cr*Zmg9ct~DEhDjbyYH`Z#K5^Gjc+kGAlKbT~2#NDg`XrA!wAQ9@!;pnx(Y*2kx z{B}$F7XpJQ(Fy=>-m!9oA%yM1BZ|+_E``B)Z`?2Sk{G!&+snI_%4eUI6bCIQ08oK} z7e?*ZMT(7LpzMf;hlfK>OS`zfQv44Xa=Ztha_VI~8I#>?ml^mgIWaF>vk|9AlXw#$&R=u&6uBl*?PzHnK06R4gas1k(~1 z?JQM2<)Lyy4x|0nPULJUkvkgz@uv?J6{>+E5YVdRELC)6QvRN0lW)j`4}k49*K6F8 z^SUUKrlV$$eJC!EQ$NR>)Uw?i=~X_(4d}W(kvc$M#GK?j_uz7dD3FJJ6j+mcI%?;~_qL90s=7mv^YW~p^KS3F zAxA8RR{o|xX3_pjoi$=Q>NX7M*XOOfGygs+Eo0tztDAR_kpENNL0Fz>=mYe74IU%2 z(u?G*-#`hRcvP8J-l9}(mz;wI2y{#Awx%+x(7f)pCQ+zI!doORB|H5VS^RE0>JG!O zD^BL?!|F&r6B{hl6zz3|!l8EAaB$ol`#N8V5&-a~q2u(}L`<2%w zGC+HXIM;4XM3Mn3_M9o6y7TFm(bD?|`SY<`=bISXAneX$&odw4{A+b$zZ!GQBqjp7NS#+Y24Ts4ziA?w;%FLSQqd8T>cW!|31J_vad(Y94#TqnT&r|~%T zNE>hF>J1Ij2_GWQDRmPD$cOui^{Azr#?mq(I=aLhn>AN19Znk^+Y_bx7BV_At44XZ z27p-^SV7pj32oPNms*bBt6x~4&y=sN`-eT~f#=aA^PP`OtycwI#t4kPKBS(RR82iVwQj5%s&Q+)AqX5q&Wbteb2J z`_M~m3DkKdcQOx5b;>FPmsJ%PldWBR)|aFuT7EAz_=)lB&t6{^`II}c1Us9g{gVVq zb2`+I=O(2Vc3#FkeHZczSMr9s9`5}rHkh&FlQk0)$Lg(>q{AU2j=esATMZSB$sx<^ zs>P!pF-h6>2g<5LmREL3SNTEaG817LQm_q+omL0tmI&P^N+&tan>_k%&;uqt*>DC; zCAVVF_#Xin80gg9SxAe2Kc~db_DRWhLdw=yqjQ6?AjSHfQ;_Zn_Wtk&2}k=C!UaP-8v5d>uKSw`RMP=#<-D4oGOe zz0>4)(@AFzebs!`?sazJ_1EisV|qUI5#zWJbFS~Gxny}~Lc}TMXIL=GG`T8D%ztQ; za#r<%eMGX?YQfw|9Whqm84BTAYm(p*)j4ik>aZt3tFF>M-)JaJ`po;7YKBXvE188P zX(VysQ7Qr+#g!u&ZM z_i_0Piis?y?VJ0aY>@u|?xnH(w`-z9l;NUDVJXnnRIt*Gm%tLw`(sJ}Gx>z(`I_HC zJXbn*+C)rwoi!n$6NTjmwk}tgQz5tAr;zVS@#K9ISWm)Ni?-PAM zNqa5_?)4+?k~v%7zdZ`G7VTspQF!Hv$1G;nqyUV*=cx!&`)#`zUo`v>5~F^H=b-H4 z&k5ExU-H({VV9$LPuU$s3zTMi|t-VHq>8uG6dux#ud#GG1@P1SS z3tdu|hp%-pUKh!i6jzg8d%-93BIl1-66!{h8pvZ%J{E^EFs($&3Jsn9#Fy|t+49;s zBKn1@+G#P%0T3=>sVofyR`pPld z&(S$ev+HBF(3(uGSFUfaRV*s&<25S=$;H9Zm?A)oTToC?FJM(OxrkMy-0rUXp2}a! z2;jcNl@Xu65)9BySH&!Kut(K3$T7WmYeM;z09C5H^OSr%!eUt`741r_BIzwdNCAzXfrE^e z-#Qm(Hy@y;=*0TD-Uw8~MB$3P7^LSW4}VX6lBb^njpXiulFPj=(cabf)BG}tcVXZ? z7a3Eqd@()igRJGv&8!L$Vd1`hPl8cqrEsO!o)c5GI)eF!$>7VitJUa}DU`^Dz z`C{FLh4AUJ!R3m`1xPAAjxpb3yWy_qh3*BONq0gH^Vwi#lJ?FBpc;FXjvM^Cr*pd7 z>8zKx&q&tiE0&Tmu?oUnZEdBRyT{GbA8wjgkV9~9($k3buO#s62_apBel9&eFL14U z1RE;P{7h9^5Q*`{Y2gGYU>XchW*QQSFPN+ojv+&OQk7AmmTaYVd1?DEh>n7ssV7%= z7LlT;Gq7#NuXl8B41FFGT@S7^{1hy5atrw1o)ZEW9j{4Dcx+ADJ2{nIW1LakRD^d*vuDOlyO6gEkMMU%|eWsk45qe%Gwqa~X68df0( z)Hf&Z`fU8ls0)0$@pUccvjNns6up?dZ^TA=vx-?y+KOCLn+B}`DeElwSdfrR7~4Z- zY)kA{ChC=aGAdP0h9(uO<^P~?!*kaAXk5Y zHV9@`2cTzqP8y$Fx;F=(jn^GeO?X|^aG@UlxOFwBdr4V$dg3L^l8iq?HGR%4a@r?A zU2}HFkA!Asrr~1$=*VuT->5rLpr>N*3E$yq{5Smrk(VM@b|TG7B3DOhg4_=ttPn1B zCoKWY^YhuQiw6MZXF)01B`Gu6BP?Y$#lc;*wn*`V7_H$Bf6kukl_ba(-tJeQ$$|G5{wm!afdLecx$?O`|67_ ze&bgvsOBW=P285^r`2?`M@RxrD(w-G#4q6CZxPG$W|vU3FFIAZB_ z?=hcl%7`q0E}MGhc{gHn-Sn=6FNf+*r%!mU7N>16t6VsF!ILwmBSf`llUuA6R|=Ok zJ-Z5*?Nd*K znf&x3{Z--!SS^*;xY7?26?3>X`^`n3X+rc;a55QxB3EY-aGxgP3o|99oJu^`@Iu3 zO}TA}VS#1!R_D4`Bv+`b^XW1RK?R`$@?gPT(8++v#cR(ilG?Wn#RbcUS%zT>UWhmv>Q%u_~8W*xVr0DUnt@p;i;#Os#w(eYw z&*yn&Ff;opcq;+SHckK5tetG|gHHJEx^~#p{;!wE!Iw?h!8-z1vsad8RRA2QNA*G- zA{lItDRk__XH{NHir%;HD6 ze-whR4h|8Bs=u_?d!(qPJy?)iULO(FnhRws)N9u&?p&N%zO%l}lQuEu#*T3`PP|uu z7@rN&k4EQ{##t7dA}HmQ^5!-F&z!HVHsFgi;BR@nWeA@gY*!N8p1EmGH9CA<DWOR=VaS*q6zltX@V^6cKEk<)BhEJo9n0lF*d!TMB9hg z?nfq}c7rNrR6T!xFcdmCINIHABH0GMO0ZPQ{sxXcirTZpXlwxbJHIYCGs)9?N#sIm zv-0dt3v+%F6W&GMF%JZ1SD*duit6yqM2K6&?G(E4kRNtugV_b=PKFF5pdepa6YxDxRMkz2Jsc%v4k_Dqa`7W^Z?oTgk@+Dpo*0qHS`YS$yZn0j806$=9QCAb zX9JEQ5!!tU1TUI9Hn^9IDBbjre>Of&1AK52k<;GnpfjJXi;y*R3p5JYogD*_omdr` zqrdo!$1@j?h)^O&dm?hrLe+O{@^wM;_^ek2`X>WDLd}O8&tD7YZJnJT=w4Vf?WQ_S zH}|=1LUwH4B?ohO2xsq~{OMmxl}rwP1$?j^S~Bpov{Y$@HLrIvPamK9yU(w&a`0Cs znk0L{my*2TLT*RQ6;|vCWwFBqY1Jeeb$d5d#!uWuHFE_lGx;B@>gM2)vB(1ZEXE-~ zlq}pk>HxKR=(x|HrY+W@JI+Y?EsCwWYwFAOUZ5u3riH5a4y%BC&Ta>Qmg?3v=4lH6 z$xLWal&1Pjf2Mej=?M`>k^V-AIVH!{TxlqD8y*G0#x4jPh@^`wP)T$Kc0uFHqmmHML z-vzpy0&y{WEfo5xJ^sQjBt+u|#IaK<_=3S0W@Nelyt$ z&mp-N$NH^vp)rWyW98$y?%3Onm2qOoRa^3mq9~aGIw2hsbQaDeEr4E2NY)u=gj$yE zvtXrWM$l^GyuTxHe8}TJi*D5wXvxz(uiy@rPAk6s?qkIU?>*rMW*?>+S9-TG0d(kD zbR6V?I!OD1;p zU|HCe{enDYyhPrIhmb&{vmok0pAm8P`cEfM9H3)98$$5C0hpUsQ@?&4_PjlV%?1f< z&2$-9aq#iAV^C`4?kgNsj$2S5+~AK2Oyj1y{qhHMJ3b2>&T2%cQMI}yw{~ZkY-uc^ zl46@D^WOP+D19C-#>W5O!}i7`xAylxmn-qtuUXafU|IMBB)V9>&2$vAG@-r~Yj#5uU$GL5_Wq-$i^tiM&#dbehGv zfEoAkBhFnt(W-R*@na{R3q{>JTZ_M`J!E4wm9Q{(;!lJMo^W7X$=m-K9N)EgyxbH_ z8MQT46%W>gtGR1^Iht~*TcmQrg_jW)nrtNj=BRU}xU;)+m{}%WX~MzY;cB`DNX*dr zI#%kQTNg(&m770<1q3(&jGzfs6iCosuYKFM`I~-Ql~osE(-b|IWuAN+BkrdqJ4mQU;=Mp5w8Qsm zx0bZ-(EjLDs9{{P+mED`&}%zNZNPre3<=dryw?RAI<5Q}V-SIMBNpU^o=60b1zAn- z^F7$sv|2oAp{R4!Awyii)|9_{$q9SB>=JRS4Q@SJg&exN?ID6Gl4EdZLQRq~emT4U ziv?(Lcr1>c3Q?9E&Zw}1uyQB((npheKF4|?3V`PNEAn)BTd7!|h*&v^ob%!bPoaTq z-droiS7vxSGIusj0dp#)3BKiQ)q`}o|DolrZvU*(*+an^o_ErFG1w>rs@`3eLq|Obyc^xBgUDUnnM!weE>aO#wlH(~G;BL+1>#3$X=RqaH(w%Z4Y1_aMNE8{4nnY^4!bE<=@(yO;) z&r9jtn-ywG=HvW0u%ef2$hAc1dxHf2wA~ELoZUD?;U5*y?M7RXeGu zYxpU~5lMCrzP87Z!J&c}d)4~&+s#Anm&!EED-6XjRizwC(%;vJqOu@%xCE_7j8*lv z9FC3~hRbnl(t}F*?X$9}pqjJMLMN{(Kf0pXKtF3iw(594ttH*h5OxAtL(y8dl(%D? z)Rc~o|9KGB{yh}K{TKD#&mNXXH=A4ZI&!XTEU|KhGv-jT(g6`s_Re4iB4E?RrfYii za`;_wnYTstz`n(!vg(!6GKnu?+6yi$C;LxEpU#qVWnfc*w%>>AlT8CX!tI&DXM*Ep z!MR=U!1j!ULF~73a#b>mqjHMroXl;gK#Ptq$%cDnyRD(W#R$Gdt#(2YV}>fQ*5)a) zEg{&Gs{pVo9+`$2j)K{>v9=|ksh+>D8Ds^tZxRX%*;x{*>T56DfY<=&5)#R2IFIvG z$8vT$Tw>C>Z1nkO&Ylp^3pHK7i~d&oK>i;c0dhe2|D-7N)RN^nR)TwC$5XeH&&0<# zXa9u9kr2>L#PE=M$3&8Guc62C79JOcUPO&M#*+MO&`I2%GG$oOY)nrwmX#b*tbAx( zTswKKeKdgq=JVL{64vFekJZ3vXdA+GQl~%Uclx@sZQ41P3nj8ADh7WeTimne99U4P z=zm(h$PJ)v!oX!U>oILDXjT58)a^|?>c`#WBzpQuQXth6^!;~y%=hogFaN_a zZB5-di4`!HxKwq^fez(b#dM3_Z$W1joWNAZ3(^ieG#{(C-HtzC z1}o@+34ELV2O_K8gwVZ_&5@S=_$RoPg%#0cVu_I?hVj| z6VQp7;j4uQMs-1COlKFqiPdtfAO^jm4RLcG#b%m{xaNiILs45pT-hxS3f#=aay$qQ zLytE6`|#3v#yUB$`uU4mBio9=EWBkoK3;jhWI?PEG0VoLMaeE5x`{zFndpaNM}dn#@DI(enwDg3V=W5jM*Zp z+7@x%nYP`I64ev9jNi1YHR3OOpVF}l8%l#o=6`rtj+Idx2l-5>1ZWoKb;bo4h64v6 z2y~KJGsO1Lee0Whx2317$E=P_xr0ynUY_7gRj-C0&a_WT!K>^&{u7|x`k(qDJ?32_ z7uQ8F;*|pLt1Yq{TY{Py^&yDX(E0cMosuN$vwH0d|1zil}Xz2|fnE>}Eh9(g>8fFs&N}*sgtvQfqbs-PQdJb+CWK^I^dn<0o^$*n1+uP zkH!`tdDf_qqCmN+*o9mc%)@VLr?Cy@;XqhaC2)pXKi$YPmBjwZXE{Yz^}^!fWt>3# z!NbVFYj?^F6d291m8CQv4L!kc(YA1XqDHmdeP3hiL7rE-d9ghaC* zPl$w#*gFi0hwKr}Q#1v3_NS=EvxzZfs3HsHR13}_$Z8Y&GIyLu6y%bQmWfbs=MtEQ z4B{1J!{w3ijlfJn-xT|r{j|Zthj(-@*79#yuOkhpfg8F~y(EBt#UTv2ji{b|k87Lg z#$+Zph##w#w=`tIBMh=VxBZ&*ZMHD+u9mhjHs=}*ITyucP5H5mePEgQ|Cru=1|sbr zn65jJT)N#z6dig=%yFML&a_0*H0Fm+Zg zSpt%8zO0N<8+yn@qbrKJN$VPhP#Z|P5;Ivn z(z%8}ga#E@P3t&rPP9k9Rx5YeW5`rUT-;9dyLMJ9Z^@1w8@4SQ*rqF@L&xU&&Ff!B z-y=*Tbh1)%i@|EL_@iTC*7Frmh_n-XrIW~!(4l>mAJ+T#_u2c({%g*}6&iaJ%@Hfi z{j{UXcdEUf8(w|U=ba?4{fsbn%^ zn`@OM`NxDkPPi;Co>JmTEdkh_4fn(v)A}c2x{b*;!072pQKvZTwtd6285^imCpMs zYHn^;23{wKQLLP5=YB0(jsUcO{GX9R-I@Or(A6-BIT5G{%*B72kM^AP`BGKJPZ-QC zFIxGS+h9HiM48t^(Xxnol$*0OJkk*?&G|~blVMpJ%p;&mDMMwF|DhD=&=tCqZ*am( z1T)~Sxb!Ki9wXa6PF-;O(1RCdWAh4p+Vd2 z3PR{jI_3_&k+FGZim-mcH(54a7!4Gt`pNbPF}{IvPAQbziaegPa{+3QE&D>>Wp60E zFU&3rf}F5KDkH{9+#jNq&mWP7)p?5BDY**c$?&%23~`hzdk`6#?rAy3PLRZ zY>^sLPcpk+(t{R(>k7shYnCiBg#w_d-2u>m2##d&h!cY?Xhh$EPp3&8A0 zSjaf{8y_?f`H?VAjAy87=PXr>l-ByT=gyw*+lrUDs1vmCQjdf!MsKbxwvky4xj-;> zqw#F}ng4Xuo^2eBJPKB^1bJQX>XVn+yaAMq$(=wAF^eLA-z7M$lc|;-aaj?^pemnH zjqD~@Ui_>gRa^8xweon>dcJCPr<;htJ;vI%L{rbwQ<5wpkAED5hLuhgKDGyhT}7&{ zioJ=ppES$VL0y#1;C{9jBvyXLc|` ztlw^1(AiuqEYX9-N~g=tv7hlti7WlMb&mseseM&U;92)|3trwBtm#Uv^(asmflyJ~ zjbH7`#W+nJo*XO*PH>SgiWd(fp&5GRf@>V1KL!s%`G@X%7-i?6WO&TEK4nQz!G?Bu z`gwAcP*oDA#Zm5m${}1zUz}P64-cGl#~@At$`mh~GL z{*lYl=xbhD3eV7wWF4%!kD5EKPc-CBR$*%|z(k0I^JP*e8liq{>AQ`A?8ZDu!#$x7#2P^8bAD!#67)K{vT`CFe zXIrPfdGbU`o~xg6tpxw)S(Qe>zkPlC-Q>cPsPKqa)CQwdOAoJ7 zu3d(PZcDvsu+LJ-#~kjnNTjjLj{LA+S)QM}Acd`U{fxs$j{@4Mnpqpy{uc$!5Tr15 zmU0F+LS^)q12p|IS95B_Rz>@vT254%X+T=K83N)t5kRsPSmo|m_hQAedas01iO+8* zw}BUrWLcpJ(6@0{!f=8prAN2Bcl+e_QiW%$O4Aimr0J)A4Ow8RP91=;So;l2;q_U=@sRV1m zd)ik`Z1Km=p!CN*=7~1)DT=-0zmh2ijny2r`WZ7H3s^9jh5;!kpUDfB=RyTFX#GDq z^=AgREm^*yvQ^x|;8TCaT_mn8;fAGs>r1!8&BZxi8Q}Ud+qu6|o3%@(RoF2g@x5uj zJRVK)x5Y|1Gv4GvJggPhxzd`w!&e!8Gm}-4LSouAb%c{s8F7y+j+W)^+iqirY=+92 z+V=>HAFadw>6=k5MOP{>W3ME5?#2 zR55XD9)tSJzsXn2Z`d>|K~8xVX`{uH*(s8x3{RO@n157me5O(}sQXZGYB*nK(5qT{ z7ctuu&+^2C#+x|SJcfvH$@mek{Cv7}>)S>y!ZaFUE2-_{P5L7Xg$PR9wYjXhDK;{} zn*wJwF;A}JpM_z`a(Jjt^tY=0(ylkRrf_O~4b;H-T6bf6%Ia7qzI%E1?zSLrEoErk zdpE&{~tz!T@v+1SxJ_O;R9M5iH`$WegMsY15X?|$^W!4GEE z$wECDl&rm+q2_es4lK&Yr=SMEAAm8l*UoG=l(+h>%>5`#w}ZXxTH;7o(%?rAji+y9 zvwpAvF}K96mX@ifYm`bkEAE@TInG+)xe>KFXs+udQmG(z)7iZ}Cic65e?C!TkKQEoy3W~~C( zIc1uuTAfTkry)UUVVl_>B|6B{=Ey>$llzyuX_%QWnBKSS>gw6uvM$vko9v0;ByuXg zEX>1(D4mB?6;Jg7numw7->)j08XzE`pQIXUAT8OZi{(<}>(#a141@2Z0KMOM4C8Y* z8o%@;ZK7*3f=ic8c0rp=^hs+>2A^b0{m1Agq49_N^fQemJcj35=*JsF<@;QcBK_F{kQ7Up%>k>%|X?> zda4j#`39d=`@)>qIz>X#rD_h%J$52ezBW-14@cbDhHa zqv!RQf|7yFcfo@kRLaj@^#7i!z||EoI7xqAP~19rzUfvqoP{&M=ZDUtuL!ky8GSDU z@?E^qQw9l3Qw96Ij4b11fGovI&nUV5j`haUvi3Z_k3F%xm(Hc zst7eJ|F1Mbg)#^h>1eilQcw@DA8hwGtE{y=ast|H1GQ`0M2%^`)c6H2`|G65pVW`` zZbPQ554njHekSh~cFv^1*Bsf$xwJB2gz`TvcZZQTChv;%OBGg4tKigOPXl(@zX6&) z|NJN^K_M*w=K00NoytO!zQ0LyycVplS%&GYzlUFOj|y?ZRbuVfF`rm?%ODmiDYri{ zoNS_L$%}x=A|v8H!gTQb3rTNA4Oj3X$G$+$EIj>v8Asa=k#gy!j&qRkmLYiS&o_<3 z>*_rHYZQJ*Ekcg_x2P%ituzKUAsu+c1{%RT?l)S0#N&+c_L0=H!|fYG4)rtvCdRwq zaKLZNo@yl%#B}*aoGA&lvc+%{f;pA1DGr8+ja4TpaK9a;+6p*R^XVOGUnlfDL?3r$i{_e3jYAQc0ba8VX4r z+fK7ZP$F1gpGh1AW~t0i2LcrsQwuj}|Gb0&uEGW(aNGj@MsH;hu%PXv7H{%AOi&>U zr&pP)fD5C0qwPmVmkPalmzt<*kFzz}flII4{jI}q< zfV=Ui_w4Kvcx}R}w)nWLkmywE?g0}X{Bo@W>vFEeHhay`moiEkf+GOi`5ub zhKjQE6KkRc1wP^R7+4Z#&|@LVy0uPeZL^Qa!#bRPV>di4#iX0J2GOxxMy4mxGaq0> z&_E;U@$M%->7<*?oS~WNIX=cWn9Jmea%VeBTAf(aV^|~B20kMof_hwk%bcrN-e=kW z&cUrqKSgTQ4QX?hV~|ie=P-nZs%!Qe_yPA+5G{{uUB+g5>ARd-RRnSNdGss>B~|Kh zd!qP78cK5thPJHeo$b^LqnK_Q912BcDTU|hPycGo^Nc1Kz}?dBu`^@Pdqq_=qgiS% zK(^E1gZ zF=h+cFE?LvtZ>t;mzWm@1ufnE;vrTxi?57*5AFmpO~J}X87Zp1k?5?x5WSlTv2d$I zzXsBYvZ1i@u2W5fZ++vCiyv#^GF^E7@UM?VpIFdlefQJn@Q_HT*(dft*(DY)lZ?&#4NbqpJNSE-H#OGju;*q-W0RYQLI3`DPn&3`#rs0`=H;;$0WVI3DEEBN=JdN2Xfgm z*|7J4%urKdZ5=Tv)2;Sl;b>_##ZENNFl#og*UoHoSw-Q@_Sg`;$B&R!iM?{;RGth< zV*+BdtyIRnA1{1D=a|QSLG{YVF+YS@jw}_}A_@4ao3&T;t`GNc=hVCCDN=HSI~yHP z6;svBC^AUX5sO&k*AfB=xP?DETVliKn9j;`OuHpR5uRzTN-Amkx&C6O|SFCrr@BJg)|A>XYcy&j-sE;m~TUdK9`5? zmB-115~&?#nH>_MtWs-yXx;Dx^SVyx9~B^$98c}9`*X&7+s{d`=o%bg<`{$1lncK2 zJA!9m0(TG&S|tZ=&qCnNW8%zX6{Gt(NG#K=JY(1}HRCI0xP>)XS9|oCafj4=Q%hRO zll(~y06KzZU0OLL?AefM)-t%}16(Kd6K|da%#-WI|8tGJbe~i#LbY-Dq9$gIqN(mG zbap}RPUB;ti3|tJTEBMDpTEYKAPM%5ixEH=<5lMwUyhNveGjZQL9SY*`}!z8F&V?0 zKfSnG-Ne(A>0$*ij_bAWP_rymlA|)!w}NG@`mLQu=6j<8y>zgDGi~pMR@2niTa)dP z8`IJr9}g$};dQ4Y))tmV!AK1w_vnE=4?_zJqWeypQQ7D@XrC%D;h@#3S<%4UVLE+v zQWZMXJY|I#&Th?TbU9J{`FfAa4Zs+&t+^$1?-$*#T$@_w8C$bO4}bf|r5K8hSHKtr zoHlRi+1iG2X7-cQ!ek)!2 zt;?kN!MlYaZSxniZT-%P;G)VRlM{Ax!_1L2mq?EsiM-KnQSwIQ=od8>44>zVx=xe- zjF&3f$#TQukFkrt+d8^w6E|9B0QawlLEMX?iO=kjMyL~SE}*y9C~}p8x;k`j6KbMs zCr-X;_SK)jqtlNmD2TV*vTel%r9~^dLaoZ+8Cjdx{V_2@MYxXJwibaTCmeoX3cg^2 z&#j4dzI)|lG0Ag2WHrdEoj=NRJlaNvF&KW+GPX;KEWa@Cd|%#j*KQ}Uw3K5sk3&1p zQg(P4lvACq&pf}q1ab-`n3)X~1o)mA^(Sl%&E`A?C%1r0qV(q1%1WBKdGOA0s9UW~ zWjmG8eGw9^<@cOM?iYQFs%p&|yjHP7YklPa*=DZjuD`o^B8cTR;4 zfIwGR_vK;5*NXkx+k(!vae%rwXdxgjzZ4T8m5()a+O#6r&25}nP_I- zI|~o!ka+{g#6|%!vx)WTbvmAL)SF6TgL$on<2*k?MJ?!Vt%1yH+gQ&6T~U~mt9nPg z=a;&ZaF>vEiO_(~y!y2;EdP-5Q+RKh@!31MSN)&SIIts&n7>7TYvpKDH`#pev&f&F z&v@(qLCtO#Ksx@}UEo;TEkplhYuG2GumIQS(e|EG4g7utr%cs~lf6Rf!6=`}P)Eyt z{=OG$=IDfxszR;jjo)H!ZfW!%#a;BK$0fdt22_P^R$Z8uB({T$C-+Twl&kma2FWPt zCFp_Y!Gi#*}j6Vyj4cpdQRiJqMCgb zAB(n~&fY=&A1SU6 zNS<@8jrL{3C3g*r@^h+4s}3PhiV}S*hLF}ygyiwX4`&m7tz(AdaI?0M<*OLnbpM0L zIK=W?@iPlelCt)6xkb~Cg_x0QMV)f5(mpjttV!UJR8cKPo=M1bn{Ra&faYqrw+CdRm3Z-KcX6+s&OM96>c0kU~g${t#IDF;dZoT z0kjdhee;s097*08YTqJj$(^OrXu{y|@BK6ws>EaDT6{hv+yV6tj~d}w(-cl(-kvjC zmb2%~=6j5ND0cPJ{ZH@JL?#%O^sdZ4fAEBS;y_Q*mUnSP!M zEjBAG zE?zD55qecLDmyTfJ3|V|pESn}$3eXxo^AHm)=G48@l=Zn-MpVKXE)g~?_to1fh`GU zoPW7!!Ue|GyFQX}>SWn63gi>O6KtKah}hJ^>UPBj4YloxLZp`nU}Z6|oP?HnD4?DK}`J*=^Io?QDVJ~F1>tz9)Nu=w2N_?&yDeQw%E|XiBb&sRpw@0>~ z{b2`d&>_W8NR|?=K{nD$3;|(+=EzpS{c}{*fco23rMk7EoT=i;)`zv8F^2p_E>nw- zids*tD>g02VGBDy$H|L?-QQr?x14Oi^VPhjM$2?`izDj7b;CY*v`$Y~bj`jM84K{h4Xb~mg0lUAp;$3m_ zbnch-4u4ezevm*4sw{DAkdkX9qd^2165c+Z3^DvL)R0*$j**o%|q!Xw~SpK)i z98`=P*S`w!U-|;#uKWz6S_zokYMq+F&wxlmy{4;4FB z#PGs*a#4kaqysK~65_Vh6#FYOaQ5I@&l>~=1n_7UMqc4XYuB-q`*5w~9y^zo+1`TI zJmKj5ID96R7u3r#Fz;mS8=F%*nai;aZp@H>zl7_YBaldbWCkyN5w9sDPp=yx%UH$?3=+X91o@@nsMrfd6)^qHmy9@ z%ina;Lth6Q5mqg!aMXWfS*ZGPUYLs$K9>x>U#iRSA&oVQVh zIk!&-h?9jvelr?bo*eLFPak%LBGdlc+vJ_R+Z5y(4Ae$n7r#3f=hDt-7ATdfgBITv zO}hEKhNTLx8akgHZzv3$e*w~U!JC#rB~>TJK^jk~%4N^YjGNxXvfbs4jO?3ICP)(k z9<@#Fvjo>lA})-PoHs>=qCX}I7zcnYO>$U&Al@W!17{}qYh{*x;6+j74wqmB!&=8) z*BqtzJf$LR_z@^cd3=FVD9J)ytxnrsQRm|OYCJU6AmKG{HD~CI@$l@q`PVAH-Sv&V zmBZnq8gliRPX21Q0Zbr!^bvy=L(%;RVO<^$y5f_N!jll83zjoHZO215dI%vU%#_-) zG!dEhh^@aY=&td#2}Qjb+`vw8V#Kh;``_iW_#-7lAdMkC$cbN;qZB{W!mCP{dk`SD zoDp+RE1|k6L_nhM$&6*AB{@MSX_zd&*<$0H+iRbMB@R+Pk}WGx5SxGfwq|{3+-6^@ z?j!2{T``>-k)s0311aBoIB@Je=mZ|}1A~jqimMQ}7$c)2*Or0WT=`gOilc?%0QWbB zA)*n*C%wu%+{~o8vyc`epq-XvQ*OfB)0c8Xa{zaWKicx7-r93`cEcvRtOaOo2y~ME zbbxYy0jRP{1h{BpF<_1=;2X&$1;Ae75QIuoZxLd=H(K!@PZaNiOY3<|r*ppOk5j#K zYU6m(*i-8C5omd#x-^`t^p4+khfKQ<=&CY13QJs^rhA7|@|cyEl7**`@_Ej~ZP1VB zThYARaWalT>0&>zm=AA&ICx#QH{AaJpoUnP#z+0PYBEoLQ?ruLugp~|_HNWV8(85! zhd=X=yjMJV8A5&nr3_Lo$Z?lEl;}va^K!v`*L^$j^%xwwS`aWiZ_Of-2qY ze_#D!AfGb2*+TJ7N-G!j*l$!aRtQBlym-V!Zssc-oyKNNL|LW$7Lw}OlLaMExBON> z+1{t!;cA(wqzx}65wVUTAS2)1wHJ6Nw%scpNu&iFDkaaj+wt_wzUOiM;raPWDb5fe zY4s4B;UiwMgimO_gx5tKA%~S4-ThH7X>uq_mAzI|kx=sxMSC2svp3q4_7#Y=h*#4H zgp|ekuBo%)WTh!WwGO~lP-jWNydytDN0y8KSb+$@or^S66bjZZ-I$4h)`rU)XQ%Gs zl{YGfdH0?2^vd5XZSRzz@WWX^a+QEk?ij?i8rw$2CiINB*B_jOT!^t$oocy;XB>JA zHTn;mhs!qDmP{LzYyN`~Epnl*+`HczL}LK8{V4;mst!6-fYxo_b)yy>R%rc<&7IXM zCb0e6mh!>g2TJr1a4WJv%jX6u87-M2_9v5&yYfE?`i&tmG<0X!=?hJ=^fp(U^;9FF?(+@>;oyT9t_cd7#8ej5IP0Y z8-S*5sPEa^a7wZ*G2UtKH!9jMZ^%wUyWV3r^uA^HE-dzGm$%$k_DH3V)eW9^rDe=EK;xBU^rib6?oZ}@TK|UZ_*N8i*TliD z<2SBE-^S|A&^b!EH7e=(QiK&Vf6C$$w2Nwy8>XUjqVzSOUP{ zP2MUeLPCpyfF@Vq6X7T6N@5cRW*!c*y8Q^$kW7UtVzf{(C+_ox^bXgLs9fMzI}d!L z0C4=w@6(Od)!L4pa>`QQ?X=VRu~jQrydulLk!9Z1Enk5?|AZcT+l_UvP$hgH$-5n0mHKybuUTR{>g@ zOI{ZrHTCWY=l`SXDxjiloA$EOCEX!Pi-I7X0@5L|fFO;ebjK1>(nxpb!qS~fi*$FV zG}7t6;QM~x|DCgkbJ*o9&vV~1*UVgV&HXG_Kzni-%761!d$`k-Jv`t_$~tPC{W12z zX>k;4x5(C;^Cg6%O>*nwv4`BL{?+=c6l_f4e)1B_`NG$`FE*3Z?gYY&r-I1D;=c?y z)=i#U{w9$>*R`@ycCa*E>Gpt43F~CMoEb>fqKL_S5Vlm;AJDud z*k7ZBTP2n=?|k({k(u(_7i^x7R#5pYOgwey&>QJp$N-ClD` z$a|UcIYB@nA-@O1R`W}vmbDM(da)#z9NRDFH`IA$-LKN~WTurqZhY)^$kT*z2Kc;% zk1o@!Xug&YG(sQAlh#6)XRqduBT+He=^9sHDRM2Y`=}q%n)U{oA9k^tr0@c(aKn89 zdA#8$t-*LIiGFnSyn3MI7^~=PAdfRbcK>eL1pltc!JGFF{Md|vmi4*=f!4$3awFr< zli}?OEVNEIv~@vv6R#X)$CPC)Yuy{RPFZTGn^Ihlj+3cxm(~BEcpe=`-?2HRuYDG< zZ*VuBZI;Or55|*@#3TNOSdMFv={;*7@@+S;|684w5n&zShqJpQBbwFj!^N8ras;MU z;?|{7S|JylwN(SZAjXc7AR+7;TB3mD%?L3h zb*vgg#s5eyKO+_@w9}TYBqjasnG#+qi#UG>+miM3cdA4R6;(ToseErGDNrdA2);e> zx1s4+0Qp;)Yi?*xFkXhNAONh9QiI!DySu($Xx=-__2H|CHSkqmj!i<6CjBSHlEVNgzA)Q?)GzV35*NH>a7xxZfsm8E@Sj-a(!A~DCZ9KR-Go^!m z1&9mA43Z?%#fbJHiv^tv9vqRz(ZX{cwKM zMKLco;JGxj9woyi+9!l-VdOsLO2&t1_3xvR)!YQWm8Q=vRcaM91#Z+=IIn(sk?vm+ z%DSL<HJehwbH-~DQh;_#1fDh%}y z=pO#)VUPU2$kOlNDGmmhb^>?r*e`nu+g|kJZDJEd%Wdh2omH3R0VqR&~S zU?fv<;LrhaK_G0R3-e{_JG?Ar_D?8iC0El<%L(5z%&Tq=rMKHmVlVcs9ekJOz01F& z6_(+v-*rXbo-_pIT=5t`H%VMKM`|Ho(TvSW^LCju zGereSXbaI1PL+LhkgM>0{KH{)R^I%(ctv;blycd7RY`@WcTE-=oTx>R_3GnS!pH?b zH8I#YIr}k~i1u^Q?qssvr&(Tx#)`fG(v#oDetTS=^^vupUVu9TP~1m^mC~c}Y$CYY z(X6Bo*}O!QfN43X5VcW@W*tu73x6>XveavtYV*_Rcs(LkaQ)5iD*-w9=6>WcNMsqdm@0z_o1v@AFyaR>i-D+*Rg{_m8RK zh}O{gAZ{ih4DN*=^(nf?zIV1`KA|K`=>*Yu_qutnRUQX;ZZG)be9OZ5W^D7S59d6N z4Zmsx9nbH%uXw<-A>bX}2b>=NFRKKW-GvUAz z1@Z7XmsgwG+pnLEC=sp|ynDW51JI?RqxrpDkr@Wj$dte5&t~uxv@6^Mptr~$$%rWYKK z{@gF2{q`$?^5;m=cb?LGj>{n;5JY9E;(P?6XynOp5_Toe{Mz{5Nl1+X5}R_70;jjh z1)AJAtx!{PX7sFKtR`rxuz{+&8e$#fH=WXc!JrAU07+VhjYEF&v6kLcLqIrnBuf(z zr{sfLCZTJq5F1D7m9Y(MY&k!d zV-Y_v6fofOAx4(feA9ddA+@DFQJaQ-2Q!NP(FG$I@`qBoS-q}^CZ{HkdVA8B@9%CB z5))_4Yaf6Ptr)?j8l!1~c#sNZ=Kglijo9!z%sG6Ltv0CH_z~p{D!5oO5CH>0y{}Fm zztL!`jpg}&0Z=QC43CvE6a^{fCqd8i7o$?*j(8vBgDLnB-ahvMueCj60`0~#STMhE z#14=TkHPy0Cc`iwtGxkt_A=*nlF@e{e(z_KqH)xQTz{th8EskkJ7+{6-HaQfY&^n7 zm{LsrEsm5~X#A9wvM6t_SIgN*v`P`4%8Bh$1?jiX{VxuU>#9EyDUDiXq=;N%Fuh}h zE~LnuZR2nNoe<<9buGvr|7b3@;R8Y!BDy=@F`ml9gqcO9^u7qY4_ z1@V39x+I(&ybG;BVrxxXp?>Xbvl7=ivw%CeAH=2|@B7@a-9;?4MK%?)QIjSu#rPTZ zqgT1U<*nxL%=~5ZK}4FkAkBb3y9$z-h{!gET4pUE{xWW|j4Bm!_Hq*sh-$I@-oCET zTcBLaJ3JMhTU}p-AnH<`wNzNx` zpmc=^fsyMZWYDYp^A?%C)P!dCEexzh9N zh^8UKeTGn~HZWubHM(s31sKDs4THR1|ab@5dMboOIrhW37voz?p$h@>{kNGp`daa&nbz^%^BIZn`Ovn3liK) zm%S6%<_Jd%`8y;L_33Z`gokjpVyG!nOgBT#F#dyuMW&))Fg^m=19}?Gv1=1w&f>qh z-)AW3bQDasPSpA#}Qx%^fAda-e?18y!l z)6|ApYT6Xi$iOqHOkA*%HR50R)n&c!EBKtTbh@ea81NzEO89=27K2`c@THc6 z%zT2}ymdbf*|Z8WUKZ^trz`k79*pJa<|qvGkWUE76v4}|i7ScOY6v(6dwzSCu|~9L zlPmo-U0r?D^0K&hJa(sx9iO;hvFECO#&EH;UzBF--!RpZ0={Nh^gIF1?sEw>T;l3@ z{CY2^Aa7Nz1&4r^XUa&oETjaAn*CgV4zK6F|8&6_$|9lbybDxY3I%hC>Nc>bzbn#o3}lxlTBh4FJTHFvEE1JQyy_qD3Ugx<$T~4 zecif=aXse##mKNUaEO^Y`zP_8OrH16K4z)cY!}MKH4g{zia+>GQn~lA4qq&j95 zsbAf08>3i%vdA7&|Mo<$CeGlwTEaK>(D&%odLI}IQ>BU-@cNqD^5e0pwl!#v&pO_0 zCbijkD)p;>^efOHYE`Rtgd8+07VTuCqRLJBsE1=a?8M%X&VoraCngJFsL-8>Lf4Re zf3Oi3V{PwnVR+c2BG&sv$abj(NZX6=dO8~v%T+eY;It=)a#jwhf~4A-z{R*0PcPNnl=bkG z(MkTi%v>`y82-1I^&6Qs*~BXt(E?d|#oL@|J(&C5@zFYS-^oFk^1$rP^bd z`@PX2_x}T)AAo)r2oHJ3)UTb8gCf#A-hZYO!A=hBF{a~WT^GB{jtJ>*x!<80=b+N&f`!UL>|EW_6IUa>9>*<9T}OB|LHpTIzI4Q4WX(kNZ{ zqLQYW$ZC16ySJcA@#Qn9+>cXY#ou$*DNT?bC@)&7f^uQ9%?^Eu8=e{T1;5f{?I?&V zK)B3OuAf#{I1$K)HmucmBvBd|a)FmJPq;dthKkP_B!XUiN)XE# znMz(U&3~dK_!SE{aL&n8$)zwA%k{07G@?8C zsX4|Qi9sO|FFQrD(`K>cCTWEl;#cmkZII9fHFtO`kD_yBU()?Dh3?2lRw!^4fk67D z)h~DXxJJ{Bm2}dPCwdlsC`=WGBfquko(%ZeBA{G!?Qt=akgX}CalyXRn@d_Yt8%&S z`IWzj)Dz6z_NyL;!B}iOz&~blO4;MkfijxYIPnp+B74$J(gXuBtebt|K|F-|Q>QFz z^Ecz7`Uxxe=T|A8ej<8K64%87d$%o%DScW>jaUOqZK9m5hbr~A=fqAAF&gmsox+2v z*Er3wH)g0SZ)FK>40*eX)EiADfUF0lu4_IIK~VHt?+Si??JUwGE>dD}1UJ%nAQvQ_k^)DVpI-Tyj4uUO>v!m<4tpgyVBc9!_GQGG#yMMk>@aCz%v0L=PBM z%}5T)B2m(@F|*lQ?33Z{KygONXD~t1J2!gu)~^k-OHLyex6KY{y8ILqq=KxvO$PDk>kuB}ynFb=Z8UQR#W1 z=a;~h*fuMx9PPw$bQF_tbaLIYbkCCIl0L>IFoJ&}P_2;^{)%g45^^2xQ5nNk7n2UO6sXpdg*scr)5mL#Fc4q1Ud#j2ozc zun)`21Rp|ZU$ZjKYbtH$C;6;}I<34Mh6trXYPTLBZ5SQ0ftSM=eADg4ev)-6{=qi?(XYgw0*Tki(`CQl}`DlkF1qo>+F zec%kOa_)+?qdiH>2Ae3`clAz$?%G`xFASJ&@2YvZCZ?w51eE{{h3ykvh{7$ST}Ilg zonKT}c>iV@kN-^T>HnAvX$X=IFGVI%@N*?QaYmfb51G#sOR5qrka>7;%_fr#V^XzM z83qW5=9q-)m+bMb_Sywwd;J;lDdPD^g;ErcS3H6@ta!6VQO>XUp1&L6Prp}j4dl8; z5!K7W7T|qxyyqFzyyk0?^ZWi9j4en-Kr6Od5 zfUEE>@9t1(8Fd=r+OPAU7gn=9kkLVH#gk87n)l9q@^zfRU4lI#lTU&MiXYX4$j5|F z(%1pA+Wvh{m78oU16!|heEBVyy2$-QccA1XUU_Syu%f zAbgX}5=(3&!S`3QAC*?wO&b%)YQSP%x+nuP9YlpV1`D-Rz_n{&^pxIWc0RBP<8i zoR5I2tV}_SsUyI)>64B67Mfz|=0a}hD2;2$7e@Vsx|MGajXCq~`sdMNZ8dY9Vo4Fzq`gT)o@u9!C&wm2u%`y|H|s|oORYPPR4>wzKZv)p~=$E zZHo&h{^=Y0-8)QTVzE_lLc+UPWtVBv85Pg6XXn)`MQA3Z72zNK0T5i#2 z{=$)x^$6lEdRY>*WsQV-ZgOrf9#LXfcK(Nbn!9FK>J2);e6 zWR|Y}WTLB|i%Y#G%xznlFyz8oWu&^FHZd$MSk8H&rTf%+wK(4;ipn9s_&AJnB$PSb z|8xFL(cC(&?awBoV&~7kzo#{f$qC0QrYd(1)h4Rt5T4G$t@kjK3T=<_smF`IH}_lW z%>)h)7y0tCkp>-(JeG!|HbS&x5E!4vJd>nQOuKr!ve0RL(ERJ%OSD<=*qfybFL$-6 zkT&P5w2&8e&1b^%sdnEdIA@H)@a@&!~gc0KxrNXBO-0H#t2WN?<}~Oc8P?14N$U zH{F~!YVG0DL|~_$ak4D52F7;XNJSeJEzsoPA?abklEFUdPDpOaGpsZ35|rrJYARC% zW$jh4uLg6iU-mB?&S%&}RkIdo5!_f3x~ocf?L#&oUW*3S_BJ(>DlWTf#9r=ZlpzZQ zq)WvAF&UiSsO>=SJf(-L(Wezf*u5+JTjvJXOY<;wmN>?fLg zl##lU?cS_U&Hb(SD$M35Sx<5bDvKlgtuakk;0aS4-&MlriroF|)H)4U;h+0kv=!k} zE{Mpzh3?%x(TzyqLuhgl2tHMKlCfL9@W~2_AvqU+CrXK>;Lb?{te7!H)^9n&+0V;C zPgBP5q{0&TE&OHE1>aewaZXvDZWY`VI3Lj+&3<>VvMajb?nvu99Y3961bhz7)SjB; zgPZ(70MFar;(tJ8`-MMzM{&~@h_SR}1occCZpW_;O1faImPAIHP~f{lo`P$j&CW$W6Y%G{GWZ%}n&R>QRlvJ$W6AYEx2%s^vk&MFSNEr+^_1c-QT7{odP3eX3;O7 z5nd*ziC7nJMz0(UJmoM6*Me zZ_Uu*GP|;@C<=0rK3`5UV}B`qU42T7bV!4{8&0%PoVKZC-`>lEcL=ikm~gJ|QctMM z*U9+WfEK9PBO_Z;+;o6;T`^Vh+|zuRg-t1*hm*n9TwxjJ2h*Va&2JaQa`r~JuSdFb zd~3w=>?)XdzmcP7+;_6S1teX(Sy?evl^|(0dF`lpnzYzsk&o2JyKA0m@w89?q!2wb zb#rhXWd;pT+hnFbJr^58Q0RZ3@WrO@pURAiA`#uj)60($XYp_?3C38GplPG$YF82< z!H7wou#ghKoD3Wt~tOPpo^#C>3Cwmy~awBh?v2^Q#x${E8ERF;>y79g;YB{Zhu zZJK`RT~*H!fg(Hl`;W7O^|}@crfcnGW8GzY9*5F|LaE#R+9N|QlU=fTa>>EH9=le5 zz{6W;bPt!EJw}t|jTG}36Mmd$&6uyQ7vcjR=&B2^yL%#c@gLdm;_|x6V{V;gf18dz zIg(~R`s0WgH@4GUo*LS$XreoY!9aQ={<+dwaqM*xqN46t=PX?na`i>|&t|@%wD`&O z#?mI6sI^L`VR@fFTX&AP*H+Z~EnZK<|DT~ipU+SK2UTd+kLhE8TjvrkcJwd<1~FCy zKL+bpPxo+LMIr%ql{`4pW9V=AiDJ56*eyX`N9^Pglub+9TE4LbtD?(T;LJ*0CtQ_N zA=AC(2WadA50|8e6`u$+qa+l|N@XI)bs%^c68WfRQH<5Uo_ANRp%(LnIHErBdBK5T zOopyb#4)b{RBJ%LBk&De+tA0y?XyMnmY`*uKxHGs=v-M&Etl*E7|p;U6tc=jd*RTQ z8J~3VasEZIxLSv3Ez`{<-Ut0qC9W95__dvrO^NKi)AA5|#qV_7(yHzqEUg}@^y!-K zd>7YM2D*iZme+HAIR$t-_7xsI_V;C35$W>j0g1a7-c6eV|}U!WqtZ)y%VguCDpW0(~nx9#04#QP(MCrW_7;8a7ml`b6dbny?4 z3{#W+3Z=kF|5zkKDmK8e1|7U%cU>)vchLSAq3G&t&%z z#Hca{4kUHn_X39YFl=4uI~~L_K+%zSk+Z-Y^lduyz6DHYb#{-p>C5c{LPT?=zalKAh2ewqx1Z?-v8* zsF{d)WWX?uED%0VB}04f0?m22tQ;3D*>`V(;YlJXj*Nw&qYS8x;hV0;TDQ8UNQ3&K zve|*Md4%i2LR?9U3FUmEnj;H1CqA$gs6<9E$T>Awgi&37CL115eLbsLP0^$I#JvUm zl|{cwCMXw>XO8!0+vSN;*$lDIqme}RgcKGsQSiEv#0%Gdt)AfYI31ybpUi9kXP}H^ zrK2mn@i2nFOMX}6@KJXM65nX;_hyGR4v9NZIVj)Gl&T-=3UK>GSFZe+rv7gdCECKQ zArkaoBMdmCEL|H~G&3yEjx>|Dchi5S%T5p2OGbUeVT{DXhgOi>Sj>>L%)eH8f&3L-(JNWn`mNB!g)xw7U?I(zr-&5J;J@iKorcq@Ah%P0P+q|1g>sP7n! z0fW;7nH**mbvB76dqL%L8Ghu*l_zmJ3oSgPZPSWT$0nNoA`l}> zyTntD9a@x;;fxZ5wz#!JMi(#U2NN6Xj7vHS#Fbw7O!mLwj5g6vQ)Q^tH2k6$O-_~i zou~X|r%RZU>!X*hAFsk0YHNz%<1K23$aOa>mw`#hd0`B!u%0Bd3i*ygb7HDx7F1Ur zqX!jc$yjGv*E%g7&iL?ixUhcy%xnUMa=E$j3H16j4N#py5c&e+o{W!hTB>MP(|Jr2 zgxX1C<7Dk!AJ^X1$aGN5d^-B>owkV*w+Q+(bd>j=Tbg*n0@@uMCa zm9I_>3OcKw|6KgK!id=I_d{2P^XA6Z(ak>LMdKIW2%bzG?6_5}pg z9Zk;h*zR=ZS@hynQ1*^i@nAp6Gmn%EahF*p7F^aQQgmZHZD!jt^=*C*{?iBV33D3? zG53eyZ@|w5xY}~`Vv4u+=zHO-NQ{5mdRV%uI9O%lq5k8~ABO)zpcc0C#^27)1G8l4 zaxW4Z-3Xl5kuF>G<>q*+2JtPkf`sdG)~ufUPKd`^z3HWsX>% zg}GUY9E<&{1fqb~v-T5|=kvPim$j`{Yt*mL*jnRgCh(=9%bX0ZRnKXvO)I067sOSt z3_s~cy$t1?+W&dnFV(CRlqG=&X-?3@+bdXC;&Hbsz6BLFsbB%QEB4pq+_v_<86S#iAkW8pPebvj$ z9?N<`D$UFNUq>*fHZ2jYt@9ETZ*7c{ewqE(?2If{unGUeRyh#}^UT0dobf;XqLXNh zmV}H1(>aCtn~Lim9LhE}CM|a>vyW2i-Y{xeue?x9*Lq3n=};d?d>+X2mhhPyqQwX* zKm`k4?*Ij=G3snMx_r;+@nn$LIOva;nnqzk^#H?iks~_6pM}UrtZCNE?hF=}As2I( z$q{ZEJC|Pe)OrC)Gt&9z#|1*5siHwix;U%ubN!wx_R>J$WokAjMZ&Tg!{f!e3e521 zF5fVaUFv$atbQsQbyo(Ag#qlLIKO4@Cl*^15A~tRpzD*eYsVO;i5myJTM>x4wbpR zSTbALR1Wy_YXbC1Q)*<0N#e zH0;GYRz?5Z;MpZBTlyjImUe~3b|peEe_=bTwbMu_lDYnqn{Mhhy%+zDT@{9rjO-$~A{zMejj|OJCKf!0D&*`GKZ3 zsjfsSmfSyTyr1cJnO>C@eyKflCTYqgU}3X2pmrsd3e z*-|4s!}b<@<>Phz<;kCg+U}#DD?cs?haZMqr=;KpQQ$keg) zX~)o0P%H_q2N5g!k^$npfFFhgp2Z|#@p^`&Sq=-*2I>ma+B#^8@HJFYtgV0Y_PRPl zzV9oYur-y*Ai@ro0F&|&euxB``T-^L=7Rx2 zKNl5Wz&xWNr$vYLu5;DASgFBb)sVwgMkst7m2hq7?UUQd?<9>qOsao1GK0%Mq9xfl zIGzCNT-WFi=3AP(sNh|WUTK0OC*9?N7Fc@$mY6}tq3-oLzPuKgb#RRJ(BjKUT%+pG zo#kErZR>q?U@X|N$isS+BWI*-KA)V*%spW7n6PYK`gpb)Tc>%pyWI`_zxE_rgZ}?H zf^Y-4Iw#lnjd5}X`^bRQx+*NQ7d6`PV@(?-^6#(}ogyh6O0Gp6XqIsw{Ir`?OhhBoS(q;ZsB2 zjqpa6U2a5C2$NecJ-qK>sBQ``{H$^wL_}i{WlZ#)!D`yH8HVGZ-vKBLbkBa;0t=5K z6vQuwbP8516#Wv+F@tYC3E_5yx(;i#7A9P4z1t*76UKQSBjb*J)xfwmpAY{oNa>#+ zf~fYSlvw5wX5@34AnxPuts4P9v)MzzIBWRIsM`(*kv)*=yEsqTFssGUrrm2Of%@0y9fXIy&@Zx z_9!)f=kix9)j>%P2_ijKB`MOg0F(|DKfGySQiCQg2(}}Y4DE7XSYHohuh3ho4{dX5 z^qo!Yvr^KFF0S%SBwdH*ji8=a9pGfA@-A7lx z8Qg<+yD?r|ofPH3hqm&8p{Y0|5kA81`MzB>X&ztvGe4pgURAdniyzZ6Fj|ZMwsZZG zi>Kvut+Bbh(L_$TW!Gaj2L=~YfTr_B0XLd>OFW-C#x?$_v8mMk08U{@mmOnYB8> zxOyKL&L~@iKEMTn-9p;6xbce52+~r}hC_2FrzQ&htzT3@M%YD*t{ox9xn>h00O)K6 z+oX%U{vnUel~23*)62GA)Fn^$_Iqhw#@~(aH65Gik4_f>XJz5X7f3p-vmKgVE+eBs zdEu(F&2bHQ4b8bA@cZu)W**N{3YQc_q!eh!ren&K4;aOpYAX5Szf(1uroJ*&=?Tm?3#d3|K7y`aKYuqhGYOlW zs`?_Q`+LWLziVLv(PGwGUnQ-@Ao947E^9U@bMw+)OA|L&!1gV*HBXLV596u2{um#~I`14lVXG(loC37;SC|pmZ3w3;hMb6y1}UCuN)qaN6XKbK#yz9YgBF>s=! z5JkSZuxf2SgQdoZ2tmy%8AKpmJJACg-b1&R+?6$?i*-F9lCa|}eJKs@N@sR}_numg zaY`w|-zb@UC3(yPXFejn^M23)OnII2vFF;Xv^QR!A9`5)wXnXgK%IRIj}+iObRod) z%ke(xOjyeu&C-1)zOK@nOkvFqLEB9mZI1nvmRSnI!@z}F2!Y3 zbB=g_Ic8#>P+)=9)dhZfD2MT-Zz-_pnQ|JeP*}wf8gg|zv}9U4r5Wqg&7X-fo7g?b zQInoZiHPdXa&b)Tb+LyKGs%d^2AAKA%plY6yf|ViH;w6HMwnc)WQw3L& zA}g20on8)n-P}(l3j(voeUj9mZuD{DZ%^~J1$v8!S8C=Olzwr&IL)oD}jjxpS%a)+;OF=zRnUG>IvcsoWiD{$HtW4Dk{!zkR4NWl)D z$X+b>q81;hkIYBfn>u*bR@Y1b7Y?qpLlNPf7mWi(qYePeNlWqlY!K@(1_*qL{F%b) zhpO1}QB3EjlMxxI31LIrBb0oD+auLb;{mxUir0;2^8>ZU9jnskNzAR#w9C-dq|xgb zLn3-jz4-#?(S$LVl$HdB;% z-%s&(Y53ZzyTN)em^>Z%+a|gQcEKw7vle<56JZXJ(g?+eRLLK3t|$W+H?R?59q!={ z=Q*`4k%i(nCfJ6__cq7Vks zUG?Hx3$4Kwv!6vf6q7 zK@yHEk>%SK5?1P9rI6o;ZFxMHwD6YTG`Ef#-ol3>HQJ6#O+xRtPYz1+;Vj~_YJB}- z`{s20{Ev0lT}dF;fb4;lS9Nc<0simWmMml++yBuwOmU4LdGC=mIfZ*U`;Dt1V{D>D z=m>J-hzkAEZ>dIBr5|8qy10`%E!@^4{;gUk6P1zK&)bho`A`qFypppsRz;7)#4Dw4 z&O>{$#dyyVb)#Nar!?2FkHNMvPQtzz%BTX(wE@=D&==^8|JGs~Gbcl$$i7)wt!`UW z+ZWdl-G0A4OakPt=-2tcKY6c)7tI5yoQs*?wcNeCFn3(Z8Q7Da1vm4@U8SWh#>}~H zaXQ!U8AvQP54Cgm4OW89T}t<3OU~Hgk{Vy(KQ>q|7cdjOb|1CBMssBiO{lp9lWK9e zQ#)Gw*pIjp?*C6~@DW#D;EFD9h;cT#lm&cfK#C&p2Cva{TOh0-HBctzR0;17)4)6Y z{D>v5&daA2zHhE5Njy)Fh2;MPFmUt^pJrozs=&W47Vq(p6I>agvY3uU*rtc^*D8Oi zONEQN-~x-tSOwR^p^wzBNQ$4&_x;+!5FZovfqSIX9vMFB#w0_U)uzf*!uuJHH{k=w z-*WE1obU*6c*`sPWJ%LH#)SHfuQpuWf@?N7UiNTqPNXN_k5^%|mC9zgF_z^MW>J~_85b5U+JWjI zZC+t7N)re*Oi5<_eoK{W1|UJ>%Tp`ogzDzk@%515=PCGehL7%XAkAwJ*sQ31eY&M0 zU~1CwwKcmMqG)0zQRGHjc<~jMF?<-!fuK3E98jYfXmyI_*M2+$__O|tjNYPsmi5Qf zk8#LGbYRco1GCqKs^$J^ja1DPB&K_vR(Ue-;bjY#m6T>z+at-1BMly69QU`N{>8^V zqa-MOIJGb`VB3lRa@qH3?KGUSnIX+VuS-O`U9$9gwufA9$m0pLv7 zais;CkZYttbx}ZX;lbV2WDgeh3Cg#t4}|Hxd^UPOl8_pql~aA8KzgJWFm2~S-f)^V zX}Gaa{OvCo=8qHFoXx5IEvwQhsuYumm{y6a8X#YT2JW3sos4j;mC4R8e zgih*oOFak;jfU{w_RJR!KR}Cpakz^6^KmhKQxIbYp)5s$4MvqJ6NEW+r!mgL$0=$h z`zr0ke_@!|ts=bSoxsC5Ms6(sX2EkAe}yyC2~3!s`igoj{_U;X*T!8^w;--XR48Qc zoK>nQ01w{Jr%0G~+rMHf#@Y_rR!4JGsY%ja87_$S*LoMJ_Lw^jOKzA;Y zEiq5DMeY?o4h?(eo%_C4Z<~N@T}WPbXObno@&Bt4q8Vzvr06`Nwq0yK!mePMGl+nL zy?ZubUK!}Mh+7wJRn6@ea~j*;>SlsH>XhQXgY&^)qDi_{HaER;{1J-2Lhzy@4yy@M}XG@JBn%F#b8SJ<*SBR;FJ0@Tep z)pBGpogWWWr^#scFB-t(*%gO7jp>qX6jgldN_5+WONy zz%M*&4EgoTjDqhL5uoSliWDz&ZS<{eAE%yle$o3jLm;ErdIY&RM@#q<@bT#6R zb=NtdDr%wLz>YnfNxb$+ zxMr{Woe>eMgM32_xQ;qW0lXZlm!EK4n$Etyo+b3AMS?$LZ*{@~3~xFB-lZfXEe!8H*v2x3}IepqF9-9HDJxNN`bMVo5jm( z)tRsz-Oo2=Wal$?Z*=%HI#kze7gC=+ZpwPd*6qmBBTU~LNR=uyxLCT!*NMlJo9i2fdXS?90V>9Z$g<|$;i)=*cX2pB*%b$_2 zyddzChMvWVc}=WcAP^`Fq3uzlOln#5$_{xPW$f(;W}-1@&_%;Bc;hFQ#8v5Vp<+;#`LM%;!yi!HfaC2Y3LLARFO*c4f+$GL&~C+F5fqQ7n_C-1$(b2t=Sy_ zz_>VA8QV>_Dwl+pTXz}=HkqtPC*iPbqTBW&%aC$vQ!Xp>2&Ii1or9LRg|-=W5M?sLDM1#F z0EJPv#7YK?y#GW&lV(nVn}_~?dVH^CD50|36l3O(O)ym4|a5XR0K*q9Tq19!?-KGStI(ckMduA^>Jne}op zJX~1e;|Vu)4GBbGZhV2f<#20VHZU2*zPS-e2!Y@9HR9ONNf7PP?>0dGmJzOM+*0=F zfv%Tvx2ERMl#YpRRt2TZR*Tn0#BY)`TRHx_Sk}WX3dO@i#ZR2RXTL*Gx}V%GmXl#C z2A+fd0cJY5inQkn{HEI+hz@gk1xq`|5haF@Ktav$F-H~^jbC|n4b!X+os4j8KE8&N z4%FNXzh`n1ax|xI2GY)F1_S|#CJ8+~n0E{fLtAPTD04y0VN_7fryO!q9OGZ1 zQ%UJtF94xEu=JFm;n34F>U)!4s)kRqOgS9WvsJh=LHeO<<{&NK*~5^b!O6nwWH@bp z#kkn2h<-WShRQ0e)X`7UVg1(@%3TlYPr8o%xtA7272yH)W(4WTN_ROd4d(kZOyu_! zlXFN+jTxxgx*(>$)@aWRbRfBTW7m>6fIX`~6e{>?40<=Y8fAh%o?uv~uU7B1 zb2?$HlxvMH!iwYx&i8HoV?-HGb$WO6cR=Z{&wF5#v^|bYKCD|Lcs>Kb_YYgwKfIxU9K-jkVIDFh40+SmZU(LNI} z6i`4#NJ)w2VW$fdmtW$b{3y`tCIS0)K}U_~Irn=e-k#tv=KMGLp|4QdX1-t=tL;P+ z)BiE`m0?kC-`grk2n;CFB_gFDIdmu>NSD;m(%oGm5{iHdQX{403`4^()BrK~>x~Ci7Jcfy9sE4nWQV)hQi-3TNiVOJ zY8E4FfdAY6$~P<0+mtAS|H0|+UiqK4!A6=7@$VH~Ukk`j0|!;Z%O_Dux} z`Dqwe)^CkXggQ$Z21v}D$BaGj5va$PPvtSd%c9W=MG5VK{^sZ2Pdl#Ox)#z@@J zSyFFp>*^nA`l2te@D)5 z`+VPRF+wrB7r1U@nKUE~b*EpmU+NS-N~q44bCt<#jodav+<;7>WR%~=K5tKv^m-4JRz z*ts2P_ii0%WYOHtawSh@)RVbgS7M5t2JtEUFtaC5=eu{->y)wwF#5B3bv?beADn^> z(D94(|*%y*Rjm%pBh`kg+RK0e{;cZTomv?p!v zKI5?n3=G7c4lF2}&-HTG9il@BnOW6-1OVFmB;mu)zdCg|v2KIZXSMEm!aEs45^8hdYwo2 zJ{Sz;bvy%Vt3Sh@Atc_rqr_S0DS%~yeaX&Ym}SdNe3cNtjw{Kh*wcWh89zuYruNQE**`nfGT3!bD(t>9cih~-`}YZ{ zzlZimmxm$sPf!=$pU&1&3N$?oRkd{~5?7q^x$>vII}e zkA?af9D+iz9DK@&d(jLZ+1Z{Ps^SvJZJrUpKv~+iGih$a^qrnzU8is3`|+CcouhFC z05||8-bjL{y!xmDgP8UOjJ3w^Hy|$0uf}QzZ50RV8n$NGAG_C{!GgAmR*Q;OK{Yit zxdHw)HWB9f^4(@1@JdQW2pANrK9`m}3G2Q+F;F^pw|TkaHC`;2p#0&jZ#{f}UG?SL zc)Lfs_V*if4)#rkmAT=o&VB*{iS0aZJEJ-}>fj@WUS~(46T$-XAKBBp!Stt03|FR! zeZnP)lhy8ndd!y9g3qs(pGIzKW?icH>Rj$KF*Jv)>^7$3dHIY| zINeN3yBQX$`JW!z>z^w$vCezPlV2$%XXdE|Dpo3H>lRXFF5z(4 zR=ND@!rOzq{B05Ox!C@7B_iZaOi%AuY17NmNk7QZBAm2Wuk{Yb3&nnjJ{bz0;=0lP zW->BlH)5=T^~$k4CcuEahF!C@VsxJycU7(ivI9;JSinOb)|n%!IG-}bs5yzIRF?#y zA2<%EEY4mw=j^P^zI6f@vihj(+|5}78c@6I;*+D*LcXRCz^R3{_@Dz=KuAbSIrD8fiGi1YTUhJwsZoN*zV@gmh6&6@8&G6kIVP z_FP)1UP@rt^LXd1ZB%$;KL5=>v(1M~17dd<;OWgrK_>o}uQo$wS%%gQ4ong|fK(CY zhoc8WxyzKbu!Mt{@{o#Bj&Q{5SdKNQM`pZiXc{7Udvd*ipz_)1=fs!xw) zscC-pE6RL74OM!A7T;)mrA|%r!xCDRRHUwRp0?2#-zBNAYuj-l6cOcS^ObY!!G!&m zyCH_+P*|yB3*&I=xU{$-cNsc93FjmcK3mku~z8WzhfKSPdu$|hVNsi_gz20Y&DFn0)ri^kkX37qvsN1(tAB+Cv@xXdpRVfCzXlq zB!WF`8LcQohrne9Re_>Jx$0cg z66?yRiWi+FW=}YVAkc6Qt5C%!<{}i#N(Q#tMVp&w@(U{4fxIt7wo1{To5*tae>8*( z5b>f9MXOt_wklA$e36OxvGK(^U0(K^X$-=DWB%m=sPr28WX?I)fxHSS@i}sse?y1U zzD%S;_jE}OApmtH{DtM`L*TK?)p7n1$6$KI!9pLOV?%|S7sK&>C|*W2tVvFm#Q4TE z4u5O~5o`S~O?)q3`8V`+@icTx9!-}|cRfHXH8=J#))rl!jZ5|Gr<(_WT2B+r0<@Is)1uYevCD-}}x;viga*i+fLSHIbYNI`6*@h<5ZOso5)8 z?6LPna^%!T+~%EWnidExN$xqJ;a|b%H^I5T7$6MN*B>D$ph8r4z3Jcy^2Z5qwOaG+%^km|EK}J zV&4>Risq^NP?>0x;g@K^9*g-aeXA3X9Pj1-KuezBM=bGGm6QIs89J?~a{mhI+bF{8 zVAdAOi9`PV=)!2ukJvZ8bx-C|3n;3PnV96|>;w6TM;t+l1~tv+Ufhqa*4wZ|ZiV5M z-GUYAc?I|-8-6N#0S(f9pBG%W7r4BivAw-;)!wy%Ip0JeTa%Wh!(7%n5s`tg)Ntop z?0sG*J?xan3K_{cI)h&Sc@BcVhW}sH3@t4Wk_-tA%uzZ~6qm@zA(#&n+^dpBQwb3O z!k<+n5^a3(=vs-1zi4vvuo+XSsn89nTV_I2N+&0rvkpO(~x;!ykHCXmN#7)UcOF^)Y5?oQfuTf<``%B4uIE~s;{UpHxL z5Wr0;kyoRpnxyIRSi%M~0)h865-n$@?W>ZI%Dk0>`5(+FE?O6xXT4sb9l%7OGh319 ze781gHrfa#F`>44afcxzpnvrBhU1mA& zC*HS8HDb3fI&!yc)DkYK^Ug|ITcanIQCj8^jB5)cih(@QR2*hjvb0eJYjlE_L5XOb_S7Je9 zAxG_1eG;J<8v7#FvK{zCkOL7suXW3~bhv!xjhMtj{$wMFK>hcYa;jbdHJH@yH?8qr zpA(X^>X`khP>XKdT84#n_nfp8Uz?=(Dzx6}#!Hx}i$Y--0KSl6Z?~S!6n2U)M66Q! zv3IcO!lc%h;RL(1RMLIbWga{Rim-_C%oJv3r7-LSwPQ~=Ji~nLvr22{gA)sPm-l>O zGn-P>*>4K9v#w}mh-@fjd!I+H|L_#8nX>Au2wQ%q9n2CxJY=-}BgPQw?A)Y3H4AI0 zG{%+7as74fPz=$*Umdb+ECE#-<>j6g&>AMgA4}N1CIJyYV3aIcY6>-o%LulWnNz%3 zwBFyA`lH?UFlOd=e~zJ~AJKYxjK75ZG9=hUyPp457~ z?VTNtHrwSC|18_tzzjvwP7!$3!$5+{NH|-Q2;*QsLKYG6NYJfBi`tZ`awH*^OS&{{ zBDxk5r~152C&-aY<5zp=QrCI+rs-_#l47bFUAxg#WH+_z$K-?O+i8O#ztd0Y&IjQk zU(sUtgpRN)rCsz%l=MW}qxmkEiZRK>T}k}*lzef$%KxO0PGxBpt;4*G*uzox?qbTF|LxKa*4yLJ~+>Z$=X4y zna|1=9p9lblX=wzR=&O&?M0j@#9|aSZizOc%DehEU&*>SLf@jdeJkC5#Tq&lL234c zr6qbV0@f<*>5k*LuRp5$U7vOd`(X`&!-DMuyjM9Kf%x+*TA$@7BQJ z*5H(4h-F5tLiXL)P+bM)Xb{GvCwaGOD*n0j#Wt>CWFX#6j9GdG9Br8IE%g{xyM|)r zry|R@kbPAf6X*bg$B%_`uv?`EB7x#jI7sRI)yC@3&L>=U5@SoOS&EFpQoMHD0|&_q zOe62ZTD`a`Y4z#MSqPly^B>~5VDyI;!KEJN@oO0;ixLv zkwflA#q@gFBWnMQLBIZnvLbj=4KtXpa4xEeoxP^BaJ&iLXJA!sPn<4r(s?jWUW`ks z(owrGi-DuNXG7;8C|Yq-x2#h>K9;+OoQa;4U$!kCY4A)q#5+t&h;8iKSzGP8(b!uK zMzE=Z_cx=ijm8Fj+qppT`DZS2ju`|9hv=?pyGUK9?Ff$Amq^ebzW#mUa_-22T-2oj z0hioJ*=S`q?1PbhES(OI_hZU{#7Cc{f#G-q`+f3P^}kb9oUVk#!E~kvA`A{^>K@3m z8QsyV^|AGd+j|i`DNIRH4L*8lOx3lm>72$j53j4Mf-<}Axp;h|hEspJ9o6O9h|x}Kx|=DD5(bnP;2RNu;GxD^+4MgtpT_gN#jW9d*%WVfEH497EBy;5ba zZCxzJNq31nzl`qsjAl?DEQe4enyVLbk#yAvyJ$C&1;cs^AGVk+zjgHgbNqZ8N z&lH@Hw1uh2DamoBcJmfBE1;uj1CYoovGIocagP)-e!_J#g}?|jm0ZO6M-~LWmQ`k( zh6q<=RZ73I3R`{QVb3p>7HLTdR@1Q8AmR4BBT`N#Y!)0aX@13)6g2o8b8xO|PPg~G ziDTtdux*y6@uSNfT-m|sWGBB#A&VVZf^XKtYPXc@qjF4I-22LgqUrRP#S@*)%H;pNab)3g!psi*rofgwZdj7eG7;09wD%1!KqingzNfkM;k8#HeJZjiW|IH{5N@Q6p}VsdRC0Zx%FU zhi;8J3?sumHeJT6=`$*{N#^Li!$KgV%=4kj#bEsvmk+mcgHVJviys?wseE(dn@A;p0JNQK4 z*+lW~tSl)%pJ*wzthtY{V0q&Bi$C~cyj0HbI4vzID5|L z(9|7-%e-4~;2Cnkr}xq+-J~YNTadB1*z=E2(CKL_W61FUKMC5^Qz0y(_P#Xk%|fv+ zci8{Q5nJN6H>QE2Ckfm}CCf4Yvk)TeDORu%Bl0Y^ATJ|feT+|oZfd5zi#e-&YE;=o)%DeaCm2w5nT z!8w;v=fI}Hc<^~Ooqmn^l@I%)fJq`~s*cl~i{4lX$lh}!j!t6a7LaPSs56*0J!?~D z(8Krmkd}02+N{p)U@Pak*zAzE`fOeZXs@cR3*yXNst&(s1y#Pulga9pfIoD1V|}6& z%ZblowM_ru=R;B$qhXOwc@PEA2J3VqsVjUt)B^ezsh30oCm>cTYT(n?oOJOF+6?Co zA8|s&vvL@4e;D#RX1I!$bj~$?X8yDu0n-WVcoSF~ME_w8frrj5*(l|hvMF)Cc0-@Z9e7tzn8n7D&mHqk~Sah4#1gYy( z9pSG9-AwU531zXMAJdh+$(TjyYc=$u-XGW*L*8?I^1VbX`)z08|C2Ani^Aix=Gq}5?q=&t-Fg)NK~q|T^K%EI0>Z(= zd-i4FBG*pVj>546_)1+$VuxfkHpIf@p@zpD#^iIn&;!>fU-y;Ui73Gre-e{ERc@b; zJtr>~8InXz8Pc6Tc>eFU+~E6vDlu}pe1CZ9CyCP-jr4E#bqar4I+KbnP&^6RNMGzx zmU_~Yd$H7Cp($X;WyLGk`6TSLKFcji%l~(EfuP++MJ}0r0;%m|aVhk1s`&B?GA;l4 z^DY*6m1V1)#ao>(T36XQhLca56YyyKnU9|(<~Vm4iO;Y9l(oU9Pnk+qEyx1mcH&!X zQ!67_uDR_x&=|29M`wvSOs8 zgC7c~o__72)nOpNdf_f$x>>%=I&jlk?zhjzXaKjO^^E8kO<4;T@VTx_#wq@Xou`%tgU1 z_lK#s2;4Gx_p$e9r*6=29I@u}1P+%>HP#brKeR?ykU*gS4^{gClh?Y?2qC?4`F*BH z>^w&n2ZC=PL6xPFk+uVDcPfSDf;>PiB&cZR3c)~*{uNOzr0Sp}e8I<7V2A-7Y&t!k z@z4v4(A)W^!SeN)`+2&B#KD60hnF2heaMc;tt;NjR2k)03t`;1Ok#-Rj)+|*tBt^G zZFg5&nqJ2k*$yO!>h4xM*T+XG1DYtxRpBwLAi)gbpYQy>4~EDW!kA3r;hcMUw_(EgIU0sR$9nQn96u z`q8yQd53Dwph@nuv>sfGVK}9~367CabfkZ3m z`R=-meJ{2-Sw)l`Qq%Kw)Pr|GoZGM3k_$CUkvto=f;h}dW5=HQ2pT~&7Z~>O(#?R} zE{hO&lnoID!c8)(BhEp)d&^5|@RR#S`lVc+7^e(r+w%VOm~1K;_U_Bo7YA@0-O2^s zyU#@df-zYu6f;Ne{oiwDT4=3$@^+TllxQ`v_JD`PZX}A&*qY3h;gHP1KdKR9RxVGINrc zxi0h@shHAb{Y>)y%yuMJ;+9QF=Vg5r+0QqkjCl6L`^hr($;4bk5W8*7f?fv7Q*bzm z0CvK$sy0P_g0mr^nH8U9se_1w1HuOi>$a*HhT*!6ZoPojD5cT5@Z>#XeOUw0pfiEy z?kSASE9^Azo-i0FKYS^Nv{nuKK7jOT(DkC1^=GqCsp@l^_aEYG?NjjIbczQsO>0{$ zXV;Fvm2S{$By-r_ZF@GY?tDP8X6kvKiB#(!jKU3it+Czd{SeXaAEDQLd;)7B6J{HZ zl8vXuqiw9l!C-5DzQ!!EL8Iq!e6xsIgq;~eb@S-mBVJtdb8`6|V1<~IS_R``vD4-J zb!uFV?UNle#hVY%NH_9-=S>~Sp<`@nbjZT!SBui`=@%1hDpIVxu0uL{Fl(l#vSQDi ztl^HBtgVYnY}esBb7cOfqV^S7fQY~zS}0FN>G8<5z`a{{dy>b5PGkJ*``t?!_-8(r z<#tt%4N!)~MttC~5?D&r#+Ui(-t+SW(S^Y*=Z=~wjdLUmRy4oR*S@@~dzbTIfW?O#>VH`EeI~jxf_-s%^;5(f@TE&z z^09}BMDa=-drSrG4`ki+ZV}`K2UumkCW1jbg1pw=VD>sDqM`~_2g5Mp42%H+Z##YN z@hRH9(>#9(!qUl&9*%}6V-@Ex$Ezr5Rr>!l^eER&?=&a*6LE_AXUS^Aq`s2&VEOJ_Pl zTgnA15|oZz*8Iu(Z1MuUGVx=?Tq9-DgpgB7H0e$4A^eg2XsW9-N$qWDUPf>tOM9$Y z0)+W7lLpn}V|h{&KxP0@Hv1w@yu^HCc48=@S#zW1u8}iw{D&|!Lw<^?Q}BU|{GLl1oISAxYf%Xb6K5GC~6!@|1M zP@0CVep~_7@HA{2s^gR>?A`ap9Bk|0`hz9>Rpa?z`uYk?b*6QmSSaZy^b6r^_WB_+ zV}%q2Ixnk$#gYONk0@~-pI(4Z`hO0~B<#lgI*}gFu{(cIF2I+Tf5Y8~mO)|h^BZAv zawuAZ$Z&R&AMJ^4Nqy2>5_Y43Iu=|avF2sB+kO00guL+oscF8Cimteu5&e*GSi!q^ z_n5j+doOO<^q&5D#C35Ku(Z~IU7Hpb!*novVS^{7qwX*Rg7t8jmp`184|RtT3Cp}W zH3-{B$4Oc*$Pq``p6T9Z2CD|SbYXkbzs0hcqw=xYXgGAI0o!MuuO7A^c83`nKx6Nz z)0R4!A@8<_)(bp86AqwzUT1I}(+k$6etT@*8)H2wgEq-X&yVowK=6d~4E(0_olE2n z>=BlrqE2)k*nWcV>LJ~O-NTC!D$@#U2z*bPuw=+i5->DLlC@CZVIfDhWu3zFX|Bqa zN-1lqn%qSc#cA`%EA{W?Me(YLM1K}_YMW$bn|!sJ8(?6r?BLF3qES_W}*8~tWfS5Ym-++fiYb-4e{P6X=! zMiIvG5oX{n8JS>dK}GMMqmv+lfZt5o!;cJunUq46bYdX4rf#YAG*y-E*7`X(oR!Q| zc|gpZniR*Xp|-EN`}iQtmHy86Jd!NZ?vX$`<0EWDs(UcAiQ``=Zr0TSqMz9;8zuBz z`^H*!@xqh?UGQZDvc-eP<;}8t;DC%>!{4>8TzJZ?bm7m-^z)%!4A$l+{j=__E)64G zA0Cm6KzMx{Jlp^F&-j*x*LdlNBHFfRJe+)8XmVG7y$yGk++&cXHU@*de3Sn?om0fA z+%$vLfVQ=Dl zy9`QO5_PWnFx?W1*u)w*ZJ{*yxhm%Zy{j{EtZSX~WM#<1JJLcYUG({qaW?O}QkhGh zZ@7L-(u>_)RL;0Q^4XPNRy*f#e!2I#Z=*-g&un)s(0)mo-m$)=y7q%jGce=V=Dx4l zE}fva&xuW5NP1FY+=JOAlUH-BJF7qXn9_`_v0YY{0NUzUsSntdmIWtLE|s^F4+^YR zKe&$UPVN5=x;w1K`K+pK@=);U*bmF{9#t= ze8-HzEGECD*4m8=&HU*|3+^Ttt_9$7F4j_awJ%$dl&xI;F;}{~2v9X+edp5Pa6DQ> z;Da+oT1hX$b#k%Pt;r2vqe!n9i5S{_>SzaTou?heiVrrLgtOlm*ofO=w&i(}$wPN* zDJsw#QL)RUqobrdl(pu%>VSx?Lx)aaI7bs!`t(IwYPb3dbr{wxgST@)K&Hlr_&Cc; z&wIWOS70~A#tPm>ufDhn71cn*>dkyFzAesnx82i7T@yP-;5Ag@v0GW7nI#G)jdXON zx(wt7wj;CC#z1HA@P^=xRnZd-6D}6s-igsvJnpCaG`$(peTm$LBR4&`Zsn{w9$jJ& zVNG8xoMa(h@VN?2zDwpAzZ3y+qU7|m^M(Ds(un|yBYv3}Ef-JHodBv!wkz{Z52M{Y z4pU1a#~3|bz~1lQ=9d@YOiLc%;0&he(^s30X*Gp=Lkt-K?CG=1M;AWlN5xltfdPv} zUoq-wTRR~Vz`op41AudZ>EYV71rfT5OFUL_?79C4BfFRPqZj{+-rO1@advv=8A}3> znD`YI!)iMM${Ob7B-Er77)UujDJf40W&jHjj&nJ)A-PG6R+*$71N|=dlbii-J9xBb zw=ed7FX~B*g(EPXJx%?Hjy~$X?_gnR=g~f;Tj~uifAKnNgd5c@o#-4}bln8p3d7WT7fP9+5>lt37 zLr+Jnc#}^CiMW>&WfLy~o$QG$B8MRtHC0A=x@gGaj?Nw_y{wjvRv`B;dmRpjj9$$m zAN-|)BJ4(B=(oocX`95^N@X%RI;d{in&0tP8f?RDZK!!UdmsKB8S)E@)oC>&py9;y zLS5*Rsb19LWe^aX&9by^G-wx21sZqA+sl{xq%PJ^x#i^+@X8u#9FD^%Q0HP1?4pgh zB@>N&R8pHw>=M;|;THf${>)<8n#$_qNt1w3r1YL?`CtG;WEZKrf7u>qu+7P`@A&zx z!E%fBar!c=r*GYfS3B_^hkSS9OkN=Ey(qQo- zAHvr{TG#rvm+JbEf#(mF6W@19U2|wUD$9b7OaL=J(g6T^OLuGU`XrWXA0-U3O27V) z*r$Uc*`79b-Bkp>UOvQ7*YcK|8b^5wdq~IJ5aV)3Xn|Hwb<^*ZnrOsKB@h#*=#0zX z_V#1#k%|Ov3AKuMQL``CNOI_2PCzGvY*o=Q@t7OpWd2|gMB-FNDO(`Q=V$#?jHD~* zQ?9**1e|k=Qx#2wJ%gqL^nxU`hwc3wRz5^n&CE{B`7P^^6zKHihhKaF5|K_x^Y*Qh z6#P2WD-tj)ZjB?JU}K2gC@l4xgeBi(Nx7n-jdFl;{X1{7mDASK$EHQ~$cH6EF$7(e z_C;zvt15U7!_~Q5BL%#5x~+f$ZF6ixv`Bj}YY}9-YT5lS7ogI#e}8Rga-@mMbkt;r zO?McggVl%?q6AeBg&rlDFCSxX(7iX$vibV~po!p6CnkDAi}i!GA;?85--&6J`_=Xd zexE6TWwRJKJxDTp>>MXvZ(5@RKaQI6Qs}g;~n{2LfK4keygS-YfZM#=dYY<1LBx0eTT+l z;zzQtd(W~U-s*mJx!1QVyQ{uk>4qKUx-xeHX^5Ul(0aJ*s!Wn;$ohk;**OC?+M?$E zSJ)yX0z6h0lfpeQ5fyHi$HyURFDGUQR10{~UIyF3!O0qy=4Ez>fZFyn zu<+&DKeQcEAD2Cm>M=5T)I{;L!M4HSnW;+%@ZfL0#fTO%F$SWn&{GNus!Odba!7D7 z<(F``j$yCsd^O^pYm9=^)t+@cKtm>SiI28m0)sY!M*lk&qj_p&2q|B81a8Z*?c4BL~(d75FRY$|bvRVs$w zj-N)Q9PCsDMJc2jL-da&qUVOJ(k7_$!Hkh@CJQ!47mpR%({r4~5ch>HnTRwk4R*NI z>j&p%Bt-kPw&dHs{ENjMJt{uI|Nbyy#!&$hXNViIM9FaFw5ieIbEFvpN~?Yn4vnw- z?eeCuFgmVWwe&e{j$V%b-WfZuLe_hJuG|lCZwG;UKyHp=A$GBo4qZ#HgG;CW*=1l;4IpEki9_tF+M+|jspj)fXm68iCZ_rS<3s)(>q8OmuxV!Jc%lJsZ8 z1z0Q%6$4HP)#>)23&QsnVrf8mMOsk6PyuuZ(kfO_ksb<6SQ}ae9R$*;84Ge9KEK-X z7AO@0JP$55WH02n7kTq7L)2%eP!c*LCBi z3#$ysWsz9AE1xo|^nlPu1iGR!atk9CA5rlQ;{p;}?N=LVDpy~dt_`U z{?p+)5tRa+$Q`WVLnl&~xc8XT*CYeSmWA=K5WUqBf4;C8(pw*|KHxb%2AnzfYVT++ zW7=6n>mC0}N=(_BoEHZCYu*lE*8lC2p|jM=WE6Eljivsb&dsRysPigclX89ieth$t)k#H1tchi$1-bE{6l(`!&Fd)~(0 zhS-b6xm8$Lxc$38Z^ZA_Z&ckA znub>;;+8*&nfU)%Mi;h|V(-aM#W^{h-FSZ)dllwn5MhpOht)y*iW1;w{ z)K?oFd}Bi38PloPVr9&gZ?Ej<6sdG&q$={-K28C1!M{DJuKx>&`)q5juFR4-~7`pI}=SLWuF}LE9p8*;k6W z)1*zIhw#PE`8p(Fm0hV0!#ARbi3k>0&1d9>>N*>$-d1E1 zQ7vyNJ!J{(8{Kj*yd(f(OvmIXmws{AG0UyP*-Gi!Qv3$44Dj70^X;bXs)|v9{XTfp_(8Y*wj@!IX9&$4MOi;w5xD!(b z0_qI`=*da3P0F!M%vyxTZ&eK6~%<;J+Fy>yYc}IG_R+PvHc7 z1ivlkbT?N*^axGpY?cYOTBCI~_oGoskXkmqJIB9iB4HNynZ}%H_M9)ta-3~N>a}e6 zJ|j6vi!y0|D-ReB?DsqpCltC!pugx$c~~SkPYgB+cWm^CLyl9sdUv8=++98C>~!NI ze~-GA($Y74s9-s|m5Vkk_QSh@vJS(;OZn6S{1P8UBsj|wv3sLHPt%x{#G3pYRCH#8 zGgYS*6ev|sz*Dfz&Xtsun;8CZa*I`+oA!Zew68S31ZAT~@ReA&@?=Z=rJyQ( zf}r_nsAA;-sA6(|)l=k6$onm(EA*ss$d6Q-Z{1!gcj|s;9zXkDOSA-OWmYoHUAbFr zW1MbK6X)Ikq>N0SEMlj+zgf@3)VdH4bHM2gF8Gc#RJ&Oc_9Y}@oOYA)uCrcSmAc4& zbJRwB|MqKt*=S~klZYOOMs~#?!T7s8V=})u7MjDm&7w4!>+&aY!KAGGVX8Se?cZih zj9kX2?V+1ezh}sG?EQO$#C?biRLy>5@$Mz%-_Y0DbIA_4sX z-EfYa-P;XpCkO-6a3H2ReCQnNJlI>*DzOx-*E}Pq4Z*nM>SJ=75Hd%rGys$L?2h)2xc)s0& zoGlt3^hI+>5SoprpqT6A%MFakc~^Rkf1PA*?jQeM&`ZfbJFjicSPDOspp+@HKyXGQmDK+?F`>2+x_`#`9tw|^ zw|q)={P9NAMDkN_$;$@io>D=huC&4X=>q552WFvaW+Hx_bCqi3m=`@Cx9P){TZF^o z0BVl|LiC)T^hnZ-%lW?|DX8+Nzu3;EkZyM4&KRAUJq85*%DBdxj-F;d*TBfGxXHo! zde)4*nH{^M^$xO}z(x%zEM=X{h$8Auk0Nxv|JB0AlS9;I#Y-DYz<12VG*NHAkGln zbxvAmBK^MgHvRb{fR_DH=2XmamvB;wEp_lhy4|Yq#9f1bk}fuWojvuE|HW-D_dtc1 ztMyPfBmCgy6`{Rnnv_2iK-_YK@j{Ne_>Xhcf5&8pZ|8hk8rU}q>&eV%8(H}BcF=J= z)mF*lh{o{Vgn@Frz4?0nZA5EAAZF^=9ZfoQztm-5Ui248#D$)yA_%odMU32$iP7aY ztD)hW5bPFYz^45O8&?t$#dwGXvGcBobYICy7mhqIdz_g(#vWv>>^tDj(=3u0>Flsw zIzcO|`_HAHwUskcVK?IQy<(nSn1HdE6iPP1%yM?Ced8i+Jk$UqTEr$&5E!Tf6DwKaN5!8LEQ#NTyLkKhhJ=X= ztqIXwf7q{JgZk;&S!18wc_N-adqHYxf#DYIaYaXEa=MjHXvV6IaqJbCFW{DM;r_S^ z#MPU_?SDG(!LlukTMwmy7v<~wChd#k5$v~BQbiAk)%dBL@+{bk?2FvWJEXQA#xKnS zLB<);eNE$o=gZp2#^Ro(_tZCe4hz~+9G*7+ zXJ}7fhZy8pBQD-?Gr6*7V2P~E*LkuW%Ybp)R6#s|VCs@g!c)|jvV~v49(JOEo%-5S zZ&KA&A@*wFT47Hw5D=M^T@S6PY_aOYfx}Sodr(6`79!J-b}NM5axv4Y+gU6bxzZpB%5%`X#xB{u1AlZARma-62 zhI7?TS-wP;+eN5e)LOo{c^X1kuJ|T0ir{j1&nq$L zcwzG$w`#P-2wXR&aPEQvwUu7DLzO3ahwio}Gy9l_S?(gQv9O9T_F~`D0>kz-K#_S* zZ8o>8`x{*DYY(I1?yxfoo(~K($HGJ&!m$?16u;{sTCvK^r zi6^yr_UPdI|025k;J}pmzdz7p3}DINRf~9P9OPjP>!Yq0w5K9Sr_n=mi>}|8qWx;~ zGX+UT;1BzPP%Q)h&VgS6w`$DYvdrIG!G zC*=0DU@sL}qIeB_lJn`<=&*MdQF07zs{k0Spk(B@*p!!_HzzLnjxjz(`VG_69eUg# z%Wc%Y-Pcgnh&I`ZDO`J=$7b9I@)`v}4oSd1+(p^CG4FV=_E>s9hYvWO6crFGT8Z%W z__K{f>MwVC0L)+cYg%SeHIL;)l`r6Yny+B#3*D&@a%!nueWO(yizb1kW-ZdtrZ*Yq zQTeY1#-S!8r9ARGFAb&`Z(98B(9sGza&e!n`80to*OhrzHDpj~eZWy6HcsV6x^JoC z_*5tM0O}S|XIYwiu||nv&n68*B9MG1%Gd}+KA%(cI}*D5#$KE8Hmm$&Ra(POQMMj> zA2idlKIV@@U5%7QrgiPLrI5*&q75b6SZhkl@YuUfScXL&e)c#@WYhM-@6*Kn^)LS7 ze=KUc*=%6{FnKE=*Eo2$N%5TQ65jrejFlX2MB7MN!^7Q1>$oY!Xn_%7uuz$-NcMhC z%R72}e5^R~npWK^-cMD`%iE~of=}F_Rdlc2#)E39(}{!2zXPn9{BHhK39naJX3on( zqsNUzQ4rZV15e&v) zI+?dKZF`QiX!NZBPO|&&S^Sufl$r=#= zM*{eL8NjN!hmW__9!X8w%vd6le6O@)VG=eu+P@WP5?@ZF=srcsM3AECRr{E{z3l z16@P9v97(z$k~CKym_k3?%%Cxp6=^c-xpc5vs7Av@Jxea-n(ZId-cU<`Z9QZ>XOLC zI>ETjHGHS40O!Bk#*^ru({=&d7POvVf3gzH_|+V8e)$#`F<0+`6SCMa1Wh%4x!Xq;W^G2uNYqsBA z6u@|8QPJmDn4E2A-?Laq^T+PWIR)n71+sw?OCSDPg!r&m!*xvm-3GyWAps*VpV! z`4-%LDBOt}WynOlmzCk=Fi@z-UHdzFsieTYU%3)HzD<|Lp}u}J|Fmo9 z$;q9}tgIWIJHDHn!|2@W8ph) z!M;0MJpJ9cN_g7qQ-1uhVK*?ob(n#5=- zEAr8fihpMPzk%PLTk)SE0e?=g$YpGPOPHg_klK6x_tT!TC*M6y%(6LoX-&V_=(KgJNS}@4!$Wy7QIClc_VZW2#vz-@@U*QqbYe z20-i^TNK+t0Dd~yXM3AIMQrFpR#WWXl3oKS00o@CNY?K>8`9Kq-E^ZlJr-Z9Ww{^C zJcQ+31!KaY#GWF=59O!HNLi)py@1sSn+=Ais|(X{|3QfLJlT%{v^{n>seU!lqE96+AW4tZs51RPgc| z4U#uK`ZlhS$}8$uiI|?d5ew90|MeL0M;YiHeL?xSPeZyBo9o>@Kl8H%VMWVP%E-~Z zX0jsY9ZJ8*)*y(H!)fZ<{yy7Af~~6x_@l{_#?{OnyII>3L#T6(nQ_S>nf)%={kt%ZLP%ErSuY@8;J-X2ajapA^us z)K5&LeR!d0)>Sk^PktBrHtB8X_zz1{R=x%TzF(wN8o9UQPus%yL1NBZSYqx9p=sk5 zVdw+efE&zfZ8VSH9PB)7HppOx278~a@KM+6x>Cr}5q0Pln-wRR#CpXc&5Px`bMt_B zG0_jkJbOke3eYmCjrANQs@ied9`Jib3(dKE1Y0arJuDPuKUrLQkHOR65+uocmx}e7 z>Gr0#rmiNVvnK-avGKw^`Q$oK+nr|pROyyedt2H-LGJqc=a$)Ax6GvSp?MBC;z4++ z(jA962Id9&(_tu|lNl^A*Pkszc1MXp3^%Q+?cpx_Ba^~A-Hdn7eaUo>fmtNIkE(ml zdiJK5KT-)X@>E4T5MXgLML&4cuUhm}#zHaXY535gYxz%J?xE1hv7FK3GINtGXPvN% zrbE^6VYbk+>;=1T>Bas}L%&PCmwkL6*B9e;&x^Eq{AJ;@xx-qo=E_O@ncL;fTS`y& zYZ--?D_;bxUN!Dr!TBrK5Y^jWTnaG>|MddYj}8E>CHe$?=6V4((n7WZzNLP2zM~Uw zW9}4?Blb;K&C1$zD>h!feq+boxHKZ;Se>P@LA|gs;oNhFxq{R=y11jmpw-NUt$&N! zB)>jB{4&?E+Qe4Yp)NYSn~3%VBe32GX1V$@@S1>-YStF^NR0Q{#RNo(HH3#orM^RH z)(v!2`KJ@~W640ZMUkwZx0;j+!|k`V5SDtJt*}>Ld^ z7;SIu|KPAXsIG*cGl0#c60Rgl%0Y5l#X9jtM##7HRR(lO=xdv*sSGv0K!awswjk{Y zP$jr#u0QGL&l5T?X_TJeH*Ra`vp@-zVPa7wQ#^g?hkmn~L$-EJvx7fSfp*QNQ?~ZM zwx^0@_>vP%7bl)$hISr}=iu`;N~7hnS`1dP7|~(+sM|3)ONvxgh86|TsVH-hBR#cf zxlnhOOQ!nt{QaZB=$q3Rsz#(au_k8#PgCSU;3KFVnKohs>@PNXc(lgi0f$z2-+TEyY}O1V1h zcwtNUI0dd>nPKI@;6oh(vpsRad056u)YFcrGIgo`(&Jd<^A|*~*m%O0^q*NkxR>mK zj$ZRtTLA+I=en)+#M8WoVanRM5<$#ppc^e;C9T;Xwbs3R)WUx7D*oHH7q|9|;!g5M zlaYz#y~4xvlj9+JZ6=%>kd$yWw}Z7dTsYs?$lqbi4HoeHl0RO?&}gVbmahVEiS&n9PmmfJbPqcRtBdX?dPprryP0^oZVt{xXpJL`CZ! zjLRA?^)(ast4NO!?=6v-p1VC@saxE$SUa;@aZ@I-gnE-Oh8`&(?vW-&Tc}~&4Y(yn zYO`y39gyim{xy#zrWc|YmBy9my@CttIXf+~96$;m10#O#GAKQ>kU(beX9V?h7!Q3| zHg<|qR5mb^c3Vzk8rLA1QNE|>AMzqIfl4_Gn=`IDOPRkxBHLWOHhMeVJf0EEra%m{ zYXQr+JT^3Yp8kX;<~eVMW*Dat##@dUZmmRHh|rR~fRaGrXb?l3jv5cF2b@ey;*GV4 zpMF3kgSVA?s0KD!OIEAMoNss$ipp}yI-c0%K?!LI=TBYtAVj}e?^JIft8s0_cdzM8Eawu=E@KG) zp<+UT_!2>N2x>j<>fxy`6Ogue<&<+%FTX1BT6QL&_I&8;WwUO8Dq{_AFCn>~@Nlky zq1V2(L1QL_*RZMM=_5Hr(uAm8>*#uYS7G{Ph}BLCzld;lvH=UL@u!1ge)V3eZbVO5 z82pjwxdPGBxA7=Bkxx#F-3S=)S6GOih^xsI4p>>qCErLFgV&9je}B;otFnUUt!4Do z(!lbIcH*^_YLVj>Erw^m)1*@az2_QI-Zx9^Xl+{U`@S3J)Y96&>JTak0G0KHx{}P1 zlG#jbR`1VujdBF@zT-J10@0*$u$qB?I*Rh?!=@F^-~j{qh4WSI!pz@1b2FnK8RE8b z1?rC1ZjYmmLMZBj`GasVcT3vZ19~rX_6^p= zlT%P2l)-`7FYQyX>DG0vC}mNA!KQ~lUmM;}`l=OhKg*6zQbrp%>215V&uzZmr8Av5 z=5jeP93k=u*R?n)v<#^Yv$5|+^w*eJ1|9z)(#2+y#s1zOf-A zl|)*i(vw6@ri1S=N_-0-c{i(K)2O(p4e?~d0!38#YZS-RHNVdDgy*~;4zn-C`)X_| z2wbQ0LB{E!`Jf$l5QALZS1WGwldlKnX^hj3dA3* zI@h|Ja9g-TTf&(F>Ej}}m3XbQoioZ*SxMuNFW<(pKL*4jj;G=pSnuBK+Wx}H&r!;X z;O0&GPLMyUyCpbm0YjSaUus}8ptahD)^qcfEZPbQ_!A4JlC`({9aCjumnqf9R<}oj zuN7AI_v6w32_Dt!QG#N^nVZcgaCdf{JPXLQ|9D*lGGgU3L}DS23(Sl+dD?DfsP2o@)LN2j;Rkf`pu> zs6t&{`IST?w31m@jzK4y@Cv?^ZjPU)lto)mLy&Tkyz(kG=SbJZR#646Sy{X5e(=g0 zB^LekJ3uDS3l`N(&OaQF@pLx{>Gs0g+xlx&mDMP9=3Rl2N=QmT4tqEYw5uhcP-tn^ z)5oE*w`yR#=kx{@;3i{QQQ}e-mqshSrMFpl)CG(FglG0avITYqD6RJu^XNsyES}X> zH1ZN~jZfZgHU1PXqA)&s1w~*^imC*bTt#JikhpJ(h@{+vfU7nN~RhC=4MprZlId~awI7c$n?JIU3WHbri?`5n~MH!CJSnK=BN{& z+z*vBG+0SQLYdp#uyi%gKbFBKe;~>{SJY&~>7K*3mbmWN><&I|oue)ul?OWNFSr`t ze%-$1IZr<=!lO8L_^ZJA@;DZg{vxpc#qNd0gMDPx`Eb0%$!4k@TNw6&e~uu@W8f<4 zm;4=HhWVVteHe4=KM5j_%LJve?LE+qBxJts`c2WR8N_mk@pVn44ldM7{&k>WXkYpV za@E1ZIk$mGHFgM-d04`$_&J2WQ+!+erp0VpQp|oj_4WRLZ8+-y4z?OE+YTkuef$%K zc}8GAjd{cez@n1&8U(L!3U4w#9oFFzKBIWEHexZl;_2@Os5thYM*9>S0c%ijNoMN2 z%pS$VZD{@#A#;tm>$9h8s+@cQVmp*p%a{BGpi2^)aERx8HzRMCTOW_R4U{>SzpuCRbT$ulKz%I^7vtUMN`q8Pay{&qmINjuSj%XYX zbqhu+9{e(vyV-q3W?6|ZP>GOG{PdRAAw`F*j2wN(AZ!&GHyHz?G>cK=96mLy=Wm|! z#MR~{Y4d1TC}MW=*k2T-yBB^fyN|57|I=L;Sir@@T?b3KSX(onY-wZ}9a6BSgFIll zsfsP0ed2f1@}|^pgtGVzT41r3WH)r3%Z>$CMqxBKfUahXb?VM-6=F@CJ*-v_P67za ziZgoWdvz!m+gpTR-W}2mV;V~Njm#;|{4O83Vu9|*$N;pk+mW3LIR#3nHs*0)Fu5w6 zf1E8rKsR?NTZxhX^>EI?8mfQo$4q*TZ~6~SWR*Nz_`CT;r$acW9t&ri?N$i+RU6Lu z2rto-&Fr|FG;PQ^T4IG)ShM^5rRdCzU%-UZ5!|&7))?BpVMos)93K$-l1>=+(N9|@ z-;|)B^4qQ~1XRMI)k>i9NERss2Y+d&6uA}MreExA1Rvu5bl$f zKxR1(#~i?vSKODo#}5JEcozu5k8TPDL(HKU-f;V&?yBfrk)?LzmYa&%Q^n@=vPs&krG^_@*sI$1TOKEWM{q zPPy}3CM@f5K-;NKxR-l{&f6YGng5~hL#KSic$&_x7A6&46e|+5b%-TEgk~`JN}dWjNtbg_e7AjjA|mO}U~LxoUZ(Wqs_?pc#Xhl{qTkUQStG zC|C?-6lMa6@1A@c9U!{S0SOOdI_TGi^6xx~?XX>F|IN@V^_n!4o9-Nf$#`4bEzX+h zBU8A#D?f*)#l-f}!ypGbEc~hy!&|hbyhQ_qqw7#%Zjw3ry-2!m-IeW<13vPh6iu9X z7xIf*L@`D2BgrQ|`g1(`Yzpcig_6KW85|!&hj(jSS(+7kmJ&t&Qo6uXRK9fIzvCPP@J=9cES2kffYkASl zjmyXnRT8wdPfC~|)eqWv{#8)O>Q`m-@&rw^%s@^S^awo|v}%Qx94`sy?M^G3`w^nX z_kqoM_hUPQGF0&U-1%;F=C%a#qv5lWi|{@at)-qo}mwn`0bj35J= zZD=s`rl~weYn&WPJ9+MFV6oWpexx-7*(`z{4uF$NZF`#3hipZCML0*+HO46SX_?wy zP!YMXn&Ct&&noJ*2M2m_`OtSibD>8V^?6X?+%cJEYhC(NX0!L=bllVCPia_Spoi7s z5!;>{#Nlb1!nEJ!$L2$Vacx6m#LT&r zFRRGs9@+d=P9@!Y_`yn4A>Emo$MndOrNK@K~4Jk70@v&&4vhbP5dz?!;}D-n_O6%8(c69HVHwIoX^*P=y01)+NPWN#};Me4w*?I zNqiUx3nKP}Trw(sjQpp7;Z=j4Z?E@#^cw@$#|tj?ZXsJ>Fq_p`xAw;QjtwX(B>M^O zqa{jJrz+3Q2%a?$;miG&`#QpiW=$cA?^y4V&ljCm7YaTJua^)kHFG z?EdbSzC=?q@g1C`lZ{T-8f?|H%?3zf98Z<|v{ z>9t$wH|j|i>~5HO0pN~T#vhWO*wlo~S2-TC=o^u#LAmXlymHK!# z*g>hFh!4ib$=VYpfR6QWkhzN0N1YjbEwN@CE! zh{Dmlq7tLJylbFeMO>%r?ZcHsDB#V65~KDj%V&aRX$5}yuQjdf$^U>!oPN&co($2e z%|=yc{9ngIb?};Av;J5OnVb+GSdbYeXrUxoGTtP!2FZ*)d*~3gbn4cALw72o_EGe-jwrk!ys$bSNr#=qZKe z(Q#Ju!*jI76QC5u4f!mEMw+|9-&%R$4q!3KAv9?mm2*^{m`~Xw4{YE8CV47WElcin z)dTXG1yp%Tj4l#E&)(GJl6fk-)2fKWXdk-Oh5ryi1;ln1=<-glYVvQAZ2AaSK54-j zeyTpYGRNA)ma&Oo8xtC%s1kh57rWRd<_gOf;w#;Y*dQm_yv7A3pRA@U;lN5`6uE4P z0-nR_Xm zjjX)DgAv>EeMI@`v)ocE2QBfWuy}3a4xM@=iNw9>(9@t6`&BXm)xxdn_}I}e3U%J% zi4EZIT|Bn_;IB}i&>w5N@ABVP8$-mqf3k+~Y;_QFl7%{wNWh1EeQ1Bd#2ydis~M6ZX8CH2o<3oWpRt=*e-0Ldn<4=8g&u_x3f9RzrqC5 zkwS3L$%akx+}P{8FVw~svlZCqXPs6UdM!7(ur=p`L;^%*G`08+-OuO!><}L8&FJDH zV2b9@*A_vf9+&-aVq%p|=A)<2`Qphmjh|1nzs90gAv1Am^0A1FJjMTNtP98%9kbRy zRN-THs}URg<=c?0M(630iNMzZml{(zr`j^1cqSk%9$Nt( za*vDRDSHok_) zDBDMYqn5gKz0a{CStO$|(=oo{oVXQ z%+q2DkdxB=2tO{+nP_3=At*P;2PG)pKhbYfGyqwqyJir+VI5 z=dP2Ln-wrciZssu%Qx#kHr?tZ>?S`{);?bKlxyR5F#&VU18#uEIHhA(lCYvWL-~@A!@Ouy-P`&g@!5dnw>Gx&8jVV-k|Gm)&6}M zLI5qZo?Xidr>gxX+D7mwt;X}DiPx6_vZXPrkmo5G%{MY zz5a5E2_e9tHFlT{-#A}k#F1(lB(kfWLo|yp&+V7H<*gka$Cq>0cyggW=ejkm3X;4% zsT~NsRDH(YzlwE5YCe(}%TQ>Pd8n;$Y%?kl*EW5r=~Ok7`J?;yY#q8@e&YvOg<-C< zD!}mLNj}a|h3B|ww-pulE;g#*0vwdTP<+cDshrxvu_5Xtjj|8EhY^Ry3O8TMP=2He zC>iQ@DfNkLw`b@!YtH1g6s|U(cE_TOWeT-*G2ZT}v^EL3HJ55MuV8;IeP#lo zZm_1^{0V!?M!!07yIQBf&zekA8zqe+zlfivKdU3V0!!x6o(L=c<+U}W{mqq@4G(Lu zHW;#8>8n6@XPwk@kDzsm&bXC%3o1Xgz@i&#z>4*dt`|(hxIwYGd1QLvwDsT43`4g6 z>17ulLO31++fWF0dTzRcHSO)-KP+!7AOa@(_-<9Ag*Z_-&HoDnVeTIqRyE;oKWkZJ zv-51wiHWhDQ;D4n0~##$TqLy#PO8pt!j#I}oK>kzeA;E@e!Oo(TfAn4o8^{E!fn

  • p_38LUJ?QYhl3-BjM`AtH95XvTePHcGELGZP_ z4Kg#MTsHVA`JDApn@Y?X8J9;!EONMOi;FS;{{c(W54ilOD22R@3y0m^KTP;CP*eYC zYWnKr2mhviZPNV>ujEJ$hp|WSHAI@X+Z7a5PF>E9M?)xC5(TUGRF}sK7rW-$rQ6yB zO-;`?+oB3ZM3AX!b7eE|NKfQNL3CuSf@20XDU+ih1=pyq*rOJ?niBo_6P2a8`OL~l zu@?9JYxCT0(RYtc!0Glws(|s(5(}ocN$QTW$oaxvd-*F=mV}xY3v*F@>d)qA{lg+q)z@VM>xAnGb_mWx|Bp_1Ci=Hec zgL(@L92~{vnBLwVCDHgq5H0V}9};-qqncf>*zf=Kdr?R2yKp4AoTg)nJ*Qt@vWbF;^nC!45o z+Y`BPsLH2fpbM2=5U`uANIMBhuzRtBg+P82xG0Z`TzgZX|K}dt)XMzM#Lm|%b>Rf0 zE5ixiOIxh4a&Qolm~PS%JrUlWZFTP4x4;+sg;$0qHapSuqPyY+m;SGC&eXI0&efpZ zkkqr8;n_{*f3K;_dn_3wk=kW9ZS)lmu=RYf^(GOYi@N=FCrLlbr_h!ly=Vym6Y$ld7U9HUh8~Rqn0~EFQdM(SX!mbu%oK^ zSW~k=hi`qc+lXJlqqO&bjoL|qXFVvN^hA}EZXuvp;abUtMs`sV2c#{kfsn{4^fl7a z+wAV3`ZCf;T;sj2=meul|8fDM^*SQMXu1!N<4AuizRF0u%NpzN?yhQTYSYyPz>@>p zA>re*?&QVb*rjDmq^3Dotm&tx4?SGFc)C@OT-HbGp&{tFX>&Gee1IY>Asv4-asT7B z04Iv^D(~_n?@FKO+++ct_peiFrB-Oljj?E9EW+#p6S>RyKzBtT(9uS_@O5eh`L57G zbsEa2S8w(_Hwg+CSt++oyE(&o39Ozy{NMW#juKRhY0?z6Zhu4&OWMy!kU zwAY&)uZitxf6CEuvDYz^Cx??Gb*Cw2=Iw^4_zQ`e_il~WK9W*1x|=zqDP!KMHgc+_ z;xwDA|GNiYYbqHUYMPpE)V;*^!+ugH=nY&jyRFs;t$)a`-lA1hB#B^@9tkA6s5bAb zdWlM2W)es*r!8nZv2bz5QkI?l_>%!B?2gfH6SGFMB!hNhoSeW1({_>`2uS(fS>M4V z4;tY>jP3iD^;dQbr;m_&Jr1WNASIFK=A1V14NwQWf?QUs6h@17whTa)IM6v%=ewz} zm7@jrmLUNjqM{?$^o{!~&E&7+;cfgX#l&QIpu2WHs0S+JWE@Pltr@Y7N*7)d68JsN zGW6&O29FOT)l^P@=YNSWWVaQH@6?^0Z7?ldUtc4ubk5n)o-}F(aFjJO6EtkUYuBC& z@@VL3jaGS`OrxR$er$_*dgP15LGAgBGa){q&3G*(Qss~RdvIW3f6?o>XtgCw0vFe0 zeje7N!1;0e#0Ey?P*Rm6BbQ)O(YTIIPUl5o<|rt0P5{;UK19B|ZAIVMxG$vv~P%F43Vz*Hi7EDDrJm!`qeqsvES!E~Qg>ptn|+XLG|dxsi< zm8IT;x-j+|c6P|eLj70`zO?X}nN-vF&p-qvbfjO%Z(?Zq|L?!#369oJQ$T) zIsY?IcA{%##pQ9Zk0o1Crim?A9gMKf>LK6~ou*es#k})zpF;8v(xUSRgpVAyb^@O&4-x zN!$+9NVYa_w-D7$!m1}Si2vnMalBE!oZKxA`}{G)=5F{ z(4jDy+P928Irjlx>8&y-V=1eBM}#+%1l*vk8knA|Znxb_XVX3W=@Vp%HrxBUkKEXz zo}&4J8}J8jZ}9OZSz253Si9{q2LYfdzekDL-pVF3$-Lqw5V12Psyns)4+g z*2F)xnbI-#qxGdWVZENCG0a9i%ahkh+^RM1>qoDDV_UTs`wfI&A_$N0{5W6g=MDp+Z#WQ^ z`KgTFbQ)6Aoocl?W3#Yxkymep+#FfB=y@R+VHAUzzyDGWkt3tRlkd9KgYD?PsSO zX2Nd)*IQ+7JvrZ=u62X7w{&w^zysTQ!pg?@A0&|5R*;megKyi&^y_B6(Y~{@hiWdx zqT&fk2K<(FbHdB^7pCajaJ)?ckET%{L5|3|A7^>K6jHr>MQ(+gah$KTwGpbfjrJ!e zwyNIVvzsVLT~NMJi1lQR)q+eoc_|B({&|JdUeLkXpzWXjOsC!M1gV0P3U#eb&HS0A z5^IO5D&$jgwbxGJ2{PrRt&JUshJ5w+uR3eHb}bdx^Tc^a4JzmT-|(X%QK(-9Jf*i>u1lk|TLp-&TaqSVl*9t10^g``NQ= zM{o8*@|T;L`ToOubl;@?2VPZj)4vR+5+lL|CxqvP71E`;SmocH z{l&?dt&yp(jQVeLU3va6LKM2 zY%6Y}gkn%Zkb$DOoGJO9l@F=M;O6*T^|J0^^@9Afx_j?j@o}9Q*M1kOy+M03Nea{q zpM#NcA{;3k+yC|)N-R=<_1eH z+bh2-aVXjTA%CL}2ApntE7h8s-)3f<@Y7N*r5_jf+6?beWB|dm&e@|=S4aHTAz|nUk*VkZ`jmy+@0JE(+K~rv>q1p z`-dr%Sum(6CkHkW5?{LRfpZ+#T7VT?RwIZeGL~%wJtax*>9PGpriR;N;I^iHvvxX= zLlg1~XLYhRB3{eN^YjN6DLN0IgXJMo_l?IvwIfN^zmr60qQF)UxmxKG!h-psJw=)b z&bW}+Sc&e$*?}>b&ER#OzJdhpY)vtTE2oP*ctEtjPIF(5l6_&R+(8$nZDS&>jt?fS z`R5Nwo?rN5MTiGctrHtH?Gg(Kg6o5xaNSRXhU|`x6@HULUzCjp58}_yVoG;9erFlD zY=%45C$`5pT`SDHZ zjFI*}N-@E+We1~oOsCcSwDFzprVs*ridP+A-DNxq8<%Iiq=>YUZCmOrJh0!YW zo<8K6MI)EXdgQg_s4JJ0T4e09xFMSaDwFOSOD~-DM?Xh-jD~|4CzM?amkQYn%&_A3 zcxO0Eo1OAjkG)oxgK~c_=m~ffTP%EYVbyaPVl8CTDs=gfGVJ3`Ayl$Bw9pt|&eBK+ zWzfaG;TnesmcKprjP=p{hUBMd6ap1c6u;^V%`Iq`K$8g9k!p#^)Hv1Bc-Lul5d=G; zk2eze-JFiLGi_}4ka6@fBf=HGP3yi zF$rgPl2NlH+7H9;Y_h2It1Is-*@=4pheHX_$ z@~=O$JDnxvq%B7-4|H!#o?(siw`Y>0-Da!l@@Rg+8H@qfgu?tIRlMe{0|P89iD7>E z;q95!vm^Ekis?o@e<|tq7koJDJ9j?7k%%X8z|CLcZBsn|?rh(x(&L0z>S&hy=0S;b z{4=jt`^ZDbq1(vSN8Wdr+R%_CKK+N_S{oalCiFFp%M*Ib$5{Az*LuVI5ULe(6{Bu1 z@;~msJD!b3+gK*{j6_>Ym;Sk|1;y)IM-IQCWa86h58vZ53!X%UP8_B5)2CMusMn$go!z6R z_LEBo)+8 z(T+>#I>-U+PY<|`R_0=k$IOA;j6}s(?-AH8 z+xngOG~*QRJtFIZqz@wHx%sz|sT#`7U`fou?(64wTw_w|f9O(N+t}axeKWniKazIi zA^IzkdwXfL4Boa}Hc_>U@|4!2MFD(M$#2-9VAo$a^ik%G;2Anf-G{u9Gi>x5ByD_C zQ1Mb42&vbH0M+|d%b;KXEm|~8tPd8G9aU~;1us{rp>ZN2qG14Y9N%B*q_f0M3^@#T z>bUH;4FB-^F@Twa#mM|XVAXEuj51L67aj;Ji;5e{6?^T&bVHaK14rTzJ-U!h#wFfEcc}gT3Emhp@|BR0Z{%KE&Y3gq#K{_n;%ub`90S)v{L?EpansaDB(ZLTMC|k?{f~`SAtG|`U9I;t_aVJjzk_7 zN_1WEElWMzpB+szNkge??QFFS9t_iw(3Pl?bB+IGo61ra|CfW(ui5`QDw-*lY3Z(a z65M_4rr8h!YUdlqfhOGtY;n!tW21d&=qC()p$M1SsDg}=@cDCCWtw5HUjt={<>FIj zSeS05^N5fcOsuDLCGrWn-sCas`j}iu{qJgA;@)b%7<=OlFaTO>>vi$86`)MT`Vc1iwW|8fVKtl95`pnYRQ>s3ARlA;Z*qgVj+1_Dv8#73kqp%~LlfomAm2s_gp8x#wHDDXv&#>9_ zH$KnPZrZfHHV`}shVW}=XXopM0Du;DbxVS8Xsrma)11*DhZ{mE-@bbHTxjd1cV&+y zwCXl=q3eQCXO8fYhpg*$>ty_n_)=S|aB-IQRVXi7 z*2jFIPAdM%`~)y_4ZoGu@MbKO2NT8;WSC_ELjB+m%*hYvUQTJ+c_2WeDp_>mdhNl?d0^SnBRfVrFPgLO z!8&}7$H%#U(of|jTqx0e>y0qfyuMcuJMJ`|5gFddpZ38~Q+al3aO26Z^v_#$TSGDV zQk&t=IW#?X_Q!Q9v|Ng9wgoT+C`laYGqRKirz89w_=RT##ziL<}v zpo4(UhyM2!ApC``2^#hnDZW337FJ$dU1G*~5)YvAh;R`#WJGzPQT!Owrjn zDLnkNTl+6%AE;xi(6QJx`nO&GftL={#tqY8cVDD=sdbAJ6H{b8Ue^kbZaP$Q>lW5J znGPh%$Hc7C@Ikf!dB?HK!5N=N2xjJ9!`%}}_=$Ype+N-gKHa)6rk?P5Ewv>OUAB8LD8+=AfRfW;@Ac@N0pFIDAF#9x6x*O#Z&F_$^26u+>is-=I7PrX^E6dYDvon(jIzAp1yc7 zTA!8vop;ye>JU*Kx##rIn|E(nOs@=Q<^J(3 z#d?)jy?Wp-x2s*{mY?zQE`q;66plxiM(4sbSx?U6vNtw&I7iupAe*|iq{e*j4gx5~ zTwgqIP5~@{yY05k53JUw-El(Bg2)(lxwWBzp^cH;vB{jt+S)qBxVz*1rGc8x6Z($$ z(6Bg>l|3vn9)(MzYRQT(1#xWLq@fQVa#4MN4Z&LR(M#y0fe#1O_u$EKw=>mH-;}6;p%zeMP%a9!JJg@!(Q8;=odvSjc(MswF~P+1O$m}_OyuA`N1T} z5w6q?)ytkbovfCXwNFnYJ+rwZ7^|ErDhSm>{sfny*iWDQJDeZTzNT$I+oKcFk%4@R zqQ+HGQ&qM5y@0hf%9N72I#?ikzC8>l)gmh$gF!RHETHK;_MyM`EMww}%7g(w%Moc6 zOXJU_u_S9j3|O+WHEYk!XDM$!vRDJGOVakicrhavJqf~P_2=0$WrhZ0lX>jpWYo)& zPpfXyp5Eic$@d){%vZYJJS4EFb&-^O8ce~xd|WL#@u=2?pg1w|!tomB^+6sb`HNLN zQ>bUB-RDl?C+*OJ@a|lrW@4y6;Y3MVYtZH5{kXS;TQieZ@$yu@gXT!ZWdTU#cYo=| zNUhnV9n#Wn#Qc%{Jrnn&2i-w7G!3CZiGy5jt4fD2=cHmcDA;Zx+9wsQ?d)zR5w|8H z#Q8*xY|{NcE3se@g`|9GAqsrR#!90X2Yp`uY`8gVUrxO8xDdG53GsB^2H)z>B>IZ&)WAG2&ZiE@0zT6f_ap>jy9{}%@z3F;Bn6Ud1ZxTn^O4rV0YnU zh0h@KWO+jW1|N)3!-};8hyc{Xt`D*#lzT30Ni{f)EOXGJBR%HnU$Vd6Kv4a0J{B8B zdkJ~;`dD@6w={>zmfeY(j~a8mK9w08QktH+cd+xt@BYcY6VB;S#0nH8 znV<6%6b{&wHB?JIm+M$em2h>o8D_K1MKF4`>+4;(t!FM2@}IS~J&lbc;dkwc?7sb9 zHNc1dvKm0e$r;r!y~Oo38dqwIotvA8u&GubVs!CXQsS_t<_;Oqm-kW#8MlB^h>Xzk z^v9c+{Y`Fewr}8wRO@29l*orn2{_$Tmis;}z4ZKfXj5AvABb`c%`MslIKV0==j6aa zuY!k%^F`Oz$-$S2s^#Za+5l=@{q+TNqIe!Zx;sI`LkGAVP0h9PPe*1qh3u#5!h3t! zMMR`atTG)+8qB&$mREshOh`zOh=Y|_>C9Zte(8^f>R7A7q+Q^&>Q{Slt{YqLw6mCu zb?pi=m~V8UQ`%K5frFlybU580E>yd+vhroLgmY^p4(w3kIe1A(FP<}9YX3=jJv(}) zjl3VN8TMFD#IUgyXe6&lX2lokFDIZ$ABk`5^HrEvUTPFHc-+EO7DfiGM>kN7>--wC z2$^*E)>WW=?)2bKPDfBksz^G!>j`;+d-G2-GZWLuNc`2Ml?at<6FjiVoSY{-ek9Mx z^{&J2KUh{4aW?f25BL@o#5CzE)wkdteA^5v_8#ZqetxG3YfMf~vUZs7d0A3x<0X8! zLtrEC?sCwX5KIiu&BtPzi%ljyPEiO>u25REnlv)_y*#oGLm;Ps{4 zN8dEsS6b_VTFU_!{^$~4Q7%ve>erow$k@G>cg-(kXvAb;$#M?aJY)J7Qk0fXF zZaMn02wA{LYzZlw_tnk!gAa6R-k@-kk8$Y#M0$CCTDDNAF-s|9iK zu^SO)t2O`A0yN;-*z_u4ouN&DI;y?KE0dRZMqK=iK?YJAL?19|rt6~-D1kNq@L2x7 zcN9!s43^nNcC!bj*DE~+I~w17&S5sP5&Sh;S(f?){Lp*8%8t3?q9!IvHGuCWY^hrA zke9*1lNC;>htpGx%0E8@-5nV@7H}sMbZ7!HLQ#+^(^N!g_+yeWmbJu?K{2NbzB4Cb|YU!JD zbnZI5`iSb2AF8W&NJzIwch$j!!{!av4uONK%S$T`MM0ML87{0dGPqeSKMRV8C`w7F zC0C>9#7BgN_H%PsXpc)&Y=wEdq%x<}h?M3&J5YS`L~IYMg0sAstG=PZ$i^V&(~zT- zk5RzWHZZ1NkG%2tsuLDXdJt`t6QcjzRPuPx>*+=ROaM`^E&{y|fy@;_WNL9Sxwc|@ z|G|6PTf>X;CzD0=StptiqBxZlsXxEh)Ch9(sVRynK2s(@dT;f`jp+xPG9}q@?{91~ zxATmQqGS9Mu_EXUX69)mXHn3dL2y`bn#sP=*`j4#LGInZmyR9#^xMg6u{W)v;53nh z&Rz5(GyC}x^^h@xE}|b*ShLx~%jR=&lOf%F@Vfw2V0}Gq%mXxZG=ck!jPuSGf7dzj z*x1_U7!NJo?`4nnqL$u*(epD)Lgu)R^(Qwia>8hIN^JGqH^%ggS*d6CMv8s-cw|TO zXK$A(Lj=~(W^Vo-?K*u+OOF<7si?=+4_a6AZuK#$W^7BW_-Kj%69%5pP^A5Y&&o<*02`}WY2ND#T720~v zh2GhG^~$=VW2n1#9gktR#>z-q=XP67@vyEg?qKf0>9(03x6Zhz&-rj%$=eUP>B9g;~oycn-ux-Xy@!NZT~&gRx*OoL0q$6Tp_EN@$A{u}mKQ3^szq~;0jSlT#h&NHwR=R$7OBB-z>FUm(oyO`Q%lQG#&C{?QXHOcRpnS^kEkwdKdbf;pG*v6g@(!22e}Vd5v&HJK9DaWO z>f-}mJkO@iwwxdhXN!wWl<%mwsc!@mFlrEMAXHgYqYD@(^!Or{+Fwb z(!|=@*xLFDv-p#$8mIfaOTXGr4sz>{pS`}hqR`t{$f8rhXW++Iif4}M?oOgToST@~ z`9&h^zFOB*+r@4kDW)~2VY2mI4|G(Ox)TzUF!kzNe)f@(z4)e zZ_5h)Y;HEQ9@$!^5)!H{sc;YUh>VJkjh1%{}d^L?;i4$7JfLdkB_qQAcsJ^Y&8M<`^ zD_eO~utsrsT@J}IHykKeYm9ep5xWs1hepek-WaDN#wU?PA$p*C|7SaL)7=UZ%4Z;$RPsHuH!x=ti#d?|`PUClLl^MEYsQQG~ z9KFor;3=}TCqP6(l9`q^vo4@1D;w4k78P~NMkn(gtbK#My}dEHl%341hKK>(r_$|e z*+V=w39F|^v*n4>9_0=UFhV;zG4Un80>?>eb+9`ghIL(CIi8I#E+54Q2akl_arQdV zwBzH0*ewl4b=tZ&7vAB@jmf3r6&6E9OW-amtE@!&8)@agw-Nku{ZzpLf_x=qWgYFB z6ag=QL|Iv_9sbeTpT&dK!}fYXefwP1}T_^%C9qp9*`AMD#ZraUy zcX?N)3hi%V_*M%F&KTxcKZ7Fm5|Ld;NIdh2X@~A3qy5JZ=z-Cf(FaGAp&mXVuBw7+ zOIyoRc_|_SqO)Un>#4QrLJ+)|6tueF3HeC-FkifE-wwPUfFk@EZJVvvzW0dd zC=*~GpHjYv923@rc-cPRKk8kd8m&iq`f3=ENH%Gy&@XROY)bt-io9fwGSbq;n&kbG zgOc}-HjBC&NCHqRH5^aQX_g-Ym~)7zvlEMg|B4Uc06DlrieJ6M#!?G7pu$(NLYV5XxM!aV|~c=G1ajyfZw-Lq$n zK{ssDw~bV@hZw2qYVBtIl51C!1Ug;a+~8Ko`=32`Keet6gD-CpunSwd?j-gWdg>+_zkbke~(Wm^vzmlxOm^he!SanggAC6qI)GZ+yTRlK_NYrfD- zp5$fn(%*v>LX!I=iD1-`nGka|jLYS~cFgB&#;KBCIBu3$i@0!bJPJP=5w@0PCb-kN zC`D95XkuoncY0u`X-MLsAS(Y#WwP-}lR`aEC>Ivzl;_=4y-3`ZwS^oKz2tgFX_4Dp z2Dg#BnOsGwm2MmKC;P8#(869;lvLzpPiOC1r z@<`R*w6jyh!ZPX2#zDx)J=Vu7?@>)rqN2*)(x`C!7ScWTXLdX?l4OMT_&8~_sMTe> z!poSIj&8isq$z=iG?=Vh#(KXq{%3Y}RkAlEaxn7xSWC;gH#H?7pa8Z5IkdD4oG6c- zfHeuo5o)H6&14@>Nm>q$-Y%ONxb$_a-J93fU>y(6%=N>tcFI`SXDlF0UcJ^^R$zJO zPDOFCqPjZ1+WvoO%ZfI1ZpBnuND+-;S1p zy6_C)Fttn}q7H9Yzd9eI8N=m+?m)sE87tlBI=33x^4o3F1n!y}SLsJ&i7{(<<~? zmwmCL4!7+%RiOynZYpC{l{~~&>ScE}Ovnm95}#9fZnTus4rTeUAbBg+bj%D`2*W`l zzt5Z}gk}sP@}}+`v<_t2!dN4f`_?V%E#$K(dW2xl>Z>6}p9_hks)T#1{=l41$p)U*?eNXk1TxA*z+(v%B-&kHAmXe~BqGj90I_HH3 zmr%Vgia>SMSXp9Yh#^~hLBV#$3HO;Ng!Qbfo3QK3qmawj0tZ{+lx-u~?&{O0PiGbv z)t)`GKD+np*Dsisxq<%WZ&=?S?H$j%m%iSL=*NpkykC*U#lHnu{@E~3sZjSIGILP0qCUb|$iFY+e$(@D%omYJKt`Fwwl_kYF z>@Fx8;2Iz|4X-j!7I?0Y6(e~jN72mfrFpg%v*#a-A9~JgO=;B|95j4Rdh%iEtb90d zT)47zhv8y~M>Ii2WiB(npy2d)Pp?V~kZU9PM&=?S?_a;Z`yQW&U9ajLa3KkKj z)cpKyjg8S-JpXMnUbHG@77ICW`M$(%ZZ2s95|@AgxDmr$ZkO-+?+b@tc>OO%0(Q2z zf--~{lyLVSolufu$=q;Go{-h-#Vt>^Z`EHaONsfxqOpHG!}1}zn(2c7G(9PQVsO7D zKbO$q_9M?JFbZmUbe~3AUBz{#>OG6SURj6}hA*GmM(A7qCJ(0Js@DSDxvT{bsd=(2 zzK!sD)fm5h@T3;s+x+9;!~Isc5m)!WkIq%T57>3sa5?&8f_ES9o}rXuxw&t3vMi!%2P*2i|_A`|Nb5Im)+POD+_?H5mF zJE_9zUsb=o5zFbez1eR%StZrc(Q&ja@d}=n6O+&BA9+vDYo&$Hi8$hXqodm(^GQqn zS)O?PF?pAs53^Qr8zdC(RSrO_U_CN-vTed&3Yl=q1Cu{9*1&d{btbeH6%i5FPOx-Q zP*PJk8jt$^tC|1L^JCMc(J5rM7SiGBGiYurvN&uS-Efvb>n#_GMMf4rY8R`Bbo&tV`JIP zd!K^#B?^WSZel)A&(nDNR9i~Qd!Zu?QBYDkURM5IRP-7KUFC%?r(I%`Cu0i=*nlNV zN@{7d=*OGY9P%YsyL_@VxA^5t`cemTk8j_uHA6z`OnB8v0q)iYe;#bo1xZ5KeAUkD z^~IJrKsT%LI#IGQ1E#GGO5ihG!u`j}%CV#Gi(dBk-#|kn=1sIDKSk;W2HGZtQfq1` zE`d-{xij`f5gnlg`NWFBWX%C_Eb zEq#RHBn;jV@X;|<<0CBUJtWAeZ)|HJTEs3b6AyuB3-XD~$ST~g~2*x9{Atc)P$n1le&$l6*bS9bxz8LW=jLYQ&h`JH8E$BLn))$Xu(#n1>(MrOC{ zBl>@L)T@RoLc7lZ?FLDPrsm{}y$--Iz+Cn18{!@dP+9%o!3O_#*8AkiZEETp`;EXy zE0oVG-SoaV&p$n-{>Cq?srgt(CqFOmb;ZWfLgy45)8JuwR&_^o4VkKYSqN6)5#hJ= ziY=mJV+9fI8qbjAWSCa1T8)yYdhPuLMuK0wXc@13X*rM$#=rB1ZFn;3Im?iwB{gyu6tOD<9uQThs}I{KQb1UHvB!uktwX zC3AY()Kq~(K?c_4^Ul;l0j*5!t*wjh4VOcJjurY4q!IofR?SN^@1-mlEk=a3v?}+q zo`{QAl$RHqDg9qRJDl+rvGD3%|6G**18aAp*2iTZbF_rHwUhZS6H{1(e>nlkN0?ZT(_(gaU<$K33<9+Lm=4};9t0u+<+~y4GO@~c55&8;fZi_^wSePQ&UlC zYNEe_B+9XK4V;x@e7JcmH8VT8KIwB40jdBbd84Z%5`&G7`PfB3zA)=X4;OdY1veyfmv2}>!vF6hh=@2kIs(m*7LU-KJ1-jzff!lhp!@$k2Gswy!{?lww48M! zpSfC}3w3dEt_Te|LO8))*3?xM6l97~U>5jzmy!Fy0|14D;2(OOe&n=_#zBBe6I$a} zYV&4e=ud7@(a$1t8cB?(+2-78j~I~BvO2HbG%;~QTu->lvxCr(rY2s;im7e^EcjRO zCfC(9!~LxA!J-nKnK?@I?SPi1^Q<%VRVUp2{bXC)JM{Em%eA$?E>U0KER|YRlu*sU z1wSA_P(+k^-|AL(l*6{_>FX2gaNKRzyvv zm)@nO_Y#=#|E`B)H%SzVdi|dD_1Z)Hx*mnqvGUp>8aV8rc#R0_Jk0t2eQu^V{nMw9 z-^T7UGkd@fl$U2bRaawtVmYuTE8B^{FyyOi*Zh!&7X23=JJ_V8{;ZG2gz{9nBzLsm zj|{(cuulPcV-*bzr|BQ$0Jwp~$BN)xPxtPWNKapScgx{Sqckv|5q;opn3_KAWMpEx zf#vn_<3|;B^^DJ-vjMs^HAO}H#I|!^SxG5L&?`DLR9#Ii{p;6n>FI-&E-Ww_zr6&E zyH|dGa5V-6Rlv|0KEMt^#-EmEZewF=V*@Oq{Ut?p?Xl6*Q%_FLVnFV%E-k&Vsy!Nu z6RH6G&DPcngn}j44lvOm+nA`8j|>MzO6aFw{{VUn%;#Eba^vFSfSo)zFz|@)fR$VA z=w)GW&DMra+h*;iW~ohZyq1s6VsBGk1x|`{0nEr%laSliUPB4M&uzk_al2_8f2{Uz;(V&2YG1P@rh3QYxu&; z!CVZKx~*wBRE&`;!cTs}V|#=wO^o;d_;C}_tqGEslT%X&g~XpW>NQvwz=Z|}0udgb z`30W8!s5=7qASpmh$qV(Vs0!s@;;k7m}~7L=W{MlXDYZ&es&A#O0F$)TsFkRn>8)b z*3$Br{?Q0749a2e-YvqsQor?bFCB!dNN8-V-Sm&NPoHiwGc(`&(9%K#<_SPwJ{vB4 zmz~XIQ43}^z%MjO7Oc+1D*33jBM}4k57R&BkkIh(-9782f2bcku(7hjr#OdQ{?)^U z6e`XZE_Qad-AMu%h@4!qgRs!XLg!6hot|I$L{Rh~g_ zoq@sockdoDZh0K<&WF*&py)4jD6*Rc|Ks}#qkEzfe4FuRgB5Nlp%U(}nNqtT1j7_hg}S6o`#xMn*6uX?sJQ=x86%Hj{7bKgGw{ z*GO#!ZSMq@So2j_M7c=Z-9kkqnsx81Z5(e+N5Hd#tnS}8?es)_>TMiQL6o2hmzMUs z?I<%d6P{Xhbo6=x(SK_qrF&-9usebG8q)4PNkx5cq@#me%kybK;5u0X#v?4l5H&Tm z#l`u1ch8q3;=#ZTV7ds^y?agF-SX6K9Ekl6@sjP&#N3*XiuI9UL=7RTXF??h*ajo^{Iyw@wx5o+#qrre;NcfdI+m#Q9L-o8+J^@Ai(WB29?=o|8o?bhJ zxWi=~hzF*o#}XknSA2_#csOVno@9)F2 z?H7eluXJ8VL9nns01*J@h$G5!a-cDJVU({<#G;$T2 zYHBXV%BJp z$4fmxJLY^4(X`ke`7pZJp|?#F`$U|dm^Xt3NvO0RoT!hT8yF4P!Ok5IlGQ;kmrvr7 z&`n|9l&i3BP1rG$YiVg~q&IfpkBkfNZ&xBh&i4g)>^ojJt!_*fuJ@wVs{M(boB7p5 zcA~Mgw31wNyAIdqWWnh|@T&(-(rr#>YJ%PIgTZ7{H56fcamLx&EU~}+Bn6E0PgD)M zyF__k76K{{f#f;9_=D05(*>WrJn^9h6WNdTQauRe2>sK;WjQM~Q@nK0o|j zZL4=*O6oG-prIkZm0wt>s1%NdtT>+oHrZI1^FdbDY!DfbeP+RS;FVe$i3efM9FUPg zN4B3ZE}oQ(rvMlD*^>`+D##Ijfkd_Jk0=NV3Jwn0qw7fR8P~7&_7DApVE+)Jy(#$O z6Egy+T4vfg9_SU9R+!1NBOf{2-$r6n@D%(S8$&=F_(=E~8o&VM+E~mww==V{h;R*{ z4MT?5+h2o8AXG$C^Pcgb?F8+{u){Ur^T5(O}G~74V zAw!8!2zehJ@9`m!RDI9Q#YA4d3{h4Ryy9C~2^dbM%Zv%oeF)MN;zHA!z~>TQ|4I63 zz}~v0SQkNSvN#?UIq=%<85!XX2i}S8C~(>+Y72Go3XK2#m$V zq#TN1ynDB+n3=K2&L1qD#0ZPu39JYS+= z+uBcRJx8~039UElN&p`_;G-L|Yys`#Ytz~B9vvFkLhYsb!3oA~bBHP|C-)sVLLqYl zLvyWo!=ufRlw*<1*@IscV81mAP5=6`gKHGv~| z?))U^byE7oS zDso_pT9*|Qwubf}q)!n>_u(T$3>O#uS+m#+e8TV~6*B8g)!d}U{Nbi*{2vYS4o@hA z1RH8HQfY~9*?+#wD!4efxv75p!^@>*d#<3Ttn7tQ5m+KUm8EY0cbw@;i!0GQQBkq7 zw)gfG#;At+Z7?6rK!p*s571YE;Ae$`HB39)yl#C(?9zUNd<{gF5IR;q2({(0R;v(obmdc%04V7SQ z^voN%&F8!|(+DiHNui&E2mBsxsmYTcveYP{43rZHWG+ku$mj0Iy97uA{}DrZog<7K zgMlz|6MvV*Ez{K_;+8`G$w5c~gXlBU8uvY$U!QZ3o?0KUDT}#M*O&hP@pP48QK;Q^ z2nA6@KnW?OrBpyVq>*lGvNEje`Z_LJwf*vx;mH%KgX||yo=^hd zu{E#!_)+h+n!T0PbG6Eb%e~shj~{1GowXH4#p@Gdekm}6D|hIZcaFGX*1(1%4+MAU z)IL;kBt|CzI9J0rSYi!;7T419t92zHFi-)m`-liBEiIDKr<~-Hl55Z-giExL@;W0o zU7USKq(C#6n`^(nY{1XYzp8Az)SWh%2hN#!dG#SZng|XDrZ;WD9!PImKZgS9j(F1* z)eJl-gNiv##z}fd(29q#&l>!d3b5a89dM<=d8XN7xf6c5YrLZQMn76mPiUH{Mi7K7Gip>w)^kjm<#3mc#C3Lw-@KqCuoXZ@b*;f0@0 z-p02NO`@A?dy0a9ay0!t7v=m3e3ytf^WxD9U0Enin-eq_=N8CKgLlX+{s zczNmG(#5_C_w7#Jx&i;uv-1lfB>0F#(v8+zgV2g}u#i2$5(tZQJcKtEEFo>zGBFVq z71|FTM8eSG!v`@0sO{~WeZw$`ME|UmHC}0(zkM4Mt;+F!T1r7@eyI`@u{nteuo*kT z(WyGL^Q&YuGH48ck#fGDUN6>D6?aPslq5sM@SGftjG!KVHKntjYjvlh;#_?oNTsOs z)7CaYVl^D1!qE^#I*kzP{Qyx_^Y`TV7m8;*yHGnj@9HZ~>v^1$OtE^wY!;zJKWJW1 zZ}6fZ;L_clvs@pcns;G#Qpnc7e_#Ln0;^=}@AuTU3UkSk5a<8(Lt3>m349w<^M!7% zi`6xMk(yx6N=~kg(sZ)N{fcovSGo38-$4{(V0%b~&+V%(5%bT;7Kx{0}}#4 zN!212^bj2ZregC{l#GmpIir8`sO403&CScq$HD+VT^-K)`4h{)fMM4K-GoLYwl6>I zSMKh4=Wbo@?nn4T?(UDylJU;n^SDkN_c+?d6m)*+*Pcv|A5lK0%oWF1#KBR%A2o1K zmDRju5nHgJ1bidBZwckFyCp)?(-5oHwkir{=ca?XywHTNJ~V>4?Df?!P;uRBGIDaN zi7gRrYD1DtA7B_NQvXFbJRXp5r>C`;aC&wwzik<)T0W&6mH&F_xvrU&{9A=tmquJa z@+4oBrgSSIouBUa@T1=~UR1Q2U*%;;Q6n_DJaRjb8y$8m+ouKIcrLwrdgzCIUWD8P zZd@KJCI9v|Zv1c=kBe;_mg>ygMvA>S$%!ZK zf*U&rIUt_Ip@1D{-*x%AqGk(*wm51mT@ zu2s4S-4|b>u&cR)SuXB9;Ei}$q-{tkIB0a2P*<#TK6|$vChD4+r^uec!4Cr%G&$bx z&c6k+MV}mPiE%&jpYI`bs8sP8x$W8d!XiXr*R4JFp9l94&il`(usN%Jb=hdLCP7k- zcv&NW+|(Y5a&}OPgpigtz=`E`xsx;Zr%#?H^k8i%6rS#LZEPRKf}s2F7g6FYE{AjsG{@)qxpk((d@)Q@ej}dTlr)vuKNy;Mj5I2fxJ> z-%ltHNIE*%?rWKv=7ssk#v%p4N%tEYaxWi0l~icHi6A9KaXw(yyV?{MX^&<*z(@^C z?Kjphot?#;Ql6hrez`$5*Rp*%lrx6+~9m?mcE`9#k-6tnL1L1<@ zu^HM41BE&Lrf*VSkq`9blk)y*kFH2f9rBRAMY#{) zR1F?i0RYzI;-Y#}E|jesl%IAPkM7+5RH0FVZs!Joy=oC30mrweQOV`F z+}uR&?hSC(na%#MEWHB^tbQ0tz{pgc^90r*6c3PRu#o_?yMGR-R5mu_RnP=+YJ4nX zd|}5(qUDD8R=4ijH-+wO*aKVhL^Gasb~EyME} z^Knz=Dyt1-=oBqv*q&^-5FXS4as%}{jp22SH2fnbED$^Zj{)*Trgp22hL{+1F_?{n z*#@PtGKCEE%4L2kLC;}99X8eO1-X1&1~t}5)QYFfbfe~2lzg89T1#`0!PhZvWJC5 z9r+V()HhGJ(-cJ{loCYGG^fSb#8dly)PF&;7vReyWEp?v0NysD-!>fyEiF~lpAQ6g zsBvIzubbh4m4n;a-`$-ZH8sM~F%OH=^t3e52Oc=rhh)#k>)AyCm5cuId$C~Fx_U7i zVGfD6L_L57&ik`Yme5;NoVaPD@Swg}pM` z|Jinz5^!|`02FOklny!5JxFTtdLr}ll>%2@$Yk!s8f)I3;E2sp^s^CO-&m2#e6Oy) zm??d`qw-NO$qRQM*e24aND5|VpUurak5Z(s=AWRq(L)^0{0M}du!;%m=!Da)Q^KB5 zQ@20c_2=l3np5=$Zkbqmix#`P)#0Z3WNjs zQ3~RPemH$)Wa@8Ye9E!Zg(?OZY#11yfHNwdq)|Z()~=W?drg=`ca@Ztp{10LWlp&N zDVZA|O8zHwoz^^V*>h(bl>u-lSxmW$*VEZ=aJ@A*|FyG$U9KQ+Xe*;2Cu9BYl|93Q z`{8}~ILbKp!_uFpqZ0mM^-WLt!YVB;C?_uA$)qhGr`ST5pG#ZF(38jTG+TE;wFD!t z^Y$m}*<3XrLd!zKx@ruBLN4#T-OctjE*8pxIBBHE1Ku!41kXNV{$-B_=vhvkCsm}( zAdYA>mWAC9%OSJD(gBtAq1*J!v!$N7Oqm7amVNuSX2mvl{0IL|a_%|2{Xk|S2!OP+ z^Xa#@&FY-|*DiGV`P)TN|Lr50t;-1w?4BQDL5bNVjTukl(DYY>7z>fPqRht6`Ut}wTd`9Dry$UFRMx+m$*pM0y7G#q^N7oU0~-F^xFtu?``x1#?@%$nevSN85+L!L;i6 zj&BsnV}TC?2}fJAQc^on?EiffI`Y!eFV4Q!I17>J2?&5ZMJ6zBc-Vs!d{H4F8jNxP z0uZm~wh)?%)0j&$l|R~K1E*aEJbGGMTK+}^LP}bCVSc`WUT2_eqE>Zr;ej=GAlvk+ ziK>=Xe-#Ve>Z6}6oVRle3W7Muh5WegkgPV5#sXDUUET2Q+gr-wDftXnJ9Al(|B%he zZGSFV!*F^=hUy9aEYS?3kWF$u3$jkXece+U7z`R2Ez#3XJA~Zzs~@OHPu~YDGfVai z@@T+-I&mz=j+#u5iIQ)$hwf5bM1Rn^%Xp;I^l!gNoXcpx$b17^D(#t_z4bf$)wDk! z(?5pvVDRy|5S{z^e@@CgP*U!f-*|ry-A>JBDcHuUc)__v)s1(4;bPhCL0+EI#>RxH zsmR_g*AP`nf9CJEzyT}0!4c6Sl1;~w)?3jVm8CDy%aL9vT1B5c9Php+ zhn@&Q#xyIvl_B;7g#jQ8opQa@#&ZV4H=HS1aPK;OL0X6OI|M_4y-sfxZEp!6_ zeVq*3#MCtOL-LdwS@MhDW*_P@f`Z(HME3XhH^-~Hbc@d~ETI!L-%HR)9vcoW6oKgL z?P-DNr#jV+JInzbTwG;kIH!ihjI7*GtgQN4%@^d1hN~8)VWP~j$m8mm3m{30NfoW8 zrslx+R3i{J!9-qocFsm7VVcuQw=goYkN@fzGz9H?8kK_S8C05D8$|4yBID%L)VtH) zi>Id{>c_Xc0!o4I_I5&!UKIfW-?33U@dLY9OG|3+Ek=4NBt+bohy-Uc&fo4Ox%J1W z%LT6+IdOKW;c;5Os2pKvMCGTS<&CE=8o5~S;btWAryqr@9-o#7b75x2G>t+ao8ELB zt8Nce)He`FAMPHN!*sDpUl5%52X7IB6cXz;fBn-1;L)VA$!S3v@u(-G|DXBH&=*vH25)%c_D`f-$uSH39hV=9X(RZv( zMh1^odtV~2#Wx^oSTxpPsg?U^SKVPEom!Xl~ zw`q0DtGE5L%UO??Y0i%&SXA!$BkXi5Ny3hisIHEq&Gu96c!4^ zn{A&#EJ!k+9V$XJB$4t7mD}Fm7C03$GN|)RUEQB*Dk?T>PdltFKCtEkEN~@Fyw3SV zH-C5_*&X%YgY5Co7oD9F`tL8#MXao>U}zl?p=4(Vc`wQi4#Pz3=a9PycIayhFSOOw zYrcM+Jy;t_6ALMLT`UE4{EsJ2PSr3dg9#e91M(SIy)iKGym@&=#BPz9nMulJn_gIG zG5r$%rq_3UW+5T6o2cWX)i!8}mqOA!>euTuSTwD?3Lg#atSh=mF0kJD;5;+|+i$Fr zjFV&k-hH!^faP{3o#5fY0-&(@n-bjNIvYHPxGZXB9&Sm*Cb)vuAbK9PF zAJA1%ncSIEJ=);jm}40p98Ai~vExXdwWRXidh%Nq6(R6et)8?LBoPfUWQb+*-G`ZJ zFQmj&qZX({NnZulD{1dPrhfBkHr!1VWvIhsw7g9QdzBf8t~Ck)%t6#m&CMviNN4>! zz3-5fm0wQ}SFeoa(!GmcD08+l3>Kc;rgoRn@t<{$8$pV#L~EKE-yi0go$ zAebW(vs-AME%~T}`7qd4{oY`3XM@Df!y&5duF_({jWa+%BO3Vq1;xA*5pYmPS(DKpm7E9lv)d{nl93~&X$nYWZBiKoL&=B zuQfAoT&h}d7G8#TjtvV9=~7jdAxQ`?D1O6PRY&KFk|&}?cl5wvcFFRLUk7!(PB7T^ z+t_;n;3H+LG9{f%{TUocm`_J#-cH(U^tiiTBI?_Q3UgyeLhKSf4mMf+4bDcLLL+N8fB$zEVj>mA=l0!~_yf>(6czwGJqLcP|#% zyNK0eHCV)kXPF=#{sk*52ttsWCMRWHzdlB@5smP}q8QE}rKc*-6vI-qSlYd~OHy<1 z-WLwT&-W^E1xTW+s=hSv^?=kwsq(qQ(dFjm#pu#!vaN@>dwfq;y!_F+^|0r9H=SHU7VXK+y+T4lOny)F0hvGMSIOVMTzq_W1x`i= zvnd8EnQa>kFrQxeo=OWxFRZ}lGu)^H-jJp+RJj%C4{=WG)58J-S7B9dLw!A>X??)k zx(4^)H5Nb}j!RQmpjJBEtk;k@@l&nT)!KTuI+5bK%i`iSC*f6?5WDl9RO)7I>`lr z9oALl%r+~S+wN`5~&0s;bW;Vx$}lu9EH4o1n8N&Lm|O@?l(i1* zGxp?DAsr0dPP?L04Y|(Fj%y10LizchGo=VCjQa&eMAUGq-@lD+y!x(~Rq>GEU6?o& zph`;P!0c$(wYGMiYS4x(sSB8XUmw6=(-0P}*p%V5TmqXdEHspI?r2Mq&3w1KG(ILW zvTdWTDkU@Q|?Sy1D?e|APa(K*!=YH(2OsZWeNLg^Uv|9i5)$W*~1}o;$63g7xVT?LT6k^5D;( zi3#sNz(c&WwieQ>)OKsAT9%X4P!(1xi|Bx&{d7pHy|crCg)JyB=#}Kjq8*V9>3oC9 z2{KsB`WqD~nQ5C?lM~)KGV7w=FwW_K$G}(r?By-f%NSNWl|54*U)FsE$9n{bu}h0) z@SNjgVw*MQKzt@x5Fxh^;@z66kBkkyJRhAStv7qMeQl-vh=M*VC3}AJ`6?W{NbE&- ztccv96hOQuW0RQb_5bCHf7LqvqsBb^e?@UHSiPEoH2|bxKxizG-XPONX$K;{i6AuS zcxP^RZ?CIMt)!#`M(k~?aD68wQ9z;$WTM_b*&5;mvH?}O*=Sfx;8k>ZxT22EQ^=s| z8>klx*+fEO=d8#~OY7&Lee$G_VzJEw1<6&Ak+jewt))TZAj^Q?DaW>OubP>LPF@n zRLK6CX?|rvePI$(B2#*1VNU*6!?B(Zw#}xK97V)?R4|iMR;c)>dJ?|0j>(Q$Bvo z^!V{*xmd>aPrOEANQkVma(PD;cwmjCA3tDR9GdNW0sO4_?_O^Z@2#vBX{Ckv+ndvT z{&dQGZ+ZzlYCq`XEE<`gWc9H_xJyl{L4_q;b01c>fC2YJNVgf~HWW0I~F%A6h zfdN}-X=QHiH71=eLoz_0MnPjcFMiJ7SXEdE@du@`v7C9TmG93=Wf&P(l{9-ZPistk zV@w>5>hJ7OyANHt>Xw{NOdMskO}Ubk<>Wu&T(8P&>2)iKyQoUU7bNk?$|}7U8kW9e zf$JH*F;`cTBMfrDy~EX1G{#c@w|y@3k5iFnft85>T0%h$l?If>u!rK~HJ}Q+cluy( zc(|=C3)D}m9pTZSVuH&nKDno@jpk7kSXSRD-ttfhzCMmlAIKjV0}hOgjJ%FzVB~>} zc-0ZbgkvV*uFV9Ym=YI`z6%Bh`j3jT2Tscg?!0AwQ{3sngVq_dqbM4bcwAtLNzBa3 z_Bg&pHzzlz(mL`JhRWO<1CbkI;PH6ApF=V4#ACJos4Xok7#4^VjnHcXL=rD13PKMT z2F?AI{5cC6b?H;k37PIT zl_J12-i>be2ryR|Ujw&32iOikA- zhkE76Z@5oR^1-++F0KuWI)3KCI6g|){wysHxj@Rjb2ds7W0Pn{QJ=FXqAJQ0;48enX-;eG-V z%{*Xa&CT7IM)Cx__3`7!T=jYfooRijh?J6&u_s}SF49zP z)!E=8O85-IjBidzAzr?G*<`bix;kHlMI=HUAESD&T=Uv>P`dDBJ4%IKbd)g0R#JCRo__)0LH!tbT(2t;YSL zwb?I(W7g&H94x2@Ai>?EU%RBV6yn{jE>1D=@&YvU|7RoeaDCd317=)(E4DXo_zXz} z2M6Qf;QZPY?OsGhapaAZJriC5qqnU42=Zuq*dc!1b4{ zZ>B47Q}t=$1+*nf=K$$kQO9_!vGpWgMn{CJy|zO`fO``T)~&m?wuFMMaPkZ@C7b^q zy5ucMz9W7@i0FOCif}xQ*~1mEr^{VUe>Ks)LDcp+S+Hir4#W9$qW#U)W&s$srp&@q z&+OSXliymr6}mY;@9+PqQ2mUi&0d8m5e>1_LwrQ=ochw7;npe>&7CZCAdnWjNCP>y7|)khpE5=fnuo}QIubPMATA_X}5F!x5hF*U6QVZOrL>3oMI zh$`TbYePa#En}O^(Z>sl1_nMCJQjz|R+zU!k5XB--ny~gAZ?|x-fyFA_kscOY^71X zJRYr*#U%Jkwr;XKP1;s|`^7fL$teE=s@O#fm#W13f||Ibq>zS-36})G_rQYpb%ap} zSlvEGLcC@Gyh&i}G78FGQetB3Ba7*{7kQ9D->7%nmaCwo1k$+GU%pIf=>Y2e^;3!) z8ZP7G{zo3KG`pExWu3|blI+b1uAQPzIl(>5kyFW)R zK}B}Q;y-e$+~jqt z+kI+EGFC>#hJ%|_?PUAzN1*6`C*Z(mZ|`Y#m7s;gjo18*ccrL>CSX{aXS#-hHZ=5= zLXc76O-jhBbgnea-@+AVRreYShVT>0 z(a}{Vq{sVq>Ze^>SesKbOAX1-OwfyoiHk3j@ZvAV$i_@qFgvSDuadaWEPYz}E3caM zqdaoeO4ch|_`9cJoscnCwf6m}FuyZaAz$7y+F~Bux%#nLESMr{E1unEwhMoUe%LJE zgn)qAOn)G9?<$eweE*f1WuvS+`!Ba-7PFr*izh9qp;q+dap(xNt5K18qR6t5^#blI zF*ABqHR5NEjtf?&m;}zJQ)!T6HAS)0LyBuj;iKTb=Pj6e=N4(T%~>Xr7r%_Mh3S&G z8IQ|DKcxTiTR;T!{o-sZ87_;}!moUMuC#yp-saU}c*orj?^qr#iZ=;N*6|CcVb97i zC>~u{qn@ZEEHxd5G$>9M{a-+!eSf(A;zNqKj?Qp%b3of%ZjSvyX$i9yXwqj}!YOf{ z^p%*6MuEuSaCOk>SB${#!=(VZFHTn@w8m=Kl4JSJP3BVe^meLBXu*j_#w%+4^)(-p z-RU>irG_sx2DGpRO`hqswzFGK=G1=jrNoN{y6Wo6$`^4;J-xIWw-pQ7FAcBbx*Zki8P`*&d#tc>T{= zQ1FDoCBJiQHQS%{R8msJjw_*SaI^P&wO-p{B3HF_^@8N@@p_k$2{+mxQ9B0*^+tDr z$i0eBI*k@7^w*K`z3kpnIkW5r3r8lM^GT8A8^6zP@n3OxwR>T&G?3PxUN$_>j|?z2 zm(hP~e8I)5d{Pn~vb7ce!)${%f-$XC8vB#?&sJ?WgDi+V_q=*{PD+GWZ6~s17F51MZ<25Dk<3zG=xIV{`S=&j-|X`Fkd9v z&IajAvvZd^o_ovVlUn6MjYvWc7E|}{5u}^FEq={barmU8Nc$)M#k_930S?YT^n+`9 zKtO~JRyjj|*46Cv8)&YvR+&&AzbGwZEiPk~Z%E()3FI^>tgMX*>EIid9W%JYOuYuxZO_js*(>R9!Y$acrF;C^yLiE(kq1;G; zJeA)&Pq#)(XMi{XQN{Yq3zrvYv9W3e>Vz6aOQ281FE(dV~00+9I&~_aEDV`+L%lAG0GP-f%dQ@dHU)DpJA#HiF<|*iH89 zBa>reE#JSFbc%JnqEtxc(}Lc2=)Lkk(9-umk!w+fnyRUxf~oo*a!T(81_y7Cx#+{9 zj3q2uu&&ODy^)doetL;Pt++zAQGn3$54=WXn*wbFnITgQkGYItt0`Tip{|K&85$N@ z#(ICTP37%jQm%5lR0VKD%79m~vpaA+Rd&VBOHF<5HWZ?m)dTqhi|;!d3)A}EMHU63 zcfm4G&;GV;uHuWQG1l8&)hfBS-kbA7E=q+>`R=4654Y{7Dp$~&vd-E4^~1VRAoWW< zHYTh?-vAB6CoDmJBH~Kj%>Lj-t&6kRguB8FNdxYlLN%|==GRyoe78}%|12Qju+)6} zwirZ*HF?<~TD8HAuCWd8XN2wWKg!wsoU>9^UDbetZ@gO1+GbB$>P|pZdirpsWgD_* zv?@0&`geVzbdg{4x?;Ht{gF`TTkLu-10f z=XNyI`pO!>NWlO^olL9jT`IFgbX1f*^uvhW!3AHR4f2N|aq{v)!`(nM&Ae|oV~S~> z8EsjLWxU3Uw+JcbwzP=+Tp2_1KJ*W#nHk}~$4Q=wk z?!H>96E}NCaK}J-Wu*wPt`LlaEf8n=k!2pP4XciRO-&WZP!J}!dV$mky!Qp4;}bg? zWOv=-n0E}2+U>agrDQLNsIpM2w!!_PrpMrXbIJom<79~5jKGl8)W@F3HcS6i_Ahwv z9H+{rXJ#V5WK`XT{bpltU)Yb5kDgkj0a=o|x+d^|8y?a+c}1VSc(K1@wYP6Joa$xs z!l4NL`E#0Fvr5dV0^0C_xpjCBky@5W_s-{gCYP+NtiKrZR~;C91dB@w-+p|6;iGG8 zuvcCGmsrMScz5fO8begQ(AugPMR-SUAgW3T=#o-4l)AcqqXo8Dznge%VEXP|nem!t z;6DJ#HKKp-R6(^!^lHD~7cS1c!izzLh^SAZA)8yX3S(!_(B0;2ZAZAc$nZ1A>YScq z@3F8BP^g!cz0S!Ye5##}gVdOxpI|i?HS#ykVRil?4o-T*kNA(wE^{lR_AQ?XmwKjL z4_04bZwCfRL&o3>78V7`w^l}(_)Anso`F{wB+d3Z%=eS8QmfLHDCxpG4AkQof-9m{ zlhLR?q`am+TmSXLtb#gHy+(dBIT?uDj63vy#z z(vY^Ly^Hgj_?R;A%Ar1l^_vOI3wXjcd!JuO=wf>t9YOHIgfhD820~+Ow`dRk9^O-J z@_XorM;wm+)z#p_aOrWC2>-RQO262cGHW|K<*46pdVxQw&m6nz9hpl^ye|5gfRxZF ziQwBuFEp&!n3&_UvjE|*+uJsRsn0k$7dj*J+|CYj#yJ@o-4;5P5pOIl*&Q~CVHEN7 zxChjU*Way)Bf)RMWN{#{J|nn!^F>cC6<%O6uM3+Mc{j%h@dJGPsRlQ0=)fr`yaZE0 zH4fU)GE>#7u^ipv$Mi1^ai)0~jvcw(n)6e~XKYQ)`QgPTslAZK$V*cYk1_r%0$@<*#szlxU;-1bCBW znvK?-yc86ah-YIn9qtC^^(*{d$-onC_6=&p>vAk(1F~bEG)||xF3Isle_>~jke45(k)mzfUK_TgJwiqViGsaeVFO>0a-NE?i;2nVXTnmX z>BZj~!c9HDe?LI@dnQAtRJ=pO|NJg7hd9qjh4~mBJ-y`D=g+irB&F$27 zFbY;9yx}{L@whwRaX_#QN=pz&O3N@cGG6YlC?Y^~(DYR#kcXES=@C8s8hlfT>8&l< ztmv!VD_FX)5Yc^pSk1NOs92xw8zZ1SAVak4mw*(TjK@)KbOyFFVj7$+=0f=CyfT?% z*FkkD7ECN}4^wDuUM5txfOFUHW0hMhEH;x3Zpo36d*@E-?hV3^2%ba_?`gP_hOEuZ z2+yBNNn@H?q5iYm{{NQ&Ss|g+O&oP{siQ%(0O5zvnq()G2V!5!{hU!M-o7uGjT9S0 zP^kVwvb?2N4!-W_b5{YiSnqeE^=I>;6xcO22?4l%H*cPTVzqJ$F2J&~Tp77CVJH$Y zuo~?zPK69=w$4v9+}%l*ZPn9~Dz`5Jf3BG#c^VC++GVMgbA0V)F10?~A4`7f6oDAkvhj6YyJ6?zBD1|g#}an z{W&0jTfl8}eK+Ji6I1t3U%^yh+riP#&dl7|-QC^ktfBWEC%_y1GKiGqtJDz^BL4T~ zX6-cp)%fnBw68d&O2=^MvTdBW(qXly&cXS`MMSLVO|QNT$tB6?LZw1Q@=!n$KlCi2 zG!->oe$C2K4YB#RX7qkYbo0EI21fqe_Uo_XlVE0`&wL_@=OYvZ<*#?!+|G$BXohfc z!(j@3El%ZtWwz9v7+~yeBFlj1=j#iEJ(QR4-+%M+60)~HOcnC;7KFvy1uO+qaFbkH zlSDmF;&GZ?SP&t0+?f>tvC-zZKQ;xy=iM`Ob_-Bhy12OLeoC`h>c(E-Lqqce(bAWW zd5CV-hHy4MzH9m58ss|;?QlaevNP9))YRTi`{}oOagOo!JC32?Uop~n$_q^p8BR~0EBLnakgAC?clLxc}6If*Ujuy33o02M*I48bI);HIv%gw!W8}OH7IU-TaezVr`J2t-?1xIrP<9 zFY(=KOzqLc`>S7AA01>B$kt1Ck`8@P$OjUPO_;AvjDn!PWx)xUUtdp1NB}z?s_>5X z`49o{m>`;!XAjNJk4vyg=5qrF0*3n-WW1ja4mZDi+5YIrR4AJ)8&wC@87!EeU{In& z6yT|O0GnOROjuOgKfo!yhMvFCbELhaqxjo1)e05@+fZ=^JXKYD#+BvwNRRj%XT7xF zzU2-u-PwL$Sy6HMqx8Sp`{6BEiehk0!`Qa9HIpq7Vvxrw%=0u0F<+1YE%5UE1j-I! z|KN7>Zg7=HSWMQb4SVWqN$fWF)mlodZQqruo|s6b;2 zBG|xd0njY)WR#Xk8kZ_7TW(JVK=Fm?qIT8xj{K*kp73m?PhMWiC`nWYGn--ON{IJs7u>Nw z%$h4<#chdBpZ_jwGO4x$p9`Pu$lQv>CDWJTxw7jy?<$!Jl?!U=N zl0waDWJF=%Mq~hYwPu6Uo{nmvCKV9+)D>vw=jS8TqoN}tMa;HO&U_^2*EU`TubNj@H#g@})Q|Cu>v+!0hG#*2c@vaI4`&=lx!=e$CK| zul*0l=boU>bLd|}0E|aUVY4X{&-epK6o}PJUabn+EzT;q(<`RR-M@c-d2J04cLO6M z`mIL;q*nONP*;QDW2Yz!3k&!oXaDnavbWU#u55FnRt(B4aL@1~b5BvoaoC!CfYD{t z&F6B+fW2MoamCm7Cr6QH!NeW$%%JoB;7Y{l;fBlc_S+9Hfp9fmtk(uYQ0$FT!{6k8 z+(6Kk`qo6fQezdiJrtjSX8i8#RJic?@KSF0C|!n`nfamJxkQ$vMQ6WqN4x)UMFGhU zKMjor-Gi&t|A;F8T^jcU?d}o9zu%r7&5+DmS+yR}k|g=kp%04<2`MpvCLUYxcMz;3 zjFT}kj|32Ig+?EJaEy(M<1`!5L@bZ=8FWR-A?^kIja$0Ndnbog*MBSygKy zMyhRwV_9a(pM-p;#ro#sd$~S4t67Z_Ago*b`oY6kDQ7FI98IR8-%nPJHpfS2W|n|g zba`sJ1|fSfzvw>N=j6n~`xpfr=F68$A-|hogX-7Qoml&Q&dTd!4X&H-ot1@+4M7Iv zS7o+qhMjZeG*RTJ;2rk|8b&{?WUFdo@@X2p=pd3amOf7EMby5M_cLUgg%t$_BI4rr z5U$5^`NlC#;NiuWwxBe|0U)aRdz9h>?PX{w!70`Rnim0i@0xuwZz-N_$iD?sz zDrA%Sl+Dk_%U&i^M0fS~_ruPfNE9Z|*|fH`{ru?@GGu`wL-r`N@nE^3KlAhK7csqOBnJhoxUyQetgmvu3-I9Yt`bCMYO2F%eEVcvRQdgL9AyV=yrC z{-s4WaPr>_PQ-n-YU5ICN5mM}NjLsM9=c2=x`n0><%^3PHay4(7zw_8x12mt;{@}M zH5(7Jh9^px){M^AuaVsXRmdrP@*3l(r1vqLPIgyT3y~iyp?&zkm;3Z!pF=WQ2FTU} zy|h=n^n83yoe>WZ&)%nayjxZxKmQUFV`6SD%Ah~+t3Zv#VYycu`gK<3S!_n5Zec*D zAwgYfbA1LoUyki$g`h1+Dy@(Sle0Kf>|EcIx@$ar4*gv1_HjC%}p{guh0Jes8Ckba@rUwHxfJ&po`3IQ0i9eS=tK_ zxnb%hlLZj_Ct-u~bsbd}BN@O?{h&8mAGJAgy@b&1wjd(Ob?37~H+6NDrS3w+Hn{kJ zDc9)VxV1H#fO>kBU$2X2!^w^>PVMrZIlf8Bs6BJ&j8<3A*K1=_sj3Mg^62crr+o@j zpru8;I@j2w*jORd^RH>i-oBT&5V!F@lkwHD7cWokExpoYYU}R)@wX;}sW9-Lrc^HR zO%s+|1Q0RaJagpH4&sFp;1y+6nm@Dz(&W_=Uq3(frv29BT+_?ssPem$kaEq($05Wd$VlYZ zObUHadCSDa3M4jx;i{Y=kHv&@nL*bT;?3c@e46M1jp3Wep-ru=;{#=%gcJUPtD%*R zsgRkG!9u=zISQPf2|s?QC@sHA{gR;owR zg9GqwGRY3lUHv;KbdV8z7m^bWav3cw%-zq-Ewm@mu&`*pE-e0zfzK8TAsU1c$Lqq1 z(5!P@S{-zOhB75(Q%0sDNS@~3CUw;Z8gO|Nliaj4J#**QmKIJfE){JC(idph*x14~ zJv}{^KfG^gGT|fa!Cn|lQ)=$Ez`%q0i$ul)`^bohdqhyW{NxRUsu6l3W;!~FRJnUy zN3pT7H*VaRsIgn?jHEw3T{yC@udi1|t1K_S*r=S!<>3wzRkVnXR8C0o=Li%`ZSU#P zskSx%-l|s7U2H%VrKq(O!&~(Kl$X8c;xc23ZeFmi(ljR_sVHQE+A+RsaM7ComXmhl zrKXVAk2$MBRgVAl-23IJec1*EVHhkc_e_s4331?*Ydn<@`rX%?isa-(X1~SveZe|Y z=AsZ!?4RPYoM5SE>vTI+96IywsX|L^=6^kwd$;c1Wqc#@)LSkwCY~rho`_y2n2;q! z2yJO#;PX&HK|s_sknS9L7lC#+-@LyS?g#ClOob;yLx#T@cR~E;cyW3O&R?%Gn7@K& zRohdY%!AE|mUjOvvj~Zd(b4lz3jEE{y};1EwnsX<6O4$LdhgB0TiNY%`mmCMViiaQ z*4HmO&gUvOe@@ikX8qlzJoUHHsJ+R<{mN^0#8_p#MTF{x@s_seL+(SzY-}6A&_sGcm^#?beCzVzfO@h60Ah3ii>ksWd}7i zHEPN_|4%h+uE)=Kd3i&{T_JEIJKOZy8-xm~{ORO?SM*=6iuGtXh=T#J1nG&74=12W zd~Sc^UYOoM{tk6*mQ13VxjAEW*HoR8&2-Zhm+kiI1oyYjFoHXAFXas1ym?v2129dB z07~RjA_?*Kqv1j=d~{T(5wGS#rp(Qy#X{~vJ-2G`CS|PDh-NT~%$;Co!U5Eu80BT1 zWD1P5_b6!^J9_YK*GH1x-MX6uaW4bI!xN2-=O@izZbF}T^Yvztkl&1o3iaCX(`PI! zg(43Bo?#DfUbkRiQleF3n^PRG$>ag=@5^JMxO7@2BUt0ta4El0H}PPscdqcydA{NH zH_!Z^_<&)RYO1WEA$4(TT}W?+WOO)e1tPmE)8jMaqowo^z2+-g*ojW4b&Uwn{BV{?4oTEVNJOLE%=H+<8g1!m=^Whq$d zu#%xGDCi}?*{#pWFj(k@Lx3*XC+}C&%SHfFU5>tj!&8=POwcn>MR|MU3#Psw$S&p~ z4SBsFy8@2GLSS!?APpJL2n2$2B>)9%daY)+fs$ulXjfPR+tx1m8BdWX&@0JNTb|89fyX8Pq7>}iCYrY7CJ z`>`!tS01WZS9n= zelliDR99DD-z-@VdFbirkP)#`nP#xi5ZmV`HiLTf?4U1Lyk78ynz76VpE5J4`=D~@ zN#>W$Z_MHeOiWA+4TbPvHUt47VY#IapJI24fEOH-!e(cu?g=~XlarT#K?tU9k5}6O z+F4R)R)k z#sXDlLQn|a0_7g0G6PHzoYkTx$&wY&$J{`C;V&p(`O4#a&Djd=JG z@kmG2Qsa%_&8Q3ZBH{9)N6$`wMRL8w%8svM`f<2B-TnAO>l9i#+p*u=!d4cFoDNPKfVp&72Uu*ta&bbt$U6_hym zBh`-EIDhFQ6huQtJRH_PGB7k|Q(4!-yeN_>ArerTS-Zf< z=;%cZf?U%lOTFn>WZcDMh`D($$fnz{l~a1n4eVl+=)xtwIV|SKv70Z=wbm0KzxWGY!NoWrTi|`80hFll(Nt3d@A|8M zkB)v-*?(^G-_#Y@xP1+vYJ>bIJ>8#=)TK9FOh;!OQ1I$gd4mGsWWY;++Ie~2dwuD? zIC5u>Babz^k|tw7`jN!^P^YP(q2Ma91}~O{4k9dsTvBaY>-6YItfqPlr(LP_ z$k2ClLx(vDqxmlZ($w7@9RO)>Pb6Rz>uRGSGV(FL*o9p;wKo1k^A!vSV~91P@4M{T zb8@j+d~@i(KG-tck}mGt7BN_KgJtS{Eh>$iPLqaX{VYJN2c|Q-i$Ku%#Fs=L%kcl5)3cIji65+DHI>`0#tEsFk zc2Faz2PlXM8KNQ5MuWk>F_*RVx^cU(pywUWqpfF}ae1k!sh&F62zcuwd76XZlLxM! z+S>V0XN3^9>;0CLd}lrKeYn)}y^wrnFbC>S5Wy&U6c4Ypv~0CeV3J*oZ%t3q>N+n? zIc9ly%Ii@0H439k+9y64X9NKcP@-J5M%+JcCnqlBk+ z`rU~>!&aT(W)F>JlDVg*Mh%Mmk^r6Fr@Z@uDQa_gcXPHmFgaOKvy|2BSI)lyeUcou zzCGB&BIM)n&tSQYEG?n6JoX!tk}2ACOrR_8p!=mh51H9^g&NUmGltF7ACpM<-S*7v zEXov6BJR5jopY_>Iac3GOR=!A1?*--rKLN7rU>vQWBCI3k6(O7Xy|R6Ek*6D&^kTf z*R~*&;dkHDdvdSMnJ(f4_%N8LAoLh-1NJ?5CTEKPX$wZN2n3kBz$mp}_4Q)pJqPQf zf-Ye4FmTo6R#qmOAKE9z5zREui zB9w#6Roi54TkyZZ>9SKr8h(46JO9Ro;hattnZxS^qwzqhqbi zdc9Bkrf_Cu@8Dqn;N?-c^-ly6(sD&bwg{;+zxU$sSH*|HD~8Dh1vD`3>cUr)e0V52 zE|!?n*==G%IYSo#$JNAi*X4|}xnAknVBcW*(wM8Ulld2BmhIIy#0))!D*+KDrmFJsll%CYN9I1(kVt z9*`t-UwG=33|nzlABeHU?EQI(6V#aNJ*06LU5tuK_--Jq0(7Qkt9Nf%8XGm-7x+=S^#a|`cV*|U-?S1A7MnOA5 zoL6SJigXceCM9q&X~YRu{SW`TBfPRdEfV$-JI+<~YpyhyUwiuaY@&N@jB&4R2z-&v zI6n1Ijkdj)+zkdynq}`k-ap*!h{-uz*EBR#Z0wu;`y57LAt9KPpaSfF8K=z|6ue78 zgf5om(|Z*+ldFo#%fFYGE7fWh>Ye$bT(q{@j+B*BX+S-=y<^OSi03J7?C7|OfSgs& z+S9_~s-vPSd$;VYS z=(1nkgv(vh7$iK)e;B)yXwaT=TK}C`EWC984T_)=69-2>ut!Zc=H}*r582q*$h^eM z&Hx_q+CTpQX;7%fV7y~p_vYGcQwU6_q|mW2Gs7g|as2)D86e_7>SU*f-NbTU{*wk; zGA=IgjV_N3^owLrf9d8V?&Wn3Z&NvOARsz@2{3u^vb3_XVPfgQ@q5|WohAz>X{8UO z@0o>#zlVlEbtRvr1OTW(0R+$SNy`5LMIc`ck3U;T@{t7h(FtO&gZo9!RvH@y$=2M-pFQR?^0rqG|N6V+2Cp{r3h__8zwFPeEVeEUI zytPu5@e!{GAcdX>r0-5E6{lti!MG+JdF{}j0tFEf02pui>Edm{GnMG@5z*4_Z&ePR z$S=;ZFd1}1ghbvd8Iyh%C2yVI0sg7N>vz9z5{^WK)oJh0L9%!MlIR#prM zS8$Ymp^$lD#;!3hq&;uE(PCsjZ==kKiU?{1Z@bK~{I=hPD>UzOa|J5nfM^pVR{(HZ zi-~4K#&bi+fH^`k?Ij@cQPR|^y8n&rf)$i!`|fcVczT$GP249!9X>b&Tzoj}larC9 z6?^9mEpCfGImL7aLDyF#+j9he>qHAmfGZw7dIrC)^5VUIR?Yz~&HmW(l*}Zmt>Y`h=b^`&P?$ddip;lHMyiOLj`U<1{^89>nAW($SEf02= zD`p%x@^p@jfb04V#2?ZPH#;l|VkLgXg6Gu(JQ6S3`R?1L+E>dpAB1cN6~0dEuKvZUoR2*HgQ;`TT?-f-!_i0IQ-bTO4Z9S93aKaX^QM4!8BM|LO^g2S<-cQ4mmt z3nbaXv>C(hii)Qg7#P?$$grO6KMHS!5?zgf+TN?5B22=OCqXs?R}s8P{!K-NZZFfy43v3aRov?)JYuCNeLi+W8!) zE!KvfK?UP9_>%tm^(u#jDGS+~$<&aQMYQs}xMWC09pDiVfPyw45)fXPZ>p%_9wC_^ z>d5Q3GzOrrwN;0gSB-#+?i*?9b|Y5Ar}lZ_WGI4|s;kO?laU#I#5{|F*y`Xh`xMt$ zfB#?5NVW33$xmC`Yb={*CTL015%nR;;~mzNkTtaXo}TZB`-e*goj3S6?TwHGQJ{?S z!yxRdEfG$JXXCXEKC$D2BC#h^Sl{c4V^$*%gM|Lc_@I0MCSQ0f{69v;&);KreIGq} zBOOz8Jly~O| z=Wh9>35Us3hky1pGB8NbXt&(?e6?PEj$2nm$KPq`BmbOTiHHDtp{7OmQf>ol6e%fC zLWJ;xAS&c}YVR^Tao!8b|EEyySm=T6d#X4ys_)d4jwnX@seCv%`2pR&{Ov`1x}0vQ ztvz^BaL_w+@&x{DNu&D#T7!HU|WBy~>aK0VW7Fpt+?b&M0VFi3EPgIdkeB z$LWCq+H$Wd%FnvG4;36m-sh8;*E^eBoG+!Xa7KY3g1y$^Os>-@bkoVkWYQ$D!1E$phC_oMmTz(Bfg zh3Q*Qm;|M^Hg=%sOP5DjZ(F}%{L=_fMpgcc79-Y7CG_;u+IP~_6vAFW49jLjM1BYk zb_J3LesOXxfK;wj_dDW4zxINv!R7_Y{qo#a_qeQ)r%xWc&VP0ySWsEX$+2@g<(c1^ z%qbfh8S-#*)L^%*tc*#sI7McJN+)sE{+d4Fd+WwV7)r(;BHPS+3Bl#J>P^8miYrH6 zJVaqhNlvXM^khP98mC#`?c!H!08*95cz4U+=45p2dvUmE{_n^<+FN%$d&4f@rJ0Tz9q>w?|mAa=OK=jvSzvbb?yMWsA;dkEp8K{>L5Fkc71JN3bTV3!+vIWVobGt z7$=+T_1A!U{ne#Hq#r1s!d})|fEE~pP5{vx|CD23q6p^*&?19(@X6o*Is~1^czK$m zm_&a{AnIu`iI0nU`2n~eDrNG3uef|CzjvC3^P)_IL@Z0jzAb0&i|YH(^AdCIp`lN$ z{et{)?LJ7?-Paw6p{?&-M@D zdbPtVFgMSF3qvIbR3d)Db0@XMqx4s6`1f`_ArKWCM>;NlOirEvaXmt>FB2u4=5`6> zpf1`sz2-JIYoPgrUe)GwK588(NO>3Tzu)CB8y%1xr|SC<9zMR*bAAJRPu1no%|}W; zoSY^N{wwxA*%FkWg|AxDLN~P6XKs$19LQ+u?fzmhld<|Tmtncwf98rWydu^i3WAw0 z1c@6t8(Af7JG+9AxM7Ru^sJa$z*wG#pMWua^>l5;1ODd3At`B%xvO#h0vV8!tuRf~ z6JE{`fhy>`t;5Qav0KnE{QSVB)%#`6uTXuRWtq_4f+RWgfdKX6s7vqd z9q!jC&-iNOs8t>=7)&iMAFlFeW>%Putg#@r7%o_@Us zF{Y+|Q{pERyr7GKze|ytmKPUKLYEOME#BGjUo`J(L6ajX+1Q%<`tHEU0a>kzt=nvD z6q=e222nv66YL_L3IHa^Vhb{?Mc3AD>@83JkAlpG{2)syJ*^R9X{mwUS6<73$4;s+ z(HX10o}$8@f+dda?K5Wj@O!J0D85Z|*{M|vZ$*XVzhQ?8e8G08aH8IS|6s== zV?%gFPUNkTo_zhRX*LAf$y!4i8Dbu{ox-NvoU8<17xTp~!>}-3U{JG{n~d6qt>}bE zCRp&lY3xDM{`tZ9VSa}C-_^>>GyLO%PDG3}a2MjbYXi-we$l+MwCJe`B)MR)fK=ZBo% zSj`h;Vfk(*6QH1R-uwp@T792|&>!9U=S^^M@FNj_c4h5MDwv#xi|%(f@LQ|^<=wzK zy(cl!TE(~jcQAw*+q0EyJtkidI++OzXy)7iE1!69x5Z@qHEi5#ZE&dJLgP_XrDLLFl(;%m$|2p%Pd$$wu-teS^zop- z`}EKava>u*AM4}MMXK-O)3eRkpQ&SO=U&XX;YnJDR(Mpz(< z@Xe@p5obHF*SljC9bu=WHO|dzS951l^neU|;!AK)ZBH+IB)33KYf(Y67ea=o1 z>9ND0vj4N+GU|-PIX6Ssc4q#AE}`{AnQZ0Z*sf&Ns(Q!`vz>GE@^Us0rs~iTuN)jKv#aFWA(F$% z{Pt%h9S!nfOfZYn>vJ-=`(H?d*PgBluG&*|C7|57cH@SIW*n-okUTJstINZ(ly^ZH ziTLSAX7P-GF;+=StIB!Z23j2T^su_6|8lJyHCtPjk&)D$eB(E+ruGDe%GJ6%B~@WO z1GRt%c^L3SK<9@EQHS$BRl9cWxT@mm(5NP`Mu>`6yd(%SX>BLfY!i0s^11re&z@K3 z(+t41`d=Se@9p^_$bhMGib}l>$`qJO2`Ip{-P1MwdQ=#bM|k(o z4)#6_^c`j0*EjpcPga!-C^8SHh=UO)C_Z5CfMxOZa0j0y+v+{De;<~$dTHR=pbKcR_lu?*eSe{NTTV< zf;`Q3(iqgkUWs+N=7Ov-x#1bu%}Cdkfr%2*O-w&w^UkT*BjwSw;wDOY|vS}+BNAI zuMQ<-PW-kZ3=)$^fsMv^=xM42UE0;|->oezjrLv)XprA+F*XKTd?mA>$>ep@9I9^x zr79$TdkS`T$Ns6Q{e4-JSfpc$s!^#6vGO9|r?lmBsXb9NyYvCSHzEWG_XGhiCm8<_ zy&=M=FtUngP(RjDe3IxV=0`uk0Aw@H<@oPEeW<>5Xti;rdVlIDJT3+9a5~LcDdIX9 z_|-f@^JmuHqer|8z9(q7@}|r>Uim$%xv~3phqfXv8+7#;2wQUDg5N?B^ZUt??}gWW zTW3vqs>)D(M-TIHQIIvK<+#hWHKU=JL{H=I(fmXfn5v2+j@Cox^?gVrUU-RpXI8JU zuxc?vL_aYZ*?pIxL|5u<`!OP|votO$=tIzvTP0r&G~z1_KKaLYS#iPXU_%9|cy)?0 zW9og$-asm@4OK#h|K!#z2==tJh&j^zYPEXLZh*Xg0uVaTTM7=o7ET7bn}U+^AKc{s ze~}jc(A*{~3rj(d2ng*?5cD~Fe_QP0Vq$fm^M>!m`8kv$W|I?PYPq+Q3jlVUDAb?+ zZcguWW_R9|K(DR!;Ht$Lp7vWDkhtvXcd?)a=eJP${pk_PzmfR4bVs1YK^tXS!}aqx z-MY{&czb)7lXu?r0gB{W@9#s(7Z4$dPw^aqI6A60KB~y7W^#gI8xXXWUGPJMrGmiW z?x*$W$6ylP-+%tRGjn`Zh>oE-Jw5$xW93eEsLN(?02Ufr>Warir3*#WB`JcSOIz~W zX+Z1Rg7oF`R9Fq-)&5DNIj-sIE~fqQrtL(aq@=gG=_&%T93N>} z$$sqvr-_Vk<}fg=qYyESa<-96Y)ns!TD%<^KXe;mJ^J)E=~jaM176Md(<0&|{BB!I zt#5fR#%%v&dv>rb%3`lvl8DDa@S;nqIheEOE~+ysRvLYK!>gdc_UM^BXhrePx4K5K z=npq0?OZ2`yaoy>rQott~Ob3Lw>(D%yD<5h3E%-ic& zCt6jZohG3~Y}9;w&_dS_+xdSl5}IVb?8Od&>J;s|^x^g`^};Ea6fwEbWk@ZZ*MEQ# z3zrc@!4nfq@FiWCOk8Fxl^GEMWOoj*(W?LDn~cGbGC{f8uMKnCIcQ@w+W}!wxNGXYC5Ef#2nHF*9q}Kw` zGLJl5Td9~C6x%GG98g08-0{y-5gTXc^24VCLTy$E-Hyj*xaVVbu zbL|?-yh#I~^`C3uEpKx~bGIj+FU-9$_PK-%Vh z8z$#H_xE>4d`e7gT=YR8AX6qG;Y9p!kI+$5Lq!0eSEz=GaJ}GrK}n}5v&QF+S0E2# ze60t&VCaqHJ80;<0wc|?bWLEcASvq&n!7~oqRc_~p=~FATn(sE;Ugu4aiG#5D7c1z zaplzED2VOtR^jAmwaCZ{TcCVZw6wC_Eyx8#Qxy^t)&sMO69wf|_)Ck$6vKzBN}VDa z0lGFeGD7nW418TwB!Dn7Suir)Mfo{4HuO`d{KVzCy3V`{H8{sIseWoD2L4AG0~A(Q z#qdLdD1MK~ZyL~av7Mt@pxoZxwP0$pfbb2&39aBtVNe@RVE_q&l4=wh0)CdrFE>%X zT5D<==scO{U0VXM|c*RS6R5L9grwUv}ZUTjSpI-OaYIkU1(Kt*-;vJxrj z$OCNRH1eWqcc^H0b?}m3|JNt;UjLlx$M06U$2vX_xrQs$Q#z_|vIb(2Bz#B`!NdxI zh(BSJj`lM;EZm57_=i|8LT|Us$>R`i^3(iBXsc&~q8u$zmzUEb{7ePHTwaMNMcW73 z>B+Bq210yFhDUtJZnn=OFYQ``6MQcB4-Zni*0omMorPy|ToHvu#X0Grsa|mrQUm8t zTtI+y9x|$m=5dfSSqUfMQ6HcF&rQuJ-~`pw)MnAW!G;K+HDCo~lnE`KJgK6_2i$cP;X0pNyIqVxXi(!aWsim0g5)4u(%dsRrDn2U~ezWd8>6anI&KiDMk zf$!gGX_MsTbuK&7*|n_nm-K6M2wSA4)=yMA%nua_%Ec6)CHV|M7eV&F47OMAulfQ2 z6YORh^qdG^CNOGZk0USlMoN9ISihSb9F@|-R`O=C9Q)^O3d?Q{9bp$wPVc)ui>Wg-xE1us23o(!vx4F5Ag}BeP z5gO{SakOf06ONwvq*VSYDdN`WqJ3@HUg0)_a%-JaD!GLudXDbX5_Q8!m?WVFc_ZW<(iq39a z9XxDnZ@<$s*V+zl&Z464$oP4LMZvH_`W_KcmS*_@uENWg=)Hz|U!B&5+|!r38jY{v zz%{17{F0Eo%6`7CE1@~iZ0UDmiD~Ggl+p4en-Rx=faf9hj!q=9qP4YLo}Ns1dLX5% zazqQ5=I`r+2{rVLU5Xn4=Pf98xdYkkJuAZ&@#Psyof=!k5 zdpnn^YT)9+FAAP=RW6%Ea49*AZ+ANq*4r5S5+_IRt>?zC<078@N=D?_iiC`es_ z5U1jzqHMqk%gyE6wO^B1ti?vFIk4778jC$QX{w+VK{hp3$vU6Te=@k#6=Fs{ME0fc z1+%9=Vx$rgh0_%`ux3vx=(T@6)PYb|Ow_-0)5PigY!;b2s^s!VTyDebm{>}bhbIF6 z2q!H0HA`>6@dNE~bp!(OHBscXt|9mmiHTNKRYlwe%_J)a2cwIz#Zd`l^sWG^g3NK= zCL%JDl+7d%z?SjxnDsuye$a;xzc$7bQ=czqY zxPt=EUeN(kS@srzDD>6cY93sCGsgZ5$GmK|FzX?6 zNPv=(a?KAuH>CLJP_&1e8!P=03xAEfQ(>W5Q|?srUhsqAa?@^XX=~D6Hb8Mq5_n`} zoYGC_+m<_coTQz|a6sAq1ir&u`n@kE&~=hU^ZOHhcknZfP6TyoG@Sq=BS$(6bS&yP zv0qtflkWbL#?*oC{Ud9!gQz`siiV!PlL4>kfr`XZa~}-bNK02yR5Wmp7CQ(4H`YR> zXgII;h?cMZ1b(y|&LySRb$xltj>aZkXLiQlOF5zwjoYf&N* za!qhze@7TI}P>gplC$$XQNCL4{9ez@I-Auvyz>W zft%j6_w`5dh_ZSju+KhV-W zrlO*G-Ygn9viInWq}MDZxpkHOHyh8AQ?c%59R&?0CAltgwx4lp*1mGJjKOq-!aq3A z^VLo{WqMdrlqvwjuw5@iYE%pfiHKf^f+o#^2NivW-WH#3nIZxqbPg>#ai6wiq@)r8bZSnX*u?YV z43B8AT=P!gEeFE@n9a(?ezyIrAS8slyW?+T)j6THoh>NGGUek-}&@DyquQ z{6EUuU8SY>B=_$TMUX146v7yA!FAgE&(+mym1JW5{fqtm?OPLdt65c4nj&t1DFt0W z1r?P-HrU*~R&7z;|JfP4{3W((4WEmbHA*%JFw@o965uv~v^8*@0fB7y zn)q-bQjOEor*7DlP%$i8Lu(71;>d`M6k(S-^&_SpVB?ngW?ekHFkL31DQK{tge*`K zqzxRhak4rQA00Xugy4kf+imMAEBASG&*=_WGi&p^tbIF-HP%d{^ii5JH8v&TDSjW& z5vR!#9vNRFSAde{aX zU_>P{&-?fvh!bDEXAEI_EcmKO0+6Wmy;x2LB58$IJ}7ue7En3CcfT`95IBfweC5Oa z<=$rKN4SzBK&|%oh2r;dLgUCb**S=zVBsHk{jd-si5WE+RTkS9O zc`@3fQ3bspu|UugGKbqp5NHVJ4;rACnS$UJV0N&^f`gNkukF#|Ozu0`pCzK2?$1ch znyYwwwZ8eluh#2)qyD}w68E4+V|}c|t?o0CXx~`FShBbvxkjbUb|bwhv>n5TS%_d+6w6(O>E_c+IMh8WWGAGwEntd*(I|JDS zXu6IV_Tu~Va~k14q^&})<+Nje3_w5KJD!bmc@$NUv?=&~bYC+nu%+eaP*c_VW;_Kf zQ=f=hT|rS$aByD_?fJXpm++d7j*l4`7*^=;3aJGJCr3w5;k3HpGfa#Z8Hy7U63WPQ z+LxnVy{5BRPLpC=+3%*jjY%*_+~;^Ffm!Drr2kIqBhK41tyVNCV3aQ*C1pKc<-7hc zL94FXXrBec~VRd*I|Yh|iW zq&P+MP|XKvjlwRwyc`256u2B|WnFu8dGFS(Nk0Daa@$GpS~~z4Xr89#+L#+mvgABF zJF^l;J7N^SeH44AxQ?EU`TD+^JcaxtQ9IElToapH(+F^l1))~uzOF)pHBmeUw2;yzWDz-tg zHE+Yg#RY~iWkp4H35!=R%~z02kW5?)Z&P3}^2?Xa{Cs*rpO4+0UDJ1rzoiYl&*A@? zG!FS`FERt7U~vLWw8r2ncRJiS##I>1w}!j-QHmc1O%VzD)NNB++Y+Fn(xhA%G|NCi z>$mBV@R?>vmOFLNfA=+zO&EB>4w%LBYr8AFu}<6XN}3{O$@bUUv%R ziJ6@^u*gA1>0swPx>)m8)k|D-*MyOX+sdR<9CDn2I`=9J!7e$8)eYJ#5fKa-Qlu{>x%Wny9i9i~$v27D7zJXNE)3|hrV zQzN7KMM8jknW9eDM_tN9aBv`-vmRfWUG=DMG=4g&j_~D(i5ZS!o+Kn7uy_1UlL99V zs^Pk}HZ_=?w{C_Ak=UGYo~%uSd1^3cexM(JGU_UTf7Ghn5z^Mqnov1xY@{L)^!7Ve zzJ~b9f*aM}CgC26D!70i(0W!RCW^rNl9?&7*p;`x7h6p7t*j%K-0shDJ5pQpO@Y&xidDqv+Ugm&<^FktE zcy#pWcpQe!KK7nPn8h0y)P5u?dCbr609BH7XqquwnFtE|OTeh4WM%msTjZWSi#(LO z3lIIOvb}A0a*&6dcK~A!cXyeDg!fnH#n;$?Rfg^J#G)~cs%62u23y_P&kUU*bi^>p zxg-^p=YLuNYFb*R$7(0FrJ$}04rWkS&-%>OOhe<--O<+7*~v`D^!W~9c;x5Dhtu-# ze3)kd=?jdxi)cP2j@o;~w*YTb?AkCjaa*j6vX8Uy*pFPw1&cE)N<<&6q2V}(rAbjj zii(kmiIhYDjzU&}D_Ag|PrXLIZ$7B;h$@Q0{!0Dgg`|3UVU{N*8CjBv;`)a&`=<}Y zu2G5kjbyt=eEG!A`Xt{h$Jf`_-yJuFx|E$4erR^O3cq{>L-aFnGN32Iy?3u=`jy6a zGX*#rANf2Etf1-r#%)pt&2bt^N_HrRbai!a+_*6Y9T4#OeFtdU_I@X08yoM|6#??L zjt+f}LF5CHb)-+X>(Lg~=rhDuSpcb6!0NbEz>7x*S?dCKzSVnFguTQ4QP6&b+`p~! z!!;DLE_mEys|h}zwV?~Ej7-SY55g!`3#%a3DgIFz$3Gje78o11(|}GOLXS7Q44Hc#LsmIw}r*oi=c@D`qGqeY{HJWOw4`NQ%M-L?r=vrP-%-ju&WgedGSaW@C4Z8mq*VY&q7&@NA{(;YtwrW0~TB*ft z9B>nh%H5yT|9x9V!1?FG%inH61NE@vN*0QCEafRRFwDi{Ajx~K0e=Bv z$K^H#x~fOeG%=R1hL8t4mvTdY7=brwTOr0CW3!rIycM#fV6@{yrv zmsOK$x83BnAV50d^R@2TYu!`=e0&&Pq}U3E1~bt42Tf@G`j0cUwU`D62g`jfFF@x^ zS6%udoEl_&z@xl{_JsS(S6@ebHOW<*R@Tz$n2+?K7dfw#vHt0sA4+ za6K=x;vTCi^(%F9C@Vn-aYMp2Sdi5Fqw*r2dle0JqVR75d!bfTbSsY24a~rcNWOV` zdzYW?JA{PFneg632-Q5yvyv38j0s$B6{M}2<#yS&dH$RL=lB8g<%aKI^0X-4y)%K6 zSs#@ZDY@<+-mA1YHJIMI&IP2}qd#u*;coqI-fU>9JFk9{uuEX;ar89vL*2)uTGD%G zi2?pt8>9rDoctT!T63k0t0v5j_bDDelyChQNJfSeRuRuchLp!&MD^vlgTH?aJ8y3f zv+QkOA;|aF*0f9)A8BZ;;DCuw>`{m$B#vAkV^Qx>| z7}`khgg|h}slM8I8V#E0xgIW~F#IxCjYV5sJ#k$gAuj+UBdtfrN=rFRI@CxA4#NIs zCtIdKUQY+&st(I4)I#+P-Ha~MDVcrmV4HPxbt`SEknz@E_TiuQaj)99w;)TlPE zp|PA#uhQ#s2b&#E69s!+H^?-cnT@I3M9}gGB0Eob9G|+m?r-=Iu%1tdGpn!+)zb({ zqNuvb_77T0iqf^A_hw)w2zofq^HPgW(vV;498iwGiCB5AriO__bk7W4uRmN6Bu@+N z_sp6lo1h!Dsxky7X>A>>n>yXY`nv=cgy?6)1>kK317+J(w=giFDu=dIo{np!Fd@MQ zoUTOPgVzt^qP09PZ#9@yg^==B?U;W4yQziV-nsMYWWN1sgl-4<1QnOv(+99VeSIe{ zr)VfBhV!+9N=$84z7IV_u$!^4=+emS#B)1zmY5bqgJ-Tf+)O{^0)m1zM&^^hQF6KM z{E3b(uxf@!`wISU3~~V>>-^leVeFSM+J^xms@rZ;3GDT+6H{BQ9LGTccLkNRelqV_ zH_T=fxH5M~9=<9!y?7)&`)#xH^LbQ0zY(#^#wnB*sscR~3SKcy@3*3}|Dn$c^tbQ7 zVVdUM(Rw5)x+9}7bweJhrcP8{8KUs=B$bq=IoFpCW+V27@w{L<>g;=Zd8g#$WatPJcr_)Yudkma16_rhWmdy* zj^Ch?3g5c=`j)uc&YYUi&t=$EuP#HE7Z(@hr05s3TCMCHzr&;!?3<4l)nRPrZ!k#% zFFZ2Ebvi*Q*Wg+wJ!fjg_@HB?b9p-IQ6_07>~|9YDq2 zMVnoJKXK1&PjWENrxN2P{~Q*XI}FxafD=t3O$!rN zbs_AdqZfO7y9{BYA~^irnx5c5x!==mTb-K9KN^VmI)aBk@4R`y@c1zRjU_tg;ARA= zF@l1^+Hkf_;M;YCue+Ff0R|3^UAO>$mZuS16SX3Xfo6SMI_Ia(lqv5+-=?HoIw0HP zTokBubt=w$&41i_3Pt3@9i$t)9v&DN$>T~h>pLK*j^T4NS5d+KcaPl;i&T+IA_2#vC+>T{ccw)_~_q2ajCo>eeP6wnHixdZ?KHhTMO||bf{sZj5w8vX;5?R0{ zXJzZ(?5m3n(7BGxF-n2Wcl~2@^Y_t_Xw_}e@9g~pOfJSFr1UP9_YO2_O?2mty~VCo zPS(~^l5@-oD91zH*wh@V>yH^j^586S{UHZ6Kfj`gi1BwXR~%pRX(}DX~6${5T*$qtrtAeezcmkb{Av4;Tk;+u5ZFzPXEs z7td*AInV*5NVI^LvbXoMb5 z?x9;;4Yh&ZZ`mZK#l&%w&e#M#H~Y1rqANt?f8Q%L?|pPTblocBh+A2?F_KY6E}^Ok za;qb4Yd9G3PhBT#=VjuuuMh)^=YY7a4t9fGO%j`_7mT_6yF0(?SKH6O{`Rfn^=s`MB|A`$1iANSRZz<*qrF~I82-i}xbCcR*hc$IX_8x*_vb20 z;bJ)%lUF(J>l-OCC>Aa*{jTd!3Juuc_f%IqO1jYrLo2mww&xZS78QDQqZ4D8>YXo3 z3ad;6)TQA> z0Ql|=MpZ)VF!a>ws0}q!NtN}RJ^s6|Gc8fAZXlc+nwu9F7FJePR9F}0+oRNK3-nt% zJI9NS+aX(Ov$+c~4nFqwGq0ZhZ`rE|aJFeFDLbxMnTN_VOGB;W=SjbRzfx56y1Hsg zYdi?|=cR<9`VKUkX?O-#vM=!fT;^0#=?vOchOM8i=~cV*c(LKH!LH}&84qs2{q^Eu z&~tHoY>kVLuMfE-!V)6PLh0t@A>47Zi;Jcgy7KbTQBi_h%;s#JeT9p>{a95FM{Sjp zYd@zkq*Gl&$)r~H*9IcZkK!u~Mw{LQzyzjq-CBK>t=U&kDcGcem!j9+l1EQbrt(9{B;Q?2)Pn^;~pW6@^?scdxKdkIYJ?(cC`u7!3Kr-+RsNI0f&-iCxs|0AnzXAIU=);N5 z1dw<#<*%hjGHNnuS1G9<6HfkxI1#@75^8E@KYf{ikpXx^lE=jc>?j1F=y|+_X7&nN zSt|AFOw`qB(|_JZTu4Cdh7`nh%vD}RrLEJN;oqH~ytC)1&nxUF58|W{u=1Q%N@S9j{otu!%lj$b)mEF^^I9yvB^LpQf8}{wnQNC9inN-c<&taJy)2ksa zqD`#)=}lFl?7xe8v-fYfVuC(ut)shu1fLG0x!)R>-&oXOSBld z>I?2CV|kfN%r0dAFsMIC?(=mCEx#M~r8w}7b2V{1A;RKAz71{}MPG29rq|v+hfify z==9X@>Gjb7$d8GLEdan#aQLsh**Lou`sB6lRxc{@>(__m#oxc@j%sbu!yW)oRluSz zv$)?2Mg?qaY(VSqe}KN3RV=%LdZAuQK){pHXW61czLRxz8<2=_b63LA_gxvT>K9i~ z7-(;Q3z1sB+8=wJ+v3YCr0F#^-9->mpsb>{9(O+iDB_ACDqI^bnT@c*zjH_4#v(u0 zR8ABJPKg4*-C~@q2&Z()#IR za(l-mAyK%8o1XKC;@vqabMD#~Djl%&o&dac{u~=hu@w-~ox|+DxOzRm4R2UWaSdp%J~{=*Xz-?HA{n27I!lAlr#|SJ}6(7d}7Z z$I#H;Z-F~y)9`wBO}{jBUgPd$m@N0|9ea7ng7za+i#%n}_E(HPlq%Af znfln$^&Lu+zlDO#%Pq`>MZ3|2EzcfEDLXDM67qSG3X2k7dRYc(Y8`E~a+2Q-?|(V4 z`Er&8F~xQ526D5<&_J|-1}Z`X;i;O{en%*jQ%Zt?9b9=;E=rFsE~0Y7U=x>X9cwau?13$IYrf^KN8{YP|pkp-61F5=<`}>s7w2}we(^u zkc}&U(w+E}YTEcWFS*5T6p`(!khn)^L^a4GzS{hd#b84tcR$-x*4Iz=724mh4hsHQ z^Xk}p_`=zmVRvU&*{Pa0l1L@PTERWVYmPZ-8#diZ+zLn76 zWN4ruzGDCIAdLC)B|G_bMppziBV(o0>M!JFBA3HL?09t)`pvD91c>+W$-YWqm5hw$ zrs~or6=z>SH69WIt;J^J{%jl{cfS&z# zHY;5mzr%03NO!2p$Z%ZUN5*`7WxBPVx)KtF`uKOzghJGi-XDY7KOFCJSx;`*7#eoL zk{|W{xOhOYL-l4I4H6&L;TL#^>W@h`4@oSppJsa3th*+3%Irlqofd|sH@WxoL_rNfDu7Kldb!tC zCocCku*EW|U{GN4b6hS%aAZf)PY-paXxt5CRDcp@6|F^i!N3|qo(l>E2$l32F5i=n zpgk>P@uPB%NoE#p|CBx`6$W!-_`OcD)k_AfhMuUxdR)JKbqPbQgbpjO02)Lan|$!j z7ehluLknzaL+_@|&B)iO0d(T37ysosRC(Zt3a{kx`?rhl{~i{09e|NO1l)Alv}t$# zWU)Fi?mYW^lg%_ATpawbN`+*o$^q#In?(NXQv`7y*8K(P_@(KEGVenhIo$A-af@3B z`N~r=)C2yf?at_k%xkQoqO182^mxVn{73hMUy~u&Ig^v8L1NU_wgWXvI5jskX`5T+ zj;1sUP4Ls8qMq$8gfLfjWEEDVyk75caZ&MfpUud%&d4104>%wbkQ0^sU|(j<(AM>* zf5P9~m8=qySLI^wP!@Z&0>g}aB4V>`cWD?Gn!4Os{aEKU84!${@eJ?l%?F!`6>qHa z9-d1b6sWPfHTCHO1pOmXwLFqwE^YT#K(wR!0WTY>&^nQz_teog+OX_)b(yUo0SO5` zFzK`6HlqXfow4c|1Xh5s4@0~Y6%)%Y#69D-nW%JMyuczdA9gE=+~NTl&1WQ4R(9VI zg$lE-;N?;)Kag_j`51IW1b2?c4$p33zc177wbPbrZgpY z{PXAo&3-Lq@r=wP>2>7gx8{c5Vy~}RQv4h}OcrQ9#O?XT-A+kGX=!*x@#v8NW|Ind z0QnyPz08E5s)mkx=yx7pc$3uL(V+!iG~jOw$BdO#12i$=)G|XYSGOGkvEQ=P^AQ`H zgm~ty6hQKj@HlMG)GYUkU!7vW2ir10^k6$_kAXpPrM$5OiI&Tn8lOeqn=Hks%}J!N zD&gh}R3R)}LVVS5MPnep*$HlC-C730zCA*)tXK&o;d3Q@t z(ilz{(AJe&Ou%S@I_z|RRm(y*k08}RH>peF;*P6zZC-e2MX-tc*tz7w=P!7RCfAi% zf4YtN)}3Fn1r>kxY}LM-VyiU&Et_@iU|u^bYdHx?2}w4GbxKNlc1!nV5?2ZZ>Or&k z1UWg{DABK(56Urwh$%uN<9Uc(+$PdKw{8`UJoSc*_S!#3S9YcPzwREef!J-T|Ar-w=lTJDa^+6u2HJ9$;#hb*sNPSw;V>WADox`*5N zPc)|+HbCqM#Dx-Mj=@)%ql8?+FB*E7kEyPyIcWX(s1kr-P%#L?%u^+Bp1%aGOH;^w z)fH<%w&7#;9YjjQAGiLGt*efTYW><+AO<0d0s;a8($WGFBHbY%Qqm35(gux%R4C9lAEzmwNTuS1pDeDXFC1COsF8<&^=xBMTboI-{23=Ra~+TX&(F+|S&$f*@keK_wh*w#B70^lw*>{u zAQs;1P7)=eqB8soV#4b`-D;?J8vixFRr8q{<|TPHkBxn}ym&CLaMen$=ZYR%f;KEyb_i_AKSs+Mzq$B*EB7zm}E??mojM zx#A`!FGpXwgyrS^@bvtUE!CZ&V8y`TUs{^PsEtcOp4_*hDifFfEYs{=L8eArEkfP~ zmG{9e)yV=dLkcgua$x0Y@c51XPM;7yNJ<&lKqy~^N$a=Aol!r{%gc*br2KpGYNN1y zWp#9tkRe6o>z6N{%|IVFd;RJglsdw`_~6v6b^sCS^ZF3I2X4-P zuoIlVc&FB|O-{?X#E6JjQc@GrXlU1?t8GnlgWu?8uB1o3U}GeZ5J=yyO*m8>Gyn6s(Y_dp>2JU5c#-LvL0TT+++bOGPO0Oe;CNeqWm#>tGgv({ zgE)-DDeFz6(rIJ6zrW@cUXJez5 zZye?Ulbr$M{Cj-zT-upGZD<&qs9N_l0R7V6Aj_&;qSvEqzfh9a$8aTXGB!xAYtV$J z6ctlFthC|VMOezB9tD={?nb6g-l!(Ql*K#iAg;AkZ8LaTw?eT5mjm>2c}%; z=;t5p4$CfsDlpC5tDQpv1IGkj7bJ(YPhHdjXx!3qv9&#($<6@3OCA;&tt{&YaVl)^ z8TYtgmuxH3X85Y%ChXEBV{Vi-n1z`AL9rs~I(@4W1HIg0QEY293>1PXjSJcDikAn< zl!i4s&*NS?Z*QG@uxrdB!ttY2l;0jMjR>nsL=WS`jq+P}l6_O%_2f)eQK+NkmjYtq zt4(3%Nq-8|*_R1wm0^@l&Lg9?)EraaC$~#B`S+~vxO4c@4qg9dNDJdiZ1{;<<)vjT?RMgZv`&`>|$6vRaF@;VVs~iu^2aC0f za)y9wrIZt=KN3}v8xRyindrA(@w{of;^T>pflM#OyE;_=>W}klRURc;Ji@C6%ckn9 z^Nttw(w$!hBf^8HR_)FdMBejjRRT98Ai=A*24VjYS(LPVyNVE6Yz<=oU!ag&VCCs5 z>@>Z4F9>r>04@S|Ck5LeaIXXt-ubzVJs+&UON@mG_)JDdVlbT+xm+QCv$f6ch(qw6 zs&4$p1zDJM$a z>gr&<#q3y6pd1ud5m$NT<* z?j$bYV5%Cfi+&}ZCyLwg&M3AEuy_W69S^Z^)lv?+#^#&->gtr0Rp;uJH94UoAtmKkR_1^<>m=`9ea>oK7LeET4ggj;6P}LNpc~}a}z}nd%(aoaP z%Yfh?b9YOv_oF8pdJk;J#X=fQC#x8#I0EA05b_>5+vpnXrlRj^}q787)$3Hb>fhfF}rqW#@yL zZdki*iVC`{7#{K=1ygE#`hy5&Cg$)kJL0jYiN2RvV+H3+(w7dfxLEWc39|kRpCw*J z01*Z-GY&4UL3{cmQ0@H(pS=M@XbOfnx?>Qw$kG2@lWBwH)`oSqZjsYV2Cl0Ey_C{l z@awG@uUxz*<`IyNUV>hHlG*skU!oZ+0l_Yit;fep!1Bp{ePsAChR3?V-?u^W?ErLX zeqPrT3^dZUn-HjXmNGI&lN9yuW8J%KU0%{AZmMi^3sV|vtDu!1*pSI&9-uX|=*}FC z)u_w47Z92M^Yc0_1euyRb7(<83A^H=e&veG!?0;KHeBdJK!>FWxNN)&@(qy<^Og~; zy@1dCD!5%xVCCd&4i?z`zY~>n)d@{ZvxhK_h%*NmhL1X_Nqc(w@ECQnyaQMI2_Al& zclz$)9CK$c%5+s|_(vnPbo4&0LmNAYSGNO+d7=U9Y%_ek*2g z|9FR$jf%tKVrF?!YV27^ZF9}Xu{0`G`on`N<3V#ZDKV+Fe#GmoUJ<(XTZ2zTJ4H5` z({SW5*tJ()lD!Ucb9<4(-)1`fhMVwO#X(Hw#~XfeoWOaDU@wV$?vRm|Hgw#oPp^8w z?Yt45l+>5P${X58u)1b_I$^WWcXB}Vl#YsU=b%5QN~PS!7RW8+iJ^2R;SLC%D%58* z>FO2sjL(PSJXQ7mVbE>_o;-(n+_*qr>fonoDQ!jbttW}CgJ&z`_5IXb@Fm8kM(lwCLF0^`_6_t!e_Pn9uPSuJ(@mo2=?y?QU` z9(81*^QaW8FPz3w7TLius}Ee*bkPM8%A(%@v3nQ#__*zIoB6T{gZsp0W9a>0`AHDybOn0ZA;I^}yMKp6+1-U=y=ew^@Kt*4697fizkU7>)c_W*uL!gaq1npo zaKF@c-Nez6fE37Ks^b!Lr0Hj2L7hQlUvKU9sH;bqzGoK9Z5X0nYpMqE#HBcMHKiNu z9)2<3>L`$_wo_2JsoEX~9RCPl%PuZBBek%Q1%7j}p80UkTwi+o#)is6+99WdwRR{G z@$n1`9;CQXKRY^1kzAnCJ3hVv%W1xqJy*l^8U4bDj{nnpdaSdUvfbDcHX4qjQap~% z5V$=J!h4tUgFKGZUbYjkby*l}5}k|V9_cRXAa0>QO}yglK^uz*^c1>7xH_|@XJpcN z=MmF~B$&0t*OYMe>Q#X`9`hSkZIBc+Hn=J%$j%aq$-Y{y^@UOJB&3lq1{xNRTn2|{ zy$k{tvwotTQ;St=wUeflZ~lqF(k7EnvFh7Gx8;84^4%*Ep>tB;Xr5ttqldYNTd7?? z(o1DQwf&vVz^xc(>J1CH0t*Ew6}?32aN6kfh|#D zR0c785!1wFx7MNB2=u{C?o#az(y;Gs-yJc{&#kc$;nLmgo2t5s7=1G4TDqEqkJeo0 z>OZgG9{p*h`i{>t-PK(M1YnBxHsC1z!Y!qXVK+wawO!->*qk;YU_F0wOogL=uRGE= zwvEYsUdxCfLQ5*8rqi(IW_!xKE8!!q9{bsq7?|C==V??q9Tyk3$z)869f2RE#&i0q z#4k~M^Ofzmik^<1$#A}H2&KygBT9%-qqVDYO!o=yy4y!BJ z-LMDZ(!IM6u(z!|!sQ&8Aa37Q8yGzP?vXN+0s>Bv%=&KnZM)t?{@h2fM0NlUvo3l$0q_T9%rtQ;IRlhw?YmP{}sPVaBS2!t5g z*m%brEG$kl^|b>7DK@+nQ2dM{oHe5HLxL{I*M>XV%megdULIXvv00ZC5=*)i92{#C zAO$>lBr)zGvb`_1F?l$dKl`!744FbdfQ|Plc|%CZ{ID;4o-*f(Q)ukjZM@{ss#oRW zGKTFK*h6b68I*EzJ+J`-4k16%R9C5EbO|xEent56WJgt0L}O@CMZ_-_y(0G4=XxQV z&nT!<(&B@IqmQPxW41goPaNElZ2V|;J`oX5rHD{y^+X5u{WK;{F?fE^ni_b+1svW% zSv0$uFq<=8`tkVWxOK2IH92*gx4F3@f;NCJ!rEJTsWp~3s;m>4oE^jX(omd$udh9zK@sq z(_KVt#7VwFoGE{zrOAA{s$AP_jqz>oTLoSsKaZaj5E%n}hthX@dO8ls4%crG%(eT1 zQqkMbugX%Fee{*5C$!>B^#@nZj=7*oOvGZK*BQG`DNO`XMCO|sLGj#N9|S!32@mth zo_jb!ki^Q%!4m{Id9va!7#{=;q$x`uNGmMwtv9vTfiN9X052lf&W&BITGQt0#bOR6_o$2^yyni=lJ zz1S0Q@c>ZKl%N8sCKMOdbAak52Pmq`_|1RL#a``rfG+Vcx!~LN%iVgkh0ZU>yl|z0 zGhba~TtmRns6=G_YX(i0JLu?m+~s;Mm0vReP#OcP37}WBnt^rY+X6k`FTdk1Tbch} z<1@dsv`&B~0bw1&kkbZ~YqT)`rPTr|;AJc7A3uK2%DRsW)`J?%t{1?6-h-ehCgN$c zIq@Ve^&b#irjvuCT})CE8VE3?6bBnS2XphzZLgN%$9W7h%YJztQN2ODFJA&lauAnF z@O80O2rk~z`Sh|>q84e7F?WCbxCs(4V0}ceYGlmbT(rQ?|2vk~mD^_JdGXgXalTKk z(6Fs?DB`tU+nKIg%vEz7%23#i<>ne1Rvz>)r$MYiRTCUs2sWye(-i%<0i);U7H zw$7g*oP-2U$`L!+wh+buuPs;r(gz*azy@!jRckqSCHb2Ax9gmD@>-kQ-s4vH_7C`f z$Iz!fFI6?07alO#(XK5AFgi?S>LK>=^yM`z$YAIWpMY(KgHTOaDRD(>bMVDWab;yz zGUi$NwIDdN$`}MDO^HhDG==$8Y-IPWzdy zuk-$lXDz#P`@BH);n{D}kNv-!nv{0tV@}ztoz7Ler$7?;F_TbH>Xp>?;EvNx*Cv*$ zU(Z_!EV8+)xBytI%(MmzkVgY#QbG z!2KFZaO3m`#q3B9?Zy@0PyA^X0eDm0|fQ12cbgyw<{*Be8J z>{PK#7EI2~z_5_Ldb{tsCH*ZUgc*4nYR~AYZ&sJR;MoBl#cglp7bc1Wo4;+Jp`^u5 z*AWf@HVX<*AwQU{(g%&_WB{N12}fOcmY}9_3KB& z7)QCl35Lbf*JnL(DKA%@nv!yfprj)wr=z6I?Ne{-z4PFKE+8@w?&~~wFb{VJJP8*n zqkQ}8u}|wf^vTh0-`{E9@+$KD_V}MMqtrR^Tvk5W?@3QKUwAimzR^E)fp97ORa)>7s3IZ;Oh(S*CnE zkq0BuAe{(|0^zEs2sk_n2m~*upYfNK`$BFN%An4x`P~P;D0Y#FeskZELdR({QOfqr zd~f{V6$uqSzE7Tj@^T-#YV~HADoCZKtWALVhe{aD$ViT46E*J9Ig=jVYtj>}$4wO% zRBzZUy{981TVAvyxZ#3gV>pmigomf>gUf-0bn%~GxpLu4uqYLtrvtyJ zu(c158mxFg@J|53|IryYODUxq7#uuOWJ~}l*+}_CwQfe*_=N3VGRh=+#N=-c^@!{& zQ~e=_3^xbwLJLt^4@At6raJ~uYPqZ~v}tgLEgX6lNHQhIu}@YB}T?C%rg zb9i_)B24up%*>W&xJd)U!U94z3v3(#}fx3iCN>ZhlW(k8W;l3ZjP#_1b zjj3=9W;F{l&zb}OUX|Mtn$d~cT@`8UkT;pTv|~rj6`GxPx+y};xvX@TY{eRF({*%K zD0e&0PcJZutF7(KKVqi(_)D8TGcQ|RGH8qDFj{Dn1@f)^3Cq!VMH-nf{Z278)gQ)r z;N&u?(klrG?X-r`qI)%e`V^##84?!O8N3MGBG4S^fpBGgZ?DIgB$yPmJ@oV~XF%dk zhqg^2SQY5%Je{9&3El!h|6q?;@nekC($crU@B{Rc!|8uMwhoJacSKl`6?tPdU2xmtNk)=3o;ZA<}v$oVX4PQj5YON zJWWQ2Vk$nY^z>WhzWyTC9|dzNF+A$-v)l_vwr>p#dqzna<>`Ivb_CHx+4bw(n_V5T zhQwU+?JQ7zg#?8#*l$78$gSGhc`9%4mcOr7qE-g=iohQA)8{0N>dMPamY)7`+*9ox zWTdqG0*rBquIs<{mPRV5>)fupMt6V$c7H$P#H~6b`i9l8m%+Y}|LnxW3_N0JU*y+S zJn$8VJ|%QuThyjX!9e=?bC?=hYcgkK{eL2y1`s718g%PDvHwe$-52Y}8H{*YNQvP1l@@pEL^e zbdwv`5%IP^n?BCjOFC>5x8P8Nv{|QLrLP?r3bTN$mN}m)f2G-i0Aghs3Fcd$WPhGO zVTcc)TrXe=DTMg=7Z=XfCMHfsMh-?s@5IF3flCC2$L_hKgOn7JEQ{=MhzJu?;LJ=S zz{wCkpgVbK?&Ia-bB@s4Y!YW=#7;@&aT@zGZwanRLcS|pn!jr-&5N=rRinrKVmJi^ zUJG%Ws3A&J9-=YI=6|YLq;&Q_vz|=Od|2s7T>hbh>2?7wK%&()i`3X4rvV!HyQg-&m zmVHa_`tNtXM@5Bm?Je0Yuat$X;u7FJI$YTh5eUmYrc>wf@XVsks<2*pC9q+o6kYMb z+Y|N9X0>5E{i)x0gFr(fuaMbDaXDC`E-rknY(SMhIT^BBqo*PPg#WqyNg9KOw%0RG ziooHFtfQZ?>owDAa03#K+QFU6vs4g8Wf0AtxwqpCIX?4(6ltO{JN?1tDoDG(FKZOJ z{Mn8Ls^Z>*MeGR1Gj|F6oidxr5{=&Sqs9^>aL;m z-Q?f^`a>AVAV2gx#f0AX(XD@oa54|T$f3%v(-nXRn54PpC=zVVMZG-I;981%U|_XS z;@P>`(d1Iv)0c#(-hV+NTQ(BK&PsnYKASy>!yg`Y^|u^qF*9qn(1#aiMeI~4eZ^Z_ zk3dpTEdK`l^X!1S1O6pL7(1&HlKYa9`>o^F$2%a%-^Hb)=(kS;faOEv`b`Bb6CF;+ zk>3D>w=}ms;<6X%w`=R{|4Xg_DCTXLyg6>8T6_?+fOQ zHlPrEW6i&P?Ml9kVm?*_#+^JtK3RxoD*6)j;n>%M&61|iXODKY(Qsu0Jn*XHe2jCM z5A8cRCh-Qe7I+RF@C+m9V;sUu49+=s=2vWDRqS%e+;kRo!g7&r+Dq6t;mc0nIX2`M z&MFYbZOvZSOsh)@irGq77|jj>4lfSIJ!9ES?Q?^`<-z?Vt5A_WUE>2wJUqC$FmNF{mz=U33RI{-F|`O&MY4_Lg{O&vATrf~%pv z{w7JIkR*G~zSUv4LUk6BRk5#HHUX5cgDdLM?F@5hyQz^d1^7O1@45u|r zk$gP=oc_h0$XQq^f)MRG(M=i}I$erEUp&TqOa3UHui?J&I3DhpgvW$;SQcV(T7_wr*tARH0AX`%dlT({PmznL#8;WOIr434>n2FA-ncQ3fs#=I&H&22YN zofjt7TOWTW@wjSqM0>HlReiWMu-Y6Z{N;cUeMHG3?C`|Z=p5P7^}NS8awUEvI5gDd zWbe<=P-#mQuqUv3Kv_V2$e;a;o*pUX%gi*M->8P^RNvg(;wv!!<^?X^fq`cO+2TUJ z_vRPaxhf`zd0qUzpNVkY{NxGBAubObnEavkwFm`;_mxt~_QtsS@Nk)w6!K@`zraYJ zFdp7;g&kT&+3|DCR4JQMr(xF_0WR=s9qD!<7Vj-|_5U-CdyQR;hK-7b&fETh<@wYn zwA2*mkN18A9A#u>6)MuptA@waR9u|6AGVX(VoFKsmY+UNQi!y%D~Yuqj9QsbbJvhINir;9a~?m*Tk)AKMM`!q%o}t3g6H;{=t6oQ(m_)G~=l9#? zW_aV1)VErV&uveper7J z>ZKY-LTC!xE|a=%X>epHDGiz9bYHgAdPOKh-ZJynbUS-niN8JPcSSlnj8l)6)<0oN z)f6u2r71I7{GO%ZFG$?zE_!!e*iP5z%^S`x#t@Amh@GoSntfZ!&3{_d5L+MfE0h}a zHRH`$>??a$<_TQcC;>73`UTzPu84_=2?QHgNu*&81$bI8k!}UmI#834XkMHhgV^xu zzK}0I4DW*pSYQ5alwq00a4L8CZRzi?k2Vb2xxRfX;Dbw1Sb*Z0wX}2u^(dGIwRg#s zpu)r;7r%Uqp!HF1{SH+|#{+8DOK8F0V}0=twKM(-9zbC(E}!AwfTIBwm1w}y>M46@ zxKyhqC!I$_^-UL7bK_T1S|>_oCrTS0O%)BpOc~|teUa90jC)>59jEGBB{%X)dfA8L zU$T%b+ccDa53H8;SavWK8eHi`L5XzRBV?pZjeC@hx>fLaO^9pAS4vV`R7|R`zdLhC zT0x4RpLAAS`S>+kR28hIZ)TTCNffC`6fn8c(0C1ycr!ZwOHwbrmBCrQu2zAl(ttG9w_ zR_W(A-Fk7kEB8ibEZ;D0Gm`LZ$=@Bd@#?rmh}ui%ikUh+iuStBvG%sMqsSw{T(2uQ zQ|-M&Eoc~c2D~+T25pPdw78isGfXF6JwW)+OQC5TPiMX%*VPTFxu!{#{s(qk>Xr;J zmyqyK-_Lcr8}}_KX-?~K-e)|_Rq`k>CMY@cr_%NfpgMiJ{DO)=h55rc{238bF!4`i zF#+EjX5Z1Nl^5_Fc-;Hal7qD*VyBnq+%|3mKKiou=3p%DJD53(d z-i+9Cxn2yM9S6ZLy8W&_iM(^ix+8ixJu8b3WFelkw{Q1KM&Y){tgdfVyR_nBvJq(G z{C(5-1jmb)VxpoGHGCdeOr|4~?NJ1_YeVIzP3R>QxIZJ`ei!p`4BT0kvfPVl%ViMr zMvx0mN_kgH-o(ZU`w=V~1dktzfx)sNfeP>>AXwJ)DOFrtl-w3w(K80JOBK1=lEN?M z={F|jZtwP7@8}GD)5S)R)N5J#%kM#QDy(yvLC9XhMXgzzwDSA=zj?5^J z%sA;JQmE6fm0;>49YNd&k#0N*|5uG`zh}4K(kh1FoWW>=@Q@H)-EVQG{nc=T^70}; zp{p>_4`aK`&CNN=sLfRVsXDh_S682c$PoY0k~mj0@#55b9DIj)&`!hbQ9-WTpPKpY zh*8cAVS~t0U0z!*v-uO)zB*6_pLFD3cF~fjpI;oi`S@a|2I1oqI`x;nSWKF~F)3<1 zA3Yd9pe|pJvWZht{Sk7uEG4!VIzwNT!$M?G0o*rtxi zm4XRH2F6OoJY+}=pJe`aBaYbaz@$D&wC?_c%tsl2{kmWY-F3NpGp-Z#@cMesZcka3 zx&45lalOstEpXG|(yJcr%!_~K^l5+`Gm=U7RQ<zat($X>Ws6p3k~yDA?X7Z4W{9v2iI7bEi{C^+n#oR^D{ zmy3j#GT|9R)r{;tCZioA$@zZC`8QG21}sWF#Yu;E!1!dWYB)YN|IlxLgTQBnP=;nNsNScwsm6Z1_9p6i!1 z1RmPSGivY2M8SSy=d3tDSb=*A68I+&2u76uehI!8@wK@L&*NilS%89~BCv|9s~itQLql(^84dqR&dtq*nJCEyC`A;E+YMegWCp1yC|GxO3$LMk zl3`*u$Hy=KX6s!JO`uLN&4}f3Ztu5w34QUz*^weNfHHO$rBjfo9WG^R0AwUrt|S;4 zwP0YJ8~l4Yk7j}Q?s~B1%czZNyVB=wi;IGiV7(Q8SYm!$D1UZcQ1BS$mJkrIC;WF2 zP~jqY!yH?rVw|Iv0cMDjlQ+OZ5TeHpj)+*Ep5BHLoh=m*W9PvUP;YjS@Fq9e&k0|G zl9ZUMD11p^CE4o-n@BFi9hf({4<1wCA*x%j?MT759{!@+42DC%2S;9tuLU2s3-|VD ziHTj|PM)Y@6h^u)0pC6#^GiiKbM(m~mxQTk!E(N`E)i3!Lh^o+U%`K9i{ zIKrI+TPqv2)#-fu*~V|<6(!04sy^Ze<`y5`dG!2eUS9K1sVL+K!NE`8oq|_dFbvxU zr^ylM2E)PE?AeWhV&m2{oBx)UjO=Gi1t5+v&f3op!&jA*{OMC2@M;UGIE`d6v;@mE z$U6VND!aM4d7|R*2)cBJXz9kLBjL--FxXBlmGC;>{Veq=t|wDZLG#fSpFcc9z)lY% z>y-0q4wrk`|4Wh2a?mhiL1To)pOo}8RU-dzR|WUpFZ66@6cmK{?!s$GsF4f8e3KhI z@sO7idAQwy)o_a^4wfkcg<^wUbnASv@t~j3vu-3`%AlK6Lt_$n$)D9=2IdRfweW-l z5?IT~*z2Bv$&c!DH8dcT?r4s^aO=;raj7E!DS=g zMNC2h#`dNc*$BfMBM-jjo9(=gQ|#LxUuuKOeLon;#YZ0@;NT}f3*V{o=g-;w)i1A~ z4w)QO+V8?d=BIRYlK;w{JfA@IQC+B7a7Pl z2otZS_Vn~j*PX(u_5h79^1xy;*fPd~QC%=|)%W{%>P?4}Jt~s=mKJXzdRYL=D&uyMU_3ug?r{JSnbHOsvTHqRr*k(CRCS(2u2hxWlO1@uBci z_2c2z{`B0ndUJS|9849p-Ie(HZ~b?Yd2t`?8+Ir9eno9>Yi*@;1LymVu7sk41LyfU z9RuNOC|IvNFi+bem_u#7BYS$}4!6Q{(w<2pPXQb^@mP*nZ-Ut%;G{X0Ux>q66=YtK33WmO;Ud~E<^ty4 z)!De4(P+_Qk8ABvL8x_Q1nv_sf>~cb#l3&O8>rR)9*M}Xdey&)%heGK8@_HT`+s(V63x@a2!}zTUkdjeH25> z#t1@_a>3gEWLucw>~NX>)3&LjJca}FMPb32xR{nVuEZoRQ0_zM%26(GYz?hz zt8=}GfU$yC*h|pG#2$6QR;cfM9!V>}OZ)DZ&hEx|ZK3?%5By065~Z&-i@VCSp)hNd zkDHl!w>MQ9B2KU+dgjuSfv|8BX#Z~YLAJ(bKJik&<1r)SS<63Ra0GIZ>pl%D-9KMV zCVy+tf{+TX)rLYsY!Gw!DVPH7cINtLX6_;HwG2IzF`dN@*J>wGU_F2i{tEIck&-@r zqN6%#5zt9?V+GTkhnD(+49CN=!0Po?{>SBf1c-9y;{6U zl8OSoh_;JMg`s|B)%d60nk`Po@{tO+(PwrZ93glDif5s#V!Tpu1?p&i+0PE%N zH%@S4OG5qJG>eCiueiYpGHEv~nCK~1=GFs7RgVb?VbsI*m6MYbFhyOTsN(uBSvmpU z`)Y4$P-G<2`jgeHA>VfO96$gHa!@nA4A#-^cRwO9c zfZSAXRuwdLXwA<`vFZI}Ic8;||K*jtaYOC$0$OEe&peH&kVQc$=0zGGM?CAc#zT2jlb;V1lkO?<)!OMF2t{;K%w?CyN+Rr%B$PEHJD!W0g7 zyX{yh335T5@m1K;IXgcrt;p5LtFeQS2L)Xr4h)3MJgan?Os;M_=r$J4=5$5OraEZv ztDigWuT1(Fm9L11iqol9{II?C%HNFJ`}}^ZNgS_>%R%5U^2Ig8_laEW4mY3|P`^GJ zX1g)wj>Tj?Aus|T4L|K*UBz~(D-z@fc+ca7JutFAq)Pq$$VaROTR1?bOOE4lUKz~Q zm`7ShffQp$hc^u@GR%&;}N z6c-fIo32mUtC*tHsp|Y;_SHm5<;HnASBG`h!aj$^l)&-9pRbfLxEu;={ELFy9jGzn zZr`JscG~ipbK|P?yz(X5B}Z+H2aj_*=394mckGVWNZp1oN}TuC`g<#+djoqTi%mv; zCkkF7P78)F9XEN%SZ9weW}#KvF45Z8J-FOe^%`@O$h*ax_lyTl?WTxyr<|hV6E^|j zrXmB)O0$@X^z;vH->;%zX^Mw&cKdDNbp0zaLfpCQlE}cxSq?*ycdjG;$&$?uOvco9 znqb9&q*F^v>-q}RJD}=bA1z7!ucz(3x0e;e`3?=8gq?ok#f;t4BfUHe zEA53u_}}-ogp;n(!#@H-H1W?uJKj2+EG_T&@KhYGsdkmA@l;@_b2dMgx;b2?r+<94 zBHvcxtA-?fd#TIC$xOP>jo9YceaC@KjmaDpu9S}-o2L7c`ph{dD<3-SPV9th@m5fq zg}$TbVB|Q{c|lTdnmoFo8-+826FcrWkRa@_bAz$+(dFF>H>?H3ch6mHH>^|i193Lm zfY1O6w>j6=+{*9hc)u8Q#;a{OPdMFvthKGxuA_$W%JVn>c}-dI)(-u}!>u}Va=7ci z0Cz1@iTLr$kMER}tm@ovxM5MI$`-!9g7WD{nPV8Zsgc0hMIKXOn$}TEv%AM`KU(g( zfSxTYs|~6JIr@Zc$XoKYn-n)Tj7JI$Wn{3*AsL1v9>dK|mD7siOFM3E?Fj1Uc3k3@ zrO>}V1h+Xu{VQpk@LzV57g+cX-yl8u6gNB7)%nK|#anFuL=)507a_a0^YnNAL5C%sGcS6ahaVZ9 zvoXWz&|BQtyO;=JZ!~Oso0{KNyvy4`W1IChUt16}ib$g2R{=RmeczaMVr#wOZmQvm z!99MtAh|*Mw<<0dWvvSs_#A01(ft~cSUc{gjrK`aX0|yQ?ir^>cEql6>ANZS`0vf& z=yA45h)Se?EUp>UPzay-kz)uuo>-XGoY&R7;*xGZ65&l=>t5PmK<7P2XYhzrcLqlR~RyyS_i(YJGSY zpTnR%mbI=z@5Onl z!N1{?#2wuw5hl>*51VjvbARRxYYqAF!(jLqd9v#7+Q~^*5I~2lLd~?jy`2#7Puho{ zXtii&y>8@H;i5PPfXaPq#+PRsd791!aQy~BU=S0h@!a*|DKbrP8R<*MfLM-(=?(@u zFu(8A>?uS zc&sH!*nTYxV~JoDho7QMB9hBtqo`o;x3s(Yi_%vT5?RKZITD+XNp!Z-YOg90GwFG{ zxz&HdzBXjSMpCa^=5u=e5K^j1|I)ZUR?*kuU$JHio0q$@g%@9UD0L{GCqwg{JLY8s z>hC%wj8>W!X5ryGCC3$`lduh(vTdr&6)b5;pMBb_!M=u0GB4?+049ic(P5&{9Rl_& z*`Gq^geRN(Y@;mfRWgCsxPAqlW6}oV|W-D^I=v=;=j$96(~)3fRdOJljs5f3L8KW zxVAC2Sf5ThY7-`xdq-ieI&$S4Jpkx|h$U^Y(KlS+7Rr`YU^N9J!GoxljNpJ!3z{?B zUcE-^Lq^o^k7^`_d`huoEu1%Nt0Hi@gyL!^&C3EqqYvudfR)MX#ygr5F>Rf#(w@?J zMDN?zPVi6nJv@|LmzAV7svOV#ux85s6jWCDV?m&w|Iz(A{KkXMfkesMDHWR@MB`5P zPpLw&dM2xRN$MTC4%@I7NvRnWjn5E>k2KUY+dUE}9$G??5t&A5DHO@EJPzPTU)xXI`k4Qwm%mr8Uc@_XR(Y#lyWC0V z1y{XDy1J`%H%ST}>kW^LO2x1jIZ;1>2=c30WMX|(IyzbioB!lsJux$LxX4)Yk`_+f zyHNTVO`W~j{JB1;FNzCRC82;q9yi$~ws0&Uzhh)%6cQ4;x(^y~Xmq|+R+ep1$OUn& z4)|sPGy+pIp}Fv1>R_|HIye^|&QK`dCl4LDrB_GyBuo#OUWv#4K`iAcWo#kzM+QXW|cV2n{L zHDp_pxX$P7N2wIa8AfUEY>KHnl|c`)yZgp|c}J*TsZ-s8=mWLOyx!tH{yx@znj9s$ z^lnq@K%AgDX?GlccYk8AUT-|BWign0!rxpMg^6&wsO24M&E2WP{x;$;GJhVLk}ct{ z%KckH<_<63MpwV4&tNFXWg@SGLmzc}WRd0BQNxuhlo0{Wkjo&KCDtu4PI>5!?(+A% zp&&5tx{&&HE<%xwM?i49kK?f)ux!44yOFHAKL`$a;5rr(6-6U+34AM{&txSh3sU`4 z-m=J$kc6$Rt3guKjUh)2nBDM@HMi@99zd#4^6hu~5q>^BaK4U|2!0d1TJeji0NEx=`EvFJuTBp_ zZc9t+#>@O&wo7EuAkCXqL?8!s0wY1mQ3;W={hQ;}x$_{zhY_d)ZjwNj*;ZGqHsX%BrBP*ElvPPfqLaI+z8KJf_(2Tq zg3~P$n1l6s7>Q=2ruMFn3g36#BVa;7sp$l0P1IoN!GD0A zLwiq<2?;9Nb)^Cc6^*E2&&$UQd8_A{hi*So=prxPp?vnM36t36>5AzUPy6paHZySU#89oDPe`Xx_Tb|22 zFWDfYQ21Uh$P7xWZ_Rac1&Bd+h$j!8%! zMzqv>ftI04S7$37`u3Xlu(0qS9es5)k~y4y4TF@3pOOPP3n2+2e`|NO{5s0dy z{v9mPz*rMP+2E+69Pv}(ccbd^M>d5I)8>LrZ} zYv{2m>*P1d{rrlIZRDf z7zNyhHBS*mE@K{JkJQ`R#n~7AVk_*2^$xu@>?e2dS&ima=EZK>JDqMHD2(2|eG8pr zQv+c~xZ3iV%dDd`t~{sOi>DyJ$xga2GYteJ>|^ZTZhSjwoLo)ykEW-lCUpZS$hPN` zs01UA&^OVAoM8w*!w;g`|3>6ZbC7`vG9&Y}GTb0FO z?+k!1ev#b;_k;u$3aLWy$w(lC&ZLVhSU{SXd`V9yS%1R&+*0RqYpd$lFJA8Fkmtg| zhZ1Fra#V2SnZZC2)1S83>cT^;{Hk^79V zp&g7>9(N5FU`t8;M5fgYL@z(W>^B1Bu61$K#wLW@QBfkgRHyMy?pL%bWL5?=+cZQ9 zLwM{Z9q)U26y`yx_k}Tufm%|weudxnCW9_8cpqG>O%y;GYJ0pU*DoU}DW*G+HC859 zm470wRtR}e)HGX|v>I#<+gnm~5i@^IDMxLMjg8DsHufvBX^NQwTAB{A`Tb4^2|4xB zGTc`-Uuq~Z45r$}Ry&?=%q766_L!_ve;b9m#-I0rEQx!Y83a|Il{zoH$24d)Nod!dj=F@l!M-0^M&G&mp|W@Kg6 z9l`$R65N0PCGHtaUG(<#Wo5&CybnW1Bqbztbns6)S;WP}z;PG$C-t%l^PVKp(GqiE zXbB?^nL=&hshNf-gH)`mVq!baC)OCZeW16O9CIUH{b-A%aoAq+!Q7@e+*Y&4Y^XCA&RQxs#{iM9`1m7az83 z*2oJYE;v&vI{U`NW)X@B9aOiNFHaXvS5>B4X-92Oc9bhnI<$#L04 z*?!nt+IFrl;PxQ>eJ3JX-1Gs!)FXUfk)bJ+eM(={TjZ%c&Z{&qxb#Z`9 zxPu9EFxv`YNnSHNj6DvGrbGdGc}Y>xSX=LvF~sFd5|VEqcS9an*ifgm@Hn5m0mh|{ z&YOH-l($TOaKD4c&!AKV*OwWPYQQyR%=^;1BUz1M2>0bIByezi;>yi;15}Xo}|iAXUbv*@D-s58CHM$keSAWSdB>mI^*Yr#9S?ejsl2FQ>wrz6?OB<(6fdXR@tkQz zv2UC2{b$ta&(?1a2ZTn4hDN8PWu#@~w6M$?t{M`TSw7_;;h>}u&h%0|Cf{fn^Etnt znVs7H(qu3@riR1V#SmT8Ygioq1QXY?@ja^thIq9E4im@LiwKSEON;2`r5C;Vkv9rn z>b38LH<$>kdcJ2na9f9HFYPJ*BQ#{7ulp=ldt9-6AFqd!ha$E?3;rqqa}I+pHIvs+ z&$yp(F>{eKe#1&k&s08!_B4x*>c*&HZ>XrKDE^r%8mkcH6%@X48Y(K~Y9~i1A(e8G z-OiPF>b9>G<;?ElUgdKRj#CicM{2et6vYg~!gGQ@LYjU|6V6gYiW7D)Zg#%8<=LW62#1o4H*_6x6%0Ncz0x5Dm9K_ImxENI>7Vz;4qE;GXZutP2;#2uKeP7-z1b;D>{5=H!GvoY%Fg;`D@0 z<>mjF`U5%S{Qo2Dpq`PZ? z?+jl5-}@|<>t1DG=9lN}v(MgxX4d~vX5z0ykVj9S0-k+@qOGm(wX~Y>$$FnXxg@j) z4Q~Wc!2x&U)>aeePREsp54(5PBV_ondO3?fnLm5i0t^T*^-jt2Vjlr3924RDbZ>gY zDNCdH`aQH6=+IEqbJ{4-Y8}W_vt1qGd0hsXPIUAz1VH!xw%KA3*ewrY+1t-lxtDk1 z(Mt99DM2%%osuH>|e$ISYB1Nz;SKEuwx89h8vW7K+SZ{W*jO~!V(4syKk=)s~2;9Ll<}7 zKv@d_14i1Z5IA`A9*&4Yzt*DqaJISF+FReTD@xDh(+wiOyt$R1xup}c#72SPWhMFK zi6Iw|(<+^}tihcHC_qMju+dZ1t=7Li3t#PoMTmZAv4~KJ>*$*44f0b{83DgK8Xvp) z&ez&3mw|&dKQ;9+BI2IhKwsa^)>aSnvHyq5$6p4m#I|1tvlB1G_>k)heHq>#Kf0+7 z+5;I8&gFYZ|AX|btk*PQ7@aS`ksg}WI-8nwz`?Jl$Nx+@6y8Z1q)xGq2v4>bq7x+s zxGgPGlWqfP{W`izoPS_Mji@yi4Wc;~wL z4cNGg_9&5W0N zBIxUDn1Zq`1S7Jnidw_fp4DJAJaZWFKu=Rk3pnFOJ}_DEqy}YX+KpFfL5QLZ*%{!g zAiKrp1y&z0MF}C3;DC$3b`Ytq- zq*Bg41@!tirWydC0d7UQQUEI2ND40M?V)Dn&@Gl2{JJBji8PU)z2^=5~y5rTV$G`C+Mdq zv?6}bT|n31(GQYr`;k8raLCZx?8l7FB{=27wnh6w3JMAs6p}T|9i-#4Q&UTzzyxJc zh33Dnl8brsM%2|c9MnX*@n}bumopO+_CdrEituudU=+4D)ld%KfsXSQ0~!KSaLIam z1{_Zpdfo`#Ib-a3@rHf)02#4~<=RJpyl}d@jBim^?bV!H6Y*YLGr9}o3Iy(B)PdG$ z`9RNs6R_0_=+54-myxJ(IM zW_Ihwjln$qXHU^|dw4u17WavIUS3{(y<&1gaYpfWN>TP_JTRH7v*6(3vMZ!k8bUqtR@G z`1pWUF^MJ`YzX<)6~Y2*3|u@dN!cJ-N?nU9A2OXo!(otNgPlzsX%eX52R&rb{|H!m+CYDpII z^+-YYvg&Hj8LbTH*Jd}w3j_iH`Vqoq<}Lg&QjzxhwG5o4@Xk(3{`@I8+KcN!#|)mF zCiP=weRZv^gKceob^iaoKVgnak7M0B-{Xx9e;)#1{Ov5wNg!^imi79hqaFgmCr{F# zmjZfh;Z%a~T#)*OQk-DSKa`u$=b}(o{oEELO!t+6s|GtsSf0b}V6&mCD`eqCCbX+> zz}$o6#lNC#d@_{qRC2~BNW&%hkn`V**N&Edlh2Ah#-L?-wEr=BcnCN(XPb!?h?7Fq z`r_i?-0f2BvJ?B?*)N~(va{+>6b@3!i~!=LscJYX%6&+T0f@xsIb6S|C!-og_46uc zqhe$Qv1ybOe{4vIe8c7N7BFGYiik*cZ_=r7dH~dE=r?>__WHHRix)3i!k8KUixT!P zk+P2AT`32S+EaLwH#kyBqnV*~g%drh@hH?AU=Z!Bj;f*4mFr-X0-QvXJquRI^3?K` zJ@yI2{;pFmE0|h5+)7A7E^K{Q$-#q*w61Q?Veyp+A82Xg2rx76z)?tsW>_X&?&{jm zD5h+rfG`N234Fpr2UfuTW@Z3tRy13OAN6O$2~I3U+rFx2;VjZ|f&zRR>*K9(OFeSi z|DFtZyyn?UF@#|GwwMob4D|FQP$2AnwzQ~gIEoJ6Mi!w^qKu6BKrlm7SEw%lmlt)c zlAgxU5iz;5@M!`UKr$}^D9eY1gvqz503jqxhvUwJJ3_40{jxB=o-&HPDPxuNNBjGJ ze&f3LN6XZH5AOl!nS=&ACOXR8j}}7c=FmJ<^b^vMOo3rS^*2Bu4_7JCWH}?QnPd+^ zE>{HACg@359^-V`Hsa>y?uu6WTS25X+c80VLJlz?+B(1X!>NR>ae>ANR6+LXAdTlX zQ-K!I{{@3?(c%1X*3XEHJ*L1vH8DUuWTTe%-?N3dvYdYIL9uO|Rp5w$aKa!9Z z@M=civZ9(Mg<2)R5YY3XhDn4ra5>{V4X%ksadQ{sFO3#kh6hn-^t8j-Piq9_7w|oX zPB|j*fGBYd*VFG4MNj#E#5`%EH`hem1mg&vTcg=+P#I-|LoF(!ALgvItPG0VM5LrT zMP`xZ<$V9uw}ne0BIYBbxxdAT_CloeR6~Of$Os@g4<`aTtX>-}f750l8&?IUt0A!7 zyiWD-P97SoWV|b@&Fg-+DdyJ?E3OA-%ABvjlS8x8u_+itEoe!B$L{Qn3SZa9mrNfpiu}({O1oZ zAZG|5=q|QYVay1F+XLcfV<04A5bka0NvWwt`ukJDoGo=FQh*6N`k`)So0q!aj@k!J zfm3OZeIOEnkq`tYeR74Mf^Pz}Np$rnFff>c&-cH`gn)N)($RJIR$Nq+2p`f2@cSqN zo7E9%_)sQly1HGZw%iT%>z@QLymY>%q|B^UKV;2$F;t+BPT625_40|g1v2reDW81& z@F8{d$^zN^;e~xE9kxmb^k%B2yE_|DxN{p=wXnqX?n8YFXkAG3?@q;3S0{TG-pjx;f+&&ArZA=0GE%Mv9JMjJ|;I@4h#>BwHM4allGGsqmW)H0Z z|GRC=^qSg>je9helmIX8O3Kde{uZDQWKif=gF%&x2IlxDsL7kDQk~6K=-02Su>#s4 zrW(U#{=3RO1B{}K0Y4-ldtHwCiRh!DbL&%}I~{D#kOu2~CJv7%dPu=({@FL|B8?9) zmhLQHrg_y{Ab;3+ND?eSYR9tqILRle9*7k1^2mhDiskKtap;4UeOv9mp)8@()ZVo^ z6lscY!H*2~A7Jm+s50jXXrT4E?Jiw*&Ed{R^2lw@U#X=bk#B$3RAWDt^jPDEitzYM z{xby$klX44;2Fvv6&}0lB5GfihLsbO13!NLm{}s#A=%;a<~Sz9(L%F?@R(+3u(c#q zDdROAcAjeH(pCqp(KN1w~F=%2M<%q__V`zt{utNRFNXbbMLYOX?+~nk5T+ z_jhR1xg+}Xx1J##3xaL<962Vj67eM(Eoe<%{=L!RwgeDg&va7`(CLfq(uimfIy%E+ zRXK(BDgVwA+#twsj!~tK9v-!WxmQL~I+T5Hs;H>UG7Fr&2xIc&r!8p_k@nhJUk3ttXy>YYQR@rB zw8f@|GJIErvlhC)NjvRpqk&HJ9#ri~KJ@Tt0U>EL$yd1MKDz(WAO1mX{&gpmYe`5+ z;&>eHax#Q6jFmV|BgaD~qH7!50s&CLGZ#YO=;r@k%@}RLXJWdixlr_wo6j*~`g?DZ zB5;bNw3NgOp;$WG5N+t)4mHrJk-0Cpye-6ig}sr*=hrkV*)2yZMwT^`J%pwNX>MDo z#IK#xsWb5P`GB%KXfsdKFL3b>*|phSXZL; z(G+w)Xlx*F&ECB6Fb`osOdaO-)Ndd86xZ9Nvh zNc8u>n83f52)Ea7;KSn3kdUK5F$f|A2pH355ADGt1I#?(z<_opm?w}i{@8T789yC^qVO`OEhX z(HHtulhkXXwCxfjl@7(Qw+ zfjvpK=ejhhtj4Wln#1MX{JJK5R-p=@cm?`#Lxr6{^viV~d+z1f=or_n?zRvG3FV5X zdmf|3*p|=)NbOUw)Zgx$#Qw=@{J_06vpV+JwJgZ~j*k_UjkHGOHPNE%!DgvHd|Ufc zJz?W~y0`A~zMmJQ-Brlk6J4{F?dV%qS{y28gl+6deMYJ(yI5AeAq{kxv`_Ro(9x~( zNBIe|WCcPMF)Bv!J+dMqX4<0Bzefq}X!~ND6K8xPe*Z(p|WZeZJ`MT*1Km~jI z`Xc?HCx-<};ROXrF-s~SeH8>c#5Rs`VPXBCiq?f*3Gj%nfSHVl2&r+35dnZ-EKE#b z=zs@tR3SAaX2Qbr;5?7cQ3xnt=C~}iZ;>=OI%q4%$w{Ikb9CWC`fBuN&&a4~W$hkU zE6Zfdz%D~8Dg!!ZoMR#m-6sqG9NO}%xPp7g^KCR^QH)fs&D?uQW~ zZ(t{|jk>=-M|aT(%>krkK`8RO%@2N+a-^a`JXLQth`^<}?Mq5$6{^ zMsMI;N1~e>N=vgM(hvGg;Z|NKG(Ez;TJsaKzf>Kk3RO{9U+9phr&I3hS>qC*F}LpS z`;!6QVRBeq{2PMrfQD<07pqBGwP6Y%;8uwrE3;pMuGM?@?#cZ_JNQ6Za4gBcf4-{( zEN={7#OvvHp|%%H>BI-S+t06;x5oxTyM8X3n1h4iCAlz|yW@*{Wps3)wDbVNz9f0N z3VUcFjGDXK@m0_Fq?aZ=PzhRI-ZK?80^xQ_FQ)O3X|ohAc1{K*C9xg1b!Smzy06Jv zt*Q)4{F>IAl5UksukfkKP?Wxbp{uBRPX>G?^}l`m zsISPP6$kF^(Eb8`Y(%0XqXVH~VfM>|QNIDi%l`IFhL0M~8xmgoJRIE7moMT0rHrqy z?`=Fi4R=0UeqKV@YtIA7D1!%}UvJaz7G6_tucElPuSsegv~S)4L0iByUYBKMWrc^6 zMhBi+oxx_P+-Q$>g?ywKkDiZz#iV$x_sHDzn|i)xZ}MV5)(f@ze|QXwZmw*Nyx|heJcZ8|P#*cc}-D+ihfBhcEj5@?Lc0b&~6smYbVf zUm9SZIQ*gd6c%d0RfJ{kx;-O5lS6+=wwHX`;1;0z35nBj04=r%Ygv>-IA zJ+vw+48|)C>U(TWjg1-3NNMI!n)Uer@tU*L7PZfy?Dx|dE`D=&a|5~)+lrd(y__*3 zQJ}~k4m*3cevhQd581yXuPtA-84huGPE4uIG%bd(G~lYvK-|H@%jR>q@Q}oGDM%tX zI}Y@b0e>#&fwhYANl2KIPaN4>6M775zqeOPOe`i=VEC-@2qr%P&Ea{A?u7@sT?DLu zKZ0(!ABRd!Zqw1}ZT|TMF5TBs0aT~pclxeTZ1FD@>CJU3lo#0MHsJ>iId;96Gz8UUUnpU>PFoC0}tedZHy#JP`{8KrsAReKP2LgMdS!7vd0)`I=0Wr#-&f= zuL-;l47!uhe?7~TZqtyX&!pL&crSB!i)C-Lm`Ve%ouu0Q8A(w+mNOiQSUFcILq542aqPRo9L<(Not+m8Al7l6LV#8~(7 zUl3=1Rc_r>4s7qhd|OFzObGQ56#8XlWnp32XLmrRK*s05RD51n3CNHVLAM?}eE9NT zd1aSbvqZlyT_96|0|0gMr3K@|Lv3A(3logs-klR4|MN$}ohA6CxN(VzZLHN&RaTRY zi+!$YhF}Fs&CAa_?}fU(i#a7J@&B%WAb zA`}SpSmf#tjAk3NN2yR%%sTOpePn)yyfkSPR@OODQYJ50;bb8W_ zxky%7?e4thTPd3m3x|&2J2%BQp>yXZsyDZ;K;gJ_WuYhB)ye7L2pbwwuZ4X1()x}> z2!xWwq@^S6rOw9i(-r{BV?QPR?EfM$7zX>9n8M~yB_*M~@J|txFn`q5VPCyb!`nLt zJ`Qb>>?z>bGUSvZ6T=0dE_83-`^#_?UMY7wa4;|kiqVqo7a>dhDrU}Qx$CiWUrB*T zR{iba+*sv3bMwIdtUxsgCX9&1gKo(^e_m!j90!f9a3<=)s*IPRKwE#r(oqEowL1Tt z^Zf1C!sTuL>dz}^lkv1Vo+MYmjpG>~iYX2W1Qbl;-({M=-nxxdlmk2GMjBq#f3Cc<9s&BLQ;WzjnHwtu(y zqmJq^f}c`oO#AusH}-$CPow?sZ*;t$7fz5;QR#r=CLln(y@sIX2Z+dYokN_rcOA$J zbOEsx9WD^eB=ZA%>}$96iQ9G&TIo6oiX;8F}%d#BB^Czp*uYp z_B?j^T3&e-W5RX9f4%C}uBWy?vf{KevgxRUd0O9rp})} zqh+D-nE3HJvbqia?MK#E3B=tjX*?Z4ezU3XCgY-obhfN_zTFlQSV{CwKrMzSud0{+ za{W|P<{71Czch^a5Rhx&bKULA(pb~k zbgHPRc$2G#4Nhx60zpdN-vJOa;h2p*d_kK(nGrXXyU-sQiX>if0%Sp8zTMg?1#+6J z`Uu1YLcm6I+jl%KU3dfKXG)&u$Cu)Pf7jM#4m9NVfBSDS+$3Q8>78Ry2AtJpXVGeR zxe!F+-M0m0FlbV;vw!eHPyF=MGJj@LlHKV^53DH*i}A8uVz}jd9(4Nu3O-ooh$|PQ z!c%uBM0p;`SjD^$YSxyLTCOYByk1hmWR=F7=duP{SLL)?Ve0@DiS~)&U>D#N0Ah)P z3P`my$;&<8H+m0kD$>zHEBQTwyiQ!p%YNRNzPLBo%!Fl>Wrm_TlyH?G<}@KP@dzaj zC2^!2kBkh1ueA7t_=My)R4QLj%3OAadQz;VqfM?-nsx9#bKhK4N>5JaC2VLEjDEDi zO=~i=eXL`ht(kbi506Ru*lIg>z9qE2Xj zqXWu+;OeTVq@*@?SOW1O)|KlQu(4Ih!#{t9dYt**>gdh?FnKTE*4kPqgbmZsgp8JJ zGcFpzM@(I#zWR3hXZ$-*jcU{K68@fOdj2D>5@H%vLBBl(dwT zVvY^tFF(BuUxhaJ^f~qQIcL;)h%v+_CkaJFz)n#kVM0Z0b(PO@+~Y%>&W&4c5lAVi zZBkYTd1a4JQHxEy5OADXfl&z@&S72o;)h?XA2TCVWTtkH07vyN@a@%jzT?#N5ggwB zKRY`=xH_+m2|yc3|5rg4xE`B7Gf)*B!Lf*c>ya0F$-%>+Sm#>`Hrv7W@5Hn8nz%sz z7>I+J-WYDL=jThlJ#)N(E%6<4-A>8U(qp!l2v61=BF__N-@kh}HRl?Uj>Y)N++c3C z;)xe4BO}OjPY>wCFwQ-Cq?(b@lG_59MonX)#0H`_;jQ2jbzh;;*YUh>=a!(R2T!N! z3#@8iIvN@gu#SE5#2*PYa~oUR;X>0U-d>5@cke>D#?H)~HBcn#iDpl1p2Z+ss=p)yC-r($AlwP1f9%m1Xp?I7su*P?=g+uW0LarF7^@F}Q? z!EDQA$HdYsvxWCBQiJhK6}_UQq&UDpw1|$5&R-HoWgP}QnoakI--;kqvO)Hx;J*&D zbI`O}U~j4?CT0#tKA(gH`DdHCV$CD*+CId%7?e>3Vem?kFO#+!egr%iR6;g`8L_M0V z_O<TY0cywDyafi#*zpv2BkFhc(XL#bFW!-svuwkz6VU4(Qr{oNjdp3AwfO_1S}1EtBY3x`olpsibtLpU?|w^z(xtaHk<@u!hM; z$2m|~5knwe^`%3`r$4`c&h5%;VJId+y{|~O4lcJ-8wUp)yMo%64G<%4K+Y@Qyh!nu4^J`!XtheeW+(p8~lHHYppsY5RY>fP?nlJ|_WK zzaw6~cp(hR_7zWLWsARme?hTW`F{>pNR=VC)cQXMYbxE^7|BREX&`5bkHp#-1?0%? z?%s0im^3Pynh#yJJ8b7EV+Xtx4od?d_Cs25w@ZugAfov-4^Jikho#o$pN4pf~&V|Dz_~_No7v|DkDZ;Km9<*`876IWoBQ01JuN%Cgq9W%z&8+f3*A{jCnEs(RX{m&-yaF?6Vp?% z9RL**@T_yE9cX~aBZ?COw<2Ij{C8&o%cL~<{+FzeuJF8>)c*1pY zMP6QZ?=BVC`iccyKSY35>57jJDRe2cx7U?if;124$PD+JgKzP8Awlg8%C_~DoaRH4 zwBQs9?Nqi1MV`5xrD8ab@6ejBBm-@qI$?0ou&OGThv#u#p5xK>f+S*Z^|1tkpEiL- ztF^5)ib&qdsy2%P# zQ{j2~fN*D_=NE)%$n)n#KYrA{7EPuv#x!$y* z^Mfl_0xq0CN5~2nH$A-{(ihL37zfs@Dx?$Wi=UT+dg2=4TVG!jQ&RyKVlhNm*!64I zKEiDeu`LKxfWu@;Qc{)ML0)F2=JV&GA|f>O^m8Z2*ih~QsViDqTJYTg(|T7Qp3qD?865D=WZb8{Di_=^&` zmYy;*Fu3n!$6u5vleR0zJC7+`2Wa?@ACzz33cRGa5Kl9);pFUmKthsf3%)=k6cl^= z))i%C_f^)*ZDw}AJuCK4&6{vsRD7X1VhaoAlo*v)Q6XbvsdODx64K0*qmyDy7sFdP zbJ;^SPEg2|D+rnNZ4ITc9xzmW%0UQ(A{(sg4)Muo7dqibskH7~8ly%{eB zC~EbbxMr>8+SoMQD)CBc>(eppiez=*nYJ@nG5xFBRNH#`jwV4?7e4}mnXD%HC{DCLh`0L64pv> ztzX7Tm#J~uw1g$hyf2iJ)YJ-J#!LzAt{(HTvY!47*+HMt@cegl0lDKv4F+xVuV2m^ zQ*RR!>4y2wojV5=!K3wabKv}>k^2%WF1Xt1>@}T8saXEc_80b%G-8J!z{Sn55DGqu zOH3H+&QG48qxHr{!GJ*b>r|(2$|DOu!d2CioDNJrSh=9}4IdJ|&i=yFUZR*+D- z+ek_TQVIz#U%EjHthMz6L7nZfN@jKS>&)tdz~8neI*DwA+kJZVGZx0aC-j zpVs%;FW39yWlm%C;)jLRr3YHwA$aoS(t`(8A>YO-Z+$j6=k>ZPab*_&i{gO|+?A#S zCx$<|63H{Fz>n?f6+U_UB(?mzec~`gO60l4Yu^&LPzPJ&pvg2VZqRx|K(BE=-S#?@ z73|j1#h?9IS2Df{I9fOshM3SVc7M|%(hb_$_Zc$~2w2u_zkc1JCHge0N&nr`b9i&pMz&)VVYk@30DV*^+dZvN3~X+B zwl-W`vH7#kcPHa|$B!SM(KBTNsW->NhXx}hwg09&(K}X2>;qJHqoZ50CScDC&_3km zHjFR?kQcHesvu|+c*Mu&Y4%s37~p~aYR_U^^4&Q8oBLZGpG?>&;Me+0a54^`ss(0S*ir2Jt1d=6v%8}N%A zRyCIw%S`6l=@33aR5dCDI2T|wKnMdD&#haTm2YH6%U{2t0wN?02=JLhE~(^t*~-A+ zE+Mc82<5|BVr1fWX%gOEA;qOyRg{;v-e1=l;cz|j9O%!_Cm#fgvQRa9QxF9!6BEG9 zdg9`ZNJ6JEHZsvokZzfOP=EQhkjFZYP^FE#~Itkx74(lovDm8v(%k8%1M81p7Du!g(B* z#qv3}wXI+a>U@So@f4_%){f%`OF8X90){p{4@$d(?UvKzP&;JbBtE7Ndrue5e5gxm{8yy$Xtzkl0&CK z_!r4o)_<07A^QMk?8}(mt2_a60K{JzDN~v{Kx_ z!^3lO^7`IBI=V64*yw=#MgU5i{URsdzJ7I?s3Gfzt~+?*AN-Ke$33UA&i>%RF-`#X?VC3_Txke+;{FPv3)l-pf>eXl4koUmg13C^`^ zmAmX%0B>6ribD9Fr_qRBrxSxJ=T8nBQ*A`_sGjaTB={)b)hdtDP>pbyf03M=+{#OV zQDbODAw(KJ1Nltv2Vv@ot;dB09Lcg&eJQdMcjHW;pC^lmh=?vBBBJT-+s9B~LA)|D zs;RVJ8QOu;s#1G}-NM6SU3BsQm@^>wz$g0r@#90bPN1EDxPOUGHK?h63@umG!j#j| z0e6>!x zoSU0=bQQ*(-JlivX&x6^g9|NS+b~aM!GBSrn*OB$FwN&z*6 zlP@#>Y-I>1dcV;T`w$UfWMm|X7_rP{W@1`=By49_5FM=n&DMn*u#AAJuBEMA6}0tt zG2viB4lPt2^J6RRw%g}Q_Z$koprmj5FGJY~?kg*UlYn}z%tj^LwOClAmvC_Ka0Am* z2~<@hY>M|=ny0FyFjAY6zTN5Cz)bc3{+$RNyVp1Z%Pj?(Nd13yteL&~b1dNMK-l$} z;nT~PlyiUnz}*&>@ds*NHsn1iG`ZrCUF1y{q7&#Blq@IG63j zv_4pDJx)K%U$NJz_qwS}X85u(AwexxLbeUw)D~FP&>zmu&MsKJdZJoc zSqVw(#^gRw-LZEd z&=ubBIw# zf8o~Eo@wD>oGmaLhOEKt!$JHX!(Y{zC;A_UZ$q})K9jAQbFR`3*FIAG;yyIIFflVT zgA`aPEtQ0bh;HqhgKE^Kt;wPW?dzy0^}eVBIRv1nReM4B-f1m{_E%n~Oj62j~G1dj@o2nytY-h^sx4_$~mbb+Voa@VI^#aAd0s$c=ATAV6b;QA(DAkqcQ=i`R;4X6nD35 zpbIl=FTXS$Cec^NFdDqi=K;jF+q8BlfG)ptvyNM>2;St0>=Fu^-Ei`jz@P13dgc)( zg$Qw^qwl)i|KQvrad4A@qN1FlVk#F4Ep2x}TI1>P(*6b!EVaf)ai!p`j-Z54I%wg6 zuW@=bNZVVOBKry5p+_>KihU3ss>Ilj9v;}n8*t2zfvC-GS`b!+RrXpK7{l_|^vw6} zMesRVsH&Tg62Nu&mj<1-I znS@TmA1y`9<*w7K1v<&O&#>hzq3dOI_~=9N9u44@05#CMY~JSL;P{M$Tc6Ky^(QYi zdsHUkY4uTz$=z=3H z1_oE>2Bw!~NN8-K<+LE}qV8~_?OJ>2^qS51%J6r~q9Zf;F3$n+AXj3?!;T&VhxrM| zWBtdp_gU^&S#63+y^{Lz>4LPDG!Z+IhQx6CodSuF;PdX7&it`UF9*I)eE-lw6HH5$ zmY&hB&2?1A21)u+@oGm$3jmZc8^c!xPZg*h2zjjUi`N9gE1y1l3KXGMzR11h@%*8# zY^@T9)79gWh?1#dsVft9<`{d8S3cadb?;$XI&*xV^fHh@%He_$B5C zMbds;N~Qp+Q~7Ai!+tCo+l1xFBYR}{Ni zsup~;`BQdkPfNyO(+RAFKg54Z9!6Kbb>GbY)6DagTQqo;Z^%Jq7?TuFQrUR(Hvf}| z2WH|kt$YKksLIo|D9tk998->Xtk-QYKPzS$Dlp1y8I00=4O1Tdnp^hPquRixk>E*# zptuLxPu1_&a8u7~66}R#e_c(v;<52yqgv|l4i|6H;zV*obeNgiLzhLP)tT8l(VpWd z*O~J04$ZMbhk+1A30R*4Ft5E=AYg~OKqgwrS9lbr!Q+TaK_Z1=i5k6u!^2gepX7fz zT7}$t#yA`WfC5~-dKC~$KqTARK!^1aly;yylMv@ZU!z1I87D|5@Y7uTJBLW<(YW!b zQ-9-S_{p(p!FLQCe8}A$9XpzWiJ;>=v)0aQ?MIt=R#jDhx)PNd=i_}KY2@gfNwRGS3h9{EKb4yn73p_CtOu z@plKlOPo@|Ei}eg2`p}D^=Q>$4Wf|uU#=43T9LgldO2VCYbpQI_)JywD{h8q^NWtO ziDBZ#X~x*aRIN_Yxi;-j1?Vc<-FZ{0WM+ok?@KG*?TBS!V0J!P+sf_A&0-eHXQM_> znirev_C1dwjy<4}LoS%tE{fi0lifOmmWh|?W!mc@Wk{Jorpw|ev(ksButi$Cn^+KwzpJOqgPAc zUDe`VtiNzQdvuOsf|-u7?y)+r?E=G^LX)SEphu$1+-UxdRsii$D3P@h@4ryTQ~6@}b1|z2~7= zwvVb^QD<+%+CB7C3eVR!2+-3iD9{`tF8-JDym;ngkFkF@^engsdJ6Ce)rB5Iq68&M zL9;!OD+4Hj;=gb9N{2l@KT?{726w2}8*bmO$G$r6u{yE?`bGU}@gYxTJG#4!hf-we z`$ejxBqftR^(;du3Pgv!ReK50s+dTG3~_JS+OjA4pvc_Q#X05`kf0X*lxMRFb_)IP z)o^=}^Ej`MpL%`ab$U1a$a9LHaN*`sA)BcP!b1X8(oHt7H$BfiK*jIEMi|56B2G;J zlR9iud^)iD%sF(5w>y+?-xrfyP;(?F-L-bFBztIEC&hL}aMk#0yKPMA3f%D{zCo{L z^vhYf`M6o>I}E<#65eUJ1B_E5`NgGPB5WCgke&-E%??zA)^8ihJ}P|3ICST<9Cd5{ z!hj&Q6}l_HdEBEi@hoR@03e9Tev&VhW)Ax0!ARoI#K~=O;)qMZM3=8z<}BbS*$|Ga zsrbUbnr`FSA19}&Xl80q{-XI!RkAyT0&cGAXWMHC#2XTFa^Ppx^5R%mf2p=#68u+5 z9EA9)8jfdl4lgOm@3dY6qHz7eaUmfOtf%THCMHa#;rPSGy9IM%n-%w8Fs&WU@yog? zr~v{j6{t(fLKAH$qoXSJYw_mR%mdKbjOIv_#VXCxz;BDK6o2+?daarppUR>Iefr8x z_ivcO+>BK=6_D33J0A5}j7MAR!wQ{%MZ)N9fWrZuBE5ZTXWP`M4&b zIj+nyH6@Ax&hF5VPc#Xn9omX`cN_1v$MIKJiXX{D#kkzu;XOIBw&15{_d`xmHQBOK zG!4vt5@#-}IAz+|2^dgn%Fue9Q{t;L_xQ)r6&uvv^t4%{((zEa2kTyc##|2Mb=ZNo z5QyS87Pw~I>p7L4B-e>Ob|*H1r%Ue;_}|-f_*0yMwa-CF7+d0m^@$Y>?)t~k9a3(A z{zMcqUk00b8(fPm9=Aso@-i%t{EK^2-4}TRs8N7o;$FQ9WwPf$d;{a)CG0pJTLY*R z7FxTzy94v#u5?uI>H>P2;Tbd;9a5E*?df1Ony8@!mzOrQvRSZq1czO^Q8m6H0Ej=wmDX4|ft)diyByZC_!Y<$v z?j|nxar6rEZXN6Dq}Y%Hsi|-5d5>I6M~mk%$~|j!xhwz57gDR?p~InOljcx!4h#K? zq>|gKTFe4jWSU7)>8+=;Ga$=4=BF~jm_0d=hT?*SjjDdUOZ=GxY1Fr>^w8!ZoSm^7 zTzY*YN`8)1V}B~s^oPUZ9yvjR)yCA8@FP(%D%Eajc!fOie6LT!%S&jw34m@4Ow010 z?l!x)MEwga6MgwC7mIy-E^a1uE z8?~)rv)Q!v%lq)-S_f$gvzO7bKsKg7gv>o-pUzK)5l987K)40I~t zHaPO&TKn0Z*9U_?kaOy7e+#HOhiyC3!;#nIy<}@9NB#VbP^}x?54)$6gXt3J%7ecM zS;rza?4kW?`Ab!?_;nhPRB6DNn8JU2UtViBL?!mAxlhB~CeLY+Mq zyBAYro;{(XMJFjPsEG%_WiU5fv~8lN=AD@DOElfhPUEevSUz^qywgzlo3y#5eVR+q z9m`~otp5*UIM|~4=y26fXYcu{HK(Zcr41O_n1DwE<7q+zSM3(3h@IyYmNxy7$Xn$e zt#d)LojvjDPoQ%Y;KP9D3hdB_zImc%7sZ2#xdIiO|B=t|xW{|-fd2t8;zJG&U}*P( zH;0l^Ru&y_ye%5v--L9ruW@C0nO{Hv8Xip1X(sx?_03reou7At+ETyBMD*bB-t5+6 zclR71;RLq(6P*KKS`R!H0FDr_7(p#BSBUxX12;~s=^RF?ClmpoL9sViFS`14SE30Y zL(mkIVG+dhpJNP0;lrSFGgM^X}&m+92=oJSZKqzV?!+ zB+!7j&BV#X(sOML)Ah6nh=rR%GoGWThkmvtoO?*gt+)o3vD?*Yyfl35(Hb$bO>%z7 zZ0(Zfz%{|j;riA;iF18iowHn!9^~luMx|DqkJG;K-63bv?|x2%$JX9yn2dYO{S@lG z$?*4Ir1~gurLJ;O4OQ&?R9>BVOGGN@PD>eV_|ky(uCER{%7zB>OZc7zHZvBJ4Exew z=Gi<@FaBZuxjp7 z)t;0@G%!uQF8%*mq4=IG7xz5?sD#@gD~m4|Z_^p5_mOP6Un?q><2WTUjqLDIZPBS;SjjaQ)gAT2Ui*w!jH&KpjmNi-YKNEjSjEKXgE)6tkV2=|M z91#!TVn*IOvF0Zd--|~ykjZ#Xo9XlFLIrzvmp_d0p>W4zm&xNJtjS6Jw6vLq25>=!KQqPLNoUg1Y=L1G$?@x8 zLvOU8U@$|a`Zxk0<>s3=ZG~=dv$4tXT2b%TytWj=l0YaHBvfc3#KlD=BpSP)4>dnc z*D4?4JtG`K76n2*rUnLhOT=j+JNiQAVvkarx#myXYYJxqS$<(94*=L z^nCM1SC9D7EvU#@aEM9Us>;%X`vPQb2g)nMe5ba;Dj!-NOb`XbaL3 z8+~1et^LTF26*KoRI}}Bg5W>T$VzW{+JDR$977yVY$urNTD{6o$+{{(a=DlUAPnUE zoRW}dQLM_+zz3vapHgX{o_3RZfqBQ^n-igPXC`!s#aAS?b^-3--TaCo;;5__F z!XdC(05MnXg@_y-R5+N#H|R{T~f&Ui{hl07Jn08DnZ zE2l~20-L!ZuXTUD_b@)?h=WxpQY3jr3SN|Em>EtSZZ|g+qpRijmLFgKxl&ZIiT0nE zpOA*;H?_|8H&2sU!v!5s%ygZQkS3v4@8X(zc>wb6uyh!NW3(1{hU32O!@=fg_$%M7 z9sDWS#|-x4Hur>PPVEQU?0rlNLtsV1!F>3eqPmHbIGg~&^7Y6>!{^%HN*P=OIJ%1#W?3TWcN)!Jb~3APEql@zY7l~EY4nt@nZp~Gv$s{05TQ&LJ8!NDmKtW^=E*X8wjwm zwTB1I5^-Fv?OaHuYcK=@Ym*O1A?@)}ueV15VHn!F>>V9tUklgp5@O)cfmSAh!((>e zWO~}*JzWCaH!9?D#oY2?Us@Lw=Y2y z!8n(BoAwFAla6YE^51qDyb=R)duD^bVME!lmdYT%729dlfu%|5?316 zLexXs1O6qaQA?}H{U)JSrBxwY^#>$}J*WHH;jZnx%FaGI%fYQO3Z#6QVVJ2>n$?Za zZ-2*AF1wbkS+z!_67M^(uAs6UC$@<=5!g?V4)8sZtJE&B8EBRsi!LEj5?^6Y?O6R( z-f*YhUs6rUIce)>dbyF&|6}Scz@qxT@8MBD3W9{Bv{;mYN(u-FC<@XgIV#=K9SVp_ zNsBZ{mvl)eh8T1F60f( z=Hnr{`YM2iyO!18BqAaCxxM9FZXEu?8z1Bce7KAoFn+vnRWlqN7oX;8lSA`~sIu}m z8?scIot+BT(__$K9cc8+*M}%uX*_^t)%w}iVV(m01gN`oc3X>H9#}36($;TnXj=Jj zf#XoO;FGP+0}eh?;Ihfi%Bop0jECAgCyZ%dth95%Q@f@}RZL+rL;i;$hw*fZt;oL! zzV;pV&9y4!dSn%3(<>*BzT6l6;7hU5)zhX9pjWy>-zD8y9W%jlRU5IY(i6cd7l5FX zlD;z?<;PVde4YmUVPF+`dQgwTh_>>z?H&Dz6)#>LKiLRw?YjfcIF{}`?#1TgmaPXC zkBYOzi$GYo;+Z}D?VCyCFEoK#jBY9ADtT2`c*r(d^(8noc;}8()>63Uxpw^=`m51+ z{D)mGfU;|EXs6?~Fg0ZjR~W6&*RvC88BiUKEK=Pwsdj&Tp(GWIKA_1}Y1gQ`pgGU9 z6)ZkN!h&|#7NQf<6O4$Jj)czOnqDNk)=!7MHH_08h$i)`J`)w)9zePk6qwZit7Hg2 zy1N&uuX`JxDvXNc*4}QHx0u-U@NhS)dO9y3Gyb*ed$i7l1)|=0=P%&W3f}EF*7y4F z-St!SnD_9ol!j(uv8i^{U&70zHk?>HqAus%lZGVFN=;)e-P?_N6w6cFBif%u<55x z;r50dvTQ)YCOF8OTY%x)s!T<4^=eml&q19QUG#N$y029OI~J(EDw=cmN4*dFCGO+E z1^bY!yu?PL+qYQ%mW9noBd#PFO-0NMbU&cy<#pcFGpC9Kc$*N?BPIf>{+vty^07*O zOep#tNy>ueF$|(25j!n76w}d-Y>P3C2+^_KOrENAG1%=x8VMbB9<5E;63~4Ua!%FJ z7e5tfSCExkw>{heF!|v^$5~?nyq~P5oLnyS)U8bwWqJs+Qo+$(zB?l|H3hz_Ww?F& z{@Yh}{Y--BmQa2c<>fy;DKh|@0?7kmFbQIA(AJ6?$dP0_3r1Au%+nSo`OEr~|x|pS^O-nOo-A>)V6vzFksg=s! zQLUkohe9ZZfvuhEVJip63>MyJ@pr^$FYM_H=H?lwm&C*_{g30qpp*_;3Bw)iA8iN? z_LQ@uxXy|^&UMlJ1g?jsl8yeR{h1LrZ^)aw`e1{i*t-4CzKpTuWk;=Y+tr2Gfy5b1 z5gK#h1%Ov!2I^Wr)5nkCZz^QiZJw4!@xM4DTfwwPI$BDcl!FWk**YmqHOMcu8u{Rz z;d}LS?A9cImsV-_^pZlopv!-!zO#FWLcIg*l2W=<(BcD^dvJ7gBj0&vc3?zZxMaP% zO914!*U=Z<--!oI!x3d5J+upmW&6%@kRKx`acKh<(1JZRHGI6hZ+4cspx&AZ&%akl zs_@&lA`Y(m9MBng_QHY*P`1EuLQ<~Zz`=95MjRaX{Z_}n^@HdOc#oXV)eb1Pz8dng zDq0$PfFIDuFJ-D`T0N$@KU!5K_3Y!vDC*rjP9~<7>Ns9De+&a2bEy@XG_qHjyox?w z84h$naIHm_SwsJbK@%{yLC3R>?}^Rj%gr46*}dKJ6S>;Co}RpzmKZ*pVZa;wzhQpFxR(Un9+NEtBJ7XP zs%Mrm)%rG;Rr}-PvOgIceG`AegmI{VV+*HF!bWKKmc;4XCA_TNW0%e{099P4I*tY^-Of zq+u2t35j)h2l>kQ*k_wBZqVW(9a;23QPFyJd=AK;7={O@k(rrLNr|r`L`@%`!*aWe zn4kW=oHHQHxO8beC@f5eW)?WRy8o)&h;ica_sFG49*d$PMJ;Kux`kq12l=6{KpVza zFU)H%we4?~u6!OHH6SJixCe8^t^et&ZJBUG=IcoTez%GNj+`q~13GkJ!M%p6f3(2R zb9?1xXi+--`+%Kx%YY@F2j&lm+2v&@v+jNU>Y1hxJ~v;f4M)Jg*JPxCL(m|mlZ!-5 z3?9P#0y$(wXaBawKE=BC2;KQuR{5#eEoP&wM!E-KVVT75WIMm!7u9aKa)W5iUN<7* zQ|*V`e*wlX98^zG*lR982HslgSsE=xL5D+TzVL(!ViVQW zj1gZ<+nK#N(3RlK<8;8;Jml~kY#{&kabfNPX+G1ik49%_DiB^hK0wVs@hSR$_eamV z2f{a@mCntkD4_0l<};wgu8VOlbf^^M(!X;T53%{9I3MeVDGp*Tzjk=*#Do}l0h`xQ z_Xlw;!1DkFT658?bUvJI7A6l51hG5FCP0R%wyUcF8lB!uw>AfpSGYtr!<77cRjULA z1_BVGAN?KbfjBpRGw^dOEbV*YROH8n?rEJ|J@tVE<-~{(nGJ}xSrkYbw$tI$#7mX>f)M# z&U=E+Uu~!fB?MxYA~@<6hy&vaIE(De``?}YYTVU_uA@j*)tccl4$RE}yA5`rw#X?} z)lztbwQ`Dz&X7_?MG5pj{)h|QC-11Jt>Ho|djVR^^IC(ctT~Vs2|Uz?4jT#3JAygp z{Jr)bhzDrBefw57`aQ6aQqqcdhyQg#WBz?Fyp!}ui(OSdFkD>hJZ;Y0`b_4G`x+6* z{T|JcoAICaXC*8e{BIrPf{bx5=pJFh^5Z!FD>Oz5%E}-MVFTYymDsQVwdbce0SnyY z$1v8Bh^QmI&3Poa%wl#&cNu77t4)@|1*$*DZij?yeFjAD@8!-;NK71{|NHMf9|?)5 ztVs?Pd>WC>Dbs6od60F{Gx23vMQCprkca_F~vhOy$E-AM;%a=bzHdjTQ8y+0aQapkZ@;OQnI$DMqTfG%W0ks+h2YCBV^S{0D6oS zs<=&%CL?+kQ>0DpmS2J$;sd}$p=SI4ySKnX%=G$5;C%tsVPV={?|QO?S`#V zv%1osHTuE1*bJu3ah!n8$JB%y#nA%hXLAHby0cod%(`{h(New}o>5%3s=6J_*qu#W z=un`14^Uul@0EV0)VMf*GN6%`5=^VyHq=tLCPSbRS+K9`y+vH|2a!NqEGBM4dL51XsMpOpQHz#|TY>x9lW zL3mEP?W(!cvtGEdF}8IBcI}@@`70`foKf`|DicI;=~1JjnNd+{4;4j|?%OaI2clLx zFoOga=UbT7o&EitJw3p<1y5OazPGOee8|no$isiMpWhw_&^Rhe5A2fi{c;Vu`hmB= zs_qH`F*=d3{3}H=l%H0eR?3Tr{I1t^Ffbs2CnvjFA?>QEPG^P_54Nw4ch`9H7O?-7 z8vIlo9hDs&$uN-`bPCDXZD0T6jK%TMGw)TXmIjG~_cR{fda_iN0dhdM)w;~u@U^L_ zp0ROnehT!vy^n~f?M++ocn`#dO3voj$ce1OU1XKhZcop7v(dpax6|Bw{R}@D%@WyS zW0msf!IfJ-={`$6lQrpiT53A-<;M?mAvG8V?Mv(SVz(IC+W9Qr|64x>KX7n91E1>y z0SpiJkEzL5nh-AbH=r{%ZoJ&$=1*uv2A);zmC8yLv+*m)k~MJ`7uFB=p+{5w8WoC` z_s3H;HOv0YzJY8n%#+<7d@!KP&1$0YfqRf&LzK;%de~ucy4mMnO2Vn-jlYjaHQ&H@ z@v7WN5lG=cvUT=Q5UJ81aa>n_)t2JTofN*!(HSqdbA9*D14OF1T^!{s){E(W%$MlB zvbWwU7FyVl)1WTCy1&>(zVcE|Zi?y}uffJ_N498_MwVFUJZTx>=b+1hdUeSirYjIDP zq2t;lrIJz-(sc-E%2JR|##NS)I|qDxgKl(Q@{Y_2MmlA$NAbRzw)1JwQnU{_ltELG zo5Hlhe5g2Arz76nC%6~>Va5p0@E;^c%+Tc$99+7R%%SHz_IOrDH}S#+I*p(9OKVf5 z?d_I%d1AA~gg=^FGn8vx8)Eu0qAy(;EZ4&eXgq8X#arw%&d%T503CtrySFZ*z^4$BOjFEAHOOb(7 zkJYE1)4}r9J<5*LfSG~kH~5K$f^Xe;^I90P`Zk$6kH{yMFt%@qcilWC@%bt zKFlYCoLl4s8y^v;OigXlpB=rrXux6I{~$&T5%;$8Xd>LSyf8Z7q`iE6bW43^x92F9 zcGMv*&tT*5peN_pb<@Y`DuW$HcsNZ5{`%wAAhnl`G6K-AZ^v^cK}n?DVR;V>VEHfJWFhz9XrMd0zz!_PCE;xY%XJ!jQ&E?5lt+D zr%%LFz9&;IqRe-8tKdvpo`L$JRbknFWLy7vaBnXRkE+OYT;TB4L2Edb9r}uZ)qKrN zW8c^q%E565Jt!y6P?a+XZ7@634}&x->{3og#i|Y`YbxX7P{8o7wCkvEPLuYd)Ep_u zEzWi5F+#FxehZ6X^J56O_F67Gitx?;!FHgWTt34Kduq}`uIrOIlHm^?a6HOTq~Lh_ zYDYe$J@(XULeTK1;XwA6PFZ@fdK^+gbkD+sU3g4o^Tg?DYqyFsBwg$V zKK>AK(WU=1aPVzyt*N^+26irB;l~O%tWJsY=r4eA`)h%aTv36cofW8ff2UixG4xa@a-tfUkwaPG(+)F_+!$M zLJSQ>KGp>@_(gKNq_kpI!*w_4A8HLdo|>M1<}u;aURRf@lyM1qI}*iryP&y-AD>gk z((+HxZ4_{D(TjTxvDj&fZ{BSD@~Y}jp99ShV^!Fv6zhKf*4h5!kSN}vnx~_wq4DeM zeU~}u|AaX-4p8!)mDde5>hmRl1>!}R#*|id_o%+Vrf8zcHT2o8$s&NR(`r+vvxBX@l$SYJCO z!0)p!-;bH<(5f6AJsst2xzg2-mHoD-f^6I%lwe@qIhP+UDk{<=-^1*vnAuYzJ%Tpf ztjbU)lna!jQZf1IbeK&z{c8!g+ewj;gji4JOC_DN!rsoKVe>r)55fd^F8p2 zOYPI0W08**9F3t&3U?0ofCb+X%j>rJM=CMzDcturN1pA>Rn@vR%&OHQCl7yndNL#E z!q@aSSZ>6z;kkZVXn%g8mRaeu#ZX>DL$`483kv!={|i_!UkZ%7Zm4)n>}IHlKM^-J zHeN7UQ!g~^NtcTJz8+7^;7KTSd~(>3B+0^Cxqg|AJX=$JZL_1>UN(Ss2+uVlB0|V~ z@ZRh8sHot9y#xQ~hnpp_$ozxtO%2ob?xdla0LPsW$|F~xVE^%>V&{0!f4Z-)XkB1! zyE|2Ts$RYWg*~OwQBOiQWa&ojH?Hn9m&cC}-@o@H)bgX!w`;pNQ8@_Mk;V?b<`URx{}J0hL$YsAYo(crk3;Z~9yq3o(8X4sC) zej2SwN{8Y%RD4wDwo~1itx(@ZkLNkf1p3JbOvp?eg}5*~1htV@9ForPn&I=y z&%0ZD#AR^lm0im>MkXq=Mhdd6*LLTs8pY~wG2C(E*pB4qK|jL+7cmyk!6Ms{EL8CW zExqO80+u_>Px(koc;41_P!;`Wnzkq>=lDIX14|H;xPD7-?5AP`qyYrK-+J*`>YIw8Zb1s!GT$kWxoR zr?H3m3)F;IuHQ}-Vy9fdNil3p@-j?KgR;#94``r|>3<>p{IY=6Q|$G}+kb|KhrM3bG>()zmD|cBCi0j}&=OHP{yEw& z^1wn0y}iD0lhi7GVdC69cjDbc-%W3$|B`^7MJx+k0WD|&kPJi-b_a&NrF8YxrjZFVV?EQ z@^h;N36~FTfBJ$QH@_Rt5EK18*bOIgy|4G8P$Kk3V#0T_Mj5>}OFN78_AVMbxH*M| z4m)URcJUz-myV6Or}JzljRp%JoBqSrAEl0-o>OpkX!O5Kf5&xOskq2=dwc7xXJH!WMS|s&M#EyL~i0!c64;_WVq$ABRv}iws3dm zG*SfVm*;+zeL?)#vno}tc#^G_5PdoK;tBofs$S{o$yYeuR!v7%I`>Qny*=7HXKSmR z2dPx*w|DPOI)pl69?XrHj^G268Cn3|(F!5b%<(gT@Xblf{<+F?DFHFu5AJ^}dzEhe+@W}*`}&^z+MeKy z7a>_cndqG>xp}!bICZ88S*S8rsEQ^^Ef|>Smr~4K)iw@^=smNuv-Mp%ymx82x6RZN&HNU+ zI(GNa&n2FfZS00lxE;96h6L{a+$Hvw*3s3QbC8%2u6pcq34e~JQthNKue9||!W*OB zv@T-(kfGUcKq)OIbKmeXi<}6F0kha#E5~ZEbCR^YcI7j7Ktus?lRsTKqHRtKaPh@TpU^ zO7pDWidDJVxHzK)?eDE;*ujr91usIb48@0Nl(AY-ruFkxe;U-m-mP1A*wk|0G-s;r zi@PxJh2@~nS2}Ne@AQF@LI}rPxv~XfNH^?oQZIUmbR~N4npc_1JbN}xpJT5=eCNs) zTw^xLoF_&`!@na=t?cY*c{@{PGcF(`e6!6WZc8S&MeSD|AIgASgzNFP7)|sq0mRj6 zr(gM%DKIcn2MM*e={I@pJ&hS5BDFbl)IU%(xd!x?Rgrj@fF2cV`RjnGg@Ph2Au9b z+dEpBs6_rjtM8$Hu^pE`!*U`(J+c|>J$6H%I@ENyJl)F8n;OCZH;i~9qN@Xt&Z9|g z@Ev$1={_ty_3%-hL{vGWN0-rphEn_}5kZ1v^^qcZyV&m# zmb)iaU(oK3TS~~tAS+!f2&Yj@3VG#+o`iERr1X8M7(B5r<4H+BZ+2)NP)MHL&*iXF zQAsP8>CRPRF(h1{{X{su%A%4zUPABr@}y5?Xbh~v`M8X({OJ%P7j zt0#wl|2F=FJe$i{Dul{Abz%`tlc9U%zzAAE{B1jYZStBR{H<>scd5UMn>(MiP@&ZM`aG1^{9dTyu1ROC=OmuMeHfHO6O=wuFteL zWw=jGw03U@jyEt@E%1IAbF*nRtp_0Z{mJI@x~5b{LqgiCa)t7@4VTe>jO4O~39@oe zQmW7nCYimAj1^G=Zk1*c4<71kRXA`Q4!rr^>#*&u8WE%QlLdnb*vA4TcN_i4aIupX z8jK-H>h%f@b?~^vb$YZZTjlDtPskv<0fnn#Lxt+N$C?_NG;{6e5sa5{yx=&STUMr9 zWXjKLyF5zg76pe+b~{D{Wk+{|Jofr>bAECAPpeIT&OO_MVqNP~t3+9&qhQxI<#M^l zLQBT4H~;wSIGg+o5y!UJ?H?ocQT`8&_d?=X%fp9ghp5s}2d!3c0^3ua!F|c;c99^q zwGemUI}*#0;J1T7Is5wSz1pVyTPFJ=0~vV!lu{Iz^OVtLmg5>$~gB7 zQ7HZIDJ-6{M?Fg_ys@rF77|A3(S?QiiQ0Gs0mFUiq{yc*);~Evx}J<4#Kx2r<5aq+ zW6L$yCtVAkO-RX5uZ}22kB45m8W;#)4(<1OI9h4dBdXSuRZb|(JS!X%W=naNdsP<4 za3{p#6>;c8L>5UhZ=R8KaNdj*c`z{@?-b<1jw{TaD*Gaxg358(PTVaa23Q1GE`0t`r>vlhRCkK~?wP3-~+q=;TH`epX>Z|-Mf%8S=!y1Lj+ zOj%h}l&2bbG4ni*5w=O0h`@M45$wRLG@6S~AoB_T{Y}X?&GM5^K=`GLqrK8^bPO0h zpS_S^uGR?UcyRB_r4g0vEu)Y|V!A>QI`j4O(P~VqZa( zLl=j5hDryE!c$FGB5VZXeK^9hs`u+O2ib^vx4+Dt2IofFFIaK67Ekky7jw%Sx3)J2 zA1kJOJu!5gX~9b?&oRnM-&FaXqmh_LINg~oN_;5ej4I@K+GgLwglp{co@bBLzj7*r zz4gl{(FW)HcRC(^X!yX~hPlrWUmKJyGs))w!9UFAzLhTg(EBboepa0QLSVE1G9WD1 zLfJAe;YGynSskSTM>1lC5?s;RS}#H+7Nzd~ezrX&E@l-$ySbLWNFGS`RF^eP%|pXt zVm6b+>s4a;owsH`84l&8XQ)?fWOQUadHRI(EnU5a+(f7d5@}%gDf8~w^f(m;6RJMU zR7fF%8p{`Oi1d$%F+1Fm0^TGDjLeoA{@LypOSIooSIQuZv)R_V{su+ei`UH5s&MHrElzWf#9C z(eBjD=yyCNeKk@I`erAk=COnc4#z67b=?C!#3E6AZh}k`$#sq~F(My5>*_)yx##$j z6q#`kmB$l&+cWyx4g+ZC1kgI>=B9>Bo?mxo0@g2=nir8Kswrhic(A+e(Vs?`e?G`2 z>WC#*RTcU8fRvd;_irN~PJ*#YPF>w>b#=Za);m3e(USg37Zw&}Yv!r44CVc#l&UCR z3)#y97ZItU?a}JahbtjpzYYcnexoJZ5k~VOBnUJgY0`^9=55*Sh7NP=b>6oAG>2qY zF?9by^;!g*fjlK@%w-7A8=#nOVHue^(2fq6B{&R;|h*Rj}6? zk7&@^YA@BFc_@fW>(c#hYQi3*{9>gxmTcoi=zUCpEPuN)Ho*r&8%F^>`RH+%MKs$c z!vSa~fp)0+zbPqXW4P86ZX4Fq-6F3$pi0WaV|dT0Iq1jQ8o*~+=gvh7o$z)v^Apet zIB)2HAeoWcaG*lUu-jIkwe$SmdUti9vxDK9n-94V$Yx7D@!t6}hyKItc?}XvT(|wX zCmKU#lSD20f+j`nHTm&10YZ&U)OAUJfjRSc*k<~G$jpYcD_&tYl0eUe- zYwN~%QTB^i`p}}PqoZ;8@{)kbVETX>A#T>^$dNsIQBT5h0y^50dh&o+K~jd} zIO+Y#ZH19Mn*j%$;#hj;m`+Qd=xbDckM+V3bK(?naGma1&W6jx{5<}2&t6C=O}=Yr zsAfV)7Ja?*nzHizZH@a6HX>ptPEL;b!<`L5xMqFB=!f%uW=KfE>smdHDq3bcYDAK! z3Ib1$eJ&&yTTwMED!$%VUqz8{@ah`P-@$vZSa2GCgk zO?Q4u2YReB{PZ>)zq)DN4~tg#m)&?-xmM;2BayBfbDum;9XeM$hlsz|3~Fg#*oCrM z3QK4U9M0~7&N<)=t0b8AMOk&|+Q`=r*xoQ=H200>5Adbl2kW@;NPEnN@6IP1eo1JC zj1_#tzmOU{YPuTGDJkgn^DwPDTeeWtHEjhQYecP z!L_%CXifUMKTmw9O-z$6j|~@vUTW>nZZkV|ijIjHKY-?&``lzAFOUUIqdf{!%O5*a$f)fxgmn{Hbh z)|q+b4DCkuMDY~oO)2;=78m#CH#>}#({6aaoI#;F^Q%=k;5?v#zAkHLVZrPi zrzGgQ_qqZO)t&KUxcA5rvIl)x>ZX8c!rLZ3Z36)w7R$zSvXljjoxl2Pl(E5ivLVcj z6*bh0>iZrppGG3`;u}Yr<#vn6N1=h!q3$eQrNnf)m#+894i^E^xf@xWS#sWbY2pdx z6%=P?jA_LOd^{nlE!CYNB_9=CJv|(HH9Ip_n*Estp{KS~`_i`skM=|j*XByt;Vq1( zhNllzC#ts7WvUJov9A)7a>P$~4wDr+aW3c11kjYu^YZbt?b*EJTnQeJ?PXTU_-4Vy zZkMwyl)XE#>^9TlXV-!Oa#FMWX(G!@L&JG$fo^Erx6#?v74|nnofXxjJZf>-iDdPQyNN^=!h`^dD#kC%ciL`>JKFsTvHJEYcRlKP@VB}0v8Wv( z9|Pml1t&=_k-$w|+pH*Y@f{S8@h{J)9>BJl@s!!s3g#N=^6jpZh`dx+vo#&D?fAy! z=;&zfNIqn3ZLKBrm4@k%2=eACJ9HF>VNmZVqXjF{6%M}>9bW@ChX)d$R?gtNcG#^D zEiFmV7qH$PUlM^)K-dQZJm|Ew#-`q1g0NbT`7>IY2AL!fToS+DpBE^ zNtHEK9X0nkA86#dcv;jihh3DJMC2nJNPuO@&P8$OHgMZ+6&g(3xW~EHs*993#7e%E1bHn>dG=`O1C{pk z8>v&d)-&BvtJA8pZfNa!ij&#^p(E#$g(3E6jVQs$-JxGd^7*pw#;4gM(x!)TU04ru zj^R&SSItSSu?j*%Ofol{=47`D*l_FL66{9emzeled^XB!j0%7X?8Len@mM5C7}qy6 z3b`Ki4s~^PR!?r{^ZfdCWqX^2mk)=YR?s!-TiE>a;>&rwF%OBP2M7C`b+bC;3@OF^ zZ9pvw_-Mbsk>nQ|sydWczpgxfgX!Tzfg8W-nwr{&54MZfZm^-(ds1xs`{(uanElql z>v^xPZewT1!L?Ar7D~b=PC!lf>HJ*sLqnmxMYZWzj4Z}YW&J^*ulzyD%e}|HH4fn!@3Zz@Kde9TBD|-S=OmiJVr{Snl zxhCC#?D+QfEP+Q@t$@`_vMMP0Y@r`prba3>$DJpXkG7z`zpTP=%LwIkA+TKYDuoMJ3}#Ls?L(6GG!jt>1`JFG^XX z`m^C^0ku>gk(%O7ggXxo0Rf*Knt?7>>EK{aB5oAv#_AUkU@)>%E~3G2HaY-WFFnbA zvX9xC*ss6J%*xV_=1ZIf&Vs!UF~hvRUUIR?e(309L|h2=%>cF6CrQ&xbv-%`5J3WAYMtt^4}5(ht8G(CD#5N2;9n zy@HofTD89K51>SA#Jojh*5J^{;NZyMtPsO#>b_*TlL}=>Yi|7w%<3lbiiydFuTiEr zG|&cYwibu17P9+tkP7I#vdFoX2u_1Z)gV$xiY-ved%F`dNzlT(#;2~{x{V_DrQx?b zISRdhKeyI<7gMHeOO|D%X6Bvcs2Oe_9tJ13b8u5yt3xct%0-z&Zf004Bsf+qR#q&V zA|Vh>(chN8G+0bkhlj zKtba9QM_o2?-hDaSw<5EnXtcJseX2-{tEbir3%6voMsv$-FZ<}ZgHcJVZzUx~=n)UTeN zw|I()#;#7;Ot@9q?xL?daA5wiT0Kq9BUW{F97kK5-tz(L%DCrc%f@#NANQuPFvr;| zs6JwWFk1Lc;XvqbH*D}tvP^N;>+J4^_*vhTs1IDY+4l24^DJi2i;LtiJHCJ&l5iHx z%uJ1kDX&FkgsP4?^zK4Tzzi(rVpPh^Vuf<_P;16JUyAM?Y6`2F%Nn7t`cU`^D^7*GK(2A`@Nfx9j!$1*+7WQcrDry#I(CM6)bcr!1*>V z0KlMT#s3f?=K=7U{|(`8tITq)zmcxP`9we(Ai1+~;rz;JIK?xO8N}~p(3L>TbAtJ4 zs?fI48nH-;$?&a$LNCIWf`X9?_WisYR*C97hH>igBBhls5HR64g=fIOyoKf*W%EdR zU}fcatQ&0zz$NXIHJW7XG0;%1@?g&O#34U0u%?l2_iltGK!iHIse&AOzL4p!b&2=T z2|C|^j2&~u4S^~%OpKCpeoT;ti_>G6Ymdp=W+hoByy3Eb`>iNmdb=B`X&?7DIf#io z2_@*64-Q(+7^T97ofU`nFk#`r&ELP*iJ2kjvBwk?5rEb>-sj>ngyq)U>$rA(V{M9q z&TTZm?%?t{MA8c=0ZzE`&kf}-h<Ra$+L*(#T444h6fvNpC^Z?nVRsgKlWKg(*Zn9RfZi3xkIgBcrKYsJ zl68E10kaPCUe%;O4<-wFk=4|s4>H|!oT<1YyXO#}Q_aSVs*brQs)fx*OB}H9qkwgA zHfF-~pw(LP<_W{in-@wwFh8muNi+0_mGiiSk94{1mrq0_0(%Mn)!ruuwcha_SS+Cu z^q!slwnFx@e`ln`r+Crw)4iD&5JEk+7pGhfwvs^L4Cce1>88M{-@jYJUSt&-+b#YH zTN((6jfcB=7pV@0-{dbU72LU4q`4%qy z`SbqGH2)b*H3u&a4tjpTdn6gBY`ul+cA5wh&77RQ?C)TH@4l<3*gn|CWmd7(0+!EQ zE6?8v3RT%4U*F$LJ#K>qh5@6GJpm{iJ&USw!o9`t)Z|{TsDYb&lEt4abrnh;=?W`x zwCoqD-$kZ8PCFq70;D3)2I8k0Kx=tM9+#yA34Zkg1Dh8wG9e}mwS=;ae1E>OGC}}@ zWmMDOzp=ND*A_Xz`c4hiztY>^Pb*Mje7W~L;-}E>HYt^y7?onPLIA$k7DPnwE8?MO2Hh{rr)3viv82_Zkvv-+ZKsxHjwR^&p`nT_VC@>D++MTfU zet#t<^W{}R-Oo+GNkp){emS&Jjx6=e;bR(m;zHK8$BLcozEoDmzwIU@)YTv%ST9@xPZ>sP0$+w;6#*!W6%DR=k~^)hH<_nxL~Q$6?bE zKwK#B!Vd5o)~m;RiA4$}D(*dfJ-s{^Xw-iKT9#GEwi2Lde|mswNtLq#LhbCo-Mcrs zynOSQSFGyGugzblmWMJhk^g_Ad5IH7b9tf7YOLUSdQbx6 zg?ZC6wU-F+*VmtyIw+*cV$;J$Wi(o*R3wU3iZMk(Fh1Ja-mW}7@p1M@Kt0OVhfBs?vRh2*fI@m&kpq`NdrA z!;4tncoZ9M@VuL%&!i6!*M&g+(adblxG(+28FvlA$k+xpaUvn8kzzfa@2|7eB$D9h znU|N)pH)8j$1z`DrZh2rFKM*IB1<(N(?Ulh#AZ6q7$VVwPa}|+V9lcVg&%{@xpyaP zRs7l6>9i;0a%9#-w!PA9#Cz6D0nwubA23U+NGl z8NRIdyYm4z*=fQ4ZOxLmHADMPi_Pvw^0d+rJ_)6z*f&`jX4(GZWxe?2WG!9}+pa zW0JXGd?@BTUa$VzJ0{f*_}#0fjs97-DCO-hgk@*Sz^Nf3@u|vfSyl^SnA-#b z)9hT|TS(B8g6QOa2J~m{Z_YORq-TR;VD8}He?_Yo5KX_jy7Z0@E-Iy$upuig(4(<% zcKpA1;gyjwv$b?n_sZKP`H%8xm=p8^J+a(3^@6Ej#{aI?UIp59eIM-5_ua6wB zigjF&R+g7ne)>Tqo-vdzMe@ZnSw@nl4GpFK`nq~|7#OIoT{A$XZkuOs9VR4YWB_vY zGA$_E$LF~ZnO=osb2Nr0TJ7{*Pihx7QQ&qaDPYJ~v;sCjzH0C@ZjHWpTOv&nEOBca zQ*?Wh=~4?iKj4-B8OWJJqcgji5s06k($bp$^lb{BI_Floy|Ui&srL~Y=;;aN|Le=- z{?^9kn}CBsU%Hv)S>vC(U0na8S6;6k8imZI%2}o`UZ&x<^#y@7w-e{=8HuDkr(HC( z!wDU&dA#Vte0bOmxC~@_&Q4R;@myCUQ5ZLbo^PCTE31b?`6_geKEoTNN@O4qUxXkC zBuS>Y9dF~fomK-4o)szB)7vYCmOXnVVQDC6v#S@q-dh{b&i1#|{gIy!pCwTPcx13w zy_Hb+m^iF$Z$~fnq{zewL}PwZ{4~D&K1oxShpJ+8Z28vUQ0#x%Nd5Us_&?&NAega55tJ{J%7d+9F)Ln z_j&rh;NW0F5M-U+Rsi3vzJY;>JY64ZjI$|p9K(jn%gg%$O~N<_8ye6yF8xOx z%#SS*QdsB!Vp@u7(@Q;Hi5b|oRwq>BWm5|X5yCbh5=o<1KL^LhKL+w5AVb{Tf|%TZ zmszgGwH5QS2-!d?9`xeU5+6T*6Y1o1{TF)Clhv-o6idurk8uALUn8U7U~kVz@_B7- zZ9s;CiV6gJK?jNk$R3trXNMjeyS=p~m|D3mbc!uCHObP^M&N%2@jt08S;`5vv@*M0 z$VL%})9#)gE-o%P<|jZV9%&%Qj)RZSqSCIIjkyDa zEH9Lfne~C3BL;0hF_5^fL_%=@H1LT!&hC-&6|kGcKo1ei?$u@+-# zV-u2lP-q+<%B*ycvp4+y*~cU~kLUUgKHp<(i_?>1fsV4Wvi>v${h0>8+cB6$2dA6T zhcal-7NCH>1S#^fA_pVAe!B)fUWK`lQDzyD)6Rdl8B(A$`Pk+*Y(JbJMbE)OY-$P) zF5f}f^50J4P6QrU(2}D#er0oB>ScieWW1Qyk0Uf#>rvd<*%A5J)YQZywb+x=0am|k znq`W4f9FWnBYQ%JDUorf_zU&YV6^0Nm<(?T#heyc_4Id_A16MI!SNEYxeeqil^iV_ za`K0H1|3~a9-iIpZPuZ)rcFRe4owdsbi=maLi69M51Xdi?K^j{ zE*`Vm5r%j|10t`(hHPJ!+s<+y$S6V1t*8kg`Df{P*{|QeEuv7M1Jqc58z(;Ge`v*J z9`o^@t}a^}n;@2Ifc)0iKUpfB5&0521Njj+;Gi&F#Ai|# z*yr!wy*rD2mJ9uv+utm4IrI;>)}^je>^rKuRtd`WdHMMs0PYmq-7L+IyY*5nOkr%g zvhpx93wX0R8D&HWcOt-Xh>75s`r*R|KE6`({_k*uNlB2E5)%h6N0=vNWkpBq@3?r_ zSX+arVNZ8ANO{4Z@bN*g1yC4F)Y!hY|M9bC#vwjgh|oNRm&$sOq?Q$4o3;l`AH8jFZc;C(Qc8RFIYUo}Ap5sj4a|S!BxK zy06+;eg|^d_KtDke5N1Sk%uNH?Y{WfYl>@i}fS63LvcJ)?!W zR$qWiowkiI$5tc+7TCp>;P4E!IXGzJczFxu6&Cgm3@CIRKsHG&WZ*6bXY*)Yp1M1q@}>bXyF5 zp&tX-OG%D7RP@79EbvB}gT2#J>;5mYDR&*f)JRrjw!$0d%m42`EN}Q)9$gZ0JJB#U zMmg(gRngw{#Kyx@U=H2qj79wkyU)P^sDZDa)IBb){;sZ1pB-%%JL8Q9ve`BE{EWu` z|dp{xJTXQdL1!_=H_&u+e=AVW|iV*ZM~H! z9uRhSf8v+d=H_!QXcT+obpGd0wF(Q@cH80Js_ok=JM_ZybwGQK<_~vS;xeH6Zr{1=Nj*m>8|T z^wWKohQUEzK0fHizdNw5F+D^4{ar>zhIb=XtQIm}#DSlmpFYZ{H+4MOZ&yFo5j&CtBT)2B=e}nS$Ofb9xlzJ7RitB^_O6r`*69G9;qr<)x^miicI2$$r|qE%ln6`R^26U>OX_k0`LQplg);v!6bYL%o@IY`Lemd z4x$_*b#;SdV-?zs_)tg`VFacN2sIohNrroZ%4!#^{%|tGiOPzsEUBFX@B=(V<>bf5 zzXoE)Tq}QRc{$8fPy=UidLKJcG&_3>#)^$C8!VK|ocAT5P#n!?15)^#MOSie-MIr2 ziU%Nm23~x}Uhw$#zkkl?UcR!@Qh!(l%Mr%y98 zQk`Y=<}N{|e0`yO63)L|C?T#!#$#x35St#fi#KBXlcgf-p+$2jPZyj>Z<9i$3r??+ z*48G#*+ccuag=}Y_V+J>hyjKdFQN}}F(na;xYyZ80z3jYPD>qg45T)W3kdk>m95Pv zLQ2QR4)aLPoeiVgTzjywJja6FhTCND>!ba_T;g}{9{Z592OXdwf`?%m8$eH6;;fCt z)m7a}i_L}zq;9u2J5nH0KF5M2jRN{vf`ala=W+nz4#5YL=@NGe^jP_BGXt?@Wg@(o z>DYlj*e-%ox7KV99U`@*#Nxtd-RSihEI}8_;Cu_r1YsnDjjJ!CyjkfHE33=+Ph^At ziul=LLEt^{h`j`snrz@C?+iPKnp(Sf$9zI!;^ve$T{d(A_s9rAy2m=?iy4_XGH77p z#+=|3CM)^@CTNS?rRB2*v&Aq={m1wD-30eG<{~d(*|wuUGHL;`3hv=+8%C+0>(3$b z;9OV~7$}$RF*UWT`}rp50N=s`XOxX7*;30S*W&~DSnOjG49~AHi^m%dk6DthFX6m9rG;gljb&aaKPGLJh=)^6>&xTr zBq}%|J@u3LcP_+CvV2u_^~U=8Ct_lXnJ@3h8bU180z+cR8@=&q)ZQ;)h7(cE0?08f zZ8oIZT_Czb&1cOAy@8+0KEg?AXH{q@(YqLCA9FtzqKWPLD|6v$tx^SG7J#pzKTWxG z6fcwKTU%RhZtixgZ{C=z5!Uyn$yx@oYMdPTg6m!Bb6^< zc}G1uv`c(?YG?;+R;DbqLP8PirRkfVO=fGYLLS-K=-K92a620w8Ijxs9w8Js#pvtS zXBZ6DF2u#a9yXRL$EvMen{bzi=J*CTcTHQC^ZHrL>jm30Q@{bzRiK~@!{VOY&0I~L z%Fe(5XSj6`ia$zGefhG$Y|IgMdZif?;1yhllou{|5aIqX=$ZyEOX;uo((G0%Be_k( z@LhL?>V9SQmlcNhsxo+X4h)$0X97PP60g!^$PyvdrzgqHy}Y!AN>XTX}IKp z3=O7WUA?_PDcD@bjU8M_yxOf#~GA8G)t~xn690p|$ohy^j)9P~Y%*Ex=zY2%k506+qD=RD9 zD_6io&>r<$(B*(y(3zK!v8lB+Lo5MvV0KsATPa?Fd!ynniUsVZD^0;CNz!eig5O|k zQ4rRtg<6?)S#Lxf4lK|#NScF#vp)A@1uMsB|BnlRXfpf#Rc?Gd%Zdh|=hhE+RFZe9 zS4QF=BE#5MA#cD2)515ZqrWqw2&cgaASV{XzEsKn|EPNJc&z&`e*BW8lF^+}ghbg? zM79z_A;}(J@ zYHDxn?W3cjDvl1uI@W?Ybf!WW4M}!)*J8qOlND0r{4WKusjqJh!OZfUFx;4!7`*)3 zDF0XyH)%W?z~@x_MIp|HV~zx#6KZ&B$PjyMtvyjI00m@#dtowA0PUH`4>?2OuM^$m z2Sg|s$fj<&yLx#pE-NbwLafv!EG*#^`6Riu7@tBF zrJp3)-~Ii&Y`1<{Erk@tVd@n~X=q-<$OHf6eHYyCAcORx8iJ9`Vi?IVO7<~0el9yZ zJDSJV*47Vi6JEVDx{y{@3RDw>BJ&uy+4&ISV0(uke^z}c0vII$mQ>vP5Jo`d>~HBq z#zi#5Z*un{OCM)o(CRjQ>$4BXVmPOGux6w z4zLY^$JXx)Os75*L1hB?W2=ncgs7TSV3{ly6qv_v#>d}=9xZI~2xlp5#H!Mz50R%@ zcWZc2uG7gM#us1ykid74Oi*eW#qeKJ#md@59Zv9IhL$+ghiYnScF$lkb&Ka2(LVwL z3I-XSfnZ5BeD`jAg_^;Nh?s&Joe|1~llW!|7#fIg;C_H|SBwOLv>P$d!#9i_|I#M& zOVcYb37Nm6z5Q;3RPeo;4YD_2C22kv*~LlxxDAy1j`Q_tJ2Qov^U*n>W$_Hn|BBs$dv0W_58?2qL;dOG5_` zEggRdB*-&%6BiTA%2kjcTU(o$0XD+HUgg&tperYD-cN;@q?7wIzF?V&Zh|j^4laPW z{K8vZRL&-fmWz|*<>l=|0t8p0;9%uG@mR-7UtfyDEPUtUTAvf!s&gkd+3o=*3V)9U zv(e7|!4FK@0F0bEZOSA1$OT=?!OgA66ac6(Q~hKqpat>q`v+uOw-M?El~|_R8EC)N z-D;YEGF@n|LKuB`7!W1C`EX#FPZVu5H2+JXh%s$WWQEepUGK5?;F=&6B= z9UJ@Eb?EXVFuo0aeafKNn-J3+F@)^~h4AOk5c=18Q=&sc6x6WP)WTee#C^`yR#%^= z0oE9%h&gS(k3?*zIK&?voDehXt{$wE!B__pMGKTQJxJnVluNWclV@gqXTn`zbiRLY z^djClgE0nn5v!@;rlo7d6kp*VuXO5w8=|c zXDida^=CAn^Q>aP4-#+Y$t7Kfnyy__#B!fxfGe=up=vl)k#SPsJCe7;u1Codr&q}I zS3?Fc4tTIX=X;o^*fPS9=Y9TJQAgX6nfL#zPJfN4W!3MsC;_KQe-@05+^q| z(J4pb37O4Dq|Wc5G$3WYH|QxT4d>osNx>xa88d|_hNhI8y3M^KqN(K_QtIkMi?lG- z!feJdxWord$Hk>^9xB_{LA(ha$G&g)XPLP^bU9~jXE$|mbzd>w`C7<*eO}AO_qq_x z8N!ge9Q_~&8*FTH{(A(PZaH4)Jo5nH05u-0$j>%*-2G)v0Z=UXoD|^Ps^g<%AW2p2 z5$wy^Nx=SUu)n`tN=T?0Rv`PxgZFJ@|FEI)Xj&^2@k`f>Bo|A8XJ?yJP~g2}DFx^s%p!-8D6-lKZGq@4!FWW_n77EFuj7+{qGp+f;H}~kRXaN}$K=1Rcx8X~I;yMb zT2*XHFYD;cyi9hq+2@>}Y7Bb!F8=oIlVw+ZBO^hJdH+8@guI{~hm2EFnsH)G3~&&! z$*Q;QTBe(wCa)!pUIS5BSFT}bf()9RoLohzct6>`!N2tj!4ZRifPkIKP@%3g+8cy@E)1P+8VmHFt3dU_vpm zcNuBdsg7s2mp(vBUQ>DxW-mU9lKtD?|A2>QdU3fiJ|)FaM@JE|U@0jx7_A8TKKQk9 z{K(|wg~>_(p&|N=^mN$M#(>VIrmmKjT4 z0J5(=m<;;Tz@QQWCNOK2d=~R>QdFqGwbhiaw}guWbX{CbPK-SA_oRk~tQ;IapoM0Bc(Ml)YrB>m7p_kQHOio;DP&-EiESrYRx>6qyZ0vQT1#%I zon=ctLncqRgHQJO1D3p;{GDgYYLd*)n6o-=8|Kw?+&ttHg?#Sw(ZtL`z??tQG?^z%jr zCI?;JR9a2mpkm#POGr>WA`OrvAtuf?9LV+iFQOMY$MQCqkf@#{Us$O3*bU_~G1gu& zJpArp8#`J=*38nfXLwlsEp>9Y9xbg_ghLO|xsSKUAhYGU=vvv(5dB)@rE*`@;NTez z=Sz_h3{19A6z!T|KVR1npbF#Ot<8~NVa{}86#6Y$xf`bE<`PrDpP*1OJ~(B(t&m(r z$@&Kcjg&c+&0Be0GAWNrH)*vVyG2^|3`ccUjKix)wEc7V zSIg1bZwG_ulCp z9m@Un>vmc5Gplbg$slE}u@D3A+4~vVQkz=~Ntr&ZtgHiNCs6;6eiY^F0Ik(5!sU{( zb8|WG>dLCA`JpuvyY)oLu!LE+MjuL;n0%c@-qqDo$0OUt{+y=vc8&VEq@=mMJy%M; zTw+tq^Q!m65fT}lpZ_Jx@T+KaW@2Jubd>1w<)|#o18Yle4vm2(F6@P862C;=C!YXUw}u(V=Bux$`{=PzudWhbbX75YZDa(az3#vPMn^v~ zzl^G1DgUT-<+goTsH*J51&Cu-cbs^H%4B(VsVgZb5!nuu z?`1s4FTyeHPyGBtR7&b_bSTu(?6&CX18DN%KkUpw& z9$qLEAjTAO6Hst90bGgBNE z5(nF??^?oUXWz50{QdMP8s?LpJ-7dd5BeXvbVWYIrl81?OKNImXJN9v!HbJ}`vL}y zlUc3nYAl3@heL7Cwg2utIo-ro*n@j-s#SGbkJ)%J3cX7oGiFisqwSwY!uh%#uY1F6 z(a47`FqDbYWc)D<>K*FBq=|x`UGa^2o>qzQKA$;@vj>#{H@LQ;a!n&zRrY0SYD?j6 zUUN&h32fGlNT0_Ma%5M)VR>syM4>jmA8f(F+&xJYn==lw9ydo}=*^eY5F9`vc2(UrfI%VM~_XYiA%!(9+V9@B<9; z<&fRbAao@k>P=Bi2*t!7ZEi8*tzV^4ddmef`?u)A;Ej_}eqvHCbKLP~)NBys;@CLe z+mOIMx9RTyKJ}b&)6a4kR|gH?yeM`YVI&q9JZmN!8yp$4gZ>=oEg(LL=`M8KvykSa zQn1eaJV7)6!%M%|TtoEb)8uOXO+~9Pcx4GcWV2lCL>@hYL43eiS+rq7L|)K%9l|e% z;8Phcp@@jvcDG(madlei1INQhVq$@dTF?PDR-OrFHQhRRi$cx2u&MW_svo2zCvPO6 z*`hc63?2RNUpOihLiX(%Zbzx@LZO@2%+Bgd*o2`5qi9UF2{@J8_E z%&)Y{LG&z?D`oAICNQl)3_u5l|9@3)YNi8OLm^8QLssQQ-e+rTIanHwQ&u?EmE@_R zv7G5Mlto|BnH8gANP}6|1zg;sm&v76{C{<-z6c-|B_M#d@I2}lE7$gC6~p#S?amNn zkl;r@zmB_FpH7!`%)-cM)0--C2KyYr;(fE}#~=S)GSb6KpCLyFG_slW@SB$xpr-{e z@wm8{pE4HnHVEKUwibG|`m@)fMVu4+TH@bkiTIUc#B#y;ueU(8;9V}R`H>OT;S6y5GPL3ZyL&UOwhfhxZOr0?0Yo8BHC;I*y{eX1)kp?yZC zWwqq7(4DMb^@U0O5=e(t5X;%W!bIX>ad`Oes6F9Rr-EIU6&xxH)p8=D&Zv z;sPuq)BI+B{*Mb6bRJ`-OQH(PKcPQbXOBV`#h1^aeb@yW8k)YoJ{WX$YOhh|+VD?$ zlBHc%$Ev4gs85TH-5jmZiWXVTYiOYIzP90mc2ohAi^(n>tje7u*1d61kr5CwE0-R6 zey7D<9J~eu#X)fJ4mj2FD~tUWvlT9WAwzacDw4wG$#?J4PkLianF?BPh@ZdTllQ37 zl^OA^|JOc^w|_z_B$ogk-h4a1s0f@XFL;LKQ#>bf zbihw^TSL1a7!Iogs$m*^ge*YK!rbPsJw1V7EJ!HN)W7?iehgq@nH9UL`T1iN?YLYU zGo3!N!|lbdE1e0U5aq2XLB3w^OH<0MV6UyGcTczDHxf3&6)OWQ=y{x6U!Ji~$k1?h z(!0retiv2+_x9H+a7P?A+aGW`S_;?sORg_a# zZpuJ^&WPoFmtMsu&4g#6s!B>MaLX{F?c)1g{Zr^ni#p*7Ro zOyO|~54lu+LXUlb!9`qLjv+WgAQBj>azg+NQqqPHOjiot*V@{QyjZ?3;O&9sf*6O0 z^2||R-b#8>lEliex+oaLSEEp(0c7WW$HR2E&aYp0Ub&Ly0cUs8k)<=EsEJRij=XLD zzNLX+u(wcn{vXL5!~Vg(te}4pr1@tYp{lXT$xVOb)gN?>4<6(f7uy5Vwr+tj3QZlI zD@O~Op^p_&yqB-e+JWRl&_n|d#>`}z>4Yt6?LhJC#6(5o6D(94HZ5%o8h#Ki%D}aQUyD29}e^4#K=#BlX3F0d@KEq!(m1PB-9>QB_sQ zoaedT z<=|wmRde#_qr{u>ZaA=3!3EZdr*Mm`1#HbP5~6!khd4H-Q+{$88ohp<0VdQ}!(pov zpJKafaoF8meQJsXs@w`O*b zuAe_c>2PgbU1Jx<$eK2^vIDsE>cgtAogGCxD+Wb{K|P?CeT4Ws(!(I|}$0vQ}IyTH5?Hd?4JlvRp`}4qjR$l3^xkkh#;oqB^b_p_?zxqn9T~j7w zgUag*zI;d|o){OxZPiz3k&$PmgV|Qp4Gu8zZs33DBw&Ot5Tte?JTT=MO(n3uX@-1Tn9O!( z88j}eg=g9Vq{CILX4_0L5%?~HS>(ZpPuHQJ`;89?$W4DnmcVfv+ZVmeKye|ks=UJ zk#otzD1v85cDof)QqtTJhn5Z@wwJLU}Kp$Zy6 zvq@N*f`T5s^x@m7h7^?)1#@EO{qe&+=0AV#?+qD2@?PWF`&+F*6c>|uj*tu3)-MkU zedR?WS3f!)K5o*}2oZS%4^4n1ynEMXA4f>Sud=dIQc@BWCT!xEv$mrluD-Pjn+n24Mudg4b1vNKV!T2ivcJ>poXbBp-?9ZCQRuOa7|0OHDn)m0lR zswLo2H)<&~VYof`BUyG9<;>-yowDQ#ujkJ*Anye4V?l(xJAUbA4PjPKm=6bezQX}& zG{&q8TY*nvkd~H)-td_$y9N3A);2aN>O~6Pm~7Pd;l?yuTA5%&P0d4i3WQK@_2*9> zwZJ#hH#K!=Ke{AwAL)B7gJma)U~gL^)Zd0(K%pZ1yu9|^s0E=b)^jNSx`Y?%INv1- zx9yS|9Lb*_U%^G(&(D)V8?l!@=xS_K$3>F1a?QqORuG5$clC~Sdh17QW{79ca=|xH z&fbvh$%ci8H#RoHkaz81QgZT;z(C8xT@&Sa#Nd^`fM84iaQAgIGfH4>d)YuMX8M+6 zP6Y(TRaG;6{VIPRnC&d@YLpZv%E#Ypfjmt{CQ7#WaD7AQZ_9do@pXmzt;#3 z8Dd?L+F*FoV#~`ZuwWbOY|TPWduV(Rox0B;uCbZkTG5H=@RvR`LIghNYjhLCnhV}o100siNOg>CT_;!hB z9{GvLFFk1^lvj6EAk3X55>ET{X`hssxTg9#8KqnrnD}}@vy)@3+FCIP5He-J*P4R* z`vkn!i}-ImR?DVJe>cIbVZ7*%@89pgZ$o%QxWn)%N;(U3^kro=pC>>O!tz$Hkc`ws z3`W6l=?X-#qDT}Q+pPz>zPHyN82r7Xr8NON(0C8?YV}4T0P9Z9%hR2RmkahV!rE+T zZjLil&8x2mcwwtQkoCa9Uc=XF`XhE-aq-}u6&R+RFlZAe@=w}`x{6BAuYhENXxIVgx?p}DmIv06iAX#E)OmjX0}tes zA=W``3k1_p?8ZcVv4Hdtq>o=NUCRVk1^_bUbI8jPwup<31y)%);yNI0L^l``S3p}0 zTmIOsOA~yNUcWr;L^*V|U+8_Yzq8|KavP3?(rTw?Y;2>rWC&&ka@wrxC@b?sd!nwo zgOuaeZ4G#|jEq+H_WY2am}4GomqsgpCnp`9@M(TBdl8(1SWJ7OJQJ*nP68~CxufGT zXwfIh5!4XXz23y}jLT5vZ?x!(b{c0C7FJ1sq$rZ!`tCE+)3*)`sMmf3W9%=fUFOKL zi-nTaQBqcBQ`sCFFfOw`wwHr*)v9YjEXfQBi2%4*f3)Tf`QX7)-ipKep9NlbRasn)%bgh<5=rBDO17|t& zHVqCM{PB~CuuFAnHpm?CCMbEcv-9%4W8Oj8^O$pKYI`{W0X3?| z4qL5G$AA^zhK*G>ova6l(gfxTbr-_;6nftM4-hBD`Dw0U!%Ga$@n9fe)f&87O)?%r<)rKY{-4RAsfoo47L~tm++hWUlLNTqjhbbk$t@K z^qSfTpjV7KsxwrqAQ){z3vKMppt~_>vaB5>i6*mcj^K#kOV|xL@|KnspW_=VpI{Vj zw=)(tK!Nfa8f+7gx54G**VmV7zu;_bWW;9JpAYUHo`$BH+I9GpZE;en1wiPA`O+~0 z2&je)Gc%L`$>ezVR4H@v2Pn1ICPp+f-biU{$IUXJEQD?MOFm-Tb&uA9qx;*hG8c(? z9%0Oi>wzp1t>9Vz-gz&J<}wVyyM+91lscq)ZC9^dyRX;vBu?&6(I~xy9E`NKgcjcB z*~MDO4HRpOvc2=Rg)5Z;`qorlUtgmgXGDmY$@D=Ur)~ll#)6MGFDVMYn z=l^+Qb20yQ)fwZJ7I?arm7je&J6Dj{Zh%#l3tGUfbr;@(z!Wlz77zFZ&UFQ*x3~pL zzPUX^mgFp*F{e#1atE?!1fcnMr(AG^uw&cbLtLP(35lO>SK@P!5|!Bp%k&|p zq%A5jF+VKq5Wo_!BsuPYgcVuk84hfF5+t!hM9&ZZ+Tr0NIKw(L8++O-L|%oxJ!p2+ zlM*^J4{ds9q=s#Dq>YR|!Yj>rZoS(AMFe_7rptp<6x~fyIkzc@&pD(8zxDL+8-wApqCgMA-s|e1#tsRnts#$iwB?L7gWv&=(MyV zWK;~Qi?qn94!nwut>y0?b$DRZ_ID(7Fd_Q{9U#Pw%vY|qK^P5mlr326zsLemwg7P< zJL+@n8yI-|U=_Gjm@5Q@83;`VUy@Rdpp|6+awZNe-kCGD;-WQyL5l81ckP)K9q(Jr zD;30tKlrXBzggbfD}vbd$Uqp}Zu7YMa0b0Il5b-Cem1)?=m)ZwB*0Vc^<|B4-MjZ6 zC32zUyA#lkW!j#jW!+r*@t03ozta`XeL{zatB;gAa2x!Uh0x~U1G1W}LBOhi+-{bX zkRYQx(0C;c2+4ptQ8f;;^Nfp%1ExY`anYB50Hh11O4X>@@=;Q z%TFDeF<3WYfFJzmpr~o#O$A^=KovDLH9;hWK#g!b#t=$Erc~3LXV)1o9j)rDf`oG~ znS1N&mD*{bY;(xK1{Y)<#gGgX!(3W7)*jZrDW5fw{2YOWGK_V9%BUVymMvsOj4*>h@BFh6&IIM7bdK%tG z;m?(^vG!t{4VY8@zx9EjQ9A7EVJ$@r@;+2vMH)Y0{TpC0R1FMMN>7esc1E1GYQ3@{eO1kU3?b8v+Ul>=tq~>JDtV8^sZFe)j>^I; zTomJJCuZLZ8TMP}^gos_2Nvd*gx*N0>%X@_0dM1nSPaN@JK8BAs=J7X$7eGBd3hRK z9x4%C>y2+}W(JUImmU_D0~2!&e~N+?gnTgVrxU_FjEj(E3J|cf{Ek_kr`R`ZE`ECu zyh=kJZMV_PjzpzoSZ&DweS&~I4>;29LTK834HW#n%1G!YI{@dzWn?h$I~Yg-_yg4J zb%-=2V%qubcV(^ctVO8gyEhnq>mQC;}CxeD-`hcjr!%-t(&S0lT+ zyZZ);ved9A#-(kov-8s5Ga&v{R=gnp!EcrOI+dR1da#L#{sPItc-@n>#TR= zLPD+c!|#oaV?uAjuOGc29Z{TbzZVasJsu4{7F-VB08{dByI>AFe8F|MBvx<2+`P2OX;SDG*8?q`k*9$VAP(GOZll@x48bimC|l(+Qfo{6p2E@z zNfyk5nwyxQ!B~`DxXjNYuIIj~G2r0n?n=rkJ2XxDODK7!Ep&N^&!9hBHYGQ4d<%e$ zwY3C`>!%hvLSSv7M>HfPC@iin$?KHweqcbzQy1KxjV71d&XU@*j`q2T113nJYnS8A^yB zZn-voAJS>Pa7Y`Tp#`}S+#Wf#`Lx~L7lMLRK)}fhtEfzSQ{Jtqx%Ds6N5gY?O71n? zPHmnyIx{;9u-~9CS z-L535($XRAV8~xD`S|$M0Zv_Lp`Qo$3d~-7Y%Dz5$SV+Z_hluJmpup8#BRC3F-F|; zkmWwC5O4^YWQEi-*ez%oz5cF0mC;e<7}WXn3W5YyE=fMQn^%2xV{_9S$bWbDwjsnW zp)RQ+PW^18G;l2eS!NR$YxiXu@URq>0xp9@Kka_-rx4#d*z>=|tj;ebrP~MElMUOY zf#_GKE77X=_t(kpv(6v?G_yW=THIe&rr2$Km*Yjr@qQv?CG(j`Je0Tu+}aT+@QzmXMmX?bURosddXgfwC(u<(MslXhFC(Ou*sDb z^_qo^b!*c9;NL$B<>;yCk^CR@>>katfXFQV{U@l2a=a!Hjy zN!lVQ6UxOLc)Y)VuK@B+3Qtu6o+_9lyPezaurm0cDz}41=pYt7-WK%&;0Uq!?>4e)N~4cEa`YLaqBNzCK%v1jhetP z1qL=Y-Ol&|L}LOwC=Sm;2|{$p7r_@m_E5+t8YhPjWe@FYN_ zmw0&M^K?L76Z#N*|DFNlR&PtV6cdx}C|D3g1JHF%GS0Lsu>!I?@@&O8vp!B zii{La?gnA${AMIXBS0}jaro@!>50;_7_?0{dxEk8d9zFqphIk}q7pw#gq`tWEDg*B z_(}1u)3+)J0ed=NbJRyPtgO!xaQ`8Q%2gYt z$fuAG1rnJTE3pd3vfR6?n{J_>Jxe4a3o;dcd$0)Jr+&hwAXz@%6dyKk%k5Frc>*fP zAU*-A4ZHD0aSzKv(R}ke(6|am&Gf+a^=Ios=kgM7L{0?ZZf52>q=N9%82AZ=Izk=+ z4-b#PK4p3;8RAdz@t;Xa@i`vmr(z0}UtNU{I^yKysH+=1OB89O|5tWuWu*kT8o;%O z&Q*iBJ}mY%+(2b7EmcI8P`!+`G^qD5qf4p`U7Gv2)GMj z#4}{K>OeXqfxxkJZyJI*XPVjJ5-s>g03(eSxr6}6rd}SNe0{kop*cBmn6$#7C-M7| z-z{`g$o*TiwE9gy5ij@^IpHTHCmPU%A{QERg>qXQdm?vk^lq-#VMR5C}s&aisLd#zvTslUQp+I0STGgrj6HQ7xK{mS>EQ z|JTlHp#)a?+X)USDJfdOt`ANXgS_}?3>BM9oRMkumJ0e(wp#fO0wsVpS08})^ch}M z7uD|-yKj(q@zQ3eHuCOP&o1@nSno}ZfrWX)p<(^Hwj<7-2(kRaM?hK9n3_Eb&!=_4Fk$mW^vH*W;rDSKRz$_@)`iMF0 z+wOFz)k~%qlo-K+PiL}X5F~NcT;RBOk9H_XNvGd%APW#~g%f@Ya1@}zfJg}ls1w$? zy1Ih17ZnqmA3I&-b4$x%7@P&11#IRym~0*e!~y1f=hJ`CUtwh-=jG!L)b0m?;o_1Z z40HIQ4R~xh8dM0-BIPv@0?_MhVzzx{ok=Lt(!*QujgHPx(u)Nq4Hy`=GBuTovC5GI z`6jd=t?{N*{r7}R07>-KLNOl@ z8gTidE?nB=v)j&8V~+`hUczdS$!gx4~(ejH{JHG^3 zkgyze2^#|Brw}0TyEr0HEMjD&r3E2wcf>S;lXU~$%wV{fozvV`jJB086O!@rk0qdY zvHq&*<#4o>&0hMGsWB0d3^G#EtWgLGH_Jyx?BD?dJ#w<&8xMI!*@>eFJm8b7oQX2; zXCr^9U88og9WDRbn;JJOi1C9?q#3elj)Dfkb`@aR~3sl~!{v`8$77eSMS zd|@HC&4=_5%C0waM-$|kTwGix#>em7ySHhE1pLmtKp+J2n_Ox84vZvNI~jB-9dGQi z#FGbRD;l|Ko#PWSb~Xjv?_aSX>4Y==`qomZZf7M>v5;Q|fC)k99^<;&h{W+4xWqBy zxbyi)OluGX0#w(whpkD%VOCGq(RbQFK`FUg^RGi>VV>8Y-Mj7F$^-QCr(+S=OU zYNQaZoZ8{!Xdby`l2Ys0fJWyAda0G zDe*TukRLnJ*RIJFh{F?3u{gGe^8_tFC>mfjaG;&l_+da?DxrPVe^rC@GpAF-sWo4Z> zK2igvO6F6$O>cr@b+{If=RnH=6M2C$-5W6GgPu3XU~phYqMSLg>`HY_xO_4z#Lw&y zyvp$bcz7raV_{})Y-s2hh|;R_W@TdP zFLfvy#&i&q)ei_#WKk!FS@33D8Yp$VOPda>k>)_f!?8eUl&OQ>+Fmye!k8rJ1*d0h zOp7>2XYxDT+y{UJ2C{{})X-R4Z=_~bTGdC$FNR1*n+dOWc>Hm|;9p6D<_FMMOK9QN zMU-=Ya_o(b{dVdrjt)j6(Wx_5rJ)hT0Zuz|5*6X%0}k={ORR>fe;-(K<>~1eLu&+oo92pH1TJ4cw$QdNzN@bTM6 zU=)xjB4_U1YY#xym8H`vi6{!8$UY4%0y@V+%O&`)-`AJuC=9vLkv-6bCgj20eBBpR z*%xNjK+f45$_F?Ul#P5fO5y-&aeu3~^X;{*)z^EVrvd!H4`Y_WO};NPnfOHQbV;*_ zi-~u?{*vv{&)Dm;(fsMKjeh>#`A za&~t2six|)pmR+6FF5qIt~8#MWMuC;_PK=lMceHd-HO#5P*kx$8TNA7F}lvF*CyL( zlqlu)ovTHC>mUVXF`R3Ns{(ps$cz33;JsiOJ^%rYgM$NVSEy((n`yD-mGs*g%}6oOOfSQ1)t{7s`LcBX4tXAG}8yTnuFsG?Y{i(0F-5Clpr^bOsuVynH zxl*{LEX<|s5`G=^)x&XaRUD24%?{7xdt{1xv!lXwMfjwONWDUA^A!t-}N zq?PXfA=5lmf})>XgIt}~R{E1YNdWm4l z`@cuEDTAJ6nq>ig$5ujV5bid$v>bFQ7JQFU_e|f$4zwjueLXSDCLt%?|5c>ytQuc& ze&%@8aG6k~H2H&c#g*Zl@$Mkd&m2IO4@&jZgC}wZbbSU|5J*7on-W2G2%IGJCxSY7 zF|jX#n9fA9c67HjK$N$=zf}YQ$d-Fb%1a=eAbJN>7~hQ`916o#f&F0VeDg*cYO}m# zptrAce{FsJdk_OG^g1CZ`&ymnZJCIG2uB%n;#WU`2>||YZds!{!SQdOz}_uUz%MSP zi*n;dV(Pl^#Po|{7u6S+xpMk zr4Ove8mQ^B=MRh3JCB`qat>sF?YKKx5URb^?S(FYi;{n-@CE|1|DBkDvgCdQG zx1W%rN7Ecnw(Qci@z5~)gN`_TuzfILpfyKt3fkmsZN{8}gD<40Oo8ZGEdx3!ko{yl z#^*Nut)WWaiMeg^Bng1W&dnll@fCAySln6E0JQdea+RZ%uI65_iYgH zYd9TQ1W3lsU@&I)I9Y~TA8I2bqjzsQgpp6Zxw5hangVcgIr_bi%%u!>*6Py!Z0(2a z?sodoZOzww0yS`A_ZR$ym5GV9X6}=H04@Nhk@(0BS#e5!Ykr=+?aev%uLOHO$44cP>5;qOe5bggb(M#YPd}$0Lf(!J zIRR<`%f-LYFr&Wyi2xe08?dpnka#{)Jn*b>EabA}t8ymq;k(IBu zy#3)EkfTaUoc@UEcU}fQusN8+u;SB>nb}6&x4k-$DuE`~!~4v95G5Z$puc}9M8C*= zY;*f$7c`-WLo!82!JWQJp1Zk{dq5{)`re?oFhD<#%@B>Z>9xDHpzSGWz1gam+P7BM z7}&kZ38VpUEcE{mk)h;R=4o&5Yw57~nre42Sy#pMu zVb9Z;13-e#HkO!eug-thu2E*fbBm~8HVETYJQ`N471)_2lu$J8UbS}3)GG7o-`aDd zlL+qJru4Lq`eKH{2F)Odd=;aakF`LjM(wD?j7j%Vp8<40j%{Xo8soj=Pdb5J@%!-u zM1-j)F$my!{(E2`k9I>)W8hjWq3~6JkGv=b#6)X62$H(NLTxSOmDS&4q8ZDklPIyx zKoWxa|9-y5F8-eu0MKZ=m6A-o?q0AAFm3CHjF38%_T1pTm{_HdHe3qw$(N}Rp#fVO zbpSE-S>|G=qw3lqW-8L;CDk1QWy9B<#VUEwdE&m&TV@HroPep$xA~SAm#Fe(bqzwy z4kil{=VUl8-nn|~R?eDhV38HI@h0lBh}{=$V$HS%2Tr#oI+i?D zQ>j%|j#kdy;bc}YxNyln1;%)p*E{(KDT1G|urj7SE#dj!SxWiAtR?oh6*5Wk(6Fqw zrUnA(*%Nd4z^Hw)|L(o7{dNHqEr1|tK>1Nwaq*j#VWtwnXevp`LgnYr`%3KU5~$<4 z^?(T3UdCjg!jxQ~L9VZ-hEf;AG?DXdmmnz;+nM>F@z26Z*$yM&HP>kd2HOZh`5!2P zx4Lmq&R6>zJg!h^GO{+wlZV<8992BlRv)?`?xT5?$Fep?XlLE@WWvduVXSHO`O5Ly z!aK?RE4aJ@6C=?Fk0t#4-kjL5^Q0CEIMYC=vk%QFfUe=XfB*8(IyK0FGalgdiX31((IHao9ds&5V&W)`xvsm<^^sf;mS=ns;l`#ig z@1ZB9N3-Z+4(-iMQR>6F%rz~SRL#HJb!j~*YRT4*dp~NzbAHLsB3NSR5u5Vcmg3bD zKtxMzx42D@J|m4SP&ddRpg;rT30-6!MM3+Fw8TWB4kA)g1$lYmYu6YjF?ZP3_xty) z9#u_N5R! z38tB76$Nw5Ku^#G&;-C~s<7U>$8~2l=U4IOddZH4&B>AC)_YHog?@qg%C&!l z!+nDkZ}5&8dr=+?cf^hTgDB}p59e{b#9n}y1|Ii7p6l6c!1Z4wNH6rPNoc}0l)qwC z$u4||J&~d1^4JZvD+C}%nufa7;sc~;Gp~!y#DpH~4YY{7=J>=fRP_Uta)ADzp&jyQ zS786pD#$@;CJ%4v{@@b=Eu+%hRFjQO+@a&Dzg zjvK>Q_BQADkBWCn(L2L-E8p-a??&og5mzVX%GT@nee?w0BtdgB3ww9XW#N?jTD8Si zBS&K9HJWfm^X+;1IyxSmCdBTDZ;Whz4-#w09;BqMbQ7Iw+14i|o+AzgW!^BTcHiVp zx=QoPFh-sOa`wf}1c)e-)V;6s=;-TDK>)lN^F~YNiCFvl~eOn;~!7bBLyX;-)V@$v{v%7y7fAWP9j9X zrF%Q&@yub0f(BGG{R|>~H~irE$1JI^ljGstLul_yLj&7==<4rpF5$;(`Mcy~7+EX| zBxPwDpbvz(?NI#^AMc?zJ5p8#G#+vm?L zs<|w*v{mix&*d>de;<%oAg%;zZj}sRKcEHxm*Uf^JqzQ<+j(+o_*TCC(3XZk7VFh5hKHf|6x|Lhye_X%X*xfQW~biNp=Oe36ad_``>`a)ZU*Sek!^ z&UcA{(1Rp=^#S6-5aIzv^o@JB8;{&e%r6$$>I-V8r7lX)>KHmPyuyHH|4PNaYXuji=`BSiEM_J5T_KD0mPkunjj(?%IFc~_!1#ch}j2nLo2#5cL(bg>RSpaWjVP&mh z+XZG1|LUDro$=4WWS_y{-}SSN>_JexVX-p&9IRhiPn3w1&P?t1?@nt^7xoze94Ro9 z$o%HvBV=e`Fge#Jf$%>li%(u&wmrWY0iO-}KX-0!ZU+dUN)Qzt*9jflj8z8EYxETt zc)GZRYed7w(z2TTpp$skPspto`K#|NZA`-c)lfO*k^xHeoKAG+_iU0Kzln%xwMZ_{ zZ{PM-t8idCq|o*<-|wWNqlw*T|J_&=z`p1XOuC0Vo{2mT*+nMzB)eP`uYR}$!u)ihF|mYtN@b{7Df%6Y6X3XDJh%hI>n)9 zNjd?R^UC}{UZV>xyW9&7CATN8FO!c;t)JgZSp58%AK_M`Z_3;hM{bNS4aD^Pw&qK} zm4$>H5BrB4=DjHead7f;Y3pMk=bW3<de#XTst-(%z8C^{Ddf9Wa_=}dxsvDD)) z76UKG8?Vr&xo1)@4Hu^K7dfoNi0~D82&P7fir9 zg}@ctea@%$8IO8s;NOC;Z?DT`*gh1fIXE~($to!+{q*;*POk=-x2IKDJYUDaXg}0U~mqZo_s50n_cI#qnz=k*PoGD@7H+%5OH}+1072*E^f$y<9F+X?535=|7f`ZnVq&%_D))Juj?XO+ zZD;4)2Y!d{-YD7CU0-)zD@)(UNcoBLZ|EEb-I2$mM3V1wc1^da3%zTKo}HEX9fQ)7 zPSXenleOkT86iaIbimcnoT85}1}nMaySx0$dJhg!nU|zFQd;$o5x;n5E zxfppJN|uC>x-^W-a0;4UDZ8PB3pVGcAY>t=V8Q+UgvxI%lyviA{fi7F!3?KLU z@?zEnUym`yBz+3*ThXyQ+{$^VCt^xUljR>fHA_68_uT6ti0F_n5*I8Xo7ZpN`1$%q z#>Q6Lm;2OBKqt+SVjB(`nvaGUF*HhE+R}14S~N72Gh?~uS*@cA;f*}N%ApCBlIz8%OIo}S+y;j-B|H{Czb|0ScpLFO)#F;oV*BJ`I zU~OTXT6B!i-X6~M3>myv%*S{|2>0jF4I*MvQV=TLqh6)GNk~XY;AS>nec|6*k-Y|O zDU6^!COf(oa-jyPmjNSjQlZeJGsxdR-RSl7@=!vI*b$%wDqAA1UrM2puN>J^l<+k@ zJ*KR8UeI0+#M#iyI`DPXbg9k8M+;)%oP4Jfo40Snelekuk1qV|{gAD%OI0Ko4e6&( z_x6W>PjWwwjVzx^zLuVt{GaxHhnr0GN3|Pgd`W`X-2lE!3u43Z6bk1u%)i7sVg-)z zmQ*ei1H=FGx!_%Vc88IQvGCX--i3zw(BcEiHs1a_#DKf+nuIwxXyGEtVx^`^1N9H% z({v~+o2uN{M~e3%Q&OJ8NBYb^wh^G3qjwYYz5zyodNDf3leNjI58DuYoA{!Xcis!z!cb6%))H@J5+ zMCaX~Kp`?b7Wevr0X};Ax{(pgM#2xt3mX|7cP704&5Vk?2j?Ci6LXD-sG9e4u(*!~ z?*q;s^~wY^G&0vIL(K}*B+QX}&?P-om?K~@pVl5Tl%`fNG0mlWa-3CDvtAU!*(Lbn zHhy1`RUe@Od4a{k!^e-aOG_=AE#dFUli}dFR#x7Ok~QC&568leZ;2@3y0?zL;(Iak zhx?P~%0HfL_l(LZaNLMK{CyU#(^P<;AL;c&>z!q%;dv`dqY}ODZ~DF4&^h#rg^ISd z%@#Sg(VYd1{s)Chaz;L>Mukt~6!aZ`r=yeALIeFCR8_e)c-7@+{Zdzl-~KE#{2i~F|o1Tj)oR15O!s- z-IS4O#la)xx81BC9*(fU5Cy2iA}}6d0(Q{)>~cuRJebS_IolQYf3b(lyt_ZWjVi=FvvxS~qvl;K>wYS91{?NL!tFu$? z`Pj)Tbd4uHG}iA?gZ`LuU^Z^uf~Hdp$HsGB)J{+WC3>@GPPWMXaWuQmAu%zrq~vEv zN{Xz|{beVMbXFa=<>Wiw_A5!)zjRph65m-ddHHQ=Db!sEAK&5Df0u(Ab=$|$9KWdq zY(*b~V)I#u(iIRE7%3^yT?SLGq}odp-HPsnVUX_iZL)dNlvi%Te}{` zMnqbrQ3RBbP5}u)5NT-;0YOq?=u$ySM3j&&X#{C$l$7r7?vA1FJA>!0d%xxS&-stU z?EUR{;|T@`LwvlOnm&H?-}V7{BW7CKDDQ=Cb`WU16R(m*1C?v%?H5q_gG=L z?DjU|f`bSnI8B7b=I7P$@Y==nO*1TBy}EN;_e4bG3SL+QDe295Jb6vciDX#@ofV*y zfBuFF^UnCO2vN=T_6TlDE2|Cfl-HeTQ3bKB!@WT$PiN_s57B&rQ^C}1kw6}{8$>NW zl8TBy9${hAG@zSD%;9kGa4dGSpUm8co-RIV1Zw*J=DMDhsnzqvC?8NQW&q8zOHUsR@Ub9;@-AkVpcLL zf1hm?jue2+buhsjWzl(jJ@D;Y*!@Wp?=>r2x#{R+RaBg&B)Mt$9J}1AJ{*a0Sd6$e zHT(M*bta8&Z6m*YS$XLEEC2Cv(CKj`jPu()hK!Y!6|_~Toc2mU1r1J2tOP5EYZngz%!`AAq_s-<{F$z&2U$&LhW-{| zUeJ(0p)!Q5XZClN>n`9%v%Yx|0Q>>7gX^b2_BO_tC6X|d< zg(Z=)s)X`~c;5n4t*;PQbz+)!Nr8lh##is!03BHCd(P8iV^v~cfX-$<^pXa!F+#4+ zSa{-M&V&~8ZE;`$v*|N;d^B5eQXb|F5fZE2iV@AmF78lvRj7B;Gjc9dRUH~AQXc|x z%o{vjZcZrohA{T;jEi2y13`9nE-tEg_^Ug#E;DaI!hi9e>tj6u#x-7hj9bfM zUp5gQi0-p9E@9zCJuK;OYWn6q)1(F>){n(PnV0bcvVHWt>3L8OVzM-E-M)S!ioej) zThR3*fyL|Yw7)G;el?4v;^C8IsImKb13SLJs6B)&t7&IhP>kbs$LGM?2L$bb zw_SmTLK{Ebn7lLB{?_|=f3dC1snvU~@@?=$Tti3i!qi{?iTfX#B6ba5zPy5`RZ$K$ zF7Lf-KWRM`Q&+#$o3%<5Fz&Mn_Y#PIyL*q6`{P@H;A?-`0q%P2B%JZr<$E(frK_~w ziHGe5`DYA_W6z*1Hd+jH*s^0|CB!(~j@^caO9%q9R>dh}5H#W37I|J0xHJRh!xGMB zzcyzJ!^3X@#Mg(?+xy+SYpH1)K1M4;+Y>50cc#2^auggLL+oQ*kBS*Jd9($>_I5|< z;O5=m+M9iN2n;DEEx!JShN0S8g;H^WJ8Jxq0uHpiyvRfQ!ylMsju5`F_Lb%A+cALD zkzJ$X;tD}xBdH9>+z>Z`CuE zSY#Ju-XEdS#*r29rX5jmjLX(8c7& ztD!f1tD=eu0p;^2PvlE$S~3Ie{p^?dX%n#iH}=v?S6cVGY8*-!KJm-q_<#uQNvqhmcSzH!EclL&m-`e zt2Hj*+FIJ$qO4-pCm)uTI^qRJM;D+t2`NLot2@coYitG=j_j zU(Dd#3prGC(?@BRYgZ6CjWso|8$%LEn1{$%|M(-NoA(ZRAKtyI+xL@CS*UBWE^BiW zdmume>uF{vprE1>#c2}cB@qB>G7u*=_Hw^i8ES`XRu|F}?XWOjV&b#wyj!Cnz1>}L zA_#f}gJ4c{CbkE-mCm~>diM5RC3f<pC?OC2u(GxG)|f746~zV@!eoo zvr~TjsKsy{$EmJBfOflMS?2_+d*t}UOkPEWDOX%pRzsj)xuLqcvbuV#k%^f2U56zn z>-vBVFtYQ02T-bOXe2Zdv$H33JmF=1TPaC}a?^lIPrB};8eZbPP2uM7V3#>Je|hEU z(Ej*DWvodH(Db&7ZCoJd?7gl>)( z4nf=)jAblmn!>;ZWPQ)MhZl2xtl=;)z^hw^43Dv_iyqYIZ{L3CAinJ!-BCiz;UG%d~f zYpad(f{2te0u;N4duEB!ivP0e3x`wQK0cT6UK<-jqWA&Xcw+D9xWBizcW_WrGU+IQ z8GDD(fh}d6+^;v|_K;Ih-7ItDg?0s#fPjMYvA+QL6gY0qxcZPSv_vJF4RXy|S>m~% zzwh!KXk5X00f@Vi{Ka2hbxN|bz3mAPVGW`q3W|WbDBev&I1u26%4q??Z*|1QcDCi~ zV4rBrjmKcPemo^dg1U6+&+-g00l@eLlphh z#<&y#i_=ivAF!NlnXLP?cd$2ni@PP)?IcrSLyys&4TK4mH8qDS+zKg|I?J3&ZZU#? zf`XC~8U6;UA^3A_Y}?`CSt25Xi(apwBfkWAtn%_}i+t|J$+3`%TLHxlt{$Vop3J7Q zH1#C0pqMC4g>Q|@U$Xr;31?jH(mFWM2o}&bL9S|*ZS{r-&{yo+rh-tw?4@$@R2933lxeC8jQr?45A-!g7U>cwpcbC&hV0_u@#IA()~S*)E$udlsFU37Q1YK*4MU%@9lVvGqpL{KaVie|)#J;wONRfx~A)uwj z2uVpBi>KX+ZRX=ae|K`S>a>H5IF6AHWg{RE%FRR|fL*){B*wk5-`G9WoZ~S0>yx2S zPI!JKM@=2@?pp6xH?H-qP@4dz;Zhi@oVaH!$M9 z(CLCOSPSCZy9Mtu@bCjt+SA~UCthHPJORAM4O&*#>CIUi0)nQV(|37@`y2usV4a}F z!@0)l#^02dmV$9g_~*|rOii0W6%+k$7nkI$0_Y#n+~Yr&tH>(i8w=!Afu zqD8XAZq?yvABnW#NVkuKOa!VDIJdeKMbP6#teGtj^yk0MJ)Zh|zr+^Il#Pnv8qU_c z_}Vxvcjas>AMz;#mc4gnGAbMZ|DFlOv62H>&XMy7eDHU)8vpa7%t^Mcj;?=@TkY4I zcV!Rnx*?7|GaVLDy|eg2Lu}cZl{%i(b}?KQ1HxKII>bi=K4O9LmMrKTYtiwQzgY%4 zm0gvQZIzO4ZTi~`Jp_6NJmc4Cq_^hg=3j@>#r~q_=AEIyyQyx+;Kqee(h~V&sHMfk zU-I~L4x+kn?`)TiPb4wDXKPJnyR{dg z5I(_AJw&ZbgHn5fgp<8v@rJ!-&ugkx(B@w+D*=9k|HrKh*Qz-mA@m1<#LjIlaDy_Y zD^9c#!gLTFa7W^~n?A_1`sC)q%y3Wj4*os*Hw~M#K2Ku!4>=rL3p^7(>>i8=LKbRG zY|8hhOX&XnS+@X#SpHa@+2+MpoAv@URyQ9^kGv-_DF2!5-|fLlF)88nhDXTviEptC zO67E(G}lOeyXdvO1}60}-#_SY z;}p}0()UO5EIP*l@d zAvs#Fa0wvM5Dn7OCVvpTOdz}K(z^H)_v@>S^;>&`0i^gs=Z?7ngNS+DS+Ao0l0Y3C zDk+}#QFwuvo=S@+HpzblKDV0Y`5=B`6TFBGn4q$ zqJLBuy`o|jbOu&OD@2r)4IquVEpdDcT@t@C)$WN6b>;(FI=TRuG)aKxkN5nL01I+r zJiIdJy*!A=2m4fWpa{+?V1Q%RNh}t0!y#SZ0NeA=a)~UyeEqQDDouRFNZik#^{I7k z6d%fI;wgp)v^NJs@Z9ciDvm|8ef4uCXEz*JV>{r^{c*Apx9WFMko&A{QxvO6={jmY zU8UU3^Ac31Un)`I-PEnbjja`bEHzx@cRCGCP?0SMCKG;Oc(}UF7WW9b9$>rE3>v{J zgG?9t=kQSVf_4$CnhWUiECCplfNZ2+SJ%}Z>TaX$g<+`wsvPkE6;58>5*q!V#Q>!U zCCP6;%#LnL^Z>#$2oPiztGw96hryAN4KORxa%~B4iGwFhxx;Fv79AwA&nM*(RA)d0 z$l5N(ajwmQg{7C>kP9@*qG4lX;B#2sjz_IE)_C@x6mK@iN>I{FRu=|PRBUZubHa@# zS$&`{*ScB9ZG*IJ>r(1%lgoW=l#S|Tr8p`H>DSSbEqRjQSm6JIpT9p#oo_Fr)p30X zF7_JFy~}>sggn0cA_#=wg*><%wr85XprNri|2h}?Z{cGT6JlbnuG7US1&q*#1{o78DJk`C zTq43PZ*Ne|U^s11rCbGAHA(0v*c`WnM%W*$=~lRYEiiu=9va$Oj6Ef8Wo2AwZdT!- zA|*92>K0Qu@CCs}$HL+UOANT2+?<>O4jWnEC$hfR05xy@Z(%?9z0#F5gN|0lququb zdPmq33+*U*R1_38rpx-lr;ON~h6V>Gf0=X^jH8}&BuQ{ftox_Tp)6LY7@4nDR780< zMc_=lx$o?ZNbyaUt@5sK$;A7w4LSerjL_aoBcuB9H`S|tHMLU1QoBIS1P;HT;J>&B zF{NZ`D$*F@4<=GIaM>Ea3k-}dD_i!&=2r7k3Wb^^eqfo)*EC9WNVvVw4JL@en3M*g z6b(#EmWp37LKV&3-Sd@itz8bD!I@wj#{TC_T2-o|8_vy+#R$8-eeJ3BUq}1FT2hw~ z-_`W>mp)VHLPtoo%yA}DOBza&sw8LX1v2BMqKHStw$?o@9<9t$E`@#mW_7rwOru_; zkB?VVOFL4&xz$Jx6|}(MU{NteI(ukAsnFbIdMNE&wZ?BTCtkM3)FeIqCYaRb+jE~u zEMeu8^mI^e($UaBpMIE^ZUcei5Co164h|i>=sWlVE(IAG8KWnrZid(xOO6=;xeaML#^R0syQ3M^B5?fpR1@vxnPXogi&7UtKvsN9Y zrE`Pt+u=|MY(h7qN1mzz5>>T);|tH^E_|kjZHG(F2js<00=na+f$l)$HQ{CXie>%G z__Uwj*OrgSh5DA;vJvYG&g{uo^K%HVx5w!n>#ST~KaR=$;J7^}=W{hsGH<5!{lwt2 zWew*t(I=ML)m0D0^!puyzNBf>Qk+Gk#oJlTx*Rb9E1Bc`CQU+p$$-cv5cW@U8(D-9hYH{54r z1fz|*cjw)3C`X{#w0G~GbB{P8-xmso28-=tgqt&9{xHP7i+9D7eRx>|!e*yhBztxh4`&kIAhktpv9Qz2~|~ubK8a>yNBPn5jFO4mk#Ss}J;FT^e0p zj2iV?VPS5VVMy(@Ceul!`U-}7uFVIZr_o*S|+k=Lg%X1heWSk_eY3+hAM+h@F# z++56-FnGh36YK2{SQeu$cj7If`4l<$XWFW9DJ+cac>FIlO^!KtSn_x6ewc*dEl6rd zN!&(GgQr+Rh_XHjQ%OonUcYn>c7lYMwzf88iiRzb|6L#?9i6#A|JJMeK#Z?8dj+BY zDcz(F3dGPh`FSny=jN=%&OAFcx60XG++wF)HPFK;7rcqtX5Y_wRe_FkV}EW$o&RPj za`CtO8AUD&!N{*)>x!|BeNIsdg9AM$`R2GISBE`!Lji%8jZtFJot8F z(a!=Bf#6L`Xut3O;^RHpm9<-ZE>mC;nU$QZ^{O!bU6Yrqq9?6q!@^@?CNGs8wX?$0 zT1EIdFKaRA=Q;b~gg+)2C*L&5w?-)Vw77qWERuzJy#%S>TzK)xyDUJH+QtQZNmuH0+ox z0mr<9z0JY>ElWXXlt_gufr|^vM4o&KA06ERjdMb|2t7TKmQ~TOWG>>%Z>4u;>ynh0-lt}rh8RMO!`NQun%C`eh4;H-(G$T( zf{)$sS6>L&%;X4XfedUm2&jW=0poD9-legx%AuRB#leA@h?;EHPhG2$d9e5 z7nx121<|hCoQZuI{SX_>Hfx zqM*AK@L*<1Hhk(wRu(#!>l?Ew0*yVO?LBgJJ+nysMC$2NaMu*?4ggIgRp-Z9cjD3C z6*~ZyqM*GtgIX5?Q>34^%Oh{Gl7~z8+>wO!1tVoq7XeApTtY?`4i*|$4e78Xiy%S! zNLu(Env@aTCrO!^4SW}cnfs3Olw|6@cxw-7Mu(9-FFrz_uKwP;tm!?gByM6ycA2Yl z>(UdX&ris!%N!?N#VH+Y;(c!2G8W@-9Y}+zswiFDUfzCvS=J||XpzrM@p7s4B}DK8 zXZwm6x0TjYC^tg*7KCIgP-<0_lcPd6a(Z}20seH6ojn)$cG;(Jfs|$_yMylfMF`0% zqhT|>d-sQwNJ#5(I7DDCH>Tp0g`UCjf{p$5?c2%C3I7t@NFpf4bS35guy6E59Q%Ek1DZR1~0mVa@A@QW2zwC;IR^eaQSTl|6BwY{?w z+!=vA@nz`PJ;wq zGz6ACnNj4Y5lqTee*OrENEvkmnK(K1w&pxR3IiKAK%e|PTWyuz0GRlpJM~~;;P^nV zHmxO!{K4==xlN_~X7UT1OAlEB$d0*;|N3eP*&E3QtOy}ri;6+aT7l#b^2Sei z7pEpx!uD@?}E!-w$ZU$wH^6R8GSjc z%fxjY98MZO%Ng}h?Md0_qGM*7eK;e2lzb{&;dr_3tL5c#wtV*&^sNVvBk9VI8a)!T zR+q1B$51mebm8S0uM}tQ$8aN@dwq%cA$3MCQ}iP&1$%|!^0{{)6AUwzs`Wd-8|7RM zq`ry@x5tk!oR+iP)s5QYecX<=)1#xgU@d&U;<9f;e8n@A7$EBiFO=^Umocy=N#S1|URTprq`U{r(QWaH>4$qdAYI@*uUF=@u={OlvXNiA9 zvoI68(L7vwaa%Lb+3@-EmTe7OxV7=**$4M=v2a@sk$RQWpTAFabv!)y#b>6Sd&ZzlT8rUj#0fJ$KR4h0*AgeY|1v^_E3BU(h>;GGxabDy?phm2kcnjfcC$^`mXA?@mKT&A@IRD2oQ(mP#pjQVGfj= z<|igPET!G!Y)&aD^N9j~{ zYvV`2PKNq%|5v)Kk7WI$ot>Vobym!4H~=NovEX25FSgX9d@P!%`Sj@@hz+uID%_yW zquS>+HI!*^{sv* zrITc1Co6=UHelLZT?f~rFcoA(;t z&lI`($!`}ky-Lb}>dSk5ANvZ3viYeNBHX+7=96trdRNNcjL&#n*3QsKs~#wBDRnTA zy^!WnS?MJPj_0ILF!HMIHqZpkHR=5VZG{tPk%us$txg`;F1^6TJ>sxz|){c%0pz?==%!GuTWn#ivXLEr~EW`sE zqOMRBwYRK*`3Hfza_5_tdsb^u0j}Zi8|W#_&$qS7TWpInka;LX9}36wldmC`MUhMz z#4lVC!fEtxe%Y3tbg>z4%*>>H{LXFn>=Q@9f@!B~T3V8tL-|m(>S(oUg@BW*@2^|7 zhSJ*4$?(=WpQ_^yCC81%Htazwrgr+^{V6t>Dh7R(oI8644^mA$c~eucW zcz`k=tlEFz5IH2JVD&3~eXz|w2x!$ki`e^~nmQ6Edf)9tSdDV+YY?RG;egV)F?Wjj za$i6r@pqOrPzM*yMqN$2(<*=u9>HTN3Fv@~65)FvDJ!Z+MnDeD$Djb3=g_JVrh4$Q z>--6b%DEcNEgtN~Jak5}(a?a*b+%gW1?XPwEcLfHG-PN$1oJ$9DYEC{o>}pKxF4Wq zJK;L6<_2F&Km)EVbeC{j2%=D$TkAzBX$^K(IVbSiL7*yRir~Ezq<)(-X5RiX0yajN zwh0*mb)m5*VVf!Hk9nr#r>jz^H|(qnwo!LiaL8)uH)z+`{kEz@v)(;7yi-O^b4|7; zZJR!wYtmlI_{*h>h|3_cTcy*6S#Ss;G!*WR_HWrc_)kvUDe-V_vgw03xvs7*SWN@& z3;pP8of`}1YGuO(bbd?sbYv%CF>^v3ah-%LlX$XJceaX z{L-hf{C7e~cslEfoOW#m1xdi1;-THj{$u})S1pJAE!TuXzL-Ff3Ljq~GEzObUt38@ z!0q@0G1ILdTKp06x8$IYxj8!yhUjjnHSk_s^-i&zbcBhC<}^{-oWUU?N?#|uWU|Ny z_#VgfsbGRdPi=}e-EC<@+HzZQ+;4$fch{?aRM%H# zbX}rRkQ)o9pwcL3 z`*VN7-3|-%U*PjS3TjN=ct?QJD7F}Vturc}Ai=T(prNkRss}VQg>3BB(2)gqVuON% zgNsSYhBy>Ue^R6~eZ=A+Q#ya{9H{09(a~jTKius3VJ7kM4LIW{D^K@2i|?l#UoP2sQtWKvDOctu>BiP) zPkoD{ZV*A^PsuS<{%D1(WwXnM(RimHexlP6AMkJMo31XN@tiqvI{fnb#)#j30Z|IDxoE?voiep z&|Ve`ORML#Tqk5&(E>&5i_4I#++dBTELTj?4Ghc%U@lOs?l3TP!39(`7Ve+hJFMMQOUz&C78zT&n7Gx{p5O5lIKnSL{XvO>GqX7Dq08Q|2Kiq9kN zRaPg3`p9H$q3E8hTHGnC2n*ZdV;Wae|C7tIEC0M(MWKD1A&qDzk$5VRgydBS?Iwngy{C^x%@D1OZ8ZSpgMhcMIbHFd&kRlhZ#SfEye$kIx9vY^<&E z0LBA+z-s+T>)=-MvORV$qpY1@lts%v;^qh@7fFhU+q;)BPcQ!QZc5 zIhmhH0Df?M{D_1FIE`Z1=RTANDzhoBbD%?S)JA^kgvE{r%%TO#KIOn2I>y$p0MFTQxva2~5y| zs{%wsD158}?yAIg*%2CL;2zGv@MMhfA!b&K*sNy&6vzu<2Xya*FXWl__qEA!LwlVV z9kKQlxOU@yfsYGi_WoRnC-InSfc}@n#C|~5IYCtnnk+l3LQVj)0`YPX6??}(?(k-1 z2q#c-YNjW@X{V{lR7M8*Sl&wP4n7(_fm#P5oGc(iLEvq7&_WOD0+q$-XMbsCdP&$p zNgnQ|{$J}Les2h%kOYg-76FP-r1~;=J(mN5kyiRHB;xLA3eP*abID)4;uk)AE${l+ zwI}&->HE;uw~2R8%ZmejL)^1;8}fu2zik}F2$B9ZxA<^p{cCsWX_3Y4ra#!l-UuOb0$4aHY_Qc~f5jeT&S zKJfj54HJG5H`>lRg2SL;1JJYp@zO5Jaq7vC&*2kckcRg)*=@@T){7w#>^f%HdT-qrPy z%@*B%$m))307HOv5rj_Ef7+vOZuZByYD0^`)F9Zv6#93s-O;=AlO7`Ds}&YI zJJIhMqSP7r_7(N@q1OD#pdf}13H;|2T~X}ETKSsx_ES(n;J2eFvRh4sizG&{?Db&5 zs7al&3JmT9rPmO6+axcKgwV_YWA7+`SVvmG&*5Ja(Zjj5kaaxZ-+hhnfiFsv)oH`Wa_H6hJ^h0ms!~xeNBc@h-<@ zWN^F`s{knJHPW8h=|(#!_M&Ud&d&HS;Gd8sg4{|_KMx!%(xJ~@DJfw?+6e`rVwEh* z`zk9rd4yyaj1Qo@?=twbTcigZgl1hk~FpkKKHS885FxMuPs}e5cAP zplwb2l}b;5QA9NjjV7oX{vIDwQpW6Ucgo*(GFDPRWfT>?&B>`ODk}Q?!lAvu2yoTm zf$}f9qzjKEzoFqpx07XfujrHRZc#BGUVEZ+A@s-G3++~O4GWcyc))pbdi@t5zD_9; z?&<((cUkBfpKURN*l-WxU#tsH)e6lm936>au;>y7WY0ZB`9rg<^ATL+3*9C|zu(VZ zxQb$+dI4f0U&A@FUkxjZLU@BsV!Je;yf;xZxU!-sDiZyZ`HOOPwht*68StGJ=K3Nr z_2@&tGg!qk(E>qG4?sWec~$N)hv-|+&kqVMUxVS+14WqYURA)o{*S0Q4{zvxd0e9M z&dW^%V)}b}`t(>E2Njh!@)8zcX+U3sh{)k|I|!%UyfMeD&e7g$=K|n3XJ_V}MQ+R1 zXvJ?hUyH;X$3WGwy<=)Q^S`CJDPrp^pZk{59g@g6=>4}KO!*7qqrbpC`(<`l*Y>K=cb;N?LsgLIJhb1x_iY^ zjhv{SURz5ka|%sO854&K`m-${uAqSj;uQam9t73$8?GOR_q2Yq+`H$Cls*qeQ`0ju z;Eoz{T6$LsmJ}1A7A#+vC&DH%my(ox-IEbl?HYv;)<(`xKrI+PqFE31bdKHX{6nW_ z%11nKzj}!1!rQ%rhgn1$e|idzkB{zy{?(7TxMJtM79j476mNe<5-NQN32{WXx`*JB zUz{bGo9Q9KdL6vEzkL8zC40vfz^qPA)DX1Bj4q6~ld~k<2yFz6;H=Q`H!CgckWzu>@)HduJ@tK_6B?==<%xU#ki7oYVZO8mbIhz$W9eNZ>z0CIC*ALvj&fK(It z%mJ-YF78JRZvl`<{}PSw&pMNEYCnV`k*>d?NDTzGO?|2{ zNKeM~^`gGq*>6I}ebF&GKP^T#jt*2Lrw;PfGoBDECP?&NIrl-Yj#<#LD+c*V2{?k2 z@b2$EUF&F*Lu1$AL;-htIlJAJ|35tYO4+9c7Y_N53;ISz_Dg-N{|a>qQ;=6@5Fla; zz<}VHsOT~rc^RU|o@w{ohInM5qzH{PvFbYDra*=$b((xn1)XMyEit2frm8UzmR}>| zfu<{Yj8L*$k!%E4v`E|oHa1&;z1k+O2?3-6&MJn@#w}Q=Kz6Z}&yf%q07p}8=Fm-` zg}ONR0DsyY8D#q4LECVyp;~J+5K#ImZ05OocsmvYgbFlNFAWX5y~MnU>F!)Zue1s$ zw7MlsF)oyCD!{J6o1TtN0`@A5k%#OPpp?J_MqmHVKcr?Vx|;>Xqng^gP?d34_iUVo zZ0#6QdJu8R&@dK(E)Ye)U~xXv>7|>315oJXXXLIsOW=z1$*@Ip6}XTP9#$`I^YUB; zfyd`^XgUs`GwKgi`+=cz{-Rf=`nH{`>+eufwE3j#A-=6VTS7`oU+-?bU*k9A;?9Qs z(B5WUB!3~Y(%n3xME@hqVvYf5eURG%4$z0-1b*O4tvg6&ook>>gpSRAX)^yC0A{e4 z(YFiexq#T`r+@&GOXqSpp^Xf>V$OmmaDn~{q51%@7?!nK6L@Oj5|axwhMxf3T7T1Li=8b7;-j(LUyw9CNrhXc8* zaMdH zQIQ>hp4U5tsh}tTXH@ynpK*FRLg+xi%^t zi{j_c&=J~&DvaeMv7w<#FXW?i4Ue0kG=@Mlq{qgt)%c;=K>x+b`dDyi zg)dzLNM3TXp}c%xRu;>@wL1;<3*hen{%H^JuEvhu6BA!RkTZ(kPVnyCBrAy<+%1Y7 za6p~Bv7EmFMTW16S|_*}@sP{)X6XPbtkAa(g8VQ!decz~EVMKhz{`Qshks{a<2~|ajWWkVXt5wSH;@40Af((aZYP2u>@OY`)}LYBCoL(-Yri%G_50II2~sr&bVuO3SYL+P z|Dw!t&OodzLv>wDLLwq8%;os72vh`+&uYE_lY^Ic4}}6&IJ$cPf!IQDM8x7M1x~tMb~t=*ae7VLMKC~)Mq7OAUQmX9s+Q|e_UvH zQz)Bgva_->Ffw+vw^PSUu@L=f`%Ep$#?H>7Q+~P{5NRr^swjwvZqtl_i(^m`td6k& zp%5YawVwbok|$?}NcFzTG4$bd;gpwagoM@HOl!7-mLV$Px$<;G*iDE#pq9ypG-mRl z!HjM79wXzv)n2&*Y;K?dL+rBec!+E4UUJYiHdd!&ev{AUQ-vE<2~DaZ-$0>p_b5#u zFwxo}(ylSmL7I$|jzg8^>(|c5{`*V}48h22=#N_hIF!8CRlrWh#29j{fS-Wo-+v)S z&KZkejht_Vg~bFY0?=X*Afc&7qWrO}tjyE1<}KDm(7&!a4M$^>erObiwyLQAdLsa< zJmpAJlh1s_c?#g(4DDo&X;N7F=;o(?NbY?BQ!%3%DIt}bZ3qi4aujzx$ z0}bJdAYmC1v~6PH<&}|@HJP|-p`t=3F0S2kl5IC?sT_JlS;z9>jq2HVm%QG;i=PlX zM|AEFnRk(OL_%qPQy@r6^5&9-sfDSB6A-C{6YL_Y&;Qze<$dMS*_`#=x?ak_ursrj zq3e!t3@rdj+FL8ySK+nTZ8vB^@(48DhPSNo}u~iQDf=_95P5d_Y(q=prr25 zpA*K#r9A!Y&U;$vvt(qZM~9`;*B}JALdVJqyh*VY48&CKmE2l-8#FXLuEQ=-_$|A_ zBhG5n78}NH2ytsqbF<6}Bdh^>-=LtNu`z-|i&4n7p;7fiIXwwv3=QTCty+`S^tYh_c;|g!c?Sm5 z85wB<{i#68&B)MpnU%4!vXZQaRh=p5dMK8fXK8KC^e5DOATO}JJplBo{nj)Q^g%nz zWuVnQJW}=u>q1bbY~S8iXaA>9oUfX0B+f(<(6sv z{VccTi!);zk&9?aGva%o-i4s+>D#ag%< z-UTIAwufxvcFh;l5yss)8s&$Jx>ZS_u7I3wut2=>hjW~; z1t9JFyC=?nzr1b^FPq`Uh`_tM#gD1P0e$!~_30jHH2U4z+G;WW#}f=ZV$qajIbsmZ zx0|Y$-59-$8_-wkU;=1Sqw zo16E>tP!-o2L?K76188vc$0b$MSJItR)s5=M?YT(;IpKO2U_|S&+@xg7+6Z|6G+{` zB=ezu{S+uwmA|avCR(@?S>wme!_&8q;`quB^-KCl5SqoNhSiN(+6aWfh4U3xWF#c& zIy%_y-hG^?5ZwMQCOR7Q1Ii!>0JW_|h197}@QU64WP@~EUfxGPKa=5oGYySturK*u zwGTv3XzeF}WUGibvlgFn`g7!L%dm*|TdYxbZf+709=;xYSl=9=VWeAeQ~>i=ygjIJ zGfOJ?-g!!9kG^8$V48Be=XFSffpnDh{D=C}rmCX@T<{{|=i{4^1y0l;%s4LYZUnal z6uZPOWjpU(!Ns+k*Ixp)Sg1JB(b8U~27tIcv=}`+JkXJTP!QzB3K|-Tetv$}X{f2k zJ7tBWK`u=MsKQAQ4T6;*{ItLo!nTgYGf>cce(wjz{xHIw8@5~cLnlD^W<*8h52`&N@`uBEpeBlQW9ew2Y?}QR{3((26x`?@G z+1|g?5eF&!#CM}m5twdK5Q9Of7g-qy3s<7nC#PHB7rXxfgc9f`gAq}_(!Jmgh(uOC z-r{_G$@0+tbJuT^fiCe&)I^6MglwRTprlw0-70epNHrdx-0vSai)S@BiF9pR)N6t+1@b?$z@owD6bKdJ& z=nf`4LG99rgv3BtU5;Rv1~p^@hhvKX~7|C9)_eDr$0kJi`aAah-Dg>D8xc z;pz=hXX#0w`rm6LkBdxEtUI2Ksn|zN-UMl5^&I{1^77~*AKzh?iVV9qKLJ2fH1r5w zOdJs9_2$|rtdcR8agLbA3gUB^(i#Zm`+>vY-@k$U&*b6kL;?4HwEQ8+4xJv^9B^zZ zoLL3_Hkif3Le2-pOA#@Nx}eH8^HhS=)!ukjn*%Niybo6IR0=E)9?ZlrYE@SY5Q^v< z7(5}WhAl9af8cQ)FuI`0fiEIpe?2TZ8jpko?f_S6F({dA47i9~O6({YV_5)$*k2|5 z6`L&@o`)|XYJzKEXU!-_szkwX#k5<8m z&?v3DZbdq8&@0M%rekf~g}3}PfkOz3S6+4{ic&}wa7O)5h8aQOSZB(+C=K5}{Bljp5;IeJiK zu^InUW7rx!-F@hB-D&4s^h44RHv^GBit`ig2@+s}*MS6|b>Bl@*CS+cw00tm5IMrP zskIe&ze^p75nw_S!tdw(@gsDVft5;;6&p3T?5XNk)cp%S^Nw`a6?nm zQ!s&{7E@9R8nX0FfhurjW+oi^P$cp^9qpx}q9SZ!M&S9RDOExv)y^hE`AZdWXjnYt z?wR@KRq0TY!^5OiT~nh~WW{+R1V?y>=-s=u4kryv~vngMC(bM8thN42G9pn&)>`yyCrJ5pOsvgTd|bdc4JG zIfz#8txwjuI6F^a4uf|CAhYoMy_d)J9~u=$6(=qrw#4j#+U^}aKD0LcdsT&=P{bR& z$T)Yu%v_=_-(Nrn2Pc}biHQbAM&EXwGMbt)XqGl6157U9u9&}i6|b#|pr`Q^sX#6g z17+w2xA{+SODxre)I(E?G{r6cH7w48f&woIg8xR>x4krfu%y;7QA7IC9|y{sGd$%%o7)V!?_Q?^m~z54en9dN%4ipORrC-n>r@?DP{ zF)KdyI(UHI_DE4o-s#JZkvw0@-Pm&6t34!i-}?Mba|<2OOP0GUWlKv-f9g*BU~w}~ zOiX;#u4`+1aPr#)Z5FXa>__}Vqr?{Ag^_%`XM|3>Qr)LHBm8xnVG#pM(>35DBcb;96FR?Y#8m@RoBKzzao(LpQ zGsA!R>FzPFbUSK{h(aBU;m_JYz6mxp;IsjUa?sET`Ze-vBntUyiJ;bc{bkh$fB5G~ zL53refBt1>QZxG2^!9TqHtyajcj4#Zy@ilL-@UKJczZ15@=#@7UN*B0A;Yy96af_xU- z&cx*8T0PjVBHjS>qbKz3PFKMMV2Jb6V=q`dc$`s^&d#ORX&ye*>rU&2%LNZkO^Mm4 zG((g0AZ9M}A!iWphL;6bF6h==q2Ais`mVPQqa~%F2#kt?4HxzKvs~pk>}`06L>RU9 z2a{wpKq=evI@F+`OS*@e3_LH?BP%U!GF2atIQuMuYZ82aU^hdc2lAd_f-W;7Wp6v! z5*5I-k;wzd;S)>!)&Sr@P1N{7B<}9+ZxL+)Zi=S;O(2PpzFu=+7{>TV2{;(5s}I2YQu(nzm@Mw`A$n_P=iZpf`o@OoX!$S% zs99OL!f^p@BSx z2lVt$kFd6UGYng^6C^5T;oNKHg`f(;7Dxv;f-rOdcl^YJ1a`OMS*(lC$k=BF!R?13 z__-CGLhnMi+w;_y3$t}$p#2=Aj7^eh`9=YLU>fR}dFDq2*J<2N%wSDGHZ0*(mSR zr-Cht@KVrVb!OB3Guz?w4j<^5cDuwtOASU}*Cva`V3D@5b*OPaNhOQoL`YHMP|MM= zHb5xz$rA@{cNRKCkVmcm;`8)Z*>)D6HP1k_@3^X+m${OD;-&WAHHV350Ao>ADGY8e zieRQK5pbN8aYD!{D7fAh*QQ-IU@~QK1SilGG(gM;2yYNuEScavlyK3u)|WtZ3(CNt<20B*Ln&49yrTU4~F)cPA7$Gg8TzK8zV zW{7g8ro%#47CymOsA=6-;bLWH@9c5yFX`;=Cg)izgZx!eG);*W8m3HLZvfl~!S&N` zYkLVGxR#p>ykwC5-lQ;VkKc=a$bS-c7-3ONb)ON=g+%O^kyfthI6_J zI)x|{**dBbp5Eu-anhTi!50$^@oc;G&MxPZ@LD^K9o)DA1 zFD#5!oIphn;6kTYFJTZ6x1oxueMa^rfb8`2HXEea*%h4*ZYifJ?af9gUA;=Uv%?7~ z^-TW36@E?7qytz*OAE7GNtO|)uq-W`lokw!N~oyxwmbuM+3gS9L*J8z|os` zfC#!5#a|H>6=l8lB89O8mvY2#d4M@Rs3uFdk$gY;q_54BZTr*AMy*$kFuW-&|x+VU8%S4e^>y7aKGqpT#;0z zE7YLIvc0v{@aT7zTJ9@w@&jCJFghzl#Dadvd*$?Uu(FDQuxiX=X(=Nrl5A%M=gWQf z_wS{SsOg@G{rc6VNWaAyh=IW%!uIwHpqJeUJ}g*R?;%qm1T=%g4kIWsWnz*U<5YRk zzqlB_R_rBu)VRTK7O0m(o;DpjM(1$@x;=^LJ6Xe4dFdj$1Nv7>4mdSh64DuAu6#A+8mQJ zJ#x2W<{@FlJO$!s;H10$XJDXMfC$vewm>-lCK;Kgp!PNR zu=irioZdgrItEBi1bn@FZ|=_rCIfk{FJAZ%ALiub$VT$auB>Dnrx4K5K#7K&+{B3H z6uzA3nVk*gjjsv{(E*evTCfv`EUy@YWde8+T9i%SMNhDt4IZ8f0sfc&llkMr)KH@j z-Yc$<4}++KRb9Kgpv%5en$q9VQ60?bBOEt9HN~ig-xe>fH`0DKmIJ&L0ZHl#s1~1P z)Yg3NKz_Q(_c73Oy~&c56n+V_J%#6AT37&ZZ_e90UFh)V;}yp9_(a?E99y6l{H3b+0JUM0pm; z^AtYc+Fi3jM-b{;9YE$)+veq@qCx=xKiEPy4aq8k`6TwsnoVxeSEalIZ$1#zbz5PgEu~*5WtO2 zpWp;!g{`o+Da6giMaFMyE7f3KG%+bI;jlpS{7w8JMR# z%Y%>|!_i_6qWndF&v**=0Q)U6+KVj|IB6f`vWSI1g7QU{LU;_e7;(p-Vf29S?UW#( zTc^c{vSNO0FcdI8a&-6a>o0Tx5`ahl>PQCO?#3j55cvfKq&IJl6>6_ePe5^K)*emq z@q(SajTBs{;AA8gxRUX|6_bOFafMXM33CiVjpcRe0#oHo%|tjeQnlQ+s3?mOyQvey zMf?Zi1l(Pl0<})cL+rxQA3Xa@g3{5^QD9VbWIS+masnu$K%-jeWJABhGdE|}&_ExK z3V_Xq>%l{NY`k)}!ATT^GJq<<0J-lCTD8gF_PMR5)kEl{pe<(7!DY83WMPq?k>UU8 z6l{}m0`ONd^5M?k-`n5}8p6|RDlDuX;OEp=>wLPQ?BF6!!p38H>}M!=OB7=8MQw1V z%FEM0Uv^VfRXs-TgHop`NZp?lryiIAxCH4Ft`?T%VUH|B=H4nFoLB%xUXPLC-RyEa z*r;3TymZO8u#^o7*QEc&BKz^`iq)=q=gnz6s3^mET64g&QP0F=1@g4h<%G})&PZ?V z%kzf8$R>Y%F=@jFBW*A~P!I*Zi*r!@=ZPXn4OrTiuM^UiG~t zSxHGW4rfC$sWMI**gN4-QJ03Da?_eT2x5$9o8qfxw!!= z_;T{DHVOvvk9#{UU#qHC!6C*9Bh|zUNE6`WGu1IW?cR2Vi~Gn%NQkDitZaNdj-BXa z#?9k#Lu2|9=j7*F`_(nb4}*DHCDh7SY-~)8%+2qgY}kA_X%lr6_Z?2YfngN84ry|S zkgcW3slc{?B7p*$1KXVf5d2Q+NSqo`9i6R_GM>@$-G>ilu=oAt_VzsOFvj%v@9TfD z2|QTY8n5oIs^VS>x{Qwxq>m(_qypblSS9ox#D9*rZz4b@f}GDub?w14{3M4pVUSQd zNxua(E?p9zblEn2cR+Fy2O(R4oyscSU+3w04pKmCrHzvc;VB=VD=2%OhH6b(_Fc#E zsy!-~jeP9K!vHd6;1Kcg!;j)(Ykyrdq+MQwki+!FhJ4*Zp$?b-FLev00kT?>n5O%Z zos?8Z$Pj(71FfY-tsQb?RqRnvPkctLy}rpy6CEKP6YE3N&$h_sNbo0y9r$IqIrtc8 zI#O{*Hj-_+jv*kvE1A?~Ia;1p^9c6HkyNY?q0qOgfrx+G%A6Rr@l|2N9}@hM5+-+S z{KVzttnl#g7#q`ZETD!xkch7~YJ$M<=Q!D6&#WM5abn#JG%L4`94_S;Pkm>3{~ocp zyqv`~562ve&G`6N>?hR@gUE+H+~a~?%-X~^WT$uXn&@HQmhohvD`^EwoCXg<18F{( zoj}`Kb^+UZxbE$0a2zMC;dhIRz;>VDGM{!!Zq`j<4 zaOGg7rIpXW3BL^lkl;My-{h?fzlHwACmol&**%D@G-(OQvU?0 zAxaP@o%(*}bUATkCLn>VR%Q3!o=+g{b&-&;+4Vk$>&+CV1UU6+GRL67!7|CN`}aQvBjg>i_o<);tcF||qaq|d$tfwVruCiB zG#D7L2RV+@Erm8%=(-On3V`W2OG`uD^Nj&J^PMH^JTT(I!o{UXoATjf!-P}oE7}zJ zc^-22mNXT*(08bXzi)ZO#>TpCJ}uVXD;|Eur%7qfm))6Z=-c`7p_y#k zk?lY_NzB)HIugeprBoS*_S0*oS$)g5=eKTEH7snB##HmxUH zJjAJZ1)G{-UulHr1yH{R29&t#K{99?kSmB)z~ah-&MJ&(%#2mqSQ}!WRTD56ZU8z( zMX?B_pvLN`bL~578k%V~p1n~^cQSU9@FN>2#KR&ZSN@k#3NCKVR|%x~A2e+me&|4r zJ`VfXk`(yS28bcY)%nASbQ?s6kWb&=z7*%c@Hej=OE-**-j4s^h#Li@f`OSIRTxoX zGk)vI4KdNi@QneG#Q`1^=%+FMaXo`0Xf;%}Jhbr#rkdkVaT}Z#UX9ALiNvzdJ-7t0 zPG)8%pav~*FB(9#toYrgj=MXC?$v2+fkPJA~ z7a<&d|3XU$1Ht2B`5NEsXSM=z+j5UyEpeI;_sy6Sn6D!EwfA066>VJqqui;*&cSYP z^7rrRvPS1&!P#mHt?F9c27FFd&Vq7HWclh90z8D>Y`8g|T4#B@+xn5XDW!l*jm2UW z59iuN>K{^`#}8L=7j^jrqK`OVa zh95gWkzcJOw;C>vo{cotH8UNm+soNcDC+I)iD*-y@!W78T!+I{Qg3)Y{%)UzOm&^j zF@7!g!V-E{4Q(ee$me!2R9RVKac`WqI%o`Ghj40Nvb#Otm@&v>pxEZO5hrpU^fCD? zCl1_>8-vI=n*_Rp&1)SjW$f*xDlCYBuE9V6<;q*6eQHrr(rE&k*p@QojbI3C z0l}A;J&sv*?rQ%~oSMwap;rXpSl_K0UQqh{v%ERyS zy^4NhAUZYhy@m(*vren-Fs-wT|N6XCpYp;L>U^y#7IWGDswK_@S6b$h!s3Iy3QH|y zKhukqo%zL{wwetgpX=Vz7pXbWbyjQZHrv@B)s!qM-4>nD#`Hn)#6l0EO7zg#hs-Xj zsMdW#FxfJIT9JywY$=utyp+jQbdX>;4gA9lICY^zfp8NYKucl*QY@$?;FZYR#q#~O z0`beV$1E%zAfMRW46MkPYfpbAODFI{q5?ND(|1+uSKbASy;h1dIBX5W!!j51j*-vV z*bANPVt}N=Y4%#JoeLUXFbcZ0HT~)Wd_99V$8nwb#XqC%70B-qaYfI02uS|=W(3B4 zWic7ZQ^}+ViKpA$S-M|_0GVR^r~;e%*xZGCD_ zqrW3YjmZ$J+7FyI2jO9aE_!q050nqc*{p|TC6uo9sX84kB`AA)f07ssP$vtBWD|(j^cGGCjKU$AXO6H7QNL#ytq;q(8@Unq~f~6l^A#{Qb?;2XDS4zQ_BKseq~nq z%g|vh&%!uY>zoV6atTD1E7U)pH_)Rje+WddyXPDZ`XkUL^~&ber6fW>1p=x14g2Kz zUthNDOZDw7)P`;qFV+mK3P@vRmx73%dR}Rp^FY|^^hqR(QAv`DbZYZvc85cTP zfe~U_a4=(7b`6*e0h`fwp%9FV0TPahj&7mAg2g0*wa(r3^?$&41e^XEeU6ICudUsz zbEO7J#895rN$6i+p>}bJKEhxjl*$gXS)1EFTA8LY#Vqt7TFK&p z`tJI+sXj{A@TGh1yn2C54EpIzQ{P_&>YpgZ?KDj&($)*>5;_hPxRus^3}4~lSRoYJ zxiwS4%y#cGd|v=*!7RP%3IG0EH1%w!LB1cSo)QlGDy zaAulY7*8yJ)P#-h>rSqfp&h45wbPOyEUje;*X;n~^6fH{7Y_LvHGBEUY9XImwLOkq zBSz1+7HcbGV~2g4@;zMM1@9ULgnYgW{710P{lGJ_#7t@;qIB?!rq#(P?9${t16n5d?vat_@n}z?$QZ zQODL1dt>Cx5mg##4<-feo_jo#^G7RiN}lT_Bv%Q0U@w+6IC~mpgGW4$Dh5|SlnCZT;Zx0>^+k5uxYzoBtq7bdl{j}0#!+yX< zfXkuMJ`kfoyKHQH{Oo`K0m6LRH@nRE@MP+E|=Ln6EI=$rTZr1yl$b{PXb&z(8e59g1X ztAm^V3-W@PGQWN+>gFr7n{`5x>*cb=kD~;s{(-fa-Kn+e!S$C-!?ki0W?iZ8Z8t~I z+LUQ=au{kA=Y*9yf_G?I-}XbkQx=uS*!$vldR zifW5`veproxn8Fxn@grq^KNEy<{Tj8;QRxR7O7dwf4n;w@Q=}8Eu_4L!yp1mEdb{N z(g83#cnQhL$-$)KEWY9c&_{b{(wF)D`*+Y5Iz`S%f}tut+(yVS=G=J0j1zhjeoI84sBQl>_bdlphw+gG{YF1?vgP zYhstEvsDpCHbIOS_w2ofX3qYhtDmo4zDdW)>Cn<7Uw&vAf_`10twEs?$26Z$ys>CG z!3{Y@pQq$2DLeu^_f@A7MuS7l>)}#Cs=uiQX8LxsyAp$GLQ`Z4C0TSDcN^(n(qI42 zva8hicz<%e+@#-Lx-;DpFUS3Z^NQq#46i7Qa*4EYlD9=&KOFl8PsAMx8kXgHkBlBRSVn3SQbTLnD zACTD0C-c?o{DaNUu0wDKM9*J>Z&wUk45YO{)sgCNlhLW+_wB9*%sRdF-W7@cY_!zP zhB;b0TkWtqso4H%oAIr2XD`}3AS)`1kOs<&Fy#GCxm5p_x$}%ajx#*;&&a*Xmq4)0 zAZ}Tzw98%GT%DghV%<}A|Mo+MTBAl_?l_3v1vSF{sqvFYWUj%A=eKjzo>`TPF%h6G zNT)%Z)adJH4Db=)L-8D|^Hp{TWyZYA8=rpw8Dofdqmcnc`7QF{g1K6<8zFu5gV{yRhH!D1V)a1!v7jg(Ek=SG~e-?6` z|IU6C3y{m10?Vz$U|#rW00-dau5rck8)jer9dAxNe%7$AkJ zMcHMA95LTlD!?$S1*o#am2Ih2eGJDPm2q*R+HQT8&^tMHYqPU)>XSa1Cn4kr?W)`o z%E}Fh1CGZW#pPvz0f7NkWcoTL$@RaNes;9A)!6NZ6DAwPMO$h*9{1Q$dwPX={SZvj zocQ`BGLoEhpAEWjze6%0_f6oFa6|L*F*DB`Zo@(S4D}71gwBKv0r&Vll%tb@LHPUk zbwWv&ZxX+-0NbIxok=-MM>Wka%F9coKYNZbtn8)YtF;Kl#)YLN_=o^ml5PsZSnMth zhcOx-xXVKy$LVM%Dj^}lpa~G!%2Jd5T*Vy4e7}oMw$#Rib6g)4Hd_g096hd(AWf;et*`X!0p@v(vRR$m;!)!)86xu73&N(s zzM_)y?WmjB`!lY(6#0GalV}0gkNju77e-MPzXSpau3WO≀JaDtsVVm8r5X&|+NB zCBJZqI(c0LVJ*PHsC2Qrt4tdmJyw#@2`t&++fNC`+FQ*B8#Qnp$ZKxe7X{}uO3}&E z@0FL0%7w^#5eAG+gw8jnk$F2%glm3C*U4D~4i;7s%HNq$@gSa8{N2{wXGgkbW@7?_ z%K2tyMwu|$!pX)4|E(y?GkB9|si*hGC=)z2oKMzHV+oy>VaV?uZx2iyAt5;f1Eq;` z&!3CLaqme<;oB`eWiy(3ofEF{yKegN?~xH};Jsd_bHM-y29`>&qyZXQu&$hN)Jt@+ zrx;#|E{RY>LBV|5DzUe>hZq4(AJM9+DqwrTOe%;II8czY+0bFXd?Nvxto!Q(i@g~i zu?X4CGRt*G)WI-Jx3HNgWL%VX-(jfJZTbWLXtEfaV{im#^4!>CVYW2Jt`Qpz507)N z-z%YuJh;_FA)+-~nNSo02y=xxaE)suDdUs-xg_Ye?|Nrl|0Lz(PA<^w&{dj{-fxo+ z_d2mKt*9sSM^sP-hJbqb6;Y?Xu(9KaqY;%%ed&YXlszPJ(>sqV%bjP_7*rBlAj zGs^`e#(aO0-(gyPQN7OMY}IVSEo+9qONTj90dYOOJ<=3B?D{{67tu}E`IY9G5}yG~ z>56ot^TaMZCudpVLw0udqKXPTJM%XtCOQ@tu-TO=i;F59^~qwgMJ9mD=m-n%;xe75 zMgWuzXXu7`c+~bh2RPrt0#8GO>{}H_riy%8rLxjQsqxH2o*GC`@j*M$X_-0T*qj?| z+o3I=uQ9r?uwY~YYx+f2p)Um*TB{?D48%vLP>+Z8htuPFnHqXT&~G?oIRGl^-by7j z!QplV=Z#Y~cqYTzm~XB^mK-RQVx#J>=BA9Ox;oGpq!wX100-2U7yqoND<9v5_V4cU zAdDyc%NCu~@e$-Fm+#9~iJt7|Op7|ms@2=9@N2ktSBY)!7{RGh?$B7=R!Tq-z~Nlq z)8st+{Ntj4G}XAFEri&$wehs;nAG!SOZ`Wa-!LThO%s@9<~TH`IZP|2q+g;|bug(l znn^xGd%@HDQwCi|xwVOCKi>IaAv8Z-pv-|u+yEC8a-aGx_%mUGV1b_N-M!$VS?dE|B|5~NZAlS#f+xmM5V3QZ2z5M{>f3}M~BQ4o4i{|d9 zGzMX&P=}`S8EA6CjoS1&{ieV;afwzLjExJV>-UQs);CF*&_v z1>D$k^YWPEy7%Ywq0rh^YKy6M$&YK8bgSzwwrd4Q!pPY867`6!Ny+NpaySuQgmTrL z%|DI0GM~i+T0UmyY)8Zq(y(fyk&Z!^sbg<*F{@W}HUDH-?|@_MNeKAXtHVFDvUWw? zMLjpPrGHfIEYo;iMA1I9tldf8GPvQg48WnqrD2-dFV$bK!##5cM_l-s0`Dun=nhQ| zo&uhTeUcDOq&wp~v&AosD0efo()Kt}_2ic8a#)loo#-KgA2y6?vE6S0X@}6@z(6Uh z3M4upB;@&I9mQNHW_qE!ALe?XN#g-|Wts$M-FAmqifB8Qe|AsNI9+DJ9dqmn)WS>G z>pD9+x|`bonE(Tc+Z?%h!N#y+_DMHZX;Sg6tk8FSS3ct;q4kRpBkf2S#v$LA> zURM-$6VN!Go%l1)c6ukcAN-l8s?)9?IX2zSZ)a{VNY%XGJT%J_LCX7l-Yt%2e>ryR z!95Pffy`oA#pUd(DtBbR&A6!DF~O0cfr03xKgYwzh2>>#`a(JQd75Nqzt%`FHH(0w zK#|eCpX?Q0SX}h@A={U=ePp3lP(5Grx)@p1O_kx-;+*pj5}vFrTisf`ma#S^RPuBayw4^&GnR)(ILNJ#*z9UtF)y;kb>OGy9zf^3j- zhzr%jlY38w3KHW0kczh0!tm6`OLw1zXobgwJ}@d>+4 zkgLM&cnxSfT--|7Rt#}9WF=SeNMIa}L8x9@9#H)DHp!(yhfpT$s>`h1Qs%ICnL$_s z9?8{b)zz#C7b-isX^p{^<3Y3F!RTIMulLCYoMrr*L3={2QyJC6#FDHm-?7D)UMw1_34pLox@W|wJ!co- zo?qzhy>$yhFf)4uApFg35Rb=*uO2x|05HR!$2qqErU^_)Jb0@ zF%~in*Y0FHkOIbT;Lvj#8gW2wr{uPM%)^r*BYpMqWq*I??BJ^a#7|7*-@bK%6fw9n zD)yL<4$L%BA;!vA>7n18ql_6YngJ*mAt&$7%)AVCaoUE4$NkCz{7%FL9kFL|g%q<* z0t=WH;1r*{?m{nxk&G+`1QwToiuvV30w@Cpw{j#{K0aX z7^tBOK}VnQ=~Fz@fjp2&V1oEy)H0@j@))44$jBy5&68perWor7%11umN-4KE?rv&g zzVpU1f`!%{X>J3F?^vZC9PG{nj0gx1l4`Yewzo5neCg{e{qki4pJJlNmK)+s%zb$` zSc%X7kj$E-DQ{(Q`h&%Vh1V)7ik?6m&}sfc4Xs|FJD!q{T1q&~d4W3J3*%VWg6v)@ z82Tz^N3M;Ms&8ZfFp7ruFNgV9|0Lhjr&zL8Z?DMl$wau!4_l_i0ZZ^+3OP!jOSjZi zseZN!FyH9VaHvA*R$E8MQH*7y#n`v+qocbOlN`GXkJ4olRODIuv-LSG#-;$%V^+B) zQ+i1(Ft(+m!*QPCG7M;jUI!M>`Z!r=csR?yez~RXEWU?aQ)43?ge6+q=V@|^@UaI4 z1<7UY?C-lHS1V4j3+vV{nLo>;azLS#v4-*in7x&*$fTW}t3ar}BMrQTkrc6NP)^H1 zIKO@SEywiuzqJ$gWSXCq{tPp<+T~*F2|veQR2e#1D)Q_OYlbi?7x_qcbD?_@3I#LN z0rkK@xb^(kSDo>zP<0#X=1Fo)C7d-Z3q)pw&JHV5DAcNe}Tx_oapM@`T29()YQg* z`M@^dH}3IXT91Kw21+-O4pKZ_0FTR=vMJnW&P)c~-qkc(0A65IzG@lhc#5sb6h}SM zEq$qI{=@Syh>CR0I~F`qAn1>jZ8MY`!8uE{Tc5CB8|#F)^1nh8@4P@w3zR(#4Lcw6U>qcXvNMdM+>k5(Q1CuYkUWmj0t&T57$$v`%*IS}+W%&i)d+ z2q-NMj^7Jq<@w|NYV)ygiGa2PSp;P5A8{WAk0t%p*3&C|Q~wi6yv><;lI(?d8*hwY zx*55r`6~({LMVf-ZUbyOY%c^}v(Wvkd6^~$JOvQMg(-tsDTQl{irIaD|ABrGpOeBf zcP99q9@93fBXQ3A$-s4f0GsE_GjIF}2m$cym`dx`@MFLQjr4k_rXE6nQ4}vtH2vhq zGd>8*9!VC_dKLQ=Jhm2~y+g%&lhJ|3u`f64XxbkGvk1tHgn=6<6`y3 z2GgOD5m7NQ<4nqPp>L@$b3zE5I1V?up0nsG4cn<(68_ zF%jc+$9En-#_~;$DZmsp4%(-){R*f15a$I94PLo;P$y5Hz^t}MaGPxtMk1`~zt+RJ z(!$gm9$;QQdK84Qfxk|I);dfBM7#hXQs!D9m4F(eF6Cdea!H=@9xN;>0;)|?Q4vU{ zhA~OiOJCfaa9#&ufZ0Ti%0B{0C>5lqvD|ilhD$;@bF&n4jtB%K`(7}y0#!Px%fZe( z5zT=8q;a;OSO9mmXg*|bW~SKL3ob-A>{Zr;@4bS_k@^q5m6fdgNHa})`;Hh=DsI~z zfTqjJ^u^O)EB#{P;_B}%;-<>Sb`EfUd48bMYyf}y`j5Cm7lFx`blDBYFo49Zf^c)S zw=X}PaFNPYEjxzG4T~pm0iR)hZjSQl+v)b!npzF8jP9FcVPI$*AFq_Vr*Vo<;cWQ9 zy_K)YH##)*_HT2+K5#yHq{LxXDxSmqXM4>4e1``5lRkE7xoon`)%LG_hDMTKgs*RR zPg*Zm{0Rlo?-Cr3Pr#~$5gbX$Tq7)Ej$B71eE9-y>I8`lpp(!h=rhimZ^~4-29?)CKOaHGO#2% z^-9oIAU!GK1fxi=T|)!1Gg?lGr6OQ?tyc*U*QgQ>M#KPv=*l0*u=Q+);J@14G*17w zs_1~Uv_n6V60n6R))W8U7UgeaZT(kDAsHkvCV&6_vs@4{2E2%}EBKUGfoS*%*3?%F zyQVac9y!;4P{cM_VSmGG_6EF9QS=8b6B83TxvyisFZ&XoeO#MFP+i+9z&*Je&Zo+$ z?5`{?Lp1`s@6HpjmccSq>kC}L5=VwUBN_n5BQlT?=r7QMgDL#)NYuO+Nag;3>u`P>crY?e;P7h*8}HL6KWTxukl5IxmJ|q1;5%gm(>m$4keY7;OS}%mB>5j< zZQODE2(X_djFK@y(TSx(!eatt4^tb1xhk}$YwH*o*iSD-P6xE6F9~I3X(c7Sb*=@N zhZOSiGqAg|5fVyDdytUU)@t;hpinRc(K9d*|I})zD~S)zAo3UKc1dwDL{)2`Rky|Q zpn=OM9^&?Hwib=OoZH*YVfv;H`}SbwK_W*n$EiPC@qhOQ_A~qhQ%Y%R`d-Wj;@$^d z-rm4V`Bw_Ug${Wh4A7I1k?nVS!;tRF^$E8nORJ+Dug{+)u~$C49dOKXLTwa{-S_Ke zokTr0{1H2Y49XE$G9K$Kysixd10MGym!95KceU`1yMKU{0B!t`kgrm`|dEVvadoZ~Dt3pIZ2AFWZA@c3hqu3qCfD4@#o=RJj z*&&nJA7R#p_gT)go*j6gYO}c_V)seUzO*5fwh$ARe-SI?g?feTNtY6E zA)hDD3~MNAj&C2j_N;^2G#~cwkp!r^VzZmTAdh@>_WAQp<{jb~n-`S}M2Kn%pc`EaT$={c51 zh^68PMuE_!>y)68#o84}9R!Vm%s)3b@CJGwD6F{a*6}{m%yhhoo3D=o{g$!?OLUph_*Vpf_kFs@24B__ z{k7dquU)XfBk!?#VZYZJJ~+Yb+_Xa#5*^Fv`S9_hmY6423qMhvm-)!Khb-R$jDq4s zV3v^Q;0`b|;_GlVdgo;_&uVTO5;oy+EXtgpF1(w$3=6ruU zP6`QFNPTR~)dW>wNJhV7`M8i!U$}4qjYgj^ssy8K!BOh@b1y)evFHZz=I$;ynLNW@ zV{y;Dr7VUD#b_HWCu*oj_xs>drR{~E>0zClZP#xsAho^xhZ6`@@btOThUTh8_ZN-j z;ORvGu01A2UZFPW&ne^4*-!f`VY*)sMtNk8wsdR-9>ATld+zF(8L!kU&a5lDt8+}A zPu-7DS-KgXgjx5qCf(3^3aeM1-hNBBCpi>SSl4iLncCib%x)K@Xe zi;nyDTJJ{;Qm7hgjcUTgcm0;%#(7pMkg&L8hpIc!K?_J5Jt%;>5-7rux!(dRGf;?= zp3_6E#BMtBI}ReJQCnNopTU9*k~h@wXgG-rkRR=azJw7p1JFT$Kyjbg4>F_mp`sa> zwLaZ3!}0~1?Pqae#=Z&56_xP=t||E58iK63qXRw#_i&-M`3Z#%_q-RDiE7mS`Xt;6 zRt_2(C7d_C(PyrpymlvTFfXSf)gRiUJW$hOd2Y6@4qea}2OPHZTEZo2EH}w;o09q` z@PtO}%rkOw)KZiJu%wpwZ|18U)IYtRkfuIAbgG*yu_|d4x(JY-?>3$4Yn6-CsrX5R z(+lw_J;h$=E6Z%TDWIo4y|(phg*8=d-+Yw5H{y)fK!&vU?+}5@mwY4nkQM(uV5MJK zH3vC5pm2UqsCyZQ`8YVeBPA4H^hHQJt^@5s&DP@ z)XTpY?5cWh3jI`4&InF7X(`+Uv?)f*;&{9f!Kuk*G&mN>_08?jX{zacTT!k;*=vze4~!6iXU>GZtN#( zd$FxYWdw zVeO4x|FhAqbhoenv1vet1(3e=Tf(B#kxQH@3hxh8HL=B0hNh+x!Z7*@_qv(4i4jcI z!vMwz%xU#y$-@xI5LT1|2PZ&ONT{XOImr9!rXJuh9*vuuivXUO!l-*s`YW3`N{opL zhX7)uBMu-yehucFlX|PBK`8K(Cx)bhe3ZRH_p)1OJntxKX70MP^bW;{!~Uo7mfzm? zgvh9 z21jo$hQc12RuCTTFpqk*=hNKW*W5q4D|e8#f%w7cg3vxfEgFj(x4F5}(gjX!z7zi0 zN0E0|sfFWCikHomIYA{xrUwV}@pRl(+}Sq3f{SwadbrnJD<=Gxt1G18(9)C`-@7+m zH|DSB-<7r%&UeP&lfQqL{r!8<9aRKo0%pyG1m!bqUxrJXsQ8>%SPSmZi!J^AX@481 z>&@(AV+(6rSWAnSl5Qh-{obXX7ydK9o>X2W=zW+IB{=#b(>(d!W0_Er`zgy}lE;1~qkdj9F0MJKtT}L$>X~&{BD@tfydPdlq2E2`pEiiQkq<+?9!hyVzVRjh z|D}KZz~HhQRE77FVQ`o3^#*M+khW)Fj*-W{ZE`YU6)UfU(`5uAI(s{d2wZ|ancBM$ zOu%BKq*{jI;-$)=^jF&}E4)vh=$1VoBO#FhYq0VD;@jA7`_5yQIQe}pFWM4qyzNh* zpK7o&QCOW}*je`+**NaQQ@nhUXmz5{S#m1!hPm2{Xz{w^)zPxnfjPa|()E!E_h#nempWm=(T~hf50N+a9114&kNkKBRu=?n+#@tKG+i{< zLn2zjn(qC&mrcN|T5B|tXw0R;Wg3x($3v;az^unH9K+^(?Fls>SDa67jEb^a@6Rz$ zt}k=q<`ia8GZOPGc5A~bT=e%Id2ul`vvzg&{(jMZhepD*)kGpnHS${b_EmMM@dKCL zex!;@WovjIG}YF+Q_hZB-TojXD=SCSJ2= zXwZpFJCYE?E}qA2PcID^vnL&ak$l!`zMif}wop#4gAW~C&Cb94f?Qn3C)|dwkm>;Z zVt`&3DaC#p&IaShrmJfLH5iF2Zo+Kytz0Ffod*29k!;Ri6LP3ZL^S=&nLoFG7Lz8U zs9}Ce&y=BG9iEaApyaA!EwqJUJ^zG=9~$nyy-KSBX0=we3jKJZ9s_El-!ZtB1d3v!zyU z{+pa?(%EGz_V)$R3&O-U)N^tN_Y7hi{=BeBYkRc4fO(L{tT!<+=&JFZn=)vBCMe-m z%-(E9LjFYEF(x)Px+pGl0%%1VEUd`67%o_G%tiwVk9}@WH&GGAWgIpUC)DqZM{22y z6_J*^uVUNGs$)iMpA@aNkuKD>w>UN8!=LH7<4DWx$8e=^B^)h$u3^|-><^GGuwZl8 zv0dSBEma|~tHJl6n@1f+g1luh%ne~*iQ4?&C<%p|% zyiN~Es^PAhkLvuzp<@tHV;GcB+wGqomC$julC1b`{|}Q231 z^S^|D{!v0S$%9dl%^jvNu5xQ~F5|oMJ!IXkKU<`gI|w2LemPuz0w+4nGLtm|Q{sOo zV*f|MdQNu1r2wDuauBetd;G8qbb3VA5bPZeuiqUg%FCyqk2PRWpN*P&ce~U5=VS$r zjI8F-N@Knc-Wq41dvht$OqF0e)+M*|z}0+gPHkx4vDJRk|8pL9`5IrrdY^nPs(i%Z zX2v}>7c|?}Qr%{R{h>Y|f5wE(nVRjFFZKLMF~zP(qVkU?i-5y+X{eq+Q=BGvtjf;c z2ed1qt?LVbo(eA>`;`R{ub@ajxly~O>M70OymhHtSZLVU3KLM?{Z?Ha8L2S2IF0x7 z=U7;4>)5zPU-0Q*1X|bJG%f@jl|!_a+r0NFALBmpZqMD5ky64Zy2mf2Kw-8nHyGnu z!`3jn(Msk%bo1Dubm@(g$*RcDs@9jC(NCQ4i58cZ(QZ@wu#&ll2JI8CoKrA?@$A+E zbGk7iBQ(K*K0bQ)icLE8{oIB1^i05TK#8Tfqot0}iJF#O7cT4UC!qRxJy`J0n>uFZ z`+4OGNu^(WB$*|{(!`9^L9`Q0xcoglK!p!os@*V{y*ub2DIy}Gr?*q6Jt5pz?J&<} zLx(~mQ}_LQT`l5yhOa6Oy9?!O(nci;ScK9g z_W9wssSHm0xs35|_V3b@zUksluJ5#~aY|nBXk1$vmeALq{fO)Qca}o;U$XnX8nBdi z_ljP-EcM+_$4-~F+LLp zpUvDOy@;1Ca;4hqiec{SBJJ_2aVmH6@Ak1r*RI=Cqzcc?_QxIC1K);#itgNb3L9$^ z4x=wTql-9+NntlqC%Cpn?5EGuTw7G(wv8TYb0n6Q=-Uu~=VIQ}5wbcOR%)w|3C zF^a{E%4E<{j%i=Izs~W__v)tldV{fV@AFi-)GL436Q6v59&|X^Puo{mPDLduEKFZl z*JkB)NF82KL_|bc*)9+sWw6?HI3Ceysd{dxO^4QqPLQk##wHlitxXyGTJ9o^KgU*w zOJ+t3Zcw`QH>8l2V_|BrkcEyoJ`tCL^@P32s097RGA|RZ?z(nlr2Ql?B5&lXzcDZt z6~^ojV^&oW63oj?zcl^y%hzqJkd_r2mrCf&4&2U`cqJln9DHm4O0C2hO2;cIC}gg+ zg$IAFCttXQ>Ls6g`&9E|P0a;IB3apI!Pt9>HDQuifTpJ(ro{%CSsvtIFqr4;CbT=hQc4wv~K7eHKm z5pIEsk`jy20pEUGoUXUo*^Jk8%K1O5%4ae3KQW%DvGK5z(87)kyG z(6oKP!_zrFo`!F8lDiA?0aTYAP`Wtu$tRxAF+DFQ&oUD;9U*u}rZsEdVnRZAwYprZ zNc(*6T8?;sOu~z3rh7EkpIqn1Ae`r-Rid%!k1XW!G{p|Z^vToUEa^a%&CfY)>uK#! zN17Ljpy8s9^5K8I^S-=8zw!$;}MTlhJk15@AvXGkQeZhvWurDhSOw6y@?G3x~|>cyNRw2X|<)1qKF^q+WAc3 z6g1JDJ*ZCO6#tgr1UZ$wB4+0OUzhNiGyZ{;d`;NQ1702wm>_I0F)^`3#Ds?ri?Phfc@%?mpRI;2b)cuL(nKp?3Rk>l@<=6Ct$iCjD<0o zm8;)Umx~1j(ge%ATEu=mP9mLT(JBOM+zN^ZER1gPhrEBZ|0BYSd6)}9TDa8YPd0px zq@*{l2eV06IrL5h^NEIshh{V3*o4nG2N|Xr63H5iFS1IwYctyT23-pqofKcWCv1Cf zt0jrT+wZc;$iuwSRNEI3)LNa#PH&pt-^#kxvMDvr^9Z+OM|gVpHxLyE@Rhkcxed>}mEEeo`l#1x+_S%CSL68oanTS8=+KVnn!gLOWyjZ( zVEPdhpoPb)5qdelZ!oVwuq_D;q*Xq*;WPDC+37wO*&Yb@{98obbg)lHBn8L-wNpO{Xc5%49uWtdaYs(S^ zH@824C5(?(XR}hAtX7|1+s>o5`av7Sn!#{;L-$O^Jpm%fG+vkKhvnC?5anssRK+NA z8fwgIa@2;q7o+OOap7W=Q}z%qp?}0P?#S)vRI#&WGGVtZ9TOI`hBBwONgU&|{JnAy zftg%qe{gVs)=dw5AzY!09?i8}`CO!QjR{)`%ukLYyzPRb8Vnxeeb=7x-rZUg5vDQk zZV6zDI-GRd$;$|t-%09?Vn(BRH#73%^OtIj z#pfB$+>UO$^~%C}_li`}OfDlz75=y1E}fB!E$HLW0)Yw{NYi z9-SsWg4e+?r3lt1kqDf)W>$u0xX3#^&g2sjbw7?m1w{CL{!B-su6MFH8%|F#Xx9A% zT9ybkb74F6Lk6NUi%F;UHFnA1piSOmE}O1w*Bto@DZE=e!ggLttE#Tw{xz8a#Cae53Co0V%g;EinF{H2Tc*0McQ80KV3bLNfO>84(0{q#*<~ob2Bkf z7ZMpOC8dO)H{x@-B1>)P=Sf4_GVVDpbNX3f9J_s4~u}KRd{$; zVZ>y3Ipq~Db;{8s&5z+-iKAWY_!RVn-62fwW4xP0*ai93mqi;$u0l_I`Trf88Wg?> z&Q)LGYZMgi#3*PycG{Egy^3Zt#-KrwEK5}6c_jN z%_+X0JnWCcp6XGTcMWta@#|R_*EuaOLERh?9;&3Ga=$2K;}ElrTrdc1*K|rAYAxlv&ge5AHomlTbL+kQ;YSjGGEr*MFC2j=!-5Jr*&4>_uI$bzhnx2 z>R1^Vq+8=6AXzKFUexyE$B)55P_L++ot-tqHob6g+OJVz6d0LJ#z)?--hp)j22Lm3 zOP%B(y#J%6<-y&%OYPx|tjg+DwhiO8IjUz*Q-D>l#)=Dx)3D*`w@>Z9;0ZwpT(jxIF>ImdV|$`|NbQr zp(drk0+apwgIVmCh;H4y^|ahtxO$z!z^ECtT3))i{0O9If_QTQl2hm1rMuTInZ`H% zd0U4;14CC8dh?r5@_d5(eD@x}$UE=vuM1WObr&}w^E3qLlE?n$DDMR-hmw@UUG#XB zloa9TFEM;d(!uHaiw!TqFYbngg~2@l(g7qSB$C4gz91o}s;N0qq`UrO9XmFQBN!0R zC&Br!Yq>w?I(9R&4Fc1FieFNpcCK@9aP^1R5NEa0R7;rJWf8CHYJb%yr%(n?U$tz? z5eSJ`HGFaf&WkQjtJ?48W~mo1Hn)~EBYq1dO+n80*0xjyu(KG>nPm_{?Th#^zuAqO zp`aLk#ZFS=xPoKPo~of}`|dn{0+H-9rLnT9MYEe@By$Dq-T!pV87X5iFe2r9N0NIXG}*Z*^3j>+u^w zORr>LZ64t%@woFhwzYk;GZiZ{IN=OIlk6f?J-yxCnl%RzTh`}CRVLJp7DQMgmKRkr zK2SkvZUTx!eQj;;CThYqH!tnR;^Qodh`Vit)m~?8@jLwQn6d%W^{7yrCwOGY;pS-e zygE(GE8jZ%1HSAZcF($qS0~+7rKOt&2LrHs5&L?Df7wk2+-^R6nDkGVjQScLeuI*- z!~P#0=+Suh;oH7o+GPbX)$&rXti6oqx*BsvSy53$SbcYAC4Io-EGjm&BGKiYvcHV zvcYZei6gl7_SY;cRNJTcGAvsS#eHFg#=`gi4Cm);<|GMyJx}2&_?)a|HaCiE zj)5;5$mu1?_a^hCb$l+U2Tv}dWe39PkW^K`+HZgwzwa5qi%p3 zOt!wh^k1qI`S%na>6<$%{6=4p`5N@#^xI+|&Pg41W1@1qt2L)-nZLWS(YiO?vJ$4( z*InbHqg4bJaRiUE8JToGWVBxH$LCu^6|$Lv(MF|I5wlxYegP zc;?N7o!u#}*xVHR>LN~>!Yu=SlemNgEe$X!|Nhl0pE2@-K|z4mn|}T*JVoN!et-qx zT$_rftZY4YVcPA`E|M1cJHM>7Ci&rP!NJvXVAs%CwHP1CV!dCGGVQ9d=bTGe2xvbXn@SuLE2*l&LV$xTaJP1$qCZTo)mDL_X2^IhLG! z?f<|yS%!mW%nDcBpuc6-)J;r|Pk-kQgc~M^DLSXuZJ}jPs`keVl_h|p3fe$f$->0s z-XGL*=B$%ewLJ`uA_8-O?{W_$^_=YGO+`-^0q4fS!8g!#u-cxR>g$t)L-7f`zat}g z;^W6B4Tzkbe0252Els@jAB)!C$9j0u5~+K;B_-R}6ViSOyr^-&{4Pn|L7{#`NQJ!gx3)+!R7WvaoLZaiohWSCc(eKh1kExTGBSt|BC-#|dnVqRW0C^X&K8Kn*M zElXU^J3xFNIY32z__{qlllEM_QAG%{@**lKoYd4_moNQKatH7EGs-zeaWHy})( zA51TU6ENcJ&>!{#$Ifk!Cp`vG^sEjh5ju*!iBy znLr$MJ=?n`7+;^ee1j$9?d8+F931!XD{TOeY--b<`XH?fWK988g=LcMt*wFfixj?6 z?0ozR@OOx)7m*D()?cBB?d3{waZw=Wa4y}8LMNw4@J0?3kFNfg^?!rcu=94CYFhq6 zzlL3IRFZ9HXVL5y^X{0F@S}gq6(6esdUH9@TuzsZxc?QMjS&;Yd}Xq(U~6h#Fw*a| zl5DDHx#TA12j40Zr`5mh3C9RRmULd0;tx%w82IL?;@gY;%UT05Oo+oht4x2{qh#?t z;(8n@{*}G>NUB{6bQIg*pvL5PN>1B)7o|7yCk}_fSu7q*#jk#P1S&=y^FDQ2_fFEo zSPh|e8~(q3*OgcyYlJ+WQEey}VmqGzK%MF(mZG9Q3frtQG8Fiswh#;p7#|Q2tb$NO zYpbF&!DX&M8R$>;o&Nc(5`@~zoR7(dm5g9oV`^m70|4|cV+#~)M@y$SFs}MPM2mQ) z{nnP3z$pZj~ z!3lsnh>qxe@ZiC1Ql1l7�@b`>z1T`$qJ9!IPAy8#&rS{?KX_A0xb+oJNeI7N@(9 zH>VS4X1)>5HR^1Ebf1HLs+G@wM+oK4GtfqZ%3-#pUqRMj?aT%cJxF%k+-3dUN7MCp zMt)C51O6O>5RyrZEbKgg4aVU7gvr3Iy$7`6KvqA9xm zSYFi2O(lO#PErI|q`S_fCx1O@~-ZR1q5!ul~yt;Fh;j zUJmUJ9yC&}F&gJ!d&`#>LLYb|j)Oy-xGoScmB`}W^YLHJ5onAPPh z$lbk1z_UF!YBtzx^eYgP)BCYrbK04~@0I``P>49ARp-{HQMXWxV!z{am6b$zt#Evs z!`LC>L4oT3>2or23IV)!bziaNIDTTlz?>HC0RB!@f^O$#bFydRa0C? z=bNI*+Kf&LlHhsqA*^j^0OBkj5EQawW4%`CneYh+5)vqu`ZCojqU)d@9WFd4VsBmc zBrQa2HPJfV#rU@oU2l>p+gR)rr#;{F>w2-(x<%i%D!I}8h^o!WTmI%w+<P;d?GPCj9etyl@f_bb>~w)N&qCnlH1urC+Yd=e!&qB1Ilk)Jt#}K zB91CKKC_kk=MR&%)*ABWUwqC!UEUu61*jw>HyrPCa&p?)?Gtm_%F4^9j zenP^Xi$pCeCDk-lR|UDhd`)6=W1)V2yFJqT<6=Ti&OVG7Nk~R}LNB(aAZbkJo2@=I z`Kj>X!$Nlo;eN)UyL-^i&O8YT;~iTe^L3KyYGW8fx5b>F=ISnsis;<2HF8a+UpCZH zGGz43=q-tA?IDGN(Rj`r4^j(c6O zu{F~i=jCMp6>fXfa4H++H8Uw6aK&$N5gSDBSU)Am6f=-Ahp(?%K^{>BIYaXo;)R~>2 z>0vYe9SDMuF_;yJ99vBzXrg%SsqCgpiE+d1PNVPBWCsh030w|~a(_gwxL36iS12}t zkTd*E^jbHJCtQ*)lNa9|xS&JNI1iGNlS@lVKr%XhVqY4jzJN~;7Mc=W(4SGnggd0+#!v~ewbX=7; z3#?lscAG^`IA_;zAphlX+Hc?oylMOox<@&{LIzWKv7jLeT^c!TJH4)6mrI7tUtqez zHVn{Q{u|+;p#1)2++PSnq|T%I4))fNEIhubr^|1Ev7LpucxB3bghtP0J%sYl>s{mv zAlrW@MGOp;+2Qk4O%}Ffyt;VL{7?~RqNpZC;()?Jugs??>%V)7 zwdI1*88r+R7dpSs+pLf3j!MKlpCK4`9Z1uVpBfMIZfA5^Di2V3*wvoZhb)8OGalZQv;LU&m~43s74cT3St5hWbixZno9DM-AHDHXbq5f+FE#Vqc=SI*0s=sN8?7+!M1YZrg8UO-l*-l0D*VXpw>_+A3L)4(4zqrseX(T7#n0J>PZqEkg-U_%? zZ}F$)fB#=!Ac@RqROvUWz;(pqDrrE~2t-hL`~>*;7abXx`)I(m@WDGRHy@`#COd=F zG?}Vm2bQz8=;i5d&gTk*#LmJtFggPRb`~?*+ZSi;-vj78TXZZ7WmtKj%q+9E7%PAI zf+^c|mA>}m<<=n=W9aGfJ8&zFj`j-(xZ+t8EP{c7{uKs~gP1oqpy_E9s}vEOv#l8P zi}yZI=Ai70@}_>iNDKK%T}8HMSHtB_Zc!-MQ083*LKKvA?Q=H;gL}}X0gMFt*d|n6 zlCWoq>r)4KlGbIh+>@b0*xuDhugseF>z5O(keQ&8kwbfO>-yC~nG?^Bc>)4R z{mZoXzCx~%l0q{=pqOVrT1LEfK*I?e+IswpZ`2R6Zk_5xpe>1tH0YWDs;vKJ-g zMXbyK4G_8Wj*`m6ANQvv!!bqN6d7J)y`f0n-L*O1UEbA`nBTMqzTWLS6~*?Oj!r!O zULdrEjdK}UfT9`X?LB#Hbt=Fg&vU2~{OObWcqO-!6LPy>2zT#u_Xj^eb`VqJb~;$8 z^#-BI@SLBCzkZdcr;9xLr}eBx6wTx6Cq7Ziz|fFpUFH%=>VKU`XW>GtE3EP*O`U>? znM`;~KcUQ-g?wl+IpvGr&=E5@v(}e%+(`Fwe@$g8@aMvP4)2+RT-&( z%nctt?a67&R9s_YV{#D@5ox@W0rA8VFjD{n_(Gdy`O7+tk9%pTU=@qkss4hRRG`y@ zYJMot)sSNM)_Y}ZHlnpCAmCXPM*%x?mx2u6#rH)qkOU&|NbxK1tQ_~oUA}hp%XrE5 z!s&h$0qeqPjLR4a{=WOFb+}pIuV+_3^?{|)fUlIieEY0r7}2HyA;i~A2Igna{&jcL zFe%K;-oJP69?iY`Ci7Pff-Gg?y&G#wt!iSz8yquQ1_*z#nwbnn*G%F_iEs6Oc}ej{ zrPOk^uiSx7m-!_U*+hO~DS`X5aK;1}ge6x%>M!(hJhBJO8IGvb6lzU+>hBpR5VX5f^i3I$K@RN(jW2m=1jJ>-=%9HIuA5?5;v$;RM2hlv6hu4sS~rfOlW_`mXM3ID#$X=@n9moG;b@bn8Tk{KqoQbx+T zwP7Z<_pTYL>Ui)KBPDe0?QMX6^x*t=u2@CE#R!l77MG1t4XKOMXlcQ;AF;6K?Zb&c z33-@1Ws6?R^#0d}SFt~~006=lPYs8bBpv3%Fcvac%m&k5wvKQ9E+FyrfP_R!RaF(P z*yIP;dN%qQ1Mm)>E#uP<^=UFG5WbDXKvBG=z}V$@TVgjKPvbGR0l|ZXu%8c%jD6rV zZf|2iLWHDcaCD_7_A!(9%YW?Oe@DGeSbQMjmHL?18{%sA<6t~y)U&f|A&gONvs26$ z8|u*CHRyAquo7zJykKJsra1uOSq`yqw=V$;B{lN10M3NEmxy1g5&%J9?7n@-Rp{2k z>A@co>EsPP#y^9g&`{OV$ACGnjh1Z>XZOVk(20t6gZQ1Sis= zY>fLeRmxub=)v>gwwzgMAa&8#)MR!l-UkV72Ksjcn2kIxE}&*04!F5GmcJR-ScD6+ z!{OE}s7#QfWBIQD!~PD706%}2n`kIwS+TXkXr)9`U6S$piTvi~udwhBex=$C;@F+$ zRhba`d3dfFiElNK5|QvY%}jTn`)Y`)eJD|dD#*_-wOkb<8)ax{a7Z)Qw@aoz!M>HB z|Do;npL6OaiO1xO5|93|19wKKyRV2c9uN#Znbkon%hRI@I(es=#X;Xox;L!qDjfX2 zyCgy$@R*X4`37%^YII0ZKCunMwrhfCb4-} zgzM&((W>z58Hwb~&p88Pf!Yg%q|y$i&1yNIoEG*Oea3 zec6|zpiHpA(9Gruo(~vK{XveIUcMx_Q56o6+My$w8>->62{)|&(6gn-0g57zLrhXq z?T9&HgO{WYa-xCGfm48_vqJvC!OmFDbgH6>nXYbf7TZOX7*lVpF@9#Ek77SRIH1@b z@!Vl=1uY<;(-SKO94dOXat?!ND8Ag;{kAxWV}r9D1s&tDzPR43xQ}4_0~L zWI@BgFlp(4OZjbj`@DoCxxAcU*`V){fLrs4$S$WP=&1(H&m?J*Ekz%P@NB!Y}-rzd&XOJ<m{9^ds= zWduiCeRKp34Gp+VXmJJ!v9Pm~JkzR$bvBUFRJWPFgra?)U_ZEZ{h)vq<#$t055WE+ z4zEZqvfHw16bBbme&%|fpwL-A>C9%ape)F9$jK#fqyX#!f;YQS*O%m8z1jr*EJ5;D zQ1*dX#AasA?fl)Pr^`ZQeIv#yS^a(&B z5aBUd9}AR8@pE!ZiQy&^5@b**{GFd){(+2^b!R059RV9+$RAY-{>=z5reEbyq3LpI zWV{CNIx*+xL}^1Or<061@XaH6f!+ErB{`YapGqto&goYlADD7tcIM}l+9eBDW_fs!lm(hHPGKwRKVEM zqqbHM)03Q{1E^(Bt>P23ffx$%k#>7~whj(AN=wZT_Mf^Yr@_3Pk?~2q^RYNFFG;0A zXDh5b(VXX`Q-|WjuPLejnmrTt>FJ!I#!`# zKJ+CKdOYM9K^fWzdoFbm5%ghi!cQV`X-K)oMvYDPwzZT`((aMuEI5M-X7@o`}ZiTQ$Py1*t#7T&4m8s^T< zrx^J0Yok7*5)%4Z*Cp?hl6J68!5xATEHvS`BqYytn`ac*mSr~&orHxw!FrVP@#9J( zSlyll=VYi-Xo5vxnmW0>EFdWOkYqh3d70G3L}$p^`KY+0bdQ!Hn3xv zMn{t{WjU;=zUW>9^9~S}aSN*kFUUHdsvwahLDrA?8hLtcpx6PPkhH-fa9|zXIH@8+8P)!ZPFjF_`EW8)JCa@{{KTy`ituvZAA7 z$r%{wx~p>XYPx3fgBN5rnA9?;m9B+qd>(UgS(&I_bKqBRF$IEsKcIJ{G&Uj;=ztZ}6tlc?JU1oO+g*;qQ{=jY|dkb~*p0wTYwMj#V00lUjmG|8$*9tKX1Aui|e zyLT-ub____kiHR6{Wr-DIWtvHe!ydj9-N4aRnIq?{jJ-wrIc40&2yR|7E#H@R+sgy z;9u9&@iEo|097|8^M;E^@1S$A+phdU!@WsF$R77`rhydo8`1t^U#91LTf~mCM7i~% zw4osl&hFZ3`pK+~&J5C*R4$@v2PJ|n&jw(?zRck?8GW!Chx1@OUa6)g{us~4e54rc z>%wE0*dV`Ie2$Czl%3siQLyz?SD%f49_O8!CUy4|#_o)Lb#1=&(DhJrVRG`UiE2CW z#}Ck7URxRxeT03oE;HqFw1`h`X|c$mU2i=L;Z;0&bpLpL`QgKruvZ!yG2nq66A+LC z_TAt=OGgzE7M7`8&^0s^4tV08My1m%bP?c10Zr`9JC^u91u`;uUEMLlf~vtHKC&H* z0g7IAb2o2(6cRdux>ZQ%=9e!YfeZrMssRBYh?Nx=7abO6p*F_h`la@yCP`9OM|alg z{4@lBFtM1me(AC|HjW&rS0rLpfWf=sa7!{fOT!;Xr7mY&<_nS%Kry3S0#@#mc=4#S zuz%SaOd%APfSoG`G9QDpQynDZ#`=0N=;i=fHHfV<0TjaZ-w0}Kk$S5r_A0Qs6&5!5 z-{8)*9u&HWxdsFtNe+*iT3T+wgXVSII{?W-nD9^^AhR)FHx3ce$`tca64vHnITp_Y zeM7@OI1!bs=4NGZB9PPhryDJ85uqxI@5h6O(5@@P(1VaI{k+MP54!jdUXu__=NgfNpMLaZRRggzHt7voat+HpS5{1cKeG#q!OAhqk3`Fri`?gACybUAw& z6p;Zgc(WtX2yQ}8S9!i<7-zSHW@Af%(dB%*>BxvO4e5`jnY1*JjeZILySS)CKrk2< z_EI7yd1f9T{^{H3+S#>vP5!B{@QsQ}Y9_%Kj&vDeK}wIye5xaW4`C z;>qKc^6Htp!63EcgbT!EuH)Rt!&@KR#>WW@3p+U6rHaqb{{>aPS7UXx?H?2cJ-6}3 zMg#Jte{piz>QP<`Lj{gGId%|t$JNEf+kSrS&(lv6WYzIX5!8As2tq+kErEAC2Xfqg zntlqCi3lfz+x-Z3Dq91oDC8t|R+NSS>Go;_dVZ}}rQpuYTT8`(C*+WP#QaH!y%qr4 zC^F}LM2_XZmZ`#tEoFbuE9`&QyK%To-v`e&okGC#qmqgWb|)N-l9EF~R)?(*#KbTm z9Q{~aUS9siE;(No@1FHHFR%om6eAQ7ym8~T<9_sGauBM8g+1n&2ViKHdQ)7i?PNLo z4S8-+5p3>?2?EDxzC##Ss=+VQac|{~AXr?NTg_j=0spJv>gq3EpWOtkEVpE*Y0f7o z#UD1Cd@s{(coz1qes)W*eMjL=0+*DYUVCSPX8QWZ_IwFcnNL7V)jK0 z+k(Fe@+VL9msmxNBaWM!X+b5~PX7E7DnLPD1Bb;Wk;iudU5DNTh&3R5Q;5rk2}c*e z3zZ@>Vm70oExQXU!M`_3ia#H6?nQk1L~;Qev}dVh08qK~G$#viv%3)Y)&LX=XL|+5 zQC_~-ivW4s!_hH4YgVRHzP8K`3@D2KeEKsDUt z=_fwpsai4w;uP!QEi`lv!iNtzz>E(-{SEtd1e(#_$|fL^MJ8zK`KejQ4v>GL!loiO zH)qmIv@`EtSojHg;>Y{b!-Y2T?I*|U7_F~jcq+o&z#ddkC>jgxl&$ddXL7wnT~SBfYJUQtZe`IQJfoOyz&a|Lu(JcU z=Uf%R8N-1ZEGvo&0_IAG0p5yff-}?8dOC?3N=i-iUF8le$%v51NcB}g5LJ3c0j|gI zk1Qo(C|M}3T&W5BJPtGBy*2JS>m}qjg4MLIu&wtCetpW)RbZ@=JYhHSC(Pab9{JWb zQ7ruFyv+c)-|mYN;)^hBh}g zJ|f2rT#CRYBqU@;?TF!3zyx)<ksli#GQNMzoxq$4T>D{Vub@ z1m;fr>dww;@Xwt8;+^QTiRzr;BD=$5bG{n%rMLZAXT3tO-Fp2hgGW3+J^T8I98jWj zs7q+HaczLb-i2HQM08^Lt19#RSIFE(JM4Es+R7%v%Wr5Rh6;Sm=Ys?ywh!%P63Eb zzE+(uoBu7^kSH=olLpSk4N2VxAfqnY|Lc z|JCk9I8~YY-V?#v?yk%l)yqeU;yMH=qWAUDX3Q&UUNHtXhIh z+}ygh4H8Mr51waL{kjro(btEUq0sS^mGuGh43WA%Ef%djeIDYp)f*S}_$Yc|$VQd# z4?zj8;rC#$Bs&V=l4jWn;nz!kHGS!ZS_f+<7=yya1V5gO{BF%Ob=$3Oh=8(DvRF2UXLNL?)z&BQeyy+&GP=q0apz$7M;YLItp&ZY*~j>buFTyXNJA$ntKHBJns-8W|mv_d*B;Whl31UDJag4 zRXD$UH&!mpMMozZCn=jTw=z9VCc|-$RaA6aE+aXVR?c$Z_d4t{(%C)Cl+8_C{6-Md z7RK`I=?4G$7%mAHb$C@j`}60Ey&0L=>)u#coABO&-&y324HEg#%a0P7gTJRcb||A7 z;%LY4{RG+~5{fi|E+4$fxVgELrV*z{Z**Vs@}Bo=bngK&aOH~d)vJE=8kLqS108-3 zU(&Lnq24}N_fF7l3AxV?;aLp6HZd^~E|rJ7`z(FRfcvx6vMYwd@$xe4pS9vAx`N-n}ZV*7DvAI!oymkzzHK=?gr=*Nmxws7F zlR7z{ZtWuK2h?j9a!WB}CD9L$P<4pBOgTj0E0Mk#-gVXibCcGA`sKt?GtEmPBH z4qKAoCdHNoN}`J(ipi8snH^)&UC+SEO8erVlJGgQ*PpphdTtco^YfWA@P%28dKzxt zJTh0cn*1wIOk6iqz}tj_oeNYtrIIaSAm!jtBm<98bnV4Zb4`s+ck-Z+P6iKSGUeq8h79wn>ayJ;tZyNRo#?M>S27gp|WD*=^|6(h#$=TRIdsKoW zAtQrM?g|A3MN(<(%-$;4b+<;a=#RneNFqXmiDi|^;E#UKl?wl&{R{;R<>C)g{aM^c zd#6wl@VaBu23M!V_yz0{avybPsX1CN^}ye#jo+&)DXP?F`Ka;+o$LpgBnM(^flfcH zC*ksghD3p3w{kiT;%IRmcGOq?#clt5HVq*TM2weudV0=pqut}iXEaeO{vZ-eJ3D@u z8sK0^CaCqW=-R1gEq)yTE$-kF>6j}m7q5nooBDtZKbPtN6aW`@x4&C~rWgh$CJ4cQ zgRq7CP?uwpaLul$4mCCH?FP1m_rki*{x-%BCL}#MmK|E`425-rels2G9V;^Tz`)Fe zgtlWw9>+a_UgCRl$;nSbn9eIzUp7c3Ac{Xsei^aI4|a2FgVzH1q2sgBN`ge zay8P^(i$nVD}#IlnR<-99i(U7vElsnW>mdQ7ri9~;Q8X8{{HjLX>2mVJUx;xU%tSf z4uYqHpk62l*)h>AHde-*Udz~6r3%#3N6Qe$tNq={&f2=V!GRmIEuk^Yy18+a=jsw5 zMxcLQrBDOvrSci_a<>A4f*yD5GIYnyS4GSL_wQqk^nJf<@>4i>YK zlt4b?ZPyCY|# zp=9BHGT#9c(9-iq*87#yW&6Zc7TaUXRy;oGwZ*?zBrdt$uFBN2m?)-TfsvV+nMZX1 ze@!ZGZnd--2`O-!FLF9Px4iS6M#i-K~44v`eU>J{;e<~^Q2Ibn=-;jwTKsFwz zLgK#0JdSvFlYe&uC>$#+#s&udjaIbB38aA3^L{;p9lSo*zQeV$*Oir29M%SAIyyhy zTBP0uQ)}j1FXlhfMu4&TQMp4P5&OxTH9_UK5)v;FCyx~R3CEp_Qtj5!K*OC@pT`4isk7|%F5Pp} zq3=}_{Nca*e`~q{o6LhB6eZK733Pa6!O#_64e%>o!?l!6mrfF?*c^G~b`z73bz>E4 ze)TUtB+2X6wZt7x&>iXDH(-i*|kPzyLnzL%RN*YK8NkbzMdAXPVvMWhqr) zytgM{I#m4nb)9O--CtwC)1C%zSLdyoy*?C-Da-209xB1vFFRuo!=s*MY!9 zpL+hyVSaM5)M5J}F77msGv(1y^mk4_j<*6QAj@R4uI@z`3ev-%D22;Eo&7sOmX;VW z+SOGJ^L<^=gaGB-k7c8ws6b_hOyE#9iaKG#Arf2}Ah+jUiiLsUGBwHO)S1hWU3Bb@ z4V7}4{mbH8$X|PJc3rRPx)8gBBk>yb2JehtMMZ_|5`4$I{O(`AfT3+mzR6%N5RHH~ zap^N*Ie)av3Em^REgWE-i-PV0K(~@o@XnrD{Fv_Psf2vSoQbyf;hun4L@6Ob+R3R~ zPZ^RLEcq0Zln1=-gJx##kqOp(A!Rd^R#+4KhY69;yh;pG<58$aJJ-jZNC*@^Gc$X^ zV=Lc$d?msh@9c1%r(`-+X1sFs&Ye5*StGFg06PjWtOS{B%MT2$@%25W>DW`RTQjjV zLc+uQ^4tDxmQ|V^MKuAmk3gr-fL%lT(c#lWJ!&M zmUeEv%G~i|X~niwl628)pD$-;R4mNQJ!MGE#aKhw+|b#YDdG1T7_cwN<2wc=M+U{G zNm2>Qfs}2V`@A%E4_Ehk6>5b1Rv=T80;P|}4zBa*qGDo!XA^0TnUv8bH^gEss2k0}c2 zyV|+D3dkQ41;r>Xh!Z9M8wi653DpCC87OODfG5D;vrY6_t8RE0Cd5hLMFGlR(HBzK z-({jW?$3@3UE>@386G0J{<*U96TerXX+-7vXApLWlxMrQQc&+}oMC4S-<~f4S_vRP zG4rbPMbiYA=IKj-^+0=1+IEt;-;8)--A$}DBTY?qxIzmH^Wz9k5#bc-a(c@u1Tir8 zkwW}20PUY=0L_**xH*0^?8t;?@KD@ ziBrU@S1H-5l^4At5o-)}CHiXuMv< z^{=y&0LJ+0qHsBvAW7l=FiOTD&j;ZcAA(W(tG#vtDd5kXqdy*sWUG=>@~ zFtToa<4oev_V;X*_cN!}+4{l3b+X!Gsfx4hCx6t-?Oz`GC=s!fHuB`@HpHckGab%) z=HT)yQ`vY^xf~C-mbmC>{I=@oBt@uOY;C01-{BQ`_wLMLkC3dk#OHZP_86JkhnWKh zvf8~-VPFoNV#OeK^QX0XNy~UiyB*hfBvb7M|NTpa|LfpT;xa*~ zrZx%}0whqt-XU&m6#0I4kD!$cr0QsEZT;%&8_J3C6%)RSfQ4s!bMq&==_bf&&iW;c zD(4&gHt2kg&p7hn<<_yg`(uc6ug=eiArsQ{{Bm1|G3gihQs~9+eYMa*+)U23hTza|1kQ_|ML3Ofgss!|J6b zWAVQIS>pkIZsy!OYbQV^`0VYyIikTcp0nBS9kY+muUdL{ByK(wuw8yH?&E7owi-1@ zY#|JhTP;}H#Ka~Xh1>QTW#9lnfARzSFSvbOoP9|;WV!{1CmS1^q|Y%x9^vETgSLFg ze35P|NMshakw9~-A9iY?KT=+M0l(=0>(eLv_LwS0kVvP#2WyK^ON__AzD7hOx|;<& z=x5NsOGp%9Y0S;eLN8GbV&O$5gOU{&myOM+H{GHaRFXIff;ew|CG_BbW;$fR%{}{# zpaq`r$Gx2p&Hz9(vX7dBdHqOEYbL5SnAAAhMn(kJ1P{R=6rA|>NnKV*c*=zlUyz#s zV8;Ufgz0R=D5hF!l@2Bcv#Fk+?yI6!ZGRrNBYlgS6lKC&-cy3n-*3+G$o;{y#N{6j zfl0?cA8odOt#3B*R_{~2QyVC8-iEIh#Xmo2^U`!Hy+tO3xoW$5M9f{`GTJ-0I%q$i zJSe^1UQ=O~qOO5XHbUrZZNGjuxS8)(XM0P9%J^G;FF4^M#D6zs=0!Uy?6sWh(33o{ zqc~aZ(&k277VL`Fxs;16&STGr&Bs1IQp+>ieBPTLg3terxRd2E>y|TVXUjYm?liv# zc3(S#<@Vc4m5~FicaRXNgGFFBbp;Ip%x#Hit^m#;c`)Yn2@dYf)or;@j(0t`Jw1v7 zJNp*cu|>Z@OdJ))QuUChJY`5>Z}-kG2uf*&-dGyQLK|KaZxyc51!g@X1JZHvuU$kM zva%TSk7LQuJ*Jkkg?APvcbBs>fMY-bSy4Voqy*@Me*O}mNuB{?yOQY{1@O*-`K0`> zf$*5ufNb$TEkftBm{3f}z$Ra7@~y?!TrYpby3!lP-M(l%W~r?SSpn2Y z3|y*7Zl3-%9@rhxb*uXrclnXG1?+>JMk;(0+`9eMb8-;g%_4Z{#7n>8ouWS-sS3^=Gqv76VCuKjhP+WT4Skts zYGr=IrM>5qHFo3ZSgHNB-fqWxrd98&k6<9u67{<5<;%e{5LyyRvi##pGjz7!KQfXi zjK#!T72DuXk;sDX!JpLJe5j%|wcQfRw7ifwv!wL;Of0SS$MLyJEMM9?kiO-Cm~xVL z9ECqHsQeaS_XZdHw25IX4{SCy+M(g#kEc$fLvl$#+^V5{!MVFO`NaK&^^8f9vKk)K z_>Z4IPbPJ3tj8>BRGNMy2h)b&@WUb^2H6_-t>AWj{PV{mNx4#|g#2C+MI`8CrFLd= zm62}PT5}`3gzTinj^mrZeqo&icc51kXx!4&$gJ^1`m!N^c(5;+35U8yQBl#hnu(QF zc1>_79hjHULeeQ@!HtJ6IujVo#VjzA3xG)8$n@f%+Ly?VEhiUJCe&?m84vMJM!LIM z09HxxehgpE7hPb``TltC#$}ybSEnDdOA7X2&B4Rq_CsZdx2mTrXW14`5E7#2hU!90 zNchAq(&=y}5cU;5LSOuSOpf|qax%?Jm*EntmgZmpoY)(C^S+)$e7bUj_a5h-+%R~l zo2}wb5xblv2}NR0Ss2WC_B(7mJ=x`dUnnjAL_b<`iP{k5q2IA*6b+P!;d3VoFwf=<}Ro_b6ApgDHl~d9R&K zo1ZE1G1q-`Fgd)2d|oKALibL-L$9(2ZtD=ZA>o1UJ!HRkNz!+K+S%V9N`~}wKtaiT z>T*^}>T;rn3*`oCNlEWBX6f0Psjv52UT_Q@9NsV_M^0qFTY+<}O7VvZ>k)t-;mdoL z&e!Ep(d!!nDxl>o(ySR%%9C$`69{Dmlg61FfWiRA)YYFg@TLE4g;QwU-v`Ad4vxh3 z#*V8i3xf)~EcHD?ubX@k0}88;+{q7T15;5yne!^2oolpD{0qnR_Sb&zPCCq()p+nbNM>*5N4`?;dCUJv@A`ULePU38GyR zeWD%lO6Ijwg@;3B#p0Q?V7ZQZ)wpN61mNs`o;U=~=Mi~=YipRLYtVdYWYZ#T{m{=%XV%qRE|U?o@jVe%tn^xn#?V7lip zD4AOfOW1V&v9}rl9Wys2rTnTUJVV!qL#4e{GAS^PA}zIJ5?rIF?gMtGw$&(ghs`Z<9meM7uVRi83)+;}fnao@I4N_&u zG9LGr#uSQxaTIVA|oKhnEk@gE+_x3P@{H0;(E)g2epl>PV%!^-)yX| zY4NMR={eQr_hPm=nxlGvJUbv2Ewv$#_4Y>9#>NM->o=;Lq|;=fyn>$1*UNr;-W$Gz z`f-*jT3>f}Ao5an^z|A2i)Az&W|uo|hBgYmFq|zTW;^BJz#d#Rz!^^Dzeff87i|&! zBD#`>QhB8}A|tfBI=46qUmve>2dpG|k7H{|E>mvy0?n1~|4W zX?Ltb81VJ^C2zn_0MP<L8fQfcN7y7^WI5MDgd*9dC@6UPP28uV|!FKGZUoWp_L)ezyycxdkoZMsZyjF z&V%2+-R7-&goUMW?b>N1Z%bcab6rw=jK=q&ZR8sv-PqEFS(UzyEzB#(1su-w}c zfh+vCI-$Jj*YF>xIzNEcV75Je^dYe+9>dYmP{A;esY5tL$L6|&ktmBjFfZ;{>fJ5f*X1t|ywr*qnRwG6-4TMZ{IU0p_Zg8`>M15End z_76hB!W`yC#=C;0_nA6&c7k}th#;@nPE8echbAW`qLZCfS`E0-(ai3jI+#>q>=dS`oL;aU|F+G! zbTl>btPOMzEiu6zX8vq#%v>6>?2@As^PG!UgRyxGN!-$SmzoCu>q{tgXXY(^4i?QS#ru^(^hXuZ%{PMI06#9ClWp0Ci3@ zZ>1UE_+HnyN)sp*E39nhzh8+;wBsz?F8-(&sFL9CjxD|4QCoYE*IChlnnkD7C3{P% zIeo^9?A)mPCC7k?DoaAL=xZ`}zxE8rVQcGq=2Wc++4!Db=hH+;U;(F9F3)v;25mHT z>r1c13ee?Em-MC0P0yYkkwgDBlw$$Ar?khd+l|JPcF?uTaZ#e**dMygQNEJR#3;&5 zkfaEogK7NZ`zNrqGlQ8_2P;P4{gMZLkY>#nIPpyvT-fvN4Nbt>V1)Jv8ArO)<%aL0 zzlPyKZ>1%q)&L59P8*}c`id7XH4P2dmX@a0Nm&oZnNq-;4kcCL{e(xd*fJU!*fVVo z>YvW~T{}TFU#I-|v6)6@P9pM!W8be$k)*5n1So&LKuO8yto<#m7VTkpPNmDw4pd3 z`uS*Ab+CMf73;of5y>h{%d`MR*=k3KvP_&8K&pp!Ad zOl5FrXlZGQxti%59(qDbN|EKP$i=8@LZjX<>X{X#M&cFfHK2eGWJaV=)`vlEqh({u zG#yTMa4ZcCJw82-gUUhL4yjwq_a^TbY;4W>FzG?q5xBKkzdFGe2Xp6y7{n1h^+H#z zcV5_ZC~1Q5{@#`)G!cEf%XTyEKk(gd+PoDLgMmngi+b4i?*QWRLM*|1!-z5@sH>$A z*J%JD+b1JXL#Se%nNx*szrH|(bFgxBttB}-TcJdH@cEGQAh5s#6EZ~$&eQIO(+IdHlpRB(1^~n?I6s-|o$unVrRHP_$sQ!+T_x=r`UJXnnF}Je1$b zW-L$0qW95Y!O@t(Lw>Q#Hagl&rSPD>fy(KinL@Z7$_aL3`KnlC-k&A9{hZaR`JF`N z3a^}wF1X|IRXCkZ>^Ekmyu5YxE9Tk!qML8f|z z@@33=LQ9)0oAx7^E;JB&j>c?3G>U@k!;?cFD~Qnl;vAwC;BcD^yV(_2H(1O5C@vUk@iepIGWQvFYoBz2LI> zP(Cjh89Mhv{svlaiGx-B{uO&Bt1^FDwnNoh7W*g7kOVCoXdd-nt(0)WiBDkt)vxQp zFAOl}#m^;K3#F%eIZt&5JT5qWFApoKu=v_{SBL-WY+U()G-5RQ_s;&Bhk?Nu?1T=Rry>SL9Z4^nT8`mTK{19i`9Wl?%R7Kb5T|e5}7sJ>UUhFcQ zw*={=T;MNq*>Ch9LA~}L#=v#^c*tzgf;YaehJDYPhMT*lyF2r})s=tD_X&M->AMxZ zeujk}<{&P_`P-W^7+;Vq z^n0`rGb>$Un5?hd(*PYr7N2b{qcj=?xAUKlISuVzSE;+qqYi6zb`L1 zIZMj=!LrNT(z2P8>4oh|WS*6wib}>+|C@Ye)JAp(VjaJAlr2{dE2f#d0%zJ2UUg7p ztMQ)YVgHT$h+jrac({1!;`xUNrp^A5k&)B~hM!q$%^`eU%$=y$0NaJMV7oQ*1X)>` zP`-P>YCfg_vy5;>5GCSElJ1AobuJ1(YeNH7B)6j&@x@yy=W=?$4hPX<8i9^p`q*7E z?KZ51&0^k2jp^Aev)_z?{}2x+tUK8kOg*3mj5BB}))PouJ#qr{^04k6J ztTanhOW?xL7@1jND0=aB8kb={#_uH(+}sS~u^HKHbsI7Ih~VG?fGD9Z7Z8v;Q?RnJ z$@%>hc4DQ4S>YSrV*(W)=Z!}@$LkHnW&Hu17_myeME%OY-!~T+7cCylhKcAtwOgA> zP5nuVP$aht8A+3GD^ceTdUoEMFpD(`{(mV6iE7t`9aOluiC0SMLFiW&gjAtDZ_) z8d6GD4VS;;IRS!HIc$O_5M%*Y|o0HlbE zAHH{NJ(0#_vU{QT5kxm7_RIe5!oVqMqn_cqB!$cX=uQvSo{LY1C?NS zX|Ep;A=J3;-AkqYTweaxxF?XYs-LGRPH&C-yrv4m|yR&p`p~OP>7(4Olq2zTuroy(+8Kj=@zDX3aOJamd%?tGoOc1Rh{sB{P==`La?Z6?I+4x zYVl%{0OocbQ#swX88;=1xUQ%(itsmmU&ONjxp#6pQ=gj{tnTlRblmQba(*T8mTo`x z^bFpCdgE*p$?}*y!%bsNsWC;jJBWUXC&I|I{h~IHY_8VRY(bukc0CE_MRG7ntt_0C z9=U~xs3JPhQ_N@)qFXc_UVM^N}TOBc?Fbqln#se zhZ`34m44}22txT+H?*zkW3$U;0Irsg(nC2({AZudOcmESPCaH!p`8+XS>eEJMY z99|fZ3R0c_5@85)by^Xkqo13m7H_^vO7NQZK9vo}PC3scoI*84Y#?Q_kcImHX zVRna11ObG+qFR7m)h~Z;j@G56h5o`fF@L0zvw!#MEw$T5gA)IHJVm|}9lAf4|MWb@ zlgW*5`YQ}$DhkjVEsDtDYOGD9=IC$sy*V{3+>y;~qGRRq*?anaMh~}Ek1_Z~%>HP8 zou{>`L%1o(o)Onx6}Tx`6m0A3`6;OO_U(b9s(wee{~;vws-P|CcHees_8jy17&-D` zddWX1zvf*3loQOeM<7cYOj&g6+78t#k8+3#x2Pp)cEInB5`(}c6P8z&eqT+ z5i-{$jVV&4hdO6?Z+9^Lt`c&rL^kZF_{2(|wUk~tBfBho7x#jEjs-dR+cQ$M-(n!KiurrUm$GAdAS#$e7$De8}zKk00#@qg+?Lp~3bN%AO%1PugC& zNyVLg@DhddGnT)Hddn?Oox;icIsfMYiXH{4E+5*?-jf3};lPhk1X!^7qW5|e|M|z| z!6v41MjE%qw7bUN^}5!n91KqUHr=JNwPxgy-*d%gS4sNSk&Y+w`7GlbshKP4$NC#x zvwpax(5=}JxMb#WB;&}$v$O4=>}G}VV>nzide^u8!HYP49bDCXhYU&y^zFxw^8zL| zg66t~a)I|4ejerEKzk(>9Gj)3R~vT^G-TW-X2f1SDIp>buHCzz!>$rzs0L%u!1j%Q zj+I;SFZj3+VN0j$T_q`ny1pSHh}yVrnVFq(AxEVdrYtNNRb{=_)rICsOk;Ap{lNDV z`0*e_wmqTRyODiQ>sRM2b*rVzucDpyx%`>`dRS?vcRAxw`zb!<@h~l$dzT7}>6zu6 z{T+1FubMCC<5W;CJS7v}A?EY_%_u4&^2pu2Ec`7s;pbkx`t>8`(!b-Rk9UJ?2uM}L zOxv}}6cdgEK~`WCHP&;Ar2YKkN1n?v1CVM4O`?ve`3uSrop~);j&p(x4mw++28kMBW!d^~+HSnEI6Oolf%HE1_O9;wq*D`F2>yBtN|@O_RL4cE ztY+AAoQE1+ZMRfD9gOGUKD>W*&TsI5Q8^el!ErtcOsi?F;Zq!VOnFo7mpf+DY|OZA z*P<&bgd+>x6lU^dcgfcHuF}6GL)wC?N?Ci5KIoknNrOFg<(CzaH?y;*G2Gau_qBfl5k+c<7x&7E{ z-x=Vr;^YrvHgFe8sJ+#%oeP%CtdM?>v?TQHc&;+~Q-JT3^2MoxNb#cH@@6Fe)azP- z@q}q%7P4h*{r;yTCIe5|SIv4edPO|fq<10zmVfsb>lv>E!APt^Tt)E}O0I`>PC<0i z(bCegh57TBFKJs{@}i>I5L94P_nnqgF2TS{6(z^o?B_=`4)ILwjJmdETVB*4mu|u3 zGcIH&AP?47{PR<9gSZZYl>*8ee-@FR(uBeU^?%do=>c8mlqU7BUOlZG{yF0f*}uWp z0zjmbyWXHmlht+~*DcUdZSIgzC*w0rt_Ww94Up4eVfg~j{r2tt>@=$5_xFla$c;tj zI;Y0D>z4!+ztD=K-1WA0VgfmyA3nVD@JJ|hrR9-=uT^yV7Lo5z7rQ~sA)Qx% zi`jOcWUlpC8#+(VA~CLtEW9$tsTqrn437hl(&FaL)HaP3Ej>Leusd(v`hr7W5x!B< zPv2N4qdaOu#!nvp42$v$3Ql&WQ?=HkDTl%sm@KoduYVJhXLr}S?nxC>WV--aV_uqh zF95V`*VGiXrHz}u#?Y{>J+5RmGPDk15s?Dji9Hmq8RNU#LjXh9(#~%P)K|z;>Rvlu ztatm2SpC)t*}A&=3c}(a12V0djEV5b;o)D$BmPX@^LhF-+iH+W-kgXj?4cNVY4evy zGtHT%D{+yt*oMT0br5rO@Y!DrmTNwA1N}rj1(lBPl^~y-1(C9FIrHoo=W11_#06Pd z!y>n8w8ncrwnIilB^@O7%7l~=zI4oy!6mQ!XSP0indTW+_k=n!;yg+mGmx;~8{ika zqHLvR;Ly7qO+V*qZRj&X%8~&S(@y%}r}s)1d;yi9F(b*=JQ7YV zQ7g;w#~WtE*ows(rv={MHTIn+*DhODo=X|O@YwkU?b5`rj4B$&{O6ehmjaDcE8<@n z#aBojpUjg+b;zo$WuVmXrc_N_9P5Q+UR+^}?`&gvH;Twd0J83^7hXzxzoL$95I3LFp?mgvfW55a^fqXlacJIB}|7#{bn>L!3a zFFP(!zfv7?aL7US9&*P1t#Z5;l_(J#x?wa&e|O12B*n_?>4pR-ws*z8EOP z&5R6kfztn{{8%`+iv=J{1#wMHPty!m?XRt^L0~0n^n*6Af`Du?Ol)@?Y>d{ssFH2D z?)c&}xgZN8zG!8C9wwcYsoEF`Bq-2v5!+fg&q?l1s`GTGeZ*$7Nk)zR7RLq_jt9FN zfBZ9DxcG>*PNk<#Wlvq*ZsNGTcOj@{1S=6;OV1h99f)MI6RCQM-r_0(~_8n zWw%i_k?+=r(}oq__hGqEf!r+x)xl%Oj?uWhWZC{FRLoJ3a*hbDJX+j3IW;Ebmlp*H zyo~{UPUZ#%uLpIA@Yz`*-LzE|boM&Oi+Oo%wxcxEG&#+Q8q4=vcH!4-JhD{T#8Y_a zx`DyXTenVN?;H<3ZE+WNKBX|Zv8jomj={w}P>x^vvNIAg?e-;4lcHsuIc>viMXd$` zXkXh;EfQ#1=cDb8rQV|~Kr~Ap7Whd^XMLb!@OkR$z#&LBzEj-SJi)`T#>kaICT1_0{~dx5d|^E2 zAM?UxHiAXrc64~Gy;SNk`_+m{B;x#I6@gvM=L$43j2C5@t~L(HY~C4h`O1~S<_`~L zZ0&X0a~ilfzhONnBkhheypE3Kx%Pf#dXOX6mIp%liK_95ZBN{8-WaO?6(4WJXTS+M zF1TFa>Ds(ij?o_P5J&cuAb-#nU|M!h-Z{yl5C#EuFk|;hfjv3UmfaAn4eP|T%Zbfbe! zgXMUAf|a$ZIyoTTXbX|=8nCjlxz04Sp;CgVTB*))w8Qxg67r!2j@u5=cc6~uy!6|3 zC0mG@xxBggebFod>^-_1ab^yoCpdxK38GO)F#p}CP6nDX&U5WYkx2nNDi6OP`ix=b z59%m|%Qn9rZBN@v0|auVuf#JL0dS#s%D6uoDcXnTN||!MKD+UliK=B_=%7ZRbsGC{ zkTV;L0IwJqFALWR7UI9Wd@S%qMQJ?mxE=DR6oI|IZIF| zx!v!A2>qv9+Q})e?bXv%sL+U;)}=8K8oILa9@<1d}1@1(MKmqY&?uhie1RJlKK%W~D z#I1+ODsjnWjIyGj_d2gE97BTH26(hhqr+;V>mu{{P{FYlL%G1ziCME8eNU2<)bqqz zsxFe%j29~O&%T9Umb)sLm16o!wewr1%$7=;N3pXGkA9~wQ65vW7QOKcH_=`0PQ7*O z9;wqJA~eiWQc}G;t`Z`!-urpGzj_@!b|nlc67da^xoGt-Z)v$$mrI@rPKk*4QCfPg z?qL3>mX>&_hd&AmoR(lgq5=WAUkN*%Ygoer`kgy1Kx>Yx6-bjMd1F+EpfigD}(10Wr0A3#vmGY7z4x{9EDCO zeSUl0#wi@p^H%y~jMmskZp62g#eq2zF6L+orT{x#j|SDk0fu*I(`c+tMjucellV4& zoXGj1gd3QiP#J6_x;K|=s_P<-$LI=25o@0M~*9s%R4K$|QRuabuc zEMJbjMK*}2I7uC~B{4VGjm!uF;T5rdr$h|*JWdAH610As@s$=7nqv3_j8*YBexmel zt|zWm+#LKd4j#VDvlsgg9^^qDcM@G#j~=~iNoy)&>>J5dC-B7! zus5?nX?MB+3YaIo>p@0FQHSZBAkU$MFmhS`(l(}!p7}phl+?)c!i5VWwqxT+7r=A> zXM?CL1(Ce{iKy35E^4UrZh-d2~!%b-j^H8|+PrYFaF_%`G z*xF~&;(#7C8iRcmjY%%-f#9iB(OgfN`!j8&!frh`B7Br`!+BujlQBiqimlWD_vred2{{m`7yyVcok91i9Bic;k0*+g} zdW}Bd5A;ZFJV=ykiAxej#K7DfiaxvO=ve8<5#r7-!@@Xi-`>2@_R#{84-k$cs#e5D zx1N`gk#O3tcD)tyZ|L1^Yt4Nkr>}TDw4jR8OEmV+hJQ{O;FCq7rX3@#A9@DH3rU>$ zTDdk??F+5`^0fr7lh44(W@aeqqW^EjO-m=ieYWUX6tknvv>oTQ_y6m!Fig`tLFyRX z(6sGv8!NUux+K?s`)^}|iXF8Hk&P7Am^z*yOK#=(xU|ue55Wuc)&n`z*;rZ2DLec4 zV{exN6Lm>#ZOYDOiIvwvC*aPFnc?_}pvmaw|J>K?J>E0g{`Xpqic)tdT7@ni7pWk| zsLlb>pd2{c_O&Rf#;bU2-lU5&AJV2lBWgRBgVogda5LfAhMjwMKfe-L&<*0{m*DK2 z#NVF>zcS7+A}~IsbJukC48h5Y;4ffpQ9HeVAm=xEx}Z z*X+o){N*Fzf@TUf008z7o2=Z$;()wRulBV>U$t^GaBVjf3n1oRLDw}fu| z;eks1yv2FMChN=pTWdQ4L$3V!Q&U}iZieW7p}8C*7l`K3d=OfKc}Ph6@MOd7*;5zd z>$$WV&*E;PT&#ywnS@h=L$yZlw~V3UF*ojEGu{z#}TZ9n2lctu-5Lg&A7sfyhmol=+%rA8X{=G-aBmUTsR3$}p~$4{g-?aMMIi?j7g4 z_3Nu4)}oep?YBgVm2JxK$O!Zi8vlRyj%J-^xVt?>^&&9v>V*rB;r{(FwB#5Y8)70g z%IayR=vO|1jNbR!U%7u%Nh`wCKG)T>QGR=I6?Ui~o$y-vI0c^32(@^lN1g zCo$(mr~c|MkxoDU45w^0OXPQ3f6}76YabWGx3KKV;w=UJi@pjHqf6b=pJU~hwz>?v zyT7T6OR;n8pAMZyI@Os=zZ=DaFGS6Xa;<(zN}yN|km3fLYis?sxNI!1t^EM15v1In zd3z%xL8N7qpc;P%b%S0Eo-)ofYmaDdp1eQ{gsMNPWq3gCXO;^i6{h8f`UOV zE@#&^mrdrKKTG|Qjz2D4nP22SD4Ln_>XjT;y8hxTMfjiUl9HCGK(Gkkq`*qvaW&etHptX*!aP%#idlYMm8vFKOlJW#tx z{;%#0m@s7gA2xy42K0P>iQa1asUuy_yu9>5 zPqDPimwL5dB;64O4q!3_KWgpjqWjl4Lm3q6>G56kyLK@%Mqh9K`O{{&(G<#7XgH*7 z%I|78Pfp7-_W_F$UPS~HtaxCW$P3xuGa~-WG@CJR{MPXGYif~T)fN<0fvmW>)vYZw zH#B0P%jCMcoQt9rj)>b=lnJio&4A%%j2wU2K$<0QH{pl z5)*5`H^a%pV+%hEfZK#~tp^lJq9iE!ZwE^GkQRjkDQY}82z`V5HyWTB5wz{{=d6@p z|6OgBY}o{){4pox){`{&Zh>pFG5eNe(V$^XH~Ja4%j7LTuSI+ivZ6GzNGk24ql1J% z3gF40pW?%f%iTjmM`1xWLX5@%3xDH=63K~|PfY9_ZoU5dt9EzVvuEQsX7>E)>BoY= zBm^WtzJ7oJpdoIhp3?E-8d1L_uARW*okOsIySduF-avII8TJ*i%p+ZYRT*Hbfx;OH?azTZm=hk+e?{6H%5RtN_EqdKv5>sDe*i#soZJ^n3(Pj<~*7>zU&D|8gy zCW<~p9(27Z;KhsP^&NAKNt>bYkPA#?eTR_8&kPebcZdPKfH6nd8vuxRu&5*kA^>QF z<}_wQ=H(i11%Ket0i1l$b)rp6h2K< zU`4QP0I-g?pVAC1&}OJ~+&w17ew}%~Q61XV1M8zX+yTXF>*$~=OQ-Ht+2>{jKz zLT(-LnYmSo*)dV>gdA7$yod8Ycg}Wo=j;u8`&Mu4(AzhUKU$2N8k<#ZtJ)U0S6ySw zG|O}M-nqZ$8+udDAef zvitMi!cy<`Z{H}H8X=~&v>>2WaK^4xuwd0;ql(HG&5UR0+X1k3&#aT<4EeH*%PFW8?2f9A`cCR=z@S)LxE7S!bJ(OFGr4Z796dPNYO5V>@mBHEOuH^x zshi^za-(HkA)t3bCk_xgJbT-*_HH=C0|!EwT(#$%xnC=XOb^r! zP5i3kB(g5bmHqVJbq6MJN;S6jHgXk+o#@NbDcvgd&WEnTSFbZNK)Sl*+duBozkNHZ z_H@OLb#At{lf4hmJ}79*9Q6&zg+e3w*B9CL+$Fi}C9OYyjC_43=D&q>>U-dq>^-BE zHKuUE?hGmfUSH2*yR0v&uKt}nUhvo}U*hGl==uM+05_x*Q4tymBbRh^U^)Vu#L7o8 z0RgUHvkw@U;`Q|v<_e74hhu^(hGcS)4ktzv>_6fv;yBs0xm_`#LFzGj=81h?)gsdY zx$BAPY3=NL`d~P$?VlS1-;-CDNWLR9RCcyXO17xh>%>0G)JStsUayu+&c1xW)Qe$E zd2B^(sBz}~`{S9G{kvM2@f$Xtllt6)IiDw5ZK(&CfV$g<9OlgCmgoFqoPI3U z$9JwQa-_Ph?yz?qw!MD+`u9}*=nb2%yonL>Z$~!fo5FfbB3y9P!$)FFLcb!bV%Mch zme}<)5i(xJI}W!Q^?VIyX5Orq)yrdS{RA-^I?}{gSXBDyCF~|3`l{x+Ph>x;4_3p! zwGv;THz3sdo&aUVvE~xI#F}p+gC+5h7O4n`aogrE_F@=htb8Z{X|%ei+aOevTz7X^ zEq&xKDmxO;Jp@R8_lB*9Gtq11Xx|WcZ_c)>r|t+VE8<}lianYX;Nxqk3RT*$dC|1( zv@G_^ebcTYZ(Ut$!*ADKrX4-L*Lf)u@+-eqmP@T&`ka@%L5WmOu&ys}2#_XYSj^Y| zoy<$b$-Jha5%S_iad9ye~rPY*=X?lQT}q5m=tdIN+IMxyQHCZ=b&L12X8}5@Z|Hb*^B`J-$P7sK^R+kIo!}x|$A_9cn2RkqzL^n=hb!Flg%i5!s^;HUKrSCuEy7IHr zC6_&SqvVZSckWD&X8B*1zlyL@On4z4Ht>zCj~e0^5!)-lCI`o$PQ}5IpkFB?k{25i z@=hx&=>IVx?l2+GV7jZ_B4wg)Kr97puUj{6@Vc%zt^G<(W8;@GG1&T31k8BRjbq|!2#_P+qVov!rOqe-2F&OCUe*o?Y8tc&$gHKX_{r){Psw45Y z-i;L9Bz@U+$K6Lp?)@zvcBt9Iy$NMk0Y%xU#R~G0JD5vp=`@2GhZ*BE`>C<8+MDShOQQd1^rvFDwrNd7bcKNRy^LV1;YQ_{ zQ@S6z@r3I(N=`ie3sIdRX(-3k+xL zDZ4vVWgBkX@Yt|^-|BRoZVU6x${;Z#qngE8(_^B&i~^>bP0h`>`>RP5OW2#Syrgja zU_n8IC%rM_U)&`@~w>cN8z z8(bEOi=XVlrJk&P0-+Mskc_=+`Re2ZJkT% zxem{i6hrtrhyt%IxSz*Pra&$&ym-mqi&SO$W@ee!KfQr|t5UQz6Av?$vfuzIJ+@aG1$@ezngtcgn7@<#fpyoCr^}YGBi!~^xljd zr)EA6@6wuXlm^|wrMYoR;8RAzWX}A&p&<4?PCUZOIlNhYkcm&h@wUAH4vtd@H+|RA zGEi$W0^B!a=x*LB<)Q57dzX}d_{Utzf`(+uh|Nf|Q+3#uK=wdCM8;Cl7QnBt8*5Rd z3T%JQgQ#c`XU}o=kaMKxolcjxYDw%tLBDf`9UhLgJA2ac>7?qZBzOE5Q$O9ii5zvw zI77s+NFloR{e993uhab94I3VyD!t|uNNw$v8#j5MQ2VAzSiI_$8Z%c$>>2i-t15~*flf)AR|6-2mKM%SL>Mar?VT$toOaf1BMX2}ATln7Z! zyV#6ScS7@JWZwcmg9qSe1dUVSDR=uSss;uevvZsxKYxCG4U%TSOaJErqd0IFgLMy0 z)EQ?$*zS^iAJ4O?jhLid;Jh@}lGZ=jSNX5OFlUB2Eq-EoDagvWHS@{HK4y2&VXkEi z_5aLBP>WaAwej4MZrm{6k~WP3L^k_PI&js-WEcTiMXO@Zx!v#d83wKsWz&D81J>+ zO_F%`=%~&ssfXC+uvC|c*v`!fvw!zW1t0(;Hu~q+(g!zhd*MX3b06_7Tv+IL23CkT zu6#!=tNHk*#l^)}uQpT6N}gwP^U~R~9FgMkbW(UPIgWFwZf<@=m}|SPNDJ8CLGe5- zyZI1Aig*Abn30i@(aIdLZ>1k=v4oi0o3jrXvg>AOK!nF{K#mzEP4r_BSJyIZqK@*v zp(&`B)z#i~#pG@#^C8y8sQDLir94`^$Kwz*Iv34h!_1Km3f3u4H znN5xi)kzVwy4?i3CVa%>I-=Kt4tH0*|JYKhf z4O#G6jh1+1{fr_`iOL~mW9z9Hk){b6R=bz__@l(@9~j6gD*N(BjDUdgM{rSwt4OJs zl?b2-u>tsCVL4~BcjaqG zM*-xL;Z)&A{fNN(NZqpom%!s-&RtIxkqZWSO+=*gg1)#jL#2D;*uEy7e$j(wH6&ki=tjkH|yq&I)wepIEu zx`Uoa7eD%UXjoX#EQWrlaB1>mQeWkAy83>Bcj`F&peA3;7X5dx?A-xVSqf9>$uX~Q zVDPo1q}=;+<)&@>uNxW)p?hd8Dt+jFC~wVDo)K~(-`VPU6ADuoZOS;#AY3(&zwqUe zKwFzOV$yx^M*#up=RB@ZZ2Wxa{Jc9nZD45~iuWnkcD;9)*``pVnVL&=Bx`;_U~ckV z?!CU6QXkneGrw58njJezpfLM~?HJSPyOS+xRzQ!kJ7Y zDG;|F79M`<)~z)w|M=P0RqX<&x>m>Uww+0sdYn+< z*Ihy+5t7NFBGxYw5~ki%$r9TE^mR;5OQ^A5Y2+uWE zwnEZ*2?-i1s!1O(&Q2UOGfPH|gL+4VgoBki5_(@-AVHw%qb>W&3tCk@`iCZ+D?Q*} zqQaHGlJ4$a3Jl_QLj_+-j&2enD3p*iK2DTAdv-aS_1}j9t)Xi(qY5w-YW-aj0DUiA zx}-KynI#S!1L+15S;}_sEoy5^l<}(g{o4R>)?OV%?h*^V3B|>w3r?>`JeUNrNn9r{ zs<$v_C(DP%Iyg8$uYm|Tsh%bidGrur3W{(nIAo!GQQAF4_4Ej0-tOXc*z{VNoY!nT z523yR8e>Pgk-Ck|tjU$FTSYnD0ie9_FiH`;dERG!zPPJPj1uJ$_Z}sAvuLMCEWE3% zEJvji68OrP^kaddBAJ0OIFcO+ik~uEmWK`sRa;m$l$kB4XPK9dH1Fz&_qTnr zJ2O@5UN}k-&})^F+ClNF(&|o5uaUJDuKF&{BoF~$L*Uu{Z)!)R) z&AkE?M%S|1oAH-`Nlt5PY$@?k`%~~_#Lqg#~Z9nisSU|wEJ;(Ha%iMJX z%WQD__5f zHd$j2yJ)W$$`gG9wIs;y7@C=}<+A$ln`yVUwcS~=DUbyx!CsF%-y&*5R{n5v5IzBs z>5)$8({9~%$a1{niQ@yM_KZLVD>F|BZHWxa0`S~YilM4-Nc*Sq*L`Ts@ z@c!Th!X;LnO1covh}v==Mu`!^b0hpzWj^mzPe3i$0~stf9(S(v{l=uw{R|9u+H+PT zNeEJQY!z)o8VS~6`hZEK_~^Fn+xKz(JWg1#|K~xjT)Fb$!w2F)c1eMTfPk_P5=o)_ zM#|dSZK$^BXW_%WyRa;2hFMlay;t+MWMo$ z8o(`Dxa^?Z^Pm36xz3NfSpWA@cK`cQ z@GJl=gg3Y-DUs*JNtR$Q%*^P3DFRDRfVKd@Rc*$_e-a^Cpv0{x`Vv4h zj3k0MVB>UBsH+28JlPez3IzTK#4S4V>?ucPQtI-z{5Nlo5y#kN*RJ5@W%}D0-f)8c z?UOb^JUb!V_2QKNTR=7=`?mbdnnT}K&A`CXEPlM~@7YLP?d)d`3K;*!SU`7LR=H*u zWLCCw_uzG-+$^lpL(eSugS^G9k*Z;HN!QYrM?EKW(4K7Eb+|V;n8|<X^J|7v@YE?~#5@nYysCVe&+RyL z8e`&4v~c0Ev&VABT}GN}NH!bYq&NT&rvCc%OVD=AkVEY+O6*^+g>fXgF3YpPkX7HQ z%D{*xX$lDP^EVR-E9x(bUE#u0xew0$!KpxMje{L^eQNSu>uc!;ff!f?znrQysTs^I zju5lBq@@24QqyaI4O3F$>XTg?-rw*74Qu1Zq>69f0{&-EAG{i&+AD>VE%o@tix)d3 z$chIhZfz`F|H`tz8Zld4oC3-qX>u{o!x8EEdLCuzkqcC=Or~1-(o@Qox`*cPt)8k# zz%^_Y{gM1AT(mI%KuOM|?W4_wvVTBZ`2D2> zPbKMs0s&91&9ZXR%T|1+)MJ!KTU%Pnyw|%)b*I&AA}@a&X+go5_T z_RUlxdS+((_MiTZta05sPn@?CffdDwQm`5bBAAOuTY2HXP2g-slABKGXx6bf1WzyJOy=TT4 zs5(0RSo#CDBaTEng8o=r4L`%?7Nv1ST6`z(YQ!rKVbISagfZ&le-GTIXK;`tvb(Zz zXs6^_AB=qQ;%|3AMD6*GgU?x24hki+!iLerf%Uu-1rU^C5T876e;x-j06NS=kH}q8 zkbKug`wI4QnfKz(FORINDk?N{tSE&<%4<1JwI8xLs5kxVQFZ}@C7tEH(|l4?G#BH3 z4JvhJDPEuEKFrW))3|4C^ah3SMR{T61T{L`J9_VYk-%RLIaOa&BnfN;noiqyN+dX4 z1Jv6UNM5GD9G){VSQmgMxIXGjv+E?yurB$zj@jk~8oTJM)om_yoY2bDi;>d@_XU)- zY|~a|^YKL}!?q}`e!}PjR7^sJ#!)|@z}S?#USQndQbxy<)K%(6TK8Hxo=qXb37XmR zp@QX<1*d~c#TQ|*c4N8)^6j%{_W)L7&+T(YVw0$uf#y9CwD$P|Gb32>)E}&eT?pHF zgz4fHmmK}d2>DQ(6S-)h0pcTbp-f6hNWH~~N>LRt;pR==yeGe}c6%;J4?T$){b?V5 z#{NcY=7aKb1;BnsMf<(12D?>WyN?1G*CT3P#3kuc>c({Mp=MHn?YJ)5^l3k1!HbHH zPz+UvYI}}#eqJ6D=OqYWQ4CcMq|~a_k{(qgQznms}dB8tT$w zN4OcOX*2`F!^K>j5JN3I3=gl8WpbXVQ*iXG-wf&5B9r3cwyEinr*gO-(uJ@5M)wG_0A%F8(% zbyrNdgrZfhMNe2t;bFpWKg|JSvmu4FyfnTFRQ4ExFI18-dhYrZmF!0vfU|oN}!IH%ok8PJ;TG>fsB9t@&(?85^G78qALATFo`91 zy`5-zdAY|tRA8#g>RZJVfD$p716k$ja+rh&!!H?6#}%mvO2fYf@oW&cenfBSr1# zsMW%3UfQ|p4}=>-W2K2Dq+GqEZS&0P(016$3}w>*9bg!E;w$J2ey1A0d;k9V=|PpX z?N%Qxo8Yqi6E3CWGpZYybYs<+7*!Se03^jdyLT@}&_DC>*}1)aA43k8u&{=#*KRwdmN1 zV(PU1&70kyA8w`OC{)twVA77XSoZYvJfuat5L|^LVt;+v{AlEy7?y~EFQa9C(WzQ1 z4H%}pX%qKB5v!M}!+lq6Ki$8$G?y|xo6IB1m398Sc1Mo2D==#ea|mo-m#7Cu|Jsaz z=S(c3eS7jar>T=u8OkSUU5YG9lA8&Pap+Ay>kz28xI>pV&d4~0&p+Z#AX;*P#D38?Ra{t2pLS~oI zU4wc(yXX)jRB4=-XQu1oYTm@fRhlh?%KALNmkGDK>rh@(QP;xG%cx(9FAi+5H_GM~ z5UA>O{YR$f{~3J8%l_z@@)N!Zoq{XU0FJ-pljtwkxT1lVzVDuHt3wq~33Y34OV&tMDO% z;i4ZvhoJxgR(EP&d+F*fBP7<&vy&G-W%Q%VVde~gU#gD#(6u*=-2TyOa52Za6~u(s zh)hT>!mY{S!4IW*c~WvDR`Ym7MYU||TY&?nX4yiWK>Zl27zLc8JletzrVc4HrG$pU z<=N2GB;W$l(g4J?P;Q7grC)*2RxMdu_->aZ;5Ue^4bP75=i>`ZO3E0a?JC4btDazz zH#R0Mcs4K1n%^r?|AGQ&w=#Qwn7h0C!~`jsw8{YlHrfKgw;sk`plr^g!;Z1s#ZUav zcn@A8grnpFj{m6;MKUneTdsngfdLon8p>J)P74k*Lqo$7u7ck&gw%D#K7r@}GXQT1 z;3au^u2cThJs=yCdR8b z+SyuJP0pIl-u!|A_3&ErO(dbGbR24_Z)U&jOvug7&aX$xVo#obBC#^x^Seq5<2_Q8 zV=B@NYdU(lyu9*V=O;oSl>;@FY-!I;#FQeG;f?{{<52pnCR|!lvLMfW^)%j>DL5nH zBKEnt!7wfXlr1tfv z2r*go5!9y}=_EBO*<49(E?8ESkumVt!L*h6XU5dejNvl)Ijq@Lo2J$SLdm4z#&hV> zcHMJqa;|!9_fky=5!)9Q8X;S3Z0tK#_H*aXp*I5VGztaPS`@c1(?ke=M1+%SiSO$0 z^ihbWq0`n^r!pso(S!xG42MN?!GR8I$8s%C>0%{eqcyU|O2b%SB6dk(Hir>;-U4abR%XaI1Z?6u%DGp85fQ(}3yW%N&59o%M%W;F?%V@p%?}>T zU3u|+HF85bK(wfj05?(nGjD%7JDbczds3PD*Kq3vlmsM&VlN*U>KCf$bp2EjxDJ^} zs-+btCI+H+xG`R(s=8W+S}ETl1_2OaQBv0?GSUk1<@8daPEPaooQsH2_4@yPZ<6A# zc|@rm2KoDA_KS#!W=n%{Mq-!xU9ZDpKRY^He!RJe)uPzi4$sg~lgc2c`+GJ%@Vpcc znmXoY9p{+09{m|((!^b{9%|}nw}J@zbU?sfkW&hr9Z{LdxmCJD3YLE!Q8?(-$K%im z#ci0Ag1<&Lq(Jqf9Q=ozrHAZq z_wjV>rLz_Sol#EzXl@J@NCOcO5g%^Jek45Hgw2)kMN@>p6`7hkh}2A5QjIFCn5d#o zf+za&{^Fs4gLQG#f!@WX3WMv!^eb#(q9`wh zc#}t%K=bL{2Zkc_HZLQK(Fb`A_N>zTv*;-Sf$h}P`%hjkdM)iK^K3t}=w^J!@!g=) z;(|Je!*C-P=GR7u<@P&4`O6s#Bt=b6AKa3*!IO?7_7LiGD~KI{V`Sc0F!~;~4qF0o z;vOmRxT;>#y=@R@+M${dzK=`uxn)Lkb2GZQXqaCLnM3SKu}^reqXTzrrImiW9B&lb zXgOx>B0QPSOQUD{LJJOwIog1;UiszAxfaHgQLYdKgWg5D>*_y{D`Ss`xBx`4Ren5r&>y4@^ z@<`N4R8YUU6x>)=T^rNYm5))VUJMQ2gnt0l8!ue#1UOBQGvyskkbaY#XCS(Ci=OM} z>6_Zt&mf&o$5#iq+yb`}pmh&|1J29WRJvT)scNQ*Z?QqsEFYP=g z|I&7Ok+FrjXeq~G<|k!z8!S_K$k-mK01kDv17W!iGZ;Dp2UsDbzhU!i4e>9x`CUV+ zw(gX8eFyVnE`*G!q~96D5Gq!8*q;>onz<>H)gM-osZSlNtw>-%`X4LDU?hcw!Erj;r@!igq=*{%0UOLtgJ>F5)9SU zX44D@A?S&Q42pq9hs4N8;_6(X1{}xg>Z5?&^B%_(l-Vv*BT_!h7wdzU@CJtf@Y;my zQKS}zNQM*COvP+Q@=}LK+lx9~%YJ=9bzOI*hl46g@g-n9@O%na@4K#WzV33EIKm57 zcHET?%)go&++kwk38DZnUXt-oQFb6Bmv;=q`(cvZ|OPk;=dzIw=< z=hLV6EG+!OAKCId&4a``!2$KIEZ2P5PrxlerU}lR&4m@ZT^7RZ?A*M(@hCd% z+gIXF`(Tsv33sp{Ld2Z|Xpf#cWrk`lYCzoFLnWSZG|Vom%f_7rBx+_brXYWCiTONW z9DwUmkD1Sj?A%XulhJ5qTl8=qeTl)@Ee_vV}# zQFw9c+H|8%1i24s5e449d6U!qty0fIVpB_+mOCwiZ&0?~X;HI+QpawoFp-(o_cuse znZ;K=j(rQcrXkIN`T%-<|r+#a!%lPza?1sB%2LrwMEVe-7An z8siYdNPn>UP|(dX?^L#tSQ^1JH~_ye;>gr-m;4LbzugDw;zog(9C3%YVH2gH@{L2z zDZZ4rN>Advmd2KjwMK++t1eatO8-E5@~!evr;3)@2zAz~_WZCn>9#`G-8#X8!#jXL z4Nt$Y{Mt#NQVih5I7EVWvWd*k;58W!elZO@iSm{tJ6}ni1RZAlA zaBzt7sT|1I9UIG5ap+}qbpE|J=bv6w$Xg}X;a zq7I!=PQ)X^c6o#^TLn`!)7Ljc#fCqAnaqL9)B5TJK+u~-(fVc@H;pS1_tk%oA)!j!-_t6VgXdSy5Zhi zRj`p{DlSKzBF$AKptGUyqgLKW(`su~_MSw}bIirRzIgP13yC{qb@%T3^mHhZ%3Zvu zbRS&`#BZr{0R09gXWO=j)q||Zj&T$=LPZahkp4n}Gj_BocM=+|q@3AoeiNNSXsQ}) z&C;oMU2k^|mKW$MCSLk5G+c`5ju%2EK8GB2ZcNN!VX_K!OSOV^Td4O#9aX@@WGg^K zDx;S|DTO9YexNDwo6P#j^c)fGch=X_+q8KcM7YdJ|8)9>gt>o!=4G0C&~&>+f&eO6 zR2Ct23^Q@YrfTe;?f7?-o$T^x>m3o{nSIsTwSHffQ}s)}kWCm{aA|`=lPHr}H~I zJM;0?xkeZmzk?6O>;b9Am|OELOn5o6pPCtNlGG-^%j?1`Lv69VXsw@2AWE&EXP@)d#?XE<?!vPHeVYEbWDVp{Dj_ixfpg3L6*)!h%AO)_|$;wqIJ6wtf*2yk>2j zsPO_N6=r#9$Dv;J21hSYkemmo2Cl78I&XOCs z1TYbDLC_0mK&}A3kJO;Fp&{F0Mh->wTpL{|xL|$1O>wvHKl3pS=#>3r7NB}ct%*2B zZhB5(TeB}Dse$?er2E3Zi5xY`*${+a;pMf!@J33kIFSOT8H3=6u=UVqU*F{lKQ?(| z9^Eq;hBb}Prs&q|R|KdDqJd)KWu080!-`41Y3poLm|B68y}o_^`}ekov~p0BrU3tq zje`Bxt5t8<*aW4%N|ZV7{xK!-%KUoUIhc54=(^eWW;(}i8W|Z8;be1x80U!-gYC+m zsS8t09UpfI-1<7OoApj-msQ@&NK)ECq1XR*k+~iH)s}q;CECEzOToz!PV;a7Kd!zz zEa(1xKRg*BS|TOxs5EI&DdZ*;ZE4fg5~Zajvydb$EtU4t-h)!K_tf5dYuE3*JAl>b8L zFCZKm0~(cX*5x?fa{4czYzBdn;fwC9j>Lz3R~pbjJ53*z+j$rEYImQ)<7yO`ZziJ;?)-WHa9XZ+OCy# zkQY(C@9o#q)3LIgus@4AjL7ON#u$o4xv7R1_-O2{rPZf$}4ju8rI(oItSDt zC@|0g#%yre*+E`enI)H~DfUsNxLVx*5#~<7w;;#4^y)i`Dw)8%tQQTnVFe&R#p;v} z;;j66|6~h}e62WN!w1ul1z=H|W5l>R95#tUL?i#)ZDHWE?SjVou$YQR(=;xEc@ZMy z7YBTbj+}Sovz`QjYU)195Du?vvA2Q}g(FcP4^?TrewXk6N+Y{}QZvDz`qt{7z`sN4 zzf=RfulK)Xt;i_&|ITUNy-T>A6gul#t&wAevFg~!$gi74t55?pqne7m8OXrM7#A0U z0nhtt49EbM=D5pT0`o}^*BvtP{sKc)%^4p1Ls0-FhrNG;`fH)xj2^HE)_*?8%y~=U zsMcisdU;{ctO%iMporzC{o3m*oAFvm;ngeyrC@F8bYF>s_lFP3_RD1h<;wX>jrhuR z!}`&M)0&z$P#mHz7WjpFP|@#O`SNIqn;J%YU%0xO^Bvlm9dEA<*RnWmo-9*F%r$1c zoNR2Rr**DW28wQ?@~n>_&wT`s1vQAMZta|zDb>W^%6>HB4hpN=A^r{Su9Q$t=oW!d zgDVGqwO$6T4JroHHi6b;z3R+|4waRaBz#BKW^F;aKLi;bLAhV;mzzmR&1n#AjWsPq z!5bX}m8dxV_)H*mEj#gw%6pmL(amOY51DCk?@)xNi zO(S(6up&rA=g+toEO@xJIxk!O?-pZ z3Qu1Fx9I>HPs-#==2DF@bdTrn(J`LW@|(OA5_0a?kHYSOsV=0)4pj%&L$ap#`DPEI z>-y@oy9+mjNxT=>8PApZ@cLL3mzBlX&be=H{s`7W8oOm{@{gb(r`1Z*s366_8V;sq z3HkXOZ?5s0o10VY2?&Wh;0rkL!v{=#D{))zWfoUd(LW_9s3ct9o?{F2YPGNx@BHIl z-oyy7F$?6wU-LSq;Xids-kMulDp?`r(4Z;+9JQ`Dn@w<({P<#v*CB~q1T9!p_?qF? z2I6q<-cPkJ+hEv&PQ;|$N|rRnBG&{-^y9}NCs{^tNP2(xt6(=$FUEaP`+`cJWV<_+mOuR~nF2Kjr z$fj+Ol-LTtt*|S57lWNP(oz4m9?O1&7;{iTG*gGmwSP#Lf2@6n($I?Pkr@ym#G%^^ z_@E*|htdSe6qYD%V>mu-mKkJY;aY91W#PsGl?YXCQ`0R87Y`Q6+()0{<0qc)>MME2 z98`7g030r z0DitYsgLY;k>j`BOt*HSQMqe#rc_HIlCs{230sI-HC_i}9*pQGn=1dxB*~S~gu`L) z#0jzG(byiyv#2GwROj`MIUe0jc7Xyz=DIK6K>oa)_jrt?)UoKSdbw9reCabBhCXec zLoHPTa=lDYu53nvWYCupO|TmI_1_*jt-S&fK&2o5#sAwjR|~OiH2z13BWcKpq!G!} zD#QtQA})DjZTWw6=jpEN-j5y+EGcXe1QYCGAIX!O_4qmOj;+65)AJ@Y8fk8}L$~+P z(o!yBRkNtD5UvH+;%^lQbS$!BY#A897#I+sX&(>c+-Ug|TA%9q1(mWgKXS-@-|(`Q zi&j*PN7ud)T<;)^yMU4LIv{=ij>X4#E}dy(SK%|};2?&_#Q`iVG;}iPzd<+oC3|~` z2h*LOKYQVC-gi+-iazX>xPJYUd2xNpAfk9jn-evCk9^-s z_A|J|eab*r_u&4oSFL`kwPZf@0ZG-9)v|MX4FEnW%)pQH$9;0lo8KP`gj2?JhxHh* zMmEp?QEp}#K>5&sREdLw14FY`Sa=-Y=J-N7N&Cmsr%xxl3eJpvPt0`wTUc z!x`XZi<9{;Uz)8<*pD^c;Nwq$)~R|R^>;W#amGz&IXT~8>CH_1N4$PQl9BcEKv@G# z0jM8(%3-yCN0?9FDMiWNEq0*-XCFuBU+V32A`1GGqCE~jN;;W^#>X%`CK(byR&37= zjK5xH8_vf3)vB(#I(4g?J^kSHa&ls}ahsHDg@LU#Dl#~?!Poem`4^H!PQ;$QyHo&j z#W5y9XVkWnjJ;08au$WcJg6%a#SGR+01*%p8f~dvt<-`kq)LI~LQT!HtX41j*Yp`d z(B;_M_eRO_L)C+O^CvxD-G>j%>N0PIgJ)faT!Cz0MSZUz6(Pd^6(Q*v8T1nO(%OIo zVsH$?TB~7AID~Sj6-NEd@|U}x?Yr*Hb&>?MckAI)ZfR5X;t2OXgOGz+Oe_xum`(BROE|rjSNC}Y&WYfM z0ODDIGYPV;{Knm&`0(BTJr3n>to9GStXn?x;EITE+9SnT3jZ}Z-rBdUzD4$nuHF~% zObd=6wTFHqGFsB?VV#D_x@;{fC1y|?mM=*RftLeV< zcj1RdMdhF;(AQfhd4q7gj@`R$DThlfN(zx%E>GxoGsx|~NW0r=JnEi_oQ}I#k};Q@ zfYAlFj@vrLPqnACr(7tW3PkUgYL{5uIGEB}{hDIW=$xpqFh4k^w)*TmIdh$A-#^Yl z<@@m4(>o!uryfO7*5B4 zwvv3Dy_1>V#fapi{A}Fvjo+IQVrO|K4SyEjT9Djo-@M2 zeywRqNykE;KmUhz$-x0fx;Kx8h|P32`eFq3yum+&kCwYmDUZ1Q(s*R>%l%X_tI%t` zV=kbjPHrwO!mavVPV_~-ObsSDKPqd{bSIi6rjS=+4E~PLk-cfyAQ0vM4~Jvi%0$1 zwO?9JOopv>3p5*njWspHEwytsAt^L$+l`DIi@Va5>fO)(LDm4|A6FMfQ5rb3yxT@b z7b?r+U}dY+TjcbbR$hrk>)t)Nu(Ws1du7;rjSo$~*lr)iABc zbZv#5KP!k2#aG-Il9=|EXr9<@abY=G99X1^_bw&`tspJ-MC4oq?lg+Pv+S?{Y@G9Ox!?I)l9-;}d(CsZsK_nrN2z)uXo5gp z`^t0(hfUb77f)d_c*8$k8$?PmyOm_7A#T+FAA*7eog7PL>>m5@#3QH6d}GZGTz4<) z)UuME2M2hA&Kfo3;tD*>FluM(Fh(;*X0LbsHEmKxda=5O@|Oxd)qg}H4*b#drZjyU z$FM&yZ@b!OQ?8{=@)aWi3NDTc88_iYz7@qQy=fn`_3l4z$P4q-Hd|B4S*X4u)TLC` z`tM^UBm20IcIn~^kkaMjyA8Cp3Hx_aQ&YE4lGB|yb!vKLVGQGZD|mw>Cu@t6T8cvO zI_%IaoO^VSyZxg0Cn5pe$m0joCh5<}E+{Py%gq;IL^|y3|4NQJ*#M88NX^MlaY~OWt9#rVq96aTatJ#2&S6#TelfV z2j^=Sy|i5z6;4LHM44povvnCBF6I8n(>X$E*{_W)1(Hpc48sg(9~D`he7*E*cIuCi0AIZ!`;9u{Xnb<=+n-Ik}^352#xN0zokcHMFa%YaHuS ziel2s()^98dlwBW4s;~;lKx$6dl&YTC&BQRN>{Ld9dgMIIE1FMvj43l zYd@JU8$R`^Z<+H?@8#Ly+PQ@V%S#f242N7>-p%dpd2n{C^93GBXRuxE4-p8H$Xhx> zL&LnkrnRepo9f}&`3~y^+~IdjO{?Y)op(Iiej3k~qh@}j$Zp}&e#TsbvX4`(RkKdO z{TZ2<&Rb9VRv#*^uC{==GPUdcn2p5+Wo0{z+_r9wSX=7*-rX%+Rb^$uw)IIh;acXO z>HhKDw~<8Rm%9VQV-4dwxbtTHgg=$nr&}R2;E$A>*kb=^c5d9zNOg5Yspi+{p{e21 z*FNjW^GN=;VacM-vQIywfN_r(nma|sFVWH0h?oW6{x&rR(f%}O9(ytC2Ly(kXoJ6N zi;T)6I{NNJn^qlHd~@RYpVdCLwt{;1b?=H&etlNWt1tSU{`#{CGB0j14LVUwB!HPqdh=ztAB4zrF8oq+H zpbPhnXN}9)o$WXaCZ@Wqur)U}^8fs4GAUiI#?dDz(6G2*xfyU#1L+We%iqta7D{`!~{QwiL2GwzqmX?zXogJxha=Eu%L3C7pbl@%`qq z-|2d@Dbtb75)|gtG?P=dhv=G8n-6S@l~F%V;juKQeAJ}hhIGRMV$3{i9?4oh(NF6c5<}0K>dghE%v5T;+ zExB>?2J{@u($;&KUz88b+I-^kdpdCx^PqUoayrOcsSciHIeLep9%>l#xj`7?dw6<^ z)z@XEH1`yZJ$)Ks_gLtzAjt*9|BBmaY*<*D&CKKUXKQTSH_ZQxFW?$AGBQ7Jz=%WD zdJ!E}WH~Rxs)^|j=*EWTY(YR@>?txZDc$nK{g$fyBhg2D6go-=4A0D{bz~OJHpgHZ zo!qB+TvE){ZvO1x<+bwh@!uJgC%gu)9j~)qSH69FK89Jcs4U5$+;KIgaq=eda@lWe zN`>ISxVI_)6D%z$-u||aBj7d{Ybb0e^o!csM0j~YdINm_Wa6Hz^V-_l5!|21)glN4uCCGeA{=1E)VoC+{%4pG*~EM<6YlbA?6jDhwU?BH-ilWqu*VAO={el; zZV$j7Y@D%;=}W=kQk&;2SOL)=YJceBl5V` zW2t`1d3QHwMTJSr51%Kq&*|1ae?QH+bmGJb9F#&r#OIgS^2s4tQvk96x1s~|^rfV| zMYa?n<`iTzKWzI#;+NI?WCV=C|6AcQL5y?*c->M|gt=@lOrvb3Go|<0zd$A~ ziB<cLHGV6IhcqbDDTC8=)ZwnQF<&^Z^KmaPle4mJpJ>a9ZHnHxuj}i>zBQPyCi_5Y z-CbT2CV5y?bmldknpc@bdWx)L{&=v{&E@4Z_+GBB)&A}{e28I`S=c=PT&U8qrlvtW z`G&^EBmDZ`I&$Pl%a>2CKT@l;GcbBGC8jmua-ykO{G?rM@t214883w%jAc9;XsQMq zsii8fnUY(KGqg^U&B@W;s&?q@zeP6Iz{6AVXBE#vx$Au4eLz6PcnrlFwspCcK-6t@ zp2dtVM@SaBz^4RE9387h8GMy=dfGol_B%SV#?n%^iKEQkKFXhCW8;x@Ief1iuOO-p z?ka3I*A|-MB_Z+sGkveZDj=~285G`JDiLja_b~Q%Pv;9#r=|Y0yqx^u1NC0F44Fte zx`pEc^Y5=7N9Sxt-XCvr`SOn)`(9Eb;0%Nuns#&&`8J0RsaQ{4(bF4%eow%7P=W}$ z<37sHOGM;?9zK_OmVqx-W$E^Ltd_Nl7&RZ-F@ zx=LFXuDm&_@t#hSxRC3V6y3P|OvbP)eYs4FZE&ER+Ouw>&CY(x*^?-+Fx1uYscG?E zt!!gubLoVSp_yM(ac#(o+N(yv)VblD)s5)ZlhxHFoh?_3qXz`n=WhNF68*duQn-)f z8GK%23ah_=e_B4kdi?lTCJK&cSC31ts8N1 zj0y@Y5m%>1>gnqv;*W+3nf~_OdVZgKiFQ&}U?7HHOmjfy+LHdhg4nt!Ia7e7YUzyQ zZE0z)uE*3)Q|x{NAJyLxH!P&2>Sq~J)G~xndw~j7Up{8c>70@(0NGW~*SiJMe#!O~ zz8eEdbi2stdIq~L?N08s*}6WJy?xC8toOjlLH&}O@6w44nRnxP9E0N31P`6IqM|Zw zwY{BJSY7x1i!Hy8J4M*9`uh!zD)W_YGKu7+oh_dYdhcl@mX-$7;2DxW7sw@&_9|{q zx*hQGW3h?FSw>^yvEpK4`lX8}9zJ+*JM%#g=po4O`tk2UbEPq1q9#9YNBc?fqik$u zgB3?ZWbf!H-OrdMD^$M5qYPJMusfmVaG$9A;g2UC`Sq(#Maj#(m^|#jERgT?Y1>T& z6k8XLzAvZqqMl|!k`}fJ{I9~ketl0mT)JMb*|%c5!;F*fyjDpn2v=b`r5@tqmlPdf z#cr{=QUCTWmwtw$Ln)J}_sbVAxHQjs7(O&lHty=Yqy*6y85!MOfR4zE0l8G?bP-xg z*nAai=ARpr9-oNE{q5NQbJ?6RW%Mf^cKU=e8yn^^R#icH5hQbEBH8qTjEzHnUXR|y zMlWdioG-iGu^2J6!}6|B&^bFfo@hq(S8WZW*NOYSM;e^y;P4?8d4E4;yKhZDE4!no zx3Dy$)0mK!CU|RlH3H@{MzDFsks1f3F%%K4=*#eH2JmXz#-<9mdU!y6$()w@9OcB5 z7*5{AI~BgifJYaVH6n5JLaQs@+}0^^Ts!;P1&jkYl3phQ{gz8?MW&9MOXi<(l}F$* zrx^($2cptH#}Fi`EcGKY3aoZY-Dsuy0m6lbhCY`Fd3I@UwBkw=OTMwdU~ND^z_uM5 z#|TuxO-s5T z(a5*=Y8AJhv`6M4mCEhg>Bfs){i5*6$B@KnWgeo1Q1JBJ+|n>4^lKd}{{_?nxAzIY z*@rOP_wovlHSROdnoQ*M_R9>}#IcM1;Y@&46-$EkYhw<_%?tVC2IC zKik9OYMN%(lPwxH=Wd9KCfzovO69tJ>Rsa;p5YT~hI5%}_lEs0ziFEKo%OM(M{%~c z=zA6LTxf;!eoNkOu3}-ow>r~Dzq&BTx%e%1tMil1u|%3P_t!+v+AJ12*WXGEGDHhx z#g5vz%>LmC*4}-Dm`3f~BumfgL!;lqhEpHyqH2uSxRfWxDm2sGV=>Cz8I-WHlC5{h zv#9pLf|{+N%oDCN%PXCL(-`|_<&L3t`}_~(yr2ZlcSQ(t7|-kY&s3{ zbta*47}GU?b17u1>W(8To>cw3D){8dE+WE;L^&7C6)PIX>FDV(MmEFXHD&`9!qHF& zPGJ3}%g?XC&3*Ca&3yHQmJG8^P`;Hq5;Wax=58}Hx}A(|&#^vFWoSHhs`2I9!a`>Z zdq74}Vg}7xboI}AN1Cw@s7id?Sd^kRr#`mkgY{MEpWzY(O=-;5g3L^MPWa{kK6p*Sd@_~WZ3)$n%A#Wq}X9n-B((4eq`%5vaeji!Z!#Wd}DJz2VTdk?V|=i zt~Z0oT>1;1A?`fANx4u&CyVzEU2l`916 z#Ve2tZL02GJ9z2UA26@{PP4Edy;Bw-tfQK?5+_d}Te3fKc{WFqjmpDN@Qj*IelWjc z@xqR0S1RtNs|i@hISuy?h|=?R$(d!*C&fDY(Q6Ovn)kQTv@n#ppsD|;;f0>1y}r}U zoBu6`C$mq1K<&ZlNBsEl;}?!;mQdj85LBdxT^yjIc!8t-5E$J*Jy>8sX=GwjVFh9= z*%B*JvXobqRz5FV&x?E7U)&*FmK|Ibj`oXWpGP0h5NyX=UK~2qifK58xZF5^D?bUD zY9lgj`c9NIYf4(0rG@boqN-|Q#EiK4@wd^X7NGpj%nX_fPQfT)^7pc&I|1XpeBEE# z;=zd_$8hG0D%>)-d$%?{o|H<6Du#uSkY^RQ?_Gpysk=+MNo!1aI5dvT;qoUvbX!|m z*uAcUX9JILGc(?#7R0CB8{Ch|F#TT7EeO^KMlD~zLFNYj$ps=pVp0B)3|v_BE6`$r zZpbIK`_Fi580sc!*Zx9hq&Pk5$i9=*5_7lcCGoh&RaR-=>~kKZDIDkRcSSNG9H#EKDSlh=r6%qDdv2fN^+ z8xoT5>B*$fZE!DYYN)yF=T%)}PW_h)3#O1^NUUF27!z$ubk9h`6`9WgQYE;nCKGK1 zaHuDhTZW}#4kCnO$Mi-ULg)k>akIc>4jMz(KYz658e(y@lWHON^E|%iYz>F1G!-K3 zt1D`^k;S=Wf0g#|DQo648qOJ}3EHq8_G?J32o3G^Z7Ci~x+bkteP29KB-K7XGB5D9 zgL2`JLxc09Ju!kt1^p#G4|ylYznTijmPW1Zj{o1?Eq;J>vYaA!gaovLN1@y2{re|d z3(VXwpMCJ)!JRwZP>l+iwtWc;EBbd4t(-XiWxt1;8+rT1PRRB+fsWw#Vf?#>vhB_o ztu6h4pzhnZl(EL5u3EbC%6LD2wG;p=rKN0{nGJ_eeJ&UcK@7vo=W%SLdjqrcUh^y> za!1=$(*ib^So&+jenKjelOmh{ zv)Yuf-ceQMZD`V5W&JzT71E+(#|}Sz)=UK_ZBakf{9vb`=+_OY(VP}sWKXJne3ajN zd9nC#8a2gLaeZ?DQsD{)kJ0c*>vNYQ=WJk-vy2j1rka&WB=vYGV%tbVE3BWObD27l zGK99Tce_UFsfelim2vu&>Mq0Mt;P=@{z4%_@#2GUO-;xK(Bv9fEz4opo5ir5=A$P6 z=TXf3U-{p-Ki|Nr^R`GJFI_sN+ZEd`!mnv)+@yJY(a5x+J+ zG8g^+y{5yK5S1Z)uzqUj3`NMcZ6c+^nc2`}}*L z|Fd=h-|)yUVMfaKlYft;ZaSd1dN97i$1bJNeL}r(D}*D0#!Y+BjKN|XFO_cRv=!-2 zQ;fsmDg8;Hr6TTi!jU*dj*gDQX~siUfWo6fzZdaV2d(EI2o_jwqme}6>$xFbJ_OwD zF&LdWh^Y$t^A7oF0TGds%6OIAEvF+K##?HoEt#oMwVX10X+M51#>#1PasWdD*&Q;d&!;gTBMLmY^CTwQ-F9E3^;A&ot@R_!!AE^KXJ^fe zie&bCB$^#wICtyT(*1vy4#2C+KyTpS!C^n&gZY-Vx$uR7KAB2xb0g5#d+*^tY$w8X z^#pdMgRbi?{JYgkGb|q1#cP;clW~z-SkXM zur{H)bjhJ{VhWHAoCVkjc6Ns&^cte_F%2QDisO$h>A|WBXr3kAKd#E8Ws!dzr|I;} z!}dJUIP0lDgM(f(S9;+?5_Db$AdvhICJ6=4_N1^OR~nxkl#EIbC8PQN;o;faZ+_V^ zpNls!GgUDp`~+8NZI(JE#TuFT@ZBY@PFW_UOWf=}H=YzNeFPaDj1fv%IWTLbfOShcz%`a=|;$n2c) z4^kx?`t+H#+3%$cPtS>|f@(fK>LjKiwZ-1cj47v$o2nDVisPR71OyO?r%zY=71(pb z)yPSJPO>zEx6=kSBuG~s1)CT0PP4G|J&W`VSo_erbGN7?sQ(MEj(_0NXAu;Hb+u>f zpBcmTZ>LpIEU|f9b#;k;azn-kX=ledIZK;v!Qe-OknJEkTjI8Z*zo0A9yAIxwRq0Z zAzdNjU{_4Mf0;1GZ>m| zrMW^pa3De>+lEF?TYD77#V%2gEl(?CZvrGnW$7BFDHb_cd3b+qn(-pSk)(;Z3oOl( zSwcP863;mWT_7@v*zoP9eDy-(>Q$R-L?}A}gHY81CI+vIB^0qaG#(Nmzmo@;2|(6Y z=M58&lpx}$t04aI8)#+|&2|$WFHN@&lxMgO=S-{CEfan|m~ruUvX2YT|o7h2nQr;49ak4Go!g*31M<14ZqZ z;#NZXdOu*lpH{jHW`pu3Ut_dFeMcS@)ny{a7`)flMV`M5LSLf1N!gmz_rTF{3l;fx zE1I24F;n{+eOz6@kn}1ah%pY&ri4_hg5i-&P;ro`b)XB}i2SnCfR1)#FT8hw-0UY; zYs?Ct?PDQJt8|@&Mm&HM)P{?brhZegUYr@?j%xuf2e=M`E<+^tmGbhizn`=D1njy( zu?9|A=7i*AzCeD1Jr+!u=*bWfAnnPzSHJ2pI#yzTPp!>BnIZAfOm93e@Dl{5&Gh<+ zy)2=K7>(B|@NtQdVeSO}w{Ur`DKWTw&7SF;4fq}2E+W={^c}4vF3I?Kd-IhKpKdNI zF8+%31sJj71>PQrP^A>}u52m5+msI}V^YqywkTV-wB@?l0rSC{Cvk{61W|wm*#ANA?(NZkgYr@3A zF<&~GtD(NWwx;HeC~aW|fqNzO_>73;Gv$<#uQErz=)Jj8uqhO-ZjtAHp|m*Nu`6>m z=SWaMhxvnp52p{4+IiBaZhTmrgr1T{YQ_a56Q5d z98ubG_sW%$9EzGG#u~%k4^3l|5=;v=CnR8=&8{Q6YHzb zd{?42)+6_OL>hQ@Ir>Ww;iwMfFca0n)Kn?$5*WFY|H3TfD8}&91EHOb6ej*fBu!`i404t8yt!EVSzB<%|?QwEi>iTs(RYl{ulF|ZQ zRdlA+wAva4j!t7uvZNKJOt%y$Y~gltt0LVJHULW~F3AnG6074UPFzwVy*|DoRW<)j zweCd@>B>)yoAJ?hjlHNqPMX-wvwt$A+W8L}no$wFc0O{)NEt0L+gT2(#wfWPO5LT! z#vN@FU0VyBW@jm$OMELJcjVJ=8EuTmPpP*rEI$4R?UF|31Ac+|JyfvzkEK}C%%Pmh z;*)mPa@>eLg>f8yweSL~;ml0kh#x>mBMM~}^hR6jm6f_PbV~0oj6E2x@v~bDigJ1d zV#8T6u{SONB^BtFehp9%7*2hDgUEXf97Nf@2BQh&02d8*%j(SZzA$qT39fE#Xuw0{r?R!Rb$~PH z=oruau6&E;gbsqoz2*caJw~_EK1^&7CGo)pr)14%=QodE!4GY1Msg>Wt(_gd=nnX% z7?r9pGd#{z74+}!wv;~OC*2e#$xDE;Iuzyk=mx(&Osl)V}1er;ZW!xs&-xU;Nv~m1RIAX^54Smkq|t{feXen6J=yI6DWCz(V+z zd0+j4@|>0RrJgi3gGftLQ~3|Q?$RI-c<`~;`%?G&9h1`o%lNs$kN*q|cjm?Kra!{T ze(Idf1Gfm)j9$v(mfYn+>#npjLPAl)+TUX$GBeNeCVu|<)up_#rnYvYf?AS^Dg52d zYs=ww!E7=TQ(aw9{reY1Pn+#~GW&toRjeRMkji%NxwvqHRgV)M>gf=;@_R2X1ChK_Gg^>=5w59^0(VzV^K?0URv)3x0-4yDk`{>w4_hWUO(%- zVz(e$iz1AHA$WmfX1G=kcB^iO-PsFdvGkAeXsX{d;LMGs39##xam?a)2j6$w)~zJ+4F+Y$UPv4| zVCAfGEb@A5!6wn%yzTo7tsVi;R{W@G6yR>k03HB#*7<^4CZ*1sP|}@uSb+jW<>>z0 zp^iQ18{i*MT>Km(qZbm(361pSXWQ%;#Tc#--@OxrA(5Il)yFc41q~SB=mP2q|n#d-oV=^MI_r4fT`CQ?e&!SPf_H$)Y(%#?F<~yS0>` z4^^iGo#zb_Ni#m7xJU&L!XqjwUu4-|NL)O@m@wLHo<;Bol2`E!*24U@w9jyK)W{-> z-EUje{#}cU)E*(><&jE@4sqz)FG*Gxv`$VoU2w>c=Sz<75*_^G9guqUvSv*88&${u z&E@m?qT-*DYU;~G_=O-Dm;hM#Fac@FscC6?q6}XR5qk`$i;EX8o;#8VA{wTK_`wrz z$jft3wYJ#bx+rnErm+zPxJusRcP2Xkxev?^h$7qXl#mc6MdUm@H%V`zZ+O^d%_dWt zRn)v6+ghWuvGQBU6?#mvm#EC80wr?A zGrSSN8_#z%G!TzdUkk5;3_bP!#Cie)qE<|N-9WVlOYH0T3|4`Tc5jw?LXI5^p)F+y zp$7gg_Yi`M8z=InCd%Hlw6x?DJ0+vD_BPec+oP4r^T+?ow_UQ|vL*1(#O}?BjLP;5 z-ssPl*4C{*zN3s(I}=R7uqik=SYm7Yqw9_{^Rw!qndQ)@TeGBDVd+A(b4gY8d)dkO zf0kZ;^ge#BMT*!|705aC1jt*K&2p9h#E^TU*+}QGjwH>n@93fCic0%Gv%gNampBi6 zBxOmEKHXu4Uzy1A>9mu4U10Iyr=cIT1Oi>U#gc0Tu@ zI~e(6gtE#?G4uZ6D7o`x0~8UEd1&~#4U{|OJQ^{-e_s==t)gNB+!w{~rY=Iscp?;4 z7I^Q}9zbQ2^~NAEas~G%Ix5O#q-1E$Pig7<_jeun4v`36I(hOM!Q;W%0L1$pB}6NV z*!}qpB?a^k0Q#Y>sP^NB`AJ_zeSBQpIWaMp;f?hjKwfN@XW?LO2y7oL{LZ&PSU$vxh91Wzw`BVaen2%J=4v!X8YW?NWa0{9h1PAQSrY|?@7!BDJjw$#Z*36m`0AO z5A&8obY877UZ44lE1pX@BDC+?FDHv{x>)Lxl0E}j5TqL#j+i-I<*2+SBO`;Vb%r2* z?3i50(zI6cz}RS`%lr3x?f#6f-jOjig^gtXg+gWakMJlJ7Pdvh@AZMI+yDKaHT4j# zH!eDNyGHq6^_rg_6B63%CS#wSWhzCu?k2u2EV<(eB>kLHJU%Ibp>b6~V)WF>JvAXk zX5t^cy){);SLDLr?f&Aq$;B)F z#Sgfbu8u^yda}uQ{nEwiXv=))xe|uCEa3R!hK_~NMwsh5@cDt@1pqXDHK4XLOvzFhx^frPypa_B336Bu=H^6gOa$sk(5_9J}3GT|)S- zEG*10V!60J0+EJEN1K235KS$n&d^WrdR@m+gSI9-5pgyW!K@la3+b6&sX;P zlQ@RLts)|Ad`vOQ88Mn2qw5BL4@)vxIs{Oqn6`(c8C#>_lH-1@sd+2D?fyM>la}|& z`9=B6!PP?#bWt3usl748^-zda3j61kZ!~KQ&EbFkSmAfKp9_H~apGy z1&$5~v@c)S(>aOokC2d8#o7<2Ium(!ZnAu^EuyLp0 z=8gvlGd4W@m1(F5=cU77MQdA{vE}5NQ!rJW>Vlok(k|uZlDWakldJclqfg>TarxO* zkdvNnMc)6H6Z9{G<-^Vw5|}MC!d5?|21Uu~(;gG*vL~?NRFKpIe^ey)va^%ey!g=F zs|{UncII!nxrI#WXP%u5)VeUY!Bb3(nv9h{8_?W!27q<@*JGJVoH7ena6xX_wz9fp z6RWxv6F7`x5FVrSCQRoBel%%~E=jkDPu2lNJ-G);ii#W>qC6_BV94n0eanX@a35pK z)WpPP;;5I+MB6fKZzR{VsIRf6K%&|bt>C2Xy`O{UcE;1H^pERq-)iUdTC@aDwi_mNb z2W|Wrcvs$xn$-o$$YFO4lBNKk{G%j-7m@+OV+!3};^N~`6Gi#+=}`n%cO~h(l8+9+ z|0c0k$hwVBS&o`Xgxs0@ecEJ)Eo_y0=0~7zvP)t5hb-ow@Z<*_*&3qOM?k>1UlmZR zsw$CA^NsV{H#03OcgU~aMo9aeGpu_K#0;JhkjUMr%*f3f92giG7&z&5y|0%V*4-5q z(w#yruOw4aQ}^r^T}wCxwG%LH&rhFX;^R#*>=6L!{BXMa;`MO(#v2L>7KKkXHa5h3 zgRlTbC1>VMMn+l@a&d-V0i&I$#Kg@(XZU64R|RM)D$dX9y}nS`+|+~@qmlinv9S>> z5n`(Svdk34uD{P>`p3+l`?q4f9j^Y=MDezDOF`~Sjg-Mew343$Q*K^$;Z8hVe)VWK zCvDmH?}Q^Vb0`q`{NB3Yr8eVOSv<#iZmsdU3It20^@9@@)LGd=NBDFfT)XyAUfvwM zs(ZtC392djOg`n9rL1l!I;~Ny&5!WotO|apA1r|eLQ)d(C+t3)x_p-}I_G}Akbpf% zJ4?QG!=HbgtkCYGH|@Ze%P3)$E~Tf~Q@+d6C@(I3B_ABPA471fgJkS7FdD6@tV~Hy zM}W-9E|0L#pg4`y9sHXb%kS21VH_cXRtORf&Dg)cu>B9Pt-U0<4)A;Sp2E8)K?z2L zD02)26T`yb8X2m{0nwjp#&Od7=l@Z{+S;y`64-klP}Jz~y@io_=ZT|ah4~{{PT_Q{USI+~ujkrc-X8M-a_slQh{*DZagIvd$%V**kbw{X?fbegHQstsien`LChm-voEo+B!2xJPia;dYn0|Y^h{2=!5;IY zhg@S`^Iq{_&~;fo%Lgb-O}VjLLb2_l1>9Ype^)NQ1p)+*Pq`J(-^codqT#c1$}7pf zO8?E7MKez7JPYxU$p{DZLBGh%oME?kn|+#v;CunogSvVJ+^Vq*T`2-x;P@!E<8Fq9 z8tN!<8(P>sUwpPbL32Gvnzg-Pa|+qhxoK)J=)|oCo`magPti}T1wpI5TYSsG5CAn09WMW5Jx9$s4BSC3a!-BeE)#54kv z+qgKc36kVVZFFobHe1Z@fCH*U!p#d83SiobvU7E${vHcU(apd$&;?57YwPNuzlF+Ir66Lx%qk=-pmA!V#%FXa)j9CFf z!Aj_D?1qa)b8|CG=*zu_W1743HtDXmBD)FPs%NbUa$(4w7p3|&Fbn(+w&UQY;Gl)m z;~)5q0~%yvViJ9Hk9YshPX2Dx(OS7KETpj{Kv-sf5~m78c1nua&$A$3ypTBNaTQW}8mTlXom)B7ELw3%ql1yY@OYYi9x(*L8iRUJyrhc5D-IUbQ z@|oC4Rv3ZvzdGR17sUfSssbUV?U24WQ$&V@9NRyw$M*s-+3*{`?_gxz4w1#Cg7*(t zWBK_!?vbu1ZT|i|-Tn|~J%Lk-Ny}HK+5T_A!VMT507$=;5OC{et@w)zg+9OfQD7e> zNS1yAYX&-ek%ztg*v{{ch?V^AbDSSO?I#VM=Q79^-UAoJ#XHegcwP^elareo_4GU0 z3hqWqAeaShlskukd=3l^C92We{~33x-=URjW7wWP;q3ejucyFRY#Cl?{MHlh41)4X z9rW~z(6xei<6255`&K|1~ zIu_dd{pp8ZiM>2!kGI79Gst{z!5co9G?<4>1PPhGj`_%gv4AZ%biD@|bAt?NU5Qvq z@_8luU5V&K@qdA?RsH;FgWzIgaz{uQ++8yDwYB+luih~+86U3IX=KiGSgp!;aDr8n z-qLi4boq}rJ|xRKv#JOBm)L1zaRSy`~}RkRd$+UUii z^5#~XMF)%lD6d+2fD6QQ*l@12%yj=&OdPbB!OxyjSb-%EkXIM>W5>3TJ5EOc{X>sm z4I~Wg9&kEN3$723ydkXtm!B<}G14Mf&MSTHyP?o=Sv^mduL6!O9cMa5CWiGTFcR!x zUtG7kXSj=wB3wOzmZIy7;r&KA*`u87?~U)>n_m7@al_MIeA4JIr1iw?U3`3|g+b!_ zYSFfBIiGwFI?kR&0p_%plyi&Q4n$AAVNE#!!7OY}HklwoXj6P1GBsh!fxyOo4D~R6 z(;8!>qxh!50ZJf+?E#XV6UY?9Slm0gIR}VHZ;gY@-t{cwO?0JyTkY{w zLr(Z*zNB1O{Il_H`GxG4pC<_1Ocv=njyxd=yHY}aN;Oieq(JbsA+x@+08B~gc2ut2 zVrOG473e51PlPiet?PVa4*8D6jI^`~STsmTNT3~nr2&pHI7bHJ@t$JJRKMSx5C~5m zS|%o%!-tIx7Dq3&qx91k&c~4n>cQ(D+W$XQrWPQnTIz#X$kyi`W1>I*cfft;f)fdL zHGg2EG_fX^ctQNotB}_0|k?dH0zsp@8JIO2-j`r zIOE~NXF$=@&wjOwro?9;oayfgq{xa<|G-^}HGl;mOU80cOOXb=^onxg;^GK(2NMl9 zQWvZYC&$PCB_BPJf!BL}MTLo)8YkHKWV>+~z^Qp2$`~XUJ$o9FlXFH}luD7~#toj} zYAjLZnXLtXD@ae5B@#jZ3Z2YfIs}>QF2|*iYK%@ngTPgXF;ze0FW0UaA`hLt`Cc$2 zfTHGE0WPYk_p18xKK&Z_oi*pM`o}ij0F4_V=2m4%RaJtmMFt4ExK`bdTyBb0&fwaS zoSK@8m@#Qquud2b=7ulbI9_MgT(!6~^B`K$$iQIL%(;sb4GIcbDNJEgk>9&RU(8mf z+8Y*UZ{1~DQVpf%2JhR8Z*B%t!!?A{70lI{nvky8whYtus^1g^RufZDiAn3^SmpPX z+>pL@Z5NaUjJY=(TZ@bPo3-fqtOXw-wq|4P1&EZ$!L}@UYv{>J{_aSJF!~5+duwZX zG2TCC-k+3_?pzEMRJ(aiv zI%!DVb!BUe{G?%fvw>12Y7ubb`b35vS{J4ACtKFD)b}bmGxJw|gN2>TaD|^mm(ylU zAqbRnF_M1PKjAug$H?e=F2_+4q~v~x|D6kudgf2sC7^)sU3|9|fMTtpsv5<%9Ho4e z88%<|KvT4yabQW%v`rU@CKW1hl8c4qC!gOq{tdGOOV`4Mp#;=x;s-I^Z;3R#fozFF z!kJm|2y(FW$LuqgZm%jYdeHh%K%Enmh<0rz=9`~$Hty?}yZMpdmS4|!D_3$i;7xG8D zeM0Q?uuRJbUZZAYVWC15+|X}il)Nd!_V*_u8ZD0HEJHgG* zw#+#!@Bqd+j^zKWorNn6A$0p*byO9;?cZ>*JRHAm1NV!DX0ud3K1*lnPP2NiShXVqh` zT#z*c51k7{T(e~#e|`Ftc>mc+E-u~sIm~BIU9dD0vj~%z>J(FsUl9`*zsRE;)tO>x zv3k>z`8<`N*`(Ei(LbQC$VVtvx3qjlRTx7F4Qo=8Yf{p+>R`6w(gJLmhu5!{_(viS z*H}-_$j}g}uAsQZho7LOAeT6%B_+j9YR<%is}(k#E;`TB@GxBXA-8^zul>i56X>Yn zfPrf^*GIXY(z4Fws^{Vl`lW{g0=BB55-RD*M?Ha}PCFrgtI>(X{<474^6;=PF4BTq z-Sh{~%I0NH#S;nO>G)4idjcicPPwOh#s=RP1Y?#^(D#54obG`6XP!AHH#dSo;CGw$ z_3Kq|3a($@xYO3c{vi#}s<;J^XIO!asF zDmDgogPm;)GBY<97Y;u~ZuBL)cI}FL`81~L`*--}AusM`AP93`VJQ3dj?;Z9EQTfd z?c9S2oA_ zEf}8J`n}otZ*#YsqF*VcFcBy&#&AtdEAoz+|1L6)N^r-}T6U(66uv!FbiQXq)QS-m z4F$y~%`LU!H%&~`b^CP)MxD9B^>v|_=Kw6D$v)@Es1$kARH=G5JrCdEBS*M>FPq@F zbR2CM!DGbDxY_M6M+ER$^8138ca@p;;Lh~4G>3_%xle*jzHTs|QgYS;0=%}o+mGDT z-l2VX6xBEzTY;_+ZWV<1NI9^(9)Ht%^~U2tf8bmHash6{Lm;B21JAJyI~RLG;2F`| zw|(&^GfPm`Oj^qGON2iD9H65c8XO$z?+=fZ`ruiwt>c-XnHQ-#KlRL;%ho~V@{^cn zMLmGdL7LFae30_^myRfZU4PzyLH`?;1|jZ`des5h-8X+T!@ShAAxem9VTAvrh)9sj zJ4O{SQLhuZ)hM~x-&56A`meeGQa0^)yptp)!inzf5*iw`;~(i01m)&z5Exx?oVlD- za3rlG)yg2TPs`26*zX;taywXS-10SuC;+G@QbuyWoNSE%#D~QBqJ0)-ziqA(R~L7* zw!L$qFo(C;}T^%_cB(w`e^9aue%G@W<{wi$A^WjCl3e?8k zdN?Q(i8QQhkHKyrv?b}drlg2br5T?&$HF2-cO^tN{a$Ub3z3jlA9;pK?)vrY;4XI1 zyONfMg1Z_MrTa=OB_sy-*J5Cb+1wS<{T6U$N^-%b%c-mH74ypeTC)Pv&NR-qE)cLz z3^l)YK{BT0+R_Qa%0ja%w9!NXDD7auOH=!D?;L|r+-2g%Mju)dm*M#lFtar;I>+gi zI}<@8b=X+DMfgxoH#xaQddu>UH|?(MEG)4aIX%SwZdt^BcQy1O@yv97*l~15(HTx= zXAG)T2^2er1svBd5LA*vE8e8TI@N zaG|WLD=PGFb#b3Onf0J&7A$<`^Nw*FZwMz&2(q!^-t;-yufyQiwM)8TZEb5~o(GOq zxJiEtAos!Kx;skKxw!b8wUw2w_>Zdca$X*uyR780d6%`+)w#R|U5ORD{p;|vy0*P~ ziuNHfFNz%(*U6L6kZ<4qmxZmlN=MJgXui3zO+QP=&TiFwDg0k(k&X;!Yc!NEP?=<4nG9vyTSMLFiW&8gDtDd41GRq7_c4d{_ zZD+5fY}qR-dlV9qP4?!t$=*qly~*Bt@6G$Y>G!_>n>%Ok@{GQ+O8H?S< z`@anhuUlDehP-$X*Y4t{0crj750W6UU&ipU?0J7|SFCk0U=2+~vrDJBEwJZZ5iDWZC(0eeCu_*WuLeLI@g!1j{;o(S> zMBHa8svN*gxU9c|X_nA^Lf1*hf)=S==*Z?4`3h0#QSP z^q4?0^+ZI3SaVWNfObE>-oyub(5Q1Zcj1IQ@JXl(u`1tf0;0xOFO*}y6&MUOwT3E# zo=%A2_TFA=OA8g1+K9677f>2gpbsT&%k-3i=4zhSsZet6nb8Cb9-d&TFk`XiYbcQ- z2vdiBKf_(ne*NtUg31VBCskGKx0Nz?7sK@%zQzJ)m{s_Nq(qI2%d=-?EziCGbjbd? zndtBW1z+Or$Xq0YYRk3m8!HoxvfjQv|3P38h3DJ)`7<5$+l>CjJ{wtzf&RVT8eJNi zT$g9)|5-P+v&eeNsi7yV_cjogmvc$_ify+s=m7lwH7VJOx^I8!Mkc!s;I{raRnN}v z8$Dn%U(@5@AZ!_U%mj+nJvpW_LK!Tox#}z5zb9wd!Rl$r%NX+WKwRohbSQb*+wk}A zdXXLIvD-7n(&vFpNjJ1ES_%P}^XG?v|L1R9kEs@c)EE_o37=Chz5FK>Z}+L3oyn*s zx9nT)W#krR2#e13>icTv9~f(ynEFL=ve;NIPEX3O6$xhMNG|o6wS@Qf^vK%ielM{4 z{0B6VicnXv==IXMy(b-CLh0}L@-Znx$NvzuJS(HiJ)~ceJQGScX49is7`w;!wY2`7H2-L{rnWPxuRo=Fu7! z`Y{!Hrp9&_#+nr{76}#e!NlZ0K7b; zeJJgTm;iRc%qCaC$>k2uT209~zAD4+R2Y{)4g`M1K+7cn+_Q0gizAanXZj05HSxwdi+>6D+p77_fD;LdZnv|kmCmp5V4n*R#%Crd~Zg3 zQKiTZeWBoA?@4C>R|2qBo#a$2wON_~tun)Ik-k@jO#ln6w%fp^6jD<=fiS>GD6#R7 zhw}dY=}8&>6EUVscmxE(p>t5yK`-~?;yT!eHEiUnmTmT4u1S-jM(Ph79Mco-%T=s5 zzWsh<1*mj0+z*kNnJ~#WhK4V$_ge^qTXXFxg9O4fzJyG9MW#C&LN~8Ldtku#`@;OY zGiBtyVXnG3H5K_S;^|gRqEoIbMHM8Z`lbD*H6X6C7toec!d*5;B|uU|%&3u7)3GG#TFSTFS@yeYw&c>_|M z@>+}PRiq4sU+zrEC8YcWA`-F2N#mwFx$!Rq|@8T;-+KjANS?m9_4U&d)|0 zn23p^>3kwYD}*RRyf*Zx^k`b<^0x$ zE34wOG1@U|r4|uh8DvIABC=drNjE*?d$K&8O-4e3%0!NcT<^i{Pl-VRI9)ZaXK+BE z(CLiQ@W7u?CcC<_2zy}?eMBzu5rvz9H%AJ`&Pcw_Tm=9^IL-rA~Iia&S0Xb3rJDretTUyrfBce>J)3GQ&48 zn-voi0}xND)SLIKH)WOQ@bN3LG5)5fH^x5FdK8{1j^X`PI`8}8_U!NTZ4&?A!}TjE zxETM{*4Fy?@CAy2pj>odAoNj%Y}t@k;9<1RZGj9j_@-chmNVoKtPzssf+$pklemh? zz-+4*BaC+tiBn9e3oy?dM$yY_1jMvI2Vdn@0~yI zo`?U!BE%w)3Ly7S+xO&n{P;E`Wa2O=HsQtZEn08o zq|~eB-2+vp0JVy+{$a*Az$(^g)$vJ46v!pwhQ((xno^!fm+b)6FWly`XSI%xIj=;=}7aY91>QU0o}trqsB zsE+m-T%`d#2%@5>s25gz!hjE_0G?i zyeT#r%GZf1F9*VL!q>0TW@f8^Wr1J&+>b(__tBl3WvbE`a?1Jzud)KEc_G0}`D^|n zG)V#@Ftq33a?RvkM9-x+1>Ze~(FA+}2AP-V=n(*YvX}Na98oJXy=#901&oF!Tuyih zNXBj>y1H30Kr^IoCi7@>3lquom4L}d0z?v<#-g3($S`c&@$VkUQ_*EuUY%+{&R_$j z6WFb5FjI#K(Q;RPXH%2W$zhq~tSiM@t_D9R14Bvjbe%}k#s>H*tkQ__M%N_SquUl05HLA2V|#jhYnlF{e2`^F#Rv3V9$RMU z&m=uLSsS*8*+g>O*!tl5u$8JRX%Ue|iCG(r7Sz>GhKC*AudOalOsvA6=^jrUP`#Q0 z1w6)de31eStQ**_Vi+5{t1gT(U zbqanmoIw4t-}GWSrJ_>LeUZr1S9;o50^%>=2*!Ifbh( zKtQ7OfG*MZfn^|flv_O?nF0X9_;}vi#vpKy0^we;^7Ck(=_0!UA;<`{(5(@lWyQ9z zTv{VlIE?kg&99*$-^Rdzg#0vCNgSz(=qUAXeD9JK}_me}K&Sm-GNAE*}@7_Y$}&a$V7 zWu(A|5CeoP@(M?knxZ0Oc=O$xBCz1ihf9Sqz>a4Y0!BI(WNOGqpP@DjRtSf#by{j_ zwZl%+@86${Tu%;LDO`_Ls`a5#KR%`*A$B?8>=>;YVMYailfgpW?o=iZ9LJ-tV5c?t z?l1q@a*1|*F3=dOtNAlCGbQfhF5V`3mAadW+Y zZ?$BxF*)<+PdNV>PmPxB&_2LJY_g7a z+|K5byXr#96j`Hq+0Ea(e)5K^w}O&U&x=b+dL|~*h3ekFEGO{YL5E}Xg*l*0=#>FQ+z?uzJ!`8_TWG&NgdR|WB^FMR(8eWUEUb@U{OxP zyuhD=|2oFsU0(Ao9q>=>PCa1KI9-A^CBU*8{H#taUHQhowR66VhEXx>EkEC>8-%Bv( zzTE44ezu~G)pf|4cibxht6x_eyc&hH9GEM#M(yFb*UG*uXDPE@ctQ!D?sHy1ll@pb zfoz`uE>Uc8*9P1vw5}b%Xuv!Rsotj@zLhW%yKqm}~|h zI0{V$EI}l{X94g;Kyd)g9Wh&GWF17&larIA#6%E(FH4PSlikH9Y>hS{ss18bYh~m?Or34yPq1~{9%g2FS>uYsL=FGr^5=73)bivNbj#;!|6k&*IJt>4#f%8KWz z$9R8!`qV)7o_j)K^xaF<3I+m1;<2SwMcu7X1`Fe-|h6gX`pe8>MM!kw9VRu&bKpQHDXOtGoH-<_=gufm64=-F6IQ z;d*+hLh_L2Z*PnsLIFqw1Uq1E$y9?QXm?i^Aao$##`gpAg*?jhtI(-EI(j%d8dyuv z6leztjh6Jf={?Y>ot8LW}n?8#yd0R9syCG6Z(Qi?{FEQ$5+7j(@Jz%WcBW z-;2JkO}EduAiiM%u?RP`H79%LL$cR>%AU#C(Q|j$LpuOo0D< zAf3V|A0hV5k;;UGSg~K27_W@9h!1gM_vs%#{L|Q&z>eQzfAd=1$jAxwxWN=}3OsSEDl0)oSV>V)$QFe|jBf=# z|K#K^wrg;gxowP04e62}UqN%qgu1Q4U&Cy`@=t?4$YS8R9GQwrN>0vqs?W8XV`HrE zt-lkop-}XNwurG&hWQxztE#%x6y0hE0tt-Hj&V?FBmLiT)oXUV|D2JK;okT>t%l!M z>8B2CzZ%kPZ)MNP`yofneSA|OUbu0|gpWny1mQZT+~_y^>rm=AM(61nMEqyx)@c3c zeUC>fq*r{Uw`ne+Azin(3&WYVxb5Dx=BPENhXFD5WV0E3K7Yd+|Fmj-{^W}=ZyXB@ z>^r%@m{gJ`Njg2n492TaN$gzms)MyK3664r8LI|kSn#)mr0T7{es>HC5E7DISZLjw zp$2ta+T*&v`6ryFuf=p=EmcNGAH$K`4q?C7=2(WG>H5u^98bEU9_ws(CN0Ut3?5JU zyYrRM^9%HX*wybZ8&Kg&OG*|wlLJFI1_U=uhwb9auU&8&-24|7Ezz--Ehc{YfoPJy z#?IbYVpZ2#rtV3n9t4CiUNfEI?LZ_Qa4 zOp(?`9Jx3-<7VHT->E|FPBJuN(hmXx7%&M+cyZ)`prizHK|V}HtVP`&es*-cgHsG3 zIFPvf00wAPd{7lYp@u%zyB5? z7ED8Ua%5XlVs5J6FR4U8@lBw0b7R43eY}i}`)iIm@6wSd19O2}J|HPWxIA@h=a*`%Eie-$l5 zT1_;W)*ze-i>Ri&qo;PQIR+}9qQg*M1xHrOHPsFGl}z{w$ROAUEtT_F__; zz}tHqGcq!q53P#|@jD4L>wQ*|M0Qv?=eh~dh~uI03SB1(JUn9~qb`7%0I(H|4V7nq zg4qFJ00HyL0k&-|l5YXfINhTpC6$dR0nw)QbuSnNiHmD1DBuC_2(o;z42vV-VA~dP zaw4Vt)ta3Kxc1&xfQmmk^n=BHA80)!B;G;@T3TA2DWAPLC`fGAP5~eb|E#a6+3{Uh zBE66}EZE-{kAePBy~-!F@dbDsUMq*BmYCl~Gfnz^dHL{K+|~G?r=+_O8K7VD*<1X3 zA->C;fl2Xe&2b9V96k1wi?ZIWy{mU-cWn*ach)_wk6!+8y%)HQr64(5Yznkjn|N+b zT_{DK-1!0^VnPY`RYo+~lIw3A^nL5_)T50S$0ab5f|OO*2`$PZ4-Pz2QglQ8-`@T6 zKPnyCwFcJiiLdphRX2bpzH_Y1%PTx0TK*JxE~fg-=BgAhGc)Hnwbz`Da_TnSx81Au34=Nb zW@k{43v}WVJDd!;-uJ)>iish*z41b>M_G0~76;;#sZO`Sw3rMDi3CZMh|kn>U>FbDrI~lWg#8w|&O5xj6eZpH16#U{8+Q4Q6MW&@~R*jagIIwy5nXfooHE zpYj13%101qm!2k%lQD6h)7vvdlpu#Y;b0yPaa~?7>M)SLBnVB(D{u*+OkBCqK zb6WnhXkf976f+6j8y^}NxQ%FPY9eIWb=_GcpiEZE41+>Zl7{-}zP9K0A2+@iY{|=a zrMt>2bSua|LFz0n;80Un>9rDLlgygwbOWBf>+hXrCjryii9Beh=ee9z0{}gWC5QS{ zT-5(suG&#}e!h!{2#3G^E7rT`84TJu-WR_e$L)FR*_I;l;7<_rs+{gx!Cy8>4toh8 z&|Bmy(lf~^D5QWaZI2dx25~Bfb5LxI-O>6QYfUKqv4NMoO$zKo1+uwC2 zitp|g7mA!O736bRD#XBeyK&W}J&r$({Wcp0q+#H<)YfJOT?YsO6=3i8>eb)V69AWw z$zT{l*9RC^!c>8>57{_5=Pb*t=YaUUO4 zKSUr=MSM<66BYZD0`k*%2v~cdW|r8l2IL%#p4wC?S9!;5+r?>3GqY0=3-_s?gk!s` zYzL5{P`*Rowj3;J>zy~pYu#_$xbZaFr}^#l>@1U7`4^u;yA6b}7r1=O_Bum3Z`SkY zqtSA2Gj!4-AV|Z^;s(ZF5mZx(Mrnl8pu-KigK+%eAYjlU6}uc27zh|l`at}v|B=G{ z9|r6#?JQ1v%nT16sL?YeTmuO_9B(_QfBcx#f&rO(UWv77j$NY zn?e&Tr^+adN}XsK9LJL9(w@{$tWBETedF|Aw3_#*ZF#^}#A2`{eCji06@OVt?9Y?+ zIrOjp-A2%yJbgD5w}ouub9Z?Eju?2vtojqFr{p7lP1uFc@{CrDfF;UzTU5DHh)`}mt5-OcH%ci^c% zZw`~%-m#hgdJfc=je#SC4F}^t(8}{sfb%0bSV2({To(*luig@C29$rX$->-RcwF2W zJR@Mdj8@p11B}`S3kaz^t%{CTm6B=&dy>VJAl$pb=?IL*=4O~WUQ)s_FfmCiEe4b#yaRwh zH!&;bCMPWqHkC4*e|k_nBefCcyyo6GW2BJwWWcNTK~N&d41sSi4gx+N5DW!v9?}JZ z#L@>GRC9+fPD4>qatAUo^qccF;05a8@hdCKgq?jC$l@53;8h$Odjg6x)0R}>&7fu* z8w){14@&qvS?Fu9BbrK8rI?jLF@LzX_xb%N5NZj$?V!osbi#?YUIl5&x5w%rN2zuo zb$sK-sDg&3?WzeN|J7RmQH|YX@`^dYSABK9QxnVUWY<(%z|EB`J5Z-!09QN^dJ*B6 zCcxj66l@RevA;bT;;0eHoI+W}BP$Ee3tVADg}&dU&|Bcv=!^71hTP)z^ApzdLBV zpn^><%w=o%#%22NXKH!zFrN$&yavOu6NoWx#BU9doZ22<+V*3h)#!=I2_Q$XuQMCi z97qAeFT55>@%Jy?+IKpI41^$!D)2K7E)fx&Nn7RnZ1_p}C;1Hsm-dQq$(%w7yvr&69gRDX@E@HIWS)z!|%tUEo5Yiy%*Z^Mw;!MM@ zU-AUD(2^r4r>k^jNx%a4fcRp4^WKcm>gt5V8g0zIfB;`?a*yzuu)#imoS<(HIoQ}F zB^*UD7EoQtNa7??BL;qsH?1AAoKNjUXZnWGkR;czmf<=UKp)S1v~oQ&2GDEH&dS#F z9hRt)U;KiAg%-zd6f&1A-hBD;Wi>Uj!J?xNt54&g&tz>QQQh&Js&SyuFwI|PO*$s; za|@spEX%3UdM-(krqS|ptAC4H=QuXc+@0bd&|em7m#aIJZ@7E+S>11@N~e|4UvaJl zYaQQ}FqdT1ad)`B;&f$rvXAv3ogCj(==D4|i7s{epm8hIy@l+(um|d13Pmx_A=l?owSp<{05FT@D>z{)~jsVom zJx)*1>gt^MK49d5Llc~yRL67{ zgR3(x0{V6~)}?fGjUG53+%ytofG@h(Qws!ar2FU3pXcW}f%cUktx?^QfCXy`UVP6! zi~Ulrgfb@~J6q`#qWW{*z)wSJNLNKA75>ww?|L&vpa}wNUZRE{=#HS6E+Z_gyFNbp z;^qZ91}zR4IGE7F|A}baUPzj6+f)H;id6PCCRt1C&W#)2p(DGxJp97D3@x5qerBF+ zMAl@Fap>zfY6;aEO;WY^jxLj_B0`c{q-|Dr0s>Y`F4zf_u&`QR+j+5LtAZ--kZG`}eMl){jwn{M|hf z6jqutHiu@9Q3U{il$2DSKj*}EJcLtesu>@3K}f5`#T%ruY0zo|Sr#tc{8v2W*uZ6h zmu$bMC$Ei-jereB&$aY)3PL81#}lFEa2lN%pRNCR2|W={V;!9-3`!tMdf;GUT4kg> zAyJWuSsY68TIxx6@dyBJ#*ZHY8EOxY*F!`AvN@XuCpQj4Qj(7`B|5-O13N)WPDxiP z`sw~?)o18#Ie!;)aiO$%r1g=rI^crghrA`PzzVh1P;CNxoOz{wyLkDO6A>q;C{6HP zd~5erAVOn5GC9hjzDXcny|2|lYCoXNG2YbJn1+?y)y{mVH}dxj4(?rm#=VQ$h}o!UN!UzUv~E>?rkp<;*5jbgGiBN z+^J(6A0DSESNuba^T3KcLFF^?5B8cO8fPb>PY>&VIXkmBv0}sGC$+J{BlL(T5#k4}jmRgx*(Q%QSTrL16F({>? zUgIHvFn^sA*BgW`N`EpEkf+`AfY=_3qit$BGt=vj14xv{`FR5{fJFf%uqc7al?1Ub z4zwz>rEI|P-3bPD>?e=V7C!-Q2*O)m&dAmVD1(ozbn9!w(3PwVb-6&i$D6i1_;}UT z@~IKS%VVDRCTGwF7%HLYBFk8W1dhwLxZ)jfD$!(bm41?XU4HTcqfzXpqmu<+V7PO_ z)~a(_y1O))Y5El`FDZ<&tu=-EHpi7gHfoPbiS}}vIg111k~O~PWNgNR^Oy=IBlgi; z`w0;bDDUr$G}DF?-A3GO;pSX;GQ~X#pqL&ba6&O2t=!1hAyQ!^98o#HKzbmK2*8g| zN=t(V1dJnZc)~am^`(q@a1n6-Xx7DEQC*FtrXVOtL+A^_EB6EO0mcWKY+$pS^iuI) zA#Fnuy?)jXW~)A5T_j9X_`t{=Atv;z0LGX=(m|jAUgkB~i4MCGYAR2U;Z`SSRFUiXAWa~#q?1a+rNEs*S&Tf00?TO)(hW(6b?d!5t4*p zCA?O{^Yp2Z#RO808tL$}%!&vo=Ws>Pm+j~v0gROKX&QzAElu#k948|^J;(j&mj}C< z%5{W{`vq2WVB4eNAbWw#Knq#uNZ7i4J6Aa;8q}dyR#&sq(yGkI?m__&4$t-1q^(Ts zINlvJsVzI9`h+qi`7bxJG!uh0l&;;*NO!b(ln z1MX)?&le3s)4_v&evg2=E_EK4g8_51*Dl4x5Nb3ZS+p}Kf+48Fj|Z;$Edi4LFrh|L~DH(S~*-ok5hUMGo<~Y|=*Ci@`$K6UtTO!cH&4^tGBnS}; z75HO=8i>Lbep3LVCAKRu(e-*6_O8UpB26>VYD4`@YW zrG2<)83GMnOUDm}XWe}D{Yku&41Dje+Frj?<^H*uRUX#`Ld2icl@H2@wHgfm)P&lB zGW&$^_N;HO^0QB5nUz`jYXTOBhkskHe(5AgRj)bdIBfN5Dk(HHEtn7AxH@2g-FBiX zA5!-=y@aIHtA4g`8nyF`uBt(oaj@VO{pAmhaJ3+24^pkd=YtkBH<>yt7XfT2a9q&& z1I2_efG?KFetz2YpeKnsGHLKBH3qALcxUZL{<^w2277h1CfF&!3&T(2AvfP$1{j32 zav{k5JdhwPHq=o*r3dO6up@1Nl-y(HsAv=C=~+KmlnF`(>GOIzI0{pf?TSeb)q=u|=cP;BR#saWl-;Q(JhrQ(0MnaCi9(o@dv`S@q4wZtO`%Zah?z0$MSEgum1lys<1m}6Fsi6lS!^Yj-~R3(n2rVFp9OG#z5HruYwt!}d|i|M1k zL0~9>{hE>V9@*~rtP3yi$|kQX@lZ{Te#vG*OC0a+YH!VpEsf!4d@q9HBryy}_OO}U zf3xpG4IIw_VQC0R2!Yf~l>jdagN{Q$z>xJEYK)1t@0#aM(E(y_;9n(Zk@0Z7;Cn`< zFEQ$C0!&&bXEl3DUz@|vdi(nghj!6tWNzJx4iDG&Cm(^Q<>Yj2Ze|9=nc)lz&HbtX z(f|y~%#eDwG&N0H79m9lec82t<=v+K1lkUBb42iM&X#X%;68$2KRDCUGBHU(3|v?M zA_<*3@VNzLJIefXUssk+3X(`mtHnf@&;H-Rw-bSHJ+PFv0U`z<)bPd^pqmIykeU