From 7cf7ea805146626de95516dd47619bdd0082737a Mon Sep 17 00:00:00 2001 From: Nico77600 <195452170+Nico77600@users.noreply.github.com> Date: Thu, 15 Oct 2026 22:53:34 +0100 Subject: [PATCH] Reorganize signed PRA package and virtualize high-volume reports --- .gitattributes | 40 + .github/ci.json | 6 +- CHANGELOG.md | 352 +- README.md | 67 +- docs/images/report-warning.png | Bin 217660 -> 0 bytes docs/images/report.png | Bin 207473 -> 0 bytes module/PRA.Gui.Directory.ps1 | 37 - .../Invoke-PraRemoteMailbox.ps1 | 203 +- package/LICENSE | 21 + package/PackageIntegrity.psd1 | 218 ++ package/README.md | 77 + .../config}/PraRemoteMailbox.config.psd1 | 6 +- .../config}/SharedPermissions.sample.csv | 4 +- {config => package/config}/Targets.sample.csv | 6 +- .../docs}/PraRemoteMailbox-Guide.html | 444 ++- .../docs}/PraRemoteMailbox-Guide.md | 1787 ++++----- .../docs}/images/console-apply.png | Bin .../docs}/images/console-preview.png | Bin {docs => package/docs}/images/gui-fluent.png | Bin .../docs}/images/readme-banner-dark.png | Bin .../docs}/images/readme-banner-light.png | Bin .../docs}/images/readme-flows-dark.png | Bin .../docs}/images/readme-flows-light.png | Bin .../docs}/images/readme-how-dark.png | Bin .../docs}/images/readme-how-light.png | Bin .../docs}/images/readme-permissions-dark.png | Bin .../docs}/images/readme-permissions-light.png | Bin .../docs}/images/readme-principles-dark.png | Bin .../docs}/images/readme-principles-light.png | Bin package/docs/images/report-warning.png | Bin 0 -> 226057 bytes package/docs/images/report.png | Bin 0 -> 236744 bytes {module => package/module}/PRA.Backup.psm1 | 1727 +++++---- {module => package/module}/PRA.Cloud.psm1 | 2225 ++++++----- {module => package/module}/PRA.Common.psm1 | 2460 +++++++----- {module => package/module}/PRA.Directory.psm1 | 3423 +++++++++-------- package/module/PRA.Gui.Directory.ps1 | 234 ++ {module => package/module}/PRA.Gui.psm1 | 2081 +++++----- {module => package/module}/PRA.Gui.xaml | 384 +- package/module/Test-PackageIntegrity.ps1 | 328 ++ package/templates/Report.template.html | 480 +++ templates/Report.template.html | 112 - tests/IntegrityFixture.ps1 | 105 + tests/Invoke-TestGate.ps1 | 14 +- tests/PackageIntegrity.Tests.ps1 | 355 ++ tests/PraRemoteMailbox.Gui.Tests.ps1 | 9 +- tests/PraRemoteMailbox.Tests.ps1 | 264 +- tests/PraReport.Tests.ps1 | 179 + tests/ReportFixture.ps1 | 119 + tools/Build-Documentation.ps1 | 6 +- tools/New-PraPackage.ps1 | 68 +- tools/New-ReadmeImages.ps1 | 10 +- 51 files changed, 10802 insertions(+), 7049 deletions(-) create mode 100644 .gitattributes delete mode 100644 docs/images/report-warning.png delete mode 100644 docs/images/report.png delete mode 100644 module/PRA.Gui.Directory.ps1 rename Invoke-PraRemoteMailbox.ps1 => package/Invoke-PraRemoteMailbox.ps1 (80%) create mode 100644 package/LICENSE create mode 100644 package/PackageIntegrity.psd1 create mode 100644 package/README.md rename {config => package/config}/PraRemoteMailbox.config.psd1 (97%) rename {config => package/config}/SharedPermissions.sample.csv (97%) rename {config => package/config}/Targets.sample.csv (94%) rename {docs => package/docs}/PraRemoteMailbox-Guide.html (56%) rename {docs => package/docs}/PraRemoteMailbox-Guide.md (91%) rename {docs => package/docs}/images/console-apply.png (100%) rename {docs => package/docs}/images/console-preview.png (100%) rename {docs => package/docs}/images/gui-fluent.png (100%) rename {docs => package/docs}/images/readme-banner-dark.png (100%) rename {docs => package/docs}/images/readme-banner-light.png (100%) rename {docs => package/docs}/images/readme-flows-dark.png (100%) rename {docs => package/docs}/images/readme-flows-light.png (100%) rename {docs => package/docs}/images/readme-how-dark.png (100%) rename {docs => package/docs}/images/readme-how-light.png (100%) rename {docs => package/docs}/images/readme-permissions-dark.png (100%) rename {docs => package/docs}/images/readme-permissions-light.png (100%) rename {docs => package/docs}/images/readme-principles-dark.png (100%) rename {docs => package/docs}/images/readme-principles-light.png (100%) create mode 100644 package/docs/images/report-warning.png create mode 100644 package/docs/images/report.png rename {module => package/module}/PRA.Backup.psm1 (76%) rename {module => package/module}/PRA.Cloud.psm1 (84%) rename {module => package/module}/PRA.Common.psm1 (63%) rename {module => package/module}/PRA.Directory.psm1 (87%) create mode 100644 package/module/PRA.Gui.Directory.ps1 rename {module => package/module}/PRA.Gui.psm1 (80%) rename {module => package/module}/PRA.Gui.xaml (98%) create mode 100644 package/module/Test-PackageIntegrity.ps1 create mode 100644 package/templates/Report.template.html delete mode 100644 templates/Report.template.html create mode 100644 tests/IntegrityFixture.ps1 create mode 100644 tests/PackageIntegrity.Tests.ps1 create mode 100644 tests/PraReport.Tests.ps1 create mode 100644 tests/ReportFixture.ps1 diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..237eb06 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,40 @@ +# Signed and hashed package files are byte-exact: no end-of-line conversion, so the Authenticode signature and the manifest SHA256 stay valid. +# Do not add a global autocrlf rule for these paths. +package/docs/** linguist-documentation + +# Owner-signed files (eight PowerShell files and the manifest); cr-at-eol because their working-tree line endings are CRLF. +package/Invoke-PraRemoteMailbox.ps1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/PRA.Common.psm1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/PRA.Directory.psm1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/PRA.Backup.psm1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/PRA.Cloud.psm1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/PRA.Gui.psm1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/PRA.Gui.Directory.ps1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/module/Test-PackageIntegrity.ps1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/PackageIntegrity.psd1 -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol + +# Stable hashed files (SHA256 in the signed manifest) and the distribution copy of the changelog. +package/module/PRA.Gui.xaml -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/templates/Report.template.html -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/config/Targets.sample.csv -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/config/SharedPermissions.sample.csv -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/README.md -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/LICENSE -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/docs/PraRemoteMailbox-Guide.html -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/docs/PraRemoteMailbox-Guide.md -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol +package/docs/images/console-apply.png -text +package/docs/images/console-preview.png -text +package/docs/images/gui-fluent.png -text +package/docs/images/readme-banner-dark.png -text +package/docs/images/readme-banner-light.png -text +package/docs/images/readme-flows-dark.png -text +package/docs/images/readme-flows-light.png -text +package/docs/images/readme-how-dark.png -text +package/docs/images/readme-how-light.png -text +package/docs/images/readme-permissions-dark.png -text +package/docs/images/readme-permissions-light.png -text +package/docs/images/readme-principles-dark.png -text +package/docs/images/readme-principles-light.png -text +package/docs/images/report-warning.png -text +package/docs/images/report.png -text +CHANGELOG.md -text whitespace=blank-at-eol,space-before-tab,blank-at-eof,cr-at-eol diff --git a/.github/ci.json b/.github/ci.json index b9f16fe..48bc505 100644 --- a/.github/ci.json +++ b/.github/ci.json @@ -1,10 +1,12 @@ { - "runtimeRoot": ".", + "runtimeRoot": "package", "testMode": "gate", "testEntry": "tests/Invoke-TestGate.ps1", "tests": [ "tests/PraRemoteMailbox.Tests.ps1", - "tests/PraRemoteMailbox.Gui.Tests.ps1" + "tests/PraRemoteMailbox.Gui.Tests.ps1", + "tests/PackageIntegrity.Tests.ps1", + "tests/PraReport.Tests.ps1" ], "packageBuilder": "tools/New-PraPackage.ps1", "packageEntry": "Invoke-PraRemoteMailbox.ps1" diff --git a/CHANGELOG.md b/CHANGELOG.md index ca46997..6e01476 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,156 +1,196 @@ -# Changelog - -All notable changes of PRA Remote Mailbox. Author: Nicolas Fabert. Versions follow `MAJOR.MINOR.PATCH`: -a MAJOR version changes the command line or the configuration file, a MINOR version adds a feature, -a PATCH version fixes a defect. The backup formats have their own version (see the guide, annex D). - -## 2.1.0 — 2026-10-09 - -### Added -- **Direct target selection for Convert AD/Both:** configuration, OU (DN or read-only directory - picker) and CSV (Identity column, comma/semicolon). Run-specific `-SearchBase`/`-CsvPath` overrides - never rewrite the configuration; source/file changes invalidate Preview. Users and shared - mailboxes continue through the same eligibility, duplicate and backup guards. -- **WPF window** (`-Gui`) for Convert, Recover, Finalize and Check, with explicit AD + cloud, AD-only - and cloud-only execution. Native Fluent with PowerShell 7.5+; compatible WPF controls with Windows - PowerShell 5.1. Every operation still runs the existing Windows PowerShell 5.1 engine. -- Preview before Apply, typed confirmation, batch selection, progress and activity, result rows, - log/report access and the next-server handoff instructions. Changing the request or its input - files invalidates the preview. A failed or incomplete preview never authorizes Apply. -- Optional structured JSONL events from the common module for the window; ordinary CLI output, - reports, transcripts and backup formats stay unchanged. GUI module and XAML included in packaging. -- Offline GUI Pester suite and regressions for event/result coherence and split recovery. - -### Changed -- **Recover -Phase Cloud now always packages final AD restoration**, even when ActiveDirectory is - installed and `DeferOnPremRestore = $false`. Run Finalize on the AD server using the package printed - in the result. Phase Both retains its existing inline restoration unless explicitly deferred. -- `-Gui` can run in either PowerShell edition; actual command-line operations still require Desktop. - No GUI action runs live on startup, and the window cannot close while its engine is running. - -### Fixed -- Large-batch receipt fingerprints and raw backup validation avoid redundant per-string - PowerShell binding and regex callbacks. Structural hashes, raw XML bytes, live tamper checks - and the existing memory/time watchdogs remain unchanged. -- The offline gate validates structured help metadata instead of matching localized headings. - French and English help both pass, while a missing synopsis, insufficient examples or a missing - real `WhatIf` parameter still fail the gate. - -This version has offline validation only; no new live-tenant campaign has been performed. - -## 2.0.1 — 2026-10-07 - -### Fixed -- **Scheduled task / `powershell.exe -File`:** Windows PowerShell 5.1 leaves `$PSScriptRoot` empty in the - default values of `param()` when a script runs with `-File`. The default `-ConfigPath` of - `Invoke-PraRemoteMailbox.ps1` (and `-Source` / `-Destination` of `tools\Build-Documentation.ps1`) was built - there, so the script stopped at once with `Join-Path: Cannot bind argument to parameter 'Path' because it is an - empty string`. The defaults are now resolved in the script body; an explicit `-ConfigPath` behaves as before. - Found while building the scenario 2 tool (PRA Cloud Mailbox), whose Collect runs as a scheduled task. - -### Tests -- New block "Scripts start with powershell.exe -File (scheduled task)": no `param()` default of the entry script - or of the tools may read `$PSScriptRoot`, `$PSCommandPath` or `$MyInvocation`. - -## 2.0.0 — 2026-10-01 - -Rewrite of the operator experience on the model of Purview DLP Report: one entry script driven by the -configuration file, a readable console, one guide. **The safety engine is unchanged** (backup before -any write, receipts and SHA-256, AD proofs, stop at the first error); backups written by 1.3.x are read -by 2.0.0 (tested in the lab: Recover of a 1.3.6 batch). - -### Changed — command line and files (breaking) - -| 1.3.6 | 2.0.0 | -|---|---| -| `PRA-RemoteMailbox.ps1` in `release\` | `Invoke-PraRemoteMailbox.ps1` at the root of the tool folder | -| `config\DRP-Config.psd1` | `config\PraRemoteMailbox.config.psd1` (English comments, unknown keys refused) | -| `-Action Convert\|Recover\|CloudCheck` | `-Action Convert\|Recover\|Finalize\|Check` | -| `-Mode Inventory\|Simulate\|Apply` (default Inventory) | `-Mode Preview\|Apply` (default Preview); `-WhatIf` = Preview | -| `-Phase Both\|AD\|Cloud\|Finalize\|TagCleanup` | `-Phase Both\|AD\|Cloud`, default `Execution.Phase`; Finalize is an action | -| `-BackupFile ` + `-StateFile ` | `-Batch ` (the 8 characters printed at the end of the previous step) or a path | -| `-MailboxScope` | `-Scope` | -| `-CloudCheckScope`, `-VerifyRetention` | `-Expect Provisioned\|Deprovisioned\|Retained` | -| `-SyncADConnect` | `EntraConnect.Sync` (default `$true`), local or remote (`EntraConnect.Server`) | -| `-DeferSharedRestore`, `-KeepCloudShared` | `SharedMailbox.DeferOnPremRestore`, `SharedMailbox.KeepCloudSharedOnRecover` | -| `-DomainController`, `-BackupDirectory`, `-LogPath`, `-TranscriptPath`, `-ReportDirectory`, `-NoReport`, `-IntervalMinutes`, `-TimeoutMinutes` | configuration only: `DomainController`, `Storage`, `Logging`, `Report`, `Polling` | -| `-SkipCloudCheck`, `-DeprovisionCloudShared` (obsolete aliases) | removed | -| `ADConnect.WaitForSync`, `SharedMailbox.VerifyTrusteeInCloud` (ignored by 1.3.x) | removed (the tool always waits; trustees are always checked) | -| exit code 0 also for Pending | 0 = done, 1 = failed, **2 = done, next step required** (Pending) | - -### Added - -- **One confirmation per run** after the plan is shown (instead of one prompt per AD write); `-Force` for unattended runs. -- **Batch IDs**: every Apply prints a short batch ID and the exact **next command**; `-Batch` finds the batch - folder, its AD proof, and (cloud phase of a Recover) its Convert source by SHA-256. -- **Remote Entra Connect synchronisation** (`EntraConnect.Server`, PowerShell remoting) and a check of the - synchronisation **before** the first AD write (1.3.x failed after the AD writes when ADSync was missing). -- Console in the style of Purview DLP Report: banner, numbered steps, compact before/after view (only the - attributes that change), summary card with the result, the batch and the next step. Full values stay in the log. -- HTML report with tiles, status badges and a filter (`templates\Report.template.html`). -- The plan of a shared mailbox lists **who will get FullAccess, SendAs and SendOnBehalf** (first holders on - screen, complete lists in the log), so that the permissions can be checked in Preview. -- **Permission entries of an account no longer in AD** ("Account Unknown": deleted, or another domain) are - ignored and reported as **warnings** — yellow line in the console, `[WARN]` in the log, CSV column `Warnings`, - *Warnings* tile and card in the HTML report, yellow summary card. 1.3.x stopped the whole batch on them. - Warnings never change the exit code. The result object (`-PassThru`) has `WarningCount` and `Warnings`. -- Preview of a cloud phase: one pass, never waits; missing permissions are shown "to grant" (1.3.x reported an error). -- `tools\New-PraPackage.ps1` (delivery package with the environment values emptied) and - `tools\Build-Documentation.ps1` (HTML guide). -- Single guide `docs\PraRemoteMailbox-Guide.md` / `.html` (replaces the operator guide, the technical - documentation and the release notes of 1.3.x). -- `-PassThru`: returns the result object of the run (status, exit code, batch ID, next steps, paths) for - scripts and orchestrators. Without it the tool writes nothing to the pipeline (1.3.x always did, which - printed a raw object after the summary in an interactive console). - -### Fixed - -- **Certificate (app-only) sign-in to Exchange Online always failed**: the session guard compared - `Get-ConnectionInformation.TenantID` with the tenant GUID, but app-only sessions report the organisation - domain. The guard now accepts the configured `Cloud.Organization` (and checks the `AppId`). This is the - "certificate returns UnAuthorized" blocker noted in the 1.3.4 pilot. -- The AD module no longer creates the `AD:` drive on a default domain controller at import. -- The PowerShell 5.1 transcript is readable again (one `Write-Host` per line). -- Before each FullAccess grant, Exchange Online answers "No permissions were found" (the normal answer when - the right is not there yet). It was read with `-ErrorAction Stop`, so Windows PowerShell 5.1 wrote it in the - transcript as a `TerminatingError` line that looked like a failure. It is now read through `-ErrorVariable`: - no line in the transcript, and any other error still stops the run as before (lab T16: 0 such line). -- **Recover stopped on a normal transient state** (lab T17): right after the sync, while the cloud shared mailbox - turned into a MailUser, Exchange Online briefly answered "object couldn't be found" (HTTP 404) for the - recipient. The check took it as an error and stopped (nothing restored on-premises, safe, but the operator had - to start again). This exact answer now means "not there yet": the check waits and reads again. Any other 404 - or error still stops. -- **Check (or Convert) after another run in the same console**: Microsoft Graph could not load next to the - Exchange Online assemblies of the previous run and failed with an obscure `GetTokenAsync ... does not have an - implementation`. The message now says what to do: run the tool in a new Windows PowerShell window. - -### Code review 2026-09-30 — other findings - -See the guide, annex F: dead settings, duplicated mode values, per-write prompts, implicit selection of the -"most recent" backup (removed), messages in two languages, 358-character lines, French/English mix. All -addressed in 2.0.0. No defect of the backup/proof engine was found. - -### Validation - -- Test gate on VMLLM (Windows PowerShell 5.1, Pester 6.0.0, PSScriptAnalyzer 1.25.0): **279 / 279 passed**, - 0 analyzer error (evidence `tests\evidence\gate\v2.0.0-release`). The 61 tests of the removed path options - of 1.3.6 are replaced by tests of `-Batch` and of the confirmation (1.3.6: 325 tests). -- Lab campaign 2026-09-30 / 2026-10-01 on `exlab.lab` + tenant M365CPI89259425 (real AD, Entra Connect and - Exchange Online): 28 runs — Convert, Recover on one and two servers, Finalize, Check, Recover of a 1.3.6 - batch, shared mailbox permissions given to a group (nested group included), SendAs actually granted, - SendOnBehalf (guide, annex B). 26 PASS; the 5 defects found (approval callback with `-Force` in a - non-interactive process; certificate session guard; recipient 404 during the Recover check; Graph after - Exchange Online in the same console; transcript lines) are fixed and covered by the gate. - -## 1.3.x — 2026-09-07 to 2026-09-10 (summary) - -| Version | Change | -|---|---| -| 1.3.6 | Exchange Online pre-check before the AD writes of a Convert (phase Both); bounded verification after one grant; invalid path characters reported precisely. | -| 1.3.5 | Shared mailboxes provisioned with `msExchRemoteRecipientType` 97 (99 with archive); 100/102 refused for a new Convert. | -| 1.3.4 | Capture of the declared properties of a native ADUser only. | -| 1.3.3 | Data-only CLIXML capture written and validated as a stream (backup schema 3), bounded permission cache: the out-of-memory of a 13 shared mailbox batch cannot happen any more. | -| 1.3.2 | Transcript start on hosts that create the file late. | -| 1.3.1 | Before / planned / verified values in the console and the log. | -| 1.3.0 | Backup of the whole batch **before** the first write, AD proofs, stop at the first error (fix of the 1.2.5 incident: the backup was written after the writes). | -| 1.2.5 | Original script (June 2026). | +# Changelog + +All notable changes of PRA Remote Mailbox. Author: Nicolas Fabert. Versions follow `MAJOR.MINOR.PATCH`: +a MAJOR version changes the command line or the configuration file, a MINOR version adds a feature, +a PATCH version fixes a defect. The backup formats have their own version (see the guide, annex D). + +## 2.2.0 — Unreleased (source only; no tag, no release) + +### Added +- **Signed-package integrity (Windows PowerShell 5.1).** `module\Test-PackageIntegrity.ps1` and the + manifest `PackageIntegrity.psd1` verify, before any code runs, the owner's timestamped Authenticode + signature (fixed thumbprint) of the verifier, the manifest and every PowerShell file, and the SHA256 of + every stable file (modules, XAML, report template, sample CSV files, README, licence, guide, images). + The entry script, each module and the GUI helper run the same bootstrap first. A changed, missing, + duplicated, unexpected or reparse-point file fails closed; there is no unsigned mode or bypass. + The configuration and the operational CSV lists in `config\` are data, outside the check, as are + `Backups\`, `logs\` and `reports\`. A backup, log or report folder inside the package other than its own + canonical `Backups`, `logs` or `reports` folder (a sub-folder is fine) is now refused before any file is + written, judged on the physical location (a `\\?\` prefix, junction, SUBST drive, 8.3 name or `Documents and Settings` alias cannot hide the package; an unresolvable path is refused; external paths are unchanged): such files would be rejected at the next start. + The final manifest is generated from the finalized signed and timestamped runtime bytes. +- `tests\PackageIntegrity.Tests.ps1`: static inventory/bootstrap checks, a controlled fixture (only the + signature call is substituted) for tamper, missing, unexpected, duplicate, manifest-schema and reparse + cases, builder checks, and the native signed-package or unsigned fail-closed state of the real package. + +- **Report export snapshot.** The filtered CSV export in the report page now iterates a copy of the rows selected + when it starts, so changing a filter while it runs cannot change the exported rows or the reported count. + +- **High-volume HTML report.** The report page no longer builds a table per row. The rows (22 fields), + run errors and warnings are streamed by a Windows PowerShell 5.1 writer into dictionary-indexed, + gzip+base64 chunks of at most 20,000 rows; the page decodes all chunks when it opens (eager, not lazy) + and shows virtualized *Summary* and *All 22 fields* grids with at most 200 data rows in the page. + Status/type/action/flag/text filters (AND, over every row), a search over the 22 fields, keyboard + navigation, a details dialog, paged warnings and run errors, and a filtered CSV export of all matching + rows (BOM, quoted, formulas neutralised). A current desktop Edge or Chrome is required + (`DecompressionStream`); otherwise the page explains it and the CSV holds every row. Compression is not + encryption. The server CSV is unchanged. +- `tests\PraReport.Tests.ps1` with synthetic 50,000 and 100,000 row reports (exact counts, chunk + boundaries, last row, escaping, fields) and `tests\ReportFixture.ps1`. + +### Changed +- The runtime moved to the `package\` folder (entry, `module\`, `config\`, `templates\`, `docs\`, runtime + README and licence). Inside the package, and in the extracted release, every path is unchanged. Tests, + tools and the gate stay outside the distribution. `tools\New-PraPackage.ps1` now builds from + `package\`, verifies the signed source first and refuses an unsigned or changed one. +- Documentation and tools (`Build-Documentation.ps1`, `New-ReadmeImages.ps1`) use the new paths. + +## 2.1.0 — 2026-10-09 + +### Added +- **Direct target selection for Convert AD/Both:** configuration, OU (DN or read-only directory + picker) and CSV (Identity column, comma/semicolon). Run-specific `-SearchBase`/`-CsvPath` overrides + never rewrite the configuration; source/file changes invalidate Preview. Users and shared + mailboxes continue through the same eligibility, duplicate and backup guards. +- **WPF window** (`-Gui`) for Convert, Recover, Finalize and Check, with explicit AD + cloud, AD-only + and cloud-only execution. Native Fluent with PowerShell 7.5+; compatible WPF controls with Windows + PowerShell 5.1. Every operation still runs the existing Windows PowerShell 5.1 engine. +- Preview before Apply, typed confirmation, batch selection, progress and activity, result rows, + log/report access and the next-server handoff instructions. Changing the request or its input + files invalidates the preview. A failed or incomplete preview never authorizes Apply. +- Optional structured JSONL events from the common module for the window; ordinary CLI output, + reports, transcripts and backup formats stay unchanged. GUI module and XAML included in packaging. +- Offline GUI Pester suite and regressions for event/result coherence and split recovery. + +### Changed +- **Recover -Phase Cloud now always packages final AD restoration**, even when ActiveDirectory is + installed and `DeferOnPremRestore = $false`. Run Finalize on the AD server using the package printed + in the result. Phase Both retains its existing inline restoration unless explicitly deferred. +- `-Gui` can run in either PowerShell edition; actual command-line operations still require Desktop. + No GUI action runs live on startup, and the window cannot close while its engine is running. + +### Fixed +- Large-batch receipt fingerprints and raw backup validation avoid redundant per-string + PowerShell binding and regex callbacks. Structural hashes, raw XML bytes, live tamper checks + and the existing memory/time watchdogs remain unchanged. +- The offline gate validates structured help metadata instead of matching localized headings. + French and English help both pass, while a missing synopsis, insufficient examples or a missing + real `WhatIf` parameter still fail the gate. + +This version has offline validation only; no new live-tenant campaign has been performed. + +## 2.0.1 — 2026-10-07 + +### Fixed +- **Scheduled task / `powershell.exe -File`:** Windows PowerShell 5.1 leaves `$PSScriptRoot` empty in the + default values of `param()` when a script runs with `-File`. The default `-ConfigPath` of + `Invoke-PraRemoteMailbox.ps1` (and `-Source` / `-Destination` of `tools\Build-Documentation.ps1`) was built + there, so the script stopped at once with `Join-Path: Cannot bind argument to parameter 'Path' because it is an + empty string`. The defaults are now resolved in the script body; an explicit `-ConfigPath` behaves as before. + Found while building the scenario 2 tool (PRA Cloud Mailbox), whose Collect runs as a scheduled task. + +### Tests +- New block "Scripts start with powershell.exe -File (scheduled task)": no `param()` default of the entry script + or of the tools may read `$PSScriptRoot`, `$PSCommandPath` or `$MyInvocation`. + +## 2.0.0 — 2026-10-01 + +Rewrite of the operator experience on the model of Purview DLP Report: one entry script driven by the +configuration file, a readable console, one guide. **The safety engine is unchanged** (backup before +any write, receipts and SHA-256, AD proofs, stop at the first error); backups written by 1.3.x are read +by 2.0.0 (tested in the lab: Recover of a 1.3.6 batch). + +### Changed — command line and files (breaking) + +| 1.3.6 | 2.0.0 | +|---|---| +| `PRA-RemoteMailbox.ps1` in `release\` | `Invoke-PraRemoteMailbox.ps1` at the root of the tool folder | +| `config\DRP-Config.psd1` | `config\PraRemoteMailbox.config.psd1` (English comments, unknown keys refused) | +| `-Action Convert\|Recover\|CloudCheck` | `-Action Convert\|Recover\|Finalize\|Check` | +| `-Mode Inventory\|Simulate\|Apply` (default Inventory) | `-Mode Preview\|Apply` (default Preview); `-WhatIf` = Preview | +| `-Phase Both\|AD\|Cloud\|Finalize\|TagCleanup` | `-Phase Both\|AD\|Cloud`, default `Execution.Phase`; Finalize is an action | +| `-BackupFile ` + `-StateFile ` | `-Batch ` (the 8 characters printed at the end of the previous step) or a path | +| `-MailboxScope` | `-Scope` | +| `-CloudCheckScope`, `-VerifyRetention` | `-Expect Provisioned\|Deprovisioned\|Retained` | +| `-SyncADConnect` | `EntraConnect.Sync` (default `$true`), local or remote (`EntraConnect.Server`) | +| `-DeferSharedRestore`, `-KeepCloudShared` | `SharedMailbox.DeferOnPremRestore`, `SharedMailbox.KeepCloudSharedOnRecover` | +| `-DomainController`, `-BackupDirectory`, `-LogPath`, `-TranscriptPath`, `-ReportDirectory`, `-NoReport`, `-IntervalMinutes`, `-TimeoutMinutes` | configuration only: `DomainController`, `Storage`, `Logging`, `Report`, `Polling` | +| `-SkipCloudCheck`, `-DeprovisionCloudShared` (obsolete aliases) | removed | +| `ADConnect.WaitForSync`, `SharedMailbox.VerifyTrusteeInCloud` (ignored by 1.3.x) | removed (the tool always waits; trustees are always checked) | +| exit code 0 also for Pending | 0 = done, 1 = failed, **2 = done, next step required** (Pending) | + +### Added + +- **One confirmation per run** after the plan is shown (instead of one prompt per AD write); `-Force` for unattended runs. +- **Batch IDs**: every Apply prints a short batch ID and the exact **next command**; `-Batch` finds the batch + folder, its AD proof, and (cloud phase of a Recover) its Convert source by SHA-256. +- **Remote Entra Connect synchronisation** (`EntraConnect.Server`, PowerShell remoting) and a check of the + synchronisation **before** the first AD write (1.3.x failed after the AD writes when ADSync was missing). +- Console in the style of Purview DLP Report: banner, numbered steps, compact before/after view (only the + attributes that change), summary card with the result, the batch and the next step. Full values stay in the log. +- HTML report with tiles, status badges and a filter (`templates\Report.template.html`). +- The plan of a shared mailbox lists **who will get FullAccess, SendAs and SendOnBehalf** (first holders on + screen, complete lists in the log), so that the permissions can be checked in Preview. +- **Permission entries of an account no longer in AD** ("Account Unknown": deleted, or another domain) are + ignored and reported as **warnings** — yellow line in the console, `[WARN]` in the log, CSV column `Warnings`, + *Warnings* tile and card in the HTML report, yellow summary card. 1.3.x stopped the whole batch on them. + Warnings never change the exit code. The result object (`-PassThru`) has `WarningCount` and `Warnings`. +- Preview of a cloud phase: one pass, never waits; missing permissions are shown "to grant" (1.3.x reported an error). +- `tools\New-PraPackage.ps1` (delivery package with the environment values emptied) and + `tools\Build-Documentation.ps1` (HTML guide). +- Single guide `docs\PraRemoteMailbox-Guide.md` / `.html` (replaces the operator guide, the technical + documentation and the release notes of 1.3.x). +- `-PassThru`: returns the result object of the run (status, exit code, batch ID, next steps, paths) for + scripts and orchestrators. Without it the tool writes nothing to the pipeline (1.3.x always did, which + printed a raw object after the summary in an interactive console). + +### Fixed + +- **Certificate (app-only) sign-in to Exchange Online always failed**: the session guard compared + `Get-ConnectionInformation.TenantID` with the tenant GUID, but app-only sessions report the organisation + domain. The guard now accepts the configured `Cloud.Organization` (and checks the `AppId`). This is the + "certificate returns UnAuthorized" blocker noted in the 1.3.4 pilot. +- The AD module no longer creates the `AD:` drive on a default domain controller at import. +- The PowerShell 5.1 transcript is readable again (one `Write-Host` per line). +- Before each FullAccess grant, Exchange Online answers "No permissions were found" (the normal answer when + the right is not there yet). It was read with `-ErrorAction Stop`, so Windows PowerShell 5.1 wrote it in the + transcript as a `TerminatingError` line that looked like a failure. It is now read through `-ErrorVariable`: + no line in the transcript, and any other error still stops the run as before (lab T16: 0 such line). +- **Recover stopped on a normal transient state** (lab T17): right after the sync, while the cloud shared mailbox + turned into a MailUser, Exchange Online briefly answered "object couldn't be found" (HTTP 404) for the + recipient. The check took it as an error and stopped (nothing restored on-premises, safe, but the operator had + to start again). This exact answer now means "not there yet": the check waits and reads again. Any other 404 + or error still stops. +- **Check (or Convert) after another run in the same console**: Microsoft Graph could not load next to the + Exchange Online assemblies of the previous run and failed with an obscure `GetTokenAsync ... does not have an + implementation`. The message now says what to do: run the tool in a new Windows PowerShell window. + +### Code review 2026-09-30 — other findings + +See the guide, annex F: dead settings, duplicated mode values, per-write prompts, implicit selection of the +"most recent" backup (removed), messages in two languages, 358-character lines, French/English mix. All +addressed in 2.0.0. No defect of the backup/proof engine was found. + +### Validation + +- Test gate on VMLLM (Windows PowerShell 5.1, Pester 6.0.0, PSScriptAnalyzer 1.25.0): **279 / 279 passed**, + 0 analyzer error (evidence `tests\evidence\gate\v2.0.0-release`). The 61 tests of the removed path options + of 1.3.6 are replaced by tests of `-Batch` and of the confirmation (1.3.6: 325 tests). +- Lab campaign 2026-09-30 / 2026-10-01 on `exlab.lab` + tenant M365CPI89259425 (real AD, Entra Connect and + Exchange Online): 28 runs — Convert, Recover on one and two servers, Finalize, Check, Recover of a 1.3.6 + batch, shared mailbox permissions given to a group (nested group included), SendAs actually granted, + SendOnBehalf (guide, annex B). 26 PASS; the 5 defects found (approval callback with `-Force` in a + non-interactive process; certificate session guard; recipient 404 during the Recover check; Graph after + Exchange Online in the same console; transcript lines) are fixed and covered by the gate. + +## 1.3.x — 2026-09-07 to 2026-09-10 (summary) + +| Version | Change | +|---|---| +| 1.3.6 | Exchange Online pre-check before the AD writes of a Convert (phase Both); bounded verification after one grant; invalid path characters reported precisely. | +| 1.3.5 | Shared mailboxes provisioned with `msExchRemoteRecipientType` 97 (99 with archive); 100/102 refused for a new Convert. | +| 1.3.4 | Capture of the declared properties of a native ADUser only. | +| 1.3.3 | Data-only CLIXML capture written and validated as a stream (backup schema 3), bounded permission cache: the out-of-memory of a 13 shared mailbox batch cannot happen any more. | +| 1.3.2 | Transcript start on hosts that create the file late. | +| 1.3.1 | Before / planned / verified values in the console and the log. | +| 1.3.0 | Backup of the whole batch **before** the first write, AD proofs, stop at the first error (fix of the 1.2.5 incident: the backup was written after the writes). | +| 1.2.5 | Original script (June 2026). | diff --git a/README.md b/README.md index 56c4e7b..eb9be07 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@

- - PRA Remote Mailbox: when the on-premises Exchange servers are lost, gives every user a mailbox in Exchange Online and rolls everything back when Exchange is available again + + PRA Remote Mailbox: when the on-premises Exchange servers are lost, gives every user a mailbox in Exchange Online and rolls everything back when Exchange is available again

@@ -12,7 +12,7 @@ WPF window  ·  Reports  ·  Quick start  ·  - Administrator guide + Administrator guide

> [!IMPORTANT] @@ -32,20 +32,21 @@ In a hybrid organisation, a mailbox hosted on-premises is only a *mail user* for Done by hand, this means rewriting about ten Exchange attributes per object in Active Directory, for hundreds of objects, under stress — and keeping every original value to come back later: a wrong or lost value cannot be repaired without a backup. This tool does the conversion in a planned, verified and **reversible** way. -**Author:** Nicolas Fabert · **Version:** 2.1.0 ([changelog](CHANGELOG.md)). +**Author:** Nicolas Fabert · **Version:** 2.2.0, unreleased source ([changelog](CHANGELOG.md)). - - Design principles: backup before any write, preview first, stop at the first error, reversible + + Design principles: backup before any write, preview first, stop at the first error, reversible ## How it works - - The configuration is read by Invoke-PraRemoteMailbox.ps1, which backs up then writes Active Directory, runs an Entra Connect delta cycle and checks Exchange Online, then writes the batch and the reports; four actions: Convert, Recover, Finalize and Check + + The configuration is read by Invoke-PraRemoteMailbox.ps1, which backs up then writes Active Directory, runs an Entra Connect delta cycle and checks Exchange Online, then writes the batch and the reports; four actions: Convert, Recover, Finalize and Check +- **Signed package.** The runtime lives in `package\` (same layout as the extracted release ZIP). Every runtime file authenticates the owner-signed manifest before it runs; a changed, missing or unexpected stable file stops the tool before any import or operation. The configuration and your CSV lists are data, outside that check. There is no unsigned mode. The tool refuses to run from any tree whose files are not signed by the owner: use a signed release package. Backup, log and report folders inside the package are limited to the canonical `Backups`, `logs` and `reports`. See [package/README.md](package/README.md). - **One script, one configuration file.** The scope is one object (`-Identity`), an OU, the members of an AD group or a CSV list — users only, shared mailboxes only, or both. - **Preview by default.** Without `-Mode Apply` the tool only reads. With `-Mode Apply` it shows the plan and asks **one** confirmation (`-Force` for unattended runs). - **One batch ID** links the steps: every Apply prints it with the exact next command, and `-Action Recover -Batch ` rolls the batch back. @@ -53,8 +54,8 @@ Done by hand, this means rewriting about ten Exchange attributes per object in A ## WPF window -Open the window with `pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui` for native Fluent on -PowerShell 7.5+, or `powershell.exe -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui` for compatible +Open the window with `pwsh -STA -File .\package\Invoke-PraRemoteMailbox.ps1 -Gui` for native Fluent on +PowerShell 7.5+, or `powershell.exe -STA -File .\package\Invoke-PraRemoteMailbox.ps1 -Gui` for compatible WPF controls. It starts no operation automatically; each operation runs the existing engine in a separate **Windows PowerShell 5.1** process. @@ -72,13 +73,13 @@ and produces a Finalize package if AD restoration remains; **Finalize** runs on Cloud-only never restores AD, even with RSAT installed. Copy complete batch folders between servers; the window does not transfer them. See the administrator guide, chapter 8. -![WPF Fluent window - synthetic preview, no live operation](docs/images/gui-fluent.png) +![WPF Fluent window - synthetic preview, no live operation](package/docs/images/gui-fluent.png) ## Convert and Recover - - Convert: read AD, backup, write AD, Entra Connect sync, Exchange Online. Recover: from the Convert batch, AD restored, Exchange Online check, final restore of the shared mailboxes, on-premises again + + Convert: read AD, backup, write AD, Entra Connect sync, Exchange Online. Recover: from the Convert batch, AD restored, Exchange Online check, final restore of the shared mailboxes, on-premises again What a Convert changes in Active Directory (a Recover puts the saved values back): @@ -99,8 +100,8 @@ What a Convert changes in Active Directory (a Recover puts the saved values back ## Shared mailbox permissions - - Shared mailbox permissions: read the 3 attributes in AD, groups expanded to users, saved in the batch, every holder checked in Exchange Online, each right granted once then re-read; FullAccess from msExchMailboxSecurityDescriptor, SendAs from the Send As right, SendOnBehalf from publicDelegates + + Shared mailbox permissions: read the 3 attributes in AD, groups expanded to users, saved in the batch, every holder checked in Exchange Online, each right granted once then re-read; FullAccess from msExchMailboxSecurityDescriptor, SendAs from the Send As right, SendOnBehalf from publicDelegates Exchange on-premises is down, so the tool reads the permissions where Exchange keeps a copy: on the account of the shared mailbox in Active Directory. The preview lists who will get each right; the log has the complete lists. A permission already present in Exchange Online is only verified, never added twice. @@ -109,12 +110,12 @@ Exchange on-premises is down, so the tool reads the permissions where Exchange k - - + + - - + +
Preview of a Convert
Preview · the plan of each object: only the attributes that change, the holders of each permission; nothing is written		Convert Apply
Apply · pre-check, backup, AD writes, Entra Connect, Exchange Online; summary card with the batch ID and the next command		Preview of a Convert
Preview · the plan of each object: only the attributes that change, the holders of each permission; nothing is written		Convert Apply
Apply · pre-check, backup, AD writes, Entra Connect, Exchange Online; summary card with the batch ID and the next command
HTML report
HTML report · counters, next step, one row per object with its AD, licence, Exchange Online and permission status		HTML report with a warning
Warnings · a permission of a deleted account is ignored and shown in the console, the log, the CSV and the report		HTML report
HTML report · counters, next step, then virtualized, filterable rows (tested to 100,000 rows, at most 200 rows in the page) with a filtered CSV export; needs current desktop Edge or Chrome		HTML report with a warning
Warnings · a permission of a deleted account is ignored and shown in the console, the log, the CSV and the report
@@ -136,21 +137,21 @@ Every run also writes a log, a PowerShell transcript and a CSV. Exit codes: 0 = ```powershell git clone https://github.com/Nico77600/PraRemoteMailbox.git cd PraRemoteMailbox -notepad .\config\PraRemoteMailbox.config.psd1 # scope, licence group, routing domain, Entra Connect, tenant +notepad .\package\config\PraRemoteMailbox.config.psd1 # scope, licence group, routing domain, Entra Connect, tenant # Optional window; actual operations still run in Windows PowerShell 5.1. -pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui +pwsh -STA -File .\package\Invoke-PraRemoteMailbox.ps1 -Gui # Command line: run these commands in Windows PowerShell 5.1. -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com # preview for one user: nothing is written -.\Invoke-PraRemoteMailbox.ps1 -Action Convert # preview of the configured scope (e.g. an OU) -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase AD -SearchBase "OU=Mailboxes,DC=contoso,DC=com" -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase Both -CsvPath .\config\Targets.sample.csv -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply # backup, AD, sync, Exchange Online -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Scope SharedOnly -Mode Apply # only the shared mailboxes of the scope -.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b # preview of the roll-back of that batch -.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Mode Apply # roll the batch back -.\Invoke-PraRemoteMailbox.ps1 -Action Check -Identity jdupont@contoso.com # provisioned or not in Exchange Online +.\package\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com # preview for one user: nothing is written +.\package\Invoke-PraRemoteMailbox.ps1 -Action Convert # preview of the configured scope (e.g. an OU) +.\package\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase AD -SearchBase "OU=Mailboxes,DC=contoso,DC=com" +.\package\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase Both -CsvPath .\package\config\Targets.sample.csv +.\package\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply # backup, AD, sync, Exchange Online +.\package\Invoke-PraRemoteMailbox.ps1 -Action Convert -Scope SharedOnly -Mode Apply # only the shared mailboxes of the scope +.\package\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b # preview of the roll-back of that batch +.\package\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Mode Apply # roll the batch back +.\package\Invoke-PraRemoteMailbox.ps1 -Action Check -Identity jdupont@contoso.com # provisioned or not in Exchange Online ``` Keep the `Backups` folder on a durable, protected volume: the backups are the only way back. The environment values of the configuration are empty in this repository. The zip of each [release](https://github.com/Nico77600/PraRemoteMailbox/releases) contains only the files needed to run; `.\tools\New-PraPackage.ps1` builds the same package from the repository. @@ -159,8 +160,8 @@ Keep the `Backups` folder on a durable, protected volume: the backups are the on The **administrator guide** covers the disaster scenario, what changes in Active Directory, the shared mailbox permissions, installation, configuration, unattended execution with a certificate, ready-to-use recipes (one user, an OU, shared mailboxes only, a list, the roll-back, two servers), the reports, troubleshooting, the internals and the lab test campaign: -- [docs/PraRemoteMailbox-Guide.md](docs/PraRemoteMailbox-Guide.md) -- `docs/PraRemoteMailbox-Guide.html` — the same guide as a single HTML file, with a light and a dark theme (download it and open it locally) +- [package/docs/PraRemoteMailbox-Guide.md](package/docs/PraRemoteMailbox-Guide.md) +- `package/docs/PraRemoteMailbox-Guide.html` — the same guide as a single HTML file, with a light and a dark theme (download it and open it locally) ## Tests @@ -173,7 +174,7 @@ The gate runs the real entry script against a synthetic Active Directory, Entra no write before the complete backup, stop at the first error, no write in Preview, no Apply without confirmation, memory bounds, proofs and Finalize packages. It also exercises WPF selection, Preview/Apply guards and OU/CSV targeting. Earlier versions were validated on a real Active Directory, -Entra Connect and Microsoft 365 tenant (guide, annex B); **2.1.0 has offline validation only, not a new +Entra Connect and Microsoft 365 tenant (guide, annex B); **2.2.0 (unreleased source) has offline validation only, not a new live-tenant campaign**. `tools\Build-Documentation.ps1`, which rebuilds the HTML guide on a workstation, needs PowerShell 7.4+. diff --git a/docs/images/report-warning.png b/docs/images/report-warning.png deleted file mode 100644 index 916967925f8fc8b33f106bd95c08c546963b62a7..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 217660 zcmeFYWm{a|@-0dT5ZoOCK^u41;2PX%+}*8#Bsh(`1sZpkK;!Q29)ddr4}RHa@89{K zbN3gxFYdd3*0a{^T5DE~sv0#WSVc(&4Vf4j1_lOAPF7M41_pi{1_q7<5%%rMd@im5 z3=AfWoTQkBcjn16#+uQ*CIGqm#ut00`}VMsIC7TFJtIX)U2wKR6Uo25pgrqzGRy*R zj?zIEG1RboQ9DflzJlD?@WV`bkD@5H2i*}fu$t@2^E+Fkc_#L?{GXpZS<2O={nDc} z{tiD}YHH!hWb4ka1RpoND%)@Q_wROmtaE++lfJq^u2!w8J0B=So!b zrK5?t|L2GM3|H>|edT}MGb-kgUHJdLch1_U+bTiyTDf`2cP61F0u@c*)Hu4MXBW!1{&zpU0HvwdXxzh2|tMoawvM*kmM`~RIU zU76=ZC;WI*{BjHsx#cB@PFy!-l$(s@H(`rpnCe;~N=5NmYxi`;iOy?EA5Ve&>~bVK;zZ+83Z#>eOS z&brsJF`T0Rc66+r%>0K)j_OzK)b=eIo>@29$-}oNzaC91KVLHsc0Bxa-?eb^JN2@E z7-aR`PG|MGIb;<$71Z)y-T2STTc=wK9C-Tvr7?UW-+x^;(DnuaJiI(#%QmaJr#R3W zq={Oi2+noe+%T12XKym$2sS5Y1;d<|BcncgOv7#`1nYCYywk;X&7zKGmQPT9|<$zQR& zG13y9LIG+Ge?TZyZ53T$s4@G?IU)kxqM+MZT@IEEL8xm@grUI(Q##|m^$UD`7~)->3n zR<8tMGvFCYn+ZAEujP~t@(&Mii7?HEtNiv$J(Jux5Go*8eAeMwuqs!-dU2A;_In!r zcGo=E3Hm+Vx%`@rGZ<40Y2PbTc-gejKWxt1cg)`Xmk%kw+;`soV2XUCfBmz*pZ)bh z(C`VvNbKM6GR=$EEw5;%b|wBT3zsbILNIMT=Eos=l>iehXitJqMnhpmXq0|0gtOWN zVKGtheWd$_@kU#mjd37T)6bMT49#>ZwOR(xd4!Y>brtLh>tb(?UWi7*J>RO%2*@=q zf25_qgG~SA93ytILR~n5me8DIyX<{w%Mqa+P{JkOOSpN5TXCTF*zkoEn)VrmTJIAj zaXo~z89=jz5WO0P%vfV6m>Y1jQ28Jk3!kEs`W_uxW&dr( zGOTXR=Uy^VYP4!KkF%P(dX=KKdX-BT?V})piiA zYyge89fSML+yNn1FDK_5GICy!JNtBPAbyj<%fn09>+9W#;KTlFs?!#^!QI)nKa-79 zZsL>cBBN9UuYunT4m8i3fB)2euAjf!_)pMG%g-FNhX&l3TNEjnEhK)#_bHy{Ol!lF zur(xXo!I8clqg3Jd{K+WsG1xGX^U~qf?V?+wh^qF)@Jp97}JVZ+qEEit&dvd;R9m} z!#bRjI<~VNzqt9_zPhfJnK3c{e4#P&@+bR1_*EMF&SrM5;C56O zC{YgGSQD?tJuGaRO^O3!D7|Zr@b$JsQ)*ft7uqm6GN~+^{Ey`X?r*3Kv!hnLbi_N7 zLSjG*ae#IVi}SO7hmpWm(<>2)Fyz61XLQ1b8Pl2xf zDEBz_&AG&dG0I!~*|<=dLdjZ(>+ia!Dl}W|+pZOVLsqB7_p5l7{brgN>VhrD@Kf28TD@ZU+6HlKgMM@NxR2~}BQ zY+4DmOo)Ss(k}{reXd@_S(FUK=d?YC8nOEOs-;uuZOLX?q6?eqY=y`D;e5Su!gx8} zc=-|bI+@yLxnAV!IWsc5_E_B-s+9(L8QFMA&30jeF!8{y_p`Qe~APXB@^yKji+(!;P!nDHAtY#vNyc`zP)JRVLj_dj_CC zEeesI2VZ5dM{@`r)_Cn?6OCiKU0 zeLsKFymU1=nra&np~tri=5R5#m^lH%^(&zP&@uwkUH_D<>ni>5lp6K#>t1WEp%lOQ zNF;M3M?h-cD$2>rI_-0&{UtvwiYRRnUE4FH){1r2S`n5-1_z?c3~BR!6+7qu$_U8T z&46c768h=9wQL5?Z&_UA7Sxqr)49pxZnNZ`-wrKI6_B}!&j5KLBRC|N1(KHQmQ7;r zgqL%?^B3e(#q38U*YIhdWz5%}Nv zSP9?sS3fn0ia;L(_lzEdtMl-RG#f6jy<{M1`feloo(6)iE1dr+{q%fB-aqk?CS2kv zvY8>;q<(*Xg*ofU&^GnKHz0eQt!{n2QxBEvLBF^rQ{p@Km(6UcaOPJCy2mU%oHF0i zCSEg<_Z~r&u_V+I!QL-+_ZCm|^B1T!CkTPP5WW8=h1HWeRl_oXs9mwm0b%LiUBWuw#barRhZe6)M|ys zDc7t}Nie}!1*^UjlVB<+L;*cpOhm%iXAtBYhSuOrlyj@sCvn>ih1Gpw$n3Z1!;x|Q zmCZz?_3={RW&kaQ=p|xM)g%$MaRn(EXW|$in@=Rge2r~r71WR@*ATrX4(89S#&VgV z^(KvuAwfNsJKG4$Sn{MaMU+@06jlqzddFv4S2-GfYU4jV%wr4u+;!v}fyd#fvOelM zS?rbd30P3%UpVqhX7D{o>v^;WSgrem=~9GO21#Ph)Z0nvx5h9fWlIA~)j+g0$vXnI z@ps$;?PQAsv53^d=nc9ti0BWA+#xz1JiZ_?c6^V{Xkg7AKlo9*z;wb~Iky*8e>ZBMOy&M!N!2kU0HTWw>&wo&GXUOnBbI4h5gP+3*(okKWv0-ydDph~Qz)r643W76Zt z#1fSFu#^0bJNhFlxv3}+(aHPyHpnG^HP?>CHdiFHYI*o?3qR!W3sF6i02mryaNq<7 zJe8OxSE#7)PYHhA^PcIQu5eP7i}9055uu#hNCIaRejV4VBXd(qG%@gJreoFTy9~a% zVe)W02b1Up;>#&x+}1o;Tt)iaiRg!XfYzAAIUCdiuy}1-U|49)V_A)xIHM*!g>nm{ z5h*yF`6)3cIVk_2B9t+x>1wt_TlXZGV|v+?(~9_vi`*1;-j7(JXLbj-QPa5+G%{k8)xBVKLpt|LcetclBrtxj3jwDldDi%!|~)>@C@2NJ(a7GTqv>4b>L zc}qA1V*l_p@?WYES1&)|>dlDE$+pueoP1Ot@FBX`5V>7U^sqC!ok@OXnvCe=y&kI{ zG`!q+_WDm}D7@bwbSwu1hb+5Upy8b3bb9r#-n_74tJ_aibM_|AWSY$Zsjp6br=LY8 zJ^I?FXcUpkwWx8>S#D3g_=I&mO?on2(g<2U2?yi?(1SMyjw#4B~nh`eqZ?LL!~BsN}!utsuya3smaT*4>KKRe~NBx#45FexymC z{WkU%ce!RpOX{2bYDASEt>=gxK zNm#~^&`f;vaN#}(7RJmxI3Z0=OBzWlr-BVv3B3}pFB+_!g70S2XvjIC-jHy`S+Dos z`U^H!7?J{qq%-^|=|cccJLtv?8$BrIT7G?kEK;($X=mn$K7Yh#~OPdr;iK zDsy=vV_NM=$0G7WR2(G3V_Bu)qPKhP<CIT!}GZD{kQ_qnP9 z5Q0-Rw?aQkVBc7$<@lQ2utm!NfF$Jo~R0@ICn(Y4l|JA6fz8CQrghj8oW_ zIpD4Qq%MTjYk_(t8knpDs%>pu-+q$zKVQ9xO5{6{^dXZ0R=MiUk2Dp*(|S;X{Rpzg znxK(PTpg;h0CyD%X9D>6eekug${f#%PMKlHu>*dP}jNYpXc-wnDpeHYPb+xP%l3eX^Mr52O8#+XXmAU~oSL zz7K?fy`*qf>Z>;Zz9z8^R#K4OZ^Bzt6r{co(wEzWySD`-CB)pnSf)*%#fP{0>Kx!C3kwTDP&wfz=GagO2d8J#0yOwTu|o=jU3 zaH2Vq91e~M$5oniL72G2$QsI0k9STmgBM%-{?&Rl{IwDLI`advhd~sqnKYcA#N;MU zu6Byg-YVRgXOtMRJjC=kMrlC!2I}G7i>Pj%l0M;E;Kq)HV_Z%nqIf}=m(bgz{O51d2N`W;zU=F3DOO6_4!a^L|8Ypi8+ zjk2kQfjFHwfkq{D1Okh`k~n^&36S;GMk{hkC99Esi%#j9uT@mO%0J`F{S1-@o#ZC1 zfpI8~?i=J$Tbj=?_BLozUXW$RkT@2k(vP=L5?T*`Mp^gJ0=ZCcg)YO+Zx86SM}bK$ zxy7#erYah6%2vyAbyL}B6zLsh`1!P78buwUra}El1r0|u{n2Esj9dzH$2Vt^W%9q@ zjdR3!O9IGw2`x}GoeH)PXdWf?@qnY#y1t}^{<2#yP!qdGLM&1QmqQEb`5#uW&V~4) zWmIOx5WTgMPHhFDqDGA^4#(hch$J!Vt~3=fh+-cUz$6x^ax?E)=F-G1DpYiCjBnPi zzGWA#DcJoRC$$1~%Crm3XvMrJz2j{=`M7B)^f1fAe6_D z+jdO9a^L!BKQioHdqZ7ki?piCU1d4n*Cbxn?B4z$-W_?q0<+g3@`rC9AZImyZ6#n` zvln9VtZU>8A|X+U@Gh(W<>hEVrWciIMQ448(VtJi!J98i$kuT4Kn#yVVEju~U}kMoa# zI}CJ}SG`K8wIDIF(9(4f5xongIHmUO4$mOSix{++k0-_A+cuRno(`EB zUqhEicmPbgL7uOZV3^M;nv6h)HN?M=+@F!V z&c)`X^G%=4cq1T~@N(OvE3f1<;QrzV8j`xhHosN+4;ExgNXw04nz6k)?6|x@uz%!m zy`S>&t<7C`*5|~kIb7>(1Nk)-Dp;vW(*!D5c8zND!}{Q7K`F6dmzzA!6rf(jToPgQW0fBzw_8)o{F?e)>j$mp%m-5QB%U&*^D zt}<)WT|@GM)+Bva0{MJ$4Y9gZ&Oe**(79H+3S+X}?J&3rWH&=dcQgouX;D7zhjWP9 zY%QJBWyQ6|Eb^Nvaq{;`=6o56y#Bs#J*&!vU|wNFu>yEDeE@DQ!K7#w=75KeFkVlf|YaWB4A4 ze>4KGLVM6nSO-Fp$T?}8y}c!eAJvf9rP@NKj8N;sjAD?Xt-P0>_aup*fmoYj9{&Li zYa|5TuSEE4rWeb`-384D5*hN zfih}@GUE~!ypJwrmI`9o9*6=ovPFD9g?t9^SrP|k54M`TrHU@N4HYmd4fVAyq zLJan~ER{vb%AjII?`2*@nN0gt*68xtHF#W9+c~%>HKc9-knylfF@#~2X;pu>oQ{cz zz>5MfI8uv6mFkpwz}|^r(;A4%QX|0SvqT}s%t%-R`y)yW*(oW00Cik?jXo%2*-y!< z|1(}-rE|TR#h(LljEmsWirVhmBbAOJsm2FHhz9T*O=P;il_>~8^nQvRsJpdS9@xjj z3^IX&1IJajU%!Gzh1qQuv}(r8)VV(-pHDZ-ms#G*?scmWt0tU`WWe5=f@~{idcGS5 ze+p4~)cSbA40@(o{x0G}QA#bcSf_b3eNysNa3paA&@88RM}bwSWr+DhZ>=(?UmLiD zcR#!Y&o}YeHU;!X8epC#hE!OBNp3w7TIjYA;%m@2j*UR=V~xto@FrIkj9N_9UO695 zJzGQ=O&-!LVJ%-~ptlyclzitccRQz>mIm4etd!L$cYaLf-#2N$p2O7`#8q<% z3O1y?tposF-FuqVIDpkUV$35fJCVyGSpyx%6aD%6n%p?KmRD3yRrncyv9}O-swV_o z>hyw@EG6mM6rF>4mc5h`XCY@Qtfdr$$H(ZiIJ_Vwd!moL9JF=gMc2@bN*2v}tX_@r zgZD$^N+Y8#+x$8I%!dqBl8PpXw}t!ScwtfR22a!>I)@dq69x*3H)BZq^y>2U1ILG| zK3i1BOk62WDprb=siL=5uLdA#oAwWud{)!~@N4(0qK;w>JP;78UzyH#N&?3gXY>2yNFOxN zyOQdvYZ`adLT|kiCC3$16dK(kjz%1$S*gTh^6$fmGyN27NRF=YYr-}kQZHP3!KqDM zG6jon4Vt~j@sm?7S~|;033BeU_6OVB(x>HIg+G))_Ecy7&N5J5EW{IhVLC9l{?cPD zhtiQy4ThDfYwEoXKpG`;GQiTZ@n{e6y~*BC6v^R)>$x0cq&tr>^OSmZKX_J$q~S24 z-n)+1r7^f*TpWAsP<791q~-D9*oa|U&xC}*@$d0Uy=?YovI|+(yHrhvycsmp$e>R+ zr@^?oX2N19IlADhXZlbX-7@uIzdo~%yn#tW5d-0crY7#vzJ^EPIRaP%Kf4U>=9_Vw z+}ckg{&zf0n(66%#b&>k3(exEAWk=+Cc8rT=`@8$xX-AufE&DEESA#jY$*=5U@_Pu z%filqeMz}yw8~scU>9SEF|Xoi`ou1>Rv%ufY}CGWA`(~nuDZ5hIXHeJXMCh>O8Kp& zzZSRO=^M#3_jw3v2%BQ$VT7fW*%?}3n&)Oj^2RL2t1+nEa;5CB7rUh%cgzwB>As64 zb=^r=2b}@0IX;l>ca556o0+9xst7A(V#R&S`gvGm*Q;wiQobNw-$7~?Jc#EKG$Pb! zL4rUF<(8kBPJ?2xOLKax;?kJu-ziG3}GcW0ny7;W$A8EyMAT7y>G0@LckF)QSz*f~dM22e2rN`PJMe511m#&Ebqp z{+XN}_$UI+FW=L)$`^)ya80fWQZLsr`EdHz2jLO#b5|ygxny3x2@53y)0SDUJEdZt zDFPCk=GVwXrXlNl$HM0DPO}G5?-sFB$*82Dql^H2P`S2kx>Z6l)6{MZig$j;r7lU9 z$C$VjlJQqo7u<)gZH~#8_V1ay>Sg^vi?60P8ZqAa1|KAIbW9TEX!c?#7QILS3noHx z*!L!+lRESZiJX3q-~?n^B`qW$)oJL{P6^Ng%+JDIp9Q^E$My_-*5qI9N-Rsr>C@9- z`|Y>{yQRd~4*veuV&gr`dt%ERPr_--rx%TRHuSxt0~%Us8w zx;zlg=2262p1)@TmX3$G)-P}vwLuAC0(X9XiF-%73|zEDG~qs$7%I{|7}+kJGe{Uw zab)y+dmlVTKN`z~%}7*Tob3vuSmxtN5P5NTSYCjj3W_z+025_le7M3fax5O$BuPQBbQ$@y*t_#g6aCJu}Z!S98=I{&-|_pkWj){GG{;hpQ$;>Fo8t1eJ1fk zzH?RBh#9A`JW&=_CDsJYB~#8=9(L(d0pmhq6sI10`}uI$rU&qGhm1mIi2J6kfBY*Y zPO4Px2lSRL)}BRaQUYCW8P79f-@umd^ETu%7Fy$dNmjjLT`{uMV+h=guboEqs;D6z zH|^P?6$F@Gpc<3=657D@!WP4qS-IMbM!hrtG)g65Pq81H_%fV7*@6Zwy3I8a7hLE4 zV@S}wOg<;PfOKAl{cN@ZQ*xGbz7RO$%LAFsmBWAnr9e=yW_DrOAX@hk$u;HtbkHGlxx>w zWP4x$ZEG`L;Fh8<@q!ALS*qS_kAyRN4zHidU-GkHxpfNU{r?1yoV~@<(8#Sb+P<7t znA_I`SAmILa@BZEs^A*jPsO%R5hAo>7zga z`Z1LcVm5^dtsCoy@agzAL7Lb$2&{K|wi|>a$yfnMB>RSVp5kifne`Q8WiK=>8rX1O z84IrY$}*cMFZXLo*SJ;30h*d^6nFcCMVzz zNqV2FjkI)WN3Yb$Yeo_01m3+I`*!ZHOv2&hq;xUlNR`wYP^%%=Ugm6?8Gd9A{NIZ- zU`r6>(cnEn3s@NGIIqeVOr`BQH;$5TXk4d($Zdvxx_D*m>Txth{HbZNoM5m^3VXNf z@xFwrA7S?=rDtGCLUvNKJSBVV$++@^2%=)a<1Bk_ZIFm0YF!Uxu3S3;|9V!Toq7yk zMpfMqG!$$?(%h8u#Uk-L*qo)kOjlh-?ZXTdZqa@*oS$;{nybhZ-enpt-K7^TbC&w? z_a~H7`|*UgQp_LLli?1%(kA^88t<-g6hcLyp{rbm)vemUP3Hr;n_LP1+@4YCoq1VD z>G&B1pGDX8@(?}rM~1&ZDWn^k%T^i+EAx`gBm>7G6UHR^r%vsc5~MZ|dJu@k8=hn+ z&Sfd#O&A4!ln$PGBpv6VeB+U{>i$;klS|Y72*UU(`)V3s+)QZ(fEGiSn`4BKA$U&L%MMFM|q8{|aP3I1{* z;u2ZKG;Z#?^X7?~Q{!Dtg-$o^NIi8ZgVtx(I0e?zVB;I9i{pBiUowtSmK54@amx~q z985TDmXcW8~VZd^xU>c)$~XDxeWFJ_-&P3KLhbPq*!Erdq4^>WF9#u@E|hh}avXA;o$o zXn*41!C(HH_LAZfB)Jw|8zOB5iG*&}5(NDL^$9;V_CQqY%Rn?X>RU|8GcA}Ne(#eV z!8m-Ykq0=5~B`8z@ z^daAE3-ueLhtsffwUTw`Pr78IIVK_8r+w7}%p1_0@HR)&h++AQ=RS6nVFg)m9?wlFFB zlM$R_JTlffqMx`m;^>Dnu^vy`Gp9~G2<+3g3@&U*+Xozp=vULLfJ#>xrd8JB5|ZMZ z9m_*3u?8262@u>4M;fE|wYEbg0P3I%Zg>|OmgBt?Y~F$o!-alFm~I}yZ*GU?u;sm* zmr=$XcRv|nSa)gA9gjRXtOdVVXvh?6)~`y$%cS@Q$6Gj4GG&I@kR;)C>q=50{%7=U zX`0aBZmYg<6_V0Q=;p|ANp?8e_yh-K)O;ikD0jqPne8=xT`%YIsbpcq)*zg z3L|xxwraD1FaNR+zsph=Ex!K)S4PeEoFZo{31&hOnv?eU zMp}cGm&;Ip1ZIZEpLd{Uv*_^*FKCaqq+3Qp7Iq#td<*OR(-W52#wWTiOJHf5+h(uV{-$$P^k-jW+&Uo-ZjoUY-G7y{A)Dzs4% zM_5MUUXGN|jgQ#J#o>(3}1?i-Q!38RS3BBI_Xdz@Ny+RbHN=1=(;ycW3F$LCIG z&?5%uU7YW$rj{F&NqErT42ghAbuT!DAgeh22N>`?=`fC6-o~CV)Fckj z(be7xm*v(P6)#?{yfR8aj=;-&=jN+Owvl}){;xHg<_F~K?=7JG*8rRw1&BTNNv|_9yKn_mjl;{ zB^q^&@w`<~MQ)|yQ3ufefB-I1^(@8_3Keyx{h}p*9U55hdfx$XK3ACQOPXz3vgsi5 zQe79>W8^IJQJT-n#P$w^J$$d@F2^qNb|HrqngC;UH)_7|<4|nYm%Ct;*ojqDFjWt< z+j9-EWu7XqXL$gYAc>DsxM4zsa%Wlm^4dH*MJR+NO?ok$KD`&!WJQwMv1FQmV^)+h zE+@lbXIj_P1>+_b5pP`WsO?qtPn|V@(ou!kF-O*T!aR14#ha*7=zrG}Z4~iY`FvEg zRCbH8NSFJYfureqev8_c1g-j-_!*Z`VQ#d5yXhg~VN^BXb^M4>{g^nXUB_-mf>pSA zRRT6`R*>llKkfHRptIi%vPNkM?-7=|y?7=ZMV(HqAbmbv?Li4mBG-17@m_iu$E21N z%r4Nv5PYLeql1V1j&r-0iv2ctmVEr9#G1();BT!(Y-ymI7_iOWL~gq}lqwnK$bVJa zWuUL37U1_(#!BB0ciZy;&olCi4ok+BkBOtbR(|EBwwV6Bge2e^Vw}jVs-UWx_qauikhshgU94kbA^Ffb z&ULQgx~B+G*VLd%E5t;wezjupAdxqi~HmdkgQM+ z?T(bjq@fZL{!Kk>5BPm(9*d|UnOlX{w?oQh9NaUvyXGe7h`BYVcxYi8rO;wbxa}>+ zZAx8xgd7PK`&2mQR-H;yKU+CZIf<*BQx-0>m{K=H)(@R_F$9xT*!4mCG?vOVBQ>lW zIn>lGfH>?zF|e4*uJ6^-;e8q9{!tJMW0YjF;~4X9gPHMT?g*~TxV2M==z1(rXoHLq z^4$�KHXxeA~H{7+Rx3$4yZ17!cIK(of>jA=hMVG8rE(yXEwqA>C&}K^>+oP0B|3wcji$a+o&IQ~k zTLUYrXWGB9lH*&#s3?yr-Sfp+Pt2vLkDsq;Vh}Z~6F(t`3*{*I!P%Y}2U(|M=ljznVa)l+y6TLCo_H=T>D z?ArxL>}(qy#n>{(S#lrXzS!+dTt^uWOk;o<28Nz7JHHK##)JmX*p#B2*xArBUog2> z4|}$U_?O`_XsmM|jkcekUhJ*-jm~E(q%B3}6ji%aUIWuU=M>n#r(rEi=a9*pIGg6+{xL^C!yY+kjD6S|_7TkbVOI3`53D40XsWN`3~J!|@;U&vHxbrKS(G3HMEl4{ zcCO7FeFXY0Z7>$`d4rIFaUJp=WO!Qt^uoH~wcK%Co$7z^Lhe0?D+Ic^|MoKNet+%p z`1SNl^_b|xrPI?K`Nk99^xn7YkUPkmSdx43Wu;lv=K*MHlw!mF6`Zx4yrkUPve@A{m5c!0OSxueHP#}_m)MW2~OMdW%1(+?7sz3vE_rp6; z=i$-WYU<*$_ZMPne4ApMhlcQSR1!PO!@}oZ$sVF&%X!i?ZuN%4ze+k$y@_!^khl`_ z?)8Abiyb%S@QLKRS0@W-mP)v^sT*#GmP?5m%sq9k1wV|$a2)xr#wvboNuTVaC=CyC zBBq(6C(6fD$|ktiYU7-ZgZZ^h4GOVSu`NQ=fA@Xhm`FHyK}*1`kaQ5RG9E!oTdA<- z>A-=2=&ll3T$0%CeQeDkg`Z}G%{Ab5$U?a-GvWj)v5?oxwdCmL^DGPf^@>HU(^1|p zR_fl%ec&|iDO6m!rrgw>=t-iH#x>|W34#)S0U9cckE49v2XP%&>$OJnUn%-$z_(w& zNqVhF=nxNG;0!~7n3-*#_l8k4S@Ux|c=!Ut7?tl>QoTKHaP+YWtbfDHOyC*rb&Vz& zl6nKXu~Zu-|1c7qlM?XSk^#6P$Ku&kh_9hs*i!jX$DL|>c`Oy-B&LIdc*=L)rUTJT zQ9~ZKBf3=L;a#RtRHYx?B%Qmpw!@vbyg`mk!$TZ*mO)EVn}sZyQ6x09MC8Uzsz}Ox z5iihpd>#Oul_jih`mw^^KYy`IfNNcloYXH2RN~fE_`IMtNP)k=`&Rp>cac~WGHi>* zx(G3{F%w-sG18<_7?p8A9n)KN_kpZyud%o>lg9-{DWT$i%$97hVG5Gd-iEF6*h^9enpV36Nu+E%P8>#kKI z8m!#yS6>?lKYr**b_~kt_2H!kHg_(Wi^&72JK%&Ld>@~TVuk+jjmtu2rI4m%&K0o_ zJcX^-JF3jcSK6Gfl!gD07>u5KpI<9&WV5b4Ym;Z4O+@{g;Cse97x?Jy^LI2-^xNs4 zcAM)%Z1v3Ed8}FjLrepd(S5nY#_7(WWzWs)>jN(nKk)RE zEHxgO)fc9ihC`2c;Hb?7-&xS5D}Q!FN^Qpje)5{d0ni@aB4I2^_u*LhE^FnR zCZXNgXpPXqBS0aAnP>04a(j4|`jQAy@kMe83ln&3U4rVZ-dP^RpCBtQ_1zDYIY=@C zc#%J}*4P-`(Dfx+XCuFV?duyV99^kh1}||j!T zJC=->P(g#f1WnBNjvcE``fX1D!P1wR_3Ve=StyZ@K>t;V48yNymcMr|00dGGRrUV5 zBk7`t$La!_dR%yXSsk})vxmu6)j#=fT=^cy`WL=BU;W0{&zFww7#<$m_l{~li`$~j zZkF{a2ygDY(2l`|D6vzccV5cH2OIR!Hz&?;)TSbvt&GZ5K>u9DR>^HGNj^yRkhbJh ztNVdho3QwhQE^OZd1}vFzy{uye>*=_o{1_FJxZ!O29)>-^nXZ&?jY_KLyP`$hTJ@} zznyVNLHo|*gFpVT0IXnj<~I=RX*p_fe%HDr*)vUs&2v(07CwGlh@;w*V5bt&^^5LH z1vUOUO%0%7IJ19l5%ve4X!~zj7l%61a~E?tywkpasemjd5B}95vX1f)ZG+u<@{&A~ zQ}A2Kvnp%;{DPVo-FZ5gelV2F-;!R$()u_?nCG$|6(Wzob*w+MbaPy|!$nvUk}SbS z_yLDF;(-4`O*)v2)vfF2!FyvwRF;*{7RXr0?9cvr`j@PfH(5jfHsRS&Kkamda;7sT zuYF}Yl{j?J?VY#hxU}N5OiftePvfZYZdocEyjU~FhxrpuW9?`X>UKq+%#-(WBxExc zkxT$F=t-&d7fc@*jQ;31zCk0=fe*zlmXH_=HfGW}#6M%8E$`ZI-70?d9rzM2(4cVKfC%KpKw+S``509iMBu!J%-acg)3Gmhui-8;}ob+xp^*EXbHbD zEgPOByi=zDj5h(P_P-p#Gi@W8iA8# zCdqK~oSEO{I3$y!>`X;Xu!o5cm|f#*#>!k2VTcyN<>^*8vN4C}mriNVTFrJT%rN-O zCZTS0<(9_FX+vmvrpr~|rtjRd5VwZQI2zJxYgVmuh;Z_`*Z{*lI`rvFh^yhTFp6rV zLK?3L_VW!UHY%vL)4vJ~ptdByrPy1J1ZeAfw?)cca7s#jRvvz+l(%f1iNi>ULsZ!} zxkY*qkuKr*C~rJ2joYC(NIpSU?ROvrLbYnMT^|mkBVl`%H@piyT7`R}rc>i!h$APB zAg%{~GPFDSA$17rht8Tr@bWoC5qind27cUvp zN#aymla}F%b{y``!6@yZ3;6E zK5e%%+HIHapvA*5r(buw8{f{;&kr0tAL?RDMuz|ihysth=Pg&@euuzp{^z0nB40S8 zPTiO1pT(U?mIX(uROyBnK|e6QxyMH;bnvXN@jv!wx8l5J@PH=@#@|Xy|5@#@D2O(_ zvw-l!&XZ{H+hH98Q3qbn7g=#7g*B`O6rV~ z6rMS!#jws|z&=_3uT9~JuNXo_HCxe!m=yUmwTVtHoQq1|FikNjyYH@c51FSDa|j5? z$J)<>M~{nCz?DtM{I?XgoGYLAXuPs0&O=uK_a0<@Ne$`Dv9wl}o6=qe4(75Tx2r@` z?SI;y*z;kW!oieqoUhR=w%1%AqwHl)xRqQPB{YRcLUjpJY%j=>JQRy^M0N>!*a~H= zbz=9y_Zg;{Eb|sFb`vge30{aO#(7{;|7x8Apt$LeKCmDiRYPr8X`Jkf7yL@ew2}W4 zuaQF979jjq-j&o$y5h3Qz{So(_XM#Zqfw1wbF+Z~{$|7VCs?_URCk&2ef(V|(?qM? zoLUT29xxu`YFu*sRqXS8Z!~vEkfJJU&vvkXhR#LcCeBGz$#1$)Wf^|IJsmMd<;le> z-M(R3b@?!t%-66(8mw=w^4fr{SglhZ59^haFrHZ%rYh4w}={^ahSLVIx zV*TGExuFZE@mZbW#_$HW<6BlyEA{CjNr@o0;1-u`zEX(x_BWFO*Cg0qaUMmIT<|i{ z_w)OPQEqmO({UKDEHy-(Xs(6K;teEGb=eGZRVGOye+}&9?S+3}(Be?igu$)t4@q^> z(wXO><=4hPVdmvwmxNgv12=|meWn*IJmMoCZ$PMEj30D zarCI_TJL^I?7-3g-g?CU#a|PNdlgeBv$iMPVSIohAbjdHtP*8Q+Wa%I>paipm&;F? zZ?}#eQ%~xsZtLxE1x4iwdPeJ*P)m6aJ6vZ%f^;;n;|+qgm7uv$lO?&!qMR&{2i_zf zB^{{{3N8-+jC6)Dbwmua1bPeIYYx=7JLFHsgKVX3Uqj7z6cdtptao_*Z%l-pGgB#Q zW|zgLx3Xgvs;U&bO16XZ37mI!jc}{2_wM2S!>>3wt6#3`?j)2D-?w%a$qM=~YxQXK z@o0ivcg^;`mwnKuZ9C!crDvavz!$EAMAYqY3%zF(YXyf2zr zgOTG|e`i#df-@ZXnK$Qi>HS|WLK@gFM&6E~YJ9rTS=)HsJ=8b;@}T<<7a%1{&?rjQ z{!nyAn4$3N+U-a2qu|2J+~~K<#fXo!vYYOBH#1Y)*$*`32^KC_yU8XWnC+*8{&@5G z0ft^Ll(T$a{P!QI;wHcP_;r{0VO6|=*`zwhEaYu07Ojv?>8i9tsP5T|)_FX7L8MOl zD~I-Gp&@cD?Ymj#Bw+|z|pj0!UYX8}9nA@#~#Son^E&Qn;0#F3Fm@42S?}tgg zvr`IUsyyaLO69_=-5+S~GkbCsYlE=$E74Uz=-j6_=dSufsID|(rm(ELp>*cv2hvc~~mqeBFrVV|(W1yrDkt z*hH%hx>z%M`CJc^UJi7}*gCFOP>l^%e^EgFZWZmQ9BCy_HfvoGaX(XxC-pEtfSfBfaw z@v8nHeVO`gyZEI|(9NqQY{r2XbO8%HWDM#Ho$?ZRSNI}eahy?ZtYT~0Gh*u%B zA`q`oJ=tsLPySl}A0Br#6SDH?SqTGbh#8zk6@kBOCG@Ts;!sI747G)7&V@7=;q8r)*lSFSmX-Qz${1xUoqqp!_i4*#LFdZeXZI z3M>*^NhjoSu3fcYS)+V^j8x;5k7h5^YVu-#JO%sRA1M387eBgSq5?+_q($BV+vpf8<}5SA`!>%O=h z_2A?TDEKl^ddz>&t!_09oV1+N^r;-_^%LUfbC{&*7!@G1)@|QkoT?`Fxw2s+>kd|Q z7AGmw!6F!Y?cl61dNS>sVgM9OaOneo3p}EVc%}O?-QM@SN6}LsVt~=}F)mH+;_=)> z*g?_qg4ay!DR+@>SYyi^DBSus$eoQZNpDk+xW#Hl&UBR&g74!!|C6R>_8gWI3ZWfa z3xjh`3%)mYNDOzTGk-ElLt#? z$KV;gnDrgp`(;lo2X0*cSF8|-iV~a2Io^sLQR%QI;8I9GS15%&#zmz4Y(HM*f*{1! zcuxR(r)EAn3jwT3Wi!qdUS~PXP8Zs$-))#_IQ}D9Ie`g>Do7>W&eRbfZeOQb>BNM8 zE8xm;?AByLeu0=D?JPDw%AT!20@59fsSo#KVs-ShSV6%tU$mLIXY@uPS8R*pX+*y( zq_RO!U$!4mUam0h#^7gU>@iB;5f0)CvD8=%8xG?!(t7r5$&s1p<3X>n$5%W5#tg-O zsg$0UW(yEAoi^O74)PQ~fkz_Owx`_8#IPD@~ExB3AQ$@Lv-_{I%th|78P zV0y=t5C_B5%*79u8=@Vfib+e$d*Q0`64iPqL~J1n={?#DWB0>*O*LwcJ<^kf?nuRR zl066oBXHP?hxwpjaPSL$(GtHgjVfRTkRwz?b=yW|-hiSnZYG1nr|Q924u=#5{5=Yg za;E|5gk;msQ{VAp11;+#a&FPH&Omf9@Atq^GH-5nVlV018R%dM$l=0B)z%Bongi$3a{)8qv zK9On7vEyA~_7r^=!4YgOPIw>%*H(FDu|-60kT+mgaF~kX`@ta!_b^l36%Q&mTQQ|| z3cZ&dgws$0hOz1RF;)YWH=O{M?1xDDqdqVl{#;{<5qt$=4b`O}v&{G&}?+M{{FB{L*oe$&{B-W!)S{WG1J>jTgby?^E_G$Wz8NEUYVT>swUzU!;&DnW-guV)vUc z5b#EBoX%W-PU_p7>hv~h;vk8UItYEu+w#jiIk*b8#%YKkvqjiLL7Vrd4rh1ciF87=Y0f<5#{>9>T<+u$CVXr@i#n^PP~SLyt=e)G-y64$-<=-7204lE*&^jC zsvlAMM*ZEBKKyik8J&uQTlB`@`c0&MJbsX+z>*$fUJ%;6P04l@u0IuDS`;5Z(h~ZN z!`%^;m`cke4rRPKy+~+16Ms{8k#tc&0#oI@1LoUU3E$*6BJ(1U>41%a1&1OUWOLQq zFZL*VW;L*~lEraNLdYbsViRC8&s%T7AO_lWJa1f7nOr1o4K&I@^n63+$R^VNnC&j{ z^6cZn@PChOPY~q-4J~ZAjF}qB%sg>C>M~^Y`>(C34d29ZCgA!p;^292bofJqi6rQ8 za8OlOf9Fe%_F$n)C&Sp0Z%CNG6qf50krQ&4lXH%uK;P-3gvT#O;P(pMh8g!E;mtBE zQbR2qSa^v`;~Oz8ya8$cH8m)Rq*;`kkaz80L}8-wtm7eYg5_Z|4&LZ3Yi({r7XDHS z)E4DbK+8|M$SPIufCkHzQPRMAGpzNg#g<8E--w=>T(O65&DRr;#_&s;Nm0I+4b|hf zT+MTs`6GrX6gnsSk7Hw<+i3t5taC?)xpgJ28h`cR)_4lX# z%&(Q6!^B#YqEgPwi?3z+ib-EC83oiuX1}2sb(RnT%*AWsg@sV?n)~hM^E*M`bsu8q znNqIKY{^FB47IUUW@|0))6xnb0SVYVG3amLwlf{xg+h#-60+BTSt z^(~L!v$bn9j{8rMkf>}ZpQ;$xwSb-x?YXc#`JV;u-zSF3HEJ#R9e76Shg$;2sH4Cs zL8=QO=+rMy3sg2+Lk8D2r7A~vaAy#qxH6OZWE_1B9_rl{COs~vn%;i4tC!>=S99$Fq00xlq1_8Wa{<37ELUc%rK3Q|}H~Fy= zq!_Y0bi8;OdS~UN1=6q3BI;%Jo3_~!f~n)>{U4t<#j9BNdtjdkZW8pmOAdBA*?HXL zAja5cvwIOCjTIO!s)nWSxmQnN`rZklZhFb&Yd`Dt;^e#OAA+cx;!K`Am9_xo-hC?< z5C>T60?8ef_}`z6l%Qx>Bm)vD@d717oN{g2Qy1y_OK&Yf(MA0v4_&|Ck^*}TQzlm1 zHphBE02K!Alh_YVz1#?B9gIsj! z%kE8zVC#VndQOh)cXjr>%7iLe8lvqTTp9Esh%ayE-Rn+Aw_evNyCbR+Rm3yPrS8`V zH`z_B>{@glGURB0^8m>{A6TGRe`f_D?UKeSe4@BJ-4$4*%)1=*t|J4Fi zVbr!B*rhl2ObD>Ty-I$N5M%DSn23SiTOT4mhWK3Rqp&3NYQ_6(t(L7`a?~U8aBus3 z-Y}x+;^v^L2yH!HUZA8g{feH+F*D~?^F$pR=3?J8SVLKbB%kILB#;Km@tTZ(Weg3p z6IhnKB*Y!zx?)I_)pPr?<^8Vsu{N^!HyO*`3HBP6%=qBq!R%BY&)HECzW)%kactEB|u z_p|*OiH64>P}MHaFs*TjTx9X(LJay?29Rz3Iu*Qoo>n6+0_cI@#FpRhhKgQh+qN6LKT z>VyjdmNiVJDH`OBh@y$MV+eRsC8>8E|HD(f5iQYSoA6ToQLh(LmURh9t&0mfDzlHX z(>)H|UCeihdsyXMhk+7HZh+ zN9LUBGY%17@0@Bg|Ab?L9&fgzPfm0wCMpbMEifzH^%Mz$=3{LUme-@IrnknH8ntBg z*%UwoH_{tXUREhkBOd~LczRBGZP1H(?|3p~1LXHX;j!kE9T6c0)%!es$Z%7s&kISw zREF8dKE1RVkLL3tHP*W2v7r8#7=?+;f2yE=%Tv-GrLVNNl#Bz7?qrr(H!%bma!k?FThsd;)64T}QOfpM+7HErZF z72m9r9HnF~m>wxD*NNWF_KGU+Q%dmpCgR|No=~Uo?)oEKb=8SdQ`lT*C%h@6(Boyv zN=pi%+e%6X95$(U3j+|FOObSOvRGvijH$DyQ1Y-*C##pu2damZ+^Dz3N8lgw#p0p5 zR(@FmKs_I3N@p;3Fns;wt&ia5vLsZ?iAT&`XSgGc1Ta%whP&ejTPw{=M-xb_d>AW6 z73oLP_4?O*gfEY%^M|#Cx}N)$`DED@lm1eQ5z16O~+Y`5vrIMtLRzLva-(t^NR2@5c zg!2WH4SK<>)F>H}{M96s`O}wm;Z&8NY8k7}AKGqvJv)o+mY^tQvs}SaWC35MPpMz6 z353m}+!mBpr;+9tvA?sP*Qn5`&?8zV;aG;A)vPU!}jycHVnOHyOp>|u>l37 z7<>LKvhcYFUu=@t)I7;{!=EhMYuwXyH4c;B*IWx6Ciy3q4%3kG z4gcPCHoI|5{V0LjkRwCMBkyIlD3&VfSIE*|aKX?mEx6;n2It6IOlU2hHndl$VDLqob=Wr=HFwL?{)P{GYIguKPTq`rqy^=7i>YQ z2U|HU@e0#*=of6|(O)|QiO91&izBM#v1py?#lvTL7dR)|WN((1)_3QMctB&_V|&$jLW`ue zst$((vTpfExgiA}lPbq;JHU{dWnKrPg5*o$ehv^%gD2nnji3nifxI!Yun!yW7nYQb zW_6P5-;>tCipl&ckuH^US$X9p#l9f~(<1TEO4U57B86;U7fLZ*Ht!H1e(92A=i)?s z{RK`((!|lZSOe0peM(FN5-rcA8cR3;C&H;)4+jP}>_SGt)#7?PYzBl-M?zC z_Sx901B2CD`H5V-i?TnOG?tz>fr{%oY_pcWoxvIs0?rI55QuRr%7ju%eH~)_#&Et? z5CtV_EtFs=}R+VgI96ZXxF^O$C%{$T>bJyg;hLmeaF&Nr;#-^Bd+ot3X5 zK0_*I7AP1~L*=++sm=+_U`;DxL_ol=lTR= z&QCf1GCUlACd_cmaCMUPi<5qyf`~nmu%7~0*!$t=mRSe;hYY{pX1*{!u>w>_I9rwP z-y*|X7~jwsE1xi>Ph&sj^KoqBrMC0g$o41t&Y*`}te$KQ7eP9uMfXG26Ykj|EhXp? z2DQ_yCcAT#fGJEgR8O=9IL4OY*RbnORo7W(Vq1sX@@|tbe3? zaiS5%n1uEh0g%5b+=Rq|A`4poglpJEa57|5rp_Ve`N)W^pN?JUGcT7zVKo4Puh9QG zTD(x-Ym7g2T*jsvlFHKy4O~ntMxo}N^0Uxux(MVxF z>Dv6?iua9_f9xuvF^6DOiAsLW3E`3WXedjWQCNmT^T!*rMb&im2i5b#1LDbT`hnASm~df`VYc96ninE!DpHD8ASrLJT2vKS ziT7nPL@bJ(t6Uw(vzg&W#D5?6yLnXbQ6{~jLDTezTCyX&K`99>P??X4!~L-pg1XS3 zDoPfPSd=l~L6C}9J0yd1=~2;TsyK0dz-*mXlpX6wfaG5mtxkem$>p#^4e02$F zJ_z2J=6kTgJR9#MRS#cok-UJ=kV17k!`pLOp3|WaRU~H}jYz(C1Y&n82LyR@;J=mIaZZ?n z+~Ai%Z?m^(0ee1j-FN>7FxdD&$F8V9!rLwE(iGx7Ega{N=z~i%kc^Y;hP0LKD-07m ztbsPf&=4Oq{FhIwZjvlBSf_yPTHpf9<6c<1cG@U;GoQq@3XSOd4)y8L2l9HU4&GYr zjsz#pKiaaK)cbX1JB~^z8GSP@rOpX4T8zM^{NHp+&32LbY;Kg135eJV6#QFH4&?J5 zBvk2>R)hZa$#Bheku|vzEZm1R3}SiTf*vizTU zI5mko3U1Li3t@-FwC4JZ$7uH!N~vkR!s!us1m#&Y=6y)rJt+;TsGd5F-hCHO<6H@g zM-@G)R1{>YaaQvTO8|0B=$+$yq7rXKbjpOLkDb7jH4%AWlRX-d+d4c533$;D#bn?Uz zxomDQG#XAGr~=7tsE;X0ewPB;k-rSJLt?z6NOvxUpp2Snbnn&R*7YxEGeG(p--uLm z&cD254(co+yM!xEvJHia*bS+9mM-^2rUm9N<-uw#M^*LHkzM2N2=N6FQE28)?jJr9 z36aG<9UfHGf9Xgz5_pY=>V5F@?dsbwDyZBvz#eBaf{K-}2EQENRT>WZZJD{_kho6+ zolttxIvN{a{!Qj^{}9JAg{B(p$HyriJ-NC#tgpu17OW#= z6@%OE=vu3uCXZ1_(m>P3MPI>F)wP`l>7Iq&hAv=#kxz>Eh?Y0lIt zEu$8Pvh3p?@j>2E1zx+zZxg)E9Cdpkl~1X85g&fCYr@u5le~4SPBe=;kI9YK1QO!v za1LwlQiR0I(fN@IicKicLyD%(A@Lm;g&1H4_7{kR?=?8QT=&NUjLq69>|d;BowA89 z)`u4=<7+lpozyO{G~7>*$VM>?AirnX@^z_6Jd3qhg|z}Adg}BJxBH^wj^HFT(z43X zJr2JYhFkaSVxbkNPne}r!kdBnm5KhKiS2NQ@?@5rKUj~6?l5SKC?DrJ9nk~@L)=bl zlb^n~nh%R}kU5}e2*iAgH=&@pfk?o#q1HKNT%iezF6nw5!;AuQn+kBTyfRWCCvu0y z#g%@r=EzRcTwQ-4$v+S!ER7g^)DyMnQdRQ#Xys&p?j?;yjv(P@!?J+%TYRy)x6g{1 zMrx`S+K{$R=$7o=7 zOM?&{=Ln`A<{Z7@+gd(dpVR*2bQV3|QNI?@_0DD`6#X{J6FKJ7k4SH%3$|Urflgu%-VnmVjM!f{HhJ9^${tEiX-Dww$BL8%$&^6I)y? zR-GjJ;EM>qC2VI@F=nT2%Xzm!r~#+IS-YgX1rn!9$)k1DkBHwX|Lq#=C$%KlZ_D20 z$euU{{sO%PeAut{sd=FJH2U5qcR2Of=8LSq?SN*X1?@Cm`ta^_;%TQ-{bf3%r~9%N z<4<>br1xI>fJGjwaJUtvGAJ%@cp9$tn8bKg3NViMF=Ymq`QsqPFAmL?aWPDK&8h^r zwzTWSn88wQT6;0S&;3Hj!7RxAIo@qwEroysNY%fkRK7vH8a6m&|LnzqW_J*q6=NIrhowijylQ{MCP&T#^T+ z4D>B>n#?%3tqv{(>Reos<)fJxX!obdaZ4tW)nO7*!$jcFOG3&{PaTYpD}o=Pc9U#M zV_|EV z1nN)3$&ilCa8dn9tQr~(Wx6Ggwv@8-?24!cvuK=XscBJ<1XH&B3JMa>q7lt0I_p2B z6+fLY+`E&-c#|QeiSR7$tq#oHXeL>|PeN*Im|9f=Cc?${Q(D0c%1RxRTos3c?NGn$ zx>VG|77;cF_5Wg+LONSaa+<+~LcJMi2M@ z3IWMEJE(Or#78Oof0#_62mfI*0ndJ2e=3f4>9=V=uPTw+McpW`FYOS?W(^18?evIC z(#V^e7)rDFNXrLP&6RzjloBdYH=pJ)@w)msX!cxI{f;||zEc-uvgDQm$=>e=0l8&KZEI1NW;tBfEH0XMsSoK-m+P(MDW3yL65P>$YjCi8clnF~oy`ZhW{~r60+e z8bWIRr{mgy=xTl*ooe8-&{M$i9!l8tw6b8Aai4l`@R~7l5Axw^KkxBj)?4uDP$|IX zVPq5zPkRxku#iJxpBg+ND{B98+b(j7@A|p_5niRT_yd-?Ci+kEs?HzVcfNnn$3Vk==uoXx*C0#_C$K(_vWPc$rq?1;)Vo!0|y`v!CSKcn}c*~ zerg`am0?v#0&;rzZ`rnuEP*KE$O~hGj zan!!AYUxF^lt=;z%AiWbC!zC73OK;ki#;u&L|V>CH3d47!B5g-0!^l$?V$3#_82|& z<6l7YkK_DQYC zw8;70sfulPeA8R!GfK6Guqj#g?U;+~Whohds#+l{6gAsK603%P1+`8mHmlc;v^tMk z#*o{6nHo#nmAr%Ntt{iUypusuLov#DXPNK3q!nSZdRfK>d6gCr8W)C$^m?@M9Eo+0 z?pm$9#5oD+H^r1M|4}Eav3{TGgNdC}7T>*+6t1pRwqpCX8A| ze{{aL#C+K9F&%ZT)(`P8n?S!Jw(t{6=dI{zYAb+w?Ov#0;a&!&v3bQ5jjbS7J8i9 zp;~fzOZjkl*>#_$LdbRNEa@)=Jez^TpefuFXsJa4`o(h8L?Wr(uph&vxic94!Q`Lr z)Z{`DM#7t|?8}cZi8RPlY~^&EIn?#&BzFktDKuZLK;)9aAIF?4y+2C^i<(*}{f@OW zz6L`EYIOOf_zB-a1Y44yKCMIK$R;(l?(YSZe)#0(bOt_h?o? z?h_@-=OLlMlD(TDsWu$DeFkZ2j5lzn?dK5c|kp@3r<| z1qt_HK{&PdCgEu!jE0$coKoa^lWfE{Eid1+YL!%vWxh<4)5^rlr9MuN#)siMBw6b0 zSGjOT3>TsAOv~&}lSegeB~9>66LIr7m;*(B90FXO_cyAK zG5GrUYVxsW<>x98k^l`cV2XxzB}fjr+(+<28b!Dum3Nwm`m+$11J5DArJ_V?3w)sO z1QKBn`C&O}Ctyao)z<|%T0utBD9US&EoEd!O(S4#>qcNEw}=!<*_xP%VyiN<#+g4i zY{Og*#^XIH6Qin+VIx`3mqpHI*OCbg5@lNvLck!kH>jkh&gwG^;K1}kEV+Aem)I-b z-*6pq2M6(gbJu+azAy=&D_9x5@&Cf=f3@BU|NHCB`hGmO^5(v3XxZbK+GFE3 zt<80_Q;8tYqA;Z37x7xxGnAI$gCFF3c~DY^pG6Uj_*(A8w2WT-xX%jqBVx`w?(@pw z2$t%7m>G%fJ!d3e_E)$&!tpR~K!N;KzAN`HiPuc;-Gn~ENSO??US|c*_p9#PNcY6W zjvBf=-q!EuC%*Ts=bhWE-XaOIY&$1pn{ld_?+kzzYT%C&Y&OLO-lV_5c2c$i`l1Bq z+mm<=NjW^PU478XpkPl_d8)FZIHzlE7K|rD@L*>*trU4nnp3!7iGT?c;7qzZ5fTY2 zGM9E0d9zPgLSx)iYgdNG(l>8U1MEUZ-K+&o{A(@DCxQW>Bh!PXocy z&V+wZqB!NqU-*yvP-vV~7A0${cL>Aa#3kb+(a^)@T-2AF&PhstmZyjm?iKfPr6C}$ zV_Z`3(xH;VY#*G#Ftp~#Q&DN!im#wd=aie8f-$&7q0pJC)#i%>r=b1N(}x%~7fle* z;j=_GC07TJEHY@2O=m_R64AP18a$l%a~6dF9HpQI)Y3?Pwt0?i{I4SJBD0{MhTrUQ z{z6uoJJL5F(?4#e^7`0kyQ&!itA?Eef#@e8dJ~PyW2MM`9DT-wW0g_yEi| z#)&(Uh*~@baPKzm&s(ckA9ybQ+!MZC64E=h^~d`Ww>(U@;_5u?6$BCc-_O0fzvq#( zRNfFwug3~DT#Pe*kLn^=@_6^xmE^O3wr?gJ-mibjf1Gr*;d?sNV_xYz?jG!zaAf7X znvB+ZTRnqP@;tQT`DJLWt_f7`&vG#m5G($~>Sk6{4r|Qr@(I$|*=IL5POH4Xjs(R! zLO6w=LJ`p_vb1p)pV_4IKBmk45)Q@pqhsu<8-qd>$(cV3F1^KkY7m^-X{@ z>9j5LX!q%|H}eLU=1u}o>K7b1 zG$7zdX%Zma%U#jz1QrAj!Tl!97vHeeD3PK=K(rLOlph7B+AgplZ+F}JH9r95Ab4XR zU?Tn-0*tR^=g_<4xnT$lcSXQ*|15W4@#yWi8dn@4Z~c!`>GDW}8Y`!f7akKPucH)R zkk9AG{pVlA8;5nm3iL)QZLZYSM)@x$py;i8KFV^v~! zrODulue&xJ(*#TE$f!H*$fm3L6)M&uu%v>wap-@x5T=u}=>f=f!tqeE2=Hi@t+E(B z9}`c4=vjLNizvhh!n=k&n*35ob(;?p6xM`5TEg#>hc)5ogK_C$Za`m zr*|jjRg9L`eTY=*Q%J$43YQlRbOFn*4>{FC<{LaQnwXg~|J`nQIuc$ec=GR5YTqugfH2DT2d9@?)lx0m&7Ai{_M!}ht%UEa=>5- zWA}1`%A#RuR_jPs-3tt~DN5-+Y*%4-TV$Cd!#Wi5c|>Xk<_3~U#52Xw&gb!I7DTxr zUN`FWs*yddS4b@K1bQLSwpqoWp294FD}BEhEl8Ko;6s1&F`P#Xjhu$+f@r&eNhq%H zHZJirQWywTs1urG><8}pM;R9j`e1YBiX|A{2a|otDa*EZTnHP+TIY1x8lAX_X%Yw$ zX9H_YfK~n%XLeHUZBe3tU=@ZRk$Xdk8$eEKdFHcEW5UFVuT`#-iB>|4AgGGwbOtJ9 zcJM^(!d(11uw`|`7tLQ=v@nuDT~wvLN4pJUtXi^ftWBpNARxO!my<)T}-ZsjZq z_QPr+dP3wP(Fi2}ByP;h_l>)eOHioxLcZkAf9$UBT6{>V{Xmo$$MN^7EnA=to41+k-=ZaFiWRI*H_n??=wO_7(C-Oho&JV$69_!u z+BW=jb)9JJqZ(PRch?8(Hn}WRXB+W%?F|)3b^6~7_V^+D?sP(xC>LN8wLTsC>6aM} zspXl5VC@m$qMIwOE+%685+WVmG6G%&oj_tG#z_PctBF2v3##m8*o)+w$!I06)6~py z%__v?;sa@Z4Np!Mp{FlngVlgd8@xaw8nPm4I3J8xR$|fFbw~% z;a)J;%(&rO?9``)h?9g- z4>2#^c#DoUSss%YKuUKsF?HYpE~+hgBPO@L7ojAbtgL$XyP2mrN%ZqAIM}e1ZDUYr zstFR0_>xXyY*t48bJ8AcDgj{t35~qyRkb}jU#5(afBE|L)q3pdUcc!xv+w0)HBK|5 zz)h|1?}0WKrj8GH8eccAyEn}wr!&|+2G|*s{TbB+S=MJ9`>3G{!2q`#p6M{igh(jyPL$MAiw%L zD6}9ZK(%8{(=~M7<%%2`x3T~nMDlq2{k!L;No&ZuE& zkDty?$nANSr1tU(rXa*~`?OHwX48Q(GUIE#1@YFUNyh*L0b((*#immeAMxg7LYGo{}Jyl*Q0cJba)=5LyuN%RXUops!s9THz> zPAs)N9%!~v`-Ar)JxueiqHBJv^ z&4%|Ce}r!jra}(Cq|J97=2tjAVe8GOmqZBwobKPB@&w-xji8xJ9s_Y$wwDdLk6ZAL-}}Yc$il_^k13XpT3!c9F3aqTy9fhm3b3Jm>^qhp=3woYgu%BZy2sGW#A3H9+4vA%d z-CO9gSc$nes6BPN-s|{9+;&_A;k9(<5(u1ZaHnS)`7A$0mz(9b-rAopCuf`ZAD;$z zj_lbPNS!^^);r4Qr>!`Rov;1b)@T^LDO&q;*0az*@33|oe>{;+{Q3;Y^7cN7LD;Be z$M>@`hAjLGNW_b`am^Kvjrbe>eT@tD8;h?OgKOtP&##YZIjY|g?u{M=wRYF$7>Qqm z9ewsQW~==?&Ys5JFMfEW+f>hYz5UE>*^7t-agTsf`wTtCg6>bXpAXKy2l(%=D-j!{ zt$4l$bXshctT$cPN9+diZ(L?%Co>72ADCYuT2>{1)4mr4n7gy?D~W#ph(3~q6QW)V z66fVV&2%EArBX5(B$Rz5e)R9Gu)wChCLMoorvJo&O?ywpCZR$zp1deRB)_$~qVEVM zS=)<>(%h47=Pq2IxCb8&X_yj?%CYT(zA=wOJQ5)8BOT4^xIrbp_!ElwF&FqhS@to= zmP>HuHYu*_I5OtgJ>T*^r)yE;>2&l$V5?x`{?G17jPM-vY<{u{Q;HDtpOyZE!r(lt zg91UHk=LV#CXUH27AkSg{a(``o0O z^CY_-2c(XuXvm;EwuvZH987K+ynw)^Ngx7FwHjj7j|w6wy3oYIqSThjkwQy+un5I! zlqs+M-+v-3ZK{E69 zhg>ryVfOS1LrE0wok_mGVR2PbP{p)>N&H zCg8^SicG}~u{x@di{7wxRqmLtl0Z)5`Dn7EBdoWUC(;T_T%y44_%>>XsGFAEBJBD5 zP^?s8rHHGL$H&yK?|bZDzHSP4d2Am?>cy^uIk=&lYyS>mwGDhty?{>CGLdR%eUnT2V8|EQHJNdRm>Q17|#iUuSvzZ@Rl$ zAACB`dygGf>ffhk10Q;dN7nBI_YIrxvEIccv?KG2-x&lcV8Okza!$w`g#kwp0INq|KcMgt+gwMMH9ZZ z{r-T|<0>p6z;$KrXu#@4=SoUIqJ_%x{W;e7?Kr-J|MQ|k3NBCM;X$C$KbnX8c8?V||EoqPW`4aSoLUR@t`mzR&}A^NEQ*zWP!qyqEQlabKlAF5=x@wQ8x@H3 z0cmN?V*kwFl<`OY#HMTUHDbhJ-aO$<_6Q7)L<@_S%@_56)=vr$_o<=7_*CUf3Jb(J znQ5@H81HbB zURDQgtyeA|1OZXe*P$bNm{RUhwDE*G9q>cB%NRJgR4j889H-~#LsM;J=;A503a7a~ z=pl()O8Rn!Kb31q`nSqh%wOQtqnf@Vi!UTrOrhPqv_L4p2)d0faDE3vLBlsI+T-m&u{M!htLplrw62!-9=P>XF@+ z9GdP4Y2oCbto}&gGf4%Ld|X0Nneg~6I+xdsbX1E3YCIPh$KoFLvEDuW+%)0rdOiT! z_nuhhakU!;!+>t%u8riMy7qrIK2dqjm|w~w2KHk0?ywoc=lWX7M`b7 z%%YA=PvNVXUG3Yw#O)47_L$91#tX5A-UCJ%0ndNd77W{u6A}6y9ooG1yV@R(Vs*}` z{4DnyJ+^NPo~wAz!7JWfIM=Cvs(lCgl7(jd>&%OfIGSxn9&4tY--V2~FQB|KcYiW& z=vAliHeJjSX~shKtX!i%R?}429skt=(%p4q-qz<*J0WAff+Rj0coX_(djs@^ z@nH8xm_SwFqnflwtEW#(@|IQDB~gUcTgCB~FottemCwfWS*Tg#;E%ihW5$eAYpQkBz7NNJm>@pz4Dmek4WRQ8S}t*jqzW7)S5T>K16tv zS$q*~G)_r|2bhTmd60Q80~)QyLB)a&FieAK-a4lS01L^91d5sE|GF5bV*M6EtzLHGp7n1-Pb=3tluIvEnr zEc!N8Pr<;>`52C5R8a!c5l>*rYC}~=F{9uioLVwdx(*l!sEMG!Pt{L6 ztf`d6h8T{gRkJtSjTa^S5@Rl-?aQq*8^rKOlsbnCnXKWV##pJ7%^}SpT0f2&UjtuL zN^~r0P>AFFQdT0@@k8WyHi}9NW|)DX15NDTHYCHRFqFc9-co~vnpEdrx-0Wld~REE zH&kv!IErR&Ks&XhvE!QxP%&cqAEcGpzHw6Yz|i7PEQy_9H@LjwoUPo*oFM)d@73SQ zCD`LaBfY6#*WKp4w6?iMOyQqS=j+b89S!f_j*H(tcKaNKp1}rAh)2tj{=1=9)DOi& z;G>u9x9{TL$CrNMGkTo*hoy*r@t^V7d(|?0foRB4^nV-m0(P-Yd-^Ven%|Uar1kzh zMj-pWY)L%DHrvZtzz!gvybmTu*r(d9JZV0XjbC=~zlL16`()*@foU|Oy~>RL7B`b|t5?r53P{k8jWe6>K#`|8Eh?Y4h2 zv?2l|)t^()Q`79gr|@=ac7K-bPzL1P&(@x*yBB$ZpR>B_ahJJyI!y2Msl#u#T~Wxk z7x3KY%$)I`j~C=#cfjqpI&V8pJepn}JI{RTz1=T(Sg?N$*(6_R_hS@vlquBJwyO*7 z%D_1f6qW(9OI#{Fq{W$;3^o_eh7C_7EukfUkX6Xw{2I4bW;rJ>&lZke&rO;w&UT;1 zvIoMLNQ_V~I)K8~#D;~}1V2As9o8bu3FMV}rJF0pf7g7JF+lAOX9Xp_7qHu?js$CG z=LBK(?zIwO9uFh`9<3V0&z%3N|07#jseEj-Y3t7cxzf+Ld+D)xJMu8Ons}b7?8W>X zp4t~u4mka=QD4gKa+dpL825DEmGY{3>7(I{xdk|e2uVHcWtkK4{@Q@asqVf(i1YAE zU~1j~;7a^Ksb&s1)wWR3x-A%pki_)@r8JR#lUta0o8ShGgu&y&XN;c&${~=#)x@v} z*IBN?E;_X^Wd2e1dz$FUUJMp<`9nQze+vKr)gkWE9wwNNv%KxN+0pGQd`t+ zjWJ0@toI2<0dmFZc%sxosUcVy*r5L9&=~phX2=k{?%P3G?u5o7(LYW0;`X8#szjho z!2e_F9m69JwrKB(ZBJ)nCllNDL=)Rq2NR=Xn-fi(nb@{%+qV7oIq!4sz2E!kFZHjg zU3;(fTjGCyphx`s5aS^y;uWGd<~fXS=%zA1<}jBqJpj`>Cv`}1dh1h@As^i$s=^Xn7-MR45E)MPCuulMy?83q1w|Jsb9K&3o9s>Yc)-& zP9xMuF>P(SZVP;kwlSZYPfNor^I{IoTLI5^J|$3(K08AX#5o@yTToVqmLCD-8CNtp z0S8>|m*j387UV>Y)elnkE&E8XOmFvBrM-StpI4LinlaxZ>UHef9~*ATLlw{3UqUO! zN}m-kIxZtu-P!_T-d=Ss1F|aW@zx)%vvgD*V|+ai3s*0~Ji)9@UDt_+e%!;xHOJl* z0jtmJt8+fL&m%QBhX4~P-)D`+EJ=E?9HBd!59jw6HpzEet4!-2EQ=U}=F`y0R*sw? z@DMaKY(vS?#$8*F;?KA#>gGF%`L^YV6@pA+cdHfE#xT{i$O z6}iSceSvUpnSVNXXp6DJRn#e?E$oM>8^RV$M=^?5W#xDJaJ}=hH9NrSi^(6tj1<2> zLm#jpIYsHmTFV${sU16`co3;YSW*PT_+1iciJs^a2Wlvjk`X&ZFes;R4x7M2MwpmT zf6~YNREN|ZYk38l|6vd2UBP`P3}IuE`r3)#Y5Zjsy*bnfHuY?F8h-rWV^^@XaxKnl znU9`m;~yQ9H+AU&5$`T#`#Nx^mzp$G!ItHfgpo?`D1#48WW0rF{H1i?O{^x|xk=k{ zVFqc|aLpeVw&O(Yx@jypUzwT-*?l?4l$g*-HV+Mz{WK^w8Q2SfcVtE>Wj{BJB*KKs zU$GSi?(9D$N3Q(;yjf#-R;eCgtEt^2B!ME01w zF;b=edA7b`4+f|&Y|AGrk8!7IKz)sd#R@O??1=hkDN#}JW8-W8KjPgXRAu9Wi&%hv zFxNOU88?(g_LPz2QgLIUD2;*#!2>i|RmKvzsBHx%SKXppHP?W!RgM6#x96F*15PzV z7-VWps=1RSv8KeSaj%thJCt6~H`y;ZigfOsB5lK|-`pfk)C#SCyHF~4bCu)!)-rx8 z3F_^Jy8z8UEg*3gdnv3tWlM){f(Hj+70yXf=`W$T;?L{fyqs@8$w#rH?en^>*Ip8>`P+&IuXg>;VW^!p+ws@{R zFje~F)x})A<|_viQ4gvL*{wb7YQ4fe@K1eTMH6)N+c0nb^SQRe)}ZIC)i~_ry?qo< z9!j*_`k2l4tK+i;O#pHp>+}5Rrj6$=h2EZj%oRsv>8@OD#ID_tpSC(MO#hx;sN`@1<$MM`*QGfbzS#`0 zPLeQ(pJvv87jmCYO|sAnJ$oqtoT`(4Kc0m(kI15#}6O0ykY)ZFwGENhDmC-d})xnEhXGr@AgSbj0JfS$47Z|3__KN2|*kr%>(IXUo- zbEeuw^&bfIyZPAw(+bd~l4UeIA>nEk9#5*M+G_`Cs=%m+)Mdufiv1%yelbGt z@@)kZ_ax}7scA?KCp^^>9=gY4yOPi`shS*dh5y>Klh}YW%%tW-+h!$1=6we;ieGyL z)^9!SpsGIlFt;2xzqE=|CZ?yGe*4WaXT1K9^J`R@g3z^mX z|FVwdc=Ii{W9{2-HalK+op|t$5?e0=`nOXWcdhNlwLageRsf4ZgO3}p;lbYzC-tZE zj)vbGKRWGw?tQrIhF=*%i3fL;h?_6Y7IigV?{f!HL%$};1N5W$=qp#Mnk?nd%e{6_ zt8oqAZ5C(WU(VECP6w~yGsZt-cjhwKHtvc%c=6r7q52)uN1_!%@X8dyTK1ypS6wXb z4)f)#`D~i3x)J(pbqw|x95S^S?kXXz7hBt}zaHn$J8QQn`lH?Otj&KK)zS@WdMzB> zyO4w*b`oi=;c&k^;cdlSuD4Zd7IuDo&p67i69YccM+))g2j1#9Gyxwsp6s%EV+TSG z8#jL4E)cw#ntR^Au!TF}3~%@P{kV(hHu$E`TPzINBw?@pb?%lRk+I>?{dU(E0O8c_;mn010reo3FB$n~qq)K3^4*zpqSSs< z&v4eNZ=Rhs6y6*M7a4A1Noro9f;5+^Mh_JFZysDOlDc(V?t$ns>~+*{R~9r}P2!=# zP=%mUoc1_u+z1HX?ip_M+6g@i+Yji%?MhaSPOgGJ?T?feRWhCAAKDd+4Z@lgM$ct) zNNU`4wbxWdTUtjzvQ*TBI=lK^&|e}hYyAb2oHV)OZC%edfSHC=PWd1TI3(irl$tIm zItp+CcCqRev!5zR*4}^}pG*-*v7tM#fZa%J`p5Y;WH8C%u4e2P%RsZTzG8@Z)>+ow zNct|U+TBh@wod(t)-VQqFcuLTSrS!$`zDpn+a{JGQ>OdF-0+E-4^e7)`Cdw3p>x#4AG9JP{x*bCSNNy0gtPS zoaVEEP*L;Gp>>UHsYaov$QLMfuv8|L1IY_)^V0w6;C{LO_>ISJHOhkSDVC9muz0m%??85A^kqSFZlbE8mYvLB1A&-9JCx%Pk9@QzL>OeyfGtp?(@P zk=NK~b#Je@MxGun|Kn3g_)F@!-i()7P2Z8~a+NC;W6PVV|5dy3Jr87;B1YVD)rQ6} zc}*{u+ssiCQmN3HM~VCFva+IrP+uN&oWs~`J=nSK7s_wrHm)=`Yo^e&c&*_(*6Dg z&k`asPun;*#M!>TkNLat;mptwFdNhHMT_edVHu-1wGG-?gi0!GSHQ@V01@uZ*8kRc z^U!r>hG!=rcS#$xi%exCi{G-mF8J56@8hV=-oBf;b)OqAYRQiil0`c3mV$S@L>15Y zSuET~a!3Tp%C3iDftCg$XYAfa!n`v?p8K!%)>{4*aTn;6CV{(EO>;emcbix^g|pCH zgwjlr#)KmgihT06Q_D8r&HPwS6j66~2xQ^GPYSoRDxXBrgjzmU-xv3k{j)Be{2 z1&T9$EUUovnW6v`?T(q5E}d~hp_LGbOSq!)D3loW4H2?U9*kpu0>kV|`Cz7g3?oqn zQ-*MV&8owy%TdU{YSQmR*&Bkudk2#D;ZFN&>iqjgXi&3fhr<$D&OB8#+jQ`)&^rCb zR|+qGInDyR^hE#^oEQek=1cY4hm=ETofyS@@S^?jjUt^2f4iHpFD#Cn29dDJU-xY? znf9<(ZN|HWpL(VXy59fm|8$-tA`ijW55qK(_--#P6M>)5^ruICy$3R<#@bLk>_@=? zv%Qj;?kxvS6ACIa?ds7PP0XuS2I8#n8ncuIoBf~1?IAKLX!4M_x@eiI=%D3c43Ny2 zJ|S&|*t>mr`qp|Lnf+YTQEfD~r%@-XrA!%6&w{HmIC6*5pm(E$5U zCloO(bu;pIOAq;gU;XU~@3Cu*pVc(08oG`b08hV{WgVu`3FU!JXq)^9Li+6%ZuW+PF!9*H_XSrESym|=WQ}u~p*Y;-1cFazoBoc9} z(V^Jkn#)8QV%d1(Tff1YDBJ8nE$8&R$LP+{<=NW3(1urk7hHj&5P?GK)F2Y$@6OZS z?(xUZZgQkl+kPfqhi41mq06~jITY8Q=lWB96`XaqWWV$rgXJIP4v;64Y|QeAglf*; z1_-C)y=}NA&UOVlfXPTBwdMTZbJqZfiLFu99laIzVY*G*Zxnbq5Mf?mJyWn_ri6ZD z$v}}GU6p5K#xnoAh+77@1UH@IP`yb+1xAwt*H0M~J_%K!xwSAz7LhCZy1Z>Q5Bh@4 zvw9?{cUDCC1y1v7vMCZghpA|TbXP2{P2RESg^sb+|3jDn8+WgCrIuTg)Ua;=4Qj6I zll6L(>5SZYrU3m9Xw94tr8+!y6hms&SipKS5qN@5&7|5UF9X#c<+?_ai|3?buoM8g zFTWY0oI^Uvn?gcy+Jje^%)OYSHUb!;1Z&X=2bcfLcz3QbAJrTY!K=rI6q9w7w>Sx= zl2G7t2K|pnjL}y1YVf>zx7M<#Aql;Vbxp6gi!Ors4TMiF&B^m8)n3Q>B58gw+d~~# zAZc;wqluy9xh#AyYm`Go?B!&1(O--UO84ZCsUb{Ulp2?v$Ni4a?Fha5RZSB5gok|C zq2+j>qznoZ2*oW*pDW0eZ<%0TUj}vRH0%g0fL%pjdd%$F)qUW;s75)722^vgpkmfx z@kDH6vFr39^4Tk$WP@ZpT6*Z^nYtcB%>OilXBwXUK9{nau7Wj(?|e){Y7})E0YA*3OIcbpuq9*!qs$JE7zOP(JD8&pVkWtXI9Er8+AK{a=yvIIjs9Wzd3xKJg|9jx+w(A zQce#8^ip= zoN*l+Q?gHl->{zW>(0~+kB(9YA+RcZkVc_J(Id*T$+2GD{Y_-2$4nRaw>JaUh`aQY z5vH1t-H)-U42i%%u#F@-ODY@wQJ_j>UrzG4$H1Z2gh9VGA#k&E8i)&4&||U9XF{?w z%VyEgGCfiC<^J1VCR4G}Nnw)xl}~L{(HJ%sQ9gWj4+BhxGKpy(_h0q~kjZhhNKYUd zZwi;FnrDNBctBT*nklRjmF?U&)4np#w8Yxu1Bg}WG_RT|iuNcLkMDHqA-f@CI5r*F zl(%=RRHTY@+DJ|ZL1qU8)x#Kl(V(x@zF=1J5^V8$JH&WVlQuuYBIW#!M;IEB+f)_G z9@%CeI{iQ&n59jC!~~TRXS1l&u2PEeQ?-m*3_wAiEc8I8fi`d5w{t%nsgPSKkes}T z#}!r{fm5*(Li~-!h;T8WoJa`xc5HE|U&qVQ4aH&1OokMN<^LumLv9+1!e^f(U;$r7 zXHOxL#8RM6UNpc_amhS_0Xo9~{YzuLA3#wir(%}D%$8#jRn8>E2Il(}n3tH6^6(Arv09hokhAQT${cNp|9wKZjgvM>$oWLx#o`vZhzdh$UEd}bJlsJG4-)MKt17d3dsBy{tn zJA)?_YI^n40i}jtG`k)avt9m2RJGlB#h>{jqX>q?X2O%c?bOBl5@m6BxzFVeYjNX> z<>@iywnw8BuihEQoBY`oyvar%$`Z)k^xhrRZ|+NeHtN3Ds;o#otUrl42womuEWM`p zO2rWB9mNm`I_*t;#IC!ZCgXK@jXbIF=&`nMuU(l>-2u@A?sObaZq?UzmaC4-uSx|P z5t+CVv~Lqqdpc1CZ-x&SS~Wtf)1iV{G!jF^a_Hp!hL)qFoYm*L1!9~QdY-TOC=`1p zGi@0KBcLbrNRCkdzM9~*oTk%Dbp9O=GB#wgFmKZwAn18}zQyKb5iB9~fT7Bt zTAqg3%*hG4nK^x@*pxEOy^KS>&bzuhsaR0C!C~Q=TM_y}jQGT9%}Sc#C|}XjnBU>} z`IL12j=Q`B7HV-;(&Gv1pr94ZwDjKR z-r~5Z&)ceF)8J}()uH3_L#Vb_;^~f0KFYzWt0S^Xf104cPiL5PSS2DN3ggH%d=lQ zYd~7mQ;|pP;t9ma$W(DybHvF-c;!jQ=(e%Br_<-?mil92QkKSHKUeVY?DpxW;&V=J z`ESm(OEaMKbwHQ`BlzxrF@(fM+J|9!}q;Klg-I=QZd`daWv-qu+#VbCAygDZMnO5(tF>Tc=NUT z({rNp^(uzV^4ZFMHYR5SJmUk3_`YpTICmaaG}-t!6 zeX8l-=4;4#e3EeRJjU{CIN0&3GyoPYWVgERM(6O8RAd3Wn*&!s<;nS-w@i$F%k@In zfq)p@C zLMGn-Dh?c1e}BK+=y))>Hu({$e-&sUboaSdeO`XL__@1S>G9T;ON~n;baf4P@mxXw z;kW2eL|}Ptl}BQ+Ihpf#@o93)%lkGT&9(k;ad^CQ?QnVK?nG&o5#`&a z->DyE+L<^A@-?!BB{sriR0{9cpDY_YMDc39bm32=q!~yN0+Tr4TtuD`SZO--g--5r z7`9T_XKPUIH?RsEwY=Z&P`9N`fz7lBszhD#?x6aw_UFuf8#f2lcamVcJ$c)SvB4O# z$sTK}vPl(-vM0N*vMb055Z|Sk$VUjBvyJ%JV%K#(ckIaLIVi>!(qVd+-Gi^Q8PZQY z=;QYZx%?-mfJ_imtnP78=>;%98s;yE%A)XpQs!D8{W&Dchl`E|usGooQRlUv^1YL8 z%pw%3RErvxLE7xt8nQm#y=6B+xx5X1w7Ok%>Ton9n-_vxTxRxezOB~P%df=^ zRonM>-lUBMiQDs*gEhFk<TTou z-&CFxV|9-2c1GT0`(w3zHR=ZCI(tBrJwwuCHYaQgCl)r^s)L^D(Y5f#CS}%UnA8Jn zD@Gy}4TfeK9rQ)5qyBjMYWvXsjB{whZNNQ-MY8Ft^zY=ffbIRLZ@&VRYQYhfdDfE3 zPVwL<>3y{7diH$1KCI@=?Y$Q)@l4{aKZl5igD~cQnb#xCvw&GW?7U2Ox|;k0=6cN9 zRnatlVK|JubjFk^M6soVD4)bvtQLlC$^U@8w03mkbj=IxQ8hjZa||-$yq{1iM5)HX z1K4kD1k_An%3VBAhnteG;;ocbYRp&(jP$1T_pHi- zNEP4LqEy$0(yoX^36bog2D~Jp$!dkPzoLVZee!-eVpmB9g|#m;hh0jPt}o6U1O?*n z$UmPpP5;F>1IcE3i4KH0zS$^NcpgXUZJXhXd2*D3|G**&HOZPm+Oq{?5-4tNDm>&p zCw*?MFDZieYb~sO8rNbu1SEim-A+4*5)Q|XBp_{Vv>eS?1`bb!0`@kh{FuMv4$%}5 z)0C04oc)Rc*2(C6wCBbw=sV4FXzpGuRoFQAJ#}pM^M*Z-AF8Gv0zSa7)?@FdY&eCJ zA5pUn>v#Iz3)^}^ou^YkZNKGq;?MqZ8;vuXXb5fH@0<5qc0wH;#lH;Cc^19*b{lQg zi+wsSB2G`?7RtDP+Au9Oz_)FC*AFnI@=XDl;!E^GaLw*4SW9-XKXfP-$5{$w9$207g0|mm%`c<2e!XX z2i2fctFmJRk5FZQz!F7@Qm%5=d55VWjbU1NP}voohAF#cF)}FlEH3xeKv1eBwN(w5 zh*w#R`UkVP89WX>x;4-dq4PjSBHmy=O7I)K3A~xDboKSg{O#^AVUlzB?Vn1Cd@c_E zfH3CTD4$>|N|!9nB{s|nnN3oOjF={_>-p2x-=k|+a|ErNo*=*q(4CSu>s*&;%bR-$ zqcFY-%s(+3VP}<8#M9rj07O{C1yUyV^&74!;a}!13C|J#F0O*>TFFSjQuY!5!(c!f zUa}k>F4BGtB!QtY0x;AhPsO7Q&qu&3od*b?uq-MDLD075zn?7Z2~dz#GbVw#%qK8 zcCeqn(Za!@V z60cPsk3A(eKi4~~y)-ll>l+m<*zyo_YU{goH|J|-Y_{F*5;p@+2WBCKZYx*nb_3A_ zpX4%9-TQz->Le8@>S&tvbmwKIl;||{dZfhNvikI(O9IG2G zzIHFCc}*Kl`w;-4w=KWtryn|^#Axfj_3k_7lIyg?wP_xxc-2xwdwS(@Q(w z0+?Fgw?A*L+W9J%UKZ|8^_Xcrk}AJeDsJ>1`@}gBHHCuEd{U zuR*(vXZPK$n1%g{=l+jJLGN4h-{}kOujFW-mx~TQCQhKgD4DMVI4q6(l*wX_an=aw zT6t+a2|Or7mfgEk{+%1|z0DX7NPMq)24E%+@1LdVrO>GD>ZM>8zY0>C%Fxd)0(!!y zSSv%k=F!U_o6MixVd26Jv^ov^U^f93;Tu77{>CgZgRL}&AU_9ltNHi#qinYH%$ALx zJm`b4G_?3t-ctdPr|*dIAGKT*0<@1TKzAN{V15g{JBU<7UGBepugrhasZ5*dvsG2 zz=UriGWP%$^)50zX7IP)5vjp^N7M^D10$DpS3eEB0@M>e9*z==eI7T9!8uhN;P4TO z)JZj3<~6Y-H#?dGk)A0A1)VGBME`!*XSN*rVKydNXLKP~Mi%AIKVwz_-L@tH{R+k< zIpo16op8)JmxRNDN&`5@O7G>AvCR|8zqgrhNs2s~lsxqbtWNrFeh>`LRB_TyxC~Rh zwnPqY!t#fE0tgK1ng2uz*5?MsYt(Nu1vZ85 zu!ba2{4H56UT%+i-3Hf?`1g7ir|(WtdQAdd3!Ypsue8 zqWHGy#j7l87ipZ3DtKn^@3yh9+^yP} zb%GQAy6pFU^YHJ>7u1^HI&Bulf{Rs*t23T&b2nPcQM8|0U{+C6w^)ObK{1&xm~Q3I zLkPpbw96~y>J|3==cII2Wow1XL4j0IMDgK=VLZkswmm$`P_>K+7AoMt zH&V`&qMu>;V>~$xB#xN$@|k+!SL zYEi95`c7e(fWS(s&;Gr8#9{Tq~G!*$*H|6iTJ6b9c^&+$BV6;jtIIq$W z3fSNbt5+34n(aY~ea8w3rtlDg&4JUu$~_ZYw+%VSh%jHbYLvQ`vZjju!_uD;mZ()} z(5ej{)5=^Dov^Z^h>4rMAVz)=ri>wDZ9{I4odc6jcVRsVJ#q26ZPu)nf=o2{vkFp^ zzlRNYw#!Gsv%FM)&m}pJ&5jbGRS& zewHfuDA$3;>Mb~9X;lG#&z1R(dV+~iz%VoWxDAOBp$ICX0yyo{dX(H1Y;@#tDmzxS zAWCi(a*m~tuIxz1tU23mu=hzu$F-|J&b)qbf11Z*C=DamOE8(b^3j}X;HgZtKSF8M z0vzBArf{(RRKS}9O7D{WYBnz9+d*dDM@fs?{oIq=L$6KtKuv8~^oObdYi@Sf(YlJ+ z_}AtAoF?+%*Ic_d=iYxM6q#dp;$S-Ji!F5E&gp%beifaPc#y_ z)hw7D*|Ejy1`DMMyC)N=H3T}ivP!HcVj(;KT2pwwu~@(Y9xO2q4WBX7_*R-TOA=Pv6gmJ=?M%s zL!OQ`77avnpZ{CT?{&9~O^;899Tl$~1x#XT?QSC7PX}A(WK9@gmN?MPpK}*FtN@JPPiZ%I7l#)RAu8pvp|i-X4jx;VRrx<(Kq5dn;~Y!? zQ9YnA?vW3Z2ViZFL1JoaT21mAAU4^o$#(>KrIkF6Cw-L~s{c&1CwLP6D4_;87~PZC zI2|)iOq*y|ywagO7+nFx)=@mnwHB~dxm9%Y8SC`#_@t6`3)kVE=LA>LSI+7cUwJna zMQRM9lCZV)#p5r!57={x$lg@Lx0VJTSvKB{F*M|X7iKSwtSTV(*&ccUBC8sQza}lfhY@^>Fv%AKx{-%F0;jPXX)C+z|V8OvAtw)6j6t=nn_Ux zPrHb7w?k~k;0iNg>fvUavS17k<}Puwj>0Y=9cn3Rz_M5e^__JOm4emag;4VER5G{kw@YWm z9Um5FllQlp=FiN26{la(4`s~*E(@FvO8Rm~sCINW$(T1bU6~IN5SsAgqq$BDbmuv5 zc9Q-0zFvwPXVPOFxb9Gga9At2B|$2W0P0fQ$0 zy>=Ah)T5gUAMBu}7LfBGV3-LU zL;%Pwn@qHhHFb=8gTr5PYDy9evqCC>(^y<8Wk-E+ZBg?pn7e95*^*!$e-gYDbT_5t ze}Vk-r4-2FEYOufxo}SW5sH*lwFkl7ueOX|Vq?Md;rc;Zx9b%GA`EGhhgDPb56o;Z zn@!7kBs|zcmhqpfbIpN-m#&#^V(#c__~3*|7XJ7!k(zgK_-*(bnwdH2Zfd;~0W>7Bb|b7+%)b{Ms5yF@%5r zf<;s|`j`Ndoe&=0&|hKF*-K=Q6No?m&$gSA*{8NSmD$wpNgi{~#=~_`!Wv!xgZW)z zb9(v~2+Ih1cA{YL?3smzSv6$HVzY9}YMgZ^6;DoZQiH)#vWaAPO-hK&BCY6AJd$*Z zC*u-78Qr93nFT_gJ$Rme4^pvY#L@_y&sBD=XhMugUEVfjrh1jVzC3*BBJSv4FcSeX zEko+X^x+f>y6z|SC|$vbh9i@e2DmVu4mxEFfwi^tDPw=5TJD=Z^ z1_K?k)s|rS>+N&gS->U#GMB#bJSu=M3SUe&-0PkdsL;X312(C3e67Cl`@xj2OdfF8 zYW-bBpRDybC5V>(tr#ja51VU8qVFV>A(B71oOQC@@;xF)aj0 zVCFlsRKPS&KF|W$H$2x!PQLxcqW7ug2Gt5AlXEy>kF#0FIl2(xaDnHqaP7YTd8V=d zH~o&FL?~2gN87wI!6Hm3pt`e6b_xeEDfCB3u$(L>fh%;4F{L6Otwo~r&YW3re6$&251l1DA$ozx-2jnqrWGp6X=HBA!Erf3 zr}Ggw`91uuqUtnD??%#+h~p{?Wu(L-oM7am_;aykSD6{T1T2fVela*YT&=R{153xW zKjJZpW~eR_n%fOzy2eb?$%1W5&er{#bi~ytjK?CoRgJfBGrH7sw3Mk~Lrp%-qC&|~ zbb&!P2L3(Sp42|6T0kZ$(QdA(Yo|RMOD8M>AG4j|F_RK6oKK@%|JYr460%IxZqn1~ zj6gpuoiI6ec!A?F4^M#4BSA3}3^Z`u?@Q?+N;89yuQ|!ZFp7v3dRBcriPIyeqEny2 z|Hm&dBKM1V_v{#^|7iBTfoAtO7Qn%DO1x-_e4OTg6LU=-KtI?t4a`3P?l+ldZSO-) zq)>SYbCZ-r=&|rp^HbSVFkxvnYt?O2sQ<$0XX5(bLCYTDNI|b*=H!v$|Y?YHql-V-Y2p-z^mv1tc(<>5sHN3$(tbtZjcdXB25>4w5ZA8zb+{T`i^ z?11c7pl`nuD^@?;JQ;0i$QZI^L!QC}BWX;4t?m3&qL?v3aXz5CzREO=)6A&6-9c@r(So36`%dYX z8_ZH%u0N0Dw@b61jss8mlzk|)Udt}+Xu*q%9Fd=BE%?Lnr_+)9zyxxLFmob|4~K^j z=!@8Yy!eBY&*tPJxH??f{G_A^M%BXQMlz-dBd9Vo;l||wxaA}n=$2g_YBrxjpc)4< zH3Nw?EqzRQcrxe!1i3lLWDW!nzlRF;=23qSLVUlYxb6Jw7uq9TXBTf@&2Yt4^m zZafwj?!-OiW2e+}ab*d(p){=PNu~a%#6dL-;X&iLnWp3>s*Fk2C5K$lV<&UO7=J2E zlcytWOU*1dSMH%604)1t>fIT+uSlpDm&d0bKI3sawXH7L@J3r6Mr!1ceeaSKq0`d= zwuymJz&|I^@CfvBT7(5`>vtv+yO_8igAS6ancEy+hHGBZrY413{gone?T0qtPPl@c z3_W9Se$b2y%KiL3lT^fBsNT)|U}^YHjbZoadz|)A4$a343#Jv5=^3(uRW&Vq9%@sG z#Pk;glH;vNJ1prv3JO%7sQqdi_#G~O6^p+`&K-t~WGCVsdSow-&Lk+Q2W@ppp}i&A z44*I}nM*S_&Vup-6#`=}y*=n!6Ff*)yGgrcJvJiNB@rzeT`IC(MB`|P;1)zle?;|Ctyop}C%oYWG{3zd zJZ0kbai6iU`aSW$oSC9`TK`L7*i8gwnbJlDSYdJ1)3CF=Z*F$zfxWMeE zW%Ztw>Juqgv@7$vR?avC0d2RQnMec_=@H@5F$B2`&c5N%8D{Yc=@iU36tn@sR9(l> zL-nc5$hojTg#(Fp%$RbA3kO;5CDeb}+Ikq+?#dt#XW-lZaaRXt&-OLR5|U~uYWG7_ z0^)Z#q_)I99D5S?-U;75d$`yd|aJIsrY7gQ{dLL>j6LC*Gaf{poV*78BQ>C;NRuwRFfM-j`f@k}QJ3mAn8l_Z>@z86RWp zs4UMHO0-j%dA=7Fi``I#>*)I>M9F48xty)k!0EsN!~b3FbJne=fQZGAsY)iBF=dJk3}D8AHFi=aE&J;)K7d%bA{dO`wu}m`(`V|9 zX+78{>m;D^BEw_Oi)c75BcVgCc&*8cm9SHz#FFMH&$aafdKSBRzh?XUIc}3FRHRsG zj;aIb=-+~3>d!x_;-SF|qRr?Uz2ovvC`u57MiD<5!(LGe)uK;|#l*Qp7$!_|z27pm zbi=}!iQqJ(anD>Q5~HsHq-U$usz=nBg8rLsViK&7s#cQ1-r^)@#VudsZF_dg(n@sm zzN1^g5I~f1C}HR*oKpY%nX8D#H1L({ zj>dNY5r9$EqvTH0SrYs5i##zDB*lx0p$2(ju^*c=|0xc|iR6MM8( zL=>jaFxqq+{5XP-TN_w5EnK#+lKt<-t<$q)26Y=!{~?t>^^eqkYWm@Uz4Bo~Mh7Fm zQTyGiH5*28xi3eOUsyb}irtz48=fd_p4LRJSzQq(Zk!`>QnG3^L3Yv|3HdNDn8v zu2Q3Ad-7=hpJ}JL#iGEpu)?_D%gkVEkRw>%!QUcW7#I>N%%-k#Et8`C$D*+t1Yy4r z$!-#CTJuFD${2H>ZV^kAKb*N%mx4;m{727-C6}gL>yUL^Zw1UdbORXvSxo}h*fwdT z4%;_kZC2@C`pEo*F9_W#y>%z;%>|7h)Naai_B?shLzZ1NuP}fZ+J1qtcm|6I%*ts~ zG7-O`ZgwBe>!K^l?)dHB{pu(q$6fI(k!P2;=HN(w%gmhipuCkIWUuNi5TUJZ(}(*G z@RX}5Z8Pfg~xa;KRcxMb$C!a0OG}+9 z%dI}{Jk~#dHb1aq-#;G*K)MM`5z$ubX!q0D362r&ydpBs`+lw+c){e9Wman5?@J* zQnD(OibM(4p5>U$DLc(2;{c!@OruJ~3yRw8NL~UAqvim?X21nhur4-pCx#uwjBkF0 z?#UBM{~GnYGxZP3J7{4#8&#oXvKpEjK|2l#IRjxPw|goF~3ha$b9_wCh^_YY8w+*Ru8 z2VB;&oPu?bYQr7#Hae@eWSEs85AR7bYw## zLWy?@;lwi(>@L9{kHNQksiA|WX#}=O(GNV4eWVvN(nC#JaKWXR=aAT?idoWYQpZ<#Zfipu1rNer&1>V5+A6uuKi zaZb4#$(#p^iMonyICDcD5Yn2NcvNwQ4?%+ zd($e>Wzqvf9j0#wzFrY6IWP5G15sev$$}i!iyh8G7H|Qub}ZOS1oZxC_{AWZ&{D}Y zhk_e}sLGOUE|q5{mndf~TjS2&?yh?t9ExQ`%TIrKPtrtj90@;tC+0WD&ZQ z3Z1K2Od@6kMO&8gV{bU5z>FwvI&sbMx5)4`{5UFPNnAc0B_r(vW_SJ{CeP(x)G2%` zpe4|w3s-Ud>$jfxFl#n2kv#=D3YTAetW;Zo}cMGZ3 zzELUl2nSIQE*dqGv^li969F|3R~S2wd^N6+L{^I2!g3mx4nMMdjWES%ZwK8%q~#C8 zggSJEcy}R#N)c~;D4K-bKQq;`&e04h^_9{C)VbOHK<8Wv76Iy+BxTEL7ZWXW=tT7u z2WDbpr?Jd_T5~g8`(aJqLDDOL?C$P&IhkQm@tPqRQp#1)uxFIjfYeB`iAWW_j)px? zNZ`7ELBFzr@;;X;{3&jhnbq0M3&9{LHRv;mQ)keDMnTD2yvly@CyGCXSAV4Lb(;ha z*_UL7h6em1eFKz`=YgCOr5aOlboHV#Pl6vmzt9luE?j~lSsOhKbk@Ie_PwAlw1$jI zSyM-{c0%CalXhXJ>ty!jCKFVye+VN7LU8Xw^|`F~BWqR_Azn?^+tg`0@VoHx3d zSZvCcd{TSY!!*b-h`rLnXtnOxFC`cth%okEd~%-l!mOu)m;;QnCvD|gxDi%$W<>g^ z99PJ{Lu^*;z7?UA2G{bqThu_q@9S|M)7!&HA4UqnJ5|{xo((X{mh7&`0n&LMsHk#U z=820aosZi$+{hYX5qNIP1g!Soqs4_zpRp$Ki8G^Lqjz%D2^IFkM64u}!}tUDi6cd! zl(>Oe2mDX##$8F!+6_aj_IeE`bfrL zpo}la9zd=kZ$yE|mMTU-S$0D6mU-T47+NIe7zB}?@;glR%2o+9fB>lp?tY-2*vLJ_ zwQ6|}OzS-DK+PA#Iwcmx5`K#?mnJ8PH&|2xcK0V-ADczxii9yLbnJTBgV71S!)Q`-&M*&mfnLeG@RlkP18gzNCU$EE!Z~*yH2@d~6w}2zfp=SNXAfWF<+ALTxUE ziqg5)=Z7i*MN{@hNDo3l0t=0SR3Eh-Rb-*+Rz5TwH??vw56oM?iDypKixy%r*JCwK~4s}DH76WsxdPwydj!x!^ z^ss2Ssfeul30=cJ*Uloy5EY{nqRRy;@0p2GT|G0HU|KN-a@M2Ii5`j;&gvJd&}esy ziKIc#j^@Ou@Vn%fQs$f34F^N?=*=e#(kz&Cdfj^6Fa}{wEhl-1Z7%=e{+~8$6RTAF)z^zDLQxMI+Oc58F&_1G}+%F0W4(j zMGxirY?hI^;8Hg~AG05%(;neCIoi)5KJZf4t+Wy1+xv4IP;$=2Pxv+UOP6-KD-Kk= zZFqmK1b+|V-OF6>5b(6Ik|2w71!5r&F7m@Itz|E>&0K1v-bNjLx_4VE}S zQ=RuPxHqo@;fofQg?Z%Ps8_yS9e zCpQ+&Ae2moDCX&I*^`hdEGBs_7&HVZ)<*htJV>o@qbn9VQQ8)9UmhlkB)n;dK*kkS zvRR~=H@uR>Tg*|vYDaIl;x15jUp#*@)Dc(6+e$(!tQd^2WgWv|e^~!%v)vaTzJ(E* z$xQb6GNYwig$0_sK25CY(37{+7hkdJ)W)!A$5N@%QjF4Km#=-wT@4X?;T%7qO!$1s z@72Bwp&&cA86us=V&S1t=di*eSjyzhgX#_5 zA#h@i0ub-sVLEy~;1{FcR8cQe!^mA)a=TJi^f(-yiq}A2_?V1ObuO*Ap_%K}M*5cL)G`@b(3@sWW(YAak}GAGEmD7G(=j4ioUcPQ3u zi71A=1|a6*t~$vGRV0ORCuD1%DVKx>sz1>goiG(s#u-8B zdn*Cn!ImVe&Fiw5-l0;a4<6!v(8qd|EH&UAOB5vD3KAL^hu=ap?;t?JPmFrfLZ0Yu z$j91cVuog1R$(K+R|c}-#G!siC{qYn2RE9WC$fLS)LfSB`-vEpXZj2^XTG2oS-4?7 zON2Mk{@((9h=rh1c#`hp3Qt>uJRokjprqNwj6sn{g(GWO|`CdU-(gmNmFD9&Mob@B(XW1Ad& zDLeEq}-a!1l7N)RGv#m)1&G*_{`5wIYw<=tHX+R z9&(iG=2i0Tg40de{xIM~&doT&DIY!i#n^8=>_yQ-(h6bT8RxvhNObS}$i{3`Hq zK(E-n_M7h6>^YgO{&GC+~NchnpN2dt+JzK7p;|j~UBlq@8fq4c4i*;#VY>Q%Srcl~K5mz>k=oZG?<^vt zt?QYTtpE)Bek-2P+edo1$7;42R#b!jpKOq_kxU{?;c45Hx-}(x0X*OWFt#M3t0&)< zkdC;_naNy%Y&R@s{89Qqzx|NC)D#e&mA?D$jmA<7(`-Y_uglt9g_TpOWXIlA;`kLm zshUbjv$F0-KSGocQ*mb^9^dAMokT_J-4({#WB?c2* zo%lI{tleZ@v^rb}?@t8j?4~R+zj`kMOXR82a3bZUWYJO78Z#~~F}*&= z{SzyyFP1&zynU&SNN$?Nm2sdbTYXA-sV|>JB$(dhAVD(BI?@^4ZdFK1U3CrKbsK9A za+5`1=53O1Htl7orc!=I&z}nfdy)H6-s<41oA*sZwZq9}0$qO{UlC>}w!x&-jZOk` zZ=;VJV=H+JGu+0^8>zPQv_JRSmoFucEKl`1O&u;<3hEw@ODI#rAaN6cc(x0Ndqz$# zmxGTmyBC%5-(MwduU@j}DL?)GTaj&XiduVr%AnEzwe3Zr;n=MT!;iw?folwMzu2(K z^D~(zSj+EMqJ2gMS6W1c5Y8`bM%qTC5VJ(AnBc1w6$(<-`t8QjCbP-Ioci9wGG}Ol z=S8CilC=heB~PZg=AG3*0X{)R37WA!Z0Niq$C)&l6ZxvN^S&Q%eStA&J+Og_Oe=A; zVW2O=WACvebY~OjqpizZvxlVdu58-3fO06I_jG&I>2S91MZ~UOA{$DRE+^=C4gJLud15%a7i=^LGBJp zarNN8PGZW&0R1aAR0nZ7yV)r%%<&I2itP?Ke~iGNsj=pxESXo>9XFD~pI2td$C@JI zMrgZ%(qtU1j>hnY-%l%TzBwRHJufIF6D$#L<1*kym4PAV|CV zQ?OpGZ%%!uPqhzAczGfIj$B7$=KtCkF=KC;3xsV#smn1CZze>Qcy1-8rb=4djBd0H4 zy(MbrVWU9>=VLD9ISB9MYcF0_Bl}S?ZHsYE(#K>|vW3dJgIt_Jf=dy*_VUKV+mx<* z^AVkHnCI>b$4kGLiu!*GCWkZ3e~b?wiae!}X_3UEk?m=+`Q#g7vppyBl=^V;d}8%x zGD+|w`bc2t<}!#0*6=QaawLmi?||BYtqgu zz8_?q5KjzCa|~QG^y?7Ry!-c)jZbX19zlt}y&LxJ)_A0=JTuBh`_9A=z@w)!Q|K$8 zK10D0`7$+R+m%zTM2J?QM6^S3igkr;y;2^w7 zwF+p>iGwb_Yt-lAx0E_i^Jf!-@z3_G)Jjzbo5n<~tWsja`J~dwE0}lqOrmgHMaP(i zt5x-su9S{I;Y>9!Il(ehq?HJ^h-5%$*i&NVRa_Z6y9f?0|HZi^9c_cCt>P}?d<}k? zaVzPJ>lun1pCNzDcjcq3rs>a)aoG>pCd;QB4Y^*IW+utQptwaW&zigCg&G$iO&nO! zfeLd5YZK54aSixj4?dhfOLyS9+(1Idi$_0-?BR(|R+G|Tg!zElfFV%jDDz0!;^b>f zmwU@bgt~#OVe?m(z+@bJ0z!~+7XpaaZFQiu{g|H4I=>XyKRg40fVmZ_c4}&#N56+2 z#aO4~77GrGYDoMLQ+K2ZhkO8~tT0EYO?jBq>JA_1dJ%dHk}JaP+kAZiQp{Jqy_Ft{ zjV`jn%wQ?}4<|F_?&XQpiTc7Ru$A-G;!0YCbOTlQ)>FzF%H)OkoDfQC$~USVw!ZAA zN|}N+iU87OKEwJ?f2pgg#F%oW^`HP~0mFCBUxQ==3o8Y?r@@%Zabgz`5G8Boy|EzV zvyddgFTBdX^9Srx0$%?>1pG~Lf#;^2I8F@sZHo7t+sXsVSE;?o3IFrum&L31%5lBf z+rNF6*T1o~`jql_$-NWo>NH*B;n+DXtjmH)X%+RHdH*RyP2Mt{zMP&SL-j$FHa>B0 zFo!FpP@08*I`n*Br&>fJcC|R20 z<#ed+xf%tBGS7a#aE61qrD7h1Hn$#%T2`}xFVxnGw6F|@IX=Tkw>lLZDYg*ghO|6N{H)mwNBA^#|L*IaPc$$g$ZN~fq-!kax|mZr zslyRFxpV>sOT>cfVd*DX-DwW#&3Y_BBg&NZ2Vw7W7-uZ76!biG@S75;UI+xs%8r4< z!kAgleTcMOu>e2txm%4NB6k8Y!SR|cCvPPQXg(Ud&?H5fN$WDu@4@cQS^Kpt7%{RE zx~Uh}S)~xWuf*yz$o?9@M#~e=iwFYxg^xIm6XE`GTObvx=9;DFWarHeTg%RvO3(q{*v|ZyIumG{)$8u8iH9t_K zpC{-BYng&UKB+$g$W&3!x0(`#tCS{m z?5)Ct;!0ObWvLNmWg@lxfRTOga$K~Hq*QF^&@`L4O#p1amA7~I(+{8Ei!eGPrcPZyJY&61YRKcACBnA3tY=yfu`jIR0K6}abgE${q@W#GEO?tUCl z1?#5Hd;DVZ>CHy#M_lLSB#DD1ft=Omg9{hx4>E6N7EtyQM&>fVv+E+05BGP~2v%d@ z{&Oe0yxk9JA4Q!rJ`k=&%!hn`-Vr$+jXPdYslOGIUs^3|Z|Ba5{$`PUox^v?7u%BH z6Z}=VT-e2bCU)Ik&p-;eOen?B?FDdBU+-K?J+)h)B&uHf=nd~c3p?Dr^Uams*Jg!t zQ^?EDVrtA=cKwX0`Aj8U+Xb%hKic#=US)6ezwTV9BHZTj(%rlr!kX0ir75j8V{$A2g6tmh0f{6>YO5KpGlr09iJyF12 zvO0J6P?|lUFc9UtPuJy3U?e>Sx*dib2L)NYI9*ppB2<-lUM1H^_mO#HJ64*p9w!}g z8}n!oRjH3Fz*rR4)AHicR>bojf(gi0NzP_TW4!WE_DqD%XB8ZGFHsHn&rKYux>w>9 zripcWHaHs(yQiHqEoa`XjP~#P{k!2dy&S@;g;H}~S1KGdKNELoaS~2km`MaOVQc~2 z;VxF&SF}xMTdrkx+P^LIZeH$9sjZKs)P>~q80QB7-il~1bAjl;$U0kYb8fgjS+^hY z)hycT@QV;WyvjI%afm$qVDnSmZ|a#}V5}RSQQgVj&uQB?+C^kT?@c_4+`l|#XKT{@Cwx=)gxRiZ{gjuSc)+9h5ykcUa5#J->QOC-_9z zMyv6SEv13~2ZKBIZ%M5gAA5E+des~<5Z)#p%`X@P8&tQPwCtVK%NOFG9jp}p!E#zL z$XNEnp?%J4&<~(gHbz^J=n5}h^=%H--RSWU(2%sN+A!=jQ?!w3DW*r#+hwaK3Msx! z=(oB`JQM5?43thOTOEzBt(R=QxaVWs(G51`OB{^&YLqziz-3k?*55$`tCJBs9Ac|hUrG8Dm53KGklDBhHS8b6trPf3vZg3rKVQm zjMp>eq*S(IJq^pqh?OSKnNK1g_b!CKC9;}Sgml(r;X}D(>3;}i>rS~GgX9J$X7!Y6 zO=a3ko2X+(at44eoTb4#v8+|Q$W4YiHr|FzuB_0=JJJE6!9^VjFx|Zb_BRp_C&Oz& zqhxTl^E+Mebb{3w?f%eEdZ~g*QipI9N=%oBf|^DzyhBHQTue0)%w$})utJTx(9v*8 zV>g|RUz)R(?8^4XZOB8=ZWnJUnhnKxa<`f2K=WH87Eqh71ds~x8I>M6d9LUqzmQ{z z6$|-SNWdrXj3KHvMV#D0-nyJRl*P`=*Ejh$q*Oq69m&v@CHh3_6In+E8_a~FU2+C1 z344ns8rQ=Nh0zz77S3>}vO-y$?fO>}?ejVP29h;d~U@UlFuR09E|uA|)ji@Ame2+dbrKiqQo4vEfsR*w8`tZ>wCjtLy8l zb7UXMGPG389HSf!i>$v{HOCp>7J+Ss_XUNsGiqqorp;);joXxD9Ep;v;(zg1OG02~;u=S7)$qr-KP-VmpcX5=JAOr zCa^jidA0}CkUAe7`ND{o(?lzRANR{HRs+qJYcGZZO(ZMx~ zx{$Pd$pl!DhT>HHa=-vaRzef=8{={6|yi#O*ZQ+$IE7suHA@Kb#;jAm{$LU zFl~?RcZp?^gmU=WNQ-nE8DGd>5=ZvG9Mz%_<|QL`y2GFk1cvQc#DF4RYIpmcT;#b z2)kLH0`IJ7Ipl+0CDY*&ez>4#eC?*+`0-7~&37k3+AWg$9aYx&yQP-jrZW(#>%&4_ zuk>WC&NvN~VzQA%I#u#wL%Q~%&gU%_-66jMyg%op__OjjM4+1O?{Sy4VJ?mK8s3V-F9YURBB7%t(Lo{?N3a;w?Tr5&BPZ{L^w9%tea7Q21W}8J{-8N06g| zLDmUCQjQK2sK&I}IZFSJZQ$`Wg|Fl4bUMENXUoQ=vbpk)TEgO_7xnH?XpYGm?PF!j)Ip;>(mQwX zWmL`u)88Fj&?P9xUC^Y)`C|r67rI!m`XsGsyM*Hq`Eb`i;V6G$5FWVTQEd5*rP=bF zH}S>^ENcy%Q4?kckjfhU#g(FONf`oj?-9^XFkE(_0R$iHqp~26#BFC$R)3Dg zqsm0inQUzVoUy0YYtWch;SyoukR!$7$AOkFq;~{5fYmU0Y`H?*Rnv(}aMu~-Rve$# zbty~xH4K+!e1I_=k9q_1_ApPOHn(YJi5*&R+wNEzY2N|(p(rUBm)}bn$6zCHYV(N z!0NlUVyNyJQ{sZOOhbpBH;>{OTwGc{Sn;g;H1v?&Z1{Ys|9Hvb^uWb^XI0f~diOzB z!Xh+5-uj&Ha7fKDUcEync0Rq&r0ooZuA7O7)8IhYcg=kd)Q4a84$shzTNaugB-gjR z{PUj{FyOU+%Sy~Pj<7*4?aZPdPtcy4 z7Qvr)PvGw#qFa*xwLdSc?7<}@qg?TAfR4< z3Xz#yw^Cw=pv(M8{i2ho!|$O-s>j{z@*PpmSX^%dz`5@iEb=)avTF8A7`QGjWw0$d zWgi1E*pR+^6!GOT9Z^(9>Q0R};jE6cfBM)~>OTH^@YH8@v0?)@?Onj6^g9kB#mb^E zuNS-biD{UJ=BrtPt`I%wm-5G!ra6iP5270>d$TY~I7(NN|4q(_E|&faDg%o20S6h} zbSk4yR}@SH#v0+d zlq=yIw2y2sz8h2~4f2xOppxwGXR8(B;MkM<=#v+P#x%iaRlIdEW_w?gaqA4`JvbmKSpG*oov9h*2Py0|~OZq1dDF)_P}5wL?KhnKWPNwz#oNM8|4sG+jli3|RN zbKRCaJUkUOtU33rV6z58|Hef;8SEc!FofL+IC63S`9zxe+5@c0Dj3D}!H%_F_#gaB z?RSR`;<%bL6Db`xrFoW-Sx=%6{z!y7?#jJ?S7FY3gxX0Se8V)&L#TMs@LlKJ?UNL3 zVCEqxjhA$snh)NRJ5lx)2jpVs$mJa8_)I7A@=k!Vk_fj1mU+qgEO)v!^%U%KkI8RItp=`ZO+#tfNgkcIvO;fKJ2ICpI zkaNm`SC?GO1QQR+e|~0iU91bS1}acFBWcr2m=VX?iL#G{ZO_iOKDsOij)Ssstu3q| zwHTh1lDe#^QKujC@zCr*WQ@nw(Xfg`m=qd%A^CwUyqNq8r0{Z3+AzT`q3azMD(gwk z8Dg36A%OWGuE{hZn7aziD7f^PY@$zS=PFkj|gy1Iyz-n^(3$=|D1naF-i2+XC)8+E;`#HS%V_emC|v)(dd%p*`I3rFBo zYHbx+6al%I$AkhP#xis>179H5ycvem4mH25kTU7NZ&2+zk1R;?>iMZ+(XZ5hS z#;xhcV?>@%4XQO{wzFGpo_wc#V$#m_MxBn){hEza&e86g^|+CP&FneZ(w8LX1pUoE z<+W@yV^d>U=DD`p7QkfLzIt>h{4OaftK>^2N?>}9Lz`la%%xr(XhDifhIvB9>TOSTTN-SiWATW18g4EZ)n)8)hcRad(3D^Dy zXWI~lkJ6ox2sUdpP13y7K<{{gNU$T_2+OmHKL8@h-29s4gY4HlI9zKNXsE)lQ30aA7tgBC z5m~M-Yd*VOK=hvb8b|E65Wxp^YO=di4i%~IZixhu3im;z<`U$A)-{hlcXrEPEBJ1Ye~3`^MRHN*+HaLqDr2fuW*E zz!%@NDeWyQtSqYTziF4`&U>Itrs~}d?vem|Stw>nHEb9zb5oT-Z~tHwSd(i)K*>XX zJ4kW6)`F>;%rfl;HWkZAA(Bqgsbf<7Eh5uf{>6BnMSVl}@%A@u9D6?y^u3{t%Qh1(0KnBjfvm4*0dkeuTl2CdepBch+7t1&_d z?MmDpXl@y`yEBqr6Y{Z1F{7kDO+2GI`R!%?K`^eJGSA~SReji+6YUT z;mkN~1j7lyNAU)4_!dw#)sHNn*TmQ8Lf3e{#oSSo)xg4-{aoSLu+F!&9LMOhc-wo*-cTR8ttg1Xuc`BIfO`~F-2 zY8Y24#-wep(DHepJq%3g&Vsd*2!Fxc62Vs=nK)MSSOz!iV}8}YSVn)t8$cmv9U|X{ z#&>`iNmCB+BP-s*6pfsX03zO5zZx#Is z5&M7egg9K6cVrEZaM-U{pQGGmoslN*gt&OD?>eO#`QH3VkX)5oYL4{n@#g5Ox%${N z{gSU!-?ZyFR@X!)46u#+=pzqb7OUHLazVk$P{PpDR%~sW4l( z7GFXw(<+!K)f{Uc!vAx$sh;|o`RD}Z6srEkrS4Z22+`L&Qp-Lo5-v5M7V0B&u-oL> zUS=wRfYstB>KVw(u!&riNWH@YWu7UgDdQf0jJ4BE(N7z|K!U$|F1`Ykqx8lVl0Z1W z`o(4+3ArA0n7zkZ*+_1m?M15&fH4ZmE>`Kr%0|t+b`{s^{62Xo%TM|eB?-={Ol+@= zkGZv!K`B%jB5GB6zn!+rZP8J`V)BBsG2SMw=Xb3l(QvSJht+&>nV>n51R| zN1~gTMMt(%L%Sj4^mHjLW=n9W#cU#~==a z`y|pOH_54Ll0&oB1{yD&j#vCs(=9yP60dC5CW7hV)7xsv3+go-HhA4c!;Cg;#j4Rw z%r?1UVtbnWYugX~IXNTvrUxjwt3nmbwW_k0d0S$FH<_|jDfJPVsoOp(Iuu*{ zwbKpae_d_6GYzv?m2}F#75l9Tju@1LZ(v=o(x6$cD)^ZXTCo9-uAuq=UtUFm zr%udHqGTRz^EgjFs2}!mdKaqOcVEFsAC8|L?7zk$O4j380lJexDbSH&w!Y1PQ#@`- z_px$(B9H)`lO1>`h&IgKe{!>&MCe~&j!R1;Z-ZhLOyPZ^7`&bc_}11EtbPl@!u~g} zQtcjAbcXH1#5i_ID`f4}Z?zeUoqhxbCK;#@!8^@06D|9O*2IIR5LD z5J2B&nPl=bit;8G!Zp}Jw}|x9OU!;M0bF4Zisy`O$y2WYwl{SFGpez? zHZ0Pl(~bZ#=TQ#3pPBKbO9owGkfzNfX2|U-b{J+U_xVeyQc2ET8bPaP@h$V3WpU-D zzX`4F2cdZ1HYjsQ<#U zY9P}jS2AEg+F(n<*@RXnm$as~uJCTK?Q{ByU(?UoY_zHg9cL$z-#z_-17%FxzXfMa zHrV1~0bey4R!&RzX9`ZO)aF1v&k_Bo3O?39G27ps=_XJVaGk@dRmA_GHlp%`NjM-8Y5kv~!7waZT*H{cTfqP``1B(&!C%5m3W zoMEERY@q?II*vObvOZ7C6H$v~qe=wB_*Nr+6Fh_QLKHrfh7N5)gz~SY-J{Te20AYj zANGjI_*+P1cd2Cq4#(@c$Y~&HZt8+DyZ(YoKITw?ICJcsU2y&T-sML4}a|v)<=n+WkAclF2tBfP+T3wy# zk>UT~!QTuuM}}vaVMXf-niBJAo+;f^iD$IzI2}eYo6AXTPbF0;fe2#aWr&>j`cPpd zqYsWrA#O%x{*ne7XpWYg=@G?(PU&z?zCLf+^vsMGG}d6VSynxMH9ag0teeK33@pPS z!R-rV5t1E|;XmnvUho~wPNCv?@$Hx&tliYI^7eYVYR^|jZBRX%sJ5e7^tF*vyJ7t5Bd?p z_s!V}@<@hg1;uExUF`{)3hoN8$YN{NkLK`|d4{=-D13qa5r= zE;`YqQjYUc+P?zN9k{DXD%A2YT~jZsL~{JoZ2i8@W=JyPxQ0@4I6X1R8dm9ay56g zp=V#$i3Pk*rG8~tbpzv$8hE45)A~2Oh_*Tnh=P%{OS01Pgrfn(%M%t>p^*!7&Ma0V zV}=;%Y=yJf0LOpEIV=Sn+?j?FS!l>HXBI#9kgvul_-gD4a0N0%n=CUx>6~nhks-&n z8&|LP5g9KL!;%;mJYLV%ifT+jh+mgd=bVgb;W6iDE4rRVRN))TOBRK-gSQ_6!w!U` zpG}$-8CZAHp>MIod+zT^qvVHTBFdVO1h9hrE%XBaaaJx6+IS+Z?7 zc^Z@qW2mMI9cmh`cFrAHEL5wB8W{*v#^I$UQ`O`3^m6?%AM8=}|E!Ea`#I9^gg$70 z8i+DZ{(PxlV1!lEo~kA|SxX1SRPNeog0C{S zl5Trmi8`P%7#c>h1yQB7n)hh?`l7(Vgx26`qklbbxFS)}y*SJS5zh>rMHR2WNS&O3 zS?p~*h#3Rd84o2ZLskoX?m)|cvX`gb!WhEYnN!6I8LBv>h<^XM*hNJ^y&-Gcef@aP zn5ilQoTVy`?-`-)2F(N)13mF8?NO6la>O)6wR`Q|X_xj(duJ z9;<%<$?r`+|IGCLOwELbZ?s&D52CV$HLSnF$2P;J2IQ?~Q}H(6j3b z3lm+1nLnZzGwM1M4X@m>F4)n;gMig1Spmig8uqAL)xfsM!|aC!l_FnjglG8-cv?WC zM;?)XO{u9U$KOhf&$_+d(UMo7){S53wGFh846Axnemk}-a(G={9Z#i+D!TJ2@sO;WQP2REF=zi zoLd0lvwT>tr}QBcwG@cZp-qztRv=&%=BQSkAzY;sVq2wtH#pFL)tXut@6fpNZdNtd z-)jG$s;IO+yx@>~>5-1u8*g1uayq-M{PDpj#T;^iU0uhpOthyIQN%IOHR;oIz(oM#ejULgYIiTTD&IpqdmtM`%I3Yog zL>lV8y`prI;$1p?I$=4fYaI0g+cY)_th4N)lTel&9e&B(e!sG$>!cjkDx9mfBfrGO zf$6!17$03w>VBE)#)?0T3zz=KoGvElO>e|(gS#su^QEE9+|}g{jWJ5!G(KMXU{9X| zm!j3@EKyR*nO?`vHk+7-hZU{>%|9?&AFej`zOj6Kp+zU^3&ts>?MIQ`Ydf@RD$jec zsyGWPBAY6KVMz-@eFIne$zZR(5^h$FD+>I@g$Zkxh+NfX`hq}R0#iKh9rD-ZkUlGd zL3{q^|7{*&GcrgbCC?9x3^Rl$OXaUCn;BV4r?@#ZR&}5UmN-)pTCU5WGD<_0)QL?| zm}vO5HvxGIr*uGx(I)~{<{+KGP={GL?hA9WRl)>}VO`-%u~D5~#rKTs{b&<`WtI{0 zR195s+zrPYJrgo?Q8%h!C6oyzZeDe>!>^lKCw&1K#;8E%rY&U9QfdcX?Sn{!-2FQM zqkAj%IG8jP`{*ty^LtfwElx&D>CsNU!99fY4Q?gwmj*P-GPXk{ihw6lN7gIj4#H0z z_~JHc;$Z+B$*GSyZDt#n{%qOZ-;gfoLHM3Gt?|5d&%A{^H3zRiSRy+^MvM7kmL6A^ z^rD*v<#{uNjS?bMJ&WI03>?t4(aC=t-bQ95gVlIyt*%X8Z$#U3^8B_Q0`;^1w-TU5 z7w)z&H9r)W%iomS@Kyv1Wl}NrdP@Wfw->Y)&j8nk=Ukf#pV$BlMP3lH%I7pI6fFwQpHK;vsfXBr!PCn8y}05uWCI~oC2h{|iCy5FiJj}>fUn|+ zZ=@<)hkbvS7BHiZfUS1!dz!uhcbXD4_ib88FAV3nt*_D2 zkDRZMbE@TZ!oGmj(KjD$hDOe$7~=3ZOLA)BP~0Q95rJ>(&FK0D9((dsD2kjq$;f(? zX!5ghbS(V)lsZx)6@-ggpwnDxJ52$rUQyIOfXa8aeHG=At%)f*Upzbs36?x6Sb$NI z<#mN>3orDI^5RvE0^;OyvPiG=Zb=0asNbn}edq2Aua?A{gH(zLZjxaM$yV)VEyvlu zWe|owxDIRr#P3);IP97TRFv`FoD_zA4n7IE^IP+;T{sO;jdLb2bfeX1wY@RW-UxgZhVqtkY$ z@t?=|_4Wt^0|eGJC?a8=tb)0=R89;xm0_ng_6khQuBtKm67tHj0-_WotxTmJovcKa z$wh?ZP;f;i5zeoB@!RM~OFuxabgI3m5eCD`E-m#?h%TJTy|cvXB$!f^e9igKhQX$( z=y30J#hr^zc=0)sfcwwXCw=;GKfUHizD8Wl!o_DEPODC?1N>`gQ{gy7{eET9UO9&# z(g9F+4Op|`%}+|5Ip&Uja)4@kt+T(&-I{Z|?-w{W!*nzJaq}-St+I5u3$CkBs^I*6 z#kglJ{=bWqMI308=od?qr+A}s*Ni!Gg5p$);O2x^o3&fP5NShKy_#rhF>7VCi+O zR7#=-HJ9I(5G;-;DABpi$Uy^kzu^~g7=du?H`c7Sr353ymUd1v`*kpuroY91iCJ1( z+MXt-fJZ8fN-RJik^~CHu|Pd<;2cEef6R>l#(GUtb8B;!2AKRexV9G);RXq~$#=8AKGvOA^=6VRTC=DQqiR zawGB;PkcsUMaC~lk65nrP5!UJ&EUh1)6P!TOC#eU3s447J9wr^pIwp**5b9yvtcnV zCln5@^y}6s{-*^jQ6fY*e?!CGDHx7&aGmU*wm6VYI%Cc};UIWGWmi`Pb1qrDof@h7 zdR-;hhKeQ?Cj$UW^B?yw|nD<|jJNLxG5$sa9l{Nm#wFTw|s@3ivXYoKhHi%+W7S}zm06rab zqBlB~l9}jA;Om!-%x%ohW@uNI(;mkT^VM*Fe+X`p4WY|m`3Szxxe@zSfhlb?zD+%^ z9DHZj&T2`xph)v$m1Q~g{*`|JBOhhl+hRV?KCA1fJ5nudq^ay7Tp*#i#r;_n{HYyF zgt;g@NzF>lo+6;iR;k}JR#$hRW_FuAJ*%nyaI`A(A5JeG<*wna$Qh=!g4^w=6&e^T zA~=zuL*D7h;0lDtum@^Qua=nm3Z~E!*|E{$F$7xtX3UMS{uKX{xC%@}T{adx)KU7c zgawGSRa!Yaf<*@X26;%AvM#e6Nicd!PwT!(oVGUC?+1Ow`VA4FkCLo6&n94GCY4P-SQK$-VR3xO>SqT%Y)dg)1t zK5^$8x5=`8bV(JTQ0O7)txG^y;MJqduq2KLhhrX`h1-+MbHFqCj|D9b?SSTOD>4*di{^cBv4C1hSO6!DtLc46*5mUIWG~ zQXJ*8;EQ^f*PQTf2~FF&%wcYq;hF0VmHH}ETYkrY`5IV~vD$k%CH`Hz{$sVx%fX#) zHaJc=)0nM)BJZLhiQ=hb2Xl%Vw{s6>0kiT!YBv_!@i?cswViH4Ld}PFZIJiFWCRcY zW3FubmSYY!AN9yFj0~vKY@x1On!zDDloSug+mRS^#PX+Uj9`wWXyf=S*TNlvB@kWF z*<)+wwo>O}1vnnh^TqG6-js-uk%DSspVigLEiu`@jMGq z;gpO?Pkk>O2k&`Fbh8m5d5o#6;l1&uMBe|+48QWYo_HCHhgyKWlaoo`9^N~wTu!{6 zBYhQ24zJVe{E?@#n6`frU?m!XbMeB`v#Cg_tC~O8MAFpo@T9|Db83qb8BysyW&DF~ z2nvtaq4b^-6br*ORLIlGTGlZj+AZZw^!0aPo?#R=qAYo2NB7M}wHY3t`hM-ENAOXA zQN{iEUiE?Y>*6NnT4G$g-}L@Wc4nw+1ydWBlvyRZL@an{pB{HBKKrPzqWY4Bj*@mx zs3~0+?P4Ydn+ZFEZSKr_i^GIRxQw&VI&yi8O`XD|MkEhwI2B6!9pNo>LRsm&mI;B> zS@w;X8XPOZzeluQ=2ch!S`xUXaHN?mys7BJrCdwN2;5eFLAitRDk@EWD3 zpl83Kzd5|05ab;<(T#Vgs{*^i;*;x_C`#T%=H;x!@0!#k|v zJV?StfI9i@G5z0bGEwBDd(lG$#HJT(cGto(!Yzq7mn@LJ^`hiqPKt`Be*0O;D(nKR zhYP3DJy_7>&uM&Tqtk=SIVt$k^9dZMfvPC#Rh{r?-_8zh^r=S2##PMGJM~FUkLOwA z(fX8a=3)Yx^-Rs`vh<^Zv@bOC60B_f2(N{KqBNzH@~biiZB;wH_3qCaYJ~~ble4mp z9O!FDrNr~y!~3K3I6s4-VQ2tv^L>}?q+k1rWx|9)#m>CC4y8C&GqWEycbzLTlm%4F zN_>h4iSoC%!@h=L)I00{kEpYZiYwT*HSQiP!4ljdxVuB};4Xm#Y1}2aySux))3|$Z zcXyYjd42AC=f3|vYLC%l*REP?&G}7iFm&BwsPb-bt>CE6vTYr0_S?U{cAo-Y@#$bt zF8-JRvbbumO;hQXj723B1cV6*sS393I>==T5nqcB(urpR*X(i2?fd`UTDS}qIWnCe zgOlWx9}Ue#PJxR<{mGO#N)CCCLPW+w?m7PVd~KGS#72El&`b-H{gX&ff2tj!B}}=i zV!|{$#QXg)=sStgp2?p_5n9!63Z+t|zPB)g(aJi!|9(g;;9gJ)7MK*OaRsYzqA)DV zLnvv^7Y~JlNDs;Ac@U@nXnbrZLxS~a=gct;9IJUmEGi{?*zv0D#3)p`rbPZ18nM|g z2kaZP5kZ-ygH2<0J#3@pP}I}>+O!sUnT=7YC+WXEi9C%}fGWo3>h;+SdbP>yNZXnt zT)xo%Lr3e?t;KaG+^454f6Mz1A`P6LTl@O_G9%`XwV-5PRF-Mh+Z+5LkuGOn1@$z! ziUWkkf}qbBc-IJ5&$<2@J((4}OMTV8REpQY+;1<^GNs&}+~&s36T6aC2^aa*PG>xe zbt>MstE{H7%MHL*Nj7KkviVR9pWKqn}5c$mo#WnKnI@aR6ek|4#0ZLueSDZ zQ)MUa-p;;CTiZ6xaA|d_#=(?x@xhV-1z>C zO9v)TtKP8o!okq5X35$v-af8bxZkWMkn#cGdlIu!ayb3;d=DoIvfEdB`lq@MXY7Tu z-d0}DN3(>Qp0b9!(=`jGne|u?&$x<0^nh>qyY{X{r7jaG#rkZY|3~8D9RB^MzLfJ6 z@DMOm`8=6N<1DEE>^B_)v&Zoj*hE=#UfqA2v&nn#`VgcqEG`IZ^{<7Zg94-XnGCYf z;}l@4c}oY_aGC1OgNIrOO|`?2p>sW?Ci#G z9lSgIW>Ri+WF{l!#ojfcrhe`WL!gGit;(M2vOCj~NKS?HyK_)z_{i6?gY!-RJtK|b zbg;|seFA3`RP$GNhJ5MAr{*6{cCD}V(5YUd7tCse5A@@`KDOb%bOVi|lk+tqltVnw zPmG)#tx(oT(GGvpgFZ9J{OZEqpp9j{>qLWH)9yuRDScp_v}9$4X}dILADsns$8?=4jDLW5py6M#a>+|3%{7E0j(l|I3#{8t|&k%d}GDS<||Q zifR28MMO>3dOQ2uqS6cBam?=R-K@)^Pdg+Bm}34Yj(O=Y%Wyd4!!Kli`kc8} z)j62}Nr8Hprv4$?;Q0WWd?E#Z;yIhc{OFgVNXqPCZ`XJI_lv{_yvZZ%c@4d^P}{)F zd(BRws4BuZb&5QTSWJYZI!mr`XtWw=({!*C2ss3<``#%>I%CqK;xZSzj_klMj1=OE?;qi8fK%&zCZ&?uUyiN=RfyC{=JRSdst%#nYOh3)Vt9e zutT4dUeG(z$%P~ahg&Z{UXRZ&sSaeKw(oUCowK zyweN?Y&$Z0pSZrGeqv1ntpSx?s8n1^Dwfc_hKAWfa ziyuU}rX9N7VDS1&)oYFEv_3q$&~-xD8uRm1*N4UT0`Gg{E8uA^@b8FqZ|~+@nNInD z7JxCdj}k(9>S0ps$k=o~d-e2$9HV#`pRHS1Y7a3?D}uo7B$hv@gsNvZ{;~mgydyR< zLbZsmRRwiLY7K?Nwmn}>cO6@wuzG0Q?XVf%q z+h}N1cDhSKPx#*0`rdGdoN~_D{JZ_=zP~(Q6}33H1}UL4;Is339o1bWRjq6!fXb}+ zT+=`1QzNpC@eYMuFHkHY@Xgyr<`sm%W|Q`fT5xBM5XC78$4l1ALk2;&7Rcjf>Scv| zKTBGH`M2YhqjZ(<)frIRK(9W7WT<5w^w4I(Y&N~_)m8SHq1v$3)A+f)*j{ZsqAIN( zf#%8r^s~-&qD&)vC}Yfsh)h`-VLC+msgLUrF87)rHnt=b4OJE%&5YC ztN&=%*qHmN*Z%PYER=zEE5?2F+4&*=7ukoSnQ4IxslPtK0J zDn*YlgF$VSZ4UJim+H^?9`><9CEV@cTT-bAVJASAoX>;M?!T zKI5Z{i{s75@*GldM~;u(;>ZJmK4=-$fN&zjZpW{Q2imchO%S_pxb=%XULCEBl^moX z*S$B()*_oxELF_sHe3s)|34)Mdog?j?j0|5HUJZ@#CQQT%Q zkWF)GpAXtgySOT4yf5Ej+~uz~yM4y(aGe&umF}q64I|2deBd(E#8cLvJI>mnGl^;_f}b*L$N^IO~;}Bc=X5I>6_>D}W^n?ylPF zSm;QcFiHN(0B+CXyjGZO$)VMAL7=Oo;TZFYx2EG37%kYnO#ZSd8qx5f_%fd9$w1aZ zfH_r@b4$=(V3J^-A>Y8TCHS2DS^P-7%yCKzdyh|3Id_tOdr7XS;vW|l z$4A@utE}j&J+X+fs_;U7LP!ceSKpzOrVZN!K5kC`x&K=C#H6=6?AjYL=WnaHD_aQP(&G_cTTRV9i{X8& znI;*05|u(<`z^V2XXyv?c--)PG`lc<7AzO5y`az3un#no982d+TW-T z1%GOb&+l^S{IjkQp;<0uR4G^5J}nrZpyb=;7>dX3<0$9 z0MsG@@w$UTos6~_cAaElVgGsNTz;brT$iMnm}E;8R`fMKUF3bcd10Up$83)jeqe?1n-e``Z@XF<3aY(j}PF!Df=o%0NWS4KV3l{!hvwQ^w zH-1HQG~6+!)~VLt%|7z)jT2Tf!{)N~mK=8#F*4!AibRs(mx;1!ACq6&c&2xiQc=Nle@X8=h0$akZ?}<() zCu`lNJUziw5YkX7y59=VwiR(NCR!_Ow4P6>) zt(5-067GUM+yHe{<0q7ph4u9E4j<}2T)#_ordNVqo3AX<#mHT@S#kK2p0LBVSSfYn z^Jh4YvIDsj=jB|uPQ3yPyGcSPc1x=(Nplp##g!{p;&!A@@|srw{XLQyI!sT$aZ^2II6)4@sIV|<7?JA zMWMnm9#44*EfXef+${6Gr(Ux#1vEqNCj4{ZR>uN?A~ z{Aasn7#e`jRUC)SK4!fd>3rWW=lu@ZL{~_!U7nGN^NW*+mAD_| z{8m5<;XNZwV}>JNTVsFuT+E7pr4h*LF4I>X?K$xsi5G*IY}guS8#<&bfGLXWaPJak z+}*fKM6m7aCnj2E9chvv5j<7ZRy@b?a*Br=yi>^e5L=-``-!>2=wgrIQCi+^#r8xM)P7a=OGL# zued$|&Ji7%K?{P4)Y)^H=uZOoa?S7Udop%_C5vgHnpvV3Qu!fI7s7;s7PNCTw~0qh zAFt&GVfXVjeTi;G)o!A2O$4jPkK5chZL5mI%88M6hsLDyM~b_&X?A^)h2cNgC;lPe z?Dx?c*Y{dyxmL`r#c76!`H?y4HB{Wy%0BAMu}$$ zq|bXE90zv=94$&NHqC!tut>*DxwRhh`V&*DpM)k1lOWe*+h4GmCy5GklyX`!G|1vL zc;p{FDzjp$r5HOKt`ykW{D5J|t-U6qixBshxLR!@GVmyJ-9Y%c!wn@ueBaL)YM>rC z7#@X07*q!M?hw{Hw%YQK7*VZRyI70oGO8#^rDB~BxO1i@zl2YqV>NM#oqE^rFshTX z+e8H+I{OM+AKpH$TF|*jxuml>Oq9kANAA{O#9hQUk0};3({%`*0;aNIVD*pwqpf#$ z4EF|vX05;>lB~6kmwoFhUW^B*Cty>~N3AYKNpKC3Y>dNym#eC>Pf z_S2I{-vpKro8vy5+W~4y&8=n>>qgCvDSuf}Be91}LDqiG`OvYclv2oluARq@8g>I( z=t}64FIx`;S@y%sWN#0d@6N{sqv3?W)$4h;UAnCT}Yx#b$d;oYt7SQEB#0oWU#{Rpuh6D zNjkyOMRo>h;hSj;xmuH`s#tfsk?qPZ{-o)CD+Mj&9o<%iSOWvRMLBEg_lLH8wp$Gq zfcE_=B|l!A5P=pem01GE|dm_&~%YQgC9b?pFcsP{}(5^9j)>7*$$St?cOcb>`>= zy}rGA8n|~|MR9UC4rs&5EkD>8Wq;tb@UV6>Toe70=%H0O`#P#Mi!_U&RgI{edYe3% z7RW7CNXnBvq&5tYXdPPX<-kj1=M-dhz*LCXGyH&{Q~{NKlX{yPZ;X7|p!)~RDBf}& zl%-C-#z{q!>7rksAEKY$xRJsiH7k*q^bxa~9J{C5eC~X}?f*HcidhcLd#dk_g?`_h z&P<{bv`QpNj6T_hM-n=?-jLXoi{;PXc*;y__X(*@ zO=Of~aK=^Op;0F|T_DwFLHTa^H+JB|ZoN5F7R3;KleYzagn{r;@0RWct?k8Ab_`a< z=dP!YTg?z=FCPqR&r)GQZeZ2jkL;Hl3jS%v=)Orql6(~*0u9F3NyE|42&fwPoV{V9 zu%^-&|6e6L7pBTID z)3HXBY~H_t4o8?=q1~EgmS>$)T+P{YY%o{W97R}bTmSZ*c73up3ACws9o^BqLUm;6 z-pdRbbB6UJV;AW!;}R-^0g4*Y-HQlP5ii8vGtH&%2F8;?-4Eb17LbemR+*z=nIX+1 z#hZU-OqZg7N`+6-(wmIt!3LA^))amD83F+=OYE=wF6gTHiUXJyExhbax{x~0ya;2| zd+0pTI2+PoJ;dGXuw z`qO(kcMLjz2sCnc;nYqQG@0_d=~Au@44X-&N+b8UMcJMYo}aWQj&!+Sx@xeuyLFW`Qj|rT}ZD$H)S2!i_mwruUAwC^T(}RPPBi?1JM5=9x;lK zi?J;S++JdaCi%^N!c%*!w?{W=2s+Qn=3cCP>mT}IP4m7ty$}9C zw~OU$*Y0xX0DZdnz5F!Bmw5lj{2DBoliw!~*<+v-t4@x>7VV31=>!_HAA;WR>>l#2 zFG?SGop}9If?Sryw>~SE3YECoe+FMm#^Wtbs8+r*%|d-Ww(%Z7A|Ci`=~d6D@p})A zJb%}O#2Ah8iz8HS9>rQG<}wuWrdvHD%H@WRMBKgzxhF1ykv_Q?eZHizkC>eQjuy8k z6`niu%`cR7Uh9Fl=}E=2P||4ezI8tPY0{6hk%W0LHmuBl6WWc9 zMZ^%|c~S}Va;L@8?i{Z0Ub08-fp0w++GlT()6;)mZsI*r>9c_+H>e%KS%Rk0^ajLD z!vs$O7VV2iZ!9tg;E>&mj5yari(}H4d2@=33h~D1h28w)JHuy^{8JngVq-yvrbwbw*iWC&gj;13WqM}Up^vLY|9z@=q2l3&D57P z&NsskSM$gF=Y;x=oTQB<0rke!_v7EfE46#W!`_5m`w1vRTq90|rAD+kNQl|(dmMk; zQUu&;N>&@825{)KT+)@~xMLT;10#c5i1UMw<^cmnvAibWc9FrORH(0N=yI|5M6wK@ z1isltP~s^Q_B*DR>IpQH-$gt7PXLrD3LJuFa%(wIE}n77uvL$$EP>cN$bO$H z9R;dr(F9P9K*CeRC>s^OCf@^WAG@tc+sU@>PSReiL^UV9%W`d3fOC5{~q8E>+97Biy!?)h3xbT&i!Ps$`M%`^CF~`jiW- zzFRcYT7JqMV7IIM-2&mI1H?1%>ltKoVZ3{M-tLIurAX(2_HsvD$_b4|^xbU$UlDL&-TR8Kirtm1+%%)ldN^1ksK zm0mabW4gk-rbbdC@&%uEl<9ysfN+!yj&De^DlEIsM34YwOBF<+M1Qj(cArUo;$4~~ zOF%$a(7&jU+f9B?G>cMCa_XOO#E}$(lue2Di}C$z5%8R&`L<*W<;DIevMIIYZ1Ajb z!)x*8qfAPC$p-*OxaM%~VvMF57nc|7mIA~QA3h+L-1TI!;0;>Be!7= zV2@eYs_&>Kjq5VMt(oPq%R=XNBkkpq{jPAojDuyXQpq#!>Gn>0N}eObnw2Ho3s33l z=`07g89Upg(Vi8hwX_sgd@$6^_>()^5-Q;y6CqEHtnqamHcG&)AuXJ_p?veQ4t-DG zSYIWwCSs3o)UtszBCI70m1N={+IL0z))*?s<-A=p;~do+d>AbwG4q{mTFL+DMbh=Z z>Dk5f_4HLh{oc5q3w(`lBKvlWTc+H>I?p^7)ygQ)hHc}zQ>Cexo+qr%cYZ#O@p?|H ze8@D(C)JI#g-?fMr#O=*FGVm7NgQm=0q$wAq^ zt^1)Q)tws##4d|PFD?0k(^ZTZ0ycg3h~YKL4CUzA-wkMPTQ@xwpP!o{chfOR0>Rff z`6oi}iI5z^Hp``mtC?u);TYfRWT1Boo4YaZmLhn0I)Z=A;NhS5&;efx(9221$Nacb zUdTaAbh|Ad&Rlw&Q5x{%6QEdvpr^xsC(kASEkXVrnx}3NFKAQhlUlufbLiz6} zk;4Hi)PhtAQM0>Qbfk_R#7mg8@wlCSCy+S)h0 zBNPuMVl75_F3W0MS3idS^^#CFBdmQjvR9USHui_jv!B1G175ft!)k&aYXI|_Ep6u# zMbww?IRpYij*oze!O^{syTZCYiqhyOl7+fcw&!tJb|U@HE(2jBf5SW{)7-c28GQ19 zi(d1;5s$VMsc}C?#)i7@!~?apG9Qb9Dd$C*R{?rH2NfxXFVB94TQ;5yD|j!+t!sLG z7y1LfI;1QH8eUWG1GG$&kh}8F6c&#Y@bp#f)y>g{;r{Kv{%<20bfUE0^s_rt?8;mpEJVg`=7GBTsgH*|tL5$n^!&((<1 z!|n4AbU@{aev9qMBBZ%P6u$s~sJ1zN9DC|gI8OkcjWe_*-g#5U@1PHr5Y0v*_dIJv<~<`Nfb8dZb?%{X4gPQX9AkpD7tDZ*&7TpfT%-!8 zf=!S3aj{FmL1V)bGeK=wGDl&$Nu1Go?{?J-ReSJ1v7=-7!z$GcNI=vd8T@~fW#J@J ztgJW@;>B)W3weMc9hv?EjUf=k9notX;^F-s2rawFPF`J6w3-wPFIMXrPmDbVLV%D0 zis|HZyCe`{M&;fIqOOU)n(gc)V&<*uKC%p^r20DUYGJX($Jnf5ix#;e%1ITKn*D5^ zydBoetJ%Uq9LNbA7>*#H(|8;thq81n43-1tNdsX>1-v49b)$MjtD=ao|6*}tX%B#c zjj00i26jgtez22MRz~t^$Y={Qmw($F#SHNAhy#FgR28@eY zIGniuv4=+J%(nKmk)_r=I2*M)2UrR6{&hG0PT=RF8Q?T!FhQ!rT8p3GfN1Gj@-_41 z^$ZHHqL&b3^Z{*vx;^QxFTTnA;(;=--FPusxjx(4(?CXkbX9eG=5P#)0%YZDgWNQq zFlk9~CL5}&?L-y4z^;$7l*ky~TE|fKU{#fjjIv5WP;1iQdsr@##~T-D+UnhEOOknarXQ9)hA%tK@;*i!dZTQhG%I>#62 zRBPOw|8)x&TleM9tuR1^X(29VM&SC+6$pzRlovQq8^_@_tZ8&<7XvXaq!o=IlCQCq zsu<3srdT7hzUI_i80X;Y8}J=D$UF@0%OWKuf&h7mI% zP_Y#e>S2j>^q~+Xc?1FJ^xcXF$Lm}FI>1Gmew}t!Rm8U-$nn!mlGT%@MS0&@99xj?d0K0?PFfMC&{SD39V+Z|(iygh6wk@qOC}2Cx=|;Sepc~( z0%u@Rol~F2v~Au|=uK;T&*#E0sD$GBNi{+Rf4?BdMLL|HE|VCR#pBBU@gxZzKCn3W znjG2jjC&{tk+p0Y4m>iyz;x>L9n+6#XZ+suYpBK5~8I_FbU|8!a_~%mlX=iz;{Sz^(#ppE}pVCSud; zJqAUShfso(l09K46#|oT@1a4ZDtt-3i*R?@5mwT_C{M|23xwyKYAULjxDa(^ADR{h>C7tr z6vtO4u^)^r6j2gk^!Ad~-wbs(ZmUlIZD#!|%{H%{vowo9pRFS((JYTKI*RUnApXgF zx39F}PB(9t1BEX)GsW)}-61O%S(bRND_L&wW!mozy)x;;e^j9*Jj>s5^t90qszex0 zLxY+C%_gA*p}uLAi>Rn{03ZVCgFuA@nkB_DCdzzbP=J_?dP(*>nK{7z8hzd1%xGfqi7N>nXCS$^gqV|7*|b8{9zqs4R`pfDq$3nd4e(mQSb$e9Qo73 zB+xLaL4GT_YXtMS{Oa}Tz|PU$IXvbTm)EwoEmze?1G`8D-kx>)6QSgOeyE-$zYK-v z2qbs(Mi8d2`@g*a*?i$&%%yPFl$P*T4+&o(BrLI&O6D)z`0A|Txwg3NW-bhep+Q12 zTH4gG35=|a=zg0LV+AwCLCSxS)S1J_gH+9O*lNk^l^=OgP@BJst-OB2&Vl>OS10$! z?SDY0ZDv#u(5Z?aLs`zYQ4}uV8w@H#zswLy;8Y?@oz)9^?HE}PVO%8}YZu1icO0JI z_KAGkV7)jdB={tUu*!i@Ug`JX`tH71QRCHc+YMbk5lLhW6)zs{9?wp7#tm7GB561i za}119BSsg~OowRf)i2lr#5%-Sz}}EWh&((p25GDj>z@cMSsAphE*epzjqephMcbe( zy?}EOKTjY!%1C0-004|Q03u}hN=|YuhW=P`sPf+$ zN`dPunRLY1#0rAn3Z;)6fGWT2&D8U4#YL?pXzz&VsR+Kh8+%tQJyvPgyuK1ks&14e zNm2q&{{QjYu*;<_GVQ>M@Q)8V@=+SR6eBW7JiIAwFUTNSIn?*+F$`AMq z${)p1knD1{|Jbn&GDV=MGTfhoW`!kkibPu{mgy-RaNngSIQD(Zf}u=+WQoc5NiZu; zDB}AWr3uMwT%)@wva!XQ>^`u!n}(jyI#n1IRn_c;8#F3(JbNIFoa3iv=NkIwP7i;B z4C=<7I^j18n!Xm+LdfKT7L`6G>VPmG^3}3Vqw<%fyKnnpC2O+yt$;f8Zw)5RbFjjD zi2m&r*>h2Ssxwm0Dk=;V9=q>SNLCLH?Q$-NglL;%lr%*Px&)Ta0XO5lOayz6=!E|7 z?GOb}nm;_nt`OxRcPz2bAEVul(rmc$u{#MUIU_7ojY$(jNE9VR*;xO_*#?=RfQmTA zx@Pl0+nA4#gxDM3r0%BOM_eau>C<;|+N|+}FW8mNt(}r6x(6tF#*rwy+<%`@5ITOT z;vcpD!3ORO8kK>l8e|OAwpzD#@XK6Ro2(nO!XR`hWfB(aFNaUHv+|+Fd@l! z&**aSYYA*V1-Sw{+^tFOijcQwt;J;{cjpDWjb{XN$VGycL~IiK+qK|)2&%6wWrPXo zF45OMr`nuZm2nuDr5mEzI32~#(4XW_`UZ@dI=p-VHT?p1&`(u#E?OQQ-oVwvkwoVC zY3{tnTsnYUn(t%uKi~#DplI&l;)Fk2kPO^1cDI$*y?1{lfC*@er*Jv+a(4!&@n5c-#wC{xkGQc7zr2Ff4S&5i^F|5oVv!8hrAzci_*@FG(hFv&3h zzmDrh*n_C00FH35QyJu}Ar`f@#AmI7ef;s+USC_vGV=bOfYExF8lMY#2a2nKahkT! z8eu8Idy58QkAO%JZj9;H0?AwGoVO`FAZ(*T2%)oyo14iZSCj z{`*^~?&si+4%58O-X7R?6!DiRsMkRbIrWUaeM+#hvv1HS&omhw5_t3x z#5lH(gTl%BN0gK5Gow`ALLmOpLxN00wOLrXiuN&?Iw$f%I6bZ=^B^92|0ZYWcb|Zf zvA!{_OcZ70O486YoY6lSobAwP%?Jf)FnW%}dWYO{2fMYLtyu6;ui-rak@>N}!EXyn zGBHRR1n_8cQfTK2S-ZEz!VO>Yyau&mssa47(o@z%I6Qn5nLwlSH-|X4Weg zvQid)E5NCW=tFTLetb+EJ-=c*{wmzLes_8b-W2+3{WCL3MITSKf*%pKMj-qRzgz_> z{11UedB4JKrm^CLXwf?YoDT(xxQHY!grWbgbal#k2EKNH4A~=o;6ssXZ^u8>0!$iG zT6TowyZM^TS6w#?t0Fw7yzXBA)RTASk8#LY`PDes- z*E#=vml)*N$JJWEVm^ywwj_A?$ax5Q!H+*gwzn+ELa@a~FcV=w@r;C66um{c|6(-b zp<5I6Kw*F4MQ$6@2K2LGPBXn9H@$PZo|b8>Voyi=93NLKo_zIbr2;iPBzhL}L2=&H<{uZ|PZ&_w9}v6i z-!>m#g$&($(q>@|S4?wcj|4=j7_D~3F`+6!J2##RW2YU9)E7Q_Lz$fd*G;=6-QcDm z32qJVk5<|0C&Ww(otFYrnjf2{b0IEU7PprPLRtKaps9c(h1XMmLcF}{U%E`<&F+Z* z98HCy*>S1;f1Cz$I`0PMZz8u2@}ldw4c_k^g0fwtoEL8X(em81Lwbu(pqqtk&8_3B zlO(B66Ylvw1$Z|^aoBl5kP|r7+L(>+ns1q0den{QdIu5`e`EUNPbG~{KR*_X^t%+C z?k+bmn)f>-+R*lSZ@jCf#;;pQB%_^bMv|t8u=C|Vf)XmFULMQK#*Q4$g9u=U*}r1K zPNwndBf?-Wt95u909YWXY|CTO*>yV&{UhU6gXyk@&v$)R4bWvO)Zx)MyX9%Y^1l9I zBBc37g#*1^7i2jpW9`=y-kf}O!vF&t^*hy~M=Hv)QhY$r>))|a(I<08G+Yfvz7XcA zVy{|h_#iBc9F8UD_0e8jc!W>5gx0TA-wJiUfA5b+I#i+WVIxODO+?nD`YuxMM$71? zyIr0yAdN!=2ZO3!DwKGPP(1oo&-~{5`&uv3#Q`~dmbPLa_LdjuhKAJhylj}v*I_fR zh4e;q*sG;NM9lBh6T0UeF|DC?4 zyd(0bzb4$6Y!WReq@)6T)vY}(NNh-!Au<}ps*Q#JiN1oJ2Q#6Kj@K?)6{eH+_j5z# z;4Jky`@m@wX574LwNC1W*w0y*ILYa6FW|(;sa8jzKP3OoGcy zge|Z~Kg5Y>D&ReXGGm}Ljn6p2f2P}D+b>^Z{hYJpxmejE6nH=dEeaFA_a!kkz6L#f z>NpUL^+Y$!i4wq6&4NggCPqxLjHgaH&?mr(Fz{$|ymCE8bmsfvutiky6Oi-d zwm1%bVXo&7O2N)Y*m|HJ?Jnu>bxFJ)URWyJ2!tQW2g@!{&bb4(y- zte|;4p}hE^Mv0Atl@SGg0<@8%{LqxZRhH$f0busyR1UbA>DNp z7hvMrBsB<2xw+ap2-{+!O0~YSMN-a)N zBgGQ@pzk7^{nx0%-0mXCUg0&LCBP<;N$95cUTfyrOM5(eXK>>>qO`*F$pKooNgIaCAUPN;g%){BDpGtaU0hM1^$6 z0~_F{-_jz(#2E22JQQVhBrKF24x5m)%XkHa>k_vI8imbs@ZYMKSW5`}0w;xzfb9ef zDRZrbQSVf!Voua#5*TxCq|2Vh8|V(B$2ezkGE&=AA;a8Vl*$Wz9ocoeF zy4&r$X_~V88cCjqaGtaabiDfaJoCK&Zn)Z13Ou_!S~nb^)bzPpK0kVUdOmx)y1BXP zHoD&de{lw`{dRbr$GdXE6+AyR1$@Vl}EsT)+!^H9UKW8#32Z zANuZB0sM5x|BS+O6kLEP~E2qaW?DZ;sn&+;&efQ*Cab z!5HrY@hR2EkFm*y?Xe1CR9hT$M*xc_e)`|q|{}7o#3JArz5a+ z8ZUytAkJ_a{5ED%3(^BEeE#>uOWpB2NLB@DWuLKFTxUkmOwz_{*xjVuNf%pum{&n} zKNo0A=eUyz+`ap*TMP}NMnr2)3Ko>w-3zf#fo>wcL{!GH`wBe8dpl9Ak2O9#0FF<* zAEF+7-HHGYUlx{F%0ji(I83R`?VBs`Dc=zmnDcde1XzCtC)(DcEKU%k`EAKWP03W& z7jG$_d3u14nzDtvSAn*Ip=A)*2a*&VW`p}uMjhg<%c{l6>)<*~bT${2g9SJZF-!PT z=TlKO*Ak7kfPHU~oq3#x{e6|>dHdbW?~e9om&LCN{Eh5eUN6MQ!&li{PhVR&x}2Hy zvh?2$UmUZ$T( z+ssg|8J7BvKy>TL~r-&OTgU2l73x&h-IZ)~1^@9=o8D67!3R z7i$Z+o!Jn@wS&brDO&x{$^S4eDW``{``7tVyPcT=^j)>v8~+|{*`Lk#mxx^8$dKii z;~1l^zqaug|86_?7%$q1mMuJp+;J?~&~5bO)bju*eB)cm4pnP#+{7G>Zuhz2ACD?) z@!7O0sQCRe==h@H-{CJ^NjjfJu`8wOb@r#lb$x|2m;0)eAp^Vdg_8&xr@pn~P#)MI z$%$Sx{kmrFuvV$ZR?=fA$m&YU79>NqK_mChs)V zvCJf{Q|J`RTP;h@NvwyzW#-d%+V0~7n0tSj6Qjl!A^$05NR?2=Mwjp%?gc8$F&5t7=f?9l%s(nwDt2FzK^yv{YjGGahnF0 z$s1j}#W;efj@vpKGSBnTVPBz#=KiT{K_r1kIbOnr;h77{;5sm z=rMW-ze=X*wu4O2{UojB2vg{BnR{p7w0kLuMX>v+?$b^=WU>3OVbZRbe-sVH8a_{^ zG(zlWm%|NzVuaj__`a_dR`jTbiGj-4S@m-vBik7kWmamzQsrEKa|A&dfE^UDZp5^-G>e-W2kPM zuHdl)et#LE$j){(tN1D8ncRn<=Y{vF~dZz(fH?=WNe=56tTqc2cW&N0IG4hU( z$6b0!H;bFq9zPGfG$c>(9YHgg*P2!o41hXLFLQ()2c)U_H}MHt_>XImTRv_z<+`qN z`?q(~sL6&YahM<S`96JXS@${<=br8|8}qg>=q4m@D~j=Y*}sbBb-fJW zp7uUI1dzCF9f1$9I~;O8nsSuV-?o1^lC{5*Wxu@=_%3G&-tERry{7YV1E05lB7#7P z5x(Y>-RI#)m?O*v+!un^Bi^x^sdw8ybNtSxK2)AOKQ8linR%h8iJ!vHlfoM#nO91_N@D=CkB6s+ht4|NcQSCvQPPqJL}0<9vv;eG zhQBCLRXMO*`IZQ#Jk|PIT2MaqTU82o%x2~DN#j5Nzir<=4IxJKrMuU3bYD03euf$g zehsKOVW@BY;QP$Tevw8W$K;k3Pw|dR4x!HFhYNXt;H$1n(7Jmc!FvWw$5git4N!sC zt2|oYl~lk+^V2{xD%g{mcgsd;pC9JePfXT_$m!&oJ~x+028^^>noRrqPmaE`Nn%4s zd;9OFI*c@fs;)Wsp-Naxm8nVyX@B7X>k*^vu&1!2S0g;qp4e8VARMO#1S z4`W9?C*u(1b~Ql-Vu%jOji5^-P+!g-bH@Zy+~Olm=?}dq%bzZs{02v++L26Dl6dyZ@6t*2!ev2pizw}?zW_hC#Ngdz>8mx;B z;&-mSHNpH7?YHb%>7lSf!l;Mu4(5kx!;wK2*}5kW#=Yh#J;M49ooPYDcBjIg`wJkoPI83SsiSLOgVQk#2P?Kt5#8$w=>Nc^D@An>v- zVmlE;n_R+REksF!hc>l62w1ZQJ&=ZQHhOo748RZQHhc z+P2-(wr%Uy`+fJEdn4*+Rb)hE?w$M5TJE1$5s;fd55t*D4P`zq#(fH4?jV?9AOD^n zd+y&ucX~HJ*4MwceQVg1{6NOUPgW!7)H(X%0*QY@VrOW7z%yFo@>T~f6c32a5%ppD z#=1ZxxAG@0!huLl_#Ufz*e*Ce@BZed>7VIzt3OedUgQ66xZpio8QioN1pAm)-ZtNH z_1!^_GRne3S8d_XxZ5A; zw|yORI7FG1#*%rx0Zj?dwEuMlA~#$v!TH=`spK-J7A7!cHsSPUJM0J6Z+287sw@#sj3LH<|H zWMbF^s`?Q#K`siP{Ypesvqep!_Gh5Vu3vrZM+maWmoKX?7G}rf_DYI`Wm6X0+?MYVn!W_ zb$REq4s%r4$t7aF_kZxc+iZZm@@2YYy|~7Sy%@W=W^_w7BaOx7*{j${rDBsV`pZml z@(@WW^z443H%j>tLxk0OFf*BZ5eUkS$1>-;EZi4d_12`FY3ULq74reFI%E&zU{wi) zn^0X?@Tcx%X@c>JBU;8NQ%Wbiud&kD04)Xpl}S_T|AJtov7uV$y2FP;a`o9KURG23 zr4^jzHxslWGZ7X~G>lamIROqJ@|;0~GSkY0n{rj_xcGujwbQEVR_`FW@ktb0>9qY^ z^SJY04kf&)Y~Z=9%42@rYhYgX))B*;W9xJro;47h-L{HZdJEvG)Fri08@4| z=-0W|P0L)8a`?CCUzW<7HZPVtQJOnTx8YdUFj19@{pOyQ?evNK^Ij#M3F+YsVz^tv6O6%q75!KyifTX-9zn zf}l>b_9l)mhTFbq)WjYCtXU@J7oXeP1g24;yFz5N8Awau69xcKwbJSZU#-t#IkqdL z17`=16BqW<#8-!pmYsjv5nH^49q}kGcT}T;4^DJ zzf^rcU3~nj)xh!6gC{h7#YuIBvSr=;b%6C9fhI4|lhDZbJJ<-cKnGXip&i&dr)lJTB zM$DKep8a9kJjQKIWOynU^aq3YWPD#t)mFw6?HYC8eZA}NmhL+aJrZmQM)hK;WZAs@ zq{;k78F!FaGiX`^eN^HwQoEj0>5X`af~`y$f^iO~0&w6 z4+3>)MaYCJYgQf44GuG3Cu4cZ2;yBCFiZiOzC;x+3F&V+B0YVH?zLqoKNikXMe7|h z99iUOG9U@*9a+z9G8`Hf$WSjjWWWeweI^c2s3Sm7qXwZSBH?x9rw7S_Z$MNXWQ-ar z;Re~l`ajgYx^te#Ullx%NL)ExbbU0_YD?L`I6D9~45~7;+&^v^0?_;I6nWW(5?U_E zVgZ$3HA%XUCABB1*UeGeK?F}3d3;Z=Chi1WH~D`0io9Q&jhNM@4c=NU4UM3GOUrUS zVyPq?hb5j<`9GH0@Wi>`w3CUYE558^#*l_sxk~n^diSP7wB#~|?+}Be@Z?|N2jERp z)k<;DXup0-UUJ_vc&3=v8OB7T!!@E%%Fb#cpVZtQ_J$)ACDT4s6*eV0XKIoo*UJ*` z2JXRsNMC|lxqd-Zq4L?2HE$*&_e(!$Jp2wTt9{+rdfv2Y?SAIJj4bQNAK1@ij`wA; z6mTFli@EX}IGe2f+6yGm{n)fJSQWU{#x5;0#JydX8P)fkah>H-w_tDoQ&M2L>?~t+ zd5SO#JSks*^WpQEVs?y* z%V>MI-^M?$3Y`6xodSjPW=bzy4(p({niOFNrJsBKJWp6mB4N%XM z^&J;!db+LnZ5Oe4?${Q(w}&K%Kf_&+*$bXiMsF+%F$9ZNPm7w60(2rnJ<8h6ovuJ!9{S%66F`R5z3-mish)ueF6h0hLm`oWW1kG~oSz zsg(dPgGC$PF1ep`S=Yr$??X;<4_~hfRWwc+NBwn%H%+n3xBT4Ov$xIzL;EiDic;UK z_2YN5^awoX$?wLMWCA}_+xcU03$3qIx_)(URwtwZ*5vZBtOj;kAkufKJumwenw3;& zTbhMn=hHo(Ax-CPM;eJZ%UW zX*`5}S3)C-sQPac6Q7CxXB{H$db7b`^=35rv5@h=zGN6+*p~S)4^Z7S+Udw}y5#@n zkeR&n(t#4MWy2mUZvLD%`gI((%|w$G#R~YGUr}7MfA}_6X9?)!HKJSDeP8OC`_|FG zUiflu5KG4MZi z>SY#x^msDiz9l3C7bfsrDs~Ar?LuJMD;tdR-GwjRWjxaYc` zbG@JkYP|sx2P!0pGqu_5AN+Lwm_2^Oc3}jb{$&x&c(lLq$=8nz!9bj&2DQtal5X}O;HXo4*{q5vLiN{~ZVP`%v#5rdElcMA!l2?EU(}ZV&4pmFNDx0UU zR|HF?eqgA1B_ed-Q)NHm9`85R zdPsBB??g21M$%xQsbTziAm+SE_TfA3@Vnqp9fLPEOH$xNr_XiVbfu|&u6^C(5;#@Q z@pGTpbI)m<)xb!XPy^J&1TH6-H2lmG7Zs|iHt_tmttMxWS6n#zT@%`>R2_|+!ntGpUvh3Q=uX*yQpmP75Q#ss82>9rw{eAqes=PL7 z;q!$`QiHg5(-(BpW|4qCsi*Pfpf-O$;5^fFaSKX8H90!)usd;*HrO_g7Xtgb{Ml)A z>VUi1n9YvC;Ro}%ndA93)47zG06GrC{Ebd zb6;h*3iAmXC@9D~wTwQ7rEzqdh61F z)BCt#A^%Ipppu$nwpF};7X-E*35zot{mE`qnhOgp$meokrmL@(ajFUX9~XmHd0{<* zTIRbOIWSVbq5TGV5LzOJB?I^- zH6!AlF@3;uxU}dG1X$2RnRe(M5V_`6`qi%pF9_5CJpOlu$=y<=l?NLV$59(#&x?iHRsZ2GvkJkGWG!sy@Uzf`J<2)?x>|2#7^3QMUzpXFq^~r)(#_xa8)wy>1igJD zGRwdQexKLS1bnA;-xHfTUQa3~5u3Jxgs>IWhX%BPCb65{Smo~DWuBvh$II5!mcbuvZh@~R zgT7IOZIihDZ{!u;%)Digf|QIYo6!S%6s zUYyq){)RL0{%)V46e@k28$~RRVxQusqLy5m2{XwppklUx)u)z1b;gZsg*b2!g?`^! zAed;bJ6{iFalDQOGP<$z-;j7-_Zd67x8tb5xjh~u+n6|L2;J`qVJ{YNb0r6_vjkpu z42V3w$r7o%b|lZk0(9Mxn>RKZ1imNZGOpdRw(bWeEad1I-eb#%K7~m=4CC4~;=qMU z!kyd#Z(pP0ex5HGNpJ%^xo)FRcxz9fJ@31C2XQ=q@}zca1zsZ(2qm_=GL-V#9+&b6 ze9aQTc6Ta46Pp;{0wL|UpHxOKd*a&vK2&fBJip+Dc**g*Zr*j?IH$JzPRI#-nELu0 zQuMx@p4MI8%_C~D<2yYS-dssY1b-=HKh-$*?y$YRevbA_?6-T%dX-x4jpSX0%@{hd z%{(jeJ8oA4m`isBpA&mwc!_#=_n0~_-5nkFK5-JRoxR=P)_~TKMb_9b-?M*yS>+PJ zwt>9h^qDQQ&hfq9&QC`K6L-0b5lgk@=nbL_`=lHNrNjR+y*_ z_is%S>#4R7L#XATv8C7k>OEJZfX(!F*GOckzTg*-c;@z{t1|u_&bG=O6;{VIdsqaL zmu46Lp-Sm{KH+bqW-IA0q1{S6Ty3@p&?Ec<(vJ2Z;@Nn+=t_+9$&kCeNwVVb z!4Be;7%(_x0bu2K=#<2ikah5jR@u&ad7EFG`>Lc`5k0Yq>Y+#K7=s0}nTjDG;!iB% zc&e}PJXN;wIT4BAY1Ilv1j1U=Pqwjn*1)bR3ak&50 zg*A^;LW!-c5#v&08=!|-3rz{?H>Q4L$%GoU79&rzubEC?dTDtmZN08Swi!_~6Uai^af-pI6_fiNO05Ra8%hfhFUB09ega*Sq*m=F?H5CfiH2Nvhv{ z|020CjxUM6^-Mpzd?R{M&<)3j#aOcOEMB+{F2b07Fyj&q z^8F3i)8jMX^YSQcFQ7pxy-|2k*a;zwXRbI(5cA9s8E-RyfU zZ&H8`%-(o@$G4+%&Gb!$#uu2%5Qxwbf`Asd`VTv9Kqa%f_91r+{dvH;TlDxCOEJl; zR~H1!W2Yxk0C){XY@Ntz-<5es;weVNyRcx$bOhl8(Yi@|L!j6k`xF$AQx1Cp@fr=j z_@lEB7{IMXEsn#~4V2E;R(V%a7UI;8Td!*10 z<6?9ulKXuXStW0zpZ2Fuc7E#;M#j8@wrTvc!P0Zfu>QmoIBl3(3InLr-N8~laLm?; zMVquEG8o8IciB&J093<0FG}m87N)*M5B?&% zG7p_)j2Mh(Nse^qo}s^+)QnOf|JNg6U$xxnm6KpjD>2m?9qDZHWR}n81cvC z|A?7qJIxkEYpYZ_fd{-5^G236oLH=0^niZo51g^UiJlo?XiDidyM zfatwm0QCLC+v}b|&B9||52eQhWOIMNbx78N5X z(MAp;TXl?rw6`sz25wT+1j|J3+ZW~kAg>uk5184E0fy~Lsw$^*K#1iQu!HHAQef5J z;LEQ#q}?1CORES=p#PFi>dgv%LTJU5yM#h5+<~t@jb@|x48i{?}2TFCkq^_*&g)!d zYL17=@@gJd?5sZN{Dz}b<5yLbUJmZ*%`A)hdsEhz=eBetGQ!}YZgc96AsS#%aJM)z z@?fzG;EVrHj_jvj^2ZEnxk{)yocF>fDzm2jwK$Lbj7firR22%e;()vGA$t8m_-J?E zQ{aa50a4Pt`gY`Tsedr_1i={?2Mw+xJArJCW|u|1?`~mYKt;$ayIy?HpVkyGr$vTQQZ>h`1~;F;tyPIB`0d(_acNcp?e2(3d3Hc48mu zm!wprX7@d#378F?wOKF>nRZdP!?s8Q)h^x4q_9wwNW}}B8qFp zd17J!L(>Gnrf?Fi-$wK_NG09~TviurEGPCQ!9o`1B-R=xty)-5NsO|Sy8uF3N=AgiTH`j=lr~^lz&O} zBLAvLdB9l;Q>0&;4lstqTD28o`f5(akA^DoC85#+z+1;geNQiL$dr%O#gBw_is*_@ z3dg@<9d3fYUFzFTL;8*G@_UXrp#!T@!?33H9S0m%xN@@!SU>)+f8-v6nzcASP!20? zATqZB1P+2@i@g48)PVRwpq$ea(ASgq-T@Z2#Vh!D9UmUbH0Ck83j(fJ;n5;CqO>Gr z0s6sadTt{$T%v98UhlwKh@QRGr=y7CR_(repM=RPCaGY%SDywO1PoQw4zz{y4dajN z20Z_uUTm7<(Zw2YN_y7)uN~j;2n4x3*h|<&WQ0QIIE3!`2t+DmzkWLa$QX2YRXWya` zPZ~*iKL-|rUhG3g(O%dQHr$dr!51)r%EowF0Zge^c(HQDV3;lOM^yyFj=dULO70i-m>(WtZZBecQ!Sqj0ZKmOCTJ3%W7~alK!v$HCYs;Kz|4F=LW+pP@fYKG+KsY*#=ZqCDUn#+jP!a@>bS{I2hxl}XjaB^vMhD-IT#A|8gWt(9sh zPW@Zwet|1mm12>E4d?spsW}xw4|&u|!Kaaj!3u;!>3<#BbgHT`o0s>TpozaKwW>U@ zEJ=gIVt`Ml0>PRsOS{wiMYloS<$@h;S!D%>)|9oNzm*_gyQW%Aa%d?&4a#1Qwkz+<^j=jJE zDaf_bvGbydf{keSr{O@rxJnL^W8i=pPeI=x9i)DY2<4VN4&Jd!r6BYbOLkNg&7$i> z7JmztdHUC^xN4rgSSoBFUHX;{L($uFvDy8Abl*_MK7d9)H8O#1hwN>{+5In@Nk+}9nJ;Xc3 zv0gOC9;D=;x&L{@JVzo~xk8bV{ysZYb%7skC^v9dKJ!TQbrS&OueQ&2spkK$|7}}3 zL=0zOEGVd<(ATs#FItfICuFeU-FH74-|c}ByR+p&(1r0M61c?@kNMz*QBaT#!ogOO ztO?R@%TR2lb@Wy11*#%DjnEBms9~Ngtc^kL6o@`&qoFR3G-HCC(KI$Zw-71xkRuep zM8kxduy6A(fvPIJYxu+zN12E333>U&&KC^rL)`{fo4_l%i5!e=z{Y#Dw!F^=a8rIIDc+9j$2JbEWI$~!nP zUuqRz#;iXex&U2MQKIC(&u4Gtf}Q-U;%Yc3S;pN1WGoC!RUDgpH)%skf)!o&r_a#8 zURI6+y3HR*`h^}U9+!ZfOgFrUB1oSwn~x$GZlof!?1A;QuWfv**Z-L%J(uTuPb z#jTvzn0RmOrf|~ zv8Y@awO@In2`PR1t34L@P5Y|1uf)G5?@^;+-JyipQwg3E{mKYO2`rcu;Va5 za{wlo`U0Rpv?x>f8^l`m>qQ49WWl@tj|ogDy<1j8O_G5Ld5dZ=UePqqn9+e|aY_Lo zB2T(Q9%?9X8<8H^?@Jn{MA^*$uj7$bDIaMJ_R|X`P?jU@r_fXCi#R1}Q32S-r$p7m zpdcm{(AD@EI)jYb!&;K}SePcJsD&!C%WM#-t^rC=DBPw@Z;Pj5BHEXT%LD^U16vMd z6z`TcC3b(&`bmfveINO)Iuzdb21tn)f_StuVyNiR{mOyA2MiUlb^=`E2|AU*JC-7i zGYcs@G)n4WDfpCDu*jNYh2|rX1KK2kmJ%n#d%Hp+KTcUaEB_v=wN9wO0~8h}E(r-o z*-W1G1-Rgj1M%+&0oH4232W)!(j0BA_wR>#6(E#PIFjY!g-8JRTW~-=wUJwb7H&|# zyi4*Z?KZ9Qsux}r;DiV>Wsjt(nJt1aB*-rvIQJ zTR{w}4yP`w2#GgQ9#GXkM%9D|xDd@ysCY~KlEC_*VT$o5(-CRX!A+um7PNSEB4ja+ zl#@ho1}&&JmF9#QO<*cm(Q%y_X4xT%8fEg&P=%OC9bGKD*z8s1-0poPpy5yP;KG zqBvV+<1a>Djz|?wc!o!Xh#L##BD0{PGHYKMeJG1%!trI`aFEOYIE@ zS}P~lU13j1LrNU^m?TKywe3xiSvAx&u^i_t$!6i4te6pa9~#iuk7{a^1xO?%EiX@eWcWB zD3OJnntV!!U8LZ?0>VW=5gt@YrOC94oEhDL?E7{)3a{{S-Ic#a=_|d``B{N_`#oo~ z^i7B1zf40G? zVeFs(|2K{atYyA-kT*V@eGWsC?oa{EFQp6h@+=>vta-J*wH%b5|Lw=(Mh~dFvNHJY zuWuSG6t!iBConoVI&1%geGd~jEiL#GIa|{k+SMJyRRPNDM5$HjA0tX@?%0yTho@$K z0{;?OkW3c2QbSK*AvExbbR{OSU8l7l=NaFczXT`QJ4gCxTQr^3J8xG_FZwq=&)OD0 zkq9n{Vh7}{K%~z5sA0IH_nT}`@>N>W@xFy>C@y-E>tMc}L%#;A0}h+u<2PLcnyNGF z+YIPXD*c2Uf=pQ5?HnDn3Y&PPt@|7@rD!HALuQ{SR}IybR_il7n~NZQQ^Z@8 z4imFUSNW(0yh=Cl^?T?|c{oX{j`Lar8%{8UJufi>aqFE8J&5Gs4%jy$fR3IROpmYY z^89_G@TIaJLM8J;)zE!QCSjzMAqz{hu+>1qW9bKzTg-- z)K@C)UTSoYu@C(CnHUT`%3UgKrwd}2`NC_b?QyAz~KWaQk~G5oie8>PC(VZ6Nx zAfWi6>a`fMVK#&lmW)K%F~-ZRfWi`z3P~zhqLU6yYl76Na(B( zwiBHw)&o<<0?8MI+L$F$J>E5}+e>aTrXTeAv=OYpX%fr~iMdVFf@+N?ly9JgDENu5sU$dO5409$+_spThTgyq<<=TfO+8M# z3`W+ZyQ!7VO(S(a=Z(L>FB1p`jnWk&X!~#j9}vyR{xeuBLWy|1E4bYU=^F|@yxhht zU?slL3LM-dergsEGgM6<>|FOLGD3#7CJ-IKPcQAf(lEu+A5yJ34~_;$!Gaw8W`-8A zpuzv!zj1N3P<39JGAP>BOe(Pq6mIc}75x^Xfr^=Ig^0t@mQcmpR7tkJ{C)c$7# zQ0j7cM7pVv0VHrN5|Q?S;x)&g&F!j+e10%6H7T@WV!>o}u>2DdpiOLXmK~5gy*9~So7R@4lE0yEob*3V5auvO1G*m~YRp~HN3cu74_XC^y#=-SwF~imK*P293SKRS z9sbektZiX#+Rwfo{h$2oDX)L+*9Los9UXkEF;H`+AcIyob5TlAc6U|PA=4YT*mm6+ zbtchrq#0%;>z}4)8&9;J)&yWzrx+A#M6`AKcPx^BxA$xHxK0Sp~Fq zHNQKFe2>9!oXifC!kolxZY|yBPb#koXlI-hiy_B#s`)*Ij$)qHXDKypU9!%EJK<(N z{@DuVR+(}s#KGjO(rg$NXIMn)@O?f_wV&`-Qy}=1>hXL#i!@$LGVs2gdB<`ap0y7? zO!j_Fho9ADbK32v_<>gW^52*Utb+wXe%)uzf0(0cb-xBb{0mpW^W7Qu#=2M17ZB+D z?)O&kiW|yf4?28_U6-&ZkaPw(RDm4z2A}A?(s)}97oM_QsoxMgx^HOX*S95>2q951$LV7& zrru!eIO(U3iSZnabctDitKU(u9-c|=3no%ZjONPFRZiK zA9DrF6J-$$ngw#l-hrlxlQBD%Xc%P?9tYf*%~(-QZ@JHM7zW9&)`ZW4Gyc@}&Z~on z%e-d1LO()D=`>0_hhTbsw&y>}>zKYn(8s8}3+(eCju`_iKjFfOC_=>v!Ad z!fOQ=|IZ`;n(+C4mQ&ZNDWEI(-{*eFe(4*-%t5#5tfW@c3H=)UF+?Wd(N7dS0%(ShKhP*D#0}QjR z42rj5GelH|yT{G9;a-O74>hALB?=Ltn_Nl@X1}u@4S{LwDL?jon$OGNeyd}-bVG7W zV(Hsx2us~s=0~!a$&lDM*r$5K#lz!9!Xl_&iNbA*`Vi92Im!i?9rW}!jBUh{e16c8 zRr*JH#&Y{AFx+uh2TtcgUHL)=nA9|sy129}mlDW_T$bWkx=6W6&>>W6ae73XR`&P= z!CoR6vdH}il6UWk;Dackuo{h`os881Z!TaEb)ZGUgh~jb#PP+KAZI**h+TKJ&@wmg zyUqPsr3T%nT=yaKq?iWX$E82a*yi|a&>Um$a{Ge#xpz^xi$Ezy%K4aze zhfLU;rzofGkd7PTh)3yR3Z;M$B{>OuMR~ZsHWHBVHa8nsbe0eZ;;sfTRlpN}mv>TM z1?&QC+8ZLdo5KQ5We%UA!!eK;*cwTU#CPDB@zsvBr50ZiKefw_2 zxn@Qh#2_&s@}h?C(Uig+=MJG$qa`6y81sz`>mngLlnJoEa+SbNca2nTNdk)m?oqtn zebSX6&qy*QZPXZ#msz3$T6vXd$t9=Q2#<%o4L}?#48o{AvKmNiaJ~gUqpcC z|5%~GdA`#yHoy_?e)-GNM)O=*ftJB*A$r@G7|RVk)n5pjZx7a!Ts2i2h~uk{|Wh|q;T&a$iLdKJt(Xd*p-4v?+=n<_QnT|dG{A(fn)uD_`$ zV!#KPJg)PseWn`>HN~OC$z|#}n#c45zKvMSYP`m@?|Cr8Vt%b^6g3+IXg~k64N2#L zhS_#}Hjd`OZsJS}k5z|+Rk21&LvgpYYh8VkDC5$}ZwTJebBDG*DY*wA)P~J>vt3$( zG5ofUpTV|`1d~XK5)rAEb+Wt!M(`(J+2sr zGpeEVNJ=+|4VC`emxbfn|o4d3FgR5 z%2bF%lM$-%0Y90apYkix64MI-9Ne{Ug*%vy9Sc` z>0|@m_vRhp-$Q@)!}(-B)?D7!Uaoo0wtZ$1_z27>B>}-pr=~yJb088*Q<@*qAKH~ zAv)(~m`Mh95fl%axf$U6pD&~-u66-|7fG2tq9#?+p&Cra=yqchq7c&0w;gy8@C)Cx zZKYY4qb>K8r=4l8?Rbcj@Tr)oH$g^aDVer_vJ&TwJV+qY#F3w*cuL3ZdZpu|b}bhc zFMP9(4o_EiX%0Swcp0AXlJ&XzaWUKg>>x8&30e#xPY#wsISL9W3aXD7L=jOUxCE~ib2n9tH2!I#fzWh{xXYZyj*i-kVMJiEM1 z6De=%(F_qrVNaMDXKhHbnl-6I$~mhB@IeMUrC?zXHHT()2$9LG&Oz;~H`>CSK43@@ zPmL3CX!Q;1b+NRq)Wj|=zP98o~amln2Tvyy<(R%jM*)@V9bYDhEB zqES4ND{}ymWV^h|UK4wmqJ^)7r>N{HqCHZKHBHMOXH-hh2UJznvX)#h9|8?N(Lv$5 zw+*DE`B=0Ix^kI1eovQcSwT?Nd6979_zyD&UXUw+vp<-!84rCGjE1G3ICjN%&(u^1 zbrV21pJ`ulrct{FwE#QNWci<3*MtM@N?6l-$|U*exrv7xdJX896i>)rkfP|tyuwpf z=-+*c+oGsy6mN!tWo&sDfdX7CjTU7S2W-o~f0{0P? z!_g$TQFoV#N#Si5W9N=gb)XPfn=F#J=`H%codTqAxqc1rLy)p&&htfPE0xm%GE=h6 zgyEJ?a`f_)DYigGENJd7& zG6s>ZmUf8SxS#B7EJv(%wxRi)Yp>CUA?A#ZP-Rcw7e%nDZlu^o95EGRBuh3AYVkjb zHi->QdFrl{|K5n6UNAh`jXU3a)@X0U{@nB$_zo96+@y$#4wJ80*|Oh@Vx4k4t_qUz zg#9|8$9g&THNN{UT6xM##pO=yFJFYv=e(GD=EMfri4y1h96TEs6>sNrzy@@muN28b%Fx51d$MPMtkJG0N1)dLi~W4H_G@9$hIS_W#6Dq( zbsJ)ycV7gdg5Eei!q2J_5aQ3#3Ri$%#>*`^*5~zIPz1_xYuAbMA_QK(y}e=pkrKaL z-oOei|K7QV;cdS2cdLmUe4?9(Xyq~M0k%L&&{A(XFFR_^fJq`aomSMw#Zabhl=FK( z^Ht+jbuB2Ef-O@e1o9JeyUmWh;7}N+9k%Aq`O_{CTAb>fsHgF5=_f=hXH?Y>2eH@w zskj=x4lD*Jhm9kPo>}5wP656!2VfwP9-3ktBR*g|b2P-6RAr-E|GHh@p#4u(1UMv6 zRSscf;Or(3TbvU8Oqc-_-w{Y{d9X@S7Y?!~hK9D|GYBW#pnt(;79MPWHs_7N^v_DQ z!q;a4y+DH3VgY*|(zz8kXM9B9KZQ`|NZwxH)dfquxn6*SXeFG`%Qv;^ag49t2r+ne zU+925Jq1}pe0b!a-Xkl$JexrvQ&g0M1+(-OstzHby?G{E1vuHn1tE5riJ1@vaP_H1 z>B`V~{j%5RK)eh0oF?9f&k~fcA+m%WRo}<6{gdn`E$Fu@kt&AS+`pxbqq#l`c<&KB zX@Fq2hr96bs^D`vaMGDn#^=J^9O2!<0F_ko)_ia>FU!R~07+$9M)Lc3-@>=5cYUA_EkR%%3(Yg7wDuR4tLL8#pbbJz_srmy|+D1uU4Dbto%so2ZXzI&5FU zaoWBVB~nlY3}hfNq|KCTjyEgUwx9}Lp_4L8m@gf1aE8lnnNMIsK~Kx;x*jp_BcNjT z`#U@71Z@Wp>so|ePn+w0{$f4vQ22Uj5ZEq$h!dU^hDtS`ygL%`z04=T#Eix5IjkB) zdk~8!_DVRl?$?oMB+r6U8pl{j);LH6H(O7^2vb*BY7@1wT7&a1!Xd(yR9ORWYIN!a z4whaBNe!|wJ5H0s6F8OyL#i-fZ6joHcUVJ;&MhFzX&U-QeZW!2P^DMentMQeg+KHy zN;NG)4roZiLY-F_eP_KJSY(BJG<3`_Dlfx}sY(O~vLJ_75TGl;tuQjv3x^trfiiRv z!J$ZrYGIC6AvGf!AUCdAf^F(6^shG_Oy41FyWt4LC~L>KB}xc4bdV`(WZt{TJVvJ$ z2Q;06Bt==6?P_TSsq8VwI)uL?t%(%<)wuZGX}i^CHEFPeq|>S#1q%pmgAE`@ zXtWrVC44+oIjSq)F(keqoO+GW3QKo@aQy8$fv$B~-MKjP>#kXeHTfuJ0;l>9s`MSk zW}#|Rz#YnP>YY!O`Z)Bxe|e$kd%6yKzgPzWf(24ZMFip1Z2!}V(9SsqaLY~Kv7h_p zn&I)vLQ-j9Ef6Bn!6c;lEnvSgLSDSTks#eXyVYW72vn?Ol*1f{%(f)5fbPwRE^1DVsY^f53a=T_WxW zS~yD5(KAERCYkFt%AHYTg=2R^O$?V6PS}q@ht|Le&n5|VNoS%r3GFIX$aKFsK`UFB zZzt0-_B>q7^!J=s;HR_oTp<@wji-)*XPx%{W%k~hYUyf%=_Mjg#gA;VJRxaEi-1Dz zMeZlM=Aixky7RUk8oRR77am=%)vicWnk*lv5dM3>>zyhe=6vYi1it@!WG0OiL#^5Y zy_jsbKRqoV#}Ch;E!bmoptRJkas%w$i|GYun(|8h@Bdy603;PmyZ;}WzWFcGK!{nS93VJ1+yFSc~< zG~0X=Jrj1;&Mt>|SL3&4$qp6ccG8GkcN}F7jLLVp9 zs$Xu|ueQlt+cVw1jfOM~@6#UQqq#^GG|d6s zZTcBEhEmpQY-W0F)d6el!lEg><}4@R^sUd34?lrNWNSAHs%GW4|569aQwO8vS1&C} zP)@0D?;Z%d)IK_;Cm0MO0Gw{cW(s?knmv1W;KdEhT3_1rYHDGb1 zIT;a*+R*Y`T*%yWu#w_Y2{MH2MKC8<(@CJID|KEqRTAJXC3j|gJaB+H{+K2#N@d^v^aBkd55}yka3+l87&wu*J#t?Xo)A}#Uy3e zkYX!GN-d5K2Xhk-J9lKkc3%B}N}%<)^kR@1qnsH0LY@rfzeL{ebV}`Ot`(qpA8M+R zsMM|J__B~BU2NTbDqX6RLSkxRdb{RIau_s3I&?Ra)Fg^R){WtKd}P=X0al%&RKVYc zm=x%QlHlLQcSsPqa_+4I^FQw#YBed%>5+y_K^{t&lSLy-;N&PwK{L)YqIGe0SDvapL?ROd<1E4y@0n?YUf=bOv5lM9PHuHE(12ET>}AA!j!$;bu3XEe(tDYrZ21^M#0 z>XhTQzr==2$RSig;P54q@FT1_n?pl}cktzlWmd~J4s`x-J#QGIG_79@0`7ga2s!w; z=}-mAi|D_k-W@M5qhP~uihrk|)=>=>@!m?{p+BZr2DTH1lF2l-Zl?}L{uPv@ouBF( zO7m&K_?Z^)-l+zZ-Fm8R@vKQ&!w5J^!Z^;CVp$*mz9I&6>uUR!-I=#2(^o39KLFQd z$0tQ-f03sSfO|q`xv1y^~NeUedhw6G{POPmqh*6F3AkUVG|Lf#q1CAL#b%eLpMDkP zrL?Q_a-r)9{znJ^I*w2+VnD@VHU*BJl;(9(YnXcw$2c}q23=@|Fe`fgKxM-?f`R@= zDYgX8bCZBFF}v_?ZsGVUcW5ABC(&R8OOd>gia_t=p;*ZAMB6efs-xqDcC>l4S$ccV z)ADnv=(9+byz*CLKdOk;3@vW9kqSIN33Bi^${>@3UjlD*iUrfy_gu*})PZ%VYzAF0 z6xH{vI>C;LKl6Dg9oFN+;B*?)*8^oaRJ$l4EYeMGjvh?oIibv9BLo?N+$K07w^CmR zLE68;i~G4(vzolJp$_hY%HXWaEg{?jHzDLM*#oDjEaH-2@mF7Hi;qyY$z`+#-YXvR zEYc&}eVjp!)-T#@?Gn7@@IVh7X9tyL8?{fA1|vTiwXKH-3t=SBJ1nnqx=&7N6KH&4 zPz`C=#fu8#M(XrMO+K}Ml)}KIfJ2ZkxM1cnPN?8GA%8e z5hH`^@xQ>aQnu>>dBBs6h$*BA3aHeXL>V;4U*U0^0TH#9G^#^yVVSh*GA*ft^N~op z0xdt+>m2_9f6v`ZW$3XfCWQYOHcrvX`u=tifyAkbSg0C6uk6lD1OnBNem?}A7Mor< z2H#F+i)SIn@_0RN@aJt#ToOTj{ZyXw8S-NO&%LbXu&0}d5K4xEH}Xhu(U#6|2hbro{V-Hw1V45@jhp48j|U)E?kZ~ zC+G>ilNf3}!Y(VWVeZJbYz|QkbRg1s^P_>$Hg`^rtUX!Q^`=xcCZWIR-&4yu-k1F- z{^qc~eROP*u^CXNr>xlu?IA#e6JE9nl?Mpa#r$PvE;fP9E>UG*I26EX)p>L8415h+ zW5q)_#NoSGBIxW#vnLy!n9?HV$MFOc4p3kLs9E$z7>0Jv*@%dni(#Jt`G8jT6CO&T zqBVP$`z)Gm!_u2CVlJ4HDqRs%mgn;XbhbT?_qn^EVxvXHT^oWwIJ9g3kmZQL$>2#3#!l3l2@3*&7X7Z;)AZl1t}(ESb_e#fhZYz5P; zen=z9^xHkZ*vN?nmsw({m*?5az4nBo0)njRbgvPv5^9=%hwAOj_a4!jBr7qGoHpTZ2u8`4JR7p8y zn2psMM{#j;>+UY!jg9S9YOiHoW`7IOa>Zq<{N;pYQrQOf3$7;k!8@>AQ7Y%)`nz=# z+L&E1@uxS_I&4(@p4#+GtNV{qq1cUTNO~Rse7-{Fg{AuS|HLGB+Vy8GkZsp)x*UBTmiNA?<+zMkO)Zktp$3FlNR`XHIZS zl=SLi@cu|0@@j#s->8!U(oOS!ewVg1G7*>lgDMH7Xi?A9q&;1c4FkwipJ<*!#K$+4 zWJHpL9-qo$N>|Ga#gk}gLQ5S9RV}(S;SKPjyKxL>CMeHEykMMSoJUfJ^T0!#a5hJK zbD=)Hn%Bu1oClg(FX=U)3qQMsBHhtIOo-9JA3;6#qbGz7YxbCx_{60%8tO}j-)zl- zWK+LaNiZv7k@tD4Li&W1SUaE7DV(!wr(XKuZ38TbNsY0`~>^lG4YWts~+@NEB3AMXCWnPI~YU46!PgMA;CnqqkgqpFAG%Tk!{a7Pi*tRVQ+plg#Pyap`dw!n&_Ma|H z)%$xS=yZZttpQ>7;E$#g?=@nj>?Ly3wfC;_*vG(SZB6&E)R)bgchIMPK6yt3jz62slFB+vGYK;~2@ z2uj#O>qFYJy&;4CB2Ufh@R#c@`BRM$50gG>X$R(BBt=R7U?_3xtNMqQb{;Lh7`)dk zq9K{jI$K*QP~tIuM?=#!DFBAU41pPCz8f?^xWK|ywW@e56&#oI<`4RO3B2xpjOD$X z0_1l7hC&~55?ev?58E=3$6y~(yX1DRYsp1+4S{UPZ9mp?~GXKbS3UA-=*p5>o z=0Cx1T+o5;VPpK0*h=hr4a1T9Gq0-u6)cIO^7bUT@fs?iNW^tgw7RHOj*T|e>F=>p zrh;e)1|Gh^8%~C`S?148qUQAM?oAhBkbd>rD^r=plkxT23)z3f*Bs~#1C0NN2P#>Uk@`<;g6i9n^bz^4s!+=VFma2U97X^bM`G*1#x! zJwxA+?^s$9Pdu7#6R8P_kH&T#t7A-uW-{h)?b&j!%(ZSfXpAeT{8c447Yv zgjAK-JV?rU4!lfaq_0&@bG^H!E!W!(bHBRVkhICkU22@Sr`u1z@dULMh+(V-V6EqQ z1W&-V@3L7IZ(glxk$y=%9^t0s#qH_*9KqN0|K1K`oYervzIjS+~ z?$aEGbjyOW5S}bx*M0$k&6oIPXHiY4=d7R)U(jW`VbcDPSu!DTd(Gr9_Il8=jD6rB&pv= zB5khTO}OyuzpKh2!-hJ`dWVyc<)O)UaW}_}dcYh&LMu*PQOk{8h*weh|WhuszX@__Z(+YsPKc5p2=w7A`k5%9;9Pkb zv>eXHrNjP&e7<$@rAr#=oIN+;9&_(Rk z;@O(_ufQ(13q&+jFeW+99p;(x3)72_+uy^vjp4T4xNx({Jza*L?#J$5xgX2EH_^eu z?(f%f7jN?wGIHs{yBpY~PNe;U1h4JhsjRuzU%ag5YcE2hOMKdTg$4Hu0FUdZ!qt*1 za9+D?c3$1PjsE+ChDs{%ykzfH)OZiiOP{D-tzNe>&G3C|^S-WD(N}0{9CEze@Gf5` zqeySKf4rJR5ZqiUh$4&{X-EFAoPl{_<(P$w;8}sk(v>7Iy0!w$SK+H)-ju zMy$}c+<;=cvLz_B9oA&ATU{bf?is4RWPirHyXEj}k=QYJ65NM8*b$6*Y`8}2&+Rsu z1Jm?mDT*+e-kiK`o@`;#ZOEjzBXvx_iW;@x(G});(pQO!P{w77*5ca~?^M_D^Gf=# znfSR_n1a-kEhbr3Fvr{O@_$=CIcgluz5MD4 z)(+mkcO=V(9P)o?Ud%yR%R~PAOzk?nr;JId<9=J70ag1M!KST0zW-s!xI zNqGH&L*~1jBzKwFnOpED9Te2AotwKX@ZqJrahQc@anrx~KP(_OT*~pf%J&9AJSrNa zGrpDNC42DPJ-a>ET%Ia9mW=b6_B^`wiGV{Wq-*l&d1r7|7!?l_A=~q>mgi(!BzB;q zz=!)b+HAOCZnZn+!o+Ws*=`5*{MH{60v~yN7(!XbKYDzhwdj|-gxQaKi_aNjldDsp zRj&D0%$7o>e26XJw0^su8dCc8H|OOI9!EjJnJksXY8d7jc4#QglaSOX*MTcTVB{x5& zUEK+V!M7s#(yA(To(NOu;DtG(dCE8h?X~M|83&DQqFVn?HJ(jEMunR1R8zi>Yt@qh z*}6L3d}naj<+1Rde*HT>>yq~w8XbJ!?LTJ~8F{N!HGXAl*!82DA|HmB;0r;#Qqk%= zdhm>RadKlvShb$@9*}XU4}M(!VRUK-OXT~)N!%mq(6llaTo>HMW7;byv_Bl!f46Up z=&g(JAj-I!z=!GQDt62IPw-a#CGh2RCk^yMhV(wGQ_a1O@;ou|iEK4o|F?fX?o00B z+;NqM^~n3nsd@0@s^KO7G{R8sl`&+g3lDu@{2OkFFox6pwqb~i--tH!@b>aB&deirffehfLw zK+_e@O-gVVi+Gq?2PX~*u5}S!X(67TP0zKaG+;_Xk%{+~9G6BIdq4r0t3{#32!*{7Qcgz zsAw45I62gaOMglb#o{ya&u^>$81``%t^fYeaIl<0MH5Sw?3*d<{Q!McsfPZQ&VS@+ zs{9t0&~1iDKYN|sr_6kBs&mppR9{^oY%~zHd0>HAiSu;sF=(k{A9!?GCOmTW?0g`f z$(Bk7*O$54{dm^IO04bUbx>|5{s=7KCu+J>*6Ma@&g;0Ae`(mIiN*c$HGhHHl|2Gw zMv7NMs`iftMu=Dq?3%qpYN$)UnyGk59^RrLZa0P_k(duw_a#h4e>W%JggFb0U$6tp zC-gf3>R0iTN4`nEe!`(+eLbEsBirKNQw#XFK+tJ{$IX|t@|?DDhy^iRuH2y$`%?@m z&kc?SU&udN4(y#k=s@TGc{DHmh%&pWd?c#rt*~0Lb{6m7G^tjhD%S*(&?8}9ASg{( zTY$AR99?7E7Ig$-OIs~)ZZzO1GSd@@Cpa)i0#mbroHtt!a!^+Pxm*F)1Tw$5^`(Xl zv4Esz3?-My$38LkMcd#YqM@_wq}WL?x%r8>(7jGSR~(y%ZLa*Y(%Z!CvjPs{lCNRM zrEr0p9*EkUb05zZjy8E#cdn~P7STpqNrOmkiPz4Kk4E3@wR42otF;!;5i?nD(Beud znH$mY+g=FMTYa8|29K$COUDd_e(1&NP3Q2CcuseEtCu5%ze>UMqbIXMkLR+#-ag_k zUGuQ!V%g35UTqWpo7WgVAg97 zGT$PkZGJS^x@dLbAaVV%nzJM0jg6q0@NJjdMzqGJ)A%}UFm$YU7>YKDrNYwJNAP)O8f`ts3ty}5pA zm_wZGt95;+$}95u4GwkX63Q|SnT57~tKga=Y~wY&bN|F5H}oZEkWYza9XL>-oty4* z-S6LK!W00G#N{Yv>TeJ{RV%#-Im6a8#SafIF{vX)qLX~)K^rH$hlA1M>0RQV#is6f z9B!I6%uL!&veUZB{-VPZRg1sDMnWUVThzw7YQUatrnY21fHWVSHL|j*_;xaSdlY#b$bh2Fy;>(mJbTZul2ytm~<5(=Vl2x zUu&Nz56~)db3DLF7h+p?2u7Y(BJv2xvWI2%)wwkUoXnQi@jMIV**HR7*gItqHRgno z)aHB^{yUTqb;%!fH~~$=0w0F zo{N<5wNrBC4(@1Ht0tWFx*}^HV*};YG?n;aId}Xlqx5X-rqH1WZjrU;(0TnmJ%b$d z8)~;?)9H2nae`K}343@u775-wT*8IN9rf-4$}{XH~}lE&l)~Mo8U! z1jt{DJ{o;_?&Y9Ga4(x;)E5tt)lAnNKl$pRAFetdULXTN#Tlx}X*FqNu=H}?oV4hI zeku$mT^b6;fv2DUR|<8}LW>LSW%W}dQzCOI#?;Kd1MeG}kyp(WOT=hsXKpRxv?n#E zHKm7YtTx=p501{UJl=T;9OPX8krydJHph`9%^2o3o}W*ms-n@{m6}4ftE_F1xv@`H zLtHpK{9xAOv=AR8>FvMw1beu_L&o%b_~^yLcO|201Ux2$nuMRCry+dXlp+^_oVNyr zBHEMxq~mZiTzNyKiP!A!G7+JYJB9&?x6-=meY-JD&3YCOyC^M9cW-wZ!TMn~x#>7_ zR12C{diA*>ryu{a>91Qz=>&H&SvxUTM~%Mp$+AAapCNuKQ|py_#VLO(iw} zZd$1?BqxaE@-gh<>qPaHyX}6zos8u{u5mrJfsEXSD4sT*&hAuU%9|r~>x40K^;EK0tAt$KCJ=px24LJ*-V510!*nTtAZVz4HSyc#vlz&6S zTMb$+`q!-Pd|tcEdQzkbscACjPJp+tu#X9f>b&w?#=sYRCbwgJ7UK12nbf0d4drN9 zRXa6Rdp7?Z-+y>7}p}!WS8}}xfw$AifHn#Ssq1zPbW&bIt z_E+ZHG;NwW^F16Q1_^R6E*wljia4{USMfruMWc{3Uh8NevWMF@Axzcg1AX1KHwEMZ zE3^Xri`to(uAP!^a;v#q6*pIB%R>r8(jDOzn%#MK#^V(h#!pk7Gy4#bEE9Q=8GNlR zo<3ifgwKh-GD;qzcAwZv*mXalTc0ZFxRrGv#4%d?REzUHcL^&m=mpaY3sE?Q>Zhai zifO^c2zf8la9S0WS-8oG_>ybH`%Fgvmp*_yCetl&R0sfL;gP}pKK*Ve3d)ipt;mw!h;!C*qNI%EsKC5k`?BH$bfbb4;X%avvbv>TI4@zs$zG&fV4 znMF~b2ZY`{d2>pi8?Ku*`tf?U`lmKQIIR)D<-1<7?Y3(L>T)V>8^OoE*@93$9)B z?z_)baAo@B=Am^TOb=chJ=}DVd>K+AK>Ta)H~Z@P!JABdv&Qdg;{kw(f#OzRNWS70 zVP>>O9QsT!xc|`gDzo8Qh);883$6TeXDqu@%w_@Purr*5VC|fBIE+X-}aszYS3Mw z@i&|CUEJ(o7}DHy^Yv3d$D}wge3ES2uBh(}ug9ice=N4TMezZlX)^yN|HbMEmplE% z@+K`>==M}H*HFmW-co?$kB7LB@`0NjD+@XxC|dax9nMwCK^(E@SlZKe+_qJ?>gnp0 zWO01r!QExl>3xkaDGvC!8+vWb)mMb}4KEiQi z%Q6BmK-XD<$>#~}!9pVb-5&hwEtaB=VQ)gvT-K<1W6;+`GF{{94dHg4h;`r8f!tk0 zc}Jah9-Eqlpx{tj%kV@35l}1X#9vVjWPwM>7s}e1Z~^hTho!?!bs#u-MgQRH=5gaa z-etiJIzjlIyBoOvBBm}Na}cnIKHWH%?1?qPWen3YnoWXXd5{8| zuAMHvK+a~_p6nYEIybZQKv z4c}z}_7J`_SMPP})MF%r(UnDQDGx#`?Mc%y0s+D!ss0r5YiHyu;Z5&ta4`D&+9M19 zwk22N?=*aPCdf#b@!RxRS3w}_DfXU(R){zH1LDvm{rWlzb35m;b{C$*C+dGnW|eF^ z#}+ zb#&22 zU{Jwa3yM!1y6O(sen*>%qh_iDw#E)eLPE*F;kru2k7mTzkjOEYa4!$#;Ps5d`&T;{ z%!jDJe^+tV7ijp~eNkn($0o-c@8ab~X5psP;{2;QIIGszWT$M0=Z)s|A6X3n0unN-<-?x;pAVO%aC6qtcpaR5xuS~egx=dP!e}O-f}5&3>S5M1Dg9I zoVWV)fePodO4lEgelkjP>s)QUQHA+0Z_pV{?OiGgxb6%WTn}U@Wi=~3%#S{p$sH2= zFS*RV6rJXP-L8L2fN{d|1_MizWR(1;QX$TJUS8fq4TcR%6K!*n68YYpxy?kiA0~%hd55_qHex$GGKi}EBhLUX z#h=rNCP&<_F}T7t#}VYRltB$uJIMFF=vtMu8w73cK~L?Zaf1|mm#}4vhqS{3iu+R? z`3_JOK$*#_0^V4gd#WJ!jVRKLoK_eYXrqsOEJxRW9!3R36lk>Ea+F+rU4!yNv2*pa zQ(0|N1yK9|QE&Z7SSU2Z{0JyiM3iDkNR{@~PH(hh{(Mkf+XDq*)17T-cXd~ToGyQ> z-Nssb`;XHSX1-=L7nvK!s;)j9K=kf~h{D$xwN`ZxM{Jlf@YB^pEm8oxz?KePj8q(W4qgCk5Cs|^5` zvKq`%g4uUJe3Kd?wDsZ(Mp+=q0NpiiDh;0@Os*en!#dvBqh8C;^Ce34nvrIvGnyV~ z&eZv68&nxRMh6>TQYy;Dz{?e7`ql^QCOmJ(YUZVxIuw$!&-h3$m@&svh+;j^Z~3&w zL$6)=|Iveb{0l}qK}RPZf6fi0 z2VChS!K(r1V^}5i&SVmkjYKKkYG}iCOE^uVbv`()lT4>r)oV=%+?E*eF1?d%NHla) zl{wOhtMCoslODqz5uN|Gp2hs|5tvqsyaHGPTUTk&WD;@GZm^nCg;Fkb`hz40C&41| z=_K_;%9Dne07G=UrLTzTmwq>G=xZy%@GR0|Y}LQ-jf(v5f8@?OZyJ&t9}ujY>aA(0 z`O8z*Pdt@}aLkP8X(riv9k@evAeyanI)iaJCZORvP#oM|-0LYRV$7zK0{DUASB-&W zK)SjmQia+HuHuITxK>cZfkr|+X7GT95oMrmcc`MtuRA4(d31F-@S~}3E zluR^~I;}jpSn*12gB}sy!mgR#oeOJRP#jW(43G;XdmTjcZD%+Bi`Lfy4o#JDGA#F<9|VTv#Wull6hQ&kmv9-{TWx&OOB< zUeKU;_|?|7E2hx~y~NZ5$C#rvQTL4*} zbL0*+Hu-}@daTno|K3os=TEHn82zDzb6-L9vzK}JG?4HGJxRObldL(ezpjpsx2TO= zVKe^2$^5V<`5cZ5{ytX>4o@@|pZJcr59L(0?xaYC#kY8f_|z`oVpIu%V{%YTY#WL* zhi%OlCIn%eCgTV`fgGj7ikeoVa-m;YCGPY=Yg#w$CaE)cCBp)6QNZvgqKK#UaFq1F zIoL7@+8kl7g{Gwe$Fu>Zxya!qm722F@>$JRGFb|DG>14KTZoR++AQapc(mx#yc$$M z*=E_XxCpadB{K^o_CiC$#PKtD8NO%R5eug$I@tW=TT9O1HGPEbE$}lhr}nW1766rW zeqQw)dE1Ozchz2mxg9dO`+86N`nXjq^okSVS+uK4$_RTP_TzD>LonWuE3Wl;z6xbp z1c>)N|5-*~r(U&mCiZ!k9}+rD4a|gAe@5Fr4L%!>+xgp2tt%kFPvPHR_Tw~_x$e8j ztsj-%h$@U&gQWVFV~O%F#GuO+Qvu>-KiQW0MBDPcdB(0e*DF(KV{OipXEZ5gYD%1Y zCIN9Jv6cV-SaaY2|FCfU-{^3U$VnlZBMJ?h`>iT!Yhn0M#|WXPr&A0+eKll#ov)S* z9q$NmVt33HD~$RPwJ7}s=PQbVbcXl~TI&lwIYsO+7W#C3>OcDxMSq6Zdlk!h(+vgI zS{8PtT!`~IfsiDXZv?+7V=z=Pao%6u^Ix{Z*;RU+Al)H+$6M^&tXqU$TJ@RPse9%_ z>Uy=9G3DJA$M=b##iyZ)fhg;4CsB(v5auT;wHc$wC^&P$+^5>wF_cHD5^V2qqs1c| z(!u7RZ8D<9pCOCJ69=_PH4k~7S5E^a|KdFmvzfPoeia8$QB{>#u(Y9uiRf!c^0uZi zBIY?k4=2wusJ|TcFI6$Yw#_A~nuMf)D6G1@KY2?7Xe|CE|Nr5A0d_^3a{i2GN5NcL4PKx9VYSuLLY zpBOv*_OK+}HLoN(&xxQ?fu9ds2StR0EcL&l7&ixL7Oli>mj-Lf0K`2psZuZX25(3m zLacMPAI>WyxJbQyhWQROND{}zR#TaP=v#_t$kJ!Odjwayk~|yj@Vzl&d(2*oxaE5T zS~tdg=O(!ZO>d5%zLZMjriew4YMm{0{-rb6YOcXcg+@C^z)UqbpeBfFIZBWli88Iv zHG{`n;%kq}za0}oqcY~@%*iBfe)0m(htNE`_)`EQ<26vZ;}Wwolp%v0oUx5oQmMmk zEo4-3Asv!#YU>-G+;~BW36Ov~><@};NKP8Q6Agh_2Su1_21YwRQ^ubXH1S@+=@J3h zreOOa*$98UvF6?a^qPdfbTB+cN24?9AJ6Fps}N;H1mGN=iqKBr<a%uPb0Vso#&r1KWZBoS-BoXx|0>5im&tcL5vXm+3F!C9Xr&b#Vh(GpNMjBSMl~>$ zlkyTR5G?cw(ld`rI(!kOErgu309j&fh-4V5>g{-Ui=m==yv?ZN7V{=EAyeRBktZ*g zQgX^@UP%Lt4eYdEi;I((cB=!qv>7=f%QJIHB^PM2If|fl+Ufy0@)jv~x*I}chw0|b zw2pR{p%Z#J!I70eNa&xxhB!h}n)3*IK#r*A0?9IXC$f0eL2iTgNT5$lp3x|D zxkvyKNgDQlY8bUcPJHPGwsLTw<|F!q!&WLU^vtnUlHK=7J;-yaiV0<` z__k6=pZ)rOm|96hXfL~Y*wfAbpFmg?KYyZvh15QZRK6+BG+y2%d^Ez0`|_Oq+g}fh z&lEnyGQegJax1Pf{Q5O5?GQ&#)`n&z2}TVM3%dq6Dw&%kRKz4bb3sgxL3e%k~%)TL#0&Cd?V>sSKT#bek-NGcvK*Rt~JY(XzhCFsk+oz!9 ziqaVzaY-Nj;e`mZ#Lwyk#OZ!`iMZP*xW4$v4UZJVV5PZ#-;o!9%3M55^~dar@SkHx z`#STD_9&agl(VpqQ)pQwUJ-Z`W3`B}*z49#sy8hi){W#T)QmW++Wf?y3NickZ99-9 zvB;*fb8ZI(zwpD0j?n-BVm7xf=V6ZJEpZpqtS?A7 zrc)!wQr!hvBmG3AM6Eyst9&Rms8!rhj6OTN|&?3<6MahAK;l z*lL^4wh!e&|Hp+DpC=apKj3f=*k{GX)Z;#$g>Z(0 zXG9Y0OdTp0oKs;7g81TImPdc+E++A)Z~#&ryouZdI~A;2$-;?P^Jsg#NleD#R0FVl z*qnkzm1)dx|HA^>`gIvm=F!J{(b#Vp)~CdkXQ9lwJQc@!mh*#l(dW?wKBcW7u#a+> zj-Thg4xHNrz|Nv^1HUnW+ZY9_F-4O5^UKH!ww(jmEzU_wNd>*;K&2b)VI2LaW-&Rk za9mVDZL_4nBduH&*0~ysagtJ!*Vs)5S>|TTr%A`$B)6L^!UfGvhr^L@U*CKSdRb7j zW%lX5x^kx|DgymP^;jb>0~e#h5DNTTn7zVWxaPC-r9epDCS-;0UE^ZRmy!^{1GEiN z3{dcG_Q+d7kA=&<4!KOsyuR!4=-@8Lbx8Jv5`auHa&{>DK}G_F zU$cCG4D#L-g|i&-;!UB6XP`B-*7@9Q8fr%+J;w_JUW}C@%qk13l#LL%vINKN1ksF( z;aGjfLh1H9620`^j5zB_vN!yZA{WmsNjpf5r{{DOAuet9@wRSTIUfR1L|$&B-Nzf| zw)Cc)y;ebL_7=)KtGmvVtF$+6uv=@3XT}cLZl+N1hhMe*JnwCDiMgEA-#2OP4A0|R z%oob3r1hIbrXQ}FIgD0(qgVXB{*rrm=s5lZ6-wuF+Qg>HxjEj+JZ~ON&*Bla90X}Q zzm!VFb$CEePtG?AaXHDEWcAwx*qWJa^K9fck9@rR?H?r9&LxX4EITE8 z0tcBqpnOn#q#J&OOPB3Gk1|2b-M;j^fczPI%v~d)0WYI@AeW>y;Im)wOZ=7V&|D>D zkiUK#sn+hmK3#|x=@5$5DBs069GolDLvWE;h(owFt17IAqx5pu-$8C^IF{u;mD76J z10#FY?)3_&M9Tz(MBF@sseXEBHsZoPj)cT>rBs0+j&1$>g8(VLIMe=97QT+Z z@PL@9&8NZu+GzInD{eha*tX+uySO%NKbn#YNJH;7l>d{I=mM~W3EU2tx3##s`n;%x*ySx)o;J90i~|3IMsyGRN>5_<1i4Kr@XLAWACD|iq}oh z0%rSDQaQ=<0s1VSuVc8P4{)$S?gUx z;huO{4m8n7RgUWk1i+Td5yZMqD8Ky8W_y%0I}{bl!^-!Fp%gcsS(SMo`K@$=`w)WI zRntss`3{Y}K%pn!g63Ou{pX>1n4XtamJf!T#3y^s`-MkzOj_F6j{m$UJg*>GP9j+2 zRCd4{=Cb)dp`8nl>j<&i&LywLvFI@5Fm<~9RSn3O=n1>%aeqkB;;@+*e!(;Ba$o50 zvnr&~tDD?8{_#2Z*B`6t{U6N1MG+F+($2AGvQ9VKR)swcH?Oy}pf}k8?Iid#Vh;Dd z;AnqAnX2~lxk%bgzQe;LMB{Eb_WC!u=#`_@f!#EaQ*>bX+w2tSkz zu>va(3J>EAUnjKK)cbQUUSAqDvp#xvOEH3)TXVUsR{Dl&i8zkN$iDiO)cl-uldl23 z7k_ykLD3H0P0PA{DgC?Rb+w|!O|y~h8VwT@nSDR`cRd-!(pSc>sic-?KK z2!-tZEkzoQ|8(eAZaLxIm9P)_CCBP&=KZmAYVIQ=AGkEG$6@=jmPl@X795V1)d1xo z;ZOx#tyEts%+>?lcRW;2vp0cq7aWl-W<>M%S|%;>;F%!uK1DgutrNM&*ayY3a?wkb zba!v9GeTJ_V-6b^Akr)v%ScAr$E+QPL0`ZY#5YS&g>mTd<=#PWw?^(f8n-QvHzP83 z!cStVV*4)_&IWkk{nJU<-(cB%kJHDJvuW9+-J-4mps3!2-qP*d+|>jFOq0+PFCO0*R_yB`U@l~6_Rak|AjJ2AQV5;k-?%i zKm~D;OaY^%MC4*CNkgWl(g~14J=KUK;+Ps({}yVjm4 zN(|r*v!|ZFNn%P^nyIrzd3c9t4MweDH0=F#304^>GuP&d5~!MnYj3mtd4<$0-#{p2 zdUH2o+W<=cr5I4ES(6%@n_FC=u9(xTr(kjq+qfMB5rEw}?0Kr8XTJ6Jp_1KZ{~H=r z3G;!F|7k6?oHPv&3-r!$xlUOLBT=Pkih>7aLE_R1fr4 zqgo4`X6>eqWu)C&fY2Ig$J(u9*o-)RK*fc(lxZr3rOfeytd`G*R4A{*w-b|=BPg~x z+Bx+*!#fKrIifYcK7;kDAUe*Q1FodNVZ=k21n1NB%}!yAbD@| zeWP#e#@DD3+{$}%RcvT`RKi$eEz!UCM=p5azdieLDEP!?shPfc2VuvUg)dh)R*=E= z>CR`qn#7W>R^!2s{d0`-=Se;3n>mJAzxBsj6h#c@LKzYdCpR-5GtS2%nxD@#vvcgv zB3nk5k8Vj*eQUdSFEO5b5gR|y-~aZ9R2tJoBF(|7t$jh*35-7cG)_tiPXHksub3z5 zH4c)*sF8emL&IkcqWsy;l#$ty03a|vwkDz7I`>?ZP173Oi8|fWU65|BSy-`$aZKQ8 z(94z6dLHjA+D$e$yE{%b5L!10bQ!|qXd>4?7PW(Jfr_hef{=*bN6U(t z(nJ=+DW2%+IJGk9i3P=ZyA8PoyyAj?C`?2$hf&JXFG2= zmZNv0-)8rBreM7B{2yd|{7MAn<%@40TP$M24@xZ<^%d32@<1#$AKj506GRL>qpPSu zKjjB`gRNg<-IsX@FJDGv`I!_lg@YeRI!vD%qwG;w_I?S3X-^ ztd0+QJVoOCJa*fU0J7xhf5xLASamt^+shJa#J=kG>KJBxHmiS5=-^GJK;8NiFZC-4 zFP+$`V(3U5i@3VAu_W~V{O(E!*()lufmJFzG?m=vwHiy{lnfXE!`FhS#7kF?vV0f!~fhU5K`C~QRu{h<|OE~^yocAYpCY4JO-k1-eQxV?z zP|`lJi1H*#bAL6VZq0F1(L-=`dc^t`b|gT=lp=@#hz;*%qa^hQOLR#E75!r?pDz$PT#rkXhfWV+Z4`bcM4Py^ z-&iFk2e^RK?Kd1bmILsqgOP*mGVPrfMBUt&Vf0~-y1@OEH~O8JL7?;`?EaVmIYsh{ovi$MY3ruSJ61run-1;&sYJszmD{A?&-L=6R~Xv?~fl1R_klCZW-Fw5&N~4PecP(9$D9#jRzm4iL%uu5$1AnE6IEhz*K!VRK;s` zCG(FuZqI(4^h%kZ24ue6oY3gLO#i_U#KRt|eXH&%G#a1(xRVPRAxPsywqW<(ER|Fi za00nNT~lDNVPqvlHC}2g{hv*WNRlcth3cyyRK@=8lamV_Ml2$eYFV9$)%(95={S*; zUnYWkIdHQYz-6#L+j${9IGQQug9A08w)?T- ztDD9yVO>%>FWtJlW2qg~RE&N0_`wk~pK{kAnHasB?UWv;n`48pPImH9m> zM$eUTGCx=c9L5|SNcg|%t`={iY8d)-O zc_dbnL=f^TKWr^vagS@^=!OQamj>>xNX(xmKo!GX*-muRu(Vjy0CCqU_NbfEp*7n7)F_lZFZgzQBfEqpGn8>w;0mvFqKJ#r61J|x z_*y5g7kit$@)Zm|mId2%$bfQHyzALYzRXbI2D7@TlhY)21~4LqR+1YVGu|%JpDgQ% zw)q2q)2K0g(>6sj7y{PAM)qrOdzpaYa^b+`0WdI)>cU-6lPA$gULkvGDZbHv$iyYb zOC~9qk|jni4hVbM#dX2p{X9MPa{@^Uh%4vkANY(9UranNZZ4$VK_M~m?#W=S9;y97c;(G7wPw(SsIFa(pCb+B5FiznS_2su=5;Bw4 zAWB8kNwVsvKHJ6DbF;@J&UM?u%S+Vn%{J$vxlqRHZRWdtzKJiWN?9rf&~5tkhosZr zmVlHE3>tg3y71yya_+~pKKXXeUoutsw9w|V^!}Z*n)QsOAJEF4wVlu9@}iqY`^mQy zUXqwrG+Y{Z{An9&JpG#XJf0hsK+#Sq%zpQbOmRE&!5CeH$o^$) z97t39Sp}zurn32V{sY!a7|C$Ll;th~r`@pd8n1m{(`CrwLeCh9D6|?+{I18#rAA>z z;No}+8ShVCVI0Z3y_Zm^<3usLFt703?K4Fhr$M_X;?|4Tm)T;0vo8*Q6B&Jr;eIH4 ze%3MXQ-7uTH&-?a`b%1kR$WO!J&OcioxCpMul!M4p!XfXi(jV%IX2P7maKls5oE*W=-&0ugGc{!q zY>XP`5Q_N zU9nIQRepDV^R~y(zF6deY`Q}gBC=Sa0_34St*_dod$EX8qlt9K-b0ihnfI>}XA_tg z&YQvVP*~#olcFyl0FN)t9Th)vz4~#$DsQR!anP|pK&4}8b1QEvQcj9W_I7_ewioy= zA~OMlU1qc2D0S}@B{;ZC)=$(Oe^?mclEdQEnwDfNnC6GV-Z^=?ZkEx_@hQy}T^tuh zEMe@O1cw)H6v@xdq#yYMtBBn_k}~W;P+2d&6gowcZJJ7SRhQG*CQ+Ox;y-XKBWG9^ z63Abx$A5qs{0#S+%}lL0DBEpm?S|OCeiT0XvY#aXYtn#@Rre((fG1r?A6oxU$nN^g zlB-MiZSiA=yJG#GQ)fu)!_NIjr3Yez*KOrRHzAiB`?;~OqM9{cZFNqMr^iLdX2)LN z-`^e&$D*_fPKMu-@jm-pX(^A6eH~$_04Xu9@Lm3tjILz<(Re;N@g}axV7SBT0aE1j zRC3TfRU<9<@uWRBi@Udqj^@io?Sv~mn;w_e;0)+@#$L|I#XT>sVQjr&>}d1DM7p?! z{ueCV@M3hPiV6eBc4u&yxg8Pa31w0NMwezk<22{*)KiZb@EG6WPX_W_BddvSM^c`P zw6k?IkI_+`i>-Pwh`nWw>+&_pUb&EXhnD(vjj7kKtK-K|0@5#A13nZT%(+W61f)E3 z8L=vn3d20DVPtc^a6crC)~Fr-RLv(T%k@>-;mcRd@y;|f^6f7k`*_-7Ka?{k#6duB zRF|sN*LF*SDIc=V&h}U}w@o4V#UlU7_VmwnQ@pgJ$J4V{ztIYP z5uCrbamB!6a{u_Q;a-C>yTIxpc*j{A&yL^eaOE{6QY4KtpuBP%vI6R8D5mqbjBvM2l>>^P$k3-C7zhH0d!?S=#?9D(TC5JCxL$?4$X^cFJ2DuXZSIZF{VkcR|Z>CKE z76e_lCQuB%FR-20mo)P<4@;TUc@3kXL#5WI{m)3=Q%>RNBe8+|6-^q;D$U$z09t$6 ztM~B9r%czUn8DzI{ov7ugG2^`z1QcBLAp8R0Qe4`vq6?$r#{0M$g9FWff=1WSgTmb z=w#nxV)mIChzX3o-dNp*wn(X3zZsaa+ z+e%!@N&Q2^S*go^Q7FAJ{~OxT>}@mg<|O(mSmUw+|9KzWmJYIZ*v_PMb$DvvzSp*O z?6`P|+*2S&;JZzGDoGBN+zRFWRAV;j{CQi#V$Jgrt#1VF?FXM*=gSgej-Q!^27WJI zpGi2(p1#N6q0KO&acZHD=>(#6Bv1q-Hu!Fg9$8Ru9rV~Q%nryAHm}8ZtKpAktGj7c z9i`5#P?Z^yH?6mR`m24Qe{$WMbJVshc(T|XHvdp`pVCive`dNDBKZDl@#);q;s&a# zIqr^E=1lzHyY226>q6cm1nxqVbo%_8S*Zwfcp1?nBQYl5^~M( z)!}QV;nNV2{g9)XZ?|(ly6Cpc;76Tj$GyEmtnOcVpXobi2%grsA8et1GBj0w;?SNa z#&zB_*sh}z+A9Sxl5QIchwY~G$RWlI6?Zi@=IWpv_Ce1dIhZ59VMEc5jaqAo(Hf4B zQbywi<&{X~1-i?eWCh}D`F0pCh(689=c(6ri9dXuVv6ZYM>&Oh;@ zzqYQE_u*ZsfIb0)kn`D1v}vP3UL5C6L-^9{*dxj=h?X^Zd?~XXy)G)Xl28u0J_h?G zP8`T-EmdmSlAnJ+XhHac>lx?E+KoJBhNqR0s>}M^i}{c!XSBja-XJGCpLutL_|=!B zicbbv%n*q0!sG&^C}hhK+AUU?Y^KP}{p!DzF5F_W2<34cS}6POF~a&JafAn6Aw+h`H!jS!o`YmTDPs|M`u%P9e4A>1pUM7c~h@vcPakopD7x(AZFd% z9lwjC4y7Hcx*Y*;WA=%WVQd(6w5}lKe&Qd6=Z1cQ$p_qTDuro8+rv(;Na*>|RBjNv z4Unzzlc_g)B_dO$Y<9R4)TeJED4!1TppF||u_}~oWWP7jPP+Pc5N9);N^3AMj4Dk- z*Sj~+!&tPy>tAd6sU@!4+6@pka#SYL4`e|O8v0q{`q>~el!~-rdxQ}Ij5<0N+2V}S zK+&3@iV9k?y`55_c%KqGZnyrPm zK)~Hp?Y1-?7*#=~DmZ5e(=sgMo}7X(A%D&W-~g{AMUN^7Z`USVooRRha80djN8OMQ z#wz#|AoGR8l#6#?$)Kf}FPNBN*Rvqw8BPUb{BKG;Htpf&m8k;-f#zp!R;2l|(Ph&! zKc2!m&XIfx88qZmwxkj`g}BmKS@CYZ%A~I`*6;<@SPn#G2T?-vbqc~%$09V4&a@G& zeu5Bhd~HS5rnLaIvORK zZ8CB^f&IoxZG*N{i&eBZTMPMybh}h1d`$0a&wtYL9#N}!Q$^!&eC06feH zCyf4cSxZ#$``KW_sBr=DoH$VrI;sw!h_i9^Ct*F*8n1D?UbsX{C#LRwpLM0bFhlmI zE3IjCLuRO6&t2io@fraI=IP3EklPy2{Pd|~#}y$Evw)?czL%{sV4K3Istrs)jhB^K z9ukY!BcxFj!i8$|mWxZa25L@2;aVB@@A;YM>W3+v9R)QI*{IT9ZbU@2?28=U+*mGm&r08gL-OmhL!IVnhKXl}qn-swG zkl`T{1BW%nBjEr7)SiAl{m@z!iHzg~iMC`;q(^QL8g^78R<$AJdkn-m3wS;!T|Phf zlC_9G*h&=y+4)8i0aa##Eb!%t5>j6^X?z&`_z!s**)1z7;Nxs3Y;^HI4e!Hth^E3< zn7KQu1%(_gCS;uP@C#!1!;a%+VvyvW@peMJSJjw(iYLCJKm8pu&bG zrkdvo?$xFg#9#fS}P2tf3PlA8zA;7&B_`$q($*GA)J-`L#7e|WV&lTm3=e}2G{Pj zgFG*eA&gN?#lnW&00%GOwWyT$kn2(%N)r?*{;Jk6Js%S@Hk=eYK4B(LPR8uumtU2M z0Ib6j>p^vuV^$PP`iOc{L~Ay55!&B-x^j_bD|^TlWf_ij&r;A@IAyYBM;MNk0OMyg z3D$34s2cq)nK-ihiJRO;6#E>1*;NWf*K5UX;>PJ`0XZxEO%x)xD}1Bh_>oj$ox5Sm zsjUEkayj|{@>Kc#1C25{)*m9JBa=sF^)k4%T-3(r{GOy-zXq0k&XiEu6@jCMnLIWg zadIi>Y}8l}n7l*Vo0<~uZBg%|GJsI3CtL`1PzHR1_ix-YL&=Zg&C&*blj_5cz2IR_ zF<2OLzhFHse)jG-Kwi0mr)PY*0;Hg#FM&yAt-lT}iy1|98}56cJuj&g(R+{Nt>YXdaTdiDv4>gs1ZLFB)rwSy5i(|}DnLQ#Y zS2%F8fkE3&o-+%47`!zN5v&kRvhf6XgAr2-UoP#hWdNyQ^_`7icn^B2Lsat@f^Habi<)$|16*_6plrm955u^G<{|06%m(`7}V}$=M zX5{4==;h0E#!KnHk$=l-h+yXXk z8!AIbDwLUb{)DuYFhMG6*5qcMFY-g=MbuGiIGl$1k~kd-6AQcY4SiV`<{hHI!RdY2 z1m@=@>xCr$$V;r71DUydK%484PkYL}3vNk}cp;SBnC)}s??x|3njI=4xMe7WZxp~F z-5yH5*ij^DQw~%|Z1xWmx@d|=D1QQGpAlN)L9G3-`+SR!KngJ?)O(CRx?pvdXkAjq z3LAg86;facmULd@410M_)Y$AH9&cok#HJouM^>M-<&ct z@(|=jMXgB0uwa9XzM4m-V!8e3digC=E z-^>Wyt<L)$$jZ42*;i*mQ;7unua%-H_D1A8TLZP!E%l6bW5h|H`d}blQYs{Hw?>=2pyY z_8MkbNxabxps)};==m!>Z|&S%Rj;kU2kkFRUp#`ior_r)>duyH9h>H~vuQ=(+NFer zkG%M6;R3kY)(L%Fc8J~t=9|K<8(4- z;iYnoGUIldH?nghEs0y-$gy6bZ#O4R4o!shdEG=A4t~&;elOb%dlSAcwr3mFQf;wI zls!z2C&{x;fxve>D5upu&u3;;Qp>`Yw$_Qu-M#+RuT<<=o zF{R~)Sf|*uZcxP`+J01D5_k>~gvnF^XGHMJ$)~ayo35@%LRkjO$WX^RmhcZS5Va=` z6HbzgnnSI#ve{kaQcIs7wbHv!4_}I=u9QtuNp-*xrip#L93Dc7$@r0%Gd`z-nVQmh z2X@d@_9p6rD#malT?B?>`|ZBwnu|Pj-APFQ`<~f=wUP)x3T+4kFFKJGs$-3`#DhXv zF$1J*!t)XzMDerbpQKb!SJ3`l58za81O{i5k+hGn!U#Tj`(O}H&4rHQA$Y6s!3>`K zBoB#$|BVt~j9CvyUqVNnW&8ad)^HNeICrExu!#6Ds{xMvblYjb5S?L|M(})sPRZQl zoKiB(ACq^0leVX;A`Fkgom_!(3?>y?;x4N-)GgEl_{~ybxNl3a6ZRIZ+d;)FgljDU zlfTLKA%e82FP~VKePw2bGCES{I~Rx=;N;_!^V~}Qb4QHgAzg{@0cG^+JLNL`sBDV7 z2N<1Oa@a9~T~=%UNQs?HhMf$d!8?}!3v;{@v|yI3!z4E=`;;|qq3wmV+pnibu*`B# z91TkKPuuH4?bz6<9_g_OC}>>6Caiuxwz+Hryq1QNRHzIFrM6tY_!+IZ{2CRlDaZcS z6$?UfV#8#T)Y0N4Af1i_VE+Js%mk322xzVm#h>Y&b7SuZO*PoD^Tht}Rhc73LopaE z@azO9GGIR*JYXlcx_eU90}4!qTN+n+WYE;`dUvWFjR7513jvUY)85p@xn!Krjg8u> zm4m>gvIvgJs5%i{PcZS6a#dXR`>zNPijY3Ee+j0WXdC3PYHby?m2#k!p;Dg+X3|x! z-t6TAXn~EV9c6yFuwMhduaU_8?X=2)#UT@1u4Q^LCG?mJ!d_ttm~U6^Bae3qE2l0I z5GKkB>I44F(a*{bf(k}c+D`6>VF@;vb+Z(!HPFI)!cDxImu8Nbk1UImd$K`uYb#TH zeAq_XRfd_wE*JFSn$4mjSv<$ zZ51l3UkmWYC-_k^eV8CSm1L(O+_KKwnGo9d85i^zn>OL$C{dEgTIU_5EeY%9a}|N5 zTwWq|5GI3B_k`32HN^hO=n|9*2PC~kDxyrxvs{`CmP>1|P! z_oO2%#@_G6pDqbZTLoQMMF91VT{& zjR?G;K{tA+F?rx>R=P?PWpPlVR1Ois0ylP;WP6TITLJW@?mB&=V;F0Z;~QN#Jg%Yg zzVm`4&pc2mHjPq&4qto8@!WupC>=_$m%B;|n(Tg(dZ(h2u{<=*cuPbD&b_8S7}@y% zd801^msi-xZ&0y&l9|vfJ70oM)q# zc>k*f=ocxh)tFb774$u)FWo1)=b+coj|G?+rumPoW;mo35e0Z-wdO@U8AS%`|3u5m z0j&qbK9e?NF~9t*A&HX52sGojI=%E~>E+Pp#CfWrjekW#=qoqCmAp>HT@H!wx+x`< zP%|D~+en=8yzu;n)G$f=u=6{4^Ok58%!)CZtl__N18sKa8%w%uZo&WFK>`QN#wBGi zWik_WGIN}RU-+PAtBw^#uEHHSlti#C_>BnWQ4qjtgvy(o@#G~M(#0fvqQKFu8N5Vt zgByJ>Q-`?~q-S7;ER7j_Qx^^P4is|7?nWg=ftAstx*!pG4zu{VCq4~L{9BC#*X;4q zvM-3RW^ZmEpvfNvaM0^gPHsb2Uyq%P(&0B^1L4@@i9ST+PW^;~h9p|l6Pm<`9A@S@ zeG|G=Au~yj7(v0V-k9%GyB{d|BMHkB^Pnx^DSd%ki972L7}B^>6ttrS@aaET6r~}t z(0yynbk z1)Q3B^Ri~p3m9(?I+g{wOvc)JXMC*_DORV~Ey+f6Q(kdV8mn&9RToqKHyVONqBbfb z^2zy*h27~~w+o#FOM`ETGcY z*j{5P6~$CWJ)f2lKzJ-Fyskl67*K{dWV&&^@DGtviO(e*B}+L>^S}fy9urj=3ADy$ z&P!wt=r$uO)9tyNF8_v-)_jDUT6YNcZiLCd)Z*US2e6^U88LvE!B^e)7tT*B7kT4i zYTzF+B3FoKr(@zAZ!RL^2~e4H6fux;In=_+W|*wVp6>>OB_P!X&5q{XZYFAbR2}&~ z0gyVE;UUtdUdErf@(g?*+7L-4S)nxVy}u2uuw0c&C)9*wotjP&gQ3=SQ}BIMhrBRW z66^TApVQM-IvuAW@2M5-Yhet88x|Y^m*nB+j4sR0MQeb8Pyr!RkE{(%X5DDcGUO2(@HD&NnK}ImhgcpTin~-N1wWJ2MuI&c=LKUL)w!PCT1c! zn>Vz^8YLJ#z&Vw)?=%nx*?O+-7YPo}LNpfH0xLm;e}fpp zH0*gqQUTHfcSx0(Nz$BT0%O;WJrB2dWnnBe{cTw+`Lhaue=)^!#_E)q4>JUv^H~KH zV$VjIQX1bggjG_EJ@hMeuC)rR_XPHNiALh$nVLE%WS9vKrZF70l51N=8~im_>OZjw zeu<@G=-G7_aSPt7J~4t{{Hh`17z(0KWz|K)S)Rl0P`+M7d2I@Dczi+e;w8@7q|o5%HOCQsb+4oKcKb@>Dn4=4qG zZM}9LpJA8W+Fa4g7FBDbf{ARQ-J=Y!qwOujx!#7M{Bj9bY19Q7MmZ4qVJ=`0FOU|z zw6N&?2KLJY17pA2G4f=vNt$6Qnm!QbVi@IIfY98G3Kh%aK{R7Q9BP;XfNmxA@JW$b zbjowhaIlkD8@)cGZX8n=2dN^s*NoFWlHqFGfMpZ;JTvy>w8oHrPA_Q`P6P?TN)vFE@pJcuW)#i(Id@8l3FbIP6PoKn2Bga5ccJ+sgVwn=+pVVWEyjx9kG1Xwq_bU}?Om4iAQ5dMCzU)4?4QJmL*rz`i>`EPGbYf-=shRjg- zMv)iN71gWlaz_lwiqy=?R~4jb@P1P*@54Y2S*86!9&H?dQe_Vc$a{< ztWeZmUI2Z73??e}k!EE)Gic~aOGR}=$v+}@2o{$CdpA<|?E)BB#ae5R6$NA`AJQb& zovx5`8u}El58rp7Fg{E!?`qn;WWQ}mHy@J%WFwBHW-+XHaJf>Y#UdJ1R?E5+JQF>% zx87ao>iR+@nSUn+2U4UjEJ?jI;N?2CxD7gVphH`3*#8#4w*WJso?=J?m)>k`l#+`8 z9uO0UCU9rU3cUM#3=>@@>%33k>Kr)yhy;>(XL**Y?qykjYvSu#q2I^HujLiH?31?N z7`EMh!APDde{a$1jM$$-hCZ&akeUJj*JE?Hhc%t z2vln@QIZJuWMHY7ndm^{uai&GsRa?xgP9Jd_5*o4~3K$VLu`d3891lC{XbSL>%T? zzuId>jN~4?3Ek;RDgS(y;!sOvZ5_WdbfY7>Ci#Yik_|C~`aj;ty@M;Gg^Nx?L>1wh z6U&s5LUM;cnvOs;&H8CltD0A{cgN`cH8&J7;~%n!e2^0bv5ujAwGg0^J{x4t$G-Rt zr2N*0+MI8^AD^QMrMZ5$$!#S$%y?s~xve{4uS?>|%yVCiJ)8D$FfT8+WuAYyKiedq z7P+V$UX*dtwuJ-Qjz3H+9`b$+Q+vd;mkSka9B{=>t0c{?fp1n0)4V)lqwpb#~P?ekI*a6>En&5<|Nz=ZCJ}Y(h1k#8`ob`Db6_#hogIr?l=0 z*E`FBvIAbqOP0FD0CIeGHu2q%3vco^zo}m5h3^?b3?{Y0YXTLn2K(ibt!F?6?in<%(3wg3>H{@{U5bYMOoJGEf)>AD0t z1-Zh6Lj3WydWh+KVoMO$Sqk~$aq{;}Yf zO>YiE{;F#`B9M$_Lsw*?%gIC}CT6~N1 zR9)?(+-~qr$|r~Nt`pjzOJQXee6mjS5P)ADCSr~nBsXjHHp#AV*5UI%d2yJ>%sRz; z41Tm=wDewk7fjeeDZ5$!bL&ON*eaHIZY})H;vfTM*G3rNZTAIu2IHR@oyck%*6tzsYep=aFgL@ zr!Z3UaH9A__K#PZe~*3?RThgot1&yjEF-yH{102oI2=i|OhZPe1h5k1rt(o3Wu%h) zP?FUVGxh=aTlbYpWG=^KXfE_6>Sr^r)q~f2nS@`qLdp|wsc0)d!vQTk75^eM z)uxg~ilxAUFC;Fep!B^AmX%5Oe0%Xmds&byv}f4;UqW7FK%NROs8@67101EB?*47Sct;IClpS z1a?rjI5<84WK`=;k=O;VojW6!9EhCAH7o-2(LTl`Sjrm>PAXtwH$V;#lBYTN{osGH zViw}g3@P;5pni?Axj(1h-ZTo;^TBwb-2|HGyDDwW>&1iy#zF<0KP^#p&qz=yY(taO zt;XzxMBDI=1eU0+Uh^1Y`)bstm&ah@b6jJ$TuVgUhKxxH_-Bga2b0I@z;MmM)|H*Q zV>y(t=^u!>5-EiPtSk^eS9-iF({eS8xGkk=Cl`B9R&phw2fgDVJRieIT+)S%d3WV| z9u8(LJ{x0boRt>ZmZbx@vNh54(i1)3B$l^8%v>VXMNtkj3`i@&Zt%t03r79S|N6pt zV{M{FC7=t4U7e{<-;xw8JLKmp-#?I9u<|C_0a&7CLpih16_3;nY zejAXN+%3&n&V{^!`PF$rM<&y?|qbvkfLcb_ewPh(Wn=H`)z~g37a_ zS;@z^BH48SJ9RC#s)F)+0p0bP7I+zQrv)$>WvXpCTH8>>fH$DQ+1&aZ>SX)J`yNv% z`+om}6%t5BOM)&Ml!y_~cIp(@ku+0M^H%F>0Vl$ICJ7uZ-aCXUh-Zh1JzZgirSj?p z$-ye6Bj9$3bl`eM7th}&n)D3|%IX<4rS=`Cd_)yYxq(6t8vhP%<{6lXm}Zymc*N0|4?X><*VHAp>?dvW!Tv zH9=)1#-+-bgutbgbnJ^}4hvruhl4~PC>*)xiD`n}$qcBf-y?WkO7jBSj1L^To>G&e zdz>3BZ^2w{(jGgLw=4Ed`Noz_!t>?0Y0ro1AN~)q%AR%A?G@YX-C1XDdsgF8=-m~p z?aZ*aaOxx6B+O5>wBz;8+WRFxFPK}cT@jtcjf?cYkln}35dx_ z&_1S8eAneveK{Ia@-{OWvke$Xhxzi89d2IIdh-5g;S$fj-10YbH0M~linO*#rfqND zleJ0`&;%7EDe1U=uFQ33CmUXVO%i~I$Ff8I{XQeeX7J01qt3ELfaaJE+kC|zj0ZEB za&%^}5cP;-SsU!+;^93~zCtNK$T1U`ZaN4_GqoR7!v3IQuZ$x@; zz$PDE;`=E)vs>#2s7r8lj)R1Su`c4OQeY7v&y-Hr5#!f!pC`-^Q%PH5jMxdUtF822 zXN&a;%Yw@uG)2l-VOGsVQsQwmD){w%bjS(RUA8MMHWTP`QvZ1RSAj-wM03ieTG^A0 znv2#Exy1U87O^FHRUxE5d6O%xDqtGwQ?l#~e=8i<=LLhQ{Ct|(*9@<|kKV@@|(SX(uAzmT{%H=XhW`AH5aB@II;+-A8 z!&(8B9^FHYobw{vkl?wC7H%S-Xg?7oOhEn6W*&aBK9Q%^uKM?W(3|5!VlZr-sc#4! zrD@0Nc<2q1n08rMHS=C=le(RQ^)Zi=MFWg<@Zw*TNIJ< zNcbzJxhE=qe`7_8b~8xNAabqb5m%#s$mSt-62#s_K9*}sn%SVshPJ7^NhVVBsM3ly z7`tzzGh!K*XXfhk z%+53`#GYvXqCMKAQi3C*Bt4p$dgK|Pws79TovHE$M*&vYbpL9=4;WtBjl2;ZWK-N7 zup?*UGnXW=QaYE-^@#{pO6*io%VBra23L|qH?^u#o!gKia_|GWO|Ef$(?{Mr>W>dGY59{SJDh!f}ePr zsjhET%3g}x-1QylL>skTJ9=~pQ2lY1YP|tlV&6VrguSwAW3Jo?=)N}f^$RLxG)cPE zHHXtfvNxVFtzLXl^{#Nns`@?#9A?9TJ#)bK2yj#^!4_K0dC%haIk?ll;c)YhxMn;q z>uF}(dgZxwm-E#laX;?z4V-L^@(%1;_cyO-=k!B%eVi^RCC4>8fHjbT!Z+t~4JBO9 zhVbCxTz6_Q1@??6V!=i&BvBSyH~TaAf@(ZD8t&X++IJ4-I^;(^xUg>a6j3gT={hHA zYGa#GSW79c5bU_}ajWUYO57WlKtSF6p{}5(R$QI7bDoBACY^0b!09>3x~D)utbT)o zwOxlCKKJ>TRm(wR*Zvd?N4H~sW04NO=f86rrT(MaXTQnyB4C-+aYNZjvn_DJO@B5N zJ5DWOMx02IZY<>@^H4}1?$fL2oU*@2@edf=JC#rDF|Q+n`a@yvbD;*puz6@75xFT} z{K5~7HVDrGg!N~kLTlV{!F{o)+nx%&Vo3%Z(ha8snZ}>k-CQ=5)#hT&xL!!Mq$tF3D0nC@v&Ww*ntIK8h8<>9su#e-9UeWq9mlYbQ zsC~*K9-1P`d$}^3v+d=m$W@d?V2uW-2q6<-4bYi#eDjA!)~Q-x4Xx%T6<3T|#YFdu z&c=3D2^ET}OF=ExBEZilsj5W8yj?kngG63T9ywOVu!7Eu_(&88XaAx3_XUH|D9Xo% zC=9Xd(G*>1c`@+pq39N)+#JplL>=2`rND!%rQJK8Z`No9$*BaC%W8Na_SKLOzsAWQ@yF@| zO(Q$kSc({oSSiPmkg^&PPzj$5ASG$%zBJwJqz|=!x+Ct|LvU2AS1b-3A`fm92PO|w zHA{f&8^@=6=E};nsaJ?*Jf6hCyd{vv-RH12qXCvD^o42Cpc_-{WbiIL&w=J#ku+12zlucTsurz^+1o?KDSs{qX^dbyx|f#&jy0$bp~q z3e+=~1 z#wRED5&wpkRfZz*ylwIoFrU)S7g2pjdUt=aY#aH6ezD3GK3XB!AJG>?t|;;OfbrA( z29IN+_ByHw(3#Vl#bQju(y|a;7|5~??xWG(mfS;aB(c6OSc6>3v7NgsSV#HLc{-MV z1Rjor$kcD6!gN^8CcNOeRr1|Ew4o>~+uTT11l;WkR2ecj<#f8IZm@K+s^0ywQ+K!5 zx+iSs^_DcOD6iHj%C5Vane%Ti!aj=C8oYE_B&vg~kK5la-jdG>qvu&Se82JO* z&GqM+u3I=kP{bs^If0q}GAyis3(?J9&4|E-x@;|Bz5nzlA?Q=}9lv%^jm6kuuLVnG z{3si z{NX<@?nM6WfBrvDLAy`>FEZetP~v}1z5@TR;{QKq{re)%hw|kAaUE`0|7HOH7FPf7 zD?AN^#w!2kfq&k3T<~96`Tzb+GxGoc7rl?@$m7;teZSKW^+Z0t=be4==zqWvvkOIV zq}#7k&s{wuYW!VA1uuoMWPMIvMV4RqS-wAIbhLbYVF3kzvZ_a!M;DA#duwBDzfzGy zI~A$$4)PijP(Jv%wGReJvfv*pB@h32?a+5()s!w|x3~9{x}g}<@$_(E>CoiU6aBXBcIY9t zvZI<#dqzQ*Qy&OmjOxg%;4s$SK@PGU#=HM?6X#HN3b-RYUTCAY)O4@pgu1Lt@KC5e zl?$>z&u$>uk~F4rZQHF2B-H#YC>d87emSk(JN5mtaNqXk!Q2lsuR%TYqhS zK0&fk$k%m$rNv`c*4c-D0)d-yYLB(oZnf2G>sM?hkHhfS1tnk3+}U7qHj;PhF(YL9 z-gWh-wdx%T@4RmgLAYCNfOJzgH#fWCjaUU6U!S|frD9}3DI^kJce~|QI`y!2Uyq?I zDO+3HT`s7>I#!|sEkNuCx_-UgAlwj%quu=E1a#7ATCA$3(Z|3dJ&OOhAPpMBoNFhIe^$j8EF*TYxM7m5YYk#by~Zdy8RxjUFb#yL)_ zvYz^p`pLW0F*l{%w|OMneqr){ktEaOwBri8T*IM!Q5X=oBFyto|F0Gx|Modt+lJKdM9T7R7ytA$_xi>&XCYO3qrR6&XeND-8dG?m_a7f_L|KtMox@4ZG4L3#)2 zT|j!5F1_~-A)(jMOGrYJ$@_lu{btR~KUpg`E9>ra&)&~|_H)iXdxCp>E?O+N$re-K zH2xN_rg8vQ`857RHOe%2k{GOo{pM+;LAZn}dn>I~F=-SI_1u4ILg%w|zh?XlL7REc z5PV(btr$Yjh~5LDY2R35vRj!a98Z?&HezDEPis}Gjh)e^+JsGH#z53{7y5cWxDATC zcE9@WI>yLrxe`fvV*@ax#&R?jW87Q?QLpT1+j59)nDLR6H?YNeVI(_Y$W+I4 z5&J*H8WM0ZGar@a`D0=TW(6w(r*q}|QSIH4wY<~pgqgNJj?t|J<{RiOF3!=V8CPpf zlIOU22C5xE9q}ibaf?7(*9J z7DX7oW$4m4%f97|!IghI%_{$-l`~^5{Mb8a@^rGr?>MQSUG-#06FuIIPQl=R5(sI^ zcQS<1?Bnf&dF-`{(vp#!b>B9z4WwF3yvv;S>K{lj3Ui`zC12OIBpQxWLUA1!5!LB6 zy~LNYieh%UOdEvzT^0`hq)a>C5JX^+NI^#23D9zVN1w0Hh1BIo75@Xi3yKF)NY z9KvM5%tV9>5L-%xTw}-7%vO|wy;x+E$V9M4u9gvkt+y|Fj4n+A%np84DzT}m8=j9U zFab@6&>ATGM`U;j&oG9c7dlG)$4vO{+@IN=aBLBkxXaT{W3GmJNbH^TOo*g^iB>U3 z3FAom#?fYQSm82rVIF`q>&@0?B<}#vbC&$M#1+Iq_a=zPo31$*WzJLV^Hgg*j}~Gw zC3MJ6SIGrxt$N1aJT?l^Ggr0K4tesCM+wCv=hq4#zqgjpKGl;+L%XP)Rpn3cc# zx)8k-LUqY_?`H;?&Z@k1`FVU{Q5&zV7T1H^uUoWAnf z)8(7NS(WYWAXCY`-*JIL*0Wz1?Q>+dLpcR{gloz1YX962mFD7t_)f9Ho+QG0@S}%IO zFN&8Dzo4m5<+o=|VgH1B{KM}&716U;Xd?ZeETXVj@Q(TmR$CfN~e^|&ch|b;0 z`E0s=`!w^>1xN9k>zBk3)#GzND)naxWM{8w=e@RoT^BQ_sd9p6%DY2eYOzp9lJp;$ zm8+nJmO>54iTF#IZbK@>_0i(=^fJ_FnY%0&=1BTZl)R6Lh#2tI<}eitOB~pA@gG<+ zoBD1u^Kkz>Ff|Q*S+-~#^gT<-Y!bb0ogjC`MeZ{3g1?dWN*$@O&qZ#qVkTj=7yDxg zz$!QSBENSA{!@ZRg7e2@eU$HRS)?_M?*j_4654YRwk+}EqtG4+N_ z-IDkI#V0Bn5n=dTvM$Xj?mzy{{~us_qSks(x^wa(4IYQNPSIPde``ZegjdeGB+qU< zPLRPHDStQ@EmvWMn*iLKi=Lv;916ItaClCb{4eRbhA5$7k_H?n#HqW}g z1~`lp`~lUdREU9|kcfW3akqK26LzLy#XQSb%H%0+>a=unoX*vr*dI%*`(qjS2VQ)w zNh;Cg@rzN_KU|J|{{u*v)_JY9u~?6Y)dydWYCFTPP{uwhwg2?VzX=%dwG^`@U|W1X z5!^6?ja5oD^1i$>n;GH#htiMDqGZyQD1nh(@FZWf9<>b?NhnGB9b3tq)iEPHYYZOJ zQA3@RO}JCWUx3pduRpLok{oF;iu@pnHglV7%Rh%^65(S8t5C_&*p zK9HSlXlS6FdXW8K$;Rq>_HB8t_mlr%pxm5n1Phj^i~mF0%>JQmOhQl9TJfZfCqr)L zNIkoeM^L)mc@6|+q9!rX(O}v0b36UtcFHy-!uI+fiPnX=y5ai|7$}Q=hU;F%PyFo| zi(r!?oU56dq4T1RZ+$vUZ2HJPe!eEYl|g_YJGg_Hy)fGT+9X!#7Zo9RAWt1$M)cy9 z^1lTgLCEhfRjU$MV_yAZ3^}XKql_qaqY$jGChR;3(K5{$pRWq}0vR^CudAN#EP#A) z^N>{w#QfwPg|;g*NSnOKk}cp!>9q28hwYHpck7k&`@O;&4^R)eVMj=aZe2V)UYgz% z^I(s<%!>K7JfxSr6wU-4mFA(6esCL#=7#&T(SQ`CO^#7_#v4y0!h(mZF zRRgW^2}`@bMWjPq{wBrz1e#5lDZl=$zS^VeEhZ#O#TUG94+a00s2>7sD%G|>P`Slq zg>SmxJWO;;S|^d*!>fyYF2Hzct}Ius^OpByS2Nq){i|#5W6lrDMD{uVcezU5{>>EG z-ZY}|!gb^gF3Oeh9&C=(ohqU%a)XV<>aq1(cRPZmO{x-iNlxke*SSvQ5>ao21w3DY z|AcW}CZt9U9p;=3bN#A%~$q%DeKAkDsd3~o&(vFKHFC_!BM z|99&zl5_Pn=1M(#KY!}TdIaNl4VOLdzNmjYG|UACu)47t-I|`_$dG=quFEs&ePHz> z-~XxQjxbB=8-m<1vr*^BL~8krS%8)k(^eQ-W`tOKv$rMKG%|9PPkTD)|G63K5(AR! zSJ?O5;0Iqud4|duOYPZYfY%Vrmg(W%ZIc7~2)K61SaLT?tgzb7kZtBw2nbmN#H2`;T^u0PAVA{njLJ0NfgwiiyZ3cXPtV*IIWg2CLhlrq;&N- zIpq7{+ov6s1$#_G;=+F?%7O_*p>$X0!qK#rl(zDIps&Y<6LqHjyv{8saDO>^<$fUS znee%Lu58fu*Sqc8M%d?o4I{;gj>|04nFadEi8kxyPKsFi1yb_%Y}4a4YUA6>Msnvh z%Umsv0K}Mikr}H`c(1u=w#=nggcZY9a+!|o3Z7ALJEItEqF$EZh_UUcyV6_(ZGv6q zr+?1Sc7BzPF_od$8WNEY`6Md=n}LTL1ze`HTx!r#e@4Mic`-lGx6ruGJJK%rl`l1A*@;DvoAct$Z(l;Uwnz-l=$gj2TKUb#PuCY2_>AzBPj3h zaBE_1(zFg5WypnTcd@A7{Vgu4Py**;aI};2fkZXDS$O(>BAfgtdF-b`FR>e=( z#=6*FTPuq7Xxsw3AaV+FP;5u74DNy5Pn{PQpn>xs zXEoFUsI`)!eg4bbp3~5m0k#ro+f7Lt5MJkdgk1`xTVW3poQ-w{wmQPIAsO=|t9bOI zKtb;l#p8EvV3H{j=EZ0__BbpO2`pLP2G^J_yEQ(!HAil8b<`Ib1%2+iJGe%XFbY$) z-dnb_IDtZnulq?zXKVxP-Bw2ckXCoY-ghC*_ze)>gE0=gAc@83=Q^?yPmD=LRn^z& zAFi6`7GvRnIm9||$xy-s151&`TyIWFpX=?f)wSJgrbSNY?bc8jDJy7@keLnnd#^M$ z|HvJF5DYI>{)NlxLltrML_#NDU4abxflB`HJudyD04IXe4^&KyOxl{8SvtM1YAgmO zEbjXYM6K7?S=SMmkVrq`9Y-y9_2N&$ZSx)r(RCemvXlN}@z;y=1tDEQ6=Az$buEnXI#fCMGraA7zni(0}G&*tV z;pfBVERAf#gzbf2+Oj5lIO(U*_QqmbUGmUe#Pke?1(}VDqakg_bmu$ITOSMdpBftl z12@4P^$}eSW(Tr&TR`x)aF9gc-1O;qbp^5-BLxL2SIA7M>;6wqL8lTGXY_QLcmB@{ z*Y8Kn)*!zD4%kF|M<;yUb`W&8rE~hCUcfr9M(6FE_sNw}WT^OHXx4B6ucm^L$l2&q z>$?4}8%95M;>wl#UhGjYL)Ak^Hh*=sD-fNVI`J0X*4wWf()jd12a{<51c)>~q)m~8 zajkB>%<@PBTynbv2ep?2Z+rWXB=DlM0;c=7@Trw@c(byo=XR6=^&q#Ijr3D1Hwo^% z@T=1M+%+2q{!Vv`{#0E{(})um8JM@rEI0h6ce;f|G+|1oH}av zphX$`bWcqJM?)InDJ*yo9*;STeA;w0Mnx?+wRDsGkck@UaX<$2(GR0As z%lPz7L@}QelW6my3uQJ0oi5JNr=!L>v9$+3Oig=Z%*2?dpedJ+4%~(38ud17*^{#=Yuz&=azzM7B4DG!2Irpubt@~q|` zt%{&Q&gwEnCd^lP?0=}48h2P#)+Lg*2}v2~tfxwaPbI47H<0ssj`47IX5GnDbE`AnNN9 zJQL${%c>s;#38YR1Ykn88oj9$aq0x!$VrZMX9v5H(N z(zBJ^PS3G88DHv3Mt+tf03o7R7W~0cm>}NnnKp}Axeh_T0&MJ$sgJ^~++MGfXv{vV z19L1p!@Vp*qAyBsb_Gnu&)BnQuU==8p1saw2*++@{MNCu@{?$_(2;kkMm}vHbzU}( zb=*sCJ#{dw1pw)=e`>oJv{&5hk>xf{deZK`ySKv7f=IQAL$KgNu50(P?Xg4!L=>C-0drFSw`Punji8iwmw6zpYN=$pMxEYp+Y+P8NN zojXiNHmX6WN?KqcXKJd{BBovx;&*L}Y!^EXC#}TMmpyGuLpklYh+4nE?2;X!PsjXq zk5Z(O-5|Iz1OTRknjHcISFcT8<1c7dH6L5X300btRqnbt;zyC_N|K+u<3X+tn8z zryT=*NTtdsU#g0s+Qh3;IJ%hMVV26$$wq?wjs)Sf^Mi%hZOjZCg?t=Xx!bP z;e6*|ZmRR`sxvsCcdoYbxZaBQWD=QN9(~=J>AJOwl`%QLLuWi*#H@KLt|LE$vMFdQXUE@@bA6e zv+pIZSKfD|;DzrF;#amHFL;6I9ssZ?{JDb?tBw zOUD}QcO;ulV6US#Z%Ek$J0-r48+ZO=!L|J&>72;qXApF*_eR_+7qW)h(=rchyb4A+ z-8Q4P1FKJ(kcynfs~$@yxt-9^juR8VwPOugTfaAL=U*p2Ts?nzM@JEeE+_ctDK^`z z(pRb;BK)eT3KtaXIZaZ=X?n>V1BxVP^<+cnmh|-nRUZNz$cVBtDjVek>1tHPvm4OU z>?OND=*a4&^ME(|cO{L0{TIQGYb&zd3~km&aW4vDGQ>=6>~B!Fu7%d)pPMH{4BNk; z!-%s5yDBuK9kA>8sG}~xwDnzoE=@YGvARUJTWN??3W zS~0<%lV~T$E*5qm>tbS4Tr_PUaud66k_zSIi6w`Oxv(U7zE(XIR&C>JP`lk_qqul7 z^?UK}w>Ytox!M@?D$B+8c2pFD(Y*6rKgV8B5o9PyR>JOtJDpKHqzPiae|DdCcg+WI z^a_YMX9**I%Wtj{*0h0t(^lRQc+3!``0EyAMt+xt zNwe(Dei#lrP^#;pa?tjVCj5)Tm7$$|w5j|GT;5J6~ZBII*y!-AceYx&uM7sZ+O=7;|9AsF-QM$1UoZ#8$M|olu^}s6uhlSawu+Mtld>)4*aB&x6DF@aX)V8R{;gy z)|%W-{eQe@oP-{cNF<)UKR;a z2<(Zbj7qP6ntXo!Y&54NDzwId0zwv+7sibD!6yzGW!M=^)dw%?2$WH6c& zhxRG9?+h-C-|NV>?^W;G$Yg8`e_fF|dmp=`md0qXvT}p#6CCY%)i26;y95&VhPZ7= zlLqZ(M8&C>@I&9$Y;-XMc=Xm#V7y3&uT5yghz+LNB2%@eg2l}Tm+_U z;6MK34wsJO4#$yAme#KZ+Uz!?O}grNyLNx9Ev~tre~;7kYTmeBEbnCa^YjZx$7=H@ zdtL3{%}kV;^^SpfS4X4O)h2wGb^eGz^ly6^p)W>g3ch^*ZyE6>W1{}qr42VHyAL!& zL>UoH^ymHVdfY8n-WnCsaNrI#;@b8*vHe0jF5?w;(V!VdhiJah(jU|f95+grxoK11 zhv>nU2noR%HPT?(2Ny`;8<@vmxHSDK%>HV88H4fZ?L9I*MU~`S@38^Hq)BLnFaLOV z`@(|{qJr_AEuZq=H^m3;*K7!qg43gU$!;(0v!~j; zSNWJ^s}+N+!qFL|4`v|e2@mO-!j#a$#DB3DzFr6j>#{5qG@^U$3R*?KsGPdbCh& zcs>Q=?Ks!E9ePFKwMdK>19q>(#-^dm`I_xBIH}%ipF}!cPop zsBXk8t{8a7J9Y+-k3_sGFk2!0ybs##*YEkDQuLBX?H!Tp5xL^tJu>viqdDJjCGWMP z5s1eE{eKQ-XclVYX2l;ju)ePwTeR#uGlZPs2Krrwu`Af81htG!0+i81lZO!tYQ z#NDe`2{Yw-aeZN^OwqKc(xG-S)w|0|2S13h4wMK7bYA>+l{r zFUehd^LMwap@B2J;G><|{m>@Y+qDAhmK7LVi3a1+#V$U_j6k?=#u_a1>Kpzb9TL^E zN6D*<+A}PNi4Lv&^6G>Q(HsEGkcRdoLPF2ivS#b*@a&pj*I6MlvR*c{WeV3>Wu&LD zHC1B*mm|W$whS=B!CtR;jsfi`-7)UB?HzzCD#jdL^6n1o2KmN!7}#Z8v#~q;QxeY| zq#pzI#`Np#?tr=8^hcOiS9k%DUCuzLec6S#P>%TJ0tO9VET5fZ1WtGle7+g^iRe15 zT+C%@4Rr2Hus3cz*v|%-WWYi6y}7>d39}7Hm}$e@88pRK1N3X!;+ok>TH15$SSECJ z&aKbUX?Qbtc$RA5*gkyIIp#%xn*IlSPs6Ko*UXj0TYrOx-1aN@CW4d@v=7BXdj%ir z1;$V681Ml}@kbAQ!{y`+k{~`HR~f%s?!}2r#dyhstG7FJAX+VP(jxOh9!BEV9JKVoeTk^g`_zKchESis??)rQivQRt_0is{CcR}K$H_o zexd}++kmH0fhudR^Ol=mV^T=luJd2z%CrQa$EXppt(U)59l5`WxZjRHbO+DL61Q7U z7s#hx5@#i10)1We#q2%53A(Nq3o>MizuuQ{b3lc_c~9m?qS1vXzBU5pwjK_z(muPb zpxBcByDuPN34LB#!AlFYHjW3NZf;D|_QM0$Lk$Nzkx&X)=PC?R5JZX=IN#!pjgrk4tet%@-||6dXW>Z@G$(31*^r?VGdCI4z;hfSjTeUi)>*B%L&u(5$_8#k;6su{C7VBs zy9k~xIHb`DTdPOvBhJ7aUR|*Kmj3U~v%v`ulz>@zaIQ|_Yh%LaglsmH-LpkP+ls%1> z?oCex$IS;g9H?=^E5U3>qj{iR9DzADzpv8>BOd;NNsjehi_8|`RWsm_*{b&$M4y3= z!=qsvj7j~>0glR28~2;bxT6(o&6){lqF8+>$xn+{>FX*KL!*N?NoK5bNN7J&M)n>>GiBSU?J7< zhWF6+cvB5O9P><=;~4 zl|P#X{3N-TI+YMmVwp*%A}2_qvMs_w((H_B&lFbCZBKfT20Q*%Mif&b9K%vd8zXsZ zsl;5VAeA7dWG5C9RKH0CalVGxK608iFG}&XGVL>>L#N<2Ui(@W2fJhj#ZV;zbj=kz1{2^*#OpwoMZ-GF27jWide;U zwCR$)=u^kY#~VE_x-O=JZMctLSq9c~(Z|R(O2m&nD|;o9E92?Wkrkd}#CIfKi8}i` zdJ%k^QL6?!O@qiWh711W zJmH^NJtafpDZSTACNn$hbl3%Lj&7oD379vy? zGuGSSd2Oh5D!R^Ht{g9#Zcd8(2@im6W-hZZG!s8szR=x6Vo&7gqH)0NJF4N0+{ zeM2_rRj{Jul+Ul$vfoWDwOV~SUM&@6sxB>AYucaJ9OwO~bQ>PIe)3E@FXdZUoyq(v zk|nd1=$Us?_TZS-7w3H)ovnnj0{70^VtWQBQsy+#h{CSjOMHPxvgI&898i)`2zaRY`_+uYP0iF&{70 zPlu5?K3!TNr&t2?j^E8wo3!ZB_jjc6?S5EKV-e+^;u)s-EhWJp=$E(aC8|3=1azau zU17VxOKy;GEv}$g{PD+rrY%=Ufg%Gu+yoS51bl1=Hp zsJZ`cC?iC#BE!k9_XS;Q8zo=8=CQ_G3KGoBE@|X1HZOL`5ZEBuiWO@EeT*4E$vyk; zE*~QPPp6P;C`7HiaBCT-KmXBZ!!ecwo3dYr8DS%bsU+M~Mh2BpRdvVF73V^_y8U~@ z+JDw;if(34;zjeY3BakM!s)UN;B8*`w&0DeNvW+|#0>6xqY|Nrz$|P_Ly&0>_nVp<7 zN}G-}d5;WB6#bvqdtaXXjd@rUVYZy-DE46Ci$NO8MV*Z`h&blDWKw9c(e*scYw*~q zv~+Wtk#dN(hKW&JMEB#g-BWq2K`}G9RIMLv$>V|)nJaZDW2EVH-CycGyX_*`*##-I zyqFK8(}k?)FJPw0ylP!!ryv<@V~^&5H0IL=leAgNO|#2nu2wyq$LRrInN-E@eb0Y@i6GxN3)=K!3e*Ih!SLj_s=YmsvVgmo`>iJu(~bQO7*_Y}mXT6?4} z6yvQVaxEQd=w7%G=F{wVlMwxbK#yEeWsjymlzhR>``^HlQT$G7z?vTuXJeX~5bsRi zU7xX1*r)}leFaH?}_9z9Rh{0Q~oCStp^E!g48?Fr%6hT0_`ji=VrZT!b z!<*dCgN}Z*S6mo2XItWQx%wFP;D#&FnWn0_;1Vko@*IM|=KzP|umjTRx;cW3FcB6; zrlCQC2LyAUA)3Ito^df30xTM(ge5&)i4qBx`|o{Qgd$Y^Q`Z-mxSvJ!Z5pcladvFv z6h~6gp`BlF*_Ru=TQZ>(>Zf=pMP_Yf-XP&v4od z(H?z4d2T@Hyv)zCAgw9Mp9uL|7U|HTH@mIry z!x4nH3 zjN}9mqf~%iz@8iivU)>+bX4xqXr^0ab;wMZ>Y}%9l;vhf>Zj9x6rCFyP-hHc4&^PS z`y(1^vN8t1QVrWz6LXY+_J~wfJ_hCD;*rS7t8XMPy|%c@W$Hf8UMRn>1MAdU zHiRcl6on=i_2sNtl5ysG3}mdJ0RTWf=fv&&jy}2&<3;#*AgVO~&(S}@lFd<)F zZs#nE0h<@=Gfw}ZB-pg|*fj#n;H)FW4#QbM7oC>lNga-&AToo(XPENGihn9$gCFLp z2HGb{K8bEpz8eH&q!_%-ggTkJ#1zc;pLXwO_J*bz$nc zm7XzhSZ}WwT(7K#^B&6`3WUxhRI~a`%R3agR$P}1be90SsF)XD%?bl!yuFa-bz)o( zI86=5#Ck#_DQBU{!NI|_&DFj{$AFbL=9ZuA{oYH`RWaB`NVi7lzm4ZSWyc5)1(sJ( zIX!T3lw07VG5B;n{kpFXycPMbdldQC-F258HbR{d}x(I$il^=5;@)qGL97@u>|&*rR~#tE-;^wg|GJ$Y)+3 zsHPM70d$emAIB~;7WN>5;gSsz5sEF+7#dK50yh?k8<|wMx1vgu_>p0eR9!4;RI(8V zYscQM4#I%8L{d(g*Ar8nq7w~Tg9b8m*<9f5Z+W5H3qprZWPp$nU|swySYLietP_j< zGcI*?{ir4SSgaTAa3}rX_mxduDi0r{tsB}Jcs22#45j;0ZETawn$R7e;a~tvW_90R zJ~*|}v=%MmK%2@(0gV|ps}(Q@Ex)bQrVG}g2g^IsFZh$0#)x#qJSkOx4vD#{uG&d_ zRtKC$Xl3blC|N6LpI-f<^c7Fqp*v0dkrbwr!tGf8>PWiknY1VNERIKN>N5h$Y$;o} z%-HCYxplO)w*w^Gh|cho{Gj%AP6dgU)zLzr1=`}a{XA=ZsU`dB75se%i` z2uz)TWM|EG@?=u%QPu{xXNrCNfSypokN!KlK-!DZ7nm2}^Ubk&mh^|q$-RHYKnsv? zXo?|jQ)7gfQ>^Xsy7QQ!J8R!5>%peMimpyu+H)Y>ER7ESL+r$vO!AnVTP7R_0 zOS>)-Nq(>&y}fMxzlFv>dT?)BYVvqL4Ay|F5wVjm9vtw z%U7MX0kR3!4*HO~LjcG$L}m9_BEY_(K8|pr$lV{W3ppYh1?CwtvoZGWO8~qGJR)Hv ziAqXZO$B+w>KX0Mue0`Gl*XJAoRy*W!}ru9I{fb(;< zZcqIWUl8%yR!qC8su8@6_bE@{!CLl?!Gz057QcY^gtVSC{4`#>vsBz=HvPWiHpeAq{pfzigzWbZoex!P(BKJLY?pBV7oQG~Q z`^`t_=WA%e(|*j7_Xm55)GV2o_E6wh;O#Ca(hD4kR~(@o5R~7$Q1sQA1=1ini@c(9 zzt$Uwe(rUNar$|)N^y9tjF7x&X0H6w-W`?q&|vwIaz}-mJ|If>RV;3rc)f(e&4>iC z!D=F#MWy32^D@b%oqm;FRQr|wqR-#?0(Re(r4?JFnnRsya2V1Vy}0-5)pf}c3}t%C z0=yMM>Mdf{!;A|qZA(ktM3<%UEvn*u6+Ps0D>8f+S&9cg=)8_SMqWlPQ<%_51Fxe5 z!@NdbKk;R$`xRJjwT2pM`;|5Q(G|MI&B^cwT|9cBhq3Z28GEkQ=y`Km+-O%DkTv^> zkw|p$RHF0nMhCOR){19G(}!Ltw+1_$f9a+tFODF7Y8d3U+K__$pmX?|#F5k2 z!C=_EnTOL@EWdd_;H6qcUkQDhWP@#(q4+$ea@Em0biZiM74jTY{_aq?b?uj0i=%_+ zl_6#`r^BrcCu7nF(-J62e>d6SaOQn@EWtGxLkKU4@yn!)2dq)~Tf(CZl4;P+pzcgE zS6%NShxs1cEuId$l>#0Li?Y%>M()(fC#_cVdyK{M@>EF!Gyb9#pxFaARrkPeD6jUF zOr}<=_~HVKo9(|$Q6_6mO3l*k*gbF6@4z+r1>3<#I3Zl@o{UtWRLFDpFyp+Xtl5nZ zZ%?pF+)C?(EWO``y+0%4{Pz&9IU#6i^-_~B=JtDAS3_MnF5sma^rfK`8{d$bo5eiT zKWA<6xwHO1!2MeXjH4Bdv^!3Mm8I$)<9VBx$O)3`59IbgcoTuEdhk(|= z%TZqXcKh)`y?{&3&gXWq%Kro~*e= z$+Cj&4K_mwqlZ7*$+Xs1!Y>#6F)mi)+~|^2!AI=3?gO->yuKzL0vF4Lt2g_!?*jcK zTCG%5kLyXevb7s8S*E#K3G8TYvW)MptWCJff=W1Js^8m^FHf-50|6(fLg$IuOiR}b z?6JOSJ6DruXPkp?_7rT%m7!Z)zpY5foJZCcV$`?mIKYVG-C+&rntjG0&4PDEe};nW z_tmN$(bV3|pBWzdV+BsVw{6%8yyqgd6r-cFMAY0?VC$_B0Uc z+%?Z`uE{!6WD{Tk1?MQz8-f1m0{dvfnYv9Vx_fKwzqdA#ENC&{BD!pszj2te@QIcS z_aH^=0?|~y+eauIv#_7;wwLy%M8%dIpkwPAaT*uh=F~C+Q_(%CR15?{1H4r^?545P zZ%iw+R_h0hk!1aw_jAxOqx14jhZqEQ@x;1W#_3v&FUK~p({-<=txM!fAAAkz;q5or zVE4Wa9W3h0K#&rKeV;O z?m14ZunevVr+Du8lXle9IiPCeA%eFdcg{w9B7z+z25u0rTO+Z`4ZY9FqT z2)ZSB4kj)N<5+W09&KtuW)`;>XOu}2At~9fX))e-J$_B>wfo`2X=*$OVA4dXwbtZ_ z<{O==wn$eI9;ZoX1D^#Lo_9k=`u87CKaUrMmLdlscj8+G2?m@Txf=r3$v*A_5VV(E zGy|6eerEHBi*9qX$&-R8Rr&<6i+nIe*K9eWtV0rweN*vVd)6ix7Z9j{M*r!oSGf+b z-id{vRXxm-*_)CbS9eeSqzqCSgQ%^ByV?tz9F{LgUG1%Xd0!X5^Qn!i7ki1bz+1!k&>r}CPs{iNE>UvT$x3P@Ac1$hF7v6c$p?Gy#5`!CaUve z?j`SSHCv$a-Co9BT(T-FHxFXKaSsW3c<}!H$RCS7!BIb0hvk;rELO!lDW4plpgS1$ zH6RszPWj<5HDIHZh??^8Gh`c#F>o~(IEfr6{_Y*{O3~hBXSkxOs4qGy9OYr7WB!*{ zx1(n{|F($yVAbnV%=+wV9+=J3ikHsmAY(T3{tpl6Z`;Y7wMrncD92mt@2dVJviajV z{;AEr|7%(50>SpA`q~jE!o@~fpVQU0UX04Zcg1mtr47*Uv{4q^tfx+vec!h?Hn0t4 zO659T^EHd#r}UL|@-gxw_Lr|Ezf5uDsrV1SM+J<(IF^|>EiJWecr)qiE4>#{6*AKo z+lu3lq7SjKCD(jNFLGg~wdp9?aw_M$S8Ah~@rLsB96;w~-9QKJLpqP`tB&)Q%DVc^ zl0`jy;h;CWm#EcsM;gU775H~Nt<@>@-oQo=#I8%Gc(PzUVkk04YvvM3N|B`GGdcidI371cr^0qUUeP#GYMOv~_ zI6-e1jukP#CPO8wm(R}Pi9XE2oVfkfq`^OccJmPww3w?&M$F>s;s>9Dc0yjG%ib>3 z!4KYYNfl%1LmJcC1HnOHhs80RBI@*ZZEtsx&QsF)ZwHm?9Q`YkpC)eT>!Z%D+MYXw zETS-y8y^1kJwaZ&!^-*jY^l0{bBvMK9&I!C3cTu+tv{lpL|t<7CkmX2Z(O=JjT_z` zFC2*21FGlN+nsrX$9dtKp)V5dBA!YKMD_kwi}Y;e9Lylg-L)){= zNd}`e?KYRVe4fbm`^CEmJVV~FDSMg+Muft|FSRnT`eI+KSj;53?HuVOChSxq*<-%K zHg{Z`%f#E|RD+t+u>Mxr!}Ui`B3Upb0HL)!wizsmHvek<5h}CR#oouRq#CmlgQ-Uk z0%sP^_aF|p^K8vPjG41x%1If^yrZN#+6(>5#Lj=)r*XY{@w1duWc7hsu9IM>;gN*U zNrCHL=58($i1B>0Iz8zH9mSx;?K>B%|d{p#*bstV1(tI+(P$6)6CAzqh0%-qrv+ko(BRo9+C ztZA*fHE1ch9BCrK^r}MxcExHf>b@=f>Rfe1I7__4HXDfGCHWYL+4PtPXVOW*m-agK z2liIu<}?VOy;sI;CY}VMbo_vOqAf|W>&3nkK8O~$Bf>{^6m{ctq%REp62!s-Fl(R)?TKPz9_ z-5Z#(5~I-k%1h0wj4(Mpg?}BpM#0uh1v>etc~5pj#me?*^2}zSA@wBBwwOV@N)T40If)?z)KCjhGOD z#*eQ(O<_vZt^|fh(q82_rn}e$bonASW$5Q2a&jXnGrNRtTl%0Upj`vQc{2w7#<9Fh zLn3Hle4o=}oHE*{AM}Pf>9H){h=D z^JCQff+V;mmp2dDj}q^3_{(>hdf6dQ0e4i1LpWx<6JTBq-FKzBP>!;&h`m~j#?%&8ytBA9 zruws*EXZ?mEAD)C_V~YAK(BG|=7;k+p()RQmBV+Vj~Ub1-b)oL&q79I$d;-7x)4QU zCK+ObvGm*$67MN8%`lzJr<`^bosR>eV&J*`KbdyDLASf^w`tnXrUx-+h^vT>PEU~6 zyGf6JydGyg)Tg1-I%B!qhJ!DTDX`PszLPX?;xF*e^HVva?_Hs)&xM_S9E_eoFbMI3 z5hG!sTj(;Z#+IW3jPulGn-15&te~ulc~c7UolBjU#Qqc!M{^2%d$x?p$WcCB)@vPv zsho~hAFS&INj_J!@%<(OX3z@?48g=TmM`l0%j#8|bS%J>ly4RV-{7l&ZPG{UIc}@* z*vc1?G{cLPz`{P5(m*#pq<2`6Rsm!SA?&hg-iNw;@_jO=i@ie*M|W-R_OGJ}qwjM5-26bm!uC8hILc)8g&c>@Qd^>6f@X^6VlqLGE^z#kVKAE#R0eV?j2j>-T4{ z=3+|q2r!`I)OGDCY|XQFe}9M;TbGy)U@n_K0x(JKpYX4;&JDm@o%gaXN028&U;mi-?oUf3@Rm3BK4*_q#FSNY3XL@p+`l!ySt<%heqihI))hO zuAyuA9l_7{ue*Nh-nH)Mo)FqCes@Ds42x($`Wpa6{fwDh7p3oW z`F?*s(ho4;Qf5v{%n5kUYsJhB^pZP%aa54hw{=XCtAU3xnxiK@vRA4P8YyCS?vY(i zjXqMPhmoaGU%nE=c9O-rrd=L3K9FIZtE+{So7oJa3O8HmB`*(qenJ$l3tRX+27l$v zk*7vY^%B3ACK0q5?Ol|>*c1pHZK4{6ZP+;k!?oWpw*K+Ws2(!r^}$TgYnCNnPpi%VW9G}lgDibx>}T^YA<)aIf;<$DE6eX^)0%* zZmME?Iv_GIZyD@xyzMh?}$!~2&AQX>qhm2`IZQ1gyUp@cn zI(O2vzm@{Jv*fkPe>!*C%jaPT%4e~UTmP0Vb|>o45>wB^sPcS`HmqrPnJ5njL`v$K z#W7rgsn-MRdr_h1xz9)11P{k;QDXy>2{{Yg&VrW%86!{?Bf_{{cfJ z0WQICd|tZCc!qgjExY)Rmv;A=ZDwCBcMVKKPk&juTYBvK2NKZgX#oM2-9;xD8N7U! zpVO*QR(`zFKRzypHSxP&6i&lQifvep5xE;18#;VKTE`1yBbI^TR^k^HH&cb%0Y>&P)pH~)N5;6qqp?9BP_ zG!fFp$$|_1OcK^dMvz*wkOP%V94sXmCA4mMF7p0D>BV`9`t`Z95_)vVv(Zp92j{tf z{&9H-)YEB)dOefi6}WQ1XGHI6vm^72C(D!hmE10$TZ?D!9D1`5CuHXtPpevg{M{VP z%-lO1GEw8waNUpR6JrlXN*mtH5-3Y6ke?rEkzdT}aWQwVPt&ykE6*{H#X$12vcvg9 z+T*4Z_1+q9Q4SUoC#v=p(k6S$&~Pu7h*%EA%BtnPUJFm}J}d*04ddC@3k;kvOG9VF z)tQW_*7Y-RE7Rri5}Kfy#)?~2L*Ua-;X9T`wDgGumaXup___YEtR%COP!gV*LdnDw z9?Q)Qf~b1wyP!nN&CMomLN79n7V48tN<<@ENNBjCel}uQAuWF!*}Qmy^at4ZqEQk- z&`L_6Z#3GIq~utar=+03;(MV?*~yRSM2Wx5FTG9$yLn1Y2z;R$J&p%3t(O}lpu#ei zH`06f9kd6s;qn)TV8)%F6tbE%MP5FI3By87IlXhH002G* zbRbrVI5GKq0NV0C3z)w(q3{LlbENRb$$dZKPh-WW&%6ZNxnd2Gh!;y^o*=`Ybyt?S zuP+7JAKA2#(nLwlMeXI|p&!*-XJcfxZ&xdIQNO=fcT3C%wF1oP+iEg-l|)Br;ERzk zze^|+1quKhM z6hB|4p;en|ydIfX%k?C%q~JRofQtkPC(6e=c!*l*#u*8qOf;z!>_9MEdQmbP;#vKf zI~jiIoD88|y-x~_8)Y?sjHSM_A&I!9oPk81n! zzXhjBqS~j&WciwsRg_HgtjSmwOZ*0DivS+PXfrlIxxo^c+JrI$fH_hrbzug__XgOQ z(hTcPqq4*aeKfg4qS$2NkLIohlU{Hu`nBY#@wOGY@aX%lUr$``{bPIlM*edJ5e(PK zvct&EPe;+x?@<82>r7ia$bn$x;?k$qehCxS2){v%me9iC%xzz<>2nqhIm4aGYmJ>3TLUKK|TCzmX$k1sFe7RDdWnv#?qJuPn*msCq*^F^CJ_fO=7DX4c;^- zC51x*qFBs~ZNd4Q7|T}mrun<1S6bTveMn!X-#?J*Bk!K^<4cNsUFq8^S~X@9W}85tUSe<%jbjXzZ6Wqlu6xhM9m_3|}D3jP+F_|1yTCHpyE-Cu8k;~oOmgYD$j z`Hdm@$*AA9>|9*5gX>&R`QZ48NhBECSENUXFV#915l7iH#NG)IbI!~Jzo9Qht<5xfOAg>g(&f zv}AM#6QPouD;4*aN7TLa^090Bwz@;gz_&Wzhj%QipVa1tDs@#Ajj>dvNdZ-=h+vr^ z%{D0-Bf;MWy%}YH4a^sSDgEv=Hk|EbK(?s3KF#-Q`eO^jCx*!IG9i(dKkxUABFdx~ zVmYi4#~-OcmauyD6|8Sts$GILjF59H<<`@2QdbSgZ%*$fj;rMoupA%s^N-Gi-`|Ui z34g5EN(c%h@wME0;hLUO%@&PC4oeSZe z!>^Ujs-Qg7BNifg515F{ZH{!$CKk?g%O2>njM;1KqRkGkrGH3ajTrQ#*tlBU-wJ~q zWk?f7zFeVZghoioz^2WmWE5nIii`1nto*P;)f4lIZRbgl?SL3X>ihr2w=xP|2@Pkl zu&}__VSF>c)Mt-($MTQR<1pmIp&%v}zZf6R{PI7tHit&Pe z=id3U483}MsRG@`_7GLVRb`9*Y^)mPT}}UNTjSXUfnEIyn9(ap0%=xZoOr+CtgBcK zs~1A+Ger*hS>9yA_IiN@#e`c~bPQjYc^>ax^+UeHoL~AMOzgN6k&=7bU6sFnQ0hfp zMG~Z_s+!(sm@EKsanw$Gdh5DIM@4D9XN+ZwVriiS|CISkZ{Hbqte0-~g0k!ZOzwYX zz{hpKS7)=0e;{&_v1(O(m4_6KhjjkLe?roui%o zMd4_?i})@GpI7|L>!61k!j)!t7BA;-Bx}HDpFh1V!r$?UJoTh_PH$uNdOFkGf5T4n zH1_p;Tvh!;K$ylMSyp`slh z{cw=pEhCZ{BI7+hn_6m&`rRX%963{-+aN-mHK3#_{-7%|g*IH?X}j*=tUHQUQ>mp} zeCg|5pnmV|shmy|%NU*+4ZYIzPn2*OWxvk=z#;j)u{6cFVcfD|K?9q7H1u>7?*tfv z#4ms-r8qwR)*mmo4WoMc-i)vsz;c<$P?A-E*lx;jgz$;3##-xk1p{{zXueJvkt>kG!ErC%|AA1k#_Dwlc! zpWMO3;B?F28XFHdF38Q5&>htrHAcK5iohI(@IFQPehy5THisChxZ7+oVm{Dd_m9oW z#e2wsbq6z==I&daT6Xh%mo|-TsFowLw)G+3H;bpygDe_%O`mAK_P40BzaKS-C(h7e zv=1#L>1?a0+LKrG*nE%vfb3$(t>R`l?h%Tj1ZqE3a!%Y122OqHB=s@^1=%?$pPw|H zN+LnUk;&0(HZ}{cUkUkqv>n`m%In8Gg5@j@pJnIPgp%^TO*f!5teh4p$!0c&vCH)Mn0j{Fbz0Wyc!eP^Q#X*nC-{TgG$W!uLyu1r&3ehw&H`V8E*T|Ly zA)!02_ecxMgg$J`jBabRRFap)ld(PtfD(WV%TG^actQhA1&$FF_pb;~gYL#c=#?p5 z?lGFd4VXFZu7pIt>}dYY9O<5y2DxzZEO}0+DeIp4UgK91QA~1oL=s;QehDea9`(7W z)s1t=K*Kr`=b2euz7egVlsw0FS$Gt+Hmt%u_!Uu}iIq>oySX0=l|yBjWpx6v?d7k+ z+us%L<~-mC`SIQS{RrSrlfhm#90UJ;o&6syKo(F*^pbNr#aBag+3R=D?p4V@n_3^ER9(5)*s%B_jB$KU%%xUU+7W_!-*fLRP9Zm+dA_uK2o|m4`#Vn} ze*YLthounOqlN|}D6cnS6GsD`8%*r&YVm8|rgG4Qb9E7e@U3Pz%oX#dr#@qrKMsHJ zg#o*5DkE3lClQ!R95Mtl1eiJv>}Bw?EJ>7jL$=3yvP0=9Dgj5Rgim9r2=@Ci$whXI zwFF6l`P>Ro=#OHy*VQkSsxE$1sWV!#Ej&ih7wQ>RjoG>rqJsL0^`rCgl5;mkrCtn5 zN__N1cYeUb%I^+{F&$uM=gi5jEDzDkTauD8D=Bv1l60|7ZHT3IR;(BaWCqS7;8j)e z%vBF#$HOX5wlcH&{=G;}US3|xUr)Q{o|%nJNf3Kq{B+81d&J9?e~$riui#;)E%=JJ zw;=3SLile-nq*!l#JW8-O~-nznBTj(SK#m5_#~X*n3VkewHmUBhQB{iZrpwvr#0kW_3~P zhL+@#v9;&sdoRn>1-kZ`4EjLrhN)?K$)H%L`?&%1jqZr_CQ71#4Z9)N*98_9#2XvL zBS6SQ*&qcVpeo=7%ke>MM>Tb_qQ20bm^RU)=7Zh2qkSYj2X#+QL=h-0zeHAEesioa z?z4iLtEEsFe|eV2^OzYJ%uEFf3k#K>C0e63tHK-HQ=q94c(^m`#~Y60+A2KvSQT>k zEoF|J?&@OFbrvjV&Na+2Hk;+xY$PF1`HTbWoxG^eaGS6>ejtE>R|ix`#gIdf?dEqC zpqCoUtDVG2#7QA#pYDlsh3k_FW2BV%WV~p1B>oZ{{$T5V(qT>Xv>S)og-MwZC&<}l zM8$@q7F?PwxZc{tRfXj0@Sn7;pB<}0SxiMo0`8+)TqS0JpQKZoq|LyFEe+L)Q0EW` zCvj=00Jw_trR5xRbErCO$SpQEEH_>n$F7YR*L$o{)iu-^(r!2KFy|}6IbBm7(fJ9^6fpm`4Wf)llZzSQc_NjEm}W+G2z>vg!_w~2d-W_c`( zPL38GX>L@WwSWL0olt&-h}Ia~)%dbLVw(gmqjvi4m}jLlS#D6cudhVorvAjh^POB8 zi0G0{D{Bmiv|VG+zq;RPm{-d?qLP#2apPoa`+}XESPj`ZdZXIsZ7ah%wyk{{^d;u@ z9O@}g?hcwSvbLSvEmY+sc|Amp`7D8NVHDz>=!?UF#b)tRFq+0Bn#K#jVk_;EAN=#@ zN+0=D2}CskuFq?)2JYV6;gYs#+}!+=>CKIKb0_SGYkKGA&L4Y$;r8XwyT5t7;`Oh% zeI)kC4s>((-_NX-8u6iGT1S0iaB!09nwpA=+wr#cKLugO&;TaD?X-8m*Tmvenm zAN@{`@U~Nw#zsdSFHg&;;@CK-mD-fF7a5$=u9nw&Piia`dFzk*<7=5*e@fk!flExQ z;4yDw1ITEq1!}Kt(~Ynl_OA>mhik1=+OFFc8Wbp|IpE`Kb5voy)?FYn-fDe2BYo>)~raVW-U(cb|6V-7ui^-c_e}`}(6Wr{jI_3l< z!86Sls;e;Qt>{?QRri`mK*;{hNH*;7uwcUt&wby&BKho7?XJVQ@yX-cQRdzlFV+$@ zjPh@c@6<@#d<(a_DBkB;ZeWpKHF5 z-QCiRNaC?kN=Q~_mEDYrCK?vYS;&e*1y>n+oegWHF^<&J(Sdkst=qRYnMw8gsy|)f z8Ja7mVm7(vH-*|XsSjt6fN_9S>s7RID&n`6A2p{O>)X?I+(F>{$0$9SQq%t)J(->>!&OHod9$JF=6SH@ykQtb5v_8pa<3GicdZCrWJ2*Sh}j zP6Jl21`=}4Q9<)iEb3|HUZQeTuj2(z=(7&eYMf?+RWZ@4<2?cojMsU3L2^<=udg-< zA|Xs#d%j&Y9xdN2MXM{_r(S0M1df&N9?- zZ{~-L6+p;(n}$BhiXTJKM`iR&e#saUCNs|cUm3yCWc63$O}F2;<6F|h#sN>Tr~Q0P zX3_5p`n&Ep)^s||tuLA7i6hM8QN8vQJwhW%VN_xL(94cPl%7JbR$A&o+oEPPb!Opi z-L8lddUKkI)Inv6=(ZB-i|3#a;^ky1BNG=C2G^RG7-(5Y=C!q{*{+I{`Mg8vG{&1WkBfbGA?4N4!0*{!mNAq?p@T zY{vuX^|z^vGCVHR{MdN1Hk?}BGyNq!8mBcD!J zU$tKBljr0Rid;^2W&BT})i;HHh`j0oU0=ALuME^Ubzc<5F6jbWUZ*B-WCZKnj|zIU z)UQpezrXRkl%(!_h=h5VD2y9JwT_D8$TYb17on!TkL8eeUWi1;Ft{xh60SQn9^{2_ zSkJ>TJFa-In)sR#iX@Dlu1U#UmNlG3GJCH_c6!f|Un3ut2nlXC)k~Zd@_neY&>C+s zZsO!vhR;E?W=~9li_jzGc``lX9iD8ola>m%(up?`dj=R5VdzP?G-}cZs_BJ{@eYk) z=t;WzxkX({O3dpPk4v~oo}_NiAg~&7QJyTK&3Q79u`o#=#^3@|&@xhq~i~ z5Oyqwq>8?y8I05bu6!o`(I_j`G28igkoPcWgIgby6vZ~|1ANd^8c9* zqMg}VP*hY@QsP`c`?vJh9sNzc%Ns*kk}@)ZYuvm>$>I_p0c|xhGO`Y`yJO3JD+<>f z6B82$l6f39M)L(d&%0iIUVF@|o4kCwzldsHU;j^AbQSX07#WLeYtPyO2n5^?0RKtKRsGxhiPXOeFI zYZnXfKYuXDo0oM3+1XSt$Z@wn`UOnC@b?h(D~Z0+Va`d#TP>5>4u zxWPJlz@uxy<^D8VLcNheBfYINf{Krh&3OxU-m;xVHcOSc{JUp*8OMbJq0Y@{2t^1<&002I#dUd=h+$J^zmNkQo4WlFf2l z9K;R~SaMdL*Is>OgoAxVQFFmIbMN_}2>NMQvpxLPm)NMhX%cJF<{Z^mye&mC>Ihs%?EdtxN#cU zEPiUVKdZNa>PKaA`Q-=rnN}gTm+40ah)fMf&ab$F>rF1PzQ`ATg???i#wjAKCsM>d zEdwJLW3`AdgMbn&aQL{OBK%SZRyY;IvN|}0GH98rcrow4jfAVhS-mx1O z$;=Ov6My0k*TN}qp9b4Iy|I$^w z_F&XquA=>_lv-PDwW$tyV!?rzLe5>`v&L@Oon`_{(uFzb-#*6<-xw`d8G7AD4n`sQ z&SBXIRZr2m&KA_W{Zv=5Z==$bDtDe$b(y-s{=uAo2P>2yY)zmJS!n{tT7(mMcXUr5 zVx>k8d$lZ3C?>&jXrtw#<`3qcni*zpIKAHeM80S8E7J9Xd~cT5cS)b)Mc(rW4k{x_ zM%Lq!mUg$;xu(O8st&y9)lq-0aThSe*g3_~dpxy;6;|r`sUK@v-g1!bXOb&r1LF_P z7=$4hcazInliB9EyZ-pz)dh|wb;5Ab45-fGC6HnHat;k4tgM}S=O8;hCaa%}RzCanhT zuo%q2kN6G_{GQ^STPJx5tv6Ogs_HN5t_`9EC>wBStF)M*IU1G$>0=F7)~86F3N>Gh zOZc!rAxBt_f!jutrCq3?H0JAgn}@#edgR9p5A=Ef>1kS4k7O?TQAVn1FG44$39V&t z+^@pT&P#~DWNevy5j4Yec_v>UVC^c^p5}9RT2kBLT3j|xcd0o_oi=EO9{FNP@y-jx zUaE~ICbr()0?tz2uPa6@#uVnm%9O&n+n36)Ruq=amC&DmX|vWJZQ{4&(Yv@X zJ4T^F0YMjMw};K`9k04&IsKw^x?4~lj$-{TL+{FKMzk7!2O`Q=eYTKX;Sxuu(ST9d zE>M*-sv#8=f2xrA4{9M@yk0i}M1qW-avwl9v{YEJ0|WZ`_$PH;_`4Ak#g|oHD!(RU zaYQm^HI}Wpxvdds4oh%D#;eP|*40LydMkScH15Fo*a?VbNVAj+~{mO^ql< zK5Rf^Q>WO&qmJEH3&FPi$Oeuou^1ltWymGA==;`49T&NTUxI{*#i`$fnZcS2PLh>U$?hAp zb%>52Ji;*Cq6RUT^im%VoxzF#BkRh5SgKMNpzmsd%9)^Sq#D+!t>@)iv0XY$ zhlsf+U(zEM9w+*kP{6St7sDc`v*ZV};0(vqzo&*3R25+hWE6$PQ` za}W0tE{!k7`gym4!aw6NdB4^Cxzpc(H}945^y_m^k6@KoeLbTZYb{0dsg|Xj$Hk_l zm7EYtex9Yl9%IYKv}LD&R{&rsoHv|DYkZASFt-uqIQ9LJ zgzL`EmY_)3o>p#uYUSyd?yM)vtI`K3i6V^D`NXezv>|T7f^V5?B#;R_bK7BE6(u9Y z^##=a5`w6s*^6%Cyd0j675@H@!O!Bi64arBMIW=qzZ)TnTq*5?tN)=~S(ewdtTY|! z7}_JbV@;iEgu%%>drrtK6iQy{Ucm!z;4A)Q^;2<=oM?M)+P#4vzM2qLn zV)71LUiqyr2mA#2l7IS1TAAns3)=T8%Hg=T*d3~a=};d$%5bohY0EPLYIF@{)fh-q zi-(z%r;bLYdO6IM^IvHd2Tg6KYBPR2692jJc#b(*L&~fb!xdk+#6j~t=tezo{VKC! zO3Bddyu6?{;SfGRh1Sg==07BpbKw2m8$6`@y&`;W#3=Nt-WdL~F=cD#oZ-BslKl=~ zUJSN>P*XeJMe0?`sH(=Ou={`9u-Ml4HYc8j;QQ<>vMUmKVq#kVc3q%4wn;|sIUoic zd362-u=VY)c@v7lep#W4P_45PH7BD#c0KPGrb+NEoa*@DkT?(lQBhF~ivqJwUb*BP$uKe}C#Szw zt19aNV4%K6lwlK?MyyW)*UZeV@hCi@qNSA-8%u+L{dsqOxbCph_u{V+7~j#+aejWD zD&QV?Tuj-n0ptPLs7inpdRwQy%h3PD&0wU8wXfNfxPS&+5!MG`H!V(y^f24b(7l40tom55O#xr z35)goUx0ETWgd9l{Zj@w^2<0=U0r=*Y>b1G^A_kG)ZiuwZEI@-&|}yE4AW;L+zuov zA|e7wx$P3ON4&$_HMjTMFaB?`5`MC6LDSo}$i+V?>V4A{+>yilX*2yh9lW=_Hwa2h zN)iul=O0+uLQ^AGJJ=*|$rfQPGb<}x0E6b1RR&H+hGXe%5!_bMI-{vcx9ua~Z_>T0 zvvZ*hIi>thUNb4_$oD-zHa*e`g{G)(lP{E1SJSYttd!mhbWNt-pXporrN=E6)&}0mF(Nh|aUGvEva$#j_o$i+}sxZgg;PaAs!7-YJkGCfyD8o0stUSI8RBj)R6W-3OS4?l;D$v&9YY)V8nc&$4 zRZt!EZa5fb?4O<1k#nh%;oTO)qNbyxqoR@$iyzj(@Y==>lz*{yJ+X-(@5Yf=?Yus^ zxW>IrSVrZ|&>2R)J0+mnCVL4Kc|Nhb>v<(|mf?0%2W>=={;d}=Az>apz2XTUtxj9S z4fb-|UQd7TDuFwVq+Wk`8A&2i7)T$P3g2W=PHhyqH!)i@EM%)PmTG7L6R2*vBI zEsmNCYUGCNujLlJiCB)CTBIN37Z>LjeYg5Uz{EaF`vUf^)JSfBucM-l9Q>e%3cs?)N|lV zyj(cluZ#wS$f=L!!g*7MAv4nWzQ(|d>o@OiKW|(Tp_xW)-4;a_9l}ayl6g;M{!VeC?(S~sfbJ?Mtk=hXcsY;jxDdi? zR>2bzHl4r4DFN&ruVV6YUv*5!BlXgQ5!OyX?*XpQr!oo(0j-~FSi&kscaWnlsPz3> zt(Cva!K)p&?7WG#rW>+tn|2r2p7Ru)c$=p`UtI6l%(DX+HXyi^p)N_g4yez}e{-$= z?Z|T@(S}_N(x8TokN)#KJU;#nAYv9P*i}8}FSca(ByV%8d=N*!(l2j7W@^VZModnE zp>TG6D>%{_xedtUUhVyD?Eh`9*&uyI@ezm$+VK5%^lepiq#lJfet}DZOpot8$WIz=64_8ov<>;&HlUjdJLWy)^^56B7f|PS$_!2$j^gtDQ z>ZCeZi_er8{pQ*fsR8DljGJXf{by2$BNuYe&3mMx*Yaj0Jn%CJ6 ze692fQ{C2fUpW*NaC>4`Q`w};-Nc^{d)h_fb=E~rRw!_pZx+jvC>sfWBe+|Rwx5mJ zl(@27EXjsm=S&{Yp7-F*uGlDEOC?2m^!^&1t<7`xpb`t*EG&F97nzc2eW>^dl{cDF zu_i0z^4;&m0SOKqVTPBMj^5=JXgcVLd+2stdQN^2b~&Ff@q$gJU!i_8G&ghCjp&)F zU@~;8SdTNggb;%cgQ)r6y`6mX+g`5JBP|n<-7Z`3d+BknB$7KP1N(kky%;J!pBlBJoOHhTlXRH$5v(P)WNr7OTjWv5+e=zKU)FV+crC<-P z4AcnC?Lb>^^;L%5LMacTlKyvTIWI^FdT()Dw#nFh6zf@l-{16A$&- zf^6hNIeCvO#gIor`0CnrCVKg}6M5R%{nOjTyVwWcQgg>?Jr375p%$ly4t7nnMGMal zF4GTG`Zk?|-!|E9P}>JMT#!s%)W;DEUP%Slij?7msAt0`PWB4uu?2VL*t{cw%$& zNh2Duoey*`(B7t@bh-7{oSS;%yDmE%9tF7d8z)VAjjIk35wkiMLqyre$3!uu>R@Pd zlP;A}=!mai{@IABj~-v6wP_2r;z`3Y^NU&)ajO*j2~6uPLgcpZ3^9}W&-B)TQn|Geug>#c zP!Q5NC@Z%xZ#GR*M>Zvy$jPoRhu;Y;KEO#iV4RrOQ@0j+ZLs-OSFg9kt>Un6#1IF4 zp*=w)TX0Mo!S@O94MqIBe?ZA~^xXAJmY3GpoMuFL3b*i0H-A1ZTC6nPZ| zt-jpe9zY0}OLMu3yj2!)?!mok9h7birfVfic2}*=+BqsfB6ZKsMjdE$m<@`io12Fr zGo#;pPb?>9y;gp<3z#yXfW0duF48S|2a4C|W0m#?A?pywG;~j#+h46d^>(X{;~wo? z+z}Nw8xgR<&u%MU5d;S}xEzU}wDGsykfFlrKm^`f7IDr!g|93M>Q$md78yMBS8NNn zX&^?0$Yw5f@}ncTsHvfv2m1Q6^KkJEh@1A9-fi=+{kdh6HeAapHp(`fm@TjJBhTxZ z(Bh?FFPLJ%O_F~|@$6zbozM`!zUz|PCn+MGuE<-lE_@;JU-p3VlXb*BIy$<`vf^A% zitTq(gLG0^85#U-Re+vj2dtsC_>pz0l$*)9ozOd0BKqQx__h=NTb^1&wTld$T#W7> z%a3AiOL}$8E1A4J*fTBR(}kqMw!Ug5*PBEI2v>fvfu0SStA`B{xb%$$A&E5qwH&G} zgw{!?8y+N!Ma6BiDi&*{<;gc%FH_t!!M~51*ZUpp8t&U2B0}Qf+5rhRQiPW^=6vQ#X0yi0$Wf(pil3bO|0g z-8?0S!ZHAhm>uJ0-X!r#H)kyAu5JuR`ABW(d+bCoa4v_vbh^MqM4ifq^_Zf9^w4M9 z>QJZA?}er%mzDN~`>uVX?Gl}txjph7(WSbc7m8dYVEo5r2h8OD6p(==hof)@I4SE& zwV$c3o!PQ=6wxkdA%sU0GZUiP?P9yUjVeUixGb0yzvvr-FwOPoxYu)dU7q&D0jK4h zz-O6DFQ>m_vUxr#vbipFjjC$pHnE@U**;(D!HFH{13)w#0jG7O v|Iz^qhKLs_% z%|tYX7GlfWAdt}UtY6h8XsQ6)qswV+xa>n6Ek+CsrwYMPgI2qn4kdlB{_+vzBuR@6 zQx|%)zi+U)01nklWZ#Y93e45{0bPbR{*d+G7E0qa-A;FfPSzbAxq6SU$X_foefeZ) zQ*$bo6g}a~ z3&h4hBIc6AwM6cb0ISIyKl^+t80*l(^|Fdb1ru9dw_1O*UVO2aNHMCj%zQ-Al#sN} zVBhy-ZhCK|lvXUUxf{iX0%@t^ zF*jtZm94a-=sR8}>a?sbn~ZWdp368qxGkjlA{XzT`{5dkLAiD|%F(ARbsq^e2poUA zkvj!>%A(f19L7veZU?{O!jhIHb3Bk&4-!q{e(+}!I0~m2dVt)49sN!4)^es%$#f}u zYRhW}+v@=ufG$CO7ukK<`ruizfW&NtV{7pR7em6uo?_mBoz0uNsYB~{qeByR#jjbj zb(gt(1JJWDD6iv4oUWI~%ny{k(th23JFPL_w@DV$QQ{^IKmW>o%+xea!<|KyQV)Z{ zQ@=O?*O6pXvg;)@tw|{J28+Gs{J}xT;dj2uCbRt@@XmR|!r*EQ;`Kt5qH_SnqNEGz zok;oq{9sdx$d+a@0N6sdDHCr@PDgGXx&i!-Gts3hJyaI4+MIKVu$Z}MhtT;#t6!t725Bc)u_ zqmX8Ov1Ln4a=m6fvKdi6T_(51aPCtSL2or#DX6>gVxwPK@MGe2=M^huc52d`=*7k9 zswOh+uyUzRMeDj|;CX;?S3EtO(2_`KehnYNSj_O$@!DOL!0=kSPo`%`zA-oaJ(^Ga$ipN8dm zUTN>2i)f)&f0Nwp3Z7qgw%?Q9(+Er$U z;(L^eKVl`m*(@ddGWOv5umMuUnF%)(jC-~Tn=AVn^}cYx`TJ{Rbc^m#AzAyHFG)(u zZsid&dc#z$?b6(d)IaCfi2AOEfT!)!3pSIYITd~Z(YC~=ir<+b#WQ!Ng?=1FRh2k< z?2<|xN4X#KCs;$hwjD7~bI@$`Yi%DGp0@{@PgA*=&%chiK2EJkE@m9EE7zNp4RQYR z1mfvM`>Ir9VurzIX>RgB{blP4)U)~rOXuUf_&OO9yMDCsJ+)1GRe8*}PxKCG8vI06 zM-z{Qet$p1`EHul8ohF^aPE~Dt15E*?*}PT-TT!3P=QqB%vb8Ub@wNws#d~6WkHeya8@w8n6VW4we1u61-^){XT)0ggXX2a*wjCs)4v!AT0W}%!QRK9a^)(o z;eaWb;%+ECe$@~o(fAFK*I+tq^KzG{R;9IMW5Gj_Cl3h7S=i=0UNmdh531$Kl`cQ# zQ+f6P6j#tP0SnA|0L1j0n_8u_Kn@TEnGi!7mcbbC0f96X*53M}hDA?{>=Q{slTAy+ zDqTOG-FNzYFL@^1+w$8t7kz@na*!&O1=0yp_OnCHs5i0DeM*Z+!(3B6_-0i_B zg~pL8((#S+X-Y#v{edUsj)Za6;iE+n$mGJ>DRUl(hyM_rN~%%^4(7<;=Mrb=ql{^XvHrOa>Ga*EQx%!?Nw3Z?5p0gk=*9Fv_Nn z&|N$_npv+LT;Ob8hG!O$7kTo^%$?6Z?d=Jojz+BKZH_FY?}!G~q@m&=Nqg8J{LCql zTh=)P))BiOGEG<>*<`kYWB$@pB9$GAfyPvB@)y)Uk~+?RTn znn0UD%IWz~Zsbe*HaOA7p+8nT5Yz3M+Dag@%$eg~(B z9(3j^VP|ixi*BcG-!-FEpMR=&$n35hI@wsNJ*Fw+O1j6E7P8lJkSy0LAE>oS*57W5!_g8q;vgf5T)4^48SBRt`s)QN#^iy{~&TBAnTMUb$bnmrN6b*menp zQxJC^bse6LdKm9feYG=*NfLatTYN2*z~n|DUfUoT$FOhOB?V)&ze1POi9kexW{44$ zJT5XzvIg<714OF|hiV)Zrr*;(m|OP*=HU>IA8)@Q7G&R2VN#8m97sHhZ`pXUqR~_J z)j71RdaL0~gW6Jd%%}97FQHh|QwbMszFCz~?9}+plz0|Hx9U|bB$mTjV4j%LURM3q zdg?I0p@GeN52M`pUFe5e2t;Fm$}ontHF|rJR)lV2Z=OIb>;ZEUUXA4Lvz}9bFM>ij z{dR01C>C?CL-7dBMoh@?!h}O0e^4*g(UNfc0Ldh5cOjxxjJx0>4hVs@vg8)3U=vyf z?kR{^z!rC^S%$HdU-h~XDB3wb^V6yoku5iSe(sTBYSTVc7AF)#mu|Jp#lbaw(0xrj zHX$MY!df-gtUj7gvc58Y=SlH2G@xh(>{5}y44j!H=wNLWvqdX_QAkb-H_zl}#uZPo z^8jhwT{jJNb|T*Cb!wH+C2`zmM8c-KW)O5ND1u$OPxW}_*+=f2EW;3!r=;uj+q?mg zKmiE zWtlODMM{>WJuOfsZau#_*ojbf6e22c>yyHq|z1C zW`d;N4u0!Yf9zfh;d5mEWeCRGaQf3ib%q-K_{HTUZCvKG*Q%Xu( z>vChF!hE2o))OF)2WD>?yZ{(4wMC{>o2Uy4mHhcl&k7V^-CWl1#WqEStw-;3>_rzJQF?x_y@%!NJuoZ4JI$#M z893qUeq`bSnTeam(~~5E#4)j+DRGHRxi^DYZf_OLl&vlWdAOi+?^}G_E$!Myl z+=vA<4ZYHPOKhslJ#LjK1~a~t<#tl3?Cl_Tea+Vql=&EQsCu2Qni}k?5&Ybo)AcBlc)RZQy35K6M*agI{z|nb^^jV*r()^sZl5A)#5B-_5))-9J<73+osy}>lUX)eB`*L%+iH! zTc&@W_P`&QkbD!>PZPx$JmvJpjp5mVN<4ke8mR+QZ!%bNUgJ1^5^hSn(w+sSZ!lWY zOy-cn;VW#g7#Cu>dlM6Qke%y^+%JqwCmkx9r24+fMqSCTRV=kMy6i!jnJwS!_ThTV~r^$nfkkDG>c@yOy!W5vTDT^ z2DSuN+Ig;CjViA^J~lsKL4DG7I$IXn{SNDORY(#IhX0!#M?1W$H+u0K+#e|B^BAk6 zk?BsgCe>n51j8OKxp2MVbKc#dmw+&uY0}F?rLtMpfyJ!Rx=S$iG@g5rT^==V``jvI z++_i|!3n762DTY}UJK2nE&kdc6h~%o9dq~OHYWdV1U^s>_aS@KCxfK>(GZEL8>944 z?UC^}o@X#>-1Ynq>Q|6AJFH-zXKAK)lj%M9$KQO*w_-}t7%lSYPl2tXhLAppdvo1H zVo^;Bn;(_bqFHvx`|GjUi)WNVwNa2zAZC9x!TBD~yV&O+c3!Nb_a&?R3OGYhBC|r} ze{BqDf9*BCtTD7)8!WKENdCkY&|fS;h3nX8HEo~7P29lY*5tylCU zm~8aO+rVmp<0L<#pvS5^`ONdmu@)MHAJ}(DcJ&#qY12I}D+Z@{2Y-u0W3xlV(ekq1 zbTgtAsIJYgFqJXno}p3T3WK7LUE zh{wOfJ5EnJV{Sj4o$+fWTdJw&in>swX5@5-DFV8imjVXke-M@qHbbpiIrvcJGQ6xd zad;9sE1VMb_txnb3+uwaz5kASd3Xjo1mA-Ts*;O3CCTU!LcJTS>jG;LxXVEehiukV zzN8UuP}T*;_$x*uSaY16Foo2>*RJ93#4)^+hgo?H)Yrh3yd9)s^c9MP$Y&*H-Hm3R zNw266FJ2xE%q({=Nu6>fgaPLg$A=?Br&iJLcgQ%hTX?ZK^SS(SdFU{wgn3R07wvdR zn1wPlaCC!hL=y8$I$GRUTx^oV(9GYLnLJ&)4IMNl6zBg5Ihp7U|6J;K^T!X|wk4Dz zn2U}23Mf%OG7!cDyZdkFV2=!sQk`8Z)4anJ`QlqB#K)UvMv~dH4Sk~|rkOy~0?5+t z;l(xU@)acIW46}95lVif3BdjineSEaYAqn4yind1o*{xhJ+Bj?UiOr%hjI!(JZLmr zR0)#kHaU3o;+|~+&>XojIha2c2T5cYsBEuDQ7i-S=ow#9|6rZI^JPFy`*uz=gLuzH z3;5*QaL@ppIABy`AW>(ik^z`&SJg;WjHFki3ZPFlD7xdPB@;I3l%~$;?Mh3Ln3}5o zBK{Ur-L&dimCPpK`fXA3dNJ7O$+QvPWlLg%>P!5*JUQZT0+f&Z-b*_dqDd~z2vTG>8GQ7ADen4)#WFPnH_WOLii&NNe-DUP{`WeY0EOQAS3n#F8+2#SFg$UDSaO50gm`0T^&)USvWkeBc7@-$o(LPa8k4t&Ri+5~J zBZl!6w`Fa>WT3PZyn8_X2;TrJ0-OFwmXwz403d*{H@W$ybQ#XJ1W6Y;8fuB7=Ao*D-zblnbcbXw+!PU=FWP#pLw z^D~P^nYw=OBo?G)^r!cJ`N!eCqMN_ZM{6(Q#Km`H*<9oX+Ud55&(ZyGq92ll5l>Zp zUALz94gNAM=1ow_pm;i!Y_kJ5{WSl5+2sYOJTCvR+p`|}8j{>9|C*6KT9t=5&otjR z+~WILl0}@dBP>>(*f{egp=O|G+P0@KsH-Z|^k-qIUx_B+8MXSLMYxlUKVY#Yk5Xv| zGrj9xO*s8NssZBk0qQRiun~?ofCq_@i8#7-+9?4ZL~6h7(rxH2Fc8&O(Pf(Cl}=uJ zB;k8yrl32hb0+-ot=wCqd~ZLH$~;F>z_(M@_v|KdnekuuqKk_2OASAzgOWVFAA_Q- z@}A~q*cBCFkKBi8qdC5%w>RPwv;dOm1r3et_^<&8%_e`;{Pg$+e7HAC;`wl z`?JkUT&Q(%?;BZ4AwO<|YnCgGm-0H&&gQSxhMb-lK{vlBs#xl%HjPiu53*wE?-X*k zZ_1-Mpe0n$>@Mitmd%l(9)WSr!%G|8H}^-vVQipqenyVc?SmhJ*IUZpYzxFfIZc=@j4ppUB(0#;589Gx9s~Vp^ zS0?16ty9l|@$7pYm`8O8BZUrpOnLRif-0ueJM+mAP^ffhO zdkT-FDDpHdc7xZ^s(}@{&6($}{VBWGS@J_l>wD3q;Yy^ggzsn>VB%^T-WsFKP-58; zwWsboZImr!xCu=R(4WlSs$&S;QVz{Xx}}DAk$!gfh}lg0FKIp+q%q%xttfTAMO^~yE%dZD^VqEjBcWaY@+GQ@p_q*d zx^aNNzEMb^X&7hgrbhbJzEOR`opbhb6Q2V{CzWTS=*>|g5tfI$xM@2qfp-`tgx{l?g!04m> zdUAhZ7d1v}Abz*K+dU~x)C642kd0j8>X;WEw9b5{WCC8kTVwWi!PWD_sWDVl3XgU9 zP}EVHfd*1XK|I{f?+&lHM4_zaiAMmqvpYq~5kmt$9PJaZrr}Vt+rAOX5?SXD=jmFK@GJn`iA{lI5IP$XM(vbzmfUd&&OTPD(lNq;g4}0;=$k zYgDUk${l+a(l?=77$ti5Iju0`_bIS|XXeT{KXg^gzX4jLyxrGRTYNy@-|8x{$*X=M zj%Q*#JfW&mE#7zCEF)AFlWH;euFLYM3D@n94j<8XXh2lJLDq#}gyb(z*J?%>#al@`%HJS(&RWU zT962Wep}~J2uS(yL8*`wGY}aR4)I!C@Z(T^WWiMwtD3&TOzBB{$A>7dGkt6+Z|t-; zsxO~TZDY|Y?=AJ?&}wx05)fKy^0uBffAcCex@M|X5*EnICTmSzvEswgcD9EnLr;Sj zWr|ss7uLw&&~xGun?_e+A4C!s8TXMdP$z}QaZ38=D{BW`6?fvv*IKveDML>cy{#}U zt2z~U{m<}jjW)hg(R^Z8XIOop@Vhnne*Mkb9y~|aA+`<637BRZ>u`M0jUKyNYZIg zFMhnfAu$+C8);WHOZ+hKm zc2m~tVRF5mUy^rkvnuX0iRgf=dxC>%z8rL+plBA5WLi1KdkLE+R96mp4&f+k%cD37 zY4~P7v=K1a*%y_M|I}PJd5|F3WL7Tp%E}yB!9(svwE@f}0p*u^mb*{w=l_%olq3H% z4w)VQXUfp9n3>LcEH3I_5&f$)hGB9W1PhC=4z8PSSM1;*^0LQwV=|xc7&e;U6q7*k z!L)FU^s#INtH8*pU+U+(@%Ipp8eqMPMz4i>jl+8vQMVDxJR?u)C>wSI7;gPHYWdAA zg1VR%hoRQ?ii4m@lL6YAyUM)gGpp%V)dvD1H8%aE77Zc=3h!(Keb1S6y&sN!^zmjt z;0-w|#s*C^I^=yVT((6RvuMM2^L>!l9xi~i_Le=dhQ#73{VzJd@4}XgPde34U$`9g zUa7AKL+N{N$z6)f@4%h&d<`28lEzzc2n)1}%cispO8fO>m@wV6fFjNo92Z@iRkpG5 z8IQn7Wx;UfSkq331AL14vik~Q{MP08U^Sd}c%eXU0M5sA>~q} z?7RZByAeZ)l~8YPfeZ?UVMwEjM{$ANs8ST00Hfwzz)zlacgVFTDD0j8bFHZNbta%A`%ABQf9^7jueuA=+WM@>ftfp}UbxfRE@2ZUF( zChC=@wXdV(iHSpTo@wi$IK7x_{ykY&$Fom5LYwfnXRB+GIXQwiPU)PXUMWhPpKSHd zW1xFIU&nFO)j5h*2w3t=2xH2IhMucyZjF7&e4@X!U!@^?I#)nm&=X~gZ^DgMJ67_tqk<%qR${pT2gycgz5V&<` ze5KAV|1TEco<0y{j(M@qKa4w3MVyJv*ptUadlK5;1 zZ(5ckZ*$;<&9*-YvGR)#s-|7B?aqwrMI|4`=}i=BD@FE|RyKcM*V=Vm(sd6BTGzUT z=&V4{>W=0b4K_xyeEGZ$wK$bbU1apu4^pc)HqudhJwoim&5WMN1sh%arKUac7gJg* zCGHm9_33_A4xvjoLaDpn@Gk;Fd5Cw44Vi4}5eNVt^wNCz>OcRvAfNv6oDXQv` zUf_}PrDSLU`%+qM>e7EBsRG7T;OZU#WVK2cp4uv1KNuX8TM<2fxgs3z5(0Fm3)|Qr zV0pm@E?n<^rWhK=js^vJ-v0QqgR<;7PfxnV$kOnR3HY;r~#1U@Np-Vq~o zgm@~REvoW)7XN&^z&z z?bYAP=F=(XSep8Cmw&-N9MhQgexYqaNcaNZ(zOr6xt_3YKR22$-2yHEjpO}>O(dnq zSFB^wo~-bOM$pa_@;!oh*&A3NaXzgLV;O&dD<&vn6Q`TJ9xM>QK7=KjWf0_w%G9sD z(^`0r;aep=e-Pp8>fyclsct&-tdJ~!gU5|UbaeX{whUTfucjwld!UC1iu2 zOwr}T^3JCO)tx*hvY>a^f$r40rAIPh}#(9dfcz^Sc@$JF21 z2n^Mi33wdjSiJkJGg(>1DlM7-Ip=XcFU@y^upgV4txM9Z`1;0J6OMm^{W z6?dL~nn!>17}GdzQ?JUWjA2#|Z_Tw4-_1zcn+kBiwqn7d*XH1EJ|x|_lO8?@)Q+Wp zn{ef85(0o6|44pcwXy19z*?HWaEJ<)IdQQ&j{FpgSSxL6DD^w&i7%t?JMO{&8e}Gl zc@1HAokQE6u+Ja92#MR2oP3@=ujidWN&is)lu3cunz6Y{-4;}p8Jhp>%eQB=r)Uy- zjo(4bOaxSOTcPf#;iSJe{!WR6P-JE0HhMs1(*%ozMb&=mgJ&dC?JOA9&M@GT)geHm zu9t(V%zig`Sdvh6jHf!}gSPcinfhK^6?iuErI32LtW8rz=LysNMNzVagM$v()h;aa zk-V0fL4rGGBseC4-+f21J8QaehL`oWDw5;Oa$YgfQ@88IJ)w6(Y_Esz)m9pAOMrn! zIRT$q5?`M{Pz1Yts763~dKP2eY~4m5!YF{wYaoWS`qS62((3f>00CDmEXbQrpL13N z?$oXtZ#b@?x8Az3OTR*9LjyFxzO+Lpt+pCvOoqBRuU+$+6xA}(o1#l4Urk~R)I}VI z<*n`%=5x=lk89~%ggpQ#;miHD+69?JSCq`6Duai$J4d@mP^{P7bQs79dS$>cDr)p{ zfscV@{4zD};Gnx4GmTTc<`;4$)~Acwr^B)B?qq2YeSD$nYW*6Oe5^6_UbQi zM6A)PeHL2r{RV4>?u^aK>YNk{|a@$Pqm`BKy;yrnX1S59(&*ANT!jTMKimav_w>Wh`fwn9%LrU% zYo381zIB|v=ZJu+X%piXlDc-?b(XG1cG2&#Mb4Za*DUKse8P18B>Q^VGYIVJo%GQ< zX(vY|n#@4~G9iT-c2SksqdM}^@$9XH->Ky9T8P+8WJA=rFJtb~=_&stlK&Fg!hHBt z`cF>QyM}*$G1dww)6uunkoYVct zWra|?fEp`he?Jgui2c{sjb9rewPKu&-hCJKM}zWzvW8Jc@ZJ&>8<@kRjtjBH%2>xl}yD$Ixdg4O8$q~!E%MIVymSg`X$g3+ZEtQZCyV~(V zO2H&}Iau6~ur|mfX}Jr>)Zd(cpUa|>0%=*tKh#E1Nm7UMqqYSlz!5m%-xG=0SXq(i z{(7x6^5JOic$%I3|27B; z4G9?!E_-)2YbMa$g#mOV@+dF}O4e9#cNr`rCr7tLoHgzHu%0H2RgH1EWk`}ojU2|IaKjmvB z83mHMmG5yD1c(&1pGf7RSuS?I&r{q%R)^ahw(g)lZ`_*g)FJqrM)yt<2~3wwy(Axv zdj;MX;W31EST!vQtl~z0Q*VM4Z;l>RO$t;XTFS8t4 zMY4y2-V|9NVZzDVJA~1S(J?WKSlSFrwtp83iU(4ZOh`z$y|c40G!z_Mwknc8F!}T~ zo-kq0zeU82?!NPP%Km?$N&R03Nrus>d24y3M0aA>I)47`-zBUo_no3`=~Xa8{>_GC zt(|XlZ5U``ifv+wgPZ6_Z0yATf&vycHa3zXmP*FB0 zC}J5^f3AM==Y+nGoY^7^LIuTf_w(IZl~$rZQ{~7%IXQ`&FGo$ujbsap%-4KQU6Xc7 zqiCDWhj5AfRfh`Fr52X(DmvwPm?N3AICeM(oCAgZ$s~MZjZQmMe`j1jud?#!veLk; zFjyk^h>(r4Y$YqTq+oxtnBzY&ss&Pvdhhdq%_$rmJ^YUtwUASB9Ar`+8;kSzE5Gu< z2+Xm8dnvP_+j%tFr7qJU5wQ||g=S{|gm&+AkZd{ki!DXFJe5vS-eo#wQzcdSOtC8C zzYYMurKf!~|F`tC%<9X*tm5AxR{O({+}w0dDPdu3zQ38Lf`pQ?5~alvZUvO}J89sg&RT;fPH=kOr}krgl$V>)(gbY&nU991qX` zvJFtQAOBBE{>3+fK(Xsa#>VSqA5=Y6FZL-^jf{2f2bllOniTQ-VFgv42Ht~O3x=Ty zZEib_Hs~>TBN{cDiM_i(NR# zU&UQw_|KRg{#v(b0YF+jnZ}CRR<_x6g!(Pp zftK}g>vk*GVDCb^XF2j0 zkDkj`uGJ?Dc9czc-i+<;w3J-XC0G5Lo>?QdI*g|oX!ZrC&e!UnpC$Z=9B%<`m7-0N z9x>`1ErrZ-XcaNuuSwacRqg!>p-EbK;oNT{X>5*tBDvO+XRw1W+X&nI<+ybgQBpIW z`_EuK-{TurxQJ-&`_dn$Nc|M7AwlSI>q>@UHMfN3sMN%YBt5!a;NcBJ2sBjB$98GZ z_+P4P|8J<*czO@}YgNoV8Vv{iy+$ z?`lF$zCg3(>^O_qi%P4d*x6QCir0z3K)TNP%+OX3#w-ctzhOD=HN!_LDKvOu9S{M| z7?S%@RQDbY*-)OPukfuDon{N48&oyVj}%H-0n`+OD(U+bDP)S^aA9W1bAfp47K zwPpUkq+cVjIneuyO`3a;8#U95)CNiV_UKUv{wlfCJL|<4`3#Y~F+V6!&L@mfO}D zoI$MyB*gjGf$_;|?oq$Ko7;RzR(k_S;C==umE4a%CD6Ru-ejHBrGNc=-o;;KOI9~5hMvedPGeCXy(-p zy5O*u+P8>ipkM>kA4`&*-?r4zDF|dXa7WE^>`aNPSl?KTmTqP5)+f~d^)XOn5Z>hu zaLoitmQ7CKqe5f=!1jzXzHmCQt;vlhx!%hC)&}Q9RS~L<8AUrhUJ?4<4_jzGcG`AI_n4G8OtTzm*`gdfe|9oZ7 zyjt)32ifS&F$rA7?=9}SCs|D0|Ex~IX(a4r@~diGbn1KkJc?=)E*_(~>eotQ##sNb zp_P-tD|Bnccx6R97qe2LYuN|dV4c4p8x;K_7O+X-T)lo<`Oa9Y{dAQHDd8T@-)DcC ze1eoi{P{U(;F9k7-+u;_QNjO@m6iVsRBs!M@e{fC4koc6sX51>-#)jaHCXd*ddt!I z0LDj2Df(x0P$48=HI>sYyRfhjsV8i9Kf^*1dh@M!JYVi&e}RXFM&eJiYh>Xb(f0`bH*vaK<;_o)?U@L2nR;^#GvzK=y&Z^?elr zZ{c{BF`Z)U_b@W|s&_b%JRIlE$37}sNE*D8Q_WD4QREu_avMHr)5jajK(I9)hum`v zhu(JsH$$rQ8jex{L50YBeJF6PRPpJ@RwCD{>8I8($;{tYNifB18tE@Ia9;`PpqSFT zJ)NAMo=d%|Lg)aGS_a66oGyJ^gNnQTI=P<8s-G^ChaLtlb!_aXw_cxZ?6=I#HEsys zg4)L68;9G0w|w6RZ+$RY`2qKIV6V%fPq4HJ&5<`@KcD`nH(!j$d{+H?qD_$ru)|{$ z6G%DF6Q3#jdadyAaPkm-ty>Sf$+btK#YA_vO9KF)e8hV1yU?lI4bikIxXIm4;3L9Z z;AI;gS<~m3j==E4{-ut!N2u<#Uan^>t*win4bU-ltfdJ#Hy<8tWp(^{V^9$f(hPrD zVZp}ZrKus+1>T==dU&4>;|mk6rdSTwQJZPsa;~ixW8AO#c8K}LLQXmRmV`5O+y>|g z#70EAwSW}uT1>swS8@a4iTy?iZY{)|Ov2rUe~u;9!5D`~Ebm?b7tD?wgY;TjD^f2c z;Uy7gg%)PSOCrb5SH=W(Tun|VPYm+3?$|2bcJ%6Jhg1Wsofl)N@wCqpuJWw^pgTso zk;NP;q)2_)-|FEJ$Z$cXak^+bHZdJ%*HlShO=lgLclO`r$9{cM4Q>S<>Rsix3=5HG zYDT`S*=!EzWR%Xr8*lnOt*-#Y0>j6n&Py!8df{YK$;vzw9itKmlwfs9L#O$1&k`N7!q*}d0Yu2=Q~Ps6z?;kEaU$)1hs z9?^Gp>5bk-4qg2_2-Spvhw92?puiF5W?JBUG^d1i2RZtT^MpJrYRqzF4?k z4b#Nq%YrcaGL4$q{W*)2j?ygCJ*(IY57!6k&~``!6^-VAyuj9Tqrt>vyc^UM?}`Mw z0?Y4pfL8LkOrcXzJ^Su!e)z2>pYpvap>ugdgo*Au$}Z&^d}mcOk7}%Bo~s=mZcnoV zoIv(}_*kzn(^!VFpiFvmHeQ#F%vY_gh$T#Kj^*Ku1&?6%Jyn651%}%>{*|z&IKN-i zRhBoQx8q6x_5&-!>Mg>SSJ}H80`oH_K%JJ++@;9*{%&k&eu>Q$_zd~JFEt?=HC(=L znR{)f(ci+oI|7)OX3_6&U}r??s$X4Amm&L;(*=9Ehr1Om9@sSySVoTN00lp^b|-Zd zd9~CiGY3n{0pB|Nw&YN>tf`l#i*yg8=}Er2A9PP9I;M*9{;b@fPWl8wRox}pOZIFw zaM6*Zc?d{!E6~b@upPcUx)uHP?HR8$8CPc`%L4&`Ty_&)wH$$G-!u9VW;6Z37u6rk zC>CMY`W~B+4zm{|H;emM5Ont=kIzfU^^P5n7XKxI|UAk0X~AtBBy;87=| z*LuC#h0FfTnaj~_#x31pSslFdN?^xiA7U>O#K>O4Vm#4K-inwM&uRXQeN>vU)f~UN zfjgSQ02R((?{Y_TAhQ*F6mFqqs4~^FwZT%W zA2Erq_5JvdR9g|in+xx}(yLAJHeo-a+iCex?`pFg>L#9|(tDTIS#}MnZ#i@PqEWYQ)7YS{IlXz7wlo6o=oooPmIRG__WWL=U_8 zAO8eRj!?~coiygGw3NGqaeu__52=N=da&yeCG+2U_K^S+zq=gt)(YRR&-!g`faiTa zd$w>oepx3Q9aXQkH^Y9gr!5_G;Bh4SXAie3RBW=@3`G~X!0<&BN9@vPvt7UOUZLzJ z&9Nb(uC+RupNL2_E#GS6S~*~|ZbFq#P5dd&v3h$i-gq6>I6A(+5>41MP(vb5x4BUE z>Ao4pDcTy0EuMPWI3MAab6*-!DRc#Yz0!Sgb+ajNkO30&P$`2qSPW<}b357~PDu^# zEN=L^8ONp=!<73V@bjBNuN?73&UDO z17{^vTi|}_>3uGp8wKB&RAiR|_|(<>jCT?gtLW!GwkH=XfzO+)NX5Jh;m=D!eVbO^ z2OREqn>pV1leHAs2+wMZPRa{&khc8+#P2-*C!D5{YSwVS{JoeTaG@OFJ$fM37Hl46 zT~tlV^hrPt2ge-bj-ae@B&7?#JBM`IoIZZ$vWZ+N*^qal%QJk^cf;xm@qdQ+E}MZH zqYUqJ?+Z`RpnA)9)liwRMAO%b6^Y&{VOoj8^cyd)?{^o_w3LissE2_&wyz&NLVfyv zM0#-g)gz@Tm9U}4@9M#gq3a*r`r4)FBTK=hk@PYHIEny8XKblQ2l`Qo3?CzfnyFyV z^>k6bMIo$QGaQEJH(tKvem8T_=vBKkSkJq`1#w$Xy?0CBU}{U(Yk>iNY7J8*_#;h* zO&@60n-OpxS0IXRT43}Bk-QYX6D(WcZv`ARo)0FbTHo`&4NnRt#t3+msDB3>7rt{& zA7G_AZ55%`BwdNW2qS zB|F_ixHkPuJwSn;sGSnJqp(IE?eGip5D*NyB)aUY-h0$joFru2!ExO3qoZT_3Rl(3 zNF&P+Sk@9087_nJODmx_hrIoppq9tZSxwzBWCe<;Bcc+>$>tpFl&|PoTz1S9Rw%CChRYJCAdf z`W{iBZzqg_JvY&-9MzC9*H6~4)#~k*bn&QhVW3`X_ixAq#S7I-d{6yamgwNtWo^z7 zcwgIOc-!52e@nYRaL%)MDf>)zw&19RjHKi4+ZHj?ag^AF))>${pw? zH>7IFJH7tBTX8=wAuJBFYiv3$_aj~wB0J5pj9&WalHFN633pH|<7i*_WlxGt$OHGu z`ntFe#s=pWiQUdg!kN_QZ?AZFZ9r9PEN28fw3or2mO1!u(`# ze0P?0SO{Hp;AgRzVyUM&rdt+}e%qHr+PXXj??EK}SdFB5E4zKN8=EfhjN#8(MS0Vi zTh{R1k;=@e`Rk=mGZhj6xp_Yag<@?!TbR~xDcil*2C!1PFXy09;pCSH%yKjgoP!^6 z-;it$e^pQz12YQo{q0CPHLEbITT)koTgK&pV*(15%=EpMz0s^N%#amGmSx$siD2#( zn)#;NU=aE9J*71uc-vFq??(?Wcc%8#k+D(2w{Lg%_MW5gMy{`~BQ6duwoVqcGyXOr zA#A-kr+fI#r(69Q3hxK^r|KHc`sjaLI~0`d2B*}n&d%I8QIy4RBf6#G;pl&lH9icZ z3q2-V3ym&DMwAbHepr~AG8z4g5pQBG+&&$ILL2Jq>nkgxPy|s&-~7zU`Nw|rDI0r4 z;wW&`iH(bk%L)}j`K3#I&AjzrEWpUf2zd%&W?`ZDJG>EPcfr)IiHX<%4I~v4$;%W+ z$>gJ_r>CT(oSK?Kk~sgyuTdHzxwf7U4h{JW>AAVNA^r8Vw6wT5+y^McNEP@gk(sHf zt)pY7#oq`YN`nq02xN<-gLW*4N&Zx5ZwU`VK?(JsPe@8qFV|@%A|m=1U*>(mM>8xm z6F^@V`0qhJ`_CDHe?tu@C`=gt6%|84348P}I)@zi%6}(46qH|_{}mbgpKH!Uy`bjc zfV^v=c;LF5n4H{i$UOGwY(AC{%{~)E7MLZ@#KK}>W=59z)D8I}wY$HIHqic8X5@cv z6#oyttlt;>OZq({6!7FzI#94DGFzlWmv~@{5ho^FFnU zFG?-XF^PD7m=zF#p zj$S8R%}VW`#6I6=cNa2*)4X&T{IJcF=|d7AkN{5VGNBID7NF zU}=$oI^2ztm>`!C$$G9yF?S=gW8dh1zMP1bEAvW#xO0jri^Y$+}q3ukPT}$6TZktrocT_4aMXeOuYK z!q`Q)qee$shJDe~+8U*;xGgn-=u-YvyE&J?0aGJUxMhP)hNwttLIJIZN@JD{$4C&_EhCtw~ix%_Ff^hin8` zvsZ>ohtpbiH*B%UH@L8-zfYOVBiTpHGgali7mcQvTJsfW+uA53VR}5TUhZL1CcWu{W$_) ztA$~s!X&}>dT4!SGsutU_&Kc!h^5fWuwIfTinjPc79n$eT0wuLToTT$TgkR=jdBs8 zf&e^nhtqDLjb1A6@p#5%MO+^Oe$2r0rg0^CIp{!g`G@SGri4bb0c$89q;kJVGMa}r z15o8GAt=>-Ms~m>EB}m?u()0DvgWN zI!+XYCM+|p_AdK0Xz&zw{T|E43APjV)dI%(Xlx#XK07dO-v-MMMhBi+;CZ}7?zZ&l z;94-cBFFpuJgV05R+!iN@WN}yy*AR^yu7lP?@%H_AgAiqtDTjg-7dSOEra^(immxa zTPcW`T+l^2cgsq-bKwpwvn%mSbbQlW&CBKZiIWZIF#7pJsCfzG>`1eqb12V09#~Dy<&)a3`t&&J+a%2#5N*qQ))_C+e6S-xEDHp@sa(M=gvczJgIJ7 zhBUooam;yNl)dK*vQ%JIPfLjoPL%ETe7)ihpx}%4NlP}b7Ek&oThHTBVi4cKu69je z{6v-S00mb6LlqWvHu3`xqggAEk_pfy#P!y#?ZjNhy2-d1Px=MKxc8t~E*CGrN+7-I zW8KnVG6dRBn`W?Z7MB~23nsmG=3*27l`2HaTP|tKJoKx*(=hU_HGcD##0-K>wR~`?ZF$IXHGh(Mv>SiHT%zGmOuI<|^2sLHA z8xm{QkP!aMs{3?w@aG&OoI3RbVYBhZ9K?f*%gvuIX`iOTVVgb^6RIj(- z4UTu%NVHg~0-4oYE8eXRc`o5ro|mFZI>3 zM7!6bm5VR5Uy$6Ja&uMlI zlIF%nYz|^OX(7bcRz7sBUsQ!!fRZFSPp-o7{MD$*=r~-PNRT-KS-Db+o<1LYzL%gj zRdU$Nd&p|c)n+Wt9;>x(nH>=mt|vT`EO6s?o8Qqn4bPWmH7UIEk@tQ@2B*!!xM0bv2uv@>1Eo(M{ME61wL+dIAC zuCRf&VOdVQ<2UZ#Rr+lDGhTSGbcU{bzv1iZdg4#---Bs9^3y;#kuT*=EOB}EOUh5~ z`(a{@^z^aa8sm=CPa=7}C2rDYr}{6L>gn-z;Cg!o3zKn%!s=o-35A{1uBXbLjYLHJ zb5fZ}x(tsrXHJl{e~(Sa6x0f)T0|OEkj1leQ;O({nL!S3v9UjCu$gGCeMRUhFO=sL zGtmCDAjYaC&mG^<5S8gteA5p_{9Cu@mvsBL&Ap=l2hE@qjROCxy&BNLke9JnD;GD9 zhU?BpvU*4b^|g)M~SD_9$Tzs?X=P) zn1tEMW8GW2h1W}U4m%w7XOd6d%!9A*z@8r$T4JQquVcW#9{MNSue}>#&i!l!>twPF z)~D2x&1v5lM2lEeO||-u)Cc!wV#dv`Z?-DYq80cO-pd(cm8IZnMY|Vff0Ot7 z%kqOY<2-m?132daqXl_s^faK+_F+o_XG#;fWVBiZN|r9A`5GNhp0zjJtzJbaEv=9w(kvYG2@4(UbtJT|ZB$eC=2&Y-}^%LY^73qv0kq z>8z*AH)Df}Jkn8&f>!8s?jSr-&B3VfmtM+8y+1#m4V0tpQ9VUO26&#T*4Ia+%zqv5 z%50pY%NQMsxf4Uvm)%2GM3+>pyLcnf5IrZ@G~)QAfiz!0<}`TW_EsI78ny&7h?~x& zM?Y2=hJAabICgJlqt9X4la$D?SDq!hh{I$u(CyI%x=(Xt|0u-P%+5yT=(YrK*;QLx zarV9+EF`?dSKU=opXIy4VJY7tjF2mDjycu2OnyT6kfC&|C1*XJSdQ0-!_(jx%T0vR zL~8T68P&c6c9m{M*$!=-AwXTFg4yYyH~>9R%Sj({ z_Yv$Sos+N7azL8-(2EVB| zfaX5=N$$8dM&rbAysO{=X{AOJ%Uq6|eq841Zi#{vYk+Oa_z~CXy zm8}Ws_{aCg)!1%z`*hlB5>*B*Sl`lehzU7Y=GJbSSKBtHLhfkKGc*(|1sEV5f) zd<~#Gjr+eyd#k9nx;1RHPALUSDYSTTC%6YFP&7z!cMFz6aBXoZ4#AMiOLwT+dr(?<2oAb&ZSbaF*7$oT}(}0@KsCh^fF(J7C-|V z3?Z@u1-P(%kBPyHOwNJg#@moLM>EhAPG&7H;ful7nW4Ta`eBQpyS-5|ouD`k-!yB& zH@w3LyFIhR;x1fKnLO3Ou7=PiMW^MD-vdLLb1umdMsJ<$2O~|*&EiLlJfhmuJ`vGz}4F;eM%{=Ly1aZ8)A-}<@IUbX!&fQI#FR8brP(cR3>vmAPi zI4B8kdR6N2`03ET_U|=D7lFCyJp_vxQz?|>Env&Op)$qCm5cg(cV_hOmf9gfCSa0c z-R;|}uajr&1s!A*w#I}F$!E(`uM3DK4F5LZx~4o>e_eL16yo%zi`Z^XG~<~Es47>a z-P0=-gnGFuFsYtqE<}HwI-2;NJb?xUT$6+un`7(Om5t{H;ol$dNv1OMW)qILcgVaJ zH0FB(pN~41D`wj;49%Y`KQJANDqYgq8$87nIPZ>R9_qrz_(RQ2-+Co1Q7K;Vi!mJ< zJ_vhfzM-Ce^%ar#jeug$?Q+Bqf0uWo`pE40p|#xM*fvaqH+R`yWjv6#c9VcTtiO1M zE6{x92P?&%a%uU#%0BmfI>91AC|<=l6K%pn7roCL!P5!7!*!cZ@|y%8daF8`;>| zI5jy(>U+83g7UNAey#|gkbPii?moo(6fZ2SB7@91@} zjimmSl+|}#$Z^Iwp3_9uAU>9t#-6^?h){uOU~q%%h19dC$QGdY=XzJ;yP?0bkThpZ zWrMBTAur%>I%h=JSXCR7lc)LqTT~GKAtrzLNbUfHzMc&K%XGQA6N;!7u1XiLSb^w?BCth>yRPul;}Q+0zbW#`SpEC-*Ky?4-!Pgz!I^}WyakH3FK zdpA-9T>m=#g!(je(EDN`;$*R6i!8!pu84ddEyA?Zp&G@Lbdee=1Sv*wvD}x#?3;ykQ z1=$4d@9)~T@k=!G1rd7UB{-SWuxDyCJzg1uaRgo&nJsiP$H7~n?OdX?{`YgppCj;e z8$a1`-8etPg-;g48hc+o^N`Ss#kB}D=hLQDllIUB5t#72k?y@5=8*D@k=BqU{&#y; zJJ|Er2)n8M-qLKdN`m{`XZ{J&7*oY@pJrm1XNNk8{jMhZ%@ZfNtB! z(0#>1oUFd{^KH=hjz`vL;D11D^nhLyJTw&=tTmK6;<)jzG@uzo9(V#SdewT|k(lgoz0OSnTnfA}#qO!)*g&kZafxvy7 zo~uuzc06i}0uSxMMUlpy6t|8knIF~Cr}L^(k{VNgc?*F&2)-n9m26U`^z zf)m?ZFD9{FldO4rHt}#e=Xq@B_n@X0N_rDwA?cQ4U7I9{PWyui9&f$}-~UOdqA#=l zXyIb;fTz0x`?-X!bRG%!`1qm?0gc}?<}RPLSVTWf#};@Ed~(ybC7yxSwIptD+y{Bw z{BI@|da0iOZ&LE3M?L=&wxYohhyUrCA3ZW6MQbtsdwsz8zufMG*582Ws2@e;z+i;q zT>o!u+sfXa?kDDdfbINL)K*fQ{m{@*=~{5qHpb~<`I8vHV>i9(H&7c(!1z-h9v*Ei zt>`6=H8D#G9EqrJe#Kb-LgJIvx_m_22M#b~b0W`$Nzj;&*fN@xjHr+ z@-QCdBoDye2KEfPJhXRgecZ&mFa7sve2Xz6)dTuyi9~zQM|?=%NWpRmdc6jkQ~#Km zV>Dg;{ng;a%Wrx}p{Eiqgm0*G)>+M_AzdLjcT4xNI~&e`3)+Pld|nGw^7g~>whFlA z2YS<7QqDSY>3mJUt#grl_#*= zU993&?ps|X=jmv^O}>m+Z2+G3@>CpAx1R&)Wi`2~y&Q=F0i#u`7IGPmub?cG!zs;^ zST%c(qeG{c^n?nkr4Ea^34dHL#vhGnG)n&_vsuSzXzUUid(vt$s=WiT8wjtlRJkp` zM|8e-YJ)Jy;8T3?Jq12^8;@7a7@ogg(?%74YST9wVbu0MFI(#XQkS<06{uN0Y^2Pe zOnh+_Q7$XHNGzNynK?h4VO>}B-_Se8!F5R&B+&VMXQwWA66W%{@u9p29x)BbFg-kJ18^5-8?Eun6j)n>?=Q`_rQ`Hu>MTvcHwRjqZJ7*cZS80t z&1a02xmJ#N-g2+(ffIf7l+wKGn4iQUk-=*W+j#5}n8OxK%Eo z@D15_))bv-Ji~w+-b`}UU(S3HXBbUsQ}{LA|dHN z>-dCO0-$xS`7BEJT1h!mu4CHJxs>9tmxgp2UP9TNq7`{^3F7^&07U+pXZbvY(m>0D zJ5iAtEcB{#jXHD$|e$a~#hc)GFSXb?Hn9VGWLOxFfaJk<8*q zU;Wn3Z_PK}C4&t_w5eT9CjB#{m%cLd)YBK^Ri&J=>TQKPK}cv7b4C43ugpS0gq>Eq>fLAIw6CVe;#+H`qkG;>hoWxI-xh-xUS-djsRlAw~!_0?ycQE=<{@HAM zf7-bk;DN4Xh;%1nVV>_- z6z&KGfN-H7EBSuH+EJcTkgwNfGEvj-LBFsK%^V=9YO9mKIBP72iFb~K&lJ~BzJp;XZ)-Xm!*w~}MuV7RHqta`q zHT@iDeKjhrfiO(8gp-$N765(uMh6*qae+5rpH>P>FC8eaCdJ=303Q$$`Sd*<1cOd)`%d z7#5t1?ZJVHxIe;Zc3I`Rr9Cs#i>#7!x2c6_{^Vt4#UbS2UTv( zJgd|<@ZDOIKW%xWt#W;T!K;}xYyHO)FD7KAaZqCOn~=0in#W0k95N5v{qCm*%8IQ; zTN?RRYuOr$^(P~W+O6TNC42GJ>w^0x@w5VF1u?5`nD{;?)cylRaiIo5n%eR2Kc!Doyc}sNccY@j#?PW1$HL#6-`hD9t=P5f6Pl_o~d~eA=*c=>!LT&7^J&2X8{3K@*?bk}AT1rq8xohW(jL=dHrUBVIzzCv{uV zFB&5!{JA~hquT@JL<1vx#V!@^Au*Pk$rhW$;DL}`+b9x$D4GV(H?OZ#=OnZ-LEqcdfc!MLS5p3Tt&wDC zjPa`AXG@RBT?3+ms;Jz^FCuDmj9$&fJd@LYz!L;%?#*cKt-@RatN5yq2?gyx&p9s` zn5cR-MW3hp9u_a6wOZyuWg3n#(O{wa+|ZRtwHx7Zzc5(V)m`m>C|?K|re*8gn;p40 zFqPe2ZycYeORjs)XOeZ!E-yV!Gi)j{(P*_qzX9mk>Zv6@eM^$NsNpZH9+yH(J4@gH zJ9LlWA`n?}zA^RwM8o0SSf}N|d>2ZUXFhmyRh;n+DN16Y;@nUk*3)#!lk!5_t4n<^sE;log0HuXVl3@H7y1)%>m7r}#Sd{CehgPtNQiXm~- zlT@6+qRSgB^8_aa=L5+;5hU^ur){8}B;2dxhQAdX@A9#KHGN(Se)|xyAZy6)L&edq zB5A@Sr}sBJ2lyvMb2E%*)91S5Tk(E}<)Bq!F}uuSjfW^wy37eMi6O%b538STVqLhv z9lc8s1uP0Eyw5GP4?PLh5v>VU|7f>k2^qT(_Lsh34ZFB=ZobB)4}rW9n-ZiWsxW{n%xo9w;M=xblmyHd4URW+ za3yR&T+H42Caw0=Jna)w60c}#Bb7QKl)LzI>8^z28`XtX-el;ovTzMzr$eGt;G&6npA;8 zhqKB^n_FF>sL80D#GFtcZI6np>yA9`kBXwSKlE})-+oS&d}y3u;`I2I9UBB^&6?|2 zdgPKM!v_^D*0}BCL0+fIgKlL@qdi(%ljcj}^ut*Mqs?wihU0c=aJ<7(ka7eR`{^l1 zYc~>4JUqEBkQ0Y2HPkQq+H5akyP(|`;jh>N9nS@za>H-tLV&}yL7R*0soyo=UUcP} z4m_bVvsK2CdqG|%0#>=grsoNyohse2G8KBiJ`h{WmXZcpOY(6GBoz|d)F;hN*Qr(G zCCQZj4Px2;%g)S`c)>Ff62((VD!2e=s!Xxd%YlND78 z1wAC8-T|?fqFl!xR3pv{%`VI!LFF^b?o!E)O>4coXAiYh=)WuLHp|pI+bHw#- z_Yz%7!~#0J7W33X|qMh%AP#m)y)1=fnW`OC~>${CSQ^l0~54zeE0f}+=x3nvELBh#*IsY(2j2NriTB0Ykt zqljK5Vj^BgirjyB^L;7nJuloi=DUu6l`#If!1R3R3zPcTQtL6 z({Wqtde9H~vy)}IZ3KHrC$pV#cRfbeOq77<$_HtC@G7dl`jXI+S^mA}T>E#W=KYx) z2?L((7odG;ix&O9e5!@vD31J~feRsaKBbjj9S*R2 zqpUpr=$ep4eS%}`hwKJwwe8l%C*yZHBl}kE`(-8Owx>QM6(3dJXvhC5QY*E5c{#oo z>$o;L z>X_0Bp{sut(;MMTi5(HJJ=p2wRtZmmPi>(UK2ZjtV(w?TX|C~m z3haBsv&m#_4w1o*z}l{_?g@!((Ynx+q!`yt?tzmXHV!*=r^xNV9aN6{dC}-X`#9TK zD957L`oQ#fI(J^=pppQic}gbuzNq~ybd-K6rV$a!mB zxEnulN1eM|L6cmdM43RPvbcJHwv8i_{*YZ$-J`LE+M9DjC-X6wfC8Zwxo;vsha8(~ zpR!Co#}B(vw$awMH};Z=Ls7;QNIkI%QTFh)GbFAuXjnS?p(KKzGd4iW9@)FnGJHZv zVH@|RhW>QG{{4{h`+l9lQ5(d|a$`(vUt2HZMfm7BUVmFTYU20#{JV1=QGss{ij@j# zR#&Dhs7~MV+o+BT2UCn5FoMIG*t24H(Xf&e`*~ebZQ#gjqMxwZQ8K z52tzv8AJ=VVM42SQ(#hR3wQ0Iufdk7bA{DI#)*F3P{$&(qW z+8#aKKC{kQrVh)}{z-G4Qs5Gulf8h9JnVBxBUaHaaV4Qx-QhSU8+@Db)>=-D7KdPi zGUtS|Cjr+qU)d=WSi8G9DKJzYu#Y!0wtt4g*3N?r{ZjfQ>3tJ};^>R*)f`zxoVMcA zYE|-75?XZW!ghr$VYG?ysMp2A!*m(Q&X`F{I~yxf@a|^+L&CJ0)XG1J5Ch_2!E%FHqb%QbgVPWG50fj#CA_U+#L3Ai4 zjZCA7s#|?mX`lDKMy-EhV}xjWqL;W_N7^R$7DY?q3r6BIAMk((_;mKPdW3wPd$y*p z2~!pZkiEGUII5F=!{%*$ui{<8UBELEG0(*LeIu;;FSmn%{lZ*c${O#4%uAr*E}Vop zB(Se)N5#a3y6Da_`)(_P-06OkU$YhuR+Q%-ajS>1bWS_1sDTIJbp^Zisj}1N-*gN$ z?sB)YS-9jDHDrLva$e5&xypFY;^mgd_sMzNKQN$bsRS!srYIe2#+^VPR4b8zNSu!Z zniDd=18N;H$tPFGAR#uH9f3?vceT6t<;Ee|-!a1*rq;gJRp?0&lvno0DBSdXo$Y(3 zE$&)9$MShGBk*)g*#%jqJO2_epa`}O%uWw8Cj=bw>*zpavc5><@PaQG4Db&H@x|hHLfUVKg z_2%V9%X}M~i_GrHqCs6A$r^A(*QcjLwXnPB?9O43>&CH@2U6dCLSq`c%#j^;TCvhJAJnb(pYpoC} zy)AnlOPWEBy~kfa@KHYc{L#46%^@wpS$?)bN^9d5rPMj6D=A%C?UD~W_HUDM{6%UQ=-FQa`*ZIY4lpi>1hgm!`Z&q2xVAvX!x{N7+pOAX}StZIndkCmg65E z*HKAq)J1A7eYNpE$Idpq73!-KYK4*KZnssM6P!m}#xip`-(b(;@>UJmSuBN)tEhsW zu@SmxM7W1KU&ag376I!U_YAyEKc}oE3g3RpTGPno2i9f9kWY0vKB!?Lw!8hVBpDa1 z3```1I$b#HewL|sr$AC2vTULk_+_i|=u8c7C6?v@&~&0HM~|U}w1LR=3~+QpV(!D$ z&BpgnE>qO3WJ;R%dRPoHDIGL4i%I%@3=pmoiOF@fM4Z%c!{Df^d9}YM#{2m=`h4bl+g(Q!0lx|ITS!Pe z1vN_{W17b)l;mu7%p+pqIh8|SnKGQHJ3X+^&B6?ea+#=WYda>af6H-*l0i{xhZye8=_RvP($B9$_PY-f5h1ZIHz4 z{Hg0CbO&KP->c+lai6b0XlOKL_$!X6$Lb{qj*|4?kEZ<}jGjDYziA>K{8B(ETQ{v3 z=(%XEzqp&A4MvNLJwnc9XN^7bKf}_8uk=rS6C%86fK$+c?BLnh`WSgReu;7K+~z(dOZ8 z5t}7;yCjjl8n5+tXQrw|OInRBQ(8T0IEP!uCkNEtP4p(ZM{GYWd~o=2b@hBB&bx3S zEw4px6#|L0waBRR)KL^%TLHa`A!Occ)3ZgAsWh~=sz`wra&B3;jhbfbp=>} z0_1O-xxYh-V!Tnrtcz93aOw)vMMaWmW0%L&Hmbez53GvSCPgc3$O-Vk z_zg-@Zb~v4*EeGEu6i!FZ@^M%X$3F#eibVnpyTrKvUKmob6JS~FXAC?_DUidYc@9> zT+TgK@u0pXO+XF&>`YDZm%DZ8_VLV)P3mlj9Gsh1d*EFZ`<%er#7|)xAFk<%QziB> zh#T=N{T+qsZsaohzr_@Dnu-pLSGMwQ`mL8Bd#exA(l!<-$IHYSy~+7*USp23YJ#sz zdZs6+#KRj6!@d?yWm>1!xLN@PRUK1=ur>sT4wR+orB=b2ew}+M!4z+gow6E1oq}c0 zDW8XJIQnU0E8Rrn9BJ(eGuEB`>VKDgI7@zxSuxxPj+V3uon++#$|{v!S}2xj+{zVro}9C?sNLH)GO@ky*qj1$)wBN=A2Qr z&zj+W>6E6cGkgq?Oc%HI8$%4~OcCJ`eQ)571L1*gcgn03tzO$}y2Vdx`qB9ZGm2F8 zM6h`in7Sc-T`6fIjrj;p&GXp}reYBV;yIOI{=vgo4@MPc*38#}tQ4Xlgh;;r&EQQu z_v8F3h4d6q{@8d&{3i2Ye797cTM0q4Wwr}Q=nnIGFS>Hkkq3xYSh$G-4GB@S8;k2P z-o7v44!^2uR(w#rtHUKv+3m8{XYY_dxHj@G=THy|T?jqz2J98L3d=y! z)(tHOyd*VNF)pakR4h<$dn~Z5bL!H8l7|RO4hP*8(z=fq_(Sr&wG#3?U&yA9oMo;> zklacu(i!-AN@v_Jt)^p>IzRt=nT55&67?CKh`hy17`1nL9Az$K=~VCDm;2r`DlAd( zK|+wJa9TcBqSN8rT{Jt(P3ijRPea#ym+Q~YPb;J!4B}b~R+9e^u-)$`zNSe$XVIRX zOhKzmE;$s@wCK;xD)tsVVnC^xhd6dsn&Vhmi9buc|0$`gr^Kw-dk%unqBSXx#HJ-Y z2_Lb;T~%pXsdhDkF6b5({b-Ieg9UyZ@BC%A{twqY%9RC__cZuT!t}T?9k&0}RWz|feUZ2Tx|3o)-f z!&Uk>!S2!OCv>2PV0WwbK?I^~0{_70bnqT#f4aE#1U%6;9FLG|zTGs&c?ti|FZecQ zOse;2iv{xHLYu$icrcU6(#N?@TZ#n~8j9(zrel_?J+)(E`7n+;>-k-WwrweB7I;0Nqiu@8st z_b}Z%SZo)WB@YdF^<}hHiF+nb@x9ZlccrZ5ZJN13kn(LTxIoJf<>MiTq5RXXFy!%G zNUqsZ^#Jp%q|}gM^OWd}Do?kXmB2xKFGY*OEaP~|Y#E}fiy8?Y){*9YT+=2=;9FJH z5R-%x;+nxXogs1%uMYDTYQ2j^!f7h3dasxoqd043ci7%_1y9N`g%%}TA4y~<`j@^$ zMe=R-zNeA2-mg!IYx^8rh|2>JywE{aPVMw&H_%=B^w@)M@(J5)lp-$Ilw7cZZz`td zV+$cE(h)0eV^6^p`|ql1aorz*QZRuxA}4Lku|PS1%rk3Mq;h)AueBL_y2K$e7W(@= zB8JH;ohq%J*Gs9IS7Sd@JWoW?sHjexb2P&6vI+NVG#F-Ac3o4ISny~x*|EE+SN+ty zV$XW540sIFlY7lZ5TK@!%Tn*kt33tk8;vhOz3pl$RhbpJJxNpUJ+}?2b}g;BkU1UE zTR5Skp+wT(-Txn@C0|tx)`L&*eJ3>@zP{ z)7?s9h%=Z%F5QmPLcQD#obB@iG~^-z=oak{d^9(B-rflfLy3#yY#WR8jpg(+lq;5; ziiKLuPN&k2jLaKsxd zbn)X>=D?*i+c8Qh;-1BG^W$8S_I#ZJQH9*F2U1v}?>tv3YQMY!hi;`T4-+ak60v_S zZETugQ}Gf^K@YxewPe05V>7I4z->^5(-*tXBtJ}$hKU|CDxK{E0Yi5>X8p%{?P)fO zE(NrPLo5R6OUze}$L~vYZ~t)dWtR3d%B_6Zul~vb9RXX9Toz~CjH85gwc)=;;O~S| zgXofh>1v+#F6#vEZ$A_*{COU@6chriXu!JoGhlMl$~BO^XF*eV#Swg=n0 z9cSTQ@;3P2nG8G$wkpz9`MJ4b z#UTBHG^JZb+T4b^@*e=@ou|i=Sh8z4F0*W+SkR1=Fb%h*6MHTqmeIa^^Vo3VSMhzA2U{I{|ez>pEQU5aMY^p zZRgZ{E1JDCw{Ri9fjm0kUji4#_-qDJ?Z4tG0bKrg3*4sv=0J8_#%RgbjvR=hs+%>UEl@)~pjYd1~S3!pd zK|MeLk-lLAD?YdK-!avb9Ce76JJ%3#&N8(qKfWsF&i6;7b6~V zCng@6n#rf;yWc(}wrB7jK*@rzQmZc2<1m%Vo3@D9LCHNYz~mgx)qiVkEW4ozddKE} z2o4Q=b$8eHKK>%OfSZbQ@U-RO^;SChq<+(e(NyI5xxd@PBez!4ToIX`imM(!!fu&H z%uJfK4N;0&f!`zNq#2qV;3;eB1|Y8UsO?=V^VPZ`BwNL?4ml;YelNysiZ14h0LIH0 z{@}1D&8&zr502DAi1{Ifv#Z|4VC_xgF9ZA_Z51iC+qkD0#K!Y2%+>T$})#{P=9@g&<(w*Ev3Xr8TAb=fwX>&wP7GH~YKB z8>psgrdjt#J@CRO#@o%NxZbg>-@cg2V#*qKD)qliEJ%rBQ@I^Kce`%hLi^x86RMCw zDobHhH(6v)izp-OZ_!&wbs}mRYp|QW@p0?;Z)EM4LK0WIm)-@z~ zYuO1ZW}8+YoBQh>k^c!sZoM79&I@~kZ&Ulp$AQg($YMmX)|EnD4lo@vzv0={5#h-O z98!@?=`MbFhelekRUjpwGOXt+D*9)pt;ntK-z_g3r>xkX1XS=e*~v$J$%mgtyzQu1 z8QdYs;04s8ex(3rGhEIxe$h0+lVyC7tW`Mhe7ty)FMNw+hPimtm~f(%Q75k<2$4I& zS{2R4FB;GqaekFh(n-uPbafta-?=g(Rs$=(}JH0yJc9?_n1>8}a1 zcz>>$V_#uDeZAPhS(CgUgy1>qknQ~+766%1BWx>b4ikQth?@+X@NFwl@pD^itq*$A=_VRo7xX`wqHat60Aw7 zNSH=%mvKxl5$GB6P@$~NNd~7jCFKTT=f~bVT%sL-kTCaAcU*=^12ugeR?0d)wt80 zkOH(#FYZx;Xne`6#IpBVQNo9qz=Fgroam6P(_g$TOEKD+!CO*Kyfh?8lb1gHUR;*W zotCma%BPZbBYFl9u-Ne}C#9})(?zg_ zF?r5%MaHAeRFuDZWo~ArggQM9J_uNQJIlVXKNl&m{(#}(3$5`wyh;JGncMIRffpxh zCkf&_XIV{sd`{NGJe$0WFG_18wRhRi3|qK_nM7rBFDo_x8!r>=sLc{+F-@(lJ4xxI zCXvxafd@UIp^myI#wG!Taf%IY0|ouTzc?r?cus$rj6T~ZgQys$6B*Xg2M$zaa)-k( zfil4iadz*Ur9Hrs{hlRY4Xlpoi)CMXoAtZIOx??fk~^2t{di25Q=EpdnMmQ@oxLUS zmJPao*z7;4@b*+Pwy66_hCFp$%+18 zB)*j7Mdz-$$Rr?K)kWK;`77GB61;fFX*Sw%PhPq zM@|RDzfv)rl~d$RG4OKC+r97fEmc0dU)F{NImQCCMrKU`={c{lKA?>t?W&7ziZ1E4 zlR&&udVYl@<*Txzjkt1ilui`aNiCv%VX3OUy!5_f$%urIY zY`q*YtIHbtCtKxPuv%&ZTDw#u;y+1;t`_Ehy&b|-(Lb2ZUH27iU1UODpXY_ed;~5m z#_-C7mne>~psXyITY{V07=5P`2?6pq*V+rB!r5kn)=*+>%$Y@cUoZELpHFr%HOLop zhcqu?bMqQ~21HnP7LrRLO7=zvKjU-cIdhyj!}&SOE}u&>c!=!Xv^LYZbP;af*LW{Q z9q1>fp<etU^~4pZ(7EH*2%_ZrFBSq&o@1ur1w09mHl^*D4* z@=oZD|H2jN?pSQ&9l9DPzjofEb8^vJT`c}Q<|8doUtw*wgmqbUGSmw?-0HOc3_tBk zm7WZ}Xp#=pAuJu46U;U`=DGat@KkhC`?uQ6B|yNNX`JTPLc=Z@d=Yg|M|51~91t#B zDI4nw`gN9SqXel(S!S;_{Xwkf3i@Uaoz#f)h%z#uZOGTt_%Wn$pkM@Qzgy|C+Q}7Y9#`kFOm+hk-0$2Y70F=Bj)eBBK>y zlB-{ZxV$-LOy1TPJcPAW|K)5koz~a8S-pyl(_|I*J=pBzBWG87I8`Nhl;F{kFO|aC znr)WMp0*gAsfI#EtBfTsq@zn8Oi<`4R(P&JQ*x{5l;GgaIzdk`_x0x4X)aj9{`;X8 z7B@7sI=rBHJ7Z6Hwh&6i{Qy_?;vR9SoJ6!_^lZ~Kk(F)+hHi9i9vU!&(&qbMvC7mk zDw$=YOIojAr1*#*n)_8lH)>w`pE+V^PSvOb>RyeD7!d31%n2LdXWS|4=q6}78~s?z zY1XjE_u}~$d%~@Tb5KG&t6A5<9YQr5t8mx!8aKDM&JvH}U0bY}KLt12uWMy7y_e~Z zn(q>$e|O>Dt-KY-oC^!UbSVrLv|?CWuYXn}%kA}>Me-?WFkIYf?>EFjyu+kCU54;D zr}CKtd7TFFM0ACS&D<0VT+3;z>P*Z<9h4@%w^akh*S~+dY#5+l;WgC5;|35?iA%3krInS8G8V zK$w3S4hlJ+XyUaOa%!vZ+FD`|P`cZe+P3cGqHZV~f z-i#P2@6JWn6pcE*3VOI*K)tojaiBM*{dM^c6k62EUUeW?#5Oz4l4`Ws>qPbS14kW; zw`+u1ng3|}_IkJ?fD1aITN*?!jjV|yXU_NjemY(-1yIlHU5w+NcBrEXYfAq|yOD3& zK{}Mo7c}!P8Tbt{rjc2kU*F0hPxfvaxp5)xNL?2O`Z3coSCj*xwFihM6O_R{sJ=$GWk>IywR^WFrdx43wavwU z*)!A}to>1eD59qhEXT^@ZR^r}V3&4u(b^Atr&+eF0V>;jx?;YvnrCYvI07CeA%0^` zYHw#7GojPG(R&=LdX6@~H@Rqxr4!yYd#eqg|{o;_YhIeqV#(@wet?_VnLk9CECv<{cTO&Hb z(sO%RATr@hjGJegi&f~|r{JATbY*0j&Qw?zK74%gZt^HSw9$Q-3_$mK&F*vsUR-uN zlM;rmk*sl*HeIWOmBz~1=YA*JKIronW;`MXw(>+aqoBkG=GD5Ah3q zshm22l>~X`pDRiBc7lC?+2lrZh_cd)=X=FhR%OY7trtSj$;ZbF;`U|VAKM1xepK>e zmuuD8U~b$Hv-iyYCU&3hGxJySTd{65{X%qobjaGS8J~7iuU$$xhgey1=#Em2_u7RH zUdop&W}e>*^+^(gem`of<&&%DnGlZk{dyX2`OmbI-<>h( zrA?n%UVw!|%bGo6-4xVBxXXccjTtOXNxWfdvetRANMaAec+HztS+GJ&=@%6jZWs}H zcih>@Yfegf8!j3IA{LH1fF*nAp5?-%Mv!Nt1gBw8|bvR zpO+~O!6zEX>dunQwX0fJ++51Io3=nyMEqkJ>=BG+s6?$;;wcnKynz2ryACqHE^vyFGQdg}EYEyQ>E2)^?1HdioT z-&RT~eUHRGb}~phB=5YR>#RObh8;dQMt{%qa~p=&in^nA*O45~1N!It6w(`F+<7bvj0tMyT~iuvI@lL$Wm0bcKrG$9bSGpLShNLI zB_zqNrt(`^l^I5?YfBETNdI7sz*#~xI5?el^wYz~laTJkZ|Uyw;o@ z0hsw9O=s+J{1u_g?-O26NTge}Lbw|s-4%?(5g|S^%$W)HqISG|hX_&IwWlVGfpB(H zf;?eAoH*PAlYclRbwjGF{ zUCGZ^v7@x$J^9I$Vw0M9M;1~1+4nV z`{WdMH>l7xhbGi`PXm@FU6bI{GKh3;l|&6Z62ta;V3NrArQN?wm^fr;3wy13zx<4C zP^A2@dc{*3Xzx2%%aL4{?v8H*vb;tG<;Vmed%9L8+VzO zo#xJucapdDmktFNggo@+{x%-S66~)Z;5W`&XD|6$ODUypaBm;gEa(w)U?k$!wkr=3 z?yFwTJ_`>d;68?Bz)Xkh*`H3xxVfYSGz1tD9+DiB#5G^F0#0!%lno7&N|;iZq0!NY2%H}dubP!TCg~6BM;+%)w zY_%QrT4OJ7>Qqx7#*VCFqM^O#h^0sd!J%g+pq7=ieCJ=Hf#&85t)Eob<_w#+HgYCR zK09Vr#`Lw4s2!1A*46F9N$VnoQJaj9x{4uMa^7At{i2!^aO?M#$>1|%dbPCYwphC2hUQc%VUA$5}QP-mtUQ+uqlp&bn2vf-JWE zS5*pL-L@YM5tz6G|4+>0%<}Jo@pG%k_r6V8TzaSzf{|(Mxon(`P^`%p#>PEtn8vFg z2k@jMxkHZRN_)hp1fTvSbu_hnLoZF{7^NEFu%h@B=X*>g=*aUtK0wMr+wtpX6;LA_|>l5QZmW-((TcssQ(d< zKk;o!Gbk)$q)9zK{`pq(Okx1dU_KJVRZsa?=);K?=Y1G_{K(@QTS(R4mf{qODi z;$93)dXyW{NlqE1cFSLS=D+C-)S1WhKC4n)aE4eRf9Q*M^?&)&Z*q+^t@kftp&4LY z4s(yU(pDL}u9Y4@GA-fVWU0!Dy?@7g@XN`b=gHCEq5oJP#Vm8`48ClCcfh2ix=`BS z1?!r1P>GswpXGCKebdcZ%6^tpmee3Bx{+<@%GBi8-K?h7s zs&)AC|LN|lgWBGrb=yLrEiGQ46e(If#VHn~DQ?BRMT<*tEiJ_{PnZkNmugOsKUyKaVkosgM*xSk6JeGmSR=nb4!wqQCAqV z>}_~emmrP<$^$Dq2LY?*u^Fru%lGJxusEEz^Habx7Q_%ja;f@pMKv|bel`-359F1-{-nOyn@#rZtA{7d*F|Bb#ny=Sco9d5sJ`4vmD!K7J&f^ z-6q&P_VIjcBpe!nH}>3^xVT&rlD&h*ITdkS6ir`-7J4>eK&ch41#ZH|-cpm=&*3Cge zn4FXby5`dc3`kTbR%CACq4(wOWA|Lrwo~AI9{SdEWFqBl z-HXCjT@7_1?w>>TTxE30G)8yglZr@9T=jidg+~u+-)qI3-@Jlr z%MmU-^zYi{KC_+K+K{=cC;7#6HReaWs$Pg@6GZLhX$1whwG)j!`Jv;hx$q;^@^o8O z>j6nc$W)pj0~cL9-eeAmXSCE)qD2-5`=>VV_qU#kfF9w8STYV~Qmo~>HdUW~eQ52N zx`MVyys^MeWwtO#C?T}?>KE>!oi&TC(h+ukmKDjNH1CtSz-|Dbt4PKkzF&pE*7x9p zARBQcam7vPtmu?;FO|G`Ef{9{zEBlVOnI|8>GbvE3u&JX33ykaPR);i4E|o$qp%A$ zQB_lYdiqDXuYc|ujv~z}plA=s{O2|>N4!j$9Qd52v`Q|)v5&(9zofE&_hqBAjbeq9 zDL$l9nlOnz!}D6oWaWW6@W+SD_afg#JPLGVM8uWig5I2!Sh_SIS(%m5j-J?*Df_;f|ohsU(- zrAaqGZ8g$7hmN0GC=yoGOV|y}f(&w49p9$9yZK=Cvw*+&3(Db!SiEtTu04+;wByQT zHJPSuChpDc0++1+u{wpFqE4;S^WE$wj}wA zc%ZmY;x)l@Mhw*^joKLDT@~}Kj3tOBLemRyjdZZUP-rFejzJp4DAT`qFJm+H>6gSX z0$;F^cLc?WCfmXedmVqc!Z~~PuwbzfExUMif?wW@_z&F}QBcas0iNfDJ+d}Jbd2}* zc!A=~uKK#M8x&GcYLVma7>N#8{Ylr({n|yf=1eUGl0!wL<-@Ix?l+^1qR36}!=V9q zMNtcWA;Uq>T3IqRJnMy%`=PT*LG0UucZs{GU?tL<4D>aWq}(e%s6-j_?tik)^KO8= zc{?0SNTX~jX245ADXDHQl60?C;p?Rot{{7?5{cZsrvVT1;3{S>ysZz)AiJw$_L5n2 zyvv&%k@eZ-6fE;ub1}#5FNAe-lvl?AzQWW}TsW8rIaN*hD& z%B?!DB}Gcy$;D=zzL)t!Q9G}%VP)~{)4&bt&_s8^DL-01;6~?9wSb;#>{ym|q57Oi zzTl>dN|VR{zyRSIEA#fQ;HZkCDIubnGwybJ3gO)}S}2Uo9UktXe_mZh+!C=ihX-$u zfgG92RAG2{YcRnLRVTjCEW-#EMrUk8Ju1ixT9Y8cHC%g;^;AEZ8fHlKbjM_CMJ0>A ziM!m3gZS78aAlBq-7@T-lZsnK?6Q`zS`&C*xmG0&qsRtt>z)g@o&b#hW(W7!sXjR+c^?{AXO6?+ zrC|!L_5L(jH&A^dl|`dyvtis6fs?sjTv%vjT~I-+6RZ5?kM`XhMCh2_36CiXXU2au zp?%d|-k*f#&K=)B+}a!cZ|Ew*WhYFGzIq$AxH6zYrN!XF=jJU?4O(Rt!Ge}?OAwPad^hOkkMcyO`}~C4D1m@9*?F- zJRc^Bx5!n&yY-upZm$)p)RzNdmmqFyXSZ?>?n2>WFD%kZGxIW{!+iJi;7&z;T`t0h zn*-~wMdFxEHunxr=og0^m+ci?PI8O6p=aJSLVCq z?s3ZAfGdTC3cuZc4iW#7>d~uihmM5%zIyS~8)AL2qCxhC7ut#KpZn&U-Rw+-+oCx-b+&mXXRurFOcw`sEbha2Y3rwY_3Kj{SELj5cEJ{1RaF;e-%3>fXU z1Fuw*q{%=lXUmR>m&t?%On!SgP)V(lk&@&IfiSYm!-Z_-)jYN1`IES|tD`T_rk7(= z`)mG%Cm~B-Z0QZh10ck*3TJ~yOWvuE&!drtaUY~-;O*<@EMUPCkChxAQgZ+3GMASMqst-(o!m|6G7>f&B>9dc0$|CvS8$LvTxP6f6k5i8WQ1_t|q=+x4AJ z?@PpbC+H0yk5ax}OMOIXSAWz&*K8E$v~G;Jaf z)5R8uz-rlQx&x%d#2pq9@!X5+7tqb|rYvFeimm!6)M3qz`TPQ88k>jr(ZKYu)078D zL+{`i>tHC@|?R8H0bMX&Kh9d$4JF#-Z|@ zseEn!5iXx5#{(ec^#`{+w&|l$_7z1rtxZp^@?>S{(>N?xEoYn0r@5*e@reh`kUuLt z-fL2*egZgidqcavAeLNor73Nl5|7#@S(OFO;NJWST9wCt?m?ao-Zrk29n?1!Pub&_ z-9Y!~w?bcR<(vE>Oz)$jJ;0F=gS6^X%DnzhTm^C zxh;)+!SMh?G}UN8cW%Vx+a-*~jArk$rks-)zAL&jbSY<#$>(M%QS z-4|*hAXR>!_8fO8>L$p}$EFLDox6Tl+QcYprl>g=fvukp=e6>)Rxk6dcosbG`ky&vvHJtlXv7bl9&)QXK#BMyPKSgfCB4w>ORP4lPwW(L zI#EQ?VJnEtF5CR?FDB%AUPTTfS%)=j4=@Zwf0xID7@?3M6HaG8VP`G)vtPms8U_nV zpj&l9zFdjdoOGohCF^Y(**WVC$0V?`af%7p+52+o5?)+MhQSTLD(VElIB6vwuQIuq z-P(K@z^3G=U(%TU>cVb)<78l4kAko>7=4o#Xwm22UlCccoF_t&*xwEUyVUlXuUny! ztSv`FJykQDoE^agS1t|3o~Bb3H`?fQqg3sAjW(BLq5|ZeX}eu-Ejf79`)s*o>qG;% zw|&H}NXqIz8t=14{Do4VueP)C=o_Psy#zp|CjOPZ=8fX5|Ag*7NNq-&nZ}vzrpsh2JRXIG1#w$^qhItvw?D zj1TIS*k%iO@p(DE-l?TJxP^~ASFWEVJc-Qf{@F6~Xg>3*zc<_My5of9jDEQ{kn*aa z-laGIrT!L!WnJ2N`qNMP+p2-_d zQ#jU=H=6Oe3G2`)Rjgl{He{ufLIU)o?%RkW`Q>B95k8jMr|Sc!o@{hCrNwSGp(h6nW$-Uw4~`pg6j$%#i7i zZ8q4yBu^QOZIz^kmK?PMGRBfcyqYLIT(8hYP^LC$H(hyjg*Mu^VFORWs?ZMFEpFXc z$5=jI;=zmnfZ>+etp(o?x?<1EjWys@(~&1mZatr)>X>uiZw#!M$wO zh*?99$%mS`J0WcM@WOGrPa+otqVXLc;S)#Ce)gwIh#!IXFfG_OqN{SfE(WWP+=vws zkQW;27Fxe9Q2O^T1-M+EJd@~uiB54$u-Z}gI~h;OX3}G?dUAyB>O@VW5p?0o4vIZu ziEids`3nHq*gx5!Iy?oR-*=fFMbkOZ*T=$aydaa#bxbMEHjTY13&v(?ln!I@xC|D zhbNt&7cWl@;X5-RF9Jsu#x~cUn4UdUA@Z&jRYUuT1Z=%7iY7<^!Rl9!^u}*~2R^#PHPHx~bz# zx%{B4sTsR5%G+zc(AaIaAs)G#Kvq!B6y`V|+?oPxs61>%s64C^86ksh_8<4)nu^9% z-a>Q^H_O;A>wXR)6C~J&d;4L98^`BiSBkClBbHcVvGl>7Y~)9W$?H0`HNQ>f!;P$q zt%dxGKA($GU+c77JpX6*(L9T5*m^V!$r(G5`i|%MBG(ci0^C=SP~TnRUx1JFUJcKv zWKZ;BHF#TH(;pTPFqa-~e!!CaTjLM|>?`==ytph&pV|AShQ7c9q+0EJsPs3XqfmPH z2&5`+Rz7F3O3zD2|4|W&DABL`qZW%1=Sf`f#-LgLDW7QmRs6<${y(fK^xshPX-)gn zuRGWH)wQ)L$;r|Efq%ry@7%fOs;=$P)0fNNLitI%kpCO~|Cv2LJ8NP;4vUHIr-kN% zXIB2Lgd(S+;#Wz2r!EIVX?ttyKOSHhV~cae5VEJ!SQ6>zjgD&kEia3C>XS@kkyKp3Qdd*Km|o7l%%K5zE~%@_`VYAxhDA&7Y=1#eke6GK zmm$48e3^p`X+eg}d%CvvcMdwH`pn`{wHp4~@q5Ee4J`dqQ#!h})qI*7FGl}d+V2)lOPLq1X;UX}f7|Vj}gIwSN^FWnbT$o2y|h z2x7dW(gvqx?5Jy*Bdy`GBZwL4J3vO3NJd6x5k>!JzrB+gY;E3^lB!Sn{P{}+WV!xxXBrs$ojq0BehW_ddvk54<_npRHN?}~ zpBf?%#oy#)Co)s*89vx$H`cNTi^|8EZqLtNd@A&3baoSWw0CEd4!g@spdCBYbDU+m z?{2usUmGmj)E|SPl6IiC(M2$xEi#si5De}Bbk3{p> zy$oLg9-9Mc8x?(gXCS~r$DW4s!?LyltMktsdbyVATq_gparRM04!bYP;et~j@X=aa zxBapEd2Ii%+qjsrK?fk^5?yObywEK*zYi&{X1G~pf>>Nv#M3V`~{qqyOXcJka0gYTvBNTrk3BDIX#`bk<0!ZOC{nwp*gCu zaNTlT|2y;6?cf*p8H60_?I6>nie4|;ZQxr6ze(2VW zTN(yg=7#(Th}~IVUUv-6-Jsa?q}l825^5hN+>NjM7SFPG=9>_OY!f3&3Uac8_REdS(D6>GJzN`Eg<5B1vSbsJHnU4VU03Zd8jWOMK zU{II2uIANM4Efk2d;#V~{^H^NN@(F^e8T#Bu&`mE0n!;%roPWiOSf}bLk@Vi5auj1 z%JT+h<)-W(#UKN?gj4Bxe1iD*rFMsPHqF-h_3WI@ih__IckA(Pt@&Aaqi+(CKZ}+N zcP=-LsGNLTZiFO%kPhsX(x7NglSd4wN>{`HYLR zue}EPQL9H?YzXw(WK$ey0eZl{T(?LG?4S0y5nd22`+q<`4PEiNCflcI@T+G*;n0Ct4U5@pfGPDmAe$5$!Ym#A|SgUF_ zvrOy&nKVQyC||#Vec7DgNaX6&0O}L1;>{oHvD*pTjI&MJ4pA<-@x2~#IHXKs%sA@c zEYQpvg~n{886VAdg>`8ZXKRo^5SGQvAl7$f(RI%17TG-M7+I^^q0#0?!=j{}e1283 zB1zBei~&~Z;;mez-tdn_*OP_T0=w#pu1iFsi8)#-nlp#Xo0N^VvI(-)%HUnSwX=~T zO#CFG=y-*r&C>7M8)eC{9I`bW+$jAXpbtT&bY^%*HU6+HtDPVe16sWnnK1jNa}3!E z3cT3VJdxF_v4{$}@_kCHWHK{THRlB00Ke~Z?Vln7%Cra_m%cTP&SH@1N*Qqb@hiqO zsk2HOB+|9*@+ih#HNSVy%Xlb02@+ZVWMpcsBs|dOV4$i#+?su7Y`u(Xuiuj$0%ypO zdn_{awb7nMSPDQXZtAe#9BSV&=uiZ zxiP6MRc;;}+ik7e2_7{Vbr-OF**)!LC0-@ffMj5egV^(&0v^@oTS~g7;EtpRAp2P8#z~=aa;B`$#F+W#y~~;I556Le zVySs%;&JDKbxLDGW`X&H&PrDEBmM-r{8$TRhg3FeHv;MYmf}i5*ByXxMW!M@_Ts=d zr4s{dhDD(}Mc-J+Rv)}n*{$1p*=@F)>e*evpv#cgAG6DEf1wJ#zRb{uprNbSLPBonLhU5iG8zK$e{zgCE5J80Q&p!+4;9!b6IM}3c|?3NKNEKcGc69m(z zgS6hJ*O^stoYgA5nmp*;_Mh5yUa%(1gk^*G{j9_LuS>^{G-B;W*Ikkp)Qdg99+kPJ zyy4$Db{lX_&Q((KRi0x3KVI_;xAPab;hJfh8R?S{1|7?5>eS@aZ33XFQ# zRuX{oY_)gD=j53mj-_H%OYP}g`i_M&c~dhn3bf{kqQOJ$31zx9tj_z*_+gz!~o zoe-0p9liE^eN&d)Fo&9a)5&fcHC~7tIh}E2Xp(1D4BUA{ZhcKGFiN?DxU^lw1>ywT z-Da8_u`Duf%T2pz5ifG&9bkPs3J@(Kw=m9FZ;fw;@^p_rFpf0fFOeS=Wx+A3#+(J! zr5GUo8>et7|LXbKZt-Cv^4M@xckJ>u5$ZB_T`mAg!Wip2HceJb6=J=8_CDE22y0`qSdp~~ z4`l9a4D9gAgpK_ENFO)zX@w?d@^Amyi;1EhiFEc?8PY4ow=M0OqvaUIS-S7a83(lW zwUIhMnJ3%ZznqJ8QuC+**H~zUzYex*#@D!}habKEZlXiTRQl{(o_e5ytf=yHmjb@} zoxDeNRw`z~*i61LhI~_N`HJw(L#asHDKuI+W;)w+;RB7#Mp~Fq;j%r%^Ho8zj8ntk2YbIE#2;^)) zNaoPxtkWBebsDLOb!e0M8HTA#zzm7}O{$go`qqnG^7q2l?#JRWt?n31*e^VrUn$tH z*6f@e2yEGFg)>;M^BCiA?3CZVuvM+Gkl;RW9V#<27-hpn`iRDsHtS``zblw@_dW5{ zpOTsuu9}R9O>)b?`USqEc+)8F^9tvB@=znRX$;WkrVZNdf$my!M#bwgmgB&j(vvCT zrXkBBbQ;y!yu;<0r&aCln28)Y&Iz&Za|YNLN4|Qa?$H2Z?@8Ut54%l19IwOS&m8P~ zI~UhqGv`t?)U89ePgCOy`QG*X1S*?x9KKF(R@sDeYTjU{Y$!8u2z626&T_*}Soypu zfaUX(P3m4O&6JF-lrwnXYi-8BTUchKiRq?#fTR3j--R2A1Xt%Hcd~g?+lt*lr7Vm)Dy42*;)OrR$7FH!q)tBs8!$r zxhc;cx{6*QnIFzfjj(7lr013D)rAio7pL>SJ3}okGp`P-MJ+)$AunZo{g^piIfCoS zz)sIr(`!{bHjE7s@DGw~)pf>AWIu3-4A=uLFs9sbx zJ@yq~5-@v+rdsiWevL&aw0nIMA; z9kuLf+a<7|S3Y)G^^RKU&v-8sWl#-H8N1pct3FJ#;WUilfm7Ju@>ukDo=z-$zf6-dZ!txM}sniYv>^C2_*?+*kmdHmR?!V*DnY8zUE? z8@~qG4PVxbB~~g)f`F-5^ALO#L4C zt~Zl6d=sZ!M!wp4M%o-{ph|^7u_CyZMJ(q=&o+5|PHm8PzoKm@F2PqVKG#i!GFlbv zPA6x)i^6Y(JjbrHz9JTR!cbB9brQht{0Gwcmo*pfv@_Z_{SD{B>NtI>LN>Yy+uxLG zKJounGE5_?((HdX%1x^{CO~n$WSy(RuyAvF11pPvM}pW|R}j7;)0bpOP<2HQC&Cf4 z9Pi_{crUt_lImFi8bSVcpPka0(kHK6QNO%8WCGc-o=R-cP-=S_g09J72k?R<7`5)@lkrR2eZu8ijh^=XrPYc2!K|mh zd`|Jw*%0f@Mdg8s!lzDImv3q$ePE?5dld=UOR=>V)nJ}W0bpvJpdZd7=Bi&Pv7r zy3Ew{yBEd2`6TSFi50hzjJoUk(u@h!r=V6p?V%~t25^RrAA1y$FT4&1GFRDrFgfk2G+xTPgX>Eo}vK;Qufcc2Uw*d*p zSqJF&y z7X(p`*?}(X1$QIv04&v{v|OI1!7wrwPh9=rbQ>C|4-QNHxYkVgDPiih)SH6TjfuCpD*aK)(Sd2Iu^Duc~|PTB~YT?d!Vs-Z5GlinuQ+Um_tP;VLW1=^!DYuOcC#hQC1h zJHl^lor;7+fTS!Ztp~|Ddc^HCHSm7*qSm{{DTF?w?Q^K;NbQdoYJ>&yQaWRu6xfIn zmU^eC&W2RI_bS$Jh(%q0E-?@Kj5vy^JHJ*wO7B(C*$zR|vf`Q7*!|>q+&txZl2&8=>1!Ze?FYE$Z_^JSkCU1wML4?t z9J5wPhhgAS^4m@4|JO%vOhn@U9QoH&j+)W@Z9_TO2RQfNHviMO z8&N(D;(sjmZ_{Z1zv=(6g*pG9*bq`LosH$wfE&r6O^{~b!4!Vb28Sk%82|I<)3&1j z7Z*%?<2DRhyMfN>*Jgj5ST5`Sb^7$VwQB>G(V3}1d*<8y$drq7yI`d$cHVvRbf9?C zq?`G_ojWQ5lx@&y)t~ijw{?^2$&!mBBpk(;^f>hVJ8kWc@BIIE+J=oI-^W|w(&iY3m{H(K|x(r1)v_iD#{8nC!`@ZLa4JKxZsfvY!i$3ytVc8BV}O(yNhm zprzTy>w&nRd?z`sOxi9<A(>0LY{_0`m;cMJ$tIwFNJ%XxnWp z6tjz?y|1gbudYs8jU(No%lm-nVB;bQZlEpgj8yyty>g?pIvNagc&U*dn+EGJU7|1u z_^tDa#j(ZavwNkgL$Zfm!7jLTnQW2m)dh~z88y)MG(isA<%?^@@}k}pl3=r((f2m` z=76u;em_7sAGTtvIZ&$oBYO$)Tas%tidh3Tp0NY}WU=B;1^Lz#2Nc`VecEfUTA}-r zRtERKcRIsRz&6sU7nVVAx%RkpM$nFNO0i5Gc11M0vQ|q;!j9kU#%9fc3-B|(mY8%U(`xI?yWsMWDtMkF#SFICgAML zX;8ngSK;~q4I<#Mp7rVI)iZVwL!;a6h3`+lnXHVj$0b2~r2pw7VnO*W`KOD7ccr7< zj2U>a#gWJExf|xkmvhE^3wailOX)Z~BA4Ej62J;hw<^^k%U%Pjc2m3AX&=~UZ5&P? zOo$-eVTvMtqLXq0;JU}MH2~0ah0ZI}>T)o5LJUMKraiJrfQgn4X z7{&#%Rd9!TP`0Btzwt;%LzJ@^>XQ+CTmdXw=85~=Q7Fhhmv z2#i*Ch0k5>s8v_+NQEga8CgX#J^>peLSz|g-n{m}Mr2>uf2S8@66oCLXJh>kbM$I9 zij0uUT0JhUIr1RA`U}?#uUoM|o5|#2*`*lI2nV>R7cfiSR@~`PEbtAa*YM3QzFN^G zVPw_J`lnBvcpZ7Wz-$ts3BD}#+-c#PdbFcCCcOaF2@p(cWU)(Q&idWA*_E0+J`MSn zl}tbDp3;|p5V!g1k!5hElPpA6rh&jVkB)E+;m?FDY<&0&QQdjYpN{?t5B@%;JoJokJW-}?AM;NS6m3foN> z8GN+lhDVlxz|a%KU9X6lQN?5+geLZ=g1hw6`K||Ds0nvU3hWZ>?L?bKiZDY!6jYhL zxYh<>JIj+Po!0!f=`mc>`%c-})qaE(TY5Wuy1^`Rtk=%N479R7C%kH3#gWUC#_QM95%hc&ON~87e|yT zjAlCr>1+jSX%|O;<`W3~P#U8JpWfb3?IDWBx(XA`LU==Xd z*Ikw)(XlzmG5q!5+hy@|;duj`4_nT|FGrHKzl<=827feHg~qVbmVjC})CWaU;0aoZH`TP4%`= zaG@*Xq+p!l`1JCSEt~RDkgV+*xA-KTjOMWh=SSmTKQx-PeA8O3e8X<8tr0gFSHa^( zMoK7fwaDEXTlVBxAlhi z(%70o$K6b;Z^bN>+ouhJzt~QPiFtp!@hz+7^^%%GX}4+M^vd*j^CNFBxd&=3KG?Oi zFsp`|fKY3??!2hX$n5wLeV3i?1vE0Wp@p6}xko|ESB4E1NSx>#c3bfSt|hjQ?M^oQw(-eQnYjqWh|8Pd;Z=O zO`YcPYFZ~bF`Xo3!c&LG*=B;X*~?lGS9KtI2hmm&pcEWkbr=h3x6w?E;gA4j)LyF} zzcCJGI}Am;LXsJd)i!khF!P6GO(rf5(ikW`_1^Rh2X^MroYI5c5#ir^bWfI{_NNkp zAz|8}-(|x;rL3a?_0XJOGI%JL@gwKP`>5oQi)gT*+|UeYP9+9whMV+BZgXmlK3h@>`?9{=lEr~xukqDse3)4aSgr`NYWeW( zV9xY6RPE+X~FOgi2(q(gunV<4+r5`2oy!E2PbU>kiHY8rb!7p^VT<;l`u`?wT77329^3Ds zeb)FTXf&J>^S^u8gDH)p#ig4&0^9R52)hIf3-7Q4rAO)Tf&XX$+37r!-!kI4B_q|t zNi|K!OG*k1uSnwFks>v5%U~}xgkfN>A~#b`%}4d#OuZPA?hc_H*vcPq{rcb_`W91* zD>{9LZ>HC@Ul~rU1wWf_TBBBxw)sex4{%dd1~GmztXJEodYiGEZxi27ZgRw4K0@iG zw%IiZH%vgqTq12w&N2LCYccTJw#o|tw~uo=6SGxSm37p?R6;CLHKz-dam5x@TYZ&- zc7-%4-vT~ZDI-8iYnw0EWO@)+`0QCb6ecklVyQpgFW?6rQIrhCn2yQhG8uiqP(+1? zDBaIadstRWx2x*^dbtLbTYoj)M#l}9Lk|jVKy=A(@&|(0=Czhag6GLQ8#BKm0P7<3 zF5nXNcF~uc3u4)x8{zty@$Pi zuW=_BWgDel`+kCvt!$dN8Fk@I9?6%%8{G2GJ0)R$zegTa&F*#n3H3t7bW=*JIICKn zAv9PyGB$$0t4f2ZQa&}cO)cuubp?5L4X{oXe}2)g(ny!i3tEhkc1yJ2b7J}Pr$Z{+ z0aH+vpPJ&5=U6cZYa!e(Wf%rFw<{R#fZJ@`TgxLTrp5*Wa$h1oE{E_tydR)w4`I}s zz3IK6^*w|2giINqnTk^GZ$&b$G=X*txEuS0#Yfc`ZoJ$q z@Vo`paoG_XmkeP!scgi0{GwpEGxa3OtG{aQCVGdee7dcwCMJ>%Ke#+_Pq5FTtE`x=`rBP*XA|&bgc42*`Zsai@FmA#XB_@D#EUEH! zKidadW$31h!m{2Z3}^oR>IKeYQa*jT<&IdWP>A|l+mJKQ3^zspqZ!b4MhoID`)bwM z5Ez4Bf#oo_?mQ*saPk|HpTx9u`C`4;_QB4v+Eyy3qoRfjK~9a7Xg$3l2 zlgM#^b~I0_9^?KEXd4f)kmGj-ZS058!xh*!Ct}I!B;ECBO|{-G0e0M%_jV{-sO3rK zlU?Z@8C0!^TgCf+3E<8?3`FUnqEfMg?vG=Ciqfjk_yTB`i~MNWSVP}6a2@LC%=++Y znB%Lcj$YyPQ&Xi2tmm&vJ6N9?xmvn66@E8ORW#h^-PsaD4XZ^!jif|M>fNHsd3C0A z_ag(adF_p_I@(TN6^2mb_H5yn6wfYn@CTJq7tsLFHFq354kF?@IA|dy!)<*a%8N|Qk z5mfor99;Qt{l#Kpd&TAh)XlL&r@}xy%kTnjM}yoB<=ve^!En}B7&pgjap~EZ_W4de2#pA8#}x4Dfqx<1{ha>uD^Q zV#v-cHZcAfz{^lp=&9tlxWjDz>Q1dKdJ=g!R7ywm=}>{!D|Qe=-Yaok1bOTNLZ7~0 zYo(zzQXk4oyQ?Bp6cSrav+nj4fX>xEsX#68AXry_{wnW6&RhSb?$V13DZvC(F|&;C z8Zst?KhZJdegT#JJnmWCe(^Ne3+*9a4=gm=qqv61M(h$S!RQ@lZ!{-Lf4PysI;B}6 z1gs#|g6cY5Y|H$EldT*9luQY)kI+CG!mr9Q1TK=j&Ww*fg)#qzhB{H^dX_cX=j8Kl zW?qt#g0A|K)lt7|e~(Ky$$-8h?y}`oRs70y(}(1b0K-OsP5T z47Adw4?0;&U%<5!K(lCWr+W~MX&aKPo+=hBStq;9iO>05fWz}l_ir&86-#v_Lix6Q zDO*S`nSxo4L1t(6x($Y}1tCQ9{phcfzNE*9^>5bqcX_AmJYq5z9Lcsh}mCSSgJ9HOc|SCmQBUyywB!N1MYEmo=D5 zqr1WpvB-zpm@gSzDNaJ0d$e;3gvYx45p1^Lq4aafP z?^xERX*MXr>2TUalFE&cz>yTZYKf#%bj{2y)Z32hdUp2Nim@*4v}|Is z(*VqsP)__V=4@t;C-)RG*`5aeg@R6UC>)tm>XW5#*0=W|h4iqFCc-mTp+cp0s^46Z zwsaLGi9@5tO9pWC*mf#5vdd;I9fW5OUw^}^f5d-QS~rY$oEmB6bUSSyZ{O_>UOm5N zm%hT^7(#8as5e+EJVp1gur^gQ-A2~XE6Ir?6{6OlKPl4T-eA16j4mChN%_iFCcGtY zqB_*JRL$3~z>Sm0uqDO}&&sm3xsJpW8HupSA_LK}LA9mXfq9i&IK8?((g{)vyYxjL zfy~~6lVvXI^VY> z?**ec2Fe-JQ4>9n=Tecp2!q~h-$_fkBQi~>DkD# z21aWagh?$mJ0bt1c1*R_4^$PJMSLt7H~3werTkh6!PB47bCl#0*lI_0!6X22^2Z_c zWW-FqiW48Fks;3&&GL6|hE8UF?%KF-MwC$;m%*GlBa?CT5PdDULU>%>mD)@w6h_R& zxDyUzTuYu>C?qb-2kewoD=X|N9d+k44#gGGQR>nJS40OY@=FM)EckdMu|C7PV+_T= z6V6=FLsV_+Bs2`!woGk}<^Hm4aXnA|@Bq<%8O8{swRjwCY*rQ4JY?T(CREveMjLUH zK{hQH-uQg*_LN~&&Ivg7u(G`mq%{FD?{??G<}Wkl)U<2n-KJ21e-LM=C?T;3ug0?e zoDjh|)e|mM;L0WzHYR$xBF3Q1O7s)S4fMJ(RuJ zFE1+OXoewr6l_q7;s!*#YSLgGLkob6gw12G45A^lDy#4#c{RX9gd}`8FRpdLQJ9j6 zK|JeXgA(9=N92YeMfULGu4d1GsrL_x{$@a?N{<=w<&Z=Xg8E{H5A&-|l#aga-P8r^ zfIR}yTOBJuW@VYfGQ)cg^Ofm{8pj*iyw$fxf< zzYkB=FF3!reuw`H?J2tuzJ3;RUmOp&y>krJC#Ne7ZE#Z2`-E>40A<*jZ{zB;U z+bT3BJMz3zu=0`AJ$8#@+Yg1WUxi$`Hk3{=wt47K_OE zE&cL>32W2PEA!uE8JSm$tJ^+$!1oz2Z8o+LTdB_rHAWLCIQ9Oegz%8&7CGhDAra{m z{PJlOjE#}(^L;r`=cr!e2HSj;O_CSgtk^ZQ$?A{U;B}$2Wqt(>o6m*Gux6J~(eCp^ zk<*I7-`DP5cu}J z)Q@&0X3HfVjQoqwoa7t_YPXrhVt0uAW7Egtk@Ls4=zXU##hp z?K&#BgYyRkQAAQmBMfT>o!#0Ff_NKp*69Z?CtLLCA_v4aF#@oefljd{x>Rs3ar;dm#h}{Tfbng@cobBMbnCQBy#d9g6n|WjdR9pn`98xW!TN5h9ztm6*m#`V{4F zA+Nn;s?;QbMyhL@7}lSGWS0WDFaF7HucM=gu}3aHA0A-}|HQdDjQsGE4BYS!rF#=paRSxFm}Vj8&LVU1-gu?^w4_XoPW5Md23%up0Szg=H+rE?sBD zSQ>9TG%cVogaRTzr=FVU+;XtNOu-I=oO2F==8`O8sL6W$>f_w?dMFxIag3;7{n6Gn za%;|g6yz+x_$<63dd7a~Vi6d1Iiai+my4n@<(yVC+2pA0YDSO-_ElZ|Yfp=EqABb1 zgVaRZp~SaG*%;QxM=AvDWGq{xl3^{3%@NVX@lMVKug&=TSs(+gOH3N5SE)_BJDTK| zmVHX9l2!vXy`Wp|tNw|4$27H6=UAZY=w@CRg<6Db#m+0jh2hbazR4cP1`G>DYM0<@ z07{SyFC)_dvH>P$dxuo|F_^po=OK$m{=4#asi~6Aq%6GP^d*QU^c_`G<9Gxih1$F0 zxc4}hFRFymJw*;G4A9{8sf^a|CQU-T@5P^T-dOL>w;<;rIk$^jtbWP_^p^?%i7oUGlAfrhDkMeuA&;aH2&>r{eGA7!; z><8x-pnvI|W9Co2NBEXGVI)mV;_1I%UNnrBT$9l_i}p?*xp)X6n9;;b1hq`){LiQ) zt9cXvNpoH*2|3Eyws;kJhZzn~-guo(cxs%G+2)3U$PFpeW}S^Y)3JlnGYrdnP4*h; z3y3K4y)-V!K^!1a;Lpk$rBeMV{Q~y)Myi*4zmN7x$HP{3flVai^qM3qWdBNLf_I8} zrvbes)hsqqN*mL0K&buP^Oi1RzLelG@txaaMPURob~78#R;xQfV&k!p8%~H7`y9Qa z{YUIr!9nOR&P$S^TYwECv3P@0Px04!FY_$_v%r0?sh9H{s zj;uDvCNXh2WEtP%;2|mqQd$9~CjAjgF8)0O+Br@sskepcGkN92yiNr!X|pnl^OT3L zDyL9>J+RgfrZ;D!k4)<8dit_n9NA5Sgh~W@_M~EGmrBM_G}OMDlu_qVHfgaoc?uW& zQ)5E*;>=CYlYqx62E~_K-YbCf&DOa-2a*s%Jax^neWdhPLj21wHq}3qVJq8mUD~#a(jSbMV>gJ;vWOCFoYB)VdN~C{ z&PS`S`u%*u{f+KZWxzyN$M7?nSz39sA+U|Z3rCJ z&Zl>RloFfD5CKI-q2h25Z5Z?dC&jpCAx|cf;B1YTw;3JRw_jXAqofsoHUJRX;}QZJ zz&XPR#-9v^Toivr-ZMo0Mfp01Hf@d!7eU#z1+r(fX}A7#@Gaq8#4pB1d&Bn&QZ6(+ zEenQO>iv9;EXyQ>JEskV1hh}O+a08U*gLjw?4X5JT+{`cj6mf{6gaKUrIOJgmI2{= z!31M(!|NXmZ*{<%*V)wq+#c-8w2q|(C_Bmw)$bX|YQew8#xReyO8=D*7CW_|BP)#r z{UXQSl(Xa@&!Bgwk_rchp20YbUu5WF6QHZdHQ#>4ioLPaGSBbi-fb z>-M#4F{?z1EBEDY`>`^5;3*Rjva>SiX{>Xv%Q=wz<^J*#QGjjmA&G&u@&fJDYAF+2 zU;4L`(Ue>cWRw5^3g)1LC35S?HRA`JkfqCSMm3BXh zqT*8-itn_+0I1z!Iqn0^azi7S0B}Gz)|0;)fot8MrSj<&S)PoMDD&a8!oa)npwX`o zch2-ZAnOiTX>_Ha8kDF~N`iOq5e~s<;*oAV{YZEJIX-~yo=Y6nNA;TtR$Yaj_aO2_ zOLf*uW&5>R$+W5j-hE?b;R`vVl14XnYjF<%-7!VON5Xi@ssuS|IHIjZWkB^0AKM!- zSsl7ET3mIX@)9-1kE*i-5yPeLe(x!@GkSIn2}guhqnoBRH&TTC%)i31?~2^Q7r^XK3raUh>G^pcD>B!XWM))rPQ#);<%D z1fr9?^5bG8Jwqj`e7%5r+ln6DWIY&qO)}sTqwMMw9Y2ye08-V3x|&p8Y*vnI-ER{0 zL$!5HHD?IgHp!zI<%dG$f z!Zk|NuW+vnq?iAIu>cPlS0Ny@r9bQwjbH}>*)V6N^GqP~Vs4YVXqsbj(ylnw$~3!Z z-F#%F`i^S5gE0M^4j$P28CT?6XnuMRYB(F8C*21O?yj=bFMAtdBap4+VqlI(C3O}Z z`e|$X!Cz8o6B$pzyM^8A^B2sC*#PP;46(#e?Ks`q=5t0otY}}ez3CnsvW7%n9KIjo z45npUWpm@IaEPEuhRwBT{kbPvyf7S`cDz)w0R$6ziifdLGx7}*IHlABkTgkjCNui80noo!-xt{1XGUrjLIK zt^bf5XJ&?S$6lZu3^Zm@jxc&vHV~sQuy8-(#kv)HARl(62hnPl@+Ut0B#n?p2`8MP zhu`3MwJ}U;F4(9~6Emk17p-p~Z$UViP$Q0qwMh5{hxqQfthx9T2@Jl|*9&a2?|kFw z8v)Gb)$D&IhGBCt6Uwpldh$UMlUP>N$2|FD)s@v%k})=0Su_F-axkU!zUi=AtJ686 z<~_{)Qs<<~K4xbZ9F)PdR+oh%A7hhdyZ7J-n??V5g=H8C?fZ$|j0*2f4D9f~5e=08_w6YY>6_4z0ol%?B znoO5$bQ1alq;XD^J?FHAA^0y|D|9k)GkBo8%##H-r%_i>Q&c;fgHfD%-#@H$LDYlB z7cJxx$T?bu?3d*x_giQcuSKnw*rJ^%NAU99zaaxG4O(@wC*3rT;QF7&2}Kp=-oq#Aic3n|g47dknFW{i2J_oOP!@P0wnm4sCPy>J3$4 zZGjD*;Oq_5`kfQLPId0kN1FGBV8e#^#y3D~8vd8o>UDz%!p#86#a`h3vlN`>mf1ih zVG|Bm~f&*QB04Da(MYgd-BEp-8i{^Hs>NCH5(Z7@3+mK^7dBFRo0pI_S%w z)keW2m<~QPnWt#@#1Vz;t8FjcVNE|SFp8T8mBmJCh!wMBLFQs!v{0B5rKe(-g5lS4>wff`P3zrk?K&Q?s`mE^7qfRi%9N+_L76!btcZ7k zTf{)$NJ)x4iU#V&>aQD|@(UC<;qQOtyH@x`W=Dv;_AU1dSDHkbk-<_*3efod?b+aF zP)?yG+fMpwznssf_l@#+vaMU>NB7bkhMmbAbSRfl-_Na5QTvMR?@Cj_q_!&9gMMh2 zh7*1RzP0a>iHub!Tgl5mLYRw~{s8t!D;(1Dq2KPl`jx-td2wQNCpa6G}Vp&KMt&oh%{as_TZR!dwZxx!OC8H==~;w z+2gkP!2x3kBpXoLo$`pnyKdjEknN^(#}mExf^@wQOF&}HlsZ>c+t*Py#0bNNIl7KK z`yzrw)JL7q^s`{95R_mmc7E#x{ZNUl)qkiruqtwv#jUJ{`$%)zPxX#G=qY7d0RpJZ zJ59w12S#=tj9WEtZ4MW-K%G^*JE|YBrDpDNVzQ@dyfQaW-k4~Q*_>5M3r_9Ln1f90 zEx&!|Vttz6HrfurTPzjlU#&%SDRea2X2C~1#nF_n*TGEOO9~-2=ZnVN@o%w0tCzef z_{n}b@CCxfQEvf^E@}v$rSZ6s8T(HMJtsQkA~=z6^;Po|{z|nlz2xY+it(Skrioxi zMyp9g9Q|^A+AjhTRl&h83Tk@uGABBzy_Z$m$!8cB90q8e6FRCdmCjjcb!`+jVUJK+ z3=ILi$Wk{hwvmcaB5a{lq3A13`!zn6Q?;t??T!!m^@&?mMySGCMphM>$e0(F9;fbS za+X~f&Kq7rctt(5szx{JJvd5ITrt8xFO=06595tUgquiohxzk546i>r3MDm{OGXsF z4?@#713|>h$S#;eQs>JYFm(TBC{kv0&pyM+Qk7a4?32k*=N0Nj*Lm3j?*1FQFt^Ds zM324(RBkH@L2HR1oZK(`bF7Gcu+g+XPs=c?guNcGLmRyA4jDey?V;HGEf?S!$}hZsp0c#YZ7cFfm7D~vM;2NZ z98?4p3fUDv@VS0~>|Bqu7S7)#gaFL9*w5e#Z8Hf^COWjD8{tV4wF4jQt~kvhk>yR} zeEl-KNe7oNViuTw*_W$c1Vto^dkZp!g&G&Q5eX{(pr&Q<-cY#Z7jmO7|#l3*c~p`QS)qk+fye z<~htMjL@7>MfWpaat2;87Ji1xs)aWaqlhBbuoIz*s#JDEeQzx%R^ZE__=!^KoXRW# zVQK(HdXcAiKWEO1^!Sh!k_h6N_L*UBxCQP)t(7-zv7?tS@sl}NnFCh-_q8@9&QKPxbQt7dIOVyo{!h_&HT1gH@$g4*-x+rAbe>oi)bae zY|ieO8FZVBs2DZg>boR^)BoWDc(yL2=Xffv$aGZiS0dtj*S2t{s${bypAvEnPLzXk zp9(Moubhdu>kql_FOy2gY-@gAf?b6~C9kg6?(Uu;hs1JJPbUUHKTbx!H~4u5CVN=T zB0l1{k!agE5&rh>%WWbRPuFqhQwFPqXYbUj2L@B4V8y4aBQP8XazM$$&|Hs>Ur0mr zt_OJJ9#OBvaz)12abLP08+5k5!=tG=n!=7^sR$J=D4OmdlZKA)pY@NzZjvyw>pL96 zl&x#iQD@%a2+sa(2H4}m8Q{H)1ogA3O;#W5sz4p%00#S*g)cMmX2NPq0w6H(}g|tmrFSue-d;)asH-`r}4C~ zl!HYw6v9wkj_;U zGG^?qcjsrnKc4l5y)IBUg7@0wXz8Fq5PSqYjDIDqjOQZUuBKW#HpP7TY>(I(R|CXi zLv85jV_nu?K`3ZbfAjC*ucD`BqUV6zpg(&u(TRS7I_CRlTY;{ecnKH*anDqF^4QJI z^Ct#An)0nAG#}DQR+R4a`aZPSOw0>mtsSQkKR}+li|WzoZ-R-(QC==KoFJTt=OU z`4QDdQn!S!uQA@>4#&VAVj`*v8huKvjhWxerb4}E1sP^xiV|p3Qn6EGxHRHx<`zjG z&kbmAJ5KXiYabGZFLokmp8BrWj2{nJ@t#({noTX{-5w}D;ss4DK12K)pVuQndoEvh zKxU(hWQp|L@Fo+dBguQE{YQ=@>ia^6YRLd2p_La*$9I>F;uU+3c5SnHELRW-5iA2* zpoTTUEO53BP3*VghlkoI+JI01R$wtUb$-&%T%qY#Dboky;ufz~czqA2ByUAOj=6rg z+1AjUGB|l0OVUX6P{{k3a~JEIgJtEneTbdZ?cdKa34b_OUpd2P$S96xJwTyMMgnJA7JRNd~_Unt9#Sr$(tSvge1nN(`=Uw1Zl&A-q#Ei_r>(x6M6OP6@ z;;`LB(#fnm>dk(!m{1n#+8ccDEI-&eTscQ!#-`qW$cv6`utCW;WDg(Jeab`sK@E~j z2~3$zkM<4r+}4RnomZgu-4AAL4na$Y9tfQ$qmK$WZ_HbCjtG4CX{k{E#|tv zPi|2%Lamulv$LN*TXMGDM2nQw;ZNzhio1G09apE-!#I`2iAV{6D1o|A6WLC#BZ&n7 zCOQo%oNVSgy>&`lxBMma!Hyr4`?#A^RJoWP0Z1n7=!wTD;XUMeEsFDHp{Q3_Q5h6*#*Qa3^oa% z{B7RJ7b*;;^D6Fc!o=!}0D&YWDrAR_6SUlPv1dFRvCgA!*d6z%YfrIX0(Mo+RIdhE zyRx{iSXnq++cv!lS)cb)Dki!DCbA=l6HWu{5zZWDxl<%vPwVh@gS>X4z{mU3)xT|0 z?e}Dl%ZM!3+guL)S$OwDu6!QUZvO*TQD*$%cv`K#?^PMqX`AJSkkv_1Qb2Ax%G$#w zO0J`+zmMHnJvh(MjyH$;>+uh4TWZhNpNCUIrca*Y20@QMrvlbb+9PD^3mTbldAiL} z<9A}p0EYL8mjQia!jgL+GkVjBp zZ@hU%n`$29dP7d~k0leoq7sNURDix|cCQ2s3361rS5m(P#xu?s7fYFyWi}?eDf`Kw zYt$>gBDQ47U`)LG66Ov>uyy6a-N{hL6A6;4u@^ndE1l>!>8l+!AW1>vz0B0;JCN+2 zjlwWH(@nK>ww?7--G@;q6rz_L+(Az04cJ+T2GBc}lo(r;kPx{j#cn=d${K?+J$c4W ze%obE<)?4%^W`zu9E~JjM+1QDt$mk|`N%AiY-8^n|8|}zAdFSQLw-f;R)RM~1%R3> zeGvd7LDF-%&lUCMqk1b+KuOk3}LkcB! zBeui%B=~unL3nkw#Z-QCNgbQ4mEt&K%f}Kt41JnqP<-R`0H+B3S%5e!#TFCm!ev!< zwI}ZeY9Q;PN^`H4ipvufpVSTx3fx;JI~M!1_xfYx&w6_Jg&Lo}ewS6h{oR|qew3!% zkGp-fo@O~dz{|mo=dI$RINEC3H7CRCMBdmZCcA!iZ>RI&Br#>L`=ob2^VE*-4h-zH z*A-W~BS_Yw4ycYa^HD|`>nXZmLA{vPfe+EV$;3e~xguFS zIm;;(ZQ>bs3=8c|CAcH zTryhXWvH}^+Yc?zPL-+NidD9Q?IadBmhu^(04G*Ly>5a>!2-&?Ns(S6FK*&yq)GJf zfZz4<0ep^y(o6w#ieYgxOh4%=;=6GjRr@>{f*-ONn@!dO2Uu!WkV$8epq5!lRy$Hg zR;;<|i~-o|p-mx9lmqfLX6g%R)aATB`C<=}Cae{^Oil7YmIowgaDk#tgqTX2t}=8g zl8(p-z|EYdSk4TMs`@yImX$RV$ntXzx#&aA(Qa6baRUppBjm_#1;f)BqZl^OUqbi- ze^uGJ*NH9n(q_ciOjD2)i!e(-$(i-|3rlmgeMLku+H9+vxv5WeDNVfw-YAV~9t(ea zCc0EgFTGbal}+{unBC7OvSlPPrn$PkiLi++O+5@U{f3W8$Ba*_<{>fYi+09 z-gft2co-&N`TOB+`NPv{cLXd+@BT8y!0bG>ajMui$M0-G-0XSFH}A5g_dV+=bxeGc ziM)J|A5YNm4^8eIwujBEs4gL4t=q}Z7dHlZcYMZ7dSgY_kijHpq1%}VZIh?tQRQhr zp2y7}w~iv(B2j`5cZxS^Kh61owKC+ticQAkgI;hi2Sd3FhW^BMBDt?3ND;GX79?n};g{$VLS>GIO7OCR z0eEVx)OHfn4h5@GNa2vDvT%!(JT5k~{w2d0f{!kF$vi|ff0a-vR;7-E0?TM@A(XIv zToLDq9f8%%pENnf3kD8I7ce;+1;wJB@SeQP9v?P-Q(ULgz@_&GQ2mt8AuT1E{!zQ7 zLJD8^JOXAO&M)t<@5ydV335YOYcpkxM4J-+)2p*Exm)u}Z$c);11hmff8u0S0WP(>Gp^K3OMGAe`v-$9c|@b6JO4g-^T^c@$SO$MF!`Gg=t%juyp@^|%e4n;f#DmPw4MQv zq>n={xqOz@CFjX%cq?GTdGFd4=f|dI=(g*}^yzK40|qlR-xyckuO1grJtZzb=1$&k z{Y7FJ35iiS-iU254lFX9?R3TD%FHlR?@pgo8@P|QGa)Z&AyeW9!OO}i~IWH^^ z(&&<9XclDx=!U+<3M+r*>%3+O{)7`Ffm_gqq`HeswQkY1~}pt6tT(l!hGLs%k$krhzoaf?zdo$ z`*cMO9UYU;e6lmG<%cN~j8=)IX5Z|(0T86K; zmkY3r#I~s=nF}Y;{k(z92O+eS9IST;D=dw{;R#aQQi<60Q0WN$0uj40E*^!gL=v2grSgqL2z!3CTMwPp7MO!4>Dd3;j)P*T6?A zHls1GUnmcD%kqrjPc1HHs0r=0P_fzq>g%e4cvwg(u6Mkn*31taOF47K9)4vKF}ZdG zc#xkDvJQlVvTl*p8Vb1x-6992pAXmuo}9EBn7L1$-ytOjS?$McG6B0fNHnTh_H3452Ov}>2_Yl@E3 z`MsAUdN@qazxq0c#Wli}QO^etA=0hutn1Nxhj_-nXL7t=WcbDMq?!lel!EO57nS1X1f&Q?2zi;hY zwboNiQeleN&{^0FxB+8%+QK2bZ6q@qno9~7s2<H`1OWY;`I%x~Js%|E|BIn+q zbF~wQm9VfvAj%h^iDySmo>`7+PhNw4w+&v^QP{awe~Go~I;+t-QioPcY3yIA&}Y#a ziz-|ZdnR`c!Vp}5u$D5Re!o!2S$xm29hRF z{;JVu>4m}ue@UPrpinn?t;-Wt#o9WH;90i136k0kJc+vW!x|Auxfkx{d!$0-lE| zYKR8Q4LcnZ{Ul2UIXqh<9aqY{TuDH0Zz6A$F7AdR9w64-^l_bLGzv&t-lv#d1jZIzzK=FdRNt8mCS#wu;>f|p#Zbmx zX-JH^OW0uBI`RSI%&9A)kVHG8IQDY_rE0E6{wbF_6M;!JKc>Hs(FCEhqC9D$SbS>v zRJHDUu*hv8tXZxL*^x^8xrZPXNjUI?2u$+WvE`o(#(96f(zJd({|Nv87&3I?vB9-{ znpu`NB^duwQYfQKG=xLls}lX$m#V^`qI2UEv!o8fx|(oFlUrcwc6_4eYkj7Ln=8oy zOcX;&8q$d&#Gm>>%PxaQq01DvlCHMy+V)hCgNEk%YlBd_my^W0V5^$m9^1Q#8Y*=W zx>B9-3qk!<>x?cj-2=3Xnpaf#7WjzAr@E;&&?|(ObpneileiHwkg5=vL$0zMi<(qd zgPJ)f#^Mtdosm=g9il=%7JLQMDD&4*f$8mat)`(H z5B>bgh*MQ8g=nQO99HD%b}3=X@KZV>uu+>UHfU_>O=5E`6F>I4+n)-w0!h@jCN-Q? z3h!=;GAdO?-YfwepPRT*0^>aj9{)bP@}d-B-6Ek)!DuLA)p#THM=YbR&s(dh?6EG~ zZ4uO{ZN}xuV&>AH1xG>$7zfDNlo<>NC%a}qV(wYW0pte9RW}B=wL%nrz*awtspGr4tJ4i{06xaQvByZv?)UTo5jyV_kA@x*pGR%+0$&yUc~6 zv_H@1)z+VVWwl*TcNIa8`e_JrkFi5dbDr53v*C(K8hL@3NRWy>&Gz8ET(TN|_Op6r zu(v-sY0;A>mX?#1!zT?%HVqt0c_+5h2g9v?wx>&#HU`WqbJ~z&a#j)OEFvtj5>2BAblG5S9 zrpafyYEoTK5fj}BF3H~0(KjcO2xMFw%LPvfuAJ;Js@eFnzJS{gi|jJW?m zvo&R5;?7@agJPQ$SMt%;S_PNvskA%p6Ss==h(o#ULSfFSa$33Ee;bpnz>-4(jbs>% zp8gzY!y2u+{lnkUY{DKO-O;sa7ZwDQwXp3E49NUq5_aR-|1@LPDhoF?sKX zbpWNMWhK)=(*#xWs1il^s56Q#K>=Q>dMahhI=tiu0WD?#kKKlo zEv*s@!J=SoE4O*I)I%Z-s?r|18${#yVhi93nJr2jV&YBY{6EzA9Fg727{hw*Z?ZOJ zTqpu3M25{AN1;FH_=fSbq*>FKo3!;o6)7^Oo~NucEji8>-|c7(W>f`D33oOi)~-zB zVAN@~BwlMh_oR;lRzus4`y$TvAZ^68g?+ekyS%r5VOr2l^eW>R|24yv1X0De=o$`U z^Io`FLG^$BjbwBdn;hHEo%C%d#k|DUfU@8hlT8fPZ19zwL6A^vu*wzsS35Z>$^2j} z102QlKus)oI%Hr!#0=NukTDf?OuD|xBhdb(S!X;U5z9HUDya}$G25oVhbE4@5X(|L zDAI4XY$rDUISIY~-sUhf5)nJEuyKL8=NDrTV;)x0UBlP zmm?|4DQ}b_0lR3wxdn#|rK$dK7;!S(X$lJmYA-Lk>gY_E!a=d7KY)1YyJSWiLcF>-|7+<0ki0+#uC+RP}@ zbAtEcVT&lvm>-b?_W{7SP(xby!NXOsR-*4WO}OUpoSoy@f&tdsziNYGlFvkH6Ev25 z%2Q>ufNt)G_=Z4USkF~J5387-(~{q$l;IQ&F#}5`f-vkhDT#ZyKxp#}$boog_0?ND zKF_-DSMxtM0h8rJr(lN}1!}C-rxdGFu@|;ozu;qcZ?vtxS|!N}T0vMJmA(zC@22Vh zH*jW*P59=v_9HpI4p&hITfhp0xlLBlN{w@oVEPoRu14MV{dk=vU+mkN+IC%y3yZrt z8I%hV-ggi`Ac;D)rNH(erC+jgHys$X7#CkvhLoa+#oXgAM2vJwF-ih*v{3)14TV|H#pK6@yF;oQcHL<6E+9-Ie6oIu2 z;HKjk3Q|sL?kBA^})x zir*HKm=e}@T@m21`1&FV+`Z}*z^pV^sD&c1+TQ3tS8?@(gxv?9h<%5j+FAS*U!`O7 zcZmkL7;VaeI(qef@p);A3pUGazr5bq&q$DcYt~N_id0+T1ZF|~*ZME`i7=ZmL=%ff z!~W{K`$W>U_eU3S_wh~g?b)7UE`MoX~@T&Un_6LvWW zb7_NDcu7e)M>G|g|BV#fn8hkZaI#LVqD7|apJKl~jSM+k*(eADtT+d~t+W`+*lO8= zj1kHw_ThgI094}$>8qbK;kX-j3JY~lb@iRy31LTLv1^l(^^M3VhXH$KCZlfoSatRb zbGifwF7#|+6D0TsOfD3{(gs-rZ4*L!`Qd|&orLt-!+AV8N=%3eGRF_!QR;ai`Gi(^ z;6JEseviNUq;TWJT!A50pGa36wa{2j_Xd{643QILhZ56d#5{B_@8oUD(g|Qmtqv9LSd0Y~wj)~NsvZUJnVZT+e(3@x|$W~udCReN`sehsli6Xo)+szXbuX5Ru zjmKTXzWT0etC==GR$w2OlG4YhX}`^z(d!vYw55Hzw{lm)IK6ClK|fn?tc#iSOcyk7 zipOw*$3*VIG|hBqFX)Bi4I89s?1tx7V=1e1Xs-dFlur-i3M>rd^0}iPus>>?iwgeV zj82ZbDJ#(}_Rs8Cw>=4Wn_1)-t!`v>E_{Us!0yRYqv@wV&+tZ%6)OnVhCJe}nA4Xl z!*WJl%Nx}!?~l3rcN;O}h=*|UW5fG{+ag*Pq@{0Rlu_lgf&s`0wya|f790PFxu~1N z^E24(8E6NK7EC(@@@*HP`v`SuO(Ql@*@~{~ReYpQu{6{lFn@R?ek`sh#X@Irxf54% z)8PK#e9kscqvesdEu*rxmP4ybV*z!X+?5zcl^hD%FvTVDrrsa)00e%@4ejm50E)?#4kG`KFQ>7L@D zWDu|3{XxF+V43*}Bx8=yE6HT{%^@bqqnRTG<);kvaB7$+142Y0Tcg9bw*O`Vj!3sz z8Lb8|%}0CDNBGp$lU`AF>);W+yHq}BB3vyLr6t z$bolIL~5o3x@eWbalLvF?!_oRqo6Z27pF$GUetHD4wQd}Y8WdXU4`z4WW;bma7`J` zAd>|%jVtknKJ5|u4!#u3-Wf99KFrA8$*J&~|Xb`;O!A1}D_fCCq0N=N5OueADPaxe;OnuL(QyGVA$5BVSzo z<}xX#(@;GVS5BTVmPk=O{UPe@Iv2*D!UonB^QgWEqIO$OqJ|Qr4W*$+50Cqr8!Rpb z#I2LRAfMqmR0c3p%i)JMjyr@nSnuJ~=MIyBK&$>Np|p;1B5`IE=;^&jh}v!S#OYU zNcJHf{1-%9v2Ett4a=M}1+xX5v@W5^`c5k%vIu95c z#VE8gWEooC(s{f7ULn_N3Mq*(QERqfxT78XSw8k26=0+aVmZVrD^i)J5nnRHr;M1! z$1i6JxYujB0nOzKjRSCTIFR*(5}QCBA#FmtD$g205KSIe8T6Yd4gZuw3}sPRsMkPe z)y{MmlJ~!!D$YV0IEBJM!of?97RDtjfSYO2%?VO$8K292yio5#u9<`}w6h(!W2K}! z$hraSa9Jf)g|k(p?AJ^DFaKfMc3VI6r<<7MZW9vTUqZ9aFwSs6%;|rwe;cVybul6= z;b=t*n_M9|9u5M=;d$KnJr#2e5(EVlW$x;S0XOo}S0_-k+F+5fAu%@ES47HSZ>s?u z03@wF(2D(2D+k8GIA2$wUU27;uVW-kT=*8{d(c1m%u<8At1d~Q5P4*wkk1sFsRR+}Xx5(A&PS zuI?PB3c@=H@deeWpR*l9$Llmxn~PCFili&trEL4#R<%t`_4Ktgb8Vb(pye~w-fz&m zK@+68{0)l&wdvnjQiLTr%GgaVw|ypJkS+3uk~!5ZmrtmMVv{#-53(qwtELiaZ_F&- zldO}=*yOp;+BD&kD6El%#=q_lsuAk-Mcv)@kqE7Fs!qm;XPPOk$f0quC?N6ZO~8Z- zj1ai+Cb_Ic55GsV*^Gsq=v2Dg-ky9uh{cY>;ruZt@h?cq@-!u>O~#F0)Mx)VdOJIx zU(C=4;hV{072{4{gVSwf4M$X4$B2-kQ+)D}r@nFQoGY=cF;;n1$}q8fTJrE3UJh0E zg6kV4_elE(?-UY{*k!6G$fe3zLj&Z3Xq;S~j9-o8jVv)O z25AxZHS`Z|{_icIaw#yG?1@@c-(=Cna$e!Cb3)7iWg+7bNtsHssk6=QBxI!j7hA?* zmsntqGT5hSMgQFKJU<*>yWrP*Pbn$lRfNoPZQ`H9kJb}V2X?BWc6vh~ncNuOmP?*3 z+vjmHqhrCAE?vEjT0RUmLf02>j(IWMg`c=C$u(BGvH)5O{hz#LqS+A2-cqfLTZ>wp zOf)`{0cGT(rifF*{b2r&uOtrB)78xO3PJa#=AqHuL=#b%K zuRj29`nbuOSRNvMVs8*SRH1X7H#zYz*uG186=@ArKU3s`AmNf^;3`aM-w>8QMJ7mX z;PUC(J0d4Y*9W1mH}w_?uRbT>P%olcXI|q#wN)Sx{AHsstG7k%4|7x4SZ5j?#C1SS z!)DLGP;1*&R6?`Y)Rq}5+#wgb&n9lSl31xXN*oEbQLom@4kRyI?6QU62JwDmDM;_fI%L2wK%S4w#^y2K zF0jr(>L}28@pvPWu~Z`?CjuBWF3qRB#7IqC*{HFLijlf%fNoZ$qD7tur(w`&gv!B# zGtW>eE%-Bbogl_2Tlps+2DV$bsUvm#+Ll@kw>j$t-U0qNQQDuc7@teD4WlmhJ zhh1{0q3OD6{;ra#W{|921CzahB7Dw0<7hDyN8U#iinEMvi$tT2meXk^GeC)1hr(c5 zfPu7N%Ysxz`ku;Qk{M7`2!ouCG|^B&!Wd)?VZpvr@^U;bQ}-QnX3E^^9Ej|c5@zYY z8>h|EVBxfCumkK*0jBTYGOT-g?`SQ(CTNe6(lvEj+pN{8kqNf0)s-0jg^m(HtA0XD zTICs#O=#~D7A$B6)mKl#q&Q^Q{IQIus%Ph<9$%}Si4|fP1Xpq==8ANtSj&z;Cj&U9 zV8o0sa^$8SziIu9w|D3N+F&aH^lCdjjtWCEJk%3KBRY40EV*yvVOGA zK#ZLw80EX4hSQ)|r^+h5!!7?CQP08QgoLcJ_KTCoM|6iQWsspa<6^1~c;$70QD_!O z`+}t5Cay(a!7pLTY@Su+u$1VlbUV4ip4+hLPgtL(35+7uieAZKavpnC{i7?K6EqF4 z2KP~-tWW2OXLih{ZdVR`=nAg{82gS}ela%>eQuVKqHYGej=IB);p7nEk+?6ecvQFc zR-U3jP=7kT@*-XqLlx;jO1q;|_1;2=spl=X&OBkSlu19LHCRY+s*f|L{z}P! z6qtR(-bn8eSm^g#efW^fCbFl$s??d%5xXnQPM9Dk=zFV)On1{gSiuU2@O78gn|{MI z-ICG(MK}t!P#lF<1eWT6Mi@5fUs2w{fG+V!f{V0$Z!zgg>hNlQR!=TtCJgVifZqKe zIH+7Na3lx*G)H{Oc(q};U`GD`nvm9_qde&}FnyXXB8$R@N`wKI&oJhTIlZi)az!%Y>j_-@Xx72K9I<{=W2GwW z(6JO&Eq#EW2O9PF4AwIL#$2Nt-*-35dqUI%HBBjd7)98cW6o#}9&}{$O6Q4K92G?u`)l))x|M zS_PHmQ2i^{gySLzAIZ`LY439Gf|GX-1+gy{jzbX$n1OvDb$T5|T@adK$h zL(Kt3lp-M95aicmfNZ;_YD&`(1mUF#`7s3qO$(#J7RG6M$CAbwZo9?jlK<5L9Ahh* zh9G?GltqasmAqDUYON`nKzn(nTgs%_y+AkNEaqFYEKAL8B5dFtkoE+2`POUgDDOl<;ZWdxaK^fVwB7C<#GK7w1|PESrN&Ah-s0S1kmT5Pb0;ewd!t=R1I zqrueGEi%bRa3w4&Jw4$Hp&f%ZihApypQzNT2f+OW0lnphMK~2H-Z2Q|EJG35di5WY z9zkmZaBAK!hV)Njn49(zx**pv(aK?wB1t`?eT0|PJ*T=zKa2{x!d7w`|01Au*JnGe ztY?rFik~z6PN-F)ZGb4jTt@$x+R|u+;A*3RngUK>wPsOb+PZF$hYb|J3ZQ+ui6$b} zvqz=Jg^_QQ$V(6RQ`D#{kd05w=|~Foo8XpMg5(Et?^^FsZ9ORIDgMCd7Yz%(;7cmb zn>sjiIvu8f2qp*iOG~p!Sa#-o`Ab$EIp3LU+csU! ztPlv&`5y1Go}N3-g3fIoHK4hBufwN2S+N4wDzSBug;IXJxhJoyEd8D!m8fhlR1m9Bp9Cju(dy6glYd#A;F#J<*Wt@4?)7^ z5(r*Xhs1SS*xnlfU(jo|v$ZGAHV~+wLbrRss>bwWsrcz~G@h9I8*=5`L~+^VA6#C; z#mF7u{C5?GL;D$0u5KvcHZe6iViG3}?*HJ;xJ*j&N}?r1ChxMwZXy|W9tVr4eOV?8 z!G*dOeZ}B;!h@_}M^=LWoyE8$f3t1lM8#<^Dba>ZyD`Nfs&5oTx?L6=*6-gPJh0TF z+k|ng>NE|5uXBgL`1szHNi9)?@2wMB{)_aA(;G56k(wT|n8$5}wR^J{K&RGv$`Na0 zVe;bsU}VdiYi9{h+$*2zB{^Av+0opApo$$d9;SB5UPukb1<74knL|d9t%N$I||*_!$Az)H4ss2cfuVyEw{j z2T3D#-8n$JUAbiNH^NK55a)MZ{14oW0V5W$2lE{OxRpIbYa?lZvaA_(`wO0~6PC1b zyvYTAe*TN4&n2lI6jFz)pK*w#0Pz2&3AP@&$1_0rEOR{F%bFBmxIai+K2!W@dfOD9 zS_GCSkdK!q0m_&s)Qx}-M(5;naj;v73*;I}T+oo^)e}NtNP~w_8LEvoBs{c3k(Uoq zrVAe^G6!*RMi)gVHYWWa!bgSM6xXayKs!Gew0FPbl}<4KF~qUaRhJjcd_Nz zH^`8X{5A}itN~e_`!Lug*b=Uc89-fNVQ3snq0q-w5oU?Y=uAnMQ<}=fzU4@f$DP0R znP({5MDR&nja-_SV@N*S)-I_U-R+z1;UKD9w1w8prJRMo)Q7o|0by`S(}YAc!6 zL8+OENNVFfF!L>>BHW_$6l0)G?~LZy$r$7uXzL&t>u;GE{+6=(OJM-E+sl7`WO0*G zv4YfP=a$26_`gCQ$kXBkrTGe9k-ewXZ+W$Eb?0YFjs~HeWAvb|jn_`(M5bXt&~%ni zx^%mJEeknD2>-pI3xg_HiN<-Qb(6z+JLkP;gI5ZR@W0zbGia!rkJ;ZW;D<@8vSG(0 z)cM3(IK;tC@g3wN2g{KG@YIFahx784qHnl>TsrXxu}B1>C+Twb?S=}I2Vhr0Ir;-9 zLl3BX2Q1K6K#APY5_a1}@TZkld?I|!a#*!}cVdOSA|6V6A!-GMqAR}Z%*e%t*!81k zt&rps2;FMQ)t3sYM88@}9GNHmRFGJr3pw>cddYrFWa{u*=dgk0+OK;$frQ~~hgl^E z1EIfmoo9{;#e=reE!w%R`h`NAKPX>(np1kIsIV`Sx>>aB2~0dqQz*`+vjn%wv%7lA zDkeyfkS96lPCk-V{vUD-B+ecOm5T^LF>iX?q1-uS*jdHNs_5-d=bHP6p6ObJKa;uj zMl#idBVgz_6281CJ>+X9O@|04tnz?Xm3chLsm8kk-H7*yI)7pZ#Vuqs&J<~-m#wE3 z6~XZc)ceuDYp;E6RkI3rTa5S$RB`Jg$Ps@8*VU_}f1PnHG>oO5gTqe(8r%2kr?Lb7 zd#BF*B2HqwBD}u(a2fjMkykOH)KfIF*yqz{eo4-88oqz%9$Q2TcklEy zor)-%h7_krpxjXD7~V;^F*?S>dpHv)?_3_kXmcI^TdwEOP^SR`1^o%vulv`Yv99S^ zI?Z;KM~{lSDc$*LSWJ*)R&e^fwlC}xW%50#>MfS((RU81PhZ#i2JqB1E5q{6&Ad^f zm5#7@S;q#e6G0H!7fZ1aQnx-++fiII_IYT-Y>>m|Mm5ZaxTUs6LXc>d%s*6&Jy{%~ z(b9R04+9pN#l=49B{vQ1ndc$yGhpok%{3RnJ^IoAWZ(O+Sh4!rE|NobvbM(4U9J*a(oh&bqZORv@+wvxb~1}Kd)76RLOG7R zm#0DDp}m4KZiHsu@*FIU@dOMt24k5h3qqx6C1{7q{B>iO|w56&1sHu*i%C zmN8DxO*Mw2 zu5PE&2)3b){dQyO!1nLVWg-VpBon3c$o*@a5luG8;`}P7ymH=(yFQ9;oI9X+0d4eh zg(Z#z)C3i4^tGu`k?mJuEdG_5{@>3rCvPqyD*m{XXAV_U@?X9(F2A)$Z}b*}Dz#D6 z-8;3hxBr^qL~0iEu|F1plZ)!qMZ}k;PK7EEw2te?i%?S#66FG?f+GAZLIP!VC z{HzO}0+lqz&#LS=zlJF%DBRMqnR5;B?`u0dOa2w=wbjB(YXFCJkl$@!Wl`bA>+5S@ zn^JDMq+5Loj}(kJ*EOQzY==fbhr`CB9^_P^s; z$X}KjF(AoA;gQs2DM%&F_D%T_qu)|E!4yOwi6K0k9s_}|04;Qv&Gl zUp`Z*m$DJRwtMjj;CYO#iu?I`bs`&vqsyXo_COYs~iOQK~QP zSS|rnB1J9=bxsK{XRLebUy#7gqgCM_-=B`y_oy^LBj=x2X_@Ty&Vx!_suH$A-dlM6 zX#!l-d=pHx=--j@@%2aGJk4gP(>mi#-H(gZZd;WrylT@k{uNY>0& zU}V(MB)d+@1Ma`^F?zQK$DV@CZ@!-(W%_BPcvWtkX(f^2j@dB+VyUkhhJZm(~$ za=Lzoi+AKdk)FDJ0oP9CI-dh4luZ=puG!>(=lwClG1K4BxNkZk%n+`$2y$rcG zhJrQ70{1J3;15)Gcf973bUUZoNPY#&htd$4-LZ~bA7KBl7O;2EJQW@~+!R)D(nOm@ zmK|c8W`V2K#qD%6M|3g|35W$@eg$>b>zl4hn0>%~opp|7*^RUS^DpLaq1G2igAs_c z;w3d~YGbE}gso@m9D>gG3HGKx9hl+bntl!r*x2P^A6P{2DweT=vJi~2A6@iUsN+qOCb@H>0vR||p3+3;HCb$-h04%pGY?6!Zf-jNFT8UNvM zSuNz`zXgkU;){2PPOXPk2l?4e5@pF<(oRnaf5H=;%83rg18O*_p z>(kOShYBP`X5-IZDhUl_1l~xQx5f%Qi6w+pK%0JNe;<*oYa(Zs#|*OxH#@}4rb*)D zOjHgjP^ZNX<#<22gd-K04sq2|$h#-RVq-emIX1+Ko#4is73{H;if7s@Mc<*8 z`y`Y|ED`Cx8fMAyIWs&-KX%GxbTZFuD{B|T1K^wN6i$s^U z9$-X&U7fU@tA1YtJ-j{B&u?-&E_5$)($;YA=d;uQCZ>NnA0cf%T=>=%xD$rbFq_$bVo3J*hB=KFCLuhJHc*`%q^Z`8xnN!{ zBPDN1gcOct6SH({{BQ-XcY?FMt{$s(`c$ zhPz(Cr~enGr~HyX2t?qv{F5%2;)$ZS)fs-p1VFdyp*9(srqP~Odj@k~MxE(@7WJ|? zlrBkxO!N5FyqlTOUm3U(DA{FVe-|h-)r^eNl5R)06r8EHl^&C)A=cZ5W|*;~{^K5O z`IQ>y&Tnul*CT1Iw-gH_*E&xB%NkDPUl8g>yYtRA9Skq5yO#}%cewB;Ff&ZS{Jpe> zqV3bplRsmF&)dP-i)4(m|H+Q*!w==G^uGZgRUI5H#-@VyZ-?%0^276p6n}m{xUMiw zU2eU1__l0zZXVnDUtSt@nRl}xmA>#M)Yt2YeG#^V%{I1C@_NPiYYdnCFxB4Lg!BIHR9Em4;4 z>u4q2Utt^MC~Q>{WX0Opt{{5+f%Dpoz7veG!lKXE-L-(RQsk^kIkj6sBnNy0e1VxJ z{YeY#G*Li|DvXQk*;&VN2;dEwtg$LoZC`4H54Rs9KBiR>$;YiPWV|Iph>Xz|xnFTx z2}UJV+4-uD`S9%vL3b*Mpo1xm$o1_vty)WG5NZbOcP_e`^Jwh6mmTt+CpV)!#$g)pc5x-DQ@2!t6Bv}Ao|F6I)P@uj zGQtR+P>1Yn6bDIsmuMFgZ&7A@T7J$H*IP3-yP*ClNM6$Cti+B;YEE^%{TuLo*C)XD zS|qy=Q}{ck?F0>q@?@4Zc=k-u#iBk%i<|-znCJ$h2Cf7U;L93uR9#5n z0LjiKiH)Nx7_vj9CvVxpC>?&LJ)-+pDkN^)=Cu=4aNa|j?GR1mH@nhb-0Tk>jC+0z>rm z*k8Z9`PkO!LFA#ZKWy1yji=jw+59~rM2KP|;M{(U0n8oR2C2aJdo8fMzT|%b=AW0< zLuPCJ-`ad1o&l-RFr?1|Q$L`MI_^DQ9s=TtS!qZ&JtSSJ8%{T>zM3>V1@l%|eVwfK zJH5)gB>mDDFdag%+IFdBcl8_9=^Ap89o6Dd0Y1xW)u1On2-(7*r~cz3bipg`rPq~` z8uVSJKj?w7>9tFz#>0%F1LO?FL|26^Nt0vlmRDR+HgCJ3&@x&VlG0L|wMhzJu7@Zg zQdi)y*$4XuHbot<%28S`@{S0ktE(0F9=9a&GU;hL3eh&p{F+qIL*Uc0dfg~HgT%h% z;F4_9j(&Bmuw{ae5E>Q>;YKIWh<1qFCWJ@ZXEcaGcRVl5{B?L+`7)_r%9V$L;8Q?2 zSZgq=+Eydm6vTdO&+Y%2eZ-KJxEpg8`aBG$%3o2_*Ff;OKK~31mr*tAWjeW01{`aE`&box=nM1=3&_hS2C7ZoZQ+8!cJi#1!yPL*Wt6$LOqU6lKZfv0b4z;PQ90yty{y?5i3_np#PtF*JxELZ1vGhXaxAAg( zsb{*FL8_VX$rJmum5enn;2mKhjR~@)Iota9!%A|?p1wl4l=xq+ORnM?xLItTP8(b>kLCJ?w-CHqDF8cUi!M& z@zZ=e5Hz6UMa;FKxY471tpe1eL+axNHSEqzNXKsa#9xw47kpk_m9+KS>8%zLRST;n zho_kminf<$wxepjCKt%k*Mr7Y?FyY5k$~|gFTef%ONU&9j~s;RLH4VhFKbEHq-wjb zi5LfuqQVye0N2ilQor-hUZ^I_R8LFo>d3(ws7!l@UVboDSx8g^J7zY)blS+nKA)~B z?mJRWOk9rh8W2RQ3_iMAsFH+@$OB&!p5qhPX7}3^EERZN zLAlp72!`t_Lvb3|@``Q8oHK=8({v}37)UjYPdYE3W1E@E*yJ2p7r9yOb^6VJf$0vy z3MbUDT5+C2^4L(_hi6h>xZ$Pm;zA8ndTK4%JBcc;6^zrn;GdWr6d)GOjHu>E3{ECT zdEOEjb_b~isAK@8#+RmdP^Q;Ky0y^BvsOyF6dcKIq^r>??ouxGj1vA`iHwb6dysmF zMK&QP?V-zk_NwF9Z&>vaDscKla(4J62akB-Oi3AG*+fb@1D(V9) zbai}{`y?$nm%C6tF>}+8QdK;$=5dCP&OMhKff3;T3@G`LD_4{TOmdyp?6~~UeKz;( ze>&qM-IRJ5#CZ3+%OT5czc1#Wy$(#-VlZg|Ci!^TzF)n+T(s|DcnLqZNk%aE{z+-5 z(OsD~{_zKoM5mt<-TyebrBgH;_l^QDL%8+FdiQ4C!*~RPYPS3PBL7zVopQq)nmeMX z=Sv*L#&!BI`n2*F*``CZRAaAk(Lb$gm9aPb?_?k25uR@^vZ4V!IGCa)chwawSqZ9X zCY@^@ixquM%H6jFEx$cnLx>T#{0=I_5j`(gfHw11uh?^YLSBB%yUs?xPh;-DheznI ztMSDc! z$SSY%TIZd}S7-mpO5kO0#AVwN4aS#8>lcjYWn(L=ui150+0=jCTe=U()*HAcAZ@U! z^Lk>_*^G$jkIl&_Jb-=8N5MX$rlAGPu@Vto(LSmB_T=SROU>*Xj3f$GmQXmF+bOD5DIO8FJc{iqbG*@}nH+8Az zY@6Pndvju#52^%pO*8GNGYDUVwgp2Ivq4Q0wNTG`I$$cgG67>=&tmT8@B(z&`U!5N zKJ=R+{ePLZrPy#1Y|Jaykb^2Dray!?X_Hq{M&b0Ir9zHl(9_x5f@++YvghS@@S!5x zKcn4tOQn6%x_Yr0wrM8%|5ppJG$GxzXU*R-Uh@1){JZ!2wCOeet=Y3dQJ6-$(Jn$G zt|J`}!K40F=f!-zU4t`p&aM`V)OM7c+7r{e)J}#IG2UDFc+AhHH2C_UF zU8NOtQPCU;#F!l(4Y*aE^eD-RZYT4`);&uE!rn&K*F;-Wa;o>XtVk>*J@X?LIlJ;! zzzt~~*~_y?AwV5?(?04Pw zH2y^3Jl0XuFXTm5(^vQM@J96B=1%+Ovhqg0t z&l0lJ_Vejg*Lq8q*XW(s9Rv59X2SXA{rr*9{Z0r^fXy;T*8y9%_p)*K?<~Lg)1J+( zjzc!lAIs3%a2D@ZT>-#VjJFXw{>?i3OY^9}$ER|Zts6;#jn)_YMjPFmU(B^PRhcdO zMjx9-H@CWoA8%8w&bfbXev*`1e=+%elpXL9!QQ!hc#iQ`1XINV=3B>Q>vi%S!RG6+ zYb6NawY^!fdDCov@w^|z7}AgU1-KkXkn6R2NjB5+rE9O9;w`Vmu`F?t+oF}!;x8?~U<5@~*@K7;&1_?hRTvgyURmyzdnT*sGnQC?Aguh6a%v0>7= zT&hDHSE7Nd2g@ue2ih-|q0uYREul!rLjZTAXf0vcL7>#_#0s7`DRMXH+u`7Vlb(@k z!JeGcDK#2;_m7#;PQoomwq~#kUd>SNIEQR4sRuPVH-5DGsBXR~%Mhn|Bug!Yd79>4 zIy?;xP~G<5a_aXS2{0&`I4D$|+R_1y7w#&fG)msyR>MfkJa6t9g(>3<+;uV~T?|`} z9&;I77MoKDL&@_a+fukebB&st453Lnnrj`#pDGLjQaz3=-Dj)kL1Q1K@+i778z9g? zFkgm?HZC$e9CX>G+LZ|Jt5z zk(Pdf36BwtOyoXqsocZui%Z)Xw9NId(Z)1b*=F#rGwqpRQj83zcjd6Q8I(N6m;}yA z)>>?#6zwRtMsmE4t`_ouFEzk+W3s;%`9gi?$SPxp_M^dJ|F~h=N};fsb6*SpDMiVR zTz&axY3X0=(i8xU>QAku;-20W32MPBM>}%+?O_m6ty%zw2}0IBEmS>udN1u0{h@sd z7oxw?_8h)eHPJ4rty>z6WZEco_c%hQay}laVqkbdEYe%ljscj+*ffGW!Ye?@@8ogA zV_xAmYnILi+$tPT$B7X^%^ZI(3I~dpVWaEK+g|z|K_B?y3bx~cJmPaP%K8XNa{yjx z+dpdnuSwTgGDU~0s^d6+i}Q=Bk?V5m6H~qyKeTU=P!sOavu`Wj68Ugo0 zm%kUB84TY0B{%WxTRRZ^u>b0nJMD->-}&wEEjXJF??bmrG_EDY{?ZGW+Hc#d=3%j> zdVQ&H#cg{)W*>eYf93g)s>dEUoIl||qt`d89>ez@c@8?_br7uE&l`2;JC3@cWx-GH zQ*9r>;gz^q%8+r!sso*xjdR=(UE(?9C-<(O{7-{)1Dt!DXDG(RFzyc9&?YiDM$5~g z42a@6xGJv-9zDFfjoQB3(3Vst$tCKyxg_P!!%P{dj?jC>6J>w0q8XhD#Dunx7DsOJ z)2r+?Qk3Ih#kL^NB2lh>VmKuOC_n!RF*qcj+!RmS7$lP^gTU$MHKmlu^i&C1``Npl z#uvFHr*iuTCbBQ`Q@?*JN&ljIxnjD$dmzMH4{AV`YV?YX)`NX>DkuxxGap$o)t%CH z;FkKHNrGAGN%stc7GzIl!lkxK#6PNNNUu7dkjf$%HBdt}8EXRfSKh=lam+#6x1}=u`K3=3)xGG6qgJg;~<5!$OF+Bf55r2 z!acD4+Rz8Nl)GRP*u2fC^0E(rBUk9xmH_wi9AYYh)iff_H)$Iy%Mx};bEW~3`+Ir* z;!DxHEwIx}iMN1<0D-d)qVJCY-ybn*MqGHYI)&njTvFzWLFfsg~D|EN^Mtc|J?k7x%jJQ+wm$);BNx#jF!Q5=kZnxv}GRErk_w93b&PB)d?~Z=Q86OY3 zM(68nHafPBhZUfVZ{~9I@v8f^T+jOm`l{mq!rkVVy=(2}hQ7`-Fx5KVQ9-!DZ)r5M zLfoAvH%i77vu_n+6NUn8{{#n{aJ);tf=g29?^YviL1qL zgV{=ab}hPElyF5Qy2Pk9!W~OnK`UALQqt0r)mj}YYym5pK2a<%3u(r91GZRIk}=*7 z_-f67CXshzNiHeezw%J6koD1E6F!Spv6%SEBx5MzXY!sDDa!%NG1!cm8&z!;@H)!T zMdl1G=`)&yQs1kCspbiLM5y`It)x3lG%T8^io8-Yy<#yLN|%Gt#g9i}0#CeUGj)nf zLRzmo2cL28z^a@m$4eXxL_N8W@7t+QMb-1Z zZ(|@qtur2PvjA#W7DJyWyDzO3WIrL=zGP0`zY)lc%QR!yYsDXh!)EAy<;8D()VXR9 zo2fLSbRR;SvJ?+xh^5TzUfj)%a7aqnaGGFIg7ePO{{Re-m@rio7jV~nL zD|^+tUp?uzn7JJd5#0q2H`A!+wmR2o zNrBO(b3{gc(^@TTUB-kOZK+|#_mj=Sg2#%6gmo_dHS>9EQeT_oM~LflHVOKY1HK^sW?bC`zo}oWzNe~ z#1d2*Fc=@m?FBkLbpBEN)ow6lbys%rONuiprJ!9Nn$1kt&{__{t*^ruZV zwOJ8hwDjye3RhAh8=SUT;keHl-;Pr4`yNT+eO?dP?J`)EC?5Ge2yC|5b$f`moj1nd zL<>GZc1F>`xANM4w{epEPxm$Z0Io8m>oBwe=XRU1I|B0_!w;H80`Dhm0uMdkhpz@s z1l!p$IFY`g&b6I{DW4fT6nYoZpPCRYul^mZ`4bB!)txW-x(L^icsuu#id3ZIY!!wY z?Jwp{|3L4N4ZwqI|C>M`a_3tI!{cT)eScGbVrG8#=Y>Lu_^TaXpzh|5_dz&*Xiv@Aj``oV&#Fu}!;P3z@`pP!wt^)y$5q=XtRpY}a(=wgW$XW#$ zag!ax!bMQ2I+C(vIx6T5RH1*UOuAn*dj3FDBn~k~CEsx`Ee@vnlxuMU(Zc+$#*Nq3sI$Q8q~$46Ezd23ky_N<^RrEd?SE zqp{MW>%tIQ8kFdmYE;0N2`Pmhp;*A_5iF+};A^htCb`-XpA1pN^RNZjq;22mC#?;{~ri~=pNR_fNSy-ajyw3}K zRPu(Hl&vmHB6`kMyM3zV_L>xOT-J@2nEK1 zTo9^eT%3Vq`$#3rn$AOHi@OAR-Rh>B=O)pwZa zwVdjF)%}%P9~g-T-|hffi8S#?4uc{t@}m^s%bWI+a3|^jh|2_;vHFD6Hv07 z6&FE##6j#PlU9?u)mxJ(1L8L13Fkl;0SC<210v?D%dH&W3<1BoAlXF6+I7hz+UW~R zzc-~BTG#}3;zL3%-XA~$Uw<`_DE+o?sT^qh-2~+`zzlDqVX{?O9#LUc`0GunsjM-N zNW7o(A2w@<)3Uo39OSj6NYCU%=d^H*Hx!loqLme8L-d{N9x;XbQIQK}$OcvuK;q7J zf!Rbz3Jz~U=_ht<4&)6!e?^d?FhF6HT37HTfFD$Lwbd`J0nKeYlf~tnD61_jIkUt% zg+kGEbD|8+n4J4zF79=O=oqonm20=s1qc)o50idBO+vA&Kh3reep71Y*A zO=TC$3qss_E%sEN_-_l?+=SLeRlYFV)%9FF%$B$4*oxk&oG}LwVNCTzrpQH8m1?7*x`)Ku@cZUfq4wq|IjKy4}kE~DJ`5j$u zMjWFj`p<>xGlc6t_mjeCHu@&SkT1Q5txs?Ny{T-Y*0uV}j^pvuIsQH}zkz4z{I8+E zk1tukhacZ=Ovatc*jd)#z>7Fw)tbK)-#c`p(_`=C<**;zy84 zTKE9H)Gb}zuETXCb371E*Lm|XUT!j@WMD=XwU?c29~FrT#$~KZ6|&Jed{{nRzx`VO zxI-2VQ}1&hdO~-SI0K$PuM-^3lpLS3{jcm{DUYix(G2r+b8eJpF8e18k!CjUxv(2Qp8c<-&=q%?}B|!zTuh2X0Mt ztxpp6y0k=3=Q%B^KgAKFh@;WcOo!TF*hxU9;d@A_um-+@7DK2i>bTtjO2Wsw(!f2q z`aX+f#6uv7cvQPeOzxo&g^RTA-%us%zN5bCmJWCh@u`Eq3L z`XSU}q>>d{9TIOe=cNi$+Uk9~4376A8byOw{mjqp9xG1NpXkCc|5J1@Aw`ae7 z)r}~LoPhR}${%0fl?w|>JrAIp!rl%7nCmXSRUmL^V}o}b_{1CkQTc)N6QB83ug4OC z$^m8j@FzW(!_G{|txU?4Db8t7m6c9RZu4&N3TpB{0P_6C&=O)f$`z_!i4o!yUP+7| z%k9!XKv>&%p<+d_y0(HnDvSwM$MJPf&IWq2xMk@`ZcF8WW-F3+@Dy_(3IPpousi|f z?cvg&MI|EZbW`5@BIT3*hm>H=`4LGb-e(}kSJNswXz30|HMyt_H`jX%k8_HqE2;+X zhI&)w28sdB!^%)h!W=v4poDZ3EjOJcg|&t4ueO!5`#K|Bep>1EMX@wY;smpc6&{s(74Q0Yyaap zq>mMCrCt=SmV>cuHox~ZU)4+k4(GiI60!?WLi3}&D*Kc`BPUJ+*yN!>e_Q==ee0`AEUf=N?w1&X<8oF6OL%~F|rsH+#dfj8Njn&-j zZ|rt73<`*!xczn-R!7_oT*zuhN5ntT^F&lMx?3ZkWIk)z-#u6n4i4^r>g$f0=brVw z@ZH4c`%1eXKXkM0xTOEwXVYS-;dbZcO_*m#{2FY#{QCG%|JuC~HpicqNEbL5O`qGj z-!nM&{yO~KInBN|-oXA@>@m}I2CWv1wQy0j0#rBMMoQ_QnWMXg`QwZ-b~q#xt97H` z`fUWJn9P!nJW~-I*#qeDr4pzd_1jV7VMG?P2J#MjVQ^ogw-+~(P!&dqHuWxJh<~mC zq%$u#@Su9&1E1)sAWFVj8jy)pG;nEgtaox*;vUt9&Nq4Cr|^0?DM>=B)-KaH%< z8j>2wo0?D~pgP!}AbrXcMF+)Up*!3T5n7JpMX`tqlwlKUYC(onA5dKrJ);`5KkhE} zZ!@qaFh39gc~w9!PDn*PIMHz9p|3b$0f^b`L@5t)ib|od3k(y`i$MiZqBKzMeswS# zuPu4V32>%%qRd^JaT%tXXjeP}cobm3H?X2~l^26txJX-AK8Z??3qlXEe((sF@G#Og z#W$HdkRiHs8+DY{z+IsyQ3KGZD2|4i=U9PE28A+9CYLWcybKam3bJOZBw~vNc|w)H zctOcj5ZhZwnmSMLg^S++TE<;!)$?lN`EcwPb4!u)Jbq-b6YG>^jd?*;O)h5Uc)ZU^ zcX`hR8AM*8nLa2gh#vAc^xTtif;^2@c!xYL)hw2+)ME$XP{2^wtu4#h>!O76>2m~3 zF3f&X)lA5o)W)i@DXj<2$y{365q&_hxq?46Q(UbL8>01aqDAV$6uEf-WI^9Nl!^|_ zY*^d(d!2AEQZyo6dR@0gJNv=TUV@w*Pl7d3!DP2O1UWP}S@< zn;uJhx;W`Kd!W zY=SZZ1QEe@8KI`&e0(mlG?J6TK-|gq_)Jq%HsuL}s37^IqP_PBTqRk@0~BZ!LD|{h zQCj^)Pex+r@M`J4eL|)O0BI;FIQ`uyWML|Lk|W%>I|3tmo98dF8*dIqaNsUsu9TR( z{CUy65t=mJYlxn6u^~!3p$Tz?;`4uMokJm_;}cpk;x4~yD~~X zy9hvAns!LTw8nD8B~2G6cSKOw`Z|Y#+_xA?1njVsQYzpm;DML^W5DqdhVC~#U-G5i z%h*IaN5ztY5zIEq>7YLc-o#uBAe#%(l%}OsNt}Bi92d|78LxrTX`?;m9)Yb$rBa#B3<;|ejKa8sF&gyRFOkeG_xe)^VxjjAy?e8n8|jhn z0lx8mYaBPe3l zfBn=DHvjsNyquJJ(ubwjnFajl%WimP!uuRSxPHTY@4X$m8N7x()q%@T_nTdD2ey$# zA1?5&eM}$uNT0XFu6-mOJ{Iz_e?8;SzaMqG`Csi83WuM(a!rLJ;{ADR^tS6iPI8xn z>RV2v!_spX^boXM+#W{y!cS@42{{q8UhBuo+i>k}2r>qRP@b5ct-p%%xf)k{c?yV8 ze#SYam~o$oq)dkUb!-S_(du#}!gK_u4MWlGBPulpZU09LsN?4Mq~Q6t=aW*eU+}E$ z>rM9&!!Znk-D4E%qr`uA8XBb}^;e;V_AbP|b&FI_G_=|Gh$nFH#Py=C3MH!8n1iQ>t=pDsh$t5tz4h?^QAh{o! zS3Z$7doJ~|q{Mj10De_mkP=hAAw*2WxM2Zkf^krLuers|hBkt%JHq)zC;9!x0NjAv zh=Z)|8Q!DIQbJlM@9;Qwpxh6q`|BToHnfRm38? zfka4|3ADsRyF#jZBYTTQ210kuk{p=ety=z?I-(qqQs7$e(jf(8D7v7fJxu;8YfzwL zwn&5SYiBkkZ*Uss?>0Q>p9BW-xm?F?()k{ih0eYg=5pW29RJd``xt0lwe$PB1dW#h z{)KwG`52zJ))$f~Ie$K|+iWHB8SrqDzRu3Zzn^ur^1D8~0{a-vig7m{oKG%+9j?=& z^}5Yw+nLV!K>wRed!O5bZvMyo`L8vC9WQh|{|wFk2aMGnXX&lp`D>utAky~zaqPKz ze?*`24KqkO{&q#ouGju6tlx^Y@80pI4uHYuc#5O;G@{bstm@ltA6Ibgksz%dufu+m^~sjTUT+i0 z)slo4O2d0lw7MO*hctxfZ)X0A`FN3*zxA!X7L-;7RP&+p>$Vy|^1JN}f92O^1AEM7 zf!>!>6pwfwPFIn>1pYUD1Rbwm9hMLPaJ5__CEv&QsnF|pAbU+&Fi^*R8t>YtZxyOe zl(a^pX#9i!2CWSW>FoT4$al>oDh`=C&ia&?YwbYPHK0R+BJf;Lg+?&pS8lZE!@phQ zkx8zk(U17ab#Xr!`NP+`T*8Pm=0!KV0lg|T6fYqOQSZ{8Ziilw9Ik#=j@wI zmVKfpS2p?XK7LaDL~#v_k##`x@8UxWHE2Q^*vN0P8NWGWJgWb?^YxKpNvG({JHAc0 zG?9jOfKS|g(|mf0uS66;QBRrfA`)>UT@AD}%Z7!$tez1$Vry=JM-ei(l-^80d`-lm*`M0wOvVL2C5my&ERB_oDErM77u}N z4^%fJ`Ni_HzoYd@OXP!EgYP4<>LY7&rVv@!6zz^xP=x(VmFSXdVqO!i{P&?wu9)WM zbSzDtR)G=tfBfI3lUg&nsm_zrR2bdOv%%+ohF6*q3=>7ZaCK=IuSQqn$#Oy*4Rj8RrATTF)ug_djkZ!nlu>58ciHbt~kWJFJlm`tp~X>@pN zC*u08UoXl-BW@fsv5e>O3^okxgS2|)n;cpjegJo}lLix%70jwSmDMQZQR@K|`aifu zs_R1dO2#woix{%$g!WNK;jv!u@rA<0#jYB%3?9$`xkEo@SOd|f63&xt`h--tj~jZP z_G53*5mu8MmOHY1jqrVyBEI&$&tn*l$JInChh&~NN=QxUR>;QdN~~j4*Bz_r>iASjlNv^yrm?Qjj;yhe7NKd4nmg zHh_)9gjQyU#U`~pu&}xw?8Hg)8~8@Zt-L6xCeo(mk|VLa;95@cUsIvzsA&+y^G-O)p5%=1GxNRO z_WYS?tTXb)G?85>cS;*f}P$!FJgmQ+6q%8~6%pD-{D=}%T zd#*|~EXbofy%(4jI^;^t7w%h0jPWb!oA#R%oxlO3>%p2c+ke2P6~HRXX?b>%Y@%fO zoxyj#KOai*)pY%)A2N7vpC56qd`wOVjKW4Q!tSfRUs}IzjNr`)daehJy@(EDX4`vk z-ncqG)Y}L$%30NSzHaq58?4r+{AB_`M}-$@`>e+E%ir`1=HCm1doPZjPSJ|`SM#&e)_GmusZzochF$;Fu(bcV z9oI}Muz6@Cy~)a$Zh=5YJ({(AVizvL5K)G>9#J|+bF&-n66cl zG#kmWb_*cfuG^EVyv*c+GpX8vof}^@B%yqg+@S`ly^KMMyn!R=?51d)-^Ov@dlj%9 z#NfFTauEtHjJ+HnR=&)v!cY+7izAzCy4vj1ilSsG=sNB5Ss}u`piJ=Y?+GPQOH?f| z(m5D)xC&?!AJx=RXz%`jy*|q3ylh4LVe(U@Tr8y(k~GwVe`{_ewb!NKuLtjh)XA(}m6EtYbcF&*ImPklDVyy6Xv2VhP*wV5@%n~l!BQ35Lu-G1; zOSltg=d_0AGBDA`l?H-!<}r=s=c8NOkEP)b@>TB+rK0D=eURoBE!}6O{%4 ziF3;}29YOd6>Wr&n8AI>!_-JM(0XaIwWwrPOVrjjk}n~Al?mHDku=3?biJj@8?4|~ zX_V}5CZ~<1S|fcXR$>O$=12uvPsCNt>N6++%lEWvrLbRd)lF#q5rU?ZT#v}8PqmLEm#6i?W=cKcDY7B0 zU5Xfi$DEB$8I#&6!=FfsV89JLDQA*Tjnxoqrv*W`cxrZD>FdU}A3uRUPj2r9_d+x8 zvJd6@?t`QC0sQ@5^KtUO85QsAwCnlcKK1@E134$@G@V~^<9&_~-22S$U!B!v%RVlr z)>rB^+HZB&fG@k^X-C_o-XU_A)%th6jy_fWsEd70fnqAKiIa597TgYOq?Cplj1ANyWj!mKX-+?yD(of*1Mtt^Uh1S$n|dhToF%$cHuxmzbfrhPdSse>IA z@h#02Fw!H4jeWuk?Zj??_2diMSXvLPk6YGBq)=Q*w{bPoK|+HBXD}P6C3vE9oU4L< zmrDN*I8xTBMGW9*RQ&Ues=Nf-(*-Sk_OnrRlFQ0chl0Wzj4yf8S>D!2P*;0QEl8pX z)Wr$o6;6;Cn-upQ&i&pIT*0>7P(TFtYfaoUEDwJK(tK=+t3`~E%6wNSD`n?XIiUwzaA7oVdsF)2w-U$yr7+ObQ#VY)NHD=tOQUQrWU1_ zU{AP*# z9lR&{Pt`M>7AnBGAh5`5@FmOew}OIQ%tkcb-BuE-MOl_OXkOm4R!Qme3-YM04j_z< z{a19eviep9w2eAI+rj&1$O*##X;XgDX-J>I?<}VO1E>%Tf;+HSIMD9ivC#tR!R1oo zT`9-p-c9n>UU}zEeXn&K$pM-uah8X3&`L5nVkmlQ&<-gu;ykYBl?;^X9HU_A9Fu(k zP~tkiR)k>Lrr>N!+6r`HhWlvw$t>SdGHbm+^%{jg9=yx2ja2mb`-YmzTd_$n4(kZ3 z5t7k8A#jf{lA21*S`L{)c~y<03-=E}C)+NX&bmsg)5<0Y@2>h=W3CF*1{rCH{M2J?dD!G<)h=`yit-zfe@ zhdND4gjJy;$L4REY@(JS(w2i|YH!J-9#EmqSJsEL1xHu02NQeOGyD&_&S(cb!lpN_ z0M+(74%?%s^j?>NiOZMh2D~EGn?L{20uXrfyA9!5D@N@~*)?*^C0J;U@GIAsIe(dt(R`u&`VJ&0Io_gN@PSq0B9%S9SQ@ zYUEU{JQg&0hM^*%L}O@VjFkr41D^8OF&Qg@I<9RF9|>EjuN(ycam2M(xipSCYE_pO z^5HgMkD3EK>1~5@szHPrYEVnAED=kxgfv)fR|*=qc~1ZY$WP7X4jFl&H2;MGgAr)3g7bqp*pcMdpWck!iTv zDJ@S%q4R`u@?FVaGJa!BAZi@#+9pJ2qae>39TBc>qs-dou1qHbl2l$h=*V(B>tV^wU{Sw1~jzDKXAc zyY!#+pY~J5`|i;|Q$5?{nm8OzE0eFvDHmK*yq>`U;k-EZv`Oa=SdwhPTT~9{ zCen3gnJ1i4Mx9G=eWOcQ=h#y_vy0QjY#mctN6F0Oa_gnvj1IfWdlDX)g#QEB9tU$W zFl6Ky=O_P~V)f|C)a|18JqePSI6LMv1v;Um;DEW#g)773 z#7v65Q^Wc>hfo9ED*d=CzdD7h_OV$MQqz#(c}~Ab`cnpFZbH${t*K6{DPb^*4f+QF zj!NGa=bI2>kNfY*%{8n(0>3HWuE0OAhWictvPDK9ZOm?Ri#+o&IY^IGM8=I7iikKy z!6|F&XgMD~n7)If^0d!7qH#E+I=UuP+?5#`KI7brk(N8pmJLLT@zB|7ZsU2WrF;*9 zQrMi1aioEyMXDt;2hHvT*YrA>&yD*xp@sDAon?d7T1)SsNZ@+?>ph8Q>nx-%0YS+% z90ddqgA7vrt!6Nke)QRirP_CkAbr~)wv9Rxbhz|(5LzX5h+P-?zA)t;>3^=X9OaDuEa zTRcL=G0MS&zAVS`w)|_m5_CO({P9K@zK|AhvNKo)YimfQA6QPFu`mr8Im6G|ZuHn9 z0Z=Z>87&OVX{C~;eidS?L7@N{5{;GDO-D1V##iK{{>r)q`WeVWwDHV-M6DOUV5sPq zb@l=icM*QBL9M<48OlX8#c_|VdEJ|zgY?FHtrNityccS}kbG>U_|j@o9PxE*&pNrc z3(5{(X&biwn-$6^*eLsJDZ97_RC`CAb2KF2SE>vp zsFKc#Rlny#BhUFd)4ai~01_4ZzQTL?12=1`u0-})^V*>bFj>wpDydEIV@pu6O1c6U z3%+OC2;94hFSmHf?g#9Dd)+3ref5)SjUq-VExr_x`HC@+2BVg0`DR}z6c#-NAEcTR ziCtPyaqA28&3Arm__V(4op;^|Vp8Mb4%52!oYVBaWWDNL<9Z{Vy{ajr8qAYiinqtT zY=e`Jje7j$=3A3?rZ{p(bfE3BwYM3X(+v_sFBm;m~qPvNx>FcZtMQ2p-wKD^>6lXzISGhaju$hLjwG<-QTF6&0 zrZ=OOZlP^OV(wz}Ksy^@Ys)~C@>C{21v2JpRmV#-;yKYOEzJnAtXZ+ZuCQp9g*z^P z<8BQg%@C^?9JM<@YtWN5ZgM7>@i1T4A zhGVaM7Blbg;pO0y2qdoJPSXCyFg;t4vMQ;vOc3IKlqeq1WJTChqP}XOoZqFQRl;u- zwHWTAP?k+L7>b2J!D;ODTJ;n2gy{ahvcfV%TU!DWy=c#QU>l~Z+QGA1&38vm+MEGZ z6VBwh{PJ-%3bGJ~Vug{iN6SJoUeyVqk%zbdu187fMP4w*a!HEQcTJsM-xU! z6W-QoI%XU;W3+*U`93xV$#Tldo~AM_Z`IYb_1Ns=%TCG{oTwIOD)6ZKMOOErOIl)$ zZgl&fsb09swYp@L0IsO~zo zW{C}7@+*k1Cn36~kSYr7x1Od|9Me=>h%M8ik*HfvL-m4PKC{_O!P{C0<7_PCwXB-M za4}jJrWc5CjTaeAq?Jr6!ku?vmY37d9Wlr`N}wmu%|Sz$eQ9_>WU)qZxEfF&tp>Oa z!K-HZC_I*V3GJSc@Rf>V&pEGAkxVTDl<*lRiis4dFmc_i&q#9iR52l;E&q}#?>0ND z%=o$6u>U>8t=!VeGOuD^`E@~6K2Zi!4x!Q1C|MOktRQEpxaTSTtr?D^hbK3!wVb5-H(`kF zYOf9k^Hj;P!Kh+oDq;4mScb}@wz6Il_aonAUywW;4m7f0QhnGox>c2>#IUPB_+#p> z2=@)oYoClX1e=DMru~4L6>oaM1|=jj7KqAcokBlQM|ge{eMabZA>!RCPa_tR^N)qJ z*phW#K&x)~5-TUkIEZ^cA`V>AB2Viyln8vW2ejr0Y}GG!BlEwi*v0ZuaX;)RDLoWe z)w)77at~^^{ln6_Nyl>3uV;BF?G1%8tLjJJt^f|d!o|(hS8Al+>S0?kdmyo%ss+c& zqw-&490NRpgMm7>g{**CRyG9P>8^b&88kuyk6>9&bDwC`YYasX%yy@W?>JCSy;n8+ zSR#sU7XRzGYaK|f3N=Zfk9iYvnjUYbtPBy#aOF>C%#+HPHj-|Hq&d6>cxR8?=W zQgv`#ar{yU4w$84s!Ufr!tBa==4n6qS6p zHE|9QC&@%~dT{x6h+)d1NXR7nor8{D{E>&yLn9=2Ogi@gxh&zwvkd%1!oQK4tF0^= z8>uvFVVP;R^25GGOM1(WoK>12FsFw`bf`M@yUY~ZCxbq0=0-;3b8j%s;Ml_?qg5=$ zV`6xCqCJr^z;`xL18Y~!=u3g4tmPrnWzWmhx?$oLDr5bkDG|+9Y>aaw37)XlN@Sh# zAo=Ks^9>XNsjhFW4EsH_t&qT^6{)|kB=e+4OByX?wM*wsVpQoN2<+X7mC<0f@hHpl z%^UlSeC4K^t#nYfQJJaH^WNdlsl-7Z5K0UT@Fudb&JF3$8hsZvE29c0RLq}158UMT z=mCUUqoa&{Xs!*@y^FHilzfwrhDUf2rPzsFdYa*R)C<-hD8Q1e@!WH>Ot#P^sAymjp4_HA5vqjdI zDc2&g&Ktb@hvWBojOOx^M31l**<^1h0F@ky4YFJW33}b=RnBRw+1x^$-Ei5=!vFir z=iV$Kqnsi6=0@uMtuEsuEwXzQDpQ`?%qGG`7n-Ly4{5negiCTv%(b*TRTAaYM{DMv zzOh@KJ1o+4TDbvwOQh2E+I0V5#`|wq%ew#K?}{G2hxT* z`%xBD5u#@MS5!?deJZ5|RUCNtg7R5RRaBZBm!d_JuVq*zvhqHTO7*CzkCBvtG%`fB z4zH^grQ&Gct7q5_h?-U-o2$Fc{H&X!QoeACC4`aN6gN%bqoHi)nevSL$H>F3KXNSD zCwdQO11-CDrY|p$T2Y|FVP{8qzU;U<-+mIb6zi2~B{($bK9YFLfA6Nr!P`1GJCoE_ z52HBXDm_c)=U7%H&|zMXz0(otuFH|dUr*xJTvsoW&&)o*%W;BfydcG(&M-j;SvLwA zn`l;6M41|lsrh&`O<>)eQW%}Gt1LaYypM=!bC{*3m|KcUk-vdQG*pl7v3(+wuFo8yqQP zeaL4juCR1D@`yKj^#!PFpk#1WTiWO~+UQxfswJ=<$99$q-QAbI(nBEyoG5{oE*fax ztEw!)vza(HvX)*~k>39>s`f<|%lF(HCuDH7 zzx_#Ziq`idS(-XwS82Soz7w)XN}JT){_=-$U=-YEYs3K54ZssEpgAxGx!KL?H?s+E z7~z6c$Sf6e%|($AU^wC|4-EPQ28sL(no4VTBD2q6;zU7K5_LlF0E2Lqy?6gMJ8l0T)r#X7f5anXL zZgDylmwbradMW{#Y&Vi{#z1@}nJ|Qc3EG7tQ`!N$JD8a^$tTyOVxlvGbGU%vpr|NC zO~!}3fM*cKb)tbpAWHxFNnwT-cVxqO89?9617@4{*BEl zcLNSz?s;JW)}p_>KIbS6K%*TOhgEf!wKk@0xnwqRXAk1VbigDt>?vr_O=T_CH}yb5 z9c{wsiFDq8vEa?*XeP!N8HA7e%~%mFuJ-^xkQ?VoHMHHh`QCZ3@&CW*|N3&1b9ZTl zBbY1Oyg1ANxKtSul$Xg!__c zO)~oLD;%sb4yUn>hL#yn4|UO%x!(<~OyG|`oYqKjqYuH5G(9-PxRPFf4D1HXtKI1F zWW<$-bRM#O2-oaMcAjgQ(b}Q}iHNKMkdfN}TV<&!qS`%S1;;H(XA`>4g+=3re9fT` z?a4ie--R%pGKk$5tfm+oKB}=!Ki^%xIZwfB+Bz;4FXA3zCYxx8_ATd02C*#?QPHse zgLm>)*M;9mG57{3o$R!}g)(EzRAq z`YlG>XrN5OM!LdYKIK?ayh^M4B+r~-G0E()gW?hP*nfW_d)ehs#(SkMD)14@kl;!N zD{!sI)yXl``di{H?Y3{m7zcyLmVU5I!>%?d=a&CWJN)>a>IiFM#14gvxtnerIbc%k z-NM?2gmBER%39j(7~_Ni3T%xZwxSF3919$mJ+EV58zo%|9ab1T+e*;%A#ojjtTrbu zJ2VU)U3$TBL~)&;r_=UN3f9JdJ$QKwkI(9jO_Js2_8QQLf?^N^KSz4pWJ52IUL?Q0 zEu5134h9l#=QAij36_&hEo~4Z4{{yU$_M?7vXNCFYfnSs<0+xB%c+B4!fc?)N;rsW zD9vF!NHr)2UdAWuu7bjEByPmkdys)8C^H?nwLiLrI72O4rke{gVDd?=MLFGK8g#M2 zRB_eC=3jGPrc4j3H)AL>J^6r{VA zCI9>a**T0NVZ&VGsnC6=gs0K8hq9U1(s9g*NEeD*T+>xUJ!#Z)a`8G~Gs`Pe7h_Dc zm7tEtBn7f|aadAi)A19{^{!_h>#WI5wKB2pZr&ibq z2fWB>SYX02rjs7VWp$mspt?sHhovHgAetB~6-91t@M#dwiAmJ4V$&qqScna)J%N>B z(^l3}@Cl18F{`SS!$hVzCPRFd`3XaPhOZ;l;L!yx^!K207a_p~u&@iAl!&AhBZ5Pe zVb=nlFE031DU(TwR_q^6keB;bZgevHdto|%EKtwd;{ZsihKkgNuyBG`6=ja!rXOBW zmVf41L@WwwNX_D&9tBpF8CF6tWy+gn-;&!Zr&uBe%C=_yNlap0f1^-aig7>_@!0tB z>#m}&T5p9#a4C7dQf-Oh|1kAcVQsD5y0``kMMHswLvVK}?(Ru&clSbzy9RgnV8Nvn zDemqq6xS9h1!^a2|K~sZ+~g)to_R69jBkv0yt2b6soWM*&KHwKcTkVYEF?z@(==y1 z>JXQJ`WV+%gPf)(CLpd+W%)67VvvV&vGopzw6VP$&lec&%t2Vz`hN|Z>on%nS2y`| zstzddi|A;=_eoie$P@CF>{Wrfhw3_J4h|idjFvmADA|GUefOXyn>apY2&GglUwF_5 z=lzJqeo%g%Ur*&q5B(L{ za&b3pg3~i_2gUfB%>$_iqh1o{CY!~zELPK{u&L_4f0^wnl)OeBw@&PSwl0)a=yt=j z@zzV#&_lOwuE`C|47X$(Cmz&ETqi;W>EV06`EVBS_`LL=Uim7g-c6YcAd6F}s;*;H zfYVzZrD9iW+Dlu*zYk(4yfnV$!dPX#F)AdI$Qk;hO@Qr-!6s=sqXVAO|E@&UpTUHP z#Z|i6*ENm!(*9xtoAOXMZ?6-$ct6lJd>QoVk1Z&m_Ya$H@v#}m11K)%-Vo1XX`ftH zsD7^=`ZsoV`^S8vA_o6&@+Wb2`wv<0c+CN-f-eGj)b^;*%ITw)Ue@MlRM8e@*tJ!H z@DT<}EJVRs^-L|-2j6c>Zj`oL?td~rE_tQo2pGpPg!6G*tb^49CI^(n8P&!Fh^S1& zerlH6{%L(o(@)Yt81W_ulyYoRM5CKiN53bzfa;(re*O~Xof8jvB2kJFYvfW}yY-;d zh=pVN(*-nRopt6ovh3aAU@qy`%%DzK^ZOF=B#1QwdBM7|Uq zp7~PS!W-(xLSaI*hmZCo%C4j`GeoHJp721dMlRIt#}E36{srbAP;E7Pr)1g%M~M@T z#HvJ*6Omk4+?E^!ic(xu^!D@r{6&I-e(O66DQxWz7rnU;CBv#jSMuH8!bWW`S8eX!%W!El^Hdsu zVwpoJF{Y16how1=UKXy8`kt&g_qf=4G)z~bG2SYk~ZjU`N~;6$OADO(c7H3iv=THG2k#s~e2PL#@)vFkgivXt!U{`Gw{R!ACKBGysXNrcv z)2M0<5+P1Ww|!|=S)$=^)j~(E5Fzxo&xA}>oq?8@`M1QHGY)#gF)8!}t{9N>brc1` zGklP>a^;0JN(XB{6lzMC!Pfm%adlYd&^^E`2~nqe>=Pwsg3ovsQf_XcLLVg&if^nH zQTnT@aq7ojQV7SU$EY*|Bk?x?*=N1=Y*JV@my?^hFB|d7sn^C8a@}d6RTCl6<8XDLYE%1uA28c})JH)Ew=tiH( zqYY0aw#Y9>k?kk^c7ITy)F)Unj-|N#mj4&cp^F_2jgq>XT&mfSIv{U#sJk1wfz%9h4T-z9q%af?%{Ed=9w(cWaLx97!s2xFfvy9Eh+b1f}Q0Lvz@g)w;x zsftAdL9CV3PiuUO3M^jHx29`q*AaB~&v-U7?3~ZVgmh96uBu|h@t5zzCF~d6J;8%v z{j>k*)lzzY$9W@MhVs%iaGC|5DpMNJ;22~yP!SP5c7h8lO?Yj(^NBqW%O7S)fZ<); zYLMgi1Edvxi#CGOtN4crkfO$OTiL|&GyAglZ>#+wB9J=}Di= z6-OSHbi*5C^d|*)=`~KF{PTOZ?~M}~&*|;(w+2+Ub2bb{1w1J;m&zyj*5k_V^H5U;(Kc{TV2z}u9>EO1SpYFY`P~X{_F-*d%JB} zpqpAaL|E_c%}c2-D$RkrXFw%C@U#VrBDn7x`tX3jN%`_6yp1Fm9vs?j|6*O^a57=5r(fS;^dvCb~<)o{k+Cs+a6D2CnguNtdm|7-+Y9x2zQ(iIfh zPE63y~z&W49GwMc`Pn&H=Zpt zbM;P;^Q`sqx5x~Uan}YXoW05$WvFwgO=;S*;-hQ+{qOu&M?w|`;v$tHB%&o{Gou}<^aukYknV%jVb6SSWY?RpA2CvDuyB0iC72Z>#f-PexlX>&p z6@Mvg8K1r$ZPGvFg|WMR=H=ZAj-lC!(aigIVS$9Jql~6spDNnC34gZdGQf)b#mO+l z!l;Hf#*Pk~!F3?RroJX<(9hA4d63{DQ>jkU(uOUs3|E~Io8~x`hwo=ch2v2ox^k9N z-%2w$Nrv4>`Je~r(grCa^Fgde+~o-~E;1!bO$o%cN{f8NG}8L~F~R6XmA0CG;8+Xh zu47BmCT(ef28y_41%3!5r^DQY>;kj4jXS2c5HQa{NNw)0{~{>LY4;!rj?b$%Px4H| z42JeZYKFsUPF3?S%PVm#>!M|IWz^qyz}EDp1hZ?ITv~X5yr2T>DNatdf6m-1phwhw{#ZtpuHGW z#hf49n@F?SM};HkNhDmU>7#spGPvn0bg&V{oo4z)LCd`XSpNSW{{G$XXBqu%RV-3(nHM!Mjeh~QQr5`v*E^VVz8>xft(h~M^oK{(MZR4k zxBrFvSmKy<)GJWXhc&;ayhzxU)|WC8fms-5Wf{x`SUJx%n58U7Fi|<;8s$*3K4!%YN`42fCMTvL=Gclli1@ zoSFGTIg`KyPnmd|6K=QgK$<8|h%FvXu z&Tt3+$CDiYInBIn>ELVT7sYMXqj`x=ecQb}=AJ{nIp#Ox%8L&jF)^#Orv9JE-uW85 zrQu$8cR%fZj=*m+U6)B@O>zu5sq+2w<|x}9$G9VvTgqYd%|$A?D(thn)Ry_m?%SIP z_0xVb9U{i1hD5?(9f31nOi?bTkZ(C? zmtm-T3Iz9*mL~p6Q#3l}VWv6U>%rq~jA z0q>~Nr-xUwvYkF`n*C%6&Ehv?Xpjm$9r8}>C%nc~JN@dd7W4QhCO9%%t*KbW0h7My zlUjmLvBY6pwW-aX_l^3#wq;3~sT0EdQ7j})X6=(G#E;4e@MwT5KPxw#$q{q`p=1eH zb!GRQF%U;NT4iS2B6ZMEE_TTDSu7#aU91+rY^bfGE#3oCp**G4VggpCyGmVr#1EwE z^_wz&C)`NcH7YfINU*M|WA+TW8OKONp6@!P zxwMq;z$+a6gEu6=!<%~O0vBEOvYHfw^av}3>Sc=^LJ8k3Pt3!){bD#Txxh=%ClO7? z>scgGnuc=NuPf+crW%Q;UCX80<-wg0NIjgj*G1Ab$^xIl`cUUwYnyu+PkmY+9&+q00M*A4CFU75Iuse#p^zC<7jitIT zMIpb7{2T@jaWAJN%Q~;mzjB&;jglo!ew8-$?D(t=9GP`rB(v$>j0rqhy)sulvRCU< zH`drO>%HQcdw-a1e}~B(dLPj+RzS;<;{5LY9#3|rNbVF<$A_q7n4R)^-}hI%iSxyR z-+oQ<2uo=G9IbIT>*7p8$UZGr#Jc@^7u7iL_9VKC&NH)b^kgpH^q7VpG)7+rXcd>R zr4_E%`_x<+l#U04)XMeDtq2im1>ZVTg}g3o6X0YyyxM;EMU2oZY?PeCg~>s&4q76R z`gzwgR2y4m(&_w-5@5)iG@i^glixf1PFN!L2c;_CNW6eJ<9PI?X>0yi92JL)N+X&V zileY+isTbb4#+)V#=3{N4SdGCEXTjnfdV_rsZsmifFVB&nXR~zlM!% z`b(C9oeP7n!r*O5U6XHZZnt!rE-rI3bJ%SA>)OS#_8?|Tmbru8X1q*&dxt*t1DKR@ zgYVMJyiI~}sjjgUqVuQLrOzU!z8 zW!yU3>V+CFBLplENlm@a!q4l@iSxe>x+z*8XL4w}-23HM(jJOdFH+vr{k6JLH}7@5 zI)|mPnho~8Vs5?aQM&vW} z-su=zbV2o|JGM+c>@EQR#ydlPbk|i5%f7Ozd4MDHBdh zW~kgQPT*>TQ@-KMWV1^78>}cZGbq3X$2Flnv@E0p-sl0U@SjZVm_e`3NMFJ5s(e+J zlY8^f_4r*8QDk3~vu9!k^Ffh}>>&Qq+vzy(nm)WCr4Lf$e=2F|O=zLYUdr~ATF;iF zChm#k!Q4=p8c{s&;b&i`uS0ZBP>Brf|Ha25x@_<)%Iu_krM+u^sOxpPr4*H%P^Id) zH!dCu0VkTSplg~N>eX>XDc_xFUm?;i<1PbdH^L!FjMj{@vwY^t$}dUzwv1Pnj!zm> zrMYk2wjUf5pK!-CTk~0BRog_L1!vuBj&ZRFUH!(I@a2SbUoc0&mh?ELdIkNf5uK+S zns8Tor%HWD{dK%xSPZ&re5v~wr-npr5Sxyv7o`G>00eWCWx zOVwJ(YaY!|e+_n2vGdd6V#VIguiQmG_NfW!6@MNR;CRQKP!DkbWo~zcbr1dSstV*6 zjLf*d>y5-|?d#t1zEZ_8{!hZ zkr2Ln=2ZSQbYT6CZ;(FkW-E?RXCsHvFOE?>`>(D?2-oQgvJ?UeesWU1zQjRkYfTG{B=dJMi%EY8XtD&;cR zG`L5z=D8`yOZR+#B<47+lE;(UtwgK$nHeO88>5`(u=l7iDq!Mfwb~jVMj+YYX#CE_ z_GMcPc$;_*hr!CfAD~1^j9Va(jqTe8t#%N0HBvyQPL2eRkcK4RB704=WHPsS1lHH6 zm%6Yo#7Q|>tb672PJ9OKm~LuLS_-CXCT_}~5+2JCvwU z9ZMS?N42wH?;!)HJt;D3U@|Yom7{W3k-NTq|Fq1N{l_mAsb>Ap65TIaucz?crJfTy zi@H8%QA`+3pR041iFB?T7vAkL2hS^dI9Qsge)iv9HEuHV_nq(Z`gZJhv3AvFyK51( z%doMsp$f6vyBG+Z%=%gA5a5%)+f*&oA@WYLzgMum>f#S9|z&d>WIfSKLO5Qel!=9`uEvs+!A;JmFRdF?VR*of3Ip zeOZW{!nkD|*UT5>GYa1O+fUkq=%`tO^i%$4@a&)Eqnu;4YM~)ht2~j$kKZP5Eqm+jLal z+x~TI3oNdz@&i-ssn{BPB*jEKS*FzUvrQ}$y9qeBKW^+X^oCdSNjkZ~64#S8$%1He z!?VgVKVGXSM-hTa(2rjpHC;k`gPK&&=r8hjR=<~G>aIqZDTIf|Fo!=$EQFRvi(4i% zJdyBR+)B=Fkp=`|VF`19Ii9W`JKNl*l0?uPHy8id720H<1^APfv@y72Qu`f?wX8BU zN#~>Ft)7e0V4p*#nY(Cx6gRjbKB^r#7Q@x! z3>}il%5+%&dv3bRjJ%|0*du3=IjHA=ZEWQjj7`hQxt2 zOU-Oo68jl*k;vL+50XE)r@&KnX-uCwMIXz6OB=OczGGURb|+qHtu$wQ(n4-;Fx#lx zu^mjinzU}POqbO2oSA>yQlGW3*^?RP269ka9ePC$esx~u4FSgT@ zTmsLtmleh>KfJHIi5qr;?PeuKE_{GFLo>ikT;kY-^>(jb*lMLnvu zG0ir(n~#w4m#|Y#&0jF3sOb?qE2=B^#9;Rt78OxJ&xM`w zM?Bvkp&^fg7#beu4QG&YHpu<*u``3_{>^rP(K4iWZ--+!YyREMOaGM;&oRB|jeh$T|vp*G1zH=WqrUZk1<`Ovm)K;{x^w$~m1vv$W)@{D(y{(6? zzdxMu`=jys;fv`2?~yXrXC-IpNnc-V)$QGL^bc1RR}?woCf$$B9COeBcSYy_x%oi( zOyrQ>O3;svsu2vEJ>x7c*1Qajd-n3{IM@g)QD zh3H(=#c)fI{E(h66gkwg=RC1yq_R;N@bLCQ%;MTAF)X_m>DF_g)XucsS479WsumiX zvcro4OyCOto^p}XuR!W&@;9|y!%JLe+A+L_9i$ya=MO^lKLxLV;#D#0Hn6@UmT=ip zLv{}&E5fNbz|pCt`zqZp%#f4_{pubdgj_q-CWRB9u@P})hTTt`*jkt?o|FZ2I=~r; zOY~y$#yxpac>+kln$18f*`1lWw|RAZ)uBx3)twAam*9V}hQBmGP&H4EHK(UA;!xOK zLBPtYWW{8v%o}!}=in!JZDL%K zrd=!4y+XPewL4j@Gje;b1GG$CS^fYTgA!dSDRmBbq)3$6;IXYWLX{t`D^jGdVe{`C zb{E_8Q>1w0J053#n0wi4O<5HFd>Z9wdbH_(zljTZ?@vS1A*$Q=$lOto_*0%sNOKie z(>alX$1UdN7~*_{+C_9h)zD4|i72rYNP|11+2!<+mr1 z2TtXPL(UqtoMb!^nDoO^SbM%t71MI+Lq4j-6wdpfY-e}E#9AcMfI?I$7BOUC!mqi+ zaKFor14cFdsFqwO2MVt{2EZ`M9I^c`7PQf?n(g{OuaQv*UztaFT#%o3iK;NJ@^5BY zfyBzW5Ek3_V;1FY(KS(kh>+w_!rFZ zo<{TCbt%S=DkvuS0n9hQV;D#hw}DlLO?9=kx= z;8$K6Rn7Lb@y!kbtdxSCwOoXbgl*5+X}WUbf)RZ2noqqEyrB6I{NXLWIL(eN{sa%g zcHLS8@qiSvgHp?qRc&xr1{GEZeyWF|CHgJW{>p}~!m=i%>Zrr-f?Uv-ucX7P5 zyED~|6?MtTWFvB>EJl=h4cWR51tn^mgydaz^9Gy=$ch_;W7&L(RurGn35spo_$BU< zBuBmeWgo6RP3GOKE>{ZElKP#XVs8i!$h}5|XCmk-ywy-HMpEaFYji_%Wm$l2exCng zqt&e@IMk{C*n;Yl8QxWG#qvp1zJT2TrFo)Licq+K@4>d}EXy2o7v~!%qYAGT^|>++ z3-3w8pYPipp2m6`UR#X#tTOK#*7CfS)`9l)h|M8Y?T3lC%+;ggw7Y%5m7y2suy3?F zcSxqi)c97W>ejUpP+j!2Ym->bZB$I%X*1}`Mf0NRk7KYv12HPKt|XG?c9qji)<#4- z22b(1E&nhj`A7;t*Kn&${z@E+s};72jY}$g?I(^hTscqR6~zWJ*Se6(v8b8r>dKm zy=Q7$O$L`7ENkYh8_k=Y$uj^GYq4m~hdT4Dj^0@KOLDfF%Opz6NRm(SlEYzkf6hNV zU{X5vX<>Wj`wHOkUH8I$dN|zI7s;Qf&D8m6EoEh)$80WPX0Z-L@kEB&fy4~}W1{LN z9`0361GBG3K*_U8*Lvt0X^+JZF5P}|;r`@TFI0jSvOgj0xm*^;tVwZ3su(mLJ1TS> z?Au4le&d4hxu6X`=cc(=w*bi6^F4Qp1HJBx&oGOCu<7u81p+TWH{!_J$t@js!OqoU zx+09_m6et9T|B+SNbLA!g?F%#QaVyQv*jiGK`4?U(PrneD%)TNFn?=0HNa?VFU9(eIaR8Y|pt>>rU8rEnq#^v^=J@zb=l&O?E>c zO;fy2vEW~>2K?aGD%X5mz>uRp5V)PE=`{Jphy3$aA=7sIjeA(;Jf}pb*hJ+nnIoPX zUIE3`pNXvT_rBa@G!3l`m7&I`Goy*~uI6($&Bjk0G$JBGq8z716oqdL)rU7ZjAqV~ zi!1&(j&4$zdS3Ss?C2)zF+24^tvE@FP5Psn@J0#`B*6b(y?@9c0Z153Q*C9~>U`zT zxGe3Ia*yY({Yi)*)8tc?smTn-ZB$aSzAALW&t!O{irSx$za;JVT*h(kCce*w=--H> z!idSkhV&Bq!<~kFEUS8>H5GBr<11!~b$&ROz?>RG2iQO5_aP#!2>sKut_-*C30c)J z+Ibj4E|w6iK2|{AJn_wwFIA21gDJKBWk!3|9oYwnkfy^Y+H-M(YQ75YDXP0#yvXQ_ zRl)QUxgay>gl#_wZUO|p?)dK5mWSbDCWVxCPcmH7%VgnMxBc&9hFxZ_;&z_85J6;i zwzCzI*7_cW?WMzq>X*a)2rQQi6WoEmd?iVAY>&M&`)Imvd95s?fn4lH%Q{2VdJhGe z6mEaVrt%YB@7IgWz5OQfXhj-&_dw`71677x=3k0nGrRw##1%H~(vhdfXOLSkytwrA zJl5TooEHnKQKPO?orM<5n+H+heL^wR*fgj&s+fCLBf%uU?Abn^h3?G26VReEZR=$Q zn3x|k;Q28LEz1Uz1XQ0MCT#GF2PozXjGNjjA{;zzp>b$cq71jIyukUf>iigbG`*oN zjMZa?qz6UH=Abv_D0aoNzsMUl+&UDUuO}dJ3Cg#D*^`ajXdJl=PAD32U4;sZT5|KhZ%&n<|CMLOHa23gXYmL zD55RT8k91HhW30Hg{&`5jWQNGMn}%qygz8&^~4R0#!gcroXX7&GWU~CkiMISF`wu! znz&MVtGLvX>m{)n_>+$qb{5C}WzSWN>Dd8|EGEF}Nfj*`Jd;~n>!#1&Cpf&ZU)Dm^ z`y|oV`xSK62~0Z{v1z;y5Me#b8v`A|YcTm-YP2rYdn7 zhRZ`V*UUJVxkqOC{6{={-cb|duRdUAPRBWN|Le0zqpf>X$9fGE7X7hObEzePxU$9m zeO-EN5dh)4ocLEZ^mEny<@XC-+gEtY#QvcEh8fVG5xf^##b~{Pp;q1Iq86pz;$dp9 z_BBNAQyL%-L-}&QH1)|b$K5AwG4DW@!b4;akJ@q=<%odG10}t%JOfRIA0UBa1r&HX zeUTr}dmmcLkr||6ERda&yoo@ver+_DJ#vL$#I{R^f-#E_&tGi-axD|2x7@EZM$D-! zX3)v{X?P*IGm0>tg)>2md}Zo_R< z8|zT(t=BE-<3Da?CX5v>Nb&e!AQV56cby{RhLNRl%zu3pqd{T%JB_+SuMyg>_{PM2 zv}Uzwb<+s7WDQ!(l_z}#OXV*>{yIv%uo5~@`+_sZWx1qdaL}gzX z_e*>(gee*;nb6wj4}SK@W$oPq1gVgLtE|m#`B`gJakC_@SEmRCDNZ?1@%BQ@06=gX zOlZkO%5LnVyBUSe@!O=u*m9+ZTAO4qg-x8X3*8UBlm&F0yM>oIaS3D^b^s}cQiGZA z8-Ae?SH^Gu-NYbE_mTMT-sS%=<{CMSE%JP;Cz}opiL&ifmrb~omlN0VsvkQ$-;rj^ zi($b`aZPI`$;i25|6Ql8d-F|S`FdpEhKL>F)NIAyS1$)j(e2}5g(R2~9!L?grAlhx zlTUxZ=<|Mnx~URf4@_hn)$jx8*tvw|dm!1B865ZWO4rVPLsL}y*>-Ac2+7*xwXpd@ zUBY;AZfoIp)j7o8Q(%w$Zo*>h+-bz|us#;LJAhuJ60g%M%HCH)b%4+|S(r@p_<3Th zO0lB@P+6>Y&XfR0`UYZg zxYRp>fXSLLZ|=s`r3MWQJ)iuO-y!(7g#^G|NIq_|csWWQGh3Mls+gZ8(hhzo2AR^a zv=98o&@X6^fHrsJNsfs@v-(?gQa}f*%LXv+5f68P9k&3j1#;Om-%5iZrTrVIs>QTT?VQg%VNBw9C8hA0oBOqCJnxTwBXJe%4bC#N%8n=Z*D>LAHMQ$ zei52;UVYtpNR&>lCXy3F-#xBxZ_R^%t5d2ie_VovnL6CBE@O5KmM#ervp}_f388iX z5*b$+EAPvH*aFxc%=4-OG(3Au!^|wff3ITrHApDtF+~pq$o_$?nuLGr(Im;rHu~O( zFYiX5qfNkQI-r#y!r+tJcQ|d<{ODEW-F68VWEL*`;n57AZU!h=9_T-Z!!-<9&j?r&`tC$Ya1WX^uoTuOIL%c(UULLIMf@=x}F$e%*iNNn&7R|{)7%mu=kAMUwm5ccN_ zdgo-A@Ri(SN@a1^1PS|Gw7ZWzn>K9%BNyubHZ#c8GtH+?9{qG}U>|GW%g5GUSxq!0 zSVyVr?Y=3N1Vc3HEri=&sYTeEDN{l!8HcSmr_@Pfj^gbB#yZ&^Z(z+`-XQd_2S1nK zh<&pJX+tE!WJ14{kLEYbO(!Rg_rM4lLgc4vji)%PB$!xLE}AAJSoJ zWS_|4rhkHZdrh7GWYfNN$fUY)~B zeA#KKp!Im_JBq5ORa*7u#R5^Q4mMkVrOaA!br`A@_Eb^R@<+SZI$HVOIwEda2Aw(= z(8}i0Rtz?j>lPk02$cnd&C$tMf~>A=zRs~uUxJJ9u)(tQ)m0)=4!M{WQ4%kl#gqkQ z)6?3DmB446t>Zjzk1h{MhSOM4>po<~kUjx)2dzjK1W#*7vDi(T3M#AYUONU!%W+-l zQXD7@T#eqJ1ILK>eIzWob-8)V9O#gkg>xwb76q;XSVE-ZXOm`Vf_2Znm=lzJ}y}30WBqeDTY0N{)BDrpQ)c_!3vU^M&WnH1ohpcxg~*&u{EG zQk@h07EWBjq>+^FsWXy|LOo9=VV#L@1Mh=0Ey#tRHAv3?ILBz9p_$IObew<(&t6nz z(AEA_2L_7EeBV}$v5Nnjsifd^%K0^~CZ0lBn2dQ{09E;b5>NusxwQAMxJCk_$O=vbv|BM<6818GJq%Xx1l6WgK^ z9-{Dg`=v%uv_eoEpH z)os}redi_GB4)k7yD4C82^vk%STSMW=m;O_UYgX*3=PEvef9a186!0!N?i7#DC+j8 zJ+M=kj$j0^nyM!#Zy97xd-PaRF5*wcw|=0~!uYSeGfE0}J>#rS*mY}H4vS`4+I%Fx z@?k4}U9~@<_xaq-m}YXbk<)atK^eVww?` z9GN2ioFrpggxkknS4wZYhr9Jsp8HHRBK#jW_EfY15jh(DV$`ZJHJqf_b5BIhm4uyA zd5SlXD~|J(oo;D6DDN~NgW*rcr~h)=erCCMfNW?#QAevNZVn60&fTdxD3HrhDbGa9 z)LQDf#QN`4OPAi`rfC6%p+~E31YC7`D?QPL`AEA~ zz~l3fPswk4pl;gP!<6{49u}JH_>w%9Y`dCrUbOdOmyYfluFi%;e&Z~;uIQVyc zsZjN6V69-nLh}R!Ylq7Pfnc!{u4K*{Qdsqo*T^i~3SFEzZfx7GHhU5(M8G?CvNXSc z0{|j#;w%}|p_l9ihGfB(_#tZRjH1{?6` z*gAZcAfJLS3V6Jp#GT90OM(oY-sA4W{*hPY4h;Sg(}Fd2@p0-iPH*}1$i9d7_>ivHQP=+& zJz!z{EM_^;6&N*N*ckeqZP>=&NF-%Z#a0G)V?|!Jgv3_%(`#<8p{c@(TV1{j+kA_sp;H>~sJT#p@6 z%KG}5o1_O^@V28n96F^p>lF7OnXAWHb$_`NH#dogR128`W9%XcYvMNrBkD8E1b&RLqYEX6>D!wW;q9mQ zMGgBMHknN&9QcNl;g!E7p_5un-K0>i{*hk2rs2Q+u`QbBaM`pN$~csIAyd?t<g_!eP&Sz7(zpWh1LsukC{*!{G4>Y9vzVb#I3hNcfcz)ZSV{ z@!lfyoW1vKR}SGzY=$V35TOS zJY5vWWeIZb3%+rgO>ffK#*u+xH_WN+5(Qk|6pY1V-LUphCoaD)KqU>b&r86-x^AQw zpCE+yo%6bxy|CLHR(`HQ@oSXbaBsV8E#Z*1z{YlXn8!}FL+9^btv3T28@s6Ud+oKF z{n;1d_Fjr>Slp9a<|1B9DQHZqM?k@&Y}@qa!4>_rvpMiF2Uxf<6TDwAe5ybe|MZn zQL!sFI?i8C`_eTto=CmFxq7%KZ`}qD>)Y}1TxZtHIL#vm6P^B%LBgz;T6tEI8MVRX zIxRHqpfsTbuoH-NUZ#Z;G!!44;{-WgT6$@4$xz72IKWn&W8F_*v|H+xEzFskP~_j!~ib zpYJR`rSL|1FsBIq!ZPp6%kzH|w%OG5&^*PE%q~^x-$+*MGGc6d)sz4vg}RK4O>gpHNiSw6QeSURe*F2X2*lSjJ%ULL0 z2#Dl$Q*;P&#&$E*y_H-ah^{?^!r>jENR{39TYy1BswJ!h(3;YdQf6HisO>SoXPR|V zUZtkZ4^ai;aa)sV4Evk}nOE-A<*0QE{49FtZ zC(@o(^;fV1rv^WfL#>EK=)RLXEDChbyz*3C%jjq)!Ys6hk^J-~Y>Yg)YIWRZOhv^q zzGFpk`HJnS6@-+p?^~1RZuYvVzZuY=60gu_Jd1utzC62q_Dua6huVpJ#Wig;Je(x>ka!OHtz=Yb&W>oa=TE(GvC{I+LJcQ z6^<>lM0a{$=OsGSx+^>+qY2XE*;bt111hA+)k1Az2e)ZAdE1=Sd#``Fgep#@Pxt0c zDw1`spkYPKleQNnlh0UuTajwvZ@LCb{<+$5#}OX2>i->*IH*|Mwn|jaU8b3WhHFoP z+51aOo9VqvMWwQU@MwlZuH$s^##~$}FUCyjZ129te^n0|JI~rQ-Jfl9ZUNC-p2QZuoS+}f5uKu$ z6|fHZ4L)ak#WjTt^0Xq!no9t_!$x?n8iJ*$i?y)|ql4F=DG|5FB{mmq!)E0#(-V^H!#-(^!k2s}({HvLEnLkaW2S?gKFj$w)H-W`Y||_N~lhMzUnC zAgorN5d<6P`Wx5BHTG>QKNGufZ{r)RmBbU7J0@^!ji@!9a^5_y_7S5Y)yvRCgpPj` zin3{Rz7c{D*RCiiCTupmv%79L;5!fBk=MtT$8M^L4A9XQjtziuXJvYM+ z9c7xD8K%#$A;HN30}iF|Uv&x5TKRsq167eQ)@FjN|8|mMBF2-1Pm@i93KG!9S?0A%^Nf?OAYAL!`M)QJS1V-pUs=#E#F} z&ckuj2pWv6Br%g>KiHh(-2{Dy+FE<)(@a9jVpQXdG|B8IF^%&*F^Xrq{MgzK% z3qdO}gY-9w&MSS~V|m6PrwGG`?C%(<$Ayt;hRHZfhB3*(|LCjv+yLO087$+3?5jn7 zT|FzxnLxfDy_D>mD@b1WGc!v*DJG7`M^)wY4TOiPxV?)lj+?XdpI=Yfn~~MSwaJ=` z)Qk~-msJwpAVLTw=eMXE7!zrHKC|tiOx2?a;9t2nwf$k+B-Ky$_Wyn2#N1%J*d_B6 zQ>JJCKbBT84@{kNlkT9T(He18(g;fwDk9(Y#62AqcFgb-0_lw7=vy`FElEwS6 zRq6GUih-X-K`p--OD^Tn0a3S)m_b9Lu6p(D#|9bmK;Drwrqe@lV>XJ(87JKOpGVRN zrJ_AkXI^t5xB4Q&Qc9zZ{=M>Sy?0=I*S}FaRPxfvhUD$}uSIHmYbNMWtTNK6FQ}{Y z$&A|#4lnTZ|vSulyw?0Xi?!%=%^6vT}F!tL`u=GjexIcQ92m?nVP-2sy!96hAYj?^@2ucw76JS6Pi?76j2osQyn;@ z|ATtAKpC@vb3}v0fd+@fQ0pxJG#%r3vUOWBmUT|&uQSy-((9u7-lYi=BopcT9a;_*qz&2NbxDuM(fg(Hp3X+A{mlj))^A*+2Vu$%q~EE?cNl#dtX3Mf=oz zbYPYA5Gdc&tU61C^+lS}0aZsc>`>$jS(JoZ?emU;Y%MM|4?q1XuqDX+AyrJyL8z9w z&bwC<^iWV9I=YY7tgto*+`yDpR+argNG`H~X=uw;^O6or4~D4Zm;!OJOM2j1hE4%W zPj}d4MVrH?T-guAo=N7|C_WFH@o3atcKIlJq;a_t9kW#>ogA;qVVl}%LGmqGH)Qo9 zG^=JVEKI%WEHDqGNN4GTUp7=N(uY^V;55TpPj02uLDoj{c@lZ9Wj<+s-^A-9H(E)q z{0u(d5`m(s8Uk&mxYqNGe`z#gfc5#qYCe7>Y;%H*6DtRi(#6i(lS3-|--w-uorr&f z!8*{vEU#pDWvwDST z>HA5o-2?aa2~_g`5cQ7Has5&IcVnlq(O8Y`Hn!0?X>8lJC$`b3v29IkvvDSNp85UP zec#WEc{#Jrn)N;B?0xNPe=g)qu;=Nn#z)Nn_yxo98lbVa$0A+6*ex#H6#ReOnVv%V zIds@ko|I;mtpSj^O54Bmm&7t;0lT8a-t*lDPind1AxkkY?6LVh8q6Z-=~P2&9ZYPJfL}*275o~ z!WESYD@~n)e7Tsf+2yTJ%}BqAaIRvIYP)| z=Fd3Z)Vh^&Ayc`j1m6=)VR4#GlJy316J56Y*~AjCCRW}j&>=*T;^AvvpS^=7p5=gM zvvaew7XT-QZCdwVlPoLnGW1MN5|)v`#yA7VBZac?Vv=g2+fnVh>*6YrvKEs8}p^D%cFFw=YV0BmQ8zK)=1G4NNfn zD`RbdZEGngtF=UK69Xx3G%)3agKb>=%~M0Lw)5|NL>rpq7q_+2!4?OcGAVb7651c| z!9EaNfguCGIUmv(`6U^fc;$MXp=58@Fnqr$llZuZDaBx7@gSo9Ej`Bv_+pcPqq3?X zki;{L+^mkh?$kS)C+V>DwxJmJ0=%F?-TEoE>NzojclSQOn27>xMs8;!%~-P8l5NJ@ zY~uxFyf1{naE!TzE%xFZz8ZTm*yrY+;fQZWy={=lA?~s=0-}u?c;qW)*NhrEc>D0? z#m?Xo0x6KyOkC+HGNx8Ks!=^Is+%g<`fnB@K!;IYWPdtVDhNNabd7c?&gy^h2=6i+ z%SBAoU+v>es&{VAxnb}~>M@lN@#q6*poc`Z21?|_GtV*1Y`*W(>#0nXEp9E<99v;_5(_1 zrAI2UaXdCV8`aad&D3M_P@1>c$j9^5|IMNS|3Zi=75dNYX;b+sQSvn3iDpTz){G3#j;qvLt>gqvP%F_vx0!H8mJ^nqH-Y1cVM|XT=a{~ZzmW@?7QBU`GWDa@0(W(xy2ySd zHfhDFm<|^=yL#ntsq`rYSx(p2SlOT+BaOlnP#1VEmS|*d5Vi{RH8H0sC2qB48!4w^ zaSa^LQjRARPbn{D3{M|&5~*ZE#8NR@uc0C_DqT8g%|;)a#>xMhgomxvvfw_ntM^cM zMxDO;S5Sf}I8c5$KO@_EQ7^*rm=BvYwztj2{{OrDU)8lD6CQo!_ zs+goVI$v0C0T^=}GhfN=eGJm}wxzOZ`HNs0yZ4FkbCJJtq~(af12i{y-L*_v-86k< zSAoa||2s7moL%Y)m@GSaFRi4f8sS05cl|AOkIqJ8S%&0Bu!|&4gc`g?spVzLD@W@k zkB=U9ijfYToWb{RjHw>psO?|B34`v>NmR7qwyf}VWoem452 zp!1f}N;Y{)L1V|dC5OyoXn?AOr^pc>n;PowkM?bBS({S<)38b%0m`ctcGM#0dTZ^U zOa11W`JF>67=(NeEOD8IuH_6?ndL|4(*o*2pB=F|rE3vI+h2sN0w zb=M<=_OrhnAXeLY>rVWdC>=Ds1-o#Hj^ zshp(RhZ4t?#J^ESQBIXlsV?=%{knzOy?NijY_~DPLZ?gZTwH^gDito3=GsX@7B4H% zIf$;;1}9;R9(&^iU&%N@f8Z}=1u|56%#5ts9b-z?0HW4y6oA`s;a5U!C`0`)Iy$zX zXi$dKVj9ftanKn#7Y=nu3n5j}>_Tpb{p)j4)!8)PbcACZm0R+|uC|)eVj&xN=SIkm zKbcUqWu40|H#b-R8X(yJM-bBo$=X-$ZPG-qp1HI#wf&MdVdxSSxC1GGfjpiP)U0e* z5Rw~c-M!Qq`LJHM9KKoi+S=1^$r$?r$5T?;k zkBw?oSV4BOvzd;hDLfT_CRzD-W}7(*ATy9oOO=e>%t&F5E+(iAE{p}0bN0KHC7j$M zZrWY7K+AUvl$X~Z+5f8rXsmM(XQ`%WmH(wUSc%}b%0Fm7Q?}M16(<%IeyyBnFEdX_ zqw5z9bUGqA&jUX;u*a>DMp4_`!DQ|xD+glAe=a%uM1sLIl{N*N-_Q2(q0K_Sq)Ym; zTD;P$C=hQMq6*ZGdpTi6#O&*T6icQ+2u9X7v&heITh7PZW&8OUlc&}~wd&R95}`XuA2zXc4?x29#c+vtnO=Bl zHp$%}=dS2CnaOQ-hk|Eq#-b(v!!Es$wt0s#a-G9JVoPB$6UiL^KvQ5^4C(Cy41JHy zo~{c|h&MAZ|f zdZoI{LvlxL4l-Obd?tEnSZ4OpHUlaO;y|=tiOzCU&fa5u!4ysdw>K8jtT`d}o3a#@ zqibX|U~MnBHcF8HYQE83#a--yWwux~n+V$%N!b9nb8|M9qGD72mk+TQMOUaNm;qp& z{!`~g`yY`h_<*KG4EU|H@>Jgo!2MBkIM$FQ1tuKm0PaI*(f)#MX+<--WgE)JM*woN zL8DWuGl6S`I%c-5Z&oLrg6=svt6UA1gtJ6k-`l}tN*yJi%MoXJ&xEF|jMbM0$>Xaw z3#%5rx$fU^ut#mrI4T0iqsQOC!BUu}@(W~V9>k^2AOx@uc>misdMT9&3EQU2JRPw{ zNnv#(rdPrWr*d$0y#+1NW0-i=ty@0Bzxyq|`+bX3Y~ri;wQYFsz4x^6MGZ5w$1cCH z*G*ua&U2>v>6j=`@Zn`!XL}|Ah6RoL$WMAP)x;?7mG@4B#4Fs%31-dC}K`q2oSQzw1Dc-Ow} z1M2m>MKL;=q8Q5BAzpsP3S;;;(m5f+(b#w)+6SlN{ONne?A2yaRx^yIjTQ5lP|T7s z{`iWIIiNiPB<_!gP4zy|iaa*bA9>m&57{^Ac+kUsaLnrOjAk`~`fCK>Jy%POF#)jc ze;e;MIuJHS>w$*Gly6R+MvsqTK^3ZBUbS2Q47;lQ7REyJJKchQMJdi8+~^H4{zV0L z43HQYjBdv160m;|9SetRR7Ew%8h8X>J#!}pq`$P9B3Gz_;;>*LbzsDj9^NWGb z+_ri5`w&B%JonoZ=JDo3cas$ zmMQu+XP^t|hmnBRNQL%u#t|tNnMjixc|rl)Wko_+ENRQKw|33?FwReGx4SXjUy?w9eN3yT4AN3z<9OG9q&t7Xg zK~$Qy@@Wdb14y6ivx%WCn_df&{Ud))TA@BKUEw?!yDa76M@}+MEv7h)DZzLPMW3Oq ziz#F2>er9Y$DFxMyo)?iaqf?J!s#9=*QTA$$C#_Up5sfqGcRs-25k}74hfnoG*~Tj zzcC-|SszE~?O@UnRRaF^6$x%ZLI2v##4wvIx_5x2Pgtx}1pGzA3zES}KK)f-1xfAv z3@BPQ#&K{3%YAXRZ#ivkYwq8mESgw|oC=4^wv9~jSvq+)S-5-&@+j`^15P@P+zif! zPhdw#gjX^i!ub!1NMUbhG|Z&@;d%aa zlQx&nbCsa!QFeu`vbbA4#S(S*oU5yN9Y$M&@SG;IiyPsWS2$1xr?qfrW~J?vVvPaR zdnS%vhMSho)@z&hWUOGPE@SZVTImiRr0P<~R2;`AX{zl>B7BQ5q}=Xg+%<0hpo1Vu z3pyehq$v|+Fx1?F_vwl{A8bFi99a>eS9Az2xM%X+ZQpi{)Z_(?3=z@9%pAs&hp~_g z%VVaiWJ;z>p0Ea*O8uaoQ6j>Y8CNQ!Gymj=kV(Q%lNCgZ7*zVxZeF0l5&r#ISqXYU znTd{q6P6fCnc)O_7*~5B3B)xXebs$a-ojk+=W|(D2!K}mJiF+JbW}?EX)8KY3yvkm z-F7{U{@i;4m6W{=rJ!`~{gSl)1R?kA&gr+ET`0_;n2q= zVJ#Z}JrX$uiVR^ZR1|ekuOWjnlG9Lu)`)lbmG45qy;j)ub3B58|0dY|>6f^y^_obA zp60M!4Zm4HxeDmKz7l@#?|EGaENkwxaW{E**(pj{7Ze!^L~ax4KExdneB^em81J%6kNe(?deq*dS5_UC|(9+LckopT-3towOD znz7YtI-y9CvB?!HTnHz@{BsS8rq#kARXa@=8FzO_G2|UtN}a-Gc*i;WzL#$a`js5c z342}IN=^pkh$g3gHe_(Fcir-^JKn$=r>VoOlIsZzYA^q-kesU)~pDV#3|10W0x)AcRHd9>%D5F=(71z}4XPu(%iYFX;08&F_*IT2I9hzLXd$<-fF(5P=}= zK<&HvNq7kw|F=v!b@(nT4Hfsj;BaazJi@=#Gnd!)=5_F5FM5oi$zNG(aDOd$2Z+ygcj$FHx9@t;3gWGdd!rM5wB*L{jn z(*IgSQs8P~i{G~mPjMVuyl|zgf{rz=b4CEMOR+=az+#1Dg-bgD&!Mp@1*i?3f=}vJ zUP}M7)=$CIFOktXoYWj${=JAidmV5{lO(AIkOBZgl~oSlLKkp+Wz8fh?s_M+7j(n$ zbNJ#VmfQp=c%SFwROH6-9yM%t zreEs31FeVCmVF;7{+#4Hqw@TH_uYOdv#x#H${Z{oLP9O9Ufz0`KLW1%c`-8bNTJRX z5u(?&T^MB2r#nB8Yk#)1C~pa52IDa2FFt;r*cRi#)R(UNIgIh~-OG<;-@`a_{vjIVxGsI>$~;4{Ss;0AWJD`Oy{wvrRI$elbi~TW(5n)btj!$OR;WkcKN0B&0UM@!Z7Wc&{o=_Cp~z+ZGU;lWFgC~(Dpn>CO7J-^Ku zOpgUmj=Cs0VWlHumFDISbl^Eslab7o6di~VwDk1uvVZQZo@9UxOu`+k0K>T6-d_}K zAH@SL-volnm(d|)9VvS$>Ute=R15=X16Vx2lC%?~yb;r2M8_JRnBwsbCyH2T2+{P7 z{^Kbet@pw*RQeJy1@F+Q<`mkNS3tb&R{vl1>$jLnoz-QNSXC+#4t2w~ z$HS<{*Nw2O=qgn{V{_}HrX;*Z>$M&D&i)_LZXJJZQ`5)0XI|sdeeFI?k>kKOHM>c% zyzRE5%bfAd3j}vL=7V~^{N%ROfyy84_mTOyt@^`dhkf{ctLth$VHMG!=AJOCXQx!A}o#TbGoNB4I<4p|En zExZi0R0@(3i0|3QZ1R9bG-*&}I+G?zgVmEUq$25^S`TU9{q*<3{nK{}<2; ztC4QseLT}JlHTL;%cpIO*Vs29hoKjX%?aVMGJ0&0<0jzerEaq8Ufz)0_%(XN{8m7f zxm13TYPYgG|Ia0f%i(Uw$lnyR;MlhVuN~)A5xvH7{q7Q%E-DF-0IS;Lp$zQlc>S>c z3`2XRFc>WhwvabZs)Jt-HrB|P$B}A`a!;R>6-muvLXt8s|E<$CGuu)qwSi+cAd0H; z{%-s2+Xju0etR6y8PTD4S=loelMc=EOL%J7o>#DTbNDzRljPoN&P^4(;1KD4KREl- zGPhSI_*uR=JRfFl@BJ-Pd-&KC_%XxQ{xGoJrtBAqI17n#1BwG~$&?D)xcU5>>B=L4 z`)quFAWm)p1yY{*K6-wxB3*WzzUKMijnPZ-!Aw8Q=J~y+vaa?#ybZ-Iy)Qtfm;J96 zFz>owo#E@gPE&a`H`IY)+jX@|1OtKCSOMF4Rq5|>`KS9~Lv!;kBRmiyHdEMPfKhBj z@I55IM7864wss@SEpjA9IU@;_Wf3@^OHArT(R6#x$iNji^L>4!cj=z6xq5rY%q-_- zSfXQ)OyWT@7H0kAdbj2r2;+E1qjt+^p-TLKt@nK;4!-q(N+8dua7ISnh)KY-8u)_K z8E(9AE9X9Dsx-?E&n-i;GEVGLi6JRKVRrtwmUq|eY&+h#PAktvsG(ZWw>6%zHPYX@tN7Wu2b;~L?}3+DQJvcn6u-I z>N(%mw3fP=<(I{so;j7%kjnVCXJk2T5gU0LURBa){KmHLcq{XsxKne z=2FcsG4G3677PllY(}=ga>0!3hX$K?K*~3MTvl%xle^?fOK5y-=kH|vnkGh7rP5Fd z=el`TnNn>80xS`&8}=1KIou>y`g|631Rbj7w3V)Y}Q+tm_>n!&)R9-)j-|M;W(H!VuJie!o9->^u z1n&FVvX%Y10?$DWgQBg0HQ#|;e<|fqQ51or2i2A#_@X)SX9vw0t)u-oDtW$S!I+xp zN|K~Na3#q=_4}0Fv$xj|fRPqem6nZMzr`bilDT(^?c4ao$Yr&~)>`lg1Me8wSI^x= z(w0}rn$~1T6AuX;7F*rw(gG*WSR5{V9!tyDPYRaboP2D# zKO+$<7FkRF+p$amNpwUnI8jNdm<$I6r_!#u=-dT?X|vqvB&|lAIc^K=2wwT5oL5Z5 zjprG!OrA#`S792Tcf%Sg0pC-KXCuweebK7@Z%00)(N=WdYhD>O*7_p_{?Zxce;#X@ zpF7jr{#ROgE3skH6W~O{$=# zSDh;epGis7SuXjP0rNIMp|n_)t{dcYn8Fdcs+m^?bbOi zcA8beCqBcf=Z6*W1;w7_!nJ%g|77)H^?eoVW)b2uGgeH|_pcUwmu)s^>t>6=?L2KD z9J~d2F{8n8@PJavXz;WlXw=ejW79BuJ6pO$O+u9XoXr`39Ln|jzSZM>EOZyju#;^# zf936W9Xh$|(sUhlxb~>9LNR^&^#pDVwmktE!2wjkH7)+D=Jk%T*Mtp&&XWQ-q8rzH zjWl;OX-V;ge^grxx%e+m0zb_vWlkjauL1=8cYKyDUuykWcD(s05{S) zlTNaZlR(a?+KUcZ7vN|6{Y=CAZg;%Tp-wj@>;V3NH%WaXuglSyUuz(nG@>X5`#qLC z3P&~NS@EHGTw8XDxGmj8rc@4dK$6V)myE&f{rv2<%j`~L`7Ub`1hI-$tqrJ~gHcaD-B&jxBkEA7O-D41FpL+vmWb4EJWDCV}dGjGT;$vUv>7FSKF*$h zzBC4C#;oURE0D(B*>`tVYaO31ZI3AM)Ry&%-P~Al?t(Fx+2g;7t%EA~n2=n*o(VT$9|*L3{#aGk==o@O=d`PgsIJ)1 zY6wmJe39k|KjQYHZu%|M_X)u(mj@S7r(p4m$4H?9Kj&*A7L;@DZe&{fO@_#eg;+|Q z@$V3ob~p@5J({1r={&6D!3+#=o z2Dx@_FPwmFu>(d(Z^3u~(#hx^K8|vC)oxVPs|E`K(XBQ@b6c&P&J0feF&xPjn*z^O zj|=igv9G)3*u8w>M1{LSJ!N-a2)>Bo=qDIwS-|f9w)^VCcT@03!(YU|Kst>MzhV`U zn#jIB&94j!tpb@Wam;)VpVbSE!kO4a{;(YnOedXgPakw9(j~G-FI_wNvZOD!iGM2h zSBA-rlfG}aJBbI&Z2T?qhEbZkp}j#_V<;HBh^TV8wuY6UnScroQfstl6$+PD2c;Kb z=i`_;=^^XfN8!#}B;`d?P{+WN(+#;V-Slb*%l2nOD?jiS=9rG}=Pmd|R;>Quy~sWm zuzp)shT}S((0%TWow_P&V(9rSa7Ehk8HSLFOnnrtvaQ=)?V@7W^yCf0{{L9w2BS;V@o%8GjN%Olmu3BGG)1PI(S2>pkRTHKoRR z?1J4m^09dG!d6nKSsHUi{}g|{A@mpT-Cx!hbtxe$P4rs%D2{VBHBu^ueA*d89+O;^NW!HBTHwT)uRy z^zYC6oerM`QP%c2T~l%@C%>3EBZDBe-l|_Hh2<%s;G7CyAt9GmG#XH)`-{==V}huP zWW5SiYg>wzid3T@_~0GH|5BaK{t*&cED}=ghY`}SNX158>F?iXl9X72>J+@-IgWfU zfKUj)j(IBw?|3H{Lb&lgi=Aj9ZsRKpkTDuU@jLVV*gca?bgCvp$VhBT^t+t+aDYu|l2(@^_bl!ep%E;^yl(tTI$opqZ2o|TrAdA^Z!4LiRqeLE%W ze_r1q)Oe8a@RU9<-FA8K*@RFoU(^dHmJrJR8)GD?5ip%qW&tM1*u+PniQo?ml{13z zhx$%hs!V5c>V(Hg3e>@KYBhY6LX>z~7p7tv7Adp8^@*uKp z<)7n^*Sob<>HTJlJWVrPm(?JnB@i)Pk>~l#@a?9b$*T733STYs8}Dpt4bN{M*{SY1 z8T)t7W54?reaCmtKe(OGg}9ugsdfSb^9G)?(L#+j?^y=3Z!QwA#AljJag<`We4z3p zfspyQwLFKr7NMDi&hzE$;W?Mar;IW#dzN>TlvM5d*@v;Ro*Q}KU@+THJh->#GQYFV zp|kCq%G!?yhMtG@tGC%r6kkRELvMqpzWt@1!xRH=a0`IbE#AfRi#9(W^P}#42?KqU z?_F+9H0JZM(HXe*$1~+*?yB0+?&O4K;~}i8=5=&Am;drmPq?tb|IE2en3xC6%m0!g ztCkZi$WdL{)OMZ@KR{<3o%(9N?<-FU8oYK{`(e-!`^~)e995OV|6}~z540dLno%vP zC_9hSt`vYOcyJTfANkEJmtQjbi_(qf+6)`1WPBN;D=j@IWAkM+%=V1bd48UAJE;?K zMJ+)rJXIkMk~}d;lcUIj?ik)(r@V`)GTI8+ffR`L!2%v9Zc|n~rA1O8mw}Tw)b1HG z%pHhxjl3qB8HGJf){P12pxIwwIJO#%M!M5(M~eva+8%%Z&)W0F`BWbzkaw&wgpM26 z=ok|N!7LSlw*SHy!3~~2?}4^=&>>IW$)evHPwI#_@|t5+cEPO|t73H5E#mvN)Kk8M zHA^cWY{1!fny86scxQB2dc^PhPqDwCvZi%|v|=rNjMU0HzcnNH*u7%KvMrGB)_1e9 z3_%n3!)#)r>CPykU{<+yQ@gk6AMm>06WUdeElW*Vx*8Q{xAH`(>=&*yrp`S~ zWTq@ozv3`GrDm$Tjko{9uhVH$xEM!!M%G>X=DV$KOiT5hG>aeq z!%mzS6*#9gg(BrBOZF56RUr*jzb0QiB9r*1`83cfC3!D7jnnkAc-$fH9`la3*ZK|- zP7q{GxSQRk+6wz4|I+88Pa@T;#JK5*{j%&Sl;LzqX1(3vZ^hvsuUCq5!8g_duY25P ztG+#_vy^&6qA&8|W>SYQn~f!jIJKho6}a;`@10v(EFnIg^_l0&9&eky)wr6_VhY^M zdzdsRB3?b3{h#QaZLzZ+u#+Oj7dHVl6~fCCE!PPjHX}UY6q^C5f1%IVnlvCmy3TJQ zWW7Xr1i(rq#Ud3xRug?asz7nAIC*W68}Gn-a3?n3$MLV92EY7kJ3e4Yb8(l{4uTR9GZcWFcps>~qpsV>s)K68Bs1-yXHYN%l z;xe8UZs<{;Jpo7(NAT)>2)KwM@W_vwayyV4R28+-Y0ua2(w!G!knZK2Ag#6dDb9MI zTP^n-R2cYDL005IWiCe}EX>()5lkS|M{Hx|Zi)DQ~bn8XZ2st{gM_~_ieL!TdGPqX~o9rv>%l3C4hI2Ua8X`x_(%)Vj@(69Co&S6u#@v6>ZZ^5pS?U z0Jnb+j)yTP+2+_vLm)Cu=GplBe}QWL6tPs%9OgVgk-Fq6airw0ePkDG^$wY@O=N=5 z)*fYg)TCtNp|ypL4zE#8>0E4OtEQMz^Bas5T!sv$*@n)DMsb_4h*=i^_}9K-I>_bQ zjE`R^C`huV}74` zy~rxj{R*8{bViU?^BY`!oVJ0xIHo8rDnI#TR1#pYwais%OD@>xb%Su096ws&gfm22 zO-WxZIaDtHC>K7oBtfR{zvqf&T)|9@MVeyVMkR^ZNQ(?RMS}m4z?;z<$If zA@*XsVksBvw4-vj#UL8#K*#_sR+m~zu(zvDhDbtNU*(s;D``$U$!Z}djVo}IFj1LY zFG)p(BAlyV#CEJD1hto)7A*Fq89`?Ko|)6elH!8tq`5}U|NHcrab!{ZXAfRQsA;{% zIH*~$8DS{(G;)w$t51ynrZlgrIe`4okuv`2y3r6rnzs=qca!U4$v(e&9sFP!S5^II z9wQ%U-dj+VZ$reY{ADjQ)LI4iZ&Fz?lBG(ue@(6*{8``5UWp!A?My2GjMsFnK$#%zWeiICr1_ivv2gXUePUkH3dJA1_u_l*4>c z84iPYaya;QomBIvDQnPy47*Zni3YPA?Gz1wg8L$h(10)LWi6=OozvDd(^d&3(&`&U zys?$BFEZXH#TyCup4U(fcbt#69$1AQox=H3vG;J$3AV6;$2MrtG#7o*r*xFHay-*X z3vT6m_`)1~<0`G}NKj?Eu)E2;%Z3)8zS>L7abafhkGXm?1~8w4fL;7{Tyg=({^il7 zng~WqwG5mta+#BbIv?k z=>YFJBaqP1sG3VAH*BAJZF1=HL^1T`DEDgVqs!kh{x%FlW;&Qe(yvloGJSQjtfm2U zw3`R~{nrJd84}C=Zx_G(6rU(XpF2ww%ka;Ch7(I6a{);Viw+a{uJh>0J$$3C3urtg z6=M&pSv$L7TW_D_316g}DDi+nY$jXLXaNH?^) z7y^s=Cn$vG+_q#6(YdHdS3CcgXFk2nw-2-Igo_x6)%3$tcD#tsTXWp4RIDTrMAC0X zFn2;V=KTas+9wCa?gW84FF`Fc0W(^SKRzGv?J9Ba`>;W}#1{fZ>3jj|cpe2f22XEw zq+uFV(HfzCMA3BW7wCkVQqbUG+Y8riqyriM2+=c+G=3#Y{^$WL4J*v#}C20QKp-D8`*6u+}yEBVF!G>rjmYSpFa zcn$gR%W3(6tqbat-DdT6P2Uq#J>(4a(zV!nK56tsT{UyC5 zK9^@T3;IOlXgUC*e-fEpxiRJU`(H6*W;k;c#`A=*uT(KA8|%r*t}i?y%c6%a{r3nvu{x7ZV;&#?rS03zdsxd* zE53jYG4jf`&K28Y=9Z(~$goIdS|+PR3!57VEm}k77&OzLVnqPAV5UtVit`UIMvX^7 zMrHU#BH0J&&p&*dsDKk>Oimb8Nf;)FuzJSa>%50rtrpvXVSIm|m_!0+gsuPoC6d#c z@<*FT7~!{_7E%{96@n#GR+wnB7-X7(yD{v**v&UN8+IOfcY(>~!jLbiBfp9aCtJ|6 zI#bPZE@lTj_yP*D^V5UXjKVj9?X59wT0@46Ow#i<4JA0bAM#kRSO)UfBsmW)hXR5X zkez#-k8SEBW#(~a5$v^6!!|SQsRvAw}(W*^>9Ama=KRsBe$FKEa-tCEAt#bp#`0*j3>jzzoLE6)q-wK<_GRmCaCjrUTkWBJi290Csvt*rC~ zbV;YzN)K2_Om&}Vy!84D}@#-psf5l)=w)CP& zY~L$G%*uSL~6ipl;* z%wGgX3$w1g_ZSuUW1PJXL(?=@VytvHUI931x5oDVM2#VhE>mq9d>zFR%3uD!fR<*= z7J*~5TkH>EWQXkdmopG=%Hyb0j2XGkq&C(~MpXk2S2!{mT89cpWjo%O5=50!I>^(< z(M6$03@Z3Kq#;ngerzD9fZg2|7!fFg!)`hl_UugEk1i4yEv6f)YWB7;e*5!~h31I8 zf&PJqGkziNKw6j^c!m|^@}`@URJ_;75-D>=Sw=cv_e&jrL97}hqqr=1gV|k>4ek~| zyZqhq878A^kB*%exyYId+XFB4N)GcjBX=s>(3SpY4WpG8N^?FK9;4MqX`LL1%ba-3 z1qC$bK5<`2t-_I598x=-R+|$j1DhAY4Ab=8=SfTza3&C>rsP_wgoEHCvOa$i` zLlN?vAYXq^_l91onzfVX-wLRmZpUd%;U9RZFAYYtUO2eD%#MHyMld)(4Ga@zQ;gW8 ze>?X1vphsO=bY6~fDf4!^*fv-kX6QBx+#-T+J9+ZDnPz7x5NBfNT?v~<7x&t#|BK* zpKHL7D1pBXav!j$>)?Q?KBdht`1^#Ou0sR z#=r3mrLC+ZG0Cq{8e>TI@nvA{iWQ;#Bj>_(J`#!zsUtN(AND2(M#=z^O<*X_A@9Y& zjVRoW3Uff;b@=ZQST3Io`*}w}*hRyvsz_ev+ zUX}Dm%q^SdoC=h6H~;RYXdd4gFK(3+leDC<5?9g^D`V%Sf9`F)qL5l0g|PwZ0svXo z)TPj*?f=nFB_j_kqJ83OsID<-p|_L97PKwomkNZ24j)wRkqe7qQNPPNMKe|JD7x6H zE{ZJPD}Z|l$blxe1JjF`Gf-@iQuaOLSRNkFzNe#@DR$+kwqa51BJEBgw*yYx9D;v% ziQzD2+AF4ML5*3#RyX8Fn`hV{R05~h5#=_0SfP5Qcajhi#F_D@@kg($>&M7xqrS=*+45R>9zXm({@iO)f3B!()x+#&xlB?#{)PiJl z1EVN1gR3Y6_yxOc-^2b>1H3vV(a`=T2BiRw%1WE_8FvC-r{^21T1MFM`1`AICi4Ct z4iz796B_tUgd`q3AHR^~ws{8u&A4nRvv>ck#`Q9l$My2JUW8<^ef8a&3^wN9$Lz`X zjjPT3j6Sorv%R31mOB6U_v)4s#iVoOZel#4;Qh22WM(i0?G$V42I~*XHGyl4LoPdD zhd@QBO(+~UYztpGhUGcH6&e55i$I3?vzcrIn`Hk-lA%mj9njlh*X#C;R#`Ul8esp| zfrxs@XL1ySm@ecysVL3vUvfFyZoXLdPd3?qMJ3sxz9A0L1z%by(5z4nk%{okkCC}C z1PBnQid4er>jV(_WhA{URsB~e5WS&Qhzmq0tweiFZRth{%4KiS;z*mnq1gxFQ<)Y^ z45b!W^b#`jyzv4pKizlbok0B_pddn>kgxuyrn}>bSDmvfamZb!tCdKo!Z)Kw{=l{! zYCOHY0GyG5&)aNJ&eZ4h%K{$}f1p5QQSnNDA`l11jr#p^28ZPieTAU!Y0W?qdMOqh zqd`tDJMMviE~&259}s&nDy%H)Om({;;TID_oz@Ahgp(oJUSf~|u>UzZOTVr!VWZw7 z(ngSTgFOC(kw)(Mjrc65l@=Xjw+ zuNPr0{Q0=r4>S3@z#%6<7jZn``V=XS_knlUe?;IoUDL;_dMULj&v%t|gvfL9FZlZ3 z&%!a4t%Y9aisC(24XUB6hWHmL)sqP#%r?sm95+I@)rv$>DlCyy=^#@Z7gnTL5eH?9 zD2XZJ3Wez`qcza-5i6R|(K-V`$hUd*uWx$pk!indWVj76GI;v$BWevV5I7J2;a7s% zaXPxR+E-UkM!3SNGcs1?mIz8MRDVDRnk(r;?lmcgqw8{m)48GwL#Y*l@IkZ+{FAQW z{U^{~-bqD_7exhXMW{i5_O#E$`Q2o*BX*2BOSI=C&+oopg-G z;Fn?OPcM)#gj_n|@7AwhrN6n3%k8>+Q2;u63FZjigaqwuI!$k}OY$fm>|`UcfoT$I z&EaY{Wj+|t*jsAuQX-Q>&-A`y6QJVcZ(njIUR_0aJI(?4uvQ4giN;FH;&cIr1k|qN z0dqus*$F?_qN}Q4P?O`e#77+D_D(XgmO65V_X&_)W zr0u0t)CsQrMO#pL1c0N_NZ^!`LE--(dpBa%>kb__`HEAj0PHRP4QH|h6X%a37|h!( zI&bHBNiI<7xu4q&lNaNI$~ClBaq?setdsf`q0oKK@9!7%X*^|a;I_oN+S z(jxq}s+oOb7*Qm( z^`mDGQ6@(cg51=gy7qUOAUBjh8Fb5Ir zBH$ouYhNQXdBQHF9_3}k>VTO?j_b`yX3*o>m*)3Q6 zTn9xD#32KK#cH0f!!wn?q?|q~kF-@a*|tWc;ep8bHy}3&j~C3ZR3XRyg;OP;yP@VJ zZ|&CqrlWKHSp;+}KZdfY8Lzz6AGdKMBfF$}ln%&^K^$o{fc2k1p|`lJ?XQ4;KRGq) z1J$H1i1wE?=J1d6{9&u#G6A?2b_`rKFJ43?zNU1TBOwr|wifI2Q3TN!`J(Zy`N5p3V2t!JeXXg}=&vDm84B{n=$g>JvvcR=Nc7_RpmbNb6&W#H1KL#a zc6K}`Ys94tmAquk3ah33=5(3x@9rp~(6%O2XOM?Ubqq4&CSo)e(JLaaSM7@W!=xQI zDY6-T5+olBrasT=wb~da7Y#u)omYZ19%8ck4r{ya+l~e^D_L7x03ea)le7NA7-@6P z=QZ3Tsn^=rD;JQ%ed{*ZRoYQQ&tWi8GVas;slyI&aKqz-v&{GTePaFzN|p3u;fmPt zz`nVOUHF@d&%O#{3?9@Gi@K2NX6|8)bv;g4eRUlRwp>Or0Qh&U&}5;6u}?s339RM* zBx_w}%XU*h;z2N3{~<$E0!2t}Z-I{GJ~EIOJX)SngH-Ps0xzeC*V zqObnvrNc6xFN~yHSM^suM=7sjDsi9oxJ`t0G@Y;f+wXtUNWXDJi>=Ytz4SNNA92U~ zZiQ~!)Yd+qUlG4{QjC1^AFY(OmY(=>3L5vc8#A|j+XXpdK`Dqu;X7@x-JfnM($qMLHHm;VKUY?pOQXNADjE`i z4VZaoWbr&vwTJ+=c96zqn7oev&FEbb;l>@;6jmU`#D(jXZu#{}oGsWIFzI3HIwCv$ zOaIAq@tH=?W#{m*`GU~A%EwRpc>C{Ou#2VhJ+pz+lyw$yUtFEp}r|zeT1tfsMgNKA;cxk1&5NOP|?H zAe8%t=Su|*m(=nH&{0`~20!s$e2{soS|63s>@tzrZhFD`WgcB&?j(Psh*e|N zw7`PmM>PSA1)FQGFih0R!pwkjMGah7KOMVeZ_OUQE;BIykR-ISks}yt2jhOp4U&is z=o|L{+t%!`Dq{SYY_d7Q&a+dy!~BdhkMx3LO)*=l3qp?Oa58|eb9uH5*Y)3=YIIxF zyz~N%jW7ryad!g9uauUyJ9pAsz++I~*B0Db)fzBN6!Dp(>Vt> z;(ZUh#@4pC-ePNaYuk3aZMU{<+o^5a_HJ$4cAGb!`OWwJBa?qJlVp;6&OP^@^E|i1 zK%X;>uYG9Fkge;E2S?A@R$JgxD@)8 zbV%IyacqH04EsPmaXX(=cahQdFyI+hZ7E80F22D>*7mm7M*m>0&+z%R*L+&R$t zr}abdx^%hsqn1P-pPlOTNRa=|#(DLnRLA!9jsV5_uo$Q} zek9MIUcHa1)ZGqTgkwv}u)nje5r}PI`W1qi?eGe+ay1O3sxBPChf(1&Fh`RdwlKP8{sv zuKfjUs4uVZs`K?WXCE6lpXj(g;oOo6%|ScSuE!svt9+v}C1xI-OR$Tuq$bbOHXOU8 zX?v}vh@0@wOK&!mbf@w(vyV6Kca9?Zb&H5FHiKno>_ZNwfkB%%FLK5YLprLu6b*v! z)33JQxunj6dryQRNoDdVqet9~Nq#f*=>a>q32+3&=QNH>qLqi^I~ptbL%1C;g|FKC zbagvEzh85`db#;rgC5Tfkb*Zy3N?5JU5(vbTl}wAdfV?&_CHb!VUHm#@Nql#RJDxgjYi2G%Z}&v7_0~u71+=xTFcr8voZq^UHYja8P{Zln|ND#a zFHt5xO4;}FJ~sCnHR1p#eQ2blA7u`RbZKP@G=_YG5C^uGG^-l@$o|^-)bsJ4XKU(} z30GXJA>-?A3#(*+GU13nuaKAc)=rYS8*CND##)hijy*AFAdVM`EIvohiLQ^_(jk5s zvn%v*PjLZ*6#O&_DSU9!g&0FjZh{@4ZmNOG#Wa0syY3S~ zrdvAK50ajgUdO>fsm+t4-p?~o(74*yF;46H5F}9$e0u=BAE*qtwmQA;y-lvwf0h&U z|0(6?ZcK6R=XXYnw6QhcC-|}(huaOF!0%V#oTyY&p{=~NmuMA-$-!oQw9)!w#X1h; z=OshuMc+;&$i1_a`d2UoBE5Vape9bLQOG1Od&`v1)b!z3RXH@;dhVBiKn$kVDqM{r z7JB4v16n3n%gp3ejVf+Cx5naDzbXU&&Aq~_%|r36zN(P_!h&uR9ci7FpN(~^ZTUDj z-p{GZm|j0%OvY4QLOsX7jP<-M0{pkivsjun5Esm+17>5-y_IqJnf24zC1jdpnw!wA zw@=_F8+jK2V;Fy6i9AJjt;oe=Pl=w-Yk&AWPV^QnpFT%`^8E|>oONw}lST3x8cyg$ zrq}F?pA5oke%`4E{R|PvLS)Dcx_isSjgxkpdQ;pRDiIi zNjOob^k}jMPZ8jT7w+eHLLsSf5ze*Ycp`lCpK+rgfWM<8AOw8b(RxVOrh{K1S5$=i zHj*z*NuQAS)r(>`8x0v(`s4YJG_%8m^f)s_w$oIi1PsRli&2fTRG2Oix1zOjX!L8- z;MUU-#wQ7Nw(FbT@`sHMj?)QF=f?5>`T|}GH17B3haGg@$DNS95PV*qdS8Pq#5}Kj zfl{-#Asp1e=g#Yn{eYwROi;dGo44)#oVf++J8v5G-o~nx*NP5(g^|b$Rh9PaVnwZ6 z%K-e&c9(U%Oq_1(D4rxv!7gvQ;aNPyelkH5AiF!aV{R1ievDPRWyXZP_SEUdpTjyEPc z&R|heK4FzXOH*0NxNce^u=fm$f`7;17u5KEMkQ4d8X#p-7B7GENa+*z+dP_f&O}-E znAmrxM+9ZNwcUBy2j$>^(zH)o+Un~j2!+^n=S$owjHs#i_oQzau`3W|iK_bvNMPWM zDv`*Hvf(CGl%0Cv)yMC)Dfo5%A_%-2H+bDN$#pxJ6zt@HbLjm{`+kRg?YG14_R%LM zr~lmN6Gqrm8wnu_dNSCnSAiWWt0&uP5g%Kz z#?pLTP%hR9*DWqWo}*h46+uJb;M6KHXN5}>g3Tt$7^R3l;S3ach_XT?zWySt5B3kBK5oPwyt=u zI^Sa<70T88qTNgZz)#L?uWJOpk2iOp*Wu?aF9)ZMsf^sV-Ls@!uDJ-CSK89vr^$VX zxYn|@>SCYwc%{*&9q>RsgsZ$`k}h(+*B$DuI=)I4O)uc41m8On-Uto8<|m`i zV-^bEy|uMM$t_^YOeAOOFW_QH!NkCRY;KhNxFv2#6Gx0u?O2jQ@ z)Uhf@Y&4Mko}NI^S2yG*O;N!1u%Z!6EA_pk{9B^cKe%S71@i(9`z|F^)EmOKV#gte zNMzKkK7A&hGuc+uctiSk%PvvSpvMC|6zg@hWLIbCAe*?*%aJGSODHZRfEh zsQi_mP7gu6S5&zjH^XrM@DIx*L-$z`67M3fJVNZVqGb6@K|___=dlZi$T46~M|79+ zETsnde*lCEPA{+sx7W7QMh;Ik7c9_|!2O=Gl8nqh zO@q=i95>Jm5+rNV4CFV82G5S-9Gt_ukwZs9CK@FNBRw69M`L0LV4Q>Vp+r=1il+{z z3sc3yU3eey1(l;hJ6kZr+`z!GGDjEIh~`ps+Z*NqUA#Y!;(YvlpXq1!hN%JGD`B<3 zqfX!;{6B)10x%pow8rxYpvgq`L^@9_j7gxhnUdrKD%xq?)N6j74Jc~Mrj%6 z7trgE*Z+JZ_^B)_rXLj z@8H3i${z^Ei<(yqH0qRs&`~B^V+hBy>t7tX!0|jBUzu z>KQv{(M_10!`XV~!)v8z*K~CEVJ^hr{&O0-w=1O@499CU-AM|9W2f z?PI5wXZV^_?GN@1VFQ z{0uwV#_YsdGZ=W+avOr=UGn{S#F1K^WG6u!=B=FZ)01Lj;@a;^!7=E%>ubIEv)zNY z#^iUtq-kkj;4!^BD-iA)cx2eB?}&U!a&VKgl00*x65)<63J)nl_N`vm&7b?n4*A7S zNA55j;TxP*T+4bocm&k2Xh2D{LnW94!(px2r3+TWBBgdojJ9rMYm_v zLSV8WhsK;q1X|TLH?0F~w^kn!BY|Bprk?vX0`I`J&zn%|D}jsf&ri%Z84`TA zg?PXD_3fA9d41;(T!CA$Qr-6vw;C&wo?8==w)+Pag*-|op2s?C!MoEZcLLv+q%?hk zVuE)$becZ(o}!9HwhOd^OUy2zFbgoQ&4uFP_A1_ss0X~Cu`IKw-5SB&EqO-nWmn zf^Q18(&=_@NeH&+9CW^057ZJpAB`pw^M4M#Pd^asZ2dIvS7$c}Yc~#{9}5*e$9FZc}UEuA4&p^Pt`91rO6*mcXsi+vcGRsW1EW&&}tZLFbL~(vAB7x39-R zedXzrxpC^tLFfBij$*c^=j)FvG6T=`+^r23<4X&{ce%CqqNH_t0E4xF*J+x8^O@g? zBK9}^QgUly`q*t+mNlIxM8;JZYOnqirYGe)YIwk!%`&vtrBb6}wC6YM30502RZTN# z@%hB6=n*QCz%M9|6hn;Kq*=@IW{a2@H_8@)yOpEdk1mhK)A~`1R$F>anzb|xI@XCx znnY1W9%H?Kt`G)^g)~~Z03$jCGk~{vbkNFnHcq4OU@8gF`&=2ap4ZL3`f)sdO3QFeZ6;Noq)Q&l?Y1pf2<2{6UJ0^QcYzvi@6ue5JKh|t* ze)vo;Zs!e^%>(bY+9oa)wg9{t-_JsUi?0Nu}=gsTJ|Y&dmaCnzU1Hg0xg6nN&gSNXPfbXh|Uym`7`Zz!&7TacB`3qPq`&Ho&mnAde@e*NP2g$e)siWao)QL403ke7erzD(&d?_=nmZrycM4K0jMEO zXuihp^XD=wUs(2YiVkpn@3-%N$K?jxCmY-RM=LkyQGzdH?L>8#z!BZ=1C=R}EjmuTUZ$lZ>K0pRbnX<2o36(dW zRVz@Ji<%A9Z%VF1Em;qX>|+zIA13xJ42&j)6Ul4O06LvV2xSJ2aC-(k#iBpb+UU3| z0!P#m%n`Y86vd&gr7~#}nQLeM;7dAuiyEw8Pa*;3yST&-XasoWS`(9nW4P-6AXS|T zme#&|vbT)#KF^`&Y6LTQ1Oz<;WnnQ<10yHv`2JcdtV-H~G(x+SY?_xe_L`A_Zn7Pc ze6n_jlTVP6;wFJ90Ng`o4@M8VFxFS52+Nnb~*?krzK$LF+r^0byWK=_7ATX2#oiI^nVxf zOkEc~Y#_gKb>TRV;vk(w{?3yi<1{=QqKZeA3QZ_YbDmsxu$NUSWRts(X|OhKLvWZ3 zm=l?Z7{qS0@!|i@0xX{C)2BpJ`Dx8FPa+Q4{w4^RiBtXRJ~w7|vzZAQPtCKurq3Zj zmx#5W&H$n=w7~5e zmN@c&)n)%$B3{xGN??yjb(FKRS|j?){DO@u=H;Lo%6n!k$%8Qw#Q7J!Ugj^{B)^%> zu67R5!rt(KwJRWm8wbW{{yN;TGxkk!#uxU~{z3I=flj3#Dl26Idm#eRF{iIYb8%SF z3e?7zLX*eFu@>B?HcOf~QJwV;U=e|b0U!{*DMpFlWl}&VmCK5{ipmcWS7gn66`DW` z&R^mUg(Ru}G%mJX#4kJ3GFdqOC}%c|{)g*}K3mx0zv#A9FU|gYuX0Te-74x>!Au85 zbbLNgR8!FGXK>BN@BXe31+TM*x6zXIZwOemmC)Qqonhs5oq_oj_aoy32TG)*C0*Ds zyGmrPD&p1UCT0tSM75h$S*r~(9CnY(BLr;IOH(g?2uJg(Z}v$z&5N2u&@=>5*iuJ4 z(PecUilYf|vmLjLh;jkx=f8uOp-QTz8cKz4}!*?Z@-xyPb{**u^xecxM-$x3#S{_U;-S!K^B+$hhaefr5GMX zzbHlXgg9{IV$6k@;@Q8a|{h!1|MW;BmLgf_+gtUIIBE}LI=vP$U^>j`MqUQ)kO(@N5{C^lJ0I$mQ% z?LWYohV+`fJdf~%VR=$hg=CKL(Gqg za2R6#dyajSR89>24bTq{QnFLbvCJ!=-ISW=12)(eF7FYM3-t+A6w7s&YW#&TY+pu@ zYa62(?-Bo#e8B53ImkeiQJ$ee6RxB=aU(u^A>p~aCw=g^Xv~)-OKq|)6oRd(GM?Xh zdT*&b=RL;F{#h%?MPC`R74}j~RvBhxj+h@aohCn5a>KM&O>0&eDpAh`VF2{3^BZ+q zr<>G3^qJBU@q6)Uj_HMT36-z1od==w_8I0$*CMmaQo(77LURjC^N-#Pa|CnGl2@mt z1kVa647^&&K4%xDfwW9M=wR(rc++q85{vh-HvjWcK2>ghj~;&22$Whf60Oi=v-ue> z3o&3av>1OhMTM4z;E>^o9y=f6-Pw-?BP6P@!yaH<-No> zn*k|c=+2lbO|^wNw zTsXuk4Nn(%UrPUSbJM8F#8^9SFWl{ld5en`_Jpc7G)}jW-7NF{ONmXKO_6Q8LVR;9 zTsKJ9k^>0vvd{jFT>DZU+x`aXAw}F!|H}r<$+SAV5@)EmRi9Szn`4;y!;9q}pW zF`I>|>Wmn6VUK3+Vym5S#Ikr&KI3$(x*SnW7pC)9JH?Jg*Qm;s;{=hS^-dp_)V=Ij zI1gG}CJT=vx9l$)W0G+woUj^GIq{{LKHG+>@*e+(#zJ{OYjWHfZg!q>aOIXn0hziC z(mY1hqTI-pq1DMl=TG}i&0_j~Vxc{>Wm<(u!2SH}u-MWJsHL;JPAHuy9oE5x+sY?O zaZ3v)NL@+|fl^~hxww8V(E{w<_+Ri;sTd%E{SNtExN>0=+dJyMaA^zIjEH&Aol>=JGyas<)_|>=NlYLyP;4tYAh_++cCDNu`BjIMI~M>}uG$g9P!zJJlU&ZLc{H z?5Ss%5*7(tT1;?%HMuI$<%IIDas#M0l+P^z4(L@{wfVbM??^$;Mh~cYGWL*Ogl$9j z%y6>HW729*8v?G7^N)OKJ6=+~qha>_X-jWbP@NZA_nmlr2k#fnK!VaKtaVo{tEt^a=|TCpvnRKyqas9+|r1Xawk zVNu`ywCCZC0mmra_~i!sXCD*z)r+unbnsa;ZeBL#VMC&Hkl|{!aXJeJ&f+PZ{nzT2_l~*P-$D!(!4Y~muudK=a;LvEFRUSbSCPlaf0eZwTsMj zE);kvB$NQ_!7A17DB)i$;B;ealm*jGOsRy!w3yK8k`|(aXwd974!+1XE$p`sVF|t} zL?ChN0j*086qyqrawbK!Gl$#`B*j!n5@{gjLq80>d0tCO1~)v!>TF+eW)+_4Wr_|L z36Mfr@hucXH+|btPsfxj-{|DuGvlaITMbhYXz(LiJ0T@qL|XY4xy08%k~W8hq9JP2dwU&mh8XGVDrC(_kYpEXGxLYo1d3)2NL zvLi&VtusW2b~LkE60^D1lZ<3+07ri&-OQ{T?g{t@rcv{}gk7M0Yi4>6GEA2IAMyAz zvE@%j#XwdRD=!PeGWC8kUcuWbSiJ-g<(%b+%g6G%Ds4XaTz0{O=hx2zg0Gj{2ba?j zI*VqIKvuN512-wjRLz08A!CK@oa$_B=JcGfMrT5d#de?)5AOIojw#U&8v+D}laiIg zg`~%&vp-zeR&y0bDT|hhpBBAQTEkUG3*}^BCZgs~3;87J(SXxHw&V83<#rtzg8FEX zzusJEJ>imRK-7|RYJiLDZZepA4FAtWfQ7vn6`J*2!~s@xW(be6x>SyKMeTkx!Als7 zU_WaaW$C16(eD)buI#!vmI*J<&^lABe{F=WhAJ3^{!Z$HP`r zwa@nihf8C^RUVt}1A_d?oT9}1ly4c5Z}FHM%NeOOIYGtfq;@UBBq0A}@KC_Lr!%tz zihv5M@Rz274#Q$$_@T&1>q%RArDb3vS`KGd0oP7u2>C41As>4t(ArB*@a^ScWO_ql zN&a(hVlgj($Y&;(?rwv20s-IpqSy;yZe$L^Qf}N;HeC$Os(&KgDXL^vaes~ zg09k-CzZwM+4+^8QdMSbKZ+<*crXUqgC=ayu+^7muZ62y zM!7>GP2x6MAc;5>4!xu*HD`)@K;BX-rJxhWP(;zL-DlCnOBU`(mup){o}5ct2R~~aj2uk%Y9%3UC?yW870XGTOD6E|86q;YI!7ZWN^u; zec8oHyQ4uh2@4!wSXDD_t!boyNL9L7w@}Fr-X+2fVZF6_PtPGnnqqUCOxCg^oUk`IQk@ui!p-A7B4A+hTJNC?9BUqTJ(+_ zq5u_W$fCpHmijfr-L0nPmg{w8pfrB|_Bq^f44Bu`vv$+S=|Lk**bwF?^LpU-@1jj2 z6A4A+1!L0+Y?;=+p`^L_j>Md8Dx-^9X|In{`0^lDj#{chc!MBmHkfazC3v*uFTNF= z!$UgcXdUdDhern`d3foAB_fNuUFGPfY5J|~)!U1`N8wJAm*l@8EO=Ow? zz8&l?3+4v(Z;1`APmAA*O2#4!Yt#o?5hJYFujbM@<9mjmY%*n5({3$~7!Zp2Z2S{I zJ>w?Ig?wb@(@CGvcA`Cq&)6p(wmt@V#U<>SpV(Vq#S8e1LhYeoW;~6Gh7BbH?&`LU~fPkc$0pfPGPzD-#*&K_TWLS25I${ZTO#8sOg*W|p(Y|=cfXZ}> zze;)m{9Y;1vLn`vZeqr*%5+CEc*t|C{>!>Y&jr|L+LBAF0XGcr@6xw?avt#2J>6c9 z8zz%>z6M|DtSQY+iv5G`T{SVAMaIbfYf$LhbDB$Z@h$_b;WUP|L0PQK+XY?EjdI~| znyi&YT>Gp>B=IHR<+(~=5v9k^T^MLClRm}vz9D7#^KhZp2HX%1L=rdn6hcV1pd83$ zAmXu@u7HzfW`dDweUF&;l60gS(;m~tjf9-FAfL8qu#);2^S`rz^bi5-1IwSKg7F*L zEN)1Mu!c?Zx=3Uj40MFZ$go+buuZoEI`;Cgz z^}F}ImSQYMsQcFc-@>bJhZ>W48!6(OnNbyqD+eL0R0evw=rG8ea32c5g6($Q zhb;mL6pXn^eKKv*@qSC|G)+k{M4K4=vKeZHYDVw+l4Ol|WqVi)6nM``WKVIFT{$oZ z-ghThN%xK2kF|j0%jGM{RZ;mIVta6>0Z;OK8bhq{WKO53T9DSOD^Wf_bX`l%jN2^0 zB6&Gh_tTs7aBc0eqDC=yT4)tm3b>vTRe925{pDMKf(9Ud=u2EiEsX^~HmbVHu7ibJ zfc3K!jf_|u{eV~W6V^S!oBA_kWf`Z>uT8S%GTOuiK)tp5Ve0rmfSHx3nk3m1sl(4#$q}azY7U_nVM&GQ-^?S-?*0tw!U{j z#tjZVA7~@@!+1E5BLQtONruy)Ws*#+#5vYJu@EBHOgK|P#Ty^#bOWD?h2vLYyYW6L zA2=XEM7F1Vrqk?_bQX$ZqB`N!QdGIX{g;$Jc->*Vl^c)$9^W&ktHx3ZUM%E`8Fz4^ z^bH>_qh(Ab!Z4&(<7$%PpPFJcLe!TQ(uKn*AA}tpu-;fSuI{ik4gSN#(4pChz!ora zx18IN^wc?}zl=1w6lCsUv1Y+-6ip1~z;_mjJ$D`*qQ-Oc?(+?6PJ>$yE&= zyX(s`NG%cJrGlB78P>czKBjf~C5aVAD>EA+4xe-tMvsG+KcO@3`uADCX}8H=#BIK9 zdu$Q=XQkyA?2(NJms-(zOzxSS;Pq9em0?5iykv3>)Uv)uN(Xra@s!h!GDWKpH({@+ zuCK&g@&(~G*VBfOjmE<;gqajT!&T4SYdL^?D9>vqI2VhcpVk1f8OehPH7c=)P}W}7 z&H!JlunMvG!WzBPMdOGE&Za+EttF>ajP|;Z_2ic@09qs=T}>J*02NknKAx*v!W;AX zZwxxip$lZ}&I9pfbrpD}v$Y$#~md++24AnXdjZCKcV4YiXYw$A=5rf%SP zr3%j=XgjizY;=Ngj4P{(=ygLXY6v}mte0a)nw>#osoWZ`9ekn9%ifu@6kYuFhC}aP ztckBSuSh8QL=dRk9rJhyoZFnki<+82>uH`W%sf7A1kAEY4Y4}X4cR~@V1QyYOkz0& z%KbewM0tIZL?1X2yNX9^k*osSDHH;RU`qepQ@<&vmfT?fGXe;PAtB~Efw-VPADlco zHCeqxI^{dx^;2E-<-@z`3n2n_$HkSjHr`Bd%qlay<*$nQKoTiwN@Xk6+0EGMFVjzS ztT4M(e&`W(<3%>qVZA$iaOGaO!P&0ACO2FQc3+vFH50j_erV#76Y+-jli%mHHc?XC zkrHl0Mj)_p9<0$qk%n4>mHe}jKzVo#6P0hS5FTQLt`Ivj)}Pq!81H0&WRI18f8uqHsg8UeWF zMuY^oo6QDIsHV6xcf5iHT#Eu}zDFn`sb{jzsmeAQ!IwGpA zNbX@W<`{r5;N9G={~5F>hU1~8XItGNNln&bVOEV3>EA0E8FkKN=21|-XZ}Vw=#e# zR!bi~Thq#UVV}jq1e`2la;fGZdFuE~fDem`f`t9?)+vamntx8B$$Z;shc$LU)}Dt#5vyda25JBd)uA zz!45{9W_uZ>t?nrGVZdbmpl1oJI4*Fg5$DJhGZ+M);Nic(($(ZrX$j_Z!}C&CN7$V zelY<`F%Sz^bSYnI1Llw#sC-vfvcJFVL@IH zpLV#H!=Ie7fh1qN0{6yECiwSvBKn0dm9pHPYL&V)f{vglS6?1_oWg@FET;zeu|-h~ox z1k1Don%dfQR{8K1$0&Rh*aYupfiUgjp#Wec-Z1px04vzSa*h@~MKiq3nK5QU@+ko{ zB@G`#Im>S`AB2C{S25G*2=J5I9E!n!Tru#hx+V8%<4`d+Jc*0M#9>UR+J%&&6Xut_ zcu&YcYvX@$O~VCX9|zZfmngF3jF zpE!iK%RnOEpUA&jN_q3I5ABI?e(d*+-IJ8E>+NRX= zsG}N3dBLF8>+FXL?4ZU`K*8eOT7vSe{~DdwMTbhI!u52omz<3+f$tdN1wE zjNk7nY;x(h>1TtV0Z|iAm8a`JOCNQ==hD_5-T6<6+1Jj7?R9G5W)jss-^${Z{j!>P zpGae;p$*_*C5|ATozrw-)HjGwVq)L>yAcvAW9-ifK^;W(>rz#pYT#K|63(Y<+>u%? zi9WyE2+MCMCbvz@4Ud=M5+cr;E{dexAm~YK938r0d1*^%KTbnU4_eE{87!`2L!nHY zoFj>K>k-6t+^ib>#oQi=0eV62mZIgMXZA}-bf5wP93q^4lotn7CG5_8 zgUfw{4dXRKY7Wt_ZT*WsLEr^rWw3it&6*OcYWs>2YJ2;DJ%F=9=CsZbn?9=?+28Z)S> zmsib6_#iKM!kFZPd3oPo4FV5q1iu`6TYEj`fv;kVEoMJx8d&aUZ9EUJfvdy%*$zvF`i_A;aCzVCXineZbZm5Ufw=>Rfmr#T@NBB zP9G~{SK`gTFPv5_y}&=-lz0jGSJw4*r&a{HEet=5>s6eHRNvHfkb; z#_Jy#l|vCp6g7c&=U;<;pjZBx?k=XM$sRYucrBq0z;CpHNns)%S!a+uVm#redbe>% zqy2kIpknsxYObxDEO6dyN~6dmP{UF@$L6NZwp^MgT|#MJz+=}T3!;G=Ri^!t1WxY@ z+Y2(DK=@lFNr8|(W=DXf)z453+QU===3%}0lki|J6KzyG@JDwdN~lsy;S`P*EhA24 zk#3I&{=R<4@mL57Bn{4%Y(vP1-%{L9KYO&S=tDg=Zl|063JYMaf$?Z%;jG2b#DwNU zhk5m^5)^$?wt>y#qWW$|>3*{U<94c`{pA_?0}G$^Qy8wE7LE%a#?@Z0V3WPUIv;dpo^7hA95q0HqCdSTe zrtmiT;1Z(0tPmK`YT@N==!l?y;nNr?EYv{S2%&-hiDU}pva6b9wI%2 z!Zxx^CFR|JsrAGA?8D`+V-~a^r4lBRb0Q_!FplcKjJd{=^5?-KyLyNrIJIQ$lHzqD z*E~5qJ#H5FWuXfzElUVUH|{L59+64$`tkwg6X&f#32*w+V3>u z%7k5VoYiB!rkxa+x_WSbcNf=`e&jt|JZD`eJOjm}!k|uJ}PI{zbR?#K3eV_xF ztY9BAzJ+T18#ar4z+uTXchvn?MWMh!Ysf{~KEuKRhq^MU!ls;V5wWB5ntu+hj|Q(Y_G z{8H3vYVVsUK0bf5zSD0=X<7gpR+Ea9<%WxYQKRV7`a>0Z-}hk*ukbBK=2W!ia#8!X z-u#ZpAXv;J;E0SKDZ2F$1zJqM#>ct{*l4UkpL3odF`rfMCs@bVegvb~oSi@4y(M(B zYd<;-huc%@vO^!E2pHh}Err5(O-v*vQ5ffDkJPF@k zixOX=RQZtP5vBy%8da5`-@MDZ8Pop-f)pUM6HmwqF#A=9Mfq5GQ2yNg7#rAYWiU&6ga7qG{u z#~_8XP*G+9*A()OAsKHzRDTsgUKRKHmkbc0t_<$`038$;x(xzDpKti6*R`na8Es6= z#5d2*3}5&>miTcx3~ebGM@Cwe7f`6AO4HGnAmiR5UYJm?k=q1|^ma7qO@B4RBh=ajjZT0}Dmkpm0>XTCm4`|F>W16XTdm-ZG*6xoHt; zruMiuSme~vO>1IcN@_9MapLBsUWDvct^PM5TOIHg(t|~i zXN3#4qkEL?A#nZ;6JZALnr1wgY|sk<5@^~_0c)Us_E9^_Q*vd-uNUh2u@aZ*L-+)v z!rNGkTL0z-A$e~}-a68VK?a!k#?vK@nC=}lsZQBI`6DcebllqpP|(cW#Ta^&9Di(A zn4I*F(oy$&<0zeUU`IMtJ9|QB38Z`k@;}EXA1kR*|=h5&OE79Mz zU=SA^jxJr&t4RPN(;9&XyS~a$bV*5WMDl8FWByyEyZ^-Z0)_&d%-b4O*b_O^6C+!j z+f1}vALpURn_d#Wx3!>Y8i3~!CzzK!4=ysV`|N<-l+V#NAp)KyDf%VY`(;CIafYs2 zE7I%SxR2p@X2xv%=-7(R4~nyMio{o0i)U0TG)V?C4&nPn7B{)ezB62c;(U&Bh90Vr z{Q?gq1d&_NCp1@Km}7$##dPM?Fduc`?nU`#ABtE2;d5iW?NA$urp^W;>n9oi!xR9g3LCf0QC)PY;nLaX2`>-gf#*HHJ zPJ?0r#-%FYb?B1j63<^;r~eMyQ<>ahsCfw@yjk}rf2`NQ+HVBXl1{Ob`gIaetj-AN zBv$>C_hYRMptos~zS8La+Prudl9#VSh5g*+JX6p*VH2BYhZnO~`*nTuD{mlqFFF134IhUm zYpdywkRV;37vym}&PYO2p?^^S(EI(O-rcFH`+8A0SUKpk{KLbHznO`e#yJ@qxa}he zyvr#seF)jBjH#^-5f~-@KqGDS`FK&#RQtSANnI(4&E_`rKsWF2R%h@^vCC0xqpwJs<)hxBM>}f&q`rjv`}sHOF0{sO zPhW}h1D=i7Z({qpTut|oH-){NaTh(nQwnW+&wkQkQ1{P~&Je$A8$Rc<+Ca2(inJWUQH2C9L=xH|oRBYqACS-608^`xs z;YLk&xJ#4I7N+;~aWBE>-82S z(JOS|=FBTrY;Bdujv9Jg>B#d_>X0sdd(heo#G6^?B#F_(oxvsS+XHz0f&cL#hSV^EWtGJ6v>zt{lFQ%?F_%N-9sg&1ipV8H2-9Ix3V}c^` zRj!xxvVNSro!1fO@~#p@9H3mx*U59^G?swVkoXwkh}a0gi6Xw0NL8noWz~E({`Urp z{r>SSAM{T}|Wj9@XvqJPVQ>f=Kq;k3LpSLntSW`O(p282T)e>7AsP z&ajNNuqqCP;__FnfufVPVajb_|da2Do+bGJx8_0X`5H>I8HP%loXem z;W$Vp;^Xz6FuskUC{1e*ToBmV1eWT@#iG zdqHDR5sAn%r-Y<@1FbkyAgreGI6qN{s6Y4o3>RluSRJDy5}rYd1AzE3;4!7Hnug-E zvW5+b89tLca1DuTi))9HOBm{y1fM$hfMcN8m-(lkl$Z8Dyolq=|KsTr|Bt7Zy$${T z=&=4`*dIFMf_)C)*QhFi=u>~a>HnNG=eN*rpa1!%Ft)_8OicyO-o`FOJ#&L5|O3Jq2pNh3WtrA0@1D0|o2C6L{2jPJQ-s;_}_aE)i zYmZ&9hp)vDT1q97th1~2gg{smI~6Wrp~Spt9VI;@Mnp+pQ^}3NkO+Q=OenFhs6;He zgs1lI2%`h0$8o_KIXy(G=n{9gvRP&OdhJN>bd=i@cBr4k9(2;A^#d0Vy84+x-_;lP zy8Yr}_hG{Nzx$U-U$PhF4@g%~z68{D4OCkXO;%ZBCoDQ`!NjZQ>Yuzl{;Sj4zt*(q z`9X`Gj}cIAnp|`BudliKUnY^aA*v&O_qsj$14hf%RKJ96-$>HL7keld4?Wxr*7j9o z^~X96@QYQ+z~JlWo^{MzbMf!|%UOqCeDG!Kp0Qu;b^9Z+*E9zH$*rgTJN<>=3>iMy z@cK1hntP2#i#^T6uY*+wW5e;bfTetc>APLUrswRj?afv~%<9Vmw;Eq0!6oYi?(!_< zN1cQL_A{T+r$W5?NO5#6gAF$xC#eu5Nfxv}n&@ye_f}oG3<|Pr6Z&)o`6*eJZZMD0 z^bftq_sel|i)#TQEhzGoB7Csf7p0UNyu%gv@d~_-a?2~QQd6uo+O5f9Vw!SAC=atr zXkLStI1p+fB5Oh?Fj+%d*5+HMSC&nvUxT+S^Ze12lk0#K_d`VxTAG$MPf@8@9xtk; zK#8z7zjfW0=UrD}$6hjd)}Puh4j%K^$qSFVZl3=2>tipT{Ac|Y2!mN`UHJbFzrVUR ze#mpv4*>M4Xm0C2@}`sjWAgoPK~mOW^aO0ul1d7w)O?bi;6St#^pCW1Ermd1Nw-n^ z@_5y{w<+YF0ffF;e(9$Oj;>qbo;c+-z6F}t7x8tHazI3rH&Ckr!3UFRuM-a;aljF;0U08rjci$koKi5FDc%F zqQue%3)t`M6Mpf?gTMXq-@W)R=j{KfbN~3u>$2uC6#xJb07*naRR8raPJ5#IdXI13 z{oe+<#6DO7_WN%)obaFJFJv3>TQ-x}VQUlMg$MujPado;jT!v^ox8s?4{jq=Qr7)? zsi}D2C4Dg;ZrBW+#gWjLYJ0J|R}%%;i2SU^*pzNTp?u1{JFI+v>L75M30?!YW3~2_0>1Fy#9umw>ZiL9t<6*Rk|-iSu1X#ZDb8X*2*)? zdjl2X5ZV`Mxn@?$aHr@34~V3(kX;Eq;AnX1%&C=?39fpzUIlEuNV$tql5*Z-KB zRe|f-kX)CX4 zsI#wzo&nOHp^dDQPeB4F_jKS}JT$Sd_-fMP4Lw7|EdVB3fO_AOvZ?4OAnqB=_rN)p z)Y49Tiyxz+!&Nnur+iDz;NQh4psI~3VCvGa1%Q}UBGkl@TF;=8_N8qKMMP-eTT<~F zlKv!q9n!K^TefU@?ai%kycP1U+fe}1ln0&x8(65vTXkER9-4UuK41jJn}DYC(mID8 z$9?w^(t%RQXFEW-2eDD;|Aq5mloYxC50{Mb_?M|6C%?@=xn;|uTw4| zLeoih(?zUVmS8Xndt+yEua&jG4q}3<(~Q`L=MAUG^?+&0z4k(qW!9!NQFfcD(xO&p zEktmDnCTd+A2<+&sQI@l=T*D<*S4JgNVvXz;Zb$6Da#s)mKq&0Y_i`Z70awR=O zt5aE1NJfFEq&Ux;d4@V~>?v;+1(Kd2xxE#As$&c7V55XU{3_H%gqi^>NLnRv+ktY| z`IZj08=A>F=+=_hWTs)!$mRvS8(WzONzb5&Eq71WO=35YY9{E|Gr+dDH*bCQjpE;w zmUa*Yf`{rUZ)c(YI&7aL2P6Tbq(iH=CM61DTL%-@fh%`f)&Q~8W4+voqzZTsHf46G z*OxM6$dKU=7hH^Nhyz)&M{pCas(+LV^(NKouY)-VhNWO>ccvMiNwEKGIb2b^Y}yBA zHKr$I3MC*BPOJAra5U6K)2KUn!j)VCfA5R}d0nOwC!MYU z7KaO~bV}wpZ8_?3;SGdmK*D=24F+UkLuBmGgo`I^;%!~J#Ng0l;BJ}2p02t$DIpUBQREV2YbA4e3q-;nNb9R*xOK(er5H~=Rf zIWs&?JOe$#0;A7@UD7jeU_XS*PRn!KCG%;TT1?6sByLsPM?jT`fXtsT74!Z?;1!>Z zYL-`8dZhKTmQlbSu|c9h7_Y0g=~f`PRt)_}BYtS1KyYH#+|R^fHyN<(IP^EDnwq`bO0UEE9vX(e17OzPhk*>j0E|nCB zHy~k6H^a4sG|VDk%f}HUgxBFprRrh?;q(UxQGSiQKE<_08SO_AiQU0~ee=vWvS}PJ zYCSIRXTH$|yzL2jQzk=(3>n@BXr8H{IFL!L;y6Gsoh2_`BLK^@DKdSbEtt!$1-DKN zPMI;SRS($NF8KMdCY3dTjkDjLBJ+=<9BMK)^dli$37+$eoT4Nsvi2+=G_NpwY6-3s zuyb=P<;qPB-F4;Pu{XuorZu~qR?5rT;f`tuCY?YgqoxJIbH#aXIxhE!td$B!q+6_rmAK%5&{9Qv=T+}YJ{7_B za2=m9O*s$?1u#n~H}hn&RzlXAz98$)`K&w@(2(a;Hr%XzFGkji%9`1i>lP^^#OV(d z_aN*G1^ulS^)1{gxsf|*L@bnf2HLGxZD4B7Y)Z(Q>P%ABfz%YWP>J|hMu5Y z@z^cnNc9Z$Eke^Y?tP20(g7Z?y=PF3JOfn`YOSPqJE|B?m@Xd?7u{3g&33|Mcx$d3 zb#a4dI6&ag!P^u-#J((_-($$HFJ;J(A;S&{s^(-F^f#6NiWNMFz;AJglu!FGMsXzJ zzriLErYTS3A>j%@P7N^_g`>P44<~#sFq=h1lc(UFznZ}pkZGRVZ8d~ck$-Iq)wqyN zJ}h4IY6iu_iDoEkV3bHuqR7A5rlkECq1@uwqy^SmOiKkG@Hu*2KIUbO0F7VA2=O@O zP+vL@j-S+yYGoalyK3<2Q$)E5ZZ)K?g_M2O%DN5nz`bG?^=XLBTBzGTMn`R}KS_HA z-&waeBBQ_}Lc5J`hbvKQMlBTDXelI?ppEUz(%StN8u=4w>>1=nB+!`GBnp7=r3hi* zZSEN`?Tx)nbuMd(Ln?j&ZPV~JBKNp7Tn`M~5>ns!^z9kOzd~V3HV1vfA5g{E@PbIF`k`8n}4F2WBu-iBe za*L9RI9Zx+A>)4ic;RdGkA_cT-H!4>j=(l%JLkcjc?(jtFzF= zIvS`g#5{vo1VO~$O|IVDL2>;h5SCF%(cZOHI>C#jk@pPEvfuQ&=5thm72Ui@$r?Of zLwSgUUqe}0Q%$R@rfDMU$P(14ChHejX$MHpK*qwCe=3R#Z_v4C&=Ig^!@X$~s6Nr{ zhI-1C^x@naFcMg{9{?K5x{-Zx&7?T8@p!I9HY_meTlg<7F}!Xo)A3nx{)e8Sy{tj% z6gKlMZ9GG3r#`*<_TKi^=54RPx%KVMZDkD*mpknVc@$tH=e022pR1_Uk`_vtlbV~! zc^al_VSwS_W&=Rw<&>M@^f?+wRjg$dyzZ3T7}AZWD5q5M9U99g?Axc;Zo6O)d=Gw% zI9JMK$dDn!jsU9h8@#ES%VZ0ri6Eq@_)@=`FxBThEZ$^E&~E4rmLex&9z@(5E|{6=oCkB zY6ay$iaCH4cKCY~%dL67IUuPapczs7+P`Z-lfzoB9x|swV1#lzDn+|9d{%_#8b?XF zoF-EGt4VB4m4OOzO|4@S1}x(mLdYf4L_HlM*>A!?Xu6n8=dNRCSlAI)A61~{iZ&}I zxXO~NX{v@RaYZJ(>KAu^=9qa?A9>)5A7^@Exqxl8Q~|@mSP!QXcxu%63b&{b_nHPn z9DH90!II2+1}AH(T`KAgnt28@dhc7X?u9AWE%59&DH};ysF1tlc`NPHxM!%98oh2e zM=EYQ<^`U?%a`Hcq((f0<(Je_V{y9fO!<2n$lBm63h>oX(lbEqi#&>0I}^1VI|TL>s;@&l;%3@Tz@=qU$Fc`6Ek!+i@()|M6$qtQB-de1;l zobfJM8QrFFgp~Bf;eC^}<0ka$h_Mt`HqZS7Ib z4Dqt79zA*%doerpu1>plo&h{P+YMT<1Hz(9h76f@N0-0Qb;qz`aWV@Ucs9hW1!qM3swxE!Mc zMjquD>7^K~f545=^Jhndf(ggo-US){Zvdje)L5J$cuh#$Nez= zLyx_)OJCn`=W#=a4XOSvT39vSYUvJ&zm0eNk0HZ`4jneE_;L~II0i*8#|F?~<$OhMHImV#H9nqE|)IUpM zaDBnyt&*h3bxkc0(izDFZFzF!s9HuGAbPKuWT*471^@sM07*naR0e0+@8#SwOp-Xg zr)sf9M#{Q()LI(QON2;ANJ>a89FyU_p~K>yVdm#QES_MBt$N^EWSg}h@JiN9*h0f0 zu4An87BQ-_v6t^U{u7@VQT&ZO@!MT3PfDv5X}Q9!(5j(-{PchP+4sM=FKU5U6>~Tl zUCU;0i+!9?qb~W0z5bJ#BR(;5#K=)2M$UZNX$uh}c(rd4DYPgSvdAfm^K=E!D{Y70_ZKx^0n7dF*GOf)SiPihMx z0=Z3j_5qh3Sl?o$L-{879M=|(b9>RA!O1Zt>%c|`<-#*iZ=iLIdRn3_oK55=8b>Iu zZ7Pb>d%SiE!U3eV5L`$KnKR~$g zJhJ%v)5{mz=9gSKy1X*_;E|`_vx&%b(>-U58a-y@=+Prjzju?9`^I}u96jd5dtNcW zfKy!Ry6>dowxX}mS1h)K78i@#MwNf%MK^%z@zEz0k6R6~Jg3^S?6NUqMqahdYfD$z z>8LT~-^?Z6jA=TPoTwZyQ_u&0K25v+=$Y$BZ3WUL03EZf*IOcb`74 zxH59|*pu%0CDHb{q>xC&3zo+er)18zM179;E#9K3s8QI9(+eVA5MiX%Y7sqR0Srk8 z!W(!z5xXt5*y`D%*Pgrf`N&?qciXu#5K4X|jtCoJ_Jxe}7K;K@!^s#xdSD8~a5zq- zQ|nv6QZBCxMl+_9A7c`@qZB!($=7bgaU8rqu?pe&$(oTq%?h=5?>>9&*7qZO_SmIw z!F;MY7;b@L+G$dBU9mp4zp zBesYyHZsnJTdN*!9X#uBx{ovWpi2*g=1}gi*rp12@}RlZTCr^E9JtMm<5oDEF8oFu zxbB?D=E#7v9;)tsYUT)-s@t4<=74J3iM)u;}KWUud*<=DKr??G$EZ4dJ%I*B+|3TB3JWJ2E#O zWKCf9Vew81>pc&qO{Lcs&af8s)XddqCpG~W%{YAS)F;-IH(k2!>}hwrT8%EP% z>Tx6&qmvan0<5q6%h1ZdD4o$zi*EV(g=^NVU9)D*6PK<#_t-nu>m-3PX+4dvzvG)f zGOZQ=bv*&qBdgbb>zIenEp}eewpQHUwE(`ncJ=Btt5^U1v5)-Eul%IC-gWz5Ts!z% ztIO-(+JDwx+}UL-Ym`mGSls0yOdhl%T!q)c<`To}U{C(5E-;+&qzbvpCv%j=l}{hp zr<7@4fvp1yah*wt;`AN`woD~PIryv~!4>!%V1O$}oXG%Uv}I)zU?DE}>~KQ4GGC(C z9CFVZd}&v9ta5wC>MBj)5be5yngVU zm8({+Ts3F^Z(R7Djf%>{NJme-YzvCE04`V0an?&ky2BUUdc!JBWBKpmOQyf{l}Dak zwer~~XS{UoUoIx2vq~0|btreKrS>t(9LhJ&b74G$1#xYWvKDer*_W#K4Au&Wk_y}i z*bxCpaOqp(*CB0RQ0o~e2gq<;0})v(!c~Ae-(tlpanU}iZ z=;1;Xx6(0XQWgi_S3}RhWz9Tu^^~TwriGX9nRmcHuKcHGioaV9 zxM}hgORMWkXMSeE(LY#GT%3Qw`twe`r-+8;&S#!kxnjjFgKwIA)l$uYjo&+c@(bs# zd}hVU70XxNeM-No$Hm3=%}h9YvZb-Sb?K!iJa+Vh#ceAdoxc9O)9%?=QoC$sd2xAh zalW}&_P_Y5F(YTH@^S4M6tf+TcYUwe30g2>`cNQJe)^8p=dW1)?DFL+AH3kji%-9+ z%kZzfrR$zK^8w6KQ*|wZ^NZUGny)|d(TlHmy5if$pQ!VfFMGE5yY7hjmt476>E|xH z;ehK_E?>5C`SttVd|A z+8z7$j%o$Kd$B9C<88`xJuw%i&6qI_=01@sf0#IX?QK(kbfe$Sm^N+dkLE5ScPzSj z*5FHL#`jUC-E!NoS?7hzstpU~!ps?Zop#uanIp_TMYSg~dlEES8O5qCEvbh z&OU2Eu}^f~wS#Y4JA0zL@vzxXT}rl-hFy3|v6gFAkJEMgd9#Myw)VP-?#jgLo|*}> zW}Cg01E(D^!1i+Hnfp4b9;$Fd)kC*VefXQ@KF-ARXRiAu*{CY33}!5HMLm|Ja#QJ& zJE|HSQNoihv>^oxZYf)}v&dC9kb;G>anyu#fvPhw5XsGxZ~Q?%G3#uwtnC zMl$TEF!4HTKKo9ZHsZOTuPd;w(r(Y!mnY7+^uUMbFG}25=*Eq3D=~pYC$rbCedw&g z^wOgF4^RE_nUzHiIP=R>pPRcNqDBknK78DTXALUd`hc@8oVsf6>n zNjJXnj$?Jz%)m3xoT$4$bn;X~0jzs&)iKi!t9m(f+SFA)U&phc1P3I!4rIApo23bG zJ4~=Sm{ufD;?q1p^CT{}hAy|pae5B`O98RAuxT|7#j6o`YD3CxUJ68xg=gmo&dIaS zl&!JsoNrlX=je41xkR2Cb>KzqD@H z(MRrEe&7GFqerZHX``oHKeqUik)sY8HR`~TCw}`EQbUl`N*H-L1p%OyHNswmq`1^j z;6T*H=vAGzyrXIw>ls?1CNnP)j;hA4En}Q-p)J$eI$F6VC=9A;$mq0>GoAry1C~pO zgnJ?9Bh@r9NfFPW+wwuI!B|9PTV_1r0I7d+WjHc>wQ-Ouk2MqR8vuqZI#)Vo%$`1;|l zhsvf7x#Frr%-0i-9~^Tkx~YZ;ZQ<247}X-{ z8T=P~=orP3RH*gn+q?JPd-VCxp1pS28GE$6LQu*X$=0`!>%u~{O_>&W1f)^Y)dV5G z9yKK)4nO1+M80x<0vXPk9>)WxMy~Vb5eY7;sL0$bJ;UtLyLYeMcj@zyy?gGyYpZ7u z(wx;X;#=MW*x@#1$|Y8@p)lZxX>jfAMakPHPCM>7vTHMG#-;0SByTR<_@k-Qjz~Xz zU6D~gPrmWA?&r@98*Fzn1`Hks>t5{E0=`(AjhHqmSojs2P0t-SZ6d!|4D&#;oiyOA zTZ%mVjP^w<1(%+iI(edKY|=EnA}tVbl|FS;73;TERYg*<_LHSa51&1M+S;%*;74;| zPFZ9yv7lkKsm8hOxQ7#aNsDG2K5MY47fR4SEKJdXb7X00wM zd8pXfS~%CLx2~4zG~{U!!$B@uvP2< z`wxcI>$>81mcHen7iWlf02@Hpy443BP&wiJCLsKWxUJYJ8Sne)O z{#4b*{s)bCWbVQWEgl(u-~pC4N1lr1Q5|mbORi~hUD^DSyjmgXvlGguGZo9H+H{Gc z38qeRYi{t00R1SwqICM_`E|!W;$AZgf^ma1XOs}A02P!E+f|OKBTM!tv#6~ck z{r3K{{0BqALh?lCRJDO;zk#!iKj+AFt~6l0@dmB|pkH&J21;7)ok3BjVo;Y>%Ck`Gx^5D@k z7X#B1?+B{K4;W;r-EYK@qRr~!;6c^{4;nFK&2#Ii2||swI1M5HdL{w9^xWDbr;IDt zu*Lmd-WlflFiyf%RM^4~Y4@({|E{?D8!GniB`s1Y)x^&+Bp(FMsY?D%^ zHsUoCosk=l8mU&Zqf#l)5Y%RkjHKtlI&0fKkcPtx8876AR4Is%3Trh8a$gkwGwx?5x3|9 z75j6ou|MND2o4T6WLSs7x)Z$s5eT`iz|MzT*khNzy+6EXuf2C`?bJuRFz{}S*q3K5 z>2bTkjwdNL4)O`a$nI){r~_F07*naR7I+hBKuyx8^vo_ zB2*o4&yU-RI3^?;TT{{31C!1G2e3eSI;_bTq#)pr)%~lMR z?dU3osvUcM-!m`N`)j4>ZKYBv{dMN8D>%^BL6o&cv;7SaK-V4Le0b`uu0*0}*{Kj| zB*P95<^J6|ZQ~o(F}p2xOj382yEA5QuG~qq<#PUDreu*?@gVtRZB}Uex;4+aTM!2x zFwEgHwMTN8?g8_UOORIhMos*o<;P<$ae$zou&9%FgENcNG zYeAAjgkFNqBA3Nygk!2yw%?CdD;28r+_RH{k>hv#uyu9!A}U$y2%qGI}~;a{13#(?s{3CBz=GUc0)IxVHQejWRTUu1Qm0h{MeyY(xyW0QO(5qx)@7> z@IUNW9`7Nw19mO9KV?SPg>%6~y}S|Y&YX1k`BPLW00VjW8$81p4#x32oYlop3hOCP zdj=K-P!jEX7E*9Ht6*Ak#pIg?O|NQUURt-tpId?b_jmJj-O}RAC(o(wM0jPxdYJzh z%vw>tzVzVq7cahiG1V4A&WkUs@my;4tJ=i!qSxN?qBA?HTuj@Eq{M)UpkBG_w2NLk z|J*|~4NI<=vS8AUpWlb;!it&t^qGZ|p1pjWy}oSbnDY3TQ45b;dBs@Wa{p7mGyj0U zFE5U{?Z5}WbH>1u$R%GNH)`y-^7NUnFDKr>dI>}>1WTqFO`t-a^mrVpsbi&vDrXuV zPu9g$lqb#_;~Y+&G9zL)!2tldPwUyYcdtEn>-&+td+)wW`C1bYZDB+4IP)#7WV~)z z7bETwv9IL!eGZ!~kFAMN z<*N(^oOR*gRB4i2=vr{^H=XmazF?2P(Wl;&!1kevc4D0I`(LYO9co%Ubk?fK0LcNy z#SIVxwpUfO+|6>Q3?Eo1Ux+&o=GdYqv8}o8=g+0?EWz*16+4M~tFe5&NCSBpkb~R1 z)Xkc0AffGa8&|29*R6JVGJQug73C!z7W9t2CjO>151rXxCqZo<;3qTAh1(wbvjMiP zGOm=_fluAAX7$=NYt|n1@Q|U$-M&HR18i1m;tgw8uUWf#^|bjzha7k3%f(~s?>Kho z`RZ@WgJ#zLEu2?AQkMkzXcDT?G+=ym%9z`JzH zjB8R6%0)g6_<0tZLoUw-KA*`mQR2K3)&fRxCC=?OVw$MX$>2kGDAN|$~S!H_)mPfEQI;l&sN=_rhnqIcmBfZ8T&;{Ck)Rq zr<5)&r?E;>2Mif5q}KJF84n*b|GH1P{92_hi!L28a^BG^%QIzG9r?(Jku!h7HRF)K znRm=1lMfs@>NDkWH&$8W+M+s^HMbE2jN(o@;M@+kdZI1OP84FyARGIc27iXNYhtrKQX}S<=jNirJ3uC8!YO8Wh(S?v1&HT8&k4S*uPx zgEv}dB}_?W%MhOZ1k5TO9#YaI3W@-ECy642vGvVsx4}AV()osgWUJN(ieM*0%tSYXLnN^-Xv+UW! z7K|EmhCY2psj=6tShjLSaq;nyqrY%>S0RF8e`oB4>Y8VlFI~Cf8n|riiQjvrxN-dD zORH06mOXp<7}fZ!F$f|rp*$gL9!G?YP@587k+`&`zQy(~Z7S4Q==`iPMTV!Us*PTI z@7CwTd-mFO=T`5YlyAPN z;s$Y#nGfs16WlRN<5pCyzP)11um)E*ukE0#ZtsJ>?mtjYTVyj|0+_F}j3*(Ba zs(LrAW05=g-b!ac^r}!}v61R-vf7U2Ye!~(Fq)cxAddm$3;4yI$6bIW@q>`00ZM%1 z?caPD9yz=Em8GHQJ_4(*J#=XKgGxT%^649HJMOvX*6Fkn%fl2f@f&|%9v_3)_2k3P z9sA|8_N{I!cC?Ru?%^l9sypj`$A{1!OLnjZT;A~^dUANHF*G*@4r zor`FTZGwuu#bgag#7^W&Z*e!!Mme?U*c8_m)&&se0vjfPcgb-@!!sVe$@?=t6y1~a@}fpWctYCzq9ElkIx@5 zWBQ@`p-)}#m0|NA`3dsz4*cRjtbA_eqsPpf@|CAsA+Ic(T^1BPb;PEu=7?&Vh{lF? z5|AI(@;!Y17j>)se5Sb%mgCer>Nso0eDWSFIg-;Gl9nraP)Mr@UBpq+4kb9*UYTg15x=uKP~B3~yX< zS6Rz6E0+*zTNAFjWpa7?4CDCtE6a-;5W1e4 zxAw^CpWmnYvfmm1^T_8HJhjn{*IFpG5j1+nd`oCYD8r9u9`|WT#U4Zfpx)X!gcf2L zU%WR+_?A?iouClq?+1BXXmiR8#kJIW^ysn6PQCwV&tmVO*KWn`Os^KuIy*K7{u4(2 z98p`wl7pyf*_k??v+owV?2Nb5OY3k~=nZu~+VtVhnYu}IU-D}U? zdhFcSyLiM#vW|4KePKu1l+kay&}I2;?BEy+#d51Wsf3)EtD!s?W!Bl(fB&v@_G?GY|rRfG~=9y zgY#?1>bI(If+&&YK9t*Cs@^Sf?YQl>g)`39`)kFv(U0o4qF!(d-SSlCNTp1*SLI&* zitXHG*pZ>@j_Gr!5sj^&QfzZt_M+L>>O+5{cUEUDO}D>L_Dxrm*A}Wb@4o3Dw1@s0 z&|B=4N#1z-`Vy~P*@b`hagvb$0Fe>c4%QxYWG2uPeSK-t3Z zSo090+$2JR?6)F`Jl6z&o;B}86OM|L$Dd7~1fguMNs;`LXjyTdgLvPbpJCy~;D=$e zKq>)j>|AP;S~Q#uXfs{W7US9?a+2sz1SqFXk(+G7Ea;O`9;HY1KkS$h4?pq~)5Oyc zKMaEh^`lP#F+0j0a2jO4w|w!W19)ny*Oba~nCf(xN53)*j+yi955CavkRvCrn)hRq zg#N{o53e3RVn07P>j?_9-~L13#h1E*K}E)HJcq@3_Ly)WC2DAT;t3K(r&^>3tW=~= zK`r{`+SoNCu=SVy!|_)iEE+bw=4kT)4Ec2IGyifRcNhbVn`u^(F2a66c0kC8MpYBzbh~Od{U= zpT7J&m_2K}qRQRx^XE)?^jmkmT;9<2y>C4_`JB`HE4BD*<((63i&{g*Pnt4+#-&TD zwibWuhBZe{8P9)D$C6jHIeGrK?&>N(>Nd|9fc-vyZh7(L@>X-PzkUpX=t)W(;D@3= zzH--Pj~#vWDgDT8{XX}dXUme7<;CB#*BuE%&Y!>hstK^^uJ0`~ca^`&G<3wiMN^yZ zx_6o3L)X3LV*f*r9`g7jON@MzeuYs#<0QpfsA-&Bv8`(Xmir|;_wBv+?!7;>XV2YtZuRY@_h8(u zmb!=?S=SQb8>VTh@o7M20M6@xvmJ+Hsusq!K#VQ)WBvve`y(_ca$S;FHGn;O7JD&0 z_uNe%-&_8gk_pfeX{rX2V&mG*&=YnTs1C3F@vmQYyPx$zpg^yu-WAywX5ypb7mfU_>du{i!-}jVo|==u>Xu9j^Gh9pPE}X zHu1W(PYpZvP~C&Rp6aE1iD~Yk*Vc40arWA$4w~j0D-XLhH9He$3_G^`O>TQ#*YZfJ z$}v7Pkv3UuOMUaaJ2p%_v-)-#oHu01bEbvE!kn8tI{*L>07*naR59K%)Al~~xJ0GQ zzGpu4Bv_V~zvu0XUyhpw(}xTxH&zau`J^Ue;_N3K|25O(@_Y8Ja}E6?rcSk04-?Oy zdE?=S4!L$}`O8*kJ@gbf4o_vjb(LXcRqC6>LG_# zmz`ZSg2GYECl7LSu&IVhKaUt%T5YMl6H)m$CQJ&&;3Ui86AQK-RS|#0P(u9Quf6U7 zn}n%u*YU&e_76B<&8LS9)ps9w=@b80GC|o6_8a{3NyDsJUHa6IO0!af{_IEJx@hR| z;rjB_Z>_%JP~Dmi`8t0R!RfHU=WQy&6~kQyM&JM@3u5lq`5nGiZPDRO25%;~(c-I(+0v-R3cKex_3%R#2Yb4sW5+E!~Eq@&cggJx{68 zC?gR&-imRbn)T#MCmlZWhU&`jOCI_D7xy*fRz*e|zkR~w>-2nM>MhTm(ccn|mY45G#s3y?8=8W?UWk>=_>%@4JzX$7V1^G#3D*oEx?FB;W&8D zpmBYjjoJ*xYpMKFr<6HvCDlUPnzv90C~sAi8=q4tipRZ$QrvXrh(L-n`D!)yQUE(3 zKMWBo^eDY%c$_GUd(=N0^TrB*YLR6@#qT_L2lV+<5;uep&%p4FzgQ2C&KUWq8^ExOe{lEd1INv}VZq4Hj4thV=mqn?JFbxF zrVSfl{*00H-JL@(`oZ02^dC3t!3$12VNB&>j=W{X*AGEIBIhlt|Hgjf`URgjVNBWP zkm>WkJGQz!_S)+o8>ufA9o=2l;P43OZHmVc709_5@A_41*F5^!F*i6GC*Sbw>u;5WSO52+D~*fZ z=pxWjZgD@NkoI^BWWz$>=>{Oe^AzQZJVpj@`5bA@QOKisFriH2yeq+TCSM_IfVM-g zk+pKu9@U=D;dKnvg=#EFS)*!@fQnKs@mdgLL^9E&t&z@BvX0@<2&8;#WbN*!dWFeR z#5{xGIn--uJzj5LSnnBPd=7Yy(bn4e6N0O_ri<-{z%#^2mo`Q4meAM^eM=3Wk&Ou7 zfvl6BA*y2#^DQY0ZR<~BI8a&FQ{K!oBxKz!-_n6+03_XdE$UR(o^ovOTc91!3FR&5 zIF1PW0%~8Kc!oH~YMz3GKWQGjTkU5W^orw>=U6KqN9sE6Bwjc2Ep6v%QOaT4wr!iY zsJAz7eQUGYy47Fr#J(Cm6}W~tUISuV$Kxz4`2oiiJ<&qNlit0`1Co37sE$ca^1Ri# zZ;8tKRe-(r+!eMb>_C+=8Qy;=f5d9~g03SVLxv1(!O!qG4gt<;BFL12PA-r<$gj(1 z>0JnB^=xp6Rnw4+4NVF8`8&bgG{W{$J!R9u4zG5H(BUM!d1_fc&5{Llq2iaLbQ(ce zpoyXx8w5Zy@5NX(O_1@XxJ))xnQ*j}+iuJM^F$Fc68tm~$u?6U9g{KEc&eI)K1&AA z_-2_Wt7#0*?x~YCqMvMeJffedPh7P8^muiHW26Q2%!}AX{SuT;uw*XLvaEix8>^29 z0o^w=vmNH@DUOY{8!82x9en%lB>+I;WVpPO4kSO4K!H93M z!ZA3~VWg==GNQC+po60vV6-ERBLNQaYMPi=1Yb=wqv8M`-N!*J-@23dn?(g2!uWDxGqHw=Yi? z=@P(4{HSkfQcV+^Y0&k1MJ%zYRxFNKVp%nfGk2(|rXd^96qkUhYMP)D)-pJZdgW}V z)uTs`7WD1iqxif{ZF_sOD)wkLZ`rnGtJ<~=(w>2NiP*)KABFX>5V2Niew5Jx)8lxh zEzvm}WtY5!<*_@hUd3Ne=v8gUI9UTmVmFag)T@cu%?ZZ<$N0qIU4^_Ulc5vX_soap zmZz~mh71|fP?LW^h%O+jr|cviuu0wnQcF;oa&XVks8Z$D>>Ih@CnCx>?q?>-Hvs@V zLuKEY2N&rawMqrJ{+P^KundMh8()Fwy+x=MlpEFsxN_8T9N2=;^3OBOcdW>?Sm2r& zKqTm-At<+jpanIe=6+_$U;RWEDhaoGYluPEh2TQr}6 z;HZdwsib{@^eq%ukd$=;&w%xw0jO1S3k4OyYwKbZQ$9%Xyv3;{UwUt#00K1!Dm6u0 zMq#Z=@Cu|=GCu=GLlnjBNQA6yYhEvitQEzRzLa|g;CQVMH+V}a{yJw!4dp&qs|4>2 zfZPL`qL@<)q5z?d(oQUts{oH3LH3)PTaA60+ai=#UwI{ykFhSFY$XHXD$1{JZd zkn*Uk1s;>Nye?&pV57g6luCLAV3bRey?i|m4Q1`_w^4v-DU#8ZUlkj`eS1OQUfQ>B z-Le&m-I-#WX3N$Ruf|2UHKBG^sVIN2wk{@QV|dX$C3VJ(4TyPpXYIG}D!fOl)w5@- zXAdm?diN|gWr)(N&@-q+?6!bZ0yP$DJp&>gH=WB8SN)aB=}DH>!LKO1$WiYJp7k=%O)&dq_|o z#R+FLs@_2hsv)1nWVeRtHL`9v-!KbELsP(W72!F0YF!I)9BQYGHCh_y7ud9JY*8Vm zYjk^ywg9Tr*Kp#Lrx%c`u1=4(eH(t$vK-LWJ*faPjfK*=mTjB2x_6x*ZC{Z<1hus= z32z{nUc1FZ_}^+3+b-q)OV1Yc=-H!JPw0V`gtT`G$+2AhgL_=@_QnlQY&JFP~=#)NB&(^r05&rjD zFJxp}kY7rqjx&gBL>4`9+sBI1*4JQ^3VXkEPr&kDn6pF-<1a$;42$c>Tn z(`^cKLuPmrwYn+Tlq&G7D`!qjjuWJ%z4*-pVY_T*#_jiD1WYO?yv`S*9x zzc_~ko1TQ$w3BC;SFvt7QdE^g_8S4!dEAui~Dmk*C zjdZomzMAu@4UicQs5aRVGaML`2@6=1f(Srsq$^QE@j}|9|K2qd4~kPqy%c~Fp|ve( z8q?K*;)sNlkYhxucUIH#Z@cB- zU#w(yjuY8z|8Xcc5D$({M0Ci?l{sP7J&**wBul8pP3NR1N3Z3(g$rtW(6^%`;r|P^)C{ zA`!DuC|o&Im@d6jqU8v!JVXP2WnLWw`P`%$t?M-62(6g!pL{&-@?`BGMq&jWsRt55p z>8J5qMz=?lAK1Ve_op$&QnyBm+a{Hg?Yw9q9pWq&utg5y98K$Xmc{S% zt@QT2b-~Sp7|m4I7_Eo^>Vo!U#``y=AH!BPzCmKniWC7%;S-lR&@vsJHR+rqKeF^L z-s!l#!V$^Pe**hri6P;x*B-n+y!8eQyyG0BatTdj$g1qImZvaA<|ui}7;K@#wJYgX zSckp9zE0CJO$1Ts8U>J6i|VFRyL3XHppOUuY~{O~v6r*oQoEQ3LSuh!wAEg;{x!+o zc53;vnw1x5*sSnum7x<~bHiqyF?>eVuKB{GrUM^pWtWmsSEPyW1-lW05jp-vmmtqn zrX?$%Gc7V`TPo2iQmrAE{J&Ar-LTWH88Sx+-^e7(Vh5abRUrq`ph0`zHPM6X5+=;@ zEkrK`JgFGVamBiO(;P|8Ewc%!?l$A1x#}g4q~-lfxJX zICHV35HHn_h~DiZ<`$)3$KVc&O~b4_Vwz)mQ}hzU#l{AktCO%be&|@3+m~Y~ z=wYQ&rnDAyh*f1G=qx;;n;tH-3LFEQacFHNq-$^knvh4`W9o2V=iOOl*ov~mmc@{@ z!gPbrVX<@+%A2kn%1H0j>*rgEjWa&JZhpzq@jq?lSTr28WVV&B{h~aqZV}{Ho1KV5 zu%K4fNRngO@MNATR^eXDx`81@^2k{D{mx+@$Uv41uCXUAx?j>cPt*T+s3_U!1~})b zpPJ6I7pOT`1D&Y~8(C-3SJQ!5%da?0(n>yy^yFowi9xUe+$(_fsda(yHW-zpv`6(p znPBV4I$ZHlMvY2%hYgDQx8JJ}vEDO;5=8(nSqK$ksDf8my1*enqH)%yhrmyl?vdC6%c=XM=^7iuf2BeCn0OmGn5@J>KCrQq>${9~rCh)z z5FZeWMjx+R{MRb>J>v$U?tg6fVB0UXNZ#5#LNxT%JQ8a8iel(1iQs}*GZw?AF5ajt zg(zhh)qR3}W)S!V*R0iLbCrK3B`G_54tbUIts?11 z1I4$5uWINKC0Q*@X(SphE7cr@N&|A;YF7PINZNW$1rA2RB{mt ze>%SFPNCHjo}z^0kFc{a8+Vvx$~%#tr=_@)CE=jU$|^^)3RE)6*AcMWJY*zkG46A< zUNnJS9~SErhlCRZQ4eNVWb?Frx?HXg_@17HFtKT-gb|&}x`ZDfoQ{%Td*OP(#EQF2kO+0^S z;(UtE|T%;3OQVCLh>c8!FY`ifG&)Y@$NAI2D z*g2$`S=%%fI1KOf!PW88lFD0}$VLQnL2%##X+erAN-jwBsip``uB<&zRFN76$h~l0 zU+4CckfXd=tOjLOUd}TLHsz&Sg()KrmrXv{bdWmLa|cvx%z9c57f%5=+@`xtTm*Q( z)kI`UvLSVR1s>riYWSx^OsZg#ysLk!m7TP%Ic5zXbhdV+vAskjQ)tGjq+cfN{qU+2 z%RxoG&D14zE8fX>j>n|-nhu+g-F!mHm0s5)Qtv5tqx^zcEXG-D-N3cdV&*Cz+Q6OH2MDF^ z=-yQP1f{+|Yg6L{FCJUAfoR=Z}{m9>dGwi!QNO{;7w-mU!T$sv#)+D_C*aK#-WV}V>2w(G;KcI!33*m5+ z`pdiDC*FhjQ{NDKYLI%WPflPH{!~#Tv8o99%UPNZ6=?fJeyxe8(%|KQ0 zGcX#wbAKsg=GiM7HR7kbnyq#a)vYj<+0ZGK)3w^{jr zlR^F zB{MBiIBw5D0Xp$lhr|y(X9sQode4QP^XOc;fnP`ilYAL$UF@_~-SCD^nLl60MsFQG2$c> zMl_F@Qd)3V^VnZ-KG%tgbb@ivGb|DAkN#+D{JXH9ql5XIRL-&95fJ6uy>}XdHbJB5 zfqU0K74v^wxPl%TEEEg)8ZMf?;1J!1TJ{Nx*uQU|rYLt`H(vYqk;Xx$o!vQ}+jyem zbyn}NeN8A&ikC22H(k-+b-m!3%T`dN>A0rS9jcvNyqToq`J|j4Z*J>R&`dyi9;ZC) zEuT&l@?F}f(*`upfarJIzLL}LCfkXv?y#2gvITb~U=P6Y#KA?Pt0>j-zhf}UZ+f^h zaXmP#&*$;IaTorWu^Pc<9|yY^es1bql47W)>yz-?o+jHqV7H!j8wuQYHY=YR`F*z& z$n~2FIL_rJS}x!{w7lRP&5hVJ+Wr`wt>e2taM`zBfI7?#th-(;M%iyYNrM4!eJX?@ zb8VEkX0N6xF0#+jDg9#q%Pam3Q9B_wG6>#Ilg??rDRw3C#`+I3yK|AsA%7^(Ud7gS zqLC5kKMjZ{Y;e7j`OOJKA8fm^GM#5$=_Jpy8};z?C9b>eRC&T+}AmFOY}An*1F zmo3UsL0N(XRn(_On*xlnzs6y1tRPhZlsu=ebmW{ngx4gA)~M!fxn{EZiA?5-LI8XQ z%)xX6I;yRrDt!Lmi6VML@dp96s1Qs9kX-swg2Z*hTMMy0i58z&64a0b7cpw173N2h z2;2m4sxzy1@aC-=7}ai1V$P$Nk#cgVj5qA@L%=o_oKV4GnNhH?M{UO>5AlZYZm9lU zM#r{mAN?8X{+D<{409YeOUZ&U!dnpv4Q)E+A2rkDqHVy%BqfG@aN9a&z#zvLbOi6; zwCMPnxjYk|vCvoTP&&T)*Z2~2<9{LWLAoXE%)5&8M+?7TtSL2H@vlm17t5|UyZ#kb z3$OI|G@Op&M#STdAQ-)`7N^WI%IgBpK3`nF*85*X)nOX>9iAi=SNE%5uW4_#m8_a| zp1yE$D++l%l*)rFag8{SzQCn(W05M38z@hQo*pMuOL6|&jENBVH?ik3@*y0!0>akv zU-wC=+DOmS^F8>z&)~LMGHI*TukCl=6wp&NBj6x;KQBm=HWG{Ptt%UwzL?A~6MD}~ z015mKb9zkYubM5vdFJ2i9kkV=Azz2bX|Xx++f+Khzw+g-bZHiCyFGub*HYW(bhWX# zsz2pwtptlTCq&f~hmciE1Dlt*PS-b#coAc?z_6;L=_;J_&EJodyw&8h)W&JEqESo8 zURRgPaxm$>j|+A)lgh!n?*OD6PiXY-ml1SdGv9QgfLq^Q-qzkW_}}vVKKDkol*yKV{6!l9U?uJj4V5}$!AkQD zLkkU;cud<9Wg4i@4qU=#2;VA}ntC3hXy8fbT+(eo!2cABQWAqOP zX+s$iyn+2+3RDmKz^)j5_B0#zH(T;;BS|Bp{RRA2h?FM;=iPEBjd6tndAWJ$H2#G+ zzqq5^6CCT*-q!ecApXzhGUCG|Pk(oz`9JS@6H&;tw2MGO!!;z-dS2q7yeQL!w=k2K zl=ggcq}l?QS#B{#K~lJl98{4^baN^);bE~H3@FZHh@^-EZ;>#^2MK^TAAp~ms!CES zgQPT_amZ4x>2!|N-{P&pO$K;u^s43NIo2=FAXMymFCbwE~t5gh4&iB7hZac zct`-zz~3r?dkN>ppC=0(Xuz>6iEpoag15r`mF_ENImat0xCk{{E!e*TGjRrUji9m2 zV9PhW1WFlc$IfpG3UT<&BVI_Iv(SjsZmjj=ojYS9e+Z9JiP56XG&n6n-Ila?mXWs@ zQz@W18>^qh@4+u(Ri>l8ns*!uK_5d%>OJKk`k~&WnA6rtVvoYW#da~iETh2XxQ+qF z`#8CCRC1AA*Lw-8VGY+BjQ>J}UYNcS^SDh{nJ`17&4#WC`&x|7=DqxpWH}!4H5|Ov z`nZ6@MJ9C_e8*;}BSx#=bRF|%@jZ;jX3+X3d^G+VPC4>eoiF@j4p7Yab`c2Zd5F=% z`)-)=M$GYW>n%@D&TPOEIMMJC6Z7h9YV`4I|M0`s;jeFp^XMH|wb*|cluZ-ppXpE) zK4obL*{<(Qi&wm8(|ysjx0m|UC9S6OPqV3X96tZq!yA{krjYZ$Axf|jtIcH;jmhUv zGS~oKs#-G6ME5K=7MI<*xIQ#L{-?`)mPzmF;(7L`Uf=7M;)%W4zJGfSf8eWEtrPfC z529RDVEP`M1!=bo%G(Y8Hw!p;uaA8@=-9gkQI}n7;neZp{Wg~m>~cHJDbDNIb<_kt zV<#X-gd5>~PBtF?n=+T*g3rt7yP3#mGPt{Fg0rmYJ~;3-D&&Hc&(8>4OvzbyUr*6_?vW}#`Nzrd6b*pPUw9wMv_-KqAcv@Y2|B0^5bP)$ZsCK5H;dlPANgzH z;v^Cdwjyfl5BChz;xCp=%Z6Zz5|zIkKJwjP!l_Ut?8ex4eH)FF|I5!KhS(Ct?fA5s zPdahRZUd+n2NQ7{rM0jBbbA5>n~TcYMxtsRbj=S^hcqjM+p{R>L7w91M?_eZih;qJ z?AYdJ`#Q||&1CqhL)_x^=f7KixX_tb#O`sG;tp;JUa?A&6c>k*eX(V4`6`Z;ly%Np zpnrpMVG5bNqnomLMaZ`ltg0ZH(fF2xbQeWhQj-6(JpPHG6iQRV``!c#b={2@A=g z(NMsjYGFjj80QrcwwQ>Fo4Dc^g=4Z3u84qSe}u0+nsXdWsoF`R^F$b|amIPixJN?f zS%7g=*6m=xa=2hR2#k2(-@n2JYk)r;@ckAJ7}BvlYkiG5gHqi4Kj6-lP3t;M6eJD% zl}R~UY_Ot+82hbJ_1%u}wl2dMER`!s&ej{YPxYJ^0^pEghAbI5s})H3KdwmQJ6fwo zI^9p+uLJsoE8-6Kcfnmv=+BU(>$#Y^fBOB1`A$abhNe*wDUj z^|-8@;#Qy6W&FsAdx9OUNEht(v%dAb-_52mYW>AmMd{G#r!RRSRG#lYa*vcp&k#0d z@NzL3EGO_j8qXIq&=t&+9ncHq!hH{vCXa_Ljva_~m1TYwX+n@%nq1VQXr33_1=95K|m! zxxz8E{^j7Ftg`SN$FOxxq%W|DB~&m`QV2TiL_Kr#J0?t0R1{}`kpfPKPL;EpY9W>E6SOle=%t+%ZJ`j2$dqV@7xED9Rx^^7?)Fp>NowRT9??Kp#6F3E?r)F z#^Y<0QY!N{z(Xt3{^(EJHRTxl+)o(XxQ{*0?u^;f&zEY;fqf)yO+)9?)bE$S{;Dno z4_aVJ=lYKgAd<4&o{%dGbOEhpqOSSfc&vU39c7g+Jxv=c#}YhSdV1=R*!k=pI0qsG zHXr;u)5xiEbvH_2KYh_mVZ=(LY3)P%+kPytFP>cERn>@lEIN z$U!rR-DD&u*apaCVc1jA;|jQCmtrv_`39+mHfQq`BaiwV@Czd(gqG5D4@+liH#>Sa zUbjUl&I`&>dKp`)4yq|5dDJ$a7wiE4j5=)vFY#}4&b7-2xlK@K4{ zexTkLtLHy-sLKm_o25q8=Qy63BC%}+LHk13Ayj`t{&8z+N1zYn9v8|kokBag@e;j& zgS8PBnknc|$bju9^%ghpW)v7yOgIqQNf$|wd_S@wDLRy#3k30$cavQX7syN&9eU*G zqP6tJ=4<5v-X7gJ+EXXmhIebFvvX9@g89KJs1S#BtXWTxs*+{L63et^isX#8&($c%&nUVObDKDafaQ-6C=6Jsz(LWyJgzD5ej!%XL04U> z2n_kUK%yP~_Vf44mqYK6JmGb(;<1p7-N5yBZBv(~r+%R5?OC%H`X785BV;shDXA%r zxYv}qb}xjMMwRuigbl?x)tx4Hhkc8v8*FVpsQ8C+FgSAlNN0B_@usmZWdBC~`kv`Q z5_R~Un@wwv+EFe z{a(Lfj*Z%OrbkC-V|&&Nd(1B6k3V;VX9E?uRpLJmADKfKnQ!1Vq$i2iW_|bXHrz+c z)O5HXrn+bT{;FzD|L3NEs~Bu_L_9kWbDzL>M=_{)5 z>2z_{zvl4pZN93NrRZ-1_&~JH<+eS~@Or+L8BR_2@w|n*9PDD}lJhlExBuv6Q2K%W zOMX?3*(SDYJi+IQ4-Cu#_%$(aG>9U9byCl0AQ9Y{KFez(=3GucyG!gpJwK|YWzY1I zjgW%YO|*EYR%T!`ByzMM!kGQMijndu2a!NIqe4Gug`Y0Hr0}oGQ=?#tBo&g7HPObp z2OyyvHkd@@uAmzf)=0Gv@2XCu{Dwp3c|Lf~8YK${-p@+*W<^56+naJD+V~$5%tekI zDEVq-QORF=?4(To-$;7S;O6ZNeNsb(NLF)B@CVl=1}~~gdbdOK^L5?N%;>BI2pRe` z&iy-hh(8Wi^C6T;xj!S+pW=rwfFe}b* zck8ZznvR&7K&iQb9TTz3!Ob{{ksa0d3zdO@x2uIAZ1(;>{RF@L-u7uymxFS+p)n)7 zputdB4GgE-A)45OaZ=uwM)|5@vx3%(wzb1Tme)=ihtBI%M4f+2@-ZaiX{r3rOw#tY z2G3h}+LDHYIsHC+C;hyo!ZDQKgG(Q_lrQ(T(RL?uHK#4(+v|h-ajtNk$hZQp&1IaC z?+;V=>%F(DoswP&Z_H_oFBR=>eJ~xfIVx+7c+ zaToHA!(iG=$y=yrx)G%X7=fSmh! zwU#1T$6e3!k`=Aim;)fsExY&>@Pg5Mut z`!dSg)@62gk*XD6TS3fz{yHudVDa!cI!eAk`f;^d)Qq6D$>P}3=XwI16d$y1V6%_w z-}{N1>+wDjI+a$YA2@vQf>f3F%)6g;N|VQ8VdniZp{J=aUIy)4BJmb@6@31mu~=-G z&7J#{WvXyj%j~I^vhZp1)9qpYxueUcI5R=dkAst#D!qCm@3Zl+@Q~;9A$rAf=54zv z%dbYy;LXn5FS2+Z0wzMvvP~C)fPbNAvGsqEm2?&YYo^xOK!P&u=&oq0zayMALi~~=05LuzYeI$ zPwi~?mHJ@VPI%w<`MZ2Z=YHvHGn+9=5cb(*Tx#C=YdzXsjw{6Kce7>^aj;n*$4M>l zvG`>ejVJpRM`%sfd*5M(1)pSudET*`2Xl8Qx)8i}F&G1{^t^o)_uxnTDyzdq4UG_t z6{)X(?{;i)Tl{}10{>~;KKX;YTu5WA7vqG}tb+G=hV|Bhj-8#P5%%W=Q!kC zNQaMCQ>*1T#7el;u}Xpwy1q;A=2Vo3wW%2i{nHfn)xZN(zUs8UvcW`lSp}{XaZ_6R zcu81dVRz_`@QY<FHf;P(+%pWoxMP0euG%!nwtm)416pL=*R%QCnG2*@l_D%k9Nu zpdW&z=DH^S7m<6wS(Q%;n_f$nk*X>?XPL8!xwtH!9BFUb@j!b5i00N7+ElrHLX z%um6J|I;}i$Yp|Q_hu(}+mo0aT|sv2Yo*xKCZLK<_lHi+w!i9jMRGpBljcet?JQy2 zt5u`4JYPT|uXM%daa-!15ila)I_!!D$x&H`;3Qd5>ouwra`Q|JPxnG3e9?nx14H))+4v3ORPThR zs813D^d0DOtlUyhl{W~|Rh=$;pfN{LS|({X(ehByze30ZYZHlR`d~1pR4c%J6?{h9 z7qkoMk&CHQ5`2L*ZmZ@kkxL|XAY60G4MZJ!|3wAlg zfn|hzP7POjK$gCtGQ;xb$y|?}Ps+(64H&4MP48riA`nW!j(&wN1GQKdloG^=jgy$z zeP`|h*2p1|7w9j&rDa&Mgx3&gvFcCqhzUZK2ce|vaL272p3iR*GF->?4vC%U!Mj#a zVh%!qgV-A-QC9uw#`Y-w$jXKE-;LvL1&N_ZPl9j&3z z0UI{SaU(o&rblQLN{9u$j6-eDs*U$%&(w7!Q?bJmL2@|CdS&70qwVJrUlaT(4Fr+r z;(48J8Rr(G<`#YEMma5Nn(jj}KsdSzA%xN(bneR9AgOe7{_sHlu0n=~G!-jX1w*I! zy0NycV4Qfiv!XX`j2ovoJNdi#YXj`CGKHP*L_;5Y7c}P=x{te_)8A}csJPhUkIQ6- zbgNMJKzpppE^i@UBIJ|@sh=Z^<8cx_HTe5I{=tO&1Rw_9!u>)*m}lf&UCQ{u7?ATX zg6P3PRGty+a`Z_ed>#$xvDQ&$dY&siuH`fSI_-E5K_x$=aq3g!(9W>Gq56kaOqop3{7Y`x}AW$7{uZcXUM<09-NgX3JJ?K~;^w9B%k z5bDsQ{18ZLWY8U}MXvRN-bl~zGtxzxf)02%Qd`^U7`biu^EM_- zJm=fd%T%)Etib0gGFuy5#-FxtCaPr7p$i@^gYqLANx)WjJnU8_{IAv4r zf>=f4aS@z(4vG_YSqj#0ZmM_Lf}_gS%N_`oO>wq(?aiqy7?vP1L>{8m9*{J|I^(Gz z3%JcP|PMgpWLsmi~7DLqb)2XATl$|;*yfI6*{AH|_Opl!>XaYAVKc%~EAgod2 zYno8R9_wx=C;SckVGRPAH>E_R`6U?}>Q7G}5OOZX2qX*I*a5zL^+)^zWI&!$yR{#j z+#O=bq3LtB2-y-SH4^0Ab3@P*3s8FieWr+ubD@#}jfiH5Z5SkYr6$9tFPi zy0#Vj?5Unh}1wuHwb=q7)r&ADGt|kXIJ8hFh4kH^N@fO82$W3d#K+ zH0Buv*st?VOdJfg+umz>VylUx{AS3|wK7Cg8FK80)p9svhJsQYl=}NA6zoy>kBE&p zD8`SIXIeVEQza{l#+#dWsd?H-V1l|RQ-yEysqVHwXo&mT^&3%o?-W5?LlbO>0$P(Q z!%u0haw{UL#?>RtYN2_sKOQa#rq$b5*h|a#M{}{64SbsM$w^WxrqIm>0>oL`IlD_@ zU0LC~HG-k4eU!OLR9=QLM^%|2abUE_oG@8`Zb!u+XF) zf0i}#d2&v=@6j8k~||3k|9#I!blwLOg8HllKqVa_y!iu zFqMFzhFf2jaN-CzL~oF|B$(*VTMLXyQkT}8%S048QP5}6LF;}1lOF&!t%Ssy=KZ{2 zRq8Zqj}!YU>vvSxRuv`2F{wXxrUwicG#~)dvE; z)>MWSlqGW+>+2Sn7R|)(VsljWQuK||LpxQ66=;SpuSI3?uLurT_6CuM@fW4(aru4; zYk;wkHe7DSP;vXkU5*T~eLmLXj1HqsoM?+ju)Nj?A~+|v6Yqi4;x7pc&+_e2T!Xi2 z`}VD|F-s2Q*I@dvhwky^1vH5fR${Wj{fn?+%|dS$kVPo51^*{$O{vR}PykiKW@3+1 zQg;?*kr4(m`g zU5z}~yZPtUB@@wqNho5V83(7lm|Fw5(>d9X=wgfM`QC^=t1I#f#Ha3}@XDBNNkw%B zGMGo8Y1)99a(WgEa!Q@^JG8e?Y@{v5-a$~bgW!zGE!+tBS{*!g?g9Vz(0vSj~I&6TcMnL{X zI&#~E;`|Hx8%+dg=248j-OAQ40Tx7R@+nR6Yw3rWlLidbcF-3=I;jwlgRIF~HGNV8 z7JV>9d0@v%zyq4_px=4;^)$qe@GlGc`ZF8&awD5lMj&ro!DcySg(nUdyVY)i5 zvIzdggK2PJOa!_h?vf449{g}HGRZo4Lel{~!E0fz_#R6=-TbW;V-4(d1U6?%)pECa zabhWTBI>DAogoO|bu}{c^@n(VwUz5kSP}B$bu17gDoR=@)thgYi|99O=OK=U`J8bj3>@Af&=UUo1~D>jC*|O*_#p(Tqd&an>x=w7xl_NIflf9N3$d|I zmO`RwF47djWozuzPgIJ{eW?s5bHr|%+1Q{r)DvVbb4R1lM%5lcoP)aC_pRF#=BWZe zi~8qnTgDuvu!a(tf}!d!PElC^3M!3J;7_6>d#wT1#8mQ9!os(@AlPUZ{ftrFlmVg4 z?@LjTnO(YM%(XE|sZBZMb%X6pt#_FsPksKWr1qM)P+_yNod00sLt86FTpP-+esRa; zt-sRq#;ea$eGCmj2JSgiR&vpZg0-&S)FY4TE*n_<8i!Qo`$7;z!Ra1&7JMEOKjec` zU|h$3vHD(xb!agcXFmBRcf;-}TS-L9O043-P=NtlMzS^Y@YAnEcMaz-HgpNzu=Pvd zJngfe_FJc@065eO<-ZDyL|pW_53;y@@E35dXNSAk>1}NuPrLAZ(41tQX8|*OEw*!n zvX^_2&*4Q^zY;hqlD{05EZ)b^ilo9)R;z#cs7`NtP50llNriuy@j{wD)253z6mQ}F z!6PzH2!$|v%A+O=+9XLLm?KGaeE4#%^cM%qwfRH<#e`j9^p z3!f5wFb5^-l1|+;rsWP~;1n2%p07wYw?Qtfh~``pzo;fR86XSyCQ-RAErB$yj})^w zip&u87XxJcxYJ8h7eo>^#zpVNFF0(9&}?fkH?Cv^OZfFBjAV`wC;GI%0_=6H@nBtzFw;v;|KFgbwQfg5&J>a7qa z#-NX+vLiO&XsfPBOY=57;QDXctTrf4A4Ar8v!0bPKQ%-qToNo-)e%xne%L}O7U{Kg z@>_Zz(ncDRviSyF*8sZ2fj4>drr@+kcYiQiNN}fzX3-a3)lubKPt5U~d7Oki7^VW= zh@*zGiB@{Jd+hGRH)GhO4v7)waBAM-CqEsA^m7(jG#$yMMQ`P}SncVVc)TPH{%;l_ zz+KYAuNowaqR*))()pQMs*6NTqOa{q!~P3;*1U!K<7*Kh9ZY~Wcc`_D^hFr5TwvYD zb0dPWGW(AeYp00k5BY5G5v_IMhQHC*|NgDVgBlklP*6pglKzaHYkku4FNJ9Ll^*7Q zCzmbDl;Dg*WqG7YNKBljlO}Tu&PRp(NTmkyG6~xb?;^)=S&nFY+QQ)H(f$pf)FDXD zRqtu~3MRg)^~_zw;<2OvL^1cVTc&1y`-YXE>xiXjF8omRVDc|Y+-JX0$h9A^|LU`; z0CCwCl>ZeI6s!{SAY9LALB3{DlnL$wsPK6spdyW&oDSF-xsxILE?PR4xWi6fARRz> z3LM1o-{oeG&me|-1Ycj7s|d@!KlKULPdO1bJ<^CqCgJPYw%VTSMYfIH9pAAcD`yTy za--)BMui9vLhPYL)zVJU`AD43$)r30s+Olk&=S6^27@6dAOM>mg{>!Ve+6IL`IKh^E}pZP8knW{T> z5i>;!GL@a=f1}g{-CIFW%@GYG?2(Wjx#o_CR!7;k>zt{oBwZ}nT)HwPhG#GQ>0EG)b zqG<;7zVK1oA?9KSwFS3vH@&!hiDIw{N-qdFu9HbJ)5c4Zv{z38K@uis8Gd3 zeg+Ci*^AQ9Ix#r26Lf=3=;fW9F$|$lk*bRa%L+*EweAhgv^2JHlv26{j47Pmc^Kp8 zCXs$0-Ft4s;btc4`1FB%fYHGU(%)+7yI_Z*yvi60Su3X6?0zRFHGxY)1&g?OYxtk8 zQTlyG=Rt@!VEz?UGLFbzv>>%Jw@vvisJyQ8j8B$snCj3O+_iJvC1mf?QyM+Q&hJGM z$R{6f60T0VFL}_~N}69fOE6PJLp9O`hr-zy#ae9nGUR^XNL`g+G^!loTea_=Q4-Zb zW+#I~9ONWx_LA>9k~L2s<2O`?*a0!bg^s_`RwlD-=@z{sI{e9f($-R>ix^pAz9_|Q zq=&!)8RARKwuZDBV|}?S2%_`9i90(txA$ZS|LGfjRyxmX(3DTf3-*HggCFM4Y9FP! z5Ok5d4vgG_FRX#umJ)#S$`LZdHh?k#cbw|#1oa3nRo~C`Xqj_A<3}+`v0DNp>;#TmM!>v0 zbmN9!Tt<#@8GXI@8{)n@&_#}?m2MCJ;cuot*fQ48`(KNbIN`t;eiV8-gA1{l6{@=B zSF+^#G8)l_2O?TE&>jt`v4H{`rCbvZIy#a-y`*!^q^`t_dLkVjjC;MsNE1$8DN~*) zM>~#L{~;awZh$j_>f$ImXn~pl8JFnGeEkVKrfBTp@=&bRw4-F<2LG*BZQJ4m-<(?V z_c9$tNjC+_GZPVTP(cR&A#|itts0Fej}#@iZs;E&4H1=%4&p}R-vOzn$&&72hGHuk z^doyruW`I&Y>oZmkPorRha00%e@)`{r0JegQA;`>@G1aix#cy(@6|1OzTbiK$rjHH zOVZk^V=B9fuAku6AuU>=BzA%te(IKvkb8g>P!3sVcm0uIV`O!+=Z;p=v64__WK|Q+ z!tIrJL<06=E#-5$xsX`+M?_5ZE@uf$^T@TG$WDb+=FM6OT2)Ghou=ejVk|#OO;)Nm zLQ}}}pSAljtf|##!0J1dMX5P;!h6Ots3FTSVDudi>PT5bX!BU&4N0UW8G-yK635SR z2OMcNVE5n~pJt?2L<0_j_{VQWOi9Fj8NA!5I`7{5K=>hm(qA)u0iK z+Qw7FuV;GjSH6}ct9libTWcEO;B|)ab3=MthsCOIg*`>-HacE@dDN}RNWKXFEP%|f z*onz34_0m2naH-?YZY1DCUOo3e;f+8Z|i?g0l@^U+=V<>r@|j}q#RH_Jm7aM3SbiB z1W-DJ;*T4YO1-=f5Wx%+hg8vgdJaz zY59X_I5JJFwuX|YnQq(_J6_XSwDI?nHf^dS**U?i$mP^+Dq+u}n&!Q^;vgYmJMn@^ zjM^04Pq$p+pay1a!*(Am)m^zhk(+he0;+nz`YR48(-|WNhIB!04Q0ojJf(D}oG&aJ zPJ<&^P=gB2AeghTi$A2gksqw3;#-v1Nl9l503ya&gTB|I9sfbkl)mmq7$(qoGHnvkSCMQAizS=~9eKexeffCVO{?#XNC~*%I z2t@1#SiK&GUFJohz zxHKxU{k$x=rZ+fZvhL=lkmrI+H5mpqF(x{Y`PAQWa7$04Zuo;nbi#AS|BD+hJ=r6_ z&;SlLvgL@ZH(OLeefTZokC0ByrY;yC2br)c6}_rJ zwG9+>4l`F<=XrJYu_GEp1li)>2dk5mOpiE5A?wGCdGl(`y5OLEq3AO?wuG~+-By-Z zFJVIpX2+s{ya}hke)Ig{mvrYHii%p2x)0*~F#pnC3QVTL*-Ff8Fv)EI|EMQ;JkF67 ze52f>dj{Bl(9-GHi`p0uQCAGB15N22N<*9U)XyzcjQLdqu?KLcZORdXJBoNEVVf zn~5e6aVuJ7i`6p%&|O&`lM!256vHL?;v=umj- z*|w3(t5M*G@O09EL41nl!-9z=Bthfu5N!dAVJ+Hf(R+_NNQuB|^q)VXb7oYMwxJIx z+Ly^}3tzzGP44QlKfg>nC8RqK$&p@8{bEcOBuajnl46zU?tW3!V11Hr{9PKUoi_2! z3QC8evJ{|k6@9Qk_DdzWbP_G;HYXv=LR1n7s2#ClW6jq7)paF8)Nt9#9OV`VdZ!~C zbMuauO;?DhU7p}3vx$^v>fBuMHq25+9aTY3BiE7q>AU;UH3krg5v+x5Az0-~QbC=> zAu|}1I8@okw`wx-fqnS?U2GY}mZPV{>M462n3}aG0FFI|cfw9CTsTEf=X4{0>B)jD z)n`F2Xwy|(N+x-Poo^3HXQ1+)u`M8rgrv{=I8qJbNPl7saU7u!zVMQHF{w>+0XyYr z&P)z!D9`jVj)ES>TA4j7Jo-uv4qB;b4@y=>F>X3uCVUsYkO~_uRjl&}pF}O2;&&fN zSi-rSK~a4$Eg?D0-iZ7;#v!IZfU``6lCMo(wKb-U;%2o%9#)mP{Q2Mbf`?fO+5mU zuR_aoT<6p+{?;>hl0g$G$I773d=-o~JJZ-BerxORg9f}SK57CnKav=wr)2~mzXsOL zm;d@3RW`WAg%aqS85@}oFLK97HlTK%&L?tTal}4c{noQsAR7*IDp^J0;zN3(XG) z$6`jrk|UOISBcf7xMMf)oT!#;k%Hn!%LsF5R893KSf(Ad3Y0e#|J8nTUmn@kGU??@ z_$O0)xPR{3? zd+uH9{SV&xX{M*w?%v&1wX3UYKhG2!=qfSJ(d|X7SWrm(Lro-qsGR+RmrjC_4Jjw@CA z5)SM2Povym1VDz40)eEN#+HCIlDvCKdm~S_j=@2qy@&-`JTR>cgqF%L?3h(VOsV`^ zC45V=V6k@YNmaN=mWr%|IjVEDW}V9z^=}*(*O^->bFu#rA9bhNP>G;ynZ1vm@V6rF zlNb@y>9?`FCZyw35ig*ny? za({4@3IVb*3*z-^B$nG_A@Za^CSEylbrl1t0HyRd7~TEuvr&A=AW(tPHr@aSTL?L} z)CR->ekA!saSMa8LQ5D3rREMz*f_HyJoieg@7#S7wXyn{yC;xA>yiO-IiQTk5{YI~ z0`q4iI0zsIJV0H#bI&e7t34%sN;scJ*aKQf45FwuOx!cb zd(yvo z47rpuOFD885(ESa=@#y`U7vR0r;7|IPW;UYAKUh4%cZQ#l@r^ux>X{;%YEQKhDGE_ z2Ahk}6PAHy6CzcAerIGXj~(7qS!3NI)XgzcsI#akNAxYe}iY&u!O_lb@YC%OTl9~@| z^~U%1Wl5uE+TrKDcp_AlaCzia3v)R$YwQ^8!Gu!q5=j+E-3SI6#pIJ>pPOZevGK3D z>wnZ%I*zf{FsUDp~OL<_a+Srt6Jcy$8OgaE!hbc)zT`sCRFu#xGOq@b8;-W!YqG1Yh~D z7j?c-^u=ipXAFK}dNqv6=!`j}E|MoHR;q$V#UPO~1a5w_P1bgZ*CF&Re}}W}&e)xF zcVq}~jX24g^|MXc=ZQOp+2t|n%NzjSdVZxc>9^QVe?OP`up-t2kCtDt9KUn;l%i z0<~Ud1lU@rT%48r96W*tI_L=fQCbK)_Rs$zJwm(b=ZZ`^iRSY~D>t88#a8dLD}0DJ z_}7uNdZe_+q+4|pR%a<14Q$&&V|iJ2?%egtnw;jmFVd&Di$lB?dPzS(oeKs03H?Kx zpro`B$(xW@)MxvCO?w<C&qHuJ(R-7JRw&|Epz>kT8^>V5jSyE!_+95%yZ8Q787c zeJiRJm$;ppYO=_c8Dx;KM95h~PtRKT5~nGn9USXMfELSgBpV7Co{8*+oAW1EvP5}D zvUr`-uL~jkz#v-mp*b0KwH#{LIHh{DW$|-3WU6Lqek#lHL>PuSIgI{4l*ldP6m9l#W3IAkOyaR~S^_0$75~(&h9nJW`P|!43^@G3!bT;AUJT>a>_Su~ zIqyYl#gYn;hpw|(6_&@W!S*$mZtNvB$sKFv+M>PW zJ+!M%DsB2%Oo@(kradS9mi5_ntLKIgJr@BciFe<`*moGuPSIH!BZI}#T)tRaTy(eu zpCMiJ7mcOcb|6=7c$~LT8~r6%hyAP)@AC@*E7h|ho%iPpGxi{<`i8WvM2I3rE)~gg zQorF{d=?er&|Kc9l`mHO8%90JHliqj?Lo6!<+uU%Ulnol#~@>P z6>-UDrDp8p7A`gn(9)^*ASSS(Ytrl4D%3v_Ukh zM+=y#C`%esd)t~Ae-}gWn^$qBD7t%hzV<;j+#N)E$^!Sz%}0>EK^tO?7}-R0?1{)8zL@C& z^OPdz@Z1n&oPX(sTAT`=^H($X0*5@DD z1yfU<_dEK0zU^(Fhnt??Pu*PRjHfK?n$EmnH1eHmxj(H`tRc{5p`W5SG-jIWT>yqxYrWLzxd{uj}2pBf8kiSYNNcBt9jox&W?tG zv9>bIn7PN1=w$R8yda6vx_F2--NI6DoVuAqMNG_^ejTEF*e7jOqj!yiebuo_bLl7S z>fl)iR6%n7dN>5yWXx_0fo=R!Y+b4F0-*;?$P(tx=c2}jSuM6FLHRW{M+!?T63h4R zX$O_9{SLj{5NL>JM&zt$(4N&v`lk`-R40y=n!Rc2F%wIA2kn*d9-?MoN3AI<2cKWk z24eg8n=NMVVgGPfv(lJ2U=i zB${aGoe3&phLAvq4eR_P`_vBKC{7syWXy*K5l4tVt&l%p)=j|IZ_RJpno+rYvp8Lk zQS#|IMLl_5GqcE=9{UFMo>~U_{(lr$d-fIQw|*yQ`q|fgfj83O3)!_FYW(sR+V!cC zABAR60mzD9LjWSmh8LO0Xjn)M9H3Qn_otZLsk`?vm!@P$*uKjWxnWCiB7h~ebTzFu znYv$n!T#E)lux#Pi4^8gfi*ufkYho&NMfGHVw)o!;<4k-pmsqqtPgLs>noX#b7^B`Y(Zdnw=yM- z7z1XttNrS<$TT>Hy6&Snn*RsQExNJ`3ZvSfra zI~rGD8p0&f=E2YKGwr&-^sC(YDnB&T#h7SrrsgIO|+B5wj|RDXI8B^Lw`Rw7nL@%mNEDotw;2)UH|4cQG~OCikgp?R0L zLnHIt%ghOUzqOwinfeq|fbUe_b@VO~?y26k%2++Hhm+HmS6Grrx~U>M)k%sm1SGiR zGs3`$lS4SpKv*N>gqr5m;;S-B4*}mQ>g-Odg46o+wOcSo$n#zE&01V0*PYjKH|Sjz zx&F#(BoIjVco{4N@h_+!SSb5elHyO8)hJ*0S$xut5VPwVc)ur=`~>8!WI)A|t-=GHo1>EgEh&?Ko=s2GvUXZpgrn5q~cest7 z*jjA>q6M5co;p@N|Aml2Lu2l4SOJ4yVy0_T?;O%C~WOx%^r)IavEa(m&{T0SeoQWjwZ?__c^3)pG}o5BmI zBfNgWK1*I&*fvMH^rvB2aZf0TsD|J7*kCYV{pz zi=y!sX+g7lIq<(56jdVz&x#+)n$jfaU4s(1Xqt%d%*;`tU!BYjWI^m*C2pQOD67_u z;?0{&ojqVn=7=WWtly;BKzNRg%y*FYu5>TfjPv~`6ZHDIt941-k{k=y;BoH+x$9)u z`3dC(reIbHyFLvSwUC-Gic40q<-VrB-HU+nPMHABXA8Z708Z>Ma{*gUuJ9$yk!Km7 zW*x3@h`M)K5gvUkEyKHw=+u2&1hN7$O7GNo1`ttb1 z)_S?ldU4%()i_xP75^8@zhV$yFXPeGROQ94&{q`6$26Qp)d8z#N3up1-`jZlL*(Td z@fjn*c)$BeCg)GB55pG!kdT_|DD^)ZtqGOa%nFQ;`&f z!ktmI$qjB}jHgMPGD}1$I_EZl@yYOXk3YzDa@0|IfFYlBSqLXq-!(3}iHOct2HzT% z`5Q|QzKh>r1q4!^mS>vA7?#x1Qdyox*_Ljx-Jwr0XfB$Yho5MBX2YL+!OVGU6(X~Q zOU_~GNp}r$1Rl!{A;k(vp2PQ%2tksa3__LuZpVn70t|3ap-)~F5AsRHn z6S~2y+tXNvxzI;ZB;fFFWW@QGBsz5@;k7q+twn(!zHM~YiEjZ`LF@dCZ`;waGe@ED zpICsKWp`W_^exSwj*W!BG7b}?PvzAgoc%{;)zsXsu^B?dHC(qACtl<6)^Ag~Sp0~d zq&T+;hiG{@@lsO;q1jDm91ET52rEIuN716&pD1*fda~Dlat5-CpaJ^_IA_6bB3z1` z))|(d#Fa+EH=!ED(|h3s!6W)b!t&2I5@Mjx1D=D+A%Yc!MoMku2!qCrz%E zJu44N`1OXX&om*ck1tSV%L2X{)i*byI3Lc{6!F3^bGQ^Khhs(?qz%% zA+!3q$v}XJf&-gIOjB&-q&=8 zwo6x8#k4ACZ(fRWi{8{gzx?Oi{;yyg2(;~At_Lpb>n1$If4=`uBM8zhOKc-y_}_j0 z+wMyIpAsuj#O}WrX-D~Y!Oj1@_y+91Ax!`8buJ+P9pV4K<351@yDIm;!~H!fy@0u? zQvFrV{|*Q0um$k>cjEv5v|kDe|NmjyQy3ezOV0zVUGE2K)m88P`04M4H@12j7WhUW z{?y6L=iB$8tTsaCU(w32r|f@vFNu2g$F)HK;jK>iR_m=;sH~o-A|lZcT2tkw(YhTQ zs?{oHlDS0v*(x;*9?>WiBnIV=mW}QWHHsIyk3?E_xmX}AcC*aIg)TuS>4innD)jrd zk#D*uwIMciwFmiW*~6$L_*8&(P9!VS%3I|4B2hC?k*aRR(jjK zqCEd+nS$#Je681ty}ze+)3?4(?2=5uR+sE`=Qofof5~){D|cZ6!JrwRG;wXL{ormC z1jrt)x4GzZK6Yx$1%1Y>pEp=|zF)QNdfEpa#Gg#iz+8^C#ebi13(&cLncF!V*LJ@@ zZk$!%!vT4brjr#!Aa=qz!<+qa+oVfL(zebHkNdNF!VW2L+s?+PaUc+rZW?%@5D0lR zU#_tw3|bL%gv6yfW7#d?4cDDJhIFon^ZEK;B&+io4xY=tBp%U795EeIL3l&;vq*QB z8-vMsuHKx+?+#BNZZ-=KUN58GFK4!18nny>bB+FyaZB~r+8wgW0M+kbr&*5IgASb~ z^CRQVt=?h)_-&R3@5oIVD?ku*Q^|1v{w_WnnJ7E}3_Ktr?6F?^Bl`Y>I2h@D=EKJY z9|6(r?hXjT7e4QNAqwR4N8-c7yt;7ddO2&V)OKEPnY>RK?R+0tm3X&*5V&7*JIEyM zje-f>c{{W9)|Sh0IbSWGbY5Cwh+74n2wPH+&T0pV+^8DJdrqpm-rF|cn_Q}i_%3eG zUp@%*oXv(d$i)PVE@E?Gu20#;kgYBrXRtSdM75>@FXDfXF_;zA5j&L3#&4 z5bSbhzB}@^g)o}o`#MFEcZw0S_GohWctV)anhr|8#h@XLqwsDfZI~K%C zyQK8@$_(l6{f!bRm0_~zcaxDIqt%5%z?(_kts$&6tJytLmYI#G#>68bs{eiEgW{x3OWvX|r=-HTT;26u!Vv58=R;c?buD!fi@>O_Qc_*+ zkywB4OUN4PYvs?6ndaO(FzP9H9|vw;XlfgW4;9t(rHIFo5jJ|4wPw3nH+8sT${sTw z)+(dG&n6=@M`YU`g%nyv$fQj?tSf_@nxveme4OT-&lf3Qi1MgPnfq%d6O_C3PXd;V zMo@R;a1B(cGpzSNkv66BO`HTUr}FjL5b{)ExGnjyC07I9IZ9jd&=IZY;MgtxnR?Zj zC`uaSRHN?BLY@SoteY`ImFbM~VThw6L?q7J)2yTqCv?GnjkozNXwn#F0>60(GW{?b zH@fEh`21LlldMPDeraZ7iNZ}E1e7e(h!0awqw9sd>T)&5arV}y65A&(ANbQ`)2DK- zyt+AWj}*(P!&fIt4NEDTmXEqC-{?l{k0ylyhu260OsPudf;tskvnqvlcuAdc#R719 zJHJ_FqPC3@ZW|FUFNE^jA4R^-j&jE1l{Kh8rFc%4aJc{LHZ-_ONn2ON_J66OqT^|) z+>D|*V)Byt4n%Q6G;&w=ycdQF|D!0>AVry&xA{;(Jck?k@pLNAqqo-(jqX2&s35(n zG;6xVj~O*iN*aI~b;J{RcrDU^i8@hqfT@t0T4lzmNtux}mLE|xDyb}67A58AMx#>e zxXi+6jKt!UXFP~%iYwN~Y&gWs7qkO6%>Y!#m&;t*8~$8P9;Mk?ck;v)l}*8+EE63j z`s>>q#T1s#EQPSFTOiNx%FJy4Vkj6G^>5!Td9ewhfkfg+}>frzRR50887dAm5Oskn*lN_lmVar5f}UbcQN9ny}>t zn0Dl0AM=r0PSw>-i94$Ifr}sLy}#}$=b>%4D|MxO66Yc|_=c}VS?460!mBJqCRc=1 zeMi2N!-cCWQKlnx{OeY4IZ`{BihDQOt{`; z4=b?>MG>|rAJq)cO!a5!mM_{plRT^z$}fn&+MKWYtE%WFd8PCrXKdbo6LSNExQ}lz z>m4SD=sz3TU9_;Y7xXLOsIMPH$7e0%XHvE0-_KD9*WG(_L zj|rfJ-kEn>a=oMLzJvM=-cN53di>=8(f{mj*8*?z|*5E|k?*!X2jqZTn}Q zNjpj$`_NH3I=XS!T@h7L4HpUdl}0-Hi-QBH9CJ7Xgt~;qpEo&>v&wMn$bZ-0@1)o8 zW2OLPU;jsAEn2-xGu=@}Ff&`M_WBR=1#QI^9S}(GH9w0F+f6@YO1%2Qb9?I~gfa^KXsV?qV!{`=)h8FhUhrWz#yNL(p7SHnM9;Hf1y=mVvjv zC=WZJtQ;?j54A`f@B1bj?*}rQVjywsbYbTX(He`fz| zd~cO`C?l~;X<#8%j^Rcaia2nzi1t?SDhX~EId5@yWhZ4j`-k%IxQKqe-?wssPS5*C zxS1Arc3Ot|yixmHV#|MG0YA;4+Npj+0s)y!UFG?ehbMBAt zdWqF{5Sg-svV&pYBv0`U!se(ix?AUIa)2uJ2!6nCD}Sk(p|Q2IIHwRTf;W5GdJQrf zf*W6dUc2TWTBQxkcnctYnNIF1%zkBbGw%F9Q95#x^ib}TVXMv_6ojJ4Y<<}jjRLbWGlOKmtL2kLS6R`u%8_`JG)Z%*7a;2_qg$LHh zeO2GIw(jVKwdFRdh;iNIvOdoRHAO8ALxBD3Bg}F9aZlL;lU|sBu=4|5XCK-$olwlN zg*fPmL+d(J-We%on3PxxyO^XwmG`)@8joDcA0rEuU6j{vYtx?9X?y@I~XQ_$67os`72rv$fesyyo+|{ ztuFXA_3`#TZhFu^GMQigg^9muN62uq%_<>IpBO=(jjs})y%VK$*lyvn-exMEi9 zff_yJ?aDvI#~os+a>nJ#k@KDU=HO#(b!SHM6J+S>(^z(!iQ2o2r8O4zHrz2eEh1-n8;qK&0kXpo$)}()zO(2rD?c^rtxf=>6y1tU zQ;5M)cWtscEG?@ZXP9aXH_hv_!#`0plE@vD>&jwB!ZEcqdmo?>1|c8)C_nOXL31H% z8ELzmmQ9L4q6YH|6O*N`q60AAF+qw30&#@0?pLxFMpo-U&DCV_i({|y;}4u>Vt9yW zm%Y0<_rKZLic#RW_Rdq-EJt-_7Zi^aj;BLisK1aqOLhIxsQ{6Oe9?BhHIRnBLOg$8 z%QFXrBP(bh?_@|Uu}TAM1C%_@4-b=fb`>i3sw(>jS){!StNVZ%X*GFBbTqF!^k1YBx=ta6 zAXz(VP^p3?GtuK)^W?*56SeTQG7pQYJp1S1ikTAA^76Gm>6Gq@vhL6z_IOq>rtCP0 zFD+YanirC-ptmuoQl0o8A#(nR_{_#d$zit+RO;g2KaefiiYI1DAnO z#M#~phBIGg;GZmioBAF;J82_5nUSFU^;NzyWQ8f58~iDo6F=`RBTw#odIJBD&RJUE zY@AsK17-!!xg|l5$-#Ogti5azxWwftsHlG{>kNvYshDuXsa3Wc zmL~yz1;7}*l4Yk|my?eMXye-_%X80It~@8_)h{sWIv=*jm@m2Pr%AIw;br`8CSsx2 zm}a{GUk`NZaNNsXV-S8P}Yf&$6ghOLjq;pJ-Zx__Q&{ng$IjO-#MWk zrZ}w#4c(#6pGfJW9g+9|`*N;h8Bzdjz`Y@3=qEmaAlGFlRHyV%KAS0-5^Fe?4dT7GmvxDg=w0~iTZ`HYB}DgM=;>`Am4(Crrm>PY zTh(_#IBj*vUstoxqfJ@E80q2Qv-<)M!Z}+}1Fje3Yfp8K{mCu2zu5V`R@O`nMCFf3 zBb)V6XZ(D)5HF_N-jc>YzGLzmht2IljHb02Zd3?t&2FTjzo*(ykXgekN|{wXa6z@fPR=FXY18~m$s1$Y90thrmR`o9v?#+HMFwbFCF&I}oAD_9-Sr`I zm!RO2wECJ$K56OD47ij;H9?bU56dL}#jUlKLTx5i|Gf)EUDx)VhKGe}J+^9%jSuZ6 zf3MWW`$m^2;Aggrj>OXV9^2ShkT?}l%dwM?uWhBa*i3tMvDgA?vZ8!L{UG-++bxuY)NNKMVX$e_2 zeg@b&CNt)?e2kA24-#(1+n|Wg-fUMXPP*B0Sj(E+H`jjTL%LnNj&PE9)>>0qEuBZ( zyL{1kvVMG|v|MQCVt8GEwo7SO)Tj`^5pXE1F(xJ338b?jSdPuY$6k$${0(gW06J`- zMNyjy+FO1E`Ckv{x8<|EGh4n{($f#LOK?>h$MIu4w|JJ(^_mEYx z;KN?72!0S-2{04yfBM;3`V>3L)LxxHXg-8+l^Z{>e)6+{r5NaVxHq(v5E0Kunl$^< zwe3Jr`sUBFt{wLd<#xj~w+Z3VaUY}MkboZqiG@`qAx{TQ3BBYXuQuKR0) zzTyTG#l>qk8y3!FJEvVRKYVLp%smtyvil4m;5}GZFzqH-7x<~&q^lL$<^J$RxP&Bx@=b49k*9soHct%l>zJ6%kgsJAH+4XzO#w3@ zI^ib0=O!A2E|ZDD@osSF6qcg{i1b46XrVsYS)XlxTGzm&#V%g7+C2VJx1)czb%C%o zAnEkuK(uSRi*UKkf##kRSuc4ab9jNcZsLU)=;-k-*s6Dk_IPwOi({)(Gk}C<@AO7D zVWr!Az1oid^khuYF4}^nwQM5ZR2hKW_BMUB_FH$dA2FC@>*}o)K$4Lc?1b4=fra=s z@ak;DWTmOQcb%k(5n$v=s_DTl@M|iH{_Ts9jhDk7P~+zMhW=|oo!!#88IsT#zhg~7 zU+WiTw-6CmUEK`^e`LsZ?Vks+4l1yFL{C4D+GKSRpFKuYw-q0H?gOQ49MhW|#hZt1 zB0PvqqlvF=V&L*o*giVC3Sz#7bLXchhNsAUGeYt1%!7N&qtjV0SNgrER&r~k+GRP@!K1e;w z9mid7k@>_FHafAdZy0IL+eQ6Z8 z0#^OJT5f$=kjSa(K%+<|7j4nu!G;XrHhhxvLN}(_>34?lq(nL#yIC%ZBch)7>yTI6 z$L}2$N9&E*+;FFxt9AXB*!5PZm{-VAY%4@h^J(o4t-Z4pw$VV;iYXcHr=;^}y2D`) zpRR-p>GVu{(SYFi83y{jY4R7Yi${;`{YRcsjGFpuye+Z)aYA&PrjuB@kEyyqJ_zcr ztA+erx1QdYhyji@f&i4j@Tg4cf(iT*4!M@qNKT|nFYv97cjmKg>9f|KIm^)rySr;7 z>u1?rCa$kPAGbP={kOzh_~=5iz1j9EyW!DX(SU26Anc}6k&N~Dppe&O04i$wUe8;M z`y+Ns+w9n;4v$-4K)4CYgK9=^hprgn=JRf zy0tnzO?(y@c`}MxVAhN!* zm*@~%5|~hlLtjy_Ex9n*X6Kt5i^lhioG_WKqr0w?moL5F$)L$aM^}YddejH4a~@5# z>D{#V@)}mxPR=LPdnSu4YNy{>(Wgl;UP#r?)Zp+@Y!Y>`m+bxA;{<`M>k71~WF&fi z=)auM3Babv(FS_lbd8T8N21w$qn+rIfY54yyD#VV-u+4_AWzHB%X>M{Jq~M6KO!?> zwOKU~{-))0&gZ<(X6N-(%(#noiDw|y1p^4c*=#kwvz%s~sy^M0t+r^T4~cRM$yk1$ zj>X67lhICR2(~A*`TVES9;Nb!M@Uxll;Lc?N7N=9X4XEH1>2+I?Dloj7th5%JawSE z+3|!HFhz?Z_RDVz!uO`h7=3Mi%Flmtj8=>FFdGGL1vo~2nhTR!H%h)a%w2X~Xrje)Z5%zm=MK zJt%|Qr*b7%+Hi_O)!Xm2wTqKst-)eHfIvOrV;C>zN;Mjkd=k*&5t^(D=)1mL0mx|e zOFwbg1JHZv7LA)}*f0j?-$z>5p4&;C)!Wy3XXZo40h;Gu<6@us<-80P+7inJwPG5A zh|mN3`FU(Nh9-^|3AKKF=QLKcNz`+F%`g|W33uJ<9#nMg=`NqOp{#bbzW%h0vm|)m zLhGm%t?=TpRcB1xalehXjq^0u{@z#Z(WRT7R4JeFi`N`b9T6&v@(oVc?3}wUaU>G<`W3g=yY}Ap5S$|$=aE})o8CBfec=g)`i#MK^{?>{n#$s@P z#KnB(kAm#IGi_$ejvC{q#z?pG=)J@36 zS2|n2O@<1x9Q|PMVO(o-u#0Btv8gKK?&0!3ZpR>x-^prT!f&$DxGa}@E-4Y+4<#+| z)!WUV11@gfvByhTE`=vc0v$stI{~!tiO-3 zbr5ymZ_PK)h}CW zmuP*#U{B1LF;21k{)2!iR*QOma&emZ*~`f4-9BTQorj0L7mYZpd^@2ZRZOM_PH?-# zo}#q1t}&wJA?pAZ2-w!>g9akVt~5GKvV9FOB_?>9kE0~N8p23cyHZO`^ejxQF59lW zl~26P#TKW?h(yQ?dY*^V9zMlCRhc)V zW!yM3?mrbN4*xJh>m*1Z#RVT99X;GP?cK>}Jg(c}PT9~>9!)aAL}$6$L}>oKZlSaJ z@HV8-+xC|FKy+3gixWkkuXNkogX~U|$wgTbh*k@J6$^TiDDKxh7fFAAKUUHu9e8YR;_nGgY)S7A9%yj8vPGND=wo!jBIs#o`+8B!m6gxkolSGi1-VbXs5+4hS9i&tfU%9}o zAUAFj?5TT3tqMC+SSnIzk4}*wSlR=cb(ZNjCfw{{EnFjrrq_=g^Nsy{nsOdrG`fD+ zd3}>JSzBC#yGl${mxb0-rnRExSmWRACHEF0Hoy6GMp7C(B+zjGeJMsnM+-A^<9hl% zZm77GV8XkEt0=D|$7)WiPv50Np(x zevQ1GD;xfl0 z%=YWS4Pa|%i{iE>dzQnEq8^hMUHO`!PSQk-YZA)cIH^tLY3RTg*Ax>3Prrg*TBwrc z+&33gHzuy3=^Vek)IhKYE|cMopP(YN9dYWOSF1zDkbjkwEM?dVQ+LA>_>;7Oz$et|#*X;w3QwXJdspMSf2N?a2LPl05S8*Ili%7Z zf#Oq9Xxt;I;-wAvJbUy_J!uBVk?wXoamgp;NDl%TS1X!#riaO;-w$UK3omx)Jbqu{ zShp+LY8~o7$?sY5gLg8K!K9CpQMWa1Uy{mSq#djvR-?q zo}w6lPNAO)qWVtIwc+sDm`|l7TjB?~@g-6tteqq1K~(@6NR(-L3BiWXv0KZyC#pUX zqNFk)vcJy;yw z7rI*PWHmMQxMyktk3=nyC6N~a?;O`z+441o9~A4SR6nXy0Zht{X;cp}T^I6o?T^E` z3ar?C50{~r9kDr>DGWa(#j&n96ms7i;exA_g7g7pMnQ!D6I-CnsM*>J&chvTz6UyL zymsy+va&xSKPVT?3%6<*zNR1XoO~t}cm(XHS`9n`rD)18fD$j|&^`%ALv9Rm!7Ns` zta2`ltemp_C0w{go7hj)>eK@r!!*jooPCC~z)#eIb)lv7l?n}DF)Gv}am=!Px0Qx- zJJCtw6fQ7h=1!uU8uO-0=r-Ao5j|}Hj%gh$H7~SG4sa$(6s1Gnvc>Y`0oTsD=7jfr z36ejR0T^YX?xJckYZG)PH5zH$ethWdSpQC|2ZPe;d9h$j-ZL?sT)0sV3C^NOHjXOwuH61mI4bf@h|?;L1eGciJJ63Jm)APuK73BFu-YF}8PG1H~AIgc9_!i=3!g}J;?tRpN z0qfSYM^HH;xoxc@Jq8ayynm@j$YiLyk$0Ar)z$Rv1XuERcpgV%_nrLjJbK#1dq0Ct zf-KJ$3%c;@3zU5nT@?bbuYpZmUkR**f@BP@Mxo%5uH7d!XklCEeHH<>LcWE?ICSInX`)EfGTUZV=bzxsE+ znNKRG1=R1aYMO3Ol|8FR%|v)C?sRIgdfzuY7(^ih|F_WkfrQp*gt=q*D=sDIk#DdW z9U)E>V_L7=Acv|W#40BU=O7lt_^G>IlXHYTFVx@5$Q4k8wE7SxC?>@a^{T~)RXgsW z%qp|g>C|V1`NW}(ul4r%u2QT4v|!RY{U(E`Mc?G2BGy&oUDv($c=hd#8hGvETJkGt zjXOwG2Rx>lDqc-U8AW`^v6`dt2=Yx;_kakyZ-_ob|GUb={QR#t_QJ?GYLXuR3<4ye z8mw}JBc`&-K_Ju)JJ`ix^-%cza!zG!l`t4F+>A!L`AR7o(o1Q;>T+r+_HM}rZW0=h z3WsvE?M4+pq*)Yk1A3I|aAIgv|7c8QwWvhDMBt`?pboH10U}fyHwVEF1Y~T9{^*5* z{9B;(*K9>8bcYtTd)vt>1uZ>fsQ3%YfWS`WQY~I$mD$Wf7;z+zYb7=v!e&gvR-z;1 zCE;0U60P0lK&#cVi4Cx2J#DtwvI6yG4T?Ax*TdhYCYUTm#!D|T)Sy-wWG1M^7f+3f z?{o^$8HiD~UaBI$kOB1(t5#uyp7iHcRl+zqNXQ zD9Guca z5eJ=hv%{T((Wf+SjQ>a7TL;C}bnl{Zf&~u{2n5&QuEA}9;KAM9bsz-y;4-+oyC%51 zYjAg;LC)s=z4_`pRrglizwW6+@dwQ8J=49qd-c<6J?q)`+a%SWd==2I#bc)=*-@4y z%iO+=?F$PDcuj7ypY87zL_2hxoMNz{%zwX0=%i2=XWtl4k&GSvK8ox^;Hjjfh;H)s zznNpRZS@7RxPlf?OQKG|FLA<&@KqVZELRiT%#3NFeIavnX5anb1IzDwdwKK3>!3SK zCX)&97|$yE?!PiQOyc8TF^WmnF{o+5m)%c|#8XA^Xrtk+tsd?P!zcGnRHX1iC_CbU zXSW^zp+nRh9{aXiWNizK90h_s;I57l;6ikEeJTJ^d{yH$UvQHC3iSheP`U`{-Dvk_~T?u-E zOP(1+yK>wu1cHb@h<~*F2*SU4HYn};pu6!(T6`J2IKwR9+@YM13zJkQ~_R#lKuqZSJCQ=JRNJ7W5bpB^ITBNq~yxATH*}ZYzq(bTgcWR z>XI!2YQx8Id|X~qV#gl@pT@F^em!$LEv(G1uH3jPEf&=Lmu2`59arZu(+;4b zNKNW^DS%%1YaaQZg@O5*n&~8e7u>SeMyuHKZCqew#s~nhb{YR!VM2~vq&*M70HMH& zH^6Hejhe=>Un1 zsI=%tW3>tCZ(o~VEEuqD{q61fTOgb7W;6(H%nPg9!jG)JZpde+G$&IT#G(?{mvotRwA&Yysynqeus7@&GNr-5dyN0(S>X?~zX9~g z6W_X~hFoYds@_aQ=%O_uFhyz~AnqpjPOAi?#`>cxf?ltmvE(Lzram7KgH1*up>+E_rEGzkDdm^q zF;w|g#d;9tYKzn_`i)qxSv~JaEp6`vlbSpioJz))sF96SFfoY?CrNyVvCWsAKk(}1 z#v^(R*7UtEMRWTq^EkF{v>JrO!FJ{w4Dn+<3h`dQ6NF4;5zCM45XEbU=rsC`lE2$t zK6={u|5E3EJ#_iQF&WPCNe229qh>aNyFbwg-zP|)=qMN+FmpRFGwg77Q7Uw^p>=U6 zhz7lpc#gFIoThX2qp3PmHg0cle1H6Ts`FU9?@#kjw56JQo(viWpoS+5l9tH((*$; zDgd;+1B0&4EwmzS6%L5#!KUSuae8j+t+f$_>t&Rxz^OLklf=G7S$GcST;@cz;6vjV zM}jZ!+A-iXx)VVUpM92W;M;YkTge}lGqS6Hes3C;T5KmvPeP@$Wk(@R{Y09qqDoW3 zaq5KeU+0roSM*nlu~Z~2qn9N55JjTxq;ixTqiD_;%ID0bbn(I|@ka%sPzy{>Bzzydnpzc`ZzSQnt) zrV&Sv>?e8}BrF@u`#tJ{F4o)3CTe26eom*WhlKRgr`@{FY|%g1f{+P!(w>uElVrVl zcfp%S`TP@AYi5iXdueh8No+vA*XHmym(PJ6S5{e_Zq>ASngth;$gIun_KltflQ;gT zkrjz8fbZ?cQS!ioO_H*8`0eZq!zS6@bm0|eeYhwQ;@LIoR#zY|<{%Q*3TSiY+GHHB zhYwSeb}K(OM?3Ius&9$E+zO)KLcZTEK54uxQh~c94#OLXUnvyOSi!{ka_ySEOU2RP z+7&g${pijnTVH7WE-3H_2HUk4y+*RveoPc5xd~%?d7St8$}Cy6T+&T4RZyus> zg{{0hrEQ7_m4~ADfwQ?2sNez)a(EG~SB_`>uVPKhR~Y?tw~OCp(xoZu9g@_rxo9FF z>e_h*S`qBol|Smktsd+NQ!}hOtmMavB(Qb?tmQG_cg8<}cqpzptBCx1k5f6gmj#Wr zAOC%-@Tda`)8>qf<=x?y@n#@s;;Y=(L3Pa*+8w;vVu@4*Ed2Wwfe0Q>=gatUA~Zv) z-o9B@`izQWhAmSU+a5Q_nwYW!k(7QqUkywtq`4Rz6jp`Ze0v34P;AUDySL&szNWdN z6<3F1F0dRSrqaf=6KSl%zIFIgERW8#F@SKkjbp7=_><PopVNjC&SzR0yjA<(XCqq_W~tfaN-W|n`F?GyJq zd$&)LAhLW|Ao-|&t6-#rW5ET2Ig=LnJJDnCBDoNL8Ru-JP84)A>Vj9kWtqyQ+r>Ff znQ>_&@w>D@Xp3Nw`EEF>!r&me8?RPqfAz-?%`&7U_uk)EwtABhLu>gX0_@R1_F5r1(flOqT{suno=eisjCVz)H4#|T0Jtlt+)|Q}pR;8`A zy$Z1JKtep^t7qu*0!dRcS09?fZeAHc%L!R08Sz;_4izl_%a2{1E95f$Qfm543L zCRqm~Fzo?lH(&G)mw8?X)I>&PAsp~r1GDYxSg7gv<;NF z7~-(S3*Ai2@y8^J3QVJ{FLPebsqQwdWoajCKMeo2rMJL|(MzMs+OjWCWJ(5t2F5W| z9R^3J;H`JjczOV)nKS68<-goX@lML7KT@F|}dkk%dCqcfTOR;rztH z`ielGx86P;N`5w%=T>N)nT9_h0k%II9TRn~2(}_j;-r;AYI7SO;8~yBl4LC2lqa{~) zFtbg&I4gfQkIk%&W%&pSYvupAt@!{#x_5Id*Yroj)G>m{$u~c$V4_3gsI8j=@Q_cq zvB$7oXovhG*08s_XocPmW;z&_t7jF_QPn{QLOHv5!}{HQnHT|XU-E%ycjb~ zOyY;#-x7|mwY5F%<)#^P9Govhlb|jxAa{Fv{^;s%YMNq^I>}Z}o0F*};Sz}^Pwng; zFY&GQTU`-}Q%G;qi1Nqc(^`ru;R z1|8iTONv9+=OMFjbB9^c z<={KYHcq!SIHpoUQ`)C}Jt{Jz%Ycg)XNZrAEUA_}t#{=;{^J%?P#9?#P-3L=?Ew~6 z3tn7M>dlm2603{Q?7uo4V#k)Sa344MvolF1eR=W{7H`%-Pnm`I+XkP4mmw(-B`1!s zqgce;m)YHFJ1kAx2pVI$yq7bR=6P^_`~dZwj-=^l;bbJ$!Q5D#Y*h_hCGnoLO^Oh| z8)~OGjLrrL3<-H*Ed|@CY*ujdmtWDNTv!{!aJaR-9=W*#?t^V0o9H#kSJ$3Fye}?B zn3-$LW}sfVd}G@c3RStr2k{7#N3D<7%5{97EpvM?qP+}YKi%JQ(oIXGVMFil*@rCI zWVHDeLdvIkk1Dj8WZX&F=#^N;8bcz@d3-p1(uxl#R-CE3KJ+Smc!Jm zy>xqK=zr$=YGvD<3i^)bvyKhwPHEELkJQGCPspnt>@BKZ8*amPbgS%!9j^`y$IHen z2u*l3?5_q<<{>-oToo%K2-dMf>pfM*ALP!xr#nQ9Wlb4zbsyV3XIe3;zy>KTU-*f_ zUOwS3-zWT4;NK+gLmTG1Vvp5)qQVui&sY!4lFSA5b1V{p3c?6-%?l>t>~o6DXkz`H#!Vj$c)^b&jrYAy}I(Oal{XFXaMF0F(C{(&y%-ZciD zChD~L$arq#KEPOLna@0p9-k`IcbhaC3&K!TlG|OoZ@kD4WYKk1Nr2Qy8&yRM;Hjvj z(DC&u&$h8_{|u+Pa&@I38vSV#Raa&E+9e4|0B+K!z( zP8Srs?k9pqsI&qiriygU_uFiXXE+`9`)p2(@U8DT{jEBcR!ew zw%sHo^lp}b_)?DelAOfQ_-%)ljGOL=*Y@3(Y=qzZiWcVFXXsK`hE!h8<2gd4o6Oiy zgi7uRS{B6%ctUBsNj4BH+hl*m=}zvb$4{e|qsjLH!w1ddKq$i5=mq795mJid*^j%U zEn`Bj%ekI2^r8I~<CUd|8OM$rQO_h0n5quP#UCB9jr&iN;(DzV+Au z!&7-Aao|Lrl%FK;!;=VAFr?ZpnGze8Hu6$nX7;U)Wi+p3 z4A?GVTg#UNWqF7An;M3Dn({LLWeXWi_ITelN;%@^w9b zlB>V-H;qME_w~TYQ74D`HN4I2=t>TvYyNt$aeS33=K?=()16MMTA=;y=Aa}3{zX8K zCogoX;JDOs-Wj@sHC#@QlY?%_6*gvP;4sxO7tj}|IUQx|6l!Y}<_?Q7)ho_ZFXNp=S?jqf-{wm%goY-J%SBhxi>+>8? zE%y6b#prp)h)Wvk2dKIh9m&}Bg5ZyZ#<*B)^vNGT372`l{$kT>eR%ko*^!nqyZ!a7 zO#9Z6xgajwvf-wtmHGU=uI|g!gWA>mNZ7;Tu0RbTu3$AWqtusB_h_PUXrwMzm2R7@ zS?%0Lw+O%7@V1Yw<)H%Dd@9JMIb z1ee5XrEJ-ZU-p5b++#D+CT#qa>5y*w8}IuN^F_3n)da6WV>2)MGZObsI@ygjH42tB zb-3t5-E9gA)Chv=tnFJYm z4WnQ;=1^o)c2Z z24gB43@thCmHNVG!-Rs41pl}bKt1uJIO)Y&0nNG3_n>p_G0>ZUXR z_6ozaofw%l&W+>_-$K;eF`HP@a8J(S;f~z&I+lFc7Ka|N9(fsHF&yHj;jwV;ytjQf zv3V%Tw5>!MAzwwW%pYb0htJS8n#*;j^S}>D4M#il+h;*#{KoQDjb>OAoK*fLY-}$j z?iKGv3y`nMu0*d3&Y~#PazmH6^niI1W%pJf7u2G|hGGmFDqk=UzUh~YKicV*i`-}} zotLY+gcREks%%$Q+gmBDv{q!>+T=WEe9ZuhCoi#|fvaI(Nj8wl>Qyy@eF76&A}zoH zHVQtt_<2RX-$Z-WR7_Z1HwJcRixQ@;CSXOI%PG3rYU4MkXe&_|yt4Hond7r@P-B)p z0ALdKOar}we_!9IJgq|_z)RcmJ5CwXRG8rhpA2cy^S?(Uk-w@Zt!C_{&kqMjyVEoN$J;bx?KxiCeR`1Y z-Galk5^=P9r$??)1%oStq&7pNyeUc_5W|Yf>m2sp$sMMW5dMl%92aaBfEE$Fc$w^e zLSAY?AUrGhlZQ5VXRfRTx^=LXGVlF$dU$A_>gJaKFJ6zTD3cp{EeGv#@wREuH`Z}40~7L@3@`!dCX<* zjz-WuGar}12i7CP4m$cwo44ABs1)vvG4Mew`J=Uh`jjlx2Zrh#1 zmnN<3&rxt;@f7SbEqTW38I&kjJB==VRbFaMR&G@0;R_xcu23WKGY}nyk0D0zcW9X9~-y36klMvS?A}! zX%bs-K*eq{7iO-FiQUAyShtn9uY3GVx7&9jcKm*ywD|I+?m@()nupMgI?}{TB;CUJ zLupY>G>h=i#_-8vvgLAi+|-#Ij9vF=Iq3A$6t~$ljo~wyOrnlwL#g6F6&O@RzdzVW z-GdA~CZA8k6U}Sdtd(#+Dn<`=q)Ow=a(K!qZPI4jiIgyHpPDAIVBOvVYjNiViC4~9STJv zf81(Gy<@%4d#7?z67$CX%I~u?_#S3c6NcQ-)KUC+$RGvL5vVN(ZJb0E-!HAbsa6~q zy>eFA<#(FK5{ubHFd-PP@p3487(?`Rj`i!pdaah$I(=|V_ZDmQcqJDMVZ2z``KG4F zzw(`}Bq2!ic60ruUG6(MYB~20F=r=~f=KcP2ZVv2y?XYiBUh^`HX^#<8D%$X@98H$ zwvP9!G}sJSJqr&`qAW7s-F$_qD?0>fu^nA|47M&-rAhTP@Edxz{(ksK=0iYX@SbeZ z&ckaJCf395LCEcDI@uZPV6j&?cq0w^yuF(?c})DsQfOaJKX-Q5i?H>&OVf3&skyr0 zeqw76E->}}nlWr+nG9G)*xZ(@C)IuZR~6Pr-{CG6;DSYX5yw~p$>M#F1(mw9~h(?y8yPI3NKV7(2DQt5ceh2wz*5a|YvBDOA(k%T* zOMWFNyg8)((6H8P+=z({CS+GrMz>zkM>_YfyC39(NbDy0Ybt!M^%I;jOdn{sVjgc59Pd>0*pQi!GJ&=32{0G9&HJo8SR37+M=S zFhbCv*nI^vr=own9iRHB{g53K&{TgOvI63(JQ&!o<{7MNDee;K>S=2}DVT>Jm^ug= zId;8WALuEI!QLnTc6y$p4U|VN_^Ia*-<=&>TWirNQ;;28^-IxWkK8qHr9BeBhF{xu zFWw%P8b4T26_y9XgbDezbx*A|8XO(0yYp8(TX#6}+!Lav8$yN@5&$kGYAri%4e?}r z@`Ido^3_|4+9F&aA(eSq;=^aSCl*T+_8~Q7%%I`q&&wZ6sVzS}5m7u_^iL6akC7u$ zz7GL0GODeQ`_f*amMjZ!fb%E_!Uvp(Jcfqpn6!LaxU7cD)qpip8&fmbzr1dlqZLE6 zMJ@nPBe)l@9}#W5?4G)nQ|SE9*j^;MyQXVot?`7IBewx6F? z{(M@yEY;||QAxF7GhTf-AVW;VXlW=yYj1CgCSyqRkb$W!zu0m? z)ZR`bLel=c@bHi(-I8W_W&tH7BqW4}w(EJRW?T<&$oQ{ha1eQuSHZ{Ynha2RM{5K+ z+Yj9pu^`)Y;V^;OtK@dlE!2fy-tXxnji|1Y_3#!~WBT9;XSqM8+ahv3CD$BGct}XQJ7I z`vBpuvV|Hhi=VbbHde_cfz$Pl*GFXW3E%(XOZ|Gt5e2epq0obg~?73vzE z;hhqXZ_QFdsu(H*L~w*aDI9}1 zl}$wwT70blzsw1q!H$R%pbZ%GPx7WZXK0@Pwkj(qY?njh*ci_N;Ggt+pfyh-AWy9U z}Z_+hNr z*bxUqD?kn0;-68*R_HpVCdk+%D9t(r;f+s{nViY?I^GD+S`gN-P0sKD2HPU1TG+tW zqQUC%=#LRbd?q0Uh-_)#`IaD;$Y^{M+oM@dSL}@`fb)n&tl9Ii`G(PTKFjlqXxOjB zr()Zn5PY+CxaXP%%mEM)yZ9Hm?evzf zt(Cjd{>FAf8*QTJH9#14mUIxvKA7A$>;T#X6ZtZM(-0(U=G-BJKyXTa)%KL3(Vp;A z`aK1;{iAHjN@@G^V-{%16QL0w z7vR{qK)kD|cKBPKPVyIGV`DnbfL7iL^>7);RQg%f0YR zWPp>bZoegaskCQU7T5DS`!gIDlMM~k6@MOw_M@M zesc|%ndpSJz22d+p!t4^;c!3=MB_EaFRb9{t>8&=WV&s<0MFiddiL3<=JIy6R;-e0&1UJvd4Mp(eOGi1L7+ zQCL}}9p6zexanj2o|9{xSRH>6Vua^2mG*QcWpf{wy-(WF=H#p&>ig^p@MN$FBL5(p z`22y|GGEct3G6=)&$#^b2mc>Z<39pa)>gjnOMooC1&ng_5Rd?Sm8VZsXi;us0~nRJMbKe^{%yOA~Y1iX2F&zl+2^?Vz|OGR<;@xzO%FurJ|QP<9uJ6 zx>ha8X+|PAj>SY1{n=10Js^H70vbZ>5y8O-FQ#k@AS~uDIT$jF7A~{!qv0U|QW{)V zR&OBz>7q@%$;u7wenURipYoKd1sEFcZa@dx8c*VVK+9$R;aWGs;?)4zuTainzld_l z7#>WSyN)2QY`9BGugzqXOBz#-Ok`5tAL5DMnMA-&p*&<{rXmuWtCP3`(JDq?9PCFQ z3Zh5*J3~vc1Y|IFKMAJGE#d&}86+dNzi|12E_nuGW>R8?`k_iX6!B@|hG%Xu}I$m5T#&RG+w zsr%s-2cA0f76R9Dv7rzhKr-%aTT`f3iqCRBUHHZp<%K1xN!6dVUjUQwiC*Im^z%ui za6<8#zDD6#Ad#B@+&j{vGW0BRTz`Y#%+o*VV+TzGAp5k53`>EcMLP>xoLRUmBxACP z`K#C)x@e_+5pwygAo}nXLcz=h!OI+A8JC!zWjw0x(P-m9CsZnIB`R!Sv zgfMcaZze>;Dx1*wbxX?S-WjN^FtRCOnnO52w7py=>pwVFQC5~r=SoHtL-!EznLUgh zkJZYObI}+n4v#>Dh$#up@<>Wa-Fuk-?2&vDYqOE$D6!kLb2cP9wPLkI0MPgAr_kEJ zyF+H*k+xahvJaE)X~e5K%MzpSltEa4SQ8(+aGFnsQQhpu6OHlhQ?`(_oS}gz8F*ti zyz7&`h%`)xNhy%dD}XAN$x*W#VJuz}@4KdvX2DxXOqNlxi3AH!e*V-a^8OuW!x%0i zi&kU^RaW*TYHiFFzzy#FQ1j}{nOuA2gu)#o-ZmLM=0zTdw#t0X8ym&Wfse9H{RhU> zbacdjVx+`GlxdDHIWrwJAw#Sj)R`~!&u#o7tS_(6-MwBCTM&2xFSh?b;Fc#Tx0~0j zh%MK27(GVjsJYyjOZ-~iEGZlgFw=^s=GgL}kZ) z%Jij=t69*fq_-#6Ln9*;e=xWE<>VUbR{lt;uxKu^e#lY%?qw^-_&je%E>cQjYZEpUMulYGmbnN?R?svAgtRG$j8LcPR@B}WNVxhv(OKp?k+)%7G z`rX|)=i1GLRLR*vM7=auIZHN#u_;8z$BtcY>53sy-AerfcNsuYk0u-{E5{^LosH>e z`W8acfqSta2oR3JmGEJGHnmcj$my_2a{a(QYofZeCndNVLCrxN1iaal$*6LZPE~lT z+r**^r5cl0zPQgrZECuyUY40mMke?2Q-N9PRtY-r=IuP7<(gx$QuyvxbaB}C@BslA zsHGgXcVFbHI3I1Xn-dLA!Qr>Dg{Gi$8AQGKqPGCYuOZn+fOa$V!p!xu9r+RE$+&Cgy zO}$}!xS*Ku3hHo!-Qu8%S_@}iGTV!4s!yx|_fh}}81)HqJ@2t`ko;BfgqmLi8b|p7 zaUl5p@#W5~A_j2oj-A{EIA(U+AC*<2i;~7yzf$mR#ZU|&`pMME0VLH8`fY&u=R0e3 zgafb`KDYTj348(^2G>pfDpC+%=uluXpO;t(hKx3a@S&K$$t@djXENPC>3EZxRTc&E zbju=`wtMPi@Z3s7StarEK{CyuT5Mgdxx?nTlE#G0q~g#E51^hO&1NumsKY!0Qlf1B zPy+ca@H|`jNfnewybE6U{7+%q*Ml15xBm!)P9j{nahTi5fM}I+SFF zw`X^mRMm`xkHv>kHPaP|YJmU>g6^4fg5F+#)+REe&+JHi3C0$4iBaMK4mjn+BBlJ% z!rW)aKNnUK_uDxv#QJi-G`rT<#a{P0!IvH1J`L~@zU5?dxn@>TY$>pS@}frX$y(Bb zc@&lYa;sMfN)kNKLxHCr0>uSD z4*@!5xJ-)4+7pb|{z`tc+@u!|LT=*La53V9Jb#ko945yDYdum4J(`t z^(L?+RcJIDHm+W=o!2QVFE)GgroH4#mg3CRa#{qH32HQ)*?(nzTmT{GWK9H(N~{Lg zk?_&sCwk*-gS+zeH@`SIp?Cq&i zb@XNn!-~av?dLa?#Cm>etNo?ncRo<S-rNsFBW;A2CtO# zCtS7VX1{{WeymNWhT3>D!MmVxFGk;Kp&!#7Xn?0K3DD=@A_H>RNHA<{S8_@rtcRP4 z2r9zu#~X#!sePj(y_6wC=|zy7 zRXCk~z9hl8&WF<2LTGw~?H^GOX)or75<#vumdc@Z+icI#8#xKwd(&?(lUNZE5ZYHG zvkNQ7?P{P%62lw%R_<`yL4e?I3KlkYd~6)_Hu1&FyS*|b!?-hfDY7MoA3u^Nq%d9y z$2CJrd0fWZl=8&@iQ}U93#gE-Et+L-((6fmc}iY3>d!QJVR6;22_UPM>D3zQ5J~E@ zkiw6Hn6razh76~#OwZGY#F?wCzc;j|ehIn{A*v=ouO{#xbrTdDrx z=Lb_%@Y;CuMVZ&_8MoAONg;LW&E#fTr@*sJI*LP5jJ)Z>p=U86pLh%VEDL?>6RCc+ zb#+|V1bLC}q}r^#2UK(~8ijLeBt1A{;pT0vNm$I3JZgMwTluV7)w&R!NzYmxBKD8> zk4x`_P6@7pgZrt8Oag~|N?#YnmgTpqzfx04Zc|4g%X!xi_TXqNVusv%EZTuY*(E~! ztO%5Kx7%%#oeiYj(MMF$1ZmNao;e?*1Y=L50r5NJw@adnF%Mz)h=?U{h$R7^s|nmp zcrE_y#Q0??-~oWQy+Z)^U!BeGx$sM9&;R|$<=GFWfB$?&@I4*r?=^6rDE}3#eD>%0 z+y1|o{NHi;4SGc3nrlc-X6Cr$krAE&J2yp__SSrIs$?^i8G+2qDSMGmE7(f4}8~ zrD)2Hmwx2H8i4_Z=4`9|3ixyhDqv1mH;`~{`#V%=qM0FT;%wsau;0V4)&-b?fTtiRd@C+Ya zey6lP6wnU`c+KzeHHliR#?Dc4jXwX?aQ%J_kAMKw2;^5sLAS%xL1U*%d;33+M$rEA zO;eeM1LKtl@{fSFF+h``?Y|Ls`)H$*?6pt#>Tk2vZ*Ol;S<-)>XQxiNf6cwrQUt1Y^Nbu4;-nQ+TKeEaF z=kuEqLAiy6Zf)QK;BaFt9o}GxfoF=ri(i{Iqccjj+6$#hqu#0}#n_f`FjNpsH{7{E|uX7;gI?k}Rpe2!J zT;^FR^+=|A5v@s&P$x<@N7jbv0n?3Qsi8yRVKNelbE%8@P07xzEc@|7JcecV2UsP$ zVpF~7YKf=*#)|+gZ_I0txfWY;$?%U zWe@weI!_Uuur5*_w$3)KWscQtZa=^?vAZ^CK$f8*?SzsG9n%L zc5$#~F0@6jeIhs#7k~X37gEm{@ox*iOl(PgNH4eTL*(COy(W|>f;)0qCAh*HX!W8U zMsRal8g}KCzBv5Vn-&p%vmF3=gtcG5=^N93sB#|Pdj0r8!Ntv1x%Xrf@r^$!`q|Ex z^S(_)KB7q8H}5hPj*1=A7C=Flef) z4s>fMZDgMvlq4z8*5<)`Jaf@?;vFFpepvNqhXU@rI}D!WuR$GHN5%94!d&fjWut0b zw#@FOL1HLJS&TnXFftp(Meoj;h~mA_F%$;D#v_F9?QYZHC18U7^hxx-28C0wIjZZQ z1IH0yQY(w`LZ5gVWVl9;ixmetTtsLuGgt@8w>m*%#sykwZBy2&-Jd(w5)3!K`||I1 zr%RasOl11uq#uQSuy;AXmVJHf_T#obwA#+m>vZ|EVRAZyZM+~v!8_Uv0CBjSnUeAeg5 zuR&?_;i|OnqZ<@fu;m|)_g~uUODvbNnqDpa7Uo;@={9|^|I|?oF-_WvdjqXcH;?k4^_7%6mTiG>yrX#TjqIA7IgSk z>-6{HzklDB9rl~^8%_Zd%S&x@cNYQn*zb5wu02^aFsA9Eeimy=ZSiTK>X~xF{8|U` zTQvZg=$}+0Jd6Gs-1S60@9@BBqgbJbl<*3fk1K0H-9lq3!{*#9TU@daggFzNPNm9` zt}KCR`fNPAlq`+zv8Qx^)UJQSyOeD2-xhz#n)=Rc`0B8ef{}3$jP2QICOHz=tSJ?h z+sbrVQsSDT$BiLhZoM3;=}OeGEfd6sHV%d+dy`tPFTM_-ZKw2!e*Z3%C2gVkPfg3~ z4Cw9(?$Yi2*6T7*3bg-6OZGP6fb-yyD3Yk@V|#82VgSF%?biKkhg|!IOXQ%V{)=^P zk5z8jyJ~VO)4tMy!#BeZE`24DUC^@Bq~?(gp*?A9{-DSroZ zLRm}8^B(HR&)>#-x+x*Q3zF%DSWDYpt)$KuDi0J?MUXxepdkm}k7@)eIzAYY02* zdt}hXxXP?y06`@TbKglx6%VN@Pljr)-B_c@xOct8zRU7=9OU{G!?pcIxkq=ZTbUT0 z&Ctk7^5ksg8SgFOnf}_LU$EV{vok1%#!$OtMglw;yZHTBg1CTVcP&`95_1N+cIqyH1G%cKQakSSh(^PS86YY7oeL($FI_4*zgFH1{4OpjEpr$_X za~qFz&ug7G%GBQPO&1%5M6Yv$_H(XwUxEYPJs3D&8h2ES>(7)-lzq^Z-ldVId!yh9 zYm8!JxU@fvY8}9HO7r&VD=4-<10fgsNnn0Xoh-NJic(<1(Gqq3M&`D zO<3_e8$fR#ExRVFTbG9((Fwt3Ed$tUKF4{9pHW3!1$*j#oQz%SN6%%jI^=4K%lLry zk&7A+PZtuoH!lif6UI>~vfs+ZGs4rs^MGr+o(~K@${(IgSDdoyIB1`*n-w)l4;!4V znKc^dSNe;wZnYo=8Zca$Nc zkW#Oxtb{gmkVx`I=H^Z3y+Jt~us}H@XYu8A&7x2n&!tWAAFC_4?w4va-Z>(j$y+5+@u_ry;^T)*Yr-veXEDnwi_~I1P#yjQJOCSTb z(`xymwdT%X^dunh%!Am`$fTw!uSq6l`T;cX71>BX>$A^dxj0_Pd#p-JJY;nXs8EP} zmA7x$*QA4tIU!F)wzxWp%<0;dqhnrf5rnGIsO(~%mqA$tjK1x9Aao}tjYmjZfeXg#q-tyZ-Z&kuGhJ8%5eQqKwIy511*{bgGbROa9 zh-Z0zLF}q1AMEjtL<0%*p6<=^q0LQxc6^TaZbQz^n$2{003FJt{%4?1JEoIE8-H4*U^G9!Bvc1OE7YT&XVmXKpod zl#WU-+i$-smt1fCY<-7dW8(ZlLMo&}^Y!GPf^msJn<{^{W*hm&ghl_r2cffo>4qW`Bn9Jn7{N&2Ot=&2MTNv1G<8Ws!p< zjeJuaK$M(WNC=x|ay+@xTlw@4*N zpP2JD*VCt5tuCbr56vp=tILF{#FZn&G-e(K;b7V`1yl>0A{XL8MwtwZr6516-|E%i z)P!w^svm5l!}T2S{V(p`Iw-E@YZoPg1q+Zs@Zb>KgA?4{HMqNb65QS0-Q9z`yA19Q zGuU8f-e1D|egB-QTlapqPSu$|s44dD*}c10cdutXOCH=Zc;xW|RQU<_fnv$6y6A)l z0+!2R-e=c|QlhFg;!r}aG!KyS*avkbWs#ql#95X^H7%=5p-;(}$A~e%UlX#!6?%%Z z`KzEX@fu(cedyw|)0}Qp_r1)JS&C^2nlSAPRq`Hi;$-Z89SJZ6HALV9|07nQWI@^d zZ|q$6am-g9rcRP(EIud_0DJ4h$f~338KBgCm*eGL?($o-q!=@mol+@rGLXE@FAv6Z zV%wVT3bJBUQa7xQWHU#aYenP41#u}#@~NANn2{`r5;bz4wN>;skAcQI_e6v<(29GG zR;A2W1gT1bwO+HPT3SlKk%c%)N#(}%jJ%8l8*R4j+3=y<<99X(Tuq)%LfjAfPW?X} ziik0ct25@$_mnZSPfJ+wH-1DKM|}oBMVqv4785=PtMNloafSss1Tr94f9^~7Jt4PU zX&b`O0LF{RgxX9JsEcguMQ6{ft~Xd$995ZhRij=AMEEiOPYc6eBaI^O#DYp{?SHedymEq9+^9R z<3_GFI^i_SJ$X|!c+GwkUm%1ORjKp!Z&*0}U7vBxEEJNOsY%6nUf6IZT-q-%xjPw7EpyR z>ii^w;+vTPXZp!?p?az3X`+o|@PnV3O2Ss0k^+Bgw85D)rqQ5-Nf)CT4qp927mDSY z?nXEbDJ$VF)SP+4G(Sh;!tG4vN3^Ms868`iz_LO+rsT*Q64uxJE~0HeB~-8E>nPfu zs|h~^%x1?c+@37RIUD#xzsFE;ThN54q5BFj5J~2nV`el2)2_xaTZu}B-U>H%X?8RD z!d(<++QmS(%}{DV%~a1#`%h4fLWsg{6g+7)u}Mr?1c{s7iI~W3!Go@=N-U<+Wy@N) z`g!{M)^_7QRdC+)J$8=+;xgxJMEZvERw6{2F$rhj3+wF zZmh*Wy*rZd3|Bm}WH$fd7ztH)KWOfbuzP&EOg$-9)r<7zXF0Vek5EQ$i%}>JJ~}aN zY3&Z8+$D(>n;{?nmf#IiR59}x)4uP~h8mlD@a^($T!#8fJ(LT{y(sqHA!<+n`% zJ_zs4&hK_xWMP}fZ+1gyQ>quFPRd!aWF`=>nw=M0$Dfx&K$D>F$@LuRapdmUgu0@sV3!>z6G!g6@ACGWpfI*Lihl9)fsIH_W^zw+* zFElhrNJylsWrW;lElMTILPA0>SoJppb`(R(D8vI%;_2zBv$NCB&+p%BaA5=ITx*c( zn44GF3)2a|e*M~Cdw6*G{hRMB!sVsI%M+@SkP04y2F+XHoT35~=lDTVTa2$>y<)Rk z$;_hj_V&h3&YG3_+nG$U?5f0fQL|={4q48XVwrx%)|U0pmP@RxtSm16f(=!pN*xy$ z_tJ%A5&{B(n#GlDp%55n2`L}MAyJb&Hp~}u_z(YlLPyXa_yPqrVe?x1;j@R3t~n; zJPOts`yH8}LoNWdxM$|$SFB&GH$R-IsHlKImMAyK)ubO|Z)WC6_mKa^`)A6E ziYC_;Hvz;D3x8jQBc}bmNZvdt@97rR@JnBQV3rgXp0mulkL0cz^ZE5i#cH3=UH-D> z`6JPg7g;@=D@z%D{UG)TsU4TEHdASo29~G*cBua=JFU^PW;77-DSUQM2z39&sJQ>5 zL!55Nj`1?0jO=A7R`f=EYyWGk5)`mZ=3R?Cl*GE&SguIYv~J)+#G2Pds1v zvfU>oL%WdS5?|QJ{&VE~^T{;rk`nmy73%*U?(n}a!SI_R7o4t5*Bp29FTW1qdZb0a+0g zv^%amzt`A)AB%AL{)ZPFlh>A$SDq|Y`)*=Fv3K$N!`~rg=4Pgd$;i-AS4aD_ZhU>i zXVUlPTN0!O@SeWe>>;wR{@?q4*O-{>_J!%(elZ8~G1<~N!x~zBjE8{@cnb~vvd=)B z$!cn9s;W*9HDcKkH(YPn)nw)hg~SIA{QZ$1Dp{THu&XnFB5VpnSi%n<;{5&V;o#st z|Gf^S?e9-*vi{4TF0iGMl0rdUdBfTYw?g}YL9D?y* zydY-I1_E|ZW)`CSGsHcNlClI29*Oj&v33LugZN4`^%jIN6!QDXM*DZ;;q&41`NSOi z?NFx;)^LdG%bVn;tDo{Otr~p%8BO?nW@;d=fRIVLKzup3O!!PFd|;SGxq+ltrBmuV zkSeh+ZLs06hcaIw$&de2S#|RHWrJg;u!1w0@s{m_{g)*-`M&ag!lr*Z;ic(snE#D2 z`M*od{|r+;@%0xYYz%~GyWBn;7G6_B9zB`O8_x7L`gcAnCi#9b#t*})kcOQAMKLFd zWk{%{TP$oH4VV~`1YQfgh~AHR6S!|lzkKXrK^d(EDv+Aqv<5Wn5lxX1y{9|=BFZ&_!=F2Zuc6NmoY6=(9WQ=w*?k^`Z{DZhzAY8N$PfEjuV&= ziL5D<@&t3&aC${Ss2(fu`v>;Bp$%@mmU1@c>GhOk9xsb2&Zkm=dehC z0JYzHJu1uEP*amTTjIHw{D7^641s_QFPE;&^&W!^G5R#e&0u1MStZ)>WzsBMA*ajb znzhM7-rfMY1yJ|(J#sKP3HcT*%NP0cja*EpRTc(P!?| z269JI68(+9qO%NmEN<(&<>9?B##-Aai1xhO?>K;k z@O+{uwuhI$L7rU&Dwm>jlh3MR+xudV#je5%+cD^{{!u>m?mUe9cfBbx81K>l6$NN( zlp$a44>)22litq-zjs4^d1mBK^Nn;@{S?jt40K38uP*kncIHPvd4C^5O}iQwjQ-`p z;b|Y4q^OauJB)(6SVf;zveR?eB*Vj~H>>vV3)pL~O`biDOW&~&-ba%?088gQLv}8A z=P^!dqJMS}h#c2c$YxU?b4b7V~0wh9J2DBi{4>L+0W3!DZ>D!Mb0QY#+y` zsm%hy4XWPTtAY}nj*vat>?Gj^-EO)O|9zPL>a*x^CBv`^J|45H%4Md=T+cP$0y}6o zsV#u<9W{x?%8*d^!gAR4C|2@$x5T)x_N`5Cb50L4y{TU9XssT4zTk65Z;LjT1Gnx_ zO_e1zJ1m>AAf4uug~3AN0lYPyR)d~kM<}MY+qLdxcQ_5S{*$#fFWTHLEx+`s`omJU z-_Q8`ofA7aNK`WtDTq{If7v6<4>XqW5fej%7h4QHS89}!ZV{6}0JFWPS~aXm8< zHJsdTn;52Oq^rE|925%fLY}IuuOM0OMhVlvW2e*}7Wh2+8wCXz$IFf1rSB<^_L4b; z0!nX1rf5TCgBPNJ@y~{mpZ*mAhVt5dvLcx~Aw$dMdSZN#t9$~cv(Pw4r9N7;`rmc& zn^dJj8{QJ1?@&QtAhwBH4U4~mPOIfJ(O)eFN;?-7){xd(yK!-9w*W;&n@o2+{NP13 zhiVnkAB(L@)ofe$lo;?Cr`2Jgn-hFla;+lhf6($j|H$-TnJ5TFdFdQfgTTL9&F?qw zU$6|+In-Ojm-bvx{~ircD186pxBpIHrhwoE2(rNl@oV4x8V>a%aL*MyZ@|c6y~_3Z z^N&CM_%UxT`Yj2E%}TXwZhd_ngGT*5R3)(x4G;*_sJA%ymu&kT!V;Q^$UXb8lc2-T z&!5a`G&*s?d?dV_c&1FW`Jf#IXMUt`g@G8$F*`(2vl58+aS92Llyc# z`nJ;Q8Z)DK8m?yVw9SFH-4hIdmR@+F;<($>f*xwbZ_KSLpY^pr6sUoX4>t5X2`gF0P52C~OcPWqMR_Wyhm>T19LCf?H06fWr}v zDf7YT0wS@tAwc_`=r{v$7g7h}*+t1YasT_c|47FV|IQL0M#!9KACg1KYJe~mwY5(- ze*+3ib$IjK9R+sqpMyccH3-4J5vtW*K|ZQM+mM$tI$3x+^@Sgj5+?7NN4u-fS;4cf z#fe#1jZ+Pe-`ct^RrE1Fx?wdLkVz#U%r2i7seY2(FKsh5$(1VQmx-hsgo z1w5L=L9ZWUszl^#QQQhm6Zc#NrT{N95%G#&tv1Pu6SKK{InV4)&qafCE}wE*!{>-G5;@^HKZ7B@i}eMXXp zqA0-Zfp0{5z9fZ5&%Sn(4&Hd2yp|W5&zB~4OgEk@#oQ0NS+B6`FjJ6GM~>+<<6qMQ zT87vB14O2vkpHZvb1$Uzs0FBXmWB0!lY!AYh<(!F7Zs%XT0*a?xQk%Gu!xBZ+08-} zvMsUOLohCTyo9lPZo#8Pw+OZR)KQ7r2;i@20SO+WZ>@i+iUBkS4o*xAYnerd5Xm>w z6uC#FH;II&eSK1bNrXQ6-s}s7Tg)|M z7@bLTT$G~)PIl2Z^+#yV0oMNP&Fgg@V#GEg4)(a2n zqK|Ik9StWVi$2TmE1YR8rQDVa*3R3ro2%b(sgBQLRshgz)?9uy7LTIWq>tSJliR9l zGE79U-(a78Zp)ulYR$QqI4Wr4)SdIC+5A&XTagUVCQ@N2GGIapM#r~Ru{xEJq0~Y^ z;C?mE;j~Gbg^+Z9o?#@F_}L5hZYEl2^PE{vfvt(_&!}CM%e^(^Bj1X7L&8%OUqxQ1 zP*pWaa5ma_EhrGUV`|daLs4w2caL#dLOR=P;CmmWnMV8g{ZRthe};^Rt1u<4bAX|Z z%wmf6y3Lgf`i@y z56MUc>|fk$C<99rVa;FDswD$uAL`y5usJNUb?qH=ypOH}jl-(!7klJKl`gtR-_T>Hi5)7rYbCgyb$OxH}&*VRU!Eec-=38II5*FxOu^~s9}er z7wVD5grU;M%0IQRERNV&eY7H$Hs|vZoqPHlNSi-q=}0+g1j-+4FV4Q$0zLsYLzH3_ zeMS-%tmOC=jn2`LzI@Ra-QRQ`akFluE4-JO4wp&1vg!dRSm=q6D~~MM&DUNH#QfQR zV6ux0hI)9Og?(w|iD5ZcBgfC{+$F0!h?&-01iaq?c7xQcYjv$ln)nCk4&3uz`F$Gd zH*XJ9BBI_tVCzXK*gvXs*Ee2F3ww^1CPuL4qHD+S@4(0a`F}Mhd{_CEM(=ukVS#gs zsXcEGsOKy6iQ2~@CuU^uj#T`?X0%^r%eb9T@@}c29+0ege}`>~Gdu$FmzUKA6L?3W zQqBCX3oWU-{9sad3~(JNF585<-$*O$USaBa`!q(eX(~a<+8ot()m=NQR-=`Q5W`o zt(TXaCW_vZNGiD9OIv${wW_Ktw#f8NL(WgaZ0Zo%bQ~4?)cKSs^ZDG~GYoSFrnnr& zMnPH>yt?-l}bqCpg=9>m(Iv%|DEiLhWOfbA1!x3J@*jLMvrK zt!lnqBgS?oh;_|K#4&{ean5oRN6=+=rr+OLv?;L7GFT9jBROA6V`^7=S=>?9TG(;z zG-y%Gz&4n^(9T^^YIt4t7-$`d((}%y{?Oje%k-nJEPHu5*$FrE4mPb7Fv*{xj{E%#`dit(*e>{|CBVzNZ3mg~c z)f+~NqCl$f$g1<>_81Zooi;}02x<7LBBDZ)%bBu>q5O2)a=oDavQbZFhqF{`iYue@ zXWRL~F-u{kQw)uLH2_|ibx+g8Sf=@MpTmO1g7wt*lf`|q`Wt4BSw#lU#EWN4V1vZ^76m*|updxAdI$ zRawtdWK68X6=`Al8V(Lc9xAwu-Ovpk^DMYa;qeLTQ-n-gV5q~j8=S=jkgR!Shn^0Z zp~WPgDvIBv)nI4WJON>`{ONk`j0_}xvi=?6HnLdCX~^aw=dGMkhR(@wu(TNqNwGwH zFnoCSCK&HS2b<6hi1ZDBZ0y1HLVlwiTdwX#NsNssZ=m5#6$%WF0WKNDc>O9t5%G4W%60IH0iY*4*A0TJ6oKPdcgJDf@}d%iqESSpsEJI6Z!Ue#vb2#SifE zdN~2&Mkgy^2_qBQ0j>g^a9!mu3(5!^1TMISu?ZXebMjxXoE*G>4-V}#N(Bf9bBzv zW4)eQHmID=!20}a@qtNt-o92%>ZW1bOi@q>$U+{1jpIiJFRga zydi|{Mt2D&)-r+f<;$WuTfM;aYS6v*UEQppA}hDPWZ3MY%g%Z>2&X%gN^qKDHMaD% z!mdzF85wMWnVeKQ^1~-nTOw%^`4QjC(O{F@53ipr4+KZNL*CHV#%Ow8 zg|*B^wsP`4bS_7}14~F##qMeO>>VfCk7djoGdHj#c`$i?KK%>ao#(cA^ z+)BdDYqBXlCZ-|0BO`UWgF)f8a!E(9`)N>hip>)4&QWu~yZ)qu!^}eiR^T9>!ARI` z7g63E&yOYxa22zLyZq>7Hg(Po@%U(Ow6-}yElMI5wNxAPPE%X(bE!*a?Uj;v*aS6k z_o(cC-)wt_GLD~=sJvkNFcRB{k^2Cu&nt=9>`1EG%kd376mDyyX?5COTiQ^n*&`1l zJ}Ve^OH~({b2@hSJXco%jg8a zRSaw-*{WBEUY#EY=%cY}VJaBMG?Yn&dM8@72t?PXC$u-DE=DqQNiU_(d#d!`41XGU zI!vtFy5%LkK3HjX+-tn3kPdG#0ESc=Jegk(tWG%=+Ya_41dT#9YkaYr3kwT!Rl3Fc zh%b}Ir3sD;lY9(!iHaU~J`4F2&8$BFNII%FC?Vjq#Ms7-JklWV?;){>WV)g@6=PuN zShh*)6JaGqLRDFc%ymqHp^{ob>&gKmN~pG)ZiSZ5Psf*!##g)wwhUJd5R;G>=?khe zrr~OJ&^!z9>-lY4L8S)omvj^@{ElF%iF&QW>Ns*+!Pg_2Voz;CE?x$o=%cr9_0B$7 zi}V1po092~d}f-vib1m_}HC*{-qOw{-q9F)D?a zZAF%<`WTEh8byEET#Wz)oexyU8>_@|b@>t|m{YV6f8*TP!yJ%MPOm9Xj7O=JSHjb% z#_+Gv_-^lz2-mNaZGyL(3rB7Go0x`Eh8@Z6qC+7vk^R?7?~*7Va~urgABr``2+ zg6NnVHQaJKzflY;`rJum@by4Pot(E8JRA!@AX_zf?i3wD6uTcQk&8fV}*(lMfqMj6;>qDFzxUY(dc}JcNK#e`ju{lcpvn zA*BD=2?_I2i`*3xwspPWr zVmu=3^FcsF&{?%gSsRb8mfO;h?>gv?j^qg0q%<)SFqt!yGcvLYkaJd6OGb3=AUW{|y6&;O?d-H<_Iv!C^;EECG z9(T>>?JZDC0AeGZ*@JIls?3dq92RDZ-<)SaPt*vAuBWCydYo5+{6b$Osw{{Ya}QB1 z-RpQ_=yrGz-dka_*IyE^Un-D10hwU9?vadp`eANkWMux{fEF()5rbjtIUH}9hnR?l zawB80$IS~60za5^LsGsLlOE4O(!+JCb42D$X0Wc8<2-IXT6BCm(^DJw@-wzIJM%N1+paZl zIWPl0?Ggbv?SrnIpJ(kcX?OcsBOGMy<2$6fqLFw%)J0fidT@|pv=Wn)O7EEhjO1H_ z%@CqlgcRfRTA6i>NvqggqQ6PvVM@;>@5qpnIgVkA>hzWhri6ItCFLT`$qj1s@~iK- z=9lq+8dZ6>T`s#$YG<4}Wb+2@?fWWLYCOGou`gW7%LFAu+-(6@>A;49Gc|l?s}A`M znB^3*y@f1X#`BwFN7H6ld;;mIXM4%?uu-txh}9^^3e4dzcGVHy=F|N>*F%@pz>}mT z9Q0Gg;d;v*dpvtq((9+k4IXRC9RroCtamP4AJ<|yY37!w}h^Ag_0n2Qfwl&k3C?vVSZO4Oyl0Lym4Z|q9 za!fCk5CSUE47z$qI6?YMr4Qqt*9h5-kVujP0Zaf4x_J_aV{@@7h?__~pr5pzK2ei5 z-Zcp8biW>HJ}2GXRk5GXzGq*qO>AsK{~6H1bK-V(S7LO1u+Z$-j~bN2k?5llkZ4N5 zquTmi4C*kk>1M)3;d*1M>s4nJUHj)Z0X!HKUX!+$zf?Af)J1xv9v{Cq+dh$#8?X86 z8`x~lG|v6(WRO7$tIj8Q@}H^r4auEZo`UMg=qm4#u_1;trW!c7i;0TLtE;H!Vq;@7 z6PYEKOW*N(yGy1|UR(NkrCHnLofW`&Y>d%oAui}wH# zeB&z}`{ioTwo3c2J#4jj)zDbJi~3%L(D^D{9|fQoi6G*<7h35pe-I9<@wl=(M+mar zDC2xb5N+SobiJhvWJ1lyWw=w)B|_y!^X84D5qSX0gv50sPB#M!n-n$&F1Q2I@T*YL z>s(?ZrC1Mlj5(q`Gw_HT=xF3lDZh>M!{c+^%r>UZ4vIbBsyIEAR9v&@tToV{xMkd( zjlQp05GDA;JD&iaxuuP9CXX55 zMJKpgsAqCC=toH$_0ZugZEn0lakUp~HY2`ysp~~%JjigpDnd{kKsU;x9iMn)y*ISsa3G}Am zhbV4Lp`LNIr`^JEvdxdumdiH5+pYKnz~+a}rdoY_{QAZf>O=x}uJnzgEuKq9F@jWH5%G|B7sA%3c1vDIkwR8wVO^uj@g|vB%jIj1}tuR4eXAGtY^Mb zRV2ngJTwinKhJST0Z7ASa$A`#ynv2s1{{ybc%)6IQHMNK#c_L3LhInz+da<7xY zvbT|_`b10~q0Zr|;nv?%<^x$lCn)`*dxH02@)}usj}!a9a&#zaj`zm3N%qE!W5(WO zzuuu6ooWzX#v!g&FphR&OtGpO3GjnL>X@#eGhXf(O}=t$MVd+H_+~$Hrb2f8 z^`Co6ey#GE$mPST}Bh52ZVlIXP%+N#3VBLNQw^FwRn< zuGaqXtosk-MLH05KnT_u3R$ZoTA=IRS83WN$jZ>lh10QnGWDoqdm?_)lM`ZphQ)T0 z&DW3MDI07?($EPfD8c=Jk?&neN$z6ffmr1sDT75doEJeux{083g61Fy>t>^$USo|n zonSoH3@}(mS;Uw^6=PUuwS5x+BLhAL3h1^B-p0BZPS>b!TQ=m1x@-uXHn9c2b=Gh- zkxpF}__T|BVb7BoGwuH5@5v6zjv1=99*gANAt_aF$}|`3+_e>u#|@=>-Y?&qpxV(p ztLfx6vUni60AI`$#q5qhQCMyHnz=(e28^8G*x{#FJ&qDi-KlPz=0**(=E`K)${4Gp zK-;fnUF7Eqh;)2DFgVw6(ApJT6KM}ryYmaV;Zd()^RNj;lys$z{A6sj0+2JQ*Ot;@ zi-$+W9U|K1bTh+Un{|o3m)c%H0hwP^Dg=XTt0L%Y@#()BP2S(5h#26zf7PAz?6D*| zJvCAA%IQl=A8KZX9LZvWU-5YES7b=q-*_5Reqq7RpMLbkRVXMzh@tEdzYy@R)~2)Vuv|p`u`{=aWy)5o#2E9|-%J=$wk#ppo!m2eFSoaq1V%CC(J+!eVCS@*@&0~ZxQWA#k)6&Z`H#-+2(N z-Wtx-HxTQ}9!i15S7D;f0FfwA9@8BDFa#O4Q99yqBf%l&Cp@&@gBPy&N!a)w_ZiGQ zT)>FNN2}iWg12-f${k%n|&yuf&0A7#Wvkt^V0_f^Y%4trP3ugPy6kn zX{`?38w7Uy$MtP>*Yu`%nCP8PMCCdkgWsc>)UR;VTUJahzP*nL+7}(am{P77X-~I5 zKH0XEKf_O8rB?Skc7tbVKm=y*7hEl*Yx&7NZgPIXD|I^N{XCT1ejhT&VuJD79VLuh z=YjYxD&+(Tev&&XUwR8FE|ddmi+3N}qNf z>Pd_GA<61z=f5MD1#shKv=~pq_Upl*6c&*GQoF36N(`={>-e^H`~%Q9`yi?3HQVpt zb+R^ZIDK&X-U$K5EgV~>;Lfd>{)TB8qx|cf8;Am%484onn6G@Re2`J$nD38tMB_(~d?B0PjDqU`FjIcxez*4Jm4I;eA*&{Gdsk|(cYi0`j z&4a*`h;DzU69e1dkCGbcu_#G5CnBj@M@zZ8aycll86df&y}%*c=#@&(x(Qwyyzs=_ zIFOL#&4xh?8E8_Zcc8cLyly81v}bUTcx^xAl%cOmUS53Lw(EHi^h9UT<>g-PR&?(fH4eL zNlh*`JxMdRZ~Ds+-8jA-7822qRMSzm8*83bJy#=YwBBM>h{jaqS}(|cnk?W{NNm{x z`^JDG8j{Q>s1x0J@pW7%MZzkCxLUqkB}G0~z*AYy#ByW!#5sBGoNbySjl0-)7=9m0 z=T-+A_N?qx9Qhd?^%6S#LSG$W2nf-7_K0QVG4Y<-zr8iaFih$4y_EVyVCx9jzFiGz z|IEO|mLJM$ovESlFtDBaijrXTOg~W@^>$(6Cp&w>rZBg%j>g>GEc`|Fe4V|;{Ur{| zSl@BK;}er9x7nmSJnG`$7G!X_uWz?Ig{PT&N3y1wEk$$f2~tvlszZG$_Y>%wkPsX+ zch#vUW`hAx1%5^@j=hb?z)+RLma58v^;2;YLoRaexU$(7uZzxF*P3aKa2ediWG*iD zs{Sh^pnMH6nzAQ7@vi)rvTQ;+E2`G++feSVb4;`SEUc0zY#ApKD#yLN<${@ z`p`FOt&V_Hofu1rn0;E8)%;?n z0levZPH!)L*|=(J`^Ffz#r<;VpjkAngjdXG5Dn^kpw!O(AW%6i6jJ#jZ-w!8DFTO%+l`uSVv34 zEFTZz?In$h)wk}O2W5M7uf&&I-)cP&O+SE?a?HGGX?fnXZ!IT<+(-9yyIIJs4YmYS z-0LZ)y-i$sRffe!tk0NKs>}vTg@uyx>*(mHu%>ahYI3_0Hvw`q@dC2^(scY%t?IDUp?|OC82Fl)zh;jFG2NPwq)}jHdxtW}>iGB{`*bFyxmyF>tCLj{U=L5ZZe}Ac=MUNjp2iH!(U3iRXZ%ASkI_AFZVMX{?Lz*2LgE z2j)k!&>MuF5QtwU8HC{ZV{M0mV&?cS=dAxv9#|D#B&<*_aXLenyyK7H4z_V^nl`mw zjiBWu&xbRs)q3}Z#|S@O{y)#f{tEH$%5>X%XP4mFQT3|ctvw8d_py*MdN^>~jpO#1%|G4PS6g*^CLnswgD3eMaF5p4uN~juu%mF@# zL|gwxMuasTz)NMsKOc|xhZ*71YH?h8Yy4sh_>X)-$!GlIZ)O~CY)Mm0k@gWteZj*< z13mo=yr$CX=UM^t{Na&g3s&C8eiP|H_DG-c15baG-vcSMx0(rJ4#t$wEqlnzKts{} zlM+a{v{~|SVP{q*T-7sbC0{F{y;a+3n3I@MQNn(pCF1FTV9lDkkb(@~Ch{pUhG$;e z8FjUqfJ24t2o8#CYx59QOA`!_(Bf!_d4_87YFj^)TqVP%O%c=xEkYa?Uvf_!Vco|H zabilQ-vFSqW~95QJj&wok$DStq}327q;&S7ge67;!Dm`gBG+z#CQ92E0 z7yp(=v~!x+ORWwV(Z8oQ-JDgf!vh1TtC&H4%%R{-r*{S&p|$u%2Rzw8-T9(=@hhJo zokDYk^hPWF2@D;q72CV3<+$sM;O14EZ&)(f?u}0p)!S_3m^Tf) z`-?nH_|o&8Ik|IPCTjygV1q%4++FIII zbLCM~G6>dnC_f2d%0N=MNFs;hZ};iN4&QGU=}&!|dOK;7wj|0tid_gR*}a@6fd?(H z+)=p&3ddYh;r+gyi&x;>zTOGZLtf)bs_`40@k*^ZRV>S!vRJfCPOVkf*5vTs9nyWB zJaE|_(SfUK0@*7hbS>gPT*qg7(awI|JmeYPN~vl)A3*58+MDF8*M>6={>0-p=w>#k zfEgdOR|(KbcAAej6#t;VIEOr)?=UY@4e=3)CME6?yB#oIR6KX|6s`I*o%HQkz5noRtrs?X zz79duhQSeIzilZxXT8%WCV6dt^nO~4DD_ zTi+6HPIFO{Og7Fc?E>^Hs`uaP*F{ zRV5Yo?LN;G%?1=^$&&l_>4K!nG*O*hmq_SL#mO*UpX5=cVM~r?#ulb<#D01EUD14C zRNH`x@C9Agm%c{M*FtQjcH3XG8N(#rpbSwoye?{Z5akp-;P7`K_-XUazfEv=f6341 z0orir(vQW*J;b+!s>=Z7olcOCSjIkio~Alh6*!ggAjI7{on-roJR>te79X7siW+4l%v@>FoD#pqdytW{9ie{M)}hRum{ z64Jd};YnMbkroK<)HCC`g5e17{;Di`0Il#vQ~)eVzG~b0W7{vZS6m@qlif3(eOX8&VRS_TY>&K(` zI+}15EUOC7Qp-hW`_T>%)M#?WE*tkU5iN&;A=2D~i$;)HAYlZ@-nzq$oBh&^Y6r`h zWA`nKgIA5-{YbNS*8}!fM70Jb>Xa!X!Io?d?w<7ZlrO25D@q%*8qUkXg$~*8)E==k zo>oi5L*iUUEPWa#eH*?70N_ZCL^zWYm=dvMhvQj;^5t)O3N_g;KHRGwf`6MlE9De= zte7yzR_#A|Ji^DA&L=CyoYFNZ`x(WTF)gVX#CnW>t($#y9By7{L2V_E6rhi?{`Dl~ zSbpjzAzkUrI*$t4ULX|7`E*Eo`sVngBwUr0c+~OdeoZv^&!MW2~mW=GhEz}OeiVv08_j@-- zz8j9D%P+3uE+2k^J0bqUl#3V?&nPm#YVP>j%noqTz+GQ2_WWItO|rescSayR-p-HBOkK6Z-Vx01I%B9l;Z6EQ}uBI_qOjU9g3VFkpnnynB`@tzzRZ&sJtHH_m5@;;N75w>c=U?|861%4uA= zz?989ELY5)f6_SztZ~FPIGRu*UhdfTQVoDuGV=vBT6~czcXuEs&mK5_GHZfUU$Tm8OBiB(V#hc_u__%yVEndT&n zl`)JlXyFGA;w`-vOl{{~^~9qvjaB=2jS{>jcgSJM7A#+fuyQ|KAd!~zs_EuPf?V37 zme*Y!>~OUCUg<|yN{OSMnkGukPG0S|aai?}j_1lgP$>a@5nHUhu&yi4NTwW`oUI=v=ho8BkV4gPkIyn~ z)liajs<~Y~R>y^aq66?j;tci!PP|;1#V=(+5titwH_T7A@8^RRBgkvG%5q2*@#Y$u zxElK@u%4^mohWf;7mE&DVoIF6mcugF(rF^CSxK#C+cw}P9=0FRJ;y=&mV{YzHt&rc z?~0Rxo8-`OF}>*k$LI!s_ZWDXj~!;6mhzF&K`` zZ>dq&z4lWUQU;q(=04k>AaYdD*$ zr5vwnHDl>>yqdw|BF8Zu_DRaARvyt0@ctL05=bmn%F;FLmZ*Kky22=yfyV@}X%tXK z-E4=iH87Sui@#_xYh6Lpw04l0prh|=JyXYj66NyIOGbHAHh(SL$+*4b@?34j^DdfK z13VfUWqjl`lnsk*U=^WQX3DS|HN3Q8WU9=sNady3EEWA9yH%b)S2c`uWXe@ZsIDTCN6WK;moAws`Mai+#m1`p?vL ze3m7#Trc27Vm#_@B4agc%h>D(!MW=_14}jI*}yt}6>>~>NvsxQgRx-rN_*VJMbUI=1aiU{($yg3llj!H1ex>HYdeimZ`9~QgE@E z(}3x2j4rZk&geU{zD*}$1kP`stR+FR$JmB6Ym$QFiSZV4DV;e(G$-({p?OlMcM~); z45So)Mt?7q4_lfxJga`Yd6M51x5^hWX*a~FDrulYVcyP?U|uo!>*}o2pn{25@x;>c zBQqOOBvbzvtd8n;$t5xFB%4d5{W3yC1=349`5e>mh*|KDK)XxV&v!WhiTRpaClM z5&8{#=at)w>khz^!%;@5*mD!d$)G!{U^ee^TPhhB5QM7O4+V4}e{wws^C@Zi0SvP<(|2e8nAsW3 zk{eApSI2-8A8WVC9;K!A@$e*Lb~&@3jb@}R9Z>2#i`dQyaPn85_2<-lZo|{74Z9Eo zEkEh0`A`)f<)}~O=S&FGW#&UTXB06u4h&VU(}lg2<1E3O_3zm9lI5w4MgE5caQ_;x zi!L}`QuWy4Fv{AbKhQ;pKU5jG`ARq!RYcSAw1j$x_sStran#D7axf8p3!Sk+iiCTRSKmg-i{c{m_-@X;Q+W^0m zkvzT%_+}!@jbPqP^T35GZ1unW^8;|LS9id)*j-BN%>?vF^i;2Np~g&&8yf1_3xe+l zSzWbWT#rUO>2>miE*(wvMPJA|jZR%bgHIyrg#9Mif%ENaw`AuvkKJff&rT-X1pIC< zj-j#NE}(4_`BL10iar?*&K?&fDAtX`?e$;*gMMGjV?0!K;wM*qk<%gyuBnINRmJQ? zg2XYEfWa>$V_U#Od3?3L!J5A)dmO)^i)o!M5uk<7FRjkqb@~gj+;4rH8#nr2+;SS$usG zHeGK;^7F|o!;Fnbdk%-3pcU^>)R@)u7*#_&n$E$agF9fhBBso^sQPm4(5WBEa<*)p zbCaHjlpv$|c(Bm_Blrg8eSTzBb@Nk?LUcG90j48@JDu`+4D4a$kg94ubk`DCOZ*fy z4~S1E#N^j=-mTuNFPq}GS8R6DFt~d~gP415MFHlBtjVMp)_n{Ulb>#q;0+GFhH%SK z&MxsYRWyy(jh&0JHT+Jk%@VA#(B3ylA2VR^m9dN!oeD9rrhLOnkw=6=J2&jzD9p-| zs4Uj#8g}_{8SK0AUD@>~Xuo7(hb}h2b}2R}*7T1&^fsTS&YSjfOsaY|{bYj~vhL?z zfJc;@n^8hbPd3KtK|>|N8)|GJdmMPmG9_0jsJDyu8o$L|1+(i3f@u&)hM(!v zfqYH9xmxBgw%;dIXmbYu>t&QeODI`blEJCs)^^kSQJ$JOG;6=^rY>SBc-@mj2PEPg!=3)Wsn!W69 z&Rx`%x_6ZXsBQ7hloTJIdJ84r9xMeOl|6xvF9(~RSxwd9`113Da?Sjv1f~h&rCgjF zbDl6SPAY9I+Iie;H+(MQblShlc)OBmvgnj)bl^AkCd5kb(&(T|cR|Vf-a$i~&c#3$ zmnM9boAZhX_`}KV+{F3=~yo9KA4Uxjb+Jmgoqkd&=j;PRU7?mzww?^Gv>x5>b1Eiv=k08vsosvYS);(HYMeWM7qmgo4#e%pdKWDOob8vpPo!LW@Hcza!sQO%gh)tCoXXna3c7vo7i@{8 zmX2LItEz6`gKyZlB!>KXkTI`a)$a_sN{JyALH8x`nBe^-Cn)%{ttV3*paX@ILgz4# z(YlyXkT9tLml;g%G-RY<<@kLcSRPoX!wu5K#2jOhsRxJ`i9r+JG-c&Nb@Y*eR*yxY zpO5u>Ka;dCW|4Vx9Yx|Zg2D~;2oef+6oOgphts5mddhUPU$QoPlUzWeP#{pvc1%iooy~R z?1{m**#}NYNsMp+T&nJTSPmOiN?ujg7Y|x%H0yND!<=1@u)A5QrVi`qmW%QV!oedy z$jR0{=3ew@KVw_otT{ZZo}CR5Zrv!hSIjczRg$D<5xh-;_MY)h@UgMY!K=()n0$>7 ziZa!HlUUAnrf@r8RrRw|+u&>7wIIiE+qeikE?_q5=^j#P;#X32BL1>ZITk7w$90Ge_)tl7~!r=PU zc=+VXLV8FngxmbMo3UqSq0iy%qm(Y+;3$OP1czGvJQWvEdWC&9;8A&3t>uDM>&RGz zcLy8S1AcbB@Y}-S2#Hgx~Bc*pE4g47Bu-Cw7I7WnIpu*>+(a(sNI37<+zo z?Gq&{dRrRlkciqTnJ%RC#WDcfc=^=EkXb~3#z?uT=j5q?9c+$%Y&N{+?NVtz?ZXq2 z$6E}~p=!K*8f1UUTNoT~+1v&?cVsDrVk2~O_!qQIY{8w{*6$RWFP;!PPEyg&(L~+8 zGS(|txb}^B&h50H`ojWKQxK`e>6sjx6bQK-ig^tPZF}ywymTX*WVeY;e zBzbvzq6kk*cLLeoq7=7ltJTwP&Ubhz5^wkRS=VGokEHUikh5Z=@QE9A=IDteXM)6? z+v=&?Z9Iy98g+WmbDK%!=3piUJ5sL$(!lu+_<<0?8`7{J<(pyA@#Y61b38crv)wA_ zj8x>_8_Ttd8J}6l2Y=L;Tcu^A^w%sWBl9J&Vj#53B1ikZ1%a8@=grdM=HwWK7u9-V z;61_PuQ*wDabjlltG49jzBpoJ?T|aX`X*eMsU&;W`-KG82lxSdiO!~1WSiXxGfAWC z!;4Yj&dZ_~nW~qk!a#KF&e{lTHD3Xw`k>&+Apa=1+bl|W)0y7w_Qw%C^wiC)`zVsE ze@GMIT!0?Ww}VdH-NaC}hOls@)@O+wVyf>J(7Ck1R|{ggqWbW53uS+_HhV~jntYrB zqC%p>(s2eTDH3qE{B?EC{Q9s7_g;9SB-eoBUmsZ}zg`A+#=h$Z4+yz6wiVQT^W9<7 z{06y`q349QkOXB$#m#|ZrZCr(T>CLqQf>|e8FToZ8utQKbQ*IdL5pXP@kE-^{(3Q2 z@+cH#ey8I5;|nzQul*~)+)8>n)dz?s4h|P3CxHR=cifdO?Stk;X(T>KUKlGkA|oT! zlt!_Er9KF**|-zO)KVRH^SE}9Cxu*Jg?8;WXd<#ru<1W+R#N{=M#EOIGx*6nVC79U ztvGsw`)+f-(el&Z4}?HK5~BWYaR2lpHiHkRqh-f_`bdqoW3OYmbL@9nuhy%v_|B^V z{<@Yg=Aj;_G`c{}zf-E)^xo$8cr=2%Z`VOfzK4fz|Dc$W@_1B|&RN@`$O&Mk)7}2x zCjN3XBzP`mmoxP8_VTFi;3b5ONz(W`%aeD|%GT$?r2B`}`X@~~A56qtJ`xm99)Is^ zPMsMofW77TysFQ`AWO-{-YOdh#j=|mp9$Ae#Rxm;>UOo<)1L_6l-ZQ{;8;TUETEb= zk`CVe;A0`V$M7Gw57#l*>Ub88`|gJ3JBZ&ZmTWXL2Hy*#-w{}IIKFLRsT9$@EFYl+ zdw)vQckJBzo(9~AVD~$#wj`cbO`VJAgoy3pZG~!tA<3ye>4lZUK zyiz2j*jY@8j9;h@S){``jjc?FBxXN!m6ey5Iepw#q+MkXQNwxka$n7lamVDv?M1VAlwu~lUlTW zR;%~9UzFbP3OW)Q<#%go>}HMgPJQ2~QJHv5aPQ+mGww@#HB}kOOd;`KmLKc`zUT4O z7wQ2k%cN&xePN`5c3x1!dX))ni=d(^-AS(&gS`rO((c;VJs~ck`mLYd$mTl@7@p^d zORyW&c!@;6{VdAJ?)${akpItWUguUjw`{J@nz43Xz%uCiKIbg#dvwvf7xpnKIlqFu{j525xyLgudA7!(cE&UO=t8O}-Wh9?Y2R zc|g53HMfh%YDJQ2>s!=o95O{co^sML7&|#1os|TRq@MQ25QGlKIV|U!*Mbhe?9`OK zWCgtILruqA%?cK$&hj@g=jrL5sTdtrR;xTyg#2F6YU~L+NkSXM^U&~(o@KA@%X@4V6CT{!q>e!G(pHnmc|#=$9N%E(5`-9AfMG~gBHo`1;=HY!oO zKBrcw4T#B6KEP23c39UxtB#B-;(+xEgH?X4TOL%A#iNbbbb92fN#dw6lg)QkC`HZp zVBr!hD3xV|u&>!tgc;Ry*}`~(Y){&`+DlXpHGBX|lag_Iul8$=ZYb zP1_Hda?10?Z63a8aV1sRi!(+!vJVjz=-R;(j%tP6+Lu~oXZjjG1=pGBH~-$SMZ0`d zGDW`<{H>A?Sx(!oeTZ+*hEX7hq}uu-Vk} z$;mMfAmae*=|2GY*J_`o!#r)B@_6Xqxk6uaGg<_MEtOEddV0bhfIpS1Y839{;PqKL zPT%23jAllknLFQbw3iTKS{#RP5*YwR)*dTsmk*PF%kQl!#QRFNOV+FhWs7^;^y1K^ zsl^CdaBXZ;=%0wrtas3Z*Y=OA#wv{$UwFhD#P*Ld2{%fnG&2)xAx2+l`Pj4It3BLq zkOB=_n=MVUWJq)mkrN5DS|{hx%_QLuL_L|C;LK`Jj!*=Tn>H>Qa9O$jn33m?uNrYro?QwXx>vi2?=Lv|YLqDz-Cp{Wi)b{^BXg zBf}*f?>kC*D{S(I+cgdK`~ofIGj%qZ>*M0v^42+|`cdMTuGH)-muCbpYXOWP1eg+0 zc*t)!h+G$EZMFIqLLJr{7khW%Vvd1Z{ytXVL(|dtTsM+_mglWplWO^Ct*CxIo_7!8 zBlt;)7cc53ZW_;AI0Bg6$~a^T-EX&cgOh*KHOsaWra#_zP#qsvS@GV&d4Rux?#fa- zF;A3&!`#8Pf5hvZmyqmecCBvfsDb8dJ2juSW{ww8UoLDpO<37+lNA9K4gRs&T9Hh4 zS`<0JZ~AFRuSN76hK4l1b&iavuKpD1cZ^@zwN9@uT&{SE#aj2QOFv}vw0v~<{=p-} zeN^(qDqa0efYu-D*FSEF&gX|`)Oc9%F<~L}#=3x1zTm>jNJHJ@v4p%C>ps2w!LTY( zpCad#-wAQs*2~sm5<*#YR``x@DDWNZInzK5cu8}dllQs!x~Y;tz8h`HRd}DWhFe{e zCbt=ldPTjmcu8iWHZGAP}wseLo*^c-&8ZE**0u!NpEfw9Kjm@|i zAgpR-Tv@fPb#mU3gj&BhJbjqO^X8K64DhSteWJ^wFADJVA`G;*+yG4 z^kcH}4}|&Trq`l2NC-kb=>gvO|6HeWrh}jctcOQWNm5w=^6ci-L`ti z>@^Pk`=m(qIU!18mwt~|e1wqds<_$FSB?>zi?(+DR6R3s;t%X_iRyI7Sx5Q!q~f3r zInnpRfmH<}2`xS%Z$HNjz3M`2J2gT0Jo-Vk4c(u6eqa>SuoplXSbV0G*WXmCRFL+9F5LJt7AKZmH4zi2VWuy@K_}#9VJF;IDyP zWE3Q?DK>XDZ^ew{^(q!AWb968f-h-cqO8`$)p4OdUJ+q=B5$0?w-kG4tvk3QYE12I zzB4Y|;NsDQ_mq9;vwuMTUVG}-0i&3NzS2ijmBn>Pa}r}n0F9306~oW^Q48S0&bSn3i82tM z*^qf`@hcZM8(zYd-tPc*OhUNg`(Z-px6D}McY?_$BxqY@tfN)byr6^rYo{vpvx{$y-w*4v= zi4JGK^<@X#)?E-NMBbR$ZM1xGj|?r~t@&QJ`iJRgqbl7YuCz~x$(eymzl;2(Rc)S6 z4vjBiE5i6{^KD&dN6W@-adg?s2rRc2+>slyWdPnL?Ag=0CX2}o;tnmwLMovj3Z;gq z&{dJj5QJJJ2)8qXqLPa%fqeRGb}fui_gTj1<4>qyZvwKeK@Fe!D)^&tuNuLzr+WHi zUv-|Y*P@?RkI?teD#PLd%gFj$>{iH|(Sz&GMzR#Za(d^p`zCt+5D}|*{_+nhRyQ*a2ofAj7=L-3 zIKiER;S!>ibE)ztKI7iTj-dghvB>(YKIc(QYHP*7#l0f=uk}#O-xpZU{9KtXI9gt# zt6j(GFz@fbb})-84elp@G?)Ux%pWR6Y(4!Vc|BgAQZOic4OT%RXBC#}J-Z>RLVulB zKhO<4(=|LTtze1Hvn#v#di!nm+JsbWoZ@r8Lwl}{I3Z?X_6AHzwW;Sxcum{G|f|(?%Hf#{E0=c1`c(AzPcZRT3%Nv zKm5qzSeZ3%@H=Eq@RMtb&#j}Tq=D0;n>SP6IxVh8bYNoEHwqHZ)dXJDqm(PtBle~7 zUgYP422DKLw^hQs%f?=By>xn%Bu&AH7%lJz$obOFMqv?WFcB^ULYSQVKCj>9d^8sa z&w`U6O^5_mLx}Usujyy{jp<+Y2ozh#_BpOe>B9gO3LNr3Ml@Lljy-aWDik}gntFLDjP z_FSPCqX+QWO54Ow&dMVet08_U+ja|9gc`1cs?Kq?vPaan0gxd67 zE1OF%Ie*~~EcmK3dvf2#M>iPL%}`rW<*H=fT?A>iP$^&hYV+4*N60(bd*Ta8lhN=5 zCC2*fV|T$sXP?rR)&U^rD(^C-q$IO{P_ zXb_OwN1TKg1y>zXKF%Wig0;>JmU?gL&tOFhY;CXidIRZmM)0pZt9D7{XYn(9U$#}q z(jEMGb@FcZX)G5H%WTJy|F;Sr7HNyS5)=8;k;WFGUv%Xvz1XS7!NDV{>Y38(B4q&% z=f-o)(BE(#NLzDM7*$gGzCDTh*zU+sltb{P8F#SNmGGpxDnXgJ5FnP^hrV52hX@qDek(M81P#*w&0eB(yaSqHv|aUie=L%2H zGMMz9=i|AsfS*$+aaT+kmtZlLx#);S85kQCMs`xeuwCv})3B5AP-}w0DF!O8HmMsM z@uLgI$L!e4PZ=jN-nXKX(@zKb;uXhjbspX&cb=dTAzp2wvlpH9@{D-Q!BZjvWO=UB z%rZAeqATn8-sKj>X&eDzF=>xyoto#!rXps8zswV6ZZbVYN%X&Qg3Ts02`%Qq`+X~2 z?1i7FZ?BOkrKJS?rdY_LtrTdqV<730Gu`Kg{$-_hTH3>Bc6d+3tExKFNt54S{i%hm zJWbF<^wun;Bn8Ke0I#vmQ7kd314@tBmGhasX{LJTN)?$jkJDa8Qm9bmy?<$8;`F%Y(7q?^%=tv-c3rW>;<7ih`mZ!v&)8~~A zjwLbGWd0Xv+BKSTrC+26Xtb$_p6bC2%QO~V%a9XxnNN+p`^k|GOOIU(774WJ<}j|f zIploa_|@q3@PU>HE4bhYt`Ob(z-V=(Lz;hcH&U_CJ$fWLA7B6cluJ(K?EVb7r`+K( z*LkMbck(MEE}}o>Zi9v&^h)I?^vZk(N!@-A1GH*th}cwa!$48ue{3_W-E49DJKRgR zKL@rq4;;!Oq%|b&kMD3L%D*+|VT zs#saIeBz?NcL?gEtn6aqqtWqqiF!>uZGx|)?%QripXn?j@3zg#nfR7p8ubFOA)vqo z-ubR|bMR`OWuxHxfzO^24+{Sdgv9Z^);M*sAW|iGImtrr=Z&`S<|G$8r;PE(Q{zbi z04JDKK8Lh9@Q6wNOSY~qo!m2_J(y>arLMgEDHD<2kIcO?1}j}lwS@YF9~8;|VFBl; z?4L`Uj2%(lKOzR$HWtU6tJ9t#-SkxXZ5oQkDla zgx3{qEedK+=qogQeH#$nq#(`q!BS(h&ZoHtTi@wt{!HSsc+fD2JWR!hye{)=Jt;uT zzk#yem@WH2|0h7sy|R8cudt%U=nJ|=LFF4kQ&#@A`Qr$g#)!Cxe`{g8GGd|e&Y z-=EyJLZQQtKkiJ@SmX~>r_-cXH@cAPv>*;Mv%j;bd|)*6cV1ZwBt)oPsLOURd2&B7c@Jo_TF2`ON7KOCDU zfn0@A*c5cY>k45rxja3U71LVCS0i(cS|b5aupXJ0f}4UAo}xANK!oY(z?8}onx6<8 zqR^?G%G!5JWYOX0URZPLXcnOi4=jL5X;8Hf@86WZx_|R`Zw0xIjwx8Yjd@=xvZ7`+ zwgwe=Q|DvO;=78@nYzEHF-y;+&tb?~PjXH~LE_BSE!Dg|-6G(V8na1OA zT27mP%m%5N+Y7X!#P6%urbi>1wSN7NC!P$1&>Cnpe{9FgdCZ>O@UE~X$h;o)+Z<~q z>`SXiGN5$=TiPKnh zhcmQ9iJR-~m{T6`&1gW3_QPIxjHTfH(9z$c|IO9R+#aJs>sIF1s^Sxos!;rN@Iknj zWkY>~#-Q^EGh0S{+Ra)4IF?I+9+ zvK5ALnBVa7MBYdFvR!dTsUzN&ImPw~$H0<)=X~BR)t~uU)^G4adf@&poJb>XVN1 zFgj7{*8lR)U%_ha`2YVyzOQ%Q#{~LCt6@+5yCdwk@1w2=t0$HHgpcuf^JZ|k*uMOa zOIGXCKOYUOP}Tp7NBNJ5`~UdK!iq@Kb_}$qvIOhu>Ad0Dq?lSsxnS|z(}bD;F`)ut zi9eqGodY$rJseuw`=cb-K0v}ieLP7Cj;<3on!xVjpsUgVM{c{7<{LN?u9YekRDxy} z^E#Yjo>(d{21o~8PFbP@`d1qd%LpPiKAR(Mzs7II1M6Jw4E|aBBx&plymYu-slIcw z^2@LnL+KzZ@`l&4k!F(YkyUlb3d1nwD z1)SXX*ql4MTwXh}i-Vv4%xO9Kr|;}j8U@$G7P4EE9dqkJLC{_3-F|Htmz`t}2z@rk zYz{#u2z!Q3q4o%v$xN6c3tM`n9I5Nu0*`eq-QO;qpC3V^#3!|BTO*FZ!G1c2_?!sf zHHDSdp}-9=vzI&C>97+GjOC9T9_YBmB-CFt7dSi*)<_c50{(G4IXt0Dx@8Q|u~vf! z{|Yf*8NC2!iT_L1m_!s_cr^tK3EjWDS|Yj1yxrcf1`$EgMkk?pz*Mm}?8se_wF6LG z0;kf{RnKziMQD3BLy(55D1vbD>MZ5JHZhCj(er_(t_8Fe8s_Gg6WT7iMNVB_05}7V z%&g629;|qsuSlrxYvj8g2Ku7TCld3~1hh3vJNY5ET4-q)V_G%uwT;O62 zSqJKiJDqN3TU%fCo`Yxvg&Fq1)OX%P+iNrJ^)I%hGyy|Ba+UrQPo~5j4G5HPXert#*1>-rM$T z^D|er)<$bFL_=+(X*WA-b8Agr$c~uwwa6*07wy4*RtieT=Nqbu1# z#JiW@hZ)QcTrl9Xof)2R3kJ+3_W8uagqH=+OQ_X5Pmg>#3O8Z9qYa^^5@_RWPt3Di z=+LjeRe-)XO}^(!LI?L@(w^>$*YX6d%hkINw1CuGg-hg>ev{d8E$zeJW?{WJvAer! z)d2b+IZP^5H#vBsKx{31v1h4g+U(T&>gB=uUBKCfn+?z{fG+Q3JJ;O*HL|iUo`_kD z)?c0^y?fX#O3d}z)O2Em^=R(abi0yYb8{op|0iB((SGdG;Vahg*D4{`{eKcc*{X&{ zi!_pAMfFCT3?|iX&HjGK#5*gL7qS~g@IL!8Z#v)n?kia*AO+J{6+ zarAb3Y;EnpJn$6#?PX4T$SQSa)a={^xlI{{D}MMHWvy-BpM7>WqNARfXZcnCy!CB7 z;m(DK%sGj!lRDD;Wz61uo#ds@s4?9Mf4kKtk{7!u%AGR{S=Q-S8cT_bvWLOuCc#Lb z)G0nvxZfyQA5|_;@&ws*8jt7+P&ie(@G11y=CcB#JMIVXz#r`Td#)pSb5~R=s`& zft7q>yX~oBW2=enfDtn@M$fPNIyK{jU)lC1aYui&kCrt9!hL*{Pp71>3gj$ts6HZJ zpb@SA=0Etf@d=bs#Qb_p(PIk%tAGX~%9c-iTC7AJO2A~a`D%eA|IGAhOPFN&hctDE zxn+&pvoW-J40>y9RK0m5bkPghyfnRQBuYvK^2@frqJ`hSi_7EhmvB8a<{rLOIm}X; zMeI1RJuKS&vp}abR~8Suqvn;DW0WVC`EFf0+}zfI8&74k;nqe?LnY=iP5|dZqpH1n z&Uc5#n&K0;HWK0?F?nmb89>QS%uxsg)j;SK>vlVwztj7-k=W@~kAzFyZYfY#Atn^< z4xuKlHBP4_j&y zcJprTR;YTmz+q#spj!^8rv7rR|3d7`(6Nf=r2&QNXj|iD-!83q4{8#5Qt*6hD0+ID zEFr|oYtKna`O4~KL8TkDx%X%R_5AOtA|H9E&FHh%b>}j56Y4eW-XreU*mo2=?Y7Id68C|EMZ~M{;C`~hSDt|n89y?~5Tb1NU&>?hX@_`z zlzxDI4wRP+(I0rOa}|5ibsDp&G8O(KG<2(Ej)0m44ViG$?FpLaC$EiBeIH zH~EsZE=%Ls0@n`}G8~XX_nVPOw ze9m{dsDsO#A_*vI&s4=dB2!C5U*=Po@?9~vXBww+QEWarjJwu4B%j0##B?MKteqx% zq)O3*k_upG(_Vc^mZ)i26y~*y}0Y_ToA9d4lwMSTl{Nv`a z^1toib_g(UJD5}d5b!(qmXJbFem}I6eF|(Q?&fI*Mj^&8R(Q4Y0&cQplo)7-E@$oQ z*O@s-Te||A8iP;NpI_^l+{~HNFp7$i-d&<4T->g^8JpV9O?eI3|2(uQSIwBrYn{8^ zU~HdBWjEWI9fhomqOXsc%_IZ2Og;K5pqMXs^0qb!FIxZ)XmHJoS9JTs&v)%5-`(`7s%+|GF5&6x*COlELd|sofXC4(2)O?%)=Ep)Ll#?hM{xK~8r6@zRcSP{_${ zxM`2dRmUUX+fW#`Cd1(Br*`vN)qY&)OS)h@4x;f|DDHAK$iD5chfZW!H<$_O;{0UT)~hZ3Gc{uUph zrsx=F)B?L?$I+vrM^ePS3W*pDf$d7B#QBOF$mM2mVso>HLPX>y*;wIlo+~BO2T9fv z+;(vbGS9g>RdGzcKL4#F~q=b9g^H+v|t2b^vt>eHH? z*k3YByQsZixSS6lz5NqwxKwZl3Kcs^U2NS%&<`dUk#`=cJ}dqY3otS9*c7Do5x?!r zma1k_$y_GR`&N6s#Q`YVd8s_mU4J_kmBMX~RNf5_4Lyu|y!@x^4SLG^?>G7TZys#D z-$YdR>8#ihs4V^^*~S@yrgQ5V|AS7ri%I=S7&{Z~}lr2#IzN-&E&M~FH>elx^*X=ANNyFesbRhZ<~fan`}o79#Ef@ODM|zb9j>S z{f_^F7iE+Ef1@27oJh9+r{T;08K3`S+qM-j?@spbnZbgiY&S1{ZJ!jzku&}K$HVMy z0{hc|i!#Dq?tr7Ni+`!MzrTJXL%~=024euM`?z64KT!~@@bB?>M0{y)?o$>go&{*w zUY2DBolYwJv$1hLCM6Z&QT%!lTq6bVKCMjdy*mX-{TtzZ`b+&GuQiLzY1i%J5fjPd zh6_00V!7Sxe*M0?%aVPsBF& z4OtptAal9;MDR6cFZ6%HgZCrx^oEk;dVEay@Bl~o{KcWce^wQay6#Zv`lf<`r}qDR z{BV*)?Vtt0SJ2Sgnay4WGa>2II^qX5ct@RAKia*3aoy7LwqSB0=d6G4d7B#;bUeJ! zcrj{nl}Lg(`8U1&-(SaCeM}LUXJk)b=hzM)1h3=GwHh|sza|ZEp#+MXNW!BOz%AM;<(<$EZYEq1&k=8^F(lOg^rU4J(X5c8K6n%O&fE%c z;Qw;q2=Ez56%f5WXC68iY-D*W#!_~nLKZSMFD9@v{s^ZK5*gdg6gnUj!>C@9TNLUl z$znUUZF%bg+LE~LTlSu;4!F!_0kEj$tZzwPeV-tIT0SP-kC~p+YoYHoI_Du z$H3K5WWBuHaIGLD;5RX(a&lv~G9_q}qtL){xkXLQ&-K}ICvu11OXxt#zZLlaYN(^l zXPSkIeMFm}-9iJF6B0n=&Cm@eKRN8NSt-6`R_XBd>_OgxEi8NUnU2N@-^CHFe~dEs z>vXTu>hQyMQmL0_ht5hO-jrX_xa|ZG%trlHI_jyW%uVx9qT}aa`=9fkXI;eAz4Yqa zn(0V8NsrcgW6_-c-_wn>C2$dr)X9F-Y(D+SWpJo{hu<2vGQqNQ9`!ck6Tgw)ZCJHq zJl9}^R{6TO!o>Ji{I9n5fE#xeZ(b4q-`1Km!ggKs!L|wWcR_i`k6&|iWw%_fF7uNW zWSJJ@Is=%WUrIgB_fRQZ_rCZ{M)plnJsv7Pxe@px5QFYo_p*&8-nIuP6H@3i&~esn z&`H3x+{yobV{R&rj7P@W0?r3i3F2cz6uD@PYYD0ecF^FujgoI9OEzWOMS!1j?3M*a z28gGGJk^88$&&+mHxL1@kQQPwwP4PJ}11bVRlB<`$(Q-4h-nsxSekpg5)a4qYMfc$pS z)8}0x&tlYEG*9XbjNByN3C%W3<%u-*vE^0Z(;|U2Urj$@S{okFi00RUxLb=^Z{T@d ziI5mq`F%4lH|LPS7^EE+>E79c+J+Q<=SBAA*h>v4&)~S&WRqz{fUI{IfIpk-`W$k# zT6DIc`zf$U4)n6oZg551c;?kxi8-Xl!Vl!d)^aC{+SYpdx2uJk8^gPAiq1OybaT06 z0UK}Txc2^tJwB5c4TLxa%UIH)<;Q>f{lbux^ukrcih}^fsZs6;9TjN@xbfEr@hctG zlbxL>H1`1K&F7=rH`@g#@AmeM56_J&L1|N_J8!A>OxV95f8lelI5~&x_secS`d-O& zh4Xg4Gx#TGtmscr^V_o3yZse5JLIRt;SUNk(WG4m`H#+H7Z6G(++A7p%G~iwii2vxM7;RH54YIy8Lt2bA_Qy+gz^y*=ECfSvVA`~e6 zL-D7p#cF8ssR?vX9kTS=z&xAG3}LC{Z5vSM><}`iKDRTy>P7hSoayp5hQcY%Jn%`r z5VlY)F&{WT>ZVgKoL{gLV-D$QCb)lL^Q*mco)tO99y3t`dT`v49eQLT0$xBbu#rfe zNYs@alcsvkgw@g-H4eJf5j@JMA#WW=`ty^Mc#nsFIlMZt;<#+e2XuNsGI z0TGi&-|bKy6Go@TutgbpK|q&*&dHaNI7yE@kJQOYh9jQYo%&D1bS(h~JJZZf9s%dT zNh%s)LlDkpaF!Y6?xDgNAq!`qfo@gvmZ~)T63%jLB8P088)z3k|HU-far>Pvz3@Z3 zgF?aX3jIZQa%elcM?A~Vuk-4<>#Dz3y+-ANwZ2X^M~#%R5pnYtcl%JD`O6VF`^{7n zD*tM8-1)7(K=>n{5PNEJ1EFQEd~YrLOT|+Eo%Xd`3BSe9TX~h{z^0JvnlAbAp=1NH>d0ZRf#kYH3 z830`J#(L6IWvbhTMw!LtIHCcq8 z%@7!C{duo_dE=2O8C*uPKV^GNYrjOoS7EsU0l+Yj*Ze#gWg)vTBjQ%%lk%0EdxaQv z)9-inDdLM6+NX0gdwAAn?FIMtDR*vaQ2{e@#H?j}>U{0TeaFB2wXB=A7RX7lg%YVN zIhiGd#j|X=%2vpz$iJMqmFTj{bt?Agq_AOZ+>j`C?w(tMIFZI~7bx?Kza+qrmfZDo zG65fjzPauru8A`0G;XDM^b*0{Um%GNo4Ws%bUf>@uRK_dceNYkk1RkEWPH#cgx`J} z;?7@Xg>7&}!}C)%RIyquT@|#S`F>VGhs@i`a!Jj912PbjY*6x&NGtF-`NAXu zBGGBCn%zw<5ln2Zi?|!EkUG-+8Xw?PaLJIeRA77lTZPt+Y01OL0F>1&r%F}4CQHpX zu7@64xz;vs&JPXPuF7XwSLIikURm#di~nFhTq?uo>HHq-n*XIwaR6|6Bwmz)mq3yJ z(A|Ez*A$z#TuDT!84K&8SuqpdclaLpqalnh8oQLzytFc#8J>qztQT{0ubYrP@{z>y zGUnGn<@m-I&;934Wc%re@(lyuXDdLU34cU_Q;33En6(5KA_^4&+MMPl9u_u&d-|P4;y|m+#YA37-_Wg2kN;sUe+Qo2gRu^+ycXI0=!2Oibz6bMC)Kh1eCMaU zpE=gPpFe4>iRFjBxwvMFgas*<0);-m1*e-2F`_=ZVlyw>mEE-47r(jp^@WW5On2X# z2cNu|q;`BUTTXc)#*UG8eNUvsB@|o%K@yEqaDMWsK;S(boGjJJITW(E7d~y?wE|nE!V>&{!Me zZw?Yaxnqi)5dXezw3Yf)iI`Df z=atZ35VN~6hPRVx6pXP<0un@5y2bP(p;AmGv(ZH(f5iGiTo74C4+5xWwi^oQa!jvU{RxffrVm-!?D124Fvl~$TcPgmeLpWal`KE&K8 zV|tI33U3W1X0>~A_?2lm0u3a+`L+}fcQR_cxFk*guVtC}T@#;K`2FzDewz|tw>A6g z3*~>j{eN=nj>sq&?0>0fJMqgL2O)FY%u0UUS3BH!JCdK)uUn)4)_nOA(WmS}`}nV? z7yiuu_2aViyU1ILk3>354YgKAr**Y2a%V3oFaB`Rb<;eiklG_@au;^jpT6>B@p92$ z55(6kioWu9ubH#Id+t858FQ})zquh4to&cn{Kc!nnP+ZW?EkyYoG-q<-;N>O?|{Dc zx}{%a1$Sp(dg?plgr@ZK|9#1!?`{^!{hYtb2gP3Q&*jDT=Zv)@UbK9F`XwC`_%`$ocBU%>5Yi) zP{r--zePKJ-#<#3^Kt4TwOSU&{gX8W&u?`)zr3#L#Hz=?dY>_Dc_+C@{_v_~O_`Is zH^fQ`u%9_ScWd1IGcz9RRQPRKQIayX`r@+cp1DbSE4nlS&1$|czJK)F1AV!!nxlJ9 zzN?(mShx4l6o)t8)MC$hcGXM#h>1(Pv-in?pvNk{z=pkb=k}@PrMBhq6}8j-3({QI zYE-%RWcOLs3dJ3nHX_GQ>UQI^5-&tT2OhEH_@aD$bx@V_6>qBx%zO7_>!lf9t>clAJ-gq+;PbmZaVyTe&X0d}^Mo2R zS9n9*fz??#BChoh&#*G^l-1s^<*fCxbF#>i9psjF~%!_lwH zM3=LR?Q-AyzH+yvPROHm<__zP&c&aLVE}H(`>qNeWNHvu@LLGX8WKw#NM27e1O~^b wI?_gK!y5ks+ur~GfA(Jhx^|HbRI@WP -[CmdletBinding()] -param([Parameter(Mandatory)][string]$ConfigPath, [Parameter(Mandatory)][string]$ResultPath) -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' -$root = Split-Path $PSScriptRoot -Parent -Import-Module (Join-Path $PSScriptRoot 'PRA.Common.psm1') -Force -Import-Module (Join-Path $PSScriptRoot 'PRA.Directory.psm1') -Force -$context = @{ - Config=$null; Server=''; NamingContext=''; CurrentPhase='BrowseOU'; CurrentOperation=''; CurrentIdentity='' - LogFile=''; Warnings=0; Issues=(New-Object 'Collections.Generic.List[object]'); ExitCode=0; VerboseEnabled=$false -} -try { - $context.Config = Import-PraConfiguration -Path $ConfigPath -Root $root -ScopeOverride @{Mode='Auto';SearchBase='';CsvPath='';GroupDN=''} - $context.Server = $context.Config.DomainController - Initialize-PraDirectory -Context $context - $units = @(Get-ADOrganizationalUnit -Filter * -Server $context.Server -SearchBase $context.NamingContext -SearchScope Subtree -ErrorAction Stop | - Sort-Object DistinguishedName | Select-Object Name,DistinguishedName) - $result = @{ Success=$true; Server=$context.Server; NamingContext=$context.NamingContext; Units=$units } - [IO.File]::WriteAllText($ResultPath,($result | ConvertTo-Json -Depth 5),(New-Object Text.UTF8Encoding($false))) - exit 0 -} -catch { - $result = @{ Success=$false; Error=$_.Exception.Message } - [IO.File]::WriteAllText($ResultPath,($result | ConvertTo-Json -Depth 5),(New-Object Text.UTF8Encoding($false))) - Write-Error $_ -ErrorAction Continue - exit 1 -} -finally { Initialize-PraPermissionCache -Context $context } diff --git a/Invoke-PraRemoteMailbox.ps1 b/package/Invoke-PraRemoteMailbox.ps1 similarity index 80% rename from Invoke-PraRemoteMailbox.ps1 rename to package/Invoke-PraRemoteMailbox.ps1 index 0996461..a337855 100644 --- a/Invoke-PraRemoteMailbox.ps1 +++ b/package/Invoke-PraRemoteMailbox.ps1 @@ -110,7 +110,7 @@ .NOTES Author : Nicolas Fabert - Version : 2.1.0 + Version : 2.2.0 Requires : Windows PowerShell 5.1 (not PowerShell 7), RSAT ActiveDirectory, ExchangeOnlineManagement 3.10+, Microsoft.Graph.Authentication and Microsoft.Graph.Users (cloud part), ADSync (sync). Exit codes : 0 = done, 1 = failed, 2 = done but a next step is required (Pending objects). @@ -147,6 +147,26 @@ param( Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' $ProgressPreference = 'SilentlyContinue' +# >>> PRA package integrity bootstrap: identical in every runtime PowerShell file (checked by the tests). +# It authenticates module\Test-PackageIntegrity.ps1 before running it; there is no unsigned or bypass path. +& { + param([Parameter(Mandatory)][string]$PackageRoot) + $verifier = [IO.Path]::GetFullPath([IO.Path]::Combine($PackageRoot, 'module', 'Test-PackageIntegrity.ps1')) + $cursor = $verifier + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + & $verifier -Root $PackageRoot +} $PSScriptRoot +# <<< PRA package integrity bootstrap # Not a parameter default: Windows PowerShell 5.1 leaves $PSScriptRoot empty in param() defaults when the script # runs with powershell.exe -File (scheduled task). An explicit -ConfigPath is unchanged ($script:ConfigPathBound). if (-not $ConfigPath) { $ConfigPath = Join-Path $PSScriptRoot 'config\PraRemoteMailbox.config.psd1' } @@ -154,7 +174,7 @@ if ($Gui) { try { Import-Module (Join-Path $PSScriptRoot 'module\PRA.Common.psm1') -Force -ErrorAction Stop Import-Module (Join-Path $PSScriptRoot 'module\PRA.Gui.psm1') -Force -ErrorAction Stop - Show-PraGui -Root $PSScriptRoot -ConfigPath $ConfigPath -Version '2.1.0' + Show-PraGui -Root $PSScriptRoot -ConfigPath $ConfigPath -Version '2.2.0' exit 0 } catch { Write-Error ('The window could not open: {0}' -f $_.Exception.Message) -ErrorAction Continue; exit 1 } @@ -186,7 +206,7 @@ function New-PraApprovalCallback { }.GetNewClosure() } $context = @{ - Root = $PSScriptRoot; Version = '2.1.0'; RunId = ((Get-Date -Format 'yyyyMMdd_HHmmss') + '-' + [guid]::NewGuid().ToString('N')) + Root = $PSScriptRoot; Version = '2.2.0'; RunId = ((Get-Date -Format 'yyyyMMdd_HHmmss') + '-' + [guid]::NewGuid().ToString('N')) StartTime = Get-Date; Action = $Action; Mode = $effectiveMode; Phase = '' CurrentPhase = 'Start'; CurrentOperation = ''; CurrentIdentity = ''; StepIndex = 0; StepTotal = 0; Warnings = 0 Issues = (New-Object 'Collections.Generic.List[object]'); Rows = (New-Object 'Collections.Generic.List[object]') @@ -862,3 +882,180 @@ finally { if ($PassThru) { $result } exit $result.ExitCode } + +# SIG # Begin signature block +# MIIghgYJKoZIhvcNAQcCoIIgdzCCIHMCAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCpjqYhB1xOrtKu +# ss0ziKekOhi72NF6k9P3wp6stV7Nx6CCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISbTCCEmkCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCA7rJeZawR0 +# TARvXGNIPigEjo32GShUB4kZVIt3BUJYPjANBgkqhkiG9w0BAQEFAASCAgCrBfXO +# W/Dl9iul0Vv30tRD81YbdQoRHwcLSJqr4undy2xqfmqO9GO0Yz2irqGq4MWKq4C8 +# 8dqnOz1IUw161TkSzqBkTAptAu44HijyVwG2Y8+d5eD3+VHLvOwwbo7NE8ZHARuQ +# AVZQEcg7kKrrM0A87gI+TGRHLBzZq/SvCvPrgeZXZgr/pjIrOiqDJGI/Paq0jVOA +# fzhrzybZKIVN1LGlUYKNID9lyGJ7qdOopDkSZ8IipDnfDHa9/QpcYItQbjFIkjFU +# 2SGIGVUFtquUHA/5SLz8LKfkrS/hT4qohvO7ksCesjx9qjhid75UWddStJZkqrFb +# UQn5l5TyGyQ3iLc9bXYkEsqU+hua8MDaqap4HVScUZ8N5aCcHVtbPuyxdZ64zDEw +# 4aJUaTKTAYQAeNTtjkpNvg9iTTBlRPD3dZC4imxdwvvRQ8YStEF//bODLjAdSGK7 +# pgaUgZIxjE1+P4By8ZfGDW7CJrQoRAWFqacWMfUPolkvpuX4SpW9W2vesDbyActS +# +dGf+ahK33ooEfmmSMG3hkVgI4B1X0Xp0bEbvr2vbo731xlf5FQFCt5d+uUQ21s8 +# hMILr46OLV0Z4vl4c5uEpdQ4f4bltE86vKWTtI2jAXcriQRwGJhqli14zGFA7rhq +# XAHYzT8mfE9ACDTVNN34eac6UepgsR2lVIBX1qGCDyowgg8mBgorBgEEAYI3AwMB +# MYIPFjCCDxIGCSqGSIb3DQEHAqCCDwMwgg7/AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEIDpK8HOXsIFEFjZTRMxoRKSUJEDNCFbb+iE8GDUxDt3rAgheYiDnwDWW +# JhgPMjAyNjEwMTUyMTIyNTdaMAMCAQECEHHciDEehJcio4/xmT3qHH6gggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# WTCCAlUCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMjI1N1owKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEIM2L1d0sO6IO +# lASlHFmd9jlQIsjs1dMNr/kNdun1Sz+vMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEgwRgIhALcapGqWCFks0TlPeAI3O44M1AAiwT6I/0IAeeFh3cocAiEA2MPIZDbW +# LKsDrZbSsafvwHCcCGHWU/Rg+WMKGRjFKd8= +# SIG # End signature block diff --git a/package/LICENSE b/package/LICENSE new file mode 100644 index 0000000..3e9407d --- /dev/null +++ b/package/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Nicolas Fabert + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. \ No newline at end of file diff --git a/package/PackageIntegrity.psd1 b/package/PackageIntegrity.psd1 new file mode 100644 index 0000000..c0ae6fc --- /dev/null +++ b/package/PackageIntegrity.psd1 @@ -0,0 +1,218 @@ +# PRA Remote Mailbox 2.2.0 - authenticated package integrity manifest +# Generated only after the final stable-file signatures and timestamps. +@{ + SchemaVersion = 1 + Algorithm = 'SHA256' + SignerThumbprint = '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' + Files = @( + @{ Path = 'Invoke-PraRemoteMailbox.ps1'; Sha256 = '6DD311E48D1A27025D5E8DFAC1EABEFA0816B148B95A89F745D784E5CF96E346' } + @{ Path = 'module\PRA.Common.psm1'; Sha256 = 'BE5862F89963DAF99A3886CCCF253563384414172B1CB310667A7B63E4031552' } + @{ Path = 'module\PRA.Directory.psm1'; Sha256 = '5F3EBD0788E508464D2E479E06CF580301DB5EC4881383C8F247AEE365F97C91' } + @{ Path = 'module\PRA.Backup.psm1'; Sha256 = 'AD48248F353D96EA880F62F735E01D5C4DF3D933B52589A7B16BB4C08B4F8C75' } + @{ Path = 'module\PRA.Cloud.psm1'; Sha256 = '954C114D3FD951CFB5C6AB2AA1EE4A82585681FF29D4AFD31AD7D1FC34B71982' } + @{ Path = 'module\PRA.Gui.psm1'; Sha256 = '4D0F6D4BE4250A2CCDFC16471F5784D51F6B52AC2FBEAAFBF728CDE8C45E34DF' } + @{ Path = 'module\PRA.Gui.Directory.ps1'; Sha256 = '6D56397B34C7BCD8F662CC4D15009797E5BB940C984DC7928D8747B18414B00D' } + @{ Path = 'module\Test-PackageIntegrity.ps1'; Sha256 = 'BA9BD1786345ADA21DB67694B51C86CD7C3348C7EF5AF158E0B41D1CA705F78B' } + @{ Path = 'module\PRA.Gui.xaml'; Sha256 = '56BC119F3D3B4A0B2E5EBE625D094F81C12817EA4611ADCCC44E07E1AD54D633' } + @{ Path = 'templates\Report.template.html'; Sha256 = '3957F1B1461611A93BED834AE254B6BC6BD165C9719066F5EDFB9A3CAFB5174B' } + @{ Path = 'config\Targets.sample.csv'; Sha256 = '564C746AFDE5A5EADEBFD4449A7BB372B4D63E8B7C8352ACF825458650A458EF' } + @{ Path = 'config\SharedPermissions.sample.csv'; Sha256 = '7838261190B01E705505EAE8C1664FCFD9143E4E3F39D3E0968A02A0B7951B5F' } + @{ Path = 'README.md'; Sha256 = 'FFA7734444412C484B867F37045DF94876E0A9D7C1BB99FAB1B85C31EDB714DB' } + @{ Path = 'LICENSE'; Sha256 = 'A91A28EED601C15D06E439F83666F0EBE1AA7897DE37D350108147C7804FD94B' } + @{ Path = 'docs\PraRemoteMailbox-Guide.html'; Sha256 = '98CDDE6FAA0EA1128E9EA59759FEFC9E10E63BDB719E2847409DCD7C82A134F2' } + @{ Path = 'docs\PraRemoteMailbox-Guide.md'; Sha256 = 'ABA1C27D83902075E1B27BA527B3A946394DB9441463D1287A8B2A96004A93C3' } + @{ Path = 'docs\images\console-apply.png'; Sha256 = 'C65D5B92591A3E37C9E0C4491F6A7A80B7D16532122816ED8F47CE1B9E179D1E' } + @{ Path = 'docs\images\console-preview.png'; Sha256 = '31467C68B0D2FEB9E595351A300012F12E25FD0C361FCDEBD3C4AA5802A55B6E' } + @{ Path = 'docs\images\gui-fluent.png'; Sha256 = '9AF642ACCFED616A99E4A83F892BFF650C90E663D978706B5BDC79A19254E9A8' } + @{ Path = 'docs\images\readme-banner-dark.png'; Sha256 = '76C7ABE36BFB819216A5F49CB1DAEB6D903CA95DBC1580562E69776C00F562D7' } + @{ Path = 'docs\images\readme-banner-light.png'; Sha256 = '6DC70A2FFC5075D0AFDF81554D1790D3958F3DDDED22A682F9238CF7A9B27ABA' } + @{ Path = 'docs\images\readme-flows-dark.png'; Sha256 = 'FE20BEFBD53D99EAF3ECDC460A6A1D29BFDBF225F87C6A762A4C9940259FEE9A' } + @{ Path = 'docs\images\readme-flows-light.png'; Sha256 = 'DD71C49C5B99CAF371A92645CBC531F80604CD252B24E5A31E7056544EF6CBEF' } + @{ Path = 'docs\images\readme-how-dark.png'; Sha256 = '9CFA889F4790EAA6A38DCD198A31BA4988A3B5A9D17FB0870E8E4349A8C7F3D8' } + @{ Path = 'docs\images\readme-how-light.png'; Sha256 = '9A339B1BB85CDF6B030B8A3B9619490CF7FEFA3D5ED6ADE26D7D82EBFF9E1F09' } + @{ Path = 'docs\images\readme-permissions-dark.png'; Sha256 = '4132480C47D0B077087F03E783701DA24DAD6381B6141781E23752E33F6E3613' } + @{ Path = 'docs\images\readme-permissions-light.png'; Sha256 = 'DB705482D633EDD17E8558838ECF3418FCCCE06146516E69183FEA3288089F07' } + @{ Path = 'docs\images\readme-principles-dark.png'; Sha256 = '0A41BDBEADB03DB5CD23926F11BCEA0676E13C905C81687E330DD3E2854085ED' } + @{ Path = 'docs\images\readme-principles-light.png'; Sha256 = 'DFDAADE0A9572D623717B25FBB0D11FA31899C96B9AF3333B76EC06451C4E39A' } + @{ Path = 'docs\images\report-warning.png'; Sha256 = '7908923CC798FF608B6E299992F7038CE3083EB8A79F4BECC1BB65B7107DEA31' } + @{ Path = 'docs\images\report.png'; Sha256 = '1348E449D5CEFC85829FB453113854C11A061837A1CFDA06F5EDF1E9C0287328' } + @{ Path = 'CHANGELOG.md'; Sha256 = 'B458B0ED23BD7DCB95E69A711E826E9F48D8458A1A459FBE1D79A4C837820FFC' } + ) +} + +# SIG # Begin signature block +# MIIghgYJKoZIhvcNAQcCoIIgdzCCIHMCAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCggMArwdUumYbf +# 3/gy4rsyWK0F/RbUcwU+SZwktVZpGaCCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISbTCCEmkCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCANrZ/FjzwI +# UnPgcBa+I4N1dBB4i8jtBk0Z7GcNutOqBTANBgkqhkiG9w0BAQEFAASCAgAvfjm3 +# 75LBwaay4Ekcbdw8idM1xk3rzmMwZmY7Y9r4x/Cq5hFPg+9lTtPYMxompXnMHixd +# 9ITcU67ENktbzeqzy+a/NbAzFSUHrg9TMVQcvfJR6n52kWo0o9NO7r9jhPlqsHaG +# LUkRi0yKLDQVbCRn0UtgmXIrv4mLOLcG4G8MseqFnaTaZzjEfLK0De0SLGGc0drU +# VnOIBYKi8FebL21MG19ZfwvBZtnvfnuDJ9flIOKH5R0Qa3Lqbdq7YMSEKAIXq5Jh +# GqGGj3bugd1o5bircHXko9+fjodXe0E9vSgo3rC8BJoBBdKA7gD9yW3tvoYtdwWT +# xk8UXnmRbxMZKn2870AiQXrPhMhbRkb2fZKqtP1o5om3gkwewKhEDl6KMWyCjddu +# CLFiLVznPdz/3de1fbKO7ufbgF5Ax/H8rp+fc7ChmsoV0nckb2z4yicq+XAGOVjw +# UjWvcSo9hLYDnhK7vasNP8eMbWD4Gd8oTPrlnkkojxJgEOGrsvWIQRwQzWq75B9V +# M2a3osrkdW3h7LwLL2j6tH5SN11pCmRgUBIYsaMc/YTDo/97juiAkDozaEsM7D7g +# iuoCMBanQFI8VpDrUwrlrdG0bHE8mASgXDoEi9X4fAfmTd9l6kOfsU3FAlB6AovX +# MRzZod3iEciRIloOmJzgjC3hD8uHvqHCicztkKGCDyowgg8mBgorBgEEAYI3AwMB +# MYIPFjCCDxIGCSqGSIb3DQEHAqCCDwMwgg7/AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEICfMdnDkDs+b4Dzcf41BUH4OvbSN9t49TVfiZAs0UnFOAghjLIQUMULZ +# TxgPMjAyNjEwMTUyMTM4MjVaMAMCAQECEEu4aGa7vH/Ogeb+KASdMhGgggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# WTCCAlUCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMzgyNVowKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEICdV7tTkOsi9 +# Yf89DOTnj9FCmmR1LbtJVsflhlTTA5GRMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEgwRgIhAMFWt6jh7XRgyQDO4h7LcMxnMCF1A9FDW5hE5CuMLNIuAiEA5fhwgh8p +# NjQKRSvXkqNmd2O0gU/hRVPqfK6h3Mr7/v4= +# SIG # End signature block diff --git a/package/README.md b/package/README.md new file mode 100644 index 0000000..e2fabe6 --- /dev/null +++ b/package/README.md @@ -0,0 +1,77 @@ +# PRA Remote Mailbox + +When the on-premises Exchange servers are lost, gives every user a mailbox in Exchange Online and rolls everything back when Exchange is available again. Windows PowerShell 5.1 engine, optional WPF window. Author: Nicolas Fabert. Version 2.2.0. + +This folder contains everything needed to run the tool: `Invoke-PraRemoteMailbox.ps1`, its modules and WPF window, the configuration and CSV samples, the report template and the administrator guide. Tests and build tools stay outside it, in the repository. + +> [!IMPORTANT] +> Files downloaded from the Internet may be blocked by Windows and fail to run. Before using this project, unblock every file in the downloaded folder: +> +> ```powershell +> Get-ChildItem "C:\Chemin\Du\Dossier" -Recurse -File -Force | Unblock-File +> ``` +> +> Replace the example path with the folder where you downloaded or extracted this project. +> +> The `Install-Module` commands in this documentation use `-Force`, so they also update or reinstall a module that is already installed. If an older version still conflicts, close every PowerShell window, open a new one (as administrator for `-Scope AllUsers`), run `Uninstall-Module -AllVersions -Force`, then run the `Install-Module` command again. + +## Requirements + +- Windows PowerShell 5.1 for the operations; PowerShell 7.5+ only for the native Fluent window (operations still run in Windows PowerShell 5.1). +- RSAT `ActiveDirectory`, `ExchangeOnlineManagement` 3.10 or later, `Microsoft.Graph.Authentication` and `Microsoft.Graph.Users`. +- A hybrid Exchange organisation synchronised by Entra Connect, and the permissions listed in the administrator guide, chapter 4. +- Windows Terminal for emoji and colours. +- To read the HTML report: a current desktop Microsoft Edge or Google Chrome (the report is compressed and needs `DecompressionStream`; the CSV with the same name works everywhere). + +## Quick start + +```powershell +notepad .\config\PraRemoteMailbox.config.psd1 # scope, licence group, routing domain, Entra Connect, tenant + +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com # preview: nothing is written +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply # backup, AD, sync, Exchange Online +.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Mode Apply # roll a batch back +.\Invoke-PraRemoteMailbox.ps1 -Action Check -Identity jdupont@contoso.com # provisioned or not in Exchange Online +pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui # optional WPF window +``` + +Keep the `Backups` folder on a durable, protected volume: the backups are the only way back. + +## Package integrity + +The tool runs only from a package signed by its owner. `module\Test-PackageIntegrity.ps1` and `PackageIntegrity.psd1` must carry a valid, timestamped signature of `0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6`; every PowerShell file must be signed by the same owner; every stable file (modules, XAML, template, sample CSV files, README, licence, guide, images) must match the signed manifest. The entry script, each module and the GUI helper check this first. A changed, missing, duplicated, unexpected or reparse-point file stops the tool before any import, window or operation. There is no unsigned mode, switch or environment bypass; do not disable your execution policy or this check to clear an error. + +Edit only `config\PraRemoteMailbox.config.psd1` and your own CSV lists in `config\`: they are data, outside the check, like the generated `Backups`, `logs` and `reports` folders. A signature detects a change; it does not stop the file system from being written. + +Output folders: `Storage.BackupFolder`, `Logging.Folder` and `Report.Folder` must be either a folder outside the package or, inside the package, exactly the canonical `Backups`, `logs` and `reports` folder (a sub-folder of its own canonical folder is accepted, the name is case-sensitive). Any other folder inside the package, such as `.\audit`, is refused with a clear message before a file is written, because the integrity check would reject the unexpected files at the next start. The check uses the physical location resolved by Windows (`\\?\` prefix, junction, SUBST, 8.3 name and legacy aliases included) and refuses a path it cannot resolve. Choose an external path for a custom location. + +## Content + +| Item | Role | +|---|---| +| `Invoke-PraRemoteMailbox.ps1` | Entry script. | +| `module\` | Modules, WPF window (`PRA.Gui.xaml`), direct GUI helper and the integrity verifier. | +| `config\` | Configuration to fill in and the two CSV samples. | +| `templates\` | HTML report template. | +| `docs\` | Administrator guide, Markdown and self-contained HTML, with images. | +| `PackageIntegrity.psd1` | Owner-signed manifest of the stable files. | +| `README.md` | This package readme. | +| `LICENSE` | MIT license. | +| `CHANGELOG.md` | Change log (added to release packages by the package builder). | + +## Documentation + +- [Administrator guide](docs/PraRemoteMailbox-Guide.md) - also `docs/PraRemoteMailbox-Guide.html`, a single file to open locally + +Project page, releases and change log: https://github.com/Nico77600/PraRemoteMailbox + +License: [MIT](LICENSE). + +## Disclaimer + +This Script is a Personal project. +It's provided "AS-IS". It's not an official Microsoft product so no support can be expected from Microsoft. + +As any scripts you must read carefully the documentation and test it first in a Test environment before any run in Production. + +The tool changes production objects in Active Directory and creates mailboxes in Exchange Online: run the preview, review the plan, keep the backups and test in a lab before using it in a real disaster. diff --git a/config/PraRemoteMailbox.config.psd1 b/package/config/PraRemoteMailbox.config.psd1 similarity index 97% rename from config/PraRemoteMailbox.config.psd1 rename to package/config/PraRemoteMailbox.config.psd1 index 8d0fe79..1a08fdc 100644 --- a/config/PraRemoteMailbox.config.psd1 +++ b/package/config/PraRemoteMailbox.config.psd1 @@ -2,14 +2,16 @@ # PRA Remote Mailbox - configuration file # -------------------------------------------------------------------------- # Author : Nicolas Fabert -# Version : 2.1.0 +# Version : 2.2.0 # # This file is read by Invoke-PraRemoteMailbox.ps1. It is a PowerShell data # file: text between quotes, $true / $false, numbers, and @( ) for lists. # Lines starting with # are comments. An unknown setting is refused # (spelling mistakes are detected). # -# Relative paths (.\Backups, .\logs ...) are relative to the tool folder. +# Relative paths (.\Backups, .\logs ...) are relative to the tool folder. Inside the tool folder only +# .\Backups, .\logs and .\reports are accepted for BackupFolder, Logging.Folder and Report.Folder (the signed +# package must not receive other files); use a folder outside the tool folder for anything else. # Everything is set here; the command line only chooses the action # (see docs\PraRemoteMailbox-Guide.md, chapter 6). # diff --git a/config/SharedPermissions.sample.csv b/package/config/SharedPermissions.sample.csv similarity index 97% rename from config/SharedPermissions.sample.csv rename to package/config/SharedPermissions.sample.csv index 750be23..5cceba4 100644 --- a/config/SharedPermissions.sample.csv +++ b/package/config/SharedPermissions.sample.csv @@ -1,2 +1,2 @@ -Shared,Group -shared01,CN=SG-Shared01,OU=Groups,DC=contoso,DC=com +Shared,Group +shared01,CN=SG-Shared01,OU=Groups,DC=contoso,DC=com diff --git a/config/Targets.sample.csv b/package/config/Targets.sample.csv similarity index 94% rename from config/Targets.sample.csv rename to package/config/Targets.sample.csv index 623aad8..e8a0e80 100644 --- a/config/Targets.sample.csv +++ b/package/config/Targets.sample.csv @@ -1,3 +1,3 @@ -Identity -user01@contoso.com -shared01@contoso.com +Identity +user01@contoso.com +shared01@contoso.com diff --git a/docs/PraRemoteMailbox-Guide.html b/package/docs/PraRemoteMailbox-Guide.html similarity index 56% rename from docs/PraRemoteMailbox-Guide.html rename to package/docs/PraRemoteMailbox-Guide.html index 15d4ddb..a57594f 100644 --- a/docs/PraRemoteMailbox-Guide.html +++ b/package/docs/PraRemoteMailbox-Guide.html @@ -1,163 +1,163 @@ - - -PRA Remote Mailbox - Administrator guide - - - -
Administrator guide

PRA Remote Mailbox

Version 2.1.0Updated 2026-10-09Nicolas FabertWindows PowerShell 5.1 engine; PowerShell 7.5+ Fluent windowBackup before every change

When the on-premises Exchange servers are lost, PRA Remote Mailbox turns the on-premises mailboxes into remote mailboxes, so that every user gets a mailbox in Exchange Online within the hour — and rolls everything back when Exchange is available again. Only Active Directory is changed on-premises, and every change is backed up first.

+ + +PRA Remote Mailbox - Administrator guide + + + +
Administrator guide

PRA Remote Mailbox

Version 2.2.0Updated 2026-10-14Nicolas FabertWindows PowerShell 5.1 engine; PowerShell 7.5+ Fluent windowBackup before every change

When the on-premises Exchange servers are lost, PRA Remote Mailbox turns the on-premises mailboxes into remote mailboxes, so that every user gets a mailbox in Exchange Online within the hour — and rolls everything back when Exchange is available again. Only Active Directory is changed on-premises, and every change is backed up first.

Important

Files downloaded from the Internet may be blocked by Windows and fail to run. Before using this project, unblock every file in the downloaded folder:

@@ -179,7 +179,7 @@

The window opens with pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui (native Fluent with PowerShell 7.5+), or powershell.exe -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui (compatible WPF). -It starts no operation automatically. Version 2.1.0 has offline validation only; no new +It starts no operation automatically. Version 2.2.0 (unreleased source) has offline validation only; no new live-tenant campaign has been performed for this version.

Part IUnderstand
Chapter 1

Project background

@@ -531,7 +531,7 @@

Permissions

Certificate sign-in for unattended runs: annex C.

Chapter 5

Installation

    -
  1. Copy the package folder (PraRemoteMailbox-2.1.0, produced by tools\New-PraPackage.ps1) to the server, for example D:\PRA\PraRemoteMailbox.
    2. +
  2. Copy the package folder (PraRemoteMailbox-2.2.0, the signed package built by tools\New-PraPackage.ps1, or the extracted release ZIP) to the server, for example D:\PRA\PraRemoteMailbox.
  3. Unblock the files if they were downloaded: Get-ChildItem D:\PRA\PraRemoteMailbox -Recurse -File -Force | Unblock-File.
  4. Put Backups on a durable volume (default: .\Backups in the tool folder; see Storage.BackupFolder).
  5. Fill in the configuration (chapter 6), then run a Preview: it checks the configuration, AD access and the scope without writing anything.
    6. @@ -563,7 +563,15 @@

    Permissions

    docs\ -this guide (Markdown + HTML) +this guide (Markdown + HTML) and its images + + +PackageIntegrity.psd1 +owner-signed manifest: SHA256 of every stable file + + +README.md, LICENSE, CHANGELOG.md +project information Backups\, logs\, reports\ @@ -571,6 +579,12 @@

    Permissions

+

Package integrity

+

package is verified every time it starts. module\Test-PackageIntegrity.ps1 and PackageIntegrity.psd1 must carry the owner's timestamped Authenticode signature (certificate thumbprint 0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6), every PowerShell file of the package must be signed by the same owner, and every stable file (modules, XAML, report template, sample CSV files, README, licence, guide, images) must match the signed manifest. A changed, missing, duplicated, unexpected or reparse-point file stops Invoke-PraRemoteMailbox.ps1, the modules and the GUI helper before any import, window or operation. There is no unsigned mode, no switch and no environment variable to bypass it. +covered, on purpose: config\PraRemoteMailbox.config.psd1 and the CSV lists you keep in config\ (your data) and the generated Backups\, logs\ and reports\. A signature detects a change; it does not stop the file system from being written.

+
+

Output folders. Storage.BackupFolder, Logging.Folder and Report.Folder must be either a folder outside the package or, inside the package, exactly the canonical Backups, logs and reports folder (a sub-folder of its own canonical folder is accepted, the name is case-sensitive). Any other folder inside the package, such as .\audit, is refused with a clear message before a file is written, because the integrity check would reject the unexpected files at the next start. Choose an external path for a custom location. The test uses the physical location resolved by Windows: a \\?\ prefix, an 8.3 name, a junction, a SUBST drive or an alias such as C:\Documents and Settings cannot hide the package (an accepted canonical folder is then used under its physical path), and a path whose location cannot be resolved is refused rather than assumed to be external.

+
Chapter 6

Configuration

Everything is set in config\PraRemoteMailbox.config.psd1 — the command line only chooses the action. The file is a PowerShell data file: text between quotes, $true / $false, numbers, @( ) for lists. An unknown setting is refused (a typing mistake never goes unnoticed). Relative paths are relative to the tool folder.

Identity of the environment

@@ -765,7 +779,7 @@

Files

Logging.Folder, Report.Folder, Report.Enabled -One log + one transcript per run; CSV + HTML report per run. +One log + one transcript per run; CSV + HTML report per run. Inside the package only .\logs and .\reports are accepted; use an external path for another location. Execution.Phase @@ -1118,11 +1132,13 @@

Exit codes

Chapter 9

Reading the results

The HTML report

-
HTML report
HTML report
-

One page per run in reports\: tiles with the counters (including Warnings), the next step, the warnings of the run, one row per object (filter box; a row with a warning has a yellow mark and the warning above its detail), and the run errors. It is self-contained (no external resource).

+
HTML report (synthetic example data)
HTML report (synthetic example data)
+

One page per run in reports\: tiles with the counters (including Warnings), the next step, the warnings of the run, one row per object, and the run errors. It is self-contained (no external resource, no network, no telemetry).

+

The rows are stored in the page as compressed chunks of 20,000 rows (gzip, then base64: compression, not encryption; protect the file like the CSV). When the page opens it decodes all chunks at once (eager, not lazy; about 0.3 s for 50,000 rows on the test PC), then shows only the rows in view: the Summary grid (the eight columns above) and the All 22 fields grid never hold more than 200 data rows in the page, whatever the number of rows. Scroll, or use the keyboard (arrows, Page Up/Down, Home/End, Enter for all the fields of a row). Filters (status, type, action, six yes/no flags, ten text fields and a search over the 22 fields) combine with AND, always inspect every row and show the filtered counts; Reset filters clears them. Export filtered CSV writes every matching row with the 22 fields (semicolon, UTF-8 with BOM, every field quoted, a cell starting with =, +, - or @ gets a leading '). The CSV written next to the report is unchanged and has the raw values. Warnings and run errors are listed 100 per page with their own filter; none is dropped.

+

Requirement: a current desktop Microsoft Edge or Google Chrome (the page needs DecompressionStream). Without it, without JavaScript, or if a chunk is missing or damaged, the page says so explicitly and displays no partial result; the run summary (tiles, next step) stays visible and the CSV with the same name holds every row. A report of 50,000 or 100,000 rows is for reading; Apply itself remains designed for the batch sizes of the guide.

Warnings

A warning never stops the run and never changes the exit code; it says that something was left aside on purpose and should be read. Today: the permission entries of a shared mailbox that point to an account no longer in AD (chapter 2). It is shown in four places: a yellow ▲ line in the console under the object, [WARN] in the log, the Warnings column of the CSV, and in the HTML report (Warnings tile, Warnings card, yellow mark on the row). The summary card of the console turns yellow and shows the last warnings.

-
Report of a preview with a warning (lab, 2026-10-01)
Report of a preview with a warning (lab, 2026-10-01)
+
Report of a preview with a warning (synthetic example data)
Report of a preview with a warning (synthetic example data)

Statuses

@@ -1231,6 +1247,10 @@

Code map

+ + + +
module\PRA.Gui.psm1, module\PRA.Gui.xaml WPF layout/theme, local state and input selection, preview guard, confirmation and Desktop child-process supervision. Optional PRA_EVENT_FILE JSONL channel carries start, step, item, summary and result events from the common module.
module\Test-PackageIntegrity.ps1Package verifier, run by the entry, every module and the GUI helper before they do anything.
Chapter 12

Modifying the tool

@@ -1247,7 +1267,7 @@

Change the routing ad

Add a cloud check

In Invoke-PraCloudPhase (PRA.Cloud.psm1): add the fact in Get-PraGraphFact or in the worker (Mailbox, Recipient), then include it in $mbok / $licok. A new Exchange Online write must go through Invoke-PraPermissionGrant (approval, proof, journal, one call, bounded re-read).

Change the console or the report

-

Texts and icons: PRA.Common.psm1, region 1-2. The HTML report: templates\Report.template.html (markers {{...}}, no code change). The CSV columns: $script:RowFields.

+

Texts and icons: PRA.Common.psm1, region 1-2. The HTML report: templates\Report.template.html (markers {{...}}; the data is written by Write-PraReportHtml, which fills {{DATA}}; no change of the data format without changing the viewer script). The template is covered by the package integrity check. The CSV columns: $script:RowFields.

PowerShell pitfalls met during the build

@@ -1301,9 +1321,9 @@

PowerShell pitfalls met during

Chapter 13

Testing a change

The gate (no directory, no tenant)

-
PowerShell
powershell.exe -NoProfile -File .\tests\Invoke-TestGate.ps1
+
PowerShell
powershell.exe -NoProfile -File .\tests\Invoke-TestGate.ps1   # in the repository; tests and tools are not part of the package
 

-
It checks every file (parse, UTF-8 BOM, help), runs PSScriptAnalyzer (Windows PowerShell 5.1 compatibility profiles), then the Pester suites tests\PraRemoteMailbox.Tests.ps1 and tests\PraRemoteMailbox.Gui.Tests.ps1: synthetic AD and ADSync modules, a synthetic cloud barrier, the real entry script in a separate Windows PowerShell process, and the WPF window without live connections. It proves in particular: no write before the complete backup, stop at the first error, no write in Preview/-WhatIf, no Apply without confirmation in a non-interactive process, memory bounds with 13 shared mailboxes × 500 trustees, proofs and Finalize packages, GUI phase/command boundaries and preview invalidation. Evidence: tests\evidence\gate\<date>\ (RESULT.txt, gate-result.json, Pester XML).

+
It checks every file (parse, UTF-8 BOM, help), runs PSScriptAnalyzer (Windows PowerShell 5.1 compatibility profiles), then the Pester suites tests\PraRemoteMailbox.Tests.ps1 and tests\PraRemoteMailbox.Gui.Tests.ps1 and tests\PackageIntegrity.Tests.ps1 (the integrity logic on a controlled copy where only the signature call is substituted, plus the real package, which fails closed unless every file carries the valid owner signature): synthetic AD and ADSync modules, a synthetic cloud barrier, the real entry script in a separate Windows PowerShell process, and the WPF window without live connections. It proves in particular: no write before the complete backup, stop at the first error, no write in Preview/-WhatIf, no Apply without confirmation in a non-interactive process, memory bounds with 13 shared mailboxes × 500 trustees, proofs and Finalize packages, GUI phase/command boundaries and preview invalidation. Evidence: tests\evidence\gate\<date>\ (RESULT.txt, gate-result.json, Pester XML).

 
Requirements: Pester 5 or later and PSScriptAnalyzer 1.25.0 (machine-wide modules). Every test is mandatory: a skipped or missing test fails the gate.

 
Release 2.0.0 (2026-10-01, VMLLM): 279 tests, 279 passed, 0 analyzer error, about 12 minutes — evidence tests\evidence\gate\v2.0.0-release. The only analyzer warnings on the delivered files are expected: Write-Host in the console module (14, by design) and ConvertFrom-Markdown in the documentation builder (6, PowerShell 7 tool). Compared with the 325 tests of 1.3.6, the 61 combinations of the removed path options (-BackupFile, -StateFile, -LogPath, -TranscriptPath, -ReportDirectory) are replaced by 9 tests of -Batch and of the confirmation.

 
The lab campaign

@@ -1652,7 +1672,7 @@ 
The lab campaign

 
Every JSON has a .sha256 file; a mismatch is refused. Version 2.0.0 reads the batches of 1.3.x (tested: Recover of a 1.3.6 Convert batch in the lab).
Annex E

Versioning and upgrade from 1.3.6

    -
  • The version is in Invoke-PraRemoteMailbox.ps1 (Version = '2.1.0', GUI call and help .NOTES), in each module header, in the configuration header, in README.md and CHANGELOG.md, and in the front matter of this guide. Change them together.
    • +
  • The version is in Invoke-PraRemoteMailbox.ps1 (Version = '2.2.0', GUI call and help .NOTES), in each module header, in the configuration header, in README.md and CHANGELOG.md, and in the front matter of this guide. Change them together.
  • Release checklist: gate PASS · lab campaign (annex B) · pwsh tools\Build-Documentation.ps1 (PowerShell 7.4+, documentation only) · tools\New-PraPackage.ps1 · git tag vX.Y.Z.

From 1.3.6: keep the old Backups folders; copy the values of DRP-Config.psd1 into the new file (same sections; ADConnect → EntraConnect; BackupFolder/LogFolder/ReportFolder → Storage/Logging/Report; Safety → Storage.ForbiddenBackupRoots); keep the same Environment to use the old batches. Command mapping: see CHANGELOG.md (table "Changed").

@@ -1737,45 +1757,45 @@

The lab campaign

No defect was found in the backup, receipt and proof engine; its logic is unchanged in 2.0.0 and covered by the gate.

-
-
PRA Remote Mailbox 2.1.0 · Nicolas Fabert · generated 2026-10-09 10:39 from PraRemoteMailbox-Guide.md
- - - + +
PRA Remote Mailbox 2.2.0 · Nicolas Fabert · generated 2026-10-15 13:34 from PraRemoteMailbox-Guide.md
+ + + \ No newline at end of file diff --git a/docs/PraRemoteMailbox-Guide.md b/package/docs/PraRemoteMailbox-Guide.md similarity index 91% rename from docs/PraRemoteMailbox-Guide.md rename to package/docs/PraRemoteMailbox-Guide.md index 7c18d04..9d6ee69 100644 --- a/docs/PraRemoteMailbox-Guide.md +++ b/package/docs/PraRemoteMailbox-Guide.md @@ -1,887 +1,900 @@ ---- -title: PRA Remote Mailbox -subtitle: Administrator guide -version: 2.1.0 -author: Nicolas Fabert -updated: 2026-10-09 -runtime: Windows PowerShell 5.1 engine; PowerShell 7.5+ Fluent window -safety: Backup before every change ---- - -# PRA Remote Mailbox — Administrator guide - -> When the on-premises Exchange servers are lost, **PRA Remote Mailbox** turns the on-premises mailboxes into **remote mailboxes**, so that every user gets a mailbox in **Exchange Online** within the hour — and rolls everything back when Exchange is available again. Only Active Directory is changed on-premises, and **every change is backed up first**. - -> [!IMPORTANT] -> Files downloaded from the Internet may be blocked by Windows and fail to run. Before using this project, unblock every file in the downloaded folder: -> -> ```powershell -> Get-ChildItem "C:\Chemin\Du\Dossier" -Recurse -File -Force | Unblock-File -> ``` -> -> Replace the example path with the folder where you downloaded or extracted this project. -> -> The `Install-Module` commands in this documentation use `-Force`, so they also update or reinstall a module that is already installed. If an older version still conflicts, close every PowerShell window, open a new one (as administrator for `-Scope AllUsers`), run `Uninstall-Module -AllVersions -Force`, then run the `Install-Module` command again. - -```cards -target | What it does | **Convert**: on-premises mailbox → remote mailbox (AD attributes, licence group, Entra Connect, shared mailbox permissions in Exchange Online). -refresh | How to go back | **Recover** a Convert batch: original AD attributes, licence removed, cloud shared mailboxes removed before the on-premises ones come back. -shield | How it protects | Preview first; a complete, re-read **backup** of every object before the first write; the first error stops everything. -terminal | How it is used | One script, one configuration file, one short **batch ID** that links the steps together. -``` - -## Quick start - -```steps -Check the prerequisites | Windows PowerShell **5.1**, RSAT `ActiveDirectory`, `ExchangeOnlineManagement` 3.10+, `Microsoft.Graph.Authentication` and `Microsoft.Graph.Users` (chapter 4). -Edit the configuration | `config\PraRemoteMailbox.config.psd1`: scope, licence group, routing domain, Entra Connect server, tenant (chapter 6). -Preview | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert` — targets and planned AD changes, **nothing is written**. -Apply | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply` — one confirmation, then backup, AD, sync, Exchange Online. -Keep the batch ID | The summary prints it (e.g. `efb9d60a`) with the next command: `-Action Recover -Batch efb9d60a` rolls the batch back. -``` - -> [!IMPORTANT] -> **Preview is the default.** Without `-Mode Apply` (or with `-WhatIf`) the tool only reads. With `-Mode Apply` it asks **one** confirmation after showing the plan; `-Force` skips it for unattended runs. No option ever skips a safety check. - -> [!TIP] -> **Ready-to-use commands** — one user, a whole OU, only the shared mailboxes, a list, the roll-back: chapter 8, recipes 1 to 6. - -The **window** opens with `pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui` (native Fluent with -PowerShell 7.5+), or `powershell.exe -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui` (compatible WPF). -It starts no operation automatically. Version **2.1.0** has offline validation only; no new -live-tenant campaign has been performed for this version. - -# Part I · Understand - - -## 1. Project background - -**The disaster scenario** - -- The mailboxes of the organisation are hosted **on-premises** (Exchange Server, hybrid with Exchange Online). -- The disaster recovery plan (PRA) covers the **loss of the on-premises Exchange servers**: mail must work again quickly, without waiting for their reconstruction. -- **Active Directory and Entra Connect are still available**: the identities, groups and synchronisation work. -- The decision is to give every user a **new, empty mailbox in Exchange Online** and to recreate the access to the shared mailboxes. The content of the lost mailboxes is **not** migrated by this tool (it comes back from the Exchange recovery, or from a backup product). -- When Exchange is back, the objects are **rolled back** to their on-premises state. - -**Why a tool** - -Turning an on-premises mailbox into a remote mailbox means rewriting about ten Exchange attributes in AD, per object, in a precise way, for hundreds of objects, under stress. A wrong value or a lost value cannot be recovered without a backup: this happened with the first script (version 1.2.5), whose backup was written **after** the changes. - -| Constraint | Value | -|---|---| -| Objects | user mailboxes, shared mailboxes (rooms and equipment possible) | -| Systems changed | Active Directory (attributes, licence group), Entra Connect (one sync cycle), Exchange Online (shared mailbox permissions) | -| Systems NOT needed | Exchange on-premises (it is down) | -| Servers | one server (AD + cloud), or two servers: an AD server and an isolated "cloud" server | -| Traceability | backups, journals, logs, transcripts and reports kept for every run | - - -## 2. How it works - -### Convert - -The default flow, on one server (`Execution.Phase = 'Both'`): - -```flow -directory | Read AD | scope, attributes, permissions -arrow | Backup | JSON + CLIXML + SHA-256, re-read -target | Write AD | remote mailbox, licence group -arrow | Sync | one Entra Connect cycle -cloud | Exchange Online | mailbox, licence, permissions -``` - -| Step | What happens | -|---|---| -| **Preview** | Every object of the scope is read, checked (it must be an on-premises mailbox) and planned. The console shows what will change. | -| **Exchange Online pre-check** | (Apply, phase Both) sign-in, every target and every permission holder resolved in Exchange Online — before any AD write. | -| **Backup** | One private folder `Backups\Batch-`: the typed values to restore (JSON), every AD value (CLIXML), their SHA-256, then everything is **re-read and compared** with the plan. | -| **AD changes** | Per object: current state re-checked, `Set-ADUser`, AD re-read, licence group, AD re-read. The **first error stops the batch**. | -| **Entra Connect** | One Delta cycle, local or on `EntraConnect.Server`; the tool waits for its end. | -| **Exchange Online** | The tool waits (up to `Polling.TimeoutMinutes`) for the mailboxes and the licences, then grants FullAccess / SendAs / SendOnBehalf on the shared mailboxes and checks each grant. | - -### What changes in AD - -| Attribute | User mailbox | Shared mailbox | -|---|---|---| -| `msExchRecipientTypeDetails` | 1 → **2147483648** (RemoteUserMailbox) | 4 → **34359738368** (RemoteSharedMailbox) | -| `msExchRemoteRecipientType` | → **1** (3 with archive) | → **97** (99 with archive) | -| `msExchRecipientDisplayType` | → -2147483642 | → -2147483642 | -| `targetAddress` | → `SMTP:alias@tenant.mail.onmicrosoft.com` | same | -| `proxyAddresses` | + `smtp:alias@tenant.mail.onmicrosoft.com` | same | -| `homeMDB`, `homeMTA`, `msExchHomeServerName`, `mDBUseDefaults`, `msExchMailboxGuid` | cleared | cleared | -| retention tag (`extensionAttribute1` by default) | → `Converted` | → `Converted` | -| licence group | **added** | never (a shared mailbox has no licence) | - -### Shared mailbox permissions — where they come from - -Exchange on-premises is down: the tool cannot ask it (`Get-MailboxPermission` is not available). It reads the permissions where Exchange keeps a copy in **Active Directory**, on the account of the shared mailbox itself (default `SharedMailbox.PermissionSource = 'AD'`): - -| Right granted in Exchange Online | Read in AD (attribute of the shared mailbox account) | Written there on-premises by | -|---|---|---| -| **FullAccess** | `msExchMailboxSecurityDescriptor` — *Allow* entries with the FullAccess right | `Add-MailboxPermission -AccessRights FullAccess` | -| **SendAs** | `nTSecurityDescriptor` (the AD permissions of the account) — *Allow* entries with the extended right **Send As** | `Add-ADPermission -ExtendedRights Send-As`, or the Exchange admin center | -| **SendOnBehalf** | `publicDelegates` | `Set-Mailbox -GrantSendOnBehalfTo` | - -```flow -directory | Read AD | 3 attributes of the shared mailbox -arrow | Clean up | groups → users, exclusions -batch | Backup | lists of UPNs in the batch -arrow | Pre-check | every holder found in Exchange Online -cloud | Grant | once, then re-read -``` - -1. Only explicit *Allow* entries are kept: inherited and *Deny* entries are ignored. -2. System and administration accounts are never reproduced: SELF, `NT AUTHORITY\…`, `BUILTIN\…`, Domain / Enterprise / Schema Admins, Organization Management, Exchange Trusted Subsystem, Exchange Servers, Exchange Windows Permissions, Managed Availability Servers, Delegated Setup — plus the accounts listed in `SharedMailbox.ExcludeTrusteeSamAccountNames` (service accounts, for example). -3. A **group** is expanded to its users, nested groups included: Exchange Online receives one permission **per user** (UPN), never the group itself (lab T16). A user added to the group later does not get the access by itself. -4. An entry that points to an account **no longer in AD** ("Account Unknown": deleted account, or an account of another domain) cannot be granted: it is **ignored and reported as a warning** — a yellow `▲` line under the shared mailbox, a `[WARN]` line in the log, the `Warnings` column of the CSV, and the *Warnings* tile and card of the HTML report. The run goes on and its exit code does not change. Every other holder must exist in AD with a UPN. -5. The lists are saved in the backup of the batch (`SharedPermissions` of each record): the proof of what was granted. -6. Apply (phase `Both`): **before any AD write**, every holder is looked up in Exchange Online. An unknown holder stops the run before AD is changed. A user still on-premises is fine: Entra Connect has synchronised it as a mail user. -7. When the cloud shared mailbox exists: `Add-MailboxPermission` (FullAccess, with `AutoMapping`), `Add-RecipientPermission` (SendAs), `Set-Mailbox -GrantSendOnBehalfTo` (SendOnBehalf). A permission already present is only verified; a missing one is granted **once**, then re-read until Exchange Online shows it. In a hybrid organisation, Entra Connect usually brings `publicDelegates` along with the mailbox: SendOnBehalf is then already there and only verified (lab T16). - -**How to check before the Apply**: the preview prints, under each shared mailbox, `FullAccess to`, `SendAs to` and `SendOnBehalf to` with the first holders; the log of the run has the complete lists (lines `PERMISSIONS | …`). After the Apply, every grant is printed and the report shows `Permissions verified=6/6`. - -**Other sources**, when the AD entries are not reliable: - -| `PermissionSource` | Holders | -|---|---| -| `'Csv'` | file `SharedMailbox.CsvPath`, columns `Shared,Group` (see `config\SharedPermissions.sample.csv`): the members of `Group` get FullAccess **and** SendAs on `Shared` | -| `'CustomAttribute'` | the AD group whose `SharedMailbox.CustomAttribute` (e.g. `extensionAttribute5`) contains the name of the shared mailbox: its members get FullAccess and SendAs | -| `'None'` | no FullAccess / SendAs | - -SendOnBehalf always comes from `publicDelegates` (set `CaptureSendOnBehalf = $false` to skip it). A Recover does not remove the cloud permissions one by one: they disappear with the cloud mailbox; Convert never changes the on-premises permissions. - -### Recover - -The way back, from the Convert batch: - -```flow -batch | Convert batch | original values -arrow | AD | users restored, shared → MailUser -cloud | Exchange Online | mailboxes gone? -arrow | Final restore | shared + tags -check | Done | on-premises again -``` - -- **Users** get their original attributes back and leave the licence group (unless they were already members before Convert). -- **Shared mailboxes** are first **deprovisioned** in Exchange Online (`msExchRemoteRecipientType` 8, MailUser): their on-premises attributes come back only when Exchange Online confirms that the cloud mailbox is gone. Otherwise two mailboxes would exist for the same object. -- The **retention tag** keeps the value `Converted` until the cloud check, then gets its original value back. -- On two servers, the cloud server writes a **Finalize package** that the AD server applies (`-Action Finalize`). - -### The four actions - -| Action | Purpose | Writes | -|---|---|---| -| `Convert` | on-premises mailbox → remote mailbox | AD, Entra Connect, Exchange Online permissions | -| `Recover` | roll back a Convert batch | AD, Entra Connect | -| `Finalize` | last step of a Recover on two servers | AD, Entra Connect | -| `Check` | is a mailbox provisioned / deprovisioned / retained? | nothing | - - -## 3. Things to know - -> [!WARNING] -> **The backups are the only way back.** A Recover restores what the Convert batch saved — nothing else. Keep the `Backups` folder on a durable, protected volume and copy it outside the server after each Apply. Never edit a backup: every file is checked by SHA-256 and a changed file is refused. - -> [!CAUTION] -> **Convert creates new, empty mailboxes** in Exchange Online (`msExchMailboxGuid` is cleared). The content of the on-premises mailboxes is not moved. A Recover **deprovisions** the cloud mailboxes: mail received in the cloud during the disaster must be exported first if it has to be kept (or protected by a retention policy, see `Retention` in chapter 6). - -> [!NOTE] -> **Nothing is automatic after an error.** The first error stops the batch: no next object, no sync, no cloud write, and no automatic rollback. The journal of the batch (`Journal-.jsonl`) says exactly which write was started, applied and verified. Read the summary, fix the cause, run the same command again: objects already done are detected (`AlreadyDone`). - -> [!TIP] -> **Two servers are supported.** If the cloud server has no access to AD (isolated network), run the AD part with `-Phase AD`, copy the batch folder, and run `-Phase Cloud` on the other server. The summary of each step prints the command of the next one. - -# Part II · Set up - - -## 4. Prerequisites - -### Server or workstation - -| Item | AD server (phase AD / Both) | Cloud server (phase Cloud / Both) | -|---|---|---| -| Windows PowerShell **5.1** (`powershell.exe`, not `pwsh`) | required | required | -| RSAT module `ActiveDirectory` | required | not required for phase Cloud; final AD restoration always runs separately | -| Entra Connect | the tool runs on the Entra Connect server, **or** WinRM to `EntraConnect.Server` | — | -| `ExchangeOnlineManagement` **3.10** or later | phase Both | required | -| `Microsoft.Graph.Authentication` and `Microsoft.Graph.Users` | phase Both | required | -| Durable disk for `Backups` | required | required (copies of the batches) | - -```powershell -# Windows PowerShell 5.1, as administrator -Install-WindowsFeature RSAT-AD-PowerShell # Windows Server (client: RSAT optional feature) -Install-Module ExchangeOnlineManagement -MinimumVersion 3.10.0 -Scope AllUsers -Force -Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Users -Scope AllUsers -Force -``` - -> [!NOTE] -> Run the tool in a **new** Windows PowerShell window: it refuses an Exchange Online or Microsoft Graph session that already exists in the console (it must know which session it signs out). - -**Window only:** PowerShell 7.5+ (.NET 9+) supplies the native WPF Fluent controls. It is optional: -Windows PowerShell 5.1 can also open the window with compatible WPF controls. The window launches -every actual operation in a fresh **Windows PowerShell 5.1** process on the same computer, under the -same Windows account. Install the AD/cloud modules for that engine, not just for PowerShell 7. - -### Permissions - -| System | Right | Why | -|---|---|---| -| Active Directory | write the Exchange attributes, `proxyAddresses`, `targetAddress` and the retention tag of the objects in scope; read `nTSecurityDescriptor` | Convert / Recover | -| Active Directory | add / remove members of the licence group | licensing | -| Entra Connect server | member of `ADSyncOperators` (or local administrator) + WinRM access when remote | sync cycle | -| Exchange Online | **Exchange Recipient Administrator** (or a custom role with `Add-MailboxPermission`, `Add-RecipientPermission`, `Set-Mailbox`, `Get-EXO*`) | shared mailbox permissions, checks | -| Microsoft Graph | `User.Read.All` | licence and provisioning checks | - -Certificate sign-in for unattended runs: annex C. - - -## 5. Installation - -1. Copy the package folder (`PraRemoteMailbox-2.1.0`, produced by `tools\New-PraPackage.ps1`) to the server, for example `D:\PRA\PraRemoteMailbox`. -2. Unblock the files if they were downloaded: `Get-ChildItem D:\PRA\PraRemoteMailbox -Recurse -File -Force | Unblock-File`. -3. Put `Backups` on a durable volume (default: `.\Backups` in the tool folder; see `Storage.BackupFolder`). -4. Fill in the configuration (chapter 6), then run a **Preview**: it checks the configuration, AD access and the scope without writing anything. - -**Two servers**: install the same version on both, with a configuration of the **same `Environment`** (a batch is refused by a configuration of another `Environment`). The cloud server needs only the cloud sections; the AD server needs the AD sections. - -| Folder | Content | -|---|---| -| `Invoke-PraRemoteMailbox.ps1` | the only script to run | -| `config\` | `PraRemoteMailbox.config.psd1` + CSV samples | -| `module\` | `PRA.Common` (console, log, configuration, reports), `PRA.Directory` (AD), `PRA.Backup` (capture), `PRA.Cloud` (Exchange Online, Graph), `PRA.Gui.psm1` and `PRA.Gui.xaml` (window) | -| `templates\` | HTML report template | -| `docs\` | this guide (Markdown + HTML) | -| `Backups\`, `logs\`, `reports\` | created by the runs | - - -## 6. Configuration - -Everything is set in `config\PraRemoteMailbox.config.psd1` — the command line only chooses the action. The file is a PowerShell data file: text between quotes, `$true` / `$false`, numbers, `@( )` for lists. **An unknown setting is refused** (a typing mistake never goes unnoticed). Relative paths are relative to the tool folder. - -### Identity of the environment - -| Setting | Meaning | -|---|---| -| `Environment` | Label used in the backup file names; a batch is only accepted by a configuration of the same `Environment`. | -| `DomainController` | The writable DC used for **every** read and write of a run. Keep it fixed: AD versions (`uSNChanged`) are per DC, and the final restore of a Recover must use the DC of the AD phase. | - -### Scope — which mailboxes are converted - -| Setting | Meaning | -|---|---| -| `Scope.Mode` | `OU` (every on-premises mailbox under `SearchBase`), `Auto` (same, `SearchBase` optional = whole domain), `Group` (members of `GroupDN`, recursive), `Csv` (column `Identity` in `CsvPath`). | -| `Scope.IncludeShared`, `IncludeRoom`, `IncludeEquip` | Mailbox types included besides user mailboxes. | -| `Scope.ExcludeSamAccountNames` | Accounts never converted. System mailboxes are always excluded. | - -`-Identity` converts one object instead of the scope; `-Scope UsersOnly|SharedOnly` and `-MaxObjects N` narrow a run (a pilot, a first wave). - -### Conversion - -| Setting | Meaning | -|---|---| -| `Remote.RecipientType` | `msExchRemoteRecipientType` of users: 1 (provision a mailbox); +2 automatically when the user has an archive and `HandleArchives = $true`. | -| `Remote.ClearMailboxGuid` | `$true`: clear `msExchMailboxGuid`, a new empty cloud mailbox is created. | -| `Routing.RoutingDomain` | `tenant.mail.onmicrosoft.com` — domain of the `targetAddress`. `AutoDetect` reuses an existing proxy address in this domain. | -| `Licensing.GroupDN` | AD group, synchronised to Entra ID, that carries the Exchange Online licence (group-based licensing). | - -### Shared mailboxes - -| Setting | Meaning | -|---|---| -| `SharedMailbox.RemoteRecipientType` | 97 (first provisioning of a shared mailbox), 99 with archive. | -| `SharedMailbox.PermissionSource` | Where FullAccess / SendAs holders are read, without Exchange: `AD` (default: the copy Exchange keeps on the account), `Csv` (`Shared,Group`), `CustomAttribute` (a group tagged with the name of the mailbox), `None`. Groups are expanded to their users. Details: chapter 2, *Shared mailbox permissions*. | -| `CaptureSendOnBehalf` | SendOnBehalf holders from `publicDelegates`. | -| `GrantFullAccess`, `GrantSendAs`, `GrantSendOnBehalf`, `AutoMapping` | What is granted in Exchange Online. | -| `ExcludeTrusteeSamAccountNames` | Accounts never reproduced (e.g. service or admin accounts found in the ACLs). | -| `KeepCloudSharedOnRecover` | `$true` = Recover keeps the cloud shared mailbox (rare). | -| `DeferOnPremRestore` | With phase Both, `$true` defers final AD restoration to Finalize. Phase Cloud always packages it, regardless of this setting. | - -### Entra Connect - -| Setting | Meaning | -|---|---| -| `EntraConnect.Sync` | `$true`: after the AD writes, run one cycle and wait for its end. Checked **before** the first AD write. `$false`: the operator synchronises. | -| `EntraConnect.Server` | Entra Connect server reached by PowerShell remoting; empty = this server (ADSync module). | -| `EntraConnect.PolicyType`, `TimeoutMinutes` | `Delta` (default) or `Initial`; how long to wait for the cycle. | - -### Microsoft 365 - -| Setting | Meaning | -|---|---| -| `Cloud.TenantId`, `Cloud.Organization` | Tenant GUID and initial domain (`tenant.onmicrosoft.com`). Every session is checked against them. | -| `Cloud.AppId` + `Cloud.CertificateThumbprint` | Certificate sign-in (unattended, annex C). Both empty = interactive sign-in (`Cloud.UserPrincipalName` = expected account). | -| `Cloud.CheckMailbox`, `CheckLicense`, `MailboxCheckVia`, `RequiredSkuPartNumber` | What "ready" means for a user: mailbox (Exchange Online type, or Graph provisioning) and licence. | -| `Exo.DisableWAM` | Interactive sign-in in the browser instead of the Windows broker. | -| `Exo.GrantVerifyAttempts`, `GrantVerifyDelaySeconds` | After **one** grant, re-read up to N times (never granted twice). | -| `Exo.UseSubprocess` | Run every Exchange Online call in a child Windows PowerShell (certificate only; automatic with a module older than `MinModuleVersion`). | -| `Polling.IntervalMinutes`, `TimeoutMinutes` | How often and how long the cloud part waits (15 to 60 minutes is common after a sync). | - -### Retention - -`Retention.Tag` writes `Converted` in `extensionAttribute1` (by default) at Convert. In Exchange Online it becomes `CustomAttribute1`: an **adaptive scope** of a Purview retention policy can use it, so that the cloud mailbox is kept (inactive mailbox) when Recover deprovisions it. The policy itself is created outside the tool; `-Action Check -Expect Retained` checks the holds (`PolicyGuid`). - -### Files - -| Setting | Meaning | -|---|---| -| `Storage.BackupFolder` | Backups (one private folder per batch). Durable, protected, copied outside the server. | -| `Storage.ForbiddenBackupRoots` | Volumes where a backup is refused (temporary disks). | -| `Logging.Folder`, `Report.Folder`, `Report.Enabled` | One log + one transcript per run; CSV + HTML report per run. | -| `Execution.Phase` | Default of `-Phase`: `Both` on one server; `AD` or `Cloud` on the servers of a two-server setup. | - - -## 7. Unattended execution - -For a run without a person at the keyboard (scheduled task, orchestrator): - -1. Certificate sign-in: create the application once (annex C) and set `Cloud.AppId` + `Cloud.CertificateThumbprint`. The certificate must be in the **CurrentUser\My** store of the account that runs the tool. -2. Run with `-Mode Apply -Force` under a domain account that has the AD rights of chapter 4. -3. Read the exit code: **0** done, **1** failed, **2** done but a next step is required (Pending objects). With `-PassThru`, the tool also returns the result object: `Status`, `ExitCode`, `BatchId`, `NextSteps`, the counters and the paths of the log and the reports (without `-PassThru`, nothing is written to the pipeline). - -```powershell -$r = & 'D:\PRA\PraRemoteMailbox\Invoke-PraRemoteMailbox.ps1' -Action Convert -Mode Apply -Force -PassThru -if ($r.ExitCode -eq 1) { throw "PRA Convert failed: $($r.Issues[0].Message)" } -$r.BatchId # keep it: Recover -Batch -``` - -# Part III · Use - - -## 8. Everyday use - -Everything else comes from the configuration file; the command line only says **what** to do this time. - -| Parameter | Values | Use | -|---|---|---| -| `-Action` | `Convert`, `Recover`, `Finalize`, `Check` | required for command-line operations; mutually exclusive with `-Gui` | -| `-Mode` | `Preview` (default), `Apply` | `Apply` writes, after one confirmation | -| `-Phase` | `Both`, `AD`, `Cloud` | Convert / Recover on two servers; default `Execution.Phase` | -| `-Batch` | batch ID (8 characters) or path of the batch JSON | Recover, `-Phase Cloud`, Finalize; optional for Check | -| `-Identity` | UPN, sAMAccountName, DN or GUID | one object only | -| `-SearchBase` | OU distinguished name | Convert AD/Both only; run-specific OU + child OUs, without changing configuration | -| `-CsvPath` | path of an Identity CSV | Convert AD/Both only; run-specific comma/semicolon list, without changing configuration | -| `-Scope` | `All` (default), `UsersOnly`, `SharedOnly` | filters the scope or the batch | -| `-MaxObjects` | number (0 = no limit) | Convert: first N objects | -| `-Expect` | `Provisioned` (default), `Deprovisioned`, `Retained` | Check only | -| `-ConfigPath` | path | another configuration file (another environment) | -| `-Force` | switch | Apply without the confirmation (unattended) | -| `-Once` | switch | cloud checks: one pass, no wait | -| `-PassThru` | switch | also returns the result object (chapter 7) | -| `-Gui` | switch | opens the window; may be combined with `-ConfigPath`, not with an operation | -| `-WhatIf` / `-Verbose` | switches | `-WhatIf` = Preview; `-Verbose` shows the debug lines of the log | - -**The routine is always the same**: run the command **without** `-Mode Apply` (preview: nothing is written), read the plan, run the **same** command **with** `-Mode Apply`, answer `Y`, and **note the batch ID** printed at the end — it is the key of the roll-back. The recipes below are complete: copy them, change the names. - -### The WPF window - -![WPF Fluent window - synthetic preview, no live operation](images/gui-fluent.png) - -```powershell -# Native Fluent controls; the business engine still runs in Windows PowerShell 5.1. -pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui - -# Compatible WPF controls when PowerShell 7.5+ is not installed. -powershell.exe -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui -ConfigPath .\config\PraRemoteMailbox.config.psd1 -``` - -Choose the action and the **execution phase** before previewing. The default phase comes from -`Execution.Phase`; it is always displayed and passed explicitly to the engine. Opening the window, -refreshing local state or selecting a batch does not connect to AD or Microsoft 365. - -| Operation | Required input | Where it runs / next step | -|---|---|---| -| Convert, AD + cloud | configured scope or one identity; no input batch | this host performs AD, sync and cloud | -| Convert, AD only | configured scope or one identity; no input batch | copy the new Convert batch folder to the cloud host | -| Convert, Cloud only | Convert batch produced by AD | cloud checks and permissions; no AD writes | -| Recover, AD + cloud | original Convert batch | this host restores AD, syncs, checks cloud and finishes AD restoration | -| Recover, AD only | original Convert batch | copy the **new Recover folder and original Convert folder** to the cloud host | -| Recover, Cloud only | **Recover batch**, not the Convert ID | cloud checks; when needed, copy the new Finalize folder back to AD | -| Finalize | RecoverFinalize package | AD host only; restores deferred shared attributes/tags and syncs | -| Check | Convert batch or one identity | read-only cloud check; use a UPN for an identity without AD access | - -For **Convert AD / AD + cloud**, choose the target source directly in the window: - -| Source | Selection | -|---|---| -| Configuration | use `Scope` from the selected configuration, or fill in one identity to override it | -| OU | type its distinguished name or click **Choisir une OU** to browse/filter the OU list on the configured DC; child OUs are included | -| Csv | click **Charger un CSV** and select a list with an `Identity` column (UPN, sAMAccountName, DN or GUID); comma and semicolon are supported | - -The source is passed to the engine as `-SearchBase` or `-CsvPath`; the original configuration is -**not rewritten**. OU and CSV are mutually exclusive and cannot be combined with a single identity. -The source controls are hidden for Cloud, Recover, Finalize and Check, whose batch/identity rules -remain unchanged. The OU browser reads AD only when clicked, in a separate Desktop process; no -directory or cloud module is imported into the WPF host. - -**Users and shared mailboxes are supported:** use `All` (with `Scope.IncludeShared = $true`, the -default), `UsersOnly` or `SharedOnly`. A single identity can be a user or a shared mailbox. For a -CSV, every explicit object must be eligible for the selected type: wrong types, exclusions, -duplicates and non-mailbox objects are refused before any write, not silently converted or skipped. - -```csv -Identity -user01@contoso.com -shared01@contoso.com -``` - -Selecting another OU/list or changing the CSV contents invalidates the previous Preview. -The list is revalidated and hashed before Apply. Missing/empty lists and a missing Identity column -keep Apply locked. AD still verifies the real object types and complete backups before writing. - -You can browse a batch JSON file from a copied folder, or use its ID. Keep the **whole folder** -unchanged: JSON, data-only CLIXML, SHA-256, State proof and journals. Both hosts must use the same -version and `Environment`, but each has its own configuration and installed prerequisites. The -window does **not** copy files, invoke the other host or bypass the engine's proof checks. - -Set the optional identity/type filters and, for Convert on AD, the maximum number of objects. -For Check, choose the expected state and whether to make one pass instead of waiting. -Preview first, inspect the result table, activity and HTML report, then Apply and type **CONVERT**, -**RECOVER** or **FINALIZE** in the confirmation. Apply uses the same request as the preview; -changing the phase, filters, configuration or batch/proof files requires another preview. -An errored, unfinished or empty preview does not enable Apply. The engine independently rereads -the directory, backs up and verifies the targets before every write; a GUI preview is not a frozen -copy of AD state. - -The window stays responsive while the child process runs. Progress shows the current step and -object; the result preserves exit codes **0/1/2**, the batch ID, report/log paths and exact next -commands. **Pending is not failure and not completion:** finish the indicated Cloud or Finalize -step. Do not close or forcibly stop the engine mid-batch; closing the window is blocked while an -operation is running so that backup/proof creation is not interrupted. - -### Recipe 1 — Convert one user - -Nothing to change in the configuration: `-Identity` replaces the scope (UPN, sAMAccountName, DN or GUID). - -```powershell -cd D:\PRA\PraRemoteMailbox -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com # 1. preview -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com -Mode Apply # 2. convert -``` - -The preview shows `jdupont UserMailbox → RemoteUserMailbox · convert`, the attributes that change and `licence group … not member → member`. The Apply backs up the account, writes AD, adds it to the licence group, runs one Entra Connect cycle, then waits until Exchange Online shows a mailbox and a licence. The summary ends with: - -```text -Batch 1d5ac20b -Next To roll back this batch later: .\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -``` - -To undo: recipe 5. - -### Recipe 2 — Convert a whole OU (users and shared mailboxes) - -1. In `config\PraRemoteMailbox.config.psd1`, section `Scope`: - -```powershell -Scope = @{ - Mode = 'OU' - SearchBase = 'OU=Paris,OU=Sites,DC=contoso,DC=com' # sub-OUs included - GroupDN = '' - CsvPath = '' - IncludeShared = $true # also the shared mailboxes of the OU - IncludeRoom = $false - IncludeEquip = $false - ExcludeSamAccountNames = @('svc-scan', 'test01') # never converted -} -``` - -2. Then: - -```powershell -.\Invoke-PraRemoteMailbox.ps1 -Action Convert # preview: every on-premises mailbox of the OU -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply # convert them all, in one batch -``` - -Only **on-premises mailboxes** are taken: objects without an on-premises mailbox (already in Exchange Online, mail users, contacts) are ignored. For a first wave, add `-MaxObjects 10` (the first 10 by sAMAccountName). For the shared mailboxes, the preview also lists **who will get FullAccess, SendAs and SendOnBehalf** (see [shared mailbox permissions](#shared-mailbox-permissions-where-they-come-from)). - -### Recipe 3 — Convert only the shared mailboxes - -All the shared mailboxes of the configured scope (recipe 2), users excluded — for example a second wave after the users: - -```powershell -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Scope SharedOnly # preview -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Scope SharedOnly -Mode Apply # convert -``` - -One shared mailbox only: - -```powershell -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity compta@contoso.com -.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity compta@contoso.com -Mode Apply -``` - -Shared mailboxes never get a licence. After the sync, the tool waits for the cloud shared mailbox, then grants each permission found in AD and re-reads it; every grant is printed (`compta@contoso.com: FullAccess granted to marie@contoso.com and verified`). The permission holders do **not** need to be converted first: a user still on-premises exists in Exchange Online as a synchronised mail user and can receive the permission (it is useful as soon as that user has a cloud mailbox). `-Scope SharedOnly` takes the shared mailboxes even when `IncludeShared = $false`; with `Scope.Mode = 'Csv'`, use a file that lists only shared mailboxes. The mirror option is `-Scope UsersOnly`. - -### Recipe 4 — Convert a list of mailboxes or the members of a group - -| Source | Configuration (`Scope`) | -|---|---| -| A CSV file | `Mode = 'Csv'`, `CsvPath = '.\config\Wave1.csv'` — one column `Identity` (UPN, sAMAccountName, DN or GUID), see `config\Targets.sample.csv`. Every line must be an on-premises mailbox, otherwise nothing is converted. | -| An AD group | `Mode = 'Group'`, `GroupDN = 'CN=PRA-Wave1,OU=Groups,DC=contoso,DC=com'` (nested groups included). | - -The commands are those of recipe 2. - -### Recipe 5 — Roll back (Recover) - -Use the batch ID of the Convert (summary, report, or the folder name `Backups\Batch-…`): - -```powershell -.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b # preview of the roll-back -.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Mode Apply # the whole batch -.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Identity jdupont@contoso.com -Mode Apply # one object of the batch -``` - -Users get their original attributes back and leave the licence group. Shared mailboxes are first removed from Exchange Online; their on-premises attributes come back when Exchange Online confirms it (up to `Polling.TimeoutMinutes`), in the same run. Their on-premises permissions were never changed. - -### Recipe 6 — Check, at any time - -```powershell -.\Invoke-PraRemoteMailbox.ps1 -Action Check -Batch 1d5ac20b # are the mailboxes of the batch in Exchange Online? -.\Invoke-PraRemoteMailbox.ps1 -Action Check -Identity jdupont@contoso.com # one mailbox -.\Invoke-PraRemoteMailbox.ps1 -Action Check -Batch 1d5ac20b -Expect Deprovisioned # after a Recover -``` - -Read only. Check waits for the expected state (up to `Polling.TimeoutMinutes`); add `-Once` for a single pass. - -### Scenario C — Convert on two servers - -```steps -AD server | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase AD -Mode Apply` — backup, AD changes, sync. The summary prints the batch ID. -Copy | Copy the folder `Backups\Batch-...` to the `Backups` folder of the cloud server (the whole folder, unchanged). -Cloud server | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase Cloud -Batch -Mode Apply` — waits for the mailboxes, grants the permissions. -``` - -### Scenario D — Recover on two servers - -```steps -AD server | `-Action Recover -Phase AD -Batch -Mode Apply` — users restored, shared mailboxes deprovisioned. Exit code 2: next step required. -Copy | Copy the new `Batch-` folder **and** the original `Batch-` folder to the cloud server. -Cloud server | `-Action Recover -Phase Cloud -Batch -Mode Apply` — checks the deprovisioning and writes a Finalize package `Finalize-`. -Copy back | Copy the `Finalize-` folder to the `Backups` folder of the AD server. -AD server | `-Action Finalize -Batch -Mode Apply` — restores the shared mailboxes and the retention tags. -``` - -Since 2.1.0, `-Phase Cloud` never performs the last AD restore itself, **even with RSAT installed**. -Phase Both retains inline restoration unless `DeferOnPremRestore` is enabled. Finalize is only -required when the result supplies a Finalize package (deferred shared attributes or retention tags). - -### What you see - -![Preview of a Convert](images/console-preview.png) - -1. The **banner**: action, mode, scope, tenant, configuration and log file. -2. **Numbered steps**. In a preview, the steps that write are shown as skipped. -3. For each object: its type change (`UserMailbox → RemoteUserMailbox`) and **only the attributes that change** — green = added, yellow = changed, red = removed. For a shared mailbox, the holders that will get **FullAccess**, **SendAs** and **SendOnBehalf** in Exchange Online. The full before/after values and the complete lists of holders are in the log. -4. The **summary**: result, batch ID, backup, report, log, duration and the **next command**. - -![Summary of a Convert Apply](images/console-apply.png) - -### Exit codes - -| Code | Meaning | What to do | -|---|---|---| -| 0 | Done (or preview without error) | nothing | -| 1 | Failed — see `Error` in the summary | fix the cause, run the same command again | -| 2 | Done, but objects are **Pending** | run the next step printed in the summary | - - -## 9. Reading the results - -### The HTML report - -![HTML report](images/report.png) - -One page per run in `reports\`: tiles with the counters (including **Warnings**), the next step, the warnings of the run, one row per object (filter box; a row with a warning has a yellow mark and the warning above its detail), and the run errors. It is self-contained (no external resource). - -### Warnings - -A warning never stops the run and never changes the exit code; it says that something was **left aside on purpose** and should be read. Today: the permission entries of a shared mailbox that point to an account no longer in AD (chapter 2). It is shown in four places: a yellow `▲` line in the console under the object, `[WARN]` in the log, the `Warnings` column of the CSV, and in the HTML report (*Warnings* tile, *Warnings* card, yellow mark on the row). The summary card of the console turns yellow and shows the last warnings. - -![Report of a preview with a warning (lab, 2026-10-01)](images/report-warning.png) - -### Statuses - -| FinalStatus | Meaning | -|---|---| -| `Planned` | Preview: this is what Apply would do. | -| `Success` | Done and verified (AD re-read; cloud state reached). | -| `AlreadyDone` | Nothing to change: the object was already in the expected state (counted as done). | -| `Pending` | AD done, waiting for another step (shared mailbox deprovisioning, Finalize). | -| `Error` | Stopped; see `Detail` and the log. | -| `Skipped` | Not processed (the batch stopped before it, or no applicable check). | - -### The CSV columns - -`ObjectGuid`, `SamAccountName`, `UserPrincipalName`, `Action`, `IsShared`, `ADApplied` (an AD write was made), `ADVerified` (AD re-read matches), `GroupAction` (Added / Removed / Preserved), `BackupPath`, `LastOperation`, `CloudMailbox`, `CloudLicense`, `CloudStatus`, `CloudDetail`, `PreserveCloudMailbox`, `PreserveLicense`, `DeprovisionConfirmed`, `PermDetail` (permissions verified / to grant / trustees missing), `PermMissing`, `FinalStatus`, `Detail`, `Warnings` (e.g. permission entries ignored). Separator `;`, UTF-8. - -> [!CAUTION] -> Logs, transcripts and reports contain AD values (addresses, DNs). Protect them like the backups; never publish them unfiltered. - - -## 10. Files: batches, proofs and packages - -```text -Backups\ - Batch-efb9d60a75054b6b9cabefa418121934\ one batch = one Apply (private ACL) - Recover-LAB-20260930_194723-efb9d60a.json typed records: what is restored (schema 3) - Recover-LAB-20260930_194723-efb9d60a.json.sha256 - Recover-LAB-20260930_194723-efb9d60a.clixml every AD value of every object (data-only CLIXML) - State-efb9d60a75054b6b9cabefa418121934.json AD proof: objects verified after the writes (+ .sha256) - Journal-efb9d60a75054b6b9cabefa418121934.jsonl Started / Applied / Verified / Failed per write - Finalize-3f2c90e1....\ Finalize package (Recover on two servers) - -cloud\CloudOperations.jsonl journal of the Exchange Online grants of a run -logs\ PRA__.log and .transcript.txt -reports\ PRA__.csv and .html -``` - -- **Batch ID** = the first 8 characters of the folder name; `-Batch` accepts 8 characters or more, or the path of the JSON file. -- The **State** file is the proof that the AD part was done and verified: the cloud phase and Finalize refuse to write without it. -- Copy **whole folders**, never single files, and never rename them. -- Keep the batches at least until the Recover is finished and checked; then archive them with the logs. - -# Part IV · Maintain - - -## 11. Inside the tool - -### Execution flow - -```flow -terminal | Invoke-PraRemoteMailbox | action, mode, phase -arrow | PRA.Common | config, audit, console -directory | PRA.Directory | plans, backup, AD writes -arrow | PRA.Backup | CLIXML capture -cloud | PRA.Cloud | EXO, Graph, grants -``` - -The run state is one hashtable, the **context** (`$context`), created by the entry script and passed to every function: configuration, mode, the result rows, the run errors (`Issues`), the files produced, the current step, and two callbacks: `Approval` (ShouldProcess before every write) and, in the cloud phase, `AssertCloudAuthorization` (re-reads the AD proof before every Exchange Online grant). - -### The safety contract - -1. **Read everything, then write.** Every object of the batch is read and planned before the first write. -2. **Backup before the first write**, for the whole batch: typed JSON (what Recover restores), data-only CLIXML (every AD value), SHA-256, private folder, new files only, then **re-read and compared** with the plans. A failure at the 13th object stops before any write. -3. **Before each write**: no previous error, Apply mode, approval, backup unchanged, and the object **re-read**: same `uSNChanged`, same DN, same values as in the backup. After each write: re-read of the expected values. -4. **First error = stop**: no next object, no sync, no cloud write, no automatic rollback. The journal records `Started` before and `Applied` after every write. -5. **Proofs**: the State file lists the objects verified; the cloud phase, Finalize and the sync refuse a batch without a valid proof, and Finalize refuses an object changed since the proof. -6. **A cloud error is never "absent"**: deprovisioning is confirmed only when Exchange Online returns no mailbox **and** a MailUser recipient. Only then are the shared mailboxes restored on-premises. -7. **Preview and Check never write** (AD, Entra Connect, Exchange Online); they still write their log, transcript and report. - -### Code map - -| File | Content | -|---|---| -| `Invoke-PraRemoteMailbox.ps1` | Parameters, context, the four actions step by step, batch resolution (`Get-PraBatchFile`), one confirmation (`Confirm-PraApply`), Finalize package (`Save-PraFinalizePackage`, `Get-PraFinalizeInput`), next-step hints. | -| `module\PRA.Common.psm1` | 1 console theme · 2 console and log (`Write-PraBanner/Step/Item/Log/Summary`) · 3 configuration (`Import-PraConfiguration`, defaults = list of valid keys) · 4 audit (log + transcript) · 5 results (`Get-PraOutcome`, CSV/HTML, `Complete-PraRun`). | -| `module\PRA.Directory.psm1` | 1 receipts and files · 2 directory reads (`Get-PraTarget`, `Get-PraUser`) · 3 attribute states and before/after display · 4 shared permissions from AD · 5 plans (`New-PraPlan`) · 6 backups and proofs · 7 writes (`Invoke-PraAdBatch`) · 8 Entra Connect (`Invoke-PraSync`). | -| `module\PRA.Backup.psm1` | Data-only CLIXML codec (write, stream-validate). | -| `module\PRA.Cloud.psm1` | Exchange Online worker (fixed commands, identity checks), sessions, pre-check, cloud phase (polling, grants), retention check. | -| `module\PRA.Gui.psm1`, `module\PRA.Gui.xaml` | WPF layout/theme, local state and input selection, preview guard, confirmation and Desktop child-process supervision. Optional `PRA_EVENT_FILE` JSONL channel carries start, step, item, summary and result events from the common module. | - - -## 12. Modifying the tool - -The rule: **change the plan, never the guards.** The backup, the re-reads and the proofs work for any attribute listed in the plan. - -### Manage one more AD attribute - -1. Add it to `$script:AttributeKinds` in `PRA.Directory.psm1` with its type (`String`, `MultiString`, `Bytes`, `Bool`, `Int`, `Long`). -2. Set its target value in `New-PraPlan` (branch `Convert`, and `Deprovision` if needed). Recover restores it automatically from the backup. -3. Old batches do not contain it: `Assert-PraStoredRecord` refuses them for Recover. Decide explicitly (new backup schema, or keep old batches on the previous version). -4. Add a gate test (chapter 13) with a synthetic user having and not having the attribute. - -### Change the routing address or the recipient types - -`Get-PraRoutingAddress` (routing) and the `Convert` branch of `New-PraPlan` (types). Keep `msExchRemoteRecipientType` of shared mailboxes at 97/99: 100/102 mean "already migrated" and are refused. - -### Add a cloud check - -In `Invoke-PraCloudPhase` (`PRA.Cloud.psm1`): add the fact in `Get-PraGraphFact` or in the worker (`Mailbox`, `Recipient`), then include it in `$mbok` / `$licok`. A new Exchange Online **write** must go through `Invoke-PraPermissionGrant` (approval, proof, journal, one call, bounded re-read). - -### Change the console or the report - -Texts and icons: `PRA.Common.psm1`, region 1-2. The HTML report: `templates\Report.template.html` (markers `{{...}}`, no code change). The CSV columns: `$script:RowFields`. - -### PowerShell pitfalls met during the build - -| Pitfall | Rule | -|---|---| -| Windows PowerShell 5.1 transcript writes every `Write-Host -NoNewline` piece on its own line | one `Write-Host` per line, one colour per line (`Write-PraHost`) | -| `GetNewClosure()` copies the variables of the current scope, including parameters with validation attributes (an empty `[ValidateSet]` parameter throws) | create closures inside a small function (`New-PraApprovalCallback`) | -| `ShouldProcess` reads `$ConfirmPreference` of the calling scope | the approval closure sets it from `$context.ConfirmPreference` | -| App-only Exchange Online sessions report the organisation domain as `TenantID` | the session guard accepts `Cloud.Organization` + `AppId` | -| `Import-Module ActiveDirectory` creates an `AD:` drive on a default DC | `$env:ADPS_LoadDefaultDrive = 0` before the import | -| Files without BOM are read as ANSI by Windows PowerShell 5.1 | every `.ps1/.psm1/.psd1` is UTF-8 **with BOM** (checked by the gate) | -| `Get-ADUser -Identity` does not search the UPN | exact, escaped LDAP filter (`Get-PraUser`) | -| With `-ErrorAction Stop`, Windows PowerShell 5.1 writes a `TerminatingError` line in the transcript even when the error is caught and expected (e.g. "No permissions were found" before a FullAccess grant) | read an expected error through `-ErrorAction SilentlyContinue -ErrorVariable` and check every record; anything else is thrown | -| `Get-EXORecipient -UserPrincipalName` answers an absent object with HTTP 404 (`ManagementObjectNotFoundException`), not with an empty result | only that exact answer, for that exact UPN, means "absent" (`MissingRecipient`); any other error stops | -| Exchange Online assemblies stay loaded in the console after a run; Microsoft Graph loaded later fails (`GetTokenAsync ... does not have an implementation`) | Graph is connected before EXO within a run; between runs, a clear message asks for a new window | - - -## 13. Testing a change - -### The gate (no directory, no tenant) - -```powershell -powershell.exe -NoProfile -File .\tests\Invoke-TestGate.ps1 -``` - -It checks every file (parse, UTF-8 BOM, help), runs PSScriptAnalyzer (Windows PowerShell 5.1 compatibility profiles), then the Pester suites `tests\PraRemoteMailbox.Tests.ps1` and `tests\PraRemoteMailbox.Gui.Tests.ps1`: synthetic AD and ADSync modules, a synthetic cloud barrier, the **real** entry script in a separate Windows PowerShell process, and the WPF window without live connections. It proves in particular: no write before the complete backup, stop at the first error, no write in Preview/-WhatIf, no Apply without confirmation in a non-interactive process, memory bounds with 13 shared mailboxes × 500 trustees, proofs and Finalize packages, GUI phase/command boundaries and preview invalidation. Evidence: `tests\evidence\gate\\` (`RESULT.txt`, `gate-result.json`, Pester XML). - -Requirements: Pester 5 or later and PSScriptAnalyzer 1.25.0 (machine-wide modules). Every test is mandatory: a skipped or missing test fails the gate. - -Release 2.0.0 (2026-10-01, VMLLM): **279 tests, 279 passed**, 0 analyzer error, about 12 minutes — evidence `tests\evidence\gate\v2.0.0-release`. The only analyzer warnings on the delivered files are expected: `Write-Host` in the console module (14, by design) and `ConvertFrom-Markdown` in the documentation builder (6, PowerShell 7 tool). Compared with the 325 tests of 1.3.6, the 61 combinations of the removed path options (`-BackupFile`, `-StateFile`, `-LogPath`, `-TranscriptPath`, `-ReportDirectory`) are replaced by 9 tests of `-Batch` and of the confirmation. - -### The lab campaign - -After a change of the engine, repeat the campaign of annex B on the lab: Preview, Convert Apply (users + shared), Check, Recover on two servers (AD, Cloud with Finalize package, Finalize), plus a Recover of a batch written by the previous version. - -# Annexes - - -## Annex A — Troubleshooting - -| Message | Cause | What to do | -|---|---|---| -| `Configuration: unknown setting X` | typing mistake or setting of another version | compare with chapter 6 | -| `Batch not found under ...` | the batch folder is not in `Storage.BackupFolder` | copy the whole `Batch-...` / `Finalize-...` folder there, or give the path of the JSON file | -| `The Convert batch used by this Recover is not in ...` | cloud phase of a Recover without the original Convert batch | copy the `Batch-` folder too | -| `Batch ... is a Convert batch: the cloud phase of a Recover needs the batch printed by its AD phase` | wrong ID | use the ID printed by `Recover -Phase AD` | -| `EntraConnect.Sync = $true but the ADSync module is not on this server` | AD part not on the Entra Connect server | set `EntraConnect.Server`, or run on the Entra Connect server, or `Sync = $false` | -| `Entra Connect server X is not reachable with PowerShell remoting` | WinRM / rights | `Test-WSMan X`; the account must be admin or `ADSyncOperators` on X | -| `An Exchange Online session already exists in this console` | the console was used for EXO before | open a new Windows PowerShell window | -| `Microsoft Graph cannot load in this console (assembly conflict ...)` | Exchange Online was used earlier in the same window (for example Recover, then Check): its assemblies stay loaded and Microsoft Graph cannot load next to them | open a new Windows PowerShell window for each run that needs Microsoft Graph (Check, Convert of users) | -| `Exchange Online session: wrong tenant (...)` | signed in to another tenant, or `Cloud.Organization` wrong | fix `Cloud.TenantId` / `Cloud.Organization` | -| `uSNChanged changed: the object was modified since it was planned` | someone (or a sync) changed the object between plan and write | run the command again (a new plan is made) | -| `Finalize: use the domain controller of the proof` | `DomainController` differs from the DC of the Recover AD phase | set the same `DomainController` | -| `Expected state not reached (timeout or -Once)` | Exchange Online is slow (provisioning up to 60 min after a sync) | run the cloud phase again later (`-Phase Cloud -Batch `); nothing is granted twice | -| `Permission ... trustees missing in Exchange Online` | a permission holder is not known in Exchange Online (not synchronised) | check that Entra Connect synchronises the holder, or exclude it (`ExcludeTrusteeSamAccountNames`) | -| `Trustee not found in Exchange Online at the pre-check: ` | same, found before any AD write (phase Both) | same; nothing was written | -| `▲ : N permission entries ignored, account unknown in AD (deleted, or from another domain): FullAccess S-1-5-21-...` (warning) | a permission entry of the shared mailbox points to an account that no longer exists ("Account Unknown") | nothing to do: the other holders are granted. To clean the source: SendAs entries in *Active Directory Users and Computers* → account of the shared mailbox → *Security*; FullAccess entries are removed when Exchange is back (`Remove-MailboxPermission`). If the account belongs to **another domain** and must keep its access, grant it by hand in Exchange Online | -| `Trustee without UPN` / `Unsupported trustee type` | a holder is an account without UPN, or a contact / computer | give it a UPN, or exclude it (`ExcludeTrusteeSamAccountNames`) | -| `Apply needs a confirmation and this console cannot ask for one` | `-Mode Apply` in a non-interactive run | add `-Force` | - -> [!TIP] -> Start with the **summary card**, then the **log** (`[ERROR]` lines, full before/after values with `[DETAIL]`), then the **journal** of the batch to see which write was started and applied. - - -## Annex B — Lab test campaign 2026-09-30 - -Lab `exlab.lab` (DC1, DC2, Entra Connect on AADC, Exchange servers stopped = disaster), tenant `M365CPI89259425`, operator account `EXLAB\pra-operator`, certificate sign-in. Objects of `OU=PRA-PILOT-OU`: `pra-user04`, `pra-user05` (user mailboxes), `pra-shared02`, `pra-shared03` (shared mailboxes, 3 FullAccess + 3 SendAs each). - -All runs were made with the **real** script on `VMLLM` (Windows PowerShell 5.1), against the real directory, the real Entra Connect server and the real tenant. Result: **28 runs**: 26 PASS, and 2 runs (T17, T18) that found defects 3 and 4, fixed since and covered by the gate (list below). - -| # | Command (short form) | What was checked | Result | -|---|---|---|---| -| T1 | `-Action Convert` (Preview) | plan of the 4 objects of the scope, nothing written, report with "Planned" rows | PASS | -| T2a | `-Action Recover -Batch <1.3.6 batch> -Mode Apply -Force` | backward compatibility: Recover of a Convert batch written by **1.3.6** (`pra-user01`, `pra-shared01`), AD restore + sync + cloud | PASS after fixes 1 and 2 | -| T2b | `-Action Recover -Phase Cloud -Batch ` without the Convert batch | clear message naming the missing `Batch-` folder, nothing written | PASS | -| T2c | `-Action Recover -Phase Cloud -Batch -Mode Apply -Force` | cloud phase of the 1.3.6 Recover, on-premises restore made inline | PASS | -| T3 | `-Action Convert -Mode Apply -Force` (phase Both) | 2 users + 2 shared, 12 permissions: backup, AD writes and proofs, remote delta sync, licence group, provisioning wait, permissions re-granted and verified. Batch `1d5ac20b`, **10 min 16 s** | PASS | -| T4 | `-Action Check -Expect Provisioned` | the 4 mailboxes are cloud mailboxes, permissions present | PASS | -| T5a | `-Action Recover -Phase AD -Batch 1d5ac20b -Mode Apply -Force` | AD restore, proof, sync; **exit code 2** (cloud phase due). Batch `f4e7a0bd` | PASS | -| T5b | `-Phase Cloud -Batch 1d5ac20b` (negative), then `-Phase Cloud -Batch f4e7a0bd` with a "cloud server" configuration (`DeferOnPremRestore`) | the Convert ID is refused with the right ID to use; cloud phase OK and **Finalize package** `593c9c5f` written | PASS | -| T5c | `-Action Finalize -Batch 593c9c5f` (Preview, then Apply) | package and proof hashes verified, on-premises restore of the shared mailboxes | PASS | -| T6 | `-Action Finalize -Batch 593c9c5f -Mode Apply -Force` (replay) | idempotent: nothing to write, success | PASS | -| T7 | `-Action Convert -Phase AD -Identity pra-shared02 -Mode Apply -Force` | one object, AD part only. Batch `79f5a1e1`, exit code 2 | PASS | -| T8 | `-Action Convert -Phase Cloud -Batch 79f5a1e1` (Preview) | one pass, 3 permissions reported "to grant", no wait, nothing granted | PASS | -| T9 | `-Action Convert -Phase Cloud -Batch 79f5a1e1 -Mode Apply -Force` | provisioning wait, permissions granted and verified | PASS | -| T10 | `-Action Recover -Batch 79f5a1e1 -Mode Apply -Force` (phase Both, one server) | AD restore, sync, cloud phase and on-premises restore inline, **12 min 29 s** | PASS | -| T11 | `-Mode Apply` without `-Force` in a non-interactive process | stops **before the backup** with "Apply needs a confirmation", exit code 1, nothing written | PASS | -| T12 | `-Action Check -Expect Deprovisioned` | the objects are back on-premises | PASS | -| T13 | `-Action Convert` (Preview) | final plan of the 4 objects (run again on 2026-10-01 for the screenshot of chapter 8) | PASS | -| T14 | `-Action Convert -Scope SharedOnly` (Preview, 2026-10-01) | only the 2 shared mailboxes; FullAccess / SendAs holders listed under each one, complete lists in the log | PASS | -| T15 | `-Action Convert -Identity pra-shared02` (Preview, 2026-10-01) after giving FullAccess + SendAs to a temporary account, then deleting it | the 2 entries of the deleted account are ignored: yellow line and yellow summary card, `[WARN]` in the log, CSV column `Warnings`, *Warnings* tile and card in the report; exit code 0; the permissions of `pra-shared02` were restored after the test | PASS | -| T16 | `-Action Convert -Identity pra-shared03` (Preview, then `-Mode Apply -Force`, 2026-10-01) after adding on `pra-shared03`: FullAccess for the group `PRA-Shared03-Team` (`pra-user01` + a nested group with `pra-user02`), SendOnBehalf for `pra-user01`, and removing its SendAs in Exchange Online | 9 permissions: the group becomes its 2 users (nested group included) and never gets a right itself; FullAccess **granted** and verified for 5 users, SendAs **granted** and verified for 3; SendOnBehalf already brought by Entra Connect, verified; an independent read of Exchange Online shows the same; **0 `TerminatingError` line** in the transcript. Batch `662e8b6d`, **8 min 48 s** | PASS | -| T17 | `-Action Recover -Batch 662e8b6d -Mode Apply -Force` | AD part and sync OK; at the first cloud check Exchange Online answered 404 "couldn't be found" for the mailbox that was turning into a MailUser: stop, nothing restored on-premises (defect 3) | defect found → fix 3 | -| T17b | `-Action Recover -Phase Cloud -Batch 8995dcbf -Mode Apply -Force`, after removing the T16 test material from the object | refused before any write: "the AD proof is out of date" (the object changed after the AD phase) | PASS (protection) | -| T17c | `-Action Recover -Batch 662e8b6d -Mode Apply -Force` (again) | AD already in the expected state (0 change, no sync), deprovisioning confirmed, on-premises restore (10 attributes) and sync. **4 min 24 s**, 0 `TerminatingError` line | PASS | -| T18 | `-Action Check -Expect Deprovisioned -Identity pra-shared03`, in the same process as T17 | Microsoft Graph cannot load after the Exchange Online assemblies of T17 (`GetTokenAsync ... does not have an implementation`) (defect 4) | defect found → fix 4 | -| T18b | same command in a new process | `pra-shared03` deprovisioned in Exchange Online (MailUser), back on-premises in AD | PASS | - -Measured durations: delta sync on the Entra Connect server (remote) about **5 min 30 s**; cloud phase alone 28 s to 61 s once the objects are provisioned. - -Defects found by the campaign and fixed in 2.0.0 (all now covered by the gate): - -1. With `-Force`, the approval callback of the AD engine still called `ShouldProcess` with `ConfirmImpact High` → "Windows PowerShell is in NonInteractive mode" in the scheduled task, **before any write** (fail-closed). Fix: the single confirmation of the run sets `ConfirmPreference = None` for the callbacks. -2. The session guard compared the organisation domain of a certificate session with `Cloud.TenantId` and refused it (finding 1 of annex F). Fix: the guard accepts `Cloud.Organization` and checks the `AppId`. -3. (T17) `Get-EXORecipient -UserPrincipalName` answers an absent object with HTTP 404 `ManagementObjectNotFoundException`. During the Recover cloud check, while the mailbox turns into a MailUser, this answer stopped the run (fail-closed). Fix: this exact answer, for this exact UPN, means "not there yet": the check waits and reads again; any other error still stops. -4. (T18) A run that needs Microsoft Graph after a run that used Exchange Online in the same console failed with an obscure `GetTokenAsync` error. Fix: a clear message asks for a new Windows PowerShell window (annex A). -5. (transcripts of T3 and T9) Before each FullAccess grant, the normal "No permissions were found" answer appeared as a `TerminatingError` line in the transcript. Fix: read through `-ErrorVariable`; T16 and T17c: 0 such line. - -The lab was left as before the tests: T16 test material removed (groups deleted, `msExchMailboxSecurityDescriptor` identical to its copy taken before the test, `publicDelegates` empty), `pra-shared03` back on-premises. - -Lab fixes made before the campaign (outside the tool): domain controller `DC2` had not replicated from `DC1` since 2026-09-18 (Kerberos `0x80090322`, stale KDC ticket); fixed by purging the tickets of the computer account and forcing the replication. Account `EXLAB\pra-operator` and the lab application (annex C) were created for the campaign. - - -## Annex C — Certificate sign-in (application) - -Least privilege for unattended runs: one application, one certificate, two application permissions and one Exchange role. - -```powershell -# 1. Certificate, in the store of the account that runs the tool (private key not exportable) -$cert = New-SelfSignedCertificate -Subject 'CN=PRA Remote Mailbox' -CertStoreLocation Cert:\CurrentUser\My ` - -KeyExportPolicy NonExportable -KeySpec Signature -KeyLength 2048 -HashAlgorithm SHA256 -NotAfter (Get-Date).AddYears(1) -Export-Certificate -Cert $cert -FilePath .\pra-app.cer -$cert.Thumbprint # -> Cloud.CertificateThumbprint -``` - -```powershell -# 2. Application (Azure CLI, Global Administrator or Privileged Role Administrator) -$app = az ad app create --display-name 'PRA Remote Mailbox' --sign-in-audience AzureADMyOrg --query appId -o tsv -az ad app credential reset --id $app --cert '@pra-app.cer' --append -$sp = az ad sp create --id $app --query id -o tsv -# Microsoft Graph: User.Read.All (application) -az ad app permission add --id $app --api 00000003-0000-0000-c000-000000000000 --api-permissions df021288-bdef-4463-88db-98f22de89214=Role -# Office 365 Exchange Online: Exchange.ManageAsApp (application) -az ad app permission add --id $app --api 00000002-0000-0ff1-ce00-000000000000 --api-permissions dc50a0fb-09a3-484d-be87-e023b12c6440=Role -az ad app permission admin-consent --id $app -# 3. Entra role Exchange Recipient Administrator for the service principal -az rest --method POST --url https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments ` - --body "{ \"roleDefinitionId\": \"31392ffb-586c-42d1-9346-e59415a2cc4e\", \"principalId\": \"$sp\", \"directoryScopeId\": \"/\" }" -$app # -> Cloud.AppId -``` - -> [!NOTE] -> With certificate sign-in, Exchange Online identifies the session by the **organisation domain** and the **AppId**: `Cloud.Organization` must be the initial domain (`tenant.onmicrosoft.com`) and `Cloud.AppId` the application ID. To revoke: delete the certificate credential of the application (or the application). - - -## Annex D — File formats - -| File | Format | Key fields | -|---|---|---| -| Backup `---.json` | schema **3** (schema 1 and 2 of 1.2.x/1.3.0-1.3.2 still read) | `Operation` (Convert, Recover, Finalize), `BatchId`, `Environment`, `Server`, `RawFile` + `RawHash`, `SourceBackupHash` (Recover/Finalize: SHA-256 of the Convert backup), `Records[]` (`Attributes` = before, `PlannedAttributes` = after, `Licensing`, `Retention`, `SharedPermissions`, `CapturedUsnChanged`) | -| Capture `.clixml` | `PraDataOnlyClixml-v1` | every attribute returned by AD, closed descriptors (no native object) | -| AD proof `State-.json` | schema 2 | `Kind = ADVerified`, `BackupFile` + `BackupHash`, `Records[]` (`ObjectGuid`, `Operation`, `VerifiedUsnChanged`) | -| Journal `Journal-.jsonl` | one JSON per line | `Target`, `Operation`, `Status` (Started, Applied, Verified, FailedOrIndeterminate) | -| Finalize package manifest | schema 2, `Operation = RecoverFinalize` | `SourceBackupHash`, `StateHash`, `Items[]` (`RestoreShared`, `RestoreTag`, `DeprovisionConfirmed`) | - -Every JSON has a `.sha256` file; a mismatch is refused. **Version 2.0.0 reads the batches of 1.3.x** (tested: Recover of a 1.3.6 Convert batch in the lab). - - -## Annex E — Versioning and upgrade from 1.3.6 - -- The version is in `Invoke-PraRemoteMailbox.ps1` (`Version = '2.1.0'`, GUI call and help `.NOTES`), in each module header, in the configuration header, in `README.md` and `CHANGELOG.md`, and in the front matter of this guide. Change them together. -- Release checklist: gate PASS · lab campaign (annex B) · `pwsh tools\Build-Documentation.ps1` (PowerShell 7.4+, documentation only) · `tools\New-PraPackage.ps1` · git tag `vX.Y.Z`. - -**From 1.3.6**: keep the old `Backups` folders; copy the values of `DRP-Config.psd1` into the new file (same sections; `ADConnect` → `EntraConnect`; `BackupFolder/LogFolder/ReportFolder` → `Storage/Logging/Report`; `Safety` → `Storage.ForbiddenBackupRoots`); keep the same `Environment` to use the old batches. Command mapping: see `CHANGELOG.md` (table "Changed"). - - -## Annex F — Code review 2026-09-30 - -Review of version 1.3.6 (script 513 lines, four modules 3,386 lines, gate 325 tests) before the 2.0.0 rewrite. - -| # | Finding | Impact | 2.0.0 | -|---|---|---|---| -| 1 | Certificate sign-in to Exchange Online always refused by the session guard (TenantID of an app-only session = organisation domain) | cloud phase impossible unattended; explains the "UnAuthorized" blocker of the 1.3.4 pilot | **fixed** (annex C) | -| 2 | Missing ADSync detected **after** the AD writes | batch half done (AD written, no sync, no cloud) — seen in the E2E pilot | checked before the first write; remote sync added | -| 3 | One ShouldProcess prompt per AD write and per grant (ConfirmImpact High) | dozens of prompts for a batch; operators used `-Force` blindly | one confirmation after the plan | -| 4 | `-BackupFile` / `-StateFile` long paths, implicit choice of "the most recent backup" | copy/paste errors (a line break in a path stopped a Recover on 09-09) | short batch IDs, explicit, proof and source found automatically | -| 5 | Two modes that do the same thing (Inventory / Simulate), three ways to say "do not write" | confusion | Preview + `-WhatIf` | -| 6 | Settings read but ignored (`WaitForSync`, `VerifyTrusteeInCloud`), obsolete switches kept | misleading configuration | removed; unknown keys refused | -| 7 | Preview of a cloud phase reported missing permissions as errors and waited up to 60 min | preview unusable before an Apply | one pass, "to grant" | -| 8 | Console: every AD read and memory probe on screen, French/English mix, 358-character lines | unreadable runs, hard to maintain | compact console, English, details in the log | -| 9 | Two operator documents (guide + technical documentation, 210 KB) plus release notes and many session notes | no single reference | this guide | -| 10 | Exit code 0 for Pending | an orchestrator cannot see that a next step is due | exit code 2 | -| 11 | `Disconnect-ExchangeOnline` message on stdout of the child process (subprocess mode) | would break the one-line JSON protocol of the child | output suppressed | - -No defect was found in the backup, receipt and proof engine; its logic is unchanged in 2.0.0 and covered by the gate. +--- +title: PRA Remote Mailbox +subtitle: Administrator guide +version: 2.2.0 +author: Nicolas Fabert +updated: 2026-10-14 +runtime: Windows PowerShell 5.1 engine; PowerShell 7.5+ Fluent window +safety: Backup before every change +--- + +# PRA Remote Mailbox — Administrator guide + +> When the on-premises Exchange servers are lost, **PRA Remote Mailbox** turns the on-premises mailboxes into **remote mailboxes**, so that every user gets a mailbox in **Exchange Online** within the hour — and rolls everything back when Exchange is available again. Only Active Directory is changed on-premises, and **every change is backed up first**. + +> [!IMPORTANT] +> Files downloaded from the Internet may be blocked by Windows and fail to run. Before using this project, unblock every file in the downloaded folder: +> +> ```powershell +> Get-ChildItem "C:\Chemin\Du\Dossier" -Recurse -File -Force | Unblock-File +> ``` +> +> Replace the example path with the folder where you downloaded or extracted this project. +> +> The `Install-Module` commands in this documentation use `-Force`, so they also update or reinstall a module that is already installed. If an older version still conflicts, close every PowerShell window, open a new one (as administrator for `-Scope AllUsers`), run `Uninstall-Module -AllVersions -Force`, then run the `Install-Module` command again. + +```cards +target | What it does | **Convert**: on-premises mailbox → remote mailbox (AD attributes, licence group, Entra Connect, shared mailbox permissions in Exchange Online). +refresh | How to go back | **Recover** a Convert batch: original AD attributes, licence removed, cloud shared mailboxes removed before the on-premises ones come back. +shield | How it protects | Preview first; a complete, re-read **backup** of every object before the first write; the first error stops everything. +terminal | How it is used | One script, one configuration file, one short **batch ID** that links the steps together. +``` + +## Quick start + +```steps +Check the prerequisites | Windows PowerShell **5.1**, RSAT `ActiveDirectory`, `ExchangeOnlineManagement` 3.10+, `Microsoft.Graph.Authentication` and `Microsoft.Graph.Users` (chapter 4). +Edit the configuration | `config\PraRemoteMailbox.config.psd1`: scope, licence group, routing domain, Entra Connect server, tenant (chapter 6). +Preview | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert` — targets and planned AD changes, **nothing is written**. +Apply | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply` — one confirmation, then backup, AD, sync, Exchange Online. +Keep the batch ID | The summary prints it (e.g. `efb9d60a`) with the next command: `-Action Recover -Batch efb9d60a` rolls the batch back. +``` + +> [!IMPORTANT] +> **Preview is the default.** Without `-Mode Apply` (or with `-WhatIf`) the tool only reads. With `-Mode Apply` it asks **one** confirmation after showing the plan; `-Force` skips it for unattended runs. No option ever skips a safety check. + +> [!TIP] +> **Ready-to-use commands** — one user, a whole OU, only the shared mailboxes, a list, the roll-back: chapter 8, recipes 1 to 6. + +The **window** opens with `pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui` (native Fluent with +PowerShell 7.5+), or `powershell.exe -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui` (compatible WPF). +It starts no operation automatically. Version **2.2.0** (unreleased source) has offline validation only; no new +live-tenant campaign has been performed for this version. + +# Part I · Understand + + +## 1. Project background + +**The disaster scenario** + +- The mailboxes of the organisation are hosted **on-premises** (Exchange Server, hybrid with Exchange Online). +- The disaster recovery plan (PRA) covers the **loss of the on-premises Exchange servers**: mail must work again quickly, without waiting for their reconstruction. +- **Active Directory and Entra Connect are still available**: the identities, groups and synchronisation work. +- The decision is to give every user a **new, empty mailbox in Exchange Online** and to recreate the access to the shared mailboxes. The content of the lost mailboxes is **not** migrated by this tool (it comes back from the Exchange recovery, or from a backup product). +- When Exchange is back, the objects are **rolled back** to their on-premises state. + +**Why a tool** + +Turning an on-premises mailbox into a remote mailbox means rewriting about ten Exchange attributes in AD, per object, in a precise way, for hundreds of objects, under stress. A wrong value or a lost value cannot be recovered without a backup: this happened with the first script (version 1.2.5), whose backup was written **after** the changes. + +| Constraint | Value | +|---|---| +| Objects | user mailboxes, shared mailboxes (rooms and equipment possible) | +| Systems changed | Active Directory (attributes, licence group), Entra Connect (one sync cycle), Exchange Online (shared mailbox permissions) | +| Systems NOT needed | Exchange on-premises (it is down) | +| Servers | one server (AD + cloud), or two servers: an AD server and an isolated "cloud" server | +| Traceability | backups, journals, logs, transcripts and reports kept for every run | + + +## 2. How it works + +### Convert + +The default flow, on one server (`Execution.Phase = 'Both'`): + +```flow +directory | Read AD | scope, attributes, permissions +arrow | Backup | JSON + CLIXML + SHA-256, re-read +target | Write AD | remote mailbox, licence group +arrow | Sync | one Entra Connect cycle +cloud | Exchange Online | mailbox, licence, permissions +``` + +| Step | What happens | +|---|---| +| **Preview** | Every object of the scope is read, checked (it must be an on-premises mailbox) and planned. The console shows what will change. | +| **Exchange Online pre-check** | (Apply, phase Both) sign-in, every target and every permission holder resolved in Exchange Online — before any AD write. | +| **Backup** | One private folder `Backups\Batch-`: the typed values to restore (JSON), every AD value (CLIXML), their SHA-256, then everything is **re-read and compared** with the plan. | +| **AD changes** | Per object: current state re-checked, `Set-ADUser`, AD re-read, licence group, AD re-read. The **first error stops the batch**. | +| **Entra Connect** | One Delta cycle, local or on `EntraConnect.Server`; the tool waits for its end. | +| **Exchange Online** | The tool waits (up to `Polling.TimeoutMinutes`) for the mailboxes and the licences, then grants FullAccess / SendAs / SendOnBehalf on the shared mailboxes and checks each grant. | + +### What changes in AD + +| Attribute | User mailbox | Shared mailbox | +|---|---|---| +| `msExchRecipientTypeDetails` | 1 → **2147483648** (RemoteUserMailbox) | 4 → **34359738368** (RemoteSharedMailbox) | +| `msExchRemoteRecipientType` | → **1** (3 with archive) | → **97** (99 with archive) | +| `msExchRecipientDisplayType` | → -2147483642 | → -2147483642 | +| `targetAddress` | → `SMTP:alias@tenant.mail.onmicrosoft.com` | same | +| `proxyAddresses` | + `smtp:alias@tenant.mail.onmicrosoft.com` | same | +| `homeMDB`, `homeMTA`, `msExchHomeServerName`, `mDBUseDefaults`, `msExchMailboxGuid` | cleared | cleared | +| retention tag (`extensionAttribute1` by default) | → `Converted` | → `Converted` | +| licence group | **added** | never (a shared mailbox has no licence) | + +### Shared mailbox permissions — where they come from + +Exchange on-premises is down: the tool cannot ask it (`Get-MailboxPermission` is not available). It reads the permissions where Exchange keeps a copy in **Active Directory**, on the account of the shared mailbox itself (default `SharedMailbox.PermissionSource = 'AD'`): + +| Right granted in Exchange Online | Read in AD (attribute of the shared mailbox account) | Written there on-premises by | +|---|---|---| +| **FullAccess** | `msExchMailboxSecurityDescriptor` — *Allow* entries with the FullAccess right | `Add-MailboxPermission -AccessRights FullAccess` | +| **SendAs** | `nTSecurityDescriptor` (the AD permissions of the account) — *Allow* entries with the extended right **Send As** | `Add-ADPermission -ExtendedRights Send-As`, or the Exchange admin center | +| **SendOnBehalf** | `publicDelegates` | `Set-Mailbox -GrantSendOnBehalfTo` | + +```flow +directory | Read AD | 3 attributes of the shared mailbox +arrow | Clean up | groups → users, exclusions +batch | Backup | lists of UPNs in the batch +arrow | Pre-check | every holder found in Exchange Online +cloud | Grant | once, then re-read +``` + +1. Only explicit *Allow* entries are kept: inherited and *Deny* entries are ignored. +2. System and administration accounts are never reproduced: SELF, `NT AUTHORITY\…`, `BUILTIN\…`, Domain / Enterprise / Schema Admins, Organization Management, Exchange Trusted Subsystem, Exchange Servers, Exchange Windows Permissions, Managed Availability Servers, Delegated Setup — plus the accounts listed in `SharedMailbox.ExcludeTrusteeSamAccountNames` (service accounts, for example). +3. A **group** is expanded to its users, nested groups included: Exchange Online receives one permission **per user** (UPN), never the group itself (lab T16). A user added to the group later does not get the access by itself. +4. An entry that points to an account **no longer in AD** ("Account Unknown": deleted account, or an account of another domain) cannot be granted: it is **ignored and reported as a warning** — a yellow `▲` line under the shared mailbox, a `[WARN]` line in the log, the `Warnings` column of the CSV, and the *Warnings* tile and card of the HTML report. The run goes on and its exit code does not change. Every other holder must exist in AD with a UPN. +5. The lists are saved in the backup of the batch (`SharedPermissions` of each record): the proof of what was granted. +6. Apply (phase `Both`): **before any AD write**, every holder is looked up in Exchange Online. An unknown holder stops the run before AD is changed. A user still on-premises is fine: Entra Connect has synchronised it as a mail user. +7. When the cloud shared mailbox exists: `Add-MailboxPermission` (FullAccess, with `AutoMapping`), `Add-RecipientPermission` (SendAs), `Set-Mailbox -GrantSendOnBehalfTo` (SendOnBehalf). A permission already present is only verified; a missing one is granted **once**, then re-read until Exchange Online shows it. In a hybrid organisation, Entra Connect usually brings `publicDelegates` along with the mailbox: SendOnBehalf is then already there and only verified (lab T16). + +**How to check before the Apply**: the preview prints, under each shared mailbox, `FullAccess to`, `SendAs to` and `SendOnBehalf to` with the first holders; the log of the run has the complete lists (lines `PERMISSIONS | …`). After the Apply, every grant is printed and the report shows `Permissions verified=6/6`. + +**Other sources**, when the AD entries are not reliable: + +| `PermissionSource` | Holders | +|---|---| +| `'Csv'` | file `SharedMailbox.CsvPath`, columns `Shared,Group` (see `config\SharedPermissions.sample.csv`): the members of `Group` get FullAccess **and** SendAs on `Shared` | +| `'CustomAttribute'` | the AD group whose `SharedMailbox.CustomAttribute` (e.g. `extensionAttribute5`) contains the name of the shared mailbox: its members get FullAccess and SendAs | +| `'None'` | no FullAccess / SendAs | + +SendOnBehalf always comes from `publicDelegates` (set `CaptureSendOnBehalf = $false` to skip it). A Recover does not remove the cloud permissions one by one: they disappear with the cloud mailbox; Convert never changes the on-premises permissions. + +### Recover + +The way back, from the Convert batch: + +```flow +batch | Convert batch | original values +arrow | AD | users restored, shared → MailUser +cloud | Exchange Online | mailboxes gone? +arrow | Final restore | shared + tags +check | Done | on-premises again +``` + +- **Users** get their original attributes back and leave the licence group (unless they were already members before Convert). +- **Shared mailboxes** are first **deprovisioned** in Exchange Online (`msExchRemoteRecipientType` 8, MailUser): their on-premises attributes come back only when Exchange Online confirms that the cloud mailbox is gone. Otherwise two mailboxes would exist for the same object. +- The **retention tag** keeps the value `Converted` until the cloud check, then gets its original value back. +- On two servers, the cloud server writes a **Finalize package** that the AD server applies (`-Action Finalize`). + +### The four actions + +| Action | Purpose | Writes | +|---|---|---| +| `Convert` | on-premises mailbox → remote mailbox | AD, Entra Connect, Exchange Online permissions | +| `Recover` | roll back a Convert batch | AD, Entra Connect | +| `Finalize` | last step of a Recover on two servers | AD, Entra Connect | +| `Check` | is a mailbox provisioned / deprovisioned / retained? | nothing | + + +## 3. Things to know + +> [!WARNING] +> **The backups are the only way back.** A Recover restores what the Convert batch saved — nothing else. Keep the `Backups` folder on a durable, protected volume and copy it outside the server after each Apply. Never edit a backup: every file is checked by SHA-256 and a changed file is refused. + +> [!CAUTION] +> **Convert creates new, empty mailboxes** in Exchange Online (`msExchMailboxGuid` is cleared). The content of the on-premises mailboxes is not moved. A Recover **deprovisions** the cloud mailboxes: mail received in the cloud during the disaster must be exported first if it has to be kept (or protected by a retention policy, see `Retention` in chapter 6). + +> [!NOTE] +> **Nothing is automatic after an error.** The first error stops the batch: no next object, no sync, no cloud write, and no automatic rollback. The journal of the batch (`Journal-.jsonl`) says exactly which write was started, applied and verified. Read the summary, fix the cause, run the same command again: objects already done are detected (`AlreadyDone`). + +> [!TIP] +> **Two servers are supported.** If the cloud server has no access to AD (isolated network), run the AD part with `-Phase AD`, copy the batch folder, and run `-Phase Cloud` on the other server. The summary of each step prints the command of the next one. + +# Part II · Set up + + +## 4. Prerequisites + +### Server or workstation + +| Item | AD server (phase AD / Both) | Cloud server (phase Cloud / Both) | +|---|---|---| +| Windows PowerShell **5.1** (`powershell.exe`, not `pwsh`) | required | required | +| RSAT module `ActiveDirectory` | required | not required for phase Cloud; final AD restoration always runs separately | +| Entra Connect | the tool runs on the Entra Connect server, **or** WinRM to `EntraConnect.Server` | — | +| `ExchangeOnlineManagement` **3.10** or later | phase Both | required | +| `Microsoft.Graph.Authentication` and `Microsoft.Graph.Users` | phase Both | required | +| Durable disk for `Backups` | required | required (copies of the batches) | + +```powershell +# Windows PowerShell 5.1, as administrator +Install-WindowsFeature RSAT-AD-PowerShell # Windows Server (client: RSAT optional feature) +Install-Module ExchangeOnlineManagement -MinimumVersion 3.10.0 -Scope AllUsers -Force +Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Users -Scope AllUsers -Force +``` + +> [!NOTE] +> Run the tool in a **new** Windows PowerShell window: it refuses an Exchange Online or Microsoft Graph session that already exists in the console (it must know which session it signs out). + +**Window only:** PowerShell 7.5+ (.NET 9+) supplies the native WPF Fluent controls. It is optional: +Windows PowerShell 5.1 can also open the window with compatible WPF controls. The window launches +every actual operation in a fresh **Windows PowerShell 5.1** process on the same computer, under the +same Windows account. Install the AD/cloud modules for that engine, not just for PowerShell 7. + +### Permissions + +| System | Right | Why | +|---|---|---| +| Active Directory | write the Exchange attributes, `proxyAddresses`, `targetAddress` and the retention tag of the objects in scope; read `nTSecurityDescriptor` | Convert / Recover | +| Active Directory | add / remove members of the licence group | licensing | +| Entra Connect server | member of `ADSyncOperators` (or local administrator) + WinRM access when remote | sync cycle | +| Exchange Online | **Exchange Recipient Administrator** (or a custom role with `Add-MailboxPermission`, `Add-RecipientPermission`, `Set-Mailbox`, `Get-EXO*`) | shared mailbox permissions, checks | +| Microsoft Graph | `User.Read.All` | licence and provisioning checks | + +Certificate sign-in for unattended runs: annex C. + + +## 5. Installation + +1. Copy the package folder (`PraRemoteMailbox-2.2.0`, the signed package built by `tools\New-PraPackage.ps1`, or the extracted release ZIP) to the server, for example `D:\PRA\PraRemoteMailbox`. +2. Unblock the files if they were downloaded: `Get-ChildItem D:\PRA\PraRemoteMailbox -Recurse -File -Force | Unblock-File`. +3. Put `Backups` on a durable volume (default: `.\Backups` in the tool folder; see `Storage.BackupFolder`). +4. Fill in the configuration (chapter 6), then run a **Preview**: it checks the configuration, AD access and the scope without writing anything. + +**Two servers**: install the same version on both, with a configuration of the **same `Environment`** (a batch is refused by a configuration of another `Environment`). The cloud server needs only the cloud sections; the AD server needs the AD sections. + +| Folder | Content | +|---|---| +| `Invoke-PraRemoteMailbox.ps1` | the only script to run | +| `config\` | `PraRemoteMailbox.config.psd1` + CSV samples | +| `module\` | `PRA.Common` (console, log, configuration, reports), `PRA.Directory` (AD), `PRA.Backup` (capture), `PRA.Cloud` (Exchange Online, Graph), `PRA.Gui.psm1` and `PRA.Gui.xaml` (window) | +| `templates\` | HTML report template | +| `docs\` | this guide (Markdown + HTML) and its images | +| `PackageIntegrity.psd1` | owner-signed manifest: SHA256 of every stable file | +| `README.md`, `LICENSE`, `CHANGELOG.md` | project information | +| `Backups\`, `logs\`, `reports\` | created by the runs | + +### Package integrity + package is verified every time it starts. `module\Test-PackageIntegrity.ps1` and `PackageIntegrity.psd1` must carry the owner's timestamped Authenticode signature (certificate thumbprint `0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6`), every PowerShell file of the package must be signed by the same owner, and every stable file (modules, XAML, report template, sample CSV files, README, licence, guide, images) must match the signed manifest. A changed, missing, duplicated, unexpected or reparse-point file stops `Invoke-PraRemoteMailbox.ps1`, the modules and the GUI helper **before** any import, window or operation. There is no unsigned mode, no switch and no environment variable to bypass it. + covered, on purpose: `config\PraRemoteMailbox.config.psd1` and the CSV lists you keep in `config\` (your data) and the generated `Backups\`, `logs\` and `reports\`. A signature detects a change; it does not stop the file system from being written. + +> **Output folders.** `Storage.BackupFolder`, `Logging.Folder` and `Report.Folder` must be either a folder outside the package or, inside the package, exactly the canonical `Backups`, `logs` and `reports` folder (a sub-folder of its own canonical folder is accepted, the name is case-sensitive). Any other folder inside the package, such as `.\audit`, is refused with a clear message before a file is written, because the integrity check would reject the unexpected files at the next start. Choose an external path for a custom location. The test uses the physical location resolved by Windows: a `\\?\` prefix, an 8.3 name, a junction, a SUBST drive or an alias such as `C:\Documents and Settings` cannot hide the package (an accepted canonical folder is then used under its physical path), and a path whose location cannot be resolved is refused rather than assumed to be external. + + +## 6. Configuration + +Everything is set in `config\PraRemoteMailbox.config.psd1` — the command line only chooses the action. The file is a PowerShell data file: text between quotes, `$true` / `$false`, numbers, `@( )` for lists. **An unknown setting is refused** (a typing mistake never goes unnoticed). Relative paths are relative to the tool folder. + +### Identity of the environment + +| Setting | Meaning | +|---|---| +| `Environment` | Label used in the backup file names; a batch is only accepted by a configuration of the same `Environment`. | +| `DomainController` | The writable DC used for **every** read and write of a run. Keep it fixed: AD versions (`uSNChanged`) are per DC, and the final restore of a Recover must use the DC of the AD phase. | + +### Scope — which mailboxes are converted + +| Setting | Meaning | +|---|---| +| `Scope.Mode` | `OU` (every on-premises mailbox under `SearchBase`), `Auto` (same, `SearchBase` optional = whole domain), `Group` (members of `GroupDN`, recursive), `Csv` (column `Identity` in `CsvPath`). | +| `Scope.IncludeShared`, `IncludeRoom`, `IncludeEquip` | Mailbox types included besides user mailboxes. | +| `Scope.ExcludeSamAccountNames` | Accounts never converted. System mailboxes are always excluded. | + +`-Identity` converts one object instead of the scope; `-Scope UsersOnly|SharedOnly` and `-MaxObjects N` narrow a run (a pilot, a first wave). + +### Conversion + +| Setting | Meaning | +|---|---| +| `Remote.RecipientType` | `msExchRemoteRecipientType` of users: 1 (provision a mailbox); +2 automatically when the user has an archive and `HandleArchives = $true`. | +| `Remote.ClearMailboxGuid` | `$true`: clear `msExchMailboxGuid`, a new empty cloud mailbox is created. | +| `Routing.RoutingDomain` | `tenant.mail.onmicrosoft.com` — domain of the `targetAddress`. `AutoDetect` reuses an existing proxy address in this domain. | +| `Licensing.GroupDN` | AD group, synchronised to Entra ID, that carries the Exchange Online licence (group-based licensing). | + +### Shared mailboxes + +| Setting | Meaning | +|---|---| +| `SharedMailbox.RemoteRecipientType` | 97 (first provisioning of a shared mailbox), 99 with archive. | +| `SharedMailbox.PermissionSource` | Where FullAccess / SendAs holders are read, without Exchange: `AD` (default: the copy Exchange keeps on the account), `Csv` (`Shared,Group`), `CustomAttribute` (a group tagged with the name of the mailbox), `None`. Groups are expanded to their users. Details: chapter 2, *Shared mailbox permissions*. | +| `CaptureSendOnBehalf` | SendOnBehalf holders from `publicDelegates`. | +| `GrantFullAccess`, `GrantSendAs`, `GrantSendOnBehalf`, `AutoMapping` | What is granted in Exchange Online. | +| `ExcludeTrusteeSamAccountNames` | Accounts never reproduced (e.g. service or admin accounts found in the ACLs). | +| `KeepCloudSharedOnRecover` | `$true` = Recover keeps the cloud shared mailbox (rare). | +| `DeferOnPremRestore` | With phase Both, `$true` defers final AD restoration to Finalize. Phase Cloud always packages it, regardless of this setting. | + +### Entra Connect + +| Setting | Meaning | +|---|---| +| `EntraConnect.Sync` | `$true`: after the AD writes, run one cycle and wait for its end. Checked **before** the first AD write. `$false`: the operator synchronises. | +| `EntraConnect.Server` | Entra Connect server reached by PowerShell remoting; empty = this server (ADSync module). | +| `EntraConnect.PolicyType`, `TimeoutMinutes` | `Delta` (default) or `Initial`; how long to wait for the cycle. | + +### Microsoft 365 + +| Setting | Meaning | +|---|---| +| `Cloud.TenantId`, `Cloud.Organization` | Tenant GUID and initial domain (`tenant.onmicrosoft.com`). Every session is checked against them. | +| `Cloud.AppId` + `Cloud.CertificateThumbprint` | Certificate sign-in (unattended, annex C). Both empty = interactive sign-in (`Cloud.UserPrincipalName` = expected account). | +| `Cloud.CheckMailbox`, `CheckLicense`, `MailboxCheckVia`, `RequiredSkuPartNumber` | What "ready" means for a user: mailbox (Exchange Online type, or Graph provisioning) and licence. | +| `Exo.DisableWAM` | Interactive sign-in in the browser instead of the Windows broker. | +| `Exo.GrantVerifyAttempts`, `GrantVerifyDelaySeconds` | After **one** grant, re-read up to N times (never granted twice). | +| `Exo.UseSubprocess` | Run every Exchange Online call in a child Windows PowerShell (certificate only; automatic with a module older than `MinModuleVersion`). | +| `Polling.IntervalMinutes`, `TimeoutMinutes` | How often and how long the cloud part waits (15 to 60 minutes is common after a sync). | + +### Retention + +`Retention.Tag` writes `Converted` in `extensionAttribute1` (by default) at Convert. In Exchange Online it becomes `CustomAttribute1`: an **adaptive scope** of a Purview retention policy can use it, so that the cloud mailbox is kept (inactive mailbox) when Recover deprovisions it. The policy itself is created outside the tool; `-Action Check -Expect Retained` checks the holds (`PolicyGuid`). + +### Files + +| Setting | Meaning | +|---|---| +| `Storage.BackupFolder` | Backups (one private folder per batch). Durable, protected, copied outside the server. | +| `Storage.ForbiddenBackupRoots` | Volumes where a backup is refused (temporary disks). | +| `Logging.Folder`, `Report.Folder`, `Report.Enabled` | One log + one transcript per run; CSV + HTML report per run. Inside the package only `.\logs` and `.\reports` are accepted; use an external path for another location. | +| `Execution.Phase` | Default of `-Phase`: `Both` on one server; `AD` or `Cloud` on the servers of a two-server setup. | + + +## 7. Unattended execution + +For a run without a person at the keyboard (scheduled task, orchestrator): + +1. Certificate sign-in: create the application once (annex C) and set `Cloud.AppId` + `Cloud.CertificateThumbprint`. The certificate must be in the **CurrentUser\My** store of the account that runs the tool. +2. Run with `-Mode Apply -Force` under a domain account that has the AD rights of chapter 4. +3. Read the exit code: **0** done, **1** failed, **2** done but a next step is required (Pending objects). With `-PassThru`, the tool also returns the result object: `Status`, `ExitCode`, `BatchId`, `NextSteps`, the counters and the paths of the log and the reports (without `-PassThru`, nothing is written to the pipeline). + +```powershell +$r = & 'D:\PRA\PraRemoteMailbox\Invoke-PraRemoteMailbox.ps1' -Action Convert -Mode Apply -Force -PassThru +if ($r.ExitCode -eq 1) { throw "PRA Convert failed: $($r.Issues[0].Message)" } +$r.BatchId # keep it: Recover -Batch +``` + +# Part III · Use + + +## 8. Everyday use + +Everything else comes from the configuration file; the command line only says **what** to do this time. + +| Parameter | Values | Use | +|---|---|---| +| `-Action` | `Convert`, `Recover`, `Finalize`, `Check` | required for command-line operations; mutually exclusive with `-Gui` | +| `-Mode` | `Preview` (default), `Apply` | `Apply` writes, after one confirmation | +| `-Phase` | `Both`, `AD`, `Cloud` | Convert / Recover on two servers; default `Execution.Phase` | +| `-Batch` | batch ID (8 characters) or path of the batch JSON | Recover, `-Phase Cloud`, Finalize; optional for Check | +| `-Identity` | UPN, sAMAccountName, DN or GUID | one object only | +| `-SearchBase` | OU distinguished name | Convert AD/Both only; run-specific OU + child OUs, without changing configuration | +| `-CsvPath` | path of an Identity CSV | Convert AD/Both only; run-specific comma/semicolon list, without changing configuration | +| `-Scope` | `All` (default), `UsersOnly`, `SharedOnly` | filters the scope or the batch | +| `-MaxObjects` | number (0 = no limit) | Convert: first N objects | +| `-Expect` | `Provisioned` (default), `Deprovisioned`, `Retained` | Check only | +| `-ConfigPath` | path | another configuration file (another environment) | +| `-Force` | switch | Apply without the confirmation (unattended) | +| `-Once` | switch | cloud checks: one pass, no wait | +| `-PassThru` | switch | also returns the result object (chapter 7) | +| `-Gui` | switch | opens the window; may be combined with `-ConfigPath`, not with an operation | +| `-WhatIf` / `-Verbose` | switches | `-WhatIf` = Preview; `-Verbose` shows the debug lines of the log | + +**The routine is always the same**: run the command **without** `-Mode Apply` (preview: nothing is written), read the plan, run the **same** command **with** `-Mode Apply`, answer `Y`, and **note the batch ID** printed at the end — it is the key of the roll-back. The recipes below are complete: copy them, change the names. + +### The WPF window + +![WPF Fluent window - synthetic preview, no live operation](images/gui-fluent.png) + +```powershell +# Native Fluent controls; the business engine still runs in Windows PowerShell 5.1. +pwsh -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui + +# Compatible WPF controls when PowerShell 7.5+ is not installed. +powershell.exe -STA -File .\Invoke-PraRemoteMailbox.ps1 -Gui -ConfigPath .\config\PraRemoteMailbox.config.psd1 +``` + +Choose the action and the **execution phase** before previewing. The default phase comes from +`Execution.Phase`; it is always displayed and passed explicitly to the engine. Opening the window, +refreshing local state or selecting a batch does not connect to AD or Microsoft 365. + +| Operation | Required input | Where it runs / next step | +|---|---|---| +| Convert, AD + cloud | configured scope or one identity; no input batch | this host performs AD, sync and cloud | +| Convert, AD only | configured scope or one identity; no input batch | copy the new Convert batch folder to the cloud host | +| Convert, Cloud only | Convert batch produced by AD | cloud checks and permissions; no AD writes | +| Recover, AD + cloud | original Convert batch | this host restores AD, syncs, checks cloud and finishes AD restoration | +| Recover, AD only | original Convert batch | copy the **new Recover folder and original Convert folder** to the cloud host | +| Recover, Cloud only | **Recover batch**, not the Convert ID | cloud checks; when needed, copy the new Finalize folder back to AD | +| Finalize | RecoverFinalize package | AD host only; restores deferred shared attributes/tags and syncs | +| Check | Convert batch or one identity | read-only cloud check; use a UPN for an identity without AD access | + +For **Convert AD / AD + cloud**, choose the target source directly in the window: + +| Source | Selection | +|---|---| +| Configuration | use `Scope` from the selected configuration, or fill in one identity to override it | +| OU | type its distinguished name or click **Choisir une OU** to browse/filter the OU list on the configured DC; child OUs are included | +| Csv | click **Charger un CSV** and select a list with an `Identity` column (UPN, sAMAccountName, DN or GUID); comma and semicolon are supported | + +The source is passed to the engine as `-SearchBase` or `-CsvPath`; the original configuration is +**not rewritten**. OU and CSV are mutually exclusive and cannot be combined with a single identity. +The source controls are hidden for Cloud, Recover, Finalize and Check, whose batch/identity rules +remain unchanged. The OU browser reads AD only when clicked, in a separate Desktop process; no +directory or cloud module is imported into the WPF host. + +**Users and shared mailboxes are supported:** use `All` (with `Scope.IncludeShared = $true`, the +default), `UsersOnly` or `SharedOnly`. A single identity can be a user or a shared mailbox. For a +CSV, every explicit object must be eligible for the selected type: wrong types, exclusions, +duplicates and non-mailbox objects are refused before any write, not silently converted or skipped. + +```csv +Identity +user01@contoso.com +shared01@contoso.com +``` + +Selecting another OU/list or changing the CSV contents invalidates the previous Preview. +The list is revalidated and hashed before Apply. Missing/empty lists and a missing Identity column +keep Apply locked. AD still verifies the real object types and complete backups before writing. + +You can browse a batch JSON file from a copied folder, or use its ID. Keep the **whole folder** +unchanged: JSON, data-only CLIXML, SHA-256, State proof and journals. Both hosts must use the same +version and `Environment`, but each has its own configuration and installed prerequisites. The +window does **not** copy files, invoke the other host or bypass the engine's proof checks. + +Set the optional identity/type filters and, for Convert on AD, the maximum number of objects. +For Check, choose the expected state and whether to make one pass instead of waiting. +Preview first, inspect the result table, activity and HTML report, then Apply and type **CONVERT**, +**RECOVER** or **FINALIZE** in the confirmation. Apply uses the same request as the preview; +changing the phase, filters, configuration or batch/proof files requires another preview. +An errored, unfinished or empty preview does not enable Apply. The engine independently rereads +the directory, backs up and verifies the targets before every write; a GUI preview is not a frozen +copy of AD state. + +The window stays responsive while the child process runs. Progress shows the current step and +object; the result preserves exit codes **0/1/2**, the batch ID, report/log paths and exact next +commands. **Pending is not failure and not completion:** finish the indicated Cloud or Finalize +step. Do not close or forcibly stop the engine mid-batch; closing the window is blocked while an +operation is running so that backup/proof creation is not interrupted. + +### Recipe 1 — Convert one user + +Nothing to change in the configuration: `-Identity` replaces the scope (UPN, sAMAccountName, DN or GUID). + +```powershell +cd D:\PRA\PraRemoteMailbox +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com # 1. preview +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity jdupont@contoso.com -Mode Apply # 2. convert +``` + +The preview shows `jdupont UserMailbox → RemoteUserMailbox · convert`, the attributes that change and `licence group … not member → member`. The Apply backs up the account, writes AD, adds it to the licence group, runs one Entra Connect cycle, then waits until Exchange Online shows a mailbox and a licence. The summary ends with: + +```text +Batch 1d5ac20b +Next To roll back this batch later: .\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b +``` + +To undo: recipe 5. + +### Recipe 2 — Convert a whole OU (users and shared mailboxes) + +1. In `config\PraRemoteMailbox.config.psd1`, section `Scope`: + +```powershell +Scope = @{ + Mode = 'OU' + SearchBase = 'OU=Paris,OU=Sites,DC=contoso,DC=com' # sub-OUs included + GroupDN = '' + CsvPath = '' + IncludeShared = $true # also the shared mailboxes of the OU + IncludeRoom = $false + IncludeEquip = $false + ExcludeSamAccountNames = @('svc-scan', 'test01') # never converted +} +``` + +2. Then: + +```powershell +.\Invoke-PraRemoteMailbox.ps1 -Action Convert # preview: every on-premises mailbox of the OU +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Mode Apply # convert them all, in one batch +``` + +Only **on-premises mailboxes** are taken: objects without an on-premises mailbox (already in Exchange Online, mail users, contacts) are ignored. For a first wave, add `-MaxObjects 10` (the first 10 by sAMAccountName). For the shared mailboxes, the preview also lists **who will get FullAccess, SendAs and SendOnBehalf** (see [shared mailbox permissions](#shared-mailbox-permissions-where-they-come-from)). + +### Recipe 3 — Convert only the shared mailboxes + +All the shared mailboxes of the configured scope (recipe 2), users excluded — for example a second wave after the users: + +```powershell +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Scope SharedOnly # preview +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Scope SharedOnly -Mode Apply # convert +``` + +One shared mailbox only: + +```powershell +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity compta@contoso.com +.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Identity compta@contoso.com -Mode Apply +``` + +Shared mailboxes never get a licence. After the sync, the tool waits for the cloud shared mailbox, then grants each permission found in AD and re-reads it; every grant is printed (`compta@contoso.com: FullAccess granted to marie@contoso.com and verified`). The permission holders do **not** need to be converted first: a user still on-premises exists in Exchange Online as a synchronised mail user and can receive the permission (it is useful as soon as that user has a cloud mailbox). `-Scope SharedOnly` takes the shared mailboxes even when `IncludeShared = $false`; with `Scope.Mode = 'Csv'`, use a file that lists only shared mailboxes. The mirror option is `-Scope UsersOnly`. + +### Recipe 4 — Convert a list of mailboxes or the members of a group + +| Source | Configuration (`Scope`) | +|---|---| +| A CSV file | `Mode = 'Csv'`, `CsvPath = '.\config\Wave1.csv'` — one column `Identity` (UPN, sAMAccountName, DN or GUID), see `config\Targets.sample.csv`. Every line must be an on-premises mailbox, otherwise nothing is converted. | +| An AD group | `Mode = 'Group'`, `GroupDN = 'CN=PRA-Wave1,OU=Groups,DC=contoso,DC=com'` (nested groups included). | + +The commands are those of recipe 2. + +### Recipe 5 — Roll back (Recover) + +Use the batch ID of the Convert (summary, report, or the folder name `Backups\Batch-…`): + +```powershell +.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b # preview of the roll-back +.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Mode Apply # the whole batch +.\Invoke-PraRemoteMailbox.ps1 -Action Recover -Batch 1d5ac20b -Identity jdupont@contoso.com -Mode Apply # one object of the batch +``` + +Users get their original attributes back and leave the licence group. Shared mailboxes are first removed from Exchange Online; their on-premises attributes come back when Exchange Online confirms it (up to `Polling.TimeoutMinutes`), in the same run. Their on-premises permissions were never changed. + +### Recipe 6 — Check, at any time + +```powershell +.\Invoke-PraRemoteMailbox.ps1 -Action Check -Batch 1d5ac20b # are the mailboxes of the batch in Exchange Online? +.\Invoke-PraRemoteMailbox.ps1 -Action Check -Identity jdupont@contoso.com # one mailbox +.\Invoke-PraRemoteMailbox.ps1 -Action Check -Batch 1d5ac20b -Expect Deprovisioned # after a Recover +``` + +Read only. Check waits for the expected state (up to `Polling.TimeoutMinutes`); add `-Once` for a single pass. + +### Scenario C — Convert on two servers + +```steps +AD server | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase AD -Mode Apply` — backup, AD changes, sync. The summary prints the batch ID. +Copy | Copy the folder `Backups\Batch-...` to the `Backups` folder of the cloud server (the whole folder, unchanged). +Cloud server | `.\Invoke-PraRemoteMailbox.ps1 -Action Convert -Phase Cloud -Batch -Mode Apply` — waits for the mailboxes, grants the permissions. +``` + +### Scenario D — Recover on two servers + +```steps +AD server | `-Action Recover -Phase AD -Batch -Mode Apply` — users restored, shared mailboxes deprovisioned. Exit code 2: next step required. +Copy | Copy the new `Batch-` folder **and** the original `Batch-` folder to the cloud server. +Cloud server | `-Action Recover -Phase Cloud -Batch -Mode Apply` — checks the deprovisioning and writes a Finalize package `Finalize-`. +Copy back | Copy the `Finalize-` folder to the `Backups` folder of the AD server. +AD server | `-Action Finalize -Batch -Mode Apply` — restores the shared mailboxes and the retention tags. +``` + +Since 2.1.0, `-Phase Cloud` never performs the last AD restore itself, **even with RSAT installed**. +Phase Both retains inline restoration unless `DeferOnPremRestore` is enabled. Finalize is only +required when the result supplies a Finalize package (deferred shared attributes or retention tags). + +### What you see + +![Preview of a Convert](images/console-preview.png) + +1. The **banner**: action, mode, scope, tenant, configuration and log file. +2. **Numbered steps**. In a preview, the steps that write are shown as skipped. +3. For each object: its type change (`UserMailbox → RemoteUserMailbox`) and **only the attributes that change** — green = added, yellow = changed, red = removed. For a shared mailbox, the holders that will get **FullAccess**, **SendAs** and **SendOnBehalf** in Exchange Online. The full before/after values and the complete lists of holders are in the log. +4. The **summary**: result, batch ID, backup, report, log, duration and the **next command**. + +![Summary of a Convert Apply](images/console-apply.png) + +### Exit codes + +| Code | Meaning | What to do | +|---|---|---| +| 0 | Done (or preview without error) | nothing | +| 1 | Failed — see `Error` in the summary | fix the cause, run the same command again | +| 2 | Done, but objects are **Pending** | run the next step printed in the summary | + + +## 9. Reading the results + +### The HTML report + +![HTML report (synthetic example data)](images/report.png) + +One page per run in `reports\`: tiles with the counters (including **Warnings**), the next step, the warnings of the run, one row per object, and the run errors. It is self-contained (no external resource, no network, no telemetry). + +The rows are stored in the page as compressed chunks of 20,000 rows (gzip, then base64: compression, **not** encryption; protect the file like the CSV). When the page opens it decodes **all** chunks at once (eager, not lazy; about 0.3 s for 50,000 rows on the test PC), then shows only the rows in view: the *Summary* grid (the eight columns above) and the *All 22 fields* grid never hold more than 200 data rows in the page, whatever the number of rows. Scroll, or use the keyboard (arrows, Page Up/Down, Home/End, Enter for all the fields of a row). Filters (status, type, action, six yes/no flags, ten text fields and a search over the 22 fields) combine with AND, always inspect every row and show the filtered counts; **Reset filters** clears them. **Export filtered CSV** writes every matching row with the 22 fields (semicolon, UTF-8 with BOM, every field quoted, a cell starting with `=`, `+`, `-` or `@` gets a leading `'`). The CSV written next to the report is unchanged and has the raw values. Warnings and run errors are listed 100 per page with their own filter; none is dropped. + +Requirement: a current desktop Microsoft Edge or Google Chrome (the page needs `DecompressionStream`). Without it, without JavaScript, or if a chunk is missing or damaged, the page says so explicitly and displays no partial result; the run summary (tiles, next step) stays visible and the CSV with the same name holds every row. A report of 50,000 or 100,000 rows is for reading; Apply itself remains designed for the batch sizes of the guide. + +### Warnings + +A warning never stops the run and never changes the exit code; it says that something was **left aside on purpose** and should be read. Today: the permission entries of a shared mailbox that point to an account no longer in AD (chapter 2). It is shown in four places: a yellow `▲` line in the console under the object, `[WARN]` in the log, the `Warnings` column of the CSV, and in the HTML report (*Warnings* tile, *Warnings* card, yellow mark on the row). The summary card of the console turns yellow and shows the last warnings. + +![Report of a preview with a warning (synthetic example data)](images/report-warning.png) + +### Statuses + +| FinalStatus | Meaning | +|---|---| +| `Planned` | Preview: this is what Apply would do. | +| `Success` | Done and verified (AD re-read; cloud state reached). | +| `AlreadyDone` | Nothing to change: the object was already in the expected state (counted as done). | +| `Pending` | AD done, waiting for another step (shared mailbox deprovisioning, Finalize). | +| `Error` | Stopped; see `Detail` and the log. | +| `Skipped` | Not processed (the batch stopped before it, or no applicable check). | + +### The CSV columns + +`ObjectGuid`, `SamAccountName`, `UserPrincipalName`, `Action`, `IsShared`, `ADApplied` (an AD write was made), `ADVerified` (AD re-read matches), `GroupAction` (Added / Removed / Preserved), `BackupPath`, `LastOperation`, `CloudMailbox`, `CloudLicense`, `CloudStatus`, `CloudDetail`, `PreserveCloudMailbox`, `PreserveLicense`, `DeprovisionConfirmed`, `PermDetail` (permissions verified / to grant / trustees missing), `PermMissing`, `FinalStatus`, `Detail`, `Warnings` (e.g. permission entries ignored). Separator `;`, UTF-8. + +> [!CAUTION] +> Logs, transcripts and reports contain AD values (addresses, DNs). Protect them like the backups; never publish them unfiltered. + + +## 10. Files: batches, proofs and packages + +```text +Backups\ + Batch-efb9d60a75054b6b9cabefa418121934\ one batch = one Apply (private ACL) + Recover-LAB-20260930_194723-efb9d60a.json typed records: what is restored (schema 3) + Recover-LAB-20260930_194723-efb9d60a.json.sha256 + Recover-LAB-20260930_194723-efb9d60a.clixml every AD value of every object (data-only CLIXML) + State-efb9d60a75054b6b9cabefa418121934.json AD proof: objects verified after the writes (+ .sha256) + Journal-efb9d60a75054b6b9cabefa418121934.jsonl Started / Applied / Verified / Failed per write + Finalize-3f2c90e1....\ Finalize package (Recover on two servers) + -cloud\CloudOperations.jsonl journal of the Exchange Online grants of a run +logs\ PRA__.log and .transcript.txt +reports\ PRA__.csv and .html +``` + +- **Batch ID** = the first 8 characters of the folder name; `-Batch` accepts 8 characters or more, or the path of the JSON file. +- The **State** file is the proof that the AD part was done and verified: the cloud phase and Finalize refuse to write without it. +- Copy **whole folders**, never single files, and never rename them. +- Keep the batches at least until the Recover is finished and checked; then archive them with the logs. + +# Part IV · Maintain + + +## 11. Inside the tool + +### Execution flow + +```flow +terminal | Invoke-PraRemoteMailbox | action, mode, phase +arrow | PRA.Common | config, audit, console +directory | PRA.Directory | plans, backup, AD writes +arrow | PRA.Backup | CLIXML capture +cloud | PRA.Cloud | EXO, Graph, grants +``` + +The run state is one hashtable, the **context** (`$context`), created by the entry script and passed to every function: configuration, mode, the result rows, the run errors (`Issues`), the files produced, the current step, and two callbacks: `Approval` (ShouldProcess before every write) and, in the cloud phase, `AssertCloudAuthorization` (re-reads the AD proof before every Exchange Online grant). + +### The safety contract + +1. **Read everything, then write.** Every object of the batch is read and planned before the first write. +2. **Backup before the first write**, for the whole batch: typed JSON (what Recover restores), data-only CLIXML (every AD value), SHA-256, private folder, new files only, then **re-read and compared** with the plans. A failure at the 13th object stops before any write. +3. **Before each write**: no previous error, Apply mode, approval, backup unchanged, and the object **re-read**: same `uSNChanged`, same DN, same values as in the backup. After each write: re-read of the expected values. +4. **First error = stop**: no next object, no sync, no cloud write, no automatic rollback. The journal records `Started` before and `Applied` after every write. +5. **Proofs**: the State file lists the objects verified; the cloud phase, Finalize and the sync refuse a batch without a valid proof, and Finalize refuses an object changed since the proof. +6. **A cloud error is never "absent"**: deprovisioning is confirmed only when Exchange Online returns no mailbox **and** a MailUser recipient. Only then are the shared mailboxes restored on-premises. +7. **Preview and Check never write** (AD, Entra Connect, Exchange Online); they still write their log, transcript and report. + +### Code map + +| File | Content | +|---|---| +| `Invoke-PraRemoteMailbox.ps1` | Parameters, context, the four actions step by step, batch resolution (`Get-PraBatchFile`), one confirmation (`Confirm-PraApply`), Finalize package (`Save-PraFinalizePackage`, `Get-PraFinalizeInput`), next-step hints. | +| `module\PRA.Common.psm1` | 1 console theme · 2 console and log (`Write-PraBanner/Step/Item/Log/Summary`) · 3 configuration (`Import-PraConfiguration`, defaults = list of valid keys) · 4 audit (log + transcript) · 5 results (`Get-PraOutcome`, CSV/HTML, `Complete-PraRun`). | +| `module\PRA.Directory.psm1` | 1 receipts and files · 2 directory reads (`Get-PraTarget`, `Get-PraUser`) · 3 attribute states and before/after display · 4 shared permissions from AD · 5 plans (`New-PraPlan`) · 6 backups and proofs · 7 writes (`Invoke-PraAdBatch`) · 8 Entra Connect (`Invoke-PraSync`). | +| `module\PRA.Backup.psm1` | Data-only CLIXML codec (write, stream-validate). | +| `module\PRA.Cloud.psm1` | Exchange Online worker (fixed commands, identity checks), sessions, pre-check, cloud phase (polling, grants), retention check. | +| `module\PRA.Gui.psm1`, `module\PRA.Gui.xaml` | WPF layout/theme, local state and input selection, preview guard, confirmation and Desktop child-process supervision. Optional `PRA_EVENT_FILE` JSONL channel carries start, step, item, summary and result events from the common module. | +| `module\Test-PackageIntegrity.ps1` | Package verifier, run by the entry, every module and the GUI helper before they do anything. | + + +## 12. Modifying the tool + +The rule: **change the plan, never the guards.** The backup, the re-reads and the proofs work for any attribute listed in the plan. + +### Manage one more AD attribute + +1. Add it to `$script:AttributeKinds` in `PRA.Directory.psm1` with its type (`String`, `MultiString`, `Bytes`, `Bool`, `Int`, `Long`). +2. Set its target value in `New-PraPlan` (branch `Convert`, and `Deprovision` if needed). Recover restores it automatically from the backup. +3. Old batches do not contain it: `Assert-PraStoredRecord` refuses them for Recover. Decide explicitly (new backup schema, or keep old batches on the previous version). +4. Add a gate test (chapter 13) with a synthetic user having and not having the attribute. + +### Change the routing address or the recipient types + +`Get-PraRoutingAddress` (routing) and the `Convert` branch of `New-PraPlan` (types). Keep `msExchRemoteRecipientType` of shared mailboxes at 97/99: 100/102 mean "already migrated" and are refused. + +### Add a cloud check + +In `Invoke-PraCloudPhase` (`PRA.Cloud.psm1`): add the fact in `Get-PraGraphFact` or in the worker (`Mailbox`, `Recipient`), then include it in `$mbok` / `$licok`. A new Exchange Online **write** must go through `Invoke-PraPermissionGrant` (approval, proof, journal, one call, bounded re-read). + +### Change the console or the report + +Texts and icons: `PRA.Common.psm1`, region 1-2. The HTML report: `templates\Report.template.html` (markers `{{...}}`; the data is written by `Write-PraReportHtml`, which fills `{{DATA}}`; no change of the data format without changing the viewer script). The template is covered by the package integrity check. The CSV columns: `$script:RowFields`. + +### PowerShell pitfalls met during the build + +| Pitfall | Rule | +|---|---| +| Windows PowerShell 5.1 transcript writes every `Write-Host -NoNewline` piece on its own line | one `Write-Host` per line, one colour per line (`Write-PraHost`) | +| `GetNewClosure()` copies the variables of the current scope, including parameters with validation attributes (an empty `[ValidateSet]` parameter throws) | create closures inside a small function (`New-PraApprovalCallback`) | +| `ShouldProcess` reads `$ConfirmPreference` of the calling scope | the approval closure sets it from `$context.ConfirmPreference` | +| App-only Exchange Online sessions report the organisation domain as `TenantID` | the session guard accepts `Cloud.Organization` + `AppId` | +| `Import-Module ActiveDirectory` creates an `AD:` drive on a default DC | `$env:ADPS_LoadDefaultDrive = 0` before the import | +| Files without BOM are read as ANSI by Windows PowerShell 5.1 | every `.ps1/.psm1/.psd1` is UTF-8 **with BOM** (checked by the gate) | +| `Get-ADUser -Identity` does not search the UPN | exact, escaped LDAP filter (`Get-PraUser`) | +| With `-ErrorAction Stop`, Windows PowerShell 5.1 writes a `TerminatingError` line in the transcript even when the error is caught and expected (e.g. "No permissions were found" before a FullAccess grant) | read an expected error through `-ErrorAction SilentlyContinue -ErrorVariable` and check every record; anything else is thrown | +| `Get-EXORecipient -UserPrincipalName` answers an absent object with HTTP 404 (`ManagementObjectNotFoundException`), not with an empty result | only that exact answer, for that exact UPN, means "absent" (`MissingRecipient`); any other error stops | +| Exchange Online assemblies stay loaded in the console after a run; Microsoft Graph loaded later fails (`GetTokenAsync ... does not have an implementation`) | Graph is connected before EXO within a run; between runs, a clear message asks for a new window | + + +## 13. Testing a change + +### The gate (no directory, no tenant) + +```powershell +powershell.exe -NoProfile -File .\tests\Invoke-TestGate.ps1 # in the repository; tests and tools are not part of the package +``` + +It checks every file (parse, UTF-8 BOM, help), runs PSScriptAnalyzer (Windows PowerShell 5.1 compatibility profiles), then the Pester suites `tests\PraRemoteMailbox.Tests.ps1` and `tests\PraRemoteMailbox.Gui.Tests.ps1` and `tests\PackageIntegrity.Tests.ps1` (the integrity logic on a controlled copy where only the signature call is substituted, plus the real package, which fails closed unless every file carries the valid owner signature): synthetic AD and ADSync modules, a synthetic cloud barrier, the **real** entry script in a separate Windows PowerShell process, and the WPF window without live connections. It proves in particular: no write before the complete backup, stop at the first error, no write in Preview/-WhatIf, no Apply without confirmation in a non-interactive process, memory bounds with 13 shared mailboxes × 500 trustees, proofs and Finalize packages, GUI phase/command boundaries and preview invalidation. Evidence: `tests\evidence\gate\\` (`RESULT.txt`, `gate-result.json`, Pester XML). + +Requirements: Pester 5 or later and PSScriptAnalyzer 1.25.0 (machine-wide modules). Every test is mandatory: a skipped or missing test fails the gate. + +Release 2.0.0 (2026-10-01, VMLLM): **279 tests, 279 passed**, 0 analyzer error, about 12 minutes — evidence `tests\evidence\gate\v2.0.0-release`. The only analyzer warnings on the delivered files are expected: `Write-Host` in the console module (14, by design) and `ConvertFrom-Markdown` in the documentation builder (6, PowerShell 7 tool). Compared with the 325 tests of 1.3.6, the 61 combinations of the removed path options (`-BackupFile`, `-StateFile`, `-LogPath`, `-TranscriptPath`, `-ReportDirectory`) are replaced by 9 tests of `-Batch` and of the confirmation. + +### The lab campaign + +After a change of the engine, repeat the campaign of annex B on the lab: Preview, Convert Apply (users + shared), Check, Recover on two servers (AD, Cloud with Finalize package, Finalize), plus a Recover of a batch written by the previous version. + +# Annexes + + +## Annex A — Troubleshooting + +| Message | Cause | What to do | +|---|---|---| +| `Configuration: unknown setting X` | typing mistake or setting of another version | compare with chapter 6 | +| `Batch not found under ...` | the batch folder is not in `Storage.BackupFolder` | copy the whole `Batch-...` / `Finalize-...` folder there, or give the path of the JSON file | +| `The Convert batch used by this Recover is not in ...` | cloud phase of a Recover without the original Convert batch | copy the `Batch-` folder too | +| `Batch ... is a Convert batch: the cloud phase of a Recover needs the batch printed by its AD phase` | wrong ID | use the ID printed by `Recover -Phase AD` | +| `EntraConnect.Sync = $true but the ADSync module is not on this server` | AD part not on the Entra Connect server | set `EntraConnect.Server`, or run on the Entra Connect server, or `Sync = $false` | +| `Entra Connect server X is not reachable with PowerShell remoting` | WinRM / rights | `Test-WSMan X`; the account must be admin or `ADSyncOperators` on X | +| `An Exchange Online session already exists in this console` | the console was used for EXO before | open a new Windows PowerShell window | +| `Microsoft Graph cannot load in this console (assembly conflict ...)` | Exchange Online was used earlier in the same window (for example Recover, then Check): its assemblies stay loaded and Microsoft Graph cannot load next to them | open a new Windows PowerShell window for each run that needs Microsoft Graph (Check, Convert of users) | +| `Exchange Online session: wrong tenant (...)` | signed in to another tenant, or `Cloud.Organization` wrong | fix `Cloud.TenantId` / `Cloud.Organization` | +| `uSNChanged changed: the object was modified since it was planned` | someone (or a sync) changed the object between plan and write | run the command again (a new plan is made) | +| `Finalize: use the domain controller of the proof` | `DomainController` differs from the DC of the Recover AD phase | set the same `DomainController` | +| `Expected state not reached (timeout or -Once)` | Exchange Online is slow (provisioning up to 60 min after a sync) | run the cloud phase again later (`-Phase Cloud -Batch `); nothing is granted twice | +| `Permission ... trustees missing in Exchange Online` | a permission holder is not known in Exchange Online (not synchronised) | check that Entra Connect synchronises the holder, or exclude it (`ExcludeTrusteeSamAccountNames`) | +| `Trustee not found in Exchange Online at the pre-check: ` | same, found before any AD write (phase Both) | same; nothing was written | +| `▲ : N permission entries ignored, account unknown in AD (deleted, or from another domain): FullAccess S-1-5-21-...` (warning) | a permission entry of the shared mailbox points to an account that no longer exists ("Account Unknown") | nothing to do: the other holders are granted. To clean the source: SendAs entries in *Active Directory Users and Computers* → account of the shared mailbox → *Security*; FullAccess entries are removed when Exchange is back (`Remove-MailboxPermission`). If the account belongs to **another domain** and must keep its access, grant it by hand in Exchange Online | +| `Trustee without UPN` / `Unsupported trustee type` | a holder is an account without UPN, or a contact / computer | give it a UPN, or exclude it (`ExcludeTrusteeSamAccountNames`) | +| `Apply needs a confirmation and this console cannot ask for one` | `-Mode Apply` in a non-interactive run | add `-Force` | + +> [!TIP] +> Start with the **summary card**, then the **log** (`[ERROR]` lines, full before/after values with `[DETAIL]`), then the **journal** of the batch to see which write was started and applied. + + +## Annex B — Lab test campaign 2026-09-30 + +Lab `exlab.lab` (DC1, DC2, Entra Connect on AADC, Exchange servers stopped = disaster), tenant `M365CPI89259425`, operator account `EXLAB\pra-operator`, certificate sign-in. Objects of `OU=PRA-PILOT-OU`: `pra-user04`, `pra-user05` (user mailboxes), `pra-shared02`, `pra-shared03` (shared mailboxes, 3 FullAccess + 3 SendAs each). + +All runs were made with the **real** script on `VMLLM` (Windows PowerShell 5.1), against the real directory, the real Entra Connect server and the real tenant. Result: **28 runs**: 26 PASS, and 2 runs (T17, T18) that found defects 3 and 4, fixed since and covered by the gate (list below). + +| # | Command (short form) | What was checked | Result | +|---|---|---|---| +| T1 | `-Action Convert` (Preview) | plan of the 4 objects of the scope, nothing written, report with "Planned" rows | PASS | +| T2a | `-Action Recover -Batch <1.3.6 batch> -Mode Apply -Force` | backward compatibility: Recover of a Convert batch written by **1.3.6** (`pra-user01`, `pra-shared01`), AD restore + sync + cloud | PASS after fixes 1 and 2 | +| T2b | `-Action Recover -Phase Cloud -Batch ` without the Convert batch | clear message naming the missing `Batch-` folder, nothing written | PASS | +| T2c | `-Action Recover -Phase Cloud -Batch -Mode Apply -Force` | cloud phase of the 1.3.6 Recover, on-premises restore made inline | PASS | +| T3 | `-Action Convert -Mode Apply -Force` (phase Both) | 2 users + 2 shared, 12 permissions: backup, AD writes and proofs, remote delta sync, licence group, provisioning wait, permissions re-granted and verified. Batch `1d5ac20b`, **10 min 16 s** | PASS | +| T4 | `-Action Check -Expect Provisioned` | the 4 mailboxes are cloud mailboxes, permissions present | PASS | +| T5a | `-Action Recover -Phase AD -Batch 1d5ac20b -Mode Apply -Force` | AD restore, proof, sync; **exit code 2** (cloud phase due). Batch `f4e7a0bd` | PASS | +| T5b | `-Phase Cloud -Batch 1d5ac20b` (negative), then `-Phase Cloud -Batch f4e7a0bd` with a "cloud server" configuration (`DeferOnPremRestore`) | the Convert ID is refused with the right ID to use; cloud phase OK and **Finalize package** `593c9c5f` written | PASS | +| T5c | `-Action Finalize -Batch 593c9c5f` (Preview, then Apply) | package and proof hashes verified, on-premises restore of the shared mailboxes | PASS | +| T6 | `-Action Finalize -Batch 593c9c5f -Mode Apply -Force` (replay) | idempotent: nothing to write, success | PASS | +| T7 | `-Action Convert -Phase AD -Identity pra-shared02 -Mode Apply -Force` | one object, AD part only. Batch `79f5a1e1`, exit code 2 | PASS | +| T8 | `-Action Convert -Phase Cloud -Batch 79f5a1e1` (Preview) | one pass, 3 permissions reported "to grant", no wait, nothing granted | PASS | +| T9 | `-Action Convert -Phase Cloud -Batch 79f5a1e1 -Mode Apply -Force` | provisioning wait, permissions granted and verified | PASS | +| T10 | `-Action Recover -Batch 79f5a1e1 -Mode Apply -Force` (phase Both, one server) | AD restore, sync, cloud phase and on-premises restore inline, **12 min 29 s** | PASS | +| T11 | `-Mode Apply` without `-Force` in a non-interactive process | stops **before the backup** with "Apply needs a confirmation", exit code 1, nothing written | PASS | +| T12 | `-Action Check -Expect Deprovisioned` | the objects are back on-premises | PASS | +| T13 | `-Action Convert` (Preview) | final plan of the 4 objects (run again on 2026-10-01 for the screenshot of chapter 8) | PASS | +| T14 | `-Action Convert -Scope SharedOnly` (Preview, 2026-10-01) | only the 2 shared mailboxes; FullAccess / SendAs holders listed under each one, complete lists in the log | PASS | +| T15 | `-Action Convert -Identity pra-shared02` (Preview, 2026-10-01) after giving FullAccess + SendAs to a temporary account, then deleting it | the 2 entries of the deleted account are ignored: yellow line and yellow summary card, `[WARN]` in the log, CSV column `Warnings`, *Warnings* tile and card in the report; exit code 0; the permissions of `pra-shared02` were restored after the test | PASS | +| T16 | `-Action Convert -Identity pra-shared03` (Preview, then `-Mode Apply -Force`, 2026-10-01) after adding on `pra-shared03`: FullAccess for the group `PRA-Shared03-Team` (`pra-user01` + a nested group with `pra-user02`), SendOnBehalf for `pra-user01`, and removing its SendAs in Exchange Online | 9 permissions: the group becomes its 2 users (nested group included) and never gets a right itself; FullAccess **granted** and verified for 5 users, SendAs **granted** and verified for 3; SendOnBehalf already brought by Entra Connect, verified; an independent read of Exchange Online shows the same; **0 `TerminatingError` line** in the transcript. Batch `662e8b6d`, **8 min 48 s** | PASS | +| T17 | `-Action Recover -Batch 662e8b6d -Mode Apply -Force` | AD part and sync OK; at the first cloud check Exchange Online answered 404 "couldn't be found" for the mailbox that was turning into a MailUser: stop, nothing restored on-premises (defect 3) | defect found → fix 3 | +| T17b | `-Action Recover -Phase Cloud -Batch 8995dcbf -Mode Apply -Force`, after removing the T16 test material from the object | refused before any write: "the AD proof is out of date" (the object changed after the AD phase) | PASS (protection) | +| T17c | `-Action Recover -Batch 662e8b6d -Mode Apply -Force` (again) | AD already in the expected state (0 change, no sync), deprovisioning confirmed, on-premises restore (10 attributes) and sync. **4 min 24 s**, 0 `TerminatingError` line | PASS | +| T18 | `-Action Check -Expect Deprovisioned -Identity pra-shared03`, in the same process as T17 | Microsoft Graph cannot load after the Exchange Online assemblies of T17 (`GetTokenAsync ... does not have an implementation`) (defect 4) | defect found → fix 4 | +| T18b | same command in a new process | `pra-shared03` deprovisioned in Exchange Online (MailUser), back on-premises in AD | PASS | + +Measured durations: delta sync on the Entra Connect server (remote) about **5 min 30 s**; cloud phase alone 28 s to 61 s once the objects are provisioned. + +Defects found by the campaign and fixed in 2.0.0 (all now covered by the gate): + +1. With `-Force`, the approval callback of the AD engine still called `ShouldProcess` with `ConfirmImpact High` → "Windows PowerShell is in NonInteractive mode" in the scheduled task, **before any write** (fail-closed). Fix: the single confirmation of the run sets `ConfirmPreference = None` for the callbacks. +2. The session guard compared the organisation domain of a certificate session with `Cloud.TenantId` and refused it (finding 1 of annex F). Fix: the guard accepts `Cloud.Organization` and checks the `AppId`. +3. (T17) `Get-EXORecipient -UserPrincipalName` answers an absent object with HTTP 404 `ManagementObjectNotFoundException`. During the Recover cloud check, while the mailbox turns into a MailUser, this answer stopped the run (fail-closed). Fix: this exact answer, for this exact UPN, means "not there yet": the check waits and reads again; any other error still stops. +4. (T18) A run that needs Microsoft Graph after a run that used Exchange Online in the same console failed with an obscure `GetTokenAsync` error. Fix: a clear message asks for a new Windows PowerShell window (annex A). +5. (transcripts of T3 and T9) Before each FullAccess grant, the normal "No permissions were found" answer appeared as a `TerminatingError` line in the transcript. Fix: read through `-ErrorVariable`; T16 and T17c: 0 such line. + +The lab was left as before the tests: T16 test material removed (groups deleted, `msExchMailboxSecurityDescriptor` identical to its copy taken before the test, `publicDelegates` empty), `pra-shared03` back on-premises. + +Lab fixes made before the campaign (outside the tool): domain controller `DC2` had not replicated from `DC1` since 2026-09-18 (Kerberos `0x80090322`, stale KDC ticket); fixed by purging the tickets of the computer account and forcing the replication. Account `EXLAB\pra-operator` and the lab application (annex C) were created for the campaign. + + +## Annex C — Certificate sign-in (application) + +Least privilege for unattended runs: one application, one certificate, two application permissions and one Exchange role. + +```powershell +# 1. Certificate, in the store of the account that runs the tool (private key not exportable) +$cert = New-SelfSignedCertificate -Subject 'CN=PRA Remote Mailbox' -CertStoreLocation Cert:\CurrentUser\My ` + -KeyExportPolicy NonExportable -KeySpec Signature -KeyLength 2048 -HashAlgorithm SHA256 -NotAfter (Get-Date).AddYears(1) +Export-Certificate -Cert $cert -FilePath .\pra-app.cer +$cert.Thumbprint # -> Cloud.CertificateThumbprint +``` + +```powershell +# 2. Application (Azure CLI, Global Administrator or Privileged Role Administrator) +$app = az ad app create --display-name 'PRA Remote Mailbox' --sign-in-audience AzureADMyOrg --query appId -o tsv +az ad app credential reset --id $app --cert '@pra-app.cer' --append +$sp = az ad sp create --id $app --query id -o tsv +# Microsoft Graph: User.Read.All (application) +az ad app permission add --id $app --api 00000003-0000-0000-c000-000000000000 --api-permissions df021288-bdef-4463-88db-98f22de89214=Role +# Office 365 Exchange Online: Exchange.ManageAsApp (application) +az ad app permission add --id $app --api 00000002-0000-0ff1-ce00-000000000000 --api-permissions dc50a0fb-09a3-484d-be87-e023b12c6440=Role +az ad app permission admin-consent --id $app +# 3. Entra role Exchange Recipient Administrator for the service principal +az rest --method POST --url https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments ` + --body "{ \"roleDefinitionId\": \"31392ffb-586c-42d1-9346-e59415a2cc4e\", \"principalId\": \"$sp\", \"directoryScopeId\": \"/\" }" +$app # -> Cloud.AppId +``` + +> [!NOTE] +> With certificate sign-in, Exchange Online identifies the session by the **organisation domain** and the **AppId**: `Cloud.Organization` must be the initial domain (`tenant.onmicrosoft.com`) and `Cloud.AppId` the application ID. To revoke: delete the certificate credential of the application (or the application). + + +## Annex D — File formats + +| File | Format | Key fields | +|---|---|---| +| Backup `---.json` | schema **3** (schema 1 and 2 of 1.2.x/1.3.0-1.3.2 still read) | `Operation` (Convert, Recover, Finalize), `BatchId`, `Environment`, `Server`, `RawFile` + `RawHash`, `SourceBackupHash` (Recover/Finalize: SHA-256 of the Convert backup), `Records[]` (`Attributes` = before, `PlannedAttributes` = after, `Licensing`, `Retention`, `SharedPermissions`, `CapturedUsnChanged`) | +| Capture `.clixml` | `PraDataOnlyClixml-v1` | every attribute returned by AD, closed descriptors (no native object) | +| AD proof `State-.json` | schema 2 | `Kind = ADVerified`, `BackupFile` + `BackupHash`, `Records[]` (`ObjectGuid`, `Operation`, `VerifiedUsnChanged`) | +| Journal `Journal-.jsonl` | one JSON per line | `Target`, `Operation`, `Status` (Started, Applied, Verified, FailedOrIndeterminate) | +| Finalize package manifest | schema 2, `Operation = RecoverFinalize` | `SourceBackupHash`, `StateHash`, `Items[]` (`RestoreShared`, `RestoreTag`, `DeprovisionConfirmed`) | + +Every JSON has a `.sha256` file; a mismatch is refused. **Version 2.0.0 reads the batches of 1.3.x** (tested: Recover of a 1.3.6 Convert batch in the lab). + + +## Annex E — Versioning and upgrade from 1.3.6 + +- The version is in `Invoke-PraRemoteMailbox.ps1` (`Version = '2.2.0'`, GUI call and help `.NOTES`), in each module header, in the configuration header, in `README.md` and `CHANGELOG.md`, and in the front matter of this guide. Change them together. +- Release checklist: gate PASS · lab campaign (annex B) · `pwsh tools\Build-Documentation.ps1` (PowerShell 7.4+, documentation only) · `tools\New-PraPackage.ps1` · git tag `vX.Y.Z`. + +**From 1.3.6**: keep the old `Backups` folders; copy the values of `DRP-Config.psd1` into the new file (same sections; `ADConnect` → `EntraConnect`; `BackupFolder/LogFolder/ReportFolder` → `Storage/Logging/Report`; `Safety` → `Storage.ForbiddenBackupRoots`); keep the same `Environment` to use the old batches. Command mapping: see `CHANGELOG.md` (table "Changed"). + + +## Annex F — Code review 2026-09-30 + +Review of version 1.3.6 (script 513 lines, four modules 3,386 lines, gate 325 tests) before the 2.0.0 rewrite. + +| # | Finding | Impact | 2.0.0 | +|---|---|---|---| +| 1 | Certificate sign-in to Exchange Online always refused by the session guard (TenantID of an app-only session = organisation domain) | cloud phase impossible unattended; explains the "UnAuthorized" blocker of the 1.3.4 pilot | **fixed** (annex C) | +| 2 | Missing ADSync detected **after** the AD writes | batch half done (AD written, no sync, no cloud) — seen in the E2E pilot | checked before the first write; remote sync added | +| 3 | One ShouldProcess prompt per AD write and per grant (ConfirmImpact High) | dozens of prompts for a batch; operators used `-Force` blindly | one confirmation after the plan | +| 4 | `-BackupFile` / `-StateFile` long paths, implicit choice of "the most recent backup" | copy/paste errors (a line break in a path stopped a Recover on 09-09) | short batch IDs, explicit, proof and source found automatically | +| 5 | Two modes that do the same thing (Inventory / Simulate), three ways to say "do not write" | confusion | Preview + `-WhatIf` | +| 6 | Settings read but ignored (`WaitForSync`, `VerifyTrusteeInCloud`), obsolete switches kept | misleading configuration | removed; unknown keys refused | +| 7 | Preview of a cloud phase reported missing permissions as errors and waited up to 60 min | preview unusable before an Apply | one pass, "to grant" | +| 8 | Console: every AD read and memory probe on screen, French/English mix, 358-character lines | unreadable runs, hard to maintain | compact console, English, details in the log | +| 9 | Two operator documents (guide + technical documentation, 210 KB) plus release notes and many session notes | no single reference | this guide | +| 10 | Exit code 0 for Pending | an orchestrator cannot see that a next step is due | exit code 2 | +| 11 | `Disconnect-ExchangeOnline` message on stdout of the child process (subprocess mode) | would break the one-line JSON protocol of the child | output suppressed | + +No defect was found in the backup, receipt and proof engine; its logic is unchanged in 2.0.0 and covered by the gate. diff --git a/docs/images/console-apply.png b/package/docs/images/console-apply.png similarity index 100% rename from docs/images/console-apply.png rename to package/docs/images/console-apply.png diff --git a/docs/images/console-preview.png b/package/docs/images/console-preview.png similarity index 100% rename from docs/images/console-preview.png rename to package/docs/images/console-preview.png diff --git a/docs/images/gui-fluent.png b/package/docs/images/gui-fluent.png similarity index 100% rename from docs/images/gui-fluent.png rename to package/docs/images/gui-fluent.png diff --git a/docs/images/readme-banner-dark.png b/package/docs/images/readme-banner-dark.png similarity index 100% rename from docs/images/readme-banner-dark.png rename to package/docs/images/readme-banner-dark.png diff --git a/docs/images/readme-banner-light.png b/package/docs/images/readme-banner-light.png similarity index 100% rename from docs/images/readme-banner-light.png rename to package/docs/images/readme-banner-light.png diff --git a/docs/images/readme-flows-dark.png b/package/docs/images/readme-flows-dark.png similarity index 100% rename from docs/images/readme-flows-dark.png rename to package/docs/images/readme-flows-dark.png diff --git a/docs/images/readme-flows-light.png b/package/docs/images/readme-flows-light.png similarity index 100% rename from docs/images/readme-flows-light.png rename to package/docs/images/readme-flows-light.png diff --git a/docs/images/readme-how-dark.png b/package/docs/images/readme-how-dark.png similarity index 100% rename from docs/images/readme-how-dark.png rename to package/docs/images/readme-how-dark.png diff --git a/docs/images/readme-how-light.png b/package/docs/images/readme-how-light.png similarity index 100% rename from docs/images/readme-how-light.png rename to package/docs/images/readme-how-light.png diff --git a/docs/images/readme-permissions-dark.png b/package/docs/images/readme-permissions-dark.png similarity index 100% rename from docs/images/readme-permissions-dark.png rename to package/docs/images/readme-permissions-dark.png diff --git a/docs/images/readme-permissions-light.png b/package/docs/images/readme-permissions-light.png similarity index 100% rename from docs/images/readme-permissions-light.png rename to package/docs/images/readme-permissions-light.png diff --git a/docs/images/readme-principles-dark.png b/package/docs/images/readme-principles-dark.png similarity index 100% rename from docs/images/readme-principles-dark.png rename to package/docs/images/readme-principles-dark.png diff --git a/docs/images/readme-principles-light.png b/package/docs/images/readme-principles-light.png similarity index 100% rename from docs/images/readme-principles-light.png rename to package/docs/images/readme-principles-light.png diff --git a/package/docs/images/report-warning.png b/package/docs/images/report-warning.png new file mode 100644 index 0000000000000000000000000000000000000000..47b124e20031fc5712a71fcb4d097fc14c335c57 GIT binary patch literal 226057 zcmeFYWmjC?)-8$$cbDMqmf-HL!QCxb2=4AuxCRRM!a|V3weaA<-3jh+ID7ABzxSTo z?msxK)rVDc$%i?I^wIkm(P}EPXvoCKP*6~4@^VrdP*Ct-C@6$}M40!L4u&*5C@4%Q zc`0!%uiTRtw2pjjZ+c{tg+^Es^`91hw5(A>EpUg*xn-Ob|DIC%;%6qG>e=)c{hZH9NW{r`HLPK-!<1J-gp?@wdwfZMGsY|17+fgdF^M* z|K}n>=KuNcpZj7?$Ho8i%s;Dg|9ACYyZ3+h;onyD|FaKO2fhlELJzB5uh;t@1Mk_< z{SO^fSxF5aCjfiph5sK51e)=|1{Ye+?T1ux~HeEzX{|o^r9-vQtLT20NH@2xBKPuw-5g> zga4N?3!q<9JHN=*1*}hY-Ct`SW*#oB2|P?tC;DH&zTHj{yfM9Tb0=p0AHMSbDnb%x z#Asb($C-)oOD+>p%V(fr7Iz*+L-%V@kT_(iJqa^^F5FY@y5G$(nQXwpnS++ zZW~@N)?r*v-mR7T2``J;E-;98QHBsw+1poxg}>b65AJ>#Yi9&{qDl5oJn{*%?)(N%LQ(_`h)#Qe&+C#?bTqBFZre!DT2 zs`QgI>d!g9c(-}4>%ZKQZ%;q%2;zMJrt{j2zqcs*Byy7|Ci@QY=*M*kCD63c24q zqYJ+*{sdp`4t-p|8(u$o>7AxlER?PTZxsc)jL-=n_}sRrfUkxv0$(Rz(^fz0tx-LE zI2XB_MOnWn3jFK#pTh^&m6MF15ROi5Foxt{xmf4?XyVItgZvoOH|xbB*2<|zUrAL5 zaQ`X)_Dds&W#$K3_R$V+pplMxx4roAE*dqz8JUn?u61D)Azg#nMWP0)^OQ>$D^^YJ zZL*~z5ROid0U7BEYOTCMi^1sQh6DdDUOG?TPm~Y3+Z5}bcNkaA!8wV>Ts%ERoa>O1 zXEpC*@0jr=b+f`K5(8Mf(bHbMgP(cA+;hIz#A{Uy1p=3=Wr;$sWE0LfG$PGzFHnH5SePw3mG^Wxn%KYW63QtRA7$Fy7DNV-`C@s=BbbUWZ(k4F~E00v;^hv=4_`Z=_5ne`p{R zx&sPM{JR8UkmN;qR_I@2dNBK}Nm0m(1OlZU*x~>ck57p359tI387c~0815p&vXp;i_0*oi)mI9^27=o~`cVU(Jl9Lx9W#pt5Bl(fyF z_+geV<`15Cjvo?2wmmUWz6lWgt;4M?d&-034*!`v>(K@mw?Zq=;arNl7LOcW%QL9+ zW#Rn!H!S(f4tJp7#HJS{p(^koZed#Mn#Cz^(cR1@@PPL1KJeu&|1tqjaHr+p$uc`a ziLnlDaBU2gGArtOHeChtgECgRbBx-LS0r;Ty;+>0!*sTxRy9lBz}o1TltZH^Zjxqk z&8pxn6kbrvj&#n}Ry_xAfzPFWx)2`o-#8}yiqqZ-`Z_HGhVP|DNvbj?!p(E|F?5Z} zQ0aOGgGyp0R{VGbwekSEJ3%%b5H`wyZiHM{0L*c-#VT9z%y-Jr1g}xnvitzSbpYy; z4?dZTonpe5y^@xgI=hiFt&11x^#HfScGbHE{FSs2_&s|dIG^Tzwi2MKf0IIxY|);M z(~q+}!(r#{L8`aJlIG>V;h?M?IK-I|PKw-QE)F~}!5y6M5ti@oD_Q*vbg9N5g`Yh+ z{%i7fn(;bE{(KW^;&oBA;MnR;qAbl#-nz#mFmZkT^Yymt`KXKkVKyW0;v(>&PgG?0 zqw2pwhE`cx3^AE>L<-5 zg*?%;KU%jvnA<5)q;-gRYBR{0?qH)jn|O10dXDKIj&FN^NC)6b`Zuy~#@DdMN9cxJ zHcxjiHe@X>M6lsTvJwa9XkAX6w+<0+-+1Y)Gl+2&RCRAf> zc6{+54x)4dkJnq%HVI+#X+E#mfs%eEvxnZ9S;DU0wkj7zrX`o(W?97@$g7hZ=lOOS zIGV_z;)J7TUriMm5|>N#`n3$M%*S>e(;4hV2GY=|OI`vTu3;eeI_C^Y<{IgTk+D-V zSpZd^r6tje)$q{3tH4vy&B%S@%SWA=ou-%sQUCpoZOGbX`l-%j=N`|0VqpTt0Pi1= znP3yQDeq2XFKR4L1Q)iaXd=}|j6*Yhs7xM|GmV%zRJc+WR867;k7a^=S+&XGuwygq z-dS#MG7s%yuazi{PLjsHR>tjnO4Fg}Flu}fOwgy6W}|vIGi0U*z-}X+m$z77-qZY!nf{EMqJ2T=(W(XQ4CZr1%ksyeoAg^ z$f7QjKa9&Fn7DhT4n>?Q3~#o6OD4>(s!8rqh(E!ZT1Z_ldDQ4XV~aWFT6a0g%?0NM z@mjZ_aHF$wO$lh)u9iC_%e#2ud_ba3$HVl6oykNpLiRJ!mBy9ukYb33u_UldARh`# z%k9nk#*` zIJ&nGLGy-}sc9m|J4uWuaP$tgws7MdMzW791xq+^ogpd9H9DWXK3BctwM{Yq;TE9E z;ul+5wEfyUp>BcBM!GZkHn;xvtMNauUjSVzhRPa9T2ceOXYZJ0wUXik9_!^9I7W@A zlpn4(s3ex<5y$2--!rVT8@;}dV#fZ+7!X5_6t$RYZumVW?V$EcPBH}2BR`xf=j&!L zx-HdvBoO`~gKGbF(%7&t#>#Du%NKMZQ@SI`qmBj`px5KY2r!NgyVZ@rwo_a$ka*h7 zSbmh223*5R>_d}0)hbQEl+6X~g-a>0Hg=I@4li8axT$I!eNb4=2#|#}X&U+b725gL6Rfwq;$Y>(56MYfa$*W(?2et#dp2oZQ@55o)1^4My0(w}K<%ax^ zciL6S10LHW-_Ejm|C0dy*HfY&sFBdE+TPG}S8(5P8|dG6ujk?8Kg(xIaJL=det-~A$1B%m(nZfzGg zH&TyIMfdkH&n{=yQVEO!ER%g;_bsV%y^$?4o>ymm2FE3A4f7(#zC)Gy=!1S~WCg2* z+`Un-vcTS{#L*Im8-~ayMHfc`f*4xK%&!ne3!U_ffUcZ+`a)xqD%1~~zhc)PbAYnx zOfOK%)Tghfy*PpQwA}Q$auQEG{R^eby-9>6XxonR%V3YJWkWP?QiztH(*Xk%#_TKa zY33hD4gpdbNk20uve@>{h`FYmZ+BcsMaRSa&$k;AAa9k)5ym=^%Fs)AUf(3C_r>~y z;6I4rL$<(BScK{j1TetiLD8HNbA^fRarkq-&(!%!xvk5OxlL49bo-kPP(N=s^0J>J zD;kF+_s1e*YL&Qo2vUsG%zYUg$>&2(Mg*0PutCwKKh>B_&-HmLg5R-!Em!DI8FkYb zRF!%n6cFNBpEw%3N*FV|et@0%gxh>x_RW}~8m_q1rxqqu*HxuENnk70_MnKGs~)o(l-LaDMvjWsq481DXy%;|{^D3o7@L$2b<|1! zwl*LkqNP1L)h^yqz82JIp*fRKX8nf?;8;vqq1jSUO}XRsIKu3S68p6lgAGXq%g_)a zzgod7`ai4jHg>;$`*vvCtCETr>{m(--@O21yvEHjb3TRJ>s3}viN+q)jQt`?2UDYqWGxSnhR3;jK?@de|9(%-fZeer}1fV(4s_sK4K6RtD z4_Ev1tEX0X$tn^cg6AKK1EwO^~^pVja8{!kW7rZ;U;@(k` zvCmk@So9wb;gC>Bb^ivGsfvPzJ}%-AEf!2bEfZuGg@1b_K0M~R@TMjG%9Q7C;qZB4 z5XS`PWpS9*1!BXr$tZ^mnDQtsfP}4Z+N?UmF71AK0^@W=(&m)<=zzhl%L3G zbvgT&I#PhLeX47BJzY(80~2wQUl)?pDaz`w>WXxUs<+cR_!CE*6#4C>p0M^!`nM|T zu&$YGvq=rgTzjKMUf}%3bOqefomJ9hIHB z*ca(*3KpkXs$~C=q|qx`jJYF!meLRh$tKeuD8V$ZjQ)VO^cJ>=OvG(KxGwFXn$@S3 zO11>c<1o00f%bQBHq6xEBWGc#S6w`=vAlc#hrzx;x&uXMNiYJQOBEB zJieSBk{ULsH$Y$V7-`!zBS8JkT!%o*dFaWxqPMBcO~m`P>9(TOpSpVDwd|D%dCOL; zlb?>1<+ofwoC!cu$#yw^OF;L|BlNzfDPAx+ z$-{Xjsa@9(V-r}1olRiSh^fL;utGxg=TCN`h970Qa&>cwnmdCC4JEE=T#OV?76%P0 zt;eJCle%H;!T5PjKde*)kl_+JM79xcSFsI>s#!gF5ijDZ40ySVMh;t@^EjGo0RQrz zZyiyJoH5Xu*kdq54_G-~kI{oPKvGg5shuN#+#grhVOPC;i+I{SrH(3;A7PbP^f&#- zW?TxL0G*iMtvnKVbfTM_UuPsappRa|t;+fc3;MGe<6V1}6=nWzdEAsFs+2?TU*e`< zYO|$aC||>K4wh^i?Rs&A-{ABEkm`SqF}PzX(rC0{woz;7a-8mFnt$XlLu<2^_C*Hs9bk*&^c0)JnZt$aARQ0p$`H2vefEl@F zGr0zJFPr1eif)(m5)2pkP6CU;EO?hG)9XB&Zt0^_sLe@w)HKxuF^fWDIe))q=u2Q} zQbdU0z~i!hUW_ptwH&{;B1oAhb2O78T?`J~S%l-25<(7;ouVmPu}#tGIuEThP)T#- zO%cwy0FSLTbW@i9)g}`eG#rScCxsVEc-*2<@41_tx?Q{SlD}!&QYS6D%dW8%Ljl!!|TIcJSnW4A)-# zpBNWz>m`N7sqR{s$wItqNnjC#EBVn?-;_ec?neZNO%Ndg5x08SsJj`=cUQeTQtC_G zA0_4 zXb+oa)pCqYPYG3?v2z)`by52mBXPZD*SO!y8R>R$y>ySWah;g>AP%aqLg4S@ex`SM&wzUO&D`&J7!C6u{;VU{JHYB&J2!zd1N#4lsg>*k+%i|n+|2LZv}bop3DLtW z^;T`jmbTH9W5JodqJ-NDe~WGKG0km_IaS4#xTvcF6eCaM9FX6QlqS-JmKGzPl znaRg#Iyt{aXbBNr3DQL|_}D37sVm{fr2SS!3>yvi15m&sbjdZVZkV)qmlFg7e0==l z&B#a}K&`oDm>x8)rddLDL02~Ii}*x8A0Ryoir%!P*^_B|nO;MuCm-D9!_Ey*F1&P& zk?ae0qw!dp5@oVSm@5(yN00vE7I!BNg{syle6rP0FxVf$wdt3lGEg>y*`_^rsFWss z=M}qJC=?iP{QGB8?SVngy7Y_={M_3u!?-20*f1Z>M0Ae2#0gF;*EXlF6ytW&z~x7b zzXHT~6Y8mZj8}C(^DJYVt6*lxo*Ej?npYGSr*Fc1xB)QI=Fn za@Fr1=n1Z79v7TizKQy0yK0PU12}tWe2!e8T`p0z{x`D?3Eom%(1`Ff7p{I;vDPY` zn37f$Lz{23&n4~(%WO>KH?4`EfMVLPTO1U1M2A!lials=+ALA#bUXH8RN|CRQkd%3 zgqB;)tXIvTi`iy8^&3Ilh}Q~j9%8K_Xv86DN=^1D5flqQLTeKb}=|g+BuS=C~)BW3E1hgHRvT4K3o-qg+zJuzM6_=v_qQ-^K=7IV{2> zcjypHe~q>0W^pKC4)}bU&+3q^QF$6_{X#oPYXK4FWQ%O~!m-Cf5>f7#1EaeprpAA}hRO`kFa2!0exZm)a&-(kLy)ukfFHvX zGVI-n!#K<9Ta(_f`q~%zOSkczU~S4 z;!@2o>4l}*-!T5A-djQSy}33lE;o|vm*GH19W5}Z$=;M<0YmpY90C$BO&`g?d7Q*k z*k*K?OADfL*!F4t$Vxi3VU9~!J_In98drxlFQS@VHT=MdE)&+8i0%4a`SnedAQ zaT6Sk{~ioc?{H?6^u39!+pZLUH_>U z7#vo`hL>RBBYVSI!c%7i^iY`VxFV(`k8vV-GAiMsG;a04FHyY<9~Q&3W_dbPrJWV#MFL_?4vWr5!0!3O0wl)_?L6wj+Wh=FCAD3ZP1W zG->{I5hzK=y!5hpN@%c@3FQL>_e-`G!3!Hd{V+4BIiwyACLZ8vfu3$B=Mw%(%Msnp z&&NqyR7BZ1YHD)jSLyE3+s133t8ucNzVJFlilb&UzR=s((WH!EbMLx9$o1vKx#$zq zL*BWW=@X+!DuX`*o)0$cc6RW*m0!)DE3UIsO&tBm=j&_OFFPE_mhMVw+tIh`G&`%S z^>SO$R;hs{;K6Aw`CC})E%hK^V1;*B5`E*D_On>oE&X^CxRhq&p7EMS*EqhBhFF#( zR?a6ye3<~eH)oYvXO?Gj0R1Dq|`*e#|E zV=;?P9iNO78|iN$ZMp>YG~E0ycOAkph04oVh(<#6D;ol2n4>y(Sow2% zd8)++pmr@3H9DtQuT|*0qH$kk+!(VsDc`8f`Rdp@6C;6ovAq;1GX&O~mW+;(2|^m_ ztJj~tY91fyMDS&TnG$P#e%h2SOUJxqn`(}jzAYAKrgbc*I^u_a=;GViIdj)t!cDwe zdX_?S*se7uF4XswYO0SZI_3%{i}G84Lc3zII0piLG`hJ4i1*`S{C0s+P!a@a&jQ=O zVp)buSJbD1`RcHEjT1w z57&M~+9mWiF=vr%J~u;}A>pB$|17Seb|&DmvomIo`*+4-G(S*0O8d%RgnThtNQS>5vm9G}ti#T6$f~s7 z@G#mldE^7bDov=oRLOIus#|^dK(0hKc^x4i{)ZZpW8P+;SQxCUBgX zxiWn#V0phfyf{#XWndh0-J0n56Ffu;xG=*eMX;*H-=H}yVr%F?t|#^YCm0oETa-@| z*vaIyODgGTS6)ZU{HU-a6e_Qfc4RV_HFeiXT;C8E7`B7+{U0s>-jP|n)6}=P9D7x| zi+a*Xh;cRDcn#(xI0k1b%brS_CrIEby3*oF*UPGS7@N-O&*jLRT%^HbD>}Iv%7k7M7>#`M5!)DHwt0xA7!!y}f5WQpC z&+cfpm?dNAC1rMhsQ93W5BAsr{{F5{&T(f`y0bMxB~%JhW*u4+AR*nh|evXA05%96cY-l)@meiyw2_Mw#*lZsd@@WIn67gpl>8 z*NihWrWElA5+9p)=}RR#qWm@X0}CD*zfDTAJMBrw8R0y5`fj^X2;bx}suO29#=tR2 zoo{~Uyt~nhN($t(7R{ULfzRe~tDX76QnMEBEYi}+GvukyP#+{ot40$tG9G6SZMFLq|Rj>(#J z5o-^F7>91~^321Z{{d(2K?>fqGS;csRzT9##QL}q>EI}eu^y?%)2#&EK^J6BHrUK> zD=cgns4RFZe3L~UbOSLT1~9U;tWz{`EUfa$OeEc?LK8fR0Okx9N9XFE+~PQuD9*$g z_v*UMF_igZc8x3g`0#v%z{+Uq3%LL&G_M|rh94N@;RK9dWt*i1(Fh!zR?plpEc>G#y=%z~t zwKEJZ;FqkfuX7ixPz;XEbGTp(v})AyFZ+t4?k1_Te?l< zC7ybV%vDn?BSv2)3jd3u-Gf>&rKOa@?+u89L0Rx;vN*C+N`^4?$!Xy_9*79{YB*RW z7xK^Mu@}==ZjFLiQ^~5K0(#p#^G=S2vMl>lZ(AKmQH&*6(xSnN77)_ENu)R$y1SX( zNGv1mzmW|NF}dkby$_?HG*gulZvl%9j0XwDXPH;;%vN*SeldGpSgTMWL|3GVjRlce zF?{AHM`q-Hnp!tk5u#O$H!Y0ADlw7jpvi*hfYvZ7B8prsA@T!7k~|VyAHeU;TfW-c4yt|IOqOC!4yi$)-NGO zvo#XhRWAt*m^E5fMfT^9A)HGm5|4tf3%cP_tvRXSDdpJ7eE(re$H^3sEp+t3CJ4)K z^742(fXFEh#!N|QowI%^NdhOjV|++Q>KxR?Wnok^b+$MZa)^eSE#pvXzAV{$*LF}e z2Uc{XEVlJ`>F%bfiPZIr7W3^@J~!wFe#K3Cj_qJw{~b}rF(DZ@Vj2VYju^Sys1-P8 zD{8a~D*BUjU>@i~NKyv1$Fdq;JyPk)T0Ca{)i#xHVL6J^e`2YwL<;Z@0|6Z=*J!Ce z7P3(xeu-YM+0D_YTQn0gxRM~W`j6o%v{Z#LD!nGCbrKnTM7X8-HU<>aUC>MsWb_6|P*OJ+ z^rYVFuM)G)1EC&?Y3P5{&ArqPlN5s0*d&|kR)MosmOd#(b<)+3&^)E2qI79A(WuRi z)(pVFX*e5GWg+AwmPtv!K-(@>GEWKn|BwI&{4#_YnYfxE{wl%m`McW#kRQ;Cm9ag- zwT5S52;(r%7rP0XB{+}C95^0mk@=ieu7bH8MlD=Go`Xxr?|R7u3S{xV;Mhp^D?&sP z?@(0wqRvI77_ODBFs8g=m@h$RuQRF{q?Dz!lM8~O>l)E`Y(U`mAR5)LC_M3qtA()O zVM*&;raMP-%NxNNW_6^4qk&P#!SORoTwfsi_QNeb= z+_MTZD(%=GlRbe72^u5VO^olDIa{$7 zV(TeOnc$vBWU>-9LF_U-Y0)FW7n*Sm`K~#5J??}d!w6#aiM!*hO1dqqv)w-p?}b;? zuY3Oz9>io(Ky0VB?{^N#cvnE=Iz2or614m&7oWH31=Q9`l;KF%D-zrtOfK%}pRwqs28EF(x?G-#)M3%0So?g> z3q48}8{)W+=d);|!J zDLRX+(cbAUOj!lLcs+*6m&njCaZk(QCgqrLnJ6aV=o8v7lE`cg6O`8yznWPAp*-;$ znyA8%l=DBfLCW*43e+%%A_VX_{t-v}Y4=<$-~alXB^bl3>K9mz zS0ao)=0)u&nn3QuOMugJVPbAzXEd~LHmJ;1jiUV2r3w+#)4+M26m_wCGLq0c;%iQi-m6VpAiVSOltAOS>=jK)hmTrU~BUwKGBwl@AZilR}5LG|5pdAur zhd5TH0?*=vb$by?^_ik0c?N(q?$R8Nfvj;aZ7 z4rY(gmw-=$xa2xQ(oDm4Ky8&x3D`4T*%>s&b&-mng_m-GUSHJO1SE{cGv?El;=JL# zNF$G9`;J?THUB4@5B;yMfbOe>LV*^=%8gyEZ{u{Oeqd)Lak?HYVE0b z6LoV=_YhV5^gxICF*3XuARn_FISu{HKn9O^ zsXVhL@<4}P1`Hy`!j)7S#$!Y_j{>uE_i--#?i^0xlaXap%MTj!I(qwT{!~`V;NuSN%NYP$M6j_Z6*%T~Kxb3%n36!*C z4Q<>u!1zZYQ31Us}!qu5(xsZDtpzXM89U+s2OWnyw5>2}3+S)};8 z;>(QA{>z@35RjG5pyDVzt`UrGsYl<>0vh}qnwFi1gYVL|<+qXd*?$GG|6Lp5*a0s6 zW7=)Cwqym^ZegWQHCN`Nn~C_owEWbWe)&GV5GAF8iRUD5arXOFtqT||ENU01$|>jT z6JSXs5pzjdz&HJ%(!o5EH3JM{v=Q*CmFVxi`BUVvy0uc8r?d!wLjOZq-BjnsR$l(% zXd~0-H*Rp*1PuD?Kl+sI%C}7>-hz)x3?Ek){LN`lbm(VoN=-U>kFWoD7?;E{>R0aM zTO9PJ^??Xc|KqQnO!OrG{=tSJ^Q&z|F@t0lK z6vnL)`E&(gx3Aso&pAg3E*-U*q2W}FSX$J%xLqhXS1FeuD}y|tKUV$IvV`Da%o=sG zRvlt|6tt8Hjc7jm(Jdsm)VTg?jr?5cp)VNEz35mh!G7huk0N*~7D$kfyH9Gt*X-uF zL3cR$e2TO^BkywSWA+g}9^Ev(g(yXRd6i*VvJ63SP0>MK5Q24u+L6O9r;4eHUq`)K zoVI=)0hrERfJr!TZ-;nh(TY?|^zhSk0(KSqi5!39c_cTH>R5CbJRNoxV+kp3x}IHB zNxl3dv268VD~G)zX?CXI1H;y)$sB*FI>olbgNP;~%5#EgM-H2$@-1w(!csyA3A3k+ ziTmP<64B`uLqSRJ#6td^$>IZG9sHCcyjhpA<};}Zwm|*(>vE;*-m=y2C|kJesZ^&w z2mAmsd7b<$B-3<39&qYkhEe|g_Gn%BDMN(}ShwoBKKKWJZo7BD)5v`--sXFk(Cx3r zK<`b6msQrs=SCgFx7NPRX)ml_H@v#oH%VS_O;qb_3;2v-XGH`$I(SCUICnzr%!@{eT6t=~Qj_y?ZtEUMzeujk-m_sk~^Z#%G+YXkJ*VIgD@8rk9Q})pV zUBpbQ)SU&FG=og=NfN4S4zxNt>?Tf3Zn8m!6zNYS$E0z%iPZv-G#vpei%js!QH<+OC7q!Se>{sSikD^96vVH~IHjYWx*6p5OrWoaC%&9+hA3XWsA zc`m}{s$FJ!@JlAHO);y>Y<$5Qydp)2^hPmgcZM~q1G~&MSbjMkPaD0Gh-XJl;gnUcKcLkG6xoMZD8;J{e=F)uoR;0f+%M)3r`BOH+I=tqGCUxQGBt{Qr@a^nmkaPKcQRm9rF_8gO>0G> z0x_M)Y#%(;mdK84bklv_%Z>v^1&G;+;-Xn7#4uj)0xo!q#xis6nvrCJ%|*qGkC)F~ zbSv!xgTVG+89k&$*>~Mc>eMjBu6~?-BqRHi-#C{0m`0wsLH=v=2aEtc?fIJ1jL#ILioUN~cQ*mw3P_z>QP&FjZg$TF@Rlz(K4&-wjt^#ZnLiKxwA)toVwA`8eO$I+ z@0h!gGy$JpkwZo{720_L%m17G$tT${he7&YNJStbd4m7d5vapB$Q58d4n{`Sz8`88 z%%rC4$E`ekC9(oliOkMPKf+8jGpuaF(5TTwQH6RuV9{_weF-sr;wMa8vhbzcNUovk zSyiUSoMWIqI4d~YeMGfp98sTY#js?of%8S|O8vI)05L5QynIwR-UQF{d+;aQR`&cUlG3Hnr_*;_`0;~Hg7m@j5e8sU0$S|HdXC_m z4v;YcU#j=>6!o`C0-m)$LhpGwU;DcV8qt-DYKf+FBJ+iH+fvfJ#OBp=lK~uzLOPoP zI`0j8AXJ9+hCz6BI|r$ix|gZnAqVozqQG{nZ%PV#z?d`Lr#uJV4bCd#UKWrW{E6Lf z;{}o*UEDozpW$5HLw@Irn(jIrwtl&N>17b}HlZ%WE&QS7sn-TM#OYh zN8YnmIw*~euZ+D=kP(D+?O2)NjxpMT*dN__j3}h}5PRJmf@m6dY}$W_$crU>*P_DG zxx))_IEPjBQ#KO0k*=eDytG(HCusAJU#emcV4U6#d^UA%W;ba6?!CS_Qg@A;^|6!8R4NA6D0hIguv-dM#**nX`T>MWEBn4J7Cipj2Uw2 zH(myNWBLA`UzCN3v@K{@41ycp*DEH3cp-flTjHv)E47CWU})B`DBq1#CQv*$RvTgLF zGghaLiFGL&MRlYwL^iVq8_4D7Hya`8C_1E!;MYj)R!plju)$K~#y*Q3tTNCk$VRZ6Ug{Wic>pfZZ{L=ES(4jwvJ~=L1lGRLS`E{HxyE zL4?~=BYGS7;)k)qBu>bSf!;28=Ckq^DeCBF@$b4q)BUl)a(`t^rrdq|`%*dse-G~r+`i13!eIWF+aJH#xx`Jf_N-3+)a-|u*1q2l#0ti(yPk1d|U92;06k%7v zUL%+kaei-6hh0;aU4pG2%o@|Fz=Dku_0{HAuOXbVb(JgFm1VHiwnSxn7U(Z9TI7jG z9m2wdy+#MoNVf7*l+|;TCgs=zGeV1nGF+E3>Y&14^OJ2Jg5Bf5nj;!nLI%pbdHnZ$ z;$5-IO!V8=hN1K*6XOS zWuT~yr095MSEd5WF@yd zxmb&0%((M6*SP`Mw2p3kb}Ob3)MvO=ZzS2%_R`|ZiU6#U7+%vl_V2gZ(_|TwET)u9 z&SKSC8H?EVqJbia>JNTN>JL%~7jk}XH?xHr$3IM)$)jG=MBy3b{?LF2`ArT3WyIKW$CfE9}L; zN2i-=99M08pxT*tnU{CQN|;f4!Q>@f z4s>l$b*%Hvvw03k3XHYk^Ef{d`u?}iGj6^7()l=UX@<#tG=#4PM8TnA2Ecj zmSLZ&`$*X$q|)Dlm(HscM;cx8^!-bUGWRhUiIE+$A&5wEwG7$`2yY04&)l%BfeiME08?`Vc3hYQW5j0s#0*mJmR;^vm}`YHX-Nx zYyeTZbEU;M&e=m#%6;hvK1-Y^KS1>@=&>3e0rHLOgV6O@$c({@#+qHVU=?ulF@{#+ zi7$$IVA({W3_bZ9EL(wIP^Og%k$EbIse167lx=LclE#ysA|^ies}zeBkuv4Ls|F)| z6sR`lEJ+Lu1K6onBY~7H4Do)+bPvG2QV`&DE2xXkXPu__Hbw?Ly|u40Yr!0O=(A70N4O-EoLvSzNIhOKSB}I6L=YP7!*W#)m3|Pq}DNB zCp&bT&IxeZ_JYv;+`Vovd0e#wKs4_rCbsD3{s<)cpZ#=upo2Uy*8R;f4|J1dTetKU z-Cb#)Y@vrMc;I@o)_g?x@{Z)e&hl^=l(TzOy_5=}x-uB`2(hOJ2d>piN&UHj^ns)j zoVc9t9*em4;nQo;#U$?(#bm-DxV4XE&7jng=+XoT@<_B%y+AXQ7}Lzt31P><>41!1 z{6%&w$_R6Avy>Ie>!`;?m-crW@Z1<#FRf3}kY5f?gMOCcG=*N zOkhvCDlIzhf=HxKSZRST{n%W5D;wwJZXtvH;L@y57aVva7!BLa&JL1>H@vvP?v{zt zbzI!kG#rZyN<1k2X#qj?1j0Vw7)`e*IzO5mH_L>No0?Gjb?~+Kt96psx1snEpPx^Z zVLF)f5hH^9V|tdM%0x8&wof5b``}TZAk&D2s*s|9>FQ@q$GOtFP>JAA`a;hcAlC~` zhuP77ftBNc{ki$*KYA{Zd$xI{wS|AU0D7u?{vz;EO4-*1Nk70qfk(M^V+=pgGH~(m$?0G)?ZA){|T{lpX{Hf7$#>H*TwKzY^FTq-)YJi&25lt``9&2)D+` z4}24!F-R$%LbM-jGr!_EoxRI%(O6k2ddAYIajd8FU$d)hRPZMn7 zkXgRu)>)$tl??}E9S6DQf@z(RRza;eRj$G+Jn&2ryqr|!{)M9}&v%bow2fDmv<=VH zK06O7u9&m5FVXbwlr3Xze{kkA2S7^7p8D*lkLDHa`KZkdDURvL%$^#;B$koU~?F2VrCCO+`ZvVaHzobVE3LqHJ|cV26^)NktfJc_jY4!ZPrde#ES45dX0d<7LpqugbDhv^!p zcgHGAh)3}5MgSJP33J+#VjJcbwv|*xPf5kUnYs^H1FmSGVQtbIe{I?OSFQea|1DR6 z{Og~Q`2xG=ufqSC=c}~bF{q$b3JB31x>fBq68==*d-RMlYJtN^>paOcw)so=x%H1i z>x6nYWLGvEhex-dY{~?bTqXf$2v*ia9MZOLG+cTxM8|2V#WBLT?VT{K%=J#*FQcn8 zK8^gK=s?4y2a`6*OeA)Id3o$zgc~2W6aTh zblws5-u-$jm|ee5e&%51P>d`Z5pg)NCf2LnrcUA$mqyZDQAS_5b|ls-G_|nu9YNiB zQgoFesMG&{5%mrZk%fK#e{Qq6*>;<4+qK!XSzD8ByEbEMn{0ElHruwF@SXel{qE=a z3ufk=xz4#hZ@jKbl>+lKcvQ~3H?!xNakihA#8_+ppShcXtrLP7!y(DuUjUZs(?17o z6A8-(_Crk7CRK-bSp0SlDFfr;qC@ozbUVmCg$Ii=$CaN=qI=o&25;Bv(911ZrmX!G zM$T@3%=NN~rSe{z)B*B%hw{ApQ{x%uJ1`tXmn-b(g6Bu+7^0}_=A3mxhQ6)vZj*Tj zG2O2y4un%6!sEkbkzO)dX1R0#Q+7o7)Q2Aqn4niT-afR zszI2=tJ1xRkrUK4lC0SI>sA}ZZ0o)FVGt^1GymyhoG54(GFL?`rq;vgE3Yi2VgNNR zGJK7$Ct|wPpxW2K2-}{mCE0uNRStl*0DK$6RzfDep7JUk_HcoyE?qKa;L{>xJ2a$P zZ@qBNwmGK5zzBwnF;=FTlQd#g4b|gXJ#_q}N~22FcOLgjQ|HLFFkRc#yDBxZGy66* zh*L@FgGb|g0H*HW)sbg4FHPdTezP2FD+k*gX)s}+m->_9TC6T3z433{7Z=r2VKcxz zoy66SuTcc___6)(%I1lR#k*qGe}2rwuz!2z#F9K%#SsT&JM-7>F}iW_K5N7(gI2B0 zQNS7J>U_Gls&j@~t)u(DZTW*8RaGqQ_@foF^0voZ8D43kU8@UI4$h{t6U^_XmjL8EFTjK-ocT4d(vqQyt5Q}{>~ z&Nz5%D^le}tf0C`<$19I0#fX@&i?Z5O$jYlQt~DO%=4g>LPHyXDYwEK)^eg)6icY;uDoYM$R9hN69J+4+%xlC0Ebx_`xJZSXZWUXz)gD zAJl8&gbX8QuHfllD395T-W06Xiln{UjxbOEQ6Qp z&)j(*%@>$(FxwU0SQe7z@aSmu3kKzvH3{{Q5fHnFcO)8e7rMt(aw!y~_ReWybctR? z7*_0xvk1~gAoFr-6_Zy<35Z~O8LEM>hWM}($#q6rzkweP+;L5pl3vk!#8?vAgl6;( zVSQJ2dJGuw+Pp)Fb!Ko0ZOaWW{=IhT=qj9u|G?L$LGuk4?lpKZW6=oQlgm2VJ}+n0 zSnyUXB}O|$zrbAnEf^glm5!KI%*FS=)}v6d+?F;mc44sZ8`Xx&Zq#7trsTQZwFXx| zLNq(Vw|z>Z{i^F}E;hYT7vY*W#WK503Oa`>cagf z%uHVd)drRzZTDiYkd}D(#1kFDc)tqw_->WsdEsm>~fu%NXir#3p_~$1w4JP zy-np-n^2#y@mHV~za>XpxQM<@>kuqy<9RNeShyT6!t=6u_WB}chp^b5Fj7|^YHSI^CZbCI= zEaSl-Qc^0$!_3HIGxE9R8}zCHBCJJlOziO-GZ9%{SYFyeF4Q?Q8m@y>?NC`%QV870 zK~PNkd0*;rq#Gh}RjWwTj(?_uBt9jHmj}mQ6v-RcmPLe$GJcSj8Mwj{0fmY=)tP*l zEk8$?(sEoF*JR_IiqODiL%^zZL&YZ+bvan_%Pd9R0CPDFIslJXcu_dX!y)T;-Q_yH zEQWxo&U;P1d2kyQ0}#gL+H0yaQc~|?+%V842qD}uVKHyGZYw%$r!%>|`^z09vyQfz znlY8j96x{pdOy=dIK%i^3@zo3do&a;h~NzhDkPu~SgB^>a~B+}dq9U?lTr`!6detW zb&=gsM+Mhv_6Ae1z^xs*9^k<%-0-}L=68gHJNf?F)bXRa zVhDZ0co(?-Z>4;qFJG9Tw#r)3%J5-Ty(AIKYl3}P7>+DM`7GI0*t8+&y-HsU zXn-(v$8yerS<(Lu;l6g0aqifDdMJ7>hw;kcMws~%i%F)@MdYDW>he_a_(my41AHR% zM$&JR%!aXBYc-bC7m=kg7C6eV)u?Rp{SyfNne+T9Rxng_#+9KhbtT=3W7ASy*I?M$ zv@^cZzNunfjs4ZpgDO0AWoI!K)hAQyBgAlHZYHX0&*Qk^kw_!L;+f^1(N58}zXy@z zat_BH$8B3A0_l6kLDHW(9uw%sjJn0wN#=qLqCWDY9Gu-(ET_m#lB?m8RZ6-P;*Nn) z2UvGP2wHBz@_(S!lCV`KpBm=0M`FIn9WZeYX%fRKt}K;Z11R_q@ds&Yv~ir+7m0_` zziMzS-`W+lR|6{-lTPJo&s2krSOhpZ6l4_UrtYB^QHmew?GfHrMQ$g&uLggqiMvYb z_NkHmo1e}>YvuJX0@}`|Njv(A?Ud8?PkeEc)m!8T02YeZ#cNRct9HCu;kO`Pt7I{)z(?PT}4<~EV_yj2eM z1Q+G6dQ=v@;gq^5K~eIYn}Jd3Up`Ik2^~ZwGYtQma4sg^_%!ZTDX zZS9n$b=A+6)gqVFG7n1?pyHiy5}=U(?80^y?X=yPsHf9EQ4dn0`92 z46<+b;C^)GNS{d%lz_-C+1}4^eH&6+#-h|^W*uq13x$oeX(rh)DKXtbTJjk+r*Qpy z)S$WO1O8O1)IuLmJS54F; z(E}xhd8oSP^?yqOSCGW!-w`5g<%P$@IL5?6=kwI9AYHzdhxCh>3Of`aa_W6Y80&T6 z`IuD6Cu0uX4INdsgtE$t6_u|=gh7blS!lyQ!xiKBJ(y1aKW)H5e1qmc1L=13dPE)> zxdB0@RJi1&nybTm7DyGqdxYuRqdlYS|k_@sP>->M-^&Q%* z5D1SbqLUD)ODibX_{lGpRY``?q%OcY&hFWd)Fzk%dz(5}7jezMjO->m$DrS&Cgi_u zMAzrhG9%^OrMtSN2h7KXH4p9#82_sUIPxKO$)DQO^li5iY_e?)ipF4<6|l0J?)h>K z+R$MQrN@nK>n5~JoJWeLviyuV88_cvuPBs=qon$Yxl$!cP#4WCc`I?Y9@2QFF&JjR z(S5ZzmSoSD?M=duu{QF0P74ldX2?Lc(a)UtR~Lg{OMPmh4{wlOULLr)&!BC!z%DKP z=v5x&OH=H`s4_W6f^&VHV>#IeDzfT1PjEHCOS4&VG$$7%DuV6-vqv};E(#*3w!8jC5W+7=zWXo@1b;uwk|*_C68Z@>HmV5BcP ziaftvHj<7L`F@wPQ_R&I$uyQO01_?o@9v%p|KRf83+hle!y>Cp%DT|dg10!BrDU`_BCCvjPq5(}FSAr{Q>~dTQ^T&~ zqmOT4oyoJmwZebNy~j|&HS>d9rfJ5kalMH^kd6pewxiEH&8J(wx7zFvblYu#F1YL= zw==HlxwCmacc5#TH^0bi`0WN zCm7mrzf#jMjs@GB*%fAvmA@KbNGSWKvIA7=4LmX0pJ9~+E$-Y`vWEDB^hgi$MqE%WxWnUrW zP$8I~paW?nkB4+i!;RnHQxO=ro^4yl&mdI&o~p{TOv2^gPf>eL8kGbJ#Hc&%B@_4`KxYo<(ISM#gcb3?$QD0H!+e|8f$A zss>BRM1$Sx!Y)OmchM6#3vg`IgYw?x|+eHJv0@h^UW@xg7r|b@sc?^6j_s z;{c^+CG-aio9#u&FeFlw>N1rXR1Z?vGV7yVn-hgZ9Gf{5Kxuy~?tE-)1r?9uAA|xQjz%QoABj+XbIZWUNsSHw6V=?^98bH>QeWyEx+K{cb+i8c=8vG6ORky zi7_uTANfB?yqxe~x_>#~7hXzZxZNO0f&~Lb%MAqMGxcZWdk5)zhnK|#*VN!I;PH{n z>R4`!x1Q$R4DtUK1w|JVRqm6EurPi3zf6VXI0iPeGIeBlvjdnu2278a*2V$$e1|(F zK~$A!c4|&rMS5j@CYkW<(NGQQT=6!-`zYj}u!PV&6pj?pz1UMs5dO$RMz|V>BTabh za{r;)B&H?Z@I=ZdMXK&t%vz$uIH)^>?S8Vci8ZEd(*^bUP|L3-8SLi4BH+_b54EOxI4DuIPIKtoQg>j5(TGYAA#HsI$opu*S^g|x9&aUeM#VjvJh zR{fQ5c0UU?8u49pf8E=QdX5rGF3Xz9ZGqv8^_(**RuD}=XfTHVY6_cNX zkLa1+xyTsNt$F{Fg9AADZde09o?0C9__MsYKMQt(A2^T#|J#*@jybtQn~JXfQ^8&ak=ytURA1 zGc>1v{WJgRH|Z_?1-U%kJoqE+S>G>n8?n~x%e&Ewus)EtwCGw3+f0`(8u?4&oy{A- z>^q0I(Xm1v5BYtKWlmq}J=O4Q{7z}Hc)$2+weupE3_Cb;-}qPVp7@^InEP2D5W6=< zFU!@JslZg7H@-+WRQ!&_{z@4XK(9#U&U1sHE%%)k&&plhh|NyLc{kH0k#JAlaG$CV z3>Ez5NmKZL_lx5I!OXJ$?@AVHsTyj31+3MNWn1-3Ep_T0*+d=j087ehd?G!AXY)(wGq$Fb*Kw}-|go^CH+!{rnO~tsD z3YRpU{$yBk(v)XH+Qmq1`BW=>OXpRz){(EZrM+m9#tO}Yd*+FtCZM0Au1e9HP2v{2 zdpz_@kUP=XVOmLRhw<|U+y8KD=$;Bpf>KQ!`vX;(Ov_BWakHx8 zp*rW@1GP#B{^&O~y6fIzsgwTw*Z8Y1&o6h@nc|NL<+#bobrM!QN$J$@EJgxpsh+C+ z%)nauEZ)q248OY+FTf}z`aA@oJ%PW-lAc?!@{>SSUaZQpk7J{-P`4$On>t6RO*nqyi69aGX z2hU1b0sro>)omq?m2JL-?=ar5VC?K(ET! zpM1!5*Geq-u>|FH&mnVv=FAz*E`@4iE8_-vhE1i8>-KS!_$f8VlXHey{)bz`O@0vz zEG-)?u1&&nrE^VJ?WLnhG?3mrHl}2-su(>NFN?l3K^l01?nQm09HFTo5Ah(r#9QEx zKecwvNvJu@2O|`kSC=hRbekHzmlvY+7^rT`!~f&o=y+h`4-`)`#VHGl0i=Fh)Aa^E z@QD@vLL%9b*-GxtM11YP-M%sjom&?_Tep&@RtST)taQHB$`cPKJn-vDk)_dCxSI&& z%&nbfBKRh%C{l9b4p7OvRL}XMn(vZb0 z9Ul3Rcfn_MAUUrJq}>-cI2?m;OLb~-oUu?(1D1A>#F^rDP%E}kD!G~sjG9BsuATdY z4|Sd3V5@^Woe9&tma1O@|LI?90ikNt|!7;WngU)LQVC+g!NvTg7nU=;Q5S z@%Q5Fzf0*Za+xief+FFD(+8*)di&C`zlB61Vn}6-?vy}de&fsKnv%=p7AcCeK^Wvu zptSpCqxwB+lLcnIiO!)lGq{yuj^-s;x006JQX!sv3praHMBq>rak@P!RE}!PG{Jdo zt{9C%kSz4)pYW^EEa8pWzl^93y_2{{F?wweD``mSzP)x8I;JCg{$vrg>NPXmwJ>oN z&AX1js*_LDh|%c!OLHW!7YU7zQg;)-)xLv5yI2UW1t{NG^3{TAm%bpe#;(eskse~{ z(A(yizBfB{^+weqFhly{EJG?tUx=gXFiZULo0~y5F77LaKzZag=U5iPhXGd~YLj15 zi$&2BYAwJ%mvEHKwd;vL|57QuweV9#Sw{44smi*Ljw$pEA(eh<7!5d(+1!v>(cENL_v z3s{|gGmM0$`nws&nQpXN>_BQb5*Yofvvdd>HAUPniX4_RH<7Hn=7!-(nzX=urXbS{ z@5G$oLEsSWp|cV3JK=xTS5cmUFs7XIp^hhw880W3A};KvGc|tlsPG9_UrtHfqA@}D zJhjI#rxM9A@7Ij=@C|6O{JR6*(dfm-rL0;Hs&f$J)+D$6qzE~ya(ks{8IXQ%!hq@t ziGZ8hsPRSTv8X~3LNA?r{_wYRL~0eI_;8V-T^*P$RYw$)qodsI>YV(zUudQM|3RxUfHz)NiC zW9h+YsjW7OynH1v>tA*f`+~ENi>Qcb>K*qCI1U;SRdKJCw^L4Lng#Y}9|2fG6eh=7 zezs2*J>skj(v<=9#z@(0VXXFpn;{%}oP5S-N#A@CLW~suyd!_J6edw2`9h1$CM zM^TG_)W$}Ezx^kdd(TP99Uf^Q8QAvA-SL%PuaAL^-xNo_m6JH_58U+RJ#_j~Upj;y z16Uiv<Dx~~4Dxdb?3G%>J9&Q`esPDg< z#xJ>>FMe3^RvNoPc9HweGl(x0H3+wh7J9hm%?uC&UoshH*spcEn>d1bGh;!-qcCz;i#U0zm97BY0qj~w}b#MOY zM{ZbO*hh!AVgG&UQx}t-Dhw`q>>@pwVp63ol#HS#uwyV#dhH$|bJRooK8?<#4T~y% zxD0w%5q0111t5v_C`$z?#Eu`v}K0M}} zX1dx?EdpRujSw-;-nsGV)bS&#@+1DmfP4ilz@93~09E=!V)m|7u}> z6J=xS`xew|@t)^a{J718vn8Obr}7)H*D*aox6Le;;I(I^l2b_YO}lsH82^9XQH@aU z&QBg0h5*oq1lLpeAJUhQs&5l3`bACgmL@CZ0{gU;FOS*9(7Qvx$6$EWK^J06H(av7N?KXnnRN=(sp^i!% z|02=t(%FkV{KJsKZb)WJnK*Gai<|H%>oR>B?oj_N6LLYiN+?8AiMQokTUvwDuV^6& zZU(9?rVqgBm#|?FvKG2I7kWtNvtr?{RqCFHs8^p_V2oZd$=is8z`thOk-YjFiB~+qVBq-ZNDRAd+rWOE)b=t11Z4!rscrKxU^a)g~JX8CUD)l z#*xoB1)Ry=&j>mN(+EipsU0|Y58&<7xg%HUuI!)hTf;C&u%F_cZ(Fm! zvnV5exnR-|!J4r~yy3H&rd+@~h|%t3ng>&g&pgkTquu@1ih7*Q9SsC#ncs0ct;UlQ z(Nr#?4K~N9iRz}Lwlzu@^UL&F=^HBmI=PBvUmwwa15-goIl;lA1-c87aJ ztC5{s5@1O!@F3D{>1<-OxTK(9Yq?VV&s0s!2{2%}t5?ig&A2C26-hoiZ1bYmRm$Utb& z7e$&#^OX}8x@BqVw1VayYpuo9N8?42>gP<-_4!jQh%si6{%36KbhiA9U)(zR*aom$E_KQOvxRMr z3#Z0P@L@j_|D1<^BkIcRi`tNmM~P+fed*j&8b|(D80@f0kBC=SKBPk0!hDTH*DW^j zGV^Jg281sz1?r^zZOa_+14+QrzZ^|!WUm>6RDj7R*&F_&{r?bp7|xVq3zL(j%-30n z^06A-cNu=l8&2PkicK*|!(F93VD#z&yklk(jmq(;Cq9L178?Tkv^8y(PHjnJBmny z<@odz(3hT@P@3<3YGUiHE$2vuW&P$~&G_d{TF1kJQp?*x+*e!ISEmH#?O$jYpNQaR z|LD91{NvlsRNm7@%T*N;Jladlc)ssg)#7K$OH9Cz@mGYd%GoDQFkEODa$1=wQZtru z2%DxASA)4(5hFql?jKxC7w;loFpW#Hm=MO0gMu1VNqJ9bP$E@XNnO;W>nGb_tL|`z zJb3(PuZg5j(NW)#xp7$6M=tq8#UzDu7+UWV!USnK_6%=IP$`g%a4~!qX`6k=T7hpg z@#my|^~evI^92hWv{&DCtzMILv5pgFblj`M0Biq^XoO3vGPuFpVbqb;1caL@`#^(c z`MH{Xn#9PA+mh~dn=Lwey=vbyLjt3w)HkYb6%7y}TC-v&zHb^=^8~xo_&38R*(he0 zp>);NWXkB|SZ3EJi$8qD@5#VfHsi0nh}a;=+3?yBI9xNmYF#MmEL6@aW!~hmTzUZt zU3+JIPkK!S_|>_&9qWlC>U@Hrc0Sv|h!y1VdOcxv?U{oVqBM>lYBDLM1kQe!C+TQ%Bx)z(qA?5BdmTlv zhnJV-mOgZx!(Z)SqJ0$MLNtb2S%itjtg zS!Ce)e<5l-a}ISU4qXPIHlUPqv^nec?&0G>qXi-9rOM=*S>drFw8nJHpC2Aid^88% zutPRf&2qDvXsv$W*6mS!={0xQpmWR{c!YITzUGa#aZ;$=V~DoErWy`ROHD662yD8C zA_)qWA@dpPS?V4xX*_?xz(@WmMobToB45RY#jl+~f<~g=s8bO$8?5(Or3`$k(EG>h z8;$%^@RouGohOL{!xMptM25a_usvh6K{t(bXjrP}?hR%UMtf0!&}DFYG3rrf2h)t} zhjkW)y^*T2vAma>Okm&4j6WSA%dMEy^ki!PBBa&SGm>s_3hvVj@oO0lqFJjPZYbhd z8bTc71?6zJ4NO@9lg~c0hDjwQ>+Cbczws~k+^4g|#h3NDI{Mb{FBo}TbWT_y72{<+{??;aHx|Rr&zdJi*U-T} zp*8KB+r1;pdqiRX)Axe)}#Ec#$flc^c*K)^lAQ=$#aQ-f|HpeaPWEj5dhu78PI#Y z4ZURaVK49`^rN)llIf?gDm`l8PNAJv$x`q{CaDm&3-3?0RyO9Q@4 zv{RIMYp&T@tekT?DY^y&r+V&hUYs+YI;qfz0-xKigQ%_IOYsFbD(llXh^fIz{3&`- zB1E-WOfm-8cFr&po@OY!UVNQe>J&3(YK$H&OgLW}$D@?tbcM3S7&^kRrXkNJFO)g3 zI-CM&D^uM{&t)A*9q6qX3-?tc7A{7&G=WnC+jDqHu@5&>;mEkc#+to(qUpHno_kEv zcz&_avIyvN*#yKm)|PY7yo9HD0+izn$!Quz?iW9%tk&a?KNA);3QRuunTM5Bu|ta( zp$q;GYUvhh8(JFjp8LSdf;!_hZ?`;IPc#_3A;7!qP9N(uLzrMMc6RSaP>?|#@ugoJ z;I(oUM39n`dsvfB74s|tu4ZT8q9uHHF4|pxB|HL?m%>yt@0$X{Je1fGBiVH<@yxz< zxmcIvUBS<(1**FHTu8(W7x&6qRvdNxo-a zlgD8&*#KP}7^K#Fp8%zq_=tUPxW%v6uv3JxvDn|zbK5Hc>L&O6_84#+zJYh}eTCO? z;E?m&e{dcN?P3!|SACTJ==9muWdK}D^!Ycpx$(4LFWT)6nqqbA+HG>5P|`iLy1JZZ z+CFvtl<_2{XwBB+@uCJ#r6mVg5x1?T7MErWs zePq~tw~fg?Hn(f+KXsKO7!b)vN>~Kr205_aoO2oaB?RH%UlwdTNkwmPD;2T?M|XWL zpO|^CE#a;OO1~-`mNPLM$dR;dnapRxZoenSsEq*L3@`FOb{UkjRk9dO&$p#Riu@S=e|*TMZ_3^d55} zUHhTmawHID@XB*|Vo7ZTQSna97pqGqU2gS1rM*?c(+pk5Ub`zNEU<$MP5;3}Nk+&# zXHL+|(wAjljgN734|}Ia%=?2qs+lA~r2$sob+ZW9b_I}JA?w_$nQohvH2PQqRBIz; zltke~raGt}Rc(-o z*B@I$$#^s9->6Kagprj?(utI~{DD(eACI<~fhfWY~}w$j3W5+uPPov5Y_KjflA^!x>$sgYcyFS zDai4f+t1Io5yyX@{r+tR8oBJ~b#e67_-*ox=T!t%$Zvkgp!o`ov9WZ+3-HtBV}0em z>@0wDz0rI75NY~l2{e!pLE>#A;;5SermoOM|5ppJb$PmIiC_*~`mx&BXum}Hm=M-+ zwH7dBKQB;b+rLY>#`<=W6PP1}cG2TG@U>#rWVLoDw#)ZoO12LI)&KPpfLdel6#fqC z5sizdBwqFKsCTM=js25h)ctbaRCT01Jt^#Qyqyw(db#DcMSHpFMZx{^BZ*!G-9BY# zeLZ5`EKMG))ZTpYXls-IHYUboK2BA{V#i>v&NQa+J^^LW@k^gz%z7r)LNLpW37y>) zy;hFJRoH&`7LPs3hEHqDz|(sll_pZ_OB*3GK~cVA@V(F}cFJ}{WW-R1sIIz4lOvRE zoFpHk)DD&+E>3*1yT~kr0U~#1V>2c+-^GzZxiDImR>+*?;?mp^?y7k#e?uTeS!}3p z)2|=G{EA!`S+JW|MMiog|B{E19|7t9`|ffB^_md#*UKEG{xaZh9Yn|rCsM4MH7-6`j*xa+olQYjzroe6=GzptaQ|V0bN)O;_N$DR(l)OmNzE3 zryrm&h2#o#M(?SljIk!tULk8HDZt+wXiBgKSErO13uTsW>8hIwe9g-S=y|v#T!GHS ze(U#_)Y_4toXJ(pR7G~>_T6{#pIKZo>#RFhdUqWZ0zjZ2*+!szg~OYEFmgbn)2oV2wAFXh9{ z`?C3p*_)Cfq0b()%V9uDR+GVx_w$ezqo#w{rmBo5rF3AfV9U>kY!7S4w%tP&zqgGG z%E@Vo-!jlpr~wq7rrf=ktnp4!)?>?K(8FgXoB9b(bFTpoLc$dDrs4Ah*!JlW*by}C z_RfQm{ERSl0f{4E^n@#U8MXl&AKZns9#hT{%qW8PfqYXPb~-O&begTp>U}OYV^aB*T1fQuq;vQ%0%P3iwTLCN-U$nPlPbv;CR)+r0Ym$M z&ISe}VsZ*MZh5c4J6lT6Z3XNtMp`*>7H%8o4)Aa85MLp|=sXRrgD>`czd& zu2){(yE~TO9xiX}ajh6j1wUsz5(|qA2$(X%?P7e2wb$!>`!zHaNJ|LI)L|wWc*HQT zOs+K@mG%jml_)X1=V*PE9(?>VHx4 zgG(Q_cxU|E<9@5QLzSn=+QpLfB4;NulrndBQJvy(w#4eh6Dop6{Ob8BMBAfVLOqe2 zN`Lq7vO^f>BXiAr@ii{u+ic!PF^h2z;AlX{5QM9bkPWEw>)WS#Xr7uYeD}I+eM#^X zz7GqD7-pPXY0F>*^0Ri_?#9^{5FoYWe>S6qz2{yIuAbl};kLsEfV6;+UzfY?E<-B@g2JS>=9Vg4O-^*vCp8uyTm*)oPs^=^@ss#d1Dk%%KdKn|F0OBbBAWiq z6$?xSj5OQa=LHe}e11gpw*f&f)*NaB13;EK#toJLuf0BjO~4`iZW2%BBJNe&+k?&^ z%KQu3=ckkZk;AtAwBuU9)z+4^k=4Y)>QdfQjE<3K(6fBTbNZq^u>JG$PZjBk&jZkD z?fpd}h7&wztMIUV+^#hP{l+ITC=-+^jYN<6f)hoA6{5zZ28Ol~Y*3I|bE2axy0BeFxty$SSMlpMR5awQ z<4>dOY!yp8SV+!lQbvpQ59#tOJj?BwXuiLSPGK@#<|oBKaGoflm;B_y_x@{8)=FOX z%enF!G=>zZLHr*|3^jL(Z*7r9qox$!e`(+WZ7qu(w6C&MD77%Cz{1kHAB>2% z?VJP(s<`oBDqCDZ95_?`2wfp?uJu>eHU}FifrP|>B|s~}4}_dMWIoqmh4^P+o*+0N ztNJQ}R_=56H}}t^LFDYl2rJ%lh`QemToj3yZfb0mS4V)jg3f!u>;=F7@@hhTsBVZs zx#e38{wV25C#Fd>W=k@e>{=iYwp#z_Cni?O!Gdo;gWGd05jdv0Db<@)O-<~DFpC1^4+~v zdAfsWHjEO^Hy`h;zdzr=>hrgrbvgO2`Ffo<#q{3LMxdU*zmIP{-U*;q4A7^eUVxVH zx<5vydkzncd`S_IpH;ApZkv~W0VXe@?{Q?FJORgNvJWHwv~ybb#JbvYwwo$7vHvr z^Kq}Wr=i`p}1rt?tTRk%{IL`My% zg|{U58zd3muO-UmP?1ZLFQM*mb~q zgUiB;)28=9O+6BmzsE?}kx|3h-G-4uOpMI2k6bA)L^u*vcxx7tmUFauC`3OC`)l9A zu~~1^L@)+hw4$#zByA9Z&QNb8de|AuXdr!*uoi`;(5#6j3^YsPUyTCwKzYdv3z7&t zE}Ka;?ORl3ejgIynOK#zmd>ht<+j~74g8XR75?&RU)73rEVH9w8m7bunL7IAyUI$ zv9A96fqg1RXnudLmXQrbL^gFe2f>EVY+!tC)ybJ$xZgm(XJRfrwSi3|>V2Xnh+j*8sz`E@ENY^l)K z^U5elgDnHkSI6m--`TB?Rr*JF``+8Hb}JQI)8r@zg#){&vN+rw9S;|-q|0T!lf)ppBM=`>rbfw#6=FV|@j zo8f+d%h7)43n}AKBaz;lXKAGZ{Ets-oh$vq$rOnIzk?yt<&^op`e2rBIFY)}&PQQT zwo%i2)9NdJJ2OhFyKRA=T*X&Mo)99s!5lN7F{o`!yQ3Nt21#;)l2Mu7aHV7P`fQy(N{JTIP_J{n~S7u#L-ru>@S&GQyPpMaw==%e7=w3a#WE|#(Wr{&yXRRK8q0h@tB;#3uI_5jg;)Lfi%^Hx{Q1dU4(n>? z$)8)4%+d{k59c7O!^KIbO~2VU{gr#b=jCN>rTcZfaofGJ;l^~0&so_4V#bwzge^=A zsJY8Y#%t+}<>h*kC*b+;&#q9}gF#2k_-DXqySamA+&2e)R*r|6DNsM+n}UGT)0GU9 zQ_w>|yN&0?+riT2?I>u(P{{k!Xzd#irG@FD`{qgeFfu2M_1rl9eEsV%;;P>zTxDU1 zfJpoND8P2h!(e~aSI@~D$EJy-b1&P`bKqb^?oYM*4tf{mrlk zaCYOvyuaN-G9a?l_2Z%zRAyrxY9 zExe~_=TbsK=LXKkc3KYb%3<$gt!5R!xdQdF{W3k*)bHeRjZ`~B+sW^98LvhNZ>Yy= z-iepA?ewDRB;UYw;J;b`pHyxP;;M*dEK)HMlsQ2p6umc#m9SFrr3xV%eWuPHjyJmp6MKYE*nujAAigLS}82YkZ? z#O9X&Ogajo!syKH#^0>eRuh}S3o<<=G@n3Jsxev9n@sPw-%(-R0ar#U>{EwyrLzIigOxjFbOUBUShGXAWM8GH zhD=R0k#k>Yf^zqjkf+o!{An{GkQeFJ1;<2g-b+Xe2AA5;ILaxB*2D}2#3W*&N&t>v zbIe`}E6!zBe&FF>di2~Qzrpuj;k#HHj4!TSV)2-ixMgUF<7Ua2SSxlDbaLc7lB;zj zF5eNXeP~!^Xa>bul|jgWjcs=2lVJE$#=cbaN0OIf&1!GI4a2``u9h-tTn~zhfml|R z+hF$M2s^CM(lmdRwRK73<-3lxuwsW|!sW(`%})={3t!>es3#{yW7_4nLdXA>KLe-1_Xu!mgQjq|B=Wp7`G_43O)B)6yVX~^ajLX-)iv8KeZ%T$^s%Qi zEFsi$Jp^O|?ho5+J$~YB%4X|%4Q>2tJ$K()JVU+oyW(3qe?*#Ob=bO@S+t+l?Yhjn z8(*WO_0RSk#M#T{+~n(-{j7VgG`H6b+jQOZaodTJ1zmpJ_c8adbq9O`OgU{XJC(j( z>*j_Ye(U_iYU#2TA~C9awFdUw*!xa@R&;>>GfymUr|oIW?%>}rZ^ZNK%;5R?k}=@* zwpBF1`)I>>tN!7@{d#M|UBKb{pYH8L-`|*ISdIxDi!@CoB_|{2P`n%}1hTQ^J0%^YKLf z@&Z3Av5|zNB=jd%9c2-Ef2097M`)YxP?|zX+X@<6UYEx7xj&?Lkgn9qvfo*B2 zAnTOQrXPbEs$MKsL-nOut5o0Aod~yPlTGpaQOMx%&_4bC2It<_ z`cXwO(5}5e4dSs7au&GHG4+Iit$9?-yBaYg(+V!WG{Rv0Nn*3A27zNd(fcSu@^ya7 z=yKy+WXpZlxS32evtMU=H4+PGcM8kN+Jwm)Db~;uze&f0JifTj^zhcbDF5~XSouX1B&@yYpAYgPC!DM`i)V%0w^0%-mo58lv5oBxpLSHX?2 zqK-FX?u+}f+Psii4?aJ&vRsCCGTH0&{}FW#+;xTB+K%1WX>8lJoiui%#%OFb=8o+& z+_7yZjnP<*%^iIEJ!ib<8)N;0HP&3uGv__8YxQo$PkDDo^UnYXJd*&TJfl_W(ZUi*G)%(?c|r)b6(k_=z|%-oZ5xE6j~6iT z{k!AB7v7oC@0r~jpT|}EBSUX-yg7mg*Ga-UJpzh4mxa6TJAEq=*x4PWAf$J{12W*Av^Hz4?WJh-P4d$=f!ENh-mbk8dFFBo)R*^(P=0Cbd?TcAN!oo9tNZ6z zC!*H?Z$e=!vv>jO>?<+#_?Q)m%ek<>9gRvyw4GG0zXF01<@e5^GiMQe5A$! zB_ewz#y;(C(g$Xa9@~=ObrH@(h6ea@P@KmJm80fbZ;8R!*yf5E{k$$0XdE>X5=i_d zeuch1ZZ0GFvJL%8;b;0Z;_YlE9WYGGU0oh?I8+ZV*=4Z@$bXD{E^n4~aE}$P8B_YU zf}Y|Nekmrt$|RfGsO8!YA;H??I)+$e-sN7@mE5GNhUu0@=#nBv4y0NVVa&mx(0nw& zFL@7#&kupg&^(leq>kl_B?Q{!^DQH?R6G>jwx_T(yt-x-#*P|(j3``oGNe4FtuB;x zJL-WtDBxVmGbW0ISoW3FEXGm45W~*(mMBuVOuH2u{{Sxt%pwv_&wvel^}swXRq+j? zhy2jS`}-nGIy;>6cgA7e5k&kH*{G@l?lSyIbS$l9QKXU#pXRG7jP@K@6F25$zA8L_ zB+O%Xcubjb(6@ipnMzf@Gd*DMo$O%h-oN*bZ?^c-LGiR_w-N%mRs}SR$@0_;N^igZFJtc z@51MCna-yFyWd{{JuehhWdDCzoF@LtCzsF(ENx0ja%aZj+0;P8)-F_(hZ^twGdA;|ft?-U zx%K`pttR5K6Qurh_80cJ=Bla?#5bwjDH{0O>q!2I_-xDLvGG;ZQA-}HYIe0P?Gg6o z?VkdPdxl2$!{YwQZ&e5}~42QA8+&cVVRNJM}sq4dEa z@g8rtpHO(SdN%X@-m(OUBLjH|Y9PgDaM-_zY~ZMQWaz=@?n#^7)zH{Oyi>q#nK=TY zlED7{XIG4+lj^5zh4-z|$|mU2b>7(L^%_w&&1OldWqb~h@i)WVb)fb+3%^;fg#{t9 zvNq=2~r~XWWN8t1W5!+oWz8y>1!#Qm?wU=Q)wq?x;cqR&k+?A}W?8r)2JL zrS=tS8)6Z5!F;7*BU0<~g8xkHvcBLsTu&w~oo)Gy{A%qPm;TA<-p?HPVnB3K@!s0| zlzc|weDf6QX&8XI>H6t(s#*)qnebZSo(Ei=nHbf2JrR3?j|q2S$5^YZ@T`};`#LP` z%lSC3ak=TAT${JFDK!)p`Ki-Ba#K z#l3M?w)lE=|NHgESwV-+KysT;Xf)!#b?95mdX0x6dAR`S*1W(Oa9yVZ*xFd(E?r;T zcoq+JewTV7DFtq zRL)-!)}9-!G-E9(E(@k35%xJ{&*2{&`KNZ(U6%K6=wdn#zrdqtc0^v3EDW2!cQQTh zhG8L8GGWtCl&}a>d1%61>P9Z$#W(8-aZui3i4Y|=WpsWEtKc+eHDwGw+)0J}3gp~? zHR}`SXLEtEE&l!%m}s=uC#s|?+_KUc=%67J5*H`_0-x|@kP{m(+N?i4wK2-j(p|Qs zZZWTB;TKZBg4!QHY~D&hIS|Uqnx7;cyhf7cGSo+ly!;lC zlevGOjqgoAqv_NRxhz7u-IOG77t@qD>=rBi+|R0q(g~^ud4%Z@opl=oV78sDlOenJ4HO z_)x1q-$&L>xCd!#IcC4^DyiDllfXKY-7wiq@dRP8J>w~w2)^F$X5!`M_{i?j|LK+a z^MvJ(^PNQ)&nF;C(#Sq}3tGl)kS0aF2iG@s3ZEB>$%p^^B~Q0IAWg% zb<1UX$?2&)Kv#dg@h%=LZXBUacHH6^9>?HpJPX)OGx*%t7~m&#cRuD`nb`&zJT?JH zg@1ZmP*C+w&D6Xk?Il0SCJf%%Pj8zTLq_-pG0w2oJ3|~%7)}=?Ydpsao9hUQ2 zx`f-FD;J_d5_{QIq||+pkP~pzACY@M`-#VC{cuGe`W?`6e!lBT-j?ueJ*NkHQz|Q+ z&8~_)4H-pB2DUkXKHXO=fz{jYr}a(lNF=kJrk9Tig1pAp8>kI>+u2}6*u(Tt{7AzQ*)h&O(U9HE{Dsp&Jr$wFV6)1$E_k|$WX{4c+b=5 zA2Wm9Ts-fDOsKRdL`KuTxoS~1-s-_=n)o+R#L`w?GNDL;aB@NEji57?DP^*m-j(=z3{0|@&;W0hX z=Lmf8XY~nA7kb<%YDuPMJNCu#B{y9IAUuiDx9f$CKL;$YU@sF09}S1eg zAQe1^1$7{CeZw^-g016-##DKa?+Y*oN^p!y-BYP+X`2uUsaZEem!a9{W0C1 zy%IQ<&kZWyXay;=1-eToJ$|~pHK7|_CmnvNzFvuDS%2T}dBb@SnD2?$sYBBTRqD*~ zh3@0j6<#0vJ_m#WZ+@7uo#0=HUTW^0YML8XPZ zwhv{@cPp21vQ_gR*)4_wPw=E`u0EE%NBH^zI5oYdlUWHMl^xN|UQb))HzxLg(z63@ zQ33c0ZKvLk0Jd0C-O8)8bZ7P!h&xISc7fzc_WHKYgT3HQWoIKx1LxRr%1bX>?#V0J zzmmsWf?bAx0mIN5$<+yDz%X=8bKU@FtHF^@L=-!l(570 zHb56pb)hFzVscf2LZfoW!xD1+g^29?vv(eY6Q?rh5K`P;Po5H>gX!AVVfiHjm%zrT z?8-@X&-U7QYzqI~DR6z$uuL++b@A$&Wohc!DV51YDb56_2)!OGR8SxId`RHznD~S7 zh)qrI_a}qJYgnO|2qSu@fu0z`yjdJKrQdUt6<}FKdydf{ zvNv`0oq~)4NP&>c51TA_vv+pB+vqE54n&g`f54M-^oScnYh zJNc4sr)8g5MIRlgJQY>n^n(WP70?dPmff*>{MV=<_Vdq^zIc;u)EeW)o0_DJ z^hjM$PlO2R^^Maaz4d6LDOxzC(MrxrqnpI`D_jno4+qn2`s3BxcEX^6kmpv@#a;bH zOoILA&ei@J2N6%~0+-dS7h~7=rY2D6%HE%D_kRmIf!CVXPjCE}3zL)U?NB23p!G?| zP8UV3@%|0q+sf!&cM0Ga_@+&N5$anDI^oT~vlH|PG~39tf6fig)_STc znop8SIP53Uh0&seIvcokztY6h^e{L{X|XX4xUR0g$oFBhr;+FHn@$oA?WsG)9k9cm z$ABCN%9y?#)`)c=(|n%}oBP)1ahqh^sywl$Mx$lM^^4~9NTba$wrbi4QNdn3um9XS~oT>(LlmLrO?ZJ zmkr{1P0uEnJwWrv&R}TI2LdgG&dtC^gGo>h1`r9Jr4DZ4@3FkEH zQoh@1m@FuPl70`VIzyQu7FtD%WIS-IZyX5A1A*R>Q%x*~*6w?VT%5OEu&IQ=cNDPC zE+PD#cKJ738b6ru2_^uy9N=5i{DYT}l|X6xXSc_q7g`%vK+FE#BNNVEdnS*LrBJ~! z^UZ(S;zbNt8*7QgctHd!#EV@ML-EUQ-TjZba{d+LRbu=~xqoYg12=rLv3KDP zecJI2PiOYC^I3Wed{A$^2!RJ08M~5p`O;qIbootwA?=}PJ=zLfz%#Ez@IQIXHCgu= zwzE}moas0{eaYR`Y}l{K*LrSxW7|tBH;G4w{O)m^PW%o%0zT2LhU+&d5VH1hpR)cks`dn_qKle0q>!R z`o1gLdta*axu;rF{O;@VaoJ*&Fz-_EF36MbZ9+R+j`w)^F$G1U)OnfSx*iv{glE|D zLYaPff3*ot2F&vY`fR=lnzVMEe>|pN`HFqD?mTKx-1KZfd;3V;*n5gP;(0$!YqtK{ zaT>b;^d2+P-$K~<;Ou7o13qf9cHdNP9@}GW%jpX_AGb_i{Y}F)Ug7@PkwyYtBMAD- zz2Vfdp&cRO>G{lb^EWMj6Jgluc)Q#3q5SPQDy@5`e8z9*v-{_r!AkABEHK;Oemi&+ zk95QH%HQ+jpXKLDGm$NnzJIh__S)UqaTnr|;yYu!k1r@6 zL{bEeh*a^1xvGNt~lKW zf=7*LNXfFX-8RmavuN2rYK!LZVzTP;m%F1kLH{PzEXwYO*fR^i*%9Z23^f}LuR=-% z-t^!SOU8Pl6t@f|afw;=?=BBvuU|GuP-B*d!)MReGt&&ZPjFxUq;Xp_u|hqKQbk*iT;ccLHJn&S zsqkOM>A$P;IJJ4?&+WHcKb=|)8XTX*xA`|8A2B}tJ!do&_PpLvpoMkM7n_;9`=Yan z-&5~@J5m+kc9%ElL4rb074dl0LkZw)xO{IlHbZlJIgMuwBtpt@Sz6j(Q5_)#Y>{kh zZUim>9YsOgCM}PA-7TDr9%rO}dvl_l&Y){nCDlLk7R5ioyH1B-$p z;^CI-@B`jo&y(B$P3x1LEy0$HZb|KyD4J5z4L;FE&YtBa!wX>x1KlS9pW4LCQ*8Gk zDQry8II4q49wu$WBW<%i8(i(^wN!?q+T|NE#XzF;0X)T5U1ApO;i5lo810+{OcOe) z-_>wNe@FTyWbK2-=P06QQADfu(8eID&m1jNuQ5Q1f2E$V!lDUi^F{fB6%ysp#q3Z01B zGoFPe=X;R6i+(P$hkz|nv~c#n!vjs4GkKJpfr2^d z+l3`lG1<%oRjFAgCAbJ5*9Jl!q(o<-%KNuM6ieCQfPiQ)y?cf3to_iKdNfGhe;URF z8s)rXSq@S3QMAV?NBED>&Ek$anYn_BD59<~?mHvSV-jti{zEceX%CGIBt@{Yl@xjr z=YDr~HHqX|NL7I%`m5Zkm4d2h(vb~EPuWNr7&bCr8v;}xxymsw?nwryX_zqTS>Vdn zc9r~!hoaG?F%#`8@#3Thr+yKy5UAd|xsVp^CUyQwie9sxyEnZSodE}w!em=b{3k;_ zKQXKrryPW;+V+f}MDrpFcf$p*1j}^DRM!07LDzc78-f0yU}}Beaigb?qmiZ23*BfE zePf92fY0gPx)#h`6aQuH{I;i&xKp;N6=M&Fm+SQXt=~(>4tb-!gArDCT%Z{u$9A$O zf>+w=WZ=EK6@S4NM3N35%Su|I(3`_+@CJDy%? z69c!KqXR)DH=@9^t%P3d3-;r7IRWpFQ@drLbM7n)Sgbg54H&79{qn-TV@Qt|WUd1k z*mQEX#jZ^#{+dJ2IZ~`{FE%6$@F|yj9zU1N!n7+ zViG)}YxVLe+Y$|9KoYVlfU1EZ)507l=3V)Wz{NgcOTCC2KoGnGMcE?vG~fZ}`6;Tw z*A#hM1JG4Kl%^P_Wbg=9i$JDu_Vl&tF2ew4rqn!DAomty{X%7O1}A)EP2-D`_c3SQ+vAfdWuH#>mDxtmUIxVfSoZQRC?vtVUolj{`PFv2er|oq} zxw!^+w-0w$?WbuV5f{U)Wkjw5wEl5 zhs=b?DaWqM50Gfr&%u+AG;nm+>F+&H?~(9KTvo0q-lK}K@77xAkL-=Mi!D{dR@-;_ zT46Wf-@1pvr|nMzqH-a~HkGPnhs~FrQPzADkOpJnTKfX8{ier?_2={Ymnfm*t+t0W z;r#BiK^=#Hv-PFj6-$?Hmyd=sk$}&@_NQ0x(fwe9T5RC>lu0|c%jcWhbM~qtZHc)1Ur-ELXNXu4uQgx}CigbwWn2JjNMI zIbDu;4Bf7*NxRN`PGI-ZE^~U!77kaoA9lVF*_wlYgWzdopke1pTtDmxkMko@LQFfc zpe3a%Zg!%pxgi(T4*nqmyA75_7G!6gxR+$=tu-z_-GbQ*3rqWIbTIAuHG(*Lgi;v_ zwY5@7jpBdAX;Uz(V;tl~oJV6}-=KLk2o3p?#N}frXbaJ~Dl7zU6K?_Ll#`(&^h$C{ z6bRBrr40Gd$%d&)4%tRU)cnyHU#$@uZoy+hO{5`ZxM;m+8wk39su<{@X z<5g#Ag(E=r8b8KbB`dC|+(P(sAi*xOYF+e4THYIrKGf@qn2EufdeA|J;!PhGW!+-6 zd-I1n*;_Kb#n1_Vz-h{v`~;=f@XFlQL?c3SYVc#lp56M@{4$PI(oID)kbYY>729u{ zOca0__!KpI;x)fb;&YnP3wrt=9|0k^!g!xJ*~rjbP=^XOuQ_&EWLz8-!g(bbE-lA1 zt@sy29)DndNrt7ROpguvGy78OGOWh}Y^yWF5?fshSUO8VPeZ=3;mRC`S#VpWWawW* zZ#qqMTi{(B+eSTOYqJ0K5J=Rk;+AojQ4|m3;lgk731P6O;PB|uU2}IUt)!=P3!9Jm zs5*TonJM+pMXy)?@=&5pVVp2iUhgPq;<(|d=7QbU2^{3f}YhS%U*WO4{2iQbj(Y`;*d7TC2Nzv7v+pVdC>ey*# zbCs|(1kXyqYOXlKFGXOUgk*UhjZ%S9#w}o*$vI;<6Sfv^|7xIKWQ3f8<|)hZw}2Av z7p1Rp)(FQOaAl}vp0AihxZ$`PgmrX|Lt%MKzKgCN%fr9A>SEO`$5c;ZeUpV6gX{^z z5f=nerpQFkt%c#JfD?)NMD$Zx`B{(ZrW!pkWmI`Hr?H51gH$S_;*c1Bh9+I1+_cK% zg{CmW=y#^j_N@Yf&1@`HM9HD&d1SJwRTc`Hn)D(C4vRv)(Y(M)eF z5Val?PiI^I*bhiCbkXGG4#czsJg4^&*typ%r_mo0`^Aa1Ry2i%aXU$G<8dR!J-z6E z|I=8*0woGnMZ_{oa&d~Kr6-fG7oW4jLOG!&S`C$#OcHEN~m4) zM^5e5zm2X*GZPeo zip`3H`U8SWjrc$6IBw$^NBAgb)72Xh5~(UxY)za~9p{EFyprAIpwnz$Wg!(>wUBy% zFY2Dk68}XjeJQGQ5JlfO!KD0^$&rokw$J7R;7jekr%qu@HRByWoM>h12;5N$h&Hi5 z$(w*29q%53QNBG#{z{?3RHSi9V$(GENd0}t1un7%8MjspjllM-tT@f zKxt}iRoI1-Rt>;nZj5JHKMM%?SMPr)SW76$m?6ForD<ELk?qFq{#Osg zBVB}bybKA}@BY(ziqltgPev$@BBAhb*%@L44Eit#^8 z0WTMWlOSq*GemXJP-G!gVX-!AM)UR>Vu$HJfW<5;dm7rjsl*0bU;WMP?#QeCC3m_;d!`zfzNd4^$SJ~gD}Ix9V2}=E#(d(ioFt72W#-NkPI*nqn z^+FOOeSzD}a-Hs-lCf;Ngq5T^YRze7Qw13ZC=!~>s@kQ00_O&zwa!JOy_K-nE{J)>7veK{( zL>jqh^u{iL-W*fcilt2<3f#gWU$vMN!)A}88__cug26zu*NK1PBQg`+DDUyo$tiNd z#GDvuLx&&#?kX=;olWt{SL$YXwCzXI?vEUoi7a)*+}1p`FjbB=1@pm@Fxxit}{^& zs$*Zv>Xe)PyZFPgKMgGtytpD~J^<%M!e^!)1xfYyfz1?ALe}QOtgzNy>q0&Z2<9~* zG%iUHASI}}rD*lcS7NE?g4;XAF%gPjUPunuUkw)P_}!07H$>5L{J|crN}4E;e?@0C zoBt1heZWjF$lL*Tle#BuTw5#SeI_XCoo9x^bUA5Ui(A_Syjy)Yv7R4*ZJNu2btCuv zH@iOf3y)46eH>KD`N%eR{UwUB%70(s!yNlj>gvG9VHVf_z}TfICX&pPt$);kvD+E{ zHYO}^;3^CJup_m@6jU-KwYIE<@x4rUXi0A(<6!#BR>k}bEGP(a$~2_d-z>;_a*tBy z=5$*T`KBI}Tt8qX@uQ^W=u-3WsjBpDX-9WYq( zKQ;A0UP~;b9TbOsp3IAt^Vp@UU7v^s&&QWkjsTn9`t8}B# zkfNmlK@%Nk58N@bhj~)>3>;d_{&90FmEbf#IJ(%zH9BNxqBx(`JwyPAd_9d}CIa*q zlF_@rfHiLdGq>9a!Ql;?4p$kQpW{|plcQZfxUKLF6;yL{U@|&(97sT+j zC0Jttk(LW$G4~rKXhf}-gQq-vulGd_Q@>fGEYmd!U|~S6Dfh+M`y*fdk1{D$13dlq z5HkuDin-P?IabGqIQ1^%cYM4%olQm6>ZiuC$?5y}I@vM-32J^|<}Vy0GB6%$;7ZAR z>S4|bk1*N;#}{YGiAY%1Rl6WinKz$m4UqCyyM;EV^J9^|o9FSF+cr4hAF*30z zqrB0~N8@)2QU}Zx)2aY;WV4s0;K9{-#G;sDp>Nf`h>b$I@icy(4<^(ith^?wlG!t+64Vf6}@&X2iyD-gg=H7&A6QHQ>l$o%ILkX>2!H^1? z)DW2y@iK$xSBdJ$&U{Q{otT$+WmI8ACIm%q>h%@ZRmFsm1P~x05}c=!LGh-BoXv5c z=X}$;mSsKn!=cP015yq5(2vB7wofF{<{Li@0O*;<!h*SBu??HBSV5qRfU>`*8cd1!bVQ=bEKNcWEpN|X%uSRidh+XPEHFnZq zkPCMo9xfm-0?h@0OVd9OFC3e|rJQC=)7y z?7rc0RthjI)Gbx{LXXPHNnbQpRb9Rw1=k<4)kiFclS&^5Mfk%)-ztzr^Uc3S(pyH_ zCB?dsf4WYJIZsM9YH2yZm4L;4NSgC3>l(8!crf!VtERBkOu-t8bE_YE@yxPJj^ws+ zA*3_r8?FopGm$x6EO)j{)MR7nU)N&3G95hqGf zJP2kI0b+xzXo8f(ge=%$jCUXXQWa z38Wwt-3MywFKhY!upGA6J+M0AWIBWdDf07`zR`!*`~Aju0q48-O6%p4(}x%{O7{+w zQzkVqdT^=0V!<~S?h7t!1v8u8LkKQZ-3r(yC-e=8b3B|(fEwMt2}-?XbQrUOGrMFQ z`e+CKRb0)aN9WwaM3*#Sz$;>D&o|cqewwoLpg?&gszYr;gNhC#o93L;7_C~0(hq4& zEPRC0wI8f}Cu0Crz=P*fL{$Kp2i9ECK>B{kh;M^dywJ^kCBQ`NaY1f=WnKt1`Pl4b zf(}pvw{p0uFr?IQ9DArJtRVyDe)q&KfHTm=B&l_){EpzXfYvhcsh!s^!j|7@#Rpc{ zhO-*0}k*nT0?5ZknyZRTaC?*CUJfBiblaL1dcQzK6%gA)}LryF(77-Rtco1uLlF)|9t5RQ;ts6k{!|$VSGDi zo;CJ-#wHkVO*>fD&^nhNyJ7IbVUnC*Ij0G&pKNq5L}-B_uK6cCpGS3NSK?#z;%dHb zpl+VIV>fX%*IUh2u?<$kifvDEoA-DS^d5Y7Xn>`6z!x5KEac#;4b zn;c9Nw;UqtS!u;OO8>g4t~18%)-SxXe#hh5ZmjnkF#S);(ZZD7?_yrA6lU96pu5`{ zCwUM>M9lBR(L(>}7^&}biRaW3S7s1Z9REST7mTja%Q*aF5&wzJOke-IEzr^wrgiyW zG|VG0*duqXLIx7`2T%sr& zW3p}BX$*(-Vl2?`U&}p%G*zfq95c%KnCo=d8_Bo^b_cwlt3&wEufWJ#$*tleDj>{J zP_X|aMO0fh+FBYRN<%{=T#QF>QRD~d;|I(fu(AVhbVYy{8V1JULetTaED^m7spSil zI+gw}JhG?+DQ{wQ|9_HNa2SLIS1bKbz(kI5Dvjn4t#<<`QLHkKNHZJ!nh;AlGOEOE z#Ts3N#IOTYkmtp|)1x z9*_9SPcukH_rv!ioV<3RHc9M4hRA4f#g3qvuMq;uo+fY+*YB7DAIqr*daxmZi}0&o z1v&1QM-S{q?#N>p?!#0Vzmdoq^@$`Y?0O^jB>3|2+aL?mUr@Uzv`y_&#!;g?+$Cu` zyFk2ic86IO`2fV>oAp`9PoZN^72~0i+>d)D ze6&zWDFQ$X+!uZthM_zTnbe!#Dlrkuy?VsBf-UgX*9Eq*Sd<}OVGEWr>>NlTia5Vs z;1E1A!*C!S99ka8LdFL>BM_?AA$=cZx8Q=9Tg$zs8rpg25f$Z$2Af6N9iT`GE>l^ArC{^y~PE~Smk9H)@6?m?H~50XLD_50ggN=v~Jwog09 zkfGEWoc-$7CQ0J(~cfE`1lq$;k?V%tY)g^yO186gvZi5KI(CAGncOqPcgCXS`f z4<1R=;r<=bHAY0Nljed%->`wIf!UlDBRySu%ucZ47eq|6GRi{7C788zLhFH^Z8 zCt8nKMC-TMvu8f$Y@md@F@Ho|TXIi;7z@5b=^GLu!a3VvG0NifV~7^W!G-PJ({<9o zCh(`1(4H(VlO4;45tAn#X?R4G0GLn6Px#QM84=m>VvZDurc2t)un}a#B6&j0iEn*i z|1RGKYzReaWRqy>K2<~UtP>h6NQM{@Y&eESlEOl6tvbIPZod|{LDjIEet3eP zKKO5M9J`a=$RFe6o-8&MvTmG?OU1Zfb$clQ{m6z5p{v{?LWYzs;PT1^cGf2^kgI1rbOuz!nLMDB#)o&Nn$#9AblG!|H zh#$ru_957C1B5GV3oO8P6&-8|4oT)*qcMc17S=k-h__J4@M!c|_7nB**a$wy!%qHc zRZOXK%ipO?+Od*?4pr4t5ml-q<$Bq5>a7PnB!Ny4_z$g1YUZaA>aXqVxs;o7%#+t6 z)5Fix!W(fh)6}uCWHf^NbU5gP9v$NE)3?IKSBIJg-_aFIH}&tt)?&p?dgH{w)L{WysUzqr9{cQ&q9~!$$YM6}E-w&B70}b()Dyd}ALya~ zY`M0jv_joUM$?W{pI@n7D~ly3gi@C(h~)Cdb}YZ|1*cdQ{QY(lSyWOUcTeBg_D_yD z6<~DK?KuHi!cSvfC^r^?%7L6REX~zY{hWVZj(V#gC8dry!-rahk1CK}6!DPsBSiCZ zuIye(z|zhT3k9y#OC$LFR6ked)|Pf5k7}+og(enk?&F6)r!u*r#R8zV*Q5+72@?w| zgs>+Xu&4Cg(C57%wVyn~jKqcaSgU)H4}1z%F_$^A_|M$ZvkJ&rf% zUA?Kr6uU$rTXXM`>HTXngYR*G#d2v_1Q;2|c=*9C1?H;chuV(1C_OzS5K>mb(IAI) zZL$p*6nGT4O2nZmzNKG0!r($^1(|w)t}Fn*1lS zb>4M7wV9;|`&zEpLCgfOB`ity+-D6I9WdVr*pF-pWcGv$5EbJcZs^3QSPqwL`{SIt zpnAt{Pwj}d+7(&<_a(VcI$5dG=pwU9t14h=bzbn7o41T1 zR*eSzIh!;0iBKnW?Ffql!^e0a=fWwLyypk+%TTOt6>OMPl#H?N+b-Jub`6#7pkNpq z@n=?b7MEqpGre^d=~%09`t+e~?D;M12vngQx)hclIsYD!D!~?E6SE41`Qs2whcP$! z+qhB0C^zx!zsbBXTzlJ-ssen|8f8y_AF5V!1wa8GBtb|pD-|PI8v9zOdV=l|g;+Z;3MSqpwO5=u{CET=Q z(=)ADPHcr!Hz-#16xO&%YLs)I+l5Z2;xflH7#q2^V>S&B7)aZ!PWv>GDbb< zamk5KU!X$u_e%`8Mh)HUN7oByDoHBAkkf_UCnz-vJW*v%sjUR<;6H5aK57bX@CMQq z9jDaTo+wUhU053)eA~&APpJnu#N^a?Gs#liMyt7EJ9CBz1Tt89icb=!|NpAf#1ODW z!&U?Bft|jpYPjnCuuJ?M)!alAF7)Dl=0kGJ7pwC69^eMIL(*WVNqs$nZGDwx;HJ50X`xY-aQRA^rF0|l ze>(yMdv7{FbI`?X1l_oLl8tIJRIvUApa0dIGN0l=mXF0F?70`8WpX~oCc9x+Y+Oq8 zQw%pdat~e=8O%d0{48fsIY)kpLaB}KCl1htkNvj?vnKmWYF-S1j>?I$)j5*dxzAbm z?}YZD{Lh$1=7U@kyUNX0p{2vEo$`4GnV6#;pQF<345n{9da_{EW3**q7q@<0+B4V%uKIZ+F*3EQiY`^Qb6kg zrWjSnZyVyCCN+LX#sLRrW$><%M>Hj6bPk6zW`e1BVp-NuXOL9>df6ziOepyS$CJa{xheTAN!5@ zPL|LBkd8Ff%m0<~+{$KyKB{`6f1ELPWnM7bB8KsWXW>ME!E&td4})f~io8EcqUkoK zSZJ6nalDt|udfl$nsn46FFYMFQSEoQmv9%r~AF2gkfyS+HxHVo!`>Q!asGXtUS#8BonYtSkeK3*>+ z%FvibbZi`f?MmBxo2^L7cXp%^5uBoeA~pZCn)j@BhxFy4XcLGl4l-GFQ)+YQ!W}}` zn~)O{9c_wF!MhM*9a^|$2F1IEn6JPZMShnOn?F17)DAM=h;@UuB0C`vZL#ijq0ELq zX*)WfG@Cj~RXhK-yfdm-W2@DCLT7q?eRdY(ViC=5;T53ggAHNkIrN5a<^S}EiqeU@ ze(VOh`p(EzX)6OM=ZzV~ej`j-Kq)pSxV)fbjMxwHcbU!6?%OyDOAFs9)#=OdqwKwL z#k-2J-x>N|8ffD-JU4jwm_>Kd>GL$Z_xi2fz!mDE?+KU5%WDLe=Qf4~CkdLg=VM`E z_+hliZ@|*o$Lk&MX~@KwK-W;yS%C~!ZD<%qFUQFXqZFhdG z$&J5+lb${t=r^C|wk8@Tq>a{!?EZn4UqO(!%yjW7S-E*ECNAM+)~y?Bn)K1abY5$? zAM7}61;bjl^`Anqh7rca6;Vv1t6AmH%Rdq-p??JJq%oFobM{lW1^l*)hf_8rW;fH` zIcDlW6v(Drgd83#KIEGC12z$?2)?6H$hat1QN)QeY=Q5V3Ko$EsRt*B=7!NO2F@8~ z3TSHdvZbtC!ME5+=*em6`A7g*V~aeflD03g8~tySS3e<|qFltYR~t-ulb?BpJ6a(y zrl;Hl35}!%43)j~U#0dmUQ=KuNGI)KhAkD-vZ6_bkmmtIz=cStR)CPlEvCCIjY|zvl?Df9^XJFzcpOkSY9i=jaI#o7V&{$y8j|f^zo_7N@7C^-jot51Ec@1%y+yCBO;^upFTA9 zybZQ)(Hpe{t*PLg8=U08GDJhmw-2Z5hll;GmId5+sKi5_6&X@f{3W{o$J9GUM;5i+ z+Ods}ZFX$icG6MBHaoU$JLy;z+qT)UyJK|l)%$+udCnQ5s(#g|AG`KmW372#bI$!{ zWvh~Cv&l+QTk7muY9~WOe~>b7Gk%$DJMdEz_5e7llQyB|{Nb3ZJSrW;(bl#}%krz~ z+B~oQ(XeCnhZD2i#HjS2h;N2pWG|eI=4%dT_Bx@;Uk{IK;%x%J_H96iA;a(r4P(1c z@oM~7ouSj=(Net;&yUNA44PG6*r-V#N7KdglZvauhhFhN0xsuMk3FZ#+;LA-&lFb{ zW3iCuBSAs$;qonh&6l2jW$)NrM3gf^Y{vd|*1d0n*}s}9GHUa+fB8A~v^5#C?g?L{ z@0|qKmO$O0f|0bQWKKt^ygomxz7{4c`v=O{Z8*#aRspCZGZQ>JFuC1aRi{nI`&kli zbnhsV2=Q;#?MzUyLW~Gkd2Z8r&WQq}_AcPavXB-kq}kO?Z_VJEG!|KzkDcg8v12@C zXUz_ORF?fIH(i%ak3OZnW5hl-H=#P!{FQcvltuX@Nuvo$ylJp9X;)cZ3z0Pel@}R_ z8?(uWG5p4y7S<4K=PqP#axf=1!Cyr@c`t z)DRNqrm`E4y9GE0(-hI@;I$W`qDY%)tOPssH^LGwF_P89qV!avfo>B@Ul^?Xp^C;En1-L4F1>#d?eWSd7Uj0X`}}$%3s2;^ z9p{>3P|$itD;{TBti;kdM*19;F+x(V^Rnnv) zsWIJ4SOI$u>8L8>OSOJ3{qlgf2fPnR$a$u|8S^(fhbiN??N`4kV!xW;1i_{n&s~F$ zp$F8NKYl7k@!HIu8s7%q!wMW)9U&@=0^Z234oXm;X1_oY9sb^Z$y}ukyzqKs5y`ACGgOG=ncunYK#6a!v$8Sfj0pno&4(=-yQ1$jSIq8PmL^-ug=mjDxDRa3~LO-V$Vv zj$1gaup;T<(ier3reaL#>s35TTfL@!6>&yRhCRtVF)va?+5k464uMhz!FCvtwbpTD zYIXWti(|B0Y{ed9IZo?~q>a~YCi=^$aLjO`!)B&7YUgbWp$*8?CEqsTfS#$oC^=Mo z1Htk^rt{A}3$(MHBpWeEtuIWvM2s)44I5-N-wgiD6Z<`TgPad*)zi5SBFqT>EX zb(}Y@0Sz7RNfSGVCF!pbT>ylk?V$6BgsVrNw5fRfhzucj8$Y)joZXgoI4s;UYX5xa z<4{fnTT^qloSdX2)Nr+oVt;pcu?sjkm;@XzKw-hsomO}QJ`@Q|m62FUkjXhk??6T( zB6Oy|(L0>gS`-bPw^RyT4Bv%7B?@9&NL{#b6=M-6n{<6x%6?}EWeWInb)tWB1xypH z&tP$Poj+i)SQ0fm7wZlqw4>o=8yfQ7fG_X^^A~~rZgfDBs3rLPGU}7f9N?kuTUlMe zo9Gnt66Hc0%{%*!`?JSr@Go^loC_rAXTGQ@71H{Z)Y|QN-?v!vjB^~0abMiJkKR{o z@Y^+~aa)zgYLY}R@-nSNXFdaJh7=3ST*FVpTeW7!#Q39;Snqoi4s+wezP7e>m5v=2 zKvA0VpCIW0#TFqX;d*_yNJgse_Tl*7nO41?z;EXgWukiG^lQJJ#Yf zK%Qn&k^pgxy>IL2BfBN5+)HOFRhwidp*(H^U>)JaGbOTUtN4U*9E<#PSS%+{!BBAo_l2vr!% zQiNb5q^=|%c7?>BBh->77@RRI*PTa?(s1pQxW*U7g4GiVVXXhj5E#dm*&|~#9ykqTAUIoU8K6jCF%urP6XE^)l{3*B zDAE@-^bV$C84gOcttJVgrger%PosEzCru+*x)Wp9f=Jc|KvA=)0e~dJO(sj@`-O4q zzB`d|&UI@^cCBcz(?DU@t8o$^`;Yd$ovclq=x&V2(=?rsaFjlqH5;tT9tOR0%-VgV zyTwynTyg$aHhhst*_>t6Ww*s?lznfid1e~gEOtpL`(O$RI|#&_Vj#7P0t*ju_)&%l zW1qq%{-xPv6S8HVz*CPTWCWqrYS2dv%&x1S?sylHrY?`;qq&iPjh-Nh#3J|wV@QXc zyDbL7h0EI!!FLA0%kiMg{%>i;hR@&NXGRvEXGS}|^FevFT>o%(3iXY6`kn`->ink# zT_1lcTD=ZsPksAYulG4C*f(iQ`%F3+W1;$Q-#npLI)w{RSk6QX8RO7`dZw@Cne}|G z(f)hX%0EcgE+?PF?E6^0jsuqOv1SukIsi==u^!wFtVO-qRdPy)>l@;{C)wj95;>*`5(JPzqyVmLA}_`P9C z>JVO6?I-J(ATnN5*fEu44PQZ7Bm4}&uBUjVD6K!(#9h-#n`1!tup|jdobrk`9WqH+ zFnz)*noCR(8mKcjq-o%fT`MvS15{=eoBE4L+U=n!H694j)Mw$XgthM!^~Y^yHv4@< z)KPRGN3)E(OKlLC=2L!3z;(+_t|qo)4}e?z*?v+7!p!&=T2O#-QzuwAmCQr^eq{%) zR>pM(U_D};Ki8iK3qyI>n2^p%d#{nMtR_OUA<9>T2OR7zu zSHSj>FOEfW{q6f0XmmtNN<7V>F1r0B3XTzn>^5P_YtyBrVXF)gL=&|vyH0eidIk%z zr7fbf+iM5vyYk4JK$X3A)hGMig|uRer`i4~`pnL#0TfxEvJ-ahl+GKpXX!A1KQ99MysAkCPmr^X`x;# z>zDJn)93T7Am^Qyd~27>;L2@=i30W1(b85K1a#WYsCug-&`R`0=@?2bX_ROw>T*cr6z2Bjhm2JU~Ha~bVHX^s?pfH z6254d*P?hu&1qh)z=~~{!HL*6R>IJV&5Hbyt?BTN9A*@;tvh%k*mx^=xT!Y{*@=-y zOY%O^imuU^7SejkKm-&`}Q9U9F@H4dhD_ zx~p*2r!b`Az~1DaEDO$r9SKfRb&xM+2=3;HAwS*^qxOn*!Rn`lAva_JCIkkJ>ggl0 z)*kW@qNDvOKII&1QKIE14SSP~mLy10CH>3A86g-$Cv`r6Fz6#u+^(S*NzWP!uT0R0 z&R5sSTIZuT=W!V0e8`6fO-Wr-{2+pLdd%7KIRlcI0TKrahW%ldUyVvaf4K&GLu*+T zMtOc~qR}yn&59WRTV4$nJ09byfDd!+B1E(=0-iKjVFt!QXaFuhu|ji$mrahkdPR*T z45($k3YmuW5Y5Kuuso#o5As8Wikh2{NicJ0At66jo+jA>%G%ntVXB@Ol`8i(y{=UM zeFpbc1aLll*LNBu4>(T@dJ~K^Ut#)tb`f%tzsT)0NRg1Y*yW)s8*EURqOH5>|6Jjt z4q)2}KEJ-M^|S#lZefc4TaYs!qiLNjEF!U|ELB%?C?n-nBKU;J5aEiA@_KB zt+=zy@A>;2l4iTz>*k>&$%sbrs<-xj%V2qx2bw4;FZjlkRg(#ay$O&y_C&mz9@m0< zrRQ<2j;|04KBMVNP^GlE&x=A=oVth>Ru3@5^jKdw(RW6^tc>kP_?aMQfY!V6K(`7} ziN;W<>}Ddq=2EJ(14b_oMeS1&Olc-w5q0*WlWO@hc1!C3>7S6CPhyNxP^v!^LAg$B zD9@IG1beN{q2w*8&V#9Fi>g&Q>iR1z-L1+3zJ*Z>SCX3>33IA1kj{Z_`Nm2R<-42QGzkSQ3(Ntn!d zMq3s>y2zWsB(5X-VDF%6KcF~xd}YA}jFUlksu((QlZb1RNCp*BEE?T`!SdhkYHBlo zk-Jbv6uzRy8~W9YVkybMW^bSsMJrJ(YuCETzoeNQ%t4xx(%;PXGiLA|1>-Lesz!Mv z15?7VYd!G*&(VBVL#-kj=QVgOQW~n+)!|CTEy@zE1qD(c@<-@l+I{okMsFu$TOY_m zu7q|jzOAGZuuFq#Rgt+eF!Bh{Wb-#j> z@bEV`f=Zz@DVmYtGK%rYMH?l2`0-x}wZHkvZmv*&950xEqzG^4)EFR;k7jou)+bzZ zj@#G`Rr4vBseM!~_;lCP~tD%-vRc07fl>J|J^Z_>pDO zmLb~ci$)KPwKcl&ii3a8t-T|HLg-pdp+Tl^epv;UY!4AG>j(A9gd})&QJyn*>gbh_ zorfk`?%Cf!d&P+TS4Ub|;K}iqx`G+j1FbKH+}k^%mHQ{O4hrONt}lq-b3?5A(e4LL z3Cu_-U5n%?3%#&wAY#n^G{hI<6sZ&{3(`-ESu^PdT7PRx?l6w0A2nar_nJgOf|hQ| z)(K~80T&1DzgM^T7Ef8oa4EwSmLgMBkEA5&<)Q!;dxI*pIqcpd8u9}Z&_qwbIo8M& zXqf;>X9PGc*(4j2npUMbMljO+($SOdFB(@ucT(4s}v^p0*hw)g*E&29I3%wI1JKdj$A`ut2>!wp> zF2Wa0up!diZAQDmX^R<+)0}0R6C}pZJJZEFKXH4IPGLOqqe{YYtUlj;%25v8_x;yv zH-;bw=;%}T#U{!~)Z%`s80e^*#1l5gkq%x0YPd;;LF=tz_N`znr=*RxH;yxHa6emm zk2%3&7y}>5Kk{9kAIO3(mrvJ}^$}CJ&>?1^z;;q@?9rZl+!;-00``HA7#f0WI^2{- z_DkfoGeZ-qBsE(YKt`LofCckYkdj;cio;r)j8s*)RJp&MWL&15mns6yI9MN7`7TQ~ z;x&Mt5*8X#OvhB_rwxA?Y3u2eA;}nu-60&r$L$*ez*Hw%9{Bm2Nj0#3#bwSbj28r_ z3ek+iul#DBAB9sb74Kk2#45(*D*ThTFEv`-0^}U^#=fQ03LxkC?iXtld5%7i3duXS z*HPPA1ba{-Vs#MRPF_|s=eEN#oN?W)NByB8=)&#S4_|-#WvTY1tj%LlUf+krD zeE>~~{VL(b^jWNJktjf8FDIuRf^zUM*)H)hJ%A@Y`NwKW;NF^2{C?si zrFDHUlO1xYTkNnqWJ!wubcmIt}H#r-};NqJ)}#v zd2zj*MkCr*lX8}nJ3b$(iHeT4I98tB9Ci9Z*;diTuf~S)=Q#my-MdpTixS&9Uz&Fa zq`kgsb)Aj|#*u<%qe$a8Gs;U>u}jJYxBJMc^mKW<9f&x=#{qxdmrkXv<1#)a-xaGn z2ku_)?R+2Hb0m(VVWnQ!`2;oG-zsosh1UdZq)us?P`0hI3flR1g}fyhJ@o%b{1v47 zwZi}Wp8c_cS)1$$0t;kez}3*ZS-zE?xnu09_80s2JELi$xdjpbvZoX^)vLg_ozT{M z!SRqWh%tGs39Qjcg_LPe9i~b96FLeVw;4z8lK=KAUZE%ONZY-i`VDN3YT~E1Im2)l zi}zq3`CYJxp#-ymp`2-*Z#Z1AX7EWx5}JwzHXX0GE8J09xbYE zLJhtlDamEMb}rdp&3IoZYhCCOzPr{fN3JoPsBPi&*d#)i9&J<4Cl-JUNl*bKc>z}z zZsyEiNV$DadY4En37pxx?`4e+x+j>i#Wj@I9Zk7u_4S4V=+cW?$gz4%XI{4vY`>JN zOCRZ4ujdw(54(@Jl#JJe0<PZdoc;3@$3fEQzyE{8rU%@wg(%sfq0KVE*;WwC z;phyw&q~llZDAn)R<#A6xsT@}h_W`kqFm>FE=lsM@sviY{btS5F>|V8Esdj6S0;+z zIdQg=!*SAAj?C%?Yrn$RJH*9Ekq_cjSKD?dlSfCnglVUKVTSHRE~4hxSAef@v-Zix zlQ0VndLV1z?~}5&s-0McgNZ>89w9Sczf65rk?o542Q_)UU?aA;%2E`ke+3&_hKA%^ zn<&wel98B)g&V(^!tv^41S@6z@7fMo&)Q;2m2}F!aGQB^(?6TMS_fMhp{)mTzJsQy z%tRfg(r<&0Mec{q*tJ$kAU^T#d$TsFgRMVN-aslW*ajZ7F$MEf``$(sE;n;ox&FZ` zZ!Mlag~Bov*Keh0%lag z`FyZV^~O;CTIGPPh5E&IKrR3ZaShlXg`*r9&Q5;lKSc(_0R&wwB%w&YN3KV*-Y9}Mlx#>O zD(#CI=(`i2JC%;M51>WSi5J-jS-7zVs`_zdqcuXeNE)N<^^qEppwUZmCfZQ1=olM` zB<>9sX8uGBK^T9Yo|p2+B(d3FOqfEfiM5-7Fr8#N(riil(H(!DWZ!%IoObmX>1Waz z^;aLaB_5k}(b2@LFGiHb#RF5JH*}E2tPk{#}P^KPQyQB`jX?=8E5URU1R2!Xt( zxsWQOOyKjQd@ghcjZ0!Z4m|vU7Hu=zb}7yoeoHw4BK^JCSS?5*sp;@n5UV%*2DZrY zaeZ@o;OoWoTC3jM^*4Y)Z3|#5cEdTMlG&Nlv9KpI%8vFin9s4HE_3>06 z->b6pKX7E+yb<9dk%oVqlMG>k>Tp)8|L|}Ru#%XWZc&#%6e;9vuGLRD5GHi2Ny<)%>mG&+U8s~l$vz3 zC)y#;4fQa3wj;IiBfh;Bj1L!@^w`=JD3u1Y6$|0LVcsEl!nB3z_|w(QDl;?B9UVM8 zvR0JE3gU=;F!q<;jE2ZPmXwqfSKr$k==scYuE7)rJE>(U6hl0dl{I?t#WvKGAV~YP z$pH|Ki?(^(U^KshezZk(v#U481kInIp=_;8uq;7oh6cLJ_3(;TItXp;>-Nu+n?WZi z_vL?CN4F_0x}S-ztO!A((>W|Yg4|5~4^xcrHBwpMZIJw!-qPsX6R;fHHva(g#djy}sGR z>;}0_V?-knV=hh7mY)mM(VB0P!1U~ms%w41-w8X^q}gEItv^@CXnG&j58JouPhBmfM{2yORB=ZDjIje=Tctg8%Y;~U+_T4JKFl8vXcUOIaHh*-hTp^E^5FfPX1V2nWpn{H!-=0V+G)#t=X! zH`g0eZZ4|!_bf~Ksm|-=c<>XoYQC2NBS~;~5czj%QvMg}NZ*TYqFU(rxe_tzntFVY5U%v5gjfE-6(i+;}fw$u7L5Xfs5R5HHEp#i|nSg*3y#0aBsQnD_(Kn|LqCn^`HD8 zn8^O!2^Du+SLlkwu!tCB&i_^chRFQ-jprMv>pT1W%()5RZfBd=$eG|8gIqmt^^j)W z`Wf*G9z4JVU&AFQ+}}~^>_0_H?p1{P8LVIggMlyV1#hr3aWMaRHN*V*Be~#&` z>%iceV~IUl>Zk`oPz{J!Y@{0HUS&^Aj*64KFsu&SVz_{#qot7#ake6-QF>cMX7&ZD zkWrtd_O)RoEIaZE5c|^LY~+DSLZQ6W-_Y>r!ZEKVVj=diVkYY>|J_nJI^g@eHeaGq zas;vUKf;-MQxRLTiDL^Mhi-h%hjYvGoG|f=`04|;m1b$To0;sRZG%oIlhDUb20-SH zfpoNxt$2vxRk5y;o_j-RulT52%4AJv{pR&Y{6StyyaDWCLHL&4T*cR*WyWBkX%D&^ z*uwk&5;?E6v@$SJN{z(EiN;)iGl$wPzO;qDMUa2L_&aNyX&dKtiego+!b#f)yRF^pruN-jgcgIhm%Z>;|8h1VryQ^>CN)ljJs zwyE~LsBpve*B)^iQlaD>S_d>7I^`vj@D>P@e;j$g$dt~pI3X{a_InLaD4ho?{Mp9Z zHhEgfJi?;yGJ)DRk5IjOTm+Wud{?L^`_LrP7-(a0gWQND|A2rPN~142#PzwlS5)&5 z&8dKJoys4S-$N97lB7&f-z$KKCqhO`BKqk3RxNE;ut$=D!@$L+oDS=sJrk1M+8xa^ z8(<Vst0kJ0BvuO6c;?}fvg;!Nh&mxf)rZ-NUq?Ij2zmH0hB_N>J}A2 zCd&lq6*rRZKn|sba8_Kc4fOvD>WtSYi=-YF2xy8bZdMH( zpN(&(y4r9S>u?ACQ?w|Y;ZNG*v+MkwOvJ84f$-~*YUtjqTLZt5bL3K(J(X)>$V-5= zkgWeE{Z^RyN?4xioM)=O88tzM!$+9v%?Jc6(FP7fRMtxVwBRXGq4Peri<{4P!Rj6` zUXD3=M5|}uwz>o4ZrD+UZjZ=)8&M@+Z#hh zo+*5G0&Os!q%{${sCsk? z6D)A9aDc`1+X(3|mtFoEd_&8^cBZzahjw^OJru~6Rj8&&zvG?%jAp*_D9KcmM zcKuDE`Q~VH8VOvf`8DOAw&h$Ic?X$Wa8CM5g8;(*cJ1@wClI?5M@z9#f+YwASfVAp zj*o?_75F-{1C?5dgcDQy!8xtoY@eNDb*d{v=<475gVB1(;wBTbA++2=;jy{#36NI@K?tjOOS(U~MI!!Y7xAAnJ!00P#z^ z5n6a{%g7yDNUp}U`Og$pbAEGS(Fhd_~^S^#F!J(QB{Kw4*YTl;I~OIc%$|2iY? z2n^TZ(4$;lSkQ*dD8*bTAb9U{B}u)Q;;o6mBxlP|n>1t|z`Q62plugB;Dzjxizz!p zB+B7J#e>bPB2U7S?w?qhkxUIhskwezRtEUMZ;Czd#yMGuJ9c%>Jo7FOnZDb5)5K`(7ad1&{D$}542 zeuXm%+;%2T*@AH;U2o_V-w1TQF&e=7J)vxl9nFw|l;fXXPwR7Ai=ZJQ%c?{HluZNi za6QWU&^iM&o~}F#j4eyt&57A>)pQGzy=my1BT|&&wVLVCG|a~v7eArqkn80MeLH(% zngVDOHeA90Y5^Q2U~x={!3Pw9XR|LqUotq& zfixER;GG`r3AT7s^AK{2@-Z!HtgQ4cMzxXK*!F!{^V%t%LOu0@2fRB{8gs_nGyn{gElI`TY=@OAwZEe!06M6{UVS0>9;QFr3XPBFv zE>c&lT1*0T`$LoL-go*(T*yy4vgkD?ay?C@6@zl<`8;zO<_%7mj^lM(2{@X=|oGFC29W18;&pvKTXYFFQZC&k6)91y{r ze~N!dm06V`(K}B2pO$r+pmmTG4!)*fX^X|MKp3^lKK%%*x~{~aJlJlQ(F<{zBf#B_ z4#{zpso{x;3c1}&D7D}!X@&(Fu-^k)7Q@$DQ}(gF$y8MrUVYailUq5TS@wKfup;L% z*L(eN(N z=Wmi@4|Jpax{{@x?VT2imXi~X7Sv3qu$Klu=D=(xL2Ic(;~tN}QfMY9E)kJ?MZ7P1W;*{G0m=HOqV*Fs~*m2j#4p) zz1)(}uPViEusC$F0F0gM)YX-7wcz(+YV1D@qYiCB{Fb!KyfifnR6b^DCKVry&Q#ol z{CGSI9O22eyAwh(TYj`DSUOa?65Ks7yrUZ+u$g=VZ1`qS$I}8Ua#K$RZOKE< zYVs*44sM>3e>~oqewG=R)N3TA?sE` zh~gHqmUIi>81nGF`bv3k@CzCr-(Tdyz#$Q(=DRrX-^rg9-L`*M*2a46EAnpv*ed7j zjQQioX&l&HzE!MK$EEq9rT0F^=(r zgxr98R)}r(O@sp&>z@dD2cq_1mP~e0!=s$?t0AMFcZaB0M}WNY%4pxI=AhIL8qK*v zQ_c~gXxLg}Jr}G+O)U8x8ezdyL6sbr1pa79sWb>?-BTt5mT*T@W)S?GSO3uhPPed| z4)N2nz*>dA#He_3xBZI;ak2x?akVQN&CeblFgu5mjy+1oZSdHU^{{E0An)VGI3LLT%t^ypWDQiga=G8jaG_#na*8{KgADQGbTrI-4( z1OoY%5LrVQ9RaR>&>mS0m`(((_Xhqq^DFN! zr1wk>11wKNYv|63BE)ce+HCg3i~WE-KQnz&*`m~&pyP&#*S!U&07f%sVE^j8X?dKz z6u2=VfRI{ePwTVmwQn`UTgZl$Tr;99y0Hi46MmtDM{&p0HKsnWKYc8@ z4dA3?+UDo+^ROU*`m}F`rCMi+hJ?{!rqM&m!0}M*2@RP0?7~G%pK|P`;d+K+<+Eb@>)Sd2dwbV5yT%lTvu+6rcg>e>Kd)t{~ z$g4?rltdS5v7zbtp#~8a_2f=gwscz&u_XPmBw)`CtJ(1OKqNIu#;oXAu0bpF2oOj| zOvmh_-ApZlXf83%j3V8tGCWM3G=jUu24=?Bt0}o8js|Gf2ru^Y%E(iZESgPv^;b`h7x6NLP zkfb*yaefG7{mu@4i-pfftky^+{!TIItqOa!O*`E0o1fHciJOVdW<7v$Q&1Twec#Vr znst*EoGS`8f7_G`b$FC68WUA>DB^`UVpE;xe^B8W?WE7@&>WB9({wwLO6{aivDo%l z3$w|9l+zXYtODeX=Kl?h*sf;raCN|$t$v|~_y=(#OPdiKR-9bwwWS?YL%yvA-Ui8u zYA>85pWN8m!nGI^N*q2C_r`1JVciArp?c>+`w(v3l7k6=wnVh`z{qPloP znrM_X!SI`OzRf*68RniJAlLbtzU~3JV)P;SI z&X%&pHKN$tO;<3fG;J~Ga4stlye?0mA5#}nyrvm}r&F>tjqAI)p(k#)!GvED3p*}# zcW*em#p$4G0lp_SZAA??W5-AjN^#JOHHEVaaBHII1o_10&orUFA&Q;IvYg8r+rEHn zt4Tp#9hWS~2E^RU@e#TnD^l1j%^9f7kyMJy2#SPgr@+xZff}-?YNl% zw(B)npFaE!Il;A@>@ukA91Ocz*Zh z|CpA-a8{UEF*d*RgKsiN{fLd3;r>a)&oqxtfqp4D(jNZECuSva z%?8tO`>BSjfVN;uDk4S@q+F{epP}G}&UVW^WSRwlV2;+AyIH!Gb*qu?IEJce#r>vX zZl}2ZW19=g{+5YG5yH%lsVHt*O0U2G@*0RFbE22cHTRoToM|5jv1e=E9rr*9>lUoB&6E_lWU2B- zXDf&RzF|bKD@Z3kX5qQ&xUgq3^%OZzcmd}pTC64Ga1gT4D{k{ma;V z3oYjq5VSU@K2IoQimFZ09$YVlI{LzB; zVdvCaSw3B}p2HMnI~*ou?6g^Uxg)wW8c{6J_{e&GnrTV}@&>ctArA_11h_aij?#Wb zxYs{XEv}plq#_GTlkc&!BR!? zL@rwzJAsdEO#bIH57f^GcvR z42AY0rkb=hT&$Wzof_+Gotw9-dS&FLm|s3XQ{&QENC^?s9^T7#QwU{F4mY zw02OA-^&?z;Vb^JQl`q_;9BB0Z=l|q(J{b<*Oj3=0yec5F2Xjt;VIf}RLFqJ^N95w z^t?jLSn;QQY088<*P9Snl6r^oL2|aC6d`+jh^1aWao_8@(fMeww#Y6lg`!Qu04@b}QI&NZoW9e1`mXep&+x&6SmY?TA zh(`!|QP;Na7DoAC++m?TrEM|C{tKF^?i)XsG#&&r1ATu399Dxcq(307) zNU@MI!?I;s3OxX7Q37`KaepxChu6}4XaU2!d0R(#slnUe^ZL(k`9g@snN4gt9Br`- zp*NlNpJ_#v8_hu!GOdy=HHUPFI+2S;OEJwk?B*oOcqEvZRIQ+FPMGQ0v7T45sr(fR zkg=XJGLaXaYEca2Rvo+Q7Qa+a6o4h=F8PZql{T~j8uYNm zk_sZ21xrP-(d*kjKz8=&3m|0D!Q1nm%5o52{pa$$b7d@ptvcN4eXR=tr%&M~(u;oo z*hahbma~WsOw@x}S}-<|4+q5R-OAgr*E`xkS8D(%gtpBra z{B3aGIasyE#wL_CnJy!wEZy8X1d9Q7&y( zCO->LO8GLSLDK8?n*>v=LU+Q5g-`VPko0gSTUxtil{Xr;OR5P8GW92j8|JcqrgaWbKOJrX-H|Sck`d@YMi++-k#cCX1ka#c z`7zcb(#>u22&epLqmGV5Ae;_UaFg61NwV7(+JThWJayDq=N3g>B9a5`ZP0k??dMzhr zX)PHmr%h6!U1;{zzv&mHjOEqD?eEM;)iYpzpwC@urA)Id8tepl>Y#otlOxT z_|?!bmbz$X69MZ0I!ho7lY3QJt>{?Hs7H4HMk4EhD$|{7iZvMUua&I+W-mrlh=@nY zJ*DFIlY60Ph7{Sy3xjcSsU&x220GZ*{E~<3D$Yd8aAe|T@{rYa%;c0n*m&g2H7L&S z1Si_wt`<O4XbG+CCy*KP-j2$qM84&_(}6G zVcBXv6agz`dt6C|(13&qX@uTPHs26wU8%!3t=O>E5U?om8GBBLwq71P^2?|0nM(S$*$>dU| z4;)kVSWeDR*2gp-stD3y3x@BBa$#mHbQI0~zg$4=$UP9mGQj$a2y@f;Rl(cIqe%7r zhy+$VbY2se@@|K3fo&kescG;z${Uev2(+Icui;NbB|sP-Q{5{fsc)|T;NKc+bj(sw zSVtiT!d%3U&s9e(Q6QNw4Js*A%(5*N8~Bh1#B^eOjX#O zzj`R)5_1V>1k(}A(jtpH-;yXAJKqos6uRvTc8t9tvs^&Z>jTY6hqtSn4pz8CBy#>TZ(+(Y=h_BUe)L) zL26;0R|qb;*1tTtjXp~*k){jhwPcLQu~!UgY4ymLSVuRqH@j9cKL=M*{;cK$vWD~0 z;Q5kPWMQ>!vh_P*1%kH@%>dX_n^IutIyrP&51!fae9>H< zbjdI)@RXHzFlBCYs(ldQ~W?s?-rDC$YrSNBWm&kv8Uqwkx;1TG&pF&A4qX`P$S zr!yU9F#ofKn5tK1E&nxD+6yYP`hCRt<*`inF=Z?4bVtde1o^8VznZ@5vf-`EbGqAK z-F}Us($d)e&Ex1WQk>;;>_=5~&$VqEp-+2XSPNhqL}^YmBrJKB5tK5=JZ&a``C~ao zkoAu@kiZ2Yl zW*Ap{Cl`HjFZkpWS3=eMx8cWgtth%<$BkqUZg@6fg1t6UU3$tloG|p%8|xX3h=mzi z+IW|(&j{nMM1(H*Y7nQU_Xe6aHr!+$lA2I=F&=8W`8RzmNKUQIg-X09RjCMg07qFGLF5^N)3$4im`{@O#k!Cj$@m&) z`hc+#e4$}jgbbwqVb47xd;GwL5XKfNi<|>s+Vb=cK-(_}1!$T->8-^QpGw1Fn%?mrj&N=7I3M82CzU(X`S3w}l&OCNfl z4`2K$zGj&d{dL!2v&Snh{+)f5eTZ*oa~z;rPReLY{wikh?( zmp|^>-n?yxgeOw0|uay^*TzhwAo>s8z9x-VPn zIc>O$I!#wDH9wWF7qm*q$(ZeNZtl|HHW!>kC3!7jSj{3q$+{a-zAmcYdq#E7S?fLh zc&g(Bb-@-9{BHR^E8tvAR15R@5s-gM;yG=Z@G?k}#_f|0KI;E|6_Vg9t?;HL;|~eS zQ;yun#>>HKqbtZ7bXM8(<)UPdE{e-pp8uPf=gBzwv`$9V@}Xxq+Dlny$tGgS6CLXr z9p@aF7YhLjZ&*a4;6f$qaczdX!=T!%#b9@p+stnJeuC!}r9=lwFg9)=Hr*bKvrULR zO0Zn_Z2~vKK_5ZTV^`cb^3m2Uhq@E1Auf&6)=^JAq)fPH%jmtWu;fv?^>Q%Um``U`1FK91zC;1bm)oq2-w(x(+vL5-4io)6#RGNP= zIkR6k2&#Yn;yE(Z@3mZ2JQ@l20IWMqZh=r?txY2?wPCAUy11H*tBqPFiJ zZSrHlgz~u=XlDyU-{QFvf-?Ywj=cg#Jmh#a4SjY(NXi(m8@f;y_7vi1 z!i3b8G$z>UGHyC6@`zzd{3`%cs2nz-I!@b<-$xy%XN?NU9~nM2)dM5{3CBsr-1R2R zTwK|Ip%yBrlF*idwud8Mz=S8CzJVPGPR1?}^73LRg z>FJ-lF7SGeHq-(}0DQ1dqJ?K6L|=-dxx;ck{zL0|eGfAf0iZX|9Es=Dv8TV+?c763 zhT)H!oK#_=+Y(3OqJTHy1fO0F^Zip{+oUVcXxMp4+KI^zTeKsT`n^A$k=PI{mwP#Go8l8e63c; zf!bcHvhD>XV@KmD6|Q%1tb)bxqU~3@oj|8&tZHTm?_pY-DA2F4&2zL-`t7FeOBb)h zMy1BaqelE$GR*u`CGY!dbl#@k(`%L8zcu7i$5!A!n;1cGbhzkK>=zbc1pCgtgjZKq zit;CgxEEVDaJa#S*;z0n^4wDWl__8lu_s zay9Rb+>v>)e5{w!OLH8r`_d9O~F8Q!5Df{y>JSKPO~ zwwr~#*crG)e&u|h35}>fEMC@y$P(8GE3jtKfOokMMbOt7iMt84xS`=Z*KwX-PZ_^5 z?m3NZ;LSVs`2r5*maD4XHJdxe3;@Hst>#`1^>)OyO&0XKBPRYk=5cLQ?=dG?}q{K{%=el**>ZyP?O zEzPpShGT=>MbralVDcj;e(Da&Z{R{<(j?x|bV%R4$pgf1fYt}2&P12+h+zzBef5oo zOy<345;0E;9<}eqVh2QaNigA)_yw&Qw>ffd&x}EcwA|qe{Rq(_B+AYkl)gdf zO$&Eawu~iAB{4A^Qiq5#Udp|W(VFe=RsmMNf~$-WFCaMcufyJIINSy#7nlZ+Fsyt# zw=jS{ugn@5k2+QB0nJ`e4er3{w<4Z0)5Qow{tz9%iIez6wDD|_T@?eOvcm03-c2(> zf_Z}#z}=#d^-z*MRWG=*^{7u;+l)CcZK<|WlI_Rouz)$Dln|;vS}mcy4UzZPnj;3s zjiJUHxLiYO7N;M4e?$f=FyS;N`gRxSD5Vg#f5sM?t9Xf%dZDfZ;cy0%EW8Qtzq+O7 zX)f?u$GgUSk+|Ri0;f+xk5j;|3NOQQ5Who?Gy(tk{t2bmKcbs;C!>BAhMiC%=8?`P zKx}#cMARR1D4X5?*je8RX!4+?D6kk>+PQDII@ax7K^aufW%IUD zHjcEDrn>EtX5X^1Kfv!W97tR3{jq3j-NalEFqZ{ZybjfI00FtL*r~nXS+m{l$0a;7 zAc)+^it5zKn{wWU`)7eT-EWhbOXAloxmo(l>Cdl(lcdO4RWC6i33H)fOn>;C~gP5Rg$V>wTxsc?HH`n(3(U0!PUN#n^` zS`$IYPRjAOiGd3pZu963ZhZe3qpMFen1{b+XL~FYV61QODv-T&G`Cv4pk^; zl_&5c6=>o`YPVZ0R$bRe0%)(JU&Hs(Y3#t9%aEzZeWw zpbjnWlt^{;;M{)!Tm2dj|0t2Qn>xRUW^nV|ZyIEx^7`Jsw`)yWNl!D`K`cCy&ATp& z7fIPUi_CPYHsv}yRj$|j{E~FWWuRh#LLQu&&4$YzYkXqfOl#8P5*Fu}H`)Lww#rzy5#bnl=f z+0f8RU3|~Lo?Z?f>7OVgY*?g36Jryyqx7^m=jWZ@o$R*hP39)DpXNW&OOYi;V5?vT z*nKnXr5-bi4Md5b$Bpzr&HG`(@DJ6fW8C`t-&ho)#T9K>_9z4J!NVEm;pq^Z+wKg^Ut zkWz2%pZ%;&4O5)4vZ#s8gdvVO3m=k|s9|g6sCXX{qCCiH63<=YvOKo(^hz0V%*I@k z*61}(7z6!?*gHVerY}h>sgj;WNK&4940cy0O#{~IRoOmRbgk!Hv3M@tDyUawUibL# zpJSy}k!NKwV;hCBwJxd^0}u65_BEZ)S8kODcJa_C2uDv3NbRq_=fj~h*>*b+SOJ_7 zwe#F^GQYe2q;pySHXIED6luaVf4iy`BYwWaO0f&u+J5PwP@vPGY8HADI(C$df3X?z zQ_CAZ#M(ahH}>15aNbKjfKNgS5E)wYB(`+gRPD*Mz*%;T+&P_zF88cY|u?byY;6 z0D0E)f4Buylh*K@^>^=kDIlr%z1ByDSb~fh)TNf)fM+2itG@p1QyX(KZiwQ6Q6xR5G z_XVOt0Gb&0)BmF5c4rwItQZ|r^zIG=FV(KfbQ@CiDz;bYJ${@wo2xjS2W-Z9Ax-5^ zs*iq2=XiPEj1Oi|v%7PD9{pcmfZ5G_GI4ja26#&GaU=bjPxjp&`h(YGha|QPTw);{ z4+re%549~J@p=JRyohN{2hH!ZO-EJH6L>he2MOUrKSW{&LNtG+)|y2JBGXG42gDe( z5~Y5Ck34rX&5syrAE=)}mW2r%?4<*94N1D_|9C{J`ACS?yA~c0>x4*Tg~6XtXndF+ zwKE6^7YYt@ocM@6sB&3CLmBNc`;nl?MAxAcG-Q&p?YXmB^Hjq5$-lM>wAasC9dPS{ z1#(Ej@_TJK%g#Oy7;NdWwo)s4yd)cFKRfq#-nk=<_cEVlpZ2lZ`UdLy zMQ38`6B!GlmY$Xi-D3J83`=^!8wL}#RH2N$psy(r0$e%r_i!kwXWh734Bxag<8V?% z2B+q=jb3GcSkGAUuL-E{F>@>&(EX+qI7K#f+j|kt?BlRMlbHTK7bYd>V>r|T%Fb5v zU=21Y?w;pWTkmRoMxW(x>&ypGLIU28e11=V1a5K%c+zrth*qo%T^vnPF1%SZP<;)n>uv~2h92caw;0EB0UYPM_bpXez{A+LJc^cf zp!Pba6dI>vi)bD@YU$1ha4}ZSV>Fi3I;~N0eYsJlWE6~ek)P&Z5u}Zdh+#|o$8&dd z^pAJx`>|Q(n!v2`_TjRq(8~&_K=XcTY6=i(mz-iY7x((I0B!?wllB!Z>{?vvG3!-9 z2L1Y5|1+*M`LR3fKISSli=2D7+iSab%hAdtTMHIV>98YboK$dm=%e;1X;fk8q`8lJ zIRtZqk6AxNmh$+dvVw0zU&i7 z^8`eMdfDQYYd(fWa}+6w!s19aRMyfY#~V@(i+_;ZPr`|&8np-F`cgeR3ibyji8;$q zCTQf@#>ge4$$q?6(O-+ZcT%sd|HeVCk+)yKo+lhNrnnGVaq;7qtVB7L(ywe3Nysgr z{Tg$o`@Izn@=*24`$yepmzc(=z|UfM83jd_8URY?gi914;;u&yV zIa>6A?ZbivOqZ;WXn@y{?s#7g&kU9Q+f=3m?wSO6& zUaZD@DFF5;_i$(Nza?0CxjFR$J3mqqqlw_4s{y?ZJu;E$f?ji`PDmao&_4Yrk+cu0hMh}?v3Z3N!f9 zxLP@-B`V)%5)9HJ_ah-$yGoxbDqtPE89CB0pzt~5cA(5owzE2y=&qb^en{cJN*;hd z7Cf?aDSYoxGt0X{?Z9R^oOE~X)(Y);|5lL?Mw8vyK42P;->{YH%zFRvD4CHmfh2JB z&pg~yy5{!m$U9xEw?XObmA2L|kBkp2muJ`S&u`rO)50Q_MnnG&!{jO!a;ztd4qJbv zYDRL6>`6yZp-K2l21vxHUESUj#dQZaAsCUt__BH6%}N?NRNbLqw4GtRDz4Xj!y5-3 zxEXrmM4?2?xS(ktrPcW0`bkB`AmQ5XiwM93r6LtGg3i zyjL&jcgydM#aqw0Zr8Ut<0+f)JOx8kQ84tY%HLXMeoU^E3QXQPw}f%&llWijjg&{^ z=*>~JMKlTI;T8<*?lrzNjPLfj2H?~aD@}n9T;#K&jbC)L)V>B;b0y&>CTR57P_a(_ zjnGEE!^!!2rp7jMytfgTt`#c?Z8_q@(Q(H@FwBRkP9jCr&e1T=CJtJbDw{X-_i*p6 z`Hjvw`r38paL6-Ud%xXi^RoOPT;`%gAnfk|p3k6G^0PABAa;3zv2N|`hO83bZ1fyi z%OU=_|GT}kYIgg$h+Qw*W|&$E)BJwp1)*!3D$|({|5Fp~j+gd}IzG7_BYva29XOZd z?{+_Z+ao*%n%-(Z_Ur3!hi_O#4fT*DSPsNo`a9nXFLYV)kx1JEAOv$)paeKmFa zi+XW8>ipeer?C3H#{8)#$zr>~>#PHGL%0po$U1FnYKk(+wP>EBo2?EwSBu}$&?BqA z$26gdi66mC+f?ow4M43knd;b|JAT49#1oM0Y=8V}ZE1QxZ9wW}0dmbt zU2Wm7QeqzCd2re@V?1-fStoQU`)Ch&k@NQkYRzNjI-Q)ALoQ2HbJ9B=(m~C)$4xrv z@*?jgi%D0xZ-dmJ@}bA&=xyv$4Q9QA;<$F`&40LD^owM}J#ku{p}O zbZb>B!(V6kk8`lwqQbIS^Nl3%99y0_DHLF6R}Qa7y8K|>MBx|@8_|7+5R*j2vnZOpa~;(- z#2{?j7|HG3w!L#0F8?U*i_#rv6)x~qk1YSCSdQHjiLTeE>_OR{FsY(wuSlL2BcW8+YH7lzpX@JeK3XQWUi=y(sEMkhdi0gBOfGGfddyA{`(vYB% ze!j<&#!$AhFRiBP;}b3`pYff>l>qeH)m%)$+EmnngK49Ak1(_Ixa_X*pwvyZ$Cdj> z-bmVuGUAQbDHDJJXs#|b)z3O!SeM)}W*PE!B`w-MUinz;Q#!ZcfB7D2wO@8fBw|2TlUc~`&;v{I` ze%Ll%^*lP!4Op(K$9mmmiGQ2L_t><~c}3pN2Db}f6_~%ZP5a6xH9*DXPkgO#nXIDM zRpU0^im&ZJ{|5WF)=a+#=|_39GpFl!$h4oJQwhLluZ6pLtKn+GMqSw5d9=qFXlm+7 z#Pb1F7P__g{9fM-aSg(;%y(;$$ECEe`4raF^b#A};xwPue8Fbk?sO!bzo^TphA<3< zN!*3&6c{$gmYr(v@J;`!Fx=UoGv>LOk}u}{L~W;_{QeDno$!GVKs*?OjsuM+laS~` zj&8yfb~1O==c=GCSHD_^ybjP>n8(!|`hTBmZr+`1U1)FY4Y);Aj0a)_`Dp(%_^5+q z%7S6vCmy!&kyqi0n%~F-Z6uGXVA!=PnEso!6A=^MOG;qwQjMCexlxfr^dpxDbHK$n zY=MKO>>3gzN#2@o6>~!L1Flhjp54su13#zDxqWT_YWLW!Lj``|fz4$aa;*6&?+n1h zRS&^v=KlO)?l=Q=_Cp26)Vhdm`sHvT#hP{%w=+3OhwQ*EV$+c~gJnPn#mI`^3349a z%!E1fWOAM2tRg9F9Y)?pQ*?g?mQv$UZV8DHvuVw_-W3`M)V`ireI4_ z&LiHa5=$0wJI_^E@G$iJrdUuL;gq4z{&_~9d`;dfR%DRTbXE)#j{P}P;V+8aU90=% zr($VbMJp4%1|emJAU*O4>!2%y0n=eVX*1eAJ!o_zgr10vjy)mtKqZjwi(z703{63P zG$x~PVLchm9S#Y)doEQ^keoesIf`&h9GS4pWQ-*oI|^6zc|CwTMTe+qdFOZnTSs+Z ziDN^N6)%ZcYBiLqncI?B`PXNpGKn@T8yhiGMn3g}HyF0H47=?gl0R`G;tI0{jK{I% z&sPY9n$J`4r8;FXNM!?0RK}Jl33Y~Ml1et{#OxGS$bW+-t`LNY*OAq6nub`~%xcyc z@?l02G;Rr-7M87-R0D?{7f&x>m`D$uBM@ zdR-#tg)G}xYZlg_pVPi%iXAyifyGP{wq-$~e-h9*7gmgY9Q!kCZYOI6?YHauLnctF zj8`66j68Bav?^x;^zey4MpV+97=+mf=}eA9c>3}Fw&dY~5{!?Y=xhy0*y_2hU{EIy z>fp(?8oZukW33&3nm)tPw)_5{dFqV-U-Iewu|%<^`WKiN`|x+L_gDP{47--z36n*Z zZ-^gY(*}&;#pF*j*q*Im;rzj0>kb!Iv_X%!wuCxU@|sS+um|(>Ds&nnJh zCU}d~LYe)>Ok+-pg`~#m)#B{mJ;7I45n4v%<4P z-kqbhB4@vjh}Wk+PaTxGKiV2<{0(JBAThVr*V4j<>r5_k#O6ycWr|~>=FIN&Cc@l2hrhe8f`52@@uxs#oPG7-!O zZuZV?cT0ph_!>@+&npfpj+=>yt_&yaj*-8uY0GRsb`s6c*YAfwt(oGq8N`Fc=Fo_Y z!1SR!$d0|*MlIRcODEQSIpG+~wmX($=ZTwx<9R47AvQB61HqlQ1KeW&e@jMAS?4zq zF+~r|+6O~FqT}nh76G(5`ntWQ0U-iSa2O}L>$yAHVSY7CEYw|k;5?K#q)==c!jQwA ze`?ZSPc=CoK@2lc#Ok&tbV^=>lJq}L*^m2sa`vyeDYqv+U3RSYvkzsv~IlFlh^`jdent@0}KCm+9t( z=T#MgHHYZ%_Zlvfq)+E~GUIbTWC_Q}rL4;$^6SRjGaW<`PsSKW z#KP@H{JqQRj=hARy~)}ha<%#8y5U?uu2>~M2@P$piVVC3!117!P&HeuuG|nup@wL7K#X`_NhK)YtR0of4n>+ep*xkNi)j-e+`)9b5_Oe zHLWblr=b1Bm|-b{Ne?w9WjJp*Q%@Sa0E}1CR9Bkl#@@07uyw`Gq9VJ0(ka5#TG<0` z;bVCiBPZM=kqxvQ6wIWCsMwCW|2umweR7oT}6ZWa==ft?8mwDv*2w-_AsbSZBY+T$Ctv|&Y&hwRF zO>$h?#%8ji@gAOk?i(?6BYXQH-Z2}X5*3<|Z_pr)t?VU;hojdCRyLbCuu{R2eRF(E>kF0AqpV!8*3Y(h_TTJ2`@-$duofe*FJGY$!#U2@f_S^$^9~>38}TwJ{tW z5&#@cRjVo;Or-#|5;GTjlt%p4$x1uTrkWRw?wz+Ksq#asF}5H;@S=7lQyge9wN38? z+V_Q(t~e7}5Rlr)-v+k_BuJy zIi{%b9~lO&P{M@)Y`-f~Q@6_MiI{@3mete`@c!eXjYXmKWii8;ciep;r+IT~s!r~) z7rwIkn6aZ1aS@1^wxqGDp&WvTe@?dFLFI@gZU5Y;A68OM-vCe z9N$_T+=9}aasW$rLRvY&PeHvqr4U!l)TeKQPy0h9x=di=db_Vwy|dYy;zh)v?uYNUx980ap9BD!N2Yp7@82_Ax;FqZ8aVKg1P;$Dr4NvB}`U%u0f zl+M0dLLb=?03m}SET4{vp2~?iEz{eR;~6N^JG6B@p`Q<~_EPZ?pV0HZBo71;{D3y3 z6uB{>dN0B)9xE_c9o1SUWY14hhil3xW4(EFwZFEpxqF`p6m@Mj9~C= zAoVh>ePNQP`lb-0FT#I;Fj(_1$OI6Ec=poTE7Eq-YL`g%dq&+54>|U;6-K&c2;SvJfGE@h!c_gNA^^XjWm#_u(Y5 zgk_Y0bOUos8+*S^Zs}x$h!NlZO0eC&Ipab37)}Z$4<#dBejyKZhQRE!{ihrXqM|H` zZRxyPTlkR$nrO{1awXT`|GWimi9D})KQN~)MGO!VC^5~%FC-`jJSe^xp^o@jm`WKf zl93ZYX^(c6{X=*DCN#Dhc7Gop_@=%V#OISD%3q^kn-1YqkoT|)^z@;P@R52HOVwfH zi$#nnibq(<;pcTSN?gbM2+_b!E`i>Fb}L*QTnDc|?4Vw*)3DwIOr8|Dw!>7Fl$_4v zjq1n#YSmN7+J^A7K3aF#UElKY6+iHtwWnII6h+Xbw4?1|LKrA?|7j(I`u(rLw^Ilx z%Rp|*LoP2u*iW?S^wK?kbf^uEA`q3Wv?O^N3}j}+DZbIf(soZgsi{l0ya+Q6)HCgw zTsY}8y8dqx9NVN31R<(d>L$4-nbdobu)pU#INAyE@+T(m9ImmdG;wJQ_NMEGuEv;K z&jUH)e}mx2bRKIT>6?C8eLi%JGz2nq_o#ozXu5Dxa?Un1KFZi}s*D-^D=_%)C16oN zk_&e}W3*vmu$d9VsGDm^RrsU!*-F_)b$$Y2KTHAP$3w9&{IcFFqGodN5|-;%XiiNv zFz@H&K$_-iFv4$1fljCB$^Otkd4t9P&u(a{z*cSr1y0iWY|*REK;e zcobLG`NA^-fFf(8_$m3ATI{%ClNGFD)|4s15n-;zHV3!tlO5OSoFaFXflYp5%A!BP z^Z%ivG|QJrUTNA0*~!;IQ&tgd73`r+N7WX>GHd0A3rk4L4$yNWjc|Q{iK*q!9}?^& zQq17wO|O3Qjh`X-WaU$K3R-G4RLW5$pOh)WLcPb7DUCc(-tFbIHYE!;*aY8(h9*S; zZjPIvgx=3JN^BQuVc*4)*In?XnqBIc?X!QOE9xBifKwYtou<>fJ1pGP$INO>q@y>} znJ<4d2G8{FbC@+J5s0=w7i{h<=W*4W9Z^q<07jAj>G+Y43tMnxV?05-;ms;LecEf@ zO4qR4!_OL7)X)!~@_st2QXDW_Z1poG5Jha1Fz8Tvh-XseA-pS*+ufvHG`iTHr)k0@ zrsX?`sdFvT5xAx+00#Jq+!!?ZVi1;j@eBMBztVl9_$wht+IB!PjNywa+)g=F(`VYY zaNubR$tTuUi{88Q5A9;^`LR}-tK}KtiACEr#a|h};N6ON@ zf{0!(*+H-B@5sp1I{si-q1Xgb1c|cmm!aO885yRK2NMPxe3VEI?0;S{OS;+aEdq$% zNho&PMzZi$^6C#yh+FK?##Wv~+sT`#h}^r58U$3`q@N$jT9=(+@`--bK1i@Rprd%C zZNhf<%4|0b6&O5Y;$BpwMvNPstA)JwNAOS)<9-*VbQBXs`Vw@y4E6`iykD2TYg{6J zoHj6kl)rxFK@$sPPdDyU;_wr_S$@sE$%dt>4&u9wV4-ehwqy4BmFe_#*D5lY#$0TO zJ79%~kQi~sM7tQ;yD-${Hhk08>wW_hW0~LYN5(#f9J5Z6pnT4*I09#KH|J^DUo^?u z&C_u8fr!Ms4*g=b@v1739;P^~;4Ea$LWM=hreRZt2e!VE#5;?fT6-8iI?z+rdOwgN zAdMkXxyPMrfsSdRhJ>NHMBmTs1UjmDhVY1=@lMf7t2WhECNU`Q-B7z+`7I@L=5&~z z)4ht=1ueQB9XXE%>8 zZ0t;Hy-FAtwO*8HTZcKfb~W z6(t~>8MEi`#mkTn-pew@N%+y3_o9=&IA#BZ#T@$(BTY!H9Kw$gomeWR1s6ko5&6yi zb_V15Qz$zNv^l1fvW;k{ov+FC-+YL`()W>2Ok>#`lrY@A;*7|z3n-|or(2Vo%v-a`h%oy6=JI*O){?$@ zTV&jX%r&4^F_~+k*HC83ik6{*`ff5adBAUrlcEN^4Z8}11r+H{lBmvW=8hz8vj3|E zP~g&zD3@UneoHJ*Ow6Y1bJjZ6L?2ZayrRADgkKU|{=D-NVC`sm-?q#PzUU4!FfeeC zqo>SSGNCj!YLepo4qarWl}UtM@9CkcU9zh9BA$^l2$ZFCEV8=c8L4YOYvR6XBp7u& zGF)@CBC(|R4TYcgJT7;uH-buCj;_4!CT|`PDJ-$6mmGRqdN`^fS=2+4|9o+Vb?fFb z+i45=-Kq79u9~M+m8!lb-zchS1jT**VW(=I(`vZ=XZqameWTj{QhpmnU1|lvfVIsRlxjV%tqY*9G&eupd~O>-~uL(29vFMh*sb7bX&})!@R!_Mm52 zMpq0ycm*9=yz$k|r)Es*nz=|gFWxSKez2y*;CGr1)4O>ZPBgRho?bdMSB;Ky`}c)r z=U(?o2#@Nwm^d7~A{>28?yZAD^pX(B%^5WoEF zSL|!I>v^pQR3*Ra)z%I7y`@!R1+Dy&J??CqL<9O>)DN?CKTZ*rQ&_xj?oTrbIAPJ$ zHcnTs0Jb+7e--3Kv-&~IpWleX7oTfXA;#6~4z0~0SR3B=71eK>{~o_=`wyi%jtiSP zL_x3Nmd$tBX!w)KO7m0I`p!ktw!!{)CCJ8B^VVba;h>;HCCd^&dU%eLxz{ahNFZqM zANQAS1HF!WKgQt*A76&g0Xg2TOFAsWc$=37HZLRJ6t+VUMf~Rg z=LTDVH7mg86W9zt>%oFo=x(I1f2L`|CFn05ukMrR$zOO(k>`MTKOKuU;hW}gGRK?G zuN1B~@5qah4AiJL-S-JN|JhL~bioe^{$+_HOMd4A@KbHL>bfH5JKv|g{!%>`I%I3A zmz-yLg0&fk-yJ9n^n^Si!H_dp@J8UZPXVaD%vBQR(lugC0(H6KX~cEH9?WD+f=4xs%GQ4W6gmXcq{}yWWO*MFsW)zMC(!d_r9E zd;MZ|i2VK(@O`Tt@|p9Ab^SBklIM;f1*<;;BlK6019g!FwI%EnQgg_gNP$b_P!i^v z2IJ|x?o>#n6+YgIFa|2-y=}b z*eH{DB}_5?<0F%@BB#7Kx&(mO)0~t?+oJSAWa#ECtASNT{=};-R`>p$T`$Mge|k2= zU0Spcn9wou8P?~PWFUHSId?W+wNrAuo)J~6YK@MmMez4ZLsR?k1=4)(Y0E>+wv}C; zI$xd&tHje>ei=08-pR}~Zwp(D?%Hd)-Q%>Bbv*q+ClCcp+O8aDQ8f6N?E`XkImQQa zHF7ReXF}47Sz4T}+)i_-pIQ%Pm1tvv1uaor_lOapgzeOa}sQU<7UXq%p*@+Rh+qpInA{%r$d`8K#s~qul zy?f_B^B?krtJb?b1s?>1uD$1+O`azG60U8u)joT_USv@pUMWT8R*tNjk0T#Xyl>GS zwwtir7AW%b-v?h5mlIUH9aQfm=N8I!HM1_i9p#M_c_OuoeyBo5!nK|WmJk~IX9;bo zarRHs>ItIxJ>u%vn;;N_7q8S75Ic0z2ZOM_^-}VS8$mjstjGn^VyZi$yBve12bO0D zzrO)9l39-F3|??6*imL?#z{XC=g_)TQKXhl(e)uY-X$NSSsC%9bw%H?8rQADQN>zy<{^Y-cDxmcJZiToI2g-TB=-W``W#l+gb=5&7BMtZx47q)=T19X z<}`%G28dtpLhE4R=N{si%~Zlb|3H|5xPZ*zPc+(BGiT$Lh>7zVSJh+-X#n-hNQX43 z64lukv4=K-RsdVS)jF0`ATj|Nkac+D+3}B}vxu(Ki?eU%#@+KZ#ChRTEpD`53MV6w#Jf#qltC*(7b2rnkB=k0;Cap$TzVPQ*u@k%-p5uA) zkCr89I_svgu?^sOY|-Vvu#YADJdiiP6XhanF!O4$EbKI!P;+e6Ec&p6c&&QVV*mj% z(io_zd!FxAFIIr)7S-fj(&u+u*1&$2j z1dsj3b_359pF7%0tPdh3r8fn-tqXuk(~yp~wwQCug1&nF-n|Uz)AP9&#QES7E2aDW{Ey?(?KTKY6s_dolveDbd`x)ND?ClX3lR+r zQ};ccjg4D!g3-c;foJHDdtQXkBj^vwr%yh<{h5%Lv7K@UjMQj<4Gv=>db$$l4^ zftCN*U4&-)0y9YTFCc4$y#6QU?z8J2bHw$VM9XQ*Hz`N&XlnC>&?rK&$O9b2A-~5Xl9Fa zsYSr1zd3If5W|;G5yIO~ydlfouJ;!<7o^CK9L_Rar2~oDwbYiayO!$=s3Uek7l0`X ziz3u2_lmPOyv}aUlsh+gZC z>0UCO=tK8T@_VD{Oos!>QSh_N?#73up%g1g$x43lZ%>^{SHz}3)A3~bc5&%Ygb8O& z2`nG-PwYFhLeAtqc*;;xJfC{Q)M(=sk3Hj&ybt&wO)>9fWPn9tC2~e~Jr)GnVs^Tb%K5S4Wa-&p!J4%;GAE z-ad1RdO-&$7LhkrioYp;*UNLx`2yJ7w87>u7q#2^%?9?EwpxHqwdVCW_2Rq>j~>|9 zEw2exe-BG)@VnY{@E2r5pf96RcTv~L*Dh%<>|IIU*`{B54QI9t-pqEt$z@kzlTv%B z_EG1x6cIRW>=L_CkgH%~M3;3^!hIj6UqKq8O8lZ;)tzR?n%@jJ-+O@90n-LI7P#kv zTaaUa0qj&gC&|@|+{aS@7I@)!H|`pEE>$KR9krfh{)y9WaK7A5JwZ7xwdyroFuv;q zJ={7)9#pStvFT-V$n3sdUC}W%ZoHG*<-A@Y$KsirqIVrhOX0N+q>!+%!SXpY=6h`L zjz$EDI8Nl0kMr~G4d70TUcT6L`ED*(uk;HUr{Y3DO0-LMpFqRXps7iLmw~RkGZyJL zpcUJ>zm3nc@_dd~>)KE4$GuMOt-}F`?*XR=lis=8y=d19mIpbw8}h68z7rB3?_++* zK;<&dvnxDeS;ZK)>eue%u!$-!Y~wNYtAzg)fc<&X4a<{D z0hgq$XAz}51|o*4Fi*n8Act)kxi0O_P~}9Y*y#_e^Q-F zp6|%fqRJYXeIq5%zLm5s)HS;?JWm|$KbfMf$CG=lbs-28?8u6p`4C)MVGU-p+)JA> z|GA3Q+zv3mr_o_z=Mj^L@nIsP4aTe9;B`5UlnCtPAg53jgH=~@CZAT}1H`LR`%+YVvcsFs-UfHNDdqydO_ub8PBaRzi}s&6>-L#w02GVw_RyJQR{QcxK=< zwb4JV3%a0=Rk&{7L4FuXoEu1K5fyn*yL(c|RIwYMvTX+Bk%$bE^p<$+LTi7RW6RqE zj43?C#BjDtu2guMB6mc`(61kD{%VQkoQNot=(fOH!3;hAkoF*>;d-44 zOLJLo2ve9t?lTy&QK7&~NFDsa{W~OwPQ2#;Kb0IN9*klS;K|he>ibI zDb5M=T`U*{vbvWoi+&Bzu&Z7KQ5+$oAlbJ>EF@`~)e%Or;8&PI5400R z3dek-@H;kT9N=@xUPtrmH{wyxu&_-|l$M3dY*%-dJk6=?x86 zkG&E$t5e~*wP@~q^0Qa#7HGk;9eH16G$;27-5;7Q7k{L`cuksC6h5eToW;GaUl6%j zM$YmrF6BC>D|Zqbrugzbk4=o(@UEd#xc!g*;Flz}bT>hXQh5yLA6ne5f z6i@!z)Qr*D*5y4qxRP-L|IZx97kx-;I~9~i(a6su0kb%SlEUo0Zn1(_emV8DcvDj* zY91pjEW94e*hH!mLw-Iic&654a+4#`>ZJBFkG;9E>3%eVmi>YDQW0;LibyzR5O01A z6t}C88OCd`l8IEBq_R{S;AW?9MTf+u%FOXQM03?eSxUL75Gu2B8t*0+5>90izYR3~ zQWtqyfMNzjacBh|)Bv;|k4jp8_ZM33yLc>t`T;z6f6$wJVvkcqxy{tAjr1!Ya)kC* zEksLhEiN8GCM+Pw*mgn+e5Nf9v!X4h0Ov@3TAGWcuozbxLJ>huXRjxXOvRZP>%>UPE~dXWVk*r z3>~;m4iH@);KR_-hIU{aA_PbBVuMT94ZOG7?fK8PbNOQw^mFxD zAi>vYQPyy1CrL}af`o3%AfW`5YXA!%Th)+zn?cVlahH+pc<2Df^WOytIGaCOA0cW` z0D73q$MkaUs@0~e1N+@8wLf_p;a_;klRqyKGS*EDo&nX$m+-WCrs|EueF{3ab=& zV2*DsV$5Y$BKAHiOm)!_d|1IlvJ=4j@-c~HJ(1u`}p10UF;sf-^d$VzZ{Lj+@x3jIz3%yXABRXs01X0kO6qXCGg-(iEV$Ui&e zz!j1_CCVE6LRrZ`k^I01;+1FA!@NTU_E~i9)v=&{`P8Gb}b=UeOKCFJqYo`}|OXE88t$zzTsWq!1UqjBp z*Sp~FC@YswEb?(;)YXLQLY$8ybAc5Pjm5t2VGceGSpC@BoG7Il;(}ejmD{_x%-^2( zJiMX37#Sp==;3stG2~pOdTV!MntclzW_P1k0Mz({0z2G+){T!&OY5o^(q=)UNUDTAwRl=Ur$* z4NHNi01=HU0T$m%{I*%`@WSKA*RxW z)2pkOl#vT(^=GINEq+AV(owYjV))C%25}-w>u<;%qo6N`=V=i1je?MT=%h3*tn($x zq2uT7yMwM%^c163+m2~V8Co_JBmRgbc(jr!3f0iuq*L|Zf#dNaM{LZp>-22Qz?|pR zx=DYZ+CH0d9?{p^%@e@&K$rg8k=An6qUR|$p{VfdO8++!dJ-c+Uvw1VRic(fiKMEzhZw(mX4!$&>h&I4Pi>;#W&)=CE%`%`=dOS zYet)QUti_Y*Dlx6t`coI|Kz466;4jS9s^#8W^|2aITF}_+BXW;5(2h4Ku1tx&JcXgq8DCmJ70{^dp{=k{?YI z-qqPSMXttS(mOsfoV*cex2&t<{}*k^2P#)Qa9WVLJlsW3gVlY@ez!q#WpB1rm4c(Y zij<7O%j2vXxuRBK`(F>)N&;<^_$+(D)HzNM6^De`ub1zj@G@+lYxa6|U7xAuC2Q}i zZjiCtFSmn4>>8&|DR=!!*^d85)H{Y(7Oh*iE4FRBV%ttCuGnV9cEz@B+qP}ntT+|k zwa@wXJ@Z-r*N=%YXCH5GZIbBw#j-W~Ngc_exEzUs``O2Cu%fEtUBD~Fi_XQ(?)!rq z$$}6`$89=W5?CIivmfZkkiO-=INO}%I|VV+XVi7O!SKrZXvNC%KC)f)?$qz!!1^_~ zwC#Dx^Rn$kwciDrQaWr;-@#k^x*`-!#CKZ7Ywq(Gc{4v@^Y-JgaPQ!uhc&K+{g6K@ z3Yz1JS>reI;aZNv@6B@aDePZV*47hWRcTbxo)}}^J01nf$WODEVmqf%^MXYY^EOapow#ysMKd;#cP^U9jxL0 zr(sgG_V?Q3gG;9G^Tb}q>SqtkdHm3p^*`bumYi{?W&M}ZK_)qEJKdIgELStV*DIvw zjQ4;Gmy{0Gb<$%&D*7J06GFS1w-+7dVo&qaK)C0(ifQh2kMZr(w#~{zkyP;9?$^Ea zQ}1&yqP2&>lM%X#lfH7V8%^6_)!L>hxs^F@d?bG+lzERttyWLDV%CH zsyjHGR+1dU-`lqhWGC%l)bj5MmLusY275ca6+Smsd*FIJX9QBsh;(U3q~r4HCPL<# z1=ze?Z_-tNoBKUwtaI+#5uyKWOz*O7dGs-wN%Z20oy$TM|IL3M;go{!3lh~4hgGOm z9Fkn%;X09CjE|X-Df5lIlL!wTr|TE;8EZne0~Hnr9&?20Lmr5=IU-3!(HI_o)}Sh< zQ#`Zy4)iqrbfB%O%fjr!xEQ|APNhnu;cpPoJtfa-`M>SXps%ajP~ zHHWn_N?R&Lhe{n+N_B;H3mrP#L*=LQYWoNC=V#vX_m5#)PH*ppcgC)R6`z>x@7qZ@ zuWXl>f(!ASH;u&Et3&IXPpsCRzjwO3e*4wt1a4EE7l!}NYClZ&=2mlSQ zYsr|lA^}y?+Sy%~LCH(NYZ3o1{Ki|5kQ3mi%xUcEKQbRGy?d-tqUu^Ar}e{c>s1*& zG=;9Ct62Q*-OkI%RKc%1T5e#(Ai?<6)+2?!L{qcKN`#HMAUT?(WL8do&o!V!yNs*= z8EWg_Xou?2`=b+MULqjiRe%Y~PwdAkruOP7HS-kqMp{1P${_L;H`=)3VkKZ21S2{N z?&{oZ5VC$ZZBzWfs@wsTX?E8Py{;e4}=)Kvdh<=~!SAL!3Y2LPXy&ay(=1^OI{Tpcf`Vf8ZE$y+tBO}T*IZ`vY?+PDu zCWBgzo~po2f8|8ded2`5R5vThc71?;W{I1exYvgEbvs~SA)p>Z_%#@MUbV|Gq}|AM0{DBF9t&V zZU+uC`#Jt!C^l8Sxp?1$KG)4bIhLT3-B2G^&D&SMq@UqEnx9YqsRGxHzvxBI439FJ z#j(FOS|AJF?LN)eKnxZ-QLNIwhd9z@VvOmPD?PF~C zZ{?F{cw%l`Y)NuU?a#&K^RD0 zdH{=fnco6^sD=l;u(C7yCROkwF(6%|$RUR`^m-+nB;Ll5X{&}=F+A1B2+XOAI#VLv zl0Iw40lv#^EezxUPY(1?UOqiPA($p#YkW`k2+oX9S-L+A{dBjae7i2&f~YA~iWQp{ zh6Z?Zvk1_xuo$wkL1|fE`QI#H4Yxn1YYs_B(zkC3qeX%ZZNoxjq(^H*t1Mdk2+G}Q zV3PZHVWy3ZEqY7Hc?fIE?itjp(^Dh*{CYJDtW*^8-80U#jph3m60|2vlkmql!A3^S z%0gn%$U1fFx`59f+7E<`oB3$ag&Up)xwD~_g-4-;9MI*A-$dX0$GN)CoVRW*M0cA@ z zn@FfB-sFE6_5Yq2WoN%ko|p+Ihs~I&UuWI*$@0r07Go zkHGpFD>Oa*ahjxZM0h%&srBceWKE>hoaM+D(aBYCw1})x$DWjqlh9Qu6_dO`u z&$IK@8b^O$goTCc6GH!pFcsNWVMAK|kPPMJgQ55~Ya2@Wkt3gnHz;Oovfc+OBE@@h zgTUV96C*8rXu~(%XKg@_hG9`iI=ezZFLK2-7IaX$?>j$6D+4qka^rNnZ##_Y$>}X` zzcbo>p2pr<+0xE;b|Bq_k&YBb=Fpx{8L>+HkIC`Cmut)K0bnphz14k6wt8YuTIjnih^rpO6!7c!H?d+LdI*dLGUX2R!keDT!-j|651&HDC!}Z62zA23$5hEiYalw;kAt&{HH(~-r z_*_p3yha}3d+M1@t(8=Sd(|Y5pcfLE1mm!knc`=MPqi{uH|SQdNEg)cjV-KClBii= zqihI&e5-%)t5RS-?X?l&Fa9we#pD-nPfQ?$aO7g2S+MONqxMhoYBIW}3YDyAl!b)K z=jks3656B6rlt*bTtP1Xc_%1}l*3XcwMh2;wfNu3Zd1A>+Rd>X4&~klb~NApVBfG( z&wtck&4qUBt};+}4E47^>v6Q0P!9{RwYtPvM{rD2as)xnS{&g9qkFJ;9K;|Tu^G4N8;Hm*yd=GyuqrVEVrQ+VdNzz{ zzZuDzhX8D;cpk_rWJwkM2GT7vi6LXzVXu-zJhF}XW`Ce_hmy?N+RRa~Ex{? zyX#b345YaR)RWYtNBaV_V%kCYhY>eph4H;@eJ+*!5kXbOHGGZsq$QXGS!d`*{v}c6 zBiNsdO1v#!4-SgfIgI@lN4Ho|9(fc}_}A-bT?`dDb^={wE5D(;v4YR9c1T7xC_3ob z2_6z65hB9`pMnyzxhEfNw20pi2vW~WqZG=E4$8!xSG9fBWT<|e0{SRxR zN3U2uz2i)Ncw%GAqHeZb>S0N7Wr)2{Ep)JBj6J&ML{3GdAx$>1M=h+ZaQ7hb&(`Dz{NPRD2 zFC}9$Nh*zVh2Y&~#h`kq1}n1yXd!`<3)*02Xo#MVXf%9lUg!bjc`1`?O}ex;nbFLA zqIW*V###?0bY*o3=mdRI4l_m{Pklw{Xwi$BC4Mj{8SE{c6_3PYPH+pT+NZ8vyy`b% ztm;zKk_W{x=6IN6YuJvd4*gs@7-h|<7lsn0pROBa1PN)~{`IJf{u=P13;eA=PcWLL zpWdR7;G+YbRrLgv*SgM2DzrleWV$Wq9qdhu5Rvr4&J2ZPOTsR=N=<$lU)*w3Nwm4@ z1Lo$}1(6InQ*{=LGwuhET!`V{X8_{Ms}DuioTgDAE|8Zd~+|8asC`4ZRh zLPH-l)q68g-cf2lkZUyz50{yRa9*6cuhZ-xw(>gvuNXvTT|mrs_b--~RPIFIBtsqV zD*xm@&|>O~4)~?qqCk|K>?_8KVIm2VR|ufKAL^=Z#%T_oRHb!>8CWs$?F+*ZkCC>L z+i!uCNdxcyIfGE>e_S`kP~_7Tli;}XDR)MroS_&+!20awiVK{^*_Zzlm(+8sG_jJm zO`QiSNGu7`BbyiO-&dmVYCLwXV1+4cCMCZRYeYuoA0LlG?Zy*g4<3?bri@5#TWtvU z$3E6(2Gr2)Ng$?RA$8(<2^PJXaj&c4r65vgC>iD|3AAtWryGV*i&@%oL8Re1(BJw$ zmeh|3xb3Uof1Wgg!57n668hn{&k(LupO?Zh>mK(+5%aUxJi7 zTCJtxijDzBn|ex$exi~s zy*F@UF<0ftgoegMb&mMv)?sHD%hm91R=LZi*~Z&$UO564ds5LWbn@8iQYuGRsQO!@ zyheusM+Y;I;h7!gT>TWTdeEbO#h(Xuzv=l&gE+>H51QkRX&9x}1s=%JM?FK6wnsMe z1YrjvCJmjj+p5=v{jnQ|cM^{tCd0Z*ZRiDIxiG;}ee=^OiSd*bDQu@XM@QQJk`q9X zlspw*IhJ~H!NWJsXqJl7W03*ND$yBGW<50!cPepLOMn5i(KsNN$pcfds$DmVW&|k4 zI(R}5#p3`KI|Tq>6l86BKdJW|9MPd|feIT^#-j!&%zgzi(xWrK1gaPqZDTu#`yBE< z8Tc|Iry;|Bqj9^6G?NYq=36~0JrbOAOTfX0iBnn&uMk7l|J9+6SIf!}72anJ_#N9l zg3@72pZB&u0Uz5a`lAvYN$oeKD!#4t8W4G{qn72+HnHi*du9_>j=E z{Yv@2grI730Yhwyztpn^Q6t}O6plS%qhxVMouy5+;L1f?H0t=8*fEws zx>v$CLh=yGh^X8C+92492yRT6@!>awBX=jax$ z#4ikO!5m~qnQnm`@M`)?4(hfCwMGn;$*V&1Y5$!&HK;(@L1ZVqv5e>!GdEbURkU6`fIj&sx(5bfE~1 z{1%Qqj%v_}-pm*kI!7`YWn=BIBxO3!{znrb&c4Fyi$Zgf$wGt6w*redZyO$9P06k+ z?9};xI#706L-0NWEhzu1f_G|l?AwEMxFbYP{t;r?VcVBWp7UFpFyfd@MN)|Z*spWu zt*=R3wyQ{CDGS-2ib3P;z4KBP9#PYeY4bO=>=pgBy9d8*vL^m%v+~y|^eEGEp|wJ1 z^4`DkPGYFyr_smv$#cagxDN3&F{T;DXp}}ezLSjIib1X@e02{cA4lvIjCxIP)R9We zd}qh(=9Ic}-e$mCXR5 zHxzt($bLuobEKn69uZdEY>q-9ffd_uV%vn91-d|lph0vfmV%9&tELq3kwnGWL7Qmv zG9}md)r`68VA$fSb>k7NaOsBNp&LDTikrsexW@vy z>8ARBc>9KiU=NCp2CsIBABfvoKuP4sf-p^Zzg&qXx|BH6+Q=ukh)b3_sRTDxa;qlN zmu66o`^S)50u#qjgvqoN{M_3l?g^3j!KNXQV1485I~~0D0Y`2~ZbDKVw|Te5Vv3r~ zg+)+K6idHpiEnQ!H|#ALas`O0=&PxtI$kB`5u7cw2xilwmdVoM|&%MPiMqZAY`i_(_y*JRkwmLlcJ! z(G|r7SxNmSB3TF+hVE_V0Ljl~hu-ghng*o3Wu-rM;wXMOoJ z$qVqlG5%=6*Y55@CmFNMi!cB-YagHr0gb%LgiiFTH}qJ`NjMi>u&firp_9$<)u)M3 zv~s7($YXZ-8amGO)b}lTN@vJ)mm2)ijh%3i=OSOA)$ zv4he^ZiY-$jfvD0Nk@mScde_)BA#aZrK!m$i4)XCz@+&?P!hmQ6jM=1aEJ2EgO{lK z|LClr$$HOjo=P)Shk{(p zaYfesai9@*QxNvy45?nqTuUC;bJ;Q&q#%YDotHdX@#IPp4KV(@(UILkmTqKZmcK?x z1s(NBz>%kB2O3R{duV~Dg#J66ESg%x*crt}5Sx;uZ(yc&{wZ_hvc*nM8hcm56IPkF zcgk6YeL@z!cV0+`I#mF4b|3YhPV?*hlT`dpx!A2mi`ES~dBQA)edd~YWmiJd;~|$I zEMS(?p<7foZm>Kt_Kbxx367<>iTEI;tBX42X<8v5M3(!V0C!(a*@GgmQpu(rYG&km zToM4hoPlCep+RiPOZRuHM0HdnD{CQ}=z}q883ip>m!zkF5|9_Q7ZC(*( z^ge2&oU&5$4rSe#p4+XGs5h2=x|J_&lo5;!C%|GVhyjrmPP~^~B2r#0qTbX7$D7>n zvPY7h^lw;v7pg2$rgBFc=3i{A;@lrd?l$WT@`YV)Tq|1O+9RV7lx^8d#UT%j{`T6& zIREj~lq`XVJmrqNv-BS*;A%@qAW78Ua3hiC3;Q z)+z<@uHBa1;#)TAY z+L_qlFf58i-<(=XM|PwQAA{-sJCTQFYOfOrFG zeU0Usw&4ectoG+_iutbpm~wui(!l)EIzxO^DR#*d#B9Jjh|#;yL2-`^kL36omW^;q z#6G8xXbS9j9`m#KRgB~A^#wwhcoKP}qMBG($UqQ?DMGXOzF9*nB z#)JQjgLtsQS=WohoI*z!W9eh2cqU}uw}%IVHVsVT5dOv5k5z&(Zc&%YH7N8b(b#qq zXBamq(i-;IPj94VQnJcH6=oe+YYb1i!Y`BTcf0*V2jd+18lP5?1hEald%nzaIb#ni znzW?~J=J$$B`>%dhJj>NE)=E`tW);X34?T{8Yq90*=>?Y6&>iA^2AEW0f(=is+{BL zvz7nNlD5@npD*h*CMNd-M#}I4`PUEeFh2G zZ=P^nw#RGmpcvYJ%WY^W;d|~Td`P)=_*es?sVnnIwuA03(jLi|p1}kGNe=@z1!T?m z&B7pwJ#I{}$}MJI6=TpfVOM+zv_pZ>2(FUfspr}=#X-a2q<(gb&FOa8{Mvh(1}V2UBwnReMSU;2 zO)}96nf^nw>0^nn#`BTQFNeTG+rB9b!D&&YWXDB#Ng?-Nq!YMAwNk6AWGtixXa5e^$^QMP3kAe`drpIwZBOpuzo&#N1{-9jyNb6a~7& z?;sh_`}lPm#D>2HAd7yg?qx{VAB{@f}C zul&wM%k4BBNh0#Gij{E{^nOKR(09ACl>FE|Z#y~hI%U{^@9zB3v-k2o0SW1QAMd0W z=;8NwoBKD^#BBgotl+9%?VZ!j>iy2cq}Qcq`2(X3t9*;ZmXNK8KxW?yTM0L?{YGb# zV|;Lia)>M9itca1V9s?S;vDtR2;JgxrVV{XSI3^`A;f<;^4#@VEm~`fz4KZk6Xif~ z1fK3iof15Klhzg%1?bwfi|g5svdf5epusOD?^`J8Iz`e;l+GEa=#;EMlUqk|UN+9T z1DDFMtTVer_iwp%isrlZF^Hfd($zy>f9t)C{gYMU zU+eNmPi9K>oWWB=E!D`FnxB7qWN@!Q-UFQU4IrJkwG)dILCAkEY?XvuSY7 znw&nx)%5mo(bK)9;3~S(+@4_wuLt{~-#sYof4z~6|(GZeeHeKNPFTh}vJ6cr(zG9ImA{Cf5V(-&rq#3`@ z;Jn+%`0Fs%4#(-pcT;T(*m=1Uq1VG}BLja&*YRZNz(Hinwy}o(*W(s}XQ9dUq}z)+ zmZ1GbRq6M?Gv2S$*S8edUB261>35&94bJrUe}$9!xjoJYIWM(qrwymjjUa^X`EMkS|EJK=SqKPj0il;&v(lN22+WGyu!O_!>dA zC^QRyf#<;^R2u_CmZh@yVKVtT7`K z@j&7eNPq?VpwWmpw2l6MhH8PTu1`ACs~6l(qg?L~q7>QG&R%Vas9o2VcCPCL$GgE_ zUxzOlN55o%hMx11Zp!G`76Fe1aDVwpycNDe8kI^aI}IFbk0&?vZScd`OqBIMWo{lL zxn2XC0KN8US4p>LYX$>>LnMV9^j?jdQXMG{Q%a)m8z-uM`PE7JVvTaHl%31}Y>770 zUY1Q0`gU#Zg(a2A*RxoLI@TVIvkL|*rThoM+P>LvUSj$W^L`!>3hd_^pm`9leV8z{ z*Wg7NF`5@+DIjba4Whz+dp zE-BGOkf4|fjpD=vH0Jx0Zm`_zsdAY#-6-ulC>f05L|+DFK$p1mIbw@U5$O?2)Gq}U zJ-nEc!FR;A zf-Q58yNQ zxLpmf6jmgR`ObaJ-xyUrvbCtqG-lQ#_GD(np5Q@X5X?vs5L7Us-POU{bX}lo`8pn@jj+ zR}6QXR0<3)VjML_StfcjZ$S?=dedRtkET}QQCM9YoZM&_PJVNX1iP|)D~Cw8*8Jg!@pV?H|JKuW3Uz0 z@4k(1WdT(c)n5ubnb9}~{t=Uaz&`(|m4I5UNh1)fE!fxP?TRK^m)Z!`xo5f!t>g*~ zI;+pa5UpmlUWL2@P}n4SZSCO;;>*#{mklpQ73_E0-X_4*=0J=^*(y?)tB`V#eY z9Q3#t7|t&+??oxuWi6H6PV+y-&ck79WhU&^R$HX9pj6!SY&1U#s9$1|db#ky8eFGr zhjh)q11K}D$sjsqDYdo(ME(^weCQI_YopohHP`|U2~#-`ij6i!^OJFDriGiD+{B7L zDQFNXMC$&G5=B}j%n+)(_sY_s4c*XHxR!+zyK-Vzr=})h3=R<;2b8e^m~IqUazIgg zBp4E|pcAqi3d1sr>U1WG*pTLl1M!mDP^C}94S#DYqvTMC(OJ4*b`Uv$3;pYfJ_zqS z8nW=6oW46AFjbp7#G`tGhV^^T)&=PPlb{*iV{lhZR>)wpN7Zx~} zu7h|x-+#`(lKdd)(sp-JaBy$C`hD9Aj^}?Krsvv!DAF`#BU5*c)-9H1XKg{jpW<6Y z30MFR{4Gl9K!N=8k4Gm(hqA6Laj#^1&PGW+Ti2x!|E1$Jo~^z@WWDS&g6iOSYZoU&pO zR$g%;0k4T09r^lt7EM6QLfkc(Ry{lJI!|_rOx5rLRQo~0174Z8&ox%c;ED^oDxIn~-r(`@&WQ5DEP~f3gG-sGm5E^1yTI>2|q04v$fWJ~J zYp~n`)-@+(yI8Nd-F3Z4#$n8^doi6$r~E>{-2NtT;fr{d z{EPXgN6-dxO+>{tDk3El>>%T3y$zQPSM_<35SVEk9Tv)-O4>#m_wp( z8&erkN3#R-rWDL#jjYL~J=*+9 zlNg*R~B9<(`lhZ-j9FLJVmNVjaIE$**Eva5Yjnu+=>OUPo{Q12r@j zBRmlv50LqZpB2tyq?x} z@h-Us7G{N^s*_$6jWN_z2NR7aEu)tT*|Qg#P)Q3K##!YB$W4crQ^ngxTP!kdVl^49 zg0E-f6U~j<2h+s_E|B9!W!Ap6prsUI93GeLPFiJ zhPs&|hirLQJCoI{9Qr4yF?9V+8=8Qtp1Xx$QHE_PUzU?UmG1?Y#Pf0ogm0g(SNIyu zcUZR$DlpcdJ%oS3v8J1qPCN#F)LLkZF00Xt=Sx$w-$=z-v8GI92sxWFJvZct)f4>W zB(4Fk8?T2o)GGbzc?^H{|s4`S@Y>Fw?cMFpNoulY{W4ha#6y7V``f6oK-MU9Pa4Uu+Rx0a0@i zDL+51wc6uHYW@~hmkAG%~Kp>ffmYyj%Za2IbFDA&twyFHM zg-&*Be&4@|PdzePE1*KgZ;4+yK+cQmPf>%?{5 z48M%@+?y(H@ZN0l)Ol~mpT0>B{+jlAkuAy2Thmgk5q+Vib`VwVSsQ9=D);Wi>u}^- zBt|OqQ|2SAxbbmN4+BfXU|T{WwzIZDkk+Y%i6Ah1k1)3Gc`U1vo6nFYdj}~N6b41| z#2B%QNDHc3o=YrhVz+_Jv(`;BHV}ZIF|n4gYvcj%0JD_Y&4WReH*EpM?iLc8B{H?H znmtM|Y?-B|cnepS!}HV?jCSYA%cJQ-q0^%?dL~!BK?W`pQ#8EwpeuvC+M1%KKo^SBT#qFCz+Y~@SS*+f`T z=+ncn!CqTNEND057kI8!h!@8c_t>cU!|T57rs|~CKVv^wQLVQ5IaUssc_(M9s!GwFDMr27O0@#j`18d+i z3fRI1cT^OqiY;X43Yg?sH2E#%m8kTnhf?n8)>(!M-c#rUMQa{^GPH5Fwb?D`>Idrw zaR2ju0R%Q{D~B93J`N69Lf;v^M*m$Uc7~esgc`a?aa_xU=pRr0(oEiYhY&XYSIL(7 z)pk`+zY#fO;^_afps;ro_` zk|7e+^lui$hG3VG7X#XXO2xyQ@-YEd?3-xs!CKFlB}&tbKGiBIWXmGyqhWiM|m; zaS8oQ+2svpXrrG@42zx2iKQ$kB?T_=r8BH)H~6Kk=#wEyB3EeC zF7UZo>WtrNp36oo((h%b`)P`XIqg40cLX7&H@vD72dCXC@TRWt zrme33ZKQSw@hKT;^>!xc#^qpbef)v*Ko}+Tj_q`?#GTadETQG9DkbN=ToxJqZb#X zfu^`;IoYT6v4w|qIsFuBC@h0!x3NyZVp7eZt1~&lMMIJ!LarVoE7}saj5^hjAn{<1 z>ZC@!@cd7iM-m8*DKb8FbeCEffr-mTD%T-TZhB+vVRwEeIixrEWv&TPCDSf zrlUp|nk7NwhW-mTA+2;8y|N3|^x!6s*u1(+7psu@VUGH86;sdpVGz5SCGo{DGA=3B zz?l3iS6qxBtSTBcn(X8+jgpM=l7dW=au&B4?B8^^A@>z{;bckYGO4YCuocswUr!DP z0;jnh<*N+>Zrz)wn%^R;qf}maGqGQXOO@;5PbxixTgadHo&DOxVNS?bb!aI%_a|kY zCvUs>pI^3z%DrQaM~MQm0`qEpx*KipHMKWAmqeun(0;f6Yc;Xfr5bdr9=i&rw|lS2 zZohaak+`@met2OX?eIi73H6-$AeHU@nJQW5!Gj<~H?*TjBnzFY+G zCT;}?*4r4)qxQ?sva1b-29Vjn7GF4hq3rrSCw{wN@`Q?awH)?@xwXm?XCAl+5lNcw zZ5n+c{l)4|XU)5p^ze|$qLcfx`T&() z>TkOL1r_R#vWc9YW12FWXp-0z=kitnk=4Oh34m4HZUf6FGzB+(RoYoc#TrA zfK{%p^Rcw0HyI*slsUk@kxtSJ1~=C$a}L|A%0YkHL{|%StT&PmGqrBO5@MSmi)5Hs zc^$+KEf0yQiZ$60OUaHIS&1sgaefw(sX8lUG>NV-bLgWi{mm%IlsO|dJuXSGy zd47LalYHfllT^HdkkwxXcbbjeU|3gQTM3(!i+cybT}O(uVDukFslW<5`*$o1GrhF3 zv@^oEF_%cab<%R{+s#E)Y3FA;og<^AFIl7{Rz_vWRuL-}S<3WNDY{xIdluoR3(6;l z>3!gm9`V2|YTO8U;P4uxDM!GWl_@UU2xdw72L*4vlrW8>Y!@P%oXUzkbB4i8rHhnq zu8=A4X2%J*+I`1hqj0@0=X$Iot&6L-OZevA9|!9j03Kk)?&y^BeY)9h;(C62O@eiC zXL$ezUE08qEDQJW&`uAL$5kblu#G%L0%tb=1}XF&!lL0w7TD-eoeO(mNibXy8n(Kk z4omou0JVb_f;KT%vq(hjqbs4x($8Kqsm(9toU*LJcQ&Em_ZY- zR46j~e2IZ(`&uSl$^de|h+ z0Vi1OhoRI8qs2-WdQ&?fcUU5Wosl|l$Vyi?G;3fGDVWVL_2&=Zk%4@Uh^d08A^JyM z4y<7MkGPcA1?UM#s7&Jtjd)QOBrEO_iAdF*u7nDfieWia*j=c~gg-k)tCAtPt~@{o zkdj*H5#38)iCs&CY8|Pb=QNfYW7ERSp-f#UjKOJ$x;uvzh9tD@F178m7a5Zb@A1QpXiMW=SPP+s)#{Rr5HV zK};_o@k`iA2c=BUgo5Sn`!UF#b*;JWe{D+pddgpIHTXEB*t2P9YE2SU@vHUil?q5MR z^d(qK&$L2D41w4}cgn$kt!b|@b2e_gAr=-5^mv9^B)VI(ntWU;R+e4H=&!P$7o;ma z4M%|&a6z-M`;B|kEoxY}gk28tt$Z9SnZ*+RtM<1s%7Q9LAR9P>b=xB8z&g}>_m_%> zgVx68J;~H38uM5jWI&L5Kpsw+Ygh;*zQ3j72p`Nmsa&Ww)|Ctj8}@+0i&p$!E%Z6n zIYQajJjDVfpRMoLTVmD>r;+1?7mc4zh6Tdp!lK|{sjsgAf8SI{kOD(AK_*dQgwcdm z(uFPhNG$NVMdDu(4H(9`;{F*0{o8@kN9LqNz|2p)0E%XYQ09%O_x&q*)9*AB7I#2NkX*U2jE{-J z;%~;D7VZL3+;Q;)Vws36!h`i$EA?ENKV=t{VRwY!6_SPD1f>nE&~GP2^+d|hD@k_|Y6q@ltUk6>n?R#;FsX&n=i+=2)kRY^ zMau)mAj5U$chZRJV0sEMu=_@UQM+O_0@FH9m(ZH^`@kU^V_1--VOx$oimlE!+<*vF~V=rox9>40|I=>3rpU7q^7x;hKgp>-&xTNw||W(N@Tfm?bgG)ulb&Z~W~t``PZ z3Ps%A@P-7M3|eAIYArF#uwNH>OOhFC0X-$|3Q-3u<7~u;uP#o%$Jvq>O`Zvx%LQPo zn%w*m5uL*Wi)7j4=(3WiA`G^a#3sU$RI7D^D5-g) zLqQE-oT8w0xoq{QY7bT=&-|Ek!c%?(BVLY8TeH!pi`q(^eCSJ7%SdOLyV{xnSheo zgtOOHDS&hMOn1y|i@w0Tfzpt!FJd%FiYqiL!%wDs^3ZWr_MC70$2KlQ3HLxE*lM@? z^)^8}WlQU%-QpHa8Ds@OZ(2~drKi>`5r%K$!{tWJji%`age8*`ywVTXKy;dF6`{xv z$S-39#D>!R*@_ek;BZ1M>aaqqM6Lg9g#3jJs41>D)L;9bbDWBHX!z^y&YW#JM$J*7PhcLJtvKdA{ju;uA-yI1DE=m9yJNWXVF5 zA6?(&FYJnZaXf`=$%jZa)dGpqbjI8_=Vfx?bod0e-%*^>6E1ki-dNKzqbXGWptsKq zToHT$q(|b-$%!97+#6V9c9s7qJL$lbOjpDCmJ}spN-K7v@*||hn7RS#u}rb$9UCl9 z17n~tL^A4>s4#(tJmQ9b;r*iumK6UF$dn&>!(6~A%8hbR6f%3$S5(4LP{M;E>>mY4 zGh*U%f8T;2g>bGEDIS$reO<_3rYecmp^8`Kc^y!~UPKUKQxATko7$=58SX3XiDFj7 z_ei6en9=+ZpAyx?JHA9$zHumT0PDU|^r0TZCr5FByrP#}fIb^56*hMFSK!dMjT&;EK`nokBg~0=IGLtD!+!MbkZM^1CDzI;ZA@a3t*wb5C?{q78cO!S~9kBvvAlp z2vMK@4M89U9R8^{OQ=mve*H@eWjR9@*68ZgdV+boaR&G$hFYVx-y&;pQiVUn;elUe z^XacXi=<54#`ew)Snz`)dJZ$ z11(LJAdh$y5vt1-?4@;)nZ-&Bw5+Yev$DiOx5V^*%7e1_NB{3*&n54z5=Ds?*;-wg z02cYvSA9!MCWfz?0xUd+-95S+C`Rms8~D zy3sVT4MMZiE<-7=P<5~gS3XlrGXJbiD6bBuuypdlt$}%~y%YvxZ>9`eObqhGsJ<>$0=FEZ#$f-2vT*&MWF~6MtVZaJu+q(wKRjHb z`p=^ms_-cARlAJhd1-Zd`MR=VQy=Ce8j7BN0@^FUf63C!tmSt@t;Q!ni49F|5|f;? z1WdQoMm~rgrYz=HCP>MNbT#owea*UJg2zmOv>qwd=Klu=LHNFxcr}6i&IOPrGFor3 zu&}VOFvGMzMk&R6ViC0e6Vt9s2x!V_N+p`0JW^RGO}J#LFM-#_b4Ed$;J>UoDy`HA zfFK%IL8=%5OoLjAx!T&FatXly;}3@vny13FXb}XvvM3EITCj()(JPu&DWH8mavHaa z)j`uDrFBU9V3NL0_?omaWk*ou2&y-PIc%=BMB|1dE)fD@nkgN-A(T<2aT@j@4NWOK zvd1r*h{jV~w?N_=+W9Mg>bxV*nO$y>J~h~YNp?6bmX{(sMP5L$EC9(!s|lfpnT^Pl zOzKtSHWJhsfw^M>sdDH#+e7wqV;Yb>djAkXgP?Jmn5_dUI=w*pa=YU2O4o&IgpOG9v( zk`+lbpng)6!E{jcG(<~Nl!nVL%x#jFll_gttiq0o>?~kxgpANCmrj=aw77WO6XoJU z`4i)cF($o@?ma%fxOn^%nw*MPmCAOa#H$G3iPi3bP1%>h)JlvBInza zip|$?yLh#|I?G@ccH77yRS$CvJ;iCP$iUku_|qEUFk$@TgMony?wKvr?~j$ zC07};}9B|~3#RCVP zc(7l9c7AuC)2|{$Vs7bg*QcGoScpn1L(B5A{p>g?wCJEG1 zM9T>gdn8&ej1X1{pH@W6X(oN2612D&qM0ND+WQU;zn+kJOpv%F*%3oJNp?h*-RHBv z|IKfH|LLtk>EM!MN=tsW3~_1eQ|Fc*RXW)DJA3w4Kdb*q2pzK}Tf;U8fqrm0q^wcW z*Vs{ntx2}Yv{7g&s{*D8NoZ-W3ZfYiCW-GT``D(^q>|-YB^ZMO8&fomYo^?jXnPxv zJ&Ex3psWPZ(((h@Ct%W$zGPM)XW%^rAlWFINkH`c%Js1A<23kLT*m=~WrySrUU9CU|A#NQyu6EE%ICK$YRl!k z{8z(|88)nRn45;*74ATySKT^n_~2iy#A$%r8l#cvwB!C1e{xtI6!7Dpzc!e%*z1=B+3*66w87PF@uwQ)16 z)yZ?maW*a*H}_({Sa|Mo2#Cps&C&h<@CjK6B*l!Z=~b#9ApSwaErD!jF^WZ_!p*1CmL zVET2BZ}yzVTa!l59sBmWwd>ctJ$3Dm$3MP>@7XzjTb}suiSYl{uU)%-?f>ido0BFj zcAvjw=Epa#UAxZtd-Il!SN*rs`S|Gx+V5kV4BA}|Fl;DlBMSh~-ZFcFac|kQ--T(A z_s0Omm?&ugHHqlNo(X>nYkhdX3uyFy7g1@Ji7*xOH(iw43R>urL@V4N zj6oDADvYx{pz)R@;af}T>~|5dpDfWh4d~2=Q;f5!HY%El>7_qA=EzClj1_#l3$6p4 z`Ot@J{`ujW4_B}G^$5nFpvgqkN0m`}@^Z)}Q%`>F%!MDWF8gr)PuE>{_S0Lv=a)Zq z?ipp*t}a{c{=G7xhr)pfR?rl7r*a$E4-hH|X6X~HhD6w!q9|A!iCHs=ImSe`H7PHy zI;w++c~LahHx)z^t%d}h5w8Uy6eYskfKarW*1jTbP3635vrJ%GI#T*Xt06&)5REy& zM5NN0*;<_Xuqsf_cwuXz%Dhx03d(L%i6+2$lE7XC%}P*dy5$eA_5Z&Q-+lMPzrH)O z-|tSJw!*u(_6(_ToQmb<&qV|62e5{qUVt&fmlRA3E*!mHxB0 z{$avt8?N%NuYUHTBCm9Jk>yr6^K@jlWYtus%$HZKerMJEpiKAqe{mLWZY6$7%5>iO z&l&fvTD{6C^PLZ;4b@5ii`kb<0x!+#d;8pf?zCmz^}pQl{rmgh@7841{YN}B^%-}d zK+BiFbxyKXD?hw%%>2o>|HWhH*5`kCE!_9vs+Fr(-Fw8$v!^a|%P#+ebMap1;)kp5 zb1qI(7{>o3MJvKOB=0k>7;z&To^ZL(m0sA(6l`~YR39m zV_$thEIN!EH}=)JOHhg>GwmgBM)8Cv&R9GJE&2?+>0xKe6fd@= z{PAn=88~bGy`%V*QTHyM3ir$iRzOO|ox)~_CtiMeZ(gf89v#$b&SPWe{nnjxj=FB@ z#@{OY`IDCL02wp|E&k~fUObBu4r2~lL2)iTHpDAu2@eoJu{PmNe&@>gCmx@~vWr+A z@29tZ^eU81A6+a37DX3g(W>B^kB3pGkA<}xT@k)Lcivey`O4h$ikrr+@m5;3DPhSB zXB`n)iWV9(H*^Si;oqTqP2?HHy8DK8W&Qf~lGfTW{q{V!@_k&o*A+L8T{G{^&!K$L zT)1WC6@C25+~{;@OTmjn8TW)UCnG0bc10g=YoYg;af5==mb~%ju{T`iHMr;HH;gTt zx4>!d(kX6OinE`xU>;1pZj|@PQIl>dnfJO=9vStU8KZsg-siNjgUZT2^|#5Sy=Ctw zZ=ax*?EraylCbvkO$8!05~R&V{RTz?@7ggsyeAy7b8gyC7MmSGnff>mkkg}B5@o+j z*>oXVT4t3beH5gED&_s3#qbDOa2m@fGLAzdJ0TabVNE~^EC8Z%JE%5i3Ew@#4`jk6 zOt|XqnQ40srvZ?6@DdR_cnJ`qON_efpP#%up)UkB>0RIU>AEA2>dV!K?RB$qmfm*E z_h&!z(_=~pIe$M}?(Bp9)D2PbX}5^2PoF>NXUiN>Zk>IeLoEGSX-TP*_`Ih+$JKF@ z{$=6o-@DFP8gb~JKf3PpHLtz3)uETp{PUUfz0O9k3CnBSGZ#1ox_>`grr1jY$tw|- z9U$2;-NAYlut7)jG=cuaic#|IOQO-UMAC5l6y_4A+jmQje7(ir32K&ijz8HL?JxRF@;0eg8PQDjPFlnSQP z+FKTBV)p|#rN|`rE6Vi;J9#mksxfb@=tyyB7mP5u6lhct($2dF$}u zgNM0)7rgL=Z~HwidisNvx1U4+DUsKzP0wF2+>0@BgF(FFdtG?vAXa&`aH9j>;9CG-iNcR{0AT4ELf@e)z{vIp^GDUp)Ksg=buQ3ReGR zzdFH>F}c7EnQ`^yvyJPH=v{)WmWh7b2oWhPB4(^)W zxge39rC4PG^+L?nq#h|qDaB0~eH@NVNh?Z4l*4)ll~$f5#g*ta({B=Ps+`2 z(`PI(CL1;GtTME=a_Xch8z11aVmIVu?6_0RneUy|Z~C?BJ3bpfE*sd7tvB@SHxM>{ zn$a}dnbZv$cWQ6-va=*qcGkF2@HrXjOJ!qEAEgv_>NsbD zw8SHTZ<0sV>cnwu>Y(!hGgUe0^LH?Xq^FSaEoDEpUGwrYv6XuSvZ3LgQR-Ho=VmC|@c_O%2=UJ>km5>2(aO#tK|6|wmi8Zgrcizb(F#n-fc*qf zMfEBCK}>e&{0p24w+OWqbHKFU73NZqp6GY;ynSANLp_fJ6(GfuU>c{PqGq7bG7sd_ zPte&KCfWI|qXxv07Z~1qhp_Azttm^A{wKdV^Oz&QdCZ`5W|y;)_#T%-uDQSLdmpY| z^UsIBH}Bd(-~99U+^~_E4*k<5eD8|{O`dn%pU1e-D~l$bjngzyP$$grk?WJnG091{`i9rKE88Al=Kme zn61?Wo$P?bkeAAD+&qG4u0%dfbh6WmMN6y6xOjuokh~&eg0wACTNnJp`({R?h!w?N zz-)I?!Gb+ZxX9MH#3kudifMv+T8MEzh_9K7EVS}cWXCEOltB@*C>Dfti%Pc;L82^I zl^rWhe;@~-)_G*=Xf=iN{9>4PP`-K7k*AI-a*5B5?B9n~vCp6Z>&iZpq`%cq>EvGi z#{7PC(Z#`wJX4p6G@@c&9o)j5G6TN#8C1NkY!l)DbK6W=*4=;3&|{AO&M_DNp*$=j zhy3i5Px|*M3aWnC5&hxQO<%CWgU9#i-RF}HpGksQ_U8Q4PZ{9~;s=0DiO54IBC6 zbuja`XUnCSAgl{+duPG@PRbQ-fXNxZTp^p8Cz>%Md${abF?HBv_|5VURxbbGkJkM(XG$l_S%>`FF72z^tV3$qwC?` z4^}vd|8)9-b8lT9RO0sZ7!;&*KzdL~3es<;wlY+;(> zG*t9#D$N)Ms53(4OFeCv)|3-GE}-2olP+$UNut1w1ENS^s9z!2yrt&EMr&I-d3(k^ z;LY%z$^4+Gw@CUAlwwNoQi~h6GG)>zh`^{BkM&bt+i~VI5#^hpKWIbDxFn#-9z*Yb z{iNSLFMnvN_O+dGVMp~-FZJvjTynS2-M4|{co0pkoH=KZ<5V@wXY8zCqrT_mH;yfv z`(|*DZS}j??+xC4aCi7UC?`skKmNeHvu3gA8@C*9WyddvUGIJQP5vsFD|)uc?@E7T z@SYKrc$?=QPMk4AB!CdgpZM*(v5&F19=Bw!LZ}dnRtj%j>?UvVYs1;M1|07*naR1k~egp9s7 zcs*$Gl#M?g@AWf$fu4{J>&nogd{FsbefyRD=7A;tKFr&{oxa8^`NSFS`#xTEo*3^Q zbTZ&4@UZ*Nk&|^}*&4CV&w3Iv>No409AxvxjcgU({p)vBiP$P|GHreGtRH`R%S|JR z<{fz63f4Mxhf~?@M0>~*trnBU836&a;-7w^O+)-$DbZ|c#{-{HBAr*l1nIQ~#gfPy zFv?B_-ri2Nx2&NF$WIT&n20@>=(rLgE)t?cEGPIV6@6Suz)3>Fv@GR7gJfFliJ8tU zQ1-+kPGrC|jwMM*mFRKV%ih~M|NQXx1MWYC#gbqF4VrZQNcX=dd~a+(C&+ilj)je% z1?Q3ojGcMkDEGfTPCV0D8TnL_*QaG`MRL-+pBL$}_0x6m+H2%@t3NDTy?WuK&#wOY za?DE7x5Qgv0TM5+L}oTo(i0*s6WwlSP+jv$DB&0`Z4vk^p76OmOn@ZzDM*MW*ls}S z2e4-1O5wN?T?`ka@xCJ=veAkkI3`GmE5USBOi=K|Ks5zt@U(@uY=&-E7< zIrL{6*755AMQoVt^Pj-7U$`lMP~=o?+vZL1`kQd~J0HHY>YuOt~+pqrsPoMe@Dqb+t zJ8lJF`|QUSK)|zAw|WPil)gP?^)H6IS+;Ka6!YeY0Y^HNvtk6o-bvqq_+oIqk9W~M z{bYFQu;Hb{hnL>Dij;5q4A;MpTbi4C#2xpH@GkZmb!M^DMk4*|{Aa+;zrL`Cm*l&b zU3cUg3zjj~xsP3O`z^aPNB03ojk+7O?Gw%iT4O;Xi{rpPJCi zWze?gXT5&fk1y@%vA*Yp_q*>0dA-MqJI-7%=KhO{ke7aE=EHFFWkY?roIIxZvn_7m z$qE0n+0NPZM+o zKtv1|3B{FQI_yT3G=K~f(WqTm8{@>4K(tBXAI7*>z;Vjy#4O9oq|ziO$KiSI!QaU4 z(m9cr1FG#C+=%FD(?%;>I$84iykM_b#8Bwr%$@r6MN0u9t@#2LzKJAB=N zmk${ucvC<{+1d^2C1-{+=qPDHrT69WUfWT(*+JQgcP3rRaVnZxIXln&`guzsJ+HW_ zpDE18n|Eoz-{`q=o_~QI%OXyckXDPFa&(*#t5j?586A{3`kpnK2BPC{odlqRw4&sc zoMGsYMGJ%bdY2mp6|9TNE1TsT*BVp0;Ol*SLALkhOjFS-Y%(+*g1dS>%CoEW>(;H~ zZ{$&VbBv;O`W~0hoC@>a+{~_fJ$(NGC46TC=$4@JC*8mJmW>mO2RN%T#cz~M9V9l~ z-8{6%Wpmc9Teo)o@8H_v0h8W#uJ+zfXwGtXs$6ZOGVyocOkIVS7zI#IL zb@1D@|96=e!A#NGJfex%29Wl?lwA|odr`I3Xd{8`0z~a762w1r8ba`ozggw_VJ(f* zp#5Z(R?>s+>jP|OBjxEQL7TKRr8K;^%y(cY;O!8+WrE(FCNbZm2K+EyV@|8u=<5=y zP(bN8iQaoxxeX{OVU?ibt!xNOnV9#MHRgla$7sTLopdKM09Q~Vu8+Ly;qT3RZK=Y^ zK+B{LDDv7+^na;thab@oBHxPvMKmYVopFaR+UVCW|?|RYbGY9?owWUnhE_)8Y z^pywU>eAAZ!BdyW+Nh-!xk$2OtXH^Ad5gk&B{;^VujpYw697aTZ4F6Zq7{1~QnZ>r zjn?kMrUH@ufMoBg?Q^b5JdtR%Uji+y@ErJ4{ELkCwS?2e9EAa(J4wf{G!kN@Udr+)a(FHi88-M9Y$ zKf9N0+ov1YFK5~0_U|0?)@iHXxno3N*8rzqd1+5CTMuV}V8Lt4v1S5Srl3sXbHy)H zwly7xM@+l_jMv{>CaIg7q(|>QER*|lW3bk9*o0^AKjNY9dq>Pph116P@*!mCJ@2es zy=vv^6Bm>Y{h=FN*Q3u7fNbrvb)PuDdbt;c9eEdN&)!GilaDs7{lt6bh+nMmPBvNb z;r|Tt)A**s(|Fw8HhaP_?}eRn?q3gbKLD(5!1XAoPmkWXZh!gZu)%MS`C!HEBfPe6 z-Msn8en$XEnoxA%lWug$ieJ;8k0|}+N}q>EdJ`4O#o+#b)zn+yp{FkBfz-u&@cR4D z^8!qUk2v$;^`C6mgl($Fg?CPZ1&g)-01+&g?T!F&`vpWJyLOSt$05 zgu1J6Ppf)uY{0;v(26ZcJ-^TTplpz6Vmu!t_!*{^^il$0g8}bRudAnV8lX~M0){k{ z2_>LOc6L^${G9HE*%b7!5}eS z+tIEoxo`2Pb@q-^abr5PwQ}F$;R`qB!(yd37kJ)D#lJl&IFs|Sv0#9-TBI!puY#R5 zYdyk@6P1MS@wXq}xSk)Ht9>9|a8cLSELta=)e!gfF8RC?q*~4jV6bEsPN}Sbqz9!# z=+}$iF>Q;5b`Lgwyhgq5bna#AHnJVOjc(;VBkVcxRrlmrXMN;4aNo-5LkNf+#bEKg zkF&JuE(m%*%Rc@zSWzdRm6Z)D>Cejdu72vqZF!rd<<87*KtFe-WXqFh-2gM!zIu6| zV8aqUA%imuq&N5G{HN8!6qzw2%`=A7X}W4yo(@82<=W|8f|qOqg28z0@H4J znqSp{P_^Wpd=hGWa8uduk_#iC+fU|nz@3EH`H36p07RRH2|_SS6^2=MS}9}cE1IBu zRYxfvQ0q`jiNu-Dy|6J7?3@SJMTLkci_z%N4G=sCwTTt?N!e#?7yYxcH3LiflOFvB z@YEvu^U*N$-4k`!L3B@Rl$jA-n*{iV~QXPdjBYZn(*@YE4b;i ztwGJ)*qQ#ld$>>B^jUczFz;d?@8V{*pGdZC-VFVmi%h*lRNCgxwgvRI&z&^Adyp@l zop8>Yi7P*FR#;ZOa&s{dW_PH$NHE;TZQcA?@xXrU3p?{qT=BvG3?pn1;IeV!XR_^Z z`mi7V`r0GiGidx|n|Yc~H?DUJety>Lu<-g3C%7NYxn&`&fB4K1zjQx!1gFe&S66TsCF{?vfGMPk*iTiCN zJ7$KMMi6O535K2oa3#ZZL;{f59q+3;%IPOq9o6Qc>qMU>C|sr87?Vx~xd(U2{YGc+ z{MW36x#PxP(g}@8lzu!7w5FvK|NRa;d7dR5Xu`1hiSh0U8faJ9hkIbhJrk#cI3YC! zyw`TFye9}RIdPIWW);6Yk~T(7ngaKnj9vuT{KTZk%l){RiRcX)_ro94`_0lEVClcM zGjX2z8Sc@TuTDgt8FH5u?iuL61+!!ly6&u}=xgPyeO$S5>ONAvVQP$941@Zw5zDJ8vf?0QXXl|UT=eM@u*=6y3xI|jJe zzvb3#kb5*qaLZfQ?{WE!Zsj+*^p;sp1gu``vJvvzOu@6T5}d#j~E+ z;_m{{B{Qab3xc%QWjB0p-h=LS_c;&F8|!9)#kY8$BBmp6`YGJ=@KV=lI9YxJQ?3~a zbjuSznK$;gm-S%PrsAQ3RsiS}2G4sbnKNP1XxCvCLHZ_%iQ%esr zoW}wB?<+|*!nc03G)@yd6f}F?-i9C%;^ZdBtGIdgkQ%8kX(@SwBQ4i&u!8BDk7IpRwXlZJ;H70#wN2-0XYf>fj zyprh@r=RFcps|EvWTPy7$s^Fe{Li&?#yulYizpQR;HuMK|NZQ8_hR{Tzn_2lm5!~_ zWxu!~gF&v^a!PrIj|QBfvJ zCgiu}4^y7o=99~wc<7VUPaVNq$2vSZ{HmMbcMmQ1Xy>`^k+GC@c-}LYO}lo(_18HU zVcYEIRt6@t_4$WhA26u5Lk+$Ddbs}y|N4sG&2$fWrF7_Z*TMZyuJ8)*FAfDd^m^~2 zSHOygyo;hA2r%@zYn{?oc(j{l(q+S_dq|4&EHBxX#jmXoi&roQVBL%-S9;{OXMQ#l z#*8d-$mP?nhkNfHE{V0rcTYL;jh{|k?(ulb3(u?oy8MONTLN4A%aad((yxz`x99{X z*(~R}o6i59jvGJn#0Sfl`AZ}pOg{zOQ%im^f(||7w1wCGYNgzwmAC$Cl}~Mb{{OvR ze9DPEP_-k^oMM_JpUolcDER57ca}Cf;$0V@8l>h(`07*naRD7OXd{1zB zth2r{N>hS+n#Mh^k26K!YjENW_lVQAEc-)K$DdqW96aLkjKdY&_g4B&D&`d)GT>VyIJmaBxGX5)#BduQp30s+_AEoxN$<<&ECR+-_shy+ zT6@+wxW2g9UH&MUy2!7_s2Phm|9z$@%yE{w<_7g2GN8y4RY*b>t>9mJiYV(Vwg92V9*_m{r%b*CwkXM z-#_d1fhQj6UN5=jtvRFp7)Mt7D;}D1)=9+!gDh9{aqfOvwx(>}sRKp7GXDRq`^`vi z#7o#$`TSOdXvzN&5D!vmHg5NGdgFk=lS(xBn|nH%0DCH9D`mfYn%~9Gi!6-@nwLf; z8WrcYD1m8zO5nHD%|-*^NHpR`P$NB;A`zi}R-slW9i8pK{jk!k)w zMpIzg>kl$G9qiR}dHL0(0r&JAX3S!hCOqht*Fm8fM}i9aaV0_Hyp1)=Yc98lq817G zdzceB@$voGJ$r6Q60#rdw##L^ps=V zhYgxE|9?k$*GJy7aMJmw3@&vOe{W{luTKzdb^cj8wd5zSdsmM9>AXLF7libkDkg;V zh2R6)e+@rGyRTIdL38^8ndWtXki2}F%L}JNwlC4Dyb#T}6cmBk)ZvZ)G$p5 z4TQ>CL{aN#xOG0q{HSh^P9T~fdsk?=0JfFtD+Q)iWfZm}w8G#W6i)%5@*5=(G!vna z5lHgFwnids4TFTbBwe?JWGB%$J?hg!J&f->f~PZ@gnAp0?H$t!SG6?mUVSlsv3WDR zKIxd(d2~E&O7@% z$GBIu21za)LMJ=<$QQZoc%KW4w!}-@D?{o-X%#T#QoQyYkXtSR?f$ZkkKa z9z4v?=$AJ9?%ymJeEx8^zbhVdda-9|gxOc13xoz77;tm{g@cFx)Fn^5cl8gP*3hk= zZ-zI1I`|F2@JWAsYC^9I|M(|3|GW`{{ak;#&}q#4^GEnyxRdvT|8c+NOb);B#ow$O z>|Zaw_MvMBJdC8zS?*ss;eTG5^uu$9jNngs@>1vd{L#hN&VTyCB9w{yB9#vHlVBQA z1pZO<4_Ud{;QTomYU}E&s_Uw2>Z@ymel28`=8i&cAGTIzc&I$l?FM=LZkHJz=MQtb z2|ca)L^&_3C4e%bFjfcHh(a2kvNR++E18o+ayQFFcUcjpkr!}K5-19@I=g$me z|K6{lDY0u$#i554fkm4@`QziSg@@;y^5*!HKfbBS)*ak%o3%HsPxZZ63yT8|X+Ruu zKWvcdT?j7|gi6rSK^hV{)l{dQ!BadM^t3W~1x!n=Ff|VRL3~O&{A8~!!e_GO3A6}e zrX!jZu@ECBil!orvZEe5qn3D7Z?B^%S_DyO`LPheZIC%^t`Fxbi79=VX6*@Uqu8JJ zt4C7OG2x_780%xwOe2kD2kb3+JttC^kjmCjxe=}7?-H)DI}uA(%xVQ|U+AnlHRKJxR=7C6e2avOb6=sl0$j6M~!&OEY8JegwDmOB*0G zlLQjSrBTDgOr{Ac4I12&nCuJNAPALdU_U@inh;z1@jEt%v^8izKR`6nN1joVIEn2A z8fI$=0vYurBy~Ta7Lc*@b%p63LIQ0B#$b(>ItwVYs>b;jYU_B=1c}XUEPa(f1j$s; zAQnL)=qR8xRCB6LKtqH=Yq;$!mn59O+#HgXB*_G%(GO%|ceP29-?;$NL@SCqu{iK> zKU8%6o8_l~g@pw$$Hspsbnu(_{}4eVFF;U6zNHWH@QWy^WLk04L_AhFFoK*`Kzln0 z!2x$9*lG7^F)TndXd0@omEs@K5CKn+l|+Wo?ZTejNzgIroQO;^DEP zRK$pj5H$M2m6G*2Xrmb9aoRMEQPL;Sz7|2D1#vW!B3tw61fmr~LDK_7OG$i|5G~Ev zgJegUyv&1p0&(rQ`rk3c>w6V02V(dh3!kykCvUJN5GgR$4{xfN<@Sjw>5KwT2$-&I73-wqOP78>_Y1W(6WVWuxcBLo>o92 zmQ=8?6M7nOl(0;TViN9JNluotXhO2GoaGYSrGYZO4J{q=z8dH9PdN+IL=7Z0H#`z{ z>BJ%(^uBz~T=$d^u&}U@k=cH-VvRo}!%uidu@=#S8Y{P*rKXqeTI=4#cxj9dL7~LI9H& zl}f`;5yLyezV6|-S=+kkT@H|EIur{5)ecFV0;YxZgZgl$_{tO1PUe!37iy`lLcl9Q zp2>1$}6^fk0V$i9f&Jf%L|)-X+#;`}+A=$RNz&2G=sv;gyv#d_8he*(17=&J5icZWsF{-NQLcghIyBVwiDGMDh%1Td1t3CRpxBz;?qcc^A(^~F zm|zq821`FoL$s}>=LNvXZRQGu?lCrG((^~!8klTNZ4eHMB^h{dQC>Q)GzQHJ>dI+| zur-a{K}KGnzP8R?J#p4hYU}H2YM{QJ*89?rtBt`=WOsTRz^s`l4F$Axg6QBW9?z2r zXO$$8m6b>)AUm66CGa|1w5>5RV_izI)LTO!ztFz0V_{)o(e#KjT!=S#g%ItPpbTFO zd&>mSz!A`JDxpNFAR3U9!8A&fnFCYGGYy6SdGK)U1dTWVkqaU*_q#BM6Ce$tGTQ3~ zc_1rT=(A4jBgwSFXOM?eG&GIDJe7FO(*u){uBBcZcSn9g3z_unUFG$Qs)sYfKY9^@r$+A{M zNJjFK0Z=e_fsFcXh1)b}300z0VoM+5+ZtiCq>XXCfW999L{pVj$nG@tp^Q%GyL$B} zb^=)X?%PMKFs7yA|I!klso%ymR5(v1&VxB>MlW%E>X2Fksj#3`1XO#8x%}itYGfs8 zjyrkJ@~*p!Db4~)O|7d}b#=koiu0qs9&-<5c57(mqA(Tey@Mk(B5|fu5Y#xrtvLhOs1pkd3yT8`s_YyRKs34z zU|NU)2rtSo$Dq&kp2tYihq!yoB!)K1 zi&+qZ*-_R(lwKuRcg;kXbXADilc4LM?@1!)u&tSFA51+-?7ijKni*%wzzD@65)s-6 zsTmYu`y?uACQPR*eGN?@a&p)t{Q%J|834qUerj8b*2Z+bfKps+{ZX!`_S9OhEfu5d zNgz|7n|^&LuqdJU(l;&_>Khc-3kU`=nwaWij4p&YwvUm9<;uC#D|Pkmf?Zu5asKP9 zt#}J7?hP+c#f??*dS2HUDJYv3?vse`qy58k5`iW=RMH#YB@zyu%u2YcDhcn@kgR0b z3+Q{@7+MPH^!#zWfQhal#73Q1SXfvzEz%v{#T|NzJwUvLLkY-3Ix5j(zN5GtO2afr zZ|3^}(lod(28)zc2#;kb=!yfwP=+;(puve~E2pL86cX{{N@$$jMZQNN(NdbAJ`~lB zN{*Zgno>=jfsKvAv@hp4(iaSaV1_Ihj7BtwjmmDGpb(md)&Kwy07*naQ~^La{RA@z zb0F@t9G#z|=r+U{$l`+JEEH#_=oAK(mUSpl+7PYi86U7xR3E7xfp`LKW|{z6&CEa( zL|&$Wyvdjja-rUXGW)_b#OF35f; zxQ*4*P&X`nB=HDaGbpoi(WIG5M*lfNc4oVi^h)Ws0rez6sg~Pd+{p(jf0{j}^r?o% zW%?B|*A}h9bv1o%T>9p z>j#2H0HpRQvaLzB!`P_WS_&_~m_n53Lfl4w+z{rxq?yrPAf~Ocj@E2z-o!no7a)=s zz_pd9c(FC8#AO03b;J}C&(#f=Fg-;We=4<)L zp#m#_RSGd6dRma zyU?H(D_mHAWL*Nx24wrvb+4`oR4YMC9TT%J5{%6GL{Zp?PqR-?MA=>VyBJ~|&N&eD z1A@la30f{B(eY)PucB}fk+5bG!e>>oU4-Pt-2j9hOhkW5m3}~y7bvzb?1-SQmZ;q> zZk_ryt6<5HDREF6!lp4q^du&`1KkF(=t-jE%L04%+9umtOfSIM4YKqT6l;Q4m{29c zZ3ol5`VgkkOFaZFVJI|CugcE&Wi%u&M28v&;jx6qYlmzN`!ynWls-2A`AVOb?2DJxqgS`^ZzvG=MVV()YT$5l-+Z!qfyeQSt(y(%9}m zUOJQ>6OtD}{t?MYv3=Dy$An!vv9PeP$Pl!lN99R0_Y_X6^^@1OxXfI&M=mE>n8TPndpd!xAM~x!>+Yo*OayfO79WblcdG%aDAwlr4f)<2jgf0 zXr!<42#x3kq;gVfCLlWKRaBaBJ17~`*mV7yoDrGzBoQZ$@d6Z%k;n*|kk$i8YAd8q zLG=int&Qac!gj|hf!c;o9HXe;ri`nSt!eBIaQ#C*SC&3vYwVuHz`Qt!MRx!&?JcW0 zfbUra`zPWa8x#U4Q7S4;Lz_5aCMRgA(nM1eB1Ne%8t-voTC@o5cM-Np!D(fW3)8$J znphHbuN$x+l;Iu0gC0gF*r-dPi9bWeZI(tas6|Ldkx?olGKH9nN(?rS^@#> z9v8DO0-7il5`FrKw|VMwCPDO3GenL|Axe~rFgQpRqomS?@G`xvd8(w^of55vY+q=j zHsVRxyG(-swiHlk1!#KUDG8bYr;r`)ClRw)!BQ+0a2erV1p>}!qtfIEHR&OYC7i~# zqjb7NOH0ky(OlCA>g};+@-%V00E#QodI8)pB5Hy?0%+KPIIL=dBqOZtd=g0HX(vQ2 zIpL@@OsjqkaI_jwTwTA%2#mwG1(lX!0A*UPzBWcFb1wiW8ZqsvU_Hpuv!sAXTQk6#98pt$o4y2TRMqU8X=(^+uBpNuc zBWb+d74`zMY9rdOe;nDdCSe*Bd7&18p(jZZp~e-Naa&PM&xfL(M5aMvwowy6_*SCC zDuQ5yYA@-+E}d9dSXjhDqwFa9<3xb)L=og&4gfr?Fzg8s5T1^hV>b>run&BNq>JJe>#F7v> zt_0ZbBAb{1YN^U40L_j^5D>w*&9{+=w51g0Hsv&yevmR~5X9RNQudYuIRhUgacvCm zE&GMzT`5rCE`}KL!YP#2aT;V!LhPM%+(CY|7`^ zLnx#Fpm>_#8yJ#TKm){#D-pI2lI=^Z61Gpw{Q!hzCv`Lswl&4>5{A8QP^7Q>styRD zA^Qr^$Z$3FLE!=rjx1o(muR4Y+T$1#X}KieWEy+Rlxk>Rj!(#5z_?t9v|R4OA*iQKE;>Jn-CM74CNby^y*Hc)_Q+efy>X+VjBI(RH*+@hg=fbfYT71H;gFZiv* zm?$2BhE6`>G)Ub~hF$>6j!B=}KBcVp!X<=C)6l?b7po`X*Uig?5V?~dwlzrM1>~`h z*PF^|2t_^)`$Hss4XuK z;T{ZUmwu@I0FGH^O%K}|q7^QMMihYfEcb25Ze%Y2*zPFR&{7)jNvzwZ^59gG5%0H^ zjklPvU)Zs*u&_A52!`N-)-2GV*$;qj=)h?jF&q~@FlBv+flh!tKs3;jW5bg}LL!2Y zNlF?b!-kFZK`aFMC6TBBhs+hzb<==VGkDd}R0-`CvoW=Gh5{ryg2QMh-_Jyq0>TZY zjj~)wNNUZD)i{3`m(WNb(2_yw5(pojk;p|EElmx!1|TgtMe33sGKam8=EjtM8n&j@ zOcQNp6@)AT)e}PXVG<-_g*m!3^8yWOMFu@dT)R_VK9cH_Xqfb68Zd3v%m&yRuSKl- z82bSdQxm}85g=7hlI}z?+{)0svedM>3V^TY%OI!;I}tz+4;+boLe*)lHii#_9}v_ z5R2P7+gBS38I8Eq4GBh9ClUpn?H6_|EG#S<8xamn8OZ8fi+3}H)AA{CJ@66~z~r<* zc3O%9!}~H(y9(lZFr0~WV2A+_?X(mJM%lGSe~%jPcM-IU7^)AE>qEn|QvcBK4iwpG zdC%#{(nx5qs23Q>!-crRU#g+y!qmNGMk38LYC@1NV(Ov{7WKEx+NfwIl?RA?KN-_h zE;IDi55Z4KUL=$E-jNN0WE(;+)h5Rr3d^)xmWkW4?Z=dUEL#Jj*Gv+rnGu6m9p~i! zfrp(_h4%j|OP^|JwRD0Ov(!ijK|}1FbF;0v&p~_3;7>d#Z%i!P#~rZV)&Q{#qNgrt z_WU6)fa$3E7&H?idtG*&EokuK&;n@MJ&9^-c$taya@wgT)zM7U8V-l-4z<+1WmjEI z(>02_1P|_-00A}-+%34fySuwP!3pl}?(PKLxVu|$hqH6t_Pjsg^aof22CUxQ)m7a! zXU~dmmNGZr&Ggxs4Lah1Fj_$6Zz1NlOvaSR9*XN)UN9IzQHY{3c+%Rv#`sJ=N5ZT! z143~xN@}=>j=-k%KteKLyWjNr1n;&P3jsZdU_Z)u`J%5Vl2TGZswJPqQYe&}kK;>x z)G%n8$k8nf(rP6C5gVcHdDDVA|LGbQa{r#oJi+V%fYX>9lBq#IWy#T8J`|#XFenbo z0rW2MbDU?}JzQprO%7iQZ~TFl%OWaDvM*ILgX^q}D7Sr#hX(HtM>5X{+IhAXd}^Ql zg^hx>xcP?4TP^JBA|dAuC`d5F72Za_5-TJ6piKM35r-W`(vjF_fqsef^%LONJ{C_GD+A7tH!$!@SkLRftCKa`<8+4Pz7}bv$8a4 zbdR$RW0piMEIPzL%)?@;P{S0!49@6hM`qRRjG(rn@r6TO1I_BY zfoh%If6Tn&Cp~NmruD!Q1dxN*L$X0I`iZBzDKX*<^@87Sa0SU4g%PXwd=aKK za|s1=6iV(YgU7@uS{Ffs50DjvKbDqr3o9bEQ5>+2Sd9r$9BAMR|M=M;p9_hbOE0pU zg-=WZ1F7DNu%Q3#4ICsxvj($UAm83hkTHuk{mI;t#5`bTL0lZa9{?A0Hu-4^db`u6 ztQ0l4=3J7iM=6eQrsP|5wca}vnmr|^U?+kMWL@RccyDD-Taf1YRC9l)SPS*cLz`Y5 zYw4kC2bkX(G?EJ_mzv|#qeUEz<7byF=gj{n$dPLdQP`pgc!S?Y7$Bq>#v~|xApsR_ zv9IbsEf*x;av*F&IKl(Z;!4-9J}R1L9qqS)$R7j}YlF<$XEPo{jt~|ErtDzGdW)>$ zr4YUkA&hvS7gOhg1cJ8!*9ef;tsr{nSz}=qn;U{D7ZxEBbV6lq^3JTRmo-wn-D(Qq4@Q|TGnxzVAAVBvt!AcKyK>)L^VsDZSr0hnI_$ZX9==`{x`QqTj zQHGQJ+==<4D3W-<1^0@>EhIdPOCoxW`m3e)V)8C9ohGPINX>_ngh8x+V~Ar;!|)vV za#=Io01^$0lr4xuHM8a)alB}re!P__gsdYdUbyne$eiwIO~wa~R9o?w>YwcR4_xFl z1wdW2b%lmxqj)R%oFGh7C5$-$tIs^48D=Qa2Y~Mi4{WUjmT^4U-r8w=6vE_Pz~p-$ z#70HE6vCsUspcIzep>d&Q8T<`fLNKFywt$LggKGSqhDBsFPpuO0u>Mjf30=H_Sl$Br=Wrb) z1&{fQ>5UY57TRB|7!sR@Y-KTY-sHXwY4D$7z5%DxeEeXxX#`UMXA-57fW8Hq&(`#H z)beNIY0M(4gwWIX4kcg%=mF~JO(5jMSOy)vT34_>38V#jh6chqL6QL#eLjXW{p8m4 z`VFj@p`T|G!0J-q+WYSZHHC%FB5K}{I=}?%DdEWmWqy=Fsj-M8m?3Cl{15^`CuO-H zc~DY~S=4VZp!!xN%Hg3f+YH-5HYV+W*v5A17BH4rI9B|mrFvM|z zp0VDX#gwGKU@M9!i)qsEU@Nx64LbVBV8RTJsKA+W!c!3QVX6aSs2P1rV+wkS{Gz%l z{X&l|)=4blMv$UWJkdi#B=~sR5pm*5&&vUZ6!N}TcNq~dz98rbjaSZV7EfHw2}ZK2^o%js@&nD5~)$LDtn zV}Fv|cMoolf8Olq-a2K&FKdv8%oE;%g52mGT^To*_j>@O_{Eq>%{)&{x%0SILv7%! zn4Ti2W8dj=q619^z^DECtJ&Sarxwj%HBB8K8n(q-d0sI-MKLxT);tg73klAa+q*5B z1MBMR|5*%4IsW}z@hkfUE_`*r!JV=KK1jqRUUc$6KV|ybBgA<#O$sqb;Ic7-AtKJy z5jfIoDHP(`_AHG2y=Qt_t-pO_TX5hL2&&6PcQ{RR$P0rBlMh@J#oK@$EqL~`PbD#k zuP&zwpOcc?qr9W&F&_zAMNX$Hpdrf-Cu@@-x02qZ7M>TofF;SQ)DJf-sMiWR#?%3u zr7&Jk%z^@D(#1v_)8kF$Z91HdlImTqnZSIAu-0j1G)2)Pz1_^@W>J7%9bLT&7-OP z-@vtTv~LngtScA%zAMouUog{lx(_o9}H|KD+qAvAk)9#|1@ARdsDuo)3Zl zjG8tXrYc03=wdIoTd-O`baKoz3|HlM!{bEA1prJne7u7{i~^F5BI+k{Y_q)ucohEp z3!0E)IdAcP*ho&0<$W@>%l2>+GcY$P+a?sI#~5k7r5q;iNc&#VfHLm6j;#3&ff3_~ zmF2>LG#pD62r`wRz5NGUfnn@qp9rAB*Xd8K&MhgDUxo(8(aDZdUapH+urybCZn!pT5RHa`*NnK%i?n|^!@>iB`; zGZo590${D}^Qj}n`rvSl%77M>zmwI39Pvm2@i!~M$Dh|9kQLb5gJNbii!oY00ZuRA z1Ip;b3u%3bp91>~WE0i-z~Y)hP9cvyz{9S$OlESaO`7(gJZu8jJONcWB=S1^TEq8u ztcB}s&LL6LQj*jtAjRb)pFgDcid-OPW{sf~L(DYu$+f4KdcF&iSu3>185o-$&aSoP zuD~jTi@n8y2&RCH4L^|CHjn`jMZV10#uzNwCX}G(G&d(P2;-k6AmcyaI{YOAC++9< zqAmSRUdrbKz2gtmZ z8nF?(TD3Tw0`Cps3Lh>)8w_RNfP!cyc_{IHv>hy%u`kpJ&7=e8-_i_bX$r-{%(OI` zL=}#cY=qGOv<=*$h1K0MEFPuELi-js?%;4Yp*ckXdC~grgK|&(_?@{f$ei zvNv4&heoE4r5OjBoTa6eh3JkkR3M5#vDVC{-veDda8<8L7P4>?4&x`16@4xP07|3;C_C$rv>*^j z9WBqBLa&Ps#vNWr>w&Jw_o)yb`3fR+In4$A_i2JdA8{GfJzTs=Kwj!Wmayb-Eo)UP zZKUMl;mJut>g^q1M3TDB1fn>%_YJH@EVL1gg0qa;JggEtQf41?f2_QOKs3KvIOI+O zFt89-mWoHeE^E%5KdaA?W_vu)`(Ac(lJ*>ka$;jB3rb&Tu$RzQ4ZJKKB@E_J4EmAN zs3D~T9rQjKw)9wx+Yp^U1j6ey@HZ1C0w5z5jg)#89Si|&$NPRz+>$z{H$IUhrHEG2kjDQ6*Q;~G9F0xQ2mqFCG32DtE7S^!fhxn=MUH!(fsY``!!N~=!Hle? z=#Y+;Jo*P3iB*zgOPpgF?ihU_)omaHE-vKURsQCby0(~sOq#%^I6xkQWCJWNs8N0q zIFcpoOGwsAh=*|MB#}u#WkAoH=8@EZL;QBFxT>Ajl6*R@IsL7?%0?sg_|{)RUA+dRgQMUBYs7l##z0YkH|V&o6ZqcbT`i zzbSd;f~*0JF-{CqKOU_hR}#YfZuJiA<-}YkbnO+Tb^06N0T}+X`au~&!s!?|?^C-3 z66&4^po^moIR&#<5%`sU#ULCq2$V`jx&;(`wi8C-U1CW1=#p!jb-3A5=Hnk=!lVt| z6`pdNu`v5Xg!8KyA@)6907QRb{;J~3W8lkGxvl*QUS4INDxu4#7tOAw)M`C96xLSw zScW2DZh1XP4RC6W1@UHGzww|lB8Sy$!yOqUy1^gO<{V2XIJwn=(oq(zH3E_Kq!U3y zAnm~g(Y4i6+#p@codx}~X6eFk>Y^I0FazZlXN$|YnSVvu0h%f?DU|#|*&TC3LwE3b z@{-g)cXG1nz=$Lu(tJS$=Huwf|ko8@yyh&$B> z1ubkCQ!#_RYtSAv`Ru#PxCFU@?AP~Lap^F#i~+8%`J#9oLutu@O0D0ivj#F~41}fd z-q00+$4Hk-?*)|JA{ZnFZl-Q;!h{_=&%(#(1;ncH{!|0??V`VEA^=J{oDxQI#D;vI zzA>19SICrl#vl1`IrP#PSNEC6J4i6}E#MjE!R3@|73uJ!8XpUDC5uFkUAy(!trhQVKSd;mc@(rlXP!NKHz8l#M-b6K%foxxBE2jY0 z2`IB>^{YMnX=xd~62OiZ^PgM*DoK$r8!HRrC-OGAohJ5+U@0ew*@PnsBCYDe2D}_1 zl5P@4Ms`>{cv!3B0WqFJWo6cRR_D9ByOBK5D1KexF5zzanT-gX3e#44?T9dxJk3qr zpKk*ux=W+{GD`fC(82600n<8;Yo1Yu$7)-ll^Z4hT98W&5`uPso|*vIj>*HYzK3P1 zs+P{VBTI)*e&)HRh_m>WdS6U%B0AUnbW=q1i#?}srNiEV^_%TiP3yA``}2;g8{qhL zgfW*m{@5PxdI#|L;rxKBN5$a|E5l|JUH!oeV&ntN*9{8$>E(y|mHvE;HpsMM#Xp(lk|1|%TAAHO%qbpb8|k>Dd~jZGC3GoI zH^Zet&$Biv&o?$Y-$B8dw|dM}37pbGrzJ`49T@E!u`8PHln5(3OG{hx$kjy5FbimR z=E%5aWhRYJOvuC@d`ifVQdW*Jn49O)#FnZ7bRtt&Rn9^ys;J+vVDBQDn2O% zplfUl5{!&9n-U+bkAI(-)+tMG(k?mqGEvC7J)75Tofx{FyHR=fSEm7XZG91AX=!O~ z9Vmnd2nc_VoO#CmaSL7EFLV!=QY|X1WA@p?Nd#)U8cR63_?#?sxvB{qbJ`>MZ?vDX{ZK&B8=nERUqnhY+y1r|pzm$Dmzei3lJ3VzH zB$1;1qbh5rlowK&b>tiO88^+~E@;5*G$e@3hD6jmuc}C6LcT;sWc_E0fz>6VtiNbq zR_BYO1DD#*`IYTkxq0OmE?29D&a{ZJleCq8wtS0^nyeZ7AM5R1bY>mlu`J{3s`AQ9 zh2`s?tV?H{(hOSTU)S1oNQj6(!)?_B$dwZ$EX$2#elUjeGt9T~ynEo6@=JY;V$cpIe z04 zvgtYZ_XSnETvU{o+p{6%_STR`H$ia$Yo_}=Fc2~D2GaqXz|qCirq}b8m#(Fb;FC-I z1?ESdH&m}y(sGz*-P&stOz3_fKw*O_CLnxELZG>iHzjN1VeD!e?CjaY7c_@A*LZvb zlRNymb#)GlRn=`y7Sm+jgYOpc<0mWgF(xaRO|~C-{)TwI0LP=;P=ArtfO%v@`mSdS z>dNwo%jukTK`x+~XAL8mV7 z@A7QSJ4p%DK6r;i&Pzg;g*c`>v9==rb_iSGt5zdP){hscb&Os+)mdzV1BpS^cD|3@ zyv$24q|`q3v&*^CdcuhYrtc8W11E4e%pxF{KnTs1X6|XnW_QoZ&qVNjIa9DFZ=x4u zci1uHc5D8-m?VlzaiZx#gyw3$^g6?Xv5_CBCK{Zsw-d#hY?lT$X3^}a6`&AAx^V?c z;^C;-*YrpZG?hFk<~Iwkv(pyU1fvd5F6GXR@5M^Jl5RkynI7+*I%{^lo(|97-5ra#Y&k)M93fGPCK5J0$5xK;` zx}47K?^i7^)pzf~-H;`^CQENW_glSwqD zU@OG8d3$Y|?Q=arpG2aDvRA9&>IZ$WlbpJ?rkWZYwl!W%7@3<*$7RO>!Lez2- z8}mqAb0e)BfctLYWrO#A$csX-{3!7#zs&$VaC-yu|EMN{zm==9nQtTOuHSjYba!U zbhx8Qs2LH7=@LgCB-4NaPFbjwisaan))h;K$h3p;6u3XsM>lwnISW4$_usSkD8BG+ zqFl+T%AT7-tilrraP7pTwlq~SaB!>$7sNtX_skTr>gs*y~iSVfXDMn_U)CkW9}zN&<5sSy3YkdZ2Im3w#gv3YEnK*tHz94+;V>N;#1QX z(88JSwWo1*R#v|{U~?&$@d1TqY*95^gIpnvjiCI|d>J!{YN-*-l3Ju9X1k~mP;o$M z_Wh);$b8g3IftR>v#=`V+b60S?r`2sih0LIRF*@L@$kerd~U@T=QURl3Ls69whJkX z4NDM{vztA$Zx*M0Y0D@6MGpw0+WgP^`|LjfnuKb}qwgU>@!?x9C_c~wuc-*6iJar% zCfUP(2$5B@Y8#1hGJOT@0|vSz2iDcl7(zPGXcac2LG!-5Oo}V-ngMYY>tCnQprd9F zS`Q$GGfTy(xoXW$6Q~l91<0hrVb{{l54JEj6|3D7Zzsb{B4m+I!RIh#x3S7RtCXnT z3oE`(E8WfTrDR6$B$yvklKCD{XoK-k_fsmqX{XNA8VS#}|KCkCC<}-*QSW4cVn(8& zAOTc5^e7;HLu0=$5QrnM&Eqr3kVikYIbksaPFnsyo8_61X{lP8zyPE!#5f8Sn-If3Skj%J32 zmC1Cq5m}53&r7JH`F5v!*x|TgxLf4FEXZF%%7=E0_c*fWm;ZB;$9A`%`L9xc~4e4g9 z-VZBQ#b%dRC%v;Jb&ndlRo&y+G9)qLx8yEl9u}^^r7f+=5t+MHb*X6B09@xJmS@@5 zuXYZI4ma2g52DOdk}lFbALxH}s_M&hpA+94j%(M_n;fSfZZbW^JlQL1HUJWJm}YyU zRwvKv&t+Y8T^IA#_4K#%j>gSnOxE1xXP!+je`&)Y3r##@-5fG9)UV8A%Q=OV<1$bs z1_TEOZVW=^8k|4tk^GTgwlEzwkxu<^e0X+lzxfH0mRyJGm>GHH`lM}# zmAGw;UlvC?j~Pa`juhTkuoJ>0Z4^neRWv+&P1y)AtZuzInR(-!pknz?E}$L9<&w{- zFEc^3uk7&9mhIrk`##E)ICYv&=c>l=CWJAQ(lAmbA|OBzcKzjNm%;N##*Fv6Wc7-C zbnwp(FEJL6pIt|Zc@cHa$OO$s#Gd^LvNE{paM+c^;a;jNT6?B}!NHNhe92s|x91-z z3@=B4ukUY>P2OkKNmaV-;6HxS`Acm@iDqTE>#xm(i9`l(n%@$+&q#;VrKc1|(;&>KBkg47fm45>7ZuRUmO74E(u}iltGvGuW)p{ryDk+Av5S|^SFo8+_=AQNX9_ z9j7Zox~p8cX2S-z-*Ie&Oih$#=>|-*)+QsCrpK`!)63 z-9mz=$4rvuq&@lanpxWmk$P<JeNV={`~s2 zmiLrmt-9;8-FZ|1Mce)0x{o=#KU#Fe)GYNXR9GxOpil)WZ1K+C(qO>IACm5w@-&-2}%t;CdeB*NC+&ceY(Zck_UQ-U=g zqgU3&DA#8++PBQ%Bp$oX8{+el(!dSAU-pOQ_uf?t5of^OH+`37yw4m1nP|woFKe&r zuGPAz)Wq%XZ!kx`Cbjsv&*iYX8%JZD?T4cYAHz&u)tX1lR(to|948K-!Y*6M2~)@I z9+SFG`DhR8kWYh2Dio9y{Upd@K)ByNt$G?_9wFsM~IlV8N;!rnKJoXNWwb`G}gQv|` z&WF8G$80+uOVM1t+loKp5*WG8#Mo1^fYz7wsyypAd&MBlSq!Bz7bUIN&}H!OxkB+|{&MLlg8A;}cMuqV+Pj+qqlsIYE}!MQElBPTl`stJ< zMJ6Vb95+@Lyhrp1bf%4`QEj|O2mvzh3soYF4DfS;prTZfc-5H0;OY%Xn3?XY4fP&Y z-gg(LR5Gb=XuKjhJDtN9Zn%@FF8j47PgMKHTp^$dsYq>(2@!eVsjCBaw^dpV+c)!E z?~T)v>-Vl-xXq`Qt=%;9vU`xv=5pygRb`@-kzupFu2XjP)1$pCcmb+& z5=v^JZ0@lZi^Q_;zmq*>)42;C%sW5sPws)2_p%3qo2gTGceazv23S(+~XlqLWG52CAG8H@twp-z{&RS3L};DnUyQaeQ4sE4MWs z(!F%xM!r|>V)X*i=IR)NnUz4ta}z~gm-#~d6Oa3)myk=iZeB7)NokJ9jgSko#%wrd z{YAxUgy(4i@yFWL$ntLe2R%>uR8RaF*3{mWziVU@6} zHGo@r8jn#{gHa$#GPIs&Y?Kot-@(`gNg};pjO1~HnF3ySUI{<^3A5jrVVq&_?PQ0%g-y$Y|xvb(=A&!{zuVnRyNyAW~b~~cIeE7aqq5p4Mnmh{Mf5-=&x7jaawCM{~4jVjV`-sZ-2lA|&M^?XEW_v)xryP##$`hLMmr zs(ZwB$)5bD%Uq6=9n)9mA^co1f`|3^K5iPGqR-eLzgxBMH^w5sF(w`A`9~%CBd}YT zYE()!$ky&uTt6EB9Kkndo+F_R46wFatV=#jK5zXdYBWHO*diqP^ZX|XmBKAb!fd=PH zSHZ3>peqA?i?93b_(Z>&$aN*Dzx$;s-Eg?w7x$W_Bl_XW*Y{nQkE8Rlh8T(1+bbnu zqq-cKM?sU=OZUS8A^Ij>=ErBecr0J-mb$!;$K3T^+%P-Z7jd(pY%HvI27eYV4=X_v z#yZUgJ4121vv=B_!t1t}@fzOkuIILm@{mv6)}bM7$Jln-9HF{$Z{dM5 zveQFeZMLM$Zl!Z`)7{y9o?+XLbM084YjC=dX=nAA&Z+O|Dj%DPFUNX!md45KeQE0~ z7d!l;0y5G>sJ^2HgVzpI*HmesHlKJxs|g?FlKn|+by|v>8xY=O^1jnKHbHStw+yR{-0uQz z9+MuCnxDR}a)z)Q55YgKCD$7+yy90beT7KTjaeged^R>O@Bu96;Ss)nyHm{P{b&c7 z%jI&Z=J6_cG1QAL$M*`H-!4iEXYXdmCyd}-Glie-&sVT+4VFcQW4g~mSUeUJE7zg0E5Tmw z&t0}?hVuD*_c||3Wt}kdUt)J72xz>->&N$5~b|dqMfp?4)Td zJs6Ur`^Kf#U^b_!bapQXzigGf>+Ef#6%OxLf9N>}dj?eOn!8*EbTDXh8ZUY^IT&*Q z5F%icdc+WQ-_2a5_hXVAajtns>69Y_n>Wg;(!blm{B&N{ZaXklwb6O9X}gp&>rkNj zYdd+dT%auWIg*?n%$4L@$rPf*#FJlnl@R$C{1bu^lG^Wuf5c|Cf2LUlUK zZ2o9n#tl>lYqcJkA>U}vks++)>*rsi&uYihF?LDbxvB>$Hi!$u%-G$bj)2!9Ef-?= zI-cg%6ZyW!NXT-|=3W%;7D;m<5~{4X|1N^9_VUt{c9}}B?ezDCAWzLiUhc0-Yub$y zBkJC+6H8cLf625Tl%sy(n58;zcU|yK(7A~T@ARf109;3rV|Up-7@so!vcE`CywKFz z4Y4P-zphMK>6g)fR^jtmcg`C5F}%rq6NN7OF0yNz-f+61?y7xkvxQ0Mx!h15`YSKX zGyA3<-(~${WQuyye(Z?HsE<`|hAQ_I+2sTs<@-aiA^SS3=a})73uC7qsPHg{==R%G zr~PY@Cvi5jy~_hIGQ|6f3Q;6vi1p27i%pjpRwj$L2dZIP-jyOXS7yJq>SU>e36A$^ zggJ&}l8@1F09O%rd+!}?XrfHZ6_O`|$f@YYRxhO9T^ley|7~;7JK_s=SNo0soSWBFdID#Haj8o*xCrTGlI z(aw^tKfE0mN%F2_ddnRLtv;skN4ELCy-KH~oXa>db{ee&frB=9Hl03;-t}v)qxD>O z3~&A*LnPq1im20_>Us%znlw7h$QAi=zDSXd_%AW6s|{ndKj!npPpXdb*!l|G5`+6^W)^%UdGxNe|BF^vY>!R z{`v>n&?sU@+gy#WYSUe^$G#eFp7beqCZ)ISn~5^bjKw@O687@KAu--4VG$^Svlbv( ziJyJMwBOS{5vz#(W1JCC@KyaI2++DMWD)lW{$7Tan;1IW(!KW4THv^xf_TNp;{=v3 z%`61kG=EVM`uG6pEttt^fJBQdPuF};Pt3GCZ(tiXUbd9%(rO>NR01g8x{b)VB8^%< zL`&;LPD9JF=2`C=ox2SD^6^0s@+?1-R-t&yx+s|(lGqn}wQS3ix&5-`{)!c2D zOYp;3y-oY|IvOc_XSZyg-2dd@35@>`M4T!@gevG>#@w7Nx4*>jNwj>xUdR#H#wVPc z!8K@FX>z_)uTOoiZ27%$$H>=Rl6S}vxVq664uUg2{{u|XPox8W1K}n3IE5tQR6uwg zC@Czpl z7@59KJ}p~I-EqQiu5Ik>t=xE8WnrO6b^n^O>PYKKu(JrfGLPXFW&K;gsA}>!}34MbqibxLMoYD*gFu z$Y1DzU{Ow2S@Dnq(=;lbu5s6gAVmSS?$G{FWLbSwYccmb9>h5U^fK1(%k~STddC4_b*V#>1GZ?-`&eOCS`o;02{zSuJrxwy=&- zG)ebo7|ff(f-cc-9PNF|){w(I&S8TSJ07bJyf7B%(7!=f_8+MjYCyGRyC2q@1_UGg zuzXNmIIk`Pfk;DsET0{Qgng|Y~j8$??If4wO?Cn;YX74+H>=w#lg z%ENDzEXqd(-K5NG&BVZ>bWXM1)Yj)j|AQsoH8$SG7<@;e+^_f!ld+6e=}^23_LA|| zZ=_RIj^BE|+fEkTU)5#1G(WBKH}wyrX1lYsWSQly;&^AVK7SvevMsIQJO|%p8P+7u z^-O-zN`!kr8Rr^Efy{R^NR2+07UFau8Ae@%eVi>$?x5bF_5F8q<4Z=aRH532<*nHF zbjhT7*7kcUu03O{y~cLy{snl`M+Mc|&6(&wqPm8ppYJY~4<9QlUOS9@)^L8(qkOHf zQTw$uu59szuG8NjU2_k~R{?GKLQ>{Ee#1#u&EL&Cf%uW-@M2N6*jo<%*pSdo!!8eOE`uDg! z>!}6Kv9>%vB0=(iLP~weG)wi>T}@~@0?lTU|3lc7Jrh)LodwAhSudZc zc0i<(^iO6ZPgL-Ix)tDt1k!2p-)I+qDr_`<-?Cdv+HL6R6AXFrdA#U!c{fD+XW_18 zuJU-EuPu=w{fA0Gzv9QvL2`&%%=;&BDB?x@&?})NemBe3pbOuf3NGmeZ;G91gN--E zt(PiMw4l&}2HrzFg2ha{XszaZPf2xYHv#$x%d2a}nhzsv}z;dFu$A%w3Q%>OfGmW_hcuA2M| z+a2;iMH!m*YEcC@5U4a3c?q-wAhb&=9L{eP#vY`S*ucD(Ar9I9af4L*4N7z z*h9YgNy%``EcWK5>Z?A}H`MfNfoKgjYG(4fr&9h_QvSg(|ABio8klT>UnQw6#zhYf zJz__cj)i>z+>?T95^?M*w_-+-dtZWRzF;w3v(2V5V#A^&s+_NB>n>~QLN%E2)LiCi z{`w1^B0hLh>Yj7R5%boVwf>!A$bU!_=k5uRb_?OIRj^E((e7j6KbHNGNfirw|C%lBf|UqQH?it}Qd{|Do|MgQ0WXj@ROJOavzKN?a_hJT8 zU{J*QLD_%YO;x$RtLnl!-`zPoHxy0IAgJP>r-G{8{$0W)tGfH&G0nac(2tDXd;MUJ zlL{!umvDU;|LD>8=9%NVDA>5t?GmyFDXkHzH7NbXh~fWn{ZyS2^;yoqkvKxLAK9FB zkR(1vVzW*LXm_Ng3UNx{q+W#~okkQJ4nK|%4lgnMaZcjF6xS7amhwio zZc&s!mgi%6`>tgF329X~)m&aoMdTF68`7MRgd^}-IJOw~_he7O@@WL>}*+ zKqkiJwLf~t2yEljWje9a5<>jz82&{mv7S!{oT^jP%1)EWKe_98rHZIcV=|Gy`!;?- zoYNvk(jGvlVu2qvJ~A{E#zazHR7eEQDCdQ%%=nRI!9{#}m2hNz4)NP=O@m#qwAk5f zi0p!enf#nbnxASEx@Hv0eW*KvISDrMWq`g{UAt;k*PKspS#UabCTh1T{wc;_k0Vff z1oHyhfA^dd=Q|``G1bMDo{MXVanD~G3^Lv^C&tEWM@0ZiObCCG9hHm>yc`Ivwyt6? zEoqp|O$PffT)a}lZeCO`vm;D75cw|7xI(6)6PBRrD^^d1PL2>lDVxt*yMj}NdZo%5 za2FSnVH+?TloDh$H|h^wIM3y3%9dvDQFtZ;P4NXj8rIin*QfsN)cZak2^QPt)=D%# zwV?is+H@|d;o3KX!<5-V3``fNGNtzBz6)F;wSU~*a@udJf>SBaI?jXkKqVlkP)yEv z%+m$;aw>}QGD#vN?BAaD`~|jGnm|3pamkxvmq=0#fBY5{qgU{KQ&1XD5G( zJ)D8si*-A(P**6LyEa&mCn;IfX$pgK+O3>=Wqca!Ny8|rENX+(#Y@@cFeaKSvDfa$ z>%_YM)(Q#z*Fqk%F@ta8 zK=m4znX+Sx@W38#jE0lGqYP#RIq?781pF&}rGxlJpzy_1D&zbtF?U5;dM#QQk)rAw zEld?11?i8}#jr={C#1-$P@0q-=$DKA>51z?+a4xbo7LQB?(CU!UGYMKIaPZpkqD9R zH;85T#mTc|-P1gi@RE(#D@!QNj$1{g7{bisyUdKcT%M54d6u_J$LjcBR$C~sid^;v zRpsuFI!+vlx-`Sj$Efb-)ZA&r|M6iS4Uo1#g2n=p>>hBxe2Rk2wkQ%Yg+Bx{Ocbg1WLnPDZ)vA`ig!XL1Utw$`Np%=Q=y( zJ}^-SfS=IO%_7H39UQjiMirF}bIiAQg_JdDSBSva4aLm212xZNjZBSQk1@TW zRP+1oV<+7f=eK=V?M_Yp(#tT`7{!WOp$}<7@D<$H6Ip#l}#pVhz(&*p)DzyxZ$(Kir^+CsDq1Ql~p?Chp@p(BftYe2^#{zQFy)NwM zbJ~j2CMh=wp(2=|Lz_#;xeMqHQOWy>}sN0L-4S|VX*pYhC5iG7obLBINx17^RvCaAhi%u4mce6i!Ja((cm zD9H&%5_a@Io@-8Zu>i|CdjwGwPj6=7e;cWnD=HAvLeM}v{^I$8I#b!lBbQWqJuB05 zG1;5_iajO$#Py^-R}Bko3yr)ka9!e|l|qH?lFnZ^v;)L+#V!@Ut(S;ESKLHS z^623ztlse5N|PjVpVB@fcv*VJr54l-K5Z}{UJ{KTT?=djtaDh?QYyXoD1bSc#C z>)Pz;$>_^eC!ln{#(dE6v_zwvn@L-1Tv~GyeM!xRJ^!SdUX^Oiolbmcq+!c;G0xnAn~c=LFa-v0s#KH<#*OYg!E~Vg)*H z4j!%Gt}t1+ax1^Tl$U86a@K7X&GVr6Hz9BV#Zm8GR6137tqLEGX9YHMQiu?&G4B@A z2l}&E8F`rB!dpMqTKc2c#?IIBjrM-pw%wiOuCJc)=M#cLGPZO4vsA2-xXXo#+gg|{ z(Zl(>=?AFnbk=5RBK~W^7$)DmW526VafTeGvta&B1X4)*|Hs^02F2M0;esSUfZ!h7 z-3bI3+$~rjgF|q43r=u?JHa)$y9Xz@y9Eg_xI5f8A>X}QwfDzX?cS=LU&FjFNBf-9 z{dD(p#8MJ{cuK@!vp5)vWliYf>%hrqX-Fd;=q@5kf^eocx#oRECN|ACZB)Dq9WV51 z-XZ62g&EtU&|4ufq% zc?!HrtKdV6Ca&QrPb&^eF#%hJ$%=w}?2H^*(Mt1nOQDtGTT^XMkDzrg)4H^>6cuoM zd!^Im34t|>70n(su+Ot8wQfJeXQVmKE_9`vvFuR;vLrnJu(9QY>3_hY&HF1l+{zk$ zVWmZSk|oX15d-v5pN3DR+{4m&R5`U>@M)(IndGp$9u!9G;z1%Rtw#@OG+W79kHn8v zq|+{%2*H((p~r5kr2dIT?5N>$5YS+jpy*2$xSMz3rZ`R*0Oss@?CuO&6~D5N){lDAlfQ z$Ko854RYBeSGzsjM&hhGxw$x-jkai#s7?RwN1{Lnug=H3fG ze0^4m+5&BbRI7Uw`iANgrG1q{6Sl}*H-v#}l(5}q7%plh|D7h=z7z$q^XgMG(-UX; z`T+-uzu85_3MJ^9AwG$W@?UsxS;Hio8YkhU_3M5@<4qn zBv*t6xII%p34O_AvA&cyp9Ap4Q9dt8-}x?b_4wVvHe9-CEM{|h-=~f@0uJ@@4sC}Q zukQdPn&kw1>#m9Gfno($>&~F>^?F2m|H#8f!GibG-2GBl`5B4mcYb?0>9!nl{?XR$ zOE!=9)!U7U2_l-l)8TJuy$_YzY+s6com_MJ*=rATyZ0XCpAEXFyBi_Yka26EpXF3j z3NM_wgAUOCoxgS!n?EJ5JEgZn4>RnV-0P&b4Q!h3iqiRp?^s5dg6jO7cjQonrb2io zzO1(wkRo0k`NexDeitOVO_k!z!okXAuN~#=@edwUDa8G{|HGR*D3Q+R5@Dg3L;OI@ z69O4`K=z1(_*oeL4v9cbuEI0h)ON^Ty)g(9A_%HR#5&{bH1yJOM`o~{t2vGLJ|odC zKU5v?#=0W-IOM(mw0HUr%VizObe+=S@>O+n%_;@)Anpj$hG4IjJ+ojBi}%oHHqpR5 zhLxaqFvSFgl{dqU7T1w%iK#sXa`t^5HYHM*mlJilcqcBAL_MbYiF`iRqR$f8< z5ghEodMn~V!YM((?x9p~c*ysdv)!|ev?VChn+9BQr&jIwk>D$@SK1M=>@eZkxY|nw{QPQLI8P_m`?q!>e=!Tg@;B zI8L~>AN5%oT#qhw(;sHNAFk&J6!>!$`f~d!n$j|CZVt|Y>t4_<8f|6*wnHMxZTLLa zZ%O3%AB#3XE>~4kU{xEIJI7laK_L=oeRWj+%_4-=mh%SYAm{f{O#=r{Um%_zw+QM+ zyuMp@L?~*yU43)Y%ZPqxKHu3dx#I1av0QDqxnhV@X^Q<295_KXy_~>dzq91oACjo+ zu-ud5R-Sy`=W1o%iz%|ixopUuFUz|^w$x(Wc+Iwxw6X&peO!f6Be}meoCh})$fZtg zS;I{CyrvpGT&g7U&M1dGT=fh{x7#GFi3-X_(0>txbGf=dAlYKgrKy2cTMqUs@_rOG z?e)o7QlpIc5@9@KkbDy9Z5c?`nuY8$Gd=yW+n#o0X>ML9&^ZD{(wM}_U{=|CDsR1> zK)`F`hZP1V9I$+mDN}#BA8w8>moqVW+_(V2V-+j{~ zFQi@z$*{FfxyCTPJExXwcNDpp4JIQ)IQ;OynEsW3C=!Gv`5Nq9NqDYA;B_k9mBGh! z@Aa|Dp}s6%o8x|wil}$>L*35`R@M5SKN0kNEoO=6#S)$t} zV%C8g9{9P-bKM_g?0n!gvfd{?oH@EbI(Y>( zDZyuMY3HSQxWqGWQz$X#1Bf2zYv*zU(2u7oVy}l;-Ip~1sIoH$ z#bL2S^JJE*%9-H=0yu&)x0hX4ZcT#o=dR1W$RpUMh!sufa0Iho<1yci=}v^LJVY7C zSuJg9eR=1z(8`wIXPG;mt^{(2Le&Xtu3yjqRJYyCd; zPoUL2DfxXO4z*osXl$`U;#kQ4Yq`Ziv$a4=u}b?wi?>7}biSksKBPr)R_v<}@<8=-#+m9pU^UYceInXSfUUAhq9LN!Kww(K~y^k6*xO%)R z#5;2j|K|RPsJo7Ohjk9x3<^vJTdkh%(Vd|PUWBLM9(72@U+vDOOmDBv=NgIT+EtIl3*!qB+oBld|k|Pt|(=PS@F4N!MkWGCDRbel^Q_@~gLw^MP#8lj+YX z*Qa?rW2NJ;wP4IkmgbGs-?ca~YlYClN{{9J!G@HwWmZ9z#6pT1^@1}#-7N zRiRZ?sHI*Ee!3kq=I#D~>|ps6UpC|n*@geu2(3L^AU!~hkM&5(ah%R;5-#I?>f*)* z2?>6x$yDja3Dh9GzlaJw?x+Uqf!x(;QU0o%{qapKTxD=f1X09HU!TXt{S6H9D#PaVs&C!l?FJ>1annTEEqCOMa4bHU+k`DZr->-5S z!i1P&zRr=!ge)hUgQfsI@Xg+bpZ6`7x8XmWUu!6Ac!*4d$L>$*v=>e407hM>f75{4 zYMK*Zr5_;tXAD#S8K(CpX-V>{nWUX0QfM1%d8d!z*!>kbCHn~kk8S-d$q*FYERXN2 zc5`MAeUaRonnAxE4`(VJIVcuzdP@{%e^9|g=R%2Q%V*ULGq$onrecw zNDn6*QD%=pIb-0L<9lZcTBh?6n+ucfUL_=3I1cA4Zld!YC)OG_wPn+n=ljz{8oZDV zD~wwTVE4mX>+LgW`?G5=rY|OL&AvFE=7P-4JOz6{0-Q z?SNvkM_sW|?oDv(@QxU?y`#8(-1#aLG#;3{CWHjfrGcCBOIx#fRHJ9&%<^7?;F%uCQ8Tlz44a`$9|Ehl`+(tjCNW4a+ z29a@8O{6;`k(0fkt6d-XN?o`sB}pe1{t*W)SzyWw%_b08(a7@J`RL|?=Nuu z95@QDVUYTRGIs1=A^1Hh(I*&A*q?ON`#8oMO;4%(R8fL5 z$gkc%8}NLguA8#sxX(ibHC9M5(Pu}ytW_&{F6Ww;6PdY>fOSfP{3Nlh==nzB^Eo^$ zvI3od`By|n>R?X=8cGUAE~({ajok2CNOGJRMx%4?psm!dw7w~D&7vuA@nSF4-c4j# zU)tD!UxXP_kFE2U7-yVrR>$i%CmR<$i1cr?D?g3w-Ajxrb-9Z$1WkvZ+b$KbWpgEQ znY=(1DbqOKb_E_{2Guza7nGOgIbG1j&Z{f({>gd-Quw6ZcGw(MY#t3ZWF30UrRSFt zyHz25?*Cx{pB;zHL^W^FYSP?ef2)ByOwv9-p|Q}4-tTGCbku)_SI9yoLtuw_y2V3? zJR9p%S|fRoOyzU6r6FA&X+E6F@ND*r3&SpVWjq$FwVd%8d#i47VN*S{0>&ws8;2}x zj&Ddj{(?Nx5XB#1gSqw9PKLQMju%*DLLxsd&K{wADqn5L;I6QLn#=MhbngEsNa8x3 znOi1N!t-NYbnb+v#cMw@??)~rQ7<+bg|DHQn(({x+-PAlPdTdrm7jdg=-uN-rz`8S z8W}dO$A`$eJl%)L3RZQ;7pSe?g+C>`}G7HQ2D_U;MP~C z@n|dKT@_2sMAyREHZ_&U5&lKH!plD)=}`C>j-Sa;e& z?0sVjUD6j{p@1rzqL~AiY-i_YY1oI=Y!`n@4ko{#Qa%LLUywLrSh!hY=lmV4us?(4 zC}^@UC7A9U`Q-Ikd!7QtneU)S>8|ZLFv`qcfKVAoq+k323b=+e*0BH-?7V|r216#W7enS8ROl4GoO zmv7=d1<~E`{p_b*{N~xN2P|4V()pv)e3Nep3(ej(y{Wt!o>OmY+<{YD zxlinB_^CjaC298g=Zsfn`fx) zMS4g2vj;ckvji-U7pYuVyXLv6BozFrrSZXAzwX5)2Ye_gUf;)I#<85g34KK&zbaOh zB4ArGoi$kjH{xkMo_Q3$qll(O2HTU?yY!H@{pfm|RS(0RW`qfFLBZ=*cRdqd< zBB`gBN^KhyxVa2?o}XTMll7l#DVJuqX;HM<`U!_GMNRaszbf{B>cn)GS}v*nJ8Zg`Jd5K zNCm|OC6DF`j`$|6g7v_amnYY!g9iab8^n}#?lxOwK{b!KG|3o$=p5$SFLdc9H;LTP zq~GmDXuSF_p6c^aB#`SY^T%8IOjse%iXiEb>h#j5{XCmz3ns(H_xt)i3^F0;SDJli zBHvsHF{F|Baox9G;01T4IR7lP5DI0-w%aucUBUZ=<8|V2$!&Upiy@t8H^>;Y^5pGdaAD6 zzMJ|(59nTuVk4r?LRZ?b!1dy$NrylW@{8XR>XcV$)FMJe) zg_%U6Dadc39lFY~dG%nr$(Zd!r;6a768E|yxqdMK7oAjY(eravguQnSm)zAb4CIDR z76YfiKUPb@*opRt%Gz=oFAXCyo3gDjglT3!WQrxA@Ued^-gVTbSG+kPYEpp=6&BD~0xY@%p&=Ly13H z6ntY?iGh`6x7r-6`%Y^BPIrVO6H-OfIEwI|ax*3Y_kzG5Ga9eUE!G)+PcGSP*ZTdTk$5EJ_%VQtc0f z+vKj1AajYZ$7oWjQ3nIa zc+p3DWW6t_FLHN~9NVOir*Ux<&|f2y{SeiNlfp!w&k`Jm7K;|PQwdK)izW(WnT2vI zW3KW`v(dkAimG=O7d2@kwQl$sD+EFKEkS!5ILp-}j=q!`92toDL2NU^z71hJP}$4b zGCW%dd3C??_}3sUewingCJ2>IZZDi!U-B3^Xe%oK0nD{Pwx0S?SR+K|`Uun~ZzYLO z_s90Y>pHC<%6@Re3^e|%*LN^@3uvO1=Bftaa@+|eRD^-#3J(rd%~4m zg%6jilVx1-#0JV^Kw6REW(&XV+-HRA#9{1{s~<#!TL`3(OY92=HyWqF6Kx;?Y*Qfw z4d8VT%#v2RhA$%?!b_Q!oHX6Yy<%jtFL{z{AMo{If~zYMAZNR!9X5GX zJBI8^s<<0DCkJmRqd^+1GbXT_z^28OpuT>I01UZX4Ox#Zp&0w+HV}qH!THB%fCEC` z&P~hz^+v;bl-&<_}SL6wy6o9aVYrAuKacZymm(<+;@~5gYZFH z8y3g7`xc^Ufj5?0Et>>>?uSMq zo`^$830WNn5c+9M73tEyWOonf5lm&y%Y?m(oD$NlN8b+VM}UoYK+&98}4%hz0{{c}fhYQoT55D0CB+f;LWC2{}1AFlg^VUY`b0 zE$PoLh=`F7=bY+lkp$0!LLMDlOyHawjqx86^9Qi%9N(0sfs4E?_w5`Zl@zaFMbKvS zW2^GZ%tRwSZI%w~M+pwzhw@#QQ>+LfoPR-!CRXzzw;!dD$Y(=NP24v4)mJ&Pj%k=8 zbunOHb@5x5Q!9br$+ig&=J=xM2|q5ribn1L{rRLofRZuiUO*g;V18cxqq7hu0tUr- zP1|?uYbMFD`FXPzf+Q)7y?S!AKAYOF(T4z&lfA=)A`(qyEG*-nAPYSa!e!GNlpZ_e z5J!|{fSxDrzf*=a%hL@rf?5}}dzqH=x(Vm@7vX&~$8{((ZKtniEA@3^UIIB|H}X9e z;XL}|*YL+;P+UM(1>b$-YUc^Ij3<<>ZD6qS3#_d#ZTu9;KI?M6AI$g_JCN~zzbcAM zAc&JuVzqBUKo(!^$5Sd5N{A-(^vk2*=aPz>%u^n9kQ4<;QDeS~dG|8pjUUv)`W-b_ z;JaZi1c&Na_p3u#L}(0kHmsa};Ni|;0&f=-lE(N+?@xFj=K4^SS!jkdsI0>d z&CCd(lra5YiimYA85&cxT`|+QE+?!y^><5rV1biQ~jvXZUiWy z0HER&dZ~$xjXl51%S00zi~jcz(GyC=vqw}#vZX-0mAmoNU}AIo~fo$x|D465J61PaA{EemsDL^I<02iY5L6)~Q1QOfRd3Q~S; z!)OX#U+=DHYWq?#_FcS^Z}wPW=aPBOiZ(AqBeCHRN$iiGIQp?#qdld*=B5`3jHZ!hT|VM~NAdTZ-e z11XZ>o#Q0KGstV9V(0~ke(W8p;K_E49jpG3BYo2InMSS{`_k>Ym@&~bfCCbB{=?wJ zPO!faErA7W*%2Io$qmEkXgd0rD5+bx+(Ckf>}jR{eyCk+k#K85Q#9@?!lqU zi1q*(6_;OEv8Ur<(so!7WKXj%|0o%cQa(!06Y=7YT>fDs+ces#Nez>CCU|cFL^u@_ zXi!#Ft$WDkS$oU!sZ86!{7*utV1RfDSZ{yyew%D@_e<(AOMp1J?V^8EG!idLG=`GU z$+weC@f?mU>rAejj;0U@KF)IBSNq~Kda*`E80f$sjNwjBE@~?T9|02HPRZOs-Nhqc z_g~vVB}^i(pO=jyMNr)9YWT8Y48!FkML1#aM+%m%WG!GMAB5*ji@GOXj%?gcE*XK1 zq628=d}ij8q?s^K96o%RnVvncu`7No15yig!fsR6cGQG}_KA2OduHI6U}8`V3@meN zgxWukd9VfYEpcv9(8`@lwqCPmJLqUjnWWSFS_~mHw2$INkwDUmn%~(^ z_SYCZGKs5aYc}%j-_N-2M7k8m$m-k577pP9qK85`NlneX2GR2<6eUZ>SPe}~ocf1v z?e8uZW{zL97)uZ?1E!sSf@9q(a1J;h+!k4EdziAOilk=mF2Y$Pg$ELDQ{@@+Q?jcg9?2l#^ zQY?;NlX1}F&?iW`uu!up)?=EeI55anc^V&QSGH3(DS2qP8q=;@bcr0QM%&6-M;6>Y zuQV(|*>!_spjjq^^BpZjf=>&T7D{@qWjCf+7m6pa=rZu%G3}=|Iqy8|F3K;1zBYZb zG0{{}v%RtoOlxf|J$P6l<0Jut#cytUU<2YusZ1)IO!bVGGouw_Yc#CPWxlqS#*2pD zwWf?$R#w*4R<@-?(``6iCO4^@oRRt^O^57gs%xsR_F*s>>sW zYs-(cx;Hj5Y1Xx5z`+lry85-~#l(lp34=KoGH|gMK`XP93r#Wc-(0yKtQp|$?jlom zY=OI0T=197k~*gSi$kPQPp5OUL}_B0y-9G7BppU|ac=@#7x?nf{o*GgI%FPH<8EeU z%wA@Bkrf}F(&#bIg3}WLkeD-W+2_V6+?ZnlR_QR(+_HW@VZh7a<0Zj^25^1IyN`O_ zU#D40WG=-M6?2k?FcDx0zx=+73UyUo|lWS@cxbvnA4Kb>V z%r7j=&rSWdS{zoYEz>-m)tjthE5CAebu}|{u|G26Tqimr;M`>sQ4rc2^IdIXj#A65C#~7#-_DL&N`;f=~8^ zS!Rn1D?hWAgCEmgN~$l;Ziwe)R_y3ld+F&#e-G$fS<(4@0asr@&)nwn_M=J;t~KIS zP^l%sA+w?@j*<%Hk%9eItAur#hv{ThfHu<#idqiSKv;C5?k5YA*{VFh*4w#b;kLl7 zW$AMHZ3j&gN#6XXFnh4HaoGL+y;cvu>x{`0P+1hHVrl}(l0FTS zrV|a5K6F}gpX5Dt)Hr-VfNR#p&dAAKhl204zBrNN-XLwA;=8J<4tuEmI_?n5$# ze^p7Io}C>nHCmZi9E^49EY%01q!|)NO5N#Y-LFmUZCzrvqdkwv1t|r^!%8b*BABV? z!EDT$9q;K@4VTMq=Ur;U^T-wmj*KwN%QM$on*`rY+GfR;D0{cNua%$rh38n@tv<*- z7c@l!2M4FBI(uH?zAnI_xI=jaUP>zOoZlJ-vvdd#{3-bRXXEyQ}CnG($Z>c<%ET;@YAQLPpYKBHx&^S#PAm1);Phv)sCEZ^CedyEs z$w)f|hw_3L^s^aT_jLYHkL6#x-|Qb8h!0P@2c>nEq)=s8Y1U#tmlxhKGb2Bx)fy!K z_00Y}qokzNlJi;0GuhO*hEaH_N=izeCEQ26@Cy8Is1p8J_qbH%Xdb`}`m%t1DniZY!LvJZ3b-+-K^ltWRcj>!K${(+&cwbMO$ri5P4z7wk} zrai91=XNe4;l|JM+!@B`o&fn&nkOeS@05m*-n6q;`Ei$!wjRv%TRDL2wI##N+PJ$A z$!NW>9VrS^=bl=eEAn>RClmSv{e^a53kgmBerlHEtJg(iQIs3!v%*caPB+8Km;xcn zcW~d-C=XP+hqlvCXNK!Oua-CEU8IFv=JogsJjFFdkiDJVyM+JSN;N3N{fbGi&VinX zVdupgs`Z{d|YRwW*JhR%MES7vy&UTpv1Q8<6C^G@%mrZn{F9od<_ zY3fVl0RlTnC(u%yZ{0N-aqaDiBk$ZX3#RNI>B^6RjL7^_+ z&ovxPmp7dUB;XcxZiiD#HBlK)2}(6(16SRj>UZ#N^oA--_;m?uu1!_m4|F3~KhGtH z6V9!@em%lq;w7$K)*1PL^CAy^wSokFTRLP}++^P*M1)dDmB7{X64nMS;uM}*NbAnI!=JMf*NNY|ucmLi)p+`@K&;2TXJkFbh zFORNTDJTX{KJ9k?_+&dN35hIy{}$b_jeWe7CphFW zBI>YrA5r=Z)464vhFxFevEl93IM<8<$;RaN=1gLnPJ`oINBiy1%&(ff3S{d5_f>^U zV0E37?b@dtrhAK%D3;XK&y6mcb_~X6bUft>Tt>k$r=jmXyS9(AcufQoK^NgaTNlh@ z_3P44)$w&EPN_~}xpb!51WF}GP=ApezQ;v`lGE2^rhYHMrj>v83L@&e@#mzxvQ z)0qYPb8G6pA0YjGX;=oJCIxgp;JgbB4ZT<8ARa_a!@|bS`~H0Zb!24Z-)h!nceCFf zAqtl`8xuthkT^6!aF-fXz1wZ*iFeX zpA{<~IMKlbrqYsiV? zpU?A!%FfH%9C%c1z?K!ezOMhgM-YEvcg&tP|MRZuw3@p5^Q*^Du^nHsv&qLR827ij zpJxp@ST|7PcSd%!u~ZILChu3W9wdRy6@V%eB%$e?c zT)5UBjVL(~j?$5RXPC5d?^C1Zm}o~^ukYT~WnM)F;-R)IxW zAfm|CQ3&Cs9l#VJoK@MB9Co#ob}G66{W~Xp0q{->PLr!=0rEzZ+F1wqrkCz$(QH=AcUdR%A z92b;JIS#n!-oJ2{NhC^@&YLM`aqi=rUUelilz|gpLaHcK({bI66OZf^lV3IwH8|f? z9pg=N%Fh5!z1|z7GrAOfqsbye(P_7^)yA`}wbM~!hW#Qh(OxF>p>i$a+3s?bZ#xot zQ)r^?8hO19M&^=sf+z>geCGY6PfA7vLh*tyP5^X*zO5R;=ulzYY17a!dtTIC@AM?T)qa zujJeV`P&;YlEKY>%%k)Uv&=T%O+u!r4(L!|BSTWKEj}-CH@hvrE)zcj9r2q7{~F;j zpDELWyaq?kJ%fh_#>cp~tP)0NM|SXpS!J@4yCvZ~)ir3!RgXkcd@s}?5C zEW>2Sl;-C5vS`Z7{Dygsb!3Q#sqU`M(pD8B#P8$+iCa8Ds&h(j@pyrB!sI-I*|3!y zUcXbWEuz{%MZfrYr*7K3X}|fUHj~RTrAi44#kW5WNo_=V3pMgC*Oc^EvqbN@3pyfi z9Gg9Ek{b=_Zlv*Pa!QcOPv+H=0~m;`yQc6s(gOU$JccJ8*6I0SiQ6+c*ITlXLz8`~ zA>{2pNq$RdzZ#<|*L#x7NIYXug?t!PtVp_REoRb++s%8Q(IIT}%Jpd81YURG<=dTM zd@d9ASf8!xsDi3D9QIaS$)SN6@pie?=6Q!m31yRGsgfB1GAx8A3|-<$$z=`!)|!Cm zooQcp|g9Db9ZO$usT($D3CW51TB-{JOG!H7s+s;;1mBf+nU7iAaAp>Vj}z3 zy3uk;Abq$}z=6Hi{f>HIc!Kw9jf4qfG674&pIrwrILuY-Zy}u}4SKz7p)nGeM%yJX zx?Ghm=>-n$shUBwDut|f^cUOo8S@c3IkMziNRZebU{Bh@ntHtP?vY>^Xw<3Bmo?$k zr7Oj8tli4>YX%746cMFWnG?Y>@$Y2Jt7zYE>S4w;rH0fd56=Z^dzKW}KO)g9iF+C_ zyE2N@zcsdRrX9ACX|4IK6f?o7Qit7@$< zt4yird?jM`iqqMpK>1X|tLYZ{Y(86^>|)-Y6h6C;iV~D`iIQ;(CES98s;iE=pGn>) zFYG`|(0;+L{q90iTPxfpG4#PpIa2%xBM1B@q5vlZ%$ZjOn*QvI^x$~r`u>5)O6jre zV?nVd_CX91WDkknO0Cz!W9Q07=bgOJw7pRwZ#O^u_*47C z0s>nwpd$*!PV;G|?GV37e)GZbIK_dbtZTA&%};St%M)#e*@ zxisP0yp_I=Ux{*DZ3S)g7!_aj$FQhg)${f@SLMXoA!~2rFDqmMX#R)@uzgM@whoL{ z+_rwu=ylz5keUcQ<_{dL(jxz3M~_YME0)SrqCP33JOd{B9Ext$c6H$#kPGcf54MO?gVw|9Nw<7%8X40v- zh%#72Ac?7Pww-$AbBrz%&C% zShsI8OT;o5w?<^8yKwS8wlq;04Ukqh7cqMAn7S0)FR?ie3%I^sr{}F!3Ur1!9ZINs zV!@M8nNN^x3>k1Ou^uEPsx=rXnebFB(ySJEv@_pXV-Hev(}{!B{PNh%C`ggPp%UR5 zkAg-1`2mwX@eqf~V$7!aG)&u$=rM;mlF&ijdfCR@|&`WZ_~!SXw-l|3-D=td;OjDTYx`1N2I`uO;CQqpor1ix&?ca z%XIW&i%D)#JY`Ycx2h2$voZQ(F`N`0)2%Tf?HXZA`HS1hX^F4fUGj{&2hIQ<0vQ=i zt0X=@bGV=J`iCjCVQ?Sc3&j>Oz6y`S;cn{UY6rWDElWV0fAE?f!YfG^W5%lY8$iA` zHalWUmd_K_NMtM~?6=)#dyT~Se*pRZd_pV+VFCh?iLSmpD1&*iyP&&tp;=Y8Tg4$c zHB;XH2-)9fg!q*FC^?yL3}D_;Y(^Qb`oVRYUC5diFvUzh9ItW4l=jDn z9V6uP0RVARjPqryf%Ef94+um3hQ+ksA4}3SnfM0^FYpBl>cQH-SWd|MUUr zu@O0c4Gnz;qd)unT=S`Q60Lt(3D{}z@$r9Ofi~<$?;RETJ^Sn1(CG59Hob`{xkYWqhGurAV>*3Dy3jN-0HTrwpLeHhlPdx zXIZ{6T*_@|Xpl>Jm(8Z8w$lxe4lOV9b8)G@QhY`ZOlN@W(%9d=1&3cKB<{TYd_>NqiQ{s|SARQtQB+Z(*ekcczrRppHhC=Cg88o$f3sGyncQ92fyCwZhOF_ z$~d#``Pa-|#VB1;^Rg9Dn&gNFS%KANFRg!NHRumO0w(?0)>uLTAt z^o~gU#k@;6AbM*&@OHatl+s%@K3@t9e)yjW99C1ToNRmMd96adAn4oB4{HFf4 z*7AGB+~Jnir_tx>&lJvGYTDY#M6aC|%EBy^`ymNt(ilW_dBRS2vQB(1r@+L_<#296 zZGL`60BXWE3-hjSc~SmW2A5y@u@C8>+~iqag<1hE)LBVMco4@K@Na1Ch)pmK>=@UaI^Qn0ehYTS9B zKC!L*pHBf~e`O6YxL#@S)HGyxfvE6l9Lcc_?~`La1X$X~>Z~HcsO~l9(=yKuo&p0x z4h9>0d3g=uTr%xji34{I0Yaz*z(*+=x{9<<)c}z5;dy=dm@_cbonk-j?{R)_`qYW%DJdx3CJ$a6O<82^9ZM*Dx{+)F4mRT1y$(XjIJ64p~vs;v0% z>;dperUhre20E-^U}FMwcvuW@uaS3AUD=;)M)QE`?7a%|!o$P=O@1j5lV)UMvbDWk zH#Ju`HWvzd_N_Gx?Q7w2m@PMj1JK&PcX?foR$5(H^5gw_N9s`U%{d%*DBCkxc_sHw z755UDH2;mJo1&UpQgX8XAJ^NuS4swl>5f=P%F>{NgN5uB;oq_pS0@ga=op7=wldML zvVN^p=b_K{+In-ENTm2J6QJ__FdX<1%HFUu| zb4=RUxol9h)Xe5tKNjG@GVTjKQ89yMl+5sE^o{|yump|P4 zU2DDkjNCzSypojc>+IB5VgPmwI(lYi9I&&q^S?C|&0S~TlBk(-qQA!vz;3^JL3J3< zBN8qtK~r-Rko_CN4^*YtPy4*-XW9W*s3;&nJUb95L;pYTEXRv?@7@gzTACM->Bv7Lou9J)Hz@7@Yj^N8p9l?` zuy&IpLa-FaMcQRw0Cbb1>tQwbzlAJ{g8>?+?kz$6AH=<9R8w2~_KUg&5rhp0NEeW< z^xmaP4M+(c=}3!|(3^^ML~7{0SEaWQrT1Q>_YyjR5CQ?-xcBq?$2jAhalX9cJ?9G} zW3aL^*Ict+^LJmjuj`nOsV?A2HgyY|w(-&zp$?^ugVmS+)`LSIsT>;>A3+#V>h0}_ zj+o1hG9ZPw0`f+jn$NHA+uZfrvLAJ}Cwa`LcWBSD;*yxe6jZVFEXXzb-|rJM8IMod z9GLJ1>{oZ#9TBgzZx?E_y?UiSCuZj~mX+$>NISn(sB~3RziF!HrSk)Y3j45%rX>3 z2gc$^G1Jl9;w~NIL=0m|<)7sWTvM6EThjT*Pa__xVh-kgX!4MC(805G&`=w4EU@8h^^KXu7b;JfS(GffN_{(>3o* zoR%&IqjeS-3g>9FrcxAwna~2y@50&iK zrA^xe`p;5HIx&ebGG;)(R?JGsEE}=oD;S+{^S{Rh!L}8pjpE~?&3!>SI-D0#$7`pA-r$t9p$6S6q(oL3tBt&;AeVHOt31HUh8iu>L`_Gd*M6q2q5#4)RJbZW&HV_D$_ z&rYU(Bk}+3^Md9YfhoU_5>~vG!UJCGNUO2a=_{l+A!7$G$RjQ8By!I)J1I4@_`87o zfstaIA$FA2H9!6yT@J|na*6t-LoLEQ!heZSxVx2mfnnyaDkBm#svK)Vs~a?}t=?6p zufANDzPU>LxA70_PX>woSO_@*D`%&-yKlJz0+t<5zW16=a39{B>W1n!X_z!R)w$xO z2M{P}NL^o9k8+s@)vT3#r=mD712lt?X;-16EAn0=f!yFdngqZ4Y1VEhsjXT;|C-{3 z5HTGf-O@?F0Ziv(HQ?yg$kC;8PslMP8o#lDE=06Z;5-&8Kv$ZWm&gs>EWtQ<0uT z+ValUB=kd|<Zul`N|~dQhSH(UKSKu1YhSEC7iG3V@dYOG>tEg? z*miKwOh2sz05@ztIyzKf7XN$7rbjayjpwDF|MB1EL0pAhsQNp562t_=B-e!Kv!U3I z68WiBV!6Biy@_m$(8id``b?p5y>oRClv}$=Ba8Px2VPUU?k?awDas$01eIrG37s;A zQ-lARE~cg)@Xq|ZzL0h975_o;Z$0sT{=Xl#{D02k7>{q7KBA_(gC1Gojivzny!f-2 z6dE}I$Ck?OWU8@q-ne67E^RX z1`@>_;Lhw}8sxsR!>L1l1l@$GU?l26OH^q*FpPn(eUr+q8h!mZr#-dFOYhl^3QNAP zv$mZ;p6!&!hFraeGiSb=9;_jrgZvox9**97>~QSUN_GcbbE^p&?4JNde}3*u>DgOy z7bInK47Q-n8e75T@B*H`e$c`Rd4kkb(}d+M)0@t@A>vE=&75_UUp0@z++HXG>o0Hn zzI?xDs#s}4>cXcTD$!OLro=g0>#oez;CW@TiU2E5+Ti810pSI zSw{|jZr&;Z(_H}%wN})ZTKDJ!lC1lf*=9LK-rWOk>-j%|xU_L^1c&qQOuW$+=DfM- zNvOp;IVZqzC@%H-ts(>Rz#6z)7IxpnS+nFwch{!-a)B&EiM}p{i26wxQeJ<%cUvDy zQ=v)bH~ai3aPyPDHxd&Z|NAv!`B|mO!hIP=%Xn0j5kGBaD+JhIS0&)#_d8dQc>Fmo zq0zCOXypE!Qf%52Kc<$EtUNK;saz#7nQQ`h%U2W5K<7JJQb85&+j_jyoby?fA;Cj& zYQG_P{+YP;GBJCs;8ZV7w$>4``d5i#(UB<%q>?D+8KCkUBzvry^)0C- z(9I{Bki>I(Y0NY2w@&gXzrI_cbtqAq%Pg6llL`e+@VxzAZbB9F&1U!WagfL6iJMJ; zx_|L_90HcZe1*TqJT}A3#;J{)(1_R@PM}6KRY?YunpKLY&Tpb)WZ*N4rTzloPTxd{ zK)mYs!IYK;mq7YX3Hy*Y3jqp?l*j=#%wmkZ7_h-azpA2Wq1GM(ty(b7FV83GTsx@T zmS5^k%I{P8CP4fl$PDJ4Y9j&uFgA*l;{zA`sZr{{oy5|U%h{3NvT$<`Iz3Q~_+Cek zed(HE%b@H2)-Qtsn;S7TKs`M-iL9}d|7rnppAhO>r}6mYM_j>IwtLHZPt<94hW5tm zgOA2@Unm$bitbMPR3gsz1uHQ)Ir?cB-XE$Dy1!I@sUiZ=(w&^OlafEbGiDX{2F8e}H z3u`fdTJ_LMYno3RkX)lt6?7r4ae!$Xx>EzNKEjdJFzll7OmrD?plgq}OW$MGT4H7f z`&aNcB2+JBdtO(uUBN%`&0FJMk&5yhbJ&0+p0Fei$BH?= zth=ktAmc{p;&$3L+;9KoR8pf}SN*gt$JN^(b+gvkVFhP6G1U)N#iX(N2JkWir3? zoA+#K*p9Uhi`DMs6fsJePUci$#o6#$|tWS@wMzam?udq z3_&_d>X4YgDD;Vd@~ntBdKC0=k0CK7KgN9WW0ErRW-mi-uc@Pm36!2|0` z+&dYN!Q!r-MACs?DljAvCOC0o*%rSxkf<-bRCKWf(qD-od)$ElYl z_+PsU;48H{i=!Jm4XqH=&Yq}sTUuI(*j73;Im2|| zRVmk<`W^o>`G04ho0~(=A5c(VQ@{G}Hcs+y2TJiD;THeFHmLFbUwGV#qC2;BeykRU zgsESmfsPDF!&q)f6TqB$P;` zrlz8fmdIoSm{vM!c3sG^EXii2+#ks;n7XE5tUpu2Ym=_6O;zfAO#VKOR&umQL1AHk zYo4(4eE9Vru@cB)#aGi-*=azi71x$NIx^A@-q+96RRAXeuvDvvh{$?CiOi<40sE5s z?)mxoOr`O{!t4Q(>F0wHelyLNL7R=B73@Yfd6w-S4liIi$j;hY5_8g7Pvm1=zDaHU zR0-#a;_|@YAauw(uVJ(D)6fMsH}`#ecI+*g(1J#`lFCUq^pe9DTU}U07}5BuS_Qj8 z%TcW(gA~!o_@ofaIQu`N{c!;-8 zE(GG|Gfs(9)_Y%$4Usp|0(LZtejqEhw=9=G$U+grLY1P%#tav#DxzU$U z3TB%DMQ@i_C584cU*ahPeBjt$%`FYn7Vc!#+pAQtxuC|^8<7g!n1wzy%>2Vxl znEudLO+geVZkGQv?BE``|3StHh%-&ZPBb58XH$UJW|mP&^2~SehNu5yjFxVm?Z}fsTL@i?WE22_AG|AcxI13Z?H>mPn<} zQqc?-($1`~yz+Q3{A)V=hiS`Sbi7%K&q&^-xIHgXlU2yWNuy?gc=|{b4HY1*p6FP9 zYKe|%;tXb0rYPGIuv76A;`BSte%o-yg%kXiLYnDav7OB2s$s5vFc5qAw3=ilWYiL0 z=yHgboWCg~-kx>(f~ub7Vh}uME%)3z1G%8_0(jd@=lWqsPoAhz-~K8`HFq{%WFQ`0 zt?Joq@#Fqr@`zPF32$)A*G5e3lFH+{bV!4YUFC~qRuT_njz6zCC&~B*@X853b~h~a z^dbE&%I7Et?TMLdW@9}tl+pG>%mnGh-bmbMfR6gSyEid8X=-9JpfNNw%9zS6aHM-{+Wh{oazbAtzbL|@BgK^oksa}IQc}^BE1{F& z$)YQt)=xyg$=>FsZe|1yr*atGWPJQ_oh$0^Z-G#-TAlNP=2SuhvzgFeHuFRbM*%xS z9QCJ4)j+jRL{iGvGPFTuatX=CA|QNJgR>$tbNT8o3bN(^^`D4fz6Idv2hwS60|Qal z^{zrS2sNM$s}rj6K+jKm8KOc-YwdPYNG$Gccvcw!^4WDOBQ}j)!JvXikJ8AWFB3@PF~rN-GQO~aI(<|GSPu^R^kD=_Ty551Zhr9Qt4!-b8*(>$Jh}RI)A8B2rF75$&-z=ylOD zs+0caQN41H88MQ})crx{m0~(0%UNPo@$lbw4ciwcv$|__HSLfr$$Ay9=h8f>4zL_r zVB66~=k3{c`5})wcZufIXioYL&FNdTCv6dtPO5-ewtCOCR$zkzSkj!T^K`81&EYTzn>z=^n7|@wSfnl5f0G}KTq|En2L-t%qdMgD4so0l7MltcooaMRSztz)) zo!2_Pba!_jw_jIjF>C{}B+(<85>~xm$)6}tA`+;)hR%smteONBBXAMxdAMmq6rUsU z#pQ>-IT;f|KYdhTd@s`jq9gB@6@y_?M7L`P->4k6CwA;^9&_4?>CBO9XixSvGM#4g zyOAEDOCIggQ~Nw0I-Yaj2IeYE2M8yY%MB;Ej}Y?>tnq_rM9u{`6~6$!=OVMKk_N>2 zOo3UD zGnEG-7CiR0h^4(1fh)KEAf5os)>OiowAOy3>aC181qHE$D!auHkGp1YOUEwTz*`n*vZ@3{(lF)n8wgu_qcfI%E~@pkau;~a{5J9i;$ekiH_Y-_(HMA zj!|gdyrfuK6aHT8(Kr;dDw2n*r{((G{tCVNnKCJrjJPXY`Nq@aoO6?A2D7t6^3^=D|eak@rc9573nK`d1UuQ7$(G9_}x&n zo?kVtelcar3L*-xHObTN4W^r|t{{7U8XC9LGZg2ezFp{^D}PbZiZwNbMmG@pEU0Cg z_xCF```UJay#9)e#5P6X#*T4ZNu3zlfWsyX@0ksZGnHK%JRZ{*d_(EQ-pWAsqurlK zWVwn|1m19DSs;ERs|Cq@ZN?JUemKdzH2^7}v@4;y9`6blk%!KhE#|t!-EVNkF82bk z37D&)7irwSOvStFtZsQ2Rh*KD?O6-uQgL76Ss7c9gk_W0B1a+pqRZun>`SQM1t&J) zayu*WT96cYuK}f|2d3v3-C+p;o2K4rPE=nZ2}N|j`#}-$UV8g~6JNv1(#_|5>J^p5 zq|Al>dgzPf&-&H%393X)GA^^rbiY`$yB@Ar<*a;2RQvK6f?P{78$~xZXC}TFpsSx? zV7skr<}*aT{^*7Ubna;{K+0BJ^2%P7S>%sjZ8(WwrWu`8VUvfoCKYz*WS+gZtP&J@ z<}~s>Iuw-sjfvfW?8uBJ^ zNn?+?xIG z6h^6M-V9b3Yd-V(LE^l~m5vo5&73=|pOyl73~w%|%%n;7_IMS)Ohola+)w1|hGxA7^bZZHNh}vJ)_sUg=JQmErzDmQ}>v3gx>04h5i)W4ep5d&5nr8%=ed5+Mu`9p>WX}0@)7Hi-BBe}f z?F2|iO4*A>XY(^o_hux!RdwWbQ~`V3mx8sHcKSVg%B0cdDqwY3ep2X*;ti-@yHWR1 zse^k8Iq>>>Z+TK9)p$(r>92B|9S(O76iiY6yukkrI|o`5uFmf}p)(uBrkfa%mGbz- zwBmDh6^m@@wlCODHdI;jgKdeO*V#{Mj`gaJFlK2FX=3bC1%-)$%Zi&eG}FnZvb&&h zt~Psq4rj-E?bQlO0PfJzsA%%7e6|78+c}xtGzga|y?#X67>t}rsmJ!y=8+Hb1is9? zsQcm1#oWN_J-kPGY%y{(a=p=1lRrT|TE^kefICy%rb5qz^Ag*$=RsfiZ$tWf@PK3< zqpMO3XQUhI(6nL`PZnQGd}@}JvIpmhF+vQF_TE;y#IveRadt8&S#y*%kO^i@@BbK} zOdKZ@vKxGaTu=a{{YAx%PfQHSC0l2etrUV0Nz@Q=(NG&cTp3jRSZTkB%w`V3BD#KS=m0{+^f#L1UM+v8^ zrP!fRPYgEiX9L<@-i)Vb>S?vR;608qsSLmM2e6nLyBsdjm{0sFOB8=GylZqIt7oh` zl17*fzr6$>o5{B<&7Yx{&B2bmr!!e*QqW^s!J+3Ubh-VhwW$J&?*-!P!nqGpLWzUU zT{TwIho@$DT5b4&YI)u!)Gq-Xbg{RU&*}s)i;4El7hWUct%6I5Oa5#kZ}f@S|9oD( zp`Fza^nf3TWz%2rSUdkZSEWDRCZlWy&N4}EJ9j<`$NTi@T;jw#_9zrenkz5}Q)J;= zKYXZjTVSTR=ab@vVisEAah`3SQcD2(_EOzjgZP0zaLT3o4@L|;DN z#zW)RD=%EYUvCA{k=Js)RA6qK)`OoF9#`fAmt5kD)O4vXqx^!3)`so*NRrwdR9`I= z!|1GjC*;5v1}Sd0y8oiGO@3G}n}7}6#l~_z44!ug?d)oxBf-2yNEBv1_cyy*Z8pwb z>GFeBG&nvxExWtsT1LO^Q@$C{B01Le@6<#ipJdAb`V`MiWmQ*VCiJWJh8{14wwVX^ zOH?6j8K6@{j9klN>}4WBNxm`kHC~D-N1{+@xx4dQ+^8iF$MAk}*j%Te8r7Sv%o@;d zzUFyIJfU)B#jNgI$o{*+a|p@6yG9$onl@eN43(afwrwod=PD=zJ5dT23>R60ef>x( z0qQn!h{|M-B_Be86kl@9FE=InM-xxpnYdk&Uq9AMSz)J4@*(?1Eg)|5XxFZy#(EAdVKjLGf_EI72ejinKZ`4t08LMWAS@8 zHqa2NP?EcJodTwO?}qr<1ZF&6Oaa?CViT>C99KuCY>Bj$6(*f(v?R6#DU|q_g|y4q zem#BMiii3=SvW|DJZl0|B5yb_9T#}9Le`oAKq0a@a$dMuSC~Y={Z9kQx~h;La8;3h zY`FzY^Y+9wsmZ%L6o_W|JbsSbt#Gd3BE4hJLQ|90TPA$&{dD^W%0Y5Sam_A4lRIBw zJvRn}=;-Jk?kT}(67NYqa?p)jZUL7&8((?ns+4HEICWK&`-wTe5BjT+SdsWDNb37b zmX-Tk-)K&A;=KC)h+k=G^_>oT|Kf6c;S=S3cA~CitG`~8Jf33SviZ&Aot%vo6^2a{ zj=o!2S>;bVJUq%qJWltn55oIwjzjzn8*_z)=y0a^Zn)G4rLZY;WCdoiS_k5*3^TL* z>MeYk?!oFk=6tL^H8P!nwP|Q6DS30t72KnrkE;_i-lBSUKMs-gq_yuG3-Nc>Y|uTj zrt=5WQw2e6Sf{LR&U-i|jHYM~f(eHa5C{a2m%+iIXGctorh5hN+3ztbq1(=}F=kkO zOupu%A~1oh)MhaGA6d<6aCo>ecM=5DWFzcw?= z!okr^|07lz=BG1aqqeX_AoW%5xQ(rCgTr*$)!AU`7Snxu-9M6-&o~4U==0z?j&ApT z@dhcZQuhA+`x>I>I5^YK3Dgap20C=6zSY*&nrPv~C`;dAS(qR7mA?#}+-#d4ITwwE z_ceakLgbm}p#lXAHA%&kw{A;nJ=S;a0m-j4qnNssy@DvyZ7^jq2z$vTZ*Kb zpB3Ys0IN#lMy$-VacFDr&A$Q93(V8^02uDBMg39Vuo9SW>glE;R?woy8dD$_geCrI zSD7Wu{JhyoNrirR3P^LBdpN`CF2STRN|R-Jlqt+1IfNWn9W|+k&RTF4<7QhK8cOu4{3)8{@#Is%8K>JIaP5WiwNtl zNw3MM6Yl3VW%B|DC-i9_v#zmXwF54ZGLhpr`Aj8c>KiY6*xyvjUoT;S?EJ$Aa=?azLqXr;`F(O&^WQIk zHS2QSJpAi`kw?11eEx&=H|3}+o*0-R90O*(mK*CT$zc{lSiN?`e45P{hc}eadykQf z7aW-9$~;UScADRQmU(skwmhWFdS9q7Y>rQc({LA=0E{l)3sfeHr4>mlx>Y}yC_VbV z2HVNU?A+7|G1ki7aBlSFvMDn}5B+nzKGr6P)MpzHyz>j3UQu*)t=~S9Xm`AnTnftc zd*sR{Ca~tKshV6O0qLY*IU05|yd7Vy+zcGtY`|IPXDn=PJ{azm zUU^*6M{(_7^cRiU!({{h)y;$6FDxpthEUjX+aypSrZ7X4l-DMx3p_4pohF8i`Hq|~ ziWU}UT^e5ab?A#g;gh!yX=ake8NBl}45Qkse(98_mcF^!xFRlUVO*0j=OYW_g&oWd zj@teMBiL)c%;_9K#|j_b-4(F}2IcG-N_e2?w~DVvYoUK<_7KBJg(Sa!E|EY}A##0J zF38$UG7gs>$UJUBXpd@c?et5MRS)-(fjQO=@YoJ))z3ZkZ~OEvaz8IbwO2VGyejY1 zJ3_mQam*>^ZP$?Tj~0+qgtK-mmV!bmXZdX=Mgm+re5als<5!-EbiYWxt}({bSZ}Be zYIQkMe}7d5tJz^Anr}IUKQvp{?HV;sYA{X9-B^+Wm>6ecMnef^| zxwsAD$={9}l?0DX2yk}p%W_dw{>%>hmaU$*1~w1V}}?(2J4sYQtAgF1v1mB8IhhbR_g&N;Sim*ui>=UYeMK^kS^l zf&i)zBJ+*Ri`2N0YOm1vq}T=#jy>Dc+f{Qr>jUsSRDz4^obyQaWatqYKC59x#)ls>06~*o*BUdg>?qkw;zB`l8|v zq1;rp)d9^OcL}5WlR>}Y>h9-1n4>9N*eL<##n;aU&49c2F0KH|F@BkwOPIIWd>6^a zCUaz_#aRKf9orlW0g@-HMe*UE;V*%Da$A|1!s0cc5blh)_V;G*W3#%PTfPbu8n1xF zZ4dzG#p;EsDycV$B35q!VhvPV`(m503Y`m63A2j@dL7@kwW^zU-Kku8sz(B5;OX#; z-Hkntvpvzm&k+Xy(1Qm2Y7X_^+;*pOcXl$-8*Dya6B?tZH*Y)H3Aea@_d8N%nR$+^ zRWm%1ZtEIGcWs?!n{pc$sxQ>-p4X6BVh)zWAbwy8U*?+id5QDib>ohSn6cjd%bt4) z8p5_50;8+nq?tDQV4*x3F0F$F9zahdX=BFKNa#VmgTK|v zR)B)Z)F`7eA<4)62u8cbc1#`0JPB^sX{l&q%%NvHDiY(x)fDK4XzR+S+teohEjZwN zY}b27Z9EltPIl}Q0i^+Clg!_c0ApKPgGhJbsH;`y4Iw%EWdpv;%SigHj=BS~JA|Le zsl5d1g#5t;x5x1d1b9d4#mqLjkC6-_aN~4QL+!49HKbuvR$A@+(ybZAWv0lNO?TXS zK9bXT?UJ_pyowEW69AWGx@I29qB~I-QeLk17;`c59kQNHITm3R)%3AFmIG#Q4n1VZ z)X*+U9dXlRON17~(*HvLPfo$cH)5{)k(dm~v&xXV31Y5@3Mr~`@__ksku%sF19 z$d;P?-fLQBvDGIcaUV|T{RfT14g+l>2b+a9_Mmk9%*3x?(%m&%Om_sqAZY~~53S&@ z!R|>E9HnGzr@%rloW+RVEAn0w`>}(t$jUM^{Y(L-cd$gJ30EFkOX=0sxH}$h+WS&Q z@3^`)0G3)Nw8s$2kg?~mUy+3Bd41)3czQxblt5i*-!&P`v*iS21kGPN5> z+Rrn_qeRwbx;w^P^;gx`-148H9}?kHk1bc$JKp^q86A8x08UjeZM{onUR@i-&b1!&f>SSQfsJT;Y{Y6F`xlxWhhN*sS{9c9k%pAg6jc$(2vyRvZe1Z2v@ zMla5Ig*p`+@h;LS`n*#%u`wVPSk*y6N(uu|$y=&90a*eD!79h#5 zj1BZ`De7$Z+{+>9pMUxf8ay0Y`JI+qs;%W_ZOaoDFn>ThV8Eut7#x4KkQ72|C~|wX zR8k#d%dG=!%kohQ-+|8W-_TmO_lhpT;fhBiSn)$JDbw?x(yaFG( zx7Nsb9L1ZeP3LE;>r0yRB!1X+G!`Cd_CXW$t?dot=y|+;juxih0%GL3IuF{VL;z@b z%qtmG>{W9>_E&T6gSkre=d5?CL-6k<61@p$IunuBMqn;W&u^gF}c={Qex8#S0xK*;XbJhbmGy24{go1K*kHY_7QE4zJBis$!NvvND9gQ zIzNgwy#3nQoaEA=9}95?OwBEQ;6FIroS2WFw6mmlq>-mi>vx-0Ex8Do_lSBEEv7wn ztM1#_9$?5`f#Dju}v<90~QN5#shPfworRNBG&Kt6su_y+GnbXSaw~ULw8e zK>@d)jQCup4RP<2)>QQ=Xx*x-Vd|~#g_)6s(Poxt{6-z0mRCP?ag~uQeDQ**#_H>3 zWgji|Z};--gtN>Le2|{BuOf>vpE7)o@u(>fZ5T_>GI>Ck7*w5&R@2oEG7rmVt5PyK zzETQvPy(2=Z9N_>%od46czb^1QkO{0A*b`Oh|Adb3fWy4(3z4|N+y)&h@xEVhcYRE zdMWhqc!q47hX|%sN{F1X{zFO`VoOKn!nce^W`>$+ue?y%<3%3!lQ3bvdN=N4QG*w4 zOP$KCyKFCBj4US8Q{_K-R>UEY51sV`u_$pv>)7Xd4h9e|fi-*@O|39~*`Ty4liA10 z63YMS0}nlZ!v%c`?(U3%*G&=Y{mO}E_}N(zDkBi``Sjk6&aZaKrL3OzGOD3$!dXNS zDv}Hg3^h!Anp0^pZ^zZ-ldFdXk47n7Vu94oSLSw$?W+}=(S*m1T~>|DVgW}Av; zCo^NCVuZBeQyzQo*!CCn+8STH0^);y4;nd+q>ffoQ$KCGCjL%_Mc#raf>;?{XYKA# zv+-;102o1cV@pe;svc+^xe9z>Vrn-yGlrE%z-=SuED6+t(bo)14Fp!jR6^B5&QmT2 z{Qw0QNXNsBOls0NZvnu}PXVijjEH8dVnPz^w4X|pHJB{K8bC8C2^uDXUMxu7`$05dI^hnyoyiARlgd>&@<2 zaAM!%Yw2Eh*=tR5+gIuQdR*bqW+7ujhNa09Zq8%vk966Pu;ydAZZqML2Upz3Iv%Wy zumkJE)09h7zS9+u*rp8J+n}b?k1-&7DyUG9)op({jg|dRcS?&Zq8F#STtcwjU4?G1 zg>?n|Kp8c(?5kByP!35axofL*~)#U!^-*N z^Ni=LNH(qLR`16s9l_2Pm&~`Uf$L%wj_>e(+|_Obn8(6|epaTJ$jw!HLuY3PsLrgcNY$ zI=+cd1AYNyq(|;2WXIc5^5$4ZmpcvUYP9;Llj2Yd{Sb|k^EfA*xO!EDN~`~x*3To#iB@1-La7`4#;pY9pVI)Vkng_d(&8UDq# z@E5Z)`o7(O8WGZB)%!Q#FHH?j1Mqrm0_@w8;;k7MoxBTFjH^^jo}J%ER>jt!Zkghn ztKD&Ozz2sv?L<)JKZIABgY?tc+5!tp25ZC`%xkEea#>=XO8954ZB*7JJjuP%mhj}@ zThQ4;3}mJ#B3Gxy$fF#maa_JSn!?_J|0^v)%bc3uB1=j9d!0zPP z=mdpO@u0h%>iv2SL7J4$~{4(f6>1qmO9rm!mhN`_(%KR{JM$$ zHi5y09rsz6-eMp#fdD@;K@AissGHjaOTpp<9%Z#_T znxGms#tvHtdLyi7(MtIwB{^4X1#J>k_w75Z?T=?-+5UtZj%lTxi>6_#NzqVH?4#Ta zhT!qzvJ8!FDk^J|CSt6a@_qYxH!S#sy)-9R5DonHbleq3NFJ1Vt@kpRwJKcg0ro%C z-yXJQJi~s#Ui9Pd{~EUrBIMaJF}_Zb&s?QBS0fQCyD49?)<5Pf3DibC{X5QHkk9qz zH@9hzl8K&lZ`&&vQ6xvBfkjU#=u?k$;mi50(jD8tgq&#&fCLh`V3m!~XCux=BOg{q zX#9y)D@bQ!FXClfPh#W=?ZvOP{InSj>P@-a4n}B<-5a-`qT{{9dP`CqU+YaZMo*Fm zgxxB+fDW#@q8~(M(~#Hc%$1;Z9VTpvoAd6v;kPt3CW54>5sU1vO$7^hUez%)%GoAs zODf?%S(vL7VtxynO%-R2yR~Lt2qKf@WmhN1jg`zff!sbEeva%F_eUyr8U6iw`$kCu z@Thp`L=CvTB?~OIx7#t3<2y2kV!A1|9#dxN4S$);@jw5*Nb80tO&zGebX9n)tkAwa zr;_$+|Zp(FHe(hm0C4B8A;O3|;3jr3JGG&OF7 zli)%odY|7!KhlbXH~^|QG|Im$$b3>A@H89}?$*UNh7uMv;>;%0rF8=^$jfz0VI9R6 z(P~*saL5onTW*h1JUly?96Vc`H6ER|ZtkjN%r3gfZguJGIT7)-IWQJvIS&y>w|)Zz z9?IAqhCV4@+0ASQopR+CKOW>sL&P=B=P)^c)k-E{&m?}S9s zYRvA`oeMn~^8Naxa%1$e#6p+IC~O&tCi0{@g{bORpZu2#kWap)T^=c|%&*V4iXxge zYYP+|GT>)-YHNj<2Fe|1q>3t&xlOy3Zd`q1%Q}9SKpLc@Qbz_ivS72U&QwX>N*R2y zGO@MdH_@%XNxPumJ}>66Mn)#Sc@!xMHJ_R((Y$wv7@=*(*yy^+wJ#;)`(a#D_~-5# z>8=|G#M+J#5We>uoKDm$y9}#=# zcdFein9W~rlqD3CDKY>WDTV1XY*YNfprL^THZsL(<-wO_!|IeBY^z>3QpSTYOfr2l z`^(fn?xKmt7z;Bhwrpdc^UY~QuQ5Smpmf@|ZHK+|^K(MR9*vZ-X^q=8jEn>~c2`OP zis!G&Bs6+O{i#*nPkEnKXQi$oVSEL1c6WsyWJXj^t&L{SXdD|syZ7abIRL{K(@)I+ zgpb9jQk^gwqa&4yo|wXqXX`P=q20E)gzkH%#z2yCt}fqm6e$yWWc#-p*O7RBth}ec z{}{fupE5VDv&z(=Ua`Ks6^2&akKhNu_ zQ;k*=N}8_OeA)*qOnc!KjR4Ah?y8srM6P|iWydn*uj`v3|9whcm#eZMR$R?;h*BzK zq!;bs_s8!*&@p*=?*-Nvss(j^D85iWv{~ca5i?&^PWL2_QktY$aaJ(k!y5+Fw^)zL zF=Ym#(>-g!AcMZK+E6&)YtYpRiY2PV5s5T2pT7uH*mP_uu5%DThTq#~R^pQ2)p;Ki z1kYy^hkJJ2L@f0L&6o{*?9&;!cQ3#ngUKX=%^7{BAR`(XVHtL-spmg6$w-6=RjRQ$ z)+Y6j5ZNRrOvf@F4;DAL=E{TV)CbP7YqiG9?m$&g;>x)n-}wp^xrp(E>6VDRoeNZp z-!T1TcxZ!a%A**%G;Z)w17VE|e8tqM5A5^s%KXu7q`en&`sP7b0z$*Ru$+w4PT0;_!2a94&AGy zQyf_y9q865@J}75WpHHJ25vWkZPbiD5n6j3mmJrU?Q(8N14m3HbY0-5RZ9m^++BM? zQe?Ko(q${q;93&E=m*MaH>Mxf)#AUo?i^~9f{3ZsS>yAS==HTdjZ(KbH5|hF&q6aW z?FD37-KN@hV<=o|$r8PO56B#&yc+*cVbh(wS0W?U#@FXa3UChy-5oV}!4t{u9EW_1NCRE# zWT&pvYnCR;f|tkLWVUp#1^s8&&_5y1#wSxP6PFM6cyeWbej4iwTi2`n(stFf5)pZ~ zsi2vgKe+iNKsh4af`*I?Q6Y8hLB#o9_;^>m1nh9xKk(4;%M0dki$%Sn#d)QM@UeQ~)w) zd+ha%0d!z@>h!jpHs(4 zO~N(IYja`N8sQ850q=`LUC{(3VL{G=q3U|FSvpBXXPzA?vsr3={USE0ic6*thex)? z&xvE=Bk$wW02OK zfJyVMh1F7esZTm(N=dCl>?jV!-K>GXKct5q$`s-PGrPf7175M?JjOF7Jh#fVOMk5g7)Fju}nJ}l=qc9wh1`v!cxDj-%%}u!M*|C z3pVkbP}V365~S$qd*gB5Sp4}b`+l?AruA54Q;d?tcfR$_`AdJQc+vVpYppJu1PMb6 zS8yxcpA!ZI#BXwBE2%Ln>s?B-j#rpfIm#=|`-Lwin7F64#bycfu6xwHhrsZ@Kk05x zNZ2xB@7OHm!=_wcPglB`vv}(7cYdS7{G6#|G{&dpwHDfNste6gY^2ooWbq0Ye$ESX z(ZrndIeaZOd{a=Sz}?H0=&A(B=i0t@Yth?fx!G=6u4~nEIMqb& z>&?Q$SkBg@(+8}6#$3*3mILb5FG|Bkl6%)*1UA#wFiDFKZ}*Q&%@T99j{IzQ!|koB z)1V2uHLd`IcqDEpKT6pR2E6%3aEq~Vii^p2ap*{r==f1T`Fvci)HQHpz7^uALl1C~Ckj59ehN2nme2{_MwYYRg?k!{)y|DCYH-zSB~J z)LValZB$ZpI-$?X;CGSzwq=IAinF<3z8xmi-hHmS=x8$6xI10cri0ukYCaVV%WIFb z3CdS^pNg`HXO1Ts2+8C0{i+2dYg`EKXJpx*@Enmhn6hV%~jLcppA@0;KB zwf5J1-PkR0v0MP$Rx{i^=RCcB)jMrt>`lb`GA)_3o#`|Z!69_u?fdZqy!argbLdDD zQ4Tt8WxQ&J#sRxme>rTm&GJ%7ps!k=X){w5>uY#(3y$o>3=j5*(r8FS9S+{uAR290 zxdcaCT)3&1?pnoYV%ZX!z{4YnSm%q;!(;fi&>B?ih9EW&T0FD_UeBtIrSNS(U7NrM zc>6xdsLs#ocD#uP@NV8;r~J9}fuW)XA03 z;r%b)#74vOjhWP9yL#r%Qh$QaZmhvfmWml?gIt~FCvIoEGInd$JBihe^b~0`E-e(2 znp^RGN~}ixA|uo^lh-;fr>b5>cNt!xVi3dFp631Ug2^7@p+f2{=Psa)pXbj${xRklgk6B;3<}Ki5%ZoIPS$2MNO4Ke!B8W0d({w7q9o z6I=VnYez*uHv%F}RGO4X@1WA8E4>9aHMG!si*6~>rFRezkQRD}M5XuMOQeP#Ab|jZ zN{e`^gh4Fm2BUD*G=O*?<(;#r! z-x}}K=i%nG`n;rkd=tS>F6kGZ3C$k3fwL5ypJY}48BeS&G9x|!?${WytYzq33p}75A(T2%ze{N;W;a=D7d>oo!_A? zvmkB*O$~~Uy>&~5yX2))4D05XMo|H{hv71v5K0MLWcH)6v1XfUWz6@16ijWwm+juu zc1}Py?S!>%9(a`ZJbUqn1A_6A6+>u zd5rnJ=?K~TE)+Nn0*j~;+Ll+7hMlq>Z;X|;=yP~yEHTOVg=ZLd21*>qR;;T-SEBeN zRoV9znw_gql_j4POU%570%UA+22(3jEBW_SIEv&486_b(kC?oyIv>b+yS9Y?+y8FO+Aj)PK#s zi8~ye;6o+Cc^lqM@Cr)iuWlDQQ?H4b`}!;}kkiKa+2_`1{yo$6`{z*JPaVdc=N89x zRXKjrv#(9U#V_gdC7PD$IAD)MLR5+^d6~y+A3R+)Qbw0Ma2ZM~ILx02*c4x+<(O(h zzf9~!$VgYnC*gK_8|t`cHNl-Tr3nHF{oD_(R_GYid*oPR)rF6gkqKxYIkjgb7T(pc8kU&mzwUH~aZ|rXPJNd(+)%+W7PZ`u_dXj@qlx zR-<{_-Es$=i2l3bYthtqQT4kf9R4lC49f3gSB((P!jK(-wI(`!fV*KFgybW|SY zAKCXBD12r1ZkS$^*4(7>iAVZjNW3#jDn+o zPXuL!-$5%ZoUnqIKv_Z?2t6PaH1aB4VN)KhHZg0tI`7{siKAI*75G`G!2RCYL?0CJ z^oKNuP5*4qj(9e5k7>=pX^0$^y|vJwnUSWwyJor61D)=;xqho$g*cTE%~jMXnQNm=W@^8LM4w8T<$VRZC+s%g6R;1eldeTG?x&F8RI z)1T!+uCBYKoceKvDB_;vJjnL^A662b%!VrqOVy(FC^4yB^`Ce3Ln={ukiSoful7L3 zpV&br7hN1}c>K2cGcBV3V$8H(BD@$bN4w!w7?42lYNrj9);xKqvCnA<8o5UMat)I@uTl+?F9C9$L_L=v+dkjh96FK#{>D~YQY=n2`OzE zt-x%p`1kPFtAKI`)9jZWPtWXZ$#HadT>d&g&WbPZIJe#h&F)M8>i2%B z+!}lOPw`AJoMXuOdcaa_6g}%-*Zz?Tf&6IPiX*$$AzpE%J=0$DVS9{JY3rsUJ&pCI z!TZP3hesvLd`UN)q9`k;-m_l5u(q-vU{Pxg0m3O?!)tJqk~L&GQIBxztxM)uzp#o& zLVaM{ilRN*m3}j~yTNtCl~-BwTlfgy9biiDr!$R8UFo5w2=_3JVef`gtEqB+Z|z{! zA6LTu30|u-aLtLqL=N0TKlIW%H7X6^MPHS2 z4$Dbj-jr~!H@DSIQ#!{j;Ed4vg*dRJJblmVX1)A_Bp(5FF+cx33g4CJ(Is=1;{yj? ztsyqWR8(e${;>DPvB?vAWu%YJ(X8VrvA5gIPpkLaUiPk-e=TA3ZZwluPXEMQOH}#{ z(e+HwdD8y$l&@X#TO_m?jSa4Gp6>Boa#q`767MXpE2dyFa`kmKimPeBehq#H_~O2zR~-?Wz51c8fnWSCQzZxHUVC>TiC+D%_#78YwqjH=7qy zZ3W0$e5J0Ibqumk?bI}qfx1Tl!ooG zNla5B$f!k~VXs8U+}%6tWdZhw!RmX&>u=b-C=3ODpT#d`NprGy5R&$J zYrUi9F`Vi_)d}NBI*PT?<*Nm9{@<^MII>W`)2c!tN<3ao(M$H@Ipg{xM$*>FUL7(r z|E_TlHUE)V`rrYXd|eV)uVM5-Q0S$a!Lj+9AI?eO0|tKf<#t`kZlETNHi4fKOvhlI zIQ!&MhC9pSULsu7el=adazRf4a7D#kNlLjNIrh`mL218f^lEx;)HCBrDIo4e(LZLK z^&D+)+(dzMC}&n84hDA|6ci#pKTzX~mX% zIb-v(yu9arK}9MhApSc_MU7;Qk&W(mfRFmoeZt1hy$o|pG6t%GWxAJ&y9)?UOa=8t ziIEH&*Lz=B%KU~LftHWi+j#8 zz*q>%Z*6}N3m8NrZ(?QBWVWf--}+IKpOrg-(1^_jgW3ML#se5Ea^9aC5?V&n8mUNP4t$kE_n z!)Rgr?k~qN|6?y`LQ1`#=Ra=|O_P|}S15RY7b-yc@}w^fSKpp}yNd3n zuQ)$L?6BUo&(nn=Gr@yc=E)+gWZ)X^0?RLpZ2P5_QN}xcLhxeQo;;+ez*Xpfe#~8S zy2aIR?C95Ki85ab4C9(_^XriRx-znzL$n}yjC?q8Zk;kEro|-}A{4fM&F3^2Np@nD zk#HGb@osN6GbYs11V+ZZOKQ)*!keD-O&cYn@=UBLi5y+~R6WBSGv)t5A}^Y=* zqUUJ{8XKdA?y1=7U%eO4VS2Q88sn{W+~}0Z zz_C6OkuzN%WKmtQ!>w(CG0}{Qs>>*I$WJlZ+@019Y>zW}arkN7o{%3NE45|t(7Sah zgCz-wol9|E3*}@od1yHW=ApNjr;WY3GROxW;$jKhU|BeH?6jWF+S8i5l;;x3p~)Wi zVti;x;efldRM9Hc)#C@N#GaqI#0v`_mDcc)r zO#p{vz8=b*qqISv8?|PP--}BBxc&SqZkSlH(319IyK9$KKUAD;HxgH&IHj~6%E#Co z^lEv^n+k|mMNg-{m|oAJOdWY~w#Ox_E6lF5v$XUHQK7(CPRR-SDK1-7LdPsxtAc;Q z{=L71S*3@a|LKzfZh-+!;K7$_w94W)%UFD4X_jA*9uUUl(7&&>HUfJ!ZO!dR=}E^0 zfou6X-Uo{4ui@KOzH-eWap>}Crt79V;yOZ_auC@EBd=RvmPxMExhC|FcgDUVZYWKM z7jhkD(mHJ)_r3}Ibc72&Teini55HRZqwK01`zEo<*RVENv-q2$5J*IRy_N2!b-?qC;1i{u)RxG`;p9BdaS)IX8ye_{qEOd`{kv=MdzFcz}Bzi?6zs1 zr-+oZoMD!)QHjvs?HwMj*x0-Uq~3u-e;Q714vy~L-eL)Nne(IDWSZVrg>(U#;ch1V z-N(S@6n_%WYwm8bz&9gol?|{w%KZW)ul3z+(jWjk=jiC@#yxGjo=5gbB_t=a zU+27Lf35G^cbf$2EG0AM!vjHN?mT6Bdh$LMX(M)A$Z3+|+nzQK;!%&cKcNJ-k7kj6A+fCIKJFn1VoeR^&GYm zM)lr%GNh!FVT${}{$90LH>V`AZ)^MM!CU+#-_rqJQ&@+!-1+xm;~JUNgZe*`I1hht z^YJCq5P@=@FlN8+5}+x5rH!;dc2yijw7f>2$->os0Ng_WHV!a(r@pr-ivx*tce_2j zczADTh{847=O<7T01J*Ls{#9s`2NwM;1%=|kLqT5g@j9OjI=i8UvP5v^z}8Tr0J$+ zaUW$syrXFMz@69C@Ij0Y4m*0~Mw7~|aw!n2CyL)Os0UP0gnQ|a60RmX7~|24y_|i+ zbgiwoDZ1wR3PTDfEtzB6B&O;}34hwF(V0sAzc`t%UH}}){Lx$BS77-+b|^JAe-Dt? zfr=_1f4>F+=;Y>i0Hpgm5&%WV#Kim&pZt3kKuw(5rhKR>(CU^zbrGQ0AkieV%gV|E zTReM~4-}sZL_Pg?%@1sqQ4#?Fh#I)r_aqD~M&y^z`)m`}@fZqFk(0ubDqfG5Wsy(;z@z&6oDR#2?r0($Z2}#kJ+0Pye9{ zf9-Vu=yd}FY5;)A!C{=>Ye~4^x`k~(y(`K(_2?_&kZ)_Qviy0$B>E!l^}d|7BrBB? zbE1^czlXh&UJt0+n!GWl066MJ+HxG-66(7T?1v_HN771*i9;sNJaaVqT!zlUTT~HCQ@oFyP`!+EkJ!*oU@3o*l#uU-|DLnC`ZakZM_a0tF;Y5M<^blaq4mb2fVw=5#4w2>CBidPGNfOOFHKLIHY> z$qal)45s5lP}l1yr7pht?>qh2mK|dXxdg_uO#?IQIpgaw0g%+>)7bJAUTXwhhirXm zV31X!yl6%yXa0+MXU_NWvG5CxY0>W}ia_}dVvk$`8Rx(E;T84NH{&e8O-+~Hr15a^ zf(ymPa;vqj3J6HVdp$ieE>I7bNEy43|11+o7T{qbJBammj@BlU;)1R-pNVaSZa({~ z;&Z-IA)|0v5%ONv!hKL{ff+2P3W>dVdv?$>gHH)J0v=qrm-q93k2fL)jK% zJo07sUB1M3r)~2CvL2N55wR;e_PbmIGo7%uQ=MqNGmR&&tSoAD^!>k^eqb+CZtxq4 zzV+08U2%nG^rsv}P^MT=txdno%IsE`w`7#rH1;j>YTk%te!>4@0aktCOy`u6qFw`L zmHAW8#+OiU`TpJ8S5_gQed7Vnw_fR_tx#SlGrcJAP8~a;A$t9m&T+}_qw`iGksOQG zOv@vvGQIQKHD=R3C+&M@18=f%WNcLbVX1y79Q^-Cu%I*#9|FvuA^_Qy=lf?G2beRC z&ue;Y@SIb_n(*wN>v3Vvs8s&j48sDZG4lZ93ot-1Zg8@zGcvDQ8|s()LI&*N-&L-t{>>k# z2n>aQ2SZw1oGX4G444uCNB-XsfCZMLqcs^p1n_zSEXkemC5Hl=PvofH1eQAk&Vu)p zZ>#%aa$I)GYGk4+NfEmMou6{5sDjTpMgjiemKKTHQ zezsDyJC02E-&U+?^{mH7=18>*^YU0f>b>e_&t1<2xTpC><%XbL3M!wbUy zvpcFsz!XzkTiX?pZSZRIxwJGme-wCN{?if%zq$DMygWQwfh}zBsRKmxoE%WT%G6Zr zAG?k}h8-z@^|Afr3!s!&sIiba{!92+wYBPhE{E9%7)iDJ6f6UQA(Zm^xpmd zP~TOAE-IOC{AY~&7(ZHdDtPQ^-8;@u4U?FJN2W{`B;?TbR|1sb7ewdre)}{Z5uV z8G&d>oYHDgXK30es|-l1Lfz72S{T;fmUdZ)N*e7=8p?L(JI~;4Att;i;W{3v=DMD8 z$@#&ra6v8wzY5*iV8ILcZj)gKe59a0_t{3rzYm{evc0X3_CvfY(kBw3d4Z3cYif}WF zuaBQCZSG=YLe=kKy2ZvTZx34CpE|99oFAuhbTrK*Xi^^0((++PT2^foti6KxIm;?C zdL$d5$IV|KbZI#{0q^RGU+r_=X?VnitjBb6k}amGFXp z=N&?5sDrF*?`K^XErZRK5~r)TF~V zyJ>r>En*Xb(Fvt}y{184dNSd1*z+WrHXf;m3-jLF4aH$gNwGruP6Yd8m~&c<(yc&m zLwwuG*v41>OOK|&c6xH##ta;GONW1D(7W4Tc4d3C9X7T50NJ`D$*n?!>&HyUT58T= z_a{DX55Ff-6ZvPnPnhYinu;q1!U_3DFP9Di3fFoAHmVM`o_Wez7@pC+>%c5#3GL$h zO%H}IoZLNP%Ux(12 zlv}ayFHFP6T0Q6Wqg|v+xl>gc-hCGr_bJel=jIr-y2Ypc1jFNhk|c%XHE5tx)bxwi zCu}uuDT>QqZo@=G!#Fm&=&GwZ-lu6TPi$(eH)H-uL@79v3`5_@Jy!x{TY2Rvhk+ZO1-_A!ejmMGi18uV8FNnvA0UUopn+il4dtRf4RyLDS#Ojm$T4$GE>P z@0tlN>GhsB>51GATzVvCu^qo>{7ux z_qyG{>~NArvq=jnesgovn{ekVYg0_Xs97e8ro8l&X{oMggj6uPT{EC+TwkEMSm}&! z?$sEDWpmZQ-!6&lbXqGT!PJ4cgJxD`ZZkt2BWb4+snDpS`q`S_oz|oJxZI(jpQE|$ z!9D@!p_`k>)NAeY6AMa(&I{hB2Z#~Kc%B@wnfEx&J3r;LUrB5n`8kF-FHe=QbLrZP zL$Xoajg$!x^P9b*9{Pc2KL$z==_NH>2VZiiyM12rG*CbI)z4s~2Bs&>lts7X0YruY40mK#XM+9sEaK1^OdGK*l4TOVQZ+}C&{ilX>Z zuD&0)kM9p!6*S$DN*CuU+%v>$Vsu;b8$jDB&93KpfkvZ_9+}OjG_l`4BNfoLROP1B z^H8TAa(D_dT|}7Yq-xgKO9^9&HHLt<9+Hl21~d0srZx8hpxA#jJ$_c04AV0tJ>|j8 zMs0p6m_J@doPxWV2{jVv0t!|$&ev%(G~;h9G7I4-rprB#J!JlI1{^1)=ezoR2qQDa z=HWllT%5({d^)awxItC5Li`pa>R@6!)^o6FDGSGHnus3{j}C4|>7^6`05obYmmdHpDhWi+M>kqY`LQU~~%kVP1xtSXZV= zro1_PzovUFq~_eOQD)3p@AvIEKc1;Z{O?g{hISi_v~fB_`8bxYi%REibq?NnAwlA$ z)n)7Jto8P>s+unEF|j5IhqZC-0_hJ409sc?&?T|#lt}_^!WYXV!xI|qH}(254~y%p zA^0}>;WEyU&#a~{y|u;=gWVmU4Fw5J5@KgWr$ldaTy8>M@s5~h`$^@Yh4IJ?F!h`I zZoPD(QOLJ}-NTF%XRI6?_y_s7$m8OQliU+)`+R$FAg$8D1k$&Kp;~Vj zCLx$amgK`QB#MV!{b>4jMiB8?W*%~}+^TqH5GJ|9@2NZUjoF@6-1=PzZW_xZ-TMqX z!fNeUc6v!tJ9;ENF)x2+cxL&M1H$2J^g=Dj>Vli7Qe&-6FIE@u@xmvqrh-RnQ`Y&= z=d4@_Wk`Ok>DOPTC)Shm<+H4Zn)p(}5yzUWy$kk54>!=ZClgVpsI=;lO{t*WSH6d8 zt!!F&=uCnHr`6uV>)4iN8JVCdgV?^v2dg(QQYVATu?%~mhrUAIT51ecF3MYX^I=l# zJca=?Z!c4C*;6xM()!u!VoaNCf2MPyw;~JudTQ$UmR9lR<{&@r0{m`q^H}d{Qs=mT z&sw@rNk)&FHn);yOpb764FG4}`TYLK(b{SYCZ1&$Qw#3PjzoE2?_%S z8@phPuDkMkEs0{q8$;Xp&q}hs=~kgN*98onXUpoh2heH`)2I{DBhFTIGHhyBqECfp2RpWM=D z6bgfiNL>Hx)g5Eq63TN@?&qPTZ|sXTIWjAyQC4wu(m`v7H|L2$J#Nm=rCD}(@>W*J zL&8SYU)lH-wvxN($#Q#Nm!KIk)%qn4&TmW#Q^lcxPLs~MF(M>(s_FOB?i?B8 zUNx3*#BB9Hwq$u3ExzgR$bS0Tqs+SRsbi6DNJwh<4U*}-D&R(C^iYm3_y zxi7;BFDKU1+-BFCd)iSvIWaxmL;thWq%pd(b7x46+(-(J`iqKmwrmc1sS_t6VISM` zaNOTnL~XWS*7xFTO_5+{g0#Pm76kl*e}bUl4fW2ufsf_+TpeS5}a^LOp7y$)cm@#D2}-R@noZhz|+ zl2$%a=7}qpxcsFKp2M;1s)7JIHLCoApS1k>_-eZNKtQ*Duiv_qE?tf`Q zJFerEX1aT??93V>-WM3tQr%;7p)Cv;!DSc>R7iF<>LB8&@9wbi<>B7+RtoaJ7=xM%`-oM~*s(x+T+impD zJ4c}K^jGktXjb9l`itlW&&zce-3Dk~^UZ7Nlt3AVkJ??--XR194WtU8khw3ki^IT7 zTu7D%!tkL$vZe@%45a@!NkMKzTJT(zZ3%*C&*-E_^5>C@ianvy6o*?PPO^`=uM)cSqDtSb(65&-SD7W zRI=CFJGjPYw97+Q!;+RL`C}Os+f2EO~JWACJ}F$;OFcMXS>?^sAGlNr^+{Mkf@}8D@102YqF+LY7=srS z>m!`!F*&%mxNdIB@CU?#>1ovr*(F!Qjd^IKp8Py6Luf#bUi7&;c8qP*&3-%jbntt8FhmUR)-$l7*DAjT!|$jio3Tj~S>LM=A5&r2%r;I~KV*kHh+K9d zHy>Q~R?Ar=!ko>UYPX7SDeC7(a8yYYDHc$QJZxKmS`U4z$(Y`KThjXIed&U~UMO>X z(dx{$!j4)rzw^d7ACLW~9SCH(WT~3TS(fXF^)TvJEWO^Qgk7z*_hU}?n7axAr~eFE zjQy(X-#CdjJ3~W@^HAUEOcD_HC})cjm%{WMUuwr`DC?@q_~*7&Sm8n0ru4OOQ-G%X$o6RYP67nw(D`tRbOE(x7-jbuXNPVU$NjrRX(m39-D0uz(nh z%)bWy$vn+yVnC4d`mU$ozh@u1E1o0oyA1?xH|ts}k$F6-J?+1V2#00J{6fKI5|hFo z8?qdvRtL#_!GM;>mCj=`>!rtaWklVXB#sqgCn^dFRHj`FUL%hZ$%x9+0*cWun=AH2 zs?ji;7#s_o+l1%#T;<_@UnA>Idy#|^=n)!&k#(Be-&IN{0(EC==)3p7QZK)<8P@`96AR+@d+k%Oy>EUwOb$(hz%9mxEv+Q%zD=1 z)ehjT(++Xm@q2t(`2S~$pw$IS!FyugvW>u z!-VTx=0#T23O5$tbIf}sB0~Vc?ug7CfAazptF?heW@o5@Y$xu=&!u)HKNHoyM}lM5 z=B<*N8Tlv8oR#f_I&yz0mkkw<#@X>vAIv=#NB7Xr3$RS-ypNI+_rA=z=!`LZ7N%|j z5wt7meU+M)AYkh?b33-*!Sp1jQ4c$2wR&axb8h*xI-`i&`E(i)W`z6^Z)u!2Af8^& zW~2U2UJEH&NSJGkfmz1y9DXVAKf2Y{!nS*Jkob3+6m<%?)?2VG{WTIcjXHZ(sfJFv zS-_UV1z(k$R^Rh+TJI-5Lto&G+YLB$!IUM9uFWjW3DXt6v%VyjB;HtRg1+Q83@8DTpIx3z0c5?o zrGdH*ND)AxP{6x@=bbp~7b>)M^m!zc0dZ_VxZh@gM6@yN>RTZOJgDVu0R6@cvigY++TRTeYf;{F)JsedS-q9**1Y<2uS08Nh}vOaKcTKuFShC_d> zIT7h@#P^CVMvWB-sw8)^(#CNnY{juWPj-V+D`fJU$3bDSLOfzw-z7pft>?biPbeV ze+rg?6tX4YdPNPSX#v*be*@#JKtA)?V?BUX`L@2Ewld-0^}ZTfl>H~6@qe9seZxT& zfBiN1TZ5&17I(`=$FXJ0<_-Dh+i0LZchlnj!)O1VPvyN}jd$Hv3syY@*K^sS5X$$f zTz`r}v$@l((YUcM|E7(usHc}-+16TFdP^^QcxMUu?45iR)8oet(gHS3sMTMpX-D5P zSph8vE(<+m`qwYOf67e7>n9amwZ>vkTbkiJ109~n%H+nSL*;t}*}0=8xCW4E_!`dL zH`q(dn`xwT^c~5Gaf18w{4^EH0t@JU$ujxwI{j|hiBBv+efZ;7K0&Vt*BweP;{pc+ zzs(+ibXEA*sv#w3I-GvoI|dMJ$$t~b(7^xx6!$TEL$BZ{4d&8qdEOfu$|}?BqL}9O z)NQc;vO`yRdsNy7{Avw{SFmIJW~DoxSia?@Y&aYMx?Iu6D`qDUs9&0d$KRs@oD;mA zAZs5hEA7lbUh}CmQJdt8RvrXBv<%E#IW4InG3VZeTBpK&;j-P1mOZ{ej9~;#8SPJE(Q5JSs{FbnCls?Xf37ROpgMZn( zu;Y)N#ak~E_Ts{ z_rwMc^set!ExjZkUIzbi+7Ss1_|dmhvscR;|UceNVTN2fFwo^Q;p z{8aAEqiwPJHvY`L?wC=OpZ7RS_92zQ%sW?VLAy!D2NHHAL%xGeoJ{xj`A9SLzOQ7( z;TaOXO*!aVCOXd(GC~h%h$EF=x`V?9DUbrsdb^eGsanhgxk%ob_Hf;MWKE3*(QiDw z+E*>vTF>Q54VYG{Zp=2JS6|9SKC%X(37<>2o^`$$P2T@WmI6dR&y0v9t%@SF^CgCI z$?5SZP72k2hDG@X?;?-KkNy92VfKh2P~Vqf7pzDTMjC7tBtllfIwcy^NBb1NaA8Iq zJ6y>z;k$gst`Bu`F<*4hC*?KO;$6nv2G`ZGpv(8}%OFeV?9+o3Svx+SU7usf`c{m< zyuNJDOZ9EpY(!(@Y9|{aoK9gh8U*KYMK*q0E%-b*yAok?VP96wYfbGo`}bf78&VU& z%V9EFewNaiP7Y%XSXG?8OyM@1I$W_xiOdO%08{M!q z;Z1mA)@4J?^w49>9!)!6l5AeJzwSy{=}&};S}v#fS!qlkf|teLH{2;KsRAA#c^JQd zMz$u$Ly7lA5MHji)$wk|4`)dlCaX^&h|}4Ui=!fR*ltda-K>&bh#N=syh76ii*O2& z_^CRvnxoI$)IjW1QKeIM)fujhchBty#gX(jQn+d^+SM+rE@TvR;`G>5{!)1k^HBzW z5?D`YfS0?a?2y)T4hv=rIc4k$Hd5N$RD{RY`tl-SemgN2D;LIepSmM%L9XUfvsL{g zEJ`9)`+VJ;w@!3!MReeY2JMLpCH3-t5ZI)Q!`(Aots(CR0=*U}?l z7aXg4dOveu^Lj$&RFX3nfqCe$Ph49~3V-@UGkhWHLQT}ic(m%Q*KWh6zl|_Xr(hby zhi~W-KK)-TK!kLT_v!xX0Df~amy;9cr+#^K-j)m-k&!VerhaJKC3`Y$l@bQ)k$O58 zYCBKmR4z?#S(^=m!&f#TffWcf5*sM8k{Cj|~*TCgXdAMal9+-=cI_{KUGjJg~+ z+0B#W%9=x-Bq{nx5;1i#(oy(&?X8VI=D4jkfgVYI$;&B*ebqWJ>Xd~Wy5;oH+k|kM zv;Gkl=erisB*)3=GqhS!#XPj$;3ImD$1@_gAC(;6eWVrS&vkfKzx0@HJs;aM!-oOy zRR0#t$k8t-h-`UJGV|NWR3et_HRHOK7G4m=Mf$z!Od!+V$Z8q>lPLvrqjfvoa9mjC zl1fm(Im=zDARlAdEt|fspW<*yX8L_7I7?_t=*=^WeYVJ2cYZxS5-mlH9*24of+n2r z{2gFzrQ5v05Nh+}1@fgFHtwZxUao^ip2J_&SUEvZo%sF2SX-S*A9>WaJmideyEZtu zblWr;$2_KBHKefLX8#B;@8c_7f+@-``*^}`J9R`JiIhn~1XxLqu8GeWgBVv%hO*6o zcYs&NYeYi1qgn(iG*co#iRR_#{{qxQ9je1kRiou$$+%h#D*2B^dNA{Oqq^R!5sP)roT$i=? z_1^};{LZ(-*T%wR-KaG{;w7I-8ZS23c7Oz~XEhj|T@82GnK4TA)$k~IdD+*7^loij z>x~k^ub3Pwem}lXMvrxIbmn!7@>zdLO=EHtSSO;`L*sz%0BOq zn~KT%-gCh!#Xt0Ou7egk4xc&pfrpe0$c~Kz?7|Rj$YRH?rC^ZZhQFPs3*xknQ{S); zf#NQ|clARAYUyYdo}k20y>~NZ5|wXvDS|E*>@3qrh@S zz(@`&VfZ~awV~w^MX|O%VANza^e}p-9kxihJAOOM$N{}Y$-9n3YaiXPSK_jvXwooS zi-{Jq5URS%|N3F*l`G_0IE=A>w6V+Q6?f;wX00GTAa(=ZXvMtPnc+2YjJTMvdDaIz zufH?JTVh7;Nq;bD3DfYZ&xR2WXqGq8;yZJz<6UUdYF7M}7#Alsy_~t3<9gc!D(z${V%NDNhPf!n>q7&q8l-TpV@ zq8=hE+MXk0>gb1YL~F)Pg*?vXziC7xL#&C_)lRI{Nw1IHs44Ym!CQ^ZdtX}8V1$=# z-<$2mx*#URGzBB{1FGXktdBF-!!#&wc=~Dw?rt<#D%Dm7&yq8x*m{zumC(<~9tI9q0&N5%!MO&JUz z*yl`TSd53Pzb9}cGcg;7uBrI5Kep%&wXNVB7q5Z~tmS`{v-)v8pw9K;fP$h~{E({g>GqF{&-i z!i`xrjAN`?-vLhKDRGxC#P|I$|E*MR#HXrvi%gu8ad1~>J?x!%BvcVvh2%dps@zC< zCJOB2KT1nyt_WwF1e&o2BXG%sQEe1 z+45-FH9e4eSxZc%YE+eME+CF|4R$YI}e9IAjZbVW@cqlzdZd`LQY7R(X)n0 zDO=fD?o}3_e_o?E)lfsx3X!P<(eB`ogB_obQ?3=A^}g6IaUxR<18UH#Eu^#q7E*Pm zI&c>wsT0DM^BEbhLp2mHw|%TajnMa}{f@SD`FT+~?j7zn3L-;@)qz zAw4%caBo$_bY7+)zw)JkNA-(b|IBF?+$D9$V~KFaT;dt2##_|IDCs8g0AxybKY(uc z7KPwnuHH#rKQfUt5pcuasE?&}usI@^rrq(E36WFGY`IrMNL9y-j@w|pg(x)S#=_*n z8#~XiV7pN-T{UH$M>I4FOQ;<8{e~vU1|pQ+^wuo|>byr9Ed!eNZ5uwz+A-l++}2w& zMP&COpqIFL@<8TPRAgbXx7Am!cG@UOsi3ASA4K+yNU)QJlL7ur;s}@x1nsR05L7wJc(7%4xU(`WiE=Sp>#p7-Bz1@tSM_&d| zG5d#8kr~-kWT@AHc1H-Y%X5qd_%LmXs+A{QD?KCFaq-JMD6$@(m@=hor)OtvQco(J z<377nkg;I4khbVo#M9@L7kRgWss$t19?B-SE=k)ZShlVm(W!{YU?;o62sb4xVMxdb z2=e{mLPMc9VPubk<@dsK*OkWkmPyj0k@K|~lsw0ej~>g7{Tu4`mj)f$o}yuxLS9PL zd+Y?xn6@B`+33F0Fw$9aA`pH*W})H9LOS#eNU~<>Y??3p6Io4{N2T8M_s>QXY-dAg zMiI*{`q$E2HTD!C{mazIf2X{k5F{L!S%ir~v&!@zWt(2@ zMnDb}M$<*g;>-o;agX&AK>!vG;eemE?f18I$l@yz8@l|G(ew$Lb;t?stI&o-3R4 z8GQ*YsPApU`dm+-!D4usVsgkDiMc`i{i7Pm*nB|Mf+GE%BeV~7y6b`4 zRyR`;%!`;|8!)8TvGWv47C#B9C^a}u5)^^$r^-}d99v!jx?A;dk2YDsV(a5*fpQBZ zp-dXeEXT(zns;DdLzb|%w!&J9fMElLr_l}--XSX-nVVUAJ-nSvgGFUo>9J7p_sny{n(Sx<6!4ZC)QCkob(ypZ3?n{l(J#iy>`I_}ifaH&`LaO@fIV?LyH6vWQ z#yQ8*U(~-Aous6%e_1jw3pU{HmvbP6i#`-+al`j%zB81WlKyBJ5n{&GzT+}IGh%B9XZR^&63ULE#; zLb)cvtW4rEjlkC;#L^M<9Xgxs8fMx%ZhxSl{R`;L!Te_@4*F$4h|S|FnDjAAhz`Um z`cba81fywJvXfzgQ1n;(C-x0ZJRP&iNb_X8V+Pk?PJfSx#(P_WV4&Dj#sG|1Gx}(H zE&v-?pEg6=q-=rh%F4~_w!7X8H9XtMat@9W+y6D*E=PqtsuA@L1{>$V&3w_N*ZHJ` z7tBaUa?VbRM~dfG?-;I=)($;c2%qxh=u-S0AzFx_?o_Ti^K%8Zqycx(!rA_$e?YI4XMvGOMSv&! zZ3T^W{DMxhfqw8|kd*Iv+PdHA`UFi5SJaF7m5nbB8z|Q<9C{o{6PooL?vFY| z5o4$2y0g59Rr+D-y0E5;+H)rsnOwO~dI2ka3COHj8DbZt`EuQz#c&GR!LJ0qEb0!l z=>su_?^00(Nj%o9s1xhZ)99KNv|3B=#XIN8f*D#2B6cqs# zm7}!d5r~L@(px}9MY@U*sS#;XLg)yA1djp&0-DevL_~TCy+afP4823B(p%_|0BN)F znfLmx=f})9-#hc`o97o{?|a{Mt#z-yBDS4C^8=kuXK02qbUw$0_3i6?3l}*QbFX?{ z520J}X0>i6Ao$eXI*Wu< z^8vy2H8R@Q7>$y{pTT^JSw({C7U1qo&V=p+^#jDb)k9nW!^>p*higd+^ z^bnU5s{<^Bf^vJN&xnQ+(NBmu4)F@=hL{iaJMMD(k{0kLn3zcv)n<95zTdROuA}j% zW&VHZ0=~UD)@Z5a9=vL%K*?SlPfe}R|TSnpPeyn~>Ri@X)3Z|k&BS8h{w(i*Ok z`8bA>l?v~<9AzstY^*)Vsji+T`ObM^;_RgUxPl2^ZSPj{Skd^Y`x8f3Agm^)3@dP1 zm=oOnEyfqq_s#M(MEmvl%65Vic60ABejM0*`@X%!yXtVXSWzWn+g<6AUxGlVg%YUB zEs5)5Rqd-}RF@91B1S^_(i-_vYwX04jx$)5Of^X5N5a=GeOtS|dlp{T&!Ch145vV% z8Y1H$NtbGk$m+316VICqaYvy)e4)cF389ry1z{_yR>&?U|1b;`UV zrPnQOi4CgohIesS(tKL_+=FxC=51)sPqr?F*EJoz`9Ym#G-5@}3-wqro0NtphKpRi zSs;|?k9DZeOMGZ#bg|*r?7GOVhUSp1LfrBxj|GKyt*wd6vBz;f20tSlUlzUdGE!)V zXA!#smW0DboAngNFDS<;koogYgwP>D$F!}EbtK1)&TBNHV~j{dTgQSw{Th3l6PK4`#a_(Nt4J`Uv z>p*-`Pd@6P`%qe`Jr7pCXvz{SH7DB+p47}yLV35gteftR@r|m<98|h4l4=8}ysX_h zVTJu^*79)LUAAwZV2i&Vy}AujYSS+e>+K`&r=i={eP#Gs?BQARow%4WZvm`%+q)+Y zLZQpmq@^YgzqRq_7GRjWb?TrNQ!FCbq^YKeNTlZlkEQDc1Y{+FRWP0jlaH|}-MpPF z!ypVLbs^I6@@apCP=wurlq(Q&px)VWNnteI&2$P~@8-Y|gY>5liA7YI{fOAMOD8_Q zE=FJM5Ko#M>*(+AaH*1AZd?RhFm-rB#_AT#ugjo3E!x`udS+>+kb0}3d7$ZD+$FrU zMg0Dz@Q^@w z-fLPJ^rNSUZ(h$=RXu>H7MIe&*Kf`Tn|N^aRlpst#Xfl_xb>#UoY6dTcgo34Lk(sJ&VKL~Gb zKB(f^9-=I8>PwAx@fkgpsdF`y4Si-Bk?%Ipn$t5huLg-MsJ1tfCYDZ$yHnj{s*Xqx z^w~iwB%#*U+qXqgkU4`f4qF}k(Pl_yny!?QaV9jmMw+NEo$J1P?aCF%K$lo_o#W54 zB{sbvcvO!0^G)KH4QzMcUEMCJduEx$eLqoUJ#4IfKF&yrYzzB{WFS*rL@R&3nrhNe-6#dy3!IU??|nG3{42^y2o>V$tT z?Y6W>catx_a{`BEeQfXUr4O4j1#QA?&Ezt@r<2F}LH*GTiK&yjK{+$(h&4BLdWRW= zIh!s}a}U3kI{KaCvG>|(74KCw-#cBxE&HwP20%3;foCR$UIwdq-}g_iky^}}GkwnT zVYWBN_TAiNNt}5dy7bMk?)b0R zK6reYu=-+NtW(}xv7`Awah9Hw3@Qzr(AvHcMDo(()l2xEs%D~@CcV34WOVSgD>;;> zPd8JUHrL&x!&i{ouJ^@rbkY9{M&n6eQD$M(#nLfXj&ZO!MTYnMco-xcWY>xi48-79*k@!R1@qF}WeqRgP-`|A8IL?O+&fX}@o8ooz?i{T%Ps zGx*>nYVY#Xi%2ncFGwcl<#j|}l@XSa1;g?DUajpT=4PNOwHtVBt+4v1ozT73M^9S& zm9>-ygZNHY=$9B4Fz*?`m}>Un|H$&Kg?%j7F~!nmI7msQ5_Y#I?Grn7lb`p3^PNyI zQsP2FBGD+QVKx(+opMV-g{pyGNzIwRmdAC@;q57&k{PX+L07L5KC})hpW2lHT}nKj z?d%;i;8+xQ9i}VHV_G*Rit!awf938wK=*xT+?M0@Bx%sjMUXF6(j^a?OxR8~i;QvL z3>-=KYT_7m(y^1cjC4RcJ>vP20ZZE+RbDy@A6^=*fGd6hI5cccv76C$?CY)7Qx|6j zJR9r2`10J%zrsUQFd0+Cdow>)XHf1Ht2maYM`bi)!aF`+$c%>*uEADpo|OP)lBCD& z;Jprx?heyqx?jgLGSC&TR)kT%97uLgi;iRFVc61mzwr6@iKY_73gVb^{X?k^IX5&h z&SQiA^Qf4-xW#i%hd6|#qqF(N#0n`Ri|V`)#}dG*%VkJg!rrua+6XIY@WSr4Bh4UY z77P)-j^&=xg$MaqRe+ET zeN9cvkw64qNLuU4a_x;NHphjF#u?RX)!*Kv4IYN|b=!I(^D%3OL3)8Fdk&x6iT)kG z{g?LdiiT%Jey1~kfBts}JU*=){L;U`OIR8PM z{~*r42{!*B3jaSQ3Ij6y4b?vD^$6-3unTM-V{DG6dIHAUFfHXRThY!y-6j;=t z^ZxQI(5N2NiV_5u!zTfGoQ>_?FrbW{tPjvwQ0@m54}Fqst?Pjp|VY0(tKZ}4h2+NXc zeYa16lFxFXHGm9X=?8WqZB9U^7cX7}WcM|?g3_U^j{QqZ*PA?CWZM?|5q7+6J1JOV z!1fC!*~V9dHD2Yh0E|{!aaiz-O9z;@&NMnLQuzk|(dy@(=)N?~sJFeh4y%&8e%)+8 zOwse-)hPU*h_~DwrGLdv?`95m@=r=lvu_y>d|2q3OEPry(|P%^SZum)1bdEZN9KUv zJp{iEpogCQ%Aq6$seP%GwjF=Qz46VkYjte%zJl!PBO0n>-n%crqLcW1OWeb_Oc$Gko5f&JuygEe>`%lT5uVy+@~cgFYAGK}mSkZAK~L!GAMNvjDFk?mV|KU(&63Ml(} zBQ3AYcfj-VB$1;NzN+rFqWuG_4hvf4vk6liUIJq+R~EV~NRCbugd2E?yb0mcCd$e_ z_h04S7oo**0*5jTvRHnDZGB>tdxg5N`b*bqoJ{hPqanY?Wv9p^DE0Qrw0zZ&^x%C5 zmtIezxrrf63s{QlXRlCG&~Z+kl`cLn*xC$?$6m4%c||%^l6dpV!VpqHw=~U_s8a?h~^VEfP_oLL>j^3)|q2YZ* z9#__C+y;vZFZybpFCX0S(+Si`yqGtz>{6tgDA8!+Bw6$M%l7DCgA{axG!#7clh+{6 zKvT`pAw2zDqOqqN>xwGA(CSCU1bXhdoRzV=&6j^K!Sktl4)o660EH^X)<>U`l7QuDNnVQ^#G%cd7236(#QVL-y_s7hB#g%9 zQjEKy^ZH&Zr z`6(M$W#g`V-#uH=2kB+21(mQ^B9YV|xJu?n*etrw#t^BBWwLJI|N2=QzI8~CN ztdc~6W86ABn+3F3+gEZhlAI-u9J$w4CC&(3Jk5RDme$@mo;7F$zXHi`x5?2^ksUKO zL%EET9fEGpu84{76yP2AA8VOfTvzEO-*d`yF6v$uYU_BcsZiD15IyN0CN3Fmp+XYh zZ_v)ecg6ipmDO`Q-tHK0QCCgENW;_>`xHUM`^6p>?~6=b&J6S|-`jkHZQjbQsnpeu zwd#8;kT40pNiV*E*HP&8ztDTjsZ$JNZ{So0vP)crat7J*O#1a5&EvRCF9K;5E^n&Pm+u?~Pfo ze6su8Pmj+yKko|GJWtLpxWB9Rs$m6{yFVKH(w0_`O|c!ml$hiCZo7Dh>@farxt0Fx z9%DLmH^?$~YqG*vPRXa~xl)efeD5phz9qhc>StL#)ID68qlVhW{)u)t6O;bdzS*Et zVj4}lnQiiMRoz5P3tmMsKqS@3+E{-otVB*vH@xo@H!NuXm>QuoA_>=T>}@iFw7c|} zq3eTkiZA+WUvgXtGL}<=KFN5SWd3Bo4Ci3#CUIdW1?CjZ#Yz7 zKlXPCh9#*RpDd(RJS!vPVLeG^Tz6(w*x2Xe#3^}ZaT1pkZgO?cu;*RJ+4?NJoVmP;=Z zlVl^ijPL%O*ybj23QkE;QRQhVP8ZBINxp#Q@U|KaF_DO6| z+~kU~XgyItF+WAN%7sE+=^YwvZ&wpAB+5V z-^8xTs}SW4y~!bsZih6IyZWh25mAqv>S5n$uwFXURh$2q6Ey+eU5L<@azd*tNJ;3` z3&fmC=rIys=*&~MebzUp?-wIib)$;Hg}5r+bWF`TbZ6OR@fSJWwGn;bZs?FKv(84) zRpgXfbC@|^6j7DPt5=dRwqOuU^fq~lqumJQTVCjdFH0y)U)A6Pei3v#E~6l;MU&7 zqwVwz5ooU=(QW2zfQ15Zl)t>P?Ov7`-0nyEAjeCqPbmm1ye%2;ty$T(=YNQm-cHfA zpeV)em}a?oGDXUpGLNFo`UKuf^k)8PH=h(*S3tfns*o7)XSvoDe%yC7|tA$UK-&$K++!|cNiSgY;ek5C>R$FnxL z>j?<~kF#=?Yr6;ksVdM&8WUvykbPQ5R6jXE$~Ra0T8Ev4EF2_fAs`a*(~jkQ`*l%1 zW~>^>eb=7lp#iH;7zXF96_2PBR-t2!M+_S zcAIJbAI>wq$5i<3fLs04LL?fnXtTLqUoqt-ckiadwG%O@*7;guiIec5t%Sc6Lril>x* z^=MJo#?g;|8)W#O0d}nwQkv%C=VOA{on?~s_I$@7@A&H%Y30%buGgMVpY%A*G;{vz znO1LTn5960`+4P=H`vl6vE#tk+(2tKc49LpAC0mEBpi~l)K88kcPI=2^noq#trg%M z1q{45uB?PT2aJ#q?NV{+ki86i`;svVr>;ZJQMB#vgF=sJ?wU{slPt>)7vWhvWNFq{ zVbE1rp)97X#Xo@mTg(Y~&bD|HUSCzNS@F211~P1hvy;M8}lP& zDn8EZLq2fR5Q*j5Md1s*n4!Viobf~B)30wNfE~@n*B2wGk##Q9U$aK%IpM+j708*` z@zhbb7J$`ieP5`VwMff49OdLqjbJ+LiYu=gJ z_ZA0A5D(TZ!3gp~vlfLpu1b4Abs0aPER6#w2^@Zya#_N2;74G=ga1Y2+W(g_=<;Q* z9E%zsAgCmO7KtUYYJjxd65@vwES+52LDl(DvKGfn?4uawdb6J&fK(=swtcx>&ZG4u z3*Sl(aJMP}>Ev+DFW@jzv2A1UE&w)5qnSRq37W*FqGAuxj6iQ54TrA`mUMkvPKxqf zxcs~MNwW zFiu3S%ohwW5)#ODP}S9vLL~_XL~#O5*s!+WdNkoF{&qp(hL)e4<$4qQPO4eIM@N@%{4W z2Pw?&hp)Sr4yfw{FWSU2)uqc^h51sFlE^hgYu3NsRg2uK=yqdQRVGokP`v6?LB+$0 z7i|1zz=&17Gw$DnhDpr%@TM+sROcVS^T4;M_Fa~#Glv5qR;uZl0O5h0`5k1=uF;hO zzSknK!R{Rf`yooyI_yXB6(u8|$L)|d{P%^tS+-&NHgElt&6?^Z_~E90c3NrZA;v;c zFs~WG1Jdpf9LvSAX&t$T#6I6NMS`m8ky*uLlZ5O!4s+#rV zVW|V;A{JG(3m!sw-vRnzt1d6Ng3V(!*_S(WSq<<)Q7?7O7`t_!yFLnwnv_;OPPOTi z;U=GcTg`d02D-O<;9t>FQGcN!FcC=;Q~C{Nd|(a8&b)d(Gk1<;U{*e%zS^NqZ+7cB z`RXyts&NQ!TEChAY5aV5|FkH`KW*|G9_D}WhI6G}@mKuWE4;ALOVy0;=`A9cb!Nu# zbh4A#6-cm!7TI0DN%KE*dsR!&`$o;9gI`xgZLUPIIAh-JR0Voowy886?R8xJ| z2gC}oMPspVyKY;Cr+G&Ubg<2vVGIYSt_h$vn~nr^fdX#k)zo;89>}I$-asJ_B6aKi zlbAJ>7+iq8=J{j00)6W!XxVmT*QFC@_^voYX-(8}{OI{=>JoB3N}9*%;P-JEdNrAX z%q-0|npT^dbq4iN9#gII2ZF8-^(xMm-NII;^pL5m9sG-pKjb*$*er#^8P&7o z-OH9n3^YGceKG4Nn}$^WA~>LJo11XaF%m_21FJcBmh7v)j&btqpzTNU3URL^CW9}A z-`jhPqkd%wdTrt-um%{%axawsTrCa`-FH-!!$o`Y1<-yO(xM}4MoAnKMjraoKSEmw zTVobJK#SLZGU}ymhd1lfoJvIU{3e&-*rLq{DBO}a5^UGz#M-PIx7vF$1ir19|IU3t z%l-_5LCsjWmkNX$`1zcyW9|iG#G_UP9Zw){kq@&e+_7JAFVi=!m-g{%J8L!6HOZ`i zwqSy&yR5fr4j!P0sgBI`aRJAJGaOU#9Dca7-s-e(NmD~+Dcn|%Is)rSNCh?K@;_Y# zwfp_{toe9h1ubRrSZ$T!mx)Yl-^>0weHBo}A2m2t>HR{4$85ll7K?5v9Qn*D_}2cq zcunsHXtcT2O=unZ`gJC)d)x0~@FLVVV7=ao#(0~O6pIsg+@{Ihy^cP|!d zFtK5puvWubk&$YFKJzDEmb-d$k}`%@0Mi`*l+HjY_i4~L`7R80jqd!wSHL*NLo7bZ zUn|~Ukm^wM886PP!EIApbYDCFtW0!$QCEgAdo+4m%zL=Z)@O6u4Z_J-4hKchUg9mn z%Wo?B40KGIWR4uVym(eiUc`Qt5@!0&*37|bvlOXe)2jr=NV&pkF|G4@$-cf7h5p+F z)=a^ztgg!%efoqNrOY70j(&P=_gt~ z;>QF$aof){?S)*(T+O4@tK!hY)lo|xrj*8|IKiY9_htqCyeoaMmD&i80&|vQ$Ei5v zb^aHc0lzXq7LWS^X!r`%*K@(VovQPR)i2F}q^Ap>P?H*$&KS5veErN~?g5n1=fnTo zRY-sEU*7gR)003|^uD^5Lc-{USB*}S`wYD@mCj^Vin{u*?894=-$CAGZ1|e<`r>1Y z^|>D*MG7pB!AP5!GnX#|Zv!>nF3x^FSSNNdmh;u@EhcJS&dmp3HsgbG2C%vUbM79J zUq#vX`dm5Io#diTrzF8zm4J`g)XypQovIXT9Jn41v|!^p_XYEIxxXvLm_|DMpFgL% zlka!t7G>;z&kO3`8MOf!Pm`4){A8`K2OF0Nz+MX6dU0o1!K~bwRAjBW=;*yZ0dQJf z6M*VYjL7kqSjeiS&Lr~K4?GTIfE}a;VC`$k6fHJKv4i;Z!PIG z{Z74m<%3$%JvO~sN6;?;Cgbyc-f(?%c+qU)a=dlqsc%oQ~1J0CmzZM`s0j0or!wE+kAJT~k@5Qhh{mR;0$U zxKXqQhVYvJH16)>DPJX~Tt6Y~K#(ZADD*oKEpc?I2>(&^OW_~~)FL2~gwz#Wz&cOV zngsAH-a`wNV_{0`!$mV2S@5Shno)vUfyKaKfhh^XH$(c#pdbhPMZ@k}PSbh8g{akW zMZSf}TeqL6;N4ge+kwh#B_u@xC3rsq5F;5GZL&N`V>J^scD!%iUMB%{Un^Ectt*^K z?v?eUBE-KAp_($b+PO^HKC65M6r^RW{WOPC3h2r3<=!stSWCGa`p~wM6CXZ40A{-w z2>wu#f5g61$##qE5JPiIX779x-w`}2+G)<;@bT2)h?#Bu%EYpiKLaI2hPGafG61!G z8o<#{xkiTzjv)7J0eA}eMFu@^GzbSRHLq2yfeZ;fSk{nQIJlXfG=-II?TuO^O~H+em(RUGkrS1vx-?K~4^_>3}z8 zfG43yzlW`2<7bpY2See>qfVW^q%V1u z#2!vrSoz3j!|0klA?2@WPwrHGvwbvw=lE%dljz8rtF#Zg6tNU@#PuLSOVjaZ(f$_E zJc3WCQZN zt`+9_*Zc*pL{2_=e}ErKN-=^!s0OSZ1F5>5r^5;a+W0ziAII`t9VwgoSOMTz&04j1 z!X{v6x~MWAOSFyxU#k8HXv?nd%D}}{s{w`Z{B+I}0hcA=XORVt$toU5we(lXtZ}8O zu_uU6V!{rOR%_i2zTK?PytVc9{jSjr<_}>rc46F>tYkpm$B!QhTJsWt%1)2bRY8uT z#N=QlnT6H989AC0pz|5_2{FsZOyMdw`xc_<0ZaXSQm}zOac+HF(E*xI9V|_b5RTlZ zm z_Wi}b0pecwdUHBeBSg?=%*{$D&#YqY4ZGlLYR#mD32C$YrIbw$UJ?FslT!syj5lzW z@qp&*#RClVG@n_jAhz;C%Xk)MGj1W*ujuOae$+K09qGzFJ&9FxGqReExjNMU^9P+r zF(GIBw1#cYim1Y+8iRP%t1>0GSxu$0;Ul3Q+u*g1yfqx@54IQT8{fFP<@i0?Z#RZ; z8>l6_Hk@K@NwJC@2XX>J^&i>?6j>5MK!#%Z=PUtomCu5!?d6_V%XVHRTT7_bPHs$>OQpq?>|>?PN>UR z&}93?cm;3$Cx-l_2&Bwrb{N7d=|8hqWSC*;?v7lvRj0RF7|eyZNBtxe+dsp|9@ zy%>{N#xHRni7uov^B*aLI?oqcMZIDfyOy0|A7rBS70lApA9td^muN70hUK`W%n=R4 zQbUpEv5~VgQ=qEs3vDFXt+8P>!L`=dDwEs2ctOjgq`9vl?Cf*(j%n?#SwMV{y`;*c zzXNLkOYo2P=bQ%fNQG97EaoIjWvSA2s=*!?Aiw`{_9icoq^r+Boe>VDPlt&Y{Hg5u zs&{j6SPwX;`#bjWR%q1LiDcVqf|EH!}v2{x%i{8becfgUD9o!EEA=+?Dq&joYHBbce zx(hK;@~Y>{ETJ)&(`gexGA9&s8wW~X9mpLLVr>c$Sd4XpYGICrenSJsqNaK^KuQ7d zg^yJh6&JgI|L3?Ci(8%U>PBh&Bu2bhz(F%Q@HDXV$0l9{u1wrD{2);YSHC&i%kJI# z*@`3-u-|-7e)DaM=KQfwnXy4)3KPTh;+M0TF8pI#Z?I(?LT8}$o6T=X-`5YOia#wu z98R25bDN1+%0hRkzjn1TWS(#M_6g-lZ)k}N^5|8IORs7!wzaa^YFUO1aT%xt+eU#L zv? znT(`wMUYbZ)~5FEIuP2BuZI#jw!&W~3_ev9hE3E~rKY9=m;76H?ujZ7`(E4qt+|<& zCZko zX6z&;mAMOL?E;#`gYFQu=pQ`9zqDSWzsls#gnnTGl+Fa85W_{*07&crM9yo(P~ASo zcfK`79CKb&#%v@2IBsyr4k9PR}*XNPa-idVVv{vQF9L6_GA_ zu1jTNGg4SSQ2{<7WWT#Qs!(VESjCe~{G%f69RXGr5@IM*ls%^|R(d`OF5qooX;My( zn2MXtg`BCKMNhQ}Ny+|DoJQ-6c&SkKicl#WH+#P~<~sE*snt90pR!g@gnQY}YDzu& z^2x60vZDL!W|bP$q{QyWa1kia1XC`T^y7M?rd`OD{p@?IF&+=OxU1lXjZzMmBG0hy z*H?TJx`Lqdp40JA6@hlwR}e@?=z zT=-n0IKCD=E1)I)lpiMjGhC{E?+v&A3jixYIRC8>b@~+G1hGa0;l|3Gh6KYs0aiF* zrk>{8x@^ z0e>x?C!Gq3HkT=C;rGxzZxn4Oq$w2Oxz@OXC)5LU0<|B95<_~Ci&{i)-$jewd|vpg zY{(KZ6QO`Uf_awiSqfnPDzFWkp-HnI1SCTqK9QW;`_%ZnhH#(X_1xm(E&6uXdg+7tBp*vrax%$DQEm!zTNt=TCwqgUun94Jx+pyAfUL_duwC%)08Gr$SG1Nnp10Q zovpP_%$~$uzx86ct9Za*3u5UsSbL@6^SvUq7=77*FPV~$3>3d!ND7SrqJ)HRR+5X` zq=RCWG4~I}1^_3o+`nDNe|4ELS~yod0i`}YSZ>tG0wcKC0{NCNdZ)fpSGzzd5M1d*8fHw_r7X%+dAHWpgb^sZN(r^xHMw|U~t+7E!wQ&8S zUZRTq>_+C=!QG^epbx6{dn1!-mClbxerT2d*(OMbozJpq41*Zs!KvNx-)GulLm1*( zu!b#m4sKa66TdI&-k8XaieHa^sNOvwe5#?SMG(l6!3eQ~TKEVjw4vxNDAnD5Lwx3D4C9xeYJ;SHqqFbDD zNZqtfCwsE+tOLAFtolwWcf=LB8^p(li2BvKBCol*IYt~(zdL9KNaMqpYsG^^Vw}13 zw0M&O+59POa{#(efe3b@s#-LWCoKJl8+ch%qyFV<>R{WBoy*YuRs(mGJVMXF@;shC zTi~iyVAuNX&D+6(059@SbM*y(Px9NzPW5$}FC8>8!ge;ZzBZ#kkr{>Z|FOmHVSAE; zgZnZkYcC=vxx4AipSON(wMnt|yHHFF?yJfKaAvNXO}q>B01=<0&np0;^waPY#yo(p zRnjf1hDL66e-?uZs?zA~x(G4<^zPi%(Xdt>sk%~t=*_#W&3tN#&9So(( z>}nftrf4Xk@wZnsf}a^1i<)Syb=`e?VxYgDz6IP;Q{1R{dP4gQ04L~f;ZU82k^Bk% zh@BoyP)Q+hUvJK|fMi}%NcJFTzGdA(t2iF8Kz&Q`9Ic(|aQ&-pPhns4Znf9?ZSuN& zP+b`y=g-EvzhF60GHiy|DV5tU!-c7UO=jv=86b6kgxwPvY`m&M3!(ZQ0ldCS0fVJr zY9s#Vj$hEV@kDlH;YI}ADFDFIz)O*Pb}yqIIfxf>^G-}))RMNBJ{?i~tM~jpz_sgN zx&ZIBF%qy&dB4SpIvU{R##KiBL+BqM`C#DNbnyouz;s0Md(U|JE8P%YD|-iYy*|b+ zs!pH);d36l1Ngf|2m+W=1dt;6ltrcM=)Xmd1O8xlc>P{v0wq%cFgkN54oxm6c8+?h zgAtT=xs&dDL=jC`<~^-f?k78uPrqtN0QO5@thW20V<*l4H}bk!!f~!Jn+iSeiE`SZ zM;&EVz$GhN=g`v*s31AYn4P#(3k>M`^U-OHxDl|-YGc47pl${5)jR$<{E_!C*jS0U z1n_fc>35B7omds0)sX>j4UiIW^eSKN)Wvk4eg(d=@k(D5uJXZ-af}yQX|Qqm5(^T^ zg@`5msQ!~wJJE89V#}@hjhcZT>RnOhsOBQ`wxJZY0yv9Rr z2EAwl@bdxz8hYoS&yF-s0Qx5o`*q?hI&^+yCkC)o-{G)Wn)~tKSn(hp$^uBh@n4V8 z<_KH|298BH_M0VPP~q||rAiT^&TX(#H+Sdk-#Nm|t;Y|o zX|K|C9)gsr*hJVuu;zj8KbB*FJR^Y`8bgQ|?7&8T?tA}#9W(gv+OmHSHQYU8@#D~4 z^3HeQkPthIKyl%~YX)5@*hD+egvCR$e&q9Kz-5sO04di$mS@L=U;k@B&i_~5yIGAY z%D#+GW(4L;`pRz$yrq)r7tDYHV}4arh29 z-1K}e*=gj*b|&M-H%ng|M{keBt#vb<8cD)#qr(th?Xc?WNUFUe|C#zNp-afunkS_u z0y|9>-6p%o+9}Q4?R2<}JPK_83yAgZm?HecMqi zZ-&DW3bCPPEr4NApnRL!(kVin*rfy>xeJp8_8ZHEVfVff3BJ9u7YXzS(Z{`F@12ar)xB!y8~KjQ2J&}+<2+#J9g%zxxkmR6MnN92FbWVUPV@` z0|(SVIgi;BLxlK9B^%2q*G$*f{n))FaYjf5sGu^AV1@6iS4h^<);0=!IB)n{*tI|j zvx8bfoyI6-!a=NXqZwf*Rx56fSx_}sp~ammw6_fM*iCx~m7kl4soGRUtw)pZEErVJ ztY-?drwG|+R_<2SWZH!29nd%7uoS=~Dk7lO@k7mng|_NjV6+Xj1dAvHIFlvn2s?eK zx*3cHj3#*T8Bm=>Wz)%PYd{I_E5-5Frl7OCJ#e^!Gp zl#g*h)`B`QU!8bYqP{g{7&jRJb%_Ebg)Uw$<{l2(e~o3EAi#o5Chu_PPO4i^rA0|5 z8yjs>IyLL}6I6@|>lr)i@D#I6Z|Uw8Gii(+iVH zl)`9|ykLmNG}062iXENU5vmA%zKHk_^IRExnY- zKsEn>15&4QlRkiE>o`MjoF?V2SNjkum1I0}zvYWy43b};KrQp(gyi;q zv@do+0~}n)xh%$-$W(6^%4H{%aUvN!1yuQx^q(aF4%ppu{DMGmwn0?bL{rzg;AR0C zwlDz}??qYqGncSd`yaS*;I!_>%Wpcp$s`<|76d6USDevN(53ZtK~!B^=0uu8n4sGCB8!fz8_vsl_0A&HkY1RG9Mzsy1hO@aw{AH#9Yl~R0 zSidZIBH5z_@A9Wa|1rQRhWrR%3?$Ojw|b5kj4^kGr1V^b2~2vL!Z>5)PNp9~6ejCw zpFj}8L?wM93AOV`(QSwHR)cUvGh}0Q@}_S9WAN7UwK%TV(~$(`Cc4@4B3OE6tpTIN zO>fNCF(%ae5hqcrkTdQ}9=r z93=kYP?Pp&jH9R>fPvi_ZjPj4xnG|F>W^3d-J_-7L}NKpIPLKVAzl8j0bM;0p{)9E zp2cS%?4Oq=x6%!Ohv|?Bzz_oI*jtKYUVq0Ubuf$LLNYWl%}CdgYm5n2giuEAtKM|$ z7AEmWlCja5PHx|&2QA}nb2$Ikz3TZwG{_`js_sbZ>-9MZ_R0wqeQW;WomTSRMUV?) zZr559=Y#B6HIrh@?-+1_9aabimk|?-+pHa-a-`?Mj=>ou3q(+(REA_&DpOhs-1d>J z5eq-sGAB2QhPe7A9&2@fhBYtmi1MjS6EMMNI9<#^iEl#wQ`t~yg{mJ(l(Lp+xS+~GCetEWR!hFEhL zYl6w8M_V54aIS#rXIFFQyv0WgKl;t9PrlbIyq1%lcH-Kmm0p%xgq56@4K*;vE5a2*l zz%}jXfH8-m$}B<0xT+1;h(Ds;bpa+oIb`{FFv)*EJb#!sJmXAKaTb`tXewM@$Dd|5 zN3>#g3o=qnChtVm{5o^rGC zeHA9bPHC9p!Oo({h9a3sQe!6L#nyh8V*2Qr71;Dr;Q*^qVEK`;*Oq;)!PaNC+EPZCbXDs4 zEy>Z*Mnhae^eE{Pqv?2GS7q8`W|!O~=~BMpHHE>D%-|(l+iLRM!}C(8RN<;q{qN3| z88*MuKWlQ-^@juNNp89~KC6P6wDtguP1UTlRj-U;_`+xv?w31g zm58VB^ufElb>xGkY(Q}rwq(RJE};&rQ}5KoQYM~zw(ax*@f_=K9w64_#2lw?iePhP zjHAbgDYceQ<1TXN+2U(2jc?f?o9OP#VO_IP)pL?9%Bs7RWU2gv2R{uMl(sdRZk1~8 znCWO{M_|FP!chI@_UktE!&ITuOQ60+q6WuWZk3u3UBJC#Hx69)>pL%+TjsRp>}{fc z*)+APRX`zRl)AwaGlB5;ZWc+$wnh+izxQ7FwPQDKth(QSIdgq;$Fb+wVRqCp815#o6X6AEV@C<{WzN5VvbdJ;BzNdp6mH^fd;RkOO5$%%NWAJ z@9p2@Pfs{E^{bS8hn3Tt1e?dJvc49$-(KtR)G!DJ9z0_HLIhi zHayclkfNBZy&Cn;8YFzrwag&8vpRq zTE2a=VF7jo3G;jWma4@6(gl=CKBq0)2;Aw2v$Eo}gLG3fqn)odno7>jC&HhY2#-FPrCp?bN zfQXi=a~LbdUo4LRl5Zi{Gn|#o&h)-S!OIKUE`5%WOmE9y@@SJ#_l~|^g)?4^m-vP? z3`^>;Ty2x^6IW^|tQx4|&gCib8&81bUz@5imi7BW9@*rK`(iNtS>WvK%L z>p3a}k4f9ONFuApZ>Td)*!brqnoh!TOFJHk{d3N=^EtbMyxQKY84(hzic9sblV39| zGRT+Asw3unis-KeZ|slV+kb15aB;{{L!xFM3>p5Fbi%pneQT$6jq&5EarsHNp6Ge- zeWWtvf&B)MqqL)@N)d`^uS^1m4LJLV_rYyeU`Dys1NmEE!Skaz1alb|U1s0MT>NFj zf){h0@63j`L*1&j>E;5sMnJg_=Q*6w5c{i)BY$+2p@y~;zMB}+wZ;}LI>|AA~NU5T@PMgx2*^GN%httf3 zwRX3-3kC7b=7#ltBPl~|9OA~wzJoOyX3hRi&GBQIK9Uy6EuWzla6dW{R_Mg?ru3;ht+Y>6IAMp0^}=BqQeG(_CsYM%_?ocg}k_rD`w zFDFbDkCqHXB`yCdEikBgb=T?}+U&G}9!tMcE{O*!4}ZGpjK39X-va)aY+G*3e}g!a z3GJqwW=lU=i4^e&KwN*OHLT%_77X(UXsPUWuTM!)yY_!n_g-O5 zb#2!uK8ghuR0O08h)9is^d{1jDkZc~lqwK9p@gRNj`R)!QbQ<#fYeCu9YP7ch2BF? z`0;tacb|O!!9Lu39<3{xYtA*V%zI{CV~qPA>7_t235~V<)y75osQeAvexALUNYr9oKQ^s;?8Z(0e_YR z4?4B4bHyS$Dj%f?e4BP-?wFtieQ=!B7pl<5UA$iGrQk$lj(FUxsmz8)fl@EC#NnpZpNnyQ+PF zInuOMjt9xCtd{ptjG}E*XUtGkA4x)=wR$g@vh# z_a3AnHff@{9|wQo50^VLRKxF+V9ze*GCK6dnrt;38}Uj#8_!l$rh?MEpGqkCpX*`>4D z&gWR~#Hnvrwu5xhtix#a*xQ<_-%Y?rZ&33l9JiL~S-V{7nvwDFU5t2zo4(?%gBePp zA9B!vY#x=QY7|AiwuZ~8uc6>8ht27N1ETNl6dqfJ`YSHYHa|QA&Y^1DoFtNSK!^M% z2r^5Haqpe}cRkN*^#1{Vs^9(uRs15uB*xP|oE!VWcU!bucBn0@IcY%E#v#zayYW5K z51x-`kSkbVylZ~Feydz8_p#eP;oasLjU%p_1g}5!Hu7=6JMrx#0+H!%F(ogOX?!|G zKQHi8)o1z#&ntF#JG>k_xHrF3m0qeIQ(M)^%&et^3RwP9vMumXTeQBn{S zKb$RqnaRG;a|z=H|LC)=dK#*|+Gtdnwl8&{fQDG!NMU5{hOba|mzG|>&;yfA4pYLm zSnqr{#-A;+{O~{msE{H$xrs_`?B=_X39~~`?3lJu68F`1o2XmYZTmUjsuI<1@G`yT zaS~-S072ERy!}-svYfm6$5AiujIq-=_tN{F!%zznl!nLb6XRIxmo*kY^gT$~X(Qvh zub2fBQGPU&n#LG=m{g3P4UBw~m)2%kz6^QFpgoa}8T7n7{?JPU<^)22?7JfkflE0oQ*bT)m#ioaru?b33T8fgp>dJ%Zg_b*94;28o-4TFO^n zCdkhZOMl|cz=Wk*Yedu>&BxAdVT1yDLEr@2BD#H7QF#-R7Z_e9Cf1;ZYC8fWN)v zjuVrg-Fcgp$hDl6F1GP-zR0>ng*L(3$)yCG!o`B_5y`tZODzH&X;fAx|zVeo1TYJU1*;Po=RBa*43wXClwQK z@kY4kS7A9DZh0XhBD-vo^H{cmD-0)0++$9+jvV$GQdT(|$bql4m0^yo@@I=OJzBnC z-7;rTA7B$BIx4qxW904q++hqZpe~XnFK~L`Y)p9$<<#DSDs6l|nb)6oZVz)ISF8#Z z2bWCNaVpcUnsGMkt|XYsN9vg&E2?AeAvq>kzu1MJp<6iHbA$4h`|Y7s0H&`-a7E4inCz*#jP?r;b&ET2!< z!rG(Z-0j0V+*#9}+qr$iQJKY_R8Pz*81PVP(z3xs&8C z%C6rB#H@kOMm*=WXt$}$8Jp1ETmxnK5j9Bj*q%A%?LnO>u@3_9-w0YOu|-RfvT8k< zA&a-noCV@_Hr6&*&IyraULbSABfY_$3B)BDv+?N%JpA&EvSnxe$HZ!l#*W_k##YpN znMDlWz?*Gh@_vCl&`ww$`O+KsKno}h>k95=ZP;?}Sl$w6_}d| zfTfEti%b5E0-j#BpcTr~WQ}~ZsbJWB3o(6AI^%EijZr?#@7+;j%OG)^GgkR|M3jt~ zb+19DkE7|dS!T`Ib$R`Mf#wM`yS^<`zHZC!X3Akthj?~ZXV?d)v@c{_DGm!syqhJ1 zmED&D-gGC98{GdB62GD(X2fubA5GC4mwQ(hyF129A4qRTjYB2Vw+v!L|DL7b&oZ4)NhCT z9Z?s}LuRJHiWB?0ZckBb0CWK7)sgEbR@4V%aYqrxIW(N4+64z*)o-0@XQGs8oV zTG(bC3|6aAczo~$af5+4YK+!pRO!I2bo@7j1@OF~U7eDGe{Q(o?&8w@?Xqo@_nDmpo}SFNH#boc+Ilj9Gf=#QSB++tBfb%~7H$6fQ(LIjO$=X_AO-Zi(0V zfK0H_85`fqr;OwCn0@ea>P!PPcaESlR(g=U3CSYRX!6Hylx>>wR&@t0J-;a=YSP!PEYT8aFc0-FiewNATqQ9o&Mav%)=0Bn;u!-bN(?$A= z#&55ixc-A)TSK<;IRHYMVN!2H2prb%Bv(i1!ljQ8U4<^ zO#p5`LQNiihXSfptoL-jH0zT%i9B+?_j>y@xoTb8T4}{6ZHRhV;2=x5TALHA_h6)Va1QX-#42dh)%40{_JVg0j^oaRpK!FjfDVNRSV|Tj`oM z-aV|Tr&D_F0~envWTEk_cK`EwTBOG9C4J4$U|dLesA#GFdbbAE;f3PC8qDsD5t7kM z=TMb9m4&#WQj*`gBsEKPb^!%*6sLSXKG06w^{>bxocH(4-a0+EandW!uoS@K;_VvN z@M3R(yc*Ce;;wxIz+J%lz0Z;G<=0pvnyg_~?v(uW3>|{+Z}R@hRQ>%s86%=+L1}xi z$7@CxElcT6*%siyig_!3%Uc@$x-uRqticm($nSl$xD^I*kM!9)wi}RpbA>2J zC87|HY)Q)6sl6$XC#m7p#d3I!)cT|L(wS(#6Old6Ie`j|o$GUGK<~6LjW#0@b+8=| zxNv`mZ>=&x&WcWVnQHxB3@}@X7(lJxO}dLU52`s48Z~@u1l?~#Io)dE`Uja}gAOU@ zeLp*)HlR=mj>{|t_~2;mE_bN>!YvD3e3PCMTf>ivXyjMSZF$c^lRWli$A<15qF6s? zlegEh0S4q_C-5c>6kwX3A5zZ`U*=Mg<*Uu^PI!o{>lrVWJ}CraO2r%Kvhc^3-)8}Z_Zj-z#Ea96VKmJ;J*HCXP`GY&?bm{&9Nrz8!+kMBMSh6Vl z;JGv;!>#4`uHGZI;;TsEDV4b4aWKYodA8J4inzjcwNFcMLg;4pyWAJhY9x7D(Ms)t-CwE{xoY>I0Rc4*EA; z^VR}0_1Ty+=a+L1?$rKOuzIL_KA$=|72CX(X}GX)^9T(x$|!VQC;tBD9=a|KVE6Kh zMt1A*e!zHy;7`U_yIFVa*UT&5ocI%$XMf~Z$kIMU_4v|zP8HlEUdWzXexU9gb!HVM zFkW~gs%)w248@DXmEIL&t`{_-g8@8oo71vFT_p7+w>}kIekTth7QLo8uJf=pzW>h^ zk$ia8-|VmJ#uoUm7KDf>?b*MS%QXpO{BNGswcIJ>e|O4w5*2*C8daiq^L}I!Zs+Uy z|K?n)CjZsi)nGHo#g954q#p?x5~bNYPRpQ^{?^tas@;mF7FnRV_bue#Io{dr{nrNj z|1$jsVX%vwz$9_DY;sMIUpITO#N+MF^XpFs2)Ae=|p2u@4{;Hu~SLs*W|9(Mq?SSDr=XJc!CVNpU;e3#6an*Jh zf3@sI=(@JnoxHlL`cJnt_{pr-NyUIT%hWhNk^KJt<%IL;SrD1+-`vk@wG0Dvx8Wqi zyC{~OEnD#V$vk%suMVntpqV~wem$mji4W7p!LscdoDlv-pd^|8!hK z?E36_sEVJpj;KN;h=%L3Vl5<2&Ia%usk3WcO-8+hO5A_fkaC?#ktsnqZ5fa_sTA^` zeVG1XfHeFh9febJU&}cmI9&PQFEYiZpZ;fP`R(gsX(B>j#rL~9B(Ek(86BQL7xAtr z0CeZh+^L=9Woj;426V>>b+HNv$Nw$nb=~Y`y!ZTeQCEbEfvah!Al-a&k&G9seck$Dk;y}}h@GkpyIGm-NKo8(zn-7aD6dh4BTISq)N^lB^y(_scfuuG~E zXX~nxr}HgQ%RZTBy%rgR*W}}Md-o;N^D@Nky%>Hpc0l6rT4m3$-|{gM{2-6du}p@P z*h}j_gQv-edns}Kd;KRT;D2xY|5wrR|HV$wYu7}G(`s`XVRtpbIu(r%XuD9hJEXN* z3TXen_RxJT{F_;9zKe-GUA|xY;3Q_H6Ez;&@xyuO z@4D`s+BwcYQn7c^O-4YpJYwfWw(DG8FFW++yf6q;-E`*{Y!$vrF#~VMxH45&KrOv4 zW6lp23+uEYnev8Uz`dF38fO>R8me)Rm5s~p(N6>ywnh)#l0FZw=B^-EP_MS^Qfuh_ zG?t;2jh$PhL)R<)HE9)@e$06?EQ4z$Qxnsx5;%DYOGnfE$%>b6Z*3Q_Av>T0+dfDW zZN9OunwS+`eup+Zo#GW2%<#%ahV>t3V61Axm4nw}X3x`)$mPm9Cb*!m6-rXBEaHp=a|KfF^zL8+E zr_Ce>fSPPO7F(ZvCx9|h4b!W&LV}1!P02mf(*=p$$N|G-%Hz!Xs@F_3iKU@ar|lct zUQFi$JUmKqW9A#AS?6+hafhL2%5$bR&mqmCFsiB^WCI40b&`4MJ|d>z#w_RWAA|-) zK1A=9MBszEf_$>7P;Xs9vwx!GbX*0{cjWSXJ3pqmbv0s=UjKtLGJC*PX$8GH;M!OL zM8NUMk0J5SMagU+Yr`pqWC}%Skd%JcL#=WDGxGa2n26!YnRA1zs>fY-qwXNM!0SAy zNwMt?rM=1Ecl4HB_+J_Vg~^GmGF-wWco}*ac(v=y(Mz_TCQY_s8E?ATzJj;ny7KSf z&DrE%`hDL!;eLy8*rlfF%aOOh?xPH{W}+7ac7^b5vm_I!>bl(yZ@2L&e`ndOQy3Aj!*-qmhK19M{gquPC+9N2;K~#XxD&>_O>e_?JS>-kn)I-hAd#5$S=+XWDMRwy=XLE>^)oTKK!5fpFBBB>I)h1y z6jI8J9kf_vIseQLcGZr?-0RbUtc$BTyY@Q)n!V7w*t@|M6w>vi_HR&wBSOd4)gfE~ks0q>AWrYzbGdhg8 zBf0(iI)DWIwvn;mrwxxru%ZH9YQ^m&g}I-oHkla;cgWJ$+{byX%s0wYGzA1WH&Tp{ ztP#;?Mb$Qz#``hBF#_$G04mmS1tR3r58LW(t9{-8mYuld1#c z2AX^-7+)-}u%0wN0>}i5nR^Ok+2AVF;#GCA0E+2MrD=(3iicl}gyjDj&^N; z>HO9xkHa&%jRBh$pIPfLdCGA zt>Nc%%gb6?ZbwD2XYsGws8$2q#pes6O*=kN(Dh`Pv03s@WIgD;8U0MWd>JI4uxAXU zcipk#)*`zLN{7?h(>)d`%_p?8wN7wvhEzlV)Z%$#$ z)gjj5kG=MU1!c1xTCq<);Quw8&+%U@AmS@HfpEOhE(K&;X+K{RPEMprNGg4Kpv1gt zhBX)NtUf5+Y-arWDzTdkr2NKoeNG!egM6W@ed}YP?~B`V#nkUe4Ja(_@9*?M)ETbS zWjY`KhzRmpTyUx25H-bE=c}lu7BUKOCJasq@GV(r`I~Hl(lw>l7h{X0L*>9*i`_#z zAn4r$9u3}>L>h>8L}D_Kiz_4)2|Hhq6qaW`@RXLe2l}d=&oa%R2zESHP?3tW@!etRD9|6 zL_?b=^y^-ymi?$Prif9tNLnWX|DtP6RtFPMT)epwA+yU#AzXeyOTHz~A3!A+8z55D zbQD{$3^CxFEde6>6^T#JXPQ!WzJ{ngo0-yti9Z>|ZsfhsoS1$bpS9Xv`>M~aXD_0C zy!_A<^YoGlRlkh$<}Qrwe!>eK0YW+RnIH0RZp6HHzbQ&+ai*T^t~*7f7uNXze;Rj{ zxN+B%#3jo$Pu*0?4S=&dP*_B((6BrxWN0kAe^G$A#{<1V+aA;4Hbu^ff~~9FV*|X` z)@*!BV%eirfP;L^;#nM8ZyF4_8>5vmJY7U1EEV3F?cbW9XH>J(KW2GIT;}ZpdNhm2Sc9?q376*fB1w#!Aw?5R8`e^3Kv5XEr6h-1dA!1 zg*Y*X3tLXPTcHqP^=FqJN(n_-8!(fDVHo=zKY@tjEN=smDQ#xGuNwVoCy8cMU6z-GJhNK;#;85Km@}Msjq{9G zm(8`@y74#rR(fFggnli#h-H9g<(BTVNy`Gg&AOBc3z4~6gg+I`%6ES)SexvK%%9t= zs6PY^-*l0u6 zu9bDWTGQT6m@PL)8@Pn2V>yUSuoCs3KHPKnvP=YP`RA@YL8Ciz@f@8o!Ch0p*+kM% zD=p37*P9H#F?eUPCbXFX1adyZZ|L?(QLBqXC;0$RWYzhh%1|Mo)xaNrLGJ) z)U6?pGl!aMKXx?qn#_x&2J98ZYV#ri*#M;JKW=NZl; zb9hJzvF3(XNgBAinRu0HkwbvqE1xEQPZfW99vhz|nic^4wK@PVjO~1K@XMD%NiBZ1 zx9~&6^RtQ;TX%R3J}3nI{P^(vSrs2Lao_kcD}vKdu_TOhaPV%AY&IO&$I;(EoU*Y{ z=kKMNJ5LODk+ms}BXQ=>Z2*NO-m$*Ei_(hUR~5+}mw@Ay#3Ufp-b=*j+##x<(8T=T0?@>X8t$I@-*TZlohy~YUW#?#rz zS1=YsciyW$1?SN|XdT_s{g~qg-5VZ{*^T2U~1a9gImV8c@MJa|%WrzgQ$G?v+#LH;%?h0w3TiR#MMZLwrJ69Fh!#O;l$L`J7aqNuEvevWT5m z!J#DtM@(B20*l7a^!C}DRdK2Vn+6w=_wX++Z;FG;02w=rk0^4u$1M*80*cdMi%Gwp zh|j!g%d^Svid-%1K?qLU)f77_wAR%(+esGsK&3J<>LK+h$}+5vXaeemP7^(v>E+c zf6W+QE~rtT2APyXyw%`TGMgc?=K{qLS_^SY%y5DsJzH!w4|`H`MRc7PSU^A9K=n;0@XM+j@C-ADOZ&K6@@8pBq4wq>xr3oj;eo{flAS<6|B`8+TTBdT{IdFUm zS%#r@^1%E=35vwIdA6DqQL$tkmU^YJfzlKOAED2Lnq-(wUYdR~@$!)sjanLMnkpqqBpS*`LXQp6^2uM$zq-Kx_ zR4jPmRC28E4KPo{TdQXC=la8K*;xt?f^eWPTU;#neSi4|VAe~t04d2WfYZRn$2YFD z1UnZRoaxK*WlU8?W=xTj4D+%w=Dz-D_~hgevhR72%-@%jwNgO`TXsx8DA!$H@Qvp` znc>Xt5Q8!)n|wp=gnJ`>pWd6feYRO@tS^+HD_OJTTg5T?+Ewk$kRImi?Q0@(As!Ja z-Dh@MVP!N-as@l@qAsTa=e5%yLrAh zvx?#Ue*3uk5;2K+{QGn|Yx-v!1tk(sj&tI?YdTx?yaG1i~k3tC=(jnh!g0 z=Osfa*xLt>4xqmZM?YHJ^N6=C{7_-UCa4MDE*wrFWUZFm3ktzq4$~tky;1k}0pA=j2+w`nv zOOm8O%V)CPxdVQ7H4w!MJNh|(|rg#JvVIC=^=go74@+^V?XX_~<@7`-v z+EUOOx!)yE+aB03;^;yf_HH*z7wV8Q4Z>}~6=yjRuQsmL7Rb=qC=oniX#agn+xj!n z25P0(S~>B&U{+A=W=Mb{)lp7=yPS>G8}D3l=JdDRS6#*1{-4B)xU1vz5K@!jIuK&s zvKR7^cwPHNm!3^&Dv1O=8@Iopm9Uj{$ff3sBw-n{+o`!+o_hI`7V10o#!6YES4Rw2 zh1Yd9#hw`{Fpj#XpqY1r8@^iAW;*$cnv(>vrR0_}fAX?>+FMW4RfXMvS*#3Lj8f&q zA{%GIHB_*e_mirOoItEl)FR-=gZyvZF%mD-*9|SJjl(l6n7BYyJ4SHEw*d}@8mm$A zZFzIS1tRrNB~$>|orIi!D#vn(`MwlUE1<7M_I^E95w@c@t6DuXSq9vqZl=0%Uz%@i znW9`#QV>SmKa}{g7(AccUf`7VCT|=U7^`t(wJ*22hu&e29;HRt6}4}^g_$O< zXwrX8CmPW*NblHcUa_%`05&*U09Btd(lZ_k^ujz0E)w(0xOh~|?4GVvTZzDyU9>OB z*{8-TZIf+_!Zn^5=m{{8(^`aa9_YuJuit&qY1sDvA1_Gy|lX2B}hHTBxo3d#nlgY*RO*kBnGZft@(>NHE~iasPvcj*RI>!`kurV zDF*F_90@8VKt3IhZ|jw1{H!I5U~V{iZ?gqC1}Zc9qc;(nFJ6BA&+aEZaG(0%p+V5I zfKl}VoL#IzE04#&*z=(D!qU&S=+|>xe$v8UrzaRPHZC7CWU9!gWeyRuy@)7odiAI( zeI6(p2v3DAdb*nPGOBY`%2OQ<*``LMrm|o?28F-n$I85&r5+7y5q6c;V(<1O9=La; zgRBU8MZZ?7qTYd)%M@d)56{u)_<^rQeZFG=6y`g7-SGSN_6R^Vm)kBXh3mC_qyzcW z=XOyKUTW7l3)QJNWG%@gj0q%ws!TT9H%hLAL~!%f-aLV-Rg0YKwIRjoIztq59l7!q zgWpM=3&%u_*&4!^)P{RHTC-_KmuQJeOW&3Yu?{le_U_+!%J-JO@y%Nu$n@k^clYRJ z*XBR#{L05G2|>VQk~tM_&dY4FpR%fj+K$sW?I3fsjyds!%|3>PCOKJIxep>t0}X2zu2r@#NoU&a>X;}P zF0?vmJEhmftPAgSwjEYnz6>r2FXqvg{Fpds+YKWhZq|G6ty4euR+26xTUPa@?s@5f zGpU+h)Ugc7k9D3fB^~?7m$aS3MLw`&m#6OR=`9{VKbRpP(s@YEHb{HpXF|TfW^v>} z3OCLuNj#h5jUi?B+_aKhV`jOXZLZ=c%v4D!)Id02RWdI~+5N&)pB@-Eu)cRx+ssb4 zef*8yt_b3N^ju2Sx#T8MB~0+zrIu52diII*P)h{p#7=yRGjlkz4j)4bDXs_`KLT}| zjawZab!(pM4(3or;nSCS!GGcDd1Vriptc!Xw)TLgc2t&Dxw9-vb^qtk#N)9gPvhf{ z_Xj>|Fi?|^SEr8MJH#ihOkHL};eNFxpl!g>`T2xuRpd^@34+|y;2KO_@D{f)Pyc}) z)60&?#-dnOTYucEW;RThT<)QYd`%k%JLJsPIJ?P;t@tk%Fqx;F#w{y=Ypk%^z-}7} z6(&+`p;xs_)~hQkcLb|ske)tFy}9S93M)sybtb{e{)H&y*=J9oWA%7=`%Kd$XPAf- zXL{VvoUYFuSo?+D*R;;fZXv@9?~PsD!U3uZUC{7O!|wL7imC@sj$ZA2yFsK9&cHoE zErxXM`F&@2T8A-i+&g%yxX8Brji-jNJM3Fhxm(eAa=goYp^ zUN^W1pylP=E|{;m9@istbjT~RsBLsh>au9W`JYa(H9U9sR`QAT==R*54MkkWUPuDn zC?I_XK1Wf@NZs(WPV#q2q@9s~(c-oji>vo~Nqs>5Uy%Fcw(V8T^l4LXEfnQ?Z1alW zpuVK`*UHqS)Mg?M9qd{YPvXZ;Z(b7%GX|G=yV`(7YC|foF?JW|6ayuM^Yplp@C@I2 zZg!fD8|s>xO-Tw7ncL3{A85CY?}TZ+;a&R8NU=2{8G4Czsi|_U<8h|b^UbnrQwlS~ zak~H9Xr!`KOAB&P7XXmSeBZlOm@E;X!$TsuNrsg}Cz=vzUMA9%JB1MQpYk#&t{nB% zYQB}rBEj+q=jaI`67Zu>JR-4`-Ftu3P4ZJ57}YZgr-gOZ<0}ILTOeK~XZ2KCeGns~rt(+I%eH@Y z2%pCAIu%c$y8UYd|5624-Y=tqTDNLVA#TmwGGrJzbycHr3f95Ydv%DfxS9a8~ z1vh;)!;8LtKU@M1b!iE0K=B);p^R6x>g(R&2{f*3g!EO31&P=qL8<89M zFGm}pwC6cC(p9eSUP4#cKB$Fh*LMeiG@1 zbeP(5nrP0E9ACj%&d#>x?j2;C}btU6Bc_pyqb&gcx(Xv1-DaTH~lCX~p;SK(9 zTD8KVx=@uD;XpOv-L|ADRiSqYB6CIc-^e;#xAy50&|I>J?|LB`6ixkP99CQxj-Mzs zfzMUaRko{mc)EOlWy6*3s1Rq4@#RkD9R^&kXoZdA(MJtKXRRW z@?PuItdc#~6A{ZT*vutZfsH_KRI5I#4shus>@2MfZxBUg8a_<#^zPhS8(!^qmW6y7 z<3^5-{2A5vn^MXS5-~iSn)ky85DC)sTK|OYTo`A?}0mvUv1A(I36|A!{Uoq z@I0Xly}@Ld=D@7_$uq@cz={08*|>@HnBLsj#A8#}%g@TQo`+YH+O{DIgSCkY&;;)` zM=ySfP1&Bo&WVk{E27{bCqfqdOKPw;kmF(K(Bp>hVp3k^%u6!GU9|iQ1RJvWvY`CQ zm`Rqk=uYxtqZy$BEvJ%uD-W3g{*IYam5JT>9dfS3?#*_%!Q{Gr@b2q!DGj-;o9==D zp)@6$=*MH|Vlzo3K_;;Tkbw!vC_&{jxJv)@?`Aj9^17%cvSD%W2sP_jra#UWg3a#CJDj>C3w4!L@L<_mx8RABh1cwn&+ zGkNI5pZ(d1T}r&dfn%seujI&vQDrw|(W1UF7mHBzL8s0cRPn0&w<6;X8>ErKX(x#_ zBS1~B;%V1yGZT&<)lMwy7e&Y+OzQd!RP7h~h5?YZHeOeLg`mGY#?aI?)tt#8LEN>m z*feZxxolVfivp}g=rq6Nn&gjm8a2)C(k3@4L@!d`;>}MM zl?m#2649oRpuub0lk7u*4i!0#Xo!C>so?sF60h_q@qi97mH}i-Wy#~_4a&!kImpl9q;8n$)*EHWWP!W9eG%#)P!Itv9qJk*Wtwu zUxc3uiR84?;V9~=&GS*YSQ{kv15GKZYfLOP3FY@=zAp+F3xH=;GX0MuyJXm87GlP{ z&fuoCTW-0ZWu~D*$0)ikbco$CmkBEQpxZ3|hqN{;uBY1Jz~P)RjKH>Zw+ zD-#sH)NhqF9;Vllplm=fZQJUa;hpn~Uu-4jN8%&_Qg0Z`YkXv)klW;SRbJQ^fs<}@ zSL>5VqBp=yJ2Z5>nR*xDKDJcK-WO_R&4b8Dsbvmrd=OAGBdXcnVr(*+OJKJ<{cK?( zj(2tUaI#wu#5p5YEDpAKjp5{`Sfu^|gMVd16(G&`srCQ`nyfRfBXr}(ykfl1D2vK! zhoBZ${wf!gqx5`WUWr&bU&US>baHtyAZx6eI06&4V~VHp_cBY@EALGcnbY}!Sgd*O zD)57<*7)a~$IIqCS0~6{y0PR zNy}LqcTdGjlXY{|#W^<;bH>kYXEZY#uEva6TsgGHOVKCBxG&Mq>7)YLf5(#2aLGUZ zU?oZJ^2B>cZKCoOw%{iZg_RB?SZ0WMx(jMbpCO>2We(R#%gH{T1a+--R3UOwo39bF z!A$D7$py7QIn$BJiCJZc-qh~;ia;sB^7xeXi0GT`+Cnk8-SLtfY{P1n^IuGfn+7Kg zF)8Eam#leZhYOo8EoXzCYwUAlUXW&GR9bi_flse*p*}kcOLdwJA9UQ_`t3S5vv2lv zb(G}^N6kWrZ2x8UZ?KZIIE)ead{1!h6T)7Mu}D#vE+RaZXK zaT4p9ky$H=_A%)vD{3@gIhbro;HG5jpQJ|bJ>c%IGWTWwO-P9gPQldwywYQ!-S(_i zc)P8|;M__0M&#t@R!~o?p{r)oCyVf~5#~SanQ$`n3t)r#)R2YY{>jU8D&071&sj3* zfA|-KP-XKNI94ht3FEmF71GDSf)Nm_x-OqTmF5ddWg=<&w z>WpS2yHuSvshoS#{%J$+=YkuF^Y2V7*e*`$0UG6OG+`&_RJ|H{|b|HClmCRBG z552ui-(-pb;+l%@DVn>$m?e{(*>-4x!rqU#sjuJHKYArYG`TQ3SeBMq4JniQ(i#)Udu=1QmEW+!bsrh3Yx{m zk@L=z*FU++A<6X%uGl`IZjS0};*u95+Z|Qct5Km325C#n6S@sdc~PeE9U-MoQ?m4s zMevM1MaSW_f?E2ITM$)kx5vTeW1gm)M4lu^j!pebITMRU zx%dCPqunTowXk+7_2h!nB;RPrOK^=K-h;B_)4gcP6OIg}8Me!2L!bI;}x`qKYL3iyA~ zr2cOZ*w*+^04elNwSP1UkIE`zdac?XHXSCvCYAwhZf?j5> ztal31653ul$Is~Pc{<(A;|71BM?Oj7EVawYuLWybS}){j z{AS{Vt(W>fw>Z%Od6{n#J$>}94-Gl`Lig$~c4TtfRFiP+VSL-F>wgY?v@q&e=HDW&g*`0e0)gZGgUd?{_VLka68az3)S@g)=nn6^RaL1 zs^iC*@Wq1V>*Hx{pqtts7W@CxWUKL>ClhKPA3OiXQ#><>sj^6~Wmf~`0v=!Qmd;+^ z|Gy0WU&btmaYf_&ELR(_Hqm)^rFD>Tu(&FCKTeb2e-8J0GfDW${K~_Vknw-`%G;-i ziChsQwGHj3rY08``782+vJ;1M!)pPjNfXZ_adMDn>6VM>PmtZnPfwt9$oUmv=iv-c z^?pN#!w=>^jyEX21#b8QIO{*1z{uwQK-j=1L{`i3+F&%j(23)yv?%wBgmqWghi+b* z3AUQdqYT>5S-&{9Ij^g~Jdv-DKkbR)&UUb`v??g)E4OX2l_rGU z@0>A2o)>;XE_Vh$tlbW+9Y6O>(I^$j)Iv5316_vc1rdF2npGi}LzaOr6ECSNpY&I$ z@86$^-p-(|ofiiFb^FiaLu$)Nhf#?}CfAulvawxkvVS!4=eR+C3>cXAV3TNP*I_KD zXaITslzsc9naw)=13l|-n=jB{9CY$r5OD7w4 zbfgSub-rk?6@AbAQ*F0}AFPnn16HK^yy9>G2 zpv6z>-bdbmu|*B@f+$i$IQx;49{l~ExgtEXzBnYSm5lj<7b~R+!Y}0G&bYLqO>WQc zCSp||rYH(?etWH!%!^icec!NZh3fpcnl&YzT6cnFzWUJX=S0_xYMEId#c z{bC~Kr{Vu`FLJf4kD{5~!Y5&TpCm>tw+Geq;BveUxUK5 zppNJHv!~y16wli{fkNXOUeNf;!2Q_yDeWs(r`!d1bKAguy4SnF=hwW8czmJl=6@&4 ztO#YMTKIw0Q8cQ|sH>SYRjl_a*k#TD^&cFei_=GhIK>AxDc3m(IYQJ8Dd}jdcQIq8gd(rfFs?d0^5w_C20HHM? z+M*8uxr@D0{O8@`WE<-hKrq7yjCl^#xp(r6(8+Bd};nCli%=<6+B`2=#Q!X!hO zIX?Pp`g)T7GE4Dv9ct=zUODgB;!dg}!$Z-s%Pcs4b@lV*rt|5rQ{a9kJ@@=P@V-|} zbmxQGzd?p}X)1t`fWDUZUNiVhZN54yGd;0SlA07f86A6ac%(BEyTyAB60kB|tDcRV z8bLIZkc2iVFC0T{)a;dN-DgAQ#C(dmkFkFCBE?!jUlRVQ(jMwHNpz5 zO~nPg(R4prwmewcs8D5eiFs?%DVT5JqB8>$~bLUsKhr`6-GJA+9FmHr3@*OzA zP64-l@u3c4^nwppn^U&&VRNZIFF1ixex@@A-Wi!9uHQB*7DT6{mR@JrBpfKJk{agt zcNjSvDc;43M9;jKDKRE273=qD8(vzB?l`6~ei7|YMW-o#4sf`Fh2H6&F(z7QrX57a zOipJ4)qEBg#m-m4Ljx}ZPsBDN_e?Gxbf>o)0r6t~d+S@!)r+(f-HDD}-v7kHc+7sj zKVWmAMjkW1?Z_Uq7~TkO98a+X>JOL)<_7OFcu`L^0kdfEC9G&##PJ?WgnM%86GLG~ z<~ThwJl^CUIz?W~QJfv54ZST)TX$4ugVA9$1f*EtkIhZQWyGb{@N5=v)$T`%z9Pyf z_^PMm2&3fjC^WJ=_rGjYK5C~;c}1>-4k}T^6R`$&XjQD%bWnaKKrOoFvbX# zWU8CO5db7TNAFvYdz3ky9V|KW&}`aN)}I+?x@N;S?~aFE$Xyt;F>p`~RWAgC!-juK zt*^_WEm7Q$$swA$d!-CUoG1=$w0uh<%B!qS>Q;<9#+{r`Su1|f>^o%#9C5F?9OvXf za)S75no)T$*tjPJwd_{P9Fi1VJaOM6)1={J`NBl+xX+lYgy&(q=|Ss9hwhji zeIXLvQ-G*-&Bxq0p6#6|&Ko##3s+OHeg-Sm%bkoZ61c{gnCTjwM^Trf(f-n^ly`pv zRAcpvDJk4~=^59s#9$}eo_L*Id;Qh$AJ{L5p$(w60g)9~!|Z->%(Pxk_JNG{@b({} zMN}vZRT);0$ni?xa9iveRoahS-9@qBd|(OyP#{Mwq*xez2c+)Te9lgSLc0})QsjNz z3`e%4dkzJ|-=|aW-AtGm6#%T=X1RUA=dvZ+QoI`Iz0^!ZIBe-`z;3v-B3nZzX~xj})wP?N=HYwArSt$fIMc@APhW9N zag+B7o`WiTHv2;pvT5YLkf9&xAZq?C$2AfBlqDh&u!u4;iE;~9@ATWgGo4)ViA79s z^4oLJOGUiRrdKSi{1-=Z^b-Yo;P(Vyq&14FXN&%=z|P09PJz2{I1Zsb2GxLWRu%a{ z|D)|THHv_Tw#e7hEWZCFK>xMm=zAJu4C~fcjGSfMJwm{jsVE>C;7m7zH^L~F@`kS_ zqfgYUfasHhUH?yHE6EFO;QWgWC?$>Q?*Q)|d>k_UEkq_%Y>ybKz3RJH$c7Bk1K+Oh z;N?W>)2r(JKH}Zs%3LglHH2gS64-S^rc!5Yhl20bQJ2nn0awkkfVt;TX)$tdP!d_r zW+{JX9IPU^dm?$b$mxbD`ccWnk&qBTCzbIP%4DgVb{^1~UB^&hVp@sze&bin+Cw%- zE{*y5oeIs#%SjJz;2j+gLyo-UBX8e)$x=@uQ8D_KqrwuzBXh|J-J1-m?dP=5_zrXC zh3_Qe4>X$)xsjaYT?IXt&_g3SAT z?Ox~~#PB{#a4;-FZ4e6V=k%a#N(NkF;dmVUoa;4nzEo-L^kZoi6A|0`W(zXN-HE*D zgMD@YET-J4yR@vO!%&dI<_&q17 zDaEGr5-nle&AG(Z=_@t;iJZ0RWkTgcR=qO2A^q@S;TjA9YAWrV6XIW7>v0p)vcdLR zncp^sq{MV|hbKBk+bUN=n$5JQk}7QfZ~>eP$;-5xifYNXd>)5b-BIGdRslHB6o@P> z5z31-f|CD}I$uNA%eQX_c0H;o_`!Z96bN1OuqLZKoYQBMcs*XFMYO)jQNb)w$of5yDZbW$N;l-#>DO)4bnYxEufwl_jfcuJwxRm{Kh`c$7a;y z)ahi{#oy-@tzxe83;E3u5Wud`mBkm*1VFAF_5-Z4c2~G^_>vxY; zYSeZhdXHS0%Rz*#ffncD#cPp3yk=OkJqjykkIOGVizeC-M2mQ{7(;7u^W<_q3hOF@ z#V{gu@<^HD>v9*%F6GA!0>Ri4B=#lc<1nPb;qW6CO||pbq}KwA()8uq+F&LLNsFBuT+h9HrTL(Bsi~{5LwD9eiV7- zqzoUmIzM3XtDc;~pjcyKJ92r*uc- zpegc2{+f)K)hoR(pf#S*Euan^Tbk%NXK>H$+fJ%p~6GV_qFk+yu_cTYW$`2g&Aej zPP{{ao{aUkd_b%zP;)pfWI#pcF#-UQZOW6rPtxN~efo;B_Q|!wMp8pQDWK*h;jTtyrxzntGfkI~f)qIL*;pu5`#1 z(3bYpzqGQZ=AAIy>*UteoQ9!rSyl7_ql*&mUbj1Ix8b^A8uZo$P|qv-SaM&F6O)%L`oKwz{JmDOcYB6=AGHwu zDl0jZWNsb9(fCI00~p9R9I!nlB{X&}2||BFB*1c4BFP3z%k9K6B;&FVPK@q9x*x%} z75yj1h1+>aV{>V^7G$uJ>{t<62H{D4a5XTa6t({m!D$;rL`ck|5jNs(4*T6z|CWsA z0`Euhq93kKEDE-8#fO#jI9K8>Y51ME;Qh)tjC&%S8RC*j`rp&Eh4L^`APY+^<&f%v zB{_42SqWlq8<@ZLJ)xS)2BzA{A7LJOC2S-HaFCqzUzh^2C~Ku<@ZyruypglX;uD&y z2=1ecQ|REg#_c+PH$&zP46NG{w?M?-zAE8=(@pvK5yuy2rBb|4bdi4O&cFZx{Xn6$ z5#NgC5XML_wV8_q^%AW;bLO@~Ic7<&lf{6>B=%t>Cq(*3?dcT|zEaTP`JH@*Z;_Lx za!Ry^ZIfCV=7y)F8t>?tEdH9<7l5&Z{*r6#@1^uK``8}(hnd(8ECMhmbyxxDcT%5n zW?oSl2a^*|)!I!pVTQI?S8Q5P2gWOyQ~~oG_dkTHO00=$-cul zU}YQ#c-wp@YImuzhP=QD<7}al`1FWyEonGt#W+y z5Nn-vD~gp}G}UNuMvoZLmg3(cTLLT#I}4$x(%|>}eKI zqiA*ulW5^w^ZKYlWt^Y^-zLu8W%=1q* zgRSNYv06^fFA>_p#Fs+!QH(zJ%Gesp1c21vYDi%t;eJ3$IK)o*Cbf0bX74h>V4#nW zf1Eiv**&-=rxeSB*3~RixHjn0wrzoc_~$*edtS+#t|V(BbvMIn@Z|WtyF%ERA?mr8 zo(b}o{GDig*2V69;^AZI-WCIz)T;u##+59Xq}hn*6H$5yKwlb1@dJE@Se zL#AH=;(YOSG~FgEdY^cga4b}@(&bK!Ocbyt|F$P<-jI2lZY?t=(q39W$C%~N?Z4lA z{Y+U)OOBAt#lCL`UwSCLM)=%3H}!3%S@mD6=+q@(lq)A7c_1r_ag-eGdZ5jUbwG?Y zg^EJ$y9Y+RtGUNHm$q+$!Rd}V(`rBNZYsYcH+Y9zOug^bd|i^S1P?qcGR2K&P+FwD zLNBhY9mUw{8|`y}x6C>Ni2SBK{u5Y47j}b-s)6K?;z79!<4u<-#*${wF@#2v{81W9 zkvZEiM>OTH=x>(QP{{PRETkxfXq@Jax+Z(!uNzn%c=!d z-mcz$r0oczbcVKx&;v(*h9X0BysC{roY|5`5NF*FHYe-IJ8( zQE;MP`|o&8!7Ic|BYLsej-`Afj2-q`rpraDF#-?!CYzWZDM!jw66IwdypL)GT{)N< zNUoAJWFS6fwSBV8)INEy3;=bKvYniA^~@{QNcQ^RXpMdDJ?si7vs04tUwbz18rP^| z;X{%C$|wdZ%k$%1!BG4o_-~GTf(3B-F&vC`uVG{vs}bdr41wFFB**9^rua76-@<7b z9=T1ARPt-IEhm#x8LQvt<6LIDT(#=sV9RH^0Xj>l2p4-~n;-6+uqP|LN#)u>&;fZl zI!Wz0`#}FoFzptQb)0G4&5^jXqL(w)5G_tE>&?%z4{d)oc zZ^)2$yRMzsmP3kALl7PY&Jpx85Hito%k&ZM8_t7>1X(&u%~Vk2p(-*etHhp~4&2W+ueb+}dT-t2mqt%H_4lTlu-KeP?q5dz?X`5EpvEs|jPsa!-{BFFL8%7FhR$Q8 zo+7p*L)_X>&4bpDYlqe{DfP45A_^hE(UjO)^f^(rtjeK#E)3bQmINHvXS^b}?^Lm{ z$gU|wTVk1hp9=8?|F{^@5Rtp};y4;2DUaOB_*ksY%iETt&53Gw@gez-dFH1OBglrI z$4i*vYW{a&hCV
#_vPHCSW(Eg{~`7a?&UlvL}-=9%{p8H^L(IoA6;dL}#9>OI;Fr z@s*9PQ2E=GIB|p#&iGDhP@_uXM~Ndnc2YEHJai<+q~|`EbcKaf9V2F@mwpxQEV=ZUyKA3GO* zWWLWmGdFu=5=~+BXTH zWu;DjGuk>OuoyBh#jS7yXS1mh1PUzo4ohTcIMsO)FTG(HYlM{0uHP|T(dwDRHPDjC zamL8|Bugw2LUw1ZQ)a`5vTG^Nt3COT5QAbWX{nw<30wMS_ffMD}cDbd8ybP^0LJG&my!&YO;$o{1Ss z7U`?sm$qUN7wJU!d7Om`du?vYj6PG>qIipXmV}`-26wt;G`lL|hkxk8>**Ow=WYCT zoLgF^VpG_T4Hn+J@5xovACh$~6ipWtHvfcn#$a>x2mEMoa}AK_!^8aT0;{Mj1k{-U zwSC353YRIbOM&p;8pkS&rgx=LbqzHlsa^JY)4ezsJX4Nf)e+K2GX54q=_}6dqjZ{g zNU|BK`GCAb}S0mIH zd`{g<#fTh!*+l3sZqPfXPPkhd&d=Ud4{dz~5gYeL+Y89mmTj1VZ$(ok>xUj}O8Z>9 z@{Hsk12XZ*NmqPx5JbzIUNlRx&4V(h+-|0`(bXI2xnv_Kt(r zC3Qvz(Vj`e?-^HULlvZppEA_c!=uxagd|6~4KS>gcSb|_4=$=3Uh4p!=ERv{TG6ga z2?LQbS<8CEe?zhR)dyOdh~y0w^vt3>u?y0=nE`1*-1zn5eJ$-SFu^uTR8ZD}b!EiceWe>mxCR?PbVNB9#XVj#bNe*KdK$izr8$LvvGG3R z>UtY!eax|CT%*woeYdxZeO^qxRRYm$k?16D*2{jeN9Q#zn-SIQ7VJ6t;;^{96Ak&% z+h%kNcj+%Pa6;f|iB@;!5WP>)bK%U%jDkA^fSXpTPk08lkw=3*`-m*hIbNwTi$vK-R9k}maEn$}%nZ5jm%l2j zAG7fL5}D!{2<5{1X zi1(4KGATDCK<`eO3vT2Pn<)A>WrN#m!Bi`12EyG;@~iV$sHyU6w+mviQexs=+1vCZ z#El91%-a`y;*U7*qi5A5iF2xVpI3(UK7O){DIE-N-~ag^aONJQ=uIbUlY(OnB3ntQiyf8;j-njxmVP+djMp1*LE&PD z%lNj;%8rS~ioeW1QRqS64|v~?nW=4)tc7c7okwme$r_d4FjR`SRWfH1f|@h z(%~sn#jW}x|A{J;I6ydNR;!zurhlXC^ki}BG@x8e2C)3_x)ZFE5Q_9gX#`WAbqDRl z=H_B^uyu_SuDmHo`AX+!d?6n*lsDLu!5p}+D4$*N-1Tlvjdz?m64h$QdaT~#*Ft?4 zeHyrpabTXHcxCqZ5+;%jZ>rUjb_F zGE?yQROSXy_c^)tLFN$^#YQd6`Rt~>2Bnbv*BAm+M%1tU8!PX_EhUOIu zVi%t)JXyq?Phq(?2;gBKK0&ySNLHtO4G1unsR&km|zRGXD@XnhTw~K4*U$37=7Mrny`wOYl+j zsW=YRU>KI=ksu7dPpTgVVR31kyy}CR)lhB#4*2yd?53M{khaR5ZMXf5=QAa9C>eX7 zq&V&7aA;?p6bx|2cu5V#UjRTfn?@`Vg-{!G&8=2_T+Umt2e<@3W#=8JMWW%)%8WM7_Y8kqloQm1RgH2YksMVhrzj)WQ zQ#J*bwji$rOMHrHXIuLnQOY?k6+3JOfPX`bJgqc} zTr=g>+WF;uiMp`&^dY3l13IIb^)DVN^rg)n)BkFl%Coc@!RtpXl}LUcJx1@PHE55BAe)hVFjOu2V32;pSwj(J@guK2xvExS7#Fi~ zl(poo7K}$KS-nj6%a`DkSwR*_CKIw!gEcO>BCK%|9e6;zq5U=r64#s8N)}@B21-)V zH05`v+!?Hpu+4$qJ&@2c{HUFMt{EaNfT*)eHP)_xW-6_Gk_&5Psvcl?OUT6NQ)#2o znjCEyL4i~7wq`2AD2c2SQhtGUoowWul3)Hq0_+RO5~XM0X@&T!2EXO+E)QT{Ko55M z)-d-fzNHbY!yJFi26%?>43N=()ZZ-oDYHx!Yb%UKB%dN1k6ys_f*Bmh>V3|+p5#}E zge=jnr2JWfn_4McJ56y^W!)%GlKzYCh*pqtrt)?U7?!?sSo5JCQNV+E#Gt(3*dw+E z%8HLIqkEC&9L=L(3~!X#o(72qMagW+Op1yo*~|MS`!;A7@~qplj;FP2Tl#65b-N_O zgqoUF@t67sOWj|j^ZAJ=r{v&EhV!6uI?yk^08#rxY7tb*Zql0aEsni$Oj&Hp6TfQM z@`UotC{C-k;e1H)1S!UA4&yX3y()zuXC_0Hm~2i%71q++1fjjU&jnmDXBDw+95e%bDEwnvKe}zrtm|j( z#G6TMCaq+HyB|=XA$&y;s=c)NHoT8k1{LhH?dE5{?xw} zUQxg9{EK;!lEi>99Xh_>Ii=!U(L@OTyF`y!@pOfHfYn~fByB6Hbx9iud4l3A6%W7$ z_RsxKF0;DbysVOR0?Fr}wipD}SBq8P$=1r_-5pHN?--u2=_dz7kjFb+o`^Nz(4*LT zea{L!iWll*d5-2XXb&1MkC8_#^sXaIPBR0uB{wKf zXHv>b6?S`>MAs`j(pVS9WG;E>Rb^8)R~5lG)4G^RD=kQm+5ycwv|kwcj3jLso5}bH;6Mj`ZrrNmdXY(0h$uUh^Z;i9B;CQ_#HWE=q1ryx>n`D|~3NU%yp%`1($+!y~ zHEF)iW*|9})OXq)UHi+JF_e#_adchC2M;TbhGx)+&UO$}#=l&n>xD1)Osy$q`X3(W zmMqv85 z^PQ(s#Ik?KE5e@plOxa&R5qig?&x=Hg|@8sTU70V4J~xQsyYVvmIEf0hP2+TrDtgG zs(KT5aZPm-m;dy@fc-H%!AcqJw6jg<#*WFDZ8@FZzm-9Hlbfz_<-e~0Sc;s2d153- zK)O(wUKPEk$0!8_kznIVDG%W@p;$ygI5>U2s(4DueV;eym0T-uQ?sat3}oo`X!<01 ze5=QH84;90c2}mRAGvDOe9X)XEYzTkZLm}B?!=>iy_=4O9sPVbZdEhrYn{+1{e_f} zmz^_>Dz%fC8$FZJ-gsdv_PJS@D!jsUVMEjuH5u7}-QQU0i?A4qIyZ_LM1g3_Z|edi zWyKcSuw{t(kC1TXuXu13?{4_Ps+0-uGlV*?ih+!to{Hg|E=mc@+A{gZhPuaGR5fG6Zi!DPjdAa(MU`v9?acMV= zvF>T{w-mYh59)FJDmd};V~OZEhwllu>6AxsHb+w$b1{Dhl%T!XZ>z}yvY~1AMYWk^ z1UnK-OwRsGo*7WEweEn@2m+oltX_#n@6UW%f@|95?fd=jGInJ*k#|{tg>e2|8{ygm zFZ=;*cG{bAg6ubNGACNgbJ0!2{GXeD>P|g>pPG-7R>i`1Qm{Pz{i5Cp3KkKw4^-ol z_w@;|B9;VPQ04Pa-K(~<3};S*f|zUty=o-;danNzdaP_Nm*grh0N-K!p{i=Ebz?6p zdv>&y?e!Zoyl4ak{q-Mt%yQ-5B9~|;KqEnjtquO>G$1zkvnIJZjiTGve=Lk!atZA# zPtpx8M&nw41O^2{&&!VVf8p9KlPi^lcrlU*32KOaWYk%oZ{PlKrXX<{LqwPMnvBqJY9?%LnjE}NRNTwt3$V3euJ9l0z9~5($PiYw zhIxxF2>~j4^0;O+|CfcLkW z7I;CoxOx0ablt;ma_d9ZAp<`B6oaK0WnEdNQE8GaVNrGAer^z=O}YA^!w#3KnW|rV zoqDW}K`kMK-d&JcBye||WO~7xOkC{X<5WCOCC9P6K*L!i53$;4bQl6XP9{?^8C{yb zeN=Is!UKt1)j$j97bUW+4553*%?;C8ff5bMEr)wiEhN;Zc(e9wb}5w`xGcrR_z+SS zPgzs zG29{tabv|kBQ5wj1JAaI&1EJoe-%NAGDK#*2)r}Rmf4O|>Kd%D6o)Sfn36<`c1P(U z5tDu4|1Fq2C9~r|@7%3@g}!K2^5c9o69Lf&bL&VdN8V6rbzbjSrvgGxeZTLv|4>gV zt`Q7rPsP!GPxMsdr#cyBH5Urg?Zy=uQ*^4V;CbJUBQ@*TGzr`{k$K3C4j_DlKOBAw z*rAP!Xy<&I-gG_O-J9WC1$`;C*i82CO+k$JC}PYF;@|1chr{Iq{K}jRnbfH6aeY%; zkg37U$Ff`dk2S?|W13y`pLVliK~VwX_F{PGmWlwTb3WiXU*Tv*_H7fgY_NrxxXIDd znTuYEKlIH@xj~^ zc|0lE>4?ZM1X2Mj^Yyxa!c>@*VJj=l!?u$I?20U6_2O@???(guqyhJk z1P{K>E&r|LwEWtYbKQJ0=N7cp0{-irGeP{Ni}g?G&VgeC>75o&gFo%J)V!D!@O>Ya zEIHa|&!tQuCzlk^;SI$$KH$>-W`FWXw=H0izZXywib@?5e02orG7WGCSd2kXP;~AF zTZA%b==<<04qk|@!Ih#jvoa5`<4ugq8?dzMv{BTd9{1R^T<<=Im^}&*B`jL{QmrRd zQ+KbZ&|u9n((Iq+pYA-M*)R=jOtxTJF;&C+B6X&G+jD@L6$@QFC?0J<<^((hlI*Jb zg7E)Ffw}!!=0)E(Ogu;$P^J)jV|&Jt;www*Q5w)2IL`n0!7fR5@A&`=v@8ZM^kF|m z@J|KEnnEr#`gjZbTBLwaIv-$my_~Q7U4)G3%fz(Bk~>iN!@BIKXrE(p>v+h44#puJ zO+ekZhCMJE<68Xyf`+|=^m6U<J4#a$5KRPQm@fp49w(xitK?1pe` z|J!7q^hYO8H~c4fSND+Ld17We4hJotZ=QP?#l1~w3h)YkXnX2+%v{No)rKT#EXaJH z8`@}P*>fpbvtgz28=K`HS!({xi`+J= zvUY6qK^@NE)cjP8MXzOQX&x>t*DwfM{o@uZIRcobwgR8boSQfd+rE3RZ4B35;br@) z7~Kb6LPTO}1w04>o_7bo`sSz_Uz)VRxgBPUem`eDxvxx6X-_XG_XRlgw-}d>Lu6C; zZzxwi&M!)OHyJ3N=vAcFUM{%v9ZauKbT?=|2{#)R{8{rJd`$DCCU9=)J(X@hP8TeH znIq4C{Oc40HPme)r%>S#@}+6q0hgx9Jk;ew9M6Lt)rPPHpWkq?b* zjQ&n{cr1_WXtR0Kh95+WG?kUjW1}Dg5$GxWsQ?>l zNRAom+7^VoTptzp!M=rqdE_Wy?%OtSFi9kFUGh5~i}ADr#y$p>t^$vO;$;Lc%~ZyveE9_n}SW;!12{LHhgbx&weg zmp+pvh&Q(H@3{pz*hstl`h_6)p*{T~BB&Sg`_V=2a{H1mZ~=@>nwG`fUGq5e6MC%L zCE$7&L`w^-PYPST1RASp(|OVhw7BT!O^qJq@Lf4<sCSAD}=NUTVKPCdT9U)Q=WTv}%Rurpi zpQ%z3nuXNEPhH|#v-NHJjjZ@dZtnZ5c+(4>)D*XWqG5&?8K0$_j_mLU@r7|aD0F6-wJ(q`rB-! zT^ZLYjZL`cEMuxg8B_2DqOE^mAA;qjWfc)?$cl14khaTf^s{vN2)XJ2q!_ObI)ee|lW({CT;&lh|9; zUA9_mc`&ZQUkMl+nEm3uq4vQqXTMm?L*r*)&F$iV@bSSdophkVQ{ncXxZ(>vF3UOr}Xt66+-I@XU3yu_e z;?sn%GUKe$Lp77E{gmYN9c9QkcOgtL;-QRJB}}?#us8zb8wU{gSculJW~Q*A3SX|k z9lt~=>Fd?f9_w!5P2@JSDi_N3l}uDP?VI3wfDw?Fljl3wCmJyP%QN9s#AED(aGTYH zX}iUQ>B8;T%>lWeG3Qw^rY``k1LIQm<+{D>zzfLlHI3@;Pib*Oc~PalNP?HvXRRma zJE^a}Y9e<#=ZDY3q}yk;0@rlBRQL%eQCAoFOD%tgcRm|k^?7yfjuQIce|+LQe#}uN zecc554xAlZ@pB|Q9Nb|6-Cxnh-wSx3z^5`^oIOVUwiP7lY-n)ly?S2fFmVj=YVPhxCV~h^%b3;;jl+vTH`MF|r{wl@mAdZ@lKB#tC|S z;Flci1#uR2R^TMze5x441InaKogwLXQ#Yy1OLXbZ73Rjz|tNA5*#?kO8lddWGn zmrNPRwO-A!);HJoDIhU0#+KjX>{$5w-(JtywXzH6quAloY}PY#{7=cpkl~9}{f(!2 z+Oa*o?}2X}Hdm~;1MnAIjbyvDFKOttEqX~Y#NgO4tbQ*uq}Qk;sz&U(+I)EtW<&#| z5cV3zJ?gGQ70Zwce@i}kuM%7t46T#5KPk!H0WcFH+vUbW)g+T_36Pj{CRo)4@uo}2 zjz+0U_N>!>yJcD8kOcDwx}opO*S|%4zZ5nQM+D-K7gL22)?sCZ(6~j!Z`mg)a!ni} zuD87b#A(hImfyH$4$P?bWbXN`aHITyRX5;=Dg;F6H}3bsSEC`*hR>R-_Ekcapp6Fr zo#Z2b6ife-sbVQc(lDvs{R*E zCWa_*4d66U90Cj6u2Lt3md+3Iea>(Xz`Ilwun z0DZF?Bwi>KKdq&x!9R=2llraHKh8}t?&jEo!I1D-W;fN!my|i5zl8R)00Q!5v+Rze zXp#;uGd|87e>Y>I0pC7Um%~kYTR{+14{0glD5|<)DBe3n719@c9&i{CLVeLwf25BR z+MM|?ZV+f&Dg?FkzTKXPAd5SXj~OsTG!0N@ePkm&>+tf{GTZ3=KDYs%c%F8Osr_|# zm3luE<1e=hw(1<{tlqjw9cYu+YH#2vsTFP}x*;)fof0EL?aL>5WatzL$laS?jvt`W zHCZD+aGS~waN6>M(*NAKsyBUDu>wN1ZpX(r8D{?oCitKJbi1dAJ~Gw*&9(@1lVe}A z@)p}!ZkuRkfX~0@eznnhK>YlMS1s%(iWetMD8qx0p8g;f@ zOI`a?9-TTRXmQbyN&c){*g z2{N_ZJT$bN3-ijnsC}scL3M;8KHr$kHYqzkm>xCBhL4$<()hLWxAm!aP}H@e`jMQS zjhA9MnD&w&f&Bs9OYcfWHUG9vqR{x@(;TDFiifI_p+e~EX3WO8Q#;X!5srI9&lsUs z^Nj~t(SCsyW5B)Hx#&OoF3>ynIpx*)f4Be!>O6r$$YFBn*Lf*FV1K?x@&^eEmeJg% zb3n}a%Mu^Q^Y-;kBHlCII?jEA>eGXm+D*``RcFZ`*B@G@cg$;vuA0jCLPEc6f2En! z+rH5n=!;~fYhDv-Mk=VJ6HQ{_n9l*1mYq+8D@l!8&oN&K?f28PXj#Om!RS{DKvTpU zlcan8@lTj!l#d}g_jVayah-C4e*0hE`2%x%|F`~ihHZY#676<}6^sssXB`x!kEH>3 zaVrLM4IB6+Q>wzA1F`xPz<>_%F6|CFb`lhG(qM2bp+*-%S~sKkd%7b3_@SL~fTy7GSaxItfkVNG54 zOzE}vkmd%QrhblQaHnb>ZT*8gm(dSaR`E38Kzpz#Z_7h#VoY{SLt*jM6d}!M;B*&$ zr1!0)*4g{TGhzeXBz~Gn!5AZxTSp4$m3O_+jG!kxYf52L}4r`jOWiUKOEsH6y}=u`E@P38bv=hqs3VrRTy)M8%%dB>M4npy zD7K7ibU}CI!f|=^@=GU8!AYf(@J0|7Eu=x6FAYYE_eL1F%{92jm^VG+W)(T!NqeRA z6(%Q<@0A>Ane|~)Cs>HZ_pvaF|rMkuRpkK)w9+Mx(VEF$7yd{w+hr&WX0CpML|sl1e-VD(VEM|g66`8%S9 z^Mu$6V^D{Gx!V6C>Kz;+3;X{6+-7sL?Ka!CYqM*!wkF$lZN}C%+2&?#wrw}zJNNVZ z-OuwE%*;7+opXKOcwGhNXYi<;d2eRVGvjPOFNv|%{y%d!16wBqGloNwy}tk~)u(?B z+9nc~4eW=Qs!gg6@38po98w0x#YKne8R&M9eF_g2WsWO9n?(1r=?&hl*P)kNvP@a~ zDU6)m{+R1!6HDd2HmL*T@ebvA_ov1)&Uauqh%Q&y(FM25`SltxX^R00crlJ_lSVB;O}Vhc z2vvhHi&v$46C)?6Yb05*^Vh95irLnC@xvfg%4Yu4$2d{YEM%^VSWK;l(N|tsO2q(b zTx9qfT~EYxsX?``ff2SnTT8O{;;S40Z2|Z;hOLB5d_Cn=I_%*BQC+%Z%)qBb$aZK* zwcdK+oNaSVhk+3c8Dp$WGbd@psv4@twR-6INtH&GtnWPTm8Q;-Yhk*!t9MmuWM}qm zY7nQA(g%;m_W(@YzpEq9YF?Ved;MlP)>aO-InrRlKri(t#kE*nMtbAlxGyfMr^04{ zdpe1$9bcme=<#Fw-<8c16^nPptpEI&iDCct%!ws=u!b>bs@ouCf<|lSr)FcI|UXVc$YU6I{m3 z#3l&GIb0LJO8++v2uP^J1qCBqKKC$;1>u)7nXhiVN;1N{B5K6dl>lp)0tnG0%MPZgDUSpCcT`^l)IJ% ziGw{-Db|ZXq5{tr!DnOWXBZ}zj^SSoG7*ow5&~DAdHa7gZ!&Ssk zDSM9vQdgqVoRHAjXMwf4N0}S^WBA|QDt}dMROecYfLVj$L@pKMNHX$K9PL=iils)! za=bBeS)BS%wk{cO%KA_yEKgTDob z(~&5D8`VYNe9u&Vd4Yg;FsGrvJj5p|gN&R%LXVPF79J9cqD!ux-SLA-h_J3q<K6>kFKZI&AtNAm5AR4ct*)+#2ik`fTX_A*ohVGZ$NCz9)ow0;9W9Ju3}E+xI9_lU71v+63@GA+g#SD#SsxMejUHej>x6BBZZFqqbYRdo>~ zQ<1AL zp6~YJ>^QtdlETs_tgV6sI~7$D)l}LK9bZzuQ%C2AHp(2^Q!zsVP?j;&&4^LHWv3m3 zXlAvfS7~lKm_+6p!+=t8I)2RT;;^#%W&Nkppxla%`mM@M3A0*i2HBkGRn~(vn+tgQ zUVEF$tu~=PVdJk_x8t&^Vyi`QcCq7T(+2+7=t4bPkwnM#xecYo(?kS$wPPjk%_g+` z5$@RJb>br1gkq@#8erF?gtn9f@W&ea3noqaC5&Suu|C5~P;sFBJGwEYQ=pG=@u)N; zZZU)_<2#GM@XJiRn1kp~v1EVg9flekV|^%$dwk3sY+r;K?EhO;v6(&;xx>58WfL^r zR~W920_*P@ac~iRo7N#%(#G>#II(a!T!iOk^X&CS&JJO*Jz=D-KGfI}hEWib_uYhQ z$XLdML8PQqjE9+#$7bYn%Qxs%14LMh;F#FsIc6fVys*5qgIuU{W;9#}soJ5ksH70M zk%OR^^z**d<489|;;L4WrXBxG2T6QN5-$&qy(p45t}TlQ6=nP&Ei-V1B?1Z+bE-4> zFk60(Fs0?VFs{kQITfLS%Z7ke>4u6=Eb4Nwv zGc{u>mpOg_1@wNViExJTvlv>+9rtJ`UJ$_>6jVq+A+S=-#OE$JSoeSqy(Xm|<|#TF z80#XtqmBx$)$9$XV1ZjZay`I?UDgFqTvGf5@kP>2)W^T70vGm2Y2%QwW;Gr zbHxz)gz+wL{ohLYL|?uzL2Z?{E+8e->y_cds(MKxme&OPurM51hVogmtFUQ9(0i4> z7|;M=>W<}{1GA$48^V3700Hfx~{>n zvuS61qkU7wyc+wfqX$)Z>dMYyEUHhY)<=lp#@tL)*Ph35!y}PKgvB$ki5J&xP9NCeXNjDw^#mVuUJlznt3x)M(>4u`d!2 zrGM4nSiZF@Xs-rVE+(DI)t;#a8?gv*awy0s%uU@xFQODb(%U1vuZrAGcwY_vQWJNT z)a_Fv`!_$GgVxIHUj($BO_O%?727dCk&`!P8J80cBkeO7eu`=olZvxf{4sA)Dh?hb0nIzcF4@dQ6D4&hUL9qMTGXI<&98Rii)f2J zVjdg`-yDOfO!HPRjrsUzu!C)wde?}`%#b2uP;0gh*P1xp2X+4AFWSlObIolc>v^jj z>Ip8&U-hUgdc!GoQ-Y%8IX45N(!YF~+7mj6N@f`TX+<|EC{Ja$HMss=NK!3{B!p+E zSlZetOUd2XVZ#`M>0P9H?6nyle8L3I%nH=a$`&(h-M^-hv*_0|N_Ri8>NpH_=`j6t zU>RiJ?7{u$%#l8mASeNmU9!EO;rceDwv0uo%gj2`d>0BEY12%yVNzncg|y@|YEI$$ z_pFEd>4>|>_J)zUjL6A5OsMI@E(Pf61Y=;epOO?=sHc}~^e+N5EuWrDxP}7yk$geZ zyoC_L^aPVr9`d9%<%AYhh_IQx=Tx5_@+j`O0j*3!clvCr0EX?WTA+;yI39%pW1CT* z8~u8FIFWiMC%|iA7vrBgtp&sMOD;_imB?U$3F=8yI*f?A#7&A%f=*vbo!iE)gHh0f=xTS2;fD-Y=xF%@jxg5i z!t*hyl267Qx*IyGYzbwR6)P%ViwJ`d!L!hYe}*f@@p~|x{(stlh4==|e+JU+==F#^ zGI9fgOsR0mOEp)A_b}|XSOpzILLVn*mR*^!?o~{q330E>(Dx|XR3#Z?JJ$LCyz4u( zSs@S}QA8&pP?uIvuJMy!EUS_Xqe)$WbDZ6?AE`|+2lh5~t}f!5e;L_Lc8)>6NlnOq z+la2uqh&_Qxl4C-OAnZj3u_+S88H4=3vlE^?2%!8WfGeE-PSVHQn>& z9JHas8cL5F-PTQLnK+LWO=bBRaWZbcy&Od4^(8;bDrR8f|q8q;%H7TNK^#f17?qKDqIvqP;G}- z3{eFRvgOeyv~@Q|xwTntO0z4ZCi{1Mvx9z|dBE3O|8MZjE!^8VwICGmSIL~49fjv{ zKQr=<_57g*>SYM>Fvy46&}1ZBJJwoBGL$VcL=QhV^yrk9Bhtn>_$F>wIi1k$hbQeV zcDs#_eva?eh7FT7U9$(Aegr0?G+tfo9z{ec)!x3xTxT+RGV-0$#2#7H#y~ypSuE_m zrNUQYHSCx-GfB0X-mu-oTrz{NCM}}XM>G~wOtmdKc+nI^bj2|gMY1c$6yJXN3BX8S zbQF1hyKE#KC-VI+XQ!B}Ig)8CT>vCnZpx|T`Wi*wSmTMP&H^l< zay-Hdxs?yq61}sh6t~4D^M*xMnUr;*p#^VoFiXj3cSKeh`<`IKIbLR|-lkeJTc(Cx z$44LE!a9>@e`|&Rl6#M#f@|gnxlGfHS>t*Wfgl|btZYZ0d74kRd~dbcALzE*0$p&~ zLvCkW)pKX_dhpnTzN%~5J8aZhgvW>H2TSr6e>qgCFII9@1ZTM=eMS|tjdaJ3T=PyEwsenn--}D zXHGD*;eMs2VH^v#H_I`kGSdmRX+v;6{eLb=LCK_^vM~A*|C%t3p0|t%>sQoUl`@!f z`kjMKJ6Bdjt-6WnhY^uQJH_70$Zl*Uz^a`gN=qM=;LcXf zaW**!sCwW3Q%a+xG#fYaVR)cg@rU@TbJszhu6Onl@sfSDtjH>I;198ue?_abe9FE; z$e}_oKS2l5NFERAmWCU@zo#NFa6Q|$j-NrO`aOsGH5SV@0MU3n;R~0M$TseqDPyRr zFbtoD1)Lq}82T~lLg;y*llpY*ZsxFI{GWM2MIOWo0z8Y#P>hV@Oc_X~y#P#g;{W9& z3RMl3l8FYp)rDP(NbjO2a2DpGL1=XT!R(VD+B3pl8br2SZ$#Zo5ftPJV#u}dN+dIs zXOo&amv~E`x7keeUP=U>CibIWLFI${{p_4I&CWh#&PHAi*1z-K%ncRHf;qHB5h?K~ zg00uFvp^I_Bx@Ys_mN-ZO?bstVOTrLy9;Ri(hw-J6@I?TaTVus6GqYN2iO=2H!Idv zY|x;uB6ARXKcZ;0AV9GkY+G>TyW)>WMDs17vE5V6rfWJ$tPoKj8FM-QPwMPvsGpHVn4}`{&o|-A{m>G$r@d+-*l1&$+vW>o%haXrV_SZ~vF|)#g7M@p8YdnX z#uH;+Wc_~R-hm3GF4o8~s z*ya91wMk4%y5WhGPl{CCv6!_)hjCDM2;2Q+V-ssk*`^EX^P!esO)}We4MIp?q;j6b zv{B{aJs$5BxQ^Org{NM&v4y{o0b&S7X(KXn&k-uQ>MQ-rGr$Q{OQm?h=K3KDn(~Ke zAWt!)W?w)H-3+h5H@KYlXOajtlG|KL?Wt{?2t*h>rv`uKzT4io7rj$H{2m)lQ^NOH z71IMR+wW0wzL>6^G+oj60$A_yu^4kSwbW1s^;K()PqMzren5q>B?@U{t>Qp(KEyyE zhOGK4;p~1EY&7D#=>EF57xf$^lw6iIliLEr8S6P`RIDJHg3xN*L}4jc39adDinnJv zE*@CTvrk4YPQA;fZmk(K#dnQ(%_emTxyl)pflOp;RMYG|rU0kA7rT#{Zo8#R)p9K0 zP?GXt?jNbfp0q>)F;O$!R;PELv6l*#HDnZme=6TP8!f*+@H%36K`jkDm_ zQsg+s(7Mla78z>BojkY?RsJ6`O|P(T60f1MJ6R;8I^VOr=3KWoEt&F(;MCa^)hi}H z2OrThy>pQ7Q^Yd~7|$+IGhH(fOZ2e>5bV6qLjC|EO4^U+|8{G4HR1z34L zM`mbF|N3YC({IvS`U`S-x_R(N+Oxi2<~Cxj*_U^t7h!!MZ)wrB7Pgr#T{QBS#51Xp{t8&DAIrAtnOf@9&B(lpmUJv0W*)uD)SGF2 zbsi-K(U`Sqc$AtP{_2q`;#sFBw9-^NU<3gUZ6t@tUu`i}DQz^{SjL#NM!o&CX??9cH?GM z#Y1(@y$5QQ5d6_^YIN7V#Zo8z`>*j=U!Gs?tTV+Q6UuRulj|g`c#_ho-&u?V(o#KD z`+YhkK!=puZ@393X{ecAHb{ zbuj_i_4*hTMKcdIKg4eT;<5cM$!VZsTo1Hk4|Dt2>cqrZ_h^AkLwNI!q@s zC=I7XR*$j7!ncU;9N^H_@t0R9@j()I&;5_rE#jIaWh?|`NAfKa+Sa}9SFizneJ2Lq z;18aavI73yVXNCp94p&=3*TY9VZqq@ovW7^#mhp@M8(e>z+gA{>+&(nq3Oj##Y7+@(i0w9oOySDDhKjjwj~~v-}UYhMW8% z7Fb#~T3nliOgW{6-c`;Zg4mT;g;&u;y7cWo(3%KAc-@@?Vwg{qf~M=8yGc*mR&pd z2_Nb@!NFDscRCZMc`a4H1pd>%)C6SHp>yBlB$GJbV#94n!>G03Ew{OF<+qCA!qLau z!{YD7*?*VPUF0%bG6hA#4W|!KE%f%KV}A>YM8uHF7~Ls>#{9;Y%QYpJ$t_Y8XM-@v zpFnB%%SQEk)FunedJ~;PYi4jO!yL^^ux=$Sxurrp`4)1vIEcWZD&ll|RHz))mT7|X z+FUUjg&4g?6zJTnkXXvE-`-(=L5MVvSvuK_flH z(xJD_F@0}#>gtWEMPP>X#aV__kiHN{)nS(S<2N^hZd}|~41w~!C)8S`6_(vWhP*FliOYfX6hn?uphD;sCI9O>5POaNctab^YDJ$&@Kbi|?Ji)D zAa5{1J|Lo3K7nYE*ElJ&)%Z_vD3~VhlLzWN*zKFY1v(yX95Fok=DtgH{vJ`e0GdcM zON|BswACq0C|F>wk;FT|^DKf1m%*OLqWD+zZx`Q)OOgRdRs0@!lOhHVb%zZ=cUjVC zG#0Qr{bm>mP4#y(jx*h8wb+5wa3nDLS7+%EHfoBvUlchkXKo@{cg+pMlQe08`%FQm z8QzIG!Gpjd+Cyg};&;OTs;{Cv17S=#=R+M&8Z%x_CPiG>O=oKS){*FV)=Imyra>JjZ0az9#rQb$gN3k`$-XUR^|3e(J~VHWfTbvvt&aY9i+-;WDnF1E+dFXw;6~@&_mlxXV6!{LjsZxSVcji={ z3qvD{I0hu%97t+ldIRE(g|}=LDXJQ2fWaFl>6Lu5x8kj&#DUj#ikxY^QXsGJy0s{! z^MAE~$>93wXhPPZj%sgN$pi4#8#NpP^RGieW^Ajs==Z3k0L0u|bM&0XSgc%jOo5l! z(8tn)(NbG&6nXhdVAj9vB=!Yo9~V&((bPNc8E_mlBC6tED{rTq%rpz^&praMgeXjo zwftv9&yv3RB7_(z{&`3KW-GKvDEIIdXbZJ< z^^c+!0jZ6R0)P8YF87|3k~=)oKr*oHm%HODy4P+3MtE+&BeH1J0D!W5g-kIUyI*_8-m$0FDKr(5bF!*{q+dC5r4A_@ zc|xFaa9M}JSUVf}hKSu7)soz(NMzvaw`EaNg_w4^FB{rnlcM&2_heVy0%AOobVvia zE=InRDjml^MuYJQ?U3gBOK~Lr;0{!H^FQy172$;~15`-)aa2C-!4u?xtvuW|s!`v6 zH;rF%H(&g)8&b_TwAGRQ5E19n@$F>q7m7Q!jX8!0<3{uH&FkL$ z(U07)zOauDZ^Qok(x)yaJyjT7^w>puFvX-wTPPVtO<>1hp!C{3LguK4_I(QVA;0z;P}23M* zIn8vnp;`pMrWzq)oV|17)2ZV}ROLtfivjrxj(BXD^-G=D)7LdX8X3@R#nBD5cmCDF z{wB)C)b}l@*Wx|Tt@v@931>?{S5M_PV6S6(f^M5xEWvBfN+qX|=9_l!$}#@`yrUYS z+?}61G7JHr4+*ZP@IRz4AywZdR>pm6{2od>{IWc*dOm9u7Bzu9cK4kWZChJLa^+sC z938cqnddO%iw!i^%rd{@c3O=m zC8DWZL>p|5Q4`foNo{MCF6Ni%wbD0M0CaK{%f3SLRI#tHFKsgwRlM)giNbxgL+lRs zh*l#zw{0l`x2fxlzg6q-D3%Mz)e%Oyq}(ysEDcg`YYs)EWEXb4Wv(_1d^u#7}lXvIOHaN0b7!mjdgTI?Q!=?UExhhhjLdm-vPC(fZ zXVDR`5h?dn_3sFMW|lyG4Nz2N{}vC(>pvWDN8$Ru#)7?q%W){pRG*7%VyFy%R*nvR zUUR<>136&FKiWhnY8=ouVHYTRk_T}kV*HGLlO?jluMvm_>4X9f-OI^bZatXCCYmq}M;Rd%^U1^M zQC|sTT_i_ahuJn4eEkQdpM58zD&7>r@_h|xef=*MGB)*|9e+Gz>(q#V&L?vMO!rn( zhLrI4b+|xt-1du(%YL)zlXqu_Ru%Ffr=KG)YotSrXTbLc6$idBnj(EHtE0u-$95Ev z2Fvm3DWESsH=#7&`_#nNTU*YN3d{P# z&;HSQ4fw~movFO1jh3q_BzUx!nDKnyv8u(-l$V%*ALFkGU6r#>oM5=nFyyo{Q>11r z;}AAYE3O7}vm!=>9Na&+m@eK$ykHuaWHBL(AqNFDsFL!Y(4a)BvXZ)}N!L%d!B*Yj z4tenS&t4NrpQ59_BXi@hu8&;uhl)uG=Ppma_kx2l%P@|8R261EYddnjsq}g>tY=z%;>mRhXL098_@`tR%LL5x5KC-s|g48Mh_f={8$*^m^64X@&$wO{s5G-6|R&LbPVZPJG`quI34Lr}1xwPqITmD5L`dP?E)B#1%@>eE0``gM8K#JBX9%mY)6gsYc7T7?+dtIz6G0L26Hj;e$fx>yz zibF}ZTJ~;Rx;{vMxt&CKo_`3Q=cpdFC7f?~+7+TP3rbp^CuY*_dBjuhW_ zlC#Lb_5VWDc;+1HP8_-nKy5%N=V)`*?cKx2gGLKN(o2=eHM7EFMQDxbmOno{p7>}E zykUoIsG8+wHPKrAz^&V(`qFFeutDdTH}DASs(j5GZR4a+yT=f1flW0Wn3kGed=S`l z4@D9bDnsTo)U(t*T+(>{fPs(vQ;e7%AVt243yWVng9MF4y-}wkW;R&wu}T^ERH65e z*EbsZr{FCG4LVN}2ZkpC6NwCc;b42lXoGGV>CmuL&)pl$B8>K;0HMp^_F~kd%nqg* z*AMF~40|J0Wn+0SHJQM^nHhgNLY7-Gsp-ko{zXWusb?hJ;1t}a7vk4497MBLIowdh zu{4A@#tX{fZX1}g0w$k*W(|`{O4iwDh=1c>?zvBAiHk4mb9MBs-($L3HF`|8Vwq@c zzPVV%j=#2E12)i9HUr+)4={H?3mN&*`Sv>fJLQh>1X>hnkiOI`M>@NytwYc3p|{63ruO65k83p$8b zd6(DPj^rE%XywvpZE<^b+hSHBEvFV(!LMq0~dia8%Z(ZxB<1llW8g zqC|*lvzTNIu%6p!|4iTi7|A9VNFAxOp=A-!=duZiajY%ppm_;T^8_fz8Isd9irg=LOj)hRAAcq+Y804!@G}o9sbYr~ zF+vyoAJoz<);6>>ohs&81YFI|z(q^=?p(CH{z`ZRCNG7lX5KdihIuHlBSy08SmK#| z?Q*d$$-9D|Qwvme_qmXW87}UXwX9$d>XiC*;3x&Poi657Qkh_3o5{n6>OtIGhmmgw_uZgb;lzh1Q49W=%2*tOf_KB1(0Xmxct z&9r^$`YGdi4tQ$%YIWSEu=Ogw%;U3Y`(%VB$o-2w&}qHpj$B_)UntQIg0y1B`d;0hWoB=` zk73CmH2?&C((o6^!21mX`P!V=B35@@|ANti`%DgNT-Ap}aEc8sf3mRginba|=;%G> zM7s7vzvW0E%;1&h@WhhZ2%_Shm@ihBOuF3ae@c6+gr^z0j=gqQPFP?E7n=TqiIR+v zdCr`mm!&Vuz8W9n=pOb?kC^uddsH(?f=UCdzUyWYuI&mSxkA>tS2NuQ<=D#qhZsfh=U-Jkf*`8juL70Cb#$=^CD&-O zMpBUDHMgIiZ6l8VKKuRK3^a1t(d**qtMS|98PBT-s*vCOkU{em8e?PWh8N(c%g6f4 zec4$6=X#^}_94>r%MxfHA%eu)M#ND!1590^i~g?`VC(X9(GtNNxb$PSvC)2s@-ZQ- z<7zEn$bMd+%(j1*a*g%vBquOO2<@WBbKq;mtjTKaPHdO&#guFx1gih*B>=U?;3@na z)FT=fPf5J$;Zg5Y{~G%z!>Ie^ys7F)dwNpX<9ItI0`+psZHxAD(~E-p=SLE~3c7vD z(E57Bx>=e$SgF1F;?dS7|7}c+$$Xruh{cYt8x@GTyDlntNOmVu}DJ}OP5)|WOyW`d%8$KZRRQ|y%Oh{%Yc4pCiok0wVb z+c-%+MyVYvMO>WtWOtES2m?g!%*JL+XugXhgK}ZCEUl0^%f+R+BivQH z-=<$bg!vV@F0x=ZuZoQHNd6@cBR>Mt{rBDF2I@5-=C7AIO8sTP-8zVn7fz&DHEUc5 z?PQB2?g5X5XN}2c5kKlCvY? z&p)jBOFAWtn~Nf~2Jq`gAcOj3ZqH_((|4X#cpF&4@!-O^Pz75JK$4bby&Nw@-? ziT&2^FR8U7K{=DFn5l~F%I&-FbS z^snd$^J>1c-8+*ii=8RZPg2fAE0ryVHa%|#sRZ>Gu>w*)>eb#$l?&w}@HuH~2VTmD zoA+h&6|*-bLqeZDXqUr)l&mI$AMfWOEk;cTu}xJOPfF>)T)~!~57{2pj%~Y#Dt>Pp z7nGCJ62E1jp-=-TJWaWKFInTAqO8Z3$DoJLN;dTqoaSBw9E5}^=1s%r39#+cBd{ZA z+U=bOBl#I&>H-o+z~~8A@-l1#I6k-wX+5T#BbZSH?F0FyI_z{_(oiWSG1HPw->2j{ zUfq+PEVFbpw(`yk+X1x;@_9j)5Eljkc#RG=+ z0i6vDM#SV4Zr&_cW#cSPq~6wsOj&;D&PWk6mk+5OrH4)+9}1K-Bzx|7v9oG35A~Fp zCEbcfq9EGnsLYsINGQO7p*#GPflGO5n{6bgsC&B?lZDhciHH-On(c&MmPti2m|q}n zfE{*}kGCtm_Z9B=Wq}S|bL_^D#I)`_43jFI@3Y^$GBt8qX8^WGH3s?xH%y<7|o5i6>M9jri5`Q;4=lw}g5k zHCFnjv)wFA0Zo1=hwGS_0T*uSNQIA+4_>; zDSRIm5;4p;x6+ou3gl<)xZRDjFCai_$^UFd3wzJK9AMx3+TsLi5qR={n0c<5pKd>I z|JvMbS;JV{dR>`Q^YV9UTFBMLj|8r|&7T0E?$+xEi4EL|%sNh%WxtotMm_&eSuW2F&{fY_a#RZhF6jnf zzKQ43?^(1wq^-$mrSsuE!_oi3u=%_nx@GGl3Ump&dq;YdO2}$kD6cjG;)D8?oP3ua zkCEMSe!Mh%<&i$)_XbV>@-admnrN^3c&_;aEWs&rI$!sv?FKgeoPSg?^j%!v21PXe zn=2NW3K(g&xz7tC{`vff=5GUnUaUFP1_ppEb&MM<0bYB30-JzC_}wI)%0=9(wzmhJ zL6rFyw9ii`|09QO`)S9ufUB)7Ya^?Ph1I3Jrx+b0&!A`djOX-4dtm$L<)13j6`u#7 z)7txsL<}c*&Q{@J`M6zc2FP*yd^US^{xk?GJ%S-tkgUV(vc@}@NkTb|WAVIkO!6@` zn~1}4g8Pk6Vo)Y1QyPgL^93i02rER5Nev8bBiNuIwdO=eS#)8$jB+_y-LB%-ZK!C- zS;wD7*V!tTcCe6~)ufCT>mSnPS$LM)Gtqp16`jIly39|Cf#5t*L@)Wth41~>psba= z?3Z)pH)sqgQiJ$Elo)F66yMq+i$+Z;)a%xRi~rKV1KL^^J7`~JsZeTRP=SS|bw3yp zZ`(Nu6jX8J!Bn=mf;e!d`VqQ9;9TpktZfc9QUVEy0ZV{ZgdYewcgTFM!3y!uz&t^4 zKvwlt1g+fX?r-j&NrTAQjS*J7swSRldJ>1a1x>(XI4Iy;nD61?eYK5Zd0X> z*9_t@Cv`Gm(pVPKeJ1=5KwhkWl#Yy$#|C?Qd96yVHx5nX**|w-*@euGl-V@#(Grg@ zHD5=McD(U9RhA<&$5-xC$auL0?enef0jLm7)Opw38k#L|)p=l)+%UC$%AAYZ@$-;z*cFl{RnN$cKROV{2l@h`q@ z59i}vYfnSB%`Ci+4@jf?**u+({j)94(PrX~C+1LSj&xMw#@L;RtWD>kxT|obVu_9# zPz$?&-OW7D`n~g;%Ld5l`wJk&(srvsgLg?l#Cu>Z;xb2ZW=@cJ^-18U=j8~vhI4*8 z(+BYS?zN+0+*aP<_)s>Px!v>`)Wy&TW~^M}lx4l#O}h@e9v37WUV^ zg=4ecriow-wrE9PZAjW60-d4WNc6BXmeD}^C}AxMO`%y6O&DmF#J?H^>Vfi-7ZxND zc*=7W!>ui;!-Viy>bO$KdIgn+MeC2rdjX%L=~dXNO<|;DSjiNy;`ZY?keJeU8#tAf~!P6*Gt_rU}%l0RAChgPeP=I zy<%Pc_XGP>j?n!6TrDFTiim9La1MeEpV`3p+NzT?xp2RMiskl8+p2aQt4?a?878|d z+KEGr$+D6oFL*xYEUxW>=d2-4WiX|S%o5(u{NQQ6UtoM4SO+;ZErGy3xVMwi9q^6gonk@M?RP}owT zujiFfkOo@@p0AG6C%>~>AFK3_?)JU6U+q>Zwx-RkPM~R{&b_LYt?q`qQ=}G=&dj!> z*RRd*<4C|a&CAjPR)>yP)J}h!X{{qeZ?}i9^u`-LF9Iw~*Q)K7r_yP*Rs(NswO+2% zBsRnS0GFfv&KFX~qeddVH_y^a1^6GI);d@Eg_9`~0e%NVq{}Juef7aC-Ebmxot=-u zplqY2_sW}ytf`m44WfdF&$piwt$NSLlle#QYe4wNE$4;Fkpl_k7|{M#w;UGyw~Imq zgX}pkPr!9@!r}K4f!4D*GbKc z+S~05kEhW~4I`2u^ZLix+M@_?dTgj52*t7OX5zVm&Z7>>uW4(znm3`afc>V)(A;kl zj>MMClfaw+yY42p)g*3DeGlEKE)!CMSL2Rsg*`G$Zuc2xaG%m!+B7v>WJhGEnLw}l zl-x$0RfOKtGIkzO3dLuEaO?Zt{>J;D@*@doOH>BaoWM!A5NdAy6?ee_fz20^9@(<` zQE3rVaRoD#)tRs2J7RrO!Zv}edNjOcR=>Q2UkB2Rlv1MD`sfG(zrHPc6+%z_+)zpT z0B%xYHH=-+@r?laMZs_lX{J6%%6MKpHGMS75-zs8>`nPKyPM}Nf<6I9W6(#zxoItX zlo)NVsZZ=iTE2L$3i*+n*@v0{=$xJ@PC2%U=O6JQzPZ#%Es5~&=f^1EPrphbDLQ4a zv&)g!ut3xqrvx#op8b6$GWp|Uc^!ia9ANS~idH>9rC$$$4uN*=&<2&QhJY=#v^-zA z@mF1U;1=3t#Y_9e6+usZBoxaL5+$+eUw=}DoX&f|(4CsWyp#jcn>9DaCP0tZBzz6Q z=jQ=l_saxQ%K&|073*^zT3O3BBgr_@rPu1!)kHpbf-h~$m0w_45unF9>!tSq@8dZO zZ`aJ}p=|2~Eule(nyByZl z&XYg4D4C@j0w2ynR)>p|PMdzSZ~80ufX~az+DiB9c;mKvWy6i>8lSVW1H_Cg{Rmr_ z7*KPUlZ@BW8OzJ{Bu~Ke;h$ZhvIm2XnDNhm(ROnO&A4w4{Hz=gGgF{`#5V;2r>83! zCa0i>fOZ?ti?@TN&D&AXh@p`8r_tIsAW93FxOSsCy z5CM_)`B8xFmWRRqs;{1tIgU*eN#|a+qvycEew+@#Sp$2BW4a~QN7#LOa*gx>&-$BT z58&*^hk1Xyg=9cvsq4o@EvU@KR^0b;#p5r*V;M^M-z{N}rOO+Z(R014!OoP8r#-KX z?pkV)k(gA>%f1t06wYQ7{pZ(%~+&jA}Di$NGi5UM3`_kxo^+gm#AVGadi{; zi@T#Ui+-^&78aCPh0%~h%PfcWy{=&SQE_>fzFt#wrg_Sb1b*~34PVEpGY0E`oeubh z3y94v|Cw|YLWR+p+l{|jsjVh9gBN6aN@zZTs8nOJrZ<`1Z@;6$x&y9^RM@8u=}KoO z{AE|0V2`OKiVg%HKQ&kOPmVtl>8kh0;|ST9AtCFI*Jg}>$C^F;<^zYF zT6ni<%L_AF2j4`^3g%Lc4=9;8422UJ%y2}l2Ao%;R)Dqq&Ic=Z%IF5nfUstVbjiL- zPYs!xY9i;p&;;e~DLX`j< z!RDB~6jq$eto*>kzx3$2M}C9vy~1~~HW*)Axy0fzDRIlt5Xa4uF|k(cCg|kIcO+Nq zNL;=nSo_eh%Fqmovnqp-0UO)w$|u3_r;L56=#L~X#hTULejA2=)m$xQ)VLlL6$7!X zD!0Mx#SwN`p`~g5C~NDI#>;mdYhlF>#e~a^7n`3Ro)^Btw^2_{ipI3dpI1%^jD=YZ zQ?Kj+18dV+Ii=Y@{{Eq?}1gYOaG)CNuAZb{^MXYvs{9GX<37AqbpD7m$?C9mGqY$vt=n~( zcQ?L9N$a2OIf%2D&AG|fGy7ThTxo8v8Mf)V>EpH&BMZ9xxbI``Ve1a~1ekK#Ty`pb zz1GbQJ^a@BiPh3&Ekt5e_i7F7xv}@1{;cQ#|7V_9-cH-omfgX>Vcv-6*O|fd^Ce@z z>usxOfcMdc@mBrAf&2B=hP!~n_dng+hrTV7@QW@5`*GJew>#3e z?YElR(pKm3<~$Lvp^vkjF9};8e-AZ|pJ#MX1%m@>jC@xM*2?TFX#~40Pi`+n+@_Rn zG?U(q`9$yGvh%h&ZLOYIoUYOQtVp{6T|-EpJ}O-C8BQyH(q3y<8~9!3KjtR|fWKNu z+JBxg^RRTjm|43Z1+=*Ue~ z7UE>r4<8NB%!2L!I)_I_A_}rS5!g$As;{>uL2)Ch22WTfEcrJqTbhqV%cg|=Sm)!3 z{N)9HR$?OwNlEBWtUAgf^!`W#ZjR74-=Q>xlE~qHx6=%5@6@KKQXK7QlnC?w%LCie zQbE=!olQRmHB`M=tcL1KvsS6TsmZ~?s0hbW*WyHf4m7dICZrkp6tYoU<30x)eh>!# zT7p+_&Mf6l0(0KAhh*`K`!EH!@3BS_64)rxo2l=Ib~+Jm%_f`T_oI-(;h}x{{SD5& zul1vfVxV1nff~ePA>=G@pJVC?0bBE^mUlH`My3^9d})Ni`jfkj6v<_wR3?)j{AYSFh&f=5vsn)9SUs95c7sRT6SOn1gJs!NFjW+)w(XWCV zVMQHp#@rY8Wwm)BvmShYYGt_$?PRjo>GIwGW9lrU;)u3&8(f1s1b26LcPF^JYjAfb z(6~E68+X^>7Cg8GcWvbLxo@2N-p~HiqeoZmUAxx$)|@N;O1nE6^MfF8PXdVin0EM% z5>=MnOIreb2B_gG?b)ZM1qb{o%%`+7-kFOQ-Y)RRVx?5}Ug)&~@rWSu4mI<~E|@4Q ze>=SsND&fAXGnz9mY>rlkQFA(FpT)?GD3Qm@X@5Jf zY0J;aqq*jmJL|aBPke2IZ;1t&8929tYe_FFqGus)JxwHbH&7!jqmiMIs}c)i0<{qlZCW<`4zM;i*`MB`d6Z`ayrXGmkoR+ zzzfgn;wY#SBJiH1E_<#0rFivC;?p*X$H2S6zM~3h=5h+upZ^J8acSgoBPf4K(sL58 zGk+}nL|fK;8BoxEW4+>Oj9t8@v0OLfbS}(8*EQz+S$JL1?*uV{7pLlqpdZrpwE<}% zTK#|mfvpOCpJq4t10z?LbxGj582cep9sF`olFtE|tLoNZiO$f}?uHTjye=DL6f+tc z^zCcn3SC3OTxQB;JKB}}kBn)A+u1ByV7R7-njFSRm@aIJ>z`gA-!am;oN4yKJ!XVP zT-nivrKs2{qfA7v8jYBC2s(9Xb0-#L+?=k{&SB41lP;)}9M-iWbD|`ed0$c0d>rNLH<-D;QU!9?Y4;K%JMe(OECRvw4A{We0LaAL0qJ+*$ya5_@=qE)RTY zV)NJi7C(>6wKoIa{r~dodLyeK1^mnAFb+^Uxr9n$ZdXi}Ju`~Pp#mDTb)z6Z)cWk7 zv6}Tga@n5{2XNB8w~bx%W+r?B51_La!PRQM^(!6>oZg$-!zgvsZ{{VwHk&GWZAT>^ zSUFK%TkrqUYoji^Kx$8Ce_@Vmud0hcypu{@B0;~rkK~@doo#tOHob~CY06<%&#tzo zKf>I+Jq#R1d=!oK!cqk~?7v#P0p@X5rYsZ=ZRjQBY+>g*fyUbz%s^Z<6ETJ4HcH0TkRicfPxFU zb67q4k#-9UiP3g&avDT}dv!_-eZw5zX_6Xg>*Bx{_RT9_queYtEGtq9OUj>plzK5* z7scxh!8C18L6HqL+TDlB_RJ=w8zU4iV^}wk7E3){G}i(LIi3dUvD=f5hO%~kSe6lg zVyqpkzQWc^OH6xFW6WqB%{_pG_!#1f zAME1qiT3+RMK`NwGZy!jr9f z5fFtK=GQ;_5=`whe?L2{m`e@aoLiu+IDGn-}<)a2I}zxyk~^a@n`9 z&D^nEfc=_~m+{HDc}uebQW+0Cj58)MFg_xZe;+U}?Z}93xjV0lzsLDtaB{2B1=#MM za!o4ijk~cXHmC*MuQ$yKICce**?dBwe*0UGwzaI=bQqeS2Y_nJ51Ik*>$Ct{8!Mcp z>x&z&lHtxgW!*gbqGkcskCS4C){mSXfdjSXCTF4J`27yoM#f`}mA&QhX9>-fUQ3B> z!?8aLvQVH_j_b|3hCBx$$A`V3EzCQkt;Uz`MgHr5AyAyD`N~X>hd@1$pge~f)@YOY zFtZz_3laRd@oO!z8BEV_wOW+6&X4d_dq=tbPb7F|Jhid#%!!k^8VUEjkiIm}p07(xzr(jbU{ z92+pE{bGEquF$q67H>g64fpy*6m^7JSGs~6)ulrd62xBMlD-acVByA^4rHV?#TZz6 z$duOq$**0EL>!QJKWy(lD8**v3h}be8 zTl@1G&U;e56s=9Uvi`={6w5RQAvYD&X`~*+`#MO#J(sc`7*OG(`v*6+m4r3sV3BR+ z32Fu|%xd0ZblsS1h^CHxmS|T|#lC?U#)b5T(PoM}7@hSQSHW1|^?o-CH!s&$W{+;Z zPkR0dGXUFySqRrRFh;`AA!Q3n+I@&RRjn7tFKr5s2a?g3@BAf9bO$8}ohj#|! z+LK5cf+!8%W5pFZ;KyIVgkF_D)m^ElLUMDo>DqX0yVPa>ubsW1>2cf1MAG%JvvwS{ z&yBL>I=$rlR1v77x88J@2o^Vv(xfUFA6n`4$*|CKudX+3YesuiUcz+z* z0#~#_zcMZ+X9YlCm-PEQ7O7mfEj%w^v<+S^n^p?gd7i+Ba#VwtQ{#21v7BDdFKv#? z`K{eT?ax(u>Y1JLCW}hpY;;Rnc@sd4faPzoJr0{ zaoGL07I66VOCs+4p4nuFkDGf$eZ77}V@Wu~Kcc2c5F98sX%?N8944YN|3sL)of2nj zERYod&wjg(ESF_Q+hkHn28f+0D*w$J<@&B3%O#u3=~QnC8_1h)jAnPMKoL3|`UgDc zY50$c-hM8TXF@tmO5{ss^S+r%aSrb4!D+hKcTm;wu42swErO~AW4lLr{B2jVLtgR( zQm@LMH{6`s3l=5AMJy0TO)7xOhl*5r%rkZfbFB?UpZ**!b=aT{{Op+KW3OyhsiKKl z)n;A2`gIBlC8TezIJd`qglau{PD-XBfnoRtCaEP4&DM*Qgy&MJjuVVqFmn6{5DWj9 z5#)OWKKQfvhGYmnZWOnsP_Z8SVf&GptO4MkMCm$o!^fWkmshZs@r4fYBXEPOA;)yF zG}sXfpTmPY5jnr(7!ktMv&Uj6zbEzwngPYx$0YA5)ikw?3Hb{+EzQA0b18qJP27Bm zd+RwMrfa(P$|o-awV!!!1`J77J&mRw3P&~typ+>*$UEi9~46l<9zt&u@#4@kH@Atl8KkzT~M(xz2>Vc}X z=Xk^RvFnSjkNqBnT6FV6yW2_npaq*e9e>?|VZLK|g&j-PsNe28z6$`iT3=@C47WjL zMYgsNb6eI}FHNg(ANksxtQlhD`3hwuo(flxHuSi5 zDmEgrL`$&C@GoElN+Rn?VJr@Hn^K3L38grL_aDFkBtUerOQhQjlDjYv`c8>F3g6gVV9}G&_fy;+ z%SRuLU&WPMPItO-D@F9elgRUF}KpVrYz0>k*6b`

tT zc*N#rkNcCMk~Pe*OZZXU({VO2Mh`f120Wv_v$$n3;9zeYLH;bZyW+38$x5)Sq9fOE z2+4=4=1yK(9wbk|>5oMkve~z=lDhK-rE>t4odOnKz;+)Cd{v`fMq~0<{SKs%04zoa z_Md#sF!Vz|_aOS~GyUNAwuTeebv5ApZMN3$_~_ET`}T9zFiC(4^zrW!COh3~+3=At z2Zl%6xXs!h`sj3}2mgDN@w)4Nh4zvELQ(T2^4sm)pbT*9M(g>51sW`lL=}Bh2cu>N|U?z_A6{ItS>v`ZN}r(+ji2BzM$7u^Tl1m zMO>1@=g!ss8ap9({355-tT#iqMRPMKY-Ml0$K&6kcF?uP_0t>Q<>KVzdIzNNJ!pN> zsmoPCb9`U}__i{3*Ha2O2EJ+0U4;47flhb|?(79TgG_gK1|;G(>AK-iiC00D8_u0? zZ(d1+!j1|RpuY3q2`5axP8zc>z{K&vvpo7 z3TBfe;*R^twBa;ppsq$P9U|&P>Rx(hNljM9LATY_7rA~cwsf+BeUnLo;XO5{gabC1 z^Ei+remUd!!&=c!Bx;N4@VW2(p0~+HZAue+s??gMoRQS8N9yfP@zv9Y7%DX7f+)G( zk%}mw4h>iax}tE2_{nE0)40YrTHElaUs3v@d3o72To~3&tsMPksy$dZgo8!`u?Fpuj`;9YDRVtsZe7D!g7PpxzSx+M9I zw=P{oNkKhGz}`{>G|d`b;dlIcsx`&By>b|kA4)bq?tLL}&X}rL6<~{yJF*MwER@@# zL-B5}ZoH@nO8zyh;sR-kP-GP=ocX||ws9aN2L$>^Of@qfT6^pvaB|#s!=w=a-;u#S zyQGMBn&n@t>3m?qCzt@-dVpt5{SQuDMjW~QpZy-QZdhGHAr0GmuXF@k-I*L3rhFy) z%=dt4^A}NIUA!eC!v!IXAP-h;9C@Vuy2rekQo$9&)z8G0ih#CCM=rP)DNpJ`lJgn> z+qBaguJ-I_*R#|X_@Lf&5ef%1G;$;9_M^GX?e?GiO43W-cC;0=h-+2_A8_)RXT0t^ zVs9(&G}C!{`jWS+(YRlmyS?_d<6L9>LZJFt~*Xd&Yp@KQk z^>c97IpAe$v*7it>EmLoEnk{Jg@ds5W1@2d_+)=x_P#L__w_Sfk>Fc)Z9@P2t zrS9Pf_!n{7xCeIIO=q>?Fn5gEdr^V-bMHLD%h2yHVaw~e(izatyP(~3-N*XL4$e~n z<$YJA@4ig?b5EtVDnh0qpKFCbPnXYKCnxEu8Ow>=W4x98(EXZ!u#uaS`^`D@Zekk0-y z#SR|P5brl>QVY7OQJNuhrIa#tp-=Jv`@AY$daAlXRVP>ORz}^+!nkeE2TE(4c7*3} zwmLi&;?J?o(VsacO%T6p2_OXwHDf7q_!l8u6@NyqYD*1qrymv+@9CxCWysAi%JQYK z)qVW-Aybe#WO!*s5C22QokfY##2?3&Ut=~2b;rA)DlEsqCD*NNRVgbs!iXKkXCA*M zm=SvUhQ$dR19%B6OQ5_lWAur!M;N`Gtsf_10Cx$Y9jg&*)pe9jshfZA*ifF zqdgC6)J(8~?NzG;D2=)GLi@j=QnV_dPN|x214{X;j-XAQ(*QpWY(74(8y&bSsuzDJb4bXcq^{^;(-3uPZo8xMBCagx4uqSJ(2N z3|r^x6rZnAk@18yuGtk4aMjUGWtJ6lXrPFgClVcMaRhY4o({7Sq}NJop20c59C!u& z0k;}a5mRL1du&`RXHj$P>Wb%Z`lzTc5`_~9JXFH{8#F@5Z4Bz&*xgwef$C~A zZqs*n!}-RdcXxRRbN#YGj1spz5;1$eo|UfObAt0SpU!2?$O8E^Mj2~4dWF|_*LY$b zqs(`ip!crA?cDBJFt^`f{d8(Iqv>3ed~T^onm_R4?C<$OnH)9l((j>3n0x8Y!N4NAKXkXPnSh zu~5Yx`xWhMk8pHHDEAevktifl#|S&g>sMZ__cQrL>uB7? zn-^02`2J@Ri3;{rRu1EyiY;QiI;kufVv^HmUM_eY;tM{F&!wZC#JvQKX1Qr z-7YSfh{|Lwsz}Z{E5b(kx-}ATBmQ&|th#?ILbj9%2@H${)4Nw_&pHl`sK$cj0;Zvj zp^(o@mt_$|9z}YcbA{#wZ~pA4k($XXiy-I-;k+|oKPJ=U>pi64mi1CgLy(6kSxKT5 zbL{uz)DTOYg;p0TpuNhjTFI-3Bp=zZ_m+>AgJB~Jb)i7D(W_julHL@6s=6_Qt~riO zU3Y0@A|$mAwW&ydsW%55IQ5Hg1yA|b!-@FEep36dgvd3^xkvMB@fmPXFl59IVaidkx_!^+NhCk2Xg5OON}ybuRC&$+9dxaWv=I~l3Zc^T8#jFVI2v6VyU>Xx z)-(FD9r!ujSKo@UYaFnwRnY!4nsCZGwPNJy_;Q`Gzx8YB*fD>sZz#&jo)a`f=+r^_ zgkOZ@)bWC=EsSKc3EcA6@_hfCU?TYpt8Fh~dwM*(dM~Nw{ysyNuiN!<1b5Y03c`C> z2>Esurv1YP+^!hxLwSsxtn2x5e_xhU_x5~$mG!Xr_m#mj@DcN>Ky)6^a=&`ge8=4< zWvuUhb95k}=uQ}Pww2UpeZh9zASfE?$0CJ>}@&%#^B^GQ{4Wc>gfz+@T3y8I#14lzsGF z)W%dBBQ@iX=-g;bWpTjZ5MD#-=xwJq^jqvDhXrwE@nj&JjwqIEd;5wr5QkG5x2tl6Xr3b_L|46jWF|K?dt9qJk83 zRpHpGMnvcs)vySdV{!jzATa2>mbeZcMl6jPIuJ`bCQZjP79XJ^3)6DBE(&jgWpZOX ziUTg}zfC1U#*$r3h6=d0wLMK74|+` ze#lCSo^tBG`~Zn`{}?*?NC!uEo&Vl*_ZxuwAsGX z)d{%+|JFYYJ#ByL6IKX9v@2IHJ8r)0jIk6LgVY&{);bn>95y{ytUsUEzs3k2Z?!+9 z3l;R74QV?Do~ z>egPq@+Wd~w0)%L6Th*bZna!ADmfc=9hKFqnfwTtw_MrsyrS8{>~Zl{&<-8F@*HO< z<8VFVHgLbPCh0!&J%QOrz0B=3T|8Xbe%Sd+Xln+341&9nK?YqX2?H>r+%AuVNpT(D z1S~1saB_aSnHg|W?%*B5v)N#pXG3(=i+M|=-CE<|(Jq?4Ff(_o#)iDuWl>WNWFxcPQVj?U4LMCJyn%#R~$`bIcih*O*kW1w%3WushO>2 zmN3B{0Um}nOkvsoa~Ki*{ZzryMao$EM8QPA12c!|f<;o0k_`YlFzN^`*B){}c} zzB=gk9_oAZXHS-0lYXl|~t#CXXcHcG_+ z1Zv;4I8=x6mGiboWUxLHxGsxp#!aM?g2w>JZHy=X+PjWC!QDeiceb;|Y+GXG3MmbN z&|kHeR@eh&uJPimm9rCyE6jyH2b1ihtJg*B((~V#^&nqYM2+>=)PfH(6>j=5DeC{! zc(i<|k-nwSnGc`v1)ip!$xTprkF3mXO*Fx$q=h_I?%A(jEi7Y8Cf`)X0_nD8(y;uu zNksq{K~FJbC*BL&#J;DgeW0iR@evSk$&dGok&X_}1$QcA@t9$iM<*mu!k<@>;?S@^ z(};aV;0^#5lxA95O845JJ+m#fEyH*&!nC>2FR|9Qf~B+Mbkt-U8*WSq7=^dhiUt9- zbSBe;w}n0>@$FPIw#NHJhd{zUW%tax%;H37Pgg$U&oBCW@{W(LJ+*hYQi{5Yw=e}5 zk1Er55?PY}Ty^{OE)T`q<;MxK*M-Y zEudPIPFFrEENALaQ>7QWMku-&$;}f~k`|hF5>oXLnP^D_Idb;nWmWZz1?Pu@M{8~- zPtLuMwcmcdd-t5$cY8c%4Sl{lpG^}wWsL-iChQPZ6V_()xjrZ~l%-a@J;fGB z>c|f-|K{%JBl|4&x8xn;XdvA-LhI@Us_sUDD$pkSist=M*840tUy`=|+GsTB(qGj9Rgj4qiYSul05`&WYv!lPv5)KA$?zxWk# zzA6$WSi>K)!1;zZzV5Y*E;4TtA1`TcS8Tpo$+u8&u<{H<~l@0TLj6zo6{ zfv_lmJVh#UZY=~$37q&@Ku9;0U6B2#W}@B;T~3)la~h98J4C50A_jpzKRoFM>8@EW zCpd)>PPa3Kx^ER2VrpZlEJ6mgz%89aDcjZb^Aeb1xy%SgnzuoRsc@X$WAWi z1ks7ay8O2XiySls;rmD@O8C11cJ8GAI;^p-F-Bd)Dg6e#QfYnW1wjfwl0`&84N_Fb zC8j081A)P1hI}9O?6-*wqr4Qe8EQ@NKPjt}ZH-;hoaTlvyi?p|q0((%Wgz6+G!c7& zFKS*&;{Qb}eJ!qc6hYfK!JvrDV$Z>I-)Hp&@TT?LQ>C(|nevPuPPDOh2JI*Y#u_`E zXXkb*M|!_+itoB==En#isB#Z5ilKXJ+HjqmB+8Vj50%uKv?3vfa4dC-Ou% z(t%&c%@k*`2$3r$CnE94F6#Y zc)RMK1XJOeBB+6eql+MmO0-xqTejB_I!*oo%x78H(oq*o#5Y*`8*XkVcgkpbyG{=P zg|5AeA?SS1YTzyLM+X=%(eDaDbfY%7M#=uY;BjW@LyQRjstr{ErWZ0@W2FIy*M~dt)8tMFThgh!m!i7iMVI{G! zzmr+*kb%#LfEG3In5@9wiCb6H*HlyV=>+!g>Q#zpx|C%0wx9=F|7ew;-2FK*Z?aqR zH&n`I1|fd7A(DKP_aon!sVHUSd?75IE7ZFgo_Z?KxKh7jEG16Vp1oJ0P<1K>Oqag4 z+UM0c%Whp`SFo;p+p~wU#}Xzt7L6WF(9z{}!u-V))@ccQ$d_bNOew*X+&ZB;DH}(o zS7&6O{SQfC6qJ3lvQ$kA@YkXV3u_+N>MyjWmze>V0g%CC)5cQC>R+B%*R^Cp*@Mg_ z5&uI}kA3zub>wq+xqRSK?}<82<-83_%v~z)D>C@ zm^Rt4Y}>HUDi_{QDf!}&U?P`I!h*kFmi^Qcjqsx4LGxM`3b7>ZQg=wNEcV}}s-!q# z^Cg{3Bz9vLKxc-bW5wJq9|JDokgb|eiej-P(2nZr4@0A)I%p?8@e-PfY*h4mYv&fb zVqi>+wxhv~Te!(d*5r_X@|L+99Bum(cLX3MWWi4!bK7)tN;@&h3F*?aalp79&^oH| zrHI5PyIVyUPfpmq$nOf-!S_mY!A!S2}PdVl*+0 zIJC^rzPe;P_UL%?r73Aeh$# z-?Su-kC>$5o~qfqP=%?i11|5B#6>B9c_F!Ae>GUF<9|Oc)fhv=K94n4ojg$}_lm}1 zy6_(W`=F_Au$d#wCRK0xxRz$-`%G}mJNFE^$#U|zCYP2mc((d(V!a>`%OsB*^G4R< z7n>f}3%7PXT>@n3`RF!R!zHqk@_#Sk!yMaD+UnrPVK(Rgz}O|pCz8!ltnKQ-*zL@J z8x!W(uvLZrSkYSH^2(VKnp@UFc-|&EG$c3C3D5)OtD^q;=H&RfpYml>F=qDrCc~>lfNj^Z-l@Ml1%f3PH0TI z9~!zK?_{##-z_?As@U>$r?Oxq>~3EyX^LVBV9SEldEE-|o2X_?67tF&WK z5F%xP!4sWl4_t9FhxwBC^z52U0SR*}Rp2x~IJ(%*IW}x>tgw*XGmH<2em#w2A_NQ+ z5!1|1&;}<+3?ScfnL@o5QO4&;s*w9((}p2Q(M#UGyPKU^REOZdcuhZn{HJTl1kn9# z@zM`pT;4TmE>wR(K)GwA8%M1;C7-*1N>U~Mh{wPtvQ5Jkj;~Lbi;0M8!_@B_GP-`=F4inSlBz$L`3uW{1Wbe+yi)X; zdYH4qC5ZLJ_QPIsCKQr!(<%&7;whk91EjvyZK2L-{#S3Hh8kn@B% zBAym2{n+p}gUeIX3?saA1*Rlcj0cpNCR~F>l!@vJIvMibjxL!XJ4AIBE;ANGoOC?$ z7*8zI(fFOb@j2OJ@mg~a zen27soTK{D)QDbQxS~8I$bU~9r1iVk5qAkpvF(|l}kP##;2m_{e z)sy`ROHi2D=lC^jzFAeDX#Bk8Ghk$(%?}(L>Bca{o_iClOM;}lQ)0yY7Diz028L8n zr-e$Nh?VQdzKYjOb`@YCX~(@JDxnA=Fv2VNP_3`HttupiCV>D+(cnClG_nsB#B8p| z0>_)?wG7L-KQ=`^DUfocmu@s}tYadXroiZ75J1QHTTaJ{KZEvk#^#&>z&*aJ)(};| z%z?$Wq%2k(j4)Mj`yOmh3x*1d5A}b^vyhxs5%Qrb^JfOq_xnnt^Qf1kh1#dxQ(+|! z6)Wx-uZ)5Ljuiny`}BfAX#chHXi{oKBa|vIW|lVMcPs5A_idSa!ZN(G|F;%^ggl`f z#O4-Fe(5B>Q@+i;_YpNaNGo{-Up)cBKJ1rg71WpB4e7r?~*U6Z0Tq(`Qe2ExH*sEpF_1VmXr zNo|e*c-Gru@36}%3l#N*v+R-3HK`d$OJC=~udzo3;a6JT78+UB0}~3ud=Ptj3+|zO zKGl1z*uX};+GCO(`#QN)wV-s8pR81?t!&#W1Z@7wi-6ywbaZ^$JU_+EO)3QoX%K`^ zYx#X1e*?D50&P_)-XVHDElz%8s?2oH1qv(&+p6#*N=_#As>q>axFXwKqzlW9|Fcm9$xj>5yK}sg~d?5a-Pu6u{dfRj428tDoXu#L&T0z z5DSK$g#R*(zvoarL`GybD3rC@2oDE2I!>rulxe`3^d>m4c}86mp<{{L66fwSV^NvP zJAO$DQ;D}4{F6~1hj+k8wBxrA!By2T0Kweg;|)^2(F%5?{haf6ld%pxsV&_}O%$Fx z7TzT7H#N2-sI3xZbAu2l^+){SAz_t)m;yRLnL0NZ7Yk$;lXRymcmxxU8JRRpAC|-Uj%2MONi6zSNWX4X#vgUZ>RR&kp!*3(n}7k zuncC^=@MM?{9K)xwXpm{r@w5|Y_^+~pL+c778x0NnCXGLK&wiYLJBJ)AVxdpk~#be zQy)V?0lg#c6M83h{zhen$bmAO#0D5mrFgV0%% z$}UoVP5dMJlMwTVwZ)r~o;WOMqWA?b^93)yUyPv;RsbOpqyNs*4U9GjcVCSii<4v> zSjhfmgTSf8$tzEIpSGHS8H(FBlDdjxBXVoLw@x`Xms@Cp;4Q?7b6}4}gERKDwRy0F zwu)-P-77pC(=5kKaIs%YH9Qg-%S=GgQt-s}*Xd$2S%D&Xs@Wst+ zU0=;CYsY@#YOb$_wQ?J*h8Ha(2_E72ZQZH%g_F77xA`t-PMu%@An8Cd3Vu6`sZJyg zq_)Y$Fm}%+w4RkxsHX_1pXxqi*lzpEGwXjmuI0{hzX3h)q!cSe(ep0q?M808tqHoj zopF`}kw?Y-`Z-nv~Yjo0%|Cq&oU@_4({Av%fG=Xkg z{uc|q%|k~`E1_j9p^JR?t_d1kDKGplPMm#MZt80T>c!e;G(58TGQ^&0NW1n*r8K7q z^2TqOcCK{#Lpo7rC^(`DuV4*jsuicq3SOpqZMG&-&cWS5pXZuTUbHJP@>XK25_*iJk-x*|=W)a`yGABqQi%gpl)5*w0Nyinm z7@=jwZ&5&gGi!^^7rVK4-C}IMo=h)2$7|LFEi27YEi=Md&xABv#oF1QjP8o6p7aIg zgMo>3tT0$D;F=Yhw%Lkosb@(7^XXYyyk4%ZC^|Plq#0(r1Nvx6|BTXQRVE%*#@J3) zDy-*QnM1+?pO}&l6?y@msl6D&_uG8MqX4Oryv-~; z%90w)GwXqOv~$iUt;(GXX>}fD3^B#Gn8VrQa%@p_9}MFl4o;l{H!3#+(UWo$mybZ zN7IHO+W6A6At74BsnOgCmHPRyauN1?;gAGbSV+#O2cHRTa5Na4+`jrQnMdr8HvW#se~>?ush+qfItG!b&Ip%B?gQ%hymxafQs zJFt9H0v!`h1?5a+6z2?PF7f!+Qix^8iY$!e;>&b6wbyN^_afCuiP16EW#v77pJB`C zS3hkWiOD(!Dxz;TA+Flkn<=T_doHa8BI#?;iI|+DNJA^-lq^mNGrU9BJ@2<9bFA}P zHBCnv>&grbVXbM~*rzrM2r$Mv>0)vYw!LUb>Z-7JTQNC5P|G-uF5^YTIz(o3Vu$do zqqfpOYH@flvzCrAo9kk2Hut5Zdh?honjn%#8CM)wo1#PO*=gJtK$QS>SfjVWA%7l4@A{!zlF!Lj1XxHASZ9N}#jCOdo^bsCC zWbN{1H{&U*W@cAL-P6HO&Wu;zKS+DyWKLA=7)Ql1aF9eooldEOu@i0*eWEQW+XKQG zzy8WRb)i=Y(dy4KAcor?N{e=NMZ2m3RVlm2Pfo&crHj{?t)au{TyG#z4Ktom(bS+E zD-$M1i0z%*B`_;Q*nu;}GpcFXDHDZcPx3Hr(KH*M;XXu{JNQ<8-4G`wt(u<}?D1|d z23UE9gXEJ4?K0xbO07rlkoPOCqhu6oRr(s~h`KZ3+nl@pR`PxLb}2)<;^RR{JC9=2z7A=L3keYix8>(3iggEl8I3xJZy+aoA2k?Z18@`iS~AW5>Z=_klNOmODyaU;w=Zo6La~R6vjNDl5eH9K|hi z)`kn({tlM&pHBc!VT}YxCmeJOKDygR4ROzqZpPtlsqwGn2W9aka?zL^%!b9T332C) z)eRo{G~i3A-MN6R_L@LjWs_2Mo4Ggc#815wW!mTip*YRPOd=Y>|0h?wn5gbD2|Q(~ zbd&?VL|ZV{aN|SOD=caJ!$UT!B9>nZY7G;=J6=%`&6fJ0RbB>5!gpPkB#TN4?uTaH zx!snZ3<~Q}CNz>1X~FAnMpYc#@zutZpjhw+1_bh0`knawdimX7?tH$IBx;zsZe!eK z)(d?4fNT@ijuAkth4#`ZPfAkWlwXQ$hFdmkb~i>kQ9Zz)ssNe#o4bA`8q$NuJuSBR zWLNI}{AJ^MG;U9K|K%RxLzo#+v+gmRs4P+YM@?;vtT0`N*qZn&<+<`I`qEmSbH%So z1~SHz56Qot3oPO%3e)kWK#OlMy2`BN@UtW))B_L}tPhH{68tIhbsF28v?&iDZ>~5kE$BZQ zcx8Rg6KU%kU``KZUotH%x+>{e6RlHr21!?ivhFo*fvbhvA1 zYTO2s`ym`dl??`$n6Vb$lQVCD1;a>EQSQ~Sc3WKLP_-K^AiItLv4mJK_o{PSZtP zS=C-xmafQpsQaa61b&D%OaEDQOQ>D)#<1JhvUBW<+_(*^gqELw8lHyWvTbW8k{ zsF4^~2*6GkTl;5^6^f+~%2ZhWNw*D_yh8Jml)z}Mnaf{k$Ib*WUl@$xt`_%ho9WV? zppNut1sWceHnN?H=K;e(-0ON}{NUSDkY^VzT3o_*)nD^_$f$#`tM}$>E;lt>3m!~8 zFmPyoAx5}pj|H`-F_9*oWi+93obx~t4HCaJ2rGN3kEU`Q`NvmiB8k3l&LS;M0e4Z5 zLNcvKWh8dxb|U+s`f_&EwB{lkI6qpCTzN4D7{u4q`lsQm-YRo9rI?-!|KB5|dhgf~ zVwB%P<^~NE6UPe_?u9xcedMxaUsb+37rEZ@yBC7t`2p5kNV?~H@^P4El4jF|jP_3d z6SA{=B5t9ebX68R3XgX2)$W;|A)CfVNc+_o9 z33_J=&l~A7|C(R%dc7ia$=MNOvgd^pqG6DMyY4LQS|Y`N!iP83^}I1+_wj73;?Mf3 z_QOR(91F9g{#y%ZMUvTPSUZe8;oK3nILRj&OPAxcrN$zN-cvRUMRsR_b8`&# zG;f#RQ}JNLH)McLMtovE0}}Q1D-bAp@Rl-I=0Sw`A_%-LE{cJ)U|lJsh6!k|w1~4! z&g_=)&-sb=>qMtYYz5Z$*Lm*@5*SF~B^hPM{{k`l*EukbaCD|YOs`Jfo3F%NSw(Gj;pqN^*OR0tZ9 z{G^Cr2RVHi2A+-sfu|UI3Lo`l-4_WcPv3o;o#7YU2{)aX^khA@vY%d22ITURxY*0! znwHj>Bh26B1oQYX z_kUM#>?#QNh9>~x!&ILvBw&Q~mSPZ^vOb8@VJ@D(Gc$%0u_`pMzvSE^8H2YbiHz!n z2^o3sna=Qx2yoqncizOr8x5Ot;(?vUeqho(q1jJYnFIm($b`-%i+9#fAtJzv1==g+?%P$$)eiN9Na!$ISd_XnOLJX#72%Mp#w z%p$zA&w5o$*&Dqgx~@vgcbLciRU6B!AZ?cyJ_~J{ms%8jhDf?wXln(G@0tP4=DKJn z>1Mp`0Oorb6tdD`=w~y2$k`_XhVSO&{pIdl3oAt2XM%21;?(j!S#P8?6nnnFl-Edf zj0>ThDQeQ;I!WQ-52n&9ofF7MGf9^p1TqkP^%;2Wj@>wA@F^4U`Nn27m=j0>EJ)sZ z9hTeL%BrWnqPQIK@W?$gf!Yyh8&YWBVByRVX`=m1FVWF@H^#7&r4krI zmK|A@0PfEY0c+?+lbA*m(_SoJ)Pfr%JE@nkLARt zvaaya6ThfkNvhc2%74L>)8B8d)urNSU;Re}C_P4P6-jxDT)#S?YD1xO?C5heUiJCc zXwIw`_^0D|W+VE}8m=x!Bxq+y`+ek+vr~PcUT27p#`wqJ<;{=w+-ie`29uAsYB+h$ zjv|?!?2Nf_YY@F9Ze68Qp6{OyYaZ4T?H6+Xm%pe=i6^td{A(FgOV7k|OZ}l7$HqO4 zzN^W{zU=>b%X{<1S~}K03v>~mO8wRx3ZXdg3K`0~6r_o*N<3v?(R2DJRI)?AH>vsZUiTpJC?o`u|L$KQjTVm5MB6t z8__?UV=%IHXD=)~l0!POue`dt%K)^p z{W3>KCcSwczZ4VvcwScXgSTG}1r+m3YkI$j{{gdW;3VXT^sNfoM%0Yt)H6zH)Ea1F z9_U9dhLfixf9TS$3fbDHHgj#3H7_VIx7OD zFrV<7Q#*1u21+Du)Zw?KVVNM}E8^=@RJF8heZm^+a(po9I~~x9w){1&hX@tL+*!4L%8v0VistvllClSa@1% zSZ&I%|A(l*U~8-Gx;D^4@gl|D13`+ryK8Vr@!}4}rMSDhJH;VDaSJZRA-I-eEn2MI zx!-R;d;f!VWL>$|oaY>4Ornpi0khj}e?mfhUDhxH%m&}4&Gr7QohW}0KjxSR3QjC2OYN`e{PHpxgiM?4?n4!sTtw zMf`+aeTzZGyFZH%%9s&*2*k}s-R3| zacBj_>}aRf?}lWa_TTI)3*OpXmq3+Kk94cd*z1<2)Eky%Wv@up=)k>lmPrsDE?Yct z?2{iabG*95ZwItlcoq%foNL(-{{-_0e2;`wImo+#=_M7FOMe<=;UhuHtqA1+>U9sH z30*-2p8Rair$bRQFFh~yW|Eab6M1yw>use?4H}VwQp;Rv^-ncT&BQ2;(t7xq9pf+p z(Bx&PBcGFL2GRj0-#JhuU!*lSH}eSFW6!JSt(sYf)O2wU0=8fze<+T_xaQO(c9Uba z`P>^WLptuqn6h!L5PmGAZivBJ->b~ZZwhB248iy^$r8;c*=q5w4}|@im`BTh2>{!U zL-U<(yn^G8j(n?EZ}8W$+DS8tBhliid@iA7Kd;9fWQHA9lePkQwtSPted0ILG&gMO zx-5BkfmYu58`bu2arjL1u^srz-hlEzG*%Aj$@;?Gn%4Y-Op=@iB|V>q=>#~%pzXf_ z+iCpkWLDfuuKDdj1B;PD%F@W-tWf?g?q9nWxja`g9zSxCalVu5GR{4}>$c?d-Hv*o z`f+iPUM|+;V|ImeM$P!;$FPSUdyp#)xNGCBk?6^x2lyiImLH&ANY5_bJbNhGr zl3LjQx);Z~)0|&KeOu(`@ZmSqs^{zZu(&EJt3u`OIg!+cK6P=g2mJHG@k6oud{NF~ z|EKw|2X*nEGTpFlMvkD}1bpNFI%LE2p{9_5L&#%BP_vO-r_sFP$JdGASI-InBg(ku zsJL9CJtm(p$v%@dBoR1nj`;Dl-ti=z@{7z@AQcz(#&0#!XvcPH+7XBh zVpP(S7$S7f1Q|zZ&vZEM3F9;QiX`Yggy{&VXkRF zw+1TqHAh~SDpKowtFdEe2Nu$2Y2y2uqKX5w?uTDNQxQ%!;|Oan&N z8Q!FX2wo(6tJPq{zi@Hgq<}DjDNBRRn}1`%ZX=68O@5SN zOA8G8okoJY5s%nBXdo1^IupjU#K62T-&gG%Uq+I&9?)7W)V+gmA(J?YnF!t}AQwh- zgy~13s{TN=wY|&T!;;}^Y3-R*mSaEy)P?5`++8bAMo7MyCh&k}m(Kmv3~Iqg&xuYI z^bzzka!oVZ$1Jrp<56-fG*=a-L6cSQ0=-eRw0p~1l@hq1qI@Q1VP=|5HtaNgAk9*gVJ{$F*vMM-8n{52{ zqxT=+{R zhTe5Cksu`w0n>dFZr>$~TlknUb#n`kApCOi&m$t}C!SF9&xl!y-oI^qoJ# zse+fyh0wsg;ZWaKWA3Tu1xrrOQ`CU85u`9JEgtP$NehBEF|B|9sE?Cjz@-^+Tb>@a zDu|W^&G^9h9L{Yx{nb*AGN-7a)V9w~7>d&=viotw2e_DOiA_<#oaSDIC3K}^$%M9+ zNrHBn-Wbu6F1g3EnlVXF2Tsn4PjEbjouaRaD5>G4hvX4hDlc`>L7RI=D%0C)iV>uUaZDgH=&1&Uf*Ylxu`m^h0M`u8Tt`2`Lr^x~RX?Q^4-7gi6x2w|{F2LpV zt%vN^Yx}$lZR?p4T`F#|pA!~k*k%7gz3Vy-M!)&+ts+M3Vg+tA&c|^Si&=Tm?11VB zLi5|R;I%q^TUh@$WBWXPw5bgbyd-iz^DWe&b3KhNyo0E{k!kvwtNCQCL ze)GFQhf+o~ZZQedv9J@8D);k*LIsQO`kCFj zE{;RJN=v)Z>47$9Xx6#i0E2sDlM2Ps+`3VMb?7>BIrH_aZj1VOk>nFgeS%$r?wv0~ z$kzH8=dzV3L-StKm}9e#a`BuFFmRy3$`IHhqP{BCNXMnC3SyQh#)G(^DSR!Tt67~U zTdru^atkJJZ=SusqyDBo?xZz9vr1~^qUf7?i_d(`A_TT{Wko;@?^S`#t&{ORhr}kx zE@X>BKaEM^BhHyxIwWjVKS%jYALsdsggyy@TZK>JhdedR{PhvbBsHJt$x)(A4e{3! zuL|rhl(Yn^HF6x=H z^n=y3@l9fW>mRb-0=#mgA6nL5r~BE{%FMA@?YvzTK0a>8Q3cHDT5H>k%B@$u;3?-! zxM#rB?fd;(p3!w*Yd^~R&;G7o?;(L*Q{hl~OgFYD{D*t_`^+e6P{vXaUKQSpw$L_w zv!#*&giIiZkkFHJ@w?G3CI+hHsp`j=ggzF_Oit^V^5&D zBBbomknIn<;Gy2h&Z;m%9Q^=f_iRETpyUdRLW@tjhaULvkz&8t!gyY@!@~k z53+R?yJmDyxl@ePF)B+y(M$|xj2~Z1+BM?aG&v&^+D{0bRsncrUQ$RLq%-vODrQ&6 zvbb?X5P708X)9v3B+j&GbW73oJp+*awV=feQo`NsDvV5-?!BhOg3aS+JBP;)gsHtU z?ClepQ*I)FZ-8+Xo}w}WTWLB7h5uhO0#`bQ@glsBEviZuUk?QH-zT4!p0tk`05d72 zq$FYlZRz2wW40sV1)(v74E}he1jNfo9_gV073EcGYl`V(A!H)ft>~kFe!s>e(xT|m zilvX-U6UEzY>YdQ3(~sLa-lUd#lP#p;Mos|Btxqa*XE0mA!hU- z6k2#6_I-uZ1s4XuD|=(_xLowntAu9fE`g3dmD~K~Em*OgXhL0!WQ`I65JML)>2Hal z#DAWD8)wHbBXMl+edND70~2#II6q`wWa_flp!n7NOy$A;v>o>L<{0#dGBZ)1#KD$C zW9YWjrC*?#W@NrSGogEb5}7U{sBe0+I}mk@^#k9$F77ozPVwQxLr7lk^Kn7I;r=6z z=;xtJEHQz=9MP-Iy5m#Ux2rS#ej8Ld3h8+tZcaFSe#q1WR@9_*2c$QAKEmSoc_)Zm zz_ZiOt8r&_FjTX5a4pMNTvYFo7|@1ME;#v z2LlBw#INIU7j@ijz+W%ZS7UzhYoluvDMxoSm+4MKb^ngs4 z-NFUcnVa|=ctBYNJp|+GOW(_JM;^l&ksw62G-mD?3Av=Uf*bl~4yo(geFk1hh!T=C zB3h|17N|5`a>xc{n_BfK3)1bZY|t&8N%&~?hD=p)=8I+}J++m~6zJX*w+ zhDTZ7#NbEiF1WhWBSwf5lO8xRHZ}SX{36jwt`IiDZnCbh6|xOU^%_g?QYeWkk&H!m zX0>_VUP*85mOKk!$0t+MdO|<{gSDVx=46Vr5e*q;wkFQgpjdCBr4Jxs!18Y9OJg_; z3jH0C+V?F8>FQOe^NEnEgD{Eo%!<$-&zrKT)KzQWk&UFiS&gJ!iU<7`utba@kHA46 zGZRJ+UL=2$;alGReO+A;BYL)-4EgqBEE5+-)3~Xf!?VHIG-rN$r7Ly4Iq)|TUZg^Z zK5pU8&UcsfHi&xdqP&|xNe4*NNkI1O*R>+9pGIlSb$n9O{iXkT;P(eAlC?0R#X_Kh znp&YZWQ#>otIvJ+Xjzz{8lQ;Kzqx|-D|Wt#ht(YK4@n@;~>dl#RHQ3Tasx)9Qz zO|OP#9a$l3Vv1iZM=fEUqds)s{&0tqk1JUyeGX+Is&f=0G=ooQNPhA}>|k1Nd$1zZ1!Sj0EkY`Bzwi zP(+-kIB2pj8JZoZRZJOp5qKxL@!9k22s>cxOCg^}{u*XVg;L>VA5MQ9$9C0xS(tUk zusiQIcwIcM6Gpht|1LI4wYU1EcE5A*mo8;zB9gXZ$vm$sH-@v0CRe)P!!sM^sJRCt z4qAJ9{>L?QmuEcfU+uU*Tr~3$Q+2iE*;L#0{!!w?{zGM*ujRu%ryNdQE?J7IfTiZ6 z)jkZDt6im*1)I*xi}7xqM)cSMnb@AdTQ!PAg^=_M|IqAY7K~WSu#Uix@9t-xfQMh* zO_!DY@iN-@9*qen#59D-3@@LRzoI#sn(bh(6)c6L%t?5)y3yyUF)fOb^lC?YcA!Dq z0gN2PB)CY}B)bqy7SYm36B7|QVvwdpQC8eOxj+N3bFR?ZI0UCv?khMU2Z5)VSgcnA z&8r4iEN0u%f?%M5a=r41#6AHm><2rFS{bv1yWaS+IRif7NSmU(ee5>5BmI1j@X#z zb(pQ+OSEa%zsswkYrN;hW9tF4J!kTWi}mxJ-0EZFh3d9P(h51ovcEiW&VwV>x67X) zy$`kp?Al_pfuuHOgL13M5^j(_jx{9C_5W^IefFCR6N?&_oiw9>6rt&(66Dnp7dcNj zb$HCkG)pq&E7C8Gs$BA4S~g{jt_Xu%!b3aRSfjOl;+rwaW*&(%c}xGO-8FenS^%VI zAt8JtpU!p{U*e7d@Y`t8Bkbl1q)iRa?BwD50CKkH6l13P}9 zA2Bh()pfosmo$?qXk(Y7(2Qxd{`eMyD=0rCL7j0Vej~aQPPHw*h8-Vd2x*onlE0lH zFq(ufY>=a#@hWfWeVbDfZ#2o8UNGF(THaF|P7!UG@)h4L&%!zFHB6G>W&xfn9clp5 zBo`{n(fNX*^*5ges8cr^!p|5TioIN5Se#wZ6cc!b=)B~Uu>xTfY{V-Z`Kf`ps#26j zX5oiKBBXip_}tOXf2#>UJEchtxUD)$kSFfyw#^qMUcpFt0vjdh6QK#MtPI8|d)&;Ok=8K({S|--; zBTSZOjMVmSjCT56;XJe!n+AO6a#gGi60yGS@z9_Wl<(IBY-cIyvfmiaR`8rqd#K3` zrJNK#mjr2Xc}eVT(x1#p9B1QQ1-jp&7goCelY8n~UkzOdBsFk7eyP*9;5bxE%OXz& z=yv}b?NTVP3p$-R4tG8&heIqG6@IkjxZTlanut}}zA{DGSH*p%+V}Hve$|ka@b{Jl z?qBbIf3m;@M|Nfo?6uOhXo0XpU71IK8CT&@WcdquLZLAd?tRWXX$@SyNS~}T$$UQi z(a!fSpLI?nzm2~elnBOZ zxk3gZ`YYLOvM9s^46C=B z3k5hB;&4>6zFqS9D;q=?Q5HP2bJNEaqja4&<3M7fA_q;oZ1?vK*EVDUSu1lnpRdK_ zVKw;A)X-0T<#nFb)E@L?a4$2{qie1U>(YU9E03gdr96-y!7t<3F5|qK4PFd@Z)BEXO(hUiGe&8NSUP>xoHrDR)rT{bxOsZ-KpfgrurPUs&%VJVYJ7tdD?}kZO3O z6lIkUx@N$Cx3st9L{(M!8Mosu++aLTak8O=FNT??3$w{uIT2R>nR(EBD|iWMr$VuV zc_kd>qxL?tabck~N=Uq5s`#ka$tn|8J>NQ+SxYvv5e42@@2oFQMtgUghNN?n9)1f1 zO6s&}EAid{!%W#hPEl6G7rEsfGPLX#peDY#S_0Y#5&@U#<*vIER3GuvcEmv-MOEW0 zdJ}0wPFHw$S4vI1j+5^km08p8>FT{ibQw-)pi2YF}vc-Y_=){`B^Ca8T2$%SV4lNXi=Hhzt7dK#_(eeF<<)j^$>e zBoB1@%*C}=X9!(7$@oJEh~s&eZ;d#U(Sx*N1lj^D5Jac>G8BR;<2=916&XqvqstRv zPkl_?$fv3ML2;Z>{-{c!9z6;^gLuomKa+1vjbKW3+>?8UrQ3!`$Qb;_Hd}VA1^ifUXI9${gkPdV~fOhmfqpc{Mt+JX>(YvmFgJJ0UWGpN->hD!S*D9na9mU@RsMnIg>&NiT=Mq zv25`vm+5yR|4&+$ApjYd!Y+%BX3iFHyY|~^dviS67h&{OK8NVt;)jht={}nw!FCAc zUw}Z#)cn7xMiY9T9-PV;AtooQq~ndy)HXMGQqKa%kkh-7(<$;+H+^10=4^ z0M%=K3;S1L8RsFg1$pwUd3L8-v)b>|^7*ap_qpqh7vTKeq%FobYBcLc?H_7%FHpK= zG^CwGC*=F3nIPrJV(nAesvtg&cF@ceUm(nANTWpneLTt5sq1)_H_^Y!?4v`!rsEkZ zQ!$&GP5lLNe`wZ5?Gcad5kS%-G^+dAhg^Aw z=ioTgZKmXcKsoyF&_u+`3jSL;kb~34h4+%)Y1Rf_P_e)He*_qg>QdRrd3qfL?$X10 zqtVA>`p7k77NvAWW^2$6kRoIW6wS^%oJ;8j@6=-kyX}6y*OAGOWoC|x`?l7i#g$kV zH)&opjdwTu)l=p?(_>QoDqZ>#chFH8p(A6LU%(zw>6G5I{0G5j>_diT|K!-FzTTwM z0{4H6E!O4iAj=-spZNnAez?0$l&{+1Z`mJ-0NBD~7krD~4?Y2ZuB}uHT)8#7C{*aqM;R0G+t z`dcZJOxWb+vEeB5XqFo9|lWAG;?U)GQaB4r_Hgn5LFtlg^$Y5{nUO_;K{qn*=b1E3)pxB(Fnv1M6I(| zyuP_J{htKlv7QMtOt#+uhZEBPQ&hQY$MDgBLZ;x)G-A*8EgPn>Y2#UdU9TC8R@Hvp;$-dLp(eGxRM_bkyZO8v%&f#^tTjCXoi&y_nG2gIwXMaVE z(4~qV#hD~ldKT@T_+zu}Wr@@;Iqahn84@O3senCCLg^&U*dAxk@6Hk*)o0PT$G-rlC z8~!lNKBZrtekgZ%{yzv>9C%N;fNc6bPyekEliUmfk z^0vrVG7}rg%}kiD-)49WTU3mZ1L6k@dZ%b76|t&dxBHq|#q@xy zg4aBz93naj&EPZIZ6E7FTgUngYe-w*P-`q6P?kh~ z_YBy_rwyJ|SNh--US4mvhmP&KQFm+k915G1Pba-)Qou2DCPS9)4#O?UIH4}6PiZ2k zEm2S`qWkFJ?R@(gW2+HZVg$Yk3Vz=Wh)<>>LEiX-puS-w@t@T4r9znzU72Wd$Vz=D8iNE& z$@*($xS>Zk%F%AQwq1sQ!C9xlYZ_N1j1+<{Xk7$BH3<7gd|VBG>V%bIV`)rk)6c%m z_ilV3Tx~jlfYcm;T4#shNebi#*Y-Ni+02RF6)idj-e^`QLUPv9MFRk*8l@*15vwCY zwM$B9<4@iZp!V8Leu-LhnmK!Ghxbl*&n;i;_+DSD4jiTD{Wqcy(nWnjJNL>(hj4JV zrxmd2X{W{ou+l@~5@aKd>OK%^e4K4n zC!r-K1@~U4P-MQu#&s>LIK2kxMh&dMxt_tf)7pl3mngEiLsRhA27r6|OQ*bASFB}6 zK5t8q>nGc2d{R~_)>9<&{QAUE&bAO>jC+k{S-OXawfJ7!?2E{s>)d8lOGfo^_+rye zhP9#h3yoRE#R`#zgkc3IIK9gE-9BaxkC=Sd3_n3X!N$-^l2)Cbw`doMann9yLC5dS zG}PI!NYeS zfg*Re&Cb*h_i!^TpzPrT{bMSPJ5nvOPaqm6EAOBp{@OjZA4V$QLX{re$PA|61%w1PpHnH# ze1=3CAkRqMnwZr{Oov>wT?0Z@yiUo@0@F?+1uRMrObxDM1$w2#>PF?-!(nD1+ z&rmXC3$z5WN`{7U^ls4CuQ}$|t+|*eB><(cN&Hyibb_rY_1b|Yg3sK~Of0OgfO{Ro z#5PLg^hMRwAev&e(M~B7O~E;5ROXgINJHD)Y=KzBy1^AM+ z5vjSX6Y8||e);sA$7nP{xf5P}hD=0jURUAEx zRAu-GMe8j8ce=&*XMy!#yX6QjFC-|rMaC{gBwrv})tx!braAu5IUQn^}6alJ;^W zSeyh^tHT!lkJ7`{3@(nKM+$r|8I`6nvr0w)J^3fDy<$QuB28|{bWk$A&+7^JF+YyVQL$h9+7I63Xrn|w4 zz{?xeaeO)Ro~gayIf4n+0YQ!tqcpVSJoxRx%EBrfiZO^`@+tOb)E{Y40)#>> zgSzmn>S(d24MKj|I~64t2K?fiq9(M9KCyKS#bB>B@Cr@i>S+CzK15K>^IQ^kVZKzTPx5hb&M zhp!h|gSqMuI;rs^LNA;l(3ts)Ut&C4Rad=@`bQ10UY3#C`@8aF2Y+QG72QdDp(6pS zRB+Ui{gA!0r9DF+cXuV$hOPC@OoH#G8KscMLKS<3qV1{Dt}vf}2HYi)*&0~;`|ZaA z)N!$|?bcd(Y+)bKGgajh_!n%g#vtB`8cggxb%yxW5!~F%?AQwJnupVjDWmxt+%)#A zuh!tYRcMexNO4!Ow~T`+dB7>5y>WWJ;9-;hhvnKTQtuCu)9G3&V||ZmmW=Up30GoR-OGBN2&`?8MS$G_{qG*bOU ziMkJdU$=U3i!afuJ>bO9$tH|(y95P#7*iIrAfa@6mW6aobJkk z?|)t2;_C}pI^_QX`1Z4n|Ax|HF&uhL;*flcZn0EuUJtj}-~F|*DoBa{+Z_eWBRI`E zxTv9-1vlb#d4%%zlK*|SdOgNobtZ5j2~tX_%d7* z0Om+%%z4TzOc5Rwl}s!3J_NWWp9#imbU)sP6LQK|$dh6@SE-P*25t=!G>W0x>i9B5 zJJ^m~G6FzYn_7X~^?>=e5Zn0d}w! zo8^vcv23soorm_ldif!_n5N_Tg4r(Ex$HY~L2Y+$$)kZz>;FHq)hEye9(~PgOIr0s z>e^`MNWk!F^CBW87rdsU=vmLp9m7+1v#;dVWe_rL(pifkR4vg##0M4O%BjiFGA;tZ zmJ}DXhw?Ei`&Lz+)H%Mtk=DIP*`{&(yueupUFu;Vv3^h)I{J(*9@sM zkM;&{YA&f|EhVzf_6pNPgb}Q2e&szY3L}PJz}LJFtpR-*D}SHhPkx*VA-YX8@=uj_ z2EGLESnr$75L*!eIOQOfIu^1%lnMyn)m336a9qcRVj8giIW%N;-UYR9qivJZ9!%jR z4!H)9oA~)|>Vf0e9i<2MT=67NN#zD6(l7AQ+X>5p5l`vCri~yPh=@w~SyhFCkSex+ zgCAIBjgs~iUBawN<{MunbY?7frAggEgRU22C8kTP_J5AJNf!qY$rCO0Eenm2d0gpTsoB2uyUtyK4_&yG zEJgU~6Wa3{r2yx&iiP4F@~jg11z_@)a12qbQ-vwLNNS5m06nl#Tuf^p$x@)`M}szXOWAq#*4K@tLfGpxld8Z^-Vl4o8T<#oc*J$C z4kaG394Cd4C6olGwTIH}w9khBGs|vdN6@LCa?4=HOgM0o&y65uA4-D;od!!mQur+K zZgw9l3#U( zbtD+Y$+3RiA8$|hyo!uhjt^2vhZ&hytQO;$eEZhqiH2j!+^Uzt3aSE1R7v{^Ij@oi zqDIL;-%rT9#UQicsm9urlxDChot=Z*6~M{;Qu{B${iV~4rABgA5F#qP6+%$RaMG`+ zQYo?CXM)#Wi2e2U@=kD>puJd;&V?hE7>V35{z4^%lV3Kv5VIqe>yZAf;kU27o-{4P7u-;J`pGQ%Zmo#aUj?fBq`L^dl<(iM4b^h7qe_E0c-({fj zEf8S;RvjvsXPSU}!*s3ePT@=m&Rk^K{&OLH+(#Tss_JP-tDC2mo0ANxZO>&)Z)>L` zKieMvVbN&i_gcO)xnjUy#VDN~LP#*^D~phD7>;%YLyeCBnWbkov_Yr1g!2 z3pVB~QDDt_j)T6(7Jj9+Wfcj<4M8MrzXv!G#WrU->?y@2G>dF>_N0=1{l~-2+qoC9 z+^;IJ%haJ&nVY7G#}=O>XnwAj*CCEP0pD9~O+d9+?cQmm(r+Azd!!JOTMVjQ#Y;f#{{Q|wk524e2w%4j+n<^P9Svu3TiCRRyF0m7Zqjp^5w)F3 zcaBA_r*?F7?}Zp zafZe}4_@AFWn)-O5rtY;@|F0K%4iu6Nx(*TWDAZBI_es&K31WxAPub`*4k$ln1ulx zhtHTsQ*Hnadrd@|2lx1Qz*iKow(rcL(acvvXt^Np_3cRJ1n{#^o7dxI{J zArCSr2J?YXe}kaggr2_T;3uN;;-ZSMf)VwPU=Z`nT>$bdZTl^%j&J_J0{AjQdjl@s17k0 zdRjpIX_~)MPlb3nlqMZ_nO*c+ZrTDlswM|!t~2S8vD5h>e|9f^5L4q~0T zCE+*k?d>@BT8yW&@7iuxvf9sl)Xpi@`K+#qk#=NX6hw1@&vdA>#ncpHw~+TVEBrsq zWR=D-SZtCo<~+V9&iLSoFKf>e9c!+P5P9Y~buI3$TD?`gE!wO7IC5ZHqL|P*!_DCd zeqB&+Ef1nC=u`K^$6m>^2;v`|(Z2C9oL%y|CiBREu}`H$ulo9Rq^NW!k<{@!8j?usJ0>neajuktQO^=&6?J`klGe07O)5c2h8Yc`t$q=g)=ZF|a;t zz8?!r0ju-EatO^mi5&O5QfO}677UbYF zSlz9;Ly&AS?#8bn75d>}S}~;ijIq9v6v|mQ7SR9DCFgQ_D^{rA-6(JJ8(~4 zmDKs>M+FWE0e=fe%db0h^22j=E0Uer`?GFf?tz{Zy)SsVOsZ4~?5rM``TrxXD(|rK zowv+5Bk)%a@0N;9UeSCJ0@dI;Sw@O)1)Je~xpXv%RcL+fj#EU7XDyo3t+8M=69t}L z)~6)Ty1yNmieK5W)Kw#7u(dN`wTUn-8{Uwz39gb2bc?zPREz{4E8xSZErio7cJrUeFV!*=CjK?D#p*0}S4t#lwK)09#rxB{l%TgLpyiDGo|fBk zQFLwUO$gTQg;Hu>5-C{a#HqdgRs1D5$hqKFM(sV=o%iWN8X`7&2JufnaV2-gUv`$1 z1U>e!1qOZ^-hCoAaRvazFp@L$vt2B*7oe9L>*7iNi{%yz*6=~8y^TX(+v;@Ct7K?o z{!S$(Zc~+(Tes~}cqT(zBM}6GTPC^Lh0-`xQ$LJVwjq29KXCuo^Qra4Tb%B@#+?$x zz?~5T1Rw0uv(fmW-HPn`Od{S9!tEgBMG*}DSc>A8PfXQC-Ns8PV|U1l#0>Z@1f1^- zbf2GM9N}3t!7A-(a$IgYg|H(W_nC~`7No^2O?(Tkp>oX>Q|KCM)JaC?+4&igs7-B* zn-psBu&=RwHim$*>D_N5Z6nOmpo_!y|H5i8${V||4i&-LxL*Vppo%;Q+OUq5nFGQf zsbvbxAq+MjqVk;7K(-DS|7F#w!@yk`M{@ zG$Ug6_S%EG$JdQiG^C~B!|oY;eG!bF2AeFO(|4+XolkU2syh{oV0`e~V&ZmqjDs15 zG3b-G-MY}LlCxyB0jns(0W<;TzCX`;mg=PdP^G&CRR8OoN#EhN9IcF zonNcxCvF3A?psw{{k5&hc}+x&M7*d|i<U1`@eh|A+U_+pmk0A z1&_+*gp|6F^ExxK=(t$rRm-VU!OQJ6{-uOJ^7l>3tRnt*4IE;3^S}l^pP`&AO2LEf zcM@HSn?ldoVlF~{o`zUg#sLqv9BU)wok7o!%NLi*x);%{*!`~9|EB}IV}|N@=J0!d zxB4O&IQoUcXK0ckgIX|%jI>JXNMmYp@=}=X-zA$zqmk+Qoz^X8soIYEA3;|%=)X=@ z-S&=vi^#zHn+{14=tVYbF6Ogfpnjj!XTvq4e5~64u>c1N#6O@O%1X4>fgl;(qz+P?b~)E>=*!ozi(1pP<2-qa_5&r%gXK+@#&RZ!9m__2 zLBoZ2I55v0GQ!i$Iuo5Z^V;#>YhI(f?m~8MAQGw5LOoT_?5%i2w^Z1@MDVMO@;T#I z1ni$D6>~I!A)aFts3AG~?j-#~r&~DeeZRxIKlU@`2YnAJ%2$>*c`G4)eyFPwb6gNK zE^#i`cD*-TCsES#$g1D}kmPs!_0R9Us?H)m;*)?T{l|3OTcH03(QBup_Kc)y)_Zn_ ziadnT|Ag2YFRe8Y1(w7awRxNkqkX4LcDvtU;YI6+1SlLGXWRvc?r0hkZvPnE!SHQQ zruSoh%2~*_x!>!D66(v2n5dk0;GN!s!&TM49jc8w(bq4D zhF&sP3y1Z@`8TsptPSkn&LP@FS^7kU&(DkT^{+3nj}lJ{Z@%Y~N<1xLZpEDtZ3|u5 z3mDb`u)1Qea2&+zXW-2)mQy1vMl=6{O$Tn9qV#0IPmx6!#T`^(&O7J_ znegd5kE8+%g}RV`FGV(wW0co9uM+<*w-XAjOWmj?0vqYK3sd_DQ+I-kHN9wjkS)_v z`Hy(C0f|5T=b)TrBt{)3SXfD0_Hh=QBqHVTPx-{untpU$4(1-F!k|yp2#Lbx9Miz= zBPmb(h$xcZi8byoJO)@j9*@W5Ms5ek9_c3~b!K|s0@WYchDpYp z!Ledq+w=qJKUaV7t9@p+#b;&JGwv=$j0^JX?*BuL`qOF-D=O=sNL~KoxwlaaF(prl zQBnGz%(5LSh_!(1B-}V8CNnQ?X@l79#sl#RTWzkHMhr7Tw< z`G39dOaxMuwvA9)r}we-&LoBvb^5J{8hzPb)?jHB*O|KVmwJvseh@R%D{6sBYbV$i z8ET~a%%b``Z9QCxWWwmKf?oW4Sy6YcfqAe9ruB8+E*sJaYlfx@^@Xd7B0S}nw5%Xy zc4-qWuW{}wK_-zF?otA5BlBIzU&XlEtAdfluLe);xw{oOxte!~=PG7pRVX~#c<&PZ zP_;LAL2SS2r+8Vh0Ws6hO*yv@bK+gn{O36IgvR4|R zA>^BqRj?RRWa?YF{k(P+rGNWZ;2^nH!aJzF$7hf5`QNX}*G3WdmxQd%`&FEu>2DTi z6INeNJfyn8SJ%cc=`I|t{q60j2Clz{9On=70{8#+w?7{+;A~d-KWcWlxR2XRo=Ln6 zt?*n0{@gMRBqKE=QQgL!-r>_ z@(N8$r4K!bbf$zFUZGl~h2;VCs?nYp#H+H;Ipw?rLNJ&n>8rMrl@QOCfZuadX4hQ3cXM$9h9{oS-u}499RV{8snd@# z#B>d861^|A#Qq4dwA&%O4Qi8Zm<_H!1HSce?SEs3Nk$!OjkBB^{J|BJ8Q*7ISrwvs zBa^?)eo8t0_xGCf#b})s@WWhq+762c(epZBvPVPu?a!b-NG8 zy=}c*{12U}d3`D7W9VYuinL5tb4BGhcfNU+rf9RvV^u+@B^8A*z0}K_iCDC?1sm1(k(ZfNYH zOh8f#ddL|~PVC^nj6cFc1sNy`K|kh<;=;8BGssZ`aeD;RH^1|$7|eY&2sj45MjeQ^ z@J_y<(?AfDN*w00oFb8Fnlf)6ixrB@BK+I(Zig;k?so_HE=!JY`2oi>kB1@U)cS|- zY%lIo8#Y5i4Vca)Iaj`ITPV3_aLW3gnE`X>ygHX+Ls(ThfJC?I5oH6NDwzG|w0A8-(b z{@pG=2X#?YF@kNWvj1iB1<@A_9%}QL{@wWe%AA=~X)A{i_Nn=jF6hSs4$JouNKi*S zF9yN@q8z(Ls?`QmK=-v*`&3&Q&mt#!Y=<_n1SWRsaIeLtOoYBqYr0oBsy{$UBGpxB zCN5G=pNn|Md9KSCuLQ8MjwqD>Z+Ilo1il-VBvv|w|>l()yl}d zA9~Miyz^>_0g1v9U8sUP;EYZz%u`E(fUk%r?fp=D#V4udzx}dNl>{;IcZFSoM}td@ z)jB#Szn-#M%?2(pHD@Y(8BPTnn?3Gl*l#5zM&?R{8=P~rqM9H+x_Hy9`gVsNRLkcj z>F#q;L=W$%2t&&L9vT(QCv z7)U6r)1VZM7f(VEMgT_8qE38WQ}wGy=mZPDIgqumqbd=6Jgr--%t-d*@?EI~wNI`< z^r_&z-2(6+dqMnIkQeTO!+xv%3>C@~q1I7!@w@&0UJv^QOYS-j z#U@MqAU~Hx8{&p(11^jL`7pz~o(}pY7a&BU{24kJU?37-r1O~8b}f~MrHmz^1*YaY zMiI}|O45JKUj_I<+5vw1iO35@?>;K~zZm3oth;v;tu3UWd@{bRtLsY3W$F(Jnu`CP zotj&~v@1KevHWl0#pn9$;W~iYvcZ?<&0mzJJzE3}b@5I`VlfkGTV{9{F41xPDE!l= zNaj}|eO$fP_C0N+8xtT9f8H}u6EUrBschwc=f2!#tE0;}Z$1QTRYQCM&i#D%6WFj{ zR~qKZkg}6~D}T=iJ+k8&gaHddNhn$*cJIHJX;`0Dv$%EFm@uU0&^(1*xqmBfHg|S_ z#;itr1y1yukM6{#@xTv`qjPvPj!O@UNnO@HwR>9>`<$#aQuu*KNzkC`bG#VsvW{@8k z;U(^ozl}C~gXK8(KDIx1IhUd4kB8CQh)eD&0YmrkkMdPZ+paop8_YNWEq&jUXX2!p zATQwa+EvGzaJi3#1!))wu{JyVXho^6^m*0MLpH2-CrvV|# zdZlJ^?qHT{fGmc>$b=giH&0F>>~DFbhQ24?780I(pfHK@Ao$gW>a_=hJpFf~*nGM| z(4v%mZy#VIpvw)i^% zJLjd|mvf}Gy)&!OsgQ`yr|i+(^ps?}I7T4(LR5M*5ODeq9$#`@9jV1$*gpfB|8qHcSlm)pp3L>Iyuvk9Or z?X*~%@Sah=D0s?Xs?*vQ%S9lAA^IH-PUqdx87p)nHMriae`amBB(s(uy7cE8nfA~ zlhMIE|D69)L6ef}oX4=ntumlNn0WzQUq27~NnU7{+BCo+?xs|=rTM?TfG%tQfn`tT z#&s)^B>CiWzt(lf6GV&Y;(_>*2oY}P1g-bB*k2y-Xm^cMU~V=k0~5OBgiXk~>?gj5 zUzHYb5t-|IF6degjMNhk^e2#a$`irwz|v8r98p+raM_(zB-)cf{C$5V`M(eR_?&5d zxjsl*!cpI?x}7I1F8UFXt@Y=9NCeNGGT`GMn&ky4{1F+hA6q3My?3U6e&fZho-q2* z+&i{+zh*>tmSu|9%Cn7>|ExeC?!nAyH+0We-mm?UpHl1dP%ifrRd5~Vk!mIE0}G*4 zIi9jQ{H^rMdDC$dtxl`Cc9_36WEBe3^jTwOFe>o282Wd6tGwjHm{;h5!zMuB8LzTd zq8Ft68cONzhIh_^tIu~+m@tcyXiCSkXcS)d`%FW#o1H*VL$P5vA&Lp(zBi02L436@ z-cC2a;7Ydhb}h};R>CqzoL5D9Eu@0+a|WNjV}h0LrSiz*YprbS2@F|TLuuPDc;E38 zREUbf0oe+dA~BSX%uuw4>-g(=)tS)6It;t^*xR@0?wYdf5W zeeHPec`N98SB?+y-hIRyJ!Aued2+sT2mkM9a*V%L?xrRc`JeAEEW&R5ppS|>dH}Qb zuE#M=zOyIk+qC@{<)l~JJj5gQO3yE5c_X0c&Q5E0sBAq@zvZ?os~*SKKBw8JW}do( zT!e<+yz0j&BR$oQdZRFOC$QsSkaHbTu3T4v{u>hQrK7sgO=g zDVgO(S{K`~JFo4k34q(&;h3D!@30q^DR-Y<^)$S#ZQXFNzKZ|qj;ln_;5(x9`e?E=Zn*|RSsFx1=$X>`S3(y=#ne2%*Vyg>40Ld7p6s#@KlhcdYnk#ub}XU6Gr2A~p2k+pl21Tl4>L#Cf`CeEqqo zLA>a(96}f;Sb7s>Pood-3{EElme# zf)MS)juw0(+O(+EDOCB^Prvo3-^Ne#I_tE>@|@CC(wZjkTS7b~9!>BYezoEwzR}T5 z3}Y}Kd=2=an#RjrHsXK=ax|tCLnR-kwKvNV8gcnru4>%V`J`BUsK1pdc9LEj6<0k! zH77GryeLi-nPqEuBRq%NXcm zmW|6&cxKULi=j;z{EYjm*PWx5JUNhC*{bwmFKU9DyBi`d7l@RLf)rj^H|(r-5pFHi z)HsT6tkZ0CMqDnlVD}BG7Ey=po8fsrbClkHGmya()P4bz26Vt1v>(TpEbh%-oHo#v z6%4PWt|39ZkV=IjYTu0uD-Y$D-Y;;C?IY-bgYq0}GRJ0dbo+nM#N~vG-877p)7O$- zkLMPO9ZgS~wVb;mA`wUH3r>a2Jr84zT8Sd{qsr-SPiCQ$g8sR_Nq3gqNzQ#{v5%U< z2|Sy-12)&g%$p9o+Kd(!X;EbAHELBm7TUwu>aWc&I3wZ)$7J=^f?K{Y97vu>8`ZsV z4;b% zf_|qpFWP}9fOO?M7NBFT8`z|tva&?IGg_=50?e3HQ5RJU(_>YX$nrMWet}}QD0AtI z-Skw5;+6np_2nGXXR?ho3IwasA10HP1TTt?CI$R=k5-#hT!;AQ1;UCu6}2Gllg$$k z6J@Bk>>?h@K=m|}$Su3*r+mgDjQ^P~feq3eB<%bd#{c8e)3q+Z!NVy8 z(UBz8%%KF=(ci1=3oFNUMqe{Gh#YD#70Tl#U&&+qySvMhEOygl}&Eas0;`rE1FO6ai^)@{zC0CnC`yke}ljUk> zwMCbVWH;w{%}m|V*v9jma3Ru@R@O`foOqt?@`fOO9e-{(t&Ih>ki z%lv8U(o~j!S-)RKEkCO#O0|P9_Vw2~72=Av4c6G_Jy(wb#4DK*3co*ka{O9fvPa^p=Q_Tdc^%R{_^KqR%pysrlVg!`BL9 z8zS?ECUxc6S)?+3Ce`efCVb7loSiqCks4Wy(p;H%2=(id&(H88SKna{dEM*N!Eb;r z#Se@T%oOYd^(#~ZL5ZaykhGXL2<&_T;%``0&A!Wm5M_BlQ)Al#LhZuRlBK9-=#+PBDMJ0lIb9O`mn{RY&_9LetE);ym7ZiIGpV1%l7P3&P7Z!EWRno(( zEeQCm0bF47RRkeltdia$d^2pjX?c$lVbTuzzgmXf<__Ebn7-jkESk91S5ohLjRfwy z1L`T9`adl5Ipr8yQTx=vq6A>>JJEt>eQj7;<*Jwgfk?@x_MPmzio`*X&mk`Qj% z?_amr-1yUCKpesqR|yl&Bs+wbY)ii3Z_)IeBYvP>y%jz>7`8V5g5UjN5nRQ2GB3E& zThqY+uuxh|Ly#pl-TiV?#<>u0SWY)T30IoX`)veYnS}d%L9Cc~|shzfj6ULEKJa{9U z5Lp=(VNY6NkgW2m4s+F-z|^$d8b2oEBUB8jqJYZWl{xq0#DXBZZ!S7Y+OL(kbOgBZ z#|?)7##`?}g6%c%K*)=qHdeWwyU{hBKYnm)hAbfF$4+ycpOIO?);s=M5^B9ivPz)c z3K9O0t$3+9iWW1>JGoY5GNesK*IPf4+>e`=+k?Zdny{!A={}T?XsMOq6%eZxSs@|_FB+ydK;h%@w zTJ~X?QPe_VkIyFJ8vdt@r>hiIxoZg6bg$h_LuUoCA2%d0gM!FrH)42AShC#Fz9zELh-a~Zk<&Vl9q#@ z-*BPZlS7pZtF;$HSDG-HivB4kzY-XVhZ2R8e*6yo<`;FWCZgL{!ilF+9rcU(M;jke zV%Qr2OWMXbEvEL0Gi#lEKmLzR)uzhK8`d@u94;Ukk00|GM?t5U|KNh9D+2m&PkhXS zX?pJV$$5^7ltSkvVqVjE;Zj!t>6Ux1=@OaSuCn0t!61^7*E~YjB*RO93^+oFJJ5=KTo`f()pZ@>fNnuIU zw@3w?pHjzfxB!u(9x{5A()R>Q8%<-PNmB3-UQAc0JH~E)wNzBCecg`S;Fs+pHKQPw zO#b{s{J#3YJ#OQ#Ql*FTiJx#fXmO1$M6p}u+;d3=T6W?f&&6h7%oKX*Wc|VKB~kyu zi>(=}Ntfma+rts2G}Re_mY7*X`hQ!p+$iewcI>j>mp>sb|CKciU=YN%D6Cf14cgq> zE>W&hDFPN1r-l3^%~y}SY{CJ}6xtT-nCJaP{g|G+9PA@iK@% zYE?~-(G|@xy$8K5Tf1zo^+m#}zJz2rU`aEwH@hz}CzdY7e;0uiCs2Q<`}&%2S4nO; zLqbYM<#m`Ci-2l(Sh?`KNACa1Fe@d%<^vC&1TG~LC8w;> z*{;u!IwguJqhhzoAoLI8d$cO$xD?R&sO5|sWM+FUZ9zG#YJI@f(Q=Jp(%U$?D~$>**UUrn*){!2#1Lt;1N`fsf zi#$rER{85dEuNKOU#SUlM}ln(#^6rV1Y?sXOpSHU#?rwFm7|~X*oPnULJrDfaGN4u z*eL$D7hs!Sp3T-qiCd)EHdnVn@N}KzSHH?{dB|k4DmNu*cMyv?;Jw5=S+OBJx`yEE z+O=d}Ium5}*3_m+taXOFPhU(g>+sqgKS@wp)kfAW|7hP$*sJlZ3|sb$18b2+RZb&> zfCxu}irLiMk{|uqrW;hC!Y>#p;_sM=dPa6i@0>A;g>!tGpIF#XTKRxE{-C`I)vw6k>4Rl~X!I<_O?Gw?!{r6cp9$G%50`;cN=0 zstvZ`drf?)*R20dDOUv_2}|Y?!xk%u78YRw_$iC_U#w5hNq!gyhCMI8Y01Y~>5}C} zf+aHM2L52TnGRk|o?-gLE0&)g-A0pC(R9$=!sa73hS3lEZi$3K#{Z(!sF3A@vs3F7U1HnVVL%S0D z=2v4dCkfZUIQ6MOqjZU%6(+J%IOiZ#!tUi=!a1 zWEBj{A0#0&`KVLwro>5NtY#lRXxEI1`Hx}i*Sc|g4HGP3)NSJDM-ier$<|+2OYAi! z5o{zsO0rLCl3Ti??}yixLN{rrGyD{?e7aT$t4Ds;D+Ab8%tzU`4YOg}J{tvhghVIP;c@4J>EY z0;`>;@6)K^=ji5mg;v$?)Z*ODrV#bsC1^UjS0yJDQ$~H~*ktmw#*m4@b{*f8g9Hu# zL3N)Qd@Qe^SVv2-O(P8wlU2E98bnm51G)V@`7tQG7SzRAi)`KnZRN^4oM_==~|2$!{HJIvm3r68;Wf@WyY*NHky_DyeNBMkL1 zR+t+@;xvIe>FtdOJ}*Z39?bElVL&BTrT)Li^+nnAL~rf=R@OuW>rBaLSGzXcuvIyC>+#F){EmTpHl3n;pL0-G@ zt#S!Y_YA6j*Ycw`n?4j7dt8=#aARTZ`s5HgOFT`kveqr*QOKIEhkkPhUo2{dh=oMC zNsA-l8c~uOv3?Wnk8@A@mJihbOBSzR|x%`ba-IeF!Q*&J4R-IY$g3k zOKrq#<-V*H6kcFXGW z*DcRw+(zsF^NOxr^Vki_t7YIeCR0WBp^n|st|5isW77liR*pDggR1$wByuP#I2`b+ z?{#w}LrfiWl&na2LH1OPpDh+u_RLtjIAEW4oy-!7M(_}Dk55>yf7?f>ih57%lScN!|~YO}c3()5En4n-5S^H!_Lc#C}Qs(Od; zpBf%o@ux`~(kSVpbU~shn-rB9;?A$ZfpLO}_ydRqGq;B0wV~#?hStHF>2Wf;pqM%e=+h3(Q8FT*y`SEIIzD zW=zJ^Ii~XD?K@;c?|j3=+L^{{dQIEZcRX!h@=0|x<+s*eFno1`NS8~qv^~eDOfus# zdM`Ytz@mxNb#rVArd`D%lv%705MHGQnu(Mke6Hzo#BV*EI)MMwqY}{9N5%BfZ z7_K==hx5Mn>B?c|{EN8HE=%z{)+*62hAY=&?QEkb59RtEbHt!F=R`BJ(-$rM``AqP z)p`B>@YSc4L>X8c6juw|^Bge(k2P!52imP^yCRWTO3~X|$>xzMGk) z=AF5WQu&ZfoqZHl~G)aLv%Y6R6lx*bBd zGbO<{0leS%;}`uEWwyHg#ePzMUG2Gg1@qOUq5ccBotYowdk=G}^Pn<@-}lm%qN}{>)+V-JMM1Zn!!MO8=jhvo$KlNzkqMX81eu)hVBMwO0mGtI6)#SElI9oxV zgkeLtw7y#nl>w1DAg2H}L3+-p(1oh?v))n3a>K%0qmS)>sq~>IEDEpb_+!fOfe{6W4_WRccIald1IzQ~glbV4fbN1xPS!Adsz)=^yzm-}|gfnx(IMBP6S<)cR-_ zQRW;nl%tDmjddB#ntJ^(ak}8LYD!*Lz3w)k^@F-g(vXiYeA_F^+cd|?8d>lM;$#YU z5_a&e)>#E2ud(y0i7UF;pNDD_Ep(P=`3655K6P#As!LVamgRKFSgh#}17F5%i#XM9kklF z28(||P?R@46_SD~Sb@K^6(N_L& zI5CUexmiO_<+a5KXob5dQ~K`^mU}l}Sx-DP*X_}QeB3m()tcKc$f?&H4#OTEw$~pI zcFN|ZEjnC=)aG+Tajy=lW^tGyFpc)(xnh9ZTq0|^0jIFdzf7gVKJ3c{IStqIDS0Zt zr`S+x;LheySB>&d8x1r~-|fEakNW#@$IqKn_a2&JI#*g~@V*L8facoW?lI>ROdyLD zTJCzN}?Usf{ zJ;H{)>~Aq>QYuQ{>tu%4hVPmV4MtidbunSs+%+<X_a4_BwDmDOf+R*-@KG6nBC+^IHykADxOqeT z0=oCmIIg@)27xUm$t|)PXjf8>8uqxhgb#mHzyD3%#9TO8MPyxVMH7rns*)q|Yg$Xj z4?>(F`R6_;uK<=1uE@jM&W%X7(%sG4k+I7IGY(%(@NJ?GG@zHVng57zln|5yl%hZM zp4mYEy=)a?b^Q=)xZ$TS$WC#hM|WN}r;ca%t5Wuk*f?%9E?)mT(kNjjKD(*RaYJ^+ zDP`DND|YM{n)+`^a?P%~=lvJ4r;#*kT{&D&9T0jyjV%_hq>S39(#m*?uIED+i>KLm zO!3;vj*A{l&ZnGvD}w|tmEbhurSCP-Uy@^ux*U&I%~TnQmfqGy;b;XwtNkl&uhlHZ zAe(p4!*dt$DH^#7Lusb~Gj0D=`a$X3RhN%O{kH>OC$?D+d0dh+seo6^Ia2OrU_3WE zNozZ52i+1^K+4QHRaPU2UHZ1r}wE;r?cV+F~C7Za-rMnbW(ZKmdwed>Z-04{Gb zftz_pGkKiZyxR%Ni(-+a*&REP#nJvIbGFlmLt^ugWFd#D4z6qbeP3hiWAWy9Q`^(6X{FBSjpCk6=~v_-yogc2NvKoykS*)HX*ofRI&(R&vu zk8s*Kf^D0Y)jkm6feP1^@bP-Mm-iMipa1bi-HL7e^u9>t$uymg5}D$hxS- z$I*B0t7J_n_J0C{6sPUR#m?UAJSZfVIo&4Pi(cJug4e}B13uv&g4LR} zw@RrW$8zQE!Pl)9L#_TVXZTvw?Hw_TWyQ%SEtl@}EY8yd`sApQ~eAVpQl~-A1QV1qwH8CP!o5Dbv{)2;)wOvILzA#ARc2^SMOuS(-Nfv z_;?*i?9fpQ{;|sja~Ub^h`8m#QYXGGCAojT*sAo<6=K+d(uV&jH0`kYwx1GoL%2xx z>7&W0^cl$w9RWg>_ZLl%UnnPC6&jd9OowsVWbNESq0CnOO|<(Qe+x3UB#N49G7~dt zhLs#Ezc5XMh$mgvvbE`FI!7ULEAfp+k4Czx3YY)iUO-)R$n3@QGBXRxAhpicF*A?@z6TJ-BTzt{1TvNk26FkDA754B*Cr7@WWpaH#wi z-G+jz%Ub*6S$22kaKf`WGGFGL9J*CRB8Uu{T_znL+GKi)Jh9yU$@H+^G0f$lg}Ek3 z8bxAquOJxMe{#^xcqsK83ovL4x8pf}=5x1mz4{3ep-yB8-7rn)bDh{syX2fXWr@dh zjEQn8c;YPLEgoFvBmrBNE3qTWy>pTcm)s?C1KrpiXukDNsbV9P$Dkdg?2KQd%Peq zahrDLJy0oRGOu_flVUY3_HO48BKEw)`$h5uyg4X|u1hIlQMy5Szqj-Ys^+b%=%^irT`!sJs1B}CFf82h+InFj^^F-p%?d!akJ=Q zxS@EB)^X}kveKz`Xwuz|UGZ$4g=X#*^W2z$_C4ni#hlGf=OcCNOQ$>z8)s4}>!=d= z{`rxr^|VuFqF9;wvQncB=n5_FLIeliu0H;qXPly1fB?l3#Qkvf=JXQOwi{#PU3p#gvidl3vI-oGC3f(C?&v@W zEl!supO63Wo_xi|(eoPHM-Yf;L3+L$Q8I~93eU6kfMSl$9V%(oF1O)vG`$A_7w`73 z&72}0_8qVvnvv~0n{T0Ah-WAAp!>2b^Ey!s9@O1AvJzkU zNqH$jD`yd>Mld0aR!!}vfm>6Ns)=5Q`7+wS%%6oJp=gHMkIRz=6bN+a=GqoDEF|Gy z;Zzbk+FyYF&Uch5)|$qkX>&cSLR-1Wdgrmq+Qz5`Ul)S}vxl?qAP1WTEg!Ytzv=h` zYRZN>g#wHE9`aez7coUdCbLKl_3j%v4PJ8n>(a^808S%D_WYffPx5ZzBP+kL^XZkZ zHMKfWUnU40bziv-1@E^|hT7qX`V<#ud26owE?NMzyCz~~@v8)lN3J0z9Q?ElgBIfn zlk<&Idw-5sEfn(<9TM;E@<)63#oQw(pUv*MG2M~nsh zpg&$sdL)cl4d8W1I{eRFb+^_9@M|cU!h`b3ebq^%K@QEuY%tQUv>NGky)cCojt?a% zcg(bCi;{RaiE)J*D%ZEcc)LgAh;?)Pl$@~DLq_7124#|gR8$&}WT%K76{$>;?e~$* zcblZx^06svwF6--a@QcQQ+*RsAL3Nz&!FD3%D%Bu;f!c@#$GXwfj?VssnjF4^hp)} zYz=p}cGjs&@Odo>nX44_*YV!6rFE^NLb5MvnZ>}ihxmk*52R}5V?3bg!WQTloFm1_ zIWb@cVwVebD8L-O^`+`MZzvx5XQUU3aX}DvT}N(3eOpV2)yA}ipAKyDifk*x0y8;ZI%!i!5bpY_o9`ebrPPBpK8r8 zWL|gAtW|2s{VgyJXcReeP&eYUj*_-Tg zoq?5&bl<*2DT(Y)UMKB#Qo}DxS(5=#8QJ2%p&A#Ok2Ti*8;{LX`xE!|%=46|FPDJK z-U!atf`71V#rfNl%hJhd_I1Nja^_n$IeX=F;NOZu5NETt^jD#*t_x}hvAd_q(|m27 z<4Gmag9UPVhuT$+j*&@E?RQV3S`NYoy)J9TW&-z%+c+(UkGFO8jlfRt*O{KGjRRlQ z0FHmLN3#u<+U-VaEwZn!cGnS$IoZ~Ms`k3p|FT%E?9=UiKC;g~w(#>}X-B#4>B~_4 zLC#C%xgXku_g3j{$V?saY313%(DNyBR*Ts*OLh9o^|(Lyc;f|LESz}?_jm2aR~AF& zX|}}#qebquZ6UDqQT~@nrbpWCE=7TR1uyuSL4h}Bb{XA=4*-3-AZJ8CB-UU;h( z-fcG`N$8DMSKBk98P-+TBwXAFLb~G;%`bSsOWnw#>oF483pqj2!`)r6l2`7XL5!38 z3>>poqe!j!M0vm`jXlJMR6d)9n+WoeY0yP#86Dlkp>UB?_kY{P!mx>a5`A?9dm?H3 z;=Ev31lbkQ(?d-38d0}xJH1LrpK2mb#%0T5>*8M?mz#;O@@NwOzc#0>49ih56hM7E(#2 zyynFmkJ0V>I!+19yz|it2w#K8^nRo|ITJ@_!7?}axvdZT*(?J$@yGgf_{86DLTz-FuK1NP_dpf)vI=hp`l`7DW48qE~8?Ut)%ILdLlL^TX47 z0r5FF77fN45T_v9p55pB9t4Ah)_255TQU(X8thW6i{tggxDW1n$XyO|Ow<%_oQrsw zs9$T{W=Bir*B1%(-P@im%WhsetyvOSt9iSFIybp!Bom{*RHW6a4!92XeR&=YH8AXq z$frv#Qdp1vt5tsE?d`8{zj)gThNGe#>rr6<%Y=760N2I$6D`t2pAMb{PQZ}qbPA(BVq8T?;#4Ou}vyTqHbKM zjM>Dd_hhEHHV8{w8S<&AV$M=Mn#W?jKal>=>B`?DLrAPdWzU;EvvXCw#q6jFvROGP zdXDn0&R+d%YfKqgYTi^4Fr5RU=;UhG0Us*_iJ6#LU;JuX^9xC4@Zz#5KFrEGwwUnt zzL%)Jkm>Szo!RuS3V6)_VlVb{I-0i#Sl67{v5mN67~f`rcRpMOPT~@aE}_PB zv;?c$Wi1b{z%#Me%YcRdH~igI+__jzC|NH-w`?tWTlJCK8rj_gLbRL_IAg9{DwyUf1AZ7R< z5Pu<;5E~oEjzILmC!c|ch8n(?jNye=Rr_#A<{K@|#f|7eBj<^9!Dw4<|Y7sw-X-*&1uw>ss4*~T*wruT2`&PN0(0c0uw|w=uHyAEtRKbd?O1J%b80~?RQ?yFcUzVnM^sDD-DHe(dqH?Ntc ze1uoInoF6=^M-WUsGTKC&tT3pHG04M=27Z{BMMj2yI))2`&65QBMM zFAoG|1%4^i&VF3$0_b(3sXw1?IwXa$Hx&mW+mZ$upmvNeqT?fy29iXZat`{r<T((_>6joj~iB!pNKr=!l^)KZXS+fgB* z_(Q<2G~01`qB#<$y0k>ppO3D^-AMB7`IeC;a{I~CXWtSdFGoVwqKA+8t^2-bK{WYm zfmFP0i3K5^x}!IpRko_yj2a~Of@4u#+jDBCQ@Si1@J?^7f#a|OIj?U+y_m!twVMY= z6+vo-L!8$wt3e`4VjPrL3ua6CAP79z!a@7a^Q_#%N%#?{j$!kW-l>~@hs&70_s96vH*6bCCsj!%ZwI0BsQ>Zj z)$ENS5i)f}P?3TypNkJ>E^i615@h-e{D%dy*w05C^i-)%g%zjs?uTXzcjXI{KAXXP zafGfOl(YRT=BK5JU;5&H<1A@K%(#aujK+iD3f1HOepUVDBcA}5=XU2E9yQhbonFg? z<$MON_oyIh_k+&b%46Wxp=(bvk;dJG{By1_kLH!@^b>y4Q3UJDeR%uWz1*YlcS4O!?qYDKxebg@_vFEkodGr(1C;Hy3=6Xzl4Lu?O$?d31`{D40T~; zZQDM6EYbGO|XeXYtyIShh zC3%GFZ95F`F`-Zj@J=9amqsQ_!O3$nmFH;~F4hzvBQm zaH6X{bf3a!D(-Uf>1O08v<}zr^dlO3$3~<><;)eLWrupyeesu`_UE>D6b!6$eYW6# zHB@ged|Z7xEvH5)=X~%86QVJjKXzZvZEjX|+uxhabOP<2cPA#Vd!JEvG@}f`G~%w- zka0Ti=Xg)hVbFWlNwDeT_RC4ee|O~zhidhPqorLw7s#+iX8TDCpBrI_>H&Zj90Mi)jNF0sU6v?_l&#@7$oU5gNb!{e+L`}eN0 zKMx!Kw&5N3p$oyPx3%0}nT%GB{#Y&;S-H%5>VbJtFB+j;dN`2!8=Phy-w0DR~yBS?AMIb8I!DR8X0Llp~dvL*#qp(vbvb1N!5~Wa5xwcq-`FB2cbLS!7ro&d`b0_V2J_0U zqM|UzhbwFm(Klik_l|e4?PyxYXv8EB#B&`V3TXR%`8MZ>-5%bL!1t`2QjobJ+JTg? z3Hee;6wn{yXWSFdtF*d_ERtbke{>&umt`x_ZCmH^2M*ftH(m6*bwaPV`Qr3nkn3Tr zYIB85skNuEKy4#FR#_k~jDca^vb2^ogdg`;Zn3%~p{N{ALQx1gpFSnsx|C^|RaV$6 z(`;1uv-RJ7YuLYdr?63Mjp<+#mwB-$x7&n{sB6{f3Ni|z-L8;~BRL}miV)MUV}5+i zY;-*p1j&oy!K{I{Hb{>T-p}S+FCp4lP7<-v*Nb5tr_9LBOYY2JiLk8gn*RarJ0XOv z3|fk<5)X*XW{uJ8A}F9Ee_eLF%OZ&G$m93{OY$AbMqe z$0;RZb$<%?Lwv)r0LYR z0ppi4#P9H<$f>!dIQ+pMe)q|2zI4doE?I`UqMF)yy6?p%UDZG>y5sB$L;)UcFN+`s zJe}Lgab25uo)67SfB#I+;R*Ge#?rOE=rAFCFW$^iW1$?d z%Qd!Of0jMB?Js!I3diqq>1{f^tgdmUpVG+;e`uFcgpxpOH}r$TpC7^F+5V@!^rxcE zlQS3=nXZSj^_-mDj1^$J@N zAPrd85~#D7|NGgDR_*zwQ~t%h`u9y46%Vu^y_#k6xu)O&x2L7|*7vBvUvw*{gG2o8 z=@C))v%W+{!?!zb%KXGOW*z}u%IHMdwfm(48p-aW=ga==INbNM{v9Cz=N*G~O=2A3 zmo=B$b2g^%+boxBS!y9`hiy7{CUnn-OBp?`%Rm`#a_*~p`L3>iJ=xjMf7dfETTP-D z5fwu*8l^;#7iq=N$dU0TSRI6(_=dvqZDu26O`g@e>i*xYwyZ`+>Vt)r-osqR@0;g3 zzq`--@W<9u`9&SR3Kip!{1;MQ^OaNE;c`P#1AyiJE0(xU=XniVn=w_Hry5hf_)4u> zU6~y***}$)Lbfv20Z?xXaJbd~N7X+DN7{yK+i+~#wr$(CZQIVow#|uc+qNclGU3E; z-|P9-s`{><{iCb8>(q6e$G&ZaIN&w%>h!U2wYrJ`*7WTcPhYz`Tifft$&Qw_=N=Q5 zUjE#N67}_D)%eiMV5E_l5TzA*Rti_cRC4}cQ4)OUaHuGM;V%i5Rw_LU{=2|3B#*<+7u^_FJnrq1MBumFE#>KOK*M1mj%1M#6l6|6V{sK$|uDcDLsr z;hX)GOF-m7S7tig1b!_Lgo2lzD3e4@@FLx`hHs5EM#8QDZF$&2+4%RV6TdjZb}gzX ziJdXjP8~A~aVk^=#HpJyM_h4vtCtTY^W>g0DTRz96L=;F&eqZq^Wb4;+|v!)oYOCp zS+Y4R>facRg$8-WNd&3-4Qj(y>SoARw&EMzZi=`%wx+g0{N9a(g?*nvRk#~CRurv^ zVK^T)*0zlt4ylBRv)~4E-nhGFrnV&w>~oxYrXO(uLIRqCvcYqG3?)L5Stxsb60Evg zeNUjk{Om2t@00#p*>!76DaT`*WbLB@{>P|v@Y%PEaUeyz&t+LF3AHB|MRfe&ztQ&v z-iKucn*TZO-`NTNXpzqgu%kFcu#NR*n9lrrGuS0vMdhR8flE9Fo;O8B_oBBiX8^X!@ps}XA5BDV`kVJLVBPX zabdIm&y%o;^D6aIu>>PX1^f$-LE+3b>-OywImS30hd+=df>sa)DVW0tBN-q3sU()r z2n0TXOAbjPQs($a99E2(pnVksaA?8ybJw3+OD-P@_>FKZRYZv#K*U<=L{T6+*UDDk zs#(K8R$5PXy0JE6tjh!wYln6HRsZ^`l%)k26bXMCO}%zHOym}~r6&_W+_^aC4%>`O z(2R}=G-^JN@1^bnNkcHIgEUFuLatHb3Eu3O0MNj?b>f|G5<;*kR1<owJEILUiM3X!)QCZq{7b6 z%*@M5%Q0hNVPQfE5iZ3%?1;l#RoE^YR1U0%gq$sy#GY*jKsclcPTN#(?FjPE4Ul;q zQuuG?*L_l8v^GvAin)YRm&5=tptBc}1t{urSu7HYU9Q$pXH@IELcm|JDKkIM+1aTIs0s;wy1p{b-$Y z%aDzY?iDvWdF=9Rk3g;^tnDOQSR9p&NVw~=@SpF=Rte2B0y8!)k=is zcsDZY)yIq8*>?_RYhVsrlUe8Dr2{j zP%v?yVP(Gd76o_wo98RLXJt&Ke5L-owEnk%AwJ410Mr@hF|#TU=ZJ;lbD_@8vJ*lu z0>3nGd~3+s+y-G%S3>zALJN>8$RoKvpLFkGOl3B%dfHcyR5P2(`50!6DO0f&-}e<4 zn~L3OThS_=?Dx_qKkWZWO3qFKFb~_sS&Db)h3{NFR2r5n5^%HlohM6QsUe;%YUzJC}7gHf&I~w7+ev4 z##L?!%>L$%MU_!6&?K?6yeW=h$ft8!D9`&_df|-sLO=2UtP6i@crJ3*`RDq|tHVURU?&?NH^BmC~$o90{I-h!y4R}0MgHct2&5QwPd$Af2 zgrNWA3)F&0oA}~jGFxH-8HrvgwcaT7n}egJ7Gs>3XI`7soAE8Y9zN**>_POWHU-G- z_wO@wqzKIq%rQ6fuJTWuhSn+r(1?^>+7c3~(*i_T(O2U^!b*Usy-a#*Td`X~Gpf|C zQ9yKM-+)Oi5M1P3Oru-aRf45~JX{>G!094}uSKp)+*2pKUs)GakJ*Z_I6VLdCGMw( z-@{js)U^KlCAqcA-O57Z0YrG<#|*(3ASsyvn{mVyf}Pr6Gl|)y1tSs?Vx**`E87=X zhsZcC*->~CTROuS5Ke%~J@kftUqXq}dyxxoD@pi^c(Ue;fk#qI3rkX-3X=EcMV-pj z8eFrE8#BZI1`T=!!8t#+jrcW~jdH13;ViBt98oHo&J=2#Kyzd<$h}GgywJPfA@}ky zGQU>jB{`{rp}UT|Lb#r9TV^@`g8As7In7AR}6Und*h%&t%4jH_u7?(CiKIlWW zJFHFn9{7(EqM8moiwNnhY<#eRO!}AnQh|QBYko^xfQrMES^5G~#tI~cI9z>g&Ck^& zHb!wt8O^kYaH{Us4KYI6Xp#HMZNY`x7?1=g@^+eCZ>92wNzTJj@;k(eVXh0ZL^hed zF|lL5rPsx%uff;pj;G>=B%1QlY50062^!x72n*PsT!|Rdn_Mx76~#bYo&+~h$3b*a z9l|g9rNh*j3L$bx5g_RhHshk9m)S>}d^^3xC!`cXgCAjYj(T>HW&Z%6?zR69>i)(~ zQ$4@@ZQDT5xx+Uk7w+nNe;YvZb{ko5N{TzB_qq(2Ekl{VP2|Y3Pnp_c-A6JnDl2hV zf6mI42t-p!v6bN(Vxx%R>)2m&?BYJR2u)@FxpnRi!(1M0UrZbY$#$?K*`pF6bjlY2 zs>zL!p4@V11)(J-wS@u(g2Xb`<+XKW5u$i2o`E#$swjF(TxGJ=<*k`Czod;9cvDpe zd?G;8$J@$_c}mxLq_?50NS{E%SHJ)oidYU9+|7*?+v9X#&isl2w5e(F3hEY^p?|cl zdnt)l@+;E5C^9Et)V8)T*9uNRH!<5=0nyt&Wz&^8aoL;eRD~!yXf_rT$X*^sA7U8SKbYDB&cwNl$(|dpzt(vI#XiYljV*>1pmWbwrqbk=Hv3d0IXT51zm_ zT>ji6QrdJDz0%IM$x8OryC<#SQ+~d(~M|U`d|syJyih@ z*(n)xI{vAnHDSlCW?6dWp_*d?O=^eGBo1nxMG`3c2w<0*zdNYy zOe>*xq78Pf zK$>Z)v$AK_=YAf{bHjjZ!BqLOwJD5e1xSBGj+_0Y0?$7@FXz>4ICvU!6=f-MZacS zkmw*e1M>;ZHxkdGbX*=uefSNt2CkiZA#7kx$#l3(fuddvT6cP@?sn+Ue;%t>a6`l(^|57;OJpboK$vuQDw4{Q3fSo;qkxfboqNf#o2?X;T1#wX&;)LBo|FX#3<)R6f!S zQI+5^th2P{E5cNB6=;Ge?Syc3oa-pvx8YK`#iqH_k@aR7moD{Jq*0GemB%GDw=Q1i zy6OHu@5uuob7=+C8izH4W$HO-re;d0t|S~EwcWq2C5iUCpd>|!XqqTVGbES{dpL5E z7;9xX5(&cjz9#XK%nL@7<2^aICpp)QD>o8uns-fZ0*5hl;YxgQg6J@*| zTTyuGBqK|qO2Qj_)R8R+Hf_l=nOjd-K$AScgI{HVH|+x7;`eG^2-uq*a{C~I&Pm#F zX~EcY3DBe;>N;;57hk!>Vui4a@H#FRq##!hP1zC=}`|(&dJlTbbwhn~gDQs+2%KWe1 z)=_AZ9_NT0Lrz7zb&sN9!oc%RS=9&AFv})@W@ZotjT4B;A|z%wJG|HsrFpcR#st84 zq#%^`0-Ws-NbYB%dQfB&GF7@dFeb4umjISvY~425WwJYbh1T?e^uN}@;5&1dDu9^= zwzI|+ORo!+jcpS$@IG(HhwXGvIhL-yFf3i;t1v*9Hq?|Lf*Q^Bj?*HvAu_cVVqVe0 zzRwE*@GQk0pxYmC5 zOUfEV4P7S3Qi>FVHL$fVX}J6QJsC7Y#r2%Cf!Lffs!f?7jIL|~)CwOAl~HGFH<9hC zpb}CMVQNNzgvSb9x5;7H-=lHB9?9Ee%yhp>?_QO@-8ZZw6^&!RzaTlggy~U1L@9-B z*v4EU#M-WmjyKy@`p5+ZUegju&!86%{T7F^oS9lmc!y@^w~`+q^0vvs5y=l@g;c#_ z_`ed16L_jkBB9|v-VtmgFyj+Pvy)qCF{T7n1M(t<#3ib#yl>JQv9V|`YnO=@uc zQ8-O%M4@9Fm>YSqd#GhDu5nEz^WSWFpYI;i#pa8{(U*^?9ukK=Ta1$#05nX zk^Z`|ukU;0y9{1BS?y9cih@PCwZy`9M38P0B|**p!PHKa;BBG(O1mCK=`M7P$qz7Q zXJ+u3Lc*21(mYllONe3Q|3p$;$yE+-n$((O?}-#IGFJ03MX%W0Ws-P2&;Ol!IdahH zetY{dT4L_R@gRdl8N;QJ>3(qIh`ixNyJ_iTVM`kbG?#r8?Kd~%QIl|8ZtVVd;iA{%qNI}_KJF-q2>Cf691A2g{Fvs z1LngR?2(aZ!(0f-Dn_OQ#Zy(eQwEJt&7@MIn6gG)wV`+;X(7Rde?h^_6mn#X`Hg@L z!Hsv0Ayu$LqCsxqWA7SLO7V|pj7ViywEENc&f-sXq38y;MyUy&bIx(G@^Ur%AR|sF zz)G+3j;&jQ(T3p^Rc65hR}+8DP%y6!*66S*r&#+WZ`*+fb3I+-Nqr?fu|U%Uvqo%f z>yt8g3^4{PzCw6_=95rLxhS-O6W&IFK|*8R9&B-X18`11JMOnJ%8V)97aL|)EyjZo zIR}SIvifl7%e(wa?jpM+;x1)rlSo=WDWy11+OsZK3D&pDZDx1rO2q*WF>cBuEF^1B zyQ%)ev3i;oH2f^Mx|RK~@#+Jx`aFa=4>Q&)i;8wZpR6)pNiVzr(s&bZ1GmYf?p!u0 zB*gxAMrbE?voC6cP<28c`4H$wL2>XN5rH&meG{3oAemHEJH!;)`;Nv!(`G%8NlI== zp*F+z>3P#n@e;}$owX_G{~^9;GcpDD9$Il@SO_zny%*GXh`JJ2h+Xf=TCi zK8LsuJzT|GB$^X89|7F@J<#@o{`-^|yQ7w;714qYkK6cZ#qG=g5n6;3RoGNi6X7~1 z{IW@2I4@H|%!*@dD0Ml({ z%&t3%mR*M_n)r%krg=mE>iX0PwGaa+?=|InP?Z41LAlj+Iruw`1xAMgRxUSUK`2pt z{;V3N#3KQ_q&K+(LgYHVEEOR<$5V48L`*<%Ay|gUh3Y*9c}1 z7a{%@{LT+EO`@+qAMt0sYF|2hzOy%w0pkfDRU_(46pjG^7jLVz9f@gAH>`Ycb z<^iuA)jq>K=*QsF@vAzh5NBKRCar>qnIm*=h7p0?z-`mMg3corCvd9sgP_|Tk?toj zUf*N*e@qiEW!C{-KZJTc?+Ym}KmFa0(N}l5p3e~3JA1wJIOpZPcpJrLh=yME&TqAwac1$?8GTK87hL~gg@{pTkb`!uEEy{pQ(xTvU;55C<-gv zfwKUOtC8BY(UG#a!F@B*RAnz{Nq1h2_U(idZ|`Hj*p!2jaqGn2-Fci;qbApPD3C7W zRlnP-3St`b$4`3Y^7?X5d|Xb;Wi^4(Q2Fs+J7J*q+fMy#nN6^oNk8$DuCuzP5ob|* zxbdaoM|iiRVteOPxi~+F1^Jo|z%B7RO8ZGQ(6PSRXT8K{?V))uz4x5coUNWh?;||C zf}vc)d=$`)nf;MxvE}@A`6A!-V5{WQO{}Q5y}jNsxM^XanZlutegl?X@Qk7JBxX(F z`a=EFV|QuynzEbdZqG1Ik7DZYo6mhSsz~4?TZ>CvY{o`3hGqQtI6<={95m}TX$o*a z3^)v^`H+~1NSFR7FN7t}UTj}G^o_Q0%PLgI$AOG)C>0f4Q92{#+!Lcsg{uP5p68BF zsVTQf`mmI`eMZ|WCV?imAVEIU`+ky#>;V8c9btHNe>k?a+MAxJ#2ZtUQPB>0?_52G) zMfCYJMC>~WRH$^I{`)NXZD7^^n)X5QDB$UIw?5v_WggL;aqG6oV#Kk?54gfiJ8D-4 zEPvF=eIhw=tx395@y$)m4=mZ%aFGKIG+T0xf4bN~_>m#>ECHrK8-D371=()cb7(8n zm;45QQ6ev$;Ivn6i8^U|@tg22 zcU8;Nq`UY3@j*mmN5Jt3-fckMg4oM#0z!PUx~9w2MNU)h+C`eG(oveRj)?(5pt?@j zHZpg)Qr$0Hj<)n)K~JAxQ*tIQAc|Z#hs&`bS(vXio`11dU^H$f6CT*s%3q%E5o2Wa!e)T0`QbLls5Nx@nWx!;U68Msm`E@9dh|3brdItnslS}B>egS{w(LCH z3^X{Ymd|8&|9ZpZ`=k>dpWOuqbuhL~dx|Mlq8%33v&;}*9 zA+8s?kTQ9r)%Hj1m02netHmCc&lFxD1wlYFB8UW40Ey_W9o?nv0ZA*;!+0MzV63eL z&jf@;$08b0Bc1B1rtYgaudze$|!fZ{RFJxCl?owXXeBldax zeH<0dc3DGGhNiU(m;z4Cy8a$Q-lAn=S0|LUHk1SrAh-SWQ#!2Xlwg5L(B z8CiN>n^U%IE&t+5#5_9|Z+yaT_>J;Bw;_Hkjn_7YbJ!s8H1TI+FAFu-8HAA4c;{bx zpZE1Csxq<}WzIO4$ULF(G*Bq){UZ1V5jQqA$}t^CLn;SW)2_N{H$A% zmVewPb^6q4^m1G#x20x})0#ExA9N+OG5MJR=RI|4lw-r~ts+R|XdNeC;zS z*}msPp#8f2#z`&I%1?VTF0`mq@6C!-^#1SARdEy6y4NBtW}}xgz0b};cx}#PsQOcX zm_Wb*LLh(`TGCbyX#E#(6LXyzewp6}=>V{}uqRN=26D{5!u_S$wm#Aw&~P70(n6fn9Arg#JXLvmYB-F+{jE&s!R z?G<}E1x?uTtJsV5eI0N?ON|TTHpt=75D46rDZb&@ADc4Ip+@!HGrf>`t&FPhb9g|Y zg;eNyvCM}zb0?$cee8gewV;*QK5G%HaiDZkA}llf4PY7${9}!ys1G{?r~>NNH~5v4 zA<%zQ>evF%>S#|{!niLCD`2UzA_gV*Db9C0{E=xW$@j@n>~-jz_Q~7B1%lo~bpJ zCt#P9XC~R_sGq+bucUh?-;#qd`NoIv$b)a-#Hheu#DQOCfh?E;M##|d^lB?+J82T4MBwt|P5%m7a^#!bAtH;u zf_c1#h>U9uikfbgP2Tp~=`da+&E~hMAKG*jkWA;c6DrrHPPr@Fz?uRW@~;>o0NY&P zh&CjF;AJi9M;~0Sb#aE)t04e~JMj{sVh@4OY>8nWkj?Ko^<=FYpGmRLDCNO18?1Z> zHp_F734J;n4tNn*?@p~h%U#_jsD*nA^D|HfpjRjx&h29ytlU6e!t-bg#O>_dpI=27zQ|j@`q2!$XaA-v)~PBV>pyzT6N=RqQq~hS#eV z8o-Q%Z0dqz_K%j;3QB!;dIBO$<$*+DN&yL98_XO=hA%Nd0d?f26LxNa&LHsH(sAqW zFe3eqPYnCrw=-u;f@|6DxA#C`8YKY2~t zmiv;5-~B&taq71`r#Vunuh;QB^O+|j!Uj-Y3vyl15y@w*I`dFv1)M; zI_zh;lu2!4lRRrL{0P_CgKI1SM0vyLs0h;5AgUbyvgc?Am5B(D{Y2@GM_JZtKaw&s z#uJ0pZIhMnazRkM(A(%*+dh(IGc`lF+%Uud7~gaI!289DZ^4&7uz~2q z^ZxhV-VJb!NGb*@s*IXnq{^rm@DV|pK>bt(%F=3w!4l#qLMesZYQ;vek$*+wAdZlq zKVZd_#Dbl$*_js;Xa2V@KslDdC6q2wxYKj<%Kqo<^5Qc8*86df;Civ&u3=A3QPI;~ zT~pp&9`WsBBEf+N8y_;*g7miVLy=)FggqzlIk=uiSbAWbKmVZG-x|%EU^zjvqps+5 zDw|}HObJJkOsWN2R$Q8>ng`2wQ;y^!UU8kI9;{)i5yDu9{QLGC^~70nU5bvC^tb4C z&1a7mA4Q`QbsY6^niUS&ai-PS+#?CsY(hz=4zmG~2C&~f=`2}cfi%#o)P8pZ9x8D? z*@iVoj}#s=JPd_1vwE6yT4<%Ubg>_8B1X2-`H23Uew%BK6I*}#6Ix3NTZ6-OjV$A~ z&u|mW#~`(mvtyfgv=8MveuUs^xLxuLy?%%wlkeq6&W%~_S0rJ6GV>mb*{M=gU>o^6EYj4%Zxjcyq zzKxWDBYmIW9x^iU)(V(t;(em$iR$3%U`maNp8SjbF)>y{x0H)S*N7f_cAEzb5n!wluX5!=BYzxr zVHU{idF!{nA{@4zM_2;+d7JmReDivoyBq4NU^qNwJxi-svm*w*|D7hTS zvWBZSk}E~YS!Cj8*ihoL2?v%q0#F32@4vkHnF_%!8%$Uw@8>zvuFyM#}Z&><)LjCE}x^}Ur)cR^w#Z&9Q<8n}=$BJnv_1vO15*Yys#yh?J57eCArS>Cy{>J*Q& z3b9A(&cG0oEP+lVSbX>3X6J$M-NCP@*BjVA5Y|r?U(k?e-sJMb<_B><&M+(PPn`~C zs8xuTIf%w;B?RB*f$g`Y-QP>z{R3AuKQyy#85(?zqTUNWnb#*fp2H}22a>OM6Zt+_ zIe!kvlK*`(R=-B==;H#$FgJ%B+8*8XP2C*!;sx3e^uCWsuJMxfjJ(%X+4(?>FG$>U zp(=^|LNTUciBTC+ob4gAUx>*A9b1AGH)k-F28WoA7QE4K79kL}ZnO=W$d}%egK7|C zS&>5RI~eZ-os9~jLmbTCI(E%*STb&dEfWwz+>nLZ)9#sZ>H19aK<4E_8@H55*5C<9 z>T9tR()GwPIyG{7cO*kTmwUx*NjI% zPc5vH8lSKD-RGK)^)*2Z|$*$ zEFS7>KT)RiAx!>0-j3Ye5D`A!W~$pPCWTN%V=9V&n~u~k90#84pB;%xVWb%3o46R2 zelq>xnTO}-Rf$hsQ=PpxsKrAcmN_NVuF7eZBsJg!uT+1hjUZ|mWapFIph8JwY#Xh0 zFxo=v7RG^)Y+AJ)RezxtHUi*3FE*xpjK2msU;YVbEvCGtZ})d4G^8_W2A(V! z((9{2gYRQ$9I(gy$#iZfxa-GE09#qdR9fg3=(Sq|rsDdhtmqyWeMnQm_E*F#z77D1 z)u`lb0?9|jEa+JPvmn*&*Xsj9^StNK|;U7b29jyw4cjAv}QS&0;P*l=S{e{#Q)|KQ}XP zO|mv)^^vOC>=_jZugm-wM_3E{ULaeF`=(wk(w65o?vn)CVzCy>JK2L2L*O=^ku|(4JFw!y{XR+x^DJ zA<5#oho`Kgr=6036E=ZyloGJos|*E^ea~3I7sW0~33-#!agN)vWhv6u$Mry3EW|b zce#GnZ1FuW`a%?FdC8T&k4W$ znUv&4G_ocuHj`O(?oBxbHteS|N6is@5Ao@UO|gOz`P~pe?M`1fLewO4fR!&@svYj- zYcSy!v|W>jHoJ|+9`QaLO-`I#7o`ETc#h+IKIAsrkA1|XzEE_7ypj`XT2b8Sp?W}g zc*2Q}i*6TWLh%PPF=fo~;cefL+v(#-_uKzyGSm^z>7xzNvHz6*%LDcie-) z>5}KW1sgMv|8!NR-NF;&g$|@YhO;Bb;Okzuo@X4w<7YjNvQv{NhUfy8z+W5XiB<5j zyUY5$akoDUOXcZ zC^9ZZR{?7N3M?Gp!BdLvWeSGaU*VP<`4_6#9Um^_i++D3g3e|n7D`O8KZ9B<5T7l2 zi~zn>SPWcBq*f}{=djf{^89b^U-3EzM50uh&S z7Yq4`EUpVpg4Qf*x$uM|trP!RpC*~;7c3|O33S>R63>7!)E|zhEsi^uVnj?8`IsF_ z+Jbm$a#T=Fq@c49SDiuoUb@bou-Jg?E($;-4X34;p3e|8@C^LY;I-reCmjaJ-hNOU zd{J%kW+4kKS-O2&$a#b~s;hiF*t%!MG(z5aLQkG# zI@vH!VZAsm0OiZ2lWLcv=di&WsKp1eY918H`$?P@NG1kII;(c6K6{BYEn+&)Rrwj= zHDof`m&NUgSZtjOpVSx@Q5w0<78$z~z9cab=~v-buEnmb$Q7-Vc1@Y~YY&Z7=^ikP%(%}d5xE8USuOHv~Tb^`b6p{t5nwV!}4=Jx`UJ&wACSqGeH5d2MCL}XJH(m=jD4PAN@83%XH8{Qi0X~r>vK-7sIlz32*zAZ){ccBf86D}y`Q;7g5g(;|I z5L7YHBI5EILJ~J&7ClpuHP@#{2i1wUfNW`lON|gkLZC&^bm*s8cRv8W3MMfd!v7rU z3deoVMP+Vv(kH_zEpMOwWI;N`$9Q~TV4$!nSohYd#TF$pUcw@u=t@43nRLST<+}Ex z5$caJa1RSuCwt!_$?g#yB>AwkX&Lv&k9WD3P}Qa?wf`YPZ)5V*75Iz4+NGH|G5o47l*6mZzB@QWFk!A zVenTLi!oU6Wv z8=mmYwuq5CWMZok@NC!NqFv0IP`1Bh5mI;%#$}7$^g;U^ARDY_vwspG#h{ps*Mep& z@17mCJ9a($s4IvwpG8H;qod=gh39N%GM0iqgSZSHHh|NticB3~cL}^vP8LTBq&I2~ zyS@l+1e%=lK$NcX*3s(~4&~F)X6^C~jzaeM4r1|(p_kYr37AA&lc=EUfK((<$>aWw z`r;gO0t@e(??N*CIo$Z;EmWxmBNVj5OM!G-bGSHCVU3~>8a1X;>bHSPfUucx09rKg z$4mog`FmoFiohSp_^B~~+6qY9T^rRbyCay1&qJ<1veZ^s9(p0@nhppNbE+1Y!vlvF zsb%Z-;H||F8G1?289$E%P|cG_^aPgL2R7^eWlgLWYz1^9M?2e9to+aTSzS9 zS?+}6++Du3>{ht&H!zQpnwBpV;zEb%U_W_T9;Lo9h*=wYG%hxUn~9N;krHEM6GEY3 znu`L>BM24PzU~V_X`^Vp_As>fU0%IRAxj;yIlJmpWe^^W}4$6I;T-7hkwUp@r*XB?yEVv#q&spP=$ znZBwQIvEJd{zEy$7dWdEAkdSvMYn?A=d>1B(uPpbzInpj?*U_B`@DwzX8OZ5=r43i zuDHoF#5g8x|6253m#WD7JzEiyUr{fe?^sZxO8 z!H5uQVFItNmyTH6`4)AFQwRPu$bQkOI5@;z6w9FStaDK?h>WaHy3%?Xfr5QNU;Y|IXgnK5yx}8)LWN}TzG<`8R&4m|# z;SMiiC14t4@glW;Dv<*jVlON3&hssnF(c+a1XDh_)DEF7$Na-)&Ty6 z$*J7xl-?(DV>5TITQ?}K{qWSG1n-!L?a!Tsh|yr>O%CJzX+4S z$nq92Z3&PnKh`OprD}?kktY>$z>o(8t7)4L6z&>#ce7~$JF6) zU_8l>INouz7e1I^H@p?kwla%r=~0h?cVr$%OF9Lmhd2mPT`u`8heYkd+Q7hhOd`7x zu+Y*n5dfT{2i)JV!=qw05fwm@ucwV^eWwCiEV(Sw=+Z#3q(JO0S;`vF8mMN4NM^6- zWuKe=EQ>cz)hyH1H72_B{<30#vSPRz#ju0yKHE#A;;WJad0ZYItGwZb?EVj$3<0*D zT{tz1jOjO(yI?qt6uw2(L}zs3<$o0#z;TlmT<=AzTNOaPWV^&K6-aU7VQJSFrEjR9 zNRmp`Ad6284frE0{m2udF+i%GoRxoj^+dbGCqy<0roRyqcI;MolsYP=l@U~J)rnhp zmA?R6{ObN3jWXXDLc!fwBj-6n3w_)+8;X{s(K8A-l?(_W?!IG{q18u)FWf51ZBq=E zR4J;`EP&~gu7pp4*_L18e6DegP0$_z8rdbw%P@eE#EvMS;7Nn56Kxkcb>CELfIoja zZWF~m%9v(-!S<@@XhN$`uZ`{8sx9OntTGY=;(SN93eS^Pc-h_yas5{hXs0Cbctda` zmAZ*1jQyLzaXj&yqmZDM6XpcNmIti$C`|5x9;D}S{TmIHy~?sh(2qjKVS_HQ(9HAU_SA;$WI8mUOeL>u zp8V6B{}co3!=C4bq)+hr1gdloU`HrCEoH;$KwyWq`vp$ z9iE34bA-rqE$*r`*e1sfzmqRWh2_OS3C3Gp7zFRtW~)4vSb9$M4s(#NKti#I5tQW3 z|NMJ6>yH#L=$kOwI=L4NaMkz`wtW7X#i{qB!*E=txyt;EU8@Z$TLIrH>7Z4rC5!Bh z;dx);E?@+M7c2)J=w}3i)djQO7hus>UG9htBtC%E#tykcYmq7ho=xdNpa}IVCzi=B zX8GO#@053GV(CvRNZRK~&jOB(0~Dmq&doOGeO~as)Sv~G9#+otu~7Gg&+_q>o6j;U z+9K4N>`dmPrrpBZ1=)Y?Pt#n8R4;IUH=8HQP*N1XJkaiEZKwv~y-qu}En6Vh40;gy zL(LB3iF!8jOf%kpOuQ|l88aKtq>vje_zj-mDZ=Vyc0N_hnvkO;$i6~Xb~=av^({~u zNad>D-uQ4k-JRcd-|E{gZWr`T@R(-GKy z$Nr&iO{QNppIOh%j{T}1&+XpTQ-;oAZNLw~zvY0f?8qj`1}pM?eARue z-(8-00&9jae)G%;euFOyt2}&~@8f%27i^dk6$>3jIFD z9I*ICf7LOEc)_*$dG7UuudE&DR_$Rq`c@gr1~L3R$u156jd|BW7r4{F3Qay^Y?a*_ zuc$e$(R;fR_V2gF$8*~>^z@wp(|WW0h;;vK>JRvnkm0&O{r2e~ZTIDD@RlR&9~1qK zzG?p1yn_ezlwBnr`u=0V&H&n1$GpYUdB_?1j@a})cgcAho;M(g*kQG$S<^6#ZMhvN z=wpm&i-+UK!Q7O;jn~HD3`6TaOVjfhZVQ>~-iA-!`2F=a#;_yp#_w+!`!=zRxO*)# zN(zoeK@$v}Y=7$E^`l0?{5QAbqlHtJY-E@NHwaHSg?-?GS@cE;CHZB=Gf4Cd0 z88Z5!1@qql1B1qh?N80`?FsXo-VY4*6o1)7Cd^AGZyxVTzPhBXcSG0T;fcMiI|``O zTs>mAm83nYe@b>1yx7J&yHoP?%rr+}9cE@PEJ#py# zQSWS6zj4DmQ`Y}v%#%C(H9PBX$5a0^9{zXZ`t=*v|8Mu-pEGf(eg9>%KD~YY`VH3K zn?K)tpzJgiXaZ~|@${9`tOl8;JO285kN@}aKmYmhd;gr({g3BQTjd;IHTmKyRd&4a*c0}i2>3zpz)+1B2+?J9jCp^%5 z&c+9a_(z63xO56UFw={G6pkLjo)Cv!cU@P%Rr4I$Yt_6bMlJY*{meP!mMNS6Ag$+5 zT;?apphwW2KYPl_XOYrj^hqly&&AITaq3y-CkUWio8Th9b!5y_Pflc)^IRV1rxQPV z4T`4^?I|P{g;!$Gq~NNLgCXaSg7us2A$({4f{X5Og}KZ1cZ^!+L|T<4VcAS8j)*ix z35A+#CIlS#x9Ahb`xo-K`=$-W-MgP4#M&|a&H}sf-E8`V>u(>mZo!+ML&=i)@bg*M zcXJzayEUOL2PY3@^i$R|85wr%_1&DMg{~t<_wj05_Qu~w-FB_h;V#$RHmZ2RVynN) zC);T$)_Tg~1u*57A)BMacR4XozGm>=k68OQ0{#8Qj1uAcfZ1ZR^dzk{5fupUGyJs zE&Bc~<2u`PmmlA9{<_!S-f7XFZ{5wUoN*QwEym2A?ZsDjaMuk^HgC5R(pJ8?==>Xh)Wts9`KlW) z*!bq#J7du0$_K70aJzT*IU`~7Hd}vT&7*Igx9FZCX}r#!_U?b4`{BvF=hn>e#=`S& z9Cw0EpWxKFq{O~v@ICK-{M?l%v(a#>*|l|3uRh(hIZC$e*tP6+xb@bv9Qu1V-q~~U z>(+!sRxeyM^08?}PMM;g-U_e(W4A?ix$4UAxnp(Kxfi&tf!#~qfIF`%a_SuP(_4Ej zd}lR~FW!FBI(U|IucBLT>9y#cHP*o;*1>BBIm$Zd)?4j^o}zG0@-qH~4!wHnph5kM z?7z!j_`=ow&R0J3(dv87A%KL)>D9L9FCXOOnApi6PW2~TasQRayX5zVjkJfx)0Z_< zost6voi%l(b@9M!>|&P46`V7&7iU(<3zrXavQd8Y(iWd{cCjz!{^G3*CXB%1zv4G% zyE!J8+bJ`)ylmaP;iRqwNY@Cg`t^XzANy?MV;2rOd+I6(!WTx85zoqR-Rju(nQil8 znHiE+#?UOpbWNC%yplrRgx1F4%#@U}RCqmXc93c5UP4}pS~A@(;jW5hP*-v0tdvFT zdRd5DGHXO#lWD10?%2iS8LjO!ldSgn@tkZ3l*ZYq{649m$%RfztmhT$vA@fR(J+1H zGHtOTqc18(v6XWtPTu^m|5R+JoQxVhLVxjtbGlETAiv|Y`P1Uw-C4Y$OZVQec}rT4 z+15i{pV8-bl@D7Xq2h~14-pSq-7G{wpDx!wHf8w2c%^V z0sbO+SgVGOX3w0~6;hhdg7J$+d)Y4Q$McB8YxChz>!1|?DtU9gm)SDsq6M0W&$5Zb zAL#C7-z*(He<<(TYvbpi?qZ^ZYXW~#hJ{4MtL6b$vmd%Bu&+Xz8y?e03Jx=XY{OM+ONn7%J!<(an zak^v(P6(TKP}Ld&3#+rBzH?&14c-lxq8Pk;mEE>pJy;Dr?Z$7ym09Rs*k{Y;&jXve zT4%N|o)4qWJ<(oY+qAy0use8fmY-Z$xX$5$w+OQ7({(3zKhcZxcRuN4*sytrzociE zvI=~E)DU^8&oMKUt$2XHItbDCED-Wac-7L%AwesOh!)l#U8Yd~2%;tEiUIoxyovH% z{2Q^cL;GLgQn*K`rPf{Q-QbuoG2Aynf+ZYuA4I(MO;D_N=hcM>Jx#QW8{S z2PDFH$^6FMBZ&5e$fb#D?3BZzq~&7%@OrhO@e0ieQuavho%fGFH!~V#tVsF-dc6}W z=ImjEi*(H&abff+#WX=PEkxKK#Fb2GER^FVjU8*8R|iGRqIe*LQ&c#G2ok2b^4PK3 z)EjaD>YYO-&sLK-?;i}(7D~2nJLTLV1vatulpft!6T9{4wV`;cF#0>)lGfEL-&ok4 zF1gBkk!Q*ZUWPZ!X@gz4Rj0?dZhd-gDBgxRz|1ximJKs58QAwb-|c(VUrT~xWRY7x z`>aQ|0UYKjJKVAhxdC*zKgw_A#sG&L?(* zP1{Q7mg0?FPwwoM?R;Wa|DaXUy?=psP#kX9R?KR%x?tC~*)9Vs7sKyY+i4>&-2$`j znp+~|1YudQ`#T3_SS4542__f(dX=bV&d`h;+}UQ&swqX2;P)#(TD|h4mnQT9EdIOR zUQ93eUMHvO)l)B9e8EdAK3cW%qutVi6*jpq$dJ8!vIMib2txTRc1VS)m<`dne*LJMunUMN*P;a!spST2|hdqX_-Mb6F zyIl9^6y<9>!OBkUE+6W0vUkW{Lbu-r67xY6t+Jjuy(`X@(|ktF@fPa4TzC7Z;`wiS z=h#xeef&Z1-3NPx-+{EFM9Gs6FSuw9%f7MeaUwfzJ?wbb>+W!)VD`|nMSgqqH+%0H zL7}sF?qJx=nY;i5Q1a9t7L0m=<@MM#`yzxYF=(Q2;$n9=!LLp0i_r-?uAwVw>$Ml} zbK`W5M(|`P#WqPU6cd6S4PWl&J@x9<>&~S(mJd8APRP&)z1M@5PTu^JG0r^W2j~ge zw4oRU<-NwAaB}zJ-#@&}U59z+57XB~3Xj?E99frcE?&pu z{A?y6Lw>)(x`J%qyqQJe?Z57)7V@P6>!O`cU-XkLKfhxzQM?21_k#6KUg4BhJJA}l zK+Dynut$K$tmwO+D9aFcRf>08SntOr8XMcZ`N5{zbMva2aTX(wEaEzMu&=C8-orhg$ zMMky=qWfgcYp5VSbYye5*U62q>u-0937K6vLHB+69PWrtw za_z4M*_Z6xwgvO%q+X|3loc@ouJ7dJ-uR$*yqj~--u+}yzoJ3?1`X=>+cl(Q+g9BE zZgy>U>9g*A;4J6h2}3UIDfE#D|62d)b?5J{=Oi!;}~=|{Pxe|POurY>-jm0&ilzVT^!bTxnhR> zevmVJth)EY#Up22S%9qcyR#mHJFgw+j?3_oJ-6<#6Hm_m)4GUFL-^Kv@2&u-t=eUT@qUydZG6oBv?E)vKq!F14!N@V~kCZbWl zurx-=D}iv8#6ProuYmKEQ^{Etg-NDKR+h!{>|?)?*{*FYCktfV*O(DL)256j7CKqB zXo0s@%yTHzu%4Z|pNv8Q{5g5qO!m|ihG8?M*LM84gI_8O7^2$%m{boIa-t z0hO-TMSE>WUS<=WFM!->_l*#y`S@p1mf% zV;%2a*vDPiaN_aX+*k?qnqx;&C|@er@@cUj*0*=4y#@ZT{{LO;WH3_{n@2R^%K*aK zm$YhPTQ4g28Z9KSRe-P+MS}Q;c0=&~aTlv>JFKK}8MK}((^7d*eSLtfY$V;V)(T&8Z1z}zl}F&Fe*FsjPgy2P zqmq`!MHoBAdWqZA?@>^$ILG|am*mi+2>_zCx`swype21FLbjT^j8gA{ssf?&fS~WP z?)zL7cp}j9yaY;G;yL(taSt-ul@gyO`Ya3p)lNEYqbcVS%S*xBR;Y{9A@5>BKsEYd zGl^7Qr+1WUzp4X~bw5>Zvk?d7=wo`tJ>U7}+vk4#?yt{wn0<1OUhd`2WxKX)V!y1g z$vxlg`}TQj-@W%NPp<*azu}rL&Sjmg0KwwdS7ONoUzof)iOUtYPEprX96oE>j0+aM zxk3;(yGZA*-PlF;&&^(}=lF4RXPort51cJ#r@(n5-SHu0-~;cjUb|-X+F^_P4g8Uv z+}63xR#)UnkfHxgI$OX_u}i;hm4Rt^drq=UKm6f>J)xn*2c@yj^e z-u3LbBIkvjOJ-~YaUKBHHt^-hYftB{xNZOVby5F!Mt-#Fp0k|3@7%uqlHP=6Tg|F4yCBbJq!X~$67W#;F_TV(~NtKdv4TWzes zz#!3*E(kNf%X+VF5NM*^AH@3^q^0sg0j`4{@6oKQrg0gd!nFi6WhfgIk0zO!8Eta2 zI_77#ZxhdL<-{}ey6=Jjr$JE1l+d(7C(Gu0`&Kv)$J2`eZ)k$yzLGOcIOcBHvFyo* zHz!FsVddS|cJT8#f3UY7#)Qy}wvxa*ApTo0BBXb7yxY7rzc`Q#65+KSWn9UAi$`v= zvz>~a)1hpY{T7cOxY2JGE4;bjUpukqA5Qi5tO%eNG7FZJA|R zHh;QKK5k9!#Tz!W6}-)M;~gdJGX6Dt=U6K~atqjR<#Zzi_==(zJnv?OR_%bG^RxKV zEnY;OY%MPCQ`m#m?;PD?=WRKQq$SpqU9awTq-4j_7u^Q4*1vXLH*dib-64%V3xqrl zwg61f;xxf4f!-o4y9uK;>lYdhgSd*oYY41PV;U`WYqL~>Jp$cod5T}vfk3mwm3$KD zymwMs?-DB`pjuD%X^%TGzVZ__(*cOG3>yf}EO{{WW2YQtJo=I(NMF^Fst43N)KemG z=5r@)jCd>O-f`X_!s}u*+H?ar4+4E+)qPgHm93(0Eneqral&`0An?WZtv=1G8S;R= zgX|ySrc3{_Q!)C&0HYC)o~0s>U2wceAmfSXvz$ObUZ4Ta%I!gq8CF-rwNsZ-*& zx=4^qK7+6>V>-t6$$+F;D!g$-EwUhF7KCoglfv3E8#+XbJ0HdT;SF$7Id*cR0kqR8 zE6W9fT^TV;MJ^NQQLxvz|1vAY^1@ejlH@9S^oo1G^ZGge{Leju@F?5Q&)(>7Teq=S zpOb9bikrNC&buGqQ^dFpP6z{H+zNmwD4uG$v{fhLmR)DzNgzr%D0HpFPY-cVqt*LO zpYQbOFSc%ilkJT;EEGN9ZZ7-ovnOv_e8I3HAvN%9x$xo$1lF zvwg>HTT8qFa}IWM4sK`biDcLI?aEt+Wek}(86FspUIf_w)Wj!C+`O3a=nWeC!ynVT&rxh(>Atozeu4fT_STrM zjYppuvcn1w^mgBZSvC8B6UlhXptWSa^9x#>+yqP?@S!;M!~G$&THWTBmRVJZ{exPI&mUO{_9Sv_?kh} zgC!v_M~b64^6!a|GjBL~C90BwTv>X(F0x3V34y-NCj|YvnNM2^xYRvmx2=!8HHml1 ziR*X1?smKJ+iZHr9INrSUw0y2g)DjM*6H1EyVhDuakq)xLFv*tPwjA5f#|ZC)181I zJ>lBhzQ5oR`?!6dM;45-FM*{$cRoc-2jB5Cc;K<+w$ZRI`8`a&c`(o&PyKYks6SlW znKhg8n{rwLpj{Xo>m@Cgcr+3A2=FiVRs)nYF5|U<)B3y;ydvbaO;H_VwpUmz!^;7H zlJ>{T@1T}HVQfSd0Q)LRV2w+l5rbH5y56a8ic1sR1u8Y0>T1BHg&S%1;{f&dl>{B} zmwuEqF5}%46l>kif*|3;>8qUI#O=>c`m?vg$g)4pSU2i|?@7Ir80U{TAi44ez>`N* zkTudq!H*`K|N1O$oaDT@L)ncO zEAe=dG(}E5`a}|Ls?<9G=`C@jUxKcoGVUUvKOjW&T@~v8WEW9QyK#?*KgR|d9@JdS zpb-A3PAPQF9~WTaDA96xA+IFtraosdO(l+n?R^7En(B3pjXu{SS-;pZp%H3ciFA_P zPt-NgNQ0tfqd5A4MWFxqDdzdV99fTT6q2qmaftjznTCu z??21E5!*@UtaHy_bmwGeixXJ!rx_bZUU(MxeZdo2!Id{$u;@?E*t?%mUMDKX$8X19 zCqK8#C09K4=x67jdzRljHsR4hH{J<A+iVff-M)aw>2S4g@;zR_CBo!Kz1{ zgM1$FFz}WMR&A>s+AcHk+9GOil49Ml=f^%b5ePVdm4T9dg%S?w$oB2Nzi6 z%4xU4gZB>-hPCteMx64-&!((&c)a62Bpj_op>cX^y|zR;junGaVd=BsVfOmM56<-;msKMS%zuQrVM5QI#a<1=f_;2!3cLHLi!@m$U9X$B1Q<*0FDvuM+KWcRtv!3%;g7;8OWbA* znYqO0zsod2i`>E$*<5@WXjwHm*m=ZIcT<0rd~ zx1ROx?D-Qn207}94Ks&Qzr6MTp0HqOZ*Mvn^{4eShdIZG&X}{P_pnp!Ofp|ufC`?XPlM%6hziecJ)Byf9bUq-#b z5op8>uSIGuiB0!8Oeg?r52}pO?!tM1rtZ=U?+|+xMWp>3GMWODUf0R+X>YCGA1}9= z)Z?C-!;D$1(Zo->_1hrPj3ZtH-DC}~bI!sV^;<6Xh@u{GxNDdWH#X0_pm3&haMWY# z?mOFioO63kX^hp0X~6e#>x;$sf@BP>45K!XArJiNt$ri=+BfSnapC_BagT3(a8$ns zow67H(fc?tAN}Q13V*uDIdaO+7QFO5;G=IfF~&!q54=aaui*!1`?V^ApbAxj z?-DImz?M>7p}@2(j9hoPRA{V&WGMh-exm}MW<$uw2!!#%x<*2D4TA)xB-ONp#!jGd zc{Ha5W*FCacz0(s3CuPi>N}<-t}1Cfy}HBr#rEy6Xky<*es_D_`RZTBbt#(u&>MX( z{_YI>z)u(bWsoJbCHA%^6Z_$kuUI7qO@H;LmtOqczV?xkkNxx4X9Jf&pM@43BZD4z z=*_;D4D{;+5UhY_#_X{pTW9^C-z?|M`7@o56N6`Sxm_z5cmJ)IUNW$sd*64jbT3Qp-zg*ebuK)OxH(%UuAZzo>&y4G0*V6fi_uqN7cl?5fR*!Rhj?O>4 z@6Ky3>FXRk|G`z)bg{YD`6^WM!PVDzZjCUL*k!J{xPOs*p8)f>9=^X>4)&-%Z?89wo)KaV@%ikJQd zmtA^RfA^}tU14=*;bmvJQ@C~QN58bcF)@=y&glO@3Y)Ja`rD@ zp7^7&1J3gA^7J*<{ry|_oUrhjD+zAcjJz&r^$kHWK$e16Et&IIevx}Z8yQ&E|y ztg5N3_U5&KR_Z4Tv42=wnc|`P__XU?<4(Iw@qGR;qZ?DxvP~4PWvv8|JPK`dfO!;x zd&9QB!{G z^zP!&pr$3~6)-LILf1KPo%p15@Xk(OxXonY2^0j;(;;073B>RRMO_uzv7-(zsQX8j3DBVV6(n@5t;5n+{& zY1^ZdOf8Ma4%l1tYEC4tA(^hBdP92Wze~WD4HY!#=K+v8EF9O2zLt)zYY`5hJ=uDOF3WhRL@tAuhJlC}rYB$*XZNP>4IM3T(Nx*x)Ab!Y>)WD;-0acxxd zU?$Q8)dsbmNp$*!br877)N&pmI!TB;`q3vg2-P*H#XLY1qmL}3FybV#6{wxA#R#M| zlaS=|fLuY^qpzw=bra%ABQORlq|^$a(26SSU#L#_NfRV8xAEx9{2^#eISo7r5<-Uo zm7$7VZ9E!61X{suD_jz@{<5=3Mx4ZBkitBWj^0(rNp9ObND)ma>%`#b!~Rgwt#6i$ z00RR9V1~{AA<^D%;{HQ8jjRAc7y3*3Ai7^fDkajAnI`58 zOLMmX(V*z4x>b^WL@ok;K$4nI#5@j8gJ$JiqCs3qkk^y_^)4}&#PuVbCJ@vd`@d{C z*`*0?GQl+WF$gm7h*<$H;hG70*pO&`t=mE(uPrNE6m#1^*vh%| z!i^H;+3O>B@_btN7$cRBp>-{SQVXI;CPljD(lJC!ih>>w5G@pOSwfUFV-FfT%En9Y z+!KhrKB=NPp9xkN&OO{auP>-~`Wz+aP;IhQ#ML~%IzK}VSSzG#HQ@7uGhQ+7$a-Bs z?Di!S>AOHfw6Q}VfFJTj+AToXLx>_WZ=7ys6W2?D%aTa*Mq_a%NPkt+E>S(Y z1ZV!pRzR#j&>(g@Jd2{{0I~ui&AWu^1ffp;6F*4n!UU1C3;9DPw+KnB0H+DyY&AjG z@C*YW<|TPFw`-tWE#LXV*o*)88SlEA@Zw1{F#QVX8sPLoVCoUbRs#TKwwhoC{Mnw0 zRsf9$fXWKs;rB_d`@-mlkDVY#z?dcGPsy`NNQRoPYx)eeu->_OhT_n9I)z4`5!%6%kiS^^0Pso=qm zscFDj!XnM9iP^D|tPCq?LNYR}a0#B$K=N+`p+kSJ##gz!oCRqjCz9$r9tsmWF-Qen zubVgD-X#PK3=Bl1x1KB*Kle$2KZ}F7s^B>v0D+Ya|B;vMxEF%?-QaE!3Y2+t}(uKK!0q@GhWMih-5Wn+X#pDJj-9u2Q}8LbrnVVVok zHUDP3cC8hNqWhY$6Lk$hp?6*}<3C_)6)x?^vY0GU)CLe}s;~&m6hs(1uNtqXf@I;|5p9N=?joJ8h0G)%>bP$O zD560*4>)tFV9iDS^5Q5|JNinR-^J@tWGg^@$pmp8klIEi+D^F0h{xTZi9}6Rf+T9} z_j;=BND7F+qwfnhfFO--mjLOSVg^wD6fHQX38s1XSc3#X=Uny6XJ*8$a7jiS>~Klk zpC_GCG$kuQh0&L3fdc>ve-hG(o|qSQ3=9km>Jv28R7U44cKSnJKM_n005&;_npJKA zNg?H%HC&$*&FNqhsPZ^Oc+rMCg~@1${IU6hM~}pGp!kXaX@( zP==7Cm4$Iwbj^v-AJMboJ&z;_o>Qo#LGREfmBt_);I{g>cOwW_6i71qSf}(=h{4dX zkW*67WGUYs4M}z1?L%t1rj$&Qie!e*3C`rDUr|)(yVx4g>lzJtAu&zK6vj^U^L;vG z-j1mI8g9FRZ^h^*Ww%dL2zyWzTcAD;wbgwh=^AMAN+MbT2pKPsbWN>y5oL*xbY3Bh zu?PEFkA9Gba9vBy3V@c|%oK3hV{Axg<`301(CM1oA)FLT(y-vXzEoam^t$J@)u$mu z*A#jOX<31q>VzFVv0^CIHHoS!sHvef?&wFAM(-!mJ2efUmrPWK0t%fV+PjOx^LWgP zlEgAHV(}PcW|E8;jmW z1d!th$eoHwSt^JIWMnXn%A{w&r22Hu5FiU4Y#pZ&2Ou;c5^=o?b2tWq3zgPdH;9fb zXQ9hFzK$f)5}!eIr)c0Y2J=+lwO=0C7^!;d^g(>s(8!Wgqt9V{TpxZy4T>xY>1L^@ zXqVkSEj)`SSzA`ONAhEJlEBA^dcv)`t*4&8>br}J1b~VXE{`2z1@Tvr`Q)M2JJBtc zWXXTcCUTaFM%Q$y4q|gCYEIari|`mDsxd`_7pnV!+oREa&Yz&J(SU>?jw&RRV!cc; zCrC4ss2_9_d<0R~(y{_r*F@n3f%&L8LZMK}1bIDKlxhf! zkr*-n3K}br*1Roon|eK=QkF{O(TC`|Mi?zfV^k}ko(BNYRAv>@J4Jgaqhso+UjB)V z03Ln&?ITthlT!YFA;hPfw{Z(4&QpQ&pwF67k2v0SNN#~pnb#`6+o$~w&g03@M0_0kD40HJrLQgprwOcRjBh04wsOi74Q_riiyPHc9<|8 zCvoDvePe%&S+oLFocW_?7qW9PLZZo%G?Nh2IpS+`8ZcQW1_lNOM;TOFIV6B+bR0kz zhye%&Wtd@*X|FnffCr?aY3ggsM64{#VU4z;7+hVfRc$oV`jW&F-4i;bwZ;X}*1JH_ zHWDrgRPWFWQXxZqT(`ch<91|OB6YMr8M1OtleEUEl%&44O!Ut&!stWPwPg}P8pU81 zL|}H9b`WV+@#3!O$dalF5oZ!~9Mm&O2p!Zlo$iBfCW*YZ99c4>gbcKhG$IxvjgXu{ zA-Ye(vSxyGs-v%<34}fz*2_FVR3QU^sH2};*TSVSRVyG>7g>I!^6ZGE$HhE$llH*G9XW=fpfowy3z{-^F4U9nXl_QI(jpYe+^sXa&@> zZUiZXRA&AtRzOEr5n{4V3=9km>KCcHcTrtWz6OYwa3}%MrK1APpLZmaLurr(;mv$E zL7IBUxwA-FgRn0{K~)`STp89ef}9iHSDzM&Q;0>+E1^+V7yUH~ffmYm?V+e`R50X} z)08UO49qtQ((X7%8GX($@Sc!4gONvr*eI>$aT)-m-A^!sFbASOmZSZ1B-w@tjx4T7 zyoBP*DcXfWrbQX@gf>7+a^^d%6tzcahc`T)G&4y6rDUcd3H(|nfqs`U?Olat56bil z(-588h!kfPf!&y6o+MCthH)=b>YBu*fFn!grUdj0w<5@G8sIh-PfgqK=%W!2(KU@Q zO9yq5DP8E^hmW0J?*zG$=50VT2~eu!HfUG!fr_7Ik2v~NLE}2z2I=%Jrk6%45_)bE z<><%c(N8X!s0^h(uiWQD_5|w9jVfIuikU<|Zwt-gx+y=KM9MD2eRTbXAm;_i47UOib&XB5dR=oK+#^~6B3J?3TJfTq|ujXWgv#2At&PSV{Ql>R)$pU?N&)F9t&?nfad&B(L&#)P=(G4u$Fnk zL{(CnWbD$BC4a;P+V7E9KY=u0LMH|W1_mjB5Rww@dc*|L*i&}$YuQQ46E-~m$om3< zb2{)P6qJQed`sjTGk%)U1nk|@StE{!4k^ZO1fL6S+36k)xSB0s;WLR&??AOc%x9AD{4!79oxX{>7SRg$>;`f4V-!n*QyCW};_D8k{pLfEMlbac z6vB{bTwWeK?U&Kecp*B_ISBd^3acH^HEh?2I8nOX0Awp&TF@^hj-sx~x*u-il%YeA zXMO<9OpEL+pm~4~kID*g+Oq<9>;NP>s4BwO(8RIxHNt78FF(8j!3FSW0-*HYkfla6 ziR@=eI;GS*tnWb@1l>oLTBHFak4ru4syrO;R)mQO?xJ7?K&G+YffzazZW9QPgE>_pdy?~d>?K!scqy!S=)yt7?p=6dk~8O1QlA*hx_tBD{;sc`R`W zJB5;iNRqv^P6F)#BCmJx_VBg|!zB)#*kYnhLMB`iWNE}S30Yf4G{1$^9`q2d7(0D! z!BZ6cbtLZ~5qlT$t2zLYbWPGbwQh)wRKMcnHGzcannoH0sjlUo1%Z$O%3RaW1NZ?0 z&nhZzQ{)#*8B~4^h^~WOhxmGOjD%*ZMbrHdZbw}0RMHUH3V^70pyYyN1wgC&M9wSW zV<)$buXVGbBRt>AElV`3)^1yq>KaJ1N9atF61Rixq5LV0fEXQ&A_<@veT7A+Ln|QE zlTz?!(k={%avg4Rvfy6Nqnn4qgdH_Le`RG%SErQS1y0QX6 zy#St>j;h3K01Fn*`T5MT;PuYw+IT4 zLTaou(=yr*^#X=^MoONmDC!!)V;yP*f;LX{C>-ttGF54)u7OB{&w-?)pOzIsG&(L= z0f7de*P%3C?h0A~QM3{5wm-_)u`Xd6r13&M0?ka4Bty*?WX5etG#wj?W)hJGf!SI~ z0B&1}l&c7w5wgCd3KKdpFfcHPggRMKbp1qt;DaKFs~iB>t5ZU>nP>!8cGWR03No80dG%CSmls>G~MbV;p@qiBwy?Hni*VCq^^qq zJeP!sc_qMB7ukaepq|QH0#K}YcnJ}V+x{{V5tfvK+@?N_N8c;ybqJ!Z2uW+p-Z+Er zB>B=9Tw8W4$E#8xzg-Lw#tWB_dgs$1auOo1Hx&|6u3!O>CSp_$j2#-%xNe6nTqyb9<1qj!Dq-#D6sF2qNhsBIrG%ybk|3Q)R z(Rc69`7Py`NEU$xc0TfH5T>6rtpFZ7Hu}EqQ_5y9TtlEX1r4lqk!BMAxISD6p)2`8 zU4tZ6K=gf_*;Fh;D6(4pU+5s6TdMZIWH{ zYlg`FB#owPcm~6l3qRy}0Ou^Tt_O7u(Gr&e9t9vii*p;&8_@~?);mfSv{1&m6PvcF z=$r~;pE!dpa`FYFi?7#JL7crG}n6#*Lb^aG%B9ekRGxZ~UgCT$PV&@m7lL=7z% zHvDi%NJtVgNlHU#+OW1gh=m}&BogLuh+NSf*Ey^T=T${hDYctFjmf>!R3OkH97Zeo z?nP9pAlOk_C*eXul1pZ!&be+}OfmX^LI%leAijG>LW43&nrd_nKnOX7%90u)hn zx*Yu!bWJIlI$F;v2xtUqCj{EVMv(9bb9im~01fIz8Z${$y^~%(65121-RO%nU|KJk zwa_)c6_MJbod-xnNdS#SfMhdCst=06Sx%|%A|0!Z-a+J2( zXC)|r&S-&Xv?K$D*JZ+175H(_oe4Eyhyf68v?K#Y*|9o*j~cIc5wwaJXb%zFLxZ%` z{(yT2(%30^@6(~Rk$|(P9xxEyg{bZ?RnTH(^4c;Zkz{Hm!MiTx(M56=)u;5*C`l$2 z9YlXU8Pim(Gw{_9&QD>yNILJmBOL@mH@IBNU5@Aqi?m&rj@zQ{M;!e~x&}lonIu#) zL!4I?=fwHJPdld)?fzFBeX5}4+6f9~$(atEhR7@DdR?>cgVvV8eej@uXCmo7o`BW5 z28d-4{^*k8%pb43Hdh;d0&RvGgyt&h zM_rPRU-04gfqKLvl1ieVS8q3 zHJ_t2@Kqh9XuFR(NZ$n-u=MJ`sv`|c;88(6cHT}X0Xm>-pwl%X&f!F!Nqn04PZNj+ zUK{RYPzER}B<3gb*~hIk>h32H)HTr9xS$>MLw*pL`6VkLS`E1#{8Jk)bVoTjULcN_ zGCp4{Q85kHCGzRF_1OjUjBuQeVepP`$q%|C2jf?vsAk-!7 zenQcsg8Nub{g!*?%x@2+G(d;92Y4+25!RMz=x!`HGXn6!4Wfgq!PL7GMQ!ujLs?O` z<00+QzDLd1|Izvz71!SalHfZWoFg8yJvM@00TCASgccIEzQmkh&H?n^I|O%Rh@M&C zH;7VDtPTO@hB*4NBv4G~Ru_3D2;K=LAU9s+0h$K5O%b;#?mKd)h;Drn{~t-CM0;a| zmK3#XZoY%)IkKD;Y{Fpj12jknxDDEeM&;VFw@-&hL#VESAPHJsBLQg)(!deWJ54?p z1lPK$qCFIXx-YB%Q)%poLWF(&@}8d{B(H=*U{=9pK-4vtIk*>CmT<4#=k4I^5u8cX zvo7d#O_=#5D*zx`0gc{?x&~+-(6>in1t54ypgF*K;&VI93WQ3gH1lhw9fDI^h&Dq_ zoJly1TIDu@&_IS!u;oPT9f>Q+FzwSwTm_b&Y`93P6Yz(9Q#(8J~YyQ~bZ>)eQCsAe+N(1u%E+a-5kj)jc)kLc;%(UKJe6~|Q!BEiY8tW3my0m)isAlZI9V4osK{Z~4Et$ET@wg;p7I+*Gx$U)< z(}CWJ%UzzshDJXu$0QcWE8!LSPMAphJ;b>rL7I5q#KGK_X<41zH+pNbJ33TbxbPElhBCC%6U=3=kZGy99TFGq^j!-7UBi z+y|E+!QI{6-DOX%`?>CC@8kUoZ-3w;XLnE4>grmnt2z@~_VhyL8+Y3bALyBu)q?QkIwuoMY}w_yr>#BE|aPO~K3Xc1RbaAp#232=^5jdDVP{G<^d z1vR1ZL2_|Vno}O!i5kHiBSjSntb18#XA24%Tv;g8eI8^WZ0;=T2y z=0F?u$Ais`*l~*Ixe4VX4{?+dT8%a+|FHo;#c6Bk&?NLl0GR-aTau6l>HYDQ`9$TX zFu-PGp%0dw^F!E(tG7!pg_ncTqpD;a51D$*wEDMg_%IQd<(^JFNA{d^3)$VvHQ?RAVHIv zXFL~6I(`)``xX1lzeSdQ{}4H*_|X*qBY*`0BY-Wu|H^oyFY>4dn*Lt?P6IxWyS%pN z1Jx%KzkXV8&)A+1g!_~;&2W=N&-JYE9wDlD4v6_BbA~7abmC=kdfH6=pcGZrdxDlW*;j-(b>c{U6%qH@$|j|(qU z*LKj2;4BL~Q2){x#yT7aA5Wl*$yya#>9>YBBR>y0jtEfpoDlJ;--Gy3{H;WgPCOG% zh<{jkflqNc758Wc5qj^#3TNn4162!J=(2hHDk;nJ8VDSu)|=97_UAUVR84TidmT*G zK>FVo){3^=QHf!v6M-9PSUcRuN2;roWqPUkp%02fB0ZU8h3Z=c4zz&tj$`23x%8HF zgM&lEqkh;*=ebx&aA>3!>zhAEMr6SOE2}w0aiOO~e0s*to&szyE4-?n-5*gWoB;8jct^~EO&e^D z98u_=>e*=F1H#CTddCCp*Wn1KAFO|p?U3uw%3{)|l0~JkCj3wk(ORio&HoxtKjon) z+HVnBS+XBkeHVHSAv(>$w}oF4i1azL7ttV%$~qm8AXFNINL4YpZ?YqPaLb(Ba)va8 z-gl}&n9s5YDMZzdG?I`7UGybEbhDxM7uf(Z0_YRE7^WRVcR57hPLk+RmJdnjgRqSr zjkLLdKaM0nVBFl|EBaEbzl5I$4mVvwydc7fMCe-F4E49d=Q9&a;+aK`31hyXM!I+$ zcrm8^QxT3EqV<80nMw5Agwi8XcauD$exok10p^HN#HvGviuVhjw|%8@^-H3xpA%;Y zXUUu~lju;gVjzFu(@0t3k>9Hcne;uJVBHG&RAOI4!0o*wAfrvQpDd}i$6 zMCntd$vEoVwJYgv^JYkA-fu)KoTFdFX4w%6Y(U_o)rVbKOcS-RZfjMAgcu(c2C`#f zyItBtMna2vsO}2RQgUhQPg-_SXCfXgm8sJ|Li%74`2lrR&j&P}A1M{-s;k~;%L z4|=@%OtQ{SvE%N@B1l$(Z#b?rk&1>zpM57=1A#54brMFn0A?DL2KeY|!3{5C| zGa;i$F&m1gcq2}lI_&G2zskoB8QIavku5HJ~qBUh+n85b3ek%Z@R#Yq&c5`iU3+{w> zbc=`6WYA8Y0Oqd(U~V#9IX@f9k=j8Jf^xPLtJ6mp(kZ)hir#(6(ysm-6;Wh=A^Mgg z3$y}uG;>_?747Et4|CxL7Z{e-AdwygaEZAeP11P>THYET@-Q^4!lu&U$W-R-JjqlU zAPjMJ1f33|4}&s3uR3nHN+ZvsyN=vyS+LA~p*gQ4W?*^LvMltN!OW<3i zc~;K%x6tU|V$_g##ZyAEQTq#7T9luu=4bxCaOiOEML--@Wq|eg)F1LHTxWX%z7LI+30<>E-$w_6x~w4}sL-%} ztZB*`(PmDBfJ>4D_SDSG$*lS+Pjg7lyQ2U;5KG9RI`F2R9c%Xx<|aUA+s1|)TlO<( z-K5R1DfkJlU~a*i@sEd41pmCTg>%b@gNX>GKoj-E36zF)eH~6K%@)Hw(eH_ytZFY zI3Zat2i({PEwr+TZXMgyKPeisc9QaBBsre~XMY?j>Rz{Kx28fX zZ*U$ge;b~x3V@3NI5E+{5w_8TsURiC!ZqOvQoWE(_<9B^_1IDI#wUl$4^lx05fckQ>=Eb&xTV^qp>hGbLE@1RKz3Yns>(lOv}EkIWdQWQL%8oPqL z+S<~+pGG`sE8xP90YxaK!wmLsvrEQjiB$Gq+QOTc6XQPwz@I?^Yu3YV<`Vt;+iS_k zz9&kg+}tq=y*Vz80Uc(#EbT(Cg?nXVmw2kcwH8(F((Sm!&MaKJMnz zt7!1lCS)Zx zR6|H@G&&5)Sb?<^ap2LVM1TBDBRh}Xk5FI@Q-2K+$iLSd5PNjM4$gZj$7FuJ*W{Y| z*{HhWVoM!}Kq39r{3nEe3of%-ZUl-}dw_8UZO*iJ{83(<0S3h=RYtH@h(`t6=OD&7 zs(du^d^G7Y-C=Zb#d)yv#vgT9l908CVIqA5FEY6;HNNokwk#wjp)1WZvC>O@T48Dip4 z4>4&NQOT~~)_+_Q(O#cRYBB7m4aM_@O09m%>`6;pF0XZ3!JDXOEa{26F{C7uLEr77 z+zLQ1S@po1?exKXoD50{>pnG}kcJd>M3+(|ROLs>l$z-$Ph9?>u0btx)nmx0e4)fu zR`Aiw=~$uC_0y5h6-14Y2vuM(vKzsK1)O2KBL7G6jK*6u61`DqY<8(Y3pP3gbh-J! zO$CwrKlyRuf_YSub^N7_=vmWzmPK5)A&$$(AhqOz<=|s2hju6zT?dAo=Tdo|Yat$X z!DJXMGZw0%FD~S@qRNQe%{aw{kVj9d*b|PtOsn^YIhEA&t>_lL5%~k4pUjO+Hwn0-QdXpmaXeiMze^&PGkMMF4 zg@=L2GXStXe$7N{7~1JzNjx%YUUOIF4gC^AQNk-f6S?0WtW{<2_onng8I2(DOHi&w z&Cxdb@$#o;*GXbE)qSv|fO-f=H4~dFlKNsBs2@vFrAmQYL$ouTI+8~&70aG{Xu+@# zYs}Cp+|oWM2h2G?rQ&7X;@D@%7ZwgaoxmB3m?}56s!rip8>Y_d~H;D>EfqP6HBZ5e5pK z*I*z-#}TGvjIP{;#y4lEzLn@xMX|PjS;qR47l*jyo_-HWF;11{DMYB24iV^qt+?zi zbgESRI;eF-7)F)qpO`#5qw=BNIz1&-3C_0tV>=9CTI|zPL4s5Y*VQHUP|<$LC9_tffAQ8!^x(R z5^*4JQNu$EhbZkU1j5Y3ex)6fC~=a|Pq&4PKl^0>q8w8G=@TcJPr93nQC&HE6*Tu7 zC>L7hVbgy@9;wn3q;mcB`^{!mP$feBcyMuk6^1f=8=&-r6aid}T{wq&y!A~g_$}{4sqI%36STZgaT3TMDBX|iWr>(r;sqpa9p;A#fIg}~7 zzZxJ@H2SBz$twRDmR=hACs4eh%wf@?ZW*9Zs%n10vrNBPv?JHqnB~Lr& zl&T+6&w~_{AUwH+&h9GLDlox=K;@b83REgi-KjR6bb-{vuYgG(d?@9stj<-?j^b_8Y~`dP%bNmj#ai zsQHeLM-KKDsY0mfa;`iw@+6}?(hd0tTY~$a8s^|K=KmcNKb899@WIRZzem6x^nd7| zzc+w?$3%DFKT3|jYL0(LJ!>xbQ22ib(|@w7|6ITR=Z_H5|Nrm)zk4_EBR{-!iqdoK zZGOH?pmL$Ev#1F6`)9}~?1JQdB4p>aSVGHJtnops`-*ST{QJx9w0J@RIklxNd9^J( zN+LgE`xx+;2x^PcEicD;qp%WEk8vy$S<23ql7{IMsC+0echGOu-1kD$1*_?b%TBlePY zylmA8jUE85=G_gI+3|e_fb$MH9DSg~@sj8lyo~bDf zKEOsJUsX#>%V$T@)Rd2lw(bpC%3W+XF5FUv>gr0X(Q+0MnUD)JtQVZAk(NQj%BgU$ zx`w%h8V=)D*0WfYQfJ+|d}@gk*6kVy_Cu{S&@e4jbrF|$!JR>i{582_z=r}w9m(-| zA~&mia1tTYi_iTo<=p$}wsLhAn?p=JEimggyZ~Qc@>UDe19v89D(a_s9uu8Bwhh}6 zg-=2I+|%%w?R1Mw|MXdFja(I0j=X(A+mP0~MS6C2dO8v~acE*<0*CgodM-$7cczBO zQnS3r1gAo4w*fehikwEs*b1^;*Bh>|NJxQljuI){O=g(x@P@m-0N3gT{|F(k&-bL< z%5ywitz+3i;0YHP{&&JQ6;dK0@~GAemz%wUXKVEpwKSWJAN&)cxjer1AkH#-XE3e)h39ToiQ9$Ou~^^ zYN)IOrPW>yl^&%TMIV}fe~}|pdwBo-=I!o$PiEZQ431hJPnXhzx{6RKiD0EQjtBL< zLA30Y$?4zBkb?WB%}H3Zg8eZ2((vh&LgosDMQESj+c(#pt51&q%>^WoF26p?-+7<{ z120GkK;bNbSyH>!c&nElk#eF|F&ccCvI$i4M=WE{;?HAvnX}Jh47qa)uGNf!otc`D zmL%1X=G?qDUIEPF1wFVlgJS`1bbp~JE;^)abmpS&cy?XGAVeUwIrYd!xGcsBfYS_PM z(Xp_sclzqLa)J=2Qiw~aE+g+wqqwHat3B`WKsOdTwng85ZFl9k|20R<=eyIwu%i_< zkQNglOZ++j>|joR9V~1~J0bY_OU-N6*go}{Jnw@>N(bA*#kIo=Bl*UpD0wPHvi=>5H!p@^A+MY9NgZz1EcTKeAzS6F~sxQlCWK0^h zGT$%T+W1(_U8;j;30LZW{i58R?K9_)>D|73aXCdxN*2+oX0B)ETC5wz6z4>Csvhw( z!6swESI8&maU+D4#s_}S5wR{u0LUKfOav3_cidZ;$jMoz5;uJeq2U#w$4EBB7yt-& z&Ttb;vGMkjSezpb$zpw~6XE-4j>DXDsxs z5ZfQZ>_Hq&bLb*R)#~ue4KM+w;c69HN@S|DVJa;3%r(q_RuG5LUrXy^LpnCKub<5lqVrD8$~C==kPpYJiIfA zBxr?ep%j7(@-%F&bjhx#Ok{R8bfx-`Q0sb~OYjG_lAh9RsVXzV`&6y)x8T1M(}qI% zL=l%`8dU9`@BNGl4(iCoG*W(!9GRm1tH)3ggw=QB(vNWPUX808b?u2{aXU-JxNTPCNtnTib=@l zVR8*oOVz~`PnXxu-B`pShO+DH>#iKl9>VXyoNq0?Y+CLWVA~&wOHH+?IFi)YMv{mk zrlFY&GMFg;i*9hkfPyD7W4@?lh;0jeI>YiXKU511EWBG1p2h3CPE@bvkk>74bi_}% z?1X>|2Y^tF-D^&6Veu8*?z2ar4#sK65c?C!aQH)v#PVa z`&EGh)n+ts;E!!aJJ5q~2c?+q?iF1*%{_#>;VN?o72V>jTJVup;4dSIt0ErWgQ1K3 zFLa^)g|4_#j!SUjGoeb|TgR}|G`N<11%PnxG&O=+qnLT-K%rAKcJf=DW^`;~jmwR5 zg7PbXfckq`FX7SWXPQH1TEEY=F9|~dh3Eu0Nvho3dmP=kAHbWk+CA#l!t|j+3nYC= zZCqCEe%}=I`!5ufq`_`m)PMZzVhDd-Oj7&xnBPgc#>^L`0^{!1fHz|SepNW&92&Be zUsy#G6JVu}Hkw5icZb!*G0Z{LT6OhvA^&Odni~3zcxK-6fvhon-sC;o_|LGwI?7~h zaqb?w9~1PPkaiDojh!GQ-@0^@Gw!N3z~Nk8ZAAZ%^`a-IhH5Oh5i-H` zO@lE&0}F~+xt2zNEhkHu-yNrxT9IkE(eDB_L|tS<2v2@!R=l7iz( zoQ{Zm`R>@t$h1X_wbF}Mxo&sNj!voCXL{SBPTbG5PLU@&sYfD8>x(7109;@w8Xv(& zXALM~?-*v8aM`xbU9!SJsRW(Xf4+|}EHp6y`{#caKG6kUIQ8F!AMqbk?VZ|Uss#s< zly#0ot2k %zPoC12FVvFQNjgA*lvI04TzL7s4Zp-Vo9q9TOdmJ?2f!OMRG-5ftd zS%nCH0-L|@1H{`y={>^mI^Si@l4@kJeGqKqyIaE*+qH+?>@%VY2ijJ&PE`ZKvVmaP)D;9qCk0ZJ zNMytdx4*3&ZFz`My)K5dIRaR?>nQO7CSI)1M-p=no#7cZ9IOj(-PWBNoCZf&g7o#i zNi4qRF9}5BhJuY9cEeR_C{MTL4D$XehHY`C5CRsx?7Ueny9K<#c)hb@W|`}YTtcu> z7-9URe6Ir;9LvL{jCeOU_V??YO-^e&gH=vgA>{%zAC{kA%_eW2`wR9L@e2aMn^z+^ z@)c@5&`>|t{$1#8BLPe5CO#xfI5`6tOcPL(1X#oSDhTqW5;o zd$vM3yJ(Bc9dNHoa@{KPr-#sH!1}(ba0oeVU?tY3q`9g^RoVvNG$(b*?z-~4bvI^o zp2iK_s|P-xX8XR6XFue~>if)h;*F(uTB`RhHL|q1PPHTDCv%!x9k{+SBC($nE?dv9 zpLOnbP{V<3S-dM~nsM;qGzo@if9=`o^9-sgkvfx3Q~iRZx}#7ROoQ;~D^lBQ_AuI6?XEV~ zqhZ3=LYFK0d{>68;QHG?xh;%&C%o)uWFh5k=z6^3(u|G zZ!(Tnl>)!erpkAW?C7K^L`uViCt9tJ-Xc?sL)b6&o zvbgObT1IkbwSH5G!^UZzH!wWhI8oC-as2E3%0HS&&u7$)1D4srfobr7=Vk~4#^eu? zp6d(U_c=1}OaDEW4g%h#YE;kHcujxcy4RHIZcEt}5<;=1*CkQW!sC*FO zbAr$}i5@E~hOZ-#lWn})IN|#!ypP|_T^AQm4esx_%Aqo!_#D<7`!ar-aCn^;jr%x{ zw^ntP`1%yDPsrcJ@xOby{$3NH-fz@;?L|uIK(^Z#BN?^Kyqswomahjs&T6Ni`ELD@ z(Z7t2@FSLUM6hKq7LIrRxpi+-tQbgD7P_S0M_#gm*ZW-Ri{YiA`f2t;^gsqG?qzUfa_Y)zp4$-FLx@hmX8f?@5E|RUK|mH*wF|-Wzed z+NV3MT?ttoYvq!hOc^Rp;vqq#nrMSTFn4r<0=B2>bCND6Tu*!HEJtz29c!wrd*QE0 z`U{Flnyg+^_4Yx{cgqIXrsG*=gE6XCQ_D8IRb}pJmRay)u=-2QAQ(K|n)fI?&LlJ3 z$PB=#r8dP~+x?D+WAb@z3^oYL+)V%Eml@mZC)#VTJkw+1(2WD)~GjN48(tFw$}E}Ov3U$*N_2p&2M(_@OS zqm)%v4gEZI!xvJW_1NpFxJx)FYp)&D%#B@?F(>#wgM+~RSCQSQg>yYCA|Ly4&~?gr z$skMHRb|PYcA!c6+uc9__{`Ci2)B_InB5A|msJ9-)#_HF7M9p#EaY@^Rw;ILiV34&?l_qsm( zV}-e}JMbGP=ucH!dl|hNt5+Tq)5aLGAS0uX^C0t1$b-Dq-se~5=GO)!#_<_fwQHo1 zd)NS25h!acB3Qz^2C4M(b&iL))~C#?N7_bNk9{U{_R}o(4m9dU{oDPzvt@_s{!a;& z{BQlPcSMt$7b`^BhiosYA6$KdEmb$hjoU6+b#eGc0KkM&nuhYBO90+q`RW@c^v2}XT|tvg-MdW*hK1*wi%S)Ay1H%%62)?#zWZi6??(=7BF&neF- z#?jsnsm+f2X-!h!L`^G+43|L{0>H%amgBHr*;yQyk*`&&yq-A23|fs$=Pk5ZJ_q5I z`poV=ha^9sWK37?-=rG(4N)HJ^Z0$ejn`aQ&Bcp(s!i9lTY0iR=Lmf!`a-vs#q~D% z%S><0d46j@#oGc-ip1mQH9AGX_vw(`X7~eD#T%`YWS$ z#imWi({9?!xAylnf0YTi-F3k{N6?IUc#NI*^}04UBYQ?Fa;T}C>hhnT>Jr1<^dG{U zKE2o-}aiPr2v%^l6QKqmp)SB#j3|G_nM+>Nt+C z1d^hSz}m&j-Mp`D_~{TlZKqqi zRuUk|(fx@Qt9dV7lfjZM-U1C-LNiD=JY2Cs^W9JE4s$Dov|=rb*XxM-jxS!@ZE(N` zXJ2!{J zKHZ?@2G;|@wFZ(@)pWfM+c62xJCZMos4%LGAJ=UafT}ye5s17C>M;-UUGcvD!aX^;UY8t>`GM1rNC?Uc<1f(wF2|gW=`(9h3i;I*wJsMq|>hbS(aZDbS#HdL3d(A zmqEn37!=rYxj23uRAs{4;+r56l%0D4kkM9!$$8Q(@3f<1nSjQtQeOYhX-E<=IclL~ zr}F;Ux}vBZBJ30Qc0`BTs}<5qfB$U=mmE)&%qP)vG~AB2rHsMrwU)ch5|Pm{SUCif z^L9{6dH+v8aJx6r7bO>rZx7ifCTH}1w@x>`O*eYRTz~DuZb^3^Z>M2ww0;$jw}^fe zmW*Y20aHmes3;VgZZC0z1K~Jrq+IPpu{%xscg|(^Y6F?F5}@1wt&AfEp2!F%+S6?> zXI4fp>wZ~VPr&S`ylj+jDp1Ky%U7ep-mo9^_}aIW8=uvFwQrMg-z9#)Kj5JzP<<2U z`L2H^cQ2?jV>sSclAumoQCVIOSUhy$fT+-bs0x-!#wZnsr(M&E&CE`xBoVBBiF@AL zjedXa3AnmnAmvxmElY%c&LQqhDxa#HS7sN2l_2GY5#w5G@LpwEd$*gXHd}&osAJEy z+8=AT^SDUo5%zA3OG!OdQsp@Ld6MdL;RAW)pb>?@YR(E6K;rE}k+`%M53=HY8Z5_w z+vq(@@M-g0wK@2bvrf71`a`~d-Dx~XAsVFM+jh`%Y^(irKTh8IEhM*<0rl&g6qGy@ z;ly>^H|2v%&8>V$|njwR&}@DpMxek5EW{_b`q>rO&RKMZgZ5&^;bXAw)e zM9Zsrk`dJ!Q&Zu&lFNx|-|J!z2`0m?s;Z|< zK89~_iW&ELI+;kF%a-*;^kkmN}nPp$EsD(Lk(QIOLhz;u8{HT3qS{>WR-_MdI0u7fWdk&wVd{Z$n; zlc*~OTkm-78{(*Y_mz^@m`~bQFAU4Wr>?x=`a0&xZfR&I*56l~5a`UHs1Xs79PgPu z-482EuWIG0+V6xDiEuKs7WRJEzBhWQyQ?l1sp~!C;R7sZ5|fDSl+50V z3fzYC$DAgdwsNMbYO7Z<`|${m3j|#ZYFBwVv(y366G+ zzF&?}W6X%6PWO3bBZPnYP*DbI{9-ENrI8gc>1sZXoAwRs1`R%h&kEdC-lGEFu zZ|3D;O=A|@-q<7_)W?<9{X+MP?R8zwQ{IYl9~Dx8mpOg)cXz#XtntUbm~p;WTQfDE zwvs8$)9v*!(A)J@IKMis3n92pUpuMy<rcobSa}=)pJ3r%j>rx$w%9LaE!JhXoi6onrxLg7+r0`MU&$27F?!pLiD2ow zHiWgCv3_KK@K0Ft*n9(W=?OTVq$H4PX_@@8&jxrMahTR6(D;EA)*K?(jbHm-yyjqn z#vbq@n}J(zaQiE+0qsA&**$@#Z3uIQJ3AX z!gxl#E*4wg^YcC~H4{JU>N)XP#VESR)HKE{-fbi#^b0Q6tS5=BM>|DzDfLta-LKV7 zky7-QYCXC+Jsmr>D!YW`nVH%-dKsUgSq!x5ty`D&4h9PopPiKc2^U?YH~NPM_7+ zarsUYL;0?YhzP{F1rTAbr8FJ>=R416jgRbZBaMj4*hopL^pZUg1RrsBKoPbX-s`=z zWf^b@5xy?F7C!XAvqLV~R^z1|i8F?uKIizGdD}e6Z>P~^g50t0vYqy>kNS{I2W|(C zyp;?B=*J7^M;6;2ni9;Z9>;GXdkg3BW(|i+=OM{vX@YJqw|_c4@7|Viwa|D|kQp_s zJ7^Xa$s|zE1D<-}=GQuXcH#7_DC&(Lrrm0RJ<@U22}cWocdj#aX$#O{4om_>OZiLs zGGE7Gql4BPbvv{8eVn@N_kG|f4Bm5Vc@HATM@PTCcVDMH#&|>>lm=o&9Nop=5j-{6FJscJFKXpAJ9Yu{`^7S`fSR2Q_7r@PseY9Ohb{AE^R!``>S%1MC#FzNyNUVcm6xLCei( z_zD3t(B$1)33$(ee=V52YdJ%B8iP; zaemJ-&`=g;W3##pnQ0g#3qr=-$A`UM_Nj zEiCH0yS7|teNN^NTYQIG&(WBpVwjFcH?LU$y)54I=-KIwyM%CcT)o8CGN;_w`q*QE z2?BEiFhPJBHJS#HJP0hv$|O&cJY4b^JAt>2k+^Ksr7(55_{%bA0LlRpRG z2Dn^i)}6O++Vk2sZrlLRTi$L=Z#9wsS#?ovQ6Bv!KK5|GoZ1qbV6s%nhsmpjaWOFe zZnd1FfeFck=$>lAK$`YY`syOzuV+N_THnmbM+BwYyKvwZ*O!`q-e}6z zdyNpody4ZuM?n&^yqvBebqT>1&PohnNzhvkG2}8EaEmkus(AF~8F6b~sx1;!I7FI( z8ED?m67-n6I1R4KKn++H!`GywfbCl?e~h{}HbVO4%Y)owu}<$T3UgD|TCn}fIXg#D z<0lJCJ*j;BFgJ}+QB7L+LAv6$$4$P0iD;2&yOrWmjEi5z2@3!w$NpIyV}{T5N^^KV zS4ngOHUI%QRZu5?p()oO1|~R_?r$Zp!L0ingYq-Kz77S=A3z|#J|y4dt)#aEp+l1J zb`VZS1v5w|)q!NK>{?qRLS{Ef^%<>Sd)Ihpx4y}wrwC!#TPl&b#+b5cLS6l$Z7rZM zd39)DG;Cko`*LC9p!=^RV6INuS+jZj=NuB_Vi_~Y_&gL8Z>5>wX2Xz>x=!`K`TzvY zgy3Nw@+S#9LP8dBQ-NSp1$27T{6KN#0uSZ&`G9ax>;%OUXW;oGW;Ee`#8*b@0@(Nl zzoR>^O)-mF^XL{+aO(kvP@o*aEf>RJ&J0`ZT())lm6o5dQ4mPyn{)AuZlwjj##aqZ zB`MS-!Y=cjzndDE`SJ82XYjiC_$WF|bhbQ+!^^*5&XK06FZBN{HEGhThg3vEjf}0DmjmNm6mF$lP=HqjK*cGCJ zK(H$PHdh&l10M~ma}2Y$JKYC2?*k}cpj=sXC_w#K6h?1ujT=Nr3?|AB6up~9p2`vc z&j5oe*(vB9!icGZ|J|anf99d+JCE)nlyr!0&xNiNOrMXh?2%)mkJjBl9v4mP9TIwU z$JOOpaKuy0*8Mf}-C`ZQ=kyEq!*koOIh@bwy`k^lQOvK+l}G%g2nD4*<~E9Z*wm9JA)%l!?w&W{P}BEG z1IYg22CG&`_^h&`Q2hU^YM4YWA5>cO{qh)03Q%5?pnpyeoc-wRi}kuV!7p6wR^j4{ zb!u_y9hPAA)k0E}{#SfXI@Mx8aKSK2Kz?Le=~3xxNVM8oxv)_%HU8|_J_0f_)nBqb zujNGY)^Dm{9fiZ(;=erPBwx8yK#;s;_Tpw1wS!WkRh;xF)s2AdbCjhYjL+jPjNB|Qc1NxBv%e9X7r2!`J zTnb+0bP8&Q5lr@XWf9HvWB!IwfS*y_WAQul^yA8s_6q3FkniB<01MD!o=lS`jTAFu zcRXReC^t}3i@Tz$;3Qpe*bNb#;ffBJRR+_kO5d#cAyYFTpiSV#ldfm39;Slnim zuipHU<|Qh%f|l84UE@^EU~*Z)Jf@d2P%a&uCj4CfsbuQP^oSydXn2Gy zmEf+EfB@W|ml~c*oX8uv{Tg@?%LgGU5zLGPbb^4<|KA zM1NOuR8zahp3g>g5v(Pnqq5N=%Y4oPXCcoA*eDz@_xc|SGOduqVxnFC=t~_G{}k=` z2}EetB8HDndS)D;j#BGRPSR7dR+&okYba@nAq&A}W5)N=q1XGc-%`$DewEgPHdczZ z)utigRrm9z(bXs47KYn-}s@81cM`MbUa?oLw;F#s7CS@mqU1O9rRWwwK@;Nus6L-!W) zKN%quGCVq)gDz-OqTM)=frCJEyQq+ z^(d;#b(i^ub8ED|+oGAOg%HC1W3&tk^BxEne>mlq$MWWqAj?2I%NX+p<$u}{)T_PnJW~$!7Pic z6bIvxmW;m9G|9438Q023qtaEZc#`qk_N67UE$_rdewiWG8Si^Dea=eBM#T^Xn!JE3^!vTcsU?)6rKEE7N!0$h+>tin?S|; z;f-eV7CNS{yk+L|%mlGE-HakRAg_hA%1=BZi;g8&E3!&>saW#3!f05{q`_LZu@X60 z)lu!aps8GeR6cF zd;})KG&o2LFWrGfh!C3g!WsH|M94HXp@Z{cvqusDjpfuu@scmytnQf?nzm{Ab8K0qz!Um`;l;95hrZpkev43j6ou;8>~mPn*HD zVEPt6$;pyDiEdMHe3ho)2H^V_y)5e?fK%ud1!QNxKm4ep3S2Km5*{hIsDd9Smul%m z@VSD!1uebGJuC{1$KQt@jA8zXV5OQ+xJ{-n#}xVrK?MJg0IKt2>K0}OHNK0yb5FMq?$B82i%0h2V2hI)mS-S9j)Nl@$Tc z9>sUi2vwQ_`L7f)%dkEbE$}E|a8mauQJMo_IhRY?)el6NRYC~4mSL&dIsjj{iQ;~7 zZL%6gPq>-pTOf`$Ou%0Bkw_s&iIwlHK}j7s{Ih7G@ajJjJB}pPPbRDV4z-K{-+d9L zz~Y~Om13g9H8dz#Jmhhx2xga$;1n33!LB#8KWmAcA!d9yY^o=TI^BiE&HWGM`5{ov z%#MXo}^P+5z!X8!@^X*xe^;fo_a zKyX2v;VRggiey}%NcZ)0dhW~R;}FsKLW78B%PhyazSm;d#EMW^={FDC=~|7;m5=6r z#dMmSu6rl@$#~~{<}A_mrwgy?`Lu6G(Q&j~z3Gn#0m9Nafpz3wVnyQE0eo{Bf$zSQN%bNI$r>)qi9cR(mF~kcs zi}Hkh)1kq*ToyC(W!sww#tE1P(g3p6A+W9o zIYap`jLz>l=SlnJ?v^{N`K=j?2;jt1@3mIr(dv6a#MqXzl1pJW>DNDwgXcti!z}k& zVxL&ZS5shZ29|z%QZ-1p>*oz?D!phXVQS@bhiMm{DoL+wn3=~OqJ*8MbBRPiRmgXl zYp%)8eSTz`NME#bgRAFLDf(W|w%lluYoEZx5<|-4^l}43+F}oWl6r5YcRLg4*y(+k zke+_5<{-`)Pg(Q0dmMt={^kcmn&cKA_od0KC+(My$68~RM`^RP`0ZxxK}=;q^b;7U_iP`EcWX@|=>hZ$Ns(4I#>&isWnOPs2HKq`MoBVp%D(;nBp zx95$nLWRRN4K6+E*^6CQJup0Y9ppv|kg2BwD!=Dqu?P#tJqq0nBK9tlB{>oCUNw`t za+7Pql3~2T8**R?Quh?XOZn)pYIeeYEl|Po(my0wv;P_h#HoOPp&5KWoIPu^6X{;s z21%>Ntgl`0TDaj9CJO6P;MmfbRzPx$*v!I85Qo)LPGXs#&QChVOdTIc;KAX^Hf>az zcqZ=C3uO2l&g?yq85>hVqB1`my1O#XOZLH`>F^X1NW;p_h;q^0g_y>ysliBKy}P@O z%#K^D*?9b1xV{Q3Gqd&EgWI+c6_UvSL~?}rZxI+(K1P^YyWS6D^^LBroOD3XPL)f& zhR9Dzi`%giMrQ-|9#G??w_Bkd#1s2L9EC38vTYOCN@i&XmahKf0L@P>lBFD9J@YQ8 zmU1}kvcf{G(<5?C$d&X6yq~F`VY-ul@&h-Aqf92I6rJfTv)Pw+h(X}DF>Lg>@87q+ zubVvX5ns>QtUL@(J&&Capc3n_-fnV?j{W*v8;6Y(Q6#T3;?s+C{_`E|256Bx@t5}{ zXq`x-$g?5RB5lx-8fxIv-OD_T&gUU|k@`fUKY~QtI;_vrxAif-`1k7gsh=qfc)7yE zf0rv2?Tn`IfR)WI{yLe({&w3v8f33$a3nKoHD+!Nz@6?@Bhd0{n?WIZqwfSy*Kn8K_q z;+zynER#ZXrilqM_om$RwJ5h6ig%xP23M5yvpgjG3I$(h;>6Ydy8!w65$ z=#TE8n{s!;!qLJ%Z#}0^7|+k3(GR_-#xeK11e&4&ap<;yftM>8$!TgEc@Bc?XZ?F0 z;g}$jMX(Bgf;fLJR*KnN9^`;~-Sa6}@5~y#R(qWdeBQtQKCJEyKMFolIj&K-6a{N7sZvnP!_AI-v3I+wlX zVxxXxATT*hvCdI(V-D}-b8nZ*z&;5gO2nL=y=ydj$*~XdTKLTsD4AqRcGBk(5}Pk? z@3f9HcAWFSg0LjczpSG*e0*3QcyxW*2Z!;83Ot{6D|KEweOpg(E|*AFY4sPk^WIK* z8=~u0W3UQC(5mzcU-R+(G8gqW&x|>SevSYGmGAWwpbw3|gJ9Wgr>^kO^vv7Wl z0Hu)1nwO(Le=?V9Z`RB9f0+Brs3^a~lyL0G-0P~yZ0}S{oBW`-mKD^$tLviIh@tZ zwQr<^+p|p9N7qO#3pNhf3$&K+`6$OM=TtS(L_BW=JP7&3a&Or~7cj*&NO+#SS*o|~ z1n!pHoJvv(>_bN+S_iz=i-JyFK}VfnnBEhlls<>=u~CeMY;?x|VF86VV}K^(OTju^ z-T2i+W0ucxXCNQD5JbIf(vEX(e3RH`;aAqytS==orO!e@7gR{?+M!C$?6uxDr{1Nv zYif$;8LpJeO8Y&n8E||s~VvJ)S2kS-{GXI zTyf^Se%D$vD|P|)wr5^E%ySM&^>)3jbQOheXGUm(uA^g5;l?v}Ke^)&_=J3g8uwMy zZrvzMDf1ekrR~5y?K;UIgSR#wqGKkbF?%K=n1Oy8=UQ^z@L<}{YPJ)Kj}IE(|4H?p zAADq(so1`mOJ^IDu5^3Y{V-+=N-7ey9x@Q-V_&VaT8c+p9v{%2!?|4n>*Sif#g8%Z z&PBqVJgFrptWhXMps`oo2v)$uw|MSv_F71RY-GCev!^oq@KU`RSZxeoJE-^tb4k+C zzYgQMy;b=zWH!p&IGUH&w&kqR23z_(dgRd6G3KyB`c9ct^&n72f{ zc6SLdM&TwQ(Yapefbcq2DxbD2oW!SJ=DD?gjLXQujO6#o@|9TQ=XR^66n>@%b5rjy zmZmD7$wx>p>?jI7P_1}e;woM5>Gey0x!A!cnS4f%1(zC9n2#zY{5TaNt*6To*w;&0 zaP5c8qHS?;9k;V?Ui%(y85+#TiuG(*KlPW}6=EMvGWUJ3qJYg!f#kl#&3Mf3`=ol@ zR-;CgA9q^PL&3&R_-4JugOf-&?f0HZF9#;sAJU~`7^JMSlkmlc>mX*37vQw0MW=ps zI&vJW@X=mdZk|E{KzA0pXuWwbR`8O`q@TO=^J2SkmSQ;nyb52hR(Y;B`e5&36HZvuo|atx>yP{Q6d z&)ygs)6zhP2uO~DzJHI~9x*v6jBb1v3Xh5p6@f{|#imniK%~cO=n?;PqeAK*%^WJC z#j&wqC~s6MrzR6{k6;6{1#2XbR8X6^0cYEst{(cf#fItk2_Wu9YyIIXs4&u}|QbsdFS zvI{MmjPrqxjc4398kD!{Z`PWX`&KT&pid8Ag#w?`8?p99@0aWK?$$tv3#8t}PUPw& ze-jEyfPFh$TsT~v|K#1VN%VyTcpP-sl9J{4+#a*l5KpFy{kSUh4o1U!!HF+hZU`1c zmoyq1;xl+quemjTnIA?Q`yz!1=JoQ_H;H`=eokLDB$y)slmOK(Q0Vd>xFger6|_or(Z zu!eBjRU9Q?U1Dtsu<>IMWFPaRDf*eqj!I9{{2>!u2BRNyxZlhejI}&??Q&-?&D!2R zEV53mP(9p7@A-ATpz^wT7|67_U|Ixh1%VS=_a1I$DmNi6C*NSXcvI=SuGOIJ1%8XVenh%!H$c&-z0tVoHlnf3p~#!gzmiIVb5|Vgso_1aBC{P<*HxkkG2C8df5L8P>bmE7p8(Z+P{`B0Ap02QuMZUe zMwQ>YWb1=LuftNhx%v0zm%C)zILcAJ%R(G|1ZfE;|{zizOD9Fsjq*S-9GZW@b6+-t7QAu}W? z%nXc4)iVDvcTsDlPvJeK-P)5>0h&itqzXHK#~jFd@2J4~{EvSedh^_v6+gvQOqc9G zSV6wl7!E6Vq@U_3p#jAMV!N=(prbU9LNMs0jO*m#KA9K_WUV-2!$V^H7Q_I(bZeJI zZRa}U-B95fgdVE+PGYE`N&>CR>yth{TXrKGeDeJExO6fEeaEp(_TO zz`b=nb{oVL~wQP$~?OI7)hn&1Ut(6Gh5| z*#rh){Yc8sVF?wIXwqBB%Z;Vq-6Paa_|hC5F6P4r_Dp-8T~*^-hQ_&+%BgB`=bcHI@uF{a6x7#z9u+>emp70 z52nL`eVHsV5RA=wx;i6VvdPB=I2mra6ZC?DcF@5-=fBGjEMHcUcWkY?O%OiR4xyucc@_O>bKx-0X36xL=T?e4m(b2cc;%~c zoeefHju=;(ccV#Q+(GPJq@kTHsC!{KBiDGy6uKG6rU;zlsg8Y;rku|)pD8as->&^V zQfYiTHuUu2`M{KU(^t_SU2C39$cT38z9`MT*jmK;Jx;|~rXB2Rnr{?3)92#_0vv+rPTA%t z?yeeZs5;;GG;v4`3wAEQ^sFJ+9}`10GQ~yv@>IeUSHVi)j^7Q}OS?c}$^hM;(E#Js z*-yE0rQpGUclOaE0@x}1*13e+ZBCo}?t7DM?641zs#CA>4dvUhu1=)XyIQ!yq;uN; z#soXdRE{{a$~cTQzO=ZD!yC!!aj1qLQixFl4ER7iDBNj+M|#aMNQKQ2xb5MVAYE;m zT(?&I^!U9xrMd#7g~X@K2s4FiBLJ1}Rv=dzjzG>oOD@K#_Tq==Np9&Wz4Z1pTrX`( zV)v>v@2VUHI;qjRJ3%L6LiE%aBW0ZFfX)HbC7a)b4YnqslWaA%8NEA-Ew|bAK`Uly z`=Dr=qr<9=Db-7*#pVG1gh-ZMOvNlTC_hJcqHlUmpfEriv8)WP^uLOU*;2n#F?FK6oSK7d~|n zKuo~OJJb>}8gW#%#oh|1_yoCh6o&ZRb%1yuAe||L#d#)13%{qfZy*LR@Ex>cB97SX zJm4EptX+uPejLr;u;$)Xc${J3a|4(VNv<7u#~*sVKrRIBtPKhm-gEqw~zs|6-W{vhoI}2 zKI`s^mnn0ToXb^+SsNfm%*Slo;I4#|ePuFt&+Xm`2uc(5x&tRY)W@u3Xf^;EVhonE zVZL*_&lUM=+Pn^KHob3hYhcig(0!M9*nL;Cs(!gzQeP(N-QfhXSNf9kp-)##AC~8t z54+p75%`icLSF>dJK*KxIcv`#n6^LFMCd(TQC?gft#7|u`3)d&F*=bxcCs@)xj#Q8 z2)|}E;rQxYZk&w)e&Up7=K(F5e&9Nb+O6QZA>=DBF8AkExn4j)CioZ=bInll<Bq6g3(}0D+JiCPPECi1Rc6X#d!L?8 zi=Dx}VyhI$oS1GSPZ10YA+7W&C_8226Usf+Muv1U&h#ymH3~wKapMFX6l)|NS!%u> zRFV{OW2hENcLRfz;SdPReY|jN_>P*_v4^u*mj_X^+qb?O6X}6vnCf4L&b5C?+y^Y&RIhC+$(t&zkgy}L@>A={| zhgMP!D{+h?-RezOg=yVR7r?GiQaYL<)y#kx6+G(XDH7EgqASE@I+c&*tJ?iFOS9D; zjs1BjvC^&0R7`_^Y*Yg0TK&BYE7{nqFK2q)%JIYU>s$A~c^^bDX+$W=J3IEcT^93p zM^jH&DTrbFlXfsUmT~(dFIV1&2It6vSV5isKOS-Mp4&j}YxZ<-hff++*v5jUr$@c| zTJ`;}G;Bo**5$u@!yK=V?IZ#p6u%Bi(Y+#18I0Lw7X$g=)NF-}0NhQ$`qEXj%&QAt zDz=HKpQ=30ub82=C-0oK?$b5enjsr~F4iT_K!ri9bE{_)aVue`cTzNr{$X)AqW4!N zCX~w7J@BjBwAw(245k&|$OB6W9-#D3kL{jJT=U`efz}*T{=))7fjM}_>47g>?qhaa z&pP0YVFoNwa8#HpbRnIY=FQ!T&$T2U&n@wr($@jAQn67io8xHaLe@LWEhvSO#S2Kb z-u5TXdf5Zr{W4_cLdH9eYPE5k>voPl%g;=s-i?;yJwsoq$Q0UrqxiONsxTSm3jF>H zreAr+Jt?m6^N-|0Iy;#Y;gTihIlOsDzBr+nd{*tG)5sGB+bDmnk~z=gv%NY7K%?wi zz&K|If$vx&plUxHt(974wMl15DyP364EC%eg+S{}H>tc~*Lrp@Hj3ch3g97+3=)f)fZjo{qO1NgkNq2;rkaRRzTq0#<|F9@Y{TYwrg0u z-AMo8JZFKPhOk26S6Fe-p=oO+Na6nN^+3V4i*@>s^dJ1HmLn?H*@KheabsWzP=V_G zH|H_&0@)^;3(WS|89|0z8}bUKlKXq`3&_`*W^}Rpxsn!NXNu=Ad0cZzvI;I5JJ{mlK~kw(xH)&VP#za8Fqeth+}mQy_kl& zMuRQIG14iS6A8z4GpE-QC5tw|$~F0--gHR`2_@!!JKphE+R_#v&JaFVQp{mxRdWwn zcByT2sjeW=BYBxV!~mbmA%=`J2mPAw&#Wv(dW5k=-stT1l0D3sl@u3S;(sKaSkx9$ z?v`+AFr0fZ?>P$_Yp{WWMEjQdZI=#*C&bbPz}Zw+Hbj}1a8{KR^ON}CDtZf=mL-8r zZ|+tFqx;=du;=jz=?XyTt^kmE-(Tl-kO-4+(8#&@wIHidnQ1) ziDDIaKZ)N$XBVR)ea^YD+z*0dkyLtLmz#ioX!AaWrD_FFIL31wKz=>3uc(y9hV9ZP zn$cN2j#t}C^itm)vs4rg50BO$ppa>;zK6$~tecd&`MC65kMEuR4TzLod3V&Ye!dxP zg(5J1g$CaS7JRXA3(PZd5TuaYh+3&*XJsubW*iB-hK8PT$94U;Cnx!*kz_^{1PG9P z;$Aieb02~iKTlo9zl-4p5GYRHyEk?sGl(MYDR9079U``V^wsHIqCG+1KqlXc8M!$_ z1zAh0G ze;0-7GmJ|J#W|GmUNb)OPSX$`sHGGCiNgp^5Af<; zT(Mv3kNOjgz9psNU+PkJKb2Q|(uMunJXJMAc7x*L3G0z6QNgLpsfuYdE@hm`Ru`_f zYOLA1+2?+3hNmzEEo5H@ov$$}J7{Cjj^$He{aNuTp9u8>Ddd4qX6j zSj@@`V0r{0);h{5gxG~4J5}GKM+_#9%%>IMt5DxTK*;xY@5d5#mLKN^si3-LT#sOY z;M1tj4WZ~-b^KD=m~Tq@SP9@&n&$9_Z~DS3qyC4{B#MZg1S`Rk4wUN$XWj_J@^f%t zylJQO{uSnmJriB7W?~k)z=pf*EM2N9`2I;U1#T-ffM9JHJ3Cf=nA@J|*WD30K!oS5 zxH-Koj-B8rANmM)?2@m6?-NM*^Ac(V?m#FBX}8W?DDFIR&3>C7evcdc<_(esbH6N} zfsrt|7dFZ8AQbUMj@dlqF0FVJjC2*dOuSvcB?a%V*P~eu&yXC+3q<&JT@VaYV|^O| z=1pbemEA$%6kxaten%NqrOS#V!vQCHsW$x1 zHms(C8I=5oSIHm#zmx_Zi^5WZ`XpI+WJYm`+h;mY9|E)i!LU{UdW8DBk+tIqkln_L zZ1G!XR^pFk^ zq=@<{B!TGlRG^tlq3b1re!eEf4@U+!(~zAZ9^aFa!K2UjspbH-t)6o8&tt?rSS@ZZ z-eGkvqZtEljnvAZT|{MyI(qTaigTnOj2 z;(ipHk?_r8_v!dsR9bRY+z;2qFBPTOmR-|nlXx>^@Zq4~OB)i(`nR>8th&Y#*pKGp zNms=KYy|xENyIBWpT@m~c!{Lt?is+m@PTX?VT4`YGzmar!Y=j+6=(%&>rmJn)7dte z*ro3^pM6D^zFR=CD*xMgvVo4!b zL-|5OrSL?XVo`z{&U%xQlG1ofW`q_>sHJdyd->~ggDTmcn{eVgsT*@oOq4LXF`~#z z?M@kA#`~yz%|??y0j*>s?>JbH@M0jha6*w+e>l4y7hs~LqUSU`wEPvN>jit-D`Y+{ zzf<7TOvKEWt5nPifsQxN5P(s?$NWweYTiE+qv&oMzn_C;&M{V4g2wFFZ=$wFb|^Zd zPCd|!cF@p7)Eok`Qr!}Ih-j7*Ls?!Kl^~cLoQl025G{@UN!|nGmNw7tz`||pz-SaR z|40Mw`9e*`qFq*6`V>hd$8)*lS2Oy&w^dfIvf>#@QE4dxk_e60Rap@~cTp++FZIWU z;D4B8vrOra&oggsdkhLBzB8!;7Z*~*Wq9*nD*Pmfz^9J&vSEqw^u z#nD5H1m$ht^?gcbD!l<U7vFQI!9< zR9J`4Ba4fRBh@z^Gz<^%ImWyHP`kVud}d90@$2-ZF=?n4OR+T^ ziFp0L7@*c4auZ30KI~f!eQ#ad8XB#XK&B+|)CF-BRW#hQl~;@zLH(Xpyk&*-$_|#Xmzlzc4S*^0TxYXSEIEWa2+XlT1U$Ml` zu(hzTaM8fUyocl*gz4U3a|Fm z(RH6B6rTxX6RpaMIX77Kq(m^Xm>Vwb6kZSJdE>W=E%&uEPRS$%(4k%-4 zhzZ+%?IPVRzUPXqIu=+eqgZ5HD3&pCei@@{EJ}*?cKz&9 z7n|lt3XGzclrhQg7jb)N_z`O-#uQz!ZNlyFP0fDeP>DW6A?tZVgC>Jz0~r$EmW?*f z-`Lj)DpTlq`-c-rQ0kk+uPCV8gd_XHa2_uqWDF)h=^Ur zUv@=PzTEQ4vc@o(MOSd{Xn6T@rbkU8uaqFe(C_-{rC%w*_iClkG(*HAqF1lrkYzdA zs6V0rCW@4NVZy5=VBqO6zVs}*5Lt$E*BebVN?Norf9fZE?_By^C`R{?in2Z`?Q{m9 zcDxM;HC&Nt&;7yEGyAr{NzO&XRJy53*S+T*OSrWu7h;Qaq_(t)@ zq}3->Iq>Z1+Zq5mZkq9vP=+UbUw@&)M~6gN3a(8qXjFWw`3Z-_|;?gmZZnAfA4wVf};4|%nAC~rU(LkYoHG^5EP>NYL)cF>P zmi%+pld$u8vHY-enY%#iWTYX+yxk)*W!h)(#gq|@@;k-X4+DGou%vw*`2OV% zJnBm#eQ$pHEMg5xuigegNB$1J>S&2Ehdar9dkAk^(z32k^`uqoiukRT1tl!bSZnIt zv4*y`wn=ZShJXbb>!HMP11Ji#IotU5hjh!?y%{vo~b>Zh~+B(=&lDzzUxqLPha;LpPHg3T0( z{D%dIXa)I#uTItY;cTMaDAu9e%lcO^ta*Xq% zx5Sqv)0+lTs-*OXjeAqDkPcb>Xo6D3LP|M{vRNhg|H8I|05ZwFoG5s{gPKh6UvS z9(HaJ3yga={Jca8D+7YT?4x<_z8T<<*%;u+cf*HzfKI|&jsy48lS9Ag+mN>n6{w>Ucn)f4 z@-NPcr{O{TJzgSP?+N_DR|qzysEE@c&$)y`+3rz#j>vJ9e1Z1VVIe>)1o-@|CGx~~ zM5+sSl-iLIW~hOaZ?<3Ej4fV@;vGEEPA26EJ9xOqF*P+YF`k~4v=n`r_p3NugP}`7 z8~Kfc1=Gi42wfsvvzzD*j+7?Yka_c)Z*8_wDb&T3{CzJxuI_!A7A z_$9sJpY%E{;r_3I=0}ZbdO1}IB^Oieg;?6{Z8(`*@yHX2i^qBY-L3WRYarx;EG1U6 zWM;9sYh5zrnra>>$X9Z0PeA;8N(DX>eou{eXc2r-O!%|Il`Y9Y6fLxS2~lfKtNyrW7Yg&6|MslsmN?KSEd9xPS|#NQ>yL3cn?{zUIYFLKzHx&Hj2wF3OWH24UZF6v zP`BSDgb%fLgyuNTO1Jf67wm}G-Rh%H8nI&mKqu$?<`VVkD47E_4q4_%o39{ zU+{nBAc`?F{dK!z$%PbVCRL?dU$fMVJ*z(%OqYy`4d*$vspk69B;b6cqm3g`OJ8LN z^OK^9O;5L3CL@;Ng;U*O5D}O=JD)RbNhz|xIYYm3(_+FYQVo2re#|8BeiNt?^wQw_ zBMAS9!zXZYSVhkSml6`uFGMZvyrJN9AG>6(ild=66IASviIhd_?Afn;ZVCo*5iprm zoL|znni6H9Kjq;DV`WHJ5$&6D<2vIp(=-MfuRkL*|Iwb$#<#2zL8EgHTWBF@WGZht zgQ04d`@iLW`C;7rtGJCn8PAUcgXaPE-E=(k-==ra&$W_L!s*#8D65one=^QWacjsC zT!oR56HAq8BtUBC3uAPdHYAqc2H>K<+%viGF+J%*J~4?u-q?MRKQ=jGF&j-2;@TD3 zO?wU7HDKc7F4N)X7ZT+vHMn2HQ+#20mZPeob-8BfZD<(#tEj89Q#|pC0jz$tHxVGT zpM&4_HPv0%=8LAQtKVQvXb#Ocstc7>D`8JYszq)qOM|EeBn^v*>d#x-#PbVFd{#Sq zS)#n2aTSK&z;BqRZkI=U2UeTtbJGapkZHxlVA&gf!j_5@N5vv>-{?f9cf^L7zrz{N zr%ccDs6pVB?CKwD1#D`UPy&MR2S34?0OB(2#EHaUXYFm=J@ID;oL z?mN#j#b4__*z`qL6Bs?xx-3mGIL6-3{+*9k0>vF!d^LC{_WRi37FJ|yL{-I7Xf+E# z_2+)rmW@81StN>#ex~t*;!XcP`kvznBL01<3>`;*d?g*I z^!EXQg~sX0->1)b*#wWTBGCTjp(VBV^zW+<8VQESZ$$rhvvSGN-xeL;*(ToE-nL4y z+7%P=FoU}2t~D(rKgt_3S1Eh4hUAQuV48rie6b? zP}&JkwZ~LuKVbg-J2w`%iQGRr$maficWdvnnJyRN^HfwYm(+^8+wtBQs#t%E$3)T4 zxW<>cd9iJ}$FeNnd3!_KJj523cC>n5bUhF>fsRsnB}nNc^A-q)B;>p+ zogJ(m4gqL?bAqe9y}iAioy2c2KeuPj&jklsQopj(tAiJ8_NZ*qGw~kFt9vh_oWkQc z?DdnOxFlMFAvpwEct1W}Q(y)B{5Z@i4Dj+UFvH=D4$^hg(tBItM#BMlw9RAX?27*~ zaV|6&DsXftSvbvOlVDh2xT5V^oEL1oOksR1o)g`4VOc0A;g8K;73 z%FE^Gh545`^~Y4xtY*Y!Hr@fx(uG^y`)?M`nh+l+Q`RVt%_5w}_^o<+dZEdpE<;o% zkB$4kX5M|C$`fRLXDQ+o=gK#6vjDZQ`&VzO7cX8&&CIxmq<7uBMrIzTG~hoLbk#XJ zs;{nB7NP_v@IMe+;I68g`Y*TfJVTdx&g!bFe@)ZKpVj?u0<-_$n77($d#_Gbl)|%k z@1!@|DH*aFXpbmU~j#rFiR;Qk*@!>$1kRIKZzmkR|A4A0_qL*N&q)| zNXpYXpYO@iZ$_m?+_t5uR;(j%poO|Rz~sHpGM{c5iD#UjrBsP0(fqCCXXMh#Zl%LB zW+HISyv=S%;au?OdSDKA%pDyW8fbPwCeE;he`SRnwV=e=ORtBrJqZnFRu?!Io=G*eGd^PVhKJA6h zb&WNoldzd#p8Tl(_Pa4?F!*wmC7s0E)lF+_W6hg24u{RdW~ZL}v42bb(kmrS2sBv2 z&U9~f$Km1aony(~xgs~ar%wyQ$a9IWYJT{jxUUF^-qnmO0dO)NJjZSo`lxLmSliz$tJ@Vji>MR1PL{1VKSeq4>M@4Lyn;Da=L#eN|hl|`_=kb z1UT>Nlatd!k6A(#c5TaD#KKYomHw8PYC|Fm3zGvIga%KSL0cN9L!id47GIGU0(yEGe+cm-4?|7MOdibK912U*w} z4`9np41Vnwk8zdB{~!(qG*yF>< zyb`1~*Yfb>3#F&jbBm@mtXoD_!Jw=!skEA93pFgpW4pPtFp(~R^{_O0(Nme8kcUa9 zT&0sY-m0dvrL|Nh8!NhxiUdAeYG=YE_UkVcVk?EM9mDN)z}|1%?FCNU>RVnD^C-nR zyLEQiSgh4M>qCB%fwNw3YC^5<2eUNG zq29llGg4ZTT$4iq()ugpsYdz4qw*;<(^!U&M&w;R1wo3R z0<_)GU2LpYWJtnnIHl@5l^c{n5!5f(Xg-?3o%8{-z_o@j2YiI=M`N?p)eE%zAsrmV zhJHB-sq{Ld!ZvP7{N!_JO98Sq5VraqsU3k6>fIUJvJ1vFCHlsDbGS#Bn=zLGJv3^X zK=u(}ZFc4(MRu8vQw~|Z6XteW$k;M_vTL^>a{uk$V)7pexF^lwU4c;HJS3*fyXdGU zE4_)5b5I}8I*rJkH3&N;{wor)M7OuL=EFTdNNcPfJWjGK-v5Ikpz#o#9z4d(e4w105VN!3eMV?j#tbrKR`x_s;_&A|f8E9F-KAvE1US zoI4?WHLaGDp{4DCm26T}RHT^7YqQ$g^ewkm06cjX}P(=g1tmF6#9Lx~3A*3>r@+Azi)0rPqoS z@D>P1cN+Khz{J zJsA7RybBxhd^BGeOE_KT_qiQS3)-skGu(WHfO8E}F*tQzgQtW^Jy30v=8zW?W1p72 zIvQ{8d)oxJ$ml(rCQha8U2(q5#Z|W{y&qWE@oBR6Z&q5Nx%-XDHxp(;@cHLR?Uejk z{h-wc2X(ov(ua-7@b&!bocHyi=bAY`n*eS(RgQ{9PYbyK28K94b9+-O2B2?t)Mm0D zaPn~y2TqdS0S2f!1`;Pr>a+si6IC!03~&2>g49LH0@75PpZ!$+5p>mVXIp17_|cx4 zWfYN4uJ=$gak7GXdk8&$u4ro@FbbHc70_&<{SIFj!*k+_y=m1l3{qvfz3AuvGiA>Y2Qqus~f$yf6t^;iP0GDWC)0Ia%sA* zHn`_Cx`;>@6-6%!8O5;4l?X{aV=wRdJ-kd_s01~hhraWg(PJx2bq0pEWfS#HlI z(KQcGj6JL)C@dKHm0pfMzl(h1k{>&>v+g0gr`gmz6}}GAKeC8UBJs%ort>?^Kk!NHciZrr+yWOc@uUQRp?~bTb4~ zOqn=;bX=PZpP||K6eeNL`*COBb6_^E{JJ~_OH#=LUi1F_PAFj}69FoOZQ2Yb{&1ic zeWdt8Ktj8_;UdI<*BVB^S#zVsP#!v+{}F&vXZ3^Sm8j$O&sT2;-g-d~=m+Tw2W#9CawHX;d^U$>)3BzABJ;;=3P_2lj0s)Ydmtk2QD%5>?=4(C}7b zqd$4+QuhUiQJ$8~C&?rM0D0k3%cZChf+Q zE9A7@M07%>+H9J^)@MiKaz`H-+@YpB9KbeNu@@X~^LkDQ9TS;7>@U~6@oIo`^Bj2! zeBD(<-KKl>`IqJdiOUJ3KY#KMx&|3`apYI-$LSP(`XkeP?BZY`^Nl!pBz|j{o;>h+zC|S!AjLCe{M;=nKrE`FZqTIt zSB+q4YLCZXn;P7xz~ffn;*Gf92YRNVUcH7ATlX0{s^Y#DPT(H8QvcsVKA+; z?~k0}6s1McF18-*VJQEpyPvev&to8e)9LgrV!_Bod*zh#HMs#-wDb9=2Dab~b_e$@ z?@Tpe08zYf3 z89Gp?7lNInk+84!Yq%a9nq8n9R;4se)6>%Nr?K1!QFSw6Dk0WdBEk|*xbk!^277_) z?d=Cn`T4tqF7fk`{Pb6$_*4cPv`o(28;u0G;$lU5wh)*5ml629f}j z+cZF$3>}i_GT(09dN-EWOD6N@XJ&iA*TljiRfEW7VjKHTvV4>mG2?+tsKL^N+2O;(vCR^ueP&Kect z(_RvINq}vb`EnB^IflmhWPlnuTb7DsDhaP8=FB5^0nWJ(GO>qW2ZTT}QZ)sa;vCa#=B@F}K1S&nsMAt?UhA|S;cV#IEoG(4c($I4wABLO= zL>SmJYc%=nw+_6rOC zvY=8j9W!Fl>t&ho95@P&I+Ahyt8>k7s%vUQgoUN*w*DDYQ4QTn5AT{>dbcX9(8F>h zQ8(zZGTxvRw{JeGUOMg#Y@w^JJS6{|Wqpo9yTMd@=S?fd2LpbUKk^=dYp?RJJ%dn+ zLgDiF4FVZ%$$sU<-URKVHI(uB4gYwaoL<9|s+94t|5fvq5Qt}#4DCVUjMIFqc6?IO zqm|YXFCVOw!ed1b{}8B@mYz-}`cI*D5bRIn$_51m!EK2gTW!U?p3zaI9c(P+zs0(} z+1}Y{Zf*`2G*h&j|8}=uKqc(RpsJ^94fa9b=gb$)57!Fr+kBqW%}#4DR1-L&|xsi-3( z_P1}cIIG}4xZ(EoD=wCA9UROv*5I{S{14c`Zf<_;(f=ngF!lRv0`doXN)e|2V2z#F z!e$+u^m+47SDD5~QmL$ug&s(Xi)TN6X)rf~eEROJ`}kox#NXfZgL56FpuPD+>zU)~ ziqzvst59K_WB!3o_N1oDGtVvpbQvBk!?)=kuXu*5lv122EnmF87N2Z*?9;5#75D{C zU+kER%V#AS6uC!7Jlc!yA*Zupt(VOIlGtu91AwJP0fo(rJ_1#^Blqt)y+;MF@*nF` zC@CNyaP2Z<;Xrdh@3b*qT%rKjZypn)f|Z_jj{VD`+}O-SKtQ8lAgnNTJnVA%yEJy0 z*LDbv&9!m}^gpagYH_7SDVpqq9vt(E)j=t%wpf(#zPZhe1+$+JJ{DHTvbicEq)YD6 za)A2wfbCClRwZ+QX=!Cu81KjXP2_*wV0E%`UsPC_rLE?1MgmVqW3kx2b(WeAFBQ{q z($?+;m}9&4U;QoM^SP)*87@=|_I)b7!d z^CdgK7$e1@6gEGZzqG&GCz(;+lVa+>)g-yte)yzo4)@1cz!BkeQyD z3GYHlHB_Mwk_W6#Ick@Cu^OqF1}cm&I1gM{l>B35)E9GeWV>YMmliBv935F(xqXcz zi|AC3d6w9(qQdpqxN+Q>eU7Tf^s_<#FGq6!2VbrxxGIJVq%vMHKvrepUTo!uf52U_ zTb>kQV4EI6R6tw04Hh3kQNwuHvm{}+pA6vPfug1%wGnF@n}4&|S;X!1CBrTplkGMo zYxzZn`a$w>wAh4pv!A8ZnomrwuIfMb&2(C(5A+s};qOF~d9;w37k-$75b zN1IEq2$A?JItJJojT8PM(*SF0YpJ?v?~wEy*;XyozxhlHd3c2QcQNq^7d;pnm5@(A z7F{R~7ydy((mCO9?-_`&(0$eH&4p|o$vi;{We$M|tx{Qx?{QnyWnC6#Yu+L5x zbjApm=LM%v zaQLG!R(5=8V~`|D5X+Jy{ahQc|7;VPDw*?STvx3~jcmwCCa0M$S&nJz`54zK9BsfwkdqQu&xuL9jv(%17rps%wxL~+V;br9 zK@UpI93&x9rer7_lj2P0 z=C+=o8;;>(|3ho-n+Ev?$PF$$Xd$09z**n$VyVU`3kL?Bz?ratoDUi2Lm8c!QZn9e z@>_7t5+gIt=1SNq*uo*N941QGEMEVhw0~URTG_#?h78BD`E{YG9t-*cWM;CrcBUHT zh7#c(rxO(nqO@Yj(RV?I5%IjTAhDW4SLG=ad{H>2T(+B&d+1z)_5TIU-Yn%SjGC{= zmI2AvE20_5`DOGz|D-oO-Vk}M4|qYeR{=?X;UyDn3F%W#C7GA-Cg-nuw5NP!O0ydT zC-_?ieWs=cuOlW*nZ*ezG=68v&t*f$NJPQ=d@7-(Tm=g4<@~oduy}$|7RoG-56T4w z!=i=nA2=0Xy?|+EpSnAT`yhkX&oJDD#`StwkH8zuc0qQ4pLEubZ8h&9bKmQE2+Gix zcmeZ)4KiIx&vpX(2EWQxWJK=}wIn68!E9EFoxc2datr7Py}{>g+o!93vwg>-ME1eZ zT}Fm74A^Gu;CftC7$nXfz54yt-%0j%b7n0h>{!tLjy;H!`ZcyQY4`q$fM(xr0-eyg zW5P1%ciYlU5P1v)cz4D|V|cv7^|%bUb+BODJtv#Ab5uTb#$(}{`jFP$j*jSZQcWCB z4|)aWWrk7%!O7Zykxpbfa!(E%s&II>L>Oj8n18L6>Pk z_7^Favk91pT>59z=Ik~x@v$j>E3J=4rFkux_ns6QF)Wl;R$se{!)R_lU}+RB+kStU z-EAjsp}SR{n`vLz<6*e=6qyUZI&kPBH!+Z%;-kx2oLK-M+C}@+`=%4XCJNQewpd>| zlYAR`9(T?jG7^W^TZ+}`K+qBgMVpB`N*V)Cr6e42#_ zIK^nlNsnCdxl@#;{sDFs( zxX$4m<(1R$3&LXR4dOU$4OIdS!afozPcX>nl^JFqE@9u;;bYEXr!Q(G&&6Q0_6h|_@j?HXd;Z84S$uN#i^a#j`c#w~F?kh ztg$~Q*l!jB@ME34e9Mn#c{=o zgVn#u9}dqfnu~j*Z-(%^)1~V^5uVs{1`D;)$%Zh`)x2M?_@#p7|6bd>X_yT&UP$bM z$raOF=k~VzftAN@TV{qul^D=!oB9U$y-9RahF)o9XTXMT9Icn?N1gmb+f~`rq49FP zO$8EXn|zS46L#+*Q^_L5S&`Z{dZ%5-6$uyKZpjZIk%|b>;A#tWKy4#VEDS_A!E4gT z`ih;MB!Y&bVHH9wq|4#jLx zb*{o8T{AFi?6efi)+F3GIZN8^F0uFiJuiOX$6xko>4^{ZhAK{&<(s4QkcI|(o!z45 z=k+$Ldei6tL~;n0hdp!O)`uEux}1wrxfF#|HcbycL~gA)yKN%aME%_Kd5T|Q!#z|V zb1_`O{`H)6nJs2vG&RB2gYWq}Nw3z4jg?6}pDRlb<^m=hCEpZNI7RAs{r`uyvkYo; zd)qzT720A23KS?%++pJmE!yH%T#8!>#U+rGQmj~UcMD!zLSPqn4GzJALvRn_r2GG# zbH1E;XU?2CUzo|v^DNdpOYdv_?rT{aT8g}S=nH}k_{!?-Pw&L6TZjFsMTIoneWyJ^ zb6GLZLi*G zNxuu{Pk|-syJW$C_Hu7LNH_u@5Q{9l&Nu3fn-_)YCDhaTi^mdv)Vx-^^DS3ELgzAK z1}pPcAFka*jVoYEh+Cx#w8+G8xY2H$C$mVUqJL`qyM;HQ?ny2{$%fZ09ytV}T|bLR zHfRViR=UH-4ucC2O8KLExTMwViZ_y_(51`0LOtok(8BsA?i|1Q3%?n21h+{#2c1g- z_EKx@__zc+4w@*^fkl0s`r$=b8C8lfcWPq3(}N{g1)sbDi|F=}Mdr!b9#;h#C&!2i z{dcwU!|q`2@0EluR5VAI&9tOU_X1w)x^#g9Kt|KL!mf%|9{&}(Em{hl#l}JvWBpoV zUB6?9Q(K#!@28K`Q^rPcRwXys&{M5P2+F0D2@SH zOo`KZpw(dDC(|u|W@IjPR&C8zsPQFl!c${?TjPJM?Dxdf%|_;1h`6<~1tr}+MXJJi zPcJJgm9O%5MdBUvKTSf->rFrITd;tLtS50E&o-5g<#9x!Uzxd5<*!dUA&YACue{P zGZ=33w=|E|rR$<>Jg$7t4t8;1UDWTvWk<w4GMC3n zNJGqA%G%Uy<57d;)SEvBw4Xfq0Eg+y(hR6X3Y>9$yxIS(EbKcPeWI(^j!Ajoc#?3z zu98Sph=|Omejzdkwytr-(6eol+Mo;W+*=Mx&BPz}q80s9#i9 zv%_D4tFimFhi%4(LzAI-lNws$Y8G$1s{DnC2b(dPS%ZGkrKW9mmLrkcClI;Xs-Noo zz_ahH?VJ8VPQy-5g8=YwS7ha8ep0TO(&eiV9>@7pHHY3UnB@GI7`tPF$bkit^&iVU z1UQh_|ME=E1FiRCo$Hk2vye=u9&Z0NKl${wOTvHm6=iYp@$pr|4yCS;3GM$1&i^6J z^~)tKd&NTj?;|;&7yk_>=6J=+%9ERuvx2$1#hx638vX@t=xL?=nC_?S1&7l`8f(j{ zNpCwti8k09fBn+@GN9n>I9;AvTU!ee!>V^!>Ey**=e)&^mTdqTHnQKSko|Lh`IV!l zXsjOwyhPHpwkk_uk6Qo2(Tt1qu(r1DgXSf18~^D2BT(uyTk)Ov8wXXt%Hi@A$&QbA zzeFujm4xkbWJgCwqfn@>TTLKa<1g)&tugF@FE;Z2@&z)#r|^|E!?QKR0Mqy9YB&lC z3f};%_BM#T^VZXwp45;rJ@}~4$Jq@6{K~?rL0SrK#LYP-CODqaZg`x`yq7)1!#KK-+)#CEL0vQ5 z?QmS2j|_k6U^qpLE5OhHO7;1Z9-zi~ki$SA?vXd;=!k{9CI+a|F&)>>g;$s*0SP{Nx8N4n)}Zc?J5& z1*`eu_YvUyL#kkQvqA6`M>94Al&mUAi&Gk<^G7*6x+-7U==!(k;++3)IZTgMycu)_ zTg?Kq64HjvgDtsfO5^1Q+?+G-3Sx;gPJ4j1z{WOiVxbnD;<3)6__+LU z_&S84URX(j{HbnQuAm_QKed1u+zv+V5YX9$70VS0BanqHr=r}X=S@=R;bn$QdE%mdq@-ZW z(9gj1uu;J9ODzC<=)sanr2w*n&=cZqKcYog`H5_L^DU{|^ zTl=v7?C9lB>^)ujb<e5ax;ynDf(tIx2Da7UEjKaXl)_g*u2(O7V$grcaS-d=k_f z^*lzeLS8B#veHjZ0dvwF>wTB+Re@Y(;>iE?>r2P?XDUfte3@6L*o#+>d#JIrMG1t{ z_4YE7ikw)`c65M1@P}+S)%#{L5kmQhoUzn*mWJ{fI2>LW^mX7vTv{2>qDLOueJtl4 z1+UploYFkkwoq-~6)-aEW_*jFu)YJ^j}{mZ=Gdd)t|abfC!^elu*Pns z`$Uj~O-T0l_XZe5Y|?|=(@<%vl)N!DE$PhbHP}O1_bC<<*@IZue{}AYXBPkY1sZqz z>6*26UibRt*nswcryAJ^#~yG!SismrV&Z_n{eU9jP8lBHFa8N7S$`Ki_joG&hSKBI zpBcfn6y3Q9;BaTzt?d^iC@cmhscN|LBpOs)!~XsdNJ6k<$YQ6h4RYKuX?Ip>*XU36U-S;lRw%f+Oj-;&@ZUcIYz%-4@z3$oYN{Xtr|Kbxah ztwcgVEhM%ba-Kr2fR*(Q9gJQL?c-_c5Gox~lD?!zcc)-)N%MV9bqOf`X}Vinc^c!- zVT=DPxjjWnPCR%}CO-(4@PvgP_}$`(*alXgiaRw4Xq+72QS#brG+2D2;Op3;dZ|KN zk5T^KenKzCVXxVQB6l6~lZy{rQ}al-Ga+)!tf)9hVAmn%F}d0v&%ay-n?s0BS=BRq z4iPY{02(2lhj-ooO@aeCiW^t_NPqK)`nmJ_VpB_a3**wgu7kq7(~1^V56eNf0CbdR3+=ZZJ_S ze^;7%q)e7OzLuAOpMACFbGq=EfLO#2z$rn+y+?)abi|9L>((n1#~NGDkAIyPI?Yr{ z0WUJdJ$G9?_ioPjSm8|{-oNit;f2Agt&|?*a8Oxn%bR=Z-nz17w~J1mR%E$^A_!ux z(5f+wz^tfnvIp+Vap$L5S({K@>_9lo*X#Dw3V!A8f9e0 zbm+ihryYwi@S6(ldU9?~`?4dQ{Re!P`7uT%A5q-d*#{0J%UYRIjO*{{*hv$2J%;9T zZzzYjW+%7G9@>FkmlEA%s3p{U2)M@AKQF3D+9m1W+U?EpP8Op|h`L|fxmI|mcSBcnLZd>!?E3?}0%Q#S zhwWl&=>4LUvF#bD4ZBrU;aao;bHtAgBs+>S`bW(bdA-4NInB{8FFX|r;SGn~90AFQ zX`9%Ld(@i%cI_XRH4n2+LoW7LYd8K$g?1+3%eZ5*u680(27{WqgA|G+BJU2yrCO5d z(4il5pK}m~hM1&*kw5s|PgX^b%kNQ~2xjs1*U{vAl_pxKhC~TWSm$rzpdgiD_o@9f z7x`g>O&DeX0JdRvbsb;|$h=UlOGdeGTWm;6qn3Ua_$pPhd0+Rt3JD3~aBR)AW9re~ zzrQ^`SxyzO!}NmDN=8QWGv?sC{aVi{3KhB&Qp+!6kP=R!#iy03yno-vRK4EOUd*Jw z4h5|CfE=-tjrnUK<0L-AB%TnW`F6|znaw%>JpZ<-izld%DLrAAQj7PHklZGMldAHD zw~@in!TqGfEs2K8S{uz_y%|{=0g%U~X{j;(05XAxOfWBcK$RB@25&gWch5R=Gef@n zQ8NZWW%D)$Wb}$PKH^=}_G`7{U7C5@G`1+H|2iK;ATYI~(zgdL;IfFUKK7QT@C>$g z66^$b>^ZAd8Z9k%9y4c5K)oCPMX>}|M!>_qvFqV25nHDhx`=~l6)fq#$(k*~u`8)< z)F^T`9JhJk1b`AFHt|X`q=}7>@Htz(e)@+DOJuiW6RHIaVcNM8oa4qxwsUo+msnhY*Ar z!L+WuNXeYF2&kjrhg$-2%e3&CD+$xI4NEEIMt`kj{)KADi4oQFteU3xure;th3eYm z14aT|E!unm+v$1!6*4O;IvY$QLE(FLgmQvBZB>@^P1hj!;a@E!3hLL~VOdh)89CF7 zVMgq9OMA4e1037k+Yb{DYu%5(@m#D5%`U6f*?jrF%3cT_dlh>om)N4q#Jm&7XF$^_ zt6w}N!g2f@1LNn40JMEqxna5@D(e4W8ec!w9YFy;?xp~NKv7-q+)4*pdnR+Bxo;C8>$xHx!_Aa$!7Diypdx4CG75+(W<~lb-n?_vY zm9SAwQ=UcHj9VGu7~{8)QtC55vG?Y69G#1lLIBUE6bgr@R5!^pwwh8Al_EVlPeMnq zS1QlHdO=xh*6wEG*AdKgXWi+$&_1DNrD^OjPD;sht?{uPbQhM6Gc|c-lvz-KW+G|# zJA_q5>KOSAI3fj<>((MG-OLItBtWXomvzM-PJilENOn+ThIZ5(!!YwYSFj0QdI zPtM?vH?v~t8u~Q#HC#7Qc#O+{%#$qqS5of!w5ZZVuN;nq-Msftcj|gYZAN#SRt6$- z#6;HyTE^5f#Z!gRJoSM1p4GesNiD&@Q34; zm|~2rt?%@LvB?W%(nKa#*U>kHpQs|6If@e4EA5YVD;7&D(8`HS|-<{}A%?;O-1+N{yeL9`Y2;`PR!Y4`FU3`}F0uVx;nz0C ze^HJfwRCW;%;{Sm&?fF)6xy`)E}ayfg?u>vjCmL6czQU{Rwb{fQ7I3Jh$Jt}XB{xb z1TXKUC3Bk6>isAkYbRq+@3ED&IcbG@@6Ah1n0)#3uz&f*6cLHM#%^$Va5R-rY4q|* zPQwenijfl2meRjJ%ku@u)F%h?W4_Pz;EKd~jIO}4PRXr?U}?p=uFQUx1iOWcr4P>% zB8BJ(4|GcaakirnvJe^7zFNq<`k05_;nsk;rlJNsj++sFNFwF%!n%oxpI6E6t6J9)bUAhMG&2eoZ2xWMi%a-ha-qB_@8CB&g!YYHQvHs;^O#YWkeXZ8;J z^{$(E>wTF?)03r%?Yb@jELeb|Xx>qV4m*jki~Ux>iKQlSsqG;a&!P zPD`0(bM=`dC@vurm4pGAPG|w8VbmktI)x2L|4}L`hK}g<-^c}QXh3(R)%Zlf;E`m^-5)@~Hw z*mJQm)dvxBBt^ZMOheSl1*sal8Yi{V>)wmgZlq$<-FQv*r%msJ%ehm`KlJh}k>n9= z8-4GEIlX#t{KXz3{eTAQEmWZVeU$BvJP`@;&i9B<5a-_2$efX(W22V|aG{~8%6+#K zxzto@`(@joSZdvS711tI(q@JqGe#k6(}l~&3pa;I&3grZPrC6;;I8~da(<+zUpSiF z));MO1O1RDlRxl}c}ERph)907LgHyD`}rd62_S=>IhP))oP}12z!Mtc(t!U(5Tcmx ziY0e&O3R1|Nf#Vv(IQxY67^{OAS%YJnHuvkZ#3Nz8e-vs%Vmr~P{>N}>WBRBsoJOZ zQm%5@Zf%z3$vgZ@8x2U%bNjfJyeEu2-K3U&wjpx6UE=lB5Q8ArYQE-#yCZWR4l;V& z?yT#iI>qxF>?c8khNiE%QAG*^Z#fPV{X3)QrrKgHXPs8)ExSWOUk(y7S+;j08 zQ3LfOkWUdcK0{=yH+TNxD^c&b8w*M&jUx;KY&jwl0QCiXBUUND7t6j36y$3cs)&58 zcD)?DAmb2d|G>_1%<@La)}!ae*zwtmOA`MOY0weguQ%8U-{0fV+%ir3F~PmN?)FOV z2JhZ^##6dH7Y}L2C9-q+Qt)hPJ>7ihblp3kqi~ zK`h0Gu))53N0|~048#1dnlZAh^*c=#5yU~TR)wbArCZ3kzP;N?R})YSy#_gFb_y8y zMLejdIDAHDG(ItK#gZ9$NJs3LO0hbqhy{x+X0R6S-n)Vy?<8&S$O6F6@5AIym8hQ= zx0R)(u02mVf3rIZYERx%vAJUn`yeQ0D9iviSuMOB|h;v$C=VrfH#{*x+b<(}PU>WsIGT$ab^Ca%tvka!S0fE|VQ9cuW5=eh%bse>-c?+R4LWw^t zJcM4kDi0tRo{pnIsGj?lTiYyzdvo**oAr=W?KDQ?g;lBQjVk_G*DK9d zhRq#-jN3o@N>v253D51N#KEygQh994BaZECY@SIs z_ZZHvH+qFnbk4_Hl<)tFop_>TV$m1JY7oTR_?6P+CQ#XNteq5_B%s9c00+Xbbgh&1 zo>QznDCi-<9S)99UZ0AL3*rGses1WijnfG%-C~G?Q~EyZtx*8>Nclfp0M?=zDUX%g z=7MmE9%(LP@i~LSXj?bi<}jRHvJG-Q<^Lt3(2B>lBfow7*4iqG{bz!{^9ih@9836f z3kzFYTa#l%=R6V;P~X$d#BB2sE(+qeFsx)p)gRH;dN%m4u%kCteXvuUJ<`|r(-Q|< z!Xw{~gkm+{lb0WnYikS?FW=t9j>+~oP%h4=BuS}(_yWm~1EjWzw4gM{ z@jL}HGg=oBxuy8W8WiWGQ+dDvSt4^d-@g?a!>WC}H-Ej|n3ZfYhdS2^{OM>uitrbd zDeYJh4n^}K5$ya3M-b5RKv|GV?R0avj7E?zF*TL_5Mp9#O6f`G`Ida;PlK4PmCYCp zK(K8+ExVzyQc|3?#`2&(>W^Mmb$G(T`|lqt2%@g8-X>gJQsn5}tVfQOTj5by7SmM4 z&DYz;#buO0$}ywd7b}Df^wR%HMNv@`q5@+xL%3RMx&}VwRa9^*PzXg}3oWE3*6UHT z&QK>e4GHOvkHpeoIh#9X)1B$wn$*^0T6!;?@{`z9%F7oAI4W@*sW!-`-zOPR3g+^$ zzbT~_FA4No!uhH=^o|*)3=7U+Gg`>Le#~9`>urz?O=s7CPK@Dr|38u^{|{+H{|goS z?^2QBIdZIxm$ZY;AgJ4E51q3N|2(oiKlFRwj~Jp9FG2CnHQAX)8he?Oe_D)f+M8c< z=+~g#=6GvJG&BhGg!w!chUKzfKQ)N+DPFvGQXSbCd&ZZ0+3%ArdpRXe_+m!Y`{W&u~C^g&FiLRM|bJaUKaf!-eGrCKKs4U z?~wbR?ngs+0HC&4;LS%p^f(0;&=~m_HyUdaJkw*X#@u^4Y~24)is2CQ&aTd6+}g$L zjhTi4OXfZ_x=o@Y(%iW%wN3(WE9t7JngYr<72|~2&vP5jB)!{GfGfcoj>3^~)OW6H zX3NnQplDfZ!2Q)plJUi)%$bB#S^h7URM+g+y8@T{o?12z#cM$Bl8IO7;{m$)i0e586F@NV&CadD&8+vKXTQ=_&^GBD{h_I0Nga? zWt~%uCzb9JqtgHWbX$~6?h_%Pwd|rl@8u8@d444B=`I)dZ}kTgTs2K`QICu-+u)In($f+e&ZG>)2`I9qG!IzZHaR>A zG8u{tN-gw8!eK~q?ogjSax|c1G2gf!V{;R?7=Dk6T6tw^_XE^@n*y|5hy|^mkEW*v-(Qb8 zm&h*PvKPUmM-!9qye$d)Wr}-BxHT5(QzDH7o{ZRL8-Qy}7BaIXTANvlAmBmHDR5w81*R|~94_^ng|9*(DY0v+1Co(Eq( zP5$$+)HxD&9d+gR++fqagN`@5Z+G;MQ{vz}EZTiQj!p?bMrEkGK@ zO=8(b6d@x22*4bg>3whMTqVOk$t#~hy5U@C5T4*dxo7re@2so2zjt8(cCo;p*B>~l zj@dEM+KU|puW%E776+Qy6Dcf-qE@R}W(UFZ|72PT$=Vn3()nN)7+wprkrMDtd$vEC zGNx|>giG#MM{(V3Hf313W^<^*)%p+PTgzB^F&ocMlKTY!1TC`)mNWqwo@*TBE|wVHT{sj4HSB!DAne4Oo9?p^D5iT3Q85`n!T3_5h)N*KKFN`&bP5 z`g>LF-ovVywS3gJk6m+;lfAdb6lg+H3}Hn!ctAr9vf+azV^N7zjc+@Wl{|zy3yn6` z*LB7ei@(bh_KpuF7c`K7aFv`_Wb7m+3u#_MuZRqUreR3&$;xFC)A^Rt>;qFH zd$`60cfxsc%BYNwCdAz7k{odNO(HTrHo=%bed6+tQQxP|Or-G^kGA5D_4=;Fd*|hX zc>TVJ#mZmp+VN5dqiqpH@31M0M3Wi?JKw0LWgEM9XL=ka1(v2Kw3jZ1hXB`V3;Pa{ZOhIbhsDpIk|kPjy^ zn`W9UWeR$Aln-rJP#SVewxNHGKBa5q0R@mhYANY8#n0TN*sY?SCW2~saLm)X3-$hD zJiKdgr#KurjQ)~zT+(I*78@`2Z2v&>?fZN6Vd2Ud;9^9JHnH$vr>XsAmNGB&AZy)E z^*oXKZUa9xDqMy$knmKYlAm&8_nwootzR;m^||_z1ah5kNh!I%Ur8ez1cRyKWnE`D z?A6!!w7Y4Tan%MFAZbc0V*2HKL*X)8QYU{$l`!W+ia$^`tMy%zfr}4{uqk*gutx zJOxzTPyR+Iz{7wP2_Pzw+o)ED3^;R@=KT(3l(gbR9 zZ}$f(Q-ZEpAi#X06G*8Ll0=po&i?>YX?g~Be4S2hdwEdpIpICo7_iK{c{>eT2&n$0 zluQzsg5GnrW3)tNst#)mvc>sMbzi9s7KMD~C#M@Uu4X&ej^ls5L(QnRa0wBcya*;z zWQmFCe*u%=J*x2k%xk(cw6UC5++Tn+K526D^L4@}eZA1|vYQOp87(TLf6-ak3~1P- zQE6b^U9k{-MR?)nP;q>enpzxQK~Kc}vRTsVj9Kj{o!G>TT`uI&*wgLao&(uHj zs~X&bDU0Ll@+x?^;(&WuF9Onl;T(M}yq%f@YmYB!%_#DcbtZoVQIJQNTx<+j>n`X$ z;Eu~5$qv}eZg^lpi@3}bS^!CVn59oQ*tG9yaVM zrm178h6 zr~)m@AInk~>UYeax|Uqm$O5;lExY>nNv66QDwO(;x{7KoT>FzrNIR2QS;HJ_KXRmf z*l`UH4<%Xp3oXRJcO8_XYr_=_ERmQtlQzGo7i}Ejx!OM|j5HZvtWHc-E-nf%1{y9` zuE3Zni4u=Og39YRv+mI$x$gp%zGlOk5+(O)yG}p!17&X8Whg^~q|TQjGyD4~iG*mo zE8hRmPs&xq-FFu9of}UFm~((93me^pJJ3)!=Y!YQEY>~DW)fdGU@>64StoARIF35mI^(XGrW6ZB6J%%SW!h6?NU}y0oE`p;be~Yw@ z7F-=K)EEO3jF!WruoTaKv;eC;LlyD%apC)jjbbH#|KjrkLPq&|&#MEM%q5q?cA?AN z>f5}#*#{D=VoUR>q8<~C0SH*DzGx#aRQ|N+F)J^pK&$(@qkdK9;Z4Gi?ADdTO;1iw z@9XM#L}v0ugT{~RHt^Bh_Lk%~{CKG9%|^@H;lh-`cZVRlrMy#ZuuUF`guMmWX>SJ; z-*(V0szy5Nds{$qOj`BN$ZzNF+)?$5)FhvoQCI}zZGVLic&vBd1hBq*aWpbYn0|W~ zLKm!aXij6Wz3Il!&UUpR{o9VQO4#{OE1~XSe}d_D#~oNlLHoPi(;drA2E?C4zY>yC z2+dR1n2+U*L!pLU{TY9GP-jdt;?kx}<(*GS2yFHcnP!1T-#xJuN3Yh>;8BZpEKF47+~+`C#%7ng7kF2T>Gkdp{>-PaXR+T99Db?_qLY|8M-BslFTCZk!&8f z2t_!f-2DJsy?f7H-FFIV_lz1O8cIXYrva0egy-Sz5^b$YPJvGpfcDoiMd+*jVYI^AKv8Eywtoi02P<*U!Y`0)sMV#iP*R8)|EE?jl zD$3KOl+vF5A8W3of)cYb(*M#6R>C!5W8q}27XL{n%4z%Wu(JOy=KsIM$p7Dq^6Dsk z`SRr=R{D8&ao3R%%FzB+P*Keo8qPY)_z|mErHQy8>Kt^AXFY5b%ccfKg@uLJ!pE_K zm7SfP7Ae5L{(kd9&iAtB$H{3o;{$jsi*SRQ&~WytKk8r{aA)=c`z7B>Rr`LCk%Jfg zS6d6MBCsxFigb7En+8245qZbYTWA@xeE9tsf@rX&qZ(4@2|+W{gXcRNH>weY#L$qRDVA%J(?d~K# ztUSAb>uA_m>o(Ld4Ms-3lpJ}=9u-qoRyLG0FbeiuBAidpvGDupf4SH(^+yMT$YCeo zIA7lNi+kD^J~e-ARu&d0$Uc@5e+PUq42*kCL&G_DgzVA3b&uD1Jf>-5_I_Zr)QD9Y z`|bnDkS8?aT2Gqaw`%>=2`=8SFUMx@xw*S@W~e1mQYXIs!2j^i%h*oiG4)RF;_q_= z_M;?Y-^AHf#v*t2_4D5(KGGscqT(tloXyP4f@}Nv^ReRd0K{LE{m?84hw5+2dFbtd z!=EtXj~KoBYmcw9A(E`VM5%lcHBY3rOU@glz9faa7o4KC2>t;VFQo$ukz{|qt1ah2S`5g4AI05mAH&gfPFO!_#%`{#= zPEM0!`7||#w>w>hdPRO`Ty?Q)?Mr?qn;rE|zmeeD@>^MIy>Z`esja$LsBK^QyJX7{ z`3rI(WhqXoL^0;1_MGPBB7PV$ywT!)^mA=>-oz}k&U8Hu02ogwYhlBofqoMUtG*R7 z1a5cb-=-NN?j*a;b^0aN;x4lW**$#t&8qUGUb&Bzd23Wfq&J$E54iO&bWRstrq_bj zi~4q?Y6*GLUV@Y}(Q314bhpE1jjrpglRz6f6SUq{YR5!G(Vg>1WEDxPtT3%uH5_Z~ zw&Uh@k_k1ksPIz{k3=)^ySe_ny-c@@#FJrkeB05}Uv*~s+HNylfHSC*Xp_*SMg%m; zR8>x093K}qu$j5hO0Q z&z3f6n)4`Dd1;ep5|;Gyg374!ldJcQqRg3GQiu^YcPMt7$qlmCFa&T8-}F7~LYP~? z`!c~?sgH}+#4ltX;f%aViMN6Y-tnSA2VO#zedDDJr}c-)ng4pmZ? z>WytEJm}hYG=D`5%o=Cdo zIaAE)Nj9_!ZI?*y^0NkzMR+Flj(S)7DLD_uf8^gaVJ$PR?HYAeC~n5)TE0RON4tKZgI=+ z!Ya0uE1FK>h-k6!@Z4hg^KSEJOG)J_A8$A1*3dK(S5I9vO)$Ne>+5l&WwndfUuOR@ z?*)Kl_qnPeh2@o6JBK|s_}NH4&u^l2YVg;GTT}s7T}@#&mKb_4-trA@)HB2D7~~3j zeH@YUmr@la?6fxqF$9*yN6KDrBL*8!xeiI^JAoEs;-eu= zqjhuBbAO}2oG#&g^Y|OF)>-{my#j3<9Fgj&;Z9JLh zQzNXDy1!;%DRw>kWvu2AJxNFCws=aywnLoPmt&`ZLzRY_i<3=CxhdV7)~kVR&(us$ z+aT!;Uc$`kJKS8S8rm8a&@8ETDbYw2WIR*$qK^nF>#Z64+j^e@AyUk7u#WYcM0y zrOHYy5CMF7nbvHL7AxC{yw$u*E!+A*{~OfXKsiw)Bk*(_dP{y6-8cCyzq#>~#K@7; zDw7+Lza9sGVPo*y=9$Uf(|eNkioFH?IO{k0P7(pxnV&=`FPlNfo8#IlF`j#CnjY5~ zm>B`k^gru2$j7E(eh#IfkOZCn9^HCRP0Z9L+dZvNml_jm)M7;o#tTmN>Yjo zN_v$1XJz#Pr?n}l9He@#HGbhM`A%#)VBprL3SrvVj`H`kTcg;j>*)7H@9i=kY?(-e zok2#`Ljf)BQlpsQ*d=LUJxWOqFcKrekT`wih2UP+Zg-UVU6IZvPI`amdF(?X z3_anq}>;DmrNru#P6hIW5;+!A$61ns8-GxFP@5L*uT;(#eUf#aJ>@5%M zpJ%l(OJjmSMdmg%gfvoCwO$=JjK^T}vq2=J(H6if&gE!Fi|rfh%lix|Gn5O~MYM@B9gnp# zCgT2f&79@l^JK`GpWKxN9o3C1v@X)qO?PeSx3H+%{COheLlw8gI_&81*p-@9oW?}d z^*B|wD%`wB2|wQaiDFms5JOdX`Wj;bh`19elFpI_Mj6|>o`#Rl)n3D|+RdA4fIn<+ z%YQ=XK+X0p{%Ay4ZiD9nSeZZ(a?f5JlCI-buuK~LAl`re_TtLfMGZSy&ZVEJNoAey zjh(Dbg*o?cx$i@-Zn-{MrqR-cdeUtzAxBD_=mNa1|KX;@Imc|vtrN{+f-A475#a!t zgU|ajc5>^9=O!^SG%b=A@gM#YR>(9hk9WH+%1! zF8gh*wO?Qj{r;l`6ds49E_i!N9{1;7kgi$v-UJ9v58q)jW0Ju43VA>6z6$-0R`%JZ zIRw!Le>hI=6lPvN2FxLbo)`n`6SVpl-M0onp7abX0)xMO7Z>TbX4=jI`M$>aUE9Y^ z*s;EsQrY&~%eYtCvGq8B(U{7QeC)(rI@)EUN4qqceXrGNX$5RQq89DoP$dHwrPyRw zwj!in&yCudLtdS4I42)0qnwss1r90z5BSf3FY`VkmZgcl4_kwz!#su4r zmG;LwWJ~(|0Dk+_MtY$=STce3w3w(p9E*jv{4*evM=FoSH{l73@0GO~S^8y|!g&xk zI)kfYKUGf89d2N`CO+PWUdJ6DwW7Zt$?SQZ_n|9+vS$`=C`F!q;P>zr=jUZF@G!~G zGv$;Ba@g!!#F!pGzmzX~2Jy4QX0&`2|8(BjwONTLA&99>XVp=_bE*0j6AE~>XRyle zu*KV6zjLBw(f`c1L){wSyS1O@Tr6UmK=u%LxfSVdgED0(&c3_KDEAinAmOdYLvjHs zEngQED@mWdHvOkAp01neaMnxPw4o$9+hRPju5Y7%CQ)ODm{kDpyOTNd$7q2T@xiJ# z(0<4^1(E#ni-)+SiKkhC{9ZNJ>7rW9hIV?X{g)T7n_qAW)@CC z9u%sQYUv&dO^IfWZw)xlszXEw5AAGiprkNCb9c{UToC4KC~@EW&Glfj$@^Ao^r;!* zp_@M-SX^mc@GK>rFVAxS)|_Yi z`N_!O;*IN?XJ-cG7Vi^o4U^g(4^36Y=wF8u(4bd4G-C}P)Ga5*ejUzqF{x*I(eudF z?a#Bof4%SceWekXKr}PDH0Nqg=~H~vwy3x38~-RnCb1lkT&lGgpT<%+wva-AfNy@GxqTmuH~%yL;8M=o^H1;{@Y? zyxCtyvk|W=s>?>dHHY?q-F!piS|#|iO^n1Nl$~U1G!{F&5DeajTlW+e6N0wykG|6U z25`IcPgh78I*O7F8ZNDhw7X4P7w}}>-ch(F7Xy@4NYl(7N~G{e)Hh1HBWVpl9={u$ z=(xpB6fCt$&g=!WI}tMCgI_FL{dmm<8xOf0!?Zm`o<$^tXDy1p2ylhp#N3^O2?-Me zgY2!K;e0*ga;@LM=0&R^E&HG2DY2PII&17;gn(nFg=V5%P!Mj!^T<@^r{YX>Vd`vV zdRL(%dqtI#GWMz+kI!*k&*M^LTy#5_neiDq*%<60fK#m7sdczf}df zv)EbhlZ;A4OQ)fAm!3p{wTBz8Y>!Y_Y&D?0L7nG9EhC}m@Va{tF@yTszZEl=DG*pG z1@&vZ{BjR_>fjnb7trSkEdb3 zUuvjFr1JS)yyN3%09~_r8*4e}^ZN7No9@pzRJ&?7#>owtsVV>T?v{e?-or(yI-bMq zTvEJ6&PL(v@0!mGWo~hhgffa&+fJAUNj8n^>PTf#L}_?WY=6 z?-3Q)G<4U_-EqVo%FQrDSrV^fgh} z++|!)G{gA_9eLJbhSBwTbAxN#s&!0^)wjrik{adjNQnf;koXcIv|b)beijgv=Mq{- z=XE9LxZA?K9H1S1px3(+c5Wq}NPEJ#BP%+4y3AN^HQsqWKfjfMK$QorL z=$b(F_Pi;1E*=Hcv&xe5O;A~3(z)M=vHT!g2)LI=8K2qmS6JK2mp9dy!Rq6#bl$3Q zvGE$P0n}!qr*h0IW-7P7&niC$w5e+!rGCz_x~z13RD83id!xa;PX%`{JTB0Rsh9n; z+Dx#?vWjn6@npPOm>=w{j(Op@<+V^WtWe>4i;bz@(Kfp-@W?L@oclHFL#hhJc)z$wg*TbG7QFiQ)G}r;kCBc@hzH^tCv>~ku<8u6{`l5+Wv2>3 zSA1vh|7CB&T^SjB4`(@eo+$`EPN;`PquVCdm!_XaU7qnW@SG7482-I|&!FVFKdrX! zX6j+zt!edQU_>EY>+ET?+E(RZYewM&(R}tQa1ceHlaakJTMc29zqH#pTotCKuJ7GGEOi zI?Y&k<$7L&#t@_A48a^d5rwBV;)$drfC=-Jlfy zG!ii{85Exww#j6{bJM*C3p?gMSZB>T*s3lJid}bn$fx_ux+6lRw}DNyg|eCbPEoOJ zj0nbItVQJifoEIS_Nj59MpU-dNOM;sqA|r5kKbkM>0vAUK3thEIy!Iorz@`&X9~RT zb`*~&Dn>d9iw-oy=*Kcz&hFrav;dtT;P)F})y(PZ_-18`?b!)4B$;iPk+xr-ft&_; zmD}dH)?ds^D!dEzK$5$IiQa#UKkc+f5b>>}+rqpT|+p!lhp`@%Z6V zZt5=Nz9Qi_@Ewoh=NR}oo+s+Jc3|4gMEOvJMZ(|!@)MNE&o8ulX^ZHL`L~vyZs0wR_F(ebcTBWaR*hwPx1*F*9o>f3ZT6n|tm(=j`nL?B}zkADc++ zrY2sT@Svbx_D}H6r>;9_9QI~kvuW*5)Aj%%X}LtRxkq}ypVDZ>(CIkI4G6r1Jwccw z;Y+qE#v2yo|0^a*C3bd9bGch;_QegHVBl3T6;RQ2lrpJ1LrJ)nro8rn)O5|GjSg(_Mc z9dy-L8ko-@*P5skFm*z^z;-Av9L^hXL}r(`2`jYGm8J1idGiaCrMH*DJBu#l#ProO zgVCx_ps}f1@xnY0W7;y4Sq%LetGmuvMY;DA;aMoy`JE(lKAVdL+pM+)7X|<1gvCgM zkUSl0s-0!aK^L)h!LrfTHv_Nf`+QgiM6cPn@-46X|WLk9x+97HG$(l!Z?lL$myq zIEN^rvGB9fKpk)0+_tvgu*B!rpdFH>oZbQH{U^Iy<$zc?cKn(v;jW>`>{>M<;t5Jy zzLi~dPJF3XeRm9(X}1mX*^;{~@fah6eaFx0l02ocRY6tWb~BfB@p3Bfuw4jJuscpj zNNK+XG^7XLDx0Wj*8*sR$*>R63{P3lXSY36wrI`68R*7m)L}o#yW9c z1Du|uCW@ytOVjA48pi9)nIBoJ)&6Bb`J3F)`-W*|ZRff#PuSLf>k5znnc?NSGhI*_ zN#pSH)fH6ZoEfL4<-QSLKajzmPbLf-bI6A-8o|7jmD@ceOV9-QHYQicZ`)AJ0Lo^U zA~udRfD;B5nNDdgTu%`HEH3-2rx3Yz^noO(QDjia_4M^*p1}1N`7nvLCWZ^Qc8J_y zNzrr8gDwNU^<1}!RJ5KX$`{$nClaW8WK|?J$e+*Ge&aDY`<38HC6OPCmK}K9LtkIE zOr&+>MwHKC;BzU}x=_IVk?2(Zm(HCF-5p7+m&>zwToWA19aNX-gWab7uuroaMUyz6 z)Aa9$xiZQ^P80-)DtxM1`S}F;Pv$&GEs-rjT#ph*fJ)@`pkvyAbA*q=!ifI&52xM+ zn;u7~^D`}z?LOQ-%MF}+N!;4=bR+7M4y4l1{ph_%7`xo05{)p3jiW-NS)B3}1UVt< z^r6n~EP>U9_@qOr4jC z6Y3LhtqrrAH<5aP&PN(7B@amc3N!jNKl=2-u%9>d%HQx7k!Up;Pjg03InXSsG2x1Kr)$(t~gr zIn6S7jO+f6#woUp0C8@iZO_S#)A^rVz^}O{JlEy*bAAR;g_{++Ux+6xJtZdRXCHVt zimDO_lZE|$!UugNhwS4nL$jpqj@SRZ`mr%BrRY~8C8}TMCEo#Qoemv^tuCS@a=dqg zmbnGh2F5qxH4aDDvSv^yYs+$55-oTnD8D+&)IKi)Vv8nHa4*}4k+choa+&#=0=+WnraER#7%BXr+&jn`Vgn zH9DgIY2Q@R1Lu2#f&mhsU!k54gK>CQE+-;5dKftRq}B#78tcT~S&%|Q%jV>{ z^Pi*&2#SOEjk7?FOrsC*7p-Xw88830P|KlrpNAO)+Crr8>Pap5i^JQEU6HPNSZ z8e#b{$3zCNtiG77o}I_EU(H3$Qgc9KW-(DN*%(ye0S7gCxg1Zkl~aph|w0F&YA zTH36b^nxEKjo-0;*U1|#qnwgS<0CtKvGF#*&?qlteon|v@Ow(BL-#Y_Q?iYTTE!v( zb|OdwF-coLNf`D<8Yx*_RiJ%9Ou7AGw7~OUAagTLVLvdl_A{9pd-K zG+MmRn|#dK{wgu1vO<7fo6&v=8Tq#BUq*kK8;pQ2P3gu^-4Gx%*x1~}e`;l8qg&S> zrq)-sPMcl+F7tk=<#4;pi(c#l99PBeuem60=Xn;-OtUlLmZv*+`N=qH=Td|msO_0T$yV> zRj5clYP#GeJL1<0tNB6B3NVqWj(f}OqfV^T;>Q2dNp^s0`C30v{0AfsOOJG>w(8Gw z{4QA*vU68I%q&zP+o6WAwZD$xA6x&AeunnH02`m6NJ)(LP;I0(rQAA&r-Z!t(O-)o z&g=ig4DYN>D=oub@B`M%BO@b!`%ct>IzAv+0o-JOX4eX>fCR0-I*R|3reUC2F($^Q z#k=I>uXitfL?zp%gGai3x$ba7@mSb94GmY^4fetOIe`a#_;v3*U4fm0@X@`=4u%q- z(de&fNt|zJ_0aFvks5FqbN161Dgj=WyKKTxhJm&eox~g-Uq8}a6>^%z;&jBQpCqs% zLW6kz0gm*iR^orKcprDmOt*v0pZzVh-}?U>o3|IN<9Bgr4yZidy!mwPXlcouEe3@t;;ItHA97 zFl+vffz_=Ze-9ohDKnJge{EIPPv!nS89;MUz>PUv?HU?VG4Koe^@UXwP_~S4P!Yw& zeJ#oMFTcL558iSFM~drepOd8~g_3b%(qu)dE5Ol5+CI&~`=1!OD-BwCo= zeSm}u@bLQUYy_C))6vmo2(a^HL4AfZ8s4Apui=->s2K(*i3_!)3zobHvd(7}vYFps zK4Bf^U+&NX4CL+Db2T(k%PSqPVFV}M1}m?#wA^R3f&dn98?(=UPTLxK|GORp7!e+y z{f5XX(7&xi&yT?yiia8dCz{rk<*n55=jZkkG2HK zca%8!mtch(Nn7ps{dbC0l@*|6A3AM@)02qU-X#V=wVfM}kQHV=2fP$6MQ2$H*erO> zmCnnACH5AF|E{s zPazp&S%)vM{TA5)$4vOhgtDVZ6%GFtQz;@YpOSczx?%N~rwZfvIe7YmYf zsY=v(&uMC^hk&c9X2`NK-=L`Yl~7{H2+0m*k^221#l-#$O zr8-C$k;!pc(y}Mks5}2{D3v@v(8lLqo3xLH6Tn3P<_E>Q_#}OK2EhwP|8umFSH9z3 zx6AcY6C&K%{>I|b2`g4rszWtnG2e%VMemmeu1 zBXvN|G4zv&sW4wy=j4m$MZluCb{2*VI(T~Lo|Amcfv{p2;`e?47DFdU<%GdBUJA%L z8$36o>{|!X3BOoYcMd$QE6Vr(yUL!FPj!cTsF!9%38`w|5hVyN+V0;cKU$miQK>^u z^{)rn-|BxUGY^hyS*3v4zoF?8RmO?<@6^RF&Pg25TspaE;=9{&qI&-dv2ML4vKz}I z2YNyOYL;wbYa_{$yhW`2T?T<)r#_xeuTK-3`}g&xXCBw>-jr!{appUQ#tB*WLd{%{ z&z_DZK!YUwTU#jLD;-$htD{M|qy|5)`8r-f{vU5mO|yq8w8%M!I@S^+{kCS|Wn2zJ z-~a%Weg;;Z@Dtl?)yvTGNM24ER~C-aT_FVe7bs8+_SMx+bhR>ZntAIJon zDROyv39OR;YkK6Y=n0g6ow)vakxjFyBaB^x8U;>9O&sQJK>0NC1t>`EyB?wmtbdbr zi9>xLmVxui2a-OgSV3fzQ7jy3cGc-WYC&Rg^K&c zQ0F%6X@}#aSdZn{W1NA1Wx~p&DoH-s8V9KKT^gzDf9nQ2QR{S=m5WQww7np8RN8@x zKXRK5?A@uE9-3;ToiVNqZ;`NDDRh~FO^r*)!&<@F3sZTjQc@%qGJlAAL&SE{<{|y zJ^RlJzOgXRXO4GZWF$H6j-H+#0ke;|0ia;y?ERFhZ7XJYn`LT{`7T z-t&zS0Llgk82hLAI{(`;JN31_-sxsrQy7-klyI@J#p*a51p|HJVMF(Tz|#JnWFRJY#t-At|K1%Mkji7l&M!*2hQI%n4Bz4yeHaq2fxmG9KmkzI$?pUxsIu}Zz%~usu7E;y=qGUQ|DNBiv8VmpiU6qr zpuAW=`T>w}rWgP!O+s8;TuRDpyPt>2Sn%JU5WpiUwen(dVL?<>bYXsexg+4OZR8X= z@}I2h(@FK#WY+(VDsB#-XaHNoT~2?C`*{gKkP;mU+lPtHj>-Jx z|3&`upFjTdDEX7aRT)j_-@bml1OQ6=->W}90+@SV45GEB{;gcv1p+a> z7jQ_G##HHPL7X{_x($IiF}GDz@K>57JXQex*4cRy^YEc5UB&f${K;+t6LxXh+${UI z5LV|7k&Y#PR`@pfE@qm?9{5cu`I6srpo1WwiHoo=CnvT z!W{iSxqzz!Pff)gg%q`2*s0O&DZWkm)`nRjq0@lfz6AOO^?yC zII(Rur70wmc-~h#H+%wmQxZR{tezsAV0U9{7PWkVUg;*(^a2Q1oZLOwyP#1V#<)rH zUV^(t-w00(?pgU3z68daV@{_dHg6_L{FCshwhx6%W+a<0B8?W?i3LHPW|#sl(gQhM z3aUWFkf#= z{u;1m07Hg`Qul~!zRI7vQTkE(1l37;&V`AzHK{t=n&U%jE7W5sl2QWp_b&H{@02=$ z;W1H3FqNYkmfHuoN5`{7HG_PPTYIe3HIvGqU}vu&LC3{~+apw4-n|?Lnd)t>Ylbr) zkCQP+dtu1U(c2!}PRqUv&;y>){bh*7o0`sK1m7?OI$kjv^<6n_45Xtt-Y5cQ4%Ff z?BTswW1^@p(*VLCh(;(-|3@N^7I$@qc;KJREbl(u$jlaW(|3!MPGjl>6nU%D>{ZQ! zdwBPNr!g7d%%j6NC8MVMJR8G|Z11zht!UAy4kz z&B-t9)#(QA%2?S(0b6Q2Mvkdt>E0J88v#-wVZe`S{z{x3xHIr(+H2E zZu8p`U9E!QX}rfi9Tv?uQ~?7w=b&>vNHiwr5PAZ(-A^I?Ls2lb)e7ezStlB`jZ{a} ztILKE&SJk=Z<@W1^L=lo^v5N+lR6eVJTqt9HMQqKBhz&=!-itkeh^jZzlBn}?f^t7v8G z?>Bej`>FRA)FfVJop{;3^qX*KU1&tgs3?8IOhcTV2-SyFd8}AS^7)E}^2X@~(C}am zScK_qej*T29Ce##Jca-{EhQkIR)0PD_N!GeiLWbTBz(f)o ziT@M>hil|HpK+_3%tt}$`1}nVr6;!Y8yqzL6Y zuySW7LW9{QCQ`m@R|b^+$^7apl!&zJ$pIYd5d_)NV?N(E!}`;hcWB*s3CIy%)r7G| zNoU?&@gLUirk`F$fSfP*z!SZ5SR_cSFXVm=o0~bCIP`Qn?Mi%WPc+B^?l{_!m!M}x zHV+?3iTT-Bpt~0ywTwo2keGlRFC4xZ2mA;HfMEyc6t7L(X>JTZHa7_C>K%zS`9REn z&@fNirs+ZVhcerb{&b?rvn+A1WS*GBwR#{Nl(kJw=>o3jFmKp7R}9}7OE{N`KZrW4 zU55Q>EUKMF=Z$opSa#k0y8X0{SIE1|_wrB(Yn~CS`XGi*?5X4{W}!WGu}R2f&|c{6 zV^X!>W|o#XzMqqO{xIyz4IcKpOcpV85rFe%KUr)^8@U)v4d1r~X7mGDBi4(OD7Nuk zZH&?e)x0`i8dANoIIp2c#p?hHxxmmE_mLHb3NZ+4FG|_&1T$x9Gm^9EN`EmkC&YAS z22z5!?N}{rn{16ZWmNKNe^kziZA%u%D5a5zu}?mtY2!Ke+853P?nchW1v}i4|3{~_ z73Nmzp7D+=xgQReG&;)Fd=JL=ic}kM8Usk=`ToO`S$gbx$(2V^?}HOK;j-Z??;hdW zTC-8VY7L{GcF(_Nk-CD1`hNw!PZ##2J zU0OxV+;{N&SrcliEzDl>{qUzjt+}%IP8T>VKwbP?!E2;~rt7Bsp7jV<4%w3}alfw4 zxf+=UT==w0>(aXZYE(jV!+~tcp$RV%1cfyn!C)#4?Ge_K2{*$-ysPY8%$DkbZIaLY zdN!nbh4PsV4bpA6kKs97)?bhMCJZkfAdbK&cvs_8LlbLk&u}#bcXd&VX!z}8#jTQJ z5k242t}>){P>VD>8AE4bzta50$~AU`--k}jd#{FHfJw+8{KBw+zxxp57UNg`Mk1r{&erXDs_)OXqJ2w<9Sj` z0aEKd1OMD@LteXzXnJaT_a)X>)UySaUhRpvtqw_MJ3C=U2as+^tGh=?w+zK)a7N!$3bfmyo&{G;AbJhvwc)k=c%Hrk^YfN--#$rO zSvzdf_UekLr{U!68~u)R8glCBXqWMZ2=Y8a*XE+D*3h$e1%5TT{CK%FS98uTx4Se0 zGd|30=UYRgb`{+xKJs1GY>6FvjqVjFB-PfEkzkp7JT@LN@NbPCGkg(gdo|dlW#gVv z>vErMIC+@j&*=ncBbp_;v+k|=kEI^VO=vdQhI>kChpX0bl?@`zbhM3c4N)J=(fIN0 zQxsCx6!Gj~M5xUiWH=TSMQo{Xort0#bV|ASB57wFV7aqf2Fg?6VArihVLFdM;@~~IYGZ5=jAoiQ0Q}UO>lA2nrxT8Ya zY2n_L{QU8dq;q;nU{X)iYAPt?3^M`?%vuu%DD6d+FSE1Wb$zxyb6TI*qh~dEe`6Uv zG)iol_$AxDuQ0uGSi9O@s>F6tw2jF4(S(#3@)IGrxWtYwvkfL`+pr^ZFM){>vUg&0 z#wA{Rpx@fxv?R(_a{s7nf6en;#1&Z z*~zcgTzc5`7>H&(O5{SRBr@-hy?lk&epBx8TT0#D%!#~BO6(8p3JIxdqJDsVfW_fr zQ`sJp+nz1B7&pie!JZcBeptBw;sWvEcfXVQK~3tV{Yvi_0;NEcR4^)oq5_)rR#9F3 z(%>6+l9BD7HS|_VFgN|=xy79PZ&FzsEhZ+6Ggp$e662f`%1se zS^F6!69P4W@d&vUFXw@UB|=G#6fgDWPi!wM-m157iC?u5#OYepQEQSS2o8IW)qf8# z(S=?-l@@m%^&O~(==M(!tUWqhK#pifXAjXWA`VyfKK5Ygkr&Ndz4a#<3`P@QJe{H3=6<>XJxMfaG1u#BTc8u?CqCQN>q#0Vby9$qzQ zA@{yp-Y?QQM>{&%Wry))xXZgj1}&?5zfQJ1jHC=Y(7s9-b@ut=f2cdB=0p-xPnw$b z*-W>cFIHT0v~S#A;CdBB^m~yJYw0SnMO%(VlgzYaRv*#7RN$#=ToIrUvR4rrk{|rP zR_1KB7s0+(vPp`Ssi4%v8uSQas$_O_#PD923i}Q0edom{`{TX%cI~@2q}~;Du{;s` z5k0aDQmD+BoNeySm{od=FAOc&WE2QqQGt5xhgzw=1eVCy?3;w^D5(3@s=gf5X}b0P z9cp3+k}Tg&`j*j?m`<@P+Nh_#uLKVFTsln-FD&(^Yly*k&0$eSFhD}<5Rx0D#GrVu6=$?v4w) z2A?ECXm4h~HNFx|KQvwvG-Bej0?aPQWW{Ia6<(d|Z~L$#hhYp8&lG2G_d1HGq>Q|OHSVlibGCrp z#FSxC&i6+D?AjoE4{PQ;d`3vMt1aqj@xJ<2iQ}IB3jU=C0|TiCFRz}b2IuaMRPi^V zyGw)4xq3hT*@}e(226ote8JYQnZ=+1O`PCI!zK%|11UDiV3YyFk*XWsL(QLd-GlXC zE?9R$rN`e~3W*Iay?l~P9M0FIly_5Dq#{tJxz)e$+3l-tkgum@)?=KBuQPZ`Bu5gg zO?+d$cyNamip-_0A~^n#1V;$Fp$q$s#J)N$2oy#w&dYW3*BGRa%g~d>`C`+#rO@Xh z6m)&=E}7lyQ9EY4P|J9Zgr9u&rt;$%#STW7Eizq_?-X zGW*hgJ81Yjz>k?NcQ6CDp4j_irn3l=`@$t_NQ65$PN{f@E|)M;&f;!j5)#;j@o!b2 zVA~&T45V#=BPo2{8SxkB-7I12?{EXjP!SviG-1aU>OXF~hjg-#G6{M|NWj+FX}XNr zK{?bdp^O{EXPOR>pRxy<8Rv~s0-ti06vNe)s2gE$->H)S$px&&FeM*PUtgM`r1Gw% zW2#M|Jj>o6YhqmENH(goCEUb}jMyfE;>A|SrZhje>@QvNbXg2AFLc*~wCg-JJM4uS z+?>9!2ez3Kie#o zDMI|qKQ`>&ojub7Ct^Np)M+=K>KG`p91DZN{(3G<`tyb&zyTH-qp9kN_ z39H5YQr(ps_5KYik3no#n| z#+kdwXp`uv*qh{9xeE1SHlKe6b#q*4#Ac*<f}$GGIpD%}x+Gw&)@&iTKWD3lPi9x-jXJ0k=hS-N?Db-k+Agrk@|hz zIbl{V60OloH2+9sp2hoT>c@{Cd9}|r8|*GD&FvRjR&L-VGNwfT_A_aov`^)W#g9D9Br>_#Yf@xYYV5Q{7k+d5*fenK>uqy0 zxptH%+dKNt!YQl^t%EfxC$Mh&Rzj*3ZkEmBgTqhu{d_(*FZTZg7QIw6X^ayKC3A9}gQA9i-KBE#{IFcAP{iO~+V|7&FKw68gcrkCx4A>N1_MnsH3AX* zeNK)SnErk4YG3~M7kdY$LXlotvAsRz+fM)iEC9`=RheMpCn{ zMBm4h;~cEBG)D=$K*2%2Z^gtdMmrBb?Zyo69ZYRdpJ&b+J^SGg_;ltl+G``Qq4e~l z-|PWYB9J)$ix0myP|}V;E@Vn9vO>u}>b#Alm0UgOg6^l4Rk*Ub#CGu6!e%{qA9U z(PZpEL97{q3j%DxWgCCLlKJc6*_)@NEEq1lCqCXVzcbqu)M(a>Mzc8IsmL8x6KU~} z3-r94K}O|;(rL^#%tO^HP1_}l)PEzpRp}>(t4^er(tM5Vj5<%cSd8i=%or^9?-m<$ z6yyvUgH`MfAp3K>-@UeE{~)^nf7)Brw;UK)&%%5h?Qm3Lg8O%VS-pMO(-Cg#I4X-+=>9dRO{hKepRq-a2?%%&Y;syV|rA&*Bf2W|J*xcCotD*o3 zCzvrH#jXl4+vn?w{(a`wqcyVvf_)$yj zcHkW^O+w(tY~O(4RhufTicGaG|6nt-b*$TJJ_Ty#$P z+Xhj=11{w;Fu(nB(zl<*+5;~tJR7JU2Wd)OP53DiY-C!_m|f19m73T|dwXTzq*hiL z_TtE6JPpdK6-*ShK9rQ%hXcTg-N%6Ua~!HD-d;aU(yw)RRIKi*2D&+s z^6V9A_6y8tVJa7_EFf?f4w{>w+{H1=ynw0NJ-><>#U1RND*r7C zz21BzYUfML*;QVyBtTaC{@vIgEp1>B*$6`SI3y}?DuUs)oP`PIOS(97`;V3oSYtr0x-J1bSiEjBDMYr#GA6}d-UE5;1a<(qj9usL1 zL=7&ObzE&hTm}b5|E+v-d>T`fNuWhqT?w& zBPA_uxqxF!gL_eAePo)6`};)u381ntPV~{jK>GCdO8b}I=djX0F0;fuyE+V(B6^1W zV#5az-qn~ADZoGb)-8@a&0sZW*(luw5q(b_)*02bCeCbGP1P@1HG!Yq z%AE91tJDZ-8XIzf=B)z4NwK3d3xOvP#U(7m%BTFF$j#!+57jmjZ=~9Q`4hE8wOQ}K zAY#o|dnZ&ztb+!`p_=WY;8Kd*OS;lIr>W9GoR=Q=<%cU&86R8NyK7b~Fb#a2n1F9k7c@w- zbM0&kU>rlTM3~uvs-yhcmJy`%843-H^j=C+CBhwdeN1t>;=CL9lP`<4jJx^r8b%_B zQ6}QG{#Gni+Fv4c**YYv5C)&M%Bm;FTHJqg(Djr~3~k2Fw#7%iu9C^D#eF}1xxqWo z(k{Xaf2d^7Apacb6u;Xepz;yyi7~N%Z9TYi;Kb~?`_Gnz={e&753T& z$Wf;M0G-iJ(qrWtg$BO4N@rK{JVc4PH+DIDUXX-aO*Tv*QGe1ADC8C1Ih*RVcU0wKbJ`fzb%+C3p>=4{QYtucWkSY_tw4K-Yi2g zJDqk+*>J^Ra+DqO?n+tXNxZ^rSMg?b&UU?>{{f)ZDvC4^GTh6C4tmU=uH;h_R&cl^ z3nu8&=}Gxv{pTmfH~07V``#*UF0BZd-W9{k!oiY=yQ88Wf}HbPW$wEW z${3pn#?j6dc!6BSlNIJWAQDpaP;alieo?&BZL2pEf<|oG`BSF+nt8pQB6Y^>C&7E9 z0n$^_NtGF;Ms_=EAeHRa45#iqLRFom=~~}lm-Qh%YfwVBTd-=h8PLzt z#QX!o##VCHYT7qdz<%;kv60(NM7~9R&8%w18J1-UIwk90C)N5^Tzb#FTpnWN9-*~V zeA=;EeoG_3iUK@wCNwCtGbO*QFVEr)uRfM`pnM0;v)`6*(pLQn;%MXmR7F%KK}&^a z>~0B*>u3e=myYjx|fARc6 zSVPGeVzd=}sQku#02P9}HvTr$ex+`g$pwL5P3x+Kl5Gu1W|U8>w=|w*kkUh9c(C(x zHCqsPHkeyRtvSGXI=0F($yrjY3Ctr57|re1BuPnh5?@`*XJ@VsgngGZN(_2U-{!sa z;-rM-Ox5wLjuxKXLcNsQd8i?le%IPCeAUuB?Z3W%gc}Zat&L_ZC80 zT7g}Q)7vtYFa1;OeE#s2fXy*F&Cr`4R1r|NxUDv6X|Bx{Ma6HAIXREKrEg7p+Rwrl zVA`!cKg$FYPG`0`rl3AN`fUNT;@070|xpMW?=NdNCp8jEXMD;`A_!@XPH>BiQ3Z%2ix85jxx*MMox6e<~@oh6!^$O!U<1y z#bIeMTI_FB(mNZ>o&+Vp+!5fJf~}#`IDb5cdN@Uq%^%76LgqXAj8f_c#7?jtTt&KELqB@AOr zx2Y5jt${cuDaD6!60Y~9aL;CJ%+^b+8e)`rDZ!V+I4xn%LiSQ>;?bLv91*j3hZ9ie z6RBw@HL64tyU*sWEd#+7R?Stu5jQ`zUnCpx+H_QxvdNibeQ1iD&Z5!ePiB`AK*wm- zd$qlnylahkIAXz?nIq{wtg=w2-p==>_*)KX3H0AcB!EaB4zLDBcM|X-5G_s!`np%7k=yn z{i)H$95*b>11Xna=s*LPQU-79&OrkXWmRT)wQn?lNa=Vib)aq1ipEby&hShM-4xEJ z-yHcKiA{oe(&+d~#{<%h_fgs!AdFdV^7&~ z&I)~vfOOnXd>OGv%l2q?KR{L7HZ8s{p_)QaV=85b$W3KM(;b<#-{=Qfioa}A4whc< zH~b)@rMAZ9I5ojq`3W84b>{~M(0fy(M{UBnpM84NCZR1xA;pXWU|7Bc6%#Z4>zS5w-QF;=4L#E|ht zoo}R_%s8*jb<3FeXga#K(^BV8Q#8(<*nRhzY=hhu20pA`j;`|x%Z=yv)XdKcUjd*8 zM?z{IVQk!Ez+LMs$@Z((`ZC3YU5Z<@^Rmmks#{6iL0!SyYbK_aC4~g|(&vX#B0E}8 z6hGJK&hql32@Ptxr}SYy8D{>Hn?w$Pp%$=K`h7BNKC0o>lcO95>?+K&tX||AX_U5R zC_QHjgcx_fhg^nUO4PZ&C=Z+(FxanOS)nYjj?L$b@Y%C?RX7l^79P{jMn%b1LQ(R9 z-{iAW4NRqls}{$nqm)-#8abUT!H6M53E^TFUN^quS}?{Nc&Yo%T|i78D`E!#!B{;q zMD}TtUZIXb1+p~C*PjRbPf(Z?ynKYXk%g7Sk8X70Vm?$+5aWI91xS89a{|uMi`g$= z$qd-u3asElgQo5NGH^*jE-^>qeuL^^&Y8_YR~dc@oth~}81x70PeMUp<=J5ucqbih z_&GSTFlVb_k$v_Gou=E)c(T(5HoDkp3vbvtiPw+@^-@rhOsviJS=I3&mBEQp9ScxW zu;dLF)GTXa;4D$%C`ci>95OP}lT^_OjyTe6=AMDO+wS>@v!O3sBGPi0Xm&Ae$ z_4}m)GLR`AV!|Cd^-q2o`mxt0K%NJfE%4i?27TXg#z_U>?lS0rK^PoEqI8)Nr%{S$ z=qT+2BQk&#@`+J-Ejy82lw-M35T3CI zb9t@mR2^h0W^8zsKk4C}F5>Joj-+%Src_pv+2P`%JHK#FP_+w? zJtN}7)F*ev>(kQH3bc_%{rUj&(pR3^FoP09?=rXajY68BuRO>;7Fk?d?#VA7`KIyCdYI9E(d5mFV*pZSrbetMU@c6r{JBAFJDlvobKN2gx%lOnic@OhGt_l(_mZ1dAJS)--7l3{ZO{^IwvZ4Tb8@l2#K!mfU-J=>uY`?K&z33F` z>!ro^XX_AiiwJ3Ua5iwWJ*jxbT;~#7o87qA?J#_)iUA^X)pUMpz6X|fqDf0e6X#}Y z1x417GYD$s(T?=A{Z|3uGXx{Gx2GGau}48$XG3%?1zG2w$~NjhGR;0XXE;RFkH2#D zvctbc8CjwhB~#X6k|u1_1vN8y=%C@pV$+M@Q(Hi{eR zNtgY4I@VOn*w@3GBgb;ci|PCrHO)^_TwXa@*KDkC+5shsx~N~-V( z*lo0g3WQ2ZE70gO%P4>9scrYu8tJF~&P?+f??tOII;oCSwjy1)TPxP2i5ogsEhvLD zEg3ploYdA!8c1Jc$uhEL^H`XEo!45cmYiV}9I2?9tEgVwes!kk#@KOm79b~=LvHE5 zJ5@Hw-R9UENpSMLsrp0uXVmpIo4<=R1>osI3w0&;* zc+&)S-R9^}yj z3_T$Xtfa!;deRE9Z&?lhWQN-w(Oav@CY_Y>noaPzwjTGW@;SpDU-EP0h*ft;U6+h< z!Ku_Tr}6G3U7v>{tYO9iAQ;C%mPiLCZLF)4Ask<&tr}sJEmh$sFr2}<-_p>YZ-}7L zOKI;gc6ZH6);HDDgq^)uuH(fW*Pq!}etkUk=O@&3RlsFY&vELi z+w`?>`(uKjRaYur@z8(+neCb3|J5&As}d zL~A7hj!d6rL!QBg^ANmSrX{SZ#lUdl z*w&)ZDZ7(w;PZk`ec0u}?f1b`W7+Sf=eigv2aneKY=_fXdS!d5Bz6J8|}16NsdLAa*?h<3?fHCpA*( zBKwnOmrF$X&#>zU4A@_`h)2RAB*{Vo&ch)3i3=gs6ekxnYV^RGbmi`D%v6>rg^K7O2zyU^t6JD z1KV@)&Y~Tx$^9jDhKf%XfLRRJTWOI`O&UYyipCcrx-9~xkjG%dF!>j{9V|~sob>i{ zBsRU&m>+GoGy#2}0*A&Q3{t;*L)bgFeta998`|{7xyJx~rK2)wcE!EQyWIG6>S5b+5Pbm|= zF&HrNkDK|Hhksd+oh$>hyA%x_lp3BJc|DAa`|>uwu9~~S;`g3cyheq`;5Bl}afqWU zvGbxS{Z%Vh=A)VJvI2R!&x^)slB{7U#u~#giF_wzxrMcb&+mE+EvWo|EB$Z0y>(cd zU)Sebqg0Rr#S64(@d5>km*Va&!QGuepoUw4;#SLrvIhmXu*vu0GeLD3&sah6^TAmA5F*=vxF$v!9 z*R8@CN{%9!dw#kb!fyULjdsK8H*;me?uUL8dM<;aJK^(9%4vcIiDYt*9CLP)b*JW< zq@l%v98V2%X&E6xcCKy*cOsv(Oluikx{Dqvc2TyjISLZnDT1M$&HqXF=*iT}Pes_Yu>Mi6S$Mcajd)GRo0! z{FH$Ne&()jHJue6i*6)Eh0Bk%hb#Xm?;OP7!mr>wN;H`wr(w(*g^C1gheI+n{S(&1 z$xZ%nB_x~St6N`mBw=>^XPzt63bbxAXz}ybLzRprSGx2^wxy;$Ym3F%J-IY8ahQ}X zOS@``8S7)+ z(KsRxw8q4jqFTa9H`*{}TrR|7IP2$&bRykU(4jAaoPO_}JPorUqG%*(GP7&xifSu` z`AH_)j(EmtWI{hlJ#zPoQ#3PYi`5qewJoiDNZXVsRc|b*nd~dCa8fGB`_;DeV<}8( zu)Ja^wF&)_bTnrb`a^U^ZgW_-PNyyZ6Gx+J~ zwMCnaERDtGAc=4fcP!y6R64f!Ad=af0Bt6axMgA=`#<-DapFS!i`Mw=hFDgW$`Q+( zFq_?WuCY%yoop+Ex@W9KHjG1Xy8p8m6@+(so$t@h82kOB4!dKB6GSbT!fiQ_pkvJZw;6Z7lHK5u zVD82iC}-SB_y;}46T1IjYr}uto1nsmY|Un{vt$^)_X7*FKpD)=CbuLx!MJ}SSoE)< zem#)be$XZ7q$M5`Y|Lc`Y_z~}{i{B`^Q2$%?mHompMc2W-`7K#r*^dWdG9sSqgUGa zff``n>-FDN-YNke=aFRIlbmUM$e3{9z-p7?y}!)q*EWG5vtfVvCx%zVfkm_2W36xP zBQ!~1#CjVed2q+qMvLY(izkWa@Zh*H6tx<(kw=|JWskDDtQcI~W;6x$8vN|V4r|QY z`S|R1;dfqGnF%1tvG%l$fw=*cdxjLNSqk`;&TB8KTk30D%8pF~&xDlFETa_O=W2QQ zxXJ#;0X);FPIH=ckyB4(64=l2w~Cl2Vnc)DgA5osk{)m|oLjZVDSTCWgU&ClMDGQ$ z-iq8lj+^{a&K8`lhDLIpm1);})uqEz544dpu?GgnZ|n2Co1oEOaGi~d!HG_Gwr$_9 z)GW?XDFwx=$XG@bH(Z_}AM#gBn=`DwpPVnh;TTb?x-RgWe!)6NyyvVB#Uvhnz4iKI z|8A@V_|Nzub^BIxf+IgVDsX8S&T3`!y)o>pf3PrN_^L+hl$H8Af+o>W;Ig6}ybyRo zeEVIQbU(^?UUHvd?_r)%)YJ8dOdDrF&G@*4Bh{?>E6pqO5CS2Amsj)WUJAPOX;tPH z2@BpT<|$RqZXqNB$7yI$)K)3CH`d_PDE4wi*e-cV`>XrB!@aefe+l{fFz{r7 z2>Y+;VqbZv7qOs45iuVSMkU*$}0DU&9S;Nd7oa)&qFJZ2VciynD4i@{`r- z=AARX4HuU0Hs5>597b<{@(>SSLU*Gt2wg|QhgtiTE!F`G?9wlZ%I-2|W$I*!953y4 zP`0x_nHbv933hG{TzeYRcG2-y9BT65)-qqd=+DHin?P$;I>bS5l$|wkJN14ZQGja5 zC8{!}r;)$kH*?C3LZb6rW?(wms0@e5^N4DQpZ_Yxan%)B#3`rZfunGKho}Ra2God7 zSh_jy`J74W3z^zM8X=PckqaTW)Au7mGEO!T=W$SrvirEZ)aiptXB#kT$XcF z5BOLisJwCXg(Mx&PGK@bbl|F?F^Vr1H;0pujc3A|ECrC`H7;0wMzgKrtwU}+x;vpB zC^K=bl(jrjDpggmpNM$k@nV?XX^ie&X;dw4x9Xdwt4dP3WtJwb=dGN^<)|7eAP+MK zCT?>4%7a_<6`JbtAjEy!k!(6Ex&2aseNruo$k%WUu#IIIC`l(qnk#JIwQK(^a0D;L zk@TXA0gY6?7M#s`gdn!8#pK@a$GhRoSM%$h$0l9xUs_V{}6^sZcu_8nMCz&%EqA$&pDMU4+Iy zBc04(Xt?&@)>(~vCFVaQkcLW?_~7|H0_wv}*(<%2mq21zo1?Q>hztu8U(}3w1N00i z(%@UIe3C0Ki~~6Rn!cbQ@@Z zidCEgdN0yC-uYUALUeQ;ekV_|v6;63yB^x2>fma67)7@Q!sYrV|5V2y)O09F?j|1>5o|hp8i@rJr>c73SzHDDg6sQ zy_e^YxM+N$(zW{tC<ol3RUfii6~j>AjL#-aH9K9s8d)5Yj3La&tNgGFjP+mdgF5BV=duD903UlR@ zwIYBL_%!@YN18DDx`}st8LS!|M@L45MhV&dr2GW&uRUnN5mR^%`H7yA6%YNU`kk|F zuSZd2}sCg!3td|2{mcI7v#(?{{`r zq2=dKApGw)5fs>(Q|LdXzML8UtJQ-&U)S4*0nk&;tm_Xg==Nd9ww(G<{nO2Iv08x9 z`|;G#onkGO=JO{AHj&Gm>ZYryEMn8LJa~*9kD{eOD;@BcA*bRJM+M2jeN;N^X^@&n z#B5&W{L=E7d3k-C8eLaL6m2cEb#Jd2G?3Lc-frXTu4_-S8pFZmWH>3)CRh7)D5Y~+ z-fpvYHHfuIBD2{5Hus5ofzIt6X|AY!`{pOi>Ngdt&6!lgK}>dOC4)lARKX-MNph!g#!wg zV({vFj}UU!NH2q#slm%xQfNb}d?Zm)d#jXo8s(SjgL#-6g98csJiY53j!;SD`6>!V zjU85RCy^E)kr7^oFVpKTlnT=T%ti ze`c{6)eJKVY#Y^YSA7VZKyomb}_C+wq{Na(lo%4OUf&)>_oPIFf; zlheeCY#Yj`PJ2x-w^!$3dptEA;i!MFcYvvLliY*l?ID}ugLpcRoc4&f!_HaH_;pCr zC}eovyg51!M&74c=6y=jg+nKGJvd7xCRPx=0gWMnO3Jk&6H3d+b9QNU^9lQi^@Uafq^|bUsQfIr3V>rp$j5t=zLx8ds6{0nD zI3*D-M8ksbhf8utQ~E3H3ypZWEqM~FE?RQc+S4cI$@HHT4W%) zU8z#v`&1FOlzUqaG4zI?N>*n@50w3u$HL`fU_JYd)!fsLk_N$s+@QtsglrV05$lH% zF@=&AUafp@C)b{7OjVaWH-eg}U&OPjhn}Sw7K$=(VuLbk>JzwQ-MN&j*6zYy1QOy7 zpVyGlJkIW^`pww3BpqbA1QB&Nb6pTZi*UJCB4%sSBp&h#dvY(x(h|Vk1aOMv990rZ zceQaH2csCf^(Q+B^oWRm%1ZL(YnLd$=6+{-et*1%*G?S(BOafh(kN{BFs%yP%+oE^ z=RAi*y3Zwua>b?=YG95~|I`sEQ|(Ki!vo0%7q?1eD@$Ppt4RgXxHmXF4QDLmUb3vk z^GYMn=K3LDSWWZW(@39=&b(xk`$wCGYG(^XoVZD=CpjApSED*NM=*)e>#pW@Y*F8k zMG6R0)&X!YyoGcc=3ndd+`kb1%Yj3<8&$%Ddw_+HHD#MLG zXpM`zuST9n)(@W<;#Vow$K!NYX0b3dNnWZvNliH%9Tq!m9u^GHWA#)^-=kYD zDJd$q) zSD1Jv)yMcry+8PU!ZFasuad7`RbfXb?Y6exJT;z8Ik?A-H8;bVKxk}U6k6(ErJ5b@ z0ZEb5Z{0{7X4zSFLrfU$6K(+8dPG4ggQ5}DNG_Io^}{dbFIreNb@fhGTej0&$zn`{ zDB2CJb0YRdB`ZKev1I}#I-_+q@wBjeV^TC1>^1D#Z;&(yK3)$jt`Tk0_3EY58b!Ws zyK39RZa-chXvVGv0QVsqc}oIZ_7FubwI;3o^&N};j?D0dDDu+5&n<2!>hrMJ!Impb zQ!8jiMPz&zH{r35LuKb{&fFu(v|QuSNL(DY>A?RK(LLfd@CECtQ^-5p?lks#r#Z+k z+)|kFthyJ8-K$5xf6PVMJZF))ScmB6Fy1tKHd2xG^Lj097`rt&P-0e1Gtb(?%pkRu z<#Yqnz21OspuLmG;W<}9EsRga%b}KUBpZ$0-9t70K+!Bys;9i;$YBuO+G-trpfKe- z72MsfTlFM&9VvSBeRPiGkb^|aQ~GNTi#?v&0{qE|)q(*{b-*I?5|K)o8bkl*b#(jB zWd(E3c}zcj zFm9>(@iqqHSb>WD7n9lVNVvEZukH%j36MQqWqfa{meCLuMlGpa>720?WU%;{QUb+P zokJcdd{i(g-pwzHm>r>GipdhLzibf7B$!DIblNN<|IkXjd=WBvh<~sP)EQk3u2d3h zI`*b&QArQD!5vhj*b*9ri~lI6tHI5C7yC~?6k!0zm;XjahJ z!@;wKeQTV`u}x#WjLfx~+|l;uzB1OLlscz*k7UlJ1_Ak*^ZUh$(>Bp?lC>gy?^+8% zPMeJ9PyPtBioWkc&9t;ti=jLwu0!`JEy}Ffg^u;z1LE6h_-*4iBZG%9DjM_d9Ug{r zPY0#wKh2o!^n`n*m6gy)W)9-ByTg0Wa_PWUOhzep8Mw`s$YR_a(VH#O)P+s`HHWu& zhDQ4LeqpT@Ypki3u*ZiLg>gpWE*R>?Mwg*k+NwBAan6sY$`!FP7+b%MlY=UVruA|M z1&un2H=lCI0 zwc)^nS@z-Vn6dGP(7rKs6IV9p%!O#6DyH8B`D3MQQe=1Ih^yG==+Y2BOnE_hgaAt|+o;0n^Uv>qe zU?&+X-FlAiRr>=2ZH&(crQA|bUl|BBSB;2zDI7Eaw%ia$5hH&$am zjVe`GGUgCyR90ZCEG+`~B|6O|2VU6bqLX-S`Im_g48Eog@owog1eW`U<^i%;Skcl( zdsjYv>a_z~##MUK=aamKs%ozuk`91^*vxJOPdnPnB+kxF!$+tOb8qY{P8=MNG6vmN zTH7mS4o_po?=so<1#{ur)r=m8I*jyekEYI6`!2h#gicS{-Ftmrd1IV-NrZz&3sHy+qN4(-uFhh3S`Q6)`V!y&ze`fQ%eDegu z1T=&V+e8XBC7^3~Q1ZCR*wEZqM7f>0cJi3wjxoXf8zFTn&Y2d_wul}q)?`8pmhYyG z7MFZCn?RT&Sm37WOMQS>KfrDWApZI7Qw&t3WQaIh^`)hpq3_hbi>b0;`2lTnLw}=O z1}kCNQYJTFaO)mjn0z^2vFw{7#~Bs}tIP`U?l~=nuko{}QtPnRM(BDfCcp>m@77r4 znnzfk@0De8_y#$-7cWk0szlV5Je<_h3VP6@(c@>vl_2M9I5^&?+{VxU-#1HHEs8q~cLmN=gD`&ldBIGRO7ruif1 z_ij#kJH3G~-`858eY|oU+AUh8{!oU{YJ~gQ4@TdLr&_ovZOZEN)e9^#DW>!U-#!sL z_INs~Rn&jgHJ3{lEFmS)b7mX|z}Yz}za!M7iUeZkzbZ6ZQBJav*~j<|>Fg{qC!(x% zOe8=9`<`ZHV@|f8<}QP^zX}dhGeh?~ryU>j)W)i_X4x-jEUw575a|*LvPcLxW#4GgArm10X-ek_(z zmc}krs$|xLH@3g7XH`9XqOH@gi>5J*Xq7k_S@!fudyTK>?lsIoB6Au(tnVe1Fa&TF z2`SNmx}*xYjcOWdtJ{=%Ma=DH(d}lX*Y(QO-t$+Mn`3{bTf=Q^WaM~8Qe_}+w9HAq z;8cNq=sDA0b|2aNIZYD%P^6(Xf8Ke@>N=6P(Y1bDb;okZJ;_mJhTU)2SA6?HFve-# zt^vF>{~`pwRGbX49`!dHn8G-t{s>`ClGSH=JXRc8ev=|kb^Z#)awWI(p7po59*8dK zM!^C=C+S+|ZT5XsXnQ zh<+7llVz-mO=ESbi{soffIEz&Buts>7P9$TQy~!Nd(lJB$hcBIJZ6)^x&3R8Iwx*2`m%@qaXXjE{l;@UV}M&9D424A&9d|3JJaqBH9b_C|GtVW^o zNBO@9@uOT=)Bm+L{Fl9nmpgEg`B7UtwH*7LRB{>3jhwheb8Wc!q}67Bo0pEs#P~)~ zzma~-RW}lv{7*LH-?XVLAJt^>sGpn1wXIETe)?o}*YMu;(Gq1_@v?BB+tF+blbE2N zwBnQh5!WT}W5!-y7u6?AB{XU@;ov@gc<{tL^;%msBqKJ}w}eQ>v7u;of;;8AjOT0+$6qVHwFldQ#3@nIN-89M(A9{Ksspn5Q9;eWLeeCy+c1o z%cKJ*t0xKu&b{cs79oLhlXqiBBon_CyJ(}MsIZ-45(gaW?6#mXLbL)-@&EP(2$~T3 zTnuaOJ&ggmoDa<`0q; z(eHHe!g((WDe~ts>*~ClEadcd7Ggz@$$ctmTuk!Ku9V4T<3f4QG8$m8+5rH`9zYCv z_s*szAj)rAusls}lF-pNU6cnD=pnN_sh<_^k@@thq4+%n<5CQD*PcdS#FdpV*0Efs z!+De=KY#51u{CY2(uxEg1v^J5K>kOprznUq)%W~S*=lq1m^n^~!#k_Le_czU@bn)@ z4sp8rEFIX7c$ny;%VrjfX4% zcF@j%GJ>RJa*e`eZ_HR)bf&>ny}t7+kLU3RCeRKCc|Hc8V9B`o%6wK!_7qzO?n5~n(X=T2MJdkbDn*!7R!mvicrg}GwtW3%tb#68-DqriBwT6O8WNak*CdJQlVT@?lTf^`{rNKW~Z-(RjflIiAnV z+%E_noIS{d*8E(OHp*iwG&D$HmTcWMnrUp>(#lTcqHe1dO_d*TI4iHa4!8YWezd8Z zOsFqM)@+f9{s)AIpS5|>?o29D-3rG#_1vvWE9dOB+u}?lMbla#mCN9<8&Z(KWww~F zSy$k~o*-B2{&F!IRKjan3{0%SHUzlK76tf^Q>a+2%@!4TbV#vIk*V~CwLOh$E~Yj; z+r3gPbm#^UODFh{?MBF-`tFPiRItSq$csTeIc~{i@b=F2#R;pJ~XJcsj?dp>Ph3R=CM;jyV&H?dJ{(%VPtpixftiuc9;xNKEX1aFNK?QQi z+b6;2vUw9F!(0&UCnLPnu6Ofk_vmW)r=qeWB@K>j@?Afgzve@lJXNB7q4@Aag1Jzu z!eUs=`-|SgFKHKWUOV8PZNxJjn2yE~pq49)4BV8z!?eC>Q|&S1RNit44UW0^ zh17ya-L9_U zm{n8C&}9yEcReW2+n}!{r&f)J3U{YU;G|jI*3PeXCF&$cewPxVh^Yo(>bvW-5GJ7{ znUJC*#FOPMc>D^KmuLCfY?G_qRc>#wdI-cm)0A(cAj3W_L&s!^Dne6*3}q}f{E;e} zs~8DlxbV>YLrHPOZo+XCkGOMn=Kpr)mE?tWQ7E`Di0ApvTK*xB`v0$@`-$ zFP}12_(=*IPXPOtN%F+)>l6f-|o1)B3{;gvG5#os!53~ z`AUR$=(`Jf#!t>6VPi421!Hp5h&FQ7&^GxaXdP({9#OYS`-e8`-JeO}E^79o9?e z+^;0lX*3v-iQ01M?(;$#%xB|@dLc(^+5dvVt|;V1w`EcUrYukzm`x<9-s=*Swg8lJ zB&gdQHVCu<1JcS+?m#=t(%JUGU_fN=77MPkJC)Do0CKLkcUw~mrtILv*ZB~5erZsX z@YM&?=Zmy_w&dF9{Ak@$N9U- zIfTrI-&Y!LniQy2kmXs(M)tt+6Z%y3O_Lz}&p5bH~_o%ENhf}o30(10v-g4I2 z|H{7(ADTJ@jXRxsOZuf;R&ka&^Cplnae#ay%J>eU*p>@*O&jvFZ2E3c+6OL~P4^HH z=H-iX$n9d;pZbN1ZA_gV6`Eyr&CNC2=$<)W ziuSA;px_e!q}KF%_%`1RFmS5 z2LCkQI&+4Jh&6=nOje9tix38&{P5Gy4{)xorWa@$PtU|SZ)QYuMV(u(Qcik}(fY%~ zhoZ;7p7wVCH=tO({coHYEYKYzN=TZS8a=NYxY&qRc5>V)HnjE-*5r4FgqvG-JX~%% zt-*NC)6yh?JzRiOl9svDA%>O9|DGI1f3u@@YO7aBi+WV|#4*pk*k-2ilPYB$;K^l9 z9kYHU02_gHI@+*+s*RS;y--x)+2BZVMx$9|ci+^hLrt0gtpkDpUe ziiHS4gTD$;>h}nupY2ns@rcTq!9-!lQIoaff3O5Ch zXE%eljV@&gc)X6*!eB*Fe52FLSU9rJB6UwP;1j&Eag^zf;vIOZP0Owa`;>$cn$jH; zRW-!3iuE+!?DMeE+pX}Nsd_h92VQ7tXbIQ4EOX@O;;eKblFf_I`;wtj_Lp zWXEQ~#oois#|W%qOvIy5MvlYE%DB<{rljSAF1F(ea@aEGS;$R)#}~_|hpx(c)nhoe zMatNlbjQ^Ym^ylIK7>ZAr}SOIhr zgeDM3k5J31Gp)|hQFnXE^5r?*96I%4lUZb}w%hF=#3=6fpCU%S!mQDzh(kWes4r1z{)tn3G?%t|TSnIdMKiuRmAIlELy1tNTm*f}epn)NfYb^^=HI`nnh>in& z8;BMIvQKlNuCG*UL95+I7E3g4p*!bWU6GfT1GRgC+QLcXHSYhxXMsBDVzm&^=!^!nA zLJ@QrGr&|Odg?`caq{DWSkJ)o1I=)|d(Gm2D#+|Z(|L)n(x@k1yoq(SGpdY+egGkp z6EdF}@MEuM(%XN88S{?#rpznL>3FdWt$K#zo|Im%8}LT&*LSBKerEFtn}vTat%Jr2 z$eS*nE+=0q?)OjaR5Vnep*q%^o50P!Tp8nZV~-hbu33w@#r{hgn>Ia;8%X@k2F$%Y z|6hEO8ph&v;!(YBqSA8!NuRXrFcN6nLUs3T7zMQ9>gy0>W#+azxg+}?NYWqZp#&J4 z)&AFf@!t|a9ssj}ApCfdF>T`f79pKkvxhKLy%TPfMt=Vxt(BvhE8YXawGxuk09MdH( z@k1koavnF*H{L^3n9ysLp;rf5{5}0DF@x$hX1-_E;zaHsBEMVyQWCy8+b)?Q17eli zk04HqB{07M6@Mf#3uTzT?xN?*qa~Pr)s_En(ZQ`GanK+u1($!CN;|{GkY#gXSJhEx zLw=kjjE0$`vR3TLN^iu- zl-cN;!vkOV1Bk^c{w!B-8jfOL!p%oHmH%AwhlhQvyqwF_?UtmYG*fcTdIPbpob_E# zI-jf~Sv;!SDWnFjWMu{FgibPfBSqRz7vp=oYjapDlds{w*LtIi-d0d1Dv4a&h#d`n z@>T&KpNKVFb-=uhr50&=(vZScepXUig3-q-#cNC|)MA7SN9#yF|KEPwgZ!a6Cne-e z{MT^I$M2nCa@JS)zP?V;YpVTC&K_>778L2VmdOG!CtCiV5@zm<1&yER z6c_UOv1st7=C<^_+wG!aPr>%kX9~I(fLDn>M)uRDaz92iqgIUe@*(-2-k@?TG<`Ym zuvck5PayY|`y0mJWUeU1Fc6hNJYBn!V@1^&tTbgVx~9;k?e_~xRin~znnQ1=QCO_d zyst`w#rcDwi=fT=Cg?lLsQWreiFe*mYkHW(EY)-nH_lMhPS~P!tI0FAiYj=}-Mx)hJ^Q7d{ zSZGT#w?@bSDX2{>X6BEvUe_q4v zVyX(d{fL96nL}&Ps)2@0$-67_M@HZE9%*6&!n@9YZqs$}k`p1qT;Z6KF}K=;dUzb@ zecn+w;w#UV_5xytZviVBq;=YtnJ7Ui{xNs5mYudeAE@gAxb0d&^ zc?RgN;{(;=<;@}po=%%Ft?(!VJ{* z(bMURGKPUCF;~r0bG&>b{>r#T8N(fr41uUvWK~u)dB4{z^8~xV{ubCM&7k6IwTa)_ zXOg?W@3~^_axcD~`cAWRkUjEVS>8Q@sTKmO%^vYlSXk8~I!P7?65e6cN|j8D^mu1k zG^|`LJOmT2lAhFaOG8M_sjI!edX8igd{-DJ= zM7n+ec#B2tsn&&+Unw9`vZe7-4+mm8P27gEUWOf^azBM#-VImiN8Vfs@!p_vQzk{x z38RZIIX+K1zYrQbk-tK%-Uwv6#s^-Za{+&b(iK>pXxaZOLi+JBq)Dj%tJ&mZtoXax z@gFQ68e$^ovQI#e^ik<`ZUQ{GhJruwj5oB2w&O>;OOkvFsm>cAP*KsrzN}}f;o|qZf~nKoF5;? z9+coo2c6FQyLnf4Gpzj3|M zK8MtdIDDw_VJxP!vYA2}_QP8##0W+&g@uv3PeCvF?!SWc)k^w+gtdy53_+5C221&+ z4Bd4~vA+vsFM{{)ek%5HPzG&1T)P%gtz(aSMja!&PsBRY=ki6?Ghcfkw5Z;BfT-wc zIT`oom&Lhum}taM99BufPl5z|rQaVlFm$Ijt4@C#-;*que!`>8%%AiyVqc3$o@ri_ zzz*w#Z-ua84pN?uGr7GGbxTpJ8(lu&3t0S{q_WMniwo@|%44OnZ+YtW!M8M{#%6ZY zU_SL&CF$&9_)o##yxFaBD=JxiBv#E0eC53h`58p7N_?6Nuud|Ng4URCc> zbt1}$do=p9HFbVAEBN)c(Y_R}uN&Dt=kCo<#ER!7n$OuVtLHO_LowOox?gTUrIzA0 z>krmg0A+YWKdmfVo15pi+2g?Pn|p04EF4;zel^V)G1X|ZPB;@HC=Hu%+hpx+KdDFz^XjQIMm zPSST?4%BtHoj^o0v)))^A=0&ZIp4K2jl`<1Fm(dMfOZxK@!^LFuU?tryjGO@>=-si zQHV8R#BqyV8Fl^}c3qX0Xwd5IX-ek$p8jNuGbdUB#>A0^I+&;&y!or@c^rXhrK=Xy zZ)VR(*pT%DqJmDG++z%W6){*t^bn4CsAchCo5#L!Na&BIw<>OEv2be2eAhPZEB%(% zSA{!|3^$Cm5($?3{voiX!CY;jyIr)CB~8jFEV+p5qoT~09X_wy@U)GfwE75FIw4*i zS)(>y_shmFh5pL+s#$yVlcEq)ga3$N`!h&V}XIh{J122RBqDmr~2qM6TzZ5oRjYTiz)f+SJAVTSy=YO*@ z{=PDEH8Xsv|6BsmNj5siubce07TKGX@x5D1U}U3YYs-5Ut%#RMxNR};omt1&7qjKRy`Gs}3F%_)N~Q{W-qXA#HJG-^ z4|)FW#~;Ts zWCyJEU}RuGVGLP|Otq-Lf7{MC;)=w-F22JE5{_eU87jp%fi84vnd-oAY-@6<^bsFk zaO$J1-*G1)$fa#1^yWqUm)<3ji}5)gGnf+CVIC&Na&p!GIlqGQZ~eMlneDuzGrsQ? zaDs$`md%Fk#kVZ=IBz+LLC7SGRx)d$XLmkx;QZ4>N#r~feAn*`xN&G(4ALleC z0BjR5HWm1TX?|hfK%a=bNNq0oflJtb24kBZ{Z}ydj`WwiLP5JGgZez_<2B9MqcGuH z5*tJhpdO-Ej)|y>a}D=!=n>tzRZG^=h2ZH6e)gDoSYJ>`8&)I zGQP^FFZ!zG^H+?<@D7Jk%nMXcOaSsoWTxDqWyksI)X59LwU^Val!uWjlsjx@m8SxZ zj{sLc*9Ydj5$MJ1_{zT_2XxZgd8$;e_4r>NV8AQjOwuoE7=2ndjE{nq(%x^*h_XDv zlp4fyuT12HYZjjc(59p#+VJ+p=)WF{(-nSVCoT#75;F9?v+_LZ`;}pj(!l4I30okh zP^QCqs9GIP;^R97!)PNJm5f=`G$LQ8S?U$W&$Iws1L0p^Gl4~1Rd2@#8TkjMppuD0 zjhl5ZSW)9*;mw#gxGGf1wm?i4@TI9-JXn8ox~%khi9#Q@dj#*6FT*BTnnlPmjJ+@^ zoC^*aqtTB`D(D1jmTqh*e2rTF(JaJjU~|d%Mh?-6+7Ck-<1ZaKs(rIk26OvQqA3AB z`@{Ike}@y@drbGq+hotSB{DIGt;PB0Oji8QqAKV1MJLLn-k!nffl1#oqwo~&A^G^J z#tPmE=xh<>&V<1`_UatJd7g=UTQb zQ9-sv?^~QL0_;-MxBTV2{%j;Lb5#7BvwlYQlxhXmOE@cM#tga3JK^TtNEc<*iIM*! zoP0f;r9Lnh)YLaBPCfI76evDNGu}7a^Lljt=lV?KctB^Kw;Di=8zjalQj%465T**y z9J$=`62D?^)GXpD8tzTHULm9ntmLedc*x-yPwz3|9e7}3*^`&*oLk-2rhZdg=4xHT ziF5>f8JEZ_b5&St!uQ8aQEbq;Gx-`YFZ^5)JJA8Nr8-$U5t(&z8kiqP{{E=v?%qai zxC)%4>z8Mm0~xiq^&*#djraeY|0O_vaJs<=YCTbJ1DOwoir$GZ)M+*#Od&XxWZ{m@K!j9>%-Pqs*i>!C3Bwb761)t{BBi~uOUT*_!5Z6j>asEsY9=S$6V}` zqkhc?kYj=o$W>X<*+&)`Xs)j>>mDH*1D=s{xjKFWF2C6sVu~;q;;=61kw)2@6?f&o z(8OX)m#cc`>MU{40WnJJp7-mq$N^2e_!m3f*CrR6!I_Q1OD-(OcBs)K*6 zyYt9AQS{RMCEXMQae~PBlGXA%Bc6ULvy5vaiH8>UhsXt)J&PeTy(zH!%N)?}Gsgs1 zgJs`~ABs+nvG}eVA$o4pOSbR3fgdb~zw4 z-7%1*Zw@D3Hh6KF!CXD--KeH5zQlASkC@%XH0y?>@r@Cz!jY9@4MbuwQXe1UTRozl=GWi;`o^cJVYvOnLpIq8fEw%Z^S@0!LyRfBMm%4mQG;l$p`{CE8+Lc>$0UNH6$$`eIl!Nph;TlFFYA;&^Z&Hww_D%KHe&GHbGKm zv@jeZd%jOJkBmr-3tD7qj6N|))}HarJC{EDpUI|mR&J8r-cvv)IP9C%0Zn6uR#X`M;lcf zcca4DA;1NUX7WlIN<^GimlCs~Q=!lENvv7%l6rFCC;jeBA?FgCer?z%j)MPx#G#4T z(iMvV%bSUSjymhGd5YZ}=v6a}X8w>y)!bdQuuvPcJkL5csW}*TK)a`JM~Wi0Z(4tN zHGZX+KczUkDXD37$l}<35Y+h^m`Cb+pmDt)g^?m~BI~SPU2hYvL3lw^X_5-Sd1izs zEE&@B(UzaGp|R$^NWILu3x_la>OXwHg@QEn)(!TaJ;7%z{qEvW2XmF`q>tm2=>Nms zdxkanuIb(?Dhdh$(nLT|Kzi>@ks^j7y@T{l=p7;=C|y7Z9qGLjAcP{lgY+JHhlE}N zfgSX}*37(nX78C<^I;#yyZpp~$-|xdd6HbubzZ;oj98{~{*edehZ$`QWEtW^TT=7N z#n;?f$BWjB!{EgR3h5jAwi&a$u8}4_ENgr}E_%hkHF#}@xau%iS3I?`bGv({t`g+1 zh(Ufktqu@VcXRmIOB?U3d%eSDE?~dG8vDZ#-e!;>78ACa(0>(HWi#j*`M~M^N{k)A zmoGS*PS8O)QIW81pB%1Iuw!)gh-z0{E%D4-uu!bmE^$pAdNt8GlOV7-fxY|d63c_= z2?-w!xwp1Mg>P<}7+hFVg`h2nyrdCMGE~=R?6mogJu^HxRFQ4Ss9xXL`mdnbPDjO(f0u$3K2zAv96A1>Ea_l$

sH)g~m~_QhlL%y?klWT48?dze)MnN5n@jZln3->SjA4}|ZlsrS9?`&GbP+>3cBcpF=?thRi$p9)|N z&dtFtDAI8FD*fQZH`!-ET!{JQ33){5OaUK1+auC(2KLlr_!p#bqqyzlIG-pFKm^r1 z>jXlfWhk*Ft(QC%<__1#L6@6-4JU91AjI>-o5WeQQJZ=hi108-zZ*1y4(KlqQP}m^PKi`KI)Zm)7h% zroN%1hV`$nYu+C=PYm7H-1E@OD-$p1Jk;Y`}3au<56B9S*HrxJOko zegEsCTX|owM%q3cGWNhuAw4Z38wXZau~TSiFbfOdO8I3t_?wYyPn4m|bDgs=AvZo| zH+j`I85T;p?e5WKAB(V<2s+&zDdMXelt{l*+G7f#2 z;uB3B5`@CUv!ev3pWhb^Ak2RfOyM??N25`{nHhBt=oC=NuaR9#wCU@v(pzAg>-KPE zmT=1}pw4TQjEMD0Qx~wDKf;~I4yUNDk5q8U>V`16pHy}0?5Mg~+mtngl(khzUp|tx zI4W~4`*yNsc8CAAZtP|k+9>fb@p#0Q73kqSZG!8L5u+_+;xXg=g%4_$+45pgRK+!A zEd)FBSLN5@cz5cUd+YjC)83Czgn0RjCEeCm+WJ-Lv_DMjj>*rSsIq+9dXG5TGN6Uj z%W4WG-we~uN7|etS$q>a>o}_9rg?762l!)-qH$iIH|vY@-;3VN_(lJNsH5w#2oDFwV1V_tgByn5qovENuA=gJ_*tsKl#akEKNkMEm!CP^&C#p z6B0{E7B^vIpheBapT+!QJ{rT|cVf?5_bD3ow*0XFMRrEoZ|{!s&xjnUp3aRaf?%$F zN8|mqwJ)|-cse${-H$`#evCx7{2M76T=_RC+K@B9AOqvhvr4e|DWGdQnUsF`Ap%K? zYPnjTZz>Ns5y*MEA;q>tY1DX`;WKEpSKfhbz7S? zi1T07ZSifLj(+kyAMgp&d%3@=1)MLJ_7Mt9n)s%N)qUQp?ZQ{GF(EKf(`7EpdPP!M z0MkiB?JvtEM!CRON&!p$C`REK+rR>%z7^qzu)#y-c$3&_WnW;-NPy*hc2nmtuVJtU@D_ z5X{LP7~8H>Y}+|ofnhTOVBMs+#HQcc$XZ^7vT~LDtY;%upZG8<98;`_0ANJ*^+7B! z4z@)-uo6hc)k5RpgnZW?Od4R)r`$DhY*la9yj85iNCI9PvH!j^@BBVb6Rb59RVNBqDEV>r_Jv|c_VYimA1k0rbtWb5`g zWq+~QJ>Svw;;T^ZNJEnUQRYBl28IA$KF0L&40&qCUU`}>2ieQCwsA9N2i@VgnF|y- z2W0phi{_88u3Vnqy&JnJUILMgf_;egR?Zal;c9SwIt6;AJEOlnuFqSt0qu99PrRI@ z*o-ZjLc4DbvyX%5uDDMRH~3pCnfrE}^rYD9?ceE&?Qo;4$De{PErG48yrsMMAKn=G1>7iu3c;5$?4~< zo$+pgmh}&(u-+KoeSO9%?iSGtw(Rm`6e4euN-;BVMihqaYt<@3L1Ya2cZ_gJqbg!^yBh5%Q*y(Wp9mxSd6jbizec!);(J5%oRMq& z`+-Mw(;aa`IG4btELQ0ADRw+ftWTnS^}L(LLdeAdp^bNNU?m3@?NlM1_6^!|!t(R5 z_vqK}1}N`h6uE*y_BXrLld)c%z6_%ky*WAGN$VPl_@|zuyb2w5!YCgC)CwgHhG;Nq z&hlkcVTd|tM)*K);Spo;3c@7{olE;hGgTcTw`8LlA;q+qOM^}GJ zKv0a4B;kV33YTk!qJ>qWL?CfxaMq%isi@k_hv^2@A6ykuTkDb9T6Eell~`2G&{3BU z=5zRSf&OgsbY;tXw-;>2)G*M zhaK{_Ucg5Heqi1LH)cfEf54I_k+4uWyI_$qwSpC{$CAGpx+_1{6#gTfi)Tq+2^hAN z$^2YV(lL{?JAgx$ghAcJB!P|Lm7lDgZE3Fq*^YzU%f{`5h=-$(2|bY3PT3{{-P!W) zWrJ}~ULBo~kQxkzic`4{=P?_4FR4WAh&b+_b{WG!uqAQ_+p{&Z{sfvgn#Q3rRRYIHGZ=8sjo()T~ToBAJ+h9j3H6vqY{li$s_M?FX!=AqMcIvDgu1Hdh|3JE4 zu}-;IFUv6crN?u(D9RIQG?A-c$f3yd(Wa4iuz(M`c4c~ip;~^VsN!t*cb5c0-kO%T zNla9G+dtUGBh^_WY~SF8tqYaQv%jdS(T9UzOk4F{VNgkBH7?~J5_j|Rg(4W9RqL#7 z*xx}MwSU?W5^1b- zFS6OTWUH3B4vo4@xDwFMW{uzfh}&7;-Dt3-Q@}~};dt`JAuli}b`#&0L{*ig6i`~h zS=!tC4tZJ2G~`>ViiGNs*Z_5Z(Xv%tp#oNH(R#lD;)9415z2;hjjKYlH}TqzYe(WW z=T8mg0?GPDX=7-QKP^bwEx+j1^h_GWqpcXdDk>h`nmvFYnC0w)v&Jiom)y zz@%rht!m6Z+mTKs8ZGexS)!nG80lWKgwD|UPPM)xh8Je?OzAH8`6>7Ewlbmta65M0 za-|L0eH^qR$nFSu2TO;TX99ZXZlXE!R&q&ss<3-P=Weg8qy+tZbAJ)#pEa?I81)O>^$QDbIXQu0?pmow0uIcZq55L!4)b%Alv* z40^slMr**UXz7r^q0x96NZ zHs46r+>menaP4Ok_p#4hl!Rl>uEk{y;6wpX$sxYkWqE7=EA=5E(Euf)15;PJ3fIWd z-MDEd!ob4&PWsvrZOXy%iL-2D-I{PA8O-&{sDa?1E~{zawsu$Qe{HHDnf>b!zkHo{ zj8!Y9w^&Yyy2Djn-1gU9#PZXCQmQ=r&bgsLD5M)jbKcwud(WhHzaxU0bji9K226cS zIz$0%)KEPXd!BAUg`VZd{KROEV!>9mnSJz@5YCy z$kfk$sS!MixkuJFyk^`cBGaO^D$Ig7BOL~S=)dy` zZIe6k#9KD!i|d$cdx+FO9wS@FRliBpcReN$nFjJ%ol7MO*rWzst&@szf2ry6D6LG} z`>?Y!G6q*Jhg)>DYM+qWFXuhCQ@%%5s^YGyIjA-R!JyNe zczJU~P}9^$UPf(4$$lo7X~T4acAZJ#&9qQw^N5VuCiVD+>h^MY8E=H@(5j3vL1~tQM;3WLRK=wZE5Yo@5YbE%3kdpt%*yF2>~$4 z>3<%fAfHG1c9Q??J2Pc=ZGSC!Qjtw2IGnhLM@he8I*C9xU#J0v9)-Orsf(#CICNEd zdyUcoiF8b6mSN-SI7!&3O{F!xY?azyo)P1rR_kF2YDzbLX36`C@#EeQ0AXmsbXD*s zOeu%<*0requ}aA8t-Ly`e>m#i8}f=@i=?sjhY$#Bq7i4BYt(}OTiPG2qFG@)D#rGN z%}ayoqhpRShB(j9ug!wTY7R%+u%?zLnpDp)d14WLjQCwoRcA+O;f4!CBqc-eZ9F^f zh*y~!Yw#a;EQdOBsUgAElFBKs^eo!GajL&07#njMzs0ezStV({q6B$zb~nP<&Qq{m zVsT>$=ksRE{zL>qzG&vhs<-PT|JQGRabso zdSJga{9ZNlbjGuEt;F}}#O)#;c=i;Du?=-3ZT!o(_+Pw=56G=;Fxtisjz>a_l7hHy zxLZ;4lg#lUcJ)NTW5l#>wmV5`V-SI_W7Lv08ksBwRuQ%?d){qq5R>nPkdz$l$80Xn zZ?`Iqv?z4HMzRv8&~QV`X5z>@Rj%hwyY<6n>>#d&Zn{+99J`f8sG@!6PSo#W;uDpc~%N-N(sw|790js2QiswHZ7J6=&PUdS|<3}h~bdK)YDN03jL zIB33>Vo2{}rdz&O*jJmPw`O8`D{`P!THmLmEMKJ8+SOG05@{hrOma z@^vfP;O_b5GY}07rS&$oc+-maG5t3PEX7q45Mb`ecJ0!#XHl=9I!8h*T~;WqZ&#rW z+i}=Hzu&CaTlg&VaN5D@k#M|IddXHw-u03{j{fi3JIxRY!j2eqNX}-h*|Z`=`2FVn zBY&8H`Li$=ef-4tpC8z+>v7C**)Q~Y0=7cZOs(Z62y&T<$7+>3?|mIi&M1e&^yhq} zEc|VM{8Z5(F43pP$KbNs(OPeqDq!%}^asj`=B=irLJl!rqfPlITNnfyt-6uYDtCzu%d{on z-%8w#YaRLbBX0cTe#C!2(*OJF`s130K;^tN#m7kv=a7V>V5P0m@GcDR{Cg`N3rR4L z-C@-wTo+)GW`^=|vR?0d#uzV^Y0D5&quSM5@Tcd)T*i} z&Nfzpo$05ZWoT!lTXk56-j+BlWZQ}CLQFSGQhmk5!=pO82Z(+y@9rn&jgeBF&u_<< zz#1=Rt+7C;yaM)AM*<;KJ;rIi2S^o030hb%KqJ}pe0B`jbs4YsD)cUvE6%_|_(yWu z4Se4CCc;QeyCQn^)o|4L`Aqd`&+@?RpcrI4JU7_j6j;$JU->jv^GjFf{8#dvUl{cH zJygmqms6mNQVD7h0Lt4lJJjdCHKe!2GiGMLq%F!qTTtn0&Bbh&zC$*FLN>=^5{KoO z{t?lA{t&H+>#bUa|5liyr*{XT7I`zdVQ>C}Bi#1#&VEi)Qw!}`C63qkGoWzhjy}mu zma?6aUnB;AcI?som0M4l7r$nGue%qOp~w(656GG`f3ZpG8)$*PW`R!sIZc6A#ElRd~J#YuENY2t#2y(-Z$E ze`8}xA8gEC>w03o_Hu)#eKu1)=r(Q&qk{R~Wvc|8^EDEj{-P&hJeV_@$vOHGoBO@M z%dy<0L_5cY+fv(zZ6?D_ZzBS+KKzMY8X6oq&3n+(ucdgh1}Lv`9XA_y(!@~G1e{GT zh7L9>7~o!_?k&|)uM-5(-MjK9K<|YzesKZ1-{<;9TJ$a6)AA~3KgTD-@FWTJRfm^i z(;TAKzmx6%SUc408c31!^{jtF5-q>UVa;caRw8T=13np_#HS*GNw4 z*_p97AxfAqHf-(J^!ydQ%mEn@s?i4~fmk)H(+>fO!@}h0t9XC|LO{LJXapTMyhD$u@A0=7ka~aYJMHQM zpoB*TaXG(s0obMVr(`Tp-Pg9&caTyB}{Pxdqv~Sj(MvsS)F- z)wZ4jKKpn5lzOR6g}O$cQ?7Am)0fX^o34pyD$cuR>MeAZ1$MI;=w*y;(IYa1g$i{B z{qyKeyt^>vsfc3Yv~O>0l_QTLF&#o(Oi8W;awrbNwRAib+Td*eA_te5Bn{pq_z-#{ zzosO6zR}d!agbfysof}&N*a^uJXQ+>+MdSYi*)p*@ke9&jlJkOKXW)?&nkK?F$B}? z(JH?fgT)4g*kH!ij3l}dxX;*M)K5#miL=5IHZ0yo^hJ)xyi=LZK#zVSRa2hJHBaz5 zyWgYYHm&d!lVT+rp9k?8R$Lzr!r$o2Lp&Pnin0J1ajWsry5gSenHK5ri!sU$1)8VSFF}xe3iGBW}ub|oU;j#}Q ze9k<@8c@YIK2f8jXE4fQGeta|#tS8#IZd#(SN`O0O?!>sj&x&g?L<_qqIlwL@nj5* zm^g2beZEkIP)U{oof+*isYXfkVBMXb$~&_d3;3{EfCjG5`g-yFf0l1P%>aZ_ zj2|ii30Y~Jw77X6#%fnLl+w9%sibnUQhXDPV&iwAZbzF8FTRc>G~(oU3prf_am?$3)reUAE@<@P3(feg zjHvW#sXVI$8QKyg)qYO&%rL@&2qWwD0bmkEz50o4I{QLzTAP&DIT8o`&5|4#3R-pm z!o^Q=0d1PQlG~1!k37MTK^B4b4%S+P0BF8DC#J+(X#?s zUkxW=4*>dJPC~P;PL)TWFOZi|3h%YfHu@fmv-)mNRD&8|>vQAC^NpWn9b5XF2FGow z)aS?19Zbl$#DgKI#PxleoSc>PCMLvy=t=clR}rgd%vR`Y>djT#Mu(esD7@GD2N3&P zwswRYQXSrXRZeeNHQmFGfpaRN#5$omuTS!yq$(Yn)r(m%{h^khLBv|B)6(@)?@HK? z_%d!^OVFIYlp}MnCUCTtjA)6O69-!6mmb#~>Rj#Hh@lmh)TrNyBt*ybZ=K-Zmd95Y zXMZe@#e5mBEsxg@G^}tJv_dFkYu*J;bJ3x!)CKjc)64Z5RY$UlZ7b{B+cD)RgvL&7d* z>V<|ph3_X769(BAaG<0|LevlL3Xu%+jSWmv$=2LbYb*1aNCkZk|w<@8J+BEQ-R!5r#ELW$$fHcxG4mMb!=&L$Ll zgpm6h(oz%^zW!e<4+6?(=_gV{KA8&xDSteml)oRb!Y35-be}DM7F+SsAZ;ni@H6>QR)uBP8!s_^1_R=2$<$F)%WU#3N|7;j6v#*24%_S zgWRRc$KTb6z&)qB>d8J;*5tMM+Y0aKvB{_R+oPsPMm@}7TFgB`Vo^?0GRhuHj~sDb zn2c!SPSc3UN%=K)`>p^F=4n;t&NKF93kT|w-!_O?_)3kbC;yVEK+YtcS)~jz(0{is zNfOnRjZ~;D7m8udC$g+T6TWE zEiOA?JBjKso&E?w6BlIooUnxAT&>RF=!hRbAJcK#@~DpB%v!1PC^yc4IN(QyfFQr0V7AME%;PKiO72|2G3k zk)sy>{XEjJn<4*BNGa+6ojB6CY2vIO^{1!>R(98FZzvqm*Yt(?ycP%OPm8O?lJq?Z*S@Ed0zN6V7CBM2~~m-b%<1LyBeeU zag0(Kb6Q~DdZ;*iv`h)oI@H}tMmKt2hIX%!B5ra1trrk(jl{p&aO!ajBr=EGd`)+S zPV<;#C++Jh>Be}&miW>imLk6x-5M?~IE!5yu%ePb$d>hDV=c*zJ!>DO1G0mk>gLeJ zj;oE7hyto@dK)ha>z^=BRo~-{x9+d7yV5>;B-<#arj80jU0WX}yopU$6FUj+8+_tc z8;Hxq)H*K#E%_$3ZD1}o0e1Nc7n2*DT=F?I2$M^>hHpY93UNe}Vr&;Uh2~8}cR8|O z+a3#2MfO3-&|2I&au|jh_HSK}<>EZDv&5SUsZHYv!*DR)cw;?WCyo$UJJ*J(It8iO z_`*`>eDa_4hf4d-3(Sp?4*5h&Je?OBnUT(N`(O9&d}*@WvJ8VdfqPjO@#JgXzhsl2yTVLWU2H{| zDV!f_h`IT{e0z0zF4MRhFW4&I@1ONBi~@YS3Q_yh42ESB zh&*vfzUilQ9WB}W=*RRHu~AhO4cScbUBA2rij_TQnFz@mPXlNu0sU0I&dEJqd52EI za}46^z9o#+^`YRGx$%%!`R(xHh-)4frtArNl*XFQcC6ZwFF|wUBTQ8crvfN$B^7_f zk*%$S3`-RX(T60?+TPYxEzD%53)QO}ZREeLY&-f|jT6GDS~7NWY@x?p&cxE&JA9;( zETG$_XLd(Yvj-}ajV;Maq-PBQ@PpxHZ9<98ol`_FO5WQhrHE9@r|TD3ZKcR%bA5YE zN?XN1$DK!7^tvKV*E6(Bt*)Lqc6vURZ-DU$I3c{m7j%U9#SF|sFxBflj>5#=T~4=> zkn^7*AThVr{9yE+H2>NWS#wH+;~A#WXitU7?h|OYTBgv|{z^-R=jsi`%yO%nAL zpEcH0idMUAS>M4{DSt83_v7n|W(nMt);dp7$YM9drh=(7jZKx;gGv63)(V?ZL%7IP+D-ewYlgF?UkCQ%PKFPTE5jQmDjLHLI&OyH(s{Ff>z}4lAD6QI=U8qkWi1 z6M5EAJ5#&I^ntAb!Aoi|Q2Y^+S=TnC=jVyRe``nAKP{HV!U_%Tn6<#tr1ARP`?KFo zJC|zS*9){wQzLB(QE5Va?u!O?F}98-6RSbNx58~XRz{n z8gr%p_#{wVh{c0HzTQU@p;5CrphTM3HY8=5TcPaI6;va!f@ckd?dx>a@^~^4D*0$t zridlBLNk>;>t5tE6M3gO>fTGOvDvH!G_qa&b_Awp!Jy|IYS8i;?Ja5y6%4VwGv@gVswnUu{|=@& z)Me1(#hEEM+Ila(N+uH?A5C=mrEDSkdP?2Zihw%LPCj|%##a5-5#F;Y zU78b5e`$?}kOJEyjPrH={Yt39CPq?}Wg=PXO86p$Na~vDRA^6Bby78}9!js#e&XZb zu@bIP67iX@m&7ymarJ{0_co});CnFqY5rv_j@M>>q093>_-^z~48ALLO$40@6i+0R z-+E53_R^3CK=7NC?dK+8Xup#t!&!Hfyd>z52cVGoO`QJxEM4-)ESbYF6jTx&Qm6mN z-}n{HbLVT>7ZXMN-witbyRi88$W)8`mp0}DDLy-p@jsOC&$jpLY0-=-*}5JpF@OHt ztFL>=4@&E4M3$Q)_utF@UIGUrC#Lg${qN&{F>LjJU&H_0tNG`V{s%9Oe{SYKH}ik; zqvoI2(?74Le_l`jqu<{Dzj#ai=ns?mTQA_B)y6*yu7B2?|9IKGdsXHp-l+66B)uc# zm2dL0Ui|^0nR|)M)PdCPz~t^gYw)<@Ez44lcj+(*mQt+K`(=`mEVx>42>`gF6r~lf z3X5+wTaYncV1*~`Db9kPH5;0Fmms>%2=HXz;+5p1Iu0Z9Q&P%A`F7DSg*tilmpH+N(bamPx{`dczZ}J~V6({}k6p4$Ag8^j2dGUHN`m!+E4eqg4 zJ?Hyp(esd#!;NA7Id2u`ao<#-vm6jAr}1Ki{m&g!9sKh0q_Oep@;rS@{}ccA#R5L) zbb9Xc&yC#At(T_(E;!pV2v*LvuI!~jn&d-sJSE#L$x@xlP z2Y=KU^25SjcJA^*)-xRYfo(Qh9d_rNL_Iiu=l|SrpS2(OGs*dpScT!wZmG-tHUFx~ z`IocPhqjTwZV~^B4>|{Jns^*nBKQ3hCLACEJvogNh;Xp^6kg^*bPsM*5f;OFn?g!~ zi2CWPJYOyt%W?9Qe~MUkfI?`1a0XTL{M>7x)dF^EY1!)dPSZuYkRY`Kbq=s zGyTYxs{erXcJ8Rv99*=hiihPMl~EUZlWkFDgzw zXO(@GGu06|pJ7(#K@)MMjlEitmbC#B|N2XUrrv*^{EQ*$e0dljIT{?vYP)53D-ZZs zGxWXJZks9P1Ilo-!%Zpav`$Mq@&O8~FHptC#d%3u*>fp%uJWf?z-c?rmJHZTCq(#p^JLedM9~lIVu%-H;1HM; z$}wYlJF_kNTd9frS~BHB+E< z0`5EgU^vx`%e(!bA#Vl~-#Icg)@8WmKQB`MDmk?nWzvXHwCf#vy9Q+OL9BKNkoI@JMzX-+$~+~CHJoalM@7?Xo35!h6fru zNx+a!ex}d@xlM%tmI3$<%z3Rxv#UR#d%T>K|9Gb0)-IZ%+*{B|EkvR(MW7&Qs*wMB z`|E=BQ_PcdncGKK_9R}5YMQJ^@#}YodGk4I`}(Gx?m4??h3DkY;rsGcX0}%@enEZ_ zi}HtPBmCPo*d3?c1HbNly)zt_Z@(WsbBNEY)Cswo{$(eI{(zFT=YQvP|I4Xn#N_DI z=jb~pFOBx5heP1mZxAOAZ@@_e#%TgPdJwx6JI|)sL*x29ech$-hAe!?$Q!F-&}B)7 zc^)ig+{0rorDd}_;(Q3TfD{sfIkuF`vFX8%K>HQ3)6!!-M|aAeQQ#Lb7}2C$e?t(> zQnc8u$R`n%X^JxeT()L{se(sNeV;>im1RsbOL7_ul2xNk-=t#fTdl-LZr%UZGwN9H z1KC(*(OFI<*vpa&icd3pi+Ghp2JvVJik#DC1E0I191+_2UI><)C0_=y`elS9si8S? zy6Dg5(dwsAxH>Yh`z#h#aexd?Ei6zlQ^9U>RPOu72I88A4UnB&GW~hax&G`qjMMZWIB)S9#vh3}ZrdOSl3zBD zhftG_mP+dj&J}h8Lj)twE!NMyhC_VXR_$fN%Gn-vl~u2QT={yp2OrVp=UkjI7wGDw z@qpMLrj#LkB3s!r$C@Ca34@jPuoJ0AlNvD8J*!$Rtg}eTuIpz9Wr&~I4W7MI;Aeq* z{hH~W+{30GLx|oB5WAFKnCTi2(@(PV)%4;p#sL%yyg(?(=(C+S{mNoz587DA1&&&g zo*~h8VCj+|ukh6g?(CiiT1U($~9y8HiRJZW!?Y3T$&hT)?4doHxlhN;Rr zN%n-CydeNE^GUj>SxU!2sVo@)a+Y_IF5x+*-8^9`A@#LNBR0Z~zMKaFJHknXHw_~BD` z*@qWkOg_zT=fLf#9K}?ztCbC5VB_dmiGDVP>u#`?ehu^8klw`W51t#x72vHv%DRhN z{QP+xuHhU`zss|U@fyQxhye4KNdETIhcExBl4l3i6J${5PV@WOH;$(;C718~&zpnU zvj#5Bf0arT*eT*5-`x+>+%zyTm;H7M?B&exKTnuY8A!eIT%UhEn5~y8$SY0s5s}d z#yZ$wSC^z2xZOd0_2RFkHDk^lK9$Y+tWda}TymYq+d#w}MUg)T^;!gCs#A=aypD4w zg$l#al{+%I@#0KIAM#tixKX>^c)2BxIq!5)q{dR2VRe*23-s{VJ+@d z!yhMa!biFizu+~TAauf{lOccV$RD`A7sIK(S376a@SWw2(guWl@;%`3a^s~_$XZI^ zTF}7XdjZ$S{5X4nDP4iKy!v&gMN2YCr@znspbN+gb%5(I9|5{B05(jXeIoz8fR8oe zS7!qQDQG=~ggTG)9}`ve@j{U)SI6fSsh}95m&p2)OBk}jYj++m>90!HRuq#lxiOrI zIW3on=`U~(FCG4k+dGpZK}*!^`j|S~Nib|b0@SJXSnAJftXv96PdyOhkT`#qg3c|72)gt8XLl&aKUy;X&lTVQ=#kVkvK7YcB9a?( zuVD3N)7g6#j+;uelNZd8Jrh%a^A{0kiJwtjD(6;jwzG=5N7~Nt-ZV1stqOqq@Vp_z221U|m$sW@?Nm0>m2MJoIn9=MjIK;(4ch^FB@fwV%`)qJS8e4J zW*x+@PYd3aX5Mc^wEFiZ?Su;)8|FwP2h6cWAV;Ik_M<%IhzUkN4|4zBvOEg&eWTP0Xa4a9t#wMu z+4^4$GL%BcR+2WW69Ef-=c~urIXrm)H1yNU@O*JQx$j(yF~eg5yAbt~@6`AaS^Ze( z3|Nfeu}Iex-mA;)^@V-@&=cY66H>v_hvzlW-c()}by)PA&<@O%W2LO4;suN(wf!K! zkiI7@~!1rRxzpX>kudP& z!u=dYfqfI-#4{$_Br?vQlLRo`*_{@~so7MaJpRqL=XNV8g6dNzDv#O0kkP(KQ8b@dGqw{N&=RXO)kRG8oig9?k-iN7T0U3hPN zMjUjK$k)swd&^Wt29nnWg?=5>9KS29Y};D?Heq}A+@F7qftx5Y$U_i=7OR0eCp%U( z9C3EL-v~ZP6fvNL62g|(eV8Q;XX35FPI~;{BR5gRv16jn;>atP?79`-mlr-_Pet5( zRO3L7hWl~3y2->X{>%rsyflss+4K>nqh^~pX(-8iM+e@!(J7G&4HNf)y{QHRctE!A z0dUaa+R?ny1<`%UuON$h(>?pM1?9crNCvmjV+}U8PTbQz^0BZOtGSo+@t2wmrHV^;3{D!)?7SX6A#h>}`J%MQTF>V1^hVUX58}1uFcQpWg7=Ig>OEQ3ByWA_@9KN^oGRrf(DX)oYf(YkC(FFZ zyI$06sz=2S%r}vx99%ZRtX>TdO@lHr7PF@!dOu_(L`&O|g}NxfvYsa(cGN?|j_4xy z%B?MW0s>izniUDym7Z`(-Bo?BHgrlH0(l~{ONvujT*RGcX}-)UWP1`|aqT#*S+c$phLvwWgBW(BxrDtJ?Y$X%Ifi&@Hcrfh z7zy6OaP?iB#g~Y?@}w=fh-P#u(!&wr-(}N}ps>AtO|?71Ibv4TIKljrfm6JXiC5ZR zy%>^{FU^`&+@#@Q-gFOC6p4MbQ7gyPt>fx=A@r*Uc;E7Sda+ookqy5Thh>uQTUpTZ zUG`tWcWNJr?rDyiPCnF}M}C-vL0`1j)zZ~onQePCxh6b_Z*88{`Elp0x*-5`a*$~A zysm6Kw1lChK0&#KS)l!pi!M4fGM^MYGD+T}Q5kgqs`XpR;oSuk>o+38 zisG~r;;6MEe#PZJliFtW^mRlwR0;CT|^L>|Ag3F)(0tvOFiQp_vjm(0-L zqUbzL-C+Fat;nGeI;*{)ac&1zyOSqY=+A(q+a;IWH&L4{bkvdb)XpOD!opHbUs3`& zo+Om504#k6Qg-3?c%FuQoRgh;R~&i&?)0w%8$|cF0klBbVZE)Xh^Zvqs=jeCuGvR* z^p`q1R=J{lr~pHRO!@+~=1Jm|Sp~&r29=hq_(vC`E_D&xu(wlwabk0e>osxs#L92d z6vm}ylwjg6>En7mx#Y}Wtdu7wdh<9NtpH3|M0DoUm`_9I^!Q2|geTOjIrsMa>RWkw z`4e@?PFzMi3uwO}D1|6$3=%dp*(o;A+cnmI21W6SAXvd|Fg7jqeexf4u7CmC3)!TLC$ZsXK~h&KF2A6yab_9aKI*zOE$ zG%DoZte2^4csmAnK0uQ;l~7ycTHAgBizgN*}L#2QOd~3!4I3~eZe%9*?ph( zoD@!-wycv?U+*mv6}%aewz04`wLEz!dixESF=2r_ro5;f(90C~DOxo)!{rBS*i>$T zf8=&`qVMrNmxWEI%W)i`)eTu~$8Qy?3+(C)i!luLMishPOD!cK0*|n@&-dhU`hO>i&$@iSC zjf;*yYNQr~;D{QzyjecqVpfYJcd~22=V^#dmYJqUhK#LbsUgR|36-(XWbo@}@oTGQ zHh5}1yq`f@+9Dnbj)bWDvk%8loog^M#V!Yrf7{{;vV0LL`cqRoE`d@7DEms)z zk~At9bRY~yvi&q32KZxYIgIooq;w;mQ0Rx0T-$Eustz(L-LF2FX8f=;v1$K^>HaE!S*c0ExSUsY>#b4_BeXx2h=vz5s59iX1) z#hTT}4N9r1M=kzqfiyn`xZ&BlakJa` ze3tGkrSUYDp@!Th_ZQkLegXKAb3>Hq<Bkr>g3dIZo42fF>b9F+g+|E^mRxeJZrCL&? zo(Ug;1HH_ipNFpL=)~F^sj+gfJrFp0RXhM>GLTGX!EyEST$BB&9&_MVB77Nx`{R*lvs5j8@Q&{A8B z5VNQmViX~2lsn)1_a6`bPyhF`&!h8sa-DNs*Xz8m_d!BE1zM{TP10Q)UJbx4Oz*-l z8*$mvLf>wg6hT9Q)tVn4-2U()h%_VOGgT7{2r?OrHIw||*fxLboY8*8NJNI;QrCUF zh@Y*uR8VU*DB#J2vDDX`j4%&BV|g$@s_i`V8F19tD>fxe8T^7_y9gWqq`|sl>SU_H z_A2Wgam&{JO&sv0e*BF^mpPHJR_@;qvRm|Okp@G+<>PBoPOy?l$HxO@@*^oPw#V_` z)0Ub(P6)+zi(sTjIpAe;z3O6lxsu};a!RjZw8_PKSm|(dh=nU5=Equ9sV{Q()n=bX zlkY$_kVYTyXeuUh%vyZq=wOg5tHyv#A6Crg*qV|N^pVcFt-5zF^t8_jjCM`chn)*r z5dP30C-PA%zMD6??dv7Fq2(3TH(`j~1SOujF5b&a-9 zadiiz$Je78y1{>>DVs}M?yWwu0t+*aN0v2!AVlJ#{a6m$O;oOo4kba#%~38{4w4Im z5-MXP94*W}vuQ~LTn3o;3lJHwgZtWyR>0<{I^n0g-{`NXgKP2a4&36xUbv%R%S$=# zQlUn3&6j)IIZ|~za~597u~)6lz0PZmm&dt!aw^Y^Ej?>}9E`AwnY782Vy(Zdxqo>n z!nwGhl1o|sb1YqTWj}i20|V1iDmUf%mUt6$&%Q#zn3L)Kpud2XLI+Jx7xRfJldQ=| zxt`?0iRq^g6i@1^!N_xLBQ(l>I8ig1QATEU*5)?+#!0z1$CzQq0uFvPtYbs8@uhgK ze?Fg>NpFAiBeIt8=yIa5>vVA5mMa+u!z||6TR1btfk1xR4ds{@`fHCJ<-4L%%f9Qk zH?91Y9qXx+q@zFJW?Jp1XfjKEz7;SzOiKX(IVD)Z#~Ry$!q2z$az)colw>+6SQpKg zxtg^3EX)RTjRzV$=2x!i{HyS;Sm0<-i2eU&0m>BtXqVDe@@KqnYOp;#O>~pGBreaO^4cc#tkl5k9i9(yBfRMVpF2HRIsXRqD-s{) zj8Em9+gEEfv%tR&DD+J4c;Ve3_0pRwjSbVMiOw`0CQ}9)xhe`ROJb*q=T8dgEb+R2 zoUpww!2v!(wPOk8UAeUY6ceEYm)k~PyAev|p^q@L(LWmNiK{1sc^`2zwg%5aB$2tk z#^dsl?{&h$Iq?oKLZlCGO3-xLh0$hr@hQIJ*=FuDJ{LnX^VofV?|8jWNK}mN{UWYO zLU1IHJTvK@Bhbm9>;6?#VB5QLf)&m}+o@zrX9eFt7bxr5C z>Y}o(4JUlxhG-aE9$91@#!tal3Fmzcn?dhja(9dU-sAUFsJyf|z zBPcO^r7)qosMa&|D3<7(Ko1t@I4^IJE$cV!85V5flx+Ll+&k+qtfZ+z_+#lbaCh;g z4}j&Ku8@^LWY$-g!;aM5Wvr3q~0|x;Z(a`x3dc2$|sO zIOhRmz6b1NPhD~nDNw}oEmuWfDf%F>=JS6CW~IDbxBSTDOB>9?!CJu@hOon_?)U&~ zJz&nGtV|OQ(>dJr?GMTl-2Q2?|B+p;h%sD_ApQ{EsO)rte2vTO>vJlRCwc>xyI^zn zhg9#YCJ%aMuj)=zgN`NUjmqNl?$+fzqr2xWTeNLCXjv-%2P7Nre03FY8(0rtQ~qh< zAxc$3gyoOBeM4mdh%V zPEn22wnK5jrrjUqSq~qH|44oylAs@V3P8y6XHHl!*e0^h{m>t^S`W>5nVP9M?_JZMj1=z!@-^J zf5>Td4zFIggt6D}FI9h0|8QjQWL}qBkf1#CL~@&R(xK_|^+2xNQXhl#FroafkgjGZ zf;FgkyWA4^TQffb`6S!DMV8A^(+qR9+r7~^M#NDk1oOpr4IMH5s@Cp?&M$NM2TR&x zzJ-G`2G{Y$GnSdgYSO*b56u#voxENdtZltvAS{`u97uGmY^C#|04$a~l$3ge@SR9G zbwlcFx;YmO1|iszpCIKg(Z&~JptJI}^NBsDH+&IBn{I4SG%q<IK_=O&#hFIT%dp|59?j~HwV(ytY2{V1F6xGk6al{%mH1=}K zy)l_9p56L~-Jz`~%_Xnr9cSw=h_Rx0S^!d}VyC$6orVgcBv|nl`kc&$I?LI^Lx*w~ zw|3*6^XKo!*p;~Zn*7Fw8vpb6GKS>8qxatSC}dOfl+oZpBV?3_z%LUoC&$rIHbD&E ztZ8c*H2&EqVY)ylS0rjL5g(fW8n#l$0l%Dh({6_HycJFGqNSHd0wA0)ga$qavIxtw zH&%stoo1E$nj{qJ&sXFu=vKL@iXp|o0GD~f@nC~*lYj5P5) z)f}#F4I|~wA;7Yq0^H*+-?Gv)z;Xer84CRjc6YJZEyAM9ao9UgE9kxhCG)o@mm4VR zI_UvgKJzg3R-VpRIczu~a=%SoPAGq0DNxJg;^-z7W6O=K zo{t1kdDsaSto_g##UIcsJ#gwZ59GY_xFklk8p6KKvr~6@IO62xC+Jzvb13KSH}$lQ z&hUNw$!LAPO2_hHL+3GTt6gD9syK^4N8=*Ko!@SojFzoe5Xxy1xI2>%Jzn$Pgw4V) zyR?kRy)8~xr$tLtu*cR@tgF(@c9|4UM}+W0-o=4-lR;_nWzyh_X@WBcMgOqXbSkrD zXTF-8tQfao9Yx;AD#v9uX^PxiSLj017^h@u(rf+>-tY}71*`S63B$d9dQT^zYSy@0 zlZ#ClA_l}+<`-}a+D#vO1uIK2%V9NvZcOqc?`+%;gQp_ImP2y_N#eCrbi}>HOS4&W z(m`gQl!%MWm$b?u;}FM+kV!umxDd&OpKQylwJ_$?Hs{~E@A9|FWZ;I%_GQ;m01?K) zFxT2+@}ED5R7|q88eY?CTXgX8Y%jPHtpDp!rge}|($2(R4gl#5&oBXUYl~#8XE6m0$bkr|6U5j6u0Am7$|C|qO?f%FBS4Xi;VhP5W zHsynKRDRepX6wqr9cI4dY1`o(3;rM5?joZvMgtaZ*ZcHFe`G8)^dzm`RLG{QD~*#I zt(=%HvqFeyJUwiyH{K#_GvtjA+~i^~9Gn~RadT6wLc|%9M@tHI5BZPJQlC?jne1Bm z`3!OY*XW2YU_y|Ap|DlClu>d)n`S15wlSoU`JBG~IsYZGmoq@ENX~+9v8Sa@7*!`R z=hX^SnZv~<1O_;{8xio~wU=2yRN zuPSe7BHcX|Q9LzTo2r~ARyCVX1O$E}_*GZm%;r3EY9;IEe<|1SflNnvzWoX=J)6oO z#69iNd8#(Sez=tSW|t8Lba3l3tf7Em`?pR1>b|y;b`bKnr;EFKoG*BeUzGlo@kQ2- zkC;bBPO6QsE;t{41{?mVjmaAy&I`4UcpRuwcO1EsCxfK-DWq%rF?+1ObJnj0q5hqb<#ZW&yG!DQxu1UZ=m~H&*Yij$3yb>VNhj9&?GRSPLde zi}6%bczbd}ZfB9`Rk87dLTn+6%7JYIkcD;L`i>)ZDC7@+6hSphXQcu_oA3&$2|5i- z=DBDt;GDO9e3LUa#%^6#oI-q0V2VbSYwDH~Lw{xasAI43XoRB26AD!yGao}XRSf7% zU7V;)&s+pQ2hd!_pFZKxo&M9+Vj(H5wpwFT_X73BNrY6XLFO28J1!2FfF&At1Zjnz zL}3`1tM&;!9x=3Iij{aK@jsyC#ZTLhToEHmfx}&Jl;J>xGC9yy|GbJtT`}4OgpGi%8cf)9)Waj|jsC6?FXk>R~)gZmMQ9 zC8|c}y}z)>eR}H%HTbZD+;k$GsDYozV2invF%>E`Hi@Y`bhfAOTJ>MvZc!XrDt;l=L-?8;)wl~z%0 zPAt?ZOFys zH}a~dEY(_ZkKnB)-%1GAE2)rZWIM8cmuk14h#QaV?T4-~3wiV$$h!aC+ueJ)ryuz7 zh28Ty(z}$b@#uib828Dp^*o?R4O?T)(*PF<*#25CY!kcMALEszZ*w~$tM)+Uy)%Au ze-Kp86k@g1=fChLktXEZ{S)f(c`SDo=e+DPhhL-rqbb6Z_nH?rnafR^-<2tDHaS?1 zkPG@mY5=KS@`$7{7QY==mIC$6RSHl z=}cH~IP9SxlPMlkk#Q1aN@2e)yv^dCN?6;! z+HM5~aBXg7B00}h>Y{X4W7SwILiu>fUkT6lCsg zC~N~78#GaJ%sGZ$j%~-ElaRjN%*V?QSAA5E&|g<1qgl|n<-CaSsW`9H5N}@JBFthz z1m;Z;LYOBieRtykYDSZ5y{_l1eodm%V4XYY=7)qtp9!5zx$9znL05>O^z&c}p6+89 zPC{1XbJWbG?aAGqhGEv@9#z%tr>Su@2)>AxBJ)hNxo5Ir;A?SzY6bUQ@>onx_xO7q z2v%vALm?489K#WA`e}UZ6$*Yj9ka(~K&-RvVSi-RjeoJY_rOxT@O6p}wczKbG-8F` zPp3Q%_74xO54xUR-zsAuFX|D>rBX6O2IV1@5&UCa$0wntg zd&TqBk$ea5fW=~o$g6!T`@7Jo6`w?=Akq)L>XKoj7H5<7x#l&4`)u-xIj<*m!`Y`I zLPbOC1j4}IJ9tks%hs5vc8MDk<8fQD9MQVD&Qw%1quT1vO+^L~-U({}W-}XOs1luC zwG;~%^uXv^Y`%0ToLur`C(*pVbn!cB)5B$W1>E#HHxcRg@jTFGek4dmE|*P_Kn@*` z=%=*Auf#&XGiU&SH}@l6Wnk{KFT2tkzOd<+<)Q&dPnz2XK{jb$I*|~kj}u#D{l0Gw zuIlpdz&#RJNwKI7fe^(BTeh7XI?m_8Jx!S_T{1_7O4BjDVbx)L#pW9Xx@GwH0E31D zhPwpwpVyw0*M$%XM`#ogc?`nQKODG56~1cQvCN!%edu)zg$XnmC5E174|?wa~Z z~H^8~QY$59H4X)C(F@NWPxM5UI5y*8P|y7cObjz^m0^nG@V z8!KCiDF^>S!*7}l?pB_@eGQ27el+n?1R`pQ=bG=!?cf$t7U&~7fL;qqpfCh=^-b2) z6u`=D8IN~555IvjOQd37UyM5Cgt6tI5ydHP?Rc_{TW<5*1Ks?xXxD zb00y_qpNh@Ug~X}e*Pmw_?Ml11lpkJBvk^8Etz`o^brrgG4*ipq;}Z&TgAWX$=bzx zvRMMWUiO%%XZk-giibJoq^f^s61_t^#+S8{H$sv;bF#S9rEl$>+DhLkn#o2bM8Y3% zEdE6DXa>LGUI3dOiSF?_Yq)6FH@)@XJu7VzRg0AiRv0F82Qc5vJ_@AP&HuEf&(?Y3 zUey-*HN5VP)WxFGz}V<|$$Di$L+aw|iZ2tZrm~kMP}Yxs10D1Q+Hk;zhvMwA12cyJ z>!5$k*1tpg(OcR+tl|c=Ft~cJdpxh0 zt5)G?YlRIwXBHM*vPbmg7kR4I&odIim*A#yCeV4WPp+db+qF>3rY_ia)9fiQIM4XW z{T&qnpzkox%#CZUdHx0~yBWFdRv`bPKxzD_f;aFVs+u%WiYm@T;_povZZ2i_o$!8L z3eNZP@k___t+M{cL>=mY`XF`%z-~pJDtKbF*G#dhajsu;fPYvaNYTrfI|DqJlG-v32+_vrY-v5damw~kH=2!7T z;$czu7haQM3bzX-?8)e`b*5vl%MAwi?41;3ynCj?mo8@=!2QwEw$ht~g}NVpr$8%W z%(hYzmTo-HT<$CvS5hIp#T-SOx;5N1LR{M3<#cnT`C2p~+WV&`Db<2boW zAy_pyXYr}-)`+hNF7hu!(s zkKPRQxER_;&F~;FYl*!vjzd++ZJ44ar3ed$yjEPg&Bf$}RO>tWsq;5?G8sPFCn@nf zSa_=Vxi=^Kj``&QBg1t~rd}cQ;zQC-A`8(0+O}hVzDr_EHy2H+Ouq53Qz==kmEkx4 ziK0qSxbP8PL#E=yKhYJ-(dhJ9wiY?`B&Hlfw00b{irkz}$CXS-8xno$yHp7SfZPG^ z)#s;JhU?e8Z_&d7>;(m?5}UPxYv{`Fojp0oGymPqh-uGcfCgPE%M2LaJnVk|y(lQ^ zxOj58JRR*4z-PW(1fO?wNbjcvg^}(_&HD90CTd1emHwTrYN+E7BTs&8c68F}n{{Pd zN7I9q*wb#kCQplapu>~#XlTf%rMT3eWh8rHvbrpE51+RdRZ!xCX*tUTIH7=V zuH25VD?o?r`RN{B0k&dS`^ytyUKz@u%_>@AQ81ovq4~Zp(N9UWWu`Op*5XpSHBYWc zm+#;Bu#ai900R7yRqPl3gYCq@GZ24Kp2ybyMUqRoXwuwxVYDTq(#2O}#hIP7ccI@0 zm2(kJWvVdkCsC!daSxKflp`58L8yMZNbcZXf3h+|Z$+Y(ks)01uSw?@x#57TVq{6Y0+m}ddBd8?vqw~QskWP0R=X4EfFZV0_8v7n%3 z@t};9J#`N&MD+{i_iNfv9bUdQ{hJmW+at_}xFY4p-gv7aEVg31{{^i(5!{|9~iUmEg1Feml@Z{q5IV5O4_ p3I@8k$n<&hgYrTBZ*g~->PmmHacRgCn|}$BwuXT^Qq?Z closed, lossless description of every attribute - Write-PraRawCapture writes the snapshots of a batch (new file only, never overwritten) - Test-PraRawCapture streams the file to the end and checks it against the JSON records - (and, just after writing, against the snapshots in memory) - - Old backups (schema 1 and 2) contain a native CLIXML: only the object identities are checked, - the graph is never inflated. - -.NOTES - Author : Nicolas Fabert - Version : 2.1.0 (format PraDataOnlyClixml-v1, unchanged since 1.3.3) -#> -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' - -# Closed, data-only codec. No directory reads, CLR property walks, or native graph serializer. -# DTO: {ObjectGUID; DistinguishedName; CapturedUtc; Attributes=[ordered] name -> descriptor}. -# Descriptor always has {Kind; Type; Value=string|null; Items=object[]}. -# Wire: Objs/Obj/MS snapshots; Attributes is DCT name -> LST of preorder descriptor nodes -# {Depth=I32; Kind=S; Type=S; Value=S|Nil; Count=I32}. XML depth is constant, not graph depth. -# IEEE754 bytes and decimal bits preserve negative zero, NaN payloads and decimal scale. -$script:PraRawFormat = 'PraDataOnlyClixml-v1' -$script:PraRawNamespace = 'http://schemas.microsoft.com/powershell/2004/04' -$script:PraRawDepth = 16 -$script:PraRawNodes = 1000000 -$script:PraRawCulture = [Globalization.CultureInfo]::InvariantCulture -$script:PraRawEscape = [regex]'[_\x00-\x1f\x7f-\x9f\uD800-\uDFFF￾￿]' -$script:PraRawUnescape = [regex]'_x([0-9a-fA-F]{4})_' - -function Get-PraRawMember { - param([AllowNull()]$Object,[string]$Name) - if ($null -eq $Object) { return $null } - if ($Object -is [Collections.IDictionary]) { - if ($Object.Contains($Name)) { return ,$Object[$Name] } - return $null - } - $property = $Object.PSObject.Properties[$Name] - if ($null -ne $property) { return ,$property.Value } - return $null -} - -function Test-PraRawCollectionType { - param([string]$Name) - return ($Name -cmatch '^System\.[A-Za-z0-9_.+`\[\], =-]+\[\]$' -or - $Name -cin @('System.Collections.ArrayList','System.Collections.Specialized.StringCollection', - 'Microsoft.ActiveDirectory.Management.ADPropertyValueCollection') -or - $Name -cmatch '^System\.Collections\.(Generic\.List|ObjectModel\.(ReadOnlyCollection|Collection))`1\[\[') -} - -function ConvertTo-PraRawDescriptor { - param([AllowNull()]$Value,[string]$Attribute,[string]$ObjectGuid,[int]$Depth,[hashtable]$Budget) - $Budget.Left-- - if ($Depth -gt $script:PraRawDepth -or $Budget.Left -lt 0) { - throw "Raw capture: collection limit/cycle, attribute=$Attribute GUID=$ObjectGuid." - } - $result = [ordered]@{ Kind='Null'; Type=''; Value=$null; Items=[object[]]@() } - if ($null -eq $Value) { return ,$result } - $type = $Value.GetType(); $name = $type.FullName - $result.Kind = 'Scalar'; $result.Type = $type.Name - switch -CaseSensitive ($name) { - 'System.String' { $result.Value = $Value; return ,$result } - 'System.Boolean' { $result.Value = if ($Value) { 'true' } else { 'false' }; return ,$result } - 'System.Char' { $result.Value = ([uint16][char]$Value).ToString($script:PraRawCulture); return ,$result } - { $_ -cin @('System.SByte','System.Byte','System.Int16','System.UInt16','System.Int32', - 'System.UInt32','System.Int64','System.UInt64') } { - $result.Value = $Value.ToString($script:PraRawCulture); return ,$result - } - { $_ -cin @('System.Single','System.Double') } { - $bytes = [BitConverter]::GetBytes($Value) - if (-not [BitConverter]::IsLittleEndian) { [array]::Reverse($bytes) } - $result.Value = [Convert]::ToBase64String($bytes); return ,$result - } - 'System.Decimal' { - $parts = [Collections.Generic.List[string]]::new() - foreach ($part in [decimal]::GetBits($Value)) { $parts.Add($part.ToString($script:PraRawCulture)) } - $result.Value = $parts -join '|'; return ,$result - } - 'System.DateTime' { $result.Value = $Value.ToBinary().ToString($script:PraRawCulture); return ,$result } - 'System.DateTimeOffset' { - $result.Value = $Value.Ticks.ToString($script:PraRawCulture) + '|' + $Value.Offset.Ticks.ToString($script:PraRawCulture) - return ,$result - } - 'System.TimeSpan' { $result.Value = $Value.Ticks.ToString($script:PraRawCulture); return ,$result } - 'System.Guid' { $result.Value = $Value.ToString('D'); return ,$result } - 'System.Security.Principal.SecurityIdentifier' { - $bytes = [byte[]]::new($Value.BinaryLength); $Value.GetBinaryForm($bytes,0) - $result.Type = 'SID'; $result.Value = [Convert]::ToBase64String($bytes); return ,$result - } - 'System.Byte[]' { - $result.Kind = 'Binary'; $result.Type = 'Byte[]' - $result.Value = [Convert]::ToBase64String($Value); return ,$result - } - } - # ActiveDirectorySecurity derives from ObjectSecurity, NOT GenericSecurityDescriptor. - if ($Value -is [Security.AccessControl.ObjectSecurity]) { - $result.Kind = 'SecurityDescriptor'; $result.Type = $name - $result.Value = [Convert]::ToBase64String($Value.GetSecurityDescriptorBinaryForm()) - return ,$result - } - if ($Value -is [Security.AccessControl.GenericSecurityDescriptor]) { - $bytes = [byte[]]::new($Value.BinaryLength); $Value.GetBinaryForm($bytes,0) - $result.Kind = 'SecurityDescriptor'; $result.Type = $name - $result.Value = [Convert]::ToBase64String($bytes); return ,$result - } - $collection = $false - if ($type.IsArray) { - $collection = $Value.Rank -eq 1 -and $Value.GetLowerBound(0) -eq 0 - } elseif ((Test-PraRawCollectionType $name) -and - $type.Assembly.GetName().Name -cin @('mscorlib','System','Microsoft.ActiveDirectory.Management')) { - $collection = $true - } - if (-not $collection) { throw "Raw capture: unsupported attribute=$Attribute type=$name GUID=$ObjectGuid; no fallback." - } - $result.Kind = 'Collection'; $result.Type = $name - $items = [Collections.Generic.List[object]]::new() - foreach ($item in $Value) { - $items.Add((ConvertTo-PraRawDescriptor -Value $item -Attribute $Attribute -ObjectGuid $ObjectGuid -Depth ($Depth+1) -Budget $Budget)) - } - $result.Items = $items.ToArray() - return ,$result -} - -function ConvertTo-PraRawSnapshot { - <# .SYNOPSIS - Detaches every returned user property into a closed lossless DTO; no native object is retained. - #> - [CmdletBinding()] - param([Parameter(Mandatory)]$User,[Parameter(Mandatory)][string]$CapturedUtc) - $identity = Get-PraRawMember $User 'ObjectGUID'; $guid = [guid]::Empty - if (($identity -isnot [guid] -and $identity -isnot [string]) -or - -not [guid]::TryParse([string]$identity,[ref]$guid) -or $guid -eq [guid]::Empty) { - throw 'Raw capture: invalid attribute=ObjectGUID, GUID unavailable.' - } - $key = $guid.ToString('D'); $attributes = [ordered]@{} - $dictionary = $User -is [Collections.IDictionary] - # Native ADUser exposes CLR tracking metadata alongside its returned directory properties. - # Its property bag is authoritative; ordinary objects/dictionaries retain every member. - $names = if ($dictionary) { $User.Keys } - elseif ($User.GetType().FullName -ceq 'Microsoft.ActiveDirectory.Management.ADUser') { $User.PropertyNames } - else { $User.PSObject.Properties.Name } - foreach ($name in $names) { - if ($name -isnot [string] -or [string]::IsNullOrEmpty($name) -or $attributes.Contains($name)) { - throw "Raw capture: invalid/duplicate attribute name, GUID=$key." - } - $value = $null - try { - # Direct assignment preserves null/empty/nested arrays and reads each getter once. - if ($name -ieq 'ObjectGUID') { $value = $identity } - elseif ($dictionary) { $value = $User[$name] } - else { - $property = $User.PSObject.Properties[$name] - if ($null -eq $property) { throw 'Declared property is not readable.' } - $value = $property.Value - } - $attributes[$name] = ConvertTo-PraRawDescriptor -Value $value -Attribute $name -ObjectGuid $key -Depth 0 -Budget @{Left=$script:PraRawNodes} - } catch { - $typeName = '' - if ($null -ne $value) { $typeName = $value.GetType().FullName } - throw "Raw capture failed: attribute=$name type=$typeName GUID=$key. $($_.Exception.Message)" - } - } - $dn = $attributes['DistinguishedName'] - if ($null -eq $dn -or $dn.Kind -cne 'Scalar' -or $dn.Type -cne 'String') { - throw "Raw capture: DistinguishedName must be a captured string, GUID=$key." - } - $snapshot = [pscustomobject][ordered]@{ ObjectGUID=$key; DistinguishedName=$dn.Value; CapturedUtc=$CapturedUtc; Attributes=$attributes } - Assert-PraRawSnapshot $snapshot - return $snapshot -} - -function Assert-PraRawScalar { - param([string]$Kind,[string]$Type,[AllowNull()]$Value) - if ($Kind -ceq 'Null') { - if ($Type -cne '' -or $null -ne $Value) { throw 'Raw: invalid null descriptor.' } - return - } - if ($Kind -ceq 'Collection') { - if ($null -ne $Value -or -not (Test-PraRawCollectionType $Type)) { throw 'Raw: invalid collection descriptor.' } - return - } - if ($Value -isnot [string]) { throw 'Raw: descriptor Value must be a string.' } - if ($Kind -ceq 'Binary' -or $Kind -ceq 'SecurityDescriptor' -or - ($Kind -ceq 'Scalar' -and $Type -cin @('Single','Double','SID'))) { - $bytes = [Convert]::FromBase64String($Value) - if ([Convert]::ToBase64String($bytes) -cne $Value) { throw 'Raw: noncanonical Base64.' } - if ($Kind -ceq 'Binary') { - if ($Type -cne 'Byte[]') { throw 'Raw: invalid binary type.' } - } elseif ($Kind -ceq 'SecurityDescriptor') { - if ($Type -notmatch '^System\.(Security\.AccessControl|DirectoryServices)\.[A-Za-z]+(Security|SecurityDescriptor)$') { - throw 'Raw: invalid security descriptor type.' - } - $security = [Security.AccessControl.RawSecurityDescriptor]::new($bytes,0) - $copy = [byte[]]::new($security.BinaryLength); $security.GetBinaryForm($copy,0) - if ([Convert]::ToBase64String($copy) -cne $Value) { throw 'Raw: security descriptor binary mismatch.' } - } elseif ($Type -ceq 'SID') { - $sid = [Security.Principal.SecurityIdentifier]::new($bytes,0) - $copy = [byte[]]::new($sid.BinaryLength); $sid.GetBinaryForm($copy,0) - if ([Convert]::ToBase64String($copy) -cne $Value) { throw 'Raw: SID binary mismatch.' } - } elseif (($Type -ceq 'Single' -and $bytes.Length -ne 4) -or ($Type -ceq 'Double' -and $bytes.Length -ne 8)) { - throw 'Raw: invalid IEEE754 width.' - } - return - } - if ($Kind -cne 'Scalar') { throw 'Raw: unknown descriptor kind.' } - $canonical = $Value - switch -CaseSensitive ($Type) { - 'String' { return } - 'Boolean' { if ($Value -cnotin @('true','false')) { throw 'Raw: invalid Boolean.' }; return } - 'Char' { $canonical = ([uint16]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'SByte' { $canonical = ([sbyte]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'Byte' { $canonical = ([byte]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'Int16' { $canonical = ([int16]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'UInt16' { $canonical = ([uint16]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'Int32' { $canonical = ([int32]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'UInt32' { $canonical = ([uint32]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'Int64' { $canonical = ([int64]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'UInt64' { $canonical = ([uint64]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } - 'Guid' { $canonical = ([guid]::Parse($Value)).ToString('D') } - 'TimeSpan' { $canonical = ([timespan]::FromTicks([int64]::Parse($Value,$script:PraRawCulture))).Ticks.ToString($script:PraRawCulture) } - 'DateTime' { - $binary = [int64]::Parse($Value,$script:PraRawCulture); $null = [datetime]::FromBinary($binary) - $canonical = $binary.ToString($script:PraRawCulture) - } - 'DateTimeOffset' { - $parts = $Value.Split('|') - if ($parts.Count -ne 2) { throw 'Raw: invalid DateTimeOffset.' } - $date = [datetimeoffset]::new([int64]::Parse($parts[0],$script:PraRawCulture),[timespan]::FromTicks([int64]::Parse($parts[1],$script:PraRawCulture))) - $canonical = $date.Ticks.ToString($script:PraRawCulture) + '|' + $date.Offset.Ticks.ToString($script:PraRawCulture) - } - 'Decimal' { - $parts = $Value.Split('|') - if ($parts.Count -ne 4) { throw 'Raw: invalid Decimal.' } - $bits = [int[]]::new(4); $text = [string[]]::new(4) - for ($i=0; $i -lt 4; $i++) { - $bits[$i] = [int32]::Parse($parts[$i],$script:PraRawCulture); $text[$i] = $bits[$i].ToString($script:PraRawCulture) - } - $null = [decimal]::new($bits); $canonical = $text -join '|' - } - default { throw "Raw: unknown scalar type '$Type'." } - } - if ($canonical -cne $Value) { throw "Raw: noncanonical $Type value." } -} - -function Assert-PraRawDescriptor { - param($Descriptor,[int]$Depth=0,[hashtable]$Budget=@{Left=$script:PraRawNodes}) - $Budget.Left-- - if ($Depth -gt $script:PraRawDepth -or $Budget.Left -lt 0) { throw 'Raw: descriptor depth/node limit or cycle.' } - if ($Descriptor -isnot [Collections.IDictionary] -or $Descriptor.Count -ne 4) { throw 'Raw: invalid descriptor shape.' } - foreach ($field in @('Kind','Type','Value','Items')) { - if (-not $Descriptor.Contains($field)) { throw "Raw: missing descriptor field $field." } - } - if ($Descriptor.Kind -isnot [string] -or $Descriptor.Type -isnot [string] -or $Descriptor.Items -isnot [object[]]) { - throw 'Raw: invalid descriptor field type.' - } - Assert-PraRawScalar $Descriptor.Kind $Descriptor.Type $Descriptor.Value - if ($Descriptor.Kind -cne 'Collection' -and $Descriptor.Items.Count -ne 0) { throw 'Raw: scalar has children.' } - foreach ($item in $Descriptor.Items) { Assert-PraRawDescriptor $item ($Depth+1) $Budget } -} - -function Assert-PraRawSnapshot { - param($Snapshot) - if ($Snapshot -isnot [pscustomobject] -or @($Snapshot.PSObject.Properties).Count -ne 4) { throw 'Raw: invalid snapshot shape.' } - foreach ($field in @('ObjectGUID','DistinguishedName','CapturedUtc')) { - if ((Get-PraRawMember $Snapshot $field) -isnot [string]) { throw "Raw: invalid snapshot $field." } - } - $guid = [guid]::Parse($Snapshot.ObjectGUID) - if ($guid -eq [guid]::Empty -or $guid.ToString('D') -cne $Snapshot.ObjectGUID) { throw 'Raw: invalid snapshot GUID.' } - if ([string]::IsNullOrWhiteSpace($Snapshot.CapturedUtc)) { throw 'Raw: empty CapturedUtc.' } - $null = [datetimeoffset]::Parse($Snapshot.CapturedUtc,$script:PraRawCulture) - if ($Snapshot.Attributes -isnot [Collections.Specialized.OrderedDictionary]) { throw 'Raw: Attributes must be an ordered dictionary.' } - foreach ($name in $Snapshot.Attributes.Keys) { - if ($name -isnot [string] -or [string]::IsNullOrEmpty($name)) { throw 'Raw: invalid attribute name.' } - try { Assert-PraRawDescriptor $Snapshot.Attributes[$name] } - catch { throw "Raw: attribute=$name GUID=$($Snapshot.ObjectGUID). $($_.Exception.Message)" } - } - $id = $Snapshot.Attributes['ObjectGUID']; $dn = $Snapshot.Attributes['DistinguishedName'] - if ($null -eq $id -or $id.Kind -cne 'Scalar' -or $id.Type -cnotin @('Guid','String') -or - ([guid]::Parse($id.Value)).ToString('D') -cne $Snapshot.ObjectGUID) { throw 'Raw: metadata/attribute ObjectGUID mismatch.' } - if ($null -eq $dn -or $dn.Kind -cne 'Scalar' -or $dn.Type -cne 'String' -or $dn.Value -cne $Snapshot.DistinguishedName) { - throw 'Raw: metadata/attribute DistinguishedName mismatch.' - } -} - -function Write-PraRawString { - param([Xml.XmlWriter]$Writer,[AllowEmptyString()][string]$Value) - if ($Value.Length -eq 0) { return } - if (-not $script:PraRawEscape.IsMatch($Value)) { $Writer.WriteString($Value); return } - # Escaping every underscore avoids _xHHHH_ ambiguity across buffer boundaries. - # Encode UTF-16 surrogate code units too, including isolated surrogates, without XML loss. - for ($offset=0; $offset -lt $Value.Length; $offset+=4096) { - $chunk = $Value.Substring($offset,[Math]::Min(4096,$Value.Length-$offset)) - $escaped = $script:PraRawEscape.Replace($chunk,[Text.RegularExpressions.MatchEvaluator]{ - param($match) - return ('_x{0:X4}_' -f [int][char]$match.Value[0]) - }) - $Writer.WriteString($escaped) - } -} - -function Write-PraRawElement { - param([hashtable]$State,[string]$Tag,[AllowEmptyString()][string]$Name,[AllowNull()]$Value) - $State.Writer.WriteStartElement($Tag,$script:PraRawNamespace) - if ($Name) { $State.Writer.WriteStartAttribute('N'); Write-PraRawString $State.Writer $Name; $State.Writer.WriteEndAttribute() } - if ($Tag -cne 'Nil') { Write-PraRawString $State.Writer $Value } - $State.Writer.WriteEndElement() -} - -function Write-PraRawObjectStart { - param([hashtable]$State,[string]$Name='') - $State.Writer.WriteStartElement('Obj',$script:PraRawNamespace) - $State.Writer.WriteAttributeString('RefId',$State.RefId.ToString($script:PraRawCulture)); $State.RefId++ - if ($Name) { $State.Writer.WriteStartAttribute('N'); Write-PraRawString $State.Writer $Name; $State.Writer.WriteEndAttribute() } -} - -function Write-PraRawNode { - param([hashtable]$State,$Descriptor,[int]$Depth) - Write-PraRawObjectStart $State - $State.Writer.WriteStartElement('MS',$script:PraRawNamespace) - Write-PraRawElement $State 'I32' 'Depth' $Depth.ToString($script:PraRawCulture) - Write-PraRawElement $State 'S' 'Kind' $Descriptor.Kind - Write-PraRawElement $State 'S' 'Type' $Descriptor.Type - $tag = if ($null -eq $Descriptor.Value) { 'Nil' } else { 'S' } - Write-PraRawElement $State $tag 'Value' $Descriptor.Value - Write-PraRawElement $State 'I32' 'Count' $Descriptor.Items.Count.ToString($script:PraRawCulture) - $State.Writer.WriteEndElement(); $State.Writer.WriteEndElement() - foreach ($item in $Descriptor.Items) { Write-PraRawNode $State $item ($Depth+1) } -} - -function Write-PraRawProgress { - param($Context,$Snapshot,[int64]$Bytes,[string]$Stage) - $name = $Snapshot.DistinguishedName - $sam = $Snapshot.Attributes['SamAccountName'] - if ($null -ne $sam -and $sam.Kind -ceq 'Scalar' -and $sam.Type -ceq 'String') { $name = $sam.Value } - if ($name.Length -gt 128) { $name = $name.Substring(0,128) } - $name = [regex]::Replace($name,'[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]','?') - $process = [Diagnostics.Process]::GetCurrentProcess() - try { $private = [Math]::Round($process.PrivateMemorySize64 / 1MB,1).ToString($script:PraRawCulture) } - finally { $process.Dispose() } - Write-PraLog -Context $Context -Message "RAW $Stage | GUID=$($Snapshot.ObjectGUID) | name=$name | attributes=$($Snapshot.Attributes.Count) | privateMiB=$private | bytes=$Bytes" -Level Debug -} - -function Write-PraRawCapture { - <# .SYNOPSIS - Creates an exclusive CLIXML stream in the caller's already-private directory. Never overwrites. - #> - [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions','',Justification='Mandatory immutable backup artifact; target mutation and private-directory approval belong to the caller.')] - [CmdletBinding()] - param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$LiteralPath, - [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Snapshots) - if ($Snapshots.Count -eq 0) { throw 'Raw: empty snapshot sequence.' } - $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal) - foreach ($snapshot in $Snapshots) { - Assert-PraRawSnapshot $snapshot - if (-not $seen.Add($snapshot.ObjectGUID)) { throw 'Raw: duplicate snapshot GUID before write.' } - } - $path = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($LiteralPath) - if (-not [IO.Directory]::Exists([IO.Path]::GetDirectoryName($path))) { throw 'Raw: private parent directory must already exist.' } - $stream = [IO.FileStream]::new($path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None,65536) - $writer = $null - try { - $settings = [Xml.XmlWriterSettings]::new(); $settings.Encoding = [Text.UTF8Encoding]::new($true) - $settings.CloseOutput = $false; $settings.Indent = $false; $settings.CheckCharacters = $true - $writer = [Xml.XmlWriter]::Create($stream,$settings) - $state = @{Writer=$writer; RefId=[int64]0} - $writer.WriteStartDocument(); $writer.WriteStartElement('Objs',$script:PraRawNamespace) - $writer.WriteAttributeString('Version','1.1.0.1') - foreach ($snapshot in $Snapshots) { - Write-PraRawProgress $Context $snapshot $stream.Position 'WRITE BEGIN' - Write-PraRawObjectStart $state; $writer.WriteStartElement('MS',$script:PraRawNamespace) - foreach ($field in @('RawFormat','ObjectGUID','DistinguishedName','CapturedUtc')) { - $value = if ($field -ceq 'RawFormat') { $script:PraRawFormat } else { $snapshot.$field } - Write-PraRawElement $state 'S' $field $value - } - Write-PraRawObjectStart $state 'Attributes'; $writer.WriteStartElement('DCT',$script:PraRawNamespace) - foreach ($name in $snapshot.Attributes.Keys) { - $writer.WriteStartElement('En',$script:PraRawNamespace) - Write-PraRawElement $state 'S' 'Key' $name - Write-PraRawObjectStart $state 'Value'; $writer.WriteStartElement('LST',$script:PraRawNamespace) - Write-PraRawNode $state $snapshot.Attributes[$name] 0 - $writer.WriteEndElement(); $writer.WriteEndElement(); $writer.WriteEndElement() - } - $writer.WriteEndElement(); $writer.WriteEndElement(); $writer.WriteEndElement(); $writer.WriteEndElement() - $writer.Flush() - Write-PraRawProgress $Context $snapshot $stream.Position 'WRITE END' - } - $writer.WriteEndElement(); $writer.WriteEndDocument(); $writer.Flush(); $stream.Flush($true) - } finally { - try { if ($null -ne $writer) { $writer.Dispose() } } finally { $stream.Dispose() } - } -} - -function ConvertFrom-PraRawString { - param([AllowEmptyString()][string]$Value) - if ($Value.IndexOf('_x',[StringComparison]::Ordinal) -lt 0) { return $Value } - return $script:PraRawUnescape.Replace($Value,[Text.RegularExpressions.MatchEvaluator]{ - param($match) - return [string][char][Convert]::ToInt32($match.Groups[1].Value,16) - }) -} - -function Assert-PraRawXmlStart { - param([Xml.XmlReader]$Reader,[string]$Tag,[string[]]$Attributes=@()) - $null = $Reader.MoveToContent() - if ($Reader.NodeType -ne [Xml.XmlNodeType]::Element -or $Reader.LocalName -cne $Tag -or $Reader.NamespaceURI -cne $script:PraRawNamespace) { - throw "Raw XML: expected $Tag, found $($Reader.NodeType)/$($Reader.LocalName)." - } - if ($Reader.MoveToFirstAttribute()) { - do { - if ($Reader.Name -ceq 'xmlns' -and $Tag -ceq 'Objs' -and $Reader.Value -ceq $script:PraRawNamespace) { continue } - if ($Reader.NamespaceURI -cne '' -or $Reader.Name -cnotin $Attributes) { throw "Raw XML: unexpected attribute $($Reader.Name)." } - } while ($Reader.MoveToNextAttribute()) - $null = $Reader.MoveToElement() - } -} - -function Read-PraRawStart { - param([Xml.XmlReader]$Reader,[string]$Tag) - Assert-PraRawXmlStart $Reader $Tag - if ($Reader.IsEmptyElement) { throw "Raw XML: empty $Tag container." } - $Reader.ReadStartElement() -} - -function Read-PraRawEnd { - param([Xml.XmlReader]$Reader,[string]$Tag) - $null = $Reader.MoveToContent() - if ($Reader.NodeType -ne [Xml.XmlNodeType]::EndElement -or $Reader.LocalName -cne $Tag -or $Reader.NamespaceURI -cne $script:PraRawNamespace) { - throw "Raw XML: expected closing $Tag." - } - $Reader.ReadEndElement() -} - -function Read-PraRawObjectStart { - param([hashtable]$State,[string]$Name='') - $reader = $State.Reader - Assert-PraRawXmlStart $reader 'Obj' @('RefId','N') - if ($reader.GetAttribute('RefId') -cne $State.RefId.ToString($script:PraRawCulture) -or - (ConvertFrom-PraRawString ([string]$reader.GetAttribute('N'))) -cne $Name -or $reader.IsEmptyElement) { - throw 'Raw XML: object identity/name/sequence invalid; shared references are forbidden.' - } - $State.RefId++; $reader.ReadStartElement() -} - -function Read-PraRawElement { - param([Xml.XmlReader]$Reader,[string]$Tag,[string]$Name) - Assert-PraRawXmlStart $Reader $Tag @('N') - if ((ConvertFrom-PraRawString ([string]$Reader.GetAttribute('N'))) -cne $Name) { throw "Raw XML: expected member $Name." } - if ($Tag -ceq 'Nil') { - if ($Reader.ReadElementContentAsString() -cne '') { throw 'Raw XML: nonempty Nil.' } - return $null - } - # One intrinsic scalar only; never materialize a snapshot XML string or the whole file. - $value = $Reader.ReadElementContentAsString() - if ($Tag -ceq 'S') { return (ConvertFrom-PraRawString $value) } - $number = [int]::Parse($value,$script:PraRawCulture) - if ($number.ToString($script:PraRawCulture) -cne $value) { throw 'Raw XML: noncanonical Int32.' } - return $number -} - -function Read-PraRawNode { - param([hashtable]$State,[int]$Depth,[hashtable]$Budget) - $Budget.Left-- - if ($Depth -gt $script:PraRawDepth -or $Budget.Left -lt 0) { throw 'Raw XML: descriptor depth/node limit.' } - $reader = $State.Reader - Read-PraRawObjectStart $State; Read-PraRawStart $reader 'MS' - if ((Read-PraRawElement $reader 'I32' 'Depth') -ne $Depth) { throw 'Raw XML: invalid descriptor preorder depth.' } - $kind = Read-PraRawElement $reader 'S' 'Kind'; $type = Read-PraRawElement $reader 'S' 'Type' - $null = $reader.MoveToContent(); $tag = $reader.LocalName - if ($tag -cnotin @('S','Nil')) { throw 'Raw XML: invalid descriptor value type.' } - $value = Read-PraRawElement $reader $tag 'Value'; $count = Read-PraRawElement $reader 'I32' 'Count' - if ($count -lt 0 -or $count -gt $Budget.Left -or ($kind -cne 'Collection' -and $count -ne 0)) { throw 'Raw XML: invalid item cardinality.' } - Read-PraRawEnd $reader 'MS'; Read-PraRawEnd $reader 'Obj' - $items = [Collections.Generic.List[object]]::new() - for ($i=0; $i -lt $count; $i++) { $items.Add((Read-PraRawNode $State ($Depth+1) $Budget)) } - return ,([ordered]@{Kind=$kind; Type=$type; Value=$value; Items=[object[]]$items.ToArray()}) -} - -function Read-PraRawSnapshot { - param([hashtable]$State) - $reader = $State.Reader - Read-PraRawObjectStart $State; Read-PraRawStart $reader 'MS' - if ((Read-PraRawElement $reader 'S' 'RawFormat') -cne $script:PraRawFormat) { throw 'Raw XML: format marker mismatch.' } - $guid = Read-PraRawElement $reader 'S' 'ObjectGUID'; $dn = Read-PraRawElement $reader 'S' 'DistinguishedName' - $utc = Read-PraRawElement $reader 'S' 'CapturedUtc' - Read-PraRawObjectStart $State 'Attributes'; Read-PraRawStart $reader 'DCT' - $attributes = [ordered]@{} - while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { - Read-PraRawStart $reader 'En'; $name = Read-PraRawElement $reader 'S' 'Key' - if ([string]::IsNullOrEmpty($name) -or $attributes.Contains($name)) { throw 'Raw XML: duplicate/empty attribute name.' } - Read-PraRawObjectStart $State 'Value'; Read-PraRawStart $reader 'LST' - $attributes[$name] = Read-PraRawNode $State 0 @{Left=$script:PraRawNodes} - Read-PraRawEnd $reader 'LST'; Read-PraRawEnd $reader 'Obj'; Read-PraRawEnd $reader 'En' - } - Read-PraRawEnd $reader 'DCT'; Read-PraRawEnd $reader 'Obj'; Read-PraRawEnd $reader 'MS'; Read-PraRawEnd $reader 'Obj' - $snapshot = [pscustomobject][ordered]@{ObjectGUID=$guid; DistinguishedName=$dn; CapturedUtc=$utc; Attributes=$attributes} - Assert-PraRawSnapshot $snapshot - return $snapshot -} - -function Assert-PraRawDescriptorEqual { - param($Left,$Right,[string]$Name) - foreach ($field in @('Kind','Type','Value')) { - if (-not [object]::Equals($Left[$field],$Right[$field])) { throw "Raw: creation roundtrip mismatch, attribute=$Name field=$field." } - } - if ($Left.Items.Count -ne $Right.Items.Count) { throw "Raw: creation roundtrip item count mismatch, attribute=$Name." } - for ($i=0; $i -lt $Left.Items.Count; $i++) { Assert-PraRawDescriptorEqual $Left.Items[$i] $Right.Items[$i] $Name } -} - -function Assert-PraRawExpected { - param($Actual,$Expected) - foreach ($field in @('ObjectGUID','DistinguishedName','CapturedUtc')) { - if (-not [object]::Equals($Actual.$field,$Expected.$field)) { throw "Raw: creation roundtrip metadata mismatch, $field." } - } - if ($Actual.Attributes.Count -ne $Expected.Attributes.Count) { throw 'Raw: creation roundtrip attribute count mismatch.' } - $names = @($Expected.Attributes.Keys); $index = 0 - foreach ($name in $Actual.Attributes.Keys) { - if ($name -cne $names[$index]) { throw 'Raw: creation roundtrip attribute name/order mismatch.' } - Assert-PraRawDescriptorEqual $Actual.Attributes[$name] $Expected.Attributes[$name] $name - $index++ - } -} - -function Assert-PraRawRecord { - param($Snapshot,$Record) - foreach ($field in @('DistinguishedName','CapturedUtc')) { - $value = Get-PraRawMember $Record $field - if ($null -ne $value -and -not [object]::Equals($value,$Snapshot.$field)) { throw "Raw/JSON: $field mismatch, GUID=$($Snapshot.ObjectGUID)." } - } - $states = Get-PraRawMember $Record 'Attributes' - if ($null -eq $states) { return } - $entries = if ($states -is [Collections.IDictionary]) { $states.GetEnumerator() } else { $states.PSObject.Properties } - foreach ($entry in $entries) { - $name = if ($states -is [Collections.IDictionary]) { $entry.Key } else { $entry.Name } - if (-not $Snapshot.Attributes.Contains($name)) { throw "Raw/JSON: attribute not captured, $name." } - $state = $entry.Value; $descriptor = $Snapshot.Attributes[$name] - $present = $descriptor.Kind -cne 'Null' -and - -not ($descriptor.Kind -ceq 'Collection' -and $descriptor.Items.Count -eq 0) -and - -not ($descriptor.Kind -ceq 'Binary' -and $descriptor.Value.Length -eq 0) -and - -not ($descriptor.Kind -ceq 'Scalar' -and $descriptor.Type -ceq 'String' -and $descriptor.Value.Length -eq 0) - $storedPresent = Get-PraRawMember $state 'Present' - if ($storedPresent -isnot [bool] -or $storedPresent -ne $present) { throw "Raw/JSON: presence mismatch, attribute=$name." } - $stored = Get-PraRawMember $state 'Value'; $kind = Get-PraRawMember $state 'Kind' - if (-not $present) { - if ($null -ne $stored) { throw "Raw/JSON: absent value mismatch, attribute=$name." } - continue - } - if ($kind -ceq 'MultiString') { - $values = [Collections.Generic.List[string]]::new() - $items = if ($descriptor.Kind -ceq 'Collection') { $descriptor.Items } else { ,$descriptor } - foreach ($item in $items) { - if ($item.Kind -cne 'Scalar' -or $item.Type -cne 'String') { throw "Raw/JSON: MultiString type mismatch, $name." } - $values.Add($item.Value) - } - $actual = @($values | Sort-Object -CaseSensitive); $expected = @($stored | Sort-Object -CaseSensitive) - if ($actual.Count -ne $expected.Count) { throw "Raw/JSON: MultiString count mismatch, $name." } - for ($i=0; $i -lt $actual.Count; $i++) { - if (-not [object]::Equals($actual[$i],$expected[$i])) { throw "Raw/JSON: MultiString value mismatch, $name." } - } - continue - } - $scalar = $descriptor - if ($scalar.Kind -ceq 'Collection' -and $scalar.Items.Count -eq 1) { $scalar = $scalar.Items[0] } - $actual = $null - switch -CaseSensitive ($kind) { - 'Bytes' { if ($descriptor.Kind -ceq 'Binary') { $actual = $descriptor.Value } } - 'String' { if ($scalar.Kind -ceq 'Scalar' -and $scalar.Type -ceq 'String') { $actual = $scalar.Value } } - 'Bool' { if ($scalar.Kind -ceq 'Scalar' -and $scalar.Type -ceq 'Boolean') { $actual = $scalar.Value -ceq 'true' } } - { $_ -cin @('Int','Long') } { - if ($scalar.Kind -ceq 'Scalar' -and $scalar.Type -cin @('SByte','Byte','Int16','UInt16','Int32','UInt32','Int64','UInt64','String')) { - $actual = ([int64]::Parse($scalar.Value,$script:PraRawCulture)).ToString($script:PraRawCulture) - if ($kind -ceq 'Int') { $null = [int32]::Parse($actual,$script:PraRawCulture) } - } - } - default { throw "Raw/JSON: unknown restoration kind, attribute=$name." } - } - if ($null -eq $actual -or -not [object]::Equals($actual,$stored)) { throw "Raw/JSON: typed value mismatch, attribute=$name." } - } - $usn = Get-PraRawMember $Record 'CapturedUsnChanged' - if ($null -ne $usn) { - $descriptor = $Snapshot.Attributes['uSNChanged'] - if ($null -eq $descriptor -or $descriptor.Kind -cne 'Scalar' -or $descriptor.Value -cne $usn) { throw 'Raw/JSON: uSNChanged mismatch.' } - } -} - -function Skip-PraLegacyValue { - param([Xml.XmlReader]$Reader) - $null = $Reader.MoveToContent(); $depth = $Reader.Depth - if ($Reader.NodeType -ne [Xml.XmlNodeType]::Element) { throw 'Legacy CLIXML: expected value.' } - $allowed = @('Obj','Ref','TN','TNRef','T','ToString','Props','MS','LST','IE','QUE','STK','DCT','En', - 'Nil','S','C','B','SB','By','I16','U16','I32','U32','I64','U64','Sg','Db','D','DT','TS','G','URI','Version','BA','SS','XD','SBK') - while ($true) { - if ($Reader.Depth -gt 256) { throw 'Legacy CLIXML: XML depth exceeds 256; no graph inflation fallback.' } - if ($Reader.NodeType -eq [Xml.XmlNodeType]::Element) { - if ($Reader.NamespaceURI -cne $script:PraRawNamespace -or $Reader.LocalName -cnotin $allowed) { throw 'Legacy CLIXML: unsupported XML node.' } - if ($Reader.LocalName -ceq 'BA') { - $buffer = [byte[]]::new(4096) - while ($Reader.ReadElementContentAsBase64($buffer,0,$buffer.Length) -gt 0) { } - if ($Reader.Depth -le $depth) { return } - continue - } - if ($Reader.Depth -eq $depth -and $Reader.IsEmptyElement) { $null = $Reader.Read(); return } - } elseif ($Reader.NodeType -eq [Xml.XmlNodeType]::EndElement -and $Reader.Depth -eq $depth) { - $null = $Reader.Read(); return - } - if (-not $Reader.Read()) { throw 'Legacy CLIXML: truncated value.' } - } -} - -function Add-PraRawIdentity { - param([hashtable]$State,[string]$Guid) - $key = ([guid]::Parse($Guid)).ToString('D') - if ($key -ceq [guid]::Empty.ToString('D') -or -not $State.Records.ContainsKey($key) -or -not $State.Seen.Add($key)) { - throw "Raw/JSON: unexpected/duplicate logical user GUID=$key." - } - $State.Guids.Add($key) -} - -function Read-PraLegacyReference { - param([hashtable]$State) - $reader = $State.Reader - Assert-PraRawXmlStart $reader 'Ref' @('RefId','N') - $id = $reader.GetAttribute('RefId') - if ($null -eq $id -or -not $State.Identities.ContainsKey($id)) { - throw 'Legacy CLIXML: identity reference cannot be proven without graph inflation; rejected.' - } - if (-not $reader.IsEmptyElement) { throw 'Legacy CLIXML: nonempty identity reference.' } - $null = $reader.Read() - return $State.Identities[$id] -} - -function Read-PraLegacyObject { - param([hashtable]$State,[bool]$AllowWrapper) - $reader = $State.Reader - Assert-PraRawXmlStart $reader 'Obj' @('RefId','N') - $refId = $reader.GetAttribute('RefId') - if ($null -eq $refId -or $refId -cnotmatch '^(0|[1-9][0-9]*)$' -or $reader.IsEmptyElement) { throw 'Legacy CLIXML: invalid logical object.' } - $reader.ReadStartElement(); $guid = $null; $wrapper = $false; $members = $false - while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { - switch -CaseSensitive ($reader.LocalName) { - { $_ -cin @('TN','TNRef','ToString') } { Skip-PraLegacyValue $reader } - 'LST' { - if (-not $AllowWrapper -or $wrapper -or $members) { throw 'Legacy CLIXML: ambiguous/nested user wrapper.' } - $wrapper = $true; Read-PraRawStart $reader 'LST' - while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { - if ($reader.LocalName -ceq 'Ref') { Add-PraRawIdentity $State (Read-PraLegacyReference $State) } - elseif ($reader.LocalName -ceq 'Obj') { $null = Read-PraLegacyObject $State $false } - else { throw 'Legacy CLIXML: non-object logical user in wrapper.' } - } - Read-PraRawEnd $reader 'LST' - } - { $_ -cin @('Props','MS') } { - if ($wrapper) { throw 'Legacy CLIXML: wrapper also has user properties.' } - $members = $true; $container = $reader.LocalName - Assert-PraRawXmlStart $reader $container - if ($reader.IsEmptyElement) { $reader.ReadStartElement(); continue } - $reader.ReadStartElement() - while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { - $name = ConvertFrom-PraRawString ([string]$reader.GetAttribute('N')) - if ($name -ieq 'ObjectGUID') { - if ($null -ne $guid) { throw 'Legacy CLIXML: duplicate direct ObjectGUID.' } - if ($reader.LocalName -ceq 'G') { - Assert-PraRawXmlStart $reader 'G' @('N') - $guid = ([guid]::Parse($reader.ReadElementContentAsString())).ToString('D') - } elseif ($reader.LocalName -ceq 'Ref') { $guid = Read-PraLegacyReference $State } - else { throw 'Legacy CLIXML: identity is not a direct typed GUID or provable reference; rejected.' } - } else { Skip-PraLegacyValue $reader } - } - Read-PraRawEnd $reader $container - } - default { throw 'Legacy CLIXML: unrecognized logical user/wrapper structure.' } - } - } - Read-PraRawEnd $reader 'Obj' - if (-not $wrapper) { - if ($null -eq $guid) { throw 'Legacy CLIXML: logical user has no direct ObjectGUID; nested ACL GUIDs do not count.' } - if ($State.Identities.ContainsKey($refId)) { throw 'Legacy CLIXML: ambiguous logical RefId.' } - $State.Identities[$refId] = $guid - Add-PraRawIdentity $State $guid - } - return $wrapper -} - -function Test-PraRawCapture { - <# .SYNOPSIS - Streams to EOF, validates the closed codec or legacy logical identities, returns only a receipt. - .DESCRIPTION - ExpectedSnapshots adds lossless creation-time comparison. Records.Attributes is independently - compared to the typed restoration JSON. Legacy never deserializes or inflates a native graph. - #> - [CmdletBinding()] - param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$LiteralPath, - [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Records, - [Parameter(Mandatory)][AllowEmptyString()][string]$RawFormat, - [AllowEmptyCollection()][object[]]$ExpectedSnapshots) - if ($RawFormat -cnotin @('',$script:PraRawFormat)) { throw "Raw: unsupported format '$RawFormat'." } - if ($Records.Count -eq 0) { throw 'Raw: empty Records.' } - $recordMap = @{}; $expectedMap = @{} - foreach ($record in $Records) { - $key = ([guid]::Parse([string](Get-PraRawMember $record 'ObjectGUID'))).ToString('D') - if ($key -ceq [guid]::Empty.ToString('D') -or $recordMap.ContainsKey($key)) { throw 'Raw: invalid/duplicate JSON GUID.' } - $recordMap[$key] = $record - } - $compare = $PSBoundParameters.ContainsKey('ExpectedSnapshots') - if ($compare) { - if ($RawFormat -ceq '' -or $ExpectedSnapshots.Count -ne $Records.Count) { throw 'Raw: ExpectedSnapshots format/cardinality mismatch.' } - foreach ($snapshot in $ExpectedSnapshots) { - Assert-PraRawSnapshot $snapshot - if ($expectedMap.ContainsKey($snapshot.ObjectGUID) -or -not $recordMap.ContainsKey($snapshot.ObjectGUID)) { throw 'Raw: duplicate/unexpected expected GUID.' } - $expectedMap[$snapshot.ObjectGUID] = $snapshot - } - } - $path = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($LiteralPath) - $stream = [IO.FileStream]::new($path,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read,65536) - $reader = $null - try { - $settings = [Xml.XmlReaderSettings]::new(); $settings.DtdProcessing = [Xml.DtdProcessing]::Prohibit - $settings.XmlResolver = $null; $settings.CloseInput = $false; $settings.IgnoreWhitespace = $false - $settings.CheckCharacters = $true; $settings.ConformanceLevel = [Xml.ConformanceLevel]::Document - $reader = [Xml.XmlReader]::Create($stream,$settings) - Assert-PraRawXmlStart $reader 'Objs' @('Version') - if ($reader.GetAttribute('Version') -cne '1.1.0.1' -or $reader.IsEmptyElement) { throw 'Raw: invalid/empty CLIXML root.' } - $reader.ReadStartElement() - $state = @{Reader=$reader; RefId=[int64]0; Records=$recordMap; Guids=[Collections.Generic.List[string]]::new(); - Seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal); Identities=@{}} - $wrapper = $false; $topCount = 0 - while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { - if ($RawFormat -ceq $script:PraRawFormat) { - $snapshot = Read-PraRawSnapshot $state - Add-PraRawIdentity $state $snapshot.ObjectGUID - Assert-PraRawRecord $snapshot $recordMap[$snapshot.ObjectGUID] - if ($compare) { Assert-PraRawExpected $snapshot $expectedMap[$snapshot.ObjectGUID] } - Write-PraRawProgress $Context $snapshot $stream.Position 'READ VERIFIED' - $snapshot = $null - } else { - if ($wrapper) { throw 'Legacy CLIXML: wrapper mixed with root sequence.' } - if ($reader.LocalName -ceq 'Ref') { Add-PraRawIdentity $state (Read-PraLegacyReference $state) } - else { $wrapper = Read-PraLegacyObject $state ($topCount -eq 0) } - $topCount++ - } - } - Read-PraRawEnd $reader 'Objs' - # Reading past the root is essential: reject a truncated/malformed trailing document. - $null = $reader.MoveToContent() - if (-not $reader.EOF) { throw 'Raw: trailing XML content.' } - if ($state.Guids.Count -ne $Records.Count) { throw 'Raw/JSON: logical user count mismatch.' } - return [pscustomobject]@{Count=$state.Guids.Count; ObjectGuids=[string[]]$state.Guids.ToArray(); - Format=$RawFormat; Bytes=[int64]$stream.Length} - } finally { - try { if ($null -ne $reader) { $reader.Dispose() } } finally { $stream.Dispose() } - } -} - -Export-ModuleMember -Function ConvertTo-PraRawSnapshot,Write-PraRawCapture,Test-PraRawCapture +#Requires -Version 5.1 +#Requires -PSEdition Desktop +<# +.SYNOPSIS + PRA Remote Mailbox - data-only CLIXML codec of the AD captures (backup part 2 of 2). + +.DESCRIPTION + Every backup has two parts: the typed JSON records (what Recover restores) and a CLIXML file + with EVERY value returned by AD for each object (audit, manual recovery, attributes the tool + does not manage). This module writes and re-reads that CLIXML as a stream, with a closed format: + no native AD object is kept or deserialised, no value is converted to text as a fallback, and an + unsupported type stops the backup (nothing is written to AD). + + ConvertTo-PraRawSnapshot ADUser -> closed, lossless description of every attribute + Write-PraRawCapture writes the snapshots of a batch (new file only, never overwritten) + Test-PraRawCapture streams the file to the end and checks it against the JSON records + (and, just after writing, against the snapshots in memory) + + Old backups (schema 1 and 2) contain a native CLIXML: only the object identities are checked, + the graph is never inflated. + +.NOTES + Author : Nicolas Fabert + Version : 2.2.0 (format PraDataOnlyClixml-v1, unchanged since 1.3.3) +#> +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' +# >>> PRA package integrity bootstrap: identical in every runtime PowerShell file (checked by the tests). +# It authenticates module\Test-PackageIntegrity.ps1 before running it; there is no unsigned or bypass path. +& { + param([Parameter(Mandatory)][string]$PackageRoot) + $verifier = [IO.Path]::GetFullPath([IO.Path]::Combine($PackageRoot, 'module', 'Test-PackageIntegrity.ps1')) + $cursor = $verifier + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + & $verifier -Root $PackageRoot +} ([IO.Path]::GetDirectoryName($PSScriptRoot)) +# <<< PRA package integrity bootstrap + +# Closed, data-only codec. No directory reads, CLR property walks, or native graph serializer. +# DTO: {ObjectGUID; DistinguishedName; CapturedUtc; Attributes=[ordered] name -> descriptor}. +# Descriptor always has {Kind; Type; Value=string|null; Items=object[]}. +# Wire: Objs/Obj/MS snapshots; Attributes is DCT name -> LST of preorder descriptor nodes +# {Depth=I32; Kind=S; Type=S; Value=S|Nil; Count=I32}. XML depth is constant, not graph depth. +# IEEE754 bytes and decimal bits preserve negative zero, NaN payloads and decimal scale. +$script:PraRawFormat = 'PraDataOnlyClixml-v1' +$script:PraRawNamespace = 'http://schemas.microsoft.com/powershell/2004/04' +$script:PraRawDepth = 16 +$script:PraRawNodes = 1000000 +$script:PraRawCulture = [Globalization.CultureInfo]::InvariantCulture +$script:PraRawEscape = [regex]'[_\x00-\x1f\x7f-\x9f\uD800-\uDFFF￾￿]' +$script:PraRawUnescape = [regex]'_x([0-9a-fA-F]{4})_' + +function Get-PraRawMember { + param([AllowNull()]$Object,[string]$Name) + if ($null -eq $Object) { return $null } + if ($Object -is [Collections.IDictionary]) { + if ($Object.Contains($Name)) { return ,$Object[$Name] } + return $null + } + $property = $Object.PSObject.Properties[$Name] + if ($null -ne $property) { return ,$property.Value } + return $null +} + +function Test-PraRawCollectionType { + param([string]$Name) + return ($Name -cmatch '^System\.[A-Za-z0-9_.+`\[\], =-]+\[\]$' -or + $Name -cin @('System.Collections.ArrayList','System.Collections.Specialized.StringCollection', + 'Microsoft.ActiveDirectory.Management.ADPropertyValueCollection') -or + $Name -cmatch '^System\.Collections\.(Generic\.List|ObjectModel\.(ReadOnlyCollection|Collection))`1\[\[') +} + +function ConvertTo-PraRawDescriptor { + param([AllowNull()]$Value,[string]$Attribute,[string]$ObjectGuid,[int]$Depth,[hashtable]$Budget) + $Budget.Left-- + if ($Depth -gt $script:PraRawDepth -or $Budget.Left -lt 0) { + throw "Raw capture: collection limit/cycle, attribute=$Attribute GUID=$ObjectGuid." + } + $result = [ordered]@{ Kind='Null'; Type=''; Value=$null; Items=[object[]]@() } + if ($null -eq $Value) { return ,$result } + $type = $Value.GetType(); $name = $type.FullName + $result.Kind = 'Scalar'; $result.Type = $type.Name + switch -CaseSensitive ($name) { + 'System.String' { $result.Value = $Value; return ,$result } + 'System.Boolean' { $result.Value = if ($Value) { 'true' } else { 'false' }; return ,$result } + 'System.Char' { $result.Value = ([uint16][char]$Value).ToString($script:PraRawCulture); return ,$result } + { $_ -cin @('System.SByte','System.Byte','System.Int16','System.UInt16','System.Int32', + 'System.UInt32','System.Int64','System.UInt64') } { + $result.Value = $Value.ToString($script:PraRawCulture); return ,$result + } + { $_ -cin @('System.Single','System.Double') } { + $bytes = [BitConverter]::GetBytes($Value) + if (-not [BitConverter]::IsLittleEndian) { [array]::Reverse($bytes) } + $result.Value = [Convert]::ToBase64String($bytes); return ,$result + } + 'System.Decimal' { + $parts = [Collections.Generic.List[string]]::new() + foreach ($part in [decimal]::GetBits($Value)) { $parts.Add($part.ToString($script:PraRawCulture)) } + $result.Value = $parts -join '|'; return ,$result + } + 'System.DateTime' { $result.Value = $Value.ToBinary().ToString($script:PraRawCulture); return ,$result } + 'System.DateTimeOffset' { + $result.Value = $Value.Ticks.ToString($script:PraRawCulture) + '|' + $Value.Offset.Ticks.ToString($script:PraRawCulture) + return ,$result + } + 'System.TimeSpan' { $result.Value = $Value.Ticks.ToString($script:PraRawCulture); return ,$result } + 'System.Guid' { $result.Value = $Value.ToString('D'); return ,$result } + 'System.Security.Principal.SecurityIdentifier' { + $bytes = [byte[]]::new($Value.BinaryLength); $Value.GetBinaryForm($bytes,0) + $result.Type = 'SID'; $result.Value = [Convert]::ToBase64String($bytes); return ,$result + } + 'System.Byte[]' { + $result.Kind = 'Binary'; $result.Type = 'Byte[]' + $result.Value = [Convert]::ToBase64String($Value); return ,$result + } + } + # ActiveDirectorySecurity derives from ObjectSecurity, NOT GenericSecurityDescriptor. + if ($Value -is [Security.AccessControl.ObjectSecurity]) { + $result.Kind = 'SecurityDescriptor'; $result.Type = $name + $result.Value = [Convert]::ToBase64String($Value.GetSecurityDescriptorBinaryForm()) + return ,$result + } + if ($Value -is [Security.AccessControl.GenericSecurityDescriptor]) { + $bytes = [byte[]]::new($Value.BinaryLength); $Value.GetBinaryForm($bytes,0) + $result.Kind = 'SecurityDescriptor'; $result.Type = $name + $result.Value = [Convert]::ToBase64String($bytes); return ,$result + } + $collection = $false + if ($type.IsArray) { + $collection = $Value.Rank -eq 1 -and $Value.GetLowerBound(0) -eq 0 + } elseif ((Test-PraRawCollectionType $name) -and + $type.Assembly.GetName().Name -cin @('mscorlib','System','Microsoft.ActiveDirectory.Management')) { + $collection = $true + } + if (-not $collection) { throw "Raw capture: unsupported attribute=$Attribute type=$name GUID=$ObjectGuid; no fallback." + } + $result.Kind = 'Collection'; $result.Type = $name + $items = [Collections.Generic.List[object]]::new() + foreach ($item in $Value) { + $items.Add((ConvertTo-PraRawDescriptor -Value $item -Attribute $Attribute -ObjectGuid $ObjectGuid -Depth ($Depth+1) -Budget $Budget)) + } + $result.Items = $items.ToArray() + return ,$result +} + +function ConvertTo-PraRawSnapshot { + <# .SYNOPSIS + Detaches every returned user property into a closed lossless DTO; no native object is retained. + #> + [CmdletBinding()] + param([Parameter(Mandatory)]$User,[Parameter(Mandatory)][string]$CapturedUtc) + $identity = Get-PraRawMember $User 'ObjectGUID'; $guid = [guid]::Empty + if (($identity -isnot [guid] -and $identity -isnot [string]) -or + -not [guid]::TryParse([string]$identity,[ref]$guid) -or $guid -eq [guid]::Empty) { + throw 'Raw capture: invalid attribute=ObjectGUID, GUID unavailable.' + } + $key = $guid.ToString('D'); $attributes = [ordered]@{} + $dictionary = $User -is [Collections.IDictionary] + # Native ADUser exposes CLR tracking metadata alongside its returned directory properties. + # Its property bag is authoritative; ordinary objects/dictionaries retain every member. + $names = if ($dictionary) { $User.Keys } + elseif ($User.GetType().FullName -ceq 'Microsoft.ActiveDirectory.Management.ADUser') { $User.PropertyNames } + else { $User.PSObject.Properties.Name } + foreach ($name in $names) { + if ($name -isnot [string] -or [string]::IsNullOrEmpty($name) -or $attributes.Contains($name)) { + throw "Raw capture: invalid/duplicate attribute name, GUID=$key." + } + $value = $null + try { + # Direct assignment preserves null/empty/nested arrays and reads each getter once. + if ($name -ieq 'ObjectGUID') { $value = $identity } + elseif ($dictionary) { $value = $User[$name] } + else { + $property = $User.PSObject.Properties[$name] + if ($null -eq $property) { throw 'Declared property is not readable.' } + $value = $property.Value + } + $attributes[$name] = ConvertTo-PraRawDescriptor -Value $value -Attribute $name -ObjectGuid $key -Depth 0 -Budget @{Left=$script:PraRawNodes} + } catch { + $typeName = '' + if ($null -ne $value) { $typeName = $value.GetType().FullName } + throw "Raw capture failed: attribute=$name type=$typeName GUID=$key. $($_.Exception.Message)" + } + } + $dn = $attributes['DistinguishedName'] + if ($null -eq $dn -or $dn.Kind -cne 'Scalar' -or $dn.Type -cne 'String') { + throw "Raw capture: DistinguishedName must be a captured string, GUID=$key." + } + $snapshot = [pscustomobject][ordered]@{ ObjectGUID=$key; DistinguishedName=$dn.Value; CapturedUtc=$CapturedUtc; Attributes=$attributes } + Assert-PraRawSnapshot $snapshot + return $snapshot +} + +function Assert-PraRawScalar { + param([string]$Kind,[string]$Type,[AllowNull()]$Value) + if ($Kind -ceq 'Null') { + if ($Type -cne '' -or $null -ne $Value) { throw 'Raw: invalid null descriptor.' } + return + } + if ($Kind -ceq 'Collection') { + if ($null -ne $Value -or -not (Test-PraRawCollectionType $Type)) { throw 'Raw: invalid collection descriptor.' } + return + } + if ($Value -isnot [string]) { throw 'Raw: descriptor Value must be a string.' } + if ($Kind -ceq 'Binary' -or $Kind -ceq 'SecurityDescriptor' -or + ($Kind -ceq 'Scalar' -and $Type -cin @('Single','Double','SID'))) { + $bytes = [Convert]::FromBase64String($Value) + if ([Convert]::ToBase64String($bytes) -cne $Value) { throw 'Raw: noncanonical Base64.' } + if ($Kind -ceq 'Binary') { + if ($Type -cne 'Byte[]') { throw 'Raw: invalid binary type.' } + } elseif ($Kind -ceq 'SecurityDescriptor') { + if ($Type -notmatch '^System\.(Security\.AccessControl|DirectoryServices)\.[A-Za-z]+(Security|SecurityDescriptor)$') { + throw 'Raw: invalid security descriptor type.' + } + $security = [Security.AccessControl.RawSecurityDescriptor]::new($bytes,0) + $copy = [byte[]]::new($security.BinaryLength); $security.GetBinaryForm($copy,0) + if ([Convert]::ToBase64String($copy) -cne $Value) { throw 'Raw: security descriptor binary mismatch.' } + } elseif ($Type -ceq 'SID') { + $sid = [Security.Principal.SecurityIdentifier]::new($bytes,0) + $copy = [byte[]]::new($sid.BinaryLength); $sid.GetBinaryForm($copy,0) + if ([Convert]::ToBase64String($copy) -cne $Value) { throw 'Raw: SID binary mismatch.' } + } elseif (($Type -ceq 'Single' -and $bytes.Length -ne 4) -or ($Type -ceq 'Double' -and $bytes.Length -ne 8)) { + throw 'Raw: invalid IEEE754 width.' + } + return + } + if ($Kind -cne 'Scalar') { throw 'Raw: unknown descriptor kind.' } + $canonical = $Value + switch -CaseSensitive ($Type) { + 'String' { return } + 'Boolean' { if ($Value -cnotin @('true','false')) { throw 'Raw: invalid Boolean.' }; return } + 'Char' { $canonical = ([uint16]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'SByte' { $canonical = ([sbyte]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'Byte' { $canonical = ([byte]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'Int16' { $canonical = ([int16]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'UInt16' { $canonical = ([uint16]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'Int32' { $canonical = ([int32]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'UInt32' { $canonical = ([uint32]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'Int64' { $canonical = ([int64]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'UInt64' { $canonical = ([uint64]::Parse($Value,$script:PraRawCulture)).ToString($script:PraRawCulture) } + 'Guid' { $canonical = ([guid]::Parse($Value)).ToString('D') } + 'TimeSpan' { $canonical = ([timespan]::FromTicks([int64]::Parse($Value,$script:PraRawCulture))).Ticks.ToString($script:PraRawCulture) } + 'DateTime' { + $binary = [int64]::Parse($Value,$script:PraRawCulture); $null = [datetime]::FromBinary($binary) + $canonical = $binary.ToString($script:PraRawCulture) + } + 'DateTimeOffset' { + $parts = $Value.Split('|') + if ($parts.Count -ne 2) { throw 'Raw: invalid DateTimeOffset.' } + $date = [datetimeoffset]::new([int64]::Parse($parts[0],$script:PraRawCulture),[timespan]::FromTicks([int64]::Parse($parts[1],$script:PraRawCulture))) + $canonical = $date.Ticks.ToString($script:PraRawCulture) + '|' + $date.Offset.Ticks.ToString($script:PraRawCulture) + } + 'Decimal' { + $parts = $Value.Split('|') + if ($parts.Count -ne 4) { throw 'Raw: invalid Decimal.' } + $bits = [int[]]::new(4); $text = [string[]]::new(4) + for ($i=0; $i -lt 4; $i++) { + $bits[$i] = [int32]::Parse($parts[$i],$script:PraRawCulture); $text[$i] = $bits[$i].ToString($script:PraRawCulture) + } + $null = [decimal]::new($bits); $canonical = $text -join '|' + } + default { throw "Raw: unknown scalar type '$Type'." } + } + if ($canonical -cne $Value) { throw "Raw: noncanonical $Type value." } +} + +function Assert-PraRawDescriptor { + param($Descriptor,[int]$Depth=0,[hashtable]$Budget=@{Left=$script:PraRawNodes}) + $Budget.Left-- + if ($Depth -gt $script:PraRawDepth -or $Budget.Left -lt 0) { throw 'Raw: descriptor depth/node limit or cycle.' } + if ($Descriptor -isnot [Collections.IDictionary] -or $Descriptor.Count -ne 4) { throw 'Raw: invalid descriptor shape.' } + foreach ($field in @('Kind','Type','Value','Items')) { + if (-not $Descriptor.Contains($field)) { throw "Raw: missing descriptor field $field." } + } + if ($Descriptor.Kind -isnot [string] -or $Descriptor.Type -isnot [string] -or $Descriptor.Items -isnot [object[]]) { + throw 'Raw: invalid descriptor field type.' + } + Assert-PraRawScalar $Descriptor.Kind $Descriptor.Type $Descriptor.Value + if ($Descriptor.Kind -cne 'Collection' -and $Descriptor.Items.Count -ne 0) { throw 'Raw: scalar has children.' } + foreach ($item in $Descriptor.Items) { Assert-PraRawDescriptor $item ($Depth+1) $Budget } +} + +function Assert-PraRawSnapshot { + param($Snapshot) + if ($Snapshot -isnot [pscustomobject] -or @($Snapshot.PSObject.Properties).Count -ne 4) { throw 'Raw: invalid snapshot shape.' } + foreach ($field in @('ObjectGUID','DistinguishedName','CapturedUtc')) { + if ((Get-PraRawMember $Snapshot $field) -isnot [string]) { throw "Raw: invalid snapshot $field." } + } + $guid = [guid]::Parse($Snapshot.ObjectGUID) + if ($guid -eq [guid]::Empty -or $guid.ToString('D') -cne $Snapshot.ObjectGUID) { throw 'Raw: invalid snapshot GUID.' } + if ([string]::IsNullOrWhiteSpace($Snapshot.CapturedUtc)) { throw 'Raw: empty CapturedUtc.' } + $null = [datetimeoffset]::Parse($Snapshot.CapturedUtc,$script:PraRawCulture) + if ($Snapshot.Attributes -isnot [Collections.Specialized.OrderedDictionary]) { throw 'Raw: Attributes must be an ordered dictionary.' } + foreach ($name in $Snapshot.Attributes.Keys) { + if ($name -isnot [string] -or [string]::IsNullOrEmpty($name)) { throw 'Raw: invalid attribute name.' } + try { Assert-PraRawDescriptor $Snapshot.Attributes[$name] } + catch { throw "Raw: attribute=$name GUID=$($Snapshot.ObjectGUID). $($_.Exception.Message)" } + } + $id = $Snapshot.Attributes['ObjectGUID']; $dn = $Snapshot.Attributes['DistinguishedName'] + if ($null -eq $id -or $id.Kind -cne 'Scalar' -or $id.Type -cnotin @('Guid','String') -or + ([guid]::Parse($id.Value)).ToString('D') -cne $Snapshot.ObjectGUID) { throw 'Raw: metadata/attribute ObjectGUID mismatch.' } + if ($null -eq $dn -or $dn.Kind -cne 'Scalar' -or $dn.Type -cne 'String' -or $dn.Value -cne $Snapshot.DistinguishedName) { + throw 'Raw: metadata/attribute DistinguishedName mismatch.' + } +} + +function Write-PraRawString { + param([Xml.XmlWriter]$Writer,[AllowEmptyString()][string]$Value) + if ($Value.Length -eq 0) { return } + if (-not $script:PraRawEscape.IsMatch($Value)) { $Writer.WriteString($Value); return } + # Escaping every underscore avoids _xHHHH_ ambiguity across buffer boundaries. + # Encode UTF-16 surrogate code units too, including isolated surrogates, without XML loss. + for ($offset=0; $offset -lt $Value.Length; $offset+=4096) { + $chunk = $Value.Substring($offset,[Math]::Min(4096,$Value.Length-$offset)) + $escaped = $script:PraRawEscape.Replace($chunk,[Text.RegularExpressions.MatchEvaluator]{ + param($match) + return ('_x{0:X4}_' -f [int][char]$match.Value[0]) + }) + $Writer.WriteString($escaped) + } +} + +function Write-PraRawElement { + param([hashtable]$State,[string]$Tag,[AllowEmptyString()][string]$Name,[AllowNull()]$Value) + $State.Writer.WriteStartElement($Tag,$script:PraRawNamespace) + if ($Name) { $State.Writer.WriteStartAttribute('N'); Write-PraRawString $State.Writer $Name; $State.Writer.WriteEndAttribute() } + if ($Tag -cne 'Nil') { Write-PraRawString $State.Writer $Value } + $State.Writer.WriteEndElement() +} + +function Write-PraRawObjectStart { + param([hashtable]$State,[string]$Name='') + $State.Writer.WriteStartElement('Obj',$script:PraRawNamespace) + $State.Writer.WriteAttributeString('RefId',$State.RefId.ToString($script:PraRawCulture)); $State.RefId++ + if ($Name) { $State.Writer.WriteStartAttribute('N'); Write-PraRawString $State.Writer $Name; $State.Writer.WriteEndAttribute() } +} + +function Write-PraRawNode { + param([hashtable]$State,$Descriptor,[int]$Depth) + Write-PraRawObjectStart $State + $State.Writer.WriteStartElement('MS',$script:PraRawNamespace) + Write-PraRawElement $State 'I32' 'Depth' $Depth.ToString($script:PraRawCulture) + Write-PraRawElement $State 'S' 'Kind' $Descriptor.Kind + Write-PraRawElement $State 'S' 'Type' $Descriptor.Type + $tag = if ($null -eq $Descriptor.Value) { 'Nil' } else { 'S' } + Write-PraRawElement $State $tag 'Value' $Descriptor.Value + Write-PraRawElement $State 'I32' 'Count' $Descriptor.Items.Count.ToString($script:PraRawCulture) + $State.Writer.WriteEndElement(); $State.Writer.WriteEndElement() + foreach ($item in $Descriptor.Items) { Write-PraRawNode $State $item ($Depth+1) } +} + +function Write-PraRawProgress { + param($Context,$Snapshot,[int64]$Bytes,[string]$Stage) + $name = $Snapshot.DistinguishedName + $sam = $Snapshot.Attributes['SamAccountName'] + if ($null -ne $sam -and $sam.Kind -ceq 'Scalar' -and $sam.Type -ceq 'String') { $name = $sam.Value } + if ($name.Length -gt 128) { $name = $name.Substring(0,128) } + $name = [regex]::Replace($name,'[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]','?') + $process = [Diagnostics.Process]::GetCurrentProcess() + try { $private = [Math]::Round($process.PrivateMemorySize64 / 1MB,1).ToString($script:PraRawCulture) } + finally { $process.Dispose() } + Write-PraLog -Context $Context -Message "RAW $Stage | GUID=$($Snapshot.ObjectGUID) | name=$name | attributes=$($Snapshot.Attributes.Count) | privateMiB=$private | bytes=$Bytes" -Level Debug +} + +function Write-PraRawCapture { + <# .SYNOPSIS + Creates an exclusive CLIXML stream in the caller's already-private directory. Never overwrites. + #> + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions','',Justification='Mandatory immutable backup artifact; target mutation and private-directory approval belong to the caller.')] + [CmdletBinding()] + param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$LiteralPath, + [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Snapshots) + if ($Snapshots.Count -eq 0) { throw 'Raw: empty snapshot sequence.' } + $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal) + foreach ($snapshot in $Snapshots) { + Assert-PraRawSnapshot $snapshot + if (-not $seen.Add($snapshot.ObjectGUID)) { throw 'Raw: duplicate snapshot GUID before write.' } + } + $path = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($LiteralPath) + if (-not [IO.Directory]::Exists([IO.Path]::GetDirectoryName($path))) { throw 'Raw: private parent directory must already exist.' } + $stream = [IO.FileStream]::new($path,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None,65536) + $writer = $null + try { + $settings = [Xml.XmlWriterSettings]::new(); $settings.Encoding = [Text.UTF8Encoding]::new($true) + $settings.CloseOutput = $false; $settings.Indent = $false; $settings.CheckCharacters = $true + $writer = [Xml.XmlWriter]::Create($stream,$settings) + $state = @{Writer=$writer; RefId=[int64]0} + $writer.WriteStartDocument(); $writer.WriteStartElement('Objs',$script:PraRawNamespace) + $writer.WriteAttributeString('Version','1.1.0.1') + foreach ($snapshot in $Snapshots) { + Write-PraRawProgress $Context $snapshot $stream.Position 'WRITE BEGIN' + Write-PraRawObjectStart $state; $writer.WriteStartElement('MS',$script:PraRawNamespace) + foreach ($field in @('RawFormat','ObjectGUID','DistinguishedName','CapturedUtc')) { + $value = if ($field -ceq 'RawFormat') { $script:PraRawFormat } else { $snapshot.$field } + Write-PraRawElement $state 'S' $field $value + } + Write-PraRawObjectStart $state 'Attributes'; $writer.WriteStartElement('DCT',$script:PraRawNamespace) + foreach ($name in $snapshot.Attributes.Keys) { + $writer.WriteStartElement('En',$script:PraRawNamespace) + Write-PraRawElement $state 'S' 'Key' $name + Write-PraRawObjectStart $state 'Value'; $writer.WriteStartElement('LST',$script:PraRawNamespace) + Write-PraRawNode $state $snapshot.Attributes[$name] 0 + $writer.WriteEndElement(); $writer.WriteEndElement(); $writer.WriteEndElement() + } + $writer.WriteEndElement(); $writer.WriteEndElement(); $writer.WriteEndElement(); $writer.WriteEndElement() + $writer.Flush() + Write-PraRawProgress $Context $snapshot $stream.Position 'WRITE END' + } + $writer.WriteEndElement(); $writer.WriteEndDocument(); $writer.Flush(); $stream.Flush($true) + } finally { + try { if ($null -ne $writer) { $writer.Dispose() } } finally { $stream.Dispose() } + } +} + +function ConvertFrom-PraRawString { + param([AllowEmptyString()][string]$Value) + if ($Value.IndexOf('_x',[StringComparison]::Ordinal) -lt 0) { return $Value } + return $script:PraRawUnescape.Replace($Value,[Text.RegularExpressions.MatchEvaluator]{ + param($match) + return [string][char][Convert]::ToInt32($match.Groups[1].Value,16) + }) +} + +function Assert-PraRawXmlStart { + param([Xml.XmlReader]$Reader,[string]$Tag,[string[]]$Attributes=@()) + $null = $Reader.MoveToContent() + if ($Reader.NodeType -ne [Xml.XmlNodeType]::Element -or $Reader.LocalName -cne $Tag -or $Reader.NamespaceURI -cne $script:PraRawNamespace) { + throw "Raw XML: expected $Tag, found $($Reader.NodeType)/$($Reader.LocalName)." + } + if ($Reader.MoveToFirstAttribute()) { + do { + if ($Reader.Name -ceq 'xmlns' -and $Tag -ceq 'Objs' -and $Reader.Value -ceq $script:PraRawNamespace) { continue } + if ($Reader.NamespaceURI -cne '' -or $Reader.Name -cnotin $Attributes) { throw "Raw XML: unexpected attribute $($Reader.Name)." } + } while ($Reader.MoveToNextAttribute()) + $null = $Reader.MoveToElement() + } +} + +function Read-PraRawStart { + param([Xml.XmlReader]$Reader,[string]$Tag) + Assert-PraRawXmlStart $Reader $Tag + if ($Reader.IsEmptyElement) { throw "Raw XML: empty $Tag container." } + $Reader.ReadStartElement() +} + +function Read-PraRawEnd { + param([Xml.XmlReader]$Reader,[string]$Tag) + $null = $Reader.MoveToContent() + if ($Reader.NodeType -ne [Xml.XmlNodeType]::EndElement -or $Reader.LocalName -cne $Tag -or $Reader.NamespaceURI -cne $script:PraRawNamespace) { + throw "Raw XML: expected closing $Tag." + } + $Reader.ReadEndElement() +} + +function Read-PraRawObjectStart { + param([hashtable]$State,[string]$Name='') + $reader = $State.Reader + Assert-PraRawXmlStart $reader 'Obj' @('RefId','N') + if ($reader.GetAttribute('RefId') -cne $State.RefId.ToString($script:PraRawCulture) -or + (ConvertFrom-PraRawString ([string]$reader.GetAttribute('N'))) -cne $Name -or $reader.IsEmptyElement) { + throw 'Raw XML: object identity/name/sequence invalid; shared references are forbidden.' + } + $State.RefId++; $reader.ReadStartElement() +} + +function Read-PraRawElement { + param([Xml.XmlReader]$Reader,[string]$Tag,[string]$Name) + Assert-PraRawXmlStart $Reader $Tag @('N') + if ((ConvertFrom-PraRawString ([string]$Reader.GetAttribute('N'))) -cne $Name) { throw "Raw XML: expected member $Name." } + if ($Tag -ceq 'Nil') { + if ($Reader.ReadElementContentAsString() -cne '') { throw 'Raw XML: nonempty Nil.' } + return $null + } + # One intrinsic scalar only; never materialize a snapshot XML string or the whole file. + $value = $Reader.ReadElementContentAsString() + if ($Tag -ceq 'S') { return (ConvertFrom-PraRawString $value) } + $number = [int]::Parse($value,$script:PraRawCulture) + if ($number.ToString($script:PraRawCulture) -cne $value) { throw 'Raw XML: noncanonical Int32.' } + return $number +} + +function Read-PraRawNode { + param([hashtable]$State,[int]$Depth,[hashtable]$Budget) + $Budget.Left-- + if ($Depth -gt $script:PraRawDepth -or $Budget.Left -lt 0) { throw 'Raw XML: descriptor depth/node limit.' } + $reader = $State.Reader + Read-PraRawObjectStart $State; Read-PraRawStart $reader 'MS' + if ((Read-PraRawElement $reader 'I32' 'Depth') -ne $Depth) { throw 'Raw XML: invalid descriptor preorder depth.' } + $kind = Read-PraRawElement $reader 'S' 'Kind'; $type = Read-PraRawElement $reader 'S' 'Type' + $null = $reader.MoveToContent(); $tag = $reader.LocalName + if ($tag -cnotin @('S','Nil')) { throw 'Raw XML: invalid descriptor value type.' } + $value = Read-PraRawElement $reader $tag 'Value'; $count = Read-PraRawElement $reader 'I32' 'Count' + if ($count -lt 0 -or $count -gt $Budget.Left -or ($kind -cne 'Collection' -and $count -ne 0)) { throw 'Raw XML: invalid item cardinality.' } + Read-PraRawEnd $reader 'MS'; Read-PraRawEnd $reader 'Obj' + $items = [Collections.Generic.List[object]]::new() + for ($i=0; $i -lt $count; $i++) { $items.Add((Read-PraRawNode $State ($Depth+1) $Budget)) } + return ,([ordered]@{Kind=$kind; Type=$type; Value=$value; Items=[object[]]$items.ToArray()}) +} + +function Read-PraRawSnapshot { + param([hashtable]$State) + $reader = $State.Reader + Read-PraRawObjectStart $State; Read-PraRawStart $reader 'MS' + if ((Read-PraRawElement $reader 'S' 'RawFormat') -cne $script:PraRawFormat) { throw 'Raw XML: format marker mismatch.' } + $guid = Read-PraRawElement $reader 'S' 'ObjectGUID'; $dn = Read-PraRawElement $reader 'S' 'DistinguishedName' + $utc = Read-PraRawElement $reader 'S' 'CapturedUtc' + Read-PraRawObjectStart $State 'Attributes'; Read-PraRawStart $reader 'DCT' + $attributes = [ordered]@{} + while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { + Read-PraRawStart $reader 'En'; $name = Read-PraRawElement $reader 'S' 'Key' + if ([string]::IsNullOrEmpty($name) -or $attributes.Contains($name)) { throw 'Raw XML: duplicate/empty attribute name.' } + Read-PraRawObjectStart $State 'Value'; Read-PraRawStart $reader 'LST' + $attributes[$name] = Read-PraRawNode $State 0 @{Left=$script:PraRawNodes} + Read-PraRawEnd $reader 'LST'; Read-PraRawEnd $reader 'Obj'; Read-PraRawEnd $reader 'En' + } + Read-PraRawEnd $reader 'DCT'; Read-PraRawEnd $reader 'Obj'; Read-PraRawEnd $reader 'MS'; Read-PraRawEnd $reader 'Obj' + $snapshot = [pscustomobject][ordered]@{ObjectGUID=$guid; DistinguishedName=$dn; CapturedUtc=$utc; Attributes=$attributes} + Assert-PraRawSnapshot $snapshot + return $snapshot +} + +function Assert-PraRawDescriptorEqual { + param($Left,$Right,[string]$Name) + foreach ($field in @('Kind','Type','Value')) { + if (-not [object]::Equals($Left[$field],$Right[$field])) { throw "Raw: creation roundtrip mismatch, attribute=$Name field=$field." } + } + if ($Left.Items.Count -ne $Right.Items.Count) { throw "Raw: creation roundtrip item count mismatch, attribute=$Name." } + for ($i=0; $i -lt $Left.Items.Count; $i++) { Assert-PraRawDescriptorEqual $Left.Items[$i] $Right.Items[$i] $Name } +} + +function Assert-PraRawExpected { + param($Actual,$Expected) + foreach ($field in @('ObjectGUID','DistinguishedName','CapturedUtc')) { + if (-not [object]::Equals($Actual.$field,$Expected.$field)) { throw "Raw: creation roundtrip metadata mismatch, $field." } + } + if ($Actual.Attributes.Count -ne $Expected.Attributes.Count) { throw 'Raw: creation roundtrip attribute count mismatch.' } + $names = @($Expected.Attributes.Keys); $index = 0 + foreach ($name in $Actual.Attributes.Keys) { + if ($name -cne $names[$index]) { throw 'Raw: creation roundtrip attribute name/order mismatch.' } + Assert-PraRawDescriptorEqual $Actual.Attributes[$name] $Expected.Attributes[$name] $name + $index++ + } +} + +function Assert-PraRawRecord { + param($Snapshot,$Record) + foreach ($field in @('DistinguishedName','CapturedUtc')) { + $value = Get-PraRawMember $Record $field + if ($null -ne $value -and -not [object]::Equals($value,$Snapshot.$field)) { throw "Raw/JSON: $field mismatch, GUID=$($Snapshot.ObjectGUID)." } + } + $states = Get-PraRawMember $Record 'Attributes' + if ($null -eq $states) { return } + $entries = if ($states -is [Collections.IDictionary]) { $states.GetEnumerator() } else { $states.PSObject.Properties } + foreach ($entry in $entries) { + $name = if ($states -is [Collections.IDictionary]) { $entry.Key } else { $entry.Name } + if (-not $Snapshot.Attributes.Contains($name)) { throw "Raw/JSON: attribute not captured, $name." } + $state = $entry.Value; $descriptor = $Snapshot.Attributes[$name] + $present = $descriptor.Kind -cne 'Null' -and + -not ($descriptor.Kind -ceq 'Collection' -and $descriptor.Items.Count -eq 0) -and + -not ($descriptor.Kind -ceq 'Binary' -and $descriptor.Value.Length -eq 0) -and + -not ($descriptor.Kind -ceq 'Scalar' -and $descriptor.Type -ceq 'String' -and $descriptor.Value.Length -eq 0) + $storedPresent = Get-PraRawMember $state 'Present' + if ($storedPresent -isnot [bool] -or $storedPresent -ne $present) { throw "Raw/JSON: presence mismatch, attribute=$name." } + $stored = Get-PraRawMember $state 'Value'; $kind = Get-PraRawMember $state 'Kind' + if (-not $present) { + if ($null -ne $stored) { throw "Raw/JSON: absent value mismatch, attribute=$name." } + continue + } + if ($kind -ceq 'MultiString') { + $values = [Collections.Generic.List[string]]::new() + $items = if ($descriptor.Kind -ceq 'Collection') { $descriptor.Items } else { ,$descriptor } + foreach ($item in $items) { + if ($item.Kind -cne 'Scalar' -or $item.Type -cne 'String') { throw "Raw/JSON: MultiString type mismatch, $name." } + $values.Add($item.Value) + } + $actual = @($values | Sort-Object -CaseSensitive); $expected = @($stored | Sort-Object -CaseSensitive) + if ($actual.Count -ne $expected.Count) { throw "Raw/JSON: MultiString count mismatch, $name." } + for ($i=0; $i -lt $actual.Count; $i++) { + if (-not [object]::Equals($actual[$i],$expected[$i])) { throw "Raw/JSON: MultiString value mismatch, $name." } + } + continue + } + $scalar = $descriptor + if ($scalar.Kind -ceq 'Collection' -and $scalar.Items.Count -eq 1) { $scalar = $scalar.Items[0] } + $actual = $null + switch -CaseSensitive ($kind) { + 'Bytes' { if ($descriptor.Kind -ceq 'Binary') { $actual = $descriptor.Value } } + 'String' { if ($scalar.Kind -ceq 'Scalar' -and $scalar.Type -ceq 'String') { $actual = $scalar.Value } } + 'Bool' { if ($scalar.Kind -ceq 'Scalar' -and $scalar.Type -ceq 'Boolean') { $actual = $scalar.Value -ceq 'true' } } + { $_ -cin @('Int','Long') } { + if ($scalar.Kind -ceq 'Scalar' -and $scalar.Type -cin @('SByte','Byte','Int16','UInt16','Int32','UInt32','Int64','UInt64','String')) { + $actual = ([int64]::Parse($scalar.Value,$script:PraRawCulture)).ToString($script:PraRawCulture) + if ($kind -ceq 'Int') { $null = [int32]::Parse($actual,$script:PraRawCulture) } + } + } + default { throw "Raw/JSON: unknown restoration kind, attribute=$name." } + } + if ($null -eq $actual -or -not [object]::Equals($actual,$stored)) { throw "Raw/JSON: typed value mismatch, attribute=$name." } + } + $usn = Get-PraRawMember $Record 'CapturedUsnChanged' + if ($null -ne $usn) { + $descriptor = $Snapshot.Attributes['uSNChanged'] + if ($null -eq $descriptor -or $descriptor.Kind -cne 'Scalar' -or $descriptor.Value -cne $usn) { throw 'Raw/JSON: uSNChanged mismatch.' } + } +} + +function Skip-PraLegacyValue { + param([Xml.XmlReader]$Reader) + $null = $Reader.MoveToContent(); $depth = $Reader.Depth + if ($Reader.NodeType -ne [Xml.XmlNodeType]::Element) { throw 'Legacy CLIXML: expected value.' } + $allowed = @('Obj','Ref','TN','TNRef','T','ToString','Props','MS','LST','IE','QUE','STK','DCT','En', + 'Nil','S','C','B','SB','By','I16','U16','I32','U32','I64','U64','Sg','Db','D','DT','TS','G','URI','Version','BA','SS','XD','SBK') + while ($true) { + if ($Reader.Depth -gt 256) { throw 'Legacy CLIXML: XML depth exceeds 256; no graph inflation fallback.' } + if ($Reader.NodeType -eq [Xml.XmlNodeType]::Element) { + if ($Reader.NamespaceURI -cne $script:PraRawNamespace -or $Reader.LocalName -cnotin $allowed) { throw 'Legacy CLIXML: unsupported XML node.' } + if ($Reader.LocalName -ceq 'BA') { + $buffer = [byte[]]::new(4096) + while ($Reader.ReadElementContentAsBase64($buffer,0,$buffer.Length) -gt 0) { } + if ($Reader.Depth -le $depth) { return } + continue + } + if ($Reader.Depth -eq $depth -and $Reader.IsEmptyElement) { $null = $Reader.Read(); return } + } elseif ($Reader.NodeType -eq [Xml.XmlNodeType]::EndElement -and $Reader.Depth -eq $depth) { + $null = $Reader.Read(); return + } + if (-not $Reader.Read()) { throw 'Legacy CLIXML: truncated value.' } + } +} + +function Add-PraRawIdentity { + param([hashtable]$State,[string]$Guid) + $key = ([guid]::Parse($Guid)).ToString('D') + if ($key -ceq [guid]::Empty.ToString('D') -or -not $State.Records.ContainsKey($key) -or -not $State.Seen.Add($key)) { + throw "Raw/JSON: unexpected/duplicate logical user GUID=$key." + } + $State.Guids.Add($key) +} + +function Read-PraLegacyReference { + param([hashtable]$State) + $reader = $State.Reader + Assert-PraRawXmlStart $reader 'Ref' @('RefId','N') + $id = $reader.GetAttribute('RefId') + if ($null -eq $id -or -not $State.Identities.ContainsKey($id)) { + throw 'Legacy CLIXML: identity reference cannot be proven without graph inflation; rejected.' + } + if (-not $reader.IsEmptyElement) { throw 'Legacy CLIXML: nonempty identity reference.' } + $null = $reader.Read() + return $State.Identities[$id] +} + +function Read-PraLegacyObject { + param([hashtable]$State,[bool]$AllowWrapper) + $reader = $State.Reader + Assert-PraRawXmlStart $reader 'Obj' @('RefId','N') + $refId = $reader.GetAttribute('RefId') + if ($null -eq $refId -or $refId -cnotmatch '^(0|[1-9][0-9]*)$' -or $reader.IsEmptyElement) { throw 'Legacy CLIXML: invalid logical object.' } + $reader.ReadStartElement(); $guid = $null; $wrapper = $false; $members = $false + while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { + switch -CaseSensitive ($reader.LocalName) { + { $_ -cin @('TN','TNRef','ToString') } { Skip-PraLegacyValue $reader } + 'LST' { + if (-not $AllowWrapper -or $wrapper -or $members) { throw 'Legacy CLIXML: ambiguous/nested user wrapper.' } + $wrapper = $true; Read-PraRawStart $reader 'LST' + while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { + if ($reader.LocalName -ceq 'Ref') { Add-PraRawIdentity $State (Read-PraLegacyReference $State) } + elseif ($reader.LocalName -ceq 'Obj') { $null = Read-PraLegacyObject $State $false } + else { throw 'Legacy CLIXML: non-object logical user in wrapper.' } + } + Read-PraRawEnd $reader 'LST' + } + { $_ -cin @('Props','MS') } { + if ($wrapper) { throw 'Legacy CLIXML: wrapper also has user properties.' } + $members = $true; $container = $reader.LocalName + Assert-PraRawXmlStart $reader $container + if ($reader.IsEmptyElement) { $reader.ReadStartElement(); continue } + $reader.ReadStartElement() + while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { + $name = ConvertFrom-PraRawString ([string]$reader.GetAttribute('N')) + if ($name -ieq 'ObjectGUID') { + if ($null -ne $guid) { throw 'Legacy CLIXML: duplicate direct ObjectGUID.' } + if ($reader.LocalName -ceq 'G') { + Assert-PraRawXmlStart $reader 'G' @('N') + $guid = ([guid]::Parse($reader.ReadElementContentAsString())).ToString('D') + } elseif ($reader.LocalName -ceq 'Ref') { $guid = Read-PraLegacyReference $State } + else { throw 'Legacy CLIXML: identity is not a direct typed GUID or provable reference; rejected.' } + } else { Skip-PraLegacyValue $reader } + } + Read-PraRawEnd $reader $container + } + default { throw 'Legacy CLIXML: unrecognized logical user/wrapper structure.' } + } + } + Read-PraRawEnd $reader 'Obj' + if (-not $wrapper) { + if ($null -eq $guid) { throw 'Legacy CLIXML: logical user has no direct ObjectGUID; nested ACL GUIDs do not count.' } + if ($State.Identities.ContainsKey($refId)) { throw 'Legacy CLIXML: ambiguous logical RefId.' } + $State.Identities[$refId] = $guid + Add-PraRawIdentity $State $guid + } + return $wrapper +} + +function Test-PraRawCapture { + <# .SYNOPSIS + Streams to EOF, validates the closed codec or legacy logical identities, returns only a receipt. + .DESCRIPTION + ExpectedSnapshots adds lossless creation-time comparison. Records.Attributes is independently + compared to the typed restoration JSON. Legacy never deserializes or inflates a native graph. + #> + [CmdletBinding()] + param([Parameter(Mandatory)]$Context,[Parameter(Mandatory)][string]$LiteralPath, + [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Records, + [Parameter(Mandatory)][AllowEmptyString()][string]$RawFormat, + [AllowEmptyCollection()][object[]]$ExpectedSnapshots) + if ($RawFormat -cnotin @('',$script:PraRawFormat)) { throw "Raw: unsupported format '$RawFormat'." } + if ($Records.Count -eq 0) { throw 'Raw: empty Records.' } + $recordMap = @{}; $expectedMap = @{} + foreach ($record in $Records) { + $key = ([guid]::Parse([string](Get-PraRawMember $record 'ObjectGUID'))).ToString('D') + if ($key -ceq [guid]::Empty.ToString('D') -or $recordMap.ContainsKey($key)) { throw 'Raw: invalid/duplicate JSON GUID.' } + $recordMap[$key] = $record + } + $compare = $PSBoundParameters.ContainsKey('ExpectedSnapshots') + if ($compare) { + if ($RawFormat -ceq '' -or $ExpectedSnapshots.Count -ne $Records.Count) { throw 'Raw: ExpectedSnapshots format/cardinality mismatch.' } + foreach ($snapshot in $ExpectedSnapshots) { + Assert-PraRawSnapshot $snapshot + if ($expectedMap.ContainsKey($snapshot.ObjectGUID) -or -not $recordMap.ContainsKey($snapshot.ObjectGUID)) { throw 'Raw: duplicate/unexpected expected GUID.' } + $expectedMap[$snapshot.ObjectGUID] = $snapshot + } + } + $path = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($LiteralPath) + $stream = [IO.FileStream]::new($path,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::Read,65536) + $reader = $null + try { + $settings = [Xml.XmlReaderSettings]::new(); $settings.DtdProcessing = [Xml.DtdProcessing]::Prohibit + $settings.XmlResolver = $null; $settings.CloseInput = $false; $settings.IgnoreWhitespace = $false + $settings.CheckCharacters = $true; $settings.ConformanceLevel = [Xml.ConformanceLevel]::Document + $reader = [Xml.XmlReader]::Create($stream,$settings) + Assert-PraRawXmlStart $reader 'Objs' @('Version') + if ($reader.GetAttribute('Version') -cne '1.1.0.1' -or $reader.IsEmptyElement) { throw 'Raw: invalid/empty CLIXML root.' } + $reader.ReadStartElement() + $state = @{Reader=$reader; RefId=[int64]0; Records=$recordMap; Guids=[Collections.Generic.List[string]]::new(); + Seen=[Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal); Identities=@{}} + $wrapper = $false; $topCount = 0 + while ($reader.MoveToContent() -eq [Xml.XmlNodeType]::Element) { + if ($RawFormat -ceq $script:PraRawFormat) { + $snapshot = Read-PraRawSnapshot $state + Add-PraRawIdentity $state $snapshot.ObjectGUID + Assert-PraRawRecord $snapshot $recordMap[$snapshot.ObjectGUID] + if ($compare) { Assert-PraRawExpected $snapshot $expectedMap[$snapshot.ObjectGUID] } + Write-PraRawProgress $Context $snapshot $stream.Position 'READ VERIFIED' + $snapshot = $null + } else { + if ($wrapper) { throw 'Legacy CLIXML: wrapper mixed with root sequence.' } + if ($reader.LocalName -ceq 'Ref') { Add-PraRawIdentity $state (Read-PraLegacyReference $state) } + else { $wrapper = Read-PraLegacyObject $state ($topCount -eq 0) } + $topCount++ + } + } + Read-PraRawEnd $reader 'Objs' + # Reading past the root is essential: reject a truncated/malformed trailing document. + $null = $reader.MoveToContent() + if (-not $reader.EOF) { throw 'Raw: trailing XML content.' } + if ($state.Guids.Count -ne $Records.Count) { throw 'Raw/JSON: logical user count mismatch.' } + return [pscustomobject]@{Count=$state.Guids.Count; ObjectGuids=[string[]]$state.Guids.ToArray(); + Format=$RawFormat; Bytes=[int64]$stream.Length} + } finally { + try { if ($null -ne $reader) { $reader.Dispose() } } finally { $stream.Dispose() } + } +} + +Export-ModuleMember -Function ConvertTo-PraRawSnapshot,Write-PraRawCapture,Test-PraRawCapture + +# SIG # Begin signature block +# MIIghgYJKoZIhvcNAQcCoIIgdzCCIHMCAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBg1436t7I8BK3A +# vBE8oE2z5dhzZURSP3+b7zd6V08y2aCCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISbTCCEmkCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCDn8w1u79fq +# RgZi1oiwfplz2kor7AtDtBHZ2zP3pbER/zANBgkqhkiG9w0BAQEFAASCAgBgwv89 +# GD4VCS8ngAMZOlOkYtovjrsYhITiZFYpYUpfnII2o2yzpP5ZPUpJxavDko/mOkLP +# iwJG1NpmjZO7kTZCfmB1XHIjXupebHPV83ZPoL4O8CW6Zres5Sy9XwsQ56KQgiyl +# 5v8sCtLuCTyXYW5sTguorRIB1JsYR9S4gqrXNnls4W+WF+lj77PB7YNUZN81BPky +# FoSbDSdjGF+nQaDOviHHKLBb79Eul3Yjbsh85NMxvTlfy1BWpYJlZKsVd9A03gNW +# XULGy1WwxFlCNA8+kx0LgJygayqL8m1lhmZgK/kaVpT0nGPw3MbyqLJG9kfnl8RR +# 2mxdZ/uRS2CvuHAdKXiPw8/GbRXcC+G3sbQCTLPRoXs6C2C0N8jQvIPN/J56ltt2 +# Id/QTrcGFCP+XMon0OT1YlxwcJAA3ajplZv8IOT/BNKq5y/fpPSGGAVgV10dHdFU +# btQIHQI4xHpFzKSX9jchQbPo+H0mBdy02rKNyvlMSyGaZymRrguNpfaEv8rcAD38 +# VL/TgVY085eNayM5/cEWrrW5X8nCGn3aWavkQE5QGSQ8A/CT3X+kH9tJ/i1exPRq +# /fIOhzpPABFLe3IsuZTz6YaZetIpenhJ42nzVEX8hhBpUv9yGF7zi5KRYdIoucXx +# MiQlxVSap0m6POUjADCTj+tpQVhc1xk3yH4HC6GCDyowgg8mBgorBgEEAYI3AwMB +# MYIPFjCCDxIGCSqGSIb3DQEHAqCCDwMwgg7/AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEIES79wxrMjSBsHfQ/Y9w9eP+GSDg0LfGcDTzl+p7I7PBAggfOMFh4A1M +# VxgPMjAyNjEwMTUyMTIzMDZaMAMCAQECEAcp0UEVAQcEdy9EUxkP4HSgggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# WTCCAlUCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMjMwNlowKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEIASkEtuiPSNp +# S1AAsyiPgJftMQq3TruDMaxlM7le+xbxMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEgwRgIhAO0b3IeoiG2PfDI5ICIV+rQ2N318gQVC6y1kUL9GY4iAAiEA04f2VzCx +# URKtCd9/ddG7j7YEeEmyQJBWD+xvw2XO9Zw= +# SIG # End signature block diff --git a/module/PRA.Cloud.psm1 b/package/module/PRA.Cloud.psm1 similarity index 84% rename from module/PRA.Cloud.psm1 rename to package/module/PRA.Cloud.psm1 index 2ebf31e..291cb03 100644 --- a/module/PRA.Cloud.psm1 +++ b/package/module/PRA.Cloud.psm1 @@ -1,1014 +1,1211 @@ -<# -.SYNOPSIS - PRA Remote Mailbox - Exchange Online and Microsoft Graph adapter (no AD read or write). - -.DESCRIPTION - Public functions (no pipeline output; result rows are updated in place; an error sets the row to - Error and records a run error, or throws): - - Initialize-PraCloudPreflight Convert, Apply, phase Both: sign-in, targets and trustees resolved - in Exchange Online BEFORE the AD part (read only) - Invoke-PraCloudPhase checks (and waits for) the expected cloud state of every row and, in - Apply, grants the shared mailbox permissions - Invoke-PraRetentionCheck Check -Expect Retained: retention policy holds (read only) - Close-PraCloudSession signs out the sessions opened by this module (idempotent) - - Expected cloud states: - Convert user: mailbox provisioned (Exchange Online type, or Graph provisioning) and a licence - with Exchange enabled; shared: SharedMailbox, then every FullAccess, SendAs and - SendOnBehalf permission present. - Recover mailbox gone and recipient back to MailUser (DeprovisionConfirmed = true); licence - removed unless the user was already in the licence group. KeepCloudShared: the shared - mailbox must still exist (never a deprovisioning confirmation). - DeprovisionConfirmed becomes true ONLY after these checks; the entry script requires it before any - final restore. A cloud error is never taken as "absent". - - Writes (Convert, Apply, phase Cloud or Both): each permission grant needs the operator approval, - a fresh check of the AD proof, a journal line "Started", ONE Add call, a journal line "Applied", - bounded re-reads (Exo.GrantVerifyAttempts x Exo.GrantVerifyDelaySeconds) and a line "Verified". - A grant is never retried. - - Sessions: Microsoft Graph is connected before Exchange Online (assembly conflicts in Windows - PowerShell 5.1); an Exchange Online or Graph session that already exists in the console is refused; - tenant, token, connection ID and module path are checked before each call. Exo.UseSubprocess (or - an ExchangeOnlineManagement older than Exo.MinModuleVersion) runs every Exchange Online call in a - child Windows PowerShell (certificate sign-in only). - -.NOTES - Author : Nicolas Fabert - Version : 2.1.0 -#> -#Requires -Version 5.1 -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' - -# Fixed worker body, also run in the child process: no code or cmdlet name ever comes from data. -$script:PraExoWorker = { - param([ValidateSet('Probe','Preflight','Mailbox','Recipient','Hold','Permission','Grant')][string]$Operation,$P,$Permit,$SessionBinding,$OnApplied) - Set-StrictMode -Version Latest - $ErrorActionPreference = 'Stop' - function V { - param($Object,[string]$Name,$Default=$null) - if ($null -ne $Object) { - if ($Object -is [System.Collections.IDictionary]) { - if ($Object.Contains($Name)) { return ,($Object[$Name]) } - } elseif ($null -ne $Object.PSObject.Properties[$Name]) { return ,($Object.PSObject.Properties[$Name].Value) } - } - return ,$Default - } - function Session { - param([string]$Right='') - $tenant=[string](V $SessionBinding 'TenantId' (V $P 'TenantId' '')) - $parsed=[guid]::Empty - if (-not [guid]::TryParse($tenant,[ref]$parsed) -or $parsed -eq [guid]::Empty) { throw 'Expected Exchange Online tenant missing or invalid (Cloud.TenantId).' } - $organization=[string](V $SessionBinding 'Organization' (V $P 'Organization' '')) - $appId=[string](V $SessionBinding 'AppId' (V $P 'AppId' '')) - $connections=@(Get-ConnectionInformation -ErrorAction Stop) - if ($connections.Count -ne 1) { throw 'Exactly one Exchange Online connection is expected in this process.' } - $c=$connections[0]; $location=[string](V $c 'ModuleName' ''); $id=[string](V $c 'ConnectionId' '') - # Interactive sign-in reports the tenant GUID; certificate (app-only) sign-in reports the - # organisation domain (tenant.onmicrosoft.com) and the AppId: both are accepted, nothing else. - $sessionTenant=[string](V $c 'TenantID' '') - $tenantOk=($sessionTenant -eq $tenant) -or ($organization -and $sessionTenant -eq $organization) - if ($appId -and [string](V $c 'AppId' '') -ne $appId) { $tenantOk=$false } - if (-not $tenantOk -or [string](V $c 'State' '') -ne 'Connected' -or - [string](V $c 'TokenStatus' '') -ne 'Active' -or -not $id -or -not [IO.Path]::IsPathRooted($location)) { - throw ("Exchange Online session: wrong tenant ({0}), state, token, connection ID or module path." -f $sessionTenant) - } - $modules=@(Get-Module | Where-Object { $_.ModuleBase -eq $location -or $_.Path -eq $location }) - if ($modules.Count -ne 1 -or -not $modules[0].Path) { throw 'Module of the Exchange Online session not found or ambiguous.' } - if ($null -ne $SessionBinding -and (V $SessionBinding 'ConnectionId' '')) { - if ($id -ne (V $SessionBinding 'ConnectionId') -or $location -ne (V $SessionBinding 'ModuleLocation') -or - $modules[0].Path -ne (V $SessionBinding 'ModulePath')) { throw 'The Exchange Online session changed.' } - } - $command=$null - if ($Right) { - $name=switch ($Right) { 'FullAccess' { 'Add-MailboxPermission' }; 'SendAs' { 'Add-RecipientPermission' }; 'SendOnBehalf' { 'Set-Mailbox' }; default { throw 'Unknown permission.' } } - $commands=@(Get-Command -Name $name -Module $modules[0].Name -All -ErrorAction Stop) - if ($commands.Count -ne 1 -or $null -eq $commands[0].Module -or $commands[0].Module.Path -ne $modules[0].Path) { - throw "Command $name is not from the module of the Exchange Online session." - } - $command=$commands[0] - } - return @{ TenantId=$tenant; Organization=$organization; AppId=$appId; ConnectionId=$id; ModuleLocation=$location; ModulePath=$modules[0].Path; Command=$command } - } - function ExactFilter { - param([string]$Upn) - if ([string]::IsNullOrWhiteSpace($Upn) -or $Upn -match '[\r\n\x00]') { throw 'Empty or invalid UPN.' } - return "UserPrincipalName -eq '$($Upn.Replace("'","''"))'" - } - function MissingRecipient { - param([System.Management.Automation.ErrorRecord]$Record,[string]$Upn) - # A selector read (-UserPrincipalName) answers an absent object with HTTP 404 ManagementObjectNotFoundException - # instead of an empty result (seen in the lab while a deprovisioned mailbox turns into a MailUser). - $text=$Record.Exception.Message - if ($text -notmatch 'HttpStatusCode=404') { return $false } - $json=[regex]::Match($text,'(?s)\{\s*"error"\s*:\s*\{.*\}\s*\}') - if (-not $json.Success) { return $false } - try { - $payload=$json.Value | ConvertFrom-Json -ErrorAction Stop - $object="object '"+[WildcardPattern]::Escape($Upn)+"' couldn't be found" - $detail=@($payload.error.details | Where-Object { [string]$_.message -like '*|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|*' }) - return ($payload.error.code -ceq 'NotFound' -and [string]$payload.error.message -like "*$object*" -and $detail.Count -gt 0 -and [string]$detail[0].message -like "*$object*") - } catch { return $false } - } - function Recipient { - param([string]$Upn) - if ([string]::IsNullOrWhiteSpace($Upn) -or $Upn -match '[\r\n\x00]') { throw 'Empty or invalid UPN.' } - # Recipient exposes a dedicated UPN selector, not a UserPrincipalName output/filter property. - # "Not found" is read through -ErrorVariable (no transcript error line); any other error stops. - $recipientErrors=$null - try { $items = @(Get-EXORecipient -UserPrincipalName $Upn -Properties RecipientTypeDetails,PrimarySmtpAddress,ExternalDirectoryObjectId,Guid,DistinguishedName -ResultSize Unlimited -ErrorAction SilentlyContinue -ErrorVariable recipientErrors -WarningAction Stop) } - catch { if (-not (MissingRecipient $_ $Upn)) { throw }; $items=@(); $recipientErrors=@($_) } - $recipientErrors=@($recipientErrors | Where-Object { $null -ne $_ }) - if ($recipientErrors.Count) { - foreach ($record in $recipientErrors) { - if ($record -isnot [System.Management.Automation.ErrorRecord] -or -not (MissingRecipient $record $Upn)) { throw $record } - } - if ($items.Count) { throw "Exchange Online returned a recipient and 'not found' for: $Upn" } - return @{ Found=$false; Type=$null; Keys=@() } - } - if ($items.Count -gt 1) { throw "Exchange Online recipient not unique: $Upn" } - if ($items.Count -eq 0) { return @{ Found=$false; Type=$null; Keys=@() } } - $type = [string](V $items[0] 'RecipientTypeDetails') - if (-not $type) { throw "Recipient type not returned: $Upn" } - $oid=[string](V $items[0] 'ExternalDirectoryObjectId' ''); $smtp=[string](V $items[0] 'PrimarySmtpAddress' '') - $parsed=[guid]::Empty - if (-not [guid]::TryParse($oid,[ref]$parsed) -or $parsed -eq [guid]::Empty -or [string]::IsNullOrWhiteSpace($smtp)) { throw "Recipient identity incomplete: $Upn" } - $expected=V (V $P 'ExpectedIdentities' @{}) $Upn - if ($null -ne $expected -and ($oid -ne (V $expected 'ObjectId') -or $smtp -ne (V $expected 'PrimarySmtpAddress'))) { throw "Recipient identity changed since the pre-check: $Upn" } - $keys = @($Upn) + @(foreach ($key in @('UserPrincipalName','PrimarySmtpAddress','ExternalDirectoryObjectId','Guid','DistinguishedName','Identity','Alias','Name','DisplayName','Sid','SamAccountName')) { - $val = [string](V $items[0] $key); if (-not [string]::IsNullOrWhiteSpace($val)) { $val } - }) - return @{ Found=$true; Type=$type; Keys=@($keys | Select-Object -Unique); ObjectId=$oid; PrimarySmtpAddress=$smtp } - } - function Mailbox { - param([string]$Upn,[switch]$Hold) - $grantParameters = @{ Filter=(ExactFilter $Upn); Properties=@('RecipientTypeDetails'); ResultSize='Unlimited' } - if ($Hold) { $grantParameters.Properties += @('IsInactiveMailbox','InPlaceHolds','LitigationHoldEnabled','RetentionHoldEnabled') } - $items = @(Get-EXOMailbox @grantParameters -ErrorAction Stop) - if ($Hold -and $items.Count -eq 0) { $items = @(Get-EXOMailbox @grantParameters -InactiveMailboxOnly -ErrorAction Stop) } - if ($items.Count -gt 1) { throw "Exchange Online mailbox not unique: $Upn" } - if ($items.Count -eq 0) { return @{ Found=$false; Type=$null; Holds=@(); IsInactive=$false; Litigation=$false; RetentionHold=$false } } - $m = $items[0]; $type = [string](V $m 'RecipientTypeDetails') - if (-not $type) { throw "Mailbox type not returned: $Upn" } - $holds = V -Object $m -Name 'InPlaceHolds' -Default @() - return @{ Found=$true; Type=$type; Holds=@($holds | Where-Object { $null -ne $_ }); IsInactive=[bool](V -Object $m -Name 'IsInactiveMailbox' -Default $false) - Litigation=[bool](V -Object $m -Name 'LitigationHoldEnabled' -Default $false); RetentionHold=[bool](V -Object $m -Name 'RetentionHoldEnabled' -Default $false) } - } - function NormalizeAcl { - param([object[]]$Entries,[string]$Right,$Target) - $field=if ($Right -eq 'FullAccess') { 'User' } else { 'Trustee' } - foreach ($entry in $Entries) { - foreach ($key in @('Identity',$field,'AccessRights','IsInherited')) { - if ($null -eq (V $entry $key)) { throw "$Right permission entry: field $key missing or null" } - } - $identity=[string](V $entry 'Identity'); $principal=[string](V $entry $field) - $inherited=V $entry 'IsInherited'; $rawRights=V $entry 'AccessRights'; $rawRights=@($rawRights) - if ($identity -notin $Target.Keys -or [string]::IsNullOrWhiteSpace($principal) -or $inherited -isnot [bool] -or $rawRights.Count -eq 0) { throw "Unexpected $Right permission entry (format or identity)." } - $rights=@(foreach ($access in $rawRights) { - if (($access -isnot [string] -and $access -isnot [enum]) -or [string]::IsNullOrWhiteSpace([string]$access)) { throw "Invalid $Right access right type." } - [string]$access - }) - if ($Right -eq 'FullAccess') { - $deny=V $entry 'Deny' - if ($deny -is [System.Management.Automation.SwitchParameter]) { $deny=$deny.IsPresent } - if ($deny -isnot [bool]) { throw 'Invalid FullAccess Deny value.' } - $control=if ($deny) { 'Deny' } else { 'Allow' } - } else { - $rawControl=V $entry 'AccessControlType' - if ($rawControl -isnot [string] -and $rawControl -isnot [enum]) { throw 'Invalid AccessControlType type.' } - $control=[string]$rawControl - if ($control -notin @('Allow','Deny')) { throw 'Invalid AccessControlType value.' } - } - if ($control -eq 'Deny' -and $Right -in $rights) { throw "A $Right Deny entry exists: grant refused." } - [pscustomobject]@{ Identity=$identity; Principal=$principal; Rights=$rights; Control=$control; Inherited=$inherited } - } - } - function AclKey { - param($Entry) - return ($Entry.Principal+'|'+$Entry.Control+'|'+$Entry.Inherited+'|'+(($Entry.Rights | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object) -join ',')).ToLowerInvariant() - } - function MissingFullAccess { - param([System.Management.Automation.ErrorRecord]$Record,[string]$Trustee) - $json=[regex]::Match($Record.Exception.Message,'(?s)\{\s*"error"\s*:\s*\{.*\}\s*\}') - if (-not $json.Success) { return $false } - try { - $payload=$json.Value | ConvertFrom-Json -ErrorAction Stop - $expected='No permissions were found for the user:'+$Trustee - return ($payload.error.code -ceq 'NotFound' -and $payload.error.message -ceq $expected -and - $payload.error.innererror.message -ceq $expected -and $payload.error.innererror.type -ceq 'Microsoft.Exchange.Admin.OData.Core.ODataServiceException') - } catch { return $false } - } - function Permission { - param([string]$Upn,[string]$Trustee,[string]$Right,$Recipient,$Target,[switch]$AllowPendingVisibility) - if ($Right -in @('FullAccess','SendAs')) { - $globalRaw=@(if ($Right -eq 'FullAccess') { Get-EXOMailboxPermission -Identity $Upn -ErrorAction Stop -WarningAction Stop } - else { Get-EXORecipientPermission -Identity $Upn -ErrorAction Stop -WarningAction Stop }) - if ($globalRaw.Count -eq 0 -or $globalRaw.Count -ge 1000) { throw "$Right permission list empty or possibly truncated." } - $globalEntries=@(NormalizeAcl $globalRaw $Right $Target) - if (-not @($globalEntries | Where-Object { $_.Principal -in @('NT AUTHORITY\SELF','S-1-5-10') -and $Right -in $_.Rights -and -not $_.Inherited }).Count) { throw "$Right permission list without the expected SELF entry." } - $expectedEntries=@($globalEntries | Where-Object { $Right -in $_.Rights -and $_.Principal -in $Recipient.Keys }) - # "No permissions were found" is the normal answer before a grant. It is read through -ErrorVariable, - # not -ErrorAction Stop, so that Windows PowerShell does not write it as an error in the transcript. - # Every error record is still checked: anything else than that exact answer stops, as before. - $filteredErrors=$null - $filteredRaw=@(if ($Right -eq 'FullAccess') { Get-EXOMailboxPermission -Identity $Upn -User $Trustee -ErrorAction SilentlyContinue -ErrorVariable filteredErrors -WarningAction Stop } - else { Get-EXORecipientPermission -Identity $Upn -Trustee $Trustee -ErrorAction Stop -WarningAction Stop }) - $filteredErrors=@($filteredErrors | Where-Object { $null -ne $_ }) - if ($filteredErrors.Count) { - foreach ($record in $filteredErrors) { - if ($record -isnot [System.Management.Automation.ErrorRecord] -or -not (MissingFullAccess $record $Trustee)) { throw $record } - } - if ($expectedEntries.Count -gt 0) { if ($AllowPendingVisibility) { return $false }; throw $filteredErrors[0] } - $filteredRaw=@() - } - $entries=@(NormalizeAcl $filteredRaw $Right $Target) - foreach ($entry in $entries) { if ($entry.Principal -notin $Recipient.Keys) { throw "Filtered $Right read inconsistent for $Trustee." } } - $actualEntries=@($entries | Where-Object { $Right -in $_.Rights }) - $expected=@($expectedEntries | ForEach-Object { AclKey $_ } | Sort-Object) - $actual=@($actualEntries | ForEach-Object { AclKey $_ } | Sort-Object) - if (($expected | ConvertTo-Json -Compress) -cne ($actual | ConvertTo-Json -Compress)) { - if ($AllowPendingVisibility -and (($expected.Count -eq 0) -xor ($actual.Count -eq 0))) { return $false } - throw "Full and filtered $Right reads disagree for $Trustee." - } - return (@($actualEntries | Where-Object { -not $_.Inherited -and $_.Control -eq 'Allow' }).Count -gt 0) - } - $mb = @(Get-Mailbox -Filter (ExactFilter $Upn) -ResultSize Unlimited -ErrorAction Stop) - if ($mb.Count -ne 1) { throw "Mailbox not unique for the SendOnBehalf read: $Upn" } - $delegates=V -Object $mb[0] -Name 'GrantSendOnBehalfTo' -Default @() - foreach ($delegate in $delegates) { - if ($null -eq $delegate) { continue } - $ids = @([string]$delegate, [string](V $delegate 'DistinguishedName'), [string](V $delegate 'ObjectGuid')) - if (@($ids | Where-Object { $_ -and $_ -in $Recipient.Keys }).Count) { return $true } - # Exchange Online can return an ADObjectId as a Name: exact resolution, an ambiguity stops. - $name = ([string]$delegate).Replace("'","''") - $resolved = @(Get-EXORecipient -Filter "Name -eq '$name'" -Properties Guid,DistinguishedName,ExternalDirectoryObjectId -ResultSize Unlimited -ErrorAction Stop) - if ($resolved.Count -gt 1) { throw "SendOnBehalf delegate not unique: $delegate" } - foreach ($r in $resolved) { - foreach ($key in @('Guid','DistinguishedName','ExternalDirectoryObjectId')) { - $id = [string](V $r $key); if ($id -and $id -in $Recipient.Keys) { return $true } - } - } - } - return $false - } - $binding=Session - if ($Operation -eq 'Probe') { [void]$binding.Remove('Command'); return @{ Connected=$true; Binding=$binding } } - $SessionBinding=$binding - $upn = [string](V $P 'Upn') - if ($Operation -eq 'Preflight') { - $target=Recipient $upn - if (-not $target.Found) { throw "Target not found in Exchange Online at the pre-check: $upn" } - $identities=@{}; $identities[$upn]=$target - $requests=V $P 'Requests' @() - foreach ($request in @($requests)) { - $trustee=[string](V $request 'Trustee'); $right=[string](V $request 'Right') - $null=Session $right - $resolved=Recipient $trustee - if (-not $resolved.Found) { throw "Trustee not found in Exchange Online at the pre-check: $trustee" } - if ($resolved.ObjectId -eq $target.ObjectId) { throw 'A mailbox cannot be delegated to itself.' } - $identities[$trustee]=$resolved - } - return @{ Found=$true; Type=$target.Type; Identities=$identities } - } - switch ($Operation) { - 'Mailbox' { return (Mailbox $upn) } - 'Recipient' { return (Recipient $upn) } - 'Hold' { return (Mailbox $upn -Hold) } - } - $trustee = [string](V $P 'Trustee'); $right = [string](V $P 'Right') - if ($right -notin @('FullAccess','SendAs','SendOnBehalf')) { throw 'Unknown permission.' } - if ($Operation -eq 'Grant') { - foreach ($flag in @('AllowMutation','Approved','Authorized','JournalStarted')) { - $b = V -Object $Permit -Name $flag -Default $false - if ($b -isnot [bool] -or -not $b) { throw 'Exchange Online grant without its individual authorisation.' } - } - if ((V $Permit 'Target') -cne $upn -or (V $Permit 'Trustee') -cne $trustee -or (V $Permit 'Right') -cne $right -or - (V $Permit 'Action') -ne 'Convert' -or (V $Permit 'Mode') -ne 'Apply' -or (V $Permit 'Phase') -notin @('Cloud','Both')) { throw 'Exchange Online authorisation does not match this grant.' } - if ((Mailbox $upn).Type -ne 'SharedMailbox') { throw 'Grant refused: SharedMailbox not confirmed.' } - } - $rcpt = Recipient $trustee - if (-not $rcpt.Found) { - if ($Operation -eq 'Grant') { throw "Trustee no longer in Exchange Online: $trustee" } - return @{ TrusteeFound=$false; Verified=$false; Mutated=$false } - } - $target=Recipient $upn - if (-not $target.Found) { throw "Target not found in Exchange Online: $upn" } - if ($Operation -eq 'Grant' -and $target.Type -ne 'SharedMailbox') { throw 'Grant refused: SharedMailbox recipient not confirmed.' } - if ($target.ObjectId -eq $rcpt.ObjectId) { throw 'A mailbox cannot be delegated to itself.' } - $ok = Permission -Upn $upn -Trustee $trustee -Right $right -Recipient $rcpt -Target $target - if ($Operation -eq 'Permission' -or $ok) { return @{ TrusteeFound=$true; Verified=[bool]$ok; Mutated=$false } } - $attempts=V $P 'GrantVerifyAttempts' 13; $delay=V $P 'GrantVerifyDelaySeconds' 10 - if (($attempts -isnot [int] -and $attempts -isnot [long]) -or $attempts -lt 1 -or $attempts -gt 60 -or - ($delay -isnot [int] -and $delay -isnot [long]) -or $delay -lt 1 -or $delay -gt 30) { throw 'Invalid Exchange Online verification cadence (1..60 reads, 1..30 seconds).' } - if ($OnApplied -isnot [scriptblock]) { throw 'The Applied journal callback is required before an Exchange Online grant.' } - $write=Session $right - switch ($right) { - 'FullAccess' { & $write.Command -Identity $upn -User $trustee -AccessRights FullAccess -AutoMapping:([bool](V -Object $P -Name 'AutoMapping' -Default $false)) -InheritanceType All -Confirm:$false -ErrorAction Stop | Out-Null } - 'SendAs' { & $write.Command -Identity $upn -Trustee $trustee -AccessRights SendAs -Confirm:$false -ErrorAction Stop | Out-Null } - 'SendOnBehalf' { & $write.Command -Identity $upn -GrantSendOnBehalfTo @{ Add=$trustee } -Confirm:$false -ErrorAction Stop | Out-Null } - } - # Add returned. Persist this fact before any eventual-consistency read, never repeat Add. - try { - $null=& $OnApplied - for ($attempt=1; $attempt -le $attempts; $attempt++) { - $null=Session - $currentTarget=Recipient $upn; $currentTrustee=Recipient $trustee - foreach ($pair in @(@($target,$currentTarget),@($rcpt,$currentTrustee))) { - if (-not $pair[1].Found -or $pair[0].ObjectId -ne $pair[1].ObjectId -or $pair[0].PrimarySmtpAddress -ne $pair[1].PrimarySmtpAddress -or $pair[0].Type -ne $pair[1].Type) { throw 'Exchange Online identity changed during the verification.' } - } - if ((Mailbox $upn).Type -ne 'SharedMailbox') { throw 'SharedMailbox lost during the verification.' } - if (Permission -Upn $upn -Trustee $trustee -Right $right -Recipient $currentTrustee -Target $currentTarget -AllowPendingVisibility) { - return @{ TrusteeFound=$true; Verified=$true; Mutated=$true; Error='' } - } - if ($attempt -lt $attempts) { Start-Sleep -Seconds $delay } - } - throw "$right added but not verified after $attempts reads: $upn / $trustee" - } catch { return @{ TrusteeFound=$true; Verified=$false; Mutated=$true; Error=('Add returned, verification failed: '+$_.Exception.Message) } } -} - -function Get-PraCloudSession { - param([hashtable]$Context) - if (-not $Context.ContainsKey('_PraCloudSession')) { - $Context['_PraCloudSession'] = @{ GraphAttempted=$false; ExoAttempted=$false; Graph=$false; Exo=$false; Subprocess=$false - Binding=$null; OwnedExoIds=@(); GraphContext=$null; Identities=@{}; Preflight=$false } - } - return $Context['_PraCloudSession'] -} - -function Write-PraCloudError { - param([hashtable]$Context,$Row,[string]$Message) - if ($null -ne $Row) { - $Row.CloudStatus='Error'; $Row.FinalStatus='Error'; $Row.CloudDetail=$Message - if ($null -ne $Row.PSObject.Properties['DeprovisionConfirmed']) { $Row.DeprovisionConfirmed=$false } - $Row.Detail = ([string](Get-PraValue $Row 'Detail' '') + ' | cloud: ' + $Message).Trim(' ','|') - $Context.CurrentIdentity=[string](Get-PraValue $Row 'ObjectGuid' (Get-PraValue $Row 'UserPrincipalName' '')) - } - # Recorded here, whatever the logger does with Issues. - [void]$Context.Issues.Add([pscustomobject]@{ Timestamp=(Get-Date).ToString('o'); Phase=$Context.CurrentPhase - Source='Cloud'; Operation=$Context.CurrentOperation; Identity=$Context.CurrentIdentity; Message=$Message }) - $null = Write-PraLog -Context $Context -Message $Message -Level Warning -} - -function Invoke-PraExoSubprocess { - param([hashtable]$Context,[string]$Operation,[hashtable]$Params,$Permit,$OnApplied) - $cloud = Get-PraValue $Context.Config 'Cloud' @{} - $id = [guid]::NewGuid().ToString('N') - $appliedPath=Join-Path ([IO.Path]::GetTempPath()) ('praexo_'+$id+'.applied.json') - $request = @{ Protocol=1; Id=$id; Operation=$Operation; Params=$Params; Permit=$Permit; AppliedPath=$appliedPath - TenantId=(Get-PraValue $cloud 'TenantId' ''); DisableWAM=(Get-PraValue (Get-PraValue $Context.Config 'Exo' @{}) 'DisableWAM' $false) - AppId=(Get-PraValue $cloud 'AppId' ''); Thumb=(Get-PraValue $cloud 'CertificateThumbprint' ''); Org=(Get-PraValue $cloud 'Organization' '') } - $b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(($request | ConvertTo-Json -Depth 12 -Compress))) - $child = @' -$ErrorActionPreference='Stop' -Set-StrictMode -Version Latest -[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false) -$ProgressPreference='SilentlyContinue' -$cfg=$null; $data=$null; $failure=''; $attempted=$false; $ownedIds=@() -try { - $cfg = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('__REQUEST__')) | ConvertFrom-Json -ErrorAction Stop - if ($cfg.Protocol -ne 1 -or $cfg.Id -notmatch '^[a-f0-9]{32}$') { throw 'Invalid Exchange Online request.' } - Import-Module ExchangeOnlineManagement -ErrorAction Stop - if (@(Get-ConnectionInformation -ErrorAction Stop).Count) { throw 'The Exchange Online child process is not clean.' } - $connect=@{ AppId=$cfg.AppId; CertificateThumbprint=$cfg.Thumb; Organization=$cfg.Org; ShowBanner=$false; ErrorAction='Stop' } - if ($cfg.DisableWAM) { - if (-not (Get-Command Connect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('DisableWAM')) { throw 'DisableWAM is not supported by this ExchangeOnlineManagement.' } - $connect.DisableWAM=$true - } - $attempted=$true - try { Connect-ExchangeOnline @connect | Out-Null } - finally { $ownedIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) } - $worker = { -__WORKER__ - } - $probe=& $worker 'Probe' @{ TenantId=$cfg.TenantId; Organization=$cfg.Org; AppId=$cfg.AppId } $null $null $null - $onApplied={ - $text=@{ Protocol=1; Id=$cfg.Id; Status='Applied'; Target=$cfg.Params.Upn; Trustee=$cfg.Params.Trustee; Right=$cfg.Params.Right } | ConvertTo-Json -Compress - $stream=New-Object IO.FileStream($cfg.AppliedPath,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None) - try { $bytes=[Text.Encoding]::UTF8.GetBytes($text); $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() } - } - $results = @(& $worker $cfg.Operation $cfg.Params $cfg.Permit $probe.Binding $onApplied) - if ($results.Count -ne 1) { throw 'Exchange Online result not unique.' } - $data=$results[0] -} catch { $failure=$_.Exception.Message } -finally { - if ($attempted) { - try { - foreach ($ownedId in $ownedIds) { - if (-not $ownedId) { throw 'Own connection ID missing: a global sign-out is not allowed.' } - Disconnect-ExchangeOnline -ConnectionId $ownedId -Confirm:$false -ErrorAction Stop 6>$null | Out-Null - } - } - catch { $failure += ' | Exchange Online sign-out: ' + $_.Exception.Message } - } -} -$correlation = if ($null -ne $cfg) { $cfg.Id } else { '' } -[Console]::Out.WriteLine(([ordered]@{ Protocol=1; Id=$correlation; Ok=($failure -eq ''); Data=$data; Error=$failure } | ConvertTo-Json -Depth 12 -Compress)) -if ($failure) { exit 1 }; exit 0 -'@ - $child = $child.Replace('__REQUEST__',$b64).Replace('__WORKER__',$script:PraExoWorker.ToString()) - $tmp = Join-Path ([IO.Path]::GetTempPath()) ('praexo_'+$id+'.ps1') - $process = $null; $started=$false - try { - [IO.File]::WriteAllText($tmp,$child,(New-Object Text.UTF8Encoding($true))) - $exe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe' - $si = New-Object Diagnostics.ProcessStartInfo - $si.FileName=$exe; $si.Arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "'+$tmp+'"' - $si.UseShellExecute=$false; $si.CreateNoWindow=$true; $si.RedirectStandardOutput=$true; $si.RedirectStandardError=$true - $si.StandardOutputEncoding=New-Object Text.UTF8Encoding($false); $si.StandardErrorEncoding=New-Object Text.UTF8Encoding($false) - $process = New-Object Diagnostics.Process; $process.StartInfo=$si - $started=$process.Start() - if (-not $started) { throw 'The Exchange Online child process cannot start.' } - $stdout = $process.StandardOutput.ReadToEndAsync(); $stderr = $process.StandardError.ReadToEndAsync() - $wait = [int][Math]::Min(2147483647,([Math]::Max(1,[int]$Context.TimeoutMinutes)*60000.0)) - $timedOut = -not $process.WaitForExit($wait) - if ($timedOut) { $process.Kill(); $process.WaitForExit() } - $out = $stdout.GetAwaiter().GetResult().Trim(); $err = $stderr.GetAwaiter().GetResult().Trim() - if ($timedOut) { throw "Exchange Online timeout; write state unknown. stderr=[$err], stdout=[$out]" } - if ($process.ExitCode -ne 0 -or $err) { throw "Exchange Online child process code=$($process.ExitCode), stderr=[$err], stdout=[$out]" } - if (-not $out.StartsWith('{') -or -not $out.EndsWith('}') -or $out -match '[\r\n]') { throw 'Exchange Online child output is not the expected one-line JSON.' } - $res = $out | ConvertFrom-Json -ErrorAction Stop - if (@($res.PSObject.Properties.Name).Count -ne 5 -or (Get-PraValue $res 'Protocol' 0) -ne 1 -or - (Get-PraValue $res 'Id' '') -cne $id -or (Get-PraValue $res 'Ok' $false) -isnot [bool] -or - (Get-PraValue $res 'Ok' $false) -ne $true -or (Get-PraValue $res 'Error' 'invalid') -ne '') { throw 'Exchange Online child result invalid or failed.' } - $data = Get-PraValue $res 'Data' $null - if ($null -eq $data) { throw 'Exchange Online result missing.' } - return $data - } finally { - try { - if ($null -ne $process) { - try { if ($started -and -not $process.HasExited) { $process.Kill(); $process.WaitForExit() } } - finally { $process.Dispose() } - } - } finally { - try { - # Child's durable Applied receipt survives timeout/protocol/verification failures. - if ([IO.File]::Exists($appliedPath)) { - $receipt=[IO.File]::ReadAllText($appliedPath) | ConvertFrom-Json -ErrorAction Stop - if ($Operation -ne 'Grant' -or $receipt.Protocol -ne 1 -or $receipt.Id -cne $id -or $receipt.Status -cne 'Applied' -or - $receipt.Target -cne $Params.Upn -or $receipt.Trustee -cne $Params.Trustee -or $receipt.Right -cne $Params.Right -or $OnApplied -isnot [scriptblock]) { throw 'Invalid Applied receipt from the Exchange Online child process.' } - $null=& $OnApplied - [IO.File]::Delete($appliedPath) - } - } finally { if ([IO.File]::Exists($tmp)) { [IO.File]::Delete($tmp) } } - } - } -} - -function Invoke-PraExo { - param([hashtable]$Context,[ValidateSet('Probe','Preflight','Mailbox','Recipient','Hold','Permission','Grant')][string]$Operation,[hashtable]$Params=@{},$Permit=$null,$OnApplied=$null) - $session = Get-PraCloudSession $Context - if (-not $session.Exo) { throw 'Exchange Online connection required but not available.' } - if (-not $session.Subprocess -and [string](Get-PraValue (Get-PraValue $session 'Binding' $null) 'TenantId' '') -ne - [string](Get-PraValue (Get-PraValue $Context.Config 'Cloud' @{}) 'TenantId' '')) { throw 'Exchange Online tenant of the session differs from Cloud.TenantId.' } - if ($Operation -eq 'Grant' -and ($null -eq $Permit -or $Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or - $Context.Mode -ne 'Apply' -or $Context.Action -ne 'Convert' -or $Context.Phase -notin @('Cloud','Both') -or $WhatIfPreference)) { throw 'Grant without an active write authorisation.' } - $Params=$Params.Clone() - $Params.ExpectedIdentities=Get-PraValue $session 'Identities' @{} - if ($Operation -eq 'Grant') { - $exo=Get-PraValue $Context.Config 'Exo' @{} - $Params.GrantVerifyAttempts=Get-PraValue $exo 'GrantVerifyAttempts' 13 - $Params.GrantVerifyDelaySeconds=Get-PraValue $exo 'GrantVerifyDelaySeconds' 10 - } - $results = @(if ($session.Subprocess) { Invoke-PraExoSubprocess -Context $Context -Operation $Operation -Params $Params -Permit $Permit -OnApplied $OnApplied } - else { & $script:PraExoWorker $Operation $Params $Permit (Get-PraValue $session 'Binding' $null) $OnApplied }) - if ($results.Count -ne 1) { throw 'Exchange Online result not unique.' } - $result=$results[0] - $booleans=switch ($Operation) { 'Probe' { 'Connected' }; 'Permission' { 'TrusteeFound'; 'Verified' }; 'Grant' { 'TrusteeFound'; 'Verified'; 'Mutated' }; default { 'Found' } } - foreach ($key in $booleans) { if ((Get-PraValue $result $key $null) -isnot [bool]) { throw "Invalid Exchange Online result: $key must be a boolean." } } - if ($Operation -in @('Mailbox','Recipient','Hold') -and (Get-PraValue $result 'Found' $false) -and -not [string](Get-PraValue $result 'Type' '')) { throw 'Exchange Online result without type.' } - return $result -} - -function Connect-PraCloudSession { - param([hashtable]$Context,[bool]$NeedGraph,[bool]$NeedExo) - $s = Get-PraCloudSession $Context; $cloud=Get-PraValue $Context.Config 'Cloud' @{} - $app=[string](Get-PraValue $cloud 'AppId' ''); $thumb=[string](Get-PraValue $cloud 'CertificateThumbprint' '') - $tenant=[string](Get-PraValue $cloud 'TenantId' ''); $parsed=[guid]::Empty - if (($NeedGraph -or $NeedExo) -and (-not [guid]::TryParse($tenant,[ref]$parsed) -or $parsed -eq [guid]::Empty)) { throw 'Cloud.TenantId (GUID of the tenant) is required.' } - if ([bool]$app -ne [bool]$thumb) { throw 'Certificate sign-in incomplete: set both Cloud.AppId and Cloud.CertificateThumbprint.' } - if ($NeedGraph -and $s.Graph) { Assert-PraGraphSession $Context } - if ($NeedExo -and $s.Exo) { $null=Invoke-PraExo -Context $Context -Operation Probe } - # Graph must establish its CLR dependencies before EXO in this dedicated process. - # Removing a module cannot repair an already-loaded conflicting assembly. - if ($NeedGraph -and -not $s.Graph) { - $Context.CurrentOperation='Connect-MgGraph' - Import-Module Microsoft.Graph.Authentication -ErrorAction Stop - Import-Module Microsoft.Graph.Users -ErrorAction Stop - if ($null -ne (Get-MgContext -ErrorAction Stop)) { throw 'A Microsoft Graph session already exists in this console: run the tool in a new Windows PowerShell window.' } - $connect=@{ TenantId=$tenant; ContextScope='Process'; NoWelcome=$true; ErrorAction='Stop' } - if ($app) { $connect.ClientId=$app; $connect.CertificateThumbprint=$thumb } else { $connect.Scopes=@('User.Read.All') } - $s.GraphAttempted=$true - try { Connect-MgGraph @connect | Out-Null } - catch { - # Typical when Exchange Online was used earlier in the same console: its assemblies stay loaded. - if ($_.Exception.Message -match 'does not have an implementation|Could not load (type|file or assembly)|Method not found') { - throw ('Microsoft Graph cannot load in this console (assembly conflict, usually because Exchange Online was used earlier in the same window): run the tool in a new Windows PowerShell window. Detail: '+$_.Exception.Message) - } - throw - } - finally { $s.GraphContext=Get-MgContext -ErrorAction Stop } - $s.Graph=$true - Assert-PraGraphSession $Context - $null = Write-PraLog -Context $Context -Message ('Microsoft Graph connected ({0}, tenant verified)' -f $(if ($app) { 'certificate' } else { [string](Get-PraValue $s.GraphContext 'Account' 'interactive') })) -Level Success - } - if ($NeedExo -and -not $s.Exo) { - $Context.CurrentOperation='Connect-ExchangeOnline' - $exo = Get-PraValue $Context.Config 'Exo' @{} - $min = [version][string](Get-PraValue $exo 'MinModuleVersion' '3.10.0') - $installed = @(Get-Module ExchangeOnlineManagement -ListAvailable | Sort-Object Version -Descending) - if ($installed.Count -eq 0) { throw 'ExchangeOnlineManagement module not found (Install-Module ExchangeOnlineManagement -MinimumVersion 3.10.0 -Scope AllUsers -Force); the tool never installs modules.' } - $s.Subprocess = [bool](Get-PraValue $exo 'UseSubprocess' $false) -or $installed[0].Version -lt $min - if ($s.Subprocess) { - if (-not $app) { throw 'Exchange Online child process required (Exo.UseSubprocess or old module): certificate sign-in is mandatory.' } - $s.Exo=$true - $probe = Invoke-PraExo $Context 'Probe' - if ((Get-PraValue $probe 'Connected' $false) -ne $true) { throw 'Exchange Online child process connection not confirmed.' } - } else { - Import-Module ExchangeOnlineManagement -MinimumVersion $min -ErrorAction Stop - if (@(Get-ConnectionInformation -ErrorAction Stop).Count) { throw 'An Exchange Online session already exists in this console: run the tool in a new Windows PowerShell window (nothing was signed out).' } - if (-not (Get-Command Disconnect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('ConnectionId')) { throw 'This ExchangeOnlineManagement cannot sign out one connection (ConnectionId): update the module.' } - $connect=@{ ShowBanner=$false; ErrorAction='Stop' } - if ($app) { $connect.AppId=$app; $connect.CertificateThumbprint=$thumb; $connect.Organization=Get-PraValue $cloud 'Organization' '' } - else { - $upn=[string](Get-PraValue $cloud 'UserPrincipalName' '') - if ($upn) { - if (-not (Get-Command Connect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('UserPrincipalName')) { throw 'Cloud.UserPrincipalName is not supported by this ExchangeOnlineManagement.' } - $connect.UserPrincipalName=$upn - } - } - $disableWam=Get-PraValue $exo 'DisableWAM' $false - if ($disableWam -isnot [bool]) { throw 'Exo.DisableWAM must be $true or $false.' } - if ($disableWam) { - if (-not (Get-Command Connect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('DisableWAM')) { throw 'Exo.DisableWAM is not supported by this ExchangeOnlineManagement.' } - $connect.DisableWAM=$true - } - $s.ExoAttempted=$true; $s.OwnedExoIds=$null - try { Connect-ExchangeOnline @connect | Out-Null } - finally { $s.OwnedExoIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) } - $probe=& $script:PraExoWorker 'Probe' @{ TenantId=$tenant; Organization=[string](Get-PraValue $cloud 'Organization' ''); AppId=$app } $null $null $null - $s.Binding=$probe.Binding; $s.Exo=$true - } - $null = Write-PraLog -Context $Context -Message ("Exchange Online connected ({0}{1})" -f $(if ($app) { 'certificate' } else { 'interactive' }), $(if ($s.Subprocess) { ', child process' } else { '' })) -Level Success - } -} - -function Assert-PraGraphSession { - param([hashtable]$Context) - $s=Get-PraCloudSession $Context; $current=Get-MgContext -ErrorAction Stop - $tenant=[string](Get-PraValue (Get-PraValue $Context.Config 'Cloud' @{}) 'TenantId' '') - if ($null -eq $current -or [string](Get-PraValue $current 'TenantId' '') -ne $tenant -or - [string](Get-PraValue $current 'ContextScope' '') -ne 'Process') { throw 'Microsoft Graph session missing, on another tenant or not limited to this process.' } - foreach ($key in @('TenantId','ClientId','Account','AuthType','ContextScope')) { - if ([string](Get-PraValue $current $key '') -cne [string](Get-PraValue $s.GraphContext $key '')) { throw 'The Microsoft Graph session changed.' } - } -} - -function Close-PraCloudSession { - <# - .SYNOPSIS - Signs out the sessions opened by this module; a sign-out failure is an error. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context) - if (-not $Context.ContainsKey('_PraCloudSession')) { return } - $s=$Context['_PraCloudSession']; $errors=New-Object 'System.Collections.Generic.List[string]' - if ($s.ExoAttempted) { - try { - if ($null -eq (Get-PraValue $s 'OwnedExoIds' $null)) { throw 'Own Exchange Online connections unknown: a global sign-out is not allowed.' } - $currentIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) - $ownedIds=Get-PraValue $s 'OwnedExoIds' @() - foreach ($id in @($ownedIds)) { - if (-not $id) { throw 'Own connection ID missing: a global sign-out is not allowed.' } - if ($id -in $currentIds) { Disconnect-ExchangeOnline -ConnectionId $id -Confirm:$false -ErrorAction Stop 6>$null | Out-Null } - } - $s.ExoAttempted=$false; $s.Exo=$false - } - catch { [void]$errors.Add('Exchange Online sign-out: '+$_.Exception.Message) } - } - if ($s.GraphAttempted) { - try { - $current=Get-MgContext -ErrorAction Stop - if ($null -ne $current) { - if ($null -eq (Get-PraValue $s 'GraphContext' $null)) { throw 'The Microsoft Graph session was not opened by the tool: not signed out.' } - foreach ($key in @('TenantId','ClientId','Account','AuthType','ContextScope')) { - if ([string](Get-PraValue $current $key '') -cne [string](Get-PraValue $s.GraphContext $key '')) { throw 'The Microsoft Graph session was replaced: not signed out.' } - } - Disconnect-MgGraph -ErrorAction Stop | Out-Null - } - $s.GraphAttempted=$false; $s.Graph=$false - } - catch { [void]$errors.Add('Microsoft Graph sign-out: '+$_.Exception.Message) } - } - if ($errors.Count) { - $Context.CloudConnectFailed=$true; $Context.CurrentOperation='Close-PraCloudSession' - Write-PraCloudError -Context $Context -Row $null -Message ($errors -join ' | ') - throw ($errors -join ' | ') - } - [void]$Context.Remove('_PraCloudSession') -} - -function Get-PraPermissionRequest { - param([hashtable]$Context,$Row) - if (-not [bool](Get-PraValue $Row 'IsShared' $false)) { return } - $cfg = Get-PraValue $Context.Config 'SharedMailbox' @{} - if (-not [bool](Get-PraValue $cfg 'Enabled' $false)) { return } - foreach ($right in @('FullAccess','SendAs','SendOnBehalf')) { - if ($right -ne 'SendOnBehalf' -and (Get-PraValue $cfg 'PermissionSource' 'None') -eq 'None') { continue } - if ([bool](Get-PraValue $cfg ('Grant'+$right) $false)) { - foreach ($u in @((Get-PraValue $Row ('Shared'+$right) @()) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Select-Object -Unique)) { - [pscustomobject]@{ Right=$right; Trustee=[string]$u } - } - } - } -} - -function Initialize-PraCloudPreflight { - <# - .SYNOPSIS - Signs in and resolves every target and trustee in Exchange Online BEFORE the AD part of a Convert (Apply, phase Both). Read only. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context,[Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows) - $Context.CurrentPhase='CloudPreflight'; $Context.CurrentOperation='Prepare'; $Context.CurrentIdentity='' - try { - if ($Context.Action -ne 'Convert' -or $Context.Mode -ne 'Apply' -or $Context.Phase -ne 'Both' -or - $Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or $WhatIfPreference) { throw 'The pre-check is only for Convert, Apply, phase Both.' } - if ($Context.CloudCheckScope -notin @('Both','MailboxOnly','LicenseOnly')) { throw 'Invalid CloudCheckScope.' } - $cloud=Get-PraValue $Context.Config 'Cloud' @{}; $exo=Get-PraValue $Context.Config 'Exo' @{} - foreach ($key in @('CheckMailbox','CheckLicense')) { if ((Get-PraValue $cloud $key $false) -isnot [bool]) { throw "Cloud.$key must be `$true or `$false." } } - foreach ($key in @('UseSubprocess','DisableWAM')) { if ((Get-PraValue $exo $key $false) -isnot [bool]) { throw "Exo.$key must be `$true or `$false." } } - $attempts=Get-PraValue $exo 'GrantVerifyAttempts' 13; $delay=Get-PraValue $exo 'GrantVerifyDelaySeconds' 10 - if (($attempts -isnot [int] -and $attempts -isnot [long]) -or $attempts -lt 1 -or $attempts -gt 60 -or - ($delay -isnot [int] -and $delay -isnot [long]) -or $delay -lt 1 -or $delay -gt 30) { throw 'Invalid Exchange Online verification cadence.' } - $via=[string](Get-PraValue $cloud 'MailboxCheckVia' 'Graph') - if ($via -notin @('Graph','Exo')) { throw 'Invalid Cloud.MailboxCheckVia.' } - $needGraph=$false - foreach ($row in $Rows) { - if ((Get-PraValue $row 'IsShared' $false) -isnot [bool] -or (Get-PraValue $row 'FinalStatus' '') -eq 'Error') { throw 'Invalid or failed row at the pre-check.' } - $shared=[bool](Get-PraValue $row 'IsShared' $false) - if (-not $shared -and (($Context.CloudCheckScope -ne 'MailboxOnly' -and (Get-PraValue $cloud 'CheckLicense' $false)) -or - ($Context.CloudCheckScope -ne 'LicenseOnly' -and (Get-PraValue $cloud 'CheckMailbox' $false) -and $via -eq 'Graph'))) { $needGraph=$true } - } - # EXO resolves each target even while it is still a MailUser; no provisioning assertion here. - Connect-PraCloudSession -Context $Context -NeedGraph $needGraph -NeedExo ($Rows.Count -gt 0) - $session=Get-PraCloudSession $Context - foreach ($row in $Rows) { - $upn=[string](Get-PraValue $row 'UserPrincipalName' '') - $Context.CurrentIdentity=$upn; $Context.CurrentOperation='ResolvePreflightIdentity' - $requests=@(Get-PraPermissionRequest $Context $row) - $result=Invoke-PraExo -Context $Context -Operation Preflight -Params @{ Upn=$upn; Requests=$requests } - $identities=Get-PraValue $result 'Identities' @{} - $names=if ($identities -is [System.Collections.IDictionary]) { @($identities.Keys) } else { @($identities.PSObject.Properties.Name) } - foreach ($name in $names) { - $identity=Get-PraValue $identities $name $null - $previous=Get-PraValue $session.Identities $name $null - if ($null -ne $previous -and ((Get-PraValue $previous 'ObjectId') -ne (Get-PraValue $identity 'ObjectId') -or - (Get-PraValue $previous 'PrimarySmtpAddress') -ne (Get-PraValue $identity 'PrimarySmtpAddress'))) { throw 'Contradictory identities at the pre-check.' } - $session.Identities[$name]=$identity - } - if ($needGraph -and -not [bool](Get-PraValue $row 'IsShared' $false)) { - Assert-PraGraphSession $Context - $users=@(Get-MgUser -UserId $upn -Property Id,UserPrincipalName -ErrorAction Stop) - $target=Get-PraValue $session.Identities $upn $null - if ($users.Count -ne 1 -or [string](Get-PraValue $users[0] 'Id' '') -ne [string](Get-PraValue $target 'ObjectId' '') -or - [string](Get-PraValue $users[0] 'UserPrincipalName' '') -ne $upn) { throw "Graph and Exchange Online identities differ at the pre-check: $upn" } - } - } - $session.Preflight=$true; $Context.CloudConnectFailed=$false - $null=Write-PraLog -Context $Context -Message ('Pre-check passed: {0} target(s) and their trustees resolved in Exchange Online (read only)' -f $Rows.Count) -Level Success - } catch { - $failure=$_.Exception.Message; $Context.CloudConnectFailed=$true - try { Close-PraCloudSession -Context $Context } catch { $failure+=' | sign-out after the pre-check: '+$_.Exception.Message } - throw $failure - } -} - -function Invoke-PraPermissionGrant { - param([hashtable]$Context,$Row,[hashtable]$Params) - if ($Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or - $Context.Action -ne 'Convert' -or $Context.Phase -notin @('Cloud','Both') -or $WhatIfPreference) { throw 'Permission missing and writes are not allowed in this mode.' } - $adVerified=Get-PraValue $Row 'ADVerified' $false - if ($adVerified -isnot [bool] -or -not $adVerified) { throw 'Grant refused: a verified AD proof is required.' } - foreach ($name in @('Approval','AssertCloudAuthorization','JournalMutation')) { - if ($Context[$name] -isnot [scriptblock]) { throw "Required callback missing: $name" } - } - $target=$Params.Upn; $operation="Grant $($Params.Right) to $($Params.Trustee)" - $Context.CurrentOperation=$operation; $Context.CurrentIdentity=[string](Get-PraValue $Row 'ObjectGuid' $target) - $approval = @(& $Context.Approval $target $operation) - if ($approval.Count -ne 1 -or $approval[0] -isnot [bool] -or -not $approval[0]) { throw "Grant refused or not confirmed: $operation" } - $proof = @(& $Context.AssertCloudAuthorization $Row) - if ($proof.Count -gt 1 -or ($proof.Count -eq 1 -and ($proof[0] -isnot [bool] -or -not $proof[0]))) { throw 'Backup/AD proof refused or ambiguous.' } - # The callbacks cannot re-open a forbidden mode before the call. - if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -ne 'Convert' -or $WhatIfPreference) { throw 'Authorisation revoked.' } - $detail="UPN=$target; Trustee=$($Params.Trustee); Right=$($Params.Right); ObjectGuid=$($Context.CurrentIdentity)" - $Row.LastOperation=$operation - $null = & $Context.JournalMutation $target $operation 'Started' $detail - $permit=@{ AllowMutation=$true; Approved=$true; Authorized=$true; JournalStarted=$true; Target=$target - Trustee=$Params.Trustee; Right=$Params.Right; Action=$Context.Action; Mode=$Context.Mode; Phase=$Context.Phase } - try { - $onApplied={ $null=& $Context.JournalMutation $target $operation 'Applied' ($detail+'; Add returned; verification pending') }.GetNewClosure() - $res = Invoke-PraExo -Context $Context -Operation 'Grant' -Params $Params -Permit $permit -OnApplied $onApplied - $verified=Get-PraValue $res 'Verified' $false - if ($verified -isnot [bool] -or -not $verified) { throw ([string](Get-PraValue $res 'Error' 'Permission re-read not confirmed.')) } - $null = & $Context.JournalMutation $target $operation 'Verified' ($detail+'; Mutated='+(Get-PraValue $res 'Mutated' $false)) - } catch { - $failure=$_.Exception.Message - try { $null = & $Context.JournalMutation $target $operation 'Failed' ($detail+'; '+$failure) } - catch { $failure += ' | journal line Failed not written: '+$_.Exception.Message } - throw $failure - } -} - -function Invoke-PraSharedPermission { - <# - .SYNOPSIS - Checks every permission of a shared mailbox in Exchange Online and grants the missing ones (Apply). - .DESCRIPTION - Trustees are always resolved strictly: a trustee missing in Exchange Online is an error. - Preview of a Convert: a missing permission is counted "to grant" (no error). - .OUTPUTS - Number of permissions still to grant (Preview only; 0 in Apply). - #> - [CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact='Low')] - param([hashtable]$Context,$Row,[object[]]$Requests) - $Row.PermMissing=@(); $verified=0; $toGrant=0; $missing=New-Object 'System.Collections.Generic.List[string]' - $cfg=Get-PraValue $Context.Config 'SharedMailbox' @{} - $upn=[string](Get-PraValue $Row 'UserPrincipalName' '') - $preview=($Context.Action -eq 'Convert' -and ($Context.Mode -ne 'Apply' -or -not $Context.AllowMutation -or $WhatIfPreference)) - foreach ($request in $Requests) { - $p=@{ Upn=$upn; Trustee=$request.Trustee; Right=$request.Right; AutoMapping=[bool](Get-PraValue $cfg 'AutoMapping' $false) } - $Row.PermDetail="Permissions verified=$verified/$($Requests.Count); current=$($request.Right)/$($request.Trustee)" - $r=Invoke-PraExo -Context $Context -Operation 'Permission' -Params $p - if ((Get-PraValue $r 'TrusteeFound' $false) -ne $true) { - if (-not $missing.Contains($request.Trustee)) { [void]$missing.Add($request.Trustee) } - $Row.PermMissing=$missing.ToArray(); continue - } - if ((Get-PraValue $r 'Verified' $false) -ne $true) { - if ($preview) { $toGrant++; continue } - if ($Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or - $Context.Action -ne 'Convert' -or $Context.Phase -notin @('Cloud','Both') -or $WhatIfPreference) { throw 'Permission missing and writes are not allowed in this mode.' } - # Native ShouldProcess per right; it never replaces the approval, proof and journal of the grant. - if (-not $PSCmdlet.ShouldProcess($upn,"Grant $($request.Right) to $($request.Trustee)")) { throw 'Exchange Online grant refused (ShouldProcess).' } - Invoke-PraPermissionGrant -Context $Context -Row $Row -Params $p - $null=Write-PraLog -Context $Context -Message ("{0}: {1} granted to {2} and verified" -f $upn,$request.Right,$request.Trustee) -Level Sub - } - $verified++ - } - $Row.PermDetail="Permissions verified=$verified/$($Requests.Count); to grant=$toGrant; trustees missing in Exchange Online=$($missing.Count)" - if ($missing.Count) { throw ($Row.PermDetail+': '+($missing -join ', ')) } - if (($verified+$toGrant) -ne $Requests.Count) { throw $Row.PermDetail } - return $toGrant -} - -function Get-PraGraphFact { - param([hashtable]$Context,[string]$Upn,[bool]$Mailbox,[bool]$License) - if (-not (Get-PraCloudSession $Context).Graph) { throw 'Microsoft Graph required but not connected.' } - Assert-PraGraphSession $Context - $props=@('assignedPlans'); if ($Mailbox) { $props+='provisionedPlans' }; if ($License) { $props+='assignedLicenses' } - $users=@(Get-MgUser -UserId $Upn -Property $props -ErrorAction Stop) - if ($users.Count -ne 1 -or $null -eq $users[0]) { throw "Microsoft Graph: user not found or not unique ($Upn)." } - $values=@{}; $sentinel=New-Object object - foreach ($prop in $props) { - $value=Get-PraValue $users[0] $prop $sentinel - if ([object]::ReferenceEquals($value,$sentinel)) { throw "Microsoft Graph: property not returned ($prop)." } - $values[$prop]=@($value | Where-Object { $null -ne $_ }) - } - foreach ($p in $values.assignedPlans) { - if (-not [string](Get-PraValue $p 'Service' '') -or -not [string](Get-PraValue $p 'CapabilityStatus' '')) { throw 'Microsoft Graph: incomplete assignedPlan, Exchange removal not proven.' } - } - if ($Mailbox) { - foreach ($p in $values.provisionedPlans) { - if (-not [string](Get-PraValue $p 'Service' '') -or -not [string](Get-PraValue $p 'ProvisioningStatus' '')) { throw 'Microsoft Graph: incomplete provisionedPlan.' } - } - } - $enabled=@($values.assignedPlans | Where-Object { (Get-PraValue $_ 'Service' '') -eq 'exchange' -and (Get-PraValue $_ 'CapabilityStatus' '') -eq 'Enabled' }).Count -gt 0 - $prov=$false; $plans=@(); $sku=@() - if ($Mailbox) { $prov=@($values.provisionedPlans | Where-Object { (Get-PraValue $_ 'Service' '') -eq 'exchange' -and (Get-PraValue $_ 'ProvisioningStatus' '') -eq 'Success' }).Count -gt 0 } - $required=[string](Get-PraValue (Get-PraValue $Context.Config 'Cloud' @{}) 'RequiredSkuPartNumber' '') - if ($Mailbox -or ($License -and $required)) { - $details=@(Get-MgUserLicenseDetail -UserId $Upn -All -ErrorAction Stop) - foreach ($d in $details) { - $sku += [string](Get-PraValue $d 'SkuPartNumber' '') - foreach ($p in @((Get-PraValue $d 'ServicePlans' @()) | Where-Object { (Get-PraValue $_ 'ServicePlanName' '') -like 'EXCHANGE_*' })) { - $status=[string](Get-PraValue $p 'ProvisioningStatus' '') - $plans += ([string](Get-PraValue $p 'ServicePlanName' '')+':'+$status) - if ($status -eq 'Success') { $prov=$true } - } - } - } - $count=0; if ($License) { $count=$values.assignedLicenses.Count } - return @{ Enabled=$enabled; Provisioned=$prov; LicenseCount=$count; RequiredSku=$required - RequiredSkuOk=(-not $required -or $required -in $sku); Detail=($plans -join ',') } -} - -function Invoke-PraCloudPhase { - <# - .SYNOPSIS - Checks (and waits for) the expected Exchange Online state of every row and, in Apply, grants the shared mailbox permissions. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context,[Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows, - [Parameter(Mandatory)][ValidateSet('Convert','Recover')][string]$Act) - $Context.CurrentPhase='Cloud'; $Context.CurrentOperation='Prepare'; $Context.CurrentIdentity=''; $Context.CloudConnectFailed=$false - $states=New-Object 'System.Collections.Generic.List[object]' - try { - $scope=[string]$Context.CloudCheckScope - if ($Context.Action -in @('Convert','Recover') -and $Context.Action -ne $Act) { throw 'Context action and -Act differ.' } - if ($scope -notin @('Both','MailboxOnly','LicenseOnly')) { throw 'Invalid CloudCheckScope.' } - if ([int]$Context.TimeoutMinutes -lt 0 -or [int]$Context.IntervalMinutes -lt 0) { throw 'Negative cloud polling values.' } - $cloud=Get-PraValue $Context.Config 'Cloud' @{} - $via=[string](Get-PraValue $cloud 'MailboxCheckVia' 'Graph') - if ($via -notin @('Graph','Exo')) { throw 'Invalid Cloud.MailboxCheckVia.' } - $needGraph=$false; $needExo=$false - foreach ($row in $Rows) { - Add-Member -InputObject $row -NotePropertyName DeprovisionConfirmed -NotePropertyValue $false -Force - $row.CloudMailbox=$null; $row.CloudLicense=$null; $row.CloudStatus='Pending'; $row.CloudDetail='' - $upn=[string](Get-PraValue $row 'UserPrincipalName' '') - if (-not $upn) { Write-PraCloudError -Context $Context -Row $row -Message 'UPN missing: check impossible.'; continue } - if ((Get-PraValue $row 'FinalStatus' '') -eq 'Error') { Write-PraCloudError -Context $Context -Row $row -Message 'Previous error: cloud part not allowed.'; continue } - $shared=[bool](Get-PraValue $row 'IsShared' $false) - $preserveMailbox=Get-PraValue $row 'PreserveCloudMailbox' $false; $preserveLicense=Get-PraValue $row 'PreserveLicense' $false - if ($preserveMailbox -isnot [bool] -or $preserveLicense -isnot [bool] -or ($preserveMailbox -and -not $shared)) { - Write-PraCloudError -Context $Context -Row $row -Message 'Invalid keep flags (PreserveCloudMailbox is for shared mailboxes only).'; continue - } - $requests=@(); if ($Act -eq 'Convert') { $requests=@(Get-PraPermissionRequest $Context $row) } - $mb=($scope -ne 'LicenseOnly') -and ([bool](Get-PraValue $cloud 'CheckMailbox' $false) -or $Act -eq 'Recover' -or $requests.Count -gt 0) - $lic=($scope -ne 'MailboxOnly') -and -not $shared -and [bool](Get-PraValue $cloud 'CheckLicense' $false) - if (-not $mb -and -not $lic) { - $row.CloudStatus='Skipped'; $row.CloudDetail='No applicable check; no restore confirmation.'; $row.FinalStatus='Skipped'; continue - } - $graphMailbox=$mb -and -not $shared -and $via -eq 'Graph' - $exoMailbox=$mb -and ($Act -eq 'Recover' -or $shared -or $via -eq 'Exo') - $needGraph=$needGraph -or $lic -or $graphMailbox; $needExo=$needExo -or $exoMailbox - [void]$states.Add(@{ Row=$row; Upn=$upn; Shared=$shared; Mailbox=$mb; License=$lic; GraphMailbox=$graphMailbox - ExoMailbox=$exoMailbox; Requests=$requests; PreserveMailbox=$preserveMailbox; PreserveLicense=$preserveLicense; Done=$false }) - } - if ($states.Count -eq 0) { return } - try { Connect-PraCloudSession -Context $Context -NeedGraph $needGraph -NeedExo $needExo } - catch { $Context.CloudConnectFailed=$true; throw } - $clock=[Diagnostics.Stopwatch]::StartNew(); $timeout=[double]$Context.TimeoutMinutes*60; $attempt=0 - do { - $attempt++; $pending=@($states | Where-Object { -not $_.Done }) - $null=Write-PraLog -Context $Context -Message ("Check {0}: {1} object(s) in Exchange Online" -f $attempt, $pending.Count) -Level Info - foreach ($s in $pending) { - $row=$s.Row; $Context.CurrentIdentity=[string](Get-PraValue $row 'ObjectGuid' $s.Upn); $Context.CurrentOperation='CloudCheck' - try { - $details=New-Object 'System.Collections.Generic.List[string]'; $mbok=$true; $licok=$true; $facts=$null - if ($s.GraphMailbox -or $s.License) { $facts=Get-PraGraphFact -Context $Context -Upn $s.Upn -Mailbox $s.GraphMailbox -License $s.License } - if ($s.ExoMailbox) { - $m=Invoke-PraExo -Context $Context -Operation 'Mailbox' -Params @{ Upn=$s.Upn } - if ($Act -eq 'Recover') { - if ($s.PreserveMailbox) { - $mbok=(Get-PraValue $m 'Found' $false) -eq $true -and (Get-PraValue $m 'Type' '') -eq 'SharedMailbox' - [void]$details.Add("MBX:KeepCloudShared SharedMailbox present=$mbok; deprovisioning NOT confirmed, tag kept") - } else { - $r=Invoke-PraExo -Context $Context -Operation 'Recipient' -Params @{ Upn=$s.Upn } - $mbok=(Get-PraValue $m 'Found' $true) -eq $false -and (Get-PraValue $r 'Found' $false) -eq $true -and (Get-PraValue $r 'Type' '') -eq 'MailUser' - [void]$details.Add("MBX:absence=$(-not [bool](Get-PraValue $m 'Found' $true)); recipient=$(Get-PraValue $r 'Type' 'none')") - if ($s.GraphMailbox) { [void]$details.Add("Graph:Enabled=$($facts.Enabled),Provisioned=$($facts.Provisioned) (Exchange Online is authoritative, Graph errors stop)") } - } - } else { - $type=[string](Get-PraValue $m 'Type' '') - $mbok=if ($s.Shared) { $type -eq 'SharedMailbox' } else { $type -in @('UserMailbox','SharedMailbox','RoomMailbox','EquipmentMailbox') } - [void]$details.Add("MBX:EXO type=$type") - } - } elseif ($s.GraphMailbox) { $mbok=$facts.Provisioned; [void]$details.Add("MBX:Graph provisioning=$mbok; Enabled=$($facts.Enabled) [$($facts.Detail)]") } - if ($s.Mailbox) { $row.CloudMailbox=[bool]$mbok } - if ($s.License) { - $licok=if ($Act -eq 'Convert' -or $s.PreserveLicense) { $facts.LicenseCount -gt 0 -and $facts.Enabled -and $facts.RequiredSkuOk } - elseif ($facts.RequiredSku) { -not $facts.RequiredSkuOk } else { -not $facts.Enabled } - $row.CloudLicense=[bool]$licok - [void]$details.Add("LIC:OK=$licok; Preserve=$($s.PreserveLicense); ExpectedSKU=$($facts.RequiredSku); SKUPresent=$($facts.RequiredSkuOk); licences=$($facts.LicenseCount); ExchangeEnabled=$($facts.Enabled)") - } elseif ($s.Shared) { [void]$details.Add('LIC:N/A (shared)') } - $row.CloudDetail=$details -join ' | ' - if ($mbok -and $licok) { - if ($Act -eq 'Recover' -and -not $s.ExoMailbox) { - $row.CloudStatus='Skipped'; $row.FinalStatus='Skipped'; $row.CloudDetail+=' | LicenseOnly: no Exchange Online confirmation, restore not allowed.' - } else { - $toGrant=0 - if ($s.Mailbox -and $s.Requests.Count) { $toGrant=[int](Invoke-PraSharedPermission -Context $Context -Row $row -Requests $s.Requests) } - $row.DeprovisionConfirmed=($Act -eq 'Recover' -and $s.ExoMailbox -and -not $s.PreserveMailbox) - if ($toGrant -gt 0) { - $row.CloudStatus='Planned'; $row.FinalStatus='Planned' - $null=Write-PraLog -Context $Context -Message ("{0}: SharedMailbox ready, {1} permission(s) to grant in Apply" -f $s.Upn, $toGrant) -Level Info - } else { - $row.CloudStatus='Success' - $row.FinalStatus=if ($Act -eq 'Recover' -and [bool](Get-PraValue $row 'DeproPending' $false)) { 'Pending' } else { 'Success' } - $what=if ($Act -eq 'Recover') { if ($s.PreserveMailbox) { 'shared mailbox kept in Exchange Online' } else { 'deprovisioned in Exchange Online (now a MailUser)' } } - elseif ($s.Shared) { 'SharedMailbox ready, ' + ([string]$row.PermDetail -replace '; to grant=0; trustees missing in Exchange Online=0', '') } - else { 'mailbox' + $(if ($s.License) { ' and licence' } else { '' }) + ' ready' } - $null=Write-PraLog -Context $Context -Message ("{0}: {1}" -f $s.Upn, $what) -Level Success - } - } - $s.Done=$true - } else { $row.CloudStatus='Pending' } - } catch { Write-PraCloudError -Context $Context -Row $row -Message ($_.Exception.Message+' | '+[string]$row.PermDetail); $s.Done=$true } - } - $pending=@($states | Where-Object { -not $_.Done }) - if (-not $pending.Count -or $Context.Once -or $clock.Elapsed.TotalSeconds -ge $timeout) { break } - $seconds=[Math]::Min([Math]::Max(1,([double]$Context.IntervalMinutes*60)),[Math]::Max(0,($timeout-$clock.Elapsed.TotalSeconds))) - $null=Write-PraLog -Context $Context -Message ("Not ready yet: {0} - next check in {1:0} s (waiting up to {2} min in total)" -f (($pending | ForEach-Object { $_.Upn }) -join ', '), $seconds, $Context.TimeoutMinutes) -Level Sub - foreach ($s in $pending) { $null=Write-PraLog -Context $Context -Message ("{0} | {1}" -f $s.Upn, $s.Row.CloudDetail) -Level Detail } - if ($seconds -gt 0) { Start-Sleep -Milliseconds ([int][Math]::Min(2147483647,($seconds*1000))) } - } while ($true) - $preview=(-not $Context.AllowMutation -and $Context.Action -in @('Convert','Recover')) - foreach ($s in $states) { - if ($s.Done) { continue } - if ($preview) { - $s.Row.CloudStatus='Pending'; $s.Row.FinalStatus='Planned' - $s.Row.Detail=([string]$s.Row.Detail+' | not yet in the expected state in Exchange Online (preview): '+$s.Row.CloudDetail).Trim(' ','|') - $null=Write-PraLog -Context $Context -Message ("{0}: not yet in the expected state ({1})" -f $s.Upn, $s.Row.CloudDetail) -Level Info - } - else { Write-PraCloudError -Context $Context -Row $s.Row -Message ('Expected state not reached (timeout or -Once): '+$s.Row.CloudDetail) } - } - } catch { - $failure=$_.Exception.Message - foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message $failure } - if ($Rows.Count -eq 0) { Write-PraCloudError -Context $Context -Row $null -Message $failure } - } finally { - try { Close-PraCloudSession $Context } - catch { foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message ('Cloud sign-out failed: '+$_.Exception.Message) } } - } -} - -function Invoke-PraRetentionCheck { - <# - .SYNOPSIS - Checks that the retention policy holds the active or inactive mailboxes (read only, never a deprovisioning confirmation). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context,[Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows) - $Context.CurrentPhase='Retention'; $Context.CurrentOperation='Prepare'; $Context.CurrentIdentity=''; $Context.CloudConnectFailed=$false - try { - if ($Rows.Count -eq 0) { return } - $cfg=Get-PraValue $Context.Config 'Retention' @{}; $raw=[string](Get-PraValue $cfg 'PolicyGuid' '') - $guid=$null; $parsed=[guid]::Empty - if ($raw) { - if (-not [guid]::TryParse($raw,[ref]$parsed) -or $parsed -eq [guid]::Empty) { throw 'Retention.PolicyGuid is not a GUID.' } - $guid=$parsed.ToString('N') - } - try { Connect-PraCloudSession -Context $Context -NeedGraph $false -NeedExo $true } - catch { $Context.CloudConnectFailed=$true; throw } - $cloud=Get-PraValue $Context.Config 'Cloud' @{}; $name=[string](Get-PraValue $cfg 'PolicyName' '') - if (-not $guid -and $name -and [bool](Get-PraValue $cfg 'UseComplianceSession' $false) -and -not [string](Get-PraValue $cloud 'AppId' '')) { - $Context.CurrentOperation='ResolveRetentionPolicy' - $session=Get-PraCloudSession $Context - if ($session.Subprocess) { throw 'Interactive policy lookup (Connect-IPPSSession) is not possible with the Exchange Online child process.' } - $beforeIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) - $session.ExoAttempted=$true - try { Connect-IPPSSession -ShowBanner:$false -ErrorAction Stop | Out-Null } - finally { - $newIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId } | Where-Object { $_ -notin $beforeIds }) - $session.OwnedExoIds=@($session.OwnedExoIds)+$newIds - } - try { - $policies=@(Get-RetentionCompliancePolicy -Identity $name -ErrorAction Stop) - if ($policies.Count -ne 1) { throw 'Retention policy not found or not unique.' } - $raw=[string](Get-PraValue $policies[0] 'Guid' '') - if (-not $raw) { $raw=[string](Get-PraValue $policies[0] 'ExchangeObjectId' '') } - if (-not [guid]::TryParse($raw,[ref]$parsed) -or $parsed -eq [guid]::Empty) { throw 'Retention policy GUID missing or invalid.' } - $guid=$parsed.ToString('N') - } finally { - foreach ($id in $newIds) { Disconnect-ExchangeOnline -ConnectionId $id -Confirm:$false -ErrorAction Stop 6>$null | Out-Null } - } - } - foreach ($row in $Rows) { - Add-Member -InputObject $row -NotePropertyName DeprovisionConfirmed -NotePropertyValue $false -Force - $Context.CurrentOperation='VerifyRetention'; $Context.CurrentIdentity=[string](Get-PraValue $row 'ObjectGuid' '') - $row.CloudMailbox=$null; $row.CloudLicense=$null; $row.CloudStatus='Pending' - try { - $h=Invoke-PraExo -Context $Context -Operation 'Hold' -Params @{ Upn=[string](Get-PraValue $row 'UserPrincipalName' '') } - $row.CloudMailbox=[bool](Get-PraValue $h 'Found' $false) - $holds=Get-PraValue $h 'Holds' @(); $holds=@($holds | Where-Object { $null -ne $_ }) - $included=$false; $excluded=$false; $deleteOnly=$false - foreach ($hold in $holds) { - if ([string]$hold -match '^(?-)?(?:mbx|grp|skp|UniH)?(?[a-f0-9]{32}|[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})(?::(?[123]))?$') { - if (($Matches.id -replace '-','') -eq $guid) { - if ($Matches.ContainsKey('excluded')) { $excluded=$true } - elseif ($Matches.ContainsKey('action') -and $Matches.action -eq '1') { $deleteOnly=$true } - else { $included=$true } - } - } - } - $row.CloudDetail="Retention: Found=$($row.CloudMailbox); Inactive=$(Get-PraValue $h 'IsInactive' $false); Litigation=$(Get-PraValue $h 'Litigation' $false); RetentionHold=$(Get-PraValue $h 'RetentionHold' $false); Holds=[$($holds -join ',')]" - if (-not $row.CloudMailbox) { throw ('Mailbox not found (active or inactive). '+$row.CloudDetail) } - if (-not $guid) { throw ('Policy unknown: set Retention.PolicyGuid (a hold may exist, check it manually). '+$row.CloudDetail) } - if ($excluded -or $deleteOnly -or -not $included) { throw ('Not covered by the policy (or excluded, or delete-only); an adaptive scope can take several days. '+$row.CloudDetail) } - $row.CloudStatus='Success'; if ($row.FinalStatus -ne 'Error') { $row.FinalStatus='Success' } - $row.CloudDetail+=' | COVERED (GUID='+$guid+')' - $null=Write-PraLog -Context $Context -Message $row.CloudDetail -Level Success - } catch { Write-PraCloudError -Context $Context -Row $row -Message $_.Exception.Message } - } - } catch { - $failure=$_.Exception.Message - foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message $failure } - if ($Rows.Count -eq 0) { Write-PraCloudError -Context $Context -Row $null -Message $failure } - } finally { - try { Close-PraCloudSession $Context } - catch { foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message ('Sign-out after the retention check failed: '+$_.Exception.Message) } } - } -} - -Export-ModuleMember -Function Initialize-PraCloudPreflight,Invoke-PraCloudPhase,Invoke-PraRetentionCheck,Close-PraCloudSession +<# +.SYNOPSIS + PRA Remote Mailbox - Exchange Online and Microsoft Graph adapter (no AD read or write). + +.DESCRIPTION + Public functions (no pipeline output; result rows are updated in place; an error sets the row to + Error and records a run error, or throws): + + Initialize-PraCloudPreflight Convert, Apply, phase Both: sign-in, targets and trustees resolved + in Exchange Online BEFORE the AD part (read only) + Invoke-PraCloudPhase checks (and waits for) the expected cloud state of every row and, in + Apply, grants the shared mailbox permissions + Invoke-PraRetentionCheck Check -Expect Retained: retention policy holds (read only) + Close-PraCloudSession signs out the sessions opened by this module (idempotent) + + Expected cloud states: + Convert user: mailbox provisioned (Exchange Online type, or Graph provisioning) and a licence + with Exchange enabled; shared: SharedMailbox, then every FullAccess, SendAs and + SendOnBehalf permission present. + Recover mailbox gone and recipient back to MailUser (DeprovisionConfirmed = true); licence + removed unless the user was already in the licence group. KeepCloudShared: the shared + mailbox must still exist (never a deprovisioning confirmation). + DeprovisionConfirmed becomes true ONLY after these checks; the entry script requires it before any + final restore. A cloud error is never taken as "absent". + + Writes (Convert, Apply, phase Cloud or Both): each permission grant needs the operator approval, + a fresh check of the AD proof, a journal line "Started", ONE Add call, a journal line "Applied", + bounded re-reads (Exo.GrantVerifyAttempts x Exo.GrantVerifyDelaySeconds) and a line "Verified". + A grant is never retried. + + Sessions: Microsoft Graph is connected before Exchange Online (assembly conflicts in Windows + PowerShell 5.1); an Exchange Online or Graph session that already exists in the console is refused; + tenant, token, connection ID and module path are checked before each call. Exo.UseSubprocess (or + an ExchangeOnlineManagement older than Exo.MinModuleVersion) runs every Exchange Online call in a + child Windows PowerShell (certificate sign-in only). + +.NOTES + Author : Nicolas Fabert + Version : 2.2.0 +#> +#Requires -Version 5.1 +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' +# >>> PRA package integrity bootstrap: identical in every runtime PowerShell file (checked by the tests). +# It authenticates module\Test-PackageIntegrity.ps1 before running it; there is no unsigned or bypass path. +& { + param([Parameter(Mandatory)][string]$PackageRoot) + $verifier = [IO.Path]::GetFullPath([IO.Path]::Combine($PackageRoot, 'module', 'Test-PackageIntegrity.ps1')) + $cursor = $verifier + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + & $verifier -Root $PackageRoot +} ([IO.Path]::GetDirectoryName($PSScriptRoot)) +# <<< PRA package integrity bootstrap + +# Fixed worker body, also run in the child process: no code or cmdlet name ever comes from data. +$script:PraExoWorker = { + param([ValidateSet('Probe','Preflight','Mailbox','Recipient','Hold','Permission','Grant')][string]$Operation,$P,$Permit,$SessionBinding,$OnApplied) + Set-StrictMode -Version Latest + $ErrorActionPreference = 'Stop' + function V { + param($Object,[string]$Name,$Default=$null) + if ($null -ne $Object) { + if ($Object -is [System.Collections.IDictionary]) { + if ($Object.Contains($Name)) { return ,($Object[$Name]) } + } elseif ($null -ne $Object.PSObject.Properties[$Name]) { return ,($Object.PSObject.Properties[$Name].Value) } + } + return ,$Default + } + function Session { + param([string]$Right='') + $tenant=[string](V $SessionBinding 'TenantId' (V $P 'TenantId' '')) + $parsed=[guid]::Empty + if (-not [guid]::TryParse($tenant,[ref]$parsed) -or $parsed -eq [guid]::Empty) { throw 'Expected Exchange Online tenant missing or invalid (Cloud.TenantId).' } + $organization=[string](V $SessionBinding 'Organization' (V $P 'Organization' '')) + $appId=[string](V $SessionBinding 'AppId' (V $P 'AppId' '')) + $connections=@(Get-ConnectionInformation -ErrorAction Stop) + if ($connections.Count -ne 1) { throw 'Exactly one Exchange Online connection is expected in this process.' } + $c=$connections[0]; $location=[string](V $c 'ModuleName' ''); $id=[string](V $c 'ConnectionId' '') + # Interactive sign-in reports the tenant GUID; certificate (app-only) sign-in reports the + # organisation domain (tenant.onmicrosoft.com) and the AppId: both are accepted, nothing else. + $sessionTenant=[string](V $c 'TenantID' '') + $tenantOk=($sessionTenant -eq $tenant) -or ($organization -and $sessionTenant -eq $organization) + if ($appId -and [string](V $c 'AppId' '') -ne $appId) { $tenantOk=$false } + if (-not $tenantOk -or [string](V $c 'State' '') -ne 'Connected' -or + [string](V $c 'TokenStatus' '') -ne 'Active' -or -not $id -or -not [IO.Path]::IsPathRooted($location)) { + throw ("Exchange Online session: wrong tenant ({0}), state, token, connection ID or module path." -f $sessionTenant) + } + $modules=@(Get-Module | Where-Object { $_.ModuleBase -eq $location -or $_.Path -eq $location }) + if ($modules.Count -ne 1 -or -not $modules[0].Path) { throw 'Module of the Exchange Online session not found or ambiguous.' } + if ($null -ne $SessionBinding -and (V $SessionBinding 'ConnectionId' '')) { + if ($id -ne (V $SessionBinding 'ConnectionId') -or $location -ne (V $SessionBinding 'ModuleLocation') -or + $modules[0].Path -ne (V $SessionBinding 'ModulePath')) { throw 'The Exchange Online session changed.' } + } + $command=$null + if ($Right) { + $name=switch ($Right) { 'FullAccess' { 'Add-MailboxPermission' }; 'SendAs' { 'Add-RecipientPermission' }; 'SendOnBehalf' { 'Set-Mailbox' }; default { throw 'Unknown permission.' } } + $commands=@(Get-Command -Name $name -Module $modules[0].Name -All -ErrorAction Stop) + if ($commands.Count -ne 1 -or $null -eq $commands[0].Module -or $commands[0].Module.Path -ne $modules[0].Path) { + throw "Command $name is not from the module of the Exchange Online session." + } + $command=$commands[0] + } + return @{ TenantId=$tenant; Organization=$organization; AppId=$appId; ConnectionId=$id; ModuleLocation=$location; ModulePath=$modules[0].Path; Command=$command } + } + function ExactFilter { + param([string]$Upn) + if ([string]::IsNullOrWhiteSpace($Upn) -or $Upn -match '[\r\n\x00]') { throw 'Empty or invalid UPN.' } + return "UserPrincipalName -eq '$($Upn.Replace("'","''"))'" + } + function MissingRecipient { + param([System.Management.Automation.ErrorRecord]$Record,[string]$Upn) + # A selector read (-UserPrincipalName) answers an absent object with HTTP 404 ManagementObjectNotFoundException + # instead of an empty result (seen in the lab while a deprovisioned mailbox turns into a MailUser). + $text=$Record.Exception.Message + if ($text -notmatch 'HttpStatusCode=404') { return $false } + $json=[regex]::Match($text,'(?s)\{\s*"error"\s*:\s*\{.*\}\s*\}') + if (-not $json.Success) { return $false } + try { + $payload=$json.Value | ConvertFrom-Json -ErrorAction Stop + $object="object '"+[WildcardPattern]::Escape($Upn)+"' couldn't be found" + $detail=@($payload.error.details | Where-Object { [string]$_.message -like '*|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|*' }) + return ($payload.error.code -ceq 'NotFound' -and [string]$payload.error.message -like "*$object*" -and $detail.Count -gt 0 -and [string]$detail[0].message -like "*$object*") + } catch { return $false } + } + function Recipient { + param([string]$Upn) + if ([string]::IsNullOrWhiteSpace($Upn) -or $Upn -match '[\r\n\x00]') { throw 'Empty or invalid UPN.' } + # Recipient exposes a dedicated UPN selector, not a UserPrincipalName output/filter property. + # "Not found" is read through -ErrorVariable (no transcript error line); any other error stops. + $recipientErrors=$null + try { $items = @(Get-EXORecipient -UserPrincipalName $Upn -Properties RecipientTypeDetails,PrimarySmtpAddress,ExternalDirectoryObjectId,Guid,DistinguishedName -ResultSize Unlimited -ErrorAction SilentlyContinue -ErrorVariable recipientErrors -WarningAction Stop) } + catch { if (-not (MissingRecipient $_ $Upn)) { throw }; $items=@(); $recipientErrors=@($_) } + $recipientErrors=@($recipientErrors | Where-Object { $null -ne $_ }) + if ($recipientErrors.Count) { + foreach ($record in $recipientErrors) { + if ($record -isnot [System.Management.Automation.ErrorRecord] -or -not (MissingRecipient $record $Upn)) { throw $record } + } + if ($items.Count) { throw "Exchange Online returned a recipient and 'not found' for: $Upn" } + return @{ Found=$false; Type=$null; Keys=@() } + } + if ($items.Count -gt 1) { throw "Exchange Online recipient not unique: $Upn" } + if ($items.Count -eq 0) { return @{ Found=$false; Type=$null; Keys=@() } } + $type = [string](V $items[0] 'RecipientTypeDetails') + if (-not $type) { throw "Recipient type not returned: $Upn" } + $oid=[string](V $items[0] 'ExternalDirectoryObjectId' ''); $smtp=[string](V $items[0] 'PrimarySmtpAddress' '') + $parsed=[guid]::Empty + if (-not [guid]::TryParse($oid,[ref]$parsed) -or $parsed -eq [guid]::Empty -or [string]::IsNullOrWhiteSpace($smtp)) { throw "Recipient identity incomplete: $Upn" } + $expected=V (V $P 'ExpectedIdentities' @{}) $Upn + if ($null -ne $expected -and ($oid -ne (V $expected 'ObjectId') -or $smtp -ne (V $expected 'PrimarySmtpAddress'))) { throw "Recipient identity changed since the pre-check: $Upn" } + $keys = @($Upn) + @(foreach ($key in @('UserPrincipalName','PrimarySmtpAddress','ExternalDirectoryObjectId','Guid','DistinguishedName','Identity','Alias','Name','DisplayName','Sid','SamAccountName')) { + $val = [string](V $items[0] $key); if (-not [string]::IsNullOrWhiteSpace($val)) { $val } + }) + return @{ Found=$true; Type=$type; Keys=@($keys | Select-Object -Unique); ObjectId=$oid; PrimarySmtpAddress=$smtp } + } + function Mailbox { + param([string]$Upn,[switch]$Hold) + $grantParameters = @{ Filter=(ExactFilter $Upn); Properties=@('RecipientTypeDetails'); ResultSize='Unlimited' } + if ($Hold) { $grantParameters.Properties += @('IsInactiveMailbox','InPlaceHolds','LitigationHoldEnabled','RetentionHoldEnabled') } + $items = @(Get-EXOMailbox @grantParameters -ErrorAction Stop) + if ($Hold -and $items.Count -eq 0) { $items = @(Get-EXOMailbox @grantParameters -InactiveMailboxOnly -ErrorAction Stop) } + if ($items.Count -gt 1) { throw "Exchange Online mailbox not unique: $Upn" } + if ($items.Count -eq 0) { return @{ Found=$false; Type=$null; Holds=@(); IsInactive=$false; Litigation=$false; RetentionHold=$false } } + $m = $items[0]; $type = [string](V $m 'RecipientTypeDetails') + if (-not $type) { throw "Mailbox type not returned: $Upn" } + $holds = V -Object $m -Name 'InPlaceHolds' -Default @() + return @{ Found=$true; Type=$type; Holds=@($holds | Where-Object { $null -ne $_ }); IsInactive=[bool](V -Object $m -Name 'IsInactiveMailbox' -Default $false) + Litigation=[bool](V -Object $m -Name 'LitigationHoldEnabled' -Default $false); RetentionHold=[bool](V -Object $m -Name 'RetentionHoldEnabled' -Default $false) } + } + function NormalizeAcl { + param([object[]]$Entries,[string]$Right,$Target) + $field=if ($Right -eq 'FullAccess') { 'User' } else { 'Trustee' } + foreach ($entry in $Entries) { + foreach ($key in @('Identity',$field,'AccessRights','IsInherited')) { + if ($null -eq (V $entry $key)) { throw "$Right permission entry: field $key missing or null" } + } + $identity=[string](V $entry 'Identity'); $principal=[string](V $entry $field) + $inherited=V $entry 'IsInherited'; $rawRights=V $entry 'AccessRights'; $rawRights=@($rawRights) + if ($identity -notin $Target.Keys -or [string]::IsNullOrWhiteSpace($principal) -or $inherited -isnot [bool] -or $rawRights.Count -eq 0) { throw "Unexpected $Right permission entry (format or identity)." } + $rights=@(foreach ($access in $rawRights) { + if (($access -isnot [string] -and $access -isnot [enum]) -or [string]::IsNullOrWhiteSpace([string]$access)) { throw "Invalid $Right access right type." } + [string]$access + }) + if ($Right -eq 'FullAccess') { + $deny=V $entry 'Deny' + if ($deny -is [System.Management.Automation.SwitchParameter]) { $deny=$deny.IsPresent } + if ($deny -isnot [bool]) { throw 'Invalid FullAccess Deny value.' } + $control=if ($deny) { 'Deny' } else { 'Allow' } + } else { + $rawControl=V $entry 'AccessControlType' + if ($rawControl -isnot [string] -and $rawControl -isnot [enum]) { throw 'Invalid AccessControlType type.' } + $control=[string]$rawControl + if ($control -notin @('Allow','Deny')) { throw 'Invalid AccessControlType value.' } + } + if ($control -eq 'Deny' -and $Right -in $rights) { throw "A $Right Deny entry exists: grant refused." } + [pscustomobject]@{ Identity=$identity; Principal=$principal; Rights=$rights; Control=$control; Inherited=$inherited } + } + } + function AclKey { + param($Entry) + return ($Entry.Principal+'|'+$Entry.Control+'|'+$Entry.Inherited+'|'+(($Entry.Rights | ForEach-Object { $_.ToLowerInvariant() } | Sort-Object) -join ',')).ToLowerInvariant() + } + function MissingFullAccess { + param([System.Management.Automation.ErrorRecord]$Record,[string]$Trustee) + $json=[regex]::Match($Record.Exception.Message,'(?s)\{\s*"error"\s*:\s*\{.*\}\s*\}') + if (-not $json.Success) { return $false } + try { + $payload=$json.Value | ConvertFrom-Json -ErrorAction Stop + $expected='No permissions were found for the user:'+$Trustee + return ($payload.error.code -ceq 'NotFound' -and $payload.error.message -ceq $expected -and + $payload.error.innererror.message -ceq $expected -and $payload.error.innererror.type -ceq 'Microsoft.Exchange.Admin.OData.Core.ODataServiceException') + } catch { return $false } + } + function Permission { + param([string]$Upn,[string]$Trustee,[string]$Right,$Recipient,$Target,[switch]$AllowPendingVisibility) + if ($Right -in @('FullAccess','SendAs')) { + $globalRaw=@(if ($Right -eq 'FullAccess') { Get-EXOMailboxPermission -Identity $Upn -ErrorAction Stop -WarningAction Stop } + else { Get-EXORecipientPermission -Identity $Upn -ErrorAction Stop -WarningAction Stop }) + if ($globalRaw.Count -eq 0 -or $globalRaw.Count -ge 1000) { throw "$Right permission list empty or possibly truncated." } + $globalEntries=@(NormalizeAcl $globalRaw $Right $Target) + if (-not @($globalEntries | Where-Object { $_.Principal -in @('NT AUTHORITY\SELF','S-1-5-10') -and $Right -in $_.Rights -and -not $_.Inherited }).Count) { throw "$Right permission list without the expected SELF entry." } + $expectedEntries=@($globalEntries | Where-Object { $Right -in $_.Rights -and $_.Principal -in $Recipient.Keys }) + # "No permissions were found" is the normal answer before a grant. It is read through -ErrorVariable, + # not -ErrorAction Stop, so that Windows PowerShell does not write it as an error in the transcript. + # Every error record is still checked: anything else than that exact answer stops, as before. + $filteredErrors=$null + $filteredRaw=@(if ($Right -eq 'FullAccess') { Get-EXOMailboxPermission -Identity $Upn -User $Trustee -ErrorAction SilentlyContinue -ErrorVariable filteredErrors -WarningAction Stop } + else { Get-EXORecipientPermission -Identity $Upn -Trustee $Trustee -ErrorAction Stop -WarningAction Stop }) + $filteredErrors=@($filteredErrors | Where-Object { $null -ne $_ }) + if ($filteredErrors.Count) { + foreach ($record in $filteredErrors) { + if ($record -isnot [System.Management.Automation.ErrorRecord] -or -not (MissingFullAccess $record $Trustee)) { throw $record } + } + if ($expectedEntries.Count -gt 0) { if ($AllowPendingVisibility) { return $false }; throw $filteredErrors[0] } + $filteredRaw=@() + } + $entries=@(NormalizeAcl $filteredRaw $Right $Target) + foreach ($entry in $entries) { if ($entry.Principal -notin $Recipient.Keys) { throw "Filtered $Right read inconsistent for $Trustee." } } + $actualEntries=@($entries | Where-Object { $Right -in $_.Rights }) + $expected=@($expectedEntries | ForEach-Object { AclKey $_ } | Sort-Object) + $actual=@($actualEntries | ForEach-Object { AclKey $_ } | Sort-Object) + if (($expected | ConvertTo-Json -Compress) -cne ($actual | ConvertTo-Json -Compress)) { + if ($AllowPendingVisibility -and (($expected.Count -eq 0) -xor ($actual.Count -eq 0))) { return $false } + throw "Full and filtered $Right reads disagree for $Trustee." + } + return (@($actualEntries | Where-Object { -not $_.Inherited -and $_.Control -eq 'Allow' }).Count -gt 0) + } + $mb = @(Get-Mailbox -Filter (ExactFilter $Upn) -ResultSize Unlimited -ErrorAction Stop) + if ($mb.Count -ne 1) { throw "Mailbox not unique for the SendOnBehalf read: $Upn" } + $delegates=V -Object $mb[0] -Name 'GrantSendOnBehalfTo' -Default @() + foreach ($delegate in $delegates) { + if ($null -eq $delegate) { continue } + $ids = @([string]$delegate, [string](V $delegate 'DistinguishedName'), [string](V $delegate 'ObjectGuid')) + if (@($ids | Where-Object { $_ -and $_ -in $Recipient.Keys }).Count) { return $true } + # Exchange Online can return an ADObjectId as a Name: exact resolution, an ambiguity stops. + $name = ([string]$delegate).Replace("'","''") + $resolved = @(Get-EXORecipient -Filter "Name -eq '$name'" -Properties Guid,DistinguishedName,ExternalDirectoryObjectId -ResultSize Unlimited -ErrorAction Stop) + if ($resolved.Count -gt 1) { throw "SendOnBehalf delegate not unique: $delegate" } + foreach ($r in $resolved) { + foreach ($key in @('Guid','DistinguishedName','ExternalDirectoryObjectId')) { + $id = [string](V $r $key); if ($id -and $id -in $Recipient.Keys) { return $true } + } + } + } + return $false + } + $binding=Session + if ($Operation -eq 'Probe') { [void]$binding.Remove('Command'); return @{ Connected=$true; Binding=$binding } } + $SessionBinding=$binding + $upn = [string](V $P 'Upn') + if ($Operation -eq 'Preflight') { + $target=Recipient $upn + if (-not $target.Found) { throw "Target not found in Exchange Online at the pre-check: $upn" } + $identities=@{}; $identities[$upn]=$target + $requests=V $P 'Requests' @() + foreach ($request in @($requests)) { + $trustee=[string](V $request 'Trustee'); $right=[string](V $request 'Right') + $null=Session $right + $resolved=Recipient $trustee + if (-not $resolved.Found) { throw "Trustee not found in Exchange Online at the pre-check: $trustee" } + if ($resolved.ObjectId -eq $target.ObjectId) { throw 'A mailbox cannot be delegated to itself.' } + $identities[$trustee]=$resolved + } + return @{ Found=$true; Type=$target.Type; Identities=$identities } + } + switch ($Operation) { + 'Mailbox' { return (Mailbox $upn) } + 'Recipient' { return (Recipient $upn) } + 'Hold' { return (Mailbox $upn -Hold) } + } + $trustee = [string](V $P 'Trustee'); $right = [string](V $P 'Right') + if ($right -notin @('FullAccess','SendAs','SendOnBehalf')) { throw 'Unknown permission.' } + if ($Operation -eq 'Grant') { + foreach ($flag in @('AllowMutation','Approved','Authorized','JournalStarted')) { + $b = V -Object $Permit -Name $flag -Default $false + if ($b -isnot [bool] -or -not $b) { throw 'Exchange Online grant without its individual authorisation.' } + } + if ((V $Permit 'Target') -cne $upn -or (V $Permit 'Trustee') -cne $trustee -or (V $Permit 'Right') -cne $right -or + (V $Permit 'Action') -ne 'Convert' -or (V $Permit 'Mode') -ne 'Apply' -or (V $Permit 'Phase') -notin @('Cloud','Both')) { throw 'Exchange Online authorisation does not match this grant.' } + if ((Mailbox $upn).Type -ne 'SharedMailbox') { throw 'Grant refused: SharedMailbox not confirmed.' } + } + $rcpt = Recipient $trustee + if (-not $rcpt.Found) { + if ($Operation -eq 'Grant') { throw "Trustee no longer in Exchange Online: $trustee" } + return @{ TrusteeFound=$false; Verified=$false; Mutated=$false } + } + $target=Recipient $upn + if (-not $target.Found) { throw "Target not found in Exchange Online: $upn" } + if ($Operation -eq 'Grant' -and $target.Type -ne 'SharedMailbox') { throw 'Grant refused: SharedMailbox recipient not confirmed.' } + if ($target.ObjectId -eq $rcpt.ObjectId) { throw 'A mailbox cannot be delegated to itself.' } + $ok = Permission -Upn $upn -Trustee $trustee -Right $right -Recipient $rcpt -Target $target + if ($Operation -eq 'Permission' -or $ok) { return @{ TrusteeFound=$true; Verified=[bool]$ok; Mutated=$false } } + $attempts=V $P 'GrantVerifyAttempts' 13; $delay=V $P 'GrantVerifyDelaySeconds' 10 + if (($attempts -isnot [int] -and $attempts -isnot [long]) -or $attempts -lt 1 -or $attempts -gt 60 -or + ($delay -isnot [int] -and $delay -isnot [long]) -or $delay -lt 1 -or $delay -gt 30) { throw 'Invalid Exchange Online verification cadence (1..60 reads, 1..30 seconds).' } + if ($OnApplied -isnot [scriptblock]) { throw 'The Applied journal callback is required before an Exchange Online grant.' } + $write=Session $right + switch ($right) { + 'FullAccess' { & $write.Command -Identity $upn -User $trustee -AccessRights FullAccess -AutoMapping:([bool](V -Object $P -Name 'AutoMapping' -Default $false)) -InheritanceType All -Confirm:$false -ErrorAction Stop | Out-Null } + 'SendAs' { & $write.Command -Identity $upn -Trustee $trustee -AccessRights SendAs -Confirm:$false -ErrorAction Stop | Out-Null } + 'SendOnBehalf' { & $write.Command -Identity $upn -GrantSendOnBehalfTo @{ Add=$trustee } -Confirm:$false -ErrorAction Stop | Out-Null } + } + # Add returned. Persist this fact before any eventual-consistency read, never repeat Add. + try { + $null=& $OnApplied + for ($attempt=1; $attempt -le $attempts; $attempt++) { + $null=Session + $currentTarget=Recipient $upn; $currentTrustee=Recipient $trustee + foreach ($pair in @(@($target,$currentTarget),@($rcpt,$currentTrustee))) { + if (-not $pair[1].Found -or $pair[0].ObjectId -ne $pair[1].ObjectId -or $pair[0].PrimarySmtpAddress -ne $pair[1].PrimarySmtpAddress -or $pair[0].Type -ne $pair[1].Type) { throw 'Exchange Online identity changed during the verification.' } + } + if ((Mailbox $upn).Type -ne 'SharedMailbox') { throw 'SharedMailbox lost during the verification.' } + if (Permission -Upn $upn -Trustee $trustee -Right $right -Recipient $currentTrustee -Target $currentTarget -AllowPendingVisibility) { + return @{ TrusteeFound=$true; Verified=$true; Mutated=$true; Error='' } + } + if ($attempt -lt $attempts) { Start-Sleep -Seconds $delay } + } + throw "$right added but not verified after $attempts reads: $upn / $trustee" + } catch { return @{ TrusteeFound=$true; Verified=$false; Mutated=$true; Error=('Add returned, verification failed: '+$_.Exception.Message) } } +} + +function Get-PraCloudSession { + param([hashtable]$Context) + if (-not $Context.ContainsKey('_PraCloudSession')) { + $Context['_PraCloudSession'] = @{ GraphAttempted=$false; ExoAttempted=$false; Graph=$false; Exo=$false; Subprocess=$false + Binding=$null; OwnedExoIds=@(); GraphContext=$null; Identities=@{}; Preflight=$false } + } + return $Context['_PraCloudSession'] +} + +function Write-PraCloudError { + param([hashtable]$Context,$Row,[string]$Message) + if ($null -ne $Row) { + $Row.CloudStatus='Error'; $Row.FinalStatus='Error'; $Row.CloudDetail=$Message + if ($null -ne $Row.PSObject.Properties['DeprovisionConfirmed']) { $Row.DeprovisionConfirmed=$false } + $Row.Detail = ([string](Get-PraValue $Row 'Detail' '') + ' | cloud: ' + $Message).Trim(' ','|') + $Context.CurrentIdentity=[string](Get-PraValue $Row 'ObjectGuid' (Get-PraValue $Row 'UserPrincipalName' '')) + } + # Recorded here, whatever the logger does with Issues. + [void]$Context.Issues.Add([pscustomobject]@{ Timestamp=(Get-Date).ToString('o'); Phase=$Context.CurrentPhase + Source='Cloud'; Operation=$Context.CurrentOperation; Identity=$Context.CurrentIdentity; Message=$Message }) + $null = Write-PraLog -Context $Context -Message $Message -Level Warning +} + +function Invoke-PraExoSubprocess { + param([hashtable]$Context,[string]$Operation,[hashtable]$Params,$Permit,$OnApplied) + $cloud = Get-PraValue $Context.Config 'Cloud' @{} + $id = [guid]::NewGuid().ToString('N') + $appliedPath=Join-Path ([IO.Path]::GetTempPath()) ('praexo_'+$id+'.applied.json') + $request = @{ Protocol=1; Id=$id; Operation=$Operation; Params=$Params; Permit=$Permit; AppliedPath=$appliedPath + TenantId=(Get-PraValue $cloud 'TenantId' ''); DisableWAM=(Get-PraValue (Get-PraValue $Context.Config 'Exo' @{}) 'DisableWAM' $false) + AppId=(Get-PraValue $cloud 'AppId' ''); Thumb=(Get-PraValue $cloud 'CertificateThumbprint' ''); Org=(Get-PraValue $cloud 'Organization' '') } + $b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes(($request | ConvertTo-Json -Depth 12 -Compress))) + $child = @' +$ErrorActionPreference='Stop' +Set-StrictMode -Version Latest +[Console]::OutputEncoding = New-Object Text.UTF8Encoding($false) +$ProgressPreference='SilentlyContinue' +$cfg=$null; $data=$null; $failure=''; $attempted=$false; $ownedIds=@() +try { + $cfg = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('__REQUEST__')) | ConvertFrom-Json -ErrorAction Stop + if ($cfg.Protocol -ne 1 -or $cfg.Id -notmatch '^[a-f0-9]{32}$') { throw 'Invalid Exchange Online request.' } + Import-Module ExchangeOnlineManagement -ErrorAction Stop + if (@(Get-ConnectionInformation -ErrorAction Stop).Count) { throw 'The Exchange Online child process is not clean.' } + $connect=@{ AppId=$cfg.AppId; CertificateThumbprint=$cfg.Thumb; Organization=$cfg.Org; ShowBanner=$false; ErrorAction='Stop' } + if ($cfg.DisableWAM) { + if (-not (Get-Command Connect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('DisableWAM')) { throw 'DisableWAM is not supported by this ExchangeOnlineManagement.' } + $connect.DisableWAM=$true + } + $attempted=$true + try { Connect-ExchangeOnline @connect | Out-Null } + finally { $ownedIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) } + $worker = { +__WORKER__ + } + $probe=& $worker 'Probe' @{ TenantId=$cfg.TenantId; Organization=$cfg.Org; AppId=$cfg.AppId } $null $null $null + $onApplied={ + $text=@{ Protocol=1; Id=$cfg.Id; Status='Applied'; Target=$cfg.Params.Upn; Trustee=$cfg.Params.Trustee; Right=$cfg.Params.Right } | ConvertTo-Json -Compress + $stream=New-Object IO.FileStream($cfg.AppliedPath,[IO.FileMode]::CreateNew,[IO.FileAccess]::Write,[IO.FileShare]::None) + try { $bytes=[Text.Encoding]::UTF8.GetBytes($text); $stream.Write($bytes,0,$bytes.Length); $stream.Flush($true) } finally { $stream.Dispose() } + } + $results = @(& $worker $cfg.Operation $cfg.Params $cfg.Permit $probe.Binding $onApplied) + if ($results.Count -ne 1) { throw 'Exchange Online result not unique.' } + $data=$results[0] +} catch { $failure=$_.Exception.Message } +finally { + if ($attempted) { + try { + foreach ($ownedId in $ownedIds) { + if (-not $ownedId) { throw 'Own connection ID missing: a global sign-out is not allowed.' } + Disconnect-ExchangeOnline -ConnectionId $ownedId -Confirm:$false -ErrorAction Stop 6>$null | Out-Null + } + } + catch { $failure += ' | Exchange Online sign-out: ' + $_.Exception.Message } + } +} +$correlation = if ($null -ne $cfg) { $cfg.Id } else { '' } +[Console]::Out.WriteLine(([ordered]@{ Protocol=1; Id=$correlation; Ok=($failure -eq ''); Data=$data; Error=$failure } | ConvertTo-Json -Depth 12 -Compress)) +if ($failure) { exit 1 }; exit 0 +'@ + $child = $child.Replace('__REQUEST__',$b64).Replace('__WORKER__',$script:PraExoWorker.ToString()) + $tmp = Join-Path ([IO.Path]::GetTempPath()) ('praexo_'+$id+'.ps1') + $process = $null; $started=$false + try { + [IO.File]::WriteAllText($tmp,$child,(New-Object Text.UTF8Encoding($true))) + $exe = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe' + $si = New-Object Diagnostics.ProcessStartInfo + $si.FileName=$exe; $si.Arguments='-NoProfile -NonInteractive -ExecutionPolicy Bypass -File "'+$tmp+'"' + $si.UseShellExecute=$false; $si.CreateNoWindow=$true; $si.RedirectStandardOutput=$true; $si.RedirectStandardError=$true + $si.StandardOutputEncoding=New-Object Text.UTF8Encoding($false); $si.StandardErrorEncoding=New-Object Text.UTF8Encoding($false) + $process = New-Object Diagnostics.Process; $process.StartInfo=$si + $started=$process.Start() + if (-not $started) { throw 'The Exchange Online child process cannot start.' } + $stdout = $process.StandardOutput.ReadToEndAsync(); $stderr = $process.StandardError.ReadToEndAsync() + $wait = [int][Math]::Min(2147483647,([Math]::Max(1,[int]$Context.TimeoutMinutes)*60000.0)) + $timedOut = -not $process.WaitForExit($wait) + if ($timedOut) { $process.Kill(); $process.WaitForExit() } + $out = $stdout.GetAwaiter().GetResult().Trim(); $err = $stderr.GetAwaiter().GetResult().Trim() + if ($timedOut) { throw "Exchange Online timeout; write state unknown. stderr=[$err], stdout=[$out]" } + if ($process.ExitCode -ne 0 -or $err) { throw "Exchange Online child process code=$($process.ExitCode), stderr=[$err], stdout=[$out]" } + if (-not $out.StartsWith('{') -or -not $out.EndsWith('}') -or $out -match '[\r\n]') { throw 'Exchange Online child output is not the expected one-line JSON.' } + $res = $out | ConvertFrom-Json -ErrorAction Stop + if (@($res.PSObject.Properties.Name).Count -ne 5 -or (Get-PraValue $res 'Protocol' 0) -ne 1 -or + (Get-PraValue $res 'Id' '') -cne $id -or (Get-PraValue $res 'Ok' $false) -isnot [bool] -or + (Get-PraValue $res 'Ok' $false) -ne $true -or (Get-PraValue $res 'Error' 'invalid') -ne '') { throw 'Exchange Online child result invalid or failed.' } + $data = Get-PraValue $res 'Data' $null + if ($null -eq $data) { throw 'Exchange Online result missing.' } + return $data + } finally { + try { + if ($null -ne $process) { + try { if ($started -and -not $process.HasExited) { $process.Kill(); $process.WaitForExit() } } + finally { $process.Dispose() } + } + } finally { + try { + # Child's durable Applied receipt survives timeout/protocol/verification failures. + if ([IO.File]::Exists($appliedPath)) { + $receipt=[IO.File]::ReadAllText($appliedPath) | ConvertFrom-Json -ErrorAction Stop + if ($Operation -ne 'Grant' -or $receipt.Protocol -ne 1 -or $receipt.Id -cne $id -or $receipt.Status -cne 'Applied' -or + $receipt.Target -cne $Params.Upn -or $receipt.Trustee -cne $Params.Trustee -or $receipt.Right -cne $Params.Right -or $OnApplied -isnot [scriptblock]) { throw 'Invalid Applied receipt from the Exchange Online child process.' } + $null=& $OnApplied + [IO.File]::Delete($appliedPath) + } + } finally { if ([IO.File]::Exists($tmp)) { [IO.File]::Delete($tmp) } } + } + } +} + +function Invoke-PraExo { + param([hashtable]$Context,[ValidateSet('Probe','Preflight','Mailbox','Recipient','Hold','Permission','Grant')][string]$Operation,[hashtable]$Params=@{},$Permit=$null,$OnApplied=$null) + $session = Get-PraCloudSession $Context + if (-not $session.Exo) { throw 'Exchange Online connection required but not available.' } + if (-not $session.Subprocess -and [string](Get-PraValue (Get-PraValue $session 'Binding' $null) 'TenantId' '') -ne + [string](Get-PraValue (Get-PraValue $Context.Config 'Cloud' @{}) 'TenantId' '')) { throw 'Exchange Online tenant of the session differs from Cloud.TenantId.' } + if ($Operation -eq 'Grant' -and ($null -eq $Permit -or $Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or + $Context.Mode -ne 'Apply' -or $Context.Action -ne 'Convert' -or $Context.Phase -notin @('Cloud','Both') -or $WhatIfPreference)) { throw 'Grant without an active write authorisation.' } + $Params=$Params.Clone() + $Params.ExpectedIdentities=Get-PraValue $session 'Identities' @{} + if ($Operation -eq 'Grant') { + $exo=Get-PraValue $Context.Config 'Exo' @{} + $Params.GrantVerifyAttempts=Get-PraValue $exo 'GrantVerifyAttempts' 13 + $Params.GrantVerifyDelaySeconds=Get-PraValue $exo 'GrantVerifyDelaySeconds' 10 + } + $results = @(if ($session.Subprocess) { Invoke-PraExoSubprocess -Context $Context -Operation $Operation -Params $Params -Permit $Permit -OnApplied $OnApplied } + else { & $script:PraExoWorker $Operation $Params $Permit (Get-PraValue $session 'Binding' $null) $OnApplied }) + if ($results.Count -ne 1) { throw 'Exchange Online result not unique.' } + $result=$results[0] + $booleans=switch ($Operation) { 'Probe' { 'Connected' }; 'Permission' { 'TrusteeFound'; 'Verified' }; 'Grant' { 'TrusteeFound'; 'Verified'; 'Mutated' }; default { 'Found' } } + foreach ($key in $booleans) { if ((Get-PraValue $result $key $null) -isnot [bool]) { throw "Invalid Exchange Online result: $key must be a boolean." } } + if ($Operation -in @('Mailbox','Recipient','Hold') -and (Get-PraValue $result 'Found' $false) -and -not [string](Get-PraValue $result 'Type' '')) { throw 'Exchange Online result without type.' } + return $result +} + +function Connect-PraCloudSession { + param([hashtable]$Context,[bool]$NeedGraph,[bool]$NeedExo) + $s = Get-PraCloudSession $Context; $cloud=Get-PraValue $Context.Config 'Cloud' @{} + $app=[string](Get-PraValue $cloud 'AppId' ''); $thumb=[string](Get-PraValue $cloud 'CertificateThumbprint' '') + $tenant=[string](Get-PraValue $cloud 'TenantId' ''); $parsed=[guid]::Empty + if (($NeedGraph -or $NeedExo) -and (-not [guid]::TryParse($tenant,[ref]$parsed) -or $parsed -eq [guid]::Empty)) { throw 'Cloud.TenantId (GUID of the tenant) is required.' } + if ([bool]$app -ne [bool]$thumb) { throw 'Certificate sign-in incomplete: set both Cloud.AppId and Cloud.CertificateThumbprint.' } + if ($NeedGraph -and $s.Graph) { Assert-PraGraphSession $Context } + if ($NeedExo -and $s.Exo) { $null=Invoke-PraExo -Context $Context -Operation Probe } + # Graph must establish its CLR dependencies before EXO in this dedicated process. + # Removing a module cannot repair an already-loaded conflicting assembly. + if ($NeedGraph -and -not $s.Graph) { + $Context.CurrentOperation='Connect-MgGraph' + Import-Module Microsoft.Graph.Authentication -ErrorAction Stop + Import-Module Microsoft.Graph.Users -ErrorAction Stop + if ($null -ne (Get-MgContext -ErrorAction Stop)) { throw 'A Microsoft Graph session already exists in this console: run the tool in a new Windows PowerShell window.' } + $connect=@{ TenantId=$tenant; ContextScope='Process'; NoWelcome=$true; ErrorAction='Stop' } + if ($app) { $connect.ClientId=$app; $connect.CertificateThumbprint=$thumb } else { $connect.Scopes=@('User.Read.All') } + $s.GraphAttempted=$true + try { Connect-MgGraph @connect | Out-Null } + catch { + # Typical when Exchange Online was used earlier in the same console: its assemblies stay loaded. + if ($_.Exception.Message -match 'does not have an implementation|Could not load (type|file or assembly)|Method not found') { + throw ('Microsoft Graph cannot load in this console (assembly conflict, usually because Exchange Online was used earlier in the same window): run the tool in a new Windows PowerShell window. Detail: '+$_.Exception.Message) + } + throw + } + finally { $s.GraphContext=Get-MgContext -ErrorAction Stop } + $s.Graph=$true + Assert-PraGraphSession $Context + $null = Write-PraLog -Context $Context -Message ('Microsoft Graph connected ({0}, tenant verified)' -f $(if ($app) { 'certificate' } else { [string](Get-PraValue $s.GraphContext 'Account' 'interactive') })) -Level Success + } + if ($NeedExo -and -not $s.Exo) { + $Context.CurrentOperation='Connect-ExchangeOnline' + $exo = Get-PraValue $Context.Config 'Exo' @{} + $min = [version][string](Get-PraValue $exo 'MinModuleVersion' '3.10.0') + $installed = @(Get-Module ExchangeOnlineManagement -ListAvailable | Sort-Object Version -Descending) + if ($installed.Count -eq 0) { throw 'ExchangeOnlineManagement module not found (Install-Module ExchangeOnlineManagement -MinimumVersion 3.10.0 -Scope AllUsers -Force); the tool never installs modules.' } + $s.Subprocess = [bool](Get-PraValue $exo 'UseSubprocess' $false) -or $installed[0].Version -lt $min + if ($s.Subprocess) { + if (-not $app) { throw 'Exchange Online child process required (Exo.UseSubprocess or old module): certificate sign-in is mandatory.' } + $s.Exo=$true + $probe = Invoke-PraExo $Context 'Probe' + if ((Get-PraValue $probe 'Connected' $false) -ne $true) { throw 'Exchange Online child process connection not confirmed.' } + } else { + Import-Module ExchangeOnlineManagement -MinimumVersion $min -ErrorAction Stop + if (@(Get-ConnectionInformation -ErrorAction Stop).Count) { throw 'An Exchange Online session already exists in this console: run the tool in a new Windows PowerShell window (nothing was signed out).' } + if (-not (Get-Command Disconnect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('ConnectionId')) { throw 'This ExchangeOnlineManagement cannot sign out one connection (ConnectionId): update the module.' } + $connect=@{ ShowBanner=$false; ErrorAction='Stop' } + if ($app) { $connect.AppId=$app; $connect.CertificateThumbprint=$thumb; $connect.Organization=Get-PraValue $cloud 'Organization' '' } + else { + $upn=[string](Get-PraValue $cloud 'UserPrincipalName' '') + if ($upn) { + if (-not (Get-Command Connect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('UserPrincipalName')) { throw 'Cloud.UserPrincipalName is not supported by this ExchangeOnlineManagement.' } + $connect.UserPrincipalName=$upn + } + } + $disableWam=Get-PraValue $exo 'DisableWAM' $false + if ($disableWam -isnot [bool]) { throw 'Exo.DisableWAM must be $true or $false.' } + if ($disableWam) { + if (-not (Get-Command Connect-ExchangeOnline -ErrorAction Stop).Parameters.ContainsKey('DisableWAM')) { throw 'Exo.DisableWAM is not supported by this ExchangeOnlineManagement.' } + $connect.DisableWAM=$true + } + $s.ExoAttempted=$true; $s.OwnedExoIds=$null + try { Connect-ExchangeOnline @connect | Out-Null } + finally { $s.OwnedExoIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) } + $probe=& $script:PraExoWorker 'Probe' @{ TenantId=$tenant; Organization=[string](Get-PraValue $cloud 'Organization' ''); AppId=$app } $null $null $null + $s.Binding=$probe.Binding; $s.Exo=$true + } + $null = Write-PraLog -Context $Context -Message ("Exchange Online connected ({0}{1})" -f $(if ($app) { 'certificate' } else { 'interactive' }), $(if ($s.Subprocess) { ', child process' } else { '' })) -Level Success + } +} + +function Assert-PraGraphSession { + param([hashtable]$Context) + $s=Get-PraCloudSession $Context; $current=Get-MgContext -ErrorAction Stop + $tenant=[string](Get-PraValue (Get-PraValue $Context.Config 'Cloud' @{}) 'TenantId' '') + if ($null -eq $current -or [string](Get-PraValue $current 'TenantId' '') -ne $tenant -or + [string](Get-PraValue $current 'ContextScope' '') -ne 'Process') { throw 'Microsoft Graph session missing, on another tenant or not limited to this process.' } + foreach ($key in @('TenantId','ClientId','Account','AuthType','ContextScope')) { + if ([string](Get-PraValue $current $key '') -cne [string](Get-PraValue $s.GraphContext $key '')) { throw 'The Microsoft Graph session changed.' } + } +} + +function Close-PraCloudSession { + <# + .SYNOPSIS + Signs out the sessions opened by this module; a sign-out failure is an error. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context) + if (-not $Context.ContainsKey('_PraCloudSession')) { return } + $s=$Context['_PraCloudSession']; $errors=New-Object 'System.Collections.Generic.List[string]' + if ($s.ExoAttempted) { + try { + if ($null -eq (Get-PraValue $s 'OwnedExoIds' $null)) { throw 'Own Exchange Online connections unknown: a global sign-out is not allowed.' } + $currentIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) + $ownedIds=Get-PraValue $s 'OwnedExoIds' @() + foreach ($id in @($ownedIds)) { + if (-not $id) { throw 'Own connection ID missing: a global sign-out is not allowed.' } + if ($id -in $currentIds) { Disconnect-ExchangeOnline -ConnectionId $id -Confirm:$false -ErrorAction Stop 6>$null | Out-Null } + } + $s.ExoAttempted=$false; $s.Exo=$false + } + catch { [void]$errors.Add('Exchange Online sign-out: '+$_.Exception.Message) } + } + if ($s.GraphAttempted) { + try { + $current=Get-MgContext -ErrorAction Stop + if ($null -ne $current) { + if ($null -eq (Get-PraValue $s 'GraphContext' $null)) { throw 'The Microsoft Graph session was not opened by the tool: not signed out.' } + foreach ($key in @('TenantId','ClientId','Account','AuthType','ContextScope')) { + if ([string](Get-PraValue $current $key '') -cne [string](Get-PraValue $s.GraphContext $key '')) { throw 'The Microsoft Graph session was replaced: not signed out.' } + } + Disconnect-MgGraph -ErrorAction Stop | Out-Null + } + $s.GraphAttempted=$false; $s.Graph=$false + } + catch { [void]$errors.Add('Microsoft Graph sign-out: '+$_.Exception.Message) } + } + if ($errors.Count) { + $Context.CloudConnectFailed=$true; $Context.CurrentOperation='Close-PraCloudSession' + Write-PraCloudError -Context $Context -Row $null -Message ($errors -join ' | ') + throw ($errors -join ' | ') + } + [void]$Context.Remove('_PraCloudSession') +} + +function Get-PraPermissionRequest { + param([hashtable]$Context,$Row) + if (-not [bool](Get-PraValue $Row 'IsShared' $false)) { return } + $cfg = Get-PraValue $Context.Config 'SharedMailbox' @{} + if (-not [bool](Get-PraValue $cfg 'Enabled' $false)) { return } + foreach ($right in @('FullAccess','SendAs','SendOnBehalf')) { + if ($right -ne 'SendOnBehalf' -and (Get-PraValue $cfg 'PermissionSource' 'None') -eq 'None') { continue } + if ([bool](Get-PraValue $cfg ('Grant'+$right) $false)) { + foreach ($u in @((Get-PraValue $Row ('Shared'+$right) @()) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Select-Object -Unique)) { + [pscustomobject]@{ Right=$right; Trustee=[string]$u } + } + } + } +} + +function Initialize-PraCloudPreflight { + <# + .SYNOPSIS + Signs in and resolves every target and trustee in Exchange Online BEFORE the AD part of a Convert (Apply, phase Both). Read only. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context,[Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows) + $Context.CurrentPhase='CloudPreflight'; $Context.CurrentOperation='Prepare'; $Context.CurrentIdentity='' + try { + if ($Context.Action -ne 'Convert' -or $Context.Mode -ne 'Apply' -or $Context.Phase -ne 'Both' -or + $Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or $WhatIfPreference) { throw 'The pre-check is only for Convert, Apply, phase Both.' } + if ($Context.CloudCheckScope -notin @('Both','MailboxOnly','LicenseOnly')) { throw 'Invalid CloudCheckScope.' } + $cloud=Get-PraValue $Context.Config 'Cloud' @{}; $exo=Get-PraValue $Context.Config 'Exo' @{} + foreach ($key in @('CheckMailbox','CheckLicense')) { if ((Get-PraValue $cloud $key $false) -isnot [bool]) { throw "Cloud.$key must be `$true or `$false." } } + foreach ($key in @('UseSubprocess','DisableWAM')) { if ((Get-PraValue $exo $key $false) -isnot [bool]) { throw "Exo.$key must be `$true or `$false." } } + $attempts=Get-PraValue $exo 'GrantVerifyAttempts' 13; $delay=Get-PraValue $exo 'GrantVerifyDelaySeconds' 10 + if (($attempts -isnot [int] -and $attempts -isnot [long]) -or $attempts -lt 1 -or $attempts -gt 60 -or + ($delay -isnot [int] -and $delay -isnot [long]) -or $delay -lt 1 -or $delay -gt 30) { throw 'Invalid Exchange Online verification cadence.' } + $via=[string](Get-PraValue $cloud 'MailboxCheckVia' 'Graph') + if ($via -notin @('Graph','Exo')) { throw 'Invalid Cloud.MailboxCheckVia.' } + $needGraph=$false + foreach ($row in $Rows) { + if ((Get-PraValue $row 'IsShared' $false) -isnot [bool] -or (Get-PraValue $row 'FinalStatus' '') -eq 'Error') { throw 'Invalid or failed row at the pre-check.' } + $shared=[bool](Get-PraValue $row 'IsShared' $false) + if (-not $shared -and (($Context.CloudCheckScope -ne 'MailboxOnly' -and (Get-PraValue $cloud 'CheckLicense' $false)) -or + ($Context.CloudCheckScope -ne 'LicenseOnly' -and (Get-PraValue $cloud 'CheckMailbox' $false) -and $via -eq 'Graph'))) { $needGraph=$true } + } + # EXO resolves each target even while it is still a MailUser; no provisioning assertion here. + Connect-PraCloudSession -Context $Context -NeedGraph $needGraph -NeedExo ($Rows.Count -gt 0) + $session=Get-PraCloudSession $Context + foreach ($row in $Rows) { + $upn=[string](Get-PraValue $row 'UserPrincipalName' '') + $Context.CurrentIdentity=$upn; $Context.CurrentOperation='ResolvePreflightIdentity' + $requests=@(Get-PraPermissionRequest $Context $row) + $result=Invoke-PraExo -Context $Context -Operation Preflight -Params @{ Upn=$upn; Requests=$requests } + $identities=Get-PraValue $result 'Identities' @{} + $names=if ($identities -is [System.Collections.IDictionary]) { @($identities.Keys) } else { @($identities.PSObject.Properties.Name) } + foreach ($name in $names) { + $identity=Get-PraValue $identities $name $null + $previous=Get-PraValue $session.Identities $name $null + if ($null -ne $previous -and ((Get-PraValue $previous 'ObjectId') -ne (Get-PraValue $identity 'ObjectId') -or + (Get-PraValue $previous 'PrimarySmtpAddress') -ne (Get-PraValue $identity 'PrimarySmtpAddress'))) { throw 'Contradictory identities at the pre-check.' } + $session.Identities[$name]=$identity + } + if ($needGraph -and -not [bool](Get-PraValue $row 'IsShared' $false)) { + Assert-PraGraphSession $Context + $users=@(Get-MgUser -UserId $upn -Property Id,UserPrincipalName -ErrorAction Stop) + $target=Get-PraValue $session.Identities $upn $null + if ($users.Count -ne 1 -or [string](Get-PraValue $users[0] 'Id' '') -ne [string](Get-PraValue $target 'ObjectId' '') -or + [string](Get-PraValue $users[0] 'UserPrincipalName' '') -ne $upn) { throw "Graph and Exchange Online identities differ at the pre-check: $upn" } + } + } + $session.Preflight=$true; $Context.CloudConnectFailed=$false + $null=Write-PraLog -Context $Context -Message ('Pre-check passed: {0} target(s) and their trustees resolved in Exchange Online (read only)' -f $Rows.Count) -Level Success + } catch { + $failure=$_.Exception.Message; $Context.CloudConnectFailed=$true + try { Close-PraCloudSession -Context $Context } catch { $failure+=' | sign-out after the pre-check: '+$_.Exception.Message } + throw $failure + } +} + +function Invoke-PraPermissionGrant { + param([hashtable]$Context,$Row,[hashtable]$Params) + if ($Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or + $Context.Action -ne 'Convert' -or $Context.Phase -notin @('Cloud','Both') -or $WhatIfPreference) { throw 'Permission missing and writes are not allowed in this mode.' } + $adVerified=Get-PraValue $Row 'ADVerified' $false + if ($adVerified -isnot [bool] -or -not $adVerified) { throw 'Grant refused: a verified AD proof is required.' } + foreach ($name in @('Approval','AssertCloudAuthorization','JournalMutation')) { + if ($Context[$name] -isnot [scriptblock]) { throw "Required callback missing: $name" } + } + $target=$Params.Upn; $operation="Grant $($Params.Right) to $($Params.Trustee)" + $Context.CurrentOperation=$operation; $Context.CurrentIdentity=[string](Get-PraValue $Row 'ObjectGuid' $target) + $approval = @(& $Context.Approval $target $operation) + if ($approval.Count -ne 1 -or $approval[0] -isnot [bool] -or -not $approval[0]) { throw "Grant refused or not confirmed: $operation" } + $proof = @(& $Context.AssertCloudAuthorization $Row) + if ($proof.Count -gt 1 -or ($proof.Count -eq 1 -and ($proof[0] -isnot [bool] -or -not $proof[0]))) { throw 'Backup/AD proof refused or ambiguous.' } + # The callbacks cannot re-open a forbidden mode before the call. + if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -ne 'Convert' -or $WhatIfPreference) { throw 'Authorisation revoked.' } + $detail="UPN=$target; Trustee=$($Params.Trustee); Right=$($Params.Right); ObjectGuid=$($Context.CurrentIdentity)" + $Row.LastOperation=$operation + $null = & $Context.JournalMutation $target $operation 'Started' $detail + $permit=@{ AllowMutation=$true; Approved=$true; Authorized=$true; JournalStarted=$true; Target=$target + Trustee=$Params.Trustee; Right=$Params.Right; Action=$Context.Action; Mode=$Context.Mode; Phase=$Context.Phase } + try { + $onApplied={ $null=& $Context.JournalMutation $target $operation 'Applied' ($detail+'; Add returned; verification pending') }.GetNewClosure() + $res = Invoke-PraExo -Context $Context -Operation 'Grant' -Params $Params -Permit $permit -OnApplied $onApplied + $verified=Get-PraValue $res 'Verified' $false + if ($verified -isnot [bool] -or -not $verified) { throw ([string](Get-PraValue $res 'Error' 'Permission re-read not confirmed.')) } + $null = & $Context.JournalMutation $target $operation 'Verified' ($detail+'; Mutated='+(Get-PraValue $res 'Mutated' $false)) + } catch { + $failure=$_.Exception.Message + try { $null = & $Context.JournalMutation $target $operation 'Failed' ($detail+'; '+$failure) } + catch { $failure += ' | journal line Failed not written: '+$_.Exception.Message } + throw $failure + } +} + +function Invoke-PraSharedPermission { + <# + .SYNOPSIS + Checks every permission of a shared mailbox in Exchange Online and grants the missing ones (Apply). + .DESCRIPTION + Trustees are always resolved strictly: a trustee missing in Exchange Online is an error. + Preview of a Convert: a missing permission is counted "to grant" (no error). + .OUTPUTS + Number of permissions still to grant (Preview only; 0 in Apply). + #> + [CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact='Low')] + param([hashtable]$Context,$Row,[object[]]$Requests) + $Row.PermMissing=@(); $verified=0; $toGrant=0; $missing=New-Object 'System.Collections.Generic.List[string]' + $cfg=Get-PraValue $Context.Config 'SharedMailbox' @{} + $upn=[string](Get-PraValue $Row 'UserPrincipalName' '') + $preview=($Context.Action -eq 'Convert' -and ($Context.Mode -ne 'Apply' -or -not $Context.AllowMutation -or $WhatIfPreference)) + foreach ($request in $Requests) { + $p=@{ Upn=$upn; Trustee=$request.Trustee; Right=$request.Right; AutoMapping=[bool](Get-PraValue $cfg 'AutoMapping' $false) } + $Row.PermDetail="Permissions verified=$verified/$($Requests.Count); current=$($request.Right)/$($request.Trustee)" + $r=Invoke-PraExo -Context $Context -Operation 'Permission' -Params $p + if ((Get-PraValue $r 'TrusteeFound' $false) -ne $true) { + if (-not $missing.Contains($request.Trustee)) { [void]$missing.Add($request.Trustee) } + $Row.PermMissing=$missing.ToArray(); continue + } + if ((Get-PraValue $r 'Verified' $false) -ne $true) { + if ($preview) { $toGrant++; continue } + if ($Context.AllowMutation -isnot [bool] -or -not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or + $Context.Action -ne 'Convert' -or $Context.Phase -notin @('Cloud','Both') -or $WhatIfPreference) { throw 'Permission missing and writes are not allowed in this mode.' } + # Native ShouldProcess per right; it never replaces the approval, proof and journal of the grant. + if (-not $PSCmdlet.ShouldProcess($upn,"Grant $($request.Right) to $($request.Trustee)")) { throw 'Exchange Online grant refused (ShouldProcess).' } + Invoke-PraPermissionGrant -Context $Context -Row $Row -Params $p + $null=Write-PraLog -Context $Context -Message ("{0}: {1} granted to {2} and verified" -f $upn,$request.Right,$request.Trustee) -Level Sub + } + $verified++ + } + $Row.PermDetail="Permissions verified=$verified/$($Requests.Count); to grant=$toGrant; trustees missing in Exchange Online=$($missing.Count)" + if ($missing.Count) { throw ($Row.PermDetail+': '+($missing -join ', ')) } + if (($verified+$toGrant) -ne $Requests.Count) { throw $Row.PermDetail } + return $toGrant +} + +function Get-PraGraphFact { + param([hashtable]$Context,[string]$Upn,[bool]$Mailbox,[bool]$License) + if (-not (Get-PraCloudSession $Context).Graph) { throw 'Microsoft Graph required but not connected.' } + Assert-PraGraphSession $Context + $props=@('assignedPlans'); if ($Mailbox) { $props+='provisionedPlans' }; if ($License) { $props+='assignedLicenses' } + $users=@(Get-MgUser -UserId $Upn -Property $props -ErrorAction Stop) + if ($users.Count -ne 1 -or $null -eq $users[0]) { throw "Microsoft Graph: user not found or not unique ($Upn)." } + $values=@{}; $sentinel=New-Object object + foreach ($prop in $props) { + $value=Get-PraValue $users[0] $prop $sentinel + if ([object]::ReferenceEquals($value,$sentinel)) { throw "Microsoft Graph: property not returned ($prop)." } + $values[$prop]=@($value | Where-Object { $null -ne $_ }) + } + foreach ($p in $values.assignedPlans) { + if (-not [string](Get-PraValue $p 'Service' '') -or -not [string](Get-PraValue $p 'CapabilityStatus' '')) { throw 'Microsoft Graph: incomplete assignedPlan, Exchange removal not proven.' } + } + if ($Mailbox) { + foreach ($p in $values.provisionedPlans) { + if (-not [string](Get-PraValue $p 'Service' '') -or -not [string](Get-PraValue $p 'ProvisioningStatus' '')) { throw 'Microsoft Graph: incomplete provisionedPlan.' } + } + } + $enabled=@($values.assignedPlans | Where-Object { (Get-PraValue $_ 'Service' '') -eq 'exchange' -and (Get-PraValue $_ 'CapabilityStatus' '') -eq 'Enabled' }).Count -gt 0 + $prov=$false; $plans=@(); $sku=@() + if ($Mailbox) { $prov=@($values.provisionedPlans | Where-Object { (Get-PraValue $_ 'Service' '') -eq 'exchange' -and (Get-PraValue $_ 'ProvisioningStatus' '') -eq 'Success' }).Count -gt 0 } + $required=[string](Get-PraValue (Get-PraValue $Context.Config 'Cloud' @{}) 'RequiredSkuPartNumber' '') + if ($Mailbox -or ($License -and $required)) { + $details=@(Get-MgUserLicenseDetail -UserId $Upn -All -ErrorAction Stop) + foreach ($d in $details) { + $sku += [string](Get-PraValue $d 'SkuPartNumber' '') + foreach ($p in @((Get-PraValue $d 'ServicePlans' @()) | Where-Object { (Get-PraValue $_ 'ServicePlanName' '') -like 'EXCHANGE_*' })) { + $status=[string](Get-PraValue $p 'ProvisioningStatus' '') + $plans += ([string](Get-PraValue $p 'ServicePlanName' '')+':'+$status) + if ($status -eq 'Success') { $prov=$true } + } + } + } + $count=0; if ($License) { $count=$values.assignedLicenses.Count } + return @{ Enabled=$enabled; Provisioned=$prov; LicenseCount=$count; RequiredSku=$required + RequiredSkuOk=(-not $required -or $required -in $sku); Detail=($plans -join ',') } +} + +function Invoke-PraCloudPhase { + <# + .SYNOPSIS + Checks (and waits for) the expected Exchange Online state of every row and, in Apply, grants the shared mailbox permissions. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context,[Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows, + [Parameter(Mandatory)][ValidateSet('Convert','Recover')][string]$Act) + $Context.CurrentPhase='Cloud'; $Context.CurrentOperation='Prepare'; $Context.CurrentIdentity=''; $Context.CloudConnectFailed=$false + $states=New-Object 'System.Collections.Generic.List[object]' + try { + $scope=[string]$Context.CloudCheckScope + if ($Context.Action -in @('Convert','Recover') -and $Context.Action -ne $Act) { throw 'Context action and -Act differ.' } + if ($scope -notin @('Both','MailboxOnly','LicenseOnly')) { throw 'Invalid CloudCheckScope.' } + if ([int]$Context.TimeoutMinutes -lt 0 -or [int]$Context.IntervalMinutes -lt 0) { throw 'Negative cloud polling values.' } + $cloud=Get-PraValue $Context.Config 'Cloud' @{} + $via=[string](Get-PraValue $cloud 'MailboxCheckVia' 'Graph') + if ($via -notin @('Graph','Exo')) { throw 'Invalid Cloud.MailboxCheckVia.' } + $needGraph=$false; $needExo=$false + foreach ($row in $Rows) { + Add-Member -InputObject $row -NotePropertyName DeprovisionConfirmed -NotePropertyValue $false -Force + $row.CloudMailbox=$null; $row.CloudLicense=$null; $row.CloudStatus='Pending'; $row.CloudDetail='' + $upn=[string](Get-PraValue $row 'UserPrincipalName' '') + if (-not $upn) { Write-PraCloudError -Context $Context -Row $row -Message 'UPN missing: check impossible.'; continue } + if ((Get-PraValue $row 'FinalStatus' '') -eq 'Error') { Write-PraCloudError -Context $Context -Row $row -Message 'Previous error: cloud part not allowed.'; continue } + $shared=[bool](Get-PraValue $row 'IsShared' $false) + $preserveMailbox=Get-PraValue $row 'PreserveCloudMailbox' $false; $preserveLicense=Get-PraValue $row 'PreserveLicense' $false + if ($preserveMailbox -isnot [bool] -or $preserveLicense -isnot [bool] -or ($preserveMailbox -and -not $shared)) { + Write-PraCloudError -Context $Context -Row $row -Message 'Invalid keep flags (PreserveCloudMailbox is for shared mailboxes only).'; continue + } + $requests=@(); if ($Act -eq 'Convert') { $requests=@(Get-PraPermissionRequest $Context $row) } + $mb=($scope -ne 'LicenseOnly') -and ([bool](Get-PraValue $cloud 'CheckMailbox' $false) -or $Act -eq 'Recover' -or $requests.Count -gt 0) + $lic=($scope -ne 'MailboxOnly') -and -not $shared -and [bool](Get-PraValue $cloud 'CheckLicense' $false) + if (-not $mb -and -not $lic) { + $row.CloudStatus='Skipped'; $row.CloudDetail='No applicable check; no restore confirmation.'; $row.FinalStatus='Skipped'; continue + } + $graphMailbox=$mb -and -not $shared -and $via -eq 'Graph' + $exoMailbox=$mb -and ($Act -eq 'Recover' -or $shared -or $via -eq 'Exo') + $needGraph=$needGraph -or $lic -or $graphMailbox; $needExo=$needExo -or $exoMailbox + [void]$states.Add(@{ Row=$row; Upn=$upn; Shared=$shared; Mailbox=$mb; License=$lic; GraphMailbox=$graphMailbox + ExoMailbox=$exoMailbox; Requests=$requests; PreserveMailbox=$preserveMailbox; PreserveLicense=$preserveLicense; Done=$false }) + } + if ($states.Count -eq 0) { return } + try { Connect-PraCloudSession -Context $Context -NeedGraph $needGraph -NeedExo $needExo } + catch { $Context.CloudConnectFailed=$true; throw } + $clock=[Diagnostics.Stopwatch]::StartNew(); $timeout=[double]$Context.TimeoutMinutes*60; $attempt=0 + do { + $attempt++; $pending=@($states | Where-Object { -not $_.Done }) + $null=Write-PraLog -Context $Context -Message ("Check {0}: {1} object(s) in Exchange Online" -f $attempt, $pending.Count) -Level Info + foreach ($s in $pending) { + $row=$s.Row; $Context.CurrentIdentity=[string](Get-PraValue $row 'ObjectGuid' $s.Upn); $Context.CurrentOperation='CloudCheck' + try { + $details=New-Object 'System.Collections.Generic.List[string]'; $mbok=$true; $licok=$true; $facts=$null + if ($s.GraphMailbox -or $s.License) { $facts=Get-PraGraphFact -Context $Context -Upn $s.Upn -Mailbox $s.GraphMailbox -License $s.License } + if ($s.ExoMailbox) { + $m=Invoke-PraExo -Context $Context -Operation 'Mailbox' -Params @{ Upn=$s.Upn } + if ($Act -eq 'Recover') { + if ($s.PreserveMailbox) { + $mbok=(Get-PraValue $m 'Found' $false) -eq $true -and (Get-PraValue $m 'Type' '') -eq 'SharedMailbox' + [void]$details.Add("MBX:KeepCloudShared SharedMailbox present=$mbok; deprovisioning NOT confirmed, tag kept") + } else { + $r=Invoke-PraExo -Context $Context -Operation 'Recipient' -Params @{ Upn=$s.Upn } + $mbok=(Get-PraValue $m 'Found' $true) -eq $false -and (Get-PraValue $r 'Found' $false) -eq $true -and (Get-PraValue $r 'Type' '') -eq 'MailUser' + [void]$details.Add("MBX:absence=$(-not [bool](Get-PraValue $m 'Found' $true)); recipient=$(Get-PraValue $r 'Type' 'none')") + if ($s.GraphMailbox) { [void]$details.Add("Graph:Enabled=$($facts.Enabled),Provisioned=$($facts.Provisioned) (Exchange Online is authoritative, Graph errors stop)") } + } + } else { + $type=[string](Get-PraValue $m 'Type' '') + $mbok=if ($s.Shared) { $type -eq 'SharedMailbox' } else { $type -in @('UserMailbox','SharedMailbox','RoomMailbox','EquipmentMailbox') } + [void]$details.Add("MBX:EXO type=$type") + } + } elseif ($s.GraphMailbox) { $mbok=$facts.Provisioned; [void]$details.Add("MBX:Graph provisioning=$mbok; Enabled=$($facts.Enabled) [$($facts.Detail)]") } + if ($s.Mailbox) { $row.CloudMailbox=[bool]$mbok } + if ($s.License) { + $licok=if ($Act -eq 'Convert' -or $s.PreserveLicense) { $facts.LicenseCount -gt 0 -and $facts.Enabled -and $facts.RequiredSkuOk } + elseif ($facts.RequiredSku) { -not $facts.RequiredSkuOk } else { -not $facts.Enabled } + $row.CloudLicense=[bool]$licok + [void]$details.Add("LIC:OK=$licok; Preserve=$($s.PreserveLicense); ExpectedSKU=$($facts.RequiredSku); SKUPresent=$($facts.RequiredSkuOk); licences=$($facts.LicenseCount); ExchangeEnabled=$($facts.Enabled)") + } elseif ($s.Shared) { [void]$details.Add('LIC:N/A (shared)') } + $row.CloudDetail=$details -join ' | ' + if ($mbok -and $licok) { + if ($Act -eq 'Recover' -and -not $s.ExoMailbox) { + $row.CloudStatus='Skipped'; $row.FinalStatus='Skipped'; $row.CloudDetail+=' | LicenseOnly: no Exchange Online confirmation, restore not allowed.' + } else { + $toGrant=0 + if ($s.Mailbox -and $s.Requests.Count) { $toGrant=[int](Invoke-PraSharedPermission -Context $Context -Row $row -Requests $s.Requests) } + $row.DeprovisionConfirmed=($Act -eq 'Recover' -and $s.ExoMailbox -and -not $s.PreserveMailbox) + if ($toGrant -gt 0) { + $row.CloudStatus='Planned'; $row.FinalStatus='Planned' + $null=Write-PraLog -Context $Context -Message ("{0}: SharedMailbox ready, {1} permission(s) to grant in Apply" -f $s.Upn, $toGrant) -Level Info + } else { + $row.CloudStatus='Success' + $row.FinalStatus=if ($Act -eq 'Recover' -and [bool](Get-PraValue $row 'DeproPending' $false)) { 'Pending' } else { 'Success' } + $what=if ($Act -eq 'Recover') { if ($s.PreserveMailbox) { 'shared mailbox kept in Exchange Online' } else { 'deprovisioned in Exchange Online (now a MailUser)' } } + elseif ($s.Shared) { 'SharedMailbox ready, ' + ([string]$row.PermDetail -replace '; to grant=0; trustees missing in Exchange Online=0', '') } + else { 'mailbox' + $(if ($s.License) { ' and licence' } else { '' }) + ' ready' } + $null=Write-PraLog -Context $Context -Message ("{0}: {1}" -f $s.Upn, $what) -Level Success + } + } + $s.Done=$true + } else { $row.CloudStatus='Pending' } + } catch { Write-PraCloudError -Context $Context -Row $row -Message ($_.Exception.Message+' | '+[string]$row.PermDetail); $s.Done=$true } + } + $pending=@($states | Where-Object { -not $_.Done }) + if (-not $pending.Count -or $Context.Once -or $clock.Elapsed.TotalSeconds -ge $timeout) { break } + $seconds=[Math]::Min([Math]::Max(1,([double]$Context.IntervalMinutes*60)),[Math]::Max(0,($timeout-$clock.Elapsed.TotalSeconds))) + $null=Write-PraLog -Context $Context -Message ("Not ready yet: {0} - next check in {1:0} s (waiting up to {2} min in total)" -f (($pending | ForEach-Object { $_.Upn }) -join ', '), $seconds, $Context.TimeoutMinutes) -Level Sub + foreach ($s in $pending) { $null=Write-PraLog -Context $Context -Message ("{0} | {1}" -f $s.Upn, $s.Row.CloudDetail) -Level Detail } + if ($seconds -gt 0) { Start-Sleep -Milliseconds ([int][Math]::Min(2147483647,($seconds*1000))) } + } while ($true) + $preview=(-not $Context.AllowMutation -and $Context.Action -in @('Convert','Recover')) + foreach ($s in $states) { + if ($s.Done) { continue } + if ($preview) { + $s.Row.CloudStatus='Pending'; $s.Row.FinalStatus='Planned' + $s.Row.Detail=([string]$s.Row.Detail+' | not yet in the expected state in Exchange Online (preview): '+$s.Row.CloudDetail).Trim(' ','|') + $null=Write-PraLog -Context $Context -Message ("{0}: not yet in the expected state ({1})" -f $s.Upn, $s.Row.CloudDetail) -Level Info + } + else { Write-PraCloudError -Context $Context -Row $s.Row -Message ('Expected state not reached (timeout or -Once): '+$s.Row.CloudDetail) } + } + } catch { + $failure=$_.Exception.Message + foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message $failure } + if ($Rows.Count -eq 0) { Write-PraCloudError -Context $Context -Row $null -Message $failure } + } finally { + try { Close-PraCloudSession $Context } + catch { foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message ('Cloud sign-out failed: '+$_.Exception.Message) } } + } +} + +function Invoke-PraRetentionCheck { + <# + .SYNOPSIS + Checks that the retention policy holds the active or inactive mailboxes (read only, never a deprovisioning confirmation). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context,[Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Rows) + $Context.CurrentPhase='Retention'; $Context.CurrentOperation='Prepare'; $Context.CurrentIdentity=''; $Context.CloudConnectFailed=$false + try { + if ($Rows.Count -eq 0) { return } + $cfg=Get-PraValue $Context.Config 'Retention' @{}; $raw=[string](Get-PraValue $cfg 'PolicyGuid' '') + $guid=$null; $parsed=[guid]::Empty + if ($raw) { + if (-not [guid]::TryParse($raw,[ref]$parsed) -or $parsed -eq [guid]::Empty) { throw 'Retention.PolicyGuid is not a GUID.' } + $guid=$parsed.ToString('N') + } + try { Connect-PraCloudSession -Context $Context -NeedGraph $false -NeedExo $true } + catch { $Context.CloudConnectFailed=$true; throw } + $cloud=Get-PraValue $Context.Config 'Cloud' @{}; $name=[string](Get-PraValue $cfg 'PolicyName' '') + if (-not $guid -and $name -and [bool](Get-PraValue $cfg 'UseComplianceSession' $false) -and -not [string](Get-PraValue $cloud 'AppId' '')) { + $Context.CurrentOperation='ResolveRetentionPolicy' + $session=Get-PraCloudSession $Context + if ($session.Subprocess) { throw 'Interactive policy lookup (Connect-IPPSSession) is not possible with the Exchange Online child process.' } + $beforeIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId }) + $session.ExoAttempted=$true + try { Connect-IPPSSession -ShowBanner:$false -ErrorAction Stop | Out-Null } + finally { + $newIds=@(Get-ConnectionInformation -ErrorAction Stop | ForEach-Object { [string]$_.ConnectionId } | Where-Object { $_ -notin $beforeIds }) + $session.OwnedExoIds=@($session.OwnedExoIds)+$newIds + } + try { + $policies=@(Get-RetentionCompliancePolicy -Identity $name -ErrorAction Stop) + if ($policies.Count -ne 1) { throw 'Retention policy not found or not unique.' } + $raw=[string](Get-PraValue $policies[0] 'Guid' '') + if (-not $raw) { $raw=[string](Get-PraValue $policies[0] 'ExchangeObjectId' '') } + if (-not [guid]::TryParse($raw,[ref]$parsed) -or $parsed -eq [guid]::Empty) { throw 'Retention policy GUID missing or invalid.' } + $guid=$parsed.ToString('N') + } finally { + foreach ($id in $newIds) { Disconnect-ExchangeOnline -ConnectionId $id -Confirm:$false -ErrorAction Stop 6>$null | Out-Null } + } + } + foreach ($row in $Rows) { + Add-Member -InputObject $row -NotePropertyName DeprovisionConfirmed -NotePropertyValue $false -Force + $Context.CurrentOperation='VerifyRetention'; $Context.CurrentIdentity=[string](Get-PraValue $row 'ObjectGuid' '') + $row.CloudMailbox=$null; $row.CloudLicense=$null; $row.CloudStatus='Pending' + try { + $h=Invoke-PraExo -Context $Context -Operation 'Hold' -Params @{ Upn=[string](Get-PraValue $row 'UserPrincipalName' '') } + $row.CloudMailbox=[bool](Get-PraValue $h 'Found' $false) + $holds=Get-PraValue $h 'Holds' @(); $holds=@($holds | Where-Object { $null -ne $_ }) + $included=$false; $excluded=$false; $deleteOnly=$false + foreach ($hold in $holds) { + if ([string]$hold -match '^(?-)?(?:mbx|grp|skp|UniH)?(?[a-f0-9]{32}|[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})(?::(?[123]))?$') { + if (($Matches.id -replace '-','') -eq $guid) { + if ($Matches.ContainsKey('excluded')) { $excluded=$true } + elseif ($Matches.ContainsKey('action') -and $Matches.action -eq '1') { $deleteOnly=$true } + else { $included=$true } + } + } + } + $row.CloudDetail="Retention: Found=$($row.CloudMailbox); Inactive=$(Get-PraValue $h 'IsInactive' $false); Litigation=$(Get-PraValue $h 'Litigation' $false); RetentionHold=$(Get-PraValue $h 'RetentionHold' $false); Holds=[$($holds -join ',')]" + if (-not $row.CloudMailbox) { throw ('Mailbox not found (active or inactive). '+$row.CloudDetail) } + if (-not $guid) { throw ('Policy unknown: set Retention.PolicyGuid (a hold may exist, check it manually). '+$row.CloudDetail) } + if ($excluded -or $deleteOnly -or -not $included) { throw ('Not covered by the policy (or excluded, or delete-only); an adaptive scope can take several days. '+$row.CloudDetail) } + $row.CloudStatus='Success'; if ($row.FinalStatus -ne 'Error') { $row.FinalStatus='Success' } + $row.CloudDetail+=' | COVERED (GUID='+$guid+')' + $null=Write-PraLog -Context $Context -Message $row.CloudDetail -Level Success + } catch { Write-PraCloudError -Context $Context -Row $row -Message $_.Exception.Message } + } + } catch { + $failure=$_.Exception.Message + foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message $failure } + if ($Rows.Count -eq 0) { Write-PraCloudError -Context $Context -Row $null -Message $failure } + } finally { + try { Close-PraCloudSession $Context } + catch { foreach ($row in $Rows) { Write-PraCloudError -Context $Context -Row $row -Message ('Sign-out after the retention check failed: '+$_.Exception.Message) } } + } +} + +Export-ModuleMember -Function Initialize-PraCloudPreflight,Invoke-PraCloudPhase,Invoke-PraRetentionCheck,Close-PraCloudSession + +# SIG # Begin signature block +# MIIghQYJKoZIhvcNAQcCoIIgdjCCIHICAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDP6YMLXwuieK0M +# wdNQo7YJ6hUjA157qf9kec08CziymKCCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISbDCCEmgCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCCAexmcgFvZ +# YbGDuPj+C1Bf2dgB+Jiq4eFO+7ks621VyTANBgkqhkiG9w0BAQEFAASCAgAhCZ2A +# fXviZA0h2JB+vbcGww8iwBTfNzY5tlzpVvAMiTnrCvzefSCOMKbSnSDwmDbaiiEJ +# MQ+4EuS/4dlU5eb3iJ6aVjL8XaycEXRLZnQsmGN9TrDT2xgoFgn0fEg3cN7j0PDS +# W+KoA+sgfSXmBj+XXm93ksnNYBg0B9CMheVtAqc/QLrHQ91nzlvIKOpQc7jjk85o +# DpxF/p+4pfrxPIUeKbYj7KHOMhduuDXRy+f5+yU65F0+DYJ4eam8/+1wLaQc0qGh +# qFAE0mKxqOA0ucw2GvkFobTX64yGKkxj408KCZy2UYI9T7UAwQ8M4zBLCxmZTGOH +# j0jcY/yprRMIvJFEBZ8k5Wh6YFGhITDQ8hEW8B1Ju1kfp+UCU9KFcj1XN71/O9se +# QByNZD45ZvxwLuDEI4YBevrhwu1V6n8v5OztLdEzyFtcLe1DQG0xkVYt2O4iGq19 +# hEXPgTMVPFP8duxrF7rkR0ZSb+297P7plyMHUHqW3+olXFu7qU1VJ7ulHojrzDAP +# T98Eb64DaIyzaK7wRv5RleiaW6oNYzUhcBW3pM34ik1BKsCyY0l0OezcoO4HVoaJ +# 0XCCGrA49OQtM19Kg452rZGZYKN4stwFEAE1bB7MeQOlmAfxMTWig5cuUaOqZzgF +# xvM1yUf7rFGYpM8TRtKkIJYAM4RyTA2P/5dVLaGCDykwgg8lBgorBgEEAYI3AwMB +# MYIPFTCCDxEGCSqGSIb3DQEHAqCCDwIwgg7+AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEILuuFQ8ECcgloEon2JbAHBX+n6SLW1A8wz8z8mW3UntLAghRQz9p+O1W +# mxgPMjAyNjEwMTUyMTIzMTBaMAMCAQECEHMUNjLjehi3GiwR9Z1qGcugggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# WDCCAlQCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMjMxMFowKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEICXwdXDjrCUG +# SJtcFqqUtcFpWU/9e7Azz2cvUDSm01RWMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEcwRQIhAILReuvH0Aghv6TORix3qtSCM7Wem06+72IRDgdIUwxgAiBPMYQbAeO9 +# oeBP5ptHyrcysbQcAVWiySbT3s+bjvy5aw== +# SIG # End signature block diff --git a/module/PRA.Common.psm1 b/package/module/PRA.Common.psm1 similarity index 63% rename from module/PRA.Common.psm1 rename to package/module/PRA.Common.psm1 index b3f01e8..68714e9 100644 --- a/module/PRA.Common.psm1 +++ b/package/module/PRA.Common.psm1 @@ -1,1007 +1,1453 @@ -<# -.SYNOPSIS - PRA Remote Mailbox - common module: console, log, configuration, audit and reports. - -.DESCRIPTION - Helper functions used by Invoke-PraRemoteMailbox.ps1 and by the other modules. The module never - reads Active Directory and never connects to Microsoft 365. It is organised in regions, in the - order of an execution: - - 1. Console theme icons, frames and colours (Windows PowerShell 5.1 console colours) - 2. Console and log Write-PraBanner, Write-PraStep, Write-PraItem, Write-PraLog, Write-PraSummary - 3. Configuration Import-PraConfiguration (reads and checks the .psd1 file) - 4. Audit Initialize-PraAudit (log file + PowerShell transcript) - 5. Results Get-PraOutcome, Write-PraReport (CSV + HTML), Complete-PraRun - - The run state is one hashtable (the "context") created by the entry script and passed to every - function. Its main keys are described in docs\PraRemoteMailbox-Guide.md, chapter "Inside the tool". - -.NOTES - Author : Nicolas Fabert - Version : 2.1.0 - History : see CHANGELOG.md -#> -#Requires -Version 5.1 -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' - -$script:ToolVersion = '2.1.0' -$script:TranscriptOwner = $null -# Columns of the CSV report, in this order (also the fields copied from each result row). -$script:RowFields = @('ObjectGuid','SamAccountName','UserPrincipalName','Action','IsShared','ADApplied','ADVerified', - 'GroupAction','BackupPath','LastOperation','CloudMailbox','CloudLicense','CloudStatus','CloudDetail','PreserveCloudMailbox', - 'PreserveLicense','DeprovisionConfirmed','PermDetail','PermMissing','FinalStatus','Detail','Warnings') -# Final statuses a row can have. 'AlreadyDone' is counted as a success. -$script:FinalStatuses = @('Planned','AlreadyDone','Success','Error','Pending','Skipped') - -#region 1. Console theme ---------------------------------------------------------------------- -# Windows PowerShell 5.1 and the classic console (conhost) are the reference: colours are console -# colours (no ANSI sequences, so the transcript and the log stay clean text) and the default icons -# are characters present in the Consolas and Lucida Console fonts. Emoji are used only in Windows -# Terminal and VS Code. Force a style with the environment variable PRA_ICONS = Emoji|Symbols|Ascii. - -function Get-PraIconSet { - <# Icons of one console style. 'Symbols' uses only characters of the classic console fonts. #> - param([Parameter(Mandatory)][ValidateSet('Emoji','Symbols','Ascii')][string]$Style) - $u = { param([int]$Code) [char]::ConvertFromUtf32($Code) } - switch ($Style) { - 'Emoji' { - return @{ - Logo = & $u 0x1F6DF; Ok = & $u 0x2705; Warn = & $u 0x1F7E1; Fail = & $u 0x274C; Info = & $u 0x1F539 - Skip = & $u 0x23E9; Directory = & $u 0x1F3E2; Plan = & $u 0x1F50E; Backup = & $u 0x1F4BE; Write = & $u 0x270F - Sync = & $u 0x1F504; Cloud = & $u 0x2601; Key = & $u 0x1F510; Batch = & $u 0x1F4E6; Config = & $u 0x1F4DD - Report = & $u 0x1F4CA; Folder = & $u 0x1F4C1; Clock = & $u 0x23F3; Mail = & $u 0x1F4E8; Target = & $u 0x1F3AF - Log = & $u 0x1F4C4; Done = & $u 0x1F389; People = & $u 0x1F465; Next = & $u 0x1F449; Mode = & $u 0x1F9ED - } - } - 'Symbols' { - return @{ - Logo = & $u 0x2666; Ok = & $u 0x221A; Warn = & $u 0x25B2; Fail = & $u 0x00D7; Info = & $u 0x2022 - Skip = & $u 0x00BB; Directory = & $u 0x2302; Plan = & $u 0x25BA; Backup = & $u 0x25A0; Write = & $u 0x00B1 - Sync = & $u 0x2194; Cloud = & $u 0x263C; Key = & $u 0x00A7; Batch = & $u 0x25D9; Config = & $u 0x2261 - Report = & $u 0x2261; Folder = & $u 0x2302; Clock = & $u 0x25CB; Mail = '@'; Target = & $u 0x25D9 - Log = & $u 0x00B6; Done = & $u 0x221A; People = & $u 0x2192; Next = & $u 0x2192; Mode = & $u 0x25BA - } - } - default { - return @{ - Logo = '*'; Ok = '+'; Warn = '!'; Fail = 'x'; Info = '-'; Skip = '>'; Directory = '#'; Plan = '?'; Backup = '=' - Write = '~'; Sync = '<>'; Cloud = '@'; Key = '$'; Batch = '#'; Config = '='; Report = '='; Folder = '>' - Clock = ':'; Mail = '@'; Target = 'o'; Log = '='; Done = '*'; People = '&'; Next = '>'; Mode = '>' - } - } - } -} - -function Get-PraFrameSet { - <# Frame characters: rounded corners (Consolas), square corners for Lucida Console, ASCII otherwise. #> - param([Parameter(Mandatory)][ValidateSet('Emoji','Symbols','Ascii')][string]$Style) - if ($Style -eq 'Ascii') { return @{ TopLeft='+'; TopRight='+'; BottomLeft='+'; BottomRight='+'; Horizontal='-'; Vertical='|' } } - return @{ TopLeft=[string][char]0x256D; TopRight=[string][char]0x256E; BottomLeft=[string][char]0x2570 - BottomRight=[string][char]0x256F; Horizontal=[string][char]0x2500; Vertical=[string][char]0x2502 } -} - -$script:IconStyle = if ($env:PRA_ICONS -in @('Emoji','Symbols','Ascii')) { $env:PRA_ICONS } - elseif ($env:WT_SESSION -or $env:TERM_PROGRAM -eq 'vscode') { 'Emoji' } - else { 'Symbols' } -$script:Icons = Get-PraIconSet $script:IconStyle -$script:Frame = Get-PraFrameSet $script:IconStyle -# Emoji are two columns wide, symbols one: pad symbols so that the text stays aligned. -$script:IconPad = if ($script:IconStyle -eq 'Emoji') { ' ' } else { ' ' } -# Console colours of the theme. Accent = frames and step numbers. -$script:Theme = @{ Accent='Magenta'; AccentBack='DarkMagenta'; Dim='DarkGray'; Ok='Green'; Warn='Yellow'; Fail='Red'; Text='Gray'; Strong='White'; Info='Cyan' } - -function Get-PraIcon { - param([Parameter(Mandatory)][string]$Name) - $icon = $script:Icons[$Name] - if (-not $icon) { $icon = $script:Icons['Info'] } - return $icon + $script:IconPad -} - -function Write-PraHost { - <# - .SYNOPSIS - Writes one console line made of coloured segments: @( @('text','Color'), @('text'), ... ). - Console output only (the transcript records it); never the log file. - #> - [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost','',Justification='Single console writer of the tool.')] - param([Parameter(Mandatory)][object[]]$Segments, [string]$Color) - # ONE Write-Host per line and one colour per line: the Windows PowerShell 5.1 transcript writes - # every Write-Host -NoNewline piece on its own line, which would make the audit transcript unreadable. - # The colour is -Color, or the first colour given in the segments. - $text = (@($Segments | ForEach-Object { [string](@($_)[0]) })) -join '' - if (-not $Color) { - foreach ($segment in $Segments) { $parts = @($segment); if ($parts.Count -ge 2 -and $parts[1]) { $Color = [string]$parts[1]; break } } - } - # PRA_ANSI=1: the colour as an ANSI sequence (console captures for the documentation). - if ($env:PRA_ANSI -eq '1' -and $Color) { - $codes = @{ Black=30; DarkBlue=34; DarkGreen=32; DarkCyan=36; DarkRed=31; DarkMagenta=35; DarkYellow=33; Gray=37; DarkGray=90; Blue=94; Green=92; Cyan=96; Red=91; Magenta=95; Yellow=93; White=97 } - Write-Host ("{0}[{1}m{2}{0}[0m" -f [char]27, $codes[$Color], $text) - return - } - if ($Color -and -not [Console]::IsOutputRedirected) { Write-Host $text -ForegroundColor $Color } - else { Write-Host $text } -} -#endregion - -#region 2. Console and log ---------------------------------------------------------------------- - -function Get-PraValue { - <# - .SYNOPSIS - Reads a key or a property without mixing up "missing", $null, $false, 0 and empty collections. - .PARAMETER Object - Dictionary or object, possibly $null. - .PARAMETER Name - Key or property name. - .PARAMETER Default - Value returned only when the object or the member is missing. - #> - [CmdletBinding()] - param([AllowNull()][object]$Object, [Parameter(Mandatory)][string]$Name, [AllowNull()][object]$Default = $null) - if ($null -eq $Object) { return ,$Default } - if ($Object -is [System.Collections.IDictionary]) { - foreach ($entry in $Object.GetEnumerator()) { if ($entry.Key -eq $Name) { return ,($entry.Value) } } - } else { - $property = $Object.PSObject.Properties[$Name] - if ($null -ne $property) { return ,($property.Value) } - } - return ,$Default -} - -function Format-PraDuration { - <# - .SYNOPSIS - '4.2 s', '3 min 05 s', '1 h 02 min'. - #> - param([Parameter(Mandatory)][double]$Seconds) - $t = [TimeSpan]::FromTicks([long]([Math]::Max(0.0, $Seconds) * 10000000)) - if ($t.TotalHours -ge 1) { return '{0} h {1:00} min' -f [int][Math]::Floor($t.TotalHours), $t.Minutes } - if ($t.TotalMinutes -ge 1) { return '{0} min {1:00} s' -f $t.Minutes, $t.Seconds } - return ('{0:0.0} s' -f $t.TotalSeconds).Replace(',', '.') -} - -function Add-PraIssue { - <# - .SYNOPSIS - Records a run error (reports, exit code) without any output. Used by Write-PraLog -Level Error. - #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Message, [string]$Source = 'Execution') - $phase = [string](Get-PraValue $Context 'CurrentPhase' '') - if (-not $phase) { $phase = [string](Get-PraValue $Context 'Phase' '') } - [void]$Context.Issues.Add([pscustomobject]@{ - Timestamp = (Get-Date).ToString('o'); Phase = $phase; Source = $Source - Operation = [string](Get-PraValue $Context 'CurrentOperation' '') - Identity = [string](Get-PraValue $Context 'CurrentIdentity' ''); Message = $Message - }) - $Context.ExitCode = 1 -} - -function Add-PraWarning { - <# - .SYNOPSIS - Records a run warning (summary card, HTML report) without any output and without changing the - exit code. Used by Write-PraLog -Level Warning and Write-PraItem -Status Warn. - #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Message) - if (-not $Context.ContainsKey('WarningList')) { $Context['WarningList'] = New-Object 'Collections.Generic.List[object]' } - [void]$Context['WarningList'].Add([pscustomobject]@{ - Timestamp = (Get-Date).ToString('yyyy-MM-dd HH:mm:ss'); Phase = [string](Get-PraValue $Context 'CurrentPhase' ''); Message = $Message - }) -} - -function Write-PraEvent { - <# Optional JSONL channel to the window; CLI runs without PRA_EVENT_FILE are unchanged. #> - [CmdletBinding()] - param([Parameter(Mandatory)][ValidateSet('start','step','item','summary','result')][string]$Kind, [hashtable]$Data = @{}) - if (-not $env:PRA_EVENT_FILE) { return } - $record = [ordered]@{ time = [datetime]::UtcNow.ToString('o'); kind = $Kind } - foreach ($key in $Data.Keys) { $record[$key] = $Data[$key] } - $line = ($record | ConvertTo-Json -Compress -Depth 8) + "`n" - for ($attempt = 1; $attempt -le 3; $attempt++) { - try { - [IO.File]::AppendAllText($env:PRA_EVENT_FILE, $line, (New-Object Text.UTF8Encoding($false))) - return - } - catch [IO.IOException] { - if ($attempt -eq 3) { throw } - Start-Sleep -Milliseconds 50 - } - } -} - -function Write-PraLogFile { - <# Appends one line to the log file. A log that cannot be written stops the run (audit). #> - [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost','',Justification='Last-resort console message when the log is broken.')] - param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Level, [AllowEmptyString()][string]$Message) - if (-not $Context.LogFile) { return } - $line = '{0} [{1,-6}] {2}' -f (Get-Date).ToString('yyyy-MM-dd HH:mm:ss.fff'), $Level, ($Message -replace '[\r\n]+', ' | ') - try { [IO.File]::AppendAllText($Context.LogFile, $line + "`r`n", (New-Object Text.UTF8Encoding($false))) } - catch { - $failure = 'The log file cannot be written: {0}' -f $_.Exception.Message - Add-PraIssue $Context $failure 'Log' - Write-Host (' [ERROR] ' + $failure) -ForegroundColor Red - throw - } -} - -function Write-PraLog { - <# - .SYNOPSIS - Writes a message to the log file and, depending on the level, to the console. - .PARAMETER Level - Info console item (bullet) + log - Success console item (tick, green) + log - Warning console item (yellow) + log; counted in the warnings - Error console item (red) + log; recorded as a run error (exit code 1) - Sub indented console detail line + log - Detail log only (full values, technical traces) - Debug log only; also on the console with -Verbose - Step log only (step headers are drawn by Write-PraStep) - .PARAMETER ForegroundColor - Console colour of the text (presentation only: it never changes the level or the counters). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][AllowEmptyString()][string]$Message, - [ValidateSet('Info','Sub','Success','Warning','Error','Debug','Step','Detail')][string]$Level = 'Info', - [ConsoleColor]$ForegroundColor) - $logLevel = @{ Info='INFO'; Sub='INFO'; Success='OK'; Warning='WARN'; Error='ERROR'; Debug='DEBUG'; Step='STEP'; Detail='DETAIL' }[$Level] - if ($Level -eq 'Warning') { $Context.Warnings = [int](Get-PraValue $Context 'Warnings' 0) + 1; Add-PraWarning $Context $Message } - if ($Level -eq 'Error') { Add-PraIssue $Context $Message } - Write-PraLogFile -Context $Context -Level $logLevel -Message $Message - $text = $Message -replace '[\r\n]+', ' | ' - switch ($Level) { - 'Debug' { - $verbose = [bool](Get-PraValue $Context 'VerboseEnabled' ($VerbosePreference -eq 'Continue')) - Write-Verbose $text -Verbose:$verbose - } - 'Detail' { } - 'Step' { } - 'Sub' { - $color = if ($PSBoundParameters.ContainsKey('ForegroundColor')) { [string]$ForegroundColor } else { $script:Theme.Dim } - Write-PraHost @(,@((' ' + $text), $color)) - } - default { - $status = @{ Info='Info'; Success='Ok'; Warning='Warn'; Error='Fail' }[$Level] - $iconColor = @{ Info=$script:Theme.Info; Ok=$script:Theme.Ok; Warn=$script:Theme.Warn; Fail=$script:Theme.Fail }[$status] - $textColor = if ($PSBoundParameters.ContainsKey('ForegroundColor')) { [string]$ForegroundColor } - elseif ($status -in @('Warn','Fail')) { $iconColor } else { '' } - Write-PraHost @(' ', (Get-PraIcon $status), $text) -Color $textColor - } - } - if ($Level -in @('Info','Sub','Success','Warning','Error')) { - Write-PraEvent -Kind item -Data @{ status = @{ Info='Info'; Sub='Sub'; Success='Ok'; Warning='Warn'; Error='Fail' }[$Level] - text = $text; identity = [string](Get-PraValue $Context 'CurrentIdentity' '') } - } -} - -function Write-PraItem { - <# - .SYNOPSIS - One indented result line with a status icon, also written to the log. - .PARAMETER Status - Ok, Warn, Fail, Info or Skip. Fail does NOT record a run error: use Write-PraLog -Level Error for that. - .PARAMETER Icon - Optional icon name instead of the status icon (Directory, Backup, Cloud, Mail, ...). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context, [ValidateSet('Ok','Warn','Fail','Info','Skip')][string]$Status = 'Info', - [Parameter(Mandatory)][AllowEmptyString()][string]$Text, [string]$Icon) - $color = @{ Ok=$script:Theme.Ok; Warn=$script:Theme.Warn; Fail=$script:Theme.Fail; Info=$script:Theme.Info; Skip=$script:Theme.Dim }[$Status] - $textColor = if ($Status -in @('Warn','Fail','Skip')) { $color } else { '' } - $symbol = if ($Icon) { Get-PraIcon $Icon } else { Get-PraIcon $Status } - Write-PraHost @(' ', $symbol, $Text) -Color $textColor - if ($Status -eq 'Warn') { $Context.Warnings = [int](Get-PraValue $Context 'Warnings' 0) + 1; Add-PraWarning $Context $Text } - Write-PraLogFile -Context $Context -Level (@{ Ok='OK'; Warn='WARN'; Fail='FAIL'; Info='INFO'; Skip='SKIP' }[$Status]) -Message $Text - Write-PraEvent -Kind item -Data @{ status = $Status; text = $Text; identity = [string](Get-PraValue $Context 'CurrentIdentity' '') } -} - -function Write-PraBanner { - <# - .SYNOPSIS - Title card at the start of an execution: - - ╭────────────────────────────────────────────────────────────────────────────╮ - │ ♦ PRA Remote Mailbox v2.1.0 · Nicolas Fabert │ - │ Hybrid Exchange disaster recovery · on-premises mailboxes → Exchange O │ - ╰────────────────────────────────────────────────────────────────────────────╯ - ► Action Convert · Preview (nothing is changed) - .PARAMETER Details - Ordered list of rows: key = label, value = @(IconName, Text) or plain text. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Title, [string]$Subtitle, - [System.Collections.Specialized.OrderedDictionary]$Details) - $F = $script:Frame; $T = $script:Theme; $width = 76 - $right = "v$($Context.Version) $([char]0x00B7) Nicolas Fabert" - $left = " $($script:Icons.Logo) $Title" - $iconWidth = if ($script:IconStyle -eq 'Emoji') { 2 } else { $script:Icons.Logo.Length } - $visible = $left.Length - $script:Icons.Logo.Length + $iconWidth - $gap = [Math]::Max(1, $width - $visible - $right.Length - 2) - Write-Host '' - Write-PraHost @(,@((' ' + $F.TopLeft + ($F.Horizontal * $width) + $F.TopRight), $T.Accent)) - Write-PraHost @(' ', $F.Vertical, $left, (' ' * $gap), $right, ' ', $F.Vertical) -Color $T.Accent - if ($Subtitle) { - $sub = (' ' + $Subtitle) - if ($sub.Length -gt $width) { $sub = $sub.Substring(0, $width) } - Write-PraHost @(' ', $F.Vertical, $sub.PadRight($width), $F.Vertical) -Color $T.Accent - } - Write-PraHost @(,@((' ' + $F.BottomLeft + ($F.Horizontal * $width) + $F.BottomRight), $T.Accent)) - Write-PraLogFile -Context $Context -Level 'STEP' -Message ("=== $Title v$($Context.Version) - run $($Context.RunId) ===") - $eventDetails = [ordered]@{} - if ($Details) { - foreach ($key in $Details.Keys) { - $value = $Details[$key] - $icon = ' '; $text = $value - if ($value -is [array]) { $icon = Get-PraIcon $value[0]; $text = $value[1] } - Write-PraHost @(' ', $icon, ('{0,-11}' -f $key), (' ' + $text)) - Write-PraLogFile -Context $Context -Level 'INFO' -Message ('{0}: {1}' -f $key, $text) - $eventDetails[$key] = [string]$text - } - } - Write-PraEvent -Kind start -Data @{ title = $Title; action = [string](Get-PraValue $Context 'Action' '') - mode = [string](Get-PraValue $Context 'Mode' ''); phase = [string](Get-PraValue $Context 'Phase' '') - version = [string]$Context.Version; runId = [string]$Context.RunId - logFile = [string](Get-PraValue $Context 'LogFile' ''); details = $eventDetails } -} - -function Write-PraStep { - <# - .SYNOPSIS - Step header with a coloured number pill and an icon, e.g. - - 3/7 ► Reading the targets and planning the changes - .DESCRIPTION - The step number comes from $Context.StepIndex (incremented here) and the total from - $Context.StepTotal (set by the entry script for the selected action and phase). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Title, [string]$Icon = 'Plan') - $Context.StepIndex = [int](Get-PraValue $Context 'StepIndex' 0) + 1 - $Context.CurrentPhase = $Title - $total = [int](Get-PraValue $Context 'StepTotal' 0) - $number = if ($total -gt 0) { '{0}/{1}' -f $Context.StepIndex, $total } else { [string]$Context.StepIndex } - Write-Host '' - Write-PraHost @(' ', ('{0,5}' -f $number), ' ', (Get-PraIcon $Icon), $Title) -Color $script:Theme.Accent - Write-PraLogFile -Context $Context -Level 'STEP' -Message ("[$number] $Title") - Write-PraEvent -Kind step -Data @{ index = $Context.StepIndex; total = $total; title = $Title } -} - -function Write-PraSummary { - <# - .SYNOPSIS - Final summary card: - - ╭─ √ Convert finished ──────────────────────────────────────────────────────╮ - √ Result 2 done · 0 pending · 0 errors - ■ Batch 490cc62e (Backups\Batch-490cc62e...) - ╰────────────────────────────────────────────────────────────────────────────╯ - .PARAMETER Values - Ordered list: key = label, value = @(IconName, Text) or plain text. A text can be an array - (several lines under the same label). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Title, - [Parameter(Mandatory)][System.Collections.Specialized.OrderedDictionary]$Values, [ValidateSet('Ok','Warn','Fail')][string]$Status = 'Ok') - $F = $script:Frame; $T = $script:Theme; $width = 76 - $color = @{ Ok=$T.Ok; Warn=$T.Warn; Fail=$T.Fail }[$Status] - $icon = $script:Icons[@{ Ok='Done'; Warn='Warn'; Fail='Fail' }[$Status]] - $iconWidth = if ($script:IconStyle -eq 'Emoji') { 2 } else { $icon.Length } - $head = " $icon $Title " - $rest = [Math]::Max(2, $width - 1 - ($head.Length - $icon.Length + $iconWidth)) - Write-Host '' - Write-PraHost @(' ', ($F.TopLeft + $F.Horizontal), $head, (($F.Horizontal * $rest) + $F.TopRight)) -Color $color - foreach ($key in $Values.Keys) { - $value = $Values[$key] - $rowIcon = ' '; $text = $value - if ($value -is [array] -and $value.Count -eq 2 -and $script:Icons.ContainsKey([string]$value[0])) { $rowIcon = Get-PraIcon $value[0]; $text = $value[1] } - $first = $true - foreach ($line in @($text)) { - $label = if ($first) { '{0,-11}' -f $key } else { ' ' * 11 } - $iconText = if ($first) { $rowIcon } else { ' ' } - Write-PraHost @(' ', $iconText, $label, (' ' + $line)) - Write-PraLogFile -Context $Context -Level 'INFO' -Message ('Summary - {0}: {1}' -f $key, $line) - $first = $false - } - } - Write-PraHost @(,@((' ' + $F.BottomLeft + ($F.Horizontal * $width) + $F.BottomRight), $color)) - $eventValues = [ordered]@{} - foreach ($key in $Values.Keys) { - $value = $Values[$key] - $text = if ($value -is [array] -and $value.Count -eq 2 -and $script:Icons.ContainsKey([string]$value[0])) { $value[1] } else { $value } - $eventValues[$key] = @(@($text) | ForEach-Object { [string]$_ }) - } - Write-PraEvent -Kind summary -Data @{ title = $Title; status = $Status; values = $eventValues } -} -#endregion - -#region 3. Configuration ---------------------------------------------------------------------- - -function Resolve-PraPath { - <# - .SYNOPSIS - Full path of a file or folder; a relative path is relative to the tool folder. - .DESCRIPTION - Invalid characters (often a line break pasted with the path) are reported with their - position and Unicode code instead of being removed silently. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][AllowEmptyString()][string]$Path, [string]$Name = 'Path', [Parameter(Mandatory)][string]$Root) - $invalid = [IO.Path]::GetInvalidPathChars(); $count = 0; $positions = @() - for ($i = 0; $i -lt $Path.Length; $i++) { - if ($Path[$i] -in $invalid) { - $count++ - if ($positions.Count -lt 8) { $positions += ('{0}:U+{1:X4}' -f $i, [int][char]$Path[$i]) } - } - } - if ($count) { - throw ('Invalid path in {0}: length={1}, invalid characters={2}, positions (0-based UTF-16)={3}, others={4}. Retype the value (a pasted line break is the usual cause).' -f $Name, $Path.Length, $count, ($positions -join ', '), ($count - $positions.Count)) - } - if ([IO.Path]::IsPathRooted($Path)) { return [IO.Path]::GetFullPath($Path) } - return [IO.Path]::GetFullPath((Join-Path $Root $Path)) -} - -function Merge-PraConfiguration { - <# Adds the missing keys from the defaults and checks the type of every known key. #> - param([hashtable]$Values, [hashtable]$Defaults, [string]$Prefix = '') - foreach ($key in $Defaults.Keys) { - if (-not $Values.ContainsKey($key)) { $Values[$key] = $Defaults[$key]; continue } - $value = $Values[$key]; $default = $Defaults[$key] - if ($default -is [hashtable]) { - if ($value -isnot [hashtable]) { throw "Configuration: $Prefix$key must be a section @{ ... }." } - Merge-PraConfiguration $value $default "$Prefix$key." - } - elseif ($default -is [bool] -and $value -isnot [bool]) { throw "Configuration: $Prefix$key must be `$true or `$false." } - elseif ($default -is [string] -and $value -isnot [string]) { throw "Configuration: $Prefix$key must be text between quotes." } - elseif ($default -is [int] -and $value -isnot [int]) { throw "Configuration: $Prefix$key must be a whole number." } - elseif ($default -is [array] -and $value -isnot [array]) { throw "Configuration: $Prefix$key must be a list @( ... )." } - } - foreach ($key in @($Values.Keys)) { - if (-not $Defaults.ContainsKey($key)) { throw "Configuration: unknown setting $Prefix$key (check the spelling, see the guide chapter 6)." } - } -} - -function Get-PraDefaultConfiguration { - <# Default values of every setting (the reference list of the valid keys). #> - return @{ - Environment = 'PROD' - DomainController = '' - Scope = @{ Mode='OU'; SearchBase=''; GroupDN=''; CsvPath=''; IncludeShared=$true; IncludeRoom=$false; IncludeEquip=$false; ExcludeSamAccountNames=@() } - Remote = @{ RecipientType=1; HandleArchives=$true; ClearMailboxGuid=$true } - Routing = @{ AutoDetect=$true; RoutingDomain='' } - Licensing = @{ Enabled=$true; GroupDN='' } - SharedMailbox = @{ - Enabled=$true; RemoteRecipientType=97; PermissionSource='AD'; CsvPath=''; CustomAttribute='extensionAttribute1' - CaptureSendOnBehalf=$true; GrantFullAccess=$true; GrantSendAs=$true; GrantSendOnBehalf=$true; AutoMapping=$true - KeepCloudSharedOnRecover=$false; DeferOnPremRestore=$false; ExcludeTrusteeSamAccountNames=@() - } - EntraConnect = @{ Sync=$true; Server=''; PolicyType='Delta'; TimeoutMinutes=15 } - Cloud = @{ - TenantId=''; Organization=''; AppId=''; CertificateThumbprint=''; UserPrincipalName='' - CheckMailbox=$true; CheckLicense=$true; MailboxCheckVia='Exo'; RequiredSkuPartNumber='' - } - Exo = @{ MinModuleVersion='3.10.0'; UseSubprocess=$false; DisableWAM=$false; GrantVerifyAttempts=13; GrantVerifyDelaySeconds=10 } - Polling = @{ IntervalMinutes=5; TimeoutMinutes=60 } - Retention = @{ Enabled=$true; PolicyName=''; PolicyGuid=''; UseComplianceSession=$false; Tag=@{ Enabled=$true; Attribute='extensionAttribute1'; Value='Converted' } } - Execution = @{ Phase='Both' } - Storage = @{ BackupFolder='.\Backups'; ForbiddenBackupRoots=@() } - Logging = @{ Folder='.\logs' } - Report = @{ Enabled=$true; Folder='.\reports' } - } -} - -function Get-PraTargetOverride { - <# Run-specific targeting; the original data file is never rewritten. #> - [CmdletBinding()] - param([string]$SearchBase = '', [string]$CsvPath = '', [string]$Identity = '') - foreach ($value in @($SearchBase,$CsvPath)) { - if ($value -match '[\x00-\x1f]' -or ($value -and [string]::IsNullOrWhiteSpace($value))) { throw 'Target OU/CSV contains an empty value or a control character.' } - } - if ($SearchBase -and $CsvPath) { throw 'Choose one source: SearchBase (OU) or CsvPath, not both.' } - if ($Identity -and ($SearchBase -or $CsvPath)) { throw 'Identity cannot be combined with a selected OU or CSV.' } - if ($SearchBase) { return @{ Mode='OU'; SearchBase=$SearchBase.Trim(); CsvPath=''; GroupDN='' } } - if ($CsvPath) { return @{ Mode='Csv'; CsvPath=$CsvPath.Trim(); SearchBase=''; GroupDN='' } } - return @{} -} - -function Read-PraTargetCsv { - <# Same local validation in the window and the engine; directory eligibility is checked later. #> - [CmdletBinding()] - param([Parameter(Mandatory)][string]$Path) - $text = [IO.File]::ReadAllText($Path, [Text.Encoding]::UTF8) - if ([string]::IsNullOrWhiteSpace($text)) { throw "The target CSV file is empty: $Path" } - $header = ($text -split '\r?\n',2)[0] - $delimiter = if ($header -match '(?i)(^|,)\s*"?Identity"?\s*(,|$)') { ',' } - elseif ($header -match '(?i)(^|;)\s*"?Identity"?\s*(;|$)') { ';' } - else { throw 'The target CSV requires an Identity column (UPN, sAMAccountName, DN or GUID).' } - $rows = @(ConvertFrom-Csv -InputObject $text -Delimiter $delimiter -ErrorAction Stop) - if (-not $rows.Count) { throw "The target CSV file has no objects: $Path" } - foreach ($row in $rows) { - $identity = [string](Get-PraValue $row 'Identity' '') - if ([string]::IsNullOrWhiteSpace($identity) -or $identity -match '[\x00-\x1f]') { throw 'A line of the target CSV file has no valid Identity: batch refused.' } - [pscustomobject]@{ Identity=$identity.Trim() } - } -} - -function Import-PraConfiguration { - <# - .SYNOPSIS - Reads the configuration file, adds the default values, checks every value and resolves the paths. - .PARAMETER Path - The .psd1 configuration file. - .PARAMETER Root - Tool folder: relative paths in the file are relative to it. - .OUTPUTS - Hashtable. Paths (Storage.BackupFolder, Logging.Folder, Report.Folder, Scope.CsvPath, - SharedMailbox.CsvPath, Storage.ForbiddenBackupRoots) are returned as full paths. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Root, [hashtable]$ScopeOverride = @{}) - $file = Resolve-PraPath $Path 'ConfigPath' $Root - if (-not (Test-Path -LiteralPath $file -PathType Leaf)) { throw "Configuration file not found: $file" } - $config = Import-PowerShellDataFile -LiteralPath $file -ErrorAction Stop - Merge-PraConfiguration $config (Get-PraDefaultConfiguration) - foreach ($key in $ScopeOverride.Keys) { - if ($key -notin @('Mode','SearchBase','CsvPath','GroupDN') -or $ScopeOverride[$key] -isnot [string]) { throw 'Unsupported target scope override.' } - $config.Scope[$key] = $ScopeOverride[$key] - } - - if ($config.Environment -notmatch '^[A-Za-z0-9_.-]{1,64}$') { throw 'Configuration: Environment must be 1 to 64 letters, digits, dot, dash or underscore (it is used in file names).' } - if ($config.DomainController -and $config.DomainController -notmatch '^[A-Za-z0-9.-]+$') { throw 'Configuration: DomainController must be a host name.' } - $scope = $config.Scope - if ($scope.Mode -notin @('Auto','OU','Group','Csv')) { throw 'Configuration: Scope.Mode must be Auto, OU, Group or Csv.' } - if ($scope.Mode -eq 'OU' -and -not $scope.SearchBase) { throw 'Configuration: Scope.Mode = OU requires Scope.SearchBase (a search of the whole domain needs Mode = Auto).' } - if ($scope.Mode -eq 'Group' -and -not $scope.GroupDN) { throw 'Configuration: Scope.Mode = Group requires Scope.GroupDN.' } - if ($scope.Mode -eq 'Csv' -and -not $scope.CsvPath) { throw 'Configuration: Scope.Mode = Csv requires Scope.CsvPath.' } - if ($config.Remote.RecipientType -notin @(1,3)) { throw 'Configuration: Remote.RecipientType must be 1 (provision a mailbox) or 3 (mailbox + archive).' } - if ($config.Routing.RoutingDomain -and $config.Routing.RoutingDomain -notmatch '^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$') { throw 'Configuration: Routing.RoutingDomain must be a domain name (tenant.mail.onmicrosoft.com).' } - if ($config.Licensing.Enabled -and -not $config.Licensing.GroupDN) { throw 'Configuration: Licensing.Enabled requires Licensing.GroupDN.' } - $shared = $config.SharedMailbox - if ($shared.RemoteRecipientType -notin @(97,99,100,102)) { throw 'Configuration: SharedMailbox.RemoteRecipientType must be 97 or 99 (100/102 are accepted only to read old backups).' } - if ($shared.PermissionSource -notin @('AD','Csv','CustomAttribute','None')) { throw 'Configuration: SharedMailbox.PermissionSource must be AD, Csv, CustomAttribute or None.' } - if ($shared.PermissionSource -eq 'Csv' -and -not $shared.CsvPath) { throw 'Configuration: SharedMailbox.PermissionSource = Csv requires SharedMailbox.CsvPath.' } - if ($shared.CustomAttribute -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw 'Configuration: SharedMailbox.CustomAttribute must be extensionAttribute1 to extensionAttribute15.' } - $sync = $config.EntraConnect - if ($sync.PolicyType -notin @('Delta','Initial')) { throw 'Configuration: EntraConnect.PolicyType must be Delta or Initial.' } - if ($sync.TimeoutMinutes -lt 1 -or $sync.TimeoutMinutes -gt 240) { throw 'Configuration: EntraConnect.TimeoutMinutes must be between 1 and 240.' } - if ($sync.Server -and $sync.Server -notmatch '^[A-Za-z0-9.-]+$') { throw 'Configuration: EntraConnect.Server must be a host name (empty = this server).' } - $cloud = $config.Cloud - if ($cloud.MailboxCheckVia -notin @('Graph','Exo')) { throw 'Configuration: Cloud.MailboxCheckVia must be Exo or Graph.' } - if ([bool]$cloud.AppId -ne [bool]$cloud.CertificateThumbprint) { throw 'Configuration: Cloud.AppId and Cloud.CertificateThumbprint go together (both set = certificate sign-in, both empty = interactive sign-in).' } - $exo = $config.Exo - if ($exo.GrantVerifyAttempts -lt 1 -or $exo.GrantVerifyAttempts -gt 60 -or $exo.GrantVerifyDelaySeconds -lt 1 -or $exo.GrantVerifyDelaySeconds -gt 30) { - throw 'Configuration: Exo.GrantVerifyAttempts must be 1..60 and Exo.GrantVerifyDelaySeconds 1..30.' - } - try { $null = [version]$exo.MinModuleVersion } catch { throw 'Configuration: Exo.MinModuleVersion must be a version number (3.10.0).' } - if ($config.Polling.IntervalMinutes -lt 1 -or $config.Polling.TimeoutMinutes -lt 1) { throw 'Configuration: Polling.IntervalMinutes and Polling.TimeoutMinutes must be at least 1.' } - $retention = $config.Retention - if ($retention.Tag.Attribute -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw 'Configuration: Retention.Tag.Attribute must be extensionAttribute1 to extensionAttribute15.' } - if ($retention.Enabled -and $retention.Tag.Enabled -and -not $retention.Tag.Value) { throw 'Configuration: Retention.Tag.Value is empty.' } - if ($config.Execution.Phase -notin @('Both','AD','Cloud')) { throw 'Configuration: Execution.Phase must be Both, AD or Cloud.' } - - $config.Storage.BackupFolder = Resolve-PraPath $config.Storage.BackupFolder 'Storage.BackupFolder' $Root - $config.Storage.ForbiddenBackupRoots = @(foreach ($forbidden in $config.Storage.ForbiddenBackupRoots) { (Resolve-PraPath ([string]$forbidden) 'Storage.ForbiddenBackupRoots' $Root).TrimEnd('\') + '\' }) - $config.Logging.Folder = Resolve-PraPath $config.Logging.Folder 'Logging.Folder' $Root - $config.Report.Folder = Resolve-PraPath $config.Report.Folder 'Report.Folder' $Root - foreach ($section in @('Scope','SharedMailbox')) { - if ($config[$section].CsvPath) { $config[$section].CsvPath = Resolve-PraPath $config[$section].CsvPath ($section + '.CsvPath') $Root } - } - $config['_Path'] = $file - return $config -} -#endregion - -#region 4. Audit ------------------------------------------------------------------------------ - -function Get-PraArtifactStem { - <# Unique, file-name safe prefix of the log, transcript and report files of this run. #> - [CmdletBinding()] - param([hashtable]$Context) - $id = ([string]$Context.RunId -replace '[^a-zA-Z0-9_.-]', '_') - if ($id.Length -gt 80) { $id = $id.Substring(0, 80) } - return ('PRA_{0}_{1}' -f $id, [guid]::NewGuid().ToString('N').Substring(0, 8)) -} - -function Wait-PraTranscriptFile { - <# - .SYNOPSIS - Waits until the transcript file really exists and is not empty. - .DESCRIPTION - Windows PowerShell 5.1 can return from Start-Transcript before the file is created. The first - console output starts it; this function waits for it (up to 5 s) instead of creating a - replacement file. A missing or empty transcript stops the run (no audit, no processing). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][string]$LiteralPath, [ValidateRange(1,60000)][int]$TimeoutMilliseconds = 5000) - $clock = [Diagnostics.Stopwatch]::StartNew() - do { - if (Test-Path -LiteralPath $LiteralPath -PathType Leaf -ErrorAction Stop) { - if ((Get-Item -LiteralPath $LiteralPath -ErrorAction Stop).Length -gt 0) { return } - } - if ($clock.ElapsedMilliseconds -ge $TimeoutMilliseconds) { break } - Start-Sleep -Milliseconds 50 - } while ($true) - throw "The transcript file is missing or empty after ${TimeoutMilliseconds} ms: $LiteralPath. No audit, no processing." -} - -function Initialize-PraAudit { - <# - .SYNOPSIS - Creates the log file of the run and starts the PowerShell transcript. Any failure stops the run. - .DESCRIPTION - Both files are created in $Context.LogFolder with a unique name; an existing file is never - overwritten and a transcript started by someone else is left untouched. When reports are - enabled, the report folder is also checked (a probe file is created and deleted). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context) - $Context.LogFile = '' - try { - if ($null -ne $script:TranscriptOwner) { throw 'A transcript of this module is already running.' } - $stem = Get-PraArtifactStem $Context - $Context['_PraArtifactStem'] = $stem - $Context.CurrentOperation = 'Create-Log' - $null = New-Item -ItemType Directory -Path $Context.LogFolder -Force -WhatIf:$false -Confirm:$false -ErrorAction Stop - $logPath = Join-Path $Context.LogFolder ($stem + '.log') - $null = New-Item -ItemType File -Path $logPath -WhatIf:$false -Confirm:$false -ErrorAction Stop - $Context.LogFile = $logPath - $transcript = Join-Path $Context.LogFolder ($stem + '.transcript.txt') - $Context.TranscriptPath = $transcript - $Context.CurrentOperation = 'Start-Transcript'; $Context['_PraTranscriptCreated'] = $false - # Never Stop-Transcript first and never -Append: a transcript started by someone else stays intact. - Start-Transcript -Path $transcript -NoClobber -WhatIf:$false -Confirm:$false -ErrorAction Stop | Out-Null - $Context.TranscriptStarted = $true; $script:TranscriptOwner = $Context - # The first host output makes Windows PowerShell 5.1 create the file. - Write-PraLog -Context $Context -Message ("Audit: host=$($Host.Name) PowerShell=$($PSVersionTable.PSVersion) transcript=$transcript") -Level Debug - Write-Host '' - $Context.CurrentOperation = 'Wait-TranscriptFile' - Wait-PraTranscriptFile -LiteralPath $transcript - $Context['_PraTranscriptCreated'] = $true - $Context.CurrentOperation = 'Check-ReportFolder' - if (-not $Context.NoReport) { - $null = New-Item -ItemType Directory -Path $Context.ReportFolder -Force -WhatIf:$false -Confirm:$false -ErrorAction Stop - $probe = Join-Path $Context.ReportFolder ($stem + '.probe'); $created = $false - try { - $null = New-Item -ItemType File -Path $probe -WhatIf:$false -Confirm:$false -ErrorAction Stop; $created = $true - Set-Content -LiteralPath $probe -Value 'PRA audit probe' -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop - } finally { if ($created) { Remove-Item -LiteralPath $probe -WhatIf:$false -Confirm:$false -ErrorAction Stop } } - } - Write-PraLog $Context ('Audit started: run {0}, version {1}, account {2}, computer {3}' -f $Context.RunId, $Context.Version, [Security.Principal.WindowsIdentity]::GetCurrent().Name, $env:COMPUTERNAME) -Level Detail - } catch { - Write-PraLog $Context ('Audit could not start: {0}' -f $_.Exception.Message) -Level Error - throw - } -} -#endregion - -#region 5. Results ---------------------------------------------------------------------------- - -function Get-PraOutcome { - <# - .SYNOPSIS - Result rows (one per object + one per run error not attached to an object), counters and exit code. - .DESCRIPTION - Exit code: 0 = done, 1 = failed (any error), 2 = done but at least one object is Pending - (a next step is needed, e.g. the cloud phase or Finalize). - #> - [CmdletBinding()] - param([hashtable]$Context) - $rows = New-Object 'System.Collections.Generic.List[object]' - $errorIdentities = @{} - foreach ($row in $Context.Rows.ToArray()) { - $copy = [ordered]@{} - foreach ($field in $script:RowFields) { $copy[$field] = Get-PraValue $row $field } - $copy.PermMissing = $copy.PermMissing -join '; ' - if ($copy.FinalStatus -notin $script:FinalStatuses) { - $copy.Detail = 'Final status missing or invalid: {0}. {1}' -f $copy.FinalStatus, $copy.Detail; $copy.FinalStatus = 'Error' - } - if ($copy.FinalStatus -eq 'Error') { - foreach ($field in @('ObjectGuid','SamAccountName','UserPrincipalName')) { if ($copy[$field]) { $errorIdentities[[string]$copy[$field]] = $true } } - } - [void]$rows.Add([pscustomobject]$copy) - } - foreach ($issue in $Context.Issues.ToArray()) { - $identity = [string](Get-PraValue $issue 'Identity' '') - $source = [string](Get-PraValue $issue 'Source' 'Execution') - if ($source -eq 'Execution' -and $identity -and $errorIdentities.ContainsKey($identity)) { continue } - $failure = [ordered]@{} - foreach ($field in $script:RowFields) { $failure[$field] = $null } - $failure.Action = $Context.Action; $failure.UserPrincipalName = $identity - $failure.FinalStatus = 'Error'; $failure.LastOperation = Get-PraValue $issue 'Operation' '' - $failure.Detail = '[Run/{0}] {1}' -f $source, (Get-PraValue $issue 'Message' ([string]$issue)) - [void]$rows.Add([pscustomobject]$failure) - } - $counts = @{ Success = 0; Error = 0; Pending = 0; Skipped = 0; Planned = 0 } - foreach ($row in $rows) { - $key = [string]$row.FinalStatus - if ($key -eq 'AlreadyDone') { $key = 'Success' } - $counts[$key]++ - } - $requested = [string](Get-PraValue $Context 'ResultStatus' '') - $code = 0; $status = 'Success' - if ($counts.Error -gt 0 -or $Context.Issues.Count -gt 0 -or [int]$Context.ExitCode -eq 1 -or $Context.CloudConnectFailed -or $requested -eq 'Failed') { - $code = 1; $status = 'Failed' - } elseif ($counts.Pending -gt 0) { $code = 2; $status = 'Pending' } - elseif ($Context.Mode -ne 'Apply' -and $counts.Planned -gt 0) { $status = 'Planned' } - return [pscustomobject]@{ Rows = $rows.ToArray(); Counts = $counts; Status = $status; ExitCode = $code } -} - -function ConvertTo-PraHtmlText { - param([AllowNull()][object]$Value) - if ($null -eq $Value) { return '' } - return [Net.WebUtility]::HtmlEncode([string]$Value) -} - -function Get-PraReportHtml { - <# - .SYNOPSIS - Builds the HTML report from templates\Report.template.html. Every value is HTML-encoded. - #> - [CmdletBinding()] - param([hashtable]$Context, $Outcome) - $templatePath = Join-Path $Context.Root 'templates\Report.template.html' - $template = if (Test-Path -LiteralPath $templatePath -PathType Leaf) { [IO.File]::ReadAllText($templatePath, [Text.Encoding]::UTF8) } - else { '{{TITLE}}

{{TITLE}}

{{SUBTITLE}}

{{TILES}}{{WARNINGS}}{{ROWS_TABLE}}{{ISSUES}}' } - $c = $Outcome.Counts - $warningList = @(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) - $statusClass = @{ Success='ok'; Planned='info'; Pending='warn'; Failed='fail' }[$Outcome.Status] - $tiles = New-Object Text.StringBuilder - foreach ($tile in @( - @('Result', $Outcome.Status, $statusClass), @('Objects', $Outcome.Rows.Count, ''), @('Done', $c.Success, 'ok'), - @('Pending', $c.Pending, $(if ($c.Pending) { 'warn' } else { '' })), @('Errors', $c.Error, $(if ($c.Error) { 'fail' } else { '' })), - @('Warnings', $warningList.Count, $(if ($warningList.Count) { 'warn' } else { '' })), - @('Planned', $c.Planned, $(if ($c.Planned) { 'info' } else { '' })), @('Skipped', $c.Skipped, ''))) { - [void]$tiles.AppendFormat('
{0}
{1}
', (ConvertTo-PraHtmlText $tile[0]), (ConvertTo-PraHtmlText $tile[1]), $tile[2]) - } - $table = New-Object Text.StringBuilder - [void]$table.Append('') - foreach ($row in $Outcome.Rows) { - $status = [string]$row.FinalStatus - $ad = if ($row.ADVerified -eq $true) { 'verified' + $(if ($row.ADApplied -eq $true) { ' (changed)' } else { ' (no change)' }) } elseif ($row.ADVerified -eq $false) { 'NOT verified' } else { '-' } - $cloud = if ([string]$row.CloudStatus -and [string]$row.CloudStatus -ne 'N/A') { [string]$row.CloudStatus + $(if ($row.DeprovisionConfirmed -eq $true) { ' (deprovisioned)' } else { '' }) } else { '-' } - $detail = (@([string]$row.CloudDetail, [string]$row.Detail) | Where-Object { $_ }) -join ' | ' - $rowWarning = [string](Get-PraValue $row 'Warnings' '') - $detailHtml = $(if ($rowWarning) { '
▲ ' + (ConvertTo-PraHtmlText $rowWarning) + '
' } else { '' }) + (ConvertTo-PraHtmlText $detail) - [void]$table.AppendFormat('', - $status.ToLowerInvariant(), (ConvertTo-PraHtmlText $row.SamAccountName), (ConvertTo-PraHtmlText $row.UserPrincipalName), - $(if ($row.IsShared -eq $true) { 'Shared' } elseif ($row.SamAccountName) { 'User' } else { '-' }), (ConvertTo-PraHtmlText $status), - (ConvertTo-PraHtmlText $ad), (ConvertTo-PraHtmlText $(if ($row.GroupAction) { $row.GroupAction } else { '-' })), (ConvertTo-PraHtmlText $cloud), - (ConvertTo-PraHtmlText $(if ($row.PermDetail) { $row.PermDetail } else { '-' })), $detailHtml, $(if ($rowWarning) { ' has-warn' } else { '' })) - } - [void]$table.Append('
ObjectTypeStatusActive DirectoryLicence groupExchange OnlinePermissionsDetail
{1}
{2}		{3}{4}{5}{6}{7}{8}{9}
') - # Every column of the CSV, for the technical review. - [void]$table.Append('
All columns (same as the CSV)
') - foreach ($field in $script:RowFields) { [void]$table.AppendFormat('', (ConvertTo-PraHtmlText $field)) } - [void]$table.Append('') - foreach ($row in $Outcome.Rows) { - [void]$table.Append('') - foreach ($field in $script:RowFields) { [void]$table.AppendFormat('', (ConvertTo-PraHtmlText (Get-PraValue $row $field ''))) } - [void]$table.Append('') - } - [void]$table.Append('
{0}
{0}
') - $issues = New-Object Text.StringBuilder - $warningsHtml = New-Object Text.StringBuilder - if ($warningList.Count) { - [void]$warningsHtml.Append('

▲ Warnings

') - foreach ($warning in $warningList) { - [void]$warningsHtml.AppendFormat('', (ConvertTo-PraHtmlText (Get-PraValue $warning 'Timestamp' '')), - (ConvertTo-PraHtmlText (Get-PraValue $warning 'Phase' '')), (ConvertTo-PraHtmlText (Get-PraValue $warning 'Message' ([string]$warning)))) - } - [void]$warningsHtml.Append('
TimeStepMessage
{0}{1}{2}
') - } - if ($Context.Issues.Count) { - [void]$issues.Append('

Run errors

') - foreach ($issue in $Context.Issues.ToArray()) { - [void]$issues.AppendFormat('', - (ConvertTo-PraHtmlText (Get-PraValue $issue 'Timestamp' '')), (ConvertTo-PraHtmlText (Get-PraValue $issue 'Phase' '')), - (ConvertTo-PraHtmlText (Get-PraValue $issue 'Operation' '')), (ConvertTo-PraHtmlText (Get-PraValue $issue 'Identity' '')), - (ConvertTo-PraHtmlText (Get-PraValue $issue 'Source' '')), (ConvertTo-PraHtmlText (Get-PraValue $issue 'Message' ([string]$issue)))) - } - [void]$issues.Append('
TimeStepOperationObjectSourceMessage
{0}{1}{2}{3}{4}{5}
') - } - $modeText = if ($Context.Mode -eq 'Apply') { 'Apply' } else { 'Preview - nothing changed' } - $meta = [ordered]@{ - 'Action' = ('{0} · phase {1} · {2}' -f $Context.Action, $Context.Phase, $modeText) - 'Environment' = [string](Get-PraValue $Context.Config 'Environment' '') - 'Batch' = [string](Get-PraValue $Context 'BatchId' '') - 'Domain controller' = [string]$Context.Server - 'Computer / account' = ('{0} · {1}\{2}' -f $env:COMPUTERNAME, $env:USERDOMAIN, $env:USERNAME) - 'Started' = ([datetime]$Context.StartTime).ToString('yyyy-MM-dd HH:mm:ss') - 'Duration' = (Format-PraDuration ((Get-Date) - [datetime]$Context.StartTime).TotalSeconds) - 'Run ID' = [string]$Context.RunId - } - $metaHtml = New-Object Text.StringBuilder - foreach ($key in $meta.Keys) { if ($meta[$key]) { [void]$metaHtml.AppendFormat('
{0}{1}
', (ConvertTo-PraHtmlText $key), (ConvertTo-PraHtmlText $meta[$key])) } } - $next = @(@(Get-PraValue $Context 'NextSteps' @()) | ForEach-Object { $_ } | Where-Object { $_ }) - $nextHtml = '' - if ($next.Count) { $nextHtml = '

Next step

' + (($next | ForEach-Object { '
' + (ConvertTo-PraHtmlText $_) + '
' }) -join '') + '
' } - $values = @{ - '{{TITLE}}' = ConvertTo-PraHtmlText ('PRA Remote Mailbox - {0}' -f $Context.Action) - '{{SUBTITLE}}' = ConvertTo-PraHtmlText ('{0} · {1}' -f $modeText, ([datetime]$Context.StartTime).ToString('yyyy-MM-dd HH:mm')) - '{{VERSION}}' = ConvertTo-PraHtmlText $Context.Version - '{{META}}' = $metaHtml.ToString(); '{{TILES}}' = $tiles.ToString(); '{{NEXT}}' = $nextHtml - '{{ROWS_TABLE}}' = $table.ToString(); '{{ISSUES}}' = $issues.ToString(); '{{WARNINGS}}' = $warningsHtml.ToString() - } - foreach ($key in $values.Keys) { $template = $template.Replace($key, $values[$key]) } - return $template -} - -function Write-PraReport { - <# - .SYNOPSIS - Writes the CSV and HTML reports (also when there are zero rows). A failed format is recorded as - a run error; the other format is still written, then refreshed to include that error. - #> - [CmdletBinding()] - param([hashtable]$Context, [hashtable]$Reports) - for ($attempt = 0; $attempt -lt 2; $attempt++) { - $issueCount = $Context.Issues.Count - foreach ($format in @('Csv','Html')) { - if (-not $Reports[$format] -or $Reports[($format + 'Failed')]) { continue } - try { - $outcome = Get-PraOutcome $Context - if ($format -eq 'Csv') { - if ($outcome.Rows.Count) { $outcome.Rows | Export-Csv -LiteralPath $Reports.Csv -NoTypeInformation -Delimiter ';' -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } - else { Set-Content -LiteralPath $Reports.Csv -Value ('"' + ($script:RowFields -join '";"') + '"') -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } - } else { - [IO.File]::WriteAllText($Reports.Html, (Get-PraReportHtml -Context $Context -Outcome $outcome), (New-Object Text.UTF8Encoding($true))) - } - if (-not (Test-Path -LiteralPath $Reports[$format] -PathType Leaf) -or (Get-Item -LiteralPath $Reports[$format]).Length -eq 0) { throw 'Report missing or empty after writing.' } - } catch { $Reports[($format + 'Failed')] = $true; Add-PraIssue $Context ('{0} report: {1}' -f $format, $_.Exception.Message) 'Report' } - } - if ($Context.Issues.Count -eq $issueCount) { break } - } -} - -function Complete-PraRun { - <# - .SYNOPSIS - Ends every run: reports, summary card, transcript, verdict. Returns one result object (no exit). - .DESCRIPTION - Always called from the finally block of the entry script, also after an error. The verdict - 'RESULT: PASS' or 'RESULT: FAIL' is the last line of the log and of the transcript; it is - added after the transcript is stopped so that a failure to stop it is still reported. - .OUTPUTS - PSCustomObject: RunId, Status (Success, Planned, Pending, Failed), ExitCode, counters, - BatchId, NextSteps, file paths and Issues. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context) - $reports = @{ Csv = ''; Html = ''; CsvFailed = $false; HtmlFailed = $false } - $paths = @{ LogFile = ''; TranscriptPath = ''; BackupFiles = @(); StateFiles = @() } - $safeLog = { - param($message, $level = 'Detail') - try { Write-PraLog $Context $message -Level $level } - catch { $console = $Context.Clone(); $console.LogFile = ''; Write-PraLog $console $message -Level $level } - } - $ownsTranscript = [object]::ReferenceEquals($script:TranscriptOwner, $Context) - if (([int]$Context.ExitCode -ne 0 -or $Context.CloudConnectFailed -or (Get-PraValue $Context 'ResultStatus' '') -eq 'Failed') -and $Context.Issues.Count -eq 0) { - Add-PraIssue $Context 'Failure reported by the run (exit code / cloud connection).' 'Run' - } - foreach ($key in @('LogFile','TranscriptPath','BackupFiles','StateFiles')) { - $candidates = Get-PraValue $Context $key - if ($key -in @('LogFile','TranscriptPath')) { $candidates = [string]$candidates } - if ($key -eq 'TranscriptPath' -and -not (Get-PraValue $Context '_PraTranscriptCreated' $false)) { $candidates = '' } - foreach ($path in $candidates) { - try { - if (-not $path -or -not (Test-Path -LiteralPath $path -PathType Leaf)) { throw 'file not found' } - $file = Get-Item -LiteralPath $path -ErrorAction Stop - if ($file.Length -eq 0 -and $key -ne 'StateFiles') { throw 'empty file' } - if ($key -in @('BackupFiles','StateFiles')) { $paths[$key] += $file.FullName } else { $paths[$key] = $file.FullName } - } catch { Add-PraIssue $Context ('Audit file {0} unavailable: {1}' -f $key, $_.Exception.Message) 'Audit' } - } - } - if (-not $Context.NoReport) { - try { - $null = New-Item -ItemType Directory -Path $Context.ReportFolder -Force -WhatIf:$false -Confirm:$false -ErrorAction Stop - $stem = [string](Get-PraValue $Context '_PraArtifactStem' '') - if (-not $stem) { $stem = Get-PraArtifactStem $Context } - foreach ($format in @('Csv','Html')) { - try { - $path = Join-Path $Context.ReportFolder ($stem + '.' + $format.ToLowerInvariant()) - $null = New-Item -ItemType File -Path $path -WhatIf:$false -Confirm:$false -ErrorAction Stop - $reports[$format] = $path - } catch { $reports[($format + 'Failed')] = $true; Add-PraIssue $Context ('{0} report cannot be created: {1}' -f $format, $_.Exception.Message) 'Report' } - } - } catch { Add-PraIssue $Context ('Report folder: {0}' -f $_.Exception.Message) 'Report' } - Write-PraReport $Context $reports - } - - # Summary card. - $outcome = Get-PraOutcome $Context - $c = $outcome.Counts - $isApply = $Context.Mode -eq 'Apply' - $title = switch ($outcome.Status) { - 'Failed' { '{0} stopped - see the errors below' -f $Context.Action } - 'Pending' { '{0} done - next step required' -f $Context.Action } - 'Planned' { '{0} preview - nothing was changed' -f $Context.Action } - default { '{0} finished' -f $Context.Action } - } - $status = @{ Failed='Fail'; Pending='Warn'; Planned='Ok'; Success='Ok' }[$outcome.Status] - $objects = if ($isApply -or $c.Success -or $c.Pending) { '{0} done {4} {1} pending {4} {2} error(s) {4} {3} skipped' -f $c.Success, $c.Pending, $c.Error, $c.Skipped, [char]0x00B7 } - else { '{0} planned {3} {1} error(s) {3} {2} skipped' -f $c.Planned, $c.Error, $c.Skipped, [char]0x00B7 } - $values = [ordered]@{ 'Result' = @('Target', $objects) } - $batch = [string](Get-PraValue $Context 'BatchId' '') - if ($batch) { $values['Batch'] = @('Batch', $batch) } - $issueLines = @($Context.Issues.ToArray() | Select-Object -Last 2 | ForEach-Object { - $message = [string](Get-PraValue $_ 'Message' ([string]$_)) - if ($message.Length -gt 240) { $message = $message.Substring(0, 237) + '...' } - $message }) - if ($issueLines.Count) { - if ($Context.Issues.Count -gt 2) { $issueLines = @(('{0} error(s) in total, see the log and the report' -f $Context.Issues.Count)) + $issueLines } - $values['Error'] = @('Fail', $issueLines) - } - $warningList = @(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) - if ($warningList.Count) { - $warningLines = @($warningList | Select-Object -Last 2 | ForEach-Object { - $message = [string](Get-PraValue $_ 'Message' ([string]$_)) - if ($message.Length -gt 240) { $message = $message.Substring(0, 237) + '...' } - $message }) - if ($warningList.Count -gt 2) { $warningLines = @(('{0} warning(s) in total, see the log and the report' -f $warningList.Count)) + $warningLines } - $values['Warning'] = @('Warn', $warningLines) - # Warnings never change the exit code; they only colour the card of a successful run. - if ($status -eq 'Ok') { $status = 'Warn'; $title += (' {0} {1} warning(s)' -f [char]0x00B7, $warningList.Count) } - } - if ($paths.BackupFiles.Count) { $values['Backup'] = @('Backup', @($paths.BackupFiles)) } - if ($reports.Html -and -not $reports.HtmlFailed) { $values['Report'] = @('Report', $reports.Html) } - if ($paths.LogFile) { $values['Log'] = @('Log', $paths.LogFile) } - $values['Duration'] = @('Clock', (Format-PraDuration ((Get-Date) - [datetime]$Context.StartTime).TotalSeconds)) - $next = @(@(Get-PraValue $Context 'NextSteps' @()) | ForEach-Object { $_ } | Where-Object { $_ }) - if ($outcome.ExitCode -ne 1 -and $next.Count) { $values['Next'] = @('Next', $next) } - try { Write-PraSummary -Context $Context -Title $title -Values $values -Status $status } - catch { & $safeLog ('Summary unavailable: ' + $_.Exception.Message) } - foreach ($key in @('BackupFiles','StateFiles')) { foreach ($path in $paths[$key]) { & $safeLog ('{0}: {1}' -f $key, $path) } } - & $safeLog ('Status {0}; total {1}; done {2}; errors {3}; pending {4}; skipped {5}; planned {6}.' -f $outcome.Status, $outcome.Rows.Count, $c.Success, $c.Error, $c.Pending, $c.Skipped, $c.Planned) - - # Stop our own transcript (never someone else's), then write the verdict. - if ($ownsTranscript) { - try { Stop-Transcript -ErrorAction Stop | Out-Null } - catch { Add-PraIssue $Context ('Transcript could not be stopped: {0}' -f $_.Exception.Message) 'Audit' } - finally { $Context.TranscriptStarted = $false; $script:TranscriptOwner = $null } - } - Write-PraReport $Context $reports - $outcome = Get-PraOutcome $Context - $verdict = if ($outcome.ExitCode -eq 1) { 'RESULT: FAIL' } else { 'RESULT: PASS' } - try { if ($ownsTranscript -and $paths.TranscriptPath) { Add-Content -LiteralPath $paths.TranscriptPath -Value $verdict -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } } - catch { Add-PraIssue $Context ('Transcript verdict: {0}' -f $_.Exception.Message) 'Audit'; Write-PraReport $Context $reports } - $outcome = Get-PraOutcome $Context; $beforeVerdict = $Context.Issues.Count - $verdict = if ($outcome.ExitCode -eq 1) { 'RESULT: FAIL' } else { 'RESULT: PASS' } - try { Write-PraLogFile -Context $Context -Level 'INFO' -Message $verdict } catch { $null = $_ } - Write-PraHost @(,@((' ' + $verdict), $script:Theme.Dim)) - Write-Host '' - if ($Context.Issues.Count -ne $beforeVerdict) { - try { if ($ownsTranscript -and $paths.TranscriptPath) { Add-Content -LiteralPath $paths.TranscriptPath -Value 'RESULT: FAIL' -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } } - catch { Add-PraIssue $Context ('Transcript verdict: {0}' -f $_.Exception.Message) 'Audit' } - Write-PraReport $Context $reports - } - $outcome = Get-PraOutcome $Context - $Context.ExitCode = $outcome.ExitCode; $Context.ResultStatus = $outcome.Status - $result = [pscustomobject][ordered]@{ - RunId = $Context.RunId; Version = $Context.Version; Action = $Context.Action; Mode = $Context.Mode; Phase = $Context.Phase - Status = $outcome.Status; ExitCode = $outcome.ExitCode; SuccessCount = $outcome.Counts.Success; ErrorCount = $outcome.Counts.Error - PendingCount = $outcome.Counts.Pending; SkippedCount = $outcome.Counts.Skipped; PlannedCount = $outcome.Counts.Planned - TotalCount = $outcome.Rows.Count; Duration = ((Get-Date) - [datetime]$Context.StartTime) - BatchId = [string](Get-PraValue $Context 'BatchId' ''); NextSteps = [string[]]@(@(Get-PraValue $Context 'NextSteps' @()) | ForEach-Object { $_ } | Where-Object { $_ }) - Server = $Context.Server; BackupFiles = [string[]]$paths.BackupFiles; StateFiles = [string[]]$paths.StateFiles - LogFile = $paths.LogFile; TranscriptPath = $paths.TranscriptPath - CsvReport = $(if (-not $reports.CsvFailed) { $reports.Csv } else { '' }) - HtmlReport = $(if (-not $reports.HtmlFailed) { $reports.Html } else { '' }); Issues = [object[]]$Context.Issues.ToArray() - WarningCount = @(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }).Count - Warnings = [object[]]@(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) - } - Write-PraEvent -Kind result -Data @{ status = $result.Status; exitCode = $result.ExitCode - action = $result.Action; mode = $result.Mode; phase = $result.Phase - success = $result.SuccessCount; error = $result.ErrorCount; pending = $result.PendingCount - skipped = $result.SkippedCount; planned = $result.PlannedCount; total = $result.TotalCount - seconds = [int]$result.Duration.TotalSeconds; batchId = $result.BatchId; nextSteps = @($result.NextSteps) - logFile = $result.LogFile; csvReport = $result.CsvReport; htmlReport = $result.HtmlReport - warnings = $result.WarningCount; backupFiles = @($result.BackupFiles); stateFiles = @($result.StateFiles) - issues = @($result.Issues | ForEach-Object { [string](Get-PraValue $_ 'Message' ([string]$_)) }) } - return $result -} -#endregion - -Export-ModuleMember -Function Get-PraValue, Format-PraDuration, Add-PraIssue, Write-PraLog, Write-PraItem, Write-PraBanner, Write-PraStep, - Write-PraSummary, Write-PraHost, Resolve-PraPath, Import-PraConfiguration, Initialize-PraAudit, Get-PraOutcome, Complete-PraRun, Write-PraEvent, Get-PraTargetOverride, Read-PraTargetCsv +<# +.SYNOPSIS + PRA Remote Mailbox - common module: console, log, configuration, audit and reports. + +.DESCRIPTION + Helper functions used by Invoke-PraRemoteMailbox.ps1 and by the other modules. The module never + reads Active Directory and never connects to Microsoft 365. It is organised in regions, in the + order of an execution: + + 1. Console theme icons, frames and colours (Windows PowerShell 5.1 console colours) + 2. Console and log Write-PraBanner, Write-PraStep, Write-PraItem, Write-PraLog, Write-PraSummary + 3. Configuration Import-PraConfiguration (reads and checks the .psd1 file) + 4. Audit Initialize-PraAudit (log file + PowerShell transcript) + 5. Results Get-PraOutcome, Write-PraReport (CSV + HTML), Complete-PraRun + + The run state is one hashtable (the "context") created by the entry script and passed to every + function. Its main keys are described in docs\PraRemoteMailbox-Guide.md, chapter "Inside the tool". + +.NOTES + Author : Nicolas Fabert + Version : 2.2.0 + History : see CHANGELOG.md +#> +#Requires -Version 5.1 +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' +# >>> PRA package integrity bootstrap: identical in every runtime PowerShell file (checked by the tests). +# It authenticates module\Test-PackageIntegrity.ps1 before running it; there is no unsigned or bypass path. +& { + param([Parameter(Mandatory)][string]$PackageRoot) + $verifier = [IO.Path]::GetFullPath([IO.Path]::Combine($PackageRoot, 'module', 'Test-PackageIntegrity.ps1')) + $cursor = $verifier + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + & $verifier -Root $PackageRoot +} ([IO.Path]::GetDirectoryName($PSScriptRoot)) +# <<< PRA package integrity bootstrap + +$script:ToolVersion = '2.2.0' +$script:TranscriptOwner = $null +$script:PraNativePath = $null +# Columns of the CSV report, in this order (also the fields copied from each result row). +$script:RowFields = @('ObjectGuid','SamAccountName','UserPrincipalName','Action','IsShared','ADApplied','ADVerified', + 'GroupAction','BackupPath','LastOperation','CloudMailbox','CloudLicense','CloudStatus','CloudDetail','PreserveCloudMailbox', + 'PreserveLicense','DeprovisionConfirmed','PermDetail','PermMissing','FinalStatus','Detail','Warnings') +# Final statuses a row can have. 'AlreadyDone' is counted as a success. +$script:FinalStatuses = @('Planned','AlreadyDone','Success','Error','Pending','Skipped') + +#region 1. Console theme ---------------------------------------------------------------------- +# Windows PowerShell 5.1 and the classic console (conhost) are the reference: colours are console +# colours (no ANSI sequences, so the transcript and the log stay clean text) and the default icons +# are characters present in the Consolas and Lucida Console fonts. Emoji are used only in Windows +# Terminal and VS Code. Force a style with the environment variable PRA_ICONS = Emoji|Symbols|Ascii. + +function Get-PraIconSet { + <# Icons of one console style. 'Symbols' uses only characters of the classic console fonts. #> + param([Parameter(Mandatory)][ValidateSet('Emoji','Symbols','Ascii')][string]$Style) + $u = { param([int]$Code) [char]::ConvertFromUtf32($Code) } + switch ($Style) { + 'Emoji' { + return @{ + Logo = & $u 0x1F6DF; Ok = & $u 0x2705; Warn = & $u 0x1F7E1; Fail = & $u 0x274C; Info = & $u 0x1F539 + Skip = & $u 0x23E9; Directory = & $u 0x1F3E2; Plan = & $u 0x1F50E; Backup = & $u 0x1F4BE; Write = & $u 0x270F + Sync = & $u 0x1F504; Cloud = & $u 0x2601; Key = & $u 0x1F510; Batch = & $u 0x1F4E6; Config = & $u 0x1F4DD + Report = & $u 0x1F4CA; Folder = & $u 0x1F4C1; Clock = & $u 0x23F3; Mail = & $u 0x1F4E8; Target = & $u 0x1F3AF + Log = & $u 0x1F4C4; Done = & $u 0x1F389; People = & $u 0x1F465; Next = & $u 0x1F449; Mode = & $u 0x1F9ED + } + } + 'Symbols' { + return @{ + Logo = & $u 0x2666; Ok = & $u 0x221A; Warn = & $u 0x25B2; Fail = & $u 0x00D7; Info = & $u 0x2022 + Skip = & $u 0x00BB; Directory = & $u 0x2302; Plan = & $u 0x25BA; Backup = & $u 0x25A0; Write = & $u 0x00B1 + Sync = & $u 0x2194; Cloud = & $u 0x263C; Key = & $u 0x00A7; Batch = & $u 0x25D9; Config = & $u 0x2261 + Report = & $u 0x2261; Folder = & $u 0x2302; Clock = & $u 0x25CB; Mail = '@'; Target = & $u 0x25D9 + Log = & $u 0x00B6; Done = & $u 0x221A; People = & $u 0x2192; Next = & $u 0x2192; Mode = & $u 0x25BA + } + } + default { + return @{ + Logo = '*'; Ok = '+'; Warn = '!'; Fail = 'x'; Info = '-'; Skip = '>'; Directory = '#'; Plan = '?'; Backup = '=' + Write = '~'; Sync = '<>'; Cloud = '@'; Key = '$'; Batch = '#'; Config = '='; Report = '='; Folder = '>' + Clock = ':'; Mail = '@'; Target = 'o'; Log = '='; Done = '*'; People = '&'; Next = '>'; Mode = '>' + } + } + } +} + +function Get-PraFrameSet { + <# Frame characters: rounded corners (Consolas), square corners for Lucida Console, ASCII otherwise. #> + param([Parameter(Mandatory)][ValidateSet('Emoji','Symbols','Ascii')][string]$Style) + if ($Style -eq 'Ascii') { return @{ TopLeft='+'; TopRight='+'; BottomLeft='+'; BottomRight='+'; Horizontal='-'; Vertical='|' } } + return @{ TopLeft=[string][char]0x256D; TopRight=[string][char]0x256E; BottomLeft=[string][char]0x2570 + BottomRight=[string][char]0x256F; Horizontal=[string][char]0x2500; Vertical=[string][char]0x2502 } +} + +$script:IconStyle = if ($env:PRA_ICONS -in @('Emoji','Symbols','Ascii')) { $env:PRA_ICONS } + elseif ($env:WT_SESSION -or $env:TERM_PROGRAM -eq 'vscode') { 'Emoji' } + else { 'Symbols' } +$script:Icons = Get-PraIconSet $script:IconStyle +$script:Frame = Get-PraFrameSet $script:IconStyle +# Emoji are two columns wide, symbols one: pad symbols so that the text stays aligned. +$script:IconPad = if ($script:IconStyle -eq 'Emoji') { ' ' } else { ' ' } +# Console colours of the theme. Accent = frames and step numbers. +$script:Theme = @{ Accent='Magenta'; AccentBack='DarkMagenta'; Dim='DarkGray'; Ok='Green'; Warn='Yellow'; Fail='Red'; Text='Gray'; Strong='White'; Info='Cyan' } + +function Get-PraIcon { + param([Parameter(Mandatory)][string]$Name) + $icon = $script:Icons[$Name] + if (-not $icon) { $icon = $script:Icons['Info'] } + return $icon + $script:IconPad +} + +function Write-PraHost { + <# + .SYNOPSIS + Writes one console line made of coloured segments: @( @('text','Color'), @('text'), ... ). + Console output only (the transcript records it); never the log file. + #> + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost','',Justification='Single console writer of the tool.')] + param([Parameter(Mandatory)][object[]]$Segments, [string]$Color) + # ONE Write-Host per line and one colour per line: the Windows PowerShell 5.1 transcript writes + # every Write-Host -NoNewline piece on its own line, which would make the audit transcript unreadable. + # The colour is -Color, or the first colour given in the segments. + $text = (@($Segments | ForEach-Object { [string](@($_)[0]) })) -join '' + if (-not $Color) { + foreach ($segment in $Segments) { $parts = @($segment); if ($parts.Count -ge 2 -and $parts[1]) { $Color = [string]$parts[1]; break } } + } + # PRA_ANSI=1: the colour as an ANSI sequence (console captures for the documentation). + if ($env:PRA_ANSI -eq '1' -and $Color) { + $codes = @{ Black=30; DarkBlue=34; DarkGreen=32; DarkCyan=36; DarkRed=31; DarkMagenta=35; DarkYellow=33; Gray=37; DarkGray=90; Blue=94; Green=92; Cyan=96; Red=91; Magenta=95; Yellow=93; White=97 } + Write-Host ("{0}[{1}m{2}{0}[0m" -f [char]27, $codes[$Color], $text) + return + } + if ($Color -and -not [Console]::IsOutputRedirected) { Write-Host $text -ForegroundColor $Color } + else { Write-Host $text } +} +#endregion + +#region 2. Console and log ---------------------------------------------------------------------- + +function Get-PraValue { + <# + .SYNOPSIS + Reads a key or a property without mixing up "missing", $null, $false, 0 and empty collections. + .PARAMETER Object + Dictionary or object, possibly $null. + .PARAMETER Name + Key or property name. + .PARAMETER Default + Value returned only when the object or the member is missing. + #> + [CmdletBinding()] + param([AllowNull()][object]$Object, [Parameter(Mandatory)][string]$Name, [AllowNull()][object]$Default = $null) + if ($null -eq $Object) { return ,$Default } + if ($Object -is [System.Collections.IDictionary]) { + foreach ($entry in $Object.GetEnumerator()) { if ($entry.Key -eq $Name) { return ,($entry.Value) } } + } else { + $property = $Object.PSObject.Properties[$Name] + if ($null -ne $property) { return ,($property.Value) } + } + return ,$Default +} + +function Format-PraDuration { + <# + .SYNOPSIS + '4.2 s', '3 min 05 s', '1 h 02 min'. + #> + param([Parameter(Mandatory)][double]$Seconds) + $t = [TimeSpan]::FromTicks([long]([Math]::Max(0.0, $Seconds) * 10000000)) + if ($t.TotalHours -ge 1) { return '{0} h {1:00} min' -f [int][Math]::Floor($t.TotalHours), $t.Minutes } + if ($t.TotalMinutes -ge 1) { return '{0} min {1:00} s' -f $t.Minutes, $t.Seconds } + return ('{0:0.0} s' -f $t.TotalSeconds).Replace(',', '.') +} + +function Add-PraIssue { + <# + .SYNOPSIS + Records a run error (reports, exit code) without any output. Used by Write-PraLog -Level Error. + #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Message, [string]$Source = 'Execution') + $phase = [string](Get-PraValue $Context 'CurrentPhase' '') + if (-not $phase) { $phase = [string](Get-PraValue $Context 'Phase' '') } + [void]$Context.Issues.Add([pscustomobject]@{ + Timestamp = (Get-Date).ToString('o'); Phase = $phase; Source = $Source + Operation = [string](Get-PraValue $Context 'CurrentOperation' '') + Identity = [string](Get-PraValue $Context 'CurrentIdentity' ''); Message = $Message + }) + $Context.ExitCode = 1 +} + +function Add-PraWarning { + <# + .SYNOPSIS + Records a run warning (summary card, HTML report) without any output and without changing the + exit code. Used by Write-PraLog -Level Warning and Write-PraItem -Status Warn. + #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Message) + if (-not $Context.ContainsKey('WarningList')) { $Context['WarningList'] = New-Object 'Collections.Generic.List[object]' } + [void]$Context['WarningList'].Add([pscustomobject]@{ + Timestamp = (Get-Date).ToString('yyyy-MM-dd HH:mm:ss'); Phase = [string](Get-PraValue $Context 'CurrentPhase' ''); Message = $Message + }) +} + +function Write-PraEvent { + <# Optional JSONL channel to the window; CLI runs without PRA_EVENT_FILE are unchanged. #> + [CmdletBinding()] + param([Parameter(Mandatory)][ValidateSet('start','step','item','summary','result')][string]$Kind, [hashtable]$Data = @{}) + if (-not $env:PRA_EVENT_FILE) { return } + $record = [ordered]@{ time = [datetime]::UtcNow.ToString('o'); kind = $Kind } + foreach ($key in $Data.Keys) { $record[$key] = $Data[$key] } + $line = ($record | ConvertTo-Json -Compress -Depth 8) + "`n" + for ($attempt = 1; $attempt -le 3; $attempt++) { + try { + [IO.File]::AppendAllText($env:PRA_EVENT_FILE, $line, (New-Object Text.UTF8Encoding($false))) + return + } + catch [IO.IOException] { + if ($attempt -eq 3) { throw } + Start-Sleep -Milliseconds 50 + } + } +} + +function Write-PraLogFile { + <# Appends one line to the log file. A log that cannot be written stops the run (audit). #> + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingWriteHost','',Justification='Last-resort console message when the log is broken.')] + param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Level, [AllowEmptyString()][string]$Message) + if (-not $Context.LogFile) { return } + $line = '{0} [{1,-6}] {2}' -f (Get-Date).ToString('yyyy-MM-dd HH:mm:ss.fff'), $Level, ($Message -replace '[\r\n]+', ' | ') + try { [IO.File]::AppendAllText($Context.LogFile, $line + "`r`n", (New-Object Text.UTF8Encoding($false))) } + catch { + $failure = 'The log file cannot be written: {0}' -f $_.Exception.Message + Add-PraIssue $Context $failure 'Log' + Write-Host (' [ERROR] ' + $failure) -ForegroundColor Red + throw + } +} + +function Write-PraLog { + <# + .SYNOPSIS + Writes a message to the log file and, depending on the level, to the console. + .PARAMETER Level + Info console item (bullet) + log + Success console item (tick, green) + log + Warning console item (yellow) + log; counted in the warnings + Error console item (red) + log; recorded as a run error (exit code 1) + Sub indented console detail line + log + Detail log only (full values, technical traces) + Debug log only; also on the console with -Verbose + Step log only (step headers are drawn by Write-PraStep) + .PARAMETER ForegroundColor + Console colour of the text (presentation only: it never changes the level or the counters). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][AllowEmptyString()][string]$Message, + [ValidateSet('Info','Sub','Success','Warning','Error','Debug','Step','Detail')][string]$Level = 'Info', + [ConsoleColor]$ForegroundColor) + $logLevel = @{ Info='INFO'; Sub='INFO'; Success='OK'; Warning='WARN'; Error='ERROR'; Debug='DEBUG'; Step='STEP'; Detail='DETAIL' }[$Level] + if ($Level -eq 'Warning') { $Context.Warnings = [int](Get-PraValue $Context 'Warnings' 0) + 1; Add-PraWarning $Context $Message } + if ($Level -eq 'Error') { Add-PraIssue $Context $Message } + Write-PraLogFile -Context $Context -Level $logLevel -Message $Message + $text = $Message -replace '[\r\n]+', ' | ' + switch ($Level) { + 'Debug' { + $verbose = [bool](Get-PraValue $Context 'VerboseEnabled' ($VerbosePreference -eq 'Continue')) + Write-Verbose $text -Verbose:$verbose + } + 'Detail' { } + 'Step' { } + 'Sub' { + $color = if ($PSBoundParameters.ContainsKey('ForegroundColor')) { [string]$ForegroundColor } else { $script:Theme.Dim } + Write-PraHost @(,@((' ' + $text), $color)) + } + default { + $status = @{ Info='Info'; Success='Ok'; Warning='Warn'; Error='Fail' }[$Level] + $iconColor = @{ Info=$script:Theme.Info; Ok=$script:Theme.Ok; Warn=$script:Theme.Warn; Fail=$script:Theme.Fail }[$status] + $textColor = if ($PSBoundParameters.ContainsKey('ForegroundColor')) { [string]$ForegroundColor } + elseif ($status -in @('Warn','Fail')) { $iconColor } else { '' } + Write-PraHost @(' ', (Get-PraIcon $status), $text) -Color $textColor + } + } + if ($Level -in @('Info','Sub','Success','Warning','Error')) { + Write-PraEvent -Kind item -Data @{ status = @{ Info='Info'; Sub='Sub'; Success='Ok'; Warning='Warn'; Error='Fail' }[$Level] + text = $text; identity = [string](Get-PraValue $Context 'CurrentIdentity' '') } + } +} + +function Write-PraItem { + <# + .SYNOPSIS + One indented result line with a status icon, also written to the log. + .PARAMETER Status + Ok, Warn, Fail, Info or Skip. Fail does NOT record a run error: use Write-PraLog -Level Error for that. + .PARAMETER Icon + Optional icon name instead of the status icon (Directory, Backup, Cloud, Mail, ...). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context, [ValidateSet('Ok','Warn','Fail','Info','Skip')][string]$Status = 'Info', + [Parameter(Mandatory)][AllowEmptyString()][string]$Text, [string]$Icon) + $color = @{ Ok=$script:Theme.Ok; Warn=$script:Theme.Warn; Fail=$script:Theme.Fail; Info=$script:Theme.Info; Skip=$script:Theme.Dim }[$Status] + $textColor = if ($Status -in @('Warn','Fail','Skip')) { $color } else { '' } + $symbol = if ($Icon) { Get-PraIcon $Icon } else { Get-PraIcon $Status } + Write-PraHost @(' ', $symbol, $Text) -Color $textColor + if ($Status -eq 'Warn') { $Context.Warnings = [int](Get-PraValue $Context 'Warnings' 0) + 1; Add-PraWarning $Context $Text } + Write-PraLogFile -Context $Context -Level (@{ Ok='OK'; Warn='WARN'; Fail='FAIL'; Info='INFO'; Skip='SKIP' }[$Status]) -Message $Text + Write-PraEvent -Kind item -Data @{ status = $Status; text = $Text; identity = [string](Get-PraValue $Context 'CurrentIdentity' '') } +} + +function Write-PraBanner { + <# + .SYNOPSIS + Title card at the start of an execution: + + ╭────────────────────────────────────────────────────────────────────────────╮ + │ ♦ PRA Remote Mailbox v2.2.0 · Nicolas Fabert │ + │ Hybrid Exchange disaster recovery · on-premises mailboxes → Exchange O │ + ╰────────────────────────────────────────────────────────────────────────────╯ + ► Action Convert · Preview (nothing is changed) + .PARAMETER Details + Ordered list of rows: key = label, value = @(IconName, Text) or plain text. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Title, [string]$Subtitle, + [System.Collections.Specialized.OrderedDictionary]$Details) + $F = $script:Frame; $T = $script:Theme; $width = 76 + $right = "v$($Context.Version) $([char]0x00B7) Nicolas Fabert" + $left = " $($script:Icons.Logo) $Title" + $iconWidth = if ($script:IconStyle -eq 'Emoji') { 2 } else { $script:Icons.Logo.Length } + $visible = $left.Length - $script:Icons.Logo.Length + $iconWidth + $gap = [Math]::Max(1, $width - $visible - $right.Length - 2) + Write-Host '' + Write-PraHost @(,@((' ' + $F.TopLeft + ($F.Horizontal * $width) + $F.TopRight), $T.Accent)) + Write-PraHost @(' ', $F.Vertical, $left, (' ' * $gap), $right, ' ', $F.Vertical) -Color $T.Accent + if ($Subtitle) { + $sub = (' ' + $Subtitle) + if ($sub.Length -gt $width) { $sub = $sub.Substring(0, $width) } + Write-PraHost @(' ', $F.Vertical, $sub.PadRight($width), $F.Vertical) -Color $T.Accent + } + Write-PraHost @(,@((' ' + $F.BottomLeft + ($F.Horizontal * $width) + $F.BottomRight), $T.Accent)) + Write-PraLogFile -Context $Context -Level 'STEP' -Message ("=== $Title v$($Context.Version) - run $($Context.RunId) ===") + $eventDetails = [ordered]@{} + if ($Details) { + foreach ($key in $Details.Keys) { + $value = $Details[$key] + $icon = ' '; $text = $value + if ($value -is [array]) { $icon = Get-PraIcon $value[0]; $text = $value[1] } + Write-PraHost @(' ', $icon, ('{0,-11}' -f $key), (' ' + $text)) + Write-PraLogFile -Context $Context -Level 'INFO' -Message ('{0}: {1}' -f $key, $text) + $eventDetails[$key] = [string]$text + } + } + Write-PraEvent -Kind start -Data @{ title = $Title; action = [string](Get-PraValue $Context 'Action' '') + mode = [string](Get-PraValue $Context 'Mode' ''); phase = [string](Get-PraValue $Context 'Phase' '') + version = [string]$Context.Version; runId = [string]$Context.RunId + logFile = [string](Get-PraValue $Context 'LogFile' ''); details = $eventDetails } +} + +function Write-PraStep { + <# + .SYNOPSIS + Step header with a coloured number pill and an icon, e.g. + + 3/7 ► Reading the targets and planning the changes + .DESCRIPTION + The step number comes from $Context.StepIndex (incremented here) and the total from + $Context.StepTotal (set by the entry script for the selected action and phase). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Title, [string]$Icon = 'Plan') + $Context.StepIndex = [int](Get-PraValue $Context 'StepIndex' 0) + 1 + $Context.CurrentPhase = $Title + $total = [int](Get-PraValue $Context 'StepTotal' 0) + $number = if ($total -gt 0) { '{0}/{1}' -f $Context.StepIndex, $total } else { [string]$Context.StepIndex } + Write-Host '' + Write-PraHost @(' ', ('{0,5}' -f $number), ' ', (Get-PraIcon $Icon), $Title) -Color $script:Theme.Accent + Write-PraLogFile -Context $Context -Level 'STEP' -Message ("[$number] $Title") + Write-PraEvent -Kind step -Data @{ index = $Context.StepIndex; total = $total; title = $Title } +} + +function Write-PraSummary { + <# + .SYNOPSIS + Final summary card: + + ╭─ √ Convert finished ──────────────────────────────────────────────────────╮ + √ Result 2 done · 0 pending · 0 errors + ■ Batch 490cc62e (Backups\Batch-490cc62e...) + ╰────────────────────────────────────────────────────────────────────────────╯ + .PARAMETER Values + Ordered list: key = label, value = @(IconName, Text) or plain text. A text can be an array + (several lines under the same label). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)][string]$Title, + [Parameter(Mandatory)][System.Collections.Specialized.OrderedDictionary]$Values, [ValidateSet('Ok','Warn','Fail')][string]$Status = 'Ok') + $F = $script:Frame; $T = $script:Theme; $width = 76 + $color = @{ Ok=$T.Ok; Warn=$T.Warn; Fail=$T.Fail }[$Status] + $icon = $script:Icons[@{ Ok='Done'; Warn='Warn'; Fail='Fail' }[$Status]] + $iconWidth = if ($script:IconStyle -eq 'Emoji') { 2 } else { $icon.Length } + $head = " $icon $Title " + $rest = [Math]::Max(2, $width - 1 - ($head.Length - $icon.Length + $iconWidth)) + Write-Host '' + Write-PraHost @(' ', ($F.TopLeft + $F.Horizontal), $head, (($F.Horizontal * $rest) + $F.TopRight)) -Color $color + foreach ($key in $Values.Keys) { + $value = $Values[$key] + $rowIcon = ' '; $text = $value + if ($value -is [array] -and $value.Count -eq 2 -and $script:Icons.ContainsKey([string]$value[0])) { $rowIcon = Get-PraIcon $value[0]; $text = $value[1] } + $first = $true + foreach ($line in @($text)) { + $label = if ($first) { '{0,-11}' -f $key } else { ' ' * 11 } + $iconText = if ($first) { $rowIcon } else { ' ' } + Write-PraHost @(' ', $iconText, $label, (' ' + $line)) + Write-PraLogFile -Context $Context -Level 'INFO' -Message ('Summary - {0}: {1}' -f $key, $line) + $first = $false + } + } + Write-PraHost @(,@((' ' + $F.BottomLeft + ($F.Horizontal * $width) + $F.BottomRight), $color)) + $eventValues = [ordered]@{} + foreach ($key in $Values.Keys) { + $value = $Values[$key] + $text = if ($value -is [array] -and $value.Count -eq 2 -and $script:Icons.ContainsKey([string]$value[0])) { $value[1] } else { $value } + $eventValues[$key] = @(@($text) | ForEach-Object { [string]$_ }) + } + Write-PraEvent -Kind summary -Data @{ title = $Title; status = $Status; values = $eventValues } +} +#endregion + +#region 3. Configuration ---------------------------------------------------------------------- + +function Resolve-PraPath { + <# + .SYNOPSIS + Full path of a file or folder; a relative path is relative to the tool folder. + .DESCRIPTION + Invalid characters (often a line break pasted with the path) are reported with their + position and Unicode code instead of being removed silently. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][AllowEmptyString()][string]$Path, [string]$Name = 'Path', [Parameter(Mandatory)][string]$Root) + $invalid = [IO.Path]::GetInvalidPathChars(); $count = 0; $positions = @() + for ($i = 0; $i -lt $Path.Length; $i++) { + if ($Path[$i] -in $invalid) { + $count++ + if ($positions.Count -lt 8) { $positions += ('{0}:U+{1:X4}' -f $i, [int][char]$Path[$i]) } + } + } + if ($count) { + throw ('Invalid path in {0}: length={1}, invalid characters={2}, positions (0-based UTF-16)={3}, others={4}. Retype the value (a pasted line break is the usual cause).' -f $Name, $Path.Length, $count, ($positions -join ', '), ($count - $positions.Count)) + } + if ([IO.Path]::IsPathRooted($Path)) { return [IO.Path]::GetFullPath($Path) } + return [IO.Path]::GetFullPath((Join-Path $Root $Path)) +} + +function Get-PraNativePathApi { + <# Two kernel32 calls (open a handle, read its final path) bound in memory with Reflection.Emit (static AssemblyBuilder.DefineDynamicAssembly, one-argument DefineDynamicModule and CreateType: the same calls in Windows PowerShell 5.1 and PowerShell 7): no compiler, temporary file, DLL or cache. #> + if ($script:PraNativePath) { return $script:PraNativePath } + $assembly = [Reflection.Emit.AssemblyBuilder]::DefineDynamicAssembly((New-Object Reflection.AssemblyName 'PraNativePath'), [Reflection.Emit.AssemblyBuilderAccess]::Run) + $type = $assembly.DefineDynamicModule('PraNativePath').DefineType('Api', 'Public,Class,Sealed,Abstract') + $flags = [Reflection.MethodImplAttributes]::PreserveSig + $open = $type.DefinePInvokeMethod('CreateFileW', 'kernel32.dll', 'Public,Static,PinvokeImpl', [Reflection.CallingConventions]::Standard, + [Microsoft.Win32.SafeHandles.SafeFileHandle], [Type[]]@([string], [uint32], [uint32], [IntPtr], [uint32], [uint32], [IntPtr]), + [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Unicode) + $open.SetImplementationFlags($flags) + $final = $type.DefinePInvokeMethod('GetFinalPathNameByHandleW', 'kernel32.dll', 'Public,Static,PinvokeImpl', [Reflection.CallingConventions]::Standard, + [uint32], [Type[]]@([Microsoft.Win32.SafeHandles.SafeFileHandle], [Text.StringBuilder], [uint32], [uint32]), + [Runtime.InteropServices.CallingConvention]::Winapi, [Runtime.InteropServices.CharSet]::Unicode) + $final.SetImplementationFlags($flags) + $script:PraNativePath = $type.CreateType() + return $script:PraNativePath +} + +function Get-PraPhysicalPath { + <# + .SYNOPSIS + Physical location of a path as the filesystem resolves it (junctions, symbolic links, SUBST and mapped drives, + 8.3 names, \\?\ prefixes), even when its last folders do not exist yet. + .DESCRIPTION + The deepest existing ancestor is opened and its final path read from the handle; the missing folders are + appended unchanged. Anything that cannot be resolved throws: a path is never assumed to be elsewhere. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$Path) + $full = [IO.Path]::GetFullPath($Path) + if ($full -match '^\\\\[?.]\\') { + if (@($full.Split('\') | Select-Object -Skip 3 | Where-Object { $_ -eq '.' -or $_ -eq '..' }).Count) { throw "Path $Path uses a device namespace with relative segments; it cannot be resolved safely." } + } + $existing = $full.TrimEnd('\') + if ($existing -match '^[A-Za-z]:$' -or $existing -match '^\\\\[?.]\\[A-Za-z]:$') { $existing += '\' } + $missing = New-Object Collections.Generic.List[string] + while (-not ([IO.Directory]::Exists($existing) -or [IO.File]::Exists($existing))) { + $parent = [IO.Path]::GetDirectoryName($existing) + if (-not $parent) { throw "Path $Path cannot be resolved: neither it nor any parent exists, so its physical location is unknown." } + $missing.Insert(0, [IO.Path]::GetFileName($existing)) + $existing = $parent + } + $native = if ($existing -match '^\\\\[?.]\\') { $existing } + elseif ($existing.StartsWith('\\')) { '\\?\UNC\' + $existing.Substring(2) } + else { '\\?\' + $existing } + $api = Get-PraNativePathApi + $handle = $api::CreateFileW($native, [uint32]0, [uint32]7, [IntPtr]::Zero, [uint32]3, [uint32]0x02000000, [IntPtr]::Zero) + try { + if ($handle.IsInvalid) { throw "Path $Path cannot be resolved: the filesystem refused to open $existing." } + $buffer = New-Object Text.StringBuilder 1024 + $length = $api::GetFinalPathNameByHandleW($handle, $buffer, [uint32]$buffer.Capacity, [uint32]0) + if ($length -gt $buffer.Capacity) { + $buffer = New-Object Text.StringBuilder ([int]$length + 1) + $length = $api::GetFinalPathNameByHandleW($handle, $buffer, [uint32]$buffer.Capacity, [uint32]0) + } + if ($length -eq 0 -or $length -gt $buffer.Capacity) { throw "Path $Path cannot be resolved: the final path of $existing is unavailable." } + $physical = $buffer.ToString() + } + finally { if ($handle) { $handle.Dispose() } } + if ($physical.StartsWith('\\?\UNC\', [StringComparison]::OrdinalIgnoreCase)) { $physical = '\\' + $physical.Substring(8) } + elseif ($physical -match '^\\\\\?\\[A-Za-z]:\\') { $physical = $physical.Substring(4) } + elseif ($physical.StartsWith('\\?\')) { throw "Path $Path cannot be resolved to a drive or share path ($physical); refusing the ambiguous namespace." } + foreach ($name in $missing) { $physical = $physical.TrimEnd('\') + '\' + $name } + return $physical +} + +function Assert-PraOutputFolder { + <# + .SYNOPSIS + Refuses an output folder inside the authenticated package other than its own canonical folder. + .DESCRIPTION + The package integrity check treats every file of the package as stable except the generated root + folders Backups, logs and reports (exact case). A backup, log or report folder anywhere else inside + the package would make the next start fail, so it is refused here, before any file is created. The + test uses the physical location of the package and of the folder (Get-PraPhysicalPath), so a \\?\ prefix, + an 8.3 name, a junction, SUBST or a legacy alias such as 'Documents and Settings' cannot hide the package; + a path that cannot be resolved is refused. The returned path is the one to use: the physical path when + it is inside the package, otherwise the configured folder unchanged. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Name, [Parameter(Mandatory)][string]$Canonical, [Parameter(Mandatory)][string]$Root) + $rootFull = [IO.Path]::GetFullPath($Root).TrimEnd('\') + $full = [IO.Path]::GetFullPath($Path) + if ($full.Length -gt [IO.Path]::GetPathRoot($full).Length) { $full = $full.TrimEnd('\') } + $lexical = $full -ieq $rootFull -or $full.StartsWith($rootFull + '\', [StringComparison]::OrdinalIgnoreCase) + if ($lexical) { + $relative = $full.Substring($rootFull.Length).TrimStart('\') + $first = if ($relative) { $relative.Split('\')[0] } else { '' } + if ($first -cne $Canonical) { + throw "Configuration: $Name ($full) is inside the signed package and is not the $Canonical folder. Use '.\$Canonical' (a sub-folder of it is accepted) or a folder outside the package; any other folder inside the package would break package integrity." + } + $current = $rootFull + foreach ($segment in $relative.Split('\')) { + $current = $current + '\' + $segment + if (-not (Test-Path -LiteralPath $current)) { break } + if ((Get-Item -LiteralPath $current -Force).Attributes -band [IO.FileAttributes]::ReparsePoint) { + throw "Configuration: $Name goes through a reparse point inside the package ($current); the integrity check refuses it." + } + } + } + try { + $physicalRoot = (Get-PraPhysicalPath $rootFull).TrimEnd('\') + $physical = (Get-PraPhysicalPath $full).TrimEnd('\') + } + catch { throw "Configuration: $Name ($full) cannot be checked against the signed package, so it is refused: $($_.Exception.Message)" } + $inside = $physical -ieq $physicalRoot -or $physical.StartsWith($physicalRoot + '\', [StringComparison]::OrdinalIgnoreCase) + if (-not $inside) { + if ($lexical) { throw "Configuration: $Name ($full) is inside the signed package but resolves outside it ($physical); the location is ambiguous and is refused." } + return $full + } + $relative = $physical.Substring($physicalRoot.Length).TrimStart('\') + $first = if ($relative) { $relative.Split('\')[0] } else { '' } + if ($first -cne $Canonical) { + throw "Configuration: $Name ($full) resolves to $physical, inside the signed package, and is not the $Canonical folder. Use '.\$Canonical' (a sub-folder of it is accepted) or a folder outside the package; any other folder inside the package would break package integrity." + } + $current = $physicalRoot + foreach ($segment in $relative.Split('\')) { + $current = $current + '\' + $segment + if (-not (Test-Path -LiteralPath $current)) { break } + if ((Get-Item -LiteralPath $current -Force).Attributes -band [IO.FileAttributes]::ReparsePoint) { + throw "Configuration: $Name goes through a reparse point inside the package ($current); the integrity check refuses it." + } + } + return $physical +} +function Merge-PraConfiguration { + <# Adds the missing keys from the defaults and checks the type of every known key. #> + param([hashtable]$Values, [hashtable]$Defaults, [string]$Prefix = '') + foreach ($key in $Defaults.Keys) { + if (-not $Values.ContainsKey($key)) { $Values[$key] = $Defaults[$key]; continue } + $value = $Values[$key]; $default = $Defaults[$key] + if ($default -is [hashtable]) { + if ($value -isnot [hashtable]) { throw "Configuration: $Prefix$key must be a section @{ ... }." } + Merge-PraConfiguration $value $default "$Prefix$key." + } + elseif ($default -is [bool] -and $value -isnot [bool]) { throw "Configuration: $Prefix$key must be `$true or `$false." } + elseif ($default -is [string] -and $value -isnot [string]) { throw "Configuration: $Prefix$key must be text between quotes." } + elseif ($default -is [int] -and $value -isnot [int]) { throw "Configuration: $Prefix$key must be a whole number." } + elseif ($default -is [array] -and $value -isnot [array]) { throw "Configuration: $Prefix$key must be a list @( ... )." } + } + foreach ($key in @($Values.Keys)) { + if (-not $Defaults.ContainsKey($key)) { throw "Configuration: unknown setting $Prefix$key (check the spelling, see the guide chapter 6)." } + } +} + +function Get-PraDefaultConfiguration { + <# Default values of every setting (the reference list of the valid keys). #> + return @{ + Environment = 'PROD' + DomainController = '' + Scope = @{ Mode='OU'; SearchBase=''; GroupDN=''; CsvPath=''; IncludeShared=$true; IncludeRoom=$false; IncludeEquip=$false; ExcludeSamAccountNames=@() } + Remote = @{ RecipientType=1; HandleArchives=$true; ClearMailboxGuid=$true } + Routing = @{ AutoDetect=$true; RoutingDomain='' } + Licensing = @{ Enabled=$true; GroupDN='' } + SharedMailbox = @{ + Enabled=$true; RemoteRecipientType=97; PermissionSource='AD'; CsvPath=''; CustomAttribute='extensionAttribute1' + CaptureSendOnBehalf=$true; GrantFullAccess=$true; GrantSendAs=$true; GrantSendOnBehalf=$true; AutoMapping=$true + KeepCloudSharedOnRecover=$false; DeferOnPremRestore=$false; ExcludeTrusteeSamAccountNames=@() + } + EntraConnect = @{ Sync=$true; Server=''; PolicyType='Delta'; TimeoutMinutes=15 } + Cloud = @{ + TenantId=''; Organization=''; AppId=''; CertificateThumbprint=''; UserPrincipalName='' + CheckMailbox=$true; CheckLicense=$true; MailboxCheckVia='Exo'; RequiredSkuPartNumber='' + } + Exo = @{ MinModuleVersion='3.10.0'; UseSubprocess=$false; DisableWAM=$false; GrantVerifyAttempts=13; GrantVerifyDelaySeconds=10 } + Polling = @{ IntervalMinutes=5; TimeoutMinutes=60 } + Retention = @{ Enabled=$true; PolicyName=''; PolicyGuid=''; UseComplianceSession=$false; Tag=@{ Enabled=$true; Attribute='extensionAttribute1'; Value='Converted' } } + Execution = @{ Phase='Both' } + Storage = @{ BackupFolder='.\Backups'; ForbiddenBackupRoots=@() } + Logging = @{ Folder='.\logs' } + Report = @{ Enabled=$true; Folder='.\reports' } + } +} + +function Get-PraTargetOverride { + <# Run-specific targeting; the original data file is never rewritten. #> + [CmdletBinding()] + param([string]$SearchBase = '', [string]$CsvPath = '', [string]$Identity = '') + foreach ($value in @($SearchBase,$CsvPath)) { + if ($value -match '[\x00-\x1f]' -or ($value -and [string]::IsNullOrWhiteSpace($value))) { throw 'Target OU/CSV contains an empty value or a control character.' } + } + if ($SearchBase -and $CsvPath) { throw 'Choose one source: SearchBase (OU) or CsvPath, not both.' } + if ($Identity -and ($SearchBase -or $CsvPath)) { throw 'Identity cannot be combined with a selected OU or CSV.' } + if ($SearchBase) { return @{ Mode='OU'; SearchBase=$SearchBase.Trim(); CsvPath=''; GroupDN='' } } + if ($CsvPath) { return @{ Mode='Csv'; CsvPath=$CsvPath.Trim(); SearchBase=''; GroupDN='' } } + return @{} +} + +function Read-PraTargetCsv { + <# Same local validation in the window and the engine; directory eligibility is checked later. #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$Path) + $text = [IO.File]::ReadAllText($Path, [Text.Encoding]::UTF8) + if ([string]::IsNullOrWhiteSpace($text)) { throw "The target CSV file is empty: $Path" } + $header = ($text -split '\r?\n',2)[0] + $delimiter = if ($header -match '(?i)(^|,)\s*"?Identity"?\s*(,|$)') { ',' } + elseif ($header -match '(?i)(^|;)\s*"?Identity"?\s*(;|$)') { ';' } + else { throw 'The target CSV requires an Identity column (UPN, sAMAccountName, DN or GUID).' } + $rows = @(ConvertFrom-Csv -InputObject $text -Delimiter $delimiter -ErrorAction Stop) + if (-not $rows.Count) { throw "The target CSV file has no objects: $Path" } + foreach ($row in $rows) { + $identity = [string](Get-PraValue $row 'Identity' '') + if ([string]::IsNullOrWhiteSpace($identity) -or $identity -match '[\x00-\x1f]') { throw 'A line of the target CSV file has no valid Identity: batch refused.' } + [pscustomobject]@{ Identity=$identity.Trim() } + } +} + +function Import-PraConfiguration { + <# + .SYNOPSIS + Reads the configuration file, adds the default values, checks every value and resolves the paths. + .PARAMETER Path + The .psd1 configuration file. + .PARAMETER Root + Tool folder: relative paths in the file are relative to it. + .OUTPUTS + Hashtable. Paths (Storage.BackupFolder, Logging.Folder, Report.Folder, Scope.CsvPath, + SharedMailbox.CsvPath, Storage.ForbiddenBackupRoots) are returned as full paths. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][string]$Root, [hashtable]$ScopeOverride = @{}) + $file = Resolve-PraPath $Path 'ConfigPath' $Root + if (-not (Test-Path -LiteralPath $file -PathType Leaf)) { throw "Configuration file not found: $file" } + $config = Import-PowerShellDataFile -LiteralPath $file -ErrorAction Stop + Merge-PraConfiguration $config (Get-PraDefaultConfiguration) + foreach ($key in $ScopeOverride.Keys) { + if ($key -notin @('Mode','SearchBase','CsvPath','GroupDN') -or $ScopeOverride[$key] -isnot [string]) { throw 'Unsupported target scope override.' } + $config.Scope[$key] = $ScopeOverride[$key] + } + + if ($config.Environment -notmatch '^[A-Za-z0-9_.-]{1,64}$') { throw 'Configuration: Environment must be 1 to 64 letters, digits, dot, dash or underscore (it is used in file names).' } + if ($config.DomainController -and $config.DomainController -notmatch '^[A-Za-z0-9.-]+$') { throw 'Configuration: DomainController must be a host name.' } + $scope = $config.Scope + if ($scope.Mode -notin @('Auto','OU','Group','Csv')) { throw 'Configuration: Scope.Mode must be Auto, OU, Group or Csv.' } + if ($scope.Mode -eq 'OU' -and -not $scope.SearchBase) { throw 'Configuration: Scope.Mode = OU requires Scope.SearchBase (a search of the whole domain needs Mode = Auto).' } + if ($scope.Mode -eq 'Group' -and -not $scope.GroupDN) { throw 'Configuration: Scope.Mode = Group requires Scope.GroupDN.' } + if ($scope.Mode -eq 'Csv' -and -not $scope.CsvPath) { throw 'Configuration: Scope.Mode = Csv requires Scope.CsvPath.' } + if ($config.Remote.RecipientType -notin @(1,3)) { throw 'Configuration: Remote.RecipientType must be 1 (provision a mailbox) or 3 (mailbox + archive).' } + if ($config.Routing.RoutingDomain -and $config.Routing.RoutingDomain -notmatch '^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$') { throw 'Configuration: Routing.RoutingDomain must be a domain name (tenant.mail.onmicrosoft.com).' } + if ($config.Licensing.Enabled -and -not $config.Licensing.GroupDN) { throw 'Configuration: Licensing.Enabled requires Licensing.GroupDN.' } + $shared = $config.SharedMailbox + if ($shared.RemoteRecipientType -notin @(97,99,100,102)) { throw 'Configuration: SharedMailbox.RemoteRecipientType must be 97 or 99 (100/102 are accepted only to read old backups).' } + if ($shared.PermissionSource -notin @('AD','Csv','CustomAttribute','None')) { throw 'Configuration: SharedMailbox.PermissionSource must be AD, Csv, CustomAttribute or None.' } + if ($shared.PermissionSource -eq 'Csv' -and -not $shared.CsvPath) { throw 'Configuration: SharedMailbox.PermissionSource = Csv requires SharedMailbox.CsvPath.' } + if ($shared.CustomAttribute -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw 'Configuration: SharedMailbox.CustomAttribute must be extensionAttribute1 to extensionAttribute15.' } + $sync = $config.EntraConnect + if ($sync.PolicyType -notin @('Delta','Initial')) { throw 'Configuration: EntraConnect.PolicyType must be Delta or Initial.' } + if ($sync.TimeoutMinutes -lt 1 -or $sync.TimeoutMinutes -gt 240) { throw 'Configuration: EntraConnect.TimeoutMinutes must be between 1 and 240.' } + if ($sync.Server -and $sync.Server -notmatch '^[A-Za-z0-9.-]+$') { throw 'Configuration: EntraConnect.Server must be a host name (empty = this server).' } + $cloud = $config.Cloud + if ($cloud.MailboxCheckVia -notin @('Graph','Exo')) { throw 'Configuration: Cloud.MailboxCheckVia must be Exo or Graph.' } + if ([bool]$cloud.AppId -ne [bool]$cloud.CertificateThumbprint) { throw 'Configuration: Cloud.AppId and Cloud.CertificateThumbprint go together (both set = certificate sign-in, both empty = interactive sign-in).' } + $exo = $config.Exo + if ($exo.GrantVerifyAttempts -lt 1 -or $exo.GrantVerifyAttempts -gt 60 -or $exo.GrantVerifyDelaySeconds -lt 1 -or $exo.GrantVerifyDelaySeconds -gt 30) { + throw 'Configuration: Exo.GrantVerifyAttempts must be 1..60 and Exo.GrantVerifyDelaySeconds 1..30.' + } + try { $null = [version]$exo.MinModuleVersion } catch { throw 'Configuration: Exo.MinModuleVersion must be a version number (3.10.0).' } + if ($config.Polling.IntervalMinutes -lt 1 -or $config.Polling.TimeoutMinutes -lt 1) { throw 'Configuration: Polling.IntervalMinutes and Polling.TimeoutMinutes must be at least 1.' } + $retention = $config.Retention + if ($retention.Tag.Attribute -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw 'Configuration: Retention.Tag.Attribute must be extensionAttribute1 to extensionAttribute15.' } + if ($retention.Enabled -and $retention.Tag.Enabled -and -not $retention.Tag.Value) { throw 'Configuration: Retention.Tag.Value is empty.' } + if ($config.Execution.Phase -notin @('Both','AD','Cloud')) { throw 'Configuration: Execution.Phase must be Both, AD or Cloud.' } + + $config.Storage.BackupFolder = Resolve-PraPath $config.Storage.BackupFolder 'Storage.BackupFolder' $Root + $config.Storage.ForbiddenBackupRoots = @(foreach ($forbidden in $config.Storage.ForbiddenBackupRoots) { (Resolve-PraPath ([string]$forbidden) 'Storage.ForbiddenBackupRoots' $Root).TrimEnd('\') + '\' }) + $config.Logging.Folder = Resolve-PraPath $config.Logging.Folder 'Logging.Folder' $Root + $config.Report.Folder = Resolve-PraPath $config.Report.Folder 'Report.Folder' $Root + $config.Storage.BackupFolder = Assert-PraOutputFolder $config.Storage.BackupFolder 'Storage.BackupFolder' 'Backups' $Root + $config.Logging.Folder = Assert-PraOutputFolder $config.Logging.Folder 'Logging.Folder' 'logs' $Root + $config.Report.Folder = Assert-PraOutputFolder $config.Report.Folder 'Report.Folder' 'reports' $Root + foreach ($section in @('Scope','SharedMailbox')) { + if ($config[$section].CsvPath) { $config[$section].CsvPath = Resolve-PraPath $config[$section].CsvPath ($section + '.CsvPath') $Root } + } + $config['_Path'] = $file + return $config +} +#endregion + +#region 4. Audit ------------------------------------------------------------------------------ + +function Get-PraArtifactStem { + <# Unique, file-name safe prefix of the log, transcript and report files of this run. #> + [CmdletBinding()] + param([hashtable]$Context) + $id = ([string]$Context.RunId -replace '[^a-zA-Z0-9_.-]', '_') + if ($id.Length -gt 80) { $id = $id.Substring(0, 80) } + return ('PRA_{0}_{1}' -f $id, [guid]::NewGuid().ToString('N').Substring(0, 8)) +} + +function Wait-PraTranscriptFile { + <# + .SYNOPSIS + Waits until the transcript file really exists and is not empty. + .DESCRIPTION + Windows PowerShell 5.1 can return from Start-Transcript before the file is created. The first + console output starts it; this function waits for it (up to 5 s) instead of creating a + replacement file. A missing or empty transcript stops the run (no audit, no processing). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$LiteralPath, [ValidateRange(1,60000)][int]$TimeoutMilliseconds = 5000) + $clock = [Diagnostics.Stopwatch]::StartNew() + do { + if (Test-Path -LiteralPath $LiteralPath -PathType Leaf -ErrorAction Stop) { + if ((Get-Item -LiteralPath $LiteralPath -ErrorAction Stop).Length -gt 0) { return } + } + if ($clock.ElapsedMilliseconds -ge $TimeoutMilliseconds) { break } + Start-Sleep -Milliseconds 50 + } while ($true) + throw "The transcript file is missing or empty after ${TimeoutMilliseconds} ms: $LiteralPath. No audit, no processing." +} + +function Initialize-PraAudit { + <# + .SYNOPSIS + Creates the log file of the run and starts the PowerShell transcript. Any failure stops the run. + .DESCRIPTION + Both files are created in $Context.LogFolder with a unique name; an existing file is never + overwritten and a transcript started by someone else is left untouched. When reports are + enabled, the report folder is also checked (a probe file is created and deleted). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context) + $Context.LogFile = '' + try { + if ($null -ne $script:TranscriptOwner) { throw 'A transcript of this module is already running.' } + $stem = Get-PraArtifactStem $Context + $Context['_PraArtifactStem'] = $stem + $Context.CurrentOperation = 'Create-Log' + $null = New-Item -ItemType Directory -Path $Context.LogFolder -Force -WhatIf:$false -Confirm:$false -ErrorAction Stop + $logPath = Join-Path $Context.LogFolder ($stem + '.log') + $null = New-Item -ItemType File -Path $logPath -WhatIf:$false -Confirm:$false -ErrorAction Stop + $Context.LogFile = $logPath + $transcript = Join-Path $Context.LogFolder ($stem + '.transcript.txt') + $Context.TranscriptPath = $transcript + $Context.CurrentOperation = 'Start-Transcript'; $Context['_PraTranscriptCreated'] = $false + # Never Stop-Transcript first and never -Append: a transcript started by someone else stays intact. + Start-Transcript -Path $transcript -NoClobber -WhatIf:$false -Confirm:$false -ErrorAction Stop | Out-Null + $Context.TranscriptStarted = $true; $script:TranscriptOwner = $Context + # The first host output makes Windows PowerShell 5.1 create the file. + Write-PraLog -Context $Context -Message ("Audit: host=$($Host.Name) PowerShell=$($PSVersionTable.PSVersion) transcript=$transcript") -Level Debug + Write-Host '' + $Context.CurrentOperation = 'Wait-TranscriptFile' + Wait-PraTranscriptFile -LiteralPath $transcript + $Context['_PraTranscriptCreated'] = $true + $Context.CurrentOperation = 'Check-ReportFolder' + if (-not $Context.NoReport) { + $null = New-Item -ItemType Directory -Path $Context.ReportFolder -Force -WhatIf:$false -Confirm:$false -ErrorAction Stop + $probe = Join-Path $Context.ReportFolder ($stem + '.probe'); $created = $false + try { + $null = New-Item -ItemType File -Path $probe -WhatIf:$false -Confirm:$false -ErrorAction Stop; $created = $true + Set-Content -LiteralPath $probe -Value 'PRA audit probe' -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop + } finally { if ($created) { Remove-Item -LiteralPath $probe -WhatIf:$false -Confirm:$false -ErrorAction Stop } } + } + Write-PraLog $Context ('Audit started: run {0}, version {1}, account {2}, computer {3}' -f $Context.RunId, $Context.Version, [Security.Principal.WindowsIdentity]::GetCurrent().Name, $env:COMPUTERNAME) -Level Detail + } catch { + Write-PraLog $Context ('Audit could not start: {0}' -f $_.Exception.Message) -Level Error + throw + } +} +#endregion + +#region 5. Results ---------------------------------------------------------------------------- + +function Get-PraOutcome { + <# + .SYNOPSIS + Result rows (one per object + one per run error not attached to an object), counters and exit code. + .DESCRIPTION + Exit code: 0 = done, 1 = failed (any error), 2 = done but at least one object is Pending + (a next step is needed, e.g. the cloud phase or Finalize). + #> + [CmdletBinding()] + param([hashtable]$Context) + $rows = New-Object 'System.Collections.Generic.List[object]' + $errorIdentities = @{} + foreach ($row in $Context.Rows.ToArray()) { + $copy = [ordered]@{} + # Same lookup as Get-PraValue (missing and $null both give $null), inlined: this loop runs 22 times per row on very large runs. + foreach ($field in $script:RowFields) { + $value = $null + if ($row -is [System.Collections.IDictionary]) { foreach ($entry in $row.GetEnumerator()) { if ($entry.Key -eq $field) { $value = $entry.Value; break } } } + elseif ($null -ne $row) { $property = $row.PSObject.Properties[$field]; if ($null -ne $property) { $value = $property.Value } } + $copy[$field] = $value + } + $copy.PermMissing = $copy.PermMissing -join '; ' + if ($copy.FinalStatus -notin $script:FinalStatuses) { + $copy.Detail = 'Final status missing or invalid: {0}. {1}' -f $copy.FinalStatus, $copy.Detail; $copy.FinalStatus = 'Error' + } + if ($copy.FinalStatus -eq 'Error') { + foreach ($field in @('ObjectGuid','SamAccountName','UserPrincipalName')) { if ($copy[$field]) { $errorIdentities[[string]$copy[$field]] = $true } } + } + [void]$rows.Add([pscustomobject]$copy) + } + foreach ($issue in $Context.Issues.ToArray()) { + $identity = [string](Get-PraValue $issue 'Identity' '') + $source = [string](Get-PraValue $issue 'Source' 'Execution') + if ($source -eq 'Execution' -and $identity -and $errorIdentities.ContainsKey($identity)) { continue } + $failure = [ordered]@{} + foreach ($field in $script:RowFields) { $failure[$field] = $null } + $failure.Action = $Context.Action; $failure.UserPrincipalName = $identity + $failure.FinalStatus = 'Error'; $failure.LastOperation = Get-PraValue $issue 'Operation' '' + $failure.Detail = '[Run/{0}] {1}' -f $source, (Get-PraValue $issue 'Message' ([string]$issue)) + [void]$rows.Add([pscustomobject]$failure) + } + $counts = @{ Success = 0; Error = 0; Pending = 0; Skipped = 0; Planned = 0 } + foreach ($row in $rows) { + $key = [string]$row.FinalStatus + if ($key -eq 'AlreadyDone') { $key = 'Success' } + $counts[$key]++ + } + $requested = [string](Get-PraValue $Context 'ResultStatus' '') + $code = 0; $status = 'Success' + if ($counts.Error -gt 0 -or $Context.Issues.Count -gt 0 -or [int]$Context.ExitCode -eq 1 -or $Context.CloudConnectFailed -or $requested -eq 'Failed') { + $code = 1; $status = 'Failed' + } elseif ($counts.Pending -gt 0) { $code = 2; $status = 'Pending' } + elseif ($Context.Mode -ne 'Apply' -and $counts.Planned -gt 0) { $status = 'Planned' } + return [pscustomobject]@{ Rows = $rows.ToArray(); Counts = $counts; Status = $status; ExitCode = $code } +} + +function ConvertTo-PraHtmlText { + param([AllowNull()][object]$Value) + if ($null -eq $Value) { return '' } + return [Net.WebUtility]::HtmlEncode([string]$Value) +} + +$script:ReportChunkRows = 20000 +$script:ReportChunkChars = 4000000 +$script:JsonEscape = New-Object Text.RegularExpressions.Regex('["\\\u0000-\u001f\u007f-\u009f\u2028\u2029<>&]') +$script:JsonEscapeEvaluator = [Text.RegularExpressions.MatchEvaluator]{ + param($m) + switch ($m.Value) { + '"' { '\"' } '\' { '\\' } "`n" { '\n' } "`r" { '\r' } "`t" { '\t' } "`b" { '\b' } "`f" { '\f' } + default { '\u' + ([int][char]$m.Value).ToString('x4') } + } +} + +function ConvertTo-PraJsonString { + <# + .SYNOPSIS + JSON string literal of a text. Quotes, backslashes, control characters, the HTML-significant characters + < > & and the line separators U+2028/U+2029 are escaped, so the result is safe in a script element. + #> + [CmdletBinding()] + param([AllowNull()][object]$Value) + if ($null -eq $Value) { return 'null' } + $Text = [string]$Value + if ($script:JsonEscape.IsMatch($Text)) { return '"' + $script:JsonEscape.Replace($Text, $script:JsonEscapeEvaluator) + '"' } + return '"' + $Text + '"' +} + +function Get-PraReportScalar { + <# + .SYNOPSIS + Keeps strings, booleans and finite numbers as they are and converts any other value to its text. + #> + [CmdletBinding()] + param([AllowNull()][object]$Value) + if ($null -eq $Value -or $Value -is [string] -or $Value -is [bool]) { return $Value } + if ($Value -is [int] -or $Value -is [long]) { return $Value } + if (($Value -is [double] -or $Value -is [single]) -and -not ([double]::IsNaN([double]$Value) -or [double]::IsInfinity([double]$Value))) { return $Value } + if ($Value -is [decimal]) { return $Value } + return [string]$Value +} + +function ConvertTo-PraJsonScalar { + [CmdletBinding()] + param([AllowNull()][object]$Value) + if ($null -eq $Value) { return 'null' } + if ($Value -is [string]) { return (ConvertTo-PraJsonString $Value) } + if ($Value -is [bool]) { if ($Value) { return 'true' } else { return 'false' } } + if ($Value -is [double] -or $Value -is [single]) { return ([double]$Value).ToString('R', [Globalization.CultureInfo]::InvariantCulture) } + return ([IFormattable]$Value).ToString($null, [Globalization.CultureInfo]::InvariantCulture) +} + +function Write-PraReportChunks { + <# + .SYNOPSIS + Writes items as gzip+base64 chunks of dictionary-indexed columns (script elements of type + application/x-pra-chunk). Each chunk holds at most ChunkRows items and about ChunkChars characters of the + long text fields, so memory stays bounded whatever the number of items. Dictionary index 0 is null. + Returns the number of chunks. + #> + [CmdletBinding()] + param( + [Parameter(Mandatory)][IO.TextWriter]$Writer, [Parameter(Mandatory)][string]$Kind, + [AllowEmptyCollection()][object[]]$Items, [Parameter(Mandatory)][string[]]$Fields, [string[]]$SizeFields = @(), + [int]$ChunkRows = $script:ReportChunkRows, [int]$ChunkChars = $script:ReportChunkChars + ) + $dictionaries = @(for ($f = 0; $f -lt $Fields.Count; $f++) { ,(New-Object 'Collections.Generic.Dictionary[object,int]') }) + $utf8 = New-Object Text.UTF8Encoding($false) + $jsonEscape = $script:JsonEscape; $jsonEvaluator = $script:JsonEscapeEvaluator + $position = 0; $chunks = 0 + while ($position -lt $Items.Count) { + $end = $position; $chars = 0 + while ($end -lt $Items.Count -and ($end - $position) -lt $ChunkRows) { + $item = $Items[$end] + foreach ($sizeField in $SizeFields) { $text = $item.$sizeField; if ($text -is [string]) { $chars += $text.Length } } + if ($chars -gt $ChunkChars -and $end -gt $position) { break } + $end++ + } + $count = $end - $position + $slice = New-Object object[] $count + [Array]::Copy($Items, $position, $slice, 0, $count) + $json = New-Object Text.StringBuilder + $indexes = New-Object Text.StringBuilder + [void]$json.Append('{"n":').Append($count).Append(',"d":[') + for ($f = 0; $f -lt $Fields.Count; $f++) { + $name = $Fields[$f]; $dictionary = $dictionaries[$f] + $column = New-Object int[] $count + $added = New-Object 'Collections.Generic.List[string]' + if ($chunks -eq 0) { $added.Add('null') } + $k = 0 + for ($i = 0; $i -lt $count; $i++) { + $value = $slice[$i].$name + if ($null -eq $value) { continue } + if ($value -isnot [string] -and $value -isnot [bool]) { $value = Get-PraReportScalar $value } + if ($dictionary.TryGetValue($value, [ref]$k)) { $column[$i] = $k } + else { + $k = $dictionary.Count + 1 + $dictionary.Add($value, $k) + if ($value -is [string]) { + if ($jsonEscape.IsMatch($value)) { $added.Add('"' + $jsonEscape.Replace($value, $jsonEvaluator) + '"') } else { $added.Add('"' + $value + '"') } + } elseif ($value -is [bool]) { if ($value) { $added.Add('true') } else { $added.Add('false') } } + else { $added.Add((ConvertTo-PraJsonScalar $value)) } + $column[$i] = $k + } + } + if ($f) { [void]$json.Append(',') ; [void]$indexes.Append(',') } + [void]$json.Append('[').Append([string]::Join(',', $added)).Append(']') + [void]$indexes.Append('[').Append([string]::Join(',', $column)).Append(']') + } + [void]$json.Append('],"c":[').Append($indexes.ToString()).Append(']}') + $memory = New-Object IO.MemoryStream + $gzip = New-Object IO.Compression.GZipStream($memory, [IO.Compression.CompressionMode]::Compress, $true) + try { $bytes = $utf8.GetBytes($json.ToString()); $gzip.Write($bytes, 0, $bytes.Length) } finally { $gzip.Dispose() } + $Writer.Write('`r`n") + $memory.Dispose() + $chunks++; $position = $end + } + return $chunks +} + +function Write-PraReportHtml { + <# + .SYNOPSIS + Streams the HTML report (templates\Report.template.html) to a writer. The header, the tiles and the next + steps are HTML-encoded markup; the object rows (the 22 fields of the CSV), the run errors and the warnings are + written by Write-PraReportChunks. Used by Write-PraReport (file) and Get-PraReportHtml (string). + #> + [CmdletBinding()] + param([hashtable]$Context, $Outcome, [Parameter(Mandatory)][IO.TextWriter]$Writer, + [int]$ChunkRows = $script:ReportChunkRows, [int]$ChunkChars = $script:ReportChunkChars) + $templatePath = Join-Path $Context.Root 'templates\Report.template.html' + $template = if (Test-Path -LiteralPath $templatePath -PathType Leaf) { [IO.File]::ReadAllText($templatePath, [Text.Encoding]::UTF8) } + else { '{{TITLE}}

{{TITLE}}

{{SUBTITLE}}

{{TILES}}{{NEXT}}

{{DATA_NOTICE}} Template missing: only the CSV file holds the rows.

' } + $c = $Outcome.Counts + $warningList = @(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) + $issueList = @($Context.Issues.ToArray()) + $statusClass = @{ Success='ok'; Planned='info'; Pending='warn'; Failed='fail' }[$Outcome.Status] + $tiles = New-Object Text.StringBuilder + foreach ($tile in @( + @('Result', $Outcome.Status, $statusClass), @('Objects', $Outcome.Rows.Count, ''), @('Done', $c.Success, 'ok'), + @('Pending', $c.Pending, $(if ($c.Pending) { 'warn' } else { '' })), @('Errors', $c.Error, $(if ($c.Error) { 'fail' } else { '' })), + @('Warnings', $warningList.Count, $(if ($warningList.Count) { 'warn' } else { '' })), + @('Planned', $c.Planned, $(if ($c.Planned) { 'info' } else { '' })), @('Skipped', $c.Skipped, ''))) { + [void]$tiles.AppendFormat('
{0}
{1}
', (ConvertTo-PraHtmlText $tile[0]), (ConvertTo-PraHtmlText $tile[1]), $tile[2]) + } + $modeText = if ($Context.Mode -eq 'Apply') { 'Apply' } else { 'Preview - nothing changed' } + $meta = [ordered]@{ + 'Action' = ('{0} · phase {1} · {2}' -f $Context.Action, $Context.Phase, $modeText) + 'Environment' = [string](Get-PraValue $Context.Config 'Environment' '') + 'Batch' = [string](Get-PraValue $Context 'BatchId' '') + 'Domain controller' = [string]$Context.Server + 'Computer / account' = ('{0} · {1}\{2}' -f $env:COMPUTERNAME, $env:USERDOMAIN, $env:USERNAME) + 'Started' = ([datetime]$Context.StartTime).ToString('yyyy-MM-dd HH:mm:ss') + 'Duration' = (Format-PraDuration ((Get-Date) - [datetime]$Context.StartTime).TotalSeconds) + 'Run ID' = [string]$Context.RunId + } + $metaHtml = New-Object Text.StringBuilder + foreach ($key in $meta.Keys) { if ($meta[$key]) { [void]$metaHtml.AppendFormat('
{0}{1}
', (ConvertTo-PraHtmlText $key), (ConvertTo-PraHtmlText $meta[$key])) } } + $next = @(@(Get-PraValue $Context 'NextSteps' @()) | ForEach-Object { $_ } | Where-Object { $_ }) + $nextHtml = '' + if ($next.Count) { $nextHtml = '

Next step

' + (($next | ForEach-Object { '
' + (ConvertTo-PraHtmlText $_) + '
' }) -join '') + '
' } + $notice = '{0} object row(s), {1} run error(s) and {2} warning(s) are stored in this file.' -f $Outcome.Rows.Count, $issueList.Count, $warningList.Count + $values = @{ + '{{TITLE}}' = ConvertTo-PraHtmlText ('PRA Remote Mailbox - {0}' -f $Context.Action) + '{{SUBTITLE}}' = ConvertTo-PraHtmlText ('{0} · {1}' -f $modeText, ([datetime]$Context.StartTime).ToString('yyyy-MM-dd HH:mm')) + '{{VERSION}}' = ConvertTo-PraHtmlText $Context.Version + '{{META}}' = $metaHtml.ToString(); '{{TILES}}' = $tiles.ToString(); '{{NEXT}}' = $nextHtml + '{{DATA_NOTICE}}' = ConvertTo-PraHtmlText $notice + '{{ROWS_TABLE}}' = ''; '{{ISSUES}}' = ''; '{{WARNINGS}}' = '' + } + foreach ($key in $values.Keys) { $template = $template.Replace($key, $values[$key]) } + $marker = '{{DATA}}' + $at = $template.LastIndexOf($marker, [StringComparison]::Ordinal) + if ($at -lt 0) { $Writer.Write($template); return } + $Writer.Write($template.Substring(0, $at)) + + $issueItems = foreach ($issue in $issueList) { + [pscustomobject]@{ Timestamp = [string](Get-PraValue $issue 'Timestamp' ''); Phase = [string](Get-PraValue $issue 'Phase' ''); Operation = [string](Get-PraValue $issue 'Operation' '') + Identity = [string](Get-PraValue $issue 'Identity' ''); Source = [string](Get-PraValue $issue 'Source' ''); Message = [string](Get-PraValue $issue 'Message' ([string]$issue)) } + } + $warningItems = foreach ($warning in $warningList) { + [pscustomobject]@{ Timestamp = [string](Get-PraValue $warning 'Timestamp' ''); Phase = [string](Get-PraValue $warning 'Phase' ''); Message = [string](Get-PraValue $warning 'Message' ([string]$warning)) } + } + $issueFields = @('Timestamp','Phase','Operation','Identity','Source','Message'); $warningFields = @('Timestamp','Phase','Message') + $rowItems = [object[]]@($Outcome.Rows) + $rowChunks = Write-PraReportChunks -Writer $Writer -Kind 'rows' -Items $rowItems -Fields $script:RowFields -SizeFields @('Detail','CloudDetail','PermDetail','Warnings') -ChunkRows $ChunkRows -ChunkChars $ChunkChars + $issueChunks = Write-PraReportChunks -Writer $Writer -Kind 'issues' -Items ([object[]]@($issueItems)) -Fields $issueFields -SizeFields @('Message') -ChunkRows $ChunkRows -ChunkChars $ChunkChars + $warningChunks = Write-PraReportChunks -Writer $Writer -Kind 'warnings' -Items ([object[]]@($warningItems)) -Fields $warningFields -SizeFields @('Message') -ChunkRows $ChunkRows -ChunkChars $ChunkChars + $statuses = ($script:FinalStatuses | ForEach-Object { ConvertTo-PraJsonString $_ }) -join ',' + $fieldsJson = ($script:RowFields | ForEach-Object { ConvertTo-PraJsonString $_ }) -join ',' + $json = '{{"format":1,"statuses":[{0}],"rows":{{"count":{1},"fields":[{2}]}},"issues":{{"count":{3},"fields":[{4}],"titles":["Time","Step","Operation","Object","Source","Message"]}},"warnings":{{"count":{5},"fields":[{6}],"titles":["Time","Step","Message"]}},"chunks":{{"rows":{7},"issues":{8},"warnings":{9}}}}}' -f + $statuses, $rowItems.Count, $fieldsJson, $issueList.Count, (($issueFields | ForEach-Object { ConvertTo-PraJsonString $_ }) -join ','), $warningList.Count, (($warningFields | ForEach-Object { ConvertTo-PraJsonString $_ }) -join ','), $rowChunks, $issueChunks, $warningChunks + $Writer.Write('`r`n") + $Writer.Write($template.Substring($at + $marker.Length)) +} + +function Get-PraReportHtml { + <# + .SYNOPSIS + Returns the HTML report as one string (small reports, tests). It uses the same writer as the report file, + so there is a single serializer; production code streams to the file instead (Write-PraReport). + #> + [CmdletBinding()] + param([hashtable]$Context, $Outcome) + $writer = New-Object IO.StringWriter + try { Write-PraReportHtml -Context $Context -Outcome $Outcome -Writer $writer; return $writer.ToString() } finally { $writer.Dispose() } +} +function Write-PraReport { + <# + .SYNOPSIS + Writes the CSV and HTML reports (also when there are zero rows). A failed format is recorded as + a run error; the other format is still written, then refreshed to include that error. + #> + [CmdletBinding()] + param([hashtable]$Context, [hashtable]$Reports) + for ($attempt = 0; $attempt -lt 2; $attempt++) { + $issueCount = $Context.Issues.Count + foreach ($format in @('Csv','Html')) { + if (-not $Reports[$format] -or $Reports[($format + 'Failed')]) { continue } + try { + $outcome = Get-PraOutcome $Context + if ($format -eq 'Csv') { + if ($outcome.Rows.Count) { $outcome.Rows | Export-Csv -LiteralPath $Reports.Csv -NoTypeInformation -Delimiter ';' -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } + else { Set-Content -LiteralPath $Reports.Csv -Value ('"' + ($script:RowFields -join '";"') + '"') -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } + } else { + $stream = [IO.File]::Open($Reports.Html, [IO.FileMode]::Create, [IO.FileAccess]::Write, [IO.FileShare]::None) + $writer = New-Object IO.StreamWriter($stream, (New-Object Text.UTF8Encoding($true)), 65536) + try { Write-PraReportHtml -Context $Context -Outcome $outcome -Writer $writer } finally { $writer.Dispose() } + } + if (-not (Test-Path -LiteralPath $Reports[$format] -PathType Leaf) -or (Get-Item -LiteralPath $Reports[$format]).Length -eq 0) { throw 'Report missing or empty after writing.' } + } catch { $Reports[($format + 'Failed')] = $true; Add-PraIssue $Context ('{0} report: {1}' -f $format, $_.Exception.Message) 'Report' } + } + if ($Context.Issues.Count -eq $issueCount) { break } + } +} + +function Complete-PraRun { + <# + .SYNOPSIS + Ends every run: reports, summary card, transcript, verdict. Returns one result object (no exit). + .DESCRIPTION + Always called from the finally block of the entry script, also after an error. The verdict + 'RESULT: PASS' or 'RESULT: FAIL' is the last line of the log and of the transcript; it is + added after the transcript is stopped so that a failure to stop it is still reported. + .OUTPUTS + PSCustomObject: RunId, Status (Success, Planned, Pending, Failed), ExitCode, counters, + BatchId, NextSteps, file paths and Issues. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context) + $reports = @{ Csv = ''; Html = ''; CsvFailed = $false; HtmlFailed = $false } + $paths = @{ LogFile = ''; TranscriptPath = ''; BackupFiles = @(); StateFiles = @() } + $safeLog = { + param($message, $level = 'Detail') + try { Write-PraLog $Context $message -Level $level } + catch { $console = $Context.Clone(); $console.LogFile = ''; Write-PraLog $console $message -Level $level } + } + $ownsTranscript = [object]::ReferenceEquals($script:TranscriptOwner, $Context) + if (([int]$Context.ExitCode -ne 0 -or $Context.CloudConnectFailed -or (Get-PraValue $Context 'ResultStatus' '') -eq 'Failed') -and $Context.Issues.Count -eq 0) { + Add-PraIssue $Context 'Failure reported by the run (exit code / cloud connection).' 'Run' + } + foreach ($key in @('LogFile','TranscriptPath','BackupFiles','StateFiles')) { + $candidates = Get-PraValue $Context $key + if ($key -in @('LogFile','TranscriptPath')) { $candidates = [string]$candidates } + if ($key -eq 'TranscriptPath' -and -not (Get-PraValue $Context '_PraTranscriptCreated' $false)) { $candidates = '' } + foreach ($path in $candidates) { + try { + if (-not $path -or -not (Test-Path -LiteralPath $path -PathType Leaf)) { throw 'file not found' } + $file = Get-Item -LiteralPath $path -ErrorAction Stop + if ($file.Length -eq 0 -and $key -ne 'StateFiles') { throw 'empty file' } + if ($key -in @('BackupFiles','StateFiles')) { $paths[$key] += $file.FullName } else { $paths[$key] = $file.FullName } + } catch { Add-PraIssue $Context ('Audit file {0} unavailable: {1}' -f $key, $_.Exception.Message) 'Audit' } + } + } + if (-not $Context.NoReport) { + try { + $null = New-Item -ItemType Directory -Path $Context.ReportFolder -Force -WhatIf:$false -Confirm:$false -ErrorAction Stop + $stem = [string](Get-PraValue $Context '_PraArtifactStem' '') + if (-not $stem) { $stem = Get-PraArtifactStem $Context } + foreach ($format in @('Csv','Html')) { + try { + $path = Join-Path $Context.ReportFolder ($stem + '.' + $format.ToLowerInvariant()) + $null = New-Item -ItemType File -Path $path -WhatIf:$false -Confirm:$false -ErrorAction Stop + $reports[$format] = $path + } catch { $reports[($format + 'Failed')] = $true; Add-PraIssue $Context ('{0} report cannot be created: {1}' -f $format, $_.Exception.Message) 'Report' } + } + } catch { Add-PraIssue $Context ('Report folder: {0}' -f $_.Exception.Message) 'Report' } + Write-PraReport $Context $reports + } + + # Summary card. + $outcome = Get-PraOutcome $Context + $c = $outcome.Counts + $isApply = $Context.Mode -eq 'Apply' + $title = switch ($outcome.Status) { + 'Failed' { '{0} stopped - see the errors below' -f $Context.Action } + 'Pending' { '{0} done - next step required' -f $Context.Action } + 'Planned' { '{0} preview - nothing was changed' -f $Context.Action } + default { '{0} finished' -f $Context.Action } + } + $status = @{ Failed='Fail'; Pending='Warn'; Planned='Ok'; Success='Ok' }[$outcome.Status] + $objects = if ($isApply -or $c.Success -or $c.Pending) { '{0} done {4} {1} pending {4} {2} error(s) {4} {3} skipped' -f $c.Success, $c.Pending, $c.Error, $c.Skipped, [char]0x00B7 } + else { '{0} planned {3} {1} error(s) {3} {2} skipped' -f $c.Planned, $c.Error, $c.Skipped, [char]0x00B7 } + $values = [ordered]@{ 'Result' = @('Target', $objects) } + $batch = [string](Get-PraValue $Context 'BatchId' '') + if ($batch) { $values['Batch'] = @('Batch', $batch) } + $issueLines = @($Context.Issues.ToArray() | Select-Object -Last 2 | ForEach-Object { + $message = [string](Get-PraValue $_ 'Message' ([string]$_)) + if ($message.Length -gt 240) { $message = $message.Substring(0, 237) + '...' } + $message }) + if ($issueLines.Count) { + if ($Context.Issues.Count -gt 2) { $issueLines = @(('{0} error(s) in total, see the log and the report' -f $Context.Issues.Count)) + $issueLines } + $values['Error'] = @('Fail', $issueLines) + } + $warningList = @(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) + if ($warningList.Count) { + $warningLines = @($warningList | Select-Object -Last 2 | ForEach-Object { + $message = [string](Get-PraValue $_ 'Message' ([string]$_)) + if ($message.Length -gt 240) { $message = $message.Substring(0, 237) + '...' } + $message }) + if ($warningList.Count -gt 2) { $warningLines = @(('{0} warning(s) in total, see the log and the report' -f $warningList.Count)) + $warningLines } + $values['Warning'] = @('Warn', $warningLines) + # Warnings never change the exit code; they only colour the card of a successful run. + if ($status -eq 'Ok') { $status = 'Warn'; $title += (' {0} {1} warning(s)' -f [char]0x00B7, $warningList.Count) } + } + if ($paths.BackupFiles.Count) { $values['Backup'] = @('Backup', @($paths.BackupFiles)) } + if ($reports.Html -and -not $reports.HtmlFailed) { $values['Report'] = @('Report', $reports.Html) } + if ($paths.LogFile) { $values['Log'] = @('Log', $paths.LogFile) } + $values['Duration'] = @('Clock', (Format-PraDuration ((Get-Date) - [datetime]$Context.StartTime).TotalSeconds)) + $next = @(@(Get-PraValue $Context 'NextSteps' @()) | ForEach-Object { $_ } | Where-Object { $_ }) + if ($outcome.ExitCode -ne 1 -and $next.Count) { $values['Next'] = @('Next', $next) } + try { Write-PraSummary -Context $Context -Title $title -Values $values -Status $status } + catch { & $safeLog ('Summary unavailable: ' + $_.Exception.Message) } + foreach ($key in @('BackupFiles','StateFiles')) { foreach ($path in $paths[$key]) { & $safeLog ('{0}: {1}' -f $key, $path) } } + & $safeLog ('Status {0}; total {1}; done {2}; errors {3}; pending {4}; skipped {5}; planned {6}.' -f $outcome.Status, $outcome.Rows.Count, $c.Success, $c.Error, $c.Pending, $c.Skipped, $c.Planned) + + # Stop our own transcript (never someone else's), then write the verdict. + if ($ownsTranscript) { + try { Stop-Transcript -ErrorAction Stop | Out-Null } + catch { Add-PraIssue $Context ('Transcript could not be stopped: {0}' -f $_.Exception.Message) 'Audit' } + finally { $Context.TranscriptStarted = $false; $script:TranscriptOwner = $null } + } + Write-PraReport $Context $reports + $outcome = Get-PraOutcome $Context + $verdict = if ($outcome.ExitCode -eq 1) { 'RESULT: FAIL' } else { 'RESULT: PASS' } + try { if ($ownsTranscript -and $paths.TranscriptPath) { Add-Content -LiteralPath $paths.TranscriptPath -Value $verdict -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } } + catch { Add-PraIssue $Context ('Transcript verdict: {0}' -f $_.Exception.Message) 'Audit'; Write-PraReport $Context $reports } + $outcome = Get-PraOutcome $Context; $beforeVerdict = $Context.Issues.Count + $verdict = if ($outcome.ExitCode -eq 1) { 'RESULT: FAIL' } else { 'RESULT: PASS' } + try { Write-PraLogFile -Context $Context -Level 'INFO' -Message $verdict } catch { $null = $_ } + Write-PraHost @(,@((' ' + $verdict), $script:Theme.Dim)) + Write-Host '' + if ($Context.Issues.Count -ne $beforeVerdict) { + try { if ($ownsTranscript -and $paths.TranscriptPath) { Add-Content -LiteralPath $paths.TranscriptPath -Value 'RESULT: FAIL' -Encoding UTF8 -WhatIf:$false -Confirm:$false -ErrorAction Stop } } + catch { Add-PraIssue $Context ('Transcript verdict: {0}' -f $_.Exception.Message) 'Audit' } + Write-PraReport $Context $reports + } + $outcome = Get-PraOutcome $Context + $Context.ExitCode = $outcome.ExitCode; $Context.ResultStatus = $outcome.Status + $result = [pscustomobject][ordered]@{ + RunId = $Context.RunId; Version = $Context.Version; Action = $Context.Action; Mode = $Context.Mode; Phase = $Context.Phase + Status = $outcome.Status; ExitCode = $outcome.ExitCode; SuccessCount = $outcome.Counts.Success; ErrorCount = $outcome.Counts.Error + PendingCount = $outcome.Counts.Pending; SkippedCount = $outcome.Counts.Skipped; PlannedCount = $outcome.Counts.Planned + TotalCount = $outcome.Rows.Count; Duration = ((Get-Date) - [datetime]$Context.StartTime) + BatchId = [string](Get-PraValue $Context 'BatchId' ''); NextSteps = [string[]]@(@(Get-PraValue $Context 'NextSteps' @()) | ForEach-Object { $_ } | Where-Object { $_ }) + Server = $Context.Server; BackupFiles = [string[]]$paths.BackupFiles; StateFiles = [string[]]$paths.StateFiles + LogFile = $paths.LogFile; TranscriptPath = $paths.TranscriptPath + CsvReport = $(if (-not $reports.CsvFailed) { $reports.Csv } else { '' }) + HtmlReport = $(if (-not $reports.HtmlFailed) { $reports.Html } else { '' }); Issues = [object[]]$Context.Issues.ToArray() + WarningCount = @(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }).Count + Warnings = [object[]]@(@(Get-PraValue $Context 'WarningList' @()) | ForEach-Object { $_ } | Where-Object { $null -ne $_ }) + } + Write-PraEvent -Kind result -Data @{ status = $result.Status; exitCode = $result.ExitCode + action = $result.Action; mode = $result.Mode; phase = $result.Phase + success = $result.SuccessCount; error = $result.ErrorCount; pending = $result.PendingCount + skipped = $result.SkippedCount; planned = $result.PlannedCount; total = $result.TotalCount + seconds = [int]$result.Duration.TotalSeconds; batchId = $result.BatchId; nextSteps = @($result.NextSteps) + logFile = $result.LogFile; csvReport = $result.CsvReport; htmlReport = $result.HtmlReport + warnings = $result.WarningCount; backupFiles = @($result.BackupFiles); stateFiles = @($result.StateFiles) + issues = @($result.Issues | ForEach-Object { [string](Get-PraValue $_ 'Message' ([string]$_)) }) } + return $result +} +#endregion + +Export-ModuleMember -Function Get-PraValue, Format-PraDuration, Add-PraIssue, Write-PraLog, Write-PraItem, Write-PraBanner, Write-PraStep, + Write-PraSummary, Write-PraHost, Resolve-PraPath, Import-PraConfiguration, Initialize-PraAudit, Get-PraOutcome, Complete-PraRun, Write-PraEvent, Get-PraTargetOverride, Read-PraTargetCsv + +# SIG # Begin signature block +# MIIghgYJKoZIhvcNAQcCoIIgdzCCIHMCAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAwcYk12WSytR7d +# EtGwZf/WQGmLpRLOo3JA1Z3Y7A1q9KCCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISbTCCEmkCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCDhTJ/wvXuA +# jiKtTQXYWmczRsfoVuDDT5fb7srrzC5SJDANBgkqhkiG9w0BAQEFAASCAgBdIcmO +# KGBqQL1ohgOvbien16tKGsndEv/JiLrZNU86jrTmNAkIK3nilYmwGKCx0wAZHXq/ +# joS1VPnCGezm1lqvJyOgpEJvEwE4XoIqTewgW7X2N21/KJPdHLf1ODmu9KYZCKC9 +# 9g1lnMeUMmgbewAigG+6DnsVcKYHgjBQtCAMTkEheaCgmfQQSRMizDvujbFUizQg +# LhIrTQfi7OJooH6yKwH/J1aLP/s2ONO1q+hAqwVXOO2GWyie7XZR4sd+utHbnJ2P +# SiUPrRf0Xqdq+kzWdUhwiBlVmA7QxTkH2Q1F2rNcE0mvCfSyQz8kSI2BAp9KG2JC +# +hZ5LIDIsWP+Zb2ryZQDEVmuVTCIe441tBsEflZg6XUSYZ+imUm40EfYpzsWSvEQ +# w2/il1Lp+BYEUTo1CrRsbt9FVvpb1dPgeVpTAhP341M64ny26DH9bG/XPvB5tNlF +# jaeD1j1t6q/zQQmdY8bv/v52uFBimt+2XXlI+oyEFKNtbNNRdF55PAcxshR7d8G3 +# 2A2YikTFe/17l5jE9ebMfJ9rkrkUT8WiGxdYLKlpa0N7qo8F6jGknoKvfSVQ414F +# 4E7sblacW2YmrQlItJuBgkxCe1nbWfU5mmAjlqmdVIPWlWsZtEj+BSLy6yeGLlgo +# SqnD4MK+BUEx9UWkyvc9oD4KjmQFekx0lFCHTaGCDyowgg8mBgorBgEEAYI3AwMB +# MYIPFjCCDxIGCSqGSIb3DQEHAqCCDwMwgg7/AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEIILWa6WE9OSfWm8RDM7wlTeUU7Kn82w9r5+edx5ml6chAghk1kPd6MXd +# 0BgPMjAyNjEwMTUyMTIzMDBaMAMCAQECEA+LtX+62FBNxpOJANoEKbagggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# WTCCAlUCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMjMwMFowKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEIHUDDr9rfXfv +# mNBjs65F5hfCoU1Bbm+RNJw5ipkU+wLoMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEgwRgIhAME1sSMkGGh+DDAaB7053RYxbCJ4cHnTafJRXC34WHFdAiEAqd+tIzlg +# Ebn2H+JOgr+4PpygEiVuFdXRGP3FCRySdYk= +# SIG # End signature block diff --git a/module/PRA.Directory.psm1 b/package/module/PRA.Directory.psm1 similarity index 87% rename from module/PRA.Directory.psm1 rename to package/module/PRA.Directory.psm1 index f0d1e9d..3adb353 100644 --- a/module/PRA.Directory.psm1 +++ b/package/module/PRA.Directory.psm1 @@ -1,1613 +1,1810 @@ -#Requires -Version 5.1 -#Requires -PSEdition Desktop -<# -.SYNOPSIS - PRA Remote Mailbox - Active Directory engine: targets, plans, backups, AD writes, proofs, sync. - -.DESCRIPTION - Every AD read and write of the tool is in this module. Regions, in the order of an execution: - - 1. Receipts and files validated backups kept in memory, SHA-256, immutable files, journal - 2. Directory reads DC connection, users, groups, targets of the scope - 3. Attribute states typed values stored in the backups, comparison, display - 4. Shared permissions FullAccess / SendAs / SendOnBehalf read from AD, CSV or a group - 5. Plans New-PraPlan: what will change for one object (read only) - 6. Backups and proofs Save-PraBatch, Import-PraBackup, Import-PraProof - 7. Writes Invoke-PraAdPreview, Invoke-PraAdBatch (the only AD writes) - 8. Entra Connect Invoke-PraSync (local or remote delta cycle) - - Safety contract (unchanged since 1.3.0): - - every target is read and planned before the first write; - - a complete backup (typed JSON + data-only CLIXML + SHA-256) of the whole batch is written, - closed and re-read before the first write; - - before each write the current AD state is compared with the backup (uSNChanged, DN, values); - - the first error stops the batch: no next object, no sync, no cloud write, no automatic rollback; - - after the writes, a State file (AD proof) records what was verified; the cloud phase and - Finalize rely on it. - -.NOTES - Author : Nicolas Fabert - Version : 2.1.0 -#> -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' - -Import-Module (Join-Path $PSScriptRoot 'PRA.Backup.psm1') -ErrorAction Stop -# Validated receipts and permission caches are attached to the run context; they are released with it. -$script:ReceiptRegistries = New-Object 'Runtime.CompilerServices.ConditionalWeakTable[object,object]' -$script:PermissionCaches = New-Object 'Runtime.CompilerServices.ConditionalWeakTable[object,object]' -# Attributes managed by the tool and their stored type. The typed JSON is what Recover restores; -# the CLIXML keeps every value returned by AD (audit, manual recovery). -$script:AttributeKinds = [ordered]@{ - homeMDB='String'; homeMTA='String'; msExchHomeServerName='String'; msExchMailboxGuid='Bytes' - mDBUseDefaults='Bool'; msExchRecipientDisplayType='Int'; msExchRecipientTypeDetails='Long' - msExchRemoteRecipientType='Long'; targetAddress='String'; proxyAddresses='MultiString' -} -# Display names of msExchRecipientTypeDetails values (console only). -$script:RecipientTypeNames = @{ - '1'='UserMailbox'; '4'='SharedMailbox'; '16'='RoomMailbox'; '32'='EquipmentMailbox'; '128'='MailUser' - '2147483648'='RemoteUserMailbox'; '8589934592'='RemoteRoomMailbox'; '17179869184'='RemoteEquipmentMailbox'; '34359738368'='RemoteSharedMailbox' -} - -#region 1. Receipts and files ---------------------------------------------------------------- - -function Write-PraMemoryStage { - <# Log only: stage of a backup and private memory of the process (large batches). #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Stage, [string]$Identity = '', [string]$Detail = '') - $process = [Diagnostics.Process]::GetCurrentProcess() - try { $privateMiB = [math]::Round(($process.PrivateMemorySize64 / 1MB), 1) } finally { $process.Dispose() } - Write-PraLog -Context $Context -Message ("BACKUP/AD | $Stage | GUID=$Identity | $Detail | PrivateMiB=$privateMiB | Process64Bit=$([Environment]::Is64BitProcess)") -Level Debug -} - -function Get-PraReceiptRegistry { - <# Validated backups ("receipts") of this run. #> - [CmdletBinding()] - param([hashtable]$Context) - $registry = $null - if (-not $script:ReceiptRegistries.TryGetValue($Context, [ref]$registry)) { - $registry = New-Object 'Collections.Generic.List[object]' - $script:ReceiptRegistries.Add($Context, $registry) - } - return ,$registry -} - -function Write-PraDataFingerprint { - <# - .SYNOPSIS - Structural SHA-256 of closed JSON data (strings, numbers, arrays, dictionaries, note properties). - Used to detect a change of a validated backup in memory. Any other type is refused. - #> - [CmdletBinding()] - param([hashtable]$State, [AllowNull()]$Value, [int]$Depth = 0) - if ($Depth -gt 64) { throw 'Receipt data too deep or cyclic.' } - $State.Nodes++ - if ($State.Nodes -gt 10000000) { throw 'Receipt data too large.' } - $writer = $State.Writer - if ($null -eq $Value) { $writer.Write([byte]0); return } - if ($Value -is [string]) { - $writer.Write([byte]1); $writer.Write([int]$Value.Length) - for ($offset = 0; $offset -lt $Value.Length; $offset += 1024) { - $count = [math]::Min(1024, $Value.Length - $offset) - $Value.CopyTo($offset, $State.Characters, 0, $count) - [Buffer]::BlockCopy($State.Characters, 0, $State.Bytes, 0, ($count * 2)) - $writer.Write($State.Bytes, 0, ($count * 2)) - } - return - } - if ($Value -is [bool]) { $writer.Write([byte]2); $writer.Write([bool]$Value); return } - if ($Value -is [int]) { $writer.Write([byte]3); $writer.Write([int]$Value); return } - if ($Value -is [long]) { $writer.Write([byte]4); $writer.Write([long]$Value); return } - if ($Value -is [double]) { $writer.Write([byte]5); $writer.Write([double]$Value); return } - if ($Value -is [decimal]) { $writer.Write([byte]6); foreach ($bits in [decimal]::GetBits($Value)) { $writer.Write([int]$bits) }; return } - if ($Value -is [array]) { - if ($Value.Rank -ne 1) { throw 'Unsupported array in a receipt.' } - $writer.Write([byte]7); $writer.Write([int]$Value.Length) - foreach ($item in $Value) { - # Permission lists dominate large receipts. Keep the same wire bytes and limits - # without creating an advanced-function invocation for every individual string. - if ($item -is [string]) { - if ($Depth -ge 64) { throw 'Receipt data too deep or cyclic.' } - $State.Nodes++ - if ($State.Nodes -gt 10000000) { throw 'Receipt data too large.' } - $writer.Write([byte]1); $writer.Write([int]$item.Length) - for ($offset = 0; $offset -lt $item.Length; $offset += 1024) { - $count = [math]::Min(1024, $item.Length - $offset) - $item.CopyTo($offset, $State.Characters, 0, $count) - [Buffer]::BlockCopy($State.Characters, 0, $State.Bytes, 0, ($count * 2)) - $writer.Write($State.Bytes, 0, ($count * 2)) - } - } - else { Write-PraDataFingerprint -State $State -Value $item -Depth ($Depth + 1) } - } - return - } - if ($Value -is [hashtable] -or $Value -is [Collections.Specialized.OrderedDictionary]) { - $writer.Write([byte]8); $writer.Write([int]$Value.Count) - foreach ($entry in $Value.GetEnumerator()) { - if ($entry.Key -isnot [string]) { throw 'Non-text key in a receipt.' } - Write-PraDataFingerprint -State $State -Value $entry.Key -Depth ($Depth + 1) - Write-PraDataFingerprint -State $State -Value $entry.Value -Depth ($Depth + 1) - } - return - } - if ($Value.PSObject.BaseObject -is [Management.Automation.PSCustomObject]) { - $properties = @($Value.PSObject.Properties) - $writer.Write([byte]9); $writer.Write([int]$properties.Count) - foreach ($property in $properties) { - if ($property.MemberType -ne [Management.Automation.PSMemberTypes]::NoteProperty) { throw 'Executable property not allowed in a receipt.' } - Write-PraDataFingerprint -State $State -Value ([string]$property.Name) -Depth ($Depth + 1) - Write-PraDataFingerprint -State $State -Value $property.Value -Depth ($Depth + 1) - } - return - } - throw "Type not allowed in a receipt (data only): $($Value.GetType().FullName)" -} - -function Get-PraDataFingerprint { - [CmdletBinding()] - param([Parameter(Mandatory)]$Data) - $hash = [Security.Cryptography.SHA256]::Create() - $crypto = New-Object Security.Cryptography.CryptoStream([IO.Stream]::Null, $hash, [Security.Cryptography.CryptoStreamMode]::Write) - $writer = New-Object IO.BinaryWriter($crypto, (New-Object Text.UTF8Encoding($false)), $true) - try { - $state = @{ Writer=$writer; Characters=(New-Object char[] 1024); Bytes=(New-Object byte[] 2048); Nodes=0L } - Write-PraDataFingerprint -State $state -Value $Data - $writer.Flush(); $crypto.FlushFinalBlock() - return ([BitConverter]::ToString($hash.Hash)).Replace('-', '').ToLowerInvariant() - } - finally { $writer.Dispose(); $crypto.Dispose(); $hash.Dispose() } -} - -function Add-PraValidatedReceipt { - <# Remembers a backup validated in this run, with its hashes and a fingerprint of its content. #> - [CmdletBinding()] - param([hashtable]$Context, $Receipt, [string]$RawPath = '', [string]$RawHash = '') - $guids = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - foreach ($record in $Receipt.Data.Records) { [void]$guids.Add([string]$record.ObjectGuid) } - $entry = [pscustomobject]@{ - Receipt=$Receipt; Data=$Receipt.Data; Path=[string]$Receipt.Path; Hash=[string]$Receipt.Hash - RawPath=$RawPath; RawHash=$RawHash; Environment=[string]$Receipt.Data.Environment - SchemaVersion=[int](Get-PraValue $Receipt.Data 'SchemaVersion' 1); RawFormat=[string](Get-PraValue $Receipt.Data 'RawFormat' '') - Operation=[string]$Receipt.Data.Operation; Legacy=[bool]$Receipt.Legacy; Guids=$guids - DataFingerprint=(Get-PraDataFingerprint -Data $Receipt.Data) - } - $registry = Get-PraReceiptRegistry -Context $Context - $registry.Add($entry) -} - -function Get-PraReceiptEntry { - [CmdletBinding()] - param([hashtable]$Context, $Receipt) - $registry = Get-PraReceiptRegistry -Context $Context - foreach ($entry in $registry) { if ([object]::ReferenceEquals($entry.Receipt, $Receipt)) { return $entry } } - throw 'Backup not validated in this run: a complete validation is required.' -} - -function Assert-PraReceiptIntegrity { - <# The backup is unchanged in memory and on disk (JSON, .sha256, CLIXML) since its validation. #> - [CmdletBinding()] - param([hashtable]$Context, $Entry) - $receipt = $Entry.Receipt - if ($Entry.Environment -cne $Context.Config.Environment -or $receipt.Path -cne $Entry.Path -or - $receipt.Data.Environment -cne $Entry.Environment -or $receipt.Data.Operation -cne $Entry.Operation -or - [int](Get-PraValue $receipt.Data 'SchemaVersion' 1) -ne $Entry.SchemaVersion -or - [string](Get-PraValue $receipt.Data 'RawFormat' '') -cne $Entry.RawFormat -or - $receipt.Legacy -isnot [bool] -or $receipt.Legacy -ne $Entry.Legacy -or - $receipt.Hash -cne $Entry.Hash -or -not [object]::ReferenceEquals($receipt.Data, $Entry.Data)) { - throw 'Backup receipt changed, or it belongs to another context.' - } - if ((Get-PraDataFingerprint -Data $receipt.Data) -cne $Entry.DataFingerprint) { throw 'Backup content changed in memory since its validation.' } - if ((Get-PraHash -Path $Entry.Path) -cne $Entry.Hash) { throw 'Backup JSON file changed since its validation.' } - if ($Entry.SchemaVersion -ge 2) { - $sidecar = (Get-Content -LiteralPath ($Entry.Path + '.sha256') -Raw -ErrorAction Stop).Trim() - if ($sidecar -cne $Entry.Hash) { throw 'Backup .sha256 file changed since its validation.' } - if ($receipt.Data.RawHash -cne $Entry.RawHash -or - [IO.Path]::GetFileName($Entry.RawPath) -cne $receipt.Data.RawFile -or - (Get-PraHash -Path $Entry.RawPath) -cne $Entry.RawHash) { throw 'Backup CLIXML file changed since its validation.' } - } -} - -function ConvertTo-PraLdapValue { - <# - .SYNOPSIS - Escapes a value for an LDAP filter (RFC 4515). - #> - [CmdletBinding()] - param([Parameter(Mandatory)][AllowEmptyString()][string]$Value) - $Value.Replace('\', '\5c').Replace('*', '\2a').Replace('(', '\28').Replace(')', '\29').Replace([string][char]0, '\00') -} - -function Get-PraHash { - <# - .SYNOPSIS - SHA-256 of a file, lower case. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][string]$Path) - $hash = [Security.Cryptography.SHA256]::Create() - $stream = [IO.File]::OpenRead($Path) - try { return ([BitConverter]::ToString($hash.ComputeHash($stream))).Replace('-', '').ToLowerInvariant() } - finally { $stream.Dispose(); $hash.Dispose() } -} - -function Write-PraImmutableFile { - <# - .SYNOPSIS - Creates a new file (never overwrites), writes it, flushes it to disk and closes it. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][AllowEmptyString()][string]$Text) - $stream = New-Object IO.FileStream($Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None) - $writer = $null - try { - $writer = New-Object IO.StreamWriter($stream, (New-Object Text.UTF8Encoding($false)), 16384, $true) - $writer.Write($Text); $writer.Flush(); $stream.Flush($true) - } - finally { if ($null -ne $writer) { $writer.Dispose() }; $stream.Dispose() } -} - -function New-PraPrivateDirectory { - <# - .SYNOPSIS - Creates a backup folder readable only by the current account, SYSTEM and Administrators - (no inherited permission). The folder must not exist. - #> - [CmdletBinding(SupportsShouldProcess = $true)] - param([Parameter(Mandatory)][string]$Path) - if (-not $PSCmdlet.ShouldProcess($Path, 'Create a private backup folder')) { throw 'Backup folder creation refused.' } - if (Test-Path -LiteralPath $Path) { throw "Backup folder already exists: $Path" } - $identity = [Security.Principal.WindowsIdentity]::GetCurrent().User - $acl = New-Object Security.AccessControl.DirectorySecurity - $acl.SetAccessRuleProtection($true, $false) - $acl.SetOwner($identity) - foreach ($sid in @($identity.Value, 'S-1-5-18', 'S-1-5-32-544') | Select-Object -Unique) { - $rule = New-Object Security.AccessControl.FileSystemAccessRule( - (New-Object Security.Principal.SecurityIdentifier($sid)), - [Security.AccessControl.FileSystemRights]::FullControl, - ([Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'), - [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow) - [void]$acl.AddAccessRule($rule) - } - # The folder is created with its restrictive ACL: no moment where files inherit broader rights. - [void][IO.Directory]::CreateDirectory($Path, $acl) - $actual = [IO.Directory]::GetAccessControl($Path) - if (-not $actual.AreAccessRulesProtected) { throw "Backup folder ACL is not protected: $Path" } -} - -function Write-PraJournal { - <# - .SYNOPSIS - Appends one JSON line to the journal of the batch (Started / Applied / Verified / Failed). - #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Target, [string]$Operation, [string]$Status, [string]$Detail = '') - if (-not $Context.JournalPath) { throw 'The batch journal is not open: no write is allowed.' } - $entry = [ordered]@{ RunId=$Context.RunId; Utc=[DateTime]::UtcNow.ToString('o'); Target=$Target; Operation=$Operation; Status=$Status; Detail=$Detail } - $bytes = (New-Object Text.UTF8Encoding($false)).GetBytes(($entry | ConvertTo-Json -Depth 8 -Compress) + "`r`n") - $stream = New-Object IO.FileStream($Context.JournalPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::Read) - try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush($true) } - finally { $stream.Dispose() } -} -#endregion - -#region 2. Directory reads -------------------------------------------------------------------- - -function Invoke-PraRead { - <# Runs one AD read, logs it (debug) and logs any failure with its details. #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Operation, [string]$Identity, [scriptblock]$Read) - $Context.CurrentOperation = $Operation; $Context.CurrentIdentity = $Identity - Write-PraLog -Context $Context -Message "AD BEGIN | $Operation | DC=$($Context.Server) | Identity=$Identity" -Level Debug - $clock = [Diagnostics.Stopwatch]::StartNew() - try { - $result = @(& $Read) - Write-PraLog -Context $Context -Message "AD END | $Operation | results=$($result.Count) | duration=$($clock.ElapsedMilliseconds)ms" -Level Debug - return $result - } - catch { - Write-PraLog -Context $Context -Message "AD read failed | $Operation | DC=$($Context.Server) | Identity=$Identity | $($_.Exception.GetType().FullName) | $($_.Exception.Message) | ErrorId=$($_.FullyQualifiedErrorId) | Category=$($_.CategoryInfo.Category)" -Level Error - Write-PraLog -Context $Context -Message "$($_.InvocationInfo.PositionMessage)`n$($_.ScriptStackTrace)" -Level Debug - throw - } -} - -function Initialize-PraDirectory { - <# - .SYNOPSIS - Loads the ActiveDirectory module and fixes ONE writable domain controller for the whole run - (DomainController in the configuration, or discovered). Optionally checks Scope.SearchBase. - #> - [CmdletBinding()] - param([hashtable]$Context, [switch]$ValidateScope) - Initialize-PraPermissionCache -Context $Context - if (-not [Environment]::Is64BitProcess) { Write-PraLog -Context $Context -Message '32-bit PowerShell: less memory for large batches. Use the 64-bit Windows PowerShell 5.1.' -Level Warning } - # No AD: drive (it would connect to a default domain controller, not the one of the run). - $env:ADPS_LoadDefaultDrive = 0 - Import-Module ActiveDirectory -ErrorAction Stop -Verbose:$false -WarningAction SilentlyContinue - if ([string]::IsNullOrWhiteSpace($Context.Server)) { - $dc = Get-ADDomainController -Discover -Writable -ErrorAction Stop - $names = @($dc.HostName | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) }) - if ($names.Count -ne 1) { throw 'Domain controller discovery: no name or several names returned.' } - $Context.Server = [string]$names[0] - } - $server = $Context.Server - $dc = @(Invoke-PraRead $Context 'Get-ADDomainController' $server { Get-ADDomainController -Identity $server -Server $server -ErrorAction Stop }) - if ($dc.Count -ne 1 -or (Get-PraValue $dc[0] 'IsReadOnly' $true)) { throw "Writable domain controller not confirmed: $server" } - $root = @(Invoke-PraRead $Context 'Get-ADRootDSE' $server { Get-ADRootDSE -Server $server -ErrorAction Stop }) - if ($root.Count -ne 1 -or -not (Get-PraValue $root[0] 'defaultNamingContext' '')) { throw 'AD domain partition not found.' } - $Context.NamingContext = [string]$root[0].defaultNamingContext - Write-PraItem -Context $Context -Status Ok -Icon Directory -Text ("{0} {1} {2} {1} account {3}" -f $server, [char]0x00B7, $Context.NamingContext, [Security.Principal.WindowsIdentity]::GetCurrent().Name) - if ($ValidateScope -and $Context.Config.Scope.SearchBase) { - $base = [string]$Context.Config.Scope.SearchBase - Assert-PraDomain $Context $base - $null = Invoke-PraRead $Context 'Get-ADObject/SearchBase' $base { Get-ADObject -Identity $base -Server $server -ErrorAction Stop } - } -} - -function Assert-PraDomain { - <# The object belongs to the domain of the fixed domain controller (no implicit DC change). #> - [CmdletBinding()] - param([hashtable]$Context, [string]$DistinguishedName) - if (-not ($DistinguishedName.EndsWith(',' + $Context.NamingContext, [StringComparison]::OrdinalIgnoreCase) -or - $DistinguishedName.Equals($Context.NamingContext, [StringComparison]::OrdinalIgnoreCase))) { - throw "Object outside the domain of the domain controller: '$DistinguishedName' (domain '$($Context.NamingContext)'). The domain controller is never changed implicitly." - } -} - -function Get-PraUser { - <# - .SYNOPSIS - Reads one user by UPN (exact LDAP filter), sAMAccountName, DN or GUID. Exactly one result is required. - .PARAMETER Capture - Also reads every attribute ('*') and the security descriptors (backup). - #> - [CmdletBinding()] - param([hashtable]$Context, [Parameter(Mandatory)][string]$Identity, [string[]]$ExtraProperties = @(), [switch]$Capture) - $properties = @('memberOf','uSNChanged','DisplayName','mail','mailNickname','msExchArchiveGUID') + @($script:AttributeKinds.Keys) + $ExtraProperties - if ($Capture) { $properties += @('*','msExchMailboxSecurityDescriptor','nTSecurityDescriptor','publicDelegates') } - $properties = @($properties | Select-Object -Unique) - $server = $Context.Server - if ($Identity -match '@' -and $Identity -notmatch '^(CN|OU|DC)=') { - # -Identity does not search the UPN: use an exact, escaped LDAP filter. - $filter = '(userPrincipalName=' + (ConvertTo-PraLdapValue $Identity) + ')' - $users = @(Invoke-PraRead $Context 'Get-ADUser/UPN' $Identity { Get-ADUser -LDAPFilter $filter -Properties $properties -Server $server -ErrorAction Stop }) - } - else { $users = @(Invoke-PraRead $Context 'Get-ADUser/Identity' $Identity { Get-ADUser -Identity $Identity -Properties $properties -Server $server -ErrorAction Stop }) } - if ($users.Count -ne 1) { throw "AD object '$Identity' not found or not unique: $($users.Count) result(s) on $server." } - $user = $users[0] - $guid = [guid](Get-PraValue $user 'ObjectGUID' ([guid]::Empty)) - if ($guid -eq [guid]::Empty) { throw "AD object without GUID: $Identity" } - Assert-PraDomain $Context ([string]$user.DistinguishedName) - Write-PraLog -Context $Context -Message "AD RESOLVED | GUID=$guid | DN=$($user.DistinguishedName) | UPN=$($user.UserPrincipalName)" -Level Debug - return $user -} - -function Get-PraUsn { - <# uSNChanged of an object (version of the object on its domain controller). #> - [CmdletBinding()] - param($User) - $value = Get-PraValue $User 'uSNChanged' $null - if ($null -eq $value -or [string]$value -notmatch '^[0-9]+$' -or [int64]$value -le 0) { throw 'uSNChanged missing or invalid: the AD version of the object cannot be proven.' } - return ([int64]$value).ToString([Globalization.CultureInfo]::InvariantCulture) -} - -function Get-PraGroup { - [CmdletBinding()] - param([hashtable]$Context, [Parameter(Mandatory)][string]$Identity, [switch]$WithoutMembers) - $server = $Context.Server - $parameters = @{ Identity=$Identity; Server=$server; ErrorAction='Stop' } - if (-not $WithoutMembers) { $parameters.Properties = @('member') } - $groups = @(Invoke-PraRead $Context 'Get-ADGroup' $Identity { Get-ADGroup @parameters }) - if ($groups.Count -ne 1) { throw "Group not found or not unique: $Identity" } - Assert-PraDomain $Context ([string]$groups[0].DistinguishedName) - if ([guid]$groups[0].ObjectGUID -eq [guid]::Empty) { throw "Group without GUID: $Identity" } - return $groups[0] -} - -function Get-PraTarget { - <# - .SYNOPSIS - Objects to convert: -Identity, or the configured scope (Auto/OU, Group, Csv), filtered by - mailbox type, exclusions and -MaxObjects. Sorted by sAMAccountName. - .DESCRIPTION - Only on-premises mailboxes are eligible (homeMDB set, msExchRecipientTypeDetails 1, 4, 16 or 32). - System mailboxes (HealthMailbox*, SystemMailbox*, "Microsoft Exchange*") are always excluded. - An explicit target (Identity or CSV line) that is not eligible stops the run. - #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Identity, [string]$MailboxScope = 'All', [int]$MaxObjects = 0) - $scope = $Context.Config.Scope; $server = $Context.Server - $types = @(1) - if ($Identity) { $types = @(1, 4, 16, 32) } - elseif ($MailboxScope -eq 'UsersOnly') { $types = @(1) } - elseif ($MailboxScope -eq 'SharedOnly') { $types = @(4) } - else { - if ($scope.IncludeShared) { $types += 4 } - if ($scope.IncludeRoom) { $types += 16 } - if ($scope.IncludeEquip) { $types += 32 } - } - $users = New-Object 'Collections.Generic.List[object]' - $explicit = $false - if ($Identity) { $explicit = $true; $users.Add((Get-PraUser $Context $Identity)) } - elseif ($scope.Mode -eq 'Csv') { - $explicit = $true - $entries = @(Read-PraTargetCsv -Path $scope.CsvPath) - foreach ($entry in $entries) { - $id = [string](Get-PraValue $entry 'Identity' '') - if ([string]::IsNullOrWhiteSpace($id)) { throw 'A line of the target CSV file has no Identity: batch refused.' } - $users.Add((Get-PraUser $Context $id.Trim())) - } - } - elseif ($scope.Mode -eq 'Group') { - $group = Get-PraGroup $Context $scope.GroupDN - $members = @(Invoke-PraRead $Context 'Get-ADGroupMember/Scope' $group.DistinguishedName { - Get-ADGroupMember -Identity $group.ObjectGUID -Recursive -Server $server -ErrorAction Stop }) - foreach ($member in $members | Where-Object objectClass -eq 'user') { $users.Add((Get-PraUser $Context ([string]$member.DistinguishedName))) } - } - else { - $filter = '(&(homeMDB=*)(|' + (($types | ForEach-Object { "(msExchRecipientTypeDetails=$_)" }) -join '') + '))' - $parameters = @{ LDAPFilter=$filter; Properties=@('homeMDB','msExchRecipientTypeDetails','DisplayName'); Server=$server; ErrorAction='Stop' } - if ($scope.SearchBase) { $parameters.SearchBase = $scope.SearchBase } - foreach ($user in @(Invoke-PraRead $Context 'Get-ADUser/Scope' ([string]$scope.SearchBase) { Get-ADUser @parameters })) { $users.Add($user) } - } - $seen = @{}; $selected = New-Object 'Collections.Generic.List[object]' - foreach ($user in $users) { - $id = ([guid]$user.ObjectGUID).ToString() - if ($seen.ContainsKey($id)) { throw "The same object is listed twice (GUID $id). Fix the scope first." } - $seen[$id] = $true - $eligible = (Get-PraValue $user 'homeMDB' '') -and ((Get-PraValue $user 'msExchRecipientTypeDetails' 0) -in $types) - $excluded = $user.SamAccountName -like 'HealthMailbox*' -or $user.SamAccountName -like 'SystemMailbox*' -or - (Get-PraValue $user 'DisplayName' '') -like 'Microsoft Exchange*' -or $user.SamAccountName -in $scope.ExcludeSamAccountNames - if (-not $eligible -or $excluded) { - if ($explicit) { throw "Explicit target not eligible (not an on-premises mailbox of an accepted type) or excluded: $($user.SamAccountName). Nothing converted." } - continue - } - $selected.Add($user) - } - $ordered = @($selected | Sort-Object SamAccountName, ObjectGUID) - if ($MaxObjects -gt 0) { $ordered = @($ordered | Select-Object -First $MaxObjects) } - return $ordered -} -#endregion - -#region 3. Attribute states ------------------------------------------------------------------- - -function Get-PraAttributeState { - <# - .SYNOPSIS - Typed state of the managed attributes: @{ Present; Kind; Value } per attribute. - A property that was not read is an error (never taken as "absent"). - #> - [CmdletBinding()] - param($User, [Collections.IDictionary]$Kinds) - $states = [ordered]@{} - foreach ($name in $Kinds.Keys) { - if ($null -eq $User.PSObject.Properties[$name]) { throw "AD attribute not read: $name (GUID $($User.ObjectGUID))." } - $raw = $User.$name; $present = $null -ne $raw; $value = $null - if ($present -and $raw -is [string] -and $raw.Length -eq 0) { $present = $false } - if ($present -and $raw -is [Collections.ICollection] -and $raw.Count -eq 0) { $present = $false } - if ($present) { - switch ($Kinds[$name]) { - String { $value = [string]$raw } - MultiString { $value = [string[]]@($raw | Sort-Object -CaseSensitive) } - Bytes { $value = [Convert]::ToBase64String([byte[]]$raw) } - Bool { $value = [bool]$raw } - Int { $value = ([int]$raw).ToString([Globalization.CultureInfo]::InvariantCulture) } - Long { $value = ([int64]$raw).ToString([Globalization.CultureInfo]::InvariantCulture) } - } - } - $states[$name] = [ordered]@{ Present=[bool]$present; Kind=[string]$Kinds[$name]; Value=$value } - } - return $states -} - -function ConvertFrom-PraStoredValue { - <# Value to write with Set-ADUser -Replace, from a stored typed state. #> - [CmdletBinding()] - param($State) - if (-not $State.Present) { return $null } - switch ($State.Kind) { - String { return [string]$State.Value } - MultiString { return ,([string[]]@($State.Value)) } - Bytes { return ,([Convert]::FromBase64String([string]$State.Value)) } - Bool { return [bool]$State.Value } - Int { return [int]::Parse([string]$State.Value, [Globalization.CultureInfo]::InvariantCulture) } - Long { return [int64]::Parse([string]$State.Value, [Globalization.CultureInfo]::InvariantCulture) } - default { throw "Unknown stored type: $($State.Kind)" } - } -} - -function Test-PraStateEqual { - <# - .SYNOPSIS - Two typed states are equal (case-sensitive; multi-valued attributes compared as sorted sets). - #> - [CmdletBinding()] - param($Left, $Right) - if ([bool]$Left.Present -ne [bool]$Right.Present -or $Left.Kind -ne $Right.Kind) { return $false } - if (-not $Left.Present) { return $true } - if ($Left.Kind -eq 'MultiString') { - $a = @($Left.Value | Sort-Object -CaseSensitive); $b = @($Right.Value | Sort-Object -CaseSensitive) - if ($a.Count -ne $b.Count) { return $false } - for ($i = 0; $i -lt $a.Count; $i++) { if ([string]$a[$i] -cne [string]$b[$i]) { return $false } } - return $true - } - return ([string]$Left.Value -ceq [string]$Right.Value) -} - -function ConvertTo-PraLogText { - <# Escapes control characters, quotes and backslashes of an AD value (the value is never cut). #> - [CmdletBinding()] - param([AllowEmptyString()][string]$Value) - return [regex]::Replace($Value, '[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\\"]', [Text.RegularExpressions.MatchEvaluator]{ - param($match) - switch ($match.Value) { - "`r" { '\r'; break } - "`n" { '\n'; break } - "`t" { '\t'; break } - '\' { '\\'; break } - '"' { '\"'; break } - default { '\u{0:x4}' -f [int][char]$match.Value[0] } - } - }) -} - -function Format-PraAttributeValue { - <# - .SYNOPSIS - Full, readable value(s) of a typed state for the log: , false and 0 stay distinct; - a multi-valued attribute returns one line per value. - #> - [CmdletBinding()] - param([Parameter(Mandatory)]$State) - if ($State.Present -isnot [bool]) { throw 'Display: presence of the attribute not captured.' } - if (-not $State.Present) { return '' } - switch ($State.Kind) { - String { return ('"' + (ConvertTo-PraLogText -Value ([string]$State.Value)) + '"') } - Bool { if ($State.Value) { return 'true' } else { return 'false' } } - Int { return [string]$State.Value } - Long { return [string]$State.Value } - MultiString { - $values = @($State.Value) - if (-not $values.Count) { return '[] (0 values)' } - for ($index = 0; $index -lt $values.Count; $index++) { - '[{0}/{1}] "{2}"' -f ($index + 1), $values.Count, (ConvertTo-PraLogText -Value ([string]$values[$index])) - } - return - } - Bytes { - $bytes = [Convert]::FromBase64String([string]$State.Value) - $base64 = [Convert]::ToBase64String($bytes) - if ($bytes.Length -eq 16) { return ('GUID={0} ; Base64={1} (16 bytes)' -f ([guid]::new($bytes)).ToString(), $base64) } - return ('Base64={0} ({1} bytes)' -f $base64, $bytes.Length) - } - default { throw "Display: unknown type '$($State.Kind)'." } - } -} - -function Format-PraShortValue { - <# Short value for the console: DN reduced to its first part, GUID for 16-byte values, (none) for absent. #> - param([Parameter(Mandatory)]$State) - if (-not $State.Present) { return '(none)' } - switch ($State.Kind) { - Bool { if ($State.Value) { return 'true' } else { return 'false' } } - Bytes { - $bytes = [Convert]::FromBase64String([string]$State.Value) - if ($bytes.Length -eq 16) { return ([guid]::new($bytes)).ToString() } - return ('{0} bytes' -f $bytes.Length) - } - MultiString { return ('{0} value(s)' -f @($State.Value).Count) } - default { - $text = ConvertTo-PraLogText -Value ([string]$State.Value) - if ($text -match '^(CN|OU)=[^,]+,.+,DC=') { $text = ($text -split ',')[0] + ',...' } - if ($text.StartsWith('/o=')) { $text = '...' + $text.Substring($text.LastIndexOf('/')) } - return $text - } - } -} - -function Write-PraAdDelta { - <# - .SYNOPSIS - Shows what changes for one object: BEFORE / PLANNED, or VERIFIED after a successful AD re-read. - .DESCRIPTION - Console: one header line per object, then only the attributes that change (green = added, - yellow = changed, red = removed) and the licence group. Log: every managed attribute with all - its values BEFORE and PLANNED (or VERIFIED). Colours describe changes, not errors. - VERIFIED is refused unless the object was really verified in Apply mode. - #> - [CmdletBinding()] - param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)]$Plan, [ValidateSet('Planned','Verified')][string]$Stage = 'Planned') - if ($Stage -eq 'Verified' -and ($Context.Mode -ne 'Apply' -or -not $Context.AllowMutation -or - $Context.Action -eq 'Check' -or $WhatIfPreference -or $Plan.Row.ADVerified -ne $true)) { - throw 'VERIFIED display refused: no successful AD verification in Apply mode.' - } - $afterLabel = if ($Stage -eq 'Verified') { 'VERIFIED' } else { 'PLANNED' } - $heading = if ($Stage -eq 'Verified') { 'AD VERIFIED' } else { 'AD PLAN - planned values, not applied' } - $record = $Plan.Record - Write-PraLog -Context $Context -Message ("$heading | $(ConvertTo-PraLogText -Value $record.SamAccountName) | $($Plan.Operation) | Mode=$($Context.Mode) | GUID=$($record.ObjectGuid)") -Level Detail - $palette = @{ ADD='Green'; CHANGE='Yellow'; REMOVE='Red'; UNCHANGED='DarkGray' } - $consoleLines = New-Object 'Collections.Generic.List[object]' - $unchanged = 0 - foreach ($name in $Plan.Kinds.Keys) { - $before = $record.Attributes[$name]; $after = $Plan.Desired[$name] - $change = if (Test-PraStateEqual -Left $before -Right $after) { 'UNCHANGED' } elseif (-not $before.Present) { 'ADD' } elseif (-not $after.Present) { 'REMOVE' } else { 'CHANGE' } - Write-PraLog -Context $Context -Message "ATTRIBUTE | $name | $change | Type=$($Plan.Kinds[$name])" -Level Detail - foreach ($value in @(Format-PraAttributeValue -State $before)) { Write-PraLog -Context $Context -Message " $name | BEFORE : $value" -Level Detail } - foreach ($value in @(Format-PraAttributeValue -State $after)) { Write-PraLog -Context $Context -Message " $name | $afterLabel : $value" -Level Detail } - if ($change -eq 'UNCHANGED') { $unchanged++; continue } - if ($Plan.Kinds[$name] -eq 'MultiString' -and $before.Present -and $after.Present) { - $old = @($before.Value); $new = @($after.Value) - foreach ($value in $new | Where-Object { $_ -cnotin $old }) { $consoleLines.Add(@($name, ('+ ' + (ConvertTo-PraLogText -Value $value)), 'Green')) } - foreach ($value in $old | Where-Object { $_ -cnotin $new }) { $consoleLines.Add(@($name, ('- ' + (ConvertTo-PraLogText -Value $value)), 'Red')) } - } - else { $consoleLines.Add(@($name, ('{0} {1} {2}' -f (Format-PraShortValue $before), [char]0x2192, (Format-PraShortValue $after)), $palette[$change])) } - } - $group = $record.Licensing - if ($group.Enabled) { - $change = if ($group.WasMember -eq $group.DesiredMember) { 'UNCHANGED' } elseif ($group.DesiredMember) { 'ADD' } else { 'REMOVE' } - $beforeText = if ($group.WasMember) { 'Member' } else { 'Not member' } - $afterText = if ($group.DesiredMember) { 'Member' } else { 'Not member' } - Write-PraLog -Context $Context -Message "LICENCE GROUP | $(ConvertTo-PraLogText -Value $group.GroupDN) | $change" -Level Detail - Write-PraLog -Context $Context -Message " Licence group | BEFORE : $beforeText" -Level Detail - Write-PraLog -Context $Context -Message " Licence group | $afterLabel : $afterText" -Level Detail - if ($change -ne 'UNCHANGED') { - $groupName = (($group.GroupDN -split ',')[0] -replace '^CN=', '') - $consoleLines.Add(@(('licence group ' + $groupName), ('{0} {1} {2}' -f $beforeText.ToLowerInvariant(), [char]0x2192, $afterText.ToLowerInvariant()), $palette[$change])) - } - } - else { Write-PraLog -Context $Context -Message 'LICENCE GROUP | not managed for this operation' -Level Detail } - $shared = $record.SharedPermissions - $permissionText = '' - if ($record.IsShared -and $Plan.Operation -eq 'Convert') { - $permissionText = ' {0} {1} FullAccess {0} {2} SendAs {0} {3} SendOnBehalf' -f [char]0x00B7, @($shared.FullAccess).Count, @($shared.SendAs).Count, @($shared.SendOnBehalf).Count - } - - # Console. - $beforeType = [string]$record.Attributes['msExchRecipientTypeDetails'].Value - $afterType = [string]$Plan.Desired['msExchRecipientTypeDetails'].Value - $typeText = if ($script:RecipientTypeNames.ContainsKey($beforeType)) { $script:RecipientTypeNames[$beforeType] } else { $beforeType } - if ($afterType -ne $beforeType) { $typeText += (' {0} ' -f [char]0x2192) + $(if ($script:RecipientTypeNames.ContainsKey($afterType)) { $script:RecipientTypeNames[$afterType] } else { $afterType }) } - if ($Stage -eq 'Verified') { - $groupAction = [string](Get-PraValue $Plan.Row 'GroupAction' '') - $statusText = switch ([string]$Plan.Row.FinalStatus) { 'Pending' { 'next: Exchange Online deprovisioning check' } 'AlreadyDone' { 'already in the expected state' } default { 'done' } } - $text = '{0} {1} {2} AD verified, {3} attribute(s) changed{4} {2} {5}' -f $record.SamAccountName, $typeText, [char]0x00B7, ($Plan.Kinds.Count - $unchanged), $(if ($groupAction -in @('Added','Removed')) { ', licence group ' + $groupAction.ToLowerInvariant() } else { '' }), $statusText - Write-PraItem -Context $Context -Status Ok -Text $text - return - } - $operationText = switch ($Plan.Operation) { 'Deprovision' { 'deprovision in Exchange Online first' } 'AlreadyRecovered' { 'already restored' } 'RestoreTag' { 'restore the retention tag' } default { $Plan.Operation.ToLowerInvariant() } } - Write-Host '' - Write-PraHost @(@(' '), @(($record.SamAccountName + ' '), 'White'), @(([string]$record.UserPrincipalName + ' '), 'DarkGray'), @($typeText, 'Cyan'), @((' ' + [char]0x00B7 + ' ' + $operationText + $permissionText), 'DarkGray')) - foreach ($line in $consoleLines) { Write-PraHost @(' ', ('{0,-28} ' -f $line[0]), $line[1]) -Color $line[2] } - if (-not $consoleLines.Count) { Write-PraHost @(@(' '), @('no change: the object is already in the expected state', 'DarkGray')) } - elseif ($unchanged) { Write-PraHost @(@(' '), @(('{0} other managed attribute(s) unchanged (full values in the log)' -f $unchanged), 'DarkGray')) } - if ($permissionText) { - # Who will get access in Exchange Online: a few names on screen, the complete list in the log. - foreach ($right in @('FullAccess', 'SendAs', 'SendOnBehalf')) { - $value = Get-PraValue $shared $right @() - $holders = @(@($value) | Where-Object { $_ }) - Write-PraLog -Context $Context -Message ("PERMISSIONS | {0} | {1} ({2}) | {3}" -f $record.SamAccountName, $right, $holders.Count, $(if ($holders.Count) { $holders -join ', ' } else { '(none)' })) -Level Detail - if (-not $holders.Count) { continue } - $names = @($holders | Select-Object -First 3) -join ', ' - if ($holders.Count -gt 3) { $names += (' + {0} more (full list in the log)' -f ($holders.Count - 3)) } - Write-PraHost @(' ', ('{0,-28} ' -f ($right + ' to')), $names) -Color 'Gray' - } - $ignoredEntries = Get-PraValue (Get-PraValue $Context '_PraIgnoredTrustees' @{}) ([string]$record.ObjectGuid) @() - $ignoredEntries = @($ignoredEntries | Where-Object { $_ }) - if ($ignoredEntries.Count) { - # A warning, not an error: the account no longer exists, so nothing can be granted to it. - Write-PraLog -Context $Context -Level Warning -Message ('{0}: {1} permission entr{2} ignored, account unknown in AD (deleted, or from another domain): {3}' -f - $record.SamAccountName, $ignoredEntries.Count, $(if ($ignoredEntries.Count -gt 1) { 'ies' } else { 'y' }), ($ignoredEntries -join '; ')) - } - } -} - -function Get-PraRoutingAddress { - <# - .SYNOPSIS - Routing address of the remote mailbox (targetAddress): an existing proxy address in - Routing.RoutingDomain (AutoDetect), otherwise @RoutingDomain. - #> - [CmdletBinding()] - param([hashtable]$Context, $User) - $domain = $Context.Config.Routing.RoutingDomain - $proxies = @($User.proxyAddresses) - $primary = @($proxies | Where-Object { $_ -cmatch '^SMTP:' } | Select-Object -First 1) - $address = if ($primary.Count) { $primary[0].Substring(5) } else { [string](Get-PraValue $User 'mail' '') } - $local = if ($address) { ($address -split '@', 2)[0] } else { [string](Get-PraValue $User 'mailNickname' '') } - if ($Context.Config.Routing.AutoDetect) { - $existing = @($proxies | Where-Object { $_ -imatch '^smtp:.+@.+\.mail\.onmicrosoft\.com$' } | ForEach-Object { $_.Substring(5) }) - $match = @($existing | Where-Object { ($_ -split '@', 2)[0] -ieq $local -and $_ -imatch "@$([regex]::Escape($domain))$" }) - if (-not $match.Count) { $match = @($existing | Where-Object { $_ -imatch "@$([regex]::Escape($domain))$" }) } - if ($match.Count -eq 1) { return [string]$match[0] } - if ($match.Count -gt 1) { throw "Several routing addresses possible for $($User.SamAccountName): keep one proxy address in $domain." } - } - if (-not $local -or $local -match '[\s@]' -or $domain -notmatch '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$') { throw "No valid routing address for $($User.SamAccountName) (check Routing.RoutingDomain and the mail alias)." } - return "$local@$domain" -} -#endregion - -#region 4. Shared permissions ------------------------------------------------------------------ - -function Initialize-PraPermissionCache { - <# - .SYNOPSIS - Clears the cache of expanded permission groups of this run (never touches AD or receipts). - #> - [CmdletBinding()] - param([hashtable]$Context) - [void]$script:PermissionCaches.Remove($Context) -} - -function Get-PraPermissionCache { - <# Bounded cache (groups, trustees) shared by the shared mailboxes of one batch. #> - [CmdletBinding()] - param([hashtable]$Context) - $policy = (@($Context.Config.SharedMailbox.ExcludeTrusteeSamAccountNames | Sort-Object) -join "`n") - $cache = $null - if ($script:PermissionCaches.TryGetValue($Context, [ref]$cache)) { - if ($cache.Server -ieq $Context.Server -and $cache.Policy -ceq $policy) { return $cache } - [void]$script:PermissionCaches.Remove($Context) - } - $cache = @{ Server=[string]$Context.Server; Policy=$policy; Entries=@{}; Order=(New-Object 'Collections.Generic.Queue[string]'); UpnCount=0; MaxEntries=512; MaxUpns=100000; CharacterCount=0L; MaxCharacters=8000000L } - $script:PermissionCaches.Add($Context, $cache) - return $cache -} - -function Add-PraPermissionCache { - [CmdletBinding()] - param([hashtable]$Context, [string]$Key, [AllowEmptyCollection()][string[]]$Upns) - $cache = Get-PraPermissionCache -Context $Context - if ($cache.Entries.ContainsKey($Key)) { return } - $characters = 0L; foreach ($upn in $Upns) { $characters += $upn.Length } - # The limits only reduce re-use; they never limit the permissions that are backed up. - if ($Upns.Count -gt $cache.MaxUpns -or $characters -gt $cache.MaxCharacters) { return } - while ($cache.Entries.Count -ge $cache.MaxEntries -or ($cache.UpnCount + $Upns.Count) -gt $cache.MaxUpns -or ($cache.CharacterCount + $characters) -gt $cache.MaxCharacters) { - $oldKey = $cache.Order.Dequeue(); $old = $cache.Entries[$oldKey] - $cache.UpnCount -= $old.Upns.Count; $cache.CharacterCount -= $old.Characters; $cache.Entries.Remove($oldKey) - } - $cache.Entries[$Key] = @{ Upns=[string[]]$Upns; Characters=$characters; CapturedUtc=[DateTime]::UtcNow.ToString('o') } - $cache.Order.Enqueue($Key); $cache.UpnCount += $Upns.Count; $cache.CharacterCount += $characters -} - -function Expand-PraTrustee { - <# UPN(s) of a trustee: the user itself, or the members of a group (recursive), minus the exclusions. #> - [CmdletBinding()] - param([hashtable]$Context, $Object) - $excluded = @($Context.Config.SharedMailbox.ExcludeTrusteeSamAccountNames) - if ((Get-PraValue $Object 'sAMAccountName' '') -in $excluded) { return } - if ($Object.objectClass -eq 'user') { - $upn = [string](Get-PraValue $Object 'userPrincipalName' '') - if (-not $upn) { throw "Trustee without UPN: $($Object.DistinguishedName)" } - return $upn - } - if ($Object.objectClass -ne 'group') { throw "Unsupported trustee type: $($Object.objectClass)" } - $cache = Get-PraPermissionCache -Context $Context - $key = 'group:' + ([string]$Object.DistinguishedName).ToLowerInvariant() - if ($cache.Entries.ContainsKey($key)) { - Write-PraLog -Context $Context -Message ("PERMISSIONS CACHE | $($Object.DistinguishedName) | UPN=$($cache.Entries[$key].Upns.Count) | captured=$($cache.Entries[$key].CapturedUtc)") -Level Debug - return $cache.Entries[$key].Upns - } - $Context.CurrentOperation = 'Expand-PermissionGroup'; $Context.CurrentIdentity = [string]$Object.DistinguishedName - $seen = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - $upns = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - Write-PraLog -Context $Context -Message ("PERMISSIONS GROUP BEGIN | DC=$($Context.Server) | $($Object.DistinguishedName)") -Level Debug - # Members are streamed: the whole member list of a large group is never kept in memory. - Get-ADGroupMember -Identity $Object.DistinguishedName -Recursive -Server $Context.Server -ErrorAction Stop | ForEach-Object { - $member = $_ - if ($member.objectClass -eq 'user' -and $seen.Add([string]$member.DistinguishedName)) { - $memberKey = 'user:' + ([string]$member.DistinguishedName).ToLowerInvariant() - if ($cache.Entries.ContainsKey($memberKey)) { - foreach ($upn in $cache.Entries[$memberKey].Upns) { [void]$upns.Add($upn) } - } - else { - $user = Get-ADUser -Identity $member.DistinguishedName -Properties userPrincipalName, sAMAccountName -Server $Context.Server -ErrorAction Stop - $memberUpns = @() - if ($user.SamAccountName -notin $excluded) { - if (-not $user.UserPrincipalName) { throw "Trustee without UPN: $($member.DistinguishedName)" } - $memberUpns = @([string]$user.UserPrincipalName); [void]$upns.Add([string]$user.UserPrincipalName) - } - Add-PraPermissionCache -Context $Context -Key $memberKey -Upns $memberUpns - } - } - } - $result = [string[]]@($upns | Sort-Object) - # An enumeration error never reaches this point: a partial expansion is never cached. - Add-PraPermissionCache -Context $Context -Key $key -Upns $result - Write-PraLog -Context $Context -Message ("PERMISSIONS GROUP END | unique members=$($seen.Count) | unique UPN=$($result.Count)") -Level Debug - return $result -} - -function Resolve-PraAclTrustee { - <# - .SYNOPSIS - UPN(s) behind the SID of an ACE. Well-known and administrative accounts/groups are ignored. - .DESCRIPTION - A SID that no AD object carries any more (deleted account, or an account of another domain) cannot - receive a permission in Exchange Online: it is added to -Unknown and ignored. The caller reports it - as a warning (console, log, report). Unknown SIDs are not cached, so every mailbox reports them. - #> - [CmdletBinding()] - param([hashtable]$Context, $Reference, [Collections.Generic.List[string]]$Unknown) - $sid = if ($Reference -is [Security.Principal.SecurityIdentifier]) { $Reference } else { $Reference.Translate([Security.Principal.SecurityIdentifier]) } - # BUILTIN, NT AUTHORITY and Domain/Enterprise/Schema Admins are never reproduced. - if ($sid.Value -match '^S-1-5-32-' -or $sid.Value -match '^S-1-5-[0-9]+$' -or - $sid.Value -match '^S-1-5-21-[0-9]+-[0-9]+-[0-9]+-(512|518|519)$') { return } - $name = [string]$Reference - foreach ($pattern in @('NT AUTHORITY\*','BUILTIN\*','*\Domain Admins','*\Enterprise Admins','*\Schema Admins','*\Organization Management','*\Exchange Trusted Subsystem','*\Exchange Servers','*\Exchange Windows Permissions','*\Managed Availability Servers','*\Delegated Setup')) { - if ($name -like $pattern) { return } - } - $cache = Get-PraPermissionCache -Context $Context - $key = 'sid:' + $sid.Value - if ($cache.Entries.ContainsKey($key)) { return $cache.Entries[$key].Upns } - $Context.CurrentOperation = 'Resolve-PermissionTrustee'; $Context.CurrentIdentity = $sid.Value - Write-PraLog -Context $Context -Message ("PERMISSIONS TRUSTEE | DC=$($Context.Server) | SID=$($sid.Value)") -Level Debug - $objects = @(Get-ADObject -Filter "objectSid -eq '$($sid.Value)'" -Properties objectClass, userPrincipalName, sAMAccountName -Server $Context.Server -ErrorAction Stop) - if ($objects.Count -eq 0) { - if ($null -eq $Unknown) { throw "Permission trustee not found in AD: $($sid.Value)" } - Write-PraLog -Context $Context -Message ("PERMISSIONS TRUSTEE | SID=$($sid.Value) | not found in AD (deleted account or another domain): ignored") -Level Detail - if (-not $Unknown.Contains($sid.Value)) { $Unknown.Add($sid.Value) } - return - } - if ($objects.Count -ne 1) { throw "Permission trustee not unique in AD: $($sid.Value)" } - $excludedGroups = @('Domain Admins','Enterprise Admins','Schema Admins','Organization Management','Exchange Trusted Subsystem','Exchange Servers','Exchange Windows Permissions','Managed Availability Servers','Delegated Setup') - if ($objects[0].objectClass -eq 'group' -and ((Get-PraValue $objects[0] 'sAMAccountName' '') -in $excludedGroups -or (Get-PraValue $objects[0] 'Name' '') -in $excludedGroups)) { - Add-PraPermissionCache -Context $Context -Key $key -Upns @() - return - } - $result = [string[]]@(Expand-PraTrustee -Context $Context -Object $objects[0]) - Add-PraPermissionCache -Context $Context -Key $key -Upns $result - return $result -} - -function Get-PraSharedPermission { - <# - .SYNOPSIS - FullAccess, SendAs and SendOnBehalf holders (UPN) of a shared mailbox, read without Exchange. - .DESCRIPTION - PermissionSource = AD SendAs: extended-right ACEs of nTSecurityDescriptor; - FullAccess: ACEs with mask 0x1 of msExchMailboxSecurityDescriptor - PermissionSource = Csv one line Shared,Group in SharedMailbox.CsvPath: group members get both rights - PermissionSource = CustomAttribute the group whose = name of the shared mailbox - PermissionSource = None no FullAccess/SendAs - SendOnBehalf always comes from publicDelegates (CaptureSendOnBehalf). Groups are expanded recursively. - #> - [CmdletBinding()] - param([hashtable]$Context, $User) - $settings = $Context.Config.SharedMailbox - $Context.CurrentOperation = 'CaptureSharedPermissions/' + $settings.PermissionSource; $Context.CurrentIdentity = [string]$User.DistinguishedName - $full = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - $send = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - $behalf = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - # SIDs of the ACEs that no AD object carries any more: ignored, reported as a warning (Write-PraAdDelta). - $unknownSendAs = New-Object 'Collections.Generic.List[string]'; $unknownFullAccess = New-Object 'Collections.Generic.List[string]' - if (-not $Context.ContainsKey('_PraIgnoredTrustees')) { $Context['_PraIgnoredTrustees'] = @{} } - [void]$Context['_PraIgnoredTrustees'].Remove(([guid]$User.ObjectGUID).ToString()) - if (-not $settings.Enabled) { return @{ FullAccess=@(); SendAs=@(); SendOnBehalf=@() } } - Write-PraLog -Context $Context -Message "Shared mailbox permissions | DC=$($Context.Server) | $($User.DistinguishedName) | source=$($settings.PermissionSource)" -Level Debug - switch ($settings.PermissionSource) { - AD { - # Descriptor read through Get-ADUser -Server, never through the AD: drive. - $security = Get-PraValue $User 'nTSecurityDescriptor' $null - if ($null -eq $security) { throw 'nTSecurityDescriptor cannot be read: SendAs capture incomplete (check the read rights of the account).' } - $sendRules = if ($security -is [Security.AccessControl.ObjectSecurity]) { $security.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) } else { $security.Access } - foreach ($ace in $sendRules) { - if ($ace.AccessControlType -eq 'Allow' -and -not $ace.IsInherited -and - $ace.ActiveDirectoryRights -match 'ExtendedRight' -and [string]$ace.ObjectType -ieq 'ab721a54-1e2f-11d0-9819-00aa0040529b') { - foreach ($upn in @(Resolve-PraAclTrustee -Context $Context -Reference $ace.IdentityReference -Unknown $unknownSendAs)) { [void]$send.Add($upn) } - } - } - if ($null -eq $User.PSObject.Properties['msExchMailboxSecurityDescriptor']) { throw 'msExchMailboxSecurityDescriptor not read.' } - $mailboxSecurity = $User.msExchMailboxSecurityDescriptor - if ($mailboxSecurity -is [byte[]]) { - $descriptor = New-Object DirectoryServices.ActiveDirectorySecurity - $descriptor.SetSecurityDescriptorBinaryForm($mailboxSecurity); $mailboxSecurity = $descriptor - } - if ($null -ne $mailboxSecurity) { - $fullRules = if ($mailboxSecurity -is [Security.AccessControl.ObjectSecurity]) { $mailboxSecurity.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) } else { $mailboxSecurity.Access } - foreach ($ace in $fullRules) { - if ($ace.AccessControlType -eq 'Allow' -and -not $ace.IsInherited -and (([int]$ace.ActiveDirectoryRights -band 1) -eq 1)) { - foreach ($upn in @(Resolve-PraAclTrustee -Context $Context -Reference $ace.IdentityReference -Unknown $unknownFullAccess)) { [void]$full.Add($upn) } - } - } - } - } - Csv { - $names = @((Get-PraValue $User 'mailNickname' ''), $User.SamAccountName, (Get-PraValue $User 'DisplayName' ''), (Get-PraValue $User 'Name' '')) - $permissionRows = @(Import-Csv -LiteralPath $settings.CsvPath -ErrorAction Stop | Where-Object { $_.Shared -in $names }) - if ($permissionRows.Count -ne 1 -or -not $permissionRows[0].Group) { throw "Permission CSV: no line (or several lines) Shared/Group for $($User.SamAccountName)." } - $group = Get-PraGroup $Context $permissionRows[0].Group -WithoutMembers - foreach ($upn in @(Expand-PraTrustee -Context $Context -Object $group)) { [void]$full.Add($upn); [void]$send.Add($upn) } - } - CustomAttribute { - $attr = [string]$settings.CustomAttribute - if ($attr -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw 'SharedMailbox.CustomAttribute is invalid.' } - $filters = @(@((Get-PraValue $User 'mailNickname' ''), $User.SamAccountName, (Get-PraValue $User 'DisplayName' '')) | Where-Object { $_ } | Select-Object -Unique | ForEach-Object { "($attr=$(ConvertTo-PraLdapValue $_))" }) - $groups = @(Get-ADGroup -LDAPFilter ('(|' + ($filters -join '') + ')') -Server $Context.Server -ErrorAction Stop) - if ($groups.Count -ne 1) { throw "Permission group not found or not unique for $($User.SamAccountName) ($attr)." } - foreach ($upn in @(Expand-PraTrustee -Context $Context -Object $groups[0])) { [void]$full.Add($upn); [void]$send.Add($upn) } - } - None { } - default { throw 'SharedMailbox.PermissionSource is invalid.' } - } - if ($settings.CaptureSendOnBehalf) { - if ($null -eq $User.PSObject.Properties['publicDelegates']) { throw 'publicDelegates not read.' } - $seenDelegates = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) - foreach ($dn in @($User.publicDelegates)) { - if (-not $dn -or -not $seenDelegates.Add([string]$dn)) { continue } - $cache = Get-PraPermissionCache -Context $Context - $key = 'delegate:' + ([string]$dn).ToLowerInvariant() - if ($cache.Entries.ContainsKey($key)) { $upns = $cache.Entries[$key].Upns } - else { - $Context.CurrentOperation = 'Resolve-PublicDelegate'; $Context.CurrentIdentity = [string]$dn - $delegate = Get-ADObject -Identity $dn -Properties objectClass, userPrincipalName, sAMAccountName -Server $Context.Server -ErrorAction Stop - $upns = [string[]]@(Expand-PraTrustee -Context $Context -Object $delegate) - Add-PraPermissionCache -Context $Context -Key $key -Upns $upns - } - foreach ($upn in $upns) { [void]$behalf.Add($upn) } - } - } - Write-PraMemoryStage -Context $Context -Stage 'PERMISSIONS CAPTURED' -Identity ([string]$User.ObjectGUID) -Detail ("FullAccess=$($full.Count) SendAs=$($send.Count) SendOnBehalf=$($behalf.Count)") - $ignored = @(@($unknownFullAccess | ForEach-Object { "FullAccess $_" }) + @($unknownSendAs | ForEach-Object { "SendAs $_" })) - if ($ignored.Count) { $Context['_PraIgnoredTrustees'][([guid]$User.ObjectGUID).ToString()] = [string[]]$ignored } - return @{ FullAccess=@($full | Sort-Object); SendAs=@($send | Sort-Object); SendOnBehalf=@($behalf | Sort-Object) } -} -#endregion - -#region 5. Plans ------------------------------------------------------------------------------- - -function New-PraRow { - <# - .SYNOPSIS - Result row of one object (CSV/HTML report, cloud phase). Memory only. - #> - [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions','',Justification='In-memory constructor, no change to any target or file.')] - [CmdletBinding()] - param([hashtable]$Context, $Record) - [pscustomobject]@{ - ObjectGuid=[string](Get-PraValue $Record 'ObjectGuid' ''); SamAccountName=[string](Get-PraValue $Record 'SamAccountName' '') - UserPrincipalName=[string](Get-PraValue $Record 'UserPrincipalName' ''); Action=$Context.Action - IsShared=[bool](Get-PraValue $Record 'IsShared' $false); ADApplied=$null; ADVerified=$null; GroupAction='' - BackupPath=''; LastOperation=''; CloudMailbox=$null; CloudLicense=$null; CloudStatus='N/A'; CloudDetail='' - FinalStatus='Skipped'; Detail=''; SharedFullAccess=@(); SharedSendAs=@(); SharedSendOnBehalf=@(); PermMissing=@(); PermDetail=''; Warnings='' - BackupRec=$Record; DeproPending=$false; RestoreDeferred=$false - PreserveCloudMailbox=$false; PreserveLicense=$false; DeprovisionConfirmed=$false - } -} - -function New-PraPlan { - <# - .SYNOPSIS - Reads one object (all attributes, security descriptors) and computes its target state. Read only. - .PARAMETER Operation - Convert on-premises mailbox -> remote mailbox (targetAddress, remote types, Exchange - attributes cleared, routing proxy, retention tag, licence group or shared permissions) - Recover original attributes and licence group membership from the Convert backup - Deprovision shared mailbox: MailUser with msExchRemoteRecipientType 8, so that Exchange Online - removes the cloud shared mailbox before the on-premises attributes come back - RestoreTag original value of the retention tag only - .PARAMETER SourceRecord - Record of the Convert backup (Recover, Deprovision, RestoreTag). - .PARAMETER RestoreRetention - Recover: also restore the original retention tag (Finalize step). - .OUTPUTS - Plan: User (light), RawSnapshot (full capture), Record (backup record), Kinds, Desired, Row, Operation. - #> - [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions','',Justification='Reads and in-memory preparation only; writes are in Invoke-PraAdWrite.')] - [CmdletBinding()] - param([hashtable]$Context, [string]$Identity, [ValidateSet('Convert','Recover','Deprovision','RestoreTag')][string]$Operation, $SourceRecord = $null, [switch]$RestoreRetention) - $Context.CurrentOperation = $Operation; $Context.CurrentIdentity = $Identity - $config = $Context.Config - if ($null -ne $SourceRecord) { Assert-PraDomain $Context ([string]$SourceRecord.DistinguishedName) } - $tag = if ($Operation -eq 'Convert') { $config.Retention.Tag } else { Get-PraValue $SourceRecord 'Retention' $null } - $tagEnabled = if ($Operation -eq 'Convert') { $config.Retention.Enabled -and $tag.Enabled } else { [bool](Get-PraValue $tag 'Enabled' $false) } - $tagAttr = if ($tagEnabled) { [string]$tag.Attribute } else { '' } - if ($tagAttr -and $tagAttr -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw "Retention tag attribute not allowed: $tagAttr" } - if ($Operation -eq 'RestoreTag' -and -not $tagEnabled) { throw 'The original value of the retention tag is not in the backup: tag clean-up refused.' } - $kinds = [ordered]@{}; foreach ($name in $script:AttributeKinds.Keys) { $kinds[$name] = $script:AttributeKinds[$name] } - if ($tagAttr) { $kinds[$tagAttr] = 'String' } - $user = Get-PraUser $Context $Identity -ExtraProperties @($kinds.Keys) -Capture - $before = Get-PraAttributeState $user $kinds - $shared = if ($Operation -eq 'Convert') { [int64]$user.msExchRecipientTypeDetails -eq 4 } else { [bool]$SourceRecord.IsShared } - $desired = [ordered]@{}; foreach ($name in $before.Keys) { $desired[$name] = $before[$name] } - $permissions = @{ FullAccess=@(); SendAs=@(); SendOnBehalf=@() } - $licensing = [ordered]@{ Enabled=$false; GroupGuid=''; GroupDN=''; WasMember=$false; DesiredMember=$false } - $routing = ''; $alreadyRecovered = $false - if ($Operation -eq 'Convert') { - if (-not $user.homeMDB -or [int64]$user.msExchRecipientTypeDetails -notin @(1, 4, 16, 32)) { throw "Not an on-premises mailbox (homeMDB / msExchRecipientTypeDetails): $Identity" } - $routing = Get-PraRoutingAddress $Context $user - $rrt = if ($shared) { [int64]$config.SharedMailbox.RemoteRecipientType } else { [int64]$config.Remote.RecipientType } - if ($shared -and $rrt -in @(100, 102)) { throw "SharedMailbox.RemoteRecipientType=$rrt means an already migrated mailbox (Migrated+Shared): first provisioning refused before any change: $Identity" } - if ($config.Remote.HandleArchives -and (Get-PraValue $user 'msExchArchiveGUID' $null)) { $rrt = $rrt -bor 2 } - $desired.targetAddress = @{ Present=$true; Kind='String'; Value="SMTP:$routing" } - $desired.msExchRecipientDisplayType = @{ Present=$true; Kind='Int'; Value='-2147483642' } - $details = if ($shared) { '34359738368' } else { '2147483648' } - $desired.msExchRecipientTypeDetails = @{ Present=$true; Kind='Long'; Value=$details } - $desired.msExchRemoteRecipientType = @{ Present=$true; Kind='Long'; Value=[string]$rrt } - foreach ($name in @('homeMDB','homeMTA','msExchHomeServerName','mDBUseDefaults')) { $desired[$name] = @{ Present=$false; Kind=$kinds[$name]; Value=$null } } - if ($config.Remote.ClearMailboxGuid) { $desired.msExchMailboxGuid = @{ Present=$false; Kind='Bytes'; Value=$null } } - $proxies = @($user.proxyAddresses) - if (-not @($proxies | Where-Object { $_ -ieq "smtp:$routing" }).Count) { $proxies += "smtp:$routing" } - $desired.proxyAddresses = @{ Present=$true; Kind='MultiString'; Value=[string[]]$proxies } - if ($tagEnabled) { $desired[$tagAttr] = @{ Present=$true; Kind='String'; Value=[string]$tag.Value } } - if ($shared) { $permissions = Get-PraSharedPermission $Context $user } - elseif ($config.Licensing.Enabled) { - $group = Get-PraGroup $Context $config.Licensing.GroupDN - $licensing.Enabled = $true; $licensing.GroupGuid = ([guid]$group.ObjectGUID).ToString(); $licensing.GroupDN = [string]$group.DistinguishedName - $licensing.WasMember = ([string]$user.DistinguishedName -in @($group.member)); $licensing.DesiredMember = $true - } - } - elseif ($Operation -eq 'Deprovision') { - if (-not $shared) { throw 'Deprovision is for shared mailboxes only.' } - $remoteState = ([int64]$user.msExchRecipientTypeDetails -eq 34359738368) - $pendingState = ([int64]$user.msExchRecipientTypeDetails -eq 128 -and [int64]$user.msExchRemoteRecipientType -eq 8) - if (-not $remoteState -and -not $pendingState) { - $alreadyRecovered = $true - foreach ($name in $script:AttributeKinds.Keys) { if (-not (Test-PraStateEqual $before[$name] $SourceRecord.Attributes.$name)) { $alreadyRecovered = $false } } - if (-not $alreadyRecovered) { throw 'Shared mailbox in an unexpected state: neither RemoteSharedMailbox, nor MailUser with RRT 8, nor its original state.' } - } - if (-not $alreadyRecovered) { - if (-not (Get-PraValue $user 'targetAddress' '')) { throw 'targetAddress missing: a clean deprovisioning is not guaranteed.' } - $desired.msExchRemoteRecipientType = @{ Present=$true; Kind='Long'; Value='8' } - $desired.msExchRecipientDisplayType = @{ Present=$true; Kind='Int'; Value='6' } - $desired.msExchRecipientTypeDetails = @{ Present=$true; Kind='Long'; Value='128' } - foreach ($name in @('homeMDB','msExchHomeServerName','mDBUseDefaults','msExchMailboxGuid')) { $desired[$name] = @{ Present=$false; Kind=$kinds[$name]; Value=$null } } - } - } - elseif ($Operation -eq 'Recover') { - foreach ($name in $script:AttributeKinds.Keys) { $desired[$name] = $SourceRecord.Attributes.$name } - $sourceGroup = Get-PraValue $SourceRecord 'Licensing' $null - if ($null -ne $sourceGroup -and $sourceGroup.Enabled) { - $group = Get-PraGroup $Context $sourceGroup.GroupGuid - $licensing.Enabled = $true; $licensing.GroupGuid = ([guid]$group.ObjectGUID).ToString(); $licensing.GroupDN = [string]$group.DistinguishedName - $licensing.WasMember = ([string]$user.DistinguishedName -in @($group.member)); $licensing.DesiredMember = [bool]$sourceGroup.WasMember - } - elseif ([bool](Get-PraValue $SourceRecord 'AddedToLicenseGroup' $false)) { - throw 'Old backup without the GUID of the licence group: removal refused (a group with the same DN may have been re-created). Have the backup migrated before restoring this batch.' - } - } - if ($Operation -eq 'RestoreTag' -or ($Operation -eq 'Recover' -and $RestoreRetention -and $tagEnabled)) { - $original = $SourceRecord.Attributes.$tagAttr - if (-not (Test-PraStateEqual $before[$tagAttr] $original) -and - (-not $before[$tagAttr].Present -or [string]$before[$tagAttr].Value -cne [string]$tag.Value)) { - throw "Retention tag $tagAttr changed by someone else: restore refused." - } - $desired[$tagAttr] = $original - } - $sourceLicensing = Get-PraValue $SourceRecord 'Licensing' $null - $preserveMailbox = $shared -and $Operation -eq 'Recover' -and [bool](Get-PraValue $Context 'KeepCloudShared' $false) - $preserveLicense = ($Operation -eq 'Recover') -and [bool](Get-PraValue $sourceLicensing 'Enabled' $false) -and [bool](Get-PraValue $sourceLicensing 'WasMember' $false) - $record = [ordered]@{ - ObjectGuid=([guid]$user.ObjectGUID).ToString(); DistinguishedName=[string]$user.DistinguishedName - SamAccountName=[string]$user.SamAccountName; UserPrincipalName=[string]$user.UserPrincipalName; DisplayName=[string](Get-PraValue $user 'DisplayName' $user.SamAccountName) - CapturedUtc=[DateTime]::UtcNow.ToString('o'); CapturedUsnChanged=(Get-PraUsn $user); IsShared=$shared; RequestedOperation=$Operation - Attributes=$before; PlannedAttributes=$desired; Licensing=$licensing - Retention=[ordered]@{ Enabled=[bool]$tagEnabled; Attribute=$tagAttr; Value=$(if ($tagEnabled) { [string]$tag.Value } else { '' }) } - SharedPermissions=$permissions; PreserveCloudMailbox=[bool]$preserveMailbox; PreserveLicense=[bool]$preserveLicense - } - $row = New-PraRow $Context $record - if ($null -ne $SourceRecord) { $row.BackupRec = $SourceRecord } else { $row.BackupRec = [pscustomobject]$record } - $row.PreserveCloudMailbox = [bool]$preserveMailbox; $row.PreserveLicense = [bool]$preserveLicense - $ignoredEntries = Get-PraValue (Get-PraValue $Context '_PraIgnoredTrustees' @{}) $record.ObjectGuid @() - $ignoredEntries = @($ignoredEntries | Where-Object { $_ }) - if ($shared -and $Operation -eq 'Convert' -and $ignoredEntries.Count) { $row.Warnings = 'Permission entries ignored (account unknown in AD): ' + ($ignoredEntries -join '; ') } - $row.IsShared = $shared; $row.SharedFullAccess = @($permissions.FullAccess); $row.SharedSendAs = @($permissions.SendAs); $row.SharedSendOnBehalf = @($permissions.SendOnBehalf) - $row.DeproPending = ($Operation -eq 'Deprovision' -and -not $alreadyRecovered); $row.Detail = "Operation=$Operation ; routing=$routing"; $row.LastOperation = 'Prepared' - $plannedOperation = if ($alreadyRecovered) { 'AlreadyRecovered' } else { $Operation } - $record.RequestedOperation = $plannedOperation - $Context.CurrentOperation = 'Project-ADSnapshot'; $Context.CurrentIdentity = $record.ObjectGuid - Write-PraMemoryStage -Context $Context -Stage 'PROJECTION BEGIN' -Identity $record.ObjectGuid -Detail $record.SamAccountName - $rawSnapshot = ConvertTo-PraRawSnapshot -User $user -CapturedUtc $record.CapturedUtc - $lightUser = [pscustomobject]@{ ObjectGUID=[guid]$record.ObjectGuid; DistinguishedName=$record.DistinguishedName; uSNChanged=[int64]$record.CapturedUsnChanged } - Write-PraMemoryStage -Context $Context -Stage 'PROJECTION END' -Identity $record.ObjectGuid -Detail ("attributes=$($rawSnapshot.Attributes.Count) FullAccess=$(@($permissions.FullAccess).Count) SendAs=$(@($permissions.SendAs).Count) SendOnBehalf=$(@($permissions.SendOnBehalf).Count)") - return [pscustomobject]@{ User=$lightUser; RawSnapshot=$rawSnapshot; Record=$record; Kinds=$kinds; Desired=$desired; Row=$row; Operation=$plannedOperation; ExpectedUsnChanged=$record.CapturedUsnChanged; Previewed=$false } -} -#endregion - -#region 6. Backups and proofs ------------------------------------------------------------------- - -function Assert-PraStoredRecord { - <# One record of a backup file is complete and correctly typed (never trusted blindly). #> - [CmdletBinding()] - param($Record, [switch]$Legacy, [switch]$Planned) - $attributeStates = if ($Planned) { $Record.PlannedAttributes } else { $Record.Attributes } - if ([guid]$Record.ObjectGuid -eq [guid]::Empty) { throw 'Backup: empty GUID.' } - foreach ($name in @('DistinguishedName','SamAccountName','UserPrincipalName')) { - if ((Get-PraValue $Record $name $null) -isnot [string] -or [string]::IsNullOrWhiteSpace($Record.$name)) { throw "Backup: $name missing or invalid." } - } - $kinds = [ordered]@{}; foreach ($name in $script:AttributeKinds.Keys) { $kinds[$name] = $script:AttributeKinds[$name] } - $retention = Get-PraValue $Record 'Retention' $null - if ($null -ne $retention -and $retention.Enabled) { - if ($retention.Attribute -notmatch '^extensionAttribute([1-9]|1[0-5])$' -or $retention.Value -isnot [string]) { throw 'Backup: invalid retention tag metadata.' } - $kinds[$retention.Attribute] = 'String' - } - foreach ($name in $kinds.Keys) { - $state = Get-PraValue $attributeStates $name $null - if ($null -eq $state -or (Get-PraValue $state 'Present' $null) -isnot [bool] -or $state.Kind -cne $kinds[$name]) { throw "Backup incomplete or wrong type: $name" } - if (-not $state.Present) { - if ($null -ne $state.Value) { throw "Backup: $name is absent but has a value." } - continue - } - switch ($state.Kind) { - Bool { if ($state.Value -isnot [bool]) { throw "Backup: invalid boolean $name" } } - MultiString { - if ($state.Value -isnot [array] -or @($state.Value).Count -eq 0) { throw "Backup: invalid list $name" } - foreach ($value in $state.Value) { if ($value -isnot [string] -or -not $value) { throw "Backup: invalid text in $name" } } - } - default { if ($state.Value -isnot [string] -or -not $state.Value) { throw "Backup: invalid value $name" } } - } - $null = ConvertFrom-PraStoredValue $state - } - if (-not $Legacy) { - if ($Record.CapturedUsnChanged -isnot [string] -or $Record.CapturedUsnChanged -notmatch '^[1-9][0-9]*$') { throw 'Backup: original uSNChanged missing or invalid.' } - $null = [int64]::Parse($Record.CapturedUsnChanged, [Globalization.CultureInfo]::InvariantCulture) - if ($Record.RequestedOperation -notin @('Convert','Recover','Deprovision','RestoreTag','AlreadyRecovered')) { throw 'Backup: invalid planned operation.' } - if ($Record.PreserveCloudMailbox -isnot [bool] -or $Record.PreserveLicense -isnot [bool]) { throw 'Backup: invalid cloud post-conditions.' } - if ($Record.PreserveCloudMailbox -and (-not $Record.IsShared -or $Record.RequestedOperation -ne 'Recover')) { throw 'Backup: keeping the cloud mailbox does not match the operation or the type.' } - if ($Record.IsShared -isnot [bool] -or $Record.Licensing.Enabled -isnot [bool] -or $Record.Licensing.WasMember -isnot [bool] -or $Record.Licensing.DesiredMember -isnot [bool]) { throw 'Backup: invalid licence group or type state.' } - if ($Record.Licensing.Enabled -and [guid]$Record.Licensing.GroupGuid -eq [guid]::Empty) { throw 'Backup: licence group GUID missing.' } - } - else { - if ((Get-PraValue $Record 'AddedToLicenseGroup' $null) -isnot [bool]) { throw 'Old backup: licence group state not captured.' } - } -} - -function Import-PraBackup { - <# - .SYNOPSIS - Reads and fully validates a backup (JSON, .sha256, CLIXML) and returns its receipt. - Schema 3 (current), 2 and 1 (old versions, read with their restrictions) are accepted. - #> - [CmdletBinding()] - param([hashtable]$Context, [Parameter(Mandatory)][string]$Path) - $pathResolved = (Get-Item -LiteralPath $Path -ErrorAction Stop).FullName - $registry = Get-PraReceiptRegistry -Context $Context - foreach ($entry in $registry) { - if ($entry.Path -ieq $pathResolved) { - Assert-PraReceiptIntegrity -Context $Context -Entry $entry - Write-PraLog -Context $Context -Message ("BACKUP INTEGRITY | already validated | $pathResolved | hashes re-read") -Level Debug - return $entry.Receipt - } - } - $Context.CurrentOperation = 'Read-BackupJson' - $hashBeforeRead = Get-PraHash -Path $pathResolved - $data = Get-Content -LiteralPath $pathResolved -Raw -Encoding UTF8 -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop - if ($data.Environment -cne $Context.Config.Environment) { throw "Backup of another Environment: '$($data.Environment)' (configuration: '$($Context.Config.Environment)')." } - $version = Get-PraValue $data 'SchemaVersion' 1 - if ($version -notin @(1, 2, 3)) { throw "Backup schema not supported: $version" } - if ($version -eq 3 -and (Get-PraValue $data 'RawFormat' '') -cne 'PraDataOnlyClixml-v1') { throw 'Backup capture format not supported.' } - if ($data.Operation -notin @('Convert','Recover','Finalize','Retention')) { throw "This file is not an AD backup: $($data.Operation)" } - $records = @($data.Records) - if (-not $records.Count -or $null -eq $records[0]) { throw 'Backup without any record.' } - $seen = @{} - foreach ($record in $records) { - Assert-PraStoredRecord $record -Legacy:($version -eq 1) - if ($version -ge 2) { Assert-PraStoredRecord $record -Planned } - $key = ([guid]$record.ObjectGuid).ToString() - if ($seen.ContainsKey($key)) { throw "Same GUID twice in the backup: $key" }; $seen[$key] = $true - } - $hash = Get-PraHash $pathResolved - if ($hash -cne $hashBeforeRead) { throw 'Backup JSON changed while it was read.' } - $rawPath = ''; $rawHash = '' - if ($version -ge 2) { - $storedHash = (Get-Content -LiteralPath ($pathResolved + '.sha256') -Raw -ErrorAction Stop).Trim() - if ($storedHash -cne $hash) { throw 'Backup SHA-256 does not match its .sha256 file.' } - if ([IO.Path]::GetFileName($data.RawFile) -cne $data.RawFile) { throw 'Backup CLIXML path is not in the batch folder.' } - $rawPath = Join-Path (Split-Path $pathResolved -Parent) $data.RawFile - $rawHash = Get-PraHash -Path $rawPath - if ($rawHash -cne $data.RawHash) { throw 'Backup CLIXML SHA-256 mismatch.' } - $format = if ($version -eq 3) { [string]$data.RawFormat } else { '' } - $Context.CurrentOperation = 'Validate-RawCapture' - Write-PraMemoryStage -Context $Context -Stage 'RAW VALIDATE BEGIN' -Detail ("schema=$version objects=$($records.Count) file=$rawPath") - $null = Test-PraRawCapture -Context $Context -LiteralPath $rawPath -Records $records -RawFormat $format - # A change during the read never yields a receipt for different content. - if ((Get-PraHash -Path $rawPath) -cne $rawHash) { throw 'Backup CLIXML changed during its validation.' } - Write-PraMemoryStage -Context $Context -Stage 'RAW VALIDATE END' -Detail ("bytes=$((Get-Item -LiteralPath $rawPath -ErrorAction Stop).Length)") - } - else { Write-PraLog -Context $Context -Message 'Schema 1 backup (version 1.2.x): no proof of the original retention tag nor of the AD phase. Missing values are never invented.' -Level Warning } - if ((Get-PraHash -Path $pathResolved) -cne $hash) { throw 'Backup JSON changed during its validation.' } - $receipt = [pscustomobject]@{ Data=$data; Path=$pathResolved; Hash=$hash; Legacy=($version -eq 1) } - Add-PraValidatedReceipt -Context $Context -Receipt $receipt -RawPath $rawPath -RawHash $rawHash - return $receipt -} - -function Assert-PraRecordMatchesPlan { - <# The re-read backup record holds exactly the planned record (metadata, values, group, tag, permissions). #> - [CmdletBinding()] - param($Stored, [Collections.IDictionary]$Expected) - foreach ($name in @('ObjectGuid','DistinguishedName','SamAccountName','UserPrincipalName','DisplayName','CapturedUtc','CapturedUsnChanged','IsShared','RequestedOperation','PreserveCloudMailbox','PreserveLicense')) { - if ((Get-PraValue $Stored $name $null) -cne $Expected[$name]) { throw "Backup re-read: $name not preserved." } - } - foreach ($section in @('Attributes','PlannedAttributes')) { - $actualNames = @($Stored.$section.PSObject.Properties.Name) - if ($actualNames.Count -ne $Expected[$section].Count) { throw "Backup re-read: missing or extra attributes in $section." } - foreach ($name in $Expected[$section].Keys) { - $state = Get-PraValue $Stored.$section $name $null - if ($null -eq $state -or -not (Test-PraStateEqual -Left $Expected[$section][$name] -Right $state)) { throw "Backup re-read: value not preserved $section/$name." } - } - } - foreach ($section in @('Licensing','Retention')) { - foreach ($name in $Expected[$section].Keys) { - if ((Get-PraValue $Stored.$section $name $null) -cne $Expected[$section][$name]) { throw "Backup re-read: state not preserved $section/$name." } - } - } - foreach ($right in @('FullAccess','SendAs','SendOnBehalf')) { - $actual = Get-PraValue $Stored.SharedPermissions $right $null - $wanted = @($Expected.SharedPermissions[$right]) - if ($null -eq $actual -or @($actual).Count -ne $wanted.Count) { throw "Backup re-read: incomplete permissions $right." } - for ($index = 0; $index -lt $wanted.Count; $index++) { - if ([string]$actual[$index] -cne [string]$wanted[$index]) { throw "Backup re-read: permission not preserved $right index=$index." } - } - } -} - -function Save-PraBatch { - <# - .SYNOPSIS - Writes the backup of the whole batch BEFORE any write: private folder Batch- with - ---.json (typed records), .clixml (every AD value), - .sha256, then re-reads and compares everything with the plans. Also opens the batch journal. - #> - [CmdletBinding()] - param([hashtable]$Context, [Parameter(Mandatory)][object[]]$Plans, [string]$Operation) - if (-not $Plans.Count) { throw 'Empty backup batch.' } - $Context.CurrentOperation = 'Capture/Persist/Verify'; $Context.CurrentIdentity = 'Batch' - $id = [guid]::NewGuid().ToString('N') - $directory = Join-Path $Context.BackupFolder ('Batch-' + $id) - $base = "$Operation-$($Context.Config.Environment)-$(Get-Date -Format 'yyyyMMdd_HHmmss')-$($id.Substring(0, 8))" - $rawPath = Join-Path $directory ($base + '.clixml') - $path = Join-Path $directory ($base + '.json') - if ($rawPath.Length -ge 248) { throw 'Backup path too long for Windows PowerShell 5.1: use a shorter Storage.BackupFolder.' } - New-PraPrivateDirectory $directory - Write-PraLog -Context $Context -Message "BACKUP BEGIN | $($Plans.Count) object(s) | $path" -Level Detail - $snapshots = @($Plans | ForEach-Object { $_.RawSnapshot }) - $Context.CurrentOperation = 'Write-RawCapture' - Write-PraMemoryStage -Context $Context -Stage 'RAW WRITE BEGIN' -Detail ("objects=$($snapshots.Count) file=$rawPath") - Write-PraRawCapture -Context $Context -LiteralPath $rawPath -Snapshots $snapshots - Write-PraMemoryStage -Context $Context -Stage 'RAW WRITE END' -Detail ("bytes=$((Get-Item -LiteralPath $rawPath -ErrorAction Stop).Length)") - $data = [ordered]@{ - SchemaVersion=3; RawFormat='PraDataOnlyClixml-v1'; Operation=$Operation; RunId=$Context.RunId; BatchId=$id; Environment=$Context.Config.Environment - Server=$Context.Server; NamingContext=$Context.NamingContext; CreatedUtc=[DateTime]::UtcNow.ToString('o') - RawFile=[IO.Path]::GetFileName($rawPath); RawHash=(Get-PraHash $rawPath) - SourceBackupHash=$Context.SourceBackupHash; Records=@($Plans | ForEach-Object { $_.Record }) - } - $Context.CurrentOperation = 'Write-BackupJson' - $json = $data | ConvertTo-Json -Depth 30 - Write-PraImmutableFile $path $json - $json = $null - Write-PraImmutableFile ($path + '.sha256') (Get-PraHash $path) - $Context.CurrentOperation = 'Validate-BackupAgainstPlan' - $null = Test-PraRawCapture -Context $Context -LiteralPath $rawPath -Records $data.Records -RawFormat $data.RawFormat -ExpectedSnapshots $snapshots - $receipt = Import-PraBackup $Context $path - # A valid JSON is not necessarily complete: compare it with the plans in memory. - for ($i = 0; $i -lt $Plans.Count; $i++) { - $record = $receipt.Data.Records[$i] - if ($record.ObjectGuid -cne $Plans[$i].Record.ObjectGuid) { throw 'Backup order or identity differs from the plan.' } - Assert-PraRecordMatchesPlan -Stored $record -Expected $Plans[$i].Record - } - $Context.BackupFiles.Add($path) - $Context.JournalPath = Join-Path $directory ('Journal-' + $id + '.jsonl') - Write-PraImmutableFile $Context.JournalPath '' - $Context.StateFiles.Add($Context.JournalPath) - foreach ($plan in $Plans) { $plan.Row.BackupPath = $path } - Write-PraJournal $Context '*' 'Backup' 'Verified' $path - Write-PraLog -Context $Context -Message "BACKUP VERIFIED | $path | SHA256=$($receipt.Hash) | JSON + CLIXML re-read" -Level Detail - Write-PraItem -Context $Context -Status Ok -Icon Backup -Text ("Backup of {0} object(s) written and re-read {1} batch {2}" -f $Plans.Count, [char]0x00B7, $id.Substring(0, 8)) - Write-PraLog -Context $Context -Message $directory -Level Sub - return $receipt -} - -function Assert-PraReceipt { - <# - .SYNOPSIS - The object is covered by the validated backup, and the backup is unchanged. - #> - [CmdletBinding()] - param([hashtable]$Context, $Receipt, [string]$ObjectGuid) - $entry = Get-PraReceiptEntry -Context $Context -Receipt $Receipt - if (-not $entry.Guids.Contains($ObjectGuid)) { throw "Object not covered by the validated backup: $ObjectGuid" } - Assert-PraReceiptIntegrity -Context $Context -Entry $entry -} - -function Assert-PraCurrentState { - <# Re-reads the object: same version (uSNChanged), same DN, expected values and group membership. #> - [CmdletBinding()] - param([hashtable]$Context, $Plan, [Collections.IDictionary]$Expected, [bool]$ExpectedMember, [switch]$AcceptNewVersion) - $user = Get-PraUser $Context $Plan.Record.ObjectGuid -ExtraProperties @($Plan.Kinds.Keys) - $version = Get-PraUsn $user - if (-not $AcceptNewVersion -and $version -cne $Plan.ExpectedUsnChanged) { throw 'uSNChanged changed: the object was modified since it was planned or last verified.' } - if ([string]$user.DistinguishedName -cne $Plan.Record.DistinguishedName) { throw 'The DN changed since the capture: plan the batch again.' } - $actual = Get-PraAttributeState $user $Plan.Kinds - foreach ($name in $Expected.Keys) { - if (-not (Test-PraStateEqual $Expected[$name] $actual[$name])) { throw "AD state differs from the expected state | GUID=$($Plan.Record.ObjectGuid) | attribute=$name | DC=$($Context.Server)" } - } - if ($Plan.Record.Licensing.Enabled) { - $group = Get-PraGroup $Context $Plan.Record.Licensing.GroupGuid - if ($group.DistinguishedName -cne $Plan.Record.Licensing.GroupDN -or - ([string]$user.DistinguishedName -in @($group.member)) -ne $ExpectedMember) { throw 'Licence group membership differs from the backup/plan.' } - } - if ($AcceptNewVersion) { $Plan.ExpectedUsnChanged = $version } -} -#endregion - -#region 7. Writes ------------------------------------------------------------------------------ - -function Invoke-PraAdWrite { - <# - .SYNOPSIS - One AD write (Set-ADUser, Add-ADGroupMember or Remove-ADGroupMember) with every guard: - no previous error, Apply mode, ShouldProcess, validated backup covering the object, - operator approval, current state re-read AFTER the approval, journal Started/Applied. - #> - [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')] - param([hashtable]$Context, $Receipt, $Plan, [string]$Operation, [scriptblock]$Write) - if ([bool](Get-PraValue $Context 'OperationFailed' $false) -or $Context.Issues.Count -gt 0 -or @($Context.Rows | Where-Object FinalStatus -eq 'Error').Count -gt 0) { throw 'Safety stop: no AD write after an error in this run.' } - if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -eq 'Check' -or $WhatIfPreference) { throw 'Safety stop: AD writes are not allowed in this mode.' } - if (-not $PSCmdlet.ShouldProcess($Plan.Record.ObjectGuid, $Operation)) { throw 'AD write not authorised (ShouldProcess).' } - Assert-PraReceipt $Context $Receipt $Plan.Record.ObjectGuid - if (-not (& $Context.Approval $Plan.Record.DistinguishedName $Operation)) { throw "Operation refused: $Operation. Batch stopped." } - # An interactive confirmation can take time: re-check the object and the backup AFTER it. - $expected = if ($Operation -eq 'Set-ADUser') { $Plan.Record.Attributes } else { $Plan.Desired } - Assert-PraCurrentState $Context $Plan $expected $Plan.Record.Licensing.WasMember - Assert-PraReceipt $Context $Receipt $Plan.Record.ObjectGuid - $Context.CurrentOperation = $Operation; $Context.CurrentIdentity = $Plan.Record.ObjectGuid - $Plan.Row.LastOperation = $Operation; $Plan.Row.Detail += " | attempt=$Operation" - Write-PraJournal $Context $Plan.Record.ObjectGuid $Operation 'Started' - Write-PraLog -Context $Context -Message "AD WRITE BEGIN | $Operation | DC=$($Context.Server) | GUID=$($Plan.Record.ObjectGuid) | backup=$($Receipt.Path)" -Level Detail - # Any exception goes up to Invoke-PraAdBatch: no next object, no sync. - & $Write | Out-Null - $Plan.Row.ADApplied = $true - Write-PraJournal $Context $Plan.Record.ObjectGuid $Operation 'Applied' -} - -function Invoke-PraAdPreview { - <# - .SYNOPSIS - Adds the planned objects to the results and shows their planned changes (before the - confirmation). Invoke-PraAdBatch does not show them again. - #> - [CmdletBinding()] - param([hashtable]$Context, [AllowEmptyCollection()][object[]]$Plans) - foreach ($plan in $Plans) { - if (-not $Context.Rows.Contains($plan.Row)) { $Context.Rows.Add($plan.Row) } - Write-PraAdDelta -Context $Context -Plan $plan -Stage Planned - $plan.Previewed = $true - } -} - -function Invoke-PraAdBatch { - <# - .SYNOPSIS - Applies a batch of plans: backup of the whole batch, then for each object Set-ADUser and the - licence group change, each followed by an AD re-read; finally the State file (AD proof). - .DESCRIPTION - Preview (or -WhatIf): the rows are marked Planned and nothing is written (no backup either). - The first error stops the batch; previous objects keep their changes (no automatic rollback): - the journal and the backup say exactly what was done. - .OUTPUTS - The receipt of the batch backup, with a StatePath property; $null in Preview. - #> - [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')] - param([hashtable]$Context, [AllowEmptyCollection()][object[]]$Plans, [ValidateSet('Convert','Recover','Finalize','Retention')][string]$Operation) - $Context.LastVerifiedReceipt = $null - if ([bool](Get-PraValue $Context 'OperationFailed' $false) -or $Context.Issues.Count -gt 0 -or @($Context.Rows | Where-Object FinalStatus -eq 'Error').Count -gt 0) { throw 'No new batch after an error in this run.' } - if (-not $Plans.Count) { Write-PraItem -Context $Context -Status Skip -Text 'Nothing to do.'; return $null } - foreach ($plan in $Plans) { if (-not $Context.Rows.Contains($plan.Row)) { $Context.Rows.Add($plan.Row) } } - try { - foreach ($plan in $Plans) { if (-not [bool](Get-PraValue $plan 'Previewed' $false)) { Write-PraAdDelta -Context $Context -Plan $plan -Stage Planned } } - if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -eq 'Check' -or $WhatIfPreference) { - foreach ($plan in $Plans) { - $plan.Row.FinalStatus = 'Planned'; $plan.Row.ADApplied = $false; $plan.Row.LastOperation = 'PreparedOnly' - Write-PraLog -Context $Context -Message "$($plan.Record.SamAccountName) | $($plan.Operation) | Planned | nothing written" -Level Detail - } - Write-PraItem -Context $Context -Status Skip -Text ("Preview: no backup and no AD change ({0} object(s) planned)." -f $Plans.Count) - return $null - } - if (-not $PSCmdlet.ShouldProcess("$($Plans.Count) object(s)", 'Apply a backed-up and verified AD batch')) { throw 'AD batch refused.' } - $receipt = Save-PraBatch $Context $Plans $Operation - foreach ($plan in $Plans) { - try { - $before = $plan.Record.Attributes; $groupState = $plan.Record.Licensing - Assert-PraCurrentState $Context $plan $before $groupState.WasMember - $replace = @{}; $clear = New-Object 'Collections.Generic.List[string]' - foreach ($name in $plan.Kinds.Keys) { - if (Test-PraStateEqual $before[$name] $plan.Desired[$name]) { continue } - if ($plan.Desired[$name].Present) { $replace[$name] = ConvertFrom-PraStoredValue $plan.Desired[$name] } else { $clear.Add($name) } - } - $changed = $replace.Count -gt 0 -or $clear.Count -gt 0 - if ($changed) { - $parameters = @{ Identity=[guid]$plan.Record.ObjectGuid; Server=$Context.Server; ErrorAction='Stop'; Confirm=$false } - if ($replace.Count) { $parameters.Replace = $replace }; if ($clear.Count) { $parameters.Clear = $clear.ToArray() } - Invoke-PraAdWrite $Context $receipt $plan 'Set-ADUser' { Set-ADUser @parameters } - Assert-PraCurrentState $Context $plan $plan.Desired $groupState.WasMember -AcceptNewVersion - Write-PraJournal $Context $plan.Record.ObjectGuid 'Set-ADUser' 'Verified' - } - if ($groupState.Enabled -and $groupState.WasMember -ne $groupState.DesiredMember) { - # Re-read before each new write: the group must not have changed. - Assert-PraCurrentState $Context $plan $plan.Desired $groupState.WasMember - $parameters = @{ Identity=[guid]$groupState.GroupGuid; Members=[guid]$plan.Record.ObjectGuid; Server=$Context.Server; ErrorAction='Stop'; Confirm=$false } - if ($groupState.DesiredMember) { Invoke-PraAdWrite $Context $receipt $plan 'Add-ADGroupMember' { Add-ADGroupMember @parameters }; $plan.Row.GroupAction = 'Added' } - else { Invoke-PraAdWrite $Context $receipt $plan 'Remove-ADGroupMember' { Remove-ADGroupMember @parameters }; $plan.Row.GroupAction = 'Removed' } - $changed = $true - } - else { $plan.Row.GroupAction = if ($groupState.Enabled) { 'Preserved' } else { 'N/A' } } - Assert-PraCurrentState $Context $plan $plan.Desired $groupState.DesiredMember - $plan.Row.ADVerified = $true; $plan.Row.ADApplied = $changed; $plan.Row.LastOperation = 'ADVerified' - $plan.Row.FinalStatus = if ($plan.Row.DeproPending) { 'Pending' } elseif ($changed) { 'Success' } else { 'AlreadyDone' } - Write-PraJournal $Context $plan.Record.ObjectGuid $plan.Operation 'Verified' - Write-PraLog -Context $Context -Message "AD VERIFIED | $($plan.Record.SamAccountName) | $($plan.Row.FinalStatus)" -Level Detail - Write-PraAdDelta -Context $Context -Plan $plan -Stage Verified - } - catch { - $plan.Row.FinalStatus = 'Error'; $plan.Row.ADVerified = $false - $plan.Row.Detail += " | FAILED: $($_.Exception.Message) | The object may be partly changed: see the journal and the backup." - try { Write-PraJournal $Context $plan.Record.ObjectGuid $plan.Row.LastOperation 'FailedOrIndeterminate' $_.Exception.Message } - catch { Write-PraLog -Context $Context -Message 'The journal cannot be written any more; the original backups are separate files.' -Level Error } - throw - } - } - $state = [ordered]@{ - SchemaVersion=2; Operation=$Operation; Kind='ADVerified'; Environment=$Context.Config.Environment; RunId=$Context.RunId - BackupFile=[IO.Path]::GetFileName($receipt.Path); BackupHash=$receipt.Hash; SourceBackupHash=$Context.SourceBackupHash - CreatedUtc=[DateTime]::UtcNow.ToString('o') - Records=@($Plans | ForEach-Object { [ordered]@{ ObjectGuid=$_.Record.ObjectGuid; Operation=$_.Operation; ADVerified=$true; VerifiedUsnChanged=$_.ExpectedUsnChanged } }) - } - $statePath = Join-Path (Split-Path $receipt.Path -Parent) ('State-' + $receipt.Data.BatchId + '.json') - Write-PraImmutableFile $statePath ($state | ConvertTo-Json -Depth 12) - Write-PraImmutableFile ($statePath + '.sha256') (Get-PraHash $statePath) - $Context.StateFiles.Add($statePath) - $receipt | Add-Member -NotePropertyName StatePath -NotePropertyValue $statePath - $Context.LastVerifiedReceipt = $receipt - return $receipt - } - catch { - $Context.OperationFailed = $true; $Context.LastVerifiedReceipt = $null - $failure = $_ - try { Write-PraLog -Context $Context -Message "AD batch stopped: $($failure.Exception.Message). No further write in this run." -Level Error } - catch { $Context.Issues.Add([pscustomobject]@{ Message=$failure.Exception.Message; Source='ADBatch' }) } - throw $failure - } - finally { Initialize-PraPermissionCache -Context $Context } -} - -function Import-PraProof { - <# - .SYNOPSIS - Reads and checks a State file (AD proof of a batch) against its backup and its Convert source. - .PARAMETER Source - Receipt of the original Convert backup. - .PARAMETER Operation - Convert, Recover, Finalize or Retention: operation expected in the proof. - #> - [CmdletBinding()] - param([hashtable]$Context, [string]$Path, $Source, [string]$Operation) - $data = Get-Content -LiteralPath $Path -Raw -Encoding UTF8 -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop - $hash = Get-PraHash $Path - if ((Get-Content -LiteralPath ($Path + '.sha256') -Raw -ErrorAction Stop).Trim() -cne $hash) { throw 'AD proof (State file): SHA-256 mismatch.' } - if ($data.SchemaVersion -ne 2 -or $data.Kind -ne 'ADVerified' -or $data.Environment -cne $Context.Config.Environment -or $data.Operation -cne $Operation) { throw "AD proof (State file) does not match: operation $($data.Operation) instead of $Operation, or another Environment." } - if ([IO.Path]::GetFileName($data.BackupFile) -cne $data.BackupFile) { throw 'AD proof: invalid backup path.' } - $receipt = Import-PraBackup $Context (Join-Path (Split-Path $Path -Parent) $data.BackupFile) - if ($receipt.Hash -cne $data.BackupHash -or $receipt.Data.Operation -cne $Operation -or $receipt.Data.RunId -cne $data.RunId -or $receipt.Data.SourceBackupHash -cne $data.SourceBackupHash) { throw 'AD proof does not match its backup, operation or source.' } - if (@($data.Records).Count -ne @($receipt.Data.Records).Count) { throw 'AD proof incomplete compared with its backup.' } - $expectedSource = if ($Operation -eq 'Convert') { $data.BackupHash } else { $data.SourceBackupHash } - if ($expectedSource -cne $Source.Hash) { throw 'AD proof built from another Convert batch.' } - $seen = @{} - foreach ($record in @($data.Records)) { - if ($record.ADVerified -isnot [bool] -or -not $record.ADVerified -or $record.ObjectGuid -notin @($Source.Data.Records.ObjectGuid) -or $seen.ContainsKey($record.ObjectGuid)) { throw 'AD proof: invalid or duplicated object.' } - $captured = @($receipt.Data.Records | Where-Object ObjectGuid -eq $record.ObjectGuid) - $allowed = switch ($Operation) { Convert { @('Convert') } Recover { @('Recover','Deprovision','AlreadyRecovered') } Finalize { @('Recover','RestoreTag','AlreadyRecovered') } Retention { @('RestoreTag') } default { @() } } - if ($captured.Count -ne 1 -or $record.Operation -notin $allowed -or $record.Operation -cne $captured[0].RequestedOperation -or - $record.VerifiedUsnChanged -isnot [string] -or $record.VerifiedUsnChanged -notmatch '^[1-9][0-9]*$') { throw 'AD proof: operation or version does not match the backup.' } - $null = [int64]::Parse($record.VerifiedUsnChanged, [Globalization.CultureInfo]::InvariantCulture) - $seen[$record.ObjectGuid] = $true - } - if (-not $seen.Count) { throw 'AD proof is empty.' } - return [pscustomobject]@{ Data=$data; Path=$Path; Hash=$hash; Receipt=$receipt } -} - -function Assert-PraFollowupState { - <# - .SYNOPSIS - Before the final restore (Finalize or inline): the object is still exactly as the AD proof left it. - uSNChanged is local to one domain controller: the DC of the proof must be used. - #> - [CmdletBinding()] - param([hashtable]$Context, $Plan, $Proof) - if ($Context.Server -ine $Proof.Receipt.Data.Server) { throw "Finalize: use the domain controller of the proof '$($Proof.Receipt.Data.Server)' (uSNChanged cannot be compared between DCs); set DomainController in the configuration." } - $verified = @($Proof.Data.Records | Where-Object ObjectGuid -eq $Plan.Record.ObjectGuid) - $captured = @($Proof.Receipt.Data.Records | Where-Object ObjectGuid -eq $Plan.Record.ObjectGuid) - if ($verified.Count -ne 1 -or $captured.Count -ne 1) { throw 'Finalize: object not in the AD proof.' } - $previous = $captured[0] - if ($previous.Licensing.Enabled) { - $group = Get-PraGroup $Context $previous.Licensing.GroupGuid - if ($group.DistinguishedName -cne $previous.Licensing.GroupDN -or - ([string]$Plan.User.DistinguishedName -in @($group.member)) -ne $previous.Licensing.DesiredMember) { throw 'Finalize: licence group membership differs from the AD proof.' } - } - # Already finished (replay): only the complete original state is accepted, it needs no write. - $original = $Plan.Row.BackupRec - $complete = $true - foreach ($name in $Plan.Kinds.Keys) { - $sourceState = Get-PraValue $original.Attributes $name $null - if ($null -eq $sourceState -or -not (Test-PraStateEqual $Plan.Record.Attributes[$name] $sourceState)) { $complete = $false } - } - if ($complete -and (-not $Plan.Record.Licensing.Enabled -or $Plan.Record.Licensing.WasMember -eq $Plan.Record.Licensing.DesiredMember)) { return } - if ((Get-PraUsn $Plan.User) -cne $verified[0].VerifiedUsnChanged -or $Plan.User.DistinguishedName -cne $previous.DistinguishedName) { - throw 'Finalize: the AD proof is out of date (version or DN changed). Nothing is overwritten: run the AD phase and the cloud check again.' - } - foreach ($name in $Plan.Kinds.Keys) { - $expected = Get-PraValue $previous.PlannedAttributes $name $null - if ($null -eq $expected -or -not (Test-PraStateEqual $Plan.Record.Attributes[$name] $expected)) { throw "Finalize: $name differs from the AD proof." } - } -} -#endregion - -#region 8. Entra Connect ----------------------------------------------------------------------- - -# Runs one synchronisation cycle and waits for its end. Self-contained: also sent to a remote server. -$script:PraSyncCycle = { - param([string]$PolicyType, [int]$TimeoutMinutes) - $ErrorActionPreference = 'Stop' - Import-Module ADSync -ErrorAction Stop - $deadline = [DateTime]::UtcNow.AddMinutes($TimeoutMinutes) - $clock = [Diagnostics.Stopwatch]::StartNew() - while ((Get-ADSyncScheduler -ErrorAction Stop).SyncCycleInProgress) { - if ([DateTime]::UtcNow -gt $deadline) { throw 'Timeout: a synchronisation cycle was already running.' } - Start-Sleep -Seconds 5 - } - $result = Start-ADSyncSyncCycle -PolicyType $PolicyType -ErrorAction Stop - if ([string]$result.Result -ne 'Success') { throw "Entra Connect refused the cycle: $($result.Result)" } - Start-Sleep -Seconds 10 - while ((Get-ADSyncScheduler -ErrorAction Stop).SyncCycleInProgress) { - if ([DateTime]::UtcNow -gt $deadline) { throw 'Timeout: the synchronisation cycle did not end in time; the cloud part is not started.' } - Start-Sleep -Seconds 5 - } - [pscustomobject]@{ Result = [string]$result.Result; Seconds = [int]$clock.Elapsed.TotalSeconds; Computer = $env:COMPUTERNAME } -} - -function Invoke-PraSync { - <# - .SYNOPSIS - After a verified AD batch (Apply): runs one Entra Connect cycle (EntraConnect.PolicyType) and - waits for its end, on this server (ADSync module) or on EntraConnect.Server (PowerShell remoting). - .DESCRIPTION - EntraConnect.Sync = $false: nothing is run; a warning reminds the operator to synchronise - before the cloud part. The sync is refused if the batch is not proven in this run. - #> - [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')] - param([hashtable]$Context) - if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -notin @('Convert','Recover','Finalize') -or $WhatIfPreference) { return } - $settings = $Context.Config.EntraConnect - if (-not $settings.Sync) { - Write-PraItem -Context $Context -Status Warn -Text 'EntraConnect.Sync = $false: run a delta synchronisation on the Entra Connect server now (Start-ADSyncSyncCycle -PolicyType Delta) or wait for the scheduled one.' - return - } - if (-not $PSCmdlet.ShouldProcess($(if ($settings.Server) { $settings.Server } else { $env:COMPUTERNAME }), 'Start an Entra Connect synchronisation cycle')) { return } - if (-not @($Context.Rows | Where-Object { (Get-PraValue $_ 'ADApplied' $null) -eq $true }).Count) { - Write-PraItem -Context $Context -Status Skip -Text 'No AD change in this run: no synchronisation needed.' - return - } - $receipt = Get-PraValue $Context 'LastVerifiedReceipt' $null - if ($null -eq $receipt -or $receipt.Data.RunId -cne $Context.RunId) { throw 'Synchronisation refused: no verified AD batch in this run.' } - if ([bool](Get-PraValue $Context 'OperationFailed' $false) -or $Context.Issues.Count -gt 0 -or @($Context.Rows | Where-Object FinalStatus -eq 'Error').Count -gt 0) { throw 'Synchronisation refused after an error in this run.' } - $source = if ($receipt.Data.Operation -eq 'Convert') { $receipt } else { Get-PraValue $Context 'Source' $null } - if ($null -eq $source) { throw 'Synchronisation refused: the Convert source of the batch is unknown.' } - $null = Import-PraProof $Context $receipt.StatePath $source $receipt.Data.Operation - if (-not $Context.JournalPath -or -not (Test-Path -LiteralPath $Context.JournalPath -PathType Leaf)) { throw 'Synchronisation refused: the batch journal is missing.' } - $target = if ($settings.Server) { $settings.Server } else { $env:COMPUTERNAME } - $Context.CurrentOperation = 'Start-ADSyncSyncCycle'; $Context.CurrentIdentity = $target - if (-not (& $Context.Approval $target 'Start-ADSyncSyncCycle')) { throw 'Synchronisation refused.' } - Write-PraJournal $Context '*' 'ADSync' 'Started' $target - Write-PraItem -Context $Context -Status Info -Icon Sync -Text ("{0} cycle started on {1}, waiting for its end (max {2} min)..." -f $settings.PolicyType, $target, $settings.TimeoutMinutes) - if ($settings.Server) { - $result = Invoke-Command -ComputerName $settings.Server -ScriptBlock $script:PraSyncCycle -ArgumentList $settings.PolicyType, $settings.TimeoutMinutes -ErrorAction Stop - } - else { $result = & $script:PraSyncCycle $settings.PolicyType $settings.TimeoutMinutes } - Write-PraJournal $Context '*' 'ADSync' 'Completed' $target - Write-PraItem -Context $Context -Status Ok -Icon Sync -Text ("Entra Connect cycle finished on {0} in {1} s (Exchange Online may still need a few minutes)" -f $target, (Get-PraValue $result 'Seconds' 0)) -} -#endregion - -Export-ModuleMember -Function ConvertTo-PraLdapValue, Get-PraHash, Write-PraImmutableFile, New-PraPrivateDirectory, Write-PraJournal, - Initialize-PraDirectory, Get-PraUser, Get-PraTarget, New-PraRow, New-PraPlan, Import-PraBackup, Invoke-PraAdPreview, Invoke-PraAdBatch, - Import-PraProof, Invoke-PraSync, Assert-PraReceipt, Test-PraStateEqual, Assert-PraFollowupState, Initialize-PraPermissionCache +#Requires -Version 5.1 +#Requires -PSEdition Desktop +<# +.SYNOPSIS + PRA Remote Mailbox - Active Directory engine: targets, plans, backups, AD writes, proofs, sync. + +.DESCRIPTION + Every AD read and write of the tool is in this module. Regions, in the order of an execution: + + 1. Receipts and files validated backups kept in memory, SHA-256, immutable files, journal + 2. Directory reads DC connection, users, groups, targets of the scope + 3. Attribute states typed values stored in the backups, comparison, display + 4. Shared permissions FullAccess / SendAs / SendOnBehalf read from AD, CSV or a group + 5. Plans New-PraPlan: what will change for one object (read only) + 6. Backups and proofs Save-PraBatch, Import-PraBackup, Import-PraProof + 7. Writes Invoke-PraAdPreview, Invoke-PraAdBatch (the only AD writes) + 8. Entra Connect Invoke-PraSync (local or remote delta cycle) + + Safety contract (unchanged since 1.3.0): + - every target is read and planned before the first write; + - a complete backup (typed JSON + data-only CLIXML + SHA-256) of the whole batch is written, + closed and re-read before the first write; + - before each write the current AD state is compared with the backup (uSNChanged, DN, values); + - the first error stops the batch: no next object, no sync, no cloud write, no automatic rollback; + - after the writes, a State file (AD proof) records what was verified; the cloud phase and + Finalize rely on it. + +.NOTES + Author : Nicolas Fabert + Version : 2.2.0 +#> +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' +# >>> PRA package integrity bootstrap: identical in every runtime PowerShell file (checked by the tests). +# It authenticates module\Test-PackageIntegrity.ps1 before running it; there is no unsigned or bypass path. +& { + param([Parameter(Mandatory)][string]$PackageRoot) + $verifier = [IO.Path]::GetFullPath([IO.Path]::Combine($PackageRoot, 'module', 'Test-PackageIntegrity.ps1')) + $cursor = $verifier + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + & $verifier -Root $PackageRoot +} ([IO.Path]::GetDirectoryName($PSScriptRoot)) +# <<< PRA package integrity bootstrap + +Import-Module (Join-Path $PSScriptRoot 'PRA.Backup.psm1') -ErrorAction Stop +# Validated receipts and permission caches are attached to the run context; they are released with it. +$script:ReceiptRegistries = New-Object 'Runtime.CompilerServices.ConditionalWeakTable[object,object]' +$script:PermissionCaches = New-Object 'Runtime.CompilerServices.ConditionalWeakTable[object,object]' +# Attributes managed by the tool and their stored type. The typed JSON is what Recover restores; +# the CLIXML keeps every value returned by AD (audit, manual recovery). +$script:AttributeKinds = [ordered]@{ + homeMDB='String'; homeMTA='String'; msExchHomeServerName='String'; msExchMailboxGuid='Bytes' + mDBUseDefaults='Bool'; msExchRecipientDisplayType='Int'; msExchRecipientTypeDetails='Long' + msExchRemoteRecipientType='Long'; targetAddress='String'; proxyAddresses='MultiString' +} +# Display names of msExchRecipientTypeDetails values (console only). +$script:RecipientTypeNames = @{ + '1'='UserMailbox'; '4'='SharedMailbox'; '16'='RoomMailbox'; '32'='EquipmentMailbox'; '128'='MailUser' + '2147483648'='RemoteUserMailbox'; '8589934592'='RemoteRoomMailbox'; '17179869184'='RemoteEquipmentMailbox'; '34359738368'='RemoteSharedMailbox' +} + +#region 1. Receipts and files ---------------------------------------------------------------- + +function Write-PraMemoryStage { + <# Log only: stage of a backup and private memory of the process (large batches). #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Stage, [string]$Identity = '', [string]$Detail = '') + $process = [Diagnostics.Process]::GetCurrentProcess() + try { $privateMiB = [math]::Round(($process.PrivateMemorySize64 / 1MB), 1) } finally { $process.Dispose() } + Write-PraLog -Context $Context -Message ("BACKUP/AD | $Stage | GUID=$Identity | $Detail | PrivateMiB=$privateMiB | Process64Bit=$([Environment]::Is64BitProcess)") -Level Debug +} + +function Get-PraReceiptRegistry { + <# Validated backups ("receipts") of this run. #> + [CmdletBinding()] + param([hashtable]$Context) + $registry = $null + if (-not $script:ReceiptRegistries.TryGetValue($Context, [ref]$registry)) { + $registry = New-Object 'Collections.Generic.List[object]' + $script:ReceiptRegistries.Add($Context, $registry) + } + return ,$registry +} + +function Write-PraDataFingerprint { + <# + .SYNOPSIS + Structural SHA-256 of closed JSON data (strings, numbers, arrays, dictionaries, note properties). + Used to detect a change of a validated backup in memory. Any other type is refused. + #> + [CmdletBinding()] + param([hashtable]$State, [AllowNull()]$Value, [int]$Depth = 0) + if ($Depth -gt 64) { throw 'Receipt data too deep or cyclic.' } + $State.Nodes++ + if ($State.Nodes -gt 10000000) { throw 'Receipt data too large.' } + $writer = $State.Writer + if ($null -eq $Value) { $writer.Write([byte]0); return } + if ($Value -is [string]) { + $writer.Write([byte]1); $writer.Write([int]$Value.Length) + for ($offset = 0; $offset -lt $Value.Length; $offset += 1024) { + $count = [math]::Min(1024, $Value.Length - $offset) + $Value.CopyTo($offset, $State.Characters, 0, $count) + [Buffer]::BlockCopy($State.Characters, 0, $State.Bytes, 0, ($count * 2)) + $writer.Write($State.Bytes, 0, ($count * 2)) + } + return + } + if ($Value -is [bool]) { $writer.Write([byte]2); $writer.Write([bool]$Value); return } + if ($Value -is [int]) { $writer.Write([byte]3); $writer.Write([int]$Value); return } + if ($Value -is [long]) { $writer.Write([byte]4); $writer.Write([long]$Value); return } + if ($Value -is [double]) { $writer.Write([byte]5); $writer.Write([double]$Value); return } + if ($Value -is [decimal]) { $writer.Write([byte]6); foreach ($bits in [decimal]::GetBits($Value)) { $writer.Write([int]$bits) }; return } + if ($Value -is [array]) { + if ($Value.Rank -ne 1) { throw 'Unsupported array in a receipt.' } + $writer.Write([byte]7); $writer.Write([int]$Value.Length) + foreach ($item in $Value) { + # Permission lists dominate large receipts. Keep the same wire bytes and limits + # without creating an advanced-function invocation for every individual string. + if ($item -is [string]) { + if ($Depth -ge 64) { throw 'Receipt data too deep or cyclic.' } + $State.Nodes++ + if ($State.Nodes -gt 10000000) { throw 'Receipt data too large.' } + $writer.Write([byte]1); $writer.Write([int]$item.Length) + for ($offset = 0; $offset -lt $item.Length; $offset += 1024) { + $count = [math]::Min(1024, $item.Length - $offset) + $item.CopyTo($offset, $State.Characters, 0, $count) + [Buffer]::BlockCopy($State.Characters, 0, $State.Bytes, 0, ($count * 2)) + $writer.Write($State.Bytes, 0, ($count * 2)) + } + } + else { Write-PraDataFingerprint -State $State -Value $item -Depth ($Depth + 1) } + } + return + } + if ($Value -is [hashtable] -or $Value -is [Collections.Specialized.OrderedDictionary]) { + $writer.Write([byte]8); $writer.Write([int]$Value.Count) + foreach ($entry in $Value.GetEnumerator()) { + if ($entry.Key -isnot [string]) { throw 'Non-text key in a receipt.' } + Write-PraDataFingerprint -State $State -Value $entry.Key -Depth ($Depth + 1) + Write-PraDataFingerprint -State $State -Value $entry.Value -Depth ($Depth + 1) + } + return + } + if ($Value.PSObject.BaseObject -is [Management.Automation.PSCustomObject]) { + $properties = @($Value.PSObject.Properties) + $writer.Write([byte]9); $writer.Write([int]$properties.Count) + foreach ($property in $properties) { + if ($property.MemberType -ne [Management.Automation.PSMemberTypes]::NoteProperty) { throw 'Executable property not allowed in a receipt.' } + Write-PraDataFingerprint -State $State -Value ([string]$property.Name) -Depth ($Depth + 1) + Write-PraDataFingerprint -State $State -Value $property.Value -Depth ($Depth + 1) + } + return + } + throw "Type not allowed in a receipt (data only): $($Value.GetType().FullName)" +} + +function Get-PraDataFingerprint { + [CmdletBinding()] + param([Parameter(Mandatory)]$Data) + $hash = [Security.Cryptography.SHA256]::Create() + $crypto = New-Object Security.Cryptography.CryptoStream([IO.Stream]::Null, $hash, [Security.Cryptography.CryptoStreamMode]::Write) + $writer = New-Object IO.BinaryWriter($crypto, (New-Object Text.UTF8Encoding($false)), $true) + try { + $state = @{ Writer=$writer; Characters=(New-Object char[] 1024); Bytes=(New-Object byte[] 2048); Nodes=0L } + Write-PraDataFingerprint -State $state -Value $Data + $writer.Flush(); $crypto.FlushFinalBlock() + return ([BitConverter]::ToString($hash.Hash)).Replace('-', '').ToLowerInvariant() + } + finally { $writer.Dispose(); $crypto.Dispose(); $hash.Dispose() } +} + +function Add-PraValidatedReceipt { + <# Remembers a backup validated in this run, with its hashes and a fingerprint of its content. #> + [CmdletBinding()] + param([hashtable]$Context, $Receipt, [string]$RawPath = '', [string]$RawHash = '') + $guids = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + foreach ($record in $Receipt.Data.Records) { [void]$guids.Add([string]$record.ObjectGuid) } + $entry = [pscustomobject]@{ + Receipt=$Receipt; Data=$Receipt.Data; Path=[string]$Receipt.Path; Hash=[string]$Receipt.Hash + RawPath=$RawPath; RawHash=$RawHash; Environment=[string]$Receipt.Data.Environment + SchemaVersion=[int](Get-PraValue $Receipt.Data 'SchemaVersion' 1); RawFormat=[string](Get-PraValue $Receipt.Data 'RawFormat' '') + Operation=[string]$Receipt.Data.Operation; Legacy=[bool]$Receipt.Legacy; Guids=$guids + DataFingerprint=(Get-PraDataFingerprint -Data $Receipt.Data) + } + $registry = Get-PraReceiptRegistry -Context $Context + $registry.Add($entry) +} + +function Get-PraReceiptEntry { + [CmdletBinding()] + param([hashtable]$Context, $Receipt) + $registry = Get-PraReceiptRegistry -Context $Context + foreach ($entry in $registry) { if ([object]::ReferenceEquals($entry.Receipt, $Receipt)) { return $entry } } + throw 'Backup not validated in this run: a complete validation is required.' +} + +function Assert-PraReceiptIntegrity { + <# The backup is unchanged in memory and on disk (JSON, .sha256, CLIXML) since its validation. #> + [CmdletBinding()] + param([hashtable]$Context, $Entry) + $receipt = $Entry.Receipt + if ($Entry.Environment -cne $Context.Config.Environment -or $receipt.Path -cne $Entry.Path -or + $receipt.Data.Environment -cne $Entry.Environment -or $receipt.Data.Operation -cne $Entry.Operation -or + [int](Get-PraValue $receipt.Data 'SchemaVersion' 1) -ne $Entry.SchemaVersion -or + [string](Get-PraValue $receipt.Data 'RawFormat' '') -cne $Entry.RawFormat -or + $receipt.Legacy -isnot [bool] -or $receipt.Legacy -ne $Entry.Legacy -or + $receipt.Hash -cne $Entry.Hash -or -not [object]::ReferenceEquals($receipt.Data, $Entry.Data)) { + throw 'Backup receipt changed, or it belongs to another context.' + } + if ((Get-PraDataFingerprint -Data $receipt.Data) -cne $Entry.DataFingerprint) { throw 'Backup content changed in memory since its validation.' } + if ((Get-PraHash -Path $Entry.Path) -cne $Entry.Hash) { throw 'Backup JSON file changed since its validation.' } + if ($Entry.SchemaVersion -ge 2) { + $sidecar = (Get-Content -LiteralPath ($Entry.Path + '.sha256') -Raw -ErrorAction Stop).Trim() + if ($sidecar -cne $Entry.Hash) { throw 'Backup .sha256 file changed since its validation.' } + if ($receipt.Data.RawHash -cne $Entry.RawHash -or + [IO.Path]::GetFileName($Entry.RawPath) -cne $receipt.Data.RawFile -or + (Get-PraHash -Path $Entry.RawPath) -cne $Entry.RawHash) { throw 'Backup CLIXML file changed since its validation.' } + } +} + +function ConvertTo-PraLdapValue { + <# + .SYNOPSIS + Escapes a value for an LDAP filter (RFC 4515). + #> + [CmdletBinding()] + param([Parameter(Mandatory)][AllowEmptyString()][string]$Value) + $Value.Replace('\', '\5c').Replace('*', '\2a').Replace('(', '\28').Replace(')', '\29').Replace([string][char]0, '\00') +} + +function Get-PraHash { + <# + .SYNOPSIS + SHA-256 of a file, lower case. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$Path) + $hash = [Security.Cryptography.SHA256]::Create() + $stream = [IO.File]::OpenRead($Path) + try { return ([BitConverter]::ToString($hash.ComputeHash($stream))).Replace('-', '').ToLowerInvariant() } + finally { $stream.Dispose(); $hash.Dispose() } +} + +function Write-PraImmutableFile { + <# + .SYNOPSIS + Creates a new file (never overwrites), writes it, flushes it to disk and closes it. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][string]$Path, [Parameter(Mandatory)][AllowEmptyString()][string]$Text) + $stream = New-Object IO.FileStream($Path, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None) + $writer = $null + try { + $writer = New-Object IO.StreamWriter($stream, (New-Object Text.UTF8Encoding($false)), 16384, $true) + $writer.Write($Text); $writer.Flush(); $stream.Flush($true) + } + finally { if ($null -ne $writer) { $writer.Dispose() }; $stream.Dispose() } +} + +function New-PraPrivateDirectory { + <# + .SYNOPSIS + Creates a backup folder readable only by the current account, SYSTEM and Administrators + (no inherited permission). The folder must not exist. + #> + [CmdletBinding(SupportsShouldProcess = $true)] + param([Parameter(Mandatory)][string]$Path) + if (-not $PSCmdlet.ShouldProcess($Path, 'Create a private backup folder')) { throw 'Backup folder creation refused.' } + if (Test-Path -LiteralPath $Path) { throw "Backup folder already exists: $Path" } + $identity = [Security.Principal.WindowsIdentity]::GetCurrent().User + $acl = New-Object Security.AccessControl.DirectorySecurity + $acl.SetAccessRuleProtection($true, $false) + $acl.SetOwner($identity) + foreach ($sid in @($identity.Value, 'S-1-5-18', 'S-1-5-32-544') | Select-Object -Unique) { + $rule = New-Object Security.AccessControl.FileSystemAccessRule( + (New-Object Security.Principal.SecurityIdentifier($sid)), + [Security.AccessControl.FileSystemRights]::FullControl, + ([Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'), + [Security.AccessControl.PropagationFlags]::None, [Security.AccessControl.AccessControlType]::Allow) + [void]$acl.AddAccessRule($rule) + } + # The folder is created with its restrictive ACL: no moment where files inherit broader rights. + [void][IO.Directory]::CreateDirectory($Path, $acl) + $actual = [IO.Directory]::GetAccessControl($Path) + if (-not $actual.AreAccessRulesProtected) { throw "Backup folder ACL is not protected: $Path" } +} + +function Write-PraJournal { + <# + .SYNOPSIS + Appends one JSON line to the journal of the batch (Started / Applied / Verified / Failed). + #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Target, [string]$Operation, [string]$Status, [string]$Detail = '') + if (-not $Context.JournalPath) { throw 'The batch journal is not open: no write is allowed.' } + $entry = [ordered]@{ RunId=$Context.RunId; Utc=[DateTime]::UtcNow.ToString('o'); Target=$Target; Operation=$Operation; Status=$Status; Detail=$Detail } + $bytes = (New-Object Text.UTF8Encoding($false)).GetBytes(($entry | ConvertTo-Json -Depth 8 -Compress) + "`r`n") + $stream = New-Object IO.FileStream($Context.JournalPath, [IO.FileMode]::Append, [IO.FileAccess]::Write, [IO.FileShare]::Read) + try { $stream.Write($bytes, 0, $bytes.Length); $stream.Flush($true) } + finally { $stream.Dispose() } +} +#endregion + +#region 2. Directory reads -------------------------------------------------------------------- + +function Invoke-PraRead { + <# Runs one AD read, logs it (debug) and logs any failure with its details. #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Operation, [string]$Identity, [scriptblock]$Read) + $Context.CurrentOperation = $Operation; $Context.CurrentIdentity = $Identity + Write-PraLog -Context $Context -Message "AD BEGIN | $Operation | DC=$($Context.Server) | Identity=$Identity" -Level Debug + $clock = [Diagnostics.Stopwatch]::StartNew() + try { + $result = @(& $Read) + Write-PraLog -Context $Context -Message "AD END | $Operation | results=$($result.Count) | duration=$($clock.ElapsedMilliseconds)ms" -Level Debug + return $result + } + catch { + Write-PraLog -Context $Context -Message "AD read failed | $Operation | DC=$($Context.Server) | Identity=$Identity | $($_.Exception.GetType().FullName) | $($_.Exception.Message) | ErrorId=$($_.FullyQualifiedErrorId) | Category=$($_.CategoryInfo.Category)" -Level Error + Write-PraLog -Context $Context -Message "$($_.InvocationInfo.PositionMessage)`n$($_.ScriptStackTrace)" -Level Debug + throw + } +} + +function Initialize-PraDirectory { + <# + .SYNOPSIS + Loads the ActiveDirectory module and fixes ONE writable domain controller for the whole run + (DomainController in the configuration, or discovered). Optionally checks Scope.SearchBase. + #> + [CmdletBinding()] + param([hashtable]$Context, [switch]$ValidateScope) + Initialize-PraPermissionCache -Context $Context + if (-not [Environment]::Is64BitProcess) { Write-PraLog -Context $Context -Message '32-bit PowerShell: less memory for large batches. Use the 64-bit Windows PowerShell 5.1.' -Level Warning } + # No AD: drive (it would connect to a default domain controller, not the one of the run). + $env:ADPS_LoadDefaultDrive = 0 + Import-Module ActiveDirectory -ErrorAction Stop -Verbose:$false -WarningAction SilentlyContinue + if ([string]::IsNullOrWhiteSpace($Context.Server)) { + $dc = Get-ADDomainController -Discover -Writable -ErrorAction Stop + $names = @($dc.HostName | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) }) + if ($names.Count -ne 1) { throw 'Domain controller discovery: no name or several names returned.' } + $Context.Server = [string]$names[0] + } + $server = $Context.Server + $dc = @(Invoke-PraRead $Context 'Get-ADDomainController' $server { Get-ADDomainController -Identity $server -Server $server -ErrorAction Stop }) + if ($dc.Count -ne 1 -or (Get-PraValue $dc[0] 'IsReadOnly' $true)) { throw "Writable domain controller not confirmed: $server" } + $root = @(Invoke-PraRead $Context 'Get-ADRootDSE' $server { Get-ADRootDSE -Server $server -ErrorAction Stop }) + if ($root.Count -ne 1 -or -not (Get-PraValue $root[0] 'defaultNamingContext' '')) { throw 'AD domain partition not found.' } + $Context.NamingContext = [string]$root[0].defaultNamingContext + Write-PraItem -Context $Context -Status Ok -Icon Directory -Text ("{0} {1} {2} {1} account {3}" -f $server, [char]0x00B7, $Context.NamingContext, [Security.Principal.WindowsIdentity]::GetCurrent().Name) + if ($ValidateScope -and $Context.Config.Scope.SearchBase) { + $base = [string]$Context.Config.Scope.SearchBase + Assert-PraDomain $Context $base + $null = Invoke-PraRead $Context 'Get-ADObject/SearchBase' $base { Get-ADObject -Identity $base -Server $server -ErrorAction Stop } + } +} + +function Assert-PraDomain { + <# The object belongs to the domain of the fixed domain controller (no implicit DC change). #> + [CmdletBinding()] + param([hashtable]$Context, [string]$DistinguishedName) + if (-not ($DistinguishedName.EndsWith(',' + $Context.NamingContext, [StringComparison]::OrdinalIgnoreCase) -or + $DistinguishedName.Equals($Context.NamingContext, [StringComparison]::OrdinalIgnoreCase))) { + throw "Object outside the domain of the domain controller: '$DistinguishedName' (domain '$($Context.NamingContext)'). The domain controller is never changed implicitly." + } +} + +function Get-PraUser { + <# + .SYNOPSIS + Reads one user by UPN (exact LDAP filter), sAMAccountName, DN or GUID. Exactly one result is required. + .PARAMETER Capture + Also reads every attribute ('*') and the security descriptors (backup). + #> + [CmdletBinding()] + param([hashtable]$Context, [Parameter(Mandatory)][string]$Identity, [string[]]$ExtraProperties = @(), [switch]$Capture) + $properties = @('memberOf','uSNChanged','DisplayName','mail','mailNickname','msExchArchiveGUID') + @($script:AttributeKinds.Keys) + $ExtraProperties + if ($Capture) { $properties += @('*','msExchMailboxSecurityDescriptor','nTSecurityDescriptor','publicDelegates') } + $properties = @($properties | Select-Object -Unique) + $server = $Context.Server + if ($Identity -match '@' -and $Identity -notmatch '^(CN|OU|DC)=') { + # -Identity does not search the UPN: use an exact, escaped LDAP filter. + $filter = '(userPrincipalName=' + (ConvertTo-PraLdapValue $Identity) + ')' + $users = @(Invoke-PraRead $Context 'Get-ADUser/UPN' $Identity { Get-ADUser -LDAPFilter $filter -Properties $properties -Server $server -ErrorAction Stop }) + } + else { $users = @(Invoke-PraRead $Context 'Get-ADUser/Identity' $Identity { Get-ADUser -Identity $Identity -Properties $properties -Server $server -ErrorAction Stop }) } + if ($users.Count -ne 1) { throw "AD object '$Identity' not found or not unique: $($users.Count) result(s) on $server." } + $user = $users[0] + $guid = [guid](Get-PraValue $user 'ObjectGUID' ([guid]::Empty)) + if ($guid -eq [guid]::Empty) { throw "AD object without GUID: $Identity" } + Assert-PraDomain $Context ([string]$user.DistinguishedName) + Write-PraLog -Context $Context -Message "AD RESOLVED | GUID=$guid | DN=$($user.DistinguishedName) | UPN=$($user.UserPrincipalName)" -Level Debug + return $user +} + +function Get-PraUsn { + <# uSNChanged of an object (version of the object on its domain controller). #> + [CmdletBinding()] + param($User) + $value = Get-PraValue $User 'uSNChanged' $null + if ($null -eq $value -or [string]$value -notmatch '^[0-9]+$' -or [int64]$value -le 0) { throw 'uSNChanged missing or invalid: the AD version of the object cannot be proven.' } + return ([int64]$value).ToString([Globalization.CultureInfo]::InvariantCulture) +} + +function Get-PraGroup { + [CmdletBinding()] + param([hashtable]$Context, [Parameter(Mandatory)][string]$Identity, [switch]$WithoutMembers) + $server = $Context.Server + $parameters = @{ Identity=$Identity; Server=$server; ErrorAction='Stop' } + if (-not $WithoutMembers) { $parameters.Properties = @('member') } + $groups = @(Invoke-PraRead $Context 'Get-ADGroup' $Identity { Get-ADGroup @parameters }) + if ($groups.Count -ne 1) { throw "Group not found or not unique: $Identity" } + Assert-PraDomain $Context ([string]$groups[0].DistinguishedName) + if ([guid]$groups[0].ObjectGUID -eq [guid]::Empty) { throw "Group without GUID: $Identity" } + return $groups[0] +} + +function Get-PraTarget { + <# + .SYNOPSIS + Objects to convert: -Identity, or the configured scope (Auto/OU, Group, Csv), filtered by + mailbox type, exclusions and -MaxObjects. Sorted by sAMAccountName. + .DESCRIPTION + Only on-premises mailboxes are eligible (homeMDB set, msExchRecipientTypeDetails 1, 4, 16 or 32). + System mailboxes (HealthMailbox*, SystemMailbox*, "Microsoft Exchange*") are always excluded. + An explicit target (Identity or CSV line) that is not eligible stops the run. + #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Identity, [string]$MailboxScope = 'All', [int]$MaxObjects = 0) + $scope = $Context.Config.Scope; $server = $Context.Server + $types = @(1) + if ($Identity) { $types = @(1, 4, 16, 32) } + elseif ($MailboxScope -eq 'UsersOnly') { $types = @(1) } + elseif ($MailboxScope -eq 'SharedOnly') { $types = @(4) } + else { + if ($scope.IncludeShared) { $types += 4 } + if ($scope.IncludeRoom) { $types += 16 } + if ($scope.IncludeEquip) { $types += 32 } + } + $users = New-Object 'Collections.Generic.List[object]' + $explicit = $false + if ($Identity) { $explicit = $true; $users.Add((Get-PraUser $Context $Identity)) } + elseif ($scope.Mode -eq 'Csv') { + $explicit = $true + $entries = @(Read-PraTargetCsv -Path $scope.CsvPath) + foreach ($entry in $entries) { + $id = [string](Get-PraValue $entry 'Identity' '') + if ([string]::IsNullOrWhiteSpace($id)) { throw 'A line of the target CSV file has no Identity: batch refused.' } + $users.Add((Get-PraUser $Context $id.Trim())) + } + } + elseif ($scope.Mode -eq 'Group') { + $group = Get-PraGroup $Context $scope.GroupDN + $members = @(Invoke-PraRead $Context 'Get-ADGroupMember/Scope' $group.DistinguishedName { + Get-ADGroupMember -Identity $group.ObjectGUID -Recursive -Server $server -ErrorAction Stop }) + foreach ($member in $members | Where-Object objectClass -eq 'user') { $users.Add((Get-PraUser $Context ([string]$member.DistinguishedName))) } + } + else { + $filter = '(&(homeMDB=*)(|' + (($types | ForEach-Object { "(msExchRecipientTypeDetails=$_)" }) -join '') + '))' + $parameters = @{ LDAPFilter=$filter; Properties=@('homeMDB','msExchRecipientTypeDetails','DisplayName'); Server=$server; ErrorAction='Stop' } + if ($scope.SearchBase) { $parameters.SearchBase = $scope.SearchBase } + foreach ($user in @(Invoke-PraRead $Context 'Get-ADUser/Scope' ([string]$scope.SearchBase) { Get-ADUser @parameters })) { $users.Add($user) } + } + $seen = @{}; $selected = New-Object 'Collections.Generic.List[object]' + foreach ($user in $users) { + $id = ([guid]$user.ObjectGUID).ToString() + if ($seen.ContainsKey($id)) { throw "The same object is listed twice (GUID $id). Fix the scope first." } + $seen[$id] = $true + $eligible = (Get-PraValue $user 'homeMDB' '') -and ((Get-PraValue $user 'msExchRecipientTypeDetails' 0) -in $types) + $excluded = $user.SamAccountName -like 'HealthMailbox*' -or $user.SamAccountName -like 'SystemMailbox*' -or + (Get-PraValue $user 'DisplayName' '') -like 'Microsoft Exchange*' -or $user.SamAccountName -in $scope.ExcludeSamAccountNames + if (-not $eligible -or $excluded) { + if ($explicit) { throw "Explicit target not eligible (not an on-premises mailbox of an accepted type) or excluded: $($user.SamAccountName). Nothing converted." } + continue + } + $selected.Add($user) + } + $ordered = @($selected | Sort-Object SamAccountName, ObjectGUID) + if ($MaxObjects -gt 0) { $ordered = @($ordered | Select-Object -First $MaxObjects) } + return $ordered +} +#endregion + +#region 3. Attribute states ------------------------------------------------------------------- + +function Get-PraAttributeState { + <# + .SYNOPSIS + Typed state of the managed attributes: @{ Present; Kind; Value } per attribute. + A property that was not read is an error (never taken as "absent"). + #> + [CmdletBinding()] + param($User, [Collections.IDictionary]$Kinds) + $states = [ordered]@{} + foreach ($name in $Kinds.Keys) { + if ($null -eq $User.PSObject.Properties[$name]) { throw "AD attribute not read: $name (GUID $($User.ObjectGUID))." } + $raw = $User.$name; $present = $null -ne $raw; $value = $null + if ($present -and $raw -is [string] -and $raw.Length -eq 0) { $present = $false } + if ($present -and $raw -is [Collections.ICollection] -and $raw.Count -eq 0) { $present = $false } + if ($present) { + switch ($Kinds[$name]) { + String { $value = [string]$raw } + MultiString { $value = [string[]]@($raw | Sort-Object -CaseSensitive) } + Bytes { $value = [Convert]::ToBase64String([byte[]]$raw) } + Bool { $value = [bool]$raw } + Int { $value = ([int]$raw).ToString([Globalization.CultureInfo]::InvariantCulture) } + Long { $value = ([int64]$raw).ToString([Globalization.CultureInfo]::InvariantCulture) } + } + } + $states[$name] = [ordered]@{ Present=[bool]$present; Kind=[string]$Kinds[$name]; Value=$value } + } + return $states +} + +function ConvertFrom-PraStoredValue { + <# Value to write with Set-ADUser -Replace, from a stored typed state. #> + [CmdletBinding()] + param($State) + if (-not $State.Present) { return $null } + switch ($State.Kind) { + String { return [string]$State.Value } + MultiString { return ,([string[]]@($State.Value)) } + Bytes { return ,([Convert]::FromBase64String([string]$State.Value)) } + Bool { return [bool]$State.Value } + Int { return [int]::Parse([string]$State.Value, [Globalization.CultureInfo]::InvariantCulture) } + Long { return [int64]::Parse([string]$State.Value, [Globalization.CultureInfo]::InvariantCulture) } + default { throw "Unknown stored type: $($State.Kind)" } + } +} + +function Test-PraStateEqual { + <# + .SYNOPSIS + Two typed states are equal (case-sensitive; multi-valued attributes compared as sorted sets). + #> + [CmdletBinding()] + param($Left, $Right) + if ([bool]$Left.Present -ne [bool]$Right.Present -or $Left.Kind -ne $Right.Kind) { return $false } + if (-not $Left.Present) { return $true } + if ($Left.Kind -eq 'MultiString') { + $a = @($Left.Value | Sort-Object -CaseSensitive); $b = @($Right.Value | Sort-Object -CaseSensitive) + if ($a.Count -ne $b.Count) { return $false } + for ($i = 0; $i -lt $a.Count; $i++) { if ([string]$a[$i] -cne [string]$b[$i]) { return $false } } + return $true + } + return ([string]$Left.Value -ceq [string]$Right.Value) +} + +function ConvertTo-PraLogText { + <# Escapes control characters, quotes and backslashes of an AD value (the value is never cut). #> + [CmdletBinding()] + param([AllowEmptyString()][string]$Value) + return [regex]::Replace($Value, '[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\\"]', [Text.RegularExpressions.MatchEvaluator]{ + param($match) + switch ($match.Value) { + "`r" { '\r'; break } + "`n" { '\n'; break } + "`t" { '\t'; break } + '\' { '\\'; break } + '"' { '\"'; break } + default { '\u{0:x4}' -f [int][char]$match.Value[0] } + } + }) +} + +function Format-PraAttributeValue { + <# + .SYNOPSIS + Full, readable value(s) of a typed state for the log: , false and 0 stay distinct; + a multi-valued attribute returns one line per value. + #> + [CmdletBinding()] + param([Parameter(Mandatory)]$State) + if ($State.Present -isnot [bool]) { throw 'Display: presence of the attribute not captured.' } + if (-not $State.Present) { return '' } + switch ($State.Kind) { + String { return ('"' + (ConvertTo-PraLogText -Value ([string]$State.Value)) + '"') } + Bool { if ($State.Value) { return 'true' } else { return 'false' } } + Int { return [string]$State.Value } + Long { return [string]$State.Value } + MultiString { + $values = @($State.Value) + if (-not $values.Count) { return '[] (0 values)' } + for ($index = 0; $index -lt $values.Count; $index++) { + '[{0}/{1}] "{2}"' -f ($index + 1), $values.Count, (ConvertTo-PraLogText -Value ([string]$values[$index])) + } + return + } + Bytes { + $bytes = [Convert]::FromBase64String([string]$State.Value) + $base64 = [Convert]::ToBase64String($bytes) + if ($bytes.Length -eq 16) { return ('GUID={0} ; Base64={1} (16 bytes)' -f ([guid]::new($bytes)).ToString(), $base64) } + return ('Base64={0} ({1} bytes)' -f $base64, $bytes.Length) + } + default { throw "Display: unknown type '$($State.Kind)'." } + } +} + +function Format-PraShortValue { + <# Short value for the console: DN reduced to its first part, GUID for 16-byte values, (none) for absent. #> + param([Parameter(Mandatory)]$State) + if (-not $State.Present) { return '(none)' } + switch ($State.Kind) { + Bool { if ($State.Value) { return 'true' } else { return 'false' } } + Bytes { + $bytes = [Convert]::FromBase64String([string]$State.Value) + if ($bytes.Length -eq 16) { return ([guid]::new($bytes)).ToString() } + return ('{0} bytes' -f $bytes.Length) + } + MultiString { return ('{0} value(s)' -f @($State.Value).Count) } + default { + $text = ConvertTo-PraLogText -Value ([string]$State.Value) + if ($text -match '^(CN|OU)=[^,]+,.+,DC=') { $text = ($text -split ',')[0] + ',...' } + if ($text.StartsWith('/o=')) { $text = '...' + $text.Substring($text.LastIndexOf('/')) } + return $text + } + } +} + +function Write-PraAdDelta { + <# + .SYNOPSIS + Shows what changes for one object: BEFORE / PLANNED, or VERIFIED after a successful AD re-read. + .DESCRIPTION + Console: one header line per object, then only the attributes that change (green = added, + yellow = changed, red = removed) and the licence group. Log: every managed attribute with all + its values BEFORE and PLANNED (or VERIFIED). Colours describe changes, not errors. + VERIFIED is refused unless the object was really verified in Apply mode. + #> + [CmdletBinding()] + param([Parameter(Mandatory)][hashtable]$Context, [Parameter(Mandatory)]$Plan, [ValidateSet('Planned','Verified')][string]$Stage = 'Planned') + if ($Stage -eq 'Verified' -and ($Context.Mode -ne 'Apply' -or -not $Context.AllowMutation -or + $Context.Action -eq 'Check' -or $WhatIfPreference -or $Plan.Row.ADVerified -ne $true)) { + throw 'VERIFIED display refused: no successful AD verification in Apply mode.' + } + $afterLabel = if ($Stage -eq 'Verified') { 'VERIFIED' } else { 'PLANNED' } + $heading = if ($Stage -eq 'Verified') { 'AD VERIFIED' } else { 'AD PLAN - planned values, not applied' } + $record = $Plan.Record + Write-PraLog -Context $Context -Message ("$heading | $(ConvertTo-PraLogText -Value $record.SamAccountName) | $($Plan.Operation) | Mode=$($Context.Mode) | GUID=$($record.ObjectGuid)") -Level Detail + $palette = @{ ADD='Green'; CHANGE='Yellow'; REMOVE='Red'; UNCHANGED='DarkGray' } + $consoleLines = New-Object 'Collections.Generic.List[object]' + $unchanged = 0 + foreach ($name in $Plan.Kinds.Keys) { + $before = $record.Attributes[$name]; $after = $Plan.Desired[$name] + $change = if (Test-PraStateEqual -Left $before -Right $after) { 'UNCHANGED' } elseif (-not $before.Present) { 'ADD' } elseif (-not $after.Present) { 'REMOVE' } else { 'CHANGE' } + Write-PraLog -Context $Context -Message "ATTRIBUTE | $name | $change | Type=$($Plan.Kinds[$name])" -Level Detail + foreach ($value in @(Format-PraAttributeValue -State $before)) { Write-PraLog -Context $Context -Message " $name | BEFORE : $value" -Level Detail } + foreach ($value in @(Format-PraAttributeValue -State $after)) { Write-PraLog -Context $Context -Message " $name | $afterLabel : $value" -Level Detail } + if ($change -eq 'UNCHANGED') { $unchanged++; continue } + if ($Plan.Kinds[$name] -eq 'MultiString' -and $before.Present -and $after.Present) { + $old = @($before.Value); $new = @($after.Value) + foreach ($value in $new | Where-Object { $_ -cnotin $old }) { $consoleLines.Add(@($name, ('+ ' + (ConvertTo-PraLogText -Value $value)), 'Green')) } + foreach ($value in $old | Where-Object { $_ -cnotin $new }) { $consoleLines.Add(@($name, ('- ' + (ConvertTo-PraLogText -Value $value)), 'Red')) } + } + else { $consoleLines.Add(@($name, ('{0} {1} {2}' -f (Format-PraShortValue $before), [char]0x2192, (Format-PraShortValue $after)), $palette[$change])) } + } + $group = $record.Licensing + if ($group.Enabled) { + $change = if ($group.WasMember -eq $group.DesiredMember) { 'UNCHANGED' } elseif ($group.DesiredMember) { 'ADD' } else { 'REMOVE' } + $beforeText = if ($group.WasMember) { 'Member' } else { 'Not member' } + $afterText = if ($group.DesiredMember) { 'Member' } else { 'Not member' } + Write-PraLog -Context $Context -Message "LICENCE GROUP | $(ConvertTo-PraLogText -Value $group.GroupDN) | $change" -Level Detail + Write-PraLog -Context $Context -Message " Licence group | BEFORE : $beforeText" -Level Detail + Write-PraLog -Context $Context -Message " Licence group | $afterLabel : $afterText" -Level Detail + if ($change -ne 'UNCHANGED') { + $groupName = (($group.GroupDN -split ',')[0] -replace '^CN=', '') + $consoleLines.Add(@(('licence group ' + $groupName), ('{0} {1} {2}' -f $beforeText.ToLowerInvariant(), [char]0x2192, $afterText.ToLowerInvariant()), $palette[$change])) + } + } + else { Write-PraLog -Context $Context -Message 'LICENCE GROUP | not managed for this operation' -Level Detail } + $shared = $record.SharedPermissions + $permissionText = '' + if ($record.IsShared -and $Plan.Operation -eq 'Convert') { + $permissionText = ' {0} {1} FullAccess {0} {2} SendAs {0} {3} SendOnBehalf' -f [char]0x00B7, @($shared.FullAccess).Count, @($shared.SendAs).Count, @($shared.SendOnBehalf).Count + } + + # Console. + $beforeType = [string]$record.Attributes['msExchRecipientTypeDetails'].Value + $afterType = [string]$Plan.Desired['msExchRecipientTypeDetails'].Value + $typeText = if ($script:RecipientTypeNames.ContainsKey($beforeType)) { $script:RecipientTypeNames[$beforeType] } else { $beforeType } + if ($afterType -ne $beforeType) { $typeText += (' {0} ' -f [char]0x2192) + $(if ($script:RecipientTypeNames.ContainsKey($afterType)) { $script:RecipientTypeNames[$afterType] } else { $afterType }) } + if ($Stage -eq 'Verified') { + $groupAction = [string](Get-PraValue $Plan.Row 'GroupAction' '') + $statusText = switch ([string]$Plan.Row.FinalStatus) { 'Pending' { 'next: Exchange Online deprovisioning check' } 'AlreadyDone' { 'already in the expected state' } default { 'done' } } + $text = '{0} {1} {2} AD verified, {3} attribute(s) changed{4} {2} {5}' -f $record.SamAccountName, $typeText, [char]0x00B7, ($Plan.Kinds.Count - $unchanged), $(if ($groupAction -in @('Added','Removed')) { ', licence group ' + $groupAction.ToLowerInvariant() } else { '' }), $statusText + Write-PraItem -Context $Context -Status Ok -Text $text + return + } + $operationText = switch ($Plan.Operation) { 'Deprovision' { 'deprovision in Exchange Online first' } 'AlreadyRecovered' { 'already restored' } 'RestoreTag' { 'restore the retention tag' } default { $Plan.Operation.ToLowerInvariant() } } + Write-Host '' + Write-PraHost @(@(' '), @(($record.SamAccountName + ' '), 'White'), @(([string]$record.UserPrincipalName + ' '), 'DarkGray'), @($typeText, 'Cyan'), @((' ' + [char]0x00B7 + ' ' + $operationText + $permissionText), 'DarkGray')) + foreach ($line in $consoleLines) { Write-PraHost @(' ', ('{0,-28} ' -f $line[0]), $line[1]) -Color $line[2] } + if (-not $consoleLines.Count) { Write-PraHost @(@(' '), @('no change: the object is already in the expected state', 'DarkGray')) } + elseif ($unchanged) { Write-PraHost @(@(' '), @(('{0} other managed attribute(s) unchanged (full values in the log)' -f $unchanged), 'DarkGray')) } + if ($permissionText) { + # Who will get access in Exchange Online: a few names on screen, the complete list in the log. + foreach ($right in @('FullAccess', 'SendAs', 'SendOnBehalf')) { + $value = Get-PraValue $shared $right @() + $holders = @(@($value) | Where-Object { $_ }) + Write-PraLog -Context $Context -Message ("PERMISSIONS | {0} | {1} ({2}) | {3}" -f $record.SamAccountName, $right, $holders.Count, $(if ($holders.Count) { $holders -join ', ' } else { '(none)' })) -Level Detail + if (-not $holders.Count) { continue } + $names = @($holders | Select-Object -First 3) -join ', ' + if ($holders.Count -gt 3) { $names += (' + {0} more (full list in the log)' -f ($holders.Count - 3)) } + Write-PraHost @(' ', ('{0,-28} ' -f ($right + ' to')), $names) -Color 'Gray' + } + $ignoredEntries = Get-PraValue (Get-PraValue $Context '_PraIgnoredTrustees' @{}) ([string]$record.ObjectGuid) @() + $ignoredEntries = @($ignoredEntries | Where-Object { $_ }) + if ($ignoredEntries.Count) { + # A warning, not an error: the account no longer exists, so nothing can be granted to it. + Write-PraLog -Context $Context -Level Warning -Message ('{0}: {1} permission entr{2} ignored, account unknown in AD (deleted, or from another domain): {3}' -f + $record.SamAccountName, $ignoredEntries.Count, $(if ($ignoredEntries.Count -gt 1) { 'ies' } else { 'y' }), ($ignoredEntries -join '; ')) + } + } +} + +function Get-PraRoutingAddress { + <# + .SYNOPSIS + Routing address of the remote mailbox (targetAddress): an existing proxy address in + Routing.RoutingDomain (AutoDetect), otherwise @RoutingDomain. + #> + [CmdletBinding()] + param([hashtable]$Context, $User) + $domain = $Context.Config.Routing.RoutingDomain + $proxies = @($User.proxyAddresses) + $primary = @($proxies | Where-Object { $_ -cmatch '^SMTP:' } | Select-Object -First 1) + $address = if ($primary.Count) { $primary[0].Substring(5) } else { [string](Get-PraValue $User 'mail' '') } + $local = if ($address) { ($address -split '@', 2)[0] } else { [string](Get-PraValue $User 'mailNickname' '') } + if ($Context.Config.Routing.AutoDetect) { + $existing = @($proxies | Where-Object { $_ -imatch '^smtp:.+@.+\.mail\.onmicrosoft\.com$' } | ForEach-Object { $_.Substring(5) }) + $match = @($existing | Where-Object { ($_ -split '@', 2)[0] -ieq $local -and $_ -imatch "@$([regex]::Escape($domain))$" }) + if (-not $match.Count) { $match = @($existing | Where-Object { $_ -imatch "@$([regex]::Escape($domain))$" }) } + if ($match.Count -eq 1) { return [string]$match[0] } + if ($match.Count -gt 1) { throw "Several routing addresses possible for $($User.SamAccountName): keep one proxy address in $domain." } + } + if (-not $local -or $local -match '[\s@]' -or $domain -notmatch '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$') { throw "No valid routing address for $($User.SamAccountName) (check Routing.RoutingDomain and the mail alias)." } + return "$local@$domain" +} +#endregion + +#region 4. Shared permissions ------------------------------------------------------------------ + +function Initialize-PraPermissionCache { + <# + .SYNOPSIS + Clears the cache of expanded permission groups of this run (never touches AD or receipts). + #> + [CmdletBinding()] + param([hashtable]$Context) + [void]$script:PermissionCaches.Remove($Context) +} + +function Get-PraPermissionCache { + <# Bounded cache (groups, trustees) shared by the shared mailboxes of one batch. #> + [CmdletBinding()] + param([hashtable]$Context) + $policy = (@($Context.Config.SharedMailbox.ExcludeTrusteeSamAccountNames | Sort-Object) -join "`n") + $cache = $null + if ($script:PermissionCaches.TryGetValue($Context, [ref]$cache)) { + if ($cache.Server -ieq $Context.Server -and $cache.Policy -ceq $policy) { return $cache } + [void]$script:PermissionCaches.Remove($Context) + } + $cache = @{ Server=[string]$Context.Server; Policy=$policy; Entries=@{}; Order=(New-Object 'Collections.Generic.Queue[string]'); UpnCount=0; MaxEntries=512; MaxUpns=100000; CharacterCount=0L; MaxCharacters=8000000L } + $script:PermissionCaches.Add($Context, $cache) + return $cache +} + +function Add-PraPermissionCache { + [CmdletBinding()] + param([hashtable]$Context, [string]$Key, [AllowEmptyCollection()][string[]]$Upns) + $cache = Get-PraPermissionCache -Context $Context + if ($cache.Entries.ContainsKey($Key)) { return } + $characters = 0L; foreach ($upn in $Upns) { $characters += $upn.Length } + # The limits only reduce re-use; they never limit the permissions that are backed up. + if ($Upns.Count -gt $cache.MaxUpns -or $characters -gt $cache.MaxCharacters) { return } + while ($cache.Entries.Count -ge $cache.MaxEntries -or ($cache.UpnCount + $Upns.Count) -gt $cache.MaxUpns -or ($cache.CharacterCount + $characters) -gt $cache.MaxCharacters) { + $oldKey = $cache.Order.Dequeue(); $old = $cache.Entries[$oldKey] + $cache.UpnCount -= $old.Upns.Count; $cache.CharacterCount -= $old.Characters; $cache.Entries.Remove($oldKey) + } + $cache.Entries[$Key] = @{ Upns=[string[]]$Upns; Characters=$characters; CapturedUtc=[DateTime]::UtcNow.ToString('o') } + $cache.Order.Enqueue($Key); $cache.UpnCount += $Upns.Count; $cache.CharacterCount += $characters +} + +function Expand-PraTrustee { + <# UPN(s) of a trustee: the user itself, or the members of a group (recursive), minus the exclusions. #> + [CmdletBinding()] + param([hashtable]$Context, $Object) + $excluded = @($Context.Config.SharedMailbox.ExcludeTrusteeSamAccountNames) + if ((Get-PraValue $Object 'sAMAccountName' '') -in $excluded) { return } + if ($Object.objectClass -eq 'user') { + $upn = [string](Get-PraValue $Object 'userPrincipalName' '') + if (-not $upn) { throw "Trustee without UPN: $($Object.DistinguishedName)" } + return $upn + } + if ($Object.objectClass -ne 'group') { throw "Unsupported trustee type: $($Object.objectClass)" } + $cache = Get-PraPermissionCache -Context $Context + $key = 'group:' + ([string]$Object.DistinguishedName).ToLowerInvariant() + if ($cache.Entries.ContainsKey($key)) { + Write-PraLog -Context $Context -Message ("PERMISSIONS CACHE | $($Object.DistinguishedName) | UPN=$($cache.Entries[$key].Upns.Count) | captured=$($cache.Entries[$key].CapturedUtc)") -Level Debug + return $cache.Entries[$key].Upns + } + $Context.CurrentOperation = 'Expand-PermissionGroup'; $Context.CurrentIdentity = [string]$Object.DistinguishedName + $seen = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + $upns = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + Write-PraLog -Context $Context -Message ("PERMISSIONS GROUP BEGIN | DC=$($Context.Server) | $($Object.DistinguishedName)") -Level Debug + # Members are streamed: the whole member list of a large group is never kept in memory. + Get-ADGroupMember -Identity $Object.DistinguishedName -Recursive -Server $Context.Server -ErrorAction Stop | ForEach-Object { + $member = $_ + if ($member.objectClass -eq 'user' -and $seen.Add([string]$member.DistinguishedName)) { + $memberKey = 'user:' + ([string]$member.DistinguishedName).ToLowerInvariant() + if ($cache.Entries.ContainsKey($memberKey)) { + foreach ($upn in $cache.Entries[$memberKey].Upns) { [void]$upns.Add($upn) } + } + else { + $user = Get-ADUser -Identity $member.DistinguishedName -Properties userPrincipalName, sAMAccountName -Server $Context.Server -ErrorAction Stop + $memberUpns = @() + if ($user.SamAccountName -notin $excluded) { + if (-not $user.UserPrincipalName) { throw "Trustee without UPN: $($member.DistinguishedName)" } + $memberUpns = @([string]$user.UserPrincipalName); [void]$upns.Add([string]$user.UserPrincipalName) + } + Add-PraPermissionCache -Context $Context -Key $memberKey -Upns $memberUpns + } + } + } + $result = [string[]]@($upns | Sort-Object) + # An enumeration error never reaches this point: a partial expansion is never cached. + Add-PraPermissionCache -Context $Context -Key $key -Upns $result + Write-PraLog -Context $Context -Message ("PERMISSIONS GROUP END | unique members=$($seen.Count) | unique UPN=$($result.Count)") -Level Debug + return $result +} + +function Resolve-PraAclTrustee { + <# + .SYNOPSIS + UPN(s) behind the SID of an ACE. Well-known and administrative accounts/groups are ignored. + .DESCRIPTION + A SID that no AD object carries any more (deleted account, or an account of another domain) cannot + receive a permission in Exchange Online: it is added to -Unknown and ignored. The caller reports it + as a warning (console, log, report). Unknown SIDs are not cached, so every mailbox reports them. + #> + [CmdletBinding()] + param([hashtable]$Context, $Reference, [Collections.Generic.List[string]]$Unknown) + $sid = if ($Reference -is [Security.Principal.SecurityIdentifier]) { $Reference } else { $Reference.Translate([Security.Principal.SecurityIdentifier]) } + # BUILTIN, NT AUTHORITY and Domain/Enterprise/Schema Admins are never reproduced. + if ($sid.Value -match '^S-1-5-32-' -or $sid.Value -match '^S-1-5-[0-9]+$' -or + $sid.Value -match '^S-1-5-21-[0-9]+-[0-9]+-[0-9]+-(512|518|519)$') { return } + $name = [string]$Reference + foreach ($pattern in @('NT AUTHORITY\*','BUILTIN\*','*\Domain Admins','*\Enterprise Admins','*\Schema Admins','*\Organization Management','*\Exchange Trusted Subsystem','*\Exchange Servers','*\Exchange Windows Permissions','*\Managed Availability Servers','*\Delegated Setup')) { + if ($name -like $pattern) { return } + } + $cache = Get-PraPermissionCache -Context $Context + $key = 'sid:' + $sid.Value + if ($cache.Entries.ContainsKey($key)) { return $cache.Entries[$key].Upns } + $Context.CurrentOperation = 'Resolve-PermissionTrustee'; $Context.CurrentIdentity = $sid.Value + Write-PraLog -Context $Context -Message ("PERMISSIONS TRUSTEE | DC=$($Context.Server) | SID=$($sid.Value)") -Level Debug + $objects = @(Get-ADObject -Filter "objectSid -eq '$($sid.Value)'" -Properties objectClass, userPrincipalName, sAMAccountName -Server $Context.Server -ErrorAction Stop) + if ($objects.Count -eq 0) { + if ($null -eq $Unknown) { throw "Permission trustee not found in AD: $($sid.Value)" } + Write-PraLog -Context $Context -Message ("PERMISSIONS TRUSTEE | SID=$($sid.Value) | not found in AD (deleted account or another domain): ignored") -Level Detail + if (-not $Unknown.Contains($sid.Value)) { $Unknown.Add($sid.Value) } + return + } + if ($objects.Count -ne 1) { throw "Permission trustee not unique in AD: $($sid.Value)" } + $excludedGroups = @('Domain Admins','Enterprise Admins','Schema Admins','Organization Management','Exchange Trusted Subsystem','Exchange Servers','Exchange Windows Permissions','Managed Availability Servers','Delegated Setup') + if ($objects[0].objectClass -eq 'group' -and ((Get-PraValue $objects[0] 'sAMAccountName' '') -in $excludedGroups -or (Get-PraValue $objects[0] 'Name' '') -in $excludedGroups)) { + Add-PraPermissionCache -Context $Context -Key $key -Upns @() + return + } + $result = [string[]]@(Expand-PraTrustee -Context $Context -Object $objects[0]) + Add-PraPermissionCache -Context $Context -Key $key -Upns $result + return $result +} + +function Get-PraSharedPermission { + <# + .SYNOPSIS + FullAccess, SendAs and SendOnBehalf holders (UPN) of a shared mailbox, read without Exchange. + .DESCRIPTION + PermissionSource = AD SendAs: extended-right ACEs of nTSecurityDescriptor; + FullAccess: ACEs with mask 0x1 of msExchMailboxSecurityDescriptor + PermissionSource = Csv one line Shared,Group in SharedMailbox.CsvPath: group members get both rights + PermissionSource = CustomAttribute the group whose = name of the shared mailbox + PermissionSource = None no FullAccess/SendAs + SendOnBehalf always comes from publicDelegates (CaptureSendOnBehalf). Groups are expanded recursively. + #> + [CmdletBinding()] + param([hashtable]$Context, $User) + $settings = $Context.Config.SharedMailbox + $Context.CurrentOperation = 'CaptureSharedPermissions/' + $settings.PermissionSource; $Context.CurrentIdentity = [string]$User.DistinguishedName + $full = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + $send = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + $behalf = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + # SIDs of the ACEs that no AD object carries any more: ignored, reported as a warning (Write-PraAdDelta). + $unknownSendAs = New-Object 'Collections.Generic.List[string]'; $unknownFullAccess = New-Object 'Collections.Generic.List[string]' + if (-not $Context.ContainsKey('_PraIgnoredTrustees')) { $Context['_PraIgnoredTrustees'] = @{} } + [void]$Context['_PraIgnoredTrustees'].Remove(([guid]$User.ObjectGUID).ToString()) + if (-not $settings.Enabled) { return @{ FullAccess=@(); SendAs=@(); SendOnBehalf=@() } } + Write-PraLog -Context $Context -Message "Shared mailbox permissions | DC=$($Context.Server) | $($User.DistinguishedName) | source=$($settings.PermissionSource)" -Level Debug + switch ($settings.PermissionSource) { + AD { + # Descriptor read through Get-ADUser -Server, never through the AD: drive. + $security = Get-PraValue $User 'nTSecurityDescriptor' $null + if ($null -eq $security) { throw 'nTSecurityDescriptor cannot be read: SendAs capture incomplete (check the read rights of the account).' } + $sendRules = if ($security -is [Security.AccessControl.ObjectSecurity]) { $security.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) } else { $security.Access } + foreach ($ace in $sendRules) { + if ($ace.AccessControlType -eq 'Allow' -and -not $ace.IsInherited -and + $ace.ActiveDirectoryRights -match 'ExtendedRight' -and [string]$ace.ObjectType -ieq 'ab721a54-1e2f-11d0-9819-00aa0040529b') { + foreach ($upn in @(Resolve-PraAclTrustee -Context $Context -Reference $ace.IdentityReference -Unknown $unknownSendAs)) { [void]$send.Add($upn) } + } + } + if ($null -eq $User.PSObject.Properties['msExchMailboxSecurityDescriptor']) { throw 'msExchMailboxSecurityDescriptor not read.' } + $mailboxSecurity = $User.msExchMailboxSecurityDescriptor + if ($mailboxSecurity -is [byte[]]) { + $descriptor = New-Object DirectoryServices.ActiveDirectorySecurity + $descriptor.SetSecurityDescriptorBinaryForm($mailboxSecurity); $mailboxSecurity = $descriptor + } + if ($null -ne $mailboxSecurity) { + $fullRules = if ($mailboxSecurity -is [Security.AccessControl.ObjectSecurity]) { $mailboxSecurity.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) } else { $mailboxSecurity.Access } + foreach ($ace in $fullRules) { + if ($ace.AccessControlType -eq 'Allow' -and -not $ace.IsInherited -and (([int]$ace.ActiveDirectoryRights -band 1) -eq 1)) { + foreach ($upn in @(Resolve-PraAclTrustee -Context $Context -Reference $ace.IdentityReference -Unknown $unknownFullAccess)) { [void]$full.Add($upn) } + } + } + } + } + Csv { + $names = @((Get-PraValue $User 'mailNickname' ''), $User.SamAccountName, (Get-PraValue $User 'DisplayName' ''), (Get-PraValue $User 'Name' '')) + $permissionRows = @(Import-Csv -LiteralPath $settings.CsvPath -ErrorAction Stop | Where-Object { $_.Shared -in $names }) + if ($permissionRows.Count -ne 1 -or -not $permissionRows[0].Group) { throw "Permission CSV: no line (or several lines) Shared/Group for $($User.SamAccountName)." } + $group = Get-PraGroup $Context $permissionRows[0].Group -WithoutMembers + foreach ($upn in @(Expand-PraTrustee -Context $Context -Object $group)) { [void]$full.Add($upn); [void]$send.Add($upn) } + } + CustomAttribute { + $attr = [string]$settings.CustomAttribute + if ($attr -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw 'SharedMailbox.CustomAttribute is invalid.' } + $filters = @(@((Get-PraValue $User 'mailNickname' ''), $User.SamAccountName, (Get-PraValue $User 'DisplayName' '')) | Where-Object { $_ } | Select-Object -Unique | ForEach-Object { "($attr=$(ConvertTo-PraLdapValue $_))" }) + $groups = @(Get-ADGroup -LDAPFilter ('(|' + ($filters -join '') + ')') -Server $Context.Server -ErrorAction Stop) + if ($groups.Count -ne 1) { throw "Permission group not found or not unique for $($User.SamAccountName) ($attr)." } + foreach ($upn in @(Expand-PraTrustee -Context $Context -Object $groups[0])) { [void]$full.Add($upn); [void]$send.Add($upn) } + } + None { } + default { throw 'SharedMailbox.PermissionSource is invalid.' } + } + if ($settings.CaptureSendOnBehalf) { + if ($null -eq $User.PSObject.Properties['publicDelegates']) { throw 'publicDelegates not read.' } + $seenDelegates = New-Object 'Collections.Generic.HashSet[string]' ([StringComparer]::OrdinalIgnoreCase) + foreach ($dn in @($User.publicDelegates)) { + if (-not $dn -or -not $seenDelegates.Add([string]$dn)) { continue } + $cache = Get-PraPermissionCache -Context $Context + $key = 'delegate:' + ([string]$dn).ToLowerInvariant() + if ($cache.Entries.ContainsKey($key)) { $upns = $cache.Entries[$key].Upns } + else { + $Context.CurrentOperation = 'Resolve-PublicDelegate'; $Context.CurrentIdentity = [string]$dn + $delegate = Get-ADObject -Identity $dn -Properties objectClass, userPrincipalName, sAMAccountName -Server $Context.Server -ErrorAction Stop + $upns = [string[]]@(Expand-PraTrustee -Context $Context -Object $delegate) + Add-PraPermissionCache -Context $Context -Key $key -Upns $upns + } + foreach ($upn in $upns) { [void]$behalf.Add($upn) } + } + } + Write-PraMemoryStage -Context $Context -Stage 'PERMISSIONS CAPTURED' -Identity ([string]$User.ObjectGUID) -Detail ("FullAccess=$($full.Count) SendAs=$($send.Count) SendOnBehalf=$($behalf.Count)") + $ignored = @(@($unknownFullAccess | ForEach-Object { "FullAccess $_" }) + @($unknownSendAs | ForEach-Object { "SendAs $_" })) + if ($ignored.Count) { $Context['_PraIgnoredTrustees'][([guid]$User.ObjectGUID).ToString()] = [string[]]$ignored } + return @{ FullAccess=@($full | Sort-Object); SendAs=@($send | Sort-Object); SendOnBehalf=@($behalf | Sort-Object) } +} +#endregion + +#region 5. Plans ------------------------------------------------------------------------------- + +function New-PraRow { + <# + .SYNOPSIS + Result row of one object (CSV/HTML report, cloud phase). Memory only. + #> + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions','',Justification='In-memory constructor, no change to any target or file.')] + [CmdletBinding()] + param([hashtable]$Context, $Record) + [pscustomobject]@{ + ObjectGuid=[string](Get-PraValue $Record 'ObjectGuid' ''); SamAccountName=[string](Get-PraValue $Record 'SamAccountName' '') + UserPrincipalName=[string](Get-PraValue $Record 'UserPrincipalName' ''); Action=$Context.Action + IsShared=[bool](Get-PraValue $Record 'IsShared' $false); ADApplied=$null; ADVerified=$null; GroupAction='' + BackupPath=''; LastOperation=''; CloudMailbox=$null; CloudLicense=$null; CloudStatus='N/A'; CloudDetail='' + FinalStatus='Skipped'; Detail=''; SharedFullAccess=@(); SharedSendAs=@(); SharedSendOnBehalf=@(); PermMissing=@(); PermDetail=''; Warnings='' + BackupRec=$Record; DeproPending=$false; RestoreDeferred=$false + PreserveCloudMailbox=$false; PreserveLicense=$false; DeprovisionConfirmed=$false + } +} + +function New-PraPlan { + <# + .SYNOPSIS + Reads one object (all attributes, security descriptors) and computes its target state. Read only. + .PARAMETER Operation + Convert on-premises mailbox -> remote mailbox (targetAddress, remote types, Exchange + attributes cleared, routing proxy, retention tag, licence group or shared permissions) + Recover original attributes and licence group membership from the Convert backup + Deprovision shared mailbox: MailUser with msExchRemoteRecipientType 8, so that Exchange Online + removes the cloud shared mailbox before the on-premises attributes come back + RestoreTag original value of the retention tag only + .PARAMETER SourceRecord + Record of the Convert backup (Recover, Deprovision, RestoreTag). + .PARAMETER RestoreRetention + Recover: also restore the original retention tag (Finalize step). + .OUTPUTS + Plan: User (light), RawSnapshot (full capture), Record (backup record), Kinds, Desired, Row, Operation. + #> + [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions','',Justification='Reads and in-memory preparation only; writes are in Invoke-PraAdWrite.')] + [CmdletBinding()] + param([hashtable]$Context, [string]$Identity, [ValidateSet('Convert','Recover','Deprovision','RestoreTag')][string]$Operation, $SourceRecord = $null, [switch]$RestoreRetention) + $Context.CurrentOperation = $Operation; $Context.CurrentIdentity = $Identity + $config = $Context.Config + if ($null -ne $SourceRecord) { Assert-PraDomain $Context ([string]$SourceRecord.DistinguishedName) } + $tag = if ($Operation -eq 'Convert') { $config.Retention.Tag } else { Get-PraValue $SourceRecord 'Retention' $null } + $tagEnabled = if ($Operation -eq 'Convert') { $config.Retention.Enabled -and $tag.Enabled } else { [bool](Get-PraValue $tag 'Enabled' $false) } + $tagAttr = if ($tagEnabled) { [string]$tag.Attribute } else { '' } + if ($tagAttr -and $tagAttr -notmatch '^extensionAttribute([1-9]|1[0-5])$') { throw "Retention tag attribute not allowed: $tagAttr" } + if ($Operation -eq 'RestoreTag' -and -not $tagEnabled) { throw 'The original value of the retention tag is not in the backup: tag clean-up refused.' } + $kinds = [ordered]@{}; foreach ($name in $script:AttributeKinds.Keys) { $kinds[$name] = $script:AttributeKinds[$name] } + if ($tagAttr) { $kinds[$tagAttr] = 'String' } + $user = Get-PraUser $Context $Identity -ExtraProperties @($kinds.Keys) -Capture + $before = Get-PraAttributeState $user $kinds + $shared = if ($Operation -eq 'Convert') { [int64]$user.msExchRecipientTypeDetails -eq 4 } else { [bool]$SourceRecord.IsShared } + $desired = [ordered]@{}; foreach ($name in $before.Keys) { $desired[$name] = $before[$name] } + $permissions = @{ FullAccess=@(); SendAs=@(); SendOnBehalf=@() } + $licensing = [ordered]@{ Enabled=$false; GroupGuid=''; GroupDN=''; WasMember=$false; DesiredMember=$false } + $routing = ''; $alreadyRecovered = $false + if ($Operation -eq 'Convert') { + if (-not $user.homeMDB -or [int64]$user.msExchRecipientTypeDetails -notin @(1, 4, 16, 32)) { throw "Not an on-premises mailbox (homeMDB / msExchRecipientTypeDetails): $Identity" } + $routing = Get-PraRoutingAddress $Context $user + $rrt = if ($shared) { [int64]$config.SharedMailbox.RemoteRecipientType } else { [int64]$config.Remote.RecipientType } + if ($shared -and $rrt -in @(100, 102)) { throw "SharedMailbox.RemoteRecipientType=$rrt means an already migrated mailbox (Migrated+Shared): first provisioning refused before any change: $Identity" } + if ($config.Remote.HandleArchives -and (Get-PraValue $user 'msExchArchiveGUID' $null)) { $rrt = $rrt -bor 2 } + $desired.targetAddress = @{ Present=$true; Kind='String'; Value="SMTP:$routing" } + $desired.msExchRecipientDisplayType = @{ Present=$true; Kind='Int'; Value='-2147483642' } + $details = if ($shared) { '34359738368' } else { '2147483648' } + $desired.msExchRecipientTypeDetails = @{ Present=$true; Kind='Long'; Value=$details } + $desired.msExchRemoteRecipientType = @{ Present=$true; Kind='Long'; Value=[string]$rrt } + foreach ($name in @('homeMDB','homeMTA','msExchHomeServerName','mDBUseDefaults')) { $desired[$name] = @{ Present=$false; Kind=$kinds[$name]; Value=$null } } + if ($config.Remote.ClearMailboxGuid) { $desired.msExchMailboxGuid = @{ Present=$false; Kind='Bytes'; Value=$null } } + $proxies = @($user.proxyAddresses) + if (-not @($proxies | Where-Object { $_ -ieq "smtp:$routing" }).Count) { $proxies += "smtp:$routing" } + $desired.proxyAddresses = @{ Present=$true; Kind='MultiString'; Value=[string[]]$proxies } + if ($tagEnabled) { $desired[$tagAttr] = @{ Present=$true; Kind='String'; Value=[string]$tag.Value } } + if ($shared) { $permissions = Get-PraSharedPermission $Context $user } + elseif ($config.Licensing.Enabled) { + $group = Get-PraGroup $Context $config.Licensing.GroupDN + $licensing.Enabled = $true; $licensing.GroupGuid = ([guid]$group.ObjectGUID).ToString(); $licensing.GroupDN = [string]$group.DistinguishedName + $licensing.WasMember = ([string]$user.DistinguishedName -in @($group.member)); $licensing.DesiredMember = $true + } + } + elseif ($Operation -eq 'Deprovision') { + if (-not $shared) { throw 'Deprovision is for shared mailboxes only.' } + $remoteState = ([int64]$user.msExchRecipientTypeDetails -eq 34359738368) + $pendingState = ([int64]$user.msExchRecipientTypeDetails -eq 128 -and [int64]$user.msExchRemoteRecipientType -eq 8) + if (-not $remoteState -and -not $pendingState) { + $alreadyRecovered = $true + foreach ($name in $script:AttributeKinds.Keys) { if (-not (Test-PraStateEqual $before[$name] $SourceRecord.Attributes.$name)) { $alreadyRecovered = $false } } + if (-not $alreadyRecovered) { throw 'Shared mailbox in an unexpected state: neither RemoteSharedMailbox, nor MailUser with RRT 8, nor its original state.' } + } + if (-not $alreadyRecovered) { + if (-not (Get-PraValue $user 'targetAddress' '')) { throw 'targetAddress missing: a clean deprovisioning is not guaranteed.' } + $desired.msExchRemoteRecipientType = @{ Present=$true; Kind='Long'; Value='8' } + $desired.msExchRecipientDisplayType = @{ Present=$true; Kind='Int'; Value='6' } + $desired.msExchRecipientTypeDetails = @{ Present=$true; Kind='Long'; Value='128' } + foreach ($name in @('homeMDB','msExchHomeServerName','mDBUseDefaults','msExchMailboxGuid')) { $desired[$name] = @{ Present=$false; Kind=$kinds[$name]; Value=$null } } + } + } + elseif ($Operation -eq 'Recover') { + foreach ($name in $script:AttributeKinds.Keys) { $desired[$name] = $SourceRecord.Attributes.$name } + $sourceGroup = Get-PraValue $SourceRecord 'Licensing' $null + if ($null -ne $sourceGroup -and $sourceGroup.Enabled) { + $group = Get-PraGroup $Context $sourceGroup.GroupGuid + $licensing.Enabled = $true; $licensing.GroupGuid = ([guid]$group.ObjectGUID).ToString(); $licensing.GroupDN = [string]$group.DistinguishedName + $licensing.WasMember = ([string]$user.DistinguishedName -in @($group.member)); $licensing.DesiredMember = [bool]$sourceGroup.WasMember + } + elseif ([bool](Get-PraValue $SourceRecord 'AddedToLicenseGroup' $false)) { + throw 'Old backup without the GUID of the licence group: removal refused (a group with the same DN may have been re-created). Have the backup migrated before restoring this batch.' + } + } + if ($Operation -eq 'RestoreTag' -or ($Operation -eq 'Recover' -and $RestoreRetention -and $tagEnabled)) { + $original = $SourceRecord.Attributes.$tagAttr + if (-not (Test-PraStateEqual $before[$tagAttr] $original) -and + (-not $before[$tagAttr].Present -or [string]$before[$tagAttr].Value -cne [string]$tag.Value)) { + throw "Retention tag $tagAttr changed by someone else: restore refused." + } + $desired[$tagAttr] = $original + } + $sourceLicensing = Get-PraValue $SourceRecord 'Licensing' $null + $preserveMailbox = $shared -and $Operation -eq 'Recover' -and [bool](Get-PraValue $Context 'KeepCloudShared' $false) + $preserveLicense = ($Operation -eq 'Recover') -and [bool](Get-PraValue $sourceLicensing 'Enabled' $false) -and [bool](Get-PraValue $sourceLicensing 'WasMember' $false) + $record = [ordered]@{ + ObjectGuid=([guid]$user.ObjectGUID).ToString(); DistinguishedName=[string]$user.DistinguishedName + SamAccountName=[string]$user.SamAccountName; UserPrincipalName=[string]$user.UserPrincipalName; DisplayName=[string](Get-PraValue $user 'DisplayName' $user.SamAccountName) + CapturedUtc=[DateTime]::UtcNow.ToString('o'); CapturedUsnChanged=(Get-PraUsn $user); IsShared=$shared; RequestedOperation=$Operation + Attributes=$before; PlannedAttributes=$desired; Licensing=$licensing + Retention=[ordered]@{ Enabled=[bool]$tagEnabled; Attribute=$tagAttr; Value=$(if ($tagEnabled) { [string]$tag.Value } else { '' }) } + SharedPermissions=$permissions; PreserveCloudMailbox=[bool]$preserveMailbox; PreserveLicense=[bool]$preserveLicense + } + $row = New-PraRow $Context $record + if ($null -ne $SourceRecord) { $row.BackupRec = $SourceRecord } else { $row.BackupRec = [pscustomobject]$record } + $row.PreserveCloudMailbox = [bool]$preserveMailbox; $row.PreserveLicense = [bool]$preserveLicense + $ignoredEntries = Get-PraValue (Get-PraValue $Context '_PraIgnoredTrustees' @{}) $record.ObjectGuid @() + $ignoredEntries = @($ignoredEntries | Where-Object { $_ }) + if ($shared -and $Operation -eq 'Convert' -and $ignoredEntries.Count) { $row.Warnings = 'Permission entries ignored (account unknown in AD): ' + ($ignoredEntries -join '; ') } + $row.IsShared = $shared; $row.SharedFullAccess = @($permissions.FullAccess); $row.SharedSendAs = @($permissions.SendAs); $row.SharedSendOnBehalf = @($permissions.SendOnBehalf) + $row.DeproPending = ($Operation -eq 'Deprovision' -and -not $alreadyRecovered); $row.Detail = "Operation=$Operation ; routing=$routing"; $row.LastOperation = 'Prepared' + $plannedOperation = if ($alreadyRecovered) { 'AlreadyRecovered' } else { $Operation } + $record.RequestedOperation = $plannedOperation + $Context.CurrentOperation = 'Project-ADSnapshot'; $Context.CurrentIdentity = $record.ObjectGuid + Write-PraMemoryStage -Context $Context -Stage 'PROJECTION BEGIN' -Identity $record.ObjectGuid -Detail $record.SamAccountName + $rawSnapshot = ConvertTo-PraRawSnapshot -User $user -CapturedUtc $record.CapturedUtc + $lightUser = [pscustomobject]@{ ObjectGUID=[guid]$record.ObjectGuid; DistinguishedName=$record.DistinguishedName; uSNChanged=[int64]$record.CapturedUsnChanged } + Write-PraMemoryStage -Context $Context -Stage 'PROJECTION END' -Identity $record.ObjectGuid -Detail ("attributes=$($rawSnapshot.Attributes.Count) FullAccess=$(@($permissions.FullAccess).Count) SendAs=$(@($permissions.SendAs).Count) SendOnBehalf=$(@($permissions.SendOnBehalf).Count)") + return [pscustomobject]@{ User=$lightUser; RawSnapshot=$rawSnapshot; Record=$record; Kinds=$kinds; Desired=$desired; Row=$row; Operation=$plannedOperation; ExpectedUsnChanged=$record.CapturedUsnChanged; Previewed=$false } +} +#endregion + +#region 6. Backups and proofs ------------------------------------------------------------------- + +function Assert-PraStoredRecord { + <# One record of a backup file is complete and correctly typed (never trusted blindly). #> + [CmdletBinding()] + param($Record, [switch]$Legacy, [switch]$Planned) + $attributeStates = if ($Planned) { $Record.PlannedAttributes } else { $Record.Attributes } + if ([guid]$Record.ObjectGuid -eq [guid]::Empty) { throw 'Backup: empty GUID.' } + foreach ($name in @('DistinguishedName','SamAccountName','UserPrincipalName')) { + if ((Get-PraValue $Record $name $null) -isnot [string] -or [string]::IsNullOrWhiteSpace($Record.$name)) { throw "Backup: $name missing or invalid." } + } + $kinds = [ordered]@{}; foreach ($name in $script:AttributeKinds.Keys) { $kinds[$name] = $script:AttributeKinds[$name] } + $retention = Get-PraValue $Record 'Retention' $null + if ($null -ne $retention -and $retention.Enabled) { + if ($retention.Attribute -notmatch '^extensionAttribute([1-9]|1[0-5])$' -or $retention.Value -isnot [string]) { throw 'Backup: invalid retention tag metadata.' } + $kinds[$retention.Attribute] = 'String' + } + foreach ($name in $kinds.Keys) { + $state = Get-PraValue $attributeStates $name $null + if ($null -eq $state -or (Get-PraValue $state 'Present' $null) -isnot [bool] -or $state.Kind -cne $kinds[$name]) { throw "Backup incomplete or wrong type: $name" } + if (-not $state.Present) { + if ($null -ne $state.Value) { throw "Backup: $name is absent but has a value." } + continue + } + switch ($state.Kind) { + Bool { if ($state.Value -isnot [bool]) { throw "Backup: invalid boolean $name" } } + MultiString { + if ($state.Value -isnot [array] -or @($state.Value).Count -eq 0) { throw "Backup: invalid list $name" } + foreach ($value in $state.Value) { if ($value -isnot [string] -or -not $value) { throw "Backup: invalid text in $name" } } + } + default { if ($state.Value -isnot [string] -or -not $state.Value) { throw "Backup: invalid value $name" } } + } + $null = ConvertFrom-PraStoredValue $state + } + if (-not $Legacy) { + if ($Record.CapturedUsnChanged -isnot [string] -or $Record.CapturedUsnChanged -notmatch '^[1-9][0-9]*$') { throw 'Backup: original uSNChanged missing or invalid.' } + $null = [int64]::Parse($Record.CapturedUsnChanged, [Globalization.CultureInfo]::InvariantCulture) + if ($Record.RequestedOperation -notin @('Convert','Recover','Deprovision','RestoreTag','AlreadyRecovered')) { throw 'Backup: invalid planned operation.' } + if ($Record.PreserveCloudMailbox -isnot [bool] -or $Record.PreserveLicense -isnot [bool]) { throw 'Backup: invalid cloud post-conditions.' } + if ($Record.PreserveCloudMailbox -and (-not $Record.IsShared -or $Record.RequestedOperation -ne 'Recover')) { throw 'Backup: keeping the cloud mailbox does not match the operation or the type.' } + if ($Record.IsShared -isnot [bool] -or $Record.Licensing.Enabled -isnot [bool] -or $Record.Licensing.WasMember -isnot [bool] -or $Record.Licensing.DesiredMember -isnot [bool]) { throw 'Backup: invalid licence group or type state.' } + if ($Record.Licensing.Enabled -and [guid]$Record.Licensing.GroupGuid -eq [guid]::Empty) { throw 'Backup: licence group GUID missing.' } + } + else { + if ((Get-PraValue $Record 'AddedToLicenseGroup' $null) -isnot [bool]) { throw 'Old backup: licence group state not captured.' } + } +} + +function Import-PraBackup { + <# + .SYNOPSIS + Reads and fully validates a backup (JSON, .sha256, CLIXML) and returns its receipt. + Schema 3 (current), 2 and 1 (old versions, read with their restrictions) are accepted. + #> + [CmdletBinding()] + param([hashtable]$Context, [Parameter(Mandatory)][string]$Path) + $pathResolved = (Get-Item -LiteralPath $Path -ErrorAction Stop).FullName + $registry = Get-PraReceiptRegistry -Context $Context + foreach ($entry in $registry) { + if ($entry.Path -ieq $pathResolved) { + Assert-PraReceiptIntegrity -Context $Context -Entry $entry + Write-PraLog -Context $Context -Message ("BACKUP INTEGRITY | already validated | $pathResolved | hashes re-read") -Level Debug + return $entry.Receipt + } + } + $Context.CurrentOperation = 'Read-BackupJson' + $hashBeforeRead = Get-PraHash -Path $pathResolved + $data = Get-Content -LiteralPath $pathResolved -Raw -Encoding UTF8 -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop + if ($data.Environment -cne $Context.Config.Environment) { throw "Backup of another Environment: '$($data.Environment)' (configuration: '$($Context.Config.Environment)')." } + $version = Get-PraValue $data 'SchemaVersion' 1 + if ($version -notin @(1, 2, 3)) { throw "Backup schema not supported: $version" } + if ($version -eq 3 -and (Get-PraValue $data 'RawFormat' '') -cne 'PraDataOnlyClixml-v1') { throw 'Backup capture format not supported.' } + if ($data.Operation -notin @('Convert','Recover','Finalize','Retention')) { throw "This file is not an AD backup: $($data.Operation)" } + $records = @($data.Records) + if (-not $records.Count -or $null -eq $records[0]) { throw 'Backup without any record.' } + $seen = @{} + foreach ($record in $records) { + Assert-PraStoredRecord $record -Legacy:($version -eq 1) + if ($version -ge 2) { Assert-PraStoredRecord $record -Planned } + $key = ([guid]$record.ObjectGuid).ToString() + if ($seen.ContainsKey($key)) { throw "Same GUID twice in the backup: $key" }; $seen[$key] = $true + } + $hash = Get-PraHash $pathResolved + if ($hash -cne $hashBeforeRead) { throw 'Backup JSON changed while it was read.' } + $rawPath = ''; $rawHash = '' + if ($version -ge 2) { + $storedHash = (Get-Content -LiteralPath ($pathResolved + '.sha256') -Raw -ErrorAction Stop).Trim() + if ($storedHash -cne $hash) { throw 'Backup SHA-256 does not match its .sha256 file.' } + if ([IO.Path]::GetFileName($data.RawFile) -cne $data.RawFile) { throw 'Backup CLIXML path is not in the batch folder.' } + $rawPath = Join-Path (Split-Path $pathResolved -Parent) $data.RawFile + $rawHash = Get-PraHash -Path $rawPath + if ($rawHash -cne $data.RawHash) { throw 'Backup CLIXML SHA-256 mismatch.' } + $format = if ($version -eq 3) { [string]$data.RawFormat } else { '' } + $Context.CurrentOperation = 'Validate-RawCapture' + Write-PraMemoryStage -Context $Context -Stage 'RAW VALIDATE BEGIN' -Detail ("schema=$version objects=$($records.Count) file=$rawPath") + $null = Test-PraRawCapture -Context $Context -LiteralPath $rawPath -Records $records -RawFormat $format + # A change during the read never yields a receipt for different content. + if ((Get-PraHash -Path $rawPath) -cne $rawHash) { throw 'Backup CLIXML changed during its validation.' } + Write-PraMemoryStage -Context $Context -Stage 'RAW VALIDATE END' -Detail ("bytes=$((Get-Item -LiteralPath $rawPath -ErrorAction Stop).Length)") + } + else { Write-PraLog -Context $Context -Message 'Schema 1 backup (version 1.2.x): no proof of the original retention tag nor of the AD phase. Missing values are never invented.' -Level Warning } + if ((Get-PraHash -Path $pathResolved) -cne $hash) { throw 'Backup JSON changed during its validation.' } + $receipt = [pscustomobject]@{ Data=$data; Path=$pathResolved; Hash=$hash; Legacy=($version -eq 1) } + Add-PraValidatedReceipt -Context $Context -Receipt $receipt -RawPath $rawPath -RawHash $rawHash + return $receipt +} + +function Assert-PraRecordMatchesPlan { + <# The re-read backup record holds exactly the planned record (metadata, values, group, tag, permissions). #> + [CmdletBinding()] + param($Stored, [Collections.IDictionary]$Expected) + foreach ($name in @('ObjectGuid','DistinguishedName','SamAccountName','UserPrincipalName','DisplayName','CapturedUtc','CapturedUsnChanged','IsShared','RequestedOperation','PreserveCloudMailbox','PreserveLicense')) { + if ((Get-PraValue $Stored $name $null) -cne $Expected[$name]) { throw "Backup re-read: $name not preserved." } + } + foreach ($section in @('Attributes','PlannedAttributes')) { + $actualNames = @($Stored.$section.PSObject.Properties.Name) + if ($actualNames.Count -ne $Expected[$section].Count) { throw "Backup re-read: missing or extra attributes in $section." } + foreach ($name in $Expected[$section].Keys) { + $state = Get-PraValue $Stored.$section $name $null + if ($null -eq $state -or -not (Test-PraStateEqual -Left $Expected[$section][$name] -Right $state)) { throw "Backup re-read: value not preserved $section/$name." } + } + } + foreach ($section in @('Licensing','Retention')) { + foreach ($name in $Expected[$section].Keys) { + if ((Get-PraValue $Stored.$section $name $null) -cne $Expected[$section][$name]) { throw "Backup re-read: state not preserved $section/$name." } + } + } + foreach ($right in @('FullAccess','SendAs','SendOnBehalf')) { + $actual = Get-PraValue $Stored.SharedPermissions $right $null + $wanted = @($Expected.SharedPermissions[$right]) + if ($null -eq $actual -or @($actual).Count -ne $wanted.Count) { throw "Backup re-read: incomplete permissions $right." } + for ($index = 0; $index -lt $wanted.Count; $index++) { + if ([string]$actual[$index] -cne [string]$wanted[$index]) { throw "Backup re-read: permission not preserved $right index=$index." } + } + } +} + +function Save-PraBatch { + <# + .SYNOPSIS + Writes the backup of the whole batch BEFORE any write: private folder Batch- with + ---.json (typed records), .clixml (every AD value), + .sha256, then re-reads and compares everything with the plans. Also opens the batch journal. + #> + [CmdletBinding()] + param([hashtable]$Context, [Parameter(Mandatory)][object[]]$Plans, [string]$Operation) + if (-not $Plans.Count) { throw 'Empty backup batch.' } + $Context.CurrentOperation = 'Capture/Persist/Verify'; $Context.CurrentIdentity = 'Batch' + $id = [guid]::NewGuid().ToString('N') + $directory = Join-Path $Context.BackupFolder ('Batch-' + $id) + $base = "$Operation-$($Context.Config.Environment)-$(Get-Date -Format 'yyyyMMdd_HHmmss')-$($id.Substring(0, 8))" + $rawPath = Join-Path $directory ($base + '.clixml') + $path = Join-Path $directory ($base + '.json') + if ($rawPath.Length -ge 248) { throw 'Backup path too long for Windows PowerShell 5.1: use a shorter Storage.BackupFolder.' } + New-PraPrivateDirectory $directory + Write-PraLog -Context $Context -Message "BACKUP BEGIN | $($Plans.Count) object(s) | $path" -Level Detail + $snapshots = @($Plans | ForEach-Object { $_.RawSnapshot }) + $Context.CurrentOperation = 'Write-RawCapture' + Write-PraMemoryStage -Context $Context -Stage 'RAW WRITE BEGIN' -Detail ("objects=$($snapshots.Count) file=$rawPath") + Write-PraRawCapture -Context $Context -LiteralPath $rawPath -Snapshots $snapshots + Write-PraMemoryStage -Context $Context -Stage 'RAW WRITE END' -Detail ("bytes=$((Get-Item -LiteralPath $rawPath -ErrorAction Stop).Length)") + $data = [ordered]@{ + SchemaVersion=3; RawFormat='PraDataOnlyClixml-v1'; Operation=$Operation; RunId=$Context.RunId; BatchId=$id; Environment=$Context.Config.Environment + Server=$Context.Server; NamingContext=$Context.NamingContext; CreatedUtc=[DateTime]::UtcNow.ToString('o') + RawFile=[IO.Path]::GetFileName($rawPath); RawHash=(Get-PraHash $rawPath) + SourceBackupHash=$Context.SourceBackupHash; Records=@($Plans | ForEach-Object { $_.Record }) + } + $Context.CurrentOperation = 'Write-BackupJson' + $json = $data | ConvertTo-Json -Depth 30 + Write-PraImmutableFile $path $json + $json = $null + Write-PraImmutableFile ($path + '.sha256') (Get-PraHash $path) + $Context.CurrentOperation = 'Validate-BackupAgainstPlan' + $null = Test-PraRawCapture -Context $Context -LiteralPath $rawPath -Records $data.Records -RawFormat $data.RawFormat -ExpectedSnapshots $snapshots + $receipt = Import-PraBackup $Context $path + # A valid JSON is not necessarily complete: compare it with the plans in memory. + for ($i = 0; $i -lt $Plans.Count; $i++) { + $record = $receipt.Data.Records[$i] + if ($record.ObjectGuid -cne $Plans[$i].Record.ObjectGuid) { throw 'Backup order or identity differs from the plan.' } + Assert-PraRecordMatchesPlan -Stored $record -Expected $Plans[$i].Record + } + $Context.BackupFiles.Add($path) + $Context.JournalPath = Join-Path $directory ('Journal-' + $id + '.jsonl') + Write-PraImmutableFile $Context.JournalPath '' + $Context.StateFiles.Add($Context.JournalPath) + foreach ($plan in $Plans) { $plan.Row.BackupPath = $path } + Write-PraJournal $Context '*' 'Backup' 'Verified' $path + Write-PraLog -Context $Context -Message "BACKUP VERIFIED | $path | SHA256=$($receipt.Hash) | JSON + CLIXML re-read" -Level Detail + Write-PraItem -Context $Context -Status Ok -Icon Backup -Text ("Backup of {0} object(s) written and re-read {1} batch {2}" -f $Plans.Count, [char]0x00B7, $id.Substring(0, 8)) + Write-PraLog -Context $Context -Message $directory -Level Sub + return $receipt +} + +function Assert-PraReceipt { + <# + .SYNOPSIS + The object is covered by the validated backup, and the backup is unchanged. + #> + [CmdletBinding()] + param([hashtable]$Context, $Receipt, [string]$ObjectGuid) + $entry = Get-PraReceiptEntry -Context $Context -Receipt $Receipt + if (-not $entry.Guids.Contains($ObjectGuid)) { throw "Object not covered by the validated backup: $ObjectGuid" } + Assert-PraReceiptIntegrity -Context $Context -Entry $entry +} + +function Assert-PraCurrentState { + <# Re-reads the object: same version (uSNChanged), same DN, expected values and group membership. #> + [CmdletBinding()] + param([hashtable]$Context, $Plan, [Collections.IDictionary]$Expected, [bool]$ExpectedMember, [switch]$AcceptNewVersion) + $user = Get-PraUser $Context $Plan.Record.ObjectGuid -ExtraProperties @($Plan.Kinds.Keys) + $version = Get-PraUsn $user + if (-not $AcceptNewVersion -and $version -cne $Plan.ExpectedUsnChanged) { throw 'uSNChanged changed: the object was modified since it was planned or last verified.' } + if ([string]$user.DistinguishedName -cne $Plan.Record.DistinguishedName) { throw 'The DN changed since the capture: plan the batch again.' } + $actual = Get-PraAttributeState $user $Plan.Kinds + foreach ($name in $Expected.Keys) { + if (-not (Test-PraStateEqual $Expected[$name] $actual[$name])) { throw "AD state differs from the expected state | GUID=$($Plan.Record.ObjectGuid) | attribute=$name | DC=$($Context.Server)" } + } + if ($Plan.Record.Licensing.Enabled) { + $group = Get-PraGroup $Context $Plan.Record.Licensing.GroupGuid + if ($group.DistinguishedName -cne $Plan.Record.Licensing.GroupDN -or + ([string]$user.DistinguishedName -in @($group.member)) -ne $ExpectedMember) { throw 'Licence group membership differs from the backup/plan.' } + } + if ($AcceptNewVersion) { $Plan.ExpectedUsnChanged = $version } +} +#endregion + +#region 7. Writes ------------------------------------------------------------------------------ + +function Invoke-PraAdWrite { + <# + .SYNOPSIS + One AD write (Set-ADUser, Add-ADGroupMember or Remove-ADGroupMember) with every guard: + no previous error, Apply mode, ShouldProcess, validated backup covering the object, + operator approval, current state re-read AFTER the approval, journal Started/Applied. + #> + [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')] + param([hashtable]$Context, $Receipt, $Plan, [string]$Operation, [scriptblock]$Write) + if ([bool](Get-PraValue $Context 'OperationFailed' $false) -or $Context.Issues.Count -gt 0 -or @($Context.Rows | Where-Object FinalStatus -eq 'Error').Count -gt 0) { throw 'Safety stop: no AD write after an error in this run.' } + if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -eq 'Check' -or $WhatIfPreference) { throw 'Safety stop: AD writes are not allowed in this mode.' } + if (-not $PSCmdlet.ShouldProcess($Plan.Record.ObjectGuid, $Operation)) { throw 'AD write not authorised (ShouldProcess).' } + Assert-PraReceipt $Context $Receipt $Plan.Record.ObjectGuid + if (-not (& $Context.Approval $Plan.Record.DistinguishedName $Operation)) { throw "Operation refused: $Operation. Batch stopped." } + # An interactive confirmation can take time: re-check the object and the backup AFTER it. + $expected = if ($Operation -eq 'Set-ADUser') { $Plan.Record.Attributes } else { $Plan.Desired } + Assert-PraCurrentState $Context $Plan $expected $Plan.Record.Licensing.WasMember + Assert-PraReceipt $Context $Receipt $Plan.Record.ObjectGuid + $Context.CurrentOperation = $Operation; $Context.CurrentIdentity = $Plan.Record.ObjectGuid + $Plan.Row.LastOperation = $Operation; $Plan.Row.Detail += " | attempt=$Operation" + Write-PraJournal $Context $Plan.Record.ObjectGuid $Operation 'Started' + Write-PraLog -Context $Context -Message "AD WRITE BEGIN | $Operation | DC=$($Context.Server) | GUID=$($Plan.Record.ObjectGuid) | backup=$($Receipt.Path)" -Level Detail + # Any exception goes up to Invoke-PraAdBatch: no next object, no sync. + & $Write | Out-Null + $Plan.Row.ADApplied = $true + Write-PraJournal $Context $Plan.Record.ObjectGuid $Operation 'Applied' +} + +function Invoke-PraAdPreview { + <# + .SYNOPSIS + Adds the planned objects to the results and shows their planned changes (before the + confirmation). Invoke-PraAdBatch does not show them again. + #> + [CmdletBinding()] + param([hashtable]$Context, [AllowEmptyCollection()][object[]]$Plans) + foreach ($plan in $Plans) { + if (-not $Context.Rows.Contains($plan.Row)) { $Context.Rows.Add($plan.Row) } + Write-PraAdDelta -Context $Context -Plan $plan -Stage Planned + $plan.Previewed = $true + } +} + +function Invoke-PraAdBatch { + <# + .SYNOPSIS + Applies a batch of plans: backup of the whole batch, then for each object Set-ADUser and the + licence group change, each followed by an AD re-read; finally the State file (AD proof). + .DESCRIPTION + Preview (or -WhatIf): the rows are marked Planned and nothing is written (no backup either). + The first error stops the batch; previous objects keep their changes (no automatic rollback): + the journal and the backup say exactly what was done. + .OUTPUTS + The receipt of the batch backup, with a StatePath property; $null in Preview. + #> + [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')] + param([hashtable]$Context, [AllowEmptyCollection()][object[]]$Plans, [ValidateSet('Convert','Recover','Finalize','Retention')][string]$Operation) + $Context.LastVerifiedReceipt = $null + if ([bool](Get-PraValue $Context 'OperationFailed' $false) -or $Context.Issues.Count -gt 0 -or @($Context.Rows | Where-Object FinalStatus -eq 'Error').Count -gt 0) { throw 'No new batch after an error in this run.' } + if (-not $Plans.Count) { Write-PraItem -Context $Context -Status Skip -Text 'Nothing to do.'; return $null } + foreach ($plan in $Plans) { if (-not $Context.Rows.Contains($plan.Row)) { $Context.Rows.Add($plan.Row) } } + try { + foreach ($plan in $Plans) { if (-not [bool](Get-PraValue $plan 'Previewed' $false)) { Write-PraAdDelta -Context $Context -Plan $plan -Stage Planned } } + if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -eq 'Check' -or $WhatIfPreference) { + foreach ($plan in $Plans) { + $plan.Row.FinalStatus = 'Planned'; $plan.Row.ADApplied = $false; $plan.Row.LastOperation = 'PreparedOnly' + Write-PraLog -Context $Context -Message "$($plan.Record.SamAccountName) | $($plan.Operation) | Planned | nothing written" -Level Detail + } + Write-PraItem -Context $Context -Status Skip -Text ("Preview: no backup and no AD change ({0} object(s) planned)." -f $Plans.Count) + return $null + } + if (-not $PSCmdlet.ShouldProcess("$($Plans.Count) object(s)", 'Apply a backed-up and verified AD batch')) { throw 'AD batch refused.' } + $receipt = Save-PraBatch $Context $Plans $Operation + foreach ($plan in $Plans) { + try { + $before = $plan.Record.Attributes; $groupState = $plan.Record.Licensing + Assert-PraCurrentState $Context $plan $before $groupState.WasMember + $replace = @{}; $clear = New-Object 'Collections.Generic.List[string]' + foreach ($name in $plan.Kinds.Keys) { + if (Test-PraStateEqual $before[$name] $plan.Desired[$name]) { continue } + if ($plan.Desired[$name].Present) { $replace[$name] = ConvertFrom-PraStoredValue $plan.Desired[$name] } else { $clear.Add($name) } + } + $changed = $replace.Count -gt 0 -or $clear.Count -gt 0 + if ($changed) { + $parameters = @{ Identity=[guid]$plan.Record.ObjectGuid; Server=$Context.Server; ErrorAction='Stop'; Confirm=$false } + if ($replace.Count) { $parameters.Replace = $replace }; if ($clear.Count) { $parameters.Clear = $clear.ToArray() } + Invoke-PraAdWrite $Context $receipt $plan 'Set-ADUser' { Set-ADUser @parameters } + Assert-PraCurrentState $Context $plan $plan.Desired $groupState.WasMember -AcceptNewVersion + Write-PraJournal $Context $plan.Record.ObjectGuid 'Set-ADUser' 'Verified' + } + if ($groupState.Enabled -and $groupState.WasMember -ne $groupState.DesiredMember) { + # Re-read before each new write: the group must not have changed. + Assert-PraCurrentState $Context $plan $plan.Desired $groupState.WasMember + $parameters = @{ Identity=[guid]$groupState.GroupGuid; Members=[guid]$plan.Record.ObjectGuid; Server=$Context.Server; ErrorAction='Stop'; Confirm=$false } + if ($groupState.DesiredMember) { Invoke-PraAdWrite $Context $receipt $plan 'Add-ADGroupMember' { Add-ADGroupMember @parameters }; $plan.Row.GroupAction = 'Added' } + else { Invoke-PraAdWrite $Context $receipt $plan 'Remove-ADGroupMember' { Remove-ADGroupMember @parameters }; $plan.Row.GroupAction = 'Removed' } + $changed = $true + } + else { $plan.Row.GroupAction = if ($groupState.Enabled) { 'Preserved' } else { 'N/A' } } + Assert-PraCurrentState $Context $plan $plan.Desired $groupState.DesiredMember + $plan.Row.ADVerified = $true; $plan.Row.ADApplied = $changed; $plan.Row.LastOperation = 'ADVerified' + $plan.Row.FinalStatus = if ($plan.Row.DeproPending) { 'Pending' } elseif ($changed) { 'Success' } else { 'AlreadyDone' } + Write-PraJournal $Context $plan.Record.ObjectGuid $plan.Operation 'Verified' + Write-PraLog -Context $Context -Message "AD VERIFIED | $($plan.Record.SamAccountName) | $($plan.Row.FinalStatus)" -Level Detail + Write-PraAdDelta -Context $Context -Plan $plan -Stage Verified + } + catch { + $plan.Row.FinalStatus = 'Error'; $plan.Row.ADVerified = $false + $plan.Row.Detail += " | FAILED: $($_.Exception.Message) | The object may be partly changed: see the journal and the backup." + try { Write-PraJournal $Context $plan.Record.ObjectGuid $plan.Row.LastOperation 'FailedOrIndeterminate' $_.Exception.Message } + catch { Write-PraLog -Context $Context -Message 'The journal cannot be written any more; the original backups are separate files.' -Level Error } + throw + } + } + $state = [ordered]@{ + SchemaVersion=2; Operation=$Operation; Kind='ADVerified'; Environment=$Context.Config.Environment; RunId=$Context.RunId + BackupFile=[IO.Path]::GetFileName($receipt.Path); BackupHash=$receipt.Hash; SourceBackupHash=$Context.SourceBackupHash + CreatedUtc=[DateTime]::UtcNow.ToString('o') + Records=@($Plans | ForEach-Object { [ordered]@{ ObjectGuid=$_.Record.ObjectGuid; Operation=$_.Operation; ADVerified=$true; VerifiedUsnChanged=$_.ExpectedUsnChanged } }) + } + $statePath = Join-Path (Split-Path $receipt.Path -Parent) ('State-' + $receipt.Data.BatchId + '.json') + Write-PraImmutableFile $statePath ($state | ConvertTo-Json -Depth 12) + Write-PraImmutableFile ($statePath + '.sha256') (Get-PraHash $statePath) + $Context.StateFiles.Add($statePath) + $receipt | Add-Member -NotePropertyName StatePath -NotePropertyValue $statePath + $Context.LastVerifiedReceipt = $receipt + return $receipt + } + catch { + $Context.OperationFailed = $true; $Context.LastVerifiedReceipt = $null + $failure = $_ + try { Write-PraLog -Context $Context -Message "AD batch stopped: $($failure.Exception.Message). No further write in this run." -Level Error } + catch { $Context.Issues.Add([pscustomobject]@{ Message=$failure.Exception.Message; Source='ADBatch' }) } + throw $failure + } + finally { Initialize-PraPermissionCache -Context $Context } +} + +function Import-PraProof { + <# + .SYNOPSIS + Reads and checks a State file (AD proof of a batch) against its backup and its Convert source. + .PARAMETER Source + Receipt of the original Convert backup. + .PARAMETER Operation + Convert, Recover, Finalize or Retention: operation expected in the proof. + #> + [CmdletBinding()] + param([hashtable]$Context, [string]$Path, $Source, [string]$Operation) + $data = Get-Content -LiteralPath $Path -Raw -Encoding UTF8 -ErrorAction Stop | ConvertFrom-Json -ErrorAction Stop + $hash = Get-PraHash $Path + if ((Get-Content -LiteralPath ($Path + '.sha256') -Raw -ErrorAction Stop).Trim() -cne $hash) { throw 'AD proof (State file): SHA-256 mismatch.' } + if ($data.SchemaVersion -ne 2 -or $data.Kind -ne 'ADVerified' -or $data.Environment -cne $Context.Config.Environment -or $data.Operation -cne $Operation) { throw "AD proof (State file) does not match: operation $($data.Operation) instead of $Operation, or another Environment." } + if ([IO.Path]::GetFileName($data.BackupFile) -cne $data.BackupFile) { throw 'AD proof: invalid backup path.' } + $receipt = Import-PraBackup $Context (Join-Path (Split-Path $Path -Parent) $data.BackupFile) + if ($receipt.Hash -cne $data.BackupHash -or $receipt.Data.Operation -cne $Operation -or $receipt.Data.RunId -cne $data.RunId -or $receipt.Data.SourceBackupHash -cne $data.SourceBackupHash) { throw 'AD proof does not match its backup, operation or source.' } + if (@($data.Records).Count -ne @($receipt.Data.Records).Count) { throw 'AD proof incomplete compared with its backup.' } + $expectedSource = if ($Operation -eq 'Convert') { $data.BackupHash } else { $data.SourceBackupHash } + if ($expectedSource -cne $Source.Hash) { throw 'AD proof built from another Convert batch.' } + $seen = @{} + foreach ($record in @($data.Records)) { + if ($record.ADVerified -isnot [bool] -or -not $record.ADVerified -or $record.ObjectGuid -notin @($Source.Data.Records.ObjectGuid) -or $seen.ContainsKey($record.ObjectGuid)) { throw 'AD proof: invalid or duplicated object.' } + $captured = @($receipt.Data.Records | Where-Object ObjectGuid -eq $record.ObjectGuid) + $allowed = switch ($Operation) { Convert { @('Convert') } Recover { @('Recover','Deprovision','AlreadyRecovered') } Finalize { @('Recover','RestoreTag','AlreadyRecovered') } Retention { @('RestoreTag') } default { @() } } + if ($captured.Count -ne 1 -or $record.Operation -notin $allowed -or $record.Operation -cne $captured[0].RequestedOperation -or + $record.VerifiedUsnChanged -isnot [string] -or $record.VerifiedUsnChanged -notmatch '^[1-9][0-9]*$') { throw 'AD proof: operation or version does not match the backup.' } + $null = [int64]::Parse($record.VerifiedUsnChanged, [Globalization.CultureInfo]::InvariantCulture) + $seen[$record.ObjectGuid] = $true + } + if (-not $seen.Count) { throw 'AD proof is empty.' } + return [pscustomobject]@{ Data=$data; Path=$Path; Hash=$hash; Receipt=$receipt } +} + +function Assert-PraFollowupState { + <# + .SYNOPSIS + Before the final restore (Finalize or inline): the object is still exactly as the AD proof left it. + uSNChanged is local to one domain controller: the DC of the proof must be used. + #> + [CmdletBinding()] + param([hashtable]$Context, $Plan, $Proof) + if ($Context.Server -ine $Proof.Receipt.Data.Server) { throw "Finalize: use the domain controller of the proof '$($Proof.Receipt.Data.Server)' (uSNChanged cannot be compared between DCs); set DomainController in the configuration." } + $verified = @($Proof.Data.Records | Where-Object ObjectGuid -eq $Plan.Record.ObjectGuid) + $captured = @($Proof.Receipt.Data.Records | Where-Object ObjectGuid -eq $Plan.Record.ObjectGuid) + if ($verified.Count -ne 1 -or $captured.Count -ne 1) { throw 'Finalize: object not in the AD proof.' } + $previous = $captured[0] + if ($previous.Licensing.Enabled) { + $group = Get-PraGroup $Context $previous.Licensing.GroupGuid + if ($group.DistinguishedName -cne $previous.Licensing.GroupDN -or + ([string]$Plan.User.DistinguishedName -in @($group.member)) -ne $previous.Licensing.DesiredMember) { throw 'Finalize: licence group membership differs from the AD proof.' } + } + # Already finished (replay): only the complete original state is accepted, it needs no write. + $original = $Plan.Row.BackupRec + $complete = $true + foreach ($name in $Plan.Kinds.Keys) { + $sourceState = Get-PraValue $original.Attributes $name $null + if ($null -eq $sourceState -or -not (Test-PraStateEqual $Plan.Record.Attributes[$name] $sourceState)) { $complete = $false } + } + if ($complete -and (-not $Plan.Record.Licensing.Enabled -or $Plan.Record.Licensing.WasMember -eq $Plan.Record.Licensing.DesiredMember)) { return } + if ((Get-PraUsn $Plan.User) -cne $verified[0].VerifiedUsnChanged -or $Plan.User.DistinguishedName -cne $previous.DistinguishedName) { + throw 'Finalize: the AD proof is out of date (version or DN changed). Nothing is overwritten: run the AD phase and the cloud check again.' + } + foreach ($name in $Plan.Kinds.Keys) { + $expected = Get-PraValue $previous.PlannedAttributes $name $null + if ($null -eq $expected -or -not (Test-PraStateEqual $Plan.Record.Attributes[$name] $expected)) { throw "Finalize: $name differs from the AD proof." } + } +} +#endregion + +#region 8. Entra Connect ----------------------------------------------------------------------- + +# Runs one synchronisation cycle and waits for its end. Self-contained: also sent to a remote server. +$script:PraSyncCycle = { + param([string]$PolicyType, [int]$TimeoutMinutes) + $ErrorActionPreference = 'Stop' + Import-Module ADSync -ErrorAction Stop + $deadline = [DateTime]::UtcNow.AddMinutes($TimeoutMinutes) + $clock = [Diagnostics.Stopwatch]::StartNew() + while ((Get-ADSyncScheduler -ErrorAction Stop).SyncCycleInProgress) { + if ([DateTime]::UtcNow -gt $deadline) { throw 'Timeout: a synchronisation cycle was already running.' } + Start-Sleep -Seconds 5 + } + $result = Start-ADSyncSyncCycle -PolicyType $PolicyType -ErrorAction Stop + if ([string]$result.Result -ne 'Success') { throw "Entra Connect refused the cycle: $($result.Result)" } + Start-Sleep -Seconds 10 + while ((Get-ADSyncScheduler -ErrorAction Stop).SyncCycleInProgress) { + if ([DateTime]::UtcNow -gt $deadline) { throw 'Timeout: the synchronisation cycle did not end in time; the cloud part is not started.' } + Start-Sleep -Seconds 5 + } + [pscustomobject]@{ Result = [string]$result.Result; Seconds = [int]$clock.Elapsed.TotalSeconds; Computer = $env:COMPUTERNAME } +} + +function Invoke-PraSync { + <# + .SYNOPSIS + After a verified AD batch (Apply): runs one Entra Connect cycle (EntraConnect.PolicyType) and + waits for its end, on this server (ADSync module) or on EntraConnect.Server (PowerShell remoting). + .DESCRIPTION + EntraConnect.Sync = $false: nothing is run; a warning reminds the operator to synchronise + before the cloud part. The sync is refused if the batch is not proven in this run. + #> + [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low')] + param([hashtable]$Context) + if (-not $Context.AllowMutation -or $Context.Mode -ne 'Apply' -or $Context.Action -notin @('Convert','Recover','Finalize') -or $WhatIfPreference) { return } + $settings = $Context.Config.EntraConnect + if (-not $settings.Sync) { + Write-PraItem -Context $Context -Status Warn -Text 'EntraConnect.Sync = $false: run a delta synchronisation on the Entra Connect server now (Start-ADSyncSyncCycle -PolicyType Delta) or wait for the scheduled one.' + return + } + if (-not $PSCmdlet.ShouldProcess($(if ($settings.Server) { $settings.Server } else { $env:COMPUTERNAME }), 'Start an Entra Connect synchronisation cycle')) { return } + if (-not @($Context.Rows | Where-Object { (Get-PraValue $_ 'ADApplied' $null) -eq $true }).Count) { + Write-PraItem -Context $Context -Status Skip -Text 'No AD change in this run: no synchronisation needed.' + return + } + $receipt = Get-PraValue $Context 'LastVerifiedReceipt' $null + if ($null -eq $receipt -or $receipt.Data.RunId -cne $Context.RunId) { throw 'Synchronisation refused: no verified AD batch in this run.' } + if ([bool](Get-PraValue $Context 'OperationFailed' $false) -or $Context.Issues.Count -gt 0 -or @($Context.Rows | Where-Object FinalStatus -eq 'Error').Count -gt 0) { throw 'Synchronisation refused after an error in this run.' } + $source = if ($receipt.Data.Operation -eq 'Convert') { $receipt } else { Get-PraValue $Context 'Source' $null } + if ($null -eq $source) { throw 'Synchronisation refused: the Convert source of the batch is unknown.' } + $null = Import-PraProof $Context $receipt.StatePath $source $receipt.Data.Operation + if (-not $Context.JournalPath -or -not (Test-Path -LiteralPath $Context.JournalPath -PathType Leaf)) { throw 'Synchronisation refused: the batch journal is missing.' } + $target = if ($settings.Server) { $settings.Server } else { $env:COMPUTERNAME } + $Context.CurrentOperation = 'Start-ADSyncSyncCycle'; $Context.CurrentIdentity = $target + if (-not (& $Context.Approval $target 'Start-ADSyncSyncCycle')) { throw 'Synchronisation refused.' } + Write-PraJournal $Context '*' 'ADSync' 'Started' $target + Write-PraItem -Context $Context -Status Info -Icon Sync -Text ("{0} cycle started on {1}, waiting for its end (max {2} min)..." -f $settings.PolicyType, $target, $settings.TimeoutMinutes) + if ($settings.Server) { + $result = Invoke-Command -ComputerName $settings.Server -ScriptBlock $script:PraSyncCycle -ArgumentList $settings.PolicyType, $settings.TimeoutMinutes -ErrorAction Stop + } + else { $result = & $script:PraSyncCycle $settings.PolicyType $settings.TimeoutMinutes } + Write-PraJournal $Context '*' 'ADSync' 'Completed' $target + Write-PraItem -Context $Context -Status Ok -Icon Sync -Text ("Entra Connect cycle finished on {0} in {1} s (Exchange Online may still need a few minutes)" -f $target, (Get-PraValue $result 'Seconds' 0)) +} +#endregion + +Export-ModuleMember -Function ConvertTo-PraLdapValue, Get-PraHash, Write-PraImmutableFile, New-PraPrivateDirectory, Write-PraJournal, + Initialize-PraDirectory, Get-PraUser, Get-PraTarget, New-PraRow, New-PraPlan, Import-PraBackup, Invoke-PraAdPreview, Invoke-PraAdBatch, + Import-PraProof, Invoke-PraSync, Assert-PraReceipt, Test-PraStateEqual, Assert-PraFollowupState, Initialize-PraPermissionCache + +# SIG # Begin signature block +# MIIghAYJKoZIhvcNAQcCoIIgdTCCIHECAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCp/XznwweHTgBs +# JGdg3k+YX6XhFkRiP1NrPZVZHEPNmaCCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISazCCEmcCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCB0H8ZslCTE +# SbbKYClqQ2JHdw1JtPLxih7RaJ6ImqJ2bjANBgkqhkiG9w0BAQEFAASCAgAR/XFn +# Zp7BE4+t4z2fLIk/UYVW/BFmqRmc2JrpU+7BJes1JuZvVNR+Y+ahalZTjEC+cpZl +# gL/7M7RRyzbmg3ZrvrwMPHFoqL0iCyq1l6TTwlpI2RveIkTWpAoUr8pTCO7MAMKZ +# g69VLxK7yQl8SHlsppqH95S/gPaWpl43YK5r0qJdY6c3cJsE2bKf8WE9bLb+QFkD +# dapOKVDRTEkXMhrnWRz1IEXtHGMgERIk2mXbWdO4CWg98uEbadCyr1LBDnjMUoqO +# /mGZb4g7Th2o8psso4UsDODIAnJtmms0OgA2xO2t1owkXcKEwpnTwAsbZFdrmivi +# 7LrkPA/7rD3myOPP4WrXU9WJCnpzDKciRsWbX9tkkC7B14EwOI+DdwlJvzFVm95b +# APnTbwAycuGOOVdIg2tyNohqfPoQkNMOrLoq+DVuIZCi1frp/jbgnCeJB7dRzWr5 +# AM+TL93WVCDEr2BigYESr1mduqUcQYQt6qgMfLBWqQq/aweAuTf4oQhIpWZcvJ8u +# hhvGxeewOGyCDlsiZo2889pIF61PRssNIHkSO3zLD+2bUPSD5OSDjXCgyGMNB/m1 +# EXofAL40TXPuiLfg1BjgAPvX9uGaKtJwyJUPDg1pT/kRSOvi3iIr/V9v+ymZxCeD +# RAX2tgIBB29fzWXjxRrxbJhl4bGbJLT85Nku06GCDygwgg8kBgorBgEEAYI3AwMB +# MYIPFDCCDxAGCSqGSIb3DQEHAqCCDwEwgg79AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEILUxOUt8soUB8qtOMhrR+4Nzp7rRHEaNvSsIbLsPapXrAggR9oOgm09T +# hRgPMjAyNjEwMTUyMTIzMDNaMAMCAQECEHMEyXZra6P2ysC044zZfKegggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# VzCCAlMCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMjMwM1owKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEIDoUde23ijRW +# srCLUo/v6MpYJ9W2dRZh1Pcc36kQpCYAMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEYwRAIgYTPZ+NUXYQE6MrauUkPPjVdMn16wTp2vjwpP9i/ht10CIA/9HzagNMjU +# Lz0QsGR+SXGYyQNjUrruIjJ7muWQz9Ul +# SIG # End signature block diff --git a/package/module/PRA.Gui.Directory.ps1 b/package/module/PRA.Gui.Directory.ps1 new file mode 100644 index 0000000..9d6f848 --- /dev/null +++ b/package/module/PRA.Gui.Directory.ps1 @@ -0,0 +1,234 @@ +#Requires -Version 5.1 +#Requires -PSEdition Desktop +<# +.SYNOPSIS + Reads the OU list for the WPF selector on the configured writable DC. No directory writes. +.NOTES + Author : Nicolas Fabert + Version : 2.2.0 +#> +[CmdletBinding()] +param([Parameter(Mandatory)][string]$ConfigPath, [Parameter(Mandatory)][string]$ResultPath) +Set-StrictMode -Version Latest +$ErrorActionPreference = 'Stop' +# >>> PRA package integrity bootstrap: identical in every runtime PowerShell file (checked by the tests). +# It authenticates module\Test-PackageIntegrity.ps1 before running it; there is no unsigned or bypass path. +& { + param([Parameter(Mandatory)][string]$PackageRoot) + $verifier = [IO.Path]::GetFullPath([IO.Path]::Combine($PackageRoot, 'module', 'Test-PackageIntegrity.ps1')) + $cursor = $verifier + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + & $verifier -Root $PackageRoot +} ([IO.Path]::GetDirectoryName($PSScriptRoot)) +# <<< PRA package integrity bootstrap +$root = Split-Path $PSScriptRoot -Parent +Import-Module (Join-Path $PSScriptRoot 'PRA.Common.psm1') -Force +Import-Module (Join-Path $PSScriptRoot 'PRA.Directory.psm1') -Force +$context = @{ + Config=$null; Server=''; NamingContext=''; CurrentPhase='BrowseOU'; CurrentOperation=''; CurrentIdentity='' + LogFile=''; Warnings=0; Issues=(New-Object 'Collections.Generic.List[object]'); ExitCode=0; VerboseEnabled=$false +} +try { + $context.Config = Import-PraConfiguration -Path $ConfigPath -Root $root -ScopeOverride @{Mode='Auto';SearchBase='';CsvPath='';GroupDN=''} + $context.Server = $context.Config.DomainController + Initialize-PraDirectory -Context $context + $units = @(Get-ADOrganizationalUnit -Filter * -Server $context.Server -SearchBase $context.NamingContext -SearchScope Subtree -ErrorAction Stop | + Sort-Object DistinguishedName | Select-Object Name,DistinguishedName) + $result = @{ Success=$true; Server=$context.Server; NamingContext=$context.NamingContext; Units=$units } + [IO.File]::WriteAllText($ResultPath,($result | ConvertTo-Json -Depth 5),(New-Object Text.UTF8Encoding($false))) + exit 0 +} +catch { + $result = @{ Success=$false; Error=$_.Exception.Message } + [IO.File]::WriteAllText($ResultPath,($result | ConvertTo-Json -Depth 5),(New-Object Text.UTF8Encoding($false))) + Write-Error $_ -ErrorAction Continue + exit 1 +} +finally { Initialize-PraPermissionCache -Context $context } + +# SIG # Begin signature block +# MIIghAYJKoZIhvcNAQcCoIIgdTCCIHECAQExDzANBglghkgBZQMEAgEFADB5Bgor +# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG +# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCB0+82aJX34Bwm3 +# M8xkViUjJmVdx3r4b0iYm68yvXbrw6CCDW8wggZyMIIEWqADAgECAghkM1HTxzif +# CDANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMx +# EDAOBgNVBAcMB0hvdXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8G +# A1UEAwwoU1NMLmNvbSBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFJTQTAe +# Fw0xNjA2MjQyMDQ0MzBaFw0zMTA2MjQyMDQ0MzBaMHgxCzAJBgNVBAYTAlVTMQ4w +# DAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjERMA8GA1UECgwIU1NMIENv +# cnAxNDAyBgNVBAMMK1NTTC5jb20gQ29kZSBTaWduaW5nIEludGVybWVkaWF0ZSBD +# QSBSU0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCfgxNzqrDG +# bSHL24t6h3TQcdyOl3Ka5LuINLTdgAPGL0WkdJq/Hg9Q6p5tePOf+lEmqT2d0bKU +# Vz77OYkbkStW72fL5gvjDjmMxjX0jD3dJekBrBdCfVgWQNz51ShEHZVkMGE6ZPKX +# 13NMfXsjAm3zdetVPW+qLcSvvnSsXf5qtvzqXHnpD0OctVIFD+8+sbGP0EmtpuNC +# GVQ/8y8Ooct8/hP5IznaJRy4PgBKOm8yMDdkHseudQfYVdIYyQ6KvKNc8HwKp4WB +# wg6vj5lc02AlvINaaRwlE81y9eucgJvcLGfE3ckJmNVz68Qho+Uyjj4vUpjGYDdk +# jLJvSlRyGMwnh/rNdaJjIUy1PWT9K6abVa8mTGC0uVz+q0O9rdATZlAfC9KJpv/X +# gAbxwxECMzNhF/dWH44vO2jnFfF3VkopngPawismYTJboFblSSmNNqf1x1KiVgMg +# Lzh4gL32Bq5BNMuURb2bx4kYHwu6/6muakCZE93vUN8BuvIE1tAx3zQ4XldbyDge +# VtSsSKbt//m4wTvtwiS+RGCnd83VPZhZtEPqqmB9zcLlL/Hr9dQg1Zc0bl0EawUR +# 0tOSjAknRO1PNTFGfnQZBWLsiePqI3CY5NEv1IoTGEaTZeVYc9NMPSd6Ij/D+KNV +# t/nmh4LsRR7Fbjp8sU65q2j3m2PVkUG8qQIDAQABo4H7MIH4MA8GA1UdEwEB/wQF +# MAMBAf8wHwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwMAYIKwYBBQUH +# AQEEJDAiMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTARBgNVHSAE +# CjAIMAYGBFUdIAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwOwYDVR0fBDQwMjAwoC6g +# LIYqaHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0G +# A1UdDgQWBBRUwv4QlQCTzWr158DX2bJLuI8M4zAOBgNVHQ8BAf8EBAMCAYYwDQYJ +# KoZIhvcNAQELBQADggIBAPUPJodwr5miyvXWyfCNZj05gtOII9iCv49UhCe204MH +# 154niU2EjlTRIO5gQ9tXQjzHsJX2vszqoz2OTwbGK1mGf+tzG8rlQCbgPW/M9r1x +# xs19DiBAOdYF0q+UCL9/wlG3K7V7gyHwY9rlnOFpLnUdTsthHvWlM98CnRXZ7WmT +# V7pGRS6AvGW+5xI+3kf/kJwQrfZWsqTU+tb8LryXIbN2g9KR+gZQ0bGAKID+260P +# Z+34fdzZcFt6umi1s0pmF4/n8OdX3Wn+vF7h1YyfE7uVmhX7eSuF1W0+Z0duGwdc +# +1RFDxYRLhHDsLy1bhwzV5Qe/kI0Ro4xUE7bM1eV+jjk5hLbq1guRbfZIsr0WkdJ +# LCjoT4xCPGRo6eZDrBmRqccTgl/8cQo3t51Qezxd96JSgjXktefTCm9r/o35pNfV +# HUvnfWII+NnXrJlJ27WEQRQu9i5gl1NLmv7xiHp0up516eDap8nMLDt7TAp4z5T3 +# NmC2gzyKVMtODWgqlBF1JhTqIDfM63kXdlV4cW3iSTgzN9vkbFnHI2LmvM4uVEv9 +# XgMqyN0eS3FE0HU+MWJliymm7STheh2ENH+kF3y0rH0/NVjLw78a3Z9UVm1F5VPz +# iIorMaPKPlDRADTsJwjDZ8Zc6Gi/zy4WZbg8Zv87spWrmo2dzJTw7XhQf+xkR6Od +# MIIG9TCCBN2gAwIBAgIQBof4ljXihJpmCqqt2mhAWzANBgkqhkiG9w0BAQsFADB4 +# MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24x +# ETAPBgNVBAoMCFNTTCBDb3JwMTQwMgYDVQQDDCtTU0wuY29tIENvZGUgU2lnbmlu +# ZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIxMB4XDTI2MTAxMzAyNDgwMloXDTI3MTAx +# MzAyNDgwMlowXDELMAkGA1UEBhMCRlIxGzAZBgNVBAcMEkNoYW50ZWxvdXAtRW4t +# QnJpZTEXMBUGA1UECgwOTmljb2xhcyBGYWJlcnQxFzAVBgNVBAMMDk5pY29sYXMg +# RmFiZXJ0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsg6CT0mFQ4jB +# V2plIS4uWFSoVqRHd82Y7XYZ4CUTe/7nPBRUlXXdKTZMMHzGgiG8dEXNE8K1Xe90 +# Dgl/FnorzAFlrNWSwf6t27UAUw9xkqtRDVVpVgpixpWkAwjcQeLG+YMqBkGbFi35 +# TGvS23lPFWvLp4DxARrv15MtZ/NjNTCAAGUlMP2hFVBknEmrnYjEGyeJ93sl20RS +# WXQQLNqlenBdkGCrQW4XjHtRjJAEqAC68hN6nWevopSQ8CLUV7A1RFfHFarDrzrL +# zr0/NjIdSyIfM9hShln31NDrktB6Ups2XIyrtPDNB7fjkW4jpLlOqQGfYKsU9ErE +# 4SnFsh0yOOjitegyh1RvZ9wH++3DF4CmJfTli5l/gEIm8xCCryxI+K5EogW3wu1y +# u8NT2hcvHjdh7OpRyPyFAuLZ8MfX7kPAJpnuCeOuktzY/20eVD8bDglj+4zgqzsn +# cR/t6T/7w1/HxpRyrVoKvEyRx+mphYh5jMdEa0BjxOL0vAJpdGZSfXGmPm/yPqRn +# 5STTkMtzkVQXPbcvgKM0luzFcQKPHk3qdHLEXa8gf93ktYDbLE5Wd2UHrXz3SZxN +# URHPdIXCr1qgrqQve7041kMpzrkDI5DnG2lvRG4108gp02bHG0muKyZlDdCOra7h +# Zonu2nO79sFallruzzNi0o994PoWksUCAwEAAaOCAZUwggGRMAwGA1UdEwEB/wQC +# MAAwHwYDVR0jBBgwFoAUVML+EJUAk81q9efA19myS7iPDOMwegYIKwYBBQUHAQEE +# bjBsMEgGCCsGAQUFBzAChjxodHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJD +# QS1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMS5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6 +# Ly9vY3Nwcy5zc2wuY29tMFEGA1UdIARKMEgwCAYGZ4EMAQQBMDwGDCsGAQQBgqkw +# AQMDATAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRv +# cnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwTQYDVR0fBEYwRDBCoECgPoY8aHR0cDov +# L2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtQ29kZVNpZ25pbmctUlNBLTQwOTYt +# UjEuY3JsMB0GA1UdDgQWBBRoUx3630l9wA1fUpkKkw2GUIxl/jAOBgNVHQ8BAf8E +# BAMCB4AwDQYJKoZIhvcNAQELBQADggIBAE3oj6cNuwlDToi1BwjgsA5djfRN4DIi +# BYDFZIRYaIRe/rEdnItz3aqQQdFuwXnJA/MQEmi2WAGek8GeZF+R41s8FbcDxBUE +# BoSt98TuBE+0xgxQWDiPhhXaX1Aw9V0GF4ZnlfCSw1eu2KiASaKn7Bo0PLbEAXff +# vftRXof/kyqtw8iID6I4Rhrf5DI3WVZQodakUUmWnbnziWvEZOWbNOfzwP+7BwEt +# 7jQANfbmEfb4p75rfy5dQVwniTDSvdo6xkrbe1Cr93GS7cJta18IG5CoIVUmdK+s +# W38B1sLuy8Mi0MstMXV3004yaRuzLdNaAM0f9WAFerxemiQC0kdmA44/lWV3lVkM +# WJSwkHBkkSg8Eh0hxcGzTH2xmtDhLJHNNLRwkI9u2Ur+HbLCt50oBgSV8BcCs/1i +# qi884iC/yuX+HIv9YgTUNZ8c4lLaq4VuliJpXLu2buHIsTkO0v0+5oCM91zjTVZm +# ULeH38N0Vr83psiJVuBSxQyt5nRVrpYz7FACq5gtXELkyViq/rGOlJKaRrgQ6WWq +# eoIXqKhVFAdP/jAEm2M8ezoVYsUgPyKY2OcuecV9coulAcxUIUydx6qYiOfsGj5u +# Dy7l4aYjvB771wkUMzUQwxzcDYXJtMMTaWRe6n9EemR67jc73u5CJyFg3PfA5WR1 +# wZislcdCZuS6MYISazCCEmcCAQEwgYwweDELMAkGA1UEBhMCVVMxDjAMBgNVBAgM +# BVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDE0MDIG +# A1UEAwwrU1NMLmNvbSBDb2RlIFNpZ25pbmcgSW50ZXJtZWRpYXRlIENBIFJTQSBS +# MQIQBof4ljXihJpmCqqt2mhAWzANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3 +# AgEMMQowCKACgAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG +# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCAD8jtUftfI +# 3b1j6vG4REZO4UJkos1j2uZWM9DI0hSE5zANBgkqhkiG9w0BAQEFAASCAgBTGYQ9 +# bAollC2XVGaHQlvpSvoqvJhSB8T8tHn2XFeuF+yFZ/mNOUGn4sSPJcU9mPWICmiw +# se8DLd8vkEaLngS8qG+gQZoUOCJCxNJ+qossjlT0hdp/H1TYSfD5Njw3yjqsQ3Be +# z/ocm/rdsvmVZdWNvFBob5ghRu2wfcLeV35AEGYpPdtuwKmLZ68qF9XD0o2yYooC +# 5IHllAkjIgdal3jjgpWHm+sOkhY9tShjPfHSjHVkufuNKl6I9bdIQpnYPVjF2roF +# BL8vSIN/r/c0HmUBgnnARVTUue+Fa8C21+78nG7+Fa3y3scn+swBGOVlG2AJ+lT+ +# QlecGsNpcX1VydWvO9XGhunGR8u69RvL7AH6tgpnaJwMGk4SJ9smG+tV9eyErQ8y +# JYx1DrE1DO7HV96h2U8q0GYF86cVfmkElNwp/lsSjyHcP9cMr11YsJfmMMPyQtr+ +# liqg3ZRblq+Lqy6dGhMoFkyr0LW6b7s3pqsHi6h81WyqVLGZ+0LgzizQeUSKGeQ3 +# QnqtlyYKy/Pu55rRuagYsF0zipsnXNp21Ibb3Z5hOkogeymhR6/scr/+Yuy8wBOa +# 9RyLrrdAs95t5CBSyitvS1YZiL6Y/UI63VXOuD3OFscno6nJX7Gea5hvrDfeIsuM +# xHE7yMZBwHbEjyAR9KY0pDLnHVX08xxsk/3I/qGCDygwgg8kBgorBgEEAYI3AwMB +# MYIPFDCCDxAGCSqGSIb3DQEHAqCCDwEwgg79AgEDMQ0wCwYJYIZIAWUDBAIBMIGJ +# BgsqhkiG9w0BCRABBKB6BHgwdgIBAQYMKwYBBAGCqTABAwYBMDEwDQYJYIZIAWUD +# BAIBBQAEIPU0NuzwlxNHKW34UPgUMtUUCZZzLodHZGhvzBI58I4lAghbQO7vQYIi +# 8BgPMjAyNjEwMTUyMTIzMTdaMAMCAQECEAOdgTc08WPBwT6LY7quyeagggwAMIIE +# /DCCAuSgAwIBAgIQH2sWYtIuG2xd8cDBoGAOODANBgkqhkiG9w0BAQsFADBzMQsw +# CQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAP +# BgNVBAoMCFNTTCBDb3JwMS8wLQYDVQQDDCZTU0wuY29tIFRpbWVzdGFtcGluZyBJ +# c3N1aW5nIFJTQSBDQSBSMTAeFw0yNTAyMTgxNjMyMDJaFw0zNDExMTIxODUwMDVa +# MG4xCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3Rv +# bjERMA8GA1UECgwIU1NMIENvcnAxKjAoBgNVBAMMIVNTTC5jb20gVGltZXN0YW1w +# aW5nIFVuaXQgMjAyNSBFMTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABBv7UVHH +# b+ZVluxPXlfE3M6tg0Xnq8dic+O3vPOCRpalUM1vO9A+GRzSVVjyygHhYrBw62XL +# Fh1kv7e+yRd/aTajggFaMIIBVjAfBgNVHSMEGDAWgBQMnRAljpqnG5mHQ88IfuG9 +# gZD0zzBRBggrBgEFBQcBAQRFMEMwQQYIKwYBBQUHMAKGNWh0dHA6Ly9jZXJ0LnNz +# bC5jb20vU1NMLmNvbS10aW1lU3RhbXBpbmctSS1SU0EtUjEuY2VyMFEGA1UdIARK +# MEgwPAYMKwYBBAGCqTABAwYBMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNz +# bC5jb20vcmVwb3NpdG9yeTAIBgZngQwBBAIwFgYDVR0lAQH/BAwwCgYIKwYBBQUH +# AwgwRgYDVR0fBD8wPTA7oDmgN4Y1aHR0cDovL2NybHMuc3NsLmNvbS9TU0wuY29t +# LXRpbWVTdGFtcGluZy1JLVJTQS1SMS5jcmwwHQYDVR0OBBYEFM582cAEgMUkEGoJ +# 6hyrJT0R/ajSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAgHN1 +# JIW9ZlNip07FfY9r1LJwLKTl1h/y9r1BjDgHMEz7U7J7mAy32JxA1KLyjCCJqNku +# RfhDHGFEfZtjTOru7AQMDSDiUDvCCc3jaz5py9jGvwIe5npkLbXqXhA+SqCzG719 +# USigwhHkYr7v8NiXoaY0Xu03p0BiZZreZlpngmGB9+86N94FqIFx2I5Z5iuu7d4j +# 7aAOZBNxfU9jFDIIGDtWfWeCpF0Q8rLE/3DHDlzJKs5Il3i/VoOl7rTU938oSrxM +# www6GDBlKX8rGHxvkjgIb9MXkVglJSDHsNAZDeCS/inaxKHA+ChuB8K4OxIxa6k1 +# e+eHBypakAY3wuN7w7PlPmhN6k5IdqZn3HZHs2VjoR841Z9wmVPFdGDdkBZ7XOmb +# 5OZUaKufsvtER0VbY2DkzaqAaItt1kc+I+FUz7PiVz2PUzpegkftRRxvrPyIL08b +# lJTnbMQ0XrqDN0rEfuTLv4XhhnKyJaXhxCUdjO/cRumMzZ35QTUMItBWy1xGp0iy +# oFVnAya2pPsVMuAI+sy1zxlOS9l5iSxvKJ8gpnpOgjqYTa7u1eyZo+4JlcGoiiR1 +# 7LthMTrF1q62tO5xOpI8txUZ6gtKGtkJV6wdj+vZLcwKZ2M93GqVpOo6UBlGjx1s +# KsVZ7AIUzJZli4NJ0M2KYcrfNnlebkYKpDnSqWwwggb8MIIE5KADAgECAhBtUhhw +# h+gjTYVgANCAj5NWMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMQ4wDAYD +# VQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjEYMBYGA1UECgwPU1NMIENvcnBv +# cmF0aW9uMTEwLwYDVQQDDChTU0wuY29tIFJvb3QgQ2VydGlmaWNhdGlvbiBBdXRo +# b3JpdHkgUlNBMB4XDTE5MTExMzE4NTAwNVoXDTM0MTExMjE4NTAwNVowczELMAkG +# A1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMREwDwYD +# VQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNvbSBUaW1lc3RhbXBpbmcgSXNz +# dWluZyBSU0EgQ0EgUjEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCu +# URAT0vk8IKAghd7JUBxkyeH9xek0/wp/MUjoclrFXqhh/fGH91Fc+7fm0MHCE7A+ +# wmOiqBj9ODrJAYGq3rm33jCnHSsCBNWAQYyoauLq8IjqsS1JlXL29qDNMMdwZ8UN +# zQS7vWZMDJ40JSGNphMGTIA2qn2bohGtgRc4p1395ESypUOaGvJ3t0FNL3BuKmb6 +# YctMcQUF2sqooMzd89h0E6ujdvBDo6ZwNnWoxj7YmfWjSXg33A5GuY9ym4QZM5OE +# Vgo8ebz/B+gyhyCLNNhh4Mb/4xvCTCMVmNYrBviGgdPZYrym8Zb84TQCmSuX0JlL +# La6WK1aO6qlwISbb9bVGh866ekKblC/XRP20gAu1CjvcYciUgNTrGFg8f8AJgQPO +# Cc1/CCdaJSYwhJpSdheKOnQgESgNmYZPhFOC6IKaMAUXk5U1tjTcFCgFvvArXtK4 +# azAWUOO1Y3fdldIBL6LjkzLUCYJNkFXqhsBVcPMuB0nUDWvLJfPimstjJ8lF4S6E +# CxWnlWi7OElVwTnt1GtRqeY9ydvvGLntU+FecK7DbqHDUd366UreMkSBtzevAc9a +# qoZPnjVMjvFqV1pYOjzmTiVHZtAc80bAfFe5LLfJzPI6DntNyqobpwTevQpHqPDN +# 9qqNO83r3kaw8A9j+HZiSw2AX5cGdQP0kG0vhzfgBwIDAQABo4IBgTCCAX0wEgYD +# VR0TAQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBTdBAkHovV6fVJTEpKV7jiAJQ2m +# WTCBgwYIKwYBBQUHAQEEdzB1MFEGCCsGAQUFBzAChkVodHRwOi8vd3d3LnNzbC5j +# b20vcmVwb3NpdG9yeS9TU0xjb21Sb290Q2VydGlmaWNhdGlvbkF1dGhvcml0eVJT +# QS5jcnQwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMD8GA1UdIAQ4 +# MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3Jl +# cG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwgwOwYDVR0fBDQwMjAwoC6gLIYq +# aHR0cDovL2NybHMuc3NsLmNvbS9zc2wuY29tLXJzYS1Sb290Q0EuY3JsMB0GA1Ud +# DgQWBBQMnRAljpqnG5mHQ88IfuG9gZD0zzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +# hvcNAQELBQADggIBAJIZdQ2mWkLPGQfZ8vyU+sCb8BXpRJZaL3Ez3VDlE3uZk3cP +# xPtybVfLuqaci0W6SB22JTMttCiQMnIVOsXWnIuAbD/aFTcUkTLBI3xys+wEajzX +# aXJYWACDS47BRjDtYlDW14gLJxf8W6DQoH3jHDGGy8kGJFOlDKG7/YrK7UGfHtBA +# EDVe6lyZ+FtCsrk7dD/IiL/+Q3Q6SFASJLQ2XI89ihFugdYL77CiDNXrI2MFspQG +# swXEAGpHuaQDTHUp/LdR3TyrIsLlnzoLskUGswF/KF8+kpWUiKJNC4rPWtNrxlbX +# YRGgdEdx8SMjUTDClldcrknlFxbqHsVmr9xkT2QtFmG+dEq1v5fsIK0vHaHrWjMM +# maJ9i+4qGJSD0stYfQ6v0PddT7EpGxGd867Ada6FZyHwbuQSadMb0K0P0OC2r7rw +# qBUe0BaMqTa6LWzWItgBjGcObXeMxmbQqlEz2YtAcErkZvh0WABDDE4U8GyV/32F +# daAvJgTfe9MiL2nSBioYe/g5mHUSWAay/Ip1RQmQCvmF9sNfqlhJwkjy/1U1ibUk +# TIUBX3HgymyQvqQTZLLys6pL2tCdWcjI9YuLw30rgZm8+K387L7ycUvqrmQ3ZJlu +# jHl3r1hgV76s3WwMPgKk1bAEFMj+rRXimSC+Ev30hXZdqyMdl/il5Ksd0vhGMYIC +# VzCCAlMCAQEwgYcwczELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYD +# VQQHDAdIb3VzdG9uMREwDwYDVQQKDAhTU0wgQ29ycDEvMC0GA1UEAwwmU1NMLmNv +# bSBUaW1lc3RhbXBpbmcgSXNzdWluZyBSU0EgQ0EgUjECEB9rFmLSLhtsXfHAwaBg +# DjgwCwYJYIZIAWUDBAIBoIIBYTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw +# HAYJKoZIhvcNAQkFMQ8XDTI2MTAxNTIxMjMxN1owKAYJKoZIhvcNAQk0MRswGTAL +# BglghkgBZQMEAgGhCgYIKoZIzj0EAwIwLwYJKoZIhvcNAQkEMSIEIOvTCqcRKASV +# gXTsuWu0VUEY04YC/9XDAIdiUswj3bcCMIHJBgsqhkiG9w0BCRACLzGBuTCBtjCB +# szCBsAQgVCr5oWqNci5mEUl4iumUwYqaruWmXLNEolSa+Wx5x4swgYswd6R1MHMx +# CzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVUZXhhczEQMA4GA1UEBwwHSG91c3RvbjER +# MA8GA1UECgwIU1NMIENvcnAxLzAtBgNVBAMMJlNTTC5jb20gVGltZXN0YW1waW5n +# IElzc3VpbmcgUlNBIENBIFIxAhAfaxZi0i4bbF3xwMGgYA44MAoGCCqGSM49BAMC +# BEYwRAIgK2P8Lwh7mYGZIkNWNXaXFMkOBR6fXuBMURN0ttlMdAwCIGjHchA4Z//0 +# 06utByq3AiOwqIqhtKXHlRzuAHU9fp3K +# SIG # End signature block diff --git a/module/PRA.Gui.psm1 b/package/module/PRA.Gui.psm1 similarity index 80% rename from module/PRA.Gui.psm1 rename to package/module/PRA.Gui.psm1 index 3d52bbf..58efdc1 100644 --- a/module/PRA.Gui.psm1 +++ b/package/module/PRA.Gui.psm1 @@ -1,942 +1,1139 @@ -<# -.SYNOPSIS - Native WPF front-end for PRA Remote Mailbox, without directory or cloud imports. -.DESCRIPTION - Every operation runs the existing CLI in Windows PowerShell 5.1 Desktop. A completed, - consistent Preview and an unchanged content fingerprint are required before typed Apply. - Local metadata is indicative; the engine remains the authority for all backup/proof checks. -.NOTES - Author : Nicolas Fabert - Version : 2.1.0 -#> -#Requires -Version 5.1 -Set-StrictMode -Version Latest -$ErrorActionPreference = 'Stop' -$script:Gui = $null -$script:GuiModuleRoot = $PSScriptRoot -$script:GuiInputNames = @('ActionChoice','PhaseChoice','BatchText','BatchChoice','IdentityText','ScopeChoice','LimitText','ExpectChoice','OnceCheck','ConfigPathText','Reload','BrowseConfig','BrowseBatch','BrowseBatchFolder','ConfirmationText','SourceChoice','OuText','CsvText','ChooseOu','BrowseCsv') - -function Get-PraGuiValue { - param($Object, [string]$Name, $Default = $null) - if ($null -eq $Object) { return $Default } - if ($Object -is [Collections.IDictionary]) { - if ($Object.Contains($Name)) { return $Object[$Name] } - } elseif ($Object.PSObject.Properties[$Name]) { return $Object.$Name } - return $Default -} - -function Get-PraGuiBatchType { - param([string]$Action, [string]$Phase) - switch ($Action) { - 'Convert' { if ($Phase -eq 'Cloud') { return 'Convert' }; return '' } - 'Recover' { if ($Phase -eq 'Cloud') { return 'Recover' }; return 'Convert' } - 'Finalize' { return 'RecoverFinalize' } - 'Check' { return 'Convert' } - default { throw 'Unknown action.' } - } -} - -function New-PraGuiRequest { - param( - [ValidateSet('Convert','Recover','Finalize','Check')][string]$Action = 'Convert', - [ValidateSet('Preview','Apply')][string]$Mode = 'Preview', - [ValidateSet('Both','AD','Cloud')][string]$Phase = 'Both', - [string]$Batch = '', [string]$Identity = '', [string]$SearchBase = '', [string]$CsvPath = '', - [ValidateSet('All','UsersOnly','SharedOnly')][string]$Scope = 'All', - [int]$MaxObjects = 0, - [ValidateSet('Provisioned','Deprovisioned','Retained')][string]$Expect = 'Provisioned', - [bool]$Once = $false - ) - foreach ($value in @($Batch, $Identity,$SearchBase,$CsvPath)) { - if ($value -match '[\x00-\x1f]') { throw 'Selection contains a control character.' } - } - if ($MaxObjects -lt 0) { throw 'MaxObjects must be zero or positive.' } - if ($Action -eq 'Convert' -and $Phase -ne 'Cloud' -and $Batch) { throw 'Convert AD/Both must not receive a batch: Apply creates a NEW Convert batch.' } - if (($Action -in @('Recover','Finalize') -or ($Action -eq 'Convert' -and $Phase -eq 'Cloud')) -and -not $Batch) { - throw ('A {0} batch is required.' -f (Get-PraGuiBatchType $Action $Phase)) - } - if ($Action -eq 'Check' -and -not $Batch -and -not $Identity) { throw 'Check requires a Convert batch or one identity (prefer a UPN).' } - if ($Action -eq 'Check' -and $Mode -eq 'Apply') { throw 'Check is always read-only.' } - if ($MaxObjects -and -not ($Action -eq 'Convert' -and $Phase -in @('AD','Both'))) { throw 'MaxObjects is only available for Convert AD/Both.' } - $null=Get-PraTargetOverride -SearchBase $SearchBase -CsvPath $CsvPath -Identity $Identity - if (($SearchBase -or $CsvPath) -and -not ($Action -eq 'Convert' -and $Phase -in @('AD','Both'))) { throw 'OU/CSV selection is only available for Convert AD/Both.' } - return [ordered]@{ - Action=$Action; Mode=$Mode; Phase=$(if ($Action -eq 'Finalize') { 'Finalize' } elseif ($Action -eq 'Check') { 'Cloud' } else { $Phase }) - Batch=$Batch; Identity=$Identity; SearchBase=$SearchBase; CsvPath=$CsvPath; Scope=$Scope; MaxObjects=$MaxObjects - Expect=$(if ($Action -eq 'Check') { $Expect } else { 'Provisioned' }); Once=$Once - } -} - -function ConvertTo-PraGuiNativeArgument { - <# CommandLineToArgvW: double backslashes before quotes and the closing quote. No shell is used. #> - param([AllowEmptyString()][string]$Value) - if ($Value.Contains([string][char]0)) { throw 'NUL is not a valid argument.' } - $escaped = [regex]::Replace($Value, '(\\*)"', '$1$1\"') - $escaped = [regex]::Replace($escaped, '(\\+)$', '$1$1') - return '"' + $escaped + '"' -} - -function Get-PraGuiEngine { - $system = if ([Environment]::Is64BitOperatingSystem -and -not [Environment]::Is64BitProcess) { 'Sysnative' } else { 'System32' } - return Join-Path $env:SystemRoot ($system + '\WindowsPowerShell\v1.0\powershell.exe') -} - -function Get-PraGuiNativeModulePath { - $paths = New-Object 'Collections.Generic.List[string]' - $native = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\Modules' - $paths.Add($native) - $documents = [Environment]::GetFolderPath('MyDocuments') - if ($documents) { $paths.Add((Join-Path $documents 'WindowsPowerShell\Modules')) } - $paths.Add((Join-Path $env:ProgramFiles 'WindowsPowerShell\Modules')) - foreach ($source in @([Environment]::GetEnvironmentVariable('PSModulePath','User'), [Environment]::GetEnvironmentVariable('PSModulePath','Machine'), $env:PSModulePath)) { - foreach ($entry in @($source -split ';')) { - if (-not $entry -or $entry -match '(?i)\\PowerShell\\(7(?:[\\.-]|$)|Modules(?:\\|$))') { continue } - if ($PSVersionTable.PSEdition -eq 'Core' -and $entry.StartsWith($PSHOME,[StringComparison]::OrdinalIgnoreCase)) { continue } - if (-not $paths.Contains($entry)) { $paths.Add($entry) } - } - } - return (@($paths | Select-Object -Unique) -join ';') -} - -function ConvertTo-PraGuiPowerShellLiteral { - param([AllowEmptyString()][string]$Value) - $escaped=$Value.Replace("'","''") - foreach ($code in @(0x2018,0x2019,0x201A,0x201B)) { - $quote=[string][char]$code - $escaped=$escaped.Replace($quote,($quote+$quote)) - } - return "'"+$escaped+"'" -} - -function Get-PraGuiCommand { - param([string]$Root, [string]$ConfigPath, [Collections.IDictionary]$Request, [string]$ScriptPath = '') - if (-not $ScriptPath) { $ScriptPath = Join-Path $Root 'Invoke-PraRemoteMailbox.ps1' } - $tokens = New-Object 'Collections.Generic.List[string]' - foreach ($token in @('-NoProfile','-NonInteractive','-STA','-File', $ScriptPath, '-Action',$Request.Action,'-Mode',$Request.Mode,'-ConfigPath',$ConfigPath,'-Scope',$Request.Scope)) { $tokens.Add([string]$token) } - if ($Request.Action -in @('Convert','Recover')) { $tokens.Add('-Phase'); $tokens.Add([string]$Request.Phase) } - foreach ($name in @('Batch','Identity','SearchBase','CsvPath')) { if ($Request[$name]) { $tokens.Add('-'+$name); $tokens.Add([string]$Request[$name]) } } - if ($Request.Action -eq 'Convert' -and $Request.Phase -in @('AD','Both')) { $tokens.Add('-MaxObjects'); $tokens.Add([string]$Request.MaxObjects) } - if ($Request.Action -eq 'Check') { $tokens.Add('-Expect'); $tokens.Add([string]$Request.Expect) } - if ($Request.Once) { $tokens.Add('-Once') } - if ($Request.Mode -eq 'Apply') { $tokens.Add('-Force') } - $engine = Get-PraGuiEngine - $displayTokens = @($engine) + @($tokens) - return [pscustomobject]@{ - FilePath=$engine; Tokens=$tokens.ToArray() - Arguments=(@($tokens | ForEach-Object { ConvertTo-PraGuiNativeArgument $_ }) -join ' ') - Display='& ' + ((@($displayTokens | ForEach-Object { ConvertTo-PraGuiPowerShellLiteral $_ })) -join ' ') - } -} - -function Get-PraGuiFileHash { - param([string]$Path) - return (Get-FileHash -LiteralPath $Path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLowerInvariant() -} - -function ConvertTo-PraGuiHash { - param([string]$Value) - $hash=$Value.Trim() - if ($hash -notmatch '^[a-fA-F0-9]{64}$') { throw 'Invalid SHA-256 hexadecimal value.' } - return $hash.ToLowerInvariant() -} - -function Read-PraGuiBatch { - param([string]$Path, [string]$Environment) - $item = [pscustomobject]@{ Path=$Path; Folder=(Split-Path $Path -Parent); Operation='?'; BatchId=''; Status=''; Valid=$false; Data=$null; Label=''; CopyPaths=@() } - try { - $data = [IO.File]::ReadAllText($Path) | ConvertFrom-Json -ErrorAction Stop - $item.Operation = [string](Get-PraGuiValue $data 'Operation' '?') - $item.BatchId = [string](Get-PraGuiValue $data 'BatchId' ((Split-Path $item.Folder -Leaf) -replace '^(Batch|Finalize)-','')) - if ($item.Operation -notin @('Convert','Recover','RecoverFinalize')) { throw 'Not a Convert, Recover or RecoverFinalize package.' } - if ((Get-PraGuiValue $data 'Kind' '') -eq 'ADVerified') { throw 'State/proof is not a batch.' } - if ((Get-PraGuiValue $data 'Environment' '') -cne $Environment) { throw 'Environment differs from configuration.' } - $schema = Get-PraGuiValue $data 'SchemaVersion' 1 - if (($item.Operation -eq 'RecoverFinalize' -and $schema -ne 2) -or $schema -notin @(1,2,3)) { throw 'Unsupported schema.' } - $records = @(if ($item.Operation -eq 'RecoverFinalize') { Get-PraGuiValue $data 'Items' @() } else { Get-PraGuiValue $data 'Records' @() }) - if (-not $records.Count -or $null -eq $records[0]) { throw 'Empty or missing records.' } - if ($schema -ge 2 -and ((ConvertTo-PraGuiHash ([IO.File]::ReadAllText($Path+'.sha256'))) -cne (Get-PraGuiFileHash $Path))) { throw 'SHA-256 mismatch.' } - $item.Data=$data; $item.Valid=$true; $item.Status='Métadonnées lisibles — validation moteur requise' - } catch { $item.Status='INVALIDE : '+$_.Exception.Message } - $item.Label='{0} · {1} · {2}' -f $item.Operation,$item.BatchId,$item.Status - return $item -} - -function Read-PraGuiState { - param([string]$Root, [string]$ConfigPath, [hashtable]$ScopeOverride=@{}) - $state = [pscustomobject]@{ Root=$Root; ConfigPath=$ConfigPath; Config=$null; ConfigError=''; Batches=@(); BatchError='' } - try { $state.Config = Import-PraConfiguration -Path $ConfigPath -Root $Root -ScopeOverride $ScopeOverride } - catch { $state.ConfigError=$_.Exception.Message; return $state } - $folder = [string]$state.Config.Storage.BackupFolder - if (-not (Test-Path -LiteralPath $folder)) { $state.BatchError='Backup folder not present yet: '+$folder; return $state } - try { - $state.Batches = @(Get-ChildItem -LiteralPath $folder -Recurse -File -Filter '*.json' -ErrorAction Stop | - Where-Object { $_.Name -notlike 'State-*' -and $_.Name -notlike 'Journal-*' -and (Split-Path $_.DirectoryName -Leaf) -match '^(Batch|Finalize)-' } | - ForEach-Object { Read-PraGuiBatch -Path $_.FullName -Environment $state.Config.Environment }) - } catch { $state.BatchError=$_.Exception.Message } - return $state -} - -function Resolve-PraGuiBatch { - param([string]$Value, [string]$Operation, $State) - if (-not $Value) { return $null } - if ($Value -match '^[a-fA-F0-9]{8,32}$') { - $found = @($State.Batches | Where-Object { $_.BatchId.StartsWith($Value,[StringComparison]::OrdinalIgnoreCase) -and $_.Operation -eq $Operation }) - if ($found.Count -gt 1) { - $hashes=@($found | ForEach-Object { Get-PraGuiFileHash $_.Path } | Select-Object -Unique) - if ($hashes.Count -ne 1) { throw 'Batch ID ambiguous: matching files have different contents. Give an exact JSON path.' } - $found=@($found | Sort-Object @{ - Expression={ - $prefix=if ($_.Operation -eq 'RecoverFinalize') { 'Finalize-' } else { 'Batch-' } - if ((Split-Path $_.Folder -Leaf) -ieq ($prefix+$_.BatchId)) { 0 } else { 1 } - } - },Path) - $selected=$found[0] - $selected.CopyPaths=@($found | ForEach-Object Path | Select-Object -Unique) - $found=@($selected) - } - } else { - $path = $Value - if (-not [IO.Path]::IsPathRooted($path)) { $path=Join-Path $State.Root $path } - $entry = Get-Item -LiteralPath $path -ErrorAction Stop - $found = @(if ($entry.PSIsContainer) { - @(Get-ChildItem -LiteralPath $entry.FullName -File -Filter '*.json' -ErrorAction Stop | Where-Object Name -NotLike 'State-*' | - ForEach-Object { Read-PraGuiBatch $_.FullName $State.Config.Environment } | Where-Object Operation -eq $Operation) - } else { Read-PraGuiBatch $entry.FullName $State.Config.Environment }) - } - if ($found.Count -ne 1) { throw 'Batch not found or ambiguous. Give its exact JSON file; check the configuration backup folder.' } - $batch = $found[0] - if (-not $batch.Valid) { throw $batch.Status } - if ($batch.Operation -cne $Operation) { throw "Expected $Operation, not $($batch.Operation)." } - return $batch -} - -function Get-PraGuiGuard { - <# Content, not timestamps: all selected batch artifacts and the original Convert source are guarded. #> - param([string]$Root, [string]$ConfigPath, [Collections.IDictionary]$Request) - $override=Get-PraTargetOverride -SearchBase ([string]$Request.SearchBase) -CsvPath ([string]$Request.CsvPath) -Identity $Request.Identity - $state = Read-PraGuiState $Root $ConfigPath -ScopeOverride $override - if ($state.ConfigError) { throw $state.ConfigError } - $configFile = $ConfigPath - if (-not [IO.Path]::IsPathRooted($configFile)) { $configFile=Join-Path $Root $configFile } - $files = New-Object 'Collections.Generic.List[string]' - $files.Add([IO.Path]::GetFullPath($configFile)) - $files.Add((Join-Path $Root 'Invoke-PraRemoteMailbox.ps1')) - $moduleFolder=Join-Path $Root 'module' - if (Test-Path -LiteralPath $moduleFolder -PathType Container) { - foreach ($file in @(Get-ChildItem -LiteralPath $moduleFolder -Recurse -File -ErrorAction Stop | - Where-Object { $_.Extension -in @('.psm1','.psd1','.ps1','.dll','.xaml') })) { $files.Add($file.FullName) } - } - foreach ($path in @($state.Config.Scope.CsvPath, $state.Config.SharedMailbox.CsvPath)) { if ($path) { $files.Add([string]$path) } } - if ($state.Config.Scope.Mode -eq 'Csv' -and $Request.Action -eq 'Convert' -and $Request.Phase -in @('AD','Both') -and -not $Request.Identity) { - $null=@(Read-PraTargetCsv -Path $state.Config.Scope.CsvPath) - } - $batch = Resolve-PraGuiBatch $Request.Batch (Get-PraGuiBatchType $Request.Action $Request.Phase) $state - if ($batch) { - foreach ($file in @(Get-ChildItem -LiteralPath $batch.Folder -Recurse -File -ErrorAction Stop)) { $files.Add($file.FullName) } - foreach ($copy in $batch.CopyPaths) { - foreach ($file in @(Get-ChildItem -LiteralPath (Split-Path $copy -Parent) -Recurse -File -ErrorAction Stop)) { $files.Add($file.FullName) } - } - if ($Request.Action -in @('Convert','Recover') -and $Request.Phase -eq 'Cloud') { - $proofPath = Join-Path $batch.Folder ('State-'+$batch.Data.BatchId+'.json') - $proof = [IO.File]::ReadAllText($proofPath) | ConvertFrom-Json -ErrorAction Stop - if ((Get-PraGuiValue $proof 'Kind' '') -cne 'ADVerified' -or (Get-PraGuiValue $proof 'Operation' '') -cne $Request.Action -or - (Get-PraGuiValue $proof 'Environment' '') -cne $state.Config.Environment -or - (ConvertTo-PraGuiHash ([IO.File]::ReadAllText($proofPath+'.sha256'))) -cne (Get-PraGuiFileHash $proofPath)) { throw 'Missing, invalid or mismatched AD proof.' } - } - if ($Request.Action -eq 'Recover' -and $Request.Phase -eq 'Cloud') { - $hash = [string](Get-PraGuiValue $batch.Data 'SourceBackupHash' '') - if (-not $hash) { throw 'Recover batch lacks its original Convert source hash.' } - $hash=ConvertTo-PraGuiHash $hash - $sources = @($state.Batches | Where-Object { $_.Valid -and $_.Operation -eq 'Convert' -and (Get-PraGuiFileHash $_.Path) -ceq $hash }) - if (-not $sources.Count) { throw 'Copy the ORIGINAL Convert folder into Storage.BackupFolder as well as the Recover folder.' } - foreach ($source in $sources) { - foreach ($file in @(Get-ChildItem -LiteralPath $source.Folder -Recurse -File -ErrorAction Stop)) { $files.Add($file.FullName) } - } - } - } - $selection = [ordered]@{} - foreach ($key in @('Action','Phase','Batch','Identity','SearchBase','CsvPath','Scope','MaxObjects','Expect','Once')) { $selection[$key]=$Request[$key] } - $artifactHashes = @(foreach ($path in @($files | Sort-Object -Unique)) { [ordered]@{ Path=$path; Hash=(Get-PraGuiFileHash $path) } }) - $payload = [ordered]@{ Root=[IO.Path]::GetFullPath($Root); Selection=$selection; Artifacts=$artifactHashes } | ConvertTo-Json -Depth 8 -Compress - $sha = [Security.Cryptography.SHA256]::Create() - try { return ([BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($payload)))).Replace('-','').ToLowerInvariant() } - finally { $sha.Dispose() } -} - -function Test-PraGuiResult { - param($Result, [Collections.IDictionary]$Request, [int]$NativeExitCode, [string[]]$TransportIssues=@(), [string]$StandardError='') - if ($TransportIssues.Count -or $StandardError.Trim() -or $null -eq $Result) { return $false } - foreach ($field in @('kind','status','exitCode','action','mode','phase','success','error','pending','skipped','planned','total')) { - if ($null -eq (Get-PraGuiValue $Result $field)) { return $false } - } - if ($Result.kind -cne 'result' -or $Result.action -cne $Request.Action -or $Result.mode -cne $Request.Mode -or $Result.phase -cne $Request.Phase) { return $false } - if ([string]$Result.exitCode -notmatch '^[012]$' -or [int]$Result.exitCode -ne $NativeExitCode -or $NativeExitCode -eq 1) { return $false } - foreach ($field in @('success','error','pending','skipped','planned','total')) { if ([string]$Result.$field -notmatch '^\d+$') { return $false } } - if ([int]$Result.error -ne 0 -or @((Get-PraGuiValue $Result 'issues' @())).Count) { return $false } - if ([int64]$Result.total -ne ([int64]$Result.success+[int64]$Result.error+[int64]$Result.pending+[int64]$Result.skipped+[int64]$Result.planned)) { return $false } - if ($NativeExitCode -eq 2) { return $Result.status -ceq 'Pending' -and [int]$Result.pending -gt 0 } - return $Result.status -cin @('Success','Planned') -and [int]$Result.pending -eq 0 -} - -function Test-PraGuiPreview { - param($Result, [Collections.IDictionary]$Request, [int]$NativeExitCode, [string[]]$TransportIssues=@(), [string]$StandardError='') - if ($Request.Mode -ne 'Preview' -or $Request.Action -eq 'Check') { return $false } - if (-not (Test-PraGuiResult $Result $Request $NativeExitCode $TransportIssues $StandardError)) { return $false } - return ([int64]$Result.success+[int64]$Result.pending+[int64]$Result.planned) -gt 0 -} - -function Read-PraGuiEvents { - param([string]$Path, [long]$Position=0) - $result = [pscustomobject]@{ Events=@(); Errors=@(); Position=$Position; HasPartial=$false } - if (-not (Test-Path -LiteralPath $Path)) { return $result } - $stream = [IO.File]::Open($Path,[IO.FileMode]::Open,[IO.FileAccess]::Read,[IO.FileShare]::ReadWrite) - $last=-1 - try { - if ($stream.Length -lt $Position) { $result.Errors=@('Event file truncated.'); return $result } - if ($stream.Length -eq $Position) { return $result } - $length=$stream.Length - [void]$stream.Seek($Position,[IO.SeekOrigin]::Begin) - $buffer = New-Object byte[] ([int][Math]::Min(1048576,($length-$Position))) - $read=$stream.Read($buffer,0,$buffer.Length) - if ($read -gt 0) { $last=[Array]::LastIndexOf($buffer,[byte]10,($read-1),$read) } - if ($last -lt 0 -and $read -gt 0 -and $stream.Position -lt $length) { - # A single polling message may exceed the normal chunk. Expand until LF - # (or the snapshotted EOF); never advance past an unfinished record. - $expanded=[IO.MemoryStream]::new() - try { - $expanded.Write($buffer,0,$read) - while ($last -lt 0 -and $stream.Position -lt $length) { - $chunk=New-Object byte[] ([int][Math]::Min(1048576,($length-$stream.Position))) - $count=$stream.Read($chunk,0,$chunk.Length) - if ($count -le 0) { break } - $offset=$expanded.Length - $expanded.Write($chunk,0,$count) - $newline=[Array]::LastIndexOf($chunk,[byte]10,($count-1),$count) - if ($newline -ge 0) { $last=[int]($offset+$newline) } - } - $buffer=$expanded.ToArray() - $read=$buffer.Length - } finally { $expanded.Dispose() } - } - } finally { $stream.Dispose() } - $result.HasPartial=$last -lt ($read-1) - if ($last -lt 0) { return $result } - $events=New-Object 'Collections.Generic.List[object]' - $errors=New-Object 'Collections.Generic.List[string]' - $text=[Text.Encoding]::UTF8.GetString($buffer,0,$last+1).TrimStart([char]0xfeff) - foreach ($line in $text.Split([char]10)) { - if (-not $line.Trim()) { continue } - try { - $record=$line | ConvertFrom-Json -ErrorAction Stop - if ((Get-PraGuiValue $record 'kind' '') -notin @('start','step','item','summary','result')) { throw 'Unknown or missing event kind.' } - $events.Add($record) - } catch { $errors.Add('Invalid event JSONL: '+$_.Exception.Message) } - } - $result.Events=$events.ToArray(); $result.Errors=$errors.ToArray(); $result.Position=$Position+$last+1 - return $result -} - -function Start-PraGuiChildProcess { - param($Command, [string]$Root, [string]$EventPath) - if (-not (Test-Path -LiteralPath $Command.FilePath -PathType Leaf)) { throw 'Windows PowerShell 5.1 Desktop is unavailable.' } - $info=New-Object Diagnostics.ProcessStartInfo - $info.FileName=$Command.FilePath; $info.Arguments=$Command.Arguments; $info.WorkingDirectory=$Root - $info.UseShellExecute=$false; $info.CreateNoWindow=$true - $info.RedirectStandardOutput=$true; $info.RedirectStandardError=$true - $info.EnvironmentVariables['PSModulePath']=Get-PraGuiNativeModulePath - $info.EnvironmentVariables['PRA_EVENT_FILE']=$EventPath - $info.EnvironmentVariables['PRA_ICONS']='Ascii' - $info.EnvironmentVariables.Remove('PRA_STOP_FILE') - $process=[Diagnostics.Process]::Start($info) - # Native Tasks drain both pipes; never execute PowerShell callbacks on background CLR threads. - return [pscustomobject]@{ Process=$process; Output=$process.StandardOutput.ReadToEndAsync(); Errors=$process.StandardError.ReadToEndAsync() } -} - -function Initialize-PraGuiTheme { - param([ValidateSet('System','Light','Dark')][string]$Theme='System') - Add-Type -AssemblyName PresentationFramework,PresentationCore,WindowsBase,System.Xaml - $app=[Windows.Application]::Current - if (-not $app) { $app=New-Object Windows.Application; $app.ShutdownMode=[Windows.ShutdownMode]::OnExplicitShutdown } - $property=[Windows.Application].GetProperty('ThemeMode') - $dark=$false - if ($property) { - $dark=$Theme -eq 'Dark' - if ($Theme -eq 'System') { - $setting=Get-ItemProperty -LiteralPath 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize' -ErrorAction SilentlyContinue - $dark=$null -ne $setting -and (Get-PraGuiValue $setting 'AppsUseLightTheme' 1) -eq 0 - } - # PropertyType is only resolved after the reflection guard; 5.1 never binds ThemeMode. - $mode=[Activator]::CreateInstance($property.PropertyType,[object[]]@($(if ($dark) { 'Dark' } else { 'Light' }))) - $property.SetValue($app,$mode,$null) - } - return [pscustomobject]@{ Fluent=($null -ne $property); Dark=$dark } -} - -function Set-PraGuiTheme { - param($Window, $Theme) - $colors=@{ - ApplicationBackgroundBrush=@('#F7F4EF','#202020'); CardBackgroundFillColorDefaultBrush=@('#FFFFFF','#2B2B2B') - CardStrokeColorDefaultBrush=@('#DEDEDE','#3D3D3D'); TextFillColorPrimaryBrush=@('#242424','#FFFFFF') - TextFillColorSecondaryBrush=@('#5C5C5C','#C5C5C5'); PraBrand=@('#B11F4B','#FD8EA1') - PraCritical=@('#DC2626','#F87171'); PraSuccess=@('#16A34A','#4ADE80'); PraCaution=@('#B45309','#FBBF24') - AccentFillColorDefaultBrush=@('#B11F4B','#FD8EA1'); AccentButtonBackground=@('#B11F4B','#FD8EA1') - AccentButtonBorderBrush=@('#B11F4B','#FD8EA1') - } - foreach ($key in $colors.Keys) { - if ($Theme.Fluent -and $key -notlike 'Pra*' -and $key -notlike 'Accent*') { continue } - $color=$colors[$key][[int][bool]$Theme.Dark] - $brush=[Windows.Media.SolidColorBrush]::new([Windows.Media.ColorConverter]::ConvertFromString($color)) - $brush.Freeze(); $Window.Resources[$key]=$brush - } - if ($Theme.Fluent) { - # The local padding/grid styles must inherit the native implicit Fluent styles; - # otherwise they mask Fluent's templates and WPF falls back to classic controls. - foreach ($name in @('BrowseConfig','Reload','BrowseBatch','BrowseBatchFolder','OpenBatch','Preview','Apply','CopyCommand','OpenLog','OpenCsv','OpenHtml','CopyBatch','OpenBackup', - 'ConfigPathText','BatchText','IdentityText','LimitText','ConfirmationText','CommandText','NextStepsText', - 'ThemeChoice','ActionChoice','PhaseChoice','BatchChoice','ScopeChoice','ExpectChoice','BatchGrid','PreviewGrid','SourceChoice','OuText','CsvText','ChooseOu','BrowseCsv')) { - $control=$Window.FindName($name) - $baseStyle=[Windows.Application]::Current.TryFindResource($control.GetType()) - if ($baseStyle -is [Windows.Style]) { - $style=[Windows.Style]::new($control.GetType(),$baseStyle) - if ($control.Style) { foreach ($setter in $control.Style.Setters) { $style.Setters.Add($setter) } } - $control.Style=$style - } - } - } - $apply=$Window.FindName('Apply') - if ($apply) { - $accent=if ($Theme.Fluent) { $Window.TryFindResource('AccentButtonStyle') } else { $null } - if ($accent) { - $style=[Windows.Style]::new([Windows.Controls.Button],$accent) - $style.Setters.Add([Windows.Setter]::new([Windows.Controls.Control]::PaddingProperty,[Windows.Thickness]::new(12,6,12,6))) - $style.Setters.Add([Windows.Setter]::new([Windows.FrameworkElement]::MarginProperty,[Windows.Thickness]::new(0,0,8,6))) - $apply.Style=$style - } else { - $apply.SetResourceReference([Windows.Controls.Control]::BackgroundProperty,'PraBrand') - $apply.Foreground=[Windows.Media.Brushes]::White - } - } -} - -function Get-PraGuiChoice { - param($Control) - return [string]$Control.SelectedItem.Content -} - -function Get-PraGuiWindowRequest { - param([string]$Mode='Preview') - $c=$script:Gui.Controls - $action=Get-PraGuiChoice $c.ActionChoice; $phase=Get-PraGuiChoice $c.PhaseChoice - $limit=0 - if ($action -eq 'Convert' -and $phase -ne 'Cloud') { - if (-not [int]::TryParse($c.LimitText.Text,[ref]$limit)) { throw 'Maximum must be an integer.' } - } - $batch=if ($action -eq 'Convert' -and $phase -ne 'Cloud') { '' } else { $c.BatchText.Text.Trim() } - $once=$c.OnceCheck.IsChecked -eq $true -and ($action -eq 'Check' -or ($action -in @('Convert','Recover') -and $phase -ne 'AD')) - $identity=$c.IdentityText.Text.Trim(); $ou=''; $csv='' - if ($action -eq 'Convert' -and $phase -in @('AD','Both')) { - switch (Get-PraGuiChoice $c.SourceChoice) { - 'OU' { $ou=$c.OuText.Text.Trim(); $identity=''; if (-not $ou) { throw 'Choisir ou saisir le DN de l''OU.' } } - 'Csv' { $csv=$c.CsvText.Text.Trim(); $identity=''; if (-not $csv) { throw 'Charger un CSV avec une colonne Identity.' } } - } - } - return New-PraGuiRequest -Action $action -Mode $Mode -Phase $phase -Batch $batch -Identity $identity -SearchBase $ou -CsvPath $csv -Scope (Get-PraGuiChoice $c.ScopeChoice) -MaxObjects $limit -Expect (Get-PraGuiChoice $c.ExpectChoice) -Once $once -} - -function Add-PraGuiLine { - param([string]$Text, [string]$Status='Info') - $g=$script:Gui - $key=switch ($Status) { 'Fail' { 'PraCritical' } 'Warn' { 'PraCaution' } 'Ok' { 'PraSuccess' } default { 'TextFillColorSecondaryBrush' } } - $g.Lines.Add([pscustomobject]@{ Text=$Text; Brush=$g.Form.TryFindResource($key) }) - while ($g.Lines.Count -gt 2000) { $g.Lines.RemoveAt(0) } - $g.Controls.ActivityLog.ScrollIntoView($g.Lines[$g.Lines.Count-1]) -} - -function Update-PraGuiSelection { - param([switch]$Invalidate) - $g=$script:Gui - if (-not $g -or $g.Updating) { return } - $g.Updating=$true - try { - if ($Invalidate) { $g.Pending=$null; $g.Controls.ConfirmationText.Clear() } - $c=$g.Controls; $action=Get-PraGuiChoice $c.ActionChoice - if ($g.LastAction -in @('Convert','Recover')) { $g.ExecutionPhase=Get-PraGuiChoice $c.PhaseChoice } - $phase=switch ($action) { 'Check' { 'Cloud' } 'Finalize' { 'AD' } default { $g.ExecutionPhase } } - foreach ($item in $c.PhaseChoice.Items) { if ($item.Content -eq $phase) { $c.PhaseChoice.SelectedItem=$item } } - $g.LastAction=$action - $busy=[bool]$g.Run -or [bool]$g.OuLookup - $c.PhaseChoice.IsEnabled=($action -in @('Convert','Recover') -and -not $busy) - $selectSource=$action -eq 'Convert' -and $phase -in @('AD','Both') - $source=Get-PraGuiChoice $c.SourceChoice - $c.SourcePanel.Visibility=if ($selectSource) { 'Visible' } else { 'Collapsed' } - $c.OuPanel.Visibility=if ($selectSource -and $source -eq 'OU') { 'Visible' } else { 'Collapsed' } - $c.CsvPanel.Visibility=if ($selectSource -and $source -eq 'Csv') { 'Visible' } else { 'Collapsed' } - $single=-not $selectSource -or $source -eq 'Configuration' - $c.IdentityText.Visibility=if ($single) { 'Visible' } else { 'Collapsed' } - $c.IdentityLabel.Visibility=$c.IdentityText.Visibility - $c.ChooseOu.IsEnabled=$selectSource -and $source -eq 'OU' -and -not $busy - $c.BrowseCsv.IsEnabled=$selectSource -and $source -eq 'Csv' -and -not $busy - $c.BatchPanel.Visibility=if ($action -eq 'Convert' -and $phase -ne 'Cloud') { 'Collapsed' } else { 'Visible' } - $c.LimitPanel.Visibility=if ($action -eq 'Convert' -and $phase -ne 'Cloud') { 'Visible' } else { 'Collapsed' } - $c.ExpectPanel.Visibility=if ($action -eq 'Check') { 'Visible' } else { 'Collapsed' } - $c.OnceCheck.Visibility=if ($action -eq 'Check' -or ($action -in @('Convert','Recover') -and $phase -ne 'AD')) { 'Visible' } else { 'Collapsed' } - $c.ConfirmationText.Visibility=if ($action -eq 'Check') { 'Collapsed' } else { 'Visible' } - $type=Get-PraGuiBatchType $action $phase - $c.BatchChoice.ItemsSource=@($g.State.Batches | Where-Object { $_.Operation -eq $type -or -not $_.Valid }) - $guide=switch ($action) { - 'Convert' { if ($phase -eq 'Cloud') { 'Cloud seul : batch CONVERT issu du précédent Apply AD, avec sa preuve State. Aucun accès AD. Copier le dossier complet.' } else { 'AD/Both : périmètre configuré ou identité, sans batch. Apply crée un nouveau batch Convert. AD seul : copier ensuite ce batch sur le serveur cloud.' } } - 'Recover' { if ($phase -eq 'Cloud') { 'Cloud seul : batch RECOVER issu de Apply AD + dossier CONVERT original dans Storage.BackupFolder. Produit un package RecoverFinalize si une restauration finale AD reste à faire ; aucune écriture AD, même avec RSAT.' } else { 'AD/Both : batch CONVERT ORIGINAL obligatoire. AD seul : copier le nouveau batch Recover ET le Convert original sur le serveur cloud.' } } - 'Finalize' { 'AD seulement : choisir le manifeste RecoverFinalize produit par Recover Cloud. Restaurer les derniers attributs confirmés par le cloud ; aucun appel cloud ici.' } - 'Check' { 'Lecture seule : batch CONVERT ou une identité UPN, sans écriture. Expect précise le résultat attendu ; Once fait un seul passage.' } - } - $c.OperationGuide.Text=$guide - $c.Apply.IsEnabled=$false; $c.Preview.IsEnabled=$false; $c.ValidationText.Text='' - $c.ConfirmationInfo.Text='' - if (-not $g.Run) { $c.CommandText.Clear() } - try { - if ($c.ConfigPathText.Text.Trim() -cne $g.ConfigPath) { throw 'Recharger la configuration sélectionnée avant de lancer.' } - $request=if ($g.Run) { $g.Run.Request } else { Get-PraGuiWindowRequest } - $override=Get-PraTargetOverride -SearchBase $request.SearchBase -CsvPath $request.CsvPath -Identity $request.Identity - $effective=if ($override.Count) { Read-PraGuiState $g.Root $g.ConfigPath -ScopeOverride $override } else { $g.State } - if ($effective.ConfigError) { throw $effective.ConfigError } - if ($request.CsvPath) { - $entries=@(Read-PraTargetCsv -Path $effective.Config.Scope.CsvPath) - $c.CsvInfo.Text='{0} objet(s) listé(s) · Identity · contenu vérifié à nouveau avant Apply' -f $entries.Count - } - $null=Resolve-PraGuiBatch $request.Batch (Get-PraGuiBatchType $request.Action $request.Phase) $g.State - $c.CommandText.Text=(Get-PraGuiCommand $g.Root $g.ConfigPath $request).Display - $c.Preview.IsEnabled=-not $busy - $target=if ($request.Identity) { $request.Identity } else { 'Scope '+$request.Scope } - if (-not $request.Identity -and $action -eq 'Convert' -and $phase -ne 'Cloud') { - $configured=$effective.Config.Scope - $target+=' · '+$configured.Mode+' '+$configured.SearchBase+' '+$configured.GroupDN+' '+$configured.CsvPath - } - $inputBatch=if ($request.Batch) { $request.Batch } elseif ($action -eq 'Convert') { 'NOUVEAU (aucun batch en entrée)' } else { 'aucun (identité)' } - $c.ConfirmationInfo.Text='{0} · phase {1} · {2} · batch {3}. Preview obligatoire ; saisir exactement {4} pour autoriser Apply.' -f $action,$request.Phase,$target,$inputBatch,$action.ToUpperInvariant() - if ($action -eq 'Check') { $c.ConfirmationInfo.Text='Check · Cloud · '+$target+' · batch '+$inputBatch+' · lecture seule, aucune écriture et aucun Apply.' } - if ($g.Pending -and -not $busy -and $c.ConfirmationText.Text -ceq $action.ToUpperInvariant()) { - $c.Apply.IsEnabled=(Get-PraGuiGuard $g.Root $g.ConfigPath $request) -ceq $g.Pending.Guard - if (-not $c.Apply.IsEnabled) { $g.Pending=$null; $c.ValidationText.Text='Fichiers modifiés : nouveau Preview obligatoire.' } - } - } catch { $c.ValidationText.Text=$_.Exception.Message } - } finally { $g.Updating=$false } -} - -function Update-PraGuiState { - $g=$script:Gui - $g.Pending=$null; $g.Controls.ConfirmationText.Clear() - $g.ConfigPath=$g.Controls.ConfigPathText.Text.Trim() - $g.State=Read-PraGuiState $g.Root $g.ConfigPath - $c=$g.Controls; $c.BatchGrid.ItemsSource=@($g.State.Batches) - $c.BatchStatus.Text=$g.State.BatchError - if ($g.State.ConfigError) { $c.ConfigStatus.Text='Configuration INVALIDE : '+$g.State.ConfigError; $c.HeaderInfo.Text='Configuration invalide' } - else { - $config=$g.State.Config - $c.HeaderInfo.Text='{0} · {1}' -f $config.Environment,$config.Cloud.Organization - $c.ConfigStatus.Text="Environment : $($config.Environment)`nConfiguration : $($g.ConfigPath)`nSauvegardes : $($config.Storage.BackupFolder)`nScope : $($config.Scope.Mode) · OU : $($config.Scope.SearchBase) · Groupe : $($config.Scope.GroupDN) · CSV : $($config.Scope.CsvPath)`nDC : $($config.DomainController) · Tenant : $($config.Cloud.Organization)`nPhase par défaut : $($config.Execution.Phase) · Entra Connect Sync : $($config.EntraConnect.Sync)`nLogs : $($config.Logging.Folder) · Rapports : $($config.Report.Folder)" - if (-not $g.InitialPhaseSet) { - $g.Updating=$true - $g.ExecutionPhase=$config.Execution.Phase - foreach ($item in $c.PhaseChoice.Items) { if ($item.Content -eq $config.Execution.Phase) { $c.PhaseChoice.SelectedItem=$item } } - $g.Updating=$false; $g.InitialPhaseSet=$true - } - } - Update-PraGuiSelection -} - -function Open-PraGuiPath { - param([string]$Path, [switch]$Folder) - if (-not $Path) { return } - if ($Folder -and (Test-Path -LiteralPath $Path -PathType Leaf)) { $Path=Split-Path $Path -Parent } - if (-not (Test-Path -LiteralPath $Path)) { throw "File/folder missing: $Path" } - $extension=[IO.Path]::GetExtension($Path) - if (-not (Test-Path -LiteralPath $Path -PathType Container) -and $extension -notin @('.csv','.html','.txt','.log','.json')) { throw 'Only reports, logs and folders may be opened.' } - $info=New-Object Diagnostics.ProcessStartInfo - $info.FileName=$Path; $info.UseShellExecute=$true - $null=[Diagnostics.Process]::Start($info) -} - -function Invoke-PraGuiClick { - param([string]$Name) - $g=$script:Gui; $c=$g.Controls - try { - switch ($Name) { - 'Reload' { if (-not $g.Run) { Update-PraGuiState } } - 'BrowseConfig' { - $dialog=New-Object Microsoft.Win32.OpenFileDialog; $dialog.Filter='Configuration (*.psd1)|*.psd1' - if ($dialog.ShowDialog($g.Form)) { $c.ConfigPathText.Text=$dialog.FileName; Update-PraGuiState } - } - 'BrowseBatch' { - $dialog=New-Object Microsoft.Win32.OpenFileDialog; $dialog.Filter='Batch (*.json)|*.json' - if ($dialog.ShowDialog($g.Form)) { $c.BatchText.Text=$dialog.FileName } - } - 'BrowseBatchFolder' { - Add-Type -AssemblyName System.Windows.Forms - $dialog=New-Object Windows.Forms.FolderBrowserDialog - try { if ($dialog.ShowDialog() -eq [Windows.Forms.DialogResult]::OK) { $c.BatchText.Text=$dialog.SelectedPath } } - finally { $dialog.Dispose() } - } - 'BrowseCsv' { - $dialog=New-Object Microsoft.Win32.OpenFileDialog; $dialog.Filter='Liste (*.csv)|*.csv' - if ($dialog.ShowDialog($g.Form)) { $c.CsvText.Text=$dialog.FileName } - } - 'ChooseOu' { Start-PraGuiOuLookup } - 'Preview' { Start-PraGuiRun -Mode Preview } - 'Apply' { Start-PraGuiRun -Mode Apply } - 'CopyCommand' { [Windows.Clipboard]::SetText($c.CommandText.Text) } - 'OpenBatch' { - $request=Get-PraGuiWindowRequest - $batch=Resolve-PraGuiBatch $request.Batch (Get-PraGuiBatchType $request.Action $request.Phase) $g.State - if ($batch) { Open-PraGuiPath $batch.Folder -Folder } - } - 'CopyBatch' { if ($g.LastResult) { [Windows.Clipboard]::SetText([string]$g.LastResult.batchId) } } - 'OpenLog' { Open-PraGuiPath ([string](Get-PraGuiValue $g.LastResult 'logFile' '')) } - 'OpenCsv' { Open-PraGuiPath ([string](Get-PraGuiValue $g.LastResult 'csvReport' '')) } - 'OpenHtml' { Open-PraGuiPath ([string](Get-PraGuiValue $g.LastResult 'htmlReport' '')) } - 'OpenBackup' { - $paths=@(Get-PraGuiValue $g.LastResult 'backupFiles' @())+@(Get-PraGuiValue $g.LastResult 'stateFiles' @()) - if ($paths.Count) { Open-PraGuiPath ([string]$paths[0]) -Folder } - } - } - } catch { Add-PraGuiLine $_.Exception.Message 'Fail'; $c.ValidationText.Text=$_.Exception.Message } -} - -function Get-PraGuiOuCommand { - param([string]$Root, [string]$ConfigPath, [string]$ResultPath) - $tokens=@('-NoProfile','-NonInteractive','-STA','-File',(Join-Path $Root 'module\PRA.Gui.Directory.ps1'),'-ConfigPath',$ConfigPath,'-ResultPath',$ResultPath) - return [pscustomobject]@{ FilePath=(Get-PraGuiEngine); Arguments=(@($tokens | ForEach-Object { ConvertTo-PraGuiNativeArgument $_ }) -join ' ') } -} - -function Start-PraGuiOuLookup { - $g=$script:Gui; $c=$g.Controls - if ($g.Run -or $g.OuLookup) { throw 'Attendre la fin de l''opération en cours.' } - if ((Get-PraGuiChoice $c.ActionChoice) -ne 'Convert' -or (Get-PraGuiChoice $c.PhaseChoice) -notin @('AD','Both') -or (Get-PraGuiChoice $c.SourceChoice) -ne 'OU') { - throw 'Le sélecteur OU est réservé à Convert AD / AD + cloud.' - } - if ($c.ConfigPathText.Text.Trim() -cne $g.ConfigPath) { throw 'Recharger la configuration sélectionnée.' } - $folder=Join-Path $g.Root 'logs\gui' - $null=New-Item -ItemType Directory -Path $folder -Force - $base=Join-Path $folder ('ou-'+[guid]::NewGuid().ToString('N')) - $command=Get-PraGuiOuCommand $g.Root $g.ConfigPath ($base+'.json') - $child=Start-PraGuiChildProcess $command $g.Root ($base+'.events.jsonl') - $g.Pending=$null; $c.ConfirmationText.Clear() - $g.OuLookup=@{ Process=$child.Process; Output=$child.Output; Errors=$child.Errors; Path=($base+'.json'); Base=$base } - foreach ($name in $script:GuiInputNames) { $c[$name].IsEnabled=$false } - Update-PraGuiSelection - $c.RunStatus.Text='Lecture des OU sur le DC configuré — aucune écriture AD' - Add-PraGuiLine $c.RunStatus.Text - $g.Timer.Start() -} - -function Select-PraGuiOu { - param([object[]]$Units, [string]$Server) - $g=$script:Gui - $xaml=@' - - - - - - - + + + + +
+
+
+
+ +
+

Use the arrow keys, Page Up, Page Down, Home and End to move between rows. Enter shows all the fields of the row.

+
+ + + +

Details

 +
Self-contained report (no external resource, no network access). The rows are stored compressed (gzip, not encrypted), all decoded when the page opens, and shown through virtual grids that keep at most 200 rows in the page. Reading them needs a current desktop Microsoft Edge or Google Chrome. Columns: see docs\PraRemoteMailbox-Guide, chapter "Reading the results". The CSV file, the log and the transcript of the run hold every detail.
+{{DATA}} + + diff --git a/templates/Report.template.html b/templates/Report.template.html deleted file mode 100644 index e853d00..0000000 --- a/templates/Report.template.html +++ /dev/null @@ -1,112 +0,0 @@ - - - -{{TITLE}} - - - -
-
PRA Remote Mailbox · v{{VERSION}}
-

{{TITLE}}

-

{{SUBTITLE}}

-
{{META}}
-
-
{{TILES}}
-{{NEXT}} -{{WARNINGS}} -
-

Objects

-
-
{{ROWS_TABLE}}
-
-{{ISSUES}} -
Self-contained report (no external resource). Columns: see docs\PraRemoteMailbox-Guide, chapter "Reading the results". The log and the transcript of the run hold every detail.
- - diff --git a/tests/IntegrityFixture.ps1 b/tests/IntegrityFixture.ps1 new file mode 100644 index 0000000..d311745 --- /dev/null +++ b/tests/IntegrityFixture.ps1 @@ -0,0 +1,105 @@ +<# +.SYNOPSIS + Controlled integrity fixtures for the offline PRA Remote Mailbox suites (dot-sourced by the test files). +.DESCRIPTION + The real package is unsigned until the owner signs it, and the runtime fails closed on that. These helpers build a + COPY of the package in which exactly one thing is substituted: every call of + Microsoft.PowerShell.Security\Get-AuthenticodeSignature (one per runtime PowerShell file: the bootstrap, or the + verifier's owner check) returns a Valid, timestamped, owner-thumbprint result. Everything else is the real code + and the real bytes: the bootstrap, the verifier, the exact inventory, the SHA256 comparison, the path/reparse + guards and the file scan. A manifest is generated from the copy's own bytes. + This proves the integrity LOGIC. It does NOT prove Authenticode trust: the native signature state is asserted + separately in PackageIntegrity.Tests.ps1, on the unmodified package, with no substitution. The two are never + claimed to be equivalent. +.NOTES + Author : Nicolas Fabert + Version: 2.2.0 +#> +#Requires -Version 5.1 + +$global:PraIntegrity = @{ + Signer = '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' + Token = 'Microsoft.PowerShell.Security\Get-AuthenticodeSignature' + Generated = @('Backups', 'logs', 'reports') +} + +function global:Get-PraExpectedInventory { + # Independent from the verifier: the tests compare both, so neither can drift silently. + $images = 'console-apply', 'console-preview', 'gui-fluent', 'readme-banner-dark', 'readme-banner-light', 'readme-flows-dark', 'readme-flows-light', + 'readme-how-dark', 'readme-how-light', 'readme-permissions-dark', 'readme-permissions-light', 'readme-principles-dark', 'readme-principles-light', + 'report-warning', 'report' + @( + 'Invoke-PraRemoteMailbox.ps1' + 'module\PRA.Common.psm1', 'module\PRA.Directory.psm1', 'module\PRA.Backup.psm1', 'module\PRA.Cloud.psm1', 'module\PRA.Gui.psm1' + 'module\PRA.Gui.Directory.ps1', 'module\Test-PackageIntegrity.ps1', 'module\PRA.Gui.xaml' + 'templates\Report.template.html' + 'config\Targets.sample.csv', 'config\SharedPermissions.sample.csv' + 'README.md', 'LICENSE' + 'docs\PraRemoteMailbox-Guide.html', 'docs\PraRemoteMailbox-Guide.md' + ) + @($images | ForEach-Object { 'docs\images\' + $_ + '.png' }) + @('CHANGELOG.md') +} + +function global:Get-PraSignedPowerShellFiles { + @(Get-PraExpectedInventory | Where-Object { $_ -match '\.ps(m1|d1|1)$' }) +} + +function global:Read-PraFixtureText([string]$Path) { + $bytes = [IO.File]::ReadAllBytes($Path) + $bom = $bytes.Length -ge 3 -and $bytes[0] -eq 239 -and $bytes[1] -eq 187 -and $bytes[2] -eq 191 + $encoding = New-Object Text.UTF8Encoding($false, $true) + [pscustomobject]@{ Text = $(if ($bom) { $encoding.GetString($bytes, 3, $bytes.Length - 3) } else { $encoding.GetString($bytes) }); Bom = $bom } +} + +function global:Write-PraFixtureText([string]$Path, [string]$Text, [bool]$Bom) { + $body = (New-Object Text.UTF8Encoding($false)).GetBytes($Text) + if ($Bom) { $body = [byte[]](239, 187, 191) + $body } + [IO.File]::WriteAllBytes($Path, $body) +} + +function global:Get-PraSignatureSubstitute { + '& { [CmdletBinding()] param([string]$LiteralPath) [pscustomobject]@{ Status = ''Valid''; SignerCertificate = [pscustomobject]@{ Thumbprint = ''' + + $global:PraIntegrity.Signer + ''' }; TimeStamperCertificate = [pscustomobject]@{ Subject = ''TEST-FIXTURE-SUBSTITUTE'' } } }' +} + +function global:Write-PraFixtureManifest { + param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string]$Changelog) + $lines = foreach ($relative in Get-PraExpectedInventory) { + $path = if ($relative -eq 'CHANGELOG.md') { $Changelog } else { Join-Path $Root $relative } + " @{ Path = '$relative'; Sha256 = '$((Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash)' }" + } + $text = "# TEST FIXTURE manifest generated from the copied bytes; the signature check is substituted. Never a release artifact.`r`n" + + "@{`r`n SchemaVersion = 1`r`n Algorithm = 'SHA256'`r`n SignerThumbprint = '$($global:PraIntegrity.Signer)'`r`n Files = @(`r`n" + + ($lines -join "`r`n") + "`r`n )`r`n}`r`n" + Write-PraFixtureText (Join-Path $Root 'PackageIntegrity.psd1') $text $true +} + +function global:New-PraIntegrityFixture { + <# Copies the package, substitutes the signature check only, writes a manifest from the copy's bytes. #> + param([Parameter(Mandatory)][string]$SourcePackage, [Parameter(Mandatory)][string]$Destination, + [Parameter(Mandatory)][string]$Changelog, [switch]$IncludeChangelog, [switch]$KeepNativeSignatureCheck) + $null = New-Item -ItemType Directory -Path (Split-Path $Destination -Parent) -Force + Copy-Item -LiteralPath $SourcePackage -Destination $Destination -Recurse + foreach ($folder in $global:PraIntegrity.Generated) { Remove-Item -LiteralPath (Join-Path $Destination $folder) -Recurse -Force -ErrorAction SilentlyContinue } + if (-not $KeepNativeSignatureCheck) { + foreach ($relative in Get-PraSignedPowerShellFiles) { + $path = Join-Path $Destination $relative + $file = Read-PraFixtureText $path + $count = ([regex]::Matches($file.Text, [regex]::Escape($global:PraIntegrity.Token))).Count + if ($count -ne 1) { throw "Integrity fixture: expected exactly one signature call in $relative, found $count." } + Write-PraFixtureText $path $file.Text.Replace($global:PraIntegrity.Token, (Get-PraSignatureSubstitute)) $file.Bom + } + } + Write-PraFixtureManifest -Root $Destination -Changelog $Changelog + if ($IncludeChangelog) { Copy-Item -LiteralPath $Changelog -Destination (Join-Path $Destination 'CHANGELOG.md') } +} + +function global:Set-PraFixtureHash { + <# Re-hashes one inventory file in the fixture manifest after a deliberate fixture edit (e.g. the synthetic Cloud barrier). #> + param([Parameter(Mandatory)][string]$Root, [Parameter(Mandatory)][string]$Relative) + $manifest = Join-Path $Root 'PackageIntegrity.psd1' + $file = Read-PraFixtureText $manifest + $hash = (Get-FileHash -LiteralPath (Join-Path $Root $Relative) -Algorithm SHA256).Hash + $pattern = "(?m)(Path = '" + [regex]::Escape($Relative) + "'; Sha256 = ')[0-9A-F]{64}(')" + if (-not [regex]::IsMatch($file.Text, $pattern)) { throw "Integrity fixture: $Relative is not in the manifest." } + Write-PraFixtureText $manifest ([regex]::Replace($file.Text, $pattern, ('${1}' + $hash + '${2}'))) $file.Bom +} diff --git a/tests/Invoke-TestGate.ps1 b/tests/Invoke-TestGate.ps1 index 022304a..58a30a6 100644 --- a/tests/Invoke-TestGate.ps1 +++ b/tests/Invoke-TestGate.ps1 @@ -12,7 +12,7 @@ powershell.exe -NoLogo -NoProfile -NonInteractive -File .\tests\Invoke-TestGate.ps1 .NOTES Author : Nicolas Fabert - Version: 2.1.0 + Version: 2.2.0 #> #Requires -Version 5.1 #Requires -PSEdition Desktop @@ -46,7 +46,7 @@ $summary=[ordered]@{ PesterVersion=''; PesterPath=''; AnalyzerVersion=''; AnalyzerProfiles=@(); TotalCount=0; PassedCount=0; FailedCount=0 FailedBlocksCount=0; FailedContainersCount=0; AnalyzerErrorCount=0; AnalyzerWarningCount=0 ReleaseDefaultWarningCount=0; ReleaseCompatibilityWarningCount=0; GateWarningCount=0 - Checks=@(); Failures=@(); RuntimeMilliseconds=0; ExitCode=1; RESULT='FAIL'; EvidenceDirectory=$EvidenceDirectory + NativeSignatureState=@(); Checks=@(); Failures=@(); RuntimeMilliseconds=0; ExitCode=1; RESULT='FAIL'; EvidenceDirectory=$EvidenceDirectory } try { Start-Transcript -LiteralPath (Join-Path $EvidenceDirectory 'gate.transcript.txt') -NoClobber | Out-Null @@ -54,7 +54,7 @@ try { $testRoot=[IO.Path]::GetFullPath($PSScriptRoot).TrimEnd('\')+'\' $files=@(Get-ChildItem -LiteralPath $root -Recurse -File | Where-Object { $_.Extension -in @('.ps1','.psm1','.psd1') -and -not $_.FullName.StartsWith($testRoot,[StringComparison]::OrdinalIgnoreCase) }) $files+=@(Get-ChildItem -LiteralPath $PSScriptRoot -File | Where-Object Extension -eq '.ps1') - $hashFiles=@($files)+@(Get-Item -LiteralPath (Join-Path $root 'module\PRA.Gui.xaml') -ErrorAction Stop) + $hashFiles=@($files)+@(Get-Item -LiteralPath (Join-Path $root 'package\module\PRA.Gui.xaml') -ErrorAction Stop) $hashes=@(foreach ($file in $hashFiles) { $hash=Get-FileHash -LiteralPath $file.FullName -Algorithm SHA256; [pscustomobject]@{Path=$file.FullName;SHA256=$hash.Hash;Length=$file.Length} }) [IO.File]::WriteAllText((Join-Path $EvidenceDirectory 'source-hashes.json'),($hashes | ConvertTo-Json -Depth 5),$encoding) foreach ($file in $files) { @@ -67,7 +67,11 @@ try { $checks.Add([pscustomobject]@{Name='UTF8-BOM';File=$file.FullName;Passed=$bom;Details='Windows PowerShell 5.1 deterministic decoding.'}) if (-not $bom) { $failures.Add('UTF8 BOM absent: '+$file.FullName) } } - $main=Join-Path $root 'Invoke-PraRemoteMailbox.ps1' + # Honest native state of the runtime signatures: Authenticode is not mocked here; the integrity tests assert fail-closed or valid. + $signed=@(foreach ($name in @('Invoke-PraRemoteMailbox.ps1','module\PRA.Common.psm1','module\PRA.Directory.psm1','module\PRA.Backup.psm1','module\PRA.Cloud.psm1','module\PRA.Gui.psm1','module\PRA.Gui.Directory.ps1','module\Test-PackageIntegrity.ps1','PackageIntegrity.psd1')) { $sig=Get-AuthenticodeSignature -LiteralPath (Join-Path $root ('package\'+$name)); [pscustomobject]@{Path=$name;Status=[string]$sig.Status;Signer=if ($sig.SignerCertificate) { $sig.SignerCertificate.Thumbprint } else { '' };Timestamped=($null -ne $sig.TimeStamperCertificate)} }) + [IO.File]::WriteAllText((Join-Path $EvidenceDirectory 'native-signature-state.json'),(ConvertTo-Json -InputObject $signed -Depth 4),$encoding) + $summary.NativeSignatureState=@($signed | ForEach-Object { $_.Path+'='+$_.Status }) + $main=Join-Path $root 'package\Invoke-PraRemoteMailbox.ps1' $help=Get-Help $main -Full $helpText=$help | Out-String -Width 240 [IO.File]::WriteAllText((Join-Path $EvidenceDirectory 'main-help.txt'),$helpText,$encoding) @@ -131,7 +135,7 @@ try { if ($pester.Version.Major -lt 5) { throw 'Pester >= 5 is mandatory.' } $summary.PesterVersion=[string]$pester.Version; $summary.PesterPath=$pester.Path $configuration=New-PesterConfiguration - $configuration.Run.Path=@((Join-Path $PSScriptRoot 'PraRemoteMailbox.Tests.ps1'),(Join-Path $PSScriptRoot 'PraRemoteMailbox.Gui.Tests.ps1')) + $configuration.Run.Path=@((Join-Path $PSScriptRoot 'PraRemoteMailbox.Tests.ps1'),(Join-Path $PSScriptRoot 'PraRemoteMailbox.Gui.Tests.ps1'),(Join-Path $PSScriptRoot 'PackageIntegrity.Tests.ps1'),(Join-Path $PSScriptRoot 'PraReport.Tests.ps1')) $configuration.Run.PassThru=$true $configuration.Run.Exit=$false $configuration.Output.Verbosity='Detailed' diff --git a/tests/PackageIntegrity.Tests.ps1 b/tests/PackageIntegrity.Tests.ps1 new file mode 100644 index 0000000..ccdc0a4 --- /dev/null +++ b/tests/PackageIntegrity.Tests.ps1 @@ -0,0 +1,355 @@ +<# +.SYNOPSIS + Package integrity tests for PRA Remote Mailbox 2.2.0 (offline; no AD, Exchange, Graph, signing key or network). +.DESCRIPTION + Three kinds of evidence, never mixed up: + * Static: bootstrap identity and order, exact inventory, git attributes, no bypass, no private data. + * Controlled fixture (IntegrityFixture.ps1): a COPY of the package where only the Authenticode call is + substituted. It exercises the real verifier, bootstrap, inventory, hash, path and reparse logic. It does not + prove signature trust. + * Native: the unmodified package with the real Get-AuthenticodeSignature. While the package is unsigned it must + fail closed before any import or operation; once the owner has signed all nine files it must verify. The + assertion depends on the observed signature state, so it is never skipped and never weakened. +.NOTES + Author : Nicolas Fabert + Version : 2.2.0 +#> +#Requires -Version 5.1 + +BeforeAll { + . (Join-Path $PSScriptRoot 'IntegrityFixture.ps1') + $script:Repo = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..')) + $script:Source = Join-Path $script:Repo 'package' + $script:Work = Join-Path ([IO.Path]::GetTempPath()) ('PI-' + [guid]::NewGuid().ToString('N').Substring(0, 8)) + $null = New-Item -ItemType Directory -Path $script:Work -Force + $script:Ps51 = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe' + $script:Changelog = Join-Path $script:Repo 'CHANGELOG.md' + $script:Fixture = Join-Path $script:Work 'fixture' + New-PraIntegrityFixture -SourcePackage $script:Source -Destination $script:Fixture -Changelog $script:Changelog -IncludeChangelog + + function script:Invoke-Ps51 { + param([Parameter(Mandatory)][string[]]$Arguments) + $previous = $ErrorActionPreference + $ErrorActionPreference = 'Continue' + try { $output = & $script:Ps51 -NoLogo -NoProfile -NonInteractive @Arguments 2>&1 | ForEach-Object { [string]$_ } } + finally { $ErrorActionPreference = $previous } + [pscustomobject]@{ Code = $LASTEXITCODE; Text = ($output -join "`n") } + } + function script:Copy-Case { + $case = Join-Path $script:Work ([guid]::NewGuid().ToString('N').Substring(0, 8)) + Copy-Item -LiteralPath $script:Fixture -Destination $case -Recurse + $case + } + function script:Invoke-Verifier([string]$Root, [switch]$Distribution) { + $arguments = @('-File', (Join-Path $Root 'module\Test-PackageIntegrity.ps1'), '-Root', $Root) + if ($Distribution) { $arguments += '-Distribution' } + Invoke-Ps51 -Arguments $arguments + } + function script:Edit-Manifest([string]$Root, [scriptblock]$Edit) { + $path = Join-Path $Root 'PackageIntegrity.psd1' + $file = Read-PraFixtureText $path + Write-PraFixtureText $path (& $Edit $file.Text) $true + } + function script:Add-Byte([string]$Path) { + $stream = [IO.File]::Open($Path, 'Append', 'Write') + try { $stream.WriteByte(32) } finally { $stream.Dispose() } + } + function script:Get-NativeState { + $names = 'Invoke-PraRemoteMailbox.ps1', 'module\PRA.Common.psm1', 'module\PRA.Directory.psm1', 'module\PRA.Backup.psm1', 'module\PRA.Cloud.psm1', + 'module\PRA.Gui.psm1', 'module\PRA.Gui.Directory.ps1', 'module\Test-PackageIntegrity.ps1', 'PackageIntegrity.psd1' + $statuses = @($names | ForEach-Object { [string](Get-AuthenticodeSignature -LiteralPath (Join-Path $script:Source $_)).Status }) + [pscustomobject]@{ AllValid = (@($statuses | Where-Object { $_ -ne 'Valid' }).Count -eq 0); Statuses = $statuses } + } +} + +AfterAll { + if ($script:Work -and [IO.Directory]::Exists($script:Work)) { + Get-ChildItem -LiteralPath $script:Work -Recurse -Force -Directory -ErrorAction SilentlyContinue | + Where-Object { $_.Attributes -band [IO.FileAttributes]::ReparsePoint } | ForEach-Object { [IO.Directory]::Delete($_.FullName) } + Remove-Item -LiteralPath $script:Work -Recurse -Force -ErrorAction SilentlyContinue + } +} + +Describe 'Static package contract' { + It 'keeps the verifier inventory identical to the independently listed exact inventory' { + $ast = [Management.Automation.Language.Parser]::ParseFile((Join-Path $script:Source 'module\Test-PackageIntegrity.ps1'), [ref]$null, [ref]$null) + $assignment = $ast.Find({ param($n) $n -is [Management.Automation.Language.AssignmentStatementAst] -and $n.Left.Extent.Text -eq '$required' }, $true) + $required = @($assignment.Right.FindAll({ param($n) $n -is [Management.Automation.Language.StringConstantExpressionAst] }, $true) | ForEach-Object Value) + $expected = @(Get-PraExpectedInventory | Where-Object { $_ -ne 'CHANGELOG.md' }) + (($required | Sort-Object) -join '|') | Should -BeExactly (($expected | Sort-Object) -join '|') + $expected.Count | Should -Be 31 + $text = [IO.File]::ReadAllText((Join-Path $script:Source 'module\Test-PackageIntegrity.ps1')) + $text | Should -Match "\`$distributionOnly = @\('CHANGELOG\.md'\)" + } + It 'has every inventory file in the source package and no unlisted stable file' { + foreach ($relative in Get-PraExpectedInventory | Where-Object { $_ -ne 'CHANGELOG.md' }) { Test-Path -LiteralPath (Join-Path $script:Source $relative) -PathType Leaf | Should -BeTrue -Because $relative } + Test-Path -LiteralPath $script:Changelog -PathType Leaf | Should -BeTrue + $inventory = @(Get-PraExpectedInventory) + @('PackageIntegrity.psd1', 'config\PraRemoteMailbox.config.psd1') + $unlisted = @(Get-ChildItem -LiteralPath $script:Source -Recurse -File -Force | ForEach-Object { $_.FullName.Substring($script:Source.Length + 1) } | + Where-Object { $_ -notin $inventory -and $_ -notmatch '^(Backups|logs|reports)\\' }) + $unlisted | Should -BeNullOrEmpty + } + It 'covers every executable PowerShell file of the package (eight) plus the manifest as the ninth signed file' { + $executables = @(Get-ChildItem -LiteralPath $script:Source -Recurse -File | Where-Object { $_.Extension -in '.ps1', '.psm1', '.psd1' } | + ForEach-Object { $_.FullName.Substring($script:Source.Length + 1) } | Where-Object { $_ -ne 'config\PraRemoteMailbox.config.psd1' }) + $signed = @(Get-PraSignedPowerShellFiles) + @('PackageIntegrity.psd1') + $signed.Count | Should -Be 9 + (($executables | Sort-Object) -join '|') | Should -BeExactly (($signed | Sort-Object) -join '|') + } + It 'runs an identical bootstrap, before any import or function, in the entry, the five modules and the direct helper' { + $files = @(Get-PraSignedPowerShellFiles | Where-Object { $_ -notmatch 'Test-PackageIntegrity|\.psd1$' }) + $files.Count | Should -Be 7 + $blocks = @() + foreach ($relative in $files) { + $text = [IO.File]::ReadAllText((Join-Path $script:Source $relative)).Replace("`r`n", "`n") + $match = [regex]::Match($text, '(?s)# >>> PRA package integrity bootstrap.*?# <<< PRA package integrity bootstrap') + $match.Success | Should -BeTrue -Because $relative + ([regex]::Matches($text, '# >>> PRA package integrity bootstrap')).Count | Should -Be 1 -Because $relative + $blocks += ($match.Value -replace '(?m)^\} .*$', '} ') + $after = $text.Substring($match.Index + $match.Length) + $first = [regex]::Match($after, '(?m)^\s*(Import-Module|function |\$script:)').Index + $before = $text.Substring(0, $match.Index) + $before | Should -Not -Match '(?m)^\s*(Import-Module|function )' -Because $relative + $first | Should -BeGreaterThan -1 + } + @($blocks | Select-Object -Unique).Count | Should -Be 1 + } + It 'has exactly eight native signature call sites in the package and none unqualified' { + $sites = 0 + foreach ($file in Get-ChildItem -LiteralPath $script:Source -Recurse -File | Where-Object { $_.Extension -in '.ps1', '.psm1' }) { + $text = [IO.File]::ReadAllText($file.FullName) + $sites += ([regex]::Matches($text, [regex]::Escape($global:PraIntegrity.Token))).Count + ([regex]::Matches($text, '(?' -ForEach @( + @{ Name = 'entry'; Path = 'Invoke-PraRemoteMailbox.ps1' }, @{ Name = 'Common module'; Path = 'module\PRA.Common.psm1' }, + @{ Name = 'Cloud module'; Path = 'module\PRA.Cloud.psm1' }, @{ Name = 'GUI helper'; Path = 'module\PRA.Gui.Directory.ps1' }, + @{ Name = 'XAML'; Path = 'module\PRA.Gui.xaml' }, @{ Name = 'report template'; Path = 'templates\Report.template.html' }, + @{ Name = 'sample CSV'; Path = 'config\Targets.sample.csv' }, @{ Name = 'README'; Path = 'README.md' }, @{ Name = 'licence'; Path = 'LICENSE' }, + @{ Name = 'guide'; Path = 'docs\PraRemoteMailbox-Guide.html' }, @{ Name = 'image'; Path = 'docs\images\report.png' }, + @{ Name = 'changelog'; Path = 'CHANGELOG.md' }, @{ Name = 'verifier'; Path = 'module\Test-PackageIntegrity.ps1' } + ) { + $case = Copy-Case + Add-Byte (Join-Path $case $Path) + $result = Invoke-Verifier $case -Distribution + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity:' + } + It 'rejects a missing stable file ' -ForEach @(@{ Path = 'module\PRA.Gui.xaml' }, @{ Path = 'docs\images\gui-fluent.png' }, @{ Path = 'LICENSE' }, @{ Path = 'module\PRA.Backup.psm1' }) { + $case = Copy-Case + Remove-Item -LiteralPath (Join-Path $case $Path) + $result = Invoke-Verifier $case -Distribution + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity:' + } + It 'rejects an unexpected stable file at ' -ForEach @( + @{ Path = 'extra.txt' }, @{ Path = 'module\Extra.ps1' }, @{ Path = 'docs\notes.md' }, @{ Path = 'templates\Other.html' }, + @{ Path = 'config\Extra.psd1' }, @{ Path = 'config\nested\data.csv' }, @{ Path = 'docs\Backups\x.txt' } + ) { + $case = Copy-Case + $null = New-Item -ItemType Directory -Path (Split-Path (Join-Path $case $Path) -Parent) -Force + [IO.File]::WriteAllText((Join-Path $case $Path), 'x') + $result = Invoke-Verifier $case -Distribution + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'unexpected stable file' + } + It 'permits editable configuration, operational CSV lists and generated folders (data, outside integrity)' { + $case = Copy-Case + [IO.File]::WriteAllText((Join-Path $case 'config\PraRemoteMailbox.config.psd1'), "@{ Anything = 'edited' }") + [IO.File]::WriteAllText((Join-Path $case 'config\Operational-List.csv'), 'a;b') + [IO.File]::WriteAllText((Join-Path $case 'config\Targets.sample.csv.bak'), 'x') | Out-Null + Remove-Item -LiteralPath (Join-Path $case 'config\Targets.sample.csv.bak') + foreach ($folder in 'Backups', 'logs', 'reports') { + $null = New-Item -ItemType Directory -Path (Join-Path $case "$folder\sub") -Force + [IO.File]::WriteAllText((Join-Path $case "$folder\sub\data.bin"), 'generated') + } + $result = Invoke-Verifier $case -Distribution + $result.Code | Should -Be 0 -Because $result.Text + } + It 'rejects a manifest ' -ForEach @( + @{ Name = 'with a wrong thumbprint'; Edit = { param($t) $t.Replace('0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6', '1111111111111111111111111111111111111111') } } + @{ Name = 'with another algorithm'; Edit = { param($t) $t.Replace("'SHA256'", "'SHA1'") } } + @{ Name = 'with an extra key'; Edit = { param($t) $t.Replace(' Algorithm', " Extra = 1`r`n Algorithm") } } + @{ Name = 'with a duplicated path'; Edit = { param($t) $t.Replace("Path = 'LICENSE'", "Path = 'README.md'") } } + @{ Name = 'with a traversal path'; Edit = { param($t) $t.Replace("Path = 'LICENSE'", "Path = '..\LICENSE'") } } + @{ Name = 'with a lowercase hash'; Edit = { param($t) [regex]::Replace($t, "Sha256 = '([0-9A-F]{64})'", { param($m) "Sha256 = '" + $m.Groups[1].Value.ToLowerInvariant() + "'" }, 'None') } } + @{ Name = 'with a missing entry'; Edit = { param($t) [regex]::Replace($t, "(?m)^\s*@\{ Path = 'LICENSE'.*\r?\n", '') } } + @{ Name = 'with a schema version 2'; Edit = { param($t) $t.Replace('SchemaVersion = 1', 'SchemaVersion = 2') } } + @{ Name = 'empty (the unsigned placeholder shape)'; Edit = { param($t) [regex]::Replace($t, '(?s)Files = @\(.*\r?\n \)', 'Files = @()') } } + ) { + $case = Copy-Case + Edit-Manifest $case $Edit + $result = Invoke-Verifier $case -Distribution + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity:|Import-PowerShellDataFile|parse|Hash' + } + It 'rejects a reparse point in the stable tree ()' -ForEach @(@{ Path = 'docs\images' }, @{ Path = 'templates' }, @{ Path = 'module' }) { + $case = Copy-Case + $moved = Join-Path $script:Work ('moved-' + [guid]::NewGuid().ToString('N').Substring(0, 6)) + Move-Item -LiteralPath (Join-Path $case $Path) -Destination $moved + $null = New-Item -ItemType Junction -Path (Join-Path $case $Path) -Target $moved + $verifier = if ($Path -eq 'module') { Join-Path $moved 'Test-PackageIntegrity.ps1' } else { Join-Path $case 'module\Test-PackageIntegrity.ps1' } + $result = Invoke-Ps51 -Arguments @('-File', $verifier, '-Root', $case, '-Distribution') + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity:' + } + It 'fails the entry (CLI and GUI) before any import, configuration or operation when a stable file changed' { + $case = Copy-Case + Add-Byte (Join-Path $case 'LICENSE') + foreach ($arguments in @(@('-Action', 'Check', '-Mode', 'Preview'), @('-Gui'))) { + $result = Invoke-Ps51 -Arguments (@('-File', (Join-Path $case 'Invoke-PraRemoteMailbox.ps1')) + $arguments) + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity: SHA256 mismatch: LICENSE' + $result.Text | Should -Not -Match 'ActiveDirectory|Configuration file' + } + foreach ($folder in 'Backups', 'logs', 'reports') { Test-Path -LiteralPath (Join-Path $case $folder) | Should -BeFalse -Because $folder } + } + It 'does not let a module or the direct GUI helper bypass the check ()' -ForEach @( + @{ Relative = 'module\PRA.Common.psm1' }, @{ Relative = 'module\PRA.Directory.psm1' }, @{ Relative = 'module\PRA.Backup.psm1' }, + @{ Relative = 'module\PRA.Cloud.psm1' }, @{ Relative = 'module\PRA.Gui.psm1' }, @{ Relative = 'module\PRA.Gui.Directory.ps1' } + ) { + $case = Copy-Case + Add-Byte (Join-Path $case 'LICENSE') + $target = Join-Path $case $Relative + $command = if ($Relative -like '*.psm1') { "Import-Module -Name '$target' -Force -ErrorAction Stop" } else { "& '$target' -ConfigPath 'x.psd1' -ResultPath 'y.json'" } + $result = Invoke-Ps51 -Arguments @('-Command', ('try { ' + $command + ' } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 1 }')) + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity: SHA256 mismatch: LICENSE' + } + It 'imports the modules of an intact fixture package (the bootstrap passes, then the module loads)' { + $result = Invoke-Ps51 -Arguments @('-Command', "try { Import-Module -Name '$(Join-Path $script:Fixture 'module\PRA.Common.psm1')' -Force -ErrorAction Stop; 'LOADED' } catch { [Console]::Error.WriteLine(`$_.Exception.Message); exit 1 }") + $result.Text | Should -Match 'LOADED' + $result.Code | Should -Be 0 + } +} + +Describe 'Package builder - controlled fixture, same paths and no private data' { + BeforeAll { + # A repository-shaped copy: package\ (fixture, no changelog), CHANGELOG.md and the real builder with its own + # signature call substituted. + $script:BuilderRepo = Join-Path $script:Work 'builder-repo' + New-PraIntegrityFixture -SourcePackage $script:Source -Destination (Join-Path $script:BuilderRepo 'package') -Changelog $script:Changelog + Copy-Item -LiteralPath $script:Changelog -Destination $script:BuilderRepo + $null = New-Item -ItemType Directory -Path (Join-Path $script:BuilderRepo 'tools') -Force + $builder = Join-Path $script:BuilderRepo 'tools\New-PraPackage.ps1' + Copy-Item -LiteralPath (Join-Path $script:Repo 'tools\New-PraPackage.ps1') -Destination $builder + $file = Read-PraFixtureText $builder + ([regex]::Matches($file.Text, [regex]::Escape($global:PraIntegrity.Token))).Count | Should -Be 1 + Write-PraFixtureText $builder $file.Text.Replace($global:PraIntegrity.Token, (Get-PraSignatureSubstitute)) $file.Bom + $script:Builder = $builder + } + It 'builds exactly the extracted-runtime layout: inventory, manifest and sanitized config, nothing else' { + $destination = Join-Path $script:Work 'built' + $result = Invoke-Ps51 -Arguments @('-File', $script:Builder, '-Destination', $destination) + $result.Code | Should -Be 0 -Because $result.Text + $built = @(Get-ChildItem -LiteralPath $destination -Recurse -File | ForEach-Object { $_.FullName.Substring($destination.Length + 1) } | Sort-Object) + $expected = @(Get-PraExpectedInventory) + @('PackageIntegrity.psd1', 'config\PraRemoteMailbox.config.psd1') + ($built -join '|') | Should -BeExactly (($expected | Sort-Object) -join '|') + Test-Path -LiteralPath (Join-Path $destination 'Invoke-PraRemoteMailbox.ps1') -PathType Leaf | Should -BeTrue + foreach ($forbidden in 'tests', 'tools', 'Backups', 'logs', 'reports', 'package') { Test-Path -LiteralPath (Join-Path $destination $forbidden) | Should -BeFalse } + (Invoke-Verifier $destination -Distribution).Code | Should -Be 0 + } + It 'refuses a changed source before writing anything' { + $changed = Join-Path $script:Work 'builder-changed' + Copy-Item -LiteralPath $script:BuilderRepo -Destination $changed -Recurse + Add-Byte (Join-Path $changed 'package\LICENSE') + $destination = Join-Path $script:Work 'built-refused' + $result = Invoke-Ps51 -Arguments @('-File', (Join-Path $changed 'tools\New-PraPackage.ps1'), '-Destination', $destination) + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity:' + Test-Path -LiteralPath $destination | Should -BeFalse + } +} + +Describe 'Native state of the real package - no substitution (honest, state-dependent)' { + It 'fails closed before any import or operation while unsigned, and verifies once all nine files are signed' { + $state = Get-NativeState + $entry = Join-Path $script:Source 'Invoke-PraRemoteMailbox.ps1' + $verifier = Join-Path $script:Source 'module\Test-PackageIntegrity.ps1' + $module = Invoke-Ps51 -Arguments @('-Command', "try { Import-Module -Name '$(Join-Path $script:Source 'module\PRA.Common.psm1')' -Force -ErrorAction Stop; 'LOADED' } catch { [Console]::Error.WriteLine(`$_.Exception.Message); exit 1 }") + $direct = Invoke-Ps51 -Arguments @('-File', $verifier, '-Root', $script:Source) + if ($state.AllValid) { + $direct.Code | Should -Be 0 -Because $direct.Text + $module.Code | Should -Be 0 -Because $module.Text + $module.Text | Should -Match 'LOADED' + # An intact signed entry could reach AD or open WPF. Test its native rejection on a tampered copy instead. + $case = Join-Path $script:Work 'native-signed-tampered' + Copy-Item -LiteralPath $script:Source -Destination $case -Recurse + Add-Byte (Join-Path $case 'LICENSE') + foreach ($arguments in @(@('-Action', 'Check', '-Mode', 'Preview'), @('-Gui'))) { + $rejected = Invoke-Ps51 -Arguments (@('-File', (Join-Path $case 'Invoke-PraRemoteMailbox.ps1')) + $arguments) + $rejected.Code | Should -Not -Be 0 + $rejected.Text | Should -Match 'Package integrity: SHA256 mismatch: LICENSE' + $rejected.Text | Should -Not -Match 'ActiveDirectory|Configuration file' + } + foreach ($folder in 'Backups', 'logs', 'reports') { + Test-Path -LiteralPath (Join-Path $case $folder) | Should -BeFalse -Because $folder + } + } + else { + $cli = Invoke-Ps51 -Arguments @('-File', $entry, '-Action', 'Check', '-Mode', 'Preview') + $gui = Invoke-Ps51 -Arguments @('-File', $entry, '-Gui') + foreach ($result in $cli, $gui, $module, $direct) { + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity' + } + $module.Text | Should -Not -Match 'LOADED' + foreach ($folder in 'Backups', 'logs', 'reports') { Test-Path -LiteralPath (Join-Path $script:Source $folder) | Should -BeFalse -Because $folder } + } + } + It 'refuses to build a package from an unsigned source and writes nothing' { + $state = Get-NativeState + $destination = Join-Path $script:Work 'native-built' + $result = Invoke-Ps51 -Arguments @('-File', (Join-Path $script:Repo 'tools\New-PraPackage.ps1'), '-Destination', $destination) + if ($state.AllValid) { $result.Code | Should -Be 0 -Because $result.Text } + else { + $result.Code | Should -Not -Be 0 + $result.Text | Should -Match 'Package integrity' + Test-Path -LiteralPath $destination | Should -BeFalse + } + } +} diff --git a/tests/PraRemoteMailbox.Gui.Tests.ps1 b/tests/PraRemoteMailbox.Gui.Tests.ps1 index 5b00d1a..c775248 100644 --- a/tests/PraRemoteMailbox.Gui.Tests.ps1 +++ b/tests/PraRemoteMailbox.Gui.Tests.ps1 @@ -1,13 +1,16 @@ #Requires -Version 5.1 # Synthetic only: no AD, Exchange, Graph, network or production configuration. BeforeAll { - $script:GuiProjectRoot=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..')) + $script:GuiEvidence=Join-Path $PSScriptRoot ('evidence\gui-'+[guid]::NewGuid().ToString('N')) + $null=New-Item -ItemType Directory -Path $script:GuiEvidence -Force + # Controlled package copy (signature call substituted, real bootstrap/verifier/hash logic); see IntegrityFixture.ps1. + . (Join-Path $PSScriptRoot 'IntegrityFixture.ps1') + $script:GuiProjectRoot=Join-Path $script:GuiEvidence 'package-fixture' + New-PraIntegrityFixture -SourcePackage ([IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\package'))) -Destination $script:GuiProjectRoot -Changelog ([IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\CHANGELOG.md'))) $script:GuiModule=Join-Path $script:GuiProjectRoot 'module\PRA.Gui.psm1' $script:GuiCommon=Join-Path $script:GuiProjectRoot 'module\PRA.Common.psm1' Import-Module $script:GuiCommon -Force Import-Module $script:GuiModule -Force - $script:GuiEvidence=Join-Path $PSScriptRoot ('evidence\gui-'+[guid]::NewGuid().ToString('N')) - $null=New-Item -ItemType Directory -Path $script:GuiEvidence -Force $script:GuiEncoding=New-Object Text.UTF8Encoding($true) function Write-GuiTestFile { diff --git a/tests/PraRemoteMailbox.Tests.ps1 b/tests/PraRemoteMailbox.Tests.ps1 index 381f3a7..c0a37af 100644 --- a/tests/PraRemoteMailbox.Tests.ps1 +++ b/tests/PraRemoteMailbox.Tests.ps1 @@ -9,7 +9,7 @@ No legacy Assert-MockCalled: counters are mutable objects. .NOTES Author : Nicolas Fabert - Version: 2.1.0 + Version: 2.2.0 Run it through tests\Invoke-TestGate.ps1 (evidence, PSScriptAnalyzer, mandatory tests). #> #Requires -Version 5.1 @@ -23,7 +23,11 @@ BeforeAll { OriginalState = $env:PRA_GATE_STATE Runtime = $null } + $global:PraGate.Source = Join-Path $global:PraGate.Release 'package' $null = New-Item -ItemType Directory -Path $global:PraGate.Root -Force + . (Join-Path $PSScriptRoot 'IntegrityFixture.ps1') + $global:PraGate.Package = Join-Path $global:PraGate.Root 'package-fixture' + New-PraIntegrityFixture -SourcePackage $global:PraGate.Source -Destination $global:PraGate.Package -Changelog (Join-Path $global:PraGate.Release 'CHANGELOG.md') $env:PRA_GATE_NONET = 'SYNTHETIC-NO-NETWORK' $global:PraGate.AdSource = @' # SYNTHETIC fixture. No AD management assembly, provider, network or remoting. @@ -354,11 +358,9 @@ Export-ModuleMember -Function Get-ADSyncScheduler,Start-ADSyncSyncCycle foreach ($name in @('ActiveDirectory','ADSync')) { $null=New-Item -ItemType Directory -Path (Join-Path $modules $name) -Force } [IO.File]::WriteAllText((Join-Path $modules 'ActiveDirectory\ActiveDirectory.psm1'),$global:PraGate.AdSource,(New-Object Text.UTF8Encoding($true))) [IO.File]::WriteAllText((Join-Path $modules 'ADSync\ADSync.psm1'),$global:PraGate.SyncSource,(New-Object Text.UTF8Encoding($true))) - Copy-Item -LiteralPath (Join-Path $global:PraGate.Release 'Invoke-PraRemoteMailbox.ps1') -Destination $package - foreach ($name in @('PRA.Common.psm1','PRA.Backup.psm1','PRA.Directory.psm1')) { Copy-Item -LiteralPath (Join-Path $global:PraGate.Release ('module\'+$name)) -Destination (Join-Path $package 'module') } - Copy-Item -LiteralPath (Join-Path $global:PraGate.Release 'module\PRA.Gui.Directory.ps1') -Destination (Join-Path $package 'module') + Copy-Item -Path (Join-Path $global:PraGate.Package '*') -Destination $package -Recurse -Force [IO.File]::WriteAllText((Join-Path $package 'module\PRA.Cloud.psm1'),$global:PraGate.CloudSource,(New-Object Text.UTF8Encoding($true))) - Copy-Item -LiteralPath (Join-Path $global:PraGate.Release 'templates\Report.template.html') -Destination (Join-Path $package 'templates') -ErrorAction SilentlyContinue + Set-PraFixtureHash -Root $package -Relative 'module\PRA.Cloud.psm1' $users=@((New-GateUser 1),(New-GateUser 2)) if ($Shared13) { $users=@(1..13 | ForEach-Object { New-GateUser $_ }) @@ -592,23 +594,23 @@ exit `$code [pscustomobject]@{Path=$file.FullName;Bytes=$file.Length;SHA256=(Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash} } }) - $record=[ordered]@{Synthetic=$true;Name=$Name;Runtime=$Runtime.Root;Statistics=$Statistics;Artifacts=$artifacts;SourceHashes=@(foreach ($moduleName in @('PRA.Backup.psm1','PRA.Directory.psm1')) { Get-FileHash -LiteralPath (Join-Path $global:PraGate.Release ('module\'+$moduleName)) -Algorithm SHA256 | Select-Object Path,Hash })} + $record=[ordered]@{Synthetic=$true;Name=$Name;Runtime=$Runtime.Root;Statistics=$Statistics;Artifacts=$artifacts;SourceHashes=@(foreach ($moduleName in @('PRA.Backup.psm1','PRA.Directory.psm1')) { Get-FileHash -LiteralPath (Join-Path $global:PraGate.Package ('module\'+$moduleName)) -Algorithm SHA256 | Select-Object Path,Hash })} [IO.File]::WriteAllText((Join-Path $env:PRA_GATE_EVIDENCE ((Split-Path $Runtime.Root -Leaf)+'-'+$Name+'.oom.json')),($record | ConvertTo-Json -Depth 12),(New-Object Text.UTF8Encoding($true))) } - Import-Module (Join-Path $global:PraGate.Release 'module\PRA.Common.psm1') -Force -Global - Import-Module (Join-Path $global:PraGate.Release 'module\PRA.Backup.psm1') -Force -Global - Import-Module (Join-Path $global:PraGate.Release 'module\PRA.Directory.psm1') -Force -Global + Import-Module (Join-Path $global:PraGate.Package 'module\PRA.Common.psm1') -Force -Global + Import-Module (Join-Path $global:PraGate.Package 'module\PRA.Backup.psm1') -Force -Global + Import-Module (Join-Path $global:PraGate.Package 'module\PRA.Directory.psm1') -Force -Global } Describe 'Runtime disclaimer' -Tag 'Disclaimer' { It 'keeps public script help identical to the root runtime readme disclaimer' { - $readme = [IO.File]::ReadAllText((Join-Path $global:PraGate.Release 'README.md')).Replace("`r`n", "`n") + $readme = [IO.File]::ReadAllText((Join-Path $global:PraGate.Source 'README.md')).Replace("`r`n", "`n") $sections = [regex]::Matches($readme, '(?ms)^## Disclaimer\n\n(?.*?)(?=^## |\z)') $sections.Count | Should -Be 1 $canonical = $sections[0].Groups['Text'].Value.TrimEnd([char[]]"`n") $canonical | Should -Not -BeNullOrEmpty - $entry = Join-Path $global:PraGate.Release 'Invoke-PraRemoteMailbox.ps1' + $entry = Join-Path $global:PraGate.Source 'Invoke-PraRemoteMailbox.ps1' $notes = ((Get-Help $entry -Full).alertSet.alert.Text -join "`n").Replace("`r`n", "`n") $disclaimers = [regex]::Matches($notes, '(?ms)^Disclaimer:\n(?.*?)(?=\n\nRequires -Version|\z)') $disclaimers.Count | Should -Be 1 @@ -1023,7 +1025,7 @@ function Get-ADUser { Remove-Module PRA.Directory -Force -ErrorAction SilentlyContinue Get-Module ActiveDirectory -All | Remove-Module -Force -ErrorAction Stop Import-Module $adModulePath -Force -Global -ErrorAction Stop - Import-Module (Join-Path $global:PraGate.Release 'module\PRA.Directory.psm1') -Force -Global -ErrorAction Stop + Import-Module (Join-Path $global:PraGate.Package 'module\PRA.Directory.psm1') -Force -Global -ErrorAction Stop $directory=Get-Module PRA.Directory (Get-Command Get-ADUser).Module.Path | Should -BeExactly $adModulePath (& $directory { (Get-Command Get-ADUser).Module.Path }) | Should -BeExactly $adModulePath -Because 'the product module, not only the test scope, must resolve the subtree-aware fixture' @@ -1147,13 +1149,13 @@ Describe 'OOM data-only raw codec and historical compatibility' -Tag 'OOM' { } It 'uses real streaming writer/reader and forbids raw native graph deserialization' { $codec=Get-GateCodec - $codec.Path | Should -BeExactly (Join-Path $global:PraGate.Release 'module\PRA.Backup.psm1') + $codec.Path | Should -BeExactly (Join-Path $global:PraGate.Package 'module\PRA.Backup.psm1') $text=[IO.File]::ReadAllText($codec.Path) $text | Should -Match 'XmlWriter' $text | Should -Match 'XmlReader' $text | Should -Match 'CreateNew' $text | Should -Not -Match 'PSSerializer|Import-Clixml|ReadAllText|ReadAllBytes' - $directoryText=[IO.File]::ReadAllText((Join-Path $global:PraGate.Release 'module\PRA.Directory.psm1')) + $directoryText=[IO.File]::ReadAllText((Join-Path $global:PraGate.Package 'module\PRA.Directory.psm1')) $directoryText | Should -Not -Match 'PSSerializer|Import-Clixml|ReadAllText' $runtime=$global:PraGate.Runtime (Get-FileHash (Join-Path $runtime.Package 'module\PRA.Backup.psm1')).Hash | Should -Be (Get-FileHash $codec.Path).Hash @@ -2063,10 +2065,10 @@ Describe 'Common value and report contracts' { $outcome.Counts.Error | Should -Be 0 $outcome.Rows[0].PermMissing | Should -BeExactly '' $html=Get-PraReportHtml -Context $context -Outcome $outcome - $html | Should -Match '' - foreach ($header in @('Object','Type','Status','Active Directory','Licence group','Exchange Online','Permissions','Detail')) { $html | Should -Match ('') } - $html | Should -Match '
All columns' - $html | Should -Match '
' + $html | Should -Match ' & ''quotes'' "double" bold' -f $i } + elseif ($i % 71 -eq 4) { $detail = "Row {0}: first line`r`nsecond line`ttab`nthird line" -f $i } + elseif ($i % 499 -eq 11) { $detail = ('Row {0}: long detail ' -f $i) + ('0123456789abcdef' * 160) } + elseif ($i % 211 -eq 9) { $detail = '+SUM(1+1) leading plus, row {0}' -f $i } + $rows.Add([pscustomobject][ordered]@{ + ObjectGuid = ('{0:x8}-1111-2222-3333-{1:x12}' -f $i, ($i * 7)); SamAccountName = $sam; UserPrincipalName = ('{0}@contoso.example' -f $sam) + Action = 'Convert'; IsShared = $(if ($i % 50 -eq 0) { $null } else { ($i % 3) -eq 0 }); ADApplied = ($i % 4) -ne 0; ADVerified = $(if ($i % 9 -eq 0) { $false } else { $true }) + GroupAction = $(if ($i % 5 -eq 0) { $null } else { 'Added to the licence group' }); BackupPath = ('Backups\batch\{0}.json' -f $sam); LastOperation = @('AD.Apply','Cloud.Check','Perm.Verify')[$i % 3] + CloudMailbox = $(if ($i % 6 -eq 0) { $null } else { ($i % 2) -eq 0 }); CloudLicense = $(if ($i % 8 -eq 0) { $false } else { 'SKU-' + ($i % 4) }); CloudStatus = @('Provisioned','N/A','Pending sync','Deprovisioned')[$i % 4] + CloudDetail = $(if ($i % 13 -eq 0) { 'Cloud check {0}' -f $i } else { '' }); PreserveCloudMailbox = ($i % 7) -eq 0; PreserveLicense = ($i % 11) -eq 0; DeprovisionConfirmed = $(if ($i % 4 -eq 3) { $true } else { $false }) + PermDetail = $(if ($i % 3 -eq 0) { 'FullAccess 2; SendAs 1' } else { '' }); PermMissing = $(if ($i % 17 -eq 0) { @('FullAccess S-1-5-21-1-2-3-{0}' -f $i, 'SendAs missing') } else { @() }) + FinalStatus = $statuses[$i % $statuses.Count]; Detail = $detail; Warnings = $(if ($i % 13 -eq 1) { 'Permission entries ignored (row {0})' -f $i } else { $null }) + }) + } + return , $rows +} + +function global:New-PraSyntheticContext { + param([Parameter(Mandatory)][string]$PackageRoot, [Parameter(Mandatory)][int]$Rows, [int]$Issues = 0, [int]$Warnings = 0) + $context = @{ + Root = $PackageRoot; Action = 'Convert'; Phase = '1'; Mode = 'Preview'; Config = @{ Environment = 'SYNTHETIC' }; BatchId = 'SYNTHETIC-BATCH'; Server = 'dc.synthetic.example' + StartTime = (Get-Date).AddMinutes(-5); RunId = 'synthetic-run'; Version = '2.2.0'; NextSteps = @('Synthetic next step: nothing to run.'); ExitCode = 0; CloudConnectFailed = $false + Rows = (New-PraSyntheticRows -Count $Rows) + Issues = (New-Object 'Collections.Generic.List[object]'); WarningList = (New-Object 'Collections.Generic.List[object]') + } + for ($i = 0; $i -lt $Issues; $i++) { + $context.Issues.Add([pscustomobject]@{ Timestamp = (Get-Date).AddSeconds($i).ToString('o'); Phase = 'Phase 1'; Source = $(if ($i % 3 -eq 0) { 'Cloud' } else { 'Execution' }) + Operation = 'Op {0}' -f ($i % 5); Identity = ('issue{0:d5}@contoso.example' -f $i); Message = $(if ($i % 50 -eq 0) { "Issue {0}: html & `"quote`"`r`nsecond line" -f $i } else { 'Issue {0}: synthetic run error.' -f $i }) }) + } + for ($i = 0; $i -lt $Warnings; $i++) { + $context.WarningList.Add([pscustomobject]@{ Timestamp = (Get-Date).AddSeconds($i).ToString('o'); Phase = 'Phase 1'; Message = 'Warning {0}: synthetic.' -f $i }) + } + return $context +} + +function global:Invoke-PraSyntheticReport { + <# Writes the CSV and HTML reports of a synthetic run with Write-PraReport; returns timings and sizes. #> + param([Parameter(Mandatory)][string]$PackageRoot, [Parameter(Mandatory)][string]$Directory, [Parameter(Mandatory)][int]$Rows, [int]$Issues = 0, [int]$Warnings = 0, [string]$Name = 'report') + $null = New-Item -ItemType Directory -Path $Directory -Force + $context = New-PraSyntheticContext -PackageRoot $PackageRoot -Rows $Rows -Issues $Issues -Warnings $Warnings + $reports = @{ Csv = (Join-Path $Directory "$Name.csv"); Html = (Join-Path $Directory "$Name.html") } + $module = Get-Module PRA.Common + $process = [Diagnostics.Process]::GetCurrentProcess() + $cpu0 = $process.TotalProcessorTime; $clock = [Diagnostics.Stopwatch]::StartNew() + $outcomeClock = [Diagnostics.Stopwatch]::StartNew() + $outcome = & $module { param($c) Get-PraOutcome $c } $context + $outcomeMs = $outcomeClock.ElapsedMilliseconds + $htmlClock = [Diagnostics.Stopwatch]::StartNew() + & $module { + param($c, $o, $path) + $stream = [IO.File]::Open($path, [IO.FileMode]::Create, [IO.FileAccess]::Write, [IO.FileShare]::None) + $writer = New-Object IO.StreamWriter($stream, (New-Object Text.UTF8Encoding($true)), 65536) + try { Write-PraReportHtml -Context $c -Outcome $o -Writer $writer } finally { $writer.Dispose() } + } $context $outcome (Join-Path $Directory "$Name.htmlonly.html") + $htmlOnlyMs = $htmlClock.ElapsedMilliseconds + $fullClock = [Diagnostics.Stopwatch]::StartNew() + & $module { param($c, $r) Write-PraReport -Context $c -Reports $r } $context $reports + $fullMs = $fullClock.ElapsedMilliseconds + $clock.Stop(); $process.Refresh() + [pscustomobject]@{ + Rows = $Rows; Issues = $Issues; Warnings = $Warnings; Context = $context; Outcome = $outcome; Reports = $reports; HtmlOnlyPath = (Join-Path $Directory "$Name.htmlonly.html") + Metrics = [ordered]@{ + outcomeMs = $outcomeMs; htmlOnlyMs = $htmlOnlyMs; writeReportMs = $fullMs; totalWallMs = $clock.ElapsedMilliseconds + cpuSeconds = [math]::Round(($process.TotalProcessorTime - $cpu0).TotalSeconds, 1) + peakWorkingSetMB = [math]::Round($process.PeakWorkingSet64 / 1MB, 0); peakPagedMB = [math]::Round($process.PeakPagedMemorySize64 / 1MB, 0) + htmlBytes = (Get-Item -LiteralPath $reports.Html).Length; csvBytes = (Get-Item -LiteralPath $reports.Csv).Length + } + } +} + +function global:Read-PraReportData { + <# Decodes the data of a report file like the page does (gzip, base64) so tests can compare it with the outcome. #> + param([Parameter(Mandatory)][string]$Path) + $html = [IO.File]::ReadAllText($Path, [Text.Encoding]::UTF8) + $metaMatch = [regex]::Match($html, '') + if (-not $metaMatch.Success) { throw 'pra-meta not found' } + $meta = $metaMatch.Groups[1].Value | ConvertFrom-Json + $data = @{} + Add-Type -AssemblyName System.Web.Extensions + $serializer = New-Object Web.Script.Serialization.JavaScriptSerializer + $serializer.MaxJsonLength = [int]::MaxValue + foreach ($kind in @('rows','issues','warnings')) { + $spec = $meta.$kind + $data[$kind] = [pscustomobject]@{ Fields = @($spec.fields); Count = 0; Dict = @(for ($f = 0; $f -lt $spec.fields.Count; $f++) { ,(New-Object 'Collections.Generic.List[object]') }); Cols = @(for ($f = 0; $f -lt $spec.fields.Count; $f++) { ,(New-Object 'Collections.Generic.List[int]') }); Chunks = (New-Object 'Collections.Generic.List[int]') } + } + foreach ($m in [regex]::Matches($html, '')) { + $ds = $data[$m.Groups[1].Value] + $input = New-Object IO.MemoryStream (, [Convert]::FromBase64String($m.Groups[3].Value)) + $gz = New-Object IO.Compression.GZipStream($input, [IO.Compression.CompressionMode]::Decompress) + $reader = New-Object IO.StreamReader($gz, [Text.Encoding]::UTF8) + $chunk = $serializer.DeserializeObject($reader.ReadToEnd()) + $reader.Dispose() + $ds.Chunks.Add([int]$chunk['n']); $ds.Count += [int]$chunk['n'] + for ($f = 0; $f -lt $ds.Fields.Count; $f++) { + foreach ($v in $chunk['d'][$f]) { $ds.Dict[$f].Add($v) } + $ds.Cols[$f].AddRange([int[]]$chunk['c'][$f]) + } + } + [pscustomobject]@{ Meta = $meta; Data = $data; Html = $html } +} diff --git a/tools/Build-Documentation.ps1 b/tools/Build-Documentation.ps1 index 5d53346..e10c8f0 100644 --- a/tools/Build-Documentation.ps1 +++ b/tools/Build-Documentation.ps1 @@ -1,7 +1,7 @@ #Requires -Version 7.4 <# .SYNOPSIS - Builds docs\PraRemoteMailbox-Guide.html from docs\PraRemoteMailbox-Guide.md. + Builds package\docs\PraRemoteMailbox-Guide.html from package\docs\PraRemoteMailbox-Guide.md. .DESCRIPTION The Markdown guide stays readable as plain text (and on GitHub / Azure DevOps). This script @@ -38,8 +38,8 @@ param( ) $ErrorActionPreference = 'Stop' # Defaults here, not in param(): $PSScriptRoot can be empty in param() defaults (Windows PowerShell 5.1 with -File). -if (-not $Source) { $Source = Join-Path $PSScriptRoot '..\docs\PraRemoteMailbox-Guide.md' } -if (-not $Destination) { $Destination = Join-Path $PSScriptRoot '..\docs\PraRemoteMailbox-Guide.html' } +if (-not $Source) { $Source = Join-Path $PSScriptRoot '..\package\docs\PraRemoteMailbox-Guide.md' } +if (-not $Destination) { $Destination = Join-Path $PSScriptRoot '..\package\docs\PraRemoteMailbox-Guide.html' } $Source = (Resolve-Path $Source).Path $Destination = [IO.Path]::GetFullPath($Destination) $docs = Split-Path $Source -Parent diff --git a/tools/New-PraPackage.ps1 b/tools/New-PraPackage.ps1 index 3c07602..04ec25d 100644 --- a/tools/New-PraPackage.ps1 +++ b/tools/New-PraPackage.ps1 @@ -4,18 +4,27 @@ Copies the files needed to run PRA Remote Mailbox into a separate folder, ready to be zipped. .DESCRIPTION - The package contains only what Invoke-PraRemoteMailbox.ps1 needs at run time, plus the guide: - Invoke-PraRemoteMailbox.ps1, README.md, CHANGELOG.md, module\*.psm1 and PRA.Gui.xaml, templates\, - config\ (configuration + CSV samples), docs\PraRemoteMailbox-Guide.html and .md (with images) + The runtime lives in the package\ folder of the repository; the package keeps the same paths as the folder + that is extracted from the release ZIP (Invoke-PraRemoteMailbox.ps1 at its root, module\, config\, + templates\, docs\). The distribution contains only what Invoke-PraRemoteMailbox.ps1 needs at run time, + plus the guide: + Invoke-PraRemoteMailbox.ps1, PackageIntegrity.psd1, README.md, LICENSE, CHANGELOG.md (copied from the + repository root), module\ (modules, GUI, verifier and XAML), templates\, config\ (configuration and + CSV samples), docs\PraRemoteMailbox-Guide.html and .md (with images) It never copies Backups\, logs\, reports\, tests\ or tools\: backups hold AD values of real objects. + The package source and the finished package must pass the owner-signed integrity check + (module\Test-PackageIntegrity.ps1 and PackageIntegrity.psd1: exact SHA256 of every stable file). A source + that is unsigned or changed is refused before anything is written: there is no unsigned mode. + The configuration file is copied with the environment values emptied (DomainController, SearchBase, GroupDN, CsvPath, RoutingDomain, Licensing.GroupDN, EntraConnect.Server, TenantId, Organization, AppId, CertificateThumbprint, UserPrincipalName): the administrator fills them in - (guide, chapter 6). The script then checks that none of these values appears in the package. + (guide, chapter 6). The script then checks that none of these values appears in the package. The + configuration is data outside the integrity manifest. .PARAMETER Destination - Package folder. Default: package\PraRemoteMailbox-, next to the tool folder. + Package folder. Default: package\PraRemoteMailbox-, next to the repository folder. .PARAMETER Force Replace the destination folder if it already contains a package. A folder that contains a @@ -23,11 +32,11 @@ .EXAMPLE .\tools\New-PraPackage.ps1 - Creates ..\package\PraRemoteMailbox-2.1.0. + Creates ..\package\PraRemoteMailbox-2.2.0. .NOTES Author : Nicolas Fabert - Version : 2.1.0 + Version : 2.2.0 #> [CmdletBinding()] param( @@ -37,9 +46,30 @@ param( $ErrorActionPreference = 'Stop' $root = Split-Path $PSScriptRoot -Parent -$entry = Join-Path $root 'Invoke-PraRemoteMailbox.ps1' +$packageRoot = Join-Path $root 'package' +$entry = Join-Path $packageRoot 'Invoke-PraRemoteMailbox.ps1' $version = ([regex]::Match([IO.File]::ReadAllText($entry), "Version = '([0-9.]+)'")).Groups[1].Value -if (-not $version) { throw 'Version not found in Invoke-PraRemoteMailbox.ps1.' } +if (-not $version) { throw 'Version not found in package\Invoke-PraRemoteMailbox.ps1.' } + +function Assert-AuthenticatedPackage([string]$Path, [switch]$Distribution) { + $verifier = Join-Path $Path 'module\Test-PackageIntegrity.ps1' + $cursor = [IO.Path]::GetFullPath($verifier) + while ($cursor) { + $item = Microsoft.PowerShell.Management\Get-Item -LiteralPath $cursor -Force -ErrorAction Stop + if ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) { throw "Package integrity: reparse point: $cursor" } + $cursor = [IO.Path]::GetDirectoryName($cursor) + } + $signature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -LiteralPath $verifier -ErrorAction Stop + if ([string]$signature.Status -cne 'Valid' -or $null -eq $signature.SignerCertificate -or + $signature.SignerCertificate.Thumbprint -cne '0F28E442889F17B5F4D251E8F96E7CC6E2C9C6D6' -or + $null -eq $signature.TimeStamperCertificate) { + throw 'Package integrity: verifier must have the trusted, timestamped owner signature.' + } + if ($Distribution) { & $verifier -Root $Path -Distribution } else { & $verifier -Root $Path } +} +# The source is authenticated first: an unsigned or changed source never produces a package. +Assert-AuthenticatedPackage $packageRoot + if (-not $Destination) { $Destination = Join-Path (Split-Path $root -Parent) "package\PraRemoteMailbox-$version" } if (-not [IO.Path]::IsPathRooted($Destination)) { $Destination = Join-Path (Get-Location).Path $Destination } $Destination = [IO.Path]::GetFullPath($Destination).TrimEnd('\') @@ -55,15 +85,17 @@ if (Test-Path -LiteralPath $Destination) { Remove-Item -LiteralPath $Destination -Recurse -Force } -# ---- Files needed at run time --------------------------------------------------------------------------- +# ---- Files needed at run time (paths relative to package\, the same as in the extracted ZIP) ---------------- $files = New-Object 'Collections.Generic.List[string]' -foreach ($f in 'Invoke-PraRemoteMailbox.ps1', 'README.md', 'CHANGELOG.md', 'templates\Report.template.html', +foreach ($f in 'Invoke-PraRemoteMailbox.ps1', 'PackageIntegrity.psd1', 'README.md', 'LICENSE', 'CHANGELOG.md', 'templates\Report.template.html', 'config\Targets.sample.csv', 'config\SharedPermissions.sample.csv', 'docs\PraRemoteMailbox-Guide.html', 'docs\PraRemoteMailbox-Guide.md') { $files.Add($f) } -foreach ($m in 'PRA.Common.psm1', 'PRA.Directory.psm1', 'PRA.Backup.psm1', 'PRA.Cloud.psm1', 'PRA.Gui.psm1', 'PRA.Gui.xaml', 'PRA.Gui.Directory.ps1') { $files.Add("module\$m") } -Get-ChildItem -LiteralPath (Join-Path $root 'docs\images') -File -ErrorAction SilentlyContinue | ForEach-Object { $files.Add('docs\images\' + $_.Name) } +foreach ($m in 'PRA.Common.psm1', 'PRA.Directory.psm1', 'PRA.Backup.psm1', 'PRA.Cloud.psm1', 'PRA.Gui.psm1', 'PRA.Gui.xaml', 'PRA.Gui.Directory.ps1', 'Test-PackageIntegrity.ps1') { $files.Add("module\$m") } +Get-ChildItem -LiteralPath (Join-Path $packageRoot 'docs\images') -File -ErrorAction SilentlyContinue | ForEach-Object { $files.Add('docs\images\' + $_.Name) } +if (@($files | Select-Object -Unique).Count -ne $files.Count) { throw 'Package integrity: duplicate distribution file path.' } foreach ($f in $files) { - $source = Join-Path $root $f + # CHANGELOG.md is the only file copied from the repository root; it is hashed by the manifest. + $source = if ($f -eq 'CHANGELOG.md') { Join-Path $root $f } else { Join-Path $packageRoot $f } if (-not (Test-Path -LiteralPath $source -PathType Leaf)) { throw "Missing file in the tool folder: $f" } $target = Join-Path $Destination $f [void][IO.Directory]::CreateDirectory((Split-Path $target -Parent)) @@ -72,7 +104,7 @@ foreach ($f in $files) { # ---- Configuration with the environment values emptied --------------------------------------------------- $configRelative = 'config\PraRemoteMailbox.config.psd1' -$config = [IO.File]::ReadAllText((Join-Path $root $configRelative), [Text.Encoding]::UTF8) +$config = [IO.File]::ReadAllText((Join-Path $packageRoot $configRelative), [Text.Encoding]::UTF8) $emptied = New-Object 'Collections.Generic.List[string]' $keys = @( @{ Key='DomainController'; Count=1 }, @{ Key='SearchBase'; Count=1 }, @{ Key='GroupDN'; Count=2 }, @{ Key='CsvPath'; Count=2 }, @@ -110,13 +142,19 @@ foreach ($value in ($emptied | Select-Object -Unique)) { } $check = Import-PowerShellDataFile -LiteralPath $configTarget if ($check.Cloud.TenantId -or $check.Cloud.AppId) { $problems.Add('Tenant values are still in the packaged configuration.') } +$delivered = @(Get-ChildItem -LiteralPath $Destination -Recurse -File | ForEach-Object { $_.FullName.Substring($Destination.Length + 1) }) +foreach ($extra in @($delivered | Where-Object { $_ -notin $files })) { $problems.Add("Unexpected file in the package: $extra") } +foreach ($missing in @($files | Where-Object { $_ -notin $delivered })) { $problems.Add("Expected file missing from the package: $missing") } if ($problems.Count) { throw ("Package not valid ($Destination):`n - " + ($problems -join "`n - ")) } +try { Assert-AuthenticatedPackage $Destination -Distribution } +catch { Remove-Item -LiteralPath $Destination -Recurse -Force -ErrorAction SilentlyContinue; throw } $all = Get-ChildItem -LiteralPath $Destination -Recurse -File Write-Host '' Write-Host " PRA Remote Mailbox $version - package ready" -ForegroundColor Green Write-Host " Folder : $Destination" Write-Host (" Content : {0} files, {1:N1} MB" -f $all.Count, (($all | Measure-Object Length -Sum).Sum / 1MB)) +Write-Host " Integrity: owner signatures and SHA256 inventory verified" Write-Host " Config : environment values emptied ($(@($emptied | Select-Object -Unique).Count)) - fill in the configuration (guide, chapter 6)" Write-Host '' $all | Sort-Object FullName | ForEach-Object { ' {0,12:N0} {1}' -f $_.Length, $_.FullName.Substring($Destination.Length + 1) } diff --git a/tools/New-ReadmeImages.ps1 b/tools/New-ReadmeImages.ps1 index 465e883..b932ca6 100644 --- a/tools/New-ReadmeImages.ps1 +++ b/tools/New-ReadmeImages.ps1 @@ -7,7 +7,7 @@ Uses the guide's CSS and icon table, with the Purview README banner layout. Runs Microsoft Edge locally; no Exchange, tenant or lab connection is made. .PARAMETER OutputFolder - Defaults to docs\images. Only readme-banner-light.png and readme-banner-dark.png are written. + Defaults to package\docs\images. Only readme-banner-light.png and readme-banner-dark.png are written. .NOTES Author: Nicolas Fabert Repository documentation tool; not included in the runtime package. @@ -17,13 +17,13 @@ param([string]$OutputFolder) $ErrorActionPreference = 'Stop' $root = Split-Path $PSScriptRoot -Parent -if (-not $OutputFolder) { $OutputFolder = Join-Path $root 'docs\images' } +if (-not $OutputFolder) { $OutputFolder = Join-Path $root 'package\docs\images' } $OutputFolder = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($OutputFolder) -$runtime = [IO.File]::ReadAllText((Join-Path $root 'Invoke-PraRemoteMailbox.ps1')) +$runtime = [IO.File]::ReadAllText((Join-Path $root 'package\Invoke-PraRemoteMailbox.ps1')) $versions = [regex]::Matches($runtime, '(?m)^\s*Version\s*:\s*(\d+\.\d+\.\d+)\s*$') if ($versions.Count -ne 1) { throw 'A unique runtime version was not found in Invoke-PraRemoteMailbox.ps1.' } $version = $versions[0].Groups[1].Value -$guide = [IO.File]::ReadAllText((Join-Path $root 'docs\PraRemoteMailbox-Guide.md')) +$guide = [IO.File]::ReadAllText((Join-Path $root 'package\docs\PraRemoteMailbox-Guide.md')) $guideVersion = [regex]::Match($guide, '(?m)^version:\s*(\S+)').Groups[1].Value if ($guideVersion -ne $version) { throw "Guide version $guideVersion differs from runtime version $version." } @@ -43,7 +43,7 @@ function Get-ReadmeIcon([string]$Name, [string]$Class = 'icon') { if (-not $icons.ContainsKey($Name)) { throw "Unknown guide icon: $Name" } "$($icons[$Name])" } -$guideHtml = [IO.File]::ReadAllText((Join-Path $root 'docs\PraRemoteMailbox-Guide.html')) +$guideHtml = [IO.File]::ReadAllText((Join-Path $root 'package\docs\PraRemoteMailbox-Guide.html')) $css = [regex]::Match($guideHtml, '(?s)').Groups[1].Value if (-not $css) { throw 'Guide CSS was not found. Build the HTML guide first.' } $css += @'
'+[regex]::Escape($header)+'PermMissing